--- linux-rt-2.6.31.orig/Makefile
+++ linux-rt-2.6.31/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 31
-EXTRAVERSION =
+EXTRAVERSION = .12
 NAME = Man-Eating Seals of Antiquity
 
 # *DOCUMENTATION*
@@ -330,14 +330,23 @@
 AFLAGS_KERNEL	=
 CFLAGS_GCOV	= -fprofile-arcs -ftest-coverage
 
+# Prefer linux-backports-modules
+ifneq ($(KBUILD_SRC),)
+ifneq ($(shell if test -e $(KBUILD_OUTPUT)/ubuntu-build; then echo yes; fi),yes)
+UBUNTUINCLUDE := -I/usr/src/linux-headers-lbm-$(KERNELRELEASE)
+endif
+endif
 
 # Use LINUXINCLUDE when you must reference the include/ directory.
 # Needed to be compatible with the O= option
-LINUXINCLUDE    := -Iinclude \
+LINUXINCLUDE    := $(UBUNTUINCLUDE) -Iinclude \
                    $(if $(KBUILD_SRC),-Iinclude2 -I$(srctree)/include) \
                    -I$(srctree)/arch/$(hdr-arch)/include               \
                    -include include/linux/autoconf.h
 
+# UBUNTU: Include our third party driver stuff too
+LINUXINCLUDE   += -Iubuntu/include $(if $(KBUILD_SRC),-I$(srctree)/ubuntu/include)
+
 KBUILD_CPPFLAGS := -D__KERNEL__
 
 KBUILD_CFLAGS   := -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \
@@ -467,7 +476,7 @@
 
 # Objects we will link into vmlinux / subdirs we need to visit
 init-y		:= init/
-drivers-y	:= drivers/ sound/ firmware/
+drivers-y	:= drivers/ sound/ firmware/ ubuntu/
 net-y		:= net/
 libs-y		:= lib/
 core-y		:= usr/
@@ -980,11 +989,6 @@
 # All the preparing..
 prepare: prepare0
 
-# Leave this as default for preprocessing vmlinux.lds.S, which is now
-# done in arch/$(ARCH)/kernel/Makefile
-
-export CPPFLAGS_vmlinux.lds += -P -C -U$(ARCH)
-
 # The asm symlink changes when $(ARCH) changes.
 # Detect this and ask user to run make mrproper
 # If asm is a stale symlink (point to dir that does not exist) remove it
--- linux-rt-2.6.31.orig/MAINTAINERS
+++ linux-rt-2.6.31/MAINTAINERS
@@ -897,6 +897,12 @@
 S:	Maintained
 F:	drivers/net/wireless/ath/ar9170/
 
+ATK0110 HWMON DRIVER
+M:	Luca Tettamanti <kronos.it@gmail.com>
+L:	lm-sensors@lm-sensors.org
+S:	Maintained
+F:	drivers/hwmon/asus_atk0110.c
+
 ATI_REMOTE2 DRIVER
 M:	Ville Syrjala <syrjala@sci.fi>
 S:	Maintained
@@ -1986,7 +1992,7 @@
 F:	fs/*
 
 FINTEK F75375S HARDWARE MONITOR AND FAN CONTROLLER DRIVER
-M:	Riku Voipio <riku.vipio@iki.fi>
+M:	Riku Voipio <riku.voipio@iki.fi>
 L:	lm-sensors@lm-sensors.org
 S:	Maintained
 F:	drivers/hwmon/f75375s.c
--- linux-rt-2.6.31.orig/virt/kvm/kvm_main.c
+++ linux-rt-2.6.31/virt/kvm/kvm_main.c
@@ -2590,8 +2590,6 @@
 	int r;
 	int cpu;
 
-	kvm_init_debug();
-
 	r = kvm_arch_init(opaque);
 	if (r)
 		goto out_fail;
@@ -2658,6 +2656,8 @@
 	kvm_preempt_ops.sched_in = kvm_sched_in;
 	kvm_preempt_ops.sched_out = kvm_sched_out;
 
+	kvm_init_debug();
+
 	return 0;
 
 out_free:
@@ -2679,7 +2679,6 @@
 	__free_page(bad_page);
 out:
 	kvm_arch_exit();
-	kvm_exit_debug();
 out_fail:
 	return r;
 }
@@ -2688,6 +2687,7 @@
 void kvm_exit(void)
 {
 	kvm_trace_cleanup();
+	kvm_exit_debug();
 	misc_deregister(&kvm_dev);
 	kmem_cache_destroy(kvm_vcpu_cache);
 	sysdev_unregister(&kvm_sysdev);
@@ -2697,7 +2697,6 @@
 	on_each_cpu(hardware_disable, NULL, 1);
 	kvm_arch_hardware_unsetup();
 	kvm_arch_exit();
-	kvm_exit_debug();
 	free_cpumask_var(cpus_hardware_enabled);
 	__free_page(bad_page);
 }
--- linux-rt-2.6.31.orig/virt/kvm/ioapic.c
+++ linux-rt-2.6.31/virt/kvm/ioapic.c
@@ -188,6 +188,8 @@
 			if ((edge && old_irr != ioapic->irr) ||
 			    (!edge && !entry.fields.remote_irr))
 				ret = ioapic_service(ioapic, irq);
+			else
+				ret = 0; /* report coalesced interrupt */
 		}
 	}
 	return ret;
--- linux-rt-2.6.31.orig/drivers/s390/block/dasd_diag.c
+++ linux-rt-2.6.31/drivers/s390/block/dasd_diag.c
@@ -145,6 +145,15 @@
 
 	mdsk_term_io(device);
 	rc = mdsk_init_io(device, device->block->bp_block, 0, NULL);
+	if (rc == 4) {
+		if (!(device->features & DASD_FEATURE_READONLY)) {
+			dev_warn(&device->cdev->dev,
+				 "The access mode of a DIAG device changed"
+				 " to read-only");
+			device->features |= DASD_FEATURE_READONLY;
+		}
+		rc = 0;
+	}
 	if (rc)
 		dev_warn(&device->cdev->dev, "DIAG ERP failed with "
 			    "rc=%d\n", rc);
@@ -433,16 +442,20 @@
 	for (sb = 512; sb < bsize; sb = sb << 1)
 		block->s2b_shift++;
 	rc = mdsk_init_io(device, block->bp_block, 0, NULL);
-	if (rc) {
+	if (rc && (rc != 4)) {
 		dev_warn(&device->cdev->dev, "DIAG initialization "
 			"failed with rc=%d\n", rc);
 		rc = -EIO;
 	} else {
+		if (rc == 4)
+			device->features |= DASD_FEATURE_READONLY;
 		dev_info(&device->cdev->dev,
-			 "New DASD with %ld byte/block, total size %ld KB\n",
+			 "New DASD with %ld byte/block, total size %ld KB%s\n",
 			 (unsigned long) block->bp_block,
 			 (unsigned long) (block->blocks <<
-					  block->s2b_shift) >> 1);
+					  block->s2b_shift) >> 1,
+			 (rc == 4) ? ", read-only device" : "");
+		rc = 0;
 	}
 out_label:
 	free_page((long) label);
--- linux-rt-2.6.31.orig/drivers/mfd/ab3100-core.c
+++ linux-rt-2.6.31/drivers/mfd/ab3100-core.c
@@ -643,7 +643,7 @@
 	u8 setting;
 };
 
-static const struct ab3100_init_setting __initdata
+static const struct ab3100_init_setting __initconst
 ab3100_init_settings[] = {
 	{
 		.abreg = AB3100_MCA,
--- linux-rt-2.6.31.orig/drivers/ide/cmd64x.c
+++ linux-rt-2.6.31/drivers/ide/cmd64x.c
@@ -379,7 +379,8 @@
 		.enablebits	= {{0x00,0x00,0x00}, {0x51,0x08,0x08}},
 		.port_ops	= &cmd64x_port_ops,
 		.host_flags	= IDE_HFLAG_CLEAR_SIMPLEX |
-				  IDE_HFLAG_ABUSE_PREFETCH,
+				  IDE_HFLAG_ABUSE_PREFETCH |
+				  IDE_HFLAG_SERIALIZE,
 		.pio_mask	= ATA_PIO5,
 		.mwdma_mask	= ATA_MWDMA2,
 		.udma_mask	= 0x00, /* no udma */
@@ -389,7 +390,8 @@
 		.init_chipset	= init_chipset_cmd64x,
 		.enablebits	= {{0x51,0x04,0x04}, {0x51,0x08,0x08}},
 		.port_ops	= &cmd648_port_ops,
-		.host_flags	= IDE_HFLAG_ABUSE_PREFETCH,
+		.host_flags	= IDE_HFLAG_ABUSE_PREFETCH |
+				  IDE_HFLAG_SERIALIZE,
 		.pio_mask	= ATA_PIO5,
 		.mwdma_mask	= ATA_MWDMA2,
 		.udma_mask	= ATA_UDMA2,
--- linux-rt-2.6.31.orig/drivers/ide/slc90e66.c
+++ linux-rt-2.6.31/drivers/ide/slc90e66.c
@@ -91,8 +91,7 @@
 
 		if (!(reg48 & u_flag))
 			pci_write_config_word(dev, 0x48, reg48|u_flag);
-		/* FIXME: (reg4a & a_speed) ? */
-		if ((reg4a & u_speed) != u_speed) {
+		if ((reg4a & a_speed) != u_speed) {
 			pci_write_config_word(dev, 0x4a, reg4a & ~a_speed);
 			pci_read_config_word(dev, 0x4a, &reg4a);
 			pci_write_config_word(dev, 0x4a, reg4a|u_speed);
--- linux-rt-2.6.31.orig/drivers/ide/ide-ioctls.c
+++ linux-rt-2.6.31/drivers/ide/ide-ioctls.c
@@ -162,7 +162,7 @@
 	if (tf->command == ATA_CMD_SET_FEATURES &&
 	    tf->feature == SETFEATURES_XFER &&
 	    tf->nsect >= XFER_SW_DMA_0) {
-		xfer_rate = ide_find_dma_mode(drive, XFER_UDMA_6);
+		xfer_rate = ide_find_dma_mode(drive, tf->nsect);
 		if (xfer_rate != tf->nsect) {
 			err = -EINVAL;
 			goto abort;
--- linux-rt-2.6.31.orig/drivers/ide/ide-probe.c
+++ linux-rt-2.6.31/drivers/ide/ide-probe.c
@@ -1035,15 +1035,6 @@
 		if (port_ops && port_ops->init_dev)
 			port_ops->init_dev(drive);
 	}
-
-	ide_port_for_each_dev(i, drive, hwif) {
-		/*
-		 * default to PIO Mode 0 before we figure out
-		 * the most suited mode for the attached device
-		 */
-		if (port_ops && port_ops->set_pio_mode)
-			port_ops->set_pio_mode(drive, 0);
-	}
 }
 
 static void ide_init_port(ide_hwif_t *hwif, unsigned int port,
--- linux-rt-2.6.31.orig/drivers/ide/sis5513.c
+++ linux-rt-2.6.31/drivers/ide/sis5513.c
@@ -2,7 +2,7 @@
  * Copyright (C) 1999-2000	Andre Hedrick <andre@linux-ide.org>
  * Copyright (C) 2002		Lionel Bouton <Lionel.Bouton@inet6.fr>, Maintainer
  * Copyright (C) 2003		Vojtech Pavlik <vojtech@suse.cz>
- * Copyright (C) 2007		Bartlomiej Zolnierkiewicz
+ * Copyright (C) 2007-2009	Bartlomiej Zolnierkiewicz
  *
  * May be copied or modified under the terms of the GNU General Public License
  *
@@ -281,11 +281,13 @@
 
 	pci_read_config_byte(dev, 0x4b, &reg4bh);
 
+	rw_prefetch = reg4bh & ~(0x11 << drive->dn);
+
 	if (drive->media == ide_disk)
-		rw_prefetch = 0x11 << drive->dn;
+		rw_prefetch |= 0x11 << drive->dn;
 
-	if ((reg4bh & (0x11 << drive->dn)) != rw_prefetch)
-		pci_write_config_byte(dev, 0x4b, reg4bh|rw_prefetch);
+	if (reg4bh != rw_prefetch)
+		pci_write_config_byte(dev, 0x4b, rw_prefetch);
 }
 
 static void sis_set_pio_mode(ide_drive_t *drive, const u8 pio)
--- linux-rt-2.6.31.orig/drivers/pcmcia/omap_cf.c
+++ linux-rt-2.6.31/drivers/pcmcia/omap_cf.c
@@ -334,7 +334,7 @@
 
 static int omap_cf_suspend(struct platform_device *pdev, pm_message_t mesg)
 {
-	return pcmcia_socket_dev_suspend(&pdev->dev, mesg);
+	return pcmcia_socket_dev_suspend(&pdev->dev);
 }
 
 static int omap_cf_resume(struct platform_device *pdev)
--- linux-rt-2.6.31.orig/drivers/pcmcia/yenta_socket.c
+++ linux-rt-2.6.31/drivers/pcmcia/yenta_socket.c
@@ -1225,60 +1225,81 @@
 }
 
 #ifdef CONFIG_PM
-static int yenta_dev_suspend (struct pci_dev *dev, pm_message_t state)
+static int yenta_dev_suspend_noirq(struct device *dev)
 {
-	struct yenta_socket *socket = pci_get_drvdata(dev);
+	struct pci_dev *pdev = to_pci_dev(dev);
+	struct yenta_socket *socket = pci_get_drvdata(pdev);
 	int ret;
 
-	ret = pcmcia_socket_dev_suspend(&dev->dev, state);
+	ret = pcmcia_socket_dev_suspend(dev);
 
-	if (socket) {
-		if (socket->type && socket->type->save_state)
-			socket->type->save_state(socket);
-
-		/* FIXME: pci_save_state needs to have a better interface */
-		pci_save_state(dev);
-		pci_read_config_dword(dev, 16*4, &socket->saved_state[0]);
-		pci_read_config_dword(dev, 17*4, &socket->saved_state[1]);
-		pci_disable_device(dev);
-
-		/*
-		 * Some laptops (IBM T22) do not like us putting the Cardbus
-		 * bridge into D3.  At a guess, some other laptop will
-		 * probably require this, so leave it commented out for now.
-		 */
-		/* pci_set_power_state(dev, 3); */
-	}
+	if (!socket)
+		return ret;
+
+	if (socket->type && socket->type->save_state)
+		socket->type->save_state(socket);
+
+	pci_save_state(pdev);
+	pci_read_config_dword(pdev, 16*4, &socket->saved_state[0]);
+	pci_read_config_dword(pdev, 17*4, &socket->saved_state[1]);
+	pci_disable_device(pdev);
+
+	/*
+	 * Some laptops (IBM T22) do not like us putting the Cardbus
+	 * bridge into D3.  At a guess, some other laptop will
+	 * probably require this, so leave it commented out for now.
+	 */
+	/* pci_set_power_state(dev, 3); */
 
 	return ret;
 }
 
-
-static int yenta_dev_resume (struct pci_dev *dev)
+static int yenta_dev_resume_noirq(struct device *dev)
 {
-	struct yenta_socket *socket = pci_get_drvdata(dev);
+	struct pci_dev *pdev = to_pci_dev(dev);
+	struct yenta_socket *socket = pci_get_drvdata(pdev);
+	int ret;
 
-	if (socket) {
-		int rc;
+	if (!socket)
+		return 0;
 
-		pci_set_power_state(dev, 0);
-		/* FIXME: pci_restore_state needs to have a better interface */
-		pci_restore_state(dev);
-		pci_write_config_dword(dev, 16*4, socket->saved_state[0]);
-		pci_write_config_dword(dev, 17*4, socket->saved_state[1]);
+	pci_write_config_dword(pdev, 16*4, socket->saved_state[0]);
+	pci_write_config_dword(pdev, 17*4, socket->saved_state[1]);
 
-		rc = pci_enable_device(dev);
-		if (rc)
-			return rc;
+	ret = pci_enable_device(pdev);
+	if (ret)
+		return ret;
 
-		pci_set_master(dev);
+	pci_set_master(pdev);
 
-		if (socket->type && socket->type->restore_state)
-			socket->type->restore_state(socket);
-	}
+	if (socket->type && socket->type->restore_state)
+		socket->type->restore_state(socket);
 
-	return pcmcia_socket_dev_resume(&dev->dev);
+	pcmcia_socket_dev_early_resume(dev);
+	return 0;
 }
+
+static int yenta_dev_resume(struct device *dev)
+{
+	pcmcia_socket_dev_late_resume(dev);
+	return 0;
+}
+
+static struct dev_pm_ops yenta_pm_ops = {
+	.suspend_noirq = yenta_dev_suspend_noirq,
+	.resume_noirq = yenta_dev_resume_noirq,
+	.resume = yenta_dev_resume,
+	.freeze_noirq = yenta_dev_suspend_noirq,
+	.thaw_noirq = yenta_dev_resume_noirq,
+	.thaw = yenta_dev_resume,
+	.poweroff_noirq = yenta_dev_suspend_noirq,
+	.restore_noirq = yenta_dev_resume_noirq,
+	.restore = yenta_dev_resume,
+};
+
+#define YENTA_PM_OPS	(&yenta_pm_ops)
+#else
+#define YENTA_PM_OPS	NULL
 #endif
 
 #define CB_ID(vend,dev,type)				\
@@ -1376,10 +1397,7 @@
 	.id_table	= yenta_table,
 	.probe		= yenta_probe,
 	.remove		= __devexit_p(yenta_close),
-#ifdef CONFIG_PM
-	.suspend	= yenta_dev_suspend,
-	.resume		= yenta_dev_resume,
-#endif
+	.driver.pm	= YENTA_PM_OPS,
 };
 
 
--- linux-rt-2.6.31.orig/drivers/pcmcia/cs.c
+++ linux-rt-2.6.31/drivers/pcmcia/cs.c
@@ -98,10 +98,13 @@
  * These functions check for the appropriate struct pcmcia_soket arrays,
  * and pass them to the low-level functions pcmcia_{suspend,resume}_socket
  */
+static int socket_early_resume(struct pcmcia_socket *skt);
+static int socket_late_resume(struct pcmcia_socket *skt);
 static int socket_resume(struct pcmcia_socket *skt);
 static int socket_suspend(struct pcmcia_socket *skt);
 
-int pcmcia_socket_dev_suspend(struct device *dev, pm_message_t state)
+static void pcmcia_socket_dev_run(struct device *dev,
+				  int (*cb)(struct pcmcia_socket *))
 {
 	struct pcmcia_socket *socket;
 
@@ -110,29 +113,34 @@
 		if (socket->dev.parent != dev)
 			continue;
 		mutex_lock(&socket->skt_mutex);
-		socket_suspend(socket);
+		cb(socket);
 		mutex_unlock(&socket->skt_mutex);
 	}
 	up_read(&pcmcia_socket_list_rwsem);
+}
 
+int pcmcia_socket_dev_suspend(struct device *dev)
+{
+	pcmcia_socket_dev_run(dev, socket_suspend);
 	return 0;
 }
 EXPORT_SYMBOL(pcmcia_socket_dev_suspend);
 
-int pcmcia_socket_dev_resume(struct device *dev)
+void pcmcia_socket_dev_early_resume(struct device *dev)
 {
-	struct pcmcia_socket *socket;
+	pcmcia_socket_dev_run(dev, socket_early_resume);
+}
+EXPORT_SYMBOL(pcmcia_socket_dev_early_resume);
 
-	down_read(&pcmcia_socket_list_rwsem);
-	list_for_each_entry(socket, &pcmcia_socket_list, socket_list) {
-		if (socket->dev.parent != dev)
-			continue;
-		mutex_lock(&socket->skt_mutex);
-		socket_resume(socket);
-		mutex_unlock(&socket->skt_mutex);
-	}
-	up_read(&pcmcia_socket_list_rwsem);
+void pcmcia_socket_dev_late_resume(struct device *dev)
+{
+	pcmcia_socket_dev_run(dev, socket_late_resume);
+}
+EXPORT_SYMBOL(pcmcia_socket_dev_late_resume);
 
+int pcmcia_socket_dev_resume(struct device *dev)
+{
+	pcmcia_socket_dev_run(dev, socket_resume);
 	return 0;
 }
 EXPORT_SYMBOL(pcmcia_socket_dev_resume);
@@ -546,29 +554,24 @@
 	return 0;
 }
 
-/*
- * Resume a socket.  If a card is present, verify its CIS against
- * our cached copy.  If they are different, the card has been
- * replaced, and we need to tell the drivers.
- */
-static int socket_resume(struct pcmcia_socket *skt)
+static int socket_early_resume(struct pcmcia_socket *skt)
 {
-	int ret;
-
-	if (!(skt->state & SOCKET_SUSPEND))
-		return -EBUSY;
-
 	skt->socket = dead_socket;
 	skt->ops->init(skt);
 	skt->ops->set_socket(skt, &skt->socket);
+	if (skt->state & SOCKET_PRESENT)
+		skt->resume_status = socket_setup(skt, resume_delay);
+	return 0;
+}
 
+static int socket_late_resume(struct pcmcia_socket *skt)
+{
 	if (!(skt->state & SOCKET_PRESENT)) {
 		skt->state &= ~SOCKET_SUSPEND;
 		return socket_insert(skt);
 	}
 
-	ret = socket_setup(skt, resume_delay);
-	if (ret == 0) {
+	if (skt->resume_status == 0) {
 		/*
 		 * FIXME: need a better check here for cardbus cards.
 		 */
@@ -596,6 +599,20 @@
 	return 0;
 }
 
+/*
+ * Resume a socket.  If a card is present, verify its CIS against
+ * our cached copy.  If they are different, the card has been
+ * replaced, and we need to tell the drivers.
+ */
+static int socket_resume(struct pcmcia_socket *skt)
+{
+	if (!(skt->state & SOCKET_SUSPEND))
+		return -EBUSY;
+
+	socket_early_resume(skt);
+	return socket_late_resume(skt);
+}
+
 static void socket_remove(struct pcmcia_socket *skt)
 {
 	dev_printk(KERN_NOTICE, &skt->dev,
--- linux-rt-2.6.31.orig/drivers/pcmcia/m32r_pcc.c
+++ linux-rt-2.6.31/drivers/pcmcia/m32r_pcc.c
@@ -675,7 +675,7 @@
 static int pcc_drv_pcmcia_suspend(struct platform_device *dev,
 				     pm_message_t state)
 {
-	return pcmcia_socket_dev_suspend(&dev->dev, state);
+	return pcmcia_socket_dev_suspend(&dev->dev);
 }
 
 static int pcc_drv_pcmcia_resume(struct platform_device *dev)
--- linux-rt-2.6.31.orig/drivers/pcmcia/cardbus.c
+++ linux-rt-2.6.31/drivers/pcmcia/cardbus.c
@@ -214,7 +214,7 @@
 	unsigned int max, pass;
 
 	s->functions = pci_scan_slot(bus, PCI_DEVFN(0, 0));
-//	pcibios_fixup_bus(bus);
+	pci_fixup_cardbus(bus);
 
 	max = bus->secondary;
 	for (pass = 0; pass < 2; pass++)
--- linux-rt-2.6.31.orig/drivers/pcmcia/sa1100_generic.c
+++ linux-rt-2.6.31/drivers/pcmcia/sa1100_generic.c
@@ -89,7 +89,7 @@
 static int sa11x0_drv_pcmcia_suspend(struct platform_device *dev,
 				     pm_message_t state)
 {
-	return pcmcia_socket_dev_suspend(&dev->dev, state);
+	return pcmcia_socket_dev_suspend(&dev->dev);
 }
 
 static int sa11x0_drv_pcmcia_resume(struct platform_device *dev)
--- linux-rt-2.6.31.orig/drivers/pcmcia/pxa2xx_base.c
+++ linux-rt-2.6.31/drivers/pcmcia/pxa2xx_base.c
@@ -302,7 +302,7 @@
 
 static int pxa2xx_drv_pcmcia_suspend(struct platform_device *dev, pm_message_t state)
 {
-	return pcmcia_socket_dev_suspend(&dev->dev, state);
+	return pcmcia_socket_dev_suspend(&dev->dev);
 }
 
 static int pxa2xx_drv_pcmcia_resume(struct platform_device *dev)
--- linux-rt-2.6.31.orig/drivers/pcmcia/at91_cf.c
+++ linux-rt-2.6.31/drivers/pcmcia/at91_cf.c
@@ -363,7 +363,7 @@
 	struct at91_cf_socket	*cf = platform_get_drvdata(pdev);
 	struct at91_cf_data	*board = cf->board;
 
-	pcmcia_socket_dev_suspend(&pdev->dev, mesg);
+	pcmcia_socket_dev_suspend(&pdev->dev);
 	if (device_may_wakeup(&pdev->dev)) {
 		enable_irq_wake(board->det_pin);
 		if (board->irq_pin)
--- linux-rt-2.6.31.orig/drivers/pcmcia/vrc4171_card.c
+++ linux-rt-2.6.31/drivers/pcmcia/vrc4171_card.c
@@ -707,7 +707,7 @@
 static int vrc4171_card_suspend(struct platform_device *dev,
 				     pm_message_t state)
 {
-	return pcmcia_socket_dev_suspend(&dev->dev, state);
+	return pcmcia_socket_dev_suspend(&dev->dev);
 }
 
 static int vrc4171_card_resume(struct platform_device *dev)
--- linux-rt-2.6.31.orig/drivers/pcmcia/sa1111_generic.c
+++ linux-rt-2.6.31/drivers/pcmcia/sa1111_generic.c
@@ -159,7 +159,7 @@
 
 static int pcmcia_suspend(struct sa1111_dev *dev, pm_message_t state)
 {
-	return pcmcia_socket_dev_suspend(&dev->dev, state);
+	return pcmcia_socket_dev_suspend(&dev->dev);
 }
 
 static int pcmcia_resume(struct sa1111_dev *dev)
--- linux-rt-2.6.31.orig/drivers/pcmcia/au1000_generic.c
+++ linux-rt-2.6.31/drivers/pcmcia/au1000_generic.c
@@ -515,7 +515,7 @@
 static int au1x00_drv_pcmcia_suspend(struct platform_device *dev,
 				     pm_message_t state)
 {
-	return pcmcia_socket_dev_suspend(&dev->dev, state);
+	return pcmcia_socket_dev_suspend(&dev->dev);
 }
 
 static int au1x00_drv_pcmcia_resume(struct platform_device *dev)
--- linux-rt-2.6.31.orig/drivers/pcmcia/m8xx_pcmcia.c
+++ linux-rt-2.6.31/drivers/pcmcia/m8xx_pcmcia.c
@@ -1296,7 +1296,7 @@
 #ifdef CONFIG_PM
 static int m8xx_suspend(struct platform_device *pdev, pm_message_t state)
 {
-	return pcmcia_socket_dev_suspend(&pdev->dev, state);
+	return pcmcia_socket_dev_suspend(&pdev->dev);
 }
 
 static int m8xx_resume(struct platform_device *pdev)
--- linux-rt-2.6.31.orig/drivers/pcmcia/bfin_cf_pcmcia.c
+++ linux-rt-2.6.31/drivers/pcmcia/bfin_cf_pcmcia.c
@@ -302,7 +302,7 @@
 
 static int bfin_cf_suspend(struct platform_device *pdev, pm_message_t mesg)
 {
-	return pcmcia_socket_dev_suspend(&pdev->dev, mesg);
+	return pcmcia_socket_dev_suspend(&pdev->dev);
 }
 
 static int bfin_cf_resume(struct platform_device *pdev)
--- linux-rt-2.6.31.orig/drivers/pcmcia/i82365.c
+++ linux-rt-2.6.31/drivers/pcmcia/i82365.c
@@ -1241,7 +1241,7 @@
 static int i82365_drv_pcmcia_suspend(struct platform_device *dev,
 				     pm_message_t state)
 {
-	return pcmcia_socket_dev_suspend(&dev->dev, state);
+	return pcmcia_socket_dev_suspend(&dev->dev);
 }
 
 static int i82365_drv_pcmcia_resume(struct platform_device *dev)
--- linux-rt-2.6.31.orig/drivers/pcmcia/pd6729.c
+++ linux-rt-2.6.31/drivers/pcmcia/pd6729.c
@@ -758,7 +758,7 @@
 #ifdef CONFIG_PM
 static int pd6729_socket_suspend(struct pci_dev *dev, pm_message_t state)
 {
-	return pcmcia_socket_dev_suspend(&dev->dev, state);
+	return pcmcia_socket_dev_suspend(&dev->dev);
 }
 
 static int pd6729_socket_resume(struct pci_dev *dev)
--- linux-rt-2.6.31.orig/drivers/pcmcia/i82092.c
+++ linux-rt-2.6.31/drivers/pcmcia/i82092.c
@@ -42,7 +42,7 @@
 #ifdef CONFIG_PM
 static int i82092aa_socket_suspend (struct pci_dev *dev, pm_message_t state)
 {
-	return pcmcia_socket_dev_suspend(&dev->dev, state);
+	return pcmcia_socket_dev_suspend(&dev->dev);
 }
 
 static int i82092aa_socket_resume (struct pci_dev *dev)
--- linux-rt-2.6.31.orig/drivers/pcmcia/tcic.c
+++ linux-rt-2.6.31/drivers/pcmcia/tcic.c
@@ -366,7 +366,7 @@
 static int tcic_drv_pcmcia_suspend(struct platform_device *dev,
 				     pm_message_t state)
 {
-	return pcmcia_socket_dev_suspend(&dev->dev, state);
+	return pcmcia_socket_dev_suspend(&dev->dev);
 }
 
 static int tcic_drv_pcmcia_resume(struct platform_device *dev)
--- linux-rt-2.6.31.orig/drivers/pcmcia/m32r_cfc.c
+++ linux-rt-2.6.31/drivers/pcmcia/m32r_cfc.c
@@ -699,7 +699,7 @@
 static int cfc_drv_pcmcia_suspend(struct platform_device *dev,
 				     pm_message_t state)
 {
-	return pcmcia_socket_dev_suspend(&dev->dev, state);
+	return pcmcia_socket_dev_suspend(&dev->dev);
 }
 
 static int cfc_drv_pcmcia_resume(struct platform_device *dev)
--- linux-rt-2.6.31.orig/drivers/w1/w1_netlink.c
+++ linux-rt-2.6.31/drivers/w1/w1_netlink.c
@@ -306,9 +306,8 @@
 	return error;
 }
 
-static void w1_cn_callback(void *data)
+static void w1_cn_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp)
 {
-	struct cn_msg *msg = data;
 	struct w1_netlink_msg *m = (struct w1_netlink_msg *)(msg + 1);
 	struct w1_netlink_cmd *cmd;
 	struct w1_slave *sl;
--- linux-rt-2.6.31.orig/drivers/serial/8250.c
+++ linux-rt-2.6.31/drivers/serial/8250.c
@@ -1337,14 +1337,12 @@
 		serial_out(up, UART_IER, up->ier);
 
 		if (up->bugs & UART_BUG_TXEN) {
-			unsigned char lsr, iir;
+			unsigned char lsr;
 			lsr = serial_in(up, UART_LSR);
 			up->lsr_saved_flags |= lsr & LSR_SAVE_FLAGS;
-			iir = serial_in(up, UART_IIR) & 0x0f;
 			if ((up->port.type == PORT_RM9000) ?
-				(lsr & UART_LSR_THRE &&
-				(iir == UART_IIR_NO_INT || iir == UART_IIR_THRI)) :
-				(lsr & UART_LSR_TEMT && iir & UART_IIR_NO_INT))
+				(lsr & UART_LSR_THRE) :
+				(lsr & UART_LSR_TEMT))
 				transmit_chars(up);
 		}
 	}
--- linux-rt-2.6.31.orig/drivers/serial/8250_pci.c
+++ linux-rt-2.6.31/drivers/serial/8250_pci.c
@@ -1561,6 +1561,7 @@
 	pbn_exar_XR17C152,
 	pbn_exar_XR17C154,
 	pbn_exar_XR17C158,
+	pbn_exar_ibm_saturn,
 	pbn_pasemi_1682M,
 	pbn_ni8430_2,
 	pbn_ni8430_4,
@@ -2146,6 +2147,13 @@
 		.base_baud	= 921600,
 		.uart_offset	= 0x200,
 	},
+	[pbn_exar_ibm_saturn] = {
+		.flags		= FL_BASE0,
+		.num_ports	= 1,
+		.base_baud	= 921600,
+		.uart_offset	= 0x200,
+	},
+
 	/*
 	 * PA Semi PWRficient PA6T-1682M on-chip UART
 	 */
@@ -2649,6 +2657,9 @@
 		PCI_SUBVENDOR_ID_CONNECT_TECH,
 		PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_8_485, 0, 0,
 		pbn_b0_8_1843200_200 },
+	{	PCI_VENDOR_ID_EXAR, PCI_DEVICE_ID_EXAR_XR17C152,
+		PCI_VENDOR_ID_IBM, PCI_SUBDEVICE_ID_IBM_SATURN_SERIAL_ONE_PORT,
+		0, 0, pbn_exar_ibm_saturn },
 
 	{	PCI_VENDOR_ID_SEALEVEL, PCI_DEVICE_ID_SEALEVEL_U530,
 		PCI_ANY_ID, PCI_ANY_ID, 0, 0,
--- linux-rt-2.6.31.orig/drivers/serial/bfin_5xx.c
+++ linux-rt-2.6.31/drivers/serial/bfin_5xx.c
@@ -42,6 +42,10 @@
 # undef CONFIG_EARLY_PRINTK
 #endif
 
+#ifdef CONFIG_SERIAL_BFIN_MODULE
+# undef CONFIG_EARLY_PRINTK
+#endif
+
 /* UART name and device definitions */
 #define BFIN_SERIAL_NAME	"ttyBF"
 #define BFIN_SERIAL_MAJOR	204
--- linux-rt-2.6.31.orig/drivers/serial/sunsu.c
+++ linux-rt-2.6.31/drivers/serial/sunsu.c
@@ -1329,11 +1329,9 @@
  */
 static int __init sunsu_console_setup(struct console *co, char *options)
 {
+	static struct ktermios dummy;
+	struct ktermios termios;
 	struct uart_port *port;
-	int baud = 9600;
-	int bits = 8;
-	int parity = 'n';
-	int flow = 'n';
 
 	printk("Console: ttyS%d (SU)\n",
 	       (sunsu_reg.minor - 64) + co->index);
@@ -1352,10 +1350,15 @@
 	 */
 	spin_lock_init(&port->lock);
 
-	if (options)
-		uart_parse_options(options, &baud, &parity, &bits, &flow);
+	/* Get firmware console settings.  */
+	sunserial_console_termios(co, to_of_device(port->dev)->node);
 
-	return uart_set_options(port, co, baud, parity, bits, flow);
+	memset(&termios, 0, sizeof(struct ktermios));
+	termios.c_cflag = co->cflag;
+	port->mctrl |= TIOCM_DTR;
+	port->ops->set_termios(port, &termios, &dummy);
+
+	return 0;
 }
 
 static struct console sunsu_console = {
@@ -1409,6 +1412,7 @@
 	struct uart_sunsu_port *up;
 	struct resource *rp;
 	enum su_type type;
+	bool ignore_line;
 	int err;
 
 	type = su_get_type(dp);
@@ -1467,8 +1471,14 @@
 
 	up->port.ops = &sunsu_pops;
 
+	ignore_line = false;
+	if (!strcmp(dp->name, "rsc-console") ||
+	    !strcmp(dp->name, "lom-console"))
+		ignore_line = true;
+
 	sunserial_console_match(SUNSU_CONSOLE(), dp,
-				&sunsu_reg, up->port.line);
+				&sunsu_reg, up->port.line,
+				ignore_line);
 	err = uart_add_one_port(&sunsu_reg, &up->port);
 	if (err)
 		goto out_unmap;
@@ -1517,6 +1527,10 @@
 		.name = "serial",
 		.compatible = "su",
 	},
+	{
+		.type = "serial",
+		.compatible = "su",
+	},
 	{},
 };
 MODULE_DEVICE_TABLE(of, su_match);
@@ -1548,6 +1562,12 @@
 				num_uart++;
 		}
 	}
+	for_each_node_by_type(dp, "serial") {
+		if (of_device_is_compatible(dp, "su")) {
+			if (su_get_type(dp) == SU_PORT_PORT)
+				num_uart++;
+		}
+	}
 
 	if (num_uart) {
 		err = sunserial_register_minors(&sunsu_reg, num_uart);
--- linux-rt-2.6.31.orig/drivers/serial/suncore.h
+++ linux-rt-2.6.31/drivers/serial/suncore.h
@@ -26,7 +26,8 @@
 extern void sunserial_unregister_minors(struct uart_driver *, int);
 
 extern int sunserial_console_match(struct console *, struct device_node *,
-				   struct uart_driver *, int);
-extern void sunserial_console_termios(struct console *);
+				   struct uart_driver *, int, bool);
+extern void sunserial_console_termios(struct console *,
+				      struct device_node *);
 
 #endif /* !(_SERIAL_SUN_H) */
--- linux-rt-2.6.31.orig/drivers/serial/suncore.c
+++ linux-rt-2.6.31/drivers/serial/suncore.c
@@ -53,20 +53,21 @@
 EXPORT_SYMBOL(sunserial_unregister_minors);
 
 int sunserial_console_match(struct console *con, struct device_node *dp,
-			    struct uart_driver *drv, int line)
+			    struct uart_driver *drv, int line, bool ignore_line)
 {
-	int off;
-
 	if (!con || of_console_device != dp)
 		return 0;
 
-	off = 0;
-	if (of_console_options &&
-	    *of_console_options == 'b')
-		off = 1;
+	if (!ignore_line) {
+		int off = 0;
 
-	if ((line & 1) != off)
-		return 0;
+		if (of_console_options &&
+		    *of_console_options == 'b')
+			off = 1;
+
+		if ((line & 1) != off)
+			return 0;
+	}
 
 	con->index = line;
 	drv->cons = con;
@@ -76,23 +77,24 @@
 }
 EXPORT_SYMBOL(sunserial_console_match);
 
-void
-sunserial_console_termios(struct console *con)
+void sunserial_console_termios(struct console *con, struct device_node *uart_dp)
 {
-	struct device_node *dp;
-	const char *od, *mode, *s;
+	const char *mode, *s;
 	char mode_prop[] = "ttyX-mode";
 	int baud, bits, stop, cflag;
 	char parity;
 
-	dp = of_find_node_by_path("/options");
-	od = of_get_property(dp, "output-device", NULL);
-	if (!strcmp(od, "rsc")) {
-		mode = of_get_property(of_console_device,
+	if (!strcmp(uart_dp->name, "rsc") ||
+	    !strcmp(uart_dp->name, "rsc-console") ||
+	    !strcmp(uart_dp->name, "rsc-control")) {
+		mode = of_get_property(uart_dp,
 				       "ssp-console-modes", NULL);
 		if (!mode)
 			mode = "115200,8,n,1,-";
+	} else if (!strcmp(uart_dp->name, "lom-console")) {
+		mode = "9600,8,n,1,-";
 	} else {
+		struct device_node *dp;
 		char c;
 
 		c = 'a';
@@ -101,6 +103,7 @@
 
 		mode_prop[3] = c;
 
+		dp = of_find_node_by_path("/options");
 		mode = of_get_property(dp, mode_prop, NULL);
 		if (!mode)
 			mode = "9600,8,n,1,-";
--- linux-rt-2.6.31.orig/drivers/serial/sunhv.c
+++ linux-rt-2.6.31/drivers/serial/sunhv.c
@@ -566,7 +566,7 @@
 		goto out_free_con_read_page;
 
 	sunserial_console_match(&sunhv_console, op->node,
-				&sunhv_reg, port->line);
+				&sunhv_reg, port->line, false);
 
 	err = uart_add_one_port(&sunhv_reg, port);
 	if (err)
--- linux-rt-2.6.31.orig/drivers/serial/sunsab.c
+++ linux-rt-2.6.31/drivers/serial/sunsab.c
@@ -883,7 +883,7 @@
 	printk("Console: ttyS%d (SAB82532)\n",
 	       (sunsab_reg.minor - 64) + con->index);
 
-	sunserial_console_termios(con);
+	sunserial_console_termios(con, to_of_device(up->port.dev)->node);
 
 	switch (con->cflag & CBAUD) {
 	case B150: baud = 150; break;
@@ -1027,10 +1027,12 @@
 		goto out1;
 
 	sunserial_console_match(SUNSAB_CONSOLE(), op->node,
-				&sunsab_reg, up[0].port.line);
+				&sunsab_reg, up[0].port.line,
+				false);
 
 	sunserial_console_match(SUNSAB_CONSOLE(), op->node,
-				&sunsab_reg, up[1].port.line);
+				&sunsab_reg, up[1].port.line,
+				false);
 
 	err = uart_add_one_port(&sunsab_reg, &up[0].port);
 	if (err)
@@ -1116,7 +1118,6 @@
 		if (!sunsab_ports)
 			return -ENOMEM;
 
-		sunsab_reg.cons = SUNSAB_CONSOLE();
 		err = sunserial_register_minors(&sunsab_reg, num_channels);
 		if (err) {
 			kfree(sunsab_ports);
--- linux-rt-2.6.31.orig/drivers/serial/sunzilog.c
+++ linux-rt-2.6.31/drivers/serial/sunzilog.c
@@ -1180,7 +1180,7 @@
 	       (sunzilog_reg.minor - 64) + con->index, con->index);
 
 	/* Get firmware console settings.  */
-	sunserial_console_termios(con);
+	sunserial_console_termios(con, to_of_device(up->port.dev)->node);
 
 	/* Firmware console speed is limited to 150-->38400 baud so
 	 * this hackish cflag thing is OK.
@@ -1416,7 +1416,8 @@
 
 	if (!keyboard_mouse) {
 		if (sunserial_console_match(SUNZILOG_CONSOLE(), op->node,
-					    &sunzilog_reg, up[0].port.line))
+					    &sunzilog_reg, up[0].port.line,
+					    false))
 			up->flags |= SUNZILOG_FLAG_IS_CONS;
 		err = uart_add_one_port(&sunzilog_reg, &up[0].port);
 		if (err) {
@@ -1425,7 +1426,8 @@
 			return err;
 		}
 		if (sunserial_console_match(SUNZILOG_CONSOLE(), op->node,
-					    &sunzilog_reg, up[1].port.line))
+					    &sunzilog_reg, up[1].port.line,
+					    false))
 			up->flags |= SUNZILOG_FLAG_IS_CONS;
 		err = uart_add_one_port(&sunzilog_reg, &up[1].port);
 		if (err) {
--- linux-rt-2.6.31.orig/drivers/serial/of_serial.c
+++ linux-rt-2.6.31/drivers/serial/of_serial.c
@@ -161,6 +161,7 @@
 static struct of_device_id __devinitdata of_platform_serial_table[] = {
 	{ .type = "serial", .compatible = "ns8250",   .data = (void *)PORT_8250, },
 	{ .type = "serial", .compatible = "ns16450",  .data = (void *)PORT_16450, },
+	{ .type = "serial", .compatible = "ns16550a", .data = (void *)PORT_16550A, },
 	{ .type = "serial", .compatible = "ns16550",  .data = (void *)PORT_16550, },
 	{ .type = "serial", .compatible = "ns16750",  .data = (void *)PORT_16750, },
 	{ .type = "serial", .compatible = "ns16850",  .data = (void *)PORT_16850, },
--- linux-rt-2.6.31.orig/drivers/serial/serial_cs.c
+++ linux-rt-2.6.31/drivers/serial/serial_cs.c
@@ -884,6 +884,7 @@
 	PCMCIA_DEVICE_CIS_MANF_CARD(0x0192, 0xa555, "SW_555_SER.cis"),  /* Sierra Aircard 555 CDMA 1xrtt Modem -- pre update */
 	PCMCIA_DEVICE_CIS_MANF_CARD(0x013f, 0xa555, "SW_555_SER.cis"),  /* Sierra Aircard 555 CDMA 1xrtt Modem -- post update */
 	PCMCIA_DEVICE_CIS_PROD_ID12("MultiTech", "PCMCIA 56K DataFax", 0x842047ee, 0xc2efcf03, "MT5634ZLX.cis"),
+	PCMCIA_DEVICE_CIS_PROD_ID12("ADVANTECH", "COMpad-32/85B-2", 0x96913a85, 0x27ab5437, "COMpad2.cis"),
 	PCMCIA_DEVICE_CIS_PROD_ID12("ADVANTECH", "COMpad-32/85B-4", 0x96913a85, 0xcec8f102, "COMpad4.cis"),
 	PCMCIA_DEVICE_CIS_PROD_ID123("ADVANTECH", "COMpad-32/85", "1.0", 0x96913a85, 0x8fbe92ae, 0x0877b627, "COMpad2.cis"),
 	PCMCIA_DEVICE_CIS_PROD_ID2("RS-COM 2P", 0xad20b156, "RS-COM-2P.cis"),
--- linux-rt-2.6.31.orig/drivers/usb/host/ehci-pci.c
+++ linux-rt-2.6.31/drivers/usb/host/ehci-pci.c
@@ -72,6 +72,12 @@
 	int			retval;
 
 	switch (pdev->vendor) {
+	case PCI_VENDOR_ID_INTEL:
+		if (pdev->device == 0x27cc) {
+			ehci->broken_periodic = 1;
+			ehci_info(ehci, "using broken periodic workaround\n");
+		}
+		break;
 	case PCI_VENDOR_ID_TOSHIBA_2:
 		/* celleb's companion chip */
 		if (pdev->device == 0x01b5) {
--- linux-rt-2.6.31.orig/drivers/usb/host/xhci-dbg.c
+++ linux-rt-2.6.31/drivers/usb/host/xhci-dbg.c
@@ -413,7 +413,8 @@
 	int i;
 
 	struct xhci_slot_ctx *slot_ctx = xhci_get_slot_ctx(xhci, ctx);
-	dma_addr_t dma = ctx->dma + ((unsigned long)slot_ctx - (unsigned long)ctx);
+	dma_addr_t dma = ctx->dma +
+		((unsigned long)slot_ctx - (unsigned long)ctx->bytes);
 	int csz = HCC_64BYTE_CONTEXT(xhci->hcc_params);
 
 	xhci_dbg(xhci, "Slot Context:\n");
@@ -459,7 +460,7 @@
 	for (i = 0; i < last_ep_ctx; ++i) {
 		struct xhci_ep_ctx *ep_ctx = xhci_get_ep_ctx(xhci, ctx, i);
 		dma_addr_t dma = ctx->dma +
-			((unsigned long)ep_ctx - (unsigned long)ctx);
+			((unsigned long)ep_ctx - (unsigned long)ctx->bytes);
 
 		xhci_dbg(xhci, "Endpoint %02d Context:\n", i);
 		xhci_dbg(xhci, "@%p (virt) @%08llx (dma) %#08x - ep_info\n",
--- linux-rt-2.6.31.orig/drivers/usb/host/xhci-hcd.c
+++ linux-rt-2.6.31/drivers/usb/host/xhci-hcd.c
@@ -22,12 +22,18 @@
 
 #include <linux/irq.h>
 #include <linux/module.h>
+#include <linux/moduleparam.h>
 
 #include "xhci.h"
 
 #define DRIVER_AUTHOR "Sarah Sharp"
 #define DRIVER_DESC "'eXtensible' Host Controller (xHC) Driver"
 
+/* Some 0.95 hardware can't handle the chain bit on a Link TRB being cleared */
+static int link_quirk;
+module_param(link_quirk, int, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(link_quirk, "Don't clear the chain bit on a link TRB");
+
 /* TODO: copied from ehci-hcd.c - can this be refactored? */
 /*
  * handshake - spin reading hc until handshake completes or fails
@@ -214,6 +220,12 @@
 
 	xhci_dbg(xhci, "xhci_init\n");
 	spin_lock_init(&xhci->lock);
+	if (link_quirk) {
+		xhci_dbg(xhci, "QUIRK: Not clearing Link TRB chain bits.\n");
+		xhci->quirks |= XHCI_LINK_TRB_QUIRK;
+	} else {
+		xhci_dbg(xhci, "xHCI doesn't need link TRB QUIRK\n");
+	}
 	retval = xhci_mem_init(xhci, GFP_KERNEL);
 	xhci_dbg(xhci, "Finished xhci_init\n");
 
@@ -555,13 +567,22 @@
 	return 1 << (xhci_get_endpoint_index(desc) + 1);
 }
 
+/* Find the flag for this endpoint (for use in the control context).  Use the
+ * endpoint index to create a bitmask.  The slot context is bit 0, endpoint 0 is
+ * bit 1, etc.
+ */
+unsigned int xhci_get_endpoint_flag_from_index(unsigned int ep_index)
+{
+	return 1 << (ep_index + 1);
+}
+
 /* Compute the last valid endpoint context index.  Basically, this is the
  * endpoint index plus one.  For slot contexts with more than valid endpoint,
  * we find the most significant bit set in the added contexts flags.
  * e.g. ep 1 IN (with epnum 0x81) => added_ctxs = 0b1000
  * fls(0b1000) = 4, but the endpoint context index is 3, so subtract one.
  */
-static inline unsigned int xhci_last_valid_endpoint(u32 added_ctxs)
+unsigned int xhci_last_valid_endpoint(u32 added_ctxs)
 {
 	return fls(added_ctxs) - 1;
 }
@@ -589,6 +610,70 @@
 	return 1;
 }
 
+static int xhci_configure_endpoint(struct xhci_hcd *xhci,
+		struct usb_device *udev, struct xhci_virt_device *virt_dev,
+		bool ctx_change);
+
+/*
+ * Full speed devices may have a max packet size greater than 8 bytes, but the
+ * USB core doesn't know that until it reads the first 8 bytes of the
+ * descriptor.  If the usb_device's max packet size changes after that point,
+ * we need to issue an evaluate context command and wait on it.
+ */
+static int xhci_check_maxpacket(struct xhci_hcd *xhci, unsigned int slot_id,
+		unsigned int ep_index, struct urb *urb)
+{
+	struct xhci_container_ctx *in_ctx;
+	struct xhci_container_ctx *out_ctx;
+	struct xhci_input_control_ctx *ctrl_ctx;
+	struct xhci_ep_ctx *ep_ctx;
+	int max_packet_size;
+	int hw_max_packet_size;
+	int ret = 0;
+
+	out_ctx = xhci->devs[slot_id]->out_ctx;
+	ep_ctx = xhci_get_ep_ctx(xhci, out_ctx, ep_index);
+	hw_max_packet_size = MAX_PACKET_DECODED(ep_ctx->ep_info2);
+	max_packet_size = urb->dev->ep0.desc.wMaxPacketSize;
+	if (hw_max_packet_size != max_packet_size) {
+		xhci_dbg(xhci, "Max Packet Size for ep 0 changed.\n");
+		xhci_dbg(xhci, "Max packet size in usb_device = %d\n",
+				max_packet_size);
+		xhci_dbg(xhci, "Max packet size in xHCI HW = %d\n",
+				hw_max_packet_size);
+		xhci_dbg(xhci, "Issuing evaluate context command.\n");
+
+		/* Set up the modified control endpoint 0 */
+		xhci_endpoint_copy(xhci, xhci->devs[slot_id], ep_index);
+		in_ctx = xhci->devs[slot_id]->in_ctx;
+		ep_ctx = xhci_get_ep_ctx(xhci, in_ctx, ep_index);
+		ep_ctx->ep_info2 &= ~MAX_PACKET_MASK;
+		ep_ctx->ep_info2 |= MAX_PACKET(max_packet_size);
+
+		/* Set up the input context flags for the command */
+		/* FIXME: This won't work if a non-default control endpoint
+		 * changes max packet sizes.
+		 */
+		ctrl_ctx = xhci_get_input_control_ctx(xhci, in_ctx);
+		ctrl_ctx->add_flags = EP0_FLAG;
+		ctrl_ctx->drop_flags = 0;
+
+		xhci_dbg(xhci, "Slot %d input context\n", slot_id);
+		xhci_dbg_ctx(xhci, in_ctx, ep_index);
+		xhci_dbg(xhci, "Slot %d output context\n", slot_id);
+		xhci_dbg_ctx(xhci, out_ctx, ep_index);
+
+		ret = xhci_configure_endpoint(xhci, urb->dev,
+				xhci->devs[slot_id], true);
+
+		/* Clean up the input context for later use by bandwidth
+		 * functions.
+		 */
+		ctrl_ctx->add_flags = SLOT_FLAG;
+	}
+	return ret;
+}
+
 /*
  * non-error returns are a promise to giveback() the urb later
  * we drop ownership so next owner (or urb unlink) can get it
@@ -600,13 +685,13 @@
 	int ret = 0;
 	unsigned int slot_id, ep_index;
 
+
 	if (!urb || xhci_check_args(hcd, urb->dev, urb->ep, true, __func__) <= 0)
 		return -EINVAL;
 
 	slot_id = urb->dev->slot_id;
 	ep_index = xhci_get_endpoint_index(&urb->ep->desc);
 
-	spin_lock_irqsave(&xhci->lock, flags);
 	if (!xhci->devs || !xhci->devs[slot_id]) {
 		if (!in_interrupt())
 			dev_warn(&urb->dev->dev, "WARN: urb submitted for dev with no Slot ID\n");
@@ -619,19 +704,38 @@
 		ret = -ESHUTDOWN;
 		goto exit;
 	}
-	if (usb_endpoint_xfer_control(&urb->ep->desc))
+	if (usb_endpoint_xfer_control(&urb->ep->desc)) {
+		/* Check to see if the max packet size for the default control
+		 * endpoint changed during FS device enumeration
+		 */
+		if (urb->dev->speed == USB_SPEED_FULL) {
+			ret = xhci_check_maxpacket(xhci, slot_id,
+					ep_index, urb);
+			if (ret < 0)
+				return ret;
+		}
+
 		/* We have a spinlock and interrupts disabled, so we must pass
 		 * atomic context to this function, which may allocate memory.
 		 */
+		spin_lock_irqsave(&xhci->lock, flags);
 		ret = xhci_queue_ctrl_tx(xhci, GFP_ATOMIC, urb,
 				slot_id, ep_index);
-	else if (usb_endpoint_xfer_bulk(&urb->ep->desc))
+		spin_unlock_irqrestore(&xhci->lock, flags);
+	} else if (usb_endpoint_xfer_bulk(&urb->ep->desc)) {
+		spin_lock_irqsave(&xhci->lock, flags);
 		ret = xhci_queue_bulk_tx(xhci, GFP_ATOMIC, urb,
 				slot_id, ep_index);
-	else
+		spin_unlock_irqrestore(&xhci->lock, flags);
+	} else if (usb_endpoint_xfer_int(&urb->ep->desc)) {
+		spin_lock_irqsave(&xhci->lock, flags);
+		ret = xhci_queue_intr_tx(xhci, GFP_ATOMIC, urb,
+				slot_id, ep_index);
+		spin_unlock_irqrestore(&xhci->lock, flags);
+	} else {
 		ret = -EINVAL;
+	}
 exit:
-	spin_unlock_irqrestore(&xhci->lock, flags);
 	return ret;
 }
 
@@ -930,6 +1034,122 @@
 	}
 }
 
+static int xhci_configure_endpoint_result(struct xhci_hcd *xhci,
+		struct usb_device *udev, struct xhci_virt_device *virt_dev)
+{
+	int ret;
+
+	switch (virt_dev->cmd_status) {
+	case COMP_ENOMEM:
+		dev_warn(&udev->dev, "Not enough host controller resources "
+				"for new device state.\n");
+		ret = -ENOMEM;
+		/* FIXME: can we allocate more resources for the HC? */
+		break;
+	case COMP_BW_ERR:
+		dev_warn(&udev->dev, "Not enough bandwidth "
+				"for new device state.\n");
+		ret = -ENOSPC;
+		/* FIXME: can we go back to the old state? */
+		break;
+	case COMP_TRB_ERR:
+		/* the HCD set up something wrong */
+		dev_warn(&udev->dev, "ERROR: Endpoint drop flag = 0, "
+				"add flag = 1, "
+				"and endpoint is not disabled.\n");
+		ret = -EINVAL;
+		break;
+	case COMP_SUCCESS:
+		dev_dbg(&udev->dev, "Successful Endpoint Configure command\n");
+		ret = 0;
+		break;
+	default:
+		xhci_err(xhci, "ERROR: unexpected command completion "
+				"code 0x%x.\n", virt_dev->cmd_status);
+		ret = -EINVAL;
+		break;
+	}
+	return ret;
+}
+
+static int xhci_evaluate_context_result(struct xhci_hcd *xhci,
+		struct usb_device *udev, struct xhci_virt_device *virt_dev)
+{
+	int ret;
+
+	switch (virt_dev->cmd_status) {
+	case COMP_EINVAL:
+		dev_warn(&udev->dev, "WARN: xHCI driver setup invalid evaluate "
+				"context command.\n");
+		ret = -EINVAL;
+		break;
+	case COMP_EBADSLT:
+		dev_warn(&udev->dev, "WARN: slot not enabled for"
+				"evaluate context command.\n");
+	case COMP_CTX_STATE:
+		dev_warn(&udev->dev, "WARN: invalid context state for "
+				"evaluate context command.\n");
+		xhci_dbg_ctx(xhci, virt_dev->out_ctx, 1);
+		ret = -EINVAL;
+		break;
+	case COMP_SUCCESS:
+		dev_dbg(&udev->dev, "Successful evaluate context command\n");
+		ret = 0;
+		break;
+	default:
+		xhci_err(xhci, "ERROR: unexpected command completion "
+				"code 0x%x.\n", virt_dev->cmd_status);
+		ret = -EINVAL;
+		break;
+	}
+	return ret;
+}
+
+/* Issue a configure endpoint command or evaluate context command
+ * and wait for it to finish.
+ */
+static int xhci_configure_endpoint(struct xhci_hcd *xhci,
+		struct usb_device *udev, struct xhci_virt_device *virt_dev,
+		bool ctx_change)
+{
+	int ret;
+	int timeleft;
+	unsigned long flags;
+
+	spin_lock_irqsave(&xhci->lock, flags);
+	if (!ctx_change)
+		ret = xhci_queue_configure_endpoint(xhci, virt_dev->in_ctx->dma,
+				udev->slot_id);
+	else
+		ret = xhci_queue_evaluate_context(xhci, virt_dev->in_ctx->dma,
+				udev->slot_id);
+	if (ret < 0) {
+		spin_unlock_irqrestore(&xhci->lock, flags);
+		xhci_dbg(xhci, "FIXME allocate a new ring segment\n");
+		return -ENOMEM;
+	}
+	xhci_ring_cmd_db(xhci);
+	spin_unlock_irqrestore(&xhci->lock, flags);
+
+	/* Wait for the configure endpoint command to complete */
+	timeleft = wait_for_completion_interruptible_timeout(
+			&virt_dev->cmd_completion,
+			USB_CTRL_SET_TIMEOUT);
+	if (timeleft <= 0) {
+		xhci_warn(xhci, "%s while waiting for %s command\n",
+				timeleft == 0 ? "Timeout" : "Signal",
+				ctx_change == 0 ?
+					"configure endpoint" :
+					"evaluate context");
+		/* FIXME cancel the configure endpoint command */
+		return -ETIME;
+	}
+
+	if (!ctx_change)
+		return xhci_configure_endpoint_result(xhci, udev, virt_dev);
+	return xhci_evaluate_context_result(xhci, udev, virt_dev);
+}
+
 /* Called after one or more calls to xhci_add_endpoint() or
  * xhci_drop_endpoint().  If this call fails, the USB core is expected
  * to call xhci_reset_bandwidth().
@@ -944,8 +1164,6 @@
 {
 	int i;
 	int ret = 0;
-	int timeleft;
-	unsigned long flags;
 	struct xhci_hcd *xhci;
 	struct xhci_virt_device	*virt_dev;
 	struct xhci_input_control_ctx *ctrl_ctx;
@@ -975,56 +1193,7 @@
 	xhci_dbg_ctx(xhci, virt_dev->in_ctx,
 			LAST_CTX_TO_EP_NUM(slot_ctx->dev_info));
 
-	spin_lock_irqsave(&xhci->lock, flags);
-	ret = xhci_queue_configure_endpoint(xhci, virt_dev->in_ctx->dma,
-			udev->slot_id);
-	if (ret < 0) {
-		spin_unlock_irqrestore(&xhci->lock, flags);
-		xhci_dbg(xhci, "FIXME allocate a new ring segment\n");
-		return -ENOMEM;
-	}
-	xhci_ring_cmd_db(xhci);
-	spin_unlock_irqrestore(&xhci->lock, flags);
-
-	/* Wait for the configure endpoint command to complete */
-	timeleft = wait_for_completion_interruptible_timeout(
-			&virt_dev->cmd_completion,
-			USB_CTRL_SET_TIMEOUT);
-	if (timeleft <= 0) {
-		xhci_warn(xhci, "%s while waiting for configure endpoint command\n",
-				timeleft == 0 ? "Timeout" : "Signal");
-		/* FIXME cancel the configure endpoint command */
-		return -ETIME;
-	}
-
-	switch (virt_dev->cmd_status) {
-	case COMP_ENOMEM:
-		dev_warn(&udev->dev, "Not enough host controller resources "
-				"for new device state.\n");
-		ret = -ENOMEM;
-		/* FIXME: can we allocate more resources for the HC? */
-		break;
-	case COMP_BW_ERR:
-		dev_warn(&udev->dev, "Not enough bandwidth "
-				"for new device state.\n");
-		ret = -ENOSPC;
-		/* FIXME: can we go back to the old state? */
-		break;
-	case COMP_TRB_ERR:
-		/* the HCD set up something wrong */
-		dev_warn(&udev->dev, "ERROR: Endpoint drop flag = 0, add flag = 1, "
-				"and endpoint is not disabled.\n");
-		ret = -EINVAL;
-		break;
-	case COMP_SUCCESS:
-		dev_dbg(&udev->dev, "Successful Endpoint Configure command\n");
-		break;
-	default:
-		xhci_err(xhci, "ERROR: unexpected command completion "
-				"code 0x%x.\n", virt_dev->cmd_status);
-		ret = -EINVAL;
-		break;
-	}
+	ret = xhci_configure_endpoint(xhci, udev, virt_dev, false);
 	if (ret) {
 		/* Callee should call reset_bandwidth() */
 		return ret;
@@ -1075,6 +1244,75 @@
 	xhci_zero_in_ctx(xhci, virt_dev);
 }
 
+void xhci_setup_input_ctx_for_quirk(struct xhci_hcd *xhci,
+		unsigned int slot_id, unsigned int ep_index,
+		struct xhci_dequeue_state *deq_state)
+{
+	struct xhci_container_ctx *in_ctx;
+	struct xhci_input_control_ctx *ctrl_ctx;
+	struct xhci_ep_ctx *ep_ctx;
+	u32 added_ctxs;
+	dma_addr_t addr;
+
+	xhci_endpoint_copy(xhci, xhci->devs[slot_id], ep_index);
+	in_ctx = xhci->devs[slot_id]->in_ctx;
+	ep_ctx = xhci_get_ep_ctx(xhci, in_ctx, ep_index);
+	addr = xhci_trb_virt_to_dma(deq_state->new_deq_seg,
+			deq_state->new_deq_ptr);
+	if (addr == 0) {
+		xhci_warn(xhci, "WARN Cannot submit config ep after "
+				"reset ep command\n");
+		xhci_warn(xhci, "WARN deq seg = %p, deq ptr = %p\n",
+				deq_state->new_deq_seg,
+				deq_state->new_deq_ptr);
+		return;
+	}
+	ep_ctx->deq = addr | deq_state->new_cycle_state;
+
+	xhci_slot_copy(xhci, xhci->devs[slot_id]);
+
+	ctrl_ctx = xhci_get_input_control_ctx(xhci, in_ctx);
+	added_ctxs = xhci_get_endpoint_flag_from_index(ep_index);
+	ctrl_ctx->add_flags = added_ctxs | SLOT_FLAG;
+	ctrl_ctx->drop_flags = added_ctxs;
+
+	xhci_dbg(xhci, "Slot ID %d Input Context:\n", slot_id);
+	xhci_dbg_ctx(xhci, in_ctx, ep_index);
+}
+
+void xhci_cleanup_stalled_ring(struct xhci_hcd *xhci,
+		struct usb_device *udev,
+		unsigned int ep_index, struct xhci_ring *ep_ring)
+{
+	struct xhci_dequeue_state deq_state;
+
+	xhci_dbg(xhci, "Cleaning up stalled endpoint ring\n");
+	/* We need to move the HW's dequeue pointer past this TD,
+	 * or it will attempt to resend it on the next doorbell ring.
+	 */
+	xhci_find_new_dequeue_state(xhci, udev->slot_id,
+			ep_index, ep_ring->stopped_td,
+			&deq_state);
+
+	/* HW with the reset endpoint quirk will use the saved dequeue state to
+	 * issue a configure endpoint command later.
+	 */
+	if (!(xhci->quirks & XHCI_RESET_EP_QUIRK)) {
+		xhci_dbg(xhci, "Queueing new dequeue state\n");
+		xhci_queue_new_dequeue_state(xhci, ep_ring,
+				udev->slot_id,
+				ep_index, &deq_state);
+	} else {
+		/* Better hope no one uses the input context between now and the
+		 * reset endpoint completion!
+		 */
+		xhci_dbg(xhci, "Setting up input context for "
+				"configure endpoint command\n");
+		xhci_setup_input_ctx_for_quirk(xhci, udev->slot_id,
+				ep_index, &deq_state);
+	}
+}
+
 /* Deal with stalled endpoints.  The core should have sent the control message
  * to clear the halt condition.  However, we need to make the xHCI hardware
  * reset its sequence number, since a device will expect a sequence number of
@@ -1089,7 +1327,6 @@
 	unsigned int ep_index;
 	unsigned long flags;
 	int ret;
-	struct xhci_dequeue_state deq_state;
 	struct xhci_ring *ep_ring;
 
 	xhci = hcd_to_xhci(hcd);
@@ -1106,6 +1343,10 @@
 				ep->desc.bEndpointAddress);
 		return;
 	}
+	if (usb_endpoint_xfer_control(&ep->desc)) {
+		xhci_dbg(xhci, "Control endpoint stall already handled.\n");
+		return;
+	}
 
 	xhci_dbg(xhci, "Queueing reset endpoint command\n");
 	spin_lock_irqsave(&xhci->lock, flags);
@@ -1116,16 +1357,7 @@
 	 * command.  Better hope that last command worked!
 	 */
 	if (!ret) {
-		xhci_dbg(xhci, "Cleaning up stalled endpoint ring\n");
-		/* We need to move the HW's dequeue pointer past this TD,
-		 * or it will attempt to resend it on the next doorbell ring.
-		 */
-		xhci_find_new_dequeue_state(xhci, udev->slot_id,
-				ep_index, ep_ring->stopped_td, &deq_state);
-		xhci_dbg(xhci, "Queueing new dequeue state\n");
-		xhci_queue_new_dequeue_state(xhci, ep_ring,
-				udev->slot_id,
-				ep_index, &deq_state);
+		xhci_cleanup_stalled_ring(xhci, udev, ep_index, ep_ring);
 		kfree(ep_ring->stopped_td);
 		xhci_ring_cmd_db(xhci);
 	}
--- linux-rt-2.6.31.orig/drivers/usb/host/ohci-q.c
+++ linux-rt-2.6.31/drivers/usb/host/ohci-q.c
@@ -49,9 +49,12 @@
 	switch (usb_pipetype (urb->pipe)) {
 	case PIPE_ISOCHRONOUS:
 		ohci_to_hcd(ohci)->self.bandwidth_isoc_reqs--;
-		if (ohci_to_hcd(ohci)->self.bandwidth_isoc_reqs == 0
-				&& quirk_amdiso(ohci))
-			quirk_amd_pll(1);
+		if (ohci_to_hcd(ohci)->self.bandwidth_isoc_reqs == 0) {
+			if (quirk_amdiso(ohci))
+				quirk_amd_pll(1);
+			if (quirk_amdprefetch(ohci))
+				sb800_prefetch(ohci, 0);
+		}
 		break;
 	case PIPE_INTERRUPT:
 		ohci_to_hcd(ohci)->self.bandwidth_int_reqs--;
@@ -680,9 +683,12 @@
 				data + urb->iso_frame_desc [cnt].offset,
 				urb->iso_frame_desc [cnt].length, urb, cnt);
 		}
-		if (ohci_to_hcd(ohci)->self.bandwidth_isoc_reqs == 0
-				&& quirk_amdiso(ohci))
-			quirk_amd_pll(0);
+		if (ohci_to_hcd(ohci)->self.bandwidth_isoc_reqs == 0) {
+			if (quirk_amdiso(ohci))
+				quirk_amd_pll(0);
+			if (quirk_amdprefetch(ohci))
+				sb800_prefetch(ohci, 1);
+		}
 		periodic = ohci_to_hcd(ohci)->self.bandwidth_isoc_reqs++ == 0
 			&& ohci_to_hcd(ohci)->self.bandwidth_int_reqs == 0;
 		break;
--- linux-rt-2.6.31.orig/drivers/usb/host/ohci.h
+++ linux-rt-2.6.31/drivers/usb/host/ohci.h
@@ -402,6 +402,7 @@
 #define	OHCI_QUIRK_FRAME_NO	0x80			/* no big endian frame_no shift */
 #define	OHCI_QUIRK_HUB_POWER	0x100			/* distrust firmware power/oc setup */
 #define	OHCI_QUIRK_AMD_ISO	0x200			/* ISO transfers*/
+#define	OHCI_QUIRK_AMD_PREFETCH	0x400			/* pre-fetch for ISO transfer */
 	// there are also chip quirks/bugs in init logic
 
 	struct work_struct	nec_work;	/* Worker for NEC quirk */
@@ -433,6 +434,10 @@
 {
 	return ohci->flags & OHCI_QUIRK_AMD_ISO;
 }
+static inline int quirk_amdprefetch(struct ohci_hcd *ohci)
+{
+	return ohci->flags & OHCI_QUIRK_AMD_PREFETCH;
+}
 #else
 static inline int quirk_nec(struct ohci_hcd *ohci)
 {
@@ -446,6 +451,10 @@
 {
 	return 0;
 }
+static inline int quirk_amdprefetch(struct ohci_hcd *ohci)
+{
+	return 0;
+}
 #endif
 
 /* convert between an hcd pointer and the corresponding ohci_hcd */
--- linux-rt-2.6.31.orig/drivers/usb/host/sl811-hcd.c
+++ linux-rt-2.6.31/drivers/usb/host/sl811-hcd.c
@@ -719,8 +719,12 @@
 		/* port status seems weird until after reset, so
 		 * force the reset and make khubd clean up later.
 		 */
-		sl811->port1 |= (1 << USB_PORT_FEAT_C_CONNECTION)
-				| (1 << USB_PORT_FEAT_CONNECTION);
+		if (sl811->stat_insrmv & 1)
+			sl811->port1 |= 1 << USB_PORT_FEAT_CONNECTION;
+		else
+			sl811->port1 &= ~(1 << USB_PORT_FEAT_CONNECTION);
+
+		sl811->port1 |= 1 << USB_PORT_FEAT_C_CONNECTION;
 
 	} else if (irqstat & SL11H_INTMASK_RD) {
 		if (sl811->port1 & (1 << USB_PORT_FEAT_SUSPEND)) {
--- linux-rt-2.6.31.orig/drivers/usb/host/ehci-sched.c
+++ linux-rt-2.6.31/drivers/usb/host/ehci-sched.c
@@ -456,6 +456,8 @@
 	/* make sure ehci_work scans these */
 	ehci->next_uframe = ehci_readl(ehci, &ehci->regs->frame_index)
 		% (ehci->periodic_size << 3);
+	if (unlikely(ehci->broken_periodic))
+		ehci->last_periodic_enable = ktime_get_real();
 	return 0;
 }
 
@@ -467,6 +469,16 @@
 	if (--ehci->periodic_sched)
 		return 0;
 
+	if (unlikely(ehci->broken_periodic)) {
+		/* delay experimentally determined */
+		ktime_t safe = ktime_add_us(ehci->last_periodic_enable, 1000);
+		ktime_t now = ktime_get_real();
+		s64 delay = ktime_us_delta(safe, now);
+
+		if (unlikely(delay > 0))
+			udelay(delay);
+	}
+
 	/* did setting PSE not take effect yet?
 	 * takes effect only at frame boundaries...
 	 */
--- linux-rt-2.6.31.orig/drivers/usb/host/xhci-mem.c
+++ linux-rt-2.6.31/drivers/usb/host/xhci-mem.c
@@ -94,6 +94,9 @@
 		val = prev->trbs[TRBS_PER_SEGMENT-1].link.control;
 		val &= ~TRB_TYPE_BITMASK;
 		val |= TRB_TYPE(TRB_LINK);
+		/* Always set the chain bit with 0.95 hardware */
+		if (xhci_link_trb_quirk(xhci))
+			val |= TRB_CHAIN;
 		prev->trbs[TRBS_PER_SEGMENT-1].link.control = val;
 	}
 	xhci_dbg(xhci, "Linking segment 0x%llx to segment 0x%llx (DMA)\n",
@@ -398,15 +401,28 @@
 	/* Step 5 */
 	ep0_ctx->ep_info2 = EP_TYPE(CTRL_EP);
 	/*
-	 * See section 4.3 bullet 6:
-	 * The default Max Packet size for ep0 is "8 bytes for a USB2
-	 * LS/FS/HS device or 512 bytes for a USB3 SS device"
 	 * XXX: Not sure about wireless USB devices.
 	 */
-	if (udev->speed == USB_SPEED_SUPER)
+	switch (udev->speed) {
+	case USB_SPEED_SUPER:
 		ep0_ctx->ep_info2 |= MAX_PACKET(512);
-	else
+		break;
+	case USB_SPEED_HIGH:
+	/* USB core guesses at a 64-byte max packet first for FS devices */
+	case USB_SPEED_FULL:
+		ep0_ctx->ep_info2 |= MAX_PACKET(64);
+		break;
+	case USB_SPEED_LOW:
 		ep0_ctx->ep_info2 |= MAX_PACKET(8);
+		break;
+	case USB_SPEED_VARIABLE:
+		xhci_dbg(xhci, "FIXME xHCI doesn't support wireless speeds\n");
+		return -EINVAL;
+		break;
+	default:
+		/* New speed? */
+		BUG();
+	}
 	/* EP 0 can handle "burst" sizes of 1, so Max Burst Size field is 0 */
 	ep0_ctx->ep_info2 |= MAX_BURST(0);
 	ep0_ctx->ep_info2 |= ERROR_COUNT(3);
@@ -598,6 +614,44 @@
 	 */
 }
 
+/* Copy output xhci_ep_ctx to the input xhci_ep_ctx copy.
+ * Useful when you want to change one particular aspect of the endpoint and then
+ * issue a configure endpoint command.
+ */
+void xhci_endpoint_copy(struct xhci_hcd *xhci,
+		struct xhci_virt_device *vdev, unsigned int ep_index)
+{
+	struct xhci_ep_ctx *out_ep_ctx;
+	struct xhci_ep_ctx *in_ep_ctx;
+
+	out_ep_ctx = xhci_get_ep_ctx(xhci, vdev->out_ctx, ep_index);
+	in_ep_ctx = xhci_get_ep_ctx(xhci, vdev->in_ctx, ep_index);
+
+	in_ep_ctx->ep_info = out_ep_ctx->ep_info;
+	in_ep_ctx->ep_info2 = out_ep_ctx->ep_info2;
+	in_ep_ctx->deq = out_ep_ctx->deq;
+	in_ep_ctx->tx_info = out_ep_ctx->tx_info;
+}
+
+/* Copy output xhci_slot_ctx to the input xhci_slot_ctx.
+ * Useful when you want to change one particular aspect of the endpoint and then
+ * issue a configure endpoint command.  Only the context entries field matters,
+ * but we'll copy the whole thing anyway.
+ */
+void xhci_slot_copy(struct xhci_hcd *xhci, struct xhci_virt_device *vdev)
+{
+	struct xhci_slot_ctx *in_slot_ctx;
+	struct xhci_slot_ctx *out_slot_ctx;
+
+	in_slot_ctx = xhci_get_slot_ctx(xhci, vdev->in_ctx);
+	out_slot_ctx = xhci_get_slot_ctx(xhci, vdev->out_ctx);
+
+	in_slot_ctx->dev_info = out_slot_ctx->dev_info;
+	in_slot_ctx->dev_info2 = out_slot_ctx->dev_info2;
+	in_slot_ctx->tt_info = out_slot_ctx->tt_info;
+	in_slot_ctx->dev_state = out_slot_ctx->dev_state;
+}
+
 /* Set up the scratchpad buffer array and scratchpad buffers, if needed. */
 static int scratchpad_alloc(struct xhci_hcd *xhci, gfp_t flags)
 {
@@ -702,9 +756,11 @@
 	int i;
 
 	/* Free the Event Ring Segment Table and the actual Event Ring */
-	xhci_writel(xhci, 0, &xhci->ir_set->erst_size);
-	xhci_write_64(xhci, 0, &xhci->ir_set->erst_base);
-	xhci_write_64(xhci, 0, &xhci->ir_set->erst_dequeue);
+	if (xhci->ir_set) {
+		xhci_writel(xhci, 0, &xhci->ir_set->erst_size);
+		xhci_write_64(xhci, 0, &xhci->ir_set->erst_base);
+		xhci_write_64(xhci, 0, &xhci->ir_set->erst_dequeue);
+	}
 	size = sizeof(struct xhci_erst_entry)*(xhci->erst.num_entries);
 	if (xhci->erst.entries)
 		pci_free_consistent(pdev, size,
@@ -741,9 +797,9 @@
 				xhci->dcbaa, xhci->dcbaa->dma);
 	xhci->dcbaa = NULL;
 
+	scratchpad_free(xhci);
 	xhci->page_size = 0;
 	xhci->page_shift = 0;
-	scratchpad_free(xhci);
 }
 
 int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags)
--- linux-rt-2.6.31.orig/drivers/usb/host/ohci-hcd.c
+++ linux-rt-2.6.31/drivers/usb/host/ohci-hcd.c
@@ -88,6 +88,7 @@
 #ifdef CONFIG_PCI
 static void quirk_amd_pll(int state);
 static void amd_iso_dev_put(void);
+static void sb800_prefetch(struct ohci_hcd *ohci, int on);
 #else
 static inline void quirk_amd_pll(int state)
 {
@@ -97,6 +98,10 @@
 {
 	return;
 }
+static inline void sb800_prefetch(struct ohci_hcd *ohci, int on)
+{
+	return;
+}
 #endif
 
 
--- linux-rt-2.6.31.orig/drivers/usb/host/xhci.h
+++ linux-rt-2.6.31/drivers/usb/host/xhci.h
@@ -581,6 +581,7 @@
 /* bit 15 is Linear Stream Array */
 /* Interval - period between requests to an endpoint - 125u increments. */
 #define EP_INTERVAL(p)		((p & 0xff) << 16)
+#define EP_INTERVAL_TO_UFRAMES(p)		(1 << (((p) >> 16) & 0xff))
 
 /* ep_info2 bitmasks */
 /*
@@ -589,6 +590,7 @@
  */
 #define	FORCE_EVENT	(0x1)
 #define ERROR_COUNT(p)	(((p) & 0x3) << 1)
+#define CTX_TO_EP_TYPE(p)	(((p) >> 3) & 0x7)
 #define EP_TYPE(p)	((p) << 3)
 #define ISOC_OUT_EP	1
 #define BULK_OUT_EP	2
@@ -601,6 +603,8 @@
 /* bit 7 is Host Initiate Disable - for disabling stream selection */
 #define MAX_BURST(p)	(((p)&0xff) << 8)
 #define MAX_PACKET(p)	(((p)&0xffff) << 16)
+#define MAX_PACKET_MASK		(0xffff << 16)
+#define MAX_PACKET_DECODED(p)	(((p) >> 16) & 0xffff)
 
 
 /**
@@ -926,6 +930,12 @@
 	union xhci_trb		*last_trb;
 };
 
+struct xhci_dequeue_state {
+	struct xhci_segment *new_deq_seg;
+	union xhci_trb *new_deq_ptr;
+	int new_cycle_state;
+};
+
 struct xhci_ring {
 	struct xhci_segment	*first_seg;
 	union  xhci_trb		*enqueue;
@@ -952,12 +962,6 @@
 	u32			cycle_state;
 };
 
-struct xhci_dequeue_state {
-	struct xhci_segment *new_deq_seg;
-	union xhci_trb *new_deq_ptr;
-	int new_cycle_state;
-};
-
 struct xhci_erst_entry {
 	/* 64-bit event ring segment address */
 	u64	seg_addr;
@@ -1058,6 +1062,9 @@
 	int			noops_submitted;
 	int			noops_handled;
 	int			error_bitmask;
+	unsigned int		quirks;
+#define	XHCI_LINK_TRB_QUIRK	(1 << 0)
+#define XHCI_RESET_EP_QUIRK	(1 << 1)
 };
 
 /* For testing purposes */
@@ -1136,6 +1143,13 @@
 	writel(val_hi, ptr + 1);
 }
 
+static inline int xhci_link_trb_quirk(struct xhci_hcd *xhci)
+{
+	u32 temp = xhci_readl(xhci, &xhci->cap_regs->hc_capbase);
+	return ((HC_VERSION(temp) == 0x95) &&
+			(xhci->quirks & XHCI_LINK_TRB_QUIRK));
+}
+
 /* xHCI debugging */
 void xhci_print_ir_set(struct xhci_hcd *xhci, struct xhci_intr_reg *ir_set, int set_num);
 void xhci_print_registers(struct xhci_hcd *xhci);
@@ -1158,7 +1172,12 @@
 int xhci_setup_addressable_virt_dev(struct xhci_hcd *xhci, struct usb_device *udev);
 unsigned int xhci_get_endpoint_index(struct usb_endpoint_descriptor *desc);
 unsigned int xhci_get_endpoint_flag(struct usb_endpoint_descriptor *desc);
+unsigned int xhci_get_endpoint_flag_from_index(unsigned int ep_index);
+unsigned int xhci_last_valid_endpoint(u32 added_ctxs);
 void xhci_endpoint_zero(struct xhci_hcd *xhci, struct xhci_virt_device *virt_dev, struct usb_host_endpoint *ep);
+void xhci_endpoint_copy(struct xhci_hcd *xhci,
+		struct xhci_virt_device *vdev, unsigned int ep_index);
+void xhci_slot_copy(struct xhci_hcd *xhci, struct xhci_virt_device *vdev);
 int xhci_endpoint_init(struct xhci_hcd *xhci, struct xhci_virt_device *virt_dev,
 		struct usb_device *udev, struct usb_host_endpoint *ep,
 		gfp_t mem_flags);
@@ -1205,8 +1224,12 @@
 		int slot_id, unsigned int ep_index);
 int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags, struct urb *urb,
 		int slot_id, unsigned int ep_index);
+int xhci_queue_intr_tx(struct xhci_hcd *xhci, gfp_t mem_flags, struct urb *urb,
+		int slot_id, unsigned int ep_index);
 int xhci_queue_configure_endpoint(struct xhci_hcd *xhci, dma_addr_t in_ctx_ptr,
 		u32 slot_id);
+int xhci_queue_evaluate_context(struct xhci_hcd *xhci, dma_addr_t in_ctx_ptr,
+		u32 slot_id);
 int xhci_queue_reset_ep(struct xhci_hcd *xhci, int slot_id,
 		unsigned int ep_index);
 void xhci_find_new_dequeue_state(struct xhci_hcd *xhci,
@@ -1215,6 +1238,12 @@
 void xhci_queue_new_dequeue_state(struct xhci_hcd *xhci,
 		struct xhci_ring *ep_ring, unsigned int slot_id,
 		unsigned int ep_index, struct xhci_dequeue_state *deq_state);
+void xhci_cleanup_stalled_ring(struct xhci_hcd *xhci,
+		struct usb_device *udev,
+		unsigned int ep_index, struct xhci_ring *ep_ring);
+void xhci_queue_config_ep_quirk(struct xhci_hcd *xhci,
+		unsigned int slot_id, unsigned int ep_index,
+		struct xhci_dequeue_state *deq_state);
 
 /* xHCI roothub code */
 int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, u16 wIndex,
--- linux-rt-2.6.31.orig/drivers/usb/host/xhci-ring.c
+++ linux-rt-2.6.31/drivers/usb/host/xhci-ring.c
@@ -172,8 +172,9 @@
  * have their chain bit cleared (so that each Link TRB is a separate TD).
  *
  * Section 6.4.4.1 of the 0.95 spec says link TRBs cannot have the chain bit
- * set, but other sections talk about dealing with the chain bit set.
- * Assume section 6.4.4.1 is wrong, and the chain bit can be set in a Link TRB.
+ * set, but other sections talk about dealing with the chain bit set.  This was
+ * fixed in the 0.96 specification errata, but we have to assume that all 0.95
+ * xHCI hardware can't handle the chain bit being cleared on a link TRB.
  */
 static void inc_enq(struct xhci_hcd *xhci, struct xhci_ring *ring, bool consumer)
 {
@@ -191,8 +192,14 @@
 	while (last_trb(xhci, ring, ring->enq_seg, next)) {
 		if (!consumer) {
 			if (ring != xhci->event_ring) {
-				next->link.control &= ~TRB_CHAIN;
-				next->link.control |= chain;
+				/* If we're not dealing with 0.95 hardware,
+				 * carry over the chain bit of the previous TRB
+				 * (which may mean the chain bit is cleared).
+				 */
+				if (!xhci_link_trb_quirk(xhci)) {
+					next->link.control &= ~TRB_CHAIN;
+					next->link.control |= chain;
+				}
 				/* Give this link TRB to the hardware */
 				wmb();
 				if (next->link.control & TRB_CYCLE)
@@ -462,7 +469,6 @@
 	 * ring running.
 	 */
 	ep_ring->state |= SET_DEQ_PENDING;
-	xhci_ring_cmd_db(xhci);
 }
 
 /*
@@ -531,6 +537,7 @@
 	if (deq_state.new_deq_ptr && deq_state.new_deq_seg) {
 		xhci_queue_new_dequeue_state(xhci, ep_ring,
 				slot_id, ep_index, &deq_state);
+		xhci_ring_cmd_db(xhci);
 	} else {
 		/* Otherwise just ring the doorbell to restart the ring */
 		ring_ep_doorbell(xhci, slot_id, ep_index);
@@ -644,18 +651,31 @@
 {
 	int slot_id;
 	unsigned int ep_index;
+	struct xhci_ring *ep_ring;
 
 	slot_id = TRB_TO_SLOT_ID(trb->generic.field[3]);
 	ep_index = TRB_TO_EP_INDEX(trb->generic.field[3]);
+	ep_ring = xhci->devs[slot_id]->ep_rings[ep_index];
 	/* This command will only fail if the endpoint wasn't halted,
 	 * but we don't care.
 	 */
 	xhci_dbg(xhci, "Ignoring reset ep completion code of %u\n",
 			(unsigned int) GET_COMP_CODE(event->status));
 
-	/* Clear our internal halted state and restart the ring */
-	xhci->devs[slot_id]->ep_rings[ep_index]->state &= ~EP_HALTED;
-	ring_ep_doorbell(xhci, slot_id, ep_index);
+	/* HW with the reset endpoint quirk needs to have a configure endpoint
+	 * command complete before the endpoint can be used.  Queue that here
+	 * because the HW can't handle two commands being queued in a row.
+	 */
+	if (xhci->quirks & XHCI_RESET_EP_QUIRK) {
+		xhci_dbg(xhci, "Queueing configure endpoint command\n");
+		xhci_queue_configure_endpoint(xhci,
+				xhci->devs[slot_id]->in_ctx->dma, slot_id);
+		xhci_ring_cmd_db(xhci);
+	} else {
+		/* Clear our internal halted state and restart the ring */
+		ep_ring->state &= ~EP_HALTED;
+		ring_ep_doorbell(xhci, slot_id, ep_index);
+	}
 }
 
 static void handle_cmd_completion(struct xhci_hcd *xhci,
@@ -664,6 +684,10 @@
 	int slot_id = TRB_TO_SLOT_ID(event->flags);
 	u64 cmd_dma;
 	dma_addr_t cmd_dequeue_dma;
+	struct xhci_input_control_ctx *ctrl_ctx;
+	unsigned int ep_index;
+	struct xhci_ring *ep_ring;
+	unsigned int ep_state;
 
 	cmd_dma = event->cmd_trb;
 	cmd_dequeue_dma = xhci_trb_virt_to_dma(xhci->cmd_ring->deq_seg,
@@ -691,6 +715,41 @@
 			xhci_free_virt_device(xhci, slot_id);
 		break;
 	case TRB_TYPE(TRB_CONFIG_EP):
+		/*
+		 * Configure endpoint commands can come from the USB core
+		 * configuration or alt setting changes, or because the HW
+		 * needed an extra configure endpoint command after a reset
+		 * endpoint command.  In the latter case, the xHCI driver is
+		 * not waiting on the configure endpoint command.
+		 */
+		ctrl_ctx = xhci_get_input_control_ctx(xhci,
+				xhci->devs[slot_id]->in_ctx);
+		/* Input ctx add_flags are the endpoint index plus one */
+		ep_index = xhci_last_valid_endpoint(ctrl_ctx->add_flags) - 1;
+		ep_ring = xhci->devs[slot_id]->ep_rings[ep_index];
+		if (!ep_ring) {
+			/* This must have been an initial configure endpoint */
+			xhci->devs[slot_id]->cmd_status =
+				GET_COMP_CODE(event->status);
+			complete(&xhci->devs[slot_id]->cmd_completion);
+			break;
+		}
+		ep_state = ep_ring->state;
+		xhci_dbg(xhci, "Completed config ep cmd - last ep index = %d, "
+				"state = %d\n", ep_index, ep_state);
+		if (xhci->quirks & XHCI_RESET_EP_QUIRK &&
+				ep_state & EP_HALTED) {
+			/* Clear our internal halted state and restart ring */
+			xhci->devs[slot_id]->ep_rings[ep_index]->state &=
+				~EP_HALTED;
+			ring_ep_doorbell(xhci, slot_id, ep_index);
+		} else {
+			xhci->devs[slot_id]->cmd_status =
+				GET_COMP_CODE(event->status);
+			complete(&xhci->devs[slot_id]->cmd_completion);
+		}
+		break;
+	case TRB_TYPE(TRB_EVAL_CONTEXT):
 		xhci->devs[slot_id]->cmd_status = GET_COMP_CODE(event->status);
 		complete(&xhci->devs[slot_id]->cmd_completion);
 		break;
@@ -763,9 +822,11 @@
 	cur_seg = start_seg;
 
 	do {
+		if (start_dma == 0)
+			return 0;
 		/* We may get an event for a Link TRB in the middle of a TD */
 		end_seg_dma = xhci_trb_virt_to_dma(cur_seg,
-				&start_seg->trbs[TRBS_PER_SEGMENT - 1]);
+				&cur_seg->trbs[TRBS_PER_SEGMENT - 1]);
 		/* If the end TRB isn't in this segment, this is set to 0 */
 		end_trb_dma = xhci_trb_virt_to_dma(cur_seg, end_trb);
 
@@ -792,8 +853,9 @@
 		}
 		cur_seg = cur_seg->next;
 		start_dma = xhci_trb_virt_to_dma(cur_seg, &cur_seg->trbs[0]);
-	} while (1);
+	} while (cur_seg != start_seg);
 
+	return 0;
 }
 
 /*
@@ -806,6 +868,7 @@
 {
 	struct xhci_virt_device *xdev;
 	struct xhci_ring *ep_ring;
+	unsigned int slot_id;
 	int ep_index;
 	struct xhci_td *td = 0;
 	dma_addr_t event_dma;
@@ -814,9 +877,11 @@
 	struct urb *urb = 0;
 	int status = -EINPROGRESS;
 	struct xhci_ep_ctx *ep_ctx;
+	u32 trb_comp_code;
 
 	xhci_dbg(xhci, "In %s\n", __func__);
-	xdev = xhci->devs[TRB_TO_SLOT_ID(event->flags)];
+	slot_id = TRB_TO_SLOT_ID(event->flags);
+	xdev = xhci->devs[slot_id];
 	if (!xdev) {
 		xhci_err(xhci, "ERROR Transfer event pointed to bad slot\n");
 		return -ENODEV;
@@ -870,7 +935,8 @@
 			(unsigned int) event->flags);
 
 	/* Look for common error cases */
-	switch (GET_COMP_CODE(event->transfer_len)) {
+	trb_comp_code = GET_COMP_CODE(event->transfer_len);
+	switch (trb_comp_code) {
 	/* Skip codes that require special handling depending on
 	 * transfer type
 	 */
@@ -913,7 +979,7 @@
 	/* Was this a control transfer? */
 	if (usb_endpoint_xfer_control(&td->urb->ep->desc)) {
 		xhci_debug_trb(xhci, xhci->event_ring->dequeue);
-		switch (GET_COMP_CODE(event->transfer_len)) {
+		switch (trb_comp_code) {
 		case COMP_SUCCESS:
 			if (event_trb == ep_ring->dequeue) {
 				xhci_warn(xhci, "WARN: Success on ctrl setup TRB without IOC set??\n");
@@ -928,8 +994,39 @@
 			break;
 		case COMP_SHORT_TX:
 			xhci_warn(xhci, "WARN: short transfer on control ep\n");
-			status = -EREMOTEIO;
+			if (td->urb->transfer_flags & URB_SHORT_NOT_OK)
+				status = -EREMOTEIO;
+			else
+				status = 0;
 			break;
+		case COMP_BABBLE:
+			/* The 0.96 spec says a babbling control endpoint
+			 * is not halted. The 0.96 spec says it is.  Some HW
+			 * claims to be 0.95 compliant, but it halts the control
+			 * endpoint anyway.  Check if a babble halted the
+			 * endpoint.
+			 */
+			if (ep_ctx->ep_info != EP_STATE_HALTED)
+				break;
+			/* else fall through */
+		case COMP_STALL:
+			/* Did we transfer part of the data (middle) phase? */
+			if (event_trb != ep_ring->dequeue &&
+					event_trb != td->last_trb)
+				td->urb->actual_length =
+					td->urb->transfer_buffer_length
+					- TRB_LEN(event->transfer_len);
+			else
+				td->urb->actual_length = 0;
+
+			ep_ring->stopped_td = td;
+			ep_ring->stopped_trb = event_trb;
+			xhci_queue_reset_ep(xhci, slot_id, ep_index);
+			xhci_cleanup_stalled_ring(xhci,
+					td->urb->dev,
+					ep_index, ep_ring);
+			xhci_ring_cmd_db(xhci);
+			goto td_cleanup;
 		default:
 			/* Others already handled above */
 			break;
@@ -943,7 +1040,10 @@
 			if (event_trb == td->last_trb) {
 				if (td->urb->actual_length != 0) {
 					/* Don't overwrite a previously set error code */
-					if (status == -EINPROGRESS || status == 0)
+					if ((status == -EINPROGRESS ||
+								status == 0) &&
+							(td->urb->transfer_flags
+							 & URB_SHORT_NOT_OK))
 						/* Did we already see a short data stage? */
 						status = -EREMOTEIO;
 				} else {
@@ -952,7 +1052,7 @@
 				}
 			} else {
 			/* Maybe the event was for the data stage? */
-				if (GET_COMP_CODE(event->transfer_len) != COMP_STOP_INVAL) {
+				if (trb_comp_code != COMP_STOP_INVAL) {
 					/* We didn't stop on a link TRB in the middle */
 					td->urb->actual_length =
 						td->urb->transfer_buffer_length -
@@ -964,7 +1064,7 @@
 			}
 		}
 	} else {
-		switch (GET_COMP_CODE(event->transfer_len)) {
+		switch (trb_comp_code) {
 		case COMP_SUCCESS:
 			/* Double check that the HW transferred everything. */
 			if (event_trb != td->last_trb) {
@@ -975,7 +1075,12 @@
 				else
 					status = 0;
 			} else {
-				xhci_dbg(xhci, "Successful bulk transfer!\n");
+				if (usb_endpoint_xfer_bulk(&td->urb->ep->desc))
+					xhci_dbg(xhci, "Successful bulk "
+							"transfer!\n");
+				else
+					xhci_dbg(xhci, "Successful interrupt "
+							"transfer!\n");
 				status = 0;
 			}
 			break;
@@ -1001,11 +1106,17 @@
 				td->urb->actual_length =
 					td->urb->transfer_buffer_length -
 					TRB_LEN(event->transfer_len);
-				if (td->urb->actual_length < 0) {
+				if (td->urb->transfer_buffer_length <
+						td->urb->actual_length) {
 					xhci_warn(xhci, "HC gave bad length "
 							"of %d bytes left\n",
 							TRB_LEN(event->transfer_len));
 					td->urb->actual_length = 0;
+					if (td->urb->transfer_flags &
+							URB_SHORT_NOT_OK)
+						status = -EREMOTEIO;
+					else
+						status = 0;
 				}
 				/* Don't overwrite a previously set error code */
 				if (status == -EINPROGRESS) {
@@ -1041,14 +1152,14 @@
 			/* If the ring didn't stop on a Link or No-op TRB, add
 			 * in the actual bytes transferred from the Normal TRB
 			 */
-			if (GET_COMP_CODE(event->transfer_len) != COMP_STOP_INVAL)
+			if (trb_comp_code != COMP_STOP_INVAL)
 				td->urb->actual_length +=
 					TRB_LEN(cur_trb->generic.field[2]) -
 					TRB_LEN(event->transfer_len);
 		}
 	}
-	if (GET_COMP_CODE(event->transfer_len) == COMP_STOP_INVAL ||
-			GET_COMP_CODE(event->transfer_len) == COMP_STOP) {
+	if (trb_comp_code == COMP_STOP_INVAL ||
+			trb_comp_code == COMP_STOP) {
 		/* The Endpoint Stop Command completion will take care of any
 		 * stopped TDs.  A stopped TD may be restarted, so don't update
 		 * the ring dequeue pointer or take this TD off any lists yet.
@@ -1056,7 +1167,8 @@
 		ep_ring->stopped_td = td;
 		ep_ring->stopped_trb = event_trb;
 	} else {
-		if (GET_COMP_CODE(event->transfer_len) == COMP_STALL) {
+		if (trb_comp_code == COMP_STALL ||
+				trb_comp_code == COMP_BABBLE) {
 			/* The transfer is completed from the driver's
 			 * perspective, but we need to issue a set dequeue
 			 * command for this stalled endpoint to move the dequeue
@@ -1072,16 +1184,41 @@
 			inc_deq(xhci, ep_ring, false);
 		}
 
+td_cleanup:
 		/* Clean up the endpoint's TD list */
 		urb = td->urb;
+		/* Do one last check of the actual transfer length.
+		 * If the host controller said we transferred more data than
+		 * the buffer length, urb->actual_length will be a very big
+		 * number (since it's unsigned).  Play it safe and say we didn't
+		 * transfer anything.
+		 */
+		if (urb->actual_length > urb->transfer_buffer_length) {
+			xhci_warn(xhci, "URB transfer length is wrong, "
+					"xHC issue? req. len = %u, "
+					"act. len = %u\n",
+					urb->transfer_buffer_length,
+					urb->actual_length);
+			urb->actual_length = 0;
+			if (td->urb->transfer_flags & URB_SHORT_NOT_OK)
+				status = -EREMOTEIO;
+			else
+				status = 0;
+		}
 		list_del(&td->td_list);
 		/* Was this TD slated to be cancelled but completed anyway? */
 		if (!list_empty(&td->cancelled_td_list)) {
 			list_del(&td->cancelled_td_list);
 			ep_ring->cancels_pending--;
 		}
-		/* Leave the TD around for the reset endpoint function to use */
-		if (GET_COMP_CODE(event->transfer_len) != COMP_STALL) {
+		/* Leave the TD around for the reset endpoint function to use
+		 * (but only if it's not a control endpoint, since we already
+		 * queued the Set TR dequeue pointer command for stalled
+		 * control endpoints).
+		 */
+		if (usb_endpoint_xfer_control(&urb->ep->desc) ||
+			(trb_comp_code != COMP_STALL &&
+				trb_comp_code != COMP_BABBLE)) {
 			kfree(td);
 		}
 		urb->hcpriv = NULL;
@@ -1094,7 +1231,7 @@
 	if (urb) {
 		usb_hcd_unlink_urb_from_ep(xhci_to_hcd(xhci), urb);
 		xhci_dbg(xhci, "Giveback URB %p, len = %d, status = %d\n",
-				urb, td->urb->actual_length, status);
+				urb, urb->actual_length, status);
 		spin_unlock(&xhci->lock);
 		usb_hcd_giveback_urb(xhci_to_hcd(xhci), urb, status);
 		spin_lock(&xhci->lock);
@@ -1335,6 +1472,47 @@
 	ring_ep_doorbell(xhci, slot_id, ep_index);
 }
 
+/*
+ * xHCI uses normal TRBs for both bulk and interrupt.  When the interrupt
+ * endpoint is to be serviced, the xHC will consume (at most) one TD.  A TD
+ * (comprised of sg list entries) can take several service intervals to
+ * transmit.
+ */
+int xhci_queue_intr_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
+		struct urb *urb, int slot_id, unsigned int ep_index)
+{
+	struct xhci_ep_ctx *ep_ctx = xhci_get_ep_ctx(xhci,
+			xhci->devs[slot_id]->out_ctx, ep_index);
+	int xhci_interval;
+	int ep_interval;
+
+	xhci_interval = EP_INTERVAL_TO_UFRAMES(ep_ctx->ep_info);
+	ep_interval = urb->interval;
+	/* Convert to microframes */
+	if (urb->dev->speed == USB_SPEED_LOW ||
+			urb->dev->speed == USB_SPEED_FULL)
+		ep_interval *= 8;
+	/* FIXME change this to a warning and a suggestion to use the new API
+	 * to set the polling interval (once the API is added).
+	 */
+	if (xhci_interval != ep_interval) {
+		if (!printk_ratelimit())
+			dev_dbg(&urb->dev->dev, "Driver uses different interval"
+					" (%d microframe%s) than xHCI "
+					"(%d microframe%s)\n",
+					ep_interval,
+					ep_interval == 1 ? "" : "s",
+					xhci_interval,
+					xhci_interval == 1 ? "" : "s");
+		urb->interval = xhci_interval;
+		/* Convert back to frames for LS/FS devices */
+		if (urb->dev->speed == USB_SPEED_LOW ||
+				urb->dev->speed == USB_SPEED_FULL)
+			urb->interval /= 8;
+	}
+	return xhci_queue_bulk_tx(xhci, GFP_ATOMIC, urb, slot_id, ep_index);
+}
+
 static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
 		struct urb *urb, int slot_id, unsigned int ep_index)
 {
@@ -1733,6 +1911,15 @@
 			TRB_TYPE(TRB_CONFIG_EP) | SLOT_ID_FOR_TRB(slot_id));
 }
 
+/* Queue an evaluate context command TRB */
+int xhci_queue_evaluate_context(struct xhci_hcd *xhci, dma_addr_t in_ctx_ptr,
+		u32 slot_id)
+{
+	return queue_command(xhci, lower_32_bits(in_ctx_ptr),
+			upper_32_bits(in_ctx_ptr), 0,
+			TRB_TYPE(TRB_EVAL_CONTEXT) | SLOT_ID_FOR_TRB(slot_id));
+}
+
 int xhci_queue_stop_endpoint(struct xhci_hcd *xhci, int slot_id,
 		unsigned int ep_index)
 {
--- linux-rt-2.6.31.orig/drivers/usb/host/ehci.h
+++ linux-rt-2.6.31/drivers/usb/host/ehci.h
@@ -118,6 +118,7 @@
 	unsigned		stamp;
 	unsigned		random_frame;
 	unsigned long		next_statechange;
+	ktime_t			last_periodic_enable;
 	u32			command;
 
 	/* SILICON QUIRKS */
@@ -126,6 +127,7 @@
 	unsigned		big_endian_mmio:1;
 	unsigned		big_endian_desc:1;
 	unsigned		has_amcc_usb23:1;
+	unsigned		broken_periodic:1;
 
 	/* required for usb32 quirk */
 	#define OHCI_CTRL_HCFS          (3 << 6)
--- linux-rt-2.6.31.orig/drivers/usb/host/xhci-pci.c
+++ linux-rt-2.6.31/drivers/usb/host/xhci-pci.c
@@ -24,6 +24,10 @@
 
 #include "xhci.h"
 
+/* Device for a quirk */
+#define PCI_VENDOR_ID_FRESCO_LOGIC	0x1b73
+#define PCI_DEVICE_ID_FRESCO_LOGIC_PDK	0x1000
+
 static const char hcd_name[] = "xhci_hcd";
 
 /* called after powerup, by probe or system-pm "wakeup" */
@@ -62,6 +66,15 @@
 	xhci->hcc_params = xhci_readl(xhci, &xhci->cap_regs->hcc_params);
 	xhci_print_registers(xhci);
 
+	/* Look for vendor-specific quirks */
+	if (pdev->vendor == PCI_VENDOR_ID_FRESCO_LOGIC &&
+			pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_PDK &&
+			pdev->revision == 0x0) {
+			xhci->quirks |= XHCI_RESET_EP_QUIRK;
+			xhci_dbg(xhci, "QUIRK: Fresco Logic xHC needs configure"
+					" endpoint cmd after reset endpoint\n");
+	}
+
 	/* Make sure the HC is halted. */
 	retval = xhci_halt(xhci);
 	if (retval)
--- linux-rt-2.6.31.orig/drivers/usb/host/ehci-q.c
+++ linux-rt-2.6.31/drivers/usb/host/ehci-q.c
@@ -475,8 +475,20 @@
 			 * we must clear the TT buffer (11.17.5).
 			 */
 			if (unlikely(last_status != -EINPROGRESS &&
-					last_status != -EREMOTEIO))
-				ehci_clear_tt_buffer(ehci, qh, urb, token);
+					last_status != -EREMOTEIO)) {
+				/* The TT's in some hubs malfunction when they
+				 * receive this request following a STALL (they
+				 * stop sending isochronous packets).  Since a
+				 * STALL can't leave the TT buffer in a busy
+				 * state (if you believe Figures 11-48 - 11-51
+				 * in the USB 2.0 spec), we won't clear the TT
+				 * buffer in this case.  Strictly speaking this
+				 * is a violation of the spec.
+				 */
+				if (last_status != -EPIPE)
+					ehci_clear_tt_buffer(ehci, qh, urb,
+							token);
+			}
 		}
 
 		/* if we're removing something not at the queue head,
--- linux-rt-2.6.31.orig/drivers/usb/host/ohci-pci.c
+++ linux-rt-2.6.31/drivers/usb/host/ohci-pci.c
@@ -177,6 +177,13 @@
 		return 0;
 
 	pci_read_config_byte(amd_smbus_dev, PCI_REVISION_ID, &rev);
+
+	/* SB800 needs pre-fetch fix */
+	if ((rev >= 0x40) && (rev <= 0x4f)) {
+		ohci->flags |= OHCI_QUIRK_AMD_PREFETCH;
+		ohci_dbg(ohci, "enabled AMD prefetch quirk\n");
+	}
+
 	if ((rev > 0x3b) || (rev < 0x30)) {
 		pci_dev_put(amd_smbus_dev);
 		amd_smbus_dev = NULL;
@@ -262,6 +269,19 @@
 
 }
 
+static void sb800_prefetch(struct ohci_hcd *ohci, int on)
+{
+	struct pci_dev *pdev;
+	u16 misc;
+
+	pdev = to_pci_dev(ohci_to_hcd(ohci)->self.controller);
+	pci_read_config_word(pdev, 0x50, &misc);
+	if (on == 0)
+		pci_write_config_word(pdev, 0x50, misc & 0xfcff);
+	else
+		pci_write_config_word(pdev, 0x50, misc | 0x0300);
+}
+
 /* List of quirks for OHCI */
 static const struct pci_device_id ohci_pci_quirks[] = {
 	{
--- linux-rt-2.6.31.orig/drivers/usb/host/ehci-hcd.c
+++ linux-rt-2.6.31/drivers/usb/host/ehci-hcd.c
@@ -28,6 +28,7 @@
 #include <linux/errno.h>
 #include <linux/init.h>
 #include <linux/timer.h>
+#include <linux/ktime.h>
 #include <linux/list.h>
 #include <linux/interrupt.h>
 #include <linux/reboot.h>
@@ -655,6 +656,7 @@
 	ehci_readl(ehci, &ehci->regs->command);	/* unblock posted writes */
 	msleep(5);
 	up_write(&ehci_cf_port_reset_rwsem);
+	ehci->last_periodic_enable = ktime_get_real();
 
 	temp = HC_VERSION(ehci_readl(ehci, &ehci->caps->hc_capbase));
 	ehci_info (ehci,
--- linux-rt-2.6.31.orig/drivers/usb/storage/transport.c
+++ linux-rt-2.6.31/drivers/usb/storage/transport.c
@@ -666,10 +666,11 @@
 	 * to wait for at least one CHECK_CONDITION to determine
 	 * SANE_SENSE support
 	 */
-	if ((srb->cmnd[0] == ATA_16 || srb->cmnd[0] == ATA_12) &&
+	if (unlikely((srb->cmnd[0] == ATA_16 || srb->cmnd[0] == ATA_12) &&
 	    result == USB_STOR_TRANSPORT_GOOD &&
 	    !(us->fflags & US_FL_SANE_SENSE) &&
-	    !(srb->cmnd[2] & 0x20)) {
+	    !(us->fflags & US_FL_BAD_SENSE) &&
+	    !(srb->cmnd[2] & 0x20))) {
 		US_DEBUGP("-- SAT supported, increasing auto-sense\n");
 		us->fflags |= US_FL_SANE_SENSE;
 	}
@@ -696,7 +697,7 @@
 		/* device supports and needs bigger sense buffer */
 		if (us->fflags & US_FL_SANE_SENSE)
 			sense_size = ~0;
-
+Retry_Sense:
 		US_DEBUGP("Issuing auto-REQUEST_SENSE\n");
 
 		scsi_eh_prep_cmnd(srb, &ses, NULL, 0, sense_size);
@@ -718,8 +719,30 @@
 		if (test_bit(US_FLIDX_TIMED_OUT, &us->dflags)) {
 			US_DEBUGP("-- auto-sense aborted\n");
 			srb->result = DID_ABORT << 16;
+
+			/* If SANE_SENSE caused this problem, disable it */
+			if (sense_size != US_SENSE_SIZE) {
+				us->fflags &= ~US_FL_SANE_SENSE;
+				us->fflags |= US_FL_BAD_SENSE;
+			}
 			goto Handle_Errors;
 		}
+
+		/* Some devices claim to support larger sense but fail when
+		 * trying to request it. When a transport failure happens
+		 * using US_FS_SANE_SENSE, we always retry with a standard
+		 * (small) sense request. This fixes some USB GSM modems
+		 */
+		if (temp_result == USB_STOR_TRANSPORT_FAILED &&
+				sense_size != US_SENSE_SIZE) {
+			US_DEBUGP("-- auto-sense failure, retry small sense\n");
+			sense_size = US_SENSE_SIZE;
+			us->fflags &= ~US_FL_SANE_SENSE;
+			us->fflags |= US_FL_BAD_SENSE;
+			goto Retry_Sense;
+		}
+
+		/* Other failures */
 		if (temp_result != USB_STOR_TRANSPORT_GOOD) {
 			US_DEBUGP("-- auto-sense failure\n");
 
@@ -739,6 +762,7 @@
 		 */
 		if (srb->sense_buffer[7] > (US_SENSE_SIZE - 8) &&
 		    !(us->fflags & US_FL_SANE_SENSE) &&
+		    !(us->fflags & US_FL_BAD_SENSE) &&
 		    (srb->sense_buffer[0] & 0x7C) == 0x70) {
 			US_DEBUGP("-- SANE_SENSE support enabled\n");
 			us->fflags |= US_FL_SANE_SENSE;
@@ -768,17 +792,32 @@
 		/* set the result so the higher layers expect this data */
 		srb->result = SAM_STAT_CHECK_CONDITION;
 
-		/* If things are really okay, then let's show that.  Zero
-		 * out the sense buffer so the higher layers won't realize
-		 * we did an unsolicited auto-sense. */
-		if (result == USB_STOR_TRANSPORT_GOOD &&
-			/* Filemark 0, ignore EOM, ILI 0, no sense */
+		/* We often get empty sense data.  This could indicate that
+		 * everything worked or that there was an unspecified
+		 * problem.  We have to decide which.
+		 */
+		if (	/* Filemark 0, ignore EOM, ILI 0, no sense */
 				(srb->sense_buffer[2] & 0xaf) == 0 &&
 			/* No ASC or ASCQ */
 				srb->sense_buffer[12] == 0 &&
 				srb->sense_buffer[13] == 0) {
-			srb->result = SAM_STAT_GOOD;
-			srb->sense_buffer[0] = 0x0;
+
+			/* If things are really okay, then let's show that.
+			 * Zero out the sense buffer so the higher layers
+			 * won't realize we did an unsolicited auto-sense.
+			 */
+			if (result == USB_STOR_TRANSPORT_GOOD) {
+				srb->result = SAM_STAT_GOOD;
+				srb->sense_buffer[0] = 0x0;
+
+			/* If there was a problem, report an unspecified
+			 * hardware error to prevent the higher layers from
+			 * entering an infinite retry loop.
+			 */
+			} else {
+				srb->result = DID_ERROR << 16;
+				srb->sense_buffer[2] = HARDWARE_ERROR;
+			}
 		}
 	}
 
--- linux-rt-2.6.31.orig/drivers/usb/storage/usb.c
+++ linux-rt-2.6.31/drivers/usb/storage/usb.c
@@ -228,6 +228,7 @@
 	if (data_len<36) // You lose.
 		return;
 
+	memset(data+8, ' ', 28);
 	if(data[0]&0x20) { /* USB device currently not connected. Return
 			      peripheral qualifier 001b ("...however, the
 			      physical device is not currently connected
@@ -237,15 +238,15 @@
 			      device, it may return zeros or ASCII spaces 
 			      (20h) in those fields until the data is
 			      available from the device."). */
-		memset(data+8,0,28);
 	} else {
 		u16 bcdDevice = le16_to_cpu(us->pusb_dev->descriptor.bcdDevice);
-		memcpy(data+8, us->unusual_dev->vendorName, 
-			strlen(us->unusual_dev->vendorName) > 8 ? 8 :
-			strlen(us->unusual_dev->vendorName));
-		memcpy(data+16, us->unusual_dev->productName, 
-			strlen(us->unusual_dev->productName) > 16 ? 16 :
-			strlen(us->unusual_dev->productName));
+		int n;
+
+		n = strlen(us->unusual_dev->vendorName);
+		memcpy(data+8, us->unusual_dev->vendorName, min(8, n));
+		n = strlen(us->unusual_dev->productName);
+		memcpy(data+16, us->unusual_dev->productName, min(16, n));
+
 		data[32] = 0x30 + ((bcdDevice>>12) & 0x0F);
 		data[33] = 0x30 + ((bcdDevice>>8) & 0x0F);
 		data[34] = 0x30 + ((bcdDevice>>4) & 0x0F);
@@ -459,6 +460,9 @@
 		case 'a':
 			f |= US_FL_SANE_SENSE;
 			break;
+		case 'b':
+			f |= US_FL_BAD_SENSE;
+			break;
 		case 'c':
 			f |= US_FL_FIX_CAPACITY;
 			break;
--- linux-rt-2.6.31.orig/drivers/usb/storage/unusual_devs.h
+++ linux-rt-2.6.31/drivers/usb/storage/unusual_devs.h
@@ -838,6 +838,13 @@
 		US_SC_DEVICE, US_PR_DEVICE, NULL,
 		US_FL_FIX_CAPACITY ),
 
+/* Reported by Daniel Kukula <daniel.kuku@gmail.com> */
+UNUSUAL_DEV( 0x067b, 0x1063, 0x0100, 0x0100,
+		"Prolific Technology, Inc.",
+		"Prolific Storage Gadget",
+		US_SC_DEVICE, US_PR_DEVICE, NULL,
+		US_FL_BAD_SENSE ),
+
 /* Reported by Rogerio Brito <rbrito@ime.usp.br> */
 UNUSUAL_DEV( 0x067b, 0x2317, 0x0001, 0x001,
 		"Prolific Technology, Inc.",
@@ -1149,6 +1156,13 @@
 		US_SC_DEVICE, US_PR_DEVICE, option_ms_init,
 		0),
 
+/* Reported by Timo Aaltonen <tjaalton@ubuntu.com> */
+UNUSUAL_DEV( 0x0af0, 0x7011, 0x0000, 0x9999,
+		"Option",
+		"Mass Storage",
+		US_SC_DEVICE, US_PR_DEVICE, option_ms_init,
+		0 ),
+
 /* Reported by F. Aben <f.aben@option.com>
  * This device (wrongly) has a vendor-specific device descriptor.
  * The entry is needed so usb-storage can bind to it's mass-storage
--- linux-rt-2.6.31.orig/drivers/usb/storage/initializers.c
+++ linux-rt-2.6.31/drivers/usb/storage/initializers.c
@@ -102,5 +102,5 @@
 				      USB_TYPE_STANDARD | USB_RECIP_DEVICE,
 				      0x01, 0x0, NULL, 0x0, 1000);
 	US_DEBUGP("Huawei mode set result is %d\n", result);
-	return (result ? 0 : -ENODEV);
+	return 0;
 }
--- linux-rt-2.6.31.orig/drivers/usb/storage/onetouch.c
+++ linux-rt-2.6.31/drivers/usb/storage/onetouch.c
@@ -163,7 +163,7 @@
 			usb_kill_urb(onetouch->irq);
 			break;
 		case US_RESUME:
-			if (usb_submit_urb(onetouch->irq, GFP_KERNEL) != 0)
+			if (usb_submit_urb(onetouch->irq, GFP_NOIO) != 0)
 				dev_err(&onetouch->irq->dev->dev,
 					"usb_submit_urb failed\n");
 			break;
--- linux-rt-2.6.31.orig/drivers/usb/serial/option.c
+++ linux-rt-2.6.31/drivers/usb/serial/option.c
@@ -166,6 +166,7 @@
 #define HUAWEI_PRODUCT_E143D			0x143D
 #define HUAWEI_PRODUCT_E143E			0x143E
 #define HUAWEI_PRODUCT_E143F			0x143F
+#define HUAWEI_PRODUCT_E14AC			0x14AC
 
 #define QUANTA_VENDOR_ID			0x0408
 #define QUANTA_PRODUCT_Q101			0xEA02
@@ -225,6 +226,7 @@
 #define AMOI_VENDOR_ID				0x1614
 #define AMOI_PRODUCT_H01			0x0800
 #define AMOI_PRODUCT_H01A			0x7002
+#define AMOI_PRODUCT_9508			0x0800
 #define AMOI_PRODUCT_H02			0x0802
 
 #define DELL_VENDOR_ID				0x413C
@@ -283,15 +285,13 @@
 #define BANDRICH_PRODUCT_1011			0x1011
 #define BANDRICH_PRODUCT_1012			0x1012
 
-#define AMOI_VENDOR_ID			0x1614
-#define AMOI_PRODUCT_9508			0x0800
-
 #define QUALCOMM_VENDOR_ID			0x05C6
 
 #define MAXON_VENDOR_ID				0x16d8
 
 #define TELIT_VENDOR_ID				0x1bc7
 #define TELIT_PRODUCT_UC864E			0x1003
+#define TELIT_PRODUCT_UC864G			0x1004
 
 /* ZTE PRODUCTS */
 #define ZTE_VENDOR_ID				0x19d2
@@ -300,12 +300,14 @@
 #define ZTE_PRODUCT_MF626			0x0031
 #define ZTE_PRODUCT_CDMA_TECH			0xfffe
 #define ZTE_PRODUCT_AC8710			0xfff1
+#define ZTE_PRODUCT_AC2726			0xfff5
 
 #define BENQ_VENDOR_ID				0x04a5
 #define BENQ_PRODUCT_H10			0x4068
 
 #define DLINK_VENDOR_ID				0x1186
 #define DLINK_PRODUCT_DWM_652			0x3e04
+#define DLINK_PRODUCT_DWM_652_U5		0xce16
 
 #define QISDA_VENDOR_ID				0x1da5
 #define QISDA_PRODUCT_H21_4512			0x4512
@@ -313,10 +315,14 @@
 #define QISDA_PRODUCT_H20_4515			0x4515
 #define QISDA_PRODUCT_H20_4519			0x4519
 
+/* TLAYTECH PRODUCTS */
+#define TLAYTECH_VENDOR_ID			0x20B9
+#define TLAYTECH_PRODUCT_TEU800			0x1682
 
 /* TOSHIBA PRODUCTS */
 #define TOSHIBA_VENDOR_ID			0x0930
 #define TOSHIBA_PRODUCT_HSDPA_MINICARD		0x1302
+#define TOSHIBA_PRODUCT_G450			0x0d45
 
 #define ALINK_VENDOR_ID				0x1e0e
 #define ALINK_PRODUCT_3GU			0x9200
@@ -325,6 +331,13 @@
 #define ALCATEL_VENDOR_ID			0x1bbb
 #define ALCATEL_PRODUCT_X060S			0x0000
 
+/* Airplus products */
+#define AIRPLUS_VENDOR_ID			0x1011
+#define AIRPLUS_PRODUCT_MCD650			0x3198
+
+/* Haier products */
+#define HAIER_VENDOR_ID				0x201e
+#define HAIER_PRODUCT_CE100			0x2009
 
 static struct usb_device_id option_ids[] = {
 	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) },
@@ -423,6 +436,7 @@
 	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E143D, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E143E, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E143F, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E14AC) },
 	{ USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_9508) },
 	{ USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V640) }, /* Novatel Merlin V640/XV620 */
 	{ USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V620) }, /* Novatel Merlin V620/S620 */
@@ -503,6 +517,7 @@
 	{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */
 	{ USB_DEVICE(MAXON_VENDOR_ID, 0x6280) }, /* BP3-USB & BP3-EXT HSDPA */
 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UC864E) },
+	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UC864G) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0003, 0xff, 0xff, 0xff) },
@@ -564,24 +579,67 @@
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0086, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2002, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2003, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0104, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0106, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0108, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0113, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0117, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0118, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0121, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0122, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0123, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0124, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0125, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0126, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0128, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0142, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0143, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0144, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0145, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0146, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0147, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0148, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0149, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0150, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0151, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0152, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0153, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0154, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0155, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0156, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0157, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0158, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0159, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0160, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0161, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0162, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0014, 0xff, 0xff, 0xff) }, /* ZTE CDMA products */
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0027, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0059, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0060, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0070, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0073, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0130, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0141, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC8710, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC2726, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE(BENQ_VENDOR_ID, BENQ_PRODUCT_H10) },
 	{ USB_DEVICE(DLINK_VENDOR_ID, DLINK_PRODUCT_DWM_652) },
+	{ USB_DEVICE(ALINK_VENDOR_ID, DLINK_PRODUCT_DWM_652_U5) }, /* Yes, ALINK_VENDOR_ID */
 	{ USB_DEVICE(QISDA_VENDOR_ID, QISDA_PRODUCT_H21_4512) },
 	{ USB_DEVICE(QISDA_VENDOR_ID, QISDA_PRODUCT_H21_4523) },
 	{ USB_DEVICE(QISDA_VENDOR_ID, QISDA_PRODUCT_H20_4515) },
 	{ USB_DEVICE(QISDA_VENDOR_ID, QISDA_PRODUCT_H20_4519) },
+	{ USB_DEVICE(TOSHIBA_VENDOR_ID, TOSHIBA_PRODUCT_G450) },
 	{ USB_DEVICE(TOSHIBA_VENDOR_ID, TOSHIBA_PRODUCT_HSDPA_MINICARD ) }, /* Toshiba 3G HSDPA == Novatel Expedite EU870D MiniCard */
 	{ USB_DEVICE(ALINK_VENDOR_ID, 0x9000) },
+	{ USB_DEVICE(ALINK_VENDOR_ID, 0xce16) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(ALINK_VENDOR_ID, ALINK_PRODUCT_3GU, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S) },
+	{ USB_DEVICE(AIRPLUS_VENDOR_ID, AIRPLUS_PRODUCT_MCD650) },
+	{ USB_DEVICE(TLAYTECH_VENDOR_ID, TLAYTECH_PRODUCT_TEU800) },
+	{ USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) },
 	{ } /* Terminating entry */
 };
 MODULE_DEVICE_TABLE(usb, option_ids);
--- linux-rt-2.6.31.orig/drivers/usb/serial/console.c
+++ linux-rt-2.6.31/drivers/usb/serial/console.c
@@ -16,6 +16,7 @@
 #include <linux/slab.h>
 #include <linux/tty.h>
 #include <linux/console.h>
+#include <linux/serial.h>
 #include <linux/usb.h>
 #include <linux/usb/serial.h>
 
@@ -63,7 +64,7 @@
 	char *s;
 	struct usb_serial *serial;
 	struct usb_serial_port *port;
-	int retval = 0;
+	int retval;
 	struct tty_struct *tty = NULL;
 	struct ktermios *termios = NULL, dummy;
 
@@ -116,13 +117,17 @@
 		return -ENODEV;
 	}
 
-	port = serial->port[0];
+	retval = usb_autopm_get_interface(serial->interface);
+	if (retval)
+		goto error_get_interface;
+
+	port = serial->port[co->index - serial->minor];
 	tty_port_tty_set(&port->port, NULL);
 
 	info->port = port;
 
 	++port->port.count;
-	if (port->port.count == 1) {
+	if (!test_bit(ASYNCB_INITIALIZED, &port->port.flags)) {
 		if (serial->type->set_termios) {
 			/*
 			 * allocate a fake tty so the driver can initialize
@@ -168,6 +173,7 @@
 			kfree(termios);
 			kfree(tty);
 		}
+		set_bit(ASYNCB_INITIALIZED, &port->port.flags);
 	}
 	/* Now that any required fake tty operations are completed restore
 	 * the tty port count */
@@ -175,18 +181,22 @@
 	/* The console is special in terms of closing the device so
 	 * indicate this port is now acting as a system console. */
 	port->console = 1;
-	retval = 0;
 
-out:
+	mutex_unlock(&serial->disc_mutex);
 	return retval;
-free_termios:
+
+ free_termios:
 	kfree(termios);
 	tty_port_tty_set(&port->port, NULL);
-free_tty:
+ free_tty:
 	kfree(tty);
-reset_open_count:
+ reset_open_count:
 	port->port.count = 0;
-	goto out;
+	usb_autopm_put_interface(serial->interface);
+ error_get_interface:
+	usb_serial_put(serial);
+	mutex_unlock(&serial->disc_mutex);
+	return retval;
 }
 
 static void usb_console_write(struct console *co,
--- linux-rt-2.6.31.orig/drivers/usb/serial/pl2303.c
+++ linux-rt-2.6.31/drivers/usb/serial/pl2303.c
@@ -96,6 +96,7 @@
 	{ USB_DEVICE(HP_VENDOR_ID, HP_LD220_PRODUCT_ID) },
 	{ USB_DEVICE(CRESSI_VENDOR_ID, CRESSI_EDY_PRODUCT_ID) },
 	{ USB_DEVICE(SONY_VENDOR_ID, SONY_QN3USB_PRODUCT_ID) },
+	{ USB_DEVICE(SANWA_VENDOR_ID, SANWA_PRODUCT_ID) },
 	{ }					/* Terminating entry */
 };
 
@@ -994,13 +995,15 @@
 	/* overrun is special, not associated with a char */
 	if (line_status & UART_OVERRUN_ERROR)
 		tty_insert_flip_char(tty, 0, TTY_OVERRUN);
-	if (port->console && port->sysrq) {
+
+	if (tty_flag == TTY_NORMAL && !(port->console && port->sysrq))
+		tty_insert_flip_string(tty, data, urb->actual_length);
+	else {
 		int i;
 		for (i = 0; i < urb->actual_length; ++i)
 			if (!usb_serial_handle_sysrq_char(tty, port, data[i]))
 				tty_insert_flip_char(tty, data[i], tty_flag);
-	} else
-		tty_insert_flip_string(tty, data, urb->actual_length);
+	}
 	tty_flip_buffer_push(tty);
 }
 
--- linux-rt-2.6.31.orig/drivers/usb/serial/iuu_phoenix.c
+++ linux-rt-2.6.31/drivers/usb/serial/iuu_phoenix.c
@@ -71,7 +71,6 @@
 	spinlock_t lock;	/* store irq state */
 	wait_queue_head_t delta_msr_wait;
 	u8 line_status;
-	u8 termios_initialized;
 	int tiostatus;		/* store IUART SIGNAL for tiocmget call */
 	u8 reset;		/* if 1 reset is needed */
 	int poll;		/* number of poll */
@@ -1018,6 +1017,18 @@
 	}
 }
 
+static void iuu_init_termios(struct tty_struct *tty)
+{
+	*(tty->termios) = tty_std_termios;
+	tty->termios->c_cflag = CLOCAL | CREAD | CS8 | B9600
+				| TIOCM_CTS | CSTOPB | PARENB;
+	tty->termios->c_ispeed = 9600;
+	tty->termios->c_ospeed = 9600;
+	tty->termios->c_lflag = 0;
+	tty->termios->c_oflag = 0;
+	tty->termios->c_iflag = 0;
+}
+
 static int iuu_open(struct tty_struct *tty,
 			struct usb_serial_port *port, struct file *filp)
 {
@@ -1025,7 +1036,6 @@
 	u8 *buf;
 	int result;
 	u32 actual;
-	unsigned long flags;
 	struct iuu_private *priv = usb_get_serial_port_data(port);
 
 	dbg("%s -  port %d", __func__, port->number);
@@ -1064,21 +1074,7 @@
 			  port->bulk_in_buffer, 512,
 			  NULL, NULL);
 
-	/* set the termios structure */
-	spin_lock_irqsave(&priv->lock, flags);
-	if (tty && !priv->termios_initialized) {
-		*(tty->termios) = tty_std_termios;
-		tty->termios->c_cflag = CLOCAL | CREAD | CS8 | B9600
-					| TIOCM_CTS | CSTOPB | PARENB;
-		tty->termios->c_ispeed = 9600;
-		tty->termios->c_ospeed = 9600;
-		tty->termios->c_lflag = 0;
-		tty->termios->c_oflag = 0;
-		tty->termios->c_iflag = 0;
-		priv->termios_initialized = 1;
-		priv->poll = 0;
-	 }
-	spin_unlock_irqrestore(&priv->lock, flags);
+	priv->poll = 0;
 
 	/* initialize writebuf */
 #define FISH(a, b, c, d) do { \
@@ -1201,6 +1197,7 @@
 	.tiocmget = iuu_tiocmget,
 	.tiocmset = iuu_tiocmset,
 	.set_termios = iuu_set_termios,
+	.init_termios = iuu_init_termios,
 	.attach = iuu_startup,
 	.release = iuu_release,
 };
--- linux-rt-2.6.31.orig/drivers/usb/serial/spcp8x5.c
+++ linux-rt-2.6.31/drivers/usb/serial/spcp8x5.c
@@ -299,7 +299,6 @@
 	wait_queue_head_t	delta_msr_wait;
 	u8 			line_control;
 	u8 			line_status;
-	u8 			termios_initialized;
 };
 
 /* desc : when device plug in,this function would be called.
@@ -498,6 +497,15 @@
 		dev_dbg(&port->dev, "usb_unlink_urb(read_urb) = %d\n", result);
 }
 
+static void spcp8x5_init_termios(struct tty_struct *tty)
+{
+	/* for the 1st time call this function */
+	*(tty->termios) = tty_std_termios;
+	tty->termios->c_cflag = B115200 | CS8 | CREAD | HUPCL | CLOCAL;
+	tty->termios->c_ispeed = 115200;
+	tty->termios->c_ospeed = 115200;
+}
+
 /* set the serial param for transfer. we should check if we really need to
  * transfer. if we set flow control we should do this too. */
 static void spcp8x5_set_termios(struct tty_struct *tty,
@@ -514,16 +522,6 @@
 	int i;
 	u8 control;
 
-	/* for the 1st time call this function */
-	spin_lock_irqsave(&priv->lock, flags);
-	if (!priv->termios_initialized) {
-		*(tty->termios) = tty_std_termios;
-		tty->termios->c_cflag = B115200 | CS8 | CREAD | HUPCL | CLOCAL;
-		tty->termios->c_ispeed = 115200;
-		tty->termios->c_ospeed = 115200;
-		priv->termios_initialized = 1;
-	}
-	spin_unlock_irqrestore(&priv->lock, flags);
 
 	/* check that they really want us to change something */
 	if (!tty_termios_hw_change(tty->termios, old_termios))
@@ -1011,6 +1009,7 @@
 	.carrier_raised		= spcp8x5_carrier_raised,
 	.write 			= spcp8x5_write,
 	.set_termios 		= spcp8x5_set_termios,
+	.init_termios		= spcp8x5_init_termios,
 	.ioctl 			= spcp8x5_ioctl,
 	.tiocmget 		= spcp8x5_tiocmget,
 	.tiocmset 		= spcp8x5_tiocmset,
--- linux-rt-2.6.31.orig/drivers/usb/serial/ftdi_sio.h
+++ linux-rt-2.6.31/drivers/usb/serial/ftdi_sio.h
@@ -81,6 +81,9 @@
 
 /* OpenDCC (www.opendcc.de) product id */
 #define FTDI_OPENDCC_PID	0xBFD8
+#define FTDI_OPENDCC_SNIFFER_PID	0xBFD9
+#define FTDI_OPENDCC_THROTTLE_PID	0xBFDA
+#define FTDI_OPENDCC_GATEWAY_PID	0xBFDB
 
 /* Sprog II (Andrew Crosland's SprogII DCC interface) */
 #define FTDI_SPROG_II		0xF0C8
@@ -930,6 +933,7 @@
  */
 #define ADI_VID 		0x0456
 #define ADI_GNICE_PID 		0xF000
+#define ADI_GNICEPLUS_PID 	0xF001
 
 /*
  * JETI SPECTROMETER SPECBOS 1201
@@ -968,6 +972,12 @@
 #define MARVELL_OPENRD_PID	0x9e90
 
 /*
+ * Hameg HO820 and HO870 interface (using VID 0x0403)
+ */
+#define        HAMEG_HO820_PID         0xed74
+#define        HAMEG_HO870_PID         0xed71
+
+/*
  *   BmRequestType:  1100 0000b
  *   bRequest:       FTDI_E2_READ
  *   wValue:         0
--- linux-rt-2.6.31.orig/drivers/usb/serial/digi_acceleport.c
+++ linux-rt-2.6.31/drivers/usb/serial/digi_acceleport.c
@@ -899,16 +899,16 @@
 
 	spin_lock_irqsave(&priv->dp_port_lock, flags);
 
-	/* turn throttle off */
-	priv->dp_throttled = 0;
-	priv->dp_throttle_restart = 0;
-
 	/* restart read chain */
 	if (priv->dp_throttle_restart) {
 		port->read_urb->dev = port->serial->dev;
 		ret = usb_submit_urb(port->read_urb, GFP_ATOMIC);
 	}
 
+	/* turn throttle off */
+	priv->dp_throttled = 0;
+	priv->dp_throttle_restart = 0;
+
 	spin_unlock_irqrestore(&priv->dp_port_lock, flags);
 
 	if (ret)
--- linux-rt-2.6.31.orig/drivers/usb/serial/cp210x.c
+++ linux-rt-2.6.31/drivers/usb/serial/cp210x.c
@@ -51,6 +51,8 @@
 static void cp210x_break_ctl(struct tty_struct *, int);
 static int cp210x_startup(struct usb_serial *);
 static void cp210x_disconnect(struct usb_serial *);
+static void cp210x_dtr_rts(struct usb_serial_port *p, int on);
+static int cp210x_carrier_raised(struct usb_serial_port *p);
 
 static int debug;
 
@@ -114,6 +116,7 @@
 	{ USB_DEVICE(0x166A, 0x0303) }, /* Clipsal 5500PCU C-Bus USB interface */
 	{ USB_DEVICE(0x16D6, 0x0001) }, /* Jablotron serial interface */
 	{ USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */
+	{ USB_DEVICE(0x413C, 0x9500) }, /* DW700 GPS USB interface */
 	{ } /* Terminating Entry */
 };
 
@@ -143,6 +146,8 @@
 	.tiocmset		= cp210x_tiocmset,
 	.attach			= cp210x_startup,
 	.disconnect		= cp210x_disconnect,
+	.dtr_rts		= cp210x_dtr_rts,
+	.carrier_raised		= cp210x_carrier_raised
 };
 
 /* Config request types */
@@ -399,12 +404,6 @@
 
 	/* Configure the termios structure */
 	cp210x_get_termios(tty, port);
-
-	/* Set the DTR and RTS pins low */
-	cp210x_tiocmset_port(tty ? (struct usb_serial_port *) tty->driver_data
-			: port,
-		NULL, TIOCM_DTR | TIOCM_RTS, 0);
-
 	return 0;
 }
 
@@ -753,6 +752,14 @@
 	return cp210x_set_config(port, CP210X_SET_MHS, &control, 2);
 }
 
+static void cp210x_dtr_rts(struct usb_serial_port *p, int on)
+{
+	if (on)
+		cp210x_tiocmset_port(p, NULL,  TIOCM_DTR|TIOCM_RTS, 0);
+	else
+		cp210x_tiocmset_port(p, NULL,  0, TIOCM_DTR|TIOCM_RTS);
+}
+
 static int cp210x_tiocmget (struct tty_struct *tty, struct file *file)
 {
 	struct usb_serial_port *port = tty->driver_data;
@@ -775,6 +782,15 @@
 	return result;
 }
 
+static int cp210x_carrier_raised(struct usb_serial_port *p)
+{
+	unsigned int control;
+	cp210x_get_config(p, CP210X_GET_MDMSTS, &control, 1);
+	if (control & CONTROL_DCD)
+		return 1;
+	return 0;
+}
+
 static void cp210x_break_ctl (struct tty_struct *tty, int break_state)
 {
 	struct usb_serial_port *port = tty->driver_data;
--- linux-rt-2.6.31.orig/drivers/usb/serial/usb-serial.c
+++ linux-rt-2.6.31/drivers/usb/serial/usb-serial.c
@@ -43,8 +43,6 @@
 #define DRIVER_AUTHOR "Greg Kroah-Hartman, greg@kroah.com, http://www.kroah.com/linux/"
 #define DRIVER_DESC "USB Serial Driver core"
 
-static void port_free(struct usb_serial_port *port);
-
 /* Driver structure we register with the USB core */
 static struct usb_driver usb_serial_driver = {
 	.name =		"usbserial",
@@ -68,6 +66,11 @@
 static DEFINE_MUTEX(table_lock);
 static LIST_HEAD(usb_serial_driver_list);
 
+/*
+ * Look up the serial structure.  If it is found and it hasn't been
+ * disconnected, return with its disc_mutex held and its refcount
+ * incremented.  Otherwise return NULL.
+ */
 struct usb_serial *usb_serial_get_by_index(unsigned index)
 {
 	struct usb_serial *serial;
@@ -75,8 +78,15 @@
 	mutex_lock(&table_lock);
 	serial = serial_table[index];
 
-	if (serial)
-		kref_get(&serial->kref);
+	if (serial) {
+		mutex_lock(&serial->disc_mutex);
+		if (serial->disconnected) {
+			mutex_unlock(&serial->disc_mutex);
+			serial = NULL;
+		} else {
+			kref_get(&serial->kref);
+		}
+	}
 	mutex_unlock(&table_lock);
 	return serial;
 }
@@ -125,8 +135,10 @@
 
 	dbg("%s", __func__);
 
+	mutex_lock(&table_lock);
 	for (i = 0; i < serial->num_ports; ++i)
 		serial_table[serial->minor + i] = NULL;
+	mutex_unlock(&table_lock);
 }
 
 static void destroy_serial(struct kref *kref)
@@ -143,163 +155,160 @@
 	if (serial->minor != SERIAL_TTY_NO_MINOR)
 		return_serial(serial);
 
-	serial->type->release(serial);
+	if (serial->attached)
+		serial->type->release(serial);
 
-	for (i = 0; i < serial->num_ports; ++i) {
+	/* Now that nothing is using the ports, they can be freed */
+	for (i = 0; i < serial->num_port_pointers; ++i) {
 		port = serial->port[i];
-		if (port)
+		if (port) {
+			port->serial = NULL;
 			put_device(&port->dev);
-	}
-
-	/* If this is a "fake" port, we have to clean it up here, as it will
-	 * not get cleaned up in port_release() as it was never registered with
-	 * the driver core */
-	if (serial->num_ports < serial->num_port_pointers) {
-		for (i = serial->num_ports;
-					i < serial->num_port_pointers; ++i) {
-			port = serial->port[i];
-			if (port)
-				port_free(port);
 		}
 	}
 
 	usb_put_dev(serial->dev);
-
-	/* free up any memory that we allocated */
 	kfree(serial);
 }
 
 void usb_serial_put(struct usb_serial *serial)
 {
-	mutex_lock(&table_lock);
 	kref_put(&serial->kref, destroy_serial);
-	mutex_unlock(&table_lock);
 }
 
 /*****************************************************************************
  * Driver tty interface functions
  *****************************************************************************/
-static int serial_open (struct tty_struct *tty, struct file *filp)
+
+/**
+ * serial_install - install tty
+ * @driver: the driver (USB in our case)
+ * @tty: the tty being created
+ *
+ * Create the termios objects for this tty.  We use the default
+ * USB serial settings but permit them to be overridden by
+ * serial->type->init_termios.
+ *
+ * This is the first place a new tty gets used.  Hence this is where we
+ * acquire references to the usb_serial structure and the driver module,
+ * where we store a pointer to the port, and where we do an autoresume.
+ * All these actions are reversed in serial_release().
+ */
+static int serial_install(struct tty_driver *driver, struct tty_struct *tty)
 {
+	int idx = tty->index;
 	struct usb_serial *serial;
 	struct usb_serial_port *port;
-	unsigned int portNumber;
-	int retval = 0;
-	int first = 0;
+	int retval = -ENODEV;
 
 	dbg("%s", __func__);
 
-	/* get the serial object associated with this tty pointer */
-	serial = usb_serial_get_by_index(tty->index);
-	if (!serial) {
-		tty->driver_data = NULL;
-		return -ENODEV;
-	}
+	serial = usb_serial_get_by_index(idx);
+	if (!serial)
+		return retval;
 
-	mutex_lock(&serial->disc_mutex);
-	portNumber = tty->index - serial->minor;
-	port = serial->port[portNumber];
-	if (!port || serial->disconnected)
-		retval = -ENODEV;
-	else
-		get_device(&port->dev);
-	/*
-	 * Note: Our locking order requirement does not allow port->mutex
-	 * to be acquired while serial->disc_mutex is held.
-	 */
-	mutex_unlock(&serial->disc_mutex);
+	port = serial->port[idx - serial->minor];
+	if (!port)
+		goto error_no_port;
+	if (!try_module_get(serial->type->driver.owner))
+		goto error_module_get;
+
+	/* perform the standard setup */
+	retval = tty_init_termios(tty);
 	if (retval)
-		goto bailout_serial_put;
+		goto error_init_termios;
 
-	if (mutex_lock_interruptible(&port->mutex)) {
-		retval = -ERESTARTSYS;
-		goto bailout_port_put;
-	}
+	retval = usb_autopm_get_interface(serial->interface);
+	if (retval)
+		goto error_get_interface;
+
+	mutex_unlock(&serial->disc_mutex);
 
-	++port->port.count;
+	/* allow the driver to update the settings */
+	if (serial->type->init_termios)
+		serial->type->init_termios(tty);
 
-	/* set up our port structure making the tty driver
-	 * remember our port object, and us it */
 	tty->driver_data = port;
-	tty_port_tty_set(&port->port, tty);
 
-	/* If the console is attached, the device is already open */
-	if (port->port.count == 1 && !port->console) {
-		first = 1;
-		/* lock this module before we call it
-		 * this may fail, which means we must bail out,
-		 * safe because we are called with BKL held */
-		if (!try_module_get(serial->type->driver.owner)) {
-			retval = -ENODEV;
-			goto bailout_mutex_unlock;
-		}
+	/* Final install (we use the default method) */
+	tty_driver_kref_get(driver);
+	tty->count++;
+	driver->ttys[idx] = tty;
+	return retval;
 
+ error_get_interface:
+ error_init_termios:
+	module_put(serial->type->driver.owner);
+ error_module_get:
+ error_no_port:
+	usb_serial_put(serial);
+	mutex_unlock(&serial->disc_mutex);
+	return retval;
+}
+
+static int serial_open(struct tty_struct *tty, struct file *filp)
+{
+	struct usb_serial_port *port = tty->driver_data;
+	struct usb_serial *serial = port->serial;
+	int retval;
+
+	dbg("%s - port %d", __func__, port->number);
+
+	spin_lock_irq(&port->port.lock);
+	if (!tty_hung_up_p(filp))
+		++port->port.count;
+	spin_unlock_irq(&port->port.lock);
+	tty_port_tty_set(&port->port, tty);
+
+	/* Do the device-specific open only if the hardware isn't
+	 * already initialized.
+	 */
+	if (!test_bit(ASYNCB_INITIALIZED, &port->port.flags)) {
+		if (mutex_lock_interruptible(&port->mutex))
+			return -ERESTARTSYS;
 		mutex_lock(&serial->disc_mutex);
 		if (serial->disconnected)
 			retval = -ENODEV;
 		else
-			retval = usb_autopm_get_interface(serial->interface);
-		if (retval)
-			goto bailout_module_put;
-
-		/* only call the device specific open if this
-		 * is the first time the port is opened */
-		retval = serial->type->open(tty, port, filp);
-		if (retval)
-			goto bailout_interface_put;
+			retval = port->serial->type->open(tty, port, filp);
 		mutex_unlock(&serial->disc_mutex);
+		mutex_unlock(&port->mutex);
+		if (retval)
+			return retval;
 		set_bit(ASYNCB_INITIALIZED, &port->port.flags);
 	}
-	mutex_unlock(&port->mutex);
+
 	/* Now do the correct tty layer semantics */
 	retval = tty_port_block_til_ready(&port->port, tty, filp);
-	if (retval == 0) {
-		if (!first)
-			usb_serial_put(serial);
-		return 0;
-	}
-	mutex_lock(&port->mutex);
-	if (first == 0)
-		goto bailout_mutex_unlock;
-	/* Undo the initial port actions */
-	mutex_lock(&serial->disc_mutex);
-bailout_interface_put:
-	usb_autopm_put_interface(serial->interface);
-bailout_module_put:
-	mutex_unlock(&serial->disc_mutex);
-	module_put(serial->type->driver.owner);
-bailout_mutex_unlock:
-	port->port.count = 0;
-	tty->driver_data = NULL;
-	tty_port_tty_set(&port->port, NULL);
-	mutex_unlock(&port->mutex);
-bailout_port_put:
-	put_device(&port->dev);
-bailout_serial_put:
-	usb_serial_put(serial);
 	return retval;
 }
 
 /**
- *	serial_do_down		-	shut down hardware
- *	@port: port to shut down
- *
- *	Shut down a USB port unless it is the console. We never shut down the
- *	console hardware as it will always be in use.
+ * serial_down - shut down hardware
+ * @port: port to shut down
  *
- *	Don't free any resources at this point
+ * Shut down a USB serial port unless it is the console.  We never
+ * shut down the console hardware as it will always be in use.
  */
-static void serial_do_down(struct usb_serial_port *port)
+static void serial_down(struct usb_serial_port *port)
 {
 	struct usb_serial_driver *drv = port->serial->type;
 	struct usb_serial *serial;
 	struct module *owner;
 
-	/* The console is magical, do not hang up the console hardware
-	   or there will be tears */
+	/*
+	 * The console is magical.  Do not hang up the console hardware
+	 * or there will be tears.
+	 */
 	if (port->console)
 		return;
 
+	/* Don't call the close method if the hardware hasn't been
+	 * initialized.
+	 */
+	if (!test_and_clear_bit(ASYNCB_INITIALIZED, &port->port.flags))
+		return;
+
 	mutex_lock(&port->mutex);
 	serial = port->serial;
 	owner = serial->type->driver.owner;
@@ -310,79 +319,69 @@
 	mutex_unlock(&port->mutex);
 }
 
-/**
- *	serial_do_free		-	free resources post close/hangup
- *	@port: port to free up
- *
- *	Do the resource freeing and refcount dropping for the port. We must
- *	be careful about ordering and we must avoid freeing up the console.
- */
-
-static void serial_do_free(struct usb_serial_port *port)
+static void serial_hangup(struct tty_struct *tty)
 {
-	struct usb_serial *serial;
-	struct module *owner;
+	struct usb_serial_port *port = tty->driver_data;
 
-	/* The console is magical, do not hang up the console hardware
-	   or there will be tears */
-	if (port->console)
-		return;
+	dbg("%s - port %d", __func__, port->number);
 
-	serial = port->serial;
-	owner = serial->type->driver.owner;
-	put_device(&port->dev);
-	/* Mustn't dereference port any more */
-	mutex_lock(&serial->disc_mutex);
-	if (!serial->disconnected)
-		usb_autopm_put_interface(serial->interface);
-	mutex_unlock(&serial->disc_mutex);
-	usb_serial_put(serial);
-	/* Mustn't dereference serial any more */
-	module_put(owner);
+	serial_down(port);
+	tty_port_hangup(&port->port);
 }
 
 static void serial_close(struct tty_struct *tty, struct file *filp)
 {
 	struct usb_serial_port *port = tty->driver_data;
 
-	if (!port)
-		return;
-
 	dbg("%s - port %d", __func__, port->number);
 
-	/* FIXME:
-	   This leaves a very narrow race. Really we should do the
-	   serial_do_free() on tty->shutdown(), but tty->shutdown can
-	   be called from IRQ context and serial_do_free can sleep.
-
-	   The right fix is probably to make the tty free (which is rare)
-	   and thus tty->shutdown() occur via a work queue and simplify all
-	   the drivers that use it.
-	*/
-	if (tty_hung_up_p(filp)) {
-		/* serial_hangup already called serial_down at this point.
-		   Another user may have already reopened the port but
-		   serial_do_free is refcounted */
-		serial_do_free(port);
+	if (tty_hung_up_p(filp))
 		return;
-	}
-
 	if (tty_port_close_start(&port->port, tty, filp) == 0)
 		return;
-
-	serial_do_down(port);		
+	serial_down(port);
 	tty_port_close_end(&port->port, tty);
 	tty_port_tty_set(&port->port, NULL);
-	serial_do_free(port);
 }
 
-static void serial_hangup(struct tty_struct *tty)
+/**
+ * serial_release - free resources post close/hangup
+ * @port: port to free up
+ *
+ * Do the resource freeing and refcount dropping for the port.
+ * Avoid freeing the console.
+ *
+ * Called when the last tty kref is dropped.
+ */
+static void serial_release(struct tty_struct *tty)
 {
 	struct usb_serial_port *port = tty->driver_data;
-	serial_do_down(port);
-	tty_port_hangup(&port->port);
-	/* We must not free port yet - the USB serial layer depends on it's
-	   continued existence */
+	struct usb_serial *serial;
+	struct module *owner;
+
+	/* The console is magical.  Do not hang up the console hardware
+	 * or there will be tears.
+	 */
+	if (port->console)
+		return;
+
+	dbg("%s - port %d", __func__, port->number);
+
+	/* Standard shutdown processing */
+	tty_shutdown(tty);
+
+	tty->driver_data = NULL;
+
+	serial = port->serial;
+	owner = serial->type->driver.owner;
+
+	mutex_lock(&serial->disc_mutex);
+	if (!serial->disconnected)
+		usb_autopm_put_interface(serial->interface);
+	mutex_unlock(&serial->disc_mutex);
+
+	usb_serial_put(serial);
+	module_put(owner);
 }
 
 static int serial_write(struct tty_struct *tty, const unsigned char *buf,
@@ -527,6 +526,7 @@
 
 		seq_putc(m, '\n');
 		usb_serial_put(serial);
+		mutex_unlock(&serial->disc_mutex);
 	}
 	return 0;
 }
@@ -596,14 +596,6 @@
 	tty_kref_put(tty);
 }
 
-static void port_release(struct device *dev)
-{
-	struct usb_serial_port *port = to_usb_serial_port(dev);
-
-	dbg ("%s - %s", __func__, dev_name(dev));
-	port_free(port);
-}
-
 static void kill_traffic(struct usb_serial_port *port)
 {
 	usb_kill_urb(port->read_urb);
@@ -623,8 +615,12 @@
 	usb_kill_urb(port->interrupt_out_urb);
 }
 
-static void port_free(struct usb_serial_port *port)
+static void port_release(struct device *dev)
 {
+	struct usb_serial_port *port = to_usb_serial_port(dev);
+
+	dbg ("%s - %s", __func__, dev_name(dev));
+
 	/*
 	 * Stop all the traffic before cancelling the work, so that
 	 * nobody will restart it by calling usb_serial_port_softint.
@@ -935,6 +931,11 @@
 		mutex_init(&port->mutex);
 		INIT_WORK(&port->work, usb_serial_port_work);
 		serial->port[i] = port;
+		port->dev.parent = &interface->dev;
+		port->dev.driver = NULL;
+		port->dev.bus = &usb_serial_bus_type;
+		port->dev.release = &port_release;
+		device_initialize(&port->dev);
 	}
 
 	/* set up the endpoint information */
@@ -1060,12 +1061,15 @@
 		module_put(type->driver.owner);
 		if (retval < 0)
 			goto probe_error;
+		serial->attached = 1;
 		if (retval > 0) {
 			/* quietly accept this device, but don't bind to a
 			   serial port as it's about to disappear */
 			serial->num_ports = 0;
 			goto exit;
 		}
+	} else {
+		serial->attached = 1;
 	}
 
 	if (get_free_serial(serial, num_ports, &minor) == NULL) {
@@ -1077,15 +1081,10 @@
 	/* register all of the individual ports with the driver core */
 	for (i = 0; i < num_ports; ++i) {
 		port = serial->port[i];
-		port->dev.parent = &interface->dev;
-		port->dev.driver = NULL;
-		port->dev.bus = &usb_serial_bus_type;
-		port->dev.release = &port_release;
-
 		dev_set_name(&port->dev, "ttyUSB%d", port->number);
 		dbg ("%s - registering %s", __func__, dev_name(&port->dev));
 		port->dev_state = PORT_REGISTERING;
-		retval = device_register(&port->dev);
+		retval = device_add(&port->dev);
 		if (retval) {
 			dev_err(&port->dev, "Error registering port device, "
 				"continuing\n");
@@ -1103,39 +1102,7 @@
 	return 0;
 
 probe_error:
-	for (i = 0; i < num_bulk_in; ++i) {
-		port = serial->port[i];
-		if (!port)
-			continue;
-		usb_free_urb(port->read_urb);
-		kfree(port->bulk_in_buffer);
-	}
-	for (i = 0; i < num_bulk_out; ++i) {
-		port = serial->port[i];
-		if (!port)
-			continue;
-		usb_free_urb(port->write_urb);
-		kfree(port->bulk_out_buffer);
-	}
-	for (i = 0; i < num_interrupt_in; ++i) {
-		port = serial->port[i];
-		if (!port)
-			continue;
-		usb_free_urb(port->interrupt_in_urb);
-		kfree(port->interrupt_in_buffer);
-	}
-	for (i = 0; i < num_interrupt_out; ++i) {
-		port = serial->port[i];
-		if (!port)
-			continue;
-		usb_free_urb(port->interrupt_out_urb);
-		kfree(port->interrupt_out_buffer);
-	}
-
-	/* free up any memory that we allocated */
-	for (i = 0; i < serial->num_port_pointers; ++i)
-		kfree(serial->port[i]);
-	kfree(serial);
+	usb_serial_put(serial);
 	return -EIO;
 }
 EXPORT_SYMBOL_GPL(usb_serial_probe);
@@ -1161,10 +1128,7 @@
 		if (port) {
 			struct tty_struct *tty = tty_port_tty_get(&port->port);
 			if (tty) {
-				/* The hangup will occur asynchronously but
-				   the object refcounts will sort out all the
-				   cleanup */
-				tty_hangup(tty);
+				tty_vhangup(tty);
 				tty_kref_put(tty);
 			}
 			kill_traffic(port);
@@ -1189,8 +1153,7 @@
 	}
 	serial->type->disconnect(serial);
 
-	/* let the last holder of this object
-	 * cause it to be cleaned up */
+	/* let the last holder of this object cause it to be cleaned up */
 	usb_serial_put(serial);
 	dev_info(dev, "device disconnected\n");
 }
@@ -1246,6 +1209,8 @@
 	.chars_in_buffer =	serial_chars_in_buffer,
 	.tiocmget =		serial_tiocmget,
 	.tiocmset =		serial_tiocmset,
+	.shutdown = 		serial_release,
+	.install = 		serial_install,
 	.proc_fops =		&serial_proc_fops,
 };
 
--- linux-rt-2.6.31.orig/drivers/usb/serial/kobil_sct.c
+++ linux-rt-2.6.31/drivers/usb/serial/kobil_sct.c
@@ -85,7 +85,7 @@
 static void kobil_write_callback(struct urb *purb);
 static void kobil_set_termios(struct tty_struct *tty,
 			struct usb_serial_port *port, struct ktermios *old);
-
+static void kobil_init_termios(struct tty_struct *tty);
 
 static struct usb_device_id id_table [] = {
 	{ USB_DEVICE(KOBIL_VENDOR_ID, KOBIL_ADAPTER_B_PRODUCT_ID) },
@@ -120,6 +120,7 @@
 	.release =		kobil_release,
 	.ioctl =		kobil_ioctl,
 	.set_termios =		kobil_set_termios,
+	.init_termios =		kobil_init_termios,
 	.tiocmget =		kobil_tiocmget,
 	.tiocmset =		kobil_tiocmset,
 	.open =			kobil_open,
@@ -210,6 +211,15 @@
 		kfree(usb_get_serial_port_data(serial->port[i]));
 }
 
+static void kobil_init_termios(struct tty_struct *tty)
+{
+	/* Default to echo off and other sane device settings */
+	tty->termios->c_lflag = 0;
+	tty->termios->c_lflag &= ~(ISIG | ICANON | ECHO | IEXTEN | XCASE);
+	tty->termios->c_iflag = IGNBRK | IGNPAR | IXOFF;
+	/* do NOT translate CR to CR-NL (0x0A -> 0x0A 0x0D) */
+	tty->termios->c_oflag &= ~ONLCR;
+}
 
 static int kobil_open(struct tty_struct *tty,
 			struct usb_serial_port *port, struct file *filp)
@@ -226,16 +236,6 @@
 	/* someone sets the dev to 0 if the close method has been called */
 	port->interrupt_in_urb->dev = port->serial->dev;
 
-	if (tty) {
-
-		/* Default to echo off and other sane device settings */
-		tty->termios->c_lflag = 0;
-		tty->termios->c_lflag &= ~(ISIG | ICANON | ECHO | IEXTEN |
-								 XCASE);
-		tty->termios->c_iflag = IGNBRK | IGNPAR | IXOFF;
-		/* do NOT translate CR to CR-NL (0x0A -> 0x0A 0x0D) */
-		tty->termios->c_oflag &= ~ONLCR;
-	}
 	/* allocate memory for transfer buffer */
 	transfer_buffer = kzalloc(transfer_buffer_length, GFP_KERNEL);
 	if (!transfer_buffer)
--- linux-rt-2.6.31.orig/drivers/usb/serial/oti6858.c
+++ linux-rt-2.6.31/drivers/usb/serial/oti6858.c
@@ -146,6 +146,7 @@
 static void oti6858_close(struct usb_serial_port *port);
 static void oti6858_set_termios(struct tty_struct *tty,
 			struct usb_serial_port *port, struct ktermios *old);
+static void oti6858_init_termios(struct tty_struct *tty);
 static int oti6858_ioctl(struct tty_struct *tty, struct file *file,
 			unsigned int cmd, unsigned long arg);
 static void oti6858_read_int_callback(struct urb *urb);
@@ -186,6 +187,7 @@
 	.write =		oti6858_write,
 	.ioctl =		oti6858_ioctl,
 	.set_termios =		oti6858_set_termios,
+	.init_termios = 	oti6858_init_termios,
 	.tiocmget =		oti6858_tiocmget,
 	.tiocmset =		oti6858_tiocmset,
 	.read_bulk_callback =	oti6858_read_bulk_callback,
@@ -206,7 +208,6 @@
 	struct {
 		u8 read_urb_in_use;
 		u8 write_urb_in_use;
-		u8 termios_initialized;
 	} flags;
 	struct delayed_work delayed_write_work;
 
@@ -447,6 +448,14 @@
 	return chars;
 }
 
+static void oti6858_init_termios(struct tty_struct *tty)
+{
+	*(tty->termios) = tty_std_termios;
+	tty->termios->c_cflag = B38400 | CS8 | CREAD | HUPCL | CLOCAL;
+	tty->termios->c_ispeed = 38400;
+	tty->termios->c_ospeed = 38400;
+}
+
 static void oti6858_set_termios(struct tty_struct *tty,
 		struct usb_serial_port *port, struct ktermios *old_termios)
 {
@@ -464,16 +473,6 @@
 		return;
 	}
 
-	spin_lock_irqsave(&priv->lock, flags);
-	if (!priv->flags.termios_initialized) {
-		*(tty->termios) = tty_std_termios;
-		tty->termios->c_cflag = B38400 | CS8 | CREAD | HUPCL | CLOCAL;
-		tty->termios->c_ispeed = 38400;
-		tty->termios->c_ospeed = 38400;
-		priv->flags.termios_initialized = 1;
-	}
-	spin_unlock_irqrestore(&priv->lock, flags);
-
 	cflag = tty->termios->c_cflag;
 
 	spin_lock_irqsave(&priv->lock, flags);
--- linux-rt-2.6.31.orig/drivers/usb/serial/whiteheat.c
+++ linux-rt-2.6.31/drivers/usb/serial/whiteheat.c
@@ -259,7 +259,7 @@
 						__u8 *data, __u8 datasize);
 static int firm_open(struct usb_serial_port *port);
 static int firm_close(struct usb_serial_port *port);
-static int firm_setup_port(struct tty_struct *tty);
+static void firm_setup_port(struct tty_struct *tty);
 static int firm_set_rts(struct usb_serial_port *port, __u8 onoff);
 static int firm_set_dtr(struct usb_serial_port *port, __u8 onoff);
 static int firm_set_break(struct usb_serial_port *port, __u8 onoff);
@@ -1211,7 +1211,7 @@
 }
 
 
-static int firm_setup_port(struct tty_struct *tty)
+static void firm_setup_port(struct tty_struct *tty)
 {
 	struct usb_serial_port *port = tty->driver_data;
 	struct whiteheat_port_settings port_settings;
@@ -1286,7 +1286,7 @@
 	port_settings.lloop = 0;
 
 	/* now send the message to the device */
-	return firm_send_command(port, WHITEHEAT_SETUP_PORT,
+	firm_send_command(port, WHITEHEAT_SETUP_PORT,
 			(__u8 *)&port_settings, sizeof(port_settings));
 }
 
--- linux-rt-2.6.31.orig/drivers/usb/serial/ark3116.c
+++ linux-rt-2.6.31/drivers/usb/serial/ark3116.c
@@ -35,11 +35,6 @@
 };
 MODULE_DEVICE_TABLE(usb, id_table);
 
-struct ark3116_private {
-	spinlock_t lock;
-	u8 termios_initialized;
-};
-
 static inline void ARK3116_SND(struct usb_serial *serial, int seq,
 			       __u8 request, __u8 requesttype,
 			       __u16 value, __u16 index)
@@ -82,22 +77,11 @@
 static int ark3116_attach(struct usb_serial *serial)
 {
 	char *buf;
-	struct ark3116_private *priv;
-	int i;
-
-	for (i = 0; i < serial->num_ports; ++i) {
-		priv = kzalloc(sizeof(struct ark3116_private), GFP_KERNEL);
-		if (!priv)
-			goto cleanup;
-		spin_lock_init(&priv->lock);
-
-		usb_set_serial_port_data(serial->port[i], priv);
-	}
 
 	buf = kmalloc(1, GFP_KERNEL);
 	if (!buf) {
 		dbg("error kmalloc -> out of mem?");
-		goto cleanup;
+		return -ENOMEM;
 	}
 
 	/* 3 */
@@ -149,13 +133,16 @@
 
 	kfree(buf);
 	return 0;
+}
 
-cleanup:
-	for (--i; i >= 0; --i) {
-		kfree(usb_get_serial_port_data(serial->port[i]));
-		usb_set_serial_port_data(serial->port[i], NULL);
-	}
-	return -ENOMEM;
+static void ark3116_init_termios(struct tty_struct *tty)
+{
+	struct ktermios *termios = tty->termios;
+	*termios = tty_std_termios;
+	termios->c_cflag = B9600 | CS8
+				      | CREAD | HUPCL | CLOCAL;
+	termios->c_ispeed = 9600;
+	termios->c_ospeed = 9600;
 }
 
 static void ark3116_set_termios(struct tty_struct *tty,
@@ -163,10 +150,8 @@
 				struct ktermios *old_termios)
 {
 	struct usb_serial *serial = port->serial;
-	struct ark3116_private *priv = usb_get_serial_port_data(port);
 	struct ktermios *termios = tty->termios;
 	unsigned int cflag = termios->c_cflag;
-	unsigned long flags;
 	int baud;
 	int ark3116_baud;
 	char *buf;
@@ -176,16 +161,6 @@
 
 	dbg("%s - port %d", __func__, port->number);
 
-	spin_lock_irqsave(&priv->lock, flags);
-	if (!priv->termios_initialized) {
-		*termios = tty_std_termios;
-		termios->c_cflag = B9600 | CS8
-					      | CREAD | HUPCL | CLOCAL;
-		termios->c_ispeed = 9600;
-		termios->c_ospeed = 9600;
-		priv->termios_initialized = 1;
-	}
-	spin_unlock_irqrestore(&priv->lock, flags);
 
 	cflag = termios->c_cflag;
 	termios->c_cflag &= ~(CMSPAR|CRTSCTS);
@@ -455,6 +430,7 @@
 	.num_ports =		1,
 	.attach =		ark3116_attach,
 	.set_termios =		ark3116_set_termios,
+	.init_termios =		ark3116_init_termios,
 	.ioctl =		ark3116_ioctl,
 	.tiocmget =		ark3116_tiocmget,
 	.open =			ark3116_open,
--- linux-rt-2.6.31.orig/drivers/usb/serial/empeg.c
+++ linux-rt-2.6.31/drivers/usb/serial/empeg.c
@@ -90,8 +90,7 @@
 static void empeg_throttle(struct tty_struct *tty);
 static void empeg_unthrottle(struct tty_struct *tty);
 static int  empeg_startup(struct usb_serial *serial);
-static void empeg_set_termios(struct tty_struct *tty,
-		struct usb_serial_port *port, struct ktermios *old_termios);
+static void empeg_init_termios(struct tty_struct *tty);
 static void empeg_write_bulk_callback(struct urb *urb);
 static void empeg_read_bulk_callback(struct urb *urb);
 
@@ -123,7 +122,7 @@
 	.throttle =		empeg_throttle,
 	.unthrottle =		empeg_unthrottle,
 	.attach =		empeg_startup,
-	.set_termios =		empeg_set_termios,
+	.init_termios =		empeg_init_termios,
 	.write =		empeg_write,
 	.write_room =		empeg_write_room,
 	.chars_in_buffer =	empeg_chars_in_buffer,
@@ -150,9 +149,6 @@
 
 	dbg("%s - port %d", __func__, port->number);
 
-	/* Force default termio settings */
-	empeg_set_termios(tty, port, NULL) ;
-
 	bytes_in = 0;
 	bytes_out = 0;
 
@@ -425,11 +421,9 @@
 }
 
 
-static void empeg_set_termios(struct tty_struct *tty,
-		struct usb_serial_port *port, struct ktermios *old_termios)
+static void empeg_init_termios(struct tty_struct *tty)
 {
 	struct ktermios *termios = tty->termios;
-	dbg("%s - port %d", __func__, port->number);
 
 	/*
 	 * The empeg-car player wants these particular tty settings.
--- linux-rt-2.6.31.orig/drivers/usb/serial/cypress_m8.c
+++ linux-rt-2.6.31/drivers/usb/serial/cypress_m8.c
@@ -659,15 +659,7 @@
 	spin_unlock_irqrestore(&priv->lock, flags);
 
 	/* Set termios */
-	result = cypress_write(tty, port, NULL, 0);
-
-	if (result) {
-		dev_err(&port->dev,
-			"%s - failed setting the control lines - error %d\n",
-							__func__, result);
-		return result;
-	} else
-		dbg("%s - success setting the control lines", __func__);
+	cypress_send(port);
 
 	if (tty)
 		cypress_set_termios(tty, port, &priv->tmp_termios);
@@ -1005,6 +997,8 @@
 	dbg("%s - port %d", __func__, port->number);
 
 	spin_lock_irqsave(&priv->lock, flags);
+	/* We can't clean this one up as we don't know the device type
+	   early enough */
 	if (!priv->termios_initialized) {
 		if (priv->chiptype == CT_EARTHMATE) {
 			*(tty->termios) = tty_std_termios;
--- linux-rt-2.6.31.orig/drivers/usb/serial/pl2303.h
+++ linux-rt-2.6.31/drivers/usb/serial/pl2303.h
@@ -130,3 +130,7 @@
 /* Sony, USB data cable for CMD-Jxx mobile phones */
 #define SONY_VENDOR_ID		0x054c
 #define SONY_QN3USB_PRODUCT_ID	0x0437
+
+/* Sanwa KB-USB2 multimeter cable (ID: 11ad:0001) */
+#define SANWA_VENDOR_ID		0x11ad
+#define SANWA_PRODUCT_ID	0x0001
--- linux-rt-2.6.31.orig/drivers/usb/serial/ftdi_sio.c
+++ linux-rt-2.6.31/drivers/usb/serial/ftdi_sio.c
@@ -76,13 +76,7 @@
 	unsigned long last_dtr_rts;	/* saved modem control outputs */
 	wait_queue_head_t delta_msr_wait; /* Used for TIOCMIWAIT */
 	char prev_status, diff_status;        /* Used for TIOCMIWAIT */
-	__u8 rx_flags;		/* receive state flags (throttling) */
-	spinlock_t rx_lock;	/* spinlock for receive state */
-	struct delayed_work rx_work;
 	struct usb_serial_port *port;
-	int rx_processed;
-	unsigned long rx_bytes;
-
 	__u16 interface;	/* FT2232C, FT2232H or FT4232H port interface
 				   (0 for FT232/245) */
 
@@ -176,6 +170,9 @@
 	{ USB_DEVICE(FTDI_VID, FTDI_MICRO_CHAMELEON_PID) },
 	{ USB_DEVICE(FTDI_VID, FTDI_RELAIS_PID) },
 	{ USB_DEVICE(FTDI_VID, FTDI_OPENDCC_PID) },
+	{ USB_DEVICE(FTDI_VID, FTDI_OPENDCC_SNIFFER_PID) },
+	{ USB_DEVICE(FTDI_VID, FTDI_OPENDCC_THROTTLE_PID) },
+	{ USB_DEVICE(FTDI_VID, FTDI_OPENDCC_GATEWAY_PID) },
 	{ USB_DEVICE(INTERBIOMETRICS_VID, INTERBIOMETRICS_IOBOARD_PID) },
 	{ USB_DEVICE(INTERBIOMETRICS_VID, INTERBIOMETRICS_MINI_IOBOARD_PID) },
 	{ USB_DEVICE(FTDI_VID, FTDI_SPROG_II) },
@@ -694,6 +691,8 @@
 	{ USB_DEVICE(DE_VID, WHT_PID) },
 	{ USB_DEVICE(ADI_VID, ADI_GNICE_PID),
 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+	{ USB_DEVICE(ADI_VID, ADI_GNICEPLUS_PID),
+		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
 	{ USB_DEVICE(JETI_VID, JETI_SPC1201_PID) },
 	{ USB_DEVICE(MARVELL_VID, MARVELL_SHEEVAPLUG_PID),
 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
@@ -702,6 +701,8 @@
 	{ USB_DEVICE(BAYER_VID, BAYER_CONTOUR_CABLE_PID) },
 	{ USB_DEVICE(FTDI_VID, MARVELL_OPENRD_PID),
 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+	{ USB_DEVICE(FTDI_VID, HAMEG_HO820_PID) },
+	{ USB_DEVICE(FTDI_VID, HAMEG_HO870_PID) },
 	{ },					/* Optional parameter entry */
 	{ }					/* Terminating entry */
 };
@@ -730,10 +731,6 @@
 /* Constants for read urb and write urb */
 #define BUFSZ 512
 
-/* rx_flags */
-#define THROTTLED		0x01
-#define ACTUALLY_THROTTLED	0x02
-
 /* Used for TIOCMIWAIT */
 #define FTDI_STATUS_B0_MASK	(FTDI_RS0_CTS | FTDI_RS0_DSR | FTDI_RS0_RI | FTDI_RS0_RLSD)
 #define FTDI_STATUS_B1_MASK	(FTDI_RS_BI)
@@ -757,7 +754,7 @@
 static int  ftdi_chars_in_buffer(struct tty_struct *tty);
 static void ftdi_write_bulk_callback(struct urb *urb);
 static void ftdi_read_bulk_callback(struct urb *urb);
-static void ftdi_process_read(struct work_struct *work);
+static void ftdi_process_read(struct usb_serial_port *port);
 static void ftdi_set_termios(struct tty_struct *tty,
 			struct usb_serial_port *port, struct ktermios *old);
 static int  ftdi_tiocmget(struct tty_struct *tty, struct file *file);
@@ -1228,7 +1225,6 @@
 					(new_serial.flags & ASYNC_FLAGS));
 	priv->custom_divisor = new_serial.custom_divisor;
 
-	tty->low_latency = (priv->flags & ASYNC_LOW_LATENCY) ? 1 : 0;
 	write_latency_timer(port);
 
 check_and_exit:
@@ -1521,7 +1517,6 @@
 	}
 
 	kref_init(&priv->kref);
-	spin_lock_init(&priv->rx_lock);
 	spin_lock_init(&priv->tx_lock);
 	init_waitqueue_head(&priv->delta_msr_wait);
 	/* This will push the characters through immediately rather
@@ -1543,7 +1538,6 @@
 		port->read_urb->transfer_buffer_length = BUFSZ;
 	}
 
-	INIT_DELAYED_WORK(&priv->rx_work, ftdi_process_read);
 	priv->port = port;
 
 	/* Free port's existing write urb and transfer buffer. */
@@ -1680,6 +1674,26 @@
 	return 0;
 }
 
+static int ftdi_submit_read_urb(struct usb_serial_port *port, gfp_t mem_flags)
+{
+	struct urb *urb = port->read_urb;
+	struct usb_serial *serial = port->serial;
+	int result;
+
+	usb_fill_bulk_urb(urb, serial->dev,
+			   usb_rcvbulkpipe(serial->dev,
+					port->bulk_in_endpointAddress),
+			   urb->transfer_buffer,
+			   urb->transfer_buffer_length,
+			   ftdi_read_bulk_callback, port);
+	result = usb_submit_urb(urb, mem_flags);
+	if (result)
+		dev_err(&port->dev,
+			"%s - failed submitting read urb, error %d\n",
+							__func__, result);
+	return result;
+}
+
 static int ftdi_open(struct tty_struct *tty,
 			struct usb_serial_port *port, struct file *filp)
 { /* ftdi_open */
@@ -1695,12 +1709,6 @@
 	spin_lock_irqsave(&priv->tx_lock, flags);
 	priv->tx_bytes = 0;
 	spin_unlock_irqrestore(&priv->tx_lock, flags);
-	spin_lock_irqsave(&priv->rx_lock, flags);
-	priv->rx_bytes = 0;
-	spin_unlock_irqrestore(&priv->rx_lock, flags);
-
-	if (tty)
-		tty->low_latency = (priv->flags & ASYNC_LOW_LATENCY) ? 1 : 0;
 
 	write_latency_timer(port);
 
@@ -1720,23 +1728,14 @@
 		ftdi_set_termios(tty, port, tty->termios);
 
 	/* Not throttled */
-	spin_lock_irqsave(&priv->rx_lock, flags);
-	priv->rx_flags &= ~(THROTTLED | ACTUALLY_THROTTLED);
-	spin_unlock_irqrestore(&priv->rx_lock, flags);
+	spin_lock_irqsave(&port->lock, flags);
+	port->throttled = 0;
+	port->throttle_req = 0;
+	spin_unlock_irqrestore(&port->lock, flags);
 
 	/* Start reading from the device */
-	priv->rx_processed = 0;
-	usb_fill_bulk_urb(port->read_urb, dev,
-			usb_rcvbulkpipe(dev, port->bulk_in_endpointAddress),
-			port->read_urb->transfer_buffer,
-				port->read_urb->transfer_buffer_length,
-			ftdi_read_bulk_callback, port);
-	result = usb_submit_urb(port->read_urb, GFP_KERNEL);
-	if (result)
-		dev_err(&port->dev,
-			"%s - failed submitting read urb, error %d\n",
-			__func__, result);
-	else
+	result = ftdi_submit_read_urb(port, GFP_KERNEL);
+	if (!result)
 		kref_get(&priv->kref);
 
 	return result;
@@ -1782,10 +1781,6 @@
 
 	dbg("%s", __func__);
 
-
-	/* cancel any scheduled reading */
-	cancel_delayed_work_sync(&priv->rx_work);
-
 	/* shutdown our bulk read */
 	usb_kill_urb(port->read_urb);
 	kref_put(&priv->kref, ftdi_sio_priv_release);
@@ -1944,7 +1939,7 @@
 		return;
 	}
 	/* account for transferred data */
-	countback = urb->actual_length;
+	countback = urb->transfer_buffer_length;
 	data_offset = priv->write_offset;
 	if (data_offset > 0) {
 		/* Subtract the control bytes */
@@ -1957,7 +1952,6 @@
 
 	if (status) {
 		dbg("nonzero write bulk status received: %d", status);
-		return;
 	}
 
 	usb_serial_port_softint(port);
@@ -2008,271 +2002,121 @@
 	return buffered;
 }
 
-static void ftdi_read_bulk_callback(struct urb *urb)
+static int ftdi_process_packet(struct tty_struct *tty,
+		struct usb_serial_port *port, struct ftdi_private *priv,
+		char *packet, int len)
 {
-	struct usb_serial_port *port = urb->context;
-	struct tty_struct *tty;
-	struct ftdi_private *priv;
-	unsigned long countread;
-	unsigned long flags;
-	int status = urb->status;
-
-	if (urb->number_of_packets > 0) {
-		dev_err(&port->dev, "%s transfer_buffer_length %d "
-			"actual_length %d number of packets %d\n", __func__,
-			urb->transfer_buffer_length,
-			urb->actual_length, urb->number_of_packets);
-		dev_err(&port->dev, "%s transfer_flags %x\n", __func__,
-			urb->transfer_flags);
-	}
+	int i;
+	char status;
+	char flag;
+	char *ch;
 
 	dbg("%s - port %d", __func__, port->number);
 
-	if (port->port.count <= 0)
-		return;
-
-	tty = tty_port_tty_get(&port->port);
-	if (!tty) {
-		dbg("%s - bad tty pointer - exiting", __func__);
-		return;
+	if (len < 2) {
+		dbg("malformed packet");
+		return 0;
 	}
 
-	priv = usb_get_serial_port_data(port);
-	if (!priv) {
-		dbg("%s - bad port private data pointer - exiting", __func__);
-		goto out;
+	/* Compare new line status to the old one, signal if different/
+	   N.B. packet may be processed more than once, but differences
+	   are only processed once.  */
+	status = packet[0] & FTDI_STATUS_B0_MASK;
+	if (status != priv->prev_status) {
+		priv->diff_status |= status ^ priv->prev_status;
+		wake_up_interruptible(&priv->delta_msr_wait);
+		priv->prev_status = status;
 	}
 
-	if (urb != port->read_urb)
-		dev_err(&port->dev, "%s - Not my urb!\n", __func__);
-
-	if (status) {
-		/* This will happen at close every time so it is a dbg not an
-		   err */
-		dbg("(this is ok on close) nonzero read bulk status received: %d", status);
-		goto out;
+	/*
+	 * Although the device uses a bitmask and hence can have multiple
+	 * errors on a packet - the order here sets the priority the error is
+	 * returned to the tty layer.
+	 */
+	flag = TTY_NORMAL;
+	if (packet[1] & FTDI_RS_OE) {
+		flag = TTY_OVERRUN;
+		dbg("OVERRRUN error");
+	}
+	if (packet[1] & FTDI_RS_BI) {
+		flag = TTY_BREAK;
+		dbg("BREAK received");
+		usb_serial_handle_break(port);
+	}
+	if (packet[1] & FTDI_RS_PE) {
+		flag = TTY_PARITY;
+		dbg("PARITY error");
+	}
+	if (packet[1] & FTDI_RS_FE) {
+		flag = TTY_FRAME;
+		dbg("FRAMING error");
 	}
 
-	/* count data bytes, but not status bytes */
-	countread = urb->actual_length;
-	countread -= 2 * DIV_ROUND_UP(countread, priv->max_packet_size);
-	spin_lock_irqsave(&priv->rx_lock, flags);
-	priv->rx_bytes += countread;
-	spin_unlock_irqrestore(&priv->rx_lock, flags);
-
-	ftdi_process_read(&priv->rx_work.work);
-out:
-	tty_kref_put(tty);
-} /* ftdi_read_bulk_callback */
+	len -= 2;
+	if (!len)
+		return 0;	/* status only */
+	ch = packet + 2;
 
+	if (!(port->console && port->sysrq) && flag == TTY_NORMAL)
+		tty_insert_flip_string(tty, ch, len);
+	else {
+		for (i = 0; i < len; i++, ch++) {
+			if (!usb_serial_handle_sysrq_char(tty, port, *ch))
+				tty_insert_flip_char(tty, *ch, flag);
+		}
+	}
+	return len;
+}
 
-static void ftdi_process_read(struct work_struct *work)
-{ /* ftdi_process_read */
-	struct ftdi_private *priv =
-		container_of(work, struct ftdi_private, rx_work.work);
-	struct usb_serial_port *port = priv->port;
-	struct urb *urb;
+static void ftdi_process_read(struct usb_serial_port *port)
+{
+	struct urb *urb = port->read_urb;
 	struct tty_struct *tty;
-	char error_flag;
-	unsigned char *data;
-
+	struct ftdi_private *priv = usb_get_serial_port_data(port);
+	char *data = (char *)urb->transfer_buffer;
 	int i;
-	int result;
-	int need_flip;
-	int packet_offset;
-	unsigned long flags;
-
-	dbg("%s - port %d", __func__, port->number);
-
-	if (port->port.count <= 0)
-		return;
+	int len;
+	int count = 0;
 
 	tty = tty_port_tty_get(&port->port);
-	if (!tty) {
-		dbg("%s - bad tty pointer - exiting", __func__);
+	if (!tty)
 		return;
-	}
 
-	priv = usb_get_serial_port_data(port);
-	if (!priv) {
-		dbg("%s - bad port private data pointer - exiting", __func__);
-		goto out;
+	for (i = 0; i < urb->actual_length; i += priv->max_packet_size) {
+		len = min_t(int, urb->actual_length - i, priv->max_packet_size);
+		count += ftdi_process_packet(tty, port, priv, &data[i], len);
 	}
 
-	urb = port->read_urb;
-	if (!urb) {
-		dbg("%s - bad read_urb pointer - exiting", __func__);
-		goto out;
-	}
-
-	data = urb->transfer_buffer;
-
-	if (priv->rx_processed) {
-		dbg("%s - already processed: %d bytes, %d remain", __func__,
-				priv->rx_processed,
-				urb->actual_length - priv->rx_processed);
-	} else {
-		/* The first two bytes of every read packet are status */
-		if (urb->actual_length > 2)
-			usb_serial_debug_data(debug, &port->dev, __func__,
-						urb->actual_length, data);
-		else
-			dbg("Status only: %03oo %03oo", data[0], data[1]);
-	}
-
-
-	/* TO DO -- check for hung up line and handle appropriately: */
-	/*   send hangup  */
-	/* See acm.c - you do a tty_hangup  - eg tty_hangup(tty) */
-	/* if CD is dropped and the line is not CLOCAL then we should hangup */
-
-	need_flip = 0;
-	for (packet_offset = priv->rx_processed;
-		packet_offset < urb->actual_length; packet_offset += priv->max_packet_size) {
-		int length;
-
-		/* Compare new line status to the old one, signal if different/
-		   N.B. packet may be processed more than once, but differences
-		   are only processed once.  */
-		char new_status = data[packet_offset + 0] &
-						FTDI_STATUS_B0_MASK;
-		if (new_status != priv->prev_status) {
-			priv->diff_status |=
-				new_status ^ priv->prev_status;
-			wake_up_interruptible(&priv->delta_msr_wait);
-			priv->prev_status = new_status;
-		}
-
-		length = min_t(u32, priv->max_packet_size, urb->actual_length-packet_offset)-2;
-		if (length < 0) {
-			dev_err(&port->dev, "%s - bad packet length: %d\n",
-				__func__, length+2);
-			length = 0;
-		}
-
-		if (priv->rx_flags & THROTTLED) {
-			dbg("%s - throttled", __func__);
-			break;
-		}
-		if (tty_buffer_request_room(tty, length) < length) {
-			/* break out & wait for throttling/unthrottling to
-			   happen */
-			dbg("%s - receive room low", __func__);
-			break;
-		}
-
-		/* Handle errors and break */
-		error_flag = TTY_NORMAL;
-		/* Although the device uses a bitmask and hence can have
-		   multiple errors on a packet - the order here sets the
-		   priority the error is returned to the tty layer  */
-
-		if (data[packet_offset+1] & FTDI_RS_OE) {
-			error_flag = TTY_OVERRUN;
-			dbg("OVERRRUN error");
-		}
-		if (data[packet_offset+1] & FTDI_RS_BI) {
-			error_flag = TTY_BREAK;
-			dbg("BREAK received");
-			usb_serial_handle_break(port);
-		}
-		if (data[packet_offset+1] & FTDI_RS_PE) {
-			error_flag = TTY_PARITY;
-			dbg("PARITY error");
-		}
-		if (data[packet_offset+1] & FTDI_RS_FE) {
-			error_flag = TTY_FRAME;
-			dbg("FRAMING error");
-		}
-		if (length > 0) {
-			for (i = 2; i < length+2; i++) {
-				/* Note that the error flag is duplicated for
-				   every character received since we don't know
-				   which character it applied to */
-				if (!usb_serial_handle_sysrq_char(tty, port,
-						data[packet_offset + i]))
-					tty_insert_flip_char(tty,
-						data[packet_offset + i],
-						error_flag);
-			}
-			need_flip = 1;
-		}
-
-#ifdef NOT_CORRECT_BUT_KEEPING_IT_FOR_NOW
-		/* if a parity error is detected you get status packets forever
-		   until a character is sent without a parity error.
-		   This doesn't work well since the application receives a
-		   never ending stream of bad data - even though new data
-		   hasn't been sent. Therefore I (bill) have taken this out.
-		   However - this might make sense for framing errors and so on
-		   so I am leaving the code in for now.
-		*/
-		else {
-			if (error_flag != TTY_NORMAL) {
-				dbg("error_flag is not normal");
-				/* In this case it is just status - if that is
-				   an error send a bad character */
-				if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-					tty_flip_buffer_push(tty);
-				tty_insert_flip_char(tty, 0xff, error_flag);
-				need_flip = 1;
-			}
-		}
-#endif
-	} /* "for(packet_offset=0..." */
-
-	/* Low latency */
-	if (need_flip)
+	if (count)
 		tty_flip_buffer_push(tty);
+	tty_kref_put(tty);
+}
 
-	if (packet_offset < urb->actual_length) {
-		/* not completely processed - record progress */
-		priv->rx_processed = packet_offset;
-		dbg("%s - incomplete, %d bytes processed, %d remain",
-				__func__, packet_offset,
-				urb->actual_length - packet_offset);
-		/* check if we were throttled while processing */
-		spin_lock_irqsave(&priv->rx_lock, flags);
-		if (priv->rx_flags & THROTTLED) {
-			priv->rx_flags |= ACTUALLY_THROTTLED;
-			spin_unlock_irqrestore(&priv->rx_lock, flags);
-			dbg("%s - deferring remainder until unthrottled",
-					__func__);
-			goto out;
-		}
-		spin_unlock_irqrestore(&priv->rx_lock, flags);
-		/* if the port is closed stop trying to read */
-		if (port->port.count > 0)
-			/* delay processing of remainder */
-			schedule_delayed_work(&priv->rx_work, 1);
-		else
-			dbg("%s - port is closed", __func__);
-		goto out;
-	}
-
-	/* urb is completely processed */
-	priv->rx_processed = 0;
+static void ftdi_read_bulk_callback(struct urb *urb)
+{
+	struct usb_serial_port *port = urb->context;
+	unsigned long flags;
 
-	/* if the port is closed stop trying to read */
-	if (port->port.count > 0) {
-		/* Continue trying to always read  */
-		usb_fill_bulk_urb(port->read_urb, port->serial->dev,
-			usb_rcvbulkpipe(port->serial->dev,
-					port->bulk_in_endpointAddress),
-			port->read_urb->transfer_buffer,
-			port->read_urb->transfer_buffer_length,
-			ftdi_read_bulk_callback, port);
+	dbg("%s - port %d", __func__, port->number);
 
-		result = usb_submit_urb(port->read_urb, GFP_ATOMIC);
-		if (result)
-			dev_err(&port->dev,
-				"%s - failed resubmitting read urb, error %d\n",
-				__func__, result);
+	if (urb->status) {
+		dbg("%s - nonzero read bulk status received: %d",
+						__func__, urb->status);
+		return;
 	}
-out:
-	tty_kref_put(tty);
-} /* ftdi_process_read */
 
+	usb_serial_debug_data(debug, &port->dev, __func__,
+				urb->actual_length, urb->transfer_buffer);
+	ftdi_process_read(port);
+
+	spin_lock_irqsave(&port->lock, flags);
+	port->throttled = port->throttle_req;
+	if (!port->throttled) {
+		spin_unlock_irqrestore(&port->lock, flags);
+		ftdi_submit_read_urb(port, GFP_ATOMIC);
+	} else
+		spin_unlock_irqrestore(&port->lock, flags);
+}
 
 static void ftdi_break_ctl(struct tty_struct *tty, int break_state)
 {
@@ -2604,33 +2448,31 @@
 static void ftdi_throttle(struct tty_struct *tty)
 {
 	struct usb_serial_port *port = tty->driver_data;
-	struct ftdi_private *priv = usb_get_serial_port_data(port);
 	unsigned long flags;
 
 	dbg("%s - port %d", __func__, port->number);
 
-	spin_lock_irqsave(&priv->rx_lock, flags);
-	priv->rx_flags |= THROTTLED;
-	spin_unlock_irqrestore(&priv->rx_lock, flags);
+	spin_lock_irqsave(&port->lock, flags);
+	port->throttle_req = 1;
+	spin_unlock_irqrestore(&port->lock, flags);
 }
 
-
-static void ftdi_unthrottle(struct tty_struct *tty)
+void ftdi_unthrottle(struct tty_struct *tty)
 {
 	struct usb_serial_port *port = tty->driver_data;
-	struct ftdi_private *priv = usb_get_serial_port_data(port);
-	int actually_throttled;
+	int was_throttled;
 	unsigned long flags;
 
 	dbg("%s - port %d", __func__, port->number);
 
-	spin_lock_irqsave(&priv->rx_lock, flags);
-	actually_throttled = priv->rx_flags & ACTUALLY_THROTTLED;
-	priv->rx_flags &= ~(THROTTLED | ACTUALLY_THROTTLED);
-	spin_unlock_irqrestore(&priv->rx_lock, flags);
-
-	if (actually_throttled)
-		schedule_delayed_work(&priv->rx_work, 0);
+	spin_lock_irqsave(&port->lock, flags);
+	was_throttled = port->throttled;
+	port->throttled = port->throttle_req = 0;
+	spin_unlock_irqrestore(&port->lock, flags);
+
+	/* Resubmit urb if throttled and open. */
+	if (was_throttled && test_bit(ASYNCB_INITIALIZED, &port->port.flags))
+		ftdi_submit_read_urb(port, GFP_KERNEL);
 }
 
 static int __init ftdi_init(void)
--- linux-rt-2.6.31.orig/drivers/usb/serial/ipaq.c
+++ linux-rt-2.6.31/drivers/usb/serial/ipaq.c
@@ -547,7 +547,6 @@
 	{ USB_DEVICE(0x413C, 0x4009) }, /* Dell Axim USB Sync */
 	{ USB_DEVICE(0x4505, 0x0010) }, /* Smartphone */
 	{ USB_DEVICE(0x5E04, 0xCE00) }, /* SAGEM Wireless Assistant */
-	{ USB_DEVICE(0x0BB4, 0x00CF) }, /* HTC smartphone modems */
 	{ }                             /* Terminating entry */
 };
 
@@ -971,6 +970,15 @@
 static int ipaq_startup(struct usb_serial *serial)
 {
 	dbg("%s", __func__);
+
+	/* Some of the devices in ipaq_id_table[] are composite, and we
+	 * shouldn't bind to all the interfaces.  This test will rule out
+	 * some obviously invalid possibilities.
+	 */
+	if (serial->num_bulk_in < serial->num_ports ||
+			serial->num_bulk_out < serial->num_ports)
+		return -ENODEV;
+
 	if (serial->dev->actconfig->desc.bConfigurationValue != 1) {
 		/*
 		 * FIXME: HP iPaq rx3715, possibly others, have 1 config that
--- linux-rt-2.6.31.orig/drivers/usb/serial/generic.c
+++ linux-rt-2.6.31/drivers/usb/serial/generic.c
@@ -530,7 +530,7 @@
 
 	if (was_throttled) {
 		/* Resume reading from device */
-		usb_serial_generic_resubmit_read_urb(port, GFP_KERNEL);
+		flush_and_resubmit_read_urb(port);
 	}
 }
 
--- linux-rt-2.6.31.orig/drivers/usb/serial/sierra.c
+++ linux-rt-2.6.31/drivers/usb/serial/sierra.c
@@ -287,6 +287,8 @@
 	struct sierra_port_private *portdata;
 	__u16 interface = 0;
 	int val = 0;
+	int do_send = 0;
+	int retval;
 
 	dev_dbg(&port->dev, "%s\n", __func__);
 
@@ -305,10 +307,7 @@
 		 */
 		if (port->interrupt_in_urb) {
 			/* send control message */
-			return usb_control_msg(serial->dev,
-				usb_rcvctrlpipe(serial->dev, 0),
-				0x22, 0x21, val, interface,
-				NULL, 0, USB_CTRL_SET_TIMEOUT);
+			do_send = 1;
 		}
 	}
 
@@ -320,12 +319,18 @@
 			interface = 1;
 		else if (port->bulk_out_endpointAddress == 5)
 			interface = 2;
-		return usb_control_msg(serial->dev,
-			usb_rcvctrlpipe(serial->dev, 0),
-			0x22, 0x21, val, interface,
-			NULL, 0, USB_CTRL_SET_TIMEOUT);
+
+		do_send = 1;
 	}
-	return 0;
+	if (!do_send)
+		return 0;
+
+	usb_autopm_get_interface(serial->interface);
+	retval = usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0),
+		0x22, 0x21, val, interface, NULL, 0, USB_CTRL_SET_TIMEOUT);
+	usb_autopm_put_interface(serial->interface);
+
+	return retval;
 }
 
 static void sierra_set_termios(struct tty_struct *tty,
--- linux-rt-2.6.31.orig/drivers/usb/class/cdc-wdm.c
+++ linux-rt-2.6.31/drivers/usb/class/cdc-wdm.c
@@ -313,8 +313,13 @@
 	r = usb_autopm_get_interface(desc->intf);
 	if (r < 0)
 		goto outnp;
-	r = wait_event_interruptible(desc->wait, !test_bit(WDM_IN_USE,
-							   &desc->flags));
+
+	if (!file->f_flags && O_NONBLOCK)
+		r = wait_event_interruptible(desc->wait, !test_bit(WDM_IN_USE,
+								&desc->flags));
+	else
+		if (test_bit(WDM_IN_USE, &desc->flags))
+			r = -EAGAIN;
 	if (r < 0)
 		goto out;
 
@@ -377,7 +382,7 @@
 static ssize_t wdm_read
 (struct file *file, char __user *buffer, size_t count, loff_t *ppos)
 {
-	int rv, cntr;
+	int rv, cntr = 0;
 	int i = 0;
 	struct wdm_device *desc = file->private_data;
 
@@ -389,10 +394,23 @@
 	if (desc->length == 0) {
 		desc->read = 0;
 retry:
+		if (test_bit(WDM_DISCONNECTING, &desc->flags)) {
+			rv = -ENODEV;
+			goto err;
+		}
 		i++;
-		rv = wait_event_interruptible(desc->wait,
-					      test_bit(WDM_READ, &desc->flags));
+		if (file->f_flags & O_NONBLOCK) {
+			if (!test_bit(WDM_READ, &desc->flags)) {
+				rv = cntr ? cntr : -EAGAIN;
+				goto err;
+			}
+			rv = 0;
+		} else {
+			rv = wait_event_interruptible(desc->wait,
+				test_bit(WDM_READ, &desc->flags));
+		}
 
+		/* may have happened while we slept */
 		if (test_bit(WDM_DISCONNECTING, &desc->flags)) {
 			rv = -ENODEV;
 			goto err;
@@ -448,7 +466,7 @@
 
 err:
 	mutex_unlock(&desc->rlock);
-	if (rv < 0)
+	if (rv < 0 && rv != -EAGAIN)
 		dev_err(&desc->intf->dev, "wdm_read: exit error\n");
 	return rv;
 }
--- linux-rt-2.6.31.orig/drivers/usb/class/usbtmc.c
+++ linux-rt-2.6.31/drivers/usb/class/usbtmc.c
@@ -367,13 +367,13 @@
 {
 	struct usbtmc_device_data *data;
 	struct device *dev;
-	unsigned long int n_characters;
+	u32 n_characters;
 	u8 *buffer;
 	int actual;
-	int done;
-	int remaining;
+	size_t done;
+	size_t remaining;
 	int retval;
-	int this_part;
+	size_t this_part;
 
 	/* Get pointer to private data structure */
 	data = filp->private_data;
@@ -455,6 +455,18 @@
 			       (buffer[6] << 16) +
 			       (buffer[7] << 24);
 
+		/* Ensure the instrument doesn't lie about it */
+		if(n_characters > actual - 12) {
+			dev_err(dev, "Device lies about message size: %zu > %zu\n", n_characters, actual - 12);
+			n_characters = actual - 12;
+		}
+
+		/* Ensure the instrument doesn't send more back than requested */
+		if(n_characters > this_part) {
+			dev_err(dev, "Device returns more than requested: %zu > %zu\n", done + n_characters, done + this_part);
+			n_characters = this_part;
+		}
+
 		/* Copy buffer to user space */
 		if (copy_to_user(buf + done, &buffer[12], n_characters)) {
 			/* There must have been an addressing problem */
@@ -465,6 +477,8 @@
 		done += n_characters;
 		if (n_characters < USBTMC_SIZE_IOBUFFER)
 			remaining = 0;
+		else
+			remaining -= n_characters;
 	}
 
 	/* Update file position value */
@@ -531,10 +545,16 @@
 		n_bytes = roundup(12 + this_part, 4);
 		memset(buffer + 12 + this_part, 0, n_bytes - (12 + this_part));
 
-		retval = usb_bulk_msg(data->usb_dev,
-				      usb_sndbulkpipe(data->usb_dev,
-						      data->bulk_out),
-				      buffer, n_bytes, &actual, USBTMC_TIMEOUT);
+		do {
+			retval = usb_bulk_msg(data->usb_dev,
+					      usb_sndbulkpipe(data->usb_dev,
+							      data->bulk_out),
+					      buffer, n_bytes,
+					      &actual, USBTMC_TIMEOUT);
+			if (retval != 0)
+				break;
+			n_bytes -= actual;
+		} while (n_bytes);
 
 		data->bTag_last_write = data->bTag;
 		data->bTag++;
--- linux-rt-2.6.31.orig/drivers/usb/class/cdc-acm.c
+++ linux-rt-2.6.31/drivers/usb/class/cdc-acm.c
@@ -59,6 +59,7 @@
 #include <linux/init.h>
 #include <linux/slab.h>
 #include <linux/tty.h>
+#include <linux/serial.h>
 #include <linux/tty_driver.h>
 #include <linux/tty_flip.h>
 #include <linux/module.h>
@@ -608,8 +609,9 @@
 
 	acm->throttle = 0;
 
-	tasklet_schedule(&acm->urb_task);
+	set_bit(ASYNCB_INITIALIZED, &acm->port.flags);
 	rv = tty_port_block_til_ready(&acm->port, tty, filp);
+	tasklet_schedule(&acm->urb_task);
 done:
 	mutex_unlock(&acm->mutex);
 err_out:
@@ -858,10 +860,7 @@
 	if (!ACM_READY(acm))
 		return;
 
-	/* FIXME: Needs to support the tty_baud interface */
-	/* FIXME: Broken on sparc */
-	newline.dwDTERate = cpu_to_le32p(acm_tty_speed +
-		(termios->c_cflag & CBAUD & ~CBAUDEX) + (termios->c_cflag & CBAUDEX ? 15 : 0));
+	newline.dwDTERate = cpu_to_le32(tty_get_baud_rate(tty));
 	newline.bCharFormat = termios->c_cflag & CSTOPB ? 2 : 0;
 	newline.bParityType = termios->c_cflag & PARENB ?
 				(termios->c_cflag & PARODD ? 1 : 2) +
--- linux-rt-2.6.31.orig/drivers/usb/mon/mon_bin.c
+++ linux-rt-2.6.31/drivers/usb/mon/mon_bin.c
@@ -350,12 +350,12 @@
 
 /*
  * Return a few (kilo-)bytes to the head of the buffer.
- * This is used if a DMA fetch fails.
+ * This is used if a data fetch fails.
  */
 static void mon_buff_area_shrink(struct mon_reader_bin *rp, unsigned int size)
 {
 
-	size = (size + PKT_ALIGN-1) & ~(PKT_ALIGN-1);
+	/* size &= ~(PKT_ALIGN-1);  -- we're called with aligned size */
 	rp->b_cnt -= size;
 	if (rp->b_in < size)
 		rp->b_in += rp->b_size;
@@ -442,6 +442,7 @@
 	unsigned int urb_length;
 	unsigned int offset;
 	unsigned int length;
+	unsigned int delta;
 	unsigned int ndesc, lendesc;
 	unsigned char dir;
 	struct mon_bin_hdr *ep;
@@ -546,8 +547,10 @@
 	if (length != 0) {
 		ep->flag_data = mon_bin_get_data(rp, offset, urb, length);
 		if (ep->flag_data != 0) {	/* Yes, it's 0x00, not '0' */
-			ep->len_cap = 0;
-			mon_buff_area_shrink(rp, length);
+			delta = (ep->len_cap + PKT_ALIGN-1) & ~(PKT_ALIGN-1);
+			ep->len_cap -= length;
+			delta -= (ep->len_cap + PKT_ALIGN-1) & ~(PKT_ALIGN-1);
+			mon_buff_area_shrink(rp, delta);
 		}
 	} else {
 		ep->flag_data = data_tag;
--- linux-rt-2.6.31.orig/drivers/usb/musb/musb_gadget.c
+++ linux-rt-2.6.31/drivers/usb/musb/musb_gadget.c
@@ -4,6 +4,7 @@
  * Copyright 2005 Mentor Graphics Corporation
  * Copyright (C) 2005-2006 by Texas Instruments
  * Copyright (C) 2006-2007 Nokia Corporation
+ * Copyright (C) 2009 MontaVista Software, Inc. <source@mvista.com>
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
@@ -436,14 +437,6 @@
 			csr |= MUSB_TXCSR_P_WZC_BITS;
 			csr &= ~MUSB_TXCSR_P_SENTSTALL;
 			musb_writew(epio, MUSB_TXCSR, csr);
-			if (dma_channel_status(dma) == MUSB_DMA_STATUS_BUSY) {
-				dma->status = MUSB_DMA_STATUS_CORE_ABORT;
-				musb->dma_controller->channel_abort(dma);
-			}
-
-			if (request)
-				musb_g_giveback(musb_ep, request, -EPIPE);
-
 			break;
 		}
 
@@ -582,15 +575,25 @@
  */
 static void rxstate(struct musb *musb, struct musb_request *req)
 {
-	u16			csr = 0;
 	const u8		epnum = req->epnum;
 	struct usb_request	*request = &req->request;
 	struct musb_ep		*musb_ep = &musb->endpoints[epnum].ep_out;
 	void __iomem		*epio = musb->endpoints[epnum].regs;
 	unsigned		fifo_count = 0;
 	u16			len = musb_ep->packet_sz;
+	u16			csr = musb_readw(epio, MUSB_RXCSR);
 
-	csr = musb_readw(epio, MUSB_RXCSR);
+	/* We shouldn't get here while DMA is active, but we do... */
+	if (dma_channel_status(musb_ep->dma) == MUSB_DMA_STATUS_BUSY) {
+		DBG(4, "DMA pending...\n");
+		return;
+	}
+
+	if (csr & MUSB_RXCSR_P_SENDSTALL) {
+		DBG(5, "%s stalling, RXCSR %04x\n",
+		    musb_ep->end_point.name, csr);
+		return;
+	}
 
 	if (is_cppi_enabled() && musb_ep->dma) {
 		struct dma_controller	*c = musb->dma_controller;
@@ -761,19 +764,10 @@
 			csr, dma ? " (dma)" : "", request);
 
 	if (csr & MUSB_RXCSR_P_SENTSTALL) {
-		if (dma_channel_status(dma) == MUSB_DMA_STATUS_BUSY) {
-			dma->status = MUSB_DMA_STATUS_CORE_ABORT;
-			(void) musb->dma_controller->channel_abort(dma);
-			request->actual += musb_ep->dma->actual_len;
-		}
-
 		csr |= MUSB_RXCSR_P_WZC_BITS;
 		csr &= ~MUSB_RXCSR_P_SENTSTALL;
 		musb_writew(epio, MUSB_RXCSR, csr);
-
-		if (request)
-			musb_g_giveback(musb_ep, request, -EPIPE);
-		goto done;
+		return;
 	}
 
 	if (csr & MUSB_RXCSR_P_OVERRUN) {
@@ -795,7 +789,7 @@
 		DBG((csr & MUSB_RXCSR_DMAENAB) ? 4 : 1,
 			"%s busy, csr %04x\n",
 			musb_ep->end_point.name, csr);
-		goto done;
+		return;
 	}
 
 	if (dma && (csr & MUSB_RXCSR_DMAENAB)) {
@@ -826,22 +820,15 @@
 		if ((request->actual < request->length)
 				&& (musb_ep->dma->actual_len
 					== musb_ep->packet_sz))
-			goto done;
+			return;
 #endif
 		musb_g_giveback(musb_ep, request, 0);
 
 		request = next_request(musb_ep);
 		if (!request)
-			goto done;
-
-		/* don't start more i/o till the stall clears */
-		musb_ep_select(mbase, epnum);
-		csr = musb_readw(epio, MUSB_RXCSR);
-		if (csr & MUSB_RXCSR_P_SENDSTALL)
-			goto done;
+			return;
 	}
 
-
 	/* analyze request if the ep is hot */
 	if (request)
 		rxstate(musb, to_musb_request(request));
@@ -849,8 +836,6 @@
 		DBG(3, "packet waiting for %s%s request\n",
 				musb_ep->desc ? "" : "inactive ",
 				musb_ep->end_point.name);
-
-done:
 	return;
 }
 
@@ -1244,7 +1229,7 @@
 	void __iomem		*mbase;
 	unsigned long		flags;
 	u16			csr;
-	struct musb_request	*request = NULL;
+	struct musb_request	*request;
 	int			status = 0;
 
 	if (!ep)
@@ -1260,24 +1245,29 @@
 
 	musb_ep_select(mbase, epnum);
 
-	/* cannot portably stall with non-empty FIFO */
 	request = to_musb_request(next_request(musb_ep));
-	if (value && musb_ep->is_in) {
-		csr = musb_readw(epio, MUSB_TXCSR);
-		if (csr & MUSB_TXCSR_FIFONOTEMPTY) {
-			DBG(3, "%s fifo busy, cannot halt\n", ep->name);
-			spin_unlock_irqrestore(&musb->lock, flags);
-			return -EAGAIN;
+	if (value) {
+		if (request) {
+			DBG(3, "request in progress, cannot halt %s\n",
+			    ep->name);
+			status = -EAGAIN;
+			goto done;
+		}
+		/* Cannot portably stall with non-empty FIFO */
+		if (musb_ep->is_in) {
+			csr = musb_readw(epio, MUSB_TXCSR);
+			if (csr & MUSB_TXCSR_FIFONOTEMPTY) {
+				DBG(3, "FIFO busy, cannot halt %s\n", ep->name);
+				status = -EAGAIN;
+				goto done;
+			}
 		}
-
 	}
 
 	/* set/clear the stall and toggle bits */
 	DBG(2, "%s: %s stall\n", ep->name, value ? "set" : "clear");
 	if (musb_ep->is_in) {
 		csr = musb_readw(epio, MUSB_TXCSR);
-		if (csr & MUSB_TXCSR_FIFONOTEMPTY)
-			csr |= MUSB_TXCSR_FLUSHFIFO;
 		csr |= MUSB_TXCSR_P_WZC_BITS
 			| MUSB_TXCSR_CLRDATATOG;
 		if (value)
@@ -1300,14 +1290,13 @@
 		musb_writew(epio, MUSB_RXCSR, csr);
 	}
 
-done:
-
 	/* maybe start the first request in the queue */
 	if (!musb_ep->busy && !value && request) {
 		DBG(3, "restarting the request\n");
 		musb_ep_restart(musb, request);
 	}
 
+done:
 	spin_unlock_irqrestore(&musb->lock, flags);
 	return status;
 }
--- linux-rt-2.6.31.orig/drivers/usb/musb/musb_gadget_ep0.c
+++ linux-rt-2.6.31/drivers/usb/musb/musb_gadget_ep0.c
@@ -199,7 +199,6 @@
 static void musb_g_ep0_giveback(struct musb *musb, struct usb_request *req)
 {
 	musb_g_giveback(&musb->endpoints[0].ep_in, req, 0);
-	musb->ep0_state = MUSB_EP0_STAGE_SETUP;
 }
 
 /*
@@ -647,7 +646,7 @@
 			musb->ep0_state = MUSB_EP0_STAGE_STATUSIN;
 			break;
 		default:
-			ERR("SetupEnd came in a wrong ep0stage %s",
+			ERR("SetupEnd came in a wrong ep0stage %s\n",
 			    decode_ep0stage(musb->ep0_state));
 		}
 		csr = musb_readw(regs, MUSB_CSR0);
@@ -770,12 +769,18 @@
 				handled = service_zero_data_request(
 						musb, &setup);
 
+				/*
+				 * We're expecting no data in any case, so
+				 * always set the DATAEND bit -- doing this
+				 * here helps avoid SetupEnd interrupt coming
+				 * in the idle stage when we're stalling...
+				 */
+				musb->ackpend |= MUSB_CSR0_P_DATAEND;
+
 				/* status stage might be immediate */
-				if (handled > 0) {
-					musb->ackpend |= MUSB_CSR0_P_DATAEND;
+				if (handled > 0)
 					musb->ep0_state =
 						MUSB_EP0_STAGE_STATUSIN;
-				}
 				break;
 
 			/* sequence #1 (IN to host), includes GET_STATUS
--- linux-rt-2.6.31.orig/drivers/usb/misc/emi62.c
+++ linux-rt-2.6.31/drivers/usb/misc/emi62.c
@@ -167,7 +167,7 @@
 			err("%s - error loading firmware: error = %d", __func__, err);
 			goto wraperr;
 		}
-	} while (i > 0);
+	} while (rec);
 
 	/* Assert reset (stop the CPU in the EMI) */
 	err = emi62_set_reset(dev,1);
--- linux-rt-2.6.31.orig/drivers/usb/misc/appledisplay.c
+++ linux-rt-2.6.31/drivers/usb/misc/appledisplay.c
@@ -72,8 +72,8 @@
 	struct usb_device *udev;	/* usb device */
 	struct urb *urb;		/* usb request block */
 	struct backlight_device *bd;	/* backlight device */
-	char *urbdata;			/* interrupt URB data buffer */
-	char *msgdata;			/* control message data buffer */
+	u8 *urbdata;			/* interrupt URB data buffer */
+	u8 *msgdata;			/* control message data buffer */
 
 	struct delayed_work work;
 	int button_pressed;
--- linux-rt-2.6.31.orig/drivers/usb/core/config.c
+++ linux-rt-2.6.31/drivers/usb/core/config.c
@@ -105,7 +105,7 @@
 	ep->ss_ep_comp->extralen = i;
 	buffer += i;
 	size -= i;
-	retval = buffer - buffer_start + i;
+	retval = buffer - buffer_start;
 	if (num_skipped > 0)
 		dev_dbg(ddev, "skipped %d descriptor%s after %s\n",
 				num_skipped, plural(num_skipped),
--- linux-rt-2.6.31.orig/drivers/usb/core/usb.c
+++ linux-rt-2.6.31/drivers/usb/core/usb.c
@@ -132,7 +132,7 @@
 
 struct find_interface_arg {
 	int minor;
-	struct usb_interface *interface;
+	struct device_driver *drv;
 };
 
 static int __find_interface(struct device *dev, void *data)
@@ -143,12 +143,10 @@
 	if (!is_usb_interface(dev))
 		return 0;
 
+	if (dev->driver != arg->drv)
+		return 0;
 	intf = to_usb_interface(dev);
-	if (intf->minor != -1 && intf->minor == arg->minor) {
-		arg->interface = intf;
-		return 1;
-	}
-	return 0;
+	return intf->minor == arg->minor;
 }
 
 /**
@@ -156,21 +154,24 @@
  * @drv: the driver whose current configuration is considered
  * @minor: the minor number of the desired device
  *
- * This walks the driver device list and returns a pointer to the interface
- * with the matching minor.  Note, this only works for devices that share the
- * USB major number.
+ * This walks the bus device list and returns a pointer to the interface
+ * with the matching minor and driver.  Note, this only works for devices
+ * that share the USB major number.
  */
 struct usb_interface *usb_find_interface(struct usb_driver *drv, int minor)
 {
 	struct find_interface_arg argb;
-	int retval;
+	struct device *dev;
 
 	argb.minor = minor;
-	argb.interface = NULL;
-	/* eat the error, it will be in argb.interface */
-	retval = driver_for_each_device(&drv->drvwrap.driver, NULL, &argb,
-					__find_interface);
-	return argb.interface;
+	argb.drv = &drv->drvwrap.driver;
+
+	dev = bus_find_device(&usb_bus_type, NULL, &argb, __find_interface);
+
+	/* Drop reference count from bus_find_device */
+	put_device(dev);
+
+	return dev ? to_usb_interface(dev) : NULL;
 }
 EXPORT_SYMBOL_GPL(usb_find_interface);
 
--- linux-rt-2.6.31.orig/drivers/usb/core/driver.c
+++ linux-rt-2.6.31/drivers/usb/core/driver.c
@@ -976,6 +976,11 @@
 	return status;
 }
 
+#ifdef CONFIG_X86_LPIA
+struct usb_hub;
+void hub_port_logical_disconnect(struct usb_hub *hub, int port1);
+#endif
+
 /* Caller has locked intf's usb_device's pm_mutex */
 static int usb_resume_interface(struct usb_device *udev,
 		struct usb_interface *intf, pm_message_t msg, int reset_resume)
@@ -1015,9 +1020,19 @@
 				dev_err(&intf->dev, "%s error %d\n",
 						"reset_resume", status);
 		} else {
+#ifdef CONFIG_X86_LPIA
+			struct usb_device *udev = interface_to_usbdev(intf);
+			struct usb_device *pdev = udev->parent;
+#endif
 			intf->needs_binding = 1;
 			dev_warn(&intf->dev, "no %s for driver %s?\n",
 					"reset_resume", driver->name);
+#ifdef CONFIG_X86_LPIA
+			if (pdev) {
+				struct usb_hub *phub = usb_get_intfdata(pdev->actconfig->interface[0]);
+				hub_port_logical_disconnect(phub, udev->portnum);
+			}
+#endif
 		}
 	} else {
 		if (driver->resume) {
--- linux-rt-2.6.31.orig/drivers/usb/core/hub.c
+++ linux-rt-2.6.31/drivers/usb/core/hub.c
@@ -439,7 +439,7 @@
 static inline int
 hub_clear_tt_buffer (struct usb_device *hdev, u16 devinfo, u16 tt)
 {
-	return usb_control_msg(hdev, usb_rcvctrlpipe(hdev, 0),
+	return usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
 			       HUB_CLEAR_TT_BUFFER, USB_RT_PORT, devinfo,
 			       tt, NULL, 0, 1000);
 }
@@ -613,7 +613,7 @@
  * time later khubd will disconnect() any existing usb_device on the port
  * and will re-enumerate if there actually is a device attached.
  */
-static void hub_port_logical_disconnect(struct usb_hub *hub, int port1)
+void hub_port_logical_disconnect(struct usb_hub *hub, int port1)
 {
 	dev_dbg(hub->intfdev, "logical disconnect on port %d\n", port1);
 	hub_port_disable(hub, port1, 1);
@@ -630,6 +630,7 @@
 	set_bit(port1, hub->change_bits);
  	kick_khubd(hub);
 }
+EXPORT_SYMBOL(hub_port_logical_disconnect);
 
 enum hub_activation_type {
 	HUB_INIT, HUB_INIT2, HUB_INIT3,
--- linux-rt-2.6.31.orig/drivers/usb/core/quirks.c
+++ linux-rt-2.6.31/drivers/usb/core/quirks.c
@@ -74,6 +74,10 @@
 	/* INTEL VALUE SSD */
 	{ USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME },
 
+#ifdef CONFIG_X86_LPIA
+	/* ASIX Ethernet Device */
+	{ USB_DEVICE(0x0b95, 0x1720), .driver_info = USB_QUIRK_RESET_RESUME },
+#endif
 	{ }  /* terminating entry must be last */
 };
 
--- linux-rt-2.6.31.orig/drivers/usb/gadget/amd5536udc.c
+++ linux-rt-2.6.31/drivers/usb/gadget/amd5536udc.c
@@ -1213,7 +1213,12 @@
 				tmp &= AMD_UNMASK_BIT(ep->num);
 				writel(tmp, &dev->regs->ep_irqmsk);
 			}
-		}
+		} else if (ep->in) {
+				/* enable ep irq */
+				tmp = readl(&dev->regs->ep_irqmsk);
+				tmp &= AMD_UNMASK_BIT(ep->num);
+				writel(tmp, &dev->regs->ep_irqmsk);
+			}
 
 	} else if (ep->dma) {
 
@@ -2005,18 +2010,17 @@
 {
 	int tmp;
 
-	/* empty queues and init hardware */
-	udc_basic_init(dev);
-	for (tmp = 0; tmp < UDC_EP_NUM; tmp++) {
-		empty_req_queue(&dev->ep[tmp]);
-	}
-
 	if (dev->gadget.speed != USB_SPEED_UNKNOWN) {
 		spin_unlock(&dev->lock);
 		driver->disconnect(&dev->gadget);
 		spin_lock(&dev->lock);
 	}
-	/* init */
+
+	/* empty queues and init hardware */
+	udc_basic_init(dev);
+	for (tmp = 0; tmp < UDC_EP_NUM; tmp++)
+		empty_req_queue(&dev->ep[tmp]);
+
 	udc_setup_endpoints(dev);
 }
 
@@ -2478,6 +2482,13 @@
 				}
 			}
 
+		} else if (!use_dma && ep->in) {
+			/* disable interrupt */
+			tmp = readl(
+				&dev->regs->ep_irqmsk);
+			tmp |= AMD_BIT(ep->num);
+			writel(tmp,
+				&dev->regs->ep_irqmsk);
 		}
 	}
 	/* clear status bits */
@@ -3285,6 +3296,17 @@
 		goto finished;
 	}
 
+	spin_lock_init(&dev->lock);
+	/* udc csr registers base */
+	dev->csr = dev->virt_addr + UDC_CSR_ADDR;
+	/* dev registers base */
+	dev->regs = dev->virt_addr + UDC_DEVCFG_ADDR;
+	/* ep registers base */
+	dev->ep_regs = dev->virt_addr + UDC_EPREGS_ADDR;
+	/* fifo's base */
+	dev->rxfifo = (u32 __iomem *)(dev->virt_addr + UDC_RXFIFO_ADDR);
+	dev->txfifo = (u32 __iomem *)(dev->virt_addr + UDC_TXFIFO_ADDR);
+
 	if (request_irq(pdev->irq, udc_irq, IRQF_SHARED, name, dev) != 0) {
 		dev_dbg(&dev->pdev->dev, "request_irq(%d) fail\n", pdev->irq);
 		kfree(dev);
@@ -3337,7 +3359,6 @@
 	udc_pollstall_timer.data = 0;
 
 	/* device struct setup */
-	spin_lock_init(&dev->lock);
 	dev->gadget.ops = &udc_ops;
 
 	dev_set_name(&dev->gadget.dev, "gadget");
@@ -3346,16 +3367,6 @@
 	dev->gadget.name = name;
 	dev->gadget.is_dualspeed = 1;
 
-	/* udc csr registers base */
-	dev->csr = dev->virt_addr + UDC_CSR_ADDR;
-	/* dev registers base */
-	dev->regs = dev->virt_addr + UDC_DEVCFG_ADDR;
-	/* ep registers base */
-	dev->ep_regs = dev->virt_addr + UDC_EPREGS_ADDR;
-	/* fifo's base */
-	dev->rxfifo = (u32 __iomem *)(dev->virt_addr + UDC_RXFIFO_ADDR);
-	dev->txfifo = (u32 __iomem *)(dev->virt_addr + UDC_TXFIFO_ADDR);
-
 	/* init registers, interrupts, ... */
 	startup_registers(dev);
 
--- linux-rt-2.6.31.orig/drivers/message/fusion/mptbase.c
+++ linux-rt-2.6.31/drivers/message/fusion/mptbase.c
@@ -1015,9 +1015,9 @@
 {
 	SGESimple64_t *pSge = (SGESimple64_t *) pAddr;
 	pSge->Address.Low = cpu_to_le32
-			(lower_32_bits((unsigned long)(dma_addr)));
+			(lower_32_bits(dma_addr));
 	pSge->Address.High = cpu_to_le32
-			(upper_32_bits((unsigned long)dma_addr));
+			(upper_32_bits(dma_addr));
 	pSge->FlagsLength = cpu_to_le32
 			((flagslength | MPT_SGE_FLAGS_64_BIT_ADDRESSING));
 }
@@ -1038,8 +1038,8 @@
 	u32 tmp;
 
 	pSge->Address.Low = cpu_to_le32
-			(lower_32_bits((unsigned long)(dma_addr)));
-	tmp = (u32)(upper_32_bits((unsigned long)dma_addr));
+			(lower_32_bits(dma_addr));
+	tmp = (u32)(upper_32_bits(dma_addr));
 
 	/*
 	 * 1078 errata workaround for the 36GB limitation
@@ -1101,7 +1101,7 @@
 		pChain->NextChainOffset = next;
 
 		pChain->Address.Low = cpu_to_le32(tmp);
-		tmp = (u32)(upper_32_bits((unsigned long)dma_addr));
+		tmp = (u32)(upper_32_bits(dma_addr));
 		pChain->Address.High = cpu_to_le32(tmp);
 }
 
@@ -3266,6 +3266,16 @@
 	pfacts->IOCStatus = le16_to_cpu(pfacts->IOCStatus);
 	pfacts->IOCLogInfo = le32_to_cpu(pfacts->IOCLogInfo);
 	pfacts->MaxDevices = le16_to_cpu(pfacts->MaxDevices);
+	/*
+	 * VMware emulation is broken, its PortFact's MaxDevices reports value
+	 * programmed by IOC Init, so if you program IOC Init to 256 (which is 0,
+	 * as that field is only 8 bit), it reports back 0 in port facts, instead
+	 * of 256...  And unfortunately using 256 triggers another bug in the
+	 * code (parallel SCSI can have only 16 devices).
+	 */
+	if (pfacts->MaxDevices == 0) {
+	   pfacts->MaxDevices = 16;
+	}
 	pfacts->PortSCSIID = le16_to_cpu(pfacts->PortSCSIID);
 	pfacts->ProtocolFlags = le16_to_cpu(pfacts->ProtocolFlags);
 	pfacts->MaxPostedCmdBuffers = le16_to_cpu(pfacts->MaxPostedCmdBuffers);
--- linux-rt-2.6.31.orig/drivers/connector/cn_queue.c
+++ linux-rt-2.6.31/drivers/connector/cn_queue.c
@@ -78,16 +78,20 @@
 	struct cn_callback_entry *cbq =
 		container_of(work, struct cn_callback_entry, work);
 	struct cn_callback_data *d = &cbq->data;
+	struct cn_msg *msg = NLMSG_DATA(nlmsg_hdr(d->skb));
+	struct netlink_skb_parms *nsp = &NETLINK_CB(d->skb);
 
-	d->callback(d->callback_priv);
+	d->callback(msg, nsp);
 
-	d->destruct_data(d->ddata);
-	d->ddata = NULL;
+	kfree_skb(d->skb);
+	d->skb = NULL;
 
 	kfree(d->free);
 }
 
-static struct cn_callback_entry *cn_queue_alloc_callback_entry(char *name, struct cb_id *id, void (*callback)(void *))
+static struct cn_callback_entry *
+cn_queue_alloc_callback_entry(char *name, struct cb_id *id,
+			      void (*callback)(struct cn_msg *, struct netlink_skb_parms *))
 {
 	struct cn_callback_entry *cbq;
 
@@ -120,7 +124,8 @@
 	return ((i1->idx == i2->idx) && (i1->val == i2->val));
 }
 
-int cn_queue_add_callback(struct cn_queue_dev *dev, char *name, struct cb_id *id, void (*callback)(void *))
+int cn_queue_add_callback(struct cn_queue_dev *dev, char *name, struct cb_id *id,
+			  void (*callback)(struct cn_msg *, struct netlink_skb_parms *))
 {
 	struct cn_callback_entry *cbq, *__cbq;
 	int found = 0;
--- linux-rt-2.6.31.orig/drivers/connector/cn_proc.c
+++ linux-rt-2.6.31/drivers/connector/cn_proc.c
@@ -202,9 +202,9 @@
  * cn_proc_mcast_ctl
  * @data: message sent from userspace via the connector
  */
-static void cn_proc_mcast_ctl(void *data)
+static void cn_proc_mcast_ctl(struct cn_msg *msg,
+			      struct netlink_skb_parms *nsp)
 {
-	struct cn_msg *msg = data;
 	enum proc_cn_mcast_op *mc_op = NULL;
 	int err = 0;
 
--- linux-rt-2.6.31.orig/drivers/connector/connector.c
+++ linux-rt-2.6.31/drivers/connector/connector.c
@@ -36,17 +36,6 @@
 MODULE_AUTHOR("Evgeniy Polyakov <zbr@ioremap.net>");
 MODULE_DESCRIPTION("Generic userspace <-> kernelspace connector.");
 
-static u32 cn_idx = CN_IDX_CONNECTOR;
-static u32 cn_val = CN_VAL_CONNECTOR;
-
-module_param(cn_idx, uint, 0);
-module_param(cn_val, uint, 0);
-MODULE_PARM_DESC(cn_idx, "Connector's main device idx.");
-MODULE_PARM_DESC(cn_val, "Connector's main device val.");
-
-static DEFINE_MUTEX(notify_lock);
-static LIST_HEAD(notify_list);
-
 static struct cn_dev cdev;
 
 static int cn_already_initialized;
@@ -129,21 +118,19 @@
 /*
  * Callback helper - queues work and setup destructor for given data.
  */
-static int cn_call_callback(struct cn_msg *msg, void (*destruct_data)(void *), void *data)
+static int cn_call_callback(struct sk_buff *skb)
 {
 	struct cn_callback_entry *__cbq, *__new_cbq;
 	struct cn_dev *dev = &cdev;
+	struct cn_msg *msg = NLMSG_DATA(nlmsg_hdr(skb));
 	int err = -ENODEV;
 
 	spin_lock_bh(&dev->cbdev->queue_lock);
 	list_for_each_entry(__cbq, &dev->cbdev->queue_list, callback_entry) {
 		if (cn_cb_equal(&__cbq->id.id, &msg->id)) {
 			if (likely(!work_pending(&__cbq->work) &&
-					__cbq->data.ddata == NULL)) {
-				__cbq->data.callback_priv = msg;
-
-				__cbq->data.ddata = data;
-				__cbq->data.destruct_data = destruct_data;
+					__cbq->data.skb == NULL)) {
+				__cbq->data.skb = skb;
 
 				if (queue_cn_work(__cbq, &__cbq->work))
 					err = 0;
@@ -156,10 +143,8 @@
 				__new_cbq = kzalloc(sizeof(struct cn_callback_entry), GFP_ATOMIC);
 				if (__new_cbq) {
 					d = &__new_cbq->data;
-					d->callback_priv = msg;
+					d->skb = skb;
 					d->callback = __cbq->data.callback;
-					d->ddata = data;
-					d->destruct_data = destruct_data;
 					d->free = __new_cbq;
 
 					__new_cbq->pdev = __cbq->pdev;
@@ -191,7 +176,6 @@
  */
 static void cn_rx_skb(struct sk_buff *__skb)
 {
-	struct cn_msg *msg;
 	struct nlmsghdr *nlh;
 	int err;
 	struct sk_buff *skb;
@@ -208,68 +192,20 @@
 			return;
 		}
 
-		msg = NLMSG_DATA(nlh);
-		err = cn_call_callback(msg, (void (*)(void *))kfree_skb, skb);
+		err = cn_call_callback(skb);
 		if (err < 0)
 			kfree_skb(skb);
 	}
 }
 
 /*
- * Notification routing.
- *
- * Gets id and checks if there are notification request for it's idx
- * and val.  If there are such requests notify the listeners with the
- * given notify event.
- *
- */
-static void cn_notify(struct cb_id *id, u32 notify_event)
-{
-	struct cn_ctl_entry *ent;
-
-	mutex_lock(&notify_lock);
-	list_for_each_entry(ent, &notify_list, notify_entry) {
-		int i;
-		struct cn_notify_req *req;
-		struct cn_ctl_msg *ctl = ent->msg;
-		int idx_found, val_found;
-
-		idx_found = val_found = 0;
-
-		req = (struct cn_notify_req *)ctl->data;
-		for (i = 0; i < ctl->idx_notify_num; ++i, ++req) {
-			if (id->idx >= req->first &&
-					id->idx < req->first + req->range) {
-				idx_found = 1;
-				break;
-			}
-		}
-
-		for (i = 0; i < ctl->val_notify_num; ++i, ++req) {
-			if (id->val >= req->first &&
-					id->val < req->first + req->range) {
-				val_found = 1;
-				break;
-			}
-		}
-
-		if (idx_found && val_found) {
-			struct cn_msg m = { .ack = notify_event, };
-
-			memcpy(&m.id, id, sizeof(m.id));
-			cn_netlink_send(&m, ctl->group, GFP_KERNEL);
-		}
-	}
-	mutex_unlock(&notify_lock);
-}
-
-/*
  * Callback add routing - adds callback with given ID and name.
  * If there is registered callback with the same ID it will not be added.
  *
  * May sleep.
  */
-int cn_add_callback(struct cb_id *id, char *name, void (*callback)(void *))
+int cn_add_callback(struct cb_id *id, char *name,
+		    void (*callback)(struct cn_msg *, struct netlink_skb_parms *))
 {
 	int err;
 	struct cn_dev *dev = &cdev;
@@ -281,8 +217,6 @@
 	if (err)
 		return err;
 
-	cn_notify(id, 0);
-
 	return 0;
 }
 EXPORT_SYMBOL_GPL(cn_add_callback);
@@ -300,112 +234,9 @@
 	struct cn_dev *dev = &cdev;
 
 	cn_queue_del_callback(dev->cbdev, id);
-	cn_notify(id, 1);
 }
 EXPORT_SYMBOL_GPL(cn_del_callback);
 
-/*
- * Checks two connector's control messages to be the same.
- * Returns 1 if they are the same or if the first one is corrupted.
- */
-static int cn_ctl_msg_equals(struct cn_ctl_msg *m1, struct cn_ctl_msg *m2)
-{
-	int i;
-	struct cn_notify_req *req1, *req2;
-
-	if (m1->idx_notify_num != m2->idx_notify_num)
-		return 0;
-
-	if (m1->val_notify_num != m2->val_notify_num)
-		return 0;
-
-	if (m1->len != m2->len)
-		return 0;
-
-	if ((m1->idx_notify_num + m1->val_notify_num) * sizeof(*req1) !=
-	    m1->len)
-		return 1;
-
-	req1 = (struct cn_notify_req *)m1->data;
-	req2 = (struct cn_notify_req *)m2->data;
-
-	for (i = 0; i < m1->idx_notify_num; ++i) {
-		if (req1->first != req2->first || req1->range != req2->range)
-			return 0;
-		req1++;
-		req2++;
-	}
-
-	for (i = 0; i < m1->val_notify_num; ++i) {
-		if (req1->first != req2->first || req1->range != req2->range)
-			return 0;
-		req1++;
-		req2++;
-	}
-
-	return 1;
-}
-
-/*
- * Main connector device's callback.
- *
- * Used for notification of a request's processing.
- */
-static void cn_callback(void *data)
-{
-	struct cn_msg *msg = data;
-	struct cn_ctl_msg *ctl;
-	struct cn_ctl_entry *ent;
-	u32 size;
-
-	if (msg->len < sizeof(*ctl))
-		return;
-
-	ctl = (struct cn_ctl_msg *)msg->data;
-
-	size = (sizeof(*ctl) + ((ctl->idx_notify_num +
-				 ctl->val_notify_num) *
-				sizeof(struct cn_notify_req)));
-
-	if (msg->len != size)
-		return;
-
-	if (ctl->len + sizeof(*ctl) != msg->len)
-		return;
-
-	/*
-	 * Remove notification.
-	 */
-	if (ctl->group == 0) {
-		struct cn_ctl_entry *n;
-
-		mutex_lock(&notify_lock);
-		list_for_each_entry_safe(ent, n, &notify_list, notify_entry) {
-			if (cn_ctl_msg_equals(ent->msg, ctl)) {
-				list_del(&ent->notify_entry);
-				kfree(ent);
-			}
-		}
-		mutex_unlock(&notify_lock);
-
-		return;
-	}
-
-	size += sizeof(*ent);
-
-	ent = kzalloc(size, GFP_KERNEL);
-	if (!ent)
-		return;
-
-	ent->msg = (struct cn_ctl_msg *)(ent + 1);
-
-	memcpy(ent->msg, ctl, size - sizeof(*ent));
-
-	mutex_lock(&notify_lock);
-	list_add(&ent->notify_entry, &notify_list);
-	mutex_unlock(&notify_lock);
-}
-
 static int cn_proc_show(struct seq_file *m, void *v)
 {
 	struct cn_queue_dev *dev = cdev.cbdev;
@@ -443,11 +274,8 @@
 static int __devinit cn_init(void)
 {
 	struct cn_dev *dev = &cdev;
-	int err;
 
 	dev->input = cn_rx_skb;
-	dev->id.idx = cn_idx;
-	dev->id.val = cn_val;
 
 	dev->nls = netlink_kernel_create(&init_net, NETLINK_CONNECTOR,
 					 CN_NETLINK_USERS + 0xf,
@@ -463,14 +291,6 @@
 
 	cn_already_initialized = 1;
 
-	err = cn_add_callback(&dev->id, "connector", &cn_callback);
-	if (err) {
-		cn_already_initialized = 0;
-		cn_queue_free_dev(dev->cbdev);
-		netlink_kernel_release(dev->nls);
-		return -EINVAL;
-	}
-
 	proc_net_fops_create(&init_net, "connector", S_IRUGO, &cn_file_ops);
 
 	return 0;
@@ -484,7 +304,6 @@
 
 	proc_net_remove(&init_net, "connector");
 
-	cn_del_callback(&dev->id);
 	cn_queue_free_dev(dev->cbdev);
 	netlink_kernel_release(dev->nls);
 }
--- linux-rt-2.6.31.orig/drivers/staging/pohmelfs/config.c
+++ linux-rt-2.6.31/drivers/staging/pohmelfs/config.c
@@ -446,11 +446,13 @@
 	return err;
 }
 
-static void pohmelfs_cn_callback(void *data)
+static void pohmelfs_cn_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp)
 {
-	struct cn_msg *msg = data;
 	int err;
 
+	if (!cap_raised(nsp->eff_cap, CAP_SYS_ADMIN))
+		return;
+
 	switch (msg->flags) {
 		case POHMELFS_FLAGS_ADD:
 		case POHMELFS_FLAGS_DEL:
--- linux-rt-2.6.31.orig/drivers/staging/dst/dcore.c
+++ linux-rt-2.6.31/drivers/staging/dst/dcore.c
@@ -846,15 +846,19 @@
 /*
  * Configuration parser.
  */
-static void cn_dst_callback(void *data)
+static void cn_dst_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp)
 {
 	struct dst_ctl *ctl;
-	struct cn_msg *msg = data;
 	int err;
 	struct dst_ctl_ack ack;
 	struct dst_node *n = NULL, *tmp;
 	unsigned int hash;
 
+	if (!cap_raised(nsp->eff_cap, CAP_SYS_ADMIN)) {
+		err = -EPERM;
+		goto out;
+	}
+
 	if (msg->len < sizeof(struct dst_ctl)) {
 		err = -EBADMSG;
 		goto out;
--- linux-rt-2.6.31.orig/drivers/staging/rt2860/common/cmm_data_2860.c
+++ linux-rt-2.6.31/drivers/staging/rt2860/common/cmm_data_2860.c
@@ -363,6 +363,8 @@
 	ULONG			SwIdx = pAd->MgmtRing.TxCpuIdx;
 
 	pTxD  = (PTXD_STRUC) pAd->MgmtRing.Cell[SwIdx].AllocVa;
+	if (!pTxD)
+		return 0;
 
 	pAd->MgmtRing.Cell[SwIdx].pNdisPacket = pPacket;
 	pAd->MgmtRing.Cell[SwIdx].pNextNdisPacket = NULL;
--- linux-rt-2.6.31.orig/drivers/staging/rt2870/rt2870.h
+++ linux-rt-2.6.31/drivers/staging/rt2870/rt2870.h
@@ -142,6 +142,7 @@
 	{USB_DEVICE(0x0789,0x0163)}, /* Logitec */		\
 	{USB_DEVICE(0x0789,0x0164)}, /* Logitec */		\
 	{USB_DEVICE(0x7392,0x7717)}, /* Edimax */		\
+	{USB_DEVICE(0x1737,0x0071)}, /* Linksys */		\
 	{ }/* Terminating entry */                      \
 }
 #endif
--- linux-rt-2.6.31.orig/drivers/bluetooth/bt3c_cs.c
+++ linux-rt-2.6.31/drivers/bluetooth/bt3c_cs.c
@@ -345,7 +345,10 @@
 	int iir;
 	irqreturn_t r = IRQ_NONE;
 
-	BUG_ON(!info->hdev);
+	if (!info || !info->hdev) {
+		BT_ERR("Call of irq %d for unknown device", irq);
+		return IRQ_NONE;
+	}
 
 	iobase = info->p_dev->io.BasePort1;
 
--- linux-rt-2.6.31.orig/drivers/bluetooth/btuart_cs.c
+++ linux-rt-2.6.31/drivers/bluetooth/btuart_cs.c
@@ -295,7 +295,10 @@
 	int iir, lsr;
 	irqreturn_t r = IRQ_NONE;
 
-	BUG_ON(!info->hdev);
+	if (!info || !info->hdev) {
+		BT_ERR("Call of irq %d for unknown device", irq);
+		return IRQ_NONE;
+	}
 
 	iobase = info->p_dev->io.BasePort1;
 
--- linux-rt-2.6.31.orig/drivers/bluetooth/dtl1_cs.c
+++ linux-rt-2.6.31/drivers/bluetooth/dtl1_cs.c
@@ -299,7 +299,10 @@
 	int iir, lsr;
 	irqreturn_t r = IRQ_NONE;
 
-	BUG_ON(!info->hdev);
+	if (!info || !info->hdev) {
+		BT_ERR("Call of irq %d for unknown device", irq);
+		return IRQ_NONE;
+	}
 
 	iobase = info->p_dev->io.BasePort1;
 
--- linux-rt-2.6.31.orig/drivers/bluetooth/bluecard_cs.c
+++ linux-rt-2.6.31/drivers/bluetooth/bluecard_cs.c
@@ -503,7 +503,10 @@
 	unsigned int iobase;
 	unsigned char reg;
 
-	BUG_ON(!info->hdev);
+	if (!info || !info->hdev) {
+		BT_ERR("Call of irq %d for unknown device", irq);
+		return IRQ_NONE;
+	}
 
 	if (!test_bit(CARD_READY, &(info->hw_state)))
 		return IRQ_HANDLED;
--- linux-rt-2.6.31.orig/drivers/firewire/ohci.c
+++ linux-rt-2.6.31/drivers/firewire/ohci.c
@@ -2180,6 +2180,13 @@
 	page     = payload >> PAGE_SHIFT;
 	offset   = payload & ~PAGE_MASK;
 	rest     = p->payload_length;
+	/*
+	 * The controllers I've tested have not worked correctly when
+	 * second_req_count is zero.  Rather than do something we know won't
+	 * work, return an error
+	 */
+	if (rest == 0)
+		return -EINVAL;
 
 	/* FIXME: make packet-per-buffer/dual-buffer a context option */
 	while (rest > 0) {
@@ -2233,7 +2240,7 @@
 					unsigned long payload)
 {
 	struct iso_context *ctx = container_of(base, struct iso_context, base);
-	struct descriptor *d = NULL, *pd = NULL;
+	struct descriptor *d, *pd;
 	struct fw_iso_packet *p = packet;
 	dma_addr_t d_bus, page_bus;
 	u32 z, header_z, rest;
@@ -2271,8 +2278,9 @@
 		d->data_address = cpu_to_le32(d_bus + (z * sizeof(*d)));
 
 		rest = payload_per_buffer;
+		pd = d;
 		for (j = 1; j < z; j++) {
-			pd = d + j;
+			pd++;
 			pd->control = cpu_to_le16(DESCRIPTOR_STATUS |
 						  DESCRIPTOR_INPUT_MORE);
 
--- linux-rt-2.6.31.orig/drivers/ata/pata_amd.c
+++ linux-rt-2.6.31/drivers/ata/pata_amd.c
@@ -307,6 +307,9 @@
 		limit |= ATA_MASK_PIO;
 	if (!(limit & (ATA_MASK_MWDMA | ATA_MASK_UDMA)))
 		limit |= ATA_MASK_MWDMA | ATA_MASK_UDMA;
+	/* PIO4, MWDMA2, UDMA2 should always be supported regardless of
+	   cable detection result */
+	limit |= ata_pack_xfermask(ATA_PIO4, ATA_MWDMA2, ATA_UDMA2);
 
 	ata_port_printk(ap, KERN_DEBUG, "nv_mode_filter: 0x%lx&0x%lx->0x%lx, "
 			"BIOS=0x%lx (0x%x) ACPI=0x%lx%s\n",
--- linux-rt-2.6.31.orig/drivers/ata/pata_cmd64x.c
+++ linux-rt-2.6.31/drivers/ata/pata_cmd64x.c
@@ -219,7 +219,7 @@
 		regU |= udma_data[adev->dma_mode - XFER_UDMA_0] << shift;
 		/* Merge the control bits */
 		regU |= 1 << adev->devno; /* UDMA on */
-		if (adev->dma_mode > 2)	/* 15nS timing */
+		if (adev->dma_mode > XFER_UDMA_2) /* 15nS timing */
 			regU |= 4 << adev->devno;
 	} else {
 		regU &= ~ (1 << adev->devno);	/* UDMA off */
--- linux-rt-2.6.31.orig/drivers/ata/libata-eh.c
+++ linux-rt-2.6.31/drivers/ata/libata-eh.c
@@ -2541,14 +2541,14 @@
 		dev->pio_mode = XFER_PIO_0;
 		dev->flags &= ~ATA_DFLAG_SLEEPING;
 
-		if (!ata_phys_link_offline(ata_dev_phys_link(dev))) {
-			/* apply class override */
-			if (lflags & ATA_LFLAG_ASSUME_ATA)
-				classes[dev->devno] = ATA_DEV_ATA;
-			else if (lflags & ATA_LFLAG_ASSUME_SEMB)
-				classes[dev->devno] = ATA_DEV_SEMB_UNSUP;
-		} else
-			classes[dev->devno] = ATA_DEV_NONE;
+		if (ata_phys_link_offline(ata_dev_phys_link(dev)))
+			continue;
+
+		/* apply class override */
+		if (lflags & ATA_LFLAG_ASSUME_ATA)
+			classes[dev->devno] = ATA_DEV_ATA;
+		else if (lflags & ATA_LFLAG_ASSUME_SEMB)
+			classes[dev->devno] = ATA_DEV_SEMB_UNSUP;
 	}
 
 	/* record current link speed */
@@ -2581,34 +2581,48 @@
 		slave->eh_info.serror = 0;
 	spin_unlock_irqrestore(link->ap->lock, flags);
 
-	/* Make sure onlineness and classification result correspond.
+	/*
+	 * Make sure onlineness and classification result correspond.
 	 * Hotplug could have happened during reset and some
 	 * controllers fail to wait while a drive is spinning up after
 	 * being hotplugged causing misdetection.  By cross checking
-	 * link onlineness and classification result, those conditions
-	 * can be reliably detected and retried.
+	 * link on/offlineness and classification result, those
+	 * conditions can be reliably detected and retried.
 	 */
 	nr_unknown = 0;
 	ata_for_each_dev(dev, link, ALL) {
-		/* convert all ATA_DEV_UNKNOWN to ATA_DEV_NONE */
-		if (classes[dev->devno] == ATA_DEV_UNKNOWN) {
-			classes[dev->devno] = ATA_DEV_NONE;
-			if (ata_phys_link_online(ata_dev_phys_link(dev)))
+		if (ata_phys_link_online(ata_dev_phys_link(dev))) {
+			if (classes[dev->devno] == ATA_DEV_UNKNOWN) {
+				ata_dev_printk(dev, KERN_DEBUG, "link online "
+					       "but device misclassifed\n");
+				classes[dev->devno] = ATA_DEV_NONE;
 				nr_unknown++;
+			}
+		} else if (ata_phys_link_offline(ata_dev_phys_link(dev))) {
+			if (ata_class_enabled(classes[dev->devno]))
+				ata_dev_printk(dev, KERN_DEBUG, "link offline, "
+					       "clearing class %d to NONE\n",
+					       classes[dev->devno]);
+			classes[dev->devno] = ATA_DEV_NONE;
+		} else if (classes[dev->devno] == ATA_DEV_UNKNOWN) {
+			ata_dev_printk(dev, KERN_DEBUG, "link status unknown, "
+				       "clearing UNKNOWN to NONE\n");
+			classes[dev->devno] = ATA_DEV_NONE;
 		}
 	}
 
 	if (classify && nr_unknown) {
 		if (try < max_tries) {
 			ata_link_printk(link, KERN_WARNING, "link online but "
-				       "device misclassified, retrying\n");
+					"%d devices misclassified, retrying\n",
+					nr_unknown);
 			failed_link = link;
 			rc = -EAGAIN;
 			goto fail;
 		}
 		ata_link_printk(link, KERN_WARNING,
-			       "link online but device misclassified, "
-			       "device detection might fail\n");
+				"link online but %d devices misclassified, "
+				"device detection might fail\n", nr_unknown);
 	}
 
 	/* reset successful, schedule revalidation */
@@ -2835,12 +2849,14 @@
 	 * device detection messages backwards.
 	 */
 	ata_for_each_dev(dev, link, ALL) {
-		if (!(new_mask & (1 << dev->devno)) ||
-		    dev->class == ATA_DEV_PMP)
+		if (!(new_mask & (1 << dev->devno)))
 			continue;
 
 		dev->class = ehc->classes[dev->devno];
 
+		if (dev->class == ATA_DEV_PMP)
+			continue;
+
 		ehc->i.flags |= ATA_EHI_PRINTINFO;
 		rc = ata_dev_configure(dev);
 		ehc->i.flags &= ~ATA_EHI_PRINTINFO;
--- linux-rt-2.6.31.orig/drivers/ata/ahci.c
+++ linux-rt-2.6.31/drivers/ata/ahci.c
@@ -433,7 +433,8 @@
 	[board_ahci_sb600] =
 	{
 		AHCI_HFLAGS	(AHCI_HFLAG_IGN_SERR_INTERNAL |
-				 AHCI_HFLAG_NO_MSI | AHCI_HFLAG_SECT255),
+				 AHCI_HFLAG_32BIT_ONLY | AHCI_HFLAG_NO_MSI |
+				 AHCI_HFLAG_SECT255),
 		.flags		= AHCI_FLAG_COMMON,
 		.pio_mask	= ATA_PIO4,
 		.udma_mask	= ATA_UDMA6,
@@ -2602,51 +2603,6 @@
 	}
 }
 
-/*
- * SB600 ahci controller on ASUS M2A-VM can't do 64bit DMA with older
- * BIOS.  The oldest version known to be broken is 0901 and working is
- * 1501 which was released on 2007-10-26.  Force 32bit DMA on anything
- * older than 1501.  Please read bko#9412 for more info.
- */
-static bool ahci_asus_m2a_vm_32bit_only(struct pci_dev *pdev)
-{
-	static const struct dmi_system_id sysids[] = {
-		{
-			.ident = "ASUS M2A-VM",
-			.matches = {
-				DMI_MATCH(DMI_BOARD_VENDOR,
-					  "ASUSTeK Computer INC."),
-				DMI_MATCH(DMI_BOARD_NAME, "M2A-VM"),
-			},
-		},
-		{ }
-	};
-	const char *cutoff_mmdd = "10/26";
-	const char *date;
-	int year;
-
-	if (pdev->bus->number != 0 || pdev->devfn != PCI_DEVFN(0x12, 0) ||
-	    !dmi_check_system(sysids))
-		return false;
-
-	/*
-	 * Argh.... both version and date are free form strings.
-	 * Let's hope they're using the same date format across
-	 * different versions.
-	 */
-	date = dmi_get_system_info(DMI_BIOS_DATE);
-	year = dmi_get_year(DMI_BIOS_DATE);
-	if (date && strlen(date) >= 10 && date[2] == '/' && date[5] == '/' &&
-	    (year > 2007 ||
-	     (year == 2007 && strncmp(date, cutoff_mmdd, 5) >= 0)))
-		return false;
-
-	dev_printk(KERN_WARNING, &pdev->dev, "ASUS M2A-VM: BIOS too old, "
-		   "forcing 32bit DMA, update BIOS\n");
-
-	return true;
-}
-
 static bool ahci_broken_system_poweroff(struct pci_dev *pdev)
 {
 	static const struct dmi_system_id broken_systems[] = {
@@ -2857,12 +2813,8 @@
 	if (board_id == board_ahci_sb700 && pdev->revision >= 0x40)
 		hpriv->flags &= ~AHCI_HFLAG_IGN_SERR_INTERNAL;
 
-	/* apply ASUS M2A_VM quirk */
-	if (ahci_asus_m2a_vm_32bit_only(pdev))
-		hpriv->flags |= AHCI_HFLAG_32BIT_ONLY;
-
-	if (!(hpriv->flags & AHCI_HFLAG_NO_MSI))
-		pci_enable_msi(pdev);
+	if ((hpriv->flags & AHCI_HFLAG_NO_MSI) || pci_enable_msi(pdev))
+		pci_intx(pdev, 1);
 
 	/* save initial config */
 	ahci_save_initial_config(pdev, hpriv);
--- linux-rt-2.6.31.orig/drivers/ata/sata_nv.c
+++ linux-rt-2.6.31/drivers/ata/sata_nv.c
@@ -1594,9 +1594,21 @@
 	    !ata_dev_enabled(link->device))
 		sata_link_hardreset(link, sata_deb_timing_hotplug, deadline,
 				    NULL, NULL);
-	else if (!(ehc->i.flags & ATA_EHI_QUIET))
-		ata_link_printk(link, KERN_INFO,
-				"nv: skipping hardreset on occupied port\n");
+	else {
+		const unsigned long *timing = sata_ehc_deb_timing(ehc);
+		int rc;
+
+		if (!(ehc->i.flags & ATA_EHI_QUIET))
+			ata_link_printk(link, KERN_INFO, "nv: skipping "
+					"hardreset on occupied port\n");
+
+		/* make sure the link is online */
+		rc = sata_link_resume(link, timing, deadline);
+		/* whine about phy resume failure but proceed */
+		if (rc && rc != -EOPNOTSUPP)
+			ata_link_printk(link, KERN_WARNING, "failed to resume "
+					"link (errno=%d)\n", rc);
+	}
 
 	/* device signature acquisition is unreliable */
 	return -EAGAIN;
--- linux-rt-2.6.31.orig/drivers/ata/pata_hpt3x2n.c
+++ linux-rt-2.6.31/drivers/ata/pata_hpt3x2n.c
@@ -8,7 +8,7 @@
  * Copyright (C) 1999-2003		Andre Hedrick <andre@linux-ide.org>
  * Portions Copyright (C) 2001	        Sun Microsystems, Inc.
  * Portions Copyright (C) 2003		Red Hat Inc
- * Portions Copyright (C) 2005-2007	MontaVista Software, Inc.
+ * Portions Copyright (C) 2005-2009	MontaVista Software, Inc.
  *
  *
  * TODO
@@ -25,7 +25,7 @@
 #include <linux/libata.h>
 
 #define DRV_NAME	"pata_hpt3x2n"
-#define DRV_VERSION	"0.3.4"
+#define DRV_VERSION	"0.3.8"
 
 enum {
 	HPT_PCI_FAST	=	(1 << 31),
@@ -185,9 +185,8 @@
 
 	pci_read_config_dword(pdev, addr1, &reg);
 	mode = hpt3x2n_find_mode(ap, adev->pio_mode);
-	mode &= ~0x8000000;	/* No FIFO in PIO */
-	mode &= ~0x30070000;	/* Leave config bits alone */
-	reg &= 0x30070000;	/* Strip timing bits */
+	mode &= 0xCFC3FFFF;	/* Leave DMA bits alone */
+	reg &= ~0xCFC3FFFF;	/* Strip timing bits */
 	pci_write_config_dword(pdev, addr1, reg | mode);
 }
 
@@ -204,8 +203,7 @@
 {
 	struct pci_dev *pdev = to_pci_dev(ap->host->dev);
 	u32 addr1, addr2;
-	u32 reg;
-	u32 mode;
+	u32 reg, mode, mask;
 	u8 fast;
 
 	addr1 = 0x40 + 4 * (adev->devno + 2 * ap->port_no);
@@ -216,11 +214,12 @@
 	fast &= ~0x07;
 	pci_write_config_byte(pdev, addr2, fast);
 
+	mask = adev->dma_mode < XFER_UDMA_0 ? 0x31C001FF : 0x303C0000;
+
 	pci_read_config_dword(pdev, addr1, &reg);
 	mode = hpt3x2n_find_mode(ap, adev->dma_mode);
-	mode |= 0x8000000;	/* FIFO in MWDMA or UDMA */
-	mode &= ~0xC0000000;	/* Leave config bits alone */
-	reg &= 0xC0000000;	/* Strip timing bits */
+	mode &= mask;
+	reg &= ~mask;
 	pci_write_config_dword(pdev, addr1, reg | mode);
 }
 
@@ -263,7 +262,7 @@
 
 static void hpt3x2n_set_clock(struct ata_port *ap, int source)
 {
-	void __iomem *bmdma = ap->ioaddr.bmdma_addr;
+	void __iomem *bmdma = ap->ioaddr.bmdma_addr - ap->port_no * 8;
 
 	/* Tristate the bus */
 	iowrite8(0x80, bmdma+0x73);
@@ -273,9 +272,9 @@
 	iowrite8(source, bmdma+0x7B);
 	iowrite8(0xC0, bmdma+0x79);
 
-	/* Reset state machines */
-	iowrite8(0x37, bmdma+0x70);
-	iowrite8(0x37, bmdma+0x74);
+	/* Reset state machines, avoid enabling the disabled channels */
+	iowrite8(ioread8(bmdma+0x70) | 0x32, bmdma+0x70);
+	iowrite8(ioread8(bmdma+0x74) | 0x32, bmdma+0x74);
 
 	/* Complete reset */
 	iowrite8(0x00, bmdma+0x79);
@@ -285,21 +284,10 @@
 	iowrite8(0x00, bmdma+0x77);
 }
 
-/* Check if our partner interface is busy */
-
-static int hpt3x2n_pair_idle(struct ata_port *ap)
-{
-	struct ata_host *host = ap->host;
-	struct ata_port *pair = host->ports[ap->port_no ^ 1];
-
-	if (pair->hsm_task_state == HSM_ST_IDLE)
-		return 1;
-	return 0;
-}
-
 static int hpt3x2n_use_dpll(struct ata_port *ap, int writing)
 {
 	long flags = (long)ap->host->private_data;
+
 	/* See if we should use the DPLL */
 	if (writing)
 		return USE_DPLL;	/* Needed for write */
@@ -308,20 +296,35 @@
 	return 0;
 }
 
+static int hpt3x2n_qc_defer(struct ata_queued_cmd *qc)
+{
+	struct ata_port *ap = qc->ap;
+	struct ata_port *alt = ap->host->ports[ap->port_no ^ 1];
+	int rc, flags = (long)ap->host->private_data;
+	int dpll = hpt3x2n_use_dpll(ap, qc->tf.flags & ATA_TFLAG_WRITE);
+
+	/* First apply the usual rules */
+	rc = ata_std_qc_defer(qc);
+	if (rc != 0)
+		return rc;
+
+	if ((flags & USE_DPLL) != dpll && alt->qc_active)
+		return ATA_DEFER_PORT;
+	return 0;
+}
+
 static unsigned int hpt3x2n_qc_issue(struct ata_queued_cmd *qc)
 {
-	struct ata_taskfile *tf = &qc->tf;
 	struct ata_port *ap = qc->ap;
 	int flags = (long)ap->host->private_data;
+	int dpll = hpt3x2n_use_dpll(ap, qc->tf.flags & ATA_TFLAG_WRITE);
 
-	if (hpt3x2n_pair_idle(ap)) {
-		int dpll = hpt3x2n_use_dpll(ap, (tf->flags & ATA_TFLAG_WRITE));
-		if ((flags & USE_DPLL) != dpll) {
-			if (dpll == 1)
-				hpt3x2n_set_clock(ap, 0x21);
-			else
-				hpt3x2n_set_clock(ap, 0x23);
-		}
+	if ((flags & USE_DPLL) != dpll) {
+		flags &= ~USE_DPLL;
+		flags |= dpll;
+		ap->host->private_data = (void *)(long)flags;
+
+		hpt3x2n_set_clock(ap, dpll ? 0x21 : 0x23);
 	}
 	return ata_sff_qc_issue(qc);
 }
@@ -338,6 +341,8 @@
 	.inherits	= &ata_bmdma_port_ops,
 
 	.bmdma_stop	= hpt3x2n_bmdma_stop,
+
+	.qc_defer	= hpt3x2n_qc_defer,
 	.qc_issue	= hpt3x2n_qc_issue,
 
 	.cable_detect	= hpt3x2n_cable_detect,
@@ -455,7 +460,7 @@
 	unsigned int f_low, f_high;
 	int adjust;
 	unsigned long iobase = pci_resource_start(dev, 4);
-	void *hpriv = NULL;
+	void *hpriv = (void *)USE_DPLL;
 	int rc;
 
 	rc = pcim_enable_device(dev);
@@ -543,7 +548,7 @@
 	/* Set our private data up. We only need a few flags so we use
 	   it directly */
 	if (pci_mhz > 60) {
-		hpriv = (void *)PCI66;
+		hpriv = (void *)(PCI66 | USE_DPLL);
 		/*
 		 * On  HPT371N, if ATA clock is 66 MHz we must set bit 2 in
 		 * the MISC. register to stretch the UltraDMA Tss timing.
--- linux-rt-2.6.31.orig/drivers/ata/pata_sc1200.c
+++ linux-rt-2.6.31/drivers/ata/pata_sc1200.c
@@ -235,8 +235,7 @@
 		.udma_mask = ATA_UDMA2,
 		.port_ops = &sc1200_port_ops
 	};
-	/* Can't enable port 2 yet, see top comments */
-	const struct ata_port_info *ppi[] = { &info, };
+	const struct ata_port_info *ppi[] = { &info, NULL };
 
 	return ata_pci_sff_init_one(dev, ppi, &sc1200_sht, NULL);
 }
--- linux-rt-2.6.31.orig/drivers/ata/libata-core.c
+++ linux-rt-2.6.31/drivers/ata/libata-core.c
@@ -139,7 +139,7 @@
 module_param_named(fua, libata_fua, int, 0444);
 MODULE_PARM_DESC(fua, "FUA support (0=off [default], 1=on)");
 
-static int ata_ignore_hpa;
+static int ata_ignore_hpa = 1;
 module_param_named(ignore_hpa, ata_ignore_hpa, int, 0644);
 MODULE_PARM_DESC(ignore_hpa, "Ignore HPA limit (0=keep BIOS limits, 1=ignore limits, using full disk)");
 
@@ -709,7 +709,13 @@
 		head = tf->device & 0xf;
 		sect = tf->lbal;
 
-		block = (cyl * dev->heads + head) * dev->sectors + sect;
+		if (!sect) {
+			ata_dev_printk(dev, KERN_WARNING, "device reported "
+				       "invalid CHS sector 0\n");
+			sect = 1; /* oh well */
+		}
+
+		block = (cyl * dev->heads + head) * dev->sectors + sect - 1;
 	}
 
 	return block;
@@ -4295,6 +4301,7 @@
 	{ "HTS541060G9SA00",    "MB3OC60D",     ATA_HORKAGE_NONCQ, },
 	{ "HTS541080G9SA00",    "MB4OC60D",     ATA_HORKAGE_NONCQ, },
 	{ "HTS541010G9SA00",    "MBZOC60D",     ATA_HORKAGE_NONCQ, },
+	{ "FUJITSU MHW2160BH PL", "0084001E",   ATA_HORKAGE_NONCQ, },
 
 	/* devices which puke on READ_NATIVE_MAX */
 	{ "HDS724040KLSA80",	"KFAOA20N",	ATA_HORKAGE_BROKEN_HPA, },
@@ -5002,12 +5009,14 @@
 			qc->flags |= ATA_QCFLAG_FAILED;
 
 		if (unlikely(qc->flags & ATA_QCFLAG_FAILED)) {
-			if (!ata_tag_internal(qc->tag)) {
-				/* always fill result TF for failed qc */
-				fill_result_tf(qc);
+			/* always fill result TF for failed qc */
+			fill_result_tf(qc);
+
+			if (!ata_tag_internal(qc->tag))
 				ata_qc_schedule_eh(qc);
-				return;
-			}
+			else
+				__ata_qc_complete(qc);
+			return;
 		}
 
 		/* read result TF if requested */
--- linux-rt-2.6.31.orig/drivers/ata/sata_via.c
+++ linux-rt-2.6.31/drivers/ata/sata_via.c
@@ -93,7 +93,6 @@
 	{ PCI_VDEVICE(VIA, 0x7372), vt6420 },
 	{ PCI_VDEVICE(VIA, 0x5287), vt8251 }, /* 2 sata chnls (Master/Slave) */
 	{ PCI_VDEVICE(VIA, 0x9000), vt8251 },
-	{ PCI_VDEVICE(VIA, 0x9040), vt8251 },
 
 	{ }	/* terminate list */
 };
--- linux-rt-2.6.31.orig/drivers/ata/pata_hpt37x.c
+++ linux-rt-2.6.31/drivers/ata/pata_hpt37x.c
@@ -24,7 +24,7 @@
 #include <linux/libata.h>
 
 #define DRV_NAME	"pata_hpt37x"
-#define DRV_VERSION	"0.6.12"
+#define DRV_VERSION	"0.6.14"
 
 struct hpt_clock {
 	u8	xfer_speed;
@@ -404,9 +404,8 @@
 
 	pci_read_config_dword(pdev, addr1, &reg);
 	mode = hpt37x_find_mode(ap, adev->pio_mode);
-	mode &= ~0x8000000;	/* No FIFO in PIO */
-	mode &= ~0x30070000;	/* Leave config bits alone */
-	reg &= 0x30070000;	/* Strip timing bits */
+	mode &= 0xCFC3FFFF;	/* Leave DMA bits alone */
+	reg &= ~0xCFC3FFFF;	/* Strip timing bits */
 	pci_write_config_dword(pdev, addr1, reg | mode);
 }
 
@@ -423,8 +422,7 @@
 {
 	struct pci_dev *pdev = to_pci_dev(ap->host->dev);
 	u32 addr1, addr2;
-	u32 reg;
-	u32 mode;
+	u32 reg, mode, mask;
 	u8 fast;
 
 	addr1 = 0x40 + 4 * (adev->devno + 2 * ap->port_no);
@@ -436,11 +434,12 @@
 	fast |= 0x01;
 	pci_write_config_byte(pdev, addr2, fast);
 
+	mask = adev->dma_mode < XFER_UDMA_0 ? 0x31C001FF : 0x303C0000;
+
 	pci_read_config_dword(pdev, addr1, &reg);
 	mode = hpt37x_find_mode(ap, adev->dma_mode);
-	mode |= 0x8000000;	/* FIFO in MWDMA or UDMA */
-	mode &= ~0xC0000000;	/* Leave config bits alone */
-	reg &= 0xC0000000;	/* Strip timing bits */
+	mode &= mask;
+	reg &= ~mask;
 	pci_write_config_dword(pdev, addr1, reg | mode);
 }
 
@@ -508,9 +507,8 @@
 	mode = hpt37x_find_mode(ap, adev->pio_mode);
 
 	printk("Find mode for %d reports %X\n", adev->pio_mode, mode);
-	mode &= ~0x80000000;	/* No FIFO in PIO */
-	mode &= ~0x30070000;	/* Leave config bits alone */
-	reg &= 0x30070000;	/* Strip timing bits */
+	mode &= 0xCFC3FFFF;	/* Leave DMA bits alone */
+	reg &= ~0xCFC3FFFF;	/* Strip timing bits */
 	pci_write_config_dword(pdev, addr1, reg | mode);
 }
 
@@ -527,8 +525,7 @@
 {
 	struct pci_dev *pdev = to_pci_dev(ap->host->dev);
 	u32 addr1, addr2;
-	u32 reg;
-	u32 mode;
+	u32 reg, mode, mask;
 	u8 fast;
 
 	addr1 = 0x40 + 4 * (adev->devno + 2 * ap->port_no);
@@ -539,12 +536,13 @@
 	fast &= ~0x07;
 	pci_write_config_byte(pdev, addr2, fast);
 
+	mask = adev->dma_mode < XFER_UDMA_0 ? 0x31C001FF : 0x303C0000;
+
 	pci_read_config_dword(pdev, addr1, &reg);
 	mode = hpt37x_find_mode(ap, adev->dma_mode);
 	printk("Find mode for DMA %d reports %X\n", adev->dma_mode, mode);
-	mode &= ~0xC0000000;	/* Leave config bits alone */
-	mode |= 0x80000000;	/* FIFO in MWDMA or UDMA */
-	reg &= 0xC0000000;	/* Strip timing bits */
+	mode &= mask;
+	reg &= ~mask;
 	pci_write_config_dword(pdev, addr1, reg | mode);
 }
 
--- linux-rt-2.6.31.orig/drivers/ata/pata_via.c
+++ linux-rt-2.6.31/drivers/ata/pata_via.c
@@ -111,7 +111,7 @@
 	{ "vt8251",	PCI_DEVICE_ID_VIA_8251,     0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST },
 	{ "cx700",	PCI_DEVICE_ID_VIA_CX700,    0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST | VIA_SATA_PATA },
 	{ "vt6410",	PCI_DEVICE_ID_VIA_6410,     0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST | VIA_NO_ENABLES },
-	{ "vt6415",	PCI_DEVICE_ID_VIA_6415,     0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST | VIA_NO_ENABLES },
+	{ "vt6415",	PCI_DEVICE_ID_VIA_6415,     0x00, 0xff, VIA_UDMA_133 | VIA_BAD_AST | VIA_NO_ENABLES },
 	{ "vt8237a",	PCI_DEVICE_ID_VIA_8237A,    0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST },
 	{ "vt8237",	PCI_DEVICE_ID_VIA_8237,     0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST },
 	{ "vt8235",	PCI_DEVICE_ID_VIA_8235,     0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST },
--- linux-rt-2.6.31.orig/drivers/scsi/scsi_error.c
+++ linux-rt-2.6.31/drivers/scsi/scsi_error.c
@@ -721,6 +721,9 @@
 		case NEEDS_RETRY:
 		case FAILED:
 			break;
+		case ADD_TO_MLQUEUE:
+			rtn = NEEDS_RETRY;
+			break;
 		default:
 			rtn = FAILED;
 			break;
--- linux-rt-2.6.31.orig/drivers/scsi/scsi.c
+++ linux-rt-2.6.31/drivers/scsi/scsi.c
@@ -241,10 +241,7 @@
  */
 struct scsi_cmnd *__scsi_get_command(struct Scsi_Host *shost, gfp_t gfp_mask)
 {
-	struct scsi_cmnd *cmd;
-	unsigned char *buf;
-
-	cmd = scsi_host_alloc_command(shost, gfp_mask);
+	struct scsi_cmnd *cmd = scsi_host_alloc_command(shost, gfp_mask);
 
 	if (unlikely(!cmd)) {
 		unsigned long flags;
@@ -258,9 +255,15 @@
 		spin_unlock_irqrestore(&shost->free_list_lock, flags);
 
 		if (cmd) {
+			void *buf, *prot;
+
 			buf = cmd->sense_buffer;
+			prot = cmd->prot_sdb;
+
 			memset(cmd, 0, sizeof(*cmd));
+
 			cmd->sense_buffer = buf;
+			cmd->prot_sdb = prot;
 		}
 	}
 
--- linux-rt-2.6.31.orig/drivers/scsi/scsi_transport_fc.c
+++ linux-rt-2.6.31/drivers/scsi/scsi_transport_fc.c
@@ -473,10 +473,30 @@
 MODULE_PARM_DESC(dev_loss_tmo,
 		 "Maximum number of seconds that the FC transport should"
 		 " insulate the loss of a remote port. Once this value is"
-		 " exceeded, the scsi target is removed. Value should be"
+		 " exceeded, the scsi target may be removed. Reference the"
+		 " remove_on_dev_loss module parameter. Value should be"
 		 " between 1 and SCSI_DEVICE_BLOCK_MAX_TIMEOUT.");
 
 /*
+ * remove_on_dev_loss: controls whether the transport will
+ *   remove a scsi target after the device loss timer expires.
+ *   Removal on disconnect is modeled after the USB subsystem
+ *   and expects subsystems layered on SCSI to be aware of
+ *   potential device loss and handle it appropriately. However,
+ *   many subsystems do not support device removal, leaving situations
+ *   where structure references may remain, causing new device
+ *   name assignments, etc., if the target returns.
+ */
+static unsigned int fc_remove_on_dev_loss = 0;
+module_param_named(remove_on_dev_loss, fc_remove_on_dev_loss,
+		   int, S_IRUGO|S_IWUSR);
+MODULE_PARM_DESC(remove_on_dev_loss,
+		"Boolean.  When the device loss timer fires, this variable"
+		" controls whether the scsi infrastructure for the target"
+		" device is removed.  Values: zero means do not remove,"
+		" non-zero means remove.  Default is zero.");
+
+/**
  * Netlink Infrastructure
  */
 
@@ -648,11 +668,22 @@
 		return error;
 	error = transport_class_register(&fc_vport_class);
 	if (error)
-		return error;
+		goto unreg_host_class;
 	error = transport_class_register(&fc_rport_class);
 	if (error)
-		return error;
-	return transport_class_register(&fc_transport_class);
+		goto unreg_vport_class;
+	error = transport_class_register(&fc_transport_class);
+	if (error)
+		goto unreg_rport_class;
+	return 0;
+
+unreg_rport_class:
+	transport_class_unregister(&fc_rport_class);
+unreg_vport_class:
+	transport_class_unregister(&fc_vport_class);
+unreg_host_class:
+	transport_class_unregister(&fc_host_class);
+	return error;
 }
 
 static void __exit fc_transport_exit(void)
@@ -2367,7 +2398,8 @@
 		container_of(work, struct fc_rport, stgt_delete_work);
 
 	fc_terminate_rport_io(rport);
-	scsi_remove_target(&rport->dev);
+	if (fc_remove_on_dev_loss)
+		scsi_remove_target(&rport->dev);
 }
 
 
@@ -3015,9 +3047,13 @@
 		return;
 	}
 
-	dev_printk(KERN_ERR, &rport->dev,
-		"blocked FC remote port time out: removing target and "
-		"saving binding\n");
+	if (fc_remove_on_dev_loss)
+		dev_printk(KERN_ERR, &rport->dev,
+			"blocked FC remote port time out: removing target and "
+			"saving binding\n");
+	else
+		dev_printk(KERN_ERR, &rport->dev,
+			"blocked FC remote port time out: saving binding\n");
 
 	list_move_tail(&rport->peers, &fc_host->rport_bindings);
 
--- linux-rt-2.6.31.orig/drivers/scsi/dpt_i2o.c
+++ linux-rt-2.6.31/drivers/scsi/dpt_i2o.c
@@ -1918,6 +1918,10 @@
 		}
 		size = size>>16;
 		size *= 4;
+		if (size > MAX_MESSAGE_SIZE) {
+			rcode = -EINVAL;
+			goto cleanup;
+		}
 		/* Copy in the user's I2O command */
 		if (copy_from_user (msg, user_msg, size)) {
 			rcode = -EFAULT;
--- linux-rt-2.6.31.orig/drivers/scsi/libsrp.c
+++ linux-rt-2.6.31/drivers/scsi/libsrp.c
@@ -124,6 +124,7 @@
 		dma_free_coherent(dev, size, ring[i]->buf, ring[i]->dma);
 		kfree(ring[i]);
 	}
+	kfree(ring);
 }
 
 int srp_target_alloc(struct srp_target *target, struct device *dev,
--- linux-rt-2.6.31.orig/drivers/scsi/hosts.c
+++ linux-rt-2.6.31/drivers/scsi/hosts.c
@@ -180,14 +180,20 @@
 EXPORT_SYMBOL(scsi_remove_host);
 
 /**
- * scsi_add_host - add a scsi host
+ * scsi_add_host_with_dma - add a scsi host with dma device
  * @shost:	scsi host pointer to add
  * @dev:	a struct device of type scsi class
+ * @dma_dev:	dma device for the host
+ *
+ * Note: You rarely need to worry about this unless you're in a
+ * virtualised host environments, so use the simpler scsi_add_host()
+ * function instead.
  *
  * Return value: 
  * 	0 on success / != 0 for error
  **/
-int scsi_add_host(struct Scsi_Host *shost, struct device *dev)
+int scsi_add_host_with_dma(struct Scsi_Host *shost, struct device *dev,
+			   struct device *dma_dev)
 {
 	struct scsi_host_template *sht = shost->hostt;
 	int error = -EINVAL;
@@ -207,6 +213,7 @@
 
 	if (!shost->shost_gendev.parent)
 		shost->shost_gendev.parent = dev ? dev : &platform_bus;
+	shost->dma_dev = dma_dev;
 
 	error = device_add(&shost->shost_gendev);
 	if (error)
@@ -262,7 +269,7 @@
  fail:
 	return error;
 }
-EXPORT_SYMBOL(scsi_add_host);
+EXPORT_SYMBOL(scsi_add_host_with_dma);
 
 static void scsi_host_dev_release(struct device *dev)
 {
--- linux-rt-2.6.31.orig/drivers/scsi/sg.c
+++ linux-rt-2.6.31/drivers/scsi/sg.c
@@ -1708,11 +1708,6 @@
 	Sg_scatter_hold *req_schp = &srp->data;
 
 	SCSI_LOG_TIMEOUT(4, printk("sg_finish_rem_req: res_used=%d\n", (int) srp->res_used));
-	if (srp->res_used)
-		sg_unlink_reserve(sfp, srp);
-	else
-		sg_remove_scat(req_schp);
-
 	if (srp->rq) {
 		if (srp->bio)
 			ret = blk_rq_unmap_user(srp->bio);
@@ -1720,6 +1715,11 @@
 		blk_put_request(srp->rq);
 	}
 
+	if (srp->res_used)
+		sg_unlink_reserve(sfp, srp);
+	else
+		sg_remove_scat(req_schp);
+
 	sg_remove_request(sfp, srp);
 
 	return ret;
@@ -1811,7 +1811,7 @@
 	return 0;
 out:
 	for (i = 0; i < k; i++)
-		__free_pages(schp->pages[k], order);
+		__free_pages(schp->pages[i], order);
 
 	if (--order >= 0)
 		goto retry;
--- linux-rt-2.6.31.orig/drivers/scsi/sd.c
+++ linux-rt-2.6.31/drivers/scsi/sd.c
@@ -2021,6 +2021,7 @@
 
 	sd_printk(KERN_NOTICE, sdkp, "Attached SCSI %sdisk\n",
 		  sdp->removable ? "removable " : "");
+	put_device(&sdkp->dev);
 }
 
 /**
@@ -2106,6 +2107,7 @@
 
 	get_device(&sdp->sdev_gendev);
 
+	get_device(&sdkp->dev);	/* prevent release before async_schedule */
 	async_schedule(sd_probe_async, sdkp);
 
 	return 0;
--- linux-rt-2.6.31.orig/drivers/scsi/gdth.c
+++ linux-rt-2.6.31/drivers/scsi/gdth.c
@@ -2900,7 +2900,7 @@
         eindex = handle;
     estr->event_source = 0;
 
-    if (eindex >= MAX_EVENTS) {
+    if (eindex < 0 || eindex >= MAX_EVENTS) {
         spin_unlock_irqrestore(&ha->smp_lock, flags);
         return eindex;
     }
--- linux-rt-2.6.31.orig/drivers/scsi/scsi_lib_dma.c
+++ linux-rt-2.6.31/drivers/scsi/scsi_lib_dma.c
@@ -23,7 +23,7 @@
 	int nseg = 0;
 
 	if (scsi_sg_count(cmd)) {
-		struct device *dev = cmd->device->host->shost_gendev.parent;
+		struct device *dev = cmd->device->host->dma_dev;
 
 		nseg = dma_map_sg(dev, scsi_sglist(cmd), scsi_sg_count(cmd),
 				  cmd->sc_data_direction);
@@ -41,7 +41,7 @@
 void scsi_dma_unmap(struct scsi_cmnd *cmd)
 {
 	if (scsi_sg_count(cmd)) {
-		struct device *dev = cmd->device->host->shost_gendev.parent;
+		struct device *dev = cmd->device->host->dma_dev;
 
 		dma_unmap_sg(dev, scsi_sglist(cmd), scsi_sg_count(cmd),
 			     cmd->sc_data_direction);
--- linux-rt-2.6.31.orig/drivers/scsi/megaraid/megaraid_sas.c
+++ linux-rt-2.6.31/drivers/scsi/megaraid/megaraid_sas.c
@@ -3032,7 +3032,7 @@
 	int error = 0, i;
 	void *sense = NULL;
 	dma_addr_t sense_handle;
-	u32 *sense_ptr;
+	unsigned long *sense_ptr;
 
 	memset(kbuff_arr, 0, sizeof(kbuff_arr));
 
@@ -3109,7 +3109,7 @@
 		}
 
 		sense_ptr =
-		    (u32 *) ((unsigned long)cmd->frame + ioc->sense_off);
+		(unsigned long *) ((unsigned long)cmd->frame + ioc->sense_off);
 		*sense_ptr = sense_handle;
 	}
 
@@ -3140,8 +3140,8 @@
 		 * sense_ptr points to the location that has the user
 		 * sense buffer address
 		 */
-		sense_ptr = (u32 *) ((unsigned long)ioc->frame.raw +
-				     ioc->sense_off);
+		sense_ptr = (unsigned long *) ((unsigned long)ioc->frame.raw +
+				ioc->sense_off);
 
 		if (copy_to_user((void __user *)((unsigned long)(*sense_ptr)),
 				 sense, ioc->sense_len)) {
@@ -3451,7 +3451,7 @@
 	return retval;
 }
 
-static DRIVER_ATTR(poll_mode_io, S_IRUGO|S_IWUGO,
+static DRIVER_ATTR(poll_mode_io, S_IRUGO|S_IWUSR,
 		megasas_sysfs_show_poll_mode_io,
 		megasas_sysfs_set_poll_mode_io);
 
--- linux-rt-2.6.31.orig/drivers/scsi/lpfc/lpfc_init.c
+++ linux-rt-2.6.31/drivers/scsi/lpfc/lpfc_init.c
@@ -2384,7 +2384,7 @@
 	vport->els_tmofunc.function = lpfc_els_timeout;
 	vport->els_tmofunc.data = (unsigned long)vport;
 
-	error = scsi_add_host(shost, dev);
+	error = scsi_add_host_with_dma(shost, dev, &phba->pcidev->dev);
 	if (error)
 		goto out_put_shost;
 
--- linux-rt-2.6.31.orig/drivers/scsi/qla2xxx/qla_attr.c
+++ linux-rt-2.6.31/drivers/scsi/qla2xxx/qla_attr.c
@@ -1654,7 +1654,8 @@
 			fc_vport_set_state(fc_vport, FC_VPORT_LINKDOWN);
 	}
 
-	if (scsi_add_host(vha->host, &fc_vport->dev)) {
+	if (scsi_add_host_with_dma(vha->host, &fc_vport->dev,
+				   &ha->pdev->dev)) {
 		DEBUG15(printk("scsi(%ld): scsi_add_host failure for VP[%d].\n",
 			vha->host_no, vha->vp_idx));
 		goto vport_create_failed_2;
--- linux-rt-2.6.31.orig/drivers/scsi/mpt2sas/mpt2sas_base.h
+++ linux-rt-2.6.31/drivers/scsi/mpt2sas/mpt2sas_base.h
@@ -119,6 +119,7 @@
 #define MPT2_IOC_PRE_RESET		1 /* prior to host reset */
 #define MPT2_IOC_AFTER_RESET		2 /* just after host reset */
 #define MPT2_IOC_DONE_RESET		3 /* links re-initialized */
+#define MPT2_IOC_RUNNING		4 /* shost running */
 
 /*
  * logging format
@@ -196,6 +197,38 @@
  * @block: device is in SDEV_BLOCK state
  * @tlr_snoop_check: flag used in determining whether to disable TLR
  */
+
+/* OEM Identifiers */
+#define MFG10_OEM_ID_INVALID                   (0x00000000)
+#define MFG10_OEM_ID_DELL                      (0x00000001)
+#define MFG10_OEM_ID_FSC                       (0x00000002)
+#define MFG10_OEM_ID_SUN                       (0x00000003)
+#define MFG10_OEM_ID_IBM                       (0x00000004)
+
+/* GENERIC Flags 0*/
+#define MFG10_GF0_OCE_DISABLED                 (0x00000001)
+#define MFG10_GF0_R1E_DRIVE_COUNT              (0x00000002)
+#define MFG10_GF0_R10_DISPLAY                  (0x00000004)
+#define MFG10_GF0_SSD_DATA_SCRUB_DISABLE       (0x00000008)
+#define MFG10_GF0_SINGLE_DRIVE_R0              (0x00000010)
+
+/* OEM Specific Flags will come from OEM specific header files */
+typedef struct _MPI2_CONFIG_PAGE_MAN_10 {
+    MPI2_CONFIG_PAGE_HEADER Header;                                 /* 00h */
+    U8                      OEMIdentifier;                          /* 04h */
+    U8                      Reserved1;                              /* 05h */
+    U16                     Reserved2;                              /* 08h */
+    U32                     Reserved3;                              /* 0Ch */
+    U32                     GenericFlags0;                          /* 10h */
+    U32                     GenericFlags1;                          /* 14h */
+    U32                     Reserved4;                              /* 18h */
+    U32                     OEMSpecificFlags0;                      /* 1Ch */
+    U32                     OEMSpecificFlags1;                      /* 20h */
+    U32                     Reserved5[18];                          /* 24h-60h*/
+} MPI2_CONFIG_PAGE_MAN_10,
+  MPI2_POINTER PTR_MPI2_CONFIG_PAGE_MAN_10,
+  Mpi2ManufacturingPage10_t, MPI2_POINTER pMpi2ManufacturingPage10_t;
+
 struct MPT2SAS_DEVICE {
 	struct MPT2SAS_TARGET *sas_target;
 	unsigned int	lun;
@@ -431,7 +464,7 @@
  * @fw_event_list: list of fw events
  * @aen_event_read_flag: event log was read
  * @broadcast_aen_busy: broadcast aen waiting to be serviced
- * @ioc_reset_in_progress: host reset in progress
+ * @shost_recovery: host reset in progress
  * @ioc_reset_in_progress_lock:
  * @ioc_link_reset_in_progress: phy/hard reset in progress
  * @ignore_loginfos: ignore loginfos during task managment
@@ -460,6 +493,7 @@
  * @facts: static facts data
  * @pfacts: static port facts data
  * @manu_pg0: static manufacturing page 0
+ * @manu_pg10: static manufacturing page 10
  * @bios_pg2: static bios page 2
  * @bios_pg3: static bios page 3
  * @ioc_pg8: static ioc page 8
@@ -544,7 +578,6 @@
 	 /* misc flags */
 	int		aen_event_read_flag;
 	u8		broadcast_aen_busy;
-	u8		ioc_reset_in_progress;
 	u8		shost_recovery;
 	spinlock_t 	ioc_reset_in_progress_lock;
 	u8		ioc_link_reset_in_progress;
@@ -663,6 +696,7 @@
 	dma_addr_t	diag_buffer_dma[MPI2_DIAG_BUF_TYPE_COUNT];
 	u8		diag_buffer_status[MPI2_DIAG_BUF_TYPE_COUNT];
 	u32		unique_id[MPI2_DIAG_BUF_TYPE_COUNT];
+	Mpi2ManufacturingPage10_t manu_pg10;
 	u32		product_specific[MPI2_DIAG_BUF_TYPE_COUNT][23];
 	u32		diagnostic_flags[MPI2_DIAG_BUF_TYPE_COUNT];
 };
@@ -734,6 +768,8 @@
 int mpt2sas_config_get_number_hba_phys(struct MPT2SAS_ADAPTER *ioc, u8 *num_phys);
 int mpt2sas_config_get_manufacturing_pg0(struct MPT2SAS_ADAPTER *ioc,
     Mpi2ConfigReply_t *mpi_reply, Mpi2ManufacturingPage0_t *config_page);
+int mpt2sas_config_get_manufacturing_pg10(struct MPT2SAS_ADAPTER *ioc,
+    Mpi2ConfigReply_t *mpi_reply, Mpi2ManufacturingPage10_t *config_page);
 int mpt2sas_config_get_bios_pg2(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
     *mpi_reply, Mpi2BiosPage2_t *config_page);
 int mpt2sas_config_get_bios_pg3(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
@@ -776,7 +812,6 @@
     u16 *volume_handle);
 int mpt2sas_config_get_volume_wwid(struct MPT2SAS_ADAPTER *ioc, u16 volume_handle,
     u64 *wwid);
-
 /* ctl shared API */
 extern struct device_attribute *mpt2sas_host_attrs[];
 extern struct device_attribute *mpt2sas_dev_attrs[];
@@ -802,5 +837,7 @@
    u16 attached_handle, u8 phy_number, u8 link_rate);
 extern struct sas_function_template mpt2sas_transport_functions;
 extern struct scsi_transport_template *mpt2sas_transport_template;
+extern int scsi_internal_device_block(struct scsi_device *sdev);
+extern int scsi_internal_device_unblock(struct scsi_device *sdev);
 
 #endif /* MPT2SAS_BASE_H_INCLUDED */
--- linux-rt-2.6.31.orig/drivers/scsi/mpt2sas/mpt2sas_ctl.c
+++ linux-rt-2.6.31/drivers/scsi/mpt2sas/mpt2sas_ctl.c
@@ -1963,7 +1963,6 @@
 {
 	enum block_state state;
 	long ret = -EINVAL;
-	unsigned long flags;
 
 	state = (file->f_flags & O_NONBLOCK) ? NON_BLOCKING :
 	    BLOCKING;
@@ -1989,13 +1988,8 @@
 		    !ioc)
 			return -ENODEV;
 
-		spin_lock_irqsave(&ioc->ioc_reset_in_progress_lock, flags);
-		if (ioc->shost_recovery) {
-			spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock,
-			    flags);
+		if (ioc->shost_recovery)
 			return -EAGAIN;
-		}
-		spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
 
 		if (_IOC_SIZE(cmd) == sizeof(struct mpt2_ioctl_command)) {
 			uarg = arg;
@@ -2098,7 +2092,6 @@
 	struct mpt2_ioctl_command karg;
 	struct MPT2SAS_ADAPTER *ioc;
 	enum block_state state;
-	unsigned long flags;
 
 	if (_IOC_SIZE(cmd) != sizeof(struct mpt2_ioctl_command32))
 		return -EINVAL;
@@ -2113,13 +2106,8 @@
 	if (_ctl_verify_adapter(karg32.hdr.ioc_number, &ioc) == -1 || !ioc)
 		return -ENODEV;
 
-	spin_lock_irqsave(&ioc->ioc_reset_in_progress_lock, flags);
-	if (ioc->shost_recovery) {
-		spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock,
-		    flags);
+	if (ioc->shost_recovery)
 		return -EAGAIN;
-	}
-	spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
 
 	memset(&karg, 0, sizeof(struct mpt2_ioctl_command));
 	karg.hdr.ioc_number = karg32.hdr.ioc_number;
--- linux-rt-2.6.31.orig/drivers/scsi/mpt2sas/mpt2sas_transport.c
+++ linux-rt-2.6.31/drivers/scsi/mpt2sas/mpt2sas_transport.c
@@ -140,11 +140,18 @@
 	u32 device_info;
 	u32 ioc_status;
 
+	if (ioc->shost_recovery) {
+		printk(MPT2SAS_INFO_FMT "%s: host reset in progress!\n",
+		    __func__, ioc->name);
+		return -EFAULT;
+	}
+
 	if ((mpt2sas_config_get_sas_device_pg0(ioc, &mpi_reply, &sas_device_pg0,
 	    MPI2_SAS_DEVICE_PGAD_FORM_HANDLE, handle))) {
 		printk(MPT2SAS_ERR_FMT "failure at %s:%d/%s()!\n",
+
 		    ioc->name, __FILE__, __LINE__, __func__);
-		return -1;
+		return -ENXIO;
 	}
 
 	ioc_status = le16_to_cpu(mpi_reply.IOCStatus) &
@@ -153,7 +160,7 @@
 		printk(MPT2SAS_ERR_FMT "handle(0x%04x), ioc_status(0x%04x)"
 		    "\nfailure at %s:%d/%s()!\n", ioc->name, handle, ioc_status,
 		     __FILE__, __LINE__, __func__);
-		return -1;
+		return -EIO;
 	}
 
 	memset(identify, 0, sizeof(identify));
@@ -288,21 +295,17 @@
 	void *psge;
 	u32 sgl_flags;
 	u8 issue_reset = 0;
-	unsigned long flags;
 	void *data_out = NULL;
 	dma_addr_t data_out_dma;
 	u32 sz;
 	u64 *sas_address_le;
 	u16 wait_state_count;
 
-	spin_lock_irqsave(&ioc->ioc_reset_in_progress_lock, flags);
-	if (ioc->ioc_reset_in_progress) {
-		spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
+	if (ioc->shost_recovery) {
 		printk(MPT2SAS_INFO_FMT "%s: host reset in progress!\n",
 		    __func__, ioc->name);
 		return -EFAULT;
 	}
-	spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
 
 	mutex_lock(&ioc->transport_cmds.mutex);
 
@@ -806,6 +809,12 @@
 	struct _sas_node *sas_node;
 	struct _sas_phy *mpt2sas_phy;
 
+	if (ioc->shost_recovery) {
+		printk(MPT2SAS_INFO_FMT "%s: host reset in progress!\n",
+			__func__, ioc->name);
+		return;
+	}
+
 	spin_lock_irqsave(&ioc->sas_node_lock, flags);
 	sas_node = _transport_sas_node_find_by_handle(ioc, handle);
 	spin_unlock_irqrestore(&ioc->sas_node_lock, flags);
@@ -1025,7 +1034,6 @@
 	void *psge;
 	u32 sgl_flags;
 	u8 issue_reset = 0;
-	unsigned long flags;
 	dma_addr_t dma_addr_in = 0;
 	dma_addr_t dma_addr_out = 0;
 	u16 wait_state_count;
@@ -1045,14 +1053,11 @@
 		return -EINVAL;
 	}
 
-	spin_lock_irqsave(&ioc->ioc_reset_in_progress_lock, flags);
-	if (ioc->ioc_reset_in_progress) {
-		spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
+	if (ioc->shost_recovery) {
 		printk(MPT2SAS_INFO_FMT "%s: host reset in progress!\n",
 		    __func__, ioc->name);
 		return -EFAULT;
 	}
-	spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
 
 	rc = mutex_lock_interruptible(&ioc->transport_cmds.mutex);
 	if (rc)
--- linux-rt-2.6.31.orig/drivers/scsi/mpt2sas/mpt2sas_config.c
+++ linux-rt-2.6.31/drivers/scsi/mpt2sas/mpt2sas_config.c
@@ -426,6 +426,67 @@
 }
 
 /**
+ * mpt2sas_config_get_manufacturing_pg10 - obtain manufacturing page 10
+ * @ioc: per adapter object
+ * @mpi_reply: reply mf payload returned from firmware
+ * @config_page: contents of the config page
+ * Context: sleep.
+ *
+ * Returns 0 for success, non-zero for failure.
+ */
+int
+mpt2sas_config_get_manufacturing_pg10(struct MPT2SAS_ADAPTER *ioc,
+    Mpi2ConfigReply_t *mpi_reply, Mpi2ManufacturingPage10_t *config_page)
+{
+	Mpi2ConfigRequest_t mpi_request;
+	int r;
+	struct config_request mem;
+
+	memset(config_page, 0, sizeof(Mpi2ManufacturingPage10_t));
+	memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
+	mpi_request.Function = MPI2_FUNCTION_CONFIG;
+	mpi_request.Action = MPI2_CONFIG_ACTION_PAGE_HEADER;
+	mpi_request.Header.PageType = MPI2_CONFIG_PAGETYPE_MANUFACTURING;
+	mpi_request.Header.PageNumber = 10;
+	mpi_request.Header.PageVersion = MPI2_MANUFACTURING0_PAGEVERSION;
+	mpt2sas_base_build_zero_len_sge(ioc, &mpi_request.PageBufferSGE);
+	r = _config_request(ioc, &mpi_request, mpi_reply,
+	    MPT2_CONFIG_PAGE_DEFAULT_TIMEOUT);
+	if (r)
+		goto out;
+
+	mpi_request.Action = MPI2_CONFIG_ACTION_PAGE_READ_CURRENT;
+	mpi_request.Header.PageVersion = mpi_reply->Header.PageVersion;
+	mpi_request.Header.PageNumber = mpi_reply->Header.PageNumber;
+	mpi_request.Header.PageType = mpi_reply->Header.PageType;
+	mpi_request.Header.PageLength = mpi_reply->Header.PageLength;
+	mem.config_page_sz = le16_to_cpu(mpi_reply->Header.PageLength) * 4;
+	if (mem.config_page_sz > ioc->config_page_sz) {
+		r = _config_alloc_config_dma_memory(ioc, &mem);
+		if (r)
+			goto out;
+	} else {
+		mem.config_page_dma = ioc->config_page_dma;
+		mem.config_page = ioc->config_page;
+	}
+	ioc->base_add_sg_single(&mpi_request.PageBufferSGE,
+	    MPT2_CONFIG_COMMON_SGLFLAGS | mem.config_page_sz,
+	    mem.config_page_dma);
+	r = _config_request(ioc, &mpi_request, mpi_reply,
+	    MPT2_CONFIG_PAGE_DEFAULT_TIMEOUT);
+	if (!r)
+		memcpy(config_page, mem.config_page,
+		    min_t(u16, mem.config_page_sz,
+		    sizeof(Mpi2ManufacturingPage10_t)));
+
+	if (mem.config_page_sz > ioc->config_page_sz)
+		_config_free_config_dma_memory(ioc, &mem);
+
+ out:
+	return r;
+}
+
+/**
  * mpt2sas_config_get_bios_pg2 - obtain bios page 2
  * @ioc: per adapter object
  * @mpi_reply: reply mf payload returned from firmware
--- linux-rt-2.6.31.orig/drivers/scsi/mpt2sas/mpt2sas_base.c
+++ linux-rt-2.6.31/drivers/scsi/mpt2sas/mpt2sas_base.c
@@ -94,7 +94,7 @@
 	int rc;
 
 	spin_lock_irqsave(&ioc->ioc_reset_in_progress_lock, flags);
-	if (ioc->ioc_reset_in_progress)
+	if (ioc->shost_recovery)
 		goto rearm_timer;
 	spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
 
@@ -1542,6 +1542,8 @@
 	   (ioc->bios_pg3.BiosVersion & 0x0000FF00) >> 8,
 	    ioc->bios_pg3.BiosVersion & 0x000000FF);
 
+	_base_display_dell_branding(ioc);
+
 	printk(MPT2SAS_INFO_FMT "Protocol=(", ioc->name);
 
 	if (ioc->facts.ProtocolFlags & MPI2_IOCFACTS_PROTOCOL_SCSI_INITIATOR) {
@@ -1554,8 +1556,6 @@
 		i++;
 	}
 
-	_base_display_dell_branding(ioc);
-
 	i = 0;
 	printk("), ");
 	printk("Capabilities=(");
@@ -1627,6 +1627,9 @@
 	u32 iounit_pg1_flags;
 
 	mpt2sas_config_get_manufacturing_pg0(ioc, &mpi_reply, &ioc->manu_pg0);
+	if (ioc->ir_firmware)
+		mpt2sas_config_get_manufacturing_pg10(ioc, &mpi_reply,
+		    &ioc->manu_pg10);
 	mpt2sas_config_get_bios_pg2(ioc, &mpi_reply, &ioc->bios_pg2);
 	mpt2sas_config_get_bios_pg3(ioc, &mpi_reply, &ioc->bios_pg3);
 	mpt2sas_config_get_ioc_pg8(ioc, &mpi_reply, &ioc->ioc_pg8);
@@ -3501,20 +3504,13 @@
 	    __func__));
 
 	spin_lock_irqsave(&ioc->ioc_reset_in_progress_lock, flags);
-	if (ioc->ioc_reset_in_progress) {
+	if (ioc->shost_recovery) {
 		spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
 		printk(MPT2SAS_ERR_FMT "%s: busy\n",
 		    ioc->name, __func__);
 		return -EBUSY;
 	}
-	ioc->ioc_reset_in_progress = 1;
 	ioc->shost_recovery = 1;
-	if (ioc->shost->shost_state == SHOST_RUNNING) {
-		/* set back to SHOST_RUNNING in mpt2sas_scsih.c */
-		scsi_host_set_state(ioc->shost, SHOST_RECOVERY);
-		printk(MPT2SAS_INFO_FMT "putting controller into "
-		    "SHOST_RECOVERY\n", ioc->name);
-	}
 	spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
 
 	_base_reset_handler(ioc, MPT2_IOC_PRE_RESET);
@@ -3534,7 +3530,10 @@
 	    ioc->name, __func__, ((r == 0) ? "SUCCESS" : "FAILED")));
 
 	spin_lock_irqsave(&ioc->ioc_reset_in_progress_lock, flags);
-	ioc->ioc_reset_in_progress = 0;
+	ioc->shost_recovery = 0;
 	spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
+
+	if (!r)
+		_base_reset_handler(ioc, MPT2_IOC_RUNNING);
 	return r;
 }
--- linux-rt-2.6.31.orig/drivers/scsi/mpt2sas/mpt2sas_scsih.c
+++ linux-rt-2.6.31/drivers/scsi/mpt2sas/mpt2sas_scsih.c
@@ -103,7 +103,6 @@
 };
 
 
-#define MPT2SAS_RESCAN_AFTER_HOST_RESET (0xFFFF)
 /**
  * struct fw_event_work - firmware event struct
  * @list: link list framework
@@ -1502,7 +1501,13 @@
 			break;
 		case MPI2_RAID_VOL_TYPE_RAID1E:
 			qdepth = MPT2SAS_RAID_QUEUE_DEPTH;
-			r_level = "RAID1E";
+			if (ioc->manu_pg10.OEMIdentifier &&
+			    (ioc->manu_pg10.GenericFlags0 &
+			    MFG10_GF0_R10_DISPLAY) &&
+			    !(raid_device->num_pds % 2))
+				r_level = "RAID10";
+			else
+				r_level = "RAID1E";
 			break;
 		case MPI2_RAID_VOL_TYPE_RAID1:
 			qdepth = MPT2SAS_RAID_QUEUE_DEPTH;
@@ -1786,17 +1791,18 @@
 	u32 ioc_state;
 	unsigned long timeleft;
 	u8 VF_ID = 0;
-	unsigned long flags;
 
-	spin_lock_irqsave(&ioc->ioc_reset_in_progress_lock, flags);
-	if (ioc->tm_cmds.status != MPT2_CMD_NOT_USED ||
-	    ioc->shost_recovery) {
-		spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
+	if (ioc->tm_cmds.status != MPT2_CMD_NOT_USED) {
+		printk(MPT2SAS_INFO_FMT "%s: tm_cmd busy!!!\n",
+		    __func__, ioc->name);
+		return;
+	}
+
+	if (ioc->shost_recovery) {
 		printk(MPT2SAS_INFO_FMT "%s: host reset in progress!\n",
 		    __func__, ioc->name);
 		return;
 	}
-	spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
 
 	ioc_state = mpt2sas_base_get_iocstate(ioc, 0);
 	if (ioc_state & MPI2_DOORBELL_USED) {
@@ -2222,7 +2228,7 @@
 			    MPT2SAS_INFO_FMT "SDEV_RUNNING: "
 			    "handle(0x%04x)\n", ioc->name, handle));
 			sas_device_priv_data->block = 0;
-			scsi_device_set_state(sdev, SDEV_RUNNING);
+			scsi_internal_device_unblock(sdev);
 		}
 	}
 }
@@ -2251,7 +2257,7 @@
 			    MPT2SAS_INFO_FMT "SDEV_BLOCK: "
 			    "handle(0x%04x)\n", ioc->name, handle));
 			sas_device_priv_data->block = 1;
-			scsi_device_set_state(sdev, SDEV_BLOCK);
+			scsi_internal_device_block(sdev);
 		}
 	}
 }
@@ -2327,6 +2333,7 @@
 	u16 handle;
 	u16 reason_code;
 	u8 phy_number;
+	u8 link_rate;
 
 	for (i = 0; i < event_data->NumEntries; i++) {
 		handle = le16_to_cpu(event_data->PHY[i].AttachedDevHandle);
@@ -2337,6 +2344,11 @@
 		    MPI2_EVENT_SAS_TOPO_RC_MASK;
 		if (reason_code == MPI2_EVENT_SAS_TOPO_RC_DELAY_NOT_RESPONDING)
 			_scsih_block_io_device(ioc, handle);
+		if (reason_code == MPI2_EVENT_SAS_TOPO_RC_PHY_CHANGED) {
+			link_rate = event_data->PHY[i].LinkRate >> 4;
+			if (link_rate >= MPI2_SAS_NEG_LINK_RATE_1_5)
+				_scsih_ublock_io_device(ioc, handle);
+		}
 	}
 }
 
@@ -2405,27 +2417,6 @@
 }
 
 /**
- * _scsih_queue_rescan - queue a topology rescan from user context
- * @ioc: per adapter object
- *
- * Return nothing.
- */
-static void
-_scsih_queue_rescan(struct MPT2SAS_ADAPTER *ioc)
-{
-	struct fw_event_work *fw_event;
-
-	if (ioc->wait_for_port_enable_to_complete)
-		return;
-	fw_event = kzalloc(sizeof(struct fw_event_work), GFP_ATOMIC);
-	if (!fw_event)
-		return;
-	fw_event->event = MPT2SAS_RESCAN_AFTER_HOST_RESET;
-	fw_event->ioc = ioc;
-	_scsih_fw_event_add(ioc, fw_event);
-}
-
-/**
  * _scsih_flush_running_cmds - completing outstanding commands.
  * @ioc: per adapter object
  *
@@ -2456,46 +2447,6 @@
 }
 
 /**
- * mpt2sas_scsih_reset_handler - reset callback handler (for scsih)
- * @ioc: per adapter object
- * @reset_phase: phase
- *
- * The handler for doing any required cleanup or initialization.
- *
- * The reset phase can be MPT2_IOC_PRE_RESET, MPT2_IOC_AFTER_RESET,
- * MPT2_IOC_DONE_RESET
- *
- * Return nothing.
- */
-void
-mpt2sas_scsih_reset_handler(struct MPT2SAS_ADAPTER *ioc, int reset_phase)
-{
-	switch (reset_phase) {
-	case MPT2_IOC_PRE_RESET:
-		dtmprintk(ioc, printk(MPT2SAS_DEBUG_FMT "%s: "
-		    "MPT2_IOC_PRE_RESET\n", ioc->name, __func__));
-		_scsih_fw_event_off(ioc);
-		break;
-	case MPT2_IOC_AFTER_RESET:
-		dtmprintk(ioc, printk(MPT2SAS_DEBUG_FMT "%s: "
-		    "MPT2_IOC_AFTER_RESET\n", ioc->name, __func__));
-		if (ioc->tm_cmds.status & MPT2_CMD_PENDING) {
-			ioc->tm_cmds.status |= MPT2_CMD_RESET;
-			mpt2sas_base_free_smid(ioc, ioc->tm_cmds.smid);
-			complete(&ioc->tm_cmds.done);
-		}
-		_scsih_fw_event_on(ioc);
-		_scsih_flush_running_cmds(ioc);
-		break;
-	case MPT2_IOC_DONE_RESET:
-		dtmprintk(ioc, printk(MPT2SAS_DEBUG_FMT "%s: "
-		    "MPT2_IOC_DONE_RESET\n", ioc->name, __func__));
-		_scsih_queue_rescan(ioc);
-		break;
-	}
-}
-
-/**
  * _scsih_setup_eedp - setup MPI request for EEDP transfer
  * @scmd: pointer to scsi command object
  * @mpi_request: pointer to the SCSI_IO reqest message frame
@@ -2615,7 +2566,6 @@
 	Mpi2SCSIIORequest_t *mpi_request;
 	u32 mpi_control;
 	u16 smid;
-	unsigned long flags;
 
 	scmd->scsi_done = done;
 	sas_device_priv_data = scmd->device->hostdata;
@@ -2634,13 +2584,10 @@
 	}
 
 	/* see if we are busy with task managment stuff */
-	spin_lock_irqsave(&ioc->ioc_reset_in_progress_lock, flags);
-	if (sas_target_priv_data->tm_busy ||
-	    ioc->shost_recovery || ioc->ioc_link_reset_in_progress) {
-		spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
+	if (sas_target_priv_data->tm_busy)
+		return SCSI_MLQUEUE_DEVICE_BUSY;
+	else if (ioc->shost_recovery || ioc->ioc_link_reset_in_progress)
 		return SCSI_MLQUEUE_HOST_BUSY;
-	}
-	spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
 
 	if (scmd->sc_data_direction == DMA_FROM_DEVICE)
 		mpi_control = MPI2_SCSIIO_CONTROL_READ;
@@ -3436,6 +3383,9 @@
 	if (!handle)
 		return -1;
 
+	if (ioc->shost_recovery)
+		return -1;
+
 	if ((mpt2sas_config_get_expander_pg0(ioc, &mpi_reply, &expander_pg0,
 	    MPI2_SAS_EXPAND_PGAD_FORM_HNDL, handle))) {
 		printk(MPT2SAS_ERR_FMT "failure at %s:%d/%s()!\n",
@@ -3572,6 +3522,9 @@
 	struct _sas_node *sas_expander;
 	unsigned long flags;
 
+	if (ioc->shost_recovery)
+		return;
+
 	spin_lock_irqsave(&ioc->sas_node_lock, flags);
 	sas_expander = mpt2sas_scsih_expander_find_by_handle(ioc, handle);
 	spin_unlock_irqrestore(&ioc->sas_node_lock, flags);
@@ -3743,6 +3696,8 @@
 		mutex_unlock(&ioc->tm_cmds.mutex);
 		dewtprintk(ioc, printk(MPT2SAS_INFO_FMT "issue target reset "
 		    "done: handle(0x%04x)\n", ioc->name, device_handle));
+		if (ioc->shost_recovery)
+			goto out;
 	}
 
 	/* SAS_IO_UNIT_CNTR - send REMOVE_DEVICE */
@@ -3765,6 +3720,9 @@
 	    le32_to_cpu(mpi_reply.IOCLogInfo)));
 
  out:
+
+	_scsih_ublock_io_device(ioc, handle);
+
 	mpt2sas_transport_port_remove(ioc, sas_device->sas_address,
 	    sas_device->parent_handle);
 
@@ -3908,6 +3866,8 @@
 			    "expander event\n", ioc->name));
 			return;
 		}
+		if (ioc->shost_recovery)
+			return;
 		if (event_data->PHY[i].PhyStatus &
 		    MPI2_EVENT_SAS_TOPO_PHYSTATUS_VACANT)
 			continue;
@@ -3942,10 +3902,6 @@
 						   link_rate_);
 				}
 			}
-			if (reason_code == MPI2_EVENT_SAS_TOPO_RC_PHY_CHANGED) {
-				if (link_rate_ >= MPI2_SAS_NEG_LINK_RATE_1_5)
-					_scsih_ublock_io_device(ioc, handle);
-			}
 			if (reason_code == MPI2_EVENT_SAS_TOPO_RC_TARG_ADDED) {
 				if (link_rate_ < MPI2_SAS_NEG_LINK_RATE_1_5)
 					break;
@@ -5156,22 +5112,9 @@
 _scsih_remove_unresponding_devices(struct MPT2SAS_ADAPTER *ioc)
 {
 	struct _sas_device *sas_device, *sas_device_next;
-	struct _sas_node *sas_expander, *sas_expander_next;
+	struct _sas_node *sas_expander;
 	struct _raid_device *raid_device, *raid_device_next;
-	unsigned long flags;
 
-	_scsih_search_responding_sas_devices(ioc);
-	_scsih_search_responding_raid_devices(ioc);
-	_scsih_search_responding_expanders(ioc);
-
-	spin_lock_irqsave(&ioc->ioc_reset_in_progress_lock, flags);
-	ioc->shost_recovery = 0;
-	if (ioc->shost->shost_state == SHOST_RECOVERY) {
-		printk(MPT2SAS_INFO_FMT "putting controller into "
-		    "SHOST_RUNNING\n", ioc->name);
-		scsi_host_set_state(ioc->shost, SHOST_RUNNING);
-	}
-	spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
 
 	list_for_each_entry_safe(sas_device, sas_device_next,
 	    &ioc->sas_device_list, list) {
@@ -5207,16 +5150,63 @@
 		_scsih_raid_device_remove(ioc, raid_device);
 	}
 
-	list_for_each_entry_safe(sas_expander, sas_expander_next,
-	    &ioc->sas_expander_list, list) {
+ retry_expander_search:
+	sas_expander = NULL;
+	list_for_each_entry(sas_expander, &ioc->sas_expander_list, list) {
 		if (sas_expander->responding) {
 			sas_expander->responding = 0;
 			continue;
 		}
-		printk("\tremoving expander: handle(0x%04x), "
-		    " sas_addr(0x%016llx)\n", sas_expander->handle,
-		    (unsigned long long)sas_expander->sas_address);
 		_scsih_expander_remove(ioc, sas_expander->handle);
+		goto retry_expander_search;
+	}
+}
+
+/**
+ * mpt2sas_scsih_reset_handler - reset callback handler (for scsih)
+ * @ioc: per adapter object
+ * @reset_phase: phase
+ *
+ * The handler for doing any required cleanup or initialization.
+ *
+ * The reset phase can be MPT2_IOC_PRE_RESET, MPT2_IOC_AFTER_RESET,
+ * MPT2_IOC_DONE_RESET
+ *
+ * Return nothing.
+ */
+void
+mpt2sas_scsih_reset_handler(struct MPT2SAS_ADAPTER *ioc, int reset_phase)
+{
+	switch (reset_phase) {
+	case MPT2_IOC_PRE_RESET:
+		dtmprintk(ioc, printk(MPT2SAS_DEBUG_FMT "%s: "
+		    "MPT2_IOC_PRE_RESET\n", ioc->name, __func__));
+		_scsih_fw_event_off(ioc);
+		break;
+	case MPT2_IOC_AFTER_RESET:
+		dtmprintk(ioc, printk(MPT2SAS_DEBUG_FMT "%s: "
+		    "MPT2_IOC_AFTER_RESET\n", ioc->name, __func__));
+		if (ioc->tm_cmds.status & MPT2_CMD_PENDING) {
+			ioc->tm_cmds.status |= MPT2_CMD_RESET;
+			mpt2sas_base_free_smid(ioc, ioc->tm_cmds.smid);
+			complete(&ioc->tm_cmds.done);
+		}
+		_scsih_fw_event_on(ioc);
+		_scsih_flush_running_cmds(ioc);
+		break;
+	case MPT2_IOC_DONE_RESET:
+		dtmprintk(ioc, printk(MPT2SAS_DEBUG_FMT "%s: "
+		    "MPT2_IOC_DONE_RESET\n", ioc->name, __func__));
+		_scsih_sas_host_refresh(ioc, 0);
+		_scsih_search_responding_sas_devices(ioc);
+		_scsih_search_responding_raid_devices(ioc);
+		_scsih_search_responding_expanders(ioc);
+		break;
+	case MPT2_IOC_RUNNING:
+		dtmprintk(ioc, printk(MPT2SAS_DEBUG_FMT "%s: "
+		    "MPT2_IOC_RUNNING\n", ioc->name, __func__));
+		_scsih_remove_unresponding_devices(ioc);
+		break;
 	}
 }
 
@@ -5236,14 +5226,6 @@
 	unsigned long flags;
 	struct MPT2SAS_ADAPTER *ioc = fw_event->ioc;
 
-	/* This is invoked by calling _scsih_queue_rescan(). */
-	if (fw_event->event == MPT2SAS_RESCAN_AFTER_HOST_RESET) {
-		_scsih_fw_event_free(ioc, fw_event);
-		_scsih_sas_host_refresh(ioc, 1);
-		_scsih_remove_unresponding_devices(ioc);
-		return;
-	}
-
 	/* the queue is being flushed so ignore this event */
 	spin_lock_irqsave(&ioc->fw_event_lock, flags);
 	if (ioc->fw_events_off || ioc->remove_host) {
@@ -5253,13 +5235,10 @@
 	}
 	spin_unlock_irqrestore(&ioc->fw_event_lock, flags);
 
-	spin_lock_irqsave(&ioc->ioc_reset_in_progress_lock, flags);
 	if (ioc->shost_recovery) {
-		spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
 		_scsih_fw_event_requeue(ioc, fw_event, 1000);
 		return;
 	}
-	spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
 
 	switch (fw_event->event) {
 	case MPI2_EVENT_SAS_TOPOLOGY_CHANGE_LIST:
@@ -5461,6 +5440,8 @@
 			if (!sas_device)
 				continue;
 			_scsih_remove_device(ioc, sas_device->handle);
+			if (ioc->shost_recovery)
+				return;
 			goto retry_device_search;
 		}
 	}
@@ -5482,6 +5463,8 @@
 			if (!expander_sibling)
 				continue;
 			_scsih_expander_remove(ioc, expander_sibling->handle);
+			if (ioc->shost_recovery)
+				return;
 			goto retry_expander_search;
 		}
 	}
--- linux-rt-2.6.31.orig/drivers/video/s3c-fb.c
+++ linux-rt-2.6.31/drivers/video/s3c-fb.c
@@ -1036,7 +1036,7 @@
 
 static struct platform_driver s3c_fb_driver = {
 	.probe		= s3c_fb_probe,
-	.remove		= s3c_fb_remove,
+	.remove		= __devexit_p(s3c_fb_remove),
 	.suspend	= s3c_fb_suspend,
 	.resume		= s3c_fb_resume,
 	.driver		= {
--- linux-rt-2.6.31.orig/drivers/video/Kconfig
+++ linux-rt-2.6.31/drivers/video/Kconfig
@@ -686,8 +686,8 @@
 	  If unsure, say N.
 
 config FB_VESA
-	bool "VESA VGA graphics support"
-	depends on (FB = y) && X86
+	tristate "VESA VGA graphics support"
+	depends on FB && X86
 	select FB_CFB_FILLRECT
 	select FB_CFB_COPYAREA
 	select FB_CFB_IMAGEBLIT
--- linux-rt-2.6.31.orig/drivers/video/vesafb.c
+++ linux-rt-2.6.31/drivers/video/vesafb.c
@@ -28,6 +28,12 @@
 #define dac_reg	(0x3c8)
 #define dac_val	(0x3c9)
 
+struct vesafb_info
+{
+	u32 pseudo_palette[256];
+	int mtrr_hdl;
+};
+
 /* --------------------------------------------------------------------- */
 
 static struct fb_var_screeninfo vesafb_defined __initdata = {
@@ -47,16 +53,37 @@
 	.accel	= FB_ACCEL_NONE,
 };
 
+#ifndef MODULE
 static int   inverse    __read_mostly;
+#endif
 static int   mtrr       __read_mostly;		/* disable mtrr */
 static int   vram_remap __initdata;		/* Set amount of memory to be used */
 static int   vram_total __initdata;		/* Set total amount of memory */
 static int   pmi_setpal __read_mostly = 1;	/* pmi for palette changes ??? */
+static int	redraw		__read_mostly;
 static int   ypan       __read_mostly;		/* 0..nothing, 1..ypan, 2..ywrap */
+static int	ywrap		__read_mostly;
 static void  (*pmi_start)(void) __read_mostly;
 static void  (*pmi_pal)  (void) __read_mostly;
 static int   depth      __read_mostly;
 static int   vga_compat __read_mostly;
+
+module_param(redraw, bool, 0);
+module_param(ypan, bool, 0);
+module_param(ywrap, bool, 0);
+module_param_named(vgapal, pmi_setpal, invbool, 0);
+MODULE_PARM_DESC(vgapal, "Use VGA for setting palette (default)");
+module_param_named(pmipal, pmi_setpal, bool, 0);
+MODULE_PARM_DESC(pmipal, "Use PMI for setting palette");
+module_param(mtrr, bool, 0);
+MODULE_PARM_DESC(mtrr, "Enable MTRR support (default)");
+module_param_named(nomtrr, mtrr, invbool, 0);
+MODULE_PARM_DESC(nomtrr, "Disable MTRR support");
+module_param(vram_remap, int, 0);
+MODULE_PARM_DESC(vram_remap, "Set total amount of memory to be used");
+module_param(vram_total, int, 0);
+MODULE_PARM_DESC(vram_total, "Total amount of memory");
+
 /* --------------------------------------------------------------------- */
 
 static int vesafb_pan_display(struct fb_var_screeninfo *var,
@@ -192,6 +219,7 @@
 	.fb_imageblit	= cfb_imageblit,
 };
 
+#ifndef MODULE
 static int __init vesafb_setup(char *options)
 {
 	char *this_opt;
@@ -225,6 +253,7 @@
 	}
 	return 0;
 }
+#endif
 
 static int __init vesafb_probe(struct platform_device *dev)
 {
@@ -476,8 +505,28 @@
 	return err;
 }
 
+static int __exit vesafb_remove(struct platform_device *device)
+{
+	struct fb_info *info = dev_get_drvdata(&device->dev);
+
+	unregister_framebuffer(info);
+#ifdef CONFIG_MTRR
+	{
+		struct vesafb_info *vfb_info = (struct vesafb_info *) info->par;
+		if (vfb_info->mtrr_hdl >= 0)
+			mtrr_del(vfb_info->mtrr_hdl, 0, 0);
+	}
+#endif
+	iounmap(info->screen_base);
+	framebuffer_release(info);
+	release_mem_region(vesafb_fix.smem_start, vesafb_fix.smem_len);
+
+	return 0;
+}
+
 static struct platform_driver vesafb_driver = {
 	.probe	= vesafb_probe,
+	.remove = vesafb_remove,
 	.driver	= {
 		.name	= "vesafb",
 	},
@@ -488,11 +537,18 @@
 static int __init vesafb_init(void)
 {
 	int ret;
+#ifndef MODULE
 	char *option = NULL;
 
 	/* ignore error return of fb_get_options */
 	fb_get_options("vesafb", &option);
 	vesafb_setup(option);
+#else
+	if (redraw)
+		ypan = 0;
+	if (ywrap)
+		ypan = 2;
+#endif
 	ret = platform_driver_register(&vesafb_driver);
 
 	if (!ret) {
@@ -511,6 +567,14 @@
 
 	return ret;
 }
+
+static void __exit vesafb_exit(void)
+{
+	platform_device_unregister(vesafb_device);
+	platform_driver_unregister(&vesafb_driver);
+}
+
 module_init(vesafb_init);
+module_exit(vesafb_exit);
 
 MODULE_LICENSE("GPL");
--- linux-rt-2.6.31.orig/drivers/video/uvesafb.c
+++ linux-rt-2.6.31/drivers/video/uvesafb.c
@@ -67,12 +67,14 @@
  * find the kernel part of the task struct, copy the registers and
  * the buffer contents and then complete the task.
  */
-static void uvesafb_cn_callback(void *data)
+static void uvesafb_cn_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp)
 {
-	struct cn_msg *msg = data;
 	struct uvesafb_task *utask;
 	struct uvesafb_ktask *task;
 
+	if (!cap_raised(nsp->eff_cap, CAP_SYS_ADMIN))
+		return;
+
 	if (msg->seq >= UVESAFB_TASKS_MAX)
 		return;
 
--- linux-rt-2.6.31.orig/drivers/video/sis/vstruct.h
+++ linux-rt-2.6.31/drivers/video/sis/vstruct.h
@@ -342,7 +342,7 @@
 	unsigned short			SiS_RY4COE;
 	unsigned short			SiS_LCDHDES;
 	unsigned short			SiS_LCDVDES;
-	unsigned short			SiS_DDC_Port;
+	SISIOADDRESS			SiS_DDC_Port;
 	unsigned short			SiS_DDC_Index;
 	unsigned short			SiS_DDC_Data;
 	unsigned short			SiS_DDC_NData;
--- linux-rt-2.6.31.orig/drivers/video/backlight/lcd.c
+++ linux-rt-2.6.31/drivers/video/backlight/lcd.c
@@ -56,7 +56,7 @@
 
 static int lcd_register_fb(struct lcd_device *ld)
 {
-	memset(&ld->fb_notif, 0, sizeof(&ld->fb_notif));
+	memset(&ld->fb_notif, 0, sizeof(ld->fb_notif));
 	ld->fb_notif.notifier_call = fb_notifier_callback;
 	return fb_register_client(&ld->fb_notif);
 }
--- linux-rt-2.6.31.orig/drivers/video/console/fbcon.c
+++ linux-rt-2.6.31/drivers/video/console/fbcon.c
@@ -114,6 +114,7 @@
 static int fbcon_is_default = 1; 
 static int fbcon_has_exited;
 static int primary_device = -1;
+static int fbcon_has_console_bind;
 
 #ifdef CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY
 static int map_override;
@@ -544,6 +545,8 @@
 			con2fb_map[i] = -1;
 		}
 		info_idx = -1;
+	} else {
+		fbcon_has_console_bind = 1;
 	}
 
 	return err;
@@ -2923,6 +2926,10 @@
 
 	ret = unbind_con_driver(&fb_con, first_fb_vc, last_fb_vc,
 				fbcon_is_default);
+
+	if (!ret)
+		fbcon_has_console_bind = 0;
+
 	return ret;
 }
 #else
@@ -2936,6 +2943,9 @@
 {
 	int i, new_idx = -1, ret = 0;
 
+	if (!fbcon_has_console_bind)
+		return 0;
+
 	for (i = first_fb_vc; i <= last_fb_vc; i++) {
 		if (con2fb_map[i] != idx &&
 		    con2fb_map[i] != -1) {
--- linux-rt-2.6.31.orig/drivers/video/matrox/g450_pll.c
+++ linux-rt-2.6.31/drivers/video/matrox/g450_pll.c
@@ -341,7 +341,8 @@
 					M1064_XDVICLKCTRL_C1DVICLKEN |
 					M1064_XDVICLKCTRL_DVILOOPCTL |
 					M1064_XDVICLKCTRL_P1LOOPBWDTCTL;
-				matroxfb_DAC_out(PMINFO M1064_XDVICLKCTRL,tmp);
+				/* Setting this breaks PC systems so don't do it */
+				/* matroxfb_DAC_out(PMINFO M1064_XDVICLKCTRL,tmp); */
 				matroxfb_DAC_out(PMINFO M1064_XPWRCTRL,
 						 xpwrctrl);
 
--- linux-rt-2.6.31.orig/drivers/gpu/drm/Kconfig
+++ linux-rt-2.6.31/drivers/gpu/drm/Kconfig
@@ -82,6 +82,7 @@
 config DRM_I915
 	tristate "i915 driver"
 	depends on AGP_INTEL
+	select SHMEM
 	select FB_CFB_FILLRECT
 	select FB_CFB_COPYAREA
 	select FB_CFB_IMAGEBLIT
--- linux-rt-2.6.31.orig/drivers/gpu/drm/drm_edid.c
+++ linux-rt-2.6.31/drivers/gpu/drm/drm_edid.c
@@ -333,6 +333,12 @@
 	mode->vsync_end = mode->vsync_start + vsync_pulse_width;
 	mode->vtotal = mode->vdisplay + vblank;
 
+	/* Some EDIDs have bogus h/vtotal values */
+	if (mode->hsync_end > mode->htotal)
+		mode->htotal = mode->hsync_end + 1;
+	if (mode->vsync_end > mode->vtotal)
+		mode->vtotal = mode->vsync_end + 1;
+
 	drm_mode_set_name(mode);
 
 	if (pt->misc & DRM_EDID_PT_INTERLACED)
--- linux-rt-2.6.31.orig/drivers/gpu/drm/drm_irq.c
+++ linux-rt-2.6.31/drivers/gpu/drm/drm_irq.c
@@ -402,15 +402,21 @@
 
 	spin_lock_irqsave(&dev->vbl_lock, irqflags);
 	/* Going from 0->1 means we have to enable interrupts again */
-	if (atomic_add_return(1, &dev->vblank_refcount[crtc]) == 1 &&
-	    !dev->vblank_enabled[crtc]) {
-		ret = dev->driver->enable_vblank(dev, crtc);
-		DRM_DEBUG("enabling vblank on crtc %d, ret: %d\n", crtc, ret);
-		if (ret)
+	if (atomic_add_return(1, &dev->vblank_refcount[crtc]) == 1) {
+		if (!dev->vblank_enabled[crtc]) {
+			ret = dev->driver->enable_vblank(dev, crtc);
+			DRM_DEBUG("enabling vblank on crtc %d, ret: %d\n", crtc, ret);
+			if (ret)
+				atomic_dec(&dev->vblank_refcount[crtc]);
+			else {
+				dev->vblank_enabled[crtc] = 1;
+				drm_update_vblank_count(dev, crtc);
+			}
+		}
+	} else {
+		if (!dev->vblank_enabled[crtc]) {
 			atomic_dec(&dev->vblank_refcount[crtc]);
-		else {
-			dev->vblank_enabled[crtc] = 1;
-			drm_update_vblank_count(dev, crtc);
+			ret = -EINVAL;
 		}
 	}
 	spin_unlock_irqrestore(&dev->vbl_lock, irqflags);
@@ -437,6 +443,18 @@
 }
 EXPORT_SYMBOL(drm_vblank_put);
 
+void drm_vblank_off(struct drm_device *dev, int crtc)
+{
+	unsigned long irqflags;
+
+	spin_lock_irqsave(&dev->vbl_lock, irqflags);
+	DRM_WAKEUP(&dev->vbl_queue[crtc]);
+	dev->vblank_enabled[crtc] = 0;
+	dev->last_vblank[crtc] = dev->driver->get_vblank_counter(dev, crtc);
+	spin_unlock_irqrestore(&dev->vbl_lock, irqflags);
+}
+EXPORT_SYMBOL(drm_vblank_off);
+
 /**
  * drm_vblank_pre_modeset - account for vblanks across mode sets
  * @dev: DRM device
--- linux-rt-2.6.31.orig/drivers/gpu/drm/radeon/radeon_drv.c
+++ linux-rt-2.6.31/drivers/gpu/drm/radeon/radeon_drv.c
@@ -328,8 +328,8 @@
 #endif
 	/* if enabled by default */
 	if (radeon_modeset == -1) {
-		DRM_INFO("radeon default to kernel modesetting.\n");
-		radeon_modeset = 1;
+		DRM_INFO("radeon default to kernel modesetting DISABLED.\n");
+		radeon_modeset = 0;
 	}
 	if (radeon_modeset == 1) {
 		DRM_INFO("radeon kernel modesetting enabled.\n");
--- linux-rt-2.6.31.orig/drivers/gpu/drm/radeon/radeon_atombios.c
+++ linux-rt-2.6.31/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -134,6 +134,14 @@
 		}
 	}
 
+	/* HIS X1300 is DVI+VGA, not DVI+DVI */
+	if ((dev->pdev->device == 0x7146) &&
+	    (dev->pdev->subsystem_vendor == 0x17af) &&
+	    (dev->pdev->subsystem_device == 0x2058)) {
+		if (supported_device == ATOM_DEVICE_DFP1_SUPPORT)
+			return false;
+	}
+
 	/* Funky macbooks */
 	if ((dev->pdev->device == 0x71C5) &&
 	    (dev->pdev->subsystem_vendor == 0x106b) &&
--- linux-rt-2.6.31.orig/drivers/gpu/drm/radeon/radeon_fb.c
+++ linux-rt-2.6.31/drivers/gpu/drm/radeon/radeon_fb.c
@@ -120,7 +120,7 @@
 	struct drm_framebuffer *fb = &rfb->base;
 	int depth;
 
-	if (var->pixclock == -1 || !var->pixclock) {
+	if (var->pixclock != 0) {
 		return -EINVAL;
 	}
 	/* Need to resize the fb object !!! */
@@ -234,7 +234,7 @@
 	int ret;
 	int i;
 
-	if (var->pixclock != -1) {
+	if (var->pixclock != 0) {
 		DRM_ERROR("PIXEL CLCOK SET\n");
 		return -EINVAL;
 	}
@@ -828,7 +828,7 @@
 	rfbdev->crtc_count = crtc_count;
 
 	if (new_fb) {
-		info->var.pixclock = -1;
+		info->var.pixclock = 0;
 		if (register_framebuffer(info) < 0)
 			return -EINVAL;
 	} else {
--- linux-rt-2.6.31.orig/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
+++ linux-rt-2.6.31/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
@@ -291,8 +291,7 @@
 	uint32_t mask;
 
 	if (radeon_crtc->crtc_id)
-		mask = (RADEON_CRTC2_EN |
-			RADEON_CRTC2_DISP_DIS |
+		mask = (RADEON_CRTC2_DISP_DIS |
 			RADEON_CRTC2_VSYNC_DIS |
 			RADEON_CRTC2_HSYNC_DIS |
 			RADEON_CRTC2_DISP_REQ_EN_B);
@@ -304,7 +303,7 @@
 	switch (mode) {
 	case DRM_MODE_DPMS_ON:
 		if (radeon_crtc->crtc_id)
-			WREG32_P(RADEON_CRTC2_GEN_CNTL, RADEON_CRTC2_EN, ~mask);
+			WREG32_P(RADEON_CRTC2_GEN_CNTL, RADEON_CRTC2_EN, ~(RADEON_CRTC2_EN | mask));
 		else {
 			WREG32_P(RADEON_CRTC_GEN_CNTL, RADEON_CRTC_EN, ~(RADEON_CRTC_EN |
 									 RADEON_CRTC_DISP_REQ_EN_B));
@@ -318,7 +317,7 @@
 	case DRM_MODE_DPMS_OFF:
 		drm_vblank_pre_modeset(dev, radeon_crtc->crtc_id);
 		if (radeon_crtc->crtc_id)
-			WREG32_P(RADEON_CRTC2_GEN_CNTL, mask, ~mask);
+			WREG32_P(RADEON_CRTC2_GEN_CNTL, mask, ~(RADEON_CRTC2_EN | mask));
 		else {
 			WREG32_P(RADEON_CRTC_GEN_CNTL, RADEON_CRTC_DISP_REQ_EN_B, ~(RADEON_CRTC_EN |
 										    RADEON_CRTC_DISP_REQ_EN_B));
--- linux-rt-2.6.31.orig/drivers/gpu/drm/i915/i915_dma.c
+++ linux-rt-2.6.31/drivers/gpu/drm/i915/i915_dma.c
@@ -1257,9 +1257,7 @@
 	}
 
 	/* Must be done after probing outputs */
-	/* FIXME: verify on IGDNG */
-	if (!IS_IGDNG(dev))
-		intel_opregion_init(dev, 0);
+	intel_opregion_init(dev, 0);
 
 	return 0;
 
@@ -1297,8 +1295,7 @@
 	if (dev_priv->regs != NULL)
 		iounmap(dev_priv->regs);
 
-	if (!IS_IGDNG(dev))
-		intel_opregion_free(dev, 0);
+	intel_opregion_free(dev, 0);
 
 	if (drm_core_check_feature(dev, DRIVER_MODESET)) {
 		intel_modeset_cleanup(dev);
--- linux-rt-2.6.31.orig/drivers/gpu/drm/i915/intel_display.c
+++ linux-rt-2.6.31/drivers/gpu/drm/i915/intel_display.c
@@ -804,10 +804,8 @@
 	struct drm_device *dev = crtc->dev;
 	struct drm_i915_private *dev_priv = dev->dev_private;
 	intel_clock_t clock;
-	int max_n;
-	bool found;
 	int err_most = 47;
-	found = false;
+	int err_min = 10000;
 
 	/* eDP has only 2 clock choice, no n/m/p setting */
 	if (HAS_eDP)
@@ -818,7 +816,7 @@
 					       refclk, best_clock);
 
 	if (intel_pipe_has_type(crtc, INTEL_OUTPUT_LVDS)) {
-		if ((I915_READ(LVDS) & LVDS_CLKB_POWER_MASK) ==
+		if ((I915_READ(PCH_LVDS) & LVDS_CLKB_POWER_MASK) ==
 		    LVDS_CLKB_POWER_UP)
 			clock.p2 = limit->p2.p2_fast;
 		else
@@ -831,16 +829,14 @@
 	}
 
 	memset(best_clock, 0, sizeof(*best_clock));
-	max_n = limit->n.max;
-	/* based on hardware requriment prefer smaller n to precision */
-	for (clock.n = limit->n.min; clock.n <= max_n; clock.n++) {
-		/* based on hardware requirment prefere larger m1,m2, p1 */
-		for (clock.m1 = limit->m1.max;
-		     clock.m1 >= limit->m1.min; clock.m1--) {
-			for (clock.m2 = limit->m2.max;
-			     clock.m2 >= limit->m2.min; clock.m2--) {
-				for (clock.p1 = limit->p1.max;
-				     clock.p1 >= limit->p1.min; clock.p1--) {
+	for (clock.p1 = limit->p1.max; clock.p1 >= limit->p1.min; clock.p1--) {
+		/* based on hardware requriment prefer smaller n to precision */
+		for (clock.n = limit->n.min; clock.n <= limit->n.max; clock.n++) {
+			/* based on hardware requirment prefere larger m1,m2 */
+			for (clock.m1 = limit->m1.max;
+			     clock.m1 >= limit->m1.min; clock.m1--) {
+				for (clock.m2 = limit->m2.max;
+				     clock.m2 >= limit->m2.min; clock.m2--) {
 					int this_err;
 
 					intel_clock(dev, refclk, &clock);
@@ -849,18 +845,18 @@
 					this_err = abs((10000 - (target*10000/clock.dot)));
 					if (this_err < err_most) {
 						*best_clock = clock;
-						err_most = this_err;
-						max_n = clock.n;
-						found = true;
 						/* found on first matching */
 						goto out;
+					} else if (this_err < err_min) {
+						*best_clock = clock;
+						err_min = this_err;
 					}
 				}
 			}
 		}
 	}
 out:
-	return found;
+	return true;
 }
 
 /* DisplayPort has only two frequencies, 162MHz and 270MHz */
@@ -1008,6 +1004,10 @@
 			dspcntr &= ~DISPPLANE_TILED;
 	}
 
+	if (IS_IGDNG(dev))
+		/* must disable */
+		dspcntr |= DISPPLANE_TRICKLE_FEED_DISABLE;
+
 	I915_WRITE(dspcntr_reg, dspcntr);
 
 	Start = obj_priv->gtt_offset;
@@ -1154,6 +1154,7 @@
 	int transconf_reg = (pipe == 0) ? TRANSACONF : TRANSBCONF;
 	int pf_ctl_reg = (pipe == 0) ? PFA_CTL_1 : PFB_CTL_1;
 	int pf_win_size = (pipe == 0) ? PFA_WIN_SZ : PFB_WIN_SZ;
+	int pf_win_pos = (pipe == 0) ? PFA_WIN_POS : PFB_WIN_POS;
 	int cpu_htot_reg = (pipe == 0) ? HTOTAL_A : HTOTAL_B;
 	int cpu_hblank_reg = (pipe == 0) ? HBLANK_A : HBLANK_B;
 	int cpu_hsync_reg = (pipe == 0) ? HSYNC_A : HSYNC_B;
@@ -1177,6 +1178,15 @@
 	case DRM_MODE_DPMS_STANDBY:
 	case DRM_MODE_DPMS_SUSPEND:
 		DRM_DEBUG("crtc %d dpms on\n", pipe);
+
+		if (intel_pipe_has_type(crtc, INTEL_OUTPUT_LVDS)) {
+			temp = I915_READ(PCH_LVDS);
+			if ((temp & LVDS_PORT_EN) == 0) {
+				I915_WRITE(PCH_LVDS, temp | LVDS_PORT_EN);
+				POSTING_READ(PCH_LVDS);
+			}
+		}
+
 		if (HAS_eDP) {
 			/* enable eDP PLL */
 			igdng_enable_pll_edp(crtc);
@@ -1205,6 +1215,19 @@
 			}
 		}
 
+		/* Enable panel fitting for LVDS */
+		if (intel_pipe_has_type(crtc, INTEL_OUTPUT_LVDS)) {
+			temp = I915_READ(pf_ctl_reg);
+			I915_WRITE(pf_ctl_reg, temp | PF_ENABLE | PF_FILTER_MED_3x3);
+
+			/* currently full aspect */
+			I915_WRITE(pf_win_pos, 0);
+
+			I915_WRITE(pf_win_size,
+				   (dev_priv->panel_fixed_mode->hdisplay << 16) |
+				   (dev_priv->panel_fixed_mode->vdisplay));
+		}
+
 		/* Enable CPU pipe */
 		temp = I915_READ(pipeconf_reg);
 		if ((temp & PIPEACONF_ENABLE) == 0) {
@@ -1348,8 +1371,6 @@
 	case DRM_MODE_DPMS_OFF:
 		DRM_DEBUG("crtc %d dpms off\n", pipe);
 
-		i915_disable_vga(dev);
-
 		/* Disable display plane */
 		temp = I915_READ(dspcntr_reg);
 		if ((temp & DISPLAY_PLANE_ENABLE) != 0) {
@@ -1359,6 +1380,8 @@
 			I915_READ(dspbase_reg);
 		}
 
+		i915_disable_vga(dev);
+
 		/* disable cpu pipe, disable after all planes disabled */
 		temp = I915_READ(pipeconf_reg);
 		if ((temp & PIPEACONF_ENABLE) != 0) {
@@ -1379,9 +1402,15 @@
 		} else
 			DRM_DEBUG("crtc %d is disabled\n", pipe);
 
-		if (HAS_eDP) {
-			igdng_disable_pll_edp(crtc);
+		udelay(100);
+
+		/* Disable PF */
+		temp = I915_READ(pf_ctl_reg);
+		if ((temp & PF_ENABLE) != 0) {
+			I915_WRITE(pf_ctl_reg, temp & ~PF_ENABLE);
+			I915_READ(pf_ctl_reg);
 		}
+		I915_WRITE(pf_win_size, 0);
 
 		/* disable CPU FDI tx and PCH FDI rx */
 		temp = I915_READ(fdi_tx_reg);
@@ -1407,6 +1436,13 @@
 
 		udelay(100);
 
+		if (intel_pipe_has_type(crtc, INTEL_OUTPUT_LVDS)) {
+			temp = I915_READ(PCH_LVDS);
+			I915_WRITE(PCH_LVDS, temp & ~LVDS_PORT_EN);
+			I915_READ(PCH_LVDS);
+			udelay(100);
+		}
+
 		/* disable PCH transcoder */
 		temp = I915_READ(transconf_reg);
 		if ((temp & TRANS_ENABLE) != 0) {
@@ -1426,6 +1462,8 @@
 			}
 		}
 
+		udelay(100);
+
 		/* disable PCH DPLL */
 		temp = I915_READ(pch_dpll_reg);
 		if ((temp & DPLL_VCO_ENABLE) != 0) {
@@ -1433,14 +1471,20 @@
 			I915_READ(pch_dpll_reg);
 		}
 
-		temp = I915_READ(fdi_rx_reg);
-		if ((temp & FDI_RX_PLL_ENABLE) != 0) {
-			temp &= ~FDI_SEL_PCDCLK;
-			temp &= ~FDI_RX_PLL_ENABLE;
-			I915_WRITE(fdi_rx_reg, temp);
-			I915_READ(fdi_rx_reg);
+		if (HAS_eDP) {
+			igdng_disable_pll_edp(crtc);
 		}
 
+		temp = I915_READ(fdi_rx_reg);
+		temp &= ~FDI_SEL_PCDCLK;
+		I915_WRITE(fdi_rx_reg, temp);
+		I915_READ(fdi_rx_reg);
+
+		temp = I915_READ(fdi_rx_reg);
+		temp &= ~FDI_RX_PLL_ENABLE;
+		I915_WRITE(fdi_rx_reg, temp);
+		I915_READ(fdi_rx_reg);
+
 		/* Disable CPU FDI TX PLL */
 		temp = I915_READ(fdi_tx_reg);
 		if ((temp & FDI_TX_PLL_ENABLE) != 0) {
@@ -1449,16 +1493,8 @@
 			udelay(100);
 		}
 
-		/* Disable PF */
-		temp = I915_READ(pf_ctl_reg);
-		if ((temp & PF_ENABLE) != 0) {
-			I915_WRITE(pf_ctl_reg, temp & ~PF_ENABLE);
-			I915_READ(pf_ctl_reg);
-		}
-		I915_WRITE(pf_win_size, 0);
-
 		/* Wait for the clocks to turn off. */
-		udelay(150);
+		udelay(100);
 		break;
 	}
 }
@@ -1522,6 +1558,7 @@
 		intel_update_watermarks(dev);
 		/* Give the overlay scaler a chance to disable if it's on this pipe */
 		//intel_crtc_dpms_video(crtc, FALSE); TODO
+		drm_vblank_off(dev, pipe);
 
 		/* Disable the VGA plane that we never use */
 		i915_disable_vga(dev);
@@ -1746,7 +1783,7 @@
 #define LINK_N 0x80000
 
 static void
-igdng_compute_m_n(int bytes_per_pixel, int nlanes,
+igdng_compute_m_n(int bits_per_pixel, int nlanes,
 		int pixel_clock, int link_clock,
 		struct fdi_m_n *m_n)
 {
@@ -1756,7 +1793,8 @@
 
 	temp = (u64) DATA_N * pixel_clock;
 	temp = div_u64(temp, link_clock);
-	m_n->gmch_m = div_u64(temp * bytes_per_pixel, nlanes);
+	m_n->gmch_m = div_u64(temp * bits_per_pixel, nlanes);
+	m_n->gmch_m >>= 3; /* convert to bytes_per_pixel */
 	m_n->gmch_n = DATA_N;
 	fdi_reduce_ratio(&m_n->gmch_m, &m_n->gmch_n);
 
@@ -1858,7 +1896,14 @@
 {
 	long entries_required, wm_size;
 
-	entries_required = (clock_in_khz * pixel_size * latency_ns) / 1000000;
+	/*
+	 * Note: we need to make sure we don't overflow for various clock &
+	 * latency values.
+	 * clocks go from a few thousand to several hundred thousand.
+	 * latency is usually a few thousand
+	 */
+	entries_required = ((clock_in_khz / 1000) * pixel_size * latency_ns) /
+		1000;
 	entries_required /= wm->cacheline_size;
 
 	DRM_DEBUG("FIFO entries required for mode: %d\n", entries_required);
@@ -2371,7 +2416,7 @@
 
 	/* FDI link */
 	if (IS_IGDNG(dev)) {
-		int lane, link_bw;
+		int lane, link_bw, bpp;
 		/* eDP doesn't require FDI link, so just set DP M/N
 		   according to current link config */
 		if (is_edp) {
@@ -2390,10 +2435,72 @@
 			lane = 4;
 			link_bw = 270000;
 		}
-		igdng_compute_m_n(3, lane, target_clock,
+
+		/* determine panel color depth */
+		temp = I915_READ(pipeconf_reg);
+
+		switch (temp & PIPE_BPC_MASK) {
+		case PIPE_8BPC:
+			bpp = 24;
+			break;
+		case PIPE_10BPC:
+			bpp = 30;
+			break;
+		case PIPE_6BPC:
+			bpp = 18;
+			break;
+		case PIPE_12BPC:
+			bpp = 36;
+			break;
+		default:
+			DRM_ERROR("unknown pipe bpc value\n");
+			bpp = 24;
+		}
+
+		igdng_compute_m_n(bpp, lane, target_clock,
 				  link_bw, &m_n);
 	}
 
+	/* Ironlake: try to setup display ref clock before DPLL
+	 * enabling. This is only under driver's control after
+	 * PCH B stepping, previous chipset stepping should be
+	 * ignoring this setting.
+	 */
+	if (IS_IGDNG(dev)) {
+		temp = I915_READ(PCH_DREF_CONTROL);
+		/* Always enable nonspread source */
+		temp &= ~DREF_NONSPREAD_SOURCE_MASK;
+		temp |= DREF_NONSPREAD_SOURCE_ENABLE;
+		I915_WRITE(PCH_DREF_CONTROL, temp);
+		POSTING_READ(PCH_DREF_CONTROL);
+
+		temp &= ~DREF_SSC_SOURCE_MASK;
+		temp |= DREF_SSC_SOURCE_ENABLE;
+		I915_WRITE(PCH_DREF_CONTROL, temp);
+		POSTING_READ(PCH_DREF_CONTROL);
+
+		udelay(200);
+
+		if (is_edp) {
+			if (dev_priv->lvds_use_ssc) {
+				temp |= DREF_SSC1_ENABLE;
+				I915_WRITE(PCH_DREF_CONTROL, temp);
+				POSTING_READ(PCH_DREF_CONTROL);
+
+				udelay(200);
+
+				temp &= ~DREF_CPU_SOURCE_OUTPUT_MASK;
+				temp |= DREF_CPU_SOURCE_OUTPUT_DOWNSPREAD;
+				I915_WRITE(PCH_DREF_CONTROL, temp);
+				POSTING_READ(PCH_DREF_CONTROL);
+			} else {
+				temp |= DREF_CPU_SOURCE_OUTPUT_NONSPREAD;
+				I915_WRITE(PCH_DREF_CONTROL, temp);
+				POSTING_READ(PCH_DREF_CONTROL);
+			}
+		}
+	}
+
 	if (IS_IGD(dev))
 		fp = (1 << clock.n) << 16 | clock.m1 << 8 | clock.m2;
 	else
@@ -2616,6 +2723,12 @@
 
 	intel_wait_for_vblank(dev);
 
+	if (IS_IGDNG(dev)) {
+		/* enable address swizzle for tiling buffer */
+		temp = I915_READ(DISP_ARB_CTL);
+		I915_WRITE(DISP_ARB_CTL, temp | DISP_TILE_SURFACE_SWIZZLING);
+	}
+
 	I915_WRITE(dspcntr_reg, dspcntr);
 
 	/* Flush the plane changes */
@@ -3231,7 +3344,7 @@
 		if (I915_READ(PCH_DP_D) & DP_DETECTED)
 			intel_dp_init(dev, PCH_DP_D);
 
-	} else if (IS_I9XX(dev)) {
+	} else if (SUPPORTS_DIGITAL_OUTPUTS(dev)) {
 		bool found = false;
 
 		if (I915_READ(SDVOB) & SDVO_DETECTED) {
@@ -3258,10 +3371,10 @@
 
 		if (SUPPORTS_INTEGRATED_DP(dev) && (I915_READ(DP_D) & DP_DETECTED))
 			intel_dp_init(dev, DP_D);
-	} else
+	} else if (IS_I8XX(dev))
 		intel_dvo_init(dev);
 
-	if (IS_I9XX(dev) && IS_MOBILE(dev) && !IS_IGDNG(dev))
+	if (SUPPORTS_TV(dev))
 		intel_tv_init(dev);
 
 	list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
--- linux-rt-2.6.31.orig/drivers/gpu/drm/i915/i915_opregion.c
+++ linux-rt-2.6.31/drivers/gpu/drm/i915/i915_opregion.c
@@ -32,6 +32,8 @@
 #include "i915_drm.h"
 #include "i915_drv.h"
 
+#define I915_DRV "i915_drv"
+
 #define PCI_ASLE 0xe4
 #define PCI_LBPC 0xf4
 #define PCI_ASLS 0xfc
@@ -118,6 +120,10 @@
 #define ASLE_BACKLIGHT_FAIL    (2<<12)
 #define ASLE_PFIT_FAIL         (2<<14)
 #define ASLE_PWM_FREQ_FAIL     (2<<16)
+#define ASLE_ALS_ILLUM_FAILED	(1<<10)
+#define ASLE_BACKLIGHT_FAILED	(1<<12)
+#define ASLE_PFIT_FAILED	(1<<14)
+#define ASLE_PWM_FREQ_FAILED	(1<<16)
 
 /* ASLE backlight brightness to set */
 #define ASLE_BCLP_VALID                (1<<31)
@@ -231,6 +237,73 @@
 	asle->aslc = asle_stat;
 }
 
+static u32 asle_set_backlight_ironlake(struct drm_device *dev, u32 bclp)
+{
+	struct drm_i915_private *dev_priv = dev->dev_private;
+	struct opregion_asle *asle = dev_priv->opregion.asle;
+	u32 cpu_pwm_ctl, pch_pwm_ctl2;
+	u32 max_backlight, level;
+
+	if (!(bclp & ASLE_BCLP_VALID))
+		return ASLE_BACKLIGHT_FAILED;
+
+	bclp &= ASLE_BCLP_MSK;
+	if (bclp < 0 || bclp > 255)
+		return ASLE_BACKLIGHT_FAILED;
+
+	cpu_pwm_ctl = I915_READ(BLC_PWM_CPU_CTL);
+	pch_pwm_ctl2 = I915_READ(BLC_PWM_PCH_CTL2);
+	/* get the max PWM frequency */
+	max_backlight = (pch_pwm_ctl2 >> 16) & BACKLIGHT_DUTY_CYCLE_MASK;
+	/* calculate the expected PMW frequency */
+	level = (bclp * max_backlight) / 255;
+	/* reserve the high 16 bits */
+	cpu_pwm_ctl &= ~(BACKLIGHT_DUTY_CYCLE_MASK);
+	/* write the updated PWM frequency */
+	I915_WRITE(BLC_PWM_CPU_CTL, cpu_pwm_ctl | level);
+
+	asle->cblv = (bclp*0x64)/0xff | ASLE_CBLV_VALID;
+
+	return 0;
+}
+
+void ironlake_opregion_gse_intr(struct drm_device *dev)
+{
+	struct drm_i915_private *dev_priv = dev->dev_private;
+	struct opregion_asle *asle = dev_priv->opregion.asle;
+	u32 asle_stat = 0;
+	u32 asle_req;
+
+	if (!asle)
+		return;
+
+	asle_req = asle->aslc & ASLE_REQ_MSK;
+
+	if (!asle_req) {
+		DRM_DEBUG_DRIVER(I915_DRV, "non asle set request??\n");
+		return;
+	}
+
+	if (asle_req & ASLE_SET_ALS_ILLUM) {
+		DRM_DEBUG_DRIVER(I915_DRV, "Illum is not supported\n");
+		asle_stat |= ASLE_ALS_ILLUM_FAILED;
+	}
+
+	if (asle_req & ASLE_SET_BACKLIGHT)
+		asle_stat |= asle_set_backlight_ironlake(dev, asle->bclp);
+
+	if (asle_req & ASLE_SET_PFIT) {
+		DRM_DEBUG_DRIVER(I915_DRV, "Pfit is not supported\n");
+		asle_stat |= ASLE_PFIT_FAILED;
+	}
+
+	if (asle_req & ASLE_SET_PWM_FREQ) {
+		DRM_DEBUG_DRIVER(I915_DRV, "PWM freq is not supported\n");
+		asle_stat |= ASLE_PWM_FREQ_FAILED;
+	}
+
+	asle->aslc = asle_stat;
+}
 #define ASLE_ALS_EN    (1<<0)
 #define ASLE_BLC_EN    (1<<1)
 #define ASLE_PFIT_EN   (1<<2)
@@ -246,8 +319,7 @@
 			unsigned long irqflags;
 
 			spin_lock_irqsave(&dev_priv->user_irq_lock, irqflags);
-			i915_enable_pipestat(dev_priv, 1,
-					     I915_LEGACY_BLC_EVENT_ENABLE);
+			intel_enable_asle(dev);
 			spin_unlock_irqrestore(&dev_priv->user_irq_lock,
 					       irqflags);
 		}
--- linux-rt-2.6.31.orig/drivers/gpu/drm/i915/i915_gem_tiling.c
+++ linux-rt-2.6.31/drivers/gpu/drm/i915/i915_gem_tiling.c
@@ -234,7 +234,13 @@
 	uint32_t swizzle_y = I915_BIT_6_SWIZZLE_UNKNOWN;
 	bool need_disable;
 
-	if (!IS_I9XX(dev)) {
+	if (IS_IGDNG(dev)) {
+		/* On IGDNG whatever DRAM config, GPU always do
+		 * same swizzling setup.
+		 */
+		swizzle_x = I915_BIT_6_SWIZZLE_9_10;
+		swizzle_y = I915_BIT_6_SWIZZLE_9;
+	} else if (!IS_I9XX(dev)) {
 		/* As far as we know, the 865 doesn't have these bit 6
 		 * swizzling issues.
 		 */
@@ -317,13 +323,6 @@
 		}
 	}
 
-	/* FIXME: check with memory config on IGDNG */
-	if (IS_IGDNG(dev)) {
-		DRM_ERROR("disable tiling on IGDNG...\n");
-		swizzle_x = I915_BIT_6_SWIZZLE_UNKNOWN;
-		swizzle_y = I915_BIT_6_SWIZZLE_UNKNOWN;
-	}
-
 	dev_priv->mm.bit_6_swizzle_x = swizzle_x;
 	dev_priv->mm.bit_6_swizzle_y = swizzle_y;
 }
--- linux-rt-2.6.31.orig/drivers/gpu/drm/i915/i915_drv.c
+++ linux-rt-2.6.31/drivers/gpu/drm/i915/i915_drv.c
@@ -94,8 +94,6 @@
 	struct drm_i915_private *dev_priv = dev->dev_private;
 	int ret = 0;
 
-	pci_set_power_state(dev->pdev, PCI_D0);
-	pci_restore_state(dev->pdev);
 	if (pci_enable_device(dev->pdev))
 		return -1;
 	pci_set_master(dev->pdev);
@@ -263,6 +261,7 @@
 module_init(i915_init);
 module_exit(i915_exit);
 
+MODULE_IMPORT(intel_agp);
 MODULE_AUTHOR(DRIVER_AUTHOR);
 MODULE_DESCRIPTION(DRIVER_DESC);
 MODULE_LICENSE("GPL and additional rights");
--- linux-rt-2.6.31.orig/drivers/gpu/drm/i915/i915_irq.c
+++ linux-rt-2.6.31/drivers/gpu/drm/i915/i915_irq.c
@@ -156,6 +156,20 @@
 }
 
 /**
+ * intel_enable_asle - enable ASLE interrupt for OpRegion
+ */
+void intel_enable_asle (struct drm_device *dev)
+{
+	drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+
+	if (IS_IGDNG(dev))
+		igdng_enable_display_irq(dev_priv, DE_GSE);
+	else
+		i915_enable_pipestat(dev_priv, 1,
+				     I915_LEGACY_BLC_EVENT_ENABLE);
+}
+
+/**
  * i915_pipe_enabled - check if a pipe is enabled
  * @dev: DRM device
  * @pipe: pipe to check
@@ -253,40 +267,54 @@
 {
 	drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
 	int ret = IRQ_NONE;
-	u32 de_iir, gt_iir;
-	u32 new_de_iir, new_gt_iir;
+	u32 de_iir, gt_iir, de_ier, pch_iir;
 	struct drm_i915_master_private *master_priv;
 
+	/* disable master interrupt before clearing iir  */
+	de_ier = I915_READ(DEIER);
+	I915_WRITE(DEIER, de_ier & ~DE_MASTER_IRQ_CONTROL);
+	(void)I915_READ(DEIER);
+
 	de_iir = I915_READ(DEIIR);
 	gt_iir = I915_READ(GTIIR);
+	pch_iir = I915_READ(SDEIIR);
 
-	for (;;) {
-		if (de_iir == 0 && gt_iir == 0)
-			break;
+	if (de_iir == 0 && gt_iir == 0 && pch_iir == 0)
+		goto done;
 
-		ret = IRQ_HANDLED;
+	ret = IRQ_HANDLED;
 
-		I915_WRITE(DEIIR, de_iir);
-		new_de_iir = I915_READ(DEIIR);
-		I915_WRITE(GTIIR, gt_iir);
-		new_gt_iir = I915_READ(GTIIR);
+	if (dev->primary->master) {
+		master_priv = dev->primary->master->driver_priv;
+		if (master_priv->sarea_priv)
+			master_priv->sarea_priv->last_dispatch =
+				READ_BREADCRUMB(dev_priv);
+	}
 
-		if (dev->primary->master) {
-			master_priv = dev->primary->master->driver_priv;
-			if (master_priv->sarea_priv)
-				master_priv->sarea_priv->last_dispatch =
-					READ_BREADCRUMB(dev_priv);
-		}
+	if (gt_iir & GT_USER_INTERRUPT) {
+		u32 seqno = i915_get_gem_seqno(dev);
+		dev_priv->mm.irq_gem_seqno = seqno;
+		DRM_WAKEUP(&dev_priv->irq_queue);
+	}
 
-		if (gt_iir & GT_USER_INTERRUPT) {
-			dev_priv->mm.irq_gem_seqno = i915_get_gem_seqno(dev);
-			DRM_WAKEUP(&dev_priv->irq_queue);
-		}
+	if (de_iir & DE_GSE)
+		ironlake_opregion_gse_intr(dev);
 
-		de_iir = new_de_iir;
-		gt_iir = new_gt_iir;
+	/* check event from PCH */
+	if ((de_iir & DE_PCH_EVENT) &&
+	    (pch_iir & SDE_HOTPLUG_MASK)) {
+		queue_work(dev_priv->wq, &dev_priv->hotplug_work);
 	}
 
+	/* should clear PCH hotplug event before clear CPU irq */
+	I915_WRITE(SDEIIR, pch_iir);
+	I915_WRITE(GTIIR, gt_iir);
+	I915_WRITE(DEIIR, de_iir);
+
+done:
+	I915_WRITE(DEIER, de_ier);
+	(void)I915_READ(DEIER);
+
 	return ret;
 }
 
@@ -877,14 +905,21 @@
 	I915_WRITE(GTIMR, 0xffffffff);
 	I915_WRITE(GTIER, 0x0);
 	(void) I915_READ(GTIER);
+
+	/* south display irq */
+	I915_WRITE(SDEIMR, 0xffffffff);
+	I915_WRITE(SDEIER, 0x0);
+	(void) I915_READ(SDEIER);
 }
 
 static int igdng_irq_postinstall(struct drm_device *dev)
 {
 	drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
 	/* enable kind of interrupts always enabled */
-	u32 display_mask = DE_MASTER_IRQ_CONTROL /*| DE_PCH_EVENT */;
+	u32 display_mask = DE_MASTER_IRQ_CONTROL | DE_GSE | DE_PCH_EVENT;
 	u32 render_mask = GT_USER_INTERRUPT;
+	u32 hotplug_mask = SDE_CRT_HOTPLUG | SDE_PORTB_HOTPLUG |
+			   SDE_PORTC_HOTPLUG | SDE_PORTD_HOTPLUG;
 
 	dev_priv->irq_mask_reg = ~display_mask;
 	dev_priv->de_irq_enable_reg = display_mask;
@@ -904,6 +939,14 @@
 	I915_WRITE(GTIER, dev_priv->gt_irq_enable_reg);
 	(void) I915_READ(GTIER);
 
+	dev_priv->pch_irq_mask_reg = ~hotplug_mask;
+	dev_priv->pch_irq_enable_reg = hotplug_mask;
+
+	I915_WRITE(SDEIIR, I915_READ(SDEIIR));
+	I915_WRITE(SDEIMR, dev_priv->pch_irq_mask_reg);
+	I915_WRITE(SDEIER, dev_priv->pch_irq_enable_reg);
+	(void) I915_READ(SDEIER);
+
 	return 0;
 }
 
--- linux-rt-2.6.31.orig/drivers/gpu/drm/i915/intel_tv.c
+++ linux-rt-2.6.31/drivers/gpu/drm/i915/intel_tv.c
@@ -1212,20 +1212,17 @@
 		tv_ctl |= TV_TRILEVEL_SYNC;
 	if (tv_mode->pal_burst)
 		tv_ctl |= TV_PAL_BURST;
+
 	scctl1 = 0;
-	/* dda1 implies valid video levels */
-	if (tv_mode->dda1_inc) {
+	if (tv_mode->dda1_inc)
 		scctl1 |= TV_SC_DDA1_EN;
-	}
-
 	if (tv_mode->dda2_inc)
 		scctl1 |= TV_SC_DDA2_EN;
-
 	if (tv_mode->dda3_inc)
 		scctl1 |= TV_SC_DDA3_EN;
-
 	scctl1 |= tv_mode->sc_reset;
-	scctl1 |= video_levels->burst << TV_BURST_LEVEL_SHIFT;
+	if (video_levels)
+		scctl1 |= video_levels->burst << TV_BURST_LEVEL_SHIFT;
 	scctl1 |= tv_mode->dda1_inc << TV_SCDDA1_INC_SHIFT;
 
 	scctl2 = tv_mode->dda2_size << TV_SCDDA2_SIZE_SHIFT |
--- linux-rt-2.6.31.orig/drivers/gpu/drm/i915/i915_gem.c
+++ linux-rt-2.6.31/drivers/gpu/drm/i915/i915_gem.c
@@ -1151,27 +1151,21 @@
 	mutex_lock(&dev->struct_mutex);
 	if (!obj_priv->gtt_space) {
 		ret = i915_gem_object_bind_to_gtt(obj, obj_priv->gtt_alignment);
-		if (ret) {
-			mutex_unlock(&dev->struct_mutex);
-			return VM_FAULT_SIGBUS;
-		}
-
-		ret = i915_gem_object_set_to_gtt_domain(obj, write);
-		if (ret) {
-			mutex_unlock(&dev->struct_mutex);
-			return VM_FAULT_SIGBUS;
-		}
+		if (ret)
+			goto unlock;
 
 		list_add_tail(&obj_priv->list, &dev_priv->mm.inactive_list);
+
+		ret = i915_gem_object_set_to_gtt_domain(obj, write);
+		if (ret)
+			goto unlock;
 	}
 
 	/* Need a new fence register? */
 	if (obj_priv->tiling_mode != I915_TILING_NONE) {
 		ret = i915_gem_object_get_fence_reg(obj);
-		if (ret) {
-			mutex_unlock(&dev->struct_mutex);
-			return VM_FAULT_SIGBUS;
-		}
+		if (ret)
+			goto unlock;
 	}
 
 	pfn = ((dev->agp->base + obj_priv->gtt_offset) >> PAGE_SHIFT) +
@@ -1179,18 +1173,18 @@
 
 	/* Finally, remap it using the new GTT offset */
 	ret = vm_insert_pfn(vma, (unsigned long)vmf->virtual_address, pfn);
-
+unlock:
 	mutex_unlock(&dev->struct_mutex);
 
 	switch (ret) {
+	case 0:
+	case -ERESTARTSYS:
+		return VM_FAULT_NOPAGE;
 	case -ENOMEM:
 	case -EAGAIN:
 		return VM_FAULT_OOM;
-	case -EFAULT:
-	case -EINVAL:
-		return VM_FAULT_SIGBUS;
 	default:
-		return VM_FAULT_NOPAGE;
+		return VM_FAULT_SIGBUS;
 	}
 }
 
@@ -2506,16 +2500,6 @@
 	if (obj_priv->pages == NULL)
 		return;
 
-	/* XXX: The 865 in particular appears to be weird in how it handles
-	 * cache flushing.  We haven't figured it out, but the
-	 * clflush+agp_chipset_flush doesn't appear to successfully get the
-	 * data visible to the PGU, while wbinvd + agp_chipset_flush does.
-	 */
-	if (IS_I865G(obj->dev)) {
-		wbinvd();
-		return;
-	}
-
 	drm_clflush_pages(obj_priv->pages, obj->size / PAGE_SIZE);
 }
 
@@ -3007,6 +2991,16 @@
 			return -EINVAL;
 		}
 
+		if (reloc->delta >= target_obj->size) {
+			DRM_ERROR("Relocation beyond target object bounds: "
+				  "obj %p target %d delta %d size %d.\n",
+				  obj, reloc->target_handle,
+				  (int) reloc->delta, (int) target_obj->size);
+			drm_gem_object_unreference(target_obj);
+			i915_gem_object_unpin(obj);
+			return -EINVAL;
+		}
+
 		if (reloc->write_domain & I915_GEM_DOMAIN_CPU ||
 		    reloc->read_domains & I915_GEM_DOMAIN_CPU) {
 			DRM_ERROR("reloc with read/write CPU domains: "
@@ -3837,7 +3831,8 @@
 
 	i915_gem_object_unbind(obj);
 
-	i915_gem_free_mmap_offset(obj);
+	if (obj_priv->mmap_offset)
+		i915_gem_free_mmap_offset(obj);
 
 	kfree(obj_priv->page_cpu_valid);
 	kfree(obj_priv->bit_17);
--- linux-rt-2.6.31.orig/drivers/gpu/drm/i915/i915_suspend.c
+++ linux-rt-2.6.31/drivers/gpu/drm/i915/i915_suspend.c
@@ -32,11 +32,15 @@
 static bool i915_pipe_enabled(struct drm_device *dev, enum pipe pipe)
 {
 	struct drm_i915_private *dev_priv = dev->dev_private;
+	u32	dpll_reg;
 
-	if (pipe == PIPE_A)
-		return (I915_READ(DPLL_A) & DPLL_VCO_ENABLE);
-	else
-		return (I915_READ(DPLL_B) & DPLL_VCO_ENABLE);
+	if (IS_IGDNG(dev)) {
+		dpll_reg = (pipe == PIPE_A) ? PCH_DPLL_A: PCH_DPLL_B;
+	} else {
+		dpll_reg = (pipe == PIPE_A) ? DPLL_A: DPLL_B;
+	}
+
+	return (I915_READ(dpll_reg) & DPLL_VCO_ENABLE);
 }
 
 static void i915_save_palette(struct drm_device *dev, enum pipe pipe)
@@ -49,6 +53,9 @@
 	if (!i915_pipe_enabled(dev, pipe))
 		return;
 
+	if (IS_IGDNG(dev))
+		reg = (pipe == PIPE_A) ? LGC_PALETTE_A : LGC_PALETTE_B;
+
 	if (pipe == PIPE_A)
 		array = dev_priv->save_palette_a;
 	else
@@ -68,6 +75,9 @@
 	if (!i915_pipe_enabled(dev, pipe))
 		return;
 
+	if (IS_IGDNG(dev))
+		reg = (pipe == PIPE_A) ? LGC_PALETTE_A : LGC_PALETTE_B;
+
 	if (pipe == PIPE_A)
 		array = dev_priv->save_palette_a;
 	else
@@ -228,13 +238,25 @@
 
 	if (drm_core_check_feature(dev, DRIVER_MODESET))
 		return;
+
+	if (IS_IGDNG(dev)) {
+		dev_priv->savePCH_DREF_CONTROL = I915_READ(PCH_DREF_CONTROL);
+		dev_priv->saveDISP_ARB_CTL = I915_READ(DISP_ARB_CTL);
+	}
+
 	/* Pipe & plane A info */
 	dev_priv->savePIPEACONF = I915_READ(PIPEACONF);
 	dev_priv->savePIPEASRC = I915_READ(PIPEASRC);
-	dev_priv->saveFPA0 = I915_READ(FPA0);
-	dev_priv->saveFPA1 = I915_READ(FPA1);
-	dev_priv->saveDPLL_A = I915_READ(DPLL_A);
-	if (IS_I965G(dev))
+	if (IS_IGDNG(dev)) {
+		dev_priv->saveFPA0 = I915_READ(PCH_FPA0);
+		dev_priv->saveFPA1 = I915_READ(PCH_FPA1);
+		dev_priv->saveDPLL_A = I915_READ(PCH_DPLL_A);
+	} else {
+		dev_priv->saveFPA0 = I915_READ(FPA0);
+		dev_priv->saveFPA1 = I915_READ(FPA1);
+		dev_priv->saveDPLL_A = I915_READ(DPLL_A);
+	}
+	if (IS_I965G(dev) && !IS_IGDNG(dev))
 		dev_priv->saveDPLL_A_MD = I915_READ(DPLL_A_MD);
 	dev_priv->saveHTOTAL_A = I915_READ(HTOTAL_A);
 	dev_priv->saveHBLANK_A = I915_READ(HBLANK_A);
@@ -242,7 +264,30 @@
 	dev_priv->saveVTOTAL_A = I915_READ(VTOTAL_A);
 	dev_priv->saveVBLANK_A = I915_READ(VBLANK_A);
 	dev_priv->saveVSYNC_A = I915_READ(VSYNC_A);
-	dev_priv->saveBCLRPAT_A = I915_READ(BCLRPAT_A);
+	if (!IS_IGDNG(dev))
+		dev_priv->saveBCLRPAT_A = I915_READ(BCLRPAT_A);
+
+	if (IS_IGDNG(dev)) {
+		dev_priv->savePIPEA_DATA_M1 = I915_READ(PIPEA_DATA_M1);
+		dev_priv->savePIPEA_DATA_N1 = I915_READ(PIPEA_DATA_N1);
+		dev_priv->savePIPEA_LINK_M1 = I915_READ(PIPEA_LINK_M1);
+		dev_priv->savePIPEA_LINK_N1 = I915_READ(PIPEA_LINK_N1);
+
+		dev_priv->saveFDI_TXA_CTL = I915_READ(FDI_TXA_CTL);
+		dev_priv->saveFDI_RXA_CTL = I915_READ(FDI_RXA_CTL);
+
+		dev_priv->savePFA_CTL_1 = I915_READ(PFA_CTL_1);
+		dev_priv->savePFA_WIN_SZ = I915_READ(PFA_WIN_SZ);
+		dev_priv->savePFA_WIN_POS = I915_READ(PFA_WIN_POS);
+
+		dev_priv->saveTRANSACONF = I915_READ(TRANSACONF);
+		dev_priv->saveTRANS_HTOTAL_A = I915_READ(TRANS_HTOTAL_A);
+		dev_priv->saveTRANS_HBLANK_A = I915_READ(TRANS_HBLANK_A);
+		dev_priv->saveTRANS_HSYNC_A = I915_READ(TRANS_HSYNC_A);
+		dev_priv->saveTRANS_VTOTAL_A = I915_READ(TRANS_VTOTAL_A);
+		dev_priv->saveTRANS_VBLANK_A = I915_READ(TRANS_VBLANK_A);
+		dev_priv->saveTRANS_VSYNC_A = I915_READ(TRANS_VSYNC_A);
+	}
 
 	dev_priv->saveDSPACNTR = I915_READ(DSPACNTR);
 	dev_priv->saveDSPASTRIDE = I915_READ(DSPASTRIDE);
@@ -259,10 +304,16 @@
 	/* Pipe & plane B info */
 	dev_priv->savePIPEBCONF = I915_READ(PIPEBCONF);
 	dev_priv->savePIPEBSRC = I915_READ(PIPEBSRC);
-	dev_priv->saveFPB0 = I915_READ(FPB0);
-	dev_priv->saveFPB1 = I915_READ(FPB1);
-	dev_priv->saveDPLL_B = I915_READ(DPLL_B);
-	if (IS_I965G(dev))
+	if (IS_IGDNG(dev)) {
+		dev_priv->saveFPB0 = I915_READ(PCH_FPB0);
+		dev_priv->saveFPB1 = I915_READ(PCH_FPB1);
+		dev_priv->saveDPLL_B = I915_READ(PCH_DPLL_B);
+	} else {
+		dev_priv->saveFPB0 = I915_READ(FPB0);
+		dev_priv->saveFPB1 = I915_READ(FPB1);
+		dev_priv->saveDPLL_B = I915_READ(DPLL_B);
+	}
+	if (IS_I965G(dev) && !IS_IGDNG(dev))
 		dev_priv->saveDPLL_B_MD = I915_READ(DPLL_B_MD);
 	dev_priv->saveHTOTAL_B = I915_READ(HTOTAL_B);
 	dev_priv->saveHBLANK_B = I915_READ(HBLANK_B);
@@ -270,7 +321,30 @@
 	dev_priv->saveVTOTAL_B = I915_READ(VTOTAL_B);
 	dev_priv->saveVBLANK_B = I915_READ(VBLANK_B);
 	dev_priv->saveVSYNC_B = I915_READ(VSYNC_B);
-	dev_priv->saveBCLRPAT_A = I915_READ(BCLRPAT_A);
+	if (!IS_IGDNG(dev))
+		dev_priv->saveBCLRPAT_B = I915_READ(BCLRPAT_B);
+
+	if (IS_IGDNG(dev)) {
+		dev_priv->savePIPEB_DATA_M1 = I915_READ(PIPEB_DATA_M1);
+		dev_priv->savePIPEB_DATA_N1 = I915_READ(PIPEB_DATA_N1);
+		dev_priv->savePIPEB_LINK_M1 = I915_READ(PIPEB_LINK_M1);
+		dev_priv->savePIPEB_LINK_N1 = I915_READ(PIPEB_LINK_N1);
+
+		dev_priv->saveFDI_TXB_CTL = I915_READ(FDI_TXB_CTL);
+		dev_priv->saveFDI_RXB_CTL = I915_READ(FDI_RXB_CTL);
+
+		dev_priv->savePFB_CTL_1 = I915_READ(PFB_CTL_1);
+		dev_priv->savePFB_WIN_SZ = I915_READ(PFB_WIN_SZ);
+		dev_priv->savePFB_WIN_POS = I915_READ(PFB_WIN_POS);
+
+		dev_priv->saveTRANSBCONF = I915_READ(TRANSBCONF);
+		dev_priv->saveTRANS_HTOTAL_B = I915_READ(TRANS_HTOTAL_B);
+		dev_priv->saveTRANS_HBLANK_B = I915_READ(TRANS_HBLANK_B);
+		dev_priv->saveTRANS_HSYNC_B = I915_READ(TRANS_HSYNC_B);
+		dev_priv->saveTRANS_VTOTAL_B = I915_READ(TRANS_VTOTAL_B);
+		dev_priv->saveTRANS_VBLANK_B = I915_READ(TRANS_VBLANK_B);
+		dev_priv->saveTRANS_VSYNC_B = I915_READ(TRANS_VSYNC_B);
+	}
 
 	dev_priv->saveDSPBCNTR = I915_READ(DSPBCNTR);
 	dev_priv->saveDSPBSTRIDE = I915_READ(DSPBSTRIDE);
@@ -285,26 +359,50 @@
 	dev_priv->savePIPEBSTAT = I915_READ(PIPEBSTAT);
 	return;
 }
+
 static void i915_restore_modeset_reg(struct drm_device *dev)
 {
 	struct drm_i915_private *dev_priv = dev->dev_private;
+	int dpll_a_reg, fpa0_reg, fpa1_reg;
+	int dpll_b_reg, fpb0_reg, fpb1_reg;
 
 	if (drm_core_check_feature(dev, DRIVER_MODESET))
 		return;
 
+	if (IS_IGDNG(dev)) {
+		dpll_a_reg = PCH_DPLL_A;
+		dpll_b_reg = PCH_DPLL_B;
+		fpa0_reg = PCH_FPA0;
+		fpb0_reg = PCH_FPB0;
+		fpa1_reg = PCH_FPA1;
+		fpb1_reg = PCH_FPB1;
+	} else {
+		dpll_a_reg = DPLL_A;
+		dpll_b_reg = DPLL_B;
+		fpa0_reg = FPA0;
+		fpb0_reg = FPB0;
+		fpa1_reg = FPA1;
+		fpb1_reg = FPB1;
+	}
+
+	if (IS_IGDNG(dev)) {
+		I915_WRITE(PCH_DREF_CONTROL, dev_priv->savePCH_DREF_CONTROL);
+		I915_WRITE(DISP_ARB_CTL, dev_priv->saveDISP_ARB_CTL);
+	}
+
 	/* Pipe & plane A info */
 	/* Prime the clock */
 	if (dev_priv->saveDPLL_A & DPLL_VCO_ENABLE) {
-		I915_WRITE(DPLL_A, dev_priv->saveDPLL_A &
+		I915_WRITE(dpll_a_reg, dev_priv->saveDPLL_A &
 			   ~DPLL_VCO_ENABLE);
 		DRM_UDELAY(150);
 	}
-	I915_WRITE(FPA0, dev_priv->saveFPA0);
-	I915_WRITE(FPA1, dev_priv->saveFPA1);
+	I915_WRITE(fpa0_reg, dev_priv->saveFPA0);
+	I915_WRITE(fpa1_reg, dev_priv->saveFPA1);
 	/* Actually enable it */
-	I915_WRITE(DPLL_A, dev_priv->saveDPLL_A);
+	I915_WRITE(dpll_a_reg, dev_priv->saveDPLL_A);
 	DRM_UDELAY(150);
-	if (IS_I965G(dev))
+	if (IS_I965G(dev) && !IS_IGDNG(dev))
 		I915_WRITE(DPLL_A_MD, dev_priv->saveDPLL_A_MD);
 	DRM_UDELAY(150);
 
@@ -315,7 +413,30 @@
 	I915_WRITE(VTOTAL_A, dev_priv->saveVTOTAL_A);
 	I915_WRITE(VBLANK_A, dev_priv->saveVBLANK_A);
 	I915_WRITE(VSYNC_A, dev_priv->saveVSYNC_A);
-	I915_WRITE(BCLRPAT_A, dev_priv->saveBCLRPAT_A);
+	if (!IS_IGDNG(dev))
+		I915_WRITE(BCLRPAT_A, dev_priv->saveBCLRPAT_A);
+
+	if (IS_IGDNG(dev)) {
+		I915_WRITE(PIPEA_DATA_M1, dev_priv->savePIPEA_DATA_M1);
+		I915_WRITE(PIPEA_DATA_N1, dev_priv->savePIPEA_DATA_N1);
+		I915_WRITE(PIPEA_LINK_M1, dev_priv->savePIPEA_LINK_M1);
+		I915_WRITE(PIPEA_LINK_N1, dev_priv->savePIPEA_LINK_N1);
+
+		I915_WRITE(FDI_RXA_CTL, dev_priv->saveFDI_RXA_CTL);
+		I915_WRITE(FDI_TXA_CTL, dev_priv->saveFDI_TXA_CTL);
+
+		I915_WRITE(PFA_CTL_1, dev_priv->savePFA_CTL_1);
+		I915_WRITE(PFA_WIN_SZ, dev_priv->savePFA_WIN_SZ);
+		I915_WRITE(PFA_WIN_POS, dev_priv->savePFA_WIN_POS);
+
+		I915_WRITE(TRANSACONF, dev_priv->saveTRANSACONF);
+		I915_WRITE(TRANS_HTOTAL_A, dev_priv->saveTRANS_HTOTAL_A);
+		I915_WRITE(TRANS_HBLANK_A, dev_priv->saveTRANS_HBLANK_A);
+		I915_WRITE(TRANS_HSYNC_A, dev_priv->saveTRANS_HSYNC_A);
+		I915_WRITE(TRANS_VTOTAL_A, dev_priv->saveTRANS_VTOTAL_A);
+		I915_WRITE(TRANS_VBLANK_A, dev_priv->saveTRANS_VBLANK_A);
+		I915_WRITE(TRANS_VSYNC_A, dev_priv->saveTRANS_VSYNC_A);
+	}
 
 	/* Restore plane info */
 	I915_WRITE(DSPASIZE, dev_priv->saveDSPASIZE);
@@ -337,16 +458,16 @@
 
 	/* Pipe & plane B info */
 	if (dev_priv->saveDPLL_B & DPLL_VCO_ENABLE) {
-		I915_WRITE(DPLL_B, dev_priv->saveDPLL_B &
+		I915_WRITE(dpll_b_reg, dev_priv->saveDPLL_B &
 			   ~DPLL_VCO_ENABLE);
 		DRM_UDELAY(150);
 	}
-	I915_WRITE(FPB0, dev_priv->saveFPB0);
-	I915_WRITE(FPB1, dev_priv->saveFPB1);
+	I915_WRITE(fpb0_reg, dev_priv->saveFPB0);
+	I915_WRITE(fpb1_reg, dev_priv->saveFPB1);
 	/* Actually enable it */
-	I915_WRITE(DPLL_B, dev_priv->saveDPLL_B);
+	I915_WRITE(dpll_b_reg, dev_priv->saveDPLL_B);
 	DRM_UDELAY(150);
-	if (IS_I965G(dev))
+	if (IS_I965G(dev) && !IS_IGDNG(dev))
 		I915_WRITE(DPLL_B_MD, dev_priv->saveDPLL_B_MD);
 	DRM_UDELAY(150);
 
@@ -357,7 +478,30 @@
 	I915_WRITE(VTOTAL_B, dev_priv->saveVTOTAL_B);
 	I915_WRITE(VBLANK_B, dev_priv->saveVBLANK_B);
 	I915_WRITE(VSYNC_B, dev_priv->saveVSYNC_B);
-	I915_WRITE(BCLRPAT_B, dev_priv->saveBCLRPAT_B);
+	if (!IS_IGDNG(dev))
+		I915_WRITE(BCLRPAT_B, dev_priv->saveBCLRPAT_B);
+
+	if (IS_IGDNG(dev)) {
+		I915_WRITE(PIPEB_DATA_M1, dev_priv->savePIPEB_DATA_M1);
+		I915_WRITE(PIPEB_DATA_N1, dev_priv->savePIPEB_DATA_N1);
+		I915_WRITE(PIPEB_LINK_M1, dev_priv->savePIPEB_LINK_M1);
+		I915_WRITE(PIPEB_LINK_N1, dev_priv->savePIPEB_LINK_N1);
+
+		I915_WRITE(FDI_RXB_CTL, dev_priv->saveFDI_RXB_CTL);
+		I915_WRITE(FDI_TXB_CTL, dev_priv->saveFDI_TXB_CTL);
+
+		I915_WRITE(PFB_CTL_1, dev_priv->savePFB_CTL_1);
+		I915_WRITE(PFB_WIN_SZ, dev_priv->savePFB_WIN_SZ);
+		I915_WRITE(PFB_WIN_POS, dev_priv->savePFB_WIN_POS);
+
+		I915_WRITE(TRANSBCONF, dev_priv->saveTRANSBCONF);
+		I915_WRITE(TRANS_HTOTAL_B, dev_priv->saveTRANS_HTOTAL_B);
+		I915_WRITE(TRANS_HBLANK_B, dev_priv->saveTRANS_HBLANK_B);
+		I915_WRITE(TRANS_HSYNC_B, dev_priv->saveTRANS_HSYNC_B);
+		I915_WRITE(TRANS_VTOTAL_B, dev_priv->saveTRANS_VTOTAL_B);
+		I915_WRITE(TRANS_VBLANK_B, dev_priv->saveTRANS_VBLANK_B);
+		I915_WRITE(TRANS_VSYNC_B, dev_priv->saveTRANS_VSYNC_B);
+	}
 
 	/* Restore plane info */
 	I915_WRITE(DSPBSIZE, dev_priv->saveDSPBSIZE);
@@ -379,19 +523,10 @@
 
 	return;
 }
-int i915_save_state(struct drm_device *dev)
+
+void i915_save_display(struct drm_device *dev)
 {
 	struct drm_i915_private *dev_priv = dev->dev_private;
-	int i;
-
-	pci_read_config_byte(dev->pdev, LBB, &dev_priv->saveLBB);
-
-	/* Render Standby */
-	if (IS_I965G(dev) && IS_MOBILE(dev))
-		dev_priv->saveRENDERSTANDBY = I915_READ(MCHBAR_RENDER_STANDBY);
-
-	/* Hardware status page */
-	dev_priv->saveHWS = I915_READ(HWS_PGA);
 
 	/* Display arbitration control */
 	dev_priv->saveDSPARB = I915_READ(DSPARB);
@@ -399,6 +534,7 @@
 	/* This is only meaningful in non-KMS mode */
 	/* Don't save them in KMS mode */
 	i915_save_modeset_reg(dev);
+
 	/* Cursor state */
 	dev_priv->saveCURACNTR = I915_READ(CURACNTR);
 	dev_priv->saveCURAPOS = I915_READ(CURAPOS);
@@ -410,21 +546,43 @@
 		dev_priv->saveCURSIZE = I915_READ(CURSIZE);
 
 	/* CRT state */
-	dev_priv->saveADPA = I915_READ(ADPA);
+	if (IS_IGDNG(dev)) {
+		dev_priv->saveADPA = I915_READ(PCH_ADPA);
+	} else {
+		dev_priv->saveADPA = I915_READ(ADPA);
+	}
 
 	/* LVDS state */
-	dev_priv->savePP_CONTROL = I915_READ(PP_CONTROL);
-	dev_priv->savePFIT_PGM_RATIOS = I915_READ(PFIT_PGM_RATIOS);
-	dev_priv->saveBLC_PWM_CTL = I915_READ(BLC_PWM_CTL);
-	if (IS_I965G(dev))
-		dev_priv->saveBLC_PWM_CTL2 = I915_READ(BLC_PWM_CTL2);
-	if (IS_MOBILE(dev) && !IS_I830(dev))
-		dev_priv->saveLVDS = I915_READ(LVDS);
-	if (!IS_I830(dev) && !IS_845G(dev))
+	if (IS_IGDNG(dev)) {
+		dev_priv->savePP_CONTROL = I915_READ(PCH_PP_CONTROL);
+		dev_priv->saveBLC_PWM_CTL = I915_READ(BLC_PWM_PCH_CTL1);
+		dev_priv->saveBLC_PWM_CTL2 = I915_READ(BLC_PWM_PCH_CTL2);
+		dev_priv->saveBLC_CPU_PWM_CTL = I915_READ(BLC_PWM_CPU_CTL);
+		dev_priv->saveBLC_CPU_PWM_CTL2 = I915_READ(BLC_PWM_CPU_CTL2);
+		dev_priv->saveLVDS = I915_READ(PCH_LVDS);
+	} else {
+		dev_priv->savePP_CONTROL = I915_READ(PP_CONTROL);
+		dev_priv->savePFIT_PGM_RATIOS = I915_READ(PFIT_PGM_RATIOS);
+		dev_priv->saveBLC_PWM_CTL = I915_READ(BLC_PWM_CTL);
+		dev_priv->saveBLC_HIST_CTL = I915_READ(BLC_HIST_CTL);
+		if (IS_I965G(dev))
+			dev_priv->saveBLC_PWM_CTL2 = I915_READ(BLC_PWM_CTL2);
+		if (IS_MOBILE(dev) && !IS_I830(dev))
+			dev_priv->saveLVDS = I915_READ(LVDS);
+	}
+
+	if (!IS_I830(dev) && !IS_845G(dev) && !IS_IGDNG(dev))
 		dev_priv->savePFIT_CONTROL = I915_READ(PFIT_CONTROL);
-	dev_priv->savePP_ON_DELAYS = I915_READ(PP_ON_DELAYS);
-	dev_priv->savePP_OFF_DELAYS = I915_READ(PP_OFF_DELAYS);
-	dev_priv->savePP_DIVISOR = I915_READ(PP_DIVISOR);
+
+	if (IS_IGDNG(dev)) {
+		dev_priv->savePP_ON_DELAYS = I915_READ(PCH_PP_ON_DELAYS);
+		dev_priv->savePP_OFF_DELAYS = I915_READ(PCH_PP_OFF_DELAYS);
+		dev_priv->savePP_DIVISOR = I915_READ(PCH_PP_DIVISOR);
+	} else {
+		dev_priv->savePP_ON_DELAYS = I915_READ(PP_ON_DELAYS);
+		dev_priv->savePP_OFF_DELAYS = I915_READ(PP_OFF_DELAYS);
+		dev_priv->savePP_DIVISOR = I915_READ(PP_DIVISOR);
+	}
 
 	/* Display Port state */
 	if (SUPPORTS_INTEGRATED_DP(dev)) {
@@ -448,16 +606,143 @@
 	dev_priv->saveFBC_CONTROL2 = I915_READ(FBC_CONTROL2);
 	dev_priv->saveFBC_CONTROL = I915_READ(FBC_CONTROL);
 
-	/* Interrupt state */
-	dev_priv->saveIIR = I915_READ(IIR);
-	dev_priv->saveIER = I915_READ(IER);
-	dev_priv->saveIMR = I915_READ(IMR);
-
 	/* VGA state */
 	dev_priv->saveVGA0 = I915_READ(VGA0);
 	dev_priv->saveVGA1 = I915_READ(VGA1);
 	dev_priv->saveVGA_PD = I915_READ(VGA_PD);
-	dev_priv->saveVGACNTRL = I915_READ(VGACNTRL);
+	if (IS_IGDNG(dev))
+		dev_priv->saveVGACNTRL = I915_READ(CPU_VGACNTRL);
+	else
+		dev_priv->saveVGACNTRL = I915_READ(VGACNTRL);
+
+	i915_save_vga(dev);
+}
+
+void i915_restore_display(struct drm_device *dev)
+{
+	struct drm_i915_private *dev_priv = dev->dev_private;
+
+	/* Display arbitration */
+	I915_WRITE(DSPARB, dev_priv->saveDSPARB);
+
+	/* Display port ratios (must be done before clock is set) */
+	if (SUPPORTS_INTEGRATED_DP(dev)) {
+		I915_WRITE(PIPEA_GMCH_DATA_M, dev_priv->savePIPEA_GMCH_DATA_M);
+		I915_WRITE(PIPEB_GMCH_DATA_M, dev_priv->savePIPEB_GMCH_DATA_M);
+		I915_WRITE(PIPEA_GMCH_DATA_N, dev_priv->savePIPEA_GMCH_DATA_N);
+		I915_WRITE(PIPEB_GMCH_DATA_N, dev_priv->savePIPEB_GMCH_DATA_N);
+		I915_WRITE(PIPEA_DP_LINK_M, dev_priv->savePIPEA_DP_LINK_M);
+		I915_WRITE(PIPEB_DP_LINK_M, dev_priv->savePIPEB_DP_LINK_M);
+		I915_WRITE(PIPEA_DP_LINK_N, dev_priv->savePIPEA_DP_LINK_N);
+		I915_WRITE(PIPEB_DP_LINK_N, dev_priv->savePIPEB_DP_LINK_N);
+	}
+
+	/* This is only meaningful in non-KMS mode */
+	/* Don't restore them in KMS mode */
+	i915_restore_modeset_reg(dev);
+
+	/* Cursor state */
+	I915_WRITE(CURAPOS, dev_priv->saveCURAPOS);
+	I915_WRITE(CURACNTR, dev_priv->saveCURACNTR);
+	I915_WRITE(CURABASE, dev_priv->saveCURABASE);
+	I915_WRITE(CURBPOS, dev_priv->saveCURBPOS);
+	I915_WRITE(CURBCNTR, dev_priv->saveCURBCNTR);
+	I915_WRITE(CURBBASE, dev_priv->saveCURBBASE);
+	if (!IS_I9XX(dev))
+		I915_WRITE(CURSIZE, dev_priv->saveCURSIZE);
+
+	/* CRT state */
+	if (IS_IGDNG(dev))
+		I915_WRITE(PCH_ADPA, dev_priv->saveADPA);
+	else
+		I915_WRITE(ADPA, dev_priv->saveADPA);
+
+	/* LVDS state */
+	if (IS_I965G(dev) && !IS_IGDNG(dev))
+		I915_WRITE(BLC_PWM_CTL2, dev_priv->saveBLC_PWM_CTL2);
+
+	if (IS_IGDNG(dev)) {
+		I915_WRITE(PCH_LVDS, dev_priv->saveLVDS);
+	} else if (IS_MOBILE(dev) && !IS_I830(dev))
+		I915_WRITE(LVDS, dev_priv->saveLVDS);
+
+	if (!IS_I830(dev) && !IS_845G(dev) && !IS_IGDNG(dev))
+		I915_WRITE(PFIT_CONTROL, dev_priv->savePFIT_CONTROL);
+
+	if (IS_IGDNG(dev)) {
+		I915_WRITE(BLC_PWM_PCH_CTL1, dev_priv->saveBLC_PWM_CTL);
+		I915_WRITE(BLC_PWM_PCH_CTL2, dev_priv->saveBLC_PWM_CTL2);
+		I915_WRITE(BLC_PWM_CPU_CTL, dev_priv->saveBLC_CPU_PWM_CTL);
+		I915_WRITE(BLC_PWM_CPU_CTL2, dev_priv->saveBLC_CPU_PWM_CTL2);
+		I915_WRITE(PCH_PP_ON_DELAYS, dev_priv->savePP_ON_DELAYS);
+		I915_WRITE(PCH_PP_OFF_DELAYS, dev_priv->savePP_OFF_DELAYS);
+		I915_WRITE(PCH_PP_DIVISOR, dev_priv->savePP_DIVISOR);
+		I915_WRITE(PCH_PP_CONTROL, dev_priv->savePP_CONTROL);
+	} else {
+		I915_WRITE(PFIT_PGM_RATIOS, dev_priv->savePFIT_PGM_RATIOS);
+		I915_WRITE(BLC_PWM_CTL, dev_priv->saveBLC_PWM_CTL);
+		I915_WRITE(BLC_HIST_CTL, dev_priv->saveBLC_HIST_CTL);
+		I915_WRITE(PP_ON_DELAYS, dev_priv->savePP_ON_DELAYS);
+		I915_WRITE(PP_OFF_DELAYS, dev_priv->savePP_OFF_DELAYS);
+		I915_WRITE(PP_DIVISOR, dev_priv->savePP_DIVISOR);
+		I915_WRITE(PP_CONTROL, dev_priv->savePP_CONTROL);
+	}
+
+	/* Display Port state */
+	if (SUPPORTS_INTEGRATED_DP(dev)) {
+		I915_WRITE(DP_B, dev_priv->saveDP_B);
+		I915_WRITE(DP_C, dev_priv->saveDP_C);
+		I915_WRITE(DP_D, dev_priv->saveDP_D);
+	}
+	/* FIXME: restore TV & SDVO state */
+
+	/* FBC info */
+	I915_WRITE(FBC_CFB_BASE, dev_priv->saveFBC_CFB_BASE);
+	I915_WRITE(FBC_LL_BASE, dev_priv->saveFBC_LL_BASE);
+	I915_WRITE(FBC_CONTROL2, dev_priv->saveFBC_CONTROL2);
+	I915_WRITE(FBC_CONTROL, dev_priv->saveFBC_CONTROL);
+
+	/* VGA state */
+	if (IS_IGDNG(dev))
+		I915_WRITE(CPU_VGACNTRL, dev_priv->saveVGACNTRL);
+	else
+		I915_WRITE(VGACNTRL, dev_priv->saveVGACNTRL);
+	I915_WRITE(VGA0, dev_priv->saveVGA0);
+	I915_WRITE(VGA1, dev_priv->saveVGA1);
+	I915_WRITE(VGA_PD, dev_priv->saveVGA_PD);
+	DRM_UDELAY(150);
+
+	i915_restore_vga(dev);
+}
+
+int i915_save_state(struct drm_device *dev)
+{
+	struct drm_i915_private *dev_priv = dev->dev_private;
+	int i;
+
+	pci_read_config_byte(dev->pdev, LBB, &dev_priv->saveLBB);
+
+	/* Render Standby */
+	if (IS_I965G(dev) && IS_MOBILE(dev))
+		dev_priv->saveRENDERSTANDBY = I915_READ(MCHBAR_RENDER_STANDBY);
+
+	/* Hardware status page */
+	dev_priv->saveHWS = I915_READ(HWS_PGA);
+
+	i915_save_display(dev);
+
+	/* Interrupt state */
+	if (IS_IGDNG(dev)) {
+		dev_priv->saveDEIER = I915_READ(DEIER);
+		dev_priv->saveDEIMR = I915_READ(DEIMR);
+		dev_priv->saveGTIER = I915_READ(GTIER);
+		dev_priv->saveGTIMR = I915_READ(GTIMR);
+		dev_priv->saveFDI_RXA_IMR = I915_READ(FDI_RXA_IMR);
+		dev_priv->saveFDI_RXB_IMR = I915_READ(FDI_RXB_IMR);
+	} else {
+		dev_priv->saveIER = I915_READ(IER);
+		dev_priv->saveIMR = I915_READ(IMR);
+	}
 
 	/* Clock gating state */
 	dev_priv->saveD_STATE = I915_READ(D_STATE);
@@ -489,7 +774,6 @@
 			for (i = 0; i < 8; i++)
 				dev_priv->saveFENCE[i+8] = I915_READ(FENCE_REG_945_8 + (i * 4));
 	}
-	i915_save_vga(dev);
 
 	return 0;
 }
@@ -508,9 +792,6 @@
 	/* Hardware status page */
 	I915_WRITE(HWS_PGA, dev_priv->saveHWS);
 
-	/* Display arbitration */
-	I915_WRITE(DSPARB, dev_priv->saveDSPARB);
-
 	/* Fences */
 	if (IS_I965G(dev)) {
 		for (i = 0; i < 16; i++)
@@ -522,69 +803,21 @@
 			for (i = 0; i < 8; i++)
 				I915_WRITE(FENCE_REG_945_8 + (i * 4), dev_priv->saveFENCE[i+8]);
 	}
-	
-	/* Display port ratios (must be done before clock is set) */
-	if (SUPPORTS_INTEGRATED_DP(dev)) {
-		I915_WRITE(PIPEA_GMCH_DATA_M, dev_priv->savePIPEA_GMCH_DATA_M);
-		I915_WRITE(PIPEB_GMCH_DATA_M, dev_priv->savePIPEB_GMCH_DATA_M);
-		I915_WRITE(PIPEA_GMCH_DATA_N, dev_priv->savePIPEA_GMCH_DATA_N);
-		I915_WRITE(PIPEB_GMCH_DATA_N, dev_priv->savePIPEB_GMCH_DATA_N);
-		I915_WRITE(PIPEA_DP_LINK_M, dev_priv->savePIPEA_DP_LINK_M);
-		I915_WRITE(PIPEB_DP_LINK_M, dev_priv->savePIPEB_DP_LINK_M);
-		I915_WRITE(PIPEA_DP_LINK_N, dev_priv->savePIPEA_DP_LINK_N);
-		I915_WRITE(PIPEB_DP_LINK_N, dev_priv->savePIPEB_DP_LINK_N);
-	}
-	/* This is only meaningful in non-KMS mode */
-	/* Don't restore them in KMS mode */
-	i915_restore_modeset_reg(dev);
-	/* Cursor state */
-	I915_WRITE(CURAPOS, dev_priv->saveCURAPOS);
-	I915_WRITE(CURACNTR, dev_priv->saveCURACNTR);
-	I915_WRITE(CURABASE, dev_priv->saveCURABASE);
-	I915_WRITE(CURBPOS, dev_priv->saveCURBPOS);
-	I915_WRITE(CURBCNTR, dev_priv->saveCURBCNTR);
-	I915_WRITE(CURBBASE, dev_priv->saveCURBBASE);
-	if (!IS_I9XX(dev))
-		I915_WRITE(CURSIZE, dev_priv->saveCURSIZE);
 
-	/* CRT state */
-	I915_WRITE(ADPA, dev_priv->saveADPA);
+	i915_restore_display(dev);
 
-	/* LVDS state */
-	if (IS_I965G(dev))
-		I915_WRITE(BLC_PWM_CTL2, dev_priv->saveBLC_PWM_CTL2);
-	if (IS_MOBILE(dev) && !IS_I830(dev))
-		I915_WRITE(LVDS, dev_priv->saveLVDS);
-	if (!IS_I830(dev) && !IS_845G(dev))
-		I915_WRITE(PFIT_CONTROL, dev_priv->savePFIT_CONTROL);
-
-	I915_WRITE(PFIT_PGM_RATIOS, dev_priv->savePFIT_PGM_RATIOS);
-	I915_WRITE(BLC_PWM_CTL, dev_priv->saveBLC_PWM_CTL);
-	I915_WRITE(PP_ON_DELAYS, dev_priv->savePP_ON_DELAYS);
-	I915_WRITE(PP_OFF_DELAYS, dev_priv->savePP_OFF_DELAYS);
-	I915_WRITE(PP_DIVISOR, dev_priv->savePP_DIVISOR);
-	I915_WRITE(PP_CONTROL, dev_priv->savePP_CONTROL);
-
-	/* Display Port state */
-	if (SUPPORTS_INTEGRATED_DP(dev)) {
-		I915_WRITE(DP_B, dev_priv->saveDP_B);
-		I915_WRITE(DP_C, dev_priv->saveDP_C);
-		I915_WRITE(DP_D, dev_priv->saveDP_D);
+	/* Interrupt state */
+	if (IS_IGDNG(dev)) {
+		I915_WRITE(DEIER, dev_priv->saveDEIER);
+		I915_WRITE(DEIMR, dev_priv->saveDEIMR);
+		I915_WRITE(GTIER, dev_priv->saveGTIER);
+		I915_WRITE(GTIMR, dev_priv->saveGTIMR);
+		I915_WRITE(FDI_RXA_IMR, dev_priv->saveFDI_RXA_IMR);
+		I915_WRITE(FDI_RXB_IMR, dev_priv->saveFDI_RXB_IMR);
+	} else {
+		I915_WRITE (IER, dev_priv->saveIER);
+		I915_WRITE (IMR,  dev_priv->saveIMR);
 	}
-	/* FIXME: restore TV & SDVO state */
-
-	/* FBC info */
-	I915_WRITE(FBC_CFB_BASE, dev_priv->saveFBC_CFB_BASE);
-	I915_WRITE(FBC_LL_BASE, dev_priv->saveFBC_LL_BASE);
-	I915_WRITE(FBC_CONTROL2, dev_priv->saveFBC_CONTROL2);
-	I915_WRITE(FBC_CONTROL, dev_priv->saveFBC_CONTROL);
-
-	/* VGA state */
-	I915_WRITE(VGACNTRL, dev_priv->saveVGACNTRL);
-	I915_WRITE(VGA0, dev_priv->saveVGA0);
-	I915_WRITE(VGA1, dev_priv->saveVGA1);
-	I915_WRITE(VGA_PD, dev_priv->saveVGA_PD);
-	DRM_UDELAY(150);
 
 	/* Clock gating state */
 	I915_WRITE (D_STATE, dev_priv->saveD_STATE);
@@ -603,8 +836,6 @@
 	for (i = 0; i < 3; i++)
 		I915_WRITE(SWF30 + (i << 2), dev_priv->saveSWF2[i]);
 
-	i915_restore_vga(dev);
-
 	return 0;
 }
 
--- linux-rt-2.6.31.orig/drivers/gpu/drm/i915/intel_dp.c
+++ linux-rt-2.6.31/drivers/gpu/drm/i915/intel_dp.c
@@ -400,7 +400,7 @@
 {
 	struct intel_dp_priv   *dp_priv = intel_output->dev_priv;
 
-	DRM_ERROR("i2c_init %s\n", name);
+	DRM_INFO("i2c_init %s\n", name);
 	dp_priv->algo.running = false;
 	dp_priv->algo.address = 0;
 	dp_priv->algo.aux_ch = intel_dp_i2c_aux_ch;
--- linux-rt-2.6.31.orig/drivers/gpu/drm/i915/intel_crt.c
+++ linux-rt-2.6.31/drivers/gpu/drm/i915/intel_crt.c
@@ -151,13 +151,10 @@
 {
 	struct drm_device *dev = connector->dev;
 	struct drm_i915_private *dev_priv = dev->dev_private;
-	u32 adpa, temp;
+	u32 adpa;
 	bool ret;
 
-	temp = adpa = I915_READ(PCH_ADPA);
-
-	adpa &= ~ADPA_DAC_ENABLE;
-	I915_WRITE(PCH_ADPA, adpa);
+	adpa = I915_READ(PCH_ADPA);
 
 	adpa &= ~ADPA_CRT_HOTPLUG_MASK;
 
@@ -184,8 +181,6 @@
 	else
 		ret = false;
 
-	/* restore origin register */
-	I915_WRITE(PCH_ADPA, temp);
 	return ret;
 }
 
@@ -239,8 +234,8 @@
 		} while (time_after(timeout, jiffies));
 	}
 
-	if ((I915_READ(PORT_HOTPLUG_STAT) & CRT_HOTPLUG_MONITOR_MASK) ==
-	    CRT_HOTPLUG_MONITOR_COLOR)
+	if ((I915_READ(PORT_HOTPLUG_STAT) & CRT_HOTPLUG_MONITOR_MASK) !=
+	    CRT_HOTPLUG_MONITOR_NONE)
 		return true;
 
 	return false;
--- linux-rt-2.6.31.orig/drivers/gpu/drm/i915/i915_reg.h
+++ linux-rt-2.6.31/drivers/gpu/drm/i915/i915_reg.h
@@ -915,6 +915,8 @@
 #define   BACKLIGHT_DUTY_CYCLE_SHIFT		(0)
 #define   BACKLIGHT_DUTY_CYCLE_MASK		(0xffff)
 
+#define BLC_HIST_CTL		0x61260
+
 /* TV port control */
 #define TV_CTL			0x68000
 /** Enables the TV encoder */
@@ -1616,6 +1618,11 @@
 #define   PIPE_START_VBLANK_INTERRUPT_STATUS	(1UL<<2) /* 965 or later */
 #define   PIPE_VBLANK_INTERRUPT_STATUS		(1UL<<1)
 #define   PIPE_OVERLAY_UPDATED_STATUS		(1UL<<0)
+#define   PIPE_BPC_MASK 			(7 << 5) /* Ironlake */
+#define   PIPE_8BPC				(0 << 5)
+#define   PIPE_10BPC				(1 << 5)
+#define   PIPE_6BPC				(2 << 5)
+#define   PIPE_12BPC				(3 << 5)
 
 #define DSPARB			0x70030
 #define   DSPARB_CSTART_MASK	(0x7f << 7)
@@ -1733,6 +1740,7 @@
 #define   DISPPLANE_NO_LINE_DOUBLE		0
 #define   DISPPLANE_STEREO_POLARITY_FIRST	0
 #define   DISPPLANE_STEREO_POLARITY_SECOND	(1<<18)
+#define   DISPPLANE_TRICKLE_FEED_DISABLE	(1<<14) /* IGDNG */
 #define   DISPPLANE_TILED			(1<<10)
 #define DSPAADDR		0x70184
 #define DSPASTRIDE		0x70188
@@ -1865,8 +1873,15 @@
 #define PFA_CTL_1               0x68080
 #define PFB_CTL_1               0x68880
 #define  PF_ENABLE              (1<<31)
+#define  PF_FILTER_MASK		(3<<23)
+#define  PF_FILTER_PROGRAMMED	(0<<23)
+#define  PF_FILTER_MED_3x3	(1<<23)
+#define  PF_FILTER_EDGE_ENHANCE	(2<<23)
+#define  PF_FILTER_EDGE_SOFTEN	(3<<23)
 #define PFA_WIN_SZ		0x68074
 #define PFB_WIN_SZ		0x68874
+#define PFA_WIN_POS		0x68070
+#define PFB_WIN_POS		0x68870
 
 /* legacy palette */
 #define LGC_PALETTE_A           0x4a000
@@ -1913,6 +1928,9 @@
 #define GTIIR   0x44018
 #define GTIER   0x4401c
 
+#define DISP_ARB_CTL	0x45000
+#define  DISP_TILE_SURFACE_SWIZZLING	(1<<13)
+
 /* PCH */
 
 /* south display engine interrupt */
@@ -1921,6 +1939,7 @@
 #define SDE_PORTC_HOTPLUG       (1 << 9)
 #define SDE_PORTB_HOTPLUG       (1 << 8)
 #define SDE_SDVOB_HOTPLUG       (1 << 6)
+#define SDE_HOTPLUG_MASK	(0xf << 8)
 
 #define SDEISR  0xc4000
 #define SDEIMR  0xc4004
@@ -1979,11 +1998,11 @@
 #define  DREF_CPU_SOURCE_OUTPUT_MASK		(3<<13)
 #define  DREF_SSC_SOURCE_DISABLE                (0<<11)
 #define  DREF_SSC_SOURCE_ENABLE                 (2<<11)
-#define  DREF_SSC_SOURCE_MASK			(2<<11)
+#define  DREF_SSC_SOURCE_MASK			(3<<11)
 #define  DREF_NONSPREAD_SOURCE_DISABLE          (0<<9)
 #define  DREF_NONSPREAD_CK505_ENABLE		(1<<9)
 #define  DREF_NONSPREAD_SOURCE_ENABLE           (2<<9)
-#define  DREF_NONSPREAD_SOURCE_MASK		(2<<9)
+#define  DREF_NONSPREAD_SOURCE_MASK		(3<<9)
 #define  DREF_SUPERSPREAD_SOURCE_DISABLE        (0<<7)
 #define  DREF_SUPERSPREAD_SOURCE_ENABLE         (2<<7)
 #define  DREF_SSC4_DOWNSPREAD                   (0<<6)
--- linux-rt-2.6.31.orig/drivers/gpu/drm/i915/intel_lvds.c
+++ linux-rt-2.6.31/drivers/gpu/drm/i915/intel_lvds.c
@@ -305,6 +305,10 @@
 		goto out;
 	}
 
+	/* full screen scale for now */
+	if (IS_IGDNG(dev))
+		goto out;
+
 	/* 965+ wants fuzzy fitting */
 	if (IS_I965G(dev))
 		pfit_control |= (intel_crtc->pipe << PFIT_PIPE_SHIFT) |
@@ -332,8 +336,10 @@
 	 * to register description and PRM.
 	 * Change the value here to see the borders for debugging
 	 */
-	I915_WRITE(BCLRPAT_A, 0);
-	I915_WRITE(BCLRPAT_B, 0);
+	if (!IS_IGDNG(dev)) {
+		I915_WRITE(BCLRPAT_A, 0);
+		I915_WRITE(BCLRPAT_B, 0);
+	}
 
 	switch (lvds_priv->fitting_mode) {
 	case DRM_MODE_SCALE_NO_SCALE:
@@ -582,7 +588,6 @@
 	 * settings.
 	 */
 
-	/* No panel fitting yet, fixme */
 	if (IS_IGDNG(dev))
 		return;
 
--- linux-rt-2.6.31.orig/drivers/gpu/drm/i915/i915_drv.h
+++ linux-rt-2.6.31/drivers/gpu/drm/i915/i915_drv.h
@@ -188,6 +188,8 @@
 	u32 gt_irq_mask_reg;
 	u32 gt_irq_enable_reg;
 	u32 de_irq_enable_reg;
+	u32 pch_irq_mask_reg;
+	u32 pch_irq_enable_reg;
 
 	u32 hotplug_supported_mask;
 	struct work_struct hotplug_work;
@@ -256,6 +258,13 @@
 	u32 saveVBLANK_A;
 	u32 saveVSYNC_A;
 	u32 saveBCLRPAT_A;
+	u32 saveTRANSACONF;
+	u32 saveTRANS_HTOTAL_A;
+	u32 saveTRANS_HBLANK_A;
+	u32 saveTRANS_HSYNC_A;
+	u32 saveTRANS_VTOTAL_A;
+	u32 saveTRANS_VBLANK_A;
+	u32 saveTRANS_VSYNC_A;
 	u32 savePIPEASTAT;
 	u32 saveDSPASTRIDE;
 	u32 saveDSPASIZE;
@@ -264,8 +273,11 @@
 	u32 saveDSPASURF;
 	u32 saveDSPATILEOFF;
 	u32 savePFIT_PGM_RATIOS;
+	u32 saveBLC_HIST_CTL;
 	u32 saveBLC_PWM_CTL;
 	u32 saveBLC_PWM_CTL2;
+	u32 saveBLC_CPU_PWM_CTL;
+	u32 saveBLC_CPU_PWM_CTL2;
 	u32 saveFPB0;
 	u32 saveFPB1;
 	u32 saveDPLL_B;
@@ -277,6 +289,13 @@
 	u32 saveVBLANK_B;
 	u32 saveVSYNC_B;
 	u32 saveBCLRPAT_B;
+	u32 saveTRANSBCONF;
+	u32 saveTRANS_HTOTAL_B;
+	u32 saveTRANS_HBLANK_B;
+	u32 saveTRANS_HSYNC_B;
+	u32 saveTRANS_VTOTAL_B;
+	u32 saveTRANS_VBLANK_B;
+	u32 saveTRANS_VSYNC_B;
 	u32 savePIPEBSTAT;
 	u32 saveDSPBSTRIDE;
 	u32 saveDSPBSIZE;
@@ -309,6 +328,12 @@
 	u32 saveIER;
 	u32 saveIIR;
 	u32 saveIMR;
+	u32 saveDEIER;
+	u32 saveDEIMR;
+	u32 saveGTIER;
+	u32 saveGTIMR;
+	u32 saveFDI_RXA_IMR;
+	u32 saveFDI_RXB_IMR;
 	u32 saveCACHE_MODE_0;
 	u32 saveD_STATE;
 	u32 saveCG_2D_DIS;
@@ -342,6 +367,26 @@
 	u32 savePIPEB_DP_LINK_M;
 	u32 savePIPEA_DP_LINK_N;
 	u32 savePIPEB_DP_LINK_N;
+	u32 saveFDI_RXA_CTL;
+	u32 saveFDI_TXA_CTL;
+	u32 saveFDI_RXB_CTL;
+	u32 saveFDI_TXB_CTL;
+	u32 savePFA_CTL_1;
+	u32 savePFB_CTL_1;
+	u32 savePFA_WIN_SZ;
+	u32 savePFB_WIN_SZ;
+	u32 savePFA_WIN_POS;
+	u32 savePFB_WIN_POS;
+	u32 savePCH_DREF_CONTROL;
+	u32 saveDISP_ARB_CTL;
+	u32 savePIPEA_DATA_M1;
+	u32 savePIPEA_DATA_N1;
+	u32 savePIPEA_LINK_M1;
+	u32 savePIPEA_LINK_N1;
+	u32 savePIPEB_DATA_M1;
+	u32 savePIPEB_DATA_N1;
+	u32 savePIPEB_LINK_M1;
+	u32 savePIPEB_LINK_N1;
 
 	struct {
 		struct drm_mm gtt_space;
@@ -576,6 +621,8 @@
 extern int i915_max_ioctl;
 extern unsigned int i915_fbpercrtc;
 
+extern void i915_save_display(struct drm_device *dev);
+extern void i915_restore_display(struct drm_device *dev);
 extern int i915_master_create(struct drm_device *dev, struct drm_master *master);
 extern void i915_master_destroy(struct drm_device *dev, struct drm_master *master);
 
@@ -627,6 +674,8 @@
 void
 i915_disable_pipestat(drm_i915_private_t *dev_priv, int pipe, u32 mask);
 
+void intel_enable_asle (struct drm_device *dev);
+
 
 /* i915_mem.c */
 extern int i915_mem_alloc(struct drm_device *dev, void *data,
@@ -746,11 +795,13 @@
 extern int intel_opregion_init(struct drm_device *dev, int resume);
 extern void intel_opregion_free(struct drm_device *dev, int suspend);
 extern void opregion_asle_intr(struct drm_device *dev);
+extern void ironlake_opregion_gse_intr(struct drm_device *dev);
 extern void opregion_enable_asle(struct drm_device *dev);
 #else
 static inline int intel_opregion_init(struct drm_device *dev, int resume) { return 0; }
 static inline void intel_opregion_free(struct drm_device *dev, int suspend) { return; }
 static inline void opregion_asle_intr(struct drm_device *dev) { return; }
+static inline void ironlake_opregion_gse_intr(struct drm_device *dev) { return; }
 static inline void opregion_enable_asle(struct drm_device *dev) { return; }
 #endif
 
@@ -837,6 +888,7 @@
 #define IS_I85X(dev) ((dev)->pci_device == 0x3582)
 #define IS_I855(dev) ((dev)->pci_device == 0x3582)
 #define IS_I865G(dev) ((dev)->pci_device == 0x2572)
+#define IS_I8XX(dev) (IS_I830(dev) || IS_845G(dev) || IS_I85X(dev) || IS_I865G(dev))
 
 #define IS_I915G(dev) ((dev)->pci_device == 0x2582 || (dev)->pci_device == 0x258a)
 #define IS_I915GM(dev) ((dev)->pci_device == 0x2592)
@@ -854,6 +906,7 @@
 		       (dev)->pci_device == 0x2E12 || \
 		       (dev)->pci_device == 0x2E22 || \
 		       (dev)->pci_device == 0x2E32 || \
+		       (dev)->pci_device == 0x2E42 || \
 		       (dev)->pci_device == 0x0042 || \
 		       (dev)->pci_device == 0x0046)
 
@@ -866,6 +919,7 @@
 		     (dev)->pci_device == 0x2E12 || \
 		     (dev)->pci_device == 0x2E22 || \
 		     (dev)->pci_device == 0x2E32 || \
+		     (dev)->pci_device == 0x2E42 || \
 		     IS_GM45(dev))
 
 #define IS_IGDG(dev) ((dev)->pci_device == 0xa001)
@@ -896,9 +950,12 @@
  */
 #define HAS_128_BYTE_Y_TILING(dev) (IS_I9XX(dev) && !(IS_I915G(dev) || \
 						      IS_I915GM(dev)))
+#define SUPPORTS_DIGITAL_OUTPUTS(dev)	(IS_I9XX(dev) && !IS_IGD(dev))
 #define SUPPORTS_INTEGRATED_HDMI(dev)	(IS_G4X(dev) || IS_IGDNG(dev))
 #define SUPPORTS_INTEGRATED_DP(dev)	(IS_G4X(dev) || IS_IGDNG(dev))
 #define SUPPORTS_EDP(dev)		(IS_IGDNG_M(dev))
+#define SUPPORTS_TV(dev)		(IS_I9XX(dev) && IS_MOBILE(dev) && \
+					!IS_IGDNG(dev) && !IS_IGD(dev))
 #define I915_HAS_HOTPLUG(dev) (IS_I945G(dev) || IS_I945GM(dev) || IS_I965G(dev))
 /* dsparb controlled by hw only */
 #define DSPARB_HWCONTROL(dev) (IS_G4X(dev) || IS_IGDNG(dev))
--- linux-rt-2.6.31.orig/drivers/gpu/drm/i915/intel_hdmi.c
+++ linux-rt-2.6.31/drivers/gpu/drm/i915/intel_hdmi.c
@@ -77,14 +77,32 @@
 	struct intel_hdmi_priv *hdmi_priv = intel_output->dev_priv;
 	u32 temp;
 
-	if (mode != DRM_MODE_DPMS_ON) {
-		temp = I915_READ(hdmi_priv->sdvox_reg);
+	temp = I915_READ(hdmi_priv->sdvox_reg);
+
+	/* HW workaround, need to toggle enable bit off and on for 12bpc, but
+	 * we do this anyway which shows more stable in testing.
+	 */
+	if (IS_IGDNG(dev)) {
 		I915_WRITE(hdmi_priv->sdvox_reg, temp & ~SDVO_ENABLE);
+		POSTING_READ(hdmi_priv->sdvox_reg);
+	}
+
+	if (mode != DRM_MODE_DPMS_ON) {
+		temp &= ~SDVO_ENABLE;
 	} else {
-		temp = I915_READ(hdmi_priv->sdvox_reg);
-		I915_WRITE(hdmi_priv->sdvox_reg, temp | SDVO_ENABLE);
+		temp |= SDVO_ENABLE;
 	}
+
+	I915_WRITE(hdmi_priv->sdvox_reg, temp);
 	POSTING_READ(hdmi_priv->sdvox_reg);
+
+	/* HW workaround, need to write this twice for issue that may result
+	 * in first write getting masked.
+	 */
+	if (IS_IGDNG(dev)) {
+		I915_WRITE(hdmi_priv->sdvox_reg, temp);
+		POSTING_READ(hdmi_priv->sdvox_reg);
+	}
 }
 
 static void intel_hdmi_save(struct drm_connector *connector)
@@ -223,7 +241,7 @@
 
 	connector = &intel_output->base;
 	drm_connector_init(dev, connector, &intel_hdmi_connector_funcs,
-			   DRM_MODE_CONNECTOR_DVID);
+			   DRM_MODE_CONNECTOR_HDMIA);
 	drm_connector_helper_add(connector, &intel_hdmi_connector_helper_funcs);
 
 	intel_output->type = INTEL_OUTPUT_HDMI;
--- linux-rt-2.6.31.orig/drivers/gpu/drm/i915/intel_fb.c
+++ linux-rt-2.6.31/drivers/gpu/drm/i915/intel_fb.c
@@ -114,7 +114,7 @@
 	struct drm_framebuffer *fb = &intel_fb->base;
 	int depth;
 
-	if (var->pixclock == -1 || !var->pixclock)
+	if (var->pixclock != 0)
 		return -EINVAL;
 
 	/* Need to resize the fb object !!! */
@@ -205,7 +205,7 @@
 
 	DRM_DEBUG("%d %d\n", var->xres, var->pixclock);
 
-	if (var->pixclock != -1) {
+	if (var->pixclock != 0) {
 
 		DRM_ERROR("PIXEL CLOCK SET\n");
 		return -EINVAL;
@@ -461,7 +461,7 @@
 
 	mutex_lock(&dev->struct_mutex);
 
-	ret = i915_gem_object_pin(fbo, PAGE_SIZE);
+	ret = i915_gem_object_pin(fbo, 64*1024);
 	if (ret) {
 		DRM_ERROR("failed to pin fb: %d\n", ret);
 		goto out_unref;
@@ -692,7 +692,7 @@
 	par->crtc_count = 1;
 
 	if (new_fb) {
-		info->var.pixclock = -1;
+		info->var.pixclock = 0;
 		if (register_framebuffer(info) < 0)
 			return -EINVAL;
 	} else
@@ -846,7 +846,7 @@
 	par->crtc_count = crtc_count;
 
 	if (new_fb) {
-		info->var.pixclock = -1;
+		info->var.pixclock = 0;
 		if (register_framebuffer(info) < 0)
 			return -EINVAL;
 	} else
--- linux-rt-2.6.31.orig/drivers/gpu/drm/i915/intel_sdvo.c
+++ linux-rt-2.6.31/drivers/gpu/drm/i915/intel_sdvo.c
@@ -114,6 +114,9 @@
 	/* DDC bus used by this SDVO output */
 	uint8_t ddc_bus;
 
+	/* Mac mini hack -- use the same DDC as the analog connector */
+	struct i2c_adapter *analog_ddc_bus;
+
 	int save_sdvo_mult;
 	u16 save_active_outputs;
 	struct intel_sdvo_dtd save_input_dtd_1, save_input_dtd_2;
@@ -1478,6 +1481,36 @@
 	return (caps > 1);
 }
 
+static struct drm_connector *
+intel_find_analog_connector(struct drm_device *dev)
+{
+	struct drm_connector *connector;
+	struct intel_output *intel_output;
+
+	list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
+		intel_output = to_intel_output(connector);
+		if (intel_output->type == INTEL_OUTPUT_ANALOG)
+			return connector;
+	}
+	return NULL;
+}
+
+static int
+intel_analog_is_connected(struct drm_device *dev)
+{
+	struct drm_connector *analog_connector;
+	analog_connector = intel_find_analog_connector(dev);
+
+	if (!analog_connector)
+		return false;
+
+	if (analog_connector->funcs->detect(analog_connector) ==
+			connector_status_disconnected)
+		return false;
+
+	return true;
+}
+
 enum drm_connector_status
 intel_sdvo_hdmi_sink_detect(struct drm_connector *connector, u16 response)
 {
@@ -1488,6 +1521,15 @@
 
 	edid = drm_get_edid(&intel_output->base,
 			    intel_output->ddc_bus);
+
+	/* when there is no edid and no monitor is connected with VGA
+	 * port, try to use the CRT ddc to read the EDID for DVI-connector
+	 */
+	if (edid == NULL &&
+	    sdvo_priv->analog_ddc_bus &&
+	    !intel_analog_is_connected(intel_output->base.dev))
+		edid = drm_get_edid(&intel_output->base,
+				    sdvo_priv->analog_ddc_bus);
 	if (edid != NULL) {
 		/* Don't report the output as connected if it's a DVI-I
 		 * connector with a non-digital EDID coming out.
@@ -1540,31 +1582,32 @@
 static void intel_sdvo_get_ddc_modes(struct drm_connector *connector)
 {
 	struct intel_output *intel_output = to_intel_output(connector);
+	struct intel_sdvo_priv *sdvo_priv = intel_output->dev_priv;
+	int num_modes;
 
 	/* set the bus switch and get the modes */
-	intel_ddc_get_modes(intel_output);
+	num_modes = intel_ddc_get_modes(intel_output);
 
-#if 0
-	struct drm_device *dev = encoder->dev;
-	struct drm_i915_private *dev_priv = dev->dev_private;
-	/* Mac mini hack.  On this device, I get DDC through the analog, which
-	 * load-detects as disconnected.  I fail to DDC through the SDVO DDC,
-	 * but it does load-detect as connected.  So, just steal the DDC bits
-	 * from analog when we fail at finding it the right way.
+	/*
+	 * Mac mini hack.  On this device, the DVI-I connector shares one DDC
+	 * link between analog and digital outputs. So, if the regular SDVO
+	 * DDC fails, check to see if the analog output is disconnected, in
+	 * which case we'll look there for the digital DDC data.
 	 */
-	crt = xf86_config->output[0];
-	intel_output = crt->driver_private;
-	if (intel_output->type == I830_OUTPUT_ANALOG &&
-	    crt->funcs->detect(crt) == XF86OutputStatusDisconnected) {
-		I830I2CInit(pScrn, &intel_output->pDDCBus, GPIOA, "CRTDDC_A");
-		edid_mon = xf86OutputGetEDID(crt, intel_output->pDDCBus);
-		xf86DestroyI2CBusRec(intel_output->pDDCBus, true, true);
-	}
-	if (edid_mon) {
-		xf86OutputSetEDID(output, edid_mon);
-		modes = xf86OutputGetEDIDModes(output);
+	if (num_modes == 0 &&
+	    sdvo_priv->analog_ddc_bus &&
+	    !intel_analog_is_connected(intel_output->base.dev)) {
+		struct i2c_adapter *digital_ddc_bus;
+
+		/* Switch to the analog ddc bus and try that
+		 */
+		digital_ddc_bus = intel_output->ddc_bus;
+		intel_output->ddc_bus = sdvo_priv->analog_ddc_bus;
+
+		(void) intel_ddc_get_modes(intel_output);
+
+		intel_output->ddc_bus = digital_ddc_bus;
 	}
-#endif
 }
 
 /**
@@ -1748,6 +1791,8 @@
 		intel_i2c_destroy(intel_output->i2c_bus);
 	if (intel_output->ddc_bus)
 		intel_i2c_destroy(intel_output->ddc_bus);
+	if (sdvo_priv->analog_ddc_bus)
+		intel_i2c_destroy(sdvo_priv->analog_ddc_bus);
 
 	if (sdvo_priv->sdvo_lvds_fixed_mode != NULL)
 		drm_mode_destroy(connector->dev,
@@ -2074,10 +2119,15 @@
 	}
 
 	/* setup the DDC bus. */
-	if (output_device == SDVOB)
+	if (output_device == SDVOB) {
 		intel_output->ddc_bus = intel_i2c_create(dev, GPIOE, "SDVOB DDC BUS");
-	else
+		sdvo_priv->analog_ddc_bus = intel_i2c_create(dev, GPIOA,
+						"SDVOB/VGA DDC BUS");
+	} else {
 		intel_output->ddc_bus = intel_i2c_create(dev, GPIOE, "SDVOC DDC BUS");
+		sdvo_priv->analog_ddc_bus = intel_i2c_create(dev, GPIOA,
+						"SDVOC/VGA DDC BUS");
+	}
 
 	if (intel_output->ddc_bus == NULL)
 		goto err_i2c;
@@ -2143,6 +2193,8 @@
 	return true;
 
 err_i2c:
+	if (sdvo_priv->analog_ddc_bus != NULL)
+		intel_i2c_destroy(sdvo_priv->analog_ddc_bus);
 	if (intel_output->ddc_bus != NULL)
 		intel_i2c_destroy(intel_output->ddc_bus);
 	if (intel_output->i2c_bus != NULL)
--- linux-rt-2.6.31.orig/drivers/gpu/drm/i915/intel_bios.c
+++ linux-rt-2.6.31/drivers/gpu/drm/i915/intel_bios.c
@@ -217,6 +217,9 @@
 			if (IS_I85X(dev_priv->dev))
 				dev_priv->lvds_ssc_freq =
 					general->ssc_freq ? 66 : 48;
+			else if (IS_IGDNG(dev_priv->dev))
+				dev_priv->lvds_ssc_freq =
+					general->ssc_freq ? 100 : 120;
 			else
 				dev_priv->lvds_ssc_freq =
 					general->ssc_freq ? 100 : 96;
--- linux-rt-2.6.31.orig/drivers/gpu/drm/r128/r128_state.c
+++ linux-rt-2.6.31/drivers/gpu/drm/r128/r128_state.c
@@ -1244,14 +1244,18 @@
 static int r128_cce_clear(struct drm_device *dev, void *data, struct drm_file *file_priv)
 {
 	drm_r128_private_t *dev_priv = dev->dev_private;
-	drm_r128_sarea_t *sarea_priv = dev_priv->sarea_priv;
+	drm_r128_sarea_t *sarea_priv;
 	drm_r128_clear_t *clear = data;
 	DRM_DEBUG("\n");
 
 	LOCK_TEST_WITH_RETURN(dev, file_priv);
 
+	DEV_INIT_TEST_WITH_RETURN(dev_priv);
+
 	RING_SPACE_TEST_WITH_RETURN(dev_priv);
 
+	sarea_priv = dev_priv->sarea_priv;
+
 	if (sarea_priv->nbox > R128_NR_SAREA_CLIPRECTS)
 		sarea_priv->nbox = R128_NR_SAREA_CLIPRECTS;
 
@@ -1312,6 +1316,8 @@
 
 	LOCK_TEST_WITH_RETURN(dev, file_priv);
 
+	DEV_INIT_TEST_WITH_RETURN(dev_priv);
+
 	RING_SPACE_TEST_WITH_RETURN(dev_priv);
 
 	if (!dev_priv->page_flipping)
@@ -1331,6 +1337,8 @@
 
 	LOCK_TEST_WITH_RETURN(dev, file_priv);
 
+	DEV_INIT_TEST_WITH_RETURN(dev_priv);
+
 	RING_SPACE_TEST_WITH_RETURN(dev_priv);
 
 	if (sarea_priv->nbox > R128_NR_SAREA_CLIPRECTS)
@@ -1354,10 +1362,7 @@
 
 	LOCK_TEST_WITH_RETURN(dev, file_priv);
 
-	if (!dev_priv) {
-		DRM_ERROR("called with no initialization\n");
-		return -EINVAL;
-	}
+	DEV_INIT_TEST_WITH_RETURN(dev_priv);
 
 	DRM_DEBUG("pid=%d index=%d count=%d discard=%d\n",
 		  DRM_CURRENTPID, vertex->idx, vertex->count, vertex->discard);
@@ -1410,10 +1415,7 @@
 
 	LOCK_TEST_WITH_RETURN(dev, file_priv);
 
-	if (!dev_priv) {
-		DRM_ERROR("called with no initialization\n");
-		return -EINVAL;
-	}
+	DEV_INIT_TEST_WITH_RETURN(dev_priv);
 
 	DRM_DEBUG("pid=%d buf=%d s=%d e=%d d=%d\n", DRM_CURRENTPID,
 		  elts->idx, elts->start, elts->end, elts->discard);
@@ -1476,6 +1478,8 @@
 
 	LOCK_TEST_WITH_RETURN(dev, file_priv);
 
+	DEV_INIT_TEST_WITH_RETURN(dev_priv);
+
 	DRM_DEBUG("pid=%d index=%d\n", DRM_CURRENTPID, blit->idx);
 
 	if (blit->idx < 0 || blit->idx >= dma->buf_count) {
@@ -1501,6 +1505,8 @@
 
 	LOCK_TEST_WITH_RETURN(dev, file_priv);
 
+	DEV_INIT_TEST_WITH_RETURN(dev_priv);
+
 	RING_SPACE_TEST_WITH_RETURN(dev_priv);
 
 	ret = -EINVAL;
@@ -1531,6 +1537,8 @@
 
 	LOCK_TEST_WITH_RETURN(dev, file_priv);
 
+	DEV_INIT_TEST_WITH_RETURN(dev_priv);
+
 	if (DRM_COPY_FROM_USER(&mask, stipple->mask, 32 * sizeof(u32)))
 		return -EFAULT;
 
@@ -1555,10 +1563,7 @@
 
 	LOCK_TEST_WITH_RETURN(dev, file_priv);
 
-	if (!dev_priv) {
-		DRM_ERROR("called with no initialization\n");
-		return -EINVAL;
-	}
+	DEV_INIT_TEST_WITH_RETURN(dev_priv);
 
 	DRM_DEBUG("idx=%d s=%d e=%d d=%d\n",
 		  indirect->idx, indirect->start, indirect->end,
@@ -1620,10 +1625,7 @@
 	drm_r128_getparam_t *param = data;
 	int value;
 
-	if (!dev_priv) {
-		DRM_ERROR("called with no initialization\n");
-		return -EINVAL;
-	}
+	DEV_INIT_TEST_WITH_RETURN(dev_priv);
 
 	DRM_DEBUG("pid=%d\n", DRM_CURRENTPID);
 
--- linux-rt-2.6.31.orig/drivers/gpu/drm/r128/r128_drv.h
+++ linux-rt-2.6.31/drivers/gpu/drm/r128/r128_drv.h
@@ -422,6 +422,14 @@
  * Misc helper macros
  */
 
+#define DEV_INIT_TEST_WITH_RETURN(_dev_priv)				\
+do {									\
+	if (!_dev_priv) {						\
+		DRM_ERROR("called with no initialization\n");		\
+		return -EINVAL;						\
+	}								\
+} while (0)
+
 #define RING_SPACE_TEST_WITH_RETURN( dev_priv )				\
 do {									\
 	drm_r128_ring_buffer_t *ring = &dev_priv->ring; int i;		\
--- linux-rt-2.6.31.orig/drivers/gpu/drm/r128/r128_cce.c
+++ linux-rt-2.6.31/drivers/gpu/drm/r128/r128_cce.c
@@ -353,6 +353,11 @@
 
 	DRM_DEBUG("\n");
 
+	if (dev->dev_private) {
+		DRM_DEBUG("called when already initialized\n");
+		return -EINVAL;
+	}
+
 	dev_priv = kzalloc(sizeof(drm_r128_private_t), GFP_KERNEL);
 	if (dev_priv == NULL)
 		return -ENOMEM;
@@ -649,6 +654,8 @@
 
 	LOCK_TEST_WITH_RETURN(dev, file_priv);
 
+	DEV_INIT_TEST_WITH_RETURN(dev_priv);
+
 	if (dev_priv->cce_running || dev_priv->cce_mode == R128_PM4_NONPM4) {
 		DRM_DEBUG("while CCE running\n");
 		return 0;
@@ -671,6 +678,8 @@
 
 	LOCK_TEST_WITH_RETURN(dev, file_priv);
 
+	DEV_INIT_TEST_WITH_RETURN(dev_priv);
+
 	/* Flush any pending CCE commands.  This ensures any outstanding
 	 * commands are exectuted by the engine before we turn it off.
 	 */
@@ -708,10 +717,7 @@
 
 	LOCK_TEST_WITH_RETURN(dev, file_priv);
 
-	if (!dev_priv) {
-		DRM_DEBUG("called before init done\n");
-		return -EINVAL;
-	}
+	DEV_INIT_TEST_WITH_RETURN(dev_priv);
 
 	r128_do_cce_reset(dev_priv);
 
@@ -728,6 +734,8 @@
 
 	LOCK_TEST_WITH_RETURN(dev, file_priv);
 
+	DEV_INIT_TEST_WITH_RETURN(dev_priv);
+
 	if (dev_priv->cce_running) {
 		r128_do_cce_flush(dev_priv);
 	}
@@ -741,6 +749,8 @@
 
 	LOCK_TEST_WITH_RETURN(dev, file_priv);
 
+	DEV_INIT_TEST_WITH_RETURN(dev->dev_private);
+
 	return r128_do_engine_reset(dev);
 }
 
--- linux-rt-2.6.31.orig/drivers/base/bus.c
+++ linux-rt-2.6.31/drivers/base/bus.c
@@ -459,8 +459,9 @@
  * bus_add_device - add device to bus
  * @dev: device being added
  *
+ * - Add device's bus attributes.
+ * - Create links to device's bus.
  * - Add the device to its bus's list of devices.
- * - Create link to device's bus.
  */
 int bus_add_device(struct device *dev)
 {
@@ -483,6 +484,7 @@
 		error = make_deprecated_bus_links(dev);
 		if (error)
 			goto out_deprecated;
+		klist_add_tail(&dev->p->knode_bus, &bus->p->klist_devices);
 	}
 	return 0;
 
@@ -498,24 +500,19 @@
 }
 
 /**
- * bus_attach_device - add device to bus
- * @dev: device tried to attach to a driver
+ * bus_probe_device - probe drivers for a new device
+ * @dev: device to probe
  *
- * - Add device to bus's list of devices.
- * - Try to attach to driver.
+ * - Automatically probe for a driver if the bus allows it.
  */
-void bus_attach_device(struct device *dev)
+void bus_probe_device(struct device *dev)
 {
 	struct bus_type *bus = dev->bus;
-	int ret = 0;
+	int ret;
 
-	if (bus) {
-		if (bus->p->drivers_autoprobe)
-			ret = device_attach(dev);
+	if (bus && bus->p->drivers_autoprobe) {
+		ret = device_attach(dev);
 		WARN_ON(ret < 0);
-		if (ret >= 0)
-			klist_add_tail(&dev->p->knode_bus,
-				       &bus->p->klist_devices);
 	}
 }
 
--- linux-rt-2.6.31.orig/drivers/base/core.c
+++ linux-rt-2.6.31/drivers/base/core.c
@@ -945,7 +945,7 @@
 					     BUS_NOTIFY_ADD_DEVICE, dev);
 
 	kobject_uevent(&dev->kobj, KOBJ_ADD);
-	bus_attach_device(dev);
+	bus_probe_device(dev);
 	if (parent)
 		klist_add_tail(&dev->p->knode_parent,
 			       &parent->p->klist_children);
--- linux-rt-2.6.31.orig/drivers/base/base.h
+++ linux-rt-2.6.31/drivers/base/base.h
@@ -104,7 +104,7 @@
 extern int cpu_dev_init(void);
 
 extern int bus_add_device(struct device *dev);
-extern void bus_attach_device(struct device *dev);
+extern void bus_probe_device(struct device *dev);
 extern void bus_remove_device(struct device *dev);
 
 extern int bus_add_driver(struct device_driver *drv);
--- linux-rt-2.6.31.orig/drivers/base/driver.c
+++ linux-rt-2.6.31/drivers/base/driver.c
@@ -236,7 +236,7 @@
 		put_driver(other);
 		printk(KERN_ERR "Error: Driver '%s' is already registered, "
 			"aborting...\n", drv->name);
-		return -EEXIST;
+		return -EBUSY;
 	}
 
 	ret = bus_add_driver(drv);
--- linux-rt-2.6.31.orig/drivers/pci/pci.c
+++ linux-rt-2.6.31/drivers/pci/pci.c
@@ -2650,6 +2650,11 @@
 	return 0;
 }
 
+void __weak pci_fixup_cardbus(struct pci_bus *bus)
+{
+}
+EXPORT_SYMBOL(pci_fixup_cardbus);
+
 static int __init pci_setup(char *str)
 {
 	while (str) {
--- linux-rt-2.6.31.orig/drivers/pci/quirks.c
+++ linux-rt-2.6.31/drivers/pci/quirks.c
@@ -1201,6 +1201,7 @@
 			switch(dev->subsystem_device) {
 			case 0x00b8: /* Compaq Evo D510 CMT */
 			case 0x00b9: /* Compaq Evo D510 SFF */
+			case 0x00ba: /* Compaq Evo D510 USDT */
 				/* Motherboard doesn't have Host bridge
 				 * subvendor/subdevice IDs and on-board VGA
 				 * controller is disabled if an AGP card is
@@ -2382,8 +2383,10 @@
 }
 
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID, nv_msi_ht_cap_quirk_leaf);
+DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID, nv_msi_ht_cap_quirk_leaf);
 
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AL, PCI_ANY_ID, nv_msi_ht_cap_quirk_all);
+DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_AL, PCI_ANY_ID, nv_msi_ht_cap_quirk_all);
 
 static void __devinit quirk_msi_intx_disable_bug(struct pci_dev *dev)
 {
@@ -2492,6 +2495,7 @@
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x10e7, quirk_i82576_sriov);
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x10e8, quirk_i82576_sriov);
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x150a, quirk_i82576_sriov);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x150d, quirk_i82576_sriov);
 
 #endif	/* CONFIG_PCI_IOV */
 
--- linux-rt-2.6.31.orig/drivers/pci/dmar.c
+++ linux-rt-2.6.31/drivers/pci/dmar.c
@@ -632,20 +632,31 @@
 	iommu->cap = dmar_readq(iommu->reg + DMAR_CAP_REG);
 	iommu->ecap = dmar_readq(iommu->reg + DMAR_ECAP_REG);
 
+	if (iommu->cap == (uint64_t)-1 && iommu->ecap == (uint64_t)-1) {
+		/* Promote an attitude of violence to a BIOS engineer today */
+		WARN(1, "Your BIOS is broken; DMAR reported at address %llx returns all ones!\n"
+		     "BIOS vendor: %s; Ver: %s; Product Version: %s\n",
+		     drhd->reg_base_addr,
+		     dmi_get_system_info(DMI_BIOS_VENDOR),
+		     dmi_get_system_info(DMI_BIOS_VERSION),
+		     dmi_get_system_info(DMI_PRODUCT_VERSION));
+		goto err_unmap;
+	}
+
 #ifdef CONFIG_DMAR
 	agaw = iommu_calculate_agaw(iommu);
 	if (agaw < 0) {
 		printk(KERN_ERR
 		       "Cannot get a valid agaw for iommu (seq_id = %d)\n",
 		       iommu->seq_id);
-		goto error;
+		goto err_unmap;
 	}
 	msagaw = iommu_calculate_max_sagaw(iommu);
 	if (msagaw < 0) {
 		printk(KERN_ERR
 			"Cannot get a valid max agaw for iommu (seq_id = %d)\n",
 			iommu->seq_id);
-		goto error;
+		goto err_unmap;
 	}
 #endif
 	iommu->agaw = agaw;
@@ -665,7 +676,7 @@
 	}
 
 	ver = readl(iommu->reg + DMAR_VER_REG);
-	pr_debug("IOMMU %llx: ver %d:%d cap %llx ecap %llx\n",
+	pr_info("IOMMU %llx: ver %d:%d cap %llx ecap %llx\n",
 		(unsigned long long)drhd->reg_base_addr,
 		DMAR_VER_MAJOR(ver), DMAR_VER_MINOR(ver),
 		(unsigned long long)iommu->cap,
@@ -675,7 +686,10 @@
 
 	drhd->iommu = iommu;
 	return 0;
-error:
+
+ err_unmap:
+	iounmap(iommu->reg);
+ error:
 	kfree(iommu);
 	return -1;
 }
--- linux-rt-2.6.31.orig/drivers/pci/pcie/aer/aerdrv.c
+++ linux-rt-2.6.31/drivers/pci/pcie/aer/aerdrv.c
@@ -52,7 +52,7 @@
 
 static struct pcie_port_service_driver aerdriver = {
 	.name		= "aer",
-	.port_type	= PCIE_ANY_PORT,
+	.port_type	= PCIE_RC_PORT,
 	.service	= PCIE_PORT_SERVICE_AER,
 
 	.probe		= aer_probe,
--- linux-rt-2.6.31.orig/drivers/block/nbd.c
+++ linux-rt-2.6.31/drivers/block/nbd.c
@@ -56,7 +56,7 @@
 
 static unsigned int nbds_max = 16;
 static struct nbd_device *nbd_dev;
-static int max_part;
+static int max_part = 15;
 
 /*
  * Use just one lock (or at most 1 per NIC). Two arguments for this:
--- linux-rt-2.6.31.orig/drivers/md/bitmap.c
+++ linux-rt-2.6.31/drivers/md/bitmap.c
@@ -1077,23 +1077,31 @@
  *			out to disk
  */
 
-void bitmap_daemon_work(struct bitmap *bitmap)
+void bitmap_daemon_work(mddev_t *mddev)
 {
+	struct bitmap *bitmap;
 	unsigned long j;
 	unsigned long flags;
 	struct page *page = NULL, *lastpage = NULL;
 	int blocks;
 	void *paddr;
 
-	if (bitmap == NULL)
+	/* Use a mutex to guard daemon_work against
+	 * bitmap_destroy.
+	 */
+	mutex_lock(&mddev->bitmap_mutex);
+	bitmap = mddev->bitmap;
+	if (bitmap == NULL) {
+		mutex_unlock(&mddev->bitmap_mutex);
 		return;
+	}
 	if (time_before(jiffies, bitmap->daemon_lastrun + bitmap->daemon_sleep*HZ))
 		goto done;
 
 	bitmap->daemon_lastrun = jiffies;
 	if (bitmap->allclean) {
 		bitmap->mddev->thread->timeout = MAX_SCHEDULE_TIMEOUT;
-		return;
+		goto done;
 	}
 	bitmap->allclean = 1;
 
@@ -1202,6 +1210,7 @@
  done:
 	if (bitmap->allclean == 0)
 		bitmap->mddev->thread->timeout = bitmap->daemon_sleep * HZ;
+	mutex_unlock(&mddev->bitmap_mutex);
 }
 
 static bitmap_counter_t *bitmap_get_counter(struct bitmap *bitmap,
@@ -1538,9 +1547,9 @@
 	 */
 	sleep = bitmap->daemon_sleep;
 	bitmap->daemon_sleep = 0;
-	bitmap_daemon_work(bitmap);
-	bitmap_daemon_work(bitmap);
-	bitmap_daemon_work(bitmap);
+	bitmap_daemon_work(mddev);
+	bitmap_daemon_work(mddev);
+	bitmap_daemon_work(mddev);
 	bitmap->daemon_sleep = sleep;
 	bitmap_update_sb(bitmap);
 }
@@ -1571,6 +1580,7 @@
 	kfree(bp);
 	kfree(bitmap);
 }
+
 void bitmap_destroy(mddev_t *mddev)
 {
 	struct bitmap *bitmap = mddev->bitmap;
@@ -1578,7 +1588,9 @@
 	if (!bitmap) /* there was no bitmap */
 		return;
 
+	mutex_lock(&mddev->bitmap_mutex);
 	mddev->bitmap = NULL; /* disconnect from the md device */
+	mutex_unlock(&mddev->bitmap_mutex);
 	if (mddev->thread)
 		mddev->thread->timeout = MAX_SCHEDULE_TIMEOUT;
 
--- linux-rt-2.6.31.orig/drivers/md/dm-snap.c
+++ linux-rt-2.6.31/drivers/md/dm-snap.c
@@ -296,6 +296,7 @@
  */
 static int register_snapshot(struct dm_snapshot *snap)
 {
+	struct dm_snapshot *l;
 	struct origin *o, *new_o;
 	struct block_device *bdev = snap->origin->bdev;
 
@@ -319,7 +320,11 @@
 		__insert_origin(o);
 	}
 
-	list_add_tail(&snap->list, &o->snapshots);
+	/* Sort the list according to chunk size, largest-first smallest-last */
+	list_for_each_entry(l, &o->snapshots, list)
+		if (l->store->chunk_size < snap->store->chunk_size)
+			break;
+	list_add_tail(&snap->list, &l->list);
 
 	up_write(&_origins_lock);
 	return 0;
@@ -668,6 +673,11 @@
 	bio_list_init(&s->queued_bios);
 	INIT_WORK(&s->queued_bios_work, flush_queued_bios);
 
+	if (!s->store->chunk_size) {
+		ti->error = "Chunk size not set";
+		goto bad_load_and_register;
+	}
+
 	/* Add snapshot to the list of snapshots for this origin */
 	/* Exceptions aren't triggered till snapshot_resume() is called */
 	if (register_snapshot(s)) {
@@ -951,7 +961,7 @@
 
 	src.bdev = bdev;
 	src.sector = chunk_to_sector(s->store, pe->e.old_chunk);
-	src.count = min(s->store->chunk_size, dev_size - src.sector);
+	src.count = min((sector_t)s->store->chunk_size, dev_size - src.sector);
 
 	dest.bdev = s->store->cow->bdev;
 	dest.sector = chunk_to_sector(s->store, pe->e.new_chunk);
@@ -1142,6 +1152,8 @@
 	unsigned sz = 0;
 	struct dm_snapshot *snap = ti->private;
 
+	down_write(&snap->lock);
+
 	switch (type) {
 	case STATUSTYPE_INFO:
 		if (!snap->valid)
@@ -1173,6 +1185,8 @@
 		break;
 	}
 
+	up_write(&snap->lock);
+
 	return 0;
 }
 
@@ -1388,7 +1402,7 @@
 	struct dm_dev *dev = ti->private;
 	struct dm_snapshot *snap;
 	struct origin *o;
-	chunk_t chunk_size = 0;
+	unsigned chunk_size = 0;
 
 	down_read(&_origins_lock);
 	o = __lookup_origin(dev->bdev);
@@ -1465,7 +1479,7 @@
 	r = dm_register_target(&snapshot_target);
 	if (r) {
 		DMERR("snapshot target register failed %d", r);
-		return r;
+		goto bad_register_snapshot_target;
 	}
 
 	r = dm_register_target(&origin_target);
@@ -1522,6 +1536,9 @@
 	dm_unregister_target(&origin_target);
 bad1:
 	dm_unregister_target(&snapshot_target);
+
+bad_register_snapshot_target:
+	dm_exception_store_exit();
 	return r;
 }
 
--- linux-rt-2.6.31.orig/drivers/md/dm.c
+++ linux-rt-2.6.31/drivers/md/dm.c
@@ -47,6 +47,7 @@
 	atomic_t io_count;
 	struct bio *bio;
 	unsigned long start_time;
+	spinlock_t endio_lock;
 };
 
 /*
@@ -576,8 +577,12 @@
 	struct mapped_device *md = io->md;
 
 	/* Push-back supersedes any I/O errors */
-	if (error && !(io->error > 0 && __noflush_suspending(md)))
-		io->error = error;
+	if (unlikely(error)) {
+		spin_lock_irqsave(&io->endio_lock, flags);
+		if (!(io->error > 0 && __noflush_suspending(md)))
+			io->error = error;
+		spin_unlock_irqrestore(&io->endio_lock, flags);
+	}
 
 	if (atomic_dec_and_test(&io->io_count)) {
 		if (io->error == DM_ENDIO_REQUEUE) {
@@ -1224,6 +1229,7 @@
 	atomic_set(&ci.io->io_count, 1);
 	ci.io->bio = bio;
 	ci.io->md = md;
+	spin_lock_init(&ci.io->endio_lock);
 	ci.sector = bio->bi_sector;
 	ci.sector_count = bio_sectors(bio);
 	if (unlikely(bio_empty_barrier(bio)))
@@ -1819,6 +1825,7 @@
 bad_bdev:
 	destroy_workqueue(md->wq);
 bad_thread:
+	del_gendisk(md->disk);
 	put_disk(md->disk);
 bad_disk:
 	blk_cleanup_queue(md->queue);
@@ -2562,6 +2569,7 @@
 {
 	return md->disk;
 }
+EXPORT_SYMBOL_GPL(dm_disk);
 
 struct kobject *dm_kobject(struct mapped_device *md)
 {
--- linux-rt-2.6.31.orig/drivers/md/md.c
+++ linux-rt-2.6.31/drivers/md/md.c
@@ -276,7 +276,9 @@
 	if (!atomic_dec_and_lock(&mddev->active, &all_mddevs_lock))
 		return;
 	if (!mddev->raid_disks && list_empty(&mddev->disks) &&
-	    !mddev->hold_active) {
+	    mddev->ctime == 0 && !mddev->hold_active) {
+		/* Array is not configured at all, and not held active,
+		 * so destroy it */
 		list_del(&mddev->all_mddevs);
 		if (mddev->gendisk) {
 			/* we did a probe so need to clean up.
@@ -361,6 +363,7 @@
 
 	mutex_init(&new->open_mutex);
 	mutex_init(&new->reconfig_mutex);
+	mutex_init(&new->bitmap_mutex);
 	INIT_LIST_HEAD(&new->disks);
 	INIT_LIST_HEAD(&new->all_mddevs);
 	init_timer(&new->safemode_timer);
@@ -5039,6 +5042,10 @@
 		mddev->minor_version = info->minor_version;
 		mddev->patch_version = info->patch_version;
 		mddev->persistent = !info->not_persistent;
+		/* ensure mddev_put doesn't delete this now that there
+		 * is some minimal configuration.
+		 */
+		mddev->ctime         = get_seconds();
 		return 0;
 	}
 	mddev->major_version = MD_MAJOR_VERSION;
@@ -6495,8 +6502,9 @@
  skip:
 	mddev->curr_resync = 0;
 	mddev->curr_resync_completed = 0;
-	mddev->resync_min = 0;
-	mddev->resync_max = MaxSector;
+	if (!test_bit(MD_RECOVERY_INTR, &mddev->recovery))
+		/* We completed so max setting can be forgotten. */
+		mddev->resync_max = MaxSector;
 	sysfs_notify(&mddev->kobj, NULL, "sync_completed");
 	wake_up(&resync_wait);
 	set_bit(MD_RECOVERY_DONE, &mddev->recovery);
@@ -6594,7 +6602,7 @@
 
 
 	if (mddev->bitmap)
-		bitmap_daemon_work(mddev->bitmap);
+		bitmap_daemon_work(mddev);
 
 	if (mddev->ro)
 		return;
--- linux-rt-2.6.31.orig/drivers/md/dm-exception-store.c
+++ linux-rt-2.6.31/drivers/md/dm-exception-store.c
@@ -155,7 +155,8 @@
 	char *value;
 
 	chunk_size_ulong = simple_strtoul(chunk_size_arg, &value, 10);
-	if (*chunk_size_arg == '\0' || *value != '\0') {
+	if (*chunk_size_arg == '\0' || *value != '\0' ||
+	    chunk_size_ulong > UINT_MAX) {
 		*error = "Invalid chunk size";
 		return -EINVAL;
 	}
@@ -171,34 +172,35 @@
 	 */
 	chunk_size_ulong = round_up(chunk_size_ulong, PAGE_SIZE >> 9);
 
-	return dm_exception_store_set_chunk_size(store, chunk_size_ulong,
+	return dm_exception_store_set_chunk_size(store,
+						 (unsigned) chunk_size_ulong,
 						 error);
 }
 
 int dm_exception_store_set_chunk_size(struct dm_exception_store *store,
-				      unsigned long chunk_size_ulong,
+				      unsigned chunk_size,
 				      char **error)
 {
 	/* Check chunk_size is a power of 2 */
-	if (!is_power_of_2(chunk_size_ulong)) {
+	if (!is_power_of_2(chunk_size)) {
 		*error = "Chunk size is not a power of 2";
 		return -EINVAL;
 	}
 
 	/* Validate the chunk size against the device block size */
-	if (chunk_size_ulong % (bdev_logical_block_size(store->cow->bdev) >> 9)) {
+	if (chunk_size % (bdev_logical_block_size(store->cow->bdev) >> 9)) {
 		*error = "Chunk size is not a multiple of device blocksize";
 		return -EINVAL;
 	}
 
-	if (chunk_size_ulong > INT_MAX >> SECTOR_SHIFT) {
+	if (chunk_size > INT_MAX >> SECTOR_SHIFT) {
 		*error = "Chunk size is too high";
 		return -EINVAL;
 	}
 
-	store->chunk_size = chunk_size_ulong;
-	store->chunk_mask = chunk_size_ulong - 1;
-	store->chunk_shift = ffs(chunk_size_ulong) - 1;
+	store->chunk_size = chunk_size;
+	store->chunk_mask = chunk_size - 1;
+	store->chunk_shift = ffs(chunk_size) - 1;
 
 	return 0;
 }
@@ -251,7 +253,7 @@
 
 	r = set_chunk_size(tmp_store, argv[2], &ti->error);
 	if (r)
-		goto bad_cow;
+		goto bad_ctr;
 
 	r = type->ctr(tmp_store, 0, NULL);
 	if (r) {
--- linux-rt-2.6.31.orig/drivers/md/dm-exception-store.h
+++ linux-rt-2.6.31/drivers/md/dm-exception-store.h
@@ -101,9 +101,9 @@
 	struct dm_dev *cow;
 
 	/* Size of data blocks saved - must be a power of 2 */
-	chunk_t chunk_size;
-	chunk_t chunk_mask;
-	chunk_t chunk_shift;
+	unsigned chunk_size;
+	unsigned chunk_mask;
+	unsigned chunk_shift;
 
 	void *context;
 };
@@ -169,7 +169,7 @@
 int dm_exception_store_type_unregister(struct dm_exception_store_type *type);
 
 int dm_exception_store_set_chunk_size(struct dm_exception_store *store,
-				      unsigned long chunk_size_ulong,
+				      unsigned chunk_size,
 				      char **error);
 
 int dm_exception_store_create(struct dm_target *ti, int argc, char **argv,
--- linux-rt-2.6.31.orig/drivers/md/dm-log-userspace-transfer.c
+++ linux-rt-2.6.31/drivers/md/dm-log-userspace-transfer.c
@@ -129,11 +129,13 @@
  * This is the connector callback that delivers data
  * that was sent from userspace.
  */
-static void cn_ulog_callback(void *data)
+static void cn_ulog_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp)
 {
-	struct cn_msg *msg = (struct cn_msg *)data;
 	struct dm_ulog_request *tfr = (struct dm_ulog_request *)(msg + 1);
 
+	if (!cap_raised(nsp->eff_cap, CAP_SYS_ADMIN))
+		return;
+
 	spin_lock(&receiving_list_lock);
 	if (msg->len == 0)
 		fill_pkg(msg, NULL);
--- linux-rt-2.6.31.orig/drivers/md/bitmap.h
+++ linux-rt-2.6.31/drivers/md/bitmap.h
@@ -282,7 +282,7 @@
 void bitmap_cond_end_sync(struct bitmap *bitmap, sector_t sector);
 
 void bitmap_unplug(struct bitmap *bitmap);
-void bitmap_daemon_work(struct bitmap *bitmap);
+void bitmap_daemon_work(mddev_t *mddev);
 #endif
 
 #endif
--- linux-rt-2.6.31.orig/drivers/md/raid1.c
+++ linux-rt-2.6.31/drivers/md/raid1.c
@@ -1643,11 +1643,12 @@
 					       r1_bio->sector,
 					       r1_bio->sectors);
 				unfreeze_array(conf);
-			}
+			} else
+				md_error(mddev,
+					 conf->mirrors[r1_bio->read_disk].rdev);
 
 			bio = r1_bio->bios[r1_bio->read_disk];
-			if ((disk=read_balance(conf, r1_bio)) == -1 ||
-			    disk == r1_bio->read_disk) {
+			if ((disk=read_balance(conf, r1_bio)) == -1) {
 				printk(KERN_ALERT "raid1: %s: unrecoverable I/O"
 				       " read error for block %llu\n",
 				       bdevname(bio->bi_bdev,b),
@@ -1676,6 +1677,7 @@
 				generic_make_request(bio);
 			}
 		}
+		cond_resched();
 	}
 	if (unplug)
 		unplug_slaves(mddev);
--- linux-rt-2.6.31.orig/drivers/md/dm-log-userspace-base.c
+++ linux-rt-2.6.31/drivers/md/dm-log-userspace-base.c
@@ -156,7 +156,7 @@
 	}
 
 	/* The ptr value is sufficient for local unique id */
-	lc->luid = (uint64_t)lc;
+	lc->luid = (unsigned long)lc;
 
 	lc->ti = ti;
 
@@ -582,7 +582,7 @@
 		break;
 	case STATUSTYPE_TABLE:
 		sz = 0;
-		table_args = strstr(lc->usr_argv_str, " ");
+		table_args = strchr(lc->usr_argv_str, ' ');
 		BUG_ON(!table_args); /* There will always be a ' ' */
 		table_args++;
 
--- linux-rt-2.6.31.orig/drivers/md/raid5.c
+++ linux-rt-2.6.31/drivers/md/raid5.c
@@ -3790,6 +3790,8 @@
 			sector_nr = conf->reshape_progress;
 		sector_div(sector_nr, new_data_disks);
 		if (sector_nr) {
+			mddev->curr_resync_completed = sector_nr;
+			sysfs_notify(&mddev->kobj, NULL, "sync_completed");
 			*skipped = 1;
 			return sector_nr;
 		}
--- linux-rt-2.6.31.orig/drivers/md/raid10.c
+++ linux-rt-2.6.31/drivers/md/raid10.c
@@ -1630,6 +1630,7 @@
 				generic_make_request(bio);
 			}
 		}
+		cond_resched();
 	}
 	if (unplug)
 		unplug_slaves(mddev);
--- linux-rt-2.6.31.orig/drivers/md/md.h
+++ linux-rt-2.6.31/drivers/md/md.h
@@ -289,6 +289,7 @@
 								* hot-adding a bitmap.  It should
 								* eventually be settable by sysfs.
 								*/
+	struct mutex			bitmap_mutex;
 
 	struct list_head		all_mddevs;
 };
--- linux-rt-2.6.31.orig/drivers/md/dm-snap-persistent.c
+++ linux-rt-2.6.31/drivers/md/dm-snap-persistent.c
@@ -284,12 +284,13 @@
 {
 	int r;
 	struct disk_header *dh;
-	chunk_t chunk_size;
+	unsigned chunk_size;
 	int chunk_size_supplied = 1;
 	char *chunk_err;
 
 	/*
-	 * Use default chunk size (or hardsect_size, if larger) if none supplied
+	 * Use default chunk size (or logical_block_size, if larger)
+	 * if none supplied
 	 */
 	if (!ps->store->chunk_size) {
 		ps->store->chunk_size = max(DM_CHUNK_SIZE_DEFAULT_SECTORS,
@@ -334,10 +335,9 @@
 		return 0;
 
 	if (chunk_size_supplied)
-		DMWARN("chunk size %llu in device metadata overrides "
-		       "table chunk size of %llu.",
-		       (unsigned long long)chunk_size,
-		       (unsigned long long)ps->store->chunk_size);
+		DMWARN("chunk size %u in device metadata overrides "
+		       "table chunk size of %u.",
+		       chunk_size, ps->store->chunk_size);
 
 	/* We had a bogus chunk_size. Fix stuff up. */
 	free_area(ps);
@@ -345,8 +345,8 @@
 	r = dm_exception_store_set_chunk_size(ps->store, chunk_size,
 					      &chunk_err);
 	if (r) {
-		DMERR("invalid on-disk chunk size %llu: %s.",
-		      (unsigned long long)chunk_size, chunk_err);
+		DMERR("invalid on-disk chunk size %u: %s.",
+		      chunk_size, chunk_err);
 		return r;
 	}
 
--- linux-rt-2.6.31.orig/drivers/cpuidle/cpuidle.c
+++ linux-rt-2.6.31/drivers/cpuidle/cpuidle.c
@@ -75,8 +75,11 @@
 #endif
 	/* ask the governor for the next state */
 	next_state = cpuidle_curr_governor->select(dev);
-	if (need_resched())
+	if (need_resched()) {
+		local_irq_enable();
 		return;
+	}
+
 	target_state = &dev->states[next_state];
 
 	/* enter the state and update stats */
--- linux-rt-2.6.31.orig/drivers/media/radio/radio-gemtek-pci.c
+++ linux-rt-2.6.31/drivers/media/radio/radio-gemtek-pci.c
@@ -181,12 +181,10 @@
 
 static void gemtek_pci_unmute(struct gemtek_pci *card)
 {
-	mutex_lock(&card->lock);
 	if (card->mute) {
 		gemtek_pci_setfrequency(card, card->current_frequency);
 		card->mute = false;
 	}
-	mutex_unlock(&card->lock);
 }
 
 static int gemtek_pci_getsignal(struct gemtek_pci *card)
--- linux-rt-2.6.31.orig/drivers/media/video/ov511.c
+++ linux-rt-2.6.31/drivers/media/video/ov511.c
@@ -5878,7 +5878,7 @@
 		goto error;
 	}
 
-	mutex_lock(&ov->lock);
+	mutex_unlock(&ov->lock);
 
 	return 0;
 
--- linux-rt-2.6.31.orig/drivers/media/video/v4l1-compat.c
+++ linux-rt-2.6.31/drivers/media/video/v4l1-compat.c
@@ -565,10 +565,9 @@
 		break;
 	}
 	chan->norm = 0;
-	err = drv(file, VIDIOC_G_STD, &sid);
-	if (err < 0)
-		dprintk("VIDIOCGCHAN / VIDIOC_G_STD: %ld\n", err);
-	if (err == 0) {
+	/* Note: G_STD might not be present for radio receivers,
+	 * so we should ignore any errors. */
+	if (drv(file, VIDIOC_G_STD, &sid) == 0) {
 		if (sid & V4L2_STD_PAL)
 			chan->norm = VIDEO_MODE_PAL;
 		if (sid & V4L2_STD_NTSC)
@@ -777,10 +776,9 @@
 			tun->flags |= VIDEO_TUNER_SECAM;
 	}
 
-	err = drv(file, VIDIOC_G_STD, &sid);
-	if (err < 0)
-		dprintk("VIDIOCGTUNER / VIDIOC_G_STD: %ld\n", err);
-	if (err == 0) {
+	/* Note: G_STD might not be present for radio receivers,
+	 * so we should ignore any errors. */
+	if (drv(file, VIDIOC_G_STD, &sid) == 0) {
 		if (sid & V4L2_STD_PAL)
 			tun->mode = VIDEO_MODE_PAL;
 		if (sid & V4L2_STD_NTSC)
--- linux-rt-2.6.31.orig/drivers/media/video/s2255drv.c
+++ linux-rt-2.6.31/drivers/media/video/s2255drv.c
@@ -598,11 +598,6 @@
 	buf = list_entry(dma_q->active.next,
 			 struct s2255_buffer, vb.queue);
 
-	if (!waitqueue_active(&buf->vb.done)) {
-		/* no one active */
-		rc = -1;
-		goto unlock;
-	}
 	list_del(&buf->vb.queue);
 	do_gettimeofday(&buf->vb.ts);
 	dprintk(100, "[%p/%d] wakeup\n", buf, buf->vb.i);
--- linux-rt-2.6.31.orig/drivers/media/video/sn9c102/sn9c102_devtable.h
+++ linux-rt-2.6.31/drivers/media/video/sn9c102/sn9c102_devtable.h
@@ -123,8 +123,8 @@
 	{ SN9C102_USB_DEVICE(0x0c45, 0x613b, BRIDGE_SN9C120), },
 #if !defined CONFIG_USB_GSPCA && !defined CONFIG_USB_GSPCA_MODULE
 	{ SN9C102_USB_DEVICE(0x0c45, 0x613c, BRIDGE_SN9C120), },
-#endif
 	{ SN9C102_USB_DEVICE(0x0c45, 0x613e, BRIDGE_SN9C120), },
+#endif
 	{ }
 };
 
--- linux-rt-2.6.31.orig/drivers/media/video/saa7134/saa7134-cards.c
+++ linux-rt-2.6.31/drivers/media/video/saa7134/saa7134-cards.c
@@ -3373,6 +3373,7 @@
 		.tuner_config   = 3,
 		.mpeg           = SAA7134_MPEG_DVB,
 		.ts_type	= SAA7134_MPEG_TS_SERIAL,
+		.ts_force_val   = 1,
 		.gpiomask       = 0x0800100, /* GPIO 21 is an INPUT */
 		.inputs         = {{
 			.name = name_tv,
--- linux-rt-2.6.31.orig/drivers/media/video/saa7134/saa7134-ts.c
+++ linux-rt-2.6.31/drivers/media/video/saa7134/saa7134-ts.c
@@ -262,11 +262,13 @@
 	switch (saa7134_boards[dev->board].ts_type) {
 	case SAA7134_MPEG_TS_PARALLEL:
 		saa_writeb(SAA7134_TS_SERIAL0, 0x40);
-		saa_writeb(SAA7134_TS_PARALLEL, 0xec);
+		saa_writeb(SAA7134_TS_PARALLEL, 0xec |
+			(saa7134_boards[dev->board].ts_force_val << 4));
 		break;
 	case SAA7134_MPEG_TS_SERIAL:
 		saa_writeb(SAA7134_TS_SERIAL0, 0xd8);
-		saa_writeb(SAA7134_TS_PARALLEL, 0x6c);
+		saa_writeb(SAA7134_TS_PARALLEL, 0x6c |
+			(saa7134_boards[dev->board].ts_force_val << 4));
 		saa_writeb(SAA7134_TS_PARALLEL_SERIAL, 0xbc);
 		saa_writeb(SAA7134_TS_SERIAL1, 0x02);
 		break;
--- linux-rt-2.6.31.orig/drivers/media/video/saa7134/saa7134.h
+++ linux-rt-2.6.31/drivers/media/video/saa7134/saa7134.h
@@ -355,6 +355,7 @@
 	enum saa7134_mpeg_type  mpeg;
 	enum saa7134_mpeg_ts_type ts_type;
 	unsigned int            vid_port_opts;
+	unsigned int            ts_force_val:1;
 };
 
 #define card_has_radio(dev)   (NULL != saa7134_boards[dev->board].radio.name)
@@ -584,6 +585,10 @@
 	int                        nosignal;
 	unsigned int               insuspend;
 
+	/* I2C keyboard data */
+	struct i2c_board_info      info;
+	struct IR_i2c_init_data    init_data;
+
 	/* SAA7134_MPEG_* */
 	struct saa7134_ts          ts;
 	struct saa7134_dmaqueue    ts_q;
--- linux-rt-2.6.31.orig/drivers/media/video/saa7134/saa7134-input.c
+++ linux-rt-2.6.31/drivers/media/video/saa7134/saa7134-input.c
@@ -684,8 +684,6 @@
 
 void saa7134_probe_i2c_ir(struct saa7134_dev *dev)
 {
-	struct i2c_board_info info;
-	struct IR_i2c_init_data init_data;
 	const unsigned short addr_list[] = {
 		0x7a, 0x47, 0x71, 0x2d,
 		I2C_CLIENT_END
@@ -705,32 +703,32 @@
 		return;
 	}
 
-	memset(&info, 0, sizeof(struct i2c_board_info));
-	memset(&init_data, 0, sizeof(struct IR_i2c_init_data));
-	strlcpy(info.type, "ir_video", I2C_NAME_SIZE);
+	memset(&dev->info, 0, sizeof(dev->info));
+	memset(&dev->init_data, 0, sizeof(dev->init_data));
+	strlcpy(dev->info.type, "ir_video", I2C_NAME_SIZE);
 
 	switch (dev->board) {
 	case SAA7134_BOARD_PINNACLE_PCTV_110i:
 	case SAA7134_BOARD_PINNACLE_PCTV_310i:
-		init_data.name = "Pinnacle PCTV";
+		dev->init_data.name = "Pinnacle PCTV";
 		if (pinnacle_remote == 0) {
-			init_data.get_key = get_key_pinnacle_color;
-			init_data.ir_codes = ir_codes_pinnacle_color;
+			dev->init_data.get_key = get_key_pinnacle_color;
+			dev->init_data.ir_codes = ir_codes_pinnacle_color;
 		} else {
-			init_data.get_key = get_key_pinnacle_grey;
-			init_data.ir_codes = ir_codes_pinnacle_grey;
+			dev->init_data.get_key = get_key_pinnacle_grey;
+			dev->init_data.ir_codes = ir_codes_pinnacle_grey;
 		}
 		break;
 	case SAA7134_BOARD_UPMOST_PURPLE_TV:
-		init_data.name = "Purple TV";
-		init_data.get_key = get_key_purpletv;
-		init_data.ir_codes = ir_codes_purpletv;
+		dev->init_data.name = "Purple TV";
+		dev->init_data.get_key = get_key_purpletv;
+		dev->init_data.ir_codes = ir_codes_purpletv;
 		break;
 	case SAA7134_BOARD_MSI_TVATANYWHERE_PLUS:
-		init_data.name = "MSI TV@nywhere Plus";
-		init_data.get_key = get_key_msi_tvanywhere_plus;
-		init_data.ir_codes = ir_codes_msi_tvanywhere_plus;
-		info.addr = 0x30;
+		dev->init_data.name = "MSI TV@nywhere Plus";
+		dev->init_data.get_key = get_key_msi_tvanywhere_plus;
+		dev->init_data.ir_codes = ir_codes_msi_tvanywhere_plus;
+		dev->info.addr = 0x30;
 		/* MSI TV@nywhere Plus controller doesn't seem to
 		   respond to probes unless we read something from
 		   an existing device. Weird...
@@ -741,9 +739,9 @@
 			(1 == rc) ? "yes" : "no");
 		break;
 	case SAA7134_BOARD_HAUPPAUGE_HVR1110:
-		init_data.name = "HVR 1110";
-		init_data.get_key = get_key_hvr1110;
-		init_data.ir_codes = ir_codes_hauppauge_new;
+		dev->init_data.name = "HVR 1110";
+		dev->init_data.get_key = get_key_hvr1110;
+		dev->init_data.ir_codes = ir_codes_hauppauge_new;
 		break;
 	case SAA7134_BOARD_BEHOLD_607FM_MK3:
 	case SAA7134_BOARD_BEHOLD_607FM_MK5:
@@ -757,26 +755,26 @@
 	case SAA7134_BOARD_BEHOLD_M63:
 	case SAA7134_BOARD_BEHOLD_M6_EXTRA:
 	case SAA7134_BOARD_BEHOLD_H6:
-		init_data.name = "BeholdTV";
-		init_data.get_key = get_key_beholdm6xx;
-		init_data.ir_codes = ir_codes_behold;
+		dev->init_data.name = "BeholdTV";
+		dev->init_data.get_key = get_key_beholdm6xx;
+		dev->init_data.ir_codes = ir_codes_behold;
 		break;
 	case SAA7134_BOARD_AVERMEDIA_CARDBUS_501:
 	case SAA7134_BOARD_AVERMEDIA_CARDBUS_506:
-		info.addr = 0x40;
+		dev->info.addr = 0x40;
 		break;
 	}
 
-	if (init_data.name)
-		info.platform_data = &init_data;
+	if (dev->init_data.name)
+		dev->info.platform_data = &dev->init_data;
 	/* No need to probe if address is known */
-	if (info.addr) {
-		i2c_new_device(&dev->i2c_adap, &info);
+	if (dev->info.addr) {
+		i2c_new_device(&dev->i2c_adap, &dev->info);
 		return;
 	}
 
 	/* Address not known, fallback to probing */
-	i2c_new_probed_device(&dev->i2c_adap, &info, addr_list);
+	i2c_new_probed_device(&dev->i2c_adap, &dev->info, addr_list);
 }
 
 static int saa7134_rc5_irq(struct saa7134_dev *dev)
--- linux-rt-2.6.31.orig/drivers/media/video/uvc/uvc_driver.c
+++ linux-rt-2.6.31/drivers/media/video/uvc/uvc_driver.c
@@ -1983,6 +1983,15 @@
 	  .bInterfaceProtocol	= 0,
 	  .driver_info		= UVC_QUIRK_PROBE_MINMAX
 				| UVC_QUIRK_IGNORE_SELECTOR_UNIT },
+	/* COMPAL JHL90 */
+        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
+                                | USB_DEVICE_ID_MATCH_INT_INFO,
+          .idVendor             = 0x064e,
+          .idProduct            = 0xa115,
+          .bInterfaceClass      = USB_CLASS_VIDEO,
+          .bInterfaceSubClass   = 1,
+          .bInterfaceProtocol   = 0,
+          .driver_info          = UVC_QUIRK_PROBE_MINMAX },
 	/* Generic USB Video Class */
 	{ USB_INTERFACE_INFO(USB_CLASS_VIDEO, 1, 0) },
 	{}
--- linux-rt-2.6.31.orig/drivers/media/video/bt8xx/bttv-driver.c
+++ linux-rt-2.6.31/drivers/media/video/bt8xx/bttv-driver.c
@@ -1299,7 +1299,7 @@
 
 	tvnorm = &bttv_tvnorms[norm];
 
-	if (!memcmp(&bttv_tvnorms[btv->tvnorm].cropcap, &tvnorm->cropcap,
+	if (memcmp(&bttv_tvnorms[btv->tvnorm].cropcap, &tvnorm->cropcap,
 		    sizeof (tvnorm->cropcap))) {
 		bttv_crop_reset(&btv->crop[0], norm);
 		btv->crop[1] = btv->crop[0]; /* current = default */
@@ -3798,11 +3798,34 @@
 		if (!V4L2_FIELD_HAS_BOTH(item->vb.field) &&
 		    (item->vb.queue.next != &btv->capture)) {
 			item = list_entry(item->vb.queue.next, struct bttv_buffer, vb.queue);
+			/* Mike Isely <isely@pobox.com> - Only check
+			 * and set up the bottom field in the logic
+			 * below.  Don't ever do the top field.  This
+			 * of course means that if we set up the
+			 * bottom field in the above code that we'll
+			 * actually skip a field.  But that's OK.
+			 * Having processed only a single buffer this
+			 * time, then the next time around the first
+			 * available buffer should be for a top field.
+			 * That will then cause us here to set up a
+			 * top then a bottom field in the normal way.
+			 * The alternative to this understanding is
+			 * that we set up the second available buffer
+			 * as a top field, but that's out of order
+			 * since this driver always processes the top
+			 * field first - the effect will be the two
+			 * buffers being returned in the wrong order,
+			 * with the second buffer also being delayed
+			 * by one field time (owing to the fifo nature
+			 * of videobuf).  Worse still, we'll be stuck
+			 * doing fields out of order now every time
+			 * until something else causes a field to be
+			 * dropped.  By effectively forcing a field to
+			 * drop this way then we always get back into
+			 * sync within a single frame time.  (Out of
+			 * order fields can screw up deinterlacing
+			 * algorithms.) */
 			if (!V4L2_FIELD_HAS_BOTH(item->vb.field)) {
-				if (NULL == set->top &&
-				    V4L2_FIELD_TOP == item->vb.field) {
-					set->top = item;
-				}
 				if (NULL == set->bottom &&
 				    V4L2_FIELD_BOTTOM == item->vb.field) {
 					set->bottom = item;
--- linux-rt-2.6.31.orig/drivers/media/video/gspca/ov519.c
+++ linux-rt-2.6.31/drivers/media/video/gspca/ov519.c
@@ -3364,6 +3364,7 @@
 	{USB_DEVICE(0x041e, 0x4061), .driver_info = BRIDGE_OV519 },
 	{USB_DEVICE(0x041e, 0x4064),
 	 .driver_info = BRIDGE_OV519 | BRIDGE_INVERT_LED },
+	{USB_DEVICE(0x041e, 0x4067), .driver_info = BRIDGE_OV519 },
 	{USB_DEVICE(0x041e, 0x4068),
 	 .driver_info = BRIDGE_OV519 | BRIDGE_INVERT_LED },
 	{USB_DEVICE(0x045e, 0x028c), .driver_info = BRIDGE_OV519 },
--- linux-rt-2.6.31.orig/drivers/media/video/gspca/sonixj.c
+++ linux-rt-2.6.31/drivers/media/video/gspca/sonixj.c
@@ -727,7 +727,7 @@
 	{0xa1, 0x21, 0x12, 0x05, 0x00, 0x00, 0x00, 0x10},
 						/* Outformat = rawRGB */
 	{0xa1, 0x21, 0x13, 0xb8, 0x00, 0x00, 0x00, 0x10}, /* init COM8 */
-	{0xd1, 0x21, 0x00, 0x01, 0x74, 0x74, 0x00, 0x10},
+	{0xd1, 0x21, 0x00, 0x01, 0x74, 0x92, 0x00, 0x10},
 						/* GAIN BLUE RED VREF */
 	{0xd1, 0x21, 0x04, 0x00, 0x7d, 0x62, 0x00, 0x10},
 						/* COM 1 BAVE GEAVE AECHH */
@@ -783,7 +783,7 @@
 	{0xc1, 0x21, 0x88, 0xaf, 0xc7, 0xdf, 0x00, 0x10}, /* gamma curve */
 	{0xc1, 0x21, 0x8b, 0x99, 0x99, 0xcf, 0x00, 0x10}, /* reserved */
 	{0xb1, 0x21, 0x92, 0x00, 0x00, 0x00, 0x00, 0x10}, /* DM_LNL/H */
-	{0xb1, 0x21, 0xa1, 0x00, 0x00, 0x00, 0x00, 0x10},
+	{0xa1, 0x21, 0xa1, 0x00, 0x00, 0x00, 0x00, 0x10},
 /****** (some exchanges in the win trace) ******/
 	{0xa1, 0x21, 0x1e, 0x01, 0x00, 0x00, 0x00, 0x10}, /* MVFP */
 						/* bits[3..0]reserved */
@@ -1145,17 +1145,12 @@
 		reg_w1(gspca_dev, 0x01, 0x42);
 		break;
 	case SENSOR_OV7660:
-		reg_w1(gspca_dev, 0x01, 0x61);
-		reg_w1(gspca_dev, 0x17, 0x20);
-		reg_w1(gspca_dev, 0x01, 0x60);
-		reg_w1(gspca_dev, 0x01, 0x40);
-		break;
 	case SENSOR_SP80708:
 		reg_w1(gspca_dev, 0x01, 0x63);
 		reg_w1(gspca_dev, 0x17, 0x20);
 		reg_w1(gspca_dev, 0x01, 0x62);
 		reg_w1(gspca_dev, 0x01, 0x42);
-		mdelay(100);
+		msleep(100);
 		reg_w1(gspca_dev, 0x02, 0x62);
 		break;
 /*	case SENSOR_HV7131R: */
@@ -1624,6 +1619,8 @@
 
 static void setinfrared(struct sd *sd)
 {
+	if (sd->gspca_dev.ctrl_dis & (1 << INFRARED_IDX))
+		return;
 /*fixme: different sequence for StarCam Clip and StarCam 370i */
 /* Clip */
 	i2c_w1(&sd->gspca_dev, 0x02,			/* gpio */
@@ -1637,16 +1634,19 @@
 	if (gspca_dev->ctrl_dis & (1 << FREQ_IDX))
 		return;
 	if (sd->sensor == SENSOR_OV7660) {
+		u8 com8;
+
+		com8 = 0xdf;		/* auto gain/wb/expo */
 		switch (sd->freq) {
 		case 0: /* Banding filter disabled */
-			i2c_w1(gspca_dev, 0x13, 0xdf);
+			i2c_w1(gspca_dev, 0x13, com8 | 0x20);
 			break;
 		case 1: /* 50 hz */
-			i2c_w1(gspca_dev, 0x13, 0xff);
+			i2c_w1(gspca_dev, 0x13, com8);
 			i2c_w1(gspca_dev, 0x3b, 0x0a);
 			break;
 		case 2: /* 60 hz */
-			i2c_w1(gspca_dev, 0x13, 0xff);
+			i2c_w1(gspca_dev, 0x13, com8);
 			i2c_w1(gspca_dev, 0x3b, 0x02);
 			break;
 		}
@@ -1796,12 +1796,6 @@
 		reg_w1(gspca_dev, 0x99, 0x60);
 		break;
 	case SENSOR_OV7660:
-		reg_w1(gspca_dev, 0x9a, 0x05);
-		if (sd->bridge == BRIDGE_SN9C105)
-			reg_w1(gspca_dev, 0x99, 0xff);
-		else
-			reg_w1(gspca_dev, 0x99, 0x5b);
-		break;
 	case SENSOR_SP80708:
 		reg_w1(gspca_dev, 0x9a, 0x05);
 		reg_w1(gspca_dev, 0x99, 0x59);
@@ -2325,18 +2319,19 @@
 	{USB_DEVICE(0x0c45, 0x607c), BSI(SN9C102P, HV7131R, 0x11)},
 /*	{USB_DEVICE(0x0c45, 0x607e), BSI(SN9C102P, OV7630, 0x??)}, */
 	{USB_DEVICE(0x0c45, 0x60c0), BSI(SN9C105, MI0360, 0x5d)},
-/*	{USB_DEVICE(0x0c45, 0x60c8), BSI(SN9C105, OM6801, 0x??)}, */
+/*	{USB_DEVICE(0x0c45, 0x60c8), BSI(SN9C105, OM6802, 0x??)}, */
 /*	{USB_DEVICE(0x0c45, 0x60cc), BSI(SN9C105, HV7131GP, 0x??)}, */
 	{USB_DEVICE(0x0c45, 0x60ec), BSI(SN9C105, MO4000, 0x21)},
 /*	{USB_DEVICE(0x0c45, 0x60ef), BSI(SN9C105, ICM105C, 0x??)}, */
 /*	{USB_DEVICE(0x0c45, 0x60fa), BSI(SN9C105, OV7648, 0x??)}, */
 	{USB_DEVICE(0x0c45, 0x60fb), BSI(SN9C105, OV7660, 0x21)},
-	{USB_DEVICE(0x0c45, 0x60fc), BSI(SN9C105, HV7131R, 0x11)},
 #if !defined CONFIG_USB_SN9C102 && !defined CONFIG_USB_SN9C102_MODULE
+	{USB_DEVICE(0x0c45, 0x60fc), BSI(SN9C105, HV7131R, 0x11)},
 	{USB_DEVICE(0x0c45, 0x60fe), BSI(SN9C105, OV7630, 0x21)},
 #endif
 	{USB_DEVICE(0x0c45, 0x6100), BSI(SN9C120, MI0360, 0x5d)}, /*sn9c128*/
-/*	{USB_DEVICE(0x0c45, 0x6108), BSI(SN9C120, OM6801, 0x??)}, */
+/*	{USB_DEVICE(0x0c45, 0x6102), BSI(SN9C120, PO2030N, ??)}, */
+/*	{USB_DEVICE(0x0c45, 0x6108), BSI(SN9C120, OM6802, 0x21)}, */
 	{USB_DEVICE(0x0c45, 0x610a), BSI(SN9C120, OV7648, 0x21)}, /*sn9c128*/
 	{USB_DEVICE(0x0c45, 0x610b), BSI(SN9C120, OV7660, 0x21)}, /*sn9c128*/
 	{USB_DEVICE(0x0c45, 0x610c), BSI(SN9C120, HV7131R, 0x11)}, /*sn9c128*/
@@ -2352,6 +2347,7 @@
 #if !defined CONFIG_USB_SN9C102 && !defined CONFIG_USB_SN9C102_MODULE
 	{USB_DEVICE(0x0c45, 0x6130), BSI(SN9C120, MI0360, 0x5d)},
 #endif
+/*	{USB_DEVICE(0x0c45, 0x6132), BSI(SN9C120, OV7670, 0x21)}, */
 	{USB_DEVICE(0x0c45, 0x6138), BSI(SN9C120, MO4000, 0x21)},
 	{USB_DEVICE(0x0c45, 0x613a), BSI(SN9C120, OV7648, 0x21)},
 #if !defined CONFIG_USB_SN9C102 && !defined CONFIG_USB_SN9C102_MODULE
@@ -2359,7 +2355,9 @@
 #endif
 	{USB_DEVICE(0x0c45, 0x613c), BSI(SN9C120, HV7131R, 0x11)},
 	{USB_DEVICE(0x0c45, 0x613e), BSI(SN9C120, OV7630, 0x21)},
-	{USB_DEVICE(0x0c45, 0x6143), BSI(SN9C120, SP80708, 0x18)},
+/*	{USB_DEVICE(0x0c45, 0x6142), BSI(SN9C120, PO2030N, ??)}, *sn9c120b*/
+	{USB_DEVICE(0x0c45, 0x6143), BSI(SN9C120, SP80708, 0x18)}, /*sn9c120b*/
+	{USB_DEVICE(0x0c45, 0x6148), BSI(SN9C120, OM6802, 0x21)}, /*sn9c120b*/
 	{}
 };
 MODULE_DEVICE_TABLE(usb, device_table);
--- linux-rt-2.6.31.orig/drivers/media/video/gspca/vc032x.c
+++ linux-rt-2.6.31/drivers/media/video/gspca/vc032x.c
@@ -424,208 +424,92 @@
 static const __u8 mi1310_socinitVGA_JPG[][4] = {
 	{0xb0, 0x03, 0x19, 0xcc},
 	{0xb0, 0x04, 0x02, 0xcc},
-	{0xb3, 0x00, 0x24, 0xcc},
-	{0xb3, 0x00, 0x25, 0xcc},
-	{0xb3, 0x05, 0x01, 0xcc},
-	{0xb3, 0x06, 0x03, 0xcc},
-	{0xb3, 0x5c, 0x01, 0xcc},
+	{0xb3, 0x00, 0x64, 0xcc},
+	{0xb3, 0x00, 0x65, 0xcc},
+	{0xb3, 0x05, 0x00, 0xcc},
+	{0xb3, 0x06, 0x00, 0xcc},
 	{0xb3, 0x08, 0x01, 0xcc},
 	{0xb3, 0x09, 0x0c, 0xcc},
 	{0xb3, 0x34, 0x02, 0xcc},
 	{0xb3, 0x35, 0xdd, 0xcc},
+	{0xb3, 0x02, 0x00, 0xcc},
 	{0xb3, 0x03, 0x0a, 0xcc},
-	{0xb3, 0x04, 0x0d, 0xcc},
+	{0xb3, 0x04, 0x05, 0xcc},
 	{0xb3, 0x20, 0x00, 0xcc},
 	{0xb3, 0x21, 0x00, 0xcc},
-	{0xb3, 0x22, 0x01, 0xcc},
-	{0xb3, 0x23, 0xe0, 0xcc},
+	{0xb3, 0x22, 0x03, 0xcc},
+	{0xb3, 0x23, 0xc0, 0xcc},
 	{0xb3, 0x14, 0x00, 0xcc},
 	{0xb3, 0x15, 0x00, 0xcc},
-	{0xb3, 0x16, 0x02, 0xcc},
-	{0xb3, 0x17, 0x7f, 0xcc},
-	{0xb8, 0x01, 0x7d, 0xcc},
-	{0xb8, 0x81, 0x09, 0xcc},
-	{0xb8, 0x27, 0x20, 0xcc},
-	{0xb8, 0x26, 0x80, 0xcc},
-	{0xb3, 0x00, 0x25, 0xcc},
-	{0xb8, 0x00, 0x13, 0xcc},
-	{0xbc, 0x00, 0x71, 0xcc},
-	{0xb8, 0x81, 0x01, 0xcc},
-	{0xb8, 0x2c, 0x5a, 0xcc},
-	{0xb8, 0x2d, 0xff, 0xcc},
-	{0xb8, 0x2e, 0xee, 0xcc},
-	{0xb8, 0x2f, 0xfb, 0xcc},
-	{0xb8, 0x30, 0x52, 0xcc},
-	{0xb8, 0x31, 0xf8, 0xcc},
-	{0xb8, 0x32, 0xf1, 0xcc},
-	{0xb8, 0x33, 0xff, 0xcc},
-	{0xb8, 0x34, 0x54, 0xcc},
-	{0xb8, 0x35, 0x00, 0xcc},
-	{0xb8, 0x36, 0x00, 0xcc},
-	{0xb8, 0x37, 0x00, 0xcc},
+	{0xb3, 0x16, 0x04, 0xcc},
+	{0xb3, 0x17, 0xff, 0xcc},
+	{0xb3, 0x00, 0x65, 0xcc},
+	{0xb8, 0x00, 0x00, 0xcc},
+	{0xbc, 0x00, 0xd0, 0xcc},
+	{0xbc, 0x01, 0x01, 0xcc},
+	{0xf0, 0x00, 0x02, 0xbb},
+	{0xc8, 0x9f, 0x0b, 0xbb},
+	{0x5b, 0x00, 0x01, 0xbb},
+	{0x2f, 0xde, 0x20, 0xbb},
 	{0xf0, 0x00, 0x00, 0xbb},
-	{0x00, 0x01, 0x00, 0xdd},
-	{0x0d, 0x00, 0x09, 0xbb},
-	{0x0d, 0x00, 0x08, 0xbb},
+	{0x20, 0x03, 0x02, 0xbb},
 	{0xf0, 0x00, 0x01, 0xbb},
-	{0x00, 0x01, 0x00, 0xdd},
-	{0x06, 0x00, 0x14, 0xbb},
-	{0x3a, 0x10, 0x00, 0xbb},
-	{0x00, 0x00, 0x10, 0xdd},
-	{0x9b, 0x10, 0x00, 0xbb},
-	{0x00, 0x00, 0x10, 0xdd},
+	{0x05, 0x00, 0x07, 0xbb},
+	{0x34, 0x00, 0x00, 0xbb},
+	{0x35, 0xff, 0x00, 0xbb},
+	{0xdc, 0x07, 0x02, 0xbb},
+	{0xdd, 0x3c, 0x18, 0xbb},
+	{0xde, 0x92, 0x6d, 0xbb},
+	{0xdf, 0xcd, 0xb1, 0xbb},
+	{0xe0, 0xff, 0xe7, 0xbb},
+	{0x06, 0xf0, 0x0d, 0xbb},
+	{0x06, 0x70, 0x0e, 0xbb},
+	{0x4c, 0x00, 0x01, 0xbb},
+	{0x4d, 0x00, 0x01, 0xbb},
+	{0xf0, 0x00, 0x02, 0xbb},
+	{0x2e, 0x0c, 0x55, 0xbb},
+	{0x21, 0xb6, 0x6e, 0xbb},
+	{0x36, 0x30, 0x10, 0xbb},
+	{0x37, 0x00, 0xc1, 0xbb},
 	{0xf0, 0x00, 0x00, 0xbb},
-	{0x00, 0x01, 0x00, 0xdd},
-	{0x2b, 0x00, 0x28, 0xbb},
-	{0x2c, 0x00, 0x30, 0xbb},
-	{0x2d, 0x00, 0x30, 0xbb},
-	{0x2e, 0x00, 0x28, 0xbb},
-	{0x41, 0x00, 0xd7, 0xbb},
-	{0x09, 0x02, 0x3a, 0xbb},
-	{0x0c, 0x00, 0x00, 0xbb},
-	{0x20, 0x00, 0x00, 0xbb},
-	{0x05, 0x00, 0x8c, 0xbb},
-	{0x06, 0x00, 0x32, 0xbb},
-	{0x07, 0x00, 0xc6, 0xbb},
-	{0x08, 0x00, 0x19, 0xbb},
-	{0x24, 0x80, 0x6f, 0xbb},
-	{0xc8, 0x00, 0x0f, 0xbb},
-	{0x20, 0x00, 0x0f, 0xbb},
+	{0x07, 0x00, 0x84, 0xbb},
+	{0x08, 0x02, 0x4a, 0xbb},
+	{0x05, 0x01, 0x10, 0xbb},
+	{0x06, 0x00, 0x39, 0xbb},
+	{0xf0, 0x00, 0x02, 0xbb},
+	{0x58, 0x02, 0x67, 0xbb},
+	{0x57, 0x02, 0x00, 0xbb},
+	{0x5a, 0x02, 0x67, 0xbb},
+	{0x59, 0x02, 0x00, 0xbb},
+	{0x5c, 0x12, 0x0d, 0xbb},
+	{0x5d, 0x16, 0x11, 0xbb},
+	{0x39, 0x06, 0x18, 0xbb},
+	{0x3a, 0x06, 0x18, 0xbb},
+	{0x3b, 0x06, 0x18, 0xbb},
+	{0x3c, 0x06, 0x18, 0xbb},
+	{0x64, 0x7b, 0x5b, 0xbb},
+	{0xf0, 0x00, 0x02, 0xbb},
+	{0x36, 0x30, 0x10, 0xbb},
+	{0x37, 0x00, 0xc0, 0xbb},
+	{0xbc, 0x0e, 0x00, 0xcc},
+	{0xbc, 0x0f, 0x05, 0xcc},
+	{0xbc, 0x10, 0xc0, 0xcc},
+	{0xbc, 0x11, 0x03, 0xcc},
 	{0xb6, 0x00, 0x00, 0xcc},
 	{0xb6, 0x03, 0x02, 0xcc},
 	{0xb6, 0x02, 0x80, 0xcc},
 	{0xb6, 0x05, 0x01, 0xcc},
 	{0xb6, 0x04, 0xe0, 0xcc},
-	{0xb6, 0x12, 0x78, 0xcc},
+	{0xb6, 0x12, 0xf8, 0xcc},
+	{0xb6, 0x13, 0x25, 0xcc},
 	{0xb6, 0x18, 0x02, 0xcc},
 	{0xb6, 0x17, 0x58, 0xcc},
 	{0xb6, 0x16, 0x00, 0xcc},
 	{0xb6, 0x22, 0x12, 0xcc},
 	{0xb6, 0x23, 0x0b, 0xcc},
-	{0xb3, 0x02, 0x02, 0xcc},
 	{0xbf, 0xc0, 0x39, 0xcc},
 	{0xbf, 0xc1, 0x04, 0xcc},
-	{0xbf, 0xcc, 0x10, 0xcc},
-	{0xb9, 0x12, 0x00, 0xcc},
-	{0xb9, 0x13, 0x0a, 0xcc},
-	{0xb9, 0x14, 0x0a, 0xcc},
-	{0xb9, 0x15, 0x0a, 0xcc},
-	{0xb9, 0x16, 0x0a, 0xcc},
-	{0xb9, 0x18, 0x00, 0xcc},
-	{0xb9, 0x19, 0x0f, 0xcc},
-	{0xb9, 0x1a, 0x0f, 0xcc},
-	{0xb9, 0x1b, 0x0f, 0xcc},
-	{0xb9, 0x1c, 0x0f, 0xcc},
-	{0xb8, 0x8e, 0x00, 0xcc},
-	{0xb8, 0x8f, 0xff, 0xcc},
-	{0xb3, 0x01, 0x41, 0xcc},
-	{0x03, 0x03, 0xc0, 0xbb},
-	{0x06, 0x00, 0x10, 0xbb},
-	{0xb6, 0x12, 0xf8, 0xcc},
-	{0xb8, 0x0c, 0x20, 0xcc},
-	{0xb8, 0x0d, 0x70, 0xcc},
-	{0xb6, 0x13, 0x13, 0xcc},
-	{0x2f, 0x00, 0xC0, 0xbb},
-	{0xb8, 0xa0, 0x12, 0xcc},
-	{},
-};
-static const __u8 mi1310_socinitQVGA_JPG[][4] = {
-	{0xb0, 0x03, 0x19, 0xcc},
-	{0xb0, 0x04, 0x02, 0xcc},
-	{0xb3, 0x00, 0x24, 0xcc},
-	{0xb3, 0x00, 0x25, 0xcc},
-	{0xb3, 0x05, 0x01, 0xcc},
-	{0xb3, 0x06, 0x03, 0xcc},
-	{0xb3, 0x5c, 0x01, 0xcc},
-	{0xb3, 0x08, 0x01, 0xcc},
-	{0xb3, 0x09, 0x0c, 0xcc},
-	{0xb3, 0x34, 0x02, 0xcc},
-	{0xb3, 0x35, 0xdd, 0xcc},
-	{0xb3, 0x03, 0x0a, 0xcc},
-	{0xb3, 0x04, 0x0d, 0xcc},
-	{0xb3, 0x20, 0x00, 0xcc},
-	{0xb3, 0x21, 0x00, 0xcc},
-	{0xb3, 0x22, 0x01, 0xcc},
-	{0xb3, 0x23, 0xe0, 0xcc},
-	{0xb3, 0x14, 0x00, 0xcc},
-	{0xb3, 0x15, 0x00, 0xcc},
-	{0xb3, 0x16, 0x02, 0xcc},
-	{0xb3, 0x17, 0x7f, 0xcc},
-	{0xb8, 0x01, 0x7d, 0xcc},
-	{0xb8, 0x81, 0x09, 0xcc},
-	{0xb8, 0x27, 0x20, 0xcc},
-	{0xb8, 0x26, 0x80, 0xcc},
-	{0xb3, 0x00, 0x25, 0xcc},
-	{0xb8, 0x00, 0x13, 0xcc},
-	{0xbc, 0x00, 0xd1, 0xcc},
-	{0xb8, 0x81, 0x01, 0xcc},
-	{0xb8, 0x2c, 0x5a, 0xcc},
-	{0xb8, 0x2d, 0xff, 0xcc},
-	{0xb8, 0x2e, 0xee, 0xcc},
-	{0xb8, 0x2f, 0xfb, 0xcc},
-	{0xb8, 0x30, 0x52, 0xcc},
-	{0xb8, 0x31, 0xf8, 0xcc},
-	{0xb8, 0x32, 0xf1, 0xcc},
-	{0xb8, 0x33, 0xff, 0xcc},
-	{0xb8, 0x34, 0x54, 0xcc},
-	{0xb8, 0x35, 0x00, 0xcc},
-	{0xb8, 0x36, 0x00, 0xcc},
-	{0xb8, 0x37, 0x00, 0xcc},
-	{0xf0, 0x00, 0x00, 0xbb},
-	{0x00, 0x01, 0x00, 0xdd},
-	{0x0d, 0x00, 0x09, 0xbb},
-	{0x0d, 0x00, 0x08, 0xbb},
-	{0xf0, 0x00, 0x01, 0xbb},
-	{0x00, 0x01, 0x00, 0xdd},
-	{0x06, 0x00, 0x14, 0xbb},
-	{0x3a, 0x10, 0x00, 0xbb},
-	{0x00, 0x00, 0x10, 0xdd},
-	{0x9b, 0x10, 0x00, 0xbb},
-	{0x00, 0x00, 0x10, 0xdd},
-	{0xf0, 0x00, 0x00, 0xbb},
-	{0x00, 0x01, 0x00, 0xdd},
-	{0x2b, 0x00, 0x28, 0xbb},
-	{0x2c, 0x00, 0x30, 0xbb},
-	{0x2d, 0x00, 0x30, 0xbb},
-	{0x2e, 0x00, 0x28, 0xbb},
-	{0x41, 0x00, 0xd7, 0xbb},
-	{0x09, 0x02, 0x3a, 0xbb},
-	{0x0c, 0x00, 0x00, 0xbb},
-	{0x20, 0x00, 0x00, 0xbb},
-	{0x05, 0x00, 0x8c, 0xbb},
-	{0x06, 0x00, 0x32, 0xbb},
-	{0x07, 0x00, 0xc6, 0xbb},
-	{0x08, 0x00, 0x19, 0xbb},
-	{0x24, 0x80, 0x6f, 0xbb},
-	{0xc8, 0x00, 0x0f, 0xbb},
-	{0x20, 0x00, 0x0f, 0xbb},
-	{0xb6, 0x00, 0x00, 0xcc},
-	{0xb6, 0x03, 0x01, 0xcc},
-	{0xb6, 0x02, 0x40, 0xcc},
-	{0xb6, 0x05, 0x00, 0xcc},
-	{0xb6, 0x04, 0xf0, 0xcc},
-	{0xb6, 0x12, 0x78, 0xcc},
-	{0xb6, 0x18, 0x00, 0xcc},
-	{0xb6, 0x17, 0x96, 0xcc},
-	{0xb6, 0x16, 0x00, 0xcc},
-	{0xb6, 0x22, 0x12, 0xcc},
-	{0xb6, 0x23, 0x0b, 0xcc},
-	{0xb3, 0x02, 0x02, 0xcc},
-	{0xbf, 0xc0, 0x39, 0xcc},
-	{0xbf, 0xc1, 0x04, 0xcc},
-	{0xbf, 0xcc, 0x10, 0xcc},
-	{0xb9, 0x12, 0x00, 0xcc},
-	{0xb9, 0x13, 0x0a, 0xcc},
-	{0xb9, 0x14, 0x0a, 0xcc},
-	{0xb9, 0x15, 0x0a, 0xcc},
-	{0xb9, 0x16, 0x0a, 0xcc},
-	{0xb9, 0x18, 0x00, 0xcc},
-	{0xb9, 0x19, 0x0f, 0xcc},
-	{0xb9, 0x1a, 0x0f, 0xcc},
-	{0xb9, 0x1b, 0x0f, 0xcc},
-	{0xb9, 0x1c, 0x0f, 0xcc},
-	{0xb8, 0x8e, 0x00, 0xcc},
-	{0xb8, 0x8f, 0xff, 0xcc},
+	{0xbf, 0xcc, 0x00, 0xcc},
 	{0xbc, 0x02, 0x18, 0xcc},
 	{0xbc, 0x03, 0x50, 0xcc},
 	{0xbc, 0x04, 0x18, 0xcc},
@@ -636,15 +520,130 @@
 	{0xbc, 0x0a, 0x10, 0xcc},
 	{0xbc, 0x0b, 0x00, 0xcc},
 	{0xbc, 0x0c, 0x00, 0xcc},
+	{0xb3, 0x5c, 0x01, 0xcc},
+	{0xf0, 0x00, 0x01, 0xbb},
+	{0x80, 0x00, 0x03, 0xbb},
+	{0x81, 0xc7, 0x14, 0xbb},
+	{0x82, 0xeb, 0xe8, 0xbb},
+	{0x83, 0xfe, 0xf4, 0xbb},
+	{0x84, 0xcd, 0x10, 0xbb},
+	{0x85, 0xf3, 0xee, 0xbb},
+	{0x86, 0xff, 0xf1, 0xbb},
+	{0x87, 0xcd, 0x10, 0xbb},
+	{0x88, 0xf3, 0xee, 0xbb},
+	{0x89, 0x01, 0xf1, 0xbb},
+	{0x8a, 0xe5, 0x17, 0xbb},
+	{0x8b, 0xe8, 0xe2, 0xbb},
+	{0x8c, 0xf7, 0xed, 0xbb},
+	{0x8d, 0x00, 0xff, 0xbb},
+	{0x8e, 0xec, 0x10, 0xbb},
+	{0x8f, 0xf0, 0xed, 0xbb},
+	{0x90, 0xf9, 0xf2, 0xbb},
+	{0x91, 0x00, 0x00, 0xbb},
+	{0x92, 0xe9, 0x0d, 0xbb},
+	{0x93, 0xf4, 0xf2, 0xbb},
+	{0x94, 0xfb, 0xf5, 0xbb},
+	{0x95, 0x00, 0xff, 0xbb},
+	{0xb6, 0x0f, 0x08, 0xbb},
+	{0xb7, 0x3d, 0x16, 0xbb},
+	{0xb8, 0x0c, 0x04, 0xbb},
+	{0xb9, 0x1c, 0x07, 0xbb},
+	{0xba, 0x0a, 0x03, 0xbb},
+	{0xbb, 0x1b, 0x09, 0xbb},
+	{0xbc, 0x17, 0x0d, 0xbb},
+	{0xbd, 0x23, 0x1d, 0xbb},
+	{0xbe, 0x00, 0x28, 0xbb},
+	{0xbf, 0x11, 0x09, 0xbb},
+	{0xc0, 0x16, 0x15, 0xbb},
+	{0xc1, 0x00, 0x1b, 0xbb},
+	{0xc2, 0x0e, 0x07, 0xbb},
+	{0xc3, 0x14, 0x10, 0xbb},
+	{0xc4, 0x00, 0x17, 0xbb},
+	{0x06, 0x74, 0x8e, 0xbb},
+	{0xf0, 0x00, 0x01, 0xbb},
+	{0x06, 0xf4, 0x8e, 0xbb},
+	{0x00, 0x00, 0x50, 0xdd},
+	{0x06, 0x74, 0x8e, 0xbb},
+	{0xf0, 0x00, 0x02, 0xbb},
+	{0x24, 0x50, 0x20, 0xbb},
+	{0xf0, 0x00, 0x02, 0xbb},
+	{0x34, 0x0c, 0x50, 0xbb},
 	{0xb3, 0x01, 0x41, 0xcc},
+	{0xf0, 0x00, 0x00, 0xbb},
+	{0x03, 0x03, 0xc0, 0xbb},
+	{},
+};
+static const __u8 mi1310_socinitQVGA_JPG[][4] = {
+	{0xb0, 0x03, 0x19, 0xcc},	{0xb0, 0x04, 0x02, 0xcc},
+	{0xb3, 0x00, 0x64, 0xcc},	{0xb3, 0x00, 0x65, 0xcc},
+	{0xb3, 0x05, 0x00, 0xcc},	{0xb3, 0x06, 0x00, 0xcc},
+	{0xb3, 0x08, 0x01, 0xcc},	{0xb3, 0x09, 0x0c, 0xcc},
+	{0xb3, 0x34, 0x02, 0xcc},	{0xb3, 0x35, 0xdd, 0xcc},
+	{0xb3, 0x02, 0x00, 0xcc},	{0xb3, 0x03, 0x0a, 0xcc},
+	{0xb3, 0x04, 0x05, 0xcc},	{0xb3, 0x20, 0x00, 0xcc},
+	{0xb3, 0x21, 0x00, 0xcc},	{0xb3, 0x22, 0x03, 0xcc},
+	{0xb3, 0x23, 0xc0, 0xcc},	{0xb3, 0x14, 0x00, 0xcc},
+	{0xb3, 0x15, 0x00, 0xcc},	{0xb3, 0x16, 0x04, 0xcc},
+	{0xb3, 0x17, 0xff, 0xcc},	{0xb3, 0x00, 0x65, 0xcc},
+	{0xb8, 0x00, 0x00, 0xcc},	{0xbc, 0x00, 0xf0, 0xcc},
+	{0xbc, 0x01, 0x01, 0xcc},	{0xf0, 0x00, 0x02, 0xbb},
+	{0xc8, 0x9f, 0x0b, 0xbb},	{0x5b, 0x00, 0x01, 0xbb},
+	{0x2f, 0xde, 0x20, 0xbb},	{0xf0, 0x00, 0x00, 0xbb},
+	{0x20, 0x03, 0x02, 0xbb},	{0xf0, 0x00, 0x01, 0xbb},
+	{0x05, 0x00, 0x07, 0xbb},	{0x34, 0x00, 0x00, 0xbb},
+	{0x35, 0xff, 0x00, 0xbb},	{0xdc, 0x07, 0x02, 0xbb},
+	{0xdd, 0x3c, 0x18, 0xbb},	{0xde, 0x92, 0x6d, 0xbb},
+	{0xdf, 0xcd, 0xb1, 0xbb},	{0xe0, 0xff, 0xe7, 0xbb},
+	{0x06, 0xf0, 0x0d, 0xbb},	{0x06, 0x70, 0x0e, 0xbb},
+	{0x4c, 0x00, 0x01, 0xbb},	{0x4d, 0x00, 0x01, 0xbb},
+	{0xf0, 0x00, 0x02, 0xbb},	{0x2e, 0x0c, 0x55, 0xbb},
+	{0x21, 0xb6, 0x6e, 0xbb},	{0x36, 0x30, 0x10, 0xbb},
+	{0x37, 0x00, 0xc1, 0xbb},	{0xf0, 0x00, 0x00, 0xbb},
+	{0x07, 0x00, 0x84, 0xbb},	{0x08, 0x02, 0x4a, 0xbb},
+	{0x05, 0x01, 0x10, 0xbb},	{0x06, 0x00, 0x39, 0xbb},
+	{0xf0, 0x00, 0x02, 0xbb},	{0x58, 0x02, 0x67, 0xbb},
+	{0x57, 0x02, 0x00, 0xbb},	{0x5a, 0x02, 0x67, 0xbb},
+	{0x59, 0x02, 0x00, 0xbb},	{0x5c, 0x12, 0x0d, 0xbb},
+	{0x5d, 0x16, 0x11, 0xbb},	{0x39, 0x06, 0x18, 0xbb},
+	{0x3a, 0x06, 0x18, 0xbb},	{0x3b, 0x06, 0x18, 0xbb},
+	{0x3c, 0x06, 0x18, 0xbb},	{0x64, 0x7b, 0x5b, 0xbb},
+	{0xf0, 0x00, 0x02, 0xbb},	{0x36, 0x30, 0x10, 0xbb},
+	{0x37, 0x00, 0xc0, 0xbb},	{0xbc, 0x0e, 0x00, 0xcc},
+	{0xbc, 0x0f, 0x05, 0xcc},	{0xbc, 0x10, 0xc0, 0xcc},
+	{0xbc, 0x11, 0x03, 0xcc},	{0xb6, 0x00, 0x00, 0xcc},
+	{0xb6, 0x03, 0x01, 0xcc},	{0xb6, 0x02, 0x40, 0xcc},
+	{0xb6, 0x05, 0x00, 0xcc},	{0xb6, 0x04, 0xf0, 0xcc},
+	{0xb6, 0x12, 0xf8, 0xcc},	{0xb6, 0x13, 0x25, 0xcc},
+	{0xb6, 0x18, 0x00, 0xcc},	{0xb6, 0x17, 0x96, 0xcc},
+	{0xb6, 0x16, 0x00, 0xcc},	{0xb6, 0x22, 0x12, 0xcc},
+	{0xb6, 0x23, 0x0b, 0xcc},	{0xbf, 0xc0, 0x39, 0xcc},
+	{0xbf, 0xc1, 0x04, 0xcc},	{0xbf, 0xcc, 0x00, 0xcc},
+	{0xb3, 0x5c, 0x01, 0xcc},	{0xf0, 0x00, 0x01, 0xbb},
+	{0x80, 0x00, 0x03, 0xbb},	{0x81, 0xc7, 0x14, 0xbb},
+	{0x82, 0xeb, 0xe8, 0xbb},	{0x83, 0xfe, 0xf4, 0xbb},
+	{0x84, 0xcd, 0x10, 0xbb},	{0x85, 0xf3, 0xee, 0xbb},
+	{0x86, 0xff, 0xf1, 0xbb},	{0x87, 0xcd, 0x10, 0xbb},
+	{0x88, 0xf3, 0xee, 0xbb},	{0x89, 0x01, 0xf1, 0xbb},
+	{0x8a, 0xe5, 0x17, 0xbb},	{0x8b, 0xe8, 0xe2, 0xbb},
+	{0x8c, 0xf7, 0xed, 0xbb},	{0x8d, 0x00, 0xff, 0xbb},
+	{0x8e, 0xec, 0x10, 0xbb},	{0x8f, 0xf0, 0xed, 0xbb},
+	{0x90, 0xf9, 0xf2, 0xbb},	{0x91, 0x00, 0x00, 0xbb},
+	{0x92, 0xe9, 0x0d, 0xbb},	{0x93, 0xf4, 0xf2, 0xbb},
+	{0x94, 0xfb, 0xf5, 0xbb},	{0x95, 0x00, 0xff, 0xbb},
+	{0xb6, 0x0f, 0x08, 0xbb},	{0xb7, 0x3d, 0x16, 0xbb},
+	{0xb8, 0x0c, 0x04, 0xbb},	{0xb9, 0x1c, 0x07, 0xbb},
+	{0xba, 0x0a, 0x03, 0xbb},	{0xbb, 0x1b, 0x09, 0xbb},
+	{0xbc, 0x17, 0x0d, 0xbb},	{0xbd, 0x23, 0x1d, 0xbb},
+	{0xbe, 0x00, 0x28, 0xbb},	{0xbf, 0x11, 0x09, 0xbb},
+	{0xc0, 0x16, 0x15, 0xbb},	{0xc1, 0x00, 0x1b, 0xbb},
+	{0xc2, 0x0e, 0x07, 0xbb},	{0xc3, 0x14, 0x10, 0xbb},
+	{0xc4, 0x00, 0x17, 0xbb},	{0x06, 0x74, 0x8e, 0xbb},
+	{0xf0, 0x00, 0x01, 0xbb},	{0x06, 0xf4, 0x8e, 0xbb},
+	{0x00, 0x00, 0x50, 0xdd},	{0x06, 0x74, 0x8e, 0xbb},
+	{0xf0, 0x00, 0x02, 0xbb},	{0x24, 0x50, 0x20, 0xbb},
+	{0xf0, 0x00, 0x02, 0xbb},	{0x34, 0x0c, 0x50, 0xbb},
+	{0xb3, 0x01, 0x41, 0xcc},	{0xf0, 0x00, 0x00, 0xbb},
 	{0x03, 0x03, 0xc0, 0xbb},
-	{0x06, 0x00, 0x10, 0xbb},
-	{0xb6, 0x12, 0xf8, 0xcc},
-	{0xb8, 0x0c, 0x20, 0xcc},
-	{0xb8, 0x0d, 0x70, 0xcc},
-	{0xb6, 0x13, 0x13, 0xcc},
-	{0x2f, 0x00, 0xC0, 0xbb},
-	{0xb8, 0xa0, 0x12, 0xcc},
 	{},
 };
 static const u8 mi1310_soc_InitSXGA_JPG[][4] = {
@@ -2514,7 +2513,8 @@
 			break;
 		case SENSOR_MI1310_SOC:
 			cam->cam_mode = vc0323_mode;
-			cam->nmodes = ARRAY_SIZE(vc0323_mode);
+			/* TODO: 1280x1024 resolution setting is incorrect, so don't export it now*/
+			cam->nmodes = ARRAY_SIZE(vc0323_mode) - 1;
 			break;
 		case SENSOR_MI1320_SOC:
 			cam->cam_mode = bi_mode;
@@ -2737,15 +2737,20 @@
 		put_tab_to_reg(gspca_dev, MatrixT, 9, 0xb82c);
 
 		/* set the led on 0x0892 0x0896 */
-		if (sd->sensor != SENSOR_PO1200) {
-			reg_w(gspca_dev->dev, 0x89, 0xffff, 0xfdff);
+		if (sd->sensor == SENSOR_PO1200) {
+			setsharpness(gspca_dev);
+			sethvflip(gspca_dev);
+			reg_w(gspca_dev->dev, 0x89, 0x0400, 0x1415);
+		} else if (sd->sensor == SENSOR_MI1310_SOC) {
+			reg_w(gspca_dev->dev, 0x89, 0x058c, 0x0000);
 			msleep(100);
 			sethvflip(gspca_dev);
 			setlightfreq(gspca_dev);
 		} else {
-			setsharpness(gspca_dev);
+			reg_w(gspca_dev->dev, 0x89, 0xffff, 0xfdff);
+			msleep(100);
 			sethvflip(gspca_dev);
-			reg_w(gspca_dev->dev, 0x89, 0x0400, 0x1415);
+			setlightfreq(gspca_dev);
 		}
 	}
 	return 0;
@@ -2754,8 +2759,12 @@
 static void sd_stopN(struct gspca_dev *gspca_dev)
 {
 	struct usb_device *dev = gspca_dev->dev;
+	struct sd *sd = (struct sd *) gspca_dev;
 
-	reg_w(dev, 0x89, 0xffff, 0xffff);
+	if( sd->sensor == SENSOR_MI1310_SOC)
+		reg_w(dev, 0x89, 0x058c, 0x00ff);
+	else
+		reg_w(dev, 0x89, 0xffff, 0xffff);
 	reg_w(dev, 0xa0, 0x01, 0xb301);
 	reg_w(dev, 0xa0, 0x09, 0xb003);
 }
@@ -2764,10 +2773,14 @@
 static void sd_stop0(struct gspca_dev *gspca_dev)
 {
 	struct usb_device *dev = gspca_dev->dev;
+	struct sd *sd = (struct sd *) gspca_dev;
 
 	if (!gspca_dev->present)
 		return;
-	reg_w(dev, 0x89, 0xffff, 0xffff);
+	if( sd->sensor == SENSOR_MI1310_SOC)
+		reg_w(dev, 0x89, 0x058c, 0x00ff);
+	else
+		reg_w(dev, 0x89, 0xffff, 0xffff);
 }
 
 static void sd_pkt_scan(struct gspca_dev *gspca_dev,
--- linux-rt-2.6.31.orig/drivers/media/video/gspca/m5602/m5602_s5k4aa.c
+++ linux-rt-2.6.31/drivers/media/video/gspca/m5602/m5602_s5k4aa.c
@@ -35,12 +35,25 @@
     const
 	struct dmi_system_id s5k4aa_vflip_dmi_table[] = {
 	{
+		.ident = "BRUNEINIT",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "BRUNENIT"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "BRUNENIT"),
+			DMI_MATCH(DMI_BOARD_VERSION, "00030D0000000001")
+		}
+	}, {
 		.ident = "Fujitsu-Siemens Amilo Xa 2528",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "AMILO Xa 2528")
 		}
 	}, {
+		.ident = "Fujitsu-Siemens Amilo Xi 2528",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "AMILO Xi 2528")
+		}
+	}, {
 		.ident = "Fujitsu-Siemens Amilo Xi 2550",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
@@ -51,6 +64,13 @@
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Micro-Star International"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "GX700"),
+			DMI_MATCH(DMI_BIOS_DATE, "12/02/2008")
+		}
+	}, {
+		.ident = "MSI GX700",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Micro-Star International"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "GX700"),
 			DMI_MATCH(DMI_BIOS_DATE, "07/26/2007")
 		}
 	}, {
--- linux-rt-2.6.31.orig/drivers/media/video/cx88/cx88-dvb.c
+++ linux-rt-2.6.31/drivers/media/video/cx88/cx88-dvb.c
@@ -696,6 +696,7 @@
 		}
 		break;
 	case CX88_BOARD_WINFAST_DTV2000H:
+	case CX88_BOARD_WINFAST_DTV2000H_J:
 	case CX88_BOARD_HAUPPAUGE_HVR1100:
 	case CX88_BOARD_HAUPPAUGE_HVR1100LP:
 	case CX88_BOARD_HAUPPAUGE_HVR1300:
--- linux-rt-2.6.31.orig/drivers/media/video/cx88/cx88-cards.c
+++ linux-rt-2.6.31/drivers/media/video/cx88/cx88-cards.c
@@ -1283,6 +1283,51 @@
 		},
 		.mpeg           = CX88_MPEG_DVB,
 	},
+	[CX88_BOARD_WINFAST_DTV2000H_J] = {
+		.name           = "WinFast DTV2000 H rev. J",
+		.tuner_type     = TUNER_PHILIPS_FMD1216ME_MK3,
+		.radio_type     = UNSET,
+		.tuner_addr     = ADDR_UNSET,
+		.radio_addr     = ADDR_UNSET,
+		.tda9887_conf   = TDA9887_PRESENT,
+		.input          = {{
+			.type   = CX88_VMUX_TELEVISION,
+			.vmux   = 0,
+			.gpio0  = 0x00017300,
+			.gpio1  = 0x00008207,
+			.gpio2	= 0x00000000,
+			.gpio3  = 0x02000000,
+		},{
+			.type   = CX88_VMUX_TELEVISION,
+			.vmux   = 0,
+			.gpio0  = 0x00018300,
+			.gpio1  = 0x0000f207,
+			.gpio2	= 0x00017304,
+			.gpio3  = 0x02000000,
+		},{
+			.type   = CX88_VMUX_COMPOSITE1,
+			.vmux   = 1,
+			.gpio0  = 0x00018301,
+			.gpio1  = 0x0000f207,
+			.gpio2	= 0x00017304,
+			.gpio3  = 0x02000000,
+		},{
+			.type   = CX88_VMUX_SVIDEO,
+			.vmux   = 2,
+			.gpio0  = 0x00018301,
+			.gpio1  = 0x0000f207,
+			.gpio2	= 0x00017304,
+			.gpio3  = 0x02000000,
+		}},
+		.radio = {
+			 .type  = CX88_RADIO,
+			 .gpio0 = 0x00015702,
+			 .gpio1 = 0x0000f207,
+			 .gpio2 = 0x00015702,
+			 .gpio3 = 0x02000000,
+		},
+		.mpeg           = CX88_MPEG_DVB,
+	},
 	[CX88_BOARD_GENIATECH_DVBS] = {
 		.name          = "Geniatech DVB-S",
 		.tuner_type    = TUNER_ABSENT,
@@ -2282,6 +2327,10 @@
 		.subdevice = 0x665e,
 		.card      = CX88_BOARD_WINFAST_DTV2000H,
 	},{
+		.subvendor = 0x107d,
+		.subdevice = 0x6f2b,
+		.card      = CX88_BOARD_WINFAST_DTV2000H_J,
+	},{
 		.subvendor = 0x18ac,
 		.subdevice = 0xd800, /* FusionHDTV 3 Gold (original revision) */
 		.card      = CX88_BOARD_DVICO_FUSIONHDTV_3_GOLD_Q,
--- linux-rt-2.6.31.orig/drivers/media/video/cx88/cx88.h
+++ linux-rt-2.6.31/drivers/media/video/cx88/cx88.h
@@ -237,6 +237,7 @@
 #define CX88_BOARD_TERRATEC_CINERGY_HT_PCI_MKII 79
 #define CX88_BOARD_HAUPPAUGE_IRONLY        80
 #define CX88_BOARD_WINFAST_DTV1800H        81
+#define CX88_BOARD_WINFAST_DTV2000H_J      82
 
 enum cx88_itype {
 	CX88_VMUX_COMPOSITE1 = 1,
--- linux-rt-2.6.31.orig/drivers/media/video/cx88/cx88-input.c
+++ linux-rt-2.6.31/drivers/media/video/cx88/cx88-input.c
@@ -225,6 +225,7 @@
 		ir->sampling = 1;
 		break;
 	case CX88_BOARD_WINFAST_DTV2000H:
+	case CX88_BOARD_WINFAST_DTV2000H_J:
 	case CX88_BOARD_WINFAST_DTV1800H:
 		ir_codes = ir_codes_winfast;
 		ir->gpio_addr = MO_GP0_IO;
--- linux-rt-2.6.31.orig/drivers/media/video/zc0301/zc0301_sensor.h
+++ linux-rt-2.6.31/drivers/media/video/zc0301/zc0301_sensor.h
@@ -62,7 +62,6 @@
 #define ZC0301_ID_TABLE                                                       \
 static const struct usb_device_id zc0301_id_table[] =  {                      \
 	{ ZC0301_USB_DEVICE(0x046d, 0x08ae, 0xff), }, /* PAS202 */            \
-	{ ZC0301_USB_DEVICE(0x0ac8, 0x303b, 0xff), }, /* PB-0330 */           \
 	{ }                                                                   \
 };
 #else
--- linux-rt-2.6.31.orig/drivers/media/video/em28xx/em28xx.h
+++ linux-rt-2.6.31/drivers/media/video/em28xx/em28xx.h
@@ -595,6 +595,10 @@
 	struct delayed_work sbutton_query_work;
 
 	struct em28xx_dvb *dvb;
+
+	/* I2C keyboard data */
+	struct i2c_board_info info;
+	struct IR_i2c_init_data init_data;
 };
 
 struct em28xx_ops {
--- linux-rt-2.6.31.orig/drivers/media/video/em28xx/em28xx-cards.c
+++ linux-rt-2.6.31/drivers/media/video/em28xx/em28xx-cards.c
@@ -2170,8 +2170,6 @@
 /* ----------------------------------------------------------------------- */
 void em28xx_register_i2c_ir(struct em28xx *dev)
 {
-	struct i2c_board_info info;
-	struct IR_i2c_init_data init_data;
 	const unsigned short addr_list[] = {
 		 0x30, 0x47, I2C_CLIENT_END
 	};
@@ -2179,9 +2177,9 @@
 	if (disable_ir)
 		return;
 
-	memset(&info, 0, sizeof(struct i2c_board_info));
-	memset(&init_data, 0, sizeof(struct IR_i2c_init_data));
-	strlcpy(info.type, "ir_video", I2C_NAME_SIZE);
+	memset(&dev->info, 0, sizeof(&dev->info));
+	memset(&dev->init_data, 0, sizeof(dev->init_data));
+	strlcpy(dev->info.type, "ir_video", I2C_NAME_SIZE);
 
 	/* detect & configure */
 	switch (dev->model) {
@@ -2191,19 +2189,19 @@
 		break;
 	case (EM2800_BOARD_TERRATEC_CINERGY_200):
 	case (EM2820_BOARD_TERRATEC_CINERGY_250):
-		init_data.ir_codes = ir_codes_em_terratec;
-		init_data.get_key = em28xx_get_key_terratec;
-		init_data.name = "i2c IR (EM28XX Terratec)";
+		dev->init_data.ir_codes = ir_codes_em_terratec;
+		dev->init_data.get_key = em28xx_get_key_terratec;
+		dev->init_data.name = "i2c IR (EM28XX Terratec)";
 		break;
 	case (EM2820_BOARD_PINNACLE_USB_2):
-		init_data.ir_codes = ir_codes_pinnacle_grey;
-		init_data.get_key = em28xx_get_key_pinnacle_usb_grey;
-		init_data.name = "i2c IR (EM28XX Pinnacle PCTV)";
+		dev->init_data.ir_codes = ir_codes_pinnacle_grey;
+		dev->init_data.get_key = em28xx_get_key_pinnacle_usb_grey;
+		dev->init_data.name = "i2c IR (EM28XX Pinnacle PCTV)";
 		break;
 	case (EM2820_BOARD_HAUPPAUGE_WINTV_USB_2):
-		init_data.ir_codes = ir_codes_hauppauge_new;
-		init_data.get_key = em28xx_get_key_em_haup;
-		init_data.name = "i2c IR (EM2840 Hauppauge)";
+		dev->init_data.ir_codes = ir_codes_hauppauge_new;
+		dev->init_data.get_key = em28xx_get_key_em_haup;
+		dev->init_data.name = "i2c IR (EM2840 Hauppauge)";
 		break;
 	case (EM2820_BOARD_MSI_VOX_USB_2):
 		break;
@@ -2215,9 +2213,9 @@
 		break;
 	}
 
-	if (init_data.name)
-		info.platform_data = &init_data;
-	i2c_new_probed_device(&dev->i2c_adap, &info, addr_list);
+	if (dev->init_data.name)
+		dev->info.platform_data = &dev->init_data;
+	i2c_new_probed_device(&dev->i2c_adap, &dev->info, addr_list);
 }
 
 void em28xx_card_setup(struct em28xx *dev)
--- linux-rt-2.6.31.orig/drivers/media/video/em28xx/em28xx-audio.c
+++ linux-rt-2.6.31/drivers/media/video/em28xx/em28xx-audio.c
@@ -383,6 +383,11 @@
 
 static int snd_em28xx_prepare(struct snd_pcm_substream *substream)
 {
+	struct em28xx *dev = snd_pcm_substream_chip(substream);
+
+	dev->adev.hwptr_done_capture = 0;
+	dev->adev.capture_transfer_done = 0;
+
 	return 0;
 }
 
--- linux-rt-2.6.31.orig/drivers/media/dvb/dvb-usb/cinergyT2-fe.c
+++ linux-rt-2.6.31/drivers/media/dvb/dvb-usb/cinergyT2-fe.c
@@ -275,6 +275,7 @@
 	param.tps = cpu_to_le16(compute_tps(fep));
 	param.freq = cpu_to_le32(fep->frequency / 1000);
 	param.bandwidth = 8 - fep->u.ofdm.bandwidth - BANDWIDTH_8_MHZ;
+	param.flags = 0;
 
 	err = dvb_usb_generic_rw(state->d,
 			(char *)&param, sizeof(param),
--- linux-rt-2.6.31.orig/drivers/media/dvb/dvb-usb/cxusb.c
+++ linux-rt-2.6.31/drivers/media/dvb/dvb-usb/cxusb.c
@@ -663,6 +663,14 @@
 	.parallel_ts = 1,
 };
 
+static struct zl10353_config cxusb_zl10353_xc3028_config_no_i2c_gate = {
+	.demod_address = 0x0f,
+	.if2 = 45600,
+	.no_tuner = 1,
+	.parallel_ts = 1,
+	.disable_i2c_gate_ctrl = 1,
+};
+
 static struct mt352_config cxusb_mt352_xc3028_config = {
 	.demod_address = 0x0f,
 	.if2 = 4560,
@@ -894,7 +902,7 @@
 	cxusb_bluebird_gpio_pulse(adap->dev, 0x02, 1);
 
 	if ((adap->fe = dvb_attach(zl10353_attach,
-				   &cxusb_zl10353_xc3028_config,
+				   &cxusb_zl10353_xc3028_config_no_i2c_gate,
 				   &adap->dev->i2c_adap)) == NULL)
 		return -EIO;
 
--- linux-rt-2.6.31.orig/drivers/media/dvb/frontends/dib7000p.c
+++ linux-rt-2.6.31/drivers/media/dvb/frontends/dib7000p.c
@@ -1344,6 +1344,11 @@
 	if (dib7000p_identify(st) != 0)
 		goto error;
 
+	/* FIXME: make sure the dev.parent field is initialized, or else
+	request_firmware() will hit an OOPS (this should be moved somewhere
+	more common) */
+	st->i2c_master.gated_tuner_i2c_adap.dev.parent = i2c_adap->dev.parent;
+
 	dibx000_init_i2c_master(&st->i2c_master, DIB7000P, st->i2c_adap, st->i2c_addr);
 
 	dib7000p_demod_reset(st);
--- linux-rt-2.6.31.orig/drivers/media/dvb/siano/smsusb.c
+++ linux-rt-2.6.31/drivers/media/dvb/siano/smsusb.c
@@ -529,6 +529,12 @@
 		.driver_info = SMS1XXX_BOARD_SIANO_NICE },
 	{ USB_DEVICE(0x187f, 0x0301),
 		.driver_info = SMS1XXX_BOARD_SIANO_VENICE },
+	{ USB_DEVICE(0x2040, 0xb900),
+		.driver_info = SMS1XXX_BOARD_HAUPPAUGE_WINDHAM },
+	{ USB_DEVICE(0x2040, 0xb910),
+		.driver_info = SMS1XXX_BOARD_HAUPPAUGE_WINDHAM },
+	{ USB_DEVICE(0x2040, 0xc000),
+		.driver_info = SMS1XXX_BOARD_HAUPPAUGE_WINDHAM },
 	{ } /* Terminating entry */
 	};
 
--- linux-rt-2.6.31.orig/drivers/media/common/tuners/mxl5007t.c
+++ linux-rt-2.6.31/drivers/media/common/tuners/mxl5007t.c
@@ -196,7 +196,7 @@
 	i = j = 0;
 
 	while (reg_pair1[i].reg || reg_pair1[i].val) {
-		while (reg_pair2[j].reg || reg_pair2[j].reg) {
+		while (reg_pair2[j].reg || reg_pair2[j].val) {
 			if (reg_pair1[i].reg != reg_pair2[j].reg) {
 				j++;
 				continue;
--- linux-rt-2.6.31.orig/drivers/media/common/tuners/tda18271-fe.c
+++ linux-rt-2.6.31/drivers/media/common/tuners/tda18271-fe.c
@@ -595,13 +595,13 @@
 		case RF2:
 			map[i].rf_a1 = (prog_cal[RF2] - prog_tab[RF2] -
 					prog_cal[RF1] + prog_tab[RF1]) /
-				((rf_freq[RF2] - rf_freq[RF1]) / 1000);
+				(s32)((rf_freq[RF2] - rf_freq[RF1]) / 1000);
 			map[i].rf2   = rf_freq[RF2] / 1000;
 			break;
 		case RF3:
 			map[i].rf_a2 = (prog_cal[RF3] - prog_tab[RF3] -
 					prog_cal[RF2] + prog_tab[RF2]) /
-				((rf_freq[RF3] - rf_freq[RF2]) / 1000);
+				(s32)((rf_freq[RF3] - rf_freq[RF2]) / 1000);
 			map[i].rf_b2 = prog_cal[RF2] - prog_tab[RF2];
 			map[i].rf3   = rf_freq[RF3] / 1000;
 			break;
@@ -963,12 +963,12 @@
 	struct tda18271_std_map_item *map;
 	char *mode;
 	int ret;
-	u32 freq = params->frequency * 62500;
+	u32 freq = params->frequency * 125 *
+		((params->mode == V4L2_TUNER_RADIO) ? 1 : 1000) / 2;
 
 	priv->mode = TDA18271_ANALOG;
 
 	if (params->mode == V4L2_TUNER_RADIO) {
-		freq = freq / 1000;
 		map = &std_map->fm_radio;
 		mode = "fm";
 	} else if (params->std & V4L2_STD_MN) {
--- linux-rt-2.6.31.orig/drivers/misc/sgi-gru/gruprocfs.c
+++ linux-rt-2.6.31/drivers/misc/sgi-gru/gruprocfs.c
@@ -161,14 +161,15 @@
 static ssize_t options_write(struct file *file, const char __user *userbuf,
 			     size_t count, loff_t *data)
 {
-	unsigned long val;
-	char buf[80];
+	char buf[20];
 
-	if (strncpy_from_user(buf, userbuf, sizeof(buf) - 1) < 0)
+	memset(buf, 0, sizeof(buf));
+	if (count >= sizeof(buf))
+		return -EINVAL;
+	if (copy_from_user(buf, userbuf, count))
 		return -EFAULT;
-	buf[count - 1] = '\0';
-	if (!strict_strtoul(buf, 10, &val))
-		gru_options = val;
+	if (strict_strtoul(buf, 0, &gru_options))
+		return -EINVAL;
 
 	return count;
 }
--- linux-rt-2.6.31.orig/drivers/ssb/sprom.c
+++ linux-rt-2.6.31/drivers/ssb/sprom.c
@@ -13,6 +13,8 @@
 
 #include "ssb_private.h"
 
+#include <linux/ctype.h>
+
 
 static const struct ssb_sprom *fallback_sprom;
 
@@ -33,17 +35,27 @@
 static int hex2sprom(u16 *sprom, const char *dump, size_t len,
 		     size_t sprom_size_words)
 {
-	char tmp[5] = { 0 };
-	int cnt = 0;
+	char c, tmp[5] = { 0 };
+	int err, cnt = 0;
 	unsigned long parsed;
 
-	if (len < sprom_size_words * 2)
+	/* Strip whitespace at the end. */
+	while (len) {
+		c = dump[len - 1];
+		if (!isspace(c) && c != '\0')
+			break;
+		len--;
+	}
+	/* Length must match exactly. */
+	if (len != sprom_size_words * 4)
 		return -EINVAL;
 
 	while (cnt < sprom_size_words) {
 		memcpy(tmp, dump, 4);
 		dump += 4;
-		parsed = simple_strtoul(tmp, NULL, 16);
+		err = strict_strtoul(tmp, 16, &parsed);
+		if (err)
+			return err;
 		sprom[cnt++] = swab16((u16)parsed);
 	}
 
--- linux-rt-2.6.31.orig/drivers/char/vt_ioctl.c
+++ linux-rt-2.6.31/drivers/char/vt_ioctl.c
@@ -36,6 +36,8 @@
 #include <linux/kbd_diacr.h>
 #include <linux/selection.h>
 
+#define max_font_size 65536
+
 char vt_dont_switch;
 extern struct tty_driver *console_driver;
 
@@ -1262,6 +1264,7 @@
 static void complete_change_console(struct vc_data *vc)
 {
 	unsigned char old_vc_mode;
+	struct vc_data *oldvc = vc_cons[fg_console].d;
 
 	last_console = fg_console;
 
@@ -1270,9 +1273,31 @@
 	 * KD_TEXT mode or vice versa, which means we need to blank or
 	 * unblank the screen later.
 	 */
-	old_vc_mode = vc_cons[fg_console].d->vc_mode;
+	old_vc_mode = oldvc->vc_mode;
+
+#if defined(CONFIG_VGA_CONSOLE)
+	if (old_vc_mode == KD_TEXT && oldvc->vc_sw == &vga_con &&
+	    oldvc->vc_sw->con_font_get) {
+		if (!oldvc->vc_font.data)
+			oldvc->vc_font.data = kmalloc(max_font_size, 
+						      GFP_KERNEL);
+		lock_kernel();
+		oldvc->vc_sw->con_font_get(oldvc, &oldvc->vc_font);
+		unlock_kernel();
+	}
+#endif
 	switch_screen(vc);
 
+#if defined(CONFIG_VGA_CONSOLE)
+	if (vc->vc_mode == KD_TEXT && vc->vc_sw == &vga_con &&
+	    vc->vc_sw->con_font_set) {
+		if (vc->vc_font.data) {
+			lock_kernel();
+			vc->vc_sw->con_font_set(vc, &vc->vc_font, 0);
+			unlock_kernel();
+		}
+	}
+#endif
 	/*
 	 * This can't appear below a successful kill_pid().  If it did,
 	 * then the *blank_screen operation could occur while X, having
--- linux-rt-2.6.31.orig/drivers/char/tty_port.c
+++ linux-rt-2.6.31/drivers/char/tty_port.c
@@ -96,6 +96,14 @@
 }
 EXPORT_SYMBOL(tty_port_tty_set);
 
+static void tty_port_shutdown(struct tty_port *port)
+{
+	if (port->ops->shutdown &&
+		test_and_clear_bit(ASYNCB_INITIALIZED, &port->flags))
+			port->ops->shutdown(port);
+
+}
+
 /**
  *	tty_port_hangup		-	hangup helper
  *	@port: tty port
@@ -116,6 +124,7 @@
 	port->tty = NULL;
 	spin_unlock_irqrestore(&port->lock, flags);
 	wake_up_interruptible(&port->open_wait);
+	tty_port_shutdown(port);
 }
 EXPORT_SYMBOL(tty_port_hangup);
 
@@ -208,8 +217,14 @@
 
 	/* if non-blocking mode is set we can pass directly to open unless
 	   the port has just hung up or is in another error state */
-	if ((filp->f_flags & O_NONBLOCK) ||
-			(tty->flags & (1 << TTY_IO_ERROR))) {
+	if (tty->flags & (1 << TTY_IO_ERROR)) {
+		port->flags |= ASYNC_NORMAL_ACTIVE;
+		return 0;
+	}
+	if (filp->f_flags & O_NONBLOCK) {
+		/* Indicate we are open */
+		if (tty->termios->c_cflag & CBAUD)
+			tty_port_raise_dtr_rts(port);
 		port->flags |= ASYNC_NORMAL_ACTIVE;
 		return 0;
 	}
@@ -296,15 +311,17 @@
 
 	if (port->count) {
 		spin_unlock_irqrestore(&port->lock, flags);
+		if (port->ops->drop)
+			port->ops->drop(port);
 		return 0;
 	}
-	port->flags |= ASYNC_CLOSING;
+	set_bit(ASYNCB_CLOSING, &port->flags);
 	tty->closing = 1;
 	spin_unlock_irqrestore(&port->lock, flags);
 	/* Don't block on a stalled port, just pull the chain */
 	if (tty->flow_stopped)
 		tty_driver_flush_buffer(tty);
-	if (port->flags & ASYNC_INITIALIZED &&
+	if (test_bit(ASYNCB_INITIALIZED, &port->flags) &&
 			port->closing_wait != ASYNC_CLOSING_WAIT_NONE)
 		tty_wait_until_sent(tty, port->closing_wait);
 	if (port->drain_delay) {
@@ -318,6 +335,9 @@
 			timeout = 2 * HZ;
 		schedule_timeout_interruptible(timeout);
 	}
+	/* Don't call port->drop for the last reference. Callers will want
+	   to drop the last active reference in ->shutdown() or the tty
+	   shutdown path */
 	return 1;
 }
 EXPORT_SYMBOL(tty_port_close_start);
@@ -348,3 +368,14 @@
 	spin_unlock_irqrestore(&port->lock, flags);
 }
 EXPORT_SYMBOL(tty_port_close_end);
+
+void tty_port_close(struct tty_port *port, struct tty_struct *tty,
+							struct file *filp)
+{
+	if (tty_port_close_start(port, tty, filp) == 0)
+		return;
+	tty_port_shutdown(port);
+	tty_port_close_end(port, tty);
+	tty_port_tty_set(port, NULL);
+}
+EXPORT_SYMBOL(tty_port_close);
--- linux-rt-2.6.31.orig/drivers/char/pty.c
+++ linux-rt-2.6.31/drivers/char/pty.c
@@ -120,8 +120,10 @@
 		/* Stuff the data into the input queue of the other end */
 		c = tty_insert_flip_string(to, buf, c);
 		/* And shovel */
-		tty_flip_buffer_push(to);
-		tty_wakeup(tty);
+		if (c) {
+			tty_flip_buffer_push(to);
+			tty_wakeup(tty);
+		}
 	}
 	return c;
 }
--- linux-rt-2.6.31.orig/drivers/char/n_tty.c
+++ linux-rt-2.6.31/drivers/char/n_tty.c
@@ -272,7 +272,8 @@
  *
  *	This is a helper function that handles one output character
  *	(including special characters like TAB, CR, LF, etc.),
- *	putting the results in the tty driver's write buffer.
+ *	doing OPOST processing and putting the results in the
+ *	tty driver's write buffer.
  *
  *	Note that Linux currently ignores TABDLY, CRDLY, VTDLY, FFDLY
  *	and NLDLY.  They simply aren't relevant in the world today.
@@ -350,8 +351,9 @@
  *	@c: character (or partial unicode symbol)
  *	@tty: terminal device
  *
- *	Perform OPOST processing.  Returns -1 when the output device is
- *	full and the character must be retried.
+ *	Output one character with OPOST processing.
+ *	Returns -1 when the output device is full and the character
+ *	must be retried.
  *
  *	Locking: output_lock to protect column state and space left
  *		 (also, this is called from n_tty_write under the
@@ -377,8 +379,11 @@
 /**
  *	process_output_block		-	block post processor
  *	@tty: terminal device
- *	@inbuf: user buffer
- *	@nr: number of bytes
+ *	@buf: character buffer
+ *	@nr: number of bytes to output
+ *
+ *	Output a block of characters with OPOST processing.
+ *	Returns the number of characters output.
  *
  *	This path is used to speed up block console writes, among other
  *	things when processing blocks of output data. It handles only
@@ -571,33 +576,23 @@
 				break;
 
 			default:
-				if (iscntrl(op)) {
-					if (L_ECHOCTL(tty)) {
-						/*
-						 * Ensure there is enough space
-						 * for the whole ctrl pair.
-						 */
-						if (space < 2) {
-							no_space_left = 1;
-							break;
-						}
-						tty_put_char(tty, '^');
-						tty_put_char(tty, op ^ 0100);
-						tty->column += 2;
-						space -= 2;
-					} else {
-						if (!space) {
-							no_space_left = 1;
-							break;
-						}
-						tty_put_char(tty, op);
-						space--;
-					}
-				}
 				/*
-				 * If above falls through, this was an
-				 * undefined op.
+				 * If the op is not a special byte code,
+				 * it is a ctrl char tagged to be echoed
+				 * as "^X" (where X is the letter
+				 * representing the control char).
+				 * Note that we must ensure there is
+				 * enough space for the whole ctrl pair.
+				 *
 				 */
+				if (space < 2) {
+					no_space_left = 1;
+					break;
+				}
+				tty_put_char(tty, '^');
+				tty_put_char(tty, op ^ 0100);
+				tty->column += 2;
+				space -= 2;
 				cp += 2;
 				nr -= 2;
 			}
@@ -605,12 +600,18 @@
 			if (no_space_left)
 				break;
 		} else {
-			int retval;
-
-			retval = do_output_char(c, tty, space);
-			if (retval < 0)
-				break;
-			space -= retval;
+			if (O_OPOST(tty) &&
+			    !(test_bit(TTY_HW_COOK_OUT, &tty->flags))) {
+				int retval = do_output_char(c, tty, space);
+				if (retval < 0)
+					break;
+				space -= retval;
+			} else {
+				if (!space)
+					break;
+				tty_put_char(tty, c);
+				space -= 1;
+			}
 			cp += 1;
 			nr -= 1;
 		}
@@ -798,8 +799,8 @@
  *	Echo user input back onto the screen. This must be called only when
  *	L_ECHO(tty) is true. Called from the driver receive_buf path.
  *
- *	This variant tags control characters to be possibly echoed as
- *	as "^X" (where X is the letter representing the control char).
+ *	This variant tags control characters to be echoed as "^X"
+ *	(where X is the letter representing the control char).
  *
  *	Locking: echo_lock to protect the echo buffer
  */
@@ -812,7 +813,7 @@
 		add_echo_byte(ECHO_OP_START, tty);
 		add_echo_byte(ECHO_OP_START, tty);
 	} else {
-		if (iscntrl(c) && c != '\t')
+		if (L_ECHOCTL(tty) && iscntrl(c) && c != '\t')
 			add_echo_byte(ECHO_OP_START, tty);
 		add_echo_byte(c, tty);
 	}
--- linux-rt-2.6.31.orig/drivers/char/tty_io.c
+++ linux-rt-2.6.31/drivers/char/tty_io.c
@@ -1184,6 +1184,7 @@
 	tty->termios->c_ospeed = tty_termios_baud_rate(tty->termios);
 	return 0;
 }
+EXPORT_SYMBOL_GPL(tty_init_termios);
 
 /**
  *	tty_driver_install_tty() - install a tty entry in the driver
--- linux-rt-2.6.31.orig/drivers/char/hvc_xen.c
+++ linux-rt-2.6.31/drivers/char/hvc_xen.c
@@ -55,7 +55,7 @@
 	notify_remote_via_evtchn(xen_start_info->console.domU.evtchn);
 }
 
-static int write_console(uint32_t vtermno, const char *data, int len)
+static int __write_console(const char *data, int len)
 {
 	struct xencons_interface *intf = xencons_interface();
 	XENCONS_RING_IDX cons, prod;
@@ -76,6 +76,29 @@
 	return sent;
 }
 
+static int write_console(uint32_t vtermno, const char *data, int len)
+{
+	int ret = len;
+
+	/*
+	 * Make sure the whole buffer is emitted, polling if
+	 * necessary.  We don't ever want to rely on the hvc daemon
+	 * because the most interesting console output is when the
+	 * kernel is crippled.
+	 */
+	while (len) {
+		int sent = __write_console(data, len);
+
+		data += sent;
+		len -= sent;
+
+		if (unlikely(len))
+			HYPERVISOR_sched_op(SCHEDOP_yield, NULL);
+	}
+
+	return ret;
+}
+
 static int read_console(uint32_t vtermno, char *buf, int len)
 {
 	struct xencons_interface *intf = xencons_interface();
--- linux-rt-2.6.31.orig/drivers/char/tty_buffer.c
+++ linux-rt-2.6.31/drivers/char/tty_buffer.c
@@ -402,28 +402,26 @@
 		container_of(work, struct tty_struct, buf.work.work);
 	unsigned long 	flags;
 	struct tty_ldisc *disc;
-	struct tty_buffer *tbuf, *head;
-	char *char_buf;
-	unsigned char *flag_buf;
 
 	disc = tty_ldisc_ref(tty);
 	if (disc == NULL)	/*  !TTY_LDISC */
 		return;
 
 	spin_lock_irqsave(&tty->buf.lock, flags);
-	/* So we know a flush is running */
-	set_bit(TTY_FLUSHING, &tty->flags);
-	head = tty->buf.head;
-	if (head != NULL) {
-		tty->buf.head = NULL;
-		for (;;) {
-			int count = head->commit - head->read;
+
+	if (!test_and_set_bit(TTY_FLUSHING, &tty->flags)) {
+		struct tty_buffer *head;
+		while ((head = tty->buf.head) != NULL) {
+			int count;
+			char *char_buf;
+			unsigned char *flag_buf;
+
+			count = head->commit - head->read;
 			if (!count) {
 				if (head->next == NULL)
 					break;
-				tbuf = head;
-				head = head->next;
-				tty_buffer_free(tty, tbuf);
+				tty->buf.head = head->next;
+				tty_buffer_free(tty, head);
 				continue;
 			}
 			/* Ldisc or user is trying to flush the buffers
@@ -445,9 +443,9 @@
 							flag_buf, count);
 			spin_lock_irqsave(&tty->buf.lock, flags);
 		}
-		/* Restore the queue head */
-		tty->buf.head = head;
+		clear_bit(TTY_FLUSHING, &tty->flags);
 	}
+
 	/* We may have a deferred request to flush the input buffer,
 	   if so pull the chain under the lock and empty the queue */
 	if (test_bit(TTY_FLUSHPENDING, &tty->flags)) {
@@ -455,7 +453,6 @@
 		clear_bit(TTY_FLUSHPENDING, &tty->flags);
 		wake_up(&tty->read_wait);
 	}
-	clear_bit(TTY_FLUSHING, &tty->flags);
 	spin_unlock_irqrestore(&tty->buf.lock, flags);
 
 	tty_ldisc_deref(disc);
--- linux-rt-2.6.31.orig/drivers/char/tty_ldisc.c
+++ linux-rt-2.6.31/drivers/char/tty_ldisc.c
@@ -516,7 +516,7 @@
 static int tty_ldisc_halt(struct tty_struct *tty)
 {
 	clear_bit(TTY_LDISC, &tty->flags);
-	return cancel_delayed_work(&tty->buf.work);
+	return cancel_delayed_work_sync(&tty->buf.work);
 }
 
 /**
@@ -754,12 +754,9 @@
 	 * N_TTY.
 	 */
 	if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS) {
-		/* Make sure the old ldisc is quiescent */
-		tty_ldisc_halt(tty);
-		flush_scheduled_work();
-
 		/* Avoid racing set_ldisc or tty_ldisc_release */
 		mutex_lock(&tty->ldisc_mutex);
+		tty_ldisc_halt(tty);
 		if (tty->ldisc) {	/* Not yet closed */
 			/* Switch back to N_TTY */
 			tty_ldisc_reinit(tty);
--- linux-rt-2.6.31.orig/drivers/char/keyboard.c
+++ linux-rt-2.6.31/drivers/char/keyboard.c
@@ -1068,6 +1068,8 @@
 	int code;
 
 	switch (keycode) {
+		case KEY_RESERVED:
+			break;
 		case KEY_PAUSE:
 			put_queue(vc, 0xe1);
 			put_queue(vc, 0x1d | up_flag);
@@ -1125,6 +1127,8 @@
 
 static int emulate_raw(struct vc_data *vc, unsigned int keycode, unsigned char up_flag)
 {
+	if (keycode == KEY_RESERVED)
+		return 0;
 	if (keycode > 127)
 		return -1;
 
@@ -1249,7 +1253,7 @@
 
 	if (keycode >= NR_KEYS)
 		if (keycode >= KEY_BRL_DOT1 && keycode <= KEY_BRL_DOT8)
-			keysym = K(KT_BRL, keycode - KEY_BRL_DOT1 + 1);
+			keysym = U(K(KT_BRL, keycode - KEY_BRL_DOT1 + 1));
 		else
 			return;
 	else
--- linux-rt-2.6.31.orig/drivers/char/tpm/tpm_tis.c
+++ linux-rt-2.6.31/drivers/char/tpm/tpm_tis.c
@@ -450,6 +450,12 @@
 		goto out_err;
 	}
 
+	/* Default timeouts */
+	chip->vendor.timeout_a = msecs_to_jiffies(TIS_SHORT_TIMEOUT);
+	chip->vendor.timeout_b = msecs_to_jiffies(TIS_LONG_TIMEOUT);
+	chip->vendor.timeout_c = msecs_to_jiffies(TIS_SHORT_TIMEOUT);
+	chip->vendor.timeout_d = msecs_to_jiffies(TIS_SHORT_TIMEOUT);
+
 	if (request_locality(chip, 0) != 0) {
 		rc = -ENODEV;
 		goto out_err;
@@ -457,12 +463,6 @@
 
 	vendor = ioread32(chip->vendor.iobase + TPM_DID_VID(0));
 
-	/* Default timeouts */
-	chip->vendor.timeout_a = msecs_to_jiffies(TIS_SHORT_TIMEOUT);
-	chip->vendor.timeout_b = msecs_to_jiffies(TIS_LONG_TIMEOUT);
-	chip->vendor.timeout_c = msecs_to_jiffies(TIS_SHORT_TIMEOUT);
-	chip->vendor.timeout_d = msecs_to_jiffies(TIS_SHORT_TIMEOUT);
-
 	dev_info(dev,
 		 "1.2 TPM (device-id 0x%X, rev-id %d)\n",
 		 vendor >> 16, ioread8(chip->vendor.iobase + TPM_RID(0)));
--- linux-rt-2.6.31.orig/drivers/char/tpm/tpm.c
+++ linux-rt-2.6.31/drivers/char/tpm/tpm.c
@@ -696,8 +696,7 @@
 
 	cmd.header.in = pcrread_header;
 	cmd.params.pcrread_in.pcr_idx = cpu_to_be32(pcr_idx);
-	BUILD_BUG_ON(cmd.header.in.length > READ_PCR_RESULT_SIZE);
-	rc = transmit_cmd(chip, &cmd, cmd.header.in.length,
+	rc = transmit_cmd(chip, &cmd, READ_PCR_RESULT_SIZE,
 			  "attempting to read a pcr value");
 
 	if (rc == 0)
@@ -742,7 +741,7 @@
  * the module usage count.
  */
 #define TPM_ORD_PCR_EXTEND cpu_to_be32(20)
-#define EXTEND_PCR_SIZE 34
+#define EXTEND_PCR_RESULT_SIZE 34
 static struct tpm_input_header pcrextend_header = {
 	.tag = TPM_TAG_RQU_COMMAND,
 	.length = cpu_to_be32(34),
@@ -760,10 +759,9 @@
 		return -ENODEV;
 
 	cmd.header.in = pcrextend_header;
-	BUILD_BUG_ON(be32_to_cpu(cmd.header.in.length) > EXTEND_PCR_SIZE);
 	cmd.params.pcrextend_in.pcr_idx = cpu_to_be32(pcr_idx);
 	memcpy(cmd.params.pcrextend_in.hash, hash, TPM_DIGEST_SIZE);
-	rc = transmit_cmd(chip, &cmd, cmd.header.in.length,
+	rc = transmit_cmd(chip, &cmd, EXTEND_PCR_RESULT_SIZE,
 			  "attempting extend a PCR value");
 
 	module_put(chip->dev->driver->owner);
--- linux-rt-2.6.31.orig/drivers/char/agp/intel-agp.c
+++ linux-rt-2.6.31/drivers/char/agp/intel-agp.c
@@ -36,6 +36,8 @@
 #define PCI_DEVICE_ID_INTEL_Q35_IG          0x29B2
 #define PCI_DEVICE_ID_INTEL_Q33_HB          0x29D0
 #define PCI_DEVICE_ID_INTEL_Q33_IG          0x29D2
+#define PCI_DEVICE_ID_INTEL_B43_HB          0x2E40
+#define PCI_DEVICE_ID_INTEL_B43_IG          0x2E42
 #define PCI_DEVICE_ID_INTEL_GM45_HB         0x2A40
 #define PCI_DEVICE_ID_INTEL_GM45_IG         0x2A42
 #define PCI_DEVICE_ID_INTEL_IGD_E_HB        0x2E00
@@ -50,6 +52,7 @@
 #define PCI_DEVICE_ID_INTEL_IGDNG_D_IG	    0x0042
 #define PCI_DEVICE_ID_INTEL_IGDNG_M_HB	    0x0044
 #define PCI_DEVICE_ID_INTEL_IGDNG_MA_HB	    0x0062
+#define PCI_DEVICE_ID_INTEL_IGDNG_MC2_HB    0x006a
 #define PCI_DEVICE_ID_INTEL_IGDNG_M_IG	    0x0046
 
 /* cover 915 and 945 variants */
@@ -81,9 +84,11 @@
 		agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_G45_HB || \
 		agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_GM45_HB || \
 		agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_G41_HB || \
+		agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_B43_HB || \
 		agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGDNG_D_HB || \
 		agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGDNG_M_HB || \
-		agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGDNG_MA_HB)
+		agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGDNG_MA_HB || \
+		agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGDNG_MC2_HB)
 
 extern int agp_memory_reserved;
 
@@ -679,23 +684,39 @@
 	if (!intel_private.i8xx_page)
 		return;
 
-	/* make page uncached */
-	map_page_into_agp(intel_private.i8xx_page);
-
 	intel_private.i8xx_flush_page = kmap(intel_private.i8xx_page);
 	if (!intel_private.i8xx_flush_page)
 		intel_i830_fini_flush();
 }
 
+static void
+do_wbinvd(void *null)
+{
+	wbinvd();
+}
+
+/* The chipset_flush interface needs to get data that has already been
+ * flushed out of the CPU all the way out to main memory, because the GPU
+ * doesn't snoop those buffers.
+ *
+ * The 8xx series doesn't have the same lovely interface for flushing the
+ * chipset write buffers that the later chips do. According to the 865
+ * specs, it's 64 octwords, or 1KB.  So, to get those previous things in
+ * that buffer out, we just fill 1KB and clflush it out, on the assumption
+ * that it'll push whatever was in there out.  It appears to work.
+ */
 static void intel_i830_chipset_flush(struct agp_bridge_data *bridge)
 {
 	unsigned int *pg = intel_private.i8xx_flush_page;
-	int i;
 
-	for (i = 0; i < 256; i += 2)
-		*(pg + i) = i;
+	memset(pg, 0, 1024);
 
-	wmb();
+	if (cpu_has_clflush) {
+		clflush_cache_range(pg, 1024);
+	} else {
+		if (on_each_cpu(do_wbinvd, NULL, 1) != 0)
+			printk(KERN_ERR "Timed out waiting for cache flush.\n");
+	}
 }
 
 /* The intel i830 automatically initializes the agp aperture during POST.
@@ -1216,9 +1237,11 @@
 	case PCI_DEVICE_ID_INTEL_Q45_HB:
 	case PCI_DEVICE_ID_INTEL_G45_HB:
 	case PCI_DEVICE_ID_INTEL_G41_HB:
+	case PCI_DEVICE_ID_INTEL_B43_HB:
 	case PCI_DEVICE_ID_INTEL_IGDNG_D_HB:
 	case PCI_DEVICE_ID_INTEL_IGDNG_M_HB:
 	case PCI_DEVICE_ID_INTEL_IGDNG_MA_HB:
+	case PCI_DEVICE_ID_INTEL_IGDNG_MC2_HB:
 		*gtt_offset = *gtt_size = MB(2);
 		break;
 	default:
@@ -2192,6 +2215,8 @@
 	    "Q45/Q43", NULL, &intel_i965_driver },
 	{ PCI_DEVICE_ID_INTEL_G45_HB, PCI_DEVICE_ID_INTEL_G45_IG, 0,
 	    "G45/G43", NULL, &intel_i965_driver },
+	{ PCI_DEVICE_ID_INTEL_B43_HB, PCI_DEVICE_ID_INTEL_B43_IG, 0,
+	    "B43", NULL, &intel_i965_driver },
 	{ PCI_DEVICE_ID_INTEL_G41_HB, PCI_DEVICE_ID_INTEL_G41_IG, 0,
 	    "G41", NULL, &intel_i965_driver },
 	{ PCI_DEVICE_ID_INTEL_IGDNG_D_HB, PCI_DEVICE_ID_INTEL_IGDNG_D_IG, 0,
@@ -2200,6 +2225,8 @@
 	    "IGDNG/M", NULL, &intel_i965_driver },
 	{ PCI_DEVICE_ID_INTEL_IGDNG_MA_HB, PCI_DEVICE_ID_INTEL_IGDNG_M_IG, 0,
 	    "IGDNG/MA", NULL, &intel_i965_driver },
+	{ PCI_DEVICE_ID_INTEL_IGDNG_MC2_HB, PCI_DEVICE_ID_INTEL_IGDNG_M_IG, 0,
+	    "IGDNG/MC2", NULL, &intel_i965_driver },
 	{ 0, 0, 0, NULL, NULL, NULL }
 };
 
@@ -2313,15 +2340,6 @@
 	struct agp_bridge_data *bridge = pci_get_drvdata(pdev);
 	int ret_val;
 
-	pci_restore_state(pdev);
-
-	/* We should restore our graphics device's config space,
-	 * as host bridge (00:00) resumes before graphics device (02:00),
-	 * then our access to its pci space can work right.
-	 */
-	if (intel_private.pcidev)
-		pci_restore_state(intel_private.pcidev);
-
 	if (bridge->driver == &intel_generic_driver)
 		intel_configure();
 	else if (bridge->driver == &intel_850_driver)
@@ -2401,9 +2419,11 @@
 	ID(PCI_DEVICE_ID_INTEL_Q45_HB),
 	ID(PCI_DEVICE_ID_INTEL_G45_HB),
 	ID(PCI_DEVICE_ID_INTEL_G41_HB),
+	ID(PCI_DEVICE_ID_INTEL_B43_HB),
 	ID(PCI_DEVICE_ID_INTEL_IGDNG_D_HB),
 	ID(PCI_DEVICE_ID_INTEL_IGDNG_M_HB),
 	ID(PCI_DEVICE_ID_INTEL_IGDNG_MA_HB),
+	ID(PCI_DEVICE_ID_INTEL_IGDNG_MC2_HB),
 	{ }
 };
 
@@ -2434,5 +2454,6 @@
 module_init(agp_intel_init);
 module_exit(agp_intel_cleanup);
 
+MODULE_EXPORT(intel_agp);
 MODULE_AUTHOR("Dave Jones <davej@redhat.com>");
 MODULE_LICENSE("GPL and additional rights");
--- linux-rt-2.6.31.orig/drivers/net/e100.c
+++ linux-rt-2.6.31/drivers/net/e100.c
@@ -156,6 +156,7 @@
 #include <linux/init.h>
 #include <linux/pci.h>
 #include <linux/dma-mapping.h>
+#include <linux/dmapool.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
 #include <linux/mii.h>
@@ -601,6 +602,7 @@
 	struct mem *mem;
 	dma_addr_t dma_addr;
 
+	struct pci_pool *cbs_pool;
 	dma_addr_t cbs_dma_addr;
 	u8 adaptive_ifs;
 	u8 tx_threshold;
@@ -1779,9 +1781,7 @@
 			nic->cb_to_clean = nic->cb_to_clean->next;
 			nic->cbs_avail++;
 		}
-		pci_free_consistent(nic->pdev,
-			sizeof(struct cb) * nic->params.cbs.count,
-			nic->cbs, nic->cbs_dma_addr);
+		pci_pool_free(nic->cbs_pool, nic->cbs, nic->cbs_dma_addr);
 		nic->cbs = NULL;
 		nic->cbs_avail = 0;
 	}
@@ -1799,10 +1799,11 @@
 	nic->cb_to_use = nic->cb_to_send = nic->cb_to_clean = NULL;
 	nic->cbs_avail = 0;
 
-	nic->cbs = pci_alloc_consistent(nic->pdev,
-		sizeof(struct cb) * count, &nic->cbs_dma_addr);
+	nic->cbs = pci_pool_alloc(nic->cbs_pool, GFP_KERNEL,
+				  &nic->cbs_dma_addr);
 	if (!nic->cbs)
 		return -ENOMEM;
+	memset(nic->cbs, 0, count * sizeof(struct cb));
 
 	for (cb = nic->cbs, i = 0; i < count; cb++, i++) {
 		cb->next = (i + 1 < count) ? cb + 1 : nic->cbs;
@@ -1811,7 +1812,6 @@
 		cb->dma_addr = nic->cbs_dma_addr + i * sizeof(struct cb);
 		cb->link = cpu_to_le32(nic->cbs_dma_addr +
 			((i+1) % count) * sizeof(struct cb));
-		cb->skb = NULL;
 	}
 
 	nic->cb_to_use = nic->cb_to_send = nic->cb_to_clean = nic->cbs;
@@ -2827,7 +2827,11 @@
 		DPRINTK(PROBE, ERR, "Cannot register net device, aborting.\n");
 		goto err_out_free;
 	}
-
+	nic->cbs_pool = pci_pool_create(netdev->name,
+			   nic->pdev,
+			   nic->params.cbs.count * sizeof(struct cb),
+			   sizeof(u32),
+			   0);
 	DPRINTK(PROBE, INFO, "addr 0x%llx, irq %d, MAC addr %pM\n",
 		(unsigned long long)pci_resource_start(pdev, use_io ? 1 : 0),
 		pdev->irq, netdev->dev_addr);
@@ -2857,6 +2861,7 @@
 		unregister_netdev(netdev);
 		e100_free(nic);
 		pci_iounmap(pdev, nic->csr);
+		pci_pool_destroy(nic->cbs_pool);
 		free_netdev(netdev);
 		pci_release_regions(pdev);
 		pci_disable_device(pdev);
--- linux-rt-2.6.31.orig/drivers/net/smsc9420.c
+++ linux-rt-2.6.31/drivers/net/smsc9420.c
@@ -252,6 +252,9 @@
 {
 	struct smsc9420_pdata *pd = netdev_priv(dev);
 
+	if (!pd->phy_dev)
+		return -ENODEV;
+
 	cmd->maxtxpkt = 1;
 	cmd->maxrxpkt = 1;
 	return phy_ethtool_gset(pd->phy_dev, cmd);
@@ -262,6 +265,9 @@
 {
 	struct smsc9420_pdata *pd = netdev_priv(dev);
 
+	if (!pd->phy_dev)
+		return -ENODEV;
+
 	return phy_ethtool_sset(pd->phy_dev, cmd);
 }
 
@@ -290,6 +296,10 @@
 static int smsc9420_ethtool_nway_reset(struct net_device *netdev)
 {
 	struct smsc9420_pdata *pd = netdev_priv(netdev);
+
+	if (!pd->phy_dev)
+		return -ENODEV;
+
 	return phy_start_aneg(pd->phy_dev);
 }
 
@@ -312,6 +322,10 @@
 	for (i = 0; i < 0x100; i += (sizeof(u32)))
 		data[j++] = smsc9420_reg_read(pd, i);
 
+	// cannot read phy registers if the net device is down
+	if (!phy_dev)
+		return;
+
 	for (i = 0; i <= 31; i++)
 		data[j++] = smsc9420_mii_read(phy_dev->bus, phy_dev->addr, i);
 }
--- linux-rt-2.6.31.orig/drivers/net/iseries_veth.c
+++ linux-rt-2.6.31/drivers/net/iseries_veth.c
@@ -495,7 +495,7 @@
 			   cnx->remote_lp);
 	} else {
 		memcpy(&cnx->cap_ack_event, event,
-		       sizeof(&cnx->cap_ack_event));
+		       sizeof(cnx->cap_ack_event));
 		cnx->state |= VETH_STATE_GOTCAPACK;
 		veth_kick_statemachine(cnx);
 	}
--- linux-rt-2.6.31.orig/drivers/net/sky2.c
+++ linux-rt-2.6.31/drivers/net/sky2.c
@@ -1455,7 +1455,6 @@
 	if (ramsize > 0) {
 		u32 rxspace;
 
-		hw->flags |= SKY2_HW_RAM_BUFFER;
 		pr_debug(PFX "%s: ram buffer %dK\n", dev->name, ramsize);
 		if (ramsize < 16)
 			rxspace = ramsize / 2;
@@ -2942,6 +2941,9 @@
 			++hw->ports;
 	}
 
+	if (sky2_read8(hw, B2_E_0))
+		hw->flags |= SKY2_HW_RAM_BUFFER;
+
 	return 0;
 }
 
@@ -4526,6 +4528,8 @@
 		goto err_out_free_netdev;
 	}
 
+	netif_carrier_off(dev);
+
 	netif_napi_add(dev, &hw->napi, sky2_poll, NAPI_WEIGHT);
 
 	err = request_irq(pdev->irq, sky2_intr,
--- linux-rt-2.6.31.orig/drivers/net/smc91x.c
+++ linux-rt-2.6.31/drivers/net/smc91x.c
@@ -2283,7 +2283,7 @@
 
 	ndev->irq = ires->start;
 
-	if (ires->flags & IRQF_TRIGGER_MASK)
+	if (irq_flags == -1 || ires->flags & IRQF_TRIGGER_MASK)
 		irq_flags = ires->flags & IRQF_TRIGGER_MASK;
 
 	ret = smc_request_attrib(pdev, ndev);
--- linux-rt-2.6.31.orig/drivers/net/acenic.c
+++ linux-rt-2.6.31/drivers/net/acenic.c
@@ -1209,7 +1209,8 @@
 	memset(ap->info, 0, sizeof(struct ace_info));
 	memset(ap->skb, 0, sizeof(struct ace_skb));
 
-	if (ace_load_firmware(dev))
+	ecode = ace_load_firmware(dev);
+	if (ecode)
 		goto init_error;
 
 	ap->fw_running = 0;
--- linux-rt-2.6.31.orig/drivers/net/tg3.h
+++ linux-rt-2.6.31/drivers/net/tg3.h
@@ -43,7 +43,7 @@
 #define  TG3PCI_DEVICE_TIGON3_57780	 0x1692
 #define  TG3PCI_DEVICE_TIGON3_57760	 0x1690
 #define  TG3PCI_DEVICE_TIGON3_57790	 0x1694
-#define  TG3PCI_DEVICE_TIGON3_57720	 0x168c
+#define  TG3PCI_DEVICE_TIGON3_57788	 0x1691
 /* 0x04 --> 0x64 unused */
 #define TG3PCI_MSI_DATA			0x00000064
 /* 0x66 --> 0x68 unused */
--- linux-rt-2.6.31.orig/drivers/net/au1000_eth.c
+++ linux-rt-2.6.31/drivers/net/au1000_eth.c
@@ -1089,7 +1089,14 @@
 		return NULL;
 	}
 
-	if ((err = register_netdev(dev)) != 0) {
+	dev->base_addr = base;
+	dev->irq = irq;
+	dev->netdev_ops = &au1000_netdev_ops;
+	SET_ETHTOOL_OPS(dev, &au1000_ethtool_ops);
+	dev->watchdog_timeo = ETH_TX_TIMEOUT;
+
+	err = register_netdev(dev);
+	if (err != 0) {
 		printk(KERN_ERR "%s: Cannot register net device, error %d\n",
 				DRV_NAME, err);
 		free_netdev(dev);
@@ -1207,12 +1214,6 @@
 		aup->tx_db_inuse[i] = pDB;
 	}
 
-	dev->base_addr = base;
-	dev->irq = irq;
-	dev->netdev_ops = &au1000_netdev_ops;
-	SET_ETHTOOL_OPS(dev, &au1000_ethtool_ops);
-	dev->watchdog_timeo = ETH_TX_TIMEOUT;
-
 	/*
 	 * The boot code uses the ethernet controller, so reset it to start
 	 * fresh.  au1000_init() expects that the device is in reset state.
--- linux-rt-2.6.31.orig/drivers/net/b44.c
+++ linux-rt-2.6.31/drivers/net/b44.c
@@ -913,9 +913,6 @@
 			bp->istat = istat;
 			__b44_disable_ints(bp);
 			__napi_schedule(&bp->napi);
-		} else {
-			printk(KERN_ERR PFX "%s: Error, poll already scheduled\n",
-			       dev->name);
 		}
 
 irq_ack:
@@ -1505,8 +1502,7 @@
 		for (k = 0; k< ethaddr_bytes; k++) {
 			ppattern[offset + magicsync +
 				(j * ETH_ALEN) + k] = macaddr[k];
-			len++;
-			set_bit(len, (unsigned long *) pmask);
+			set_bit(len++, (unsigned long *) pmask);
 		}
 	}
 	return len - 1;
--- linux-rt-2.6.31.orig/drivers/net/r8169.c
+++ linux-rt-2.6.31/drivers/net/r8169.c
@@ -2163,6 +2163,13 @@
 	dev->features |= NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX;
 #endif
 
+	/* Ubuntu temporary workaround for bug #76489, disable
+	 * NETIF_F_TSO by default for RTL8111/8168B chipsets.
+	 * People can re-enable if required */
+	if (tp->mac_version == RTL_GIGA_MAC_VER_11
+				|| tp->mac_version == RTL_GIGA_MAC_VER_12)
+		dev->features &= ~NETIF_F_TSO;
+
 	tp->intr_mask = 0xffff;
 	tp->align = cfg->align;
 	tp->hw_start = cfg->hw_start;
--- linux-rt-2.6.31.orig/drivers/net/tg3.c
+++ linux-rt-2.6.31/drivers/net/tg3.c
@@ -223,7 +223,7 @@
 	{PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, TG3PCI_DEVICE_TIGON3_57780)},
 	{PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, TG3PCI_DEVICE_TIGON3_57760)},
 	{PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, TG3PCI_DEVICE_TIGON3_57790)},
-	{PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, TG3PCI_DEVICE_TIGON3_57720)},
+	{PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, TG3PCI_DEVICE_TIGON3_57788)},
 	{PCI_DEVICE(PCI_VENDOR_ID_SYSKONNECT, PCI_DEVICE_ID_SYSKONNECT_9DXX)},
 	{PCI_DEVICE(PCI_VENDOR_ID_SYSKONNECT, PCI_DEVICE_ID_SYSKONNECT_9MXX)},
 	{PCI_DEVICE(PCI_VENDOR_ID_ALTIMA, PCI_DEVICE_ID_ALTIMA_AC1000)},
@@ -11485,6 +11485,9 @@
 	else if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_57780 &&
 		 tp->pdev->device == TG3PCI_DEVICE_TIGON3_57790)
 		strcpy(tp->board_part_number, "BCM57790");
+	else if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_57780 &&
+		 tp->pdev->device == TG3PCI_DEVICE_TIGON3_57788)
+		strcpy(tp->board_part_number, "BCM57788");
 	else
 		strcpy(tp->board_part_number, "none");
 }
--- linux-rt-2.6.31.orig/drivers/net/tun.c
+++ linux-rt-2.6.31/drivers/net/tun.c
@@ -943,8 +943,6 @@
 		char *name;
 		unsigned long flags = 0;
 
-		err = -EINVAL;
-
 		if (!capable(CAP_NET_ADMIN))
 			return -EPERM;
 
@@ -958,7 +956,7 @@
 			flags |= TUN_TAP_DEV;
 			name = "tap%d";
 		} else
-			goto failed;
+			return -EINVAL;
 
 		if (*ifr->ifr_name)
 			name = ifr->ifr_name;
--- linux-rt-2.6.31.orig/drivers/net/e1000/e1000_main.c
+++ linux-rt-2.6.31/drivers/net/e1000/e1000_main.c
@@ -1924,18 +1924,6 @@
 	rctl &= ~E1000_RCTL_SZ_4096;
 	rctl |= E1000_RCTL_BSEX;
 	switch (adapter->rx_buffer_len) {
-		case E1000_RXBUFFER_256:
-			rctl |= E1000_RCTL_SZ_256;
-			rctl &= ~E1000_RCTL_BSEX;
-			break;
-		case E1000_RXBUFFER_512:
-			rctl |= E1000_RCTL_SZ_512;
-			rctl &= ~E1000_RCTL_BSEX;
-			break;
-		case E1000_RXBUFFER_1024:
-			rctl |= E1000_RCTL_SZ_1024;
-			rctl &= ~E1000_RCTL_BSEX;
-			break;
 		case E1000_RXBUFFER_2048:
 		default:
 			rctl |= E1000_RCTL_SZ_2048;
@@ -3492,13 +3480,7 @@
 	 * larger slab size
 	 * i.e. RXBUFFER_2048 --> size-4096 slab */
 
-	if (max_frame <= E1000_RXBUFFER_256)
-		adapter->rx_buffer_len = E1000_RXBUFFER_256;
-	else if (max_frame <= E1000_RXBUFFER_512)
-		adapter->rx_buffer_len = E1000_RXBUFFER_512;
-	else if (max_frame <= E1000_RXBUFFER_1024)
-		adapter->rx_buffer_len = E1000_RXBUFFER_1024;
-	else if (max_frame <= E1000_RXBUFFER_2048)
+	if (max_frame <= E1000_RXBUFFER_2048)
 		adapter->rx_buffer_len = E1000_RXBUFFER_2048;
 	else if (max_frame <= E1000_RXBUFFER_4096)
 		adapter->rx_buffer_len = E1000_RXBUFFER_4096;
@@ -4041,13 +4023,22 @@
 
 		length = le16_to_cpu(rx_desc->length);
 		/* !EOP means multiple descriptors were used to store a single
-		 * packet, also make sure the frame isn't just CRC only */
-		if (unlikely(!(status & E1000_RXD_STAT_EOP) || (length <= 4))) {
+		 * packet, if thats the case we need to toss it.  In fact, we
+		 * to toss every packet with the EOP bit clear and the next
+		 * frame that _does_ have the EOP bit set, as it is by
+		 * definition only a frame fragment
+		 */
+		if (unlikely(!(status & E1000_RXD_STAT_EOP)))
+			adapter->discarding = true;
+
+		if (adapter->discarding) {
 			/* All receives must fit into a single buffer */
 			E1000_DBG("%s: Receive packet consumed multiple"
 				  " buffers\n", netdev->name);
 			/* recycle */
 			buffer_info->skb = skb;
+			if (status & E1000_RXD_STAT_EOP)
+				adapter->discarding = false;
 			goto next_desc;
 		}
 
--- linux-rt-2.6.31.orig/drivers/net/e1000/e1000.h
+++ linux-rt-2.6.31/drivers/net/e1000/e1000.h
@@ -324,6 +324,8 @@
 	/* for ioport free */
 	int bars;
 	int need_ioport;
+
+	bool discarding;
 };
 
 enum e1000_state_t {
--- linux-rt-2.6.31.orig/drivers/net/usb/smsc95xx.c
+++ linux-rt-2.6.31/drivers/net/usb/smsc95xx.c
@@ -1232,7 +1232,7 @@
 	.rx_fixup	= smsc95xx_rx_fixup,
 	.tx_fixup	= smsc95xx_tx_fixup,
 	.status		= smsc95xx_status,
-	.flags		= FLAG_ETHER,
+	.flags		= FLAG_ETHER | FLAG_SEND_ZLP,
 };
 
 static const struct usb_device_id products[] = {
--- linux-rt-2.6.31.orig/drivers/net/usb/rtl8150.c
+++ linux-rt-2.6.31/drivers/net/usb/rtl8150.c
@@ -324,7 +324,7 @@
 		dbg("%02X:", netdev->dev_addr[i]);
 	dbg("%02X\n", netdev->dev_addr[i]);
 	/* Set the IDR registers. */
-	set_registers(dev, IDR, sizeof(netdev->dev_addr), netdev->dev_addr);
+	set_registers(dev, IDR, netdev->addr_len, netdev->dev_addr);
 #ifdef EEPROM_WRITE
 	{
 	u8 cr;
--- linux-rt-2.6.31.orig/drivers/net/usb/Kconfig
+++ linux-rt-2.6.31/drivers/net/usb/Kconfig
@@ -174,7 +174,7 @@
 	    * Ericsson Mobile Broadband Module (all variants)
  	    * Motorola (DM100 and SB4100)
  	    * Broadcom Cable Modem (reference design)
-	    * Toshiba (PCX1100U and F3507g)
+	    * Toshiba (PCX1100U and F3507g/F3607gw)
 	    * ...
 
 	  This driver creates an interface named "ethX", where X depends on
--- linux-rt-2.6.31.orig/drivers/net/usb/kaweth.c
+++ linux-rt-2.6.31/drivers/net/usb/kaweth.c
@@ -263,6 +263,7 @@
 			  int timeout)
 {
 	struct usb_ctrlrequest *dr;
+	int retval;
 
 	dbg("kaweth_control()");
 
@@ -278,18 +279,21 @@
 		return -ENOMEM;
 	}
 
-	dr->bRequestType= requesttype;
+	dr->bRequestType = requesttype;
 	dr->bRequest = request;
 	dr->wValue = cpu_to_le16(value);
 	dr->wIndex = cpu_to_le16(index);
 	dr->wLength = cpu_to_le16(size);
 
-	return kaweth_internal_control_msg(kaweth->dev,
-					pipe,
-					dr,
-					data,
-					size,
-					timeout);
+	retval = kaweth_internal_control_msg(kaweth->dev,
+					     pipe,
+					     dr,
+					     data,
+					     size,
+					     timeout);
+
+	kfree(dr);
+	return retval;
 }
 
 /****************************************************************
--- linux-rt-2.6.31.orig/drivers/net/usb/hso.c
+++ linux-rt-2.6.31/drivers/net/usb/hso.c
@@ -1362,7 +1362,7 @@
 	/* reset the rts and dtr */
 	/* do the actual close */
 	serial->open_count--;
-	kref_put(&serial->parent->ref, hso_serial_ref_free);
+
 	if (serial->open_count <= 0) {
 		serial->open_count = 0;
 		spin_lock_irq(&serial->serial_lock);
@@ -1382,6 +1382,8 @@
 		usb_autopm_put_interface(serial->parent->interface);
 
 	mutex_unlock(&serial->parent->mutex);
+
+	kref_put(&serial->parent->ref, hso_serial_ref_free);
 }
 
 /* close the requested serial port */
--- linux-rt-2.6.31.orig/drivers/net/usb/cdc_ether.c
+++ linux-rt-2.6.31/drivers/net/usb/cdc_ether.c
@@ -544,20 +544,60 @@
 			USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
 	.driver_info = (unsigned long) &cdc_info,
 }, {
-	/* Ericsson F3307 */
+	/* Ericsson F3607gw ver 2 */
+	USB_DEVICE_AND_INTERFACE_INFO(0x0bdb, 0x1905, USB_CLASS_COMM,
+			USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
+	.driver_info = (unsigned long) &cdc_info,
+}, {
+	/* Ericsson F3607gw ver 3 */
 	USB_DEVICE_AND_INTERFACE_INFO(0x0bdb, 0x1906, USB_CLASS_COMM,
 			USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
 	.driver_info = (unsigned long) &cdc_info,
 }, {
+	/* Ericsson F3307 */
+	USB_DEVICE_AND_INTERFACE_INFO(0x0bdb, 0x190a, USB_CLASS_COMM,
+			USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
+	.driver_info = (unsigned long) &cdc_info,
+}, {
+	/* Ericsson F3307 ver 2 */
+	USB_DEVICE_AND_INTERFACE_INFO(0x0bdb, 0x1909, USB_CLASS_COMM,
+			USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
+	.driver_info = (unsigned long) &cdc_info,
+}, {
+	/* Ericsson C3607w */
+	USB_DEVICE_AND_INTERFACE_INFO(0x0bdb, 0x1049, USB_CLASS_COMM,
+			USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
+	.driver_info = (unsigned long) &cdc_info,
+}, {
 	/* Toshiba F3507g */
 	USB_DEVICE_AND_INTERFACE_INFO(0x0930, 0x130b, USB_CLASS_COMM,
 			USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
 	.driver_info = (unsigned long) &cdc_info,
 }, {
+	/* Toshiba F3607gw */
+	USB_DEVICE_AND_INTERFACE_INFO(0x0930, 0x130c, USB_CLASS_COMM,
+			USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
+	.driver_info = (unsigned long) &cdc_info,
+}, {
+	/* Toshiba F3607gw ver 2 */
+	USB_DEVICE_AND_INTERFACE_INFO(0x0930, 0x1311, USB_CLASS_COMM,
+			USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
+	.driver_info = (unsigned long) &cdc_info,
+}, {
 	/* Dell F3507g */
 	USB_DEVICE_AND_INTERFACE_INFO(0x413c, 0x8147, USB_CLASS_COMM,
 			USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
 	.driver_info = (unsigned long) &cdc_info,
+}, {
+	/* Dell F3607gw */
+	USB_DEVICE_AND_INTERFACE_INFO(0x413c, 0x8183, USB_CLASS_COMM,
+			USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
+	.driver_info = (unsigned long) &cdc_info,
+}, {
+	/* Dell F3607gw ver 2 */
+	USB_DEVICE_AND_INTERFACE_INFO(0x413c, 0x8184, USB_CLASS_COMM,
+			USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
+	.driver_info = (unsigned long) &cdc_info,
 },
 	{ },		// END
 };
--- linux-rt-2.6.31.orig/drivers/net/usb/usbnet.c
+++ linux-rt-2.6.31/drivers/net/usb/usbnet.c
@@ -988,7 +988,7 @@
 	 * NOTE:  strictly conforming cdc-ether devices should expect
 	 * the ZLP here, but ignore the one-byte packet.
 	 */
-	if ((length % dev->maxpacket) == 0) {
+	if (!(info->flags & FLAG_SEND_ZLP) && (length % dev->maxpacket) == 0) {
 		urb->transfer_buffer_length++;
 		if (skb_tailroom(skb)) {
 			skb->data[skb->len] = 0;
--- linux-rt-2.6.31.orig/drivers/net/tulip/tulip_core.c
+++ linux-rt-2.6.31/drivers/net/tulip/tulip_core.c
@@ -228,8 +228,12 @@
 	{ 0x1259, 0xa120, PCI_ANY_ID, PCI_ANY_ID, 0, 0, COMET },
 	{ 0x11F6, 0x9881, PCI_ANY_ID, PCI_ANY_ID, 0, 0, COMPEX9881 },
 	{ 0x8086, 0x0039, PCI_ANY_ID, PCI_ANY_ID, 0, 0, I21145 },
+	/* Ubuntu: On non-sparc, this seems to be handled better by the
+	 * dmfe driver. */
+#ifdef __sparc__
 	{ 0x1282, 0x9100, PCI_ANY_ID, PCI_ANY_ID, 0, 0, DM910X },
 	{ 0x1282, 0x9102, PCI_ANY_ID, PCI_ANY_ID, 0, 0, DM910X },
+#endif
 	{ 0x1113, 0x1216, PCI_ANY_ID, PCI_ANY_ID, 0, 0, COMET },
 	{ 0x1113, 0x1217, PCI_ANY_ID, PCI_ANY_ID, 0, 0, MX98715 },
 	{ 0x1113, 0x9511, PCI_ANY_ID, PCI_ANY_ID, 0, 0, COMET },
@@ -393,6 +397,11 @@
 				goto media_picked;
 			}
 	}
+	if (tp->chip_id == PCI_ULI5261_ID || tp->chip_id == PCI_ULI5263_ID) {
+		for (i = tp->mtable->leafcount - 1; i >= 0; i--)
+			if (tulip_media_cap[tp->mtable->mleaf[i].media] & MediaIsMII)
+				goto media_picked;
+	}
 	/* Start sensing first non-full-duplex media. */
 	for (i = tp->mtable->leafcount - 1;
 		 (tulip_media_cap[tp->mtable->mleaf[i].media] & MediaAlwaysFD) && i > 0; i--)
--- linux-rt-2.6.31.orig/drivers/net/tulip/tulip.h
+++ linux-rt-2.6.31/drivers/net/tulip/tulip.h
@@ -38,7 +38,10 @@
 #define TULIP_BAR	0	/* CBIO */
 #endif
 
-
+#ifndef PCI_ULI5261_ID
+#define PCI_ULI5261_ID  0x526110B9      /* ULi M5261 ID*/
+#define PCI_ULI5263_ID  0x526310B9      /* ULi M5263 ID*/
+#endif
 
 struct tulip_chip_table {
 	char *chip_name;
--- linux-rt-2.6.31.orig/drivers/net/sfc/rx.c
+++ linux-rt-2.6.31/drivers/net/sfc/rx.c
@@ -444,7 +444,8 @@
  * the appropriate LRO method
  */
 static void efx_rx_packet_lro(struct efx_channel *channel,
-			      struct efx_rx_buffer *rx_buf)
+			      struct efx_rx_buffer *rx_buf,
+			      bool checksummed)
 {
 	struct napi_struct *napi = &channel->napi_str;
 
@@ -466,7 +467,8 @@
 		skb->len = rx_buf->len;
 		skb->data_len = rx_buf->len;
 		skb->truesize += rx_buf->len;
-		skb->ip_summed = CHECKSUM_UNNECESSARY;
+		skb->ip_summed =
+			checksummed ? CHECKSUM_UNNECESSARY : CHECKSUM_NONE;
 
 		napi_gro_frags(napi);
 
@@ -475,6 +477,7 @@
 		rx_buf->page = NULL;
 	} else {
 		EFX_BUG_ON_PARANOID(!rx_buf->skb);
+		EFX_BUG_ON_PARANOID(!checksummed);
 
 		napi_gro_receive(napi, rx_buf->skb);
 		rx_buf->skb = NULL;
@@ -570,7 +573,7 @@
 	}
 
 	if (likely(checksummed || rx_buf->page)) {
-		efx_rx_packet_lro(channel, rx_buf);
+		efx_rx_packet_lro(channel, rx_buf, checksummed);
 		goto done;
 	}
 
--- linux-rt-2.6.31.orig/drivers/net/mlx4/main.c
+++ linux-rt-2.6.31/drivers/net/mlx4/main.c
@@ -525,7 +525,10 @@
 		goto err_unmap_aux;
 	}
 
-	err = mlx4_map_eq_icm(dev, init_hca->eqc_base);
+	err = mlx4_init_icm_table(dev, &priv->eq_table.table,
+				  init_hca->eqc_base, dev_cap->eqc_entry_sz,
+				  dev->caps.num_eqs, dev->caps.num_eqs,
+				  0, 0);
 	if (err) {
 		mlx4_err(dev, "Failed to map EQ context memory, aborting.\n");
 		goto err_unmap_cmpt;
@@ -668,7 +671,7 @@
 	mlx4_cleanup_icm_table(dev, &priv->mr_table.mtt_table);
 
 err_unmap_eq:
-	mlx4_unmap_eq_icm(dev);
+	mlx4_cleanup_icm_table(dev, &priv->eq_table.table);
 
 err_unmap_cmpt:
 	mlx4_cleanup_icm_table(dev, &priv->eq_table.cmpt_table);
@@ -698,11 +701,11 @@
 	mlx4_cleanup_icm_table(dev, &priv->qp_table.qp_table);
 	mlx4_cleanup_icm_table(dev, &priv->mr_table.dmpt_table);
 	mlx4_cleanup_icm_table(dev, &priv->mr_table.mtt_table);
+	mlx4_cleanup_icm_table(dev, &priv->eq_table.table);
 	mlx4_cleanup_icm_table(dev, &priv->eq_table.cmpt_table);
 	mlx4_cleanup_icm_table(dev, &priv->cq_table.cmpt_table);
 	mlx4_cleanup_icm_table(dev, &priv->srq_table.cmpt_table);
 	mlx4_cleanup_icm_table(dev, &priv->qp_table.cmpt_table);
-	mlx4_unmap_eq_icm(dev);
 
 	mlx4_UNMAP_ICM_AUX(dev);
 	mlx4_free_icm(dev, priv->fw.aux_icm, 0);
--- linux-rt-2.6.31.orig/drivers/net/mlx4/eq.c
+++ linux-rt-2.6.31/drivers/net/mlx4/eq.c
@@ -526,48 +526,6 @@
 	iounmap(priv->clr_base);
 }
 
-int mlx4_map_eq_icm(struct mlx4_dev *dev, u64 icm_virt)
-{
-	struct mlx4_priv *priv = mlx4_priv(dev);
-	int ret;
-
-	/*
-	 * We assume that mapping one page is enough for the whole EQ
-	 * context table.  This is fine with all current HCAs, because
-	 * we only use 32 EQs and each EQ uses 64 bytes of context
-	 * memory, or 1 KB total.
-	 */
-	priv->eq_table.icm_virt = icm_virt;
-	priv->eq_table.icm_page = alloc_page(GFP_HIGHUSER);
-	if (!priv->eq_table.icm_page)
-		return -ENOMEM;
-	priv->eq_table.icm_dma  = pci_map_page(dev->pdev, priv->eq_table.icm_page, 0,
-					       PAGE_SIZE, PCI_DMA_BIDIRECTIONAL);
-	if (pci_dma_mapping_error(dev->pdev, priv->eq_table.icm_dma)) {
-		__free_page(priv->eq_table.icm_page);
-		return -ENOMEM;
-	}
-
-	ret = mlx4_MAP_ICM_page(dev, priv->eq_table.icm_dma, icm_virt);
-	if (ret) {
-		pci_unmap_page(dev->pdev, priv->eq_table.icm_dma, PAGE_SIZE,
-			       PCI_DMA_BIDIRECTIONAL);
-		__free_page(priv->eq_table.icm_page);
-	}
-
-	return ret;
-}
-
-void mlx4_unmap_eq_icm(struct mlx4_dev *dev)
-{
-	struct mlx4_priv *priv = mlx4_priv(dev);
-
-	mlx4_UNMAP_ICM(dev, priv->eq_table.icm_virt, 1);
-	pci_unmap_page(dev->pdev, priv->eq_table.icm_dma, PAGE_SIZE,
-		       PCI_DMA_BIDIRECTIONAL);
-	__free_page(priv->eq_table.icm_page);
-}
-
 int mlx4_alloc_eq_table(struct mlx4_dev *dev)
 {
 	struct mlx4_priv *priv = mlx4_priv(dev);
--- linux-rt-2.6.31.orig/drivers/net/mlx4/mlx4.h
+++ linux-rt-2.6.31/drivers/net/mlx4/mlx4.h
@@ -205,9 +205,7 @@
 	void __iomem	      **uar_map;
 	u32			clr_mask;
 	struct mlx4_eq	       *eq;
-	u64			icm_virt;
-	struct page	       *icm_page;
-	dma_addr_t		icm_dma;
+	struct mlx4_icm_table	table;
 	struct mlx4_icm_table	cmpt_table;
 	int			have_irq;
 	u8			inta_pin;
@@ -373,9 +371,6 @@
 		      struct mlx4_dev_cap *dev_cap,
 		      struct mlx4_init_hca_param *init_hca);
 
-int mlx4_map_eq_icm(struct mlx4_dev *dev, u64 icm_virt);
-void mlx4_unmap_eq_icm(struct mlx4_dev *dev);
-
 int mlx4_cmd_init(struct mlx4_dev *dev);
 void mlx4_cmd_cleanup(struct mlx4_dev *dev);
 void mlx4_cmd_event(struct mlx4_dev *dev, u16 token, u8 status, u64 out_param);
--- linux-rt-2.6.31.orig/drivers/net/wireless/ray_cs.c
+++ linux-rt-2.6.31/drivers/net/wireless/ray_cs.c
@@ -2878,7 +2878,7 @@
 		       unsigned long count, void *data)
 {
 	static char proc_essid[33];
-	int len = count;
+	unsigned int len = count;
 
 	if (len > 32)
 		len = 32;
--- linux-rt-2.6.31.orig/drivers/net/wireless/hostap/hostap_info.c
+++ linux-rt-2.6.31/drivers/net/wireless/hostap/hostap_info.c
@@ -237,6 +237,7 @@
 	wrqu.data.length = 0;
 	wrqu.data.flags = 0;
 	wireless_send_event(local->dev, SIOCGIWSCAN, &wrqu, NULL);
+	wireless_send_event(local->ddev, SIOCGIWSCAN, &wrqu, NULL);
 
 	/* Allow SIOCGIWSCAN handling to occur since we have received
 	 * scanning result */
@@ -448,8 +449,10 @@
 	 * frames and can confuse wpa_supplicant about the current association
 	 * status.
 	 */
-	if (connected || local->prev_linkstatus_connected)
+	if (connected || local->prev_linkstatus_connected) {
 		wireless_send_event(local->dev, SIOCGIWAP, &wrqu, NULL);
+		wireless_send_event(local->ddev, SIOCGIWAP, &wrqu, NULL);
+	}
 	local->prev_linkstatus_connected = connected;
 }
 
--- linux-rt-2.6.31.orig/drivers/net/wireless/hostap/hostap_main.c
+++ linux-rt-2.6.31/drivers/net/wireless/hostap/hostap_main.c
@@ -875,15 +875,16 @@
 
 	switch(type) {
 	case HOSTAP_INTERFACE_AP:
+		dev->tx_queue_len = 0;	/* use main radio device queue */
 		dev->netdev_ops = &hostap_mgmt_netdev_ops;
 		dev->type = ARPHRD_IEEE80211;
 		dev->header_ops = &hostap_80211_ops;
 		break;
 	case HOSTAP_INTERFACE_MASTER:
-		dev->tx_queue_len = 0;	/* use main radio device queue */
 		dev->netdev_ops = &hostap_master_ops;
 		break;
 	default:
+		dev->tx_queue_len = 0;	/* use main radio device queue */
 		dev->netdev_ops = &hostap_netdev_ops;
 	}
 
@@ -1099,6 +1100,7 @@
 				   (u8 *) &val, 2);
 	memset(wrqu.ap_addr.sa_data, 0, ETH_ALEN);
 	wireless_send_event(local->dev, SIOCGIWAP, &wrqu, NULL);
+	wireless_send_event(local->ddev, SIOCGIWAP, &wrqu, NULL);
 	return ret;
 }
 
--- linux-rt-2.6.31.orig/drivers/net/wireless/hostap/hostap_hw.c
+++ linux-rt-2.6.31/drivers/net/wireless/hostap/hostap_hw.c
@@ -68,7 +68,7 @@
 module_param_string(essid, essid, sizeof(essid), 0444);
 MODULE_PARM_DESC(essid, "Host AP's ESSID");
 
-static int iw_mode[MAX_PARM_DEVICES] = { IW_MODE_MASTER, DEF_INTS };
+static int iw_mode[MAX_PARM_DEVICES] = { IW_MODE_INFRA, DEF_INTS };
 module_param_array(iw_mode, int, NULL, 0444);
 MODULE_PARM_DESC(iw_mode, "Initial operation mode");
 
@@ -2618,6 +2618,15 @@
 	int events = 0;
 	u16 ev;
 
+	/* Detect early interrupt before driver is fully configued */
+	if (!dev->base_addr) {
+		if (net_ratelimit()) {
+			printk(KERN_DEBUG "%s: Interrupt, but dev not configured\n",
+			       dev->name);
+		}
+		return IRQ_HANDLED;
+	}
+
 	iface = netdev_priv(dev);
 	local = iface->local;
 
@@ -3383,6 +3392,7 @@
 	memset(&wrqu, 0, sizeof(wrqu));
 	wrqu.ap_addr.sa_family = ARPHRD_ETHER;
 	wireless_send_event(local->dev, SIOCGIWAP, &wrqu, NULL);
+	wireless_send_event(local->ddev, SIOCGIWAP, &wrqu, NULL);
 
 	/* Disable hardware and firmware */
 	prism2_hw_shutdown(dev, 0);
--- linux-rt-2.6.31.orig/drivers/net/wireless/b43legacy/rfkill.c
+++ linux-rt-2.6.31/drivers/net/wireless/b43legacy/rfkill.c
@@ -34,6 +34,13 @@
 		      & B43legacy_MMIO_RADIO_HWENABLED_HI_MASK))
 			return 1;
 	} else {
+		/* To prevent CPU fault on PPC, do not read a register
+		 * unless the interface is started; however, on resume
+		 * for hibernation, this routine is entered early. When
+		 * that happens, unconditionally return TRUE.
+		 */
+		if (b43legacy_status(dev) < B43legacy_STAT_STARTED)
+			return 1;
 		if (b43legacy_read16(dev, B43legacy_MMIO_RADIO_HWENABLED_LO)
 		    & B43legacy_MMIO_RADIO_HWENABLED_LO_MASK)
 			return 1;
--- linux-rt-2.6.31.orig/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
+++ linux-rt-2.6.31/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
@@ -415,6 +415,15 @@
 	else if (tid == IWL_AGG_ALL_TID)
 		for (tid = 0; tid < TID_MAX_LOAD_COUNT; tid++)
 			rs_tl_turn_on_agg_for_tid(priv, lq_data, tid, sta);
+	if (priv->cfg->use_rts_for_ht) {
+		/*
+		 * switch to RTS/CTS if it is the prefer protection method
+		 * for HT traffic
+		 */
+		IWL_DEBUG_HT(priv, "use RTS/CTS protection for HT\n");
+		priv->staging_rxon.flags &= ~RXON_FLG_SELF_CTS_EN;
+		iwlcore_commit_rxon(priv);
+	}
 }
 
 static inline int get_num_of_ant_from_rate(u32 rate_n_flags)
--- linux-rt-2.6.31.orig/drivers/net/wireless/iwlwifi/iwl-1000.c
+++ linux-rt-2.6.31/drivers/net/wireless/iwlwifi/iwl-1000.c
@@ -46,7 +46,7 @@
 #include "iwl-5000-hw.h"
 
 /* Highest firmware API version supported */
-#define IWL1000_UCODE_API_MAX 2
+#define IWL1000_UCODE_API_MAX 3
 
 /* Lowest firmware API version supported */
 #define IWL1000_UCODE_API_MIN 1
@@ -62,12 +62,15 @@
 	.ucode_api_min = IWL1000_UCODE_API_MIN,
 	.sku = IWL_SKU_G|IWL_SKU_N,
 	.ops = &iwl5000_ops,
-	.eeprom_size = IWL_5000_EEPROM_IMG_SIZE,
+	.eeprom_size = OTP_LOW_IMAGE_SIZE,
 	.eeprom_ver = EEPROM_5000_EEPROM_VERSION,
 	.eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
 	.mod_params = &iwl50_mod_params,
 	.valid_tx_ant = ANT_A,
 	.valid_rx_ant = ANT_AB,
 	.need_pll_cfg = true,
+	.max_ll_items = OTP_MAX_LL_ITEMS_1000,
+	.shadow_ram_support = false,
+	.use_rts_for_ht = true, /* use rts/cts protection */
 };
 
--- linux-rt-2.6.31.orig/drivers/net/wireless/iwlwifi/iwl-3945.c
+++ linux-rt-2.6.31/drivers/net/wireless/iwlwifi/iwl-3945.c
@@ -2784,11 +2784,50 @@
 	return 0;
 }
 
+#define IWL3945_UCODE_GET(item)						\
+static u32 iwl3945_ucode_get_##item(const struct iwl_ucode_header *ucode,\
+				    u32 api_ver)			\
+{									\
+	return le32_to_cpu(ucode->u.v1.item);				\
+}
+
+static u32 iwl3945_ucode_get_header_size(u32 api_ver)
+{
+	return UCODE_HEADER_SIZE(1);
+}
+static u32 iwl3945_ucode_get_build(const struct iwl_ucode_header *ucode,
+				   u32 api_ver)
+{
+	return 0;
+}
+static u8 *iwl3945_ucode_get_data(const struct iwl_ucode_header *ucode,
+				  u32 api_ver)
+{
+	return (u8 *) ucode->u.v1.data;
+}
+
+IWL3945_UCODE_GET(inst_size);
+IWL3945_UCODE_GET(data_size);
+IWL3945_UCODE_GET(init_size);
+IWL3945_UCODE_GET(init_data_size);
+IWL3945_UCODE_GET(boot_size);
+
 static struct iwl_hcmd_ops iwl3945_hcmd = {
 	.rxon_assoc = iwl3945_send_rxon_assoc,
 	.commit_rxon = iwl3945_commit_rxon,
 };
 
+static struct iwl_ucode_ops iwl3945_ucode = {
+	.get_header_size = iwl3945_ucode_get_header_size,
+	.get_build = iwl3945_ucode_get_build,
+	.get_inst_size = iwl3945_ucode_get_inst_size,
+	.get_data_size = iwl3945_ucode_get_data_size,
+	.get_init_size = iwl3945_ucode_get_init_size,
+	.get_init_data_size = iwl3945_ucode_get_init_data_size,
+	.get_boot_size = iwl3945_ucode_get_boot_size,
+	.get_data = iwl3945_ucode_get_data,
+};
+
 static struct iwl_lib_ops iwl3945_lib = {
 	.txq_attach_buf_to_tfd = iwl3945_hw_txq_attach_buf_to_tfd,
 	.txq_free_tfd = iwl3945_hw_txq_free_tfd,
@@ -2829,6 +2868,7 @@
 };
 
 static struct iwl_ops iwl3945_ops = {
+	.ucode = &iwl3945_ucode,
 	.lib = &iwl3945_lib,
 	.hcmd = &iwl3945_hcmd,
 	.utils = &iwl3945_hcmd_utils,
--- linux-rt-2.6.31.orig/drivers/net/wireless/iwlwifi/iwl-tx.c
+++ linux-rt-2.6.31/drivers/net/wireless/iwlwifi/iwl-tx.c
@@ -1233,8 +1233,16 @@
 		return -ENXIO;
 	}
 
+	if (priv->stations[sta_id].tid[tid].agg.state ==
+				IWL_EMPTYING_HW_QUEUE_ADDBA) {
+		IWL_DEBUG_HT(priv, "AGG stop before setup done\n");
+		ieee80211_stop_tx_ba_cb_irqsafe(priv->hw, ra, tid);
+		priv->stations[sta_id].tid[tid].agg.state = IWL_AGG_OFF;
+		return 0;
+	}
+
 	if (priv->stations[sta_id].tid[tid].agg.state != IWL_AGG_ON)
-		IWL_WARN(priv, "Stopping AGG while state not IWL_AGG_ON\n");
+		IWL_WARN(priv, "Stopping AGG while state not ON or starting\n");
 
 	tid_data = &priv->stations[sta_id].tid[tid];
 	ssn = (tid_data->seq_number & IEEE80211_SCTL_SEQ) >> 4;
--- linux-rt-2.6.31.orig/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ linux-rt-2.6.31/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -46,8 +46,8 @@
 #include "iwl-5000-hw.h"
 
 /* Highest firmware API version supported */
-#define IWL6000_UCODE_API_MAX 2
-#define IWL6050_UCODE_API_MAX 2
+#define IWL6000_UCODE_API_MAX 3
+#define IWL6050_UCODE_API_MAX 3
 
 /* Lowest firmware API version supported */
 #define IWL6000_UCODE_API_MIN 1
@@ -69,6 +69,7 @@
 };
 
 static struct iwl_ops iwl6000_ops = {
+	.ucode = &iwl5000_ucode,
 	.lib = &iwl5000_lib,
 	.hcmd = &iwl5000_hcmd,
 	.utils = &iwl6000_hcmd_utils,
@@ -81,13 +82,15 @@
 	.ucode_api_min = IWL6000_UCODE_API_MIN,
 	.sku = IWL_SKU_A|IWL_SKU_G,
 	.ops = &iwl6000_ops,
-	.eeprom_size = IWL_5000_EEPROM_IMG_SIZE,
+	.eeprom_size = OTP_LOW_IMAGE_SIZE,
 	.eeprom_ver = EEPROM_5000_EEPROM_VERSION,
 	.eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
 	.mod_params = &iwl50_mod_params,
 	.valid_tx_ant = ANT_BC,
 	.valid_rx_ant = ANT_BC,
 	.need_pll_cfg = false,
+	.max_ll_items = OTP_MAX_LL_ITEMS_6x00,
+	.shadow_ram_support = true,
 };
 
 struct iwl_cfg iwl6000_2agn_cfg = {
@@ -97,13 +100,16 @@
 	.ucode_api_min = IWL6000_UCODE_API_MIN,
 	.sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
 	.ops = &iwl6000_ops,
-	.eeprom_size = IWL_5000_EEPROM_IMG_SIZE,
+	.eeprom_size = OTP_LOW_IMAGE_SIZE,
 	.eeprom_ver = EEPROM_5000_EEPROM_VERSION,
 	.eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
 	.mod_params = &iwl50_mod_params,
 	.valid_tx_ant = ANT_AB,
 	.valid_rx_ant = ANT_AB,
 	.need_pll_cfg = false,
+	.max_ll_items = OTP_MAX_LL_ITEMS_6x00,
+	.shadow_ram_support = true,
+	.use_rts_for_ht = true, /* use rts/cts protection */
 };
 
 struct iwl_cfg iwl6050_2agn_cfg = {
@@ -113,13 +119,16 @@
 	.ucode_api_min = IWL6050_UCODE_API_MIN,
 	.sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
 	.ops = &iwl6000_ops,
-	.eeprom_size = IWL_5000_EEPROM_IMG_SIZE,
+	.eeprom_size = OTP_LOW_IMAGE_SIZE,
 	.eeprom_ver = EEPROM_5000_EEPROM_VERSION,
 	.eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
 	.mod_params = &iwl50_mod_params,
 	.valid_tx_ant = ANT_AB,
 	.valid_rx_ant = ANT_AB,
 	.need_pll_cfg = false,
+	.max_ll_items = OTP_MAX_LL_ITEMS_6x00,
+	.shadow_ram_support = true,
+	.use_rts_for_ht = true, /* use rts/cts protection */
 };
 
 struct iwl_cfg iwl6000_3agn_cfg = {
@@ -129,13 +138,16 @@
 	.ucode_api_min = IWL6000_UCODE_API_MIN,
 	.sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
 	.ops = &iwl6000_ops,
-	.eeprom_size = IWL_5000_EEPROM_IMG_SIZE,
+	.eeprom_size = OTP_LOW_IMAGE_SIZE,
 	.eeprom_ver = EEPROM_5000_EEPROM_VERSION,
 	.eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
 	.mod_params = &iwl50_mod_params,
 	.valid_tx_ant = ANT_ABC,
 	.valid_rx_ant = ANT_ABC,
 	.need_pll_cfg = false,
+	.max_ll_items = OTP_MAX_LL_ITEMS_6x00,
+	.shadow_ram_support = true,
+	.use_rts_for_ht = true, /* use rts/cts protection */
 };
 
 struct iwl_cfg iwl6050_3agn_cfg = {
@@ -145,13 +157,16 @@
 	.ucode_api_min = IWL6050_UCODE_API_MIN,
 	.sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
 	.ops = &iwl6000_ops,
-	.eeprom_size = IWL_5000_EEPROM_IMG_SIZE,
+	.eeprom_size = OTP_LOW_IMAGE_SIZE,
 	.eeprom_ver = EEPROM_5000_EEPROM_VERSION,
 	.eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
 	.mod_params = &iwl50_mod_params,
 	.valid_tx_ant = ANT_ABC,
 	.valid_rx_ant = ANT_ABC,
 	.need_pll_cfg = false,
+	.max_ll_items = OTP_MAX_LL_ITEMS_6x00,
+	.shadow_ram_support = true,
+	.use_rts_for_ht = true, /* use rts/cts protection */
 };
 
 MODULE_FIRMWARE(IWL6000_MODULE_FIRMWARE(IWL6000_UCODE_API_MAX));
--- linux-rt-2.6.31.orig/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ linux-rt-2.6.31/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -799,7 +799,8 @@
 {
 	struct iwl_priv *priv = container_of(work, struct iwl_priv, abort_scan);
 
-	if (!iwl_is_ready(priv))
+	if (!test_bit(STATUS_READY, &priv->status) ||
+	    !test_bit(STATUS_GEO_CONFIGURED, &priv->status))
 		return;
 
 	mutex_lock(&priv->mutex);
--- linux-rt-2.6.31.orig/drivers/net/wireless/iwlwifi/iwl-4965.c
+++ linux-rt-2.6.31/drivers/net/wireless/iwlwifi/iwl-4965.c
@@ -2221,12 +2221,50 @@
 	cancel_work_sync(&priv->txpower_work);
 }
 
+#define IWL4965_UCODE_GET(item)						\
+static u32 iwl4965_ucode_get_##item(const struct iwl_ucode_header *ucode,\
+				    u32 api_ver)			\
+{									\
+	return le32_to_cpu(ucode->u.v1.item);				\
+}
+
+static u32 iwl4965_ucode_get_header_size(u32 api_ver)
+{
+	return UCODE_HEADER_SIZE(1);
+}
+static u32 iwl4965_ucode_get_build(const struct iwl_ucode_header *ucode,
+				   u32 api_ver)
+{
+	return 0;
+}
+static u8 *iwl4965_ucode_get_data(const struct iwl_ucode_header *ucode,
+				  u32 api_ver)
+{
+	return (u8 *) ucode->u.v1.data;
+}
+
+IWL4965_UCODE_GET(inst_size);
+IWL4965_UCODE_GET(data_size);
+IWL4965_UCODE_GET(init_size);
+IWL4965_UCODE_GET(init_data_size);
+IWL4965_UCODE_GET(boot_size);
+
 static struct iwl_hcmd_ops iwl4965_hcmd = {
 	.rxon_assoc = iwl4965_send_rxon_assoc,
 	.commit_rxon = iwl_commit_rxon,
 	.set_rxon_chain = iwl_set_rxon_chain,
 };
 
+static struct iwl_ucode_ops iwl4965_ucode = {
+	.get_header_size = iwl4965_ucode_get_header_size,
+	.get_build = iwl4965_ucode_get_build,
+	.get_inst_size = iwl4965_ucode_get_inst_size,
+	.get_data_size = iwl4965_ucode_get_data_size,
+	.get_init_size = iwl4965_ucode_get_init_size,
+	.get_init_data_size = iwl4965_ucode_get_init_data_size,
+	.get_boot_size = iwl4965_ucode_get_boot_size,
+	.get_data = iwl4965_ucode_get_data,
+};
 static struct iwl_hcmd_utils_ops iwl4965_hcmd_utils = {
 	.get_hcmd_size = iwl4965_get_hcmd_size,
 	.build_addsta_hcmd = iwl4965_build_addsta_hcmd,
@@ -2287,6 +2325,7 @@
 };
 
 static struct iwl_ops iwl4965_ops = {
+	.ucode = &iwl4965_ucode,
 	.lib = &iwl4965_lib,
 	.hcmd = &iwl4965_hcmd,
 	.utils = &iwl4965_hcmd_utils,
--- linux-rt-2.6.31.orig/drivers/net/wireless/iwlwifi/iwl-prph.h
+++ linux-rt-2.6.31/drivers/net/wireless/iwlwifi/iwl-prph.h
@@ -80,6 +80,8 @@
 #define APMG_RFKILL_REG			(APMG_BASE + 0x0014)
 #define APMG_RTC_INT_STT_REG		(APMG_BASE + 0x001c)
 #define APMG_RTC_INT_MSK_REG		(APMG_BASE + 0x0020)
+#define APMG_DIGITAL_SVR_REG		(APMG_BASE + 0x0058)
+#define APMG_ANALOG_SVR_REG		(APMG_BASE + 0x006C)
 
 #define APMG_CLK_VAL_DMA_CLK_RQT	(0x00000200)
 #define APMG_CLK_VAL_BSM_CLK_RQT	(0x00000800)
@@ -91,7 +93,8 @@
 #define APMG_PS_CTRL_VAL_PWR_SRC_VMAIN		(0x00000000)
 #define APMG_PS_CTRL_VAL_PWR_SRC_MAX		(0x01000000) /* 3945 only */
 #define APMG_PS_CTRL_VAL_PWR_SRC_VAUX		(0x02000000)
-
+#define APMG_SVR_VOLTAGE_CONFIG_BIT_MSK	(0x000001E0) /* bit 8:5 */
+#define APMG_SVR_DIGITAL_VOLTAGE_1_32		(0x00000060)
 
 #define APMG_PCIDEV_STT_VAL_L1_ACT_DIS		(0x00000800)
 
--- linux-rt-2.6.31.orig/drivers/net/wireless/iwlwifi/iwl-rx.c
+++ linux-rt-2.6.31/drivers/net/wireless/iwlwifi/iwl-rx.c
@@ -239,33 +239,51 @@
 	struct iwl_rx_queue *rxq = &priv->rxq;
 	struct list_head *element;
 	struct iwl_rx_mem_buffer *rxb;
+	struct sk_buff *skb;
 	unsigned long flags;
 
 	while (1) {
 		spin_lock_irqsave(&rxq->lock, flags);
-
 		if (list_empty(&rxq->rx_used)) {
 			spin_unlock_irqrestore(&rxq->lock, flags);
 			return;
 		}
-		element = rxq->rx_used.next;
-		rxb = list_entry(element, struct iwl_rx_mem_buffer, list);
-		list_del(element);
-
 		spin_unlock_irqrestore(&rxq->lock, flags);
 
+		if (rxq->free_count > RX_LOW_WATERMARK)
+			priority |= __GFP_NOWARN;
 		/* Alloc a new receive buffer */
-		rxb->skb = alloc_skb(priv->hw_params.rx_buf_size + 256,
+		skb = alloc_skb(priv->hw_params.rx_buf_size + 256,
 						priority);
 
-		if (!rxb->skb) {
-			IWL_CRIT(priv, "Can not allocate SKB buffers\n");
+		if (!skb) {
+			if (net_ratelimit())
+				IWL_DEBUG_INFO(priv, "Failed to allocate SKB buffer.\n");
+			if ((rxq->free_count <= RX_LOW_WATERMARK) &&
+			    net_ratelimit())
+				IWL_CRIT(priv, "Failed to allocate SKB buffer with %s. Only %u free buffers remaining.\n",
+					 priority == GFP_ATOMIC ?  "GFP_ATOMIC" : "GFP_KERNEL",
+					 rxq->free_count);
 			/* We don't reschedule replenish work here -- we will
 			 * call the restock method and if it still needs
 			 * more buffers it will schedule replenish */
 			break;
 		}
 
+		spin_lock_irqsave(&rxq->lock, flags);
+
+		if (list_empty(&rxq->rx_used)) {
+			spin_unlock_irqrestore(&rxq->lock, flags);
+			dev_kfree_skb_any(skb);
+			return;
+		}
+		element = rxq->rx_used.next;
+		rxb = list_entry(element, struct iwl_rx_mem_buffer, list);
+		list_del(element);
+
+		spin_unlock_irqrestore(&rxq->lock, flags);
+
+		rxb->skb = skb;
 		/* Get physical address of RB/SKB */
 		rxb->real_dma_addr = pci_map_single(
 					priv->pci_dev,
--- linux-rt-2.6.31.orig/drivers/net/wireless/iwlwifi/iwl-eeprom.c
+++ linux-rt-2.6.31/drivers/net/wireless/iwlwifi/iwl-eeprom.c
@@ -152,6 +152,19 @@
 }
 EXPORT_SYMBOL(iwlcore_eeprom_verify_signature);
 
+static void iwl_set_otp_access(struct iwl_priv *priv, enum iwl_access_mode mode)
+{
+	u32 otpgp;
+
+	otpgp = iwl_read32(priv, CSR_OTP_GP_REG);
+	if (mode == IWL_OTP_ACCESS_ABSOLUTE)
+		iwl_clear_bit(priv, CSR_OTP_GP_REG,
+				CSR_OTP_GP_REG_OTP_ACCESS_MODE);
+	else
+		iwl_set_bit(priv, CSR_OTP_GP_REG,
+				CSR_OTP_GP_REG_OTP_ACCESS_MODE);
+}
+
 static int iwlcore_get_nvm_type(struct iwl_priv *priv)
 {
 	u32 otpgp;
@@ -249,6 +262,123 @@
 	return ret;
 }
 
+static int iwl_read_otp_word(struct iwl_priv *priv, u16 addr, u16 *eeprom_data)
+{
+	int ret = 0;
+	u32 r;
+	u32 otpgp;
+
+	_iwl_write32(priv, CSR_EEPROM_REG,
+		     CSR_EEPROM_REG_MSK_ADDR & (addr << 1));
+	ret = iwl_poll_direct_bit(priv, CSR_EEPROM_REG,
+				  CSR_EEPROM_REG_READ_VALID_MSK,
+				  IWL_EEPROM_ACCESS_TIMEOUT);
+	if (ret < 0) {
+		IWL_ERR(priv, "Time out reading OTP[%d]\n", addr);
+		return ret;
+	}
+	r = _iwl_read_direct32(priv, CSR_EEPROM_REG);
+	/* check for ECC errors: */
+	otpgp = iwl_read32(priv, CSR_OTP_GP_REG);
+	if (otpgp & CSR_OTP_GP_REG_ECC_UNCORR_STATUS_MSK) {
+		/* stop in this case */
+		/* set the uncorrectable OTP ECC bit for acknowledgement */
+		iwl_set_bit(priv, CSR_OTP_GP_REG,
+			CSR_OTP_GP_REG_ECC_UNCORR_STATUS_MSK);
+		IWL_ERR(priv, "Uncorrectable OTP ECC error, abort OTP read\n");
+		return -EINVAL;
+	}
+	if (otpgp & CSR_OTP_GP_REG_ECC_CORR_STATUS_MSK) {
+		/* continue in this case */
+		/* set the correctable OTP ECC bit for acknowledgement */
+		iwl_set_bit(priv, CSR_OTP_GP_REG,
+				CSR_OTP_GP_REG_ECC_CORR_STATUS_MSK);
+		IWL_ERR(priv, "Correctable OTP ECC error, continue read\n");
+	}
+	*eeprom_data = le16_to_cpu((__force __le16)(r >> 16));
+	return 0;
+}
+
+/*
+ * iwl_is_otp_empty: check for empty OTP
+ */
+static bool iwl_is_otp_empty(struct iwl_priv *priv)
+{
+	u16 next_link_addr = 0, link_value;
+	bool is_empty = false;
+
+	/* locate the beginning of OTP link list */
+	if (!iwl_read_otp_word(priv, next_link_addr, &link_value)) {
+		if (!link_value) {
+			IWL_ERR(priv, "OTP is empty\n");
+			is_empty = true;
+		}
+	} else {
+		IWL_ERR(priv, "Unable to read first block of OTP list.\n");
+		is_empty = true;
+	}
+
+	return is_empty;
+}
+
+
+/*
+ * iwl_find_otp_image: find EEPROM image in OTP
+ *   finding the OTP block that contains the EEPROM image.
+ *   the last valid block on the link list (the block _before_ the last block)
+ *   is the block we should read and used to configure the device.
+ *   If all the available OTP blocks are full, the last block will be the block
+ *   we should read and used to configure the device.
+ *   only perform this operation if shadow RAM is disabled
+ */
+static int iwl_find_otp_image(struct iwl_priv *priv,
+					u16 *validblockaddr)
+{
+	u16 next_link_addr = 0, link_value = 0, valid_addr;
+	int usedblocks = 0;
+
+	/* set addressing mode to absolute to traverse the link list */
+	iwl_set_otp_access(priv, IWL_OTP_ACCESS_ABSOLUTE);
+
+	/* checking for empty OTP or error */
+	if (iwl_is_otp_empty(priv))
+		return -EINVAL;
+
+	/*
+	 * start traverse link list
+	 * until reach the max number of OTP blocks
+	 * different devices have different number of OTP blocks
+	 */
+	do {
+		/* save current valid block address
+		 * check for more block on the link list
+		 */
+		valid_addr = next_link_addr;
+		next_link_addr = link_value * sizeof(u16);
+		IWL_DEBUG_INFO(priv, "OTP blocks %d addr 0x%x\n",
+			       usedblocks, next_link_addr);
+		if (iwl_read_otp_word(priv, next_link_addr, &link_value))
+			return -EINVAL;
+		if (!link_value) {
+			/*
+			 * reach the end of link list, return success and
+			 * set address point to the starting address
+			 * of the image
+			 */
+			*validblockaddr = valid_addr;
+			/* skip first 2 bytes (link list pointer) */
+			*validblockaddr += 2;
+			return 0;
+		}
+		/* more in the link list, continue */
+		usedblocks++;
+	} while (usedblocks <= priv->cfg->max_ll_items);
+
+	/* OTP has no valid blocks */
+	IWL_DEBUG_INFO(priv, "OTP has no valid blocks\n");
+	return -EINVAL;
+}
+
 /**
  * iwl_eeprom_init - read EEPROM contents
  *
@@ -263,14 +393,13 @@
 	int sz;
 	int ret;
 	u16 addr;
-	u32 otpgp;
+	u16 validblockaddr = 0;
+	u16 cache_addr = 0;
 
 	priv->nvm_device_type = iwlcore_get_nvm_type(priv);
 
 	/* allocate eeprom */
-	if (priv->nvm_device_type == NVM_DEVICE_TYPE_OTP)
-		priv->cfg->eeprom_size =
-			OTP_BLOCK_SIZE * OTP_LOWER_BLOCKS_TOTAL;
+	IWL_DEBUG_INFO(priv, "NVM size = %d\n", priv->cfg->eeprom_size);
 	sz = priv->cfg->eeprom_size;
 	priv->eeprom = kzalloc(sz, GFP_KERNEL);
 	if (!priv->eeprom) {
@@ -298,46 +427,31 @@
 		if (ret) {
 			IWL_ERR(priv, "Failed to initialize OTP access.\n");
 			ret = -ENOENT;
-			goto err;
+			goto done;
 		}
 		_iwl_write32(priv, CSR_EEPROM_GP,
 			     iwl_read32(priv, CSR_EEPROM_GP) &
 			     ~CSR_EEPROM_GP_IF_OWNER_MSK);
-		/* clear */
-		_iwl_write32(priv, CSR_OTP_GP_REG,
-			     iwl_read32(priv, CSR_OTP_GP_REG) |
+
+		iwl_set_bit(priv, CSR_OTP_GP_REG,
 			     CSR_OTP_GP_REG_ECC_CORR_STATUS_MSK |
 			     CSR_OTP_GP_REG_ECC_UNCORR_STATUS_MSK);
-
-		for (addr = 0; addr < sz; addr += sizeof(u16)) {
-			u32 r;
-
-			_iwl_write32(priv, CSR_EEPROM_REG,
-				     CSR_EEPROM_REG_MSK_ADDR & (addr << 1));
-
-			ret = iwl_poll_direct_bit(priv, CSR_EEPROM_REG,
-						  CSR_EEPROM_REG_READ_VALID_MSK,
-						  IWL_EEPROM_ACCESS_TIMEOUT);
-			if (ret < 0) {
-				IWL_ERR(priv, "Time out reading OTP[%d]\n", addr);
+		/* traversing the linked list if no shadow ram supported */
+		if (!priv->cfg->shadow_ram_support) {
+			if (iwl_find_otp_image(priv, &validblockaddr)) {
+				ret = -ENOENT;
 				goto done;
 			}
-			r = _iwl_read_direct32(priv, CSR_EEPROM_REG);
-			/* check for ECC errors: */
-			otpgp = iwl_read32(priv, CSR_OTP_GP_REG);
-			if (otpgp & CSR_OTP_GP_REG_ECC_UNCORR_STATUS_MSK) {
-				/* stop in this case */
-				IWL_ERR(priv, "Uncorrectable OTP ECC error, Abort OTP read\n");
+		}
+		for (addr = validblockaddr; addr < validblockaddr + sz;
+		     addr += sizeof(u16)) {
+			u16 eeprom_data;
+
+			ret = iwl_read_otp_word(priv, addr, &eeprom_data);
+			if (ret)
 				goto done;
-			}
-			if (otpgp & CSR_OTP_GP_REG_ECC_CORR_STATUS_MSK) {
-				/* continue in this case */
-				_iwl_write32(priv, CSR_OTP_GP_REG,
-					     iwl_read32(priv, CSR_OTP_GP_REG) |
-					     CSR_OTP_GP_REG_ECC_CORR_STATUS_MSK);
-				IWL_ERR(priv, "Correctable OTP ECC error, continue read\n");
-			}
-			e[addr / 2] = le16_to_cpu((__force __le16)(r >> 16));
+			e[cache_addr / 2] = eeprom_data;
+			cache_addr += sizeof(u16);
 		}
 	} else {
 		/* eeprom is an array of 16bit values */
--- linux-rt-2.6.31.orig/drivers/net/wireless/iwlwifi/iwl-eeprom.h
+++ linux-rt-2.6.31/drivers/net/wireless/iwlwifi/iwl-eeprom.h
@@ -180,8 +180,14 @@
 #define EEPROM_5050_EEPROM_VERSION	(0x21E)
 
 /* OTP */
-#define OTP_LOWER_BLOCKS_TOTAL		(3)
-#define OTP_BLOCK_SIZE			(0x400)
+/* lower blocks contain EEPROM image and calibration data */
+#define OTP_LOW_IMAGE_SIZE		(2 * 512 * sizeof(u16)) /* 2 KB */
+/* high blocks contain PAPD data */
+#define OTP_HIGH_IMAGE_SIZE_6x00        (6 * 512 * sizeof(u16)) /* 6 KB */
+#define OTP_HIGH_IMAGE_SIZE_1000        (0x200 * sizeof(u16)) /* 1024 bytes */
+#define OTP_MAX_LL_ITEMS_1000		(3)	/* OTP blocks for 1000 */
+#define OTP_MAX_LL_ITEMS_6x00		(4)	/* OTP blocks for 6x00 */
+#define OTP_MAX_LL_ITEMS_6x50		(7)	/* OTP blocks for 6x50 */
 
 /* 2.4 GHz */
 extern const u8 iwl_eeprom_band_1[14];
--- linux-rt-2.6.31.orig/drivers/net/wireless/iwlwifi/iwl-dev.h
+++ linux-rt-2.6.31/drivers/net/wireless/iwlwifi/iwl-dev.h
@@ -66,6 +66,7 @@
 /* shared structures from iwl-5000.c */
 extern struct iwl_mod_params iwl50_mod_params;
 extern struct iwl_ops iwl5000_ops;
+extern struct iwl_ucode_ops iwl5000_ucode;
 extern struct iwl_lib_ops iwl5000_lib;
 extern struct iwl_hcmd_ops iwl5000_hcmd;
 extern struct iwl_hcmd_utils_ops iwl5000_hcmd_utils;
@@ -525,15 +526,29 @@
 };
 
 /* uCode file layout */
-struct iwl_ucode {
-	__le32 ver;		/* major/minor/API/serial */
-	__le32 inst_size;	/* bytes of runtime instructions */
-	__le32 data_size;	/* bytes of runtime data */
-	__le32 init_size;	/* bytes of initialization instructions */
-	__le32 init_data_size;	/* bytes of initialization data */
-	__le32 boot_size;	/* bytes of bootstrap instructions */
-	u8 data[0];		/* data in same order as "size" elements */
+struct iwl_ucode_header {
+	__le32 ver;	/* major/minor/API/serial */
+	union {
+		struct {
+			__le32 inst_size;	/* bytes of runtime code */
+			__le32 data_size;	/* bytes of runtime data */
+			__le32 init_size;	/* bytes of init code */
+			__le32 init_data_size;	/* bytes of init data */
+			__le32 boot_size;	/* bytes of bootstrap code */
+			u8 data[0];		/* in same order as sizes */
+		} v1;
+		struct {
+			__le32 build;		/* build number */
+			__le32 inst_size;	/* bytes of runtime code */
+			__le32 data_size;	/* bytes of runtime data */
+			__le32 init_size;	/* bytes of init code */
+			__le32 init_data_size;	/* bytes of init data */
+			__le32 boot_size;	/* bytes of bootstrap code */
+			u8 data[0];		/* in same order as sizes */
+		} v2;
+	} u;
 };
+#define UCODE_HEADER_SIZE(ver) ((ver) == 1 ? 24 : 28)
 
 struct iwl4965_ibss_seq {
 	u8 mac[ETH_ALEN];
@@ -820,6 +835,18 @@
 	NVM_DEVICE_TYPE_OTP,
 };
 
+/*
+ * Two types of OTP memory access modes
+ *   IWL_OTP_ACCESS_ABSOLUTE - absolute address mode,
+ * 			        based on physical memory addressing
+ *   IWL_OTP_ACCESS_RELATIVE - relative address mode,
+ * 			       based on logical memory addressing
+ */
+enum iwl_access_mode {
+	IWL_OTP_ACCESS_ABSOLUTE,
+	IWL_OTP_ACCESS_RELATIVE,
+};
+
 /* interrupt statistics */
 struct isr_statistics {
 	u32 hw;
--- linux-rt-2.6.31.orig/drivers/net/wireless/iwlwifi/iwl-core.h
+++ linux-rt-2.6.31/drivers/net/wireless/iwlwifi/iwl-core.h
@@ -116,6 +116,17 @@
 	void (*set_ct_kill)(struct iwl_priv *priv);
 };
 
+struct iwl_ucode_ops {
+	u32 (*get_header_size)(u32);
+	u32 (*get_build)(const struct iwl_ucode_header *, u32);
+	u32 (*get_inst_size)(const struct iwl_ucode_header *, u32);
+	u32 (*get_data_size)(const struct iwl_ucode_header *, u32);
+	u32 (*get_init_size)(const struct iwl_ucode_header *, u32);
+	u32 (*get_init_data_size)(const struct iwl_ucode_header *, u32);
+	u32 (*get_boot_size)(const struct iwl_ucode_header *, u32);
+	u8 * (*get_data)(const struct iwl_ucode_header *, u32);
+};
+
 struct iwl_lib_ops {
 	/* set hw dependent parameters */
 	int (*set_hw_params)(struct iwl_priv *priv);
@@ -171,6 +182,7 @@
 };
 
 struct iwl_ops {
+	const struct iwl_ucode_ops *ucode;
 	const struct iwl_lib_ops *lib;
 	const struct iwl_hcmd_ops *hcmd;
 	const struct iwl_hcmd_utils_ops *utils;
@@ -195,6 +207,9 @@
  * 	filename is constructed as fw_name_pre<api>.ucode.
  * @ucode_api_max: Highest version of uCode API supported by driver.
  * @ucode_api_min: Lowest version of uCode API supported by driver.
+ * @max_ll_items: max number of OTP blocks
+ * @shadow_ram_support: shadow support for OTP memory
+ * @use_rts_for_ht: use rts/cts protection for HT traffic
  *
  * We enable the driver to be backward compatible wrt API version. The
  * driver specifies which APIs it supports (with @ucode_api_max being the
@@ -231,6 +246,9 @@
 	u8   valid_rx_ant;
 	bool need_pll_cfg;
 	bool use_isr_legacy;
+	const u16 max_ll_items;
+	const bool shadow_ram_support;
+	bool use_rts_for_ht;
 };
 
 /***************************
--- linux-rt-2.6.31.orig/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ linux-rt-2.6.31/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -239,6 +239,13 @@
 				APMG_PS_CTRL_EARLY_PWR_OFF_RESET_DIS,
 				~APMG_PS_CTRL_EARLY_PWR_OFF_RESET_DIS);
 
+	if ((priv->hw_rev & CSR_HW_REV_TYPE_MSK) == CSR_HW_REV_TYPE_1000) {
+		/* Setting digital SVR for 1000 card to 1.32V */
+		iwl_set_bits_mask_prph(priv, APMG_DIGITAL_SVR_REG,
+					APMG_SVR_DIGITAL_VOLTAGE_1_32,
+					~APMG_SVR_VOLTAGE_CONFIG_BIT_MSK);
+	}
+
 	spin_unlock_irqrestore(&priv->lock, flags);
 }
 
@@ -1426,6 +1433,44 @@
 	return max_rssi - agc - IWL49_RSSI_OFFSET;
 }
 
+#define IWL5000_UCODE_GET(item)						\
+static u32 iwl5000_ucode_get_##item(const struct iwl_ucode_header *ucode,\
+				    u32 api_ver)			\
+{									\
+	if (api_ver <= 2)						\
+		return le32_to_cpu(ucode->u.v1.item);			\
+	return le32_to_cpu(ucode->u.v2.item);				\
+}
+
+static u32 iwl5000_ucode_get_header_size(u32 api_ver)
+{
+	if (api_ver <= 2)
+		return UCODE_HEADER_SIZE(1);
+	return UCODE_HEADER_SIZE(2);
+}
+
+static u32 iwl5000_ucode_get_build(const struct iwl_ucode_header *ucode,
+				   u32 api_ver)
+{
+	if (api_ver <= 2)
+		return 0;
+	return le32_to_cpu(ucode->u.v2.build);
+}
+
+static u8 *iwl5000_ucode_get_data(const struct iwl_ucode_header *ucode,
+				  u32 api_ver)
+{
+	if (api_ver <= 2)
+		return (u8 *) ucode->u.v1.data;
+	return (u8 *) ucode->u.v2.data;
+}
+
+IWL5000_UCODE_GET(inst_size);
+IWL5000_UCODE_GET(data_size);
+IWL5000_UCODE_GET(init_size);
+IWL5000_UCODE_GET(init_data_size);
+IWL5000_UCODE_GET(boot_size);
+
 struct iwl_hcmd_ops iwl5000_hcmd = {
 	.rxon_assoc = iwl5000_send_rxon_assoc,
 	.commit_rxon = iwl_commit_rxon,
@@ -1441,6 +1486,17 @@
 	.calc_rssi = iwl5000_calc_rssi,
 };
 
+struct iwl_ucode_ops iwl5000_ucode = {
+	.get_header_size = iwl5000_ucode_get_header_size,
+	.get_build = iwl5000_ucode_get_build,
+	.get_inst_size = iwl5000_ucode_get_inst_size,
+	.get_data_size = iwl5000_ucode_get_data_size,
+	.get_init_size = iwl5000_ucode_get_init_size,
+	.get_init_data_size = iwl5000_ucode_get_init_data_size,
+	.get_boot_size = iwl5000_ucode_get_boot_size,
+	.get_data = iwl5000_ucode_get_data,
+};
+
 struct iwl_lib_ops iwl5000_lib = {
 	.set_hw_params = iwl5000_hw_set_hw_params,
 	.txq_update_byte_cnt_tbl = iwl5000_txq_update_byte_cnt_tbl,
@@ -1542,12 +1598,14 @@
 };
 
 struct iwl_ops iwl5000_ops = {
+	.ucode = &iwl5000_ucode,
 	.lib = &iwl5000_lib,
 	.hcmd = &iwl5000_hcmd,
 	.utils = &iwl5000_hcmd_utils,
 };
 
 static struct iwl_ops iwl5150_ops = {
+	.ucode = &iwl5000_ucode,
 	.lib = &iwl5150_lib,
 	.hcmd = &iwl5000_hcmd,
 	.utils = &iwl5000_hcmd_utils,
--- linux-rt-2.6.31.orig/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ linux-rt-2.6.31/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -115,9 +115,6 @@
 
 	/* always get timestamp with Rx frame */
 	priv->staging_rxon.flags |= RXON_FLG_TSF2HOST_MSK;
-	/* allow CTS-to-self if possible. this is relevant only for
-	 * 5000, but will not damage 4965 */
-	priv->staging_rxon.flags |= RXON_FLG_SELF_CTS_EN;
 
 	ret = iwl_check_rxon_cmd(priv);
 	if (ret) {
@@ -217,6 +214,13 @@
 					"Could not send WEP static key.\n");
 		}
 
+		/*
+		 * allow CTS-to-self if possible for new association.
+		 * this is relevant only for 5000 series and up,
+		 * but will not damage 4965
+		 */
+		priv->staging_rxon.flags |= RXON_FLG_SELF_CTS_EN;
+
 		/* Apply the new configuration
 		 * RXON assoc doesn't clear the station table in uCode,
 		 */
@@ -1348,7 +1352,7 @@
  */
 static int iwl_read_ucode(struct iwl_priv *priv)
 {
-	struct iwl_ucode *ucode;
+	struct iwl_ucode_header *ucode;
 	int ret = -EINVAL, index;
 	const struct firmware *ucode_raw;
 	const char *name_pre = priv->cfg->fw_name_pre;
@@ -1357,7 +1361,8 @@
 	char buf[25];
 	u8 *src;
 	size_t len;
-	u32 api_ver, inst_size, data_size, init_size, init_data_size, boot_size;
+	u32 api_ver, build;
+	u32 inst_size, data_size, init_size, init_data_size, boot_size;
 
 	/* Ask kernel firmware_class module to get the boot firmware off disk.
 	 * request_firmware() is synchronous, file is in memory on return. */
@@ -1387,23 +1392,26 @@
 	if (ret < 0)
 		goto error;
 
-	/* Make sure that we got at least our header! */
-	if (ucode_raw->size < sizeof(*ucode)) {
+	/* Make sure that we got at least the v1 header! */
+	if (ucode_raw->size < priv->cfg->ops->ucode->get_header_size(1)) {
 		IWL_ERR(priv, "File size way too small!\n");
 		ret = -EINVAL;
 		goto err_release;
 	}
 
 	/* Data from ucode file:  header followed by uCode images */
-	ucode = (void *)ucode_raw->data;
+	ucode = (struct iwl_ucode_header *)ucode_raw->data;
 
 	priv->ucode_ver = le32_to_cpu(ucode->ver);
 	api_ver = IWL_UCODE_API(priv->ucode_ver);
-	inst_size = le32_to_cpu(ucode->inst_size);
-	data_size = le32_to_cpu(ucode->data_size);
-	init_size = le32_to_cpu(ucode->init_size);
-	init_data_size = le32_to_cpu(ucode->init_data_size);
-	boot_size = le32_to_cpu(ucode->boot_size);
+	build = priv->cfg->ops->ucode->get_build(ucode, api_ver);
+	inst_size = priv->cfg->ops->ucode->get_inst_size(ucode, api_ver);
+	data_size = priv->cfg->ops->ucode->get_data_size(ucode, api_ver);
+	init_size = priv->cfg->ops->ucode->get_init_size(ucode, api_ver);
+	init_data_size =
+		priv->cfg->ops->ucode->get_init_data_size(ucode, api_ver);
+	boot_size = priv->cfg->ops->ucode->get_boot_size(ucode, api_ver);
+	src = priv->cfg->ops->ucode->get_data(ucode, api_ver);
 
 	/* api_ver should match the api version forming part of the
 	 * firmware filename ... but we don't check for that and only rely
@@ -1429,6 +1437,9 @@
 	       IWL_UCODE_API(priv->ucode_ver),
 	       IWL_UCODE_SERIAL(priv->ucode_ver));
 
+	if (build)
+		IWL_DEBUG_INFO(priv, "Build %u\n", build);
+
 	IWL_DEBUG_INFO(priv, "f/w package hdr ucode version raw = 0x%x\n",
 		       priv->ucode_ver);
 	IWL_DEBUG_INFO(priv, "f/w package hdr runtime inst size = %u\n",
@@ -1443,12 +1454,14 @@
 		       boot_size);
 
 	/* Verify size of file vs. image size info in file's header */
-	if (ucode_raw->size < sizeof(*ucode) +
+	if (ucode_raw->size !=
+		priv->cfg->ops->ucode->get_header_size(api_ver) +
 		inst_size + data_size + init_size +
 		init_data_size + boot_size) {
 
-		IWL_DEBUG_INFO(priv, "uCode file size %d too small\n",
-			       (int)ucode_raw->size);
+		IWL_DEBUG_INFO(priv,
+			"uCode file size %d does not match expected size\n",
+			(int)ucode_raw->size);
 		ret = -EINVAL;
 		goto err_release;
 	}
@@ -1528,42 +1541,42 @@
 	/* Copy images into buffers for card's bus-master reads ... */
 
 	/* Runtime instructions (first block of data in file) */
-	src = &ucode->data[0];
-	len = priv->ucode_code.len;
+	len = inst_size;
 	IWL_DEBUG_INFO(priv, "Copying (but not loading) uCode instr len %Zd\n", len);
 	memcpy(priv->ucode_code.v_addr, src, len);
+	src += len;
+
 	IWL_DEBUG_INFO(priv, "uCode instr buf vaddr = 0x%p, paddr = 0x%08x\n",
 		priv->ucode_code.v_addr, (u32)priv->ucode_code.p_addr);
 
 	/* Runtime data (2nd block)
 	 * NOTE:  Copy into backup buffer will be done in iwl_up()  */
-	src = &ucode->data[inst_size];
-	len = priv->ucode_data.len;
+	len = data_size;
 	IWL_DEBUG_INFO(priv, "Copying (but not loading) uCode data len %Zd\n", len);
 	memcpy(priv->ucode_data.v_addr, src, len);
 	memcpy(priv->ucode_data_backup.v_addr, src, len);
+	src += len;
 
 	/* Initialization instructions (3rd block) */
 	if (init_size) {
-		src = &ucode->data[inst_size + data_size];
-		len = priv->ucode_init.len;
+		len = init_size;
 		IWL_DEBUG_INFO(priv, "Copying (but not loading) init instr len %Zd\n",
 				len);
 		memcpy(priv->ucode_init.v_addr, src, len);
+		src += len;
 	}
 
 	/* Initialization data (4th block) */
 	if (init_data_size) {
-		src = &ucode->data[inst_size + data_size + init_size];
-		len = priv->ucode_init_data.len;
+		len = init_data_size;
 		IWL_DEBUG_INFO(priv, "Copying (but not loading) init data len %Zd\n",
 			       len);
 		memcpy(priv->ucode_init_data.v_addr, src, len);
+		src += len;
 	}
 
 	/* Bootstrap instructions (5th block) */
-	src = &ucode->data[inst_size + data_size + init_size + init_data_size];
-	len = priv->ucode_boot.len;
+	len = boot_size;
 	IWL_DEBUG_INFO(priv, "Copying (but not loading) boot instr len %Zd\n", len);
 	memcpy(priv->ucode_boot.v_addr, src, len);
 
@@ -2206,7 +2219,7 @@
 
 	priv->is_open = 0;
 
-	if (iwl_is_ready_rf(priv)) {
+	if (iwl_is_ready_rf(priv) || test_bit(STATUS_SCAN_HW, &priv->status)) {
 		/* stop mac, cancel any scan request and clear
 		 * RXON_FILTER_ASSOC_MSK BIT
 		 */
--- linux-rt-2.6.31.orig/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ linux-rt-2.6.31/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -1196,6 +1196,7 @@
 	struct iwl_rx_queue *rxq = &priv->rxq;
 	struct list_head *element;
 	struct iwl_rx_mem_buffer *rxb;
+	struct sk_buff *skb;
 	unsigned long flags;
 
 	while (1) {
@@ -1205,25 +1206,39 @@
 			spin_unlock_irqrestore(&rxq->lock, flags);
 			return;
 		}
-
-		element = rxq->rx_used.next;
-		rxb = list_entry(element, struct iwl_rx_mem_buffer, list);
-		list_del(element);
 		spin_unlock_irqrestore(&rxq->lock, flags);
 
+		if (rxq->free_count > RX_LOW_WATERMARK)
+			priority |= __GFP_NOWARN;
 		/* Alloc a new receive buffer */
-		rxb->skb =
-		    alloc_skb(priv->hw_params.rx_buf_size,
-				priority);
-		if (!rxb->skb) {
+		skb = alloc_skb(priv->hw_params.rx_buf_size, priority);
+		if (!skb) {
 			if (net_ratelimit())
-				IWL_CRIT(priv, ": Can not allocate SKB buffers\n");
+				IWL_DEBUG_INFO(priv, "Failed to allocate SKB buffer.\n");
+			if ((rxq->free_count <= RX_LOW_WATERMARK) &&
+			    net_ratelimit())
+				IWL_CRIT(priv, "Failed to allocate SKB buffer with %s. Only %u free buffers remaining.\n",
+					 priority == GFP_ATOMIC ?  "GFP_ATOMIC" : "GFP_KERNEL",
+					 rxq->free_count);
 			/* We don't reschedule replenish work here -- we will
 			 * call the restock method and if it still needs
 			 * more buffers it will schedule replenish */
 			break;
 		}
 
+		spin_lock_irqsave(&rxq->lock, flags);
+		if (list_empty(&rxq->rx_used)) {
+			spin_unlock_irqrestore(&rxq->lock, flags);
+			dev_kfree_skb_any(skb);
+			return;
+		}
+		element = rxq->rx_used.next;
+		rxb = list_entry(element, struct iwl_rx_mem_buffer, list);
+		list_del(element);
+		spin_unlock_irqrestore(&rxq->lock, flags);
+
+		rxb->skb = skb;
+
 		/* If radiotap head is required, reserve some headroom here.
 		 * The physical head count is a variable rx_stats->phy_count.
 		 * We reserve 4 bytes here. Plus these extra bytes, the
@@ -2111,7 +2126,7 @@
  */
 static int iwl3945_read_ucode(struct iwl_priv *priv)
 {
-	struct iwl_ucode *ucode;
+	const struct iwl_ucode_header *ucode;
 	int ret = -EINVAL, index;
 	const struct firmware *ucode_raw;
 	/* firmware file name contains uCode/driver compatibility version */
@@ -2152,22 +2167,24 @@
 		goto error;
 
 	/* Make sure that we got at least our header! */
-	if (ucode_raw->size < sizeof(*ucode)) {
+	if (ucode_raw->size <  priv->cfg->ops->ucode->get_header_size(1)) {
 		IWL_ERR(priv, "File size way too small!\n");
 		ret = -EINVAL;
 		goto err_release;
 	}
 
 	/* Data from ucode file:  header followed by uCode images */
-	ucode = (void *)ucode_raw->data;
+	ucode = (struct iwl_ucode_header *)ucode_raw->data;
 
 	priv->ucode_ver = le32_to_cpu(ucode->ver);
 	api_ver = IWL_UCODE_API(priv->ucode_ver);
-	inst_size = le32_to_cpu(ucode->inst_size);
-	data_size = le32_to_cpu(ucode->data_size);
-	init_size = le32_to_cpu(ucode->init_size);
-	init_data_size = le32_to_cpu(ucode->init_data_size);
-	boot_size = le32_to_cpu(ucode->boot_size);
+	inst_size = priv->cfg->ops->ucode->get_inst_size(ucode, api_ver);
+	data_size = priv->cfg->ops->ucode->get_data_size(ucode, api_ver);
+	init_size = priv->cfg->ops->ucode->get_init_size(ucode, api_ver);
+	init_data_size =
+		priv->cfg->ops->ucode->get_init_data_size(ucode, api_ver);
+	boot_size = priv->cfg->ops->ucode->get_boot_size(ucode, api_ver);
+	src = priv->cfg->ops->ucode->get_data(ucode, api_ver);
 
 	/* api_ver should match the api version forming part of the
 	 * firmware filename ... but we don't check for that and only rely
@@ -2208,12 +2225,13 @@
 
 
 	/* Verify size of file vs. image size info in file's header */
-	if (ucode_raw->size < sizeof(*ucode) +
+	if (ucode_raw->size != priv->cfg->ops->ucode->get_header_size(api_ver) +
 		inst_size + data_size + init_size +
 		init_data_size + boot_size) {
 
-		IWL_DEBUG_INFO(priv, "uCode file size %zd too small\n",
-			       ucode_raw->size);
+		IWL_DEBUG_INFO(priv,
+			"uCode file size %zd does not match expected size\n",
+			ucode_raw->size);
 		ret = -EINVAL;
 		goto err_release;
 	}
@@ -2296,44 +2314,44 @@
 	/* Copy images into buffers for card's bus-master reads ... */
 
 	/* Runtime instructions (first block of data in file) */
-	src = &ucode->data[0];
-	len = priv->ucode_code.len;
+	len = inst_size;
 	IWL_DEBUG_INFO(priv,
 		"Copying (but not loading) uCode instr len %zd\n", len);
 	memcpy(priv->ucode_code.v_addr, src, len);
+	src += len;
+
 	IWL_DEBUG_INFO(priv, "uCode instr buf vaddr = 0x%p, paddr = 0x%08x\n",
 		priv->ucode_code.v_addr, (u32)priv->ucode_code.p_addr);
 
 	/* Runtime data (2nd block)
 	 * NOTE:  Copy into backup buffer will be done in iwl3945_up()  */
-	src = &ucode->data[inst_size];
-	len = priv->ucode_data.len;
+	len = data_size;
 	IWL_DEBUG_INFO(priv,
 		"Copying (but not loading) uCode data len %zd\n", len);
 	memcpy(priv->ucode_data.v_addr, src, len);
 	memcpy(priv->ucode_data_backup.v_addr, src, len);
+	src += len;
 
 	/* Initialization instructions (3rd block) */
 	if (init_size) {
-		src = &ucode->data[inst_size + data_size];
-		len = priv->ucode_init.len;
+		len = init_size;
 		IWL_DEBUG_INFO(priv,
 			"Copying (but not loading) init instr len %zd\n", len);
 		memcpy(priv->ucode_init.v_addr, src, len);
+		src += len;
 	}
 
 	/* Initialization data (4th block) */
 	if (init_data_size) {
-		src = &ucode->data[inst_size + data_size + init_size];
-		len = priv->ucode_init_data.len;
+		len = init_data_size;
 		IWL_DEBUG_INFO(priv,
 			"Copying (but not loading) init data len %zd\n", len);
 		memcpy(priv->ucode_init_data.v_addr, src, len);
+		src += len;
 	}
 
 	/* Bootstrap instructions (5th block) */
-	src = &ucode->data[inst_size + data_size + init_size + init_data_size];
-	len = priv->ucode_boot.len;
+	len = boot_size;
 	IWL_DEBUG_INFO(priv,
 		"Copying (but not loading) boot instr len %zd\n", len);
 	memcpy(priv->ucode_boot.v_addr, src, len);
--- linux-rt-2.6.31.orig/drivers/net/wireless/ath/ath5k/eeprom.h
+++ linux-rt-2.6.31/drivers/net/wireless/ath/ath5k/eeprom.h
@@ -34,6 +34,14 @@
 #define AR5K_EEPROM_RFKILL_POLARITY_S	1
 
 #define AR5K_EEPROM_REG_DOMAIN		0x00bf	/* EEPROM regdom */
+
+/* FLASH(EEPROM) Defines for AR531X chips */
+#define AR5K_EEPROM_SIZE_LOWER		0x1b /* size info -- lower */
+#define AR5K_EEPROM_SIZE_UPPER		0x1c /* size info -- upper */
+#define AR5K_EEPROM_SIZE_UPPER_MASK	0xfff0
+#define AR5K_EEPROM_SIZE_UPPER_SHIFT	4
+#define AR5K_EEPROM_SIZE_ENDLOC_SHIFT	12
+
 #define AR5K_EEPROM_CHECKSUM		0x00c0	/* EEPROM checksum */
 #define AR5K_EEPROM_INFO_BASE		0x00c0	/* EEPROM header */
 #define AR5K_EEPROM_INFO_MAX		(0x400 - AR5K_EEPROM_INFO_BASE)
--- linux-rt-2.6.31.orig/drivers/net/wireless/ath/ath5k/phy.c
+++ linux-rt-2.6.31/drivers/net/wireless/ath/ath5k/phy.c
@@ -740,13 +740,22 @@
 						AR5K_RF_XPD_GAIN, true);
 
 		} else {
-			/* TODO: Set high and low gain bits */
-			ath5k_hw_rfb_op(ah, rf_regs,
-						ee->ee_x_gain[ee_mode],
+			u8 *pdg_curve_to_idx = ee->ee_pdc_to_idx[ee_mode];
+			if (ee->ee_pd_gains[ee_mode] > 1) {
+				ath5k_hw_rfb_op(ah, rf_regs,
+						pdg_curve_to_idx[0],
 						AR5K_RF_PD_GAIN_LO, true);
-			ath5k_hw_rfb_op(ah, rf_regs,
-						ee->ee_x_gain[ee_mode],
+				ath5k_hw_rfb_op(ah, rf_regs,
+						pdg_curve_to_idx[1],
 						AR5K_RF_PD_GAIN_HI, true);
+			} else {
+				ath5k_hw_rfb_op(ah, rf_regs,
+						pdg_curve_to_idx[0],
+						AR5K_RF_PD_GAIN_LO, true);
+				ath5k_hw_rfb_op(ah, rf_regs,
+						pdg_curve_to_idx[0],
+						AR5K_RF_PD_GAIN_HI, true);
+			}
 
 			/* Lower synth voltage on Rev 2 */
 			ath5k_hw_rfb_op(ah, rf_regs, 2,
@@ -1897,8 +1906,9 @@
 	s16 min_pwrL, min_pwrR;
 	s16 pwr_i;
 
-	if (WARN_ON(stepL[0] == stepL[1] || stepR[0] == stepR[1]))
-		return 0;
+	/* Some vendors write the same pcdac value twice !!! */
+	if (stepL[0] == stepL[1] || stepR[0] == stepR[1])
+		return max(pwrL[0], pwrR[0]);
 
 	if (pwrL[0] == pwrL[1])
 		min_pwrL = pwrL[0];
@@ -2921,8 +2931,6 @@
 		ATH5K_ERR(ah->ah_sc, "invalid tx power: %u\n", txpower);
 		return -EINVAL;
 	}
-	if (txpower == 0)
-		txpower = AR5K_TUNE_DEFAULT_TXPOWER;
 
 	/* Reset TX power values */
 	memset(&ah->ah_txpower, 0, sizeof(ah->ah_txpower));
--- linux-rt-2.6.31.orig/drivers/net/wireless/ath/ath5k/eeprom.c
+++ linux-rt-2.6.31/drivers/net/wireless/ath/ath5k/eeprom.c
@@ -97,6 +97,7 @@
 	struct ath5k_eeprom_info *ee = &ah->ah_capabilities.cap_eeprom;
 	int ret;
 	u16 val;
+	u32 cksum, offset, eep_max = AR5K_EEPROM_INFO_MAX;
 
 	/*
 	 * Read values from EEPROM and store them in the capability structure
@@ -111,20 +112,44 @@
 	if (ah->ah_ee_version < AR5K_EEPROM_VERSION_3_0)
 		return 0;
 
-#ifdef notyet
 	/*
 	 * Validate the checksum of the EEPROM date. There are some
 	 * devices with invalid EEPROMs.
 	 */
-	for (cksum = 0, offset = 0; offset < AR5K_EEPROM_INFO_MAX; offset++) {
+	AR5K_EEPROM_READ(AR5K_EEPROM_SIZE_UPPER, val);
+	if (val) {
+		eep_max = (val & AR5K_EEPROM_SIZE_UPPER_MASK) <<
+			   AR5K_EEPROM_SIZE_ENDLOC_SHIFT;
+		AR5K_EEPROM_READ(AR5K_EEPROM_SIZE_LOWER, val);
+		eep_max = (eep_max | val) - AR5K_EEPROM_INFO_BASE;
+
+		/*
+		 * Fail safe check to prevent stupid loops due
+		 * to busted EEPROMs. XXX: This value is likely too
+		 * big still, waiting on a better value.
+		 */
+		if (eep_max > (3 * AR5K_EEPROM_INFO_MAX)) {
+			ATH5K_ERR(ah->ah_sc, "Invalid max custom EEPROM size: "
+				  "%d (0x%04x) max expected: %d (0x%04x)\n",
+				  eep_max, eep_max,
+				  3 * AR5K_EEPROM_INFO_MAX,
+				  3 * AR5K_EEPROM_INFO_MAX);
+			return -EIO;
+		}
+	}
+
+	for (cksum = 0, offset = 0; offset < eep_max; offset++) {
 		AR5K_EEPROM_READ(AR5K_EEPROM_INFO(offset), val);
 		cksum ^= val;
 	}
 	if (cksum != AR5K_EEPROM_INFO_CKSUM) {
-		ATH5K_ERR(ah->ah_sc, "Invalid EEPROM checksum 0x%04x\n", cksum);
+		ATH5K_ERR(ah->ah_sc, "Invalid EEPROM "
+			  "checksum: 0x%04x eep_max: 0x%04x (%s)\n",
+			  cksum, eep_max,
+			  eep_max == AR5K_EEPROM_INFO_MAX ?
+				"default size" : "custom size");
 		return -EIO;
 	}
-#endif
 
 	AR5K_EEPROM_READ_HDR(AR5K_EEPROM_ANT_GAIN(ah->ah_ee_version),
 	    ee_ant_gain);
--- linux-rt-2.6.31.orig/drivers/net/wireless/ath/ath5k/base.c
+++ linux-rt-2.6.31/drivers/net/wireless/ath/ath5k/base.c
@@ -666,7 +666,6 @@
 
 	ath5k_led_off(sc);
 
-	free_irq(pdev->irq, sc);
 	pci_save_state(pdev);
 	pci_disable_device(pdev);
 	pci_set_power_state(pdev, PCI_D3hot);
@@ -694,18 +693,8 @@
 	 */
 	pci_write_config_byte(pdev, 0x41, 0);
 
-	err = request_irq(pdev->irq, ath5k_intr, IRQF_SHARED, "ath", sc);
-	if (err) {
-		ATH5K_ERR(sc, "request_irq failed\n");
-		goto err_no_irq;
-	}
-
 	ath5k_led_enable(sc);
 	return 0;
-
-err_no_irq:
-	pci_disable_device(pdev);
-	return err;
 }
 #endif /* CONFIG_PM */
 
@@ -2445,27 +2434,29 @@
 	ret = ath5k_stop_locked(sc);
 	if (ret == 0 && !test_bit(ATH_STAT_INVALID, sc->status)) {
 		/*
-		 * Set the chip in full sleep mode.  Note that we are
-		 * careful to do this only when bringing the interface
-		 * completely to a stop.  When the chip is in this state
-		 * it must be carefully woken up or references to
-		 * registers in the PCI clock domain may freeze the bus
-		 * (and system).  This varies by chip and is mostly an
-		 * issue with newer parts that go to sleep more quickly.
-		 */
-		if (sc->ah->ah_mac_srev >= 0x78) {
-			/*
-			 * XXX
-			 * don't put newer MAC revisions > 7.8 to sleep because
-			 * of the above mentioned problems
-			 */
-			ATH5K_DBG(sc, ATH5K_DEBUG_RESET, "mac version > 7.8, "
-				"not putting device to sleep\n");
-		} else {
-			ATH5K_DBG(sc, ATH5K_DEBUG_RESET,
-				"putting device to full sleep\n");
-			ath5k_hw_set_power(sc->ah, AR5K_PM_FULL_SLEEP, true, 0);
-		}
+		 * Don't set the card in full sleep mode!
+		 *
+		 * a) When the device is in this state it must be carefully
+		 * woken up or references to registers in the PCI clock
+		 * domain may freeze the bus (and system).  This varies
+		 * by chip and is mostly an issue with newer parts
+		 * (madwifi sources mentioned srev >= 0x78) that go to
+		 * sleep more quickly.
+		 *
+		 * b) On older chips full sleep results a weird behaviour
+		 * during wakeup. I tested various cards with srev < 0x78
+		 * and they don't wake up after module reload, a second
+		 * module reload is needed to bring the card up again.
+		 *
+		 * Until we figure out what's going on don't enable
+		 * full chip reset on any chip (this is what Legacy HAL
+		 * and Sam's HAL do anyway). Instead Perform a full reset
+		 * on the device (same as initial state after attach) and
+		 * leave it idle (keep MAC/BB on warm reset) */
+		ret = ath5k_hw_on_hold(sc->ah);
+
+		ATH5K_DBG(sc, ATH5K_DEBUG_RESET,
+				"putting device to sleep\n");
 	}
 	ath5k_txbuf_free(sc, sc->bbuf);
 
@@ -2676,7 +2667,7 @@
 		sc->curchan = chan;
 		sc->curband = &sc->sbands[chan->band];
 	}
-	ret = ath5k_hw_reset(ah, sc->opmode, sc->curchan, true);
+	ret = ath5k_hw_reset(ah, sc->opmode, sc->curchan, chan != NULL);
 	if (ret) {
 		ATH5K_ERR(sc, "can't reset hardware (%d)\n", ret);
 		goto err;
--- linux-rt-2.6.31.orig/drivers/net/wireless/ath/ath5k/reset.c
+++ linux-rt-2.6.31/drivers/net/wireless/ath/ath5k/reset.c
@@ -258,29 +258,35 @@
 		if (!set_chip)
 			goto commit;
 
-		/* Preserve sleep duration */
 		data = ath5k_hw_reg_read(ah, AR5K_SLEEP_CTL);
+
+		/* If card is down we 'll get 0xffff... so we
+		 * need to clean this up before we write the register
+		 */
 		if (data & 0xffc00000)
 			data = 0;
 		else
-			data = data & 0xfffcffff;
+			/* Preserve sleep duration etc */
+			data = data & ~AR5K_SLEEP_CTL_SLE;
 
-		ath5k_hw_reg_write(ah, data, AR5K_SLEEP_CTL);
+		ath5k_hw_reg_write(ah, data | AR5K_SLEEP_CTL_SLE_WAKE,
+							AR5K_SLEEP_CTL);
 		udelay(15);
 
-		for (i = 50; i > 0; i--) {
+		for (i = 200; i > 0; i--) {
 			/* Check if the chip did wake up */
 			if ((ath5k_hw_reg_read(ah, AR5K_PCICFG) &
 					AR5K_PCICFG_SPWR_DN) == 0)
 				break;
 
 			/* Wait a bit and retry */
-			udelay(200);
-			ath5k_hw_reg_write(ah, data, AR5K_SLEEP_CTL);
+			udelay(50);
+			ath5k_hw_reg_write(ah, data | AR5K_SLEEP_CTL_SLE_WAKE,
+							AR5K_SLEEP_CTL);
 		}
 
 		/* Fail if the chip didn't wake up */
-		if (i <= 0)
+		if (i == 0)
 			return -EIO;
 
 		break;
@@ -297,6 +303,64 @@
 }
 
 /*
+ * Put device on hold
+ *
+ * Put MAC and Baseband on warm reset and
+ * keep that state (don't clean sleep control
+ * register). After this MAC and Baseband are
+ * disabled and a full reset is needed to come
+ * back. This way we save as much power as possible
+ * without puting the card on full sleep.
+ */
+int ath5k_hw_on_hold(struct ath5k_hw *ah)
+{
+	struct pci_dev *pdev = ah->ah_sc->pdev;
+	u32 bus_flags;
+	int ret;
+
+	/* Make sure device is awake */
+	ret = ath5k_hw_set_power(ah, AR5K_PM_AWAKE, true, 0);
+	if (ret) {
+		ATH5K_ERR(ah->ah_sc, "failed to wakeup the MAC Chip\n");
+		return ret;
+	}
+
+	/*
+	 * Put chipset on warm reset...
+	 *
+	 * Note: puting PCI core on warm reset on PCI-E cards
+	 * results card to hang and always return 0xffff... so
+	 * we ingore that flag for PCI-E cards. On PCI cards
+	 * this flag gets cleared after 64 PCI clocks.
+	 */
+	bus_flags = (pdev->is_pcie) ? 0 : AR5K_RESET_CTL_PCI;
+
+	if (ah->ah_version == AR5K_AR5210) {
+		ret = ath5k_hw_nic_reset(ah, AR5K_RESET_CTL_PCU |
+			AR5K_RESET_CTL_MAC | AR5K_RESET_CTL_DMA |
+			AR5K_RESET_CTL_PHY | AR5K_RESET_CTL_PCI);
+			mdelay(2);
+	} else {
+		ret = ath5k_hw_nic_reset(ah, AR5K_RESET_CTL_PCU |
+			AR5K_RESET_CTL_BASEBAND | bus_flags);
+	}
+
+	if (ret) {
+		ATH5K_ERR(ah->ah_sc, "failed to put device on warm reset\n");
+		return -EIO;
+	}
+
+	/* ...wakeup again!*/
+	ret = ath5k_hw_set_power(ah, AR5K_PM_AWAKE, true, 0);
+	if (ret) {
+		ATH5K_ERR(ah->ah_sc, "failed to put device on hold\n");
+		return ret;
+	}
+
+	return ret;
+}
+
+/*
  * Bring up MAC + PHY Chips and program PLL
  * TODO: Half/Quarter rate support
  */
@@ -319,6 +383,50 @@
 		return ret;
 	}
 
+	/*
+	 * Put chipset on warm reset...
+	 *
+	 * Note: puting PCI core on warm reset on PCI-E cards
+	 * results card to hang and always return 0xffff... so
+	 * we ingore that flag for PCI-E cards. On PCI cards
+	 * this flag gets cleared after 64 PCI clocks.
+	 */
+	bus_flags = (pdev->is_pcie) ? 0 : AR5K_RESET_CTL_PCI;
+
+	if (ah->ah_version == AR5K_AR5210) {
+		ret = ath5k_hw_nic_reset(ah, AR5K_RESET_CTL_PCU |
+			AR5K_RESET_CTL_MAC | AR5K_RESET_CTL_DMA |
+			AR5K_RESET_CTL_PHY | AR5K_RESET_CTL_PCI);
+			mdelay(2);
+	} else {
+		ret = ath5k_hw_nic_reset(ah, AR5K_RESET_CTL_PCU |
+			AR5K_RESET_CTL_BASEBAND | bus_flags);
+	}
+
+	if (ret) {
+		ATH5K_ERR(ah->ah_sc, "failed to reset the MAC Chip\n");
+		return -EIO;
+	}
+
+	/* ...wakeup again!...*/
+	ret = ath5k_hw_set_power(ah, AR5K_PM_AWAKE, true, 0);
+	if (ret) {
+		ATH5K_ERR(ah->ah_sc, "failed to resume the MAC Chip\n");
+		return ret;
+	}
+
+	/* ...clear reset control register and pull device out of
+	 * warm reset */
+	if (ath5k_hw_nic_reset(ah, 0)) {
+		ATH5K_ERR(ah->ah_sc, "failed to warm reset the MAC Chip\n");
+		return -EIO;
+	}
+
+	/* On initialization skip PLL programming since we don't have
+	 * a channel / mode set yet */
+	if (initial)
+		return 0;
+
 	if (ah->ah_version != AR5K_AR5210) {
 		/*
 		 * Get channel mode flags
@@ -384,39 +492,6 @@
 					AR5K_PHY_TURBO);
 	}
 
-	/* reseting PCI on PCI-E cards results card to hang
-	 * and always return 0xffff... so we ingore that flag
-	 * for PCI-E cards */
-	bus_flags = (pdev->is_pcie) ? 0 : AR5K_RESET_CTL_PCI;
-
-	/* Reset chipset */
-	if (ah->ah_version == AR5K_AR5210) {
-		ret = ath5k_hw_nic_reset(ah, AR5K_RESET_CTL_PCU |
-			AR5K_RESET_CTL_MAC | AR5K_RESET_CTL_DMA |
-			AR5K_RESET_CTL_PHY | AR5K_RESET_CTL_PCI);
-			mdelay(2);
-	} else {
-		ret = ath5k_hw_nic_reset(ah, AR5K_RESET_CTL_PCU |
-			AR5K_RESET_CTL_BASEBAND | bus_flags);
-	}
-	if (ret) {
-		ATH5K_ERR(ah->ah_sc, "failed to reset the MAC Chip\n");
-		return -EIO;
-	}
-
-	/* ...wakeup again!*/
-	ret = ath5k_hw_set_power(ah, AR5K_PM_AWAKE, true, 0);
-	if (ret) {
-		ATH5K_ERR(ah->ah_sc, "failed to resume the MAC Chip\n");
-		return ret;
-	}
-
-	/* ...final warm reset */
-	if (ath5k_hw_nic_reset(ah, 0)) {
-		ATH5K_ERR(ah->ah_sc, "failed to warm reset the MAC Chip\n");
-		return -EIO;
-	}
-
 	if (ah->ah_version != AR5K_AR5210) {
 
 		/* ...update PLL if needed */
--- linux-rt-2.6.31.orig/drivers/net/wireless/ath/ath5k/attach.c
+++ linux-rt-2.6.31/drivers/net/wireless/ath/ath5k/attach.c
@@ -145,7 +145,7 @@
 		goto err_free;
 
 	/* Bring device out of sleep and reset it's units */
-	ret = ath5k_hw_nic_wakeup(ah, CHANNEL_B, true);
+	ret = ath5k_hw_nic_wakeup(ah, 0, true);
 	if (ret)
 		goto err_free;
 
--- linux-rt-2.6.31.orig/drivers/net/wireless/ath/ath5k/ath5k.h
+++ linux-rt-2.6.31/drivers/net/wireless/ath/ath5k/ath5k.h
@@ -1164,6 +1164,7 @@
 
 /* Reset Functions */
 extern int ath5k_hw_nic_wakeup(struct ath5k_hw *ah, int flags, bool initial);
+extern int ath5k_hw_on_hold(struct ath5k_hw *ah);
 extern int ath5k_hw_reset(struct ath5k_hw *ah, enum nl80211_iftype op_mode, struct ieee80211_channel *channel, bool change_channel);
 /* Power management functions */
 extern int ath5k_hw_set_power(struct ath5k_hw *ah, enum ath5k_power_mode mode, bool set_chip, u16 sleep_duration);
--- linux-rt-2.6.31.orig/drivers/net/wireless/ath/ar9170/usb.c
+++ linux-rt-2.6.31/drivers/net/wireless/ath/ar9170/usb.c
@@ -64,6 +64,8 @@
 	{ USB_DEVICE(0x0cf3, 0x9170) },
 	/* Atheros TG121N */
 	{ USB_DEVICE(0x0cf3, 0x1001) },
+	/* TP-Link TL-WN821N v2 */
+	{ USB_DEVICE(0x0cf3, 0x1002) },
 	/* Cace Airpcap NX */
 	{ USB_DEVICE(0xcace, 0x0300) },
 	/* D-Link DWA 160A */
--- linux-rt-2.6.31.orig/drivers/net/wireless/ipw2x00/ipw2200.c
+++ linux-rt-2.6.31/drivers/net/wireless/ipw2x00/ipw2200.c
@@ -89,7 +89,7 @@
 static u32 ipw_debug_level;
 static int associate;
 static int auto_create = 1;
-static int led = 0;
+static int led = 1;
 static int disable = 0;
 static int bt_coexist = 0;
 static int hwcrypto = 0;
@@ -11964,7 +11964,7 @@
 MODULE_PARM_DESC(auto_create, "auto create adhoc network (default on)");
 
 module_param(led, int, 0444);
-MODULE_PARM_DESC(led, "enable led control on some systems (default 0 off)");
+MODULE_PARM_DESC(led, "enable led control on some systems (default 1 on)");
 
 module_param(debug, int, 0444);
 MODULE_PARM_DESC(debug, "debug output mask");
--- linux-rt-2.6.31.orig/drivers/net/wireless/ipw2x00/ipw2100.c
+++ linux-rt-2.6.31/drivers/net/wireless/ipw2x00/ipw2100.c
@@ -6487,6 +6487,16 @@
 }
 #endif
 
+static void ipw2100_shutdown(struct pci_dev *pci_dev)
+{
+	struct ipw2100_priv *priv = pci_get_drvdata(pci_dev);
+
+	/* Take down the device; powers it off, etc. */
+	ipw2100_down(priv);
+
+	pci_disable_device(pci_dev);
+}
+
 #define IPW2100_DEV_ID(x) { PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, x }
 
 static struct pci_device_id ipw2100_pci_id_table[] __devinitdata = {
@@ -6550,6 +6560,7 @@
 	.suspend = ipw2100_suspend,
 	.resume = ipw2100_resume,
 #endif
+	.shutdown = ipw2100_shutdown,
 };
 
 /**
--- linux-rt-2.6.31.orig/drivers/net/wireless/rtl818x/rtl8187_leds.c
+++ linux-rt-2.6.31/drivers/net/wireless/rtl818x/rtl8187_leds.c
@@ -210,10 +210,10 @@
 
 	/* turn the LED off before exiting */
 	queue_delayed_work(dev->workqueue, &priv->led_off, 0);
-	cancel_delayed_work_sync(&priv->led_off);
-	cancel_delayed_work_sync(&priv->led_on);
 	rtl8187_unregister_led(&priv->led_rx);
 	rtl8187_unregister_led(&priv->led_tx);
+	cancel_delayed_work_sync(&priv->led_off);
+	cancel_delayed_work_sync(&priv->led_on);
 }
 #endif /* def CONFIG_RTL8187_LED */
 
--- linux-rt-2.6.31.orig/drivers/net/wireless/b43/rfkill.c
+++ linux-rt-2.6.31/drivers/net/wireless/b43/rfkill.c
@@ -33,7 +33,8 @@
 		      & B43_MMIO_RADIO_HWENABLED_HI_MASK))
 			return 1;
 	} else {
-		if (b43_read16(dev, B43_MMIO_RADIO_HWENABLED_LO)
+		if (b43_status(dev) >= B43_STAT_STARTED &&
+		    b43_read16(dev, B43_MMIO_RADIO_HWENABLED_LO)
 		    & B43_MMIO_RADIO_HWENABLED_LO_MASK)
 			return 1;
 	}
--- linux-rt-2.6.31.orig/drivers/net/wireless/b43/dma.c
+++ linux-rt-2.6.31/drivers/net/wireless/b43/dma.c
@@ -1158,8 +1158,9 @@
 }
 
 static int dma_tx_fragment(struct b43_dmaring *ring,
-			   struct sk_buff *skb)
+			   struct sk_buff **in_skb)
 {
+	struct sk_buff *skb = *in_skb;
 	const struct b43_dma_ops *ops = ring->ops;
 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 	u8 *header;
@@ -1225,8 +1226,14 @@
 		}
 
 		memcpy(skb_put(bounce_skb, skb->len), skb->data, skb->len);
+		memcpy(bounce_skb->cb, skb->cb, sizeof(skb->cb));
+		bounce_skb->dev = skb->dev;
+		skb_set_queue_mapping(bounce_skb, skb_get_queue_mapping(skb));
+		info = IEEE80211_SKB_CB(bounce_skb);
+
 		dev_kfree_skb_any(skb);
 		skb = bounce_skb;
+		*in_skb = bounce_skb;
 		meta->skb = skb;
 		meta->dmaaddr = map_descbuffer(ring, skb->data, skb->len, 1);
 		if (b43_dma_mapping_error(ring, meta->dmaaddr, skb->len, 1)) {
@@ -1334,13 +1341,22 @@
 	spin_lock_irqsave(&ring->lock, flags);
 
 	B43_WARN_ON(!ring->tx);
-	/* Check if the queue was stopped in mac80211,
-	 * but we got called nevertheless.
-	 * That would be a mac80211 bug. */
-	B43_WARN_ON(ring->stopped);
 
-	if (unlikely(free_slots(ring) < TX_SLOTS_PER_FRAME)) {
-		b43warn(dev->wl, "DMA queue overflow\n");
+	if (unlikely(ring->stopped)) {
+		/* We get here only because of a bug in mac80211.
+		 * Because of a race, one packet may be queued after
+		 * the queue is stopped, thus we got called when we shouldn't.
+		 * For now, just refuse the transmit. */
+		if (b43_debug(dev, B43_DBG_DMAVERBOSE))
+			b43err(dev->wl, "Packet after queue stopped\n");
+		err = -ENOSPC;
+		goto out_unlock;
+	}
+
+	if (unlikely(WARN_ON(free_slots(ring) < TX_SLOTS_PER_FRAME))) {
+		/* If we get here, we have a real error with the queue
+		 * full, but queues not stopped. */
+		b43err(dev->wl, "DMA queue overflow\n");
 		err = -ENOSPC;
 		goto out_unlock;
 	}
@@ -1350,7 +1366,11 @@
 	 * static, so we don't need to store it per frame. */
 	ring->queue_prio = skb_get_queue_mapping(skb);
 
-	err = dma_tx_fragment(ring, skb);
+	/* dma_tx_fragment might reallocate the skb, so invalidate pointers pointing
+	 * into the skb data or cb now. */
+	hdr = NULL;
+	info = NULL;
+	err = dma_tx_fragment(ring, &skb);
 	if (unlikely(err == -ENOKEY)) {
 		/* Drop this packet, as we don't have the encryption key
 		 * anymore and must not transmit it unencrypted. */
--- linux-rt-2.6.31.orig/drivers/net/wireless/libertas/if_usb.c
+++ linux-rt-2.6.31/drivers/net/wireless/libertas/if_usb.c
@@ -507,7 +507,7 @@
 	/* Fill the receive configuration URB and initialise the Rx call back */
 	usb_fill_bulk_urb(cardp->rx_urb, cardp->udev,
 			  usb_rcvbulkpipe(cardp->udev, cardp->ep_in),
-			  (void *) (skb->tail + (size_t) IPFIELD_ALIGN_OFFSET),
+			  skb->data + IPFIELD_ALIGN_OFFSET,
 			  MRVDRV_ETH_RX_PACKET_BUFFER_SIZE, callbackfn,
 			  cardp);
 
--- linux-rt-2.6.31.orig/drivers/net/wireless/libertas/wext.c
+++ linux-rt-2.6.31/drivers/net/wireless/libertas/wext.c
@@ -1951,10 +1951,8 @@
 	if (priv->connect_status == LBS_CONNECTED) {
 		memcpy(extra, priv->curbssparams.ssid,
 		       priv->curbssparams.ssid_len);
-		extra[priv->curbssparams.ssid_len] = '\0';
 	} else {
 		memset(extra, 0, 32);
-		extra[priv->curbssparams.ssid_len] = '\0';
 	}
 	/*
 	 * If none, we may want to get the one that was set
--- linux-rt-2.6.31.orig/drivers/net/wireless/p54/p54usb.c
+++ linux-rt-2.6.31/drivers/net/wireless/p54/p54usb.c
@@ -64,8 +64,9 @@
 	{USB_DEVICE(0x0915, 0x2002)},	/* Cohiba Proto board */
 	{USB_DEVICE(0x0baf, 0x0118)},   /* U.S. Robotics U5 802.11g Adapter*/
 	{USB_DEVICE(0x0bf8, 0x1009)},   /* FUJITSU E-5400 USB D1700*/
-	{USB_DEVICE(0x0cde, 0x0006)},   /* Medion MD40900 */
+// DUPE	{USB_DEVICE(0x0cde, 0x0006)},   /* Medion MD40900 */
 	{USB_DEVICE(0x0cde, 0x0008)},	/* Sagem XG703A */
+	{USB_DEVICE(0x0cde, 0x0015)},	/* Zcomax XG-705A */
 	{USB_DEVICE(0x0d8e, 0x3762)},	/* DLink DWL-G120 Cohiba */
 	{USB_DEVICE(0x124a, 0x4025)},	/* IOGear GWU513 (GW3887IK chip) */
 	{USB_DEVICE(0x1260, 0xee22)},	/* SMC 2862W-G version 2 */
@@ -426,12 +427,16 @@
 static int p54u_firmware_reset_3887(struct ieee80211_hw *dev)
 {
 	struct p54u_priv *priv = dev->priv;
-	u8 buf[4];
+	u8 *buf;
 	int ret;
 
-	memcpy(&buf, p54u_romboot_3887, sizeof(buf));
+	buf = kmalloc(4, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
+	memcpy(buf, p54u_romboot_3887, 4);
 	ret = p54u_bulk_msg(priv, P54U_PIPE_DATA,
-			    buf, sizeof(buf));
+			    buf, 4);
+	kfree(buf);
 	if (ret)
 		dev_err(&priv->udev->dev, "(p54usb) unable to jump to "
 			"boot ROM (%d)!\n", ret);
--- linux-rt-2.6.31.orig/drivers/net/can/vcan.c
+++ linux-rt-2.6.31/drivers/net/can/vcan.c
@@ -80,7 +80,7 @@
 	skb->dev       = dev;
 	skb->ip_summed = CHECKSUM_UNNECESSARY;
 
-	netif_rx(skb);
+	netif_rx_ni(skb);
 }
 
 static int vcan_tx(struct sk_buff *skb, struct net_device *dev)
--- linux-rt-2.6.31.orig/drivers/net/appletalk/ipddp.c
+++ linux-rt-2.6.31/drivers/net/appletalk/ipddp.c
@@ -176,8 +176,7 @@
 	dev->stats.tx_packets++;
 	dev->stats.tx_bytes += skb->len;
 
-        if(aarp_send_ddp(rt->dev, skb, &rt->at, NULL) < 0)
-                dev_kfree_skb(skb);
+	aarp_send_ddp(rt->dev, skb, &rt->at, NULL);
 
 	spin_unlock(&ipddp_route_lock);
 
--- linux-rt-2.6.31.orig/drivers/net/e1000e/hw.h
+++ linux-rt-2.6.31/drivers/net/e1000e/hw.h
@@ -368,6 +368,7 @@
 #define E1000_DEV_ID_ICH9_IGP_M_AMT		0x10F5
 #define E1000_DEV_ID_ICH9_IGP_M			0x10BF
 #define E1000_DEV_ID_ICH9_IGP_M_V		0x10CB
+#define E1000_DEV_ID_ICH9_IGP_M_V_2		0x10BE
 #define E1000_DEV_ID_ICH9_IGP_C			0x294C
 #define E1000_DEV_ID_ICH9_IFE			0x10C0
 #define E1000_DEV_ID_ICH9_IFE_GT		0x10C3
--- linux-rt-2.6.31.orig/drivers/net/e1000e/netdev.c
+++ linux-rt-2.6.31/drivers/net/e1000e/netdev.c
@@ -482,14 +482,24 @@
 
 		length = le16_to_cpu(rx_desc->length);
 
-		/* !EOP means multiple descriptors were used to store a single
-		 * packet, also make sure the frame isn't just CRC only */
-		if (!(status & E1000_RXD_STAT_EOP) || (length <= 4)) {
+		/*
+		 * !EOP means multiple descriptors were used to store a single
+		 * packet, if that's the case we need to toss it.  In fact, we
+		 * need to toss every packet with the EOP bit clear and the
+		 * next frame that _does_ have the EOP bit set, as it is by
+		 * definition only a frame fragment
+		 */
+		if (unlikely(!(status & E1000_RXD_STAT_EOP)))
+			adapter->flags2 |= FLAG2_IS_DISCARDING;
+
+		if (adapter->flags2 & FLAG2_IS_DISCARDING) {
 			/* All receives must fit into a single buffer */
 			e_dbg("%s: Receive packet consumed multiple buffers\n",
 			      netdev->name);
 			/* recycle */
 			buffer_info->skb = skb;
+			if (status & E1000_RXD_STAT_EOP)
+				adapter->flags2 &= ~FLAG2_IS_DISCARDING;
 			goto next_desc;
 		}
 
@@ -747,10 +757,16 @@
 				 PCI_DMA_FROMDEVICE);
 		buffer_info->dma = 0;
 
-		if (!(staterr & E1000_RXD_STAT_EOP)) {
+		/* see !EOP comment in other rx routine */
+		if (!(staterr & E1000_RXD_STAT_EOP))
+			adapter->flags2 |= FLAG2_IS_DISCARDING;
+
+		if (adapter->flags2 & FLAG2_IS_DISCARDING) {
 			e_dbg("%s: Packet Split buffers didn't pick up the "
 			      "full packet\n", netdev->name);
 			dev_kfree_skb_irq(skb);
+			if (staterr & E1000_RXD_STAT_EOP)
+				adapter->flags2 &= ~FLAG2_IS_DISCARDING;
 			goto next_desc;
 		}
 
@@ -1120,6 +1136,7 @@
 
 	rx_ring->next_to_clean = 0;
 	rx_ring->next_to_use = 0;
+	adapter->flags2 &= ~FLAG2_IS_DISCARDING;
 
 	writel(0, adapter->hw.hw_addr + rx_ring->head);
 	writel(0, adapter->hw.hw_addr + rx_ring->tail);
@@ -2330,18 +2347,6 @@
 	rctl &= ~E1000_RCTL_SZ_4096;
 	rctl |= E1000_RCTL_BSEX;
 	switch (adapter->rx_buffer_len) {
-	case 256:
-		rctl |= E1000_RCTL_SZ_256;
-		rctl &= ~E1000_RCTL_BSEX;
-		break;
-	case 512:
-		rctl |= E1000_RCTL_SZ_512;
-		rctl &= ~E1000_RCTL_BSEX;
-		break;
-	case 1024:
-		rctl |= E1000_RCTL_SZ_1024;
-		rctl &= ~E1000_RCTL_BSEX;
-		break;
 	case 2048:
 	default:
 		rctl |= E1000_RCTL_SZ_2048;
@@ -4301,13 +4306,7 @@
 	 * fragmented skbs
 	 */
 
-	if (max_frame <= 256)
-		adapter->rx_buffer_len = 256;
-	else if (max_frame <= 512)
-		adapter->rx_buffer_len = 512;
-	else if (max_frame <= 1024)
-		adapter->rx_buffer_len = 1024;
-	else if (max_frame <= 2048)
+	if (max_frame <= 2048)
 		adapter->rx_buffer_len = 2048;
 	else
 		adapter->rx_buffer_len = 4096;
@@ -4985,7 +4984,7 @@
 	/* AER (Advanced Error Reporting) hooks */
 	err = pci_enable_pcie_error_reporting(pdev);
 	if (err) {
-		dev_err(&pdev->dev, "pci_enable_pcie_error_reporting failed "
+		dev_notice(&pdev->dev, "pci_enable_pcie_error_reporting failed "
 		        "0x%x\n", err);
 		/* non-fatal, continue */
 	}
@@ -5365,6 +5364,7 @@
 	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_ICH9_IGP_M), board_ich9lan },
 	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_ICH9_IGP_M_AMT), board_ich9lan },
 	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_ICH9_IGP_M_V), board_ich9lan },
+	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_ICH9_IGP_M_V_2), board_ich9lan },
 
 	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_ICH10_R_BM_LM), board_ich9lan },
 	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_ICH10_R_BM_LF), board_ich9lan },
--- linux-rt-2.6.31.orig/drivers/net/e1000e/82571.c
+++ linux-rt-2.6.31/drivers/net/e1000e/82571.c
@@ -1803,7 +1803,7 @@
 				  | FLAG_HAS_AMT
 				  | FLAG_HAS_CTRLEXT_ON_LOAD,
 	.pba			= 20,
-	.max_hw_frame_size	= ETH_FRAME_LEN + ETH_FCS_LEN,
+	.max_hw_frame_size	= DEFAULT_JUMBO,
 	.get_variants		= e1000_get_variants_82571,
 	.mac_ops		= &e82571_mac_ops,
 	.phy_ops		= &e82_phy_ops_bm,
@@ -1820,7 +1820,7 @@
 				  | FLAG_HAS_AMT
 				  | FLAG_HAS_CTRLEXT_ON_LOAD,
 	.pba			= 20,
-	.max_hw_frame_size	= DEFAULT_JUMBO,
+	.max_hw_frame_size	= ETH_FRAME_LEN + ETH_FCS_LEN,
 	.get_variants		= e1000_get_variants_82571,
 	.mac_ops		= &e82571_mac_ops,
 	.phy_ops		= &e82_phy_ops_bm,
--- linux-rt-2.6.31.orig/drivers/net/e1000e/e1000.h
+++ linux-rt-2.6.31/drivers/net/e1000e/e1000.h
@@ -401,6 +401,7 @@
 /* CRC Stripping defines */
 #define FLAG2_CRC_STRIPPING               (1 << 0)
 #define FLAG2_HAS_PHY_WAKEUP              (1 << 1)
+#define FLAG2_IS_DISCARDING               (1 << 2)
 
 #define E1000_RX_DESC_PS(R, i)	    \
 	(&(((union e1000_rx_desc_packet_split *)((R).desc))[i]))
--- linux-rt-2.6.31.orig/drivers/net/bonding/bond_main.c
+++ linux-rt-2.6.31/drivers/net/bonding/bond_main.c
@@ -691,7 +691,7 @@
 			       struct net_device *slave_dev, int reporting)
 {
 	const struct net_device_ops *slave_ops = slave_dev->netdev_ops;
-	static int (*ioctl)(struct net_device *, struct ifreq *, int);
+	int (*ioctl)(struct net_device *, struct ifreq *, int);
 	struct ifreq ifr;
 	struct mii_ioctl_data *mii;
 
@@ -3707,10 +3707,10 @@
 
 	if (skb->protocol == htons(ETH_P_IP)) {
 		return ((ntohl(iph->saddr ^ iph->daddr) & 0xffff) ^
-			(data->h_dest[5] ^ bond_dev->dev_addr[5])) % count;
+			(data->h_dest[5] ^ data->h_source[5])) % count;
 	}
 
-	return (data->h_dest[5] ^ bond_dev->dev_addr[5]) % count;
+	return (data->h_dest[5] ^ data->h_source[5]) % count;
 }
 
 /*
@@ -3737,7 +3737,7 @@
 
 	}
 
-	return (data->h_dest[5] ^ bond_dev->dev_addr[5]) % count;
+	return (data->h_dest[5] ^ data->h_source[5]) % count;
 }
 
 /*
@@ -3748,7 +3748,7 @@
 {
 	struct ethhdr *data = (struct ethhdr *)skb->data;
 
-	return (data->h_dest[5] ^ bond_dev->dev_addr[5]) % count;
+	return (data->h_dest[5] ^ data->h_source[5]) % count;
 }
 
 /*-------------------------- Device entry points ----------------------------*/
--- linux-rt-2.6.31.orig/drivers/virtio/virtio_ring.c
+++ linux-rt-2.6.31/drivers/virtio/virtio_ring.c
@@ -281,6 +281,9 @@
 		return NULL;
 	}
 
+	/* Only get used array entries after they have been exposed by host. */
+	rmb();
+
 	i = vq->vring.used->ring[vq->last_used_idx%vq->vring.num].id;
 	*len = vq->vring.used->ring[vq->last_used_idx%vq->vring.num].len;
 
--- linux-rt-2.6.31.orig/drivers/ps3/ps3stor_lib.c
+++ linux-rt-2.6.31/drivers/ps3/ps3stor_lib.c
@@ -23,6 +23,65 @@
 #include <asm/lv1call.h>
 #include <asm/ps3stor.h>
 
+/*
+ * A workaround for flash memory I/O errors when the internal hard disk
+ * has not been formatted for OtherOS use.  Delay disk close until flash
+ * memory is closed.
+ */
+
+static struct ps3_flash_workaround {
+	int flash_open;
+	int disk_open;
+	struct ps3_system_bus_device *disk_sbd;
+} ps3_flash_workaround;
+
+static int ps3stor_open_hv_device(struct ps3_system_bus_device *sbd)
+{
+	int error = ps3_open_hv_device(sbd);
+
+	if (error)
+		return error;
+
+	if (sbd->match_id == PS3_MATCH_ID_STOR_FLASH)
+		ps3_flash_workaround.flash_open = 1;
+
+	if (sbd->match_id == PS3_MATCH_ID_STOR_DISK)
+		ps3_flash_workaround.disk_open = 1;
+
+	return 0;
+}
+
+static int ps3stor_close_hv_device(struct ps3_system_bus_device *sbd)
+{
+	int error;
+
+	if (sbd->match_id == PS3_MATCH_ID_STOR_DISK
+		&& ps3_flash_workaround.disk_open
+		&& ps3_flash_workaround.flash_open) {
+		ps3_flash_workaround.disk_sbd = sbd;
+		return 0;
+	}
+
+	error = ps3_close_hv_device(sbd);
+
+	if (error)
+		return error;
+
+	if (sbd->match_id == PS3_MATCH_ID_STOR_DISK)
+		ps3_flash_workaround.disk_open = 0;
+
+	if (sbd->match_id == PS3_MATCH_ID_STOR_FLASH) {
+		ps3_flash_workaround.flash_open = 0;
+
+		if (ps3_flash_workaround.disk_sbd) {
+			ps3_close_hv_device(ps3_flash_workaround.disk_sbd);
+			ps3_flash_workaround.disk_open = 0;
+			ps3_flash_workaround.disk_sbd = NULL;
+		}
+	}
+
+	return 0;
+}
 
 static int ps3stor_probe_access(struct ps3_storage_device *dev)
 {
@@ -90,7 +149,7 @@
 	int error, res, alignment;
 	enum ps3_dma_page_size page_size;
 
-	error = ps3_open_hv_device(&dev->sbd);
+	error = ps3stor_open_hv_device(&dev->sbd);
 	if (error) {
 		dev_err(&dev->sbd.core,
 			"%s:%u: ps3_open_hv_device failed %d\n", __func__,
@@ -166,7 +225,7 @@
 fail_sb_event_receive_port_destroy:
 	ps3_sb_event_receive_port_destroy(&dev->sbd, dev->irq);
 fail_close_device:
-	ps3_close_hv_device(&dev->sbd);
+	ps3stor_close_hv_device(&dev->sbd);
 fail:
 	return error;
 }
@@ -193,7 +252,7 @@
 			"%s:%u: destroy event receive port failed %d\n",
 			__func__, __LINE__, error);
 
-	error = ps3_close_hv_device(&dev->sbd);
+	error = ps3stor_close_hv_device(&dev->sbd);
 	if (error)
 		dev_err(&dev->sbd.core,
 			"%s:%u: ps3_close_hv_device failed %d\n", __func__,
--- linux-rt-2.6.31.orig/drivers/mmc/host/pxamci.c
+++ linux-rt-2.6.31/drivers/mmc/host/pxamci.c
@@ -694,14 +694,14 @@
 	if (mmc) {
 		struct pxamci_host *host = mmc_priv(mmc);
 
+		mmc_remove_host(mmc);
+
 		if (host->vcc)
 			regulator_put(host->vcc);
 
 		if (host->pdata && host->pdata->exit)
 			host->pdata->exit(&pdev->dev, mmc);
 
-		mmc_remove_host(mmc);
-
 		pxamci_stop_clock(host);
 		writel(TXFIFO_WR_REQ|RXFIFO_RD_REQ|CLK_IS_OFF|STOP_CMD|
 		       END_CMD_RES|PRG_DONE|DATA_TRAN_DONE,
--- linux-rt-2.6.31.orig/drivers/mmc/core/sd.c
+++ linux-rt-2.6.31/drivers/mmc/core/sd.c
@@ -210,11 +210,11 @@
 
 	err = mmc_sd_switch(card, 0, 0, 1, status);
 	if (err) {
-		/*
-		 * We all hosts that cannot perform the command
-		 * to fail more gracefully
-		 */
-		if (err != -EINVAL)
+		/* If the host or the card can't do the switch,
+		 * fail more gracefully. */
+		if ((err != -EINVAL)
+		 && (err != -ENOSYS)
+		 && (err != -EFAULT))
 			goto out;
 
 		printk(KERN_WARNING "%s: problem reading switch "
--- linux-rt-2.6.31.orig/drivers/mmc/core/mmc.c
+++ linux-rt-2.6.31/drivers/mmc/core/mmc.c
@@ -180,11 +180,11 @@
 
 	err = mmc_send_ext_csd(card, ext_csd);
 	if (err) {
-		/*
-		 * We all hosts that cannot perform the command
-		 * to fail more gracefully
-		 */
-		if (err != -EINVAL)
+		/* If the host or the card can't do the switch,
+		 * fail more gracefully. */
+		if ((err != -EINVAL)
+		 && (err != -ENOSYS)
+		 && (err != -EFAULT))
 			goto out;
 
 		/*
--- linux-rt-2.6.31.orig/drivers/mmc/card/block.c
+++ linux-rt-2.6.31/drivers/mmc/card/block.c
@@ -88,6 +88,12 @@
 		int devidx = MINOR(disk_devt(md->disk)) >> MMC_SHIFT;
 		__clear_bit(devidx, dev_use);
 
+		/*
+		 * We are about to drop the last reference to the disk object.
+		 * Nothing else should now be looking at the queue pointer, so
+		 * now it won't hurt if we release it.
+		 */
+		blk_cleanup_queue(md->disk->queue);
 		put_disk(md->disk);
 		kfree(md);
 	}
--- linux-rt-2.6.31.orig/drivers/mmc/card/queue.c
+++ linux-rt-2.6.31/drivers/mmc/card/queue.c
@@ -245,7 +245,12 @@
 		kfree(mq->bounce_buf);
 	mq->bounce_buf = NULL;
 
-	blk_cleanup_queue(mq->queue);
+	/*
+	 * Calling blk_cleanup_queue() would be too soon here. As long as
+	 * the gendisk has a reference to it and is not released we should
+	 * keep the queue. It has been shutdown and will not accept any new
+	 * requests, so that should be safe.
+	 */
 
 	mq->card = NULL;
 }
--- linux-rt-2.6.31.orig/drivers/acpi/sleep.c
+++ linux-rt-2.6.31/drivers/acpi/sleep.c
@@ -405,6 +405,46 @@
 		},
 	},
 	{
+	.callback = init_set_sci_en_on_resume,
+	.ident = "Hewlett-Packard HP Pavilion dv3 Notebook PC",
+	.matches = {
+		DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+		DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv3 Notebook PC"),
+		},
+	},
+	{
+	.callback = init_set_sci_en_on_resume,
+	.ident = "Hewlett-Packard Pavilion dv4",
+	.matches = {
+		DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+		DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv4"),
+		},
+	},
+	{
+	.callback = init_set_sci_en_on_resume,
+	.ident = "Hewlett-Packard Pavilion dv7",
+	.matches = {
+		DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+		DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv7"),
+		},
+	},
+	{
+	.callback = init_set_sci_en_on_resume,
+	.ident = "Hewlett-Packard Compaq Presario C700 Notebook PC",
+	.matches = {
+		DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+		DMI_MATCH(DMI_PRODUCT_NAME, "Compaq Presario C700 Notebook PC"),
+		},
+	},
+	{
+	.callback = init_set_sci_en_on_resume,
+	.ident = "Hewlett-Packard Compaq Presario CQ40 Notebook PC",
+	.matches = {
+		DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+		DMI_MATCH(DMI_PRODUCT_NAME, "Compaq Presario CQ40 Notebook PC"),
+		},
+	},
+	{
 	.callback = init_old_suspend_ordering,
 	.ident = "Panasonic CF51-2L",
 	.matches = {
--- linux-rt-2.6.31.orig/drivers/acpi/ac.c
+++ linux-rt-2.6.31/drivers/acpi/ac.c
@@ -243,6 +243,7 @@
 		acpi_bus_generate_netlink_event(device->pnp.device_class,
 						  dev_name(&device->dev), event,
 						  (u32) ac->state);
+		acpi_notifier_call_chain(device, event, (u32) ac->state);
 #ifdef CONFIG_ACPI_SYSFS_POWER
 		kobject_uevent(&ac->charger.dev->kobj, KOBJ_CHANGE);
 #endif
--- linux-rt-2.6.31.orig/drivers/acpi/pci_slot.c
+++ linux-rt-2.6.31/drivers/acpi/pci_slot.c
@@ -57,7 +57,7 @@
 				MY_NAME , ## arg);		\
 	} while (0)
 
-#define SLOT_NAME_SIZE 20		/* Inspired by #define in acpiphp.h */
+#define SLOT_NAME_SIZE 21		/* Inspired by #define in acpiphp.h */
 
 struct acpi_pci_slot {
 	acpi_handle root_handle;	/* handle of the root bridge */
@@ -149,7 +149,7 @@
 		return AE_OK;
 	}
 
-	snprintf(name, sizeof(name), "%u", (u32)sun);
+	snprintf(name, sizeof(name), "%llu", sun);
 	pci_slot = pci_create_slot(pci_bus, device, name, NULL);
 	if (IS_ERR(pci_slot)) {
 		err("pci_create_slot returned %ld\n", PTR_ERR(pci_slot));
--- linux-rt-2.6.31.orig/drivers/acpi/video.c
+++ linux-rt-2.6.31/drivers/acpi/video.c
@@ -603,6 +603,7 @@
 					unsigned long long *level)
 {
 	acpi_status status = AE_OK;
+	int i;
 
 	if (device->cap._BQC || device->cap._BCQ) {
 		char *buf = device->cap._BQC ? "_BQC" : "_BCQ";
@@ -618,8 +619,15 @@
 
 			}
 			*level += bqc_offset_aml_bug_workaround;
-			device->brightness->curr = *level;
-			return 0;
+			for (i = 2; i < device->brightness->count; i++)
+				if (device->brightness->levels[i] == *level) {
+					device->brightness->curr = *level;
+					return 0;
+			}
+			/* BQC returned an invalid level. Stop using it.  */
+			ACPI_WARNING((AE_INFO, "%s returned an invalid level",
+						buf));
+			device->cap._BQC = device->cap._BCQ = 0;
 		} else {
 			/* Fixme:
 			 * should we return an error or ignore this failure?
@@ -870,7 +878,7 @@
 	br->flags._BCM_use_index = br->flags._BCL_use_index;
 
 	/* _BQC uses INDEX while _BCL uses VALUE in some laptops */
-	br->curr = level_old = max_level;
+	br->curr = level = max_level;
 
 	if (!device->cap._BQC)
 		goto set_level;
@@ -892,15 +900,25 @@
 
 	br->flags._BQC_use_index = (level == max_level ? 0 : 1);
 
-	if (!br->flags._BQC_use_index)
+	if (!br->flags._BQC_use_index) {
+		/*
+		 * Set the backlight to the initial state.
+		 * On some buggy laptops, _BQC returns an uninitialized value
+		 * when invoked for the first time, i.e. level_old is invalid.
+		 * set the backlight to max_level in this case
+		 */
+		for (i = 2; i < br->count; i++)
+			if (level_old == br->levels[i])
+				level = level_old;
 		goto set_level;
+	}
 
 	if (br->flags._BCL_reversed)
 		level_old = (br->count - 1) - level_old;
-	level_old = br->levels[level_old];
+	level = br->levels[level_old];
 
 set_level:
-	result = acpi_video_device_lcd_set_level(device, level_old);
+	result = acpi_video_device_lcd_set_level(device, level);
 	if (result)
 		goto out_free_levels;
 
@@ -1083,7 +1101,12 @@
 	 */
 
 	/* Does this device support video switching? */
-	if (video->cap._DOS) {
+	if (video->cap._DOS || video->cap._DOD) {
+		if (!video->cap._DOS) {
+			printk(KERN_WARNING FW_BUG
+				"ACPI(%s) defines _DOD but not _DOS\n",
+				acpi_device_bid(video->device));
+		}
 		video->flags.multihead = 1;
 		status = 0;
 	}
--- linux-rt-2.6.31.orig/drivers/acpi/scan.c
+++ linux-rt-2.6.31/drivers/acpi/scan.c
@@ -1264,16 +1264,6 @@
 	acpi_device_set_id(device, parent, handle, type);
 
 	/*
-	 * The ACPI device is attached to acpi handle before getting
-	 * the power/wakeup/peformance flags. Otherwise OS can't get
-	 * the corresponding ACPI device by the acpi handle in the course
-	 * of getting the power/wakeup/performance flags.
-	 */
-	result = acpi_device_set_context(device, type);
-	if (result)
-		goto end;
-
-	/*
 	 * Power Management
 	 * ----------------
 	 */
@@ -1303,6 +1293,8 @@
 			goto end;
 	}
 
+	if ((result = acpi_device_set_context(device, type)))
+		goto end;
 
 	result = acpi_device_register(device, parent);
 
--- linux-rt-2.6.31.orig/drivers/acpi/processor_idle.c
+++ linux-rt-2.6.31/drivers/acpi/processor_idle.c
@@ -104,6 +104,12 @@
 /* Actually this shouldn't be __cpuinitdata, would be better to fix the
    callers to only run once -AK */
 static struct dmi_system_id __cpuinitdata processor_power_dmi_table[] = {
+	{ set_max_cstate, "IBM ThinkPad R40e", {
+	  DMI_MATCH(DMI_BIOS_VENDOR,"IBM"),
+	  DMI_MATCH(DMI_BIOS_VERSION,"1SET")}, (void *)1},
+	{ set_max_cstate, "Medion 41700", {
+	  DMI_MATCH(DMI_BIOS_VENDOR,"Phoenix Technologies LTD"),
+	  DMI_MATCH(DMI_BIOS_VERSION,"R01-A1J")}, (void *)1},
 	{ set_max_cstate, "Clevo 5600D", {
 	  DMI_MATCH(DMI_BIOS_VENDOR,"Phoenix Technologies LTD"),
 	  DMI_MATCH(DMI_BIOS_VERSION,"SHE845M0.86C.0013.D.0302131307")},
@@ -297,6 +303,17 @@
 	pr->power.states[ACPI_STATE_C2].latency = acpi_gbl_FADT.C2latency;
 	pr->power.states[ACPI_STATE_C3].latency = acpi_gbl_FADT.C3latency;
 
+	/*
+	 * FADT specified C2 latency must be less than or equal to
+	 * 100 microseconds.
+	 */
+	if (acpi_gbl_FADT.C2latency > ACPI_PROCESSOR_MAX_C2_LATENCY) {
+		ACPI_DEBUG_PRINT((ACPI_DB_INFO,
+			"C2 latency too large [%d]\n", acpi_gbl_FADT.C2latency));
+		/* invalidate C2 */
+		pr->power.states[ACPI_STATE_C2].address = 0;
+	}
+
 	ACPI_DEBUG_PRINT((ACPI_DB_INFO,
 			  "lvl2[0x%08x] lvl3[0x%08x]\n",
 			  pr->power.states[ACPI_STATE_C2].address,
@@ -493,16 +510,6 @@
 		return;
 
 	/*
-	 * C2 latency must be less than or equal to 100
-	 * microseconds.
-	 */
-	else if (cx->latency > ACPI_PROCESSOR_MAX_C2_LATENCY) {
-		ACPI_DEBUG_PRINT((ACPI_DB_INFO,
-				  "latency too large [%d]\n", cx->latency));
-		return;
-	}
-
-	/*
 	 * Otherwise we've met all of our C2 requirements.
 	 * Normalize the C2 latency to expidite policy
 	 */
--- linux-rt-2.6.31.orig/drivers/acpi/pci_root.c
+++ linux-rt-2.6.31/drivers/acpi/pci_root.c
@@ -400,6 +400,17 @@
 
 		pbus = pdev->subordinate;
 		pci_dev_put(pdev);
+
+		/*
+		 * This function may be called for a non-PCI device that has a
+		 * PCI parent (eg. a disk under a PCI SATA controller).  In that
+		 * case pdev->subordinate will be NULL for the parent.
+		 */
+		if (!pbus) {
+			dev_dbg(&pdev->dev, "Not a PCI-to-PCI bridge\n");
+			pdev = NULL;
+			break;
+		}
 	}
 out:
 	list_for_each_entry_safe(node, tmp, &device_list, node)
--- linux-rt-2.6.31.orig/drivers/acpi/video_detect.c
+++ linux-rt-2.6.31/drivers/acpi/video_detect.c
@@ -82,7 +82,7 @@
 		return 0;
 
 	/* Does this device able to support video switching ? */
-	if (ACPI_SUCCESS(acpi_get_handle(device->handle, "_DOD", &h_dummy)) &&
+	if (ACPI_SUCCESS(acpi_get_handle(device->handle, "_DOD", &h_dummy)) ||
 	    ACPI_SUCCESS(acpi_get_handle(device->handle, "_DOS", &h_dummy)))
 		video_caps |= ACPI_VIDEO_OUTPUT_SWITCHING;
 
--- linux-rt-2.6.31.orig/drivers/acpi/osl.c
+++ linux-rt-2.6.31/drivers/acpi/osl.c
@@ -1182,7 +1182,13 @@
 			       res_list_elem->name,
 			       (long long) res_list_elem->start,
 			       (long long) res_list_elem->end);
-			printk(KERN_INFO "ACPI: Device needs an ACPI driver\n");
+			if (acpi_enforce_resources == ENFORCE_RESOURCES_LAX)
+				printk(KERN_NOTICE "ACPI: This conflict may"
+				       " cause random problems and system"
+				       " instability\n");
+			printk(KERN_INFO "ACPI: If an ACPI driver is available"
+			       " for this device, you should use it instead of"
+			       " the native driver\n");
 		}
 		if (acpi_enforce_resources == ENFORCE_RESOURCES_STRICT)
 			return -EBUSY;
--- linux-rt-2.6.31.orig/drivers/mtd/ofpart.c
+++ linux-rt-2.6.31/drivers/mtd/ofpart.c
@@ -46,21 +46,12 @@
 		const u32 *reg;
 		int len;
 
-		/* check if this is a partition node */
-		partname = of_get_property(pp, "name", &len);
-		if (strcmp(partname, "partition") != 0) {
+		reg = of_get_property(pp, "reg", &len);
+		if (!reg) {
 			nr_parts--;
 			continue;
 		}
 
-		reg = of_get_property(pp, "reg", &len);
-		if (!reg || (len != 2 * sizeof(u32))) {
-			of_node_put(pp);
-			dev_err(dev, "Invalid 'reg' on %s\n", node->full_name);
-			kfree(*pparts);
-			*pparts = NULL;
-			return -EINVAL;
-		}
 		(*pparts)[i].offset = reg[0];
 		(*pparts)[i].size = reg[1];
 
@@ -75,6 +66,14 @@
 		i++;
 	}
 
+	if (!i) {
+		of_node_put(pp);
+		dev_err(dev, "No valid partition found on %s\n", node->full_name);
+		kfree(*pparts);
+		*pparts = NULL;
+		return -EINVAL;
+	}
+
 	return nr_parts;
 }
 EXPORT_SYMBOL(of_mtd_parse_partitions);
--- linux-rt-2.6.31.orig/drivers/mtd/chips/cfi_util.c
+++ linux-rt-2.6.31/drivers/mtd/chips/cfi_util.c
@@ -81,6 +81,10 @@
 {
 	cfi_send_gen_cmd(0xF0, 0, base, map, cfi, cfi->device_type, NULL);
 	cfi_send_gen_cmd(0xFF, 0, base, map, cfi, cfi->device_type, NULL);
+	/* M29W128G flashes require an additional reset command
+	   when exit qry mode */
+	if ((cfi->mfr == CFI_MFR_ST) && (cfi->id == 0x227E || cfi->id == 0x7E))
+		cfi_send_gen_cmd(0xF0, 0, base, map, cfi, cfi->device_type, NULL);
 }
 EXPORT_SYMBOL_GPL(cfi_qry_mode_off);
 
--- linux-rt-2.6.31.orig/drivers/mtd/chips/cfi_cmdset_0002.c
+++ linux-rt-2.6.31/drivers/mtd/chips/cfi_cmdset_0002.c
@@ -282,16 +282,6 @@
 	}
 }
 
-static void fixup_M29W128G_write_buffer(struct mtd_info *mtd, void *param)
-{
-	struct map_info *map = mtd->priv;
-	struct cfi_private *cfi = map->fldrv_priv;
-	if (cfi->cfiq->BufWriteTimeoutTyp) {
-		pr_warning("Don't use write buffer on ST flash M29W128G\n");
-		cfi->cfiq->BufWriteTimeoutTyp = 0;
-	}
-}
-
 static struct cfi_fixup cfi_fixup_table[] = {
 	{ CFI_MFR_ATMEL, CFI_ID_ANY, fixup_convert_atmel_pri, NULL },
 #ifdef AMD_BOOTLOC_BUG
@@ -308,7 +298,6 @@
 	{ CFI_MFR_AMD, 0x1301, fixup_s29gl064n_sectors, NULL, },
 	{ CFI_MFR_AMD, 0x1a00, fixup_s29gl032n_sectors, NULL, },
 	{ CFI_MFR_AMD, 0x1a01, fixup_s29gl032n_sectors, NULL, },
-	{ CFI_MFR_ST,  0x227E, fixup_M29W128G_write_buffer, NULL, },
 #if !FORCE_WORD_WRITE
 	{ CFI_MFR_ANY, CFI_ID_ANY, fixup_use_write_buffers, NULL, },
 #endif
--- linux-rt-2.6.31.orig/drivers/mtd/nand/ndfc.c
+++ linux-rt-2.6.31/drivers/mtd/nand/ndfc.c
@@ -102,8 +102,8 @@
 	wmb();
 	ecc = in_be32(ndfc->ndfcbase + NDFC_ECC);
 	/* The NDFC uses Smart Media (SMC) bytes order */
-	ecc_code[0] = p[2];
-	ecc_code[1] = p[1];
+	ecc_code[0] = p[1];
+	ecc_code[1] = p[2];
 	ecc_code[2] = p[3];
 
 	return 0;
--- linux-rt-2.6.31.orig/drivers/crypto/padlock-aes.c
+++ linux-rt-2.6.31/drivers/crypto/padlock-aes.c
@@ -236,7 +236,7 @@
 	/* Padlock in ECB mode fetches at least ecb_fetch_bytes of data.
 	 * We could avoid some copying here but it's probably not worth it.
 	 */
-	if (unlikely(((unsigned long)in & PAGE_SIZE) + ecb_fetch_bytes > PAGE_SIZE)) {
+	if (unlikely(((unsigned long)in & ~PAGE_MASK) + ecb_fetch_bytes > PAGE_SIZE)) {
 		ecb_crypt_copy(in, out, key, cword, count);
 		return;
 	}
@@ -248,7 +248,7 @@
 			    u8 *iv, struct cword *cword, int count)
 {
 	/* Padlock in CBC mode fetches at least cbc_fetch_bytes of data. */
-	if (unlikely(((unsigned long)in & PAGE_SIZE) + cbc_fetch_bytes > PAGE_SIZE))
+	if (unlikely(((unsigned long)in & ~PAGE_MASK) + cbc_fetch_bytes > PAGE_SIZE))
 		return cbc_crypt_copy(in, out, key, iv, cword, count);
 
 	return rep_xcrypt_cbc(in, out, key, iv, cword, count);
--- linux-rt-2.6.31.orig/drivers/pps/kapi.c
+++ linux-rt-2.6.31/drivers/pps/kapi.c
@@ -271,6 +271,7 @@
 {
 	struct pps_device *pps;
 	unsigned long flags;
+	int captured = 0;
 
 	if ((event & (PPS_CAPTUREASSERT | PPS_CAPTURECLEAR)) == 0) {
 		printk(KERN_ERR "pps: unknown event (%x) for source %d\n",
@@ -293,7 +294,8 @@
 
 	/* Check the event */
 	pps->current_mode = pps->params.mode;
-	if (event & PPS_CAPTUREASSERT) {
+	if ((event & PPS_CAPTUREASSERT) &
+			(pps->params.mode & PPS_CAPTUREASSERT)) {
 		/* We have to add an offset? */
 		if (pps->params.mode & PPS_OFFSETASSERT)
 			pps_add_offset(ts, &pps->params.assert_off_tu);
@@ -303,8 +305,11 @@
 		pps->assert_sequence++;
 		pr_debug("capture assert seq #%u for source %d\n",
 			pps->assert_sequence, source);
+
+		captured = ~0;
 	}
-	if (event & PPS_CAPTURECLEAR) {
+	if ((event & PPS_CAPTURECLEAR) &
+			(pps->params.mode & PPS_CAPTURECLEAR)) {
 		/* We have to add an offset? */
 		if (pps->params.mode & PPS_OFFSETCLEAR)
 			pps_add_offset(ts, &pps->params.clear_off_tu);
@@ -314,12 +319,17 @@
 		pps->clear_sequence++;
 		pr_debug("capture clear seq #%u for source %d\n",
 			pps->clear_sequence, source);
+
+		captured = ~0;
 	}
 
-	pps->go = ~0;
-	wake_up_interruptible(&pps->queue);
+	/* Wake up iif captured somthing */
+	if (captured) {
+		pps->go = ~0;
+		wake_up_interruptible(&pps->queue);
 
-	kill_fasync(&pps->async_queue, SIGIO, POLL_IN);
+		kill_fasync(&pps->async_queue, SIGIO, POLL_IN);
+	}
 
 	spin_unlock_irqrestore(&pps->lock, flags);
 
--- linux-rt-2.6.31.orig/drivers/pps/pps.c
+++ linux-rt-2.6.31/drivers/pps/pps.c
@@ -71,9 +71,14 @@
 	case PPS_GETPARAMS:
 		pr_debug("PPS_GETPARAMS: source %d\n", pps->id);
 
-		/* Return current parameters */
-		err = copy_to_user(uarg, &pps->params,
-						sizeof(struct pps_kparams));
+		spin_lock_irq(&pps->lock);
+
+		/* Get the current parameters */
+		params = pps->params;
+
+		spin_unlock_irq(&pps->lock);
+
+		err = copy_to_user(uarg, &params, sizeof(struct pps_kparams));
 		if (err)
 			return -EFAULT;
 
--- linux-rt-2.6.31.orig/drivers/input/input.c
+++ linux-rt-2.6.31/drivers/input/input.c
@@ -88,19 +88,26 @@
  */
 static void input_pass_event(struct input_dev *dev,
 			     unsigned int type, unsigned int code, int value)
-{
-	struct input_handle *handle;
+
+{	struct input_handle *handle;
 
 	rcu_read_lock();
 
 	handle = rcu_dereference(dev->grab);
-	if (handle)
+	if (handle) {
 		handle->handler->event(handle, type, code, value);
-	else
-		list_for_each_entry_rcu(handle, &dev->h_list, d_node)
-			if (handle->open)
-				handle->handler->event(handle,
-							type, code, value);
+		goto out;
+	}
+
+	handle = rcu_dereference(dev->filter);
+	if (handle && handle->handler->filter(handle, type, code, value))
+		goto out;
+
+	list_for_each_entry_rcu(handle, &dev->h_list, d_node)
+		if (handle->open)
+			handle->handler->event(handle,
+					       type, code, value);
+out:
 	rcu_read_unlock();
 }
 
@@ -375,12 +382,15 @@
 }
 EXPORT_SYMBOL(input_grab_device);
 
-static void __input_release_device(struct input_handle *handle)
+static void __input_release_device(struct input_handle *handle, bool filter)
 {
 	struct input_dev *dev = handle->dev;
 
-	if (dev->grab == handle) {
-		rcu_assign_pointer(dev->grab, NULL);
+	if (handle == (filter ? dev->filter : dev->grab)) {
+		if (filter)
+			rcu_assign_pointer(dev->filter, NULL);
+		else
+			rcu_assign_pointer(dev->grab, NULL);
 		/* Make sure input_pass_event() notices that grab is gone */
 		synchronize_rcu();
 
@@ -404,12 +414,65 @@
 	struct input_dev *dev = handle->dev;
 
 	mutex_lock(&dev->mutex);
-	__input_release_device(handle);
+	__input_release_device(handle, false);
 	mutex_unlock(&dev->mutex);
 }
 EXPORT_SYMBOL(input_release_device);
 
 /**
+ * input_filter_device - allow input events to be filtered from higher layers
+ * @handle: input handle that wants to filter the device
+ *
+ * When a device is filtered by an input handle all events generated by
+ * the device are to this handle. If the filter function returns true then
+ * the event is discarded rather than being passed to any other input handles,
+ * otherwise it is passed to them as normal. Grabs will be handled before
+ * filters, so a grabbed device will not deliver events to a filter function.
+ */
+int input_filter_device(struct input_handle *handle)
+{
+	struct input_dev *dev = handle->dev;
+	int retval;
+
+	retval = mutex_lock_interruptible(&dev->mutex);
+	if (retval)
+		return retval;
+
+	if (dev->filter) {
+		retval = -EBUSY;
+		goto out;
+	}
+
+	rcu_assign_pointer(dev->filter, handle);
+	synchronize_rcu();
+
+ out:
+	mutex_unlock(&dev->mutex);
+	return retval;
+}
+EXPORT_SYMBOL(input_filter_device);
+
+/**
+ * input_unfilter_device - removes a filter from a device
+ * @handle: input handle that owns the device
+ *
+ * Removes the filter from a device so that other input handles can
+ * start receiving unfiltered input events. Upon release all handlers
+ * attached to the device have their start() method called so they
+ * have a change to synchronize device state with the rest of the
+ * system.
+ */
+void input_unfilter_device(struct input_handle *handle)
+{
+	struct input_dev *dev = handle->dev;
+
+	mutex_lock(&dev->mutex);
+	__input_release_device(handle, true);
+	mutex_unlock(&dev->mutex);
+}
+EXPORT_SYMBOL(input_unfilter_device);
+
+/**
  * input_open_device - open input device
  * @handle: handle through which device is being accessed
  *
@@ -482,7 +545,9 @@
 
 	mutex_lock(&dev->mutex);
 
-	__input_release_device(handle);
+	/* Release both grabs and filters */
+	__input_release_device(handle, false);
+	__input_release_device(handle, true);
 
 	if (!--dev->users && dev->close)
 		dev->close(dev);
--- linux-rt-2.6.31.orig/drivers/input/keyboard/atkbd.c
+++ linux-rt-2.6.31/drivers/input/keyboard/atkbd.c
@@ -857,6 +857,14 @@
 };
 
 /*
+ * Dell Studio 1557 does not generate release keys for
+ * mute, volume up, & volume down
+ */
+static unsigned int atkdb_dell_studio_1157_force_relase_keys[] = {
+	0xa0, 0xae, 0xb0, -1U
+};
+
+/*
  * Perform fixup for HP system that doesn't generate release
  * for its video switch
  */
@@ -910,6 +918,13 @@
 };
 
 /*
+ * Amilo Si 1848 key release for Fn+Volume keys not working
+ */
+static unsigned int atkbd_amilo_si1848_forced_release_keys[] = {
+	0xa0, 0xae, 0xb0, -1U
+};
+
+/*
  * Amilo Xi 3650 key release for light touch bar not working
  */
 static unsigned int atkbd_amilo_xi3650_forced_release_keys[] = {
@@ -917,6 +932,14 @@
 };
 
 /*
+ * Fujitsu Siemens system with broken key release on volume keys and mute key
+ */
+
+static unsigned int atkbd_amilo_xi_2428_forced_release_keys[] = {
+	0xa0, 0xae, 0xb0, -1U
+};
+
+/*
  * Soltech TA12 system with broken key release on volume keys and mute key
  */
 static unsigned int atkdb_soltech_ta12_forced_release_keys[] = {
@@ -1527,6 +1550,15 @@
 		.driver_data = atkbd_dell_laptop_forced_release_keys,
 	},
 	{
+		.ident = "Dell Stuido 1557",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Studio 1557"),
+		},
+		.callback = atkbd_setup_forced_release,
+		.driver_data = atkdb_dell_studio_1157_force_relase_keys,
+	},
+	{
 		.ident = "HP 2133",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
@@ -1608,6 +1640,24 @@
 		.driver_data = atkbd_samsung_forced_release_keys,
 	},
 	{
+		.ident = "Samsung Q210/P210",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Q210/P210"),
+		},
+		.callback = atkbd_setup_forced_release,
+		.driver_data = atkbd_samsung_forced_release_keys,
+	},
+	{
+		.ident = "Samsung R59P/R60P/R61P",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "R59P/R60P/R61P"),
+		},
+		.callback = atkbd_setup_forced_release,
+		.driver_data = atkbd_samsung_forced_release_keys,
+	},
+	{
 		.ident = "Fujitsu Amilo PA 1510",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
@@ -1617,6 +1667,15 @@
 		.driver_data = atkbd_amilo_pa1510_forced_release_keys,
 	},
 	{
+		.ident = "Fujitsu Amilo Si 1848+u",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "AMILO Si 1848+u"),
+		},
+		.callback = atkbd_setup_forced_release,
+		.driver_data = atkbd_amilo_si1848_forced_release_keys,
+	},
+	{
 		.ident = "Fujitsu Amilo Pi 3525",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
@@ -1635,6 +1694,43 @@
 		.driver_data = atkbd_amilo_xi3650_forced_release_keys,
 	},
 	{
+		.ident = "Znote 6615WD",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Zepto"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Znote 6615WD"),
+		},
+		.callback = atkbd_setup_forced_release,
+		.driver_data = atkbd_inventec_forced_release_keys,
+	},
+	{
+		.ident = "Znote 6625WD",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Zepto"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Znote"),
+			DMI_MATCH(DMI_PRODUCT_VERSION, "6625WD"),
+		},
+		.callback = atkbd_setup_forced_release,
+		.driver_data = atkbd_inventec_forced_release_keys,
+	},
+	{
+		.ident = "AMILO Xi 2428",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "AMILO Xi 2428"),
+		},
+		.callback = atkbd_setup_forced_release,
+		.driver_data = atkbd_amilo_xi_2428_forced_release_keys,
+	},
+	{
+		.ident = "Soltech Corporation TA12",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Soltech Corporation"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "TA12"),
+		},
+		.callback = atkbd_setup_forced_release,
+		.driver_data = atkdb_soltech_ta12_forced_release_keys,
+	},
+	{
 		.ident = "Soltech Corporation TA12",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Soltech Corporation"),
--- linux-rt-2.6.31.orig/drivers/input/serio/i8042.c
+++ linux-rt-2.6.31/drivers/input/serio/i8042.c
@@ -83,6 +83,8 @@
 MODULE_PARM_DESC(debug, "Turn i8042 debugging mode on and off");
 #endif
 
+static bool i8042_bypass_aux_irq_test;
+
 #include "i8042.h"
 
 static DEFINE_SPINLOCK(i8042_lock);
@@ -641,7 +643,7 @@
  * used it for a PCI card or somethig else.
  */
 
-	if (i8042_noloop || aux_loop_broken) {
+	if (i8042_noloop || i8042_bypass_aux_irq_test || aux_loop_broken) {
 /*
  * Without LOOP command we can't test AUX IRQ delivery. Assume the port
  * is working and hope we are right.
--- linux-rt-2.6.31.orig/drivers/input/serio/i8042-x86ia64io.h
+++ linux-rt-2.6.31/drivers/input/serio/i8042-x86ia64io.h
@@ -457,6 +457,34 @@
 	},
 	{ }
 };
+
+static struct dmi_system_id __initdata i8042_dmi_laptop_table[] = {
+	{
+		.ident = "Portable",
+		.matches = {
+			DMI_MATCH(DMI_CHASSIS_TYPE, "8"), /* Portable */
+		},
+	},
+	{
+		.ident = "Laptop",
+		.matches = {
+			DMI_MATCH(DMI_CHASSIS_TYPE, "9"), /* Laptop */
+		},
+	},
+	{
+		.ident = "Notebook",
+		.matches = {
+			DMI_MATCH(DMI_CHASSIS_TYPE, "10"), /* Notebook */
+		},
+	},
+	{
+		.ident = "Sub-Notebook",
+		.matches = {
+			DMI_MATCH(DMI_CHASSIS_TYPE, "14"), /* Sub-Notebook */
+		},
+	},
+	{ }
+};
 #endif
 
 /*
@@ -735,6 +763,11 @@
 	i8042_kbd_irq = i8042_pnp_kbd_irq;
 	i8042_aux_irq = i8042_pnp_aux_irq;
 
+#ifdef CONFIG_X86
+	i8042_bypass_aux_irq_test = !pnp_data_busted &&
+				    dmi_check_system(i8042_dmi_laptop_table);
+#endif
+
 	return 0;
 }
 
--- linux-rt-2.6.31.orig/drivers/input/mouse/synaptics.c
+++ linux-rt-2.6.31/drivers/input/mouse/synaptics.c
@@ -652,6 +652,16 @@
 			DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "PORTEGE M300"),
 		},
+
+	},
+	{
+		.ident = "Toshiba Portege M300",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Portable PC"),
+			DMI_MATCH(DMI_PRODUCT_VERSION, "Version 1.0"),
+		},
+
 	},
 	{ }
 };
--- linux-rt-2.6.31.orig/drivers/input/mouse/alps.c
+++ linux-rt-2.6.31/drivers/input/mouse/alps.c
@@ -5,6 +5,7 @@
  * Copyright (c) 2003-2005 Peter Osterlund <petero2@telia.com>
  * Copyright (c) 2004 Dmitry Torokhov <dtor@mail.ru>
  * Copyright (c) 2005 Vojtech Pavlik <vojtech@suse.cz>
+ * Copyright (c) 2009 Sebastian Kapfer <sebastian_kapfer@gmx.net>
  *
  * ALPS detection, tap switching and status querying info is taken from
  * tpconfig utility (by C. Scott Ananian and Bruce Kall).
@@ -35,6 +36,8 @@
 #define ALPS_OLDPROTO	0x10
 #define ALPS_PASS	0x20
 #define ALPS_FW_BK_2	0x40
+#define ALPS_PS2_INTERLEAVED	0x80	/* 3-byte PS/2 packet interleaved with
+					   6-byte ALPS packet */
 
 static const struct alps_model_info alps_model_data[] = {
 	{ { 0x32, 0x02, 0x14 },	0xf8, 0xf8, ALPS_PASS | ALPS_DUALPOINT }, /* Toshiba Salellite Pro M10 */
@@ -55,7 +58,9 @@
 	{ { 0x20, 0x02, 0x0e },	0xf8, 0xf8, ALPS_PASS | ALPS_DUALPOINT }, /* XXX */
 	{ { 0x22, 0x02, 0x0a },	0xf8, 0xf8, ALPS_PASS | ALPS_DUALPOINT },
 	{ { 0x22, 0x02, 0x14 }, 0xff, 0xff, ALPS_PASS | ALPS_DUALPOINT }, /* Dell Latitude D600 */
-	{ { 0x62, 0x02, 0x14 }, 0xcf, 0xcf, ALPS_PASS | ALPS_DUALPOINT }, /* Dell Latitude E6500 */
+	/* Dell Latitude E5500, E6400, E6500, Precision M4400 */
+	{ { 0x62, 0x02, 0x14 }, 0xcf, 0xcf,
+		ALPS_PASS | ALPS_DUALPOINT | ALPS_PS2_INTERLEAVED },
 	{ { 0x73, 0x02, 0x50 }, 0xcf, 0xcf, ALPS_FW_BK_1 },		  /* Dell Vostro 1400 */
 };
 
@@ -66,20 +71,88 @@
  */
 
 /*
- * ALPS abolute Mode - new format
+ * PS/2 packet format
+ *
+ * byte 0:  0    0 YSGN XSGN    1    M    R    L
+ * byte 1: X7   X6   X5   X4   X3   X2   X1   X0
+ * byte 2: Y7   Y6   Y5   Y4   Y3   Y2   Y1   Y0
+ *
+ * Note that the device never signals overflow condition.
+ *
+ * ALPS absolute Mode - new format
  *
  * byte 0:  1    ?    ?    ?    1    ?    ?    ?
  * byte 1:  0   x6   x5   x4   x3   x2   x1   x0
- * byte 2:  0   x10  x9   x8   x7    ?  fin  ges
+ * byte 2:  0  x10   x9   x8   x7    ?  fin  ges
  * byte 3:  0   y9   y8   y7    1    M    R    L
  * byte 4:  0   y6   y5   y4   y3   y2   y1   y0
  * byte 5:  0   z6   z5   z4   z3   z2   z1   z0
  *
+ * Dualpoint device -- interleaved packet format
+ *
+ * byte 0:    1    1    0    0    1    1    1    1
+ * byte 1:    0   x6   x5   x4   x3   x2   x1   x0
+ * byte 2:    0  x10   x9   x8   x7    0  fin  ges
+ * byte 3:    0    0 YSGN XSGN    1    1    1    1
+ * byte 4:   X7   X6   X5   X4   X3   X2   X1   X0
+ * byte 5:   Y7   Y6   Y5   Y4   Y3   Y2   Y1   Y0
+ * byte 6:    0   y9   y8   y7    1    m    r    l
+ * byte 7:    0   y6   y5   y4   y3   y2   y1   y0
+ * byte 8:    0   z6   z5   z4   z3   z2   z1   z0
+ *
+ * CAPITALS = stick, miniscules = touchpad
+ *
  * ?'s can have different meanings on different models,
  * such as wheel rotation, extra buttons, stick buttons
  * on a dualpoint, etc.
  */
 
+static bool alps_is_valid_first_byte(const struct alps_model_info *model,
+				     unsigned char data)
+{
+	return (data & model->mask0) == model->byte0;
+}
+
+static void alps_report_buttons(struct psmouse *psmouse,
+				struct input_dev *dev1, struct input_dev *dev2,
+				int left, int right, int middle)
+{
+	struct alps_data *priv = psmouse->private;
+	const struct alps_model_info *model = priv->i;
+
+	if (model->flags & ALPS_PS2_INTERLEAVED) {
+		struct input_dev *dev;
+
+		/*
+		 * If shared button has already been reported on the
+		 * other device (dev2) then this event should be also
+		 * sent through that device.
+		 */
+		dev = test_bit(BTN_LEFT, dev2->key) ? dev2 : dev1;
+		input_report_key(dev, BTN_LEFT, left);
+
+		dev = test_bit(BTN_RIGHT, dev2->key) ? dev2 : dev1;
+		input_report_key(dev, BTN_RIGHT, right);
+
+		dev = test_bit(BTN_MIDDLE, dev2->key) ? dev2 : dev1;
+		input_report_key(dev, BTN_MIDDLE, middle);
+
+		/*
+		 * Sync the _other_ device now, we'll do the first
+		 * device later once we report the rest of the events.
+		 */
+		input_sync(dev2);
+	} else {
+		/*
+		 * For devices with non-interleaved packets we know what
+		 * device buttons belong to so we can simply report them.
+		 */
+		input_report_key(dev1, BTN_LEFT, left);
+		input_report_key(dev1, BTN_RIGHT, right);
+		input_report_key(dev1, BTN_MIDDLE, middle);
+	}
+}
+
 static void alps_process_packet(struct psmouse *psmouse)
 {
 	struct alps_data *priv = psmouse->private;
@@ -89,18 +162,6 @@
 	int x, y, z, ges, fin, left, right, middle;
 	int back = 0, forward = 0;
 
-	if ((packet[0] & 0xc8) == 0x08) {   /* 3-byte PS/2 packet */
-		input_report_key(dev2, BTN_LEFT,   packet[0] & 1);
-		input_report_key(dev2, BTN_RIGHT,  packet[0] & 2);
-		input_report_key(dev2, BTN_MIDDLE, packet[0] & 4);
-		input_report_rel(dev2, REL_X,
-			packet[1] ? packet[1] - ((packet[0] << 4) & 0x100) : 0);
-		input_report_rel(dev2, REL_Y,
-			packet[2] ? ((packet[0] << 3) & 0x100) - packet[2] : 0);
-		input_sync(dev2);
-		return;
-	}
-
 	if (priv->i->flags & ALPS_OLDPROTO) {
 		left = packet[2] & 0x10;
 		right = packet[2] & 0x08;
@@ -136,18 +197,13 @@
 		input_report_rel(dev2, REL_X,  (x > 383 ? (x - 768) : x));
 		input_report_rel(dev2, REL_Y, -(y > 255 ? (y - 512) : y));
 
-		input_report_key(dev2, BTN_LEFT, left);
-		input_report_key(dev2, BTN_RIGHT, right);
-		input_report_key(dev2, BTN_MIDDLE, middle);
+		alps_report_buttons(psmouse, dev2, dev, left, right, middle);
 
-		input_sync(dev);
 		input_sync(dev2);
 		return;
 	}
 
-	input_report_key(dev, BTN_LEFT, left);
-	input_report_key(dev, BTN_RIGHT, right);
-	input_report_key(dev, BTN_MIDDLE, middle);
+	alps_report_buttons(psmouse, dev, dev2, left, right, middle);
 
 	/* Convert hardware tap to a reasonable Z value */
 	if (ges && !fin) z = 40;
@@ -188,25 +244,168 @@
 	input_sync(dev);
 }
 
+static void alps_report_bare_ps2_packet(struct psmouse *psmouse,
+					unsigned char packet[],
+					bool report_buttons)
+{
+	struct alps_data *priv = psmouse->private;
+	struct input_dev *dev2 = priv->dev2;
+
+	if (report_buttons)
+		alps_report_buttons(psmouse, dev2, psmouse->dev,
+				packet[0] & 1, packet[0] & 2, packet[0] & 4);
+
+	input_report_rel(dev2, REL_X,
+		packet[1] ? packet[1] - ((packet[0] << 4) & 0x100) : 0);
+	input_report_rel(dev2, REL_Y,
+		packet[2] ? ((packet[0] << 3) & 0x100) - packet[2] : 0);
+
+	input_sync(dev2);
+}
+
+static psmouse_ret_t alps_handle_interleaved_ps2(struct psmouse *psmouse)
+{
+	struct alps_data *priv = psmouse->private;
+
+	if (psmouse->pktcnt < 6)
+		return PSMOUSE_GOOD_DATA;
+
+	if (psmouse->pktcnt == 6) {
+		/*
+		 * Start a timer to flush the packet if it ends up last
+		 * 6-byte packet in the stream. Timer needs to fire
+		 * psmouse core times out itself. 20 ms should be enough
+		 * to decide if we are getting more data or not.
+		 */
+		mod_timer(&priv->timer, jiffies + msecs_to_jiffies(20));
+		return PSMOUSE_GOOD_DATA;
+	}
+
+	del_timer(&priv->timer);
+
+	if (psmouse->packet[6] & 0x80) {
+
+		/*
+		 * Highest bit is set - that means we either had
+		 * complete ALPS packet and this is start of the
+		 * next packet or we got garbage.
+		 */
+
+		if (((psmouse->packet[3] |
+		      psmouse->packet[4] |
+		      psmouse->packet[5]) & 0x80) ||
+		    (!alps_is_valid_first_byte(priv->i, psmouse->packet[6]))) {
+			dbg("refusing packet %x %x %x %x "
+			    "(suspected interleaved ps/2)\n",
+			    psmouse->packet[3], psmouse->packet[4],
+			    psmouse->packet[5], psmouse->packet[6]);
+			return PSMOUSE_BAD_DATA;
+		}
+
+		alps_process_packet(psmouse);
+
+		/* Continue with the next packet */
+		psmouse->packet[0] = psmouse->packet[6];
+		psmouse->pktcnt = 1;
+
+	} else {
+
+		/*
+		 * High bit is 0 - that means that we indeed got a PS/2
+		 * packet in the middle of ALPS packet.
+		 *
+		 * There is also possibility that we got 6-byte ALPS
+		 * packet followed  by 3-byte packet from trackpoint. We
+		 * can not distinguish between these 2 scenarios but
+		 * becase the latter is unlikely to happen in course of
+		 * normal operation (user would need to press all
+		 * buttons on the pad and start moving trackpoint
+		 * without touching the pad surface) we assume former.
+		 * Even if we are wrong the wost thing that would happen
+		 * the cursor would jump but we should not get protocol
+		 * desynchronization.
+		 */
+
+		alps_report_bare_ps2_packet(psmouse, &psmouse->packet[3],
+					    false);
+
+		/*
+		 * Continue with the standard ALPS protocol handling,
+		 * but make sure we won't process it as an interleaved
+		 * packet again, which may happen if all buttons are
+		 * pressed. To avoid this let's reset the 4th bit which
+		 * is normally 1.
+		 */
+		psmouse->packet[3] = psmouse->packet[6] & 0xf7;
+		psmouse->pktcnt = 4;
+	}
+
+	return PSMOUSE_GOOD_DATA;
+}
+
+static void alps_flush_packet(unsigned long data)
+{
+	struct psmouse *psmouse = (struct psmouse *)data;
+
+	serio_pause_rx(psmouse->ps2dev.serio);
+
+	if (psmouse->pktcnt == 6) {
+
+		/*
+		 * We did not any more data in reasonable amount of time.
+		 * Validate the last 3 bytes and process as a standard
+		 * ALPS packet.
+		 */
+		if ((psmouse->packet[3] |
+		     psmouse->packet[4] |
+		     psmouse->packet[5]) & 0x80) {
+			dbg("refusing packet %x %x %x "
+			    "(suspected interleaved ps/2)\n",
+			    psmouse->packet[3], psmouse->packet[4],
+			    psmouse->packet[5]);
+		} else {
+			alps_process_packet(psmouse);
+		}
+		psmouse->pktcnt = 0;
+	}
+
+	serio_continue_rx(psmouse->ps2dev.serio);
+}
+
 static psmouse_ret_t alps_process_byte(struct psmouse *psmouse)
 {
 	struct alps_data *priv = psmouse->private;
+	const struct alps_model_info *model = priv->i;
 
 	if ((psmouse->packet[0] & 0xc8) == 0x08) { /* PS/2 packet */
 		if (psmouse->pktcnt == 3) {
-			alps_process_packet(psmouse);
+			alps_report_bare_ps2_packet(psmouse, psmouse->packet,
+						    true);
 			return PSMOUSE_FULL_PACKET;
 		}
 		return PSMOUSE_GOOD_DATA;
 	}
 
-	if ((psmouse->packet[0] & priv->i->mask0) != priv->i->byte0)
+	/* Check for PS/2 packet stuffed in the middle of ALPS packet. */
+
+	if ((model->flags & ALPS_PS2_INTERLEAVED) &&
+	    psmouse->pktcnt >= 4 && (psmouse->packet[3] & 0x0f) == 0x0f) {
+		return alps_handle_interleaved_ps2(psmouse);
+	}
+
+	if (!alps_is_valid_first_byte(model, psmouse->packet[0])) {
+		dbg("refusing packet[0] = %x (mask0 = %x, byte0 = %x)\n",
+		    psmouse->packet[0], model->mask0, model->byte0);
 		return PSMOUSE_BAD_DATA;
+	}
 
 	/* Bytes 2 - 6 should have 0 in the highest bit */
 	if (psmouse->pktcnt >= 2 && psmouse->pktcnt <= 6 &&
-	    (psmouse->packet[psmouse->pktcnt - 1] & 0x80))
+	    (psmouse->packet[psmouse->pktcnt - 1] & 0x80)) {
+		dbg("refusing packet[%i] = %x\n",
+		    psmouse->pktcnt - 1, psmouse->packet[psmouse->pktcnt - 1]);
 		return PSMOUSE_BAD_DATA;
+	}
 
 	if (psmouse->pktcnt == 6) {
 		alps_process_packet(psmouse);
@@ -428,7 +627,8 @@
 
 static int alps_reconnect(struct psmouse *psmouse)
 {
-	psmouse_reset(psmouse);
+	/* UBUNTU: Causes lockups on resume */
+	/* psmouse_reset(psmouse); */
 
 	if (alps_hw_init(psmouse, NULL))
 		return -1;
@@ -441,6 +641,7 @@
 	struct alps_data *priv = psmouse->private;
 
 	psmouse_reset(psmouse);
+	del_timer_sync(&priv->timer);
 	input_unregister_device(priv->dev2);
 	kfree(priv);
 }
@@ -457,6 +658,8 @@
 		goto init_fail;
 
 	priv->dev2 = dev2;
+	setup_timer(&priv->timer, alps_flush_packet, (unsigned long)psmouse);
+
 	psmouse->private = priv;
 
 	if (alps_hw_init(psmouse, &version))
--- linux-rt-2.6.31.orig/drivers/input/mouse/alps.h
+++ linux-rt-2.6.31/drivers/input/mouse/alps.h
@@ -23,6 +23,7 @@
 	char phys[32];			/* Phys */
 	const struct alps_model_info *i;/* Info */
 	int prev_fin;			/* Finger bit from previous packet */
+	struct timer_list timer;
 };
 
 #ifdef CONFIG_MOUSE_PS2_ALPS
--- linux-rt-2.6.31.orig/drivers/hid/hid-ids.h
+++ linux-rt-2.6.31/drivers/hid/hid-ids.h
@@ -376,11 +376,8 @@
 #define USB_DEVICE_ID_SONY_PS3_CONTROLLER	0x0268
 
 #define USB_VENDOR_ID_SOUNDGRAPH	0x15c2
-#define USB_DEVICE_ID_SOUNDGRAPH_IMON_LCD	0x0038
-#define USB_DEVICE_ID_SOUNDGRAPH_IMON_LCD2	0x0036
-#define USB_DEVICE_ID_SOUNDGRAPH_IMON_LCD3	0x0034
-#define USB_DEVICE_ID_SOUNDGRAPH_IMON_LCD4	0x0044
-#define USB_DEVICE_ID_SOUNDGRAPH_IMON_LCD5	0x0045
+#define USB_DEVICE_ID_SOUNDGRAPH_IMON_FIRST	0x0034
+#define USB_DEVICE_ID_SOUNDGRAPH_IMON_LAST	0x0046
 
 #define USB_VENDOR_ID_SUN		0x0430
 #define USB_DEVICE_ID_RARITAN_KVM_DONGLE	0xcdab
--- linux-rt-2.6.31.orig/drivers/hid/hid-core.c
+++ linux-rt-2.6.31/drivers/hid/hid-core.c
@@ -1319,7 +1319,6 @@
 	{ HID_USB_DEVICE(USB_VENDOR_ID_ZEROPLUS, 0x0005) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_ZEROPLUS, 0x0030) },
 
-	{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, 0x030c) },
 	{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_PRESENTER_8K_BT) },
 	{ }
 };
@@ -1623,11 +1622,6 @@
 	{ HID_USB_DEVICE(USB_VENDOR_ID_PANJIT, 0x0003) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_PANJIT, 0x0004) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_POWERCOM, USB_DEVICE_ID_POWERCOM_UPS) },
-	{ HID_USB_DEVICE(USB_VENDOR_ID_SOUNDGRAPH, USB_DEVICE_ID_SOUNDGRAPH_IMON_LCD) },
-	{ HID_USB_DEVICE(USB_VENDOR_ID_SOUNDGRAPH, USB_DEVICE_ID_SOUNDGRAPH_IMON_LCD2) },
-	{ HID_USB_DEVICE(USB_VENDOR_ID_SOUNDGRAPH, USB_DEVICE_ID_SOUNDGRAPH_IMON_LCD3) },
-	{ HID_USB_DEVICE(USB_VENDOR_ID_SOUNDGRAPH, USB_DEVICE_ID_SOUNDGRAPH_IMON_LCD4) },
-	{ HID_USB_DEVICE(USB_VENDOR_ID_SOUNDGRAPH, USB_DEVICE_ID_SOUNDGRAPH_IMON_LCD5) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_TENX, USB_DEVICE_ID_TENX_IBUDDY1) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_TENX, USB_DEVICE_ID_TENX_IBUDDY2) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_VERNIER, USB_DEVICE_ID_VERNIER_LABPRO) },
@@ -1694,6 +1688,11 @@
 				hdev->product <= USB_DEVICE_ID_LOGITECH_HARMONY_LAST)
 			return true;
 		break;
+	case USB_VENDOR_ID_SOUNDGRAPH:
+		if (hdev->product >= USB_DEVICE_ID_SOUNDGRAPH_IMON_FIRST &&
+		    hdev->product <= USB_DEVICE_ID_SOUNDGRAPH_IMON_LAST)
+			return true;
+		break;
 	}
 
 	if (hdev->type == HID_TYPE_USBMOUSE &&
--- linux-rt-2.6.31.orig/drivers/hwmon/sht15.c
+++ linux-rt-2.6.31/drivers/hwmon/sht15.c
@@ -304,7 +304,7 @@
 	int d1 = 0;
 	int i;
 
-	for (i = 1; i < ARRAY_SIZE(temppoints) - 1; i++)
+	for (i = 1; i < ARRAY_SIZE(temppoints); i++)
 		/* Find pointer to interpolate */
 		if (data->supply_uV > temppoints[i - 1].vdd) {
 			d1 = (data->supply_uV/1000 - temppoints[i - 1].vdd)
@@ -331,12 +331,12 @@
 
 	const int c1 = -4;
 	const int c2 = 40500; /* x 10 ^ -6 */
-	const int c3 = 2800; /* x10 ^ -9 */
+	const int c3 = -2800; /* x10 ^ -9 */
 
 	RHlinear = c1*1000
 		+ c2 * data->val_humid/1000
 		+ (data->val_humid * data->val_humid * c3)/1000000;
-	return (temp - 25000) * (10000 + 800 * data->val_humid)
+	return (temp - 25000) * (10000 + 80 * data->val_humid)
 		/ 1000000 + RHlinear;
 }
 
--- linux-rt-2.6.31.orig/drivers/hwmon/it87.c
+++ linux-rt-2.6.31/drivers/hwmon/it87.c
@@ -1028,12 +1028,11 @@
 		chip_type, *address, sio_data->revision);
 
 	/* Read GPIO config and VID value from LDN 7 (GPIO) */
-	if (chip_type != IT8705F_DEVID) {
+	if (sio_data->type != it87) {
 		int reg;
 
 		superio_select(GPIO);
-		if ((chip_type == it8718) ||
-		    (chip_type == it8720))
+		if (sio_data->type == it8718 || sio_data->type == it8720)
 			sio_data->vid_value = superio_inb(IT87_SIO_VID_REG);
 
 		reg = superio_inb(IT87_SIO_PINX2_REG);
--- linux-rt-2.6.31.orig/drivers/hwmon/adt7475.c
+++ linux-rt-2.6.31/drivers/hwmon/adt7475.c
@@ -350,8 +350,7 @@
 
 	case FAULT:
 		/* Note - only for remote1 and remote2 */
-		out = data->alarms & (sattr->index ? 0x8000 : 0x4000);
-		out = out ? 0 : 1;
+		out = !!(data->alarms & (sattr->index ? 0x8000 : 0x4000));
 		break;
 
 	default:
@@ -1152,7 +1151,7 @@
 	}
 
 	/* Limits and settings, should never change update every 60 seconds */
-	if (time_after(jiffies, data->limits_updated + HZ * 2) ||
+	if (time_after(jiffies, data->limits_updated + HZ * 60) ||
 	    !data->valid) {
 		data->config5 = adt7475_read(REG_CONFIG5);
 
--- linux-rt-2.6.31.orig/drivers/hwmon/fschmd.c
+++ linux-rt-2.6.31/drivers/hwmon/fschmd.c
@@ -819,7 +819,7 @@
 static ssize_t watchdog_write(struct file *filp, const char __user *buf,
 	size_t count, loff_t *offset)
 {
-	size_t ret;
+	int ret;
 	struct fschmd_data *data = filp->private_data;
 
 	if (count) {
--- linux-rt-2.6.31.orig/drivers/hwmon/adt7462.c
+++ linux-rt-2.6.31/drivers/hwmon/adt7462.c
@@ -97,7 +97,7 @@
 #define		ADT7462_PIN24_SHIFT		6
 #define		ADT7462_PIN26_VOLT_INPUT	0x08
 #define		ADT7462_PIN25_VOLT_INPUT	0x20
-#define		ADT7462_PIN28_SHIFT		6	/* cfg3 */
+#define		ADT7462_PIN28_SHIFT		4	/* cfg3 */
 #define		ADT7462_PIN28_VOLT		0x5
 
 #define ADT7462_REG_ALARM1			0xB8
--- linux-rt-2.6.31.orig/drivers/watchdog/riowd.c
+++ linux-rt-2.6.31/drivers/watchdog/riowd.c
@@ -206,7 +206,7 @@
 
 	dev_set_drvdata(&op->dev, p);
 	riowd_device = p;
-	err = 0;
+	return 0;
 
 out_iounmap:
 	of_iounmap(&op->resource[0], p->regs, 2);
--- linux-rt-2.6.31.orig/drivers/macintosh/windfarm_smu_sat.c
+++ linux-rt-2.6.31/drivers/macintosh/windfarm_smu_sat.c
@@ -194,6 +194,8 @@
 	.owner		= THIS_MODULE,
 };
 
+static struct i2c_driver wf_sat_driver;
+
 static void wf_sat_create(struct i2c_adapter *adapter, struct device_node *dev)
 {
 	struct i2c_board_info info;
@@ -222,7 +224,7 @@
 	 * Let i2c-core delete that device on driver removal.
 	 * This is safe because i2c-core holds the core_lock mutex for us.
 	 */
-	list_add_tail(&client->detected, &client->driver->clients);
+	list_add_tail(&client->detected, &wf_sat_driver.clients);
 }
 
 static int wf_sat_probe(struct i2c_client *client,
--- linux-rt-2.6.31.orig/drivers/macintosh/windfarm_max6690_sensor.c
+++ linux-rt-2.6.31/drivers/macintosh/windfarm_max6690_sensor.c
@@ -88,6 +88,8 @@
 	return rc;
 }
 
+static struct i2c_driver wf_max6690_driver;
+
 static struct i2c_client *wf_max6690_create(struct i2c_adapter *adapter,
 					    u8 addr, const char *loc)
 {
@@ -119,7 +121,7 @@
 	 * Let i2c-core delete that device on driver removal.
 	 * This is safe because i2c-core holds the core_lock mutex for us.
 	 */
-	list_add_tail(&client->detected, &client->driver->clients);
+	list_add_tail(&client->detected, &wf_max6690_driver.clients);
 	return client;
 
  fail:
--- linux-rt-2.6.31.orig/drivers/macintosh/windfarm_lm75_sensor.c
+++ linux-rt-2.6.31/drivers/macintosh/windfarm_lm75_sensor.c
@@ -115,6 +115,8 @@
 	return rc;
 }
 
+static struct i2c_driver wf_lm75_driver;
+
 static struct i2c_client *wf_lm75_create(struct i2c_adapter *adapter,
 					     u8 addr, int ds1775,
 					     const char *loc)
@@ -157,7 +159,7 @@
 	 * Let i2c-core delete that device on driver removal.
 	 * This is safe because i2c-core holds the core_lock mutex for us.
 	 */
-	list_add_tail(&client->detected, &client->driver->clients);
+	list_add_tail(&client->detected, &wf_lm75_driver.clients);
 	return client;
  fail:
 	return NULL;
--- linux-rt-2.6.31.orig/drivers/macintosh/therm_adt746x.c
+++ linux-rt-2.6.31/drivers/macintosh/therm_adt746x.c
@@ -79,6 +79,7 @@
 	u8			limits[3];
 	int			last_speed[2];
 	int			last_var[2];
+	int			pwm_inv[2];
 };
 
 static enum {ADT7460, ADT7467} therm_type;
@@ -124,6 +125,8 @@
 	return data;
 }
 
+static struct i2c_driver thermostat_driver;
+
 static int
 attach_thermostat(struct i2c_adapter *adapter)
 {
@@ -148,7 +151,7 @@
 	 * Let i2c-core delete that device on driver removal.
 	 * This is safe because i2c-core holds the core_lock mutex for us.
 	 */
-	list_add_tail(&client->detected, &client->driver->clients);
+	list_add_tail(&client->detected, &thermostat_driver.clients);
 	return 0;
 }
 
@@ -227,19 +230,23 @@
 	
 	if (speed >= 0) {
 		manual = read_reg(th, MANUAL_MODE[fan]);
+		manual &= ~INVERT_MASK;
 		write_reg(th, MANUAL_MODE[fan],
-			(manual|MANUAL_MASK) & (~INVERT_MASK));
+			manual | MANUAL_MASK | th->pwm_inv[fan]);
 		write_reg(th, FAN_SPD_SET[fan], speed);
 	} else {
 		/* back to automatic */
 		if(therm_type == ADT7460) {
 			manual = read_reg(th,
 				MANUAL_MODE[fan]) & (~MANUAL_MASK);
-
+			manual &= ~INVERT_MASK;
+			manual |= th->pwm_inv[fan];
 			write_reg(th,
 				MANUAL_MODE[fan], manual|REM_CONTROL[fan]);
 		} else {
 			manual = read_reg(th, MANUAL_MODE[fan]);
+			manual &= ~INVERT_MASK;
+			manual |= th->pwm_inv[fan];
 			write_reg(th, MANUAL_MODE[fan], manual&(~AUTO_MASK));
 		}
 	}
@@ -416,6 +423,10 @@
 
 	thermostat = th;
 
+	/* record invert bit status because fw can corrupt it after suspend */
+	th->pwm_inv[0] = read_reg(th, MANUAL_MODE[0]) & INVERT_MASK;
+	th->pwm_inv[1] = read_reg(th, MANUAL_MODE[1]) & INVERT_MASK;
+
 	/* be sure to really write fan speed the first time */
 	th->last_speed[0] = -2;
 	th->last_speed[1] = -2;
--- linux-rt-2.6.31.orig/drivers/macintosh/therm_pm72.c
+++ linux-rt-2.6.31/drivers/macintosh/therm_pm72.c
@@ -286,6 +286,8 @@
 	},
 };
 
+static struct i2c_driver therm_pm72_driver;
+
 /*
  * Utility function to create an i2c_client structure and
  * attach it to one of u3 adapters
@@ -318,7 +320,7 @@
 	 * Let i2c-core delete that device on driver removal.
 	 * This is safe because i2c-core holds the core_lock mutex for us.
 	 */
-	list_add_tail(&clt->detected, &clt->driver->clients);
+	list_add_tail(&clt->detected, &therm_pm72_driver.clients);
 	return clt;
 }
 
--- linux-rt-2.6.31.orig/drivers/macintosh/via-pmu.c
+++ linux-rt-2.6.31/drivers/macintosh/via-pmu.c
@@ -405,7 +405,11 @@
 		printk(KERN_ERR "via-pmu: can't map interrupt\n");
 		return -ENODEV;
 	}
-	if (request_irq(irq, via_pmu_interrupt, 0, "VIA-PMU", (void *)0)) {
+	/* We set IRQF_TIMER because we don't want the interrupt to be disabled
+	 * between the 2 passes of driver suspend, we control our own disabling
+	 * for that one
+	 */
+	if (request_irq(irq, via_pmu_interrupt, IRQF_TIMER, "VIA-PMU", (void *)0)) {
 		printk(KERN_ERR "via-pmu: can't request irq %d\n", irq);
 		return -ENODEV;
 	}
@@ -419,7 +423,7 @@
 			gpio_irq = irq_of_parse_and_map(gpio_node, 0);
 
 		if (gpio_irq != NO_IRQ) {
-			if (request_irq(gpio_irq, gpio1_interrupt, 0,
+			if (request_irq(gpio_irq, gpio1_interrupt, IRQF_TIMER,
 					"GPIO1 ADB", (void *)0))
 				printk(KERN_ERR "pmu: can't get irq %d"
 				       " (GPIO1)\n", gpio_irq);
@@ -925,8 +929,7 @@
 
 #ifdef CONFIG_ADB
 /* Send an ADB command */
-static int
-pmu_send_request(struct adb_request *req, int sync)
+static int pmu_send_request(struct adb_request *req, int sync)
 {
 	int i, ret;
 
@@ -1005,16 +1008,11 @@
 }
 
 /* Enable/disable autopolling */
-static int
-pmu_adb_autopoll(int devs)
+static int __pmu_adb_autopoll(int devs)
 {
 	struct adb_request req;
 
-	if ((vias == NULL) || (!pmu_fully_inited) || !pmu_has_adb)
-		return -ENXIO;
-
 	if (devs) {
-		adb_dev_map = devs;
 		pmu_request(&req, NULL, 5, PMU_ADB_CMD, 0, 0x86,
 			    adb_dev_map >> 8, adb_dev_map);
 		pmu_adb_flags = 2;
@@ -1027,9 +1025,17 @@
 	return 0;
 }
 
+static int pmu_adb_autopoll(int devs)
+{
+	if ((vias == NULL) || (!pmu_fully_inited) || !pmu_has_adb)
+		return -ENXIO;
+
+	adb_dev_map = devs;
+	return __pmu_adb_autopoll(devs);
+}
+
 /* Reset the ADB bus */
-static int
-pmu_adb_reset_bus(void)
+static int pmu_adb_reset_bus(void)
 {
 	struct adb_request req;
 	int save_autopoll = adb_dev_map;
@@ -1038,13 +1044,13 @@
 		return -ENXIO;
 
 	/* anyone got a better idea?? */
-	pmu_adb_autopoll(0);
+	__pmu_adb_autopoll(0);
 
-	req.nbytes = 5;
+	req.nbytes = 4;
 	req.done = NULL;
 	req.data[0] = PMU_ADB_CMD;
-	req.data[1] = 0;
-	req.data[2] = ADB_BUSRESET;
+	req.data[1] = ADB_BUSRESET;
+	req.data[2] = 0;
 	req.data[3] = 0;
 	req.data[4] = 0;
 	req.reply_len = 0;
@@ -1056,7 +1062,7 @@
 	pmu_wait_complete(&req);
 
 	if (save_autopoll != 0)
-		pmu_adb_autopoll(save_autopoll);
+		__pmu_adb_autopoll(save_autopoll);
 
 	return 0;
 }
--- linux-rt-2.6.31.orig/drivers/dma/at_hdmac.c
+++ linux-rt-2.6.31/drivers/dma/at_hdmac.c
@@ -813,7 +813,7 @@
 	dev_vdbg(chan2dev(chan), "is_tx_complete: %d (d%d, u%d)\n",
 			cookie, done ? *done : 0, used ? *used : 0);
 
-	spin_lock_bh(atchan->lock);
+	spin_lock_bh(&atchan->lock);
 
 	last_complete = atchan->completed_cookie;
 	last_used = chan->cookie;
@@ -828,7 +828,7 @@
 		ret = dma_async_is_complete(cookie, last_complete, last_used);
 	}
 
-	spin_unlock_bh(atchan->lock);
+	spin_unlock_bh(&atchan->lock);
 
 	if (done)
 		*done = last_complete;
--- linux-rt-2.6.31.orig/drivers/i2c/i2c-core.c
+++ linux-rt-2.6.31/drivers/i2c/i2c-core.c
@@ -718,6 +718,7 @@
 {
 	int res = 0;
 	struct i2c_adapter *found;
+	struct i2c_client *client, *next;
 
 	/* First make sure that this adapter was ever added */
 	mutex_lock(&core_lock);
@@ -737,6 +738,16 @@
 	if (res)
 		return res;
 
+	/* Remove devices instantiated from sysfs */
+	list_for_each_entry_safe(client, next, &userspace_devices, detected) {
+		if (client->adapter == adap) {
+			dev_dbg(&adap->dev, "Removing %s at 0x%x\n",
+				client->name, client->addr);
+			list_del(&client->detected);
+			i2c_unregister_device(client);
+		}
+	}
+
 	/* Detach any active clients. This can't fail, thus we do not
 	   checking the returned value. */
 	res = device_for_each_child(&adap->dev, NULL, __unregister_client);
--- linux-rt-2.6.31.orig/drivers/i2c/chips/tsl2550.c
+++ linux-rt-2.6.31/drivers/i2c/chips/tsl2550.c
@@ -277,6 +277,7 @@
 
 static ssize_t __tsl2550_show_lux(struct i2c_client *client, char *buf)
 {
+	struct tsl2550_data *data = i2c_get_clientdata(client);
 	u8 ch0, ch1;
 	int ret;
 
@@ -296,6 +297,8 @@
 	ret = tsl2550_calculate_lux(ch0, ch1);
 	if (ret < 0)
 		return ret;
+	if (data->operating_mode == 1)
+		ret *= 5;
 
 	return sprintf(buf, "%d\n", ret);
 }
--- linux-rt-2.6.31.orig/drivers/i2c/busses/i2c-i801.c
+++ linux-rt-2.6.31/drivers/i2c/busses/i2c-i801.c
@@ -732,8 +732,10 @@
 	}
 
 	err = acpi_check_resource_conflict(&dev->resource[SMBBAR]);
-	if (err)
+	if (err) {
+		err = -ENODEV;
 		goto exit;
+	}
 
 	err = pci_request_region(dev, SMBBAR, i801_driver.name);
 	if (err) {
--- linux-rt-2.6.31.orig/drivers/i2c/busses/i2c-amd756.c
+++ linux-rt-2.6.31/drivers/i2c/busses/i2c-amd756.c
@@ -364,7 +364,7 @@
 	error = acpi_check_region(amd756_ioport, SMB_IOSIZE,
 				  amd756_driver.name);
 	if (error)
-		return error;
+		return -ENODEV;
 
 	if (!request_region(amd756_ioport, SMB_IOSIZE, amd756_driver.name)) {
 		dev_err(&pdev->dev, "SMB region 0x%x already in use!\n",
--- linux-rt-2.6.31.orig/drivers/i2c/busses/i2c-sis96x.c
+++ linux-rt-2.6.31/drivers/i2c/busses/i2c-sis96x.c
@@ -280,7 +280,7 @@
 
 	retval = acpi_check_resource_conflict(&dev->resource[SIS96x_BAR]);
 	if (retval)
-		return retval;
+		return -ENODEV;
 
 	/* Everything is happy, let's grab the memory and set things up. */
 	if (!request_region(sis96x_smbus_base, SMB_IOSIZE,
--- linux-rt-2.6.31.orig/drivers/i2c/busses/i2c-piix4.c
+++ linux-rt-2.6.31/drivers/i2c/busses/i2c-piix4.c
@@ -168,7 +168,7 @@
 	}
 
 	if (acpi_check_region(piix4_smba, SMBIOSIZE, piix4_driver.name))
-		return -EBUSY;
+		return -ENODEV;
 
 	if (!request_region(piix4_smba, SMBIOSIZE, piix4_driver.name)) {
 		dev_err(&PIIX4_dev->dev, "SMBus region 0x%x already in use!\n",
@@ -259,7 +259,7 @@
 
 	piix4_smba = ((smba_en_hi << 8) | smba_en_lo) & 0xffe0;
 	if (acpi_check_region(piix4_smba, SMBIOSIZE, piix4_driver.name))
-		return -EBUSY;
+		return -ENODEV;
 
 	if (!request_region(piix4_smba, SMBIOSIZE, piix4_driver.name)) {
 		dev_err(&PIIX4_dev->dev, "SMBus region 0x%x already in use!\n",
--- linux-rt-2.6.31.orig/drivers/i2c/busses/i2c-amd8111.c
+++ linux-rt-2.6.31/drivers/i2c/busses/i2c-amd8111.c
@@ -376,8 +376,10 @@
 	smbus->size = pci_resource_len(dev, 0);
 
 	error = acpi_check_resource_conflict(&dev->resource[0]);
-	if (error)
+	if (error) {
+		error = -ENODEV;
 		goto out_kfree;
+	}
 
 	if (!request_region(smbus->base, smbus->size, amd8111_driver.name)) {
 		error = -EBUSY;
--- linux-rt-2.6.31.orig/drivers/i2c/busses/i2c-isch.c
+++ linux-rt-2.6.31/drivers/i2c/busses/i2c-isch.c
@@ -281,7 +281,7 @@
 		return -ENODEV;
 	}
 	if (acpi_check_region(sch_smba, SMBIOSIZE, sch_driver.name))
-		return -EBUSY;
+		return -ENODEV;
 	if (!request_region(sch_smba, SMBIOSIZE, sch_driver.name)) {
 		dev_err(&dev->dev, "SMBus region 0x%x already in use!\n",
 			sch_smba);
--- linux-rt-2.6.31.orig/drivers/i2c/busses/i2c-viapro.c
+++ linux-rt-2.6.31/drivers/i2c/busses/i2c-viapro.c
@@ -365,7 +365,7 @@
 found:
 	error = acpi_check_region(vt596_smba, 8, vt596_driver.name);
 	if (error)
-		return error;
+		return -ENODEV;
 
 	if (!request_region(vt596_smba, 8, vt596_driver.name)) {
 		dev_err(&pdev->dev, "SMBus region 0x%x already in use!\n",
--- linux-rt-2.6.31.orig/drivers/rtc/rtc-v3020.c
+++ linux-rt-2.6.31/drivers/rtc/rtc-v3020.c
@@ -96,7 +96,7 @@
 
 static unsigned char v3020_mmio_read_bit(struct v3020 *chip)
 {
-	return readl(chip->ioaddress) & (1 << chip->leftshift);
+	return !!(readl(chip->ioaddress) & (1 << chip->leftshift));
 }
 
 static struct v3020_chip_ops v3020_mmio_ops = {
--- linux-rt-2.6.31.orig/drivers/isdn/gigaset/interface.c
+++ linux-rt-2.6.31/drivers/isdn/gigaset/interface.c
@@ -408,33 +408,28 @@
 	return retval;
 }
 
-/* FIXME: This function does not have error returns */
-
 static int if_chars_in_buffer(struct tty_struct *tty)
 {
 	struct cardstate *cs;
-	int retval = -ENODEV;
+	int retval = 0;
 
 	cs = (struct cardstate *) tty->driver_data;
 	if (!cs) {
 		pr_err("%s: no cardstate\n", __func__);
-		return -ENODEV;
+		return 0;
 	}
 
 	gig_dbg(DEBUG_IF, "%u: %s()", cs->minor_index, __func__);
 
-	if (mutex_lock_interruptible(&cs->mutex))
-		return -ERESTARTSYS; // FIXME -EINTR?
+	mutex_lock(&cs->mutex);
 
-	if (!cs->connected) {
+	if (!cs->connected)
 		gig_dbg(DEBUG_IF, "not connected");
-		retval = -ENODEV;
-	} else if (!cs->open_count)
+	else if (!cs->open_count)
 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
-	else if (cs->mstate != MS_LOCKED) {
+	else if (cs->mstate != MS_LOCKED)
 		dev_warn(cs->dev, "can't write to unlocked device\n");
-		retval = -EBUSY;
-	} else
+	else
 		retval = cs->ops->chars_in_buffer(cs);
 
 	mutex_unlock(&cs->mutex);
--- linux-rt-2.6.31.orig/drivers/isdn/hisax/hfc_usb.c
+++ linux-rt-2.6.31/drivers/isdn/hisax/hfc_usb.c
@@ -817,8 +817,8 @@
 	}
 	/* we have a complete hdlc packet */
 	if (finish) {
-		if ((!fifo->skbuff->data[fifo->skbuff->len - 1])
-		    && (fifo->skbuff->len > 3)) {
+		if (fifo->skbuff->len > 3 &&
+				!fifo->skbuff->data[fifo->skbuff->len - 1]) {
 
 			if (fifon == HFCUSB_D_RX) {
 				DBG(HFCUSB_DBG_DCHANNEL,
--- linux-rt-2.6.31.orig/drivers/isdn/i4l/isdn_ppp.c
+++ linux-rt-2.6.31/drivers/isdn/i4l/isdn_ppp.c
@@ -1535,10 +1535,8 @@
 	int sz = ISDN_MAX_CHANNELS*sizeof(ippp_bundle);
 	if( (isdn_ppp_bundle_arr = kzalloc(sz, GFP_KERNEL)) == NULL )
 		return -ENOMEM;
-	for (i = 0; i < ISDN_MAX_CHANNELS; i++) {
+	for( i = 0; i < ISDN_MAX_CHANNELS; i++ )
 		spin_lock_init(&isdn_ppp_bundle_arr[i].lock);
-		skb_queue_head_init(&isdn_ppp_bundle_arr[i].frags);
-	}
 	return 0;
 }
 
@@ -1571,7 +1569,7 @@
 		if ((lp->netdev->pb = isdn_ppp_mp_bundle_alloc()) == NULL)
 			return -ENOMEM;
 		lp->next = lp->last = lp;	/* nobody else in a queue */
-		skb_queue_head_init(&lp->netdev->pb->frags);
+		lp->netdev->pb->frags = NULL;
 		lp->netdev->pb->frames = 0;
 		lp->netdev->pb->seq = UINT_MAX;
 	}
@@ -1583,29 +1581,28 @@
 
 static u32 isdn_ppp_mp_get_seq( int short_seq, 
 					struct sk_buff * skb, u32 last_seq );
-static void isdn_ppp_mp_discard(ippp_bundle *mp, struct sk_buff *from,
-				struct sk_buff *to);
-static void isdn_ppp_mp_reassembly(isdn_net_dev *net_dev, isdn_net_local *lp,
-				   struct sk_buff *from, struct sk_buff *to,
-				   u32 lastseq);
-static void isdn_ppp_mp_free_skb(ippp_bundle *mp, struct sk_buff *skb);
+static struct sk_buff * isdn_ppp_mp_discard( ippp_bundle * mp,
+			struct sk_buff * from, struct sk_buff * to );
+static void isdn_ppp_mp_reassembly( isdn_net_dev * net_dev, isdn_net_local * lp,
+				struct sk_buff * from, struct sk_buff * to );
+static void isdn_ppp_mp_free_skb( ippp_bundle * mp, struct sk_buff * skb );
 static void isdn_ppp_mp_print_recv_pkt( int slot, struct sk_buff * skb );
 
 static void isdn_ppp_mp_receive(isdn_net_dev * net_dev, isdn_net_local * lp, 
-				struct sk_buff *skb)
+							struct sk_buff *skb)
 {
-	struct sk_buff *newfrag, *frag, *start, *nextf;
-	u32 newseq, minseq, thisseq;
-	isdn_mppp_stats *stats;
 	struct ippp_struct *is;
+	isdn_net_local * lpq;
+	ippp_bundle * mp;
+	isdn_mppp_stats * stats;
+	struct sk_buff * newfrag, * frag, * start, *nextf;
+	u32 newseq, minseq, thisseq;
 	unsigned long flags;
-	isdn_net_local *lpq;
-	ippp_bundle *mp;
 	int slot;
 
 	spin_lock_irqsave(&net_dev->pb->lock, flags);
-	mp = net_dev->pb;
-	stats = &mp->stats;
+    	mp = net_dev->pb;
+        stats = &mp->stats;
 	slot = lp->ppp_slot;
 	if (slot < 0 || slot >= ISDN_MAX_CHANNELS) {
 		printk(KERN_ERR "%s: lp->ppp_slot(%d)\n",
@@ -1616,19 +1613,20 @@
 		return;
 	}
 	is = ippp_table[slot];
-	if (++mp->frames > stats->max_queue_len)
+    	if( ++mp->frames > stats->max_queue_len )
 		stats->max_queue_len = mp->frames;
 
 	if (is->debug & 0x8)
 		isdn_ppp_mp_print_recv_pkt(lp->ppp_slot, skb);
 
 	newseq = isdn_ppp_mp_get_seq(is->mpppcfg & SC_IN_SHORT_SEQ,
-				     skb, is->last_link_seqno);
+						skb, is->last_link_seqno);
+
 
 	/* if this packet seq # is less than last already processed one,
 	 * toss it right away, but check for sequence start case first 
 	 */
-	if (mp->seq > MP_LONGSEQ_MAX && (newseq & MP_LONGSEQ_MAXBIT)) {
+	if( mp->seq > MP_LONGSEQ_MAX && (newseq & MP_LONGSEQ_MAXBIT) ) {
 		mp->seq = newseq;	/* the first packet: required for
 					 * rfc1990 non-compliant clients --
 					 * prevents constant packet toss */
@@ -1659,31 +1657,22 @@
 					 * packets */
 	newfrag = skb;
 
-	/* Insert new fragment into the proper sequence slot.  */
-	skb_queue_walk(&mp->frags, frag) {
-		if (MP_SEQ(frag) == newseq) {
-			isdn_ppp_mp_free_skb(mp, newfrag);
-			newfrag = NULL;
-			break;
-		}
-		if (MP_LT(newseq, MP_SEQ(frag))) {
-			__skb_queue_before(&mp->frags, frag, newfrag);
-			newfrag = NULL;
-			break;
-		}
-	}
-	if (newfrag)
-		__skb_queue_tail(&mp->frags, newfrag);
+  	/* if this new fragment is before the first one, then enqueue it now. */
+  	if ((frag = mp->frags) == NULL || MP_LT(newseq, MP_SEQ(frag))) {
+		newfrag->next = frag;
+    		mp->frags = frag = newfrag;
+    		newfrag = NULL;
+  	}
 
-	frag = skb_peek(&mp->frags);
-	start = ((MP_FLAGS(frag) & MP_BEGIN_FRAG) &&
-		 (MP_SEQ(frag) == mp->seq)) ? frag : NULL;
-	if (!start)
-		goto check_overflow;
+  	start = MP_FLAGS(frag) & MP_BEGIN_FRAG &&
+				MP_SEQ(frag) == mp->seq ? frag : NULL;
 
-	/* main fragment traversing loop
+	/*
+	 * main fragment traversing loop
 	 *
 	 * try to accomplish several tasks:
+	 * - insert new fragment into the proper sequence slot (once that's done
+	 *   newfrag will be set to NULL)
 	 * - reassemble any complete fragment sequence (non-null 'start'
 	 *   indicates there is a continguous sequence present)
 	 * - discard any incomplete sequences that are below minseq -- due
@@ -1692,46 +1681,71 @@
 	 *   come to complete such sequence and it should be discarded
 	 *
 	 * loop completes when we accomplished the following tasks:
+	 * - new fragment is inserted in the proper sequence ('newfrag' is
+	 *   set to NULL)
 	 * - we hit a gap in the sequence, so no reassembly/processing is 
 	 *   possible ('start' would be set to NULL)
 	 *
 	 * algorithm for this code is derived from code in the book
 	 * 'PPP Design And Debugging' by James Carlson (Addison-Wesley)
 	 */
-	skb_queue_walk_safe(&mp->frags, frag, nextf) {
-		thisseq = MP_SEQ(frag);
+  	while (start != NULL || newfrag != NULL) {
+
+    		thisseq = MP_SEQ(frag);
+    		nextf = frag->next;
 
-		/* check for misplaced start */
-		if (start != frag && (MP_FLAGS(frag) & MP_BEGIN_FRAG)) {
-			printk(KERN_WARNING"isdn_mppp(seq %d): new "
-			       "BEGIN flag with no prior END", thisseq);
-			stats->seqerrs++;
-			stats->frame_drops++;
-			isdn_ppp_mp_discard(mp, start, frag);
-			start = frag;
-		} else if (MP_LE(thisseq, minseq)) {		
-			if (MP_FLAGS(frag) & MP_BEGIN_FRAG)
+    		/* drop any duplicate fragments */
+    		if (newfrag != NULL && thisseq == newseq) {
+      			isdn_ppp_mp_free_skb(mp, newfrag);
+      			newfrag = NULL;
+    		}
+
+    		/* insert new fragment before next element if possible. */
+    		if (newfrag != NULL && (nextf == NULL ||
+						MP_LT(newseq, MP_SEQ(nextf)))) {
+      			newfrag->next = nextf;
+      			frag->next = nextf = newfrag;
+      			newfrag = NULL;
+    		}
+
+    		if (start != NULL) {
+	    		/* check for misplaced start */
+      			if (start != frag && (MP_FLAGS(frag) & MP_BEGIN_FRAG)) {
+				printk(KERN_WARNING"isdn_mppp(seq %d): new "
+				      "BEGIN flag with no prior END", thisseq);
+				stats->seqerrs++;
+				stats->frame_drops++;
+				start = isdn_ppp_mp_discard(mp, start,frag);
+				nextf = frag->next;
+      			}
+    		} else if (MP_LE(thisseq, minseq)) {
+      			if (MP_FLAGS(frag) & MP_BEGIN_FRAG)
 				start = frag;
-			else {
+      			else {
 				if (MP_FLAGS(frag) & MP_END_FRAG)
-					stats->frame_drops++;
-				__skb_unlink(skb, &mp->frags);
+	  				stats->frame_drops++;
+				if( mp->frags == frag )
+					mp->frags = nextf;
 				isdn_ppp_mp_free_skb(mp, frag);
+				frag = nextf;
 				continue;
-			}
+      			}
 		}
 
-		/* if we have end fragment, then we have full reassembly
-		 * sequence -- reassemble and process packet now
+		/* if start is non-null and we have end fragment, then
+		 * we have full reassembly sequence -- reassemble
+		 * and process packet now
 		 */
-		if (MP_FLAGS(frag) & MP_END_FRAG) {
-			minseq = mp->seq = (thisseq+1) & MP_LONGSEQ_MASK;
-			/* Reassemble the packet then dispatch it */
-			isdn_ppp_mp_reassembly(net_dev, lp, start, frag, thisseq);
+    		if (start != NULL && (MP_FLAGS(frag) & MP_END_FRAG)) {
+      			minseq = mp->seq = (thisseq+1) & MP_LONGSEQ_MASK;
+      			/* Reassemble the packet then dispatch it */
+			isdn_ppp_mp_reassembly(net_dev, lp, start, nextf);
 
-			start = NULL;
-			frag = NULL;
-		}
+      			start = NULL;
+      			frag = NULL;
+
+      			mp->frags = nextf;
+    		}
 
 		/* check if need to update start pointer: if we just
 		 * reassembled the packet and sequence is contiguous
@@ -1742,25 +1756,26 @@
 		 * below low watermark and set start to the next frag or
 		 * clear start ptr.
 		 */ 
-		if (nextf != (struct sk_buff *)&mp->frags && 
+    		if (nextf != NULL &&
 		    ((thisseq+1) & MP_LONGSEQ_MASK) == MP_SEQ(nextf)) {
-			/* if we just reassembled and the next one is here, 
-			 * then start another reassembly.
-			 */
-			if (frag == NULL) {
+      			/* if we just reassembled and the next one is here,
+			 * then start another reassembly. */
+
+      			if (frag == NULL) {
 				if (MP_FLAGS(nextf) & MP_BEGIN_FRAG)
-					start = nextf;
-				else {
-					printk(KERN_WARNING"isdn_mppp(seq %d):"
-					       " END flag with no following "
-					       "BEGIN", thisseq);
+	  				start = nextf;
+				else
+				{
+	  				printk(KERN_WARNING"isdn_mppp(seq %d):"
+						" END flag with no following "
+						"BEGIN", thisseq);
 					stats->seqerrs++;
 				}
 			}
-		} else {
-			if (nextf != (struct sk_buff *)&mp->frags &&
-			    frag != NULL &&
-			    MP_LT(thisseq, minseq)) {
+
+    		} else {
+			if ( nextf != NULL && frag != NULL &&
+						MP_LT(thisseq, minseq)) {
 				/* we've got a break in the sequence
 				 * and we not at the end yet
 				 * and we did not just reassembled
@@ -1769,39 +1784,41 @@
 			 	 * discard all the frames below low watermark 
 				 * and start over */
 				stats->frame_drops++;
-				isdn_ppp_mp_discard(mp, start, nextf);
+				mp->frags = isdn_ppp_mp_discard(mp,start,nextf);
 			}
 			/* break in the sequence, no reassembly */
-			start = NULL;
-		}
-		if (!start)
-			break;
-	}
+      			start = NULL;
+    		}
+
+    		frag = nextf;
+  	}	/* while -- main loop */
+
+  	if (mp->frags == NULL)
+    		mp->frags = frag;
 
-check_overflow:
 	/* rather straighforward way to deal with (not very) possible 
-	 * queue overflow
-	 */
+	 * queue overflow */
 	if (mp->frames > MP_MAX_QUEUE_LEN) {
 		stats->overflows++;
-		skb_queue_walk_safe(&mp->frags, frag, nextf) {
-			if (mp->frames <= MP_MAX_QUEUE_LEN)
-				break;
-			__skb_unlink(frag, &mp->frags);
-			isdn_ppp_mp_free_skb(mp, frag);
+		while (mp->frames > MP_MAX_QUEUE_LEN) {
+			frag = mp->frags->next;
+			isdn_ppp_mp_free_skb(mp, mp->frags);
+			mp->frags = frag;
 		}
 	}
 	spin_unlock_irqrestore(&mp->lock, flags);
 }
 
-static void isdn_ppp_mp_cleanup(isdn_net_local *lp)
+static void isdn_ppp_mp_cleanup( isdn_net_local * lp )
 {
-	struct sk_buff *skb, *tmp;
-
-	skb_queue_walk_safe(&lp->netdev->pb->frags, skb, tmp) {
-		__skb_unlink(skb, &lp->netdev->pb->frags);
-		isdn_ppp_mp_free_skb(lp->netdev->pb, skb);
+	struct sk_buff * frag = lp->netdev->pb->frags;
+	struct sk_buff * nextfrag;
+    	while( frag ) {
+		nextfrag = frag->next;
+		isdn_ppp_mp_free_skb(lp->netdev->pb, frag);
+		frag = nextfrag;
 	}
+	lp->netdev->pb->frags = NULL;
 }
 
 static u32 isdn_ppp_mp_get_seq( int short_seq, 
@@ -1838,115 +1855,72 @@
 	return seq;
 }
 
-static void isdn_ppp_mp_discard(ippp_bundle *mp, struct sk_buff *from,
-				struct sk_buff *to)
+struct sk_buff * isdn_ppp_mp_discard( ippp_bundle * mp,
+			struct sk_buff * from, struct sk_buff * to )
 {
-	if (from) {
-		struct sk_buff *skb, *tmp;
-		int freeing = 0;
-
-		skb_queue_walk_safe(&mp->frags, skb, tmp) {
-			if (skb == to)
-				break;
-			if (skb == from)
-				freeing = 1;
-			if (!freeing)
-				continue;
-			__skb_unlink(skb, &mp->frags);
-			isdn_ppp_mp_free_skb(mp, skb);
+	if( from )
+		while (from != to) {
+	  		struct sk_buff * next = from->next;
+			isdn_ppp_mp_free_skb(mp, from);
+	  		from = next;
 		}
-	}
-}
-
-static unsigned int calc_tot_len(struct sk_buff_head *queue,
-				 struct sk_buff *from, struct sk_buff *to)
-{
-	unsigned int tot_len = 0;
-	struct sk_buff *skb;
-	int found_start = 0;
-
-	skb_queue_walk(queue, skb) {
-		if (skb == from)
-			found_start = 1;
-		if (!found_start)
-			continue;
-		tot_len += skb->len - MP_HEADER_LEN;
-		if (skb == to)
-			break;
-	}
-	return tot_len;
+	return from;
 }
 
-/* Reassemble packet using fragments in the reassembly queue from
- * 'from' until 'to', inclusive.
- */
-static void isdn_ppp_mp_reassembly(isdn_net_dev *net_dev, isdn_net_local *lp,
-				   struct sk_buff *from, struct sk_buff *to,
-				   u32 lastseq)
+void isdn_ppp_mp_reassembly( isdn_net_dev * net_dev, isdn_net_local * lp,
+				struct sk_buff * from, struct sk_buff * to )
 {
-	ippp_bundle *mp = net_dev->pb;
-	unsigned int tot_len;
-	struct sk_buff *skb;
+	ippp_bundle * mp = net_dev->pb;
 	int proto;
+	struct sk_buff * skb;
+	unsigned int tot_len;
 
 	if (lp->ppp_slot < 0 || lp->ppp_slot >= ISDN_MAX_CHANNELS) {
 		printk(KERN_ERR "%s: lp->ppp_slot(%d) out of range\n",
 			__func__, lp->ppp_slot);
 		return;
 	}
-
-	tot_len = calc_tot_len(&mp->frags, from, to);
-
-	if (MP_FLAGS(from) == (MP_BEGIN_FRAG | MP_END_FRAG)) {
-		if (ippp_table[lp->ppp_slot]->debug & 0x40)
+	if( MP_FLAGS(from) == (MP_BEGIN_FRAG | MP_END_FRAG) ) {
+		if( ippp_table[lp->ppp_slot]->debug & 0x40 )
 			printk(KERN_DEBUG "isdn_mppp: reassembly: frame %d, "
-			       "len %d\n", MP_SEQ(from), from->len);
+					"len %d\n", MP_SEQ(from), from->len );
 		skb = from;
 		skb_pull(skb, MP_HEADER_LEN);
-		__skb_unlink(skb, &mp->frags);
 		mp->frames--;	
 	} else {
-		struct sk_buff *walk, *tmp;
-		int found_start = 0;
+		struct sk_buff * frag;
+		int n;
 
-		if (ippp_table[lp->ppp_slot]->debug & 0x40)
-			printk(KERN_DEBUG"isdn_mppp: reassembling frames %d "
-			       "to %d, len %d\n", MP_SEQ(from), lastseq,
-			       tot_len);
+		for(tot_len=n=0, frag=from; frag != to; frag=frag->next, n++)
+			tot_len += frag->len - MP_HEADER_LEN;
 
-		skb = dev_alloc_skb(tot_len);
-		if (!skb)
+		if( ippp_table[lp->ppp_slot]->debug & 0x40 )
+			printk(KERN_DEBUG"isdn_mppp: reassembling frames %d "
+				"to %d, len %d\n", MP_SEQ(from),
+				(MP_SEQ(from)+n-1) & MP_LONGSEQ_MASK, tot_len );
+		if( (skb = dev_alloc_skb(tot_len)) == NULL ) {
 			printk(KERN_ERR "isdn_mppp: cannot allocate sk buff "
-			       "of size %d\n", tot_len);
-
-		found_start = 0;
-		skb_queue_walk_safe(&mp->frags, walk, tmp) {
-			if (walk == from)
-				found_start = 1;
-			if (!found_start)
-				continue;
+					"of size %d\n", tot_len);
+			isdn_ppp_mp_discard(mp, from, to);
+			return;
+		}
 
-			if (skb) {
-				unsigned int len = walk->len - MP_HEADER_LEN;
-				skb_copy_from_linear_data_offset(walk, MP_HEADER_LEN,
-								 skb_put(skb, len),
-								 len);
-			}
-			__skb_unlink(walk, &mp->frags);
-			isdn_ppp_mp_free_skb(mp, walk);
+		while( from != to ) {
+			unsigned int len = from->len - MP_HEADER_LEN;
 
-			if (walk == to)
-				break;
+			skb_copy_from_linear_data_offset(from, MP_HEADER_LEN,
+							 skb_put(skb,len),
+							 len);
+			frag = from->next;
+			isdn_ppp_mp_free_skb(mp, from);
+			from = frag;
 		}
 	}
-	if (!skb)
-		return;
-
    	proto = isdn_ppp_strip_proto(skb);
 	isdn_ppp_push_higher(net_dev, lp, skb, proto);
 }
 
-static void isdn_ppp_mp_free_skb(ippp_bundle *mp, struct sk_buff *skb)
+static void isdn_ppp_mp_free_skb(ippp_bundle * mp, struct sk_buff * skb)
 {
 	dev_kfree_skb(skb);
 	mp->frames--;
--- linux-rt-2.6.31.orig/drivers/xen/Makefile
+++ linux-rt-2.6.31/drivers/xen/Makefile
@@ -1,6 +1,9 @@
 obj-y	+= grant-table.o features.o events.o manage.o
 obj-y	+= xenbus/
 
+nostackp := $(call cc-option, -fno-stack-protector)
+CFLAGS_features.o			:= $(nostackp)
+
 obj-$(CONFIG_HOTPLUG_CPU)	+= cpu_hotplug.o
 obj-$(CONFIG_XEN_XENCOMM)	+= xencomm.o
 obj-$(CONFIG_XEN_BALLOON)	+= balloon.o
--- linux-rt-2.6.31.orig/drivers/platform/x86/compal-laptop.c
+++ linux-rt-2.6.31/drivers/platform/x86/compal-laptop.c
@@ -26,17 +26,8 @@
 /*
  * comapl-laptop.c - Compal laptop support.
  *
- * This driver exports a few files in /sys/devices/platform/compal-laptop/:
- *
- *   wlan - wlan subsystem state: contains 0 or 1 (rw)
- *
- *   bluetooth - Bluetooth subsystem state: contains 0 or 1 (rw)
- *
- *   raw - raw value taken from embedded controller register (ro)
- *
- * In addition to these platform device attributes the driver
- * registers itself in the Linux backlight control subsystem and is
- * available to userspace under /sys/class/backlight/compal-laptop/.
+ * The driver registers itself with the rfkill subsystem and
+ * the Linux backlight control subsystem.
  *
  * This driver might work on other laptops produced by Compal. If you
  * want to try it you can pass force=1 as argument to the module which
@@ -52,6 +43,7 @@
 #include <linux/backlight.h>
 #include <linux/platform_device.h>
 #include <linux/autoconf.h>
+#include <linux/rfkill.h>
 
 #define COMPAL_DRIVER_VERSION "0.2.6"
 
@@ -64,6 +56,10 @@
 #define WLAN_MASK	0x01
 #define BT_MASK 	0x02
 
+static struct rfkill *wifi_rfkill;
+static struct rfkill *bt_rfkill;
+static struct platform_device *compal_device;
+
 static int force;
 module_param(force, bool, 0);
 MODULE_PARM_DESC(force, "Force driver load, ignore DMI data");
@@ -89,65 +85,75 @@
 	return (int) result;
 }
 
-static int set_wlan_state(int state)
+static int compal_rfkill_set(void *data, bool blocked)
 {
+	unsigned long radio = (unsigned long) data;
 	u8 result, value;
 
 	ec_read(COMPAL_EC_COMMAND_WIRELESS, &result);
 
-	if ((result & KILLSWITCH_MASK) == 0)
-		return -EINVAL;
-	else {
-		if (state)
-			value = (u8) (result | WLAN_MASK);
-		else
-			value = (u8) (result & ~WLAN_MASK);
-		ec_write(COMPAL_EC_COMMAND_WIRELESS, value);
-	}
+	if (!blocked)
+		value = (u8) (result | radio);
+	else
+		value = (u8) (result & ~radio);
+	ec_write(COMPAL_EC_COMMAND_WIRELESS, value);
 
 	return 0;
 }
 
-static int set_bluetooth_state(int state)
+static void compal_rfkill_poll(struct rfkill *rfkill, void *data)
 {
-	u8 result, value;
+	u8 result;
+	bool hw_blocked;
 
 	ec_read(COMPAL_EC_COMMAND_WIRELESS, &result);
 
-	if ((result & KILLSWITCH_MASK) == 0)
-		return -EINVAL;
-	else {
-		if (state)
-			value = (u8) (result | BT_MASK);
-		else
-			value = (u8) (result & ~BT_MASK);
-		ec_write(COMPAL_EC_COMMAND_WIRELESS, value);
-	}
-
-	return 0;
+	hw_blocked = !(result & KILLSWITCH_MASK);
+	rfkill_set_hw_state(rfkill, hw_blocked);
 }
 
-static int get_wireless_state(int *wlan, int *bluetooth)
+static const struct rfkill_ops compal_rfkill_ops = {
+	.poll = compal_rfkill_poll,
+	.set_block = compal_rfkill_set,
+};
+
+static int setup_rfkill(void)
 {
-	u8 result;
+	int ret;
 
-	ec_read(COMPAL_EC_COMMAND_WIRELESS, &result);
+	wifi_rfkill = rfkill_alloc("compal-wifi", &compal_device->dev,
+				RFKILL_TYPE_WLAN, &compal_rfkill_ops,
+				(void *) WLAN_MASK);
+	if (!wifi_rfkill)
+		return -ENOMEM;
 
-	if (wlan) {
-		if ((result & KILLSWITCH_MASK) == 0)
-			*wlan = 0;
-		else
-			*wlan = result & WLAN_MASK;
-	}
+	ret = rfkill_register(wifi_rfkill);
+	if (ret)
+		goto err_wifi;
 
-	if (bluetooth) {
-		if ((result & KILLSWITCH_MASK) == 0)
-			*bluetooth = 0;
-		else
-			*bluetooth = (result & BT_MASK) >> 1;
+	bt_rfkill = rfkill_alloc("compal-bluetooth", &compal_device->dev,
+				RFKILL_TYPE_BLUETOOTH, &compal_rfkill_ops,
+				(void *) BT_MASK);
+	if (!bt_rfkill) {
+		ret = -ENOMEM;
+		goto err_allocate_bt;
 	}
+	ret = rfkill_register(bt_rfkill);
+	if (ret)
+		goto err_register_bt;
 
 	return 0;
+
+err_register_bt:
+	rfkill_destroy(bt_rfkill);
+
+err_allocate_bt:
+	rfkill_unregister(wifi_rfkill);
+
+err_wifi:
+	rfkill_destroy(wifi_rfkill);
+
+	return ret;
 }
 
 /* Backlight device stuff */
@@ -170,86 +176,6 @@
 
 static struct backlight_device *compalbl_device;
 
-/* Platform device */
-
-static ssize_t show_wlan(struct device *dev,
-	struct device_attribute *attr, char *buf)
-{
-	int ret, enabled;
-
-	ret = get_wireless_state(&enabled, NULL);
-	if (ret < 0)
-		return ret;
-
-	return sprintf(buf, "%i\n", enabled);
-}
-
-static ssize_t show_raw(struct device *dev,
-	struct device_attribute *attr, char *buf)
-{
-	u8 result;
-
-	ec_read(COMPAL_EC_COMMAND_WIRELESS, &result);
-
-	return sprintf(buf, "%i\n", result);
-}
-
-static ssize_t show_bluetooth(struct device *dev,
-	struct device_attribute *attr, char *buf)
-{
-	int ret, enabled;
-
-	ret = get_wireless_state(NULL, &enabled);
-	if (ret < 0)
-		return ret;
-
-	return sprintf(buf, "%i\n", enabled);
-}
-
-static ssize_t store_wlan_state(struct device *dev,
-	struct device_attribute *attr, const char *buf, size_t count)
-{
-	int state, ret;
-
-	if (sscanf(buf, "%i", &state) != 1 || (state < 0 || state > 1))
-		return -EINVAL;
-
-	ret = set_wlan_state(state);
-	if (ret < 0)
-		return ret;
-
-	return count;
-}
-
-static ssize_t store_bluetooth_state(struct device *dev,
-	struct device_attribute *attr, const char *buf, size_t count)
-{
-	int state, ret;
-
-	if (sscanf(buf, "%i", &state) != 1 || (state < 0 || state > 1))
-		return -EINVAL;
-
-	ret = set_bluetooth_state(state);
-	if (ret < 0)
-		return ret;
-
-	return count;
-}
-
-static DEVICE_ATTR(bluetooth, 0644, show_bluetooth, store_bluetooth_state);
-static DEVICE_ATTR(wlan, 0644, show_wlan, store_wlan_state);
-static DEVICE_ATTR(raw, 0444, show_raw, NULL);
-
-static struct attribute *compal_attributes[] = {
-	&dev_attr_bluetooth.attr,
-	&dev_attr_wlan.attr,
-	&dev_attr_raw.attr,
-	NULL
-};
-
-static struct attribute_group compal_attribute_group = {
-	.attrs = compal_attributes
-};
 
 static struct platform_driver compal_driver = {
 	.driver = {
@@ -258,8 +184,6 @@
 	}
 };
 
-static struct platform_device *compal_device;
-
 /* Initialization */
 
 static int dmi_check_cb(const struct dmi_system_id *id)
@@ -311,6 +235,47 @@
 		},
 		.callback = dmi_check_cb
 	},
+	{
+		.ident = "Dell Mini 9",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 910"),
+		},
+		.callback = dmi_check_cb
+	},
+	{
+		.ident = "Dell Mini 10",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 1010"),
+		},
+		.callback = dmi_check_cb
+	},
+	{
+		.ident = "Dell Mini 10v",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 1011"),
+		},
+		.callback = dmi_check_cb
+	},
+	{
+		.ident = "Dell Inspiron 11z",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 1110"),
+		},
+		.callback = dmi_check_cb
+	},
+	{
+		.ident = "Dell Mini 12",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 1210"),
+		},
+		.callback = dmi_check_cb
+	},
+
 	{ }
 };
 
@@ -349,23 +314,21 @@
 
 	ret = platform_device_add(compal_device);
 	if (ret)
-		goto fail_platform_device1;
+		goto fail_platform_device;
 
-	ret = sysfs_create_group(&compal_device->dev.kobj,
-		&compal_attribute_group);
+	ret = setup_rfkill();
 	if (ret)
-		goto fail_platform_device2;
+		goto fail_rfkill;
 
 	printk(KERN_INFO "compal-laptop: driver "COMPAL_DRIVER_VERSION
 		" successfully loaded.\n");
 
 	return 0;
 
-fail_platform_device2:
-
+fail_rfkill:
 	platform_device_del(compal_device);
 
-fail_platform_device1:
+fail_platform_device:
 
 	platform_device_put(compal_device);
 
@@ -383,10 +346,13 @@
 static void __exit compal_cleanup(void)
 {
 
-	sysfs_remove_group(&compal_device->dev.kobj, &compal_attribute_group);
 	platform_device_unregister(compal_device);
 	platform_driver_unregister(&compal_driver);
 	backlight_device_unregister(compalbl_device);
+	rfkill_unregister(wifi_rfkill);
+	rfkill_destroy(wifi_rfkill);
+	rfkill_unregister(bt_rfkill);
+	rfkill_destroy(bt_rfkill);
 
 	printk(KERN_INFO "compal-laptop: driver unloaded.\n");
 }
@@ -404,3 +370,8 @@
 MODULE_ALIAS("dmi:*:rnIFL91:rvrIFT00:*");
 MODULE_ALIAS("dmi:*:rnJFL92:rvrIFT00:*");
 MODULE_ALIAS("dmi:*:rnIFT00:rvrIFT00:*");
+MODULE_ALIAS("dmi:*:svnDellInc.:pnInspiron910:*");
+MODULE_ALIAS("dmi:*:svnDellInc.:pnInspiron1010:*");
+MODULE_ALIAS("dmi:*:svnDellInc.:pnInspiron1011:*");
+MODULE_ALIAS("dmi:*:svnDellInc.:pnInspiron1110:*");
+MODULE_ALIAS("dmi:*:svnDellInc.:pnInspiron1210:*");
--- linux-rt-2.6.31.orig/drivers/platform/x86/acerhdf.c
+++ linux-rt-2.6.31/drivers/platform/x86/acerhdf.c
@@ -52,7 +52,7 @@
  */
 #undef START_IN_KERNEL_MODE
 
-#define DRV_VER "0.5.13"
+#define DRV_VER "0.5.16"
 
 /*
  * According to the Atom N270 datasheet,
@@ -61,7 +61,7 @@
  * measured by the on-die thermal monitor are within 0 <= Tj <= 90. So,
  * assume 89°C is critical temperature.
  */
-#define ACERHDF_TEMP_CRIT 89
+#define ACERHDF_TEMP_CRIT 89000
 #define ACERHDF_FAN_OFF 0
 #define ACERHDF_FAN_AUTO 1
 
@@ -69,7 +69,7 @@
  * No matter what value the user puts into the fanon variable, turn on the fan
  * at 80 degree Celsius to prevent hardware damage
  */
-#define ACERHDF_MAX_FANON 80
+#define ACERHDF_MAX_FANON 80000
 
 /*
  * Maximum interval between two temperature checks is 15 seconds, as the die
@@ -85,11 +85,12 @@
 #endif
 
 static unsigned int interval = 10;
-static unsigned int fanon = 63;
-static unsigned int fanoff = 58;
+static unsigned int fanon = 63000;
+static unsigned int fanoff = 58000;
 static unsigned int verbose;
 static unsigned int fanstate = ACERHDF_FAN_AUTO;
 static char force_bios[16];
+static char force_product[16];
 static unsigned int prev_interval;
 struct thermal_zone_device *thz_dev;
 struct thermal_cooling_device *cl_dev;
@@ -107,34 +108,62 @@
 MODULE_PARM_DESC(verbose, "Enable verbose dmesg output");
 module_param_string(force_bios, force_bios, 16, 0);
 MODULE_PARM_DESC(force_bios, "Force BIOS version and omit BIOS check");
+module_param_string(force_product, force_product, 16, 0);
+MODULE_PARM_DESC(force_product, "Force BIOS product and omit BIOS check");
+
+/*
+ * cmd_off: to switch the fan completely off / to check if the fan is off
+ *	cmd_auto: to set the BIOS in control of the fan. The BIOS regulates then
+ *		the fan speed depending on the temperature
+ */
+struct fancmd {
+	u8 cmd_off;
+	u8 cmd_auto;
+};
 
 /* BIOS settings */
 struct bios_settings_t {
 	const char *vendor;
+	const char *product;
 	const char *version;
 	unsigned char fanreg;
 	unsigned char tempreg;
-	unsigned char fancmd[2]; /* fan off and auto commands */
+	struct fancmd cmd;
 };
 
 /* Register addresses and values for different BIOS versions */
 static const struct bios_settings_t bios_tbl[] = {
-	{"Acer", "v0.3109", 0x55, 0x58, {0x1f, 0x00} },
-	{"Acer", "v0.3114", 0x55, 0x58, {0x1f, 0x00} },
-	{"Acer", "v0.3301", 0x55, 0x58, {0xaf, 0x00} },
-	{"Acer", "v0.3304", 0x55, 0x58, {0xaf, 0x00} },
-	{"Acer", "v0.3305", 0x55, 0x58, {0xaf, 0x00} },
-	{"Acer", "v0.3308", 0x55, 0x58, {0x21, 0x00} },
-	{"Acer", "v0.3309", 0x55, 0x58, {0x21, 0x00} },
-	{"Acer", "v0.3310", 0x55, 0x58, {0x21, 0x00} },
-	{"Gateway", "v0.3103", 0x55, 0x58, {0x21, 0x00} },
-	{"Packard Bell", "v0.3105", 0x55, 0x58, {0x21, 0x00} },
-	{"", "", 0, 0, {0, 0} }
+	/* AOA110 */
+	{"Acer", "AOA110", "v0.3109", 0x55, 0x58, {0x1f, 0x00} },
+	{"Acer", "AOA110", "v0.3114", 0x55, 0x58, {0x1f, 0x00} },
+	{"Acer", "AOA110", "v0.3301", 0x55, 0x58, {0xaf, 0x00} },
+	{"Acer", "AOA110", "v0.3304", 0x55, 0x58, {0xaf, 0x00} },
+	{"Acer", "AOA110", "v0.3305", 0x55, 0x58, {0xaf, 0x00} },
+	{"Acer", "AOA110", "v0.3307", 0x55, 0x58, {0xaf, 0x00} },
+	{"Acer", "AOA110", "v0.3308", 0x55, 0x58, {0x21, 0x00} },
+	{"Acer", "AOA110", "v0.3309", 0x55, 0x58, {0x21, 0x00} },
+	{"Acer", "AOA110", "v0.3310", 0x55, 0x58, {0x21, 0x00} },
+	/* AOA150 */
+	{"Acer", "AOA150", "v0.3114", 0x55, 0x58, {0x20, 0x00} },
+	{"Acer", "AOA150", "v0.3301", 0x55, 0x58, {0x20, 0x00} },
+	{"Acer", "AOA150", "v0.3304", 0x55, 0x58, {0x20, 0x00} },
+	{"Acer", "AOA150", "v0.3305", 0x55, 0x58, {0x20, 0x00} },
+	{"Acer", "AOA150", "v0.3307", 0x55, 0x58, {0x20, 0x00} },
+	{"Acer", "AOA150", "v0.3308", 0x55, 0x58, {0x20, 0x00} },
+	{"Acer", "AOA150", "v0.3309", 0x55, 0x58, {0x20, 0x00} },
+	{"Acer", "AOA150", "v0.3310", 0x55, 0x58, {0x20, 0x00} },
+	/* special BIOS / other */
+	{"Gateway", "AOA110", "v0.3103", 0x55, 0x58, {0x21, 0x00} },
+	{"Gateway", "AOA150", "v0.3103", 0x55, 0x58, {0x20, 0x00} },
+	{"Packard Bell", "DOA150", "v0.3104", 0x55, 0x58, {0x21, 0x00} },
+	{"Packard Bell", "AOA110", "v0.3105", 0x55, 0x58, {0x21, 0x00} },
+	{"Packard Bell", "AOA150", "v0.3105", 0x55, 0x58, {0x20, 0x00} },
+	/* pewpew-terminator */
+	{"", "", "", 0, 0, {0, 0} }
 };
 
 static const struct bios_settings_t *bios_cfg __read_mostly;
 
-
 static int acerhdf_get_temp(int *temp)
 {
 	u8 read_temp;
@@ -142,7 +171,7 @@
 	if (ec_read(bios_cfg->tempreg, &read_temp))
 		return -EINVAL;
 
-	*temp = read_temp;
+	*temp = read_temp * 1000;
 
 	return 0;
 }
@@ -150,13 +179,14 @@
 static int acerhdf_get_fanstate(int *state)
 {
 	u8 fan;
-	bool tmp;
 
 	if (ec_read(bios_cfg->fanreg, &fan))
 		return -EINVAL;
 
-	tmp = (fan == bios_cfg->fancmd[ACERHDF_FAN_OFF]);
-	*state = tmp ? ACERHDF_FAN_OFF : ACERHDF_FAN_AUTO;
+	if (fan != bios_cfg->cmd.cmd_off)
+		*state = ACERHDF_FAN_AUTO;
+	else
+		*state = ACERHDF_FAN_OFF;
 
 	return 0;
 }
@@ -175,7 +205,8 @@
 		state = ACERHDF_FAN_AUTO;
 	}
 
-	cmd = bios_cfg->fancmd[state];
+	cmd = (state == ACERHDF_FAN_OFF) ? bios_cfg->cmd.cmd_off
+					 : bios_cfg->cmd.cmd_auto;
 	fanstate = state;
 
 	ec_write(bios_cfg->fanreg, cmd);
@@ -437,7 +468,7 @@
 	return 0;
 }
 
-struct platform_driver acerhdf_drv = {
+static struct platform_driver acerhdf_driver = {
 	.driver = {
 		.name = "acerhdf",
 		.owner = THIS_MODULE,
@@ -454,32 +485,40 @@
 {
 	char const *vendor, *version, *product;
 	int i;
+	unsigned long prod_len = 0;
 
 	/* get BIOS data */
 	vendor  = dmi_get_system_info(DMI_SYS_VENDOR);
 	version = dmi_get_system_info(DMI_BIOS_VERSION);
 	product = dmi_get_system_info(DMI_PRODUCT_NAME);
 
+
 	pr_info("Acer Aspire One Fan driver, v.%s\n", DRV_VER);
 
-	if (!force_bios[0]) {
-		if (strncmp(product, "AO", 2)) {
-			pr_err("no Aspire One hardware found\n");
-			return -EINVAL;
-		}
-	} else {
-		pr_info("forcing BIOS version: %s\n", version);
+	if (force_bios[0]) {
 		version = force_bios;
+		pr_info("forcing BIOS version: %s\n", version);
 		kernelmode = 0;
 	}
 
+	if (force_product[0]) {
+		product = force_product;
+		pr_info("forcing BIOS product: %s\n", product);
+		kernelmode = 0;
+	}
+
+	prod_len = strlen(product);
+
 	if (verbose)
 		pr_info("BIOS info: %s %s, product: %s\n",
 			vendor, version, product);
 
 	/* search BIOS version and vendor in BIOS settings table */
 	for (i = 0; bios_tbl[i].version[0]; i++) {
-		if (!strcmp(bios_tbl[i].vendor, vendor) &&
+		if (strlen(bios_tbl[i].product) >= prod_len &&
+		    !strncmp(bios_tbl[i].product, product,
+			   strlen(bios_tbl[i].product)) &&
+		    !strcmp(bios_tbl[i].vendor, vendor) &&
 		    !strcmp(bios_tbl[i].version, version)) {
 			bios_cfg = &bios_tbl[i];
 			break;
@@ -487,8 +526,8 @@
 	}
 
 	if (!bios_cfg) {
-		pr_err("unknown (unsupported) BIOS version %s/%s, "
-			"please report, aborting!\n", vendor, version);
+		pr_err("unknown (unsupported) BIOS version %s/%s/%s, "
+			"please report, aborting!\n", vendor, product, version);
 		return -EINVAL;
 	}
 
@@ -509,7 +548,7 @@
 {
 	int err = 0;
 
-	err = platform_driver_register(&acerhdf_drv);
+	err = platform_driver_register(&acerhdf_driver);
 	if (err)
 		return err;
 
@@ -525,7 +564,7 @@
 		return;
 
 	platform_device_del(acerhdf_dev);
-	platform_driver_unregister(&acerhdf_drv);
+	platform_driver_unregister(&acerhdf_driver);
 }
 
 static int acerhdf_register_thermal(void)
@@ -594,9 +633,10 @@
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Peter Feuerer");
 MODULE_DESCRIPTION("Aspire One temperature and fan driver");
-MODULE_ALIAS("dmi:*:*Acer*:*:");
-MODULE_ALIAS("dmi:*:*Gateway*:*:");
-MODULE_ALIAS("dmi:*:*Packard Bell*:*:");
+MODULE_ALIAS("dmi:*:*Acer*:pnAOA*:");
+MODULE_ALIAS("dmi:*:*Gateway*:pnAOA*:");
+MODULE_ALIAS("dmi:*:*Packard Bell*:pnAOA*:");
+MODULE_ALIAS("dmi:*:*Packard Bell*:pnDOA*:");
 
 module_init(acerhdf_init);
 module_exit(acerhdf_exit);
--- linux-rt-2.6.31.orig/drivers/platform/x86/asus-laptop.c
+++ linux-rt-2.6.31/drivers/platform/x86/asus-laptop.c
@@ -1172,8 +1172,8 @@
 	hotk->ledd_status = 0xFFF;
 
 	/* Set initial values of light sensor and level */
-	hotk->light_switch = 1;	/* Default to light sensor disabled */
-	hotk->light_level = 0;	/* level 5 for sensor sensitivity */
+	hotk->light_switch = 0;	/* Default to light sensor disabled */
+	hotk->light_level = 5;	/* level 5 for sensor sensitivity */
 
 	if (ls_switch_handle)
 		set_light_sens_switch(hotk->light_switch);
--- linux-rt-2.6.31.orig/drivers/platform/x86/thinkpad_acpi.c
+++ linux-rt-2.6.31/drivers/platform/x86/thinkpad_acpi.c
@@ -3406,15 +3406,6 @@
 
 #define TPACPI_RFK_BLUETOOTH_SW_NAME	"tpacpi_bluetooth_sw"
 
-static void bluetooth_suspend(pm_message_t state)
-{
-	/* Try to make sure radio will resume powered off */
-	if (!acpi_evalf(NULL, NULL, "\\BLTH", "vd",
-		   TP_ACPI_BLTH_PWR_OFF_ON_RESUME))
-		vdbg_printk(TPACPI_DBG_RFKILL,
-			"bluetooth power down on resume request failed\n");
-}
-
 static int bluetooth_get_status(void)
 {
 	int status;
@@ -3448,10 +3439,9 @@
 #endif
 
 	/* We make sure to keep TP_ACPI_BLUETOOTH_RESUMECTRL off */
+	status = TP_ACPI_BLUETOOTH_RESUMECTRL;
 	if (state == TPACPI_RFK_RADIO_ON)
-		status = TP_ACPI_BLUETOOTH_RADIOSSW;
-	else
-		status = 0;
+		status |= TP_ACPI_BLUETOOTH_RADIOSSW;
 
 	if (!acpi_evalf(hkey_handle, NULL, "SBDC", "vd", status))
 		return -EIO;
@@ -3590,7 +3580,6 @@
 	.read = bluetooth_read,
 	.write = bluetooth_write,
 	.exit = bluetooth_exit,
-	.suspend = bluetooth_suspend,
 	.shutdown = bluetooth_shutdown,
 };
 
@@ -3608,15 +3597,6 @@
 
 #define TPACPI_RFK_WWAN_SW_NAME		"tpacpi_wwan_sw"
 
-static void wan_suspend(pm_message_t state)
-{
-	/* Try to make sure radio will resume powered off */
-	if (!acpi_evalf(NULL, NULL, "\\WGSV", "qvd",
-		   TP_ACPI_WGSV_PWR_OFF_ON_RESUME))
-		vdbg_printk(TPACPI_DBG_RFKILL,
-			"WWAN power down on resume request failed\n");
-}
-
 static int wan_get_status(void)
 {
 	int status;
@@ -3649,11 +3629,10 @@
 	}
 #endif
 
-	/* We make sure to keep TP_ACPI_WANCARD_RESUMECTRL off */
+	/* We make sure to set TP_ACPI_WANCARD_RESUMECTRL */
+	status = TP_ACPI_WANCARD_RESUMECTRL;
 	if (state == TPACPI_RFK_RADIO_ON)
-		status = TP_ACPI_WANCARD_RADIOSSW;
-	else
-		status = 0;
+		status |= TP_ACPI_WANCARD_RADIOSSW;
 
 	if (!acpi_evalf(hkey_handle, NULL, "SWAN", "vd", status))
 		return -EIO;
@@ -3791,7 +3770,6 @@
 	.read = wan_read,
 	.write = wan_write,
 	.exit = wan_exit,
-	.suspend = wan_suspend,
 	.shutdown = wan_shutdown,
 };
 
@@ -5655,16 +5633,16 @@
 	/* Models with ATI GPUs known to require ECNVRAM mode */
 	TPACPI_Q_IBM('1', 'Y', TPACPI_BRGHT_Q_EC),	/* T43/p ATI */
 
-	/* Models with ATI GPUs (waiting confirmation) */
-	TPACPI_Q_IBM('1', 'R', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_EC),
+	/* Models with ATI GPUs that can use ECNVRAM */
+	TPACPI_Q_IBM('1', 'R', TPACPI_BRGHT_Q_EC),
 	TPACPI_Q_IBM('1', 'Q', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_EC),
 	TPACPI_Q_IBM('7', '6', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_EC),
 	TPACPI_Q_IBM('7', '8', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_EC),
 
-	/* Models with Intel Extreme Graphics 2 (waiting confirmation) */
-	TPACPI_Q_IBM('1', 'V', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_NOEC),
-	TPACPI_Q_IBM('1', 'W', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_NOEC),
-	TPACPI_Q_IBM('1', 'U', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_NOEC),
+	/* Models with Intel Extreme Graphics 2 */
+	TPACPI_Q_IBM('1', 'U', TPACPI_BRGHT_Q_NOEC),
+	TPACPI_Q_IBM('1', 'V', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_EC),
+	TPACPI_Q_IBM('1', 'W', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_EC),
 
 	/* Models with Intel GMA900 */
 	TPACPI_Q_IBM('7', '0', TPACPI_BRGHT_Q_NOEC),	/* T43, R52 */
@@ -5863,7 +5841,7 @@
 	 * Doing it this way makes the syscall restartable in case of EINTR
 	 */
 	rc = brightness_set(level);
-	return (rc == -EINTR)? ERESTARTSYS : rc;
+	return (rc == -EINTR)? -ERESTARTSYS : rc;
 }
 
 static struct ibm_struct brightness_driver_data = {
--- linux-rt-2.6.31.orig/drivers/platform/x86/dell-laptop.c
+++ linux-rt-2.6.31/drivers/platform/x86/dell-laptop.c
@@ -22,9 +22,14 @@
 #include <linux/rfkill.h>
 #include <linux/power_supply.h>
 #include <linux/acpi.h>
+#include <linux/input.h>
 #include "../../firmware/dcdbas.h"
 
 #define BRIGHTNESS_TOKEN 0x7d
+#define WLAN_SWITCH_MASK 0
+#define BT_SWITCH_MASK 1
+#define WWAN_SWITCH_MASK 2
+#define HW_SWITCH_MASK 16
 
 /* This structure will be modified by the firmware when we enter
  * system management mode, hence the volatiles */
@@ -63,6 +68,13 @@
 static struct rfkill *bluetooth_rfkill;
 static struct rfkill *wwan_rfkill;
 
+/*
+ * RFkill status is maintained in software because the BIOS has an annoying
+ * habit of emitting a KEY_WLAN key press event before the BIOS state is updated, making
+ * dell_send_request() racy.
+ */
+static int   hw_switch_status;
+
 static const struct dmi_system_id __initdata dell_device_table[] = {
 	{
 		.ident = "Dell laptop",
@@ -74,6 +86,54 @@
 	{ }
 };
 
+static struct dmi_system_id __devinitdata dell_blacklist[] = {
+	/* BIOS always returns HW switch disabled */
+	{
+		.ident = "Dell Vostro 1720",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Vostro 1720"),
+		},
+	},
+	/* Supported by compal-laptop */
+	{
+		.ident = "Dell Mini 9",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 910"),
+		},
+	},
+	{
+		.ident = "Dell Mini 10",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 1010"),
+		},
+	},
+	{
+		.ident = "Dell Mini 10v",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 1011"),
+		},
+	},
+	{
+		.ident = "Dell Inspiron 11z",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 1110"),
+		},
+	},
+	{
+		.ident = "Dell Mini 12",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 1210"),
+		},
+	},
+	{}
+};
+
 static void parse_da_table(const struct dmi_header *dm)
 {
 	/* Final token is a terminator, so we don't want to copy it */
@@ -180,10 +240,11 @@
 	int disable = blocked ? 1 : 0;
 	unsigned long radio = (unsigned long)data;
 
-	memset(&buffer, 0, sizeof(struct calling_interface_buffer));
-	buffer.input[0] = (1 | (radio<<8) | (disable << 16));
-	dell_send_request(&buffer, 17, 11);
-
+	if (!(hw_switch_status & BIT(radio-1)) || !(hw_switch_status & BIT(HW_SWITCH_MASK))) {
+		memset(&buffer, 0, sizeof(struct calling_interface_buffer));
+		buffer.input[0] = (1 | (radio<<8) | (disable << 16));
+		dell_send_request(&buffer, 17, 11);
+	}
 	return 0;
 }
 
@@ -191,14 +252,32 @@
 {
 	struct calling_interface_buffer buffer;
 	int status;
-	int bit = (unsigned long)data + 16;
+	int bit = (unsigned long)data - 1;
 
 	memset(&buffer, 0, sizeof(struct calling_interface_buffer));
 	dell_send_request(&buffer, 17, 11);
 	status = buffer.output[1];
 
-	if (status & BIT(bit))
-		rfkill_set_hw_state(rfkill, !!(status & BIT(16)));
+	hw_switch_status |= (status & BIT(HW_SWITCH_MASK)) ^ BIT(HW_SWITCH_MASK);
+
+	/* HW switch control not supported
+	   explicitly set it to all 3 as they'll change in unison then */
+	if (!(status & BIT(0)))
+		hw_switch_status |= BIT(WLAN_SWITCH_MASK) | BIT(BT_SWITCH_MASK) | (WWAN_SWITCH_MASK);
+	else {
+		/* rerun the query to see what is really supported */
+		memset(&buffer, 0, sizeof(struct calling_interface_buffer));
+		buffer.input[0] = 2;
+		dell_send_request(&buffer, 17, 11);
+		status = buffer.output[1];
+
+		hw_switch_status |= status & BIT(bit);
+	}
+
+	if (hw_switch_status & BIT(bit))
+		rfkill_set_hw_state(rfkill, hw_switch_status & BIT(HW_SWITCH_MASK));
+	else
+		rfkill_set_hw_state(rfkill, 0);
 }
 
 static const struct rfkill_ops dell_rfkill_ops = {
@@ -206,11 +285,35 @@
 	.query = dell_rfkill_query,
 };
 
+/*
+ * Called for each KEY_WLAN key press event. Note that a physical
+ * rf-kill switch change also causes the BIOS to emit a KEY_WLAN.
+ */
+static void dell_rfkill_update(void)
+{
+	hw_switch_status ^= BIT(HW_SWITCH_MASK);
+	if (wifi_rfkill && (hw_switch_status & BIT(WLAN_SWITCH_MASK))) {
+		rfkill_set_hw_state(wifi_rfkill, hw_switch_status & BIT(HW_SWITCH_MASK));
+		dell_rfkill_set((void*)1, rfkill_blocked(wifi_rfkill));
+	}
+
+	if (bluetooth_rfkill && (hw_switch_status & BIT(BT_SWITCH_MASK))) {
+		rfkill_set_hw_state(bluetooth_rfkill, hw_switch_status & BIT(HW_SWITCH_MASK));
+		dell_rfkill_set((void*)2, rfkill_blocked(bluetooth_rfkill));
+	}
+
+	if (wwan_rfkill && (hw_switch_status & BIT(WWAN_SWITCH_MASK))) {
+		rfkill_set_hw_state(wwan_rfkill, hw_switch_status & BIT(HW_SWITCH_MASK));
+		dell_rfkill_set((void*)3, rfkill_blocked(wwan_rfkill));
+	}
+}
+
 static int dell_setup_rfkill(void)
 {
 	struct calling_interface_buffer buffer;
 	int status;
 	int ret;
+	hw_switch_status = 0;
 
 	memset(&buffer, 0, sizeof(struct calling_interface_buffer));
 	dell_send_request(&buffer, 17, 11);
@@ -310,6 +413,90 @@
 	.update_status  = dell_send_intensity,
 };
 
+static const struct input_device_id dell_input_ids[] = {
+	{
+		.bustype = 0x11,
+		.vendor = 0x01,
+		.product = 0x01,
+		.version = 0xab41,
+		.flags = INPUT_DEVICE_ID_MATCH_BUS |
+			 INPUT_DEVICE_ID_MATCH_VENDOR |
+			 INPUT_DEVICE_ID_MATCH_PRODUCT |
+			 INPUT_DEVICE_ID_MATCH_VERSION
+	},
+	{ },
+};
+
+static bool dell_input_filter(struct input_handle *handle, unsigned int type,
+			     unsigned int code, int value)
+{
+	if (type == EV_KEY && code == KEY_WLAN && value == 1) {
+		dell_rfkill_update();
+		return 1;
+	}
+
+	return 0;
+}
+
+static void dell_input_event(struct input_handle *handle, unsigned int type,
+			     unsigned int code, int value)
+{
+}
+
+static int dell_input_connect(struct input_handler *handler,
+			      struct input_dev *dev,
+			      const struct input_device_id *id)
+{
+	struct input_handle *handle;
+	int error;
+
+	handle = kzalloc(sizeof(struct input_handle), GFP_KERNEL);
+	if (!handle)
+		return -ENOMEM;
+
+	handle->dev = dev;
+	handle->handler = handler;
+	handle->name = "dell-laptop";
+
+	error = input_register_handle(handle);
+	if (error)
+		goto err_free_handle;
+
+	error = input_open_device(handle);
+	if (error)
+		goto err_unregister_handle;
+
+	error = input_filter_device(handle);
+	if (error)
+		goto err_close_handle;
+
+	return 0;
+
+err_close_handle:
+	input_close_device(handle);
+err_unregister_handle:
+	input_unregister_handle(handle);
+err_free_handle:
+	kfree(handle);
+	return error;
+}
+
+static void dell_input_disconnect(struct input_handle *handle)
+{
+	input_close_device(handle);
+	input_unregister_handle(handle);
+	kfree(handle);
+}
+
+static struct input_handler dell_input_handler = {
+	.name = "dell-laptop",
+	.filter = dell_input_filter,
+	.event = dell_input_event,
+	.connect = dell_input_connect,
+	.disconnect = dell_input_disconnect,
+	.id_table = dell_input_ids,
+};
+
 static int __init dell_init(void)
 {
 	struct calling_interface_buffer buffer;
@@ -319,6 +506,12 @@
 	if (!dmi_check_system(dell_device_table))
 		return -ENODEV;
 
+	if (dmi_check_system(dell_blacklist)) {
+		printk(KERN_INFO "dell-laptop: Blacklisted hardware detected - "
+				"not loading\n");
+		return -ENODEV;
+	}
+
 	dmi_walk(find_tokens, NULL);
 
 	if (!da_tokens)  {
@@ -333,6 +526,10 @@
 		goto out;
 	}
 
+	if (input_register_handler(&dell_input_handler))
+		printk(KERN_INFO
+		       "dell-laptop: Could not register input filter\n");
+
 #ifdef CONFIG_ACPI
 	/* In the event of an ACPI backlight being available, don't
 	 * register the platform controller.
@@ -388,6 +585,7 @@
 		rfkill_unregister(bluetooth_rfkill);
 	if (wwan_rfkill)
 		rfkill_unregister(wwan_rfkill);
+	input_unregister_handler(&dell_input_handler);
 }
 
 module_init(dell_init);
--- linux-rt-2.6.31.orig/drivers/platform/x86/dell-wmi.c
+++ linux-rt-2.6.31/drivers/platform/x86/dell-wmi.c
@@ -40,6 +40,10 @@
 
 MODULE_ALIAS("wmi:"DELL_EVENT_GUID);
 
+/* Temporary workaround until the WMI sysfs interface goes in.
+   Borrowed from acer-wmi */
+MODULE_ALIAS("dmi:*:*Dell*:*:");
+
 struct key_entry {
 	char type;		/* See KE_* below */
 	u16 code;
--- linux-rt-2.6.31.orig/drivers/platform/x86/sony-laptop.c
+++ linux-rt-2.6.31/drivers/platform/x86/sony-laptop.c
@@ -1081,6 +1081,8 @@
 	struct rfkill *rfk;
 	enum rfkill_type type;
 	const char *name;
+	int result;
+	bool hwblock;
 
 	switch (nc_type) {
 	case SONY_WIFI:
@@ -1108,6 +1110,10 @@
 	if (!rfk)
 		return -ENOMEM;
 
+	sony_call_snc_handle(0x124, 0x200, &result);
+	hwblock = !(result & 0x1);
+	rfkill_set_hw_state(rfk, hwblock);
+
 	err = rfkill_register(rfk);
 	if (err) {
 		rfkill_destroy(rfk);
@@ -1399,10 +1405,13 @@
 	u16				evport_offset;
 	u8				has_camera;
 	u8				has_bluetooth;
-	u8				has_wwan;
 	struct sonypi_eventtypes	*event_types;
 };
 
+struct sony_pic_quirk_entry {
+	u8				set_wwan_power;
+};
+
 struct sony_pic_dev {
 	struct device_ctrl	*control;
 	struct acpi_device	*acpi_dev;
@@ -1411,6 +1420,7 @@
 	struct list_head	interrupts;
 	struct list_head	ioports;
 	struct mutex		lock;
+	struct sony_pic_quirk_entry *quirks;
 	u8			camera_power;
 	u8			bluetooth_power;
 	u8			wwan_power;
@@ -2844,6 +2854,12 @@
 	if (result)
 		goto err_remove_pf;
 
+	if (spic_dev.quirks && spic_dev.quirks->set_wwan_power) {
+		/*
+		 * Power isn't enabled by default.
+		 */
+		__sony_pic_set_wwanpower(1);
+	}
 	return 0;
 
 err_remove_pf:
@@ -2914,6 +2930,16 @@
 		},
 };
 
+static struct sony_pic_quirk_entry sony_pic_vaio_vgn = {
+	.set_wwan_power = 1,
+};
+
+static int dmi_matched(const struct dmi_system_id *dmi)
+{
+	spic_dev.quirks = dmi->driver_data;
+	return 0;
+}
+
 static struct dmi_system_id __initdata sonypi_dmi_table[] = {
 	{
 		.ident = "Sony Vaio",
@@ -2928,6 +2954,8 @@
 			DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "VGN-"),
 		},
+		.callback = dmi_matched,
+		.driver_data = &sony_pic_vaio_vgn,
 	},
 	{ }
 };
--- linux-rt-2.6.31.orig/drivers/platform/x86/toshiba_acpi.c
+++ linux-rt-2.6.31/drivers/platform/x86/toshiba_acpi.c
@@ -28,13 +28,28 @@
  *		engineering the Windows drivers
  *	Yasushi Nagato - changes for linux kernel 2.4 -> 2.5
  *	Rob Miller - TV out and hotkeys help
+ *      Daniel Silverstone - Punting of hotkeys via acpi using a thread    	
  *
+ *  PLEASE NOTE
+ *
+ *  This is an experimental version of toshiba_acpi which includes emulation
+ *  of the original toshiba driver's /proc/toshiba and /dev/toshiba,
+ *  allowing Toshiba userspace utilities to work.  The relevant code was
+ *  based on toshiba.c (copyright 1996-2001 Jonathan A. Buzzard) and
+ *  incorporated into this driver with help from Gintautas Miliauskas,
+ *  Charles Schwieters, and Christoph Burger-Scheidlin.
+ *
+ *  Caveats:
+ *      * hotkey status in /proc/toshiba is not implemented
+ *      * to make accesses to /dev/toshiba load this driver instead of
+ *          the original driver, you will have to modify your module
+ *          auto-loading configuration
  *
  *  TODO
  *
  */
 
-#define TOSHIBA_ACPI_VERSION	"0.19"
+#define TOSHIBA_ACPI_VERSION	"0.19-dev-acpikeys"
 #define PROC_INTERFACE_VERSION	1
 
 #include <linux/kernel.h>
@@ -42,9 +57,15 @@
 #include <linux/init.h>
 #include <linux/types.h>
 #include <linux/proc_fs.h>
+#include <linux/seq_file.h>
+#include <linux/miscdevice.h>
+#include <linux/toshiba.h>
+#include <asm/io.h>
 #include <linux/backlight.h>
 #include <linux/platform_device.h>
 #include <linux/rfkill.h>
+#include <linux/input-polldev.h>
+#include <linux/freezer.h>
 
 #include <asm/uaccess.h>
 
@@ -356,6 +377,11 @@
 static int force_fan;
 static int last_key_event;
 static int key_event_valid;
+static int hotkeys_over_acpi = 1;
+static int hotkeys_check_per_sec = 2;
+
+module_param(hotkeys_over_acpi, uint, 0400);
+module_param(hotkeys_check_per_sec, uint, 0400);
 
 typedef struct _ProcItem {
 	const char *name;
@@ -583,27 +609,34 @@
 	u32 hci_result;
 	u32 value;
 
-	if (!key_event_valid) {
-		hci_read1(HCI_SYSTEM_EVENT, &value, &hci_result);
-		if (hci_result == HCI_SUCCESS) {
-			key_event_valid = 1;
-			last_key_event = value;
-		} else if (hci_result == HCI_EMPTY) {
-			/* better luck next time */
-		} else if (hci_result == HCI_NOT_SUPPORTED) {
-			/* This is a workaround for an unresolved issue on
-			 * some machines where system events sporadically
-			 * become disabled. */
-			hci_write1(HCI_SYSTEM_EVENT, 1, &hci_result);
-			printk(MY_NOTICE "Re-enabled hotkeys\n");
-		} else {
-			printk(MY_ERR "Error reading hotkey status\n");
-			goto end;
+	if (!hotkeys_over_acpi) {
+		if (!key_event_valid) {
+			hci_read1(HCI_SYSTEM_EVENT, &value, &hci_result);
+			if (hci_result == HCI_SUCCESS) {
+				key_event_valid = 1;
+				last_key_event = value;
+			} else if (hci_result == HCI_EMPTY) {
+				/* better luck next time */
+			} else if (hci_result == HCI_NOT_SUPPORTED) {
+				/* This is a workaround for an
+				 * unresolved issue on some machines
+				 * where system events sporadically
+				 * become disabled. */
+				hci_write1(HCI_SYSTEM_EVENT, 1, &hci_result);
+				printk(MY_NOTICE "Re-enabled hotkeys\n");
+			} else {
+				printk(MY_ERR "Error reading hotkey status\n");
+				goto end;
+			}
 		}
+	} else {
+		key_event_valid = 0;
+		last_key_event = 0;
 	}
 
 	p += sprintf(p, "hotkey_ready:            %d\n", key_event_valid);
 	p += sprintf(p, "hotkey:                  0x%04x\n", last_key_event);
+	p += sprintf(p, "hotkeys_via_acpi:        %d\n", hotkeys_over_acpi);
 
       end:
 	return p;
@@ -630,6 +663,191 @@
 	return p;
 }
 
+/* /dev/toshiba and /proc/toshiba handlers {{{
+ *
+ * ISSUE: lots of magic numbers and mysterious code
+ */
+
+#define TOSH_MINOR_DEV		181
+#define OLD_PROC_TOSHIBA	"toshiba"
+
+static int
+tosh_acpi_bridge(SMMRegisters* regs)
+{
+	acpi_status status;
+
+	/* assert(sizeof(SMMRegisters) == sizeof(u32)*HCI_WORDS); */
+	status = hci_raw((u32*)regs, (u32*)regs);
+	if (status == AE_OK && (regs->eax & 0xff00) == HCI_SUCCESS)
+		return 0;
+
+	return -EINVAL;
+}
+
+static int
+tosh_ioctl(struct inode* ip, struct file* fp, unsigned int cmd,
+	unsigned long arg)
+{
+	SMMRegisters regs;
+	unsigned short ax,bx;
+	int err;
+
+	if ((!arg) || (cmd != TOSH_SMM))
+		return -EINVAL;
+
+	if (copy_from_user(&regs, (SMMRegisters*)arg, sizeof(SMMRegisters)))
+		return -EFAULT;
+
+	ax = regs.eax & 0xff00;
+	bx = regs.ebx & 0xffff;
+
+	/* block HCI calls to read/write memory & PCI devices */
+	if (((ax==HCI_SET) || (ax==HCI_GET)) && (bx>0x0069))
+		return -EINVAL;
+
+	err = tosh_acpi_bridge(&regs);
+
+	if (copy_to_user((SMMRegisters*)arg, &regs, sizeof(SMMRegisters)))
+		return -EFAULT;
+
+	return err;
+}
+
+static int
+tosh_get_machine_id(void __iomem *bios)
+{
+	int id;
+	unsigned short bx,cx;
+	unsigned long address;
+
+	id = (0x100*(int) readb(bios+0xfffe))+((int) readb(bios+0xfffa));
+
+	/* do we have a SCTTable machine identication number on our hands */
+	if (id==0xfc2f) {
+		bx = 0xe6f5; /* cheat */
+		/* now twiddle with our pointer a bit */
+		address = 0x00000000 + bx;
+		cx = readw(bios + address);
+		address = 0x00000009 + bx + cx;
+		cx = readw(bios + address);
+		address = 0x0000000a + cx;
+		cx = readw(bios + address);
+		/* now construct our machine identification number */
+		id = ((cx & 0xff)<<8)+((cx & 0xff00)>>8);
+	}
+
+	return id;
+}
+
+static int tosh_id;
+static int tosh_bios;
+static int tosh_date;
+static int tosh_sci;
+
+static struct file_operations tosh_fops = {
+	.owner = THIS_MODULE,
+	.ioctl = tosh_ioctl
+};
+
+static struct miscdevice tosh_device = {
+	TOSH_MINOR_DEV,
+	"toshiba",
+	&tosh_fops
+};
+
+static void
+setup_tosh_info(void __iomem *bios)
+{
+	int major, minor;
+	int day, month, year;
+
+	tosh_id = tosh_get_machine_id(bios);
+
+	/* get the BIOS version */
+	major = readb(bios + 0xe009)-'0';
+	minor = ((readb(bios + 0xe00b)-'0')*10)+(readb(bios + 0xe00c)-'0');
+	tosh_bios = (major*0x100)+minor;
+
+	/* get the BIOS date */
+	day = ((readb(bios + 0xfff5)-'0')*10)+(readb(bios + 0xfff6)-'0');
+	month = ((readb(bios + 0xfff8)-'0')*10)+(readb(bios + 0xfff9)-'0');
+	year = ((readb(bios + 0xfffb)-'0')*10)+(readb(bios + 0xfffc)-'0');
+	tosh_date = (((year-90) & 0x1f)<<10) | ((month & 0xf)<<6)
+		| ((day & 0x1f)<<1);
+}
+
+/* /proc/toshiba read handler */
+static int
+tosh_proc_show(struct seq_file *m, void *v)
+{
+	/* TODO: tosh_fn_status() */
+	int key = 0;
+
+	/* Format:
+	 *    0) Linux driver version (this will change if format changes)
+	 *    1) Machine ID
+	 *    2) SCI version
+	 *    3) BIOS version (major, minor)
+	 *    4) BIOS date (in SCI date format)
+	 *    5) Fn Key status
+	 */
+
+	seq_printf(m, "1.1 0x%04x %d.%d %d.%d 0x%04x 0x%02x\n",
+		tosh_id,
+		(tosh_sci & 0xff00)>>8,
+		tosh_sci & 0xff,
+		(tosh_bios & 0xff00)>>8,
+		tosh_bios & 0xff,
+		tosh_date,
+		key);
+
+	return 0;
+}
+
+static int tosh_proc_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, tosh_proc_show, NULL);
+}
+
+static const struct file_operations tosh_proc_fops = {
+	.owner		= THIS_MODULE,
+	.open		= tosh_proc_open,
+	.read		= seq_read,
+	.llseek		= seq_lseek,
+	.release	= single_release,
+};
+
+static int __init
+old_driver_emulation_init(void)
+{
+	int status;
+	void __iomem *bios = ioremap(0xf0000, 0x10000);
+	if (!bios)
+		return -ENOMEM;
+
+	if ((status = misc_register(&tosh_device))) {
+		printk(MY_ERR "failed to register misc device %d (\"%s\")\n",
+			tosh_device.minor, tosh_device.name);
+		return status;
+	}
+
+	setup_tosh_info(bios);
+	proc_create(OLD_PROC_TOSHIBA, 0, NULL, &tosh_proc_fops);
+
+	iounmap(bios);
+
+	return 0;
+}
+
+static void __exit
+old_driver_emulation_exit(void)
+{
+	remove_proc_entry(OLD_PROC_TOSHIBA, NULL);
+	misc_deregister(&tosh_device);
+}
+
+/* }}} end of /dev/toshiba and /proc/toshiba handlers */
+
 /* proc and module init
  */
 
@@ -676,6 +894,133 @@
         .update_status  = set_lcd_status,
 };
 
+static struct semaphore thread_sem;
+static int thread_should_die;
+
+static struct acpi_device *threaded_device = 0;
+
+static void thread_deliver_button_event(u32 value)
+{
+	if (!threaded_device) return;
+	if( value == 0x0100 ) {
+		/* Ignore FN on its own */
+	} else if( value & 0x80 ) {
+		acpi_bus_generate_proc_event( threaded_device, 1, value & ~0x80 );
+	} else {
+		acpi_bus_generate_proc_event( threaded_device, 0, value );
+	}
+}
+
+static int toshiba_acpi_thread(void *data)
+{
+	int dropped = 0;
+	u32 hci_result, value;
+
+	daemonize("ktoshkeyd");
+	set_user_nice(current, 4);
+	thread_should_die = 0;
+
+	up(&thread_sem);
+
+	do {
+		/* In case we get stuck; we can rmmod the module here */
+		if (thread_should_die)
+			break;
+
+		hci_read1(HCI_SYSTEM_EVENT, &value, &hci_result);
+		if (hci_result == HCI_SUCCESS) {
+			dropped++;
+		} else if (hci_result == HCI_EMPTY) {
+                         /* better luck next time */
+		} else if (hci_result == HCI_NOT_SUPPORTED) {
+			/* This is a workaround for an unresolved issue on
+			 * some machines where system events sporadically
+			 * become disabled. */
+			hci_write1(HCI_SYSTEM_EVENT, 1, &hci_result);
+			printk(MY_NOTICE "Re-enabled hotkeys\n");
+		}
+	} while (hci_result != HCI_EMPTY);
+
+	printk(MY_INFO "Dropped %d keys from the queue on startup\n", dropped);
+
+	for (;;) {
+		set_current_state(TASK_INTERRUPTIBLE);
+		schedule_timeout(HZ / hotkeys_check_per_sec);
+
+		if (thread_should_die)
+			break;
+
+		if (try_to_freeze())
+			continue;
+
+		do {
+			hci_read1(HCI_SYSTEM_EVENT, &value, &hci_result);
+			if (hci_result == HCI_SUCCESS) {
+				thread_deliver_button_event(value);
+			} else if (hci_result == HCI_EMPTY) {
+				/* better luck next time */
+			} else if (hci_result == HCI_NOT_SUPPORTED) {
+				/* This is a workaround for an
+				 * unresolved issue on some machines
+				 * where system events sporadically
+				 * become disabled. */
+				hci_write1(HCI_SYSTEM_EVENT, 1, &hci_result);
+				printk(MY_NOTICE "Re-enabled hotkeys\n");
+			}
+		} while (hci_result == HCI_SUCCESS);
+	}
+	set_user_nice(current, -20);	/* Become nasty so we are cleaned up
+					 * before the module exits making us oops */
+	up(&thread_sem);
+	return 0;
+}
+
+static int acpi_toshkeys_add (struct acpi_device *device)
+{
+	threaded_device = device;
+	strcpy(acpi_device_name(device), "Toshiba laptop hotkeys");
+	strcpy(acpi_device_class(device), "hkey");
+	return 0;
+}
+
+static int acpi_toshkeys_remove (struct acpi_device *device, int type)
+{
+	if (threaded_device == device)
+		threaded_device = 0;
+	return 0;
+}
+
+static const struct acpi_device_id acpi_toshkeys_ids[] = {
+	{ "TOS6200", 0 },
+	{ "TOS6207", 0 },
+	{ "TOS6208", 0 },
+ 	{"", 0}
+};
+
+static struct acpi_driver acpi_threaded_toshkeys = {
+	.name = "Toshiba laptop hotkeys driver",
+	.class = "hkey",
+	.ids = acpi_toshkeys_ids,
+	.ops = {
+		.add = acpi_toshkeys_add,
+		.remove = acpi_toshkeys_remove,
+	},
+};
+
+static int __init init_threaded_acpi(void)
+{
+        acpi_status result = AE_OK;
+        result = acpi_bus_register_driver(&acpi_threaded_toshkeys);
+        if( result < 0 )
+                printk(MY_ERR "Registration of toshkeys acpi device failed\n");
+        return result;
+}
+
+static void kill_threaded_acpi(void)
+{
+        acpi_bus_unregister_driver(&acpi_threaded_toshkeys);
+}
+
 static void toshiba_acpi_exit(void)
 {
 	if (toshiba_acpi.bt_rfk) {
@@ -686,11 +1031,19 @@
 	if (toshiba_backlight_device)
 		backlight_device_unregister(toshiba_backlight_device);
 
+	if (hotkeys_over_acpi) {
+		thread_should_die = 1;
+		down(&thread_sem);
+		kill_threaded_acpi();
+	}
+
 	remove_device();
 
 	if (toshiba_proc_dir)
 		remove_proc_entry(PROC_TOSHIBA, acpi_root_dir);
 
+	old_driver_emulation_exit();
+
 	platform_device_unregister(toshiba_acpi.p_dev);
 
 	return;
@@ -730,6 +1083,9 @@
 		return ret;
 	}
 
+	if ((ret = old_driver_emulation_init()))
+		return ret;
+
 	force_fan = 0;
 	key_event_valid = 0;
 
@@ -762,6 +1118,26 @@
 	}
         toshiba_backlight_device->props.max_brightness = HCI_LCD_BRIGHTNESS_LEVELS - 1;
 
+	if (hotkeys_over_acpi && ACPI_SUCCESS(status)) {
+		printk(MY_INFO "Toshiba hotkeys are sent as ACPI events\n");
+		if (hotkeys_check_per_sec < 1)
+			hotkeys_check_per_sec = 1;
+		if (hotkeys_check_per_sec > 10)
+			hotkeys_check_per_sec = 10;
+		printk(MY_INFO "ktoshkeyd will check %d time%s per second\n",
+			hotkeys_check_per_sec, hotkeys_check_per_sec==1?"":"s");
+		if (init_threaded_acpi() >= 0) {
+			init_MUTEX_LOCKED(&thread_sem);
+			kernel_thread(toshiba_acpi_thread, NULL, CLONE_KERNEL);
+			down(&thread_sem);
+		} else {
+			remove_device();
+			remove_proc_entry(PROC_TOSHIBA, acpi_root_dir);
+			status = AE_ERROR;
+			printk(MY_INFO "ktoshkeyd initialisation failed. Refusing to load module\n");
+		}
+	}
+
 	/* Register rfkill switch for Bluetooth */
 	if (hci_get_bt_present(&bt_present) == HCI_SUCCESS && bt_present) {
 		toshiba_acpi.bt_rfk = rfkill_alloc(toshiba_acpi.bt_name,
--- linux-rt-2.6.31.orig/include/Kbuild
+++ linux-rt-2.6.31/include/Kbuild
@@ -9,4 +9,3 @@
 header-y += video/
 header-y += drm/
 header-y += xen/
-header-y += scsi/
--- linux-rt-2.6.31.orig/include/pcmcia/ss.h
+++ linux-rt-2.6.31/include/pcmcia/ss.h
@@ -262,6 +262,8 @@
 	struct device			dev;
 	/* data internal to the socket driver */
 	void				*driver_data;
+	/* status of the card during resume from a system sleep state */
+	int				resume_status;
 };
 
 
@@ -279,7 +281,9 @@
 extern struct pccard_resource_ops pccard_nonstatic_ops;
 
 /* socket drivers are expected to use these callbacks in their .drv struct */
-extern int pcmcia_socket_dev_suspend(struct device *dev, pm_message_t state);
+extern int pcmcia_socket_dev_suspend(struct device *dev);
+extern void pcmcia_socket_dev_early_resume(struct device *dev);
+extern void pcmcia_socket_dev_late_resume(struct device *dev);
 extern int pcmcia_socket_dev_resume(struct device *dev);
 
 /* socket drivers use this callback in their IRQ handler */
--- linux-rt-2.6.31.orig/include/drm/drmP.h
+++ linux-rt-2.6.31/include/drm/drmP.h
@@ -1268,6 +1268,7 @@
 extern void drm_handle_vblank(struct drm_device *dev, int crtc);
 extern int drm_vblank_get(struct drm_device *dev, int crtc);
 extern void drm_vblank_put(struct drm_device *dev, int crtc);
+extern void drm_vblank_off(struct drm_device *dev, int crtc);
 extern void drm_vblank_cleanup(struct drm_device *dev);
 /* Modesetting support */
 extern void drm_vblank_pre_modeset(struct drm_device *dev, int crtc);
--- linux-rt-2.6.31.orig/include/drm/drm_pciids.h
+++ linux-rt-2.6.31/include/drm/drm_pciids.h
@@ -552,6 +552,7 @@
 	{0x8086, 0x2e12, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \
 	{0x8086, 0x2e22, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \
 	{0x8086, 0x2e32, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \
+	{0x8086, 0x2e42, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \
 	{0x8086, 0xa001, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \
 	{0x8086, 0xa011, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \
 	{0x8086, 0x35e8, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \
--- linux-rt-2.6.31.orig/include/scsi/scsi_host.h
+++ linux-rt-2.6.31/include/scsi/scsi_host.h
@@ -677,6 +677,12 @@
 	void *shost_data;
 
 	/*
+	 * Points to the physical bus device we'd use to do DMA
+	 * Needed just in case we have virtual hosts.
+	 */
+	struct device *dma_dev;
+
+	/*
 	 * We should ensure that this is aligned, both for better performance
 	 * and also because some compilers (m68k) don't automatically force
 	 * alignment to a long boundary.
@@ -720,7 +726,9 @@
 extern void scsi_flush_work(struct Scsi_Host *);
 
 extern struct Scsi_Host *scsi_host_alloc(struct scsi_host_template *, int);
-extern int __must_check scsi_add_host(struct Scsi_Host *, struct device *);
+extern int __must_check scsi_add_host_with_dma(struct Scsi_Host *,
+					       struct device *,
+					       struct device *);
 extern void scsi_scan_host(struct Scsi_Host *);
 extern void scsi_rescan_device(struct device *);
 extern void scsi_remove_host(struct Scsi_Host *);
@@ -731,6 +739,12 @@
 
 extern u64 scsi_calculate_bounce_limit(struct Scsi_Host *);
 
+static inline int __must_check scsi_add_host(struct Scsi_Host *host,
+					     struct device *dev)
+{
+	return scsi_add_host_with_dma(host, dev, dev);
+}
+
 static inline struct device *scsi_get_device(struct Scsi_Host *shost)
 {
         return shost->shost_gendev.parent;
--- linux-rt-2.6.31.orig/include/scsi/osd_protocol.h
+++ linux-rt-2.6.31/include/scsi/osd_protocol.h
@@ -17,6 +17,7 @@
 #define __OSD_PROTOCOL_H__
 
 #include <linux/types.h>
+#include <linux/kernel.h>
 #include <asm/unaligned.h>
 #include <scsi/scsi.h>
 
--- linux-rt-2.6.31.orig/include/linux/resource.h
+++ linux-rt-2.6.31/include/linux/resource.h
@@ -55,8 +55,11 @@
 /*
  * Limit the stack by to some sane default: root can always
  * increase this limit if needed..  8MB seems reasonable.
+ *
+ * (2MB more to cover randomization effects.)
  */
-#define _STK_LIM	(8*1024*1024)
+#define _STK_LIM	(10*1024*1024)
+#define EXEC_STACK_BIAS	(2*1024*1024)
 
 /*
  * GPG2 wants 64kB of mlocked memory, to make sure pass phrases
--- linux-rt-2.6.31.orig/include/linux/ftrace.h
+++ linux-rt-2.6.31/include/linux/ftrace.h
@@ -241,7 +241,7 @@
 # define ftrace_set_filter(buf, len, reset)	do { } while (0)
 # define ftrace_disable_daemon()		do { } while (0)
 # define ftrace_enable_daemon()			do { } while (0)
-static inline void ftrace_release(void *start, unsigned long size) { }
+static inline void ftrace_release_mod(struct module *mod) {}
 static inline int register_ftrace_command(struct ftrace_func_command *cmd)
 {
 	return -EINVAL;
--- linux-rt-2.6.31.orig/include/linux/module.h
+++ linux-rt-2.6.31/include/linux/module.h
@@ -720,4 +720,13 @@
 static inline void module_bug_cleanup(struct module *mod) {}
 #endif	/* CONFIG_GENERIC_BUG */
 
+/*
+ * Establish a symbolic link between 2 modules so that depmod
+ * and modprobe do the heavy lifting of loading the modules in the
+ * correct dependency order.
+ */
+#define MODULE_EXPORT(mod_name) int sym_link_##mod_name; EXPORT_SYMBOL(sym_link_##mod_name);
+#define MODULE_IMPORT(mod_name) extern int sym_link_##mod_name; int func_sym_link_##mod_name(void) {sym_link_##mod_name=1;}; EXPORT_SYMBOL(func_sym_link_##mod_name);
+
+
 #endif /* _LINUX_MODULE_H */
--- linux-rt-2.6.31.orig/include/linux/quota.h
+++ linux-rt-2.6.31/include/linux/quota.h
@@ -313,8 +313,9 @@
 	int (*claim_space) (struct inode *, qsize_t);
 	/* release rsved quota for delayed alloc */
 	void (*release_rsv) (struct inode *, qsize_t);
-	/* get reserved quota for delayed alloc */
-	qsize_t (*get_reserved_space) (struct inode *);
+	/* get reserved quota for delayed alloc, value returned is managed by
+	 * quota code only */
+	qsize_t *(*get_reserved_space) (struct inode *);
 };
 
 /* Operations handling requests from userspace */
--- linux-rt-2.6.31.orig/include/linux/isdn_ppp.h
+++ linux-rt-2.6.31/include/linux/isdn_ppp.h
@@ -157,7 +157,7 @@
 
 typedef struct {
   int mp_mrru;                        /* unused                             */
-  struct sk_buff_head frags;	/* fragments sl list */
+  struct sk_buff * frags;	/* fragments sl list -- use skb->next */
   long frames;			/* number of frames in the frame list */
   unsigned int seq;		/* last processed packet seq #: any packets
   				 * with smaller seq # will be dropped
--- linux-rt-2.6.31.orig/include/linux/binfmts.h
+++ linux-rt-2.6.31/include/linux/binfmts.h
@@ -101,6 +101,7 @@
 extern int __must_check remove_arg_zero(struct linux_binprm *);
 extern int search_binary_handler(struct linux_binprm *,struct pt_regs *);
 extern int flush_old_exec(struct linux_binprm * bprm);
+extern void setup_new_exec(struct linux_binprm * bprm);
 
 extern int suid_dumpable;
 #define SUID_DUMP_DISABLE	0	/* No setuid dumping */
--- linux-rt-2.6.31.orig/include/linux/kvm.h
+++ linux-rt-2.6.31/include/linux/kvm.h
@@ -104,6 +104,11 @@
 	__u64 cr8;
 	__u64 apic_base;
 
+#ifdef __KVM_S390
+	/* the processor status word for s390 */
+	__u64 psw_mask; /* psw upper half */
+	__u64 psw_addr; /* psw lower half */
+#endif
 	union {
 		/* KVM_EXIT_UNKNOWN */
 		struct {
@@ -155,8 +160,6 @@
 		/* KVM_EXIT_S390_SIEIC */
 		struct {
 			__u8 icptcode;
-			__u64 mask; /* psw upper half */
-			__u64 addr; /* psw lower half */
 			__u16 ipa;
 			__u32 ipb;
 		} s390_sieic;
@@ -453,6 +456,7 @@
 };
 
 #endif
+#define KVM_CAP_S390_PSW 42
 
 /*
  * ioctls for VM fds
--- linux-rt-2.6.31.orig/include/linux/kvm_para.h
+++ linux-rt-2.6.31/include/linux/kvm_para.h
@@ -13,6 +13,7 @@
 #define KVM_ENOSYS		1000
 #define KVM_EFAULT		EFAULT
 #define KVM_E2BIG		E2BIG
+#define KVM_EPERM		EPERM
 
 #define KVM_HC_VAPIC_POLL_IRQ		1
 #define KVM_HC_MMU_OP			2
--- linux-rt-2.6.31.orig/include/linux/sched.h
+++ linux-rt-2.6.31/include/linux/sched.h
@@ -372,6 +372,9 @@
 arch_get_unmapped_area(struct file *, unsigned long, unsigned long,
 		       unsigned long, unsigned long);
 extern unsigned long
+arch_get_unmapped_exec_area(struct file *, unsigned long, unsigned long,
+		       unsigned long, unsigned long);
+extern unsigned long
 arch_get_unmapped_area_topdown(struct file *filp, unsigned long addr,
 			  unsigned long len, unsigned long pgoff,
 			  unsigned long flags);
@@ -1296,7 +1299,7 @@
 	char comm[TASK_COMM_LEN]; /* executable name excluding path
 				     - access with [gs]et_task_comm (which lock
 				       it with task_lock())
-				     - initialized normally by flush_old_exec */
+				     - initialized normally by setup_new_exec */
 /* file system info */
 	int link_count, total_link_count;
 #ifdef CONFIG_SYSVIPC
@@ -1999,11 +2002,18 @@
 	return info <= SEND_SIG_FORCED;
 }
 
-/* True if we are on the alternate signal stack.  */
-
+/*
+ * True if we are on the alternate signal stack.
+ */
 static inline int on_sig_stack(unsigned long sp)
 {
-	return (sp - current->sas_ss_sp < current->sas_ss_size);
+#ifdef CONFIG_STACK_GROWSUP
+	return sp >= current->sas_ss_sp &&
+		sp - current->sas_ss_sp < current->sas_ss_size;
+#else
+	return sp > current->sas_ss_sp &&
+		sp - current->sas_ss_sp <= current->sas_ss_size;
+#endif
 }
 
 static inline int sas_ss_flags(unsigned long sp)
--- linux-rt-2.6.31.orig/include/linux/skbuff.h
+++ linux-rt-2.6.31/include/linux/skbuff.h
@@ -1761,6 +1761,8 @@
 						     int to_offset,
 						     int size);
 extern void	       skb_free_datagram(struct sock *sk, struct sk_buff *skb);
+extern void	       skb_free_datagram_locked(struct sock *sk,
+						struct sk_buff *skb);
 extern int	       skb_kill_datagram(struct sock *sk, struct sk_buff *skb,
 					 unsigned int flags);
 extern __wsum	       skb_checksum(const struct sk_buff *skb, int offset,
--- linux-rt-2.6.31.orig/include/linux/connector.h
+++ linux-rt-2.6.31/include/linux/connector.h
@@ -24,9 +24,6 @@
 
 #include <linux/types.h>
 
-#define CN_IDX_CONNECTOR		0xffffffff
-#define CN_VAL_CONNECTOR		0xffffffff
-
 /*
  * Process Events connector unique ids -- used for message routing
  */
@@ -73,30 +70,6 @@
 	__u8 data[0];
 };
 
-/*
- * Notify structure - requests notification about
- * registering/unregistering idx/val in range [first, first+range].
- */
-struct cn_notify_req {
-	__u32 first;
-	__u32 range;
-};
-
-/*
- * Main notification control message
- * *_notify_num 	- number of appropriate cn_notify_req structures after 
- *				this struct.
- * group 		- notification receiver's idx.
- * len 			- total length of the attached data.
- */
-struct cn_ctl_msg {
-	__u32 idx_notify_num;
-	__u32 val_notify_num;
-	__u32 group;
-	__u32 len;
-	__u8 data[0];
-};
-
 #ifdef __KERNEL__
 
 #include <asm/atomic.h>
@@ -132,11 +105,8 @@
 };
 
 struct cn_callback_data {
-	void (*destruct_data) (void *);
-	void *ddata;
-	
-	void *callback_priv;
-	void (*callback) (void *);
+	struct sk_buff *skb;
+	void (*callback) (struct cn_msg *, struct netlink_skb_parms *);
 
 	void *free;
 };
@@ -152,11 +122,6 @@
 	u32 seq, group;
 };
 
-struct cn_ctl_entry {
-	struct list_head notify_entry;
-	struct cn_ctl_msg *msg;
-};
-
 struct cn_dev {
 	struct cb_id id;
 
@@ -167,11 +132,11 @@
 	struct cn_queue_dev *cbdev;
 };
 
-int cn_add_callback(struct cb_id *, char *, void (*callback) (void *));
+int cn_add_callback(struct cb_id *, char *, void (*callback) (struct cn_msg *, struct netlink_skb_parms *));
 void cn_del_callback(struct cb_id *);
 int cn_netlink_send(struct cn_msg *, u32, gfp_t);
 
-int cn_queue_add_callback(struct cn_queue_dev *dev, char *name, struct cb_id *id, void (*callback)(void *));
+int cn_queue_add_callback(struct cn_queue_dev *dev, char *name, struct cb_id *id, void (*callback)(struct cn_msg *, struct netlink_skb_parms *));
 void cn_queue_del_callback(struct cn_queue_dev *dev, struct cb_id *id);
 
 int queue_cn_work(struct cn_callback_entry *cbq, struct work_struct *work);
--- linux-rt-2.6.31.orig/include/linux/syscalls.h
+++ linux-rt-2.6.31/include/linux/syscalls.h
@@ -761,4 +761,8 @@
 asmlinkage long sys_perf_counter_open(
 		struct perf_counter_attr __user *attr_uptr,
 		pid_t pid, int cpu, int group_fd, unsigned long flags);
+
+asmlinkage long sys_mmap_pgoff(unsigned long addr, unsigned long len,
+			unsigned long prot, unsigned long flags,
+			unsigned long fd, unsigned long pgoff);
 #endif
--- linux-rt-2.6.31.orig/include/linux/swap.h
+++ linux-rt-2.6.31/include/linux/swap.h
@@ -155,6 +155,7 @@
 	unsigned int max;
 	unsigned int inuse_pages;
 	unsigned int old_block_size;
+	void (*notify_swap_entry_free_fn) (unsigned long);
 };
 
 struct swap_list_t {
@@ -296,6 +297,7 @@
 extern int reuse_swap_page(struct page *);
 extern int try_to_free_swap(struct page *);
 struct backing_dev_info;
+extern void set_notify_swap_entry_free(unsigned, void (*) (unsigned long));
 
 /* linux/mm/thrash.c */
 extern struct mm_struct *swap_token_mm;
--- linux-rt-2.6.31.orig/include/linux/usb_usual.h
+++ linux-rt-2.6.31/include/linux/usb_usual.h
@@ -56,7 +56,9 @@
 	US_FLAG(SANE_SENSE,     0x00008000)			\
 		/* Sane Sense (> 18 bytes) */			\
 	US_FLAG(CAPACITY_OK,	0x00010000)			\
-		/* READ CAPACITY response is correct */
+		/* READ CAPACITY response is correct */		\
+	US_FLAG(BAD_SENSE,	0x00020000)			\
+		/* Bad Sense (never more than 18 bytes) */
 
 #define US_FLAG(name, value)	US_FL_##name = value ,
 enum { US_DO_ALL_FLAGS };
--- linux-rt-2.6.31.orig/include/linux/moduleparam.h
+++ linux-rt-2.6.31/include/linux/moduleparam.h
@@ -37,7 +37,6 @@
 typedef int (*param_get_fn)(char *buffer, struct kernel_param *kp);
 
 /* Flag bits for kernel_param.flags */
-#define KPARAM_KMALLOCED	1
 #define KPARAM_ISBOOL		2
 
 struct kernel_param {
--- linux-rt-2.6.31.orig/include/linux/pci.h
+++ linux-rt-2.6.31/include/linux/pci.h
@@ -560,6 +560,9 @@
 				resource_size_t);
 void pcibios_update_irq(struct pci_dev *, int irq);
 
+/* Weak but can be overriden by arch */
+void pci_fixup_cardbus(struct pci_bus *);
+
 /* Generic PCI functions used internally */
 
 extern struct pci_bus *pci_find_bus(int domain, int busnr);
--- linux-rt-2.6.31.orig/include/linux/namei.h
+++ linux-rt-2.6.31/include/linux/namei.h
@@ -75,6 +75,9 @@
 extern struct file *nameidata_to_filp(struct nameidata *nd, int flags);
 extern void release_open_intent(struct nameidata *);
 
+extern struct dentry *lookup_hash(struct nameidata *nd);
+extern int __lookup_one_len(const char *name, struct qstr *this,
+			    struct dentry *base, int len);
 extern struct dentry *lookup_one_len(const char *, struct dentry *, int);
 extern struct dentry *lookup_one_noperm(const char *, struct dentry *);
 
--- linux-rt-2.6.31.orig/include/linux/tty.h
+++ linux-rt-2.6.31/include/linux/tty.h
@@ -185,7 +185,12 @@
 struct tty_port_operations {
 	/* Return 1 if the carrier is raised */
 	int (*carrier_raised)(struct tty_port *port);
+	/* Control the DTR line */
 	void (*dtr_rts)(struct tty_port *port, int raise);
+	/* Called when the last close completes or a hangup finishes
+	   IFF the port was initialized. Do not use to free resources */
+	void (*shutdown)(struct tty_port *port);
+	void (*drop)(struct tty_port *port);
 };
 	
 struct tty_port {
@@ -457,7 +462,8 @@
 extern int tty_port_close_start(struct tty_port *port,
 				struct tty_struct *tty, struct file *filp);
 extern void tty_port_close_end(struct tty_port *port, struct tty_struct *tty);
-
+extern void tty_port_close(struct tty_port *port,
+				struct tty_struct *tty, struct file *filp);
 extern int tty_register_ldisc(int disc, struct tty_ldisc_ops *new_ldisc);
 extern int tty_unregister_ldisc(int disc);
 extern int tty_set_ldisc(struct tty_struct *tty, int ldisc);
--- linux-rt-2.6.31.orig/include/linux/splice.h
+++ linux-rt-2.6.31/include/linux/splice.h
@@ -82,4 +82,10 @@
 extern ssize_t splice_direct_to_actor(struct file *, struct splice_desc *,
 				      splice_direct_actor *);
 
+extern long do_splice_from(struct pipe_inode_info *pipe, struct file *out,
+			   loff_t *ppos, size_t len, unsigned int flags);
+extern long do_splice_to(struct file *in, loff_t *ppos,
+			 struct pipe_inode_info *pipe, size_t len,
+			 unsigned int flags);
+
 #endif
--- linux-rt-2.6.31.orig/include/linux/mm.h
+++ linux-rt-2.6.31/include/linux/mm.h
@@ -1118,7 +1118,15 @@
 				   unsigned long addr, unsigned long len,
 				   unsigned long flags, struct page **pages);
 
-extern unsigned long get_unmapped_area(struct file *, unsigned long, unsigned long, unsigned long, unsigned long);
+extern unsigned long get_unmapped_area_prot(struct file *, unsigned long,
+		unsigned long, unsigned long, unsigned long, int);
+
+static inline unsigned long get_unmapped_area(struct file *file,
+		unsigned long addr, unsigned long len, unsigned long pgoff,
+		unsigned long flags)
+{
+	return get_unmapped_area_prot(file, addr, len, pgoff, flags, 0);
+}
 
 extern unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
 	unsigned long len, unsigned long prot,
--- linux-rt-2.6.31.orig/include/linux/pci_ids.h
+++ linux-rt-2.6.31/include/linux/pci_ids.h
@@ -479,6 +479,9 @@
 #define PCI_DEVICE_ID_IBM_ICOM_V2_ONE_PORT_RVX_ONE_PORT_MDM_PCIE 0x0361
 #define PCI_DEVICE_ID_IBM_ICOM_FOUR_PORT_MODEL	0x252
 
+#define PCI_SUBVENDOR_ID_IBM		0x1014
+#define PCI_SUBDEVICE_ID_IBM_SATURN_SERIAL_ONE_PORT	0x03d4
+
 #define PCI_VENDOR_ID_UNISYS		0x1018
 #define PCI_DEVICE_ID_UNISYS_DMA_DIRECTOR 0x001C
 
@@ -877,6 +880,7 @@
 #define PCI_DEVICE_ID_APPLE_SH_SUNGEM   0x0051
 #define PCI_DEVICE_ID_APPLE_U3L_AGP	0x0058
 #define PCI_DEVICE_ID_APPLE_U3H_AGP	0x0059
+#define PCI_DEVICE_ID_APPLE_U4_PCIE	0x005b
 #define PCI_DEVICE_ID_APPLE_IPID2_AGP	0x0066
 #define PCI_DEVICE_ID_APPLE_IPID2_ATA	0x0069
 #define PCI_DEVICE_ID_APPLE_IPID2_FW	0x006a
--- linux-rt-2.6.31.orig/include/linux/fs.h
+++ linux-rt-2.6.31/include/linux/fs.h
@@ -2296,6 +2296,7 @@
 extern int generic_readlink(struct dentry *, char __user *, int);
 extern void generic_fillattr(struct inode *, struct kstat *);
 extern int vfs_getattr(struct vfsmount *, struct dentry *, struct kstat *);
+void __inode_add_bytes(struct inode *inode, loff_t bytes);
 void inode_add_bytes(struct inode *inode, loff_t bytes);
 void inode_sub_bytes(struct inode *inode, loff_t bytes);
 loff_t inode_get_bytes(struct inode *inode);
--- linux-rt-2.6.31.orig/include/linux/input.h
+++ linux-rt-2.6.31/include/linux/input.h
@@ -1118,6 +1118,7 @@
 	int (*event)(struct input_dev *dev, unsigned int type, unsigned int code, int value);
 
 	struct input_handle *grab;
+	struct input_handle *filter;
 
 	spinlock_t event_lock;
 	struct mutex mutex;
@@ -1218,6 +1219,7 @@
 	void *private;
 
 	void (*event)(struct input_handle *handle, unsigned int type, unsigned int code, int value);
+	bool (*filter)(struct input_handle *handle, unsigned int type, unsigned int code, int value);
 	int (*connect)(struct input_handler *handler, struct input_dev *dev, const struct input_device_id *id);
 	void (*disconnect)(struct input_handle *handle);
 	void (*start)(struct input_handle *handle);
@@ -1295,6 +1297,9 @@
 int input_grab_device(struct input_handle *);
 void input_release_device(struct input_handle *);
 
+int input_filter_device(struct input_handle *);
+void input_unfilter_device(struct input_handle *);
+
 int input_open_device(struct input_handle *);
 void input_close_device(struct input_handle *);
 
--- linux-rt-2.6.31.orig/include/linux/mm_types.h
+++ linux-rt-2.6.31/include/linux/mm_types.h
@@ -206,6 +206,9 @@
 	unsigned long (*get_unmapped_area) (struct file *filp,
 				unsigned long addr, unsigned long len,
 				unsigned long pgoff, unsigned long flags);
+       unsigned long (*get_unmapped_exec_area) (struct file *filp,
+				unsigned long addr, unsigned long len,
+				unsigned long pgoff, unsigned long flags);
 	void (*unmap_area) (struct mm_struct *mm, unsigned long addr);
 	unsigned long mmap_base;		/* base of mmap area */
 	unsigned long task_size;		/* size of task vm space */
--- linux-rt-2.6.31.orig/include/linux/hrtimer.h
+++ linux-rt-2.6.31/include/linux/hrtimer.h
@@ -448,7 +448,7 @@
 
 static inline void timer_stats_account_hrtimer(struct hrtimer *timer)
 {
-	if (likely(!timer->start_site))
+	if (likely(!timer_stats_active))
 		return;
 	timer_stats_update_stats(timer, timer->start_pid, timer->start_site,
 				 timer->function, timer->start_comm, 0);
@@ -459,8 +459,6 @@
 
 static inline void timer_stats_hrtimer_set_start_info(struct hrtimer *timer)
 {
-	if (likely(!timer_stats_active))
-		return;
 	__timer_stats_hrtimer_set_start_info(timer, __builtin_return_address(0));
 }
 
--- linux-rt-2.6.31.orig/include/linux/audit.h
+++ linux-rt-2.6.31/include/linux/audit.h
@@ -33,7 +33,7 @@
  * 1200 - 1299 messages internal to the audit daemon
  * 1300 - 1399 audit event messages
  * 1400 - 1499 SE Linux use
- * 1500 - 1599 kernel LSPP events
+ * 1500 - 1599 AppArmor use
  * 1600 - 1699 kernel crypto events
  * 1700 - 1799 kernel anomaly records
  * 1800 - 1899 kernel integrity events
@@ -122,6 +122,14 @@
 #define AUDIT_MAC_UNLBL_STCADD	1416	/* NetLabel: add a static label */
 #define AUDIT_MAC_UNLBL_STCDEL	1417	/* NetLabel: del a static label */
 
+#define AUDIT_APPARMOR_AUDIT	1501	/* AppArmor audited grants */
+#define AUDIT_APPARMOR_ALLOWED	1502	/* Allowed Access for learning */
+#define AUDIT_APPARMOR_DENIED	1503
+#define AUDIT_APPARMOR_HINT	1504	/* Process Tracking information */
+#define AUDIT_APPARMOR_STATUS	1505	/* Changes in config */
+#define AUDIT_APPARMOR_ERROR	1506	/* Internal AppArmor Errors */
+#define AUDIT_APPARMOR_KILL	1507	/* AppArmor killing processes */
+
 #define AUDIT_FIRST_KERN_ANOM_MSG   1700
 #define AUDIT_LAST_KERN_ANOM_MSG    1799
 #define AUDIT_ANOM_PROMISCUOUS      1700 /* Device changed promiscuous mode */
--- linux-rt-2.6.31.orig/include/linux/usb/serial.h
+++ linux-rt-2.6.31/include/linux/usb/serial.h
@@ -148,6 +148,7 @@
 	struct usb_interface		*interface;
 	unsigned char			disconnected:1;
 	unsigned char			suspending:1;
+	unsigned char			attached:1;
 	unsigned char			minor;
 	unsigned char			num_ports;
 	unsigned char			num_port_pointers;
@@ -261,6 +262,9 @@
 	   be an attached tty at this point */
 	void (*dtr_rts)(struct usb_serial_port *port, int on);
 	int  (*carrier_raised)(struct usb_serial_port *port);
+	/* Called by the usb serial hooks to allow the user to rework the
+	   termios state */
+	void (*init_termios)(struct tty_struct *tty);
 	/* USB events */
 	void (*read_int_callback)(struct urb *urb);
 	void (*write_int_callback)(struct urb *urb);
--- linux-rt-2.6.31.orig/include/linux/usb/usbnet.h
+++ linux-rt-2.6.31/include/linux/usb/usbnet.h
@@ -86,6 +86,7 @@
 
 #define FLAG_FRAMING_AX 0x0040		/* AX88772/178 packets */
 #define FLAG_WLAN	0x0080		/* use "wlan%d" names */
+#define FLAG_SEND_ZLP	0x0200		/* hw requires ZLPs are sent */
 
 
 	/* init device ... can sleep, or cause probe() failure */
--- linux-rt-2.6.31.orig/include/linux/netfilter/Kbuild
+++ linux-rt-2.6.31/include/linux/netfilter/Kbuild
@@ -38,6 +38,8 @@
 header-y += xt_pkttype.h
 header-y += xt_quota.h
 header-y += xt_rateest.h
+header-y += xt_policy.h
+header-y += xt_quota.h
 header-y += xt_realm.h
 header-y += xt_recent.h
 header-y += xt_sctp.h
--- linux-rt-2.6.31.orig/include/linux/nfsd/state.h
+++ linux-rt-2.6.31/include/linux/nfsd/state.h
@@ -89,7 +89,6 @@
 	/* RPC client info */
 	atomic_t		cb_set;     /* successful CB_NULL call */
 	struct rpc_clnt *       cb_client;
-	struct rpc_cred	*	cb_cred;
 };
 
 /* Maximum number of slots per session. 128 is useful for long haul TCP */
@@ -345,6 +344,7 @@
 extern __be32 nfs4_check_open_reclaim(clientid_t *clid);
 extern void put_nfs4_client(struct nfs4_client *clp);
 extern void nfs4_free_stateowner(struct kref *kref);
+extern int set_callback_cred(void);
 extern void nfsd4_probe_callback(struct nfs4_client *clp);
 extern void nfsd4_cb_recall(struct nfs4_delegation *dp);
 extern void nfs4_put_delegation(struct nfs4_delegation *dp);
--- linux-rt-2.6.31.orig/include/net/ipv6.h
+++ linux-rt-2.6.31/include/net/ipv6.h
@@ -354,8 +354,15 @@
 
 struct inet_frag_queue;
 
+enum ip6_defrag_users {
+	IP6_DEFRAG_LOCAL_DELIVER,
+	IP6_DEFRAG_CONNTRACK_IN,
+	IP6_DEFRAG_CONNTRACK_OUT,
+};
+
 struct ip6_create_arg {
 	__be32 id;
+	u32 user;
 	struct in6_addr *src;
 	struct in6_addr *dst;
 };
--- linux-rt-2.6.31.orig/include/net/mac80211.h
+++ linux-rt-2.6.31/include/net/mac80211.h
@@ -1244,6 +1244,12 @@
  *
  * These flags are used with the ampdu_action() callback in
  * &struct ieee80211_ops to indicate which action is needed.
+ *
+ * Note that drivers MUST be able to deal with a TX aggregation
+ * session being stopped even before they OK'ed starting it by
+ * calling ieee80211_start_tx_ba_cb(_irqsafe), because the peer
+ * might receive the addBA frame and send a delBA right away!
+ *
  * @IEEE80211_AMPDU_RX_START: start Rx aggregation
  * @IEEE80211_AMPDU_RX_STOP: stop Rx aggregation
  * @IEEE80211_AMPDU_TX_START: start Tx aggregation
--- linux-rt-2.6.31.orig/include/net/bluetooth/hci_core.h
+++ linux-rt-2.6.31/include/net/bluetooth/hci_core.h
@@ -187,6 +187,7 @@
 	struct work_struct work_del;
 
 	struct device	dev;
+	atomic_t	devref;
 
 	struct hci_dev	*hdev;
 	void		*l2cap_data;
@@ -339,6 +340,9 @@
 void hci_conn_enter_active_mode(struct hci_conn *conn);
 void hci_conn_enter_sniff_mode(struct hci_conn *conn);
 
+void hci_conn_hold_device(struct hci_conn *conn);
+void hci_conn_put_device(struct hci_conn *conn);
+
 static inline void hci_conn_hold(struct hci_conn *conn)
 {
 	atomic_inc(&conn->refcnt);
--- linux-rt-2.6.31.orig/include/net/netfilter/nf_nat_helper.h
+++ linux-rt-2.6.31/include/net/netfilter/nf_nat_helper.h
@@ -32,4 +32,8 @@
  * to port ct->master->saved_proto. */
 extern void nf_nat_follow_master(struct nf_conn *ct,
 				 struct nf_conntrack_expect *this);
+
+extern s16 nf_nat_get_offset(const struct nf_conn *ct,
+			     enum ip_conntrack_dir dir,
+			     u32 seq);
 #endif
--- linux-rt-2.6.31.orig/include/net/netfilter/nf_conntrack.h
+++ linux-rt-2.6.31/include/net/netfilter/nf_conntrack.h
@@ -255,11 +255,9 @@
 }
 
 /* These are for NAT.  Icky. */
-/* Update TCP window tracking data when NAT mangles the packet */
-extern void nf_conntrack_tcp_update(const struct sk_buff *skb,
-				    unsigned int dataoff,
-				    struct nf_conn *ct, int dir,
-				    s16 offset);
+extern s16 (*nf_ct_nat_offset)(const struct nf_conn *ct,
+			       enum ip_conntrack_dir dir,
+			       u32 seq);
 
 /* Fake conntrack entry for untracked connections */
 extern struct nf_conn nf_conntrack_untracked;
--- linux-rt-2.6.31.orig/include/net/netfilter/ipv6/nf_conntrack_ipv6.h
+++ linux-rt-2.6.31/include/net/netfilter/ipv6/nf_conntrack_ipv6.h
@@ -9,7 +9,7 @@
 
 extern int nf_ct_frag6_init(void);
 extern void nf_ct_frag6_cleanup(void);
-extern struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb);
+extern struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb, u32 user);
 extern void nf_ct_frag6_output(unsigned int hooknum, struct sk_buff *skb,
 			       struct net_device *in,
 			       struct net_device *out,
--- linux-rt-2.6.31.orig/include/trace/events/fs.h
+++ linux-rt-2.6.31/include/trace/events/fs.h
@@ -0,0 +1,53 @@
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM fs
+
+#if !defined(_TRACE_FS_H) || defined(TRACE_HEADER_MULTI_READ)
+#define _TRACE_FS_H
+
+#include <linux/fs.h>
+#include <linux/tracepoint.h>
+
+TRACE_EVENT(do_sys_open,
+
+	TP_PROTO(char *filename, int flags, int mode),
+
+	TP_ARGS(filename, flags, mode),
+
+	TP_STRUCT__entry(
+		__string(	filename, filename		)
+		__field(	int, flags			)
+		__field(	int, mode			)
+	),
+
+	TP_fast_assign(
+		__assign_str(filename, filename);
+		__entry->flags = flags;
+		__entry->mode = mode;
+	),
+
+	TP_printk("\"%s\" %x %o",
+		  __get_str(filename), __entry->flags, __entry->mode)
+);
+
+TRACE_EVENT(open_exec,
+
+	TP_PROTO(char *filename),
+
+	TP_ARGS(filename),
+
+	TP_STRUCT__entry(
+		__string(	filename, filename		)
+	),
+
+	TP_fast_assign(
+		__assign_str(filename, filename);
+	),
+
+	TP_printk("\"%s\"",
+		  __get_str(filename))
+);
+
+#endif /* _TRACE_FS_H */
+
+/* This part must be outside protection */
+#include <trace/define_trace.h>
--- linux-rt-2.6.31.orig/include/trace/events/ext4.h
+++ linux-rt-2.6.31/include/trace/events/ext4.h
@@ -5,10 +5,12 @@
 #define _TRACE_EXT4_H
 
 #include <linux/writeback.h>
-#include "../../../fs/ext4/ext4.h"
-#include "../../../fs/ext4/mballoc.h"
 #include <linux/tracepoint.h>
 
+struct ext4_allocation_context;
+struct ext4_allocation_request;
+struct ext4_prealloc_space;
+
 TRACE_EVENT(ext4_free_inode,
 	TP_PROTO(struct inode *inode),
 
@@ -229,6 +231,7 @@
 		__field(	char,	for_reclaim		)
 		__field(	char,	for_writepages		)
 		__field(	char,	range_cyclic		)
+		__field(       pgoff_t,	writeback_index		)
 	),
 
 	TP_fast_assign(
@@ -243,14 +246,51 @@
 		__entry->for_reclaim	= wbc->for_reclaim;
 		__entry->for_writepages	= wbc->for_writepages;
 		__entry->range_cyclic	= wbc->range_cyclic;
+		__entry->writeback_index = inode->i_mapping->writeback_index;
 	),
 
-	TP_printk("dev %s ino %lu nr_t_write %ld pages_skipped %ld range_start %llu range_end %llu nonblocking %d for_kupdate %d for_reclaim %d for_writepages %d range_cyclic %d",
-		  jbd2_dev_to_name(__entry->dev), __entry->ino, __entry->nr_to_write,
+	TP_printk("dev %s ino %lu nr_to_write %ld pages_skipped %ld range_start %llu range_end %llu nonblocking %d for_kupdate %d for_reclaim %d for_writepages %d range_cyclic %d writeback_index %lu",
+		  jbd2_dev_to_name(__entry->dev),
+		  (unsigned long) __entry->ino, __entry->nr_to_write,
 		  __entry->pages_skipped, __entry->range_start,
 		  __entry->range_end, __entry->nonblocking,
 		  __entry->for_kupdate, __entry->for_reclaim,
-		  __entry->for_writepages, __entry->range_cyclic)
+		  __entry->for_writepages, __entry->range_cyclic,
+		  (unsigned long) __entry->writeback_index)
+);
+
+TRACE_EVENT(ext4_da_write_pages,
+	TP_PROTO(struct inode *inode, struct mpage_da_data *mpd),
+
+	TP_ARGS(inode, mpd),
+
+	TP_STRUCT__entry(
+		__field(	dev_t,	dev			)
+		__field(	ino_t,	ino			)
+		__field(	__u64,	b_blocknr		)
+		__field(	__u32,	b_size			)
+		__field(	__u32,	b_state			)
+		__field(	unsigned long,	first_page	)
+		__field(	int,	io_done			)
+		__field(	int,	pages_written		)
+	),
+
+	TP_fast_assign(
+		__entry->dev		= inode->i_sb->s_dev;
+		__entry->ino		= inode->i_ino;
+		__entry->b_blocknr	= mpd->b_blocknr;
+		__entry->b_size		= mpd->b_size;
+		__entry->b_state	= mpd->b_state;
+		__entry->first_page	= mpd->first_page;
+		__entry->io_done	= mpd->io_done;
+		__entry->pages_written	= mpd->pages_written;
+	),
+
+	TP_printk("dev %s ino %lu b_blocknr %llu b_size %u b_state 0x%04x first_page %lu io_done %d pages_written %d",
+		  jbd2_dev_to_name(__entry->dev), (unsigned long) __entry->ino,
+		  __entry->b_blocknr, __entry->b_size,
+		  __entry->b_state, __entry->first_page,
+		  __entry->io_done, __entry->pages_written)
 );
 
 TRACE_EVENT(ext4_da_writepages_result,
@@ -268,6 +308,7 @@
 		__field(	char,	encountered_congestion	)
 		__field(	char,	more_io			)	
 		__field(	char,	no_nrwrite_index_update )
+		__field(       pgoff_t,	writeback_index		)
 	),
 
 	TP_fast_assign(
@@ -279,13 +320,16 @@
 		__entry->encountered_congestion	= wbc->encountered_congestion;
 		__entry->more_io	= wbc->more_io;
 		__entry->no_nrwrite_index_update = wbc->no_nrwrite_index_update;
+		__entry->writeback_index = inode->i_mapping->writeback_index;
 	),
 
-	TP_printk("dev %s ino %lu ret %d pages_written %d pages_skipped %ld congestion %d more_io %d no_nrwrite_index_update %d",
-		  jbd2_dev_to_name(__entry->dev), __entry->ino, __entry->ret,
+	TP_printk("dev %s ino %lu ret %d pages_written %d pages_skipped %ld congestion %d more_io %d no_nrwrite_index_update %d writeback_index %lu",
+		  jbd2_dev_to_name(__entry->dev),
+		  (unsigned long) __entry->ino, __entry->ret,
 		  __entry->pages_written, __entry->pages_skipped,
 		  __entry->encountered_congestion, __entry->more_io,
-		  __entry->no_nrwrite_index_update)
+		  __entry->no_nrwrite_index_update,
+		  (unsigned long) __entry->writeback_index)
 );
 
 TRACE_EVENT(ext4_da_write_begin,
--- linux-rt-2.6.31.orig/sound/pcmcia/pdaudiocf/pdaudiocf_pcm.c
+++ linux-rt-2.6.31/sound/pcmcia/pdaudiocf/pdaudiocf_pcm.c
@@ -51,7 +51,7 @@
 			return 0; /* already enough large */
 		vfree(runtime->dma_area);
 	}
-	runtime->dma_area = vmalloc_32(size);
+	runtime->dma_area = vmalloc_32_user(size);
 	if (! runtime->dma_area)
 		return -ENOMEM;
 	runtime->dma_bytes = size;
--- linux-rt-2.6.31.orig/sound/usb/usbaudio.h
+++ linux-rt-2.6.31/sound/usb/usbaudio.h
@@ -210,7 +210,7 @@
 /*
  */
 
-#define combine_word(s)    ((*s) | ((unsigned int)(s)[1] << 8))
+#define combine_word(s)    ((*(s)) | ((unsigned int)(s)[1] << 8))
 #define combine_triple(s)  (combine_word(s) | ((unsigned int)(s)[2] << 16))
 #define combine_quad(s)    (combine_triple(s) | ((unsigned int)(s)[3] << 24))
 
--- linux-rt-2.6.31.orig/sound/usb/usbaudio.c
+++ linux-rt-2.6.31/sound/usb/usbaudio.c
@@ -752,7 +752,7 @@
 			return 0; /* already large enough */
 		vfree(runtime->dma_area);
 	}
-	runtime->dma_area = vmalloc(size);
+	runtime->dma_area = vmalloc_user(size);
 	if (!runtime->dma_area)
 		return -ENOMEM;
 	runtime->dma_bytes = size;
--- linux-rt-2.6.31.orig/sound/arm/aaci.c
+++ linux-rt-2.6.31/sound/arm/aaci.c
@@ -504,6 +504,10 @@
 	int err;
 
 	aaci_pcm_hw_free(substream);
+	if (aacirun->pcm_open) {
+		snd_ac97_pcm_close(aacirun->pcm);
+		aacirun->pcm_open = 0;
+	}
 
 	err = devdma_hw_alloc(NULL, substream,
 			      params_buffer_bytes(params));
@@ -517,7 +521,7 @@
 	else
 		err = snd_ac97_pcm_open(aacirun->pcm, params_rate(params),
 					params_channels(params),
-					aacirun->pcm->r[1].slots);
+					aacirun->pcm->r[0].slots);
 
 	if (err)
 		goto out;
--- linux-rt-2.6.31.orig/sound/aoa/codecs/tas.c
+++ linux-rt-2.6.31/sound/aoa/codecs/tas.c
@@ -897,6 +897,15 @@
 	client = i2c_new_device(adapter, &info);
 	if (!client)
 		return -ENODEV;
+	/*
+	 * We know the driver is already loaded, so the device should be
+	 * already bound. If not it means binding failed, and then there
+	 * is no point in keeping the device instantiated.
+	 */
+	if (!client->driver) {
+		i2c_unregister_device(client);
+		return -ENODEV;
+	}
 
 	/*
 	 * Let i2c-core delete that device on driver removal.
--- linux-rt-2.6.31.orig/sound/pci/via82xx.c
+++ linux-rt-2.6.31/sound/pci/via82xx.c
@@ -1626,7 +1626,7 @@
 				      struct snd_ctl_elem_value *ucontrol)
 {
 	struct via82xx *chip = snd_kcontrol_chip(kcontrol);
-	unsigned int idx = snd_ctl_get_ioff(kcontrol, &ucontrol->id);
+	unsigned int idx = kcontrol->id.subdevice;
 
 	ucontrol->value.integer.value[0] = VIA_DXS_MAX_VOLUME - chip->playback_volume[idx][0];
 	ucontrol->value.integer.value[1] = VIA_DXS_MAX_VOLUME - chip->playback_volume[idx][1];
@@ -1646,7 +1646,7 @@
 				      struct snd_ctl_elem_value *ucontrol)
 {
 	struct via82xx *chip = snd_kcontrol_chip(kcontrol);
-	unsigned int idx = snd_ctl_get_ioff(kcontrol, &ucontrol->id);
+	unsigned int idx = kcontrol->id.subdevice;
 	unsigned long port = chip->port + 0x10 * idx;
 	unsigned char val;
 	int i, change = 0;
@@ -1705,11 +1705,12 @@
 };
 
 static struct snd_kcontrol_new snd_via8233_dxs_volume_control __devinitdata = {
-	.name = "VIA DXS Playback Volume",
-	.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
+	.iface = SNDRV_CTL_ELEM_IFACE_PCM,
+	.device = 0,
+	/* .subdevice set later */
+	.name = "PCM Playback Volume",
 	.access = (SNDRV_CTL_ELEM_ACCESS_READWRITE |
 		   SNDRV_CTL_ELEM_ACCESS_TLV_READ),
-	.count = 4,
 	.info = snd_via8233_dxs_volume_info,
 	.get = snd_via8233_dxs_volume_get,
 	.put = snd_via8233_dxs_volume_put,
@@ -1936,10 +1937,18 @@
 		}
 		else /* Using DXS when PCM emulation is enabled is really weird */
 		{
-			/* Standalone DXS controls */
-			err = snd_ctl_add(chip->card, snd_ctl_new1(&snd_via8233_dxs_volume_control, chip));
-			if (err < 0)
-				return err;
+			for (i = 0; i < 4; ++i) {
+				struct snd_kcontrol *kctl;
+
+				kctl = snd_ctl_new1(
+					&snd_via8233_dxs_volume_control, chip);
+				if (!kctl)
+					return -ENOMEM;
+				kctl->id.subdevice = i;
+				err = snd_ctl_add(chip->card, kctl);
+				if (err < 0)
+					return err;
+			}
 		}
 	}
 	/* select spdif data slot 10/11 */
--- linux-rt-2.6.31.orig/sound/pci/intel8x0.c
+++ linux-rt-2.6.31/sound/pci/intel8x0.c
@@ -1954,6 +1954,18 @@
 		.name = "Sony S1XP",
 		.type = AC97_TUNE_INV_EAPD
 	},
+	{
+		.subvendor = 0x104d,
+		.subdevice = 0x81c0,
+		.name = "Sony VAIO VGN-T350P", /*AD1981B*/
+		.type = AC97_TUNE_INV_EAPD
+	},
+	{
+		.subvendor = 0x104d,
+		.subdevice = 0x81c5,
+		.name = "Sony VAIO VGN-B1VP", /*AD1981B*/
+		.type = AC97_TUNE_INV_EAPD
+	},
  	{
 		.subvendor = 0x1043,
 		.subdevice = 0x80f3,
--- linux-rt-2.6.31.orig/sound/pci/ice1712/ice1724.c
+++ linux-rt-2.6.31/sound/pci/ice1712/ice1724.c
@@ -643,7 +643,7 @@
 	    (inb(ICEMT1724(ice, DMA_PAUSE)) & DMA_PAUSES)) {
 		/* running? we cannot change the rate now... */
 		spin_unlock_irqrestore(&ice->reg_lock, flags);
-		return -EBUSY;
+		return ((rate == ice->cur_rate) && !force) ? 0 : -EBUSY;
 	}
 	if (!force && is_pro_rate_locked(ice)) {
 		spin_unlock_irqrestore(&ice->reg_lock, flags);
--- linux-rt-2.6.31.orig/sound/pci/hda/patch_nvhdmi.c
+++ linux-rt-2.6.31/sound/pci/hda/patch_nvhdmi.c
@@ -377,6 +377,7 @@
  */
 static struct hda_codec_preset snd_hda_preset_nvhdmi[] = {
 	{ .id = 0x10de0002, .name = "MCP78 HDMI", .patch = patch_nvhdmi_8ch },
+	{ .id = 0x10de0003, .name = "MCP78 HDMI", .patch = patch_nvhdmi_8ch },
 	{ .id = 0x10de0006, .name = "MCP78 HDMI", .patch = patch_nvhdmi_8ch },
 	{ .id = 0x10de0007, .name = "MCP7A HDMI", .patch = patch_nvhdmi_8ch },
 	{ .id = 0x10de0067, .name = "MCP67 HDMI", .patch = patch_nvhdmi_2ch },
@@ -385,6 +386,7 @@
 };
 
 MODULE_ALIAS("snd-hda-codec-id:10de0002");
+MODULE_ALIAS("snd-hda-codec-id:10de0003");
 MODULE_ALIAS("snd-hda-codec-id:10de0006");
 MODULE_ALIAS("snd-hda-codec-id:10de0007");
 MODULE_ALIAS("snd-hda-codec-id:10de0067");
--- linux-rt-2.6.31.orig/sound/pci/hda/hda_codec.c
+++ linux-rt-2.6.31/sound/pci/hda/hda_codec.c
@@ -2356,9 +2356,14 @@
 	hda_nid_t nid;
 	int i;
 
-	snd_hda_codec_write(codec, fg, 0, AC_VERB_SET_POWER_STATE,
+	/* this delay seems necessary to avoid click noise at power-down */
+	if (power_state == AC_PWRST_D3)
+		msleep(100);
+	snd_hda_codec_read(codec, fg, 0, AC_VERB_SET_POWER_STATE,
 			    power_state);
-	msleep(10); /* partial workaround for "azx_get_response timeout" */
+	/* partial workaround for "azx_get_response timeout" */
+	if (power_state == AC_PWRST_D0)
+		msleep(10);
 
 	nid = codec->start_nid;
 	for (i = 0; i < codec->num_nodes; i++, nid++) {
--- linux-rt-2.6.31.orig/sound/pci/hda/hda_intel.c
+++ linux-rt-2.6.31/sound/pci/hda/hda_intel.c
@@ -2254,6 +2254,9 @@
 	/* forced codec slots */
 	SND_PCI_QUIRK(0x1043, 0x1262, "ASUS W5Fm", 0x103),
 	SND_PCI_QUIRK(0x1046, 0x1262, "ASUS W5F", 0x103),
+	/* conflict of ALC268 in slot#3 (digital I/O); a temporary fix */
+	SND_PCI_QUIRK(0x1179, 0xff00, "Toshiba laptop", 0x03),
+	SND_PCI_QUIRK(0x1028, 0x0271, "Dell Studio XPS 1340", 0x09),
 	{}
 };
 
@@ -2284,6 +2287,31 @@
 	}
 }
 
+/*
+ * white-list for enable_msi
+ */
+static struct snd_pci_quirk msi_white_list[] __devinitdata = {
+	SND_PCI_QUIRK(0x103c, 0x30f7, "HP Pavilion dv4t-1300", 1),
+	SND_PCI_QUIRK(0x103c, 0x3607, "HP Compa CQ40", 1),
+	{}
+};
+
+static void __devinit check_msi(struct azx *chip)
+{
+	const struct snd_pci_quirk *q;
+
+	chip->msi = enable_msi;
+	if (chip->msi)
+		return;
+	q = snd_pci_quirk_lookup(chip->pci, msi_white_list);
+	if (q) {
+		printk(KERN_INFO
+		       "hda_intel: msi for device %04x:%04x set to %d\n",
+		       q->subvendor, q->subdevice, q->value);
+		chip->msi = q->value;
+	}
+}
+
 
 /*
  * constructor
@@ -2318,7 +2346,7 @@
 	chip->pci = pci;
 	chip->irq = -1;
 	chip->driver_type = driver_type;
-	chip->msi = enable_msi;
+	check_msi(chip);
 	chip->dev_index = dev;
 	INIT_WORK(&chip->irq_pending_work, azx_irq_pending_work);
 
@@ -2392,6 +2420,11 @@
 		}
 	}
 
+	/* disable 64bit DMA address for Teradici */
+	/* it does not work with device 6549:1200 subsys e4a2:040b */
+	if (chip->driver_type == AZX_DRIVER_TERA)
+		gcap &= ~ICH6_GCAP_64OK;
+
 	/* allow 64bit DMA address if supported by H/W */
 	if ((gcap & ICH6_GCAP_64OK) && !pci_set_dma_mask(pci, DMA_BIT_MASK(64)))
 		pci_set_consistent_dma_mask(pci, DMA_BIT_MASK(64));
@@ -2649,11 +2682,15 @@
 	/* this entry seems still valid -- i.e. without emu20kx chip */
 	{ PCI_DEVICE(0x1102, 0x0009), .driver_data = AZX_DRIVER_GENERIC },
 #endif
-	/* AMD Generic, PCI class code and Vendor ID for HD Audio */
+	/* AMD/ATI Generic, PCI class code and Vendor ID for HD Audio */
 	{ PCI_DEVICE(PCI_VENDOR_ID_ATI, PCI_ANY_ID),
 	  .class = PCI_CLASS_MULTIMEDIA_HD_AUDIO << 8,
 	  .class_mask = 0xffffff,
 	  .driver_data = AZX_DRIVER_GENERIC },
+	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_ANY_ID),
+	  .class = PCI_CLASS_MULTIMEDIA_HD_AUDIO << 8,
+	  .class_mask = 0xffffff,
+	  .driver_data = AZX_DRIVER_GENERIC },
 	{ 0, }
 };
 MODULE_DEVICE_TABLE(pci, azx_ids);
--- linux-rt-2.6.31.orig/sound/pci/hda/patch_realtek.c
+++ linux-rt-2.6.31/sound/pci/hda/patch_realtek.c
@@ -16876,6 +16876,7 @@
 	SND_PCI_QUIRK(0x105b, 0x0cd6, "Foxconn", ALC662_ECS),
 	SND_PCI_QUIRK(0x105b, 0x0d47, "Foxconn 45CMX/45GMX/45CMX-K",
 		      ALC662_3ST_6ch_DIG),
+	SND_PCI_QUIRK(0x1179, 0xff6e, "Toshiba NB200", ALC663_ASUS_MODE4),
 	SND_PCI_QUIRK(0x144d, 0xca00, "Samsung NC10", ALC272_SAMSUNG_NC10),
 	SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte 945GCM-S2L",
 		      ALC662_3ST_6ch_DIG),
--- linux-rt-2.6.31.orig/sound/pci/hda/patch_sigmatel.c
+++ linux-rt-2.6.31/sound/pci/hda/patch_sigmatel.c
@@ -1817,6 +1817,8 @@
 				"Dell Studio 17", STAC_DELL_M6_DMIC),
 	SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x02be,
 				"Dell Studio 1555", STAC_DELL_M6_DMIC),
+	SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x02bd,
+				"Dell Studio 1557", STAC_DELL_M6_DMIC),
 	{} /* terminator */
 };
 
@@ -1927,6 +1929,10 @@
 		      "HP mini 1000", STAC_HP_M4),
 	SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x361b,
 		      "HP HDX", STAC_HP_HDX),  /* HDX16 */
+	SND_PCI_QUIRK_MASK(PCI_VENDOR_ID_HP, 0xfff0, 0x3620,
+		      "HP dv6", STAC_HP_DV5),
+	SND_PCI_QUIRK_MASK(PCI_VENDOR_ID_HP, 0xfff0, 0x7010,
+		      "HP", STAC_HP_DV5),
 	SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0233,
 				"unknown Dell", STAC_DELL_M4_1),
 	SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0234,
@@ -4754,6 +4760,20 @@
 static int stac92xx_suspend(struct hda_codec *codec, pm_message_t state)
 {
 	struct sigmatel_spec *spec = codec->spec;
+	int i;
+	hda_nid_t nid;
+
+	/* reset each pin before powering down DAC/ADC to avoid click noise */
+	nid = codec->start_nid;
+	for (i = 0; i < codec->num_nodes; i++, nid++) {
+		unsigned int wcaps = get_wcaps(codec, nid);
+		unsigned int wid_type = (wcaps & AC_WCAP_TYPE) >>
+			AC_WCAP_TYPE_SHIFT;
+		if (wid_type == AC_WID_PIN)
+			snd_hda_codec_read(codec, nid, 0,
+				AC_VERB_SET_PIN_WIDGET_CONTROL, 0);
+	}
+
 	if (spec->eapd_mask)
 		stac_gpio_set(codec, spec->gpio_mask,
 				spec->gpio_dir, spec->gpio_data &
@@ -5440,6 +5460,11 @@
 	case STAC_HP_DV5:
 		snd_hda_codec_set_pincfg(codec, 0x0d, 0x90170010);
 		stac92xx_auto_set_pinctl(codec, 0x0d, AC_PINCTL_OUT_EN);
+		/* HP dv6 gives the headphone pin as a line-out.  Thus we
+		 * need to set hp_detect flag here to force to enable HP
+		 * detection.
+		 */
+		spec->hp_detect = 1;
 		break;
 	case STAC_HP_HDX:
 		spec->num_dmics = 1;
--- linux-rt-2.6.31.orig/sound/pci/cs46xx/cs46xx_lib.h
+++ linux-rt-2.6.31/sound/pci/cs46xx/cs46xx_lib.h
@@ -35,7 +35,7 @@
 
 
 #ifdef CONFIG_SND_CS46XX_NEW_DSP
-#define CS46XX_MIN_PERIOD_SIZE 1
+#define CS46XX_MIN_PERIOD_SIZE 64
 #define CS46XX_MAX_PERIOD_SIZE 1024*1024
 #else
 #define CS46XX_MIN_PERIOD_SIZE 2048
--- linux-rt-2.6.31.orig/sound/pci/oxygen/oxygen_io.c
+++ linux-rt-2.6.31/sound/pci/oxygen/oxygen_io.c
@@ -215,17 +215,8 @@
 
 void oxygen_write_i2c(struct oxygen *chip, u8 device, u8 map, u8 data)
 {
-	unsigned long timeout;
-
 	/* should not need more than about 300 us */
-	timeout = jiffies + msecs_to_jiffies(1);
-	do {
-		if (!(oxygen_read16(chip, OXYGEN_2WIRE_BUS_STATUS)
-		      & OXYGEN_2WIRE_BUSY))
-			break;
-		udelay(1);
-		cond_resched();
-	} while (time_after_eq(timeout, jiffies));
+	msleep(1);
 
 	oxygen_write8(chip, OXYGEN_2WIRE_MAP, map);
 	oxygen_write8(chip, OXYGEN_2WIRE_DATA, data);
--- linux-rt-2.6.31.orig/sound/core/rawmidi.c
+++ linux-rt-2.6.31/sound/core/rawmidi.c
@@ -248,7 +248,8 @@
 	list_for_each_entry(substream, &s->substreams, list) {
 		if (substream->opened) {
 			if (stream == SNDRV_RAWMIDI_STREAM_INPUT ||
-			    !(mode & SNDRV_RAWMIDI_LFLG_APPEND))
+			    !(mode & SNDRV_RAWMIDI_LFLG_APPEND) ||
+			    !substream->append)
 				continue;
 		}
 		if (subdevice < 0 || subdevice == substream->number) {
@@ -266,17 +267,21 @@
 {
 	int err;
 
-	err = snd_rawmidi_runtime_create(substream);
-	if (err < 0)
-		return err;
-	err = substream->ops->open(substream);
-	if (err < 0)
-		return err;
-	substream->opened = 1;
-	if (substream->use_count++ == 0)
-		substream->active_sensing = 1;
-	if (mode & SNDRV_RAWMIDI_LFLG_APPEND)
-		substream->append = 1;
+	if (substream->use_count == 0) {
+		err = snd_rawmidi_runtime_create(substream);
+		if (err < 0)
+			return err;
+		err = substream->ops->open(substream);
+		if (err < 0) {
+			snd_rawmidi_runtime_free(substream);
+			return err;
+		}
+		substream->opened = 1;
+		substream->active_sensing = 0;
+		if (mode & SNDRV_RAWMIDI_LFLG_APPEND)
+			substream->append = 1;
+	}
+	substream->use_count++;
 	rmidi->streams[substream->stream].substream_opened++;
 	return 0;
 }
@@ -297,27 +302,27 @@
 				       SNDRV_RAWMIDI_STREAM_INPUT,
 				       mode, &sinput);
 		if (err < 0)
-			goto __error;
+			return err;
 	}
 	if (mode & SNDRV_RAWMIDI_LFLG_OUTPUT) {
 		err = assign_substream(rmidi, subdevice,
 				       SNDRV_RAWMIDI_STREAM_OUTPUT,
 				       mode, &soutput);
 		if (err < 0)
-			goto __error;
+			return err;
 	}
 
 	if (sinput) {
 		err = open_substream(rmidi, sinput, mode);
 		if (err < 0)
-			goto __error;
+			return err;
 	}
 	if (soutput) {
 		err = open_substream(rmidi, soutput, mode);
 		if (err < 0) {
 			if (sinput)
 				close_substream(rmidi, sinput, 0);
-			goto __error;
+			return err;
 		}
 	}
 
@@ -325,13 +330,6 @@
 	rfile->input = sinput;
 	rfile->output = soutput;
 	return 0;
-
-      __error:
-	if (sinput && sinput->runtime)
-		snd_rawmidi_runtime_free(sinput);
-	if (soutput && soutput->runtime)
-		snd_rawmidi_runtime_free(soutput);
-	return err;
 }
 
 /* called from sound/core/seq/seq_midi.c */
--- linux-rt-2.6.31.orig/sound/core/hrtimer.c
+++ linux-rt-2.6.31/sound/core/hrtimer.c
@@ -37,14 +37,22 @@
 struct snd_hrtimer {
 	struct snd_timer *timer;
 	struct hrtimer hrt;
+	atomic_t running;
 };
 
 static enum hrtimer_restart snd_hrtimer_callback(struct hrtimer *hrt)
 {
 	struct snd_hrtimer *stime = container_of(hrt, struct snd_hrtimer, hrt);
 	struct snd_timer *t = stime->timer;
+
+	if (!atomic_read(&stime->running))
+		return HRTIMER_NORESTART;
+
 	hrtimer_forward_now(hrt, ns_to_ktime(t->sticks * resolution));
 	snd_timer_interrupt(stime->timer, t->sticks);
+
+	if (!atomic_read(&stime->running))
+		return HRTIMER_NORESTART;
 	return HRTIMER_RESTART;
 }
 
@@ -58,6 +66,7 @@
 	hrtimer_init(&stime->hrt, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
 	stime->timer = t;
 	stime->hrt.function = snd_hrtimer_callback;
+	atomic_set(&stime->running, 0);
 	t->private_data = stime;
 	return 0;
 }
@@ -78,16 +87,18 @@
 {
 	struct snd_hrtimer *stime = t->private_data;
 
+	atomic_set(&stime->running, 0);
+	hrtimer_cancel(&stime->hrt);
 	hrtimer_start(&stime->hrt, ns_to_ktime(t->sticks * resolution),
 		      HRTIMER_MODE_REL);
+	atomic_set(&stime->running, 1);
 	return 0;
 }
 
 static int snd_hrtimer_stop(struct snd_timer *t)
 {
 	struct snd_hrtimer *stime = t->private_data;
-
-	hrtimer_cancel(&stime->hrt);
+	atomic_set(&stime->running, 0);
 	return 0;
 }
 
--- linux-rt-2.6.31.orig/sound/core/seq/seq_midi.c
+++ linux-rt-2.6.31/sound/core/seq/seq_midi.c
@@ -236,6 +236,7 @@
 	memset(&params, 0, sizeof(params));
 	params.avail_min = 1;
 	params.buffer_size = output_buffer_size;
+	params.no_active_sensing = 1;
 	if ((err = snd_rawmidi_output_params(msynth->output_rfile.output, &params)) < 0) {
 		snd_rawmidi_kernel_release(&msynth->output_rfile);
 		return err;
--- linux-rt-2.6.31.orig/sound/ppc/keywest.c
+++ linux-rt-2.6.31/sound/ppc/keywest.c
@@ -59,6 +59,18 @@
 	strlcpy(info.type, "keywest", I2C_NAME_SIZE);
 	info.addr = keywest_ctx->addr;
 	keywest_ctx->client = i2c_new_device(adapter, &info);
+	if (!keywest_ctx->client)
+		return -ENODEV;
+	/*
+	 * We know the driver is already loaded, so the device should be
+	 * already bound. If not it means binding failed, and then there
+	 * is no point in keeping the device instantiated.
+	 */
+	if (!keywest_ctx->client->driver) {
+		i2c_unregister_device(keywest_ctx->client);
+		keywest_ctx->client = NULL;
+		return -ENODEV;
+	}
 	
 	/*
 	 * Let i2c-core delete that device on driver removal.
--- linux-rt-2.6.31.orig/sound/mips/sgio2audio.c
+++ linux-rt-2.6.31/sound/mips/sgio2audio.c
@@ -609,7 +609,7 @@
 	/* alloc virtual 'dma' area */
 	if (runtime->dma_area)
 		vfree(runtime->dma_area);
-	runtime->dma_area = vmalloc(size);
+	runtime->dma_area = vmalloc_user(size);
 	if (runtime->dma_area == NULL)
 		return -ENOMEM;
 	runtime->dma_bytes = size;
--- linux-rt-2.6.31.orig/sound/soc/soc-dapm.c
+++ linux-rt-2.6.31/sound/soc/soc-dapm.c
@@ -774,9 +774,19 @@
 			if (!w->power_check)
 				continue;
 
-			power = w->power_check(w);
-			if (power)
-				sys_power = 1;
+			/* If we're suspending then pull down all the
+			 * power. */
+			switch (event) {
+			case SND_SOC_DAPM_STREAM_SUSPEND:
+				power = 0;
+				break;
+
+			default:
+				power = w->power_check(w);
+				if (power)
+					sys_power = 1;
+				break;
+			}
 
 			if (w->power == power)
 				continue;
--- linux-rt-2.6.31.orig/sound/soc/codecs/tlv320aic23.c
+++ linux-rt-2.6.31/sound/soc/codecs/tlv320aic23.c
@@ -625,11 +625,10 @@
 {
 	struct snd_soc_device *socdev = platform_get_drvdata(pdev);
 	struct snd_soc_codec *codec = socdev->card->codec;
-	int i;
 	u16 reg;
 
 	/* Sync reg_cache with the hardware */
-	for (reg = 0; reg < ARRAY_SIZE(tlv320aic23_reg); i++) {
+	for (reg = 0; reg < TLV320AIC23_RESET; reg++) {
 		u16 val = tlv320aic23_read_reg_cache(codec, reg);
 		tlv320aic23_write(codec, reg, val);
 	}
--- linux-rt-2.6.31.orig/sound/soc/codecs/wm9712.c
+++ linux-rt-2.6.31/sound/soc/codecs/wm9712.c
@@ -464,7 +464,8 @@
 {
 	u16 *cache = codec->reg_cache;
 
-	soc_ac97_ops.write(codec->ac97, reg, val);
+	if (reg < 0x7c)
+		soc_ac97_ops.write(codec->ac97, reg, val);
 	reg = reg >> 1;
 	if (reg < (ARRAY_SIZE(wm9712_reg)))
 		cache[reg] = val;
--- linux-rt-2.6.31.orig/sound/soc/codecs/wm8350.c
+++ linux-rt-2.6.31/sound/soc/codecs/wm8350.c
@@ -580,7 +580,7 @@
 	SOC_DAPM_SINGLE_TLV("L3 Capture Volume",
 			    WM8350_INPUT_MIXER_VOLUME_L, 9, 7, 0, out_mix_tlv),
 	SOC_DAPM_SINGLE("PGA Capture Switch",
-			WM8350_LEFT_INPUT_VOLUME, 14, 1, 0),
+			WM8350_LEFT_INPUT_VOLUME, 14, 1, 1),
 };
 
 /* Right Input Mixer */
@@ -590,7 +590,7 @@
 	SOC_DAPM_SINGLE_TLV("L3 Capture Volume",
 			    WM8350_INPUT_MIXER_VOLUME_R, 13, 7, 0, out_mix_tlv),
 	SOC_DAPM_SINGLE("PGA Capture Switch",
-			WM8350_RIGHT_INPUT_VOLUME, 14, 1, 0),
+			WM8350_RIGHT_INPUT_VOLUME, 14, 1, 1),
 };
 
 /* Left Mic Mixer */
@@ -613,7 +613,7 @@
 
 /* Out4 Capture Mux */
 static const struct snd_kcontrol_new wm8350_out4_capture_controls =
-SOC_DAPM_ENUM("Route", wm8350_enum[8]);
+SOC_DAPM_ENUM("Route", wm8350_enum[7]);
 
 static const struct snd_soc_dapm_widget wm8350_dapm_widgets[] = {
 
--- linux-rt-2.6.31.orig/init/main.c
+++ linux-rt-2.6.31/init/main.c
@@ -233,7 +233,7 @@
 
 static int __init quiet_kernel(char *str)
 {
-	console_loglevel = 4;
+	console_loglevel = 2;
 	return 0;
 }
 
@@ -250,7 +250,7 @@
 
 /*
  * Unknown boot options get handed to init, unless they look like
- * failed parameters
+ * unused parameters (modprobe will find them in /proc/cmdline).
  */
 static int __init unknown_bootoption(char *param, char *val)
 {
@@ -271,14 +271,9 @@
 	if (obsolete_checksetup(param))
 		return 0;
 
-	/*
-	 * Preemptive maintenance for "why didn't my misspelled command
-	 * line work?"
-	 */
-	if (strchr(param, '.') && (!val || strchr(param, '.') < val)) {
-		printk(KERN_ERR "Unknown boot option `%s': ignoring\n", param);
+	/* Unused module parameter. */
+	if (strchr(param, '.') && (!val || strchr(param, '.') < val))
 		return 0;
-	}
 
 	if (panic_later)
 		return 0;
--- linux-rt-2.6.31.orig/init/version.c
+++ linux-rt-2.6.31/init/version.c
@@ -39,7 +39,11 @@
 /* FIXED STRINGS! Don't touch! */
 const char linux_banner[] =
 	"Linux version " UTS_RELEASE " (" LINUX_COMPILE_BY "@"
-	LINUX_COMPILE_HOST ") (" LINUX_COMPILER ") " UTS_VERSION "\n";
+	LINUX_COMPILE_HOST ") (" LINUX_COMPILER ") " UTS_VERSION
+#ifdef CONFIG_VERSION_SIGNATURE
+        " (" CONFIG_VERSION_SIGNATURE ")"
+#endif
+	"\n";
 
 const char linux_proc_banner[] =
 	"%s version %s"
--- linux-rt-2.6.31.orig/init/Kconfig
+++ linux-rt-2.6.31/init/Kconfig
@@ -166,6 +166,15 @@
 
 endchoice
 
+config VERSION_SIGNATURE
+	string "Arbitrary version signature"
+	help
+	  This string will be created in a file, /proc/version_signature. It
+	  is useful in determining arbitrary data about your kernel. For instance,
+	  if you have several kernels of the same version, but need to keep track
+	  of a revision of the same kernel, but not affect it's ability to load
+	  compatible modules, this is the easiest way to do that.
+
 config SWAP
 	bool "Support for paging of anonymous memory (swap)"
 	depends on MMU && BLOCK
--- linux-rt-2.6.31.orig/security/device_cgroup.c
+++ linux-rt-2.6.31/security/device_cgroup.c
@@ -513,6 +513,7 @@
 
 	return -EPERM;
 }
+EXPORT_SYMBOL(devcgroup_inode_permission);
 
 int devcgroup_inode_mknod(int mode, dev_t dev)
 {
--- linux-rt-2.6.31.orig/security/Kconfig
+++ linux-rt-2.6.31/security/Kconfig
@@ -60,6 +60,15 @@
 
 	  If you are unsure how to answer this question, answer N.
 
+config SECURITY_DEFAULT
+	string "Default security module"
+	depends on SECURITY
+	default ""
+	help
+          This determines the security module used if the security=
+          boot parmater is not provided.  If a security module is not
+          specified the first module to register will be used.
+
 config SECURITY_NETWORK
 	bool "Socket and Networking Security Hooks"
 	depends on SECURITY
--- linux-rt-2.6.31.orig/security/security.c
+++ linux-rt-2.6.31/security/security.c
@@ -18,7 +18,7 @@
 #include <linux/security.h>
 
 /* Boot-time LSM user choice */
-static __initdata char chosen_lsm[SECURITY_NAME_MAX + 1];
+static __initdata char chosen_lsm[SECURITY_NAME_MAX + 1] = CONFIG_SECURITY_DEFAULT;
 
 /* things that live in capability.c */
 extern struct security_operations default_security_ops;
@@ -79,8 +79,10 @@
  *
  * Return true if:
  *	-The passed LSM is the one chosen by user at boot time,
- *	-or user didn't specify a specific LSM and we're the first to ask
- *	 for registration permission,
+ *	-The passed LSM is configured as the default and the user did not
+ *	 choose an alternate LSM at boot time.
+ *	-or there is no default LSM set and the user didn't specify a
+ *	 specific LSM and we're the first to ask for registration permission,
  *	-or the passed LSM is currently loaded.
  * Otherwise, return false.
  */
@@ -386,6 +388,7 @@
 		return 0;
 	return security_ops->path_mkdir(path, dentry, mode);
 }
+EXPORT_SYMBOL(security_path_mkdir);
 
 int security_path_rmdir(struct path *path, struct dentry *dentry)
 {
@@ -393,6 +396,7 @@
 		return 0;
 	return security_ops->path_rmdir(path, dentry);
 }
+EXPORT_SYMBOL(security_path_rmdir);
 
 int security_path_unlink(struct path *path, struct dentry *dentry)
 {
@@ -400,6 +404,7 @@
 		return 0;
 	return security_ops->path_unlink(path, dentry);
 }
+EXPORT_SYMBOL(security_path_unlink);
 
 int security_path_symlink(struct path *path, struct dentry *dentry,
 			  const char *old_name)
@@ -408,6 +413,7 @@
 		return 0;
 	return security_ops->path_symlink(path, dentry, old_name);
 }
+EXPORT_SYMBOL(security_path_symlink);
 
 int security_path_link(struct dentry *old_dentry, struct path *new_dir,
 		       struct dentry *new_dentry)
@@ -416,6 +422,7 @@
 		return 0;
 	return security_ops->path_link(old_dentry, new_dir, new_dentry);
 }
+EXPORT_SYMBOL(security_path_link);
 
 int security_path_rename(struct path *old_dir, struct dentry *old_dentry,
 			 struct path *new_dir, struct dentry *new_dentry)
@@ -426,6 +433,7 @@
 	return security_ops->path_rename(old_dir, old_dentry, new_dir,
 					 new_dentry);
 }
+EXPORT_SYMBOL(security_path_rename);
 
 int security_path_truncate(struct path *path, loff_t length,
 			   unsigned int time_attrs)
@@ -434,6 +442,7 @@
 		return 0;
 	return security_ops->path_truncate(path, length, time_attrs);
 }
+EXPORT_SYMBOL(security_path_truncate);
 #endif
 
 int security_inode_create(struct inode *dir, struct dentry *dentry, int mode)
@@ -505,6 +514,7 @@
 		return 0;
 	return security_ops->inode_readlink(dentry);
 }
+EXPORT_SYMBOL(security_inode_readlink);
 
 int security_inode_follow_link(struct dentry *dentry, struct nameidata *nd)
 {
@@ -519,6 +529,7 @@
 		return 0;
 	return security_ops->inode_permission(inode, mask);
 }
+EXPORT_SYMBOL(security_inode_permission);
 
 int security_inode_setattr(struct dentry *dentry, struct iattr *attr)
 {
@@ -619,6 +630,7 @@
 {
 	return security_ops->file_permission(file, mask);
 }
+EXPORT_SYMBOL(security_file_permission);
 
 int security_file_alloc(struct file *file)
 {
--- linux-rt-2.6.31.orig/security/integrity/ima/ima_iint.c
+++ linux-rt-2.6.31/security/integrity/ima/ima_iint.c
@@ -58,11 +58,11 @@
 
 	if (!ima_initialized)
 		return iint;
-	iint = kmem_cache_alloc(iint_cache, GFP_KERNEL);
+	iint = kmem_cache_alloc(iint_cache, GFP_NOFS);
 	if (!iint)
 		return iint;
 
-	rc = radix_tree_preload(GFP_KERNEL);
+	rc = radix_tree_preload(GFP_NOFS);
 	if (rc < 0)
 		goto out;
 
--- linux-rt-2.6.31.orig/security/keys/keyctl.c
+++ linux-rt-2.6.31/security/keys/keyctl.c
@@ -860,7 +860,7 @@
 	/* otherwise specify the destination keyring recorded in the
 	 * authorisation key (any KEY_SPEC_*_KEYRING) */
 	if (ringid >= KEY_SPEC_REQUESTOR_KEYRING) {
-		*_dest_keyring = rka->dest_keyring;
+		*_dest_keyring = key_get(rka->dest_keyring);
 		return 0;
 	}
 
--- linux-rt-2.6.31.orig/block/elevator.c
+++ linux-rt-2.6.31/block/elevator.c
@@ -101,16 +101,22 @@
 		return 0;
 
 	/*
-	 * Don't merge if failfast settings don't match.
+	 * Don't merge if failfast settings don't match.  Note readahead
+	 * requests are always mapped to failfast.
 	 *
 	 * FIXME: The negation in front of each condition is necessary
 	 * because bio and request flags use different bit positions
 	 * and the accessors return those bits directly.  This
 	 * ugliness will soon go away.
 	 */
-	if (!bio_failfast_dev(bio)	 != !blk_failfast_dev(rq)	||
-	    !bio_failfast_transport(bio) != !blk_failfast_transport(rq)	||
-	    !bio_failfast_driver(bio)	 != !blk_failfast_driver(rq))
+	if (!(bio_rw_ahead(bio) || bio_failfast_dev(bio)) !=
+						!blk_failfast_dev(rq))
+		return 0;
+	if (!(bio_rw_ahead(bio) || bio_failfast_transport(bio)) !=
+						!blk_failfast_transport(rq))
+		return 0;
+	if (!(bio_rw_ahead(bio) || bio_failfast_driver(bio)) !=
+						!blk_failfast_driver(rq))
 		return 0;
 
 	if (!elv_iosched_allow_merge(rq, bio))
--- linux-rt-2.6.31.orig/block/blk-sysfs.c
+++ linux-rt-2.6.31/block/blk-sysfs.c
@@ -40,7 +40,12 @@
 {
 	struct request_list *rl = &q->rq;
 	unsigned long nr;
-	int ret = queue_var_store(&nr, page, count);
+	int ret;
+
+	if (!q->request_fn)
+		return -EINVAL;
+
+	ret = queue_var_store(&nr, page, count);
 	if (nr < BLKDEV_MIN_RQ)
 		nr = BLKDEV_MIN_RQ;
 
--- linux-rt-2.6.31.orig/block/blk-core.c
+++ linux-rt-2.6.31/block/blk-core.c
@@ -1163,7 +1163,7 @@
 	const int unplug = bio_unplug(bio);
 	int rw_flags;
 
-	if (bio_barrier(bio) && bio_has_data(bio) &&
+	if (bio_barrier(bio) &&
 	    (q->next_ordered == QUEUE_ORDERED_NONE)) {
 		bio_endio(bio, -EOPNOTSUPP);
 		return 0;
--- linux-rt-2.6.31.orig/mm/nommu.c
+++ linux-rt-2.6.31/mm/nommu.c
@@ -1056,7 +1056,7 @@
 	ret = vma->vm_file->f_op->mmap(vma->vm_file, vma);
 	if (ret == 0) {
 		vma->vm_region->vm_top = vma->vm_region->vm_end;
-		return ret;
+		return 0;
 	}
 	if (ret != -ENOSYS)
 		return ret;
@@ -1073,7 +1073,8 @@
  */
 static int do_mmap_private(struct vm_area_struct *vma,
 			   struct vm_region *region,
-			   unsigned long len)
+			   unsigned long len,
+			   unsigned long capabilities)
 {
 	struct page *pages;
 	unsigned long total, point, n, rlen;
@@ -1084,13 +1085,13 @@
 	 * shared mappings on devices or memory
 	 * - VM_MAYSHARE will be set if it may attempt to share
 	 */
-	if (vma->vm_file) {
+	if (capabilities & BDI_CAP_MAP_DIRECT) {
 		ret = vma->vm_file->f_op->mmap(vma->vm_file, vma);
 		if (ret == 0) {
 			/* shouldn't return success if we're not sharing */
 			BUG_ON(!(vma->vm_flags & VM_MAYSHARE));
 			vma->vm_region->vm_top = vma->vm_region->vm_end;
-			return ret;
+			return 0;
 		}
 		if (ret != -ENOSYS)
 			return ret;
@@ -1317,7 +1318,8 @@
 					goto error_just_free;
 				}
 			}
-			fput(region->vm_file);
+			if (region->vm_file)
+				fput(region->vm_file);
 			kmem_cache_free(vm_region_jar, region);
 			region = pregion;
 			result = start;
@@ -1328,7 +1330,7 @@
 		 * - this is the hook for quasi-memory character devices to
 		 *   tell us the location of a shared mapping
 		 */
-		if (file && file->f_op->get_unmapped_area) {
+		if (capabilities & BDI_CAP_MAP_DIRECT) {
 			addr = file->f_op->get_unmapped_area(file, addr, len,
 							     pgoff, flags);
 			if (IS_ERR((void *) addr)) {
@@ -1352,15 +1354,17 @@
 	}
 
 	vma->vm_region = region;
-	add_nommu_region(region);
 
-	/* set up the mapping */
+	/* set up the mapping
+	 * - the region is filled in if BDI_CAP_MAP_DIRECT is still set
+	 */
 	if (file && vma->vm_flags & VM_SHARED)
 		ret = do_mmap_shared_file(vma);
 	else
-		ret = do_mmap_private(vma, region, len);
+		ret = do_mmap_private(vma, region, len, capabilities);
 	if (ret < 0)
-		goto error_put_region;
+		goto error_just_free;
+	add_nommu_region(region);
 
 	/* okay... we have a mapping; now we have to register it */
 	result = vma->vm_start;
@@ -1378,25 +1382,14 @@
 	kleave(" = %lx", result);
 	return result;
 
-error_put_region:
-	__put_nommu_region(region);
-	if (vma) {
-		if (vma->vm_file) {
-			fput(vma->vm_file);
-			if (vma->vm_flags & VM_EXECUTABLE)
-				removed_exe_file_vma(vma->vm_mm);
-		}
-		kmem_cache_free(vm_area_cachep, vma);
-	}
-	kleave(" = %d [pr]", ret);
-	return ret;
-
 error_just_free:
 	up_write(&nommu_region_sem);
 error:
-	fput(region->vm_file);
+	if (region->vm_file)
+		fput(region->vm_file);
 	kmem_cache_free(vm_region_jar, region);
-	fput(vma->vm_file);
+	if (vma->vm_file)
+		fput(vma->vm_file);
 	if (vma->vm_flags & VM_EXECUTABLE)
 		removed_exe_file_vma(vma->vm_mm);
 	kmem_cache_free(vm_area_cachep, vma);
--- linux-rt-2.6.31.orig/mm/mprotect.c
+++ linux-rt-2.6.31/mm/mprotect.c
@@ -26,9 +26,14 @@
 #include <linux/perf_counter.h>
 #include <asm/uaccess.h>
 #include <asm/pgtable.h>
+#include <asm/pgalloc.h>
 #include <asm/cacheflush.h>
 #include <asm/tlbflush.h>
 
+#ifndef arch_remove_exec_range
+#define arch_remove_exec_range(mm, limit)      do { ; } while (0)
+#endif
+
 #ifndef pgprot_modify
 static inline pgprot_t pgprot_modify(pgprot_t oldprot, pgprot_t newprot)
 {
@@ -139,7 +144,7 @@
 	struct mm_struct *mm = vma->vm_mm;
 	unsigned long oldflags = vma->vm_flags;
 	long nrpages = (end - start) >> PAGE_SHIFT;
-	unsigned long charged = 0;
+	unsigned long charged = 0, old_end = vma->vm_end;
 	pgoff_t pgoff;
 	int error;
 	int dirty_accountable = 0;
@@ -204,6 +209,9 @@
 		dirty_accountable = 1;
 	}
 
+	if (oldflags & VM_EXEC)
+		arch_remove_exec_range(current->mm, old_end);
+
 	mmu_notifier_invalidate_range_start(mm, start, end);
 	if (is_vm_hugetlb_page(vma))
 		hugetlb_change_protection(vma, start, end, vma->vm_page_prot);
--- linux-rt-2.6.31.orig/mm/oom_kill.c
+++ linux-rt-2.6.31/mm/oom_kill.c
@@ -400,7 +400,7 @@
 		cpuset_print_task_mems_allowed(current);
 		task_unlock(current);
 		dump_stack();
-		mem_cgroup_print_oom_info(mem, current);
+		mem_cgroup_print_oom_info(mem, p);
 		show_mem();
 		if (sysctl_oom_dump_tasks)
 			dump_tasks(mem);
--- linux-rt-2.6.31.orig/mm/pagewalk.c
+++ linux-rt-2.6.31/mm/pagewalk.c
@@ -1,6 +1,7 @@
 #include <linux/mm.h>
 #include <linux/highmem.h>
 #include <linux/sched.h>
+#include <linux/hugetlb.h>
 
 static int walk_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
 			  struct mm_walk *walk)
@@ -107,6 +108,7 @@
 	pgd_t *pgd;
 	unsigned long next;
 	int err = 0;
+	struct vm_area_struct *vma;
 
 	if (addr >= end)
 		return err;
@@ -117,11 +119,22 @@
 	pgd = pgd_offset(walk->mm, addr);
 	do {
 		next = pgd_addr_end(addr, end);
+
+		/* skip hugetlb vma to avoid hugepage PMD being cleared
+		 * in pmd_none_or_clear_bad(). */
+		vma = find_vma(walk->mm, addr);
+		if (vma && is_vm_hugetlb_page(vma)) {
+			if (vma->vm_end < next)
+				next = vma->vm_end;
+			continue;
+		}
+
 		if (pgd_none_or_clear_bad(pgd)) {
 			if (walk->pte_hole)
 				err = walk->pte_hole(addr, next, walk);
 			if (err)
 				break;
+			pgd++;
 			continue;
 		}
 		if (walk->pgd_entry)
@@ -131,7 +144,8 @@
 			err = walk_pud_range(pgd, addr, next, walk);
 		if (err)
 			break;
-	} while (pgd++, addr = next, addr != end);
+		pgd++;
+	} while (addr = next, addr != end);
 
 	return err;
 }
--- linux-rt-2.6.31.orig/mm/highmem.c
+++ linux-rt-2.6.31/mm/highmem.c
@@ -426,16 +426,21 @@
 
 void debug_kmap_atomic(enum km_type type)
 {
-	static unsigned warn_count = 10;
+	static int warn_count = 10;
 
-	if (unlikely(warn_count == 0))
+	if (unlikely(warn_count < 0))
 		return;
 
 	if (unlikely(in_interrupt())) {
-		if (in_irq()) {
+		if (in_nmi()) {
+			if (type != KM_NMI && type != KM_NMI_PTE) {
+				WARN_ON(1);
+				warn_count--;
+			}
+		} else if (in_irq()) {
 			if (type != KM_IRQ0 && type != KM_IRQ1 &&
 			    type != KM_BIO_SRC_IRQ && type != KM_BIO_DST_IRQ &&
-			    type != KM_BOUNCE_READ) {
+			    type != KM_BOUNCE_READ && type != KM_IRQ_PTE) {
 				WARN_ON(1);
 				warn_count--;
 			}
@@ -452,7 +457,9 @@
 	}
 
 	if (type == KM_IRQ0 || type == KM_IRQ1 || type == KM_BOUNCE_READ ||
-			type == KM_BIO_SRC_IRQ || type == KM_BIO_DST_IRQ) {
+			type == KM_BIO_SRC_IRQ || type == KM_BIO_DST_IRQ ||
+			type == KM_IRQ_PTE || type == KM_NMI ||
+			type == KM_NMI_PTE ) {
 		if (!irqs_disabled()) {
 			WARN_ON(1);
 			warn_count--;
--- linux-rt-2.6.31.orig/mm/migrate.c
+++ linux-rt-2.6.31/mm/migrate.c
@@ -597,7 +597,7 @@
 	struct page *newpage = get_new_page(page, private, &result);
 	int rcu_locked = 0;
 	int charge = 0;
-	struct mem_cgroup *mem;
+	struct mem_cgroup *mem = NULL;
 
 	if (!newpage)
 		return -ENOMEM;
@@ -937,6 +937,9 @@
 				goto out_pm;
 
 			err = -ENODEV;
+			if (node < 0 || node >= MAX_NUMNODES)
+				goto out_pm;
+
 			if (!node_state(node, N_HIGH_MEMORY))
 				goto out_pm;
 
--- linux-rt-2.6.31.orig/mm/swapfile.c
+++ linux-rt-2.6.31/mm/swapfile.c
@@ -584,8 +584,12 @@
 		nr_swap_pages++;
 		p->inuse_pages--;
 	}
-	if (!swap_count(count))
+	if (!swap_count(count)) {
 		mem_cgroup_uncharge_swap(ent);
+			if (p->notify_swap_entry_free_fn)
+				p->notify_swap_entry_free_fn(offset);
+	}
+
 	return count;
 }
 
@@ -1149,8 +1153,7 @@
 				} else
 					retval = unuse_mm(mm, entry, page);
 
-				if (set_start_mm &&
-				    swap_count(*swap_map) < swcount) {
+				if (set_start_mm && *swap_map < swcount) {
 					mmput(new_start_mm);
 					atomic_inc(&mm->mm_users);
 					new_start_mm = mm;
@@ -2164,6 +2167,23 @@
 }
 
 /*
+ * Sets callback for event when swap_map[offset] == 0
+ * i.e. page at this swap offset is not longer used.
+ *
+ * type: identifies swap file
+ * fn: callback function
+ */
+void set_notify_swap_entry_free(unsigned type, void (*fn) (unsigned long))
+{
+	struct swap_info_struct *sis;
+	sis = get_swap_info_struct(type);
+	BUG_ON(!sis);
+	sis->notify_swap_entry_free_fn = fn;
+	return;
+}
+EXPORT_SYMBOL(set_notify_swap_entry_free);
+
+/*
  * swap_lock prevents swap_map being freed. Don't grab an extra
  * reference on the swaphandle, it doesn't matter if it becomes unused.
  */
--- linux-rt-2.6.31.orig/mm/mlock.c
+++ linux-rt-2.6.31/mm/mlock.c
@@ -139,49 +139,36 @@
 }
 
 /**
- * __mlock_vma_pages_range() -  mlock/munlock a range of pages in the vma.
+ * __mlock_vma_pages_range() -  mlock a range of pages in the vma.
  * @vma:   target vma
  * @start: start address
  * @end:   end address
- * @mlock: 0 indicate munlock, otherwise mlock.
  *
- * If @mlock == 0, unlock an mlocked range;
- * else mlock the range of pages.  This takes care of making the pages present ,
- * too.
+ * This takes care of making the pages present too.
  *
  * return 0 on success, negative error code on error.
  *
  * vma->vm_mm->mmap_sem must be held for at least read.
  */
 static long __mlock_vma_pages_range(struct vm_area_struct *vma,
-				   unsigned long start, unsigned long end,
-				   int mlock)
+				    unsigned long start, unsigned long end)
 {
 	struct mm_struct *mm = vma->vm_mm;
 	unsigned long addr = start;
 	struct page *pages[16]; /* 16 gives a reasonable batch */
 	int nr_pages = (end - start) / PAGE_SIZE;
 	int ret = 0;
-	int gup_flags = 0;
+	int gup_flags;
 
 	VM_BUG_ON(start & ~PAGE_MASK);
 	VM_BUG_ON(end   & ~PAGE_MASK);
 	VM_BUG_ON(start < vma->vm_start);
 	VM_BUG_ON(end   > vma->vm_end);
-	VM_BUG_ON((!rwsem_is_locked(&mm->mmap_sem)) &&
-		  (atomic_read(&mm->mm_users) != 0));
-
-	/*
-	 * mlock:   don't page populate if vma has PROT_NONE permission.
-	 * munlock: always do munlock although the vma has PROT_NONE
-	 *          permission, or SIGKILL is pending.
-	 */
-	if (!mlock)
-		gup_flags |= GUP_FLAGS_IGNORE_VMA_PERMISSIONS |
-			     GUP_FLAGS_IGNORE_SIGKILL;
+	VM_BUG_ON(!rwsem_is_locked(&mm->mmap_sem));
 
+	gup_flags = 0;
 	if (vma->vm_flags & VM_WRITE)
-		gup_flags |= GUP_FLAGS_WRITE;
+		gup_flags = GUP_FLAGS_WRITE;
 
 	while (nr_pages > 0) {
 		int i;
@@ -201,19 +188,10 @@
 		 * This can happen for, e.g., VM_NONLINEAR regions before
 		 * a page has been allocated and mapped at a given offset,
 		 * or for addresses that map beyond end of a file.
-		 * We'll mlock the the pages if/when they get faulted in.
+		 * We'll mlock the pages if/when they get faulted in.
 		 */
 		if (ret < 0)
 			break;
-		if (ret == 0) {
-			/*
-			 * We know the vma is there, so the only time
-			 * we cannot get a single page should be an
-			 * error (ret < 0) case.
-			 */
-			WARN_ON(1);
-			break;
-		}
 
 		lru_add_drain();	/* push cached pages to LRU */
 
@@ -224,28 +202,22 @@
 			/*
 			 * Because we lock page here and migration is blocked
 			 * by the elevated reference, we need only check for
-			 * page truncation (file-cache only).
+			 * file-cache page truncation.  This page->mapping
+			 * check also neatly skips over the ZERO_PAGE(),
+			 * though if that's common we'd prefer not to lock it.
 			 */
-			if (page->mapping) {
-				if (mlock)
-					mlock_vma_page(page);
-				else
-					munlock_vma_page(page);
-			}
+			if (page->mapping)
+				mlock_vma_page(page);
 			unlock_page(page);
-			put_page(page);		/* ref from get_user_pages() */
-
-			/*
-			 * here we assume that get_user_pages() has given us
-			 * a list of virtually contiguous pages.
-			 */
-			addr += PAGE_SIZE;	/* for next get_user_pages() */
-			nr_pages--;
+			put_page(page);	/* ref from get_user_pages() */
 		}
+
+		addr += ret * PAGE_SIZE;
+		nr_pages -= ret;
 		ret = 0;
 	}
 
-	return ret;	/* count entire vma as locked_vm */
+	return ret;	/* 0 or negative error code */
 }
 
 /*
@@ -289,7 +261,7 @@
 			is_vm_hugetlb_page(vma) ||
 			vma == get_gate_vma(current))) {
 
-		__mlock_vma_pages_range(vma, start, end, 1);
+		__mlock_vma_pages_range(vma, start, end);
 
 		/* Hide errors from mmap() and other callers */
 		return 0;
@@ -310,7 +282,6 @@
 	return nr_pages;		/* error or pages NOT mlocked */
 }
 
-
 /*
  * munlock_vma_pages_range() - munlock all pages in the vma range.'
  * @vma - vma containing range to be munlock()ed.
@@ -330,10 +301,24 @@
  * free them.  This will result in freeing mlocked pages.
  */
 void munlock_vma_pages_range(struct vm_area_struct *vma,
-			   unsigned long start, unsigned long end)
+			     unsigned long start, unsigned long end)
 {
+	unsigned long addr;
+
+	lru_add_drain();
 	vma->vm_flags &= ~VM_LOCKED;
-	__mlock_vma_pages_range(vma, start, end, 0);
+
+	for (addr = start; addr < end; addr += PAGE_SIZE) {
+		struct page *page = follow_page(vma, addr, FOLL_GET);
+		if (page) {
+			lock_page(page);
+			if (page->mapping)
+				munlock_vma_page(page);
+			unlock_page(page);
+			put_page(page);
+		}
+		cond_resched();
+	}
 }
 
 /*
@@ -400,18 +385,14 @@
 	 * It's okay if try_to_unmap_one unmaps a page just after we
 	 * set VM_LOCKED, __mlock_vma_pages_range will bring it back.
 	 */
-	vma->vm_flags = newflags;
 
 	if (lock) {
-		ret = __mlock_vma_pages_range(vma, start, end, 1);
-
-		if (ret > 0) {
-			mm->locked_vm -= ret;
-			ret = 0;
-		} else
-			ret = __mlock_posix_error_return(ret); /* translate if needed */
+		vma->vm_flags = newflags;
+		ret = __mlock_vma_pages_range(vma, start, end);
+		if (ret < 0)
+			ret = __mlock_posix_error_return(ret);
 	} else {
-		__mlock_vma_pages_range(vma, start, end, 0);
+		munlock_vma_pages_range(vma, start, end);
 	}
 
 out:
--- linux-rt-2.6.31.orig/mm/swap_state.c
+++ linux-rt-2.6.31/mm/swap_state.c
@@ -66,10 +66,10 @@
 }
 
 /*
- * add_to_swap_cache resembles add_to_page_cache_locked on swapper_space,
+ * __add_to_swap_cache resembles add_to_page_cache_locked on swapper_space,
  * but sets SwapCache flag and private instead of mapping and index.
  */
-int add_to_swap_cache(struct page *page, swp_entry_t entry, gfp_t gfp_mask)
+static int __add_to_swap_cache(struct page *page, swp_entry_t entry)
 {
 	int error;
 
@@ -77,28 +77,37 @@
 	VM_BUG_ON(PageSwapCache(page));
 	VM_BUG_ON(!PageSwapBacked(page));
 
+	page_cache_get(page);
+	SetPageSwapCache(page);
+	set_page_private(page, entry.val);
+
+	spin_lock_irq(&swapper_space.tree_lock);
+	error = radix_tree_insert(&swapper_space.page_tree, entry.val, page);
+	if (likely(!error)) {
+		total_swapcache_pages++;
+		__inc_zone_page_state(page, NR_FILE_PAGES);
+		INC_CACHE_INFO(add_total);
+	}
+	spin_unlock_irq(&swapper_space.tree_lock);
+
+	if (unlikely(error)) {
+		set_page_private(page, 0UL);
+		ClearPageSwapCache(page);
+		page_cache_release(page);
+	}
+
+	return error;
+}
+
+
+int add_to_swap_cache(struct page *page, swp_entry_t entry, gfp_t gfp_mask)
+{
+	int error;
+
 	error = radix_tree_preload(gfp_mask);
 	if (!error) {
-		page_cache_get(page);
-		SetPageSwapCache(page);
-		set_page_private(page, entry.val);
-
-		spin_lock_irq(&swapper_space.tree_lock);
-		error = radix_tree_insert(&swapper_space.page_tree,
-						entry.val, page);
-		if (likely(!error)) {
-			total_swapcache_pages++;
-			__inc_zone_page_state(page, NR_FILE_PAGES);
-			INC_CACHE_INFO(add_total);
-		}
-		spin_unlock_irq(&swapper_space.tree_lock);
+		error = __add_to_swap_cache(page, entry);
 		radix_tree_preload_end();
-
-		if (unlikely(error)) {
-			set_page_private(page, 0UL);
-			ClearPageSwapCache(page);
-			page_cache_release(page);
-		}
 	}
 	return error;
 }
@@ -289,13 +298,24 @@
 		}
 
 		/*
+		 * call radix_tree_preload() while we can wait.
+		 */
+		err = radix_tree_preload(gfp_mask & GFP_KERNEL);
+		if (err)
+			break;
+
+		/*
 		 * Swap entry may have been freed since our caller observed it.
 		 */
 		err = swapcache_prepare(entry);
-		if (err == -EEXIST) /* seems racy */
+		if (err == -EEXIST) {	/* seems racy */
+			radix_tree_preload_end();
 			continue;
-		if (err)           /* swp entry is obsolete ? */
+		}
+		if (err) {		/* swp entry is obsolete ? */
+			radix_tree_preload_end();
 			break;
+		}
 
 		/*
 		 * Associate the page with swap entry in the swap cache.
@@ -307,8 +327,9 @@
 		 */
 		__set_page_locked(new_page);
 		SetPageSwapBacked(new_page);
-		err = add_to_swap_cache(new_page, entry, gfp_mask & GFP_KERNEL);
+		err = __add_to_swap_cache(new_page, entry);
 		if (likely(!err)) {
+			radix_tree_preload_end();
 			/*
 			 * Initiate read into locked page and return.
 			 */
@@ -316,6 +337,7 @@
 			swap_readpage(new_page);
 			return new_page;
 		}
+		radix_tree_preload_end();
 		ClearPageSwapBacked(new_page);
 		__clear_page_locked(new_page);
 		swapcache_free(entry, NULL);
--- linux-rt-2.6.31.orig/mm/vmscan.c
+++ linux-rt-2.6.31/mm/vmscan.c
@@ -1298,7 +1298,7 @@
 			 * IO, plus JVM can create lots of anon VM_EXEC pages,
 			 * so we ignore them here.
 			 */
-			if ((vm_flags & VM_EXEC) && !PageAnon(page)) {
+			if ((vm_flags & VM_EXEC) && page_is_file_cache(page)) {
 				list_add(&page->lru, &l_active);
 				continue;
 			}
--- linux-rt-2.6.31.orig/mm/mempolicy.c
+++ linux-rt-2.6.31/mm/mempolicy.c
@@ -1024,7 +1024,7 @@
 
 		err = migrate_prep();
 		if (err)
-			return err;
+			goto mpol_out;
 	}
 	{
 		NODEMASK_SCRATCH(scratch);
@@ -1039,10 +1039,9 @@
 			err = -ENOMEM;
 		NODEMASK_SCRATCH_FREE(scratch);
 	}
-	if (err) {
-		mpol_put(new);
-		return err;
-	}
+	if (err)
+		goto mpol_out;
+
 	vma = check_range(mm, start, end, nmask,
 			  flags | MPOL_MF_INVERT, &pagelist);
 
@@ -1058,9 +1057,11 @@
 
 		if (!err && nr_failed && (flags & MPOL_MF_STRICT))
 			err = -EIO;
-	}
+	} else
+		putback_lru_pages(&pagelist);
 
 	up_write(&mm->mmap_sem);
+ mpol_out:
 	mpol_put(new);
 	return err;
 }
--- linux-rt-2.6.31.orig/mm/mincore.c
+++ linux-rt-2.6.31/mm/mincore.c
@@ -14,6 +14,7 @@
 #include <linux/syscalls.h>
 #include <linux/swap.h>
 #include <linux/swapops.h>
+#include <linux/hugetlb.h>
 
 #include <asm/uaccess.h>
 #include <asm/pgtable.h>
@@ -72,6 +73,42 @@
 	if (!vma || addr < vma->vm_start)
 		return -ENOMEM;
 
+#ifdef CONFIG_HUGETLB_PAGE
+	if (is_vm_hugetlb_page(vma)) {
+		struct hstate *h;
+		unsigned long nr_huge;
+		unsigned char present;
+
+		i = 0;
+		nr = min(pages, (vma->vm_end - addr) >> PAGE_SHIFT);
+		h = hstate_vma(vma);
+		nr_huge = ((addr + pages * PAGE_SIZE - 1) >> huge_page_shift(h))
+			  - (addr >> huge_page_shift(h)) + 1;
+		nr_huge = min(nr_huge,
+			      (vma->vm_end - addr) >> huge_page_shift(h));
+		while (1) {
+			/* hugepage always in RAM for now,
+			 * but generally it needs to be check */
+			ptep = huge_pte_offset(current->mm,
+					       addr & huge_page_mask(h));
+			present = !!(ptep &&
+				     !huge_pte_none(huge_ptep_get(ptep)));
+			while (1) {
+				vec[i++] = present;
+				addr += PAGE_SIZE;
+				/* reach buffer limit */
+				if (i == nr)
+					return nr;
+				/* check hugepage border */
+				if (!((addr & ~huge_page_mask(h))
+				      >> PAGE_SHIFT))
+					break;
+			}
+		}
+		return nr;
+	}
+#endif
+
 	/*
 	 * Calculate how many pages there are left in the last level of the
 	 * PTE array for our address.
--- linux-rt-2.6.31.orig/mm/memcontrol.c
+++ linux-rt-2.6.31/mm/memcontrol.c
@@ -496,7 +496,13 @@
 	task_unlock(task);
 	if (!curr)
 		return 0;
-	if (curr->use_hierarchy)
+	/*
+	 * We should check use_hierarchy of "mem" not "curr". Because checking
+	 * use_hierarchy of "curr" here make this function true if hierarchy is
+	 * enabled in "curr" and "curr" is a child of "mem" in *cgroup*
+	 * hierarchy(even if use_hierarchy is disabled in "mem").
+	 */
+	if (mem->use_hierarchy)
 		ret = css_is_ancestor(&curr->css, &mem->css);
 	else
 		ret = (curr == mem);
--- linux-rt-2.6.31.orig/mm/memory.c
+++ linux-rt-2.6.31/mm/memory.c
@@ -2638,7 +2638,8 @@
 		goto oom_free_page;
 
 	entry = mk_pte(page, vma->vm_page_prot);
-	entry = maybe_mkwrite(pte_mkdirty(entry), vma);
+	if (vma->vm_flags & VM_WRITE)
+		entry = pte_mkwrite(pte_mkdirty(entry));
 
 	page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
 	if (!pte_none(*page_table))
--- linux-rt-2.6.31.orig/mm/mmap.c
+++ linux-rt-2.6.31/mm/mmap.c
@@ -29,6 +29,7 @@
 #include <linux/rmap.h>
 #include <linux/mmu_notifier.h>
 #include <linux/perf_counter.h>
+#include <linux/random.h>
 
 #include <asm/uaccess.h>
 #include <asm/cacheflush.h>
@@ -45,6 +46,18 @@
 #define arch_rebalance_pgtables(addr, len)		(addr)
 #endif
 
+/* No sane architecture will #define these to anything else */
+#ifndef arch_add_exec_range
+#define arch_add_exec_range(mm, limit)	do { ; } while (0)
+#endif
+#ifndef arch_flush_exec_range
+#define arch_flush_exec_range(mm)	do { ; } while (0)
+#endif
+#ifndef arch_remove_exec_range
+#define arch_remove_exec_range(mm, limit)	do { ; } while (0)
+#endif
+
+
 static void unmap_region(struct mm_struct *mm,
 		struct vm_area_struct *vma, struct vm_area_struct *prev,
 		unsigned long start, unsigned long end);
@@ -389,6 +402,8 @@
 __vma_link_list(struct mm_struct *mm, struct vm_area_struct *vma,
 		struct vm_area_struct *prev, struct rb_node *rb_parent)
 {
+	if (vma->vm_flags & VM_EXEC)
+		arch_add_exec_range(mm, vma->vm_end);
 	if (prev) {
 		vma->vm_next = prev->vm_next;
 		prev->vm_next = vma;
@@ -491,6 +506,8 @@
 	rb_erase(&vma->vm_rb, &mm->mm_rb);
 	if (mm->mmap_cache == vma)
 		mm->mmap_cache = prev;
+	if (vma->vm_flags & VM_EXEC)
+		arch_remove_exec_range(mm, vma->vm_end);
 }
 
 /*
@@ -570,9 +587,9 @@
 
 	/*
 	 * When changing only vma->vm_end, we don't really need
-	 * anon_vma lock: but is that case worth optimizing out?
+	 * anon_vma lock.
 	 */
-	if (vma->anon_vma)
+	if (vma->anon_vma && (insert || importer || start != vma->vm_start))
 		anon_vma = vma->anon_vma;
 	if (anon_vma) {
 		spin_lock(&anon_vma->lock);
@@ -800,6 +817,8 @@
 		} else					/* cases 2, 5, 7 */
 			vma_adjust(prev, prev->vm_start,
 				end, prev->vm_pgoff, NULL);
+		if (prev->vm_flags & VM_EXEC)
+			arch_add_exec_range(mm, prev->vm_end);
 		return prev;
 	}
 
@@ -934,13 +953,9 @@
 	if (!(flags & MAP_FIXED))
 		addr = round_hint_to_min(addr);
 
-	error = arch_mmap_check(addr, len, flags);
-	if (error)
-		return error;
-
 	/* Careful about overflows.. */
 	len = PAGE_ALIGN(len);
-	if (!len || len > TASK_SIZE)
+	if (!len)
 		return -ENOMEM;
 
 	/* offset overflow? */
@@ -954,7 +969,8 @@
 	/* Obtain the address to map to. we verify (or select) it and ensure
 	 * that it represents a valid section of the address space.
 	 */
-	addr = get_unmapped_area(file, addr, len, pgoff, flags);
+	addr = get_unmapped_area_prot(file, addr, len, pgoff, flags,
+		prot & PROT_EXEC);
 	if (addr & ~PAGE_MASK)
 		return addr;
 
@@ -1272,7 +1288,12 @@
 	struct mm_struct *mm = current->mm;
 	struct vm_area_struct *vma;
 	unsigned long start_addr;
+	unsigned long error = arch_mmap_check(addr, len, flags);
 
+	if (error)
+		return error;
+
+	/* Careful about overflows.. */
 	if (len > TASK_SIZE)
 		return -ENOMEM;
 
@@ -1439,13 +1460,17 @@
 }
 
 unsigned long
-get_unmapped_area(struct file *file, unsigned long addr, unsigned long len,
-		unsigned long pgoff, unsigned long flags)
+get_unmapped_area_prot(struct file *file, unsigned long addr, unsigned long len,
+		unsigned long pgoff, unsigned long flags, int exec)
 {
 	unsigned long (*get_area)(struct file *, unsigned long,
 				  unsigned long, unsigned long, unsigned long);
 
-	get_area = current->mm->get_unmapped_area;
+	if (exec && current->mm->get_unmapped_exec_area)
+		get_area = current->mm->get_unmapped_exec_area;
+	else
+		get_area = current->mm->get_unmapped_area;
+
 	if (file && file->f_op && file->f_op->get_unmapped_area)
 		get_area = file->f_op->get_unmapped_area;
 	addr = get_area(file, addr, len, pgoff, flags);
@@ -1459,8 +1484,81 @@
 
 	return arch_rebalance_pgtables(addr, len);
 }
+EXPORT_SYMBOL(get_unmapped_area_prot);
+
+#define SHLIB_BASE	0x00110000
+
+unsigned long
+arch_get_unmapped_exec_area(struct file *filp, unsigned long addr0,
+		unsigned long len0, unsigned long pgoff, unsigned long flags)
+{
+	unsigned long addr = addr0, len = len0;
+	struct mm_struct *mm = current->mm;
+	struct vm_area_struct *vma;
+	unsigned long tmp;
+
+	if (len > TASK_SIZE)
+		return -ENOMEM;
+
+	if (flags & MAP_FIXED)
+		return addr;
+
+	if (!addr) {
+		addr = SHLIB_BASE;
+		if ((current->flags & PF_RANDOMIZE) && randomize_va_space)
+			addr = randomize_range(addr, 0x01000000, len);
+	}
+
+	if (addr) {
+		addr = PAGE_ALIGN(addr);
+		vma = find_vma(mm, addr);
+		if (TASK_SIZE - len >= addr &&
+		    (!vma || addr + len <= vma->vm_start))
+			return addr;
+	}
+
+	addr = SHLIB_BASE;
+	for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
+		/* At this point:  (!vma || addr < vma->vm_end). */
+		if (TASK_SIZE - len < addr)
+			return -ENOMEM;
+
+		if (!vma || addr + len <= vma->vm_start) {
+			/*
+			 * Must not let a PROT_EXEC mapping get into the
+			 * brk area:
+			 */
+			if (addr + len > mm->brk)
+				goto failed;
+
+			/*
+			 * Up until the brk area we randomize addresses
+			 * as much as possible:
+			 */
+			if ((current->flags & PF_RANDOMIZE) &&
+                            randomize_va_space &&
+                            addr >= 0x01000000) {
+				tmp = randomize_range(0x01000000,
+					PAGE_ALIGN(max(mm->start_brk,
+					(unsigned long)0x08000000)), len);
+				vma = find_vma(mm, tmp);
+				if (TASK_SIZE - len >= tmp &&
+				    (!vma || tmp + len <= vma->vm_start))
+					return tmp;
+			}
+			/*
+			 * Ok, randomization didnt work out - return
+			 * the result of the linear search:
+			 */
+			return addr;
+		}
+		addr = vma->vm_end;
+	}
+
+failed:
+	return current->mm->get_unmapped_area(filp, addr0, len0, pgoff, flags);
+}
 
-EXPORT_SYMBOL(get_unmapped_area);
 
 /* Look up the first VMA which satisfies  addr < vm_end,  NULL if none. */
 struct vm_area_struct *find_vma(struct mm_struct *mm, unsigned long addr)
@@ -1535,6 +1633,14 @@
 	return prev ? prev->vm_next : vma;
 }
 
+static int over_stack_limit(unsigned long sz)
+{
+	if (sz < EXEC_STACK_BIAS)
+		return 0;
+	return (sz - EXEC_STACK_BIAS) >
+			current->signal->rlim[RLIMIT_STACK].rlim_cur;
+}
+
 /*
  * Verify that the stack growth is acceptable and
  * update accounting. This is shared with both the
@@ -1551,7 +1657,7 @@
 		return -ENOMEM;
 
 	/* Stack limit test */
-	if (size > rlim[RLIMIT_STACK].rlim_cur)
+	if (over_stack_limit(size))
 		return -ENOMEM;
 
 	/* mlock limit tests */
@@ -1861,10 +1967,14 @@
 	if (new->vm_ops && new->vm_ops->open)
 		new->vm_ops->open(new);
 
-	if (new_below)
+	if (new_below) {
+		unsigned long old_end = vma->vm_end;
+
 		vma_adjust(vma, addr, vma->vm_end, vma->vm_pgoff +
 			((addr - new->vm_start) >> PAGE_SHIFT), new);
-	else
+		if (vma->vm_flags & VM_EXEC)
+			arch_remove_exec_range(mm, old_end);
+	} else
 		vma_adjust(vma, vma->vm_start, addr, vma->vm_pgoff, new);
 
 	return 0;
@@ -1989,20 +2099,14 @@
 	if (!len)
 		return addr;
 
-	if ((addr + len) > TASK_SIZE || (addr + len) < addr)
-		return -EINVAL;
-
-	if (is_hugepage_only_range(mm, addr, len))
-		return -EINVAL;
-
 	error = security_file_mmap(NULL, 0, 0, 0, addr, 1);
 	if (error)
 		return error;
 
 	flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags;
 
-	error = arch_mmap_check(addr, len, flags);
-	if (error)
+	error = get_unmapped_area(NULL, addr, len, 0, MAP_FIXED);
+	if (error & ~PAGE_MASK)
 		return error;
 
 	/*
@@ -2113,6 +2217,7 @@
 	vm_unacct_memory(nr_accounted);
 	free_pgtables(tlb, vma, FIRST_USER_ADDRESS, 0);
 	tlb_finish_mmu(tlb, 0, end);
+	arch_flush_exec_range(mm);
 
 	/*
 	 * Walk the list again, actually closing and freeing it,
--- linux-rt-2.6.31.orig/mm/page_alloc.c
+++ linux-rt-2.6.31/mm/page_alloc.c
@@ -1715,7 +1715,7 @@
 		 * See also cpuset_zone_allowed() comment in kernel/cpuset.c.
 		 */
 		alloc_flags &= ~ALLOC_CPUSET;
-	} else if (unlikely(rt_task(p)))
+	} else if (unlikely(rt_task(p)) && !in_interrupt())
 		alloc_flags |= ALLOC_HARDER;
 
 	if (likely(!(gfp_mask & __GFP_NOMEMALLOC))) {
@@ -1763,6 +1763,7 @@
 	if (NUMA_BUILD && (gfp_mask & GFP_THISNODE) == GFP_THISNODE)
 		goto nopage;
 
+restart:
 	wake_all_kswapd(order, zonelist, high_zoneidx);
 
 	/*
@@ -1772,7 +1773,6 @@
 	 */
 	alloc_flags = gfp_to_alloc_flags(gfp_mask);
 
-restart:
 	/* This is the last chance, in general, before the goto nopage. */
 	page = get_page_from_freelist(gfp_mask, nodemask, order, zonelist,
 			high_zoneidx, alloc_flags & ~ALLOC_NO_WATERMARKS,
@@ -2783,7 +2783,8 @@
 {
 	unsigned long start_pfn, pfn, end_pfn;
 	struct page *page;
-	unsigned long reserve, block_migratetype;
+	unsigned long block_migratetype;
+	int reserve;
 
 	/* Get the start pfn, end pfn and the number of blocks to reserve */
 	start_pfn = zone->zone_start_pfn;
@@ -2791,6 +2792,15 @@
 	reserve = roundup(min_wmark_pages(zone), pageblock_nr_pages) >>
 							pageblock_order;
 
+	/*
+	 * Reserve blocks are generally in place to help high-order atomic
+	 * allocations that are short-lived. A min_free_kbytes value that
+	 * would result in more than 2 reserve blocks for atomic allocations
+	 * is assumed to be in place to help anti-fragmentation for the
+	 * future allocation of hugepages at runtime.
+	 */
+	reserve = min(2, reserve);
+
 	for (pfn = start_pfn; pfn < end_pfn; pfn += pageblock_nr_pages) {
 		if (!pfn_valid(pfn))
 			continue;
--- linux-rt-2.6.31.orig/mm/hugetlb.c
+++ linux-rt-2.6.31/mm/hugetlb.c
@@ -1010,6 +1010,7 @@
 				NODE_DATA(h->hugetlb_next_nid),
 				huge_page_size(h), huge_page_size(h), 0);
 
+		hstate_next_node(h);
 		if (addr) {
 			/*
 			 * Use the beginning of the huge page to store the
@@ -1019,7 +1020,6 @@
 			m = addr;
 			goto found;
 		}
-		hstate_next_node(h);
 		nr_nodes--;
 	}
 	return 0;
--- linux-rt-2.6.31.orig/mm/util.c
+++ linux-rt-2.6.31/mm/util.c
@@ -4,6 +4,10 @@
 #include <linux/module.h>
 #include <linux/err.h>
 #include <linux/sched.h>
+#include <linux/hugetlb.h>
+#include <linux/syscalls.h>
+#include <linux/mman.h>
+#include <linux/file.h>
 #include <asm/uaccess.h>
 
 #define CREATE_TRACE_POINTS
@@ -268,6 +272,31 @@
 }
 EXPORT_SYMBOL_GPL(get_user_pages_fast);
 
+SYSCALL_DEFINE6(mmap_pgoff, unsigned long, addr, unsigned long, len,
+		unsigned long, prot, unsigned long, flags,
+		unsigned long, fd, unsigned long, pgoff)
+{
+	struct file * file = NULL;
+	unsigned long retval = -EBADF;
+
+	if (!(flags & MAP_ANONYMOUS)) {
+		file = fget(fd);
+		if (!file)
+			goto out;
+	}
+
+	flags &= ~(MAP_EXECUTABLE | MAP_DENYWRITE);
+
+	down_write(&current->mm->mmap_sem);
+	retval = do_mmap_pgoff(file, addr, len, prot, flags, pgoff);
+	up_write(&current->mm->mmap_sem);
+
+	if (file)
+		fput(file);
+out:
+	return retval;
+}
+
 /* Tracepoints definitions. */
 EXPORT_TRACEPOINT_SYMBOL(kmalloc);
 EXPORT_TRACEPOINT_SYMBOL(kmem_cache_alloc);
--- linux-rt-2.6.31.orig/mm/mremap.c
+++ linux-rt-2.6.31/mm/mremap.c
@@ -247,6 +247,137 @@
 	return new_addr;
 }
 
+static struct vm_area_struct *vma_to_resize(unsigned long addr,
+	unsigned long old_len, unsigned long new_len, unsigned long *p)
+{
+	struct mm_struct *mm = current->mm;
+	struct vm_area_struct *vma = find_vma(mm, addr);
+
+	if (!vma || vma->vm_start > addr)
+		goto Efault;
+
+	if (is_vm_hugetlb_page(vma))
+		goto Einval;
+
+	/* We can't remap across vm area boundaries */
+	if (old_len > vma->vm_end - addr)
+		goto Efault;
+
+	if (vma->vm_flags & (VM_DONTEXPAND | VM_PFNMAP)) {
+		if (new_len > old_len)
+			goto Efault;
+	}
+
+	if (vma->vm_flags & VM_LOCKED) {
+		unsigned long locked, lock_limit;
+		locked = mm->locked_vm << PAGE_SHIFT;
+		lock_limit = current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur;
+		locked += new_len - old_len;
+		if (locked > lock_limit && !capable(CAP_IPC_LOCK))
+			goto Eagain;
+	}
+
+	if (!may_expand_vm(mm, (new_len - old_len) >> PAGE_SHIFT))
+		goto Enomem;
+
+	if (vma->vm_flags & VM_ACCOUNT) {
+		unsigned long charged = (new_len - old_len) >> PAGE_SHIFT;
+		if (security_vm_enough_memory(charged))
+			goto Efault;
+		*p = charged;
+	}
+
+	return vma;
+
+Efault:	/* very odd choice for most of the cases, but... */
+	return ERR_PTR(-EFAULT);
+Einval:
+	return ERR_PTR(-EINVAL);
+Enomem:
+	return ERR_PTR(-ENOMEM);
+Eagain:
+	return ERR_PTR(-EAGAIN);
+}
+
+static unsigned long mremap_to(unsigned long addr,
+	unsigned long old_len, unsigned long new_addr,
+	unsigned long new_len)
+{
+	struct mm_struct *mm = current->mm;
+	struct vm_area_struct *vma;
+	unsigned long ret = -EINVAL;
+	unsigned long charged = 0;
+	unsigned long map_flags;
+
+	if (new_addr & ~PAGE_MASK)
+		goto out;
+
+	if (new_len > TASK_SIZE || new_addr > TASK_SIZE - new_len)
+		goto out;
+
+	/* Check if the location we're moving into overlaps the
+	 * old location at all, and fail if it does.
+	 */
+	if ((new_addr <= addr) && (new_addr+new_len) > addr)
+		goto out;
+
+	if ((addr <= new_addr) && (addr+old_len) > new_addr)
+		goto out;
+
+	ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
+	if (ret)
+		goto out;
+
+	ret = do_munmap(mm, new_addr, new_len);
+	if (ret)
+		goto out;
+
+	if (old_len >= new_len) {
+		ret = do_munmap(mm, addr+new_len, old_len - new_len);
+		if (ret && old_len != new_len)
+			goto out;
+		old_len = new_len;
+	}
+
+	vma = vma_to_resize(addr, old_len, new_len, &charged);
+	if (IS_ERR(vma)) {
+		ret = PTR_ERR(vma);
+		goto out;
+	}
+
+	map_flags = MAP_FIXED;
+	if (vma->vm_flags & VM_MAYSHARE)
+		map_flags |= MAP_SHARED;
+
+	ret = get_unmapped_area(vma->vm_file, new_addr, new_len, vma->vm_pgoff +
+				((addr - vma->vm_start) >> PAGE_SHIFT),
+				map_flags);
+	if (ret & ~PAGE_MASK)
+		goto out1;
+
+	ret = move_vma(vma, addr, old_len, new_len, new_addr);
+	if (!(ret & ~PAGE_MASK))
+		goto out;
+out1:
+	vm_unacct_memory(charged);
+
+out:
+	return ret;
+}
+
+static int vma_expandable(struct vm_area_struct *vma, unsigned long delta)
+{
+	unsigned long end = vma->vm_end + delta;
+	if (end < vma->vm_end) /* overflow */
+		return 0;
+	if (vma->vm_next && vma->vm_next->vm_start < end) /* intersection */
+		return 0;
+	if (get_unmapped_area(NULL, vma->vm_start, end - vma->vm_start,
+			      0, MAP_FIXED) & ~PAGE_MASK)
+		return 0;
+	return 1;
+}
+
 /*
  * Expand (or shrink) an existing mapping, potentially moving it at the
  * same time (controlled by the MREMAP_MAYMOVE flag and available VM space)
@@ -280,32 +411,10 @@
 	if (!new_len)
 		goto out;
 
-	/* new_addr is only valid if MREMAP_FIXED is specified */
 	if (flags & MREMAP_FIXED) {
-		if (new_addr & ~PAGE_MASK)
-			goto out;
-		if (!(flags & MREMAP_MAYMOVE))
-			goto out;
-
-		if (new_len > TASK_SIZE || new_addr > TASK_SIZE - new_len)
-			goto out;
-
-		/* Check if the location we're moving into overlaps the
-		 * old location at all, and fail if it does.
-		 */
-		if ((new_addr <= addr) && (new_addr+new_len) > addr)
-			goto out;
-
-		if ((addr <= new_addr) && (addr+old_len) > new_addr)
-			goto out;
-
-		ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
-		if (ret)
-			goto out;
-
-		ret = do_munmap(mm, new_addr, new_len);
-		if (ret)
-			goto out;
+		if (flags & MREMAP_MAYMOVE)
+			ret = mremap_to(addr, old_len, new_addr, new_len);
+		goto out;
 	}
 
 	/*
@@ -318,60 +427,23 @@
 		if (ret && old_len != new_len)
 			goto out;
 		ret = addr;
-		if (!(flags & MREMAP_FIXED) || (new_addr == addr))
-			goto out;
-		old_len = new_len;
+		goto out;
 	}
 
 	/*
-	 * Ok, we need to grow..  or relocate.
+	 * Ok, we need to grow..
 	 */
-	ret = -EFAULT;
-	vma = find_vma(mm, addr);
-	if (!vma || vma->vm_start > addr)
+	vma = vma_to_resize(addr, old_len, new_len, &charged);
+	if (IS_ERR(vma)) {
+		ret = PTR_ERR(vma);
 		goto out;
-	if (is_vm_hugetlb_page(vma)) {
-		ret = -EINVAL;
-		goto out;
-	}
-	/* We can't remap across vm area boundaries */
-	if (old_len > vma->vm_end - addr)
-		goto out;
-	if (vma->vm_flags & (VM_DONTEXPAND | VM_PFNMAP)) {
-		if (new_len > old_len)
-			goto out;
-	}
-	if (vma->vm_flags & VM_LOCKED) {
-		unsigned long locked, lock_limit;
-		locked = mm->locked_vm << PAGE_SHIFT;
-		lock_limit = current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur;
-		locked += new_len - old_len;
-		ret = -EAGAIN;
-		if (locked > lock_limit && !capable(CAP_IPC_LOCK))
-			goto out;
-	}
-	if (!may_expand_vm(mm, (new_len - old_len) >> PAGE_SHIFT)) {
-		ret = -ENOMEM;
-		goto out;
-	}
-
-	if (vma->vm_flags & VM_ACCOUNT) {
-		charged = (new_len - old_len) >> PAGE_SHIFT;
-		if (security_vm_enough_memory(charged))
-			goto out_nc;
 	}
 
 	/* old_len exactly to the end of the area..
-	 * And we're not relocating the area.
 	 */
-	if (old_len == vma->vm_end - addr &&
-	    !((flags & MREMAP_FIXED) && (addr != new_addr)) &&
-	    (old_len != new_len || !(flags & MREMAP_MAYMOVE))) {
-		unsigned long max_addr = TASK_SIZE;
-		if (vma->vm_next)
-			max_addr = vma->vm_next->vm_start;
+	if (old_len == vma->vm_end - addr) {
 		/* can we just expand the current mapping? */
-		if (max_addr - addr >= new_len) {
+		if (vma_expandable(vma, new_len - old_len)) {
 			int pages = (new_len - old_len) >> PAGE_SHIFT;
 
 			vma_adjust(vma, vma->vm_start,
@@ -395,28 +467,27 @@
 	 */
 	ret = -ENOMEM;
 	if (flags & MREMAP_MAYMOVE) {
-		if (!(flags & MREMAP_FIXED)) {
-			unsigned long map_flags = 0;
-			if (vma->vm_flags & VM_MAYSHARE)
-				map_flags |= MAP_SHARED;
-
-			new_addr = get_unmapped_area(vma->vm_file, 0, new_len,
-						vma->vm_pgoff, map_flags);
-			if (new_addr & ~PAGE_MASK) {
-				ret = new_addr;
-				goto out;
-			}
-
-			ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
-			if (ret)
-				goto out;
+		unsigned long map_flags = 0;
+		if (vma->vm_flags & VM_MAYSHARE)
+			map_flags |= MAP_SHARED;
+
+		new_addr = get_unmapped_area(vma->vm_file, 0, new_len,
+					vma->vm_pgoff +
+					((addr - vma->vm_start) >> PAGE_SHIFT),
+					map_flags);
+		if (new_addr & ~PAGE_MASK) {
+			ret = new_addr;
+			goto out;
 		}
+
+		ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
+		if (ret)
+			goto out;
 		ret = move_vma(vma, addr, old_len, new_len, new_addr);
 	}
 out:
 	if (ret & ~PAGE_MASK)
 		vm_unacct_memory(charged);
-out_nc:
 	return ret;
 }
 
--- linux-rt-2.6.31.orig/kernel/perf_counter.c
+++ linux-rt-2.6.31/kernel/perf_counter.c
@@ -469,7 +469,8 @@
 	struct perf_counter_context *ctx = counter->ctx;
 	u64 run_end;
 
-	if (counter->state < PERF_COUNTER_STATE_INACTIVE)
+	if (counter->state < PERF_COUNTER_STATE_INACTIVE ||
+	    counter->group_leader->state < PERF_COUNTER_STATE_INACTIVE)
 		return;
 
 	counter->total_time_enabled = ctx->time - counter->tstamp_enabled;
@@ -518,7 +519,7 @@
 	 */
 	if (counter->state >= PERF_COUNTER_STATE_INACTIVE) {
 		update_context_time(ctx);
-		update_counter_times(counter);
+		update_group_times(counter);
 		if (counter == counter->group_leader)
 			group_sched_out(counter, cpuctx, ctx);
 		else
@@ -573,7 +574,7 @@
 	 * in, so we can change the state safely.
 	 */
 	if (counter->state == PERF_COUNTER_STATE_INACTIVE) {
-		update_counter_times(counter);
+		update_group_times(counter);
 		counter->state = PERF_COUNTER_STATE_OFF;
 	}
 
@@ -851,6 +852,27 @@
 }
 
 /*
+ * Put a counter into inactive state and update time fields.
+ * Enabling the leader of a group effectively enables all
+ * the group members that aren't explicitly disabled, so we
+ * have to update their ->tstamp_enabled also.
+ * Note: this works for group members as well as group leaders
+ * since the non-leader members' sibling_lists will be empty.
+ */
+static void __perf_counter_mark_enabled(struct perf_counter *counter,
+					struct perf_counter_context *ctx)
+{
+	struct perf_counter *sub;
+
+	counter->state = PERF_COUNTER_STATE_INACTIVE;
+	counter->tstamp_enabled = ctx->time - counter->total_time_enabled;
+	list_for_each_entry(sub, &counter->sibling_list, list_entry)
+		if (sub->state >= PERF_COUNTER_STATE_INACTIVE)
+			sub->tstamp_enabled =
+				ctx->time - sub->total_time_enabled;
+}
+
+/*
  * Cross CPU call to enable a performance counter
  */
 static void __perf_counter_enable(void *info)
@@ -877,8 +899,7 @@
 
 	if (counter->state >= PERF_COUNTER_STATE_INACTIVE)
 		goto unlock;
-	counter->state = PERF_COUNTER_STATE_INACTIVE;
-	counter->tstamp_enabled = ctx->time - counter->total_time_enabled;
+	__perf_counter_mark_enabled(counter, ctx);
 
 	/*
 	 * If the counter is in a group and isn't the group leader,
@@ -971,11 +992,9 @@
 	 * Since we have the lock this context can't be scheduled
 	 * in, so we can change the state safely.
 	 */
-	if (counter->state == PERF_COUNTER_STATE_OFF) {
-		counter->state = PERF_COUNTER_STATE_INACTIVE;
-		counter->tstamp_enabled =
-			ctx->time - counter->total_time_enabled;
-	}
+	if (counter->state == PERF_COUNTER_STATE_OFF)
+		__perf_counter_mark_enabled(counter, ctx);
+
  out:
 	spin_unlock_irq(&ctx->lock);
 }
@@ -1344,7 +1363,7 @@
 	u64 interrupts, freq;
 
 	spin_lock(&ctx->lock);
-	list_for_each_entry(counter, &ctx->counter_list, list_entry) {
+	list_for_each_entry_rcu(counter, &ctx->counter_list, event_entry) {
 		if (counter->state != PERF_COUNTER_STATE_ACTIVE)
 			continue;
 
@@ -1479,9 +1498,7 @@
 		counter->attr.enable_on_exec = 0;
 		if (counter->state >= PERF_COUNTER_STATE_INACTIVE)
 			continue;
-		counter->state = PERF_COUNTER_STATE_INACTIVE;
-		counter->tstamp_enabled =
-			ctx->time - counter->total_time_enabled;
+		__perf_counter_mark_enabled(counter, ctx);
 		enabled = 1;
 	}
 
@@ -4126,8 +4143,8 @@
 static int perf_copy_attr(struct perf_counter_attr __user *uattr,
 			  struct perf_counter_attr *attr)
 {
-	int ret;
 	u32 size;
+	int ret;
 
 	if (!access_ok(VERIFY_WRITE, uattr, PERF_ATTR_SIZE_VER0))
 		return -EFAULT;
@@ -4152,25 +4169,26 @@
 
 	/*
 	 * If we're handed a bigger struct than we know of,
-	 * ensure all the unknown bits are 0.
+	 * ensure all the unknown bits are 0 - i.e. new
+	 * user-space does not rely on any kernel feature
+	 * extensions we dont know about yet.
 	 */
 	if (size > sizeof(*attr)) {
-		unsigned long val;
-		unsigned long __user *addr;
-		unsigned long __user *end;
-
-		addr = PTR_ALIGN((void __user *)uattr + sizeof(*attr),
-				sizeof(unsigned long));
-		end  = PTR_ALIGN((void __user *)uattr + size,
-				sizeof(unsigned long));
+		unsigned char __user *addr;
+		unsigned char __user *end;
+		unsigned char val;
+
+		addr = (void __user *)uattr + sizeof(*attr);
+		end  = (void __user *)uattr + size;
 
-		for (; addr < end; addr += sizeof(unsigned long)) {
+		for (; addr < end; addr++) {
 			ret = get_user(val, addr);
 			if (ret)
 				return ret;
 			if (val)
 				goto err_size;
 		}
+		size = sizeof(*attr);
 	}
 
 	ret = copy_from_user(attr, uattr, size);
--- linux-rt-2.6.31.orig/kernel/audit_tree.c
+++ linux-rt-2.6.31/kernel/audit_tree.c
@@ -277,7 +277,7 @@
 		owner->root = NULL;
 	}
 
-	for (i = j = 0; i < size; i++, j++) {
+	for (i = j = 0; j <= size; i++, j++) {
 		struct audit_tree *s;
 		if (&chunk->owners[j] == p) {
 			list_del_init(&p->list);
@@ -290,7 +290,7 @@
 		if (!s) /* result of earlier fallback */
 			continue;
 		get_tree(s);
-		list_replace_init(&chunk->owners[i].list, &new->owners[j].list);
+		list_replace_init(&chunk->owners[j].list, &new->owners[i].list);
 	}
 
 	list_replace_rcu(&chunk->hash, &new->hash);
@@ -373,15 +373,17 @@
 	for (n = 0; n < old->count; n++) {
 		if (old->owners[n].owner == tree) {
 			spin_unlock(&hash_lock);
-			put_inotify_watch(watch);
+			put_inotify_watch(&old->watch);
 			return 0;
 		}
 	}
 	spin_unlock(&hash_lock);
 
 	chunk = alloc_chunk(old->count + 1);
-	if (!chunk)
+	if (!chunk) {
+		put_inotify_watch(&old->watch);
 		return -ENOMEM;
+	}
 
 	mutex_lock(&inode->inotify_mutex);
 	if (inotify_clone_watch(&old->watch, &chunk->watch) < 0) {
@@ -425,7 +427,8 @@
 	spin_unlock(&hash_lock);
 	inotify_evict_watch(&old->watch);
 	mutex_unlock(&inode->inotify_mutex);
-	put_inotify_watch(&old->watch);
+	put_inotify_watch(&old->watch); /* pair to inotify_find_watch */
+	put_inotify_watch(&old->watch); /* and kill it */
 	return 0;
 }
 
--- linux-rt-2.6.31.orig/kernel/sched.c
+++ linux-rt-2.6.31/kernel/sched.c
@@ -7945,6 +7945,7 @@
 /* Setup the mask of cpus configured for isolated domains */
 static int __init isolated_cpu_setup(char *str)
 {
+	alloc_bootmem_cpumask_var(&cpu_isolated_map);
 	cpulist_parse(str, cpu_isolated_map);
 	return 1;
 }
@@ -9383,13 +9384,15 @@
 	current->sched_class = &fair_sched_class;
 
 	/* Allocate the nohz_cpu_mask if CONFIG_CPUMASK_OFFSTACK */
-	alloc_cpumask_var(&nohz_cpu_mask, GFP_NOWAIT);
+	zalloc_cpumask_var(&nohz_cpu_mask, GFP_NOWAIT);
 #ifdef CONFIG_SMP
 #ifdef CONFIG_NO_HZ
-	alloc_cpumask_var(&nohz.cpu_mask, GFP_NOWAIT);
+	zalloc_cpumask_var(&nohz.cpu_mask, GFP_NOWAIT);
 	alloc_cpumask_var(&nohz.ilb_grp_nohz_mask, GFP_NOWAIT);
 #endif
-	alloc_cpumask_var(&cpu_isolated_map, GFP_NOWAIT);
+	/* May be allocated at isolcpus cmdline parse time */
+	if (cpu_isolated_map == NULL)
+		zalloc_cpumask_var(&cpu_isolated_map, GFP_NOWAIT);
 #endif /* SMP */
 
 	perf_counter_init();
--- linux-rt-2.6.31.orig/kernel/futex.c
+++ linux-rt-2.6.31/kernel/futex.c
@@ -115,6 +115,9 @@
 	/* rt_waiter storage for requeue_pi: */
 	struct rt_mutex_waiter *rt_waiter;
 
+	/* The expected requeue pi target futex key: */
+	union futex_key *requeue_pi_key;
+
 	/* Bitset for the optional bitmasked wakeup */
 	u32 bitset;
 };
@@ -147,7 +150,8 @@
  */
 static inline int match_futex(union futex_key *key1, union futex_key *key2)
 {
-	return (key1->both.word == key2->both.word
+	return (key1 && key2
+		&& key1->both.word == key2->both.word
 		&& key1->both.ptr == key2->both.ptr
 		&& key1->both.offset == key2->both.offset);
 }
@@ -299,8 +303,14 @@
  */
 static int fault_in_user_writeable(u32 __user *uaddr)
 {
-	int ret = get_user_pages(current, current->mm, (unsigned long)uaddr,
-				 1, 1, 0, NULL, NULL);
+	struct mm_struct *mm = current->mm;
+	int ret;
+
+	down_read(&mm->mmap_sem);
+	ret = get_user_pages(current, mm, (unsigned long)uaddr,
+			     1, 1, 0, NULL, NULL);
+	up_read(&mm->mmap_sem);
+
 	return ret < 0 ? ret : 0;
 }
 
@@ -749,6 +759,13 @@
 	if (!pi_state)
 		return -EINVAL;
 
+	/*
+	 * If current does not own the pi_state then the futex is
+	 * inconsistent and user space fiddled with the futex value.
+	 */
+	if (pi_state->owner != current)
+		return -EINVAL;
+
 	spin_lock(&pi_state->pi_mutex.wait_lock);
 	new_owner = rt_mutex_next_owner(&pi_state->pi_mutex);
 
@@ -912,8 +929,8 @@
 	hb1 = hash_futex(&key1);
 	hb2 = hash_futex(&key2);
 
-	double_lock_hb(hb1, hb2);
 retry_private:
+	double_lock_hb(hb1, hb2);
 	op_ret = futex_atomic_op_inuser(op, uaddr2);
 	if (unlikely(op_ret < 0)) {
 
@@ -1024,7 +1041,6 @@
 void requeue_pi_wake_futex(struct futex_q *q, union futex_key *key,
 			   struct futex_hash_bucket *hb)
 {
-	drop_futex_key_refs(&q->key);
 	get_futex_key_refs(key);
 	q->key = *key;
 
@@ -1089,6 +1105,10 @@
 	if (!top_waiter)
 		return 0;
 
+	/* Ensure we requeue to the expected futex. */
+	if (!match_futex(top_waiter->requeue_pi_key, key2))
+		return -EINVAL;
+
 	/*
 	 * Try to take the lock for top_waiter.  Set the FUTEX_WAITERS bit in
 	 * the contended case or if set_waiters is 1.  The pi_state is returned
@@ -1218,6 +1238,7 @@
 		 */
 		if (ret == 1) {
 			WARN_ON(pi_state);
+			drop_count++;
 			task_count++;
 			ret = get_futex_value_locked(&curval2, uaddr2);
 			if (!ret)
@@ -1276,6 +1297,12 @@
 			continue;
 		}
 
+		/* Ensure we requeue to the expected futex for requeue_pi. */
+		if (requeue_pi && !match_futex(this->requeue_pi_key, &key2)) {
+			ret = -EINVAL;
+			break;
+		}
+
 		/*
 		 * Requeue nr_requeue waiters and possibly one more in the case
 		 * of requeue_pi if we couldn't acquire the lock atomically.
@@ -1290,6 +1317,7 @@
 			if (ret == 1) {
 				/* We got the lock. */
 				requeue_pi_wake_futex(this, &key2, hb2);
+				drop_count++;
 				continue;
 			} else if (ret) {
 				/* -EDEADLK */
@@ -1625,17 +1653,8 @@
 static void futex_wait_queue_me(struct futex_hash_bucket *hb, struct futex_q *q,
 				struct hrtimer_sleeper *timeout)
 {
-	queue_me(q, hb);
-
-	/*
-	 * There might have been scheduling since the queue_me(), as we
-	 * cannot hold a spinlock across the get_user() in case it
-	 * faults, and we cannot just set TASK_INTERRUPTIBLE state when
-	 * queueing ourselves into the futex hash. This code thus has to
-	 * rely on the futex_wake() code removing us from hash when it
-	 * wakes us up.
-	 */
 	set_current_state(TASK_INTERRUPTIBLE);
+	queue_me(q, hb);
 
 	/* Arm the timer */
 	if (timeout) {
@@ -1645,8 +1664,8 @@
 	}
 
 	/*
-	 * !plist_node_empty() is safe here without any lock.
-	 * q.lock_ptr != 0 is not safe, because of ordering against wakeup.
+	 * If we have been removed from the hash list, then another task
+	 * has tried to wake us, and we can skip the call to schedule().
 	 */
 	if (likely(!plist_node_empty(&q->list))) {
 		/*
@@ -1751,6 +1770,7 @@
 	q.pi_state = NULL;
 	q.bitset = bitset;
 	q.rt_waiter = NULL;
+	q.requeue_pi_key = NULL;
 
 	if (abs_time) {
 		to = &timeout;
@@ -1762,6 +1782,7 @@
 					     current->timer_slack_ns);
 	}
 
+retry:
 	/* Prepare to wait on uaddr. */
 	ret = futex_wait_setup(uaddr, val, fshared, &q, &hb);
 	if (ret)
@@ -1779,9 +1800,14 @@
 		goto out_put_key;
 
 	/*
-	 * We expect signal_pending(current), but another thread may
-	 * have handled it for us already.
+	 * We expect signal_pending(current), but we might be the
+	 * victim of a spurious wakeup as well.
 	 */
+	if (!signal_pending(current)) {
+		put_futex_key(fshared, &q.key);
+		goto retry;
+	}
+
 	ret = -ERESTARTSYS;
 	if (!abs_time)
 		goto out_put_key;
@@ -1858,6 +1884,7 @@
 
 	q.pi_state = NULL;
 	q.rt_waiter = NULL;
+	q.requeue_pi_key = NULL;
 retry:
 	q.key = FUTEX_KEY_INIT;
 	ret = get_futex_key(uaddr, fshared, &q.key, VERIFY_WRITE);
@@ -1930,7 +1957,7 @@
 	/* Unqueue and drop the lock */
 	unqueue_me_pi(&q);
 
-	goto out;
+	goto out_put_key;
 
 out_unlock_put_key:
 	queue_unlock(&q, hb);
@@ -2087,11 +2114,12 @@
 		 * Unqueue the futex_q and determine which it was.
 		 */
 		plist_del(&q->list, &q->list.plist);
-		drop_futex_key_refs(&q->key);
 
+		/* Handle spurious wakeups gracefully */
+		ret = -EWOULDBLOCK;
 		if (timeout && !timeout->task)
 			ret = -ETIMEDOUT;
-		else
+		else if (signal_pending(current))
 			ret = -ERESTARTNOINTR;
 	}
 	return ret;
@@ -2169,15 +2197,16 @@
 	debug_rt_mutex_init_waiter(&rt_waiter);
 	rt_waiter.task = NULL;
 
-	q.pi_state = NULL;
-	q.bitset = bitset;
-	q.rt_waiter = &rt_waiter;
-
 	key2 = FUTEX_KEY_INIT;
 	ret = get_futex_key(uaddr2, fshared, &key2, VERIFY_WRITE);
 	if (unlikely(ret != 0))
 		goto out;
 
+	q.pi_state = NULL;
+	q.bitset = bitset;
+	q.rt_waiter = &rt_waiter;
+	q.requeue_pi_key = &key2;
+
 	/* Prepare to wait on uaddr. */
 	ret = futex_wait_setup(uaddr, val, fshared, &q, &hb);
 	if (ret)
--- linux-rt-2.6.31.orig/kernel/module.c
+++ linux-rt-2.6.31/kernel/module.c
@@ -1138,6 +1138,12 @@
  * J. Corbet <corbet@lwn.net>
  */
 #if defined(CONFIG_KALLSYMS) && defined(CONFIG_SYSFS)
+
+static inline bool sect_empty(const Elf_Shdr *sect)
+{
+	return !(sect->sh_flags & SHF_ALLOC) || sect->sh_size == 0;
+}
+
 struct module_sect_attr
 {
 	struct module_attribute mattr;
@@ -1179,7 +1185,7 @@
 
 	/* Count loaded sections and allocate structures */
 	for (i = 0; i < nsect; i++)
-		if (sechdrs[i].sh_flags & SHF_ALLOC)
+		if (!sect_empty(&sechdrs[i]))
 			nloaded++;
 	size[0] = ALIGN(sizeof(*sect_attrs)
 			+ nloaded * sizeof(sect_attrs->attrs[0]),
@@ -1197,7 +1203,7 @@
 	sattr = &sect_attrs->attrs[0];
 	gattr = &sect_attrs->grp.attrs[0];
 	for (i = 0; i < nsect; i++) {
-		if (! (sechdrs[i].sh_flags & SHF_ALLOC))
+		if (sect_empty(&sechdrs[i]))
 			continue;
 		sattr->address = sechdrs[i].sh_addr;
 		sattr->name = kstrdup(secstrings + sechdrs[i].sh_name,
@@ -1281,7 +1287,7 @@
 	/* Count notes sections and allocate structures.  */
 	notes = 0;
 	for (i = 0; i < nsect; i++)
-		if ((sechdrs[i].sh_flags & SHF_ALLOC) &&
+		if (!sect_empty(&sechdrs[i]) &&
 		    (sechdrs[i].sh_type == SHT_NOTE))
 			++notes;
 
@@ -1297,7 +1303,7 @@
 	notes_attrs->notes = notes;
 	nattr = &notes_attrs->attrs[0];
 	for (loaded = i = 0; i < nsect; ++i) {
-		if (!(sechdrs[i].sh_flags & SHF_ALLOC))
+		if (sect_empty(&sechdrs[i]))
 			continue;
 		if (sechdrs[i].sh_type == SHT_NOTE) {
 			nattr->attr.name = mod->sect_attrs->attrs[loaded].name;
--- linux-rt-2.6.31.orig/kernel/fork.c
+++ linux-rt-2.6.31/kernel/fork.c
@@ -544,12 +544,18 @@
 
 	/* Get rid of any futexes when releasing the mm */
 #ifdef CONFIG_FUTEX
-	if (unlikely(tsk->robust_list))
+	if (unlikely(tsk->robust_list)) {
 		exit_robust_list(tsk);
+		tsk->robust_list = NULL;
+	}
 #ifdef CONFIG_COMPAT
-	if (unlikely(tsk->compat_robust_list))
+	if (unlikely(tsk->compat_robust_list)) {
 		compat_exit_robust_list(tsk);
+		tsk->compat_robust_list = NULL;
+	}
 #endif
+	if (unlikely(!list_empty(&tsk->pi_state_list)))
+		exit_pi_state_list(tsk);
 #endif
 
 	/* Get rid of any cached register state */
--- linux-rt-2.6.31.orig/kernel/user.c
+++ linux-rt-2.6.31/kernel/user.c
@@ -330,9 +330,9 @@
  */
 static void free_user(struct user_struct *up, unsigned long flags)
 {
-	spin_unlock_irqrestore(&uidhash_lock, flags);
 	INIT_DELAYED_WORK(&up->work, cleanup_user_struct);
 	schedule_delayed_work(&up->work, msecs_to_jiffies(1000));
+	spin_unlock_irqrestore(&uidhash_lock, flags);
 }
 
 #else	/* CONFIG_USER_SCHED && CONFIG_SYSFS */
--- linux-rt-2.6.31.orig/kernel/exit.c
+++ linux-rt-2.6.31/kernel/exit.c
@@ -987,8 +987,6 @@
 	tsk->mempolicy = NULL;
 #endif
 #ifdef CONFIG_FUTEX
-	if (unlikely(!list_empty(&tsk->pi_state_list)))
-		exit_pi_state_list(tsk);
 	if (unlikely(current->pi_state_cache))
 		kfree(current->pi_state_cache);
 #endif
--- linux-rt-2.6.31.orig/kernel/signal.c
+++ linux-rt-2.6.31/kernel/signal.c
@@ -939,7 +939,8 @@
 		for (i = 0; i < 16; i++) {
 			unsigned char insn;
 
-			__get_user(insn, (unsigned char *)(regs->ip + i));
+			if (get_user(insn, (unsigned char *)(regs->ip + i)))
+				break;
 			printk("%02x ", insn);
 		}
 	}
--- linux-rt-2.6.31.orig/kernel/acct.c
+++ linux-rt-2.6.31/kernel/acct.c
@@ -491,13 +491,17 @@
 	u64 run_time;
 	struct timespec uptime;
 	struct tty_struct *tty;
+	const struct cred *orig_cred;
+
+	/* Perform file operations on behalf of whoever enabled accounting */
+	orig_cred = override_creds(file->f_cred);
 
 	/*
 	 * First check to see if there is enough free_space to continue
 	 * the process accounting system.
 	 */
 	if (!check_free_space(acct, file))
-		return;
+		goto out;
 
 	/*
 	 * Fill the accounting struct with the needed info as recorded
@@ -532,7 +536,8 @@
 	do_div(elapsed, AHZ);
 	ac.ac_btime = get_seconds() - elapsed;
 	/* we really need to bite the bullet and change layout */
-	current_uid_gid(&ac.ac_uid, &ac.ac_gid);
+	ac.ac_uid = orig_cred->uid;
+	ac.ac_gid = orig_cred->gid;
 #if ACCT_VERSION==2
 	ac.ac_ahz = AHZ;
 #endif
@@ -578,6 +583,8 @@
 			       sizeof(acct_t), &file->f_pos);
 	current->signal->rlim[RLIMIT_FSIZE].rlim_cur = flim;
 	set_fs(fs);
+out:
+	revert_creds(orig_cred);
 }
 
 /**
--- linux-rt-2.6.31.orig/kernel/sched_features.h
+++ linux-rt-2.6.31/kernel/sched_features.h
@@ -1,4 +1,4 @@
-SCHED_FEAT(NEW_FAIR_SLEEPERS, 1)
+SCHED_FEAT(NEW_FAIR_SLEEPERS, 0)
 SCHED_FEAT(NORMALIZED_SLEEPER, 0)
 SCHED_FEAT(ADAPTIVE_GRAN, 1)
 SCHED_FEAT(WAKEUP_PREEMPT, 1)
--- linux-rt-2.6.31.orig/kernel/params.c
+++ linux-rt-2.6.31/kernel/params.c
@@ -217,15 +217,11 @@
 		return -ENOSPC;
 	}
 
-	if (kp->flags & KPARAM_KMALLOCED)
-		kfree(*(char **)kp->arg);
-
 	/* This is a hack.  We can't need to strdup in early boot, and we
 	 * don't need to; this mangled commandline is preserved. */
 	if (slab_is_available()) {
-		kp->flags |= KPARAM_KMALLOCED;
 		*(char **)kp->arg = kstrdup(val, GFP_KERNEL);
-		if (!kp->arg)
+		if (!*(char **)kp->arg)
 			return -ENOMEM;
 	} else
 		*(const char **)kp->arg = val;
@@ -303,6 +299,7 @@
 		       unsigned int min, unsigned int max,
 		       void *elem, int elemsize,
 		       int (*set)(const char *, struct kernel_param *kp),
+		       u16 flags,
 		       unsigned int *num)
 {
 	int ret;
@@ -312,6 +309,7 @@
 	/* Get the name right for errors. */
 	kp.name = name;
 	kp.arg = elem;
+	kp.flags = flags;
 
 	/* No equals sign? */
 	if (!val) {
@@ -357,7 +355,8 @@
 	unsigned int temp_num;
 
 	return param_array(kp->name, val, 1, arr->max, arr->elem,
-			   arr->elemsize, arr->set, arr->num ?: &temp_num);
+			   arr->elemsize, arr->set, kp->flags,
+			   arr->num ?: &temp_num);
 }
 
 int param_array_get(char *buffer, struct kernel_param *kp)
@@ -604,11 +603,7 @@
 
 void destroy_params(const struct kernel_param *params, unsigned num)
 {
-	unsigned int i;
-
-	for (i = 0; i < num; i++)
-		if (params[i].flags & KPARAM_KMALLOCED)
-			kfree(*(char **)params[i].arg);
+	/* FIXME: This should free kmalloced charp parameters.  It doesn't. */
 }
 
 static void __init kernel_add_sysfs_param(const char *name,
--- linux-rt-2.6.31.orig/kernel/power/console.c
+++ linux-rt-2.6.31/kernel/power/console.c
@@ -33,6 +33,7 @@
 
 int pm_prepare_console(void)
 {
+#ifndef CONFIG_PM_DISABLE_CONSOLE
 	acquire_console_sem();
 
 	if (disable_vt_switch) {
@@ -66,11 +67,13 @@
 	}
 	orig_kmsg = kmsg_redirect;
 	kmsg_redirect = SUSPEND_CONSOLE;
+#endif
 	return 0;
 }
 
 void pm_restore_console(void)
 {
+#ifndef CONFIG_PM_DISABLE_CONSOLE
 	acquire_console_sem();
 	if (disable_vt_switch) {
 		release_console_sem();
@@ -85,5 +88,6 @@
 	}
 
 	kmsg_redirect = orig_kmsg;
+#endif
 }
 #endif
--- linux-rt-2.6.31.orig/kernel/power/Kconfig
+++ linux-rt-2.6.31/kernel/power/Kconfig
@@ -119,6 +119,21 @@
 config HIBERNATION_NVS
 	bool
 
+config PM_DISABLE_CONSOLE
+	bool "Disable Power Management messing with the active console"
+	depends on PM
+	default n
+	---help---
+	  By default, PM will take over the active console (generally, this means
+	  switching to the console when suspending from X). This can at times cause
+	  problems, especially if userspace suspend scripts try to do things with
+	  the console before or after suspending (e.g. calling vbestate).
+
+	  To work around this, enable this option so that PM will not handle the
+	  console.
+
+	  If unsure, say N.
+
 config HIBERNATION
 	bool "Hibernation (aka 'suspend to disk')"
 	depends on PM && SWAP && ARCH_HIBERNATION_POSSIBLE
--- linux-rt-2.6.31.orig/kernel/power/suspend_test.c
+++ linux-rt-2.6.31/kernel/power/suspend_test.c
@@ -19,7 +19,7 @@
  * The time it takes is system-specific though, so when we test this
  * during system bootup we allow a LOT of time.
  */
-#define TEST_SUSPEND_SECONDS	5
+#define TEST_SUSPEND_SECONDS	10
 
 static unsigned long suspend_test_start_time;
 
@@ -49,7 +49,8 @@
 	 * has some performance issues.  The stack dump of a WARN_ON
 	 * is more likely to get the right attention than a printk...
 	 */
-	WARN(msec > (TEST_SUSPEND_SECONDS * 1000), "Component: %s\n", label);
+	WARN(msec > (TEST_SUSPEND_SECONDS * 1000),
+	     "Component: %s, time: %u\n", label, msec);
 }
 
 /*
--- linux-rt-2.6.31.orig/kernel/trace/trace_events_filter.c
+++ linux-rt-2.6.31/kernel/trace/trace_events_filter.c
@@ -844,8 +844,9 @@
 
 	while (!list_empty(&ps->postfix)) {
 		elt = list_first_entry(&ps->postfix, struct postfix_elt, list);
-		kfree(elt->operand);
 		list_del(&elt->list);
+		kfree(elt->operand);
+		kfree(elt);
 	}
 }
 
--- linux-rt-2.6.31.orig/kernel/trace/ftrace.c
+++ linux-rt-2.6.31/kernel/trace/ftrace.c
@@ -1110,14 +1110,9 @@
 		failed = __ftrace_replace_code(rec, enable);
 		if (failed) {
 			rec->flags |= FTRACE_FL_FAILED;
-			if ((system_state == SYSTEM_BOOTING) ||
-			    !core_kernel_text(rec->ip)) {
-				ftrace_free_rec(rec);
-				} else {
-				ftrace_bug(failed, rec->ip);
-					/* Stop processing */
-					return;
-				}
+			ftrace_bug(failed, rec->ip);
+			/* Stop processing */
+			return;
 		}
 	} while_for_each_ftrace_rec();
 }
@@ -2801,19 +2796,17 @@
 }
 
 #ifdef CONFIG_MODULES
-void ftrace_release(void *start, void *end)
+void ftrace_release_mod(struct module *mod)
 {
 	struct dyn_ftrace *rec;
 	struct ftrace_page *pg;
-	unsigned long s = (unsigned long)start;
-	unsigned long e = (unsigned long)end;
 
-	if (ftrace_disabled || !start || start == end)
+	if (ftrace_disabled)
 		return;
 
 	mutex_lock(&ftrace_lock);
 	do_for_each_ftrace_rec(pg, rec) {
-		if ((rec->ip >= s) && (rec->ip < e)) {
+		if (within_module_core(rec->ip, mod)) {
 			/*
 			 * rec->ip is changed in ftrace_free_rec()
 			 * It should not between s and e if record was freed.
@@ -2845,9 +2838,7 @@
 				   mod->num_ftrace_callsites);
 		break;
 	case MODULE_STATE_GOING:
-		ftrace_release(mod->ftrace_callsites,
-			       mod->ftrace_callsites +
-			       mod->num_ftrace_callsites);
+		ftrace_release_mod(mod);
 		break;
 	}
 
--- linux-rt-2.6.31.orig/kernel/time/tick-sched.c
+++ linux-rt-2.6.31/kernel/time/tick-sched.c
@@ -231,6 +231,13 @@
 	if (!inidle && !ts->inidle)
 		goto end;
 
+	/*
+	 * Set ts->inidle unconditionally. Even if the system did not
+	 * switch to NOHZ mode the cpu frequency governers rely on the
+	 * update of the idle time accounting in tick_nohz_start_idle().
+	 */
+	ts->inidle = 1;
+
 	now = tick_nohz_start_idle(ts);
 
 	/*
@@ -248,8 +255,6 @@
 	if (unlikely(ts->nohz_mode == NOHZ_MODE_INACTIVE))
 		goto end;
 
-	ts->inidle = 1;
-
 	if (need_resched())
 		goto end;
 
--- linux-rt-2.6.31.orig/kernel/time/clockevents.c
+++ linux-rt-2.6.31/kernel/time/clockevents.c
@@ -237,8 +237,9 @@
  */
 void clockevents_notify(unsigned long reason, void *arg)
 {
-	struct list_head *node, *tmp;
+	struct clock_event_device *dev, *tmp;
 	unsigned long flags;
+	int cpu;
 
 	spin_lock_irqsave(&clockevents_lock, flags);
 	clockevents_do_notify(reason, arg);
@@ -249,8 +250,19 @@
 		 * Unregister the clock event devices which were
 		 * released from the users in the notify chain.
 		 */
-		list_for_each_safe(node, tmp, &clockevents_released)
-			list_del(node);
+		list_for_each_entry_safe(dev, tmp, &clockevents_released, list)
+			list_del(&dev->list);
+		/*
+		 * Now check whether the CPU has left unused per cpu devices
+		 */
+		cpu = *((int *)arg);
+		list_for_each_entry_safe(dev, tmp, &clockevent_devices, list) {
+			if (cpumask_test_cpu(cpu, dev->cpumask) &&
+			    cpumask_weight(dev->cpumask) == 1) {
+				BUG_ON(dev->mode != CLOCK_EVT_MODE_UNUSED);
+				list_del(&dev->list);
+			}
+		}
 		break;
 	default:
 		break;
--- linux-rt-2.6.31.orig/net/packet/af_packet.c
+++ linux-rt-2.6.31/net/packet/af_packet.c
@@ -1836,7 +1836,7 @@
 static int packet_getsockopt(struct socket *sock, int level, int optname,
 			     char __user *optval, int __user *optlen)
 {
-	int len;
+	unsigned int len;
 	int val;
 	struct sock *sk = sock->sk;
 	struct packet_sock *po = pkt_sk(sk);
@@ -1849,7 +1849,7 @@
 	if (get_user(len, optlen))
 		return -EFAULT;
 
-	if (len < 0)
+	if ((int)len < 0)
 		return -EINVAL;
 
 	switch (optname) {
--- linux-rt-2.6.31.orig/net/unix/af_unix.c
+++ linux-rt-2.6.31/net/unix/af_unix.c
@@ -1074,6 +1074,8 @@
 	err = -ECONNREFUSED;
 	if (other->sk_state != TCP_LISTEN)
 		goto out_unlock;
+	if (other->sk_shutdown & RCV_SHUTDOWN)
+		goto out_unlock;
 
 	if (unix_recvq_full(other)) {
 		err = -EAGAIN;
@@ -1501,6 +1503,7 @@
 	struct sk_buff *skb;
 	int sent = 0;
 	struct scm_cookie tmp_scm;
+	bool fds_sent = false;
 
 	if (NULL == siocb->scm)
 		siocb->scm = &tmp_scm;
@@ -1562,12 +1565,14 @@
 		size = min_t(int, size, skb_tailroom(skb));
 
 		memcpy(UNIXCREDS(skb), &siocb->scm->creds, sizeof(struct ucred));
-		if (siocb->scm->fp) {
+		/* Only send the fds in the first buffer */
+		if (siocb->scm->fp && !fds_sent) {
 			err = unix_attach_fds(siocb->scm, skb);
 			if (err) {
 				kfree_skb(skb);
 				goto out_err;
 			}
+			fds_sent = true;
 		}
 
 		err = memcpy_fromiovec(skb_put(skb, size), msg->msg_iov, size);
--- linux-rt-2.6.31.orig/net/rfkill/core.c
+++ linux-rt-2.6.31/net/rfkill/core.c
@@ -1180,6 +1180,7 @@
 #endif
 
 static const struct file_operations rfkill_fops = {
+	.owner		= THIS_MODULE,
 	.open		= rfkill_fop_open,
 	.read		= rfkill_fop_read,
 	.write		= rfkill_fop_write,
--- linux-rt-2.6.31.orig/net/ipv4/ip_output.c
+++ linux-rt-2.6.31/net/ipv4/ip_output.c
@@ -500,8 +500,8 @@
 			if (skb->sk) {
 				frag->sk = skb->sk;
 				frag->destructor = sock_wfree;
-				truesizes += frag->truesize;
 			}
+			truesizes += frag->truesize;
 		}
 
 		/* Everything is OK. Generate! */
--- linux-rt-2.6.31.orig/net/ipv4/tcp_minisocks.c
+++ linux-rt-2.6.31/net/ipv4/tcp_minisocks.c
@@ -363,7 +363,7 @@
 #ifdef CONFIG_TCP_MD5SIG
 	struct tcp_timewait_sock *twsk = tcp_twsk(sk);
 	if (twsk->tw_md5_keylen)
-		tcp_put_md5sig_pool();
+		tcp_free_md5sig_pool();
 #endif
 }
 
--- linux-rt-2.6.31.orig/net/ipv4/udp.c
+++ linux-rt-2.6.31/net/ipv4/udp.c
@@ -831,6 +831,42 @@
 	return ret;
 }
 
+
+/**
+ *	first_packet_length	- return length of first packet in receive queue
+ *	@sk: socket
+ *
+ *	Drops all bad checksum frames, until a valid one is found.
+ *	Returns the length of found skb, or 0 if none is found.
+ */
+static unsigned int first_packet_length(struct sock *sk)
+{
+	struct sk_buff_head list_kill, *rcvq = &sk->sk_receive_queue;
+	struct sk_buff *skb;
+	unsigned int res;
+
+	__skb_queue_head_init(&list_kill);
+
+	spin_lock_bh(&rcvq->lock);
+	while ((skb = skb_peek(rcvq)) != NULL &&
+		udp_lib_checksum_complete(skb)) {
+		UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
+				 IS_UDPLITE(sk));
+		__skb_unlink(skb, rcvq);
+		__skb_queue_tail(&list_kill, skb);
+	}
+	res = skb ? skb->len : 0;
+	spin_unlock_bh(&rcvq->lock);
+
+	if (!skb_queue_empty(&list_kill)) {
+		lock_sock(sk);
+		__skb_queue_purge(&list_kill);
+		sk_mem_reclaim_partial(sk);
+		release_sock(sk);
+	}
+	return res;
+}
+
 /*
  *	IOCTL requests applicable to the UDP protocol
  */
@@ -847,21 +883,16 @@
 
 	case SIOCINQ:
 	{
-		struct sk_buff *skb;
-		unsigned long amount;
+		unsigned int amount = first_packet_length(sk);
 
-		amount = 0;
-		spin_lock_bh(&sk->sk_receive_queue.lock);
-		skb = skb_peek(&sk->sk_receive_queue);
-		if (skb != NULL) {
+		if (amount)
 			/*
 			 * We will only return the amount
 			 * of this packet since that is all
 			 * that will be read.
 			 */
-			amount = skb->len - sizeof(struct udphdr);
-		}
-		spin_unlock_bh(&sk->sk_receive_queue.lock);
+			amount -= sizeof(struct udphdr);
+
 		return put_user(amount, (int __user *)arg);
 	}
 
@@ -956,9 +987,7 @@
 		err = ulen;
 
 out_free:
-	lock_sock(sk);
-	skb_free_datagram(sk, skb);
-	release_sock(sk);
+	skb_free_datagram_locked(sk, skb);
 out:
 	return err;
 
@@ -1525,32 +1554,13 @@
 {
 	unsigned int mask = datagram_poll(file, sock, wait);
 	struct sock *sk = sock->sk;
-	int 	is_lite = IS_UDPLITE(sk);
 
 	/* Check for false positives due to checksum errors */
-	if ( (mask & POLLRDNORM) &&
-	     !(file->f_flags & O_NONBLOCK) &&
-	     !(sk->sk_shutdown & RCV_SHUTDOWN)){
-		struct sk_buff_head *rcvq = &sk->sk_receive_queue;
-		struct sk_buff *skb;
-
-		spin_lock_bh(&rcvq->lock);
-		while ((skb = skb_peek(rcvq)) != NULL &&
-		       udp_lib_checksum_complete(skb)) {
-			UDP_INC_STATS_BH(sock_net(sk),
-					UDP_MIB_INERRORS, is_lite);
-			__skb_unlink(skb, rcvq);
-			kfree_skb(skb);
-		}
-		spin_unlock_bh(&rcvq->lock);
-
-		/* nothing to see, move along */
-		if (skb == NULL)
-			mask &= ~(POLLIN | POLLRDNORM);
-	}
+	if ((mask & POLLRDNORM) && !(file->f_flags & O_NONBLOCK) &&
+	    !(sk->sk_shutdown & RCV_SHUTDOWN) && !first_packet_length(sk))
+		mask &= ~(POLLIN | POLLRDNORM);
 
 	return mask;
-
 }
 
 struct proto udp_prot = {
--- linux-rt-2.6.31.orig/net/ipv4/ip_fragment.c
+++ linux-rt-2.6.31/net/ipv4/ip_fragment.c
@@ -563,7 +563,7 @@
 		printk(KERN_INFO "Oversized IP packet from %pI4.\n",
 			&qp->saddr);
 out_fail:
-	IP_INC_STATS_BH(dev_net(dev), IPSTATS_MIB_REASMFAILS);
+	IP_INC_STATS_BH(net, IPSTATS_MIB_REASMFAILS);
 	return err;
 }
 
--- linux-rt-2.6.31.orig/net/ipv4/netfilter/nf_nat_helper.c
+++ linux-rt-2.6.31/net/ipv4/netfilter/nf_nat_helper.c
@@ -73,6 +73,28 @@
 	DUMP_OFFSET(this_way);
 }
 
+/* Get the offset value, for conntrack */
+s16 nf_nat_get_offset(const struct nf_conn *ct,
+		      enum ip_conntrack_dir dir,
+		      u32 seq)
+{
+	struct nf_conn_nat *nat = nfct_nat(ct);
+	struct nf_nat_seq *this_way;
+	s16 offset;
+
+	if (!nat)
+		return 0;
+
+	this_way = &nat->seq[dir];
+	spin_lock_bh(&nf_nat_seqofs_lock);
+	offset = after(seq, this_way->correction_pos)
+		 ? this_way->offset_after : this_way->offset_before;
+	spin_unlock_bh(&nf_nat_seqofs_lock);
+
+	return offset;
+}
+EXPORT_SYMBOL_GPL(nf_nat_get_offset);
+
 /* Frobs data inside this packet, which is linear. */
 static void mangle_contents(struct sk_buff *skb,
 			    unsigned int dataoff,
@@ -189,11 +211,6 @@
 		adjust_tcp_sequence(ntohl(tcph->seq),
 				    (int)rep_len - (int)match_len,
 				    ct, ctinfo);
-		/* Tell TCP window tracking about seq change */
-		nf_conntrack_tcp_update(skb, ip_hdrlen(skb),
-					ct, CTINFO2DIR(ctinfo),
-					(int)rep_len - (int)match_len);
-
 		nf_conntrack_event_cache(IPCT_NATSEQADJ, ct);
 	}
 	return 1;
@@ -415,12 +432,7 @@
 	tcph->seq = newseq;
 	tcph->ack_seq = newack;
 
-	if (!nf_nat_sack_adjust(skb, tcph, ct, ctinfo))
-		return 0;
-
-	nf_conntrack_tcp_update(skb, ip_hdrlen(skb), ct, dir, seqoff);
-
-	return 1;
+	return nf_nat_sack_adjust(skb, tcph, ct, ctinfo);
 }
 
 /* Setup NAT on this expected conntrack so it follows master. */
--- linux-rt-2.6.31.orig/net/ipv4/netfilter/nf_nat_core.c
+++ linux-rt-2.6.31/net/ipv4/netfilter/nf_nat_core.c
@@ -212,7 +212,7 @@
 	maxip = ntohl(range->max_ip);
 	j = jhash_2words((__force u32)tuple->src.u3.ip,
 			 range->flags & IP_NAT_RANGE_PERSISTENT ?
-				(__force u32)tuple->dst.u3.ip : 0, 0);
+				0 : (__force u32)tuple->dst.u3.ip, 0);
 	j = ((u64)j * (maxip - minip + 1)) >> 32;
 	*var_ipp = htonl(minip + j);
 }
@@ -750,6 +750,8 @@
 	BUG_ON(nfnetlink_parse_nat_setup_hook != NULL);
 	rcu_assign_pointer(nfnetlink_parse_nat_setup_hook,
 			   nfnetlink_parse_nat_setup);
+	BUG_ON(nf_ct_nat_offset != NULL);
+	rcu_assign_pointer(nf_ct_nat_offset, nf_nat_get_offset);
 	return 0;
 
  cleanup_extend:
@@ -764,6 +766,7 @@
 	nf_ct_extend_unregister(&nat_extend);
 	rcu_assign_pointer(nf_nat_seq_adjust_hook, NULL);
 	rcu_assign_pointer(nfnetlink_parse_nat_setup_hook, NULL);
+	rcu_assign_pointer(nf_ct_nat_offset, NULL);
 	synchronize_net();
 }
 
--- linux-rt-2.6.31.orig/net/8021q/vlan.c
+++ linux-rt-2.6.31/net/8021q/vlan.c
@@ -287,8 +287,11 @@
 	if (ngrp)
 		vlan_gvrp_uninit_applicant(real_dev);
 out_free_group:
-	if (ngrp)
-		vlan_group_free(ngrp);
+	if (ngrp) {
+		hlist_del_rcu(&ngrp->hlist);
+		/* Free the group, after all cpu's are done. */
+		call_rcu(&ngrp->rcu, vlan_rcu_free);
+	}
 	return err;
 }
 
--- linux-rt-2.6.31.orig/net/bluetooth/hci_conn.c
+++ linux-rt-2.6.31/net/bluetooth/hci_conn.c
@@ -246,6 +246,8 @@
 	if (hdev->notify)
 		hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
 
+	atomic_set(&conn->devref, 0);
+
 	hci_conn_init_sysfs(conn);
 
 	tasklet_enable(&hdev->tx_task);
@@ -288,7 +290,7 @@
 
 	skb_queue_purge(&conn->data_q);
 
-	hci_conn_del_sysfs(conn);
+	hci_conn_put_device(conn);
 
 	hci_dev_put(hdev);
 
@@ -583,6 +585,19 @@
 	hci_dev_unlock(hdev);
 }
 
+void hci_conn_hold_device(struct hci_conn *conn)
+{
+	atomic_inc(&conn->devref);
+}
+EXPORT_SYMBOL(hci_conn_hold_device);
+
+void hci_conn_put_device(struct hci_conn *conn)
+{
+	if (atomic_dec_and_test(&conn->devref))
+		hci_conn_del_sysfs(conn);
+}
+EXPORT_SYMBOL(hci_conn_put_device);
+
 int hci_get_conn_list(void __user *arg)
 {
 	struct hci_conn_list_req req, *cl;
--- linux-rt-2.6.31.orig/net/bluetooth/hci_event.c
+++ linux-rt-2.6.31/net/bluetooth/hci_event.c
@@ -887,6 +887,7 @@
 		} else
 			conn->state = BT_CONNECTED;
 
+		hci_conn_hold_device(conn);
 		hci_conn_add_sysfs(conn);
 
 		if (test_bit(HCI_AUTH, &hdev->flags))
@@ -1693,6 +1694,7 @@
 		conn->handle = __le16_to_cpu(ev->handle);
 		conn->state  = BT_CONNECTED;
 
+		hci_conn_hold_device(conn);
 		hci_conn_add_sysfs(conn);
 		break;
 
--- linux-rt-2.6.31.orig/net/bluetooth/hidp/core.c
+++ linux-rt-2.6.31/net/bluetooth/hidp/core.c
@@ -40,6 +40,7 @@
 
 #include <linux/input.h>
 #include <linux/hid.h>
+#include <linux/hidraw.h>
 
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
@@ -92,10 +93,14 @@
 {
 	__module_get(THIS_MODULE);
 	list_add(&session->list, &hidp_session_list);
+
+	hci_conn_hold_device(session->conn);
 }
 
 static void __hidp_unlink_session(struct hidp_session *session)
 {
+	hci_conn_put_device(session->conn);
+
 	list_del(&session->list);
 	module_put(THIS_MODULE);
 }
@@ -573,7 +578,11 @@
 	if (session->hid) {
 		if (session->hid->claimed & HID_CLAIMED_INPUT)
 			hidinput_disconnect(session->hid);
+		if (session->hid->claimed & HID_CLAIMED_HIDRAW)
+			hidraw_disconnect(session->hid);
+
 		hid_destroy_device(session->hid);
+		session->hid = NULL;
 	}
 
 	/* Wakeup user-space polling for socket errors */
@@ -601,25 +610,27 @@
 {
 	bdaddr_t *src = &bt_sk(session->ctrl_sock->sk)->src;
 	bdaddr_t *dst = &bt_sk(session->ctrl_sock->sk)->dst;
+	struct device *device = NULL;
 	struct hci_dev *hdev;
-	struct hci_conn *conn;
 
 	hdev = hci_get_route(dst, src);
 	if (!hdev)
 		return NULL;
 
-	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
+	session->conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
+	if (session->conn)
+		device = &session->conn->dev;
 
 	hci_dev_put(hdev);
 
-	return conn ? &conn->dev : NULL;
+	return device;
 }
 
 static int hidp_setup_input(struct hidp_session *session,
 				struct hidp_connadd_req *req)
 {
 	struct input_dev *input;
-	int i;
+	int err, i;
 
 	input = input_allocate_device();
 	if (!input)
@@ -666,7 +677,13 @@
 
 	input->event = hidp_input_event;
 
-	return input_register_device(input);
+	err = input_register_device(input);
+	if (err < 0) {
+		hci_conn_put_device(session->conn);
+		return err;
+	}
+
+	return 0;
 }
 
 static int hidp_open(struct hid_device *hid)
@@ -748,13 +765,11 @@
 {
 	struct hid_device *hid;
 	bdaddr_t src, dst;
-	int ret;
+	int err;
 
 	hid = hid_allocate_device();
-	if (IS_ERR(hid)) {
-		ret = PTR_ERR(session->hid);
-		goto err;
-	}
+	if (IS_ERR(hid))
+		return PTR_ERR(session->hid);
 
 	session->hid = hid;
 	session->req = req;
@@ -776,16 +791,17 @@
 	hid->dev.parent = hidp_get_device(session);
 	hid->ll_driver = &hidp_hid_driver;
 
-	ret = hid_add_device(hid);
-	if (ret)
-		goto err_hid;
+	err = hid_add_device(hid);
+	if (err < 0)
+		goto failed;
 
 	return 0;
-err_hid:
+
+failed:
 	hid_destroy_device(hid);
 	session->hid = NULL;
-err:
-	return ret;
+
+	return err;
 }
 
 int hidp_add_connection(struct hidp_connadd_req *req, struct socket *ctrl_sock, struct socket *intr_sock)
@@ -835,13 +851,13 @@
 	if (req->rd_size > 0) {
 		err = hidp_setup_hid(session, req);
 		if (err && err != -ENODEV)
-			goto err_skb;
+			goto purge;
 	}
 
 	if (!session->hid) {
 		err = hidp_setup_input(session, req);
 		if (err < 0)
-			goto err_skb;
+			goto purge;
 	}
 
 	__hidp_link_session(session);
@@ -869,13 +885,20 @@
 
 	__hidp_unlink_session(session);
 
-	if (session->input)
+	if (session->input) {
 		input_unregister_device(session->input);
-	if (session->hid)
+		session->input = NULL;
+	}
+
+	if (session->hid) {
 		hid_destroy_device(session->hid);
-err_skb:
+		session->hid = NULL;
+	}
+
+purge:
 	skb_queue_purge(&session->ctrl_transmit);
 	skb_queue_purge(&session->intr_transmit);
+
 failed:
 	up_write(&hidp_session_sem);
 
--- linux-rt-2.6.31.orig/net/bluetooth/hidp/hidp.h
+++ linux-rt-2.6.31/net/bluetooth/hidp/hidp.h
@@ -126,6 +126,8 @@
 struct hidp_session {
 	struct list_head list;
 
+	struct hci_conn *conn;
+
 	struct socket *ctrl_sock;
 	struct socket *intr_sock;
 
--- linux-rt-2.6.31.orig/net/ax25/af_ax25.c
+++ linux-rt-2.6.31/net/ax25/af_ax25.c
@@ -538,7 +538,7 @@
 	if (level != SOL_AX25)
 		return -ENOPROTOOPT;
 
-	if (optlen < sizeof(int))
+	if (optlen < (int)sizeof(int))
 		return -EINVAL;
 
 	if (get_user(opt, (int __user *)optval))
@@ -893,7 +893,6 @@
 
 	sock_init_data(NULL, sk);
 
-	sk->sk_destruct = ax25_free_sock;
 	sk->sk_type     = osk->sk_type;
 	sk->sk_priority = osk->sk_priority;
 	sk->sk_protocol = osk->sk_protocol;
@@ -931,6 +930,7 @@
 	}
 
 	sk->sk_protinfo = ax25;
+	sk->sk_destruct = ax25_free_sock;
 	ax25->sk    = sk;
 
 	return sk;
@@ -1781,8 +1781,8 @@
 		ax25_info.idletimer = ax25_display_timer(&ax25->idletimer) / (60 * HZ);
 		ax25_info.n2count   = ax25->n2count;
 		ax25_info.state     = ax25->state;
-		ax25_info.rcv_q     = sk_wmem_alloc_get(sk);
-		ax25_info.snd_q     = sk_rmem_alloc_get(sk);
+		ax25_info.rcv_q     = sk_rmem_alloc_get(sk);
+		ax25_info.snd_q     = sk_wmem_alloc_get(sk);
 		ax25_info.vs        = ax25->vs;
 		ax25_info.vr        = ax25->vr;
 		ax25_info.va        = ax25->va;
--- linux-rt-2.6.31.orig/net/sched/cls_api.c
+++ linux-rt-2.6.31/net/sched/cls_api.c
@@ -348,7 +348,7 @@
 	tcm = NLMSG_DATA(nlh);
 	tcm->tcm_family = AF_UNSPEC;
 	tcm->tcm__pad1 = 0;
-	tcm->tcm__pad1 = 0;
+	tcm->tcm__pad2 = 0;
 	tcm->tcm_ifindex = qdisc_dev(tp->q)->ifindex;
 	tcm->tcm_parent = tp->classid;
 	tcm->tcm_info = TC_H_MAKE(tp->prio, tp->protocol);
--- linux-rt-2.6.31.orig/net/sched/act_pedit.c
+++ linux-rt-2.6.31/net/sched/act_pedit.c
@@ -34,7 +34,7 @@
 };
 
 static const struct nla_policy pedit_policy[TCA_PEDIT_MAX + 1] = {
-	[TCA_PEDIT_PARMS]	= { .len = sizeof(struct tcf_pedit) },
+	[TCA_PEDIT_PARMS]	= { .len = sizeof(struct tc_pedit) },
 };
 
 static int tcf_pedit_init(struct nlattr *nla, struct nlattr *est,
--- linux-rt-2.6.31.orig/net/ipv6/udp.c
+++ linux-rt-2.6.31/net/ipv6/udp.c
@@ -288,9 +288,7 @@
 		err = ulen;
 
 out_free:
-	lock_sock(sk);
-	skb_free_datagram(sk, skb);
-	release_sock(sk);
+	skb_free_datagram_locked(sk, skb);
 out:
 	return err;
 
--- linux-rt-2.6.31.orig/net/ipv6/reassembly.c
+++ linux-rt-2.6.31/net/ipv6/reassembly.c
@@ -72,6 +72,7 @@
 	struct inet_frag_queue	q;
 
 	__be32			id;		/* fragment id		*/
+	u32			user;
 	struct in6_addr		saddr;
 	struct in6_addr		daddr;
 
@@ -141,7 +142,7 @@
 	struct ip6_create_arg *arg = a;
 
 	fq = container_of(q, struct frag_queue, q);
-	return (fq->id == arg->id &&
+	return (fq->id == arg->id && fq->user == arg->user &&
 			ipv6_addr_equal(&fq->saddr, arg->src) &&
 			ipv6_addr_equal(&fq->daddr, arg->dst));
 }
@@ -163,6 +164,7 @@
 	struct ip6_create_arg *arg = a;
 
 	fq->id = arg->id;
+	fq->user = arg->user;
 	ipv6_addr_copy(&fq->saddr, arg->src);
 	ipv6_addr_copy(&fq->daddr, arg->dst);
 }
@@ -244,6 +246,7 @@
 	unsigned int hash;
 
 	arg.id = id;
+	arg.user = IP6_DEFRAG_LOCAL_DELIVER;
 	arg.src = src;
 	arg.dst = dst;
 
--- linux-rt-2.6.31.orig/net/ipv6/exthdrs.c
+++ linux-rt-2.6.31/net/ipv6/exthdrs.c
@@ -559,6 +559,11 @@
 	return skb_dst(skb) ? ip6_dst_idev(skb_dst(skb)) : __in6_dev_get(skb->dev);
 }
 
+static inline struct net *ipv6_skb_net(struct sk_buff *skb)
+{
+	return skb_dst(skb) ? dev_net(skb_dst(skb)->dev) : dev_net(skb->dev);
+}
+
 /* Router Alert as of RFC 2711 */
 
 static int ipv6_hop_ra(struct sk_buff *skb, int optoff)
@@ -580,8 +585,8 @@
 static int ipv6_hop_jumbo(struct sk_buff *skb, int optoff)
 {
 	const unsigned char *nh = skb_network_header(skb);
+	struct net *net = ipv6_skb_net(skb);
 	u32 pkt_len;
-	struct net *net = dev_net(skb_dst(skb)->dev);
 
 	if (nh[optoff + 1] != 4 || (optoff & 3) != 2) {
 		LIMIT_NETDEBUG(KERN_DEBUG "ipv6_hop_jumbo: wrong jumbo opt length/alignment %d\n",
--- linux-rt-2.6.31.orig/net/ipv6/sit.c
+++ linux-rt-2.6.31/net/ipv6/sit.c
@@ -313,7 +313,7 @@
 
 	c = 0;
 	for (prl = t->prl; prl; prl = prl->next) {
-		if (c > cmax)
+		if (c >= cmax)
 			break;
 		if (kprl.addr != htonl(INADDR_ANY) && prl->addr != kprl.addr)
 			continue;
--- linux-rt-2.6.31.orig/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ linux-rt-2.6.31/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -170,13 +170,14 @@
 /* Creation primitives. */
 
 static __inline__ struct nf_ct_frag6_queue *
-fq_find(__be32 id, struct in6_addr *src, struct in6_addr *dst)
+fq_find(__be32 id, u32 user, struct in6_addr *src, struct in6_addr *dst)
 {
 	struct inet_frag_queue *q;
 	struct ip6_create_arg arg;
 	unsigned int hash;
 
 	arg.id = id;
+	arg.user = user;
 	arg.src = src;
 	arg.dst = dst;
 
@@ -561,7 +562,7 @@
 	return 0;
 }
 
-struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb)
+struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb, u32 user)
 {
 	struct sk_buff *clone;
 	struct net_device *dev = skb->dev;
@@ -607,7 +608,7 @@
 	if (atomic_read(&nf_init_frags.mem) > nf_init_frags.high_thresh)
 		nf_ct_frag6_evictor();
 
-	fq = fq_find(fhdr->identification, &hdr->saddr, &hdr->daddr);
+	fq = fq_find(fhdr->identification, user, &hdr->saddr, &hdr->daddr);
 	if (fq == NULL) {
 		pr_debug("Can't find and can't create new queue\n");
 		goto ret_orig;
--- linux-rt-2.6.31.orig/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
+++ linux-rt-2.6.31/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
@@ -183,6 +183,16 @@
 	return nf_conntrack_confirm(skb);
 }
 
+static enum ip6_defrag_users nf_ct6_defrag_user(unsigned int hooknum,
+						struct sk_buff *skb)
+{
+	if (hooknum == NF_INET_PRE_ROUTING)
+		return IP6_DEFRAG_CONNTRACK_IN;
+	else
+		return IP6_DEFRAG_CONNTRACK_OUT;
+
+}
+
 static unsigned int ipv6_defrag(unsigned int hooknum,
 				struct sk_buff *skb,
 				const struct net_device *in,
@@ -195,8 +205,7 @@
 	if (skb->nfct)
 		return NF_ACCEPT;
 
-	reasm = nf_ct_frag6_gather(skb);
-
+	reasm = nf_ct_frag6_gather(skb, nf_ct6_defrag_user(hooknum, skb));
 	/* queued */
 	if (reasm == NULL)
 		return NF_STOLEN;
--- linux-rt-2.6.31.orig/net/sunrpc/svcsock.c
+++ linux-rt-2.6.31/net/sunrpc/svcsock.c
@@ -110,7 +110,7 @@
 		rqstp->rq_xprt_ctxt = NULL;
 
 		dprintk("svc: service %p, releasing skb %p\n", rqstp, skb);
-		skb_free_datagram(svsk->sk_sk, skb);
+		skb_free_datagram_locked(svsk->sk_sk, skb);
 	}
 }
 
@@ -537,7 +537,7 @@
 			printk("rpcsvc: received unknown control message:"
 			       "%d/%d\n",
 			       cmh->cmsg_level, cmh->cmsg_type);
-		skb_free_datagram(svsk->sk_sk, skb);
+		skb_free_datagram_locked(svsk->sk_sk, skb);
 		return 0;
 	}
 	svc_udp_get_dest_address(rqstp, cmh);
@@ -548,18 +548,18 @@
 		if (csum_partial_copy_to_xdr(&rqstp->rq_arg, skb)) {
 			local_bh_enable();
 			/* checksum error */
-			skb_free_datagram(svsk->sk_sk, skb);
+			skb_free_datagram_locked(svsk->sk_sk, skb);
 			return 0;
 		}
 		local_bh_enable();
-		skb_free_datagram(svsk->sk_sk, skb);
+		skb_free_datagram_locked(svsk->sk_sk, skb);
 	} else {
 		/* we can use it in-place */
 		rqstp->rq_arg.head[0].iov_base = skb->data +
 			sizeof(struct udphdr);
 		rqstp->rq_arg.head[0].iov_len = len;
 		if (skb_checksum_complete(skb)) {
-			skb_free_datagram(svsk->sk_sk, skb);
+			skb_free_datagram_locked(svsk->sk_sk, skb);
 			return 0;
 		}
 		rqstp->rq_xprt_ctxt = skb;
--- linux-rt-2.6.31.orig/net/sunrpc/auth_gss/auth_gss.c
+++ linux-rt-2.6.31/net/sunrpc/auth_gss/auth_gss.c
@@ -485,7 +485,7 @@
 	dprintk("RPC: %5u gss_refresh_upcall for uid %u\n", task->tk_pid,
 								cred->cr_uid);
 	gss_msg = gss_setup_upcall(task->tk_client, gss_auth, cred);
-	if (IS_ERR(gss_msg) == -EAGAIN) {
+	if (PTR_ERR(gss_msg) == -EAGAIN) {
 		/* XXX: warning on the first, under the assumption we
 		 * shouldn't normally hit this case on a refresh. */
 		warn_gssd();
--- linux-rt-2.6.31.orig/net/netfilter/nf_conntrack_proto_tcp.c
+++ linux-rt-2.6.31/net/netfilter/nf_conntrack_proto_tcp.c
@@ -492,6 +492,21 @@
 	}
 }
 
+#ifdef CONFIG_NF_NAT_NEEDED
+static inline s16 nat_offset(const struct nf_conn *ct,
+			     enum ip_conntrack_dir dir,
+			     u32 seq)
+{
+	typeof(nf_ct_nat_offset) get_offset = rcu_dereference(nf_ct_nat_offset);
+
+	return get_offset != NULL ? get_offset(ct, dir, seq) : 0;
+}
+#define NAT_OFFSET(pf, ct, dir, seq) \
+	(pf == NFPROTO_IPV4 ? nat_offset(ct, dir, seq) : 0)
+#else
+#define NAT_OFFSET(pf, ct, dir, seq)	0
+#endif
+
 static bool tcp_in_window(const struct nf_conn *ct,
 			  struct ip_ct_tcp *state,
 			  enum ip_conntrack_dir dir,
@@ -506,6 +521,7 @@
 	struct ip_ct_tcp_state *receiver = &state->seen[!dir];
 	const struct nf_conntrack_tuple *tuple = &ct->tuplehash[dir].tuple;
 	__u32 seq, ack, sack, end, win, swin;
+	s16 receiver_offset;
 	bool res;
 
 	/*
@@ -519,11 +535,16 @@
 	if (receiver->flags & IP_CT_TCP_FLAG_SACK_PERM)
 		tcp_sack(skb, dataoff, tcph, &sack);
 
+	/* Take into account NAT sequence number mangling */
+	receiver_offset = NAT_OFFSET(pf, ct, !dir, ack - 1);
+	ack -= receiver_offset;
+	sack -= receiver_offset;
+
 	pr_debug("tcp_in_window: START\n");
 	pr_debug("tcp_in_window: ");
 	nf_ct_dump_tuple(tuple);
-	pr_debug("seq=%u ack=%u sack=%u win=%u end=%u\n",
-		 seq, ack, sack, win, end);
+	pr_debug("seq=%u ack=%u+(%d) sack=%u+(%d) win=%u end=%u\n",
+		 seq, ack, receiver_offset, sack, receiver_offset, win, end);
 	pr_debug("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i "
 		 "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
 		 sender->td_end, sender->td_maxend, sender->td_maxwin,
@@ -613,8 +634,8 @@
 
 	pr_debug("tcp_in_window: ");
 	nf_ct_dump_tuple(tuple);
-	pr_debug("seq=%u ack=%u sack =%u win=%u end=%u\n",
-		 seq, ack, sack, win, end);
+	pr_debug("seq=%u ack=%u+(%d) sack=%u+(%d) win=%u end=%u\n",
+		 seq, ack, receiver_offset, sack, receiver_offset, win, end);
 	pr_debug("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i "
 		 "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
 		 sender->td_end, sender->td_maxend, sender->td_maxwin,
@@ -700,7 +721,7 @@
 			before(seq, sender->td_maxend + 1) ?
 			after(end, sender->td_end - receiver->td_maxwin - 1) ?
 			before(sack, receiver->td_end + 1) ?
-			after(ack, receiver->td_end - MAXACKWINDOW(sender)) ? "BUG"
+			after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1) ? "BUG"
 			: "ACK is under the lower bound (possible overly delayed ACK)"
 			: "ACK is over the upper bound (ACKed data not seen yet)"
 			: "SEQ is under the lower bound (already ACKed data retransmitted)"
@@ -715,39 +736,6 @@
 	return res;
 }
 
-#ifdef CONFIG_NF_NAT_NEEDED
-/* Update sender->td_end after NAT successfully mangled the packet */
-/* Caller must linearize skb at tcp header. */
-void nf_conntrack_tcp_update(const struct sk_buff *skb,
-			     unsigned int dataoff,
-			     struct nf_conn *ct, int dir,
-			     s16 offset)
-{
-	const struct tcphdr *tcph = (const void *)skb->data + dataoff;
-	const struct ip_ct_tcp_state *sender = &ct->proto.tcp.seen[dir];
-	const struct ip_ct_tcp_state *receiver = &ct->proto.tcp.seen[!dir];
-	__u32 end;
-
-	end = segment_seq_plus_len(ntohl(tcph->seq), skb->len, dataoff, tcph);
-
-	spin_lock_bh(&ct->lock);
-	/*
-	 * We have to worry for the ack in the reply packet only...
-	 */
-	if (ct->proto.tcp.seen[dir].td_end + offset == end)
-		ct->proto.tcp.seen[dir].td_end = end;
-	ct->proto.tcp.last_end = end;
-	spin_unlock_bh(&ct->lock);
-	pr_debug("tcp_update: sender end=%u maxend=%u maxwin=%u scale=%i "
-		 "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
-		 sender->td_end, sender->td_maxend, sender->td_maxwin,
-		 sender->td_scale,
-		 receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
-		 receiver->td_scale);
-}
-EXPORT_SYMBOL_GPL(nf_conntrack_tcp_update);
-#endif
-
 #define	TH_FIN	0x01
 #define	TH_SYN	0x02
 #define	TH_RST	0x04
--- linux-rt-2.6.31.orig/net/netfilter/nf_conntrack_core.c
+++ linux-rt-2.6.31/net/netfilter/nf_conntrack_core.c
@@ -1089,14 +1089,14 @@
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_flush_report);
 
-static void nf_ct_release_dying_list(void)
+static void nf_ct_release_dying_list(struct net *net)
 {
 	struct nf_conntrack_tuple_hash *h;
 	struct nf_conn *ct;
 	struct hlist_nulls_node *n;
 
 	spin_lock_bh(&nf_conntrack_lock);
-	hlist_nulls_for_each_entry(h, n, &init_net.ct.dying, hnnode) {
+	hlist_nulls_for_each_entry(h, n, &net->ct.dying, hnnode) {
 		ct = nf_ct_tuplehash_to_ctrack(h);
 		/* never fails to remove them, no listeners at this point */
 		nf_ct_kill(ct);
@@ -1115,7 +1115,7 @@
 {
  i_see_dead_people:
 	nf_ct_iterate_cleanup(net, kill_all, NULL);
-	nf_ct_release_dying_list();
+	nf_ct_release_dying_list(net);
 	if (atomic_read(&net->ct.count) != 0) {
 		schedule();
 		goto i_see_dead_people;
@@ -1350,6 +1350,11 @@
 	return ret;
 }
 
+s16 (*nf_ct_nat_offset)(const struct nf_conn *ct,
+			enum ip_conntrack_dir dir,
+			u32 seq);
+EXPORT_SYMBOL_GPL(nf_ct_nat_offset);
+
 int nf_conntrack_init(struct net *net)
 {
 	int ret;
@@ -1367,6 +1372,9 @@
 		/* For use by REJECT target */
 		rcu_assign_pointer(ip_ct_attach, nf_conntrack_attach);
 		rcu_assign_pointer(nf_ct_destroy, destroy_conntrack);
+
+		/* Howto get NAT offsets */
+		rcu_assign_pointer(nf_ct_nat_offset, NULL);
 	}
 	return 0;
 
--- linux-rt-2.6.31.orig/net/netfilter/xt_connlimit.c
+++ linux-rt-2.6.31/net/netfilter/xt_connlimit.c
@@ -103,7 +103,7 @@
 		      const struct nf_conntrack_tuple *tuple,
 		      const union nf_inet_addr *addr,
 		      const union nf_inet_addr *mask,
-		      const struct xt_match *match)
+		      u_int8_t family)
 {
 	const struct nf_conntrack_tuple_hash *found;
 	struct xt_connlimit_conn *conn;
@@ -113,8 +113,7 @@
 	bool addit = true;
 	int matches = 0;
 
-
-	if (match->family == NFPROTO_IPV6)
+	if (family == NFPROTO_IPV6)
 		hash = &data->iphash[connlimit_iphash6(addr, mask)];
 	else
 		hash = &data->iphash[connlimit_iphash(addr->ip & mask->ip)];
@@ -157,8 +156,7 @@
 			continue;
 		}
 
-		if (same_source_net(addr, mask, &conn->tuple.src.u3,
-		    match->family))
+		if (same_source_net(addr, mask, &conn->tuple.src.u3, family))
 			/* same source network -> be counted! */
 			++matches;
 		nf_ct_put(found_ct);
@@ -207,7 +205,7 @@
 
 	spin_lock_bh(&info->data->lock);
 	connections = count_them(info->data, tuple_ptr, &addr,
-	                         &info->mask, par->match);
+	                         &info->mask, par->family);
 	spin_unlock_bh(&info->data->lock);
 
 	if (connections < 0) {
--- linux-rt-2.6.31.orig/net/netfilter/nf_conntrack_ftp.c
+++ linux-rt-2.6.31/net/netfilter/nf_conntrack_ftp.c
@@ -323,24 +323,24 @@
 			  struct nf_ct_ftp_master *info, int dir,
 			  struct sk_buff *skb)
 {
-	unsigned int i, oldest = NUM_SEQ_TO_REMEMBER;
+	unsigned int i, oldest;
 
 	/* Look for oldest: if we find exact match, we're done. */
 	for (i = 0; i < info->seq_aft_nl_num[dir]; i++) {
 		if (info->seq_aft_nl[dir][i] == nl_seq)
 			return;
-
-		if (oldest == info->seq_aft_nl_num[dir] ||
-		    before(info->seq_aft_nl[dir][i],
-			   info->seq_aft_nl[dir][oldest]))
-			oldest = i;
 	}
 
 	if (info->seq_aft_nl_num[dir] < NUM_SEQ_TO_REMEMBER) {
 		info->seq_aft_nl[dir][info->seq_aft_nl_num[dir]++] = nl_seq;
-	} else if (oldest != NUM_SEQ_TO_REMEMBER &&
-		   after(nl_seq, info->seq_aft_nl[dir][oldest])) {
-		info->seq_aft_nl[dir][oldest] = nl_seq;
+	} else {
+		if (before(info->seq_aft_nl[dir][0], info->seq_aft_nl[dir][1]))
+			oldest = 0;
+		else
+			oldest = 1;
+
+		if (after(nl_seq, info->seq_aft_nl[dir][oldest]))
+			info->seq_aft_nl[dir][oldest] = nl_seq;
 	}
 }
 
--- linux-rt-2.6.31.orig/net/netfilter/ipvs/ip_vs_ctl.c
+++ linux-rt-2.6.31/net/netfilter/ipvs/ip_vs_ctl.c
@@ -2713,6 +2713,8 @@
 	if (!(nla_af && (nla_fwmark || (nla_port && nla_protocol && nla_addr))))
 		return -EINVAL;
 
+	memset(usvc, 0, sizeof(*usvc));
+
 	usvc->af = nla_get_u16(nla_af);
 #ifdef CONFIG_IP_VS_IPV6
 	if (usvc->af != AF_INET && usvc->af != AF_INET6)
@@ -2900,6 +2902,8 @@
 	if (!(nla_addr && nla_port))
 		return -EINVAL;
 
+	memset(udest, 0, sizeof(*udest));
+
 	nla_memcpy(&udest->addr, nla_addr, sizeof(udest->addr));
 	udest->port = nla_get_u16(nla_port);
 
--- linux-rt-2.6.31.orig/net/wireless/scan.c
+++ linux-rt-2.6.31/net/wireless/scan.c
@@ -97,7 +97,7 @@
 		dev->bss_generation++;
 }
 
-static u8 *find_ie(u8 num, u8 *ies, size_t len)
+static u8 *find_ie(u8 num, u8 *ies, int len)
 {
 	while (len > 2 && ies[0] != num) {
 		len -= ies[1] + 2;
--- linux-rt-2.6.31.orig/net/can/af_can.c
+++ linux-rt-2.6.31/net/can/af_can.c
@@ -199,6 +199,8 @@
  * @skb: pointer to socket buffer with CAN frame in data section
  * @loop: loopback for listeners on local CAN sockets (recommended default!)
  *
+ * Due to the loopback this routine must not be called from hardirq context.
+ *
  * Return:
  *  0 on success
  *  -ENETDOWN when the selected interface is down
@@ -278,7 +280,7 @@
 	}
 
 	if (newskb)
-		netif_rx(newskb);
+		netif_rx_ni(newskb);
 
 	/* update statistics */
 	can_stats.tx_frames++;
--- linux-rt-2.6.31.orig/net/appletalk/aarp.c
+++ linux-rt-2.6.31/net/appletalk/aarp.c
@@ -599,7 +599,7 @@
 
 	/* Non ELAP we cannot do. */
 	if (dev->type != ARPHRD_ETHER)
-		return -1;
+		goto free_it;
 
 	skb->dev = dev;
 	skb->protocol = htons(ETH_P_ATALK);
@@ -634,7 +634,7 @@
 	if (!a) {
 		/* Whoops slipped... good job it's an unreliable protocol 8) */
 		write_unlock_bh(&aarp_lock);
-		return -1;
+		goto free_it;
 	}
 
 	/* Set up the queue */
@@ -663,15 +663,21 @@
 	write_unlock_bh(&aarp_lock);
 
 	/* Tell the ddp layer we have taken over for this frame. */
-	return 0;
+	goto sent;
 
 sendit:
 	if (skb->sk)
 		skb->priority = skb->sk->sk_priority;
-	dev_queue_xmit(skb);
+	if (dev_queue_xmit(skb))
+		goto drop;
 sent:
-	return 1;
+	return NET_XMIT_SUCCESS;
+free_it:
+	kfree_skb(skb);
+drop:
+	return NET_XMIT_DROP;
 }
+EXPORT_SYMBOL(aarp_send_ddp);
 
 /*
  *	An entry in the aarp unresolved queue has become resolved. Send
--- linux-rt-2.6.31.orig/net/appletalk/ddp.c
+++ linux-rt-2.6.31/net/appletalk/ddp.c
@@ -1270,8 +1270,10 @@
 	struct net_device_stats *stats;
 
 	/* This needs to be able to handle ipddp"N" devices */
-	if (!dev)
-		return -ENODEV;
+	if (!dev) {
+		kfree_skb(skb);
+		return NET_RX_DROP;
+	}
 
 	skb->protocol = htons(ETH_P_IP);
 	skb_pull(skb, 13);
@@ -1281,8 +1283,7 @@
 	stats = netdev_priv(dev);
 	stats->rx_packets++;
 	stats->rx_bytes += skb->len + 13;
-	netif_rx(skb);  /* Send the SKB up to a higher place. */
-	return 0;
+	return netif_rx(skb);  /* Send the SKB up to a higher place. */
 }
 #else
 /* make it easy for gcc to optimize this test out, i.e. kill the code */
@@ -1290,9 +1291,8 @@
 #define handle_ip_over_ddp(skb) 0
 #endif
 
-static void atalk_route_packet(struct sk_buff *skb, struct net_device *dev,
-			       struct ddpehdr *ddp, __u16 len_hops,
-			       int origlen)
+static int atalk_route_packet(struct sk_buff *skb, struct net_device *dev,
+			      struct ddpehdr *ddp, __u16 len_hops, int origlen)
 {
 	struct atalk_route *rt;
 	struct atalk_addr ta;
@@ -1359,8 +1359,6 @@
 		/* 22 bytes - 12 ether, 2 len, 3 802.2 5 snap */
 		struct sk_buff *nskb = skb_realloc_headroom(skb, 32);
 		kfree_skb(skb);
-		if (!nskb)
-			goto out;
 		skb = nskb;
 	} else
 		skb = skb_unshare(skb, GFP_ATOMIC);
@@ -1369,12 +1367,18 @@
 	 * If the buffer didn't vanish into the lack of space bitbucket we can
 	 * send it.
 	 */
-	if (skb && aarp_send_ddp(rt->dev, skb, &ta, NULL) == -1)
-		goto free_it;
-out:
-	return;
+	if (skb == NULL)
+		goto drop;
+
+	/*
+	 * It is OK, NET_XMIT_SUCCESS == NET_RX_SUCCESS and
+	 * NET_XMIT_DROP == NET_RX_DROP
+	 */
+	return aarp_send_ddp(rt->dev, skb, &ta, NULL);
 free_it:
 	kfree_skb(skb);
+drop:
+	return NET_RX_DROP;
 }
 
 /**
@@ -1404,7 +1408,7 @@
 
 	/* Don't mangle buffer if shared */
 	if (!(skb = skb_share_check(skb, GFP_ATOMIC)))
-		goto out;
+		goto drop;
 
 	/* Size check and make sure header is contiguous */
 	if (!pskb_may_pull(skb, sizeof(*ddp)))
@@ -1448,8 +1452,7 @@
 		/* Not ours, so we route the packet via the correct
 		 * AppleTalk iface
 		 */
-		atalk_route_packet(skb, dev, ddp, len_hops, origlen);
-		goto out;
+		return atalk_route_packet(skb, dev, ddp, len_hops, origlen);
 	}
 
 	/* if IP over DDP is not selected this code will be optimized out */
@@ -1472,11 +1475,12 @@
 
 	if (sock_queue_rcv_skb(sock, skb) < 0)
 		goto freeit;
-out:
-	return 0;
+
+	return NET_RX_SUCCESS;
 freeit:
 	kfree_skb(skb);
-	goto out;
+drop:
+	return NET_RX_DROP;
 }
 
 /*
@@ -1652,10 +1656,10 @@
 		if (skb2) {
 			loopback = 1;
 			SOCK_DEBUG(sk, "SK %p: send out(copy).\n", sk);
-			if (aarp_send_ddp(dev, skb2,
-					  &usat->sat_addr, NULL) == -1)
-				kfree_skb(skb2);
-				/* else queued/sent above in the aarp queue */
+			/*
+			 * If it fails it is queued/sent above in the aarp queue
+			 */
+			aarp_send_ddp(dev, skb2, &usat->sat_addr, NULL);
 		}
 	}
 
@@ -1685,9 +1689,10 @@
 		    usat = &gsat;
 		}
 
-		if (aarp_send_ddp(dev, skb, &usat->sat_addr, NULL) == -1)
-			kfree_skb(skb);
-		/* else queued/sent above in the aarp queue */
+		/*
+		 * If it fails it is queued/sent above in the aarp queue
+		 */
+		aarp_send_ddp(dev, skb, &usat->sat_addr, NULL);
 	}
 	SOCK_DEBUG(sk, "SK %p: Done write (%Zd).\n", sk, len);
 
@@ -1865,7 +1870,6 @@
 static unsigned char ddp_snap_id[] = { 0x08, 0x00, 0x07, 0x80, 0x9B };
 
 /* Export symbols for use by drivers when AppleTalk is a module */
-EXPORT_SYMBOL(aarp_send_ddp);
 EXPORT_SYMBOL(atrtr_get_dev);
 EXPORT_SYMBOL(atalk_find_dev_addr);
 
--- linux-rt-2.6.31.orig/net/core/datagram.c
+++ linux-rt-2.6.31/net/core/datagram.c
@@ -223,6 +223,15 @@
 	consume_skb(skb);
 	sk_mem_reclaim_partial(sk);
 }
+EXPORT_SYMBOL(skb_free_datagram);
+
+void skb_free_datagram_locked(struct sock *sk, struct sk_buff *skb)
+{
+	lock_sock(sk);
+	skb_free_datagram(sk, skb);
+	release_sock(sk);
+}
+EXPORT_SYMBOL(skb_free_datagram_locked);
 
 /**
  *	skb_kill_datagram - Free a datagram skbuff forcibly
@@ -749,5 +758,4 @@
 EXPORT_SYMBOL(datagram_poll);
 EXPORT_SYMBOL(skb_copy_and_csum_datagram_iovec);
 EXPORT_SYMBOL(skb_copy_datagram_iovec);
-EXPORT_SYMBOL(skb_free_datagram);
 EXPORT_SYMBOL(skb_recv_datagram);
--- linux-rt-2.6.31.orig/net/core/skbuff.c
+++ linux-rt-2.6.31/net/core/skbuff.c
@@ -2704,7 +2704,8 @@
 
 		NAPI_GRO_CB(skb)->free = 1;
 		goto done;
-	}
+	} else if (skb_gro_len(p) != pinfo->gso_size)
+		return -E2BIG;
 
 	headroom = skb_headroom(p);
 	nskb = netdev_alloc_skb(p->dev, headroom + skb_gro_offset(p));
--- linux-rt-2.6.31.orig/net/core/dev.c
+++ linux-rt-2.6.31/net/core/dev.c
@@ -933,14 +933,15 @@
 	ret = notifier_to_errno(ret);
 
 	if (ret) {
-		if (err) {
-			printk(KERN_ERR
-			       "%s: name change rollback failed: %d.\n",
-			       dev->name, ret);
-		} else {
+		/* err >= 0 after dev_alloc_name() or stores the first errno */
+		if (err >= 0) {
 			err = ret;
 			memcpy(dev->name, oldname, IFNAMSIZ);
 			goto rollback;
+		} else {
+			printk(KERN_ERR
+			       "%s: name change rollback failed: %d.\n",
+			       dev->name, ret);
 		}
 	}
 
@@ -2248,6 +2249,9 @@
 	int ret = NET_RX_DROP;
 	__be16 type;
 
+	if (!skb->tstamp.tv64)
+		net_timestamp(skb);
+
 	if (skb->vlan_tci && vlan_hwaccel_do_receive(skb))
 		return NET_RX_SUCCESS;
 
@@ -2255,9 +2259,6 @@
 	if (netpoll_receive_skb(skb))
 		return NET_RX_DROP;
 
-	if (!skb->tstamp.tv64)
-		net_timestamp(skb);
-
 	if (!skb->iif)
 		skb->iif = skb->dev->ifindex;
 
@@ -4807,6 +4808,11 @@
 		rollback_registered(dev);
 		dev->reg_state = NETREG_UNREGISTERED;
 	}
+	/*
+	 *	Prevent userspace races by waiting until the network
+	 *	device is fully setup before sending notifications.
+	 */
+	rtmsg_ifinfo(RTM_NEWLINK, dev, ~0U);
 
 out:
 	return ret;
@@ -5342,6 +5348,12 @@
 	/* Notify protocols, that a new device appeared. */
 	call_netdevice_notifiers(NETDEV_REGISTER, dev);
 
+	/*
+	 *	Prevent userspace races by waiting until the network
+	 *	device is fully setup before sending notifications.
+	 */
+	rtmsg_ifinfo(RTM_NEWLINK, dev, ~0U);
+
 	synchronize_net();
 	err = 0;
 out:
--- linux-rt-2.6.31.orig/net/core/sock.c
+++ linux-rt-2.6.31/net/core/sock.c
@@ -1218,17 +1218,22 @@
 void sock_wfree(struct sk_buff *skb)
 {
 	struct sock *sk = skb->sk;
-	int res;
+	unsigned int len = skb->truesize;
 
-	/* In case it might be waiting for more memory. */
-	res = atomic_sub_return(skb->truesize, &sk->sk_wmem_alloc);
-	if (!sock_flag(sk, SOCK_USE_WRITE_QUEUE))
+	if (!sock_flag(sk, SOCK_USE_WRITE_QUEUE)) {
+		/*
+		 * Keep a reference on sk_wmem_alloc, this will be released
+		 * after sk_write_space() call
+		 */
+		atomic_sub(len - 1, &sk->sk_wmem_alloc);
 		sk->sk_write_space(sk);
+		len = 1;
+	}
 	/*
-	 * if sk_wmem_alloc reached 0, we are last user and should
-	 * free this sock, as sk_free() call could not do it.
+	 * if sk_wmem_alloc reaches 0, we must finish what sk_free()
+	 * could not do because of in-flight packets
 	 */
-	if (res == 0)
+	if (atomic_sub_and_test(len, &sk->sk_wmem_alloc))
 		__sk_free(sk);
 }
 EXPORT_SYMBOL(sock_wfree);
--- linux-rt-2.6.31.orig/net/core/rtnetlink.c
+++ linux-rt-2.6.31/net/core/rtnetlink.c
@@ -1347,13 +1347,11 @@
 	case NETDEV_UNREGISTER:
 		rtmsg_ifinfo(RTM_DELLINK, dev, ~0U);
 		break;
-	case NETDEV_REGISTER:
-		rtmsg_ifinfo(RTM_NEWLINK, dev, ~0U);
-		break;
 	case NETDEV_UP:
 	case NETDEV_DOWN:
 		rtmsg_ifinfo(RTM_NEWLINK, dev, IFF_UP|IFF_RUNNING);
 		break;
+	case NETDEV_REGISTER:
 	case NETDEV_CHANGE:
 	case NETDEV_GOING_DOWN:
 		break;
--- linux-rt-2.6.31.orig/net/bridge/br_netfilter.c
+++ linux-rt-2.6.31/net/bridge/br_netfilter.c
@@ -359,7 +359,7 @@
 				},
 				.proto = 0,
 			};
-			struct in_device *in_dev = in_dev_get(dev);
+			struct in_device *in_dev = __in_dev_get_rcu(dev);
 
 			/* If err equals -EHOSTUNREACH the error is due to a
 			 * martian destination or due to the fact that
--- linux-rt-2.6.31.orig/net/bridge/netfilter/ebtables.c
+++ linux-rt-2.6.31/net/bridge/netfilter/ebtables.c
@@ -1405,6 +1405,9 @@
 {
 	int ret;
 
+	if (!capable(CAP_NET_ADMIN))
+		return -EPERM;
+
 	switch(cmd) {
 	case EBT_SO_SET_ENTRIES:
 		ret = do_replace(sock_net(sk), user, len);
@@ -1424,6 +1427,9 @@
 	struct ebt_replace tmp;
 	struct ebt_table *t;
 
+	if (!capable(CAP_NET_ADMIN))
+		return -EPERM;
+
 	if (copy_from_user(&tmp, user, sizeof(tmp)))
 		return -EFAULT;
 
--- linux-rt-2.6.31.orig/net/bridge/netfilter/ebt_ulog.c
+++ linux-rt-2.6.31/net/bridge/netfilter/ebt_ulog.c
@@ -266,7 +266,7 @@
 	if (uloginfo->qthreshold > EBT_ULOG_MAX_QLEN)
 		uloginfo->qthreshold = EBT_ULOG_MAX_QLEN;
 
-	return 0;
+	return true;
 }
 
 static struct xt_target ebt_ulog_tg_reg __read_mostly = {
--- linux-rt-2.6.31.orig/net/mac80211/tx.c
+++ linux-rt-2.6.31/net/mac80211/tx.c
@@ -1478,7 +1478,7 @@
 				if (sdata->vif.type != NL80211_IFTYPE_AP)
 					continue;
 				if (compare_ether_addr(sdata->dev->dev_addr,
-						       hdr->addr2)) {
+						       hdr->addr2) == 0) {
 					dev_hold(sdata->dev);
 					dev_put(odev);
 					osdata = sdata;
@@ -1736,7 +1736,8 @@
 	if (!is_multicast_ether_addr(hdr.addr1)) {
 		rcu_read_lock();
 		sta = sta_info_get(local, hdr.addr1);
-		if (sta)
+		/* XXX: in the future, use sdata to look up the sta */
+		if (sta && sta->sdata == sdata)
 			sta_flags = get_sta_flags(sta);
 		rcu_read_unlock();
 	}
--- linux-rt-2.6.31.orig/net/mac80211/ht.c
+++ linux-rt-2.6.31/net/mac80211/ht.c
@@ -141,7 +141,6 @@
 			     struct sta_info *sta,
 			     struct ieee80211_mgmt *mgmt, size_t len)
 {
-	struct ieee80211_local *local = sdata->local;
 	u16 tid, params;
 	u16 initiator;
 
@@ -161,10 +160,9 @@
 						 WLAN_BACK_INITIATOR, 0);
 	else { /* WLAN_BACK_RECIPIENT */
 		spin_lock_bh(&sta->lock);
-		sta->ampdu_mlme.tid_state_tx[tid] =
-				HT_AGG_STATE_OPERATIONAL;
+		if (sta->ampdu_mlme.tid_state_tx[tid] & HT_ADDBA_REQUESTED_MSK)
+			___ieee80211_stop_tx_ba_session(sta, tid,
+							WLAN_BACK_RECIPIENT);
 		spin_unlock_bh(&sta->lock);
-		ieee80211_stop_tx_ba_session(&local->hw, sta->sta.addr, tid,
-					     WLAN_BACK_RECIPIENT);
 	}
 }
--- linux-rt-2.6.31.orig/net/mac80211/debugfs_netdev.c
+++ linux-rt-2.6.31/net/mac80211/debugfs_netdev.c
@@ -470,6 +470,7 @@
 {
 	struct net_device *dev = ndev;
 	struct dentry *dir;
+	struct ieee80211_local *local;
 	struct ieee80211_sub_if_data *sdata;
 	char buf[10+IFNAMSIZ];
 
@@ -482,7 +483,12 @@
 	if (dev->ieee80211_ptr->wiphy->privid != mac80211_wiphy_privid)
 		return 0;
 
-	sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+	/*
+	 * Do not use IEEE80211_DEV_TO_SUB_IF because that
+	 * BUG_ONs for the master netdev which we need to
+	 * handle here.
+	 */
+	sdata = netdev_priv(dev);
 
 	dir = sdata->debugfsdir;
 
--- linux-rt-2.6.31.orig/net/mac80211/rx.c
+++ linux-rt-2.6.31/net/mac80211/rx.c
@@ -2155,11 +2155,17 @@
 
 	skb = rx.skb;
 
-	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+	if (rx.sdata && ieee80211_is_data(hdr->frame_control)) {
+		rx.flags |= IEEE80211_RX_RA_MATCH;
+		prepares = prepare_for_handlers(rx.sdata, &rx, hdr);
+		if (prepares)
+			prev = rx.sdata;
+	} else list_for_each_entry_rcu(sdata, &local->interfaces, list) {
 		if (!netif_running(sdata->dev))
 			continue;
 
-		if (sdata->vif.type == NL80211_IFTYPE_MONITOR)
+		if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
+		    sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
 			continue;
 
 		rx.flags |= IEEE80211_RX_RA_MATCH;
--- linux-rt-2.6.31.orig/net/mac80211/agg-rx.c
+++ linux-rt-2.6.31/net/mac80211/agg-rx.c
@@ -85,10 +85,6 @@
 	struct ieee80211_local *local = sdata->local;
 	struct sta_info *sta;
 
-	/* stop HW Rx aggregation. ampdu_action existence
-	 * already verified in session init so we add the BUG_ON */
-	BUG_ON(!local->ops->ampdu_action);
-
 	rcu_read_lock();
 
 	sta = sta_info_get(local, ra);
--- linux-rt-2.6.31.orig/net/mac80211/agg-tx.c
+++ linux-rt-2.6.31/net/mac80211/agg-tx.c
@@ -123,13 +123,18 @@
 	ieee80211_tx_skb(sdata, skb, 0);
 }
 
-static int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
-					   enum ieee80211_back_parties initiator)
+int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
+				    enum ieee80211_back_parties initiator)
 {
 	struct ieee80211_local *local = sta->local;
 	int ret;
 	u8 *state;
 
+#ifdef CONFIG_MAC80211_HT_DEBUG
+	printk(KERN_DEBUG "Tx BA session stop requested for %pM tid %u\n",
+	       sta->sta.addr, tid);
+#endif /* CONFIG_MAC80211_HT_DEBUG */
+
 	state = &sta->ampdu_mlme.tid_state_tx[tid];
 
 	if (*state == HT_AGG_STATE_OPERATIONAL)
@@ -143,7 +148,6 @@
 
 	/* HW shall not deny going back to legacy */
 	if (WARN_ON(ret)) {
-		*state = HT_AGG_STATE_OPERATIONAL;
 		/*
 		 * We may have pending packets get stuck in this case...
 		 * Not bothering with a workaround for now.
@@ -526,11 +530,6 @@
 		goto unlock;
 	}
 
-#ifdef CONFIG_MAC80211_HT_DEBUG
-	printk(KERN_DEBUG "Tx BA session stop requested for %pM tid %u\n",
-	       sta->sta.addr, tid);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
-
 	ret = ___ieee80211_stop_tx_ba_session(sta, tid, initiator);
 
  unlock:
@@ -546,7 +545,7 @@
 	struct sta_info *sta;
 	int ret = 0;
 
-	if (WARN_ON(!local->ops->ampdu_action))
+	if (!local->ops->ampdu_action)
 		return -EINVAL;
 
 	if (tid >= STA_TID_NUM)
--- linux-rt-2.6.31.orig/net/mac80211/cfg.c
+++ linux-rt-2.6.31/net/mac80211/cfg.c
@@ -87,6 +87,9 @@
 	if (!dev)
 		return -ENODEV;
 
+	if (netif_running(dev))
+		return -EBUSY;
+
 	if (!nl80211_type_check(type))
 		return -EINVAL;
 
@@ -96,9 +99,6 @@
 	if (ret)
 		return ret;
 
-	if (netif_running(sdata->dev))
-		return -EBUSY;
-
 	if (ieee80211_vif_is_mesh(&sdata->vif) && params->mesh_id_len)
 		ieee80211_sdata_set_mesh_id(sdata,
 					    params->mesh_id_len,
--- linux-rt-2.6.31.orig/net/mac80211/ieee80211_i.h
+++ linux-rt-2.6.31/net/mac80211/ieee80211_i.h
@@ -1057,6 +1057,8 @@
 
 int __ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
 				   enum ieee80211_back_parties initiator);
+int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
+				    enum ieee80211_back_parties initiator);
 
 /* Spectrum management */
 void ieee80211_process_measurement_req(struct ieee80211_sub_if_data *sdata,
--- linux-rt-2.6.31.orig/net/mac80211/sta_info.c
+++ linux-rt-2.6.31/net/mac80211/sta_info.c
@@ -360,6 +360,7 @@
 					     u.ap);
 
 		drv_sta_notify(local, &sdata->vif, STA_NOTIFY_ADD, &sta->sta);
+		sdata = sta->sdata;
 	}
 
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
@@ -494,6 +495,7 @@
 
 		drv_sta_notify(local, &sdata->vif, STA_NOTIFY_REMOVE,
 			       &(*sta)->sta);
+		sdata = (*sta)->sdata;
 	}
 
 	if (ieee80211_vif_is_mesh(&sdata->vif)) {
--- linux-rt-2.6.31.orig/net/mac80211/util.c
+++ linux-rt-2.6.31/net/mac80211/util.c
@@ -537,7 +537,7 @@
 		if (elen > left)
 			break;
 
-		if (calc_crc && id < 64 && (filter & BIT(id)))
+		if (calc_crc && id < 64 && (filter & (1ULL << id)))
 			crc = crc32_be(crc, pos - 2, elen + 2);
 
 		switch (id) {
--- linux-rt-2.6.31.orig/Documentation/kernel-parameters.txt
+++ linux-rt-2.6.31/Documentation/kernel-parameters.txt
@@ -90,6 +90,7 @@
 			A lot of drivers has their options described inside of
 			Documentation/scsi/.
 	SECURITY Different security models are enabled.
+	SECURITY_DEFAULT set a default security module
 	SELINUX SELinux support is enabled.
 	SERIAL	Serial support is enabled.
 	SH	SuperH architecture is enabled.
@@ -2561,6 +2562,8 @@
 			to a common usb-storage quirk flag as follows:
 				a = SANE_SENSE (collect more than 18 bytes
 					of sense data);
+				b = BAD_SENSE (don't collect more than 18
+					bytes of sense data);
 				c = FIX_CAPACITY (decrease the reported
 					device capacity by one sector);
 				h = CAPACITY_HEURISTICS (decrease the
--- linux-rt-2.6.31.orig/Documentation/video4linux/gspca.txt
+++ linux-rt-2.6.31/Documentation/video4linux/gspca.txt
@@ -37,6 +37,7 @@
 ov519		041e:4060	Creative Live! VISTA VF0350
 ov519		041e:4061	Creative Live! VISTA VF0400
 ov519		041e:4064	Creative Live! VISTA VF0420
+ov519		041e:4067	Creative Live! Cam Video IM (VF0350)
 ov519		041e:4068	Creative Live! VISTA VF0470
 spca561		0458:7004	Genius VideoCAM Express V2
 sunplus		0458:7006	Genius Dsc 1.3 Smart
@@ -284,6 +285,7 @@
 sonixj		0c45:613b	Surfer SN-206
 sonixj		0c45:613c	Sonix Pccam168
 sonixj		0c45:6143	Sonix Pccam168
+sonixj		0c45:6148	Digitus DA-70811/ZSMC USB PC Camera ZS211/Microdia
 sn9c20x		0c45:6240	PC Camera (SN9C201 + MT9M001)
 sn9c20x		0c45:6242	PC Camera (SN9C201 + MT9M111)
 sn9c20x		0c45:6248	PC Camera (SN9C201 + OV9655)
--- linux-rt-2.6.31.orig/Documentation/video4linux/CARDLIST.cx88
+++ linux-rt-2.6.31/Documentation/video4linux/CARDLIST.cx88
@@ -80,3 +80,4 @@
  79 -> Terratec Cinergy HT PCI MKII                        [153b:1177]
  80 -> Hauppauge WinTV-IR Only                             [0070:9290]
  81 -> Leadtek WinFast DTV1800 Hybrid                      [107d:6654]
+ 82 -> WinFast DTV2000 H rev. J                            [107d:6f2b]
--- linux-rt-2.6.31.orig/Documentation/networking/README.ipw2200
+++ linux-rt-2.6.31/Documentation/networking/README.ipw2200
@@ -171,7 +171,7 @@
   
   led
 	Can be used to turn on experimental LED code.
-	0 = Off, 1 = On.  Default is 0.
+	0 = Off, 1 = On.  Default is 1.
 
   mode
 	Can be used to set the default mode of the adapter.  
--- linux-rt-2.6.31.orig/Documentation/networking/timestamping/timestamping.c
+++ linux-rt-2.6.31/Documentation/networking/timestamping/timestamping.c
@@ -381,7 +381,7 @@
 	memset(&hwtstamp, 0, sizeof(hwtstamp));
 	strncpy(hwtstamp.ifr_name, interface, sizeof(hwtstamp.ifr_name));
 	hwtstamp.ifr_data = (void *)&hwconfig;
-	memset(&hwconfig, 0, sizeof(&hwconfig));
+	memset(&hwconfig, 0, sizeof(hwconfig));
 	hwconfig.tx_type =
 		(so_timestamping_flags & SOF_TIMESTAMPING_TX_HARDWARE) ?
 		HWTSTAMP_TX_ON : HWTSTAMP_TX_OFF;
--- linux-rt-2.6.31.orig/Documentation/connector/connector.txt
+++ linux-rt-2.6.31/Documentation/connector/connector.txt
@@ -23,7 +23,7 @@
 based networking for inter-process communication in a significantly
 easier way:
 
-int cn_add_callback(struct cb_id *id, char *name, void (*callback) (void *));
+int cn_add_callback(struct cb_id *id, char *name, void (*callback) (struct cn_msg *, struct netlink_skb_parms *));
 void cn_netlink_send(struct cn_msg *msg, u32 __group, int gfp_mask);
 
 struct cb_id
@@ -53,15 +53,15 @@
 Connector interfaces.
 /*****************************************/
 
-int cn_add_callback(struct cb_id *id, char *name, void (*callback) (void *));
+int cn_add_callback(struct cb_id *id, char *name, void (*callback) (struct cn_msg *, struct netlink_skb_parms *));
 
 Registers new callback with connector core.
 
-struct cb_id *id 		- unique connector's user identifier.
-			  	  It must be registered in connector.h for legal in-kernel users.
-char *name 			- connector's callback symbolic name.
-void (*callback) (void *)	- connector's callback.
-				  Argument must be dereferenced to struct cn_msg *.
+ struct cb_id *id		- unique connector's user identifier.
+				  It must be registered in connector.h for legal in-kernel users.
+ char *name			- connector's callback symbolic name.
+ void (*callback) (struct cn..)	- connector's callback.
+				  cn_msg and the sender's credentials
 
 void cn_del_callback(struct cb_id *id);
 
--- linux-rt-2.6.31.orig/Documentation/connector/cn_test.c
+++ linux-rt-2.6.31/Documentation/connector/cn_test.c
@@ -32,10 +32,8 @@
 static struct sock *nls;
 static struct timer_list cn_test_timer;
 
-void cn_test_callback(void *data)
+static void cn_test_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp)
 {
-	struct cn_msg *msg = (struct cn_msg *)data;
-
 	printk("%s: %lu: idx=%x, val=%x, seq=%u, ack=%u, len=%d: %s.\n",
 	       __func__, jiffies, msg->id.idx, msg->id.val,
 	       msg->seq, msg->ack, msg->len, (char *)msg->data);
--- linux-rt-2.6.31.orig/Documentation/filesystems/ext4.txt
+++ linux-rt-2.6.31/Documentation/filesystems/ext4.txt
@@ -153,8 +153,8 @@
 			identified through its new major/minor numbers encoded
 			in devnum.
 
-noload			Don't load the journal on mounting.  Note that
-                     	if the filesystem was not unmounted cleanly,
+norecovery		Don't load the journal on mounting.  Note that
+noload			if the filesystem was not unmounted cleanly,
                      	skipping the journal replay will lead to the
                      	filesystem containing inconsistencies that can
                      	lead to any number of problems.
@@ -338,6 +338,12 @@
 			system crashes before the delayed allocation
 			blocks are forced to disk.
 
+discard		Controls whether ext4 should issue discard/TRIM
+nodiscard(*)		commands to the underlying block device when
+			blocks are freed.  This is useful for SSD devices
+			and sparse/thinly-provisioned LUNs, but it is off
+			by default until sufficient testing has been done.
+
 Data Mode
 =========
 There are 3 different data modes:
--- linux-rt-2.6.31.orig/scripts/kallsyms.c
+++ linux-rt-2.6.31/scripts/kallsyms.c
@@ -585,7 +585,7 @@
 {
 	const char *tail = str;
 
-	while (*tail != '_')
+	while (*tail == '_')
 		tail++;
 
 	return tail - str;
--- linux-rt-2.6.31.orig/scripts/Kbuild.include
+++ linux-rt-2.6.31/scripts/Kbuild.include
@@ -105,12 +105,12 @@
 # Usage: cflags-y += $(call cc-option,-march=winchip-c6,-march=i586)
 
 cc-option = $(call try-run,\
-	$(CC) $(KBUILD_CFLAGS) $(1) -c -xc /dev/null -o "$$TMP",$(1),$(2))
+	$(CC) $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS) $(1) -c -xc /dev/null -o "$$TMP",$(1),$(2))
 
 # cc-option-yn
 # Usage: flag := $(call cc-option-yn,-march=winchip-c6)
 cc-option-yn = $(call try-run,\
-	$(CC) $(KBUILD_CFLAGS) $(1) -c -xc /dev/null -o "$$TMP",y,n)
+	$(CC) $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS) $(1) -c -xc /dev/null -o "$$TMP",y,n)
 
 # cc-option-align
 # Prefix align with either -falign or -malign
--- linux-rt-2.6.31.orig/scripts/Makefile.build
+++ linux-rt-2.6.31/scripts/Makefile.build
@@ -269,7 +269,8 @@
 # Linker scripts preprocessor (.lds.S -> .lds)
 # ---------------------------------------------------------------------------
 quiet_cmd_cpp_lds_S = LDS     $@
-      cmd_cpp_lds_S = $(CPP) $(cpp_flags) -D__ASSEMBLY__ -o $@ $<
+      cmd_cpp_lds_S = $(CPP) $(cpp_flags) -P -C -U$(ARCH) \
+	                     -D__ASSEMBLY__ -o $@ $<
 
 $(obj)/%.lds: $(src)/%.lds.S FORCE
 	$(call if_changed_dep,cpp_lds_S)
--- linux-rt-2.6.31.orig/fs/open.c
+++ linux-rt-2.6.31/fs/open.c
@@ -31,6 +31,9 @@
 #include <linux/falloc.h>
 #include <linux/fs_struct.h>
 
+#define CREATE_TRACE_POINTS
+#include <trace/events/fs.h>
+
 int vfs_statfs(struct dentry *dentry, struct kstatfs *buf)
 {
 	int retval = -ENODEV;
@@ -221,6 +224,7 @@
 	mutex_unlock(&dentry->d_inode->i_mutex);
 	return err;
 }
+EXPORT_SYMBOL(do_truncate);
 
 static long do_sys_truncate(const char __user *pathname, loff_t length)
 {
@@ -1040,6 +1044,7 @@
 			} else {
 				fsnotify_open(f->f_path.dentry);
 				fd_install(fd, f);
+				trace_do_sys_open(tmp, flags, mode);
 			}
 		}
 		putname(tmp);
--- linux-rt-2.6.31.orig/fs/exec.c
+++ linux-rt-2.6.31/fs/exec.c
@@ -56,6 +56,8 @@
 #include <linux/fsnotify.h>
 #include <linux/fs_struct.h>
 
+#include <trace/events/fs.h>
+
 #include <asm/uaccess.h>
 #include <asm/mmu_context.h>
 #include <asm/tlb.h>
@@ -665,6 +667,8 @@
 
 	fsnotify_open(file->f_path.dentry);
 
+	trace_open_exec(name);
+
 	err = deny_write_access(file);
 	if (err)
 		goto exit;
@@ -928,9 +932,7 @@
 
 int flush_old_exec(struct linux_binprm * bprm)
 {
-	char * name;
-	int i, ch, retval;
-	char tcomm[sizeof(current->comm)];
+	int retval;
 
 	/*
 	 * Make sure we have a private signal table and that
@@ -951,6 +953,25 @@
 
 	bprm->mm = NULL;		/* We're using it now */
 
+	current->flags &= ~PF_RANDOMIZE;
+	flush_thread();
+	current->personality &= ~bprm->per_clear;
+
+	return 0;
+
+out:
+	return retval;
+}
+EXPORT_SYMBOL(flush_old_exec);
+
+void setup_new_exec(struct linux_binprm * bprm)
+{
+	int i, ch;
+	char * name;
+	char tcomm[sizeof(current->comm)];
+
+	arch_pick_mmap_layout(current->mm);
+
 	/* This is the point of no return */
 	current->sas_ss_sp = current->sas_ss_size = 0;
 
@@ -972,9 +993,6 @@
 	tcomm[i] = '\0';
 	set_task_comm(current, tcomm);
 
-	current->flags &= ~PF_RANDOMIZE;
-	flush_thread();
-
 	/* Set the new mm task size. We have to do that late because it may
 	 * depend on TIF_32BIT which is only updated in flush_thread() on
 	 * some architectures like powerpc
@@ -990,8 +1008,6 @@
 		set_dumpable(current->mm, suid_dumpable);
 	}
 
-	current->personality &= ~bprm->per_clear;
-
 	/*
 	 * Flush performance counters when crossing a
 	 * security domain:
@@ -1006,14 +1022,8 @@
 			
 	flush_signal_handlers(current, 0);
 	flush_old_files(current->files);
-
-	return 0;
-
-out:
-	return retval;
 }
-
-EXPORT_SYMBOL(flush_old_exec);
+EXPORT_SYMBOL(setup_new_exec);
 
 /*
  * Prepare credentials and lock ->cred_guard_mutex.
--- linux-rt-2.6.31.orig/fs/compat_ioctl.c
+++ linux-rt-2.6.31/fs/compat_ioctl.c
@@ -1800,7 +1800,7 @@
 /* just account for different alignment */
 static int compat_ioctl_preallocate(struct file *file, unsigned long arg)
 {
-	struct space_resv_32	__user *p32 = (void __user *)arg;
+	struct space_resv_32	__user *p32 = compat_ptr(arg);
 	struct space_resv	__user *p = compat_alloc_user_space(sizeof(*p));
 
 	if (copy_in_user(&p->l_type,	&p32->l_type,	sizeof(s16)) ||
@@ -2802,7 +2802,7 @@
 #else
 	case FS_IOC_RESVSP:
 	case FS_IOC_RESVSP64:
-		error = ioctl_preallocate(filp, (void __user *)arg);
+		error = ioctl_preallocate(filp, compat_ptr(arg));
 		goto out_fput;
 #endif
 
--- linux-rt-2.6.31.orig/fs/stat.c
+++ linux-rt-2.6.31/fs/stat.c
@@ -401,9 +401,9 @@
 }
 #endif /* __ARCH_WANT_STAT64 */
 
-void inode_add_bytes(struct inode *inode, loff_t bytes)
+/* Caller is here responsible for sufficient locking (ie. inode->i_lock) */
+void __inode_add_bytes(struct inode *inode, loff_t bytes)
 {
-	spin_lock(&inode->i_lock);
 	inode->i_blocks += bytes >> 9;
 	bytes &= 511;
 	inode->i_bytes += bytes;
@@ -411,6 +411,12 @@
 		inode->i_blocks++;
 		inode->i_bytes -= 512;
 	}
+}
+
+void inode_add_bytes(struct inode *inode, loff_t bytes)
+{
+	spin_lock(&inode->i_lock);
+	__inode_add_bytes(inode, bytes);
 	spin_unlock(&inode->i_lock);
 }
 
--- linux-rt-2.6.31.orig/fs/binfmt_elf_fdpic.c
+++ linux-rt-2.6.31/fs/binfmt_elf_fdpic.c
@@ -313,6 +313,9 @@
 	 * defunct, deceased, etc. after this point we have to exit via
 	 * error_kill */
 	set_personality(PER_LINUX_FDPIC);
+
+	setup_new_exec(bprm);
+
 	set_binfmt(&elf_fdpic_format);
 
 	current->mm->start_code = 0;
--- linux-rt-2.6.31.orig/fs/binfmt_som.c
+++ linux-rt-2.6.31/fs/binfmt_som.c
@@ -227,6 +227,7 @@
 	/* OK, This is the point of no return */
 	current->flags &= ~PF_FORKNOEXEC;
 	current->personality = PER_HPUX;
+	setup_new_exec(bprm);
 
 	/* Set the task size for HP-UX processes such that
 	 * the gateway page is outside the address space.
--- linux-rt-2.6.31.orig/fs/fcntl.c
+++ linux-rt-2.6.31/fs/fcntl.c
@@ -199,7 +199,9 @@
 static void f_modown(struct file *filp, struct pid *pid, enum pid_type type,
                      int force)
 {
-	write_lock_irq(&filp->f_owner.lock);
+	unsigned long flags;
+
+	write_lock_irqsave(&filp->f_owner.lock, flags);
 	if (force || !filp->f_owner.pid) {
 		put_pid(filp->f_owner.pid);
 		filp->f_owner.pid = get_pid(pid);
@@ -211,7 +213,7 @@
 			filp->f_owner.euid = cred->euid;
 		}
 	}
-	write_unlock_irq(&filp->f_owner.lock);
+	write_unlock_irqrestore(&filp->f_owner.lock, flags);
 }
 
 int __f_setown(struct file *filp, struct pid *pid, enum pid_type type,
@@ -526,60 +528,90 @@
 static struct kmem_cache *fasync_cache __read_mostly;
 
 /*
- * fasync_helper() is used by almost all character device drivers
- * to set up the fasync queue. It returns negative on error, 0 if it did
- * no changes and positive if it added/deleted the entry.
+ * Remove a fasync entry. If successfully removed, return
+ * positive and clear the FASYNC flag. If no entry exists,
+ * do nothing and return 0.
+ *
+ * NOTE! It is very important that the FASYNC flag always
+ * match the state "is the filp on a fasync list".
+ *
+ * We always take the 'filp->f_lock', in since fasync_lock
+ * needs to be irq-safe.
  */
-int fasync_helper(int fd, struct file * filp, int on, struct fasync_struct **fapp)
+static int fasync_remove_entry(struct file *filp, struct fasync_struct **fapp)
 {
 	struct fasync_struct *fa, **fp;
-	struct fasync_struct *new = NULL;
 	int result = 0;
 
-	if (on) {
-		new = kmem_cache_alloc(fasync_cache, GFP_KERNEL);
-		if (!new)
-			return -ENOMEM;
+	spin_lock(&filp->f_lock);
+	write_lock_irq(&fasync_lock);
+	for (fp = fapp; (fa = *fp) != NULL; fp = &fa->fa_next) {
+		if (fa->fa_file != filp)
+			continue;
+		*fp = fa->fa_next;
+		kmem_cache_free(fasync_cache, fa);
+		filp->f_flags &= ~FASYNC;
+		result = 1;
+		break;
 	}
+	write_unlock_irq(&fasync_lock);
+	spin_unlock(&filp->f_lock);
+	return result;
+}
+
+/*
+ * Add a fasync entry. Return negative on error, positive if
+ * added, and zero if did nothing but change an existing one.
+ *
+ * NOTE! It is very important that the FASYNC flag always
+ * match the state "is the filp on a fasync list".
+ */
+static int fasync_add_entry(int fd, struct file *filp, struct fasync_struct **fapp)
+{
+	struct fasync_struct *new, *fa, **fp;
+	int result = 0;
+
+	new = kmem_cache_alloc(fasync_cache, GFP_KERNEL);
+	if (!new)
+		return -ENOMEM;
 
-	/*
-	 * We need to take f_lock first since it's not an IRQ-safe
-	 * lock.
-	 */
 	spin_lock(&filp->f_lock);
 	write_lock_irq(&fasync_lock);
 	for (fp = fapp; (fa = *fp) != NULL; fp = &fa->fa_next) {
-		if (fa->fa_file == filp) {
-			if(on) {
-				fa->fa_fd = fd;
-				kmem_cache_free(fasync_cache, new);
-			} else {
-				*fp = fa->fa_next;
-				kmem_cache_free(fasync_cache, fa);
-				result = 1;
-			}
-			goto out;
-		}
+		if (fa->fa_file != filp)
+			continue;
+		fa->fa_fd = fd;
+		kmem_cache_free(fasync_cache, new);
+		goto out;
 	}
 
-	if (on) {
-		new->magic = FASYNC_MAGIC;
-		new->fa_file = filp;
-		new->fa_fd = fd;
-		new->fa_next = *fapp;
-		*fapp = new;
-		result = 1;
-	}
+	new->magic = FASYNC_MAGIC;
+	new->fa_file = filp;
+	new->fa_fd = fd;
+	new->fa_next = *fapp;
+	*fapp = new;
+	result = 1;
+	filp->f_flags |= FASYNC;
+
 out:
-	if (on)
-		filp->f_flags |= FASYNC;
-	else
-		filp->f_flags &= ~FASYNC;
 	write_unlock_irq(&fasync_lock);
 	spin_unlock(&filp->f_lock);
 	return result;
 }
 
+/*
+ * fasync_helper() is used by almost all character device drivers
+ * to set up the fasync queue, and for regular files by the file
+ * lease code. It returns negative on error, 0 if it did no changes
+ * and positive if it added/deleted the entry.
+ */
+int fasync_helper(int fd, struct file * filp, int on, struct fasync_struct **fapp)
+{
+	if (!on)
+		return fasync_remove_entry(filp, fapp);
+	return fasync_add_entry(fd, filp, fapp);
+}
+
 EXPORT_SYMBOL(fasync_helper);
 
 void __kill_fasync(struct fasync_struct *fa, int sig, int band)
--- linux-rt-2.6.31.orig/fs/binfmt_elf.c
+++ linux-rt-2.6.31/fs/binfmt_elf.c
@@ -501,22 +501,22 @@
 		}
 	}
 
-	/*
-	 * Now fill out the bss section.  First pad the last page up
-	 * to the page boundary, and then perform a mmap to make sure
-	 * that there are zero-mapped pages up to and including the 
-	 * last bss page.
-	 */
-	if (padzero(elf_bss)) {
-		error = -EFAULT;
-		goto out_close;
-	}
+	if (last_bss > elf_bss) {
+		/*
+		 * Now fill out the bss section.  First pad the last page up
+		 * to the page boundary, and then perform a mmap to make sure
+		 * that there are zero-mapped pages up to and including the
+		 * last bss page.
+		 */
+		if (padzero(elf_bss)) {
+			error = -EFAULT;
+			goto out_close;
+		}
 
-	/* What we have mapped so far */
-	elf_bss = ELF_PAGESTART(elf_bss + ELF_MIN_ALIGN - 1);
+		/* What we have mapped so far */
+		elf_bss = ELF_PAGESTART(elf_bss + ELF_MIN_ALIGN - 1);
 
-	/* Map the last of the bss segment */
-	if (last_bss > elf_bss) {
+		/* Map the last of the bss segment */
 		down_write(&current->mm->mmap_sem);
 		error = do_brk(elf_bss, last_bss - elf_bss);
 		up_write(&current->mm->mmap_sem);
@@ -662,27 +662,6 @@
 			if (elf_interpreter[elf_ppnt->p_filesz - 1] != '\0')
 				goto out_free_interp;
 
-			/*
-			 * The early SET_PERSONALITY here is so that the lookup
-			 * for the interpreter happens in the namespace of the 
-			 * to-be-execed image.  SET_PERSONALITY can select an
-			 * alternate root.
-			 *
-			 * However, SET_PERSONALITY is NOT allowed to switch
-			 * this task into the new images's memory mapping
-			 * policy - that is, TASK_SIZE must still evaluate to
-			 * that which is appropriate to the execing application.
-			 * This is because exit_mmap() needs to have TASK_SIZE
-			 * evaluate to the size of the old image.
-			 *
-			 * So if (say) a 64-bit application is execing a 32-bit
-			 * application it is the architecture's responsibility
-			 * to defer changing the value of TASK_SIZE until the
-			 * switch really is going to happen - do this in
-			 * flush_thread().	- akpm
-			 */
-			SET_PERSONALITY(loc->elf_ex);
-
 			interpreter = open_exec(elf_interpreter);
 			retval = PTR_ERR(interpreter);
 			if (IS_ERR(interpreter))
@@ -730,9 +709,6 @@
 		/* Verify the interpreter has a valid arch */
 		if (!elf_check_arch(&loc->interp_elf_ex))
 			goto out_free_dentry;
-	} else {
-		/* Executables without an interpreter also need a personality  */
-		SET_PERSONALITY(loc->elf_ex);
 	}
 
 	/* Flush all traces of the currently running executable */
@@ -740,6 +716,14 @@
 	if (retval)
 		goto out_free_dentry;
 
+#ifdef CONFIG_X86_32
+	/*
+	 * Turn off the CS limit completely if NX active:
+	 */
+	if (executable_stack != EXSTACK_DISABLE_X || nx_enabled)
+		arch_add_exec_range(current->mm, -1);
+#endif
+
 	/* OK, This is the point of no return */
 	current->flags &= ~PF_FORKNOEXEC;
 	current->mm->def_flags = def_flags;
@@ -752,7 +736,8 @@
 
 	if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
 		current->flags |= PF_RANDOMIZE;
-	arch_pick_mmap_layout(current->mm);
+
+	setup_new_exec(bprm);
 
 	/* Do this so that we can load the interpreter, if need be.  We will
 	   change some of these later */
--- linux-rt-2.6.31.orig/fs/namei.c
+++ linux-rt-2.6.31/fs/namei.c
@@ -221,6 +221,7 @@
 	/*
 	 * Searching includes executable on directories, else just read.
 	 */
+	mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
 	if (mask == MAY_READ || (S_ISDIR(inode->i_mode) && !(mask & MAY_WRITE)))
 		if (capable(CAP_DAC_READ_SEARCH))
 			return 0;
@@ -337,6 +338,7 @@
 
 	return 0;
 }
+EXPORT_SYMBOL(deny_write_access);
 
 /**
  * path_get - get a reference to a path
@@ -1219,7 +1221,7 @@
  * needs parent already locked. Doesn't follow mounts.
  * SMP-safe.
  */
-static struct dentry *lookup_hash(struct nameidata *nd)
+struct dentry *lookup_hash(struct nameidata *nd)
 {
 	int err;
 
@@ -1228,8 +1230,9 @@
 		return ERR_PTR(err);
 	return __lookup_hash(&nd->last, nd->path.dentry, nd);
 }
+EXPORT_SYMBOL(lookup_hash);
 
-static int __lookup_one_len(const char *name, struct qstr *this,
+int __lookup_one_len(const char *name, struct qstr *this,
 		struct dentry *base, int len)
 {
 	unsigned long hash;
@@ -1250,6 +1253,7 @@
 	this->hash = end_name_hash(hash);
 	return 0;
 }
+EXPORT_SYMBOL(__lookup_one_len);
 
 /**
  * lookup_one_len - filesystem helper to lookup single pathname component
@@ -1533,9 +1537,11 @@
 	if (error)
 		return error;
 
-	error = ima_path_check(path,
-			       acc_mode & (MAY_READ | MAY_WRITE | MAY_EXEC),
+	error = ima_path_check(path, acc_mode ?
+			       acc_mode & (MAY_READ | MAY_WRITE | MAY_EXEC) :
+			       ACC_MODE(flag) & (MAY_READ | MAY_WRITE),
 			       IMA_COUNT_UPDATE);
+
 	if (error)
 		return error;
 	/*
--- linux-rt-2.6.31.orig/fs/block_dev.c
+++ linux-rt-2.6.31/fs/block_dev.c
@@ -1243,8 +1243,8 @@
 			bd_set_size(bdev, (loff_t)bdev->bd_part->nr_sects << 9);
 		}
 	} else {
-		put_disk(disk);
 		module_put(disk->fops->owner);
+		put_disk(disk);
 		disk = NULL;
 		if (bdev->bd_contains == bdev) {
 			if (bdev->bd_disk->fops->open) {
--- linux-rt-2.6.31.orig/fs/binfmt_flat.c
+++ linux-rt-2.6.31/fs/binfmt_flat.c
@@ -521,6 +521,7 @@
 
 		/* OK, This is the point of no return */
 		set_personality(PER_LINUX_32BIT);
+		setup_new_exec(bprm);
 	}
 
 	/*
--- linux-rt-2.6.31.orig/fs/pipe.c
+++ linux-rt-2.6.31/fs/pipe.c
@@ -777,36 +777,55 @@
 static int
 pipe_read_open(struct inode *inode, struct file *filp)
 {
-	/* We could have perhaps used atomic_t, but this and friends
-	   below are the only places.  So it doesn't seem worthwhile.  */
+	int ret = -ENOENT;
+
 	mutex_lock(&inode->i_mutex);
-	inode->i_pipe->readers++;
+
+	if (inode->i_pipe) {
+		ret = 0;
+		inode->i_pipe->readers++;
+	}
+
 	mutex_unlock(&inode->i_mutex);
 
-	return 0;
+	return ret;
 }
 
 static int
 pipe_write_open(struct inode *inode, struct file *filp)
 {
+	int ret = -ENOENT;
+
 	mutex_lock(&inode->i_mutex);
-	inode->i_pipe->writers++;
+
+	if (inode->i_pipe) {
+		ret = 0;
+		inode->i_pipe->writers++;
+	}
+
 	mutex_unlock(&inode->i_mutex);
 
-	return 0;
+	return ret;
 }
 
 static int
 pipe_rdwr_open(struct inode *inode, struct file *filp)
 {
+	int ret = -ENOENT;
+
 	mutex_lock(&inode->i_mutex);
-	if (filp->f_mode & FMODE_READ)
-		inode->i_pipe->readers++;
-	if (filp->f_mode & FMODE_WRITE)
-		inode->i_pipe->writers++;
+
+	if (inode->i_pipe) {
+		ret = 0;
+		if (filp->f_mode & FMODE_READ)
+			inode->i_pipe->readers++;
+		if (filp->f_mode & FMODE_WRITE)
+			inode->i_pipe->writers++;
+	}
+
 	mutex_unlock(&inode->i_mutex);
 
-	return 0;
+	return ret;
 }
 
 /*
--- linux-rt-2.6.31.orig/fs/inode.c
+++ linux-rt-2.6.31/fs/inode.c
@@ -697,13 +697,15 @@
 	}
 #endif
 	/*
-	 * This is special!  We do not need the spinlock
-	 * when clearing I_LOCK, because we're guaranteed
-	 * that nobody else tries to do anything about the
-	 * state of the inode when it is locked, as we
-	 * just created it (so there can be no old holders
-	 * that haven't tested I_LOCK).
+	 * This is special!  We do not need the spinlock when clearing I_LOCK,
+	 * because we're guaranteed that nobody else tries to do anything about
+	 * the state of the inode when it is locked, as we just created it (so
+	 * there can be no old holders that haven't tested I_LOCK).
+	 * However we must emit the memory barrier so that other CPUs reliably
+	 * see the clearing of I_LOCK after the other inode initialisation has
+	 * completed.
 	 */
+	smp_mb();
 	WARN_ON((inode->i_state & (I_LOCK|I_NEW)) != (I_LOCK|I_NEW));
 	inode->i_state &= ~(I_LOCK|I_NEW);
 	wake_up_inode(inode);
--- linux-rt-2.6.31.orig/fs/namespace.c
+++ linux-rt-2.6.31/fs/namespace.c
@@ -39,6 +39,7 @@
 
 /* spinlock for vfsmount related operations, inplace of dcache_lock */
 __cacheline_aligned_in_smp DEFINE_SPINLOCK(vfsmount_lock);
+EXPORT_SYMBOL(vfsmount_lock);
 
 static int event;
 static DEFINE_IDA(mnt_id_ida);
--- linux-rt-2.6.31.orig/fs/splice.c
+++ linux-rt-2.6.31/fs/splice.c
@@ -1057,8 +1057,8 @@
 /*
  * Attempt to initiate a splice from pipe to file.
  */
-static long do_splice_from(struct pipe_inode_info *pipe, struct file *out,
-			   loff_t *ppos, size_t len, unsigned int flags)
+long do_splice_from(struct pipe_inode_info *pipe, struct file *out,
+		    loff_t *ppos, size_t len, unsigned int flags)
 {
 	ssize_t (*splice_write)(struct pipe_inode_info *, struct file *,
 				loff_t *, size_t, unsigned int);
@@ -1080,13 +1080,14 @@
 
 	return splice_write(pipe, out, ppos, len, flags);
 }
+EXPORT_SYMBOL(do_splice_from);
 
 /*
  * Attempt to initiate a splice from a file to a pipe.
  */
-static long do_splice_to(struct file *in, loff_t *ppos,
-			 struct pipe_inode_info *pipe, size_t len,
-			 unsigned int flags)
+long do_splice_to(struct file *in, loff_t *ppos,
+		  struct pipe_inode_info *pipe, size_t len,
+		  unsigned int flags)
 {
 	ssize_t (*splice_read)(struct file *, loff_t *,
 			       struct pipe_inode_info *, size_t, unsigned int);
@@ -1105,6 +1106,7 @@
 
 	return splice_read(in, ppos, pipe, len, flags);
 }
+EXPORT_SYMBOL(do_splice_to);
 
 /**
  * splice_direct_to_actor - splices data directly between two non-pipes
--- linux-rt-2.6.31.orig/fs/binfmt_aout.c
+++ linux-rt-2.6.31/fs/binfmt_aout.c
@@ -263,6 +263,7 @@
 #else
 	set_personality(PER_LINUX);
 #endif
+	setup_new_exec(bprm);
 
 	current->mm->end_code = ex.a_text +
 		(current->mm->start_code = N_TXTADDR(ex));
--- linux-rt-2.6.31.orig/fs/xfs/xfs_log_recover.c
+++ linux-rt-2.6.31/fs/xfs/xfs_log_recover.c
@@ -1980,7 +1980,7 @@
 					"XFS: NULL dquot in %s.", __func__);
 				goto next;
 			}
-			if (item->ri_buf[i].i_len < sizeof(xfs_dqblk_t)) {
+			if (item->ri_buf[i].i_len < sizeof(xfs_disk_dquot_t)) {
 				cmn_err(CE_ALERT,
 					"XFS: dquot too small (%d) in %s.",
 					item->ri_buf[i].i_len, __func__);
@@ -2635,7 +2635,7 @@
 			"XFS: NULL dquot in %s.", __func__);
 		return XFS_ERROR(EIO);
 	}
-	if (item->ri_buf[1].i_len < sizeof(xfs_dqblk_t)) {
+	if (item->ri_buf[1].i_len < sizeof(xfs_disk_dquot_t)) {
 		cmn_err(CE_ALERT,
 			"XFS: dquot too small (%d) in %s.",
 			item->ri_buf[1].i_len, __func__);
--- linux-rt-2.6.31.orig/fs/quota/dquot.c
+++ linux-rt-2.6.31/fs/quota/dquot.c
@@ -1388,6 +1388,70 @@
 EXPORT_SYMBOL(vfs_dq_drop);
 
 /*
+ * inode_reserved_space is managed internally by quota, and protected by
+ * i_lock similar to i_blocks+i_bytes.
+ */
+static qsize_t *inode_reserved_space(struct inode * inode)
+{
+	/* Filesystem must explicitly define it's own method in order to use
+	 * quota reservation interface */
+	BUG_ON(!inode->i_sb->dq_op->get_reserved_space);
+	return inode->i_sb->dq_op->get_reserved_space(inode);
+}
+
+static void inode_add_rsv_space(struct inode *inode, qsize_t number)
+{
+	spin_lock(&inode->i_lock);
+	*inode_reserved_space(inode) += number;
+	spin_unlock(&inode->i_lock);
+}
+
+
+static void inode_claim_rsv_space(struct inode *inode, qsize_t number)
+{
+	spin_lock(&inode->i_lock);
+	*inode_reserved_space(inode) -= number;
+	__inode_add_bytes(inode, number);
+	spin_unlock(&inode->i_lock);
+}
+
+static void inode_sub_rsv_space(struct inode *inode, qsize_t number)
+{
+	spin_lock(&inode->i_lock);
+	*inode_reserved_space(inode) -= number;
+	spin_unlock(&inode->i_lock);
+}
+
+static qsize_t inode_get_rsv_space(struct inode *inode)
+{
+	qsize_t ret;
+
+	if (!inode->i_sb->dq_op->get_reserved_space)
+		return 0;
+	spin_lock(&inode->i_lock);
+	ret = *inode_reserved_space(inode);
+	spin_unlock(&inode->i_lock);
+	return ret;
+}
+
+static void inode_incr_space(struct inode *inode, qsize_t number,
+				int reserve)
+{
+	if (reserve)
+		inode_add_rsv_space(inode, number);
+	else
+		inode_add_bytes(inode, number);
+}
+
+static void inode_decr_space(struct inode *inode, qsize_t number, int reserve)
+{
+	if (reserve)
+		inode_sub_rsv_space(inode, number);
+	else
+		inode_sub_bytes(inode, number);
+}
+
+/*
  * Following four functions update i_blocks+i_bytes fields and
  * quota information (together with appropriate checks)
  * NOTE: We absolutely rely on the fact that caller dirties
@@ -1405,6 +1469,21 @@
 	int cnt, ret = QUOTA_OK;
 	char warntype[MAXQUOTAS];
 
+	/*
+	 * First test before acquiring mutex - solves deadlocks when we
+	 * re-enter the quota code and are already holding the mutex
+	 */
+	if (IS_NOQUOTA(inode)) {
+		inode_incr_space(inode, number, reserve);
+		goto out;
+	}
+
+	down_read(&sb_dqopt(inode->i_sb)->dqptr_sem);
+	if (IS_NOQUOTA(inode)) {
+		inode_incr_space(inode, number, reserve);
+		goto out_unlock;
+	}
+
 	for (cnt = 0; cnt < MAXQUOTAS; cnt++)
 		warntype[cnt] = QUOTA_NL_NOWARN;
 
@@ -1415,7 +1494,8 @@
 		if (check_bdq(inode->i_dquot[cnt], number, warn, warntype+cnt)
 		    == NO_QUOTA) {
 			ret = NO_QUOTA;
-			goto out_unlock;
+			spin_unlock(&dq_data_lock);
+			goto out_flush_warn;
 		}
 	}
 	for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
@@ -1426,64 +1506,32 @@
 		else
 			dquot_incr_space(inode->i_dquot[cnt], number);
 	}
-	if (!reserve)
-		inode_add_bytes(inode, number);
-out_unlock:
+	inode_incr_space(inode, number, reserve);
 	spin_unlock(&dq_data_lock);
-	flush_warnings(inode->i_dquot, warntype);
-	return ret;
-}
-
-int dquot_alloc_space(struct inode *inode, qsize_t number, int warn)
-{
-	int cnt, ret = QUOTA_OK;
-
-	/*
-	 * First test before acquiring mutex - solves deadlocks when we
-	 * re-enter the quota code and are already holding the mutex
-	 */
-	if (IS_NOQUOTA(inode)) {
-		inode_add_bytes(inode, number);
-		goto out;
-	}
-
-	down_read(&sb_dqopt(inode->i_sb)->dqptr_sem);
-	if (IS_NOQUOTA(inode)) {
-		inode_add_bytes(inode, number);
-		goto out_unlock;
-	}
-
-	ret = __dquot_alloc_space(inode, number, warn, 0);
-	if (ret == NO_QUOTA)
-		goto out_unlock;
 
+	if (reserve)
+		goto out_flush_warn;
 	/* Dirtify all the dquots - this can block when journalling */
 	for (cnt = 0; cnt < MAXQUOTAS; cnt++)
 		if (inode->i_dquot[cnt])
 			mark_dquot_dirty(inode->i_dquot[cnt]);
+out_flush_warn:
+	flush_warnings(inode->i_dquot, warntype);
 out_unlock:
 	up_read(&sb_dqopt(inode->i_sb)->dqptr_sem);
 out:
 	return ret;
 }
+
+int dquot_alloc_space(struct inode *inode, qsize_t number, int warn)
+{
+	return __dquot_alloc_space(inode, number, warn, 0);
+}
 EXPORT_SYMBOL(dquot_alloc_space);
 
 int dquot_reserve_space(struct inode *inode, qsize_t number, int warn)
 {
-	int ret = QUOTA_OK;
-
-	if (IS_NOQUOTA(inode))
-		goto out;
-
-	down_read(&sb_dqopt(inode->i_sb)->dqptr_sem);
-	if (IS_NOQUOTA(inode))
-		goto out_unlock;
-
-	ret = __dquot_alloc_space(inode, number, warn, 1);
-out_unlock:
-	up_read(&sb_dqopt(inode->i_sb)->dqptr_sem);
-out:
-	return ret;
+	return __dquot_alloc_space(inode, number, warn, 1);
 }
 EXPORT_SYMBOL(dquot_reserve_space);
 
@@ -1540,14 +1588,14 @@
 	int ret = QUOTA_OK;
 
 	if (IS_NOQUOTA(inode)) {
-		inode_add_bytes(inode, number);
+		inode_claim_rsv_space(inode, number);
 		goto out;
 	}
 
 	down_read(&sb_dqopt(inode->i_sb)->dqptr_sem);
 	if (IS_NOQUOTA(inode))	{
 		up_read(&sb_dqopt(inode->i_sb)->dqptr_sem);
-		inode_add_bytes(inode, number);
+		inode_claim_rsv_space(inode, number);
 		goto out;
 	}
 
@@ -1559,7 +1607,7 @@
 							number);
 	}
 	/* Update inode bytes */
-	inode_add_bytes(inode, number);
+	inode_claim_rsv_space(inode, number);
 	spin_unlock(&dq_data_lock);
 	/* Dirtify all the dquots - this can block when journalling */
 	for (cnt = 0; cnt < MAXQUOTAS; cnt++)
@@ -1572,38 +1620,9 @@
 EXPORT_SYMBOL(dquot_claim_space);
 
 /*
- * Release reserved quota space
- */
-void dquot_release_reserved_space(struct inode *inode, qsize_t number)
-{
-	int cnt;
-
-	if (IS_NOQUOTA(inode))
-		goto out;
-
-	down_read(&sb_dqopt(inode->i_sb)->dqptr_sem);
-	if (IS_NOQUOTA(inode))
-		goto out_unlock;
-
-	spin_lock(&dq_data_lock);
-	/* Release reserved dquots */
-	for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
-		if (inode->i_dquot[cnt])
-			dquot_free_reserved_space(inode->i_dquot[cnt], number);
-	}
-	spin_unlock(&dq_data_lock);
-
-out_unlock:
-	up_read(&sb_dqopt(inode->i_sb)->dqptr_sem);
-out:
-	return;
-}
-EXPORT_SYMBOL(dquot_release_reserved_space);
-
-/*
  * This operation can block, but only after everything is updated
  */
-int dquot_free_space(struct inode *inode, qsize_t number)
+int __dquot_free_space(struct inode *inode, qsize_t number, int reserve)
 {
 	unsigned int cnt;
 	char warntype[MAXQUOTAS];
@@ -1612,7 +1631,7 @@
          * re-enter the quota code and are already holding the mutex */
 	if (IS_NOQUOTA(inode)) {
 out_sub:
-		inode_sub_bytes(inode, number);
+		inode_decr_space(inode, number, reserve);
 		return QUOTA_OK;
 	}
 
@@ -1627,21 +1646,43 @@
 		if (!inode->i_dquot[cnt])
 			continue;
 		warntype[cnt] = info_bdq_free(inode->i_dquot[cnt], number);
-		dquot_decr_space(inode->i_dquot[cnt], number);
+		if (reserve)
+			dquot_free_reserved_space(inode->i_dquot[cnt], number);
+		else
+			dquot_decr_space(inode->i_dquot[cnt], number);
 	}
-	inode_sub_bytes(inode, number);
+	inode_decr_space(inode, number, reserve);
 	spin_unlock(&dq_data_lock);
+
+	if (reserve)
+		goto out_unlock;
 	/* Dirtify all the dquots - this can block when journalling */
 	for (cnt = 0; cnt < MAXQUOTAS; cnt++)
 		if (inode->i_dquot[cnt])
 			mark_dquot_dirty(inode->i_dquot[cnt]);
+out_unlock:
 	flush_warnings(inode->i_dquot, warntype);
 	up_read(&sb_dqopt(inode->i_sb)->dqptr_sem);
 	return QUOTA_OK;
 }
+
+int dquot_free_space(struct inode *inode, qsize_t number)
+{
+	return  __dquot_free_space(inode, number, 0);
+}
 EXPORT_SYMBOL(dquot_free_space);
 
 /*
+ * Release reserved quota space
+ */
+void dquot_release_reserved_space(struct inode *inode, qsize_t number)
+{
+	__dquot_free_space(inode, number, 1);
+
+}
+EXPORT_SYMBOL(dquot_release_reserved_space);
+
+/*
  * This operation can block, but only after everything is updated
  */
 int dquot_free_inode(const struct inode *inode, qsize_t number)
@@ -1679,19 +1720,6 @@
 EXPORT_SYMBOL(dquot_free_inode);
 
 /*
- * call back function, get reserved quota space from underlying fs
- */
-qsize_t dquot_get_reserved_space(struct inode *inode)
-{
-	qsize_t reserved_space = 0;
-
-	if (sb_any_quota_active(inode->i_sb) &&
-	    inode->i_sb->dq_op->get_reserved_space)
-		reserved_space = inode->i_sb->dq_op->get_reserved_space(inode);
-	return reserved_space;
-}
-
-/*
  * Transfer the number of inode and blocks from one diskquota to an other.
  *
  * This operation can block, but only after everything is updated
@@ -1734,7 +1762,7 @@
 	}
 	spin_lock(&dq_data_lock);
 	cur_space = inode_get_bytes(inode);
-	rsv_space = dquot_get_reserved_space(inode);
+	rsv_space = inode_get_rsv_space(inode);
 	space = cur_space + rsv_space;
 	/* Build the transfer_from list and check the limits */
 	for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
--- linux-rt-2.6.31.orig/fs/hfsplus/wrapper.c
+++ linux-rt-2.6.31/fs/hfsplus/wrapper.c
@@ -99,6 +99,10 @@
 
 	if (hfsplus_get_last_session(sb, &part_start, &part_size))
 		return -EINVAL;
+	if ((u64)part_start + part_size > 0x100000000ULL) {
+		pr_err("hfs: volumes larger than 2TB are not supported yet\n");
+		return -EINVAL;
+	}
 	while (1) {
 		bh = sb_bread512(sb, part_start + HFSPLUS_VOLHEAD_SECTOR, vhdr);
 		if (!bh)
--- linux-rt-2.6.31.orig/fs/ext4/ext4_extents.h
+++ linux-rt-2.6.31/fs/ext4/ext4_extents.h
@@ -220,6 +220,11 @@
 		(le16_to_cpu(ext->ee_len) - EXT_INIT_MAX_LEN));
 }
 
+static inline void ext4_ext_mark_initialized(struct ext4_extent *ext)
+{
+	ext->ee_len = cpu_to_le16(ext4_ext_get_actual_len(ext));
+}
+
 extern int ext4_ext_calc_metadata_amount(struct inode *inode, int blocks);
 extern ext4_fsblk_t ext_pblock(struct ext4_extent *ex);
 extern ext4_fsblk_t idx_pblock(struct ext4_extent_idx *);
@@ -235,7 +240,7 @@
 				 struct ext4_ext_path *path,
 				 struct ext4_extent *);
 extern unsigned int ext4_ext_check_overlap(struct inode *, struct ext4_extent *, struct ext4_ext_path *);
-extern int ext4_ext_insert_extent(handle_t *, struct inode *, struct ext4_ext_path *, struct ext4_extent *);
+extern int ext4_ext_insert_extent(handle_t *, struct inode *, struct ext4_ext_path *, struct ext4_extent *, int);
 extern int ext4_ext_walk_space(struct inode *, ext4_lblk_t, ext4_lblk_t,
 							ext_prepare_callback, void *);
 extern struct ext4_ext_path *ext4_ext_find_extent(struct inode *, ext4_lblk_t,
--- linux-rt-2.6.31.orig/fs/ext4/migrate.c
+++ linux-rt-2.6.31/fs/ext4/migrate.c
@@ -75,7 +75,7 @@
 				goto err_out;
 		}
 	}
-	retval = ext4_ext_insert_extent(handle, inode, path, &newext);
+	retval = ext4_ext_insert_extent(handle, inode, path, &newext, 0);
 err_out:
 	if (path) {
 		ext4_ext_drop_refs(path);
@@ -238,7 +238,7 @@
 	 * So allocate a credit of 3. We may update
 	 * quota (user and group).
 	 */
-	needed = 3 + 2*EXT4_QUOTA_TRANS_BLOCKS(inode->i_sb);
+	needed = 3 + EXT4_MAXQUOTAS_TRANS_BLOCKS(inode->i_sb);
 
 	if (ext4_journal_extend(handle, needed) != 0)
 		retval = ext4_journal_restart(handle, needed);
@@ -353,17 +353,16 @@
 
 	down_write(&EXT4_I(inode)->i_data_sem);
 	/*
-	 * if EXT4_EXT_MIGRATE is cleared a block allocation
+	 * if EXT4_STATE_EXT_MIGRATE is cleared a block allocation
 	 * happened after we started the migrate. We need to
 	 * fail the migrate
 	 */
-	if (!(EXT4_I(inode)->i_flags & EXT4_EXT_MIGRATE)) {
+	if (!(EXT4_I(inode)->i_state & EXT4_STATE_EXT_MIGRATE)) {
 		retval = -EAGAIN;
 		up_write(&EXT4_I(inode)->i_data_sem);
 		goto err_out;
 	} else
-		EXT4_I(inode)->i_flags = EXT4_I(inode)->i_flags &
-							~EXT4_EXT_MIGRATE;
+		EXT4_I(inode)->i_state &= ~EXT4_STATE_EXT_MIGRATE;
 	/*
 	 * We have the extent map build with the tmp inode.
 	 * Now copy the i_data across
@@ -478,7 +477,7 @@
 	handle = ext4_journal_start(inode,
 					EXT4_DATA_TRANS_BLOCKS(inode->i_sb) +
 					EXT4_INDEX_EXTRA_TRANS_BLOCKS + 3 +
-					2 * EXT4_QUOTA_INIT_BLOCKS(inode->i_sb)
+					EXT4_MAXQUOTAS_INIT_BLOCKS(inode->i_sb)
 					+ 1);
 	if (IS_ERR(handle)) {
 		retval = PTR_ERR(handle);
@@ -517,14 +516,15 @@
 	 * when we add extents we extent the journal
 	 */
 	/*
-	 * Even though we take i_mutex we can still cause block allocation
-	 * via mmap write to holes. If we have allocated new blocks we fail
-	 * migrate.  New block allocation will clear EXT4_EXT_MIGRATE flag.
-	 * The flag is updated with i_data_sem held to prevent racing with
-	 * block allocation.
+	 * Even though we take i_mutex we can still cause block
+	 * allocation via mmap write to holes. If we have allocated
+	 * new blocks we fail migrate.  New block allocation will
+	 * clear EXT4_STATE_EXT_MIGRATE flag.  The flag is updated
+	 * with i_data_sem held to prevent racing with block
+	 * allocation.
 	 */
 	down_read((&EXT4_I(inode)->i_data_sem));
-	EXT4_I(inode)->i_flags = EXT4_I(inode)->i_flags | EXT4_EXT_MIGRATE;
+	EXT4_I(inode)->i_state |= EXT4_STATE_EXT_MIGRATE;
 	up_read((&EXT4_I(inode)->i_data_sem));
 
 	handle = ext4_journal_start(inode, 1);
@@ -618,7 +618,7 @@
 	tmp_inode->i_nlink = 0;
 
 	ext4_journal_stop(handle);
-
+	unlock_new_inode(tmp_inode);
 	iput(tmp_inode);
 
 	return retval;
--- linux-rt-2.6.31.orig/fs/ext4/balloc.c
+++ linux-rt-2.6.31/fs/ext4/balloc.c
@@ -761,7 +761,13 @@
 static unsigned long ext4_bg_num_gdb_nometa(struct super_block *sb,
 					ext4_group_t group)
 {
-	return ext4_bg_has_super(sb, group) ? EXT4_SB(sb)->s_gdb_count : 0;
+	if (!ext4_bg_has_super(sb, group))
+		return 0;
+
+	if (EXT4_HAS_INCOMPAT_FEATURE(sb,EXT4_FEATURE_INCOMPAT_META_BG))
+		return le32_to_cpu(EXT4_SB(sb)->s_es->s_first_meta_bg);
+	else
+		return EXT4_SB(sb)->s_gdb_count;
 }
 
 /**
--- linux-rt-2.6.31.orig/fs/ext4/ext4_jbd2.c
+++ linux-rt-2.6.31/fs/ext4/ext4_jbd2.c
@@ -44,7 +44,7 @@
 						  handle, err);
 	}
 	else
-		brelse(bh);
+		bforget(bh);
 	return err;
 }
 
@@ -60,7 +60,7 @@
 						  handle, err);
 	}
 	else
-		brelse(bh);
+		bforget(bh);
 	return err;
 }
 
@@ -89,7 +89,10 @@
 			ext4_journal_abort_handle(where, __func__, bh,
 						  handle, err);
 	} else {
-		mark_buffer_dirty(bh);
+		if (inode && bh)
+			mark_buffer_dirty_inode(bh, inode);
+		else
+			mark_buffer_dirty(bh);
 		if (inode && inode_needs_sync(inode)) {
 			sync_dirty_buffer(bh);
 			if (buffer_req(bh) && !buffer_uptodate(bh)) {
--- linux-rt-2.6.31.orig/fs/ext4/xattr.c
+++ linux-rt-2.6.31/fs/ext4/xattr.c
@@ -810,12 +810,23 @@
 			get_bh(new_bh);
 		} else {
 			/* We need to allocate a new block */
-			ext4_fsblk_t goal = ext4_group_first_block_no(sb,
+			ext4_fsblk_t goal, block;
+
+			goal = ext4_group_first_block_no(sb,
 						EXT4_I(inode)->i_block_group);
-			ext4_fsblk_t block = ext4_new_meta_blocks(handle, inode,
+
+			/* non-extent files can't have physical blocks past 2^32 */
+			if (!(EXT4_I(inode)->i_flags & EXT4_EXTENTS_FL))
+				goal = goal & EXT4_MAX_BLOCK_FILE_PHYS;
+
+			block = ext4_new_meta_blocks(handle, inode,
 						  goal, NULL, &error);
 			if (error)
 				goto cleanup;
+
+			if (!(EXT4_I(inode)->i_flags & EXT4_EXTENTS_FL))
+				BUG_ON(block > EXT4_MAX_BLOCK_FILE_PHYS);
+
 			ea_idebug(inode, "creating block %d", block);
 
 			new_bh = sb_getblk(sb, block);
@@ -977,6 +988,10 @@
 	if (error)
 		goto cleanup;
 
+	error = ext4_journal_get_write_access(handle, is.iloc.bh);
+	if (error)
+		goto cleanup;
+
 	if (EXT4_I(inode)->i_state & EXT4_STATE_NEW) {
 		struct ext4_inode *raw_inode = ext4_raw_inode(&is.iloc);
 		memset(raw_inode, 0, EXT4_SB(inode->i_sb)->s_inode_size);
@@ -1002,9 +1017,6 @@
 		if (flags & XATTR_CREATE)
 			goto cleanup;
 	}
-	error = ext4_journal_get_write_access(handle, is.iloc.bh);
-	if (error)
-		goto cleanup;
 	if (!value) {
 		if (!is.s.not_found)
 			error = ext4_xattr_ibody_set(handle, inode, &i, &is);
--- linux-rt-2.6.31.orig/fs/ext4/fsync.c
+++ linux-rt-2.6.31/fs/ext4/fsync.c
@@ -44,27 +44,37 @@
  *
  * What we do is just kick off a commit and wait on it.  This will snapshot the
  * inode to disk.
+ *
+ * i_mutex lock is held when entering and exiting this function
  */
 
 int ext4_sync_file(struct file *file, struct dentry *dentry, int datasync)
 {
 	struct inode *inode = dentry->d_inode;
+	struct ext4_inode_info *ei = EXT4_I(inode);
 	journal_t *journal = EXT4_SB(inode->i_sb)->s_journal;
-	int ret = 0;
+	int ret;
+	tid_t commit_tid;
 
 	J_ASSERT(ext4_journal_current_handle() == NULL);
 
 	trace_ext4_sync_file(file, dentry, datasync);
 
+	if (inode->i_sb->s_flags & MS_RDONLY)
+		return 0;
+
+	ret = flush_aio_dio_completed_IO(inode);
+	if (ret < 0)
+		return ret;
+
+	if (!journal)
+		return simple_fsync(file, dentry, datasync);
+
 	/*
-	 * data=writeback:
+	 * data=writeback,ordered:
 	 *  The caller's filemap_fdatawrite()/wait will sync the data.
-	 *  sync_inode() will sync the metadata
-	 *
-	 * data=ordered:
-	 *  The caller's filemap_fdatawrite() will write the data and
-	 *  sync_inode() will write the inode if it is dirty.  Then the caller's
-	 *  filemap_fdatawait() will wait on the pages.
+	 *  Metadata is in the journal, we wait for proper transaction to
+	 *  commit here.
 	 *
 	 * data=journal:
 	 *  filemap_fdatawrite won't do anything (the buffers are clean).
@@ -74,27 +84,13 @@
 	 *  (they were dirtied by commit).  But that's OK - the blocks are
 	 *  safe in-journal, which is all fsync() needs to ensure.
 	 */
-	if (ext4_should_journal_data(inode)) {
-		ret = ext4_force_commit(inode->i_sb);
-		goto out;
-	}
-
-	if (datasync && !(inode->i_state & I_DIRTY_DATASYNC))
-		goto out;
+	if (ext4_should_journal_data(inode))
+		return ext4_force_commit(inode->i_sb);
 
-	/*
-	 * The VFS has written the file data.  If the inode is unaltered
-	 * then we need not start a commit.
-	 */
-	if (inode->i_state & (I_DIRTY_SYNC|I_DIRTY_DATASYNC)) {
-		struct writeback_control wbc = {
-			.sync_mode = WB_SYNC_ALL,
-			.nr_to_write = 0, /* sys_fsync did this */
-		};
-		ret = sync_inode(inode, &wbc);
-		if (journal && (journal->j_flags & JBD2_BARRIER))
-			blkdev_issue_flush(inode->i_sb->s_bdev, NULL);
-	}
-out:
+	commit_tid = datasync ? ei->i_datasync_tid : ei->i_sync_tid;
+	if (jbd2_log_start_commit(journal, commit_tid))
+		jbd2_log_wait_commit(journal, commit_tid);
+	else if (journal->j_flags & JBD2_BARRIER)
+		blkdev_issue_flush(inode->i_sb->s_bdev, NULL);
 	return ret;
 }
--- linux-rt-2.6.31.orig/fs/ext4/namei.c
+++ linux-rt-2.6.31/fs/ext4/namei.c
@@ -1292,9 +1292,6 @@
  * add_dirent_to_buf will attempt search the directory block for
  * space.  It will return -ENOSPC if no space is available, and -EIO
  * and -EEXIST if directory entry already exists.
- *
- * NOTE!  bh is NOT released in the case where ENOSPC is returned.  In
- * all other cases bh is released.
  */
 static int add_dirent_to_buf(handle_t *handle, struct dentry *dentry,
 			     struct inode *inode, struct ext4_dir_entry_2 *de,
@@ -1315,14 +1312,10 @@
 		top = bh->b_data + blocksize - reclen;
 		while ((char *) de <= top) {
 			if (!ext4_check_dir_entry("ext4_add_entry", dir, de,
-						  bh, offset)) {
-				brelse(bh);
+						  bh, offset))
 				return -EIO;
-			}
-			if (ext4_match(namelen, name, de)) {
-				brelse(bh);
+			if (ext4_match(namelen, name, de))
 				return -EEXIST;
-			}
 			nlen = EXT4_DIR_REC_LEN(de->name_len);
 			rlen = ext4_rec_len_from_disk(de->rec_len, blocksize);
 			if ((de->inode? rlen - nlen: rlen) >= reclen)
@@ -1337,7 +1330,6 @@
 	err = ext4_journal_get_write_access(handle, bh);
 	if (err) {
 		ext4_std_error(dir->i_sb, err);
-		brelse(bh);
 		return err;
 	}
 
@@ -1377,7 +1369,6 @@
 	err = ext4_handle_dirty_metadata(handle, dir, bh);
 	if (err)
 		ext4_std_error(dir->i_sb, err);
-	brelse(bh);
 	return 0;
 }
 
@@ -1471,7 +1462,9 @@
 	if (!(de))
 		return retval;
 
-	return add_dirent_to_buf(handle, dentry, inode, de, bh);
+	retval = add_dirent_to_buf(handle, dentry, inode, de, bh);
+	brelse(bh);
+	return retval;
 }
 
 /*
@@ -1514,8 +1507,10 @@
 		if(!bh)
 			return retval;
 		retval = add_dirent_to_buf(handle, dentry, inode, NULL, bh);
-		if (retval != -ENOSPC)
+		if (retval != -ENOSPC) {
+			brelse(bh);
 			return retval;
+		}
 
 		if (blocks == 1 && !dx_fallback &&
 		    EXT4_HAS_COMPAT_FEATURE(sb, EXT4_FEATURE_COMPAT_DIR_INDEX))
@@ -1528,7 +1523,9 @@
 	de = (struct ext4_dir_entry_2 *) bh->b_data;
 	de->inode = 0;
 	de->rec_len = ext4_rec_len_to_disk(blocksize, blocksize);
-	return add_dirent_to_buf(handle, dentry, inode, de, bh);
+	retval = add_dirent_to_buf(handle, dentry, inode, de, bh);
+	brelse(bh);
+	return retval;
 }
 
 /*
@@ -1561,10 +1558,8 @@
 		goto journal_error;
 
 	err = add_dirent_to_buf(handle, dentry, inode, NULL, bh);
-	if (err != -ENOSPC) {
-		bh = NULL;
+	if (err != -ENOSPC)
 		goto cleanup;
-	}
 
 	/* Block full, should compress but for now just split */
 	dxtrace(printk(KERN_DEBUG "using %u of %u node entries\n",
@@ -1590,9 +1585,9 @@
 			goto cleanup;
 		node2 = (struct dx_node *)(bh2->b_data);
 		entries2 = node2->entries;
+		memset(&node2->fake, 0, sizeof(struct fake_dirent));
 		node2->fake.rec_len = ext4_rec_len_to_disk(sb->s_blocksize,
 							   sb->s_blocksize);
-		node2->fake.inode = 0;
 		BUFFER_TRACE(frame->bh, "get_write_access");
 		err = ext4_journal_get_write_access(handle, frame->bh);
 		if (err)
@@ -1657,7 +1652,6 @@
 	if (!de)
 		goto cleanup;
 	err = add_dirent_to_buf(handle, dentry, inode, de, bh);
-	bh = NULL;
 	goto cleanup;
 
 journal_error:
@@ -1775,7 +1769,7 @@
 retry:
 	handle = ext4_journal_start(dir, EXT4_DATA_TRANS_BLOCKS(dir->i_sb) +
 					EXT4_INDEX_EXTRA_TRANS_BLOCKS + 3 +
-					2*EXT4_QUOTA_INIT_BLOCKS(dir->i_sb));
+					EXT4_MAXQUOTAS_INIT_BLOCKS(dir->i_sb));
 	if (IS_ERR(handle))
 		return PTR_ERR(handle);
 
@@ -1809,7 +1803,7 @@
 retry:
 	handle = ext4_journal_start(dir, EXT4_DATA_TRANS_BLOCKS(dir->i_sb) +
 					EXT4_INDEX_EXTRA_TRANS_BLOCKS + 3 +
-					2*EXT4_QUOTA_INIT_BLOCKS(dir->i_sb));
+					EXT4_MAXQUOTAS_INIT_BLOCKS(dir->i_sb));
 	if (IS_ERR(handle))
 		return PTR_ERR(handle);
 
@@ -1846,7 +1840,7 @@
 retry:
 	handle = ext4_journal_start(dir, EXT4_DATA_TRANS_BLOCKS(dir->i_sb) +
 					EXT4_INDEX_EXTRA_TRANS_BLOCKS + 3 +
-					2*EXT4_QUOTA_INIT_BLOCKS(dir->i_sb));
+					EXT4_MAXQUOTAS_INIT_BLOCKS(dir->i_sb));
 	if (IS_ERR(handle))
 		return PTR_ERR(handle);
 
@@ -2068,7 +2062,8 @@
 	struct ext4_iloc iloc;
 	int err = 0;
 
-	if (!ext4_handle_valid(handle))
+	/* ext4_handle_valid() assumes a valid handle_t pointer */
+	if (handle && !ext4_handle_valid(handle))
 		return 0;
 
 	mutex_lock(&EXT4_SB(inode->i_sb)->s_orphan_lock);
@@ -2258,7 +2253,7 @@
 retry:
 	handle = ext4_journal_start(dir, EXT4_DATA_TRANS_BLOCKS(dir->i_sb) +
 					EXT4_INDEX_EXTRA_TRANS_BLOCKS + 5 +
-					2*EXT4_QUOTA_INIT_BLOCKS(dir->i_sb));
+					EXT4_MAXQUOTAS_INIT_BLOCKS(dir->i_sb));
 	if (IS_ERR(handle))
 		return PTR_ERR(handle);
 
@@ -2310,7 +2305,7 @@
 	struct inode *inode = old_dentry->d_inode;
 	int err, retries = 0;
 
-	if (EXT4_DIR_LINK_MAX(inode))
+	if (inode->i_nlink >= EXT4_LINK_MAX)
 		return -EMLINK;
 
 	/*
@@ -2413,7 +2408,7 @@
 			goto end_rename;
 		retval = -EMLINK;
 		if (!new_inode && new_dir != old_dir &&
-				new_dir->i_nlink >= EXT4_LINK_MAX)
+		    EXT4_DIR_LINK_MAX(new_dir))
 			goto end_rename;
 	}
 	if (!new_bh) {
--- linux-rt-2.6.31.orig/fs/ext4/ioctl.c
+++ linux-rt-2.6.31/fs/ext4/ioctl.c
@@ -221,32 +221,38 @@
 		struct file *donor_filp;
 		int err;
 
+		if (!(filp->f_mode & FMODE_READ) ||
+		    !(filp->f_mode & FMODE_WRITE))
+			return -EBADF;
+
 		if (copy_from_user(&me,
 			(struct move_extent __user *)arg, sizeof(me)))
 			return -EFAULT;
+		me.moved_len = 0;
 
 		donor_filp = fget(me.donor_fd);
 		if (!donor_filp)
 			return -EBADF;
 
-		if (!capable(CAP_DAC_OVERRIDE)) {
-			if ((current->real_cred->fsuid != inode->i_uid) ||
-				!(inode->i_mode & S_IRUSR) ||
-				!(donor_filp->f_dentry->d_inode->i_mode &
-				S_IRUSR)) {
-				fput(donor_filp);
-				return -EACCES;
-			}
+		if (!(donor_filp->f_mode & FMODE_WRITE)) {
+			err = -EBADF;
+			goto mext_out;
 		}
 
+		err = mnt_want_write(filp->f_path.mnt);
+		if (err)
+			goto mext_out;
+
 		err = ext4_move_extents(filp, donor_filp, me.orig_start,
 					me.donor_start, me.len, &me.moved_len);
-		fput(donor_filp);
+		mnt_drop_write(filp->f_path.mnt);
+		if (me.moved_len > 0)
+			file_remove_suid(donor_filp);
 
-		if (!err)
-			if (copy_to_user((struct move_extent *)arg,
-				&me, sizeof(me)))
-				return -EFAULT;
+		if (copy_to_user((struct move_extent *)arg, &me, sizeof(me)))
+			err = -EFAULT;
+mext_out:
+		fput(donor_filp);
 		return err;
 	}
 
--- linux-rt-2.6.31.orig/fs/ext4/extents.c
+++ linux-rt-2.6.31/fs/ext4/extents.c
@@ -93,7 +93,9 @@
 	ix->ei_leaf_hi = cpu_to_le16((unsigned long) ((pb >> 31) >> 1) & 0xffff);
 }
 
-static int ext4_ext_journal_restart(handle_t *handle, int needed)
+static int ext4_ext_truncate_extend_restart(handle_t *handle,
+					    struct inode *inode,
+					    int needed)
 {
 	int err;
 
@@ -104,7 +106,14 @@
 	err = ext4_journal_extend(handle, needed);
 	if (err <= 0)
 		return err;
-	return ext4_journal_restart(handle, needed);
+	err = ext4_truncate_restart_trans(handle, inode, needed);
+	/*
+	 * We have dropped i_data_sem so someone might have cached again
+	 * an extent we are going to truncate.
+	 */
+	ext4_ext_invalidate_cache(inode);
+
+	return err;
 }
 
 /*
@@ -701,7 +710,7 @@
  * insert new index [@logical;@ptr] into the block at @curp;
  * check where to insert: before @curp or after @curp
  */
-static int ext4_ext_insert_index(handle_t *handle, struct inode *inode,
+int ext4_ext_insert_index(handle_t *handle, struct inode *inode,
 				struct ext4_ext_path *curp,
 				int logical, ext4_fsblk_t ptr)
 {
@@ -1563,7 +1572,7 @@
  */
 int ext4_ext_insert_extent(handle_t *handle, struct inode *inode,
 				struct ext4_ext_path *path,
-				struct ext4_extent *newext)
+				struct ext4_extent *newext, int flag)
 {
 	struct ext4_extent_header *eh;
 	struct ext4_extent *ex, *fex;
@@ -1579,7 +1588,8 @@
 	BUG_ON(path[depth].p_hdr == NULL);
 
 	/* try to insert block into found extent and return */
-	if (ex && ext4_can_extents_be_merged(inode, ex, newext)) {
+	if (ex && (flag != EXT4_GET_BLOCKS_DIO_CREATE_EXT)
+		&& ext4_can_extents_be_merged(inode, ex, newext)) {
 		ext_debug("append %d block to %d:%d (from %llu)\n",
 				ext4_ext_get_actual_len(newext),
 				le32_to_cpu(ex->ee_block),
@@ -1694,7 +1704,8 @@
 
 merge:
 	/* try to merge extents to the right */
-	ext4_ext_try_to_merge(inode, path, nearex);
+	if (flag != EXT4_GET_BLOCKS_DIO_CREATE_EXT)
+		ext4_ext_try_to_merge(inode, path, nearex);
 
 	/* try to merge extents to the left */
 
@@ -1731,7 +1742,9 @@
 	while (block < last && block != EXT_MAX_BLOCK) {
 		num = last - block;
 		/* find extent for this block */
+		down_read(&EXT4_I(inode)->i_data_sem);
 		path = ext4_ext_find_extent(inode, block, path);
+		up_read(&EXT4_I(inode)->i_data_sem);
 		if (IS_ERR(path)) {
 			err = PTR_ERR(path);
 			path = NULL;
@@ -2044,7 +2057,7 @@
 		ext_debug("free last %u blocks starting %llu\n", num, start);
 		for (i = 0; i < num; i++) {
 			bh = sb_find_get_block(inode->i_sb, start + i);
-			ext4_forget(handle, 0, inode, bh, start + i);
+			ext4_forget(handle, metadata, inode, bh, start + i);
 		}
 		ext4_free_blocks(handle, inode, start, num, metadata);
 	} else if (from == le32_to_cpu(ex->ee_block)
@@ -2136,9 +2149,9 @@
 			correct_index = 1;
 			credits += (ext_depth(inode)) + 1;
 		}
-		credits += 2 * EXT4_QUOTA_TRANS_BLOCKS(inode->i_sb);
+		credits += EXT4_MAXQUOTAS_TRANS_BLOCKS(inode->i_sb);
 
-		err = ext4_ext_journal_restart(handle, credits);
+		err = ext4_ext_truncate_extend_restart(handle, inode, credits);
 		if (err)
 			goto out;
 
@@ -2461,7 +2474,6 @@
 }
 
 #define EXT4_EXT_ZERO_LEN 7
-
 /*
  * This function is called by ext4_ext_get_blocks() if someone tries to write
  * to an uninitialized extent. It may result in splitting the uninitialized
@@ -2554,7 +2566,8 @@
 			ex3->ee_block = cpu_to_le32(iblock);
 			ext4_ext_store_pblock(ex3, newblock);
 			ex3->ee_len = cpu_to_le16(allocated);
-			err = ext4_ext_insert_extent(handle, inode, path, ex3);
+			err = ext4_ext_insert_extent(handle, inode, path,
+							ex3, 0);
 			if (err == -ENOSPC) {
 				err =  ext4_ext_zeroout(inode, &orig_ex);
 				if (err)
@@ -2610,7 +2623,7 @@
 		ext4_ext_store_pblock(ex3, newblock + max_blocks);
 		ex3->ee_len = cpu_to_le16(allocated - max_blocks);
 		ext4_ext_mark_uninitialized(ex3);
-		err = ext4_ext_insert_extent(handle, inode, path, ex3);
+		err = ext4_ext_insert_extent(handle, inode, path, ex3, 0);
 		if (err == -ENOSPC) {
 			err =  ext4_ext_zeroout(inode, &orig_ex);
 			if (err)
@@ -2728,7 +2741,191 @@
 	err = ext4_ext_dirty(handle, inode, path + depth);
 	goto out;
 insert:
-	err = ext4_ext_insert_extent(handle, inode, path, &newex);
+	err = ext4_ext_insert_extent(handle, inode, path, &newex, 0);
+	if (err == -ENOSPC) {
+		err =  ext4_ext_zeroout(inode, &orig_ex);
+		if (err)
+			goto fix_extent_len;
+		/* update the extent length and mark as initialized */
+		ex->ee_block = orig_ex.ee_block;
+		ex->ee_len   = orig_ex.ee_len;
+		ext4_ext_store_pblock(ex, ext_pblock(&orig_ex));
+		ext4_ext_dirty(handle, inode, path + depth);
+		/* zero out the first half */
+		return allocated;
+	} else if (err)
+		goto fix_extent_len;
+out:
+	return err ? err : allocated;
+
+fix_extent_len:
+	ex->ee_block = orig_ex.ee_block;
+	ex->ee_len   = orig_ex.ee_len;
+	ext4_ext_store_pblock(ex, ext_pblock(&orig_ex));
+	ext4_ext_mark_uninitialized(ex);
+	ext4_ext_dirty(handle, inode, path + depth);
+	return err;
+}
+
+/*
+ * This function is called by ext4_ext_get_blocks() from
+ * ext4_get_blocks_dio_write() when DIO to write
+ * to an uninitialized extent.
+ *
+ * Writing to an uninitized extent may result in splitting the uninitialized
+ * extent into multiple /intialized unintialized extents (up to three)
+ * There are three possibilities:
+ *   a> There is no split required: Entire extent should be uninitialized
+ *   b> Splits in two extents: Write is happening at either end of the extent
+ *   c> Splits in three extents: Somone is writing in middle of the extent
+ *
+ * One of more index blocks maybe needed if the extent tree grow after
+ * the unintialized extent split. To prevent ENOSPC occur at the IO
+ * complete, we need to split the uninitialized extent before DIO submit
+ * the IO. The uninitilized extent called at this time will be split
+ * into three uninitialized extent(at most). After IO complete, the part
+ * being filled will be convert to initialized by the end_io callback function
+ * via ext4_convert_unwritten_extents().
+ *
+ * Returns the size of uninitialized extent to be written on success.
+ */
+static int ext4_split_unwritten_extents(handle_t *handle,
+					struct inode *inode,
+					struct ext4_ext_path *path,
+					ext4_lblk_t iblock,
+					unsigned int max_blocks,
+					int flags)
+{
+	struct ext4_extent *ex, newex, orig_ex;
+	struct ext4_extent *ex1 = NULL;
+	struct ext4_extent *ex2 = NULL;
+	struct ext4_extent *ex3 = NULL;
+	struct ext4_extent_header *eh;
+	ext4_lblk_t ee_block;
+	unsigned int allocated, ee_len, depth;
+	ext4_fsblk_t newblock;
+	int err = 0;
+
+	ext_debug("ext4_split_unwritten_extents: inode %lu,"
+		  "iblock %llu, max_blocks %u\n", inode->i_ino,
+		  (unsigned long long)iblock, max_blocks);
+	depth = ext_depth(inode);
+	eh = path[depth].p_hdr;
+	ex = path[depth].p_ext;
+	ee_block = le32_to_cpu(ex->ee_block);
+	ee_len = ext4_ext_get_actual_len(ex);
+	allocated = ee_len - (iblock - ee_block);
+	newblock = iblock - ee_block + ext_pblock(ex);
+	ex2 = ex;
+	orig_ex.ee_block = ex->ee_block;
+	orig_ex.ee_len   = cpu_to_le16(ee_len);
+	ext4_ext_store_pblock(&orig_ex, ext_pblock(ex));
+
+	/*
+ 	 * If the uninitialized extent begins at the same logical
+ 	 * block where the write begins, and the write completely
+ 	 * covers the extent, then we don't need to split it.
+ 	 */
+	if ((iblock == ee_block) && (allocated <= max_blocks))
+		return allocated;
+
+	err = ext4_ext_get_access(handle, inode, path + depth);
+	if (err)
+		goto out;
+	/* ex1: ee_block to iblock - 1 : uninitialized */
+	if (iblock > ee_block) {
+		ex1 = ex;
+		ex1->ee_len = cpu_to_le16(iblock - ee_block);
+		ext4_ext_mark_uninitialized(ex1);
+		ex2 = &newex;
+	}
+	/*
+	 * for sanity, update the length of the ex2 extent before
+	 * we insert ex3, if ex1 is NULL. This is to avoid temporary
+	 * overlap of blocks.
+	 */
+	if (!ex1 && allocated > max_blocks)
+		ex2->ee_len = cpu_to_le16(max_blocks);
+	/* ex3: to ee_block + ee_len : uninitialised */
+	if (allocated > max_blocks) {
+		unsigned int newdepth;
+		ex3 = &newex;
+		ex3->ee_block = cpu_to_le32(iblock + max_blocks);
+		ext4_ext_store_pblock(ex3, newblock + max_blocks);
+		ex3->ee_len = cpu_to_le16(allocated - max_blocks);
+		ext4_ext_mark_uninitialized(ex3);
+		err = ext4_ext_insert_extent(handle, inode, path, ex3, flags);
+		if (err == -ENOSPC) {
+			err =  ext4_ext_zeroout(inode, &orig_ex);
+			if (err)
+				goto fix_extent_len;
+			/* update the extent length and mark as initialized */
+			ex->ee_block = orig_ex.ee_block;
+			ex->ee_len   = orig_ex.ee_len;
+			ext4_ext_store_pblock(ex, ext_pblock(&orig_ex));
+			ext4_ext_dirty(handle, inode, path + depth);
+			/* zeroed the full extent */
+			/* blocks available from iblock */
+			return allocated;
+
+		} else if (err)
+			goto fix_extent_len;
+		/*
+		 * The depth, and hence eh & ex might change
+		 * as part of the insert above.
+		 */
+		newdepth = ext_depth(inode);
+		/*
+		 * update the extent length after successful insert of the
+		 * split extent
+		 */
+		orig_ex.ee_len = cpu_to_le16(ee_len -
+						ext4_ext_get_actual_len(ex3));
+		depth = newdepth;
+		ext4_ext_drop_refs(path);
+		path = ext4_ext_find_extent(inode, iblock, path);
+		if (IS_ERR(path)) {
+			err = PTR_ERR(path);
+			goto out;
+		}
+		eh = path[depth].p_hdr;
+		ex = path[depth].p_ext;
+		if (ex2 != &newex)
+			ex2 = ex;
+
+		err = ext4_ext_get_access(handle, inode, path + depth);
+		if (err)
+			goto out;
+
+		allocated = max_blocks;
+	}
+	/*
+	 * If there was a change of depth as part of the
+	 * insertion of ex3 above, we need to update the length
+	 * of the ex1 extent again here
+	 */
+	if (ex1 && ex1 != ex) {
+		ex1 = ex;
+		ex1->ee_len = cpu_to_le16(iblock - ee_block);
+		ext4_ext_mark_uninitialized(ex1);
+		ex2 = &newex;
+	}
+	/*
+	 * ex2: iblock to iblock + maxblocks-1 : to be direct IO written,
+	 * uninitialised still.
+	 */
+	ex2->ee_block = cpu_to_le32(iblock);
+	ext4_ext_store_pblock(ex2, newblock);
+	ex2->ee_len = cpu_to_le16(allocated);
+	ext4_ext_mark_uninitialized(ex2);
+	if (ex2 != ex)
+		goto insert;
+	/* Mark modified extent as dirty */
+	err = ext4_ext_dirty(handle, inode, path + depth);
+	ext_debug("out here\n");
+	goto out;
+insert:
+	err = ext4_ext_insert_extent(handle, inode, path, &newex, flags);
 	if (err == -ENOSPC) {
 		err =  ext4_ext_zeroout(inode, &orig_ex);
 		if (err)
@@ -2743,6 +2940,7 @@
 	} else if (err)
 		goto fix_extent_len;
 out:
+	ext4_ext_show_leaf(inode, path);
 	return err ? err : allocated;
 
 fix_extent_len:
@@ -2753,7 +2951,151 @@
 	ext4_ext_dirty(handle, inode, path + depth);
 	return err;
 }
+static int ext4_convert_unwritten_extents_dio(handle_t *handle,
+					      struct inode *inode,
+					      struct ext4_ext_path *path)
+{
+	struct ext4_extent *ex;
+	struct ext4_extent_header *eh;
+	int depth;
+	int err = 0;
+	int ret = 0;
+
+	depth = ext_depth(inode);
+	eh = path[depth].p_hdr;
+	ex = path[depth].p_ext;
+
+	err = ext4_ext_get_access(handle, inode, path + depth);
+	if (err)
+		goto out;
+	/* first mark the extent as initialized */
+	ext4_ext_mark_initialized(ex);
+
+	/*
+	 * We have to see if it can be merged with the extent
+	 * on the left.
+	 */
+	if (ex > EXT_FIRST_EXTENT(eh)) {
+		/*
+		 * To merge left, pass "ex - 1" to try_to_merge(),
+		 * since it merges towards right _only_.
+		 */
+		ret = ext4_ext_try_to_merge(inode, path, ex - 1);
+		if (ret) {
+			err = ext4_ext_correct_indexes(handle, inode, path);
+			if (err)
+				goto out;
+			depth = ext_depth(inode);
+			ex--;
+		}
+	}
+	/*
+	 * Try to Merge towards right.
+	 */
+	ret = ext4_ext_try_to_merge(inode, path, ex);
+	if (ret) {
+		err = ext4_ext_correct_indexes(handle, inode, path);
+		if (err)
+			goto out;
+		depth = ext_depth(inode);
+	}
+	/* Mark modified extent as dirty */
+	err = ext4_ext_dirty(handle, inode, path + depth);
+out:
+	ext4_ext_show_leaf(inode, path);
+	return err;
+}
+
+static int
+ext4_ext_handle_uninitialized_extents(handle_t *handle, struct inode *inode,
+			ext4_lblk_t iblock, unsigned int max_blocks,
+			struct ext4_ext_path *path, int flags,
+			unsigned int allocated, struct buffer_head *bh_result,
+			ext4_fsblk_t newblock)
+{
+	int ret = 0;
+	int err = 0;
+	ext4_io_end_t *io = EXT4_I(inode)->cur_aio_dio;
+
+	ext_debug("ext4_ext_handle_uninitialized_extents: inode %lu, logical"
+		  "block %llu, max_blocks %u, flags %d, allocated %u",
+		  inode->i_ino, (unsigned long long)iblock, max_blocks,
+		  flags, allocated);
+	ext4_ext_show_leaf(inode, path);
 
+	/* DIO get_block() before submit the IO, split the extent */
+	if (flags == EXT4_GET_BLOCKS_DIO_CREATE_EXT) {
+		ret = ext4_split_unwritten_extents(handle,
+						inode, path, iblock,
+						max_blocks, flags);
+		/*
+		 * Flag the inode(non aio case) or end_io struct (aio case)
+		 * that this IO needs to convertion to written when IO is
+		 * completed
+		 */
+		if (io)
+			io->flag = DIO_AIO_UNWRITTEN;
+		else
+			EXT4_I(inode)->i_state |= EXT4_STATE_DIO_UNWRITTEN;
+		goto out;
+	}
+	/* async DIO end_io complete, convert the filled extent to written */
+	if (flags == EXT4_GET_BLOCKS_DIO_CONVERT_EXT) {
+		ret = ext4_convert_unwritten_extents_dio(handle, inode,
+							path);
+		if (ret >= 0)
+			ext4_update_inode_fsync_trans(handle, inode, 1);
+		goto out2;
+	}
+	/* buffered IO case */
+	/*
+	 * repeat fallocate creation request
+	 * we already have an unwritten extent
+	 */
+	if (flags & EXT4_GET_BLOCKS_UNINIT_EXT)
+		goto map_out;
+
+	/* buffered READ or buffered write_begin() lookup */
+	if ((flags & EXT4_GET_BLOCKS_CREATE) == 0) {
+		/*
+		 * We have blocks reserved already.  We
+		 * return allocated blocks so that delalloc
+		 * won't do block reservation for us.  But
+		 * the buffer head will be unmapped so that
+		 * a read from the block returns 0s.
+		 */
+		set_buffer_unwritten(bh_result);
+		goto out1;
+	}
+
+	/* buffered write, writepage time, convert*/
+	ret = ext4_ext_convert_to_initialized(handle, inode,
+						path, iblock,
+						max_blocks);
+	if (ret >= 0)
+		ext4_update_inode_fsync_trans(handle, inode, 1);
+out:
+	if (ret <= 0) {
+		err = ret;
+		goto out2;
+	} else
+		allocated = ret;
+	set_buffer_new(bh_result);
+map_out:
+	set_buffer_mapped(bh_result);
+out1:
+	if (allocated > max_blocks)
+		allocated = max_blocks;
+	ext4_ext_show_leaf(inode, path);
+	bh_result->b_bdev = inode->i_sb->s_bdev;
+	bh_result->b_blocknr = newblock;
+out2:
+	if (path) {
+		ext4_ext_drop_refs(path);
+		kfree(path);
+	}
+	return err ? err : allocated;
+}
 /*
  * Block allocation/map/preallocation routine for extents based files
  *
@@ -2784,6 +3126,7 @@
 	int err = 0, depth, ret, cache_type;
 	unsigned int allocated = 0;
 	struct ext4_allocation_request ar;
+	ext4_io_end_t *io = EXT4_I(inode)->cur_aio_dio;
 
 	__clear_bit(BH_New, &bh_result->b_state);
 	ext_debug("blocks %u/%u requested for inode %u\n",
@@ -2859,33 +3202,10 @@
 							EXT4_EXT_CACHE_EXTENT);
 				goto out;
 			}
-			if (flags & EXT4_GET_BLOCKS_UNINIT_EXT)
-				goto out;
-			if ((flags & EXT4_GET_BLOCKS_CREATE) == 0) {
-				if (allocated > max_blocks)
-					allocated = max_blocks;
-				/*
-				 * We have blocks reserved already.  We
-				 * return allocated blocks so that delalloc
-				 * won't do block reservation for us.  But
-				 * the buffer head will be unmapped so that
-				 * a read from the block returns 0s.
-				 */
-				set_buffer_unwritten(bh_result);
-				bh_result->b_bdev = inode->i_sb->s_bdev;
-				bh_result->b_blocknr = newblock;
-				goto out2;
-			}
-
-			ret = ext4_ext_convert_to_initialized(handle, inode,
-								path, iblock,
-								max_blocks);
-			if (ret <= 0) {
-				err = ret;
-				goto out2;
-			} else
-				allocated = ret;
-			goto outnew;
+			ret = ext4_ext_handle_uninitialized_extents(handle,
+					inode, iblock, max_blocks, path,
+					flags, allocated, bh_result, newblock);
+			return ret;
 		}
 	}
 
@@ -2956,9 +3276,27 @@
 	/* try to insert new extent into found leaf and return */
 	ext4_ext_store_pblock(&newex, newblock);
 	newex.ee_len = cpu_to_le16(ar.len);
-	if (flags & EXT4_GET_BLOCKS_UNINIT_EXT)  /* Mark uninitialized */
+	/* Mark uninitialized */
+	if (flags & EXT4_GET_BLOCKS_UNINIT_EXT){
 		ext4_ext_mark_uninitialized(&newex);
-	err = ext4_ext_insert_extent(handle, inode, path, &newex);
+		/*
+		 * io_end structure was created for every async
+		 * direct IO write to the middle of the file.
+		 * To avoid unecessary convertion for every aio dio rewrite
+		 * to the mid of file, here we flag the IO that is really
+		 * need the convertion.
+		 * For non asycn direct IO case, flag the inode state
+		 * that we need to perform convertion when IO is done.
+		 */
+		if (flags == EXT4_GET_BLOCKS_DIO_CREATE_EXT) {
+			if (io)
+				io->flag = DIO_AIO_UNWRITTEN;
+			else
+				EXT4_I(inode)->i_state |=
+					EXT4_STATE_DIO_UNWRITTEN;;
+		}
+	}
+	err = ext4_ext_insert_extent(handle, inode, path, &newex, flags);
 	if (err) {
 		/* free data blocks we just allocated */
 		/* not a good idea to call discard here directly,
@@ -2972,13 +3310,18 @@
 	/* previous routine could use block we allocated */
 	newblock = ext_pblock(&newex);
 	allocated = ext4_ext_get_actual_len(&newex);
-outnew:
 	set_buffer_new(bh_result);
 
-	/* Cache only when it is _not_ an uninitialized extent */
-	if ((flags & EXT4_GET_BLOCKS_UNINIT_EXT) == 0)
+	/*
+	 * Cache the extent and update transaction to commit on fdatasync only
+	 * when it is _not_ an uninitialized extent.
+	 */
+	if ((flags & EXT4_GET_BLOCKS_UNINIT_EXT) == 0) {
 		ext4_ext_put_in_cache(inode, iblock, allocated, newblock,
 						EXT4_EXT_CACHE_EXTENT);
+		ext4_update_inode_fsync_trans(handle, inode, 1);
+	} else
+		ext4_update_inode_fsync_trans(handle, inode, 0);
 out:
 	if (allocated > max_blocks)
 		allocated = max_blocks;
@@ -3171,6 +3514,64 @@
 }
 
 /*
+ * This function convert a range of blocks to written extents
+ * The caller of this function will pass the start offset and the size.
+ * all unwritten extents within this range will be converted to
+ * written extents.
+ *
+ * This function is called from the direct IO end io call back
+ * function, to convert the fallocated extents after IO is completed.
+ * Returns 0 on success.
+ */
+int ext4_convert_unwritten_extents(struct inode *inode, loff_t offset,
+				    loff_t len)
+{
+	handle_t *handle;
+	ext4_lblk_t block;
+	unsigned int max_blocks;
+	int ret = 0;
+	int ret2 = 0;
+	struct buffer_head map_bh;
+	unsigned int credits, blkbits = inode->i_blkbits;
+
+	block = offset >> blkbits;
+	/*
+	 * We can't just convert len to max_blocks because
+	 * If blocksize = 4096 offset = 3072 and len = 2048
+	 */
+	max_blocks = (EXT4_BLOCK_ALIGN(len + offset, blkbits) >> blkbits)
+							- block;
+	/*
+	 * credits to insert 1 extent into extent tree
+	 */
+	credits = ext4_chunk_trans_blocks(inode, max_blocks);
+	while (ret >= 0 && ret < max_blocks) {
+		block = block + ret;
+		max_blocks = max_blocks - ret;
+		handle = ext4_journal_start(inode, credits);
+		if (IS_ERR(handle)) {
+			ret = PTR_ERR(handle);
+			break;
+		}
+		map_bh.b_state = 0;
+		ret = ext4_get_blocks(handle, inode, block,
+				      max_blocks, &map_bh,
+				      EXT4_GET_BLOCKS_DIO_CONVERT_EXT);
+		if (ret <= 0) {
+			WARN_ON(ret <= 0);
+			printk(KERN_ERR "%s: ext4_ext_get_blocks "
+				    "returned error inode#%lu, block=%u, "
+				    "max_blocks=%u", __func__,
+				    inode->i_ino, block, max_blocks);
+		}
+		ext4_mark_inode_dirty(handle, inode);
+		ret2 = ext4_journal_stop(handle);
+		if (ret <= 0 || ret2 )
+			break;
+	}
+	return ret > 0 ? ret2 : ret;
+}
+/*
  * Callback function called for each extent to gather FIEMAP information.
  */
 static int ext4_ext_fiemap_cb(struct inode *inode, struct ext4_ext_path *path,
@@ -3308,10 +3709,8 @@
 		 * Walk the extent tree gathering extent information.
 		 * ext4_ext_fiemap_cb will push extents back to user.
 		 */
-		down_read(&EXT4_I(inode)->i_data_sem);
 		error = ext4_ext_walk_space(inode, start_blk, len_blks,
 					  ext4_ext_fiemap_cb, fieinfo);
-		up_read(&EXT4_I(inode)->i_data_sem);
 	}
 
 	return error;
--- linux-rt-2.6.31.orig/fs/ext4/ext4_jbd2.h
+++ linux-rt-2.6.31/fs/ext4/ext4_jbd2.h
@@ -49,7 +49,7 @@
 
 #define EXT4_DATA_TRANS_BLOCKS(sb)	(EXT4_SINGLEDATA_TRANS_BLOCKS(sb) + \
 					 EXT4_XATTR_TRANS_BLOCKS - 2 + \
-					 2*EXT4_QUOTA_TRANS_BLOCKS(sb))
+					 EXT4_MAXQUOTAS_TRANS_BLOCKS(sb))
 
 /*
  * Define the number of metadata blocks we need to account to modify data.
@@ -57,7 +57,7 @@
  * This include super block, inode block, quota blocks and xattr blocks
  */
 #define EXT4_META_TRANS_BLOCKS(sb)	(EXT4_XATTR_TRANS_BLOCKS + \
-					2*EXT4_QUOTA_TRANS_BLOCKS(sb))
+					EXT4_MAXQUOTAS_TRANS_BLOCKS(sb))
 
 /* Delete operations potentially hit one directory's namespace plus an
  * entire inode, plus arbitrary amounts of bitmap/indirection data.  Be
@@ -92,6 +92,7 @@
  * but inode, sb and group updates are done only once */
 #define EXT4_QUOTA_INIT_BLOCKS(sb) (test_opt(sb, QUOTA) ? (DQUOT_INIT_ALLOC*\
 		(EXT4_SINGLEDATA_TRANS_BLOCKS(sb)-3)+3+DQUOT_INIT_REWRITE) : 0)
+
 #define EXT4_QUOTA_DEL_BLOCKS(sb) (test_opt(sb, QUOTA) ? (DQUOT_DEL_ALLOC*\
 		(EXT4_SINGLEDATA_TRANS_BLOCKS(sb)-3)+3+DQUOT_DEL_REWRITE) : 0)
 #else
@@ -99,6 +100,9 @@
 #define EXT4_QUOTA_INIT_BLOCKS(sb) 0
 #define EXT4_QUOTA_DEL_BLOCKS(sb) 0
 #endif
+#define EXT4_MAXQUOTAS_TRANS_BLOCKS(sb) (MAXQUOTAS*EXT4_QUOTA_TRANS_BLOCKS(sb))
+#define EXT4_MAXQUOTAS_INIT_BLOCKS(sb) (MAXQUOTAS*EXT4_QUOTA_INIT_BLOCKS(sb))
+#define EXT4_MAXQUOTAS_DEL_BLOCKS(sb) (MAXQUOTAS*EXT4_QUOTA_DEL_BLOCKS(sb))
 
 int
 ext4_mark_iloc_dirty(handle_t *handle,
@@ -161,11 +165,13 @@
 handle_t *ext4_journal_start_sb(struct super_block *sb, int nblocks);
 int __ext4_journal_stop(const char *where, handle_t *handle);
 
-#define EXT4_NOJOURNAL_HANDLE	((handle_t *) 0x1)
+#define EXT4_NOJOURNAL_MAX_REF_COUNT ((unsigned long) 4096)
 
+/* Note:  Do not use this for NULL handles.  This is only to determine if
+ * a properly allocated handle is using a journal or not. */
 static inline int ext4_handle_valid(handle_t *handle)
 {
-	if (handle == EXT4_NOJOURNAL_HANDLE)
+	if ((unsigned long)handle < EXT4_NOJOURNAL_MAX_REF_COUNT)
 		return 0;
 	return 1;
 }
@@ -252,6 +258,19 @@
 	return 0;
 }
 
+static inline void ext4_update_inode_fsync_trans(handle_t *handle,
+						 struct inode *inode,
+						 int datasync)
+{
+	struct ext4_inode_info *ei = EXT4_I(inode);
+
+	if (ext4_handle_valid(handle)) {
+		ei->i_sync_tid = handle->h_transaction->t_tid;
+		if (datasync)
+			ei->i_datasync_tid = handle->h_transaction->t_tid;
+	}
+}
+
 /* super.c */
 int ext4_force_commit(struct super_block *sb);
 
--- linux-rt-2.6.31.orig/fs/ext4/move_extent.c
+++ linux-rt-2.6.31/fs/ext4/move_extent.c
@@ -19,14 +19,31 @@
 #include "ext4_extents.h"
 #include "ext4.h"
 
-#define get_ext_path(path, inode, block, ret)		\
-	do {								\
-		path = ext4_ext_find_extent(inode, block, path);	\
-		if (IS_ERR(path)) {					\
-			ret = PTR_ERR(path);				\
-			path = NULL;					\
-		}							\
-	} while (0)
+/**
+ * get_ext_path - Find an extent path for designated logical block number.
+ *
+ * @inode:	an inode which is searched
+ * @lblock:	logical block number to find an extent path
+ * @path:	pointer to an extent path pointer (for output)
+ *
+ * ext4_ext_find_extent wrapper. Return 0 on success, or a negative error value
+ * on failure.
+ */
+static inline int
+get_ext_path(struct inode *inode, ext4_lblk_t lblock,
+		struct ext4_ext_path **path)
+{
+	int ret = 0;
+
+	*path = ext4_ext_find_extent(inode, lblock, *path);
+	if (IS_ERR(*path)) {
+		ret = PTR_ERR(*path);
+		*path = NULL;
+	} else if ((*path)[ext_depth(inode)].p_ext == NULL)
+		ret = -ENODATA;
+
+	return ret;
+}
 
 /**
  * copy_extent_status - Copy the extent's initialization status
@@ -60,12 +77,14 @@
 mext_next_extent(struct inode *inode, struct ext4_ext_path *path,
 		      struct ext4_extent **extent)
 {
+	struct ext4_extent_header *eh;
 	int ppos, leaf_ppos = path->p_depth;
 
 	ppos = leaf_ppos;
 	if (EXT_LAST_EXTENT(path[ppos].p_hdr) > path[ppos].p_ext) {
 		/* leaf block */
 		*extent = ++path[ppos].p_ext;
+		path[ppos].p_block = ext_pblock(path[ppos].p_ext);
 		return 0;
 	}
 
@@ -102,9 +121,18 @@
 					ext_block_hdr(path[cur_ppos+1].p_bh);
 			}
 
+			path[leaf_ppos].p_ext = *extent = NULL;
+
+			eh = path[leaf_ppos].p_hdr;
+			if (le16_to_cpu(eh->eh_entries) == 0)
+				/* empty leaf is found */
+				return -ENODATA;
+
 			/* leaf block */
 			path[leaf_ppos].p_ext = *extent =
 				EXT_FIRST_EXTENT(path[leaf_ppos].p_hdr);
+			path[leaf_ppos].p_block =
+					ext_pblock(path[leaf_ppos].p_ext);
 			return 0;
 		}
 	}
@@ -113,47 +141,43 @@
 }
 
 /**
- * mext_double_down_read - Acquire two inodes' read semaphore
+ * mext_check_null_inode - NULL check for two inodes
  *
- * @orig_inode:		original inode structure
- * @donor_inode:	donor inode structure
- * Acquire read semaphore of the two inodes (orig and donor) by i_ino order.
+ * If inode1 or inode2 is NULL, return -EIO. Otherwise, return 0.
  */
-static void
-mext_double_down_read(struct inode *orig_inode, struct inode *donor_inode)
+static int
+mext_check_null_inode(struct inode *inode1, struct inode *inode2,
+		const char *function)
 {
-	struct inode *first = orig_inode, *second = donor_inode;
-
-	BUG_ON(orig_inode == NULL || donor_inode == NULL);
+	int ret = 0;
 
-	/*
-	 * Use the inode number to provide the stable locking order instead
-	 * of its address, because the C language doesn't guarantee you can
-	 * compare pointers that don't come from the same array.
-	 */
-	if (donor_inode->i_ino < orig_inode->i_ino) {
-		first = donor_inode;
-		second = orig_inode;
+	if (inode1 == NULL) {
+		ext4_error(inode2->i_sb, function,
+			"Both inodes should not be NULL: "
+			"inode1 NULL inode2 %lu", inode2->i_ino);
+		ret = -EIO;
+	} else if (inode2 == NULL) {
+		ext4_error(inode1->i_sb, function,
+			"Both inodes should not be NULL: "
+			"inode1 %lu inode2 NULL", inode1->i_ino);
+		ret = -EIO;
 	}
-
-	down_read(&EXT4_I(first)->i_data_sem);
-	down_read(&EXT4_I(second)->i_data_sem);
+	return ret;
 }
 
 /**
- * mext_double_down_write - Acquire two inodes' write semaphore
+ * double_down_write_data_sem - Acquire two inodes' write lock of i_data_sem
  *
  * @orig_inode:		original inode structure
  * @donor_inode:	donor inode structure
- * Acquire write semaphore of the two inodes (orig and donor) by i_ino order.
+ * Acquire write lock of i_data_sem of the two inodes (orig and donor) by
+ * i_ino order.
  */
 static void
-mext_double_down_write(struct inode *orig_inode, struct inode *donor_inode)
+double_down_write_data_sem(struct inode *orig_inode, struct inode *donor_inode)
 {
 	struct inode *first = orig_inode, *second = donor_inode;
 
-	BUG_ON(orig_inode == NULL || donor_inode == NULL);
-
 	/*
 	 * Use the inode number to provide the stable locking order instead
 	 * of its address, because the C language doesn't guarantee you can
@@ -165,37 +189,19 @@
 	}
 
 	down_write(&EXT4_I(first)->i_data_sem);
-	down_write(&EXT4_I(second)->i_data_sem);
-}
-
-/**
- * mext_double_up_read - Release two inodes' read semaphore
- *
- * @orig_inode:		original inode structure to be released its lock first
- * @donor_inode:	donor inode structure to be released its lock second
- * Release read semaphore of two inodes (orig and donor).
- */
-static void
-mext_double_up_read(struct inode *orig_inode, struct inode *donor_inode)
-{
-	BUG_ON(orig_inode == NULL || donor_inode == NULL);
-
-	up_read(&EXT4_I(orig_inode)->i_data_sem);
-	up_read(&EXT4_I(donor_inode)->i_data_sem);
+	down_write_nested(&EXT4_I(second)->i_data_sem, SINGLE_DEPTH_NESTING);
 }
 
 /**
- * mext_double_up_write - Release two inodes' write semaphore
+ * double_up_write_data_sem - Release two inodes' write lock of i_data_sem
  *
  * @orig_inode:		original inode structure to be released its lock first
  * @donor_inode:	donor inode structure to be released its lock second
- * Release write semaphore of two inodes (orig and donor).
+ * Release write lock of i_data_sem of two inodes (orig and donor).
  */
 static void
-mext_double_up_write(struct inode *orig_inode, struct inode *donor_inode)
+double_up_write_data_sem(struct inode *orig_inode, struct inode *donor_inode)
 {
-	BUG_ON(orig_inode == NULL || donor_inode == NULL);
-
 	up_write(&EXT4_I(orig_inode)->i_data_sem);
 	up_write(&EXT4_I(donor_inode)->i_data_sem);
 }
@@ -283,23 +289,23 @@
 	}
 
 	if (new_flag) {
-		get_ext_path(orig_path, orig_inode, eblock, err);
-		if (orig_path == NULL)
+		err = get_ext_path(orig_inode, eblock, &orig_path);
+		if (err)
 			goto out;
 
 		if (ext4_ext_insert_extent(handle, orig_inode,
-					orig_path, new_ext))
+					orig_path, new_ext, 0))
 			goto out;
 	}
 
 	if (end_flag) {
-		get_ext_path(orig_path, orig_inode,
-				      le32_to_cpu(end_ext->ee_block) - 1, err);
-		if (orig_path == NULL)
+		err = get_ext_path(orig_inode,
+				le32_to_cpu(end_ext->ee_block) - 1, &orig_path);
+		if (err)
 			goto out;
 
 		if (ext4_ext_insert_extent(handle, orig_inode,
-					   orig_path, end_ext))
+					   orig_path, end_ext, 0))
 			goto out;
 	}
 out:
@@ -519,7 +525,15 @@
 	 * oext      |-----------|
 	 * new_ext       |-------|
 	 */
-	BUG_ON(le32_to_cpu(oext->ee_block) + oext_alen - 1 < new_ext_end);
+	if (le32_to_cpu(oext->ee_block) + oext_alen - 1 < new_ext_end) {
+		ext4_error(orig_inode->i_sb, __func__,
+			"new_ext_end(%u) should be less than or equal to "
+			"oext->ee_block(%u) + oext_alen(%d) - 1",
+			new_ext_end, le32_to_cpu(oext->ee_block),
+			oext_alen);
+		ret = -EIO;
+		goto out;
+	}
 
 	/*
 	 * Case: new_ext is smaller than original extent
@@ -543,6 +557,7 @@
 
 	ret = mext_insert_extents(handle, orig_inode, orig_path, o_start,
 				o_end, &start_ext, &new_ext, &end_ext);
+out:
 	return ret;
 }
 
@@ -554,8 +569,10 @@
  * @orig_off:		block offset of original inode
  * @donor_off:		block offset of donor inode
  * @max_count:		the maximun length of extents
+ *
+ * Return 0 on success, or a negative error value on failure.
  */
-static void
+static int
 mext_calc_swap_extents(struct ext4_extent *tmp_dext,
 			      struct ext4_extent *tmp_oext,
 			      ext4_lblk_t orig_off, ext4_lblk_t donor_off,
@@ -564,6 +581,19 @@
 	ext4_lblk_t diff, orig_diff;
 	struct ext4_extent dext_old, oext_old;
 
+	BUG_ON(orig_off != donor_off);
+
+	/* original and donor extents have to cover the same block offset */
+	if (orig_off < le32_to_cpu(tmp_oext->ee_block) ||
+	    le32_to_cpu(tmp_oext->ee_block) +
+			ext4_ext_get_actual_len(tmp_oext) - 1 < orig_off)
+		return -ENODATA;
+
+	if (orig_off < le32_to_cpu(tmp_dext->ee_block) ||
+	    le32_to_cpu(tmp_dext->ee_block) +
+			ext4_ext_get_actual_len(tmp_dext) - 1 < orig_off)
+		return -ENODATA;
+
 	dext_old = *tmp_dext;
 	oext_old = *tmp_oext;
 
@@ -591,6 +621,8 @@
 
 	copy_extent_status(&oext_old, tmp_dext);
 	copy_extent_status(&dext_old, tmp_oext);
+
+	return 0;
 }
 
 /**
@@ -601,6 +633,7 @@
  * @donor_inode:	donor inode
  * @from:		block offset of orig_inode
  * @count:		block count to be replaced
+ * @err:		pointer to save return value
  *
  * Replace original inode extents and donor inode extents page by page.
  * We implement this replacement in the following three steps:
@@ -611,33 +644,33 @@
  * 3. Change the block information of donor inode to point at the saved
  *    original inode blocks in the dummy extents.
  *
- * Return 0 on success, or a negative error value on failure.
+ * Return replaced block count.
  */
 static int
 mext_replace_branches(handle_t *handle, struct inode *orig_inode,
 			   struct inode *donor_inode, ext4_lblk_t from,
-			   ext4_lblk_t count)
+			   ext4_lblk_t count, int *err)
 {
 	struct ext4_ext_path *orig_path = NULL;
 	struct ext4_ext_path *donor_path = NULL;
 	struct ext4_extent *oext, *dext;
 	struct ext4_extent tmp_dext, tmp_oext;
 	ext4_lblk_t orig_off = from, donor_off = from;
-	int err = 0;
 	int depth;
 	int replaced_count = 0;
 	int dext_alen;
 
-	mext_double_down_write(orig_inode, donor_inode);
+	/* Protect extent trees against block allocations via delalloc */
+	double_down_write_data_sem(orig_inode, donor_inode);
 
 	/* Get the original extent for the block "orig_off" */
-	get_ext_path(orig_path, orig_inode, orig_off, err);
-	if (orig_path == NULL)
+	*err = get_ext_path(orig_inode, orig_off, &orig_path);
+	if (*err)
 		goto out;
 
 	/* Get the donor extent for the head */
-	get_ext_path(donor_path, donor_inode, donor_off, err);
-	if (donor_path == NULL)
+	*err = get_ext_path(donor_inode, donor_off, &donor_path);
+	if (*err)
 		goto out;
 	depth = ext_depth(orig_inode);
 	oext = orig_path[depth].p_ext;
@@ -647,24 +680,39 @@
 	dext = donor_path[depth].p_ext;
 	tmp_dext = *dext;
 
-	mext_calc_swap_extents(&tmp_dext, &tmp_oext, orig_off,
+	*err = mext_calc_swap_extents(&tmp_dext, &tmp_oext, orig_off,
 				      donor_off, count);
+	if (*err)
+		goto out;
 
 	/* Loop for the donor extents */
 	while (1) {
 		/* The extent for donor must be found. */
-		BUG_ON(!dext || donor_off != le32_to_cpu(tmp_dext.ee_block));
+		if (!dext) {
+			ext4_error(donor_inode->i_sb, __func__,
+				   "The extent for donor must be found");
+			*err = -EIO;
+			goto out;
+		} else if (donor_off != le32_to_cpu(tmp_dext.ee_block)) {
+			ext4_error(donor_inode->i_sb, __func__,
+				"Donor offset(%u) and the first block of donor "
+				"extent(%u) should be equal",
+				donor_off,
+				le32_to_cpu(tmp_dext.ee_block));
+			*err = -EIO;
+			goto out;
+		}
 
 		/* Set donor extent to orig extent */
-		err = mext_leaf_block(handle, orig_inode,
+		*err = mext_leaf_block(handle, orig_inode,
 					   orig_path, &tmp_dext, &orig_off);
-		if (err < 0)
+		if (*err)
 			goto out;
 
 		/* Set orig extent to donor extent */
-		err = mext_leaf_block(handle, donor_inode,
+		*err = mext_leaf_block(handle, donor_inode,
 					   donor_path, &tmp_oext, &donor_off);
-		if (err < 0)
+		if (*err)
 			goto out;
 
 		dext_alen = ext4_ext_get_actual_len(&tmp_dext);
@@ -678,36 +726,26 @@
 
 		if (orig_path)
 			ext4_ext_drop_refs(orig_path);
-		get_ext_path(orig_path, orig_inode, orig_off, err);
-		if (orig_path == NULL)
+		*err = get_ext_path(orig_inode, orig_off, &orig_path);
+		if (*err)
 			goto out;
 		depth = ext_depth(orig_inode);
 		oext = orig_path[depth].p_ext;
-		if (le32_to_cpu(oext->ee_block) +
-				ext4_ext_get_actual_len(oext) <= orig_off) {
-			err = 0;
-			goto out;
-		}
 		tmp_oext = *oext;
 
 		if (donor_path)
 			ext4_ext_drop_refs(donor_path);
-		get_ext_path(donor_path, donor_inode,
-				      donor_off, err);
-		if (donor_path == NULL)
+		*err = get_ext_path(donor_inode, donor_off, &donor_path);
+		if (*err)
 			goto out;
 		depth = ext_depth(donor_inode);
 		dext = donor_path[depth].p_ext;
-		if (le32_to_cpu(dext->ee_block) +
-				ext4_ext_get_actual_len(dext) <= donor_off) {
-			err = 0;
-			goto out;
-		}
 		tmp_dext = *dext;
 
-		mext_calc_swap_extents(&tmp_dext, &tmp_oext, orig_off,
-					      donor_off,
-					      count - replaced_count);
+		*err = mext_calc_swap_extents(&tmp_dext, &tmp_oext, orig_off,
+					   donor_off, count - replaced_count);
+		if (*err)
+			goto out;
 	}
 
 out:
@@ -720,8 +758,12 @@
 		kfree(donor_path);
 	}
 
-	mext_double_up_write(orig_inode, donor_inode);
-	return err;
+	ext4_ext_invalidate_cache(orig_inode);
+	ext4_ext_invalidate_cache(donor_inode);
+
+	double_up_write_data_sem(orig_inode, donor_inode);
+
+	return replaced_count;
 }
 
 /**
@@ -733,16 +775,17 @@
  * @data_offset_in_page:	block index where data swapping starts
  * @block_len_in_page:		the number of blocks to be swapped
  * @uninit:			orig extent is uninitialized or not
+ * @err:			pointer to save return value
  *
  * Save the data in original inode blocks and replace original inode extents
  * with donor inode extents by calling mext_replace_branches().
- * Finally, write out the saved data in new original inode blocks. Return 0
- * on success, or a negative error value on failure.
+ * Finally, write out the saved data in new original inode blocks. Return
+ * replaced block count.
  */
 static int
-move_extent_par_page(struct file *o_filp, struct inode *donor_inode,
+move_extent_per_page(struct file *o_filp, struct inode *donor_inode,
 		  pgoff_t orig_page_offset, int data_offset_in_page,
-		  int block_len_in_page, int uninit)
+		  int block_len_in_page, int uninit, int *err)
 {
 	struct inode *orig_inode = o_filp->f_dentry->d_inode;
 	struct address_space *mapping = orig_inode->i_mapping;
@@ -754,9 +797,11 @@
 	long long offs = orig_page_offset << PAGE_CACHE_SHIFT;
 	unsigned long blocksize = orig_inode->i_sb->s_blocksize;
 	unsigned int w_flags = 0;
-	unsigned int tmp_data_len, data_len;
+	unsigned int tmp_data_size, data_size, replaced_size;
 	void *fsdata;
-	int ret, i, jblocks;
+	int i, jblocks;
+	int err2 = 0;
+	int replaced_count = 0;
 	int blocks_per_page = PAGE_CACHE_SIZE >> orig_inode->i_blkbits;
 
 	/*
@@ -766,8 +811,8 @@
 	jblocks = ext4_writepage_trans_blocks(orig_inode) * 2;
 	handle = ext4_journal_start(orig_inode, jblocks);
 	if (IS_ERR(handle)) {
-		ret = PTR_ERR(handle);
-		return ret;
+		*err = PTR_ERR(handle);
+		return 0;
 	}
 
 	if (segment_eq(get_fs(), KERNEL_DS))
@@ -783,39 +828,36 @@
 	 * Just swap data blocks between orig and donor.
 	 */
 	if (uninit) {
-		ret = mext_replace_branches(handle, orig_inode,
-						 donor_inode, orig_blk_offset,
-						 block_len_in_page);
-
-		/* Clear the inode cache not to refer to the old data */
-		ext4_ext_invalidate_cache(orig_inode);
-		ext4_ext_invalidate_cache(donor_inode);
+		replaced_count = mext_replace_branches(handle, orig_inode,
+						donor_inode, orig_blk_offset,
+						block_len_in_page, err);
 		goto out2;
 	}
 
 	offs = (long long)orig_blk_offset << orig_inode->i_blkbits;
 
-	/* Calculate data_len */
+	/* Calculate data_size */
 	if ((orig_blk_offset + block_len_in_page - 1) ==
 	    ((orig_inode->i_size - 1) >> orig_inode->i_blkbits)) {
 		/* Replace the last block */
-		tmp_data_len = orig_inode->i_size & (blocksize - 1);
+		tmp_data_size = orig_inode->i_size & (blocksize - 1);
 		/*
-		 * If data_len equal zero, it shows data_len is multiples of
+		 * If data_size equal zero, it shows data_size is multiples of
 		 * blocksize. So we set appropriate value.
 		 */
-		if (tmp_data_len == 0)
-			tmp_data_len = blocksize;
+		if (tmp_data_size == 0)
+			tmp_data_size = blocksize;
 
-		data_len = tmp_data_len +
+		data_size = tmp_data_size +
 			((block_len_in_page - 1) << orig_inode->i_blkbits);
-	} else {
-		data_len = block_len_in_page << orig_inode->i_blkbits;
-	}
+	} else
+		data_size = block_len_in_page << orig_inode->i_blkbits;
+
+	replaced_size = data_size;
 
-	ret = a_ops->write_begin(o_filp, mapping, offs, data_len, w_flags,
+	*err = a_ops->write_begin(o_filp, mapping, offs, data_size, w_flags,
 				 &page, &fsdata);
-	if (unlikely(ret < 0))
+	if (unlikely(*err < 0))
 		goto out;
 
 	if (!PageUptodate(page)) {
@@ -836,14 +878,17 @@
 	/* Release old bh and drop refs */
 	try_to_release_page(page, 0);
 
-	ret = mext_replace_branches(handle, orig_inode, donor_inode,
-					 orig_blk_offset, block_len_in_page);
-	if (ret < 0)
-		goto out;
-
-	/* Clear the inode cache not to refer to the old data */
-	ext4_ext_invalidate_cache(orig_inode);
-	ext4_ext_invalidate_cache(donor_inode);
+	replaced_count = mext_replace_branches(handle, orig_inode, donor_inode,
+					orig_blk_offset, block_len_in_page,
+					&err2);
+	if (err2) {
+		if (replaced_count) {
+			block_len_in_page = replaced_count;
+			replaced_size =
+				block_len_in_page << orig_inode->i_blkbits;
+		} else
+			goto out;
+	}
 
 	if (!page_has_buffers(page))
 		create_empty_buffers(page, 1 << orig_inode->i_blkbits, 0);
@@ -853,16 +898,16 @@
 		bh = bh->b_this_page;
 
 	for (i = 0; i < block_len_in_page; i++) {
-		ret = ext4_get_block(orig_inode,
+		*err = ext4_get_block(orig_inode,
 				(sector_t)(orig_blk_offset + i), bh, 0);
-		if (ret < 0)
+		if (*err < 0)
 			goto out;
 
 		if (bh->b_this_page != NULL)
 			bh = bh->b_this_page;
 	}
 
-	ret = a_ops->write_end(o_filp, mapping, offs, data_len, data_len,
+	*err = a_ops->write_end(o_filp, mapping, offs, data_size, replaced_size,
 			       page, fsdata);
 	page = NULL;
 
@@ -871,11 +916,15 @@
 		if (PageLocked(page))
 			unlock_page(page);
 		page_cache_release(page);
+		ext4_journal_stop(handle);
 	}
 out2:
 	ext4_journal_stop(handle);
 
-	return ret < 0 ? ret : 0;
+	if (err2)
+		*err = err2;
+
+	return replaced_count;
 }
 
 /**
@@ -886,7 +935,6 @@
  * @orig_start:		logical start offset in block for orig
  * @donor_start:	logical start offset in block for donor
  * @len:		the number of blocks to be moved
- * @moved_len:		moved block length
  *
  * Check the arguments of ext4_move_extents() whether the files can be
  * exchanged with each other.
@@ -894,9 +942,13 @@
  */
 static int
 mext_check_arguments(struct inode *orig_inode,
-			  struct inode *donor_inode, __u64 orig_start,
-			  __u64 donor_start, __u64 *len, __u64 moved_len)
+		     struct inode *donor_inode, __u64 orig_start,
+		     __u64 donor_start, __u64 *len)
 {
+	ext4_lblk_t orig_blocks, donor_blocks;
+	unsigned int blkbits = orig_inode->i_blkbits;
+	unsigned int blocksize = 1 << blkbits;
+
 	/* Regular file check */
 	if (!S_ISREG(orig_inode->i_mode) || !S_ISREG(donor_inode->i_mode)) {
 		ext4_debug("ext4 move extent: The argument files should be "
@@ -905,6 +957,13 @@
 		return -EINVAL;
 	}
 
+	if (donor_inode->i_mode & (S_ISUID|S_ISGID)) {
+		ext4_debug("ext4 move extent: suid or sgid is set"
+			   " to donor file [ino:orig %lu, donor %lu]\n",
+			   orig_inode->i_ino, donor_inode->i_ino);
+		return -EINVAL;
+	}
+
 	/* Ext4 move extent does not support swapfile */
 	if (IS_SWAPFILE(orig_inode) || IS_SWAPFILE(donor_inode)) {
 		ext4_debug("ext4 move extent: The argument files should "
@@ -921,14 +980,6 @@
 		return -EINVAL;
 	}
 
-	/* orig and donor should be different file */
-	if (orig_inode->i_ino == donor_inode->i_ino) {
-		ext4_debug("ext4 move extent: The argument files should not "
-			"be same file [ino:orig %lu, donor %lu]\n",
-			orig_inode->i_ino, donor_inode->i_ino);
-		return -EINVAL;
-	}
-
 	/* Ext4 move extent supports only extent based file */
 	if (!(EXT4_I(orig_inode)->i_flags & EXT4_EXTENTS_FL)) {
 		ext4_debug("ext4 move extent: orig file is not extents "
@@ -953,13 +1004,6 @@
 		return -EINVAL;
 	}
 
-	if (moved_len) {
-		ext4_debug("ext4 move extent: moved_len should be 0 "
-			"[ino:orig %lu, donor %lu]\n", orig_inode->i_ino,
-			donor_inode->i_ino);
-		return -EINVAL;
-	}
-
 	if ((orig_start > MAX_DEFRAG_SIZE) ||
 	    (donor_start > MAX_DEFRAG_SIZE) ||
 	    (*len > MAX_DEFRAG_SIZE) ||
@@ -971,43 +1015,47 @@
 	}
 
 	if (orig_inode->i_size > donor_inode->i_size) {
-		if (orig_start >= donor_inode->i_size) {
+		donor_blocks = (donor_inode->i_size + blocksize - 1) >> blkbits;
+		/* TODO: eliminate this artificial restriction */
+		if (orig_start >= donor_blocks) {
 			ext4_debug("ext4 move extent: orig start offset "
-			"[%llu] should be less than donor file size "
-			"[%lld] [ino:orig %lu, donor_inode %lu]\n",
-			orig_start, donor_inode->i_size,
+			"[%llu] should be less than donor file blocks "
+			"[%u] [ino:orig %lu, donor %lu]\n",
+			orig_start, donor_blocks,
 			orig_inode->i_ino, donor_inode->i_ino);
 			return -EINVAL;
 		}
 
-		if (orig_start + *len > donor_inode->i_size) {
+		/* TODO: eliminate this artificial restriction */
+		if (orig_start + *len > donor_blocks) {
 			ext4_debug("ext4 move extent: End offset [%llu] should "
-				"be less than donor file size [%lld]."
-				"So adjust length from %llu to %lld "
+				"be less than donor file blocks [%u]."
+				"So adjust length from %llu to %llu "
 				"[ino:orig %lu, donor %lu]\n",
-				orig_start + *len, donor_inode->i_size,
-				*len, donor_inode->i_size - orig_start,
+				orig_start + *len, donor_blocks,
+				*len, donor_blocks - orig_start,
 				orig_inode->i_ino, donor_inode->i_ino);
-			*len = donor_inode->i_size - orig_start;
+			*len = donor_blocks - orig_start;
 		}
 	} else {
-		if (orig_start >= orig_inode->i_size) {
+		orig_blocks = (orig_inode->i_size + blocksize - 1) >> blkbits;
+		if (orig_start >= orig_blocks) {
 			ext4_debug("ext4 move extent: start offset [%llu] "
-				"should be less than original file size "
-				"[%lld] [inode:orig %lu, donor %lu]\n",
-				 orig_start, orig_inode->i_size,
+				"should be less than original file blocks "
+				"[%u] [ino:orig %lu, donor %lu]\n",
+				 orig_start, orig_blocks,
 				orig_inode->i_ino, donor_inode->i_ino);
 			return -EINVAL;
 		}
 
-		if (orig_start + *len > orig_inode->i_size) {
+		if (orig_start + *len > orig_blocks) {
 			ext4_debug("ext4 move extent: Adjust length "
-				"from %llu to %lld. Because it should be "
-				"less than original file size "
+				"from %llu to %llu. Because it should be "
+				"less than original file blocks "
 				"[ino:orig %lu, donor %lu]\n",
-				*len, orig_inode->i_size - orig_start,
+				*len, orig_blocks - orig_start,
 				orig_inode->i_ino, donor_inode->i_ino);
-			*len = orig_inode->i_size - orig_start;
+			*len = orig_blocks - orig_start;
 		}
 	}
 
@@ -1027,18 +1075,23 @@
  * @inode1:	the inode structure
  * @inode2:	the inode structure
  *
- * Lock two inodes' i_mutex by i_ino order. This function is moved from
- * fs/inode.c.
+ * Lock two inodes' i_mutex by i_ino order.
+ * If inode1 or inode2 is NULL, return -EIO. Otherwise, return 0.
  */
-static void
+static int
 mext_inode_double_lock(struct inode *inode1, struct inode *inode2)
 {
-	if (inode1 == NULL || inode2 == NULL || inode1 == inode2) {
-		if (inode1)
-			mutex_lock(&inode1->i_mutex);
-		else if (inode2)
-			mutex_lock(&inode2->i_mutex);
-		return;
+	int ret = 0;
+
+	BUG_ON(inode1 == NULL && inode2 == NULL);
+
+	ret = mext_check_null_inode(inode1, inode2, __func__);
+	if (ret < 0)
+		goto out;
+
+	if (inode1 == inode2) {
+		mutex_lock(&inode1->i_mutex);
+		goto out;
 	}
 
 	if (inode1->i_ino < inode2->i_ino) {
@@ -1048,6 +1101,9 @@
 		mutex_lock_nested(&inode2->i_mutex, I_MUTEX_PARENT);
 		mutex_lock_nested(&inode1->i_mutex, I_MUTEX_CHILD);
 	}
+
+out:
+	return ret;
 }
 
 /**
@@ -1056,17 +1112,28 @@
  * @inode1:     the inode that is released first
  * @inode2:     the inode that is released second
  *
- * This function is moved from fs/inode.c.
+ * If inode1 or inode2 is NULL, return -EIO. Otherwise, return 0.
  */
 
-static void
+static int
 mext_inode_double_unlock(struct inode *inode1, struct inode *inode2)
 {
+	int ret = 0;
+
+	BUG_ON(inode1 == NULL && inode2 == NULL);
+
+	ret = mext_check_null_inode(inode1, inode2, __func__);
+	if (ret < 0)
+		goto out;
+
 	if (inode1)
 		mutex_unlock(&inode1->i_mutex);
 
 	if (inode2 && inode2 != inode1)
 		mutex_unlock(&inode2->i_mutex);
+
+out:
+	return ret;
 }
 
 /**
@@ -1123,70 +1190,84 @@
 	ext4_lblk_t block_end, seq_start, add_blocks, file_end, seq_blocks = 0;
 	ext4_lblk_t rest_blocks;
 	pgoff_t orig_page_offset = 0, seq_end_page;
-	int ret, depth, last_extent = 0;
+	int ret1, ret2, depth, last_extent = 0;
 	int blocks_per_page = PAGE_CACHE_SIZE >> orig_inode->i_blkbits;
 	int data_offset_in_page;
 	int block_len_in_page;
 	int uninit;
 
-	/* protect orig and donor against a truncate */
-	mext_inode_double_lock(orig_inode, donor_inode);
+	/* orig and donor should be different file */
+	if (orig_inode->i_ino == donor_inode->i_ino) {
+		ext4_debug("ext4 move extent: The argument files should not "
+			"be same file [ino:orig %lu, donor %lu]\n",
+			orig_inode->i_ino, donor_inode->i_ino);
+		return -EINVAL;
+	}
+
+	/* Protect orig and donor inodes against a truncate */
+	ret1 = mext_inode_double_lock(orig_inode, donor_inode);
+	if (ret1 < 0)
+		return ret1;
 
-	mext_double_down_read(orig_inode, donor_inode);
+	/* Protect extent tree against block allocations via delalloc */
+	double_down_write_data_sem(orig_inode, donor_inode);
 	/* Check the filesystem environment whether move_extent can be done */
-	ret = mext_check_arguments(orig_inode, donor_inode, orig_start,
-					donor_start, &len, *moved_len);
-	mext_double_up_read(orig_inode, donor_inode);
-	if (ret)
-		goto out2;
+	ret1 = mext_check_arguments(orig_inode, donor_inode, orig_start,
+				    donor_start, &len);
+	if (ret1)
+		goto out;
 
 	file_end = (i_size_read(orig_inode) - 1) >> orig_inode->i_blkbits;
 	block_end = block_start + len - 1;
 	if (file_end < block_end)
 		len -= block_end - file_end;
 
-	get_ext_path(orig_path, orig_inode, block_start, ret);
-	if (orig_path == NULL)
-		goto out2;
+	ret1 = get_ext_path(orig_inode, block_start, &orig_path);
+	if (ret1)
+		goto out;
 
 	/* Get path structure to check the hole */
-	get_ext_path(holecheck_path, orig_inode, block_start, ret);
-	if (holecheck_path == NULL)
+	ret1 = get_ext_path(orig_inode, block_start, &holecheck_path);
+	if (ret1)
 		goto out;
 
 	depth = ext_depth(orig_inode);
 	ext_cur = holecheck_path[depth].p_ext;
-	if (ext_cur == NULL) {
-		ret = -EINVAL;
-		goto out;
-	}
 
 	/*
-	 * Get proper extent whose ee_block is beyond block_start
-	 * if block_start was within the hole.
+	 * Get proper starting location of block replacement if block_start was
+	 * within the hole.
 	 */
 	if (le32_to_cpu(ext_cur->ee_block) +
 		ext4_ext_get_actual_len(ext_cur) - 1 < block_start) {
+		/*
+		 * The hole exists between extents or the tail of
+		 * original file.
+		 */
 		last_extent = mext_next_extent(orig_inode,
 					holecheck_path, &ext_cur);
 		if (last_extent < 0) {
-			ret = last_extent;
+			ret1 = last_extent;
 			goto out;
 		}
 		last_extent = mext_next_extent(orig_inode, orig_path,
 							&ext_dummy);
 		if (last_extent < 0) {
-			ret = last_extent;
+			ret1 = last_extent;
 			goto out;
 		}
-	}
-	seq_start = block_start;
+		seq_start = le32_to_cpu(ext_cur->ee_block);
+	} else if (le32_to_cpu(ext_cur->ee_block) > block_start)
+		/* The hole exists at the beginning of original file. */
+		seq_start = le32_to_cpu(ext_cur->ee_block);
+	else
+		seq_start = block_start;
 
 	/* No blocks within the specified range. */
 	if (le32_to_cpu(ext_cur->ee_block) > block_end) {
 		ext4_debug("ext4 move extent: The specified range of file "
 							"may be the hole\n");
-		ret = -EINVAL;
+		ret1 = -EINVAL;
 		goto out;
 	}
 
@@ -1206,7 +1287,7 @@
 		last_extent = mext_next_extent(orig_inode, holecheck_path,
 						&ext_cur);
 		if (last_extent < 0) {
-			ret = last_extent;
+			ret1 = last_extent;
 			break;
 		}
 		add_blocks = ext4_ext_get_actual_len(ext_cur);
@@ -1246,29 +1327,39 @@
 		seq_start = le32_to_cpu(ext_cur->ee_block);
 		rest_blocks = seq_blocks;
 
-		/* Discard preallocations of two inodes */
-		down_write(&EXT4_I(orig_inode)->i_data_sem);
-		ext4_discard_preallocations(orig_inode);
-		up_write(&EXT4_I(orig_inode)->i_data_sem);
-
-		down_write(&EXT4_I(donor_inode)->i_data_sem);
-		ext4_discard_preallocations(donor_inode);
-		up_write(&EXT4_I(donor_inode)->i_data_sem);
+		/*
+		 * Up semaphore to avoid following problems:
+		 * a. transaction deadlock among ext4_journal_start,
+		 *    ->write_begin via pagefault, and jbd2_journal_commit
+		 * b. racing with ->readpage, ->write_begin, and ext4_get_block
+		 *    in move_extent_per_page
+		 */
+		double_up_write_data_sem(orig_inode, donor_inode);
 
 		while (orig_page_offset <= seq_end_page) {
 
 			/* Swap original branches with new branches */
-			ret = move_extent_par_page(o_filp, donor_inode,
+			block_len_in_page = move_extent_per_page(
+						o_filp, donor_inode,
 						orig_page_offset,
 						data_offset_in_page,
-						block_len_in_page, uninit);
-			if (ret < 0)
-				goto out;
-			orig_page_offset++;
+						block_len_in_page, uninit,
+						&ret1);
+
 			/* Count how many blocks we have exchanged */
 			*moved_len += block_len_in_page;
-			BUG_ON(*moved_len > len);
+			if (ret1 < 0)
+				break;
+			if (*moved_len > len) {
+				ext4_error(orig_inode->i_sb, __func__,
+					"We replaced blocks too much! "
+					"sum of replaced: %llu requested: %llu",
+					*moved_len, len);
+				ret1 = -EIO;
+				break;
+			}
 
+			orig_page_offset++;
 			data_offset_in_page = 0;
 			rest_blocks -= block_len_in_page;
 			if (rest_blocks > blocks_per_page)
@@ -1277,20 +1368,23 @@
 				block_len_in_page = rest_blocks;
 		}
 
+		double_down_write_data_sem(orig_inode, donor_inode);
+		if (ret1 < 0)
+			break;
+
 		/* Decrease buffer counter */
 		if (holecheck_path)
 			ext4_ext_drop_refs(holecheck_path);
-		get_ext_path(holecheck_path, orig_inode,
-				      seq_start, ret);
-		if (holecheck_path == NULL)
+		ret1 = get_ext_path(orig_inode, seq_start, &holecheck_path);
+		if (ret1)
 			break;
 		depth = holecheck_path->p_depth;
 
 		/* Decrease buffer counter */
 		if (orig_path)
 			ext4_ext_drop_refs(orig_path);
-		get_ext_path(orig_path, orig_inode, seq_start, ret);
-		if (orig_path == NULL)
+		ret1 = get_ext_path(orig_inode, seq_start, &orig_path);
+		if (ret1)
 			break;
 
 		ext_cur = holecheck_path[depth].p_ext;
@@ -1299,6 +1393,11 @@
 
 	}
 out:
+	if (*moved_len) {
+		ext4_discard_preallocations(orig_inode);
+		ext4_discard_preallocations(donor_inode);
+	}
+
 	if (orig_path) {
 		ext4_ext_drop_refs(orig_path);
 		kfree(orig_path);
@@ -1307,14 +1406,13 @@
 		ext4_ext_drop_refs(holecheck_path);
 		kfree(holecheck_path);
 	}
-out2:
-	mext_inode_double_unlock(orig_inode, donor_inode);
-
-	if (ret)
-		return ret;
+	double_up_write_data_sem(orig_inode, donor_inode);
+	ret2 = mext_inode_double_unlock(orig_inode, donor_inode);
 
-	/* All of the specified blocks must be exchanged in succeed */
-	BUG_ON(*moved_len != len);
+	if (ret1)
+		return ret1;
+	else if (ret2)
+		return ret2;
 
 	return 0;
 }
--- linux-rt-2.6.31.orig/fs/ext4/block_validity.c
+++ linux-rt-2.6.31/fs/ext4/block_validity.c
@@ -160,7 +160,7 @@
 		if (ext4_bg_has_super(sb, i) &&
 		    ((i < 5) || ((i % flex_size) == 0)))
 			add_system_zone(sbi, ext4_group_first_block_no(sb, i),
-					sbi->s_gdb_count + 1);
+					ext4_bg_num_gdb(sb, i) + 1);
 		gdp = ext4_get_group_desc(sb, i, NULL);
 		ret = add_system_zone(sbi, ext4_block_bitmap(sb, gdp), 1);
 		if (ret)
--- linux-rt-2.6.31.orig/fs/ext4/inode.c
+++ linux-rt-2.6.31/fs/ext4/inode.c
@@ -37,6 +37,7 @@
 #include <linux/namei.h>
 #include <linux/uio.h>
 #include <linux/bio.h>
+#include <linux/workqueue.h>
 
 #include "ext4_jbd2.h"
 #include "xattr.h"
@@ -192,11 +193,25 @@
  * so before we call here everything must be consistently dirtied against
  * this transaction.
  */
-static int ext4_journal_test_restart(handle_t *handle, struct inode *inode)
+int ext4_truncate_restart_trans(handle_t *handle, struct inode *inode,
+				 int nblocks)
 {
+	int ret;
+
+	/*
+	 * Drop i_data_sem to avoid deadlock with ext4_get_blocks At this
+	 * moment, get_block can be called only for blocks inside i_size since
+	 * page cache has been already dropped and writes are blocked by
+	 * i_mutex. So we can safely drop the i_data_sem here.
+	 */
 	BUG_ON(EXT4_JOURNAL(inode) == NULL);
 	jbd_debug(2, "restarting handle %p\n", handle);
-	return ext4_journal_restart(handle, blocks_for_truncate(inode));
+	up_write(&EXT4_I(inode)->i_data_sem);
+	ret = ext4_journal_restart(handle, blocks_for_truncate(inode));
+	down_write(&EXT4_I(inode)->i_data_sem);
+	ext4_discard_preallocations(inode);
+
+	return ret;
 }
 
 /*
@@ -551,15 +566,21 @@
  *
  *	Normally this function find the preferred place for block allocation,
  *	returns it.
+ *	Because this is only used for non-extent files, we limit the block nr
+ *	to 32 bits.
  */
 static ext4_fsblk_t ext4_find_goal(struct inode *inode, ext4_lblk_t block,
 				   Indirect *partial)
 {
+	ext4_fsblk_t goal;
+
 	/*
 	 * XXX need to get goal block from mballoc's data structures
 	 */
 
-	return ext4_find_near(inode, partial);
+	goal = ext4_find_near(inode, partial);
+	goal = goal & EXT4_MAX_BLOCK_FILE_PHYS;
+	return goal;
 }
 
 /**
@@ -640,6 +661,8 @@
 		if (*err)
 			goto failed_out;
 
+		BUG_ON(current_block + count > EXT4_MAX_BLOCK_FILE_PHYS);
+
 		target -= count;
 		/* allocate blocks for indirect blocks */
 		while (index < indirect_blks && count) {
@@ -674,6 +697,7 @@
 		ar.flags = EXT4_MB_HINT_DATA;
 
 	current_block = ext4_mb_new_blocks(handle, &ar, err);
+	BUG_ON(current_block + ar.len > EXT4_MAX_BLOCK_FILE_PHYS);
 
 	if (*err && (target == blks)) {
 		/*
@@ -998,10 +1022,12 @@
 	if (!err)
 		err = ext4_splice_branch(handle, inode, iblock,
 					 partial, indirect_blks, count);
-	else
+	if (err)
 		goto cleanup;
 
 	set_buffer_new(bh_result);
+
+	ext4_update_inode_fsync_trans(handle, inode, 1);
 got_it:
 	map_bh(bh_result, inode->i_sb, le32_to_cpu(chain[depth-1].key));
 	if (count > blocks_to_boundary)
@@ -1020,17 +1046,12 @@
 	return err;
 }
 
-qsize_t ext4_get_reserved_space(struct inode *inode)
+#ifdef CONFIG_QUOTA
+qsize_t *ext4_get_reserved_space(struct inode *inode)
 {
-	unsigned long long total;
-
-	spin_lock(&EXT4_I(inode)->i_block_reservation_lock);
-	total = EXT4_I(inode)->i_reserved_data_blocks +
-		EXT4_I(inode)->i_reserved_meta_blocks;
-	spin_unlock(&EXT4_I(inode)->i_block_reservation_lock);
-
-	return total;
+	return &EXT4_I(inode)->i_reserved_quota;
 }
+#endif
 /*
  * Calculate the number of metadata blocks need to reserve
  * to allocate @blocks for non extent file based file
@@ -1109,22 +1130,79 @@
 		ext4_discard_preallocations(inode);
 }
 
-static int check_block_validity(struct inode *inode, sector_t logical,
-				sector_t phys, int len)
+static int check_block_validity(struct inode *inode, const char *msg,
+				sector_t logical, sector_t phys, int len)
 {
 	if (!ext4_data_block_valid(EXT4_SB(inode->i_sb), phys, len)) {
-		ext4_error(inode->i_sb, "check_block_validity",
+		ext4_error(inode->i_sb, msg,
 			   "inode #%lu logical block %llu mapped to %llu "
 			   "(size %d)", inode->i_ino,
 			   (unsigned long long) logical,
 			   (unsigned long long) phys, len);
-		WARN_ON(1);
 		return -EIO;
 	}
 	return 0;
 }
 
 /*
+ * Return the number of contiguous dirty pages in a given inode
+ * starting at page frame idx.
+ */
+static pgoff_t ext4_num_dirty_pages(struct inode *inode, pgoff_t idx,
+				    unsigned int max_pages)
+{
+	struct address_space *mapping = inode->i_mapping;
+	pgoff_t	index;
+	struct pagevec pvec;
+	pgoff_t num = 0;
+	int i, nr_pages, done = 0;
+
+	if (max_pages == 0)
+		return 0;
+	pagevec_init(&pvec, 0);
+	while (!done) {
+		index = idx;
+		nr_pages = pagevec_lookup_tag(&pvec, mapping, &index,
+					      PAGECACHE_TAG_DIRTY,
+					      (pgoff_t)PAGEVEC_SIZE);
+		if (nr_pages == 0)
+			break;
+		for (i = 0; i < nr_pages; i++) {
+			struct page *page = pvec.pages[i];
+			struct buffer_head *bh, *head;
+
+			lock_page(page);
+			if (unlikely(page->mapping != mapping) ||
+			    !PageDirty(page) ||
+			    PageWriteback(page) ||
+			    page->index != idx) {
+				done = 1;
+				unlock_page(page);
+				break;
+			}
+			if (page_has_buffers(page)) {
+				bh = head = page_buffers(page);
+				do {
+					if (!buffer_delay(bh) &&
+					    !buffer_unwritten(bh))
+						done = 1;
+					bh = bh->b_this_page;
+				} while (!done && (bh != head));
+			}
+			unlock_page(page);
+			if (done)
+				break;
+			idx++;
+			num++;
+			if (num >= max_pages)
+				break;
+		}
+		pagevec_release(&pvec);
+	}
+	return num;
+}
+
+/*
  * The ext4_get_blocks() function tries to look up the requested blocks,
  * and returns if the blocks are already mapped.
  *
@@ -1155,6 +1233,9 @@
 	clear_buffer_mapped(bh);
 	clear_buffer_unwritten(bh);
 
+	ext_debug("ext4_get_blocks(): inode %lu, flag %d, max_blocks %u,"
+		  "logical block %lu\n", inode->i_ino, flags, max_blocks,
+		  (unsigned long)block);
 	/*
 	 * Try to see if we can get the block without requesting a new
 	 * file system block.
@@ -1170,8 +1251,8 @@
 	up_read((&EXT4_I(inode)->i_data_sem));
 
 	if (retval > 0 && buffer_mapped(bh)) {
-		int ret = check_block_validity(inode, block,
-					       bh->b_blocknr, retval);
+		int ret = check_block_validity(inode, "file system corruption",
+					       block, bh->b_blocknr, retval);
 		if (ret != 0)
 			return ret;
 	}
@@ -1235,8 +1316,7 @@
 			 * i_data's format changing.  Force the migrate
 			 * to fail by clearing migrate flags
 			 */
-			EXT4_I(inode)->i_flags = EXT4_I(inode)->i_flags &
-							~EXT4_EXT_MIGRATE;
+			EXT4_I(inode)->i_state &= ~EXT4_STATE_EXT_MIGRATE;
 		}
 	}
 
@@ -1252,8 +1332,9 @@
 
 	up_write((&EXT4_I(inode)->i_data_sem));
 	if (retval > 0 && buffer_mapped(bh)) {
-		int ret = check_block_validity(inode, block,
-					       bh->b_blocknr, retval);
+		int ret = check_block_validity(inode, "file system "
+					       "corruption after allocation",
+					       block, bh->b_blocknr, retval);
 		if (ret != 0)
 			return ret;
 	}
@@ -1451,6 +1532,16 @@
 	return ext4_journal_get_write_access(handle, bh);
 }
 
+/*
+ * Truncate blocks that were not used by write. We have to truncate the
+ * pagecache as well so that corresponding buffers get properly unmapped.
+ */
+static void ext4_truncate_failed_write(struct inode *inode)
+{
+	truncate_inode_pages(inode->i_mapping, inode->i_size);
+	ext4_truncate(inode);
+}
+
 static int ext4_write_begin(struct file *file, struct address_space *mapping,
 			    loff_t pos, unsigned len, unsigned flags,
 			    struct page **pagep, void **fsdata)
@@ -1516,7 +1607,7 @@
 
 		ext4_journal_stop(handle);
 		if (pos + len > inode->i_size) {
-			ext4_truncate(inode);
+			ext4_truncate_failed_write(inode);
 			/*
 			 * If truncate failed early the inode might
 			 * still be on the orphan list; we need to
@@ -1626,7 +1717,7 @@
 		ret = ret2;
 
 	if (pos + len > inode->i_size) {
-		ext4_truncate(inode);
+		ext4_truncate_failed_write(inode);
 		/*
 		 * If truncate failed early the inode might still be
 		 * on the orphan list; we need to make sure the inode
@@ -1668,7 +1759,7 @@
 		ret = ret2;
 
 	if (pos + len > inode->i_size) {
-		ext4_truncate(inode);
+		ext4_truncate_failed_write(inode);
 		/*
 		 * If truncate failed early the inode might still be
 		 * on the orphan list; we need to make sure the inode
@@ -1731,7 +1822,7 @@
 	if (!ret)
 		ret = ret2;
 	if (pos + len > inode->i_size) {
-		ext4_truncate(inode);
+		ext4_truncate_failed_write(inode);
 		/*
 		 * If truncate failed early the inode might still be
 		 * on the orphan list; we need to make sure the inode
@@ -1763,30 +1854,29 @@
 
 	md_needed = mdblocks - EXT4_I(inode)->i_reserved_meta_blocks;
 	total = md_needed + nrblocks;
+	spin_unlock(&EXT4_I(inode)->i_block_reservation_lock);
 
 	/*
 	 * Make quota reservation here to prevent quota overflow
 	 * later. Real quota accounting is done at pages writeout
 	 * time.
 	 */
-	if (vfs_dq_reserve_block(inode, total)) {
-		spin_unlock(&EXT4_I(inode)->i_block_reservation_lock);
+	if (vfs_dq_reserve_block(inode, total))
 		return -EDQUOT;
-	}
 
 	if (ext4_claim_free_blocks(sbi, total)) {
-		spin_unlock(&EXT4_I(inode)->i_block_reservation_lock);
+		vfs_dq_release_reservation_block(inode, total);
 		if (ext4_should_retry_alloc(inode->i_sb, &retries)) {
 			yield();
 			goto repeat;
 		}
-		vfs_dq_release_reservation_block(inode, total);
 		return -ENOSPC;
 	}
+	spin_lock(&EXT4_I(inode)->i_block_reservation_lock);
 	EXT4_I(inode)->i_reserved_data_blocks += nrblocks;
-	EXT4_I(inode)->i_reserved_meta_blocks = mdblocks;
-
+	EXT4_I(inode)->i_reserved_meta_blocks += md_needed;
 	spin_unlock(&EXT4_I(inode)->i_block_reservation_lock);
+
 	return 0;       /* success */
 }
 
@@ -1860,22 +1950,6 @@
 }
 
 /*
- * Delayed allocation stuff
- */
-
-struct mpage_da_data {
-	struct inode *inode;
-	sector_t b_blocknr;		/* start block number of extent */
-	size_t b_size;			/* size of extent */
-	unsigned long b_state;		/* state of the extent */
-	unsigned long first_page, next_page;	/* extent of pages */
-	struct writeback_control *wbc;
-	int io_done;
-	int pages_written;
-	int retval;
-};
-
-/*
  * mpage_da_submit_io - walks through extent of pages and try to write
  * them with writepage() call back
  *
@@ -2717,7 +2791,7 @@
 	 * number of contiguous block. So we will limit
 	 * number of contiguous block to a sane value
 	 */
-	if (!(inode->i_flags & EXT4_EXTENTS_FL) &&
+	if (!(EXT4_I(inode)->i_flags & EXT4_EXTENTS_FL) &&
 	    (max_blocks > EXT4_MAX_TRANS_DATA))
 		max_blocks = EXT4_MAX_TRANS_DATA;
 
@@ -2735,8 +2809,11 @@
 	int no_nrwrite_index_update;
 	int pages_written = 0;
 	long pages_skipped;
+	unsigned int max_pages;
 	int range_cyclic, cycled = 1, io_done = 0;
-	int needed_blocks, ret = 0, nr_to_writebump = 0;
+	int needed_blocks, ret = 0;
+	long desired_nr_to_write, nr_to_writebump = 0;
+	loff_t range_start = wbc->range_start;
 	struct ext4_sb_info *sbi = EXT4_SB(mapping->host->i_sb);
 
 	trace_ext4_da_writepages(inode, wbc);
@@ -2762,16 +2839,6 @@
 	if (unlikely(sbi->s_mount_flags & EXT4_MF_FS_ABORTED))
 		return -EROFS;
 
-	/*
-	 * Make sure nr_to_write is >= sbi->s_mb_stream_request
-	 * This make sure small files blocks are allocated in
-	 * single attempt. This ensure that small files
-	 * get less fragmented.
-	 */
-	if (wbc->nr_to_write < sbi->s_mb_stream_request) {
-		nr_to_writebump = sbi->s_mb_stream_request - wbc->nr_to_write;
-		wbc->nr_to_write = sbi->s_mb_stream_request;
-	}
 	if (wbc->range_start == 0 && wbc->range_end == LLONG_MAX)
 		range_whole = 1;
 
@@ -2786,6 +2853,36 @@
 	} else
 		index = wbc->range_start >> PAGE_CACHE_SHIFT;
 
+	/*
+	 * This works around two forms of stupidity.  The first is in
+	 * the writeback code, which caps the maximum number of pages
+	 * written to be 1024 pages.  This is wrong on multiple
+	 * levels; different architectues have a different page size,
+	 * which changes the maximum amount of data which gets
+	 * written.  Secondly, 4 megabytes is way too small.  XFS
+	 * forces this value to be 16 megabytes by multiplying
+	 * nr_to_write parameter by four, and then relies on its
+	 * allocator to allocate larger extents to make them
+	 * contiguous.  Unfortunately this brings us to the second
+	 * stupidity, which is that ext4's mballoc code only allocates
+	 * at most 2048 blocks.  So we force contiguous writes up to
+	 * the number of dirty blocks in the inode, or
+	 * sbi->max_writeback_mb_bump whichever is smaller.
+	 */
+	max_pages = sbi->s_max_writeback_mb_bump << (20 - PAGE_CACHE_SHIFT);
+	if (!range_cyclic && range_whole)
+		desired_nr_to_write = wbc->nr_to_write * 8;
+	else
+		desired_nr_to_write = ext4_num_dirty_pages(inode, index,
+							   max_pages);
+	if (desired_nr_to_write > max_pages)
+		desired_nr_to_write = max_pages;
+
+	if (wbc->nr_to_write < desired_nr_to_write) {
+		nr_to_writebump = desired_nr_to_write - wbc->nr_to_write;
+		wbc->nr_to_write = desired_nr_to_write;
+	}
+
 	mpd.wbc = wbc;
 	mpd.inode = mapping->host;
 
@@ -2904,7 +3001,9 @@
 out_writepages:
 	if (!no_nrwrite_index_update)
 		wbc->no_nrwrite_index_update = 0;
-	wbc->nr_to_write -= nr_to_writebump;
+	if (wbc->nr_to_write > nr_to_writebump)
+		wbc->nr_to_write -= nr_to_writebump;
+	wbc->range_start = range_start;
 	trace_ext4_da_writepages_result(inode, wbc, ret, pages_written);
 	return ret;
 }
@@ -2994,7 +3093,7 @@
 		 * i_size_read because we hold i_mutex.
 		 */
 		if (pos + len > inode->i_size)
-			ext4_truncate(inode);
+			ext4_truncate_failed_write(inode);
 	}
 
 	if (ret == -ENOSPC && ext4_should_retry_alloc(inode->i_sb, &retries))
@@ -3259,6 +3358,8 @@
 }
 
 /*
+ * O_DIRECT for ext3 (or indirect map) based files
+ *
  * If the O_DIRECT write will extend the file then add this inode to the
  * orphan list.  So recovery will truncate it back to the original size
  * if the machine crashes during the write.
@@ -3267,7 +3368,7 @@
  * crashes then stale disk data _may_ be exposed inside the file. But current
  * VFS code falls back into buffered path in that case so we are safe.
  */
-static ssize_t ext4_direct_IO(int rw, struct kiocb *iocb,
+static ssize_t ext4_ind_direct_IO(int rw, struct kiocb *iocb,
 			      const struct iovec *iov, loff_t offset,
 			      unsigned long nr_segs)
 {
@@ -3278,6 +3379,7 @@
 	ssize_t ret;
 	int orphan = 0;
 	size_t count = iov_length(iov, nr_segs);
+	int retries = 0;
 
 	if (rw == WRITE) {
 		loff_t final_size = offset + count;
@@ -3300,9 +3402,12 @@
 		}
 	}
 
+retry:
 	ret = blockdev_direct_IO(rw, iocb, inode, inode->i_sb->s_bdev, iov,
 				 offset, nr_segs,
 				 ext4_get_block, NULL);
+	if (ret == -ENOSPC && ext4_should_retry_alloc(inode->i_sb, &retries))
+		goto retry;
 
 	if (orphan) {
 		int err;
@@ -3341,6 +3446,364 @@
 	return ret;
 }
 
+static int ext4_get_block_dio_write(struct inode *inode, sector_t iblock,
+		   struct buffer_head *bh_result, int create)
+{
+	handle_t *handle = NULL;
+	int ret = 0;
+	unsigned max_blocks = bh_result->b_size >> inode->i_blkbits;
+	int dio_credits;
+
+	ext4_debug("ext4_get_block_dio_write: inode %lu, create flag %d\n",
+		   inode->i_ino, create);
+	/*
+	 * DIO VFS code passes create = 0 flag for write to
+	 * the middle of file. It does this to avoid block
+	 * allocation for holes, to prevent expose stale data
+	 * out when there is parallel buffered read (which does
+	 * not hold the i_mutex lock) while direct IO write has
+	 * not completed. DIO request on holes finally falls back
+	 * to buffered IO for this reason.
+	 *
+	 * For ext4 extent based file, since we support fallocate,
+	 * new allocated extent as uninitialized, for holes, we
+	 * could fallocate blocks for holes, thus parallel
+	 * buffered IO read will zero out the page when read on
+	 * a hole while parallel DIO write to the hole has not completed.
+	 *
+	 * when we come here, we know it's a direct IO write to
+	 * to the middle of file (<i_size)
+	 * so it's safe to override the create flag from VFS.
+	 */
+	create = EXT4_GET_BLOCKS_DIO_CREATE_EXT;
+
+	if (max_blocks > DIO_MAX_BLOCKS)
+		max_blocks = DIO_MAX_BLOCKS;
+	dio_credits = ext4_chunk_trans_blocks(inode, max_blocks);
+	handle = ext4_journal_start(inode, dio_credits);
+	if (IS_ERR(handle)) {
+		ret = PTR_ERR(handle);
+		goto out;
+	}
+	ret = ext4_get_blocks(handle, inode, iblock, max_blocks, bh_result,
+			      create);
+	if (ret > 0) {
+		bh_result->b_size = (ret << inode->i_blkbits);
+		ret = 0;
+	}
+	ext4_journal_stop(handle);
+out:
+	return ret;
+}
+
+static void ext4_free_io_end(ext4_io_end_t *io)
+{
+	BUG_ON(!io);
+	iput(io->inode);
+	kfree(io);
+}
+static void dump_aio_dio_list(struct inode * inode)
+{
+#ifdef	EXT4_DEBUG
+	struct list_head *cur, *before, *after;
+	ext4_io_end_t *io, *io0, *io1;
+
+	if (list_empty(&EXT4_I(inode)->i_aio_dio_complete_list)){
+		ext4_debug("inode %lu aio dio list is empty\n", inode->i_ino);
+		return;
+	}
+
+	ext4_debug("Dump inode %lu aio_dio_completed_IO list \n", inode->i_ino);
+	list_for_each_entry(io, &EXT4_I(inode)->i_aio_dio_complete_list, list){
+		cur = &io->list;
+		before = cur->prev;
+		io0 = container_of(before, ext4_io_end_t, list);
+		after = cur->next;
+		io1 = container_of(after, ext4_io_end_t, list);
+
+		ext4_debug("io 0x%p from inode %lu,prev 0x%p,next 0x%p\n",
+			    io, inode->i_ino, io0, io1);
+	}
+#endif
+}
+
+/*
+ * check a range of space and convert unwritten extents to written.
+ */
+static int ext4_end_aio_dio_nolock(ext4_io_end_t *io)
+{
+	struct inode *inode = io->inode;
+	loff_t offset = io->offset;
+	size_t size = io->size;
+	int ret = 0;
+
+	ext4_debug("end_aio_dio_onlock: io 0x%p from inode %lu,list->next 0x%p,"
+		   "list->prev 0x%p\n",
+	           io, inode->i_ino, io->list.next, io->list.prev);
+
+	if (list_empty(&io->list))
+		return ret;
+
+	if (io->flag != DIO_AIO_UNWRITTEN)
+		return ret;
+
+	if (offset + size <= i_size_read(inode))
+		ret = ext4_convert_unwritten_extents(inode, offset, size);
+
+	if (ret < 0) {
+		printk(KERN_EMERG "%s: failed to convert unwritten"
+			"extents to written extents, error is %d"
+			" io is still on inode %lu aio dio list\n",
+                       __func__, ret, inode->i_ino);
+		return ret;
+	}
+
+	/* clear the DIO AIO unwritten flag */
+	io->flag = 0;
+	return ret;
+}
+/*
+ * work on completed aio dio IO, to convert unwritten extents to extents
+ */
+static void ext4_end_aio_dio_work(struct work_struct *work)
+{
+	ext4_io_end_t *io  = container_of(work, ext4_io_end_t, work);
+	struct inode *inode = io->inode;
+	int ret = 0;
+
+	mutex_lock(&inode->i_mutex);
+	ret = ext4_end_aio_dio_nolock(io);
+	if (ret >= 0) {
+		if (!list_empty(&io->list))
+			list_del_init(&io->list);
+		ext4_free_io_end(io);
+	}
+	mutex_unlock(&inode->i_mutex);
+}
+/*
+ * This function is called from ext4_sync_file().
+ *
+ * When AIO DIO IO is completed, the work to convert unwritten
+ * extents to written is queued on workqueue but may not get immediately
+ * scheduled. When fsync is called, we need to ensure the
+ * conversion is complete before fsync returns.
+ * The inode keeps track of a list of completed AIO from DIO path
+ * that might needs to do the conversion. This function walks through
+ * the list and convert the related unwritten extents to written.
+ */
+int flush_aio_dio_completed_IO(struct inode *inode)
+{
+	ext4_io_end_t *io;
+	int ret = 0;
+	int ret2 = 0;
+
+	if (list_empty(&EXT4_I(inode)->i_aio_dio_complete_list))
+		return ret;
+
+	dump_aio_dio_list(inode);
+	while (!list_empty(&EXT4_I(inode)->i_aio_dio_complete_list)){
+		io = list_entry(EXT4_I(inode)->i_aio_dio_complete_list.next,
+				ext4_io_end_t, list);
+		/*
+		 * Calling ext4_end_aio_dio_nolock() to convert completed
+		 * IO to written.
+		 *
+		 * When ext4_sync_file() is called, run_queue() may already
+		 * about to flush the work corresponding to this io structure.
+		 * It will be upset if it founds the io structure related
+		 * to the work-to-be schedule is freed.
+		 *
+		 * Thus we need to keep the io structure still valid here after
+		 * convertion finished. The io structure has a flag to
+		 * avoid double converting from both fsync and background work
+		 * queue work.
+		 */
+		ret = ext4_end_aio_dio_nolock(io);
+		if (ret < 0)
+			ret2 = ret;
+		else
+			list_del_init(&io->list);
+	}
+	return (ret2 < 0) ? ret2 : 0;
+}
+
+static ext4_io_end_t *ext4_init_io_end (struct inode *inode)
+{
+	ext4_io_end_t *io = NULL;
+
+	io = kmalloc(sizeof(*io), GFP_NOFS);
+
+	if (io) {
+		igrab(inode);
+		io->inode = inode;
+		io->flag = 0;
+		io->offset = 0;
+		io->size = 0;
+		io->error = 0;
+		INIT_WORK(&io->work, ext4_end_aio_dio_work);
+		INIT_LIST_HEAD(&io->list);
+	}
+
+	return io;
+}
+
+static void ext4_end_io_dio(struct kiocb *iocb, loff_t offset,
+			    ssize_t size, void *private)
+{
+        ext4_io_end_t *io_end = iocb->private;
+	struct workqueue_struct *wq;
+
+	/* if not async direct IO or dio with 0 bytes write, just return */
+	if (!io_end || !size)
+		return;
+
+	ext_debug("ext4_end_io_dio(): io_end 0x%p"
+		  "for inode %lu, iocb 0x%p, offset %llu, size %llu\n",
+ 		  iocb->private, io_end->inode->i_ino, iocb, offset,
+		  size);
+
+	/* if not aio dio with unwritten extents, just free io and return */
+	if (io_end->flag != DIO_AIO_UNWRITTEN){
+		ext4_free_io_end(io_end);
+		iocb->private = NULL;
+		return;
+	}
+
+	io_end->offset = offset;
+	io_end->size = size;
+	wq = EXT4_SB(io_end->inode->i_sb)->dio_unwritten_wq;
+
+	/* queue the work to convert unwritten extents to written */
+	queue_work(wq, &io_end->work);
+
+	/* Add the io_end to per-inode completed aio dio list*/
+	list_add_tail(&io_end->list,
+		 &EXT4_I(io_end->inode)->i_aio_dio_complete_list);
+	iocb->private = NULL;
+}
+/*
+ * For ext4 extent files, ext4 will do direct-io write to holes,
+ * preallocated extents, and those write extend the file, no need to
+ * fall back to buffered IO.
+ *
+ * For holes, we fallocate those blocks, mark them as unintialized
+ * If those blocks were preallocated, we mark sure they are splited, but
+ * still keep the range to write as unintialized.
+ *
+ * The unwrritten extents will be converted to written when DIO is completed.
+ * For async direct IO, since the IO may still pending when return, we
+ * set up an end_io call back function, which will do the convertion
+ * when async direct IO completed.
+ *
+ * If the O_DIRECT write will extend the file then add this inode to the
+ * orphan list.  So recovery will truncate it back to the original size
+ * if the machine crashes during the write.
+ *
+ */
+static ssize_t ext4_ext_direct_IO(int rw, struct kiocb *iocb,
+			      const struct iovec *iov, loff_t offset,
+			      unsigned long nr_segs)
+{
+	struct file *file = iocb->ki_filp;
+	struct inode *inode = file->f_mapping->host;
+	ssize_t ret;
+	size_t count = iov_length(iov, nr_segs);
+
+	loff_t final_size = offset + count;
+	if (rw == WRITE && final_size <= inode->i_size) {
+		/*
+ 		 * We could direct write to holes and fallocate.
+		 *
+ 		 * Allocated blocks to fill the hole are marked as uninitialized
+ 		 * to prevent paralel buffered read to expose the stale data
+ 		 * before DIO complete the data IO.
+		 *
+ 		 * As to previously fallocated extents, ext4 get_block
+ 		 * will just simply mark the buffer mapped but still
+ 		 * keep the extents uninitialized.
+ 		 *
+		 * for non AIO case, we will convert those unwritten extents
+		 * to written after return back from blockdev_direct_IO.
+		 *
+		 * for async DIO, the conversion needs to be defered when
+		 * the IO is completed. The ext4 end_io callback function
+		 * will be called to take care of the conversion work.
+		 * Here for async case, we allocate an io_end structure to
+		 * hook to the iocb.
+ 		 */
+		iocb->private = NULL;
+		EXT4_I(inode)->cur_aio_dio = NULL;
+		if (!is_sync_kiocb(iocb)) {
+			iocb->private = ext4_init_io_end(inode);
+			if (!iocb->private)
+				return -ENOMEM;
+			/*
+			 * we save the io structure for current async
+			 * direct IO, so that later ext4_get_blocks()
+			 * could flag the io structure whether there
+			 * is a unwritten extents needs to be converted
+			 * when IO is completed.
+			 */
+			EXT4_I(inode)->cur_aio_dio = iocb->private;
+		}
+
+		ret = blockdev_direct_IO(rw, iocb, inode,
+					 inode->i_sb->s_bdev, iov,
+					 offset, nr_segs,
+					 ext4_get_block_dio_write,
+					 ext4_end_io_dio);
+		if (iocb->private)
+			EXT4_I(inode)->cur_aio_dio = NULL;
+		/*
+		 * The io_end structure takes a reference to the inode,
+		 * that structure needs to be destroyed and the
+		 * reference to the inode need to be dropped, when IO is
+		 * complete, even with 0 byte write, or failed.
+		 *
+		 * In the successful AIO DIO case, the io_end structure will be
+		 * desctroyed and the reference to the inode will be dropped
+		 * after the end_io call back function is called.
+		 *
+		 * In the case there is 0 byte write, or error case, since
+		 * VFS direct IO won't invoke the end_io call back function,
+		 * we need to free the end_io structure here.
+		 */
+		if (ret != -EIOCBQUEUED && ret <= 0 && iocb->private) {
+			ext4_free_io_end(iocb->private);
+			iocb->private = NULL;
+		} else if (ret > 0 && (EXT4_I(inode)->i_state &
+				       EXT4_STATE_DIO_UNWRITTEN)) {
+			int err;
+			/*
+			 * for non AIO case, since the IO is already
+			 * completed, we could do the convertion right here
+			 */
+			err = ext4_convert_unwritten_extents(inode,
+							     offset, ret);
+			if (err < 0)
+				ret = err;
+			EXT4_I(inode)->i_state &= ~EXT4_STATE_DIO_UNWRITTEN;
+		}
+		return ret;
+	}
+
+	/* for write the the end of file case, we fall back to old way */
+	return ext4_ind_direct_IO(rw, iocb, iov, offset, nr_segs);
+}
+
+static ssize_t ext4_direct_IO(int rw, struct kiocb *iocb,
+			      const struct iovec *iov, loff_t offset,
+			      unsigned long nr_segs)
+{
+	struct file *file = iocb->ki_filp;
+	struct inode *inode = file->f_mapping->host;
+
+	if (EXT4_I(inode)->i_flags & EXT4_EXTENTS_FL)
+		return ext4_ext_direct_IO(rw, iocb, iov, offset, nr_segs);
+
+	return ext4_ind_direct_IO(rw, iocb, iov, offset, nr_segs);
+}
+
 /*
  * Pages can be marked dirty completely asynchronously from ext4's journalling
  * activity.  By filemap_sync_pte(), try_to_unmap_one(), etc.  We cannot do
@@ -3653,13 +4116,16 @@
 			      __le32 *last)
 {
 	__le32 *p;
+	int	is_metadata = S_ISDIR(inode->i_mode) || S_ISLNK(inode->i_mode);
+
 	if (try_to_extend_transaction(handle, inode)) {
 		if (bh) {
 			BUFFER_TRACE(bh, "call ext4_handle_dirty_metadata");
 			ext4_handle_dirty_metadata(handle, inode, bh);
 		}
 		ext4_mark_inode_dirty(handle, inode);
-		ext4_journal_test_restart(handle, inode);
+		ext4_truncate_restart_trans(handle, inode,
+					    blocks_for_truncate(inode));
 		if (bh) {
 			BUFFER_TRACE(bh, "retaking write access");
 			ext4_journal_get_write_access(handle, bh);
@@ -3682,11 +4148,11 @@
 
 			*p = 0;
 			tbh = sb_find_get_block(inode->i_sb, nr);
-			ext4_forget(handle, 0, inode, tbh, nr);
+			ext4_forget(handle, is_metadata, inode, tbh, nr);
 		}
 	}
 
-	ext4_free_blocks(handle, inode, block_to_free, count, 0);
+	ext4_free_blocks(handle, inode, block_to_free, count, is_metadata);
 }
 
 /**
@@ -3870,7 +4336,8 @@
 				return;
 			if (try_to_extend_transaction(handle, inode)) {
 				ext4_mark_inode_dirty(handle, inode);
-				ext4_journal_test_restart(handle, inode);
+				ext4_truncate_restart_trans(handle, inode,
+					    blocks_for_truncate(inode));
 			}
 
 			ext4_free_blocks(handle, inode, nr, 1, 1);
@@ -3958,8 +4425,7 @@
 	if (!ext4_can_truncate(inode))
 		return;
 
-	if (ei->i_disksize && inode->i_size == 0 &&
-	    !test_opt(inode->i_sb, NO_AUTO_DA_ALLOC))
+	if (inode->i_size == 0 && !test_opt(inode->i_sb, NO_AUTO_DA_ALLOC))
 		ei->i_state |= EXT4_STATE_DA_ALLOC_CLOSE;
 
 	if (EXT4_I(inode)->i_flags & EXT4_EXTENTS_FL) {
@@ -4313,8 +4779,8 @@
 	struct ext4_iloc iloc;
 	struct ext4_inode *raw_inode;
 	struct ext4_inode_info *ei;
-	struct buffer_head *bh;
 	struct inode *inode;
+	journal_t *journal = EXT4_SB(sb)->s_journal;
 	long ret;
 	int block;
 
@@ -4325,11 +4791,11 @@
 		return inode;
 
 	ei = EXT4_I(inode);
+	iloc.bh = 0;
 
 	ret = __ext4_get_inode_loc(inode, &iloc, 0);
 	if (ret < 0)
 		goto bad_inode;
-	bh = iloc.bh;
 	raw_inode = ext4_raw_inode(&iloc);
 	inode->i_mode = le16_to_cpu(raw_inode->i_mode);
 	inode->i_uid = (uid_t)le16_to_cpu(raw_inode->i_uid_low);
@@ -4352,7 +4818,6 @@
 		if (inode->i_mode == 0 ||
 		    !(EXT4_SB(inode->i_sb)->s_mount_state & EXT4_ORPHAN_FS)) {
 			/* this inode is deleted */
-			brelse(bh);
 			ret = -ESTALE;
 			goto bad_inode;
 		}
@@ -4369,6 +4834,9 @@
 			((__u64)le16_to_cpu(raw_inode->i_file_acl_high)) << 32;
 	inode->i_size = ext4_isize(raw_inode);
 	ei->i_disksize = inode->i_size;
+#ifdef CONFIG_QUOTA
+	ei->i_reserved_quota = 0;
+#endif
 	inode->i_generation = le32_to_cpu(raw_inode->i_generation);
 	ei->i_block_group = iloc.block_group;
 	ei->i_last_alloc_group = ~0;
@@ -4380,11 +4848,35 @@
 		ei->i_data[block] = raw_inode->i_block[block];
 	INIT_LIST_HEAD(&ei->i_orphan);
 
+	/*
+	 * Set transaction id's of transactions that have to be committed
+	 * to finish f[data]sync. We set them to currently running transaction
+	 * as we cannot be sure that the inode or some of its metadata isn't
+	 * part of the transaction - the inode could have been reclaimed and
+	 * now it is reread from disk.
+	 */
+	if (journal) {
+		transaction_t *transaction;
+		tid_t tid;
+
+		spin_lock(&journal->j_state_lock);
+		if (journal->j_running_transaction)
+			transaction = journal->j_running_transaction;
+		else
+			transaction = journal->j_committing_transaction;
+		if (transaction)
+			tid = transaction->t_tid;
+		else
+			tid = journal->j_commit_sequence;
+		spin_unlock(&journal->j_state_lock);
+		ei->i_sync_tid = tid;
+		ei->i_datasync_tid = tid;
+	}
+
 	if (EXT4_INODE_SIZE(inode->i_sb) > EXT4_GOOD_OLD_INODE_SIZE) {
 		ei->i_extra_isize = le16_to_cpu(raw_inode->i_extra_isize);
 		if (EXT4_GOOD_OLD_INODE_SIZE + ei->i_extra_isize >
 		    EXT4_INODE_SIZE(inode->i_sb)) {
-			brelse(bh);
 			ret = -EIO;
 			goto bad_inode;
 		}
@@ -4416,10 +4908,7 @@
 
 	ret = 0;
 	if (ei->i_file_acl &&
-	    ((ei->i_file_acl <
-	      (le32_to_cpu(EXT4_SB(sb)->s_es->s_first_data_block) +
-	       EXT4_SB(sb)->s_gdb_count)) ||
-	     (ei->i_file_acl >= ext4_blocks_count(EXT4_SB(sb)->s_es)))) {
+	    !ext4_data_block_valid(EXT4_SB(sb), ei->i_file_acl, 1)) {
 		ext4_error(sb, __func__,
 			   "bad extended attribute block %llu in inode #%lu",
 			   ei->i_file_acl, inode->i_ino);
@@ -4437,10 +4926,8 @@
 		/* Validate block references which are part of inode */
 		ret = ext4_check_inode_blockref(inode);
 	}
-	if (ret) {
-		brelse(bh);
+	if (ret)
 		goto bad_inode;
-	}
 
 	if (S_ISREG(inode->i_mode)) {
 		inode->i_op = &ext4_file_inode_operations;
@@ -4468,7 +4955,6 @@
 			init_special_inode(inode, inode->i_mode,
 			   new_decode_dev(le32_to_cpu(raw_inode->i_block[1])));
 	} else {
-		brelse(bh);
 		ret = -EIO;
 		ext4_error(inode->i_sb, __func__,
 			   "bogus i_mode (%o) for inode=%lu",
@@ -4481,6 +4967,7 @@
 	return inode;
 
 bad_inode:
+	brelse(iloc.bh);
 	iget_failed(inode);
 	return ERR_PTR(ret);
 }
@@ -4581,8 +5068,7 @@
 	if (ext4_inode_blocks_set(handle, raw_inode, ei))
 		goto out_brelse;
 	raw_inode->i_dtime = cpu_to_le32(ei->i_dtime);
-	/* clear the migrate flag in the raw_inode */
-	raw_inode->i_flags = cpu_to_le32(ei->i_flags & ~EXT4_EXT_MIGRATE);
+	raw_inode->i_flags = cpu_to_le32(ei->i_flags);
 	if (EXT4_SB(inode->i_sb)->s_es->s_creator_os !=
 	    cpu_to_le32(EXT4_OS_HURD))
 		raw_inode->i_file_acl_high =
@@ -4641,6 +5127,7 @@
 		err = rc;
 	ei->i_state &= ~EXT4_STATE_NEW;
 
+	ext4_update_inode_fsync_trans(handle, inode, 0);
 out_brelse:
 	brelse(bh);
 	ext4_std_error(inode->i_sb, err);
@@ -4684,19 +5171,40 @@
  */
 int ext4_write_inode(struct inode *inode, int wait)
 {
+	int err;
+
 	if (current->flags & PF_MEMALLOC)
 		return 0;
 
-	if (ext4_journal_current_handle()) {
-		jbd_debug(1, "called recursively, non-PF_MEMALLOC!\n");
-		dump_stack();
-		return -EIO;
-	}
+	if (EXT4_SB(inode->i_sb)->s_journal) {
+		if (ext4_journal_current_handle()) {
+			jbd_debug(1, "called recursively, non-PF_MEMALLOC!\n");
+			dump_stack();
+			return -EIO;
+		}
 
-	if (!wait)
-		return 0;
+		if (!wait)
+			return 0;
+
+		err = ext4_force_commit(inode->i_sb);
+	} else {
+		struct ext4_iloc iloc;
 
-	return ext4_force_commit(inode->i_sb);
+		err = ext4_get_inode_loc(inode, &iloc);
+		if (err)
+			return err;
+		if (wait)
+			sync_dirty_buffer(iloc.bh);
+		if (buffer_req(iloc.bh) && !buffer_uptodate(iloc.bh)) {
+			ext4_error(inode->i_sb, __func__,
+				   "IO error syncing inode, "
+				   "inode=%lu, block=%llu",
+				   inode->i_ino,
+				   (unsigned long long)iloc.bh->b_blocknr);
+			err = -EIO;
+		}
+	}
+	return err;
 }
 
 /*
@@ -4739,8 +5247,8 @@
 
 		/* (user+group)*(old+new) structure, inode write (sb,
 		 * inode block, ? - but truncate inode update has it) */
-		handle = ext4_journal_start(inode, 2*(EXT4_QUOTA_INIT_BLOCKS(inode->i_sb)+
-					EXT4_QUOTA_DEL_BLOCKS(inode->i_sb))+3);
+		handle = ext4_journal_start(inode, (EXT4_MAXQUOTAS_INIT_BLOCKS(inode->i_sb)+
+					EXT4_MAXQUOTAS_DEL_BLOCKS(inode->i_sb))+3);
 		if (IS_ERR(handle)) {
 			error = PTR_ERR(handle);
 			goto err_out;
@@ -5137,24 +5645,13 @@
 	handle_t *current_handle = ext4_journal_current_handle();
 	handle_t *handle;
 
-	if (!ext4_handle_valid(current_handle)) {
-		ext4_mark_inode_dirty(current_handle, inode);
-		return;
-	}
-
 	handle = ext4_journal_start(inode, 2);
 	if (IS_ERR(handle))
 		goto out;
-	if (current_handle &&
-		current_handle->h_transaction != handle->h_transaction) {
-		/* This task has a transaction open against a different fs */
-		printk(KERN_EMERG "%s: transactions do not match!\n",
-		       __func__);
-	} else {
-		jbd_debug(5, "marking dirty.  outer handle=%p\n",
-				current_handle);
-		ext4_mark_inode_dirty(handle, inode);
-	}
+
+	jbd_debug(5, "marking dirty.  outer handle=%p\n", current_handle);
+	ext4_mark_inode_dirty(handle, inode);
+
 	ext4_journal_stop(handle);
 out:
 	return;
@@ -5281,12 +5778,21 @@
 	else
 		len = PAGE_CACHE_SIZE;
 
+	lock_page(page);
+	/*
+	 * return if we have all the buffers mapped. This avoid
+	 * the need to call write_begin/write_end which does a
+	 * journal_start/journal_stop which can block and take
+	 * long time
+	 */
 	if (page_has_buffers(page)) {
-		/* return if we have all the buffers mapped */
 		if (!walk_page_buffers(NULL, page_buffers(page), 0, len, NULL,
-				       ext4_bh_unmapped))
+					ext4_bh_unmapped)) {
+			unlock_page(page);
 			goto out_unlock;
+		}
 	}
+	unlock_page(page);
 	/*
 	 * OK, we need to fill the hole... Do write_begin write_end
 	 * to do block allocation/reservation.We are not holding
--- linux-rt-2.6.31.orig/fs/ext4/super.c
+++ linux-rt-2.6.31/fs/ext4/super.c
@@ -45,6 +45,7 @@
 #include "ext4_jbd2.h"
 #include "xattr.h"
 #include "acl.h"
+#include "mballoc.h"
 
 #define CREATE_TRACE_POINTS
 #include <trace/events/ext4.h>
@@ -188,6 +189,36 @@
 		bg->bg_itable_unused_hi = cpu_to_le16(count >> 16);
 }
 
+
+/* Just increment the non-pointer handle value */
+static handle_t *ext4_get_nojournal(void)
+{
+	handle_t *handle = current->journal_info;
+	unsigned long ref_cnt = (unsigned long)handle;
+
+	BUG_ON(ref_cnt >= EXT4_NOJOURNAL_MAX_REF_COUNT);
+
+	ref_cnt++;
+	handle = (handle_t *)ref_cnt;
+
+	current->journal_info = handle;
+	return handle;
+}
+
+
+/* Decrement the non-pointer handle value */
+static void ext4_put_nojournal(handle_t *handle)
+{
+	unsigned long ref_cnt = (unsigned long)handle;
+
+	BUG_ON(ref_cnt == 0);
+
+	ref_cnt--;
+	handle = (handle_t *)ref_cnt;
+
+	current->journal_info = handle;
+}
+
 /*
  * Wrappers for jbd2_journal_start/end.
  *
@@ -214,11 +245,7 @@
 		}
 		return jbd2_journal_start(journal, nblocks);
 	}
-	/*
-	 * We're not journaling, return the appropriate indication.
-	 */
-	current->journal_info = EXT4_NOJOURNAL_HANDLE;
-	return current->journal_info;
+	return ext4_get_nojournal();
 }
 
 /*
@@ -234,11 +261,7 @@
 	int rc;
 
 	if (!ext4_handle_valid(handle)) {
-		/*
-		 * Do this here since we don't call jbd2_journal_stop() in
-		 * no-journal mode.
-		 */
-		current->journal_info = NULL;
+		ext4_put_nojournal(handle);
 		return 0;
 	}
 	sb = handle->h_transaction->t_journal->j_private;
@@ -344,7 +367,8 @@
 		errstr = "Out of memory";
 		break;
 	case -EROFS:
-		if (!sb || EXT4_SB(sb)->s_journal->j_flags & JBD2_ABORT)
+		if (!sb || (EXT4_SB(sb)->s_journal &&
+			    EXT4_SB(sb)->s_journal->j_flags & JBD2_ABORT))
 			errstr = "Journal has aborted";
 		else
 			errstr = "Readonly filesystem";
@@ -578,15 +602,14 @@
 	struct ext4_super_block *es = sbi->s_es;
 	int i, err;
 
+	flush_workqueue(sbi->dio_unwritten_wq);
+	destroy_workqueue(sbi->dio_unwritten_wq);
+
 	lock_super(sb);
 	lock_kernel();
 	if (sb->s_dirt)
 		ext4_commit_super(sb, 1);
 
-	ext4_release_system_zone(sb);
-	ext4_mb_release(sb);
-	ext4_ext_release(sb);
-	ext4_xattr_put_super(sb);
 	if (sbi->s_journal) {
 		err = jbd2_journal_destroy(sbi->s_journal);
 		sbi->s_journal = NULL;
@@ -594,6 +617,12 @@
 			ext4_abort(sb, __func__,
 				   "Couldn't clean up the journal");
 	}
+
+	ext4_release_system_zone(sb);
+	ext4_mb_release(sb);
+	ext4_ext_release(sb);
+	ext4_xattr_put_super(sb);
+
 	if (!(sb->s_flags & MS_RDONLY)) {
 		EXT4_CLEAR_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_RECOVER);
 		es->s_state = cpu_to_le16(sbi->s_mount_state);
@@ -682,6 +711,13 @@
 	ei->i_allocated_meta_blocks = 0;
 	ei->i_delalloc_reserved_flag = 0;
 	spin_lock_init(&(ei->i_block_reservation_lock));
+#ifdef CONFIG_QUOTA
+	ei->i_reserved_quota = 0;
+#endif
+	INIT_LIST_HEAD(&ei->i_aio_dio_complete_list);
+	ei->cur_aio_dio = NULL;
+	ei->i_sync_tid = 0;
+	ei->i_datasync_tid = 0;
 
 	return &ei->vfs_inode;
 }
@@ -877,6 +913,12 @@
 	if (test_opt(sb, NO_AUTO_DA_ALLOC))
 		seq_puts(seq, ",noauto_da_alloc");
 
+	if (test_opt(sb, DISCARD))
+		seq_puts(seq, ",discard");
+
+	if (test_opt(sb, NOLOAD))
+		seq_puts(seq, ",norecovery");
+
 	ext4_show_quota_options(seq, sb);
 
 	return 0;
@@ -969,7 +1011,9 @@
 	.reserve_space	= dquot_reserve_space,
 	.claim_space	= dquot_claim_space,
 	.release_rsv	= dquot_release_reserved_space,
+#ifdef CONFIG_QUOTA
 	.get_reserved_space = ext4_get_reserved_space,
+#endif
 	.alloc_inode	= dquot_alloc_inode,
 	.free_space	= dquot_free_space,
 	.free_inode	= dquot_free_inode,
@@ -1057,7 +1101,8 @@
 	Opt_usrquota, Opt_grpquota, Opt_i_version,
 	Opt_stripe, Opt_delalloc, Opt_nodelalloc,
 	Opt_block_validity, Opt_noblock_validity,
-	Opt_inode_readahead_blks, Opt_journal_ioprio
+	Opt_inode_readahead_blks, Opt_journal_ioprio,
+	Opt_discard, Opt_nodiscard,
 };
 
 static const match_table_t tokens = {
@@ -1082,6 +1127,7 @@
 	{Opt_acl, "acl"},
 	{Opt_noacl, "noacl"},
 	{Opt_noload, "noload"},
+	{Opt_noload, "norecovery"},
 	{Opt_nobh, "nobh"},
 	{Opt_bh, "bh"},
 	{Opt_commit, "commit=%u"},
@@ -1123,6 +1169,8 @@
 	{Opt_auto_da_alloc, "auto_da_alloc=%u"},
 	{Opt_auto_da_alloc, "auto_da_alloc"},
 	{Opt_noauto_da_alloc, "noauto_da_alloc"},
+	{Opt_discard, "discard"},
+	{Opt_nodiscard, "nodiscard"},
 	{Opt_err, NULL},
 };
 
@@ -1551,6 +1599,12 @@
 			else
 				set_opt(sbi->s_mount_opt,NO_AUTO_DA_ALLOC);
 			break;
+		case Opt_discard:
+			set_opt(sbi->s_mount_opt, DISCARD);
+			break;
+		case Opt_nodiscard:
+			clear_opt(sbi->s_mount_opt, DISCARD);
+			break;
 		default:
 			ext4_msg(sb, KERN_ERR,
 			       "Unrecognized mount option \"%s\" "
@@ -1666,14 +1720,14 @@
 	size_t size;
 	int i;
 
-	if (!sbi->s_es->s_log_groups_per_flex) {
+	sbi->s_log_groups_per_flex = sbi->s_es->s_log_groups_per_flex;
+	groups_per_flex = 1 << sbi->s_log_groups_per_flex;
+
+	if (groups_per_flex < 2) {
 		sbi->s_log_groups_per_flex = 0;
 		return 1;
 	}
 
-	sbi->s_log_groups_per_flex = sbi->s_es->s_log_groups_per_flex;
-	groups_per_flex = 1 << sbi->s_log_groups_per_flex;
-
 	/* We allocate both existing and potentially added groups */
 	flex_group_count = ((sbi->s_groups_count + groups_per_flex - 1) +
 			((le16_to_cpu(sbi->s_es->s_reserved_gdt_blocks) + 1) <<
@@ -1695,12 +1749,12 @@
 		gdp = ext4_get_group_desc(sb, i, NULL);
 
 		flex_group = ext4_flex_group(sbi, i);
-		atomic_set(&sbi->s_flex_groups[flex_group].free_inodes,
-			   ext4_free_inodes_count(sb, gdp));
-		atomic_set(&sbi->s_flex_groups[flex_group].free_blocks,
-			   ext4_free_blks_count(sb, gdp));
-		atomic_set(&sbi->s_flex_groups[flex_group].used_dirs,
-			   ext4_used_dirs_count(sb, gdp));
+		atomic_add(ext4_free_inodes_count(sb, gdp),
+			   &sbi->s_flex_groups[flex_group].free_inodes);
+		atomic_add(ext4_free_blks_count(sb, gdp),
+			   &sbi->s_flex_groups[flex_group].free_blocks);
+		atomic_add(ext4_used_dirs_count(sb, gdp),
+			   &sbi->s_flex_groups[flex_group].used_dirs);
 	}
 
 	return 1;
@@ -2197,6 +2251,7 @@
 EXT4_RW_ATTR_SBI_UI(mb_order2_req, s_mb_order2_reqs);
 EXT4_RW_ATTR_SBI_UI(mb_stream_req, s_mb_stream_request);
 EXT4_RW_ATTR_SBI_UI(mb_group_prealloc, s_mb_group_prealloc);
+EXT4_RW_ATTR_SBI_UI(max_writeback_mb_bump, s_max_writeback_mb_bump);
 
 static struct attribute *ext4_attrs[] = {
 	ATTR_LIST(delayed_allocation_blocks),
@@ -2210,6 +2265,7 @@
 	ATTR_LIST(mb_order2_req),
 	ATTR_LIST(mb_stream_req),
 	ATTR_LIST(mb_group_prealloc),
+	ATTR_LIST(max_writeback_mb_bump),
 	NULL,
 };
 
@@ -2253,6 +2309,49 @@
 	.release	= ext4_sb_release,
 };
 
+/*
+ * Check whether this filesystem can be mounted based on
+ * the features present and the RDONLY/RDWR mount requested.
+ * Returns 1 if this filesystem can be mounted as requested,
+ * 0 if it cannot be.
+ */
+static int ext4_feature_set_ok(struct super_block *sb, int readonly)
+{
+	if (EXT4_HAS_INCOMPAT_FEATURE(sb, ~EXT4_FEATURE_INCOMPAT_SUPP)) {
+		ext4_msg(sb, KERN_ERR,
+			"Couldn't mount because of "
+			"unsupported optional features (%x)",
+			(le32_to_cpu(EXT4_SB(sb)->s_es->s_feature_incompat) &
+			~EXT4_FEATURE_INCOMPAT_SUPP));
+		return 0;
+	}
+
+	if (readonly)
+		return 1;
+
+	/* Check that feature set is OK for a read-write mount */
+	if (EXT4_HAS_RO_COMPAT_FEATURE(sb, ~EXT4_FEATURE_RO_COMPAT_SUPP)) {
+		ext4_msg(sb, KERN_ERR, "couldn't mount RDWR because of "
+			 "unsupported optional features (%x)",
+			 (le32_to_cpu(EXT4_SB(sb)->s_es->s_feature_ro_compat) &
+				~EXT4_FEATURE_RO_COMPAT_SUPP));
+		return 0;
+	}
+	/*
+	 * Large file size enabled file system can only be mounted
+	 * read-write on 32-bit systems if kernel is built with CONFIG_LBDAF
+	 */
+	if (EXT4_HAS_RO_COMPAT_FEATURE(sb, EXT4_FEATURE_RO_COMPAT_HUGE_FILE)) {
+		if (sizeof(blkcnt_t) < sizeof(u64)) {
+			ext4_msg(sb, KERN_ERR, "Filesystem with huge files "
+				 "cannot be mounted RDWR without "
+				 "CONFIG_LBDAF");
+			return 0;
+		}
+	}
+	return 1;
+}
+
 static int ext4_fill_super(struct super_block *sb, void *data, int silent)
 				__releases(kernel_lock)
 				__acquires(kernel_lock)
@@ -2274,7 +2373,6 @@
 	unsigned int db_count;
 	unsigned int i;
 	int needs_recovery, has_huge_files;
-	int features;
 	__u64 blocks_count;
 	int err;
 	unsigned int journal_ioprio = DEFAULT_JOURNAL_IOPRIO;
@@ -2401,39 +2499,9 @@
 	 * previously didn't change the revision level when setting the flags,
 	 * so there is a chance incompat flags are set on a rev 0 filesystem.
 	 */
-	features = EXT4_HAS_INCOMPAT_FEATURE(sb, ~EXT4_FEATURE_INCOMPAT_SUPP);
-	if (features) {
-		ext4_msg(sb, KERN_ERR,
-			"Couldn't mount because of "
-			"unsupported optional features (%x)",
-			(le32_to_cpu(EXT4_SB(sb)->s_es->s_feature_incompat) &
-			~EXT4_FEATURE_INCOMPAT_SUPP));
-		goto failed_mount;
-	}
-	features = EXT4_HAS_RO_COMPAT_FEATURE(sb, ~EXT4_FEATURE_RO_COMPAT_SUPP);
-	if (!(sb->s_flags & MS_RDONLY) && features) {
-		ext4_msg(sb, KERN_ERR,
-			"Couldn't mount RDWR because of "
-			"unsupported optional features (%x)",
-			(le32_to_cpu(EXT4_SB(sb)->s_es->s_feature_ro_compat) &
-			~EXT4_FEATURE_RO_COMPAT_SUPP));
+	if (!ext4_feature_set_ok(sb, (sb->s_flags & MS_RDONLY)))
 		goto failed_mount;
-	}
-	has_huge_files = EXT4_HAS_RO_COMPAT_FEATURE(sb,
-				    EXT4_FEATURE_RO_COMPAT_HUGE_FILE);
-	if (has_huge_files) {
-		/*
-		 * Large file size enabled file system can only be
-		 * mount if kernel is build with CONFIG_LBDAF
-		 */
-		if (sizeof(root->i_blocks) < sizeof(u64) &&
-				!(sb->s_flags & MS_RDONLY)) {
-			ext4_msg(sb, KERN_ERR, "Filesystem with huge "
-					"files cannot be mounted read-write "
-					"without CONFIG_LBDAF");
-			goto failed_mount;
-		}
-	}
+
 	blocksize = BLOCK_SIZE << le32_to_cpu(es->s_log_block_size);
 
 	if (blocksize < EXT4_MIN_BLOCK_SIZE ||
@@ -2469,6 +2537,8 @@
 		}
 	}
 
+	has_huge_files = EXT4_HAS_RO_COMPAT_FEATURE(sb,
+				EXT4_FEATURE_RO_COMPAT_HUGE_FILE);
 	sbi->s_bitmap_maxbytes = ext4_max_bitmap_size(sb->s_blocksize_bits,
 						      has_huge_files);
 	sb->s_maxbytes = ext4_max_size(sb->s_blocksize_bits, has_huge_files);
@@ -2549,12 +2619,19 @@
 		goto failed_mount;
 	}
 
-	if (ext4_blocks_count(es) >
-		    (sector_t)(~0ULL) >> (sb->s_blocksize_bits - 9)) {
+	/*
+	 * Test whether we have more sectors than will fit in sector_t,
+	 * and whether the max offset is addressable by the page cache.
+	 */
+	if ((ext4_blocks_count(es) >
+	     (sector_t)(~0ULL) >> (sb->s_blocksize_bits - 9)) ||
+	    (ext4_blocks_count(es) >
+	     (pgoff_t)(~0ULL) >> (PAGE_CACHE_SHIFT - sb->s_blocksize_bits))) {
 		ext4_msg(sb, KERN_ERR, "filesystem"
-			" too large to mount safely");
+			 " too large to mount safely on this system");
 		if (sizeof(sector_t) < 8)
 			ext4_msg(sb, KERN_WARNING, "CONFIG_LBDAF not enabled");
+		ret = -EFBIG;
 		goto failed_mount;
 	}
 
@@ -2595,6 +2672,8 @@
 		goto failed_mount;
 	}
 	sbi->s_groups_count = blocks_count;
+	sbi->s_blockfile_groups = min_t(ext4_group_t, sbi->s_groups_count,
+			(EXT4_MAX_BLOCK_FILE_PHYS / EXT4_BLOCKS_PER_GROUP(sb)));
 	db_count = (sbi->s_groups_count + EXT4_DESC_PER_BLOCK(sb) - 1) /
 		   EXT4_DESC_PER_BLOCK(sb);
 	sbi->s_group_desc = kmalloc(db_count * sizeof(struct buffer_head *),
@@ -2656,6 +2735,7 @@
 	}
 
 	sbi->s_stripe = ext4_get_stripe_size(sbi);
+	sbi->s_max_writeback_mb_bump = 128;
 
 	/*
 	 * set up enough so that it can read an inode
@@ -2781,6 +2861,12 @@
 			clear_opt(sbi->s_mount_opt, NOBH);
 		}
 	}
+	EXT4_SB(sb)->dio_unwritten_wq = create_workqueue("ext4-dio-unwritten");
+	if (!EXT4_SB(sb)->dio_unwritten_wq) {
+		printk(KERN_ERR "EXT4-fs: failed to create DIO workqueue\n");
+		goto failed_mount_wq;
+	}
+
 	/*
 	 * The jbd2_journal_load will have done any necessary log recovery,
 	 * so we can safely mount the rest of the filesystem now.
@@ -2893,6 +2979,8 @@
 
 failed_mount4:
 	ext4_msg(sb, KERN_ERR, "mount failed");
+	destroy_workqueue(EXT4_SB(sb)->dio_unwritten_wq);
+failed_mount_wq:
 	ext4_release_system_zone(sb);
 	if (sbi->s_journal) {
 		jbd2_journal_destroy(sbi->s_journal);
@@ -3208,7 +3296,18 @@
 		clear_buffer_write_io_error(sbh);
 		set_buffer_uptodate(sbh);
 	}
-	es->s_wtime = cpu_to_le32(get_seconds());
+	/*
+	 * If the file system is mounted read-only, don't update the
+	 * superblock write time.  This avoids updating the superblock
+	 * write time when we are mounting the root file system
+	 * read/only but we need to replay the journal; at that point,
+	 * for people who are east of GMT and who make their clock
+	 * tick in localtime for Windows bug-for-bug compatibility,
+	 * the clock is set in the future, and this will cause e2fsck
+	 * to complain and force a full file system check.
+	 */
+	if (!(sb->s_flags & MS_RDONLY))
+		es->s_wtime = cpu_to_le32(get_seconds());
 	es->s_kbytes_written =
 		cpu_to_le64(EXT4_SB(sb)->s_kbytes_written + 
 			    ((part_stat_read(sb->s_bdev->bd_part, sectors[1]) -
@@ -3333,11 +3432,13 @@
 {
 	int ret = 0;
 	tid_t target;
+	struct ext4_sb_info *sbi = EXT4_SB(sb);
 
 	trace_ext4_sync_fs(sb, wait);
-	if (jbd2_journal_start_commit(EXT4_SB(sb)->s_journal, &target)) {
+	flush_workqueue(sbi->dio_unwritten_wq);
+	if (jbd2_journal_start_commit(sbi->s_journal, &target)) {
 		if (wait)
-			jbd2_log_wait_commit(EXT4_SB(sb)->s_journal, target);
+			jbd2_log_wait_commit(sbi->s_journal, target);
 	}
 	return ret;
 }
@@ -3477,18 +3578,11 @@
 			if (sbi->s_journal)
 				ext4_mark_recovery_complete(sb, es);
 		} else {
-			int ret;
-			if ((ret = EXT4_HAS_RO_COMPAT_FEATURE(sb,
-					~EXT4_FEATURE_RO_COMPAT_SUPP))) {
-				ext4_msg(sb, KERN_WARNING, "couldn't "
-				       "remount RDWR because of unsupported "
-				       "optional features (%x)",
-				(le32_to_cpu(sbi->s_es->s_feature_ro_compat) &
-					~EXT4_FEATURE_RO_COMPAT_SUPP));
+			/* Make sure we can mount this feature set readwrite */
+			if (!ext4_feature_set_ok(sb, 0)) {
 				err = -EROFS;
 				goto restore_opts;
 			}
-
 			/*
 			 * Make sure the group descriptor checksums
 			 * are sane.  If they aren't, refuse to remount r/w.
@@ -3624,13 +3718,11 @@
 	buf->f_blocks = ext4_blocks_count(es) - sbi->s_overhead_last;
 	buf->f_bfree = percpu_counter_sum_positive(&sbi->s_freeblocks_counter) -
 		       percpu_counter_sum_positive(&sbi->s_dirtyblocks_counter);
-	ext4_free_blocks_count_set(es, buf->f_bfree);
 	buf->f_bavail = buf->f_bfree - ext4_r_blocks_count(es);
 	if (buf->f_bfree < ext4_r_blocks_count(es))
 		buf->f_bavail = 0;
 	buf->f_files = le32_to_cpu(es->s_inodes_count);
 	buf->f_ffree = percpu_counter_sum_positive(&sbi->s_freeinodes_counter);
-	es->s_free_inodes_count = cpu_to_le32(buf->f_ffree);
 	buf->f_namelen = EXT4_NAME_LEN;
 	fsid = le64_to_cpup((void *)es->s_uuid) ^
 	       le64_to_cpup((void *)es->s_uuid + sizeof(u64));
--- linux-rt-2.6.31.orig/fs/ext4/mballoc.c
+++ linux-rt-2.6.31/fs/ext4/mballoc.c
@@ -908,6 +908,97 @@
 	return err;
 }
 
+static noinline_for_stack
+int ext4_mb_init_group(struct super_block *sb, ext4_group_t group)
+{
+
+	int ret = 0;
+	void *bitmap;
+	int blocks_per_page;
+	int block, pnum, poff;
+	int num_grp_locked = 0;
+	struct ext4_group_info *this_grp;
+	struct ext4_sb_info *sbi = EXT4_SB(sb);
+	struct inode *inode = sbi->s_buddy_cache;
+	struct page *page = NULL, *bitmap_page = NULL;
+
+	mb_debug("init group %lu\n", group);
+	blocks_per_page = PAGE_CACHE_SIZE / sb->s_blocksize;
+	this_grp = ext4_get_group_info(sb, group);
+	/*
+	 * This ensures we don't add group
+	 * to this buddy cache via resize
+	 */
+	num_grp_locked =  ext4_mb_get_buddy_cache_lock(sb, group);
+	if (!EXT4_MB_GRP_NEED_INIT(this_grp)) {
+		/*
+		 * somebody initialized the group
+		 * return without doing anything
+		 */
+		ret = 0;
+		goto err;
+	}
+	/*
+	 * the buddy cache inode stores the block bitmap
+	 * and buddy information in consecutive blocks.
+	 * So for each group we need two blocks.
+	 */
+	block = group * 2;
+	pnum = block / blocks_per_page;
+	poff = block % blocks_per_page;
+	page = find_or_create_page(inode->i_mapping, pnum, GFP_NOFS);
+	if (page) {
+		BUG_ON(page->mapping != inode->i_mapping);
+		ret = ext4_mb_init_cache(page, NULL);
+		if (ret) {
+			unlock_page(page);
+			goto err;
+		}
+		unlock_page(page);
+	}
+	if (page == NULL || !PageUptodate(page)) {
+		ret = -EIO;
+		goto err;
+	}
+	mark_page_accessed(page);
+	bitmap_page = page;
+	bitmap = page_address(page) + (poff * sb->s_blocksize);
+
+	/* init buddy cache */
+	block++;
+	pnum = block / blocks_per_page;
+	poff = block % blocks_per_page;
+	page = find_or_create_page(inode->i_mapping, pnum, GFP_NOFS);
+	if (page == bitmap_page) {
+		/*
+		 * If both the bitmap and buddy are in
+		 * the same page we don't need to force
+		 * init the buddy
+		 */
+		unlock_page(page);
+	} else if (page) {
+		BUG_ON(page->mapping != inode->i_mapping);
+		ret = ext4_mb_init_cache(page, bitmap);
+		if (ret) {
+			unlock_page(page);
+			goto err;
+		}
+		unlock_page(page);
+	}
+	if (page == NULL || !PageUptodate(page)) {
+		ret = -EIO;
+		goto err;
+	}
+	mark_page_accessed(page);
+err:
+	ext4_mb_put_buddy_cache_lock(sb, group, num_grp_locked);
+	if (bitmap_page)
+		page_cache_release(bitmap_page);
+	if (page)
+		page_cache_release(page);
+	return ret;
+}
+
 static noinline_for_stack int
 ext4_mb_load_buddy(struct super_block *sb, ext4_group_t group,
 					struct ext4_buddy *e4b)
@@ -941,8 +1032,26 @@
 	 * groups mapped by the page is blocked
 	 * till we are done with allocation
 	 */
+repeat_load_buddy:
 	down_read(e4b->alloc_semp);
 
+	if (unlikely(EXT4_MB_GRP_NEED_INIT(grp))) {
+		/* we need to check for group need init flag
+		 * with alloc_semp held so that we can be sure
+		 * that new blocks didn't get added to the group
+		 * when we are loading the buddy cache
+		 */
+		up_read(e4b->alloc_semp);
+		/*
+		 * we need full data about the group
+		 * to make a good selection
+		 */
+		ret = ext4_mb_init_group(sb, group);
+		if (ret)
+			return ret;
+		goto repeat_load_buddy;
+	}
+
 	/*
 	 * the buddy cache inode stores the block bitmap
 	 * and buddy information in consecutive blocks.
@@ -1360,7 +1469,7 @@
 	ac->alloc_semp =  e4b->alloc_semp;
 	e4b->alloc_semp = NULL;
 	/* store last allocated for subsequent stream allocation */
-	if ((ac->ac_flags & EXT4_MB_HINT_DATA)) {
+	if (ac->ac_flags & EXT4_MB_STREAM_ALLOC) {
 		spin_lock(&sbi->s_md_lock);
 		sbi->s_mb_last_group = ac->ac_f_ex.fe_group;
 		sbi->s_mb_last_start = ac->ac_f_ex.fe_start;
@@ -1837,97 +1946,6 @@
 
 }
 
-static noinline_for_stack
-int ext4_mb_init_group(struct super_block *sb, ext4_group_t group)
-{
-
-	int ret;
-	void *bitmap;
-	int blocks_per_page;
-	int block, pnum, poff;
-	int num_grp_locked = 0;
-	struct ext4_group_info *this_grp;
-	struct ext4_sb_info *sbi = EXT4_SB(sb);
-	struct inode *inode = sbi->s_buddy_cache;
-	struct page *page = NULL, *bitmap_page = NULL;
-
-	mb_debug("init group %lu\n", group);
-	blocks_per_page = PAGE_CACHE_SIZE / sb->s_blocksize;
-	this_grp = ext4_get_group_info(sb, group);
-	/*
-	 * This ensures we don't add group
-	 * to this buddy cache via resize
-	 */
-	num_grp_locked =  ext4_mb_get_buddy_cache_lock(sb, group);
-	if (!EXT4_MB_GRP_NEED_INIT(this_grp)) {
-		/*
-		 * somebody initialized the group
-		 * return without doing anything
-		 */
-		ret = 0;
-		goto err;
-	}
-	/*
-	 * the buddy cache inode stores the block bitmap
-	 * and buddy information in consecutive blocks.
-	 * So for each group we need two blocks.
-	 */
-	block = group * 2;
-	pnum = block / blocks_per_page;
-	poff = block % blocks_per_page;
-	page = find_or_create_page(inode->i_mapping, pnum, GFP_NOFS);
-	if (page) {
-		BUG_ON(page->mapping != inode->i_mapping);
-		ret = ext4_mb_init_cache(page, NULL);
-		if (ret) {
-			unlock_page(page);
-			goto err;
-		}
-		unlock_page(page);
-	}
-	if (page == NULL || !PageUptodate(page)) {
-		ret = -EIO;
-		goto err;
-	}
-	mark_page_accessed(page);
-	bitmap_page = page;
-	bitmap = page_address(page) + (poff * sb->s_blocksize);
-
-	/* init buddy cache */
-	block++;
-	pnum = block / blocks_per_page;
-	poff = block % blocks_per_page;
-	page = find_or_create_page(inode->i_mapping, pnum, GFP_NOFS);
-	if (page == bitmap_page) {
-		/*
-		 * If both the bitmap and buddy are in
-		 * the same page we don't need to force
-		 * init the buddy
-		 */
-		unlock_page(page);
-	} else if (page) {
-		BUG_ON(page->mapping != inode->i_mapping);
-		ret = ext4_mb_init_cache(page, bitmap);
-		if (ret) {
-			unlock_page(page);
-			goto err;
-		}
-		unlock_page(page);
-	}
-	if (page == NULL || !PageUptodate(page)) {
-		ret = -EIO;
-		goto err;
-	}
-	mark_page_accessed(page);
-err:
-	ext4_mb_put_buddy_cache_lock(sb, group, num_grp_locked);
-	if (bitmap_page)
-		page_cache_release(bitmap_page);
-	if (page)
-		page_cache_release(page);
-	return ret;
-}
-
 static noinline_for_stack int
 ext4_mb_regular_allocator(struct ext4_allocation_context *ac)
 {
@@ -1938,11 +1956,14 @@
 	struct ext4_sb_info *sbi;
 	struct super_block *sb;
 	struct ext4_buddy e4b;
-	loff_t size, isize;
 
 	sb = ac->ac_sb;
 	sbi = EXT4_SB(sb);
 	ngroups = ext4_get_groups_count(sb);
+	/* non-extent files are limited to low blocks/groups */
+	if (!(EXT4_I(ac->ac_inode)->i_flags & EXT4_EXTENTS_FL))
+		ngroups = sbi->s_blockfile_groups;
+
 	BUG_ON(ac->ac_status == AC_STATUS_FOUND);
 
 	/* first, try the goal */
@@ -1974,20 +1995,16 @@
 	}
 
 	bsbits = ac->ac_sb->s_blocksize_bits;
-	/* if stream allocation is enabled, use global goal */
-	size = ac->ac_o_ex.fe_logical + ac->ac_o_ex.fe_len;
-	isize = i_size_read(ac->ac_inode) >> bsbits;
-	if (size < isize)
-		size = isize;
 
-	if (size < sbi->s_mb_stream_request &&
-			(ac->ac_flags & EXT4_MB_HINT_DATA)) {
+	/* if stream allocation is enabled, use global goal */
+	if (ac->ac_flags & EXT4_MB_STREAM_ALLOC) {
 		/* TBD: may be hot point */
 		spin_lock(&sbi->s_md_lock);
 		ac->ac_g_ex.fe_group = sbi->s_mb_last_group;
 		ac->ac_g_ex.fe_start = sbi->s_mb_last_start;
 		spin_unlock(&sbi->s_md_lock);
 	}
+
 	/* Let's just scan groups to find more-less suitable blocks */
 	cr = ac->ac_2order ? 0 : 1;
 	/*
@@ -2015,27 +2032,6 @@
 			if (grp->bb_free == 0)
 				continue;
 
-			/*
-			 * if the group is already init we check whether it is
-			 * a good group and if not we don't load the buddy
-			 */
-			if (EXT4_MB_GRP_NEED_INIT(grp)) {
-				/*
-				 * we need full data about the group
-				 * to make a good selection
-				 */
-				err = ext4_mb_init_group(sb, group);
-				if (err)
-					goto out;
-			}
-
-			/*
-			 * If the particular group doesn't satisfy our
-			 * criteria we continue with the next group
-			 */
-			if (!ext4_mb_good_group(ac, group, cr))
-				continue;
-
 			err = ext4_mb_load_buddy(sb, group, &e4b);
 			if (err)
 				goto out;
@@ -2571,13 +2567,11 @@
 {
 	ext4_group_t ngroups = ext4_get_groups_count(sb);
 	ext4_group_t i;
-	int metalen;
 	struct ext4_sb_info *sbi = EXT4_SB(sb);
 	struct ext4_super_block *es = sbi->s_es;
 	int num_meta_group_infos;
 	int num_meta_group_infos_max;
 	int array_size;
-	struct ext4_group_info **meta_group_info;
 	struct ext4_group_desc *desc;
 
 	/* This is the number of blocks used by GDT */
@@ -2622,22 +2616,6 @@
 		goto err_freesgi;
 	}
 	EXT4_I(sbi->s_buddy_cache)->i_disksize = 0;
-
-	metalen = sizeof(*meta_group_info) << EXT4_DESC_PER_BLOCK_BITS(sb);
-	for (i = 0; i < num_meta_group_infos; i++) {
-		if ((i + 1) == num_meta_group_infos)
-			metalen = sizeof(*meta_group_info) *
-				(ngroups -
-					(i << EXT4_DESC_PER_BLOCK_BITS(sb)));
-		meta_group_info = kmalloc(metalen, GFP_KERNEL);
-		if (meta_group_info == NULL) {
-			printk(KERN_ERR "EXT4-fs: can't allocate mem for a "
-			       "buddy group\n");
-			goto err_freemeta;
-		}
-		sbi->s_group_info[i] = meta_group_info;
-	}
-
 	for (i = 0; i < ngroups; i++) {
 		desc = ext4_get_group_desc(sb, i, NULL);
 		if (desc == NULL) {
@@ -2655,7 +2633,6 @@
 	while (i-- > 0)
 		kfree(ext4_get_group_info(sb, i));
 	i = num_meta_group_infos;
-err_freemeta:
 	while (i-- > 0)
 		kfree(sbi->s_group_info[i]);
 	iput(sbi->s_buddy_cache);
@@ -2833,7 +2810,6 @@
 	struct ext4_group_info *db;
 	int err, count = 0, count2 = 0;
 	struct ext4_free_data *entry;
-	ext4_fsblk_t discard_block;
 	struct list_head *l, *ltmp;
 
 	list_for_each_safe(l, ltmp, &txn->t_private_list) {
@@ -2863,13 +2839,19 @@
 			page_cache_release(e4b.bd_bitmap_page);
 		}
 		ext4_unlock_group(sb, entry->group);
-		discard_block = (ext4_fsblk_t) entry->group * EXT4_BLOCKS_PER_GROUP(sb)
-			+ entry->start_blk
-			+ le32_to_cpu(EXT4_SB(sb)->s_es->s_first_data_block);
-		trace_ext4_discard_blocks(sb, (unsigned long long)discard_block,
-					  entry->count);
-		sb_issue_discard(sb, discard_block, entry->count);
-
+		if (test_opt(sb, DISCARD)) {
+			ext4_fsblk_t discard_block;
+			struct ext4_super_block *es = EXT4_SB(sb)->s_es;
+
+			discard_block = (ext4_fsblk_t)entry->group *
+						EXT4_BLOCKS_PER_GROUP(sb)
+					+ entry->start_blk
+					+ le32_to_cpu(es->s_first_data_block);
+			trace_ext4_discard_blocks(sb,
+					(unsigned long long)discard_block,
+					entry->count);
+			sb_issue_discard(sb, discard_block, entry->count);
+		}
 		kmem_cache_free(ext4_free_ext_cachep, entry);
 		ext4_mb_release_desc(&e4b);
 	}
@@ -3276,6 +3258,24 @@
 }
 
 /*
+ * Called on failure; free up any blocks from the inode PA for this
+ * context.  We don't need this for MB_GROUP_PA because we only change
+ * pa_free in ext4_mb_release_context(), but on failure, we've already
+ * zeroed out ac->ac_b_ex.fe_len, so group_pa->pa_free is not changed.
+ */
+static void ext4_discard_allocated_blocks(struct ext4_allocation_context *ac)
+{
+	struct ext4_prealloc_space *pa = ac->ac_pa;
+	int len;
+
+	if (pa && pa->pa_type == MB_INODE_PA) {
+		len = ac->ac_b_ex.fe_len;
+		pa->pa_free += len;
+	}
+
+}
+
+/*
  * use blocks preallocated to inode
  */
 static void ext4_mb_use_inode_pa(struct ext4_allocation_context *ac,
@@ -3382,6 +3382,11 @@
 			ac->ac_o_ex.fe_logical >= pa->pa_lstart + pa->pa_len)
 			continue;
 
+		/* non-extent files can't have physical blocks past 2^32 */
+		if (!(EXT4_I(ac->ac_inode)->i_flags & EXT4_EXTENTS_FL) &&
+			pa->pa_pstart + pa->pa_len > EXT4_MAX_BLOCK_FILE_PHYS)
+			continue;
+
 		/* found preallocated blocks, use them */
 		spin_lock(&pa->pa_lock);
 		if (pa->pa_deleted == 0 && pa->pa_free) {
@@ -4174,16 +4179,26 @@
 	if (!(ac->ac_flags & EXT4_MB_HINT_DATA))
 		return;
 
+	if (unlikely(ac->ac_flags & EXT4_MB_HINT_GOAL_ONLY))
+		return;
+
 	size = ac->ac_o_ex.fe_logical + ac->ac_o_ex.fe_len;
-	isize = i_size_read(ac->ac_inode) >> bsbits;
-	size = max(size, isize);
+	isize = (i_size_read(ac->ac_inode) + ac->ac_sb->s_blocksize - 1)
+		>> bsbits;
 
-	/* don't use group allocation for large files */
-	if (size >= sbi->s_mb_stream_request)
+	if ((size == isize) &&
+	    !ext4_fs_is_busy(sbi) &&
+	    (atomic_read(&ac->ac_inode->i_writecount) == 0)) {
+		ac->ac_flags |= EXT4_MB_HINT_NOPREALLOC;
 		return;
+	}
 
-	if (unlikely(ac->ac_flags & EXT4_MB_HINT_GOAL_ONLY))
+	/* don't use group allocation for large files */
+	size = max(size, isize);
+	if (size >= sbi->s_mb_stream_request) {
+		ac->ac_flags |= EXT4_MB_STREAM_ALLOC;
 		return;
+	}
 
 	BUG_ON(ac->ac_lg != NULL);
 	/*
@@ -4549,6 +4564,7 @@
 			ac->ac_status = AC_STATUS_CONTINUE;
 			goto repeat;
 		} else if (*errp) {
+			ext4_discard_allocated_blocks(ac);
 			ac->ac_b_ex.fe_len = 0;
 			ar->len = 0;
 			ext4_mb_show_ac(ac);
--- linux-rt-2.6.31.orig/fs/ext4/resize.c
+++ linux-rt-2.6.31/fs/ext4/resize.c
@@ -247,7 +247,7 @@
 			goto exit_bh;
 
 		if (IS_ERR(gdb = bclean(handle, sb, block))) {
-			err = PTR_ERR(bh);
+			err = PTR_ERR(gdb);
 			goto exit_bh;
 		}
 		ext4_handle_dirty_metadata(handle, NULL, gdb);
--- linux-rt-2.6.31.orig/fs/ext4/ext4.h
+++ linux-rt-2.6.31/fs/ext4/ext4.h
@@ -88,6 +88,8 @@
 #define EXT4_MB_HINT_TRY_GOAL		512
 /* blocks already pre-reserved by delayed allocation */
 #define EXT4_MB_DELALLOC_RESERVED      1024
+/* We are doing stream allocation */
+#define EXT4_MB_STREAM_ALLOC		2048
 
 
 struct ext4_allocation_request {
@@ -111,6 +113,33 @@
 	unsigned int flags;
 };
 
+#define	DIO_AIO_UNWRITTEN	0x1
+typedef struct ext4_io_end {
+	struct list_head	list;		/* per-file finished AIO list */
+	struct inode		*inode;		/* file being written to */
+	unsigned int		flag;		/* sync IO or AIO */
+	int			error;		/* I/O error code */
+	ext4_lblk_t		offset;		/* offset in the file */
+	size_t			size;		/* size of the extent */
+	struct work_struct	work;		/* data work queue */
+} ext4_io_end_t;
+
+/*
+ * Delayed allocation stuff
+ */
+
+struct mpage_da_data {
+	struct inode *inode;
+	sector_t b_blocknr;		/* start block number of extent */
+	size_t b_size;			/* size of extent */
+	unsigned long b_state;		/* state of the extent */
+	unsigned long first_page, next_page;	/* extent of pages */
+	struct writeback_control *wbc;
+	int io_done;
+	int pages_written;
+	int retval;
+};
+
 /*
  * Special inodes numbers
  */
@@ -251,7 +280,6 @@
 #define EXT4_TOPDIR_FL			0x00020000 /* Top of directory hierarchies*/
 #define EXT4_HUGE_FILE_FL               0x00040000 /* Set to each huge file */
 #define EXT4_EXTENTS_FL			0x00080000 /* Inode uses extents */
-#define EXT4_EXT_MIGRATE		0x00100000 /* Inode is migrating */
 #define EXT4_RESERVED_FL		0x80000000 /* reserved for ext4 lib */
 
 #define EXT4_FL_USER_VISIBLE		0x000BDFFF /* User visible flags */
@@ -289,6 +317,8 @@
 #define EXT4_STATE_XATTR		0x00000004 /* has in-inode xattrs */
 #define EXT4_STATE_NO_EXPAND		0x00000008 /* No space for expansion */
 #define EXT4_STATE_DA_ALLOC_CLOSE	0x00000010 /* Alloc DA blks on close */
+#define EXT4_STATE_EXT_MIGRATE		0x00000020 /* Inode is migrating */
+#define EXT4_STATE_DIO_UNWRITTEN	0x00000040 /* need convert on dio done*/
 
 /* Used to pass group descriptor data when online resize is done */
 struct ext4_new_group_input {
@@ -330,7 +360,16 @@
 	/* Call ext4_da_update_reserve_space() after successfully 
 	   allocating the blocks */
 #define EXT4_GET_BLOCKS_UPDATE_RESERVE_SPACE	0x0008
-
+	/* caller is from the direct IO path, request to creation of an
+	unitialized extents if not allocated, split the uninitialized
+	extent if blocks has been preallocated already*/
+#define EXT4_GET_BLOCKS_DIO			0x0010
+#define EXT4_GET_BLOCKS_CONVERT			0x0020
+#define EXT4_GET_BLOCKS_DIO_CREATE_EXT		(EXT4_GET_BLOCKS_DIO|\
+					 EXT4_GET_BLOCKS_CREATE_UNINIT_EXT)
+	/* Convert extent to initialized after direct IO complete */
+#define EXT4_GET_BLOCKS_DIO_CONVERT_EXT		(EXT4_GET_BLOCKS_CONVERT|\
+					 EXT4_GET_BLOCKS_DIO_CREATE_EXT)
 
 /*
  * ioctl commands
@@ -386,6 +425,9 @@
 #endif
 };
 
+/* Max physical block we can addres w/o extents */
+#define EXT4_MAX_BLOCK_FILE_PHYS	0xFFFFFFFF
+
 /*
  * Structure of an inode on the disk
  */
@@ -481,8 +523,8 @@
 static inline __le32 ext4_encode_extra_time(struct timespec *time)
 {
        return cpu_to_le32((sizeof(time->tv_sec) > 4 ?
-			   time->tv_sec >> 32 : 0) |
-			   ((time->tv_nsec << 2) & EXT4_NSEC_MASK));
+			   (time->tv_sec >> 32) & EXT4_EPOCH_MASK : 0) |
+                          ((time->tv_nsec << EXT4_EPOCH_BITS) & EXT4_NSEC_MASK));
 }
 
 static inline void ext4_decode_extra_time(struct timespec *time, __le32 extra)
@@ -490,7 +532,7 @@
        if (sizeof(time->tv_sec) > 4)
 	       time->tv_sec |= (__u64)(le32_to_cpu(extra) & EXT4_EPOCH_MASK)
 			       << 32;
-       time->tv_nsec = (le32_to_cpu(extra) & EXT4_NSEC_MASK) >> 2;
+       time->tv_nsec = (le32_to_cpu(extra) & EXT4_NSEC_MASK) >> EXT4_EPOCH_BITS;
 }
 
 #define EXT4_INODE_SET_XTIME(xtime, inode, raw_inode)			       \
@@ -653,6 +695,22 @@
 	__u16 i_extra_isize;
 
 	spinlock_t i_block_reservation_lock;
+#ifdef CONFIG_QUOTA
+	/* quota space reservation, managed internally by quota code */
+	qsize_t i_reserved_quota;
+#endif
+
+	/* completed async DIOs that might need unwritten extents handling */
+	struct list_head i_aio_dio_complete_list;
+	/* current io_end structure for async DIO write*/
+	ext4_io_end_t *cur_aio_dio;
+
+	/*
+	 * Transactions that contain inode's metadata needed to complete
+	 * fsync and fdatasync, respectively.
+	 */
+	tid_t i_sync_tid;
+	tid_t i_datasync_tid;
 };
 
 /*
@@ -700,6 +758,7 @@
 #define EXT4_MOUNT_DELALLOC		0x8000000 /* Delalloc support */
 #define EXT4_MOUNT_DATA_ERR_ABORT	0x10000000 /* Abort on file data write */
 #define EXT4_MOUNT_BLOCK_VALIDITY	0x20000000 /* Block validity checking */
+#define EXT4_MOUNT_DISCARD		0x40000000 /* Issue DISCARD requests */
 
 #define clear_opt(o, opt)		o &= ~EXT4_MOUNT_##opt
 #define set_opt(o, opt)			o |= EXT4_MOUNT_##opt
@@ -841,6 +900,7 @@
 	unsigned long s_gdb_count;	/* Number of group descriptor blocks */
 	unsigned long s_desc_per_block;	/* Number of group descriptors per block */
 	ext4_group_t s_groups_count;	/* Number of groups in the fs */
+	ext4_group_t s_blockfile_groups;/* Groups acceptable for non-extent files */
 	unsigned long s_overhead_last;  /* Last calculated overhead */
 	unsigned long s_blocks_last;    /* Last seen block count */
 	loff_t s_bitmap_maxbytes;	/* max bytes for bitmap files */
@@ -923,6 +983,7 @@
 	unsigned int s_mb_stats;
 	unsigned int s_mb_order2_reqs;
 	unsigned int s_mb_group_prealloc;
+	unsigned int s_max_writeback_mb_bump;
 	/* where last allocation was done - for stream allocation */
 	unsigned long s_mb_last_group;
 	unsigned long s_mb_last_start;
@@ -950,6 +1011,7 @@
 	atomic_t s_mb_lost_chunks;
 	atomic_t s_mb_preallocated;
 	atomic_t s_mb_discarded;
+	atomic_t s_lock_busy;
 
 	/* locality groups */
 	struct ext4_locality_group *s_locality_groups;
@@ -960,6 +1022,9 @@
 
 	unsigned int s_log_groups_per_flex;
 	struct flex_groups *s_flex_groups;
+
+	/* workqueue for dio unwritten */
+	struct workqueue_struct *dio_unwritten_wq;
 };
 
 static inline struct ext4_sb_info *EXT4_SB(struct super_block *sb)
@@ -1367,6 +1432,7 @@
 extern int ext4_get_inode_loc(struct inode *, struct ext4_iloc *);
 extern int ext4_can_truncate(struct inode *inode);
 extern void ext4_truncate(struct inode *);
+extern int ext4_truncate_restart_trans(handle_t *, struct inode *, int nblocks);
 extern void ext4_set_inode_flags(struct inode *);
 extern void ext4_get_inode_flags(struct ext4_inode_info *);
 extern int ext4_alloc_da_blocks(struct inode *inode);
@@ -1377,8 +1443,8 @@
 extern int ext4_block_truncate_page(handle_t *handle,
 		struct address_space *mapping, loff_t from);
 extern int ext4_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf);
-extern qsize_t ext4_get_reserved_space(struct inode *inode);
-
+extern qsize_t *ext4_get_reserved_space(struct inode *inode);
+extern int flush_aio_dio_completed_IO(struct inode *inode);
 /* ioctl.c */
 extern long ext4_ioctl(struct file *, unsigned int, unsigned long);
 extern long ext4_compat_ioctl(struct file *, unsigned int, unsigned long);
@@ -1591,15 +1657,42 @@
 #define EXT4_MB_GRP_NEED_INIT(grp)	\
 	(test_bit(EXT4_GROUP_INFO_NEED_INIT_BIT, &((grp)->bb_state)))
 
+#define EXT4_MAX_CONTENTION		8
+#define EXT4_CONTENTION_THRESHOLD	2
+
 static inline spinlock_t *ext4_group_lock_ptr(struct super_block *sb,
 					      ext4_group_t group)
 {
 	return bgl_lock_ptr(EXT4_SB(sb)->s_blockgroup_lock, group);
 }
 
+/*
+ * Returns true if the filesystem is busy enough that attempts to
+ * access the block group locks has run into contention.
+ */
+static inline int ext4_fs_is_busy(struct ext4_sb_info *sbi)
+{
+	return (atomic_read(&sbi->s_lock_busy) > EXT4_CONTENTION_THRESHOLD);
+}
+
 static inline void ext4_lock_group(struct super_block *sb, ext4_group_t group)
 {
-	spin_lock(ext4_group_lock_ptr(sb, group));
+	spinlock_t *lock = ext4_group_lock_ptr(sb, group);
+	if (spin_trylock(lock))
+		/*
+		 * We're able to grab the lock right away, so drop the
+		 * lock contention counter.
+		 */
+		atomic_add_unless(&EXT4_SB(sb)->s_lock_busy, -1, 0);
+	else {
+		/*
+		 * The lock is busy, so bump the contention counter,
+		 * and then wait on the spin lock.
+		 */
+		atomic_add_unless(&EXT4_SB(sb)->s_lock_busy, 1,
+				  EXT4_MAX_CONTENTION);
+		spin_lock(lock);
+	}
 }
 
 static inline void ext4_unlock_group(struct super_block *sb,
@@ -1650,6 +1743,8 @@
 extern void ext4_ext_release(struct super_block *);
 extern long ext4_fallocate(struct inode *inode, int mode, loff_t offset,
 			  loff_t len);
+extern int ext4_convert_unwritten_extents(struct inode *inode, loff_t offset,
+			  loff_t len);
 extern int ext4_get_blocks(handle_t *handle, struct inode *inode,
 			   sector_t block, unsigned int max_blocks,
 			   struct buffer_head *bh, int flags);
--- linux-rt-2.6.31.orig/fs/proc/kcore.c
+++ linux-rt-2.6.31/fs/proc/kcore.c
@@ -361,7 +361,13 @@
 				/* don't dump ioremap'd stuff! (TA) */
 				if (m->flags & VM_IOREMAP)
 					continue;
-				memcpy(elf_buf + (vmstart - start),
+				/*
+				 * we may access memory holes, then use
+				 * ex_table. checking return value just for
+				 * avoid warnings.
+				 */
+				vmsize = __copy_from_user_inatomic(
+					elf_buf + (vmstart - start),
 					(char *)vmstart, vmsize);
 			}
 			read_unlock(&vmlist_lock);
--- linux-rt-2.6.31.orig/fs/proc/Makefile
+++ linux-rt-2.6.31/fs/proc/Makefile
@@ -26,3 +26,4 @@
 proc-$(CONFIG_PROC_DEVICETREE)	+= proc_devtree.o
 proc-$(CONFIG_PRINTK)	+= kmsg.o
 proc-$(CONFIG_PROC_PAGE_MONITOR)	+= page.o
+proc-y	+= version_signature.o
--- linux-rt-2.6.31.orig/fs/proc/version_signature.c
+++ linux-rt-2.6.31/fs/proc/version_signature.c
@@ -0,0 +1,31 @@
+#include <linux/fs.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/proc_fs.h>
+#include <linux/seq_file.h>
+#include <linux/utsname.h>
+
+static int version_signature_proc_show(struct seq_file *m, void *v)
+{
+	seq_printf(m, "%s\n", CONFIG_VERSION_SIGNATURE);
+	return 0;
+}
+
+static int version_signature_proc_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, version_signature_proc_show, NULL);
+}
+
+static const struct file_operations version_signature_proc_fops = {
+	.open		= version_signature_proc_open,
+	.read		= seq_read,
+	.llseek		= seq_lseek,
+	.release	= single_release,
+};
+
+static int __init proc_version_signature_init(void)
+{
+	proc_create("version_signature", 0, NULL, &version_signature_proc_fops);
+	return 0;
+}
+module_init(proc_version_signature_init);
--- linux-rt-2.6.31.orig/fs/proc/base.c
+++ linux-rt-2.6.31/fs/proc/base.c
@@ -2580,8 +2580,7 @@
 	name.len = snprintf(buf, sizeof(buf), "%d", pid);
 	dentry = d_hash_and_lookup(mnt->mnt_root, &name);
 	if (dentry) {
-		if (!(current->flags & PF_EXITING))
-			shrink_dcache_parent(dentry);
+		shrink_dcache_parent(dentry);
 		d_drop(dentry);
 		dput(dentry);
 	}
--- linux-rt-2.6.31.orig/fs/proc/uptime.c
+++ linux-rt-2.6.31/fs/proc/uptime.c
@@ -4,13 +4,18 @@
 #include <linux/sched.h>
 #include <linux/seq_file.h>
 #include <linux/time.h>
+#include <linux/kernel_stat.h>
 #include <asm/cputime.h>
 
 static int uptime_proc_show(struct seq_file *m, void *v)
 {
 	struct timespec uptime;
 	struct timespec idle;
-	cputime_t idletime = cputime_add(init_task.utime, init_task.stime);
+	int i;
+	cputime_t idletime = cputime_zero;
+
+	for_each_possible_cpu(i)
+		idletime = cputime64_add(idletime, kstat_cpu(i).cpustat.idle);
 
 	do_posix_clock_monotonic_gettime(&uptime);
 	monotonic_to_bootbased(&uptime);
--- linux-rt-2.6.31.orig/fs/devpts/inode.c
+++ linux-rt-2.6.31/fs/devpts/inode.c
@@ -518,11 +518,23 @@
 
 struct tty_struct *devpts_get_tty(struct inode *pts_inode, int number)
 {
+	struct dentry *dentry;
+	struct tty_struct *tty;
+
 	BUG_ON(pts_inode->i_rdev == MKDEV(TTYAUX_MAJOR, PTMX_MINOR));
 
+	/* Ensure dentry has not been deleted by devpts_pty_kill() */
+	dentry = d_find_alias(pts_inode);
+	if (!dentry)
+		return NULL;
+
+	tty = NULL;
 	if (pts_inode->i_sb->s_magic == DEVPTS_SUPER_MAGIC)
-		return (struct tty_struct *)pts_inode->i_private;
-	return NULL;
+		tty = (struct tty_struct *)pts_inode->i_private;
+
+	dput(dentry);
+
+	return tty;
 }
 
 void devpts_pty_kill(struct tty_struct *tty)
--- linux-rt-2.6.31.orig/fs/fuse/file.c
+++ linux-rt-2.6.31/fs/fuse/file.c
@@ -1063,7 +1063,8 @@
 				break;
 		}
 	}
-	fuse_put_request(fc, req);
+	if (!IS_ERR(req))
+		fuse_put_request(fc, req);
 	if (res > 0)
 		*ppos = pos;
 
@@ -1599,7 +1600,7 @@
 			kaddr += copy;
 		}
 
-		kunmap(map);
+		kunmap(page);
 	}
 
 	return 0;
--- linux-rt-2.6.31.orig/fs/fuse/dir.c
+++ linux-rt-2.6.31/fs/fuse/dir.c
@@ -385,6 +385,9 @@
 	if (fc->no_create)
 		return -ENOSYS;
 
+	if (flags & O_DIRECT)
+		return -EINVAL;
+
 	forget_req = fuse_get_req(fc);
 	if (IS_ERR(forget_req))
 		return PTR_ERR(forget_req);
--- linux-rt-2.6.31.orig/fs/sysfs/file.c
+++ linux-rt-2.6.31/fs/sysfs/file.c
@@ -268,7 +268,7 @@
 	struct sysfs_open_dirent *od, *new_od = NULL;
 
  retry:
-	spin_lock(&sysfs_open_dirent_lock);
+	spin_lock_irq(&sysfs_open_dirent_lock);
 
 	if (!sd->s_attr.open && new_od) {
 		sd->s_attr.open = new_od;
@@ -281,7 +281,7 @@
 		list_add_tail(&buffer->list, &od->buffers);
 	}
 
-	spin_unlock(&sysfs_open_dirent_lock);
+	spin_unlock_irq(&sysfs_open_dirent_lock);
 
 	if (od) {
 		kfree(new_od);
@@ -315,8 +315,9 @@
 				  struct sysfs_buffer *buffer)
 {
 	struct sysfs_open_dirent *od = sd->s_attr.open;
+	unsigned long flags;
 
-	spin_lock(&sysfs_open_dirent_lock);
+	spin_lock_irqsave(&sysfs_open_dirent_lock, flags);
 
 	list_del(&buffer->list);
 	if (atomic_dec_and_test(&od->refcnt))
@@ -324,7 +325,7 @@
 	else
 		od = NULL;
 
-	spin_unlock(&sysfs_open_dirent_lock);
+	spin_unlock_irqrestore(&sysfs_open_dirent_lock, flags);
 
 	kfree(od);
 }
@@ -456,8 +457,9 @@
 void sysfs_notify_dirent(struct sysfs_dirent *sd)
 {
 	struct sysfs_open_dirent *od;
+	unsigned long flags;
 
-	spin_lock(&sysfs_open_dirent_lock);
+	spin_lock_irqsave(&sysfs_open_dirent_lock, flags);
 
 	od = sd->s_attr.open;
 	if (od) {
@@ -465,7 +467,7 @@
 		wake_up_interruptible(&od->poll);
 	}
 
-	spin_unlock(&sysfs_open_dirent_lock);
+	spin_unlock_irqrestore(&sysfs_open_dirent_lock, flags);
 }
 EXPORT_SYMBOL_GPL(sysfs_notify_dirent);
 
--- linux-rt-2.6.31.orig/fs/jffs2/read.c
+++ linux-rt-2.6.31/fs/jffs2/read.c
@@ -164,12 +164,15 @@
 
 	/* XXX FIXME: Where a single physical node actually shows up in two
 	   frags, we read it twice. Don't do that. */
-	/* Now we're pointing at the first frag which overlaps our page */
+	/* Now we're pointing at the first frag which overlaps our page
+	 * (or perhaps is before it, if we've been asked to read off the
+	 * end of the file). */
 	while(offset < end) {
 		D2(printk(KERN_DEBUG "jffs2_read_inode_range: offset %d, end %d\n", offset, end));
-		if (unlikely(!frag || frag->ofs > offset)) {
+		if (unlikely(!frag || frag->ofs > offset ||
+			     frag->ofs + frag->size <= offset)) {
 			uint32_t holesize = end - offset;
-			if (frag) {
+			if (frag && frag->ofs > offset) {
 				D1(printk(KERN_NOTICE "Eep. Hole in ino #%u fraglist. frag->ofs = 0x%08x, offset = 0x%08x\n", f->inocache->ino, frag->ofs, offset));
 				holesize = min(holesize, frag->ofs - offset);
 			}
--- linux-rt-2.6.31.orig/fs/jffs2/gc.c
+++ linux-rt-2.6.31/fs/jffs2/gc.c
@@ -700,7 +700,8 @@
 	struct jffs2_raw_inode ri;
 	struct jffs2_node_frag *last_frag;
 	union jffs2_device_node dev;
-	char *mdata = NULL, mdatalen = 0;
+	char *mdata = NULL;
+	int mdatalen = 0;
 	uint32_t alloclen, ilen;
 	int ret;
 
--- linux-rt-2.6.31.orig/fs/ecryptfs/main.c
+++ linux-rt-2.6.31/fs/ecryptfs/main.c
@@ -35,6 +35,7 @@
 #include <linux/key.h>
 #include <linux/parser.h>
 #include <linux/fs_stack.h>
+#include <linux/ima.h>
 #include "ecryptfs_kernel.h"
 
 /**
@@ -118,6 +119,7 @@
 	const struct cred *cred = current_cred();
 	struct ecryptfs_inode_info *inode_info =
 		ecryptfs_inode_to_private(ecryptfs_dentry->d_inode);
+	int opened_lower_file = 0;
 	int rc = 0;
 
 	mutex_lock(&inode_info->lower_file_mutex);
@@ -129,15 +131,17 @@
 		lower_dentry = ecryptfs_dentry_to_lower(ecryptfs_dentry);
 		rc = ecryptfs_privileged_open(&inode_info->lower_file,
 					      lower_dentry, lower_mnt, cred);
-		if (rc || IS_ERR(inode_info->lower_file)) {
+		if (rc) {
 			printk(KERN_ERR "Error opening lower persistent file "
 			       "for lower_dentry [0x%p] and lower_mnt [0x%p]; "
 			       "rc = [%d]\n", lower_dentry, lower_mnt, rc);
-			rc = PTR_ERR(inode_info->lower_file);
 			inode_info->lower_file = NULL;
-		}
+		} else
+			opened_lower_file = 1;
 	}
 	mutex_unlock(&inode_info->lower_file_mutex);
+	if (opened_lower_file)
+		ima_counts_get(inode_info->lower_file);
 	return rc;
 }
 
--- linux-rt-2.6.31.orig/fs/ecryptfs/crypto.c
+++ linux-rt-2.6.31/fs/ecryptfs/crypto.c
@@ -797,6 +797,7 @@
 	kfree(full_alg_name);
 	if (IS_ERR(crypt_stat->tfm)) {
 		rc = PTR_ERR(crypt_stat->tfm);
+		crypt_stat->tfm = NULL;
 		ecryptfs_printk(KERN_ERR, "cryptfs: init_crypt_ctx(): "
 				"Error initializing cipher [%s]\n",
 				crypt_stat->cipher);
@@ -1702,7 +1703,7 @@
 	} else {
 		printk(KERN_ERR "%s: No support for requested filename "
 		       "encryption method in this release\n", __func__);
-		rc = -ENOTSUPP;
+		rc = -EOPNOTSUPP;
 		goto out;
 	}
 out:
@@ -2166,7 +2167,7 @@
 			(*encoded_name)[(*encoded_name_size)] = '\0';
 			(*encoded_name_size)++;
 		} else {
-			rc = -ENOTSUPP;
+			rc = -EOPNOTSUPP;
 		}
 		if (rc) {
 			printk(KERN_ERR "%s: Error attempting to encode "
--- linux-rt-2.6.31.orig/fs/ecryptfs/keystore.c
+++ linux-rt-2.6.31/fs/ecryptfs/keystore.c
@@ -416,7 +416,9 @@
 			    &mount_crypt_stat->global_auth_tok_list,
 			    mount_crypt_stat_list) {
 		if (memcmp(walker->sig, sig, ECRYPTFS_SIG_SIZE_HEX) == 0) {
-			(*global_auth_tok) = walker;
+			rc = key_validate(walker->global_auth_tok_key);
+			if (!rc)
+				(*global_auth_tok) = walker;
 			goto out;
 		}
 	}
@@ -612,7 +614,12 @@
 	}
 	/* TODO: Support other key modules than passphrase for
 	 * filename encryption */
-	BUG_ON(s->auth_tok->token_type != ECRYPTFS_PASSWORD);
+	if (s->auth_tok->token_type != ECRYPTFS_PASSWORD) {
+		rc = -EOPNOTSUPP;
+		printk(KERN_INFO "%s: Filename encryption only supports "
+		       "password tokens\n", __func__);
+		goto out_free_unlock;
+	}
 	sg_init_one(
 		&s->hash_sg,
 		(u8 *)s->auth_tok->token.password.session_key_encryption_key,
@@ -910,7 +917,12 @@
 	}
 	/* TODO: Support other key modules than passphrase for
 	 * filename encryption */
-	BUG_ON(s->auth_tok->token_type != ECRYPTFS_PASSWORD);
+	if (s->auth_tok->token_type != ECRYPTFS_PASSWORD) {
+		rc = -EOPNOTSUPP;
+		printk(KERN_INFO "%s: Filename encryption only supports "
+		       "password tokens\n", __func__);
+		goto out_free_unlock;
+	}
 	rc = crypto_blkcipher_setkey(
 		s->desc.tfm,
 		s->auth_tok->token.password.session_key_encryption_key,
@@ -1316,8 +1328,10 @@
 		rc = -EINVAL;
 		goto out_free;
 	}
-	ecryptfs_cipher_code_to_string(crypt_stat->cipher,
-				       (u16)data[(*packet_size)]);
+	rc = ecryptfs_cipher_code_to_string(crypt_stat->cipher,
+					    (u16)data[(*packet_size)]);
+	if (rc)
+		goto out_free;
 	/* A little extra work to differentiate among the AES key
 	 * sizes; see RFC2440 */
 	switch(data[(*packet_size)++]) {
@@ -1328,7 +1342,9 @@
 		crypt_stat->key_size =
 			(*new_auth_tok)->session_key.encrypted_key_size;
 	}
-	ecryptfs_init_crypt_ctx(crypt_stat);
+	rc = ecryptfs_init_crypt_ctx(crypt_stat);
+	if (rc)
+		goto out_free;
 	if (unlikely(data[(*packet_size)++] != 0x03)) {
 		printk(KERN_WARNING "Only S2K ID 3 is currently supported\n");
 		rc = -ENOSYS;
--- linux-rt-2.6.31.orig/fs/ecryptfs/kthread.c
+++ linux-rt-2.6.31/fs/ecryptfs/kthread.c
@@ -136,6 +136,7 @@
 			     const struct cred *cred)
 {
 	struct ecryptfs_open_req *req;
+	int flags = O_LARGEFILE;
 	int rc = 0;
 
 	/* Corresponding dput() and mntput() are done when the
@@ -143,10 +144,14 @@
 	 * destroyed. */
 	dget(lower_dentry);
 	mntget(lower_mnt);
-	(*lower_file) = dentry_open(lower_dentry, lower_mnt,
-				    (O_RDWR | O_LARGEFILE), cred);
+	flags |= IS_RDONLY(lower_dentry->d_inode) ? O_RDONLY : O_RDWR;
+	(*lower_file) = dentry_open(lower_dentry, lower_mnt, flags, cred);
 	if (!IS_ERR(*lower_file))
 		goto out;
+	if (flags & O_RDONLY) {
+		rc = PTR_ERR((*lower_file));
+		goto out;
+	}
 	req = kmem_cache_alloc(ecryptfs_open_req_cache, GFP_KERNEL);
 	if (!req) {
 		rc = -ENOMEM;
@@ -180,21 +185,8 @@
 		       __func__);
 		goto out_unlock;
 	}
-	if (IS_ERR(*req->lower_file)) {
+	if (IS_ERR(*req->lower_file))
 		rc = PTR_ERR(*req->lower_file);
-		dget(lower_dentry);
-		mntget(lower_mnt);
-		(*lower_file) = dentry_open(lower_dentry, lower_mnt,
-					    (O_RDONLY | O_LARGEFILE), cred);
-		if (IS_ERR(*lower_file)) {
-			rc = PTR_ERR(*req->lower_file);
-			(*lower_file) = NULL;
-			printk(KERN_WARNING "%s: Error attempting privileged "
-			       "open of lower file with either RW or RO "
-			       "perms; rc = [%d]. Giving up.\n",
-			       __func__, rc);
-		}
-	}
 out_unlock:
 	mutex_unlock(&req->mux);
 out_free:
--- linux-rt-2.6.31.orig/fs/ecryptfs/inode.c
+++ linux-rt-2.6.31/fs/ecryptfs/inode.c
@@ -476,6 +476,7 @@
 	struct inode *lower_dir_inode = ecryptfs_inode_to_lower(dir);
 	struct dentry *lower_dir_dentry;
 
+	dget(lower_dentry);
 	lower_dir_dentry = lock_parent(lower_dentry);
 	rc = vfs_unlink(lower_dir_inode, lower_dentry);
 	if (rc) {
@@ -489,6 +490,7 @@
 	d_drop(dentry);
 out_unlock:
 	unlock_dir(lower_dir_dentry);
+	dput(lower_dentry);
 	return rc;
 }
 
--- linux-rt-2.6.31.orig/fs/nilfs2/ioctl.c
+++ linux-rt-2.6.31/fs/nilfs2/ioctl.c
@@ -297,7 +297,18 @@
 			       (unsigned long long)vdesc->vd_vblocknr);
 		return ret;
 	}
-	bh->b_private = vdesc;
+	if (unlikely(!list_empty(&bh->b_assoc_buffers))) {
+		printk(KERN_CRIT "%s: conflicting %s buffer: ino=%llu, "
+		       "cno=%llu, offset=%llu, blocknr=%llu, vblocknr=%llu\n",
+		       __func__, vdesc->vd_flags ? "node" : "data",
+		       (unsigned long long)vdesc->vd_ino,
+		       (unsigned long long)vdesc->vd_cno,
+		       (unsigned long long)vdesc->vd_offset,
+		       (unsigned long long)vdesc->vd_blocknr,
+		       (unsigned long long)vdesc->vd_vblocknr);
+		brelse(bh);
+		return -EEXIST;
+	}
 	list_add_tail(&bh->b_assoc_buffers, buffers);
 	return 0;
 }
@@ -335,24 +346,10 @@
 	list_for_each_entry_safe(bh, n, &buffers, b_assoc_buffers) {
 		ret = nilfs_gccache_wait_and_mark_dirty(bh);
 		if (unlikely(ret < 0)) {
-			if (ret == -EEXIST) {
-				vdesc = bh->b_private;
-				printk(KERN_CRIT
-				       "%s: conflicting %s buffer: "
-				       "ino=%llu, cno=%llu, offset=%llu, "
-				       "blocknr=%llu, vblocknr=%llu\n",
-				       __func__,
-				       vdesc->vd_flags ? "node" : "data",
-				       (unsigned long long)vdesc->vd_ino,
-				       (unsigned long long)vdesc->vd_cno,
-				       (unsigned long long)vdesc->vd_offset,
-				       (unsigned long long)vdesc->vd_blocknr,
-				       (unsigned long long)vdesc->vd_vblocknr);
-			}
+			WARN_ON(ret == -EEXIST);
 			goto failed;
 		}
 		list_del_init(&bh->b_assoc_buffers);
-		bh->b_private = NULL;
 		brelse(bh);
 	}
 	return nmembs;
@@ -360,7 +357,6 @@
  failed:
 	list_for_each_entry_safe(bh, n, &buffers, b_assoc_buffers) {
 		list_del_init(&bh->b_assoc_buffers);
-		bh->b_private = NULL;
 		brelse(bh);
 	}
 	return ret;
--- linux-rt-2.6.31.orig/fs/nilfs2/btnode.c
+++ linux-rt-2.6.31/fs/nilfs2/btnode.c
@@ -36,6 +36,7 @@
 
 void nilfs_btnode_cache_init_once(struct address_space *btnc)
 {
+	memset(btnc, 0, sizeof(*btnc));
 	INIT_RADIX_TREE(&btnc->page_tree, GFP_ATOMIC);
 	spin_lock_init(&btnc->tree_lock);
 	INIT_LIST_HEAD(&btnc->private_list);
@@ -275,8 +276,7 @@
 				       "invalid oldkey %lld (newkey=%lld)",
 				       (unsigned long long)oldkey,
 				       (unsigned long long)newkey);
-		if (!test_set_buffer_dirty(obh) && TestSetPageDirty(opage))
-			BUG();
+		nilfs_btnode_mark_dirty(obh);
 
 		spin_lock_irq(&btnc->tree_lock);
 		radix_tree_delete(&btnc->page_tree, oldkey);
--- linux-rt-2.6.31.orig/fs/udf/super.c
+++ linux-rt-2.6.31/fs/udf/super.c
@@ -1078,21 +1078,39 @@
 	return 0;
 }
 
-static int udf_load_vat(struct super_block *sb, int p_index, int type1_index)
+static void udf_find_vat_block(struct super_block *sb, int p_index,
+			       int type1_index, sector_t start_block)
 {
 	struct udf_sb_info *sbi = UDF_SB(sb);
 	struct udf_part_map *map = &sbi->s_partmaps[p_index];
+	sector_t vat_block;
 	struct kernel_lb_addr ino;
+
+	/*
+	 * VAT file entry is in the last recorded block. Some broken disks have
+	 * it a few blocks before so try a bit harder...
+	 */
+	ino.partitionReferenceNum = type1_index;
+	for (vat_block = start_block;
+	     vat_block >= map->s_partition_root &&
+	     vat_block >= start_block - 3 &&
+	     !sbi->s_vat_inode; vat_block--) {
+		ino.logicalBlockNum = vat_block - map->s_partition_root;
+		sbi->s_vat_inode = udf_iget(sb, &ino);
+	}
+}
+
+static int udf_load_vat(struct super_block *sb, int p_index, int type1_index)
+{
+	struct udf_sb_info *sbi = UDF_SB(sb);
+	struct udf_part_map *map = &sbi->s_partmaps[p_index];
 	struct buffer_head *bh = NULL;
 	struct udf_inode_info *vati;
 	uint32_t pos;
 	struct virtualAllocationTable20 *vat20;
 	sector_t blocks = sb->s_bdev->bd_inode->i_size >> sb->s_blocksize_bits;
 
-	/* VAT file entry is in the last recorded block */
-	ino.partitionReferenceNum = type1_index;
-	ino.logicalBlockNum = sbi->s_last_block - map->s_partition_root;
-	sbi->s_vat_inode = udf_iget(sb, &ino);
+	udf_find_vat_block(sb, p_index, type1_index, sbi->s_last_block);
 	if (!sbi->s_vat_inode &&
 	    sbi->s_last_block != blocks - 1) {
 		printk(KERN_NOTICE "UDF-fs: Failed to read VAT inode from the"
@@ -1100,9 +1118,7 @@
 		       "block of the device (%lu).\n",
 		       (unsigned long)sbi->s_last_block,
 		       (unsigned long)blocks - 1);
-		ino.partitionReferenceNum = type1_index;
-		ino.logicalBlockNum = blocks - 1 - map->s_partition_root;
-		sbi->s_vat_inode = udf_iget(sb, &ino);
+		udf_find_vat_block(sb, p_index, type1_index, blocks - 1);
 	}
 	if (!sbi->s_vat_inode)
 		return 1;
--- linux-rt-2.6.31.orig/fs/cifs/misc.c
+++ linux-rt-2.6.31/fs/cifs/misc.c
@@ -705,3 +705,17 @@
 ctoUCS_out:
 	return i;
 }
+
+void
+cifs_autodisable_serverino(struct cifs_sb_info *cifs_sb)
+{
+	if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM) {
+		cifs_sb->mnt_cifs_flags &= ~CIFS_MOUNT_SERVER_INUM;
+		cERROR(1, ("Autodisabling the use of server inode numbers on "
+			   "%s. This server doesn't seem to support them "
+			   "properly. Hardlinks will not be recognized on this "
+			   "mount. Consider mounting with the \"noserverino\" "
+			   "option to silence this message.",
+			   cifs_sb->tcon->treeName));
+	}
+}
--- linux-rt-2.6.31.orig/fs/cifs/connect.c
+++ linux-rt-2.6.31/fs/cifs/connect.c
@@ -1556,7 +1556,8 @@
 
 out_err:
 	if (tcp_ses) {
-		kfree(tcp_ses->hostname);
+		if (!IS_ERR(tcp_ses->hostname))
+			kfree(tcp_ses->hostname);
 		if (tcp_ses->ssocket)
 			sock_release(tcp_ses->ssocket);
 		kfree(tcp_ses);
@@ -2199,16 +2200,8 @@
 		   struct cifs_sb_info *cifs_sb, const char *full_path)
 {
 	int rc;
-	__u64 inode_num;
 	FILE_ALL_INFO *pfile_info;
 
-	rc = CIFSGetSrvInodeNumber(xid, tcon, full_path, &inode_num,
-				   cifs_sb->local_nls,
-				   cifs_sb->mnt_cifs_flags &
-						CIFS_MOUNT_MAP_SPECIAL_CHR);
-	if (rc != -EOPNOTSUPP)
-		return rc;
-
 	pfile_info = kmalloc(sizeof(FILE_ALL_INFO), GFP_KERNEL);
 	if (pfile_info == NULL)
 		return -ENOMEM;
@@ -2274,12 +2267,12 @@
 cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
 		char *mount_data_global, const char *devname)
 {
-	int rc = 0;
+	int rc;
 	int xid;
 	struct smb_vol *volume_info;
-	struct cifsSesInfo *pSesInfo = NULL;
-	struct cifsTconInfo *tcon = NULL;
-	struct TCP_Server_Info *srvTcp = NULL;
+	struct cifsSesInfo *pSesInfo;
+	struct cifsTconInfo *tcon;
+	struct TCP_Server_Info *srvTcp;
 	char   *full_path;
 	char *mount_data = mount_data_global;
 #ifdef CONFIG_CIFS_DFS_UPCALL
@@ -2288,6 +2281,10 @@
 	int referral_walks_count = 0;
 try_mount_again:
 #endif
+	rc = 0;
+	tcon = NULL;
+	pSesInfo = NULL;
+	srvTcp = NULL;
 	full_path = NULL;
 
 	xid = GetXid();
@@ -2584,6 +2581,7 @@
 
 			cleanup_volume_info(&volume_info);
 			referral_walks_count++;
+			FreeXid(xid);
 			goto try_mount_again;
 		}
 #else /* No DFS support, return error on mount */
--- linux-rt-2.6.31.orig/fs/cifs/dir.c
+++ linux-rt-2.6.31/fs/cifs/dir.c
@@ -212,8 +212,6 @@
 		posix_flags |= SMB_O_EXCL;
 	if (oflags & O_TRUNC)
 		posix_flags |= SMB_O_TRUNC;
-	if (oflags & O_APPEND)
-		posix_flags |= SMB_O_APPEND;
 	if (oflags & O_SYNC)
 		posix_flags |= SMB_O_SYNC;
 	if (oflags & O_DIRECTORY)
@@ -648,7 +646,7 @@
 	 * O_EXCL: optimize away the lookup, but don't hash the dentry. Let
 	 * the VFS handle the create.
 	 */
-	if (nd->flags & LOOKUP_EXCL) {
+	if (nd && (nd->flags & LOOKUP_EXCL)) {
 		d_instantiate(direntry, NULL);
 		return 0;
 	}
@@ -680,7 +678,7 @@
 	 * reduction in network traffic in the other paths.
 	 */
 	if (pTcon->unix_ext) {
-		if (!(nd->flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY)) &&
+		if (nd && !(nd->flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY)) &&
 		     (nd->flags & LOOKUP_OPEN) && !pTcon->broken_posix_open &&
 		     (nd->intent.open.flags & O_CREAT)) {
 			rc = cifs_posix_open(full_path, &newInode,
--- linux-rt-2.6.31.orig/fs/cifs/cifsproto.h
+++ linux-rt-2.6.31/fs/cifs/cifsproto.h
@@ -389,4 +389,5 @@
 		const struct nls_table *nls_codepage, int remap_special_chars);
 extern int CIFSGetExtAttr(const int xid, struct cifsTconInfo *tcon,
 			const int netfid, __u64 *pExtAttrBits, __u64 *pMask);
+extern void cifs_autodisable_serverino(struct cifs_sb_info *cifs_sb);
 #endif			/* _CIFSPROTO_H */
--- linux-rt-2.6.31.orig/fs/cifs/cifsglob.h
+++ linux-rt-2.6.31/fs/cifs/cifsglob.h
@@ -572,9 +572,9 @@
 #define   CIFSSEC_MUST_LANMAN	0x10010
 #define   CIFSSEC_MUST_PLNTXT	0x20020
 #ifdef CONFIG_CIFS_UPCALL
-#define   CIFSSEC_MASK          0xAF0AF /* allows weak security but also krb5 */
+#define   CIFSSEC_MASK          0xBF0BF /* allows weak security but also krb5 */
 #else
-#define   CIFSSEC_MASK          0xA70A7 /* current flags supported if weak */
+#define   CIFSSEC_MASK          0xB70B7 /* current flags supported if weak */
 #endif /* UPCALL */
 #else /* do not allow weak pw hash */
 #ifdef CONFIG_CIFS_UPCALL
--- linux-rt-2.6.31.orig/fs/cifs/inode.c
+++ linux-rt-2.6.31/fs/cifs/inode.c
@@ -512,13 +512,10 @@
 					cifs_sb->local_nls,
 					cifs_sb->mnt_cifs_flags &
 						CIFS_MOUNT_MAP_SPECIAL_CHR);
-			if (rc1) {
+			if (rc1 || !fattr.cf_uniqueid) {
 				cFYI(1, ("GetSrvInodeNum rc %d", rc1));
 				fattr.cf_uniqueid = iunique(sb, ROOT_I);
-				/* disable serverino if call not supported */
-				if (rc1 == -EINVAL)
-					cifs_sb->mnt_cifs_flags &=
-							~CIFS_MOUNT_SERVER_INUM;
+				cifs_autodisable_serverino(cifs_sb);
 			}
 		} else {
 			fattr.cf_uniqueid = iunique(sb, ROOT_I);
--- linux-rt-2.6.31.orig/fs/cifs/readdir.c
+++ linux-rt-2.6.31/fs/cifs/readdir.c
@@ -727,11 +727,12 @@
 		cifs_dir_info_to_fattr(&fattr, (FILE_DIRECTORY_INFO *)
 					pfindEntry, cifs_sb);
 
-	/* FIXME: make _to_fattr functions fill this out */
-	if (pCifsF->srch_inf.info_level == SMB_FIND_FILE_ID_FULL_DIR_INFO)
+	if (inum && (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM)) {
 		fattr.cf_uniqueid = inum;
-	else
+	} else {
 		fattr.cf_uniqueid = iunique(sb, ROOT_I);
+		cifs_autodisable_serverino(cifs_sb);
+	}
 
 	ino = cifs_uniqueid_to_ino_t(fattr.cf_uniqueid);
 	tmp_dentry = cifs_readdir_lookup(file->f_dentry, &qstring, &fattr);
--- linux-rt-2.6.31.orig/fs/ext3/inode.c
+++ linux-rt-2.6.31/fs/ext3/inode.c
@@ -1137,6 +1137,16 @@
 	return ext3_journal_get_write_access(handle, bh);
 }
 
+/*
+ * Truncate blocks that were not used by write. We have to truncate the
+ * pagecache as well so that corresponding buffers get properly unmapped.
+ */
+static void ext3_truncate_failed_write(struct inode *inode)
+{
+	truncate_inode_pages(inode->i_mapping, inode->i_size);
+	ext3_truncate(inode);
+}
+
 static int ext3_write_begin(struct file *file, struct address_space *mapping,
 				loff_t pos, unsigned len, unsigned flags,
 				struct page **pagep, void **fsdata)
@@ -1195,7 +1205,7 @@
 		unlock_page(page);
 		page_cache_release(page);
 		if (pos + len > inode->i_size)
-			ext3_truncate(inode);
+			ext3_truncate_failed_write(inode);
 	}
 	if (ret == -ENOSPC && ext3_should_retry_alloc(inode->i_sb, &retries))
 		goto retry;
@@ -1290,7 +1300,7 @@
 	page_cache_release(page);
 
 	if (pos + len > inode->i_size)
-		ext3_truncate(inode);
+		ext3_truncate_failed_write(inode);
 	return ret ? ret : copied;
 }
 
@@ -1316,7 +1326,7 @@
 	page_cache_release(page);
 
 	if (pos + len > inode->i_size)
-		ext3_truncate(inode);
+		ext3_truncate_failed_write(inode);
 	return ret ? ret : copied;
 }
 
@@ -1369,7 +1379,7 @@
 	page_cache_release(page);
 
 	if (pos + len > inode->i_size)
-		ext3_truncate(inode);
+		ext3_truncate_failed_write(inode);
 	return ret ? ret : copied;
 }
 
--- linux-rt-2.6.31.orig/fs/ext3/super.c
+++ linux-rt-2.6.31/fs/ext3/super.c
@@ -2321,7 +2321,18 @@
 
 	if (!sbh)
 		return error;
-	es->s_wtime = cpu_to_le32(get_seconds());
+	/*
+	 * If the file system is mounted read-only, don't update the
+	 * superblock write time.  This avoids updating the superblock
+	 * write time when we are mounting the root file system
+	 * read/only but we need to replay the journal; at that point,
+	 * for people who are east of GMT and who make their clock
+	 * tick in localtime for Windows bug-for-bug compatibility,
+	 * the clock is set in the future, and this will cause e2fsck
+	 * to complain and force a full file system check.
+	 */
+	if (!(sb->s_flags & MS_RDONLY))
+		es->s_wtime = cpu_to_le32(get_seconds());
 	es->s_free_blocks_count = cpu_to_le32(ext3_count_free_blocks(sb));
 	es->s_free_inodes_count = cpu_to_le32(ext3_count_free_inodes(sb));
 	BUFFER_TRACE(sbh, "marking dirty");
--- linux-rt-2.6.31.orig/fs/nfsd/nfs4state.c
+++ linux-rt-2.6.31/fs/nfsd/nfs4state.c
@@ -647,10 +647,6 @@
 		clp->cl_cb_conn.cb_client = NULL;
 		rpc_shutdown_client(clnt);
 	}
-	if (clp->cl_cb_conn.cb_cred) {
-		put_rpccred(clp->cl_cb_conn.cb_cred);
-		clp->cl_cb_conn.cb_cred = NULL;
-	}
 }
 
 static inline void
@@ -4086,6 +4082,7 @@
 	laundry_wq = create_singlethread_workqueue("nfsd4");
 	queue_delayed_work(laundry_wq, &laundromat_work, grace_time);
 	set_max_delegations();
+	return set_callback_cred();
 }
 
 void
--- linux-rt-2.6.31.orig/fs/nfsd/nfs4callback.c
+++ linux-rt-2.6.31/fs/nfsd/nfs4callback.c
@@ -439,42 +439,29 @@
 	.rpc_call_done = nfsd4_cb_probe_done,
 };
 
-static struct rpc_cred *lookup_cb_cred(struct nfs4_cb_conn *cb)
-{
-	struct auth_cred acred = {
-		.machine_cred = 1
-	};
+static struct rpc_cred *callback_cred;
 
-	/*
-	 * Note in the gss case this doesn't actually have to wait for a
-	 * gss upcall (or any calls to the client); this just creates a
-	 * non-uptodate cred which the rpc state machine will fill in with
-	 * a refresh_upcall later.
-	 */
-	return rpcauth_lookup_credcache(cb->cb_client->cl_auth, &acred,
-							RPCAUTH_LOOKUP_NEW);
+int set_callback_cred(void)
+{
+	callback_cred = rpc_lookup_machine_cred();
+	if (!callback_cred)
+		return -ENOMEM;
+	return 0;
 }
 
+
 void do_probe_callback(struct nfs4_client *clp)
 {
 	struct nfs4_cb_conn *cb = &clp->cl_cb_conn;
 	struct rpc_message msg = {
 		.rpc_proc       = &nfs4_cb_procedures[NFSPROC4_CLNT_CB_NULL],
 		.rpc_argp       = clp,
+		.rpc_cred	= callback_cred
 	};
-	struct rpc_cred *cred;
 	int status;
 
-	cred = lookup_cb_cred(cb);
-	if (IS_ERR(cred)) {
-		status = PTR_ERR(cred);
-		goto out;
-	}
-	cb->cb_cred = cred;
-	msg.rpc_cred = cb->cb_cred;
 	status = rpc_call_async(cb->cb_client, &msg, RPC_TASK_SOFT,
 				&nfsd4_cb_probe_ops, (void *)clp);
-out:
 	if (status) {
 		warn_no_callback_path(clp, status);
 		put_nfs4_client(clp);
@@ -557,7 +544,7 @@
 	struct rpc_message msg = {
 		.rpc_proc = &nfs4_cb_procedures[NFSPROC4_CLNT_CB_RECALL],
 		.rpc_argp = dp,
-		.rpc_cred = clp->cl_cb_conn.cb_cred
+		.rpc_cred = callback_cred
 	};
 	int status;
 
--- linux-rt-2.6.31.orig/fs/nfs/nfs4xdr.c
+++ linux-rt-2.6.31/fs/nfs/nfs4xdr.c
@@ -5406,7 +5406,6 @@
 	{ NFS4ERR_SERVERFAULT,	-ESERVERFAULT	},
 	{ NFS4ERR_BADTYPE,	-EBADTYPE	},
 	{ NFS4ERR_LOCKED,	-EAGAIN		},
-	{ NFS4ERR_RESOURCE,	-EREMOTEIO	},
 	{ NFS4ERR_SYMLINK,	-ELOOP		},
 	{ NFS4ERR_OP_ILLEGAL,	-EOPNOTSUPP	},
 	{ NFS4ERR_DEADLOCK,	-EDEADLK	},
--- linux-rt-2.6.31.orig/fs/nfs/client.c
+++ linux-rt-2.6.31/fs/nfs/client.c
@@ -1171,7 +1171,7 @@
 				      1, flags & NFS_MOUNT_NORESVPORT);
 	if (error < 0)
 		goto error;
-	memcpy(clp->cl_ipaddr, ip_addr, sizeof(clp->cl_ipaddr));
+	strlcpy(clp->cl_ipaddr, ip_addr, sizeof(clp->cl_ipaddr));
 
 	error = nfs_idmap_new(clp);
 	if (error < 0) {
--- linux-rt-2.6.31.orig/fs/nfs/dir.c
+++ linux-rt-2.6.31/fs/nfs/dir.c
@@ -1536,6 +1536,8 @@
 		old_dentry->d_parent->d_name.name, old_dentry->d_name.name,
 		dentry->d_parent->d_name.name, dentry->d_name.name);
 
+	nfs_inode_return_delegation(inode);
+
 	d_drop(dentry);
 	error = NFS_PROTO(dir)->link(inode, dir, &dentry->d_name);
 	if (error == 0) {
--- linux-rt-2.6.31.orig/fs/nfs/nfs4proc.c
+++ linux-rt-2.6.31/fs/nfs/nfs4proc.c
@@ -71,12 +71,17 @@
 /* Prevent leaks of NFSv4 errors into userland */
 static int nfs4_map_errors(int err)
 {
-	if (err < -1000) {
+	if (err >= -1000)
+		return err;
+	switch (err) {
+	case -NFS4ERR_RESOURCE:
+		return -EREMOTEIO;
+	default:
 		dprintk("%s could not handle NFSv4 error %d\n",
 				__func__, -err);
-		return -EIO;
+		break;
 	}
-	return err;
+	return -EIO;
 }
 
 /*
@@ -2735,7 +2740,7 @@
 		.pages = &page,
 		.pgbase = 0,
 		.count = count,
-		.bitmask = NFS_SERVER(dentry->d_inode)->cache_consistency_bitmask,
+		.bitmask = NFS_SERVER(dentry->d_inode)->attr_bitmask,
 	};
 	struct nfs4_readdir_res res;
 	struct rpc_message msg = {
@@ -3033,9 +3038,6 @@
 	if (time_before(clp->cl_last_renewal,timestamp))
 		clp->cl_last_renewal = timestamp;
 	spin_unlock(&clp->cl_lock);
-	dprintk("%s calling put_rpccred on rpc_cred %p\n", __func__,
-				task->tk_msg.rpc_cred);
-	put_rpccred(task->tk_msg.rpc_cred);
 }
 
 static const struct rpc_call_ops nfs4_renew_ops = {
@@ -4850,7 +4852,6 @@
 	nfs41_sequence_free_slot(clp, task->tk_msg.rpc_resp);
 	dprintk("%s rpc_cred %p\n", __func__, task->tk_msg.rpc_cred);
 
-	put_rpccred(task->tk_msg.rpc_cred);
 	kfree(task->tk_msg.rpc_argp);
 	kfree(task->tk_msg.rpc_resp);
 
--- linux-rt-2.6.31.orig/fs/nfs/direct.c
+++ linux-rt-2.6.31/fs/nfs/direct.c
@@ -457,6 +457,7 @@
 	};
 	struct rpc_task_setup task_setup_data = {
 		.rpc_client = NFS_CLIENT(inode),
+		.rpc_message = &msg,
 		.callback_ops = &nfs_write_direct_ops,
 		.workqueue = nfsiod_workqueue,
 		.flags = RPC_TASK_ASYNC,
--- linux-rt-2.6.31.orig/fs/nfs/super.c
+++ linux-rt-2.6.31/fs/nfs/super.c
@@ -1323,6 +1323,7 @@
 			default:
 				dfprintk(MOUNT, "NFS:   unrecognized "
 						"transport protocol\n");
+				kfree(string);
 				return 0;
 			}
 			break;
@@ -2669,7 +2670,6 @@
 	dprintk("--> %s\n", __func__);
 	nfs_super_return_all_delegations(sb);
 	kill_anon_super(sb);
-	nfs4_renewd_prepare_shutdown(server);
 	nfs_fscache_release_super_cookie(sb);
 	nfs_free_server(server);
 	dprintk("<-- %s\n", __func__);
--- linux-rt-2.6.31.orig/fs/nfs/nfs4renewd.c
+++ linux-rt-2.6.31/fs/nfs/nfs4renewd.c
@@ -127,12 +127,6 @@
 }
 
 void
-nfs4_renewd_prepare_shutdown(struct nfs_server *server)
-{
-	cancel_delayed_work(&server->nfs_client->cl_renewd);
-}
-
-void
 nfs4_kill_renewd(struct nfs_client *clp)
 {
 	cancel_delayed_work_sync(&clp->cl_renewd);
--- linux-rt-2.6.31.orig/fs/jbd2/transaction.c
+++ linux-rt-2.6.31/fs/jbd2/transaction.c
@@ -57,7 +57,7 @@
 	INIT_LIST_HEAD(&transaction->t_private_list);
 
 	/* Set up the commit timer for the new transaction. */
-	journal->j_commit_timer.expires = round_jiffies(transaction->t_expires);
+	journal->j_commit_timer.expires = round_jiffies_up(transaction->t_expires);
 	add_timer(&journal->j_commit_timer);
 
 	J_ASSERT(journal->j_running_transaction == NULL);
@@ -238,6 +238,8 @@
 		  __jbd2_log_space_left(journal));
 	spin_unlock(&transaction->t_handle_lock);
 	spin_unlock(&journal->j_state_lock);
+
+	lock_map_acquire(&handle->h_lockdep_map);
 out:
 	if (unlikely(new_transaction))		/* It's usually NULL */
 		kfree(new_transaction);
@@ -303,8 +305,6 @@
 		handle = ERR_PTR(err);
 		goto out;
 	}
-
-	lock_map_acquire(&handle->h_lockdep_map);
 out:
 	return handle;
 }
@@ -426,6 +426,7 @@
 	__jbd2_log_start_commit(journal, transaction->t_tid);
 	spin_unlock(&journal->j_state_lock);
 
+	lock_map_release(&handle->h_lockdep_map);
 	handle->h_buffer_credits = nblocks;
 	ret = start_this_handle(journal, handle);
 	return ret;
--- linux-rt-2.6.31.orig/fs/jbd2/commit.c
+++ linux-rt-2.6.31/fs/jbd2/commit.c
@@ -636,6 +636,10 @@
 		JBUFFER_TRACE(jh, "ph3: write metadata");
 		flags = jbd2_journal_write_metadata_buffer(commit_transaction,
 						      jh, &new_jh, blocknr);
+		if (flags < 0) {
+			jbd2_journal_abort(journal, flags);
+			continue;
+		}
 		set_bit(BH_JWrite, &jh2bh(new_jh)->b_state);
 		wbuf[bufs++] = jh2bh(new_jh);
 
--- linux-rt-2.6.31.orig/fs/jbd2/journal.c
+++ linux-rt-2.6.31/fs/jbd2/journal.c
@@ -78,6 +78,7 @@
 EXPORT_SYMBOL(jbd2_journal_ack_err);
 EXPORT_SYMBOL(jbd2_journal_clear_err);
 EXPORT_SYMBOL(jbd2_log_wait_commit);
+EXPORT_SYMBOL(jbd2_log_start_commit);
 EXPORT_SYMBOL(jbd2_journal_start_commit);
 EXPORT_SYMBOL(jbd2_journal_force_commit_nested);
 EXPORT_SYMBOL(jbd2_journal_wipe);
@@ -361,6 +362,10 @@
 
 		jbd_unlock_bh_state(bh_in);
 		tmp = jbd2_alloc(bh_in->b_size, GFP_NOFS);
+		if (!tmp) {
+			jbd2_journal_put_journal_head(new_jh);
+			return -ENOMEM;
+		}
 		jbd_lock_bh_state(bh_in);
 		if (jh_in->b_frozen_data) {
 			jbd2_free(tmp, bh_in->b_size);
@@ -1187,6 +1192,12 @@
 
 	first = be32_to_cpu(sb->s_first);
 	last = be32_to_cpu(sb->s_maxlen);
+	if (first + JBD2_MIN_JOURNAL_BLOCKS > last + 1) {
+		printk(KERN_ERR "JBD: Journal too short (blocks %llu-%llu).\n",
+		       first, last);
+		journal_fail_superblock(journal);
+		return -EINVAL;
+	}
 
 	journal->j_first = first;
 	journal->j_last = last;
@@ -1410,6 +1421,13 @@
 	if (jbd2_journal_recover(journal))
 		goto recovery_error;
 
+	if (journal->j_failed_commit) {
+		printk(KERN_ERR "JBD2: journal transaction %u on %s "
+		       "is corrupt.\n", journal->j_failed_commit,
+		       journal->j_devname);
+		return -EIO;
+	}
+
 	/* OK, we've finished with the dynamic journal bits:
 	 * reinitialise the dynamic contents of the superblock in memory
 	 * and reset them on disk. */
--- linux-rt-2.6.31.orig/fs/debugfs/inode.c
+++ linux-rt-2.6.31/fs/debugfs/inode.c
@@ -32,7 +32,9 @@
 static int debugfs_mount_count;
 static bool debugfs_registered;
 
-static struct inode *debugfs_get_inode(struct super_block *sb, int mode, dev_t dev)
+static struct inode *debugfs_get_inode(struct super_block *sb, int mode, dev_t dev,
+				       void *data, const struct file_operations *fops)
+
 {
 	struct inode *inode = new_inode(sb);
 
@@ -44,14 +46,18 @@
 			init_special_inode(inode, mode, dev);
 			break;
 		case S_IFREG:
-			inode->i_fop = &debugfs_file_operations;
+			inode->i_fop = fops ? fops : &debugfs_file_operations;
+			inode->i_private = data;
 			break;
 		case S_IFLNK:
 			inode->i_op = &debugfs_link_operations;
+			inode->i_fop = fops;
+			inode->i_private = data;
 			break;
 		case S_IFDIR:
 			inode->i_op = &simple_dir_inode_operations;
-			inode->i_fop = &simple_dir_operations;
+			inode->i_fop = fops ? fops : &simple_dir_operations;
+			inode->i_private = data;
 
 			/* directory inodes start off with i_nlink == 2
 			 * (for "." entry) */
@@ -64,7 +70,8 @@
 
 /* SMP-safe */
 static int debugfs_mknod(struct inode *dir, struct dentry *dentry,
-			 int mode, dev_t dev)
+			 int mode, dev_t dev, void *data,
+			 const struct file_operations *fops)
 {
 	struct inode *inode;
 	int error = -EPERM;
@@ -72,7 +79,7 @@
 	if (dentry->d_inode)
 		return -EEXIST;
 
-	inode = debugfs_get_inode(dir->i_sb, mode, dev);
+	inode = debugfs_get_inode(dir->i_sb, mode, dev, data, fops);
 	if (inode) {
 		d_instantiate(dentry, inode);
 		dget(dentry);
@@ -81,12 +88,13 @@
 	return error;
 }
 
-static int debugfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
+static int debugfs_mkdir(struct inode *dir, struct dentry *dentry, int mode,
+			 void *data, const struct file_operations *fops)
 {
 	int res;
 
 	mode = (mode & (S_IRWXUGO | S_ISVTX)) | S_IFDIR;
-	res = debugfs_mknod(dir, dentry, mode, 0);
+	res = debugfs_mknod(dir, dentry, mode, 0, data, fops);
 	if (!res) {
 		inc_nlink(dir);
 		fsnotify_mkdir(dir, dentry);
@@ -94,18 +102,20 @@
 	return res;
 }
 
-static int debugfs_link(struct inode *dir, struct dentry *dentry, int mode)
+static int debugfs_link(struct inode *dir, struct dentry *dentry, int mode,
+			void *data, const struct file_operations *fops)
 {
 	mode = (mode & S_IALLUGO) | S_IFLNK;
-	return debugfs_mknod(dir, dentry, mode, 0);
+	return debugfs_mknod(dir, dentry, mode, 0, data, fops);
 }
 
-static int debugfs_create(struct inode *dir, struct dentry *dentry, int mode)
+static int debugfs_create(struct inode *dir, struct dentry *dentry, int mode,
+			  void *data, const struct file_operations *fops)
 {
 	int res;
 
 	mode = (mode & S_IALLUGO) | S_IFREG;
-	res = debugfs_mknod(dir, dentry, mode, 0);
+	res = debugfs_mknod(dir, dentry, mode, 0, data, fops);
 	if (!res)
 		fsnotify_create(dir, dentry);
 	return res;
@@ -139,7 +149,9 @@
 
 static int debugfs_create_by_name(const char *name, mode_t mode,
 				  struct dentry *parent,
-				  struct dentry **dentry)
+				  struct dentry **dentry,
+				  void *data,
+				  const struct file_operations *fops)
 {
 	int error = 0;
 
@@ -164,13 +176,16 @@
 	if (!IS_ERR(*dentry)) {
 		switch (mode & S_IFMT) {
 		case S_IFDIR:
-			error = debugfs_mkdir(parent->d_inode, *dentry, mode);
+			error = debugfs_mkdir(parent->d_inode, *dentry, mode,
+					      data, fops);
 			break;
 		case S_IFLNK:
-			error = debugfs_link(parent->d_inode, *dentry, mode);
+			error = debugfs_link(parent->d_inode, *dentry, mode,
+					     data, fops);
 			break;
 		default:
-			error = debugfs_create(parent->d_inode, *dentry, mode);
+			error = debugfs_create(parent->d_inode, *dentry, mode,
+					       data, fops);
 			break;
 		}
 		dput(*dentry);
@@ -221,19 +236,13 @@
 	if (error)
 		goto exit;
 
-	error = debugfs_create_by_name(name, mode, parent, &dentry);
+	error = debugfs_create_by_name(name, mode, parent, &dentry,
+				       data, fops);
 	if (error) {
 		dentry = NULL;
 		simple_release_fs(&debugfs_mount, &debugfs_mount_count);
 		goto exit;
 	}
-
-	if (dentry->d_inode) {
-		if (data)
-			dentry->d_inode->i_private = data;
-		if (fops)
-			dentry->d_inode->i_fop = fops;
-	}
 exit:
 	return dentry;
 }
--- linux-rt-2.6.31.orig/fs/notify/inode_mark.c
+++ linux-rt-2.6.31/fs/notify/inode_mark.c
@@ -324,11 +324,11 @@
 	spin_lock(&group->mark_lock);
 	spin_lock(&inode->i_lock);
 
-	entry->group = group;
-	entry->inode = inode;
-
 	lentry = fsnotify_find_mark_entry(group, inode);
 	if (!lentry) {
+		entry->group = group;
+		entry->inode = inode;
+
 		hlist_add_head(&entry->i_list, &inode->i_fsnotify_mark_entries);
 		list_add(&entry->g_list, &group->mark_entries);
 
--- linux-rt-2.6.31.orig/fs/hfs/dir.c
+++ linux-rt-2.6.31/fs/hfs/dir.c
@@ -79,6 +79,11 @@
 		filp->f_pos++;
 		/* fall through */
 	case 1:
+		if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) {
+			err = -EIO;
+			goto out;
+		}
+
 		hfs_bnode_read(fd.bnode, &entry, fd.entryoffset, fd.entrylength);
 		if (entry.type != HFS_CDR_THD) {
 			printk(KERN_ERR "hfs: bad catalog folder thread\n");
@@ -109,6 +114,12 @@
 			err = -EIO;
 			goto out;
 		}
+
+		if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) {
+			err = -EIO;
+			goto out;
+		}
+
 		hfs_bnode_read(fd.bnode, &entry, fd.entryoffset, fd.entrylength);
 		type = entry.type;
 		len = hfs_mac2asc(sb, strbuf, &fd.key->cat.CName);
--- linux-rt-2.6.31.orig/fs/hfs/catalog.c
+++ linux-rt-2.6.31/fs/hfs/catalog.c
@@ -289,6 +289,10 @@
 	err = hfs_brec_find(&src_fd);
 	if (err)
 		goto out;
+	if (src_fd.entrylength > sizeof(entry) || src_fd.entrylength < 0) {
+		err = -EIO;
+		goto out;
+	}
 
 	hfs_bnode_read(src_fd.bnode, &entry, src_fd.entryoffset,
 			    src_fd.entrylength);
--- linux-rt-2.6.31.orig/fs/hfs/super.c
+++ linux-rt-2.6.31/fs/hfs/super.c
@@ -409,8 +409,13 @@
 	/* try to get the root inode */
 	hfs_find_init(HFS_SB(sb)->cat_tree, &fd);
 	res = hfs_cat_find_brec(sb, HFS_ROOT_CNID, &fd);
-	if (!res)
+	if (!res) {
+		if (fd.entrylength > sizeof(rec) || fd.entrylength < 0) {
+			res =  -EIO;
+			goto bail;
+		}
 		hfs_bnode_read(fd.bnode, &rec, fd.entryoffset, fd.entrylength);
+	}
 	if (res) {
 		hfs_find_exit(&fd);
 		goto bail_no_root;
--- linux-rt-2.6.31.orig/debian/NOTES
+++ linux-rt-2.6.31/debian/NOTES
@@ -0,0 +1,4 @@
+eSCO patch removed. Replaced upstream with a disable_esco module parm.
+airprime: Module gone, use option driver instead
+AppArmor: Patch is all there and ported. Ooops when enabled, so default
+	off (still can be enabled apparmor=1)
--- linux-rt-2.6.31.orig/debian/changelog.historical
+++ linux-rt-2.6.31/debian/changelog.historical
@@ -0,0 +1,5745 @@
+linux (2.6.24-19.33) UNRELEASED; urgency=low
+
+  CHANGELOG: Do not edit directly. Autogenerated at release.
+  CHANGELOG: Use the printchanges target to see the curent changes.
+  CHANGELOG: Use the insertchanges target to create the final log.
+
+ -- Tim Gardner <tim.gardner@canonical.com>  Sun, 04 May 2008 20:22:21 -0600
+
+linux (2.6.24-18.32) hardy-security; urgency=low
+
+  * CVE-2007-6694: [POWERPC] CHRP: Fix possible NULL pointer dereference
+  * fix SMP ordering hole in fcntl_setlk() (CVE-2008-1669)
+  * Fix dnotify/close race (CVE-2008-1375)
+  * tehuti: check register size (CVE-2008-1675)
+  * tehuti: move ioctl perm check closer to function start (CVE-2008-1675)
+
+ -- Ben Collins <ben.collins@canonical.com>  Mon, 19 May 2008 16:50:11 +0000
+
+linux (2.6.24-17.31) hardy; urgency=low
+
+  [Alessio Igor Bogani]
+
+  * rt: Fix mutex in the toshiba_acpi driver
+  * rt: Updated configuration files
+
+  [Ben Collins]
+
+  * build: Fix revert detection in git-ubuntu-log
+  * SAUCE: Re-add eeprom_bad_csum_allow module-param
+    - LP: #60388
+
+  [Stefan Bader]
+
+  * Pulled updates to openvz custom build. Fixes openvz 'refuses to boot' problem.
+    - LP: #210672
+  * sched: retain vruntime, fix delayed key events when CONFIG_FAIR_GROUP_SCHED.
+    - LP: #218516
+  * UBUNTU: SAUCE: Add blacklist support to fix Belkin bluetooth dongle.
+    - LP: #140511
+
+  [Tim Gardner]
+
+  * Enable CONFIG_ISCSI_TCP for -virtual
+    - LP: #218215
+  * build: Add fancontrol modules to powerpc64-smp debian installer
+  * Fix Xen Dom0/DomU bridging
+    - LP: #218126
+  * TSC Clocksource can cause hangs and time jumps
+    - LP: #221351
+  * Kernel should use CONFIG_FAIR_CGROUP_SCHED. Fixes high load issues
+    with pulseaudio.
+    - LP: #188226
+
+  [Upstream Kernel Changes]
+
+  * KVM: MMU: prepopulate guest pages after write-protecting
+    - LP: #221032
+
+ -- Tim Gardner <tim.gardner@canonical.com>  Fri, 11 Apr 2008 07:59:10 -0600
+
+linux (2.6.24-16.30) hardy; urgency=low
+
+  * Fix amd64/i386 ABI and module check FTBS by creating an ignore
+    and ignore.modules in the ABI directory.
+
+ -- Tim Gardner <tim.gardner@canonical.com>  Wed, 09 Apr 2008 21:58:25 -0600
+
+linux (2.6.24-16.29) hardy; urgency=low
+
+  [Stephan Bader]
+
+  * UBUNTU: SAUCE: mmc: Increase power_up deleay to fix TI readers
+
+  [Alessio Igor Bogani]
+
+  * rt: Updated configuration files
+
+  [Chuck Short]
+
+  * Xen updates for vitrio changes.
+
+  [Tim Gardner]
+
+  * openvz updates for vitrio changes.
+
+ -- Tim Gardner <tim.gardner@canonical.com>  Tue, 08 Apr 2008 21:48:16 -0600
+
+linux (2.6.24-16.28) hardy; urgency=low
+
+  [Tim Gardner]
+
+  * Revert "UBUNTU: x86: tsc prevent time going backwards"
+
+  [Kees Cook]
+
+  * AppArmor: implement mmap_min_addr check as done in mainline.
+
+  [Soren Hansen]
+
+  * Bring our virtio code up to date with 2.6.25-rc7
+
+  [Upstream Kernel Changes]
+
+  * Ubuntu: Revert all our virtio changes
+  * lguest: Reboot support
+  * lguest: adapt launcher to per-cpuness
+  * virtio: Implement skb_partial_csum_set, for setting partial csums on
+    untrusted packets.
+  * virtio: simplify config mechanism.
+  * virtio: explicit enable_cb/disable_cb rather than callback return.
+  * virtio: configuration change callback
+  * virtio: Fix vring_init/vring_size to take unsigned long
+  * virtio: clarify NO_NOTIFY flag usage
+  * virtio: remove unused id field from struct virtio_blk_outhdr
+  * virtio: Net header needs hdr_len
+  * virtio: Tweak virtio_net defines
+  * virtio: populate network rings in the probe routine, not open
+  * virtio: reset function
+  * virtio: handle interrupts after callbacks turned off
+  * virtio: Use the sg_phys convenience function.
+  * virtio: Allow virtio to be modular and used by modules
+  * virtnet: remove double ether_setup
+  * virtio: flush buffers on open
+  * virtio: free transmit skbs when notified, not on next xmit.
+  * virtio_net: parametrize the napi_weight for virtio receive queue.
+  * virtio_blk: provide getgeo
+  * virtio_blk: Dont waste major numbers
+  * virtio_blk: implement naming for vda-vdz,vdaa-vdzz,vdaaa-vdzzz
+  * virtio: PCI device
+  * virtio: Use PCI revision field to indicate virtio PCI ABI version
+  * virtio: balloon driver
+  * virtio net: fix oops on interface-up
+  * virtio: add missing #include <linux/delay.h>
+  * virtio: fix race in enable_cb
+  * virtio: handle > 2 billion page balloon targets
+  * virtio_net: Fix oops on early interrupts - introduced by virtio reset
+    code
+  * lguest: Do not append space to guests kernel command line
+  * virtio: Use spin_lock_irqsave/restore for virtio-pci
+  * virtio: Fix sysfs bits to have proper block symlink
+  * virtio: Enable netpoll interface for netconsole logging
+  * virtio_pci: unregister virtio device at device remove
+  * lguest: Add puppies which where previously missing.
+  * lguest: lguest.txt documentation fix
+  * lguest: Don't need comment terminator before disk section.
+  * virtio_pci iomem annotations
+  * virtio_net: remove overzealous printk
+  * virtio: remove overzealous BUG_ON.
+
+ -- Tim Gardner <tim.gardner@canonical.com>  Tue, 08 Apr 2008 11:53:49 -0600
+
+linux (2.6.24-15.27) hardy; urgency=low
+
+  [Alan Stern]
+
+  * usb-storage: don't access beyond the end of the sg buffer
+    - LP: #204922
+
+  [Mario Limonciello]
+
+  * Enable Reset and SCO workaround on Dell 410 BT adapter
+
+  [Tim Gardner]
+
+  * Enable CONFIG_E1000 in the i386 virtual image.
+    - LP: #205646
+
+  [Thomas Gleixner]
+
+  * x86: tsc prevent time going backwards
+
+  [Matthew Garrett]
+
+  * Fix framebuffer fonts on non-x86 platforms
+
+ -- Tim Gardner <tim.gardner@canonical.com>  Fri, 04 Apr 2008 08:14:49 -0600
+
+linux (2.6.24-15.26) hardy; urgency=low
+
+  [Colin Ian King]
+
+  * airprime.c supports more devices
+    - LP: #208250
+
+  [Kees Cook]
+
+  * AppArmor: get latest batch of upstream fixes into Hardy (svn 1160)
+
+  [Stefan Bader]
+
+  * ACPI: fix boot oops regression in kernel
+    - LP: #207014
+
+  [Tim Gardner]
+
+  * Enable CGROUPS for non x86/x86_64 arches, all flavours.
+   - LP: #188226
+
+ -- Tim Gardner <tim.gardner@canonical.com>  Thu, 03 Apr 2008 07:00:29 -0600
+
+linux (2.6.24-14.25) hardy; urgency=low
+
+  [Mario Limonciello]
+
+  * Resolve sky2 race condition leading to failed suspends
+    - LP: #210877
+
+  [Tim Gardner]
+
+  * Copy drivers/media internal header files into header
+    package for external LUM compilation. This paves the
+    way for LP #202065.
+
+ -- Tim Gardner <tim.gardner@canonical.com>  Wed, 02 Apr 2008 08:28:32 -0600
+
+linux (2.6.24-14.24) hardy; urgency=low
+
+  [Amit Kucheria]
+
+  * LPIA: Update from moblin
+  * LPIA: Fix reboot problem after S3/S4
+  * LPIA: Integrate latest Dabney thermal patches
+  * LPIA: Change-umd_dbg-debug-level-to-KERN_INFO
+  * LPIA: Compile modules into kernel to save on boot time
+  * LPIA: lots of Dabney CONFIG options dissapeared
+  * LPIA: Purge nonexistent config options
+
+  [Jay Chetty]
+
+  * UBUNTU:USBC:Integrated USBC 2.0.0.32L.0009
+
+  [Misha Zhilin]
+
+  * USB: ehci: handle large bulk URBs correctly (again)
+    - LP: #204857
+
+  [Tim Gardner]
+
+  * frame buffer regression - screen blank except for blinking cursor after
+    fbcon vtswitch
+    - LP: #201591
+  * Blacklist Bluetooth Dell Wireless 370 for SCO MTU
+    - LP: #209715
+  * Set CONFIG_FAIR_CGROUP_SCHED for server flavours.
+    - LP: #188226
+  * Add DMI IO_DELAY support.
+    - LP: #200057
+
+ -- Tim Gardner <tim.gardner@canonical.com>  Mon, 31 Mar 2008 11:19:49 -0600
+
+linux (2.6.24-13.23) hardy; urgency=low
+
+  [Alessio Igor Bogani]
+
+  * rt: Updated configuration files
+
+  [Ben Collins]
+
+  * openvz: New custom flavour for OpenVZ
+  * config: Disable IDE AMD driver in favor of PATA version
+    - LP: #181561
+  * config: Disable IDE VIA driver in favor of PATA version
+    - LP: #181561
+  * drivers/video: Restore gutsy backlight dimming behavior
+    - LP: #205261
+  * build/config: Enable CONFIG_CIFS_WEAK_PW_HASH
+    - LP: #202445
+
+  [Colin Ian King]
+
+  * SAUCE: Add support for version 4 of Chelsio NICs in cxgb3 driver
+    - LP: #201893
+
+  [Kees Cook]
+
+  * AppArmor: re-add missing "type" field in syslog reports.
+    - LP: #202888
+  * kvm: reset TSS on x86_64 to avoid ioperm bitmap corruption
+    - LP: #144900
+
+  [Stefan Bader]
+
+  * USB: EHCI: add separate IAA watchdog timer
+    - LP: #198619
+  * SAUCE: Always use SCO protocol (disable eSCO support)
+    - LP: #39414
+  * PM: Introduce PM_EVENT_HIBERNATE callback state
+    - LP: #201086
+
+  [Tim Gardner]
+
+  * Disable DRM suspend/resume on pre-915 Intel chips
+    - LP: #207496
+  * frame buffer regression - screen blank except for blinking cursor after fbcon
+    vtswitch
+    - LP: #201591
+
+ -- Tim Gardner <tim.gardner@canonical.com>  Wed, 19 Mar 2008 10:05:05 -0400
+
+linux (2.6.24-12.22) hardy; urgency=low
+
+  [Ben Collins]
+
+  * custom/rt: Disable toshiba_acpi, since it isn't compatible
+
+ -- Ben Collins <bcollins@ubuntu.com>  Wed, 12 Mar 2008 14:38:59 -0400
+
+linux (2.6.24-12.21) hardy; urgency=low
+
+  [Ben Collins]
+
+  * build: Fix vesafb module inclusion into initrd subdir
+    - LP: #129910
+  * net/bluetooth: POWERBOOK => APPLE, fix for apple keyboard patch
+  * custom/xen: Remove asix portion of xen patch, breaks driver
+    - LP: #199296
+
+  [Colin Ian King]
+
+  * SAUCE: fix Udma not fully available in Acer 1694 Wlmi
+    - LP: #187121
+  * SAUCE: Update toshiba_acpi.c to version 0.19a
+    - LP: #77026
+
+  [Stefan Bader]
+
+  * x86: Clear DF before calling signal handler
+  * Enable FN key on Apple aluminum bluetooth keyboard
+    - LP: #162083
+
+ -- Ben Collins <bcollins@ubuntu.com>  Tue, 11 Mar 2008 13:20:49 -0400
+
+linux (2.6.24-12.20) hardy; urgency=low
+
+  [Ben Collins]
+
+  * Enable CONFIG_SOUND at least, so alsa build in lum works
+    - LP: #200338
+
+ -- Ben Collins <bcollins@ubuntu.com>  Mon, 10 Mar 2008 08:15:00 -0400
+
+linux (2.6.24-12.19) hardy; urgency=low
+
+  * Re-upload of -12.18 to fix build failures
+  * Fixup binary-custom configs
+  * Fixup xen patch to cope with kvm changes
+
+  [Amit Kucheria]
+
+  * Move Marvell 8686 and 8688 to LUM
+  * Poulsbo: Sync patches with moblin/ume-hardy tree
+  * Break if a patch fails to apply
+  * SAUCE:  implement smarter atime updates support
+    - LP: #199427
+  * Enable USB_PERSIST to allow devices with /root on usb to work with
+    suspend
+  * Enable USB_PERSIST across the board
+
+  [Ben Collins]
+
+  * build/config: Really fix ide on smp ppc configs
+  * build/configs: Enable relatime config option for all flavors
+  * build/abi: Ignore ide-core module for ppc, moved to built-in
+
+  [Colin Ian King]
+
+  * fix reversed logic for bbuild check leads to -j1 default
+    - LP: #197040
+  * Enable IDE_PMAC for powerpc-smp
+    - LP: #196686
+  * Disable CONFIG_USB_OHCI_HCD_SSB
+    - LP: #182716
+  * SAUCE: fix arcmsr + archttp64 calls dma_free_coherent() with irqs
+    disabled - dmesg filled with warnings
+    - LP: #194207
+
+  [Jorge Boncompte [DTI2]]
+
+  * Fix Messed multicast lists after dev_mc_sync/unsync
+    - LP: #193468
+
+  [Stefan Bader]
+
+  * Add support for Apple Aluminium keyboards.
+    - LP: #162083
+  * SAUCE: Restore VT fonts on switch
+
+  [Upstream Kernel Changes]
+
+  * [NET]: Messed multicast lists after dev_mc_sync/unsync
+  * KVM: x86 emulator: add support for group decoding
+  * KVM: x86 emulator: group decoding for group 1A
+  * KVM: x86 emulator: Group decoding for group 3
+  * KVM: x86 emulator: Group decoding for groups 4 and 5
+  * KVM: x86 emulator: add group 7 decoding
+  * KVM: constify function pointer tables
+  * KVM: Only x86 has pio
+  * KVM: x86 emulator: group decoding for group 1 instructions
+  * KVM: MMU: Decouple mmio from shadow page tables
+  * KVM: Limit vcpu mmap size to one page on non-x86
+  * KVM: VMX: Enable Virtual Processor Identification (VPID)
+  * KVM: Use CONFIG_PREEMPT_NOTIFIERS around struct preempt_notifier
+  * KVM: Disable pagefaults during copy_from_user_inatomic()
+  * KVM: make EFER_RESERVED_BITS configurable for architecture code
+  * KVM: align valid EFER bits with the features of the host system
+  * KVM: allow access to EFER in 32bit KVM
+  * kvm: i386 fix
+  * KVM: export information about NPT to generic x86 code
+  * KVM: MMU: make the __nonpaging_map function generic
+  * KVM: export the load_pdptrs() function to modules
+  * KVM: MMU: add TDP support to the KVM MMU
+  * KVM: x86 emulator: Fix 'jmp abs'
+  * KVM: x86 emulator: fix group 5 decoding
+  * KVM: Fix kvm_arch_vcpu_ioctl_set_sregs so that set_cr0 works properly
+  * KVM: Make the supported cpuid list a host property rather than a vm
+    property
+  * KVM: emulate access to MSR_IA32_MCG_CTL
+  * KVM: remove the usage of the mmap_sem for the protection of the memory
+    slots.
+  * KVM: SVM: allocate the MSR permission map per VCPU
+  * KVM: make MMU_DEBUG compile again
+  * KVM: paravirtualized clocksource: host part
+  * KVM: Add missing semicolon
+  * KVM: x86 emulator: add ad_mask static inline
+  * KVM: x86 emulator: make register_address, address_mask static inlines
+  * KVM: x86 emulator: make register_address_increment and JMP_REL static
+    inlines
+  * KVM: Add API to retrieve the number of supported vcpus per vm
+  * KVM: Increase vcpu count to 16
+  * KVM: Add API for determining the number of supported memory slots
+  * KVM: Increase the number of user memory slots per vm
+  * KVM: Add stat counter for hypercalls
+  * KVM: x86 emulator: fix sparse warnings in x86_emulate.c
+  * KVM: sparse fixes for kvm/x86.c
+  * KVM: Implement dummy values for MSR_PERF_STATUS
+  * KVM: MMU: ignore zapped root pagetables
+  * KVM: call write_guest_time as soon as we register the paravirt clock
+  * KVM: MMU: large page support
+  * KVM: Prefix control register accessors with kvm_ to avoid namespace
+    pollution
+  * KVM: Avoid infinite-frequency local apic timer
+  * KVM: Route irq 0 to vcpu 0 exclusively
+  * KVM: SVM: add support for Nested Paging
+  * KVM: SVM: enable LBR virtualization
+  * KVM: SVM: make iopm_base static
+  * KVM: SVM: let init_vmcb() take struct vcpu_svm as parameter
+  * KVM: VMX: fix typo in VMX header define
+  * KVM: SVM: fix Windows XP 64 bit installation crash
+  * KVM: VMX: Fix invalid opcode of VPID
+  * KVM: VMX: Handle machines without EFER
+  * KVM: move alloc_apic_access_page() outside of non-preemptable region
+  * KVM: VMX: unifdef the EFER specific code
+  * KVM: SVM: move feature detection to hardware setup code
+  * KVM: Export include/linux/kvm.h only if $ARCH actually supports KVM
+  * dlm: fix rcom_names message to self
+  * virtio: Net header needs hdr_len
+
+ -- Tim Gardner <tim.gardner@canonical.com>  Mon, 03 Mar 2008 07:07:16 -0700
+
+linux (2.6.24-11.17) hardy; urgency=low
+
+  [Alan Cox]
+
+  * Pull in fixes for pata_it821x.
+    - LP: #106931
+
+  [Alessio Igor Bogani]
+
+  * rt: Synchronized with upstream (2.6.24.3-rt3)
+  * rt: Updated configuration files
+
+  [Amit Kucheria]
+
+  * Add AGP support for Radeon Mobility 9000 chipset
+    - LP: #178634
+  * Bluetooth: SCO flow control to enable bluetooth headsets
+
+  [Ben Collins]
+
+  * binary: Include vesafs in initrd subdir, should fix vga= usage
+
+  [Colin Ian King]
+
+  * AMD SB700 south bridge support patches
+    - LP: #195354
+  * BCM4311 Revision 2 fix
+    - LP: #184600
+
+  [Mauro Carvalho Chehab]
+
+  * V4L/DVB (6753): Fix vivi to support non-zero minor node
+
+  [Tim Gardner]
+
+  * Merged 2.6.24.3
+  * Add atl1 to d-i bits.
+    - LP: #159561
+  * SAUCE: Add xpad support for RedOctane Guitar Hero
+    - LP: #196745
+
+  [Upstream Kernel Changes]
+
+  * DVB: cx23885: add missing subsystem ID for Hauppauge HVR1800 Retail
+  * slab: fix bootstrap on memoryless node
+  * vm audit: add VM_DONTEXPAND to mmap for drivers that need it
+    (CVE-2008-0007)
+  * USB: keyspan: Fix oops
+  * usb gadget: fix fsl_usb2_udc potential OOPS
+  * USB: CP2101 New Device IDs
+  * USB: add support for 4348:5523 WinChipHead USB->RS 232 adapter
+  * USB: Sierra - Add support for Aircard 881U
+  * USB: Adding YC Cable USB Serial device to pl2303
+  * USB: sierra driver - add devices
+  * USB: ftdi_sio - enabling multiple ELV devices, adding EM1010PC
+  * USB: ftdi-sio: Patch to add vendor/device id for ATK_16IC CCD
+  * USB: sierra: add support for Onda H600/Zte MF330 datacard to USB Driver
+    for Sierra Wireless
+  * USB: remove duplicate entry in Option driver and Pl2303 driver for
+    Huawei modem
+  * USB: pl2303: add support for RATOC REX-USB60F
+  * USB: ftdi driver - add support for optical probe device
+  * USB: use GFP_NOIO in reset path
+  * USB: Variant of the Dell Wireless 5520 driver
+  * USB: storage: Add unusual_dev for HP r707
+  * USB: fix usbtest halt check on big endian systems
+  * USB: handle idVendor of 0x0000
+  * USB: Fix usb_serial_driver structure for Kobil cardreader driver.
+  * forcedeth: mac address mcp77/79
+  * lockdep: annotate epoll
+  * sys_remap_file_pages: fix ->vm_file accounting
+  * PCI: Fix fakephp deadlock
+  * ACPI: update ACPI blacklist
+  * x86: restore correct module name for apm
+  * sky2: restore multicast addresses after recovery
+  * sky2: fix for WOL on some devices
+  * b43: Fix suspend/resume
+  * b43: Drop packets we are not able to encrypt
+  * b43: Fix dma-slot resource leakage
+  * b43legacy: fix PIO crash
+  * b43legacy: fix suspend/resume
+  * b43legacy: drop packets we are not able to encrypt
+  * b43legacy: fix DMA slot resource leakage
+  * selinux: fix labeling of /proc/net inodes
+  * b43: Reject new firmware early
+  * sched: let +nice tasks have smaller impact
+  * sched: fix high wake up latencies with FAIR_USER_SCHED
+  * fix writev regression: pan hanging unkillable and un-straceable
+  * Driver core: Revert "Fix Firmware class name collision"
+  * drm: the drm really should call pci_set_master..
+  * splice: missing user pointer access verification (CVE-2008-0009/10)
+  * Linux 2.6.24.1
+  * splice: fix user pointer access in get_iovec_page_array()
+  * Linux 2.6.24.2
+  * ACPI: video: Rationalise ACPI backlight implementation
+  * ACPI: video: Ignore ACPI video devices that aren't present in hardware
+  * SPARC/SPARC64: Fix usage of .section .sched.text in assembler code.
+  * NETFILTER: nf_conntrack_tcp: conntrack reopening fix
+  * NFS: Fix a potential file corruption issue when writing
+  * inotify: fix check for one-shot watches before destroying them
+  * hugetlb: add locking for overcommit sysctl
+  * XFS: Fix oops in xfs_file_readdir()
+  * Fix dl2k constants
+  * SCSI: sd: handle bad lba in sense information
+  * TCP: Fix a bug in strategy_allowed_congestion_control
+  * TC: oops in em_meta
+  * SELinux: Fix double free in selinux_netlbl_sock_setsid()
+  * PKT_SCHED: ematch: oops from uninitialized variable (resend)
+  * NET: Add if_addrlabel.h to sanitized headers.
+  * IPV4: fib_trie: apply fixes from fib_hash
+  * IPV4: fib: fix route replacement, fib_info is shared
+  * IPCOMP: Fix reception of incompressible packets
+  * IPCOMP: Fetch nexthdr before ipch is destroyed
+  * INET_DIAG: Fix inet_diag_lock_handler error path.
+  * INET: Prevent out-of-sync truesize on ip_fragment slow path
+  * BLUETOOTH: Add conn add/del workqueues to avoid connection fail.
+  * AUDIT: Increase skb->truesize in audit_expand
+  * Be more robust about bad arguments in get_user_pages()
+  * Disable G5 NAP mode during SMU commands on U3
+  * hrtimer: fix *rmtp handling in hrtimer_nanosleep()
+  * hrtimer: fix *rmtp/restarts handling in compat_sys_nanosleep()
+  * SLUB: Deal with annoying gcc warning on kfree()
+  * hrtimer: check relative timeouts for overflow
+  * hrtimer: catch expired CLOCK_REALTIME timers early
+  * genirq: do not leave interupts enabled on free_irq
+  * S390: Fix futex_atomic_cmpxchg_std inline assembly.
+  * USB: fix pm counter leak in usblp
+  * SCSI: gdth: scan for scsi devices
+  * PCMCIA: Fix station address detection in smc
+  * POWERPC: Revert chrp_pci_fixup_vt8231_ata devinit to fix libata on
+    pegasos
+  * bonding: fix NULL pointer deref in startup processing
+  * x86_64: CPA, fix cache attribute inconsistency bug
+  * Linux 2.6.24.3
+
+ -- Tim Gardner <tim.gardner@canonical.com>  Mon, 25 Feb 2008 12:28:13 -0700
+
+linux (2.6.24-10.16) hardy; urgency=low
+
+  [Alessio Igor Bogani]
+
+  * rt: Synchronized with upstream (2.6.24.2-rt2)
+  * rt: Updated configuration files
+
+  [Eric Piel]
+
+  * SAUCE: ACPI: Allow custom DSDT tables to be loaded from initramfs
+    Amit Kucheria consolidated the DSDT patch with another fix that
+    ifdefs symbols required when BLK_DEV_INITR is disabled.
+
+  [Stefan Bader]
+
+  * Add Optiarc DVD drive to audio quirks list.
+    - LP: #186664
+  * Update drm and i915 drm driver to fix suspend issues.
+    - LP: #189260
+
+  [Tim Gardner]
+
+  * Fix FTBS without BLK_DEV_INITRD
+    - LP: #193507
+  * 64 bit CPA cache attribute bug
+    - LP: #193736
+  * Implemented default EDD control
+
+  [Upstream Kernel Changes]
+
+  * bonding: fix NULL pointer deref in startup processing
+  * dlm: bind connections from known local address when using TCP
+  * dlm: proper prototypes
+  * dlm: don't print common non-errors
+  * dlm: use dlm prefix on alloc and free functions
+  * dlm: close othercons
+  * dlm: align midcomms message buffer
+  * dlm: swap bytes for rcom lock reply
+  * dlm: use fixed errno values in messages
+  * dlm: clear ast_type when removing from astqueue
+  * dlm: recover locks waiting for overlap replies
+  * dlm: another call to confirm_master in receive_request_reply
+  * dlm: reject messages from non-members
+  * dlm: validate messages before processing
+  * dlm: reject normal unlock when lock is waiting for lookup
+  * dlm: limit dir lookup loop
+  * dlm: fix possible use-after-free
+  * dlm: change error message to debug
+  * dlm: keep cached master rsbs during recovery
+  * dlm: Sanity check namelen before copying it
+  * dlm: clean ups
+  * dlm: static initialization improvements
+  * dlm: use proper C for dlm/requestqueue stuff (and fix alignment bug)
+  * dlm: dlm_process_incoming_buffer() fixes
+  * dlm: do not byteswap rcom_lock
+  * dlm: do not byteswap rcom_config
+  * dlm: use proper type for ->ls_recover_buf
+  * dlm: missing length check in check_config()
+  * dlm: validate data in dlm_recover_directory()
+  * dlm: verify that places expecting rcom_lock have packet long enough
+  * dlm: receive_rcom_lock_args() overflow check
+  * dlm: make find_rsb() fail gracefully when namelen is too large
+  * dlm: fix overflows when copying from ->m_extra to lvb
+  * dlm: fix dlm_dir_lookup() handling of too long names
+  * dlm: dlm/user.c input validation fixes
+  * dlm: proper types for asts and basts
+  * dlm: eliminate astparam type casting
+  * dlm: add __init and __exit marks to init and exit functions
+  * virtio: Use PCI revision field to indicate virtio PCI ABI version
+
+ -- Tim Gardner <tim.gardner@canonical.com>  Tue, 19 Feb 2008 09:57:18 -0700
+
+linux (2.6.24-9.15) hardy; urgency=low
+
+  [Alessio Igor Bogani]
+
+  * rt: Fix FTBS
+  * rt: Updated configuration files
+
+  [Tim Gardner]
+
+  * SAUCE: make /dev/kmem a config option
+  * SAUCE: x86: introduce /dev/mem restrictions with a config option
+  * Fixed CGROUP FTBS caused by AppArmor patch.
+  * Enabled CGROUP and CPUSETS for server flavor.
+    - LP: #182434
+
+  [Colin King]
+
+  * Turn on /proc/acpi/alarm for x86_64 (amd64)
+    - LP: #186297
+
+  [Upstream Kernel Changes]
+
+  * Ubuntu: LatencyTOP infrastructure patch
+
+ -- Tim Gardner <tim.gardner@canonical.com>  Thu, 14 Feb 2008 13:34:55 -0700
+
+linux (2.6.24-8.14) hardy; urgency=low
+
+  [cking]
+
+  * Support Novatel U727 EVDO modem: Add pid and vid to
+    drivers/usb/serial/airprime.c
+    - LP: #150996
+  * Enable speedstep for sonoma processors.
+    - LP: #132271
+
+  [Stefan Bader]
+
+  * SAUCE: Export dm_disk function of device-mapper
+
+ -- Tim Gardner <tim.gardner@canonical.com>  Wed, 13 Feb 2008 21:47:18 -0700
+
+linux (2.6.24-8.13) hardy; urgency=low
+
+  [Soren Hansen]
+
+  * Add missing iscsi modules to kernel udebs
+
+  [Stefan Bader]
+
+  * Lower message level for PCI memory and I/O allocation.
+
+  [Tim Gardner]
+
+  * Enabled IP_ADVANCED_ROUTER and IP_MULTIPLE_TABLES in sparc, hppa
+    - LP: #189560
+  * Compile RealTek 8139 using PIO method.
+    - LP: #90271
+  * Add WD WD800ADFS NCQ horkage quirk support.
+    - LP: #147858
+
+  [Upstream Kernel Changes]
+
+  * Introduce WEXT scan capabilities
+  * DVB: cx23885: add missing subsystem ID for Hauppauge HVR1800 Retail
+  * slab: fix bootstrap on memoryless node
+  * vm audit: add VM_DONTEXPAND to mmap for drivers that need it
+    (CVE-2008-0007)
+  * USB: keyspan: Fix oops
+  * usb gadget: fix fsl_usb2_udc potential OOPS
+  * USB: CP2101 New Device IDs
+  * USB: add support for 4348:5523 WinChipHead USB->RS 232 adapter
+  * USB: Sierra - Add support for Aircard 881U
+  * USB: Adding YC Cable USB Serial device to pl2303
+  * USB: sierra driver - add devices
+  * USB: ftdi_sio - enabling multiple ELV devices, adding EM1010PC
+  * USB: ftdi-sio: Patch to add vendor/device id for ATK_16IC CCD
+  * USB: sierra: add support for Onda H600/Zte MF330 datacard to USB Driver
+    for Sierra Wireless
+  * USB: remove duplicate entry in Option driver and Pl2303 driver for
+    Huawei modem
+  * USB: pl2303: add support for RATOC REX-USB60F
+  * USB: ftdi driver - add support for optical probe device
+  * USB: use GFP_NOIO in reset path
+  * USB: Variant of the Dell Wireless 5520 driver
+  * USB: storage: Add unusual_dev for HP r707
+  * USB: fix usbtest halt check on big endian systems
+  * USB: handle idVendor of 0x0000
+  * forcedeth: mac address mcp77/79
+  * lockdep: annotate epoll
+  * sys_remap_file_pages: fix ->vm_file accounting
+  * PCI: Fix fakephp deadlock
+  * ACPI: update ACPI blacklist
+  * x86: restore correct module name for apm
+  * sky2: restore multicast addresses after recovery
+  * sky2: fix for WOL on some devices
+  * b43: Fix suspend/resume
+  * b43: Drop packets we are not able to encrypt
+  * b43: Fix dma-slot resource leakage
+  * b43legacy: fix PIO crash
+  * b43legacy: fix suspend/resume
+  * b43legacy: drop packets we are not able to encrypt
+  * b43legacy: fix DMA slot resource leakage
+  * selinux: fix labeling of /proc/net inodes
+  * b43: Reject new firmware early
+  * sched: let +nice tasks have smaller impact
+  * sched: fix high wake up latencies with FAIR_USER_SCHED
+  * fix writev regression: pan hanging unkillable and un-straceable
+  * Driver core: Revert "Fix Firmware class name collision"
+  * drm: the drm really should call pci_set_master..
+  * splice: missing user pointer access verification (CVE-2008-0009/10)
+  * Linux 2.6.24.1
+  * splice: fix user pointer access in get_iovec_page_array()
+  * Linux 2.6.24.2
+
+ -- Tim Gardner <tim.gardner@canonical.com>  Thu, 07 Feb 2008 06:50:13 -0700
+
+linux (2.6.24-7.12) hardy; urgency=low
+  
+  [Jay Chetty]
+
+  * Added patch to fix legacy USB interrupt issue
+  * Enabled Poulsbo PATA udma5 support
+  * Add touchscreen doubleclick workaround
+
+  [Amit Kucheria]
+
+  * Add AGP support for Radeon Mobility 9000 chipset
+    - LP: #178634
+
+  [Soren Hansen]
+
+  * Add virtio modules to the relevant udebs
+  * Add missing "?" for virtio modules in storage-core-modules
+
+  [Stefan Bader]
+
+  * Added vendor id for Dell 5720 broadband modem
+
+ -- Jay Chetty <jay.chetty@intel.com>  Wed, 06 Feb 2008 14:13:41 -0800
+
+linux (2.6.24-7.11) hardy; urgency=low
+
+  [Jay Chetty]
+
+  * poulsbo: Add a 100ms delay for SiB workaround
+
+  [Tim Gardner]
+
+  * -6.10 should have been an ABI bump, but due to incomplete build testing
+    went undetected.
+
+ -- Tim Gardner <tim.gardner@canonical.com>  Mon, 04 Feb 2008 19:13:52 -0700
+
+linux (2.6.24-6.10) hardy; urgency=low
+
+  [Alessio Igor Bogani]
+
+  * rt: Synced with upstream, removed old kvm related patches and updated
+    configurations files.
+
+  [Chuck Short]
+
+  * SAUCE: Enable Xen
+
+  [Soren Hansen]
+
+  * Update kvm driver to kvm-60.
+  * Added CONFIG_ARCH_SUPPORTS_KVM=y for lpia, i386, and amd64
+  * Add rtl8139 driver to -virtual flavour
+
+  [Stefan Bader]
+
+  * Fix usb_serial_driver structure for Kobil cardreader driver.
+    - LP: #183109
+  * Lower warning level of pci resource allocation messages.
+    - LP: #159241
+
+  [Tim Gardner]
+
+  * Enabled CONFIG_BLK_DEV_IDE_PMAC
+    - LP: #185862
+  * Add virtio config options to lpiacompat.
+  * SAUCE: Export symbols for aufs (in lum).
+  * Enabled Xen
+
+  [Upstream Kernel Changes]
+
+  * KVM: mmu: add missing dirty page tracking cases
+  * KVM: Move virtualization deactivation from CPU_DEAD state to
+    CPU_DOWN_PREPARE
+  * KVM: Cosmetics
+  * KVM: vmx: hack set_cr0_no_modeswitch() to actually do modeswitch
+  * KVM: Use ARRAY_SIZE macro instead of manual calculation.
+  * KVM: Use page_private()/set_page_private() apis
+  * KVM: add MSR based hypercall API
+  * KVM: Add host hypercall support for vmx
+  * KVM: Add hypercall host support for svm
+  * KVM: Wire up hypercall handlers to a central arch-independent location
+  * KVM: svm: init cr0 with the wp bit set
+  * KVM: SVM: intercept SMI to handle it at host level
+  * KVM: More 0 -> NULL conversions
+  * kvm, dirty pages log: adding some calls to mark_page_dirty()
+  * KVM: Add internal filesystem for generating inodes
+  * KVM: Create an inode per virtual machine
+  * KVM: Rename some kvm_dev_ioctl_*() functions to kvm_vm_ioctl_*()
+  * KVM: Move kvm_vm_ioctl_create_vcpu() around
+  * KVM: Per-vcpu inodes
+  * KVM: Bump API version
+  * .gitignore: ignore emacs backup files (*~)
+  * kvm: dirty pages log: fix bitmap size/access calculation
+  * kvm: move do_remove_write_access() up
+  * kvm: dirty page logging: remove write access permissions when
+    dirty-page-logging is enabled
+  * KVM: Add missing calls to mark_page_dirty()
+  * KVM: Fix dirty page log bitmap size/access calculation
+  * kvm: move do_remove_write_access() up
+  * KVM: Remove write access permissions when dirty-page-logging is enabled
+  * KVM: Fix bogus failure in kvm.ko module initialization
+  * KVM: Move kvmfs magic number to <linux/magic.h>
+  * KVM: Unset kvm_arch_ops if arch module loading failed
+  * KVM: Fix guest register corruption on paravirt hypercall
+  * KVM: Use the generic skip_emulated_instruction() in hypercall code
+  * KVM: Use own minor number
+  * KVM: Fix guest sysenter on vmx
+  * KVM: Export <linux/kvm.h>
+  * KVM: Fix bogus sign extension in mmu mapping audit
+  * KVM: MMU: Fix guest writes to nonpae pde
+  * KVM: MMU: Fix host memory corruption on i386 with >= 4GB ram
+  * KVM: trivial whitespace fixes
+  * KVM: always reload segment selectors
+  * KVM: Remove extraneous guest entry on mmio read
+  * added KVM_GET_MEM_MAP ioctl to get the memory bitmap for a memory slot
+  * KVM: Prevent system selectors leaking into guest on real->protected
+    mode transition on vmx
+  * KVM: Use a shared page for kernel/user communication when runing a vcpu
+  * KVM: Do not communicate to userspace through cpu registers during PIO
+  * KVM: Initialize PIO I/O count
+  * KVM: Handle cpuid in the kernel instead of punting to userspace
+  * KVM: Remove the 'emulated' field from the userspace interface
+  * KVM: Remove minor wart from KVM_CREATE_VCPU ioctl
+  * KVM: Renumber ioctls
+  * KVM: Add method to check for backwards-compatible API extensions
+  * KVM: Allow userspace to process hypercalls which have no kernel handler
+  * KVM: Fold kvm_run::exit_type into kvm_run::exit_reason
+  * KVM: Add a special exit reason when exiting due to an interrupt
+  * KVM: Initialize the apic_base msr on svm too
+  * KVM: Add guest mode signal mask
+  * KVM: Allow kernel to select size of mmap() buffer
+  * KVM: Future-proof argument-less ioctls
+  * KVM: Avoid guest virtual addresses in string pio userspace interface
+  * KVM: MMU: Remove unnecessary check for pdptr access
+  * KVM: MMU: Remove global pte tracking
+  * KVM: Workaround vmx inability to virtualize the reset state
+  * KVM: Remove set_cr0_no_modeswitch() arch op
+  * KVM: Modify guest segments after potentially switching modes
+  * KVM: Hack real-mode segments on vmx from KVM_SET_SREGS
+  * KVM: Don't allow the guest to turn off the cpu cache
+  * KVM: Remove unused and write-only variables
+  * KVM: Handle writes to MCG_STATUS msr
+  * KVM: MMU: Fix hugepage pdes mapping same physical address with
+    different access
+  * KVM: SVM: Ensure timestamp counter monotonicity
+  * KVM: Remove unused function
+  * KVM: Remove debug message
+  * KVM: x86 emulator: fix bit string operations operand size
+  * KVM: SVM: enable LBRV virtualization if available
+  * Add mmu cache clear function
+  * KVM: Simply gfn_to_page()
+  * KVM: Add physical memory aliasing feature
+  * KVM: Add fpu get/set operations
+  * KVM: Use kernel-standard types
+  * KVM: Fix overflow bug in overflow detection code
+  * KVM: Fix memory leak on pio completion
+  * KVM: Handle partial pae pdptr
+  * KVM: Fix string pio when count == 0
+  * KVM: Use slab caches to allocate mmu data structures
+  * KVM: Retry sleeping allocation if atomic allocation fails
+  * KVM: Fix pio completion
+  * KVM: SVM: Report hardware exit reason to userspace instead of dmesg
+  * KVM: Handle guest page faults when emulating mmio
+  * KVM: VMX: Reduce unnecessary saving of host msrs
+  * KVM: Fix off-by-one when writing to a nonpae guest pde
+  * KVM: VMX: Don't switch 64-bit msrs for 32-bit guests
+  * KVM: Fold drivers/kvm/kvm_vmx.h into drivers/kvm/vmx.c
+  * KVM: VMX: Only save/restore MSR_K6_STAR if necessary
+  * KVM: Per-vcpu statistics
+  * KVM: Silence compile warning on i386
+  * KVM: Allow passing 64-bit values to the emulated read/write API
+  * KVM: Lazy FPU support for SVM
+  * KVM: Fix msr-avoidance regression on Core processors
+  * KVM: Don't complain about cpu erratum AA15
+  * KVM: Document MSR_K6_STAR's special place in the msr index array
+  * KVM: MMU: Avoid heavy ASSERT at non debug mode.
+  * KVM: Initialize cr0 to indicate an fpu is present
+  * KVM: We want asserts on debug builds, not release
+  * KVM: Avoid unused function warning due to assertion removal
+  * KVM: VMX: Avoid unnecessary vcpu_load()/vcpu_put() cycles
+  * KVM: Move need_resched() check to common code
+  * KVM: VMX: Properly shadow the CR0 register in the vcpu struct
+  * KVM: VMX: Add lazy FPU support for VT
+  * KVM: fix an if() condition
+  * KVM: SVM: Only save/restore MSRs when needed
+  * KVM: Remove trailing whitespace
+  * KVM: Remove extraneous guest entry on mmio read
+  * KVM: Don't require explicit indication of completion of mmio or pio
+  * KVM: Remove unused 'instruction_length'
+  * KVM: VMX: Enable io bitmaps to avoid IO port 0x80 VMEXITs
+  * KVM: SVM: Allow direct guest access to PC debug port
+  * KVM: Fix RMW mmio handling
+  * KVM: Assume that writes smaller than 4 bytes are to non-pagetable pages
+  * KVM: Avoid saving and restoring some host CPU state on lightweight
+    vmexit
+  * KVM: Unindent some code
+  * KVM: Reduce misfirings of the fork detector
+  * KVM: Be more careful restoring fs on lightweight vmexit
+  * KVM: Unify kvm_mmu_pre_write() and kvm_mmu_post_write()
+  * KVM: MMU: Respect nonpae pagetable quadrant when zapping ptes
+  * KVM: Update shadow pte on write to guest pte
+  * KVM: Increase mmu shadow cache to 1024 pages
+  * KVM: Fix potential guest state leak into host
+  * KVM: Prevent guest fpu state from leaking into the host
+  * KVM: Move some more msr mangling into vmx_save_host_state()
+  * KVM: Rationalize exception bitmap usage
+  * KVM: Consolidate guest fpu activation and deactivation
+  * KVM: Ensure host cr0.ts is saved
+  * KVM: Set cr0.mp for guests
+  * KVM: Implement IA32_EBL_CR_POWERON msr
+  * KVM: MMU: Simplify kvm_mmu_free_page() a tiny bit
+  * KVM: MMU: Store shadow page tables as kernel virtual addresses, not
+    physical
+  * KVM: VMX: Only reload guest msrs if they are already loaded
+  * KVM: Avoid corrupting tr in real mode
+  * KVM: Fix vmx I/O bitmap initialization on highmem systems
+  * KVM: Remove merge artifact
+  * KVM: VMX: Use local labels in inline assembly
+  * KVM: VMX: Handle #SS faults from real mode
+  * KVM: VMX: Avoid saving and restoring msrs on lightweight vmexit
+  * KVM: VMX: Compile-fix for 32-bit hosts
+  * KVM: VMX: Cleanup redundant code in MSR set
+  * KVM: VMX: Fix a typo which mixes X86_64 and CONFIG_X86_64
+  * KVM: VMX: Avoid saving and restoring msr_efer on lightweight vmexit
+  * KVM: VMX: Remove warnings on i386
+  * Use menuconfig objects II - KVM/Virt
+  * KVM: x86 emulator: implement wbinvd
+  * KVM: Fix includes
+  * KVM: Use symbolic constants instead of magic numbers
+  * KVM: MMU: Use slab caches for shadow pages and their headers
+  * KVM: MMU: Simplify fetch() a little bit
+  * KVM: MMU: Move set_pte_common() to pte width dependent code
+  * KVM: MMU: Pass the guest pde to set_pte_common
+  * KVM: MMU: Fold fix_read_pf() into set_pte_common()
+  * KVM: MMU: Fold fix_write_pf() into set_pte_common()
+  * KVM: Move shadow pte modifications from set_pte/set_pde to
+    set_pde_common()
+  * KVM: Make shadow pte updates atomic
+  * KVM: MMU: Make setting shadow ptes atomic on i386
+  * KVM: MMU: Remove cr0.wp tricks
+  * KVM: MMU: Simpify accessed/dirty/present/nx bit handling
+  * KVM: MMU: Don't cache guest access bits in the shadow page table
+  * KVM: MMU: Remove unused large page marker
+  * KVM: VMX: Fix asm constraint
+  * KVM: Lazy guest cr3 switching
+  * KVM: Replace C code with call to ARRAY_SIZE() macro.
+  * KVM: Remove unnecessary initialization and checks in mark_page_dirty()
+  * KVM: Fix vcpu freeing for guest smp
+  * KVM: Fix adding an smp virtual machine to the vm list
+  * KVM: Enable guest smp
+  * KVM: Move duplicate halt handling code into kvm_main.c
+  * KVM: Emulate hlt on real mode for Intel
+  * KVM: Keep an upper bound of initialized vcpus
+  * KVM: Flush remote tlbs when reducing shadow pte permissions
+  * KVM: SVM: Replace memset(<addr>, 0, PAGESIZE) with clear_page(<addr>)
+  * KVM: VMX: Replace memset(<addr>, 0, PAGESIZE) with clear_page(<addr>)
+  * KVM: Require a cpu which can set 64-bit values atomically
+  * KVM: Initialize the BSP bit in the APIC_BASE msr correctly
+  * KVM: VMX: Ensure vcpu time stamp counter is monotonous
+  * KVM: Bring local tree in line with origin
+  * KVM: Implement emulation of "pop reg" instruction (opcode 0x58-0x5f)
+  * KVM: Implement emulation of instruction "ret" (opcode 0xc3)
+  * KVM: Adds support for in-kernel mmio handlers
+  * KVM: VMX: Fix interrupt checking on lightweight exit
+  * KVM: Add support for in-kernel pio handlers
+  * KVM: Fix x86 emulator writeback
+  * KVM: Avoid useless memory write when possible
+  * KVM: VMX: Reinitialize the real-mode tss when entering real mode
+  * KVM: MMU: Fix Wrong tlb flush order
+  * KVM: VMX: Remove unnecessary code in vmx_tlb_flush()
+  * KVM: SVM: Reliably detect if SVM was disabled by BIOS
+  * KVM: Remove kvmfs in favor of the anonymous inodes source
+  * KVM: Clean up #includes
+  * KVM: Fix svm availability check miscompile on i386
+  * HOTPLUG: Add CPU_DYING notifier
+  * HOTPLUG: Adapt cpuset hotplug callback to CPU_DYING
+  * HOTPLUG: Adapt thermal throttle to CPU_DYING
+  * SMP: Implement on_cpu()
+  * KVM: Keep track of which cpus have virtualization enabled
+  * KVM: Tune hotplug/suspend IPIs
+  * KVM: Use CPU_DYING for disabling virtualization
+  * KVM: MMU: Store nx bit for large page shadows
+  * KVM: Fix *nopage() in kvm_main.c
+  * KVM: SMP: Add vcpu_id field in struct vcpu
+  * KVM - add hypercall nr to kvm_run
+  * KVM:: Future-proof the exit information union ABI
+  * KVM: In-kernel string pio write support
+  * KVM: Fix memory slot management functions for guest smp
+  * KVM: x86 emulator: implement rdmsr and wrmsr
+  * KVM: Trivial: /dev/kvm interface is no longer experimental.
+  * KVM: Trivial: Remove unused struct cpu_user_regs declaration
+  * KVM: Trivial: Make decode_register() static
+  * KVM: Trivial: Comment spelling may escape grep
+  * KVM: Trivial: Avoid hardware_disable predeclaration
+  * KVM: Trivial: Use standard CR0 flags macros from asm/cpu-features.h
+  * Use standard CR3 flags, tighten checking
+  * Use standard CR4 flags, tighten checking
+  * KVM: Trivial: Use standard BITMAP macros, open-code userspace-exposed
+    header
+  * KVM: Set exit_reason to KVM_EXIT_MMIO where run->mmio is initialized.
+  * KVM: Use standard CR8 flags, and fix TPR definition
+  * KVM: MMU: Fix oopses with SLUB
+  * KVM: x86 emulator: fix cmov for writeback changes
+  * KVM: MMU: Fix cleaning up the shadow page allocation cache
+  * KVM: Require CONFIG_ANON_INODES
+  * KVM: x86 emulator: fix faulty check for two-byte opcode
+  * KVM: Correctly handle writes crossing a page boundary
+  * KVM: Fix unlikely kvm_create vs decache_vcpus_on_cpu race
+  * KVM: Hoist kvm_mmu_reload() out of the critical section
+  * KVM: Fix removal of nx capability from guest cpuid
+  * KVM: Move gfn_to_page out of kmap/unmap pairs
+  * KVM: disable writeback for 0x0f 0x01 instructions.
+  * KVM: VMX: Import some constants of vmcs from IA32 SDM
+  * KVM: Remove dead code in the cmpxchg instruction emulation
+  * KVM: load_pdptrs() cleanups
+  * KVM: Remove arch specific components from the general code
+  * KVM: Dynamically allocate vcpus
+  * KVM: VMX: Improve the method of writing vmcs control
+  * KVM: Use the scheduler preemption notifiers to make kvm preemptible
+  * KVM: Convert vm lock to a mutex
+  * KVM: fx_init() needs preemption disabled while it plays with the FPU
+    state
+  * KVM: VMX: pass vcpu_vmx internally
+  * KVM: Remove three magic numbers
+  * KVM: SVM: de-containization
+  * KVM: SVM: internal function name cleanup
+  * KVM: x86 emulator: disable writeback for debug register instructions
+  * KVM: Change the emulator_{read,write,cmpxchg}_* functions to take a
+    vcpu
+  * KVM: Remove kvm_{read,write}_guest()
+  * KVM: Use kmem cache for allocating vcpus
+  * KVM: Use alignment properties of vcpu to simplify FPU ops
+  * KVM: kvm_vm_ioctl_get_dirty_log restore "nothing dirty" optimization
+  * KVM: VMX: Add cpu consistency check
+  * KVM: Don't assign vcpu->cr3 if it's invalid: check first, set last
+  * KVM: Cleanup mark_page_dirty
+  * KVM: SVM: Make set_msr_interception more reliable
+  * KVM: Remove redundant alloc_vmcs_cpu declaration
+  * KVM: Fix defined but not used warning in drivers/kvm/vmx.c
+  * KVM: Remove stat_set from debugfs
+  * KVM: Remove unneeded kvm_dev_open and kvm_dev_release functions.
+  * KVM: Add and use pr_unimpl for standard formatting of unimplemented
+    features
+  * KVM: Use kmem_cache_free for kmem_cache_zalloc'ed objects
+  * KVM: VMX: Remove a duplicated ia32e mode vm entry control
+  * KVM: Remove useless assignment
+  * KVM: Cleanup string I/O instruction emulation
+  * KVM: Clean up kvm_setup_pio()
+  * KVM: VMX: Don't require cr8 load/store exit capability when running on
+    32-bit
+  * KVM: Close minor race in signal handling
+  * KVM: Communicate cr8 changes to userspace
+  * KVM: x86 emulator: implement 'and $imm, %{al|ax|eax}'
+  * KVM: x86 emulator: implement 'jmp rel' instruction (opcode 0xe9)
+  * KVM: x86 emulator: Implement 'jmp rel short' instruction (opcode 0xeb)
+  * KVM: x86 emulator: implement 'push reg' (opcodes 0x50-0x57)
+  * KVM: VMX: allow rmode_tss_base() to work with >2G of guest memory
+  * KVM: Avoid calling smp_call_function_single() with interrupts disabled
+  * KVM: MMU: Fix rare oops on guest context switch
+  * KVM: Support more memory slots
+  * KVM: X86 emulator: fix 'push reg' writeback
+  * KVM: VMX: Split segments reload in vmx_load_host_state()
+  * KVM: Add support for in-kernel PIC emulation
+  * KVM: Define and use cr8 access functions
+  * KVM: Emulate local APIC in kernel
+  * KVM: In-kernel I/O APIC model
+  * KVM: Emulate hlt in the kernel
+  * KVM: Protect in-kernel pio using kvm->lock
+  * KVM: Add get/set irqchip ioctls for in-kernel PIC live migration
+    support
+  * KVM: Bypass irq_pending get/set when using in kernel irqchip
+  * KVM: in-kernel IOAPIC save and restore support
+  * KVM: in-kernel LAPIC save and restore support
+  * KVM: pending irq save/restore
+  * KVM: VMX: Use shadow TPR/cr8 for 64-bits guests
+  * KVM: Keep track of missed timer irq injections
+  * KVM: Migrate lapic hrtimer when vcpu moves to another cpu
+  * KVM: disable tpr/cr8 sync when in-kernel APIC is used
+  * KVM: VMX: Fix tpr threshold updating
+  * KVM: deliver PIC interrupt only to vcpu0
+  * KVM: round robin for APIC lowest priority delivery mode
+  * KVM: enable in-kernel APIC INIT/SIPI handling
+  * KVM: Set the ET flag in CR0 after initializing FX
+  * KVM: Remove the unused invlpg member of struct kvm_arch_ops.
+  * KVM: Clean up unloved invlpg emulation
+  * KVM: Keep control regs in sync
+  * KVM: Hoist SVM's get_cs_db_l_bits into core code.
+  * KVM: Simplify memory allocation
+  * KVM: Rename kvm_arch_ops to kvm_x86_ops
+  * KVM: Fix lapic 64-bit division on 32-bit hosts
+  * KVM: fix apic timer migration when inactive
+  * KVM: MMU: Don't do GFP_NOWAIT allocations
+  * KVM: Remove smp_processor_id() in kvm_vcpu_kick()
+  * KVM: VMX: Move vm entry failure handling to the exit handler
+  * KVM: Move main vcpu loop into subarch independent code
+  * KVM: Fix link error to "genapic"
+  * KVM: VMX: Fix exit qualification width on i386
+  * KVM: x86 emulator: push imm8
+  * KVM: x86 emulator: call near
+  * KVM: x86 emulator: pushf
+  * KVM: Improve emulation failure reporting
+  * KVM: VMX: Prevent setting CPU_BASED_TPR_SHADOW on i386 host
+  * KVM: x86 emulator: sort opcodes into ascending order
+  * KVM: x86 emulator: imlpement jump conditional relative
+  * KVM: X86 emulator: jump conditional short
+  * KVM: x86 emulator: lea
+  * KVM: x86 emulator: jmp abs
+  * KVM: x86 emulator: fix src, dst value initialization
+  * KVM: x86 emulator: popf
+  * KVM: Skip pio instruction when it is emulated, not executed
+  * KVM: fix PIC interrupt delivery on different APIC conditions
+  * KVM: Fix kvm_vcpu_ioctl_get_sregs() warning on i386
+  * KVM: Remove errant printk() in kvm_vcpu_ioctl_get_sregs()
+  * KVM: Fix virtualization menu help text
+  * KVM: x86 emulator: Add vmmcall/vmcall to x86_emulate (v3)
+  * KVM: Refactor hypercall infrastructure (v3)
+  * KVM: x86 emulator: remove unused functions
+  * KVM: x86 emulator: move all x86_emulate_memop() to a structure
+  * KVM: x86 emulator: move all decoding process to function
+    x86_decode_insn()
+  * KVM: emulate_instruction() calls now x86_decode_insn() and
+    x86_emulate_insn()
+  * KVM: Call x86_decode_insn() only when needed
+  * KVM: Fix ioapic level-triggered interrupt redelivery
+  * KVM: Fix #UD exception delivery
+  * KVM: VMX: Further reduce efer reloads
+  * KVM: VMX: Fix build on i386 due to EFER_LMA not defined
+  * KVM: Fix ioapic.c compilation failure due to missing include
+  * KVM: x86 emulator: fix merge screwup due to emulator split
+  * KVM: x85 emulator: Correct inconcistency in between cr2 and ctxt->cr2.
+  * KVM: Avoid redelivery of edge-triggered irq if it is already in service
+  * KVM: Implement ioapic irq polarity bit
+  * KVM: x86 emulator: fix repne/repnz decoding
+  * KVM: Fix host oops due to guest changing efer
+  * KVM: Fix ioapic edge-triggered interrupts
+  * KVM: MMU: Set shadow pte atomically in mmu_pte_write_zap_pte()
+  * KVM: Allow not-present guest page faults to bypass kvm
+  * KVM: MMU: Make flooding detection work when guest page faults are
+    bypassed
+  * KVM: MMU: Ignore reserved bits in cr3 in non-pae mode
+  * KVM: x86 emulator: split some decoding into functions for readability
+  * KVM: x86 emulator: remove _eflags and use directly ctxt->eflags.
+  * KVM: x86 emulator: Remove no_wb, use dst.type = OP_NONE instead
+  * KVM: x86_emulator: no writeback for bt
+  * KVM: apic round robin cleanup
+  * KVM: Purify x86_decode_insn() error case management
+  * KVM: x86 emulator: Any legacy prefix after a REX prefix nullifies its
+    effect
+  * i386: Expose IOAPIC register definitions even if CONFIG_X86_IO_APIC is
+    not set
+  * KVM: x86 emulator: On a pop instruction, don't restore ECX and EIP on
+    error
+  * KVM: x86 emulator: remove unused variable
+  * KVM: VMX: Don't clear the vmcs if the vcpu is not loaded on any
+    processor
+  * KVM: VMX: Simplify vcpu_clear()
+  * KVM: Remove the usage of paeg->private field by rmap
+  * KVM: x86 emulator: Correct management of REP prefix
+  * KVM: Add general accessors to read and write guest memory
+  * KVM: Allow dynamic allocation of the mmu shadow cache size
+  * KVM: Check I/O APIC indirect index before writing
+  * KVM: Add kvm_free_lapic() to pair with kvm_create_lapic()
+  * KVM: Hoist kvm_create_lapic() into kvm_vcpu_init()
+  * KVM: Remove gratuitous casts from lapic.c
+  * KVM: CodingStyle cleanup
+  * KVM: VMX: Handle NMIs before enabling interrupts and preemption
+  * KVM: Support assigning userspace memory to the guest
+  * KVM: Export PIC reset for kernel device reset
+  * KVM: Split IOAPIC reset function and export for kernel RESET
+  * KVM: VMX: Reset mmu context when entering real mode
+  * KVM: Replace enum by #define
+  * KVM: Move x86 msr handling to new files x86.[ch]
+  * KVM: MMU: Clean up MMU functions to take struct kvm when appropriate
+  * KVM: MMU: More struct kvm_vcpu -> struct kvm cleanups
+  * KVM: Move guest pte dirty bit management to the guest pagetable walker
+  * KVM: MMU: Fix nx access bit for huge pages
+  * KVM: MMU: Disable write access on clean large pages
+  * KVM: MMU: Instatiate real-mode shadows as user writable shadows
+  * KVM: MMU: Move dirty bit updates to a separate function
+  * KVM: MMU: When updating the dirty bit, inform the mmu about it
+  * KVM: Portability: split kvm_vcpu_ioctl
+  * KVM: Restore missing #include <linux/vmalloc.h>
+  * KVM: Add some \n in ioapic_debug()
+  * KVM: x86 emulator: implement 'movnti mem, reg'
+  * KVM: MMU: Call update_dirty_bit() without disabling preemption
+  * KVM: Move apic timer interrupt backlog processing to common code
+  * KVM: Move interrupt injection out of interrupt disabled section
+  * KVM: Rename KVM_TLB_FLUSH to KVM_REQ_TLB_FLUSH
+  * KVM: VMX: Force vm86 mode if setting flags during real mode
+  * KVM: MMU: Simplify page table walker
+  * KVM: Actually move the interrupt injection code out of the critical
+    section
+  * KVM: x86 emulator: cmc, clc, cli, sti
+  * KVM: x86 emulator: use a defined flag definition
+  * KVM: x86 emulator: fix access registers for instructions with ModR/M
+    byte and Mod = 3
+  * KVM: MMU: Add rmap_next(), a helper for walking kvm rmaps
+  * KVM: MMU: Keep a reverse mapping of non-writable translations
+  * KVM: MMU: Make gfn_to_page() always safe
+  * KVM: Partial swapping of guest memory
+  * KVM: VMX: Initialize vcpu with preemption enabled
+  * KVM: Use virtual cpu accounting if available for guest times.
+  * KVM: Move kvm_guest_exit() after local_irq_enable()
+  * KVM: MMU: Fix dirty bit pte gpa calculation
+  * KVM: Allocate userspace memory for older userspace
+  * KVM: Portability: Split kvm_vcpu into arch dependent and independent
+    parts (part 1)
+  * KVM: Fix local apic timer divide by zero
+  * KVM: Move vmx_vcpu_reset() out of vmx_vcpu_setup()
+  * KVM: Add a might_sleep() annotation to gfn_to_page()
+  * KVM: VMX: vmx_vcpu_setup(): remove unused variable.
+  * KVM: Per-architecture hypercall definitions
+  * KVM: Use new smp_call_function_mask() in kvm_flush_remote_tlbs()
+  * KVM: Unmap kernel-allocated memory on slot destruction
+  * KVM: Export memory slot allocation mechanism
+  * KVM: Add kernel-internal memory slots
+  * KVM: Add ioctl to tss address from userspace,
+  * KVM: x86 emulator: fix 'push imm8' emulation
+  * KVM: VMX: Let gcc to choose which registers to save (x86_64)
+  * KVM: VMX: Let gcc to choose which registers to save (i386)
+  * KVM: SVM: Let gcc to choose which registers to save (x86_64)
+  * KVM: SVM: Let gcc to choose which registers to save (i386)
+  * KVM: x86 emulator: invd instruction
+  * KVM: SVM: Intercept the 'invd' and 'wbinvd' instructions
+  * KVM: x86 emulator: don't depend on cr2 for mov abs emulation
+  * KVM: Move page fault processing to common code
+  * KVM: MMU: Topup the mmu memory preallocation caches before emulating an
+    insn
+  * KVM: Portability: Split kvm_vm_ioctl v3
+  * KVM: Portability: Move memory segmentation to x86.c
+  * KVM: Portability: move get/set_apic_base to x86.c
+  * KVM: Portability: Move control register helper functions to x86.c
+  * KVM: VMX: Enable memory mapped TPR shadow (FlexPriority)
+  * KVM: Fix gfn_to_page() acquiring mmap_sem twice
+  * KVM: Portability: Move kvm_get/set_msr[_common] to x86.c
+  * KVM: Portability: Move x86 emulation and mmio device hook to x86.c
+  * KVM: Portability: Move pio emulation functions to x86.c
+  * KVM: x86 emulator: Extract the common code of SrcReg and DstReg
+  * KVM: x86 emulator: centralize decoding of one-byte register access
+    insns
+  * KVM: Simplify decode_register_operand() calling convention
+  * KVM: Make mark_page_dirty() work for aliased pages too.
+  * KVM: x86 emulator: Hoist modrm and abs decoding into separate functions
+  * KVM: Portability: Make exported debugfs data architecture-specific
+  * KVM: Portability: Move x86 instruction emulation code to x86.c
+  * KVM: Portability: Move x86 FPU handling to x86.c
+  * KVM: Portability: Move x86 vcpu ioctl handlers to x86.c
+  * KVM: x86 emulator: Move one-byte insns with reg operand into one-byte
+    section
+  * KVM: VMX: Fix repeated allocation of apic access page on smp
+  * KVM: SVM: Fix SMP with kernel apic
+  * KVM: Add make_page_dirty() to kvm_clear_guest_page()
+  * KVM: SVM: Defer nmi processing until switch to host state is complete
+  * KVM: VMX: Avoid reloading host efer on cpus that don't have it
+  * KVM: VMX: Use vmx to inject real interrupts
+  * KVM: Go back to atomically injecting interrupts
+  * KVM: VMX: Comment VMX primary/secondary exec ctl definitions
+  * KVM: VMX: wbinvd exiting
+  * KVM: x86 emulator: fix JMP_REL
+  * KVM: x86 emulator: fix the saving of of the eip value
+  * KVM: x86 emulator: remove 8 bytes operands emulator for call near
+    instruction
+  * KVM: Simplify CPU_TASKS_FROZEN cpu notifier handling
+  * KVM: add kvm_is_error_hva()
+  * KVM: introduce gfn_to_hva()
+  * KVM: Change kvm_{read,write}_guest() to use copy_{from,to}_user()
+  * KVM: Portability: Move some includes to x86.c
+  * KVM: Portability: Move kvm_x86_ops to x86.c
+  * KVM: Portability: Add vcpu and hardware management arch hooks
+  * KVM: Portability: Combine kvm_init and kvm_init_x86
+  * KVM: Portability: Move x86 specific code from kvm_init() to kvm_arch()
+  * KVM: x86 emulator: modify 'lods', and 'stos' not to depend on CR2
+  * KVM: Portability: move KVM_CHECK_EXTENSION
+  * KVM: VMX: Consolidate register usage in vmx_vcpu_run()
+  * KVM: Portability: Make kvm_vcpu_ioctl_translate arch dependent
+  * KVM: x86 emulator: Rename 'cr2' to 'memop'
+  * KVM: Remove ptr comparisons to 0
+  * KVM: Remove __init attributes for kvm_init_debug and kvm_init_msr_list
+  * KVM: Portability: Add two hooks to handle kvm_create and destroy vm
+  * KVM: Replace 'light_exits' stat with 'host_state_reload'
+  * KVM: Add fpu_reload counter
+  * KVM: Add instruction emulation statistics
+  * KVM: Extend stats support for VM stats
+  * KVM: MMU: Add some mmu statistics
+  * KVM: x86 emulator: Use emulator_write_emulated and not
+    emulator_write_std
+  * KVM: Make unloading of FPU state when putting vcpu arch-independent
+  * KVM: SVM: Disable Lazy FPU optimization
+  * KVM: Portability: Move kvm_vcpu_ioctl_get_dirty_log to arch-specific 
+    file
+  * KVM: Portability: MMU initialization and teardown split
+  * KVM: Portability: Move some macro definitions from kvm.h to x86.h
+  * KVM: Portability: Move struct kvm_x86_ops definition to x86.h
+  * KVM: Portability: Move vcpu regs enumeration definition to x86.h
+  * KVM: Move some static inline functions out from kvm.h into x86.h
+  * KVM: Portability: Move some function declarations to x86.h
+  * KVM: VMX: Force seg.base == (seg.sel << 4) in real	mode
+  * KVM: MMU: Change guest pte access to kvm_{read,write}_guest()
+  * kvm: simplify kvm_clear_guest_page()
+  * KVM: Add missing #include <asm/pgtable.h>
+  * KVM: MMU: Remove unused variable
+  * KVM: Remove unused "rmap_overflow" variable
+  * KVM: Correct consistent typo: "destory" -> "destroy"
+  * KVM: Move misplaced comment
+  * KVM: Portability: Move kvm_memory_alias to asm/kvm.h
+  * KVM: Portability: Move x86 pic strutctures
+  * KVM: Portability: Move kvm_regs to <asm/kvm.h>
+  * KVM: Portability: Move structure lapic_state to <asm/kvm.h>
+  * KVM: Portability: Move kvm_segment & kvm_dtable structure to 
+    <asm/kvm.h>
+  * KVM: Portability: Move kvm_sregs and msr structures to <asm/kvm.h>
+  * KVM: Portability: Move cpuid structures to <asm/kvm.h>
+  * KVM: Export include/asm-x86/kvm.h
+  * KVM: MMU: Fix potential memory leak with smp real-mode
+  * KVM: MMU: Selectively set PageDirty when releasing guest memory
+  * KVM: x86 emulator: retire ->write_std()
+  * KVM: x86 emulator: prefetch up to 15 bytes of the instruction executed
+  * KVM: SVM: Fix FPU leak and re-enable lazy FPU switching
+  * KVM: Recalculate mmu pages needed for every memory region change
+  * KVM: Portability:  Split kvm_set_memory_region() to have an arch
+    callout
+  * KVM: Split vcpu creation to avoid vcpu_load() before preemption setup
+  * KVM: MMU: Implement guest page fault bypass for nonpae
+  * KVM: Add statistic for remote tlb flushes
+  * KVM: MMU: Avoid unnecessary remote tlb flushes when guest updates a pte
+  * KVM: Add parentheses to silence gcc
+  * KVM: Don't bother the mmu if cr3 load doesn't change cr3
+  * KVM: MMU: Code cleanup
+  * KVM: MMU: Introduce and use gpte_to_gfn()
+  * KVM: MMU: Move pse36 handling to the guest walker
+  * KVM: MMU: Remove extra gaddr parameter from set_pte_common()
+  * KVM: MMU: Remove set_pde()
+  * KVM: MMU: Adjust page_header_update_slot() to accept a gfn instead of a
+    gpa
+  * KVM: MMU: Introduce gfn_to_gpa()
+  * KVM: MMU: Simplify nonpaging_map()
+  * KVM: MMU: Remove gva_to_hpa()
+  * KVM: Remove gpa_to_hpa()
+  * KVM: MMU: Rename variable of type 'struct kvm_mmu_page *'
+  * KVM: MMU: Rename 'release_page'
+  * KVM: Disallow fork() and similar games when using a VM
+  * KVM: Enhance guest cpuid management
+  * KVM: Replace private 'struct segment descriptor' by x86's desc_struct
+  * KVM: Remove segment_descriptor, part 2
+  * KVM: Fix compile error on i386
+  * KVM: VMX: Read & store IDT_VECTORING_INFO_FIELD
+  * KVM: Fix faults during injection of real-mode interrupts
+  * KVM: x86 emulator: Fix instruction fetch cache hit check
+  * KVM: VMX: Remove the secondary execute control dependency on irqchip
+  * KVM: Portability: Move unalias_gfn to arch dependent file
+  * KVM: x86 emulator: Make a distinction between repeat prefixes F3 and F2
+  * KVM: x86 emulator: address size and operand size overrides are sticky
+  * KVM: Remove desc.h include in kvm_main.c
+  * KVM: Revert segment_descriptor.h removal
+  * KVM: Remove misleading check for mmio during event injection
+  * KVM: MMU: mark pages that were inserted to the shadow pages table as
+    accessed
+  * KVM: x86 emulator: rename REP_REPE_PREFIX
+  * KVM: x86 emulator: cmps instruction
+  * KVM: Add ifdef in irqchip struct for x86 only structures
+  * KVM: Fix cpuid2 killing 32-bit guests on non-NX machines
+  * KVM: x86 emulator: Move rep processing before instruction execution
+  * KVM: x86 emulator: unify two switches
+  * KVM: x86 emulator: unify four switch statements into two
+  * KVM: Don't bypass the mmu if in pae and pdptrs changed
+  * KVM: Portability: Move KVM_INTERRUPT vcpu ioctl to x86.c
+  * KVM: Correct kvm_init() error paths not freeing bad_pge.
+  * KVM: Export include/linux/kvm.h only if $ARCH actually supports KVM
+  * KVM: SVM: Remove KVM specific defines for MSR_EFER
+  * KVM: Replace kvm_lapic with kvm_vcpu in ioapic/lapic interface
+  * KVM: Replace dest_Lowest_Prio and dest_Fixed with self-defined macros
+  * KVM: Extend ioapic code to support iosapic
+  * KVM: Portability: Move address types to their own header file
+  * KVM: Portability: Move IO device definitions to its own header file
+  * KVM: Portability: Stop including x86-specific headers in kvm_main.c
+  * KVM: Portability: Create kvm_arch_vcpu_runnable() function
+  * KVM: Convert KVM from ->nopage() to ->fault()
+  * KVM: MMU: Remove unused prev_shadow_ent variable from fetch()
+  * KVM: Generalize exception injection mechanism
+  * KVM: Replace page fault injection by the generalized exception queue
+  * KVM: Replace #GP injection by the generalized exception queue
+  * KVM: Use generalized exception queue for injecting #UD
+  * KVM: x86 emulator: fix eflags preparation for emulation
+  * KVM: VMX: Avoid exit when setting cr8 if the local apic is in the
+    kernel
+  * KVM: SVM: Emulate read/write access to cr8
+  * KVM: x86 emulator: Fix stack instructions on 64-bit mode
+  * KVM: SVM: Trap access to the cr8 register
+  * KVM: VMX: Fix cr8 exit optimization
+  * KVM: MMU: Use cmpxchg for pte updates on walk_addr()
+  * KVM: MMU: Simplify calculation of pte access
+  * KVM: MMU: Set nx bit correctly on shadow ptes
+  * KVM: MMU: Move pte access calculation into a helper function
+  * KVM: MMU: Fix inherited permissions for emulated guest pte updates
+  * KVM: MMU: No need to pick up nx bit from guest pte
+  * KVM: MMU: Pass pte dirty flag to set_pte() instead of calculating it
+    on-site
+  * KVM: MMU: Remove walker argument to set_pte()
+  * KVM: MMU: Move set_pte() into guest paging mode independent code
+  * KVM: MMU: Adjust mmu_set_spte() debug code for gpte removal
+  * KVM: MMU: Use mmu_set_spte() for real-mode shadows
+  * KVM: SVM: Exit to userspace if write to cr8 and not using in-kernel
+    apic
+  * KVM: SVM: support writing 0 to K8 performance counter control registers
+  * KVM: MMU: Fix kunmap_atomic() call in cmpxchg_gpte()
+  * KVM: MMU: Fix SMP shadow instantiation race
+  * KVM: LAPIC: minor debugging compile fix
+  * KVM: MMU: emulated cmpxchg8b should be atomic on i386
+  * KVM: Fix bad kunmap_atomic() paramerter inm cmpxchg emulation
+  * KVM: Make cmpxchg emulation compile on i386
+  * KVM: Another cmpxchg i386 compile fix
+  * KVM: Another cmpxchg emulation compile fix
+  * KVM: Another cmpxchg emulation compile fix
+  * KVM: Portability: Move kvm{pic,ioapic} accesors to x86 specific code
+  * KVM: Portability: Introduce kvm_vcpu_arch
+  * KVM: Portability: Split mmu-related static inline functions to mmu.h
+  * KVM: Portability: Move kvm_vcpu definition back to kvm.h
+  * KVM: Portability: Expand the KVM_VCPU_COMM in kvm_vcpu structure.
+  * KVM: Portability: Move kvm_vcpu_stat to x86.h
+  * KVM: Portability: Move memslot aliases to new struct kvm_arch
+  * KVM: Portability: Move mmu-related fields to kvm_arch
+  * KVM: Portability: move vpic and vioapic to kvm_arch
+  * KVM: Portability: Move round_robin_prev_vcpu and tss_addr to kvm_arch
+  * KVM: Portability: Move kvm_vm_stat to x86.h
+  * KVM: VMX: Add printk_ratelimit in vmx_intr_assist
+  * KVM: Move arch dependent files to new directory arch/x86/kvm/
+  * KVM: Move drivers/kvm/* to virt/kvm/
+  * KVM: Fix compile error in asm/kvm_host.h
+  * KVM: Move irqchip declarations into new ioapic.h and lapic.h
+  * KVM: Move ioapic code to common directory.
+  * KVM: Move kvm_vcpu_kick() to x86.c
+  * KVM: Expose ioapic to ia64 save/restore APIs
+  * KVM: MMU: Coalesce remote tlb flushes
+  * KVM: MMU: Add cache miss statistic
+  * KVM: Print data for unimplemented wrmsr
+  * KVM: Ensure pages are copied on write
+  * KVM: MMU: Fix cmpxchg8b emulation on i386 (again)
+  * KVM: x86 emulator: Add vmmcall/vmcall to x86_emulate (v3)
+  * KVM: Refactor hypercall infrastructure (v3)
+  * KVM: x86 emulator: remove unused functions
+  * KVM: x86 emulator: move all x86_emulate_memop() to a structure
+  * KVM: x86 emulator: move all decoding process to function
+    x86_decode_insn()
+  * KVM: emulate_instruction() calls now x86_decode_insn() and
+    x86_emulate_insn()
+  * KVM: Call x86_decode_insn() only when needed
+  * KVM: VMX: Further reduce efer reloads
+  * KVM: Allow not-present guest page faults to bypass kvm
+  * KVM: MMU: Make flooding detection work when guest page faults are
+    bypassed
+  * KVM: MMU: Ignore reserved bits in cr3 in non-pae mode
+  * KVM: x86 emulator: split some decoding into functions for readability
+  * KVM: x86 emulator: remove _eflags and use directly ctxt->eflags.
+  * KVM: x86 emulator: Remove no_wb, use dst.type = OP_NONE instead
+  * KVM: x86_emulator: no writeback for bt
+  * KVM: Purify x86_decode_insn() error case management
+  * KVM: x86 emulator: Any legacy prefix after a REX prefix nullifies its
+    effect
+  * KVM: VMX: Don't clear the vmcs if the vcpu is not loaded on any
+    processor
+  * KVM: VMX: Simplify vcpu_clear()
+  * KVM: Remove the usage of page->private field by rmap
+  * KVM: Add general accessors to read and write guest memory
+  * KVM: Allow dynamic allocation of the mmu shadow cache size
+  * KVM: Add kvm_free_lapic() to pair with kvm_create_lapic()
+  * KVM: Hoist kvm_create_lapic() into kvm_vcpu_init()
+  * KVM: Remove gratuitous casts from lapic.c
+  * KVM: CodingStyle cleanup
+  * KVM: Support assigning userspace memory to the guest
+  * KVM: Move x86 msr handling to new files x86.[ch]
+  * KVM: MMU: Clean up MMU functions to take struct kvm when appropriate
+  * KVM: MMU: More struct kvm_vcpu -> struct kvm cleanups
+  * KVM: Move guest pte dirty bit management to the guest pagetable walker
+  * KVM: MMU: Fix nx access bit for huge pages
+  * KVM: MMU: Disable write access on clean large pages
+  * KVM: MMU: Instantiate real-mode shadows as user writable shadows
+  * KVM: MMU: Move dirty bit updates to a separate function
+  * KVM: MMU: When updating the dirty bit, inform the mmu about it
+  * KVM: Portability: split kvm_vcpu_ioctl
+  * KVM: apic round robin cleanup
+  * KVM: Add some \n in ioapic_debug()
+  * KVM: Move apic timer interrupt backlog processing to common code
+  * KVM: Rename KVM_TLB_FLUSH to KVM_REQ_TLB_FLUSH
+  * KVM: x86 emulator: Implement emulation of instruction: inc & dec
+  * KVM: MMU: Simplify page table walker
+  * KVM: x86 emulator: cmc, clc, cli, sti
+  * KVM: MMU: Add rmap_next(), a helper for walking kvm rmaps
+  * KVM: MMU: Keep a reverse mapping of non-writable translations
+  * KVM: MMU: Make gfn_to_page() always safe
+  * KVM: MMU: Partial swapping of guest memory
+  * KVM: Use virtual cpu accounting if available for guest times.
+  * KVM: Allocate userspace memory for older userspace
+  * KVM: Portability: Split kvm_vcpu into arch dependent and independent
+    parts (part 1)
+  * KVM: Move vmx_vcpu_reset() out of vmx_vcpu_setup()
+  * KVM: Add a might_sleep() annotation to gfn_to_page()
+  * KVM: Export PIC reset for kernel device reset
+  * KVM: Split IOAPIC reset function and export for kernel RESET
+  * KVM: Per-architecture hypercall definitions
+  * KVM: Unmap kernel-allocated memory on slot destruction
+  * KVM: Export memory slot allocation mechanism
+  * KVM: Add kernel-internal memory slots
+  * KVM: Add ioctl to tss address from userspace,
+  * KVM: VMX: Let gcc to choose which registers to save (x86_64)
+  * KVM: VMX: Let gcc to choose which registers to save (i386)
+  * KVM: SVM: Let gcc to choose which registers to save (x86_64)
+  * KVM: SVM: Let gcc to choose which registers to save (i386)
+  * KVM: x86 emulator: don't depend on cr2 for mov abs emulation
+  * KVM: Move page fault processing to common code
+  * KVM: MMU: Topup the mmu memory preallocation caches before emulating an
+    insn
+  * KVM: Portability: Split kvm_vm_ioctl v3
+  * KVM: Portability: Move memory segmentation to x86.c
+  * KVM: Portability: move get/set_apic_base to x86.c
+  * KVM: Portability: Move control register helper functions to x86.c
+  * KVM: VMX: Enable memory mapped TPR shadow (FlexPriority)
+  * KVM: Fix gfn_to_page() acquiring mmap_sem twice
+  * KVM: Portability: Move kvm_get/set_msr[_common] to x86.c
+  * KVM: Portability: Move x86 emulation and mmio device hook to x86.c
+  * KVM: Portability: Move pio emulation functions to x86.c
+  * KVM: x86 emulator: Extract the common code of SrcReg and DstReg
+  * KVM: x86 emulator: centralize decoding of one-byte register access
+    insns
+  * KVM: Simplify decode_register_operand() calling convention
+  * KVM: Make mark_page_dirty() work for aliased pages too.
+  * KVM: x86 emulator: Hoist modrm and abs decoding into separate functions
+  * KVM: Portability: Make exported debugfs data architecture-specific
+  * KVM: Portability: Move x86 instruction emulation code to x86.c
+  * KVM: Portability: Move x86 FPU handling to x86.c
+  * KVM: Portability: Move x86 vcpu ioctl handlers to x86.c
+  * KVM: Add make_page_dirty() to kvm_clear_guest_page()
+  * KVM: VMX: Use vmx to inject real-mode interrupts
+  * KVM: VMX: Read & store IDT_VECTORING_INFO_FIELD
+  * KVM: Fix faults during injection of real-mode interrupts
+  * KVM: VMX: Comment VMX primary/secondary exec ctl definitions
+  * KVM: VMX: wbinvd exiting
+  * KVM: x86 emulator: remove 8 bytes operands emulator for call near
+    instruction
+  * KVM: Simplify CPU_TASKS_FROZEN cpu notifier handling
+  * KVM: add kvm_is_error_hva()
+  * KVM: introduce gfn_to_hva()
+  * KVM: Change kvm_{read,write}_guest() to use copy_{from,to}_user()
+  * KVM: Portability: Move some includes to x86.c
+  * KVM: Portability: Move kvm_x86_ops to x86.c
+  * KVM: Portability: Add vcpu and hardware management arch hooks
+  * KVM: Portability: Combine kvm_init and kvm_init_x86
+  * KVM: Portability: Move x86 specific code from kvm_init() to kvm_arch()
+  * KVM: x86 emulator: modify 'lods', and 'stos' not to depend on CR2
+  * KVM: Portability: move KVM_CHECK_EXTENSION
+  * KVM: VMX: Consolidate register usage in vmx_vcpu_run()
+  * KVM: Portability: Make kvm_vcpu_ioctl_translate arch dependent
+  * KVM: Remove ptr comparisons to 0
+  * KVM: Remove __init attributes for kvm_init_debug and kvm_init_msr_list
+  * KVM: Portability: Add two hooks to handle kvm_create and destroy vm
+  * KVM: Replace 'light_exits' stat with 'host_state_reload'
+  * KVM: Add fpu_reload counter
+  * KVM: Add instruction emulation statistics
+  * KVM: Extend stats support for VM stats
+  * KVM: MMU: Add some mmu statistics
+  * KVM: Make unloading of FPU state when putting vcpu arch-independent
+  * KVM: Portability: Move kvm_vcpu_ioctl_get_dirty_log to arch-specific 
+    file
+  * KVM: Portability: MMU initialization and teardown split
+  * KVM: Portability: Move some macro definitions from kvm.h to x86.h
+  * KVM: Portability: Move struct kvm_x86_ops definition to x86.h
+  * KVM: Portability: Move vcpu regs enumeration definition to x86.h
+  * KVM: Move some static inline functions out from kvm.h into x86.h
+  * KVM: Portability: Move some function declarations to x86.h
+  * KVM: VMX: Force seg.base == (seg.sel << 4) in real	mode
+  * KVM: MMU: Change guest pte access to kvm_{read,write}_guest()
+  * KVM: Simplify kvm_clear_guest_page()
+  * KVM: Add missing #include <asm/pgtable.h>
+  * KVM: MMU: Remove unused variable
+  * KVM: Remove unused "rmap_overflow" variable
+  * KVM: Correct consistent typo: "destory" -> "destroy"
+  * KVM: Move misplaced comment
+  * KVM: Portability: Move kvm_memory_alias to asm/kvm.h
+  * KVM: Portability: Move x86 pic strutctures
+  * KVM: Portability: Move kvm_regs to <asm/kvm.h>
+  * KVM: Portability: Move structure lapic_state to <asm/kvm.h>
+  * KVM: Portability: Move kvm_segment & kvm_dtable structure to 
+    <asm/kvm.h>
+  * KVM: Portability: Move kvm_sregs and msr structures to <asm/kvm.h>
+  * KVM: Portability: Move cpuid structures to <asm/kvm.h>
+  * KVM: Export include/asm-x86/kvm.h
+  * KVM: MMU: Fix potential memory leak with smp real-mode
+  * KVM: MMU: Selectively set PageDirty when releasing guest memory
+  * KVM: x86 emulator: retire ->write_std()
+  * KVM: x86 emulator: prefetch up to 15 bytes of the instruction executed
+  * KVM: Recalculate mmu pages needed for every memory region change
+  * KVM: Portability:  Split kvm_set_memory_region() to have an arch
+    callout
+  * KVM: Split vcpu creation to avoid vcpu_load() before preemption setup
+  * KVM: MMU: Implement guest page fault bypass for nonpae
+  * KVM: Add statistic for remote tlb flushes
+  * KVM: MMU: Avoid unnecessary remote tlb flushes when guest updates a pte
+  * KVM: Don't bother the mmu if cr3 load doesn't change cr3
+  * KVM: MMU: Code cleanup
+  * KVM: MMU: Introduce and use gpte_to_gfn()
+  * KVM: MMU: Move pse36 handling to the guest walker
+  * KVM: MMU: Remove extra gaddr parameter from set_pte_common()
+  * KVM: MMU: Remove set_pde()
+  * KVM: MMU: Adjust page_header_update_slot() to accept a gfn instead of a
+    gpa
+  * KVM: MMU: Introduce gfn_to_gpa()
+  * KVM: MMU: Simplify nonpaging_map()
+  * KVM: MMU: Remove gva_to_hpa()
+  * KVM: Remove gpa_to_hpa()
+  * KVM: MMU: Rename variables of type 'struct kvm_mmu_page *'
+  * KVM: MMU: Rename 'release_page'
+  * KVM: Disallow fork() and similar games when using a VM
+  * KVM: Enhance guest cpuid management
+  * KVM: VMX: Remove the secondary execute control dependency on irqchip
+  * KVM: Portability: Move unalias_gfn to arch dependent file
+  * KVM: x86 emulator: Make a distinction between repeat prefixes F3 and F2
+  * KVM: x86 emulator: address size and operand size overrides are sticky
+  * KVM: Remove misleading check for mmio during event injection
+  * KVM: MMU: mark pages that were inserted to the shadow pages table as
+    accessed
+  * KVM: x86 emulator: rename REP_REPE_PREFIX
+  * KVM: x86 emulator: Rename 'cr2' to 'memop'
+  * KVM: x86 emulator: cmps instruction
+  * KVM: Add ifdef in irqchip struct for x86 only structures
+  * KVM: Fix cpuid2 killing 32-bit guests on non-NX machines
+  * KVM: x86 emulator: Move rep processing before instruction execution
+  * KVM: x86 emulator: unify two switches
+  * KVM: x86 emulator: unify four switch statements into two
+  * KVM: Portability: Move KVM_INTERRUPT vcpu ioctl to x86.c
+  * KVM: Correct kvm_init() error paths not freeing bad_pge.
+  * KVM: Export include/linux/kvm.h only if $ARCH actually supports KVM
+  * KVM: SVM: Remove KVM specific defines for MSR_EFER
+  * KVM: Replace kvm_lapic with kvm_vcpu in ioapic/lapic interface
+  * KVM: Replace dest_Lowest_Prio and dest_Fixed with self-defined macros
+  * KVM: Extend ioapic code to support iosapic
+  * KVM: Portability: Move address types to their own header file
+  * KVM: Portability: Move IO device definitions to its own header file
+  * KVM: Portability: Stop including x86-specific headers in kvm_main.c
+  * KVM: Portability: Create kvm_arch_vcpu_runnable() function
+  * KVM: Convert KVM from ->nopage() to ->fault()
+  * KVM: MMU: Remove unused prev_shadow_ent variable from fetch()
+  * KVM: Generalize exception injection mechanism
+  * KVM: Replace page fault injection by the generalized exception queue
+  * KVM: Replace #GP injection by the generalized exception queue
+  * KVM: Use generalized exception queue for injecting #UD
+  * KVM: x86 emulator: fix eflags preparation for emulation
+  * KVM: VMX: Avoid exit when setting cr8 if the local apic is in the
+    kernel
+  * KVM: SVM: Emulate read/write access to cr8
+  * KVM: x86 emulator: Fix stack instructions on 64-bit mode
+  * KVM: SVM: Trap access to the cr8 register
+  * KVM: VMX: Fix cr8 exit optimization
+  * KVM: MMU: Use cmpxchg for pte updates on walk_addr()
+  * KVM: MMU: Simplify calculation of pte access
+  * KVM: MMU: Set nx bit correctly on shadow ptes
+  * KVM: MMU: Move pte access calculation into a helper function
+  * KVM: MMU: Fix inherited permissions for emulated guest pte updates
+  * KVM: MMU: No need to pick up nx bit from guest pte
+  * KVM: MMU: Pass pte dirty flag to set_pte() instead of calculating it
+    on-site
+  * KVM: MMU: Remove walker argument to set_pte()
+  * KVM: MMU: Move set_pte() into guest paging mode independent code
+  * KVM: MMU: Adjust mmu_set_spte() debug code for gpte removal
+  * KVM: MMU: Use mmu_set_spte() for real-mode shadows
+  * KVM: SVM: Exit to userspace if write to cr8 and not using in-kernel
+    apic
+  * KVM: MMU: Fix SMP shadow instantiation race
+  * KVM: LAPIC: minor debugging compile fix
+  * KVM: SVM: support writing 0 to K8 performance counter control registers
+  * KVM: MMU: emulated cmpxchg8b should be atomic on i386
+  * KVM: Portability: Move kvm{pic,ioapic} accesors to x86 specific code
+  * KVM: Portability: Introduce kvm_vcpu_arch
+  * KVM: Portability: Split mmu-related static inline functions to mmu.h
+  * KVM: Portability: Move kvm_vcpu definition back to kvm.h
+  * KVM: Portability: Expand the KVM_VCPU_COMM in kvm_vcpu structure.
+  * KVM: Portability: Move kvm_vcpu_stat to x86.h
+  * KVM: Portability: Move memslot aliases to new struct kvm_arch
+  * KVM: Portability: Move mmu-related fields to kvm_arch
+  * KVM: Portability: move vpic and vioapic to kvm_arch
+  * KVM: Portability: Move round_robin_prev_vcpu and tss_addr to kvm_arch
+  * KVM: Portability: Move kvm_vm_stat to x86.h
+  * KVM: VMX: Add printk_ratelimit in vmx_intr_assist
+  * KVM: Move arch dependent files to new directory arch/x86/kvm/
+  * KVM: Move drivers/kvm/* to virt/kvm/
+  * KVM: Move irqchip declarations into new ioapic.h and lapic.h
+  * KVM: Move ioapic code to common directory.
+  * KVM: Move kvm_vcpu_kick() to x86.c
+  * KVM: Expose ioapic to ia64 save/restore APIs
+  * KVM: MMU: Coalesce remote tlb flushes
+  * KVM: MMU: Add cache miss statistic
+  * KVM: Print data for unimplemented wrmsr
+  * KVM: Ensure pages are copied on write
+  * KVM: local APIC TPR access reporting facility
+  * KVM: Accelerated apic support
+  * KVM: Disable vapic support on Intel machines with FlexPriority
+  * KVM: MMU: Concurrent guest walkers
+  * KVM: Add kvm_read_guest_atomic()
+  * KVM: MMU: Avoid calling gfn_to_page() in mmu_set_spte()
+  * KVM: MMU: Switch to mmu spinlock
+  * KVM: MMU: Move kvm_free_some_pages() into critical section
+  * KVM: MMU: Broaden scope of mmap_sem to include actual mapping
+  * KVM: MMU: Fix recursive locking of mmap_sem()
+  * KVM: Fix unbalanced mmap_sem operations in cmpxchg8b emulation
+  * KVM: Mark vapic page as dirty for save/restore/migrate
+  * KVM: x86 emulator: Only allow VMCALL/VMMCALL trapped by #UD
+  * KVM: MMU: Update shadow ptes on partial guest pte writes
+  * KVM: MMU: Simplify hash table indexing
+  * KVM: Portability: Move kvm_fpu to asm-x86/kvm.h
+  * KVM: MMU: Fix dirty page setting for pages removed from rmap
+  * KVM: Initialize the mmu caches only after verifying cpu support
+  * KVM: Fix unbounded preemption latency
+  * KVM: Put kvm_para.h include outside __KERNEL__
+  * KVM: Move apic timer migration away from critical section
+  * KVM: SVM: Fix lazy FPU switching
+  * KVM: MMU: Fix gpa truncation when reading a pte
+  * [GFS2] Handle multiple glock demote requests
+  * [GFS2] Clean up internal read function
+  * [GFS2] Use ->page_mkwrite() for mmap()
+  * [GFS2] Remove useless i_cache from inodes
+  * [GFS2] Remove unused field in struct gfs2_inode
+  * [GFS2] Add gfs2_is_writeback()
+  * [GFS2] Introduce gfs2_set_aops()
+  * [GFS2] Split gfs2_writepage into three cases
+  * [GFS2] Add writepages for GFS2 jdata
+  * [GFS2] Don't hold page lock when starting transaction
+  * [GFS2] Use correct include file in ops_address.c
+  * [GFS2] Remove unused variables
+  * [GFS2] Remove "reclaim limit"
+  * [GFS2] Add sync_page to metadata address space operations
+  * [GFS2] Reorder writeback for glock sync
+  * [GFS2] Remove flags no longer required
+  * [GFS2] Given device ID rather than s_id in "id" sysfs file
+  * [GFS2] check kthread_should_stop when waiting
+  * [GFS2] Don't add glocks to the journal
+  * [GFS2] Use atomic_t for journal free blocks counter
+  * [GFS2] Move gfs2_logd into log.c
+  * [GFS2] Don't periodically update the jindex
+  * [GFS2] Check for installation of mount helpers for DLM mounts
+  * [GFS2] tidy up error message
+  * [GFS2] Fix runtime issue with UP kernels
+  * [GFS2] remove unnecessary permission checks
+  * [GFS2] Fix build warnings
+  * [GFS2] Remove unrequired code
+  * [GFS2] Remove lock methods for lock_nolock protocol
+  * [GFS2] patch to check for recursive lock requests in gfs2_rename code
+    path
+  * [GFS2] Remove unused variable
+  * [GFS2] use pid for plock owner for nfs clients
+  * [GFS2] Remove function gfs2_get_block
+  * [GFS2] Journal extent mapping
+  * [GFS2] Get rid of useless "found" variable in quota.c
+  * [GFS2] Run through full bitmaps quicker in gfs2_bitfit
+  * [GFS2] Reorganize function gfs2_glmutex_lock
+  * [GFS2] Only fetch the dinode once in block_map
+  * [GFS2] Function meta_read optimization
+  * [GFS2] Incremental patch to fix compiler warning
+  * [GFS2] Eliminate the no longer needed sd_statfs_mutex
+  * [GFS2] Minor correction
+  * [GFS2] Fix log block mapper
+  * [GFS2] Remove unused variable
+  * [GFS2] Allow page migration for writeback and ordered pages
+  * [GFS2] Initialize extent_list earlier
+  * [GFS2] Fix problems relating to execution of files on GFS2
+  * [GFS2] Fix assert in log code
+  * [GFS2] Reduce inode size by moving i_alloc out of line
+  * [GFS2] Remove unneeded i_spin
+  * [GFS2] gfs2_alloc_required performance
+  * [GFS2] Fix write alloc required shortcut calculation
+  * [GFS2] Fix typo
+  * [GFS2] Fix page_mkwrite truncation race path
+  * [GFS2] Lockup on error
+  * [GFS2] Allow journal recovery on read-only mount
+
+ -- Tim Gardner <tim.gardner@canonical.com>  Sun, 27 Jan 2008 20:37:18 -0700
+
+linux (2.6.24-5.9) hardy; urgency=low
+
+  [Amit Kucheria]
+
+  * Fix LPIA FTBFS due to virtio Ignore: yes
+
+  [Upstream Kernel Changes]
+
+  * ACPI: processor: Fix null pointer dereference in throttling
+  * [SPARC64]: Fix of section mismatch warnings.
+  * [SPARC64]: Fix section error in sparcspkr
+  * [SPARC]: Constify function pointer tables.
+  * [BLUETOOTH]: Move children of connection device to NULL before
+    connection down.
+  * [TULIP] DMFE: Fix SROM parsing regression.
+  * [IPV4]: Add missing skb->truesize increment in ip_append_page().
+  * iwlwifi: fix possible read attempt on ucode that is not available
+  * [NETNS]: Re-export init_net via EXPORT_SYMBOL.
+  * [INET]: Fix truesize setting in ip_append_data
+  * sis190: add cmos ram access code for the SiS19x/968 chipset pair
+  * sis190: remove duplicate INIT_WORK
+  * sis190: mdio operation failure is not correctly detected
+  * sis190: scheduling while atomic error
+  * Update ctime and mtime for memory-mapped files
+  * [SCSI] initio: fix module hangs on loading
+  * xen: disable vcpu_info placement for now
+  * agp/intel: add support for E7221 chipset
+  * drm/i915: add support for E7221 chipset
+  * DMI: move dmi_available declaration to linux/dmi.h
+  * DMI: create dmi_get_slot()
+  * ACPI: create acpi_dmi_dump()
+  * ACPI: on OSI(Linux), print needed DMI rather than requesting dmidecode
+    output
+  * ACPI: Delete Intel Customer Reference Board (CRB) from OSI(Linux) DMI
+    list
+  * ACPI: make _OSI(Linux) console messages smarter
+  * ACPI: Add ThinkPad R61, ThinkPad T61 to OSI(Linux) white-list
+  * ACPI: DMI blacklist to reduce console warnings on OSI(Linux) systems.
+  * ACPI: EC: fix dmesg spam regression
+  * ACPI: EC: add leading zeros to debug messages
+  * Pull bugzilla-9747 into release branch
+  * Pull bugzilla-8459 into release branch
+  * Pull bugzilla-9798 into release branch
+  * Pull dmi-2.6.24 into release branch
+  * [SPARC64]: Partially revert "Constify function pointer tables."
+  * lockdep: fix kernel crash on module unload
+  * sysctl: kill binary sysctl KERN_PPC_L2CR
+  * fix hugepages leak due to pagetable page sharing
+  * spi: omap2_mcspi PIO RX fix
+  * Linux 2.6.24
+
+ -- Tim Gardner <tim.gardner@canonical.com>  Fri, 25 Jan 2008 01:44:27 -0700
+
+linux (2.6.24-5.8) hardy; urgency=low
+
+  [Alessio Igor Bogani]
+
+  * rt: Update to 2.6.24-rc8-rt1
+  * rt: Update configuration files
+
+  [Amit Kucheria]
+
+  * Asix: fix breakage caused in 2.6.24-rc7
+  * Add CONFIG_CPUSETS to server-related flavours
+    - LP: #182434
+
+  [Chuck Short]
+
+  * SAUCE: ata: blacklist FUJITSU MHW2160BH PL
+    - LP: #175834
+
+  [Kees Cook]
+
+  * AppArmor: updated patch series to upstream SVN 1079.
+
+  [Soren Hansen]
+
+  * Updated configs to enable virtio stuff Ignore: yes
+
+  [Stefan Bader]
+
+  * Enabled CONFIG_BSD_PROCESS_ACCT=y for sparc.
+    - LP: #176587
+  * Enable CONFIG_AUDITSYSCALL=y.
+    - LP: #140784
+  * Added CONFIG_AUDIT_SYSCALL=y to custom lpia(compat)
+  * Enabled CONFIG_HUGETLBFS=y for i386/server amd64/server and ia64.
+  * Lower priority of pnpacpi resource messages to warning level.
+    - LP: #159241
+  * Fix the messed up message level of pnpacpi parser.
+
+  [Tim Gardner]
+
+  * Start new release, bump ABI to -5
+  * Disabled iwlwifi preperatory to moving it to l-u-m.
+  * Enabled CONFIG_USB_SERIAL_KEYSPAN
+  * Disabled CONFIG_CGROUPS.
+  * Virtio config settings for -rt.
+  * Re-enable IWLWIFI in the kernel.
+  * Fixed -rt saa7134-core.c FTBS
+
+  [Upstream Kernel Changes]
+
+  * Input: Handle EV_PWR type of input caps in input_set_capability.
+  * Input: jornada680_kbd - fix default keymap
+  * increase PNP_MAX_PORT to 40 from 24
+  * sched: fix gcc warnings
+  * leds: Fix leds_list_lock locking issues
+  * leds: Fix locomo LED driver oops
+  * x86: fix asm-x86/byteorder.h for userspace export
+  * x86: fix asm-x86/msr.h for user-space export
+  * ACPI: EC: Enable boot EC before bus_scan
+  * ACPI: Make sysfs interface in ACPI power optional.
+  * fix lguest rmmod "bad pgd"
+  * slub: provide /proc/slabinfo
+  * [POWERPC] Fix build failure on Cell when CONFIG_SPU_FS=y
+  * slub: register slabinfo to procfs
+  * [SCSI] scsi_sysfs: restore prep_fn when ULD is removed
+  * Unify /proc/slabinfo configuration
+  * scsi: revert "[SCSI] Get rid of scsi_cmnd->done"
+  * restrict reading from /proc/<pid>/maps to those who share ->mm or can
+    ptrace pid
+  * Fix kernel/ptrace.c compile problem (missing "may_attach()")
+  * hwmon: (w83627ehf) Be more careful when changing VID input level
+  * NFS: Fix a possible Oops in fs/nfs/super.c
+  * NFSv4: Fix circular locking dependency in nfs4_kill_renewd
+  * NFS: add newline to kernel warning message in auth_gss code
+  * NFSv4: nfs4_open_confirm must not set the open_owner as confirmed on
+    error
+  * NFSv4: Fix open_to_lock_owner sequenceid allocation...
+  * gameport: don't export functions that are static inline
+  * Input: spitzkbd - fix suspend key handling
+  * Input: pass EV_PWR events to event handlers
+  * [ARM] 4735/1: Unbreak pxa25x suspend/resume
+  * IB/srp: Fix list corruption/oops on module reload
+  * Console is utf-8 by default
+  * [IA64] Update Altix BTE error return status patch
+  * [IA64] Update Altix nofault code
+  * [X25]: Add missing x25_neigh_put
+  * [XFRM]: Do not define km_migrate() if !CONFIG_XFRM_MIGRATE
+  * [CASSINI]: Fix endianness bug.
+  * [CASSINI]: Revert 'dont touch page_count'.
+  * [CASSINI]: Program parent Intel31154 bridge when necessary.
+  * [CASSINI]: Set skb->truesize properly on receive packets.
+  * [CASSINI]: Fix two obvious NAPI bugs.
+  * [CASSINI]: Bump driver version and release date.
+  * [INET]: Fix netdev renaming and inet address labels
+  * [CONNECTOR]: Return proper error code in cn_call_callback()
+  * [ISDN] i4l: 'NO CARRIER' message lost after ldisc flush
+  * [ISDN]: i4l: Fix DLE handling for i4l-audio
+  * fix: using joysticks in 32 bit applications on 64 bit systems
+  * [ARM] 4691/1: add missing i2c_board_info struct for at91rm9200
+  * hda_intel suspend latency: shorten codec read
+  * CPU hotplug: fix cpu_is_offline() on !CONFIG_HOTPLUG_CPU
+  * Linux 2.6.24-rc7
+  * sh: Fix argument page dcache flushing regression.
+  * V4L/DVB (6944a): Fix Regression VIDIOCGMBUF ioctl hangs on bttv driver
+  * V4L/DVB (6916): ivtv: udelay has to be changed *after* the eeprom was
+    read, not before
+  * [MIPS] Move inclusing of kernel/time/Kconfig menu to appropriate place
+  * [MIPS] Alchemy: Fix use of __init code bug exposed by modpost warning
+  * [MIPS] Fix IP32 breakage
+  * [MIPS] Assume R4000/R4400 newer than 3.0 don't have the mfc0 count bug
+  * [MIPS] Fix CONFIG_BOOT_RAW.
+  * ACPI: Reintroduce run time configurable max_cstate for !CPU_IDLE case
+  * core dump: real_parent ppid
+  * acct: real_parent ppid
+  * IB/mlx4: Fix value of pkey_index in QP1 completions
+  * IB/srp: Release transport before removing host
+  * x86: fix do_fork_idle section mismatch
+  * spi_bitbang: always grab lock with irqs blocked
+  * fat: optimize fat_count_free_clusters()
+  * KEYS: fix macro
+  * md: fix data corruption when a degraded raid5 array is reshaped
+  * xip: fix get_zeroed_page with __GFP_HIGHMEM
+  * eCryptfs: fix dentry handling on create error, unlink, and inode
+    destroy
+  * vmcoreinfo: add the array length of "free_list" for filtering free
+    pages
+  * dmi-id: fix for __you_cannot_kmalloc_that_much failure
+  * snd_mixer_oss_build_input(): fix for __you_cannot_kmalloc_that_much
+    failure with gcc-3.2
+  * Fix crash with FLAT_MEMORY and ARCH_PFN_OFFSET != 0
+  * hfs: handle more on-disk corruptions without oopsing
+  * pl2303: Fix mode switching regression
+  * futex: Prevent stale futex owner when interrupted/timeout
+  * [NIU]: Fix slowpath interrupt handling.
+  * [NIU]: Missing ->last_rx update.
+  * [NIU]: Fix potentially stuck TCP socket send queues.
+  * [NIU]: Update driver version and release date.
+  * [IPV4] raw: Strengthen check on validity of iph->ihl
+  * [IPV4] ipconfig: Fix regression in ip command line processing
+  * [NET]: Fix netx-eth.c compilation.
+  * [METH]: Fix MAC address handling.
+  * [TULIP]: NAPI full quantum bug.
+  * [ATM]: [nicstar] delay irq setup until card is configured
+  * [SCTP]: Fix the name of the authentication event.
+  * [SCTP]: Correctly handle AUTH parameters in unexpected INIT
+  * [SCTP]: Add back the code that accounted for FORWARD_TSN parameter in
+    INIT.
+  * [IRDA]: irda_create() nuke user triggable printk
+  * b43: Fix rxheader channel parsing
+  * [NET]: Do not grab device reference when scheduling a NAPI poll.
+  * [NET]: Add NAPI_STATE_DISABLE.
+  * [NET]: Do not check netif_running() and carrier state in ->poll()
+  * ssb: Fix probing of PCI cores if PCI and PCIE core is available
+  * mac80211: return an error when SIWRATE doesn't match any rate
+  * [NETXEN]: Fix ->poll() done logic.
+  * [NET]: Fix drivers to handle napi_disable() disabling interrupts.
+  * [NET]: Stop polling when napi_disable() is pending.
+  * [NET]: Make ->poll() breakout consistent in Intel ethernet drivers.
+  * [NET] Intel ethernet drivers: update MAINTAINERS
+  * [NET]: kaweth was forgotten in msec switchover of usb_start_wait_urb
+  * [IPV4] ROUTE: ip_rt_dump() is unecessary slow
+  * [NET]: Clone the sk_buff 'iif' field in __skb_clone()
+  * [LRO] Fix lro_mgr->features checks
+  * [NET]: mcs7830 passes msecs instead of jiffies to usb_control_msg
+  * [FORCEDETH]: Fix reversing the MAC address on suspend.
+  * [XFRM]: xfrm_algo_clone() allocates too much memory
+  * [SOCK]: Adds a rcu_dereference() in sk_filter
+  * [CONNECTOR]: Don't touch queue dev after decrement of ref count.
+  * [IPV6]: IPV6_MULTICAST_IF setting is ignored on link-local connect()
+  * [ATM]: Check IP header validity in mpc_send_packet
+  * show_task: real_parent
+  * [SCSI] qla1280: fix 32 bit segment code
+  * [NIU]: Support for Marvell PHY
+  * [NEIGH]: Fix race between neigh_parms_release and neightbl_fill_parms
+  * [IPV4] ROUTE: fix rcu_dereference() uses in /proc/net/rt_cache
+  * [AX25]: Kill user triggable printks.
+  * [ARM] pxa: silence warnings from cpu_is_xxx() macros
+  * [POWERPC] efika: add phy-handle property for fec_mpc52xx
+  * [ARM] vfp: fix fuitod/fsitod instructions
+  * [CRYPTO] padlock: Fix alignment fault in aes_crypt_copy
+  * rt2x00: Allow rt61 to catch up after a missing tx report
+  * rt2x00: Corectly initialize rt2500usb MAC
+  * rt2x00: Put 802.11 data on 4 byte boundary
+  * NFSv4: Give the lock stateid its own sequence queue
+  * sata_qstor: use hardreset instead of softreset
+  * libata-sff: PCI IRQ handling fix
+  * pata_pdc202xx_old: Further fixups
+  * pata_ixp4xx_cf: fix compilation introduced by ata_port_desc()
+    conversion
+  * libata-pmp: 4726 hates SRST
+  * libata-pmp: propagate timeout to host link
+  * libata: don't normalize UNKNOWN to NONE after reset
+  * Update kernel parameter document for libata DMA mode setting knobs.
+  * sata_sil24: prevent hba lockup when pass-through ATA commands are used
+  * ide: workaround suspend bug for ACPI IDE
+  * ide: fix cable detection for SATA bridges
+  * trm290: do hook dma_host_{on,off} methods (take 2)
+  * libata and starting/stopping ATAPI floppy devices
+  * ACPI : Not register gsi for PCI IDE controller in legacy mode
+  * ACPICA: fix acpi_serialize hang regression
+  * sh: Force __access_ok() to obey address space limit.
+  * [AX25] af_ax25: Possible circular locking.
+  * ACPI: apply quirk_ich6_lpc_acpi to more ICH8 and ICH9
+  * [POWERPC] Fix CPU hotplug when using the SLB shadow buffer
+  * [BLUETOOTH]: rfcomm tty BUG_ON() code fix
+  * [BLUETOOTH]: Always send explicit hci_ll wake-up acks.
+  * [DECNET] ROUTE: fix rcu_dereference() uses in /proc/net/decnet_cache
+  * [VLAN]: nested VLAN: fix lockdep's recursive locking warning
+  * [MACVLAN]: Prevent nesting macvlan devices
+  * [NETFILTER]: ip6t_eui64: Fixes calculation of Universal/Local bit
+  * [NETFILTER]: xt_helper: Do not bypass RCU
+  * [XFS] fix unaligned access in readdir
+  * Don't blatt first element of prv in sg_chain()
+  * loop: fix bad bio_alloc() nr_iovec request
+  * block: fix blktrace timestamps
+  * blktrace: kill the unneeded initcall
+  * V4L/DVB (6999): ivtv: stick to udelay=10 after all
+  * V4L/DVB (7001): av7110: fix section mismatch
+  * [MIPS] Wrong CONFIG option prevents setup of DMA zone.
+  * [MIPS] pnx8xxx: move to clocksource
+  * [MIPS] Malta: Fix software reset on big endian
+  * [MIPS] Lasat: Fix built in separate object directory.
+  * [MIPS] Replace 40c7869b693b18412491fdcff64682215b739f9e kludge
+  * Pull bugzilla-5637 into release branch
+  * Pull bugzilla-8171 into release branch
+  * Pull bugzilla-8973 into release branch
+  * PM: ACPI and APM must not be enabled at the same time
+  * Pull bugzilla-9194 into release branch
+  * Pull bugzilla-9494 into release branch
+  * Pull bugzilla-9535 into release branch
+  * Pull bugzilla-9627 into release branch
+  * Pull bugzilla-9683 into release branch
+  * IDE: terminate ACPI DMI list
+  * cache invalidation error for buffered write
+  * ps3fb: prevent use after free of fb_info
+  * ps3fb: fix deadlock on kexec()
+  * [NETFILTER]: bridge: fix double POST_ROUTING invocation
+  * xircom_cb endianness fixes
+  * de4x5 fixes
+  * endianness noise in tulip_core
+  * netxen: update MAINTAINERS
+  * netxen: update driver version
+  * netxen: stop second phy correctly
+  * netxen: optimize tx handling
+  * netxen: fix byte-swapping in tx and rx
+  * 3c509: PnP resource management fix
+  * Fixed a small typo in the loopback driver
+  * ip1000: menu location change
+  * r8169: fix missing loop variable increment
+  * [usb netdev] asix: fix regression
+  * fs_enet: check for phydev existence in the ethtool handlers
+  * Use access mode instead of open flags to determine needed permissions
+  * sky2: large memory workaround.
+  * sky2: remove check for PCI wakeup setting from BIOS
+  * spidernet MAINTAINERship update
+  * pnpacpi: print resource shortage message only once
+  * Pull bugzilla-9535 into release branch
+  * [SPARC]: Make gettimeofday() monotonic again.
+  * [SPARC64]: Fix build with SPARSEMEM_VMEMMAP disabled.
+  * remove task_ppid_nr_ns
+  * knfsd: Allow NFSv2/3 WRITE calls to succeed when krb5i etc is used.
+  * Input: improve Kconfig help entries for HP Jornada devices
+  * [TOKENRING]: rif_timer not initialized properly
+  * modules: de-mutex more symbol lookup paths in the module code
+  * w1: decrement slave counter only in ->release() callback
+  * Kick CPUS that might be sleeping in cpus_idle_wait
+  * TPM: fix suspend and resume failure
+  * MAINTAINERS: email update and add missing entry
+  * quicklists: Only consider memory that can be used with GFP_KERNEL
+  * macintosh: fix fabrication of caplock key events
+  * scsi/qla2xxx/qla_os.c section fix
+  * cciss: section mismatch
+  * advansys: fix section mismatch warning
+  * hugetlbfs: fix quota leak
+  * s3c2410fb: fix incorrect argument type in resume function
+  * CRIS: define __ARCH_WANT_SYS_RT_SIGSUSPEND in unistd.h for CRIS
+  * CRIS v10: correct do_signal to fix oops and clean up signal handling in
+    general
+  * CRIS v10: kernel/time.c needs to include linux/vmstat.h to compile
+  * uvesafb: fix section mismatch warnings
+  * CRIS v10: driver for ds1302 needs to include cris-specific i2c.h
+  * OSS msnd: fix array overflows
+  * i2c-omap: Fix NULL pointer dereferencing
+  * i2c: Spelling fixes
+  * i2c: Driver IDs are optional
+  * i2c-sibyte: Fix an error path
+  * fix the "remove task_ppid_nr_ns" commit
+  * [MIPS] Kconfig fixes for BCM47XX platform
+  * [MIPS] Cobalt: Fix ethernet interrupts for RaQ1
+  * [MIPS] Cobalt: Qube1 has no serial port so don't use it
+  * [MIPS] Cacheops.h: Fix typo.
+  * ata_piix: ignore ATA_DMA_ERR on vmware ich4
+  * sata_sil24: fix stupid typo
+  * sata_sil24: freeze on non-dev errors reported via CERR
+  * libata: relocate sdev->manage_start_stop configuration
+  * [POWERPC] Fix boot failure on POWER6
+  * x86: fix boot crash on HIGHMEM4G && SPARSEMEM
+  * x86: asm-x86/msr.h: pull in linux/types.h
+  * x86: fix RTC_AIE with CONFIG_HPET_EMULATE_RTC
+  * Fix ARM profiling/instrumentation configuration
+  * Fix Blackfin HARDWARE_PM support
+  * libata fixes for sparse-found problems
+  * [libata] pata_bf54x: checkpatch fixes
+  * [libata] core checkpatch fix
+  * libata: correct handling of TSS DVD
+  * [IA64] Fix unaligned handler for floating point instructions with base
+    update
+  * Linux 2.6.24-rc8
+  * lockdep: fix internal double unlock during self-test
+  * lockdep: fix workqueue creation API lockdep interaction
+  * lockdep: more hardirq annotations for notify_die()
+  * hostap: section mismatch warning
+  * wireless/libertas support for 88w8385 sdio older revision
+  * ipw2200: fix typo in kerneldoc
+  * b43: fix use-after-free rfkill bug
+  * rt2x00: Fix ieee80211 payload alignment
+  * sysfs: make sysfs_lookup() return ERR_PTR(-ENOENT) on failed lookup
+  * sysfs: fix bugs in sysfs_rename/move_dir()
+  * Use access mode instead of open flags to determine needed permissions
+    (CVE-2008-0001)
+  * IB/ipath: Fix receiving UD messages with immediate data
+  * [NET]: Fix TX timeout regression in Intel drivers.
+  * [NIU]: Fix 1G PHY link state handling.
+  * [SPARC64]: Fix hypervisor TLB operation error reporting.
+  * Input: mousedev - handle mice that use absolute coordinates
+  * Input: usbtouchscreen - fix buffer overflow, make more egalax work
+  * Input: psmouse - fix potential memory leak in psmouse_connect()
+  * Input: psmouse - fix input_dev leak in lifebook driver
+  * Input: ALPS - fix sync loss on Acer Aspire 5720ZG
+  * ipg: balance locking in irq handler
+  * ipg: plug Tx completion leak
+  * ipg: fix queue stop condition in the xmit handler
+  * ipg: fix Tx completion irq request
+  * cpufreq: Initialise default governor before use
+  * hfs: fix coverity-found null deref
+  * pnpacpi: print resource shortage message only once (more)
+  * CRIS v10: vmlinux.lds.S: ix kernel oops on boot and use common defines
+  * mm: fix section mismatch warning in page_alloc.c
+  * jbd: do not try lock_acquire after handle made invalid
+  * alpha: fix conversion from denormal float to double
+  * #ifdef very expensive debug check in page fault path
+  * Fix unbalanced helper_lock in kernel/kmod.c
+  * fix wrong sized spinlock flags argument
+  * bonding: fix locking in sysfs primary/active selection
+  * bonding: fix ASSERT_RTNL that produces spurious warnings
+  * bonding: fix locking during alb failover and slave removal
+  * bonding: release slaves when master removed via sysfs
+  * bonding: Fix up parameter parsing
+  * bonding: fix lock ordering for rtnl and bonding_rwsem
+  * bonding: Don't hold lock when calling rtnl_unlock
+  * Documentation: add a guideline for hard_start_xmit method
+  * atl1: fix frame length bug
+  * S2io: Fixed synchronization between scheduling of napi with card reset
+    and close
+  * dscc4 endian fixes
+  * wan/lmc bitfields fixes
+  * sbni endian fixes
+  * 3c574, 3c515 bitfields abuse
+  * dl2k: BMCR_t fixes
+  * dl2k: ANAR, ANLPAR fixes
+  * dl2k: BMSR fixes
+  * dl2k: MSCR, MSSR, ESR, PHY_SCR fixes
+  * dl2k: the rest
+  * Replace cpmac fix
+  * [WATCHDOG] Revert "Stop looking for device as soon as one is found"
+  * [WATCHDOG] clarify watchdog operation in documentation
+  * x86: add support for the latest Intel processors to Oprofile
+  * Selecting LGUEST should turn on Guest support, as in 2.6.23.
+  * ARM: OMAP1: Keymap fix for f-sample and p2-sample
+  * ARM: OMAP1: Fix compile for board-nokia770
+  * pata_pdc202xx_old: Fix crashes with ATAPI
+  * arch: Ignore arch/i386 and arch/x86_64
+  * Remove bogus duplicate CONFIG_LGUEST_GUEST entry.
+  * [ARM] pxa: don't rely on r2 being preserved over a function call
+  * [ARM] 4748/1: dca: source drivers/dca/Kconfig in arch/arm/Kconfig to
+    fix warning
+  * rfkill: call rfkill_led_trigger_unregister() on error
+  * [IPV6]: Mischecked tw match in __inet6_check_established.
+  * [IPV4] fib_hash: fix duplicated route issue
+  * [IPV4] fib_trie: fix duplicated route issue
+  * [NET]: Fix interrupt semaphore corruption in Intel drivers.
+  * [IPV4] FIB_HASH : Avoid unecessary loop in fn_hash_dump_zone()
+  * [IPV6] ROUTE: Make sending algorithm more friendly with RFC 4861.
+  * [NETFILTER]: bridge-netfilter: fix net_device refcnt leaks
+  * [NEIGH]: Revert 'Fix race between neigh_parms_release and
+    neightbl_fill_parms'
+  * [IrDA]: af_irda memory leak fixes
+  * [ATM] atm/idt77105.c: Fix section mismatch.
+  * [ATM] atm/suni.c: Fix section mismatch.
+  * [AF_KEY]: Fix skb leak on pfkey_send_migrate() error
+  * [NET]: rtnl_link: fix use-after-free
+  * [IPV6]: ICMP6_MIB_OUTMSGS increment duplicated
+  * [IPV6]: RFC 2011 compatibility broken
+  * [ICMP]: ICMP_MIB_OUTMSGS increment duplicated
+  * selinux: fix memory leak in netlabel code
+  * [MIPS] SMTC: Fix build error.
+  * [MIPS] Malta: Fix reading the PCI clock frequency on big-endian
+  * tc35815: Use irq number for tc35815-mac platform device id
+  * keyspan: fix oops
+  * hrtimer: fix section mismatch
+  * timer: fix section mismatch
+  * CRIS: add missed local_irq_restore call
+  * s3c2410_fb: fix line length calculation
+  * Fix filesystem capability support
+  * sched: group scheduler, set uid share fix
+  * hwmon: (it87) request only Environment Controller ports
+  * W1: w1_therm.c ds18b20 decode freezing temperatures correctly
+  * W1: w1_therm.c is flagging 0C etc as invalid
+  * rcu: fix section mismatch
+  * Fix file references in documentation and Kconfig
+  * x86: GEODE fix a race condition in the MFGPT timer tick
+  * virtnet: remove double ether_setup
+  * virtio:simplify-config-mechanism
+  * virtio: An entropy device, as suggested by hpa.
+  * virtio: Export vring functions for modules to use
+  * virtio: Put the virtio under the virtualization menu
+  * virtio:pci-device
+  * Fix vring_init/vring_size to take unsigned long
+  * virtio:vring-kick-when-empty
+  * virtio:explicit-callback-disable
+  * virtio:net-flush-queue-on-init
+  * virtio:net-fix-xmit-skb-free-real
+  * Parametrize the napi_weight for virtio receive queue.
+  * Handle module unload Add the device release function.
+  * Update all status fields on driver unload
+  * Make virtio modules GPL
+  * Make virtio_pci license be GPL2+
+  * Use Qumranet donated PCI vendor/device IDs
+  * virtio:more-interrupt-suppression
+  * Reboot Implemented
+  * lguest:reboot-fix
+  * introduce vcpu struct
+  * adapt lguest launcher to per-cpuness
+  * initialize vcpu
+  * per-cpu run guest
+  * make write() operation smp aware
+  * make hypercalls use the vcpu struct
+  * per-vcpu lguest timers
+  * per-vcpu interrupt processing.
+  * map_switcher_in_guest() per-vcpu
+  * make emulate_insn receive a vcpu struct.
+  * make registers per-vcpu
+  * replace lguest_arch with lg_cpu_arch.
+  * per-vcpu lguest task management
+  * makes special fields be per-vcpu
+  * make pending notifications per-vcpu
+  * per-vcpu lguest pgdir management
+
+ -- Tim Gardner <tim.gardner@canonical.com>  Thu, 17 Jan 2008 14:45:01 -0700
+
+linux (2.6.24-4.7) hardy; urgency=low
+
+  [Amit Kucheria]
+
+  * Poulsbo: Add SD8686 and 8688 WLAN drivers
+  * Poulsbo: Mass update of patches to be identical to those on moblin
+  * SAUCE: make fc transport removal of target configurable OriginalAuthor:
+    Michael Reed <mdr <at> sgi.com> OriginalLocation:
+    http://thread.gmane.org/gmane.linux.scsi/25318 Bug: 163075
+
+  [Fabio M. Di Nitto]
+
+  * Fix handling of gcc-4.1 for powerpc and ia64
+
+  [Tim Gardner]
+
+  * Re-engineered architecture specific linux-headers compiler version
+    dependencies.
+  * Doh! Changed header-depends to header_depends.
+
+ -- Tim Gardner <tim.gardner@canonical.com>  Fri, 11 Jan 2008 07:10:46 -0700
+
+linux (2.6.24-4.6) hardy; urgency=low
+
+  [Alessio Igor Bogani]
+
+  * Fix -rt build FTBS.
+
+  [Amit Kucheria]
+
+  * LPIACOMPAT: Update thermal patches to be inline with lpia flavour
+  * Poulsbo: Add USB Controller patch and corresponding config change
+
+  [Fabio M. Di Nitto]
+
+  * Enable aoe and nbd modules on hppa Ignore: yes
+  * Fix ia64 build by using gcc-4.1
+
+  [Tim Gardner]
+
+  * Enable JFFS2 LZO compression.
+    - LP: #178343
+  * Remove IS_G33 special handling.
+    - LP: #174367
+  * Enabled CONFIG_SECURITY_CAPABILITIES and
+    CONFIG_SECURITY_FILE_CAPABILITIES
+    - LP: #95089
+  * Enabled CONFIG_TASKSTATS and CONFIG_TASK_IO_ACCOUNTING
+  * Turned CONFIG_SECURITY_FILE_CAPABILITIES back off.
+  * Enabled CONFIG_B43LEGACY=m
+  * Enabled CONFIG_SCSI_QLOGIC_1280=m
+  * Enabled CONFIG_FUSION=y for virtual
+  * USB bluetooth device 0x0e5e:0x6622 floods errors to syslog
+    - LP: #152689
+  * Removed lpia from d-i.
+  * Added ia64 modules.
+  * Added hppa32/64 modules.
+
+  [Upstream Kernel Changes]
+
+  * DMI autoload dcdbas on all Dell systems.
+  * sched: fix gcc warnings
+  * leds: Fix leds_list_lock locking issues
+  * leds: Fix locomo LED driver oops
+  * x86: fix asm-x86/byteorder.h for userspace export
+  * x86: fix asm-x86/msr.h for user-space export
+  * fix lguest rmmod "bad pgd"
+  * slub: provide /proc/slabinfo
+  * [POWERPC] Fix build failure on Cell when CONFIG_SPU_FS=y
+  * slub: register slabinfo to procfs
+  * [SCSI] scsi_sysfs: restore prep_fn when ULD is removed
+  * Unify /proc/slabinfo configuration
+  * scsi: revert "[SCSI] Get rid of scsi_cmnd->done"
+  * restrict reading from /proc/<pid>/maps to those who share ->mm or can
+    ptrace pid
+  * Fix kernel/ptrace.c compile problem (missing "may_attach()")
+  * hwmon: (w83627ehf) Be more careful when changing VID input level
+  * NFS: Fix a possible Oops in fs/nfs/super.c
+  * NFSv4: Fix circular locking dependency in nfs4_kill_renewd
+  * NFS: add newline to kernel warning message in auth_gss code
+  * NFSv4: nfs4_open_confirm must not set the open_owner as confirmed on
+    error
+  * NFSv4: Fix open_to_lock_owner sequenceid allocation...
+  * IB/srp: Fix list corruption/oops on module reload
+  * Console is utf-8 by default
+  * [IA64] Update Altix BTE error return status patch
+  * [IA64] Update Altix nofault code
+  * [X25]: Add missing x25_neigh_put
+  * [XFRM]: Do not define km_migrate() if !CONFIG_XFRM_MIGRATE
+  * [CASSINI]: Fix endianness bug.
+  * [CASSINI]: Revert 'dont touch page_count'.
+  * [CASSINI]: Program parent Intel31154 bridge when necessary.
+  * [CASSINI]: Set skb->truesize properly on receive packets.
+  * [CASSINI]: Fix two obvious NAPI bugs.
+  * [CASSINI]: Bump driver version and release date.
+  * [INET]: Fix netdev renaming and inet address labels
+  * [CONNECTOR]: Return proper error code in cn_call_callback()
+  * [ISDN] i4l: 'NO CARRIER' message lost after ldisc flush
+  * [ISDN]: i4l: Fix DLE handling for i4l-audio
+  * fix: using joysticks in 32 bit applications on 64 bit systems
+  * hda_intel suspend latency: shorten codec read
+  * CPU hotplug: fix cpu_is_offline() on !CONFIG_HOTPLUG_CPU
+  * Linux 2.6.24-rc7
+  * PIE executable randomization (upstream cherry pick by kees)
+
+ -- Tim Gardner <tim.gardner@canonical.com>  Fri, 04 Jan 2008 07:15:47 -0700
+
+linux (2.6.24-3.5) hardy; urgency=low
+
+  [Alessio Igor Bogani]
+
+  * rt: Fix rt preempt patchset version
+  * Updated README file for binary custom flavours
+  * Fix -rt build FTBS.
+  * rt: Update configuration files
+
+  [Tim Gardner]
+
+  * SAUCE: Add extra headers to linux-libc-dev
+
+  [Upstream Kernel Changes]
+
+  * [WATCHDOG] at32ap700x_wdt: add support for boot status and add fix for
+    silicon errata
+  * [WATCHDOG] Stop looking for device as soon as one is found
+  * [WATCHDOG] bfin_wdt, remove SPIN_LOCK_UNLOCKED
+  * [WATCHDOG] Sbus: cpwatchdog, remove SPIN_LOCK_UNLOCKED
+  * [WATCHDOG] IT8212F watchdog driver
+  * ACPI: acpiphp: Remove dmesg spam on device remove
+  * [WATCHDOG] ipmi: add the standard watchdog timeout ioctls
+  * [WATCHDOG] add Nano 7240 driver
+  * ACPI: battery: fix ACPI battery technology reporting
+  * [ARM] 4667/1: CM-X270 fixes
+  * [ARM] 4690/1: PXA: fix CKEN corruption in PXA27x AC97 cold reset code
+  * [IPV6] XFRM: Fix auditing rt6i_flags; use RTF_xxx flags instead of
+    RTCF_xxx.
+  * [IPV4]: Swap the ifa allocation with the"ipv4_devconf_setall" call
+  * [IPv4] ESP: Discard dummy packets introduced in rfc4303
+  * [IPv6] ESP: Discard dummy packets introduced in rfc4303
+  * [UM]: Fix use of skb after netif_rx
+  * [XTENSA]: Fix use of skb after netif_rx
+  * [S390]: Fix use of skb after netif_rx
+  * [BNX2]: Add PHY_DIS_EARLY_DAC workaround.
+  * [BNX2]: Fix RX packet rot.
+  * [BNX2]: Update version to 1.6.9.
+  * [NET]: Fix wrong comments for unregister_net*
+  * [VLAN]: Fix potential race in vlan_cleanup_module vs
+    vlan_ioctl_handler.
+  * [IPSEC]: Fix potential dst leak in xfrm_lookup
+  * V4L/DVB (6485): ivtv: fix compile warning
+  * V4L/DVB (6540): em28xx: fix failing autodetection after the reboot
+  * V4L/DVB (6542): Fix S-video mode on tvp5150
+  * V4L/DVB (6579): Fix bug #8824: Correct support for Diseqc on tda10086
+  * V4L/DVB (6581): Fix: avoids negative vma usage count
+  * V4L/DVB (6601): V4L: videobuf-core locking fixes and comments
+  * V4L/DVB (6602): V4L: Convert videobuf drivers to videobuf_stop
+  * V4L/DVB (6615): V4L: Fix  VIDIOCGMBUF locking in saa7146
+  * V4L/DVB (6629): zl10353: fix default adc_clock and TRL nominal rate
+    calculation
+  * V4L/DVB (6666): saa7134-alsa: fix period handling
+  * V4L/DVB (6684): Complement va_start() with va_end() + style fixes
+  * V4L/DVB (6686): saa7134: fix composite over s-video input on the Tevion
+    MD 9717
+  * V4L/DVB (6690): saa7134: fix ignored interrupts
+  * V4L/DVB (6751): V4L: Memory leak!  Fix count in videobuf-vmalloc mmap
+  * V4L/DVB (6746): saa7134-dvb: fix tuning for WinTV HVR-1110
+  * V4L/DVB (6750): Fix in-kernel compilation for cxusb
+  * V4L/DVB (6733): DVB: Compile 3000MC-specific DIB code only for
+    CONFIG_DVB_DIB3000MC
+  * V4L/DVB (6794): Fix compilation when dib3000mc is compiled as a module
+  * NFS: Fix NFS mountpoint crossing...
+  * V4L/DVB (6796): ivtv/ section fix
+  * V4L/DVB (6797): bt8xx/ section fixes
+  * NFSv2/v3: Fix a memory leak when using -onolock
+  * V4L/DVB (6609): Re-adds lock safe videobuf_read_start
+  * i2c: Delete an outdated piece of documentation
+  * i2c-gpio: Initialize adapter class
+  * i2c: Add missing spaces in split log messages
+  * i2c/isp1301_omap: Build fix
+  * [SERIAL] sparc: Infrastructure to fix section mismatch bugs.
+  * NFS: Fix an Oops in NFS unmount
+  * sdhci: describe quirks
+  * sdhci: don't warn about sdhci 2.0 controllers
+  * sdhci: use PIO when DMA can't satisfy the request
+  * sdhci: support JMicron JMB38x chips
+  * mmc: remove unused 'mode' from the mmc_host structure
+  * IB/ehca: Return correct number of SGEs for SRQ
+  * IB/ehca: Serialize HCA-related hCalls if necessary
+  * ide-scsi: add ide_scsi_hex_dump() helper
+  * ide: add missing checks for control register existence
+  * ide: deprecate CONFIG_BLK_DEV_OFFBOARD
+  * ide: fix ide_scan_pcibus() error message
+  * ide: coding style fixes for drivers/ide/setup-pci.c
+  * ide: add /sys/bus/ide/devices/*/{model,firmware,serial} sysfs entries
+  * ide: DMA reporting and validity checking fixes (take 3)
+  * ide-cd: remove dead post_transform_command()
+  * pdc202xx_new: fix Promise TX4 support
+  * hpt366: fix HPT37x PIO mode timings (take 2)
+  * ide: remove dead code from __ide_dma_test_irq()
+  * ide: remove stale changelog from ide-disk.c
+  * ide: remove stale changelog from ide-probe.c
+  * ide: fix ->io_32bit race in set_io_32bit()
+  * MAINTAINERS: update the NFS CLIENT entry
+  * V4L/DVB (6803): buf-core.c locking fixes
+  * [SPARC64]: Fix two kernel linear mapping setup bugs.
+  * IB/ehca: Fix lock flag variable location, bump version number
+  * kbuild: re-enable Makefile generation in a new O=... directory
+  * V4L/DVB (6798): saa7134: enable LNA in analog mode for Hauppauge WinTV
+    HVR-1110
+  * V4L/DVB (6814): Makefile: always enter video/
+  * V4L/DVB (6819): i2c: fix drivers/media/video/bt866.c
+  * V4L/DVB (6820): s5h1409: QAM SNR related fixes
+  * ACPI: video_device_list corruption
+  * ACPI: fix modpost warnings
+  * ACPI: thinkpad-acpi: fix lenovo keymap for brightness
+  * Pull thinkpad-2.6.24 into release branch
+  * Pull battery-2.6.24 into release branch
+  * [POWERPC] Fix typo #ifdef -> #ifndef
+  * [POWERPC] Kill non-existent symbols from ksyms and commproc.h
+  * [POWRPC] CPM2: Eliminate section mismatch warning in cpm2_reset().
+  * [POWERPC] 82xx: mpc8272ads, pq2fads: Update defconfig with
+    CONFIG_FS_ENET_MDIO_FCC
+  * [POWERPC] iSeries: don't printk with HV spinlock held
+  * [POWERPC] Fix rounding bug in emulation for double float operating
+  * [POWERPC] Make PS3_SYS_MANAGER default y, not m
+  * [MIPS] time: Set up Cobalt's mips_hpt_frequency
+  * [MIPS] Alchemy: fix PCI resource conflict
+  * [MIPS] Alchemy: fix off by two error in __fixup_bigphys_addr()
+  * [MIPS] Atlas, Malta: Don't free firmware memory on free_initmem.
+  * [MIPS] PCI: Make pcibios_fixup_device_resources ignore legacy
+    resources.
+  * [MIPS] time: Delete weak definition of plat_time_init() due to gcc bug.
+  * [MIPS] Ensure that ST0_FR is never set on a 32 bit kernel
+  * [SPARC32]: Silence sparc32 warnings on missing syscalls.
+  * Pull hotplug into release branch
+  * ACPI: SBS: Reset alarm bit
+  * ACPI: SBS: Ignore alarms coming from unknown devices
+  * ACPI: SBS: Return rate in mW if capacity in mWh
+  * Pull bugzilla-9362 into release branch
+  * sky2: RX lockup fix
+  * sundance fixes
+  * starfire VLAN fix
+  * e100: free IRQ to remove warningwhenrebooting
+  * hamachi endianness fixes
+  * drivers/net/sis190.c section fix
+  * drivers/net/s2io.c section fixes
+  * ucc_geth: minor whitespace fix
+  * net: smc911x: shut up compiler warnings
+  * Net: ibm_newemac, remove SPIN_LOCK_UNLOCKED
+  * ixgb: make sure jumbos stay enabled after reset
+  * [NETFILTER]: ctnetlink: set expected bit for related conntracks
+  * [NETFILTER]: ip_tables: fix compat copy race
+  * [XFRM]: Display the audited SPI value in host byte order.
+  * [NETFILTER]: xt_hashlimit should use time_after_eq()
+  * [TIPC]: Fix semaphore handling.
+  * [SYNCPPP]: Endianness and 64bit fixes.
+  * [NETFILTER]: bridge: fix missing link layer headers on outgoing routed
+    packets
+  * [ATM]: Fix compiler warning noise with FORE200E driver
+  * [IPV4]: Updates to nfsroot documentation
+  * [BRIDGE]: Assign random address.
+  * [IPV6]: Fix the return value of ipv6_getsockopt
+  * [IPV4]: Make tcp_input_metrics() get minimum RTO via tcp_rto_min()
+  * [AX25]: Locking dependencies fix in ax25_disconnect().
+  * [SCTP]: Flush fragment queue when exiting partial delivery.
+  * [IRDA]: Race between open and disconnect in irda-usb.
+  * [IRDA]: mcs7780 needs to free allocated rx buffer.
+  * [IRDA]: irlmp_unregister_link() needs to free lsaps.
+  * [IRDA]: stir4200 fixes.
+  * [IRDA]: irda parameters warning fixes.
+  * [S390] pud_present/pmd_present bug.
+  * [ARM] 4710/1: Fix coprocessor 14 usage for debug messages via ICEDCC
+  * [ARM] 4694/1: IXP4xx: Update clockevent support for shutdown and resume
+  * kobject: fix the documentation of how kobject_set_name works
+  * tipar: remove obsolete module
+  * HOWTO: Change man-page maintainer address for Japanese HOWTO
+  * Add Documentation for FAIR_USER_SCHED sysfs files
+  * HOWTO: change addresses of maintainer and lxr url for Korean HOWTO
+  * add stable_api_nonsense.txt in korean
+  * HOWTO: update misspelling and word incorrected
+  * PCI: Restore PCI expansion ROM P2P prefetch window creation
+  * USB: sierra: fix product id
+  * usb-storage: Fix devices that cannot handle 32k transfers
+  * USB: cp2101: new device id
+  * USB: option: Bind to the correct interface of the Huawei E220
+  * usb.h: fix kernel-doc warning
+  * USB: fix locking loop by avoiding flush_scheduled_work
+  * USB: use IRQF_DISABLED for HCD interrupt handlers
+  * USB: at91_udc: correct hanging while disconnecting usb cable
+  * usb: Remove broken optimisation in OHCI IRQ handler
+  * USB: revert portions of "UNUSUAL_DEV: Sync up some reported devices
+    from Ubuntu"
+  * ocfs2: fix exit-while-locked bug in ocfs2_queue_orphans()
+  * ocfs2: Don't panic when truncating an empty extent
+  * ocfs2: Allow for debugging of transaction extends
+  * ocfs2: Re-journal buffers after transaction extend
+  * pcnet_cs: add new id
+  * ucc_geth: really fix section mismatch
+  * sis190 endianness
+  * libertas: add Dan Williams as maintainer
+  * zd1211rw: Fix alignment problems
+  * wireless/ipw2200.c: add __dev{init,exit} annotations
+  * ieee80211_rate: missed unlock
+  * iwlwifi3945/4965: fix rate control algo reference leak
+  * libertas: select WIRELESS_EXT
+  * bcm43xx_debugfs sscanf fix
+  * b43: Fix rfkill radio LED
+  * iwlwifi: fix rf_kill state inconsistent during suspend and resume
+  * sata_sil: fix spurious IRQ handling
+  * libata: clear link->eh_info.serror from ata_std_postreset()
+  * libata: add ST3160023AS / 3.42 to NCQ blacklist
+  * sata_mv: improve warnings about Highpoint RocketRAID 23xx cards
+  * libata-acpi: adjust constness in ata_acpi_gtm/stm() parameters
+  * libata: update ata_*_printk() macros such that level can be a variable
+  * libata: add more opcodes to ata.h
+  * libata: ata_dev_disable() should be called from EH context
+  * libata-acpi: add new hooks ata_acpi_dissociate() and
+    ata_acpi_on_disable()
+  * libata-acpi: implement and use ata_acpi_init_gtm()
+  * libata-acpi: implement dev->gtf_cache and evaluate _GTF right after
+    _STM during resume
+  * libata-acpi: improve ACPI disabling
+  * libata-acpi: improve _GTF execution error handling and reporting
+  * libata-acpi: implement _GTF command filtering
+  * libata: update atapi_eh_request_sense() such that lbam/lbah contains
+    buffer size
+  * libata: fix ATAPI draining
+  * fix headers_install
+  * revert "Hibernation: Use temporary page tables for kernel text mapping
+    on x86_64"
+  * uml: stop gdb from deleting breakpoints when running UML
+  * alpha: strncpy/strncat fixes
+  * rtc-at32ap700x: fix irq init oops
+  * parport: "dev->timeslice" is an unsigned long, not an int
+  * ecryptfs: initialize new auth_tokens before teardown
+  * Fix lguest documentation
+  * sparsemem: make SPARSEMEM_VMEMMAP selectable
+  * fs/Kconfig: grammar fix
+  * ext3, ext4: avoid divide by zero
+  * alpha: build fixes
+  * cpufreq: fix missing unlocks in cpufreq_add_dev error paths.
+  * mm/sparse.c: check the return value of sparse_index_alloc()
+  * mm/sparse.c: improve the error handling for sparse_add_one_section()
+  * pktcdvd: add kobject_put when kobject register fails
+  * drivers/macintosh/via-pmu.c: Added a missing iounmap
+  * drivers/cpufreq/cpufreq_stats.c section fix
+  * apm_event{,info}_t are userspace types
+  * mm: fix page allocation for larger I/O segments
+  * ecryptfs: set s_blocksize from lower fs in sb
+  * I/OAT: fixups from code comments
+  * I/OAT: fix null device in call to dev_err()
+  * fix bloat-o-meter for ppc64
+  * ecryptfs: fix fsx data corruption problems
+  * Documentation: update hugetlb information
+  * Fix compilation warning in dquot.c
+  * SLUB: remove useless masking of GFP_ZERO
+  * quicklist: Set tlb->need_flush if pages are remaining in quicklist 0
+  * sysctl: fix ax25 checks
+  * [XFS] Don't wait for pending I/Os when purging blocks beyond eof.
+  * [XFS] Put the correct offset in dirent d_off
+  * block: use jiffies conversion functions in scsi_ioctl.c
+  * as-iosched: fix incorrect comments
+  * as-iosched: fix write batch start point
+  * block: let elv_register() return void
+  * Cleanup umem driver: fix most checkpatch warnings, conform to kernel
+  * sched: fix crash on ia64, introduce task_current()
+  * sched: mark rwsem functions as __sched for wchan/profiling
+  * sched: sysctl, proc_dointvec_minmax() expects int values for
+  * sched: touch softlockup watchdog after idling
+  * sched: do not hurt SCHED_BATCH on wakeup
+  * oprofile: op_model_athlon.c support for AMD family 10h barcelona
+    performance counters
+  * clockevents: fix reprogramming decision in oneshot broadcast
+  * genirq: add unlocked version of set_irq_handler()
+  * timer: kernel/timer.c section fixes
+  * x86: jprobe bugfix
+  * x86: kprobes bugfix
+  * x86: also define AT_VECTOR_SIZE_ARCH
+  * genirq: revert lazy irq disable for simple irqs
+  * x86: fix "Kernel panic - not syncing: IO-APIC + timer doesn't work!"
+  * [SCSI] sym53c8xx: fix free_irq() regression
+  * [SCSI] dpt_i2o: driver is only 32 bit so don't set 64 bit DMA mask
+  * [SCSI] sym53c8xx: fix "irq X: nobody cared" regression
+  * [SCSI] initio: fix conflict when loading driver
+  * [SCSI] st: fix kernel BUG at include/linux/scatterlist.h:59!
+  * [SCSI] initio: bugfix for accessors patch
+  * IA64: Slim down __clear_bit_unlock
+  * [IA64] signal: remove redundant code in setup_sigcontext()
+  * [IA64] ia32 nopage
+  * [IA64] Avoid unnecessary TLB flushes when allocating memory
+  * [IA64] Two trivial spelling fixes
+  * [IA64] print kernel release in OOPS to make kerneloops.org happy
+  * [IA64] set_thread_area fails in IA32 chroot
+  * [IA64] Remove compiler warinings about uninitialized variable in
+    irq_ia64.c
+  * [IA64] Remove assembler warnings on head.S
+  * [IA64] Fix Altix BTE error return status
+  * [IA64] Guard elfcorehdr_addr with #if CONFIG_PROC_FS
+  * [IA64] make flush_tlb_kernel_range() an inline function
+  * [IA64] Adjust CMCI mask on CPU hotplug
+  * Do dirty page accounting when removing a page from the page cache
+  * x86 apic_32.c section fix
+  * x86 smpboot_32.c section fixes
+  * x86_32: select_idle_routine() must be __cpuinit
+  * x86_32: disable_pse must be __cpuinitdata
+  * x86: fix show cpuinfo cpu number always zero
+  * ps3fb: Update for firmware 2.10
+  * ps3fb: Fix ps3fb free_irq() dev_id
+  * pata_hpt37x: Fix HPT374 detection
+  * mac80211: Drop out of associated state if link is lost
+  * mac80211: fix header ops
+  * NET: mac80211: fix inappropriate memory freeing
+  * [TG3]: Endianness annotations.
+  * [TG3]: Endianness bugfix.
+  * rtl8187: Add USB ID for Sitecom WL-168 v1 001
+  * p54: add Kconfig description
+  * iwlwifi: fix possible priv->mutex deadlock during suspend
+  * ipw2200: prevent alloc of unspecified size on stack
+  * [IPV4] ARP: Remove not used code
+  * [IPSEC]: Avoid undefined shift operation when testing algorithm ID
+  * [XFRM]: Audit function arguments misordered
+  * [IPV4] ip_gre: set mac_header correctly in receive path
+  * [NET]: Correct two mistaken skb_reset_mac_header() conversions.
+  * [SPARC64]: Fix OOPS in dma_sync_*_for_device()
+  * sched: rt: account the cpu time during the tick
+  * debug: add end-of-oops marker
+  * mm: fix exit_mmap BUG() on a.out binary exit
+  * dm: table detect io beyond device
+  * dm mpath: hp requires scsi
+  * dm crypt: fix write endio
+  * dm: trigger change uevent on rename
+  * dm: merge max_hw_sector
+  * dm crypt: use bio_add_page
+  * [SPARC64]: Spelling fixes
+  * [SPARC32]: Spelling fixes
+  * [NET] include/net/: Spelling fixes
+  * [DCCP]: Spelling fixes
+  * [IRDA]: Spelling fixes
+  * [IPV6]: Spelling fixes
+  * [NET] net/core/: Spelling fixes
+  * [PKT_SCHED]: Spelling fixes
+  * [NETLABEL]: Spelling fixes
+  * [SCTP]: Spelling fixes
+  * [NETFILTER]: Spelling fixes
+  * [NETFILTER] ipv4: Spelling fixes
+  * [ATM]: Spelling fixes
+  * [NET]: Fix function put_cmsg() which may cause usr application memory
+    overflow
+  * x86: fix die() to not be preemptible
+  * x86: intel_cacheinfo.c: cpu cache info entry for Intel Tolapai
+  * [XFS] Fix mknod regression
+  * [XFS] Initialise current offset in xfs_file_readdir correctly
+  * Linux 2.6.24-rc6
+  * [IPV4]: OOPS with NETLINK_FIB_LOOKUP netlink socket
+  * SLUB: Improve hackbench speed
+  * typhoon: endianness bug in tx/rx byte counters
+  * typhoon: missing le32_to_cpu() in get_drvinfo
+  * typhoon: set_settings broken on big-endian
+  * typhoon: missed rx overruns on big-endian
+  * typhoon: memory corruptor on big-endian if TSO is enabled
+  * typhoon: trivial endianness annotations
+  * cycx: annotations and fixes (.24 fodder?)
+  * asix fixes
+  * yellowfin: annotations and fixes (.24 fodder?)
+  * dl2k endianness fixes (.24 fodder?)
+  * r8169 endianness
+  * rrunner: use offsetof() instead of homegrown insanity
+  * 3c574 and 3c589 endianness fixes (.24?)
+  * fec_mpc52xx: write in C...
+  * 3c359 endianness annotations and fixes
+  * MACB: clear transmit buffers properly on transmit underrun
+  * UIO: Add a MAINTAINERS entry for Userspace I/O
+  * Modules: fix memory leak of module names
+  * USB: Unbreak fsl_usb2_udc
+  * USB: VID/PID update for sierra
+  * USB: New device ID for the CP2101 driver
+  * quicklists: do not release off node pages early
+  * ecryptfs: fix string overflow on long cipher names
+  * Fix computation of SKB size for quota messages
+  * Don't send quota messages repeatedly when hardlimit reached
+  * ecryptfs: fix unlocking in error paths
+  * ecryptfs: redo dget,mntget on dentry_open failure
+  * MAINTAINERS: mailing list archives are web links
+  * ps3: vuart: fix error path locking
+  * lib: proportion: fix underflow in prop_norm_percpu()
+  * pcmcia: remove pxa2xx_lubbock build warning
+  * kconfig: obey KCONFIG_ALLCONFIG choices with randconfig.
+  * tty: fix logic change introduced by wait_event_interruptible_timeout()
+  * uml: user of helper_wait() got missed when it got extra arguments
+  * V4L/DVB (6871): Kconfig: VIDEO_CX23885 must select DVB_LGDT330X
+  * V4L/DVB (6876): ivtv: mspx4xx needs a longer i2c udelay
+  * drivers/ide/: Spelling fixes
+  * ide-cd: fix SAMSUNG CD-ROM SCR-3231 quirk
+  * ide-cd: fix ACER/AOpen 24X CDROM speed reporting on big-endian machines
+  * ide-cd: use ide_cd_release() in ide_cd_probe()
+  * ide-cd: fix error messages in cdrom_{read,write}_check_ireason()
+  * ide-cd: add missing 'ireason' masking to cdrom_write_intr()
+  * ide-cd: fix error messages in cdrom_write_intr()
+  * ide-cd: add error message for DMA error to cdrom_read_intr()
+  * ide-cd: fix error message in cdrom_pc_intr()
+  * ide-cd: fix 'ireason' reporting in cdrom_pc_intr()
+  * MAINTAINERS: update ide-cd entry
+  * [SPARC64]: Implement pci_resource_to_user()
+  * mac80211: round station cleanup timer
+  * mac80211: warn when receiving frames with unaligned data
+  * [NETFILTER]: nf_conntrack_ipv4: fix module parameter compatibility
+  * [TUNTAP]: Fix wrong debug message.
+  * [NET] tc_nat: header install
+  * [VETH]: move veth.h to include/linux
+  * [IPV4]: Fix ip command line processing.
+  * Revert quicklist need->flush fix
+  * [CRYPTO] padlock: Fix spurious ECB page fault
+  * [POWERPC] Oprofile: Remove dependency on spufs module
+  * [POWERPC] PS3: Fix printing of os-area magic numbers
+  * [PCI] Do not enable CRS Software Visibility by default
+  * [IPV4] Fix ip=dhcp regression
+  * [SERIAL]: Fix section mismatches in Sun serial console drivers.
+  * [TCP]: use non-delayed ACK for congestion control RTT
+  * [BLUETOOTH]: put_device before device_del fix
+
+ -- Tim Gardner <tim.gardner@canonical.com>  Sat, 22 Dec 2007 15:16:11 -0700
+
+linux (2.6.24-2.4) hardy; urgency=low
+
+  [Alessio Igor Bogani]
+
+  * rt: First import for Hardy
+
+  [Amit Kucheria]
+
+  * LPIA: Fix FTBFS for hda
+  * LPIA: Trim configs including disabling stock DRM
+
+  [Tim Gardner]
+
+  * SAUCE: Increase CONFIG_IDE_MAX_HWIFS to 8 (from 4)
+    - LP: #157909
+    Then reverted since it causes an ABI bump. Will pick it up
+    again when next the ABI changes.
+  * Expose apm for applications.
+
+ -- Tim Gardner <tim.gardner@canonical.com>  Wed, 19 Dec 2007 13:17:31 -0700
+
+linux (2.6.24-2.3) hardy; urgency=low
+
+  [Amit Kucheria]
+
+  * LPIA: Add thermal framework from Intel
+  * LPIA: Poulsbo-specific patches
+  * LPIA: Add thermal framework from Intel
+
+  [Tim Gardner]
+
+  * SAUCE: hdaps module does not load on Thinkpad T61P
+    - LP: #133636
+
+  [Upstream Kernel Changes]
+
+  * Rebased against 2.6.24-rc5
+
+ -- Tim Gardner <tim.gardner@canonical.com>  Wed, 12 Dec 2007 13:58:52 -0700
+
+linux (2.6.24-1.2) hardy; urgency=low
+
+  [Ben Collins]
+
+  * cell: Remove cell custom flavour, merged upstream
+  * apparmor: Added module from SVN repo
+  * ubuntu: Update configs to enable apparmor
+  * ubuntu/configs: Disable vga type framebuffers on hppa32. Fixes FTBFS
+
+  [Tim Gardner]
+
+  * Add support for PPA builds.
+
+  [Upstream Kernel Changes]
+
+  * [SPARC64] Export symbols for sunvnet and sunvdc to be built modular
+
+ -- Ben Collins <bcollins@ubuntu.com>  Fri, 07 Dec 2007 15:18:32 -0500
+
+linux (2.6.24-1.1) hardy; urgency=low
+
+  [Ben Collins]
+
+  * ubuntu: Disable custom binary flavours for now
+  * ubuntu: Remove cruft in headers-postinst
+  * ubuntu: Set skipabi/skipmodule to true if prev_revions == 0.0
+  * ubuntu: Do not fail on missing module lists when skipmodule is set
+  * ubuntu: capability.ko is built-in now, no need to place in initrd.
+  * ubuntu: Change to "linux" instead of "linux-source-2.6.x"
+  * d-i: cdrom-modules disappeared, and sha256/aes modules renamed.
+  * ubuntu-build: Add asm_link= to arch rules, and use them
+  * config: Re-enable snd-hda-intel
+
+ -- Ben Collins <bcollins@ubuntu.com>  Wed, 28 Nov 2007 12:58:37 -0500
+
+linux-source-2.6.22 (2.6.22-14.46) gutsy; urgency=low
+
+  [Upstream Kernel Changes]
+
+  * [SPARC64]: Fix bugs in SYSV IPC handling in 64-bit processes.
+
+ -- Kyle McMartin <kyle@ubuntu.com>  Sun, 14 Oct 2007 20:30:09 +0000
+
+linux-source-2.6.22 (2.6.22-14.45) gutsy; urgency=low
+
+  [Upstream Kernel Changes]
+
+  * [SPARC64]: Fix register usage in xor_raid_4().
+
+ -- Kyle McMartin <kyle@ubuntu.com>  Sun, 14 Oct 2007 12:34:44 -0400
+
+linux-source-2.6.22 (2.6.22-14.44) gutsy; urgency=low
+
+  [Kyle McMartin]
+
+  * Revert "sparc wants ehci built in"
+
+  [Upstream Kernel Changes]
+
+  * Revert "[PATCH]: Gutsy OHCI hang workaround for Huron"
+  * [USB]: Serialize EHCI CF initialization.
+
+ -- Kyle McMartin <kyle@ubuntu.com>  Sun, 14 Oct 2007 16:25:51 +0000
+
+linux-source-2.6.22 (2.6.22-14.43) gutsy; urgency=low
+
+  [Kyle McMartin]
+
+  * sparc wants ehci built in
+
+ -- Kyle McMartin <kyle@ubuntu.com>  Tue, 09 Oct 2007 20:07:58 +0000
+
+linux-source-2.6.22 (2.6.22-14.42) gutsy; urgency=low
+
+  [Kyle McMartin]
+
+  * fix up module-check to bail early if asked to ignore modules
+  * disable kernel DRM on lpia (we provide one in lum)
+    - LP: #145168
+  * add ignore for ia64 abi too
+
+  [Upstream Kernel Changes]
+
+  * [NIU]: Use netif_msg_*().
+  * [NIU]: Use pr_info().
+  * [NIU]: Remove redundant BUILD_BUG_ON() in __niu_wait_bits_clear().
+  * [NIU]: Remove BUG_ON() NULL pointer checks.
+  * [NIU]: Use dev_err().
+  * [NIU]: Fix x86_64 build failure.
+  * [NIU]: Use linux/io.h instead of asm/io.h
+  * [NIU]: Fix some checkpatch caught coding style issues.
+  * [NIU]: Fix shadowed local variables.
+  * [NIU]: Fix locking errors in link_status_10g().
+  * [NIU]: Document a few magic constants using comments.
+  * [NIU]: MII phy handling fixes.
+  * [NIU]: Make sure link_up status is set to something in
+    link_status_{1,10}g().
+  * [PATCH]: Gutsy OHCI hang workaround for Huron
+
+ -- Kyle McMartin <kyle@ubuntu.com>  Tue, 09 Oct 2007 17:25:06 +0000
+
+linux-source-2.6.22 (2.6.22-14.41) gutsy; urgency=low
+
+  [Ben Collins]
+
+  * ubuntu/d-i: Add niu to nic-modules
+
+  [Kyle McMartin]
+
+  * vesafb is not for ia64
+  * remove CONFIG_NIU from places it shouldn't be
+  * fix orinoco_cs oops
+    - LP: #149997
+
+  [Upstream Kernel Changes]
+
+  * [SPARC64]: Allow userspace to get at the machine description.
+  * [SPARC64]: Niagara-2 optimized copies.
+  * [SPARC64]: Do not touch %tick_cmpr on sun4v cpus.
+  * [SPARC64]: SMP trampoline needs to avoid %tick_cmpr on sun4v too.
+  * [SPARC64]: Create a HWCAP_SPARC_N2 and report it to userspace on
+    Niagara-2.
+  * [MATH-EMU]: Fix underflow exception reporting.
+  * [SPARC64]: Need to clobber global reg vars in switch_to().
+  * [MATH]: Fix typo in FP_TRAPPING_EXCEPTIONS default setting.
+  * [SUNVDC]: Use slice 0xff on VD_DISK_TYPE_DISK.
+  * [SPARC64]: Fix type and constant sizes wrt. sun4u IMAP/ICLR handling.
+  * [SPARC64]: Enable MSI on sun4u Fire PCI-E controllers.
+  * [SPARC64]: Fix several bugs in MSI handling.
+  * [SPARC64]: Fix booting on V100 systems.
+  * [SPARC64]: Fix lockdep, particularly on SMP.
+  * [SPARC64]: Warn user if cpu is ignored.
+  * [SUNSAB]: Fix several bugs.
+  * [SUNSAB]: Fix broken SYSRQ.
+  * [SPARC64]: Fix missing load-twin usage in Niagara-1 memcpy.
+  * [SPARC64]: Don't use in/local regs for ldx/stx data in N1 memcpy.
+  * [SPARC64]: Fix domain-services port probing.
+  * [SPARC64]: VIO device addition log message level is too high.
+  * [SPARC64]: check fork_idle() error
+  * [SPARC64]: Fix 'niu' complex IRQ probing.
+  * [NIU]: Add Sun Neptune ethernet driver.
+
+ -- Kyle McMartin <kyle@ubuntu.com>  Tue, 09 Oct 2007 00:38:16 +0000
+
+linux-source-2.6.22 (2.6.22-13.40) gutsy; urgency=low
+
+  [Amit Kucheria]
+
+  * Enable CONFIG_VM86 for LPIA
+    - LP: #146311
+  * Update configuration files
+  * Disable MSI by default
+  * Add mmconf documentation
+  * Update configuration files
+
+  [Bartlomiej Zolnierkiewicz]
+
+  * ide-disk: workaround for buggy HPA support on ST340823A (take 3)
+    - LP: #26119
+
+  [Ben Collins]
+
+  * ubuntu/cell: Fixup ps3 related modules for d-i, enable RTAS console
+  * ubuntu/cell: Enable CELLEB and related modules (pata_scc)
+  * ubuntu/cell: Move ps3rom to storage-core. Also use spidernet, not
+    spider_net.
+  * ubuntu/cell: Set PS3_MANAGER=y
+  * ubuntu: Set NR_CPUS=256 for sparc64-smp
+
+  [Chuck Short]
+
+  * [USB] USB] Support for MediaTek MT6227 in cdc-acm.
+    - LP: #134123
+  * [XEN] Fix xen vif create with more than 14 guests.
+    - LP: #14486
+
+  [Jorge Juan Chico]
+
+  * ide: ST320413A has the same problem as ST340823A
+    - LP: #26119
+
+  [Kyle McMartin]
+
+  * fix -rt build
+  * fix ia32entry-xen.S for CVE-2007-4573
+  * fix build when CONFIG_PCI_MSI is not set
+
+  [Matthew Garrett]
+
+  * hostap: send events on data interface as well as master interface
+    - LP: #57146
+  * A malformed _GTF object should not prevent ATA device recovery
+    - LP: #139079
+  * hostap: send events on data interface as well as master interface
+    - LP: #57146
+  * A malformed _GTF object should not prevent ATA device recovery
+    - LP: #139079
+  * Don't lose appletouch button release events
+  * Fix build with appletouch change
+  * Disable Thinkpad backlight support on machines with ACPI video
+    - LP: #148055
+  * Don't attempt to register a callback if there is no CMOS object
+    - LP: #145857
+  * Update ACPI bay hotswap code to support locking
+    - LP: #148219
+  * Update ACPI bay hotswap code to support locking
+    - LP: #148219
+  * Don't attempt to register a callback if there is no CMOS object
+    - LP: #145857
+  * Disable Thinkpad backlight support on machines with ACPI video
+    - LP: #148055
+
+  [Steffen Klassert]
+
+  * 3c59x: fix duplex configuration
+    - LP: #94186
+
+  [Thomas Gleixner]
+
+  * clockevents: remove the suspend/resume workaround^Wthinko
+
+  [Tim Gardner]
+
+  * orinoco_cs.ko missing
+    - LP: #125832
+  * Marvell Technology ethernet card not recognized and not operational
+    - LP: #135316
+  * Marvell Technology ethernet card not recognized and not operational
+    - LP: #135316
+  * acpi_scan_rsdp() breaks some PCs by not honouring ACPI specification
+    - LP: #144336
+  * VIA southbridge Intel id missing
+    - LP: #128289
+  * Add T-Sinus 111card to hostap_cs driver to be able to upload firmware
+    - LP: #132466
+  * RTL8111 PCI Express Gigabit driver r8169 big files produce slow file
+    transfer
+    - LP: #114171
+  * Guest OS does not recognize a lun with non zero target id on Vmware ESX
+    Server
+    - LP: #140761
+  * Modualrize vesafb
+    - LP: #139505
+  * Nikon cameras need support in unusual_devs.h
+    - LP: #134477
+  * agp for i830m broken in gutsy
+    - LP: #139767
+  * hdaps: Added support for Thinkpad T61
+    - LP: #147383
+  * xen: Update config for i386
+    - LP: #139047
+  * xen: resync for amd64
+    - LP: #139047
+  * ide-disk: workaround for buggy HPA support on ST340823A (take 4)
+    - LP: #26119
+
+  [Upstream Kernel Changes]
+
+  * Convert snd-page-alloc proc file to use seq_file (CVE-2007-4571)
+  * Linux 2.6.22.8
+  * ACPI: disable lower idle C-states across suspend/resume
+  * V4L: ivtv: fix VIDIOC_S_FBUF: new OSD values were never set
+  * DVB: get_dvb_firmware: update script for new location of sp8870
+    firmware
+  * DVB: get_dvb_firmware: update script for new location of tda10046
+    firmware
+  * DVB: b2c2-flexcop: fix Airstar HD5000 tuning regression
+  * setpgid(child) fails if the child was forked by sub-thread
+  * sigqueue_free: fix the race with collect_signal()
+  * kconfig: oldconfig shall not set symbols if it does not need to
+  * MTD: Makefile fix for mtdsuper
+  * USB: fix linked list insertion bugfix for usb core
+  * ACPI: Validate XSDT, use RSDT if XSDT fails
+  * POWERPC: Flush registers to proper task context
+  * 3w-9xxx: Fix dma mask setting
+  * MTD: Initialise s_flags in get_sb_mtd_aux()
+  * JFFS2: fix write deadlock regression
+  * V4L: cx88: Avoid a NULL pointer dereference during mpeg_open()
+  * hwmon: End of I/O region off-by-one
+  * Fix debug regression in video/pwc
+  * splice: fix direct splice error handling
+  * rpc: fix garbage in printk in svc_tcp_accept()
+  * disable sys_timerfd()
+  * afs: mntput called before dput
+  * Fix DAC960 driver on machines which don't support 64-bit DMA
+  * Fix "Fix DAC960 driver on machines which don't support 64-bit DMA"
+  * firewire: fw-ohci: ignore failure of pci_set_power_state (fix suspend
+    regression)
+  * futex_compat: fix list traversal bugs
+  * Leases can be hidden by flocks
+  * ext34: ensure do_split leaves enough free space in both blocks
+  * nfs: fix oops re sysctls and V4 support
+  * dir_index: error out instead of BUG on corrupt dx dirs
+  * ieee1394: ohci1394: fix initialization if built non-modular
+  * Correctly close old nfsd/lockd sockets.
+  * Fix race with shared tag queue maps
+  * crypto: blkcipher_get_spot() handling of buffer at end of page
+  * fix realtek phy id in forcedeth
+  * Fix decnet device address listing.
+  * Fix device address listing for ipv4.
+  * Fix inet_diag OOPS.
+  * Fix IPV6 append OOPS.
+  * Fix IPSEC AH4 options handling
+  * Fix ipv6 double-sock-release with MSG_CONFIRM
+  * Fix IPV6 DAD handling
+  * Fix ipv6 source address handling.
+  * Fix oops in vlan and bridging code
+  * Fix tc_ematch kbuild
+  * Handle snd_una in tcp_cwnd_down()
+  * Fix TCP DSACK cwnd handling
+  * Fix datagram recvmsg NULL iov handling regression.
+  * Fix pktgen src_mac handling.
+  * Fix sparc64 v100 platform booting.
+  * bcm43xx: Fix cancellation of work queue crashes
+  * Linux 2.6.22.9
+  * usb: serial/pl2303: support for BenQ Siemens Mobile Phone EF81
+  * pata_it821x: fix lost interrupt with atapi devices
+  * i915: make vbl interrupts work properly on i965g/gm hw.
+
+ -- Kyle McMartin <kyle@ubuntu.com>  Thu, 04 Oct 2007 13:57:53 +0000
+
+linux-source-2.6.22 (2.6.22-12.39) gutsy; urgency=low
+
+  [Ben Collins]
+
+  * ubuntu: Re-order deps so that binary-custom is done before
+    binary-udebs. Fixes ppc build
+
+  [Upstream Kernel Changes]
+
+  * x86_64: Zero extend all registers after ptrace in 32bit entry path.
+  * Linux 2.6.22.7
+
+ -- Ben Collins <bcollins@ubuntu.com>  Sun, 23 Sep 2007 11:05:32 -0400
+
+linux-source-2.6.22 (2.6.22-12.38) gutsy; urgency=low
+
+  [Kyle McMartin]
+
+  * add -12 abi files
+  * update getabis for new flavours
+
+ -- Kyle McMartin <kyle@ubuntu.com>  Fri, 21 Sep 2007 13:35:49 -0400
+
+linux-source-2.6.22 (2.6.22-12.37) gutsy; urgency=low
+
+  [Kyle McMartin]
+
+  * enable d-i for cell flavour
+  * ignore ABI check on all hppa flavours
+
+ -- Kyle McMartin <kyle@ubuntu.com>  Fri, 21 Sep 2007 11:28:34 -0400
+
+linux-source-2.6.22 (2.6.22-12.36) gutsy; urgency=low
+
+  [Ben Collins]
+
+  * ABI bump due to LED support being enabled.
+
+  [Kyle McMartin]
+
+  * fix memory leak in psparse.c
+    - Bug introduced in previous commit to acpi
+
+  [Upstream Kernel Changes]
+
+  * Ubuntu: Allocate acpi_devices structure rather than leaving it on the
+    stack.
+  * ipw2100: Fix `iwpriv set_power` error
+  * Fix ipw2200 set wrong power parameter causing firmware error
+  * [SCSI] Fix async scanning double-add problems
+    - LP: #110997
+
+ -- Ben Collins <bcollins@ubuntu.com>  Thu, 20 Sep 2007 11:34:52 -0400
+
+linux-source-2.6.22 (2.6.22-11.34) gutsy; urgency=low
+
+  [Alan Stern]
+
+  * USB: disable autosuspend by default for non-hubs
+    - LP: #85488
+
+  [Ben Collins]
+
+  * ubuntu: Enable LEDS_TRIGGERS and related options
+    - Needed for iwlwifi
+  * ubuntu: Add real ABI files for virtual flavour
+  * ubuntu: Re-enable missing CONFIG_SERPENT for hppa64
+    - Noticed by Lamont
+  * ubuntu: Add linux-headers postinst to handle hooks
+    - LP: #125816
+  * ubuntu: Add support for /etc/kernel/headers_postinst.d/ to
+    headers-postinst
+    - LP: #120049
+  * cell: Add binary-custom flavour "cell" to support ps3
+
+  [Mattia Dongili]
+
+  * sony-laptop: restore the last user requested brightness level on
+    resume.
+    - LP: #117331
+
+  [Tejun Heo]
+
+  * ata_piix: fix suspend/resume for some TOSHIBA laptops
+    - LP: #139045
+  * PCI: export __pci_reenable_device()
+    - needed for ata_piix change
+
+  [Tim Gardner]
+
+  * Enable Sierra Wireless MC8775 0x6813
+    - LP: #131167
+
+  [Zhang Rui]
+
+  * ACPI: work around duplicate name "VID" problem on T61
+    - Noted by mjg59
+
+ -- Ben Collins <bcollins@ubuntu.com>  Sun, 16 Sep 2007 22:31:47 -0400
+
+linux-source-2.6.22 (2.6.22-11.33) gutsy; urgency=low
+
+  [Alessio Igor Bogani]
+
+  * rt: Update to rt9
+  * rt: Update configuration files
+
+  [Ben Collins]
+
+  * ubuntu: Enable A100 driver
+    - LP: #138632
+  * libata: Default to hpa being overridden
+
+  [Chuck Short]
+
+  * [HDAPS] Add support for Thinkpad R61.
+  * [LIBATA] Add more hard drives to blacklist.
+  * [USB] Added support for Sprint Pantech PX-500.
+  * [XEN] No really enable amd64.
+  * [XEN] Fix amd64 yet again.
+
+  [Matthew Garrett]
+
+  * alter default behaviour of ACPI video module
+  * Add infrastructure for notification on ACPI method execution
+  * Get thinkpad_acpi to send notifications on CMOS updates
+  * Add support to libata-acpi for acpi-based bay hotplug
+
+  [Phillip Lougher]
+
+  * Add kernel flavour optimised for virtualised environments
+  * Change abi-check script to check for $flavour.ignore in previous abi
+  * Disable abi and module check for virtual flavour
+
+  [Richard Hughes]
+
+  * Refresh laptop lid status on resume
+
+  [Upstream Kernel Changes]
+
+  * [pata_marvell]: Add more identifiers
+
+ -- Ben Collins <bcollins@ubuntu.com>  Sun, 16 Sep 2007 22:13:08 -0400
+
+linux-source-2.6.22 (2.6.22-11.32) gutsy; urgency=low
+
+  [Amit Kucheria]
+
+  * Build system: Allow custom builds to comprise multiple patches
+  * Move UME to a Custom build and add first setup of thermal framework
+
+  [Ben Collins]
+
+  * ubuntu: Enable CONFIG_BLK_DEV_IO_TRACE
+  * bcm203x: Fix firmware loading
+    - LP: #85247
+  * ubuntu: mtd changes caused module renaming. Ignore
+  * rt: Do not patch top level Makefile for SUBLEVEL. Will always end up
+    breaking
+
+  [Chuck Short]
+
+  * [USB] Unusual Device support for Gold MP3 Player Energy
+    - LP: #125250
+  * [SIERRA] Adds support for Onda H600 ZTE MF330
+    - LP: #129433
+  * [HDAPS] Add Thinkpad T61P to whitelist.
+    - LP: #133636
+  * [USB] Add support for Toshiba (Novatel Wireless) HSDPA for M400.
+    - LP: #133650
+
+  [Kyle McMartin]
+
+  * apparmor 10.3 hooks
+  * unionfs 2.1 hooks
+  * nuke UNION_FS stuff from fs/{Kconfig,Makefile}
+
+  [Tim Gardner]
+
+  * Paravirt-ops I/O hypercalls
+  * Fix lazy vmalloc bug for Gutsy
+  * bluetooth headset patch
+    - LP: #130870
+  * Add the PCI ID of this ICH4 in list of laptops that use short cables.
+  * v2.6.22.5 merge
+  * Update Xen config options.
+    - LP: #132726
+  * Remove mtd modules from ABI
+  * Support parallel=<n> in DEB_BUILD_OPTIONS
+    - LP: #136426
+
+  [Upstream Kernel Changes]
+
+  * hwmon: fix w83781d temp sensor type setting
+  * hwmon: (smsc47m1) restore missing name attribute
+  * sky2: restore workarounds for lost interrupts
+  * sky2: carrier management
+  * sky2: check for more work before leaving NAPI
+  * sky2: check drop truncated packets
+  * revert "x86, serial: convert legacy COM ports to platform devices"
+  * ACPICA: Fixed possible corruption of global GPE list
+  * ACPICA: Clear reserved fields for incoming ACPI 1.0 FADTs
+  * AVR32: Fix atomic_add_unless() and atomic_sub_unless()
+  * r8169: avoid needless NAPI poll scheduling
+  * forcedeth: fix random hang in forcedeth driver when using netconsole
+  * libata: add ATI SB700 device IDs to AHCI driver
+  * Hibernation: do not try to mark invalid PFNs as nosave
+  * i386: allow debuggers to access the vsyscall page with compat vDSO
+  * x86_64: Check for .cfi_rel_offset in CFI probe
+  * x86_64: Change PMDS invocation to single macro
+  * i386: Handle P6s without performance counters in nmi watchdog
+  * i386: Fix double fault handler
+  * JFFS2 locking regression fix.
+  * [Input]: appletouch - improve powersaving for Geyser3 devices
+  * [Input]: add driver for Fujitsu serial touchscreens
+  * [sdhci]: add support to ENE-CB714
+  * v2.6.22.5
+  * [MTD] Makefile fix for mtdsuper
+  * ocfs2: Fix bad source start calculation during kernel writes
+  * NET: Share correct feature code between bridging and bonding
+  * sky2: don't clear phy power bits
+  * uml: fix previous request size limit fix
+  * i386: fix lazy mode vmalloc synchronization for paravirt
+  * signalfd: fix interaction with posix-timers
+  * signalfd: make it group-wide, fix posix-timers scheduling
+  * DCCP: Fix DCCP GFP_KERNEL allocation in atomic context
+  * IPV6: Fix kernel panic while send SCTP data with IP fragments
+  * IPv6: Invalid semicolon after if statement
+  * Fix soft-fp underflow handling.
+  * Netfilter: Missing Kbuild entry for netfilter
+  * SNAP: Fix SNAP protocol header accesses.
+  * NET: Fix missing rcu unlock in __sock_create()
+  * SPARC64: Fix sparc64 task stack traces.
+  * SPARC64: Fix sparc64 PCI config accesses on sun4u
+  * TCP: Do not autobind ports for TCP sockets
+  * TCP: Fix TCP rate-halving on bidirectional flows.
+  * TCP: Fix TCP handling of SACK in bidirectional flows.
+  * PPP: Fix PPP buffer sizing.
+  * PCI: lets kill the 'PCI hidden behind bridge' message
+  * PCI: disable MSI on RS690
+  * PCI: disable MSI on RD580
+  * PCI: disable MSI on RX790
+  * USB: allow retry on descriptor fetch errors
+  * USB: fix DoS in pwc USB video driver
+  * usb: add PRODUCT, TYPE to usb-interface events
+  * Linux 2.6.22.6
+  * V4L/DVB (6042): b2c2-flexcop: fix Airstar HD5000 tuning regression
+  * V4L/DVB (5967): ivtv: fix VIDIOC_S_FBUF:new OSD values where never set
+  * Re-add _GTM and _STM support
+
+ -- Ben Collins <bcollins@ubuntu.com>  Fri, 31 Aug 2007 16:26:56 -0400
+
+linux-source-2.6.22 (2.6.22-10.30) gutsy; urgency=low
+
+  * URGENT upload to fix FTBFS with xen-{i386,amd64} configs,
+    lpia d-i ftbfs, xen ftbfs.
+  * URGENT fix module-check to actually ignore things
+  * URGENT ignore ume modules
+
+  [Alek Du]
+
+  * Add Intel Poulsbo chipset Libata support
+
+  [Amit Kucheria]
+
+  * Update configuration files
+  * Enable stylus on Lenovo X60/X61 thinkpads
+
+  [Ben Collins]
+
+  * ubuntu: Disable snd-hda-intel, in favor of lum updated version
+
+  [Kyle McMartin]
+
+  * apparmor 10.3 hooks
+  * add lpia d-i udeb generation
+  * fix bits of rt/diff for -rt8
+  * fix rt/diff for 2.6.22.3 changes
+  * fix up rt/diff for stable 2.6.22.4
+
+  [LaMont Jones]
+
+  * Update configuration files
+
+  [Phillip Lougher]
+
+  * WriteSupportForNTFS: make fuse module available to d-i
+
+  [Tim Gardner]
+
+  * Gutsy Tribe 3 CD don't load on Dell Inspiron 1501
+    - LP: #121111
+  * Update configuration files
+  * Update configuration files
+  * Update configuration files
+
+  [Upstream Kernel Changes]
+
+  * [SPARC64]: Fix handling of multiple vdc-port nodes.
+  * [SPARC64]: Tweak assertions in sun4v_build_virq().
+  * [SPARC64]: Fix log message type in vio_create_one().
+  * [SPARC64]: Fix two year old bug in early bootup asm.
+  * [SPARC64]: Improve VIO device naming further.
+  * [SPARC64]: Handle multiple domain-services-port nodes properly.
+  * [SPARC64]: Add proper multicast support to VNET driver.
+  * [SPARC64]: Do not flood log with failed DS messages.
+  * [SPARC64]: Use KERN_ERR in IRQ manipulation error printks.
+  * [SPARC64]: Fix virq decomposition.
+  * [SPARC]: Fix serial console device detection.
+  * [SPARC64]: fix section mismatch warning in pci_sunv4
+  * [SPARC64]: fix section mismatch warning in mdesc.c
+  * [SPARC64] viohs: extern on function definition
+  * [SPARC64]: Fix sun4u PCI config space accesses on sun4u.
+  * [SPARC64]: Fix show_stack() when stack argument is NULL.
+  * [SUNLANCE]: Fix sparc32 crashes by using of_*() interfaces.
+  * [SPARC]: Centralize find_in_proplist() instead of duplicating N times.
+  * [SPARC64]: Fix hard-coding of cpu type output in /proc/cpuinfo on
+    sun4v.
+  * [SPARC64]: Do not assume sun4v chips have load-twin/store-init support.
+  * [SPARC64]: Fix memory leak when cpu hotplugging.
+  * USB: cdc-acm: fix sysfs attribute registration bug
+  * TCP FRTO retransmit bug fix
+  * Fix TC deadlock.
+  * Fix IPCOMP crashes.
+  * Fix console write locking in sparc drivers.
+  * Add a PCI ID for santa rosa's PATA controller.
+  * Missing header include in ipt_iprange.h
+  * SCTP scope_id handling fix
+  * Fix rfkill IRQ flags.
+  * gen estimator timer unload race
+  * gen estimator deadlock fix
+  * Fix error queue socket lookup in ipv6
+  * Fix ipv6 link down handling.
+  * Netpoll leak
+  * Sparc64 bootup assembler bug
+  * Fix ipv6 tunnel endianness bug.
+  * Fix sparc32 memset()
+  * Fix sparc32 udelay() rounding errors.
+  * Fix TCP IPV6 MD5 bug.
+  * KVM: SVM: Reliably detect if SVM was disabled by BIOS
+  * USB: fix warning caused by autosuspend counter going negative
+  * usb-serial: Fix edgeport regression on non-EPiC devices
+  * Fix reported task file values in sense data
+  * aacraid: fix security hole
+  * firewire: fw-sbp2: set correct maximum payload (fixes CardBus adapters)
+  * make timerfd return a u64 and fix the __put_user
+  * V4L: Add check for valid control ID to v4l2_ctrl_next
+  * V4L: ivtv: fix broken VBI output support
+  * V4L: ivtv: fix DMA timeout when capturing VBI + another stream
+  * V4L: ivtv: Add locking to ensure stream setup is atomic
+  * V4L: wm8775/wm8739: Fix memory leak when unloading module
+  * Input: lifebook - fix an oops on Panasonic CF-18
+  * splice: fix double page unlock
+  * drm/i915: Fix i965 secured batchbuffer usage (CVE-2007-3851)
+  * Fix leak on /proc/lockdep_stats
+  * CPU online file permission
+  * Fix user struct leakage with locked IPC shem segment
+  * md: handle writes to broken raid10 arrays gracefully
+  * md: raid10: fix use-after-free of bio
+  * pcmcia: give socket time to power down
+  * Fix leaks on /proc/{*/sched, sched_debug, timer_list, timer_stats}
+  * futex: pass nr_wake2 to futex_wake_op
+  * "ext4_ext_put_in_cache" uses __u32 to receive physical block number
+  * Include serial_reg.h with userspace headers
+  * dm io: fix panic on large request
+  * i386: HPET, check if the counter works
+  * fw-ohci: fix "scheduling while atomic"
+  * firewire: fix memory leak of fw_request instances
+  * softmac: Fix ESSID problem
+  * eCryptfs: ecryptfs_setattr() bugfix
+  * nfsd: fix possible read-ahead cache and export table corruption
+  * readahead: MIN_RA_PAGES/MAX_RA_PAGES macros
+  * fs: 9p/conv.c error path fix
+  * forcedeth bug fix: cicada phy
+  * forcedeth bug fix: vitesse phy
+  * forcedeth bug fix: realtek phy
+  * acpi-cpufreq: Proper ReadModifyWrite of PERF_CTL MSR
+  * jbd commit: fix transaction dropping
+  * jbd2 commit: fix transaction dropping
+  * hugetlb: fix race in alloc_fresh_huge_page()
+  * do not limit locked memory when RLIMIT_MEMLOCK is RLIM_INFINITY
+  * uml: limit request size on COWed devices
+  * sony-laptop: fix bug in event handling
+  * destroy_workqueue() can livelock
+  * drivers/video/macmodes.c:mac_find_mode() mustn't be __devinit
+  * cfq-iosched: fix async queue behaviour
+  * libata: add FUJITSU MHV2080BH to NCQ blacklist
+  * ieee1394: revert "sbp2: enforce 32bit DMA mapping"
+  * nfsd: fix possible oops on re-insertion of rpcsec_gss modules
+  * dm raid1: fix status
+  * dm io: fix another panic on large request
+  * dm snapshot: permit invalid activation
+  * dm: disable barriers
+  * cr_backlight_probe() allocates too little storage for struct cr_panel
+  * ACPI: dock: fix opps after dock driver fails to initialize
+  * Hangup TTY before releasing rfcomm_dev
+  * Keep rfcomm_dev on the list until it is freed
+  * nf_conntrack: don't track locally generated special ICMP error
+  * IPV6: /proc/net/anycast6 unbalanced inet6_dev refcnt
+  * sysfs: release mutex when kmalloc() failed in sysfs_open_file().
+  * Netfilter: Fix logging regression
+  * USB: fix for ftdi_sio quirk handling
+  * sx: switch subven and subid values
+  * UML: exports for hostfs
+  * Linux 2.6.22.2
+  * fix oops in __audit_signal_info()
+  * random: fix bound check ordering (CVE-2007-3105)
+  * softmac: Fix deadlock of wx_set_essid with assoc work
+  * ata_piix: update map 10b for ich8m
+  * PPC: Revert "[POWERPC] Don't complain if size-cells == 0 in
+    prom_parse()"
+  * PPC: Revert "[POWERPC] Add 'mdio' to bus scan id list for platforms
+    with QE UEC"
+  * powerpc: Fix size check for hugetlbfs
+  * direct-io: fix error-path crashes
+  * stifb: detect cards in double buffer mode more reliably
+  * pata_atiixp: add SB700 PCI ID
+  * CPUFREQ: ondemand: fix tickless accounting and software coordination
+    bug
+  * CPUFREQ: ondemand: add a check to avoid negative load calculation
+  * Linux 2.6.22.3
+  * intel_agp: really fix 945/965GME
+  * Reset current->pdeath_signal on SUID binary execution (CVE-2007-3848)
+  * MSS(mmc/sd/sdio) driver patch
+
+ -- Kyle McMartin <kyle@ubuntu.com>  Thu, 16 Aug 2007 12:17:27 -0400
+
+linux-source-2.6.22 (2.6.22-9.25) gutsy; urgency=low
+
+  [Kyle McMartin]
+
+  * ubuntu: Fix FTBFS -- forgot to bump debian/abi
+
+ -- Kyle McMartin <kyle@ubuntu.com>  Thu, 02 Aug 2007 22:13:28 +0000
+
+linux-source-2.6.22 (2.6.22-9.24) gutsy; urgency=low
+
+  [Colin Watson]
+
+  * provide Provides for fs-*-modules udebs
+
+  [Matthias Klose]
+
+  * test $dilist before using it
+
+  [Lamont Jones]
+
+  * hppa: Update abi files
+
+ -- Kyle McMartin <kyle@ubuntu.com>  Thu, 02 Aug 2007 18:26:34 +0000
+
+linux-source-2.6.22 (2.6.22-9.23) gutsy; urgency=low
+
+  [Ben Collins]
+
+  * ubuntu: Add missing newline to module-check script
+  * ubuntu: Add lpia to linux-libc-dev. Should finally build now.
+
+ -- Ben Collins <bcollins@ubuntu.com>  Thu, 02 Aug 2007 13:10:23 -0400
+
+linux-source-2.6.22 (2.6.22-9.22) gutsy; urgency=low
+
+  [Ben Collins]
+
+  * ubuntu: Use DEB_HOST_ARCH, not DEB_HOST_ARCH_CPU
+
+ -- Ben Collins <bcollins@ubuntu.com>  Thu, 02 Aug 2007 08:44:09 -0400
+
+linux-source-2.6.22 (2.6.22-9.21) gutsy; urgency=low
+
+  [Ben Collins]
+
+  * lpia: Add build stuff for lpia architecture
+
+  [LaMont Jones]
+
+  * abi files for hppa
+  * UBUNTU-HPPA: configs that seem to work
+  * hppa: abi files for 9.20
+
+ -- Ben Collins <bcollins@ubuntu.com>  Wed, 01 Aug 2007 11:12:59 -0400
+
+linux-source-2.6.22 (2.6.22-9.20) gutsy; urgency=low
+
+  [Ben Collins]
+
+  * tulip: Fix for Uli5261 chipsets.
+  * tulip: Define ULI PCI ID's
+  * tulip: Let dmfe handle davicom on non-sparc
+  * input: Allow root to inject unknown scan codes.
+  * irda: Default to dongle type 9 on IBM hardware
+  * input/mouse/alps: Do not call psmouse_reset() for alps
+  * pcmcia: Do not insert pcmcia cards on resume
+  * ide-cd: Disable verbose errors.
+  * block: Make CDROMEJECT more robust
+  * pm: Config option to disable handling of console during suspend/resume.
+  * version: Implement version_signature proc file.
+  * update toshiba_acpi to 0.19a-dev
+  * xpad: Update to latest version from xbox-linux.
+  * ubuntu: Enable setting of CONFIG_VERSION_SIGNATURE at build time
+  * toshiba_acpi: Don't use init_MUTEX_LOCKED
+
+  [Chuck Short]
+
+  * [USB]: add ASUS LCM to the blacklist
+  * [NET]: Add mcp73 to forcedeth.
+  * [USB]: Added support for Sanwa PC5000 multimeter usb cable (KB-USB2).
+  * [ATA] Add support for Sb700 AHCI nor-raid5 and raid5
+
+  [Fabio M. Di Nitto]
+
+  * drivers/char/vt.c: make promcon driver init a boot option.
+
+  [Kyle McMartin]
+
+  * Disable MMCONFIG by default
+
+  [Phillip Lougher]
+
+  * fix NFS mounting regression from Edgy->Feisty
+  * r8169: disable TSO by default for RTL8111/8168B chipsets.
+
+  [Tim Gardner]
+
+  * Catch nonsense keycodes and silently ignore
+  * Cause SoftMac to emit an association event when setting ESSID.
+
+ -- Ben Collins <bcollins@ubuntu.com>  Mon, 30 Jul 2007 12:01:43 -0400
+
+linux-source-2.6.22 (2.6.22-9.19) gutsy; urgency=low
+
+  [Amit Kucheria]
+
+  * Fix for FTBFS bug 123178
+  * Fix for FTBFS bug 123178
+  * Add devices to USB quirks to prevent USB autosuspend
+  * More devices added to USB quirks
+    - LP: #85488
+  * Support for ENE CB-712/4 SD card reader
+  * Reorder quirk list based on Vendor/Product ID
+
+  [Ben Collins]
+
+  * ubuntu: Enable HOTPLUG_CPU in sparc64-smp config.
+  * ubuntu: Add xen to amd64 custom builds
+  * ubuntu: Update real-time kernel to -rt4
+  * rt: Patch from Alessio Igor Bogani <abogani@texware.it> for RT-8
+
+  [Chuck Short]
+
+  * IDE: add MHV2080BH to NCQ blacklist
+  * XEN: update to 2.6.22 final and amd64 support.
+  * NET: Add more pci-ids to zd1211rw
+  * IDE: add new PCI ID
+  * USB: fix oops in ftdi_sio
+
+  [Eric Piel]
+
+  * ACPI: Allow custom DSDT tables to be loaded from initramfs
+
+  [Ryan Lortie]
+
+  * Macbook calibration loop fix
+    - LP: #54621
+
+  [Upstream Kernel Changes]
+
+  * NETFILTER: {ip, nf}_conntrack_sctp: fix remotely triggerable NULL ptr
+    dereference (CVE-2007-2876)
+  * Linux 2.6.22.1
+  * [SPARC64]: Use KERN_ERR in sun4v IRQ printk()'s.
+  * [SPARC64]: Add LDOM virtual channel driver and VIO device layer.
+  * [SPARC64]: Add Sun LDOM virtual network driver.
+  * [SPARC64]: Add Sun LDOM virtual disk driver.
+  * [SPARC64]: Create proper obppath sysfs files for VIO bus devices.
+  * [SPARC64] LDC: Do limited polled retry on setting RX queue head.
+  * [SUNVNET]: Validate RX descriptor size field.
+  * [SPARC64]: Add missing symbol exports for LDOM infrastructure.
+  * [SPARC64]: Temporary workaround for LDC INO double-delivery.
+  * [SPARC64]: Create 'devspec' nodes for vio devices.
+  * [SPARC64]: vdev->type can be NULL, handle this in devspec_show().
+  * [SPARC64]: Assorted LDC bug cures.
+  * [SPARC64]: Add domain-services nodes to VIO device tree.
+  * [SPARC64]: Export powerd facilities for external entities.
+  * [SPARC64]: Initial domain-services driver.
+  * [SPARC64]: Use more mearningful names for IRQ registry.
+  * [SPARC64]: Abstract out mdesc accesses for better MD update handling.
+  * [SPARC64]: Fix MD property lifetime bugs.
+  * [SPARC64]: Fix setting of variables in LDOM guest.
+  * [SPARC64]: Initial LDOM cpu hotplug support.
+  * [SPARC64]: Unconditionally register vio_bus_type.
+  * [SPARC64]: Fix build regressions added by dr-cpu changes.
+  * [SPARC64]: mdesc.c needs linux/mm.h
+  * [SPARC64]: SMP build fixes.
+  * [SPARC64]: More sensible udelay implementation.
+  * [SPARC64]: Process dr-cpu events in a kthread instead of workqueue.
+  * [SPARC64]: Add ->set_affinity IRQ handlers.
+  * [SPARC64]: Fix leak when DR added cpu does not bootup.
+  * [SPARC64]: Clear cpu_{core,sibling}_map[] in
+    smp_fill_in_sib_core_maps()
+  * [SPARC64]: Give more accurate errors in dr_cpu_configure().
+  * [SERIAL]: Fix console write locking in sparc drivers.
+  * [TIMER]: Fix clockevent notifications on 64-bit.
+  * [SPARC64]: dr-cpu unconfigure support.
+  * [SPARC64]: Fix UP build.
+  * [SPARC64]: SMP build fix.
+  * [SPARC64]: Fix race between MD update and dr-cpu add.
+  * [SERIAL] SUNHV: Fix jerky console on LDOM guests.
+  * [SPARC64]: Kill explicit %gl register reference.
+  * [SPARC64]: Add basic infrastructure for MD add/remove notification.
+  * [SPARC64]: Simplify VDC device probing.
+  * [SPARC64]: Simplify VNET probing.
+  * [SPARC64]: Massively simplify VIO device layer and support hot
+    add/remove.
+  * [SPARC64]: Handle LDC resets properly in domain-services driver.
+  * [SPARC64]: Handle reset events in vio_link_state_change().
+  * [SPARC64]: Fix reset handling in VNET driver.
+  * [SPARC64]: Set vio->desc_buf to NULL after freeing.
+  * [SPARC64]: Fix MODULE_DEVICE_TABLE() specification in VDC and VNET.
+  * [SPARC64]: Fix device type matching in VIO's devspec_show().
+  * Add empty <asm-parisc/vga.h>
+  * Add dummy isa_(bus|virt)_to_(virt|bus) inlines
+  * Clean up sti_flush
+  * Do not allow STI_CONSOLE to be modular
+  * Use compat_sys_getdents
+
+ -- Ben Collins <bcollins@ubuntu.com>  Sat, 28 Jul 2007 12:30:53 -0400
+
+linux-source-2.6.22 (2.6.22-8.18) gutsy; urgency=low
+
+  [Ben Collins]
+
+  * ubuntu: *sigh* update xen config to fix FTBFS
+
+ -- Ben Collins <bcollins@ubuntu.com>  Thu, 12 Jul 2007 14:23:20 +0100
+
+linux-source-2.6.22 (2.6.22-8.17) gutsy; urgency=low
+
+  [Ben Collins]
+
+  * ubuntu: Actually enable the -xen build.
+
+ -- Ben Collins <bcollins@ubuntu.com>  Thu, 12 Jul 2007 09:51:01 +0100
+
+linux-source-2.6.22 (2.6.22-8.16) gutsy; urgency=low
+
+  * Removed CONFIG_BLINK from all configs and added to modules.ignore
+  * This fixes a build failure for 8.15
+
+  [Alexey Starikovskiy]
+
+  * Fix ACPI battery detection on Asus
+
+  [Amit Kucheria]
+
+  * Export symbols required to build GFS1 in LUM
+  * Update configuration files
+  * 2.6.22-7.14 ABI
+  * Remove old ABI
+  * Update d-i modules to support Sparc LDOM
+  * Introducing the UME kernel flavour
+
+  [Jacob Pan]
+
+  * Poulsbo SMBus Controller
+  * Intel Poulsbo SCH IDE Controller
+  * Intel Poulsbo HD audio controller
+
+  [Phillip Lougher]
+
+  * xen: Update custom binary flavour (Xen 3.1 for 2.6.22-rc5)
+  * xen: Update xen/config.i386 to enable PAE
+
+  [Upstream Kernel Changes]
+
+  * [SCSI] fusion: fix for BZ 8426 - massive slowdown on SCSI CD/DVD drive
+  * [XFS] Update the MAINTAINERS file entry for XFS.
+  * IB/mlx4: Fix handling of wq->tail for send completions
+  * IB/mlx4: Fix warning in rounding up queue sizes
+  * [SCSI] ESP: Don't forget to clear ESP_FLAG_RESETTING.
+  * firewire: fix hang after card ejection
+  * ieee1394: fix to ether1394_tx in ether1394.c
+  * [ARM] Add support for pause_on_oops and display preempt/smp options
+  * sh: Fix restartable syscall arg5 clobbering.
+  * ACPI: gracefully print null trip-point device
+  * ACPICA: fix error path in new external package objects as method
+    arguments
+  * sh: oops_enter()/oops_exit() in die().
+  * [ARM] Update show_regs/oops register format
+  * IB/mlx4: Handle new FW requirement for send request prefetching
+  * IB/mlx4: Get rid of max_inline_data calculation
+  * IB/mlx4: Handle buffer wraparound in __mlx4_ib_cq_clean()
+  * IB/mlx4: Handle FW command interface rev 3
+  * Fix signalfd interaction with thread-private signals
+  * sched: fix SysRq-N (normalize RT tasks)
+  * Fix possible runqueue lock starvation in wait_task_inactive()
+  * sh: Handle -ERESTART_RESTARTBLOCK for restartable syscalls.
+  * sh64: Handle -ERESTART_RESTARTBLOCK for restartable syscalls.
+  * [POWERPC] Fix snd-powermac refcounting bugs
+  * [XFS] s/memclear_highpage_flush/zero_user_page/
+  * [XFS] Update the MAINTAINERS file entry for XFS - change git repo name.
+  * [XFRM]: Fix MTU calculation for non-ESP SAs
+  * [IPVS]: Fix state variable on failure to start ipvs threads
+  * [AF_RXRPC]: Return the number of bytes buffered in rxrpc_send_data()
+  * [S390] Missing blank when appending cio_ignore kernel parameter
+  * [S390] Fix zfcpdump header
+  * [S390] Fix yet another two section mismatches.
+  * [S390] Print list of modules on die().
+  * [S390] Add oops_enter()/oops_exit() calls to die().
+  * [S390] Move psw_set_key.
+  * [POWERPC] rheap - eliminates internal fragments caused by alignment
+  * [POWERPC] PowerPC: Prevent data exception in kernel space (32-bit)
+  * [POWERPC] Fix powermac late initcall to only run on powermac
+  * [MIPS] Don't drag a platform specific header into generic arch code.
+  * x86_64: Fix readahead/sync_file_range/fadvise64 compat calls
+  * x86_64: Fix eventd/timerfd syscalls
+  * x86: Disable DAC on VIA bridges
+  * x86_64: Quieten Atari keyboard warnings in Kconfig
+  * x86: Only make Macintosh drivers default on Macs
+  * x86: Disable KPROBES with DEBUG_RODATA for now
+  * x86: change_page_attr bandaids
+  * x86_64: fix link warning between for .text and .init.text
+  * Fix up CREDIT entry ordering
+  * firewire: Only set client->iso_context if allocation was successful.
+  * spidernet: null out skb pointer after its been used.
+  * spidernet: Cure RX ram full bug
+  * spidernet: Don't terminate the RX ring
+  * spidernet: silence the ramfull messages
+  * spidernet: turn off descriptor chain end interrupt.
+  * spidernet: checksum and ethtool
+  * bonding: Fix use after free in unregister path
+  * bonding: Fix 802.3ad no carrier on "no partner found" instance
+  * s390: print correct level for HiperSockets devices
+  * s390: qeth driver does not recover
+  * s390: avoid inconsistent lock state in qeth
+  * s390: qeth: wrong packet length in qdio header
+  * s390: Use ccw_device_get_id() in qeth/claw drivers
+  * s390: don't call iucv_path_connect from tasklet context
+  * s390: netiucv spinlock initializer cleanup
+  * s390: netiucv inlining cleanup
+  * forcedeth: use unicast receive mode for WoL
+  * natsemi irq flags
+  * cxgb3 - fix skb->dev dereference
+  * cxgb3 - fix netpoll hanlder
+  * cxgb3 - Fix direct XAUI support
+  * cxgb3 - Stop mac RX when changing MTU
+  * cxgb3 - MAC watchdog update
+  * PATA: Add the MCP73/77 support to PATA driver
+  * pata_it821x: (partially) fix DMA in RAID mode
+  * libata: more NONCQ devices
+  * kerneldoc fix in libata
+  * ahci: fix PORTS_IMPL override
+  * fix module_param mistake in it821x
+  * Blackfin arch: update ANOMALY handling
+  * Blackfin arch: update printk to use KERN_EMERG and reformat crash
+    output
+  * Blackfin arch: add missing braces around array bfin serial init
+  * Blackfin arch: match kernel startup messaage with new linker script
+  * Blackfin arch: move cond_syscall() behind __KERNEL__ like all other
+    architectures
+  * Blackfin arch: Add definition of dma_mapping_error
+  * Blackfin arch: add proper const volatile to addr argument to the read
+    functions
+  * [AGPGART] intel_agp: don't load if no IGD and AGP port
+  * IB/umem: Fix possible hang on process exit
+  * IPoIB/cm: Initialize RX before moving QP to RTR
+  * IPoIB/cm: Fix interoperability when MTU doesn't match
+  * IPoIB/cm: Remove dead definition of struct ipoib_cm_id
+  * IB/mlx4: Correct max_srq_wr returned from mlx4_ib_query_device()
+  * [PARISC] stop lcd driver from stripping initial whitespace
+  * [PARISC] Handle wrapping in expand_upwards()
+  * [PARISC] Fix unwinder on 64-bit kernels
+  * [PARISC] unwinder improvements
+  * page_mapping must avoid slub pages
+  * posix-timers: Prevent softirq starvation by small intervals and SIG_IGN
+  * Allow DEBUG_RODATA and KPROBES to co-exist
+  * [NETFILTER]: nf_conntrack_sip: add missing message types containing RTP
+    info
+  * [NETFILTER]: nfctnetlink: Don't allow to change helper
+  * [IPV6] NDISC: Fix thinko to control Router Preference support.
+  * [IPV4]: include sysctl.h from inetdevice.h
+  * i386: Make CMPXCHG64 only dependent on PAE
+  * x86_64: Fix only make Macintosh drivers default on Macs
+  * x86_64: Ignore compat mode SYSCALL when IA32_EMULATION is not defined
+  * [AVR32] Fix bug in invalidate_dcache_region()
+  * [AVR32] NGW100, Remove relics of the old USART mapping scheme
+  * [AVR32] Initialize dma_mask and dma_coherent_mask
+  * [AVR32] Update defconfigs
+  * ACPI: fix 2.6.20 SMP boot regression
+  * [SKBUFF]: Fix incorrect config #ifdef around skb_copy_secmark
+  * [TIPC]: Fix infinite loop in netlink handler
+  * [PPP]: Revert 606f585e363527da9feaed79465132c0c661fd9e
+  * [PPP]: Fix osize too small errors when decoding mppe.
+  * [TCP] tcp_read_sock: Allow recv_actor() return return negative error
+    value.
+  * [NET]: Re-enable irqs before pushing pending DMA requests
+  * [NET]: Make skb_seq_read unmap the last fragment
+  * hwmon/coretemp: fix a broken error path
+  * fix refcounting of nsproxy object when unshared
+  * console UTF-8 fixes (fix)
+  * SM501: suspend support
+  * SM501: initialise SDRAM clock before bus clocks
+  * SM501: Fix sm501_init_reg() mask/set order
+  * SM501: Clock updates and checks
+  * SM501: Add Documentation/SM501.txt
+  * SM501: Check SM501 ID register on initialisation
+  * SLUB: fix behavior if the text output of list_locations overflows
+    PAGE_SIZE
+  * sched: fix next_interval determination in idle_balance()
+  * update checkpatch.pl to version 0.05
+  * alpha: fix alignment problem in csum_ipv6_magic()
+  * Char: stallion, fix oops during init with ISA cards
+  * uml: use generic BUG
+  * uml: add asm/paravirt.h
+  * "volatile considered harmful"
+  * document nlink function
+  * slab allocators: MAX_ORDER one off fix
+  * update checkpatch.pl to version 0.06
+  * x86_64: fix misplaced `continue' in mce.c
+  * ext2: disallow setting xip on remount
+  * audit: fix oops removing watch if audit disabled
+  * ext3: lost brelse in ext3_read_inode()
+  * ext4: lost brelse in ext4_read_inode()
+  * ACPI: preserve the ebx value in acpi_copy_wakeup_routine
+  * FUTEX: Restore the dropped ERSCH fix
+  * Linus 2.6.22-rc6
+  * [ARM] 4452/1: Force the literal pool dump before reloc_end
+  * [ARM] 4449/1: more entries in arch/arm/boot/.gitignore
+  * fix nmi_watchdog=2 bootup hang
+  * [POWERPC] Update g5_defconfig
+  * [POWERPC] Update defconfigs
+  * [POWERPC] Fix VDSO gettimeofday() when called with NULL struct timeval
+  * [POWERPC] Fix subtle FP state corruption bug in signal return on SMP
+  * USB: g_file_storage: call allow_signal()
+  * USB: ti serial driver sleeps with spinlock held
+  * USB: memory leak in iowarrior.c
+  * USB: usblcd doesn't limit memory consumption during write
+  * USB: fix race leading to use after free in io_edgeport
+  * USB: add new device id to option driver
+  * USB: ftdio_sio: New IPlus device ID
+  * [MIPS] __ucmpdi2 arguments are unsigned long long.
+  * [MIPS] add io_map_base to pci_controller on Cobalt
+  * [MIPS] remove "support for" from system type entry
+  * [MIPS] Alchemy: Fix wrong cast
+  * [MIPS] Fix pb1500 reg B access
+  * [MIPS] AP/SP requires shadow registers, auto enable support.
+  * [MIPS] 20K: Handle WAIT related bugs according to errata information
+  * [MIPS] use compat_siginfo in rt_sigframe_n32
+  * [MIPS] Remove a duplicated local variable in test_and_clear_bit()
+  * [MIPS] EMMA2RH: Disable GEN_RTC, it can't possibly work.
+  * [MIPS] SMTC and non-SMTC kernel and modules are incompatible
+  * [MIPS] Count timer interrupts correctly.
+  * x86_64: set the irq_chip name for lapic
+  * x86_64 irq: use mask/unmask and proper locking in fixup_irqs()
+  * [SPARC64]: Add irqs to mdesc_node.
+  * [SPARC64]: Fix VIRQ enabling.
+  * [SPARC64]: Need to set state to IDLE during sun4v IRQ enable.
+  * [SPARC64]: Add LDOM virtual channel driver and VIO device layer.
+  * [SPARC64]: Add Sun LDOM virtual network driver.
+  * [SPARC64]: Add Sun LDOM virtual disk driver.
+  * [SPARC64]: Create proper obppath sysfs files for VIO bus devices.
+  * [SPARC64] LDC: Do limited polled retry on setting RX queue head.
+  * [GFS2] Fix gfs2_block_truncate_page err return
+  * [DLM] Telnet to port 21064 can stop all lockspaces
+  * [GFS2] inode size inconsistency
+  * [GFS2] remounting w/o acl option leaves acls enabled
+  * [GFS2] System won't suspend with GFS2 file system mounted
+  * [GFS2] git-gfs2-nmw-build-fix
+  * [GFS2] Obtaining no_formal_ino from directory entry
+  * [GFS2] Remove i_mode passing from NFS File Handle
+  * [SUNVNET]: Validate RX descriptor size field.
+  * [SPARC64]: Add missing symbol exports for LDOM infrastructure.
+  * [SPARC64]: Temporary workaround for LDC INO double-delivery.
+  * [SPARC64]: Create 'devspec' nodes for vio devices.
+  * [SPARC64]: vdev->type can be NULL, handle this in devspec_show().
+
+ -- Amit Kucheria <amit.kucheria@ubuntu.com>  Mon, 09 Jul 2007 12:55:56 +0300
+
+linux-source-2.6.22 (2.6.22-7.14) gutsy; urgency=low
+
+  [Ben Collins]
+
+  * build/vars: Provide ivtv-modules
+  * Bump ABI
+  * ubuntu/config: Enable Intermediate Functional Block device
+  * coredump: Fix typo in patch merge
+  * ubuntu/scripts: Make sure to symlink *.lds for ia64 builds
+  * ubuntu/config: Enable NO_HZ for server and sparc64 targets.
+  * ubuntu/config: Remove bigiron target, see if anyone complains
+  * ubuntu: Ok, really remove bigiron
+  * ubuntu/control-scripts: Fo sho, remove the debconf stuff from controls
+    scripts
+  * AppArmor: Enable exports and changes for AppArmor usage
+  * ubuntu: Add feisty changelog for historical purposes.
+
+  [Colin Watson]
+
+  * Move isofs to storage-core-modules udeb from fs-core-modules.
+
+  [Upstream Kernel Changes]
+
+  * [MTD] [MAPS] don't force uclinux mtd map to be root dev
+  * [MTD] generalise the handling of MTD-specific superblocks
+  * [SCSI] zfcp: avoid clutter in erp_dbf
+  * [SCSI] zfcp: IO stall after deleting and path checker changes after
+    reenabling zfcp devices
+  * [SCSI] ipr: Proper return codes for eh_dev_reset for SATA devices
+  * [SCSI] stex: fix id mapping issue
+  * [SCSI] stex: extend hard reset wait time
+  * [SCSI] stex: fix reset recovery for console device
+  * [SCSI] stex: minor cleanup and version update
+  * [SCSI] MegaRAID: Update MAINTAINERS email-id
+  * [SCSI] tgt: fix a rdma indirect transfer error bug
+  * [SCSI] NCR53C9x: correct spelling mistake in deprecation notice
+  * [SCSI] aacraid: Correct sa platform support. (Was: [Bug 8469] Bad EIP
+    value on pentium3 SMP kernel-2.6.21.1)
+  * [SCSI] aacraid: fix panic on short Inquiry
+  * [WATCHDOG] ks8695_wdt.c - new KS8695 watchdog driver
+  * [JFFS2] Fix BUG() caused by failing to discard xattrs on deleted files.
+  * [JFFS2] Fix potential memory leak of dead xattrs on unmount.
+  * [SCSI] sd: fix refcounting regression in suspend/resume routines
+  * [SCSI] aacraid: apply commit config for reset_devices flag
+  * [SCSI] aic7xxx: fix aicasm build failure with gcc-3.4.6
+  * [SCSI] aic94xx: asd_clear_nexus should fail if the cleared task does
+    not complete
+  * [SCSI] fusion: Fix |/|| confusion
+  * parisc: make command_line[] static
+  * parisc: sync compat getdents
+  * [PARISC] Move #undef to end of syscall table
+  * [PARISC] Wire up kexec_load syscall
+  * parisc: convert /proc/gsc/pcxl_dma to seq_file
+  * [PARISC] Let PA-8900 processors boot
+  * [PARISC] Disable LWS debugging
+  * [PARISC] spelling fixes: arch/parisc/
+  * sh: section mismatch fixes for system timer.
+  * [PARISC] ROUND_UP macro cleanup in arch/parisc
+  * [PARISC] ROUNDUP macro cleanup in drivers/parisc
+  * [PPC] Fix COMMON symbol warnings
+  * [PPC] Remove duplicate export of __div64_32.
+  * [POWERPC] 52xx: unbreak lite5200 dts (_pic vs. -pic)
+  * [POWERPC] QE: fix Kconfig 'select' warning with UCC_FAST
+  * [POWERPC] Fix Section mismatch warnings
+  * [POWERPC] Fix modpost warning
+  * [PPC] Fix modpost warning
+  * [CIFS] Fix oops on failed cifs mount (in kthread_stop)
+  * [POWERPC] Fix Kconfig warning
+  * [CIFS] typo in previous patch
+  * [SCSI] megaraid_sas: intercept cmd timeout and throttle io
+  * [WATCHDOG] clean-up watchdog documentation
+  * drm: Spinlock initializer cleanup
+  * drm/radeon: add more IGP chipset pci ids
+  * drm: make sure the drawable code doesn't call malloc(0).
+  * [PARISC] kobject is embedded in subsys, not kset
+  * [PARISC] Build fixes for power.c
+  * [ARM] 4401/1: S3C2443: Add definitions for port GPIOJ
+  * [ARM] 4402/1: S3C2443: Add physical address of HSMMC controller
+  * [ARM] 4403/1: Make the PXA-I2C driver work with lockdep validator
+  * [ARM] 4404/1: Trivial IXP42x Kconfig cleanup
+  * [ARM] 4405/1: NSLU2, DSM-G600 frequency fixup code
+  * [ARM] 4406/1: Trivial NSLU2 / NAS-100D header & setup code cleanup
+  * [ARM] remove unused header file: arch/arm/mach-s3c2410/bast.h
+  * [PARISC] fix lasi_82596 build
+  * [PARISC] fix section mismatch in parport_gsc
+  * [PARISC] fix section mismatch in parisc STI video drivers
+  * [PARISC] fix section mismatch in ccio-dma
+  * [PARISC] fix section mismatches in arch/parisc/kernel
+  * [PARISC] fix section mismatch in parisc eisa driver
+  * [PARISC] fix section mismatch in superio serial drivers
+  * [PARISC] Wire up utimensat/signalfd/timerfd/eventfd syscalls
+  * hwmon/ds1621: Fix swapped temperature limits
+  * hwmon/coretemp: Add more safety checks
+  * hwmon/w83627hf: Be quiet when no chip is found
+  * hwmon-vid: Don't spam the logs when VRM version is missing
+  * hwmon/applesmc: Simplify dependencies
+  * hwmon/applesmc: Handle name file creation error and deletion
+  * ieee1394: sbp2: include workqueue.h
+  * ieee1394: eth1394: remove bogus netif_wake_queue
+  * ieee1394: eth1394: handle tlabel exhaustion
+  * ieee1394: eth1394: bring back a parent device
+  * ieee1394: raw1394: Fix async send
+  * firewire: Add missing byteswapping for receive DMA programs.
+  * firewire: prefix modules with firewire- instead of fw-
+  * firewire: fix return code
+  * [libata] Add drive to NCQ blacklist
+  * [ARM] enable arbitary speed tty ioctls and split input/output speed
+  * Input: db9 - do not ignore dev2 module parameter
+  * Input: logips2pp - fix typo in Kconfig
+  * [XFS] Write at EOF may not update filesize correctly.
+  * [SCSI] pluto: Use wait_for_completion_timeout.
+  * [SPARC64]: Kill unused DIE_PAGE_FAULT enum value.
+  * [SPARC64]: Don't be picky about virtual-dma values on sun4v.
+  * [SPARC32]: Removes mismatch section warnigs in sparc time.c file
+  * [SERIAL] sunzilog: section mismatch fix
+  * [SPARC64]: PCI device scan is way too verbose by default.
+  * [SCSI] jazz_esp: Converted to use esp_core.
+  * [SCSI] ESP: Kill SCSI_ESP_CORE and link directly just like jazz_esp
+  * [SPARC64]: Fix typo in sun4v_hvapi_register error handling.
+  * [SPARC64]: Report proper system soft state to the hypervisor.
+  * [SPARC64]: Negotiate hypervisor API for PCI services.
+  * [SPARC64]: Use machine description and OBP properly for cpu probing.
+  * [SPARC64]: Eliminate NR_CPUS limitations.
+  * [SPARC64]: arch/sparc64/time.c doesn't compile on Ultra 1 (no PCI)
+  * [SPARC]: Linux always started with 9600 8N1
+  * [SPARC64]: Fix _PAGE_EXEC_4U check in sun4u I-TLB miss handler.
+  * [SPARC]: Emulate cmpxchg like parisc
+  * [SPARC]: Mark as emulating cmpxchg, add appropriate depends for DRM.
+  * [SPARC64]: Fix two bugs wrt. kernel 4MB TSB.
+  * [SPARC64]: Fill holes in hypervisor APIs and fix KTSB registry.
+  * mac80211: fail back to use associate from reassociate
+  * mac80211: fix memory leak when defrag fragments
+  * mac80211: always set carrier status on open
+  * mac80211: avoid null ptr deref in ieee80211_ibss_add_sta
+  * prism54: fix monitor mode oops
+  * ieee80211: fix incomplete error message
+  * softmac: alloc_ieee80211() NULL check
+  * hostap: Allocate enough tailroom for TKIP
+  * sparc64: fix alignment bug in linker definition script
+  * USB: replace flush_workqueue with cancel_sync_work
+  * ACPICA: allow Load(OEMx) tables
+  * ACPI: thermal: Replace pointer with name in trip_points
+  * ACPI: extend "acpi_osi=" boot option
+  * IB/mthca: Fix handling of send CQE with error for QPs connected to SRQ
+  * IPoIB/cm: Fix performance regression on Mellanox
+  * IB/cm: Fix stale connection detection
+  * IB/mlx4: Fix last allocated object tracking in bitmap allocator
+  * NOHZ: prevent multiplication overflow - stop timer for huge timeouts
+  * random: fix error in entropy extraction
+  * random: fix seeding with zero entropy
+  * ACPI: Make _OSI(Linux) a special case
+  * ACPI: add __init to acpi_initialize_subsystem()
+  * [PARISC] fix "ENTRY" macro redefinition
+  * [PARISC] fix section mismatch in smp.c
+  * [PARISC] remove remnants of parisc-specific softirq code
+  * [PARISC] fix trivial spelling nit in asm/linkage.h
+  * [PARISC] fix null ptr deref in unwind.c
+  * [PARISC] fix "reduce size of task_struct on 64-bit machines" fallout
+  * [PARISC] be more defensive in process.c::get_wchan
+  * [ARM] use __used attribute
+  * [ARM] Fix stacktrace FP range checking
+  * [ARM] oprofile: avoid lockdep warnings on mpcore oprofile init
+  * [ARM] 4411/1: KS8695: Another serial driver fix
+  * [ARM] 4412/1: S3C2412: reset errata fix
+  * [ARM] 4414/1: S3C2443: sparse fix for clock.c
+  * [ARM] 4415/1: AML5900: fix sparse warnings from map_io
+  * [ARM] 4416/1: NWFPE: fix undeclared symbols
+  * [ARM] 4410/1: Remove extern declarations in coyote/ixdpg425-pci.c
+  * [ARM] 4394/1: ARMv7: Add the TLB range operations
+  * [ARM] 4417/1: Serial: Fix AMBA drivers locking
+  * sky2: dont set bogus bit in PHY register
+  * sky2: checksum offload plus vlan bug
+  * sky2: program proper register for fiber PHY
+  * defxx: Fix the handling of ioremap() failures
+  * e1000: restore netif_poll_enable call but make sure IRQs are off
+  * sky2: enable IRQ on duplex renegotiation
+  * ehea: Fixed multi queue RX bug
+  * [SCSI] fix CONFIG_SCSI_WAIT_SCAN=m
+  * [SCSI] qla2xxx: fix timeout in qla2x00_down_timeout
+  * [ARM] Fix some section mismatch warnings
+  * alpha: cleanup in bitops.h
+  * alpha: support new syscalls
+  * fix possible null ptr deref in kallsyms_lookup
+  * NFS: Fix a refcount leakage in O_DIRECT
+  * a bug in ramfs_nommu_resize function, passing old size to vmtruncate
+  * sh: Fix pcrel too far for in_nmi label.
+  * sh: Trivial fix for dma-api compile failure.
+  * sh: Fix vsyscall build failure.
+  * sh: trivial build cleanups.
+  * sh: support older gcc's
+  * [ALSA] HDA: Add support for Gateway NX860
+  * [ALSA] HDA: Add more systems to Sigmatel codec
+  * [ALSA] HDA: Fix headphone mute issue on non-eapd Conexant systems
+  * [ALSA] hda-codec - Add support for ASUS A8J modem
+  * [ALSA] ali5451 - Fix possible NULL dereference
+  * [ALSA] hda-intel: fix ASUS M2V detection
+  * [ALSA] Fix ASoC s3c24xx-pcm spinlock bug
+  * [ALSA] hda-codec - Add quirk for MSI S420
+  * [ALSA] hda-codec - Add quirk for Supermicro PDSBA to alc883_cfg_tbl[]
+  * [ALSA] hda-codec - Add support for MSI K9N Ultra
+  * [ALSA] hda-codec - Fix pin configs for Gateway MX6453
+  * [ALSA] hda-codec - Fix input with STAC92xx
+  * [ALSA] hda-codec - Fix STAC922x capture boost level
+  * [CRYPTO] cryptd: Fix problem with cryptd and the freezer
+  * [CASSINI]: Fix printk message typo.
+  * [XFRM]: Allow XFRM_ACQ_EXPIRES to be tunable via sysctl.
+  * [XFRM]: xfrm_larval_drop sysctl should be __read_mostly.
+  * [IPSEC]: Fix IPv6 AH calculation in outbound
+  * [IPV6] ROUTE: No longer handle ::/0 specially.
+  * [NET]: parse ip:port strings correctly in in4_pton
+  * [IPSEC]: Fix panic when using inter address familiy IPsec on loopback.
+  * [IPV4]: Kill references to bogus non-existent CONFIG_IP_NOSIOCRT
+  * [AF_PACKET]: Kill bogus CONFIG_PACKET_MULTICAST
+  * [IPV6]: Fix build warning.
+  * [AF_PACKET]: Kill CONFIG_PACKET_SOCKET.
+  * [SOCK]: Shrink struct sock by 8 bytes on 64-bit.
+  * [TCP]: Consolidate checking for tcp orphan count being too big.
+  * [NET] napi: Call __netif_rx_complete in netif_rx_complete
+  * [IPV6] ADDRCONF: Fix conflicts in DEVCONF_xxx constant.
+  * [TCP] tcp_probe: a trivial fix for mismatched number of printl
+    arguments.
+  * [TCP] tcp_probe: use GCC printf attribute
+  * [BRIDGE]: Reduce frequency of forwarding cleanup timer in bridge.
+  * [BRIDGE]: Round off STP perodic timers.
+  * [IPSEC]: Add xfrm_sysctl.txt.
+  * [SPARC64]: Add missing NCS and SVC hypervisor interfaces.
+  * [SPARC32]: Build fix.
+  * [SPARC]: Missing #include <linux/mm.h> in drivers/sbus/char/flash.c
+  * [ALSA] version 1.0.14
+  * neofb: Fix pseudo_palette array overrun in neofb_setcolreg
+  * smpboot: fix cachesize comparison in smp_tune_scheduling()
+  * at91: fix enable/disable_irq_wake symmetry in pcmcia driver
+  * SLUB: More documentation
+  * pci-quirks: fix MSI disabling on RS400-200 and RS480
+  * ntfs_init_locked_inode(): fix array indexing
+  * m68k: runtime patching infrastructure
+  * SLUB: Fix NUMA / SYSFS bootstrap issue
+  * afs: needs sched.h
+  * m68k: discontinuous memory support
+  * [S390] Add exception handler for diagnose 224
+  * [S390] dasd_eer: use mutex instead of semaphore
+  * [S390] arch/s390/kernel/debug.c: use mutex instead of semaphore
+  * [S390] raw3270: use mutex instead of semaphore
+  * [S390] Fix section annotations.
+  * [S390] cio: Use device_schedule_callback() for removing disconnected
+    devices.
+  * [S390] cio: deregister ccw device when pgid disband failed
+  * ACPI: thinkpad-acpi: do not use named sysfs groups
+  * ieee1394: fix calculation of sysfs attribute "address"
+  * ieee1394: sbp2: offer SAM-conforming target port ID in sysfs
+  * firewire: fw-sbp2: implement sysfs ieee1394_id
+  * firewire: add to MAINTAINERS
+  * firewire: Implement suspend/resume PCI driver hooks.
+  * firewire: Change struct fw_cdev_iso_packet to not use bitfields.
+  * firewire: Install firewire-constants.h and firewire-cdev.h for
+    userspace.
+  * EXT4: Fix whitespace
+  * Remove unnecessary exported symbols.
+  * ext4: Extent overlap bugfix
+  * When ext4_ext_insert_extent() fails to insert new blocks
+  * Define/reserve new ext4 superblock fields
+  * msi: fix ARM compile
+  * PCI: disable MSI by default on systems with Serverworks HT1000 chips
+  * PCI: Fix pci_find_present
+  * PCI: i386: fixup for Siemens Nixdorf AG FSC Multiprocessor Interrupt
+    Controllers
+  * PCI: quirk disable MSI on via vt3351
+  * [XTENSA] fix bit operations in bitops.h
+  * [XTENSA] Spelling fixes in arch/xtensa
+  * [XTENSA] fix sources using deprecated assembler directive
+  * [XTENSA] Remove multi-exported symbols from xtensa_ksyms.c
+  * [XTENSA] Use generic 64-bit division
+  * [XTENSA] clean-up header files
+  * [XTENSA] Move common sections into bss sections
+  * [XTENSA] Remove non-rt signal handling
+  * Xtensa: use asm-generic/fcntl.h
+  * [JFFS2] Fix buffer length calculations in jffs2_get_inode_nodes()
+  * Fix vmi.c compilation
+  * x86_64: allocate sparsemem memmap above 4G
+  * Add select PHYLIB to the UCC_GETH Kconfig option
+  * Fix possible UDF data corruption
+  * m68k: parenthesis balance
+  * msi: fix the ordering of msix irqs
+  * msi: mask the msix vector before we unmap it
+  * potential parse error in ifdef
+  * parse errors in ifdefs
+  * pci_ids: update patch for Intel ICH9M
+  * x86: fix oprofile double free
+  * Work around Dell E520 BIOS reboot bug
+  * fix compat futex code for private futexes
+  * skeletonfb: fix of xxxfb_setup ifdef
+  * vt8623fb: arkfb: null pointer dereference fix
+  * cfag12864bfb: Use sys_ instead of cfb_ framebuffer accessors
+  * fbdev: Move declaration of fb_class to <linux/fb.h>
+  * misc/tifm_7xx1: replace deprecated irq flag
+  * add a trivial patch style checker
+  * Documentation: How to use GDB to decode OOPSes
+  * RTC: use fallback IRQ if PNP tables don't provide one
+  * memory hotplug: fix unnecessary calling of init_currenty_empty_zone()
+  * tty: fix leakage of -ERESTARTSYS to userland
+  * ISDN4Linux: fix maturity label
+  * Fix broken CLIR in isdn driver
+  * prism54: MAINTAINERS update
+  * atmel_spi dma address bugfix
+  * h8300 trival patches
+  * ALPHA: support graphics on non-zero PCI domains
+  * ALPHA: correct low-level I/O routines for sable-lynx
+  * ALPHA: misc fixes
+  * Better documentation for ERESTARTSYS
+  * serial_core.h: include <linux/sysrq.h>
+  * SPI: Freescale iMX SPI controller driver fixes
+  * SLUB: fix locking for hotplug callbacks
+  * pm3fb: switching between X and fb fix
+  * microcode: fix section mismatch warning
+  * isdn: fix section mismatch warnings
+  * acpi: fix section mismatch warning in asus + toshiba
+  * kvm: fix section mismatch warning in kvm-intel.o
+  * net/hp100: fix section mismatch warning
+  * timer statistics: fix race
+  * timer stats: speedups
+  * [SCSI] aacraid: fix shutdown handler to also disable interrupts.
+  * [MTD] Fix error checking after get_mtd_device() in get_sb_mtd functions
+  * [JFFS2] Fix obsoletion of metadata nodes in jffs2_add_tn_to_tree()
+  * ACPI: Section mismatch ... acpi_map_pxm_to_node
+  * ACPICA: Support for external package objects as method arguments
+  * Pull now into release branch
+  * Pull osi-now into release branch
+  * [POWERPC] Update documentation for of_find_node_by_type()
+  * [POWERPC] Fix ppc32 single-stepping out of syscalls
+  * [POWERPC] Fix compiler/assembler flags for Ebony platform boot files
+  * [POWERPC] Fix possible access to free pages
+  * [POWERPC] ps3/interrupt.c uses get_hard_smp_processor_id
+  * [POWERPC] pasemi idle uses hard_smp_processor_id
+  * [POWERPC] Create a zImage for legacy iSeries
+  * [POWERPC] Don't use HOSTCFLAGS in BOOTCFLAGS
+  * [POWERPC] Fix compile warning in pseries xics code
+  * [POWERPC] Fix return from pte_alloc_one() in out-of-memory case
+  * [POWERPC] Compare irq numbers with NO_IRQ not IRQ_NONE
+  * [POWERPC] Don't allow PMAC_APM_EMU for 64-bit
+  * [POWERPC] Fix compile breakage for IBM/AMCC 4xx arch/ppc platforms
+  * [POWERPC] Fix zImage.coff generation for 32-bit pmac
+  * [ARM] 4392/2: Do not corrupt the SP register in compressed/head.S
+  * [ARM] 4418/1: AT91: Number of programmable clocks differs
+  * [ARM] 4419/1: AT91: SAM9 USB clocks check for suspending
+  * [ARM] 4422/1: Fix default value handling in gpio_direction_output (PXA)
+  * [ARM] Solve buggy smp_processor_id() usage
+  * qla3xxx: device doesnt do hardware checksumming.
+  * VLAN: kill_vid is only useful for VLAN filtering devices
+  * sky2: Fix VLAN unregistration
+  * 8139cp: fix VLAN unregistration
+  * atl1: eliminate unneeded kill_vid code
+  * network drivers: eliminate unneeded kill_vid code
+  * e1000: disable polling before registering netdevice
+  * smc91x: sh solution engine fixes.
+  * Update tulip maintainer email address
+  * NetXen: Removal of extra free_irq call
+  * myri10ge: report link up/down in standard ethtool way
+  * NET: add MAINTAINERS entry for ucc_geth driver
+  * [ARM] 4421/1: AT91: Value of _KEY fields.
+  * [PARISC] Fix bug when syscall nr is __NR_Linux_syscalls
+  * [AF_UNIX]: Make socket locking much less confusing.
+  * [TG3]: Fix link problem on Dell's onboard 5906.
+  * [AF_UNIX]: Fix datagram connect race causing an OOPS.
+  * [TCP]: Use default 32768-61000 outgoing port range in all cases.
+  * [ATM]: Fix warning.
+  * [NET]: Make net watchdog timers 1 sec jiffy aligned.
+  * [NET]: Fix comparisons of unsigned < 0.
+  * [TCP]: Fix GSO ignorance of pkts_acked arg (cong.cntrl modules)
+  * [NET] gso: Fix GSO feature mask in sk_setup_caps
+  * [IPV4]: Fix "ipOutNoRoutes" counter error for TCP and UDP
+  * [ICMP]: Fix icmp_errors_use_inbound_ifaddr sysctl
+  * [VIDEO]: XVR500 and XVR2500 require FB=y
+  * [ATA]: Don't allow to enable this for SPARC64 without PCI.
+  * sh: Fix in_nmi symbol build error.
+  * sh: microdev: Fix compile warnings.
+  * sh: Fix SH4-202 clock fwk set_rate() mismatch.
+  * sh: voyagergx: Fix build warnings.
+  * sh: ioremap() through PMB needs asm/mmu.h.
+  * sh: Fix se73180 platform device registration.
+  * Input: ucb1x00 - do not access input_dev->private directly
+  * Input: reduce raciness when input handlers disconnect
+  * [PARISC] Fix kernel panic in check_ivt
+  * [SCSI] atari_NCR5380: update_timeout removal
+  * [SCSI] JAZZ ESP and SUN ESP need SPI_ATTRS
+  * [CIFS] fix mempool destroy done in wrong order in cifs error path
+  * SPI dynamic busid generation bugfix
+  * mtrr atomicity fix
+  * vanishing ioctl handler debugging
+  * libata: always use polling SETXFER
+  * Linux 2.6.22-rc4
+  * [SPARC64]: Move topology init code into new file, sysfs.c
+  * [SPARC64]: Export basic cpu properties via sysfs.
+  * [SPARC64]: Fix service channel hypervisor function names.
+  * [SPARC64]: Provide mmu statistics via sysfs.
+  * [SPARC64]: Proper multi-core scheduling support.
+  * [SPARC64]: Make core and sibling groups equal on UltraSPARC-IV.
+  * [SPARC64]: Fix {mc,smt}_capable().
+  * [SPARC64]: Fill in gaps in non-PCI dma_*() NOP implementation.
+  * [ATA]: Back out bogus (SPARC64 && !PCI) Kconfig depends.
+  * [VIDEO]: Fix section mismatch warning in promcon.
+  * [CIFS] whitespace cleanup
+  * [ARM] Fix 4417/1: Serial: Fix AMBA drivers locking
+  * [VIDEO] ffb: The pseudo_palette is only 16 elements long
+  * [ARM] pxa: fix pxa27x keyboard driver
+  * [VIDEO] sunxvr2500fb: Fix pseudo_palette array size
+  * [VIDEO] sunxvr500fb: Fix pseudo_palette array size
+  * [CIFS] whitespace cleanup part 2
+  * [CIFS] Missing flag on negprot needed for some servers to force packet
+    signing
+  * [MIPS] Atlas, Malta, SEAD: Remove scroll from interrupt handler.
+  * [MIPS] Remove duplicate fpu enable hazard code.
+  * [MIPS] EMMA2RH: remove dead KGDB code
+  * [MIPS] RM300: Fix MMIO problems by marking the PCI INT ACK region busy
+  * [MIPS] Fix VGA corruption on RM300C
+  * [MIPS] Drop __ARCH_WANT_SYS_FADVISE64
+  * [MIPS] Make dma_map_sg handle sg elements which are longer than one
+    page
+  * [MIPS] Fix some system calls with long long arguments
+  * [MIPS] Remove prototype for deleted function qemu_handle_int
+  * [MIPS] Fix some minor typoes in arch/mips/Kconfig.
+  * [MIPS] Fix warning by moving do_default_vi into CONFIG_CPU_MIPSR2_SRS
+  * [AGPGART] intel_agp: cleanup intel private data
+  * [AGPGART] intel_agp: use table for device probe
+  * [AGPGART] intel_agp: add support for 965GME/GLE
+  * [AGPGART] intel_agp: add support for 945GME
+  * [AGPGART] intel_agp: Add support for G33, Q33 and Q35 chipsets
+  * ocfs2: Fix masklog breakage
+  * ocfs2: Fix invalid assertion during write on 64k pages
+  * [POWERPC] pasemi: Fix iommu + 64K PAGE_SIZE bug
+  * [POWERPC] spufs: Refuse to load the module when not running on cell
+  * [POWERPC] spufs: Hook up spufs_release_mem
+  * [POWERPC] spufs: Fix gang destroy leaks
+  * [POWERPC] spufs: Free mm if spufs_fill_dir() failed
+  * [POWERPC] spufs: Synchronize pte invalidation vs ps close
+  * [POWERPC] spufs scheduler: Fix wakeup races
+  * [POWERPC] Fix pci_setup_phb_io_dynamic for pci_iomap
+  * [POWERPC] cbe_cpufreq: Limit frequency via cpufreq notifier chain
+  * [POWERPC] scc_sio: Fix link failure
+  * [POWERPC] Fix typo in booting-without-of-txt section numbering
+  * [POWERPC] spufs: Don't yield nosched context
+  * [POWERPC] Add table of contents to booting-without-of.txt
+  * [POWERPC] spufs: Fix error handling in spufs_fill_dir()
+  * mmc-atmel: remove linux/mmc/protocol.h dependencies
+  * au1xmmc: Replace C code with call to ARRAY_SIZE() macro.
+  * mmc: fix broken if clause
+  * mmc: don't call switch on old cards
+  * [POWERPC] Fix building of COFF zImages
+  * checkpatch.pl: should be executable
+  * Restrict clearing TIF_SIGPENDING
+  * mlx4_core: Fix CQ context layout
+  * mlx4_core: Initialize ctx_list and ctx_lock earlier
+  * mlx4_core: Free catastrophic error MSI-X interrupt with correct dev_id
+  * IB/mthca, mlx4_core: Fix typo in comment
+  * [BNX2]: Fix netdev watchdog on 5708.
+  * [BNX2]: Add missing wait in bnx2_init_5709_context().
+  * [BNX2]: Enable DMA on 5709.
+  * [BNX2]: Fix occasional counter corruption on 5708.
+  * [BNX2]: Update version and reldate.
+  * [TCP]: Honour sk_bound_dev_if in tcp_v4_send_ack
+  * [IPV4]: Only panic if inetdev_init fails for loopback
+  * [IPV4]: Convert IPv4 devconf to an array
+  * [IPV4]: Add default config support after inetdev_init
+  * [IPV4]: Restore old behaviour of default config values
+  * [RFKILL]: Make rfkill->name const
+  * [TCP]: Use LIMIT_NETDEBUG in tcp_retransmit_timer().
+  * [TCP] tcp_probe: Attach printf attribute properly to printl().
+  * [NETLINK]: Mark netlink policies const
+  * [RTNETLINK]: ifindex 0 does not exist
+  * [NETFILTER]: nf_conntrack: fix helper module unload races
+  * [NETFILTER]: ip_tables: fix compat related crash
+  * [NETFILTER]: nf_conntrack_amanda: fix textsearch_prepare() error check
+  * [AF_UNIX]: Fix stream recvmsg() race.
+  * [UDP]: Revert 2-pass hashing changes.
+  * [NET]: Avoid duplicate netlink notification when changing link state
+  * [NET_SCHED]: Fix filter double free
+  * xfrm: Add security check before flushing SAD/SPD
+  * [SPARC64]: Fix 2 bugs in PCI Sabre bus scanning.
+  * [SPARC64]: Fix SBUS IRQ regression caused by PCI-E driver.
+  * frv: build fix
+  * enable interrupts in user path of page fault.
+  * RAMFS NOMMU: missed POSIX UID/GID inode attribute checking
+  * [SPARC64]: Include <linux/rwsem.h> instead of <asm/rwsem.h>.
+  * [SPARC64]: Handle PCI bridges without 'ranges' property.
+  * mlx4_core: Check firmware command interface revision
+  * mlx4_core: Don't set MTT address in dMPT entries with PA set
+  * IB/mlx4: Fix zeroing of rnr_retry value in ib_modify_qp()
+  * RDMA/cma: Fix initialization of next_port
+  * IB/mlx4: Make sure RQ allocation is always valid
+  * splice: move inode size check into generic_file_splice_read()
+  * splice: remove do_splice_direct() symbol export
+  * pipe: move pipe_inode_info structure decleration up before it's used
+  * splice: move balance_dirty_pages_ratelimited() outside of splice actor
+  * splice: __generic_file_splice_read: fix i_size_read() length checks
+  * splice: __generic_file_splice_read: fix read/truncate race
+  * V4L/DVB (5702): Fix Kconfig items to avoid linkedition errors
+  * V4L/DVB (5700): Saa7111: fix picture settings cache bug
+  * V4L/DVB (5699): Cinergyt2: fix file release handler
+  * V4L/DVB (5675): Move big PIO accesses from the interrupt handler to a
+    workhandler
+  * V4L/DVB (5716): Tda10086,tda826x: fix tuning, STR/SNR values
+  * V4L/DVB (5720): Usbvision: fix urb allocation and submits
+  * V4L/DVB (5730): Remove unused V4L2_CAP_VIDEO_OUTPUT_POS
+  * V4L/DVB (5732): Add ivtv CROPCAP support and fix ivtv S_CROP for video
+    output.
+  * V4L/DVB (5736): Add V4L2_FBUF_CAP/FLAG_LOCAL/GLOBAL_INV_ALPHA
+  * V4L/DVB (5673): Fix audio stuttering for saa711x/ivtv when in radio
+    mode.
+  * V4L/DVB (5761): Fix broken b2c2 dependency on non x86 architectures
+  * V4L/DVB (5751): Ivtv: fix ia64 printk format warnings.
+  * serverworks: remove crappy code
+  * serverworks: fix CSB6 tuning logic
+  * it821x: RAID mode fixes
+  * ide: HPA detect from resume
+  * ide: generic IDE PCI driver, add another device exception
+  * hpt366: disallow Ultra133 for HPT374
+  * Add the PATA controller device ID to pci_ids.h for MCP73/MCP77.
+  * ide: Add the MCP73/77 support to PATA driver
+  * [CIFS] CIFS should honour umask
+  * update Documentation/driver-model/platform.txt
+  * Driver core: keep PHYSDEV for old struct class_device
+  * Driver core: kill unused code
+  * kobject: use the proper printk level for kobject error
+  * firmware: remove orphaned Email
+  * [IPV4]: Do not remove idev when addresses are cleared
+  * [NetLabel]: consolidate the struct socket/sock handling to just struct
+    sock
+  * [CIPSO]: Fix several unaligned kernel accesses in the CIPSO engine.
+  * USB: set default y for CONFIG_USB_DEVICE_CLASS
+  * usblp: Don't let suspend to kill ->used
+  * USB: usb gadgets avoid le{16,32}_to_cpup()
+  * USB: UNUSUAL_DEV: Sync up some reported devices from Ubuntu
+  * USB: cxacru: add Documentation file
+  * USB: cxacru: create sysfs attributes in atm_start instead of bind
+  * USB: cxacru: ignore error trying to start ADSL in atm_start
+  * USB: Fix up bogus bInterval values in endpoint descriptors
+  * OHCI: Fix machine check in ohci_hub_status_data
+  * update checkpatch.pl to version 0.03
+  * m68knommu: fix ColdFire timer off by 1
+  * nommu: report correct errno in message
+  * loop: preallocate eight loop devices
+  * document Acked-by:
+  * update feature-removal-schedule.txt to include deprecated functions
+  * mount -t tmpfs -o mpol=: check nodes online
+  * slab: fix alien cache handling
+  * potential parse error in ifdef part 3
+  * SLUB: return ZERO_SIZE_PTR for kmalloc(0)
+  * uml: fix kernel stack size on x86_64
+  * Documentation/atomic_ops.txt typo fix
+  * Move three functions that are only needed for CONFIG_MEMORY_HOTPLUG
+  * Char: stallion, don't fail with less than max panels
+  * Char: stallion, alloc tty before pci devices init
+  * Char: stallion, proper fail return values
+  * uml: get declaration of simple_strtoul
+  * isdn/diva: fix section mismatch
+  * sata_promise: use TF interface for polling NODATA commands
+  * rt-mutex: fix stale return value
+  * rt-mutex: fix chain walk early wakeup bug
+  * pi-futex: fix exit races and locking problems
+  * fix sysrq-m oops
+  * x86_64: oops_begin() fix
+  * reiserfs: mailing list has moved
+  * checkpatch: produce fewer lines of output
+  * MAINTAINERS: corrections
+  * hexdump: more output formatting
+  * update checkpatch.pl to version 0.04
+  * Protect <linux/console_struct.h> from multiple inclusion
+  * [IrDA]: Fix Rx/Tx path race.
+  * [IrDA]: f-timer reloading when sending rejected frames.
+  * ibmveth: Fix h_free_logical_lan error on pool resize
+  * ibmveth: Automatically enable larger rx buffer pools for larger mtu
+  * typo in via-velocity.c
+  * NetXen: Fix ping issue after reboot on Blades with 3.4.19 firmware
+  * NetXen: Fix compile failure seen on PPC architecture
+  * ehea: Fixed possible kernel panic on VLAN packet recv
+  * phylib: add RGMII-ID mode to the Marvell m88e1111 PHY to fix broken
+    ucc_geth
+  * net: fix typo in drivers/net/usb/Kconfig
+  * remove unused variable in pata_isapnp
+  * libata: disable NCQ for HITACHI HTS541680J9SA00/SB21C7EP
+  * libata: fix probe time irq printouts
+  * libata: print device model and firmware revision for ATAPI devices
+  * libata: fix hw_sata_spd_limit initialization
+  * ahci: Add MCP73/MCP77 support to AHCI driver
+  * libata-core/sff: Fix multiple assumptions about DMA
+  * libata: Correct abuse of language
+  * libata passthru: update protocol numbers
+  * libata passthru: support PIO multi commands
+  * libata passthru: map UDMA protocols
+  * libata passthru: always enforce correct DEV bit
+  * libata passthru: update cached device paramters
+  * i915: add new pciids for 945GME, 965GME/GLE
+  * drm/i915:  Add support for the G33, Q33, and Q35 chipsets.
+  * drm: fix radeon setparam on 32/64 bit systems.
+  * [ARM] VFP: fix section mismatch error
+  * libata: force PIO on IOMEGA ZIP 250 ATAPI
+  * libata: limit post SRST nsect/lbal wait to ~100ms
+  * Blackfin arch: remove defconfig file
+  * Blackfin arch: DMA code minor naming convention fix
+  * Blackfin arch: spelling fixes
+  * Blackfin arch:  fix bug ad1836 fails to build properly for BF533-EZKIT
+  * Blackfin arch: all symbols were offset by 4k, since we didn't have the
+    __text label.
+  * Blackfin arch: mark our memory init functions with __init so they get
+    freed after init
+  * Blackfin arch: implement a basic /proc/sram file for L1 allocation
+    visibility
+  * Blackfin arch: fixup Blackfin MAINTIANERS team member list
+  * Blackfin arch: scrub old console defines
+  * Blackfin arch: update defconfigs
+  * Blackfin arch: unify differences between our diff head.S files -- no
+    functional changes
+  * Blackfin arch: move more of our startup code to .init so it can be
+    freed once we are up and running
+  * Blackfin arch: add proper ENDPROC()
+  * Blackfin arch: try to split up functions like this into smaller units
+    according to LKML review
+  * Blackfin arch: fix spelling typo in output
+  * Blackfin arch: As Mike pointed out range goes form m..MAX_BLACKFIN_GPIO
+    -1
+  * Blackfin arch: add missing gpio.h header to fix compiling in some pm
+    configurations
+  * Blackfin arch: add support for Alon Bar-Lev's dynamic kernel
+    command-line
+  * Blackfin arch: fix bug can not wakeup from sleep via push buttons
+  * Blackfin arch: make sure we initialize our L1 Data B section properly
+    based on the linked kernel
+  * Blackfin arch: redo our linker script a bit
+  * Blackfin arch: move HI/LO macros into blackfin.h and punt the rest of
+    macros.h as it includes VDSP macros we never use
+  * Blackfin serial driver: hook up our UARTs STP bit with userspaces
+    CMSPAR
+  * Blackfin serial driver: ignore framing and parity errors
+  * Blackfin serial driver: actually implement the break_ctl() function
+  * Blackfin serial driver: decouple PARODD and CMSPAR checking from PARENB
+  * Blackfin RTC drivers: update MAINTAINERS information
+  * Blackfin SPI driver: tweak spi cleanup function to match newer kernel
+    changes
+  * [ARM] 4442/1: OSIRIS: Fix CPLD register definitions
+  * [ARM] 4443/1: OSIRIS: Add watchdog device to machine devices
+  * [ARM] 4444/2: OSIRIS: CPLD suspend fix
+  * [ARM] 4445/1: ANUBIS: Fix CPLD registers
+  * Blackfin SPI driver: fix bug SPI DMA incomplete transmission
+  * Blackfin SMC91X ethernet supporting driver: SMC91C111 LEDs are note
+    drived in the kernel like in uboot
+  * [MIPS] Fix KMODE for the R3000
+  * [MIPS] SMTC: Don't set and restore irqregs ptr from self_ipi.
+  * [MIPS] Always install the DSP exception handler.
+  * [MIPS] Atlas: Fix build.
+  * [MIPS] Wire up utimensat, signalfd, timerfd, eventfd
+  * [MIPS] SMTC: Fix warning.
+  * [MIPS] SMTC: Don't continue in set_vi_srs_handler on detected bad
+    arguments.
+  * [MIPS] SMTC: The MT ASE requires to initialize c0_pagemask and
+    c0_wired.
+  * [MIPS] SMTC: Fix build error caused by nonsense code.
+  * [MIPS] Fix modpost warnings by making start_secondary __cpuinit
+  * [MIPS] Fix IP27 build
+  * [MIPS] Fix smp barriers in test_and_{change,clear,set}_bit
+  * libertas: scan two channels per scan command
+  * libertas: rename wlan_association_worker
+  * libertas: a debug output was missing a newline
+  * libertas: fix removal of all debugfs files
+  * libertas: remove deprecated pm_register and associated code
+  * libertas: remove __FILE__ from debug output
+  * libertas: remove unused/superfluous definitions of DEV_NAME_LEN
+  * libertas: move vendor & product id's into if_usb.c
+  * libertas: make libertas_wlan_data_rates static
+  * libertas: fix scanning from associate path
+  * libertas: exclude non-used code when PROC_DEBUG is not set
+  * libertas: make debug configurable
+  * libertas: tune debug code
+  * libertas: single out mesh code
+  * libertas: change debug output of libertas_interrupt()
+  * libertas: get rid of libertas_sbi_get_priv()
+  * libertas: fix SSID output
+  * libertas: changed some occurences of kmalloc() + memset(&a,0,sz) to
+    kzalloc()
+  * libertas: move reset_device() code main.c to if_usb.c
+  * libertas: split wlan_add_card()
+  * libertas: fixed transmission flow control on the mesh interface
+  * libertas: fix error handling of card initialization
+  * libertas: added transmission failures to mesh statistics
+  * libertas: wakeup both mesh and normal wakeup when getting out of scan
+  * libertas: indirect all hardware access via hw_XXXX functions
+  * libertas: move contents of fw.h to decl.h
+  * libertas: split module into two (libertas.ko and usb8xxx.ko)
+  * libertas: fix RESET logic at unload time
+  * libertas: let DRV_NAME be overridable
+  * libertas: remove unused variables in wlan_dev_t
+  * libertas: fixed incorrect assigment of fcs errors to frag errors
+  * libertas: add URB debug info
+  * libertas: fixed kernel oops on module/card removal
+  * libertas: call SET_NETDEV_DEV from common code
+  * libertas: replace 'macaddress' with 'bssid'
+  * libertas: correctly unregister mesh netdev on error
+  * libertas: don't tear down netdev in libertas_activate_card
+  * libertas: version bump (321p0) and cmds update for new fw (5.220.10.p0)
+  * libertas: updated mesh commands for 5.220.9.p11
+  * libertas: make scan result handling more flexible
+  * libertas: fix 'keep previous scan' behavior
+  * libertas: cleanup of fwt_list_route processing
+  * libertas: fix oops on rmmod
+  * libertas: move channel changing into association framework
+  * libertas: make association paths consistent
+  * libertas: use MAC_FMT and MAC_ARG where appropriate
+  * libertas: use compare_ether_addr() rather than memcmp() where
+    appropriate
+  * libertas: fix debug enter/leave prints for
+    libertas_execute_next_command
+  * libertas: correctly balance locking in libertas_process_rx_command
+  * libertas: correct error report paths for wlan_fwt_list_ioctl
+  * libertas: fix deadlock SIOCGIWSCAN handler
+  * libertas: fix default adhoc channel
+  * libertas: honor specific channel requests during association
+  * libertas: send SIOCGIWSCAN event after partial scans too
+  * libertas: debug print spacing fixes in assoc.c
+  * libertas: add more verbose debugging to libertas_cmd_80211_authenticate
+  * libertas: Make WPA work through supplicant handshake
+  * libertas: updated readme file
+  * libertas: make mac address configuration work with mesh interface too
+  * libertas: split wext for eth and msh
+  * libertas: support for mesh autostart on firmware 5.220.11
+  * libertas: fix character set in README
+  * libertas: sparse fixes
+  * libertas: first pass at fixing up endianness issues
+  * libertas: More endianness fixes.
+  * libertas: more endianness fixes, in tx.c this time
+  * libertas: don't byte-swap firmware version number. It's a byte array.
+  * libertas: fix big-endian associate command.
+  * libertas: tweak association debug output
+  * libertas: remove structure WLAN_802_11_SSID and libertas_escape_essid
+  * libertas: remove WPA_SUPPLICANT structure
+  * libertas: reduce SSID and BSSID mixed-case abuse
+  * kbuild: fix sh64 section mismatch problems
+  * cfg80211: fix signed macaddress in sysfs
+  * mac80211: fix debugfs tx power reduction output
+  * mac80211: Don't stop tx queue on master device while scanning.
+  * Input: usbtouchscreen - fix fallout caused by move from drivers/usb
+  * Input: i8042 - add ASUS P65UP5 to the noloop list
+  * Input: i8042 - add ULI EV4873 to noloop list
+  * [PARISC] remove global_ack_eiem
+  * libertas: pull current channel from firmware on mesh autostart
+  * libertas: deauthenticate from AP in channel switch
+  * libertas: actually send mesh frames to mesh netdev
+  * libertas: convert libertas_mpp into anycast_mask
+  * [PPP_MPPE]: Fix "osize too small" check.
+  * NetXen: Fix link status messages
+  * myri10ge: limit the number of recoveries
+  * myri10ge: report when the link partner is running in Myrinet mode
+  * myri10ge: update driver version
+  * sysfs: store sysfs inode nrs in s_ino to avoid readdir oopses
+  * sysfs: fix condition check in sysfs_drop_dentry()
+  * sysfs: fix race condition around sd->s_dentry, take#2
+  * [TCP]: Fix left_out setting during FRTO
+  * Input: move input-polldev to drivers/input
+  * [SPARC64]: Wire up cookie based sun4v interrupt registry.
+  * [SPARC64]: Fix IO/MEM space sizing for PCI.
+  * [SPARC64]: Really fix parport.
+  * [SPARC64]: Fix args to sun4v_ldc_revoke().
+  * [TCP]: Set initial_ssthresh default to zero in Cubic and BIC.
+  * mmc-omap: fix sd response type 6 vs. 1
+  * mmc: get back read-only switch function
+  * [SCTP]: Correctly set daddr for IPv6 sockets during peeloff
+  * [SCTP]: Allow unspecified port in sctp_bindx()
+  * [SCTP] Fix leak in sctp_getsockopt_local_addrs when copy_to_user fails
+  * [SCTP] Update pmtu handling to be similar to tcp
+  * [SCTP] Flag a pmtu change request
+  * [SCTP] Don't disable PMTU discovery when mtu is small
+  * [POWERPC] Fix per-cpu allocation on oldworld SMP powermacs
+  * [POWERPC] Fix console output getting dropped on platforms without
+    udbg_putc
+  * [AVR32] ratelimit segfault reporting rate
+  * [AVR32] gpio_*_cansleep() fix
+  * [AVR32] STK1000: Set SPI_MODE_3 in the ltv350qv board info
+  * [AVR32] Define ARCH_KMALLOC_MINALIGN to L1_CACHE_BYTES
+  * [MIPS] Malta: Fix for SOCitSC based Maltas
+  * [MIPS] Separate performance counter interrupts
+  * [MIPS] Fix builds where MSC01E_xxx is undefined.
+  * [TCP]: Add missing break to TCP option parsing code
+  * [IPV6] addrconf: Fix IPv6 on tuntap tunnels
+  * [AGPGART] intel_agp: fix device probe
+  * KVM: Prevent guest fpu state from leaking into the host
+  * splice: adjust balance_dirty_pages_ratelimited() call
+  * splice: fix leak of pages on short splice to pipe
+  * splice: only check do_wakeup in splice_to_pipe() for a real pipe
+  * [TCP]: Congestion control API RTT sampling fix
+  * [TCP]: Fix logic breakage due to DSACK separation
+  * [RXRPC] net/rxrpc/ar-connection.c: fix NULL dereference
+  * block: always requeue !fs requests at the front
+  * mm: Fix memory/cpu hotplug section mismatch and oops.
+  * Resume from RAM on HPC nx6325 broken
+  * ide-scsi: fix OOPS in idescsi_expiry()
+  * fix radeon setparam on 32/64 systems, harder.
+  * tty: restore locked ioctl file op
+  * i386: fix NMI watchdog not reserving its MSRs
+  * i386: use the right wrapper to disable the NMI watchdog
+  * SLUB slab validation: Alloc while interrupts are disabled must use
+    GFP_ATOMIC
+  * Restore shmid as inode# to fix /proc/pid/maps ABI breakage
+  * i386 mm: use pte_update() in ptep_test_and_clear_dirty()
+  * cpuset: zero malloc - fix for old cpusets
+  * toshiba_acpi: fix section mismatch in allyesconfig
+  * swsusp: Fix userland interface
+  * perfctr-watchdog: fix interchanged parameters to
+    release_{evntsel,perfctr}_nmi
+  * fuse: ->fs_flags fixlet
+  * md: fix two raid10 bugs
+  * md: fix bug in error handling during raid1 repair
+  * spi doc updates
+  * uml: remove PAGE_SIZE from libc code
+  * uml: kill x86_64 STACK_TOP_MAX
+  * random: fix output buffer folding
+  * Rework ptep_set_access_flags and fix sun4c
+  * SLUB: minimum alignment fixes
+  * udf: fix possible leakage of blocks
+  * hugetlb: fix get_policy for stacked shared memory files
+  * shm: fix the filename of hugetlb sysv shared memory
+  * Linux 2.6.22-rc5
+  * [GFS2] flush the glock completely in inode_go_sync
+  * [DLM] fix a couple of races
+  * [GFS2] kernel changes to support new gfs2_grow command
+  * [GFS2] Kernel changes to support new gfs2_grow command (part 2)
+  * [GFS2] use zero_user_page
+  * [GFS2] Addendum patch 2 for gfs2_grow
+  * [GFS2] Reduce size of struct gdlm_lock
+  * [GFS2] Clean up inode number handling
+  * [GFS2] Quotas non-functional - fix bug
+  * [DLM] keep dlm from panicing when traversing rsb list in debugfs
+  * [DLM] block scand during recovery [1/6]
+  * [DLM] add lock timeouts and warnings [2/6]
+  * [DLM] dlm_device interface changes [3/6]
+  * [DLM] cancel in conversion deadlock [4/6]
+  * [DLM] fix new_lockspace error exit [5/6]
+  * [DLM] wait for config check during join [6/6]
+  * [DLM] fix compile breakage
+  * [GFS2] latest gfs2-nmw headers break userland build
+  * [DLM] Compile fix
+  * [DLM] timeout fixes
+  * [DLM] canceling deadlocked lock
+  * [DLM] dumping master locks
+  * [DLM] show default protocol
+  * [GFS2] Quotas non-functional - fix another bug
+  * [GFS2] Make the log reserved blocks depend on block size
+  * [DLM] fix socket shutdown
+  * [GFS2] fix jdata issues
+  * [GFS2] Fix sign problem in quota/statfs and cleanup _host structures
+  * [GFS2] Add nanosecond timestamp feature
+  * [DLM] fix reference counting
+  * [DLM] variable allocation
+  * [GFS2] Fix typo in rename of directories
+  * [GFS2] Fix bug in error path of inode
+  * [GFS2] Can't mount GFS2 file system on AoE device
+  * [GFS2] Recovery for lost unlinked inodes
+  * [GFS2] gfs2_lookupi() uninitialised var fix
+  * [GFS2] set plock owner in GETLK info
+  * [GFS2] return conflicts for GETLK
+  * [GFS2] Fix deallocation issues
+  * [DLM] don't require FS flag on all nodes
+  * [GFS2] Journaled file write/unstuff bug
+  * [GFS2] Remove bogus '\0' in rgrp.c
+  * [GFS2] Use zero_user_page() in stuffed_readpage()
+  * [GFS2] assertion failure after writing to journaled file, umount
+  * [GFS2] Simplify multiple glock aquisition
+  * [GFS2] Addendum to the journaled file/unmount patch
+
+ -- Ben Collins <bcollins@ubuntu.com>  Fri, 01 Jun 2007 12:15:58 -0400
+
+linux-source-2.6.22 (2.6.22-6.13) gutsy; urgency=low
+
+  [Ben Collins]
+
+  * Bump ABI
+  * build/scripts: Remove all remnants of debconf from control scripts
+  * build/config: Re-enable paravirt/vmi
+  * build/config: Build ide-core as a module
+  * i386/x86_64: Allow disabling the putstr's from compressed boot wrapper
+  * PM: Do not require dev spew to get PM_DEBUG
+  * RTC: Ratelimit "lost interrupts" message
+  * UNUSUAL_DEV: Sync up some reported devices from Ubuntu
+  * build/d-i: Include ide-core in storage-core udeb, not that it's modular
+  * build/d-i: Make ide-modules depend on storage-code-modules
+  * build/config: Enable CONFIG_TIMER_STATS on x86_64.
+  * build/config: Disable CONFIG_RTC_DRV_CMOS
+  * build/config: Enable TIMER_STATS everywhere.
+  * build/config: Enable SND_AC97_POWER_SAVE
+    - LP: #116679
+  * kmod: Improve call_usermodehelper_pipe to handle data close
+  * coredump: Convert to new call_usermodehelper_pipe symantics
+  * PPC: Only set hwif stuff when ide-core is non-modular
+  * PPC/MEDIABAY: Export some functions for modular ide-core/ppc-ide
+
+  [Colin Watson]
+
+  * Move isofs to storage-core-modules udeb from fs-core-modules.
+
+  [Upstream Kernel Changes]
+
+  * Input: logips2pp - add type 72 (PS/2 TrackMan Marble)
+  * Input: adbhid - do not access input_dev->private directly
+  * sh: Shut up compiler warnings in __do_page_fault().
+  * sh: Fix up psw build rules for r7780rp.
+  * sh: Kill off pmb slab cache destructor.
+  * sh: landisk: rtc-rs5c313 support.
+  * sh: landisk: Header cleanups.
+  * input: hp680_ts compile fixes.
+  * [ARM] 4375/1: sharpsl_pm: Fix compile warnings
+  * [ARM] 4376/1: Selects GENERIC_GPIO for ARCH_IXP4XX in Kconfig
+  * [ARM] 4378/1: KS8695: Serial driver fix
+  * [ARM] Remove Integrator/CP SMP platform support
+  * [ARM] 4382/1: iop13xx: fix msi support
+  * [ARM] 4383/1: iop: fix usage of '__init' and 'inline' in iop files
+  * [ARM] 4384/1: S3C2412/13 SPI registers offset correction
+  * [ARM] Update ARM syscalls
+  * [ARM] Silence OMAP kernel configuration warning
+  * [ARM] gic: Fix gic cascade irq handling
+  * [ARM] integrator: fix pci_v3 compile error with DEBUG_LL
+  * [ARM] ARMv6: add CPU_HAS_ASID configuration
+  * [CRYPTO] padlock: Make CRYPTO_DEV_PADLOCK a tristate again
+  * [CRYPTO] tcrypt: Add missing error check
+  * eventfd use waitqueue lock ...
+  * timerfd use waitqueue lock ...
+  * [IA64] Fix bogus messages about system calls not implemented.
+  * [IA64] Yet another section mismatch warning
+  * Fix roundup_pow_of_two(1)
+  * Further update of the i386 boot documentation
+  * cciss: Fix pci_driver.shutdown while device is still active
+  * Linux v2.6.22-rc2
+  * [CRYPTO] api: Read module pointer before freeing algorithm
+  * powerpc: Fix the MODALIAS generation in modpost for of devices
+  * kbuild: include limits.h in sumversion.c for PATH_MAX
+  * kconfig: search harder for curses library in check-lxdialog.sh
+  * kbuild: make modpost section warnings clearer
+  * kbuild: make better section mismatch reports on i386, arm and mips
+  * kbuild: add "Section mismatch" warning whitelist for powerpc
+  * all-archs: consolidate .text section definition in asm-generic
+  * all-archs: consolidate .data section definition in asm-generic
+  * kbuild: introduce __init_refok/__initdata_refok to supress section
+    mismatch warnings
+  * init/main: use __init_refok to fix section mismatch
+  * mm: fix section mismatch warnings
+  * mm/slab: fix section mismatch warning
+  * IB/core: Free umem when mm is already gone
+  * IB/ipath: Fix potential deadlock with multicast spinlocks
+  * IB/core: Add helpers for uncached GID and P_Key searches
+  * IB/core: Use start_port() and end_port()
+  * IPoIB: Handle P_Key table reordering
+  * IB/ehca: Return proper error code if register_mr fails
+  * IB/mthca: Fix use-after-free on device restart
+  * IB/mlx4: Fix check of max_qp_dest_rdma in modify QP
+  * IB/mthca: Set GRH:HopLimit when building MLX headers
+  * IB/mlx4: Set GRH:HopLimit when sending globally routed MADs
+  * IB/mthca: Fix RESET to ERROR transition
+  * IB/mlx4: Fix RESET to RESET and RESET to ERROR transitions
+  * mlx4_core: Fix array overrun in dump_dev_cap_flags()
+  * IB/mlx4: Fix check of opcode in mlx4_ib_post_send()
+  * [IPV6]: Add ip6_tunnel.h to headers_install
+  * [RFKILL]: Fix check for correct rfkill allocation
+  * [NET]: Fix net/core/skbuff.c gcc-3.2.3 compilation error
+  * [TCP] FRTO: Add missing ECN CWR sending to one of the responses
+  * [TCP] FRTO: Prevent state inconsistency in corner cases
+  * [IPSEC] pfkey: Load specific algorithm in pfkey_add rather than all
+  * [NETFILTER]: nf_conntrack: fix use-after-free in helper destroy
+    callback invocation
+  * [NETFILTER]: nf_conntrack_ipv4: fix incorrect #ifdef config name
+  * [IPV4]: icmp: fix crash with sysctl_icmp_errors_use_inbound_ifaddr
+  * [NET]: Fix race condition about network device name allocation.
+  * IB/mlx4: Pass send queue sizes from userspace to kernel
+  * [ARM] 4387/1: fix /proc/cpuinfo formatting for pre-ARM7 parts
+  * [ARM] 4388/1: no need for arm/mm mmap range checks for non-mmu
+  * [ARM] 4395/1: S3C24XX: add include of <linux/sysdev.h> to relevant
+    machines
+  * [ARM] 4396/1: S3C2443: Add missing HCLK clocks
+  * [ARM] 4397/1: S3C2443: remove SDI0/1 IRQ ambiguity
+  * [ARM] 4398/1: S3C2443: Fix watchdog IRQ number
+  * [ARM] 4399/2: S3C2443: Fix SMDK2443 nand timings
+  * [ARM] 4400/1: S3C24XX: Add high-speed MMC device definition
+  * [ARM] at91_adc parenthesis balance
+  * [ARM] spelling fixes
+  * IB/mlx4: Check if SRQ is full when posting receive
+  * spelling fixes: arch/sh/
+  * sh: revert addition of page fault notifiers
+  * sh: Wire up signalfd/timerfd/eventfd syscalls.
+  * sh: Fix up various compile warnings for SE boards.
+  * sh: Fix page size alignment in __copy_user_page().
+  * sh: Disable psw support for R7785RP.
+  * fs: Kill sh dependency for binfmt_flat.
+  * sh: disable genrtc support.
+  * sh: sr.bl toggling around idle sleep.
+  * sh: Wire up kdump crash kernel exec in die().
+  * sh: Fix clock multiplier on SH7722.
+  * sh: Fix dreamcast build for IRQ changes.
+  * [S390] cio: Update documentation.
+  * [S390] Wire up sys_utimensat.
+  * [S390] Wire up signald, timerfd and eventfd syscalls.
+  * [S390] Make use of kretprobe_assert.
+  * [S390] More verbose show_mem() like other architectures.
+  * Fix "fs: convert core functions to zero_user_page"
+  * Detach sched.h from mm.h
+  * Blackfin arch: Add Workaround for ANOMALY 05000257
+  * Blackfin arch: add SPI MMC driver support on bf533-stamp, tested on
+    STAMP-BF533
+  * Blackfin arch: ISP1761 doesn't work for USB flash disk
+  * Blackfin arch: fix a few random warnings
+  * Blackfin arch: Add configuration data for ISP176x on BF561
+  * Blackfin arch: mark a bunch of local functions as static
+  * Blackfin arch: Fix reserved map after we changed PORT_H definition
+  * Blackfin arch: Move write to VR_CTL closer to IDLE
+  * Blackfin arch: DMA operation cleanup
+  * Blackfin arch: GPIO fix some defines
+  * Blackfin arch: fix trace output for FLAT binaries
+  * Blackfin arch: Fix bug using usb keyboard crashes kernel
+  * Blackfin arch: initial tepla-bf561 board support
+  * Blackfin arch: make sure we declare the revid functions as pure (since
+    they are)
+  * Blackfin arch: dont clear status register bits in SWRST so we can
+    actually use it
+  * Blackfin arch: finish removing p* volatile defines for MMRs
+  * Blackfin arch: move board specific setup out of common init code and
+    into the board specific init code
+  * Blackfin arch: issue reset via SWRST so we dont clobber the watchdog
+    state
+  * Blackfin arch: document why we have to touch the UART peripheral in our
+    boot up code
+  * Blackfin arch: dma_memcpy borken for > 64K
+  * Blackfin arch: dont clear the bit that tells coreb to start booting
+  * Blackfin arch: make sure we use local labels
+  * Blackfin arch: update blackfin header files to latest one in VDSP.
+  * Blackfin arch: cache SWRST value at bootup so other things like
+    watchdog can non-destructively query it
+  * Blackfin arch: fix signal handling bug
+  * Blackfin arch: Change NO_ACCESS_CHECK to ACCESS_CHECK
+  * Blackfin arch: add board default configs to blackfin arch
+  * Blackfin arch: update defconfig files
+  * Blackfin arch: update pm.c according to power management API change.
+  * Blackfin serial driver: fix overhead issue
+  * Blackfin serial driver: implement support for ignoring parity/break
+    errors
+  * Blackfin SPI: cleanup according to David Brownell's review
+  * x86_64: Update defconfig
+  * i386: Update defconfig
+  * x86_64: Support x86_64 in make buildtar
+  * i386: Fix K8/core2 oprofile on multiple CPUs
+  * x86_64: Support gcc 5 properly
+  * i386: Clear MCE flag on AMD K6
+  * i386: Fix wrong CPU error message in early boot path
+  * i386: Enable CX8/PGE CPUID bits early on VIA C3
+  * x86_64: early_print kernel console should send CRLF not LFCR
+  * x86_64: vsyscall time() fix
+  * i386: fix PGE mask
+  * LDM: Fix for Windows Vista dynamic disks
+  * IB/ipoib: Fix typos in error messages
+  * IPoIB/cm: Fix SRQ WR leak
+  * IB/cm: Improve local id allocation
+  * e1000: Don't enable polling in open() (was: e1000: assertion hit in
+    e1000_clean(), kernel 2.6.21.1)
+  * declance: Remove a dangling spin_unlock_irq() thingy
+  * Add constant for FCS/CRC length (frame check sequence)
+  * ahci: disable 64bit dma on sb600
+  * libata: Add Seagate STT20000A to DMA blacklist.
+  * pata_hpt366: Enable bits are unreliable so don't use them
+  * ata_piix: clean up
+  * libata: Kiss post_set_mode goodbye
+  * libata: Trim trailing whitespace
+  * partitions/LDM: build fix
+  * Make 'headerscheck' stop immediately on an error
+  * Fix headers check fallout
+  * [POWERPC] Fix smp_call_function to be preempt-safe
+  * [POWERPC] Add missing pmc_type fields in cpu_table
+  * [POWERPC] Fix typo: MMCR0_PMA0 != MMCR0_PMAO
+  * [POWERPC] Fix powerpc vmlinux.lds.S
+  * [POWERPC] Fix warning in 32-bit builds with CONFIG_HIGHMEM
+  * libertas: skb dereferenced after netif_rx
+  * drivers/net/wireless/libertas/fw.c: fix use-before-check
+  * drivers/net/wireless/libertas/rx.c: fix use-after-free
+  * [IA64] Improve unwind checking.
+  * [IA64] Only unwind non-running tasks.
+  * [IA64] fix kmalloc(0) in arch/ia64/pci/pci.c
+  * i2c: Legacy i2c drivers shouldn't issue uevents
+  * i2c-tiny-usb: Fix truncated adapter name
+  * i2c-s3c2410: Fix build warning
+  * V4L/DVB (5639): Fix Kconfig dependencies for ivtv
+  * V4L/DVB (5640): Fix: em28xx shouldn't be selecting VIDEO_BUF
+  * V4L/DVB (5670): Adding new fields to v4l2_pix_format broke the ABI,
+    reverted that change
+  * V4L/DVB (5639a): Fix dst usage count
+  * V4L/DVB (5630): Dvb-core: Handle failures to create devices
+  * V4L/DVB (5680): Tuner-simple.c fix suport for SECAM with FI1216MF
+  * V4L/DVB (5690): Cafe_ccic: Properly power down the sensor
+  * V4L/DVB (5691): Ov7670: reset clkrc in rgb565 mode
+  * [IPSEC]: Fix warnings with casting int to pointer
+  * [AF_RXRPC]: AF_RXRPC depends on IPv4
+  * [AF_RXRPC]: Make call state names available if CONFIG_PROC_FS=n
+  * [RTNETLINK]: Allow changing of subsets of netdevice flags in
+    rtnl_setlink
+  * [RTNETLINK]: Remove remains of wireless extensions over rtnetlink
+  * Input: iforce - fix force feedback not working
+  * Input: iforce - minor clean-ups
+  * Input: ALPS - force stream mode
+  * Input: ucb1400_ts - use sched_setscheduler()
+  * Input: ucb1x00-ts - remove commented out code
+  * Input: input-polldev - add module info
+  * Input: ads7846 - document that it handles tsc2046 too
+  * Input: ads7846 - SPI_CPHA mode bugfix
+  * USB: fix omninet memory leak found by coverity
+  * USB: remove useless check in mos7840 found by coverity
+  * usb-storage: ignore Sitecom WL-117 USB-WLAN
+  * USB: fix more ftdi-elan/u132-hcd #include lossage
+  * USB: handle more rndis_host oddities
+  * USB: remove usb DocBook warnings
+  * USB: address FIXME in usbnet w.r.t drivers claiming multiple interfaces
+  * EHCI: fix problem with BIOS handoff
+  * USB: more autosuspend timer stuff
+  * USB: remove unneeded WARN_ON
+  * USB: New device PID for ftdi_sio driver
+  * USB: set the correct Interrupt interval in usb_bulk_msg
+  * USB: fsl_usb2_udc: Fix UMTI_WIDE support and a compile warning
+  * USB: auerswald: fix file release handler
+  * USB: Remove duplicate IDs from option card driver
+  * USB: Deref URB after usbmon is done with it
+  * USB: remove short initial timeout for device descriptor fetch
+  * USB: don't try to kzalloc 0 bytes
+  * USB: Onetouch - switch to using input_dev->dev.parent
+  * USB: Fix debug output of ark3116
+  * USB: usblp: Use correct DMA address in case of probe error
+  * USB: Fix USB OHCI Subvendor for Toshiba Portege 4000
+  * USB: make the autosuspend workqueue thread freezable
+  * USB: handle errors in power/level attribute
+  * USB: fix ratelimit call semantics
+  * USB: ftdi_sio: Add USB Product Id for OpenDCC
+  * USB: ldusb bugfix
+  * USB: Add support for Sierra Wireless Aircard 595U
+  * USB: Add support for Olimex arm-usb-ocd JTAG interface serial port
+  * IB/mlx4: Don't allocate RQ doorbell if using SRQ
+  * [IA64] start_secondary() and smp_callin() should be __cpuinit
+  * add the IDE device ID for ATI SB700
+  * ide/pci/serverworks.c: Fix corruption/timeouts with MegaIDE
+  * Add two missing chipsets to drivers/ide/ide-proc.c
+  * Match DMA blacklist entries between ide-dma.c and libata-core.c
+  * ide serverworks warning fixes
+  * freezer: close potential race between refrigerator and thaw_tasks
+  * freezer: fix vfork problem
+  * freezer: take kernel_execve into consideration
+  * freezer: fix kthread_create vs freezer theoretical race
+  * freezer: fix PF_NOFREEZE vs freezeable race
+  * freezer: move frozen_process() to kernel/power/process.c
+  * Ignore bogus ACPI info for offline CPUs
+  * SLUB Debug: Fix object size calculation
+  * fuse: fix mknod of regular file
+  * mpc52xx_psc_spi: fix it for CONFIG_PPC_MERGE
+  * spi doc update: describe clock mode bits
+  * NOHZ: Rate limit the local softirq pending warning output
+  * genhd: expose AN to user space
+  * genhd: send async notification on media change
+  * capability.h warning fix
+  * spi/spidev: check message size before copying
+  * uml: improve PTRACE_SYSEMU checking
+  * prohibit rcutorture from being compiled into the kernel
+  * Documentation: fix the explanation of Kconfig files
+  * Avoid zero size allocation in cache_k8_northbridges()
+  * recalc_sigpending_tsk fixes
+  * optimize compat_core_sys_select() by a using stack space for small fd
+    sets
+  * spi: potential memleak in spidev_ioctl
+  * fbdev: cleanup of sparc FB options
+  * pm2fb: RDAC_WR barriers clean up
+  * pm3fb: various fixes
+  * w100fb: fix compile warnings
+  * ps3fb: use FB_SYS_* instead of FB_CFB_*
+  * imxfb: remove ifdefs
+  * imxfb: fix memory hole
+  * Missing 'const' from reiserfs MIN_KEY declaration.
+  * uselib: add missing MNT_NOEXEC check
+  * fuse: generic_write_checks() for direct_io
+  * fuse: delete inode on drop
+  * fix unused setup_nr_node_ids
+  * SLUB Debug: fix check for super sized slabs (>512k 64bit, >256k 32bit)
+  * Char: cyclades, fix deadlock
+  * simplify cleanup_workqueue_thread()
+  * phantom: move to unlocked_ioctl
+  * Misc: phantom, take care of pci posting
+  * power: Fix sizeof(PAGE_SIZE) typo
+  * update dontdiff file
+  * signalfd: retrieve multiple signals with one read() call
+  * i2o: destroy event queue only when drv->event is set
+  * i2o: fix notifiers when max_drivers is configured
+  * i2o: eliminate a peculiar constraint on i2o_max_drivers
+  * i386, x86-64: show that CONFIG_HOTPLUG_CPU is required for suspend on
+    SMP
+  * md: avoid overflow in raid0 calculation with large components
+  * md: don't write more than is required of the last page of a bitmap
+  * md: fix bug with linear hot-add and elsewhere
+  * documentation: Documentation/initrd.txt
+  * HiSax: fix error checking for hisax_register()]
+  * applesmc - sensors patch missing from 2.6.22-rc2
+  * Off by one in floppy.c
+  * eCryptfs: delay writing 0's after llseek until write
+  * document clocksources
+  * ehci-fsl: fix cache coherency problem on system with large memory
+  * Prevent going idle with softirq pending
+  * i386: fix early usage of atomic_add_return and local_add_return on real
+    i386
+  * Documentation/memory-barriers.txt: various fixes
+  * omap_uwire: SPI_CPHA mode bugfix
+  * capifunc warning fixes
+  * drivers/isdn/hardware/eicon/message.c warning fixes
+  * i386 bigsmp: section mismatch fixes
+  * boot documentation: clarifications
+  * mmc: clean up unused parts of block driver
+  * mmc: mark unmaintained drivers
+  * mmc: Add maintainers for TI OMAP MMC interface
+  * mmc: add maintainer for iMX MMC interface
+  * mmc: add maintainer for ARM Primecell controller
+  * [CRYPTO] geode: Fix in-place operations and set key
+  * [Bluetooth] Always send HCI_Reset for Broadcom devices
+  * [Bluetooth] Fix L2CAP configuration parameter handling
+  * NFS: Avoid a deadlock situation on write
+  * NFS: Fix handful of compiler warnings in direct.c
+  * NFS: Fix nfs_direct_dirty_pages()
+  * Don't call a warnign a bug. It's a warning.
+  * [IA64] Fix using uninitialized data in _PDC setup
+  * [IA64] Cleanup acpi header to reuse the generic _PDC defines
+  * Documentation: Fix up docs still talking about i_sem
+  * [IA64] acpi_get_sysname() should be __init
+  * IB/mlx4: Initialize send queue entry ownership bits
+  * IB/ehca: Fix number of send WRs reported for new QP
+  * IPoIB/cm: Fix timeout check in ipoib_cm_dev_stop()
+  * IPoIB/cm: Drain cq in ipoib_cm_dev_stop()
+  * ucc_geth: Fix MODULE_DEVICE_TABLE() duplication
+  * ucc_geth:trivial fix
+  * asix.c - Add Belkin F5D5055 ids
+  * fix compiler warning in fixed.c
+  * remove unnecessary dependency on VIA velocity config
+  * meth driver renovation
+  * spidernet: skb used after netif_receive_skb
+  * chelsio parenthesis fix
+  * forcedeth: fix cpu irq mask
+  * [NET_SCHED]: Fix qdisc_restart return value when dequeue is empty
+  * [IPV6]: Ignore ipv6 events on non-IPV6 capable devices.
+  * [ATM]: Use mutex instead of binary semaphore in idt77252 driver.
+  * [DCCP]: Use menuconfig objects.
+  * [IPVS]: Use menuconfig objects.
+  * [SCTP]: Use menuconfig objects.
+  * [TIPC]: Use menuconfig objects.
+  * [ARCNET]: Use menuconfig objects.
+  * [TR]: Use menuconfig objects.
+  * [RTNETLINK]: Fix sending netlink message when replace route.
+  * [TIPC]: Fixed erroneous introduction of for_each_netdev
+  * [DCCP]: Fix build warning when debugging is disabled.
+  * [NET_SCHED]: sch_htb: fix event cache time calculation
+  * [NETFILTER]: nf_conntrack_ftp: fix newline sequence number update
+  * [NETFILTER]: nf_conntrack_ftp: fix newline sequence number calculation
+  * [NETFILTER]: nf_conntrack_h323: fix ASN.1 types
+  * [NETFILTER]: nf_conntrack_h323: fix get_h225_addr() for IPv6 address
+    access
+  * [NETFILTER]: nf_conntrack_h323: remove unnecessary process of
+    Information signal
+  * [NETFILTER]: nf_conntrack_h323: add missing T.120 address in OLCA
+  * [NETFILTER]: nf_nat_h323: call set_h225_addr instead of
+    set_h225_addr_hook
+  * [NET]: "wrong timeout value" in sk_wait_data() v2
+  * hpt3x2n: Correct revision boundary
+  * pata_sis: Fix and clean up some timing setups
+  * ata_piix: add short 40c quirk for Acer Aspire 2030, take #2
+  * libata: don't consider 0xff as port empty if SStatus is available
+  * libata: -ENODEV during prereset isn't an error
+  * pata_via: Handle laptops via DMI
+  * [CASSINI]: Check pci_set_mwi() return value.
+  * [XFRM]: Allow packet drops during larval state resolution.
+  * [libata] sata_promise: fix flags typo
+  * [libata] sata_mv: add TODO list
+  * Fix build failure for drivers/ata/pata_scc.c
+  * libata: sata_sis fixes
+  * [libata] Fix decoding of 6-byte commands
+  * [libata] sata_via, pata_via: Add PCI IDs.
+  * ocfs2: trylock in ocfs2_readpage()
+  * ocfs2: unmap_mapping_range() in ocfs2_truncate()
+  * ocfs2: use zero_user_page
+  * ocfs2: fix inode leak
+  * ocfs2: use generic_segment_checks
+  * pata: Trivia
+  * pata_hpt37x: Further improvements based on the IDE updates and vendor
+    drivers
+  * fix compat console unimap regression
+  * Linux 2.6.22-rc3
+
+ -- Ben Collins <bcollins@ubuntu.com>  Thu, 31 May 2007 12:35:44 -0400
+
+linux-source-2.6.22 (2.6.22-5.11) gutsy; urgency=low
+
+  [Ben Collins]
+
+  * build/headers/ppc: Correct asm-ppc -> asm for arch symlink
+  * build/headers/ia64: Fix find command line to correctly pull in *.lds
+    files
+  * Bump ABI
+
+  [Upstream Kernel Changes]
+
+  * [IA64] spelling fixes: arch/ia64/
+  * [AVR32] Remove bogus comment in arch/avr32/kernel/irq.c
+  * [AVR32] optimize pagefault path
+  * [AVR32] Wire up signalfd, timerfd and eventfd
+  * [IA64] wire up {signal,timer,event}fd syscalls
+  * [IA64] kdump on INIT needs multi-nodes sync-up (v.2)
+  * [IA64] s/scalibility/scalability/
+  * [AVR32] Implement platform hooks for atmel_lcdfb driver
+  * [IA64] Fix section conflict of ia64_mlogbuf_finish
+  * [SPARC64]: Add hypervisor API negotiation and fix console bugs.
+  * pata_scc had been missed by ata_std_prereset() switch
+  * libata: separate out ata_dev_reread_id()
+  * libata: during revalidation, check n_sectors after device is configured
+  * libata-acpi: add ATA_FLAG_ACPI_SATA port flag
+  * libata: fix shutdown warning message printing
+  * libata: track spindown status and skip spindown_compat if possible
+  * [ALSA] usb-audio: another Logitech QuickCam ID
+  * [ALSA] hda-codec - Make the mixer capability check more robust
+  * [ALSA] ASoC AC97 static GPL symbol fix
+  * [ALSA] ASoC AC97 device reg bugfix
+  * [ALSA] hda-codec - Fix ALC882/861VD codec support on some laptops
+  * [ALSA] version 1.0.14rc4
+  * [ALSA] Fix probe of non-PnP ISA devices
+  * [ALSA] Include quirks from Ubuntu Dapper/Edgy/Feisty
+  * [ALSA] usbaudio - Coping with short replies in usbmixer
+  * [IA64] optimize pagefaults a little
+  * Fix ACPI suspend / device suspend ordering problem
+  * AFS: write back dirty data on unmount
+  * SLUB: It is legit to allocate a slab of the maximum permitted size
+  * slub: don't confuse ctor and dtor
+  * AFS: Fix afs_prepare_write()
+  * spi: fix spidev for >sizeof(long)/32 devices
+  * parport_pc needs dma-mapping.h
+  * Fix: find_or_create_page skips cpuset memory spreading.
+  * slob: implement RCU freeing
+  * Slab allocators: Drop support for destructors
+  * SLUB: Remove depends on EXPERIMENTAL and !ARCH_USES_SLAB_PAGE_STRUCT
+  * SLAB: Move two remaining SLAB specific definitions to slab_def.h
+  * SLUB: Define functions for cpu slab handling instead of using
+    PageActive
+  * slab: warn on zero-length allocations
+  * slub: fix handling of oversized slabs
+  * SLUB: slabinfo fixes
+  * SLUB: Do our own flags based on PG_active and PG_error
+  * Remove SLAB_CTOR_CONSTRUCTOR
+  * SLUB: Simplify debug code
+  * Slab allocators: define common size limitations
+  * acpi: fix potential call to a freed memory section.
+  * i386/x86-64: fix section mismatch
+  * Make __vunmap static
+  * simplify compat_sys_timerfd
+  * Let smp_call_function_single return -EBUSY on UP
+  * Refine SCREEN_INFO sanity check for vgacon initialization
+  * make freezeable workqueues singlethread
+  * parport: mailing list is subscribers-only
+  * docbook: make kernel-locking table readable
+  * gpio interface loosens call restrictions
+  * rtc-omap build fix
+  * rtc kconfig clarification
+  * icom: add new sub-device-id to support new adapter
+  * make sysctl/kernel/core_pattern and fs/exec.c agree on maximum core
+    filename size
+  * ecryptfs: use zero_user_page
+  * i386: don't check_pgt_cache in flush_tlb_mm
+  * circular locking dependency found in QUOTA OFF
+  * swsusp: fix sysfs interface
+  * Fix page allocation flags in grow_dev_page()
+  * mm: more rmap checking
+  * NS16550A: Restore HS settings in EXCR2 on resume
+  * Fix incorrect prototype for ipxrtr_route_packet()
+  * sky2: remove Gigabyte 88e8056 restriction
+  * sky2: PHY register settings
+  * sky2: keep track of receive alloc failures
+  * sky2: MIB counter overflow handling
+  * sky2: remove dual port workaround
+  * sky2: memory barriers change
+  * small netdevices.txt fix
+  * ibm_emac: fix section mismatch warnings
+  * ibm_emac: improved PHY support
+  * ibm_emac: fix link speed detection change
+  * gianfar: Add I/O barriers when touching buffer descriptor ownership.
+  * spidernet: node-aware skbuff allocation
+  * NetXen: Fix NetXen driver ping on system-p
+  * ixgb: don't print error if pci_enable_msi() fails, cleanup minor leak
+  * e1000: Fix msi enable leak on error, don't print error message, cleanup
+  * drivers/ata: remove the wildcard from sata_nv driver
+  * sata_nv: fix fallout of devres conversion
+  * libata: remove libata.spindown_compat
+  * sata_via: pcim_iomap_regions() conversion missed BAR5
+
+ -- Ben Collins <bcollins@ubuntu.com>  Thu, 17 May 2007 14:54:16 -0400
+
+linux-source-2.6.22 (2.6.22-4.10) gutsy; urgency=low
+
+  [Ben Collins]
+
+  * Bump ABI
+  * build/config: Disable obsolete tsdev driver.
+  * build: Add tsdev to list of modules intentionally removed.
+  * build/headers: Include *.lds files (fixes ia64 headers).
+  * build/headers: Add arch/powerpc/include/asm symlink to get all headers.
+  * build/module-check: Fix logic for printed messages.
+  * build/maintainer: Use linux instead of upstream-linux for local diffs
+  * build/config: Enable SLUB slab allocator (vs. SLAB).
+  * build/config: Disable orinoco_nortel, use prefered hostap_plx
+  * build/config: Disable ir-usb in favor of irda-usb
+  * build/config: Disable sis5513(ide) in favor of pata_sis(libata)
+  * build/config: Disable piix(ide) in favour of pata_oldpiix, ata_piix and
+    pata_mpiix (libata)
+  * build/config: Disable zaurus driver in favour of the cdc_ether driver
+  * build/abi: Note a few modules intentionally removed.
+  * build/config: Disable mxb and dpc7146 driver in favour of hexium_orion
+  * build/config: Disable usbtest driver (for development only)
+  * build/config: Disable keyspan driver in favour of keyspan_pda
+  * build/abi: Add mxb and usbtest to list of removed modules.
+
+  [Upstream Kernel Changes]
+
+  * net: Trivial MLX4_DEBUG dependency fix.
+  * mlx4_core: Remove unused doorbell_lock
+  * [CPUFREQ] Support rev H AMD64s in powernow-k8
+  * [CPUFREQ] powernow-k7: fix MHz rounding issue with perflib
+  * [AGPGART] Fix wrong ID in via-agp.c
+  * sh64: ROUND_UP macro cleanup in arch/sh64/kernel/pci_sh5.c
+  * spelling fixes: arch/sh64/
+  * sh64: Wire up many new syscalls.
+  * sh64: Fixups for the irq_regs changes.
+  * sh64: dma-mapping updates.
+  * sh64: ppoll/pselect6() and restartable syscalls.
+  * sh64: Fixup sh-sci build.
+  * sh64: Update cayman defconfig.
+  * sh64: generic quicklist support.
+  * sh64: Add .gitignore entry for syscalltab.
+  * IB/mlx4: Fix uninitialized spinlock for 32-bit archs
+  * IB/ipath: Shadow the gpio_mask register
+  * IB/ehca: Serialize hypervisor calls in ehca_register_mr()
+  * IB/ehca: Correctly set GRH mask bit in ehca_modify_qp()
+  * IB/ehca: Fix AQP0/1 QP number
+  * IB/ehca: Remove _irqsave, move #ifdef
+  * IB/ehca: Beautify sysfs attribute code and fix compiler warnings
+  * IB/ehca: Disable scaling code by default, bump version number
+  * RDMA/cma: Simplify device removal handling code
+  * RDMA/cma: Fix synchronization with device removal in cma_iw_handler
+  * RDMA/cma: Add check to validate that cm_id is bound to a device
+  * IB/mthca: Fix posting >255 recv WRs for Tavor
+  * IB/mthca: Set cleaned CQEs back to HW ownership when cleaning CQ
+  * IPoIB/cm: Optimize stale connection detection
+  * [CPUFREQ] Correct revision mask for powernow-k8
+  * fix epoll single pass code and add wait-exclusive flag
+  * epoll locks changes and cleanups
+  * epoll: fix some comments
+  * epoll: move kfree inside ep_free
+  * nommu: add ioremap_page_range()
+  * h8300 atomic.h update
+  * alpha: fix hard_smp_processor_id compile error
+  * m68k: implement __clear_user()
+  * Remove cpu hotplug defines for __INIT & __INITDATA
+  * i386: move common parts of smp into their own file
+  * i386: fix voyager build
+  * SLUB: CONFIG_LARGE_ALLOCS must consider MAX_ORDER limit
+  * ll_rw_blk: fix gcc 4.2 warning on current_io_context()
+  * pasemi_mac: Fix register defines
+  * pasemi_mac: Interrupt ack fixes
+  * pasemi_mac: Terminate PCI ID list
+  * pasemi_mac: Fix local-mac-address parsing
+  * smc911x: fix compilation breakage
+  * ucc_geth: eliminate max-speed, change interface-type to
+    phy-connection-type
+  * pdc202xx_old: rewrite mode programming code (v2)
+  * serverworks: PIO mode setup fixes
+  * sis5513: PIO mode setup fixes
+  * alim15x3: use ide_tune_dma()
+  * pdc202xx_new: use ide_tune_dma()
+  * ide: always disable DMA before tuning it
+  * cs5530/sc1200: add ->udma_filter methods
+  * ide: use ide_tune_dma() part #2
+  * cs5530/sc1200: DMA support cleanup
+  * cs5530/sc1200: add ->speedproc support
+  * sl82c105: add speedproc() method and MWDMA0/1 support
+  * ide: remove ide_dma_enable()
+  * ide: add missing validity checks for identify words 62 and 63
+  * ide: remove ide_use_dma()
+  * sl82c105: Switch to ref counting API
+  * Use menuconfig objects: IDE
+  * x86: Fix discontigmem + non-HIGHMEM compile
+  * missing mm.h in fw-ohci
+  * missing dependencies for USB drivers in input
+  * missing includes in mlx4
+  * em28xx and ivtv should depend on PCI
+  * rpadlpar breakage - fallout of struct subsystem removal
+  * m32r: __xchg() should be always_inline
+  * audit_match_signal() and friends are used only if CONFIG_AUDITSYSCALL
+    is set
+  * fix uml-x86_64
+  * arm: walk_stacktrace() needs to be exported
+
+ -- Ben Collins <bcollins@ubuntu.com>  Tue, 15 May 2007 10:13:23 -0400
+
+linux-source-2.6.22 (2.6.22-3.9) gutsy; urgency=low
+
+  * Fixup firmware-modules -> efi-modules in exclude files.
+
+  [Ben Collins]
+
+  * build/config: Enable CONFIG_TIMER_STATS
+  * build/config: Disable CONFIG_IRQBALANCE, handled in userspace now
+  * build: Update modules that have been deprecated
+  * sparc64: Get some drivers compiling, till patches get upstream.
+  * powerpc: Add 64-bit cmp op for 32-bit.
+  * build/config: Disable apm_emu, pasemi_mac and cbe_cpufreq on ppc64
+  * build/d-i(cjwatson): Rename firmware-modules to efi-modules
+
+ -- Ben Collins <bcollins@ubuntu.com>  Fri, 11 May 2007 09:38:50 +0200
+
+linux-source-2.6.22 (2.6.22-2.7) gutsy; urgency=low
+
+  [Changes for 2.7]
+
+  * Added some more modules going missing to ignore.
+  * Disable ADB_PMU_LED on powerpc64. FTBFS.
+
+  [Ben Collins]
+
+  * XXX: Well, xen and rt got disabled in this upload. Hopefully things will
+    get working again soon.
+
+  * build: Add check for nrcpus on buildd's for CONCURRENCY_LEVEL
+  * build: No longer provide ndiswrapper or ivtv modules (l-u-m does).
+  * build/d-i: Remove firmware lists, since we no longer supply those udebs
+  * build: Remove more firmware stuff
+  * build/control: Build-dep on coreutils
+  * Update configuration files
+  * build/custom: Updated xen/rt patches and configs.
+  * build: Make sure to use /bin/bash for headers_install
+  * build: Add SHELL=/bin/bash to headers_install
+  * Update configuration files
+  * Bump ABI
+  * Update module lists to match module name changes and merges.
+  * build/rt: Trimmed down real-time patch from Alessio Igor Bogani.
+  * Update configuration files
+  * Update configuration files
+  * build/rt: Fix typo in diff
+  * Update configuration files
+  * build: make explicit binary-headers target
+  * Update configuration files
+  * build/control-scripts: Remove debconf from pre-rm script
+  * build/ia64: Compress and use vmlinuz for target install
+  * build/config: Diable OSS i810_audio driver (Alsa driver prefered)
+  * build/config: Disable OSS cs4232 driver (Alsa prefered)
+  * build/config: Disable OSS via82xx driver (Alsa prefered)
+  * build/config: Disable OSS trident driver (Alsa prefered)
+  * build/config: Disable OSS Sound Blaster driver (Alsa prefered)
+  * build/config: Disable IDE generic, ata_generic prefered
+  * build/config: Disable siimage, pata_sil680 prefered
+  * build/module-check: More robust module checking
+  * build: Call module-check with perl, not $SHELL
+  * Update configuration files
+  * build: Fixup calling conventions of module-check
+  * build: Add modules.ignore from 1.3 revision
+  * build/config: Disable obsolete MOXA_SMARTIO in favor of new driver.
+  * build/config: Disable orinoco_cs in favor of hostap_cs
+  * build/config: Disable orinoco_pci in favor of hostap_pci
+  * build/config: Disable orinoco_{plx,tmd} in favor of hostap_plx
+  * build/config: Disable sk98lin in favor of skge
+  * build: Add more modules intentionally removed since 1.3
+
+ -- Ben Collins <bcollins@ubuntu.com>  Fri, 27 Apr 2007 09:04:29 -0400
+
+linux-source-2.6.22 (2.6.22-1.3) gutsy; urgency=low
+
+  [Ben Collins]
+
+  * build: Only use bzip2 for linux-image, and pre-depend on proper dpkg
+
+  [2.6.22-1.2]
+
+  [Ben Collins]
+
+  * build: Add build-arch target. FTBFS
+
+  [2.6.22-1.1]
+
+  [Ben Collins]
+
+  * debian: New build system, from scratch
+  * debian: Rename place holder so debian/stamps/ sticks around
+  * debian: Create stamp-flavours at start of build (for build scripts)
+  * debian/abi: Add revision 0.0 bootstrap module list.
+  * debian: Fix backwards logic in module/abi checkers.
+  * debian: Add arch= to vars.* files
+  * Update configuration files
+  * build: Added control scripts for images
+  * build/config: Disable CONFIG_PARAVIRT for now
+  * build/config: Enable CONFIG_FB_VESA
+  * build: Take CONCURRENCY_LEVEL from env if it exists.
+  * build: Do not print SHAs by default for changelog
+  * build/config(i386): Disable NO_HZ on all but generic
+  * build: Implement udeb rules
+  * build/d-i: Remove speakup-modules udeb
+  * build/udebs: Fix a couple trivial errors in the build.
+  * build/config: Disable CONFIG_FB_IMSTT on powerpc64-smp (no NVRAM)
+  * build/config: Disable some modules for ppc64 that don't use DMA API
+  * build/config: Yet another module to disable on ppc64
+  * build/tests: New test infrastructure
+  * build: Special kernel build infrastructure
+  * build: Fix typo from last commit
+  * build/custom: Move custom files for each flavour into subdir.
+  * build/config: Disable some drivers on sparc that don't support DMA API
+  * build/sparc: Add new compress_file config, and use it for sparc
+  * build: Fix typo in compress_file commit.
+  * build/schedcfs: Update to v6 of the patch.
+  * build: Fix control file generation for custom images
+  * build: Correct message in link-headers
+  * build: 2.6.21 is released, force our SUBLEVEL to .22
+  * build/vars: kvm API is at 4, provide that.
+  * build/custom: Allow custom builds to override things like build_image
+  * build/custom: Fix type causing custom rules not to be included.
+  * build/custom: Hello Xen 3.0.5
+  * build/custom: Remove sched-cfs. Superseded in use by rt.
+  * build/custom: Add 2.6.21-rt1 patch for -rt custom flavour
+  * build/link-headers: Make sure to copy new files for custom
+
+ -- Ben Collins <bcollins@ubuntu.com>  Fri, 27 Apr 2007 08:29:00 -0400
--- linux-rt-2.6.31.orig/debian/compat
+++ linux-rt-2.6.31/debian/compat
@@ -0,0 +1 @@
+4
--- linux-rt-2.6.31.orig/debian/changelog
+++ linux-rt-2.6.31/debian/changelog
@@ -0,0 +1,585 @@
+linux-rt (2.6.31-11.154) lucid-proposed; urgency=low
+
+  * Update to latest Ubuntu mainline kernel v2.6.31-21.59
+  * Update to new upstream rt patchset, rt21
+  * Bump ABI
+
+ -- Alessio Igor Bogani <abogani@ubuntu.com>  Mon, 17 May 2010 14:19:29 +0200
+
+linux-rt (2.6.31-10.153) lucid; urgency=low
+
+  * Re-enabled the quilt patching system
+  * Update to latest Ubuntu mainline kernel v2.6.31-17.54
+    - LP: #495383
+  * Update to new upstrea rt patchset, rt19
+  * Bump ABI
+
+ -- Alessio Igor Bogani <abogani@ubuntu.com>  Sun, 13 Dec 2009 17:22:37 +0100
+
+linux-rt (2.6.31-9.152) karmic; urgency=low
+
+  * Update to latest Ubuntu mainline kernel v2.6.31-14.47.
+
+ -- Luke Yelavich <themuso@ubuntu.com>  Thu, 15 Oct 2009 12:20:43 +1100
+
+linux-rt (2.6.31-9.151) karmic; urgency=low
+
+  * Turn off dynamic ticks again, after forgetting to do so with the rebase
+    of the Ubuntu kernel sources and the new RT patch.
+
+ -- Luke Yelavich <themuso@ubuntu.com>  Thu, 15 Oct 2009 08:16:31 +1100
+
+linux-rt (2.6.31-9.14) karmic; urgency=low
+
+  * Update to new upstrea rt patchset, rt14
+
+ -- Luke Yelavich <themuso@ubuntu.com>  Wed, 14 Oct 2009 22:32:15 +1100
+
+linux-rt (2.6.31-9.13) karmic; urgency=low
+
+  * Update to Ubuntu mainline kernel 2.6.31-14.46.
+  * Set CONFIG_X86_MCE=y as per mainline
+
+ -- Luke Yelavich <themuso@ubuntu.com>  Wed, 14 Oct 2009 08:12:41 +1100
+
+linux-rt (2.6.31-8.12) karmic; urgency=low
+
+  [ Alessio Igor Bogani ]
+  * Fix a package description error
+  * Dynamic Ticks off by default
+
+  [ Luke Yelavich ]
+  * Update to Ubuntu mainline kernel v2.6.31-13.45.
+  * Set CONFIG_X86_PAT=y as per mainline.
+
+ -- Luke Yelavich <themuso@ubuntu.com>  Tue, 13 Oct 2009 21:29:28 +1100
+
+linux-rt (2.6.31-8.11) karmic; urgency=low
+
+  * Update to mainline Ubuntu kernel 2.6.31-13.44
+
+ -- Luke Yelavich <themuso@ubuntu.com>  Tue, 13 Oct 2009 06:28:20 +1100
+
+linux-rt (2.6.31-8.10) karmic; urgency=low
+
+  * Update to mainline Ubuntu kernel 2.6.31-13.43, upstrea m2.6.31.3.
+
+ -- Luke Yelavich <themuso@ubuntu.com>  Sat, 10 Oct 2009 15:52:35 +1100
+
+linux-rt (2.6.31-7.9) karmic; urgency=low
+
+  * Add cpio to build dependencies.
+  * Update to Ubuntu mainline 2.6.31-12.41.
+  * Set CONFIG_GFS2_FS_LOCKING_DLM=y as per mainline.
+
+ -- Luke Yelavich <themuso@ubuntu.com>  Thu, 08 Oct 2009 08:55:22 +1100
+
+linux-rt (2.6.31-7.8) karmic; urgency=low
+
+  * New upstrea rt patch release, rt13.
+  * Update kernel to Ubuntu mainline 2.6.31-12.40.
+  * Enable CONFIG_SND_HDA_HWDEP as per mainline Ubuntu kernels.
+
+ -- Luke Yelavich <themuso@ubuntu.com>  Wed, 07 Oct 2009 21:01:45 +1100
+
+linux-rt (2.6.31-6.7) karmic; urgency=low
+
+  * Update to latest Ubuntu mainline source, 2.6.31-11,36.
+
+ -- Luke Yelavich <themuso@ubuntu.com>  Sat, 26 Sep 2009 13:41:38 +1000
+
+linux-rt (2.6.31-5.6) karmic; urgency=low
+
+  * Set CONFIG_HZ to 1000
+  * New upstrea RT patchset release, -rt11
+
+ -- Luke Yelavich <themuso@ubuntu.com>  Sun, 20 Sep 2009 10:19:56 +1000
+
+linux-rt (2.6.31-5.5) karmic; urgency=low
+
+  * New upstream RT patch release to be used with 2.6.31 final.
+  * disable CONFIG_FTRACE
+  * Merge with mainline Ubuntu kernel configs
+
+ -- Luke Yelavich <themuso@ubuntu.com>  Wed, 16 Sep 2009 13:28:21 +1000
+
+linux-rt (2.6.31-4.4) karmic; urgency=low
+
+  * New RT patchset release
+  * Base on Ubuntu mainline 2.6.31-9.29.
+
+ -- Luke Yelavich <themuso@ubuntu.com>  Sat, 29 Aug 2009 14:20:04 +1000
+
+linux-rt (2.6.31-3.3) karmic; urgency=low
+
+  * New upstream RT patch release
+
+ -- Luke Yelavich <themuso@ubuntu.com>  Sun, 23 Aug 2009 14:44:26 +1000
+
+linux-rt (2.6.31-2.2) karmic; urgency=low
+
+  * New upstream release
+  * Updated configs, based on Ubuntu mainline kernel configs
+
+ -- Luke Yelavich <themuso@ubuntu.com>  Tue, 18 Aug 2009 10:50:41 +1000
+
+linux-rt (2.6.31-1.1) karmic; urgency=low
+
+  * New upstream release
+
+ -- Luke Yelavich <themuso@ubuntu.com>  Wed, 05 Aug 2009 23:00:52 +0100
+
+linux-rt (2.6.29.6-1.3) karmic; urgency=low
+
+  * Disable ABI checking for now, to fix anothre FTBFs
+
+ -- Luke Yelavich <themuso@ubuntu.com>  Sat, 11 Jul 2009 21:45:36 +1000
+
+linux-rt (2.6.29.6-1.2) karmic; urgency=low
+
+  * Generate debian/control (blush)
+
+ -- Luke Yelavich <themuso@ubuntu.com>  Sat, 11 Jul 2009 20:07:25 +1000
+
+linux-rt (2.6.29.6-1.1) karmic; urgency=low
+
+  * New upstream kernel and RT patchset release
+
+ -- Luke Yelavich <themuso@ubuntu.com>  Sat, 11 Jul 2009 13:31:31 +1000
+
+linux-rt (2.6.29.5-2.3) karmic; urgency=low
+
+  * Backport ALSA code from kernel 2.6.31-rc2 (LP: #394282)
+  * Recommend grub-pc
+
+ -- Luke Yelavich <themuso@ubuntu.com>  Mon, 06 Jul 2009 20:57:44 +1000
+
+linux-rt (2.6.29.5-1.2) karmic; urgency=low
+
+  * Temporarily hard-code the .5 point release for the kernel, since without
+    this, needed files cannot be copied into the correct places, causing an
+    FTBFs.
+
+ -- Luke Yelavich <themuso@ubuntu.com>  Sun, 28 Jun 2009 11:18:17 +1000
+
+linux-rt (2.6.29.5-1.1) karmic; urgency=low
+
+  * New 2.6.29 kernel upstream release
+  * New realtime patch upstream release
+  * Bump ABI
+  * Use main ubuntu kernel configs as a base for the rt configs.
+
+ -- Luke Yelavich <themuso@ubuntu.com>  Sat, 27 Jun 2009 21:25:03 +1000
+
+linux-rt (2.6.29-1.1) karmic; urgency=low
+
+  * New upstream release
+
+ -- Luke Yelavich <themuso@ubuntu.com>  Sun, 14 Jun 2009 15:07:25 +1000
+
+linux-rt (2.6.28-3.12) jaunty; urgency=low
+
+  * Build depend on linux-source-2.6.28 >= 2.6.28-11.42.
+
+  Rebase on jaunty mainline 2.6.28-11.41:
+
+  [ Tim Gardner ]
+
+  * Enabled LPIA CONFIG_PACKET=y
+    - LP: #362071
+
+  [ Upstream Kernel Changes ]
+
+  * ext4: fix bb_prealloc_list corruption due to wrong group locking
+    - LP: #348836
+
+ -- Luke Yelavich <themuso@ubuntu.com>  Fri, 17 Apr 2009 15:06:04 +1000
+
+linux-rt (2.6.28-3.11) jaunty; urgency=low
+
+  Rebase on jaunty mainline 2.6.28-11.41:
+
+  [ Amit Kucheria ]
+
+  * ixp4xx: Enabled TCP SYN_COOKIES
+    - LP: #346378
+
+  [ Brad Figg ]
+
+  * Change LPIA configuration to compile with CONFIG_NETFILTER_XT_MATCH_RECENT
+    - LP: #355291
+
+  [ Kay Sievers ]
+
+  * SAUCE: driver core: allow non-root users to listen to uevents
+    - LP: #357124
+
+  [ Manoj Iyer ]
+
+  * SAUCE: Added quirk to recognize GE0301 3G modem as an interface.
+    - LP: #348861
+
+  [ Tim Gardner ]
+
+  * Revert "SAUCE: [i915] allocate MCHBAR space & enable if necessary"
+    Appears to cause hard locks in some cases. 
+    - LP: #349314
+
+  [ Trond Myklebust ]
+
+  * SAUCE: NFS: Fix the notifications when renaming onto an existing file
+    - LP: #224642
+
+  [ Upstream Kernel Changes ]
+
+  * USB: option: add QUANTA HSDPA Data Card device ids
+    - LP: #353321
+  * hwmon: (abituguru3) Match partial DMI board name strings
+    - LP: #298798
+  * zd1211rw: adding Sitecom WL-603 (0df6:0036) to the USB id list
+    - LP: #339631
+  * USB: unusual dev for Option N.V. ZeroCD modems
+    - LP: #348861
+
+ -- Luke Yelavich <themuso@ubuntu.com>  Thu, 09 Apr 2009 02:34:08 +1000
+
+linux-rt (2.6.28-3.10) jaunty; urgency=low
+
+  * Disable DEVKMEM for all archs on Jaunty
+
+  Rebase on jaunty mainline 2.6.28-11.40:
+
+  [ Amit Kucheria ]
+
+  * Disable DEVKMEM for all archs on Jaunty
+    - LP: #354221
+
+  [ Andy Whitcroft ]
+
+  * SAUCE: md: wait for possible pending deletes after stopping an array
+    - LP: #334994
+
+  [ Brad Figg ]
+
+  * ARM: Setting the bootloader for imx51 flavour.
+    - LP: #348382
+  * ARM: Add bootloader package Recomendation to iop32x and ixp4xx flavours
+    - LP: #348382
+
+  [ Tim Gardner ]
+
+  * SAUCE: [i915] allocate MCHBAR space & enable if necessary
+    - LP: #349314
+
+  [ Upstream Kernel Changes ]
+
+  * hpilo: open/close fix
+    - LP: #353496
+
+  [ Alan Tull ]
+
+  * SAUCE: mx51: fix to1.1 in mxc_iomux_set_input
+    - LP: #348333
+
+  [ Andy Whitcroft ]
+
+  * SAUCE: acer: rfkill disable quirk for ACER Aspire One
+    - LP: #319825
+
+  [ Brad Figg ]
+
+  * ARM: Increase CONFIG_BLK_DEV_RAM_SIZE for imx51 flavour.
+    - LP: #349842
+  * ARM: Enable rtl8187 for imx51
+    - LP: #349526
+  * ARM: Unset CONFIG_USB_STORAGE_DEBUG for imx51
+    - LP: #348504
+
+  [ Bryan Wu ]
+
+  * build CRAMFS into kernel to support mounting CRAMFS initrd on iop32x
+    machine
+    - LP: #349104
+
+  [ Michael Casadevall ]
+
+  * [lpia] Change ATA, SCSI, SD, ext2-4 modules into compiled-in components
+    - LP: #347458
+
+  [ Rob Herring ]
+
+  * SAUCE: imx51: fec: fix cache operations for receive
+    - LP: #348333
+
+  [ Sam Yang ]
+
+  * SAUCE: Revert ENGR00103870 FEC reopening causes network wdog timeout
+    - LP: #348333
+  * SAUCE: imx51: fec cache flush functions are incorrect
+    - LP: #348333
+
+  [ Upstream Kernel Changes ]
+
+  * Bluetooth: Add fine grained mem_flags usage to btusb driver
+    - LP: #268502
+  * Bluetooth: Handle bulk URBs in btusb driver from notify callback
+    - LP: #268502
+  * Bluetooth: Submit bulk URBs along with interrupt URBs
+    - LP: #268502
+
+ -- Luke Yelavich <themuso@ubuntu.com>  Tue, 07 Apr 2009 09:23:10 +1000
+
+linux-rt (2.6.28-3.9) jaunty; urgency=low
+
+  * link-headers: only link directories which do not already exist
+
+  Rebase on jaunty mainline 2.6.28-11.38:
+
+  [ Brad Figg ]
+
+  * When AppArmor is configured, securityfs must be as well.
+    - LP: #344370
+  * ARM: Enable AA with SECURITYFS for imx51
+    - LP: #344370
+
+  [ Bryan Wu ]
+
+  * Add 3 missing files to prerm remove file list
+    - LP: #345623
+
+  [ Daniel T Chen ]
+
+  * SAUCE: (drop after 2.6.28) Don't trust hw-ptr blindly
+    - LP: #330814
+  * SAUCE: (drop after 2.6.28) Apply further pcm_lib updates for hw_ptr
+    - LP: #330814
+
+  [ Ike Panhc ]
+
+  * Copy header files for various kernel media driver
+    - LP: #322732
+
+  [ Tim Gardner ]
+
+  * Revert "Fix the VFP handling on the Feroceon CPU"
+    Only applied to mv78xx0 ARM flavour.
+  * Enabled drivers/staging/at76_usb
+    - LP: #152626
+
+  [ ubuntu@tjworld.net ]
+
+  * SAUCE: ipw2200: Enable LED by default
+    - LP: #21367
+  * SAUCE: wistron_btns: support Prestigio Wifi RF kill button over suspend
+    - LP: #346586
+
+  [ Upstream Kernel Changes ]
+
+  * Build fix for __early_pfn_to_nid() undefined link error
+  * Fix misreporting of #cores as #hyperthreads for Q9550
+  * eventfd: remove fput() call from possible IRQ context
+  * S390: __div64_31 broken for CONFIG_MARCH_G5
+  * ALSA: Fix vunmap and free order in snd_free_sgbuf_pages()
+  * ALSA: mixart, fix lock imbalance
+  * ALSA: pcm_oss, fix locking typo
+  * ALSA: hda - Fix DMA mask for ATI controllers
+  * ALSA: hda - Workaround for buggy DMA position on ATI controllers
+  * ALSA: opl3sa2 - Fix NULL dereference when suspending snd_opl3sa2
+  * nfsd: nfsd should drop CAP_MKNOD for non-root
+  * NFSD: provide encode routine for OP_OPENATTR
+  * dm ioctl: validate name length when renaming
+  * dm io: respect BIO_MAX_PAGES limit
+  * dm crypt: fix kcryptd_async_done parameter
+  * dm crypt: wait for endio to complete before destruction
+  * ata_piix: add workaround for Samsung DB-P70
+  * V4L/DVB (10218): cx23885: Fix Oops for mixed install of analog and
+    digital only cards
+  * thinkpad-acpi: fix module autoloading for older models
+  * Add '-fwrapv' to gcc CFLAGS
+  * Move cc-option to below arch-specific setup
+  * USB: storage: Unusual USB device Prolific 2507 variation added
+  * USB: Add Vendor/Product ID for new CDMA U727 to option driver
+  * USB: option.c: add ZTE 622 modem device
+  * USB: Add device id for Option GTM380 to option driver
+  * USB: Option: let cdc-acm handle Sony Ericsson F3507g / Dell 5530
+  * USB: Updated unusual-devs entry for USB mass storage on Nokia 6233
+  * USB: unusual_devs: Add support for GI 0431 SD-Card interface
+  * USB: serial: add FTDI USB/Serial converter devices
+  * USB: serial: ftdi: enable UART detection on gnICE JTAG adaptors
+    blacklist interface0
+  * USB: serial: new cp2101 device id
+  * USB: usbtmc: fix stupid bug in open()
+  * USB: usbtmc: add protocol 1 support
+  * USB: usbfs: keep async URBs until the device file is closed
+  * USB: EHCI: expedite unlinks when the root hub is suspended
+  * USB: EHCI: Fix isochronous URB leak
+  * powerpc: Remove extra semicolon in fsl_soc.c
+  * menu: fix embedded menu snafu
+  * Linux 2.6.28.9
+  * Add '-fwrapv' to gcc CFLAGS
+    - LP: #348015
+  * Move cc-option to below arch-specific setup
+    - LP: #348015
+  * Revert Staging: at76_usb: update drivers/staging/at76_usb w/ mac80211
+    port
+    - LP: #152626
+  * Staging: at76_usb: fix bugs introduced by "Staging: at76_usb: cleanup
+    dma on stack issues"
+    - LP: #152626
+  * Staging: at76_usb: Add support for OQO Model 01+
+    - LP: #152626
+
+  [ Alex Deucher ]
+
+  * SAUCE: radeon: add some new pci ids
+    - LP: #334101
+
+  [ Amit Kucheria ]
+
+  * Updating configs - rip out orion5x and mv78xx0 flavours
+
+  [ Andy Whitcroft ]
+
+  * SAUCE: tone down the synaptics warning to avoid triggering kerneloops
+    - LP: #330606
+
+  [ Upstream Kernel Changes ]
+
+  * ext4: fix header check in ext4_ext_search_right() for deep extent
+    trees.
+    - LP: #346194
+  * eCryptfs: NULL crypt_stat dereference during lookup
+    - LP: #345766
+  * eCryptfs: Allocate a variable number of pages for file headers
+    (CVE-2009-0787)
+    - LP: #345544
+
+ -- Luke Yelavich <themuso@ubuntu.com>  Tue, 24 Mar 2009 10:40:43 +1100
+
+linux-rt (2.6.28-3.8) jaunty; urgency=low
+
+  * Rebase on jaunty mainline 2.6.28-11.36.
+  * Adjust CONFIG_SECURITY_DEFAULT_MMAP_MIN_ADDR as per jaunty mainline.
+  * Adjust CONFIG_UEVENT_HELPER_PATH as per jaunty mainline.
+  * Adjust dependency on linux-source-2.6.28.
+
+ -- Luke Yelavich <themuso@ubuntu.com>  Sun, 22 Mar 2009 10:18:54 +1100
+
+linux-rt (2.6.28-3.7) jaunty; urgency=low
+
+  * Rebase on jaunty mainline 2.6.28-11.34.
+  * Update config files as per jaunty mainline.
+  * Add hard dependency on linux-source-2.6.28 = 2.6.28-11.34
+
+ -- Luke Yelavich <themuso@ubuntu.com>  Wed, 18 Mar 2009 17:56:45 +1100
+
+linux-rt (2.6.28-2.6) jaunty; urgency=low
+
+  * Rebase on top of Jaunty 2.6.28-9.29.
+  * Add code to copy modules.order into the kernel packages.
+  * Add fuse to modules.ignore since fuse is built into the kernel.
+
+ -- Luke Yelavich <themuso@ubuntu.com>  Tue, 10 Mar 2009 09:45:01 +1100
+
+linux-rt (2.6.28-1.5) jaunty; urgency=low
+
+  [ Alessio Igor Bogani ]
+  * Resync with ubuntu jaunty kernel v2.6.28-8.26
+
+  [ Luke Yelavich ]
+  * re-enable ABI checking
+  * debian/scripts/misc/getabis: tweak for fetching the rt abi files
+  * build our own arch independant headers package as well
+  * rebase against jaunty 2.6.28-8.27
+  * update config files.
+
+ -- Luke Yelavich <themuso@ubuntu.com>  Fri, 06 Mar 2009 07:58:51 +1100
+
+linux-rt (2.6.28-1.4) jaunty; urgency=low
+
+  * Resync with ubuntu jaunty kernel v2.6.28-8.24
+  * Merge all patches into only one
+  * Update config files
+
+ -- Alessio Igor Bogani <abogani@ubuntu.com>  Fri, 20 Feb 2009 19:54:53 +0100
+
+linux-rt (2.6.28-1.3) jaunty; urgency=low
+
+  * Update config files, and remove unneeded armel files/references.
+
+ -- Luke Yelavich <themuso@ubuntu.com>  Sat, 14 Feb 2009 22:18:58 +1100
+
+linux-rt (2.6.28-1.2) jaunty; urgency=low
+
+  * Resync with the ubuntu jaunty kernel, v2.6.28-8.21, and use the work done
+    so far by Alessio Igor Bogani <abogani@ubuntu.com> for the realtime patch
+  * Partially remove udeb generation code, as the udebs are not ever used
+    for installation
+  * Add a hack to ensure that the linux-headers package depends on jaunty's
+    main linux headers package
+
+ -- Luke Yelavich <themuso@ubuntu.com>  Sat, 14 Feb 2009 16:24:24 +1100
+
+linux-rt (2.6.28-1.1) jaunty; urgency=low
+
+  * Initial version based on linux-source-2.6.28 2.6.28-6.16
+  * CONFIG_AUFS and CONFIG_CGROUP_MEM_RES_CTLR are still disabled
+
+ -- Alessio Igor Bogani <abogani@ubuntu.com>  Thu, 29 Jan 2009 08:46:29 +0100
+
+linux-rt (2.6.27-3.8) intrepid; urgency=low
+
+  * Blacklisted XFS to prevent an ABI bump
+    - This is based off git commit 21c69ea60244403e503f148cd29d89df85eb0908
+      from ubuntu-intrepid.git (LP: #289683)
+
+ -- Michael Casadevall <sonicmctails@gmail.com>  Sun, 26 Oct 2008 20:46:33 -0400
+
+linux-rt (2.6.27-3.7) intrepid; urgency=low
+
+  * Synced against linux-source-2.6.27 2.6.27-7.12
+  * Added ext4-nrpages.patch and jbd2-nrpages.patch
+  * Synced configuration
+
+ -- Alessio Igor Bogani <abogani@ubuntu.com>  Sat, 18 Oct 2008 18:08:55 +0200
+
+linux-rt (2.6.27-3.6) intrepid; urgency=low
+
+  * Synced against linux-source-2.6.27 2.6.27-7.11
+
+ -- Alessio Igor Bogani <abogani@ubuntu.com>  Wed, 15 Oct 2008 15:36:52 +0200
+
+linux-rt (2.6.27-3.5) intrepid; urgency=low
+
+  * Synced against linux-source-2.6.27 2.6.27-7.10
+  * Bump ABI to -3
+
+ -- Alessio Igor Bogani <abogani@ubuntu.com>  Mon, 13 Oct 2008 15:46:02 +0200
+
+linux-rt (2.6.27-2.4) intrepid; urgency=low
+
+  * Mistake in packaging
+
+ -- Alessio Igor Bogani <abogani@ubuntu.com>  Fri, 10 Oct 2008 14:07:41 +0200
+
+linux-rt (2.6.27-2.3) intrepid; urgency=low
+
+  * Fix a FTBS 
+
+ -- Alessio Igor Bogani <abogani@ubuntu.com>  Fri, 10 Oct 2008 11:46:25 +0200
+
+linux-rt (2.6.27-2.2) intrepid; urgency=low
+
+  * Synced against linux-source-2.6.27 2.6.27-6.9 
+  * Disable CONFIG_AUFS, CONFIG_CGROUP_MEM_RES_CTLR, CONFIG_FTRACE,
+    CONFIG_LATENCYTOP, CONFIG_CONTEXT_SWITCH_TRACER
+  * Set timer frequency to 1000 HZ
+  * Bump ABI to -2
+
+ -- Alessio Igor Bogani <abogani@ubuntu.com>  Thu, 09 Oct 2008 15:27:27 +0200
+
+linux-rt (2.6.27-1.1) intrepid; urgency=low
+
+  * Initial version based on linux-source-2.6.27 2.6.27-4.6 (LP: #281276)
+
+ -- Alessio Igor Bogani <abogani@ubuntu.com>  Fri, 03 Oct 2008 09:15:26 +0200
--- linux-rt-2.6.31.orig/debian/copyright
+++ linux-rt-2.6.31/debian/copyright
@@ -0,0 +1,30 @@
+This is the Ubuntu prepackaged version of the Linux kernel.
+Linux was written by Linus Torvalds <Linus.Torvalds@cs.Helsinki.FI>
+and others.
+
+This package was put together by the Ubuntu Kernel Team, from
+sources retrieved from upstream linux git.
+The sources may be found at most Linux ftp sites, including 
+ftp://ftp.kernel.org/pub/linux/kernel/
+
+This package is currently maintained by the
+Ubuntu Kernel Team <ubuntu-kernel@lists.ubuntu.com>
+
+Linux is copyrighted by Linus Torvalds and others.
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; version 2 dated June, 1991.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
+   02111-1307, USA.
+
+On Ubuntu Linux systems, the complete text of the GNU General
+Public License v2 can be found in `/usr/share/common-licenses/GPL-2'.
--- linux-rt-2.6.31.orig/debian/changelog.jaunty
+++ linux-rt-2.6.31/debian/changelog.jaunty
@@ -0,0 +1,4737 @@
+linux (2.6.28-11.42) jaunty; urgency=low
+
+  [ Tim Gardner ]
+
+  * Enabled LPIA CONFIG_PACKET=y
+    - LP: #362071
+
+  [ Upstream Kernel Changes ]
+
+  * ext4: fix bb_prealloc_list corruption due to wrong group locking
+    - LP: #348836
+
+ -- Stefan Bader <stefan.bader@canonical.com>  Thu, 16 Apr 2009 08:10:55 +0200
+
+linux (2.6.28-11.41) jaunty; urgency=low
+
+  [ Amit Kucheria ]
+
+  * ixp4xx: Enabled TCP SYN_COOKIES
+    - LP: #346378
+
+  [ Brad Figg ]
+
+  * Change LPIA configuration to compile with CONFIG_NETFILTER_XT_MATCH_RECENT
+    - LP: #355291
+
+  [ Kay Sievers ]
+
+  * SAUCE: driver core: allow non-root users to listen to uevents
+    - LP: #357124
+
+  [ Manoj Iyer ]
+
+  * SAUCE: Added quirk to recognize GE0301 3G modem as an interface.
+    - LP: #348861
+
+  [ Tim Gardner ]
+
+  * Revert "SAUCE: [i915] allocate MCHBAR space & enable if necessary"
+    Appears to cause hard locks in some cases. 
+    - LP: #349314
+
+  [ Trond Myklebust ]
+
+  * SAUCE: NFS: Fix the notifications when renaming onto an existing file
+    - LP: #224642
+
+  [ Upstream Kernel Changes ]
+
+  * USB: option: add QUANTA HSDPA Data Card device ids
+    - LP: #353321
+  * hwmon: (abituguru3) Match partial DMI board name strings
+    - LP: #298798
+  * zd1211rw: adding Sitecom WL-603 (0df6:0036) to the USB id list
+    - LP: #339631
+  * USB: unusual dev for Option N.V. ZeroCD modems
+    - LP: #348861
+
+ --  Tim Gardner <tim.gardner@canonical.com>  Sat, 04 Apr 2009 08:42:14 -0600
+
+linux (2.6.28-11.40) jaunty; urgency=low
+
+  [ Amit Kucheria ]
+
+  * Disable DEVKMEM for all archs on Jaunty
+    - LP: #354221
+
+  [ Andy Whitcroft ]
+
+  * SAUCE: md: wait for possible pending deletes after stopping an array
+    - LP: #334994
+
+  [ Brad Figg ]
+
+  * ARM: Setting the bootloader for imx51 flavour.
+    - LP: #348382
+  * ARM: Add bootloader package Recomendation to iop32x and ixp4xx flavours
+    - LP: #348382
+
+  [ Tim Gardner ]
+
+  * SAUCE: [i915] allocate MCHBAR space & enable if necessary
+    - LP: #349314
+
+  [ Upstream Kernel Changes ]
+
+  * hpilo: open/close fix
+    - LP: #353496
+
+ -- Amit Kucheria <amit.kucheria@canonical.com>  Thu, 02 Apr 2009 11:26:22 -0400
+
+linux (2.6.28-11.39) jaunty; urgency=low
+
+  [ Alan Tull ]
+
+  * SAUCE: mx51: fix to1.1 in mxc_iomux_set_input
+    - LP: #348333
+
+  [ Andy Whitcroft ]
+
+  * SAUCE: acer: rfkill disable quirk for ACER Aspire One
+    - LP: #319825
+
+  [ Brad Figg ]
+
+  * ARM: Increase CONFIG_BLK_DEV_RAM_SIZE for imx51 flavour.
+    - LP: #349842
+  * ARM: Enable rtl8187 for imx51
+    - LP: #349526
+  * ARM: Unset CONFIG_USB_STORAGE_DEBUG for imx51
+    - LP: #348504
+
+  [ Bryan Wu ]
+
+  * build CRAMFS into kernel to support mounting CRAMFS initrd on iop32x
+    machine
+    - LP: #349104
+
+  [ Michael Casadevall ]
+
+  * [lpia] Change ATA, SCSI, SD, ext2-4 modules into compiled-in components
+    - LP: #347458
+
+  [ Rob Herring ]
+
+  * SAUCE: imx51: fec: fix cache operations for receive
+    - LP: #348333
+
+  [ Sam Yang ]
+
+  * SAUCE: Revert ENGR00103870 FEC reopening causes network wdog timeout
+    - LP: #348333
+  * SAUCE: imx51: fec cache flush functions are incorrect
+    - LP: #348333
+
+  [ Upstream Kernel Changes ]
+
+  * Bluetooth: Add fine grained mem_flags usage to btusb driver
+    - LP: #268502
+  * Bluetooth: Handle bulk URBs in btusb driver from notify callback
+    - LP: #268502
+  * Bluetooth: Submit bulk URBs along with interrupt URBs
+    - LP: #268502
+
+ --  Tim Gardner <tim.gardner@canonical.com>  Wed, 01 Apr 2009 17:37:32 -0600
+
+linux (2.6.28-11.38) jaunty; urgency=low
+
+  [ Brad Figg ]
+
+  * When AppArmor is configured, securityfs must be as well.
+    - LP: #344370
+  * ARM: Enable AA with SECURITYFS for imx51
+    - LP: #344370
+
+  [ Bryan Wu ]
+
+  * Add 3 missing files to prerm remove file list
+    - LP: #345623
+
+  [ Daniel T Chen ]
+
+  * SAUCE: (drop after 2.6.28) Don't trust hw-ptr blindly
+    - LP: #330814
+  * SAUCE: (drop after 2.6.28) Apply further pcm_lib updates for hw_ptr
+    - LP: #330814
+
+  [ Ike Panhc ]
+
+  * Copy header files for various kernel media driver
+    - LP: #322732
+
+  [ Tim Gardner ]
+
+  * Revert "Fix the VFP handling on the Feroceon CPU"
+    Only applied to mv78xx0 ARM flavour.
+  * Enabled drivers/staging/at76_usb
+    - LP: #152626
+
+  [ ubuntu@tjworld.net ]
+
+  * SAUCE: ipw2200: Enable LED by default
+    - LP: #21367
+  * SAUCE: wistron_btns: support Prestigio Wifi RF kill button over suspend
+    - LP: #346586
+
+  [ Upstream Kernel Changes ]
+
+  * Build fix for __early_pfn_to_nid() undefined link error
+  * Fix misreporting of #cores as #hyperthreads for Q9550
+  * eventfd: remove fput() call from possible IRQ context
+  * S390: __div64_31 broken for CONFIG_MARCH_G5
+  * ALSA: Fix vunmap and free order in snd_free_sgbuf_pages()
+  * ALSA: mixart, fix lock imbalance
+  * ALSA: pcm_oss, fix locking typo
+  * ALSA: hda - Fix DMA mask for ATI controllers
+  * ALSA: hda - Workaround for buggy DMA position on ATI controllers
+  * ALSA: opl3sa2 - Fix NULL dereference when suspending snd_opl3sa2
+  * nfsd: nfsd should drop CAP_MKNOD for non-root
+  * NFSD: provide encode routine for OP_OPENATTR
+  * dm ioctl: validate name length when renaming
+  * dm io: respect BIO_MAX_PAGES limit
+  * dm crypt: fix kcryptd_async_done parameter
+  * dm crypt: wait for endio to complete before destruction
+  * ata_piix: add workaround for Samsung DB-P70
+  * V4L/DVB (10218): cx23885: Fix Oops for mixed install of analog and
+    digital only cards
+  * thinkpad-acpi: fix module autoloading for older models
+  * Add '-fwrapv' to gcc CFLAGS
+  * Move cc-option to below arch-specific setup
+  * USB: storage: Unusual USB device Prolific 2507 variation added
+  * USB: Add Vendor/Product ID for new CDMA U727 to option driver
+  * USB: option.c: add ZTE 622 modem device
+  * USB: Add device id for Option GTM380 to option driver
+  * USB: Option: let cdc-acm handle Sony Ericsson F3507g / Dell 5530
+  * USB: Updated unusual-devs entry for USB mass storage on Nokia 6233
+  * USB: unusual_devs: Add support for GI 0431 SD-Card interface
+  * USB: serial: add FTDI USB/Serial converter devices
+  * USB: serial: ftdi: enable UART detection on gnICE JTAG adaptors
+    blacklist interface0
+  * USB: serial: new cp2101 device id
+  * USB: usbtmc: fix stupid bug in open()
+  * USB: usbtmc: add protocol 1 support
+  * USB: usbfs: keep async URBs until the device file is closed
+  * USB: EHCI: expedite unlinks when the root hub is suspended
+  * USB: EHCI: Fix isochronous URB leak
+  * powerpc: Remove extra semicolon in fsl_soc.c
+  * menu: fix embedded menu snafu
+  * Linux 2.6.28.9
+  * Add '-fwrapv' to gcc CFLAGS
+    - LP: #348015
+  * Move cc-option to below arch-specific setup
+    - LP: #348015
+  * Revert Staging: at76_usb: update drivers/staging/at76_usb w/ mac80211
+    port
+    - LP: #152626
+  * Staging: at76_usb: fix bugs introduced by "Staging: at76_usb: cleanup
+    dma on stack issues"
+    - LP: #152626
+  * Staging: at76_usb: Add support for OQO Model 01+
+    - LP: #152626
+
+ --  Tim Gardner <tim.gardner@canonical.com>  Mon, 23 Mar 2009 19:20:08 -0600
+
+linux (2.6.28-11.37) jaunty; urgency=low
+
+  [ Alex Deucher ]
+
+  * SAUCE: radeon: add some new pci ids
+    - LP: #334101
+
+  [ Amit Kucheria ]
+
+  * Updating configs - rip out orion5x and mv78xx0 flavours
+
+  [ Andy Whitcroft ]
+
+  * SAUCE: tone down the synaptics warning to avoid triggering kerneloops
+    - LP: #330606
+
+  [ Upstream Kernel Changes ]
+
+  * ext4: fix header check in ext4_ext_search_right() for deep extent
+    trees.
+    - LP: #346194
+  * eCryptfs: NULL crypt_stat dereference during lookup
+    - LP: #345766
+  * eCryptfs: Allocate a variable number of pages for file headers
+    (CVE-2009-0787)
+    - LP: #345544
+
+ --  Tim Gardner <tim.gardner@canonical.com>  Mon, 23 Mar 2009 09:24:32 -0600
+
+linux (2.6.28-11.36) jaunty; urgency=low
+
+  [ Amit Kucheria ]
+
+  * Updating imx51 configs one more time
+  * Disable CONFIG_UEVENT_HELPER_PATH
+
+  [ Anton Veretenenko ]
+
+  * SAUCE: sony-laptop: add support for Sony Vaio FW series function/media
+    keys
+    - LP: #307592
+
+  [ Brad Figg ]
+
+  * Have AUFS use current VFS APIs so it can build with or without
+    AppArmor.
+
+  [ Bryan Wu ]
+
+  * Build-in "Ram block device support" to boot up with initramfs
+    - LP: #329098
+  * Remove brd module from iop32x modules list
+    - LP: #329098
+  * Increase the CONFIG_BLK_DEV_RAM_SIZE to 8192 on i.MX51
+
+  [ Ike Panhc ]
+
+  * SAUCE: Fixing symbol name in HECI module
+    - LP: #336549
+
+  [ Manoj Iyer ]
+
+  * SAUCE: Added quirk for Ralink rt2870 802.11n USB driver
+    - LP: #326621
+
+  [ Upstream Kernel Changes ]
+
+  * udf:SAUCE (drop after 2.6.30): Fix oops when invalid character in
+    filename occurs
+    - LP: #321606
+
+ -- Stefan Bader <stefan.bader@canonical.com>  Fri, 20 Mar 2009 16:52:08 +0100
+
+linux (2.6.28-11.35) jaunty; urgency=low
+
+  [ Amit Kucheria ]
+
+  * Updating imx51 configs
+
+  [ Andy Whitcroft ]
+
+  * SAUCE: hotkey quirks for various Zeptro Znote and Fujitsu Amilo laptops
+    - LP: #330259
+
+  [ Tim Gardner ]
+
+  * Revert "SAUCE: (drop after 2.6.28) eCryptfs: Don't encrypt file key
+    with filename key". Use upstream commit.
+  * CONFIG_SECURITY_DEFAULT_MMAP_MIN_ADDR set to upstream defaults.
+    64K for x86'en, 32K for ARM
+    - LP: #344955
+
+  [ Upstream Kernel Changes ]
+
+  * eCryptfs: don't encrypt file key with filename key
+  * libata: set NODEV_HINT for 0x7f status
+    - LP: #293218
+  * USB: cdc-acm: Add another conexant modem to the quirks
+    - LP: #323829
+  * Input: elantech - touchpad driver miss-recognising logitech mice
+    - LP: #318722
+
+ --  Tim Gardner <tim.gardner@canonical.com>  Wed, 18 Mar 2009 08:52:46 -0600
+
+linux (2.6.28-11.34) jaunty; urgency=low
+
+  [ Alex Deucher ]
+
+  * SAUCE: (drop after 2.6.28) radeon: add support for RS600, R6xx, and
+    R7xx GPUs
+    - LP: #334101
+
+  [ Aristeu Sergio Rozanski Filho ]
+
+  * SAUCE: (drop after 2.6.28) ALSA: hda: add quirk for Lenovo X200 laptop
+    dock
+
+  [ Shane Huang ]
+
+  * SAUCE: (drop after 2.6.28) i2c-piix4: Add support to SB800 SMBus
+    changes
+    - LP: #338108
+
+  [ Upstream Kernel Changes ]
+
+  * net: amend the fix for SO_BSDCOMPAT gsopt infoleak
+  * net: Kill skb_truesize_check(), it only catches false-positives.
+  * sparc64: Fix crashes in jbusmc_print_dimm()
+  * sparc64: Fix DAX handling via userspace access from kernel.
+  * vfs: separate FMODE_PREAD/FMODE_PWRITE into separate flags
+  * seq_file: properly cope with pread
+  * vt: Declare PIO_CMAP/GIO_CMAP as compatbile ioctls.
+  * timerfd: add flags check
+  * aoe: ignore vendor extension AoE responses
+  * mm: clean up for early_pfn_to_nid()
+  * mm: fix memmap init for handling memory hole
+  * Fix oops in cifs_strfromUCS_le mounting to servers which do not specify
+    their OS
+  * mm: fix lazy vmap purging (use-after-free error)
+  * mm: vmap fix overflow
+  * PCI quirk: enable MSI on 8132
+  * SCSI: hptiop: Add new PCI device ID
+  * JFFS2: fix mount crash caused by removed nodes
+  * SCSI: sd: revive sd_index_lock
+  * USB: usb_get_string should check the descriptor type
+  * USB: usb-storage: add IGNORE_RESIDUE flag for Genesys Logic adapters
+  * USB: cdc-acm: add usb id for motomagx phones
+  * rtl8187: New USB ID's for RTL8187L
+  * WATCHDOG: ks8695_wdt.c: 'CLOCK_TICK_RATE' undeclared
+  * WATCHDOG: rc32434_wdt: fix watchdog driver
+  * WATCHDOG: rc32434_wdt: fix sections
+  * RDMA/nes: Don't allow userspace QPs to use STag zero
+  * USB: option: add BenQ 3g modem information
+  * md: avoid races when stopping resync.
+  * md/raid10: Don't call bitmap_cond_end_sync when we are doing recovery.
+  * md/raid10: Don't skip more than 1 bitmap-chunk at a time during
+    recovery.
+  * sound: virtuoso: revert "do not overwrite EEPROM on Xonar D2/D2X"
+  * ALSA: usb-audio - Fix non-continuous rate detection
+  * ALSA: usb-audio - Workaround for misdetected sample rate with CM6207
+  * sound: usb-audio: fix uninitialized variable with M-Audio MIDI
+    interfaces
+  * ALSA: fix excessive background noise introduced by OSS emulation rate
+    shrink
+  * ALSA: hda - Fix digital mic on dell-m4-1 and dell-m4-3
+  * ALSA: aw2: do not grab every saa7146 based device
+  * acer-wmi: fix regression in backlight detection
+  * vmalloc: call flush_cache_vunmap() from unmap_kernel_range()
+  * Fix fixpoint divide exception in acct_update_integrals
+  * 8250: fix boot hang with serial console when using with Serial Over Lan
+    port
+  * x86, vmi: TSC going backwards check in vmi clocksource
+  * HID: fix bus endianity in file2alias
+  * inotify: fix GFP_KERNEL related deadlock
+  * sdhci: fix led naming
+  * x86: oprofile: don't set counter width from cpuid on Core2
+  * intel-agp: fix a panic with 1M of shared memory, no GTT entries
+  * mtd_dataflash: fix probing of AT45DB321C chips.
+  * proc: fix kflags to uflags copying in /proc/kpageflags
+  * fs: new inode i_state corruption fix
+  * PCIe: portdrv: call pci_disable_device during remove
+  * PCI: Enable PCIe AER only after checking firmware support
+  * jsm: additional device support
+  * libata: Don't trust current capacity values in identify words 57-58
+  * mmc: fix data timeout for SEND_EXT_CSD
+  * s3cmci: Fix hangup in do_pio_write()
+  * mmc: s3cmci: fix s3c2410_dma_config() arguments.
+  * MMC: fix bug - SDHC card capacity not correct
+  * mmc_test: fix basic read test
+  * x86: tone down mtrr_trim_uncached_memory() warning
+  * selinux: Fix a panic in selinux_netlbl_inode_permission()
+  * selinux: Fix the NetLabel glue code for setsockopt()
+  * hpilo: new pci device
+  * x86-64: seccomp: fix 32/64 syscall hole
+  * x86-64: syscall-audit: fix 32/64 syscall hole
+  * xen: disable interrupts early, as start_kernel expects
+  * xen/blkfront: use blk_rq_map_sg to generate ring entries
+  * asix: new device ids
+  * cdc_ether: add usb id for Ericsson F3507g
+  * zaurus: add usb id for motomagx phones
+  * fore200: fix oops on failed firmware load
+  * PCI: Add PCI quirk to disable L0s ASPM state for 82575 and 82598
+  * copy_process: fix CLONE_PARENT && parent_exec_id interaction
+  * proc: fix PG_locked reporting in /proc/kpageflags
+  * powerpc: Fix load/store float double alignment handler
+  * sdhci: Add quirk for controllers with no end-of-busy IRQ
+  * sdhci: Add NO_BUSY_IRQ quirk for Marvell CAFE host chip
+  * pipe_rdwr_fasync: fix the error handling to prevent the leak/crash
+  * DVB: s5h1409: Perform s5h1409 soft reset after tuning
+  * V4L: tda8290: fix TDA8290 + TDA18271 initialization
+  * V4L: ivtv: fix decoder crash regression
+  * x86/paravirt: make arch_flush_lazy_mmu/cpu disable preemption
+  * x86, hpet: fix for LS21 + HPET = boot hang
+  * x86: math_emu info cleanup
+  * x86: fix math_emu register frame access
+  * ide-iops: fix odd-length ATAPI PIO transfers
+  * HID: move tmff and zpff devices from ignore_list to blacklist
+  * ARM: Add i2c_board_info for RiscPC PCF8583
+  * i2c: Timeouts reach -1
+  * i2c: Fix misplaced parentheses
+  * ACPI: fix broken usage of name.ascii
+  * ACPI: fix broken usage of acpi_ut_get_node_name()
+  * crypto: api - Fix algorithm test race that broke aead initialisation
+  * hwmon: (f71882fg) Hide misleading error message
+  * MIPS: compat: Implement is_compat_task.
+  * hwmon: (it87) Properly decode -128 degrees C temperature
+  * Linux 2.6.28.8
+
+ --  Tim Gardner <tim.gardner@canonical.com>  Tue, 17 Mar 2009 07:07:33 -0600
+
+linux (2.6.28-10.33) jaunty; urgency=low
+
+  [ Scott James Remnant ]
+
+  * SAUCE: nbd: Change default partitions per device to 15
+    - LP: #342563
+
+  [ Tejun Heo ]
+
+  * SAUCE: libata: make sure port is thawed when skipping resets
+    - LP: #269652
+
+  [ Tim Gardner ]
+
+  * Revert "SAUCE: Auto-load esp module when device opened."
+    This driver performs unsafe ISA probes (according to Alan Cox).
+  * Enable CONFIG_USB_GADGET_DUMMY_HCD
+    This facilitates gadget slave endpoints in virtual environments.
+  * Build ehci, uhci, and ohci into the i386/amd64 kernels
+    - LP: #296710
+
+  [ Upstream Kernel Changes ]
+
+  * Add "thumbee" to the hwcap_str array
+    - LP: #343602
+  * Add HWCAP_NEON to the ARM hwcap.h file
+    - LP: #343602
+  * x86: mtrr: don't modify RdDram/WrDram bits of fixed MTRRs
+    - LP: #292619
+
+ --  Tim Gardner <tim.gardner@canonical.com>  Mon, 16 Mar 2009 08:19:53 -0600
+
+linux (2.6.28-10.32) jaunty; urgency=low
+
+  [ Amit Kucheria ]
+
+  * Delete prepare-ppa-source script
+
+  [ Andy Isaacson ]
+
+  * SAUCE: FSAM7400: select CHECK_SIGNATURE
+  * SAUCE: LIRC_PVR150: depends on VIDEO_IVTV
+    - LP: #341477
+
+  [ Ayaz Abdulla ]
+
+  * SAUCE: forcedeth: msi interrupt fix
+    - LP: #288281
+
+  [ Brad Figg ]
+
+  * Updating armel configs to remove PREEMPT
+
+  [ Catalin Marinas ]
+
+  * Fix the VFP handling on the Feroceon CPU
+
+  [ Huaxu Wan ]
+
+  * SAUCE: (drop after 2.6.28) [Jaunty] iwlagn: fix iwlagn DMA mapping
+    direction
+
+  [ Ike Panhc ]
+
+  * squashfs: correct misspelling
+    - LP: #322306
+
+  [ Theodore Ts'o ]
+
+  * SAUCE: (drop after 2.6.28) ext4: add EXT4_IOC_ALLOC_DA_BLKS ioctl
+  * SAUCE: (drop after 2.6.28) ext4: Automatically allocate delay allocated
+    blocks on close
+  * SAUCE: (drop after 2.6.28) ext4: Automatically allocate delay allocated
+    blocks on rename
+    - LP: #317781
+
+  [ Tyler Hicks ]
+
+  * SAUCE: (drop after 2.6.28) eCryptfs: Don't encrypt file key with
+    filename key
+    - LP: #342128
+
+  [ Upstream Kernel Changes ]
+
+  * ALS: hda - Add support of iMac 24 Aluminium
+  * USB: fix broken OTG makefile reference
+  * ALSA: hda - add another MacBook Pro 3,1 SSID
+  * ALSA: hda - Add model entry for HP dv4
+  * x86-64: fix int $0x80 -ENOSYS return
+    - LP: #339743
+
+ --  Tim Gardner <tim.gardner@canonical.com>  Thu, 12 Mar 2009 19:16:07 -0600
+
+linux (2.6.28-9.31) jaunty; urgency=low
+
+  [ Andy Whitcroft ]
+
+  * SAUCE: cpufreq-nforce2: probe failures are not errors
+    - LP: #332170
+  * SAUCE: mmc: add MODALIAS linkage for MMC/SD devices
+    - LP: #30335
+  * remove test-suspend script
+    - LP: #333856
+
+  [ Kees Cook ]
+
+  * handle relative paths in modules.dep
+    Fixes 2.6.28-9.30 FTBS.
+
+  [ Upstream Kernel Changes ]
+
+  * ricoh_mmc: Handle newer models of Ricoh controllers
+
+ --  Tim Gardner <tim.gardner@canonical.com>  Wed, 11 Mar 2009 08:19:24 -0600
+
+linux (2.6.28-9.30) jaunty; urgency=low
+
+  [ Amit Kucheria ]
+
+  * ARM:mx51 Add SoC and board support for mx51 platforms
+  * ARM:mx51 Add CONFIG_ARCH_MXC_CANONICAL to disable parts of Freescale's
+    code
+  * MMC: Add support for 8-bit cards
+  * Add ARM:MX51 SoC support to the build system
+  * ARM: Make ARM arch aware of ubuntu/ drivers
+  * ARM: Add imx51 configuration
+  * Disable d-i modules for imx51 and mv78xx0
+  * Disable Apparmor on boot for ARM
+  * Updating imx51 config
+
+  [ Jason Liu ]
+
+  * Do not use OOB with MLC NAND
+
+  [ Richard Zhu ]
+
+  * Support the eMMC4.3 card
+
+  [ Rob Herring ]
+
+  * ARM: Add more cache memory types macros
+
+  [ Tim Gardner ]
+
+  * Set CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE=y for i386/amd64/lpia
+
+  [ Manoj Iyer ]
+
+  * Enable CONFIG_RTL8187SE=m
+
+  [ Upstream Kernel Changes ]
+
+  * USB: EHCI: slow down ITD reuse
+    - LP: #329437
+
+ --  Tim Gardner <tim.gardner@canonical.com>  Sun, 08 Mar 2009 14:14:15 -0600
+
+linux (2.6.28-9.29) jaunty; urgency=low
+
+  [ Andy Whitcroft ]
+
+  * link-headers -- only link directories which do not already exist
+    - LP: #315252
+
+  [ Daniel Marjamäki ]
+
+  * SAUCE: (drop after 2.6.28) netxen: fix memory leak in
+    drivers/net/netxen_nic_init.c
+    - LP: #330813
+
+  [ Dhananjay Phadke ]
+
+  * SAUCE: (drop after 2.6.28) netxen: fix endianness in firmware commands
+    - LP: #330813
+  * SAUCE: (drop after 2.6.28) netxen: fix ipv6 offload and tx cleanup
+    - LP: #330813
+  * SAUCE: (drop after 2.6.28) netxen: fix link speed reporting for some
+    boards
+    - LP: #330813
+  * SAUCE: (drop after 2.6.28) netxen: firmware init fix
+    - LP: #330813
+  * SAUCE: (drop after 2.6.28) netxen: cleanup mac list on driver unload
+    - LP: #330813
+  * SAUCE: (drop after 2.6.28) netxen: hold tx lock while sending firmware
+    commands
+    - LP: #330813
+  * SAUCE: (drop after 2.6.28) netxen: handle dma mapping failures
+    - LP: #330813
+  * SAUCE: (drop after 2.6.28) netxen: avoid invalid iounmap
+    - LP: #330813
+  * SAUCE: (drop after 2.6.28) netxen: include ipv6.h (fixes build failure)
+    - LP: #330813
+  * SAUCE: (drop after 2.6.28) netxen: fix vlan tso/checksum offload
+    - LP: #330813
+  * SAUCE: (drop after 2.6.28) netxen: reduce memory footprint
+    - LP: #330813
+  * SAUCE: (drop after 2.6.28) netxen: revert jumbo ringsize
+    - LP: #330813
+  * SAUCE: (drop after 2.6.28) netxen: fix msi-x interrupt handling
+    - LP: #330813
+  * SAUCE: (drop after 2.6.28) netxen: remove pcie workaround
+    - LP: #330813
+
+  [ Hannes Eder ]
+
+  * SAUCE: (drop after 2.6.28) drivers/net/netxen: fix sparse warnings: use
+    NULL pointer instead of plain integer
+    - LP: #330813
+
+  [ Huaxu Wan ]
+
+  * SAUCE: report rfkill changes event if interface is down
+    - LP: #193970
+
+  [ Tim Gardner ]
+
+  * MV78XX0 must specify a target in the vars definition.
+
+  [ Upstream Kernel Changes ]
+
+  * Revert "ext4: wait on all pending commits in ext4_sync_fs()"
+  * jbd2: Fix return value of jbd2_journal_start_commit()
+  * jbd2: Avoid possible NULL dereference in
+    jbd2_journal_begin_ordered_truncate()
+  * ext4: Fix to read empty directory blocks correctly in 64k
+  * ext4: Fix lockdep warning
+  * ext4: Initialize preallocation list_head's properly
+  * ext4: Implement range_cyclic in ext4_da_writepages instead of
+    write_cache_pages
+  * ext4: Fix NULL dereference in ext4_ext_migrate()'s error handling
+  * ext4: Add fallback for find_group_flex
+  * ext4: Fix deadlock in ext4_write_begin() and ext4_da_write_begin()
+  * Added mv78xx0 flavor
+
+ --  Tim Gardner <tim.gardner@canonical.com>  Fri, 06 Mar 2009 06:13:31 -0700
+
+linux (2.6.28-8.28) jaunty; urgency=low
+
+  [ Alexey Starikovskiy ]
+
+  * SAUCE: ACPI: EC: Limit workaround for ASUS notebooks even more
+    - LP: #288385
+
+  [ Scott James Remnant ]
+
+  * SAUCE: Auto-load esp module when device opened.
+  * SAUCE: Auto-load bridge module when socket opened.
+  * SAUCE: Auto-load af_netlink module when socket opened.
+  * SAUCE: Auto-load wanrouter module when socket opened.
+  * SAUCE: Auto-load ip_queue module when socket opened.
+  * SAUCE: Auto-load ip6_queue module when socket opened.
+  * SAUCE: Auto-load cn module when socket opened.
+  * SAUCE: Auto-load scsi_transport_iscsi module when socket opened.
+  * SAUCE: Auto-load ftl module when device opened.
+  * SAUCE: Auto-load pcd module when device opened.
+  * SAUCE: Auto-load pf module when device opened.
+  * SAUCE: Auto-load nftl module when device opened.
+  * SAUCE: Auto-load mousedev module when psaux device opened.
+  * SAUCE: Auto-load mousedev module when /dev/input/mice opened.
+  * SAUCE: Auto-load rng-core module when device opened.
+  * SAUCE: Auto-load openprom module when device opened.
+  * SAUCE: Auto-load applicom module when device opened.
+  * SAUCE: Auto-load toshiba module when device opened.
+  * SAUCE: Auto-load cyclades module when device opened.
+  * SAUCE: Auto-load riscom8 module when device opened.
+  * SAUCE: Auto-load specialix module when device opened.
+  * SAUCE: Auto-load videodev module when device opened.
+  * SAUCE: Auto-load i2c_dev module when device opened.
+  * SAUCE: Auto-load mtdchar module when device opened.
+  * SAUCE: Auto-load pt module when device opened.
+  * SAUCE: Auto-load pg module when device opened.
+  * SAUCE: Auto-load cdc_acm module when device opened.
+  * SAUCE: Auto-load msr module when device opened.
+  * SAUCE: Auto-load cpuid module when device opened.
+  * SAUCE: quickcam: Enable double-buffering by default
+  * SAUCE: libata: Ignore HPA by default.
+  * SAUCE: hostap: Change initial operation mode to managed (infra)
+  * SAUCE: floppy: Provide a PnP device table in the module.
+    - LP: #255651
+  * SAUCE: Auto-load mwave module when device opened.
+  * Build CONFIG_FUSE_FS into kernel, not as module.
+
+  [ Stefan Bader ]
+
+  * Enable build of ext4 as a module on LPIA
+    - LP: #331848
+
+  [ Tim Gardner ]
+
+  * Update configs to fix LPIA FTBS
+
+ --  Tim Gardner <tim.gardner@canonical.com>  Thu, 05 Mar 2009 10:43:24 -0700
+
+linux (2.6.28-8.27) jaunty; urgency=low
+
+  [ Amit Kucheria ]
+
+  * Updating configs (arm:ixp4xx)
+
+  [ Andy Whitcroft ]
+
+  * SAUCE: enable Intel HDMI output
+
+  [ Manoj Iyer ]
+
+  * SAUCE: Added quirk for Linksys WUSB600N USB wifi-n networking adapter
+    - LP: #323473
+
+  [ Steve Beattie ]
+
+  * fix apparmor memory leak on unlinked file ops
+    - LP: #329489
+
+  [ Tim Gardner ]
+
+  * SAUCE: Dell XPS710 reboot quirk
+    - LP: #323592
+  * SAUCE: (drop after 2.6.28) ieee80211: Add infrastructure to obsolete
+    scan results
+    - LP: #336055
+  * Add modules.order to the linux-image package.
+
+  [ Upstream Kernel Changes ]
+
+  * iwlwifi: fix time interval misuse in iwl_poll_{direct_}bit
+  * x86: only scan the root bus in early PCI quirks
+    - LP: #267295
+  * ALSA: hda - Intel HDMI audio support
+  * ALSA: hda - Fix unused function in patch_intelhdmi.c
+  * ALSA: handle SiI1392 HDMI codec in patch_intelhdmi.c
+  * ALSA: hda-intel: reorder HDMI audio enabling sequence
+  * ALSA: introduce snd_print_pcm_rates()
+  * ALSA: create hda_eld.c for ELD routines and proc interface
+  * ALSA: ELD proc interface for HDMI sinks
+  * ALSA: hda: make standalone hdmi_fill_audio_infoframe()
+  * ALSA: hda: make global snd_print_channel_allocation()
+  * ALSA: hda: HDMI channel allocations for audio infoframe
+  * ALSA: hda: HDMI channel mapping cleanups
+  * ALSA: hda: minor code cleanups
+  * ALSA: hda: rename sink_eld to hdmi_eld
+  * ALSA: hda - Release ELD proc file
+  * ALSA: hda - minor HDMI code cleanups
+  * ALSA: hda - report selected CA index for Audio InfoFrame
+  * ALSA: hda - Add Intel vendor id string
+
+ --  Tim Gardner <tim.gardner@canonical.com>  Wed, 25 Feb 2009 14:23:46 -0700
+
+linux (2.6.28-8.26) jaunty; urgency=low
+
+  [ Amit Kucheria ]
+
+  * Updating configs (armel:ixp4xx)
+    - LP: #331510
+
+  [ Tim Gardner ]
+
+  * Add more missing modules
+
+ --  Tim Gardner <tim.gardner@canonical.com>  Tue, 24 Feb 2009 06:58:53 -0700
+
+linux (2.6.28-8.25) jaunty; urgency=low
+
+  [ Scott James Remnant ]
+
+  * SAUCE: Prefer powernow-k8 to acpi-cpufreq
+  * Change CONFIG_X86_P4_CLOCKMOD to be a module again.
+
+  [ Tim Gardner ]
+
+  * Revert "SAUCE: (revert before 2.6.28.y update) ext4: Initialize the new
+    group descriptor when resizing the filesystem"
+  * Revert "SAUCE: (revert before 2.6.28.y update) ext4: Add sanity check
+    to make_indexed_dir"
+  * Revert "SAUCE: (revert before 2.6.28.y update) ext4: only use
+    i_size_high for regular files"
+  * Revert "SAUCE: (revert before 2.6.28.y update) ext4: Add sanity checks
+    for the superblock before mounting the filesystem"
+  * Revert "SAUCE: (revert before 2.6.28.y update) ext4: Fix
+    s_dirty_blocks_counter if block allocation failed with nodelalloc"
+  * Revert "SAUCE: (revert before 2.6.28.y update) ext4: Init the complete
+    page while building buddy cache"
+  * Revert "SAUCE: (revert before 2.6.28.y update) ext4: Don't allow new
+    groups to be added during block allocation"
+  * Revert "SAUCE: (revert before 2.6.28.y update) ext4: mark the
+    blocks/inode bitmap beyond end of group as used"
+  * Revert "SAUCE: (revert before 2.6.28.y update) ext4: Use new
+    buffer_head flag to check uninit group bitmaps initialization"
+  * Revert "SAUCE: (revert before 2.6.28.y update) ext4: Fix the race
+    between read_inode_bitmap() and ext4_new_inode()"
+  * Revert "SAUCE: (revert before 2.6.28.y update) ext4: Fix race between
+    read_block_bitmap() and mark_diskspace_used()"
+  * Revert "SAUCE: (revert before 2.6.28.y update) ext4: don't use blocks
+    freed but not yet committed in buddy cache init"
+  * Revert "SAUCE: (revert before 2.6.28.y update) ext4: cleanup mballoc
+    header files"
+  * Revert "SAUCE: (revert before 2.6.28.y update) ext4: Use
+    EXT4_GROUP_INFO_NEED_INIT_BIT during resize"
+  * Revert "SAUCE: (revert before 2.6.28.y update) ext4: Add blocks added
+    during resize to bitmap"
+  * Revert "SAUCE: (revert before 2.6.28.y update) ext4: Don't overwrite
+    allocation_context ac_status"
+  * Revert "SAUCE: (revert before 2.6.28.y update) jbd2: Add barrier not
+    supported test to journal_wait_on_commit_record"
+  * Revert "SAUCE: (revert before 2.6.28.y update) ext4: Widen type of
+    ext4_sb_info.s_mb_maxs[]"
+  * Revert "SAUCE: (revert before 2.6.28.y update) ext4: avoid ext4_error
+    when mounting a fs with a single bg"
+  * Revert "SAUCE: (revert before 2.6.28.y update) ext4: Fix the delalloc
+    writepages to allocate blocks at the right offset."
+  * Revert "SAUCE: (revert before 2.6.28.y update) ext4: tone down
+    ext4_da_writepages warnings"
+  * Revert "SAUCE: (revert before 2.6.28.y update) ext4: Add support for
+    non-native signed/unsigned htree hash algorithms"
+  * Enabled X86_ACPI_CPUFREQ=y
+
+  [ Upstream Kernel Changes ]
+
+  * ath9k: quiet harmless ForceXPAon messages
+    - LP: #321474
+  * [WATCHDOG] iTCO_wdt: fix SMI_EN regression 2
+    - LP: #314050
+  * pid: implement ns_of_pid
+  * mqueue: fix si_pid value in mqueue do_notify()
+  * powerpc/vsx: Fix VSX alignment handler for regs 32-63
+  * sata_nv: give up hardreset on nf2
+  * Fix Intel IOMMU write-buffer flushing
+  * SCSI: libiscsi: fix iscsi pool leak
+  * x86/cpa: make sure cpa is safe to call in lazy mmu mode
+  * sched: SCHED_OTHER vs SCHED_IDLE isolation
+  * x86, vm86: fix preemption bug
+  * Add support for VT6415 PCIE PATA IDE Host Controller
+  * ext2/xip: refuse to change xip flag during remount with busy inodes
+  * 3c505: do not set pcb->data.raw beyond its size
+  * Bluetooth: Fix TX error path in btsdio driver
+  * ext4: Add support for non-native signed/unsigned htree hash algorithms
+  * ext4: tone down ext4_da_writepages warnings
+  * ext4: Fix the delalloc writepages to allocate blocks at the right
+    offset.
+  * ext4: avoid ext4_error when mounting a fs with a single bg
+  * ext4: Widen type of ext4_sb_info.s_mb_maxs[]
+  * jbd2: Add barrier not supported test to journal_wait_on_commit_record
+  * ext4: Don't overwrite allocation_context ac_status
+  * ext4: Add blocks added during resize to bitmap
+  * ext4: Use EXT4_GROUP_INFO_NEED_INIT_BIT during resize
+  * ext4: cleanup mballoc header files
+  * ext4: don't use blocks freed but not yet committed in buddy cache init
+  * ext4: Fix race between read_block_bitmap() and mark_diskspace_used()
+  * ext4: Fix the race between read_inode_bitmap() and ext4_new_inode()
+  * ext4: Use new buffer_head flag to check uninit group bitmaps
+    initialization
+  * ext4: mark the blocks/inode bitmap beyond end of group as used
+  * ext4: Don't allow new groups to be added during block allocation
+  * ext4: Init the complete page while building buddy cache
+  * ext4: Fix s_dirty_blocks_counter if block allocation failed with
+    nodelalloc
+  * ext4: Add sanity checks for the superblock before mounting the
+    filesystem
+  * ext4: only use i_size_high for regular files
+  * ext4: Add sanity check to make_indexed_dir
+  * ext4: Initialize the new group descriptor when resizing the filesystem
+  * Fix longstanding "error: storage size of '__mod_dmi_device_table' isn't
+    known"
+  * Linux 2.6.28.7
+
+ --  Tim Gardner <tim.gardner@canonical.com>  Thu, 19 Feb 2009 06:45:55 -0700
+
+linux (2.6.28-8.24) jaunty; urgency=low
+
+  [ Scott James Remnant ]
+
+  * Change CPU_FREQ_DEFAULT_GOV_ONDEMAND to y
+  * SAUCE: Link acpi-cpufreq.o first
+
+  [ Tim Gardner ]
+
+  * Build in CPU Frequency scaling drivers
+
+ --  Tim Gardner <tim.gardner@canonical.com>  Wed, 18 Feb 2009 06:12:24 -0700
+
+linux (2.6.28-8.23) jaunty; urgency=low
+
+  [ Andy Whitcroft ]
+
+  * include the kernel configuration in the sub-flavour images
+    - LP: #328859
+
+  [ Tim Gardner ]
+
+  * Revert "SAUCE: (drop after 2.6.28) [eCryptfs] Regression in unencrypted
+    filename symlinks" in favor of upstream commit.
+  * Fix compile issues with qc-usb
+  * SAUCE: (remove after 2.6.28) V4L/DVB (10216): saa7127: fix broken
+    S-Video with saa7129
+    - LP: #329267
+
+  [ Upstream Kernel Changes ]
+
+  * Subject:SAUCE: LP#193970 iwlagn: fix hw-rfkill while the interface is
+    down
+    - LP: #193970
+  * x86, vmi: put a missing paravirt_release_pmd in pgd_dtor
+  * nbd: fix I/O hang on disconnected nbds
+  * mac80211: restrict to AP in outgoing interface heuristic
+  * w1: w1 temp calculation overflow fix
+  * zd1211rw: adding 0ace:0xa211 as a ZD1211 device
+  * zd1211rw: treat MAXIM_NEW_RF(0x08) as UW2453_RF(0x09) for TP-Link
+    WN322/422G
+  * parport: parport_serial, don't bind netmos ibm 0299
+  * syscall define: fix uml compile bug
+  * kernel-doc: fix syscall wrapper processing
+  * Fix page writeback thinko, causing Berkeley DB slowdown
+  * write-back: fix nr_to_write counter
+  * writeback: fix break condition
+  * mm: rearrange exit_mmap() to unlock before arch_exit_mmap
+  * powerpc/fsl-booke: Fix mapping functions to use phys_addr_t
+  * lockd: fix regression in lockd's handling of blocked locks
+  * sctp: Fix crc32c calculations on big-endian arhes.
+  * sctp: Correctly start rtx timer on new packet transmissions.
+  * sctp: Properly timestamp outgoing data chunks for rtx purposes
+  * net: Fix frag_list handling in skb_seq_read
+  * net: Fix OOPS in skb_seq_read().
+  * drivers/net/skfp: if !capable(CAP_NET_ADMIN): inverted logic
+  * ipv4: fix infinite retry loop in IP-Config
+  * net: Fix userland breakage wrt. linux/if_tunnel.h
+  * net: packet socket packet_lookup_frame fix
+  * packet: Avoid lock_sock in mmap handler
+  * sungem: Soft lockup in sungem on Netra AC200 when switching interface
+    up
+  * udp: Fix UDP short packet false positive
+  * udp: increments sk_drops in __udp_queue_rcv_skb()
+  * ipv6: Disallow rediculious flowlabel option sizes.
+  * ipv6: Copy cork options in ip6_append_data
+  * net: 4 bytes kernel memory disclosure in SO_BSDCOMPAT gsopt try #2
+  * sky2: fix hard hang with netconsoling and iface going up
+  * tun: Add some missing TUN compat ioctl translations.
+  * tun: Fix unicast filter overflow
+  * virtio_net: Fix MAX_PACKET_LEN to support 802.1Q VLANs
+  * tcp: splice as many packets as possible at once
+  * tcp: Fix length tcp_splice_data_recv passes to skb_splice_bits.
+  * sparc: Enable syscall wrappers for 64-bit (CVE-2009-0029)
+  * sparc64: Annotate sparc64 specific syscalls with SYSCALL_DEFINEx()
+  * ALSA: hda - Add missing terminator in slave dig-out array
+  * ALSA: mtpav - Fix initial value for input hwport
+  * HID: adjust report descriptor fixup for MS 1028 receiver
+  * ide/libata: fix ata_id_is_cfa() (take 4)
+  * libata: fix EH device failure handling
+  * netfilter: fix tuple inversion for Node information request
+  * netfilter: xt_sctp: sctp chunk mapping doesn't work
+  * x86: microcode_amd: fix wrong handling of equivalent CPU id
+  * ide-cd: fix DMA for non bio-backed requests
+  * net: Fix data corruption when splicing from sockets.
+  * Linux 2.6.28.6
+  * eCryptfs: Regression in unencrypted filename symlinks
+
+ --  Tim Gardner <tim.gardner@canonical.com>  Mon, 16 Feb 2009 06:43:51 -0700
+
+linux (2.6.28-8.22) jaunty; urgency=low
+
+  [ Amit Kucheria ]
+
+  * Remove perm-blacklist
+
+  [ Andy Whitcroft ]
+
+  * SAUCE: psmouse/synaptics: ensure we reset the device on resume
+    - LP: #317270
+
+  [ Tim Gardner ]
+
+  * Add lpia to getabi script
+  * SAUCE: tracer for sreadahead
+
+ -- Amit Kucheria <amit.kucheria@ubuntu.com>  Fri, 13 Feb 2009 15:23:21 +0200
+
+linux (2.6.28-8.21) jaunty; urgency=low
+
+  [ Andy Whitcroft ]
+
+  * SAUCE: switch the Asus Pundit P1-AH2 to old acpi sleep ordering
+    - LP: #327267
+
+  [ Tim Gardner ]
+
+  * Added LPIA arch support
+  * Added libdrm-dev as a 'Replaces' to linux-libc-dev
+  * SAUCE: LPIA support for 9202 HDA Sigmatel codec
+  * SAUCE: Add an X86_LPIA Kconfig option
+  * SAUCE: UHCI USB quirk for resume
+  * SAUCE: LPIA Reboot fix for Intel Crownbeach development boards
+  * SAUCE: LPIA  Logical reset of USB port on resume
+  * Set CONFIG_WIRELESS_OLD_REGULATORY=n, added wireless-crda
+    as an install dependency.
+
+  [ Upstream Kernel Changes ]
+
+  * Revert "Revert "x86, early_ioremap: fix fencepost error""
+    - LP: #312554
+  * drm/i915: capture last_vblank count at IRQ uninstall time too
+    - LP: #320813
+  * drm/i915: add get_vblank_counter function for GM45
+    - LP: #320813
+  * Staging: comedi: fix Kbuild
+  * Staging: meilhaus: fix Kbuild
+  * Staging: android: binder: fix arm build errors
+  * Staging: android: timed_gpio: Fix build to build on kernels after
+    2.6.25.
+  * Staging: android: fix build error on 64bit boxes
+  * Staging: android: Add lowmemorykiller documentation.
+  * Staging: android: task_get_unused_fd_flags: fix the wrong usage of
+    tsk->signal
+  * staging: agnx: drivers/staging/agnx/agnx.h needs <linux/io.h>
+  * Staging: usbip: usbip_start_threads(): handle kernel_thread failure
+  * Staging: poch: fix verification of memory area
+  * Documentation: move DMA-mapping.txt to Doc/PCI/
+  * sgi-xp: fix writing past the end of kzalloc()'d space
+  * do_wp_page: fix regression with execute in place
+  * wait: prevent exclusive waiter starvation
+  * shm: fix shmctl(SHM_INFO) lockup with !CONFIG_SHMEM
+  * revert "rlimit: permit setting RLIMIT_NOFILE to RLIM_INFINITY"
+  * prevent kprobes from catching spurious page faults
+  * sound: usb-audio: handle wMaxPacketSize for FIXED_ENDPOINT devices
+  * md: Ensure an md array never has too many devices.
+  * md: Fix a bug in linear.c causing which_dev() to return the wrong
+    device.
+  * ACPI: Enable bit 11 in _PDC to advertise hw coord
+  * ACPI: dock: Don't eval _STA on every show_docked sysfs read
+  * ieee1394: ohci1394: increase AT req. retries, fix ack_busy_X from
+    Panasonic camcorders and others
+  * firewire: ohci: increase AT req. retries, fix ack_busy_X from Panasonic
+    camcorders and others
+  * firewire: sbp2: fix DMA mapping leak on the failure path
+  * firewire: sbp2: add workarounds for 2nd and 3rd generation iPods
+  * ieee1394: sbp2: add workarounds for 2nd and 3rd generation iPods
+  * module: remove over-zealous check in __module_get()
+  * x86: APIC: enable workaround on AMD Fam10h CPUs
+  * eeepc-laptop: fix oops when changing backlight brightness during
+    eeepc-laptop init
+  * eeepc-laptop: Add support for extended hotkeys
+  * e1000: fix bug with shared interrupt during reset
+  * e1000: Fix PCI enable to honor the need_ioport flag
+  * agp/intel: Fix broken ® symbol in device name.
+  * ALSA: hda - Add quirk for FSC Amilo Xi2550
+  * ALSA: hda - Add missing COEF initialization for ALC887
+  * ALSA: hda - Add missing initialization for ALC272
+  * asus_acpi: Add R1F support
+  * panasonic-laptop: fix X[ ARRAY_SIZE(X) ]
+  * ACPI: Skip the first two elements in the _BCL package
+  * ACPI: proc_dir_entry 'video/VGA' already registered
+  * ACPI: disable ACPI cleanly when bad RSDP found
+  * ACPICA: Fix table entry truncation calculation
+  * PCI: properly clean up ASPM link state on device remove
+  * PCI: return error on failure to read PCI ROMs
+  * seq_file: move traverse so it can be used from seq_read
+  * seq_file: fix big-enough lseek() + read()
+  * serial: set correct baud_base for Oxford Semiconductor Ltd EXSYS
+    EX-41092 Dual 16950 Serial adapter
+  * Add support for '8-port RS-232 MIC-3620 from advantech'
+  * mm: fix error case in mlock downgrade reversion
+  * elf core dump: fix get_user use
+  * ACPI: video: Fix reversed brightness behavior on ThinkPad SL series
+  * ipw2200: fix scanning while associated
+  * XFS: set b_error from bio error in xfs_buf_bio_end_io
+  * Revert USB: option: add Pantech cards
+  * USB: option: New mobile broadband modems to be supported
+  * USB: new id for ti_usb_3410_5052 driver
+  * USB: two more usb ids for ti_usb_3410_5052
+  * USB: usb-storage: add Pentax to the bad-vendor list
+  * sata_via: Add VT8261 support
+  * nbd: do not allow two clients at the same time
+  * sctp: Fix another socket race during accept/peeloff
+  * Linux 2.6.28.5
+
+ --  Tim Gardner <tim.gardner@canonical.com>  Mon, 09 Feb 2009 16:11:28 -0700
+
+linux (2.6.28-7.20) jaunty; urgency=low
+
+  [ Tim Gardner ]
+
+  * SAUCE: Input: atkbd - Samsung NC10 key repeat fix
+
+  [ Upstream Kernel Changes ]
+
+  * Manually revert "mlock: downgrade mmap sem while populating mlocked
+    regions"
+  * xen: make sysfs files behave as their names suggest
+  * sata_mv: fix 8-port timeouts on 508x/6081 chips
+  * m68knommu: set NO_DMA
+  * PCI/MSI: bugfix/utilize for msi_capability_init()
+  * x86: use early clobbers in usercopy*.c
+  * netfilter: ctnetlink: fix scheduling while atomic
+  * orinoco: move kmalloc(..., GFP_KERNEL) outside spinlock in
+    orinoco_ioctl_set_genie
+  * fbdev/atyfb: Fix DSP config on some PowerMacs & PowerBooks
+  * kmalloc: return NULL instead of link failure
+  * sata_nv: rename nv_nf2_hardreset()
+  * sata_nv: fix MCP5x reset
+  * sata_nv: ck804 has borked hardreset too
+  * Fix memory corruption in console selection
+  * Add enable_ms to jsm driver
+  * nfsd: only set file_lock.fl_lmops in nfsd4_lockt if a stateowner is
+    found
+  * nfsd: Ensure nfsv4 calls the underlying filesystem on LOCKT
+  * iwlwifi: fix rs_get_rate WARN_ON()
+  * p54: fix lm87 checksum endianness
+  * p54: fix p54_read_eeprom to cope with tx_hdr_len
+  * p54usb: rewriting rx/tx routines to make use of usb_anchor's facilities
+  * minstrel: fix warning if lowest supported rate index is not 0
+  * PCI: irq and pci_ids patch for Intel Tigerpoint DeviceIDs
+  * cpuidle: Add decaying history logic to menu idle predictor
+  * ACPI: Avoid array address overflow when _CST MWAIT hint bits are set
+  * video: always update the brightness when poking "brightness"
+  * Newly inserted battery might differ from one just removed, so update of
+    battery info fields is required.
+  * ACPI: Do not modify SCI_EN directly
+  * dlm: initialize file_lock struct in GETLK before copying conflicting
+    lock
+  * sata_mv: Fix chip type for Hightpoint RocketRaid 1740/1742
+  * ACPICA: Allow multiple backslash prefix in namepaths
+  * Linux 2.6.28.4
+
+ --  Tim Gardner <tim.gardner@canonical.com>  Sat, 07 Feb 2009 18:53:42 -0700
+
+linux (2.6.28-7.19) jaunty; urgency=low
+
+  * Fix missing modules FTBS
+
+ --  Tim Gardner <tim.gardner@canonical.com>  Thu, 05 Feb 2009 15:28:15 -0700
+
+linux (2.6.28-7.18) jaunty; urgency=low
+
+  [ Alok Kataria ]
+
+  * SAUCE: (drop after 2.6.29) x86: add a synthetic TSC_RELIABLE feature
+    bit
+    - LP: #319945
+  * SAUCE: (drop after 2.6.29) x86: add X86_FEATURE_HYPERVISOR feature bit
+    - LP: #319945
+  * SAUCE: (drop after 2.6.29) x86: Hypervisor detection and get tsc_freq
+    from hypervisor
+    - LP: #319945
+  * SAUCE: (drop after 2.6.29) x86: Add a synthetic TSC_RELIABLE feature
+    bit.
+    - LP: #319945
+  * SAUCE: (drop after 2.6.29) x86: Skip verification by the watchdog for
+    TSC clocksource.
+    - LP: #319945
+  * SAUCE: (drop after 2.6.29) x86: VMware: Fix vmware_get_tsc code
+    - LP: #319945
+  * SAUCE: (drop after 2.6.29) x86: vmware: look for DMI string in the
+    product serial key
+    - LP: #319945
+
+  [ Andy Whitcroft ]
+
+  * SAUCE: toshiba_acpi -- pull in current -dev version of driver
+    - LP: #269831
+  * SAUCE: toshiba_acpi -- add acpi hotkey kernel thread
+    - LP: #269831
+  * move toshiba laptops back from tlsup to toshiba_acpi
+    - LP: #269831
+
+  [ Aneesh Kumar K.V ]
+
+  * SAUCE: (revert before 2.6.28.y update) ext4: Fix the delalloc
+    writepages to allocate blocks at the right offset.
+  * SAUCE: (revert before 2.6.28.y update) ext4: avoid ext4_error when
+    mounting a fs with a single bg
+  * SAUCE: (revert before 2.6.28.y update) ext4: Don't overwrite
+    allocation_context ac_status
+  * SAUCE: (revert before 2.6.28.y update) ext4: Add blocks added during
+    resize to bitmap
+  * SAUCE: (revert before 2.6.28.y update) ext4: Use
+    EXT4_GROUP_INFO_NEED_INIT_BIT during resize
+  * SAUCE: (revert before 2.6.28.y update) ext4: cleanup mballoc header
+    files
+  * SAUCE: (revert before 2.6.28.y update) ext4: don't use blocks freed but
+    not yet committed in buddy cache init
+  * SAUCE: (revert before 2.6.28.y update) ext4: Fix race between
+    read_block_bitmap() and mark_diskspace_used()
+  * SAUCE: (revert before 2.6.28.y update) ext4: Fix the race between
+    read_inode_bitmap() and ext4_new_inode()
+  * SAUCE: (revert before 2.6.28.y update) ext4: Use new buffer_head flag
+    to check uninit group bitmaps initialization
+  * SAUCE: (revert before 2.6.28.y update) ext4: mark the blocks/inode
+    bitmap beyond end of group as used
+  * SAUCE: (revert before 2.6.28.y update) ext4: Don't allow new groups to
+    be added during block allocation
+  * SAUCE: (revert before 2.6.28.y update) ext4: Init the complete page
+    while building buddy cache
+  * SAUCE: (revert before 2.6.28.y update) ext4: Fix s_dirty_blocks_counter
+    if block allocation failed with nodelalloc
+
+  [ Hannes Eder ]
+
+  * SAUCE: (drop after 2.6.29) x86: vmware - fix sparse warnings
+    - LP: #319945
+
+  [ Luke Yelavich ]
+
+  * hid modules have hyphens instead of underscores in their names
+
+  [ Mark Fasheh ]
+
+  * SAUCE: (revert before 2.6.28.y update) jbd2: Add BH_JBDPrivateStart
+
+  [ Theodore Ts'o ]
+
+  * SAUCE: (revert before 2.6.28.y update) ext4: Add support for non-native
+    signed/unsigned htree hash algorithms
+  * SAUCE: (revert before 2.6.28.y update) ext4: tone down
+    ext4_da_writepages warnings
+  * SAUCE: (revert before 2.6.28.y update) jbd2: Add barrier not supported
+    test to journal_wait_on_commit_record
+  * SAUCE: (revert before 2.6.28.y update) ext4: Add sanity checks for the
+    superblock before mounting the filesystem
+  * SAUCE: (revert before 2.6.28.y update) ext4: only use i_size_high for
+    regular files
+  * SAUCE: (revert before 2.6.28.y update) ext4: Add sanity check to
+    make_indexed_dir
+  * SAUCE: (revert before 2.6.28.y update) jbd2: On a __journal_expect()
+    assertion failure printk "JBD2", not "EXT3-fs"
+  * SAUCE: (revert before 2.6.28.y update) ext4: Initialize the new group
+    descriptor when resizing the filesystem
+
+  [ Tyler Hicks ]
+
+  * SAUCE: (drop after 2.6.28) [eCryptfs] Regression in unencrypted
+    filename symlinks
+    - LP: #322532
+
+  [ Upstream Kernel Changes ]
+
+  * Input: atkbd - broaden the Dell DMI signatures
+    - LP: #261721
+  * ti_usb_3410_5052: support alternate firmware
+  * ath5k: fix mesh point operation
+  * mac80211: decrement ref count to netdev after launching mesh discovery
+  * inotify: clean up inotify_read and fix locking problems
+  * fuse: destroy bdi on umount
+  * fuse: fix missing fput on error
+  * fuse: fix NULL deref in fuse_file_alloc()
+  * x86, mm: fix pte_free()
+  * klist.c: bit 0 in pointer can't be used as flag
+  * sysfs: fix problems with binary files
+  * x86: fix page attribute corruption with cpa()
+  * USB: fix toggle mismatch in disable_endpoint paths
+  * sound: virtuoso: enable UART on Xonar HDAV1.3
+  * USB: usbmon: Implement compat_ioctl
+  * USB: fix char-device disconnect handling
+  * USB: storage: add unusual devs entry
+  * alpha: nautilus - fix compile failure with gcc-4.3
+  * alpha: fix vmalloc breakage
+  * resources: skip sanity check of busy resources
+  * rtl8187: Add termination packet to prevent stall
+  * it821x: Add ultra_mask quirk for Vortex86SX
+  * libata: pata_via: support VX855, future chips whose IDE controller use
+    0x0571
+  * serial_8250: support for Sealevel Systems Model 7803 COMM+8
+  * drm: stash AGP include under the do-we-have-AGP ifdef
+  * Fix OOPS in mmap_region() when merging adjacent VM_LOCKED file segments
+  * bnx2x: Block nvram access when the device is inactive
+  * ext3: Add sanity check to make_indexed_dir
+  * rtl8187: Fix error in setting OFDM power settings for RTL8187L
+  * epoll: drop max_user_instances and rely only on max_user_watches
+  * gpiolib: fix request related issue
+  * sgi-xpc: Remove NULL pointer dereference.
+  * sgi-xpc: ensure flags are updated before bte_copy
+  * include/linux: Add bsg.h to the Kernel exported headers
+  * ALSA: hda - Fix PCM reference NID for STAC/IDT analog outputs
+  * ALSA: hda - add another MacBook Pro 4, 1 subsystem ID
+  * ALSA: hda - Add quirk for HP DV6700 laptop
+  * crypto: authenc - Fix zero-length IV crash
+  * crypto: ccm - Fix handling of null assoc data
+  * x86, pat: fix reserve_memtype() for legacy 1MB range
+  * x86, pat: fix PTE corruption issue while mapping RAM using /dev/mem
+  * PCI hotplug: fix lock imbalance in pciehp
+  * dmaengine: fix dependency chaining
+  * NET: net_namespace, fix lock imbalance
+  * relay: fix lock imbalance in relay_late_setup_files
+  * Linux 2.6.28.3
+  * ALSA: Enable SPDIF output on ALC655
+  * ALSA: hda - Add ASUS V1Sn support
+  * ALSA: hda - support detecting HD Audio devices with PCI class code
+  * ALSA: hda: alc883 model for ASUS P5Q-EM boards
+  * ALSA: hda - Add quirk for MSI 7260 mobo
+  * ALSA: hda - Add quirk for Sony VAIO VGN-SR19XN
+  * ALSA: oxygen: add Claro halo support
+  * ALSA: hda - Add a new function to seek for a codec ID
+  * ALSA: patch_sigmatel: Add missing Gateway entries and autodetection
+  * ALSA: hda - More fixes on Gateway entries
+  * ALSA: hda - Add MCP67 HDMI support
+  * ALSA: hda - fix name for ALC1200
+  * LSA: hda - Add HP Acacia detection
+  * ALSA: hda - Add quirk for HP 2230s
+  * ALSA: hda - Add quirk for Dell Inspiron Mini9
+  * ALSA: hda - add support for Intel DX58SO board
+  * ALSA: hda - Fix silent headphone output on Panasonic CF-74
+  * ALSA: USB quirk for Logitech Quickcam Pro 9000 name
+  * ALSA: hda - add quirks for some 82801H variants to use ALC883_MITAC
+
+  [ Yasunori Goto ]
+
+  * SAUCE: (revert before 2.6.28.y update) ext4: Widen type of
+    ext4_sb_info.s_mb_maxs[]
+
+ --  Tim Gardner <tim.gardner@canonical.com>  Mon, 02 Feb 2009 23:07:13 -0700
+
+linux (2.6.28-6.17) jaunty; urgency=low
+
+  [ Amit Kucheria ]
+
+  * Updating configs: ARMEL/versatile
+
+ -- Amit Kucheria <amit.kucheria@ubuntu.com>  Fri, 30 Jan 2009 13:36:59 +0200
+
+linux (2.6.28-6.16) jaunty; urgency=low
+
+  [ Luke Yelavich ]
+
+  * Add hid quirks to input-modules udeb
+
+  [ Tim Gardner ]
+
+  * Revert "[arm] Fix kexec on ARM by properly calling the relocation
+    function". This patch was deemed 'bogus' by Russell King on the
+    ARM mailing list.
+
+  [ Upstream Kernel Changes ]
+
+  * PCI: keep ASPM link state consistent throughout PCIe hierarchy
+  * security: introduce missing kfree
+  * rt2x00: add USB ID for the Linksys WUSB200.
+  * p54usb: Add USB ID for Thomson Speedtouch 121g
+  * lib/idr.c: use kmem_cache_zalloc() for the idr_layer cache
+  * sgi-xp: eliminate false detection of no heartbeat
+  * sched: fix update_min_vruntime
+  * IA64: Turn on CONFIG_HAVE_UNSTABLE_CLOCK
+  * sound: virtuoso: do not overwrite EEPROM on Xonar D2/D2X
+  * ALSA: hda - Add quirk for another HP dv5
+  * ALSA: hda - Fix HP dv5 mic input
+  * ALSA: hda - Don't reset HP pinctl in patch_sigmatel.c
+  * ALSA: hda - make laptop-eapd model back for AD1986A
+  * drivers/net/irda/irda-usb.c: fix buffer overflow
+  * usb-storage: add last-sector hacks
+  * usb-storage: set CAPACITY_HEURISTICS flag for bad vendors
+  * pkt_sched: sch_htb: Fix deadlock in hrtimers triggered by HTB
+  * ipv6: Fix fib6_dump_table walker leak
+  * sctp: Avoid memory overflow while FWD-TSN chunk is received with bad
+    stream ID
+  * pkt_sched: cls_u32: Fix locking in u32_change()
+  * r6040: fix wrong logic in mdio code
+  * r6040: save and restore MIER correctly in the interrupt routine
+  * r6040: bump release number to 0.19
+  * tcp: don't mask EOF and socket errors on nonblocking splice receive
+  * p54usb: fix traffic stalls / packet drop
+  * netfilter: x_tables: fix match/target revision lookup
+  * netfilter: ebtables: fix inversion in match code
+  * netfilter: nf_conntrack: fix ICMP/ICMPv6 timeout sysctls on big-endian
+  * dell_rbu: use scnprintf() instead of less secure sprintf()
+  * powerpc: is_hugepage_only_range() must account for both 4kB and 64kB
+    slices
+  * hwmon: (abituguru3) Fix CONFIG_DMI=n fallback to probe
+  * mm: write_cache_pages cyclic fix
+  * mm: write_cache_pages early loop termination
+  * mm: write_cache_pages writepage error fix
+  * mm: write_cache_pages integrity fix
+  * mm: write_cache_pages cleanups
+  * mm: write_cache_pages optimise page cleaning
+  * mm: write_cache_pages terminate quickly
+  * mm: write_cache_pages more terminate quickly
+  * mm: do_sync_mapping_range integrity fix
+  * mm: direct IO starvation improvement
+  * fs: remove WB_SYNC_HOLD
+  * fs: sync_sb_inodes fix
+  * fs: sys_sync fix
+  * Linux 2.6.28.2
+
+ --  Tim Gardner <tim.gardner@canonical.com>  Sun, 25 Jan 2009 13:36:16 -0700
+
+linux (2.6.28-5.15) jaunty; urgency=low
+
+  [ Tim Gardner ]
+
+  * Revert "Enabled CONFIG_PID_NS=y for i386/amd64"
+    Somehow this commit also reverted the 7 prior commits (which is bad).
+  * Enabled CONFIG_PID_NS=y for i386/amd64 (version 2)
+
+ --  Tim Gardner <tim.gardner@canonical.com>  Thu, 22 Jan 2009 13:48:34 -0700
+
+linux (2.6.28-5.14) jaunty; urgency=low
+
+  [ Ben Collins ]
+
+  * lirc_gpio: Forward ported to current kernel (jaunty)
+  * configs: Enable LIRC_GPIO on 64-bit/32-bit x86
+    - LP: #298791
+
+  [ Jeff Layton ]
+
+  * SAUCE: cifs: make sure we allocate enough storage for socket address
+    - LP: #318565
+
+  [ Tim Gardner ]
+
+  * check-abi: Return success when ABI skip is requested and no ABI files exist.
+    This ought to fix the armel FTBS.
+
+ --  Tim Gardner <tim.gardner@canonical.com>  Thu, 22 Jan 2009 06:42:49 -0700
+
+linux (2.6.28-5.13) jaunty; urgency=low
+
+  [ Andy Whitcroft ]
+
+  * Revert "SAUCE: don't use buggy _BCL/_BCM/_BQC for backlight control"
+
+  [ Tim Gardner ]
+
+  * Fix udeb generation breakage caused by the previous armel versatile
+    flavour config update.
+
+ --  Tim Gardner <tim.gardner@canonical.com>  Wed, 21 Jan 2009 12:38:35 -0700
+
+linux (2.6.28-5.12) jaunty; urgency=low
+
+  [ Ante ]
+
+  * Update drbd to 8.3.0
+
+  [ Dave Airlie ]
+
+  * i915/drm: provide compat defines for userspace for certain struct
+
+  [ Eric Anholt ]
+
+  * drm/i915: Don't double-unpin buffers if we take a signal in
+  * drm/i915: Don't complain when interrupted while pinning in execbuffers.
+  * drm/i915: Don't allow objects to get bound while VT switched.
+
+  [ Jani Monoses ]
+
+  * Fix webcam having USB ID 0ac8:303b
+    - LP: #292086
+
+  [ Jesse Barnes ]
+
+  * drm/i915: set vblank enabled flag correctly across IRQ
+  * drm/i915: don't enable vblanks on disabled pipes
+
+  [ Michael Casadevall ]
+
+  * [arm] Fix kexec on ARM by properly calling the relocation function
+
+  [ Tim Gardner ]
+
+  * Enabled CONFIG_PID_NS=y for i386/amd64
+  * SAUCE: Increase ATA_TMOUT_PMP_SRST_WAIT to 5 seconds.
+    - LP: #318978
+  * Update armel versatile config
+    - LP: #314789
+  * Enabled CONFIG_RT2860=m for i386/amd64
+  * Enabled CONFIG_RT2870=m for i386/amd64
+
+  [ Upstream Kernel Changes ]
+
+  * Input: atkbd - add keyboard quirk for HP Pavilion ZV6100 laptop
+    - LP: #291878
+  * ALSA: hda - Add quirk for another HP dv7
+  * ALSA: hda - Add quirk for HP6730B laptop
+  * ALSA: caiaq - Fix Oops with MIDI
+  * ALSA: hda - Fix typos for AD1882 codecs
+  * x86: fix intel x86_64 llc_shared_map/cpu_llc_id anomolies
+  * x86: default to SWIOTLB=y on x86_64
+  * CIFS: make sure that DFS pathnames are properly formed
+  * ring-buffer: prevent false positive warning
+  * ring-buffer: fix dangling commit race
+  * iwlwifi: use GFP_KERNEL to allocate Rx SKB memory
+  * tx493[89]ide: Fix length for __ide_flush_dcache_range
+  * tx4939ide: Do not use zero count PRD entry
+  * SCSI: eata: fix the data buffer accessors conversion regression
+  * USB: emi26: fix oops on load
+  * x86, UV: remove erroneous BAU initialization
+  * x86: fix incorrect __read_mostly on _boot_cpu_pda
+  * vmalloc.c: fix flushing in vmap_page_range()
+  * fs: symlink write_begin allocation context fix
+  * cgroups: fix a race between cgroup_clone and umount
+  * dm raid1: fix error count
+  * dm log: fix dm_io_client leak on error paths
+  * minix: fix add link's wrong position calculation
+  * md: fix bitmap-on-external-file bug.
+  * sched_clock: prevent scd->clock from moving backwards, take #2
+  * devices cgroup: allow mkfifo
+  * SCSI: aha152x_cs: Fix regression that keeps driver from using shared
+    interrupts
+  * ioat: fix self test for multi-channel case
+  * USB: isp1760: use a specific PLX bridge instead of any bdridge
+  * USB: isp1760: Fix probe in PCI glue code
+  * USB: unusual_devs.h additions for Pentax K10D
+  * inotify: fix type errors in interfaces
+  * Move compat system call declarations to compat header file
+  * Convert all system calls to return a long
+  * Rename old_readdir to sys_old_readdir
+  * Remove __attribute__((weak)) from sys_pipe/sys_pipe2
+  * Make sys_pselect7 static
+  * Make sys_syslog a conditional system call
+  * System call wrapper infrastructure
+  * powerpc: Enable syscall wrappers for 64-bit
+  * s390: enable system call wrappers
+  * System call wrapper special cases
+  * System call wrappers part 01
+  * System call wrappers part 02
+  * System call wrappers part 03
+  * System call wrappers part 04
+  * System call wrappers part 05
+  * System call wrappers part 06
+  * System call wrappers part 07
+  * System call wrappers part 08
+  * System call wrappers part 09
+  * System call wrappers part 10
+  * System call wrappers part 11
+  * System call wrappers part 12
+  * System call wrappers part 13
+  * System call wrappers part 14
+  * System call wrappers part 15
+  * System call wrappers part 16
+  * System call wrappers part 17
+  * System call wrappers part 18
+  * System call wrappers part 19
+  * System call wrappers part 20
+  * System call wrappers part 21
+  * System call wrappers part 22
+  * System call wrappers part 23
+  * System call wrappers part 24
+  * System call wrappers part 25
+  * System call wrappers part 26
+  * System call wrappers part 27
+  * System call wrappers part 28
+  * System call wrappers part 29
+  * System call wrappers part 30
+  * System call wrappers part 31
+  * System call wrappers part 32
+  * System call wrappers part 33
+  * s390 specific system call wrappers
+  * x86: fix RIP printout in early_idt_handler
+  * Fix timeouts in sys_pselect7
+  * USB: another unusual_devs entry for another bad Argosy storage device
+  * USB: storage: extend unusual range for 067b:3507
+  * USB: storage: recognizing and enabling Nokia 5200 cell phoes
+  * HID: fix error condition propagation in hid-sony driver
+  * fix switch_names() breakage in short-to-short case
+  * nfs: remove redundant tests on reading new pages
+  * eCryptfs: check readlink result was not an error before using it
+  * mvsas: increase port type detection delay to suit Seagate's 10k6 drive ST3450856SS 0003
+  * x86: avoid theoretical vmalloc fault loop
+  * ath9k: enable RXing of beacons on STA/IBSS
+  * mm lockless pagecache barrier fix
+  * powerpc: Disable Collaborative Memory Manager for kdump
+  * ibmvfc: Delay NPIV login retry and add retries
+  * ibmvfc: Improve async event handling
+  * getrusage: RUSAGE_THREAD should return ru_utime and ru_stime
+  * ath5k: ignore the return value of ath5k_hw_noise_floor_calibration
+  * mm: fix assertion
+  * XFS: truncate readdir offsets to signed 32 bit values
+  * Linux 2.6.28.1
+  * eCryptfs: Filename Encryption: Tag 70 packets
+  * eCryptfs: Filename Encryption: Header updates
+  * eCryptfs: Filename Encryption: Encoding and encryption functions
+  * eCryptfs: Filename Encryption: filldir, lookup, and readlink
+  * eCryptfs: Filename Encryption: mount option
+  * eCryptfs: Replace %Z with %z
+  * eCryptfs: Fix data types (int/size_t)
+  * eCryptfs: kerneldoc for ecryptfs_parse_tag_70_packet()
+  * eCryptfs: Clean up ecryptfs_decode_from_filename()
+  * fs/ecryptfs/inode.c: cleanup kerneldoc
+  * staging-p80211: Kill directly reference of netdev->priv
+  * staging-slicoss: Kill directly reference of netdev->priv
+  * staging-winbond: Kill directly reference of netdev->priv
+  * Staging: go7007: fixes due to video_usercopy api change
+  * Staging: go7007: fixes due v4l2_file_operations api change
+  * staging: correct dubious use of !x & y
+  * Staging: w35und: make wb35_probe() and wb35_disconnect() funtions static
+  * Staging: w35und: remove unused wb35_open() and wb35_close() functions
+  * Staging: w35und: use msleep() and udelay()
+  * Staging: w35und: remove the no-op pa_stall_execution macro
+  * Staging: w35und: purb typedef removal
+  * Staging: w35und: reg queue struct typedef removal
+  * Staging: w35und: wb35reg struct typedef removal
+  * Staging: w35und: padapter struct typedef removal
+  * Staging: w35und: merge wblinux struct to adapter
+  * Staging: w35und: wb35_probe() cleanup
+  * Staging: w35und: remove usb_submit_urb wrapper function
+  * Staging: w35und: remove usb_alloc_urb wrapper function
+  * w35und: remove dead code from wbusb_f.h
+  * Staging: w35und: remove true/false boolean macros
+  * Staging: w35und: OS_MEMORY_ALLOC wrapper removal
+  * Staging: w35und: usb_put_dev() is missing from wb35_disconnect()
+  * Staging: w35und: remove macro magic from MLME_GetNextPacket()
+  * Staging: w35und: plug memory leak in wbsoft_tx()
+  * Staging: w35und: move supported band initialization out of wb35_probe()
+  * Staging: w35und: remove timer wrappers
+  * Staging: w35und: remove atomic op wrappers
+  * Staging: w35und: remove memcpy/memcmp wrappers
+  * Staging: w35und: remove abs() and BIT() macros
+  * Staging: w35und: remove unused macros from common.h
+  * Staging: w35und: remove unused link status code
+  * Staging: w35und: #include cleanup
+  * Staging: w35und: remove some dead code
+  * Staging: w35und: move source files to one directory
+  * Staging: w35und: move struct wbsoft_priv to core.h and use it
+  * Staging: w35und: remove ->adapter from struct _HW_DATA_T
+  * Staging: w35und: clean up adapter.h a bit
+  * Staging: w35und: merge struct wb35_adapter to struct wbsoft_priv
+  * Staging: w35und: remove global struct ieee80211_hw
+  * Staging: w35und: inline DRIVER_AUTHOR and DRIVER_DESC macros
+  * Staging: w35und: clean up wblinux.c a bit
+  * Staging: w35und: remove unused ->ShutDowned member from struct
+    LOCAL_PARA
+  * Staging: w35und: move global wbsoft_enabled to struct wbsoft_priv
+  * Staging: w35und: move packet_came() to wb35rx.c
+  * Staging: w35und: remove ->skb_array from struct wbsoft_priv
+  * Staging: w35und: remove ->shutdown from struct wbsoft_priv
+  * Staging: w35und: make functions local to mds.c static
+  * Staging: w35und: make functions local to mlmetxrx.c static
+  * Staging: w35und: remove dead code from mto.c
+  * Staging: w35und: make functions local to wb35rx.c static
+  * Staging: w35und: make functions local to wb35tx.c static
+  * Staging: w35und: remove dead code from wbhal.c
+  * Staging: w35und: remove rxisr.c as dead code
+  * Staging: w35und: fix Kconfig
+  * Staging: w35und: fix config build warnings
+  * Staging: wlan-ng: Remove PCI/PLX/PCMCIA files.
+  * Staging: wlan-ng: Update Help text to mention prism3 devices.
+  * Staging: wlan-ng: Delete PCI/PLX/PCMCIA-specific code.
+  * Staging: wlan-ng: Make wlan-ng use WEXT mode by default.
+  * Staging: wlan-ng: Eliminate more <2.6 kernel support.
+  * Staging: wlan-ng: Eliminate all backwards-compatibility for <2.6.13 kernels.
+  * Staging: wlan-ng: Eliminate a boatload of tertiaryAP-only code.
+  * Staging: wlan-ng: Remove AP-only code from MLME functions.
+  * Staging: wlan-ng: Get rid of the MTU tests in the rx conversion path.
+  * Staging: wlan-ng: Eliminate one more rx mtu test.
+  * Staging: wlan-ng: Eliminate local 'version.h'
+  * Staging: wlan-ng: Eliminate usage of procfs.
+  * Staging: wlan-ng: Use standard kernel integer (u32/s32/etc) types.
+  * Staging: wlan-ng: Eliminate all backwards-compatible kernel code.
+  * Staging: wlan-ng: Wireless Extension support is mandatory.
+  * Staging: wlan-ng: use WIRELESS_EXT, not CONFIG_WIRELESS_EXT
+  * Staging: wlan-ng: Delete a large pile of now-unused code.
+  * Staging: wlan-ng: Delete a pile of unused mibs. And fix WEXT SET_TXPOWER.
+  * Staging: wlan-ng: Consolidate wlan-ng into a single module.
+  * Staging: wlan-ng: Purge all MIBs not used internally.
+  * Staging: wlan-ng: p80211netdev.c fix netdev alloc to prevent oops on device start
+  * Staging: wlan-ng: prism2_usb.c always enable the card in probe_usb
+  * Staging: wlan-ng: hfa384x_usb.c use newest version of 384x_drvr_start
+  * Staging: wlan-ng: p80211wext.c add latest changes & remove extra nulls from wext_handlers
+  * Staging: wlan-ng: p80211wext don't set default key id twice
+  * Staging: wlan-ng: hfa384x_usbin_callback: check for hardware removed
+  * Staging: wlan-ng: p80211conv.c copy code from wlan-ng-devel branch to not drop packets
+  * Staging: wlan-ng: remove unused #include <version.h>
+  * Staging: wlan-ng: p80211wext.c: use ARRAY_SIZE
+  * Staging: wlan-ng: fix compiler warnings
+  * Staging: wlan-ng: skb_p80211_to_ether() - payload_length is unsigned, check before subtraction
+  * Staging: at76_usb: update drivers/staging/at76_usb w/ mac80211 port
+  * Staging: at76_usb: fix build breakage
+  * Staging: at76_usb: remove compiler warnings
+  * Staging: at76_usb: fix up all remaining checkpatch.pl warnings
+  * Staging: at76_usb: cleanup dma on stack issues
+  * Staging: poch: Block size bug fix
+  * Staging: poch: Update TODO list
+  * Staging: poch: Correct pages from bytes.
+  * Staging: poch: minor fixes
+  * Staging: poch: Fix build warnings
+  * Staging: poch: Rx control register init
+  * Staging: poch: Fix user space protocol syncing
+  * Staging: poch: Fine grained locking
+  * Staging: sxg: remove typedefs
+  * Staging: sxg: break the build in a cleaner way when !x86
+  * Staging: sxg: update README
+  * staging: struct device - replace bus_id with dev_name(), dev_set_name()
+  * Staging: echo: remove typedefs
+  * Staging: echo: Lindent drivers/staging/echo
+  * Staging: go7007: saa7134 updates
+  * Staging: go7007: add sensoray 2250/2251 support
+  * Staging: go7007: Convert driver to use video_ioctl2
+  * Staging: go7007: annotate code pointers
+  * Staging: go7007: fix minor build warnings
+  * Staging: go7007: small cleanup
+  * Staging: go7007: add some more v4l2 ioctls
+  * Staging: et131x: Cleanup et131x_debug.h defines
+  * Staging: et131x: fix build failure
+  * Staging: et131x: remove unused variable in et1310_tx.c
+  * Staging: usbip: cleanup kerneldoc
+  * Staging: slicoss: use kzalloc
+  * Staging: slicoss: use correct type for memory allcations
+  * Staging: slicoss: use request_firmware
+  * Staging: add agnx wireless driver
+  * Staging: agnx: fix build errors due to ssid removal
+  * Staging: agnx: fix build errors due to rate control API changes
+  * Staging: agnx: fix build warnings
+  * Staging: add otus Atheros wireless network driver
+  * Staging: otus: fix netdev->priv usage
+  * Staging: otus: fix name clash
+  * Staging: otus: fix urb callback function type
+  * Staging: otus: remove dependence on kernel version
+  * Staging: add rt2860 wireless driver
+  * Staging: rt2860: disable root hack for reading files
+  * Staging: rt2860: fix up netdev->priv usage
+  * Staging: rt2860: use standard bit-reverse function
+  * Staging: rt2860: Fix minor compiler warnings
+  * Staging: rt2860: enable WPA_SUPPLICANT support
+  * Staging: Add ServerEngines benet 10Gb ethernet driver
+  * Staging: benet: fix netif api breakage
+  * Staging: benet: fix up netdev->priv change
+  * Staging: benet: build is broken unless CONFIG_NETPOLL is enabled
+  * Staging: benet: patch to remove subdirectories
+  * Staging: benet: fix build errors when CONFIG_NETPOLL is off
+  * Staging: benet: fix build error.
+  * Staging: benet: patch to use offsetof() instead of AMAP_BYTE_OFFSET()
+  * Staging: benet: fix problems reported by checkpatch
+  * Staging: benet: cleanup a check while posting rx buffers
+  * Staging: add comedi core
+  * Staging: comedi: fix up a lot of checkpatch.pl warnings
+  * Staging: comedi: fix checkpatch.pl errors in comedi_fops.c
+  * Staging: comedi: fix build error in comedilib.h
+  * Staging: comedi: add kcomedilib to the tree
+  * Staging: comedi: set up infrastructure for individual drivers
+  * Staging: comedi: add local copy of interrupt.h
+  * Staging: comedi: add pci and usb wrapper header files
+  * Staging: comedi: comedi driver common function module
+  * Staging: comedi: add mite comedi pci driver
+  * Staging: comedi: add usb usbdux driver
+  * Staging: comedi: add usb usbduxfast driver
+  * Staging: comedi: add usb dt9812 driver
+  * Staging: comedi: add comedi_bond driver
+  * Staging: comedi: add comedi_test driver
+  * Staging: comedi: add comedi_parport driver
+  * Staging: comedi: dt9812: fix up a lot of coding style issues
+  * Staging: comedi: dt9812: remove dt9812.h
+  * Staging: comedi: dt9812: remove typedefs
+  * Staging: comedi: dt9812: fix sparse warnings
+  * Staging: comedi: usbdux: remove kernel version checks
+  * Staging: comedi: usbdux: code style cleanups
+  * Staging: comedi: usbdux: remove // comments
+  * Staging: comedi: usbdux: fix up printk calls
+  * Staging: comedi: usbdux: remove checkpatch.pl warnings
+  * Staging: comedi: usbdux: remove typedef
+  * Staging: comedi: usbdux: remove comedi usb wrappers
+  * Staging: comedi: usbduxfast: remove comedi usb wrappers
+  * Staging: comedi: dt9812: remove #ifdef that is not needed
+  * Staging: comedi: remove usb wrappers
+  * Staging: comedi: remove PCI wrappers
+  * Staging: comedi: add icp_multi driver
+  * Staging: comedi: add me4000 driver
+  * Staging: comedi: fix checkpatch.pl issues in comedi_bond.c
+  * Staging: comedi: fix checkpatch.pl issues in comedi_fc.c
+  * Staging: comedi: remove typedefs from comedi_bond.c
+  * Staging: comedi: fix sparse issues in comedi_bond.c
+  * Staging: comedi: fix checkpatch.pl issues in comedi_test.c
+  * Staging: comedi: fix sparse issues in comedi_test.c
+  * Staging: comedi: remove typedefs from comedi_test.c
+  * Staging: comedi: fix comedi_parport.c checkpatch.pl issues.
+  * Staging: comedi: fix comedi_fc.h checkpatch.pl issues.
+  * Staging: comedi: fix comedi_pci.h checkpatch.pl issues.
+  * Staging: comedi: comedi_pci.h: remove unneeded wrapper
+  * Staging: comedi: comedi_pci.h: remove comedi_pci_enable_no_regions
+  * Staging: comedi: comedi_pci.h: remove comedi_pci_disable_no_regions
+  * Staging: comedi: add s626 driver
+  * Staging: comedi: add rtd520 driver
+  * Staging: comedi: add me_daq driver
+  * Staging: comedi: me_daq: fix checkpatch.pl issues
+  * Staging: comedi: me_daq: remove typedefs
+  * Staging: comedi: me_daq: fix sparse issues
+  * Staging: comedi: fix checkpatch.pl warning in interrupt.h
+  * Staging: comedi: fix build if CONFIG_PROC_FS is not set
+  * Staging: add asus_oled driver
+  * Staging: asus_oled: fix build dependancy
+  * Staging: Add the Meilhaus ME-IDS driver package
+  * Staging: meilhaus: fix __symbol_get problems
+  * Staging: add lcd-panel driver
+  * Staging: panel: major checkpatch cleanup
+  * Staging: panel: remove ifdefs and code for pre-2.6 kernels
+  * Staging: panel: remove support for smartcards
+  * Staging: add Driver for Altera PCI Express Chaining DMA reference design
+  * Staging: add rtl8187se driver
+  * Staging: rtl8187se: remove unneeded files
+  * Staging: rtl8187se: make the built module be the proper name
+  * Staging: rtl8187se: remove duplicate pci ids
+  * Staging: me4000: switch to list_for_each*()
+  * Staging: usbip: switch to list_for_each_entry()
+  * Staging: add princeton instruments usb camera driver
+  * Staging: add mimio xi driver
+  * Staging: add rt2870 wireless driver
+  * Staging: rt2870: disable root hack for reading files
+  * Staging: rt2870: fix up netdev->priv usage
+  * Staging: add frontier tranzport and alphatrack drivers
+  * Staging: frontier: remove unused alphatrack_sysfs.c file
+  * Staging: frontier: fix compiler warnings
+  * Staging: add epl stack
+  * Staging: epl: run Lindent on all kernel/*.h files
+  * Staging: epl: run Lindent on all user/*.h files
+  * Staging: epl: run Lindent on *.h files
+  * Staging: epl: run Lindent on *.c files
+  * Staging: epl: hr timers all run in hard irq context now
+  * Staging: epl: fix netdev->priv b0rkage
+  * Staging: add android framework
+  * Staging: android: add binder driver
+  * Staging: android: binder: Fix gcc warnings about improper format specifiers for size_t in printk
+  * staging: android: binder: Fix use of euid
+  * Staging: android: add logging driver
+  * Staging: android: add ram_console driver
+  * Staging: android: add timed_gpio driver
+  * Staging: android: timed_gpio: Rename android_timed_gpio to timed_gpio
+  * Staging: android: remove dummy android.c driver
+  * Staging: android: add lowmemorykiller driver
+  * Staging: android: binder: fix build errors
+  * staging: __FUNCTION__ is gcc-specific, use __func__
+  * V4L/DVB (10176a): Switch remaining clear_user_page users over to
+    clear_user_highpage
+
+  [ Zhenyu Wang ]
+
+  * agp/intel: add support for G41 chipset
+
+ --  Tim Gardner <tim.gardner@canonical.com>  Sun, 18 Jan 2009 20:22:54 -0700
+
+linux (2.6.28-4.11) jaunty; urgency=low
+
+  [ Mario Limonciello ]
+
+  * SAUCE: Enable HDMI audio codec on Studio XPS 1340
+    - LP: #309508
+
+  [ Tim Gardner ]
+
+  * Fix armel d-i FTBSs
+
+  [ Upstream Kernel Changes ]
+
+  * USB: re-enable interface after driver unbinds
+
+ --  Tim Gardner <tim.gardner@canonical.com>  Tue, 13 Jan 2009 16:33:08 -0700
+
+linux (2.6.28-4.10) jaunty; urgency=low
+
+  [ Andy Whitcroft ]
+
+  * update kernel bootloader recommends: to prefer grub
+    - LP: #314004
+  * SAUCE: don't use buggy _BCL/_BCM/_BQC for backlight control
+    - LP: #311716
+  * SAUCE: test-suspend -- add the suspend test scripts
+    - LP: #316419
+
+  [ Colin Watson ]
+
+  * Enable udebs for armel
+
+  [ Tim Gardner ]
+
+  * SAUCE: Dell laptop digital mic does not work, PCI 1028:0271
+    - LP: #309508
+  * Enable CIFS_XATTR=y and CONFIG_CIFS_POSIX=y
+    - LP: #220658
+
+ --  Tim Gardner <tim.gardner@canonical.com>  Thu, 08 Jan 2009 10:38:22 -0700
+
+linux (2.6.28-4.9) jaunty; urgency=low
+
+  [ Tim Gardner ]
+
+  * Restore DM_CRYPT, AES, ECB, and CBC as modules. This fixes
+    some installer issues with encrypted /home and Private directories.
+  * Take one more stab at building armel without module or ABI errors.
+
+ --  Tim Gardner <tim.gardner@canonical.com>  Tue, 06 Jan 2009 08:38:23 -0700
+
+linux (2.6.28-4.8) jaunty; urgency=low
+
+  * Fix i386/amd64 FTBS by ignoring all module and ABI changes,
+    not something you would normally do, but I'm sure the ABI
+    has not changed. This will probably also allow the ARM builds to complete.
+
+ --  Tim Gardner <tim.gardner@canonical.com>  Mon, 05 Jan 2009 14:42:58 -0700
+
+linux (2.6.28-4.7) jaunty; urgency=low
+
+  [ Tim Gardner ]
+
+  * Enable CONFIG_ATH5K=m for i386/amd64
+    - LP: #306719
+  * Build all i386/amd64 AGP/DRM components as modules.
+    - LP: #312721
+  * git commands are now installed outside the default $PATH
+    Use 'git  CMD' instead of 'git-CMD'.
+  * Build in most PATA/SATA drivers. This should allow most i386/amd64 systems to boot
+    without an initramfs, though some support work is still required in initramfs-tools
+    and grub.
+    - LP: #311730
+
+ --  Tim Gardner <tim.gardner@canonical.com>  Fri, 02 Jan 2009 07:33:09 -0700
+
+linux (2.6.28-4.6) jaunty; urgency=low
+
+  [ Tim Gardner ]
+
+  * Enable CONFIG_X86_E_POWERSAVER=m for i386 generic
+    - LP: #237405
+  * Build i386 AGP drivers as modules
+    - LP: #312721
+  * Build i386 DRM as a module
+    - LP: #312721
+
+  [ Upstream Kernel Changes ]
+
+  * drm/i915: Add missing userland definitions for gem init/execbuffer.
+    - LP: #308387
+
+ --  Tim Gardner <tim.gardner@canonical.com>  Mon, 29 Dec 2008 09:16:47 -0700
+
+linux (2.6.28-4.5) jaunty; urgency=low
+
+  [ Andy Whitcroft ]
+
+  * clean up module dependancy information on package removal/purge
+    - LP: #300773
+
+  [ Tim Gardner ]
+
+  * Update iscsitarget to 0.4.17
+  * Build in ext{234}
+  * Build in Crypto modules AES, CBC, ECB
+  * Build in ACPI AC,BATTERY,BUTTON,FAN,PCI_SLOT,PROCESSOR,SBS,THERMAL,WMI
+  * Build in AGP intel,via,sis,ali,amd,amd64,efficeon,nvidia,sworks
+  * Build in ata,dev_dm,dev_loop,dev_md,dev_sd,dev_sr
+  * Build in BT l2cap,rfcomm,sco
+  * Reduce CONFIG_LEGACY_PTY_COUNT to 0
+  * Build in CDROM_PKTCDVD and CHR_DEV_SG
+  * Build in CPU_FREQ
+    GOV_CONSERVATIVE,GOV_ONDEMAND,GOV_POWERSAVE,GOV_USERSPACE,STAT,TABLE
+  * Build in DM CRYPT,MIRROR,MULTIPATH,SNAPSHOT
+  * Build in DRM
+  * Build in HID
+  * Build in HOTPLUG PCI,PCIE
+  * Build in I2C
+  * Build in IEEE1394 OHCI1394
+  * Build in INPUT EVDEV
+  * Build in IPV6
+  * Build in MMC
+  * Build in PACKET
+  * Enable both IEEE1394 (Firewire) stacks as modules
+    - LP: #276463
+  * Disable SUNRPC_REGISTER_V4
+    - LP: #306016
+  * Enable dm-raid4-5
+    - LP: #309378
+  * Build in PPP
+  * Build in RFKILL
+  * Build in USB SERIAL
+
+  [ Upstream Kernel Changes ]
+
+  * Rebased to v2.6.28
+
+ --  Tim Gardner <tim.gardner@canonical.com>  Thu, 18 Dec 2008 21:18:44 -0700
+
+linux (2.6.28-3.4) jaunty; urgency=low
+
+  [ Tim Gardner ]
+
+  * Build ecryptfs into the kernel
+    - LP: #302870
+  * Deprecated gnbd
+
+  [ Upstream Kernel Changes ]
+
+  * Rebased to v2.6.28-rc8
+
+ --  Tim Gardner <tim.gardner@canonical.com>  Wed, 10 Dec 2008 22:45:13 -0700
+
+linux (2.6.28-2.3) jaunty; urgency=low
+
+  [ Andy Whitcroft ]
+
+  * update the templates so that we have spaces following the title line
+
+  [ Tim Gardner ]
+
+  * Add upload number to kernel version signature. This has the side effect
+    of renaming kernel packages back to the original way, e.g., without '-ub'
+    in the name.
+
+ --  Tim Gardner <tim.gardner@canonical.com>  Thu, 04 Dec 2008 12:18:31 -0700
+
+linux (2.6.28-2.2) jaunty; urgency=low
+
+  [ Andy Whitcroft ]
+
+  * Revert "SAUCE: (no-up) version: Implement version_signature proc file."
+  * SAUCE: (no-up) version: Implement version_signature proc file.
+  * SAUCE: serial: RS485 ioctl structure uses __u32 include linux/types.h
+    - LP: #303711
+
+  [ Tim Gardner ]
+
+  * UBUNTU: Removed CONFIG_DRM_VIA_CHROME9 since it is upstream.
+  * UBUNTU: Removed ubuntu/via_chrome9
+
+  [ Upstream Kernel Changes ]
+
+  * Rebased to v2.6.28-rc7
+
+ --  Tim Gardner <tim.gardner@canonical.com>  Tue, 02 Dec 2008 07:33:32 -0700
+
+linux (2.6.28-1.1) jaunty; urgency=low
+
+  [ Amit Kucheria ]
+
+  * SAUCE: make fc transport removal of target configurable
+  * SAUCE: pm: Config option to disable handling of console during
+    suspend/resume
+  * SAUCE: Adds support for COMPAL JHL90 webcam
+  * Map armel to arm to all editconfigs to work correctly
+  * Add armel to getabis for completeness sake
+  * Add -ub to our versioning to allow kerneloops.org to identify us
+
+  [ Andy Whitcroft ]
+
+  * Fix Vcs-Git path for the kernel repository.
+    - LP: #296915
+
+  [ Ben Collins ]
+
+  * SAUCE: Lower warning level of some PCI messages
+    - LP: #159241
+  * SAUCE: input/mouse/alps: Do not call psmouse_reset() for alps
+  * SAUCE: tulip: Let dmfe handle davicom on non-sparc
+  * SAUCE: tulip: Define ULI PCI ID's
+  * SAUCE: (no-up) version: Implement version_signature proc file.
+  * SAUCE: (no-up) connector.h: Add idx/val for drbd
+  * SAUCE: (no-up) swap: Add notify_swap_entry_free callback for compcache
+  * SAUCE: drivers: Remove some duplicate device entries in various modules
+  * SAUCE: (no-up) [AppArmor] merge with upstream subversion r1291
+  * SAUCE: (no-up) Enable ubuntu extra subdirectory
+  * SAUCE: (no-up) ACPI: initramfs DSDT override support
+  * ubuntu: Add drbd module
+  * ubuntu: Add iscsitarget module
+  * ubuntu: Add BOM for iscsitarget
+  * ubuntu: Add squashfs driver
+  * SAUCE: (no-up) Check for squashfs superblock in initramfs mounting.
+  * ubuntu: Add aufs module
+  * ubuntu: Added atl2 driver
+  * ubuntu: Added et131x driver
+  * ubuntu: Add dm-raid4-5 driver
+  * ubuntu: Add ndiswrapper driver
+  * ubuntu: Added ram backed compressed swap module (compcache)
+  * ubuntu: Add misc drivers from hardy lum
+  * ubuntu: Add heci driver 3.2.0.24
+  * ubuntu: Add ov511 and bt-sco drivers
+  * ubuntu: Add acx, prism2_usb wireless drivers
+  * ubuntu: Add at76 driver to build
+  * ubuntu: Add fsam7400 sw kill switch driver
+  * ubuntu: Added qc-usb driver
+  * ubuntu: e1000e: Upgraded module to 0.4.1.7
+  * ubuntu: Added rfkill drivers
+  * ubuntu: VIA - Add VIA DRM Chrome9 3D engine
+  * ubuntu: unionfs: Added v1.4 module from hardy
+  * ubuntu: Add LIRC driver
+  * ubuntu: Add GFS driver
+  * ubuntu: New tlsup driver for toshiba laptops
+  * SAUCE: (no-up) Export lookup_has for aufs
+  * SAUCE: (no-up) Modularize vesafb
+  * ubuntu: Config files
+  * Disable some modules that need porting to 2.6.28
+  * ubuntu: Fixup headers creation to include arch/*/include
+  * ubuntu/module-check: Ignore comment lines
+
+  [ Chuck Short ]
+
+  * SAUCE: ata: blacklist FUJITSU MHW2160BH PL
+
+  [ cking ]
+
+  * SAUCE: Enable speedstep for sonoma processors.
+
+  [ Colin Ian King ]
+
+  * ubuntu: Add dm-loop
+  * SAUCE: cx88: Support Leadtek WinFast DTV2000 H version J.
+  * SAUCE: fix kernel oops in VirtualBox during paravirt patching
+  * SAUCE: qc-usb: Enable Logitech QuickCam Messenger
+  * SAUCE: appleir: Enable driver for new MacBook Pro
+
+  [ Colin Watson ]
+
+  * Enable configfs, fuse, jfs, reiserfs, and xfs for armel
+  * Extend debian/d-i/ modules handling to make armel easier to support
+  * Create udebs for armel
+
+  [ Fabio M. Di Nitto ]
+
+  * ubuntu: update GFS Cluster File System
+
+  [ Kees Cook ]
+
+  * SAUCE: AppArmor: update to upstream subversion r1302
+
+  [ Leann Ogasawara ]
+
+  * Add automatic model setting for Samsung Q45
+  * Add Dell Dimension 9200 reboot quirk
+
+  [ Mackenzie Morgan ]
+
+  * SAUCE: Add quirk for ASUS Z37E to make sound audible after resume
+
+  [ Matthew Garrett ]
+
+  * SAUCE: hostap: send events on data interface as well as master
+    interface
+
+  [ Michael Frey (Senior Manager, MID ]
+
+  * SAUCE: Send HCI_RESET for Broadcomm 2046
+
+  [ Michael Haas ]
+
+  * add proper aufs source tree from 20080922
+  * Fix AUFS compilation in vfsub.c
+  * Add splice-2.6.23.patch from AUFS to export a symbol needed by AUFS
+  * Add put_filp.patch from AUFS to export a symbol needed by AUFS
+  * Add deny_write_access.patch from AUFS - export deny_write_access
+  * Add sec_perm-2.6.24.patch from AUFS - export security_inode_permission
+  * make sure TMPFS_MAGIC is defined in AUFS Makefile
+  * SAUCE: Revert aufs changes from AppArmor merge
+
+  [ Mohamed Abbas ]
+
+  * SAUCE: iwlagn -- fix rfkill when on when driver loaded
+
+  [ Phillip Lougher ]
+
+  * SAUCE: r8169: disable TSO by default for RTL8111/8168B chipsets.
+
+  [ Stefan Bader ]
+
+  * SAUCE: (no-up) Export dm_disk function of device-mapper
+  * SAUCE: Restore VT fonts on switch
+  * SAUCE: mmc: Increase power_up deleay to fix TI readers
+  * gfs1: GFS1 can't create more than 4kb file
+  * uvcvideo: Commit streaming parameters when enabling the video stream.
+
+  [ Tim Gardner ]
+
+  * SAUCE: Add extra headers to linux-libc-dev
+  * SAUCE: Catch nonsense keycodes and silently ignore
+  * SAUCE: Added support for HDAPS on various ThinkPads from Lenovo and IBM
+  * SAUCE: Guest OS does not recognize a lun with non zero target id on
+    Vmware ESX Server
+  * SAUCE: (no-up) Take care of orinoco_cs overlap with hostap_cs
+  * ubuntu: Add GNBD driver
+  * SAUCE: e1000e: Map NV RAM dynamically only when needed.
+  * SAUCE: Correctly blacklist Thinkpad r40e in ACPI
+  * SAUCE: Update Wacom tablet driver to 1.49
+  * SAUCE: Fix Wacom tablet 1.49 porting errors
+  * SAUCE: Enable an e1000e Intel Corporation 82567 Gigabit controller
+  * SAUCE: Fix Oops in wlan_setup
+  * SAUCE: ipw2200: change default policy for auto-associate
+  * Dell Wireless 365 needs BTUSB_RESET quirk.
+  * ndiswrapper remote buffer overflows on long ESSIDs (CVE 2008-4395)
+  * Disabled ubuntu/e1000e config
+
+  [ Upstream Kernel Changes ]
+
+  * Revert "[Bluetooth] Eliminate checks for impossible conditions in IRQ
+    handler"
+  * Revert "x86, early_ioremap: fix fencepost error"
+  * mac80211: fix two issues in debugfs
+  * iwl3945: do not send scan command if channel count zero
+
+ --  Ben Collins <ben.collins@canonical.com>  Fri, 07 Nov 2008 09:37:42 -0700
+
+linux (2.6.27-8.17) intrepid-proposed; urgency=low
+
+  [ John W. Linville ]
+
+  * SAUCE: iwlagn: avoid sleep in softirq context
+    -LP: #286285
+
+  [ Tim Gardner ]
+
+  * Dell Wireless 365 needs BTUSB_RESET quirk.
+    - LP: #293670
+  * SAUCE: ALSA: hda: make a STAC_DELL_EQ option (version 2)
+    - LP: #293271
+
+  [ Upstream Kernel Changes ]
+
+  * iwlagn: downgrade BUG_ON in interrupt
+  * Input: atkbd - expand Latitude's force release quirk to other Dells
+  * fbcon_set_all_vcs: fix kernel crash when switching the rotated consoles
+  * modules: fix module "notes" kobject leak
+  * Driver core: Fix cleanup in device_create_vargs().
+  * Driver core: Clarify device cleanup.
+  * ath9k/mac80211: disallow fragmentation in ath9k, report to userspace
+  * md: Fix rdev_size_store with size == 0
+  * xfs: fix remount rw with unrecognized options
+  * OHCI: Allow broken controllers to auto-stop
+  * USB: OHCI: fix endless polling behavior
+  * USB: Fix s3c2410_udc usb speed handling
+  * USB: EHCI: log a warning if ehci-hcd is not loaded first
+  * usb gadget: cdc ethernet notification bugfix
+  * usb: musb_hdrc build fixes
+  * drm/i915: fix ioremap of a user address for non-root (CVE-2008-3831)
+  * DVB: au0828: add support for another USB id for Hauppauge HVR950Q
+  * DVB: sms1xxx: support two new revisions of the Hauppauge WinTV
+    MiniStick
+  * security: avoid calling a NULL function pointer in
+    drivers/video/tvaudio.c
+  * Linux 2.6.27.3
+    -LP: #294152
+
+  * gpiolib: fix oops in gpio_get_value_cansleep()
+  * edac cell: fix incorrect edac_mode
+  * x86 ACPI: fix breakage of resume on 64-bit UP systems with SMP kernel
+  * sched: fix the wrong mask_len
+  * USB: cdc-wdm: make module autoload work
+  * USB: don't rebind drivers after failed resume or reset
+  * USB: fix memory leak in cdc-acm
+  * USB: Speedtouch: add pre_reset and post_reset routines
+  * dm kcopyd: avoid queue shuffle
+  * dm snapshot: fix primary_pe race
+  * amd_iommu: fix nasty bug that caused ILLEGAL_DEVICE_TABLE_ENTRY errors
+  * CIFS: fix saving of resume key before CIFSFindNext
+  * netfilter: xt_iprange: fix range inversion match
+  * netfilter: snmp nat leaks memory in case of failure
+  * netfilter: restore lost ifdef guarding defrag exception
+  * anon_vma_prepare: properly lock even newly allocated entries
+  * hvc_console: Fix free_irq in spinlocked section
+  * ACPI Suspend: Enable ACPI during resume if SCI_EN is not set
+  * ACPI suspend: Blacklist HP xw4600 Workstation for old code ordering
+  * ACPI suspend: Always use the 32-bit waking vector
+  * proc: fix vma display mismatch between /proc/pid/{maps,smaps}
+  * SCSI: scsi_dh: add Dell product information into rdac device handler
+  * PCI hotplug: cpqphp: fix kernel NULL pointer dereference
+  * V4L/DVB (9300): pvrusb2: Fix deadlock problem
+  * Linux 2.6.27.4
+    -LP: #294155
+
+ --  Tim Gardner <tim.gardner@canonical.com>  Tue, 04 Nov 2008 12:16:07 -0700
+
+linux (2.6.27-7.16) intrepid-security; urgency=low
+
+  [ Tim Gardner ]
+
+  * ndiswrapper remote buffer overflows on long ESSIDs (CVE 2008-4395)
+    - LP: #275860
+
+  [ Upstream Kernel Changes ]
+
+  * ext[234]: Avoid printk floods in the face of directory corruption
+    (CVE-2008-3528)
+
+ --  Tim Gardner <tim.gardner@canonical.com>  Mon, 03 Nov 2008 13:34:42 -0700
+
+linux (2.6.27-7.15) intrepid-security; urgency=low
+
+  [ Upstream Kernel Changes ]
+
+  * tcp: Restore ordering of TCP options for the sake of inter-operability
+    - LP: #264019
+
+ --  Tim Gardner <tim.gardner@canonical.com>  Mon, 27 Oct 2008 19:28:06 -0600
+
+linux (2.6.27-7.14) intrepid; urgency=low
+
+  [ Tim Gardner ]
+
+  * Disable ath5k in 2.6.27
+    - LP: #288148
+
+ --  Tim Gardner <tim.gardner@canonical.com>  Thu, 23 Oct 2008 07:40:43 -0600
+
+linux (2.6.27-7.13) intrepid; urgency=low
+
+  [ Stefan Bader ]
+
+  * gfs1: GFS1 can't create more than 4kb file
+
+  [ Tim Gardner ]
+
+  * Revert "SAUCE: x86: Reserve FIRST_DEVICE_VECTOR in used_vectors
+    bitmap.". Use upstream commit to avoid future conflicts.
+  * Revert "STABLE queue: mac80211: fix two issues in debugfs".
+    Use upstream commit to avoid future conflicts.
+  * Revert "x86, early_ioremap: fix fencepost error"
+    Use upstream commit to avoid future conflicts.
+
+  [ Upstream Kernel Changes ]
+
+  * sched_rt.c: resch needed in rt_rq_enqueue() for the root rt_rq
+  * x86: Reserve FIRST_DEVICE_VECTOR in used_vectors bitmap.
+  * mac80211: fix two issues in debugfs
+  * Fix barrier fail detection in XFS
+  * tty: Termios locking - sort out real_tty confusions and lock reads
+  * CIFS: make sure we have the right resume info before calling
+    CIFSFindNext
+  * rfkill: update LEDs for all state changes
+  * libertas: clear current command on card removal
+  * b43legacy: Fix failure in rate-adjustment mechanism
+  * x86, early_ioremap: fix fencepost error
+  * x86: SB450: skip IRQ0 override if it is not routed to INT2 of IOAPIC
+  * x86: improve UP kernel when CPU-hotplug and SMP is enabled
+  * sky2: Fix WOL regression
+  * netdrvr: atl1e: Don't take the mdio_lock in atl1e_probe
+  * Linux 2.6.27.2
+
+  [ Amit Kucheria ]
+
+  * Ubuntu: agp: Fix stolen memory counting on G4X.
+    -LP: 285572
+
+  [ Scott Remnant ]
+
+  * add MODULE_ALIAS to load ipmi_devintf with ipmi_si
+
+ --  Tim Gardner <tim.gardner@canonical.com>  Sun, 19 Oct 2008 10:06:21 -0600
+
+linux (2.6.27-7.12) intrepid; urgency=low
+
+  [ Chuck Short ]
+
+  * xen: Add xen modules to virtual flavours.
+
+  [ Mario Limonciello ]
+
+  * SAUCE: Add back in lost commit for Apple BT Wireless Keyboard
+    - LP: #162083
+
+  [ Tim Gardner ]
+
+  * Remove depmod created files from packages.
+    - LP: #250511
+  *  Changed default TCP congestion algorithm to 'cubic' (again)
+    - LP: #278801
+  * Update configs for 'disable CONFIG_DYNAMIC_FTRACE'
+    - LP: #263555
+
+  [ Upstream Kernel Changes ]
+
+  * x86: register a platform RTC device if PNP doesn't describe it
+  * disable CONFIG_DYNAMIC_FTRACE due to possible memory corruption on
+    module unload
+
+ --  Tim Gardner <tim.gardner@canonical.com>  Fri, 17 Oct 2008 11:25:39 -0600
+
+linux (2.6.27-7.11) intrepid; urgency=low
+
+  [ Amit Kucheria ]
+
+  * STABLE queue: mac80211: fix two issues in debugfs
+    - LP: #275227
+  * SAUCE: Adds support for COMPAL JHL90 webcam
+
+  [ Ben Collins ]
+
+  * SAUCE: (no-up) x86: Quiet "Kernel alive" messages
+    - LP: #39985
+  * SAUCE: (no-up) Modularize vesafb
+  * build/config: Enable vesafb module
+  * build: Switch to vesafb as preferred.
+
+  [ Leann Ogasawara ]
+
+  * Add Dell Dimension 9200 reboot quirk
+    - LP: #271370
+
+  [ Michael Haas ]
+
+  * SAUCE: Revert aufs changes from AppArmor merge
+
+  [ Tim Gardner ]
+
+  * fix virtio udeb layout
+    - LP: #257739
+  * Enabled CONFIG_EXT4DEV_FS=m
+  * Changed default TCP congestion algorithm to 'cubic'
+    - LP: #278801
+  * SAUCE: ipw2200: change default policy for auto-associate
+    - LP: #264104
+
+  [ Upstream Kernel Changes ]
+
+  * x86, early_ioremap: fix fencepost error
+    - LP: #263543
+
+ --  Tim Gardner <tim.gardner@canonical.com>  Sat, 11 Oct 2008 08:07:42 -0600
+
+linux (2.6.27-7.10) intrepid; urgency=low
+
+  [ Alexey Starikovskiy ]
+
+  * SAUCE: ACPI: EC: do transaction from interrupt context
+    - LP: #277802
+
+  [ Ben Collins ]
+
+  * build/d-i: Change virtio-modules udeb to prio standard
+
+  [ Colin Ian King ]
+
+  * SAUCE: Blacklist IBM 2656 in serio/i8042
+    - LP: #21558
+
+  [ Henrik Rydberg ]
+
+  * Revert "SAUCE: applesmc: Add MacBookAir"
+  * SAUCE: [PATCH 1/5] hwmon: applesmc: Specified number of bytes to read
+    should match actual
+  * SAUCE: [PATCH 2/5] hwmon: applesmc: Fix the 'wait status failed: c !=
+    8' problem
+  * SAUCE: [PATCH 3/5] hwmon: applesmc: Prolong status wait
+  * SAUCE: [PATCH 4/5] hwmon: applesmc: Allow for variable ALV0 and ALV1
+    package length
+  * SAUCE: [PATCH 5/5] hwmon: applesmc: Add support for Macbook Air
+  * SAUCE: hwmon: applesmc: Add support for Macbook Pro 4
+  * SAUCE: hwmon: applesmc: Add support for Macbook Pro 3
+  * SAUCE: hwmon: applesmc: Lighter wait mechanism, drastic improvement
+
+  [ Leann Ogasawara ]
+
+  * Add automatic model setting for Samsung Q45
+    - LP: #200210
+
+  [ Tim Gardner ]
+
+  * SAUCE: Correctly blacklist Thinkpad r40e in ACPI
+    - LP: #278794
+  * SAUCE: Update Wacom tablet driver to 1.49
+    - LP: #260675
+  * SAUCE: ALPS touchpad for Dell Latitude E6500/E6400
+    - LP: #270643
+  * SAUCE: Fix Wacom tablet 1.49 porting errors
+  * SAUCE: Enable an e1000e Intel Corporation 82567 Gigabit controller
+  * SAUCE: Fix Oops in wlan_setup
+    - LP: #263309
+
+  [ Upstream Kernel Changes ]
+
+  * ath9k: fix oops on trying to hold the wrong spinlock
+  * [Bluetooth] Fix double frees on error paths of btusb and bpa10x drivers
+  * [Bluetooth] Add reset quirk for new Targus and Belkin dongles
+  * [Bluetooth] Add reset quirk for A-Link BlueUSB21 dongle
+  * Revert "ax25: Fix std timer socket destroy handling."
+  * ax25: Quick fix for making sure unaccepted sockets get destroyed.
+  * netrom: Fix sock_orphan() use in nr_release
+  * Revert "V4L/DVB (8904): cx88: add missing unlock_kernel"
+  * SLOB: fix bogus ksize calculation
+  * net: only invoke dev->change_rx_flags when device is UP
+  * tcp: Fix possible double-ack w/ user dma
+  * net: Fix netdev_run_todo dead-lock
+  * tcp: Fix tcp_hybla zero congestion window growth with small rho and large cwnd.
+  * [MIPS] Sibyte: Register PIO PATA device only for Swarm and Litte Sur
+  * eeepc-laptop: Fix hwmon interface
+  * hwmon: (it87) Prevent power-off on Shuttle SN68PT
+  * hwmon: Define sysfs interface for energy consumption register
+  * hwmon: (adt7473) Fix some bogosity in documentation file
+  * hwmon: (abituguru3) Enable reading from AUX3 fan on Abit AT8 32X
+  * hwmon: (abituguru3) Enable DMI probing feature on Abit AT8 32X
+  * [CPUFREQ] correct broken links and email addresses
+  * SLOB: fix bogus ksize calculation fix
+  * Don't allow splice() to files opened with O_APPEND
+  * Linux 2.6.27
+
+ --  Tim Gardner <tim.gardner@canonical.com>  Wed, 08 Oct 2008 21:19:34 -0600
+
+linux (2.6.27-6.9) intrepid; urgency=low
+
+  [ Kees Cook ]
+
+  * SAUCE: AppArmor: update to upstream subversion r1302
+    - LP: #269921
+
+  [ Stefan Bader ]
+
+  * Update configuration files to be compliant to desktop specs
+    - LP: #279019
+
+  [ Tim Gardner ]
+
+  * Add support in e1000e for a couple of ICH10 PCI IDs
+  * Enable CONFIG_INPUT_PCSPKR=m
+    - LP: #275453
+
+  [ Upstream Kernel Changes ]
+
+  * V4L/DVB (8559a): Fix a merge conflict at gspca/sonixb
+  * V4L/DVB (8789): wm8739: remove wrong kfree
+  * V4L/DVB (8883): w9968cf: Fix order of usb_alloc_urb validation
+  * V4L/DVB (8884): em28xx-audio: fix memory leak
+  * V4L/DVB (8885): cpia2_usb: fix memory leak
+  * V4L/DVB (8886): ov511: fix memory leak
+  * V4L/DVB (8887): gspca: fix memory leak
+  * V4L/DVB (8892): pvrusb2: Handle USB ID 2040:2950 same as 2040:2900
+  * V4L/DVB (8904): cx88: add missing unlock_kernel
+  * V4L/DVB (8905): ov511: fix exposure sysfs attribute bug
+  * V4L/DVB (8909): gspca: PAC 7302 webcam 093a:262a added.
+  * hrtimer: migrate pending list on cpu offline
+  * hrtimer: fix migration of CB_IRQSAFE_NO_SOFTIRQ hrtimers
+  * hrtimer: mark migration state
+  * hrtimer: prevent migration of per CPU hrtimers
+  * [IA64] Put the space for cpu0 per-cpu area into .data section
+  * powerpc: Fix PCI in Holly device tree
+  * powerpc: Fix failure to shutdown with CPU hotplug
+  * mfd: Fix Kconfig accroding to the new gpiolib symbols
+  * mfd: Fix asic3 compilation
+  * x86: fix typo in enable_mtrr_cleanup early parameter
+  * ipsec: Fix pskb_expand_head corruption in xfrm_state_check_space
+  * iucv: Fix mismerge again.
+  * ALSA: ASoC: Fix cs4270 error path
+  * ALSA: hda - Fix model for Dell Inspiron 1525
+  * sctp: Fix kernel panic while process protocol violation parameter
+  * x86: Fix broken LDT access in VMI
+  * x86, vmi: fix broken LDT access
+  * tcp: Fix NULL dereference in tcp_4_send_ack()
+  * ipv6: NULL pointer dereferrence in tcp_v6_send_ack
+  * XFRM,IPv6: initialize ip6_dst_blackhole_ops.kmem_cachep
+  * af_key: Free dumping state on socket close
+  * dm: always allow one page in dm_merge_bvec
+  * dm: cope with access beyond end of device in dm_merge_bvec
+  * dm mpath: add missing path switching locking
+  * MN10300: Fix IRQ handling
+  * pxa2xx_spi: fix build breakage
+  * e1000e: write protect ICHx NVM to prevent malicious write/erase
+  * powerpc: Fix boot hang regression on MPC8544DS
+  * ASoC: Set correct name for WM8753 rec mixer output
+  * ALSA: snd-powermac: mixers for PowerMac G4 AGP
+  * ALSA: snd-powermac: HP detection for 1st iMac G3 SL
+  * fbcon: fix monochrome color value calculation
+  * inotify: fix lock ordering wrt do_page_fault's mmap_sem
+  * braille_console: only register notifiers when the braille console is used
+  * fix error-path NULL deref in alloc_posix_timer()
+  * memory hotplug: missing zone->lock in test_pages_isolated()
+  * mm: tiny-shmem nommu fix
+  * mm: handle initialising compound pages at orders greater than MAX_ORDER
+  * e1000e: reset swflag after resetting hardware
+  * e1000e: do not ever sleep in interrupt context
+  * e1000e: remove phy read from inside spinlock
+  * e1000e: drop stats lock
+  * e1000e: debug contention on NVM SWFLAG
+  * e1000e: update version from k4 to k6
+  * Check mapped ranges on sysfs resource files
+  * e1000e: Fix incorrect debug warning
+  * [MIPS] Build fix: Fix irq flags type
+  * [MIPS] SMTC: Build fix: Fix filename in Makefile
+  * [MIPS] SMTC: Fix holes in SMTC and FPU affinity support.
+  * [MIPS] SMTC: Close tiny holes in the SMTC IPI replay system.
+  * [MIPS] SMTC: Fix SMTC dyntick support.
+  * [S390] nohz: Fix __udelay.
+  * [S390] qdio: prevent stack clobber
+  * Fix init/main.c to use regular printk with '%pF' for initcall fn
+  * x86 setup: correct segfault in generation of 32-bit reloc kernel
+  * selinux: Fix an uninitialized variable BUG/panic in selinux_secattr_to_sid()
+  * rtc: fix kernel panic on second use of SIGIO nofitication
+  * fbdev: fix recursive notifier and locking when fbdev console is blanked
+  * orion_spi: fix handling of default transfer speed
+  * include/linux/stacktrace.h: declare struct task_struct
+  * cpusets: remove pj from cpuset maintainers
+  * MAINTAINERS: add mailing list for man-pages
+  * SubmitChecklist: interfaces changes should CC linux-api@
+  * Documentation/HOWTO: info about interface changes should CC linux-api@vger
+  * dw_dmac: fix copy/paste bug in tasklet
+  * leds-fsg: change order of initialization and deinitialization
+  * leds-pca955x: add proper error handling and fix bogus memory handling
+  * ACPI: Make /proc/acpi/wakeup interface handle PCI devices (again)
+  * clockevents: check broadcast tick device not the clock events device
+  * V4L/DVB (8919): cx18: Fix tuner audio input for Compro H900 cards
+  * V4L/DVB (8926): gspca: Bad fix of leak memory (changeset 43d2ead315b1).
+  * V4L/DVB (8933): gspca: Disable light frquency for zc3xx cs2102 Kokom.
+  * V4L/DVB (8935): em28xx-cards: Remove duplicate entry (EM2800_BOARD_KWORLD_USB2800)
+  * V4L/DVB (8955): bttv: Prevent NULL pointer dereference in radio_open
+  * V4L/DVB (8957): zr36067: Restore the default pixel format
+  * V4L/DVB (8958): zr36067: Return proper bytes-per-line value
+  * V4L/DVB (8960): drivers/media/video/cafe_ccic.c needs mm.h
+  * V4L/DVB (8961): zr36067: Fix RGBR pixel format
+  * V4L/DVB (8963): s2255drv field count fix
+  * V4L/DVB (8967): Use correct XC3028L firmware for AMD ATI TV Wonder 600
+  * V4L/DVB (8978): sms1xxx: fix product name for Hauppauge WinTV MiniStick
+  * V4L/DVB (8979): sms1xxx: Add new USB product ID for Hauppauge WinTV MiniStick
+  * V4L/DVB (9029): Fix deadlock in demux code
+  * V4L/DVB (9037): Fix support for Hauppauge Nova-S SE
+  * V4L/DVB (9043): S5H1420: Fix size of shadow-array to avoid overflow
+  * V4L/DVB (9053): fix buffer overflow in uvc-video
+  * V4L/DVB (9075): gspca: Bad check of returned status in i2c_read() spca561.
+  * V4L/DVB (9080): gspca: Add a delay after writing to the sonixj sensors.
+  * V4L/DVB (9092): gspca: Bad init values for sonixj ov7660.
+  * V4L/DVB (9099): em28xx: Add detection for K-WORLD DVB-T 310U
+  * V4L/DVB (9103): em28xx: HVR-900 B3C0 - fix audio clicking issue
+  * x86: gart iommu have direct mapping when agp is present too
+  * ide-cd: temporary tray close fix
+  * ide-dma: fix ide_build_dmatable() for TRM290
+  * IDE: Fix platform device registration in Swarm IDE driver (v2)
+  * ide-cd: Optiarc DVD RW AD-7200A does play audio
+  * ide: workaround for bogus gcc warning in ide_sysfs_register_port()
+  * [MIPS] Fix CMP Kconfig configuration and mark as broken.
+  * [MIPS] IP27: Fix build errors if CONFIG_MAPPED_KERNEL=y
+  * x86 ACPI: Blacklist two HP machines with buggy BIOSes
+  * kgdb, x86: Avoid invoking kgdb_nmicallback twice per NMI
+  * kgdb: call touch_softlockup_watchdog on resume
+  * atmel-mci: Initialize BLKR before sending data transfer command
+  * Marker depmod fix core kernel list
+  * Linux 2.6.27-rc9
+
+ --  Tim Gardner <tim.gardner@canonical.com>  Sun, 05 Oct 2008 21:27:49 -0600
+
+linux (2.6.27-5.8) intrepid; urgency=low
+
+  [ Amit Kucheria ]
+
+  * Update AUFS-related Kconfig
+    - LP: #264048
+
+  [ Michael Haas ]
+
+  * add proper aufs source tree from 20080922
+  * Fix AUFS compilation in vfsub.c
+  * Add splice-2.6.23.patch from AUFS to export a symbol needed by AUFS
+  * Add put_filp.patch from AUFS to export a symbol needed by AUFS
+  * apply (modified) lhash.patch from AUFS to export __lookup_hash()
+  * Add deny_write_access.patch from AUFS - export deny_write_access
+  * Add sec_perm-2.6.24.patch from AUFS - export security_inode_permission
+  * make sure TMPFS_MAGIC is defined in AUFS Makefile
+
+  [ Tim Gardner ]
+
+  * Enabled CONFIG_IPWIRELESS
+    - LP: #274748
+  * Enabled CONFIG_E1000E, disabled CONFIG_E1000E_NEW
+    This takes advantage of the upstream NVM protection fix in
+    commit 4a7703582836f55a1cbad0e2c1c6ebbee3f9b3a7.
+
+  [ Upstream Kernel Changes ]
+
+  * Revert "[Bluetooth] Eliminate checks for impossible conditions in IRQ
+    handler"
+  * [SCSI] qla2xxx: Defer enablement of RISC interrupts until ISP
+    initialization completes.
+  * PCI: Fix pcie_aspm=force
+  * PCI: fix compiler warnings in pci_get_subsys()
+  * UBIFS: create the name of the background thread in every case
+  * UBIFS: TNC / GC race fixes
+  * UBIFS: remove incorrect assert
+  * UBIFS: fix printk format warnings
+  * AMD IOMMU: set iommu sunc flag after command queuing
+  * AMD IOMMU: protect completion wait loop with iommu lock
+  * sparc64: Fix disappearing PCI devices on e3500.
+  * x86, oprofile: BUG scheduling while atomic
+  * ALSA: ASoC: Fix at32-pcm build breakage with PM enabled
+  * ath9k: connectivity is lost after Group rekeying is done
+  * wireless: zd1211rw: add device ID fix wifi dongle "trust nw-3100"
+  * [IA64] Ski simulator doesn't need check_sal_cache_flush
+  * [IA64] kexec fails on systems with blocks of uncached memory
+  * ath9k: Fix IRQ nobody cared issue with ath9k
+  * [Bluetooth] Fix I/O errors on MacBooks with Broadcom chips
+  * [Bluetooth] Fix wrong URB handling of btusb driver
+  * [Bluetooth] Fix USB disconnect handling of btusb driver
+  * sparc64: Fix missing devices due to PCI bridge test in
+    of_create_pci_dev().
+  * [WATCHDOG] ibmasr: remove unnecessary spin_unlock()
+  * [WATCHDOG] wdt285: fix sparse warnings
+  * [WATCHDOG] unlocked_ioctl changes
+  * x86: fix 27-rc crash on vsmp due to paravirt during module load
+  * sched: fix init_hrtick() section mismatch warning
+  * clockevents: prevent cpu online to interfere with nohz
+  * x86: prevent stale state of c1e_mask across CPU offline/online
+  * clockevents: prevent stale tick_next_period for onlining CPUs
+  * clockevents: check broadcast device not tick device
+  * clockevents: prevent mode mismatch on cpu online
+  * x86: prevent C-states hang on AMD C1E enabled machines
+  * x86: c1e_idle: don't mark TSC unstable if CPU has invariant TSC
+  * timers: fix build error in !oneshot case
+  * ALSA: ASoC: maintainers - update email address for Liam Girdwood
+  * ibmasr: remove unnecessary spin_unlock()
+  * smb.h: do not include linux/time.h in userspace
+  * kernel-doc: allow structs whose members are all private
+  * kexec: fix segmentation fault in kimage_add_entry
+  * Documentation/DMA-mapping.txt: update for pci_dma_mapping_error()
+    changes
+  * sys_paccept: disable paccept() until API design is resolved
+  * mm: tiny-shmem fix lock ordering: mmap_sem vs i_mutex
+  * Documentation/sysctl/kernel.txt: fix softlockup_thresh description
+  * memcg: check under limit at shrink_usage
+  * atmel_serial: update the powersave handler to match serial core
+  * [SCSI] Fix hang with split requests
+  * USB Storage: Sierra: Non-configurable TRU-Install
+  * USB Serial: Sierra: Device addition & version rev
+  * USB: ehci: fix some ehci hangs and crashes
+  * USB: Fix the Nokia 6300 storage-mode.
+  * USB: Correct Sierra Wireless USB EVDO Modem Device ID
+  * USB: fix hcd interrupt disabling
+  * USB: update of Documentation/usb/anchors.txt
+  * usb gadget: fix omap_udc DMA regression
+  * USB: Fixing Nokia 3310c in storage mode
+  * usb: musb: fix include path
+  * USB: fix EHCI periodic transfers
+  * usb-serial: Add Siemens EF81 to PL-2303 hack triggers
+  * USB: SERIAL CP2101 add device IDs
+  * USB: unusual_devs addition for RockChip MP3 player
+  * USB: fsl_usb2_udc: fix VDBG() format string
+  * usb serial: ti_usb_3410_5052 obviously broken by firmware changes
+  * USB: ftdi_sio: Add 0x5050/0x0900 USB IDs (Papouch Quido USB 4/4)
+  * USB: serial: add ZTE CDMA Tech id to option driver
+  * USB Serial: Sierra: Add MC8785 VID/PID
+  * USB: drivers/usb/musb/: disable it on SuperH
+  * usb: ftdi_sio: add support for Domintell devices
+  * usb: unusual devs patch for Nokia 5310 Music Xpress
+  * USB: revert recovery from transient errors
+  * [MIPS] au1000: Fix gpio direction
+  * [MIPS] Fixe the definition of PTRS_PER_PGD
+  * x86: prevent stale state of c1e_mask across CPU offline/online, fix
+  * x86: disable apm on the olpc
+  * i2c-powermac: Fix section for probe and remove functions
+  * i2c-dev: Return correct error code on class_create() failure
+  * i2c: Fix mailing lists in two MAINTAINERS entries
+  * ath9k: disable MIB interrupts to fix interrupt storm
+  * 9p: implement proper trans module refcounting and unregistration
+  * 9p-trans_fd: fix trans_fd::p9_conn_destroy()
+  * 9p-trans_fd: clean up p9_conn_create()
+  * 9p-trans_fd: don't do fs segment mangling in p9_fd_poll()
+  * 9p-trans_fd: fix and clean up module init/exit paths
+  * 9p: introduce missing kfree
+  * 9p: use an IS_ERR test rather than a NULL test
+  * 9p: fix put_data error handling
+  * netfilter: ip6t_{hbh,dst}: Rejects not-strict mode on rule insertion
+  * MN10300: Move asm-arm/cnt32_to_63.h to include/linux/
+  * MN10300: Make sched_clock() report time since boot
+  * ALSA: fix locking in snd_pcm_open*() and snd_rawmidi_open*()
+  * ALSA: remove unneeded power_mutex lock in snd_pcm_drop
+  * IPoIB: Fix crash when path record fails after path flush
+  * [XFS] Fix extent list corruption in xfs_iext_irec_compact_full().
+  * [XFS] Remove xfs_iext_irec_compact_full()
+  * kgdb: could not write to the last of valid memory with kgdb
+  * kgdb, x86, arm, mips, powerpc: ignore user space single stepping
+  * kgdb, x86_64: gdb serial has BX and DX reversed
+  * kgdb, x86_64: fix PS CS SS registers in gdb serial
+  * kgdboc,tty: Fix tty polling search to use name correctly
+  * ARM: Delete ARM's own cnt32_to_63.h
+  * m32r: remove the unused NOHIGHMEM option
+  * m32r: don't offer CONFIG_ISA
+  * m32r: export empty_zero_page
+  * m32r: export __ndelay
+  * m32r/kernel/: cleanups
+  * [MIPS] au1000: Make sure GPIO value is zero or one
+  * [MIPS] IP27: Switch to dynamic interrupt routing avoding panic on
+    error.
+  * [MIPS] BCM47xx: Fix build error due to missing PCI functions
+  * [SSB] Initialise dma_mask for SSB_BUSTYPE_SSB devices
+  * Swarm: Fix crash due to missing initialization
+  * ide-tape: fix vendor strings
+  * ide: note that IDE generic may prevent other drivers from attaching
+  * cdrom: update ioctl documentation
+  * [SCSI] qlogicpti: fix sg list traversal error in continuation entries
+  * sata_nv: reinstate nv_hardreset() for non generic controllers
+  * scsi: fix fall out of sg-chaining patch in qlogicpti
+  * ALSA: make the CS4270 driver a new-style I2C driver
+  * ALSA: ASoC: Fix another cs4270 error path
+  * Fix NULL pointer dereference in proc_sys_compare
+  * kconfig: fix silentoldconfig
+  * kconfig: readd lost change count
+  * mm owner: fix race between swapoff and exit
+  * Linux 2.6.27-rc8
+  * e1000e: write protect ICHx NVM to prevent malicious write/erase
+
+ -- Amit Kucheria <amit.kucheria@canonical.com>  Tue, 30 Sep 2008 18:22:35 +0300
+
+linux (2.6.27-4.7) intrepid; urgency=low
+
+  [ Ben Collins ]
+
+  * build/abi: Add gfs1 to perm blacklist
+  * build/abi: Ignored changes in gfs2 symbols
+
+  [ Fabio M. Di Nitto ]
+
+  * Revert "SAUCE: Export gfs2 symbols required for gfs1 kernel module"
+  * ubuntu: update GFS Cluster File System
+
+  [ Stefan Bader ]
+
+  * SAUCE: x86: Reserve FIRST_DEVICE_VECTOR in used_vectors bitmap.
+    - LP: #276334
+
+  [ Tim Gardner ]
+
+  * Revert "Disable e1000e until the NVRAM corruption problem is found."
+  * Add atl1e and atl2 to Debian installer bits
+    - LP: #273904
+  * SAUCE: e1000e: Map NV RAM dynamically only when needed.
+    - LP: #263555
+
+ --  Tim Gardner <tim.gardner@canonical.com>  Fri, 26 Sep 2008 20:51:22 -0600
+
+linux (2.6.27-4.6) intrepid; urgency=low
+
+  [ Tim Gardner ]
+
+  * Disable e1000e until the NVRAM corruption problem is found.
+    - LP: #263555
+
+  [ Upstream Kernel Changes ]
+
+  * Revert "[Bluetooth] Eliminate checks for impossible conditions in IRQ
+    handler"
+
+ -- Ben Collins <ben.collins@canonical.com>  Tue, 23 Sep 2008 09:53:57 -0400
+
+linux (2.6.27-4.5) intrepid; urgency=low
+
+  [ Upstream Kernel Changes ]
+
+  * Revert "b43/b43legacy: add RFKILL_STATE_HARD_BLOCKED support"
+  * udf: Fix lock inversion between iprune_mutex and alloc_mutex (v2)
+  * udf: Fix error paths in udf_new_inode()
+  * [SCSI] sd: select CRC_T10DIF only when necessary
+  * [SCSI] zfcp: Fix request queue locking
+  * [SCSI] zfcp: Correctly query end flag in gpn_ft response
+  * [SCSI] zfcp: Simplify ccw notify handler
+  * [SCSI] zfcp: Fix reference counter for remote ports
+  * [SCSI] zfcp: channel cannot be detached due to refcount imbalance
+  * [SCSI] zfcp: Remove duplicated unlikely() macros.
+  * [SCSI] scsi_dh: make check_sense return ADD_TO_MLQUEUE
+  * [SCSI] make scsi_check_sense HARDWARE_ERROR return ADD_TO_MLQUEUE on
+    retry
+  * [SCSI] fix check of PQ and PDT bits for WLUNs
+  * pcm037: add rts/cts support for serial port
+  * i.MX serial: fix init failure
+  * imx serial: set RXD mux bit on i.MX27 and i.MX31
+  * imx serial: fix rts handling for non imx1 based hardware
+  * mlx4_core: Set RAE and init mtt_sz field in FRMR MPT entries
+  * udf: add llseek method
+  * PCI/iommu: blacklist DMAR on Intel G31/G33 chipsets
+  * PCI: Fix printk warnings in probe.c
+  * PCI: Fix printk warnings in setup-bus.c
+  * PCI Hotplug: fakephp: fix deadlock... again
+  * clockevents: remove WARN_ON which was used to gather information
+  * ocfs2: Fix a bug in direct IO read.
+  * arch/x86/kernel/kdebugfs.c: introduce missing kfree
+  * [IA64] fix compile failure with non modular builds
+  * [IA64] fix up bte.h
+  * [IA64] arch/ia64/sn/pci/tioca_provider.c: introduce missing kfree
+  * PCI: fix pciehp_free_irq()
+  * [IA64] prevent ia64 from invoking irq handlers on offline CPUs
+  * ide: Fix pointer arithmetic in hpt3xx driver code (3rd try)
+  * add deprecated ide-scsi to feature-removal-schedule.txt
+  * swiotlb: fix back-off path when memory allocation fails
+  * sparc64: Fix interrupt register calculations on Psycho and Sabre.
+  * VIDEO_SH_MOBILE_CEU should depend on HAS_DMA
+  * m68k: Update defconfigs for 2.6.27-rc6
+  * sparc32: Fix function signature of of_bus_sbus_get_flags().
+  * sched: fix 2.6.27-rc5 couldn't boot on tulsa machine randomly
+  * sched: fix deadlock in setting scheduler parameter to zero
+  * KVM: SVM: fix random segfaults with NPT enabled
+  * KVM: SVM: fix guest global tlb flushes with NPT
+  * KVM: VMX: Always return old for clear_flush_young() when using EPT
+  * clocksource, acpi_pm.c: fix check for monotonicity
+  * [ARM] OMAP: Fix MMC device data
+  * block: disable sysfs parts of the disk command filter
+  * ath9k: Assign seq# when mac80211 requests this
+  * sg: disable interrupts inside sg_copy_buffer
+  * MN10300: Change the fault handler to check in_atomic() not
+    in_interrupt()
+  * [Bluetooth] Fix regression from using default link policy
+  * netlink: fix overrun in attribute iteration
+  * x86: fix possible x86_64 and EFI regression
+  * sparc64: Fix PCI error interrupt registry on PSYCHO.
+  * sparc: Fix user_regset 'n' field values.
+  * niu: panic on reset
+  * PCI: re-add debug prints for unmodified BARs
+  * [ARM] 5245/1: Fix warning about unused return value in drivers/pcmcia
+  * [ARM] 5246/1: tosa: add proper clock alias for tc6393xb clock
+  * [ARM] 5247/1: tosa: SW_EAR_IN support
+  * [ARM] Fix PCI_DMA_BUS_IS_PHYS for ARM
+  * ata: duplicate variable sparse warning
+  * sata_inic162x: enable LED blinking
+  * [libata] LBA28/LBA48 off-by-one bug in ata.h
+  * proc: more debugging for "already registered" case
+  * include/linux/ioport.h: add missing macro argument for devm_release_*
+    family
+  * cpuset: avoid changing cpuset's cpus when -errno returned
+  * cpuset: hotplug documentation fix
+  * coredump_filter: add description of bit 4
+  * bfs: fix Lockdep warning
+  * mm: ifdef Quicklists in /proc/meminfo
+  * spi_mpc83xx: fix clockrate calculation for low speed
+  * spi_mpc83xx: reject invalid transfer sizes
+  * pxa2xx_spi: chipselect bugfixes
+  * pxa2xx_spi: dma bugfixes
+  * mm: mark the correct zone as full when scanning zonelists
+  * Documentation/ABI: /sys/class/gpio
+  * MAINTAINERS: fix USB VIDEO CLASS mail list address
+  * ia64: fix panic during `modprobe -r xpc'
+  * atmel_lcdfb: disable LCD and DMA engines when suspending
+  * spi_s3c24xx: fix section warning
+  * rescan_partitions(): make device capacity errors non-fatal
+  * memstick: fix MSProHG 8-bit interface mode support
+  * Add Uwe Kleine-König to .mailmap
+  * xen: fix for xen guest with mem > 3.7G
+  * x86/paravirt: Remove duplicate paravirt_pagetable_setup_{start, done}()
+  * crypto: talitos - Avoid consecutive packets going out with same IV
+  * slub: fixed uninitialized counter in struct kmem_cache_node
+  * udp: Fix rcv socket locking
+  * IB/mlx4: Fix up fast register page list format
+  * [MIPS] VR41xx: unsigned irq cannot be negative
+  * x86: completely disable NOPL on 32 bits
+  * [S390] cio: Fix driver_data handling for ccwgroup devices.
+  * [S390] cio: fix orb initialization in cio_start_key
+  * sparc64: Fix OOPS in psycho_pcierr_intr_other().
+  * sparc64: Fix SMP bootup with CONFIG_STACK_DEBUG or ftrace.
+  * RDMA/nes: Fix client side QP destroy
+  * IPoIB: Fix deadlock on RTNL between bcast join comp and ipoib_stop()
+  * clockevents: make device shutdown robust
+  * powerpc: Fix interrupt values for DMA2 in MPC8610 HPCD device tree
+  * hpplus: fix build regression
+  * Fix PNP build failure, bugzilla #11276
+  * warn: Turn the netdev timeout WARN_ON() into a WARN()
+  * [XFS] Move memory allocations for log tracing out of the critical path
+  * [XFS] Fix regression introduced by remount fixup
+  * [XFS] Prevent direct I/O from mapping extents beyond eof
+  * [XFS] Fix barrier status change detection.
+  * [XFS] Prevent lockdep false positives when locking two inodes.
+  * [XFS] Fix use-after-free with buffers
+  * [XFS] Don't do I/O beyond eof when unreserving space
+  * powerpc: Holly board needs dtbImage target
+  * Fix compile failure with non modular builds
+  * [ARM] 5249/1: davinci: remove redundant check in davinci_psc_config()
+  * [ARM] omap: back out 'internal_clock' support
+  * sctp: set the skb->ip_summed correctly when sending over loopback.
+  * [ARM] 5255/1: Update jornada ssp to remove build errors/warnings
+  * sctp: do not enable peer features if we can't do them.
+  * sctp: Fix oops when INIT-ACK indicates that peer doesn't support AUTH
+  * bnx2: Promote vector field in bnx2_irq structure from u16 to unsigned
+    int
+  * forcedeth: call restore mac addr in nv_shutdown path
+  * e1000: prevent corruption of EEPROM/NVM
+  * e100: Use pci_pme_active to clear PME_Status and disable PME#
+  * md: Don't wait UNINTERRUPTIBLE for other resync to finish
+  * atstk1000: fix build breakage with BOARD_ATSTK100X_SW2_CUSTOM=y
+  * avr32: add .gitignore files
+  * avr32: add generic_find_next_le_bit bit function
+  * avr32: fix sys_sync_file_range() call convention
+  * avr32: nmi_enter() without nmi_exit()
+  * KVM: ia64: 'struct fdesc' build fix
+  * hwmon: (atxp1) Fix device detection logic
+  * hwmon: (it87) Fix fan tachometer reading in IT8712F rev 0x7 (I)
+  * hwmon: (ad7414) Make ad7414_update_device() static
+  * tmio_mmc: fix compilation with debug enabled
+  * atmel-mci: debugfs: enable clock before dumping regs
+  * atmel-mci: Fix memory leak in atmci_regs_show
+  * atmel-mci: Fix bogus debugfs file size
+  * atmel-mci: Set MMC_CAP_NEEDS_POLL if no detect_pin
+  * mmc_block: handle error from mmc_register_driver()
+  * mmc_test: initialize mmc_test_lock statically
+  * [MIPS] Fix 64-bit IP checksum code
+  * [MIPS] SMTC: Clear TIF_FPUBOUND on clone / fork.
+  * [MIPS] Fix potential latency problem due to non-atomic cpu_wait.
+  * [MIPS] vmlinux.lds.S: handle .text.*
+  * MAINTAINERS: Trivial whitespace cleanups
+  * MAINTAINERS: Various fixes
+  * Linux 2.6.27-rc7
+
+ --  Tim Gardner <tim.gardner@canonical.com>  Sun, 21 Sep 2008 21:49:28 -0600
+
+linux (2.6.27-3.4) intrepid; urgency=low
+
+  [ Colin Ian King ]
+
+  * SAUCE: fix kernel oops in VirtualBox during paravirt patching
+    - LP: #246067
+  * SAUCE: qc-usb: Enable Logitech QuickCam Messenger
+    - LP: #209901
+  * SAUCE: appleir: Enable driver for new MacBook Pro
+    - LP: #157919
+
+  [ Tim Gardner ]
+
+  * Enabled CONFIG_DEBUG_RODATA=y
+
+  [ Upstream Kernel Changes ]
+
+  * Revert "ALSA: hda - Added model selection for iMac 24""
+  * Revert "x86: fix HPET regression in 2.6.26 versus 2.6.25, check hpet
+    against BAR, v3"
+  * Revert "[ARM] use the new byteorder headers"
+  * Revert "mac80211: Use IWEVASSOCREQIE instead of IWEVCUSTOM"
+  * Revert "crypto: camellia - Use kernel-provided bitops, unaligned access
+    helpers"
+  * svcrdma: Fix race between svc_rdma_recvfrom thread and the dto_tasklet
+  * sched, cpuset: rework sched domains and CPU hotplug handling (v4)
+  * ACPI: Fix now signed module parameter.
+  * ACPI: Change package length error to warning
+  * ACPI: Fix now signed module parameter.
+  * ACPI: Fix typo in "Disable MWAIT via DMI on broken Compal board"
+  * acpi: add checking for NULL early param
+  * UBIFS: fix zero-length truncations
+  * Input: bcm5974 - add maintainer entry
+  * sh64: re-add the __strnlen_user() prototype
+  * sh: fix ptrace_64.c:user_disable_single_step()
+  * PNPACPI: ignore the producer/consumer bit for extended IRQ descriptors
+  * UBIFS: always read hashed-key nodes under TNC mutex
+  * UBIFS: allow for racing between GC and TNC
+  * [CIFS] Fix plaintext authentication
+  * sparc32: Implement smp_call_function_single().
+  * sh: crash kernel resource fix
+  * sh: fix kexec entry point for crash kernels
+  * sh: fix platform_resource_setup_memory() section mismatch
+  * sh: update Migo-R defconfig
+  * sh: update AP325RXA defconfig
+  * sh: fix semtimedop syscall
+  * cifs: fix O_APPEND on directio mounts
+  * [CIFS] update cifs change log
+  * [CIFS] Turn off Unicode during session establishment for plaintext
+    authentication
+  * ACPI: thinkpad-acpi: wan radio control is not experimental
+  * sparc: Fix resource flags for PCI children in OF device tree.
+  * remove blk_register_filter and blk_unregister_filter in gendisk
+  * ALSA: oxygen: fix distorted output on AK4396-based cards
+  * ipv6: When we droped a packet, we should return NET_RX_DROP instead of
+    0
+  * pkt_sched: Fix locking of qdisc_root with qdisc_root_sleeping_lock()
+  * net: Unbreak userspace usage of linux/mroute.h
+  * Don't trigger softlockup detector on network fs blocked tasks
+  * Resource handling: add 'insert_resource_expand_to_fit()' function
+  * sparc64: setup_valid_addr_bitmap_from_pavail() should be __init
+  * UBIFS: do not update min_idx_lebs in stafs
+  * UBIFS: push empty flash hack down
+  * UBIFS: remove incorrect index space check
+  * UBIFS: improve statfs reporting
+  * UBIFS: fix assertion
+  * UBIFS: add forgotten gc_idx_lebs component
+  * UBIFS: introduce LEB overhead
+  * UBIFS: improve statfs reporting even more
+  * UBIFS: fill f_fsid
+  * drm/radeon: downgrade debug message from info to debug.
+  * Remove invalidate_partition call from do_md_stop.
+  * Fix problem with waiting while holding rcu read lock in md/bitmap.c
+  * ALSA: hda: Distortion fix for dell_m6_core_init
+  * ALSA: ASoC: fix pxa2xx-i2s clk_get call
+  * block: restore original behavior of /proc/partition when there's no
+    partition
+  * debugobjects: fix lockdep warning
+  * avr32: Fix lockup after Java stack underflow in user mode
+  * avr32: pm_standby low-power ram bug fix
+  * nfsd: fix compound state allocation error handling
+  * sunrpc: fix possible overrun on read of /proc/sys/sunrpc/transports
+  * nfsd: fix buffer overrun decoding NFSv4 acl
+  * audit: Moved variable declaration to beginning of function
+  * Fix modules_install on RO nfs-exported trees.
+  * Remove '#include <stddef.h>' from mm/page_isolation.c
+  * dabusb_fpga_download(): fix a memory leak
+  * [MTD] mtdchar.c: Fix regression in MEMGETREGIONINFO ioctl()
+  * ALSA: hda - Fix ALC663 auto-probe
+  * ALSA: hda - Add mic-boost controls to ALC662/663 auto configuration
+  * Un-break printk strings in x86 PCI probing code
+  * kernel/resource.c: fix new kernel-doc warning
+  * softlockup: minor cleanup, don't check task->state twice
+  * fix typo in arch/parisc/hpux/fs.c
+  * m68k: atari_keyb_init operator precedence fix
+  * ACPI: Fix typo in "Disable MWAIT via DMI on broken Compal board"
+  * don't diff generated firmware files
+  * IDE: compile fix for sff_dma_ops
+  * IDE: palm_bk3710: fix compile warning for unused variable
+  * ide: fix hwif_to_node()
+  * palm_bk3710: improve IDE registration
+  * ide-disk: remove stale init_idedisk_capacity() documentation
+  * ide/Kconfig: mark ide-scsi as deprecated
+  * net/wireless/Kconfig: clarify the description for
+    CONFIG_WIRELESS_EXT_SYSFS
+  * iwlwifi: do not use GFP_DMA in iwl_tx_queue_init
+  * iwlwifi: workaround interrupt handling no some platforms
+  * iwlwifi: fix apm_stop (wrong bit polarity for FLAG_INIT_DONE)
+  * iwlwifi: fix 64bit platform firmware loading
+  * orinoco: Multicast to the specified addresses
+  * wireless/libertas/if_cs.c: fix memory leaks
+  * mac80211: Fix debugfs union misuse and pointer corruption
+  * rt2x00: Compiler warning unmasked by fix of BUILD_BUG_ON
+  * ath9k: Incorrect key used when group and pairwise ciphers are
+    different.
+  * ath9: Fix ath_rx_flush_tid() for IRQs disabled kernel warning message.
+  * net/xfrm: Use an IS_ERR test rather than a NULL test
+  * ipv: Re-enable IP when MTU > 68
+  * NTFS: update homepage
+  * mm: make setup_zone_migrate_reserve() aware of overlapping nodes
+  * VFS: fix dio write returning EIO when try_to_release_page fails
+  * acer-wmi: remove debugfs entries upon unloading
+  * mm/bootmem: silence section mismatch warning -
+    contig_page_data/bootmem_node_data
+  * MAINTAINERS: add a maintainer for the BCM5974 multitouch driver
+  * 8250: improve workaround for UARTs that don't re-assert THRE correctly
+  * mmc: at91_mci: don't use coherent dma buffers
+  * pid_ns: zap_pid_ns_processes: fix the ->child_reaper changing
+  * pid_ns: (BUG 11391) change ->child_reaper when init->group_leader exits
+  * cirrusfb: check_par fixes
+  * devcgroup: fix race against rmdir()
+  * mm: show quicklist usage in /proc/meminfo
+  * mm: size of quicklists shouldn't be proportional to the number of CPUs
+  * ipc: document the new auto_msgmni proc file
+  * hp-wmi: update to match current rfkill semantics
+  * hp-wmi: add proper hotkey support
+  * tdfxfb: fix SDRAM memory size detection
+  * tdfxfb: fix frame buffer name overrun
+  * rtc_time_to_tm: fix signed/unsigned arithmetic
+  * ibft: fix target info parsing in ibft module
+  * sysfs: document files in /sys/firmware/sgi_uv/
+  * rtc-cmos: wake again from S5
+  * pm_qos_requirement might sleep
+  * drivers/char/random.c: fix a race which can lead to a bogus BUG()
+  * ipsec: Fix deadlock in xfrm_state management.
+  * [x86] Fix TSC calibration issues
+  * tipc: Don't use structure names which easily globally conflict.
+  * sparc64: Fix IPI call locking.
+  * [ARM] omap: fix gpio.c build error
+  * sparc64: Prevent sparc64 from invoking irq handlers on offline CPUs
+  * powerpc: Fix uninitialised variable in VSX alignment code
+  * powerpc: Only make kernel text pages of linear mapping executable
+  * powerpc: Make sure _etext is after all kernel text
+  * powerpc: Work around gcc's -fno-omit-frame-pointer bug
+  * powerpc: Fix build error with 64K pages and !hugetlbfs
+  * powerpc: Fix for getting CPU number in power_save_ppc32_restore()
+  * UBIFS: amend f_fsid
+  * net/usb/pegasus: avoid hundreds of diagnostics
+  * ixgbe: initialize interrupt throttle rate
+  * pcnet-cs, axnet_cs: add new IDs, remove dup ID with less info
+  * netxen: Remove workaround for chipset quirk
+  * Split up PIT part of TSC calibration from native_calibrate_tsc
+  * iwlwifi: W/A for the TSF correction in IBSS
+  * iwlwifi: fix hidden ssid discovery in passive channels
+  * iwlwifi: remove false rxon if rx chain changes
+  * iwlwifi: fix station mimo power save values
+  * iwlwifi: fix rx_chain computation
+  * iwlwifi: fix Tx cmd memory allocation failure handling
+  * iwlwifi: call apm stop on exit
+  * iwlwifi: fix STATUS_EXIT_PENDING is not set on pci_remove
+  * ath9k: Fix TX status reporting
+  * ath9k: Fix TX control flag use for no ACK and RTS/CTS
+  * V4L/DVB (8555): au8522: add mechanism to configure IF frequency for vsb
+    and qam
+  * V4L/DVB (8556): au0828: add support for Hauppauge Woodbury
+  * V4L/DVB (8598): au8522: clean up function au8522_set_if
+  * V4L/DVB (8599): au8522: remove if frequency settings from vsb/qam
+    modulation tables
+  * V4L/DVB (8600): au0828: explicitly set 6 MHz IF frequency in
+    hauppauge_hvr950q_config
+  * V4L/DVB (8629): v4l2-ioctl: do not try to handle private V4L1 ioctls
+  * V4L/DVB (8633): ivtv: update ivtv version number
+  * V4L/DVB (8648): ivtv: improve CC support
+  * V4L/DVB (8660): gspca: Simplify the scan of URB packets in pac7311.
+  * V4L/DVB (8661): gspca: Bug in the previous changeset about pac7311.
+  * V4L/DVB (8663): gspca: Webcam 0c45:6128 added in sonixj.
+  * V4L/DVB (8664): gspca: The bridge/sensor of the webcam 093a:2621 is a
+    PAC 7302.
+  * V4L/DVB (8665): gspca: Fix the 640x480 resolution of the webcam
+    093a:2621.
+  * V4L/DVB (8666): gspca: Bad scanning of frames in pac7311.
+  * V4L/DVB (8667): gspca: Bad probe of Z-Star/Vimicro webcams with pas106
+    sensor.
+  * V4L/DVB (8668): gspca: Conflict GSPCA / ET61X251 for the webcam
+    102c:6251.
+  * V4L/DVB (8669): gspca: Add white balance control for spca561 rev 012A.
+  * V4L/DVB (8671): gspca: Remove the unused field 'dev_name' of the device
+    structure.
+  * V4L/DVB (8672): gspca: Big rewrite of spca561.
+  * V4L/DVB (8673): gspca: Bad frame scanning again and bad init in
+    pac7311.
+  * V4L/DVB (8674): gspca: Webcam 0c45:612e added in sonixj.
+  * V4L/DVB (8675): gspca: Pixmap PJPG (Pixart 73xx JPEG) added, generated
+    by pac7311.
+  * V4L/DVB (8678): Remove the dead CONFIG_RADIO_MIROPCM20{,_RDS} code
+  * V4L/DVB (8681): v4l2-ioctl.c: fix warning
+  * V4L/DVB (8682): V4L: fix return value of register video func
+  * V4L/DVB (8701): cx18: Add missing lock for when the irq handler
+    manipulates the queues
+  * V4L/DVB (8703): gspca: Do controls work for spca561 revision 12a.
+  * V4L/DVB (8705): gspca: Adjust some control limits in spca561.
+  * V4L/DVB (8706): Make contrast and brightness work for pac7302.
+  * V4L/DVB (8707): gspca: Colors, hflip and vflip controls added for
+    pac7302.
+  * V4L/DVB (8709): gspca: Fix initialization and controls of sn9x110 -
+    ov7630.
+  * V4L/DVB (8710): gspca: Bad color control in sonixj.
+  * V4L/DVB (8711): gspca: Bad controls and quantization table of pac7311.
+  * V4L/DVB (8712): gspca: Bad start of sonixj webcams since changeset
+    a8779025e7e8.
+  * V4L/DVB (8713): gspca: Bad color control again in sonixj.
+  * V4L/DVB (8714): gspca: Bad start of sn9c110 and sensor om6802.
+  * V4L/DVB (8715): gspca: Change the name of some webcam in the gspca doc.
+  * V4L/DVB (8716): gspca: Bad start of sn9c110 and sensor ov7630.
+  * V4L/DVB (8717): gspca: Frame buffer too small for small resolutions
+    (sonixj and t613).
+  * V4L/DVB (8718): gspca: suspend/resume added.
+  * V4L/DVB (8719): gspca: Have VIDIOC_QUERYCTRL more compliant to the
+    spec.
+  * V4L/DVB (8720): gspca: V4L2_CAP_SENSOR_UPSIDE_DOWN added as a cap for
+    some webcams.
+  * V4L/DVB (8722): sms1xxx: fix typo in license header
+  * V4L/DVB (8726): link tuner before saa7134
+  * V4L/DVB (8727): V4L1: make PMS not autoprobe when builtin.
+  * V4L/DVB (8728): 1-make-pms-not-autoprobe-when-builtin update
+  * V4L/DVB (8749): Fix error code, when camera is not turned on by sonypi
+  * V4L/DVB (8750): V4L: check inval in video_register_device_index()
+  * V4L/DVB (8751): vivi: Fix some issues at vivi register routine
+  * V4L/DVB (8757): v4l-dvb: fix a bunch of sparse warnings
+  * V4L/DVB (8769): cx18: Simplify queue flush logic to prevent oops in
+    cx18_flush_queues()
+  * V4L/DVB (8778): radio: fix incorrect video_register_device result check
+  * V4L/DVB (8779): v4l: fix more incorrect video_register_device result
+    checks
+  * V4L/DVB (8790): saa7115: call i2c_set_clientdata only when state !=
+    NULL
+  * V4L/DVB (8803): s5h1409: Enable QAM_AUTO mode
+  * V4L/DVB (8804): s5h1411: Enable QAM_AUTO mode
+  * V4L/DVB (8805): Steven Toth email address change
+  * V4L/DVB (8809): gspca: Revert commit
+    9a9335776548d01525141c6e8f0c12e86bbde982
+  * V4L/DVB (8810): gspca: Compile error when CONFIG_PM not defined.
+  * V4L/DVB (8812): gspca: Do pac73xx webcams work.
+  * V4L/DVB (8813): gspca: Adjust SOF detection for pac73xx.
+  * V4L/DVB (8814): gspca: Set DISABLED the disabled controls at query
+    control time.
+  * V4L/DVB (8815): gspca: Fix problems with disabled controls.
+  * V4L/DVB (8816): gspca: Set disabled ctrls and fix a register pb with
+    ovxxxx in sonixb.
+  * V4L/DVB (8817): gspca: LED and proble changes in sonixb.
+  * V4L/DVB (8818): gspca: Reinitialize the device on resume.
+  * V4L/DVB (8819): gspca: Initialize the ov519 at open time and source
+    cleanup.
+  * V4L/DVB (8820): gspca: Change initialization and gamma of zc3xx -
+    pas106.
+  * V4L/DVB (8822): gspca: Change some subdriver functions for
+    suspend/resume.
+  * V4L/DVB (8823): gspca: H and V flips work for ov7670 only in ov519.
+  * V4L/DVB (8824): gspca: Too much code removed in the suspend/resume
+    changeset.
+  * V4L/DVB (8825): gspca: More controls for pac73xx and new webcam
+    093a:2624.
+  * V4L/DVB (8826): gspca: Webcam Labtec 2200 (093a:2626) added in pac7311.
+  * V4L/DVB (8827): gspca: Stop pac7302 autogain oscillation.
+  * V4L/DVB (8828): gspca: Set the clock at the end of initialization in
+    sonixj.
+  * V4L/DVB (8829): gspca: Have a clean kmalloc-ated buffer for USB
+    exchanges.
+  * V4L/DVB (8830): gspca: Move some probe code to the new init function.
+  * V4L/DVB (8831): gspca: Resolve webcam conflicts between some drivers.
+  * V4L/DVB (8832): gspca: Bad pixelformat of vc0321 webcams.
+  * V4L/DVB (8833): gspca: Cleanup the sonixb code.
+  * V4L/DVB (8834): gspca: Have a bigger buffer for sn9c10x compressed
+    images.
+  * V4L/DVB (8835): gspca: Same pixfmt as the sn9c102 driver and raw Bayer
+    added in sonixb.
+  * V4L/DVB (8837): dvb: fix I2C adapters name size
+  * V4L/DVB (8839): dib0700: add comment to identify 35th USB id pair
+  * V4L/DVB (8840): dib0700: add basic support for Hauppauge Nova-TD-500
+    (84xxx)
+  * V4L/DVB (8842): vivi_release(): fix use-after-free
+  * V4L/DVB (8843): tda10048_firmware_upload(): fix a memory leak
+  * V4L/DVB (8844): dabusb_fpga_download(): fix a memory leak
+  * bnx2x: Accessing un-mapped page
+  * SELinux: memory leak in security_context_to_sid_core
+  * x86: add io delay quirk for Presario F700
+  * mmap: fix petty bug in anonymous shared mmap offset handling
+  * x86: Change warning message in TSC calibration.
+  * PCI: fix pbus_size_mem() resource alignment for CardBus controllers
+  * [ARM] omap: fix build error in ohci-omap.c
+  * [ARM] remove unused #include <version.h>
+  * ACPI: Make Len Brown the ACPI maintainer again
+  * fujitsu-laptop: fix regression for P8010 in 2.6.27-rc
+  * ACPI: Avoid bogus timeout about SMbus check
+  * acer-wmi: remove debugfs entries upon unloading
+  * forgotten refcount on sysctl root table
+  * V4L/DVB (8868): gspca: Support for vga modes with sif sensors in
+    sonixb.
+  * V4L/DVB (8869): gspca: Move the Sonix webcams with TAS5110C1B from
+    sn9c102 to gspca.
+  * V4L/DVB (8870): gspca: Fix dark room problem with sonixb.
+  * V4L/DVB (8872): gspca: Bad image format and offset with rev072a of
+    spca561.
+  * V4L/DVB (8873): gspca: Bad image offset with rev012a of spca561 and
+    adjust exposure.
+  * V4L/DVB (8874): gspca: Adjust hstart for sn9c103/ov7630 and update
+    usb-id's.
+  * [ARM] omap: fix virtual vs physical address space confusions
+  * V4L/DVB (8876): budget: udelay changed to mdelay
+  * V4L/DVB (8877): b2c2 and bt8xx: udelay to mdelay
+  * V4L/DVB (8880): PATCH: Fix parents on some webcam drivers
+  * V4L/DVB (8881): gspca: After 'while (retry--) {...}', retry will be -1
+    but not 0.
+  * powerpc/spufs: Fix multiple get_spu_context()
+  * powerpc/spufs: Fix race for a free SPU
+  * Input: bcm5974 - small formatting cleanup
+  * Input: bcm5974 - improve finger tracking and counting
+  * Input: bcm5974 - add BTN_TOUCH event for mousedev benefit
+  * Input: i8042 - make Lenovo 3000 N100 blacklist entry more specific
+  * sh: resume_kernel fix for kernel oops built with CONFIG_BKL_PREEMPT=y.
+  * sh64: resume_kernel fix for kernel oops built with
+    CONFIG_BKL_PREEMPT=y.
+  * i2c: fix i2c-sh_mobile timing issues
+  * clockevents: prevent clockevent event_handler ending up handler_noop
+  * clockevents: prevent endless loop in periodic broadcast handler
+  * clockevents: enforce reprogram in oneshot setup
+  * clockevents: prevent multiple init/shutdown
+  * clockevents: prevent endless loop lockup
+  * HPET: make minimum reprogramming delta useful
+  * [MTD] [NAND] tmio_nand: fix base address programming
+  * Fix conditional export of kvh.h and a.out.h to userspace.
+  * async_tx: fix the bug in async_tx_run_dependencies
+  * sched_clock: fix NOHZ interaction
+  * sched: fix process time monotonicity
+  * UBIFS: fix division by zero
+  * UBIFS: make minimum fanout 3
+  * [MIPS] Fix data bus error recovery
+  * [MIPS] Fix WARNING: at kernel/smp.c:290
+  * [MIPS] TXx9: Fix txx9_pcode initialization
+  * [MIPS] TX39xx: Add missing local_flush_icache_range initialization
+  * [MIPS] Probe initrd header only if explicitly specified
+  * res_counter: fix off-by-one bug in setting limit
+  * forcedeth: fix kexec regression
+  * atmel_lcdfb: fix oops in rmmod when framebuffer fails to register
+  * tracehook: comment pasto fixes
+  * drivers/mmc/card/block.c: fix refcount leak in mmc_block_open()
+  * x86: boot: stub out unimplemented CPU feature words
+  * x86: add NOPL as a synthetic CPU feature bit
+  * x86: use X86_FEATURE_NOPL in alternatives
+  * clockevents: broadcast fixup possible waiters
+  * x86: HPET fix moronic 32/64bit thinko
+  * x86: HPET: read back compare register before reading counter
+  * Fix CONFIG_AC97_BUS dependency
+  * [ARM] 5241/1: provide ioremap_wc()
+  * ntp: fix calculation of the next jiffie to trigger RTC sync
+  * clocksource, acpi_pm.c: use proper read function also in errata mode
+  * clocksource, acpi_pm.c: check for monotonicity
+  * x86: delay early cpu initialization until cpuid is done
+  * x86: move mtrr cpu cap setting early in early_init_xxxx
+  * sched: arch_reinit_sched_domains() must destroy domains to force
+    rebuild
+  * x86, xen: Use native_pte_flags instead of native_pte_val for .pte_flags
+  * x86: pda_init(): fix memory leak when using CPU hotplug
+  * x86: cpu_init(): fix memory leak when using CPU hotplug
+  * powerpc/spufs: Fix possible scheduling of a context to multiple SPEs
+  * netfilter: nf_conntrack_sip: de-static helper pointers
+  * netfilter: nf_conntrack_gre: more locking around keymap list
+  * netfilter: nf_conntrack_gre: nf_ct_gre_keymap_flush() fixlet
+  * netfilter: nf_conntrack_irc: make sure string is terminated before
+    calling simple_strtoul
+  * pkt_sched: Fix qdisc state in net_tx_action()
+  * powerpc: Fix rare boot build breakage
+  * ahci, pata_marvell: play nicely together
+  * sata_mv: add RocketRaid 1720 PCI ID to driver
+  * ahci: disable PMP for marvell ahcis
+  * sata_nv: disable hardreset for generic
+  * libata-sff: kill spurious WARN_ON() in ata_hsm_move()
+  * pata_sil680: remove duplicate pcim_enable_device
+  * ahci: RAID mode SATA patch for Intel Ibex Peak DeviceIDs
+  * [MIPS] IP22: Fix detection of second HPC3 on Challenge S
+  * xen: fix 2.6.27-rc5 xen balloon driver warnings
+  * x86: disable static NOPLs on 32 bits
+  * netns : fix kernel panic in timewait socket destruction
+  * bridge: don't allow setting hello time to zero
+  * NFS: Restore missing hunk in NFS mount option parser
+  * usb: fix null deferences in low level usb serial
+  * Fix format of MAINTAINERS
+  * sparc64: Disable timer interrupts in fixup_irqs().
+  * [Bluetooth] Fix reference counting during ACL config stage
+  * [Bluetooth] Enforce correct authentication requirements
+  * [Bluetooth] Reject L2CAP connections on an insecure ACL link
+  * [S390] CVE-2008-1514: prevent ptrace padding area read/write in 31-bit
+    mode
+  * [S390] cio: Correct cleanup on error.
+  * [S390] cio: handle ssch() return codes correctly.
+  * [S390] cio: allow offline processing for disconnected devices
+  * ipsec: Restore larval states and socket policies in dump
+  * update Documentation/filesystems/Locking for 2.6.27 changes
+  * MAINTAINERS: add Atheros maintainer for atlx
+  * lib: Correct printk %pF to work on all architectures
+  * x86: fix memmap=exactmap boot argument
+  * clockevents: remove WARN_ON which was used to gather information
+  * ipv6: Fix OOPS in ip6_dst_lookup_tail().
+  * Linux 2.6.27-rc6
+
+ -- Ben Collins <ben.collins@canonical.com>  Tue, 02 Sep 2008 12:45:56 -0400
+
+linux (2.6.27-2.3) intrepid; urgency=low
+
+  [ Ben Collins ]
+
+  * build/retag: Make script save .orig of tags for later use
+  * ubuntu/lirc: Fix device_create call
+  * build/firmware: Put in-kernel firmware into version specific subdir
+    - LP: #262115
+  * Rebase on linux-2.6 git.
+  * ABI bump
+
+  [ Herton Ronaldo Krzesinski ]
+
+  * SAUCE: (no-up) Apparmor warning fixes
+
+  [ John Johansen ]
+
+  * SAUCE: (no-up) Proper AppArmor ptrace updates for newer lsm API
+
+  [ Mackenzie Morgan ]
+
+  * SAUCE: Add quirk for ASUS Z37E to make sound audible after resume
+    - LP: #25896
+
+ -- Ben Collins <ben.collins@canonical.com>  Wed, 27 Aug 2008 14:03:05 -0400
+
+linux (2.6.27-1.2) intrepid; urgency=low
+
+  [ Amit Kucheria ]
+
+  * SAUCE: make fc transport removal of target configurable
+  * SAUCE: pm: Config option to disable handling of console during
+    suspend/resume
+
+  [ Ben Collins ]
+
+  * SAUCE: Lower warning level of some PCI messages
+  * SAUCE: input/mouse/alps: Do not call psmouse_reset() for alps
+  * SAUCE: tulip: Let dmfe handle davicom on non-sparc
+  * SAUCE: tulip: Define ULI PCI ID's
+  * SAUCE: (no-up) version: Implement version_signature proc file.
+  * SAUCE: (no-up) connector.h: Add idx/val for drbd
+  * SAUCE: (no-up) swap: Add notify_swap_entry_free callback for compcache
+  * SAUCE: drivers: Remove some duplicate device entries in various modules
+  * SAUCE: (no-up) [AppArmor] merge with upstream subversion r1291
+  * SAUCE: apparmor: Update for changes to ptrace lsm hooks
+  * SAUCE: (no-up) Enable ubuntu extra subdirectory
+  * SAUCE: applesmc: Add MacBookAir
+  * SAUCE: (no-up) ACPI: initramfs DSDT override support
+  * ubuntu: Add drbd module
+  * ubuntu: Add iscsitarget module
+  * ubuntu: Add BOM for iscsitarget
+  * ubuntu: Add squashfs driver
+  * SAUCE: (no-up) Check for squashfs superblock in initramfs mounting.
+  * ubuntu: Add aufs module
+  * ubuntu: Added atl2 driver
+  * ubuntu: Added et131x driver
+  * ubuntu: Add dm-raid4-5 driver
+  * ubuntu: Add ndiswrapper driver
+  * ubuntu: Added ram backed compressed swap module (compcache)
+  * ubuntu: Add misc drivers from hardy lum
+  * ubuntu: Add heci driver 3.2.0.24
+  * ubuntu: Add ov511 and bt-sco drivers
+  * ubuntu: Add acx, prism2_usb wireless drivers
+  * ubuntu: Add at76 driver to build
+  * ubuntu: Add fsam7400 sw kill switch driver
+  * ubuntu: Added qc-usb driver
+  * ubuntu: e1000e: Upgraded module to 0.4.1.7
+  * ubuntu: Added rfkill drivers
+  * ubuntu: VIA - Add VIA DRM Chrome9 3D engine
+  * ubuntu: unionfs: Added v1.4 module from hardy
+  * ubuntu: Add LIRC driver
+  * ubuntu: Add GFS driver
+  * ubuntu: New tlsup driver for toshiba laptops
+  * Update config files
+  * build/d-i: Remove obsolete dm modules
+
+  [ Chuck Short ]
+
+  * SAUCE: ata: blacklist FUJITSU MHW2160BH PL
+
+  [ Colin Ian King ]
+
+  * ubuntu: Add dm-loop
+  * SAUCE: Enable speedstep for sonoma processors.
+
+  [ Dennis Noordsij ]
+
+  * SAUCE: Work around ACPI corruption upon suspend on some Dell machines.
+
+  [ Fabio M. Di Nitto ]
+
+  * SAUCE: Export gfs2 symbols required for gfs1 kernel module
+
+  [ Matthew Garrett ]
+
+  * SAUCE: hostap: send events on data interface as well as master
+    interface
+
+  [ Michael Frey (Senior Manager, MID ]
+
+  * SAUCE: Send HCI_RESET for Broadcomm 2046
+
+  [ Phillip Lougher ]
+
+  * SAUCE: r8169: disable TSO by default for RTL8111/8168B chipsets.
+
+  [ Stefan Bader ]
+
+  * SAUCE: (no-up) Export dm_disk function of device-mapper
+  * SAUCE: Restore VT fonts on switch
+  * SAUCE: mmc: Increase power_up deleay to fix TI readers
+
+  [ Tim Gardner ]
+
+  * SAUCE: Add extra headers to linux-libc-dev
+  * SAUCE: Catch nonsense keycodes and silently ignore
+  * SAUCE: Added support for HDAPS on various ThinkPads from Lenovo and IBM
+  * SAUCE: Guest OS does not recognize a lun with non zero target id on
+    Vmware ESX Server
+  * SAUCE: (no-up) Take care of orinoco_cs overlap with hostap_cs
+  * ubuntu: Add GNBD driver
+
+ -- Ben Collins <ben.collins@canonical.com>  Sat, 23 Aug 2008 15:48:35 -0400
+
+linux (2.6.27-0.0) intrepid; urgency=low
+
+  * Not uploaded, placeholder for new release
+
+ -- Ben Collins <ben.collins@canonical.com>  Sat, 23 Aug 2008 15:48:35 -0400
+
+linux (2.6.26-5.17) intrepid; urgency=low
+
+  [ Ben Collins ]
+
+  * build/abi: Add tosh_smm symbol to blacklist
+
+ -- Ben Collins <ben.collins@canonical.com>  Fri, 15 Aug 2008 09:29:34 -0400
+
+linux (2.6.26-5.16) intrepid; urgency=low
+
+  [ Ben Collins ]
+
+  * Revert "SAUCE: toshiba_acpi: Rewrote most of the proc entry bits."
+  * Revert "SAUCE: Update toshiba_acpi.c to version 0.19a"
+  * build/config: Disable in-kernel toshiba driver(s)
+  * ubuntu/tlsup: New driver for toshiba laptops
+  * build/config: Enable TLSUP driver
+  * SAUCE: e1000e: Fix E1000E_ENABLED logic to check for our E1000E_NEW
+    driver as well
+  * ubuntu/e1000e: Remove E1000E_ENABLED option in local config
+  * build/config: Update configs to have E1000E_ENABLED set
+  * ubuntu/prism2: Remove duplicate device
+
+  [ Fabio M. Di Nitto ]
+
+  * SAUCE: Export gfs2 symbols required for gfs1 kernel module
+
+  [ Stefan Bader ]
+
+  * SAUCE: x86: HPET rework for SB700
+    - LP: #255910
+
+  [ Tim Gardner ]
+
+  * Add GNBD driver
+  * Enable GNBD driver
+  * SAUCE: Add GFS driver
+  * SAUCE: Enable gfs driver configs
+  * b43: Linksys WMP54G (BCM4306/3) card in a PCI format has an SPROM
+    coding
+
+  [ Upstream Kernel Changes ]
+
+  * KVM: x86 emulator: emulate clflush
+  * USB: quirk PLL power down mode
+
+ -- Ben Collins <ben.collins@canonical.com>  Mon, 11 Aug 2008 13:19:28 -0400
+
+linux (2.6.26-5.15) intrepid; urgency=low
+
+  [ Ben Collins ]
+
+  * Revert "SAUCE: Add blacklist support to fix Belkin bluetooth dongle."
+    - Superceded by upstream changes.
+  * build/config: New option enabled for uvcvideo
+  * build/control: Add Vcs-Git meta data to control file
+  * SAUCE: toshiba_acpi: Rewrote most of the new code
+  * abi/perm-blacklist: Add emu10k1 driver to blacklist
+
+  [ Upstream Kernel Changes ]
+
+  * pxamci: trivial fix of DMA alignment register bit clearing
+  * udplite: Protection against coverage value wrap-around
+  * ipv6: use timer pending
+  * ipv6: __KERNEL__ ifdef struct ipv6_devconf
+  * hdlcdrv: Fix CRC calculation.
+  * quota: fix possible infinite loop in quota code
+  * isofs: fix minor filesystem corruption
+  * KVM: VMX: Fix a wrong usage of vmcs_config
+  * KVM: SVM: fix suspend/resume support
+  * KVM: mmu_shrink: kvm_mmu_zap_page requires slots_lock to be held
+  * KVM: VMX: Add ept_sync_context in flush_tlb
+  * KVM: x86 emulator: Fix HLT instruction
+  * KVM: MMU: nuke shadowed pgtable pages and ptes on memslot destruction
+  * KVM: MMU: Fix potential race setting upper shadow ptes on nonpae hosts
+  * Patch Upstream: x86 ptrace: fix PTRACE_GETFPXREGS error
+  * rcu: fix rcu_try_flip_waitack_needed() to prevent grace-period stall
+  * Fix typos from signal_32/64.h merge
+  * x86 reboot quirks: add Dell Precision WorkStation T5400
+  * USB: fix usb serial pm counter decrement for disconnected interfaces
+  * x86, suspend, acpi: enter Big Real Mode
+  * markers: fix duplicate modpost entry
+  * Fix build on COMPAT platforms when CONFIG_EPOLL is disabled
+  * proc: fix /proc/*/pagemap some more
+  * cpusets: fix wrong domain attr updates
+  * x86: fix crash due to missing debugctlmsr on AMD K6-3
+  * ide-cd: fix oops when using growisofs
+  * rtc-at91rm9200: avoid spurious irqs
+  * vmlinux.lds: move __attribute__((__cold__)) functions back into final
+    .text section
+  * ARM: fix fls() for 64-bit arguments
+  * tcp: Clear probes_out more aggressively in tcp_ack().
+  * sparc64: Fix lockdep issues in LDC protocol layer.
+  * sparc64: Fix cpufreq notifier registry.
+  * sparc64: Do not define BIO_VMERGE_BOUNDARY.
+  * iop-adma: fix platform driver hotplug/coldplug
+  * myri10ge: do not forget to setup the single slice pointers
+  * myri10ge: do not use mgp->max_intr_slots before loading the firmware
+  * ALSA: trident - pause s/pdif output
+  * V4L: cx18: Upgrade to newer firmware & update documentation
+  * DVB: dib0700: add support for Hauppauge Nova-TD Stick 52009
+  * V4L: uvcvideo: Fix a buffer overflow in format descriptor parsing
+  * V4L: uvcvideo: Use GFP_NOIO when allocating memory during resume
+  * V4L: uvcvideo: Don't free URB buffers on suspend
+  * V4L: uvcvideo: Make input device support optional
+  * V4L: uvcvideo: Add support for Medion Akoya Mini E1210 integrated
+    webcam
+  * V4L: saa7134: Copy tuner data earlier to avoid overwriting manual tuner
+    type
+  * V4L: cx23885: Bugfix for concurrent use of /dev/video0 and /dev/video1
+  * DVB: cx23885: Ensure PAD_CTRL is always reset to a sensible default
+  * DVB: cx23885: DVB Transport cards using DVB port VIDB/TS1 did not
+    stream
+  * DVB: cx23885: Reallocated the sram to avoid concurrent VIDB/C issues
+  * DVB: cx23885: SRAM changes for the 885 and 887 silicon parts
+  * x86: fix kernel_physical_mapping_init() for large x86 systems
+  * eCryptfs: use page_alloc not kmalloc to get a page of memory
+  * UML - Fix boot crash
+  * ixgbe: remove device ID for unsupported device
+  * mpc52xx_psc_spi: fix block transfer
+  * tmpfs: fix kernel BUG in shmem_delete_inode
+  * markers: fix markers read barrier for multiple probes
+  * VFS: increase pseudo-filesystem block size to PAGE_SIZE
+  * cpufreq acpi: only call _PPC after cpufreq ACPI init funcs got called
+    already
+  * b43legacy: Release mutex in error handling code
+  * ath5k: don't enable MSI, we cannot handle it yet
+  * Fix off-by-one error in iov_iter_advance()
+  * Linux 2.6.26.1
+  * ftrace: remove unneeded documentation
+  * romfs_readpage: don't report errors for pages beyond i_size
+  * netfilter: nf_nat_sip: c= is optional for session
+  * SCSI: bsg: fix bsg_mutex hang with device removal
+  * x86: idle process - add checking for NULL early param
+  * x86: io delay - add checking for NULL early param
+  * Close race in md_probe
+  * Kprobe smoke test lockdep warning
+  * netfilter: xt_time: fix time's time_mt()'s use of do_div()
+  * linear: correct disk numbering error check
+  * SCSI: ch: fix ch_remove oops
+  * NFS: Ensure we zap only the access and acl caches when setting new acls
+  * jbd: fix race between free buffer and commit transaction
+  * Input: i8042 - add Intel D845PESV to nopnp list
+  * Input: i8042 - add Gericom Bellagio to nomux blacklist
+  * Input: i8042 - add Acer Aspire 1360 to nomux blacklist
+  * Bluetooth: Signal user-space for HIDP and BNEP socket errors
+  * Add compat handler for PTRACE_GETSIGINFO
+  * ALSA: hda - Fix wrong volumes in AD1988 auto-probe mode
+  * ALSA: hda - Fix DMA position inaccuracy
+  * ALSA: hda - Add missing Thinkpad Z60m support
+  * ALSA: emu10k1 - Fix inverted Analog/Digital mixer switch on Audigy2
+  * vfs: fix lookup on deleted directory
+  * Ath5k: fix memory corruption
+  * Ath5k: kill tasklets on shutdown
+  * sound: ensure device number is valid in snd_seq_oss_synth_make_info
+  * Linux 2.6.26.2
+
+ -- Ben Collins <ben.collins@canonical.com>  Sun, 03 Aug 2008 13:25:02 -0400
+
+linux (2.6.26-5.14) intrepid; urgency=low
+
+  [ Ben Collins ]
+
+  * SAUCE: applesmc: Add MacBookAir
+  * build: Do not build ddeb unless we are on the buildd
+  * build: control: Consistency in arch fields.
+  * SAUCE: Update toshiba_acpi.c to version 0.19a
+    - LP: #77026
+  * build: Added perm blacklist support and per-module support to abi-check
+    - Blacklist p80211 module from abi checks
+  * ubuntu/lirc: Get rid of drivers symlink and use real include stuff
+
+
+  [ Colin Ian King ]
+
+  * SAUCE: acerhk module - add support for Amilo A1650g keyboard
+    - LP: #84159
+  * SAUCE: rt2x00: Fix OOPS on failed creation of rt2x00lib workqueue
+    - LP: #249242
+
+  [ Mario Limonciello ]
+
+  * Add LIRC back in
+
+  [ Tim Gardner ]
+
+  * Makefile race condition can lead to ndiswrapper build failure
+    - LP: #241547
+  * update linux-wlan-ng (prism2_usb) to upstream version 1861
+    - LP: #245026
+
+  [ Upstream Kernel Changes ]
+
+  * Fix typos from signal_32/64.h merge
+
+ -- Ben Collins <ben.collins@canonical.com>  Fri, 01 Aug 2008 00:05:01 -0400
+
+linux (2.6.26-5.13) intrepid; urgency=low
+
+  [ Ben Collins ]
+
+  * build: Make makedumpfile an amd64/i386 only build-dep
+  * ubuntu/acerhk: Fixup assembly to compile with newer binutils
+
+ -- Ben Collins <ben.collins@canonical.com>  Sat, 26 Jul 2008 16:41:50 -0400
+
+linux (2.6.26-4.12) intrepid; urgency=low
+
+  [ Ben Collins ]
+
+  * e1000e: Upgraded module to 0.4.1.7 upstream. Placed in ubuntu/,
+    in-kernel driver disabled
+  * config: Disable e1000e in-kernel, and enable newer driver in ubuntu/
+  * rfkill: Update to 1.3 drivers, and move to common location
+  * ubuntu: Actually link kconfig/kbuild into rfkill subdir
+  * config: Enable loading dsdt from initramfs
+    - LP: #246222
+  * ubuntu: [compcache] Update to fix crashes in improper BUG()
+  * build: Create a retag scripts to recover tags from rebases
+  * build: Updates for dbg pkg
+  * build: Make sure no empty lines show up in debian/files
+  * ubuntu: atl1e: Add new driver from 2.6.27-pre-rc1
+    - LP: #243894
+  * sys_getcwd: Fix some brokeness introduced by AppArmor __d_path
+    changes
+    - LP: #251223
+  * ubuntu: unionfs: Added v1.4 module from hardy
+  * build: Add sub-flavour infrastructure, and virtual subflav
+
+  [ Eric Piel ]
+
+  * ACPI: Allow custom DSDT tables to be loaded from initramfs
+
+  [ Kees Cook ]
+
+  * AppArmor: Smack VFS patches
+
+  [ Mario Limonciello ]
+
+  * Work around ACPI corruption upon suspend on some Dell machines.
+    - LP: #183033
+
+  [ Tim Gardner ]
+
+  * Export usbhid_modify_dquirk for LBM module bcm5974
+    - LP: #250838
+  * VIA - Add VIA DRM Chrome9 3D engine
+    - LP: #251862
+  * Define TRUE/FALSE for VIA DRM driver.
+
+ -- Ben Collins <ben.collins@canonical.com>  Tue, 15 Jul 2008 12:51:39 -0400
+
+linux (2.6.26-4.11) intrepid; urgency=low
+
+  [ Ben Collins ]
+
+  * config: Enable bcm5974 driver in all configs
+
+  [ 2.6.26-4.10 ]
+
+  [ Amit Kucheria ]
+
+  * Fix typo in GSPCA Makefile and make it compile
+
+  [ Ben Collins ]
+
+  * ubuntu: Remove UVC driver in favor of in-kernel one (-rc9)
+  * config: Updates for -rc9
+  * ubuntu: Add acx, prism2_usb wireless drivers
+  * config: Enable prism2_usb and acx drivers.
+  * ubuntu: Add at76 driver to build
+  * config: Enable at76_usb driver.
+  * iscsitarget: Fix prototype for bi_end_io callback.
+  * acx: Fix section type mismatch warnings
+  * fsam7400: Add sw kill switch driver
+  * config: Enable fsam7400 driver
+  * qc-usb: Added new driver
+  * config: Enable qc-usb driver
+  * drbd: Remove built-in connector usage
+  * drbd: Do not define idx/val for connector here
+  * connector.h: Add idx/val for drbd
+  * bcm5974: Added new driver
+
+  [ Kees Cook ]
+
+  * SAUCE: [AppArmor] merge with upstream subversion r1291
+  * SAUCE: [AppArmor] fix typo in selinux_inode_link
+  * SAUCE: [AppArmor] aufs patches
+
+  [ Michael Frey (Senior Manager, MID ]
+
+  * SAUCE: Send HCI_RESET for Broadcomm 2046
+    - LP: #241749
+
+  [ Tim Gardner ]
+
+  * SAUCE: Medion Akoya Mini E1210
+
+  [ Upstream Kernel Changes ]
+
+  * Revert "BAST: Remove old IDE driver"
+  * ARM: OMAP: DMA: Don't mark channel active in omap_enable_channel_irq
+  * ARM: OMAP: Correcting the gpmc prefetch control register address
+  * debugobjects: fix lockdep warning
+  * [ARM] 5115/1: pxafb: fix ifdef for command line option handling
+  * [ARM] 5116/1: pxafb: cleanup and fix order of failure handling
+  * [ARM] 5109/1: Mark rtc sa1100 driver as wakeup source before
+    registering it
+  * [ARM] Export dma_sync_sg_for_device()
+  * fix cgroup-inflicted breakage in block_dev.c
+  * [patch for 2.6.26 2/4] vfs: utimensat(): be consistent with utime() for
+    immutable and append-only files
+  * [patch for 2.6.26 1/4] vfs: utimensat(): ignore tv_sec if tv_nsec ==
+    UTIME_OMIT or UTIME_NOW
+  * [patch for 2.6.26 3/4] vfs: utimensat(): fix error checking for
+    {UTIME_NOW,UTIME_OMIT} case
+  * [patch for 2.6.26 4/4] vfs: utimensat(): fix write access check for
+    futimens()
+  * [patch 1/4] vfs: path_{get,put}() cleanups
+  * [patch 2/4] fs: make struct file arg to d_path const
+  * [patch 3/4] vfs: fix ERR_PTR abuse in generic_readlink
+  * [patch 4/4] flock: remove unused fields from file_lock_operations
+  * [patch 3/3] vfs: make d_path() consistent across mount operations
+  * [patch 1/3] vfs: dcache sparse fixes
+  * [patch 2/3] vfs: dcache cleanups
+  * udf: Fix regression in UDF anchor block detection
+  * [SCSI] ses: Fix timeout
+  * netfilter: ip6table_mangle: don't reroute in LOCAL_IN
+  * [SCSI] esp: Fix OOPS in esp_reset_cleanup().
+  * kernel/audit.c: nlh->nlmsg_type is gotten more than once
+  * audit: fix kernel-doc parameter notation
+  * remove useless argument type in audit_filter_user()
+  * Blackfin arch: fix bug - kernel boot fails when Spinlock and rw-lock
+    debugging enabled
+  * Blackfin arch: fix up section mismatch warning
+  * mac80211: implement EU regulatory domain
+  * b43: Do not return TX_BUSY from op_tx
+  * b43legacy: Do not return TX_BUSY from op_tx
+  * b43: Fix possible MMIO access while device is down
+  * b43legacy: Fix possible NULL pointer dereference in DMA code
+  * rt2x00: Fix unbalanced mutex locking
+  * iwlwifi: improve scanning band selection management
+  * [SCSI] esp: tidy up target reference counting
+  * [ARM] 5117/1: pxafb: fix __devinit/exit annotations
+  * thermal: Create CONFIG_THERMAL_HWMON=n
+  * ACPI: don't walk tables if ACPI was disabled
+  * dock: bay: Don't call acpi_walk_namespace() when ACPI is disabled.
+  * x86: shift bits the right way in native_read_tscp
+  * x86: section/warning fixes
+  * V4L/DVB (8004): Fix INPUT dependency at budget-ci
+  * V4L/DVB (8005): Fix OOPS if frontend is null
+  * V4L/DVB (8007): cx18/cx25840: the S-Video LUMA input can use all
+    In1-In8 inputs
+  * V4L/DVB (8008): cx18: remove duplicate audio and video input enums
+  * V4L/DVB (8010): em28xx: Properly register extensions for already
+    attached devices
+  * V4L/DVB (8011): em28xx: enable DVB for HVR-900
+  * V4L/DVB (8012): gl861: sleep a little to avoid I2C errors
+  * V4L/DVB (8013): gl861: remove useless identify_state
+  * V4L/DVB (8015): gl861: replace non critical msleep(0) with msleep(1) to
+    be on the safe side
+  * V4L/DVB (8017): Ensure em28xx extensions only get run against devs that
+    support them
+  * V4L/DVB (8018): Add em2860 chip ID
+  * V4L/DVB (8020): Fix callbacks functions of saa7134_empress
+  * V4L/DVB (8022): saa7134: fix race between opening and closing the
+    device
+  * V4L/DVB (8026): Avoids an OOPS if dev struct can't be successfully
+    recovered
+  * V4L/DVB (8027): saa7134: Avermedia A700: only s-video and composite
+    input are working
+  * V4L/DVB (8028): Improve error messages for tda1004x attach
+  * V4L/DVB (8029): Improve error message at tda1004x_attach
+  * V4L/DVB (8034): tda18271: fix IF notch frequency handling
+  * V4L/DVB (8035): tda18271: dont touch EB14 if rf_cal lookup is out of
+    range
+  * V4L/DVB (8036): tda18271: toggle rf agc speed mode on TDA18271HD/C2
+    only
+  * V4L/DVB (8037): tda18271: ensure that the thermometer is off during
+    channel configuration
+  * V4L/DVB (8039): pxa-camera: fix platform_get_irq() error handling.
+  * V4L/DVB (8040): soc-camera: remove soc_camera_host_class class
+  * V4L/DVB (8042): DVB-USB UMT-010 channel scan oops
+  * V4L/DVB (8043): au0828: add support for additional USB device id's
+  * V4L/DVB (8044): au8522: tuning optimizations
+  * V4L/DVB (8048): saa7134: Fix entries for Avermedia A16d and Avermedia
+    E506
+  * V4L/DVB (8061): cx18: only select tuner / frontend modules if
+    !DVB_FE_CUSTOMISE
+  * V4L/DVB (8063): cx18: Fix unintended auto configurations in
+    cx18-av-core
+  * V4L/DVB (8066): cx18: Fix audio mux input definitions for HVR-1600 Line
+    In 2 and FM radio
+  * V4L/DVB (8067): cx18: Fix firmware load for case when digital capture
+    happens first
+  * V4L/DVB (8068): cx18: Add I2C slave reset via GPIO upon initialization
+  * V4L/DVB (8069): cx18: Fix S-Video and Compsite inputs for the Yuan
+    MPC718 and enable card entry
+  * V4L/DVB (8071): tda10023: Fix possible kernel oops during
+    initialisation
+  * V4L/DVB (8073): av7110: Catch another type of ARM crash
+  * V4L/DVB (8074): av7110: OSD transfers should not be interrupted
+  * V4L/DVB (8075): stv0299: Uncorrected block count and bit error rate
+    fixed
+  * V4L/DVB (8092): videodev: simplify and fix standard enumeration
+  * V4L/DVB (8096): au8522: prevent false-positive lock status
+  * V4L/DVB (8097): xc5000: check device hardware state to determine if
+    firmware download is needed
+  * V4L/DVB (8100): V4L/vivi: fix possible memory leak in vivi_fillbuff
+  * V4L/DVB (8108): Fix open/close race in saa7134
+  * s2io: fix documentation about intr_type
+  * tc35815: Mark carrier-off before starting PHY
+  * tc35815: Fix receiver hangup on Rx FIFO overflow
+  * ixgbe: fix EEH recovery during reset on PPC
+  * igb: fix EEH recovery during reset on PPC
+  * e1000e: fix EEH recovery during reset on PPC
+  * pcnet_cs, axnet_cs: clear bogus interrupt before request_irq
+  * drivers/net/r6040.c: Eliminate double sizeof
+  * ipg: fix jumbo frame compilation
+  * ipg: use NULL, not zero, for pointers
+  * [netdrvr] 3c59x: remove irqs_disabled warning from local_bh_enable
+  * [netdrvr] netxen: fix netxen_pci_tbl[] breakage
+  * e100: Do pci_dma_sync after skb_alloc for proper operation on ixp4xx
+  * e1000: only enable TSO6 via ethtool when using correct hardware
+  * [netdrvr] Fix IOMMU overflow checking in s2io.c
+  * qla3xxx: Hold RTNL while calling dev_close()
+  * Hold RTNL while calling dev_close()
+  * sata_uli: hardreset is broken
+  * rt2x00: Fix lock dependency errror
+  * prism: islpci_eth.c endianness fix
+  * mac80211: fix an oops in several failure paths in key allocation
+  * firewire: fw-sbp2: fix parsing of logical unit directories
+  * kbuild: fix a.out.h export to userspace with O= build.
+  * Ensure interrupted recovery completed properly (v1 metadata plus
+    bitmap)
+  * Don't acknowlege that stripe-expand is complete until it really is.
+  * Fix error paths if md_probe fails.
+  * hamradio: remove unused variable
+  * tcp: calculate tcp_mem based on low memory instead of all memory
+  * tcp: fix for splice receive when used with software LRO
+  * af_unix: fix 'poll for write'/connected DGRAM sockets
+  * netdevice: Fix typo of dev_unicast_add() comment
+  * pkt_sched: ERR_PTR() ususally encodes an negative errno, not positive.
+  * pkt_sched: Remove CONFIG_NET_SCH_RR
+  * include/linux/netdevice.h: don't export MAX_HEADER to userspace
+  * tcp: /proc/net/tcp rto,ato values not scaled properly (v2)
+  * netlink: Fix some doc comments in net/netlink/attr.c
+  * CONNECTOR: add a proc entry to list connectors
+  * inet fragments: fix race between inet_frag_find and
+    inet_frag_secret_rebuild
+  * net/inet_lro: remove setting skb->ip_summed when not LRO-able
+  * netlabel: Fix a problem when dumping the default IPv6 static labels
+  * ipv6 route: Convert rt6_device_match() to use RT6_LOOKUP_F_xxx flags.
+  * sched: fix cpu hotplug
+  * Fix and clean top .gitignore
+  * x86: fix cpu hotplug crash
+  * ptrace GET/SET FPXREGS broken
+  * Input: add KEY_MEDIA_REPEAT definition
+  * Input: fix locking in force-feedback core
+  * [ARM] 5131/1: Annotate platform_secondary_init with trace_hardirqs_off
+  * ide: fix /proc/ide/ide?/mate reporting
+  * netfilter: nf_conntrack_tcp: fixing to check the lower bound of valid
+    ACK
+  * textsearch: fix Boyer-Moore text search bug
+  * hostap: don't report useless WDS frames by default
+  * hostap: fix sparse warnings
+  * mac80211: don't accept WEP keys other than WEP40 and WEP104
+  * V4L/DVB (8145a): USB Video Class driver
+  * [IA64] Bugfix for system with 32 cpus
+  * [IA64] export account_system_vtime
+  * sched: fix divide error when trying to configure rt_period to zero
+  * x86: fix NODES_SHIFT Kconfig range
+  * block: Fix the starving writes bug in the anticipatory IO scheduler
+  * Properly notify block layer of sync writes
+  * rcu: fix hotplug vs rcu race
+  * I2C: S3C2410: Check ACK on byte transmission
+  * I2C: S3C2410: Fixup error codes returned rom a transfer.
+  * I2C: S3C2410: Add MODULE_ALIAS() for s3c2440 device.
+  * PCI: Restrict VPD read permission to root
+  * powerpc/bootwrapper: update for initrd with simpleImage
+  * i2c: Documentation: fix device matching description
+  * i2c: Fix bad hint about irqs in i2c.h
+  * powerpc/legacy_serial: Bail if reg-offset/shift properties are present
+  * powerpc/mpc5200: Fix lite5200b suspend/resume
+  * ipv4: fix sysctl documentation of time related values
+  * net-sched: change tcf_destroy_chain() to clear start of filter list
+  * net-sched: fix filter destruction in atm/hfsc qdisc destruction
+  * netlink: Unneeded local variable
+  * net: Tyop of sk_filter() comment
+  * netdevice: Fix wrong string handle in kernel command line parsing
+  * net: fib_rules: fix error code for unsupported families
+  * dm crypt: use cond_resched
+  * V4L/DVB (8178): uvc: Fix compilation breakage for the other drivers, if
+    uvc is selected
+  * PCI: Limit VPD read/write lengths for Broadcom 5706, 5708, 5709 rev.
+  * PCI: acpiphp: cleanup notify handler on all root bridges
+  * drivers/input/ff-core.c needs <linux/sched.h>
+  * DRM/i915: only use tiled blits on 965+
+  * tty: Fix inverted logic in send_break
+  * x86: fix Intel Mac booting with EFI
+  * arch/x86/mm/init_64.c: early_memtest(): fix types
+  * 9p: fix O_APPEND in legacy mode
+  * slub: Do not use 192 byte sized cache if minimum alignment is 128 byte
+  * Do not overwrite nr_zones on !NUMA when initialising zlcache_ptr
+  * [MIPS] IP32: Fix unexpected irq 71
+  * [MIPS] IP22: Fix crashes due to wrong L1_CACHE_BYTES
+  * [MIPS] cevt-txx9: Reset timer counter on initialization
+  * hrtimer: prevent migration for raising softirq
+  * svcrpc: fix handling of garbage args
+  * OHCI: Fix problem if SM501 and another platform driver is selected
+  * USB: fix cdc-acm resume()
+  * USB: ehci - fix timer regression
+  * USB: ohci - record data toggle after unlink
+  * USB: mass storage: new id for US_SC_CYP_ATACB
+  * sisusbvga: Fix oops on disconnect.
+  * USB: New device ID for ftdi_sio driver
+  * USB: fix interrupt disabling for HCDs with shared interrupt handlers
+  * USB: don't lose disconnections during suspend
+  * USB: another option device id
+  * USB: add a pl2303 device id
+  * USB: fix Oops on loading ipaq module since 2.6.26
+  * USB: adding comment for ipaq forcing number of ports
+  * [MIPS] Fix bug in atomic_sub_if_positive.
+  * xen: fix address truncation in pte mfn<->pfn conversion
+  * sata_sil24: add DID for another adaptec flavor
+  * ahci: always clear all bits in irq_stat
+  * libata-sff: improve HSM violation reporting
+  * sata_mv: safer logic for limit_warnings
+  * Update maintainers for powerpc
+  * Christoph has moved
+  * mm: dirty page accounting vs VM_MIXEDMAP
+  * rtc: rtc_read_alarm() handles wraparound
+  * firmware: fix the request_firmware() dummy
+  * serial: fix serial_match_port() for dynamic major tty-device numbers
+  * get_user_pages(): fix possible page leak on oom
+  * rtc-x1205: Fix alarm set
+  * rtc: fix CMOS time error after writing /proc/acpi/alarm
+  * pci: VT3336 can't do MSI either
+  * Miguel Ojeda has moved
+  * ext3: add missing unlock to error path in ext3_quota_write()
+  * ext4: add missing unlock to an error path in ext4_quota_write()
+  * reiserfs: add missing unlock to an error path in reiserfs_quota_write()
+  * ecryptfs: remove unnecessary mux from ecryptfs_init_ecryptfs_miscdev()
+  * lib: taint kernel in common report_bug() WARN path.
+  * gpio: pca953x (i2c) handles max7310 too
+  * fsl_diu_fb: fix build with CONFIG_PM=y, plus fix some warnings
+  * Update taskstats-struct document for scaled time accounting
+  * cciss: fix regression that no device nodes are created if no logical
+    drives are configured.
+  * delay accounting: maintainer update
+  * Doc*/kernel-parameters.txt: fix stale references
+  * hdaps: add support for various newer Lenovo thinkpads
+  * mn10300: export certain arch symbols required to build allmodconfig
+  * mn10300: provide __ucmpdi2() for MN10300
+  * Introduce rculist.h
+  * man-pages is supported
+  * ntfs: update help text
+  * add kernel-doc for simple_read_from_buffer and memory_read_from_buffer
+  * w100fb: do not depend on SHARPSL
+  * w100fb: add 80 MHz modeline
+  * MFD maintainer
+  * cgroups: document the effect of attaching PID 0 to a cgroup
+  * spi: fix the read path in spidev
+  * doc: doc maintainers
+  * security: filesystem capabilities: fix fragile setuid fixup code
+  * security: filesystem capabilities: fix CAP_SETPCAP handling
+  * Alpha Linux kernel fails with inconsistent kallsyms data
+  * cpusets: document proc status cpus and mems allowed lists
+  * MAINTAINERS: update the email address of Andreas Dilger
+  * cciss: read config to obtain max outstanding commands per controller
+  * olpc: sdhci: add quirk for the Marvell CaFe's vdd/powerup issue
+  * olpc: sdhci: add quirk for the Marvell CaFe's interrupt timeout
+  * cpumask: introduce new APIs
+  * mm: switch node meminfo Active & Inactive pages to Kbytes
+  * Update MAINTAINERS file for the TPM device driver
+  * devcgroup: fix odd behaviour when writing 'a' to devices.allow
+  * doc: document the relax_domain_level kernel boot argument
+  * mmc: don't use DMA on newer ENE controllers
+  * mempolicy: mask off internal flags for userspace API
+  * x86 ACPI: normalize segment descriptor register on resume
+  * x86 ACPI: fix resume from suspend to RAM on uniprocessor x86-64
+  * softlockup: print a module list on being stuck
+  * ide: fix hwif->gendev refcounting
+  * ide: ide_unregister() warm-plug bugfix
+  * ide: ide_unregister() locking bugfix
+  * ahci: give another shot at clearing all bits in irq_stat
+  * Fix clear_refs_write() use of struct mm_walk
+  * Move _RET_IP_ and _THIS_IP_ to include/linux/kernel.h
+  * Fix pagemap_read() use of struct mm_walk
+  * Linux 2.6.26-rc9
+  * Revert "USB: don't explicitly reenable root-hub status interrupts"
+  * Revert "PCI: Correct last two HP entries in the bfsort whitelist"
+  * iwlwifi: fix incorrect 5GHz rates reported in monitor mode
+  * iwlwifi: drop skb silently for Tx request in monitor mode
+  * libertas: support USB persistence on suspend/resume (resend)
+  * tcp: net/ipv4/tcp.c needs linux/scatterlist.h
+  * tcp: fix a size_t < 0 comparison in tcp_read_sock
+  * bridge: fix use-after-free in br_cleanup_bridges()
+  * Add missing skb->dev assignment in Frame Relay RX code
+  * forcedeth: fix lockdep warning on ethtool -s
+  * ehea: fix might sleep problem
+  * ehea: add MODULE_DEVICE_TABLE
+  * ehea: fix race condition
+  * ehea: Access iph->tot_len with correct endianness
+  * pasemi_mac: Access iph->tot_len with correct endianness
+  * ibm_newemac: Fixes kernel crashes when speed of cable connected changes
+  * ibm_newemac: Fixes entry of short packets
+  * fs_enet: restore promiscuous and multicast settings in restart()
+  * can: add sanity checks
+  * x86: KVM guest: Add memory clobber to hypercalls
+  * KVM: IOAPIC: Fix level-triggered irq injection hang
+  * [SCSI] erase invalid data returned by device
+  * pxamci: fix byte aligned DMA transfers
+  * vsprintf: split out '%s' handling logic
+  * vsprintf: split out '%p' handling logic
+  * vsprintf: add infrastructure support for extended '%p' specifiers
+  * vsprintf: add support for '%pS' and '%pF' pointer formats
+  * powerpc: Fix unterminated of_device_id array in legacy_serial.c
+  * [UML] fix gcc ICEs and unresolved externs
+  * ocfs2/dlm: Fixes oops in dlm_new_lockres()
+  * hostap_cs: correct poor NULL checks in suspend/resume routines
+  * drivers/net/wireless/iwlwifi/iwl-3945.c Fix type issue on 64bit
+  * mac80211: move netif_carrier_on to after
+    ieee80211_bss_info_change_notify
+  * mac80211: Only flush workqueue when last interface was removed
+  * zd1211rw: add ID for AirTies WUS-201
+  * ssb-pcicore: Fix IRQ-vector init on embedded devices
+  * mac80211: don't report selected IBSS when not found
+  * crypto: tcrypt - Fix memory leak in test_cipher
+  * sctp: Mark the tsn as received after all allocations finish
+  * [S390] protect _PAGE_SPECIAL bit against mprotect
+  * irda: via-ircc proper dma freeing
+  * irda: New device ID for nsc-ircc
+  * irda: Fix netlink error path return value
+  * [SCSI] mptspi: fix oops in mptspi_dv_renegotiate_work()
+  * Correct hash flushing from huge_ptep_set_wrprotect()
+  * ide: add __ide_default_irq() inline helper
+  * palm_bk3710: fix IDECLK period calculation
+  * it8213: fix return value in it8213_init_one()
+  * [MIPS] Atlas, decstation: Fix section mismatches triggered by
+    defconfigs
+  * [MIPS] Fix 32bit kernels on R4k with 128 byte cache line size
+  * NFS: Fix readdir cache invalidation
+  * SUNRPC: Fix a double-free in rpcbind
+  * SUNRPC: Fix an rpcbind breakage for the case of IPv6 lookups
+  * reiserfs: discard prealloc in reiserfs_delete_inode
+  * Fix broken fix for fsl-diu-db
+  * RDMA/cxgb3: Fix regression caused by class_device -> device conversion
+  * ipv6: fix race between ipv6_del_addr and DAD timer
+  * sctp: Add documentation for sctp sysctl variable
+  * kernel/printk.c: Made printk_recursion_bug_msg static.
+  * powerpc: Add missing reference to coherent_dma_mask
+  * rc80211_pid: Fix fast_start parameter handling
+  * rt2x00: Disable synchronization during initialization
+  * zd1211rw: stop beacons on remove_interface
+  * libertas: fix memory alignment problems on the blackfin
+  * netfilter: nf_conntrack_tcp: fix endless loop
+  * netfilter: nf_nat_snmp_basic: fix a range check in NAT for SNMP
+  * md: ensure all blocks are uptodate or locked when syncing
+  * sched: fix cpu hotplug
+  * x86: fix /dev/mem compatibility under PAT
+  * crypto: chainiv - Invoke completion function
+  * ocfs2: Fix flags in ocfs2_file_lock
+  * kernel/kprobes.c: Made kprobe_blacklist static.
+  * arch/x86/kernel/.gitignore: Added vmlinux.lds to .gitignore file
+    because it shouldn't be tracked.
+  * ftrace: Documentation
+  * Fix PREEMPT_RCU without HOTPLUG_CPU
+  * sched: fix cpu hotplug, cleanup
+  * exec: fix stack excutability without PT_GNU_STACK
+  * slub: Fix use-after-preempt of per-CPU data structure
+  * Documentation: clarify tcp_{r,w}mem sysctl docs
+  * ip: sysctl documentation cleanup
+  * tcp: correct kcalloc usage
+  * ipv4: fib_trie: Fix lookup error return
+  * netlabel: netlink_unicast calls kfree_skb on error path by itself
+  * ipv6: missed namespace context in ipv6_rthdr_rcv
+  * xfrm: Add a XFRM_STATE_AF_UNSPEC flag to xfrm_usersa_info
+  * tun: Persistent devices can get stuck in xoff state
+  * tpm: add Intel TPM TIS device HID
+  * rapidio: fix device reference counting
+  * Fix name of Russell King in various comments
+  * rtc: fix reported IRQ rate for when HPET is enabled
+  * libata-acpi: filter out DIPM enable
+  * Added Targa Visionary 1000 IDE adapter to pata_sis.c
+  * libata-acpi: don't call sleeping function from invalid context
+  * Fix reference counting race on log buffers
+  * [SCSI] ipr: Fix HDIO_GET_IDENTITY oops for SATA devices
+  * IPMI: return correct value from ipmi_write
+  * x86: fix ldt limit for 64 bit
+  * [SCSI] fusion: default MSI to disabled for SPI and FC controllers
+  * [SCSI] bsg: fix oops on remove
+  * drivers/char/pcmcia/ipwireless/hardware.c fix resource leak
+  * drivers/isdn/i4l/isdn_common.c fix small resource leak
+  * fbdev: bugfix for multiprocess defio
+  * serial8250: sanity check nr_uarts on all paths.
+  * ov7670: clean up ov7670_read semantics
+  * rtc-fm3130: fix chip naming
+  * rtc-pcf8563: add chip id
+  * OProfile kernel maintainership changes
+  * frv: fix irqs_disabled() to return an int, not an unsigned long
+  * cifs: fix inode leak in cifs_get_inode_info_unix
+  * cifs: fix wksidarr declaration to be big-endian friendly
+  * cpusets, hotplug, scheduler: fix scheduler domain breakage
+  * Documentation/HOWTO: correct wrong kernel bugzilla FAQ URL
+  * devcgroup: always show positive major/minor num
+  * devcgroup: fix permission check when adding entry to child cgroup
+  * Linux 2.6.26
+
+ -- Ben Collins <ben.collins@canonical.com>  Mon, 14 Jul 2008 13:41:50 -0400
+
+linux (2.6.26-3.9) intrepid; urgency=low
+
+  * abi: Add dca and ioatdma to modules.ignore
+
+  [ 2.6.26-3.8 ]
+
+  [ Ben Collins ]
+
+  * ubuntu: Add heci driver 3.2.0.24
+  * ubuntu: Add heci to kconfig/kbuild
+  * config: Enable heci module on all flavours
+  * dm-bbr: Update to get it to compile with 2.6.26
+  * config: Enable dm-bbr
+  * ubuntu: Add some media drivers
+  * config: Enable misc media drivers
+  * udeb: Switch to uvesafb in fb-modules
+  * abi: Add more modules to ignore (known)
+
+  [ 2.6.26-3.7 ]
+
+  [Amit Kucheria]
+
+  * SAUCE: make fc transport removal of target configurable
+     - LP: #163075
+  * SAUCE: pm: Config option to disable handling of console during
+    suspend/resume
+
+  [Ben Collins]
+
+  * SAUCE: input/mouse/alps: Do not call psmouse_reset() for alps
+  * SAUCE: irda: Default to dongle type 9 on IBM hardware
+  * SAUCE: tulip: Let dmfe handle davicom on non-sparc
+  * SAUCE: tulip: Define ULI PCI ID's
+  * SAUCE: version: Implement version_signature proc file.
+  * build: Cleanup arches
+  * build: Remove remnants of unused binary-custom infrastructure
+  * build: Remove disable_d_i (not needed) and cleanup ppa build stuff
+  * ubuntu: New modules, acer-acpi
+  * build: Remove -virtual, and rebuild configs
+  * ubuntu: Add drbd module
+  * acer-acpi: Fix makefile
+  * x86/Kconfig: Fix missing quote for ubuntu Kconfig source
+  * ubuntu: Add iscsitarget module
+  * ubuntu: Added Amiga FS driver
+  * ubuntu: Add squashfs driver
+  * ubuntu: Remove asfs (Amiga FS). Need to be in linux-ports instead
+  * squashfs: Move headers to real include directory
+  * build/configs: The Great Config Consistency Check of 2008
+  * ubuntu: Move third-party includes to ubuntu/include
+  * ubuntu: Add aufs module
+  * ubuntu: Added atl2 driver
+  * ubuntu: Add dm-radi4-5 driver
+  * build: Add CONFIG_DEBUG_SECTION_MISMATCH=y to get old style warnings
+    from build
+  * ubuntu/Makefile: Fixup dm-raid4-5 and add kludge for kbuild
+  * squashfs: Fixes for VFS changes
+  * ubuntu/dm-raid4-5: Fixups for moved/renamed headers/functions in core
+    md
+  * ubuntu: Add ndiswrapper driver
+  * d-i: Update module listings
+  * build: Disable xd block device (ancient)
+  * ndiswrapper: Fixup makefile
+  * d-i: Remove efi-modules. The only module, efivars, is built-in
+  * build: Remove install-source, obsolete and caused build failure
+  * Ubuntu-2.6.26-1.3
+  * build: linux-doc rules got broken when disabling html side. Fixed now.
+  * Ubuntu-2.6.26-1.4
+  * x86: Update to -rc6 allows CONFIG_PCI_OLPC to work with PCI_GOANY
+  * d-i: Make virtio-ring optional (it's built-in on i386)
+  * Ubuntu-2.6.26-1.4
+  * Ubuntu-2.6.26-1.5
+  * config: Enable DVB devices
+  * ubuntu/aufs: Make aufs a bool config, since it needs to be built-in
+  * config: Build aufs into the kernels
+  * build: Fix arguments passed to link-headers script
+  * config: Disable early printk
+  * d-i: Move isofs to storage-core and kill st (scsi tape) from list
+  * config: Enable non-promiscuous access to /dev/mem
+  * x86: Add option to disable decompression info messages
+  * config: Enable no-bz-chatter config options
+  * build: Re-add linux-source package
+  * d-i: Re-add socket-modules. Accidentally removed
+    - LP: #241295
+  * Ubuntu-2.6.26-2.6
+  * Use makedumpfile to generate a vmcoreinfo file.
+  * build: Build-Depend on makedumpfile for vmcoreinfo generation
+  * build: Remove debug print from git-ubuntu-log
+  * Updated configs for -rc7
+  * build: postinst, do not call depmod with -F
+  * config: Enable rtc-cmos as a built-in driver.
+  * control: Provide ndiswrapper-modules-1.9
+  * build: Generate vmcoreinfo in image build for crashdumps without debug
+    image
+  * config: Disable vesafb, since we'll prefer uvesafb
+  * build: Copy uvesafb module to initrd mod directory
+  * abi-check: New, more robust script
+  * config: Enable heap randomization by default
+  * abi-check: Cleanup output and call with perl (not $SHELL)
+  * abi: Ignore missing vesafb (known)
+  * config: Disable pcspkr (in favor of snd-pcsp)
+  * swap: Add notify_swap_entry_free callback for compcache
+  * compcache: Added ram backed compressed swap module
+  * ubuntu: Enable kbuild and kconfig for compcache
+  * config: Enable compcache and tlsf allocator as modules
+  * config: Updated for -rc8. Disables XEN on i386
+  * config: Switch i386-server to 64G, enable PAE, 64-bit res, and XEN
+  * ubuntu: Add misc drivers from hardy lum
+  * ubuntu: Enable build of misc/ subdir
+  * config: Enable misc drivers
+  * aufs: Fix warning about single non-string-literal arg to printf style
+    function
+  * drivers: Remove some duplicate device entries in various modules
+  * config: Disable some duplicate drivers
+  * keyspan: Remove duplicate device ID's
+  * check-aliases: Cleanup output, and fix rolling checks
+  * ubuntu: Disable dm-bbr for now
+  * dm-bbr: First cut at forward portiong. Still needs work.
+  * ubuntu: Disable dm-bbr in kbuild/kconfig
+
+  [Chuck Short]
+
+  * SAUCE: ata: blacklist FUJITSU MHW2160BH PL
+     - LP: #175834
+  * SAUCE: [USB]: add ASUS LCM to the blacklist
+
+  [Colin Ian King]
+
+  * SAUCE: airprime.c supports more devices
+    - LP: #208250
+  * SAUCE: Enable speedstep for sonoma processors. 
+     - LP: #132271
+  * Add dm-loop
+  * Add dm-loop BOM
+
+  [Kyle McMartin]
+
+  * SAUCE: fix orinoco_cs oops
+
+  [Mario Limonciello]
+
+  * SAUCE: Enable Reset and SCO workaround on Dell 410 BT adapter
+
+  [Matthew Garrett]
+
+  * SAUCE: hostap: send events on data interface as well as master
+    interface
+
+  [Phillip Lougher]
+
+  * SAUCE: r8169: disable TSO by default for RTL8111/8168B chipsets.
+
+  [Stefan Bader]
+
+  * SAUCE: Export dm_disk function of device-mapper
+  * SAUCE: Restore VT fonts on switch
+  * SAUCE: Always use SCO protocol (disable eSCO support) Bug: #39414
+  * SAUCE: mmc: Increase power_up deleay to fix TI readers OriginalAuthor:
+    Pascal Terjan <pterjan@mandriva.com> Bug: #137686
+  * SAUCE: Add blacklist support to fix Belkin bluetooth dongle. Bug:
+    #140511
+  * SAUCE: Lower warning level of pci resource allocation messages. Bug:
+    159241
+  * SAUCE: Lower message level for PCI memory and I/O allocation.
+    - LP: #159241
+  * Modify log generation to catch bug numbers when adding with git-am.
+
+  [Tim Gardner]
+
+  * Added the debian directory. Ignore: yes
+  * Add support for UBUNTUINCLUDE Ignore: yes
+  * LUM headers go in /usr/src Ignore: yes
+  * First pass at 2.6.25 configs Ignore: yes
+  * i386 -generic builds. Ignore: yes
+  * SAUCE: Increase CONFIG_IDE_MAX_HWIFS to 8 (from 4)
+  * SAUCE: Add extra headers to linux-libc-dev OriginalAuthor: Soren Hansen
+    OriginalLocation:
+    https://lists.ubuntu.com/archives/kernel-team/2007-November/001891.html
+  * Set CONFIG_DEVKMEM=n Ignore: yes
+  * Enabled ALSA and CGROUPS for i386 Ignore: yes
+  * Enabled amd64 configs. Ignore: yes
+  * CONFIG_STANDALONE=n Ignore: yes
+  * CONFIG_BLK_DEV_4DRIVES=n for i386 Ignore: yes
+  * CONFIG: CONFIG_DEFAULT_RELATIME=y for all flavours. Ignore: yes
+  * Set CONFIG_EDD_OFF=y Ignore: yes
+  * SAUCE: Blacklist Bluetooth Dell Wireless 370 for SCO MTU
+    OriginalAuthor: Mario Limonciello <Mario_Limonciello@Dell.com> Bug:
+    #209715
+  * SAUCE: Catch nonsense keycodes and silently ignore
+  * SAUCE: frame buffer regression - screen blank except for blinking
+    cursor after fbcon vtswitch OriginalAuthor: Matthew Garrett
+    <mjg59@srcf.ucam.org> Bug: #201591
+  * SAUCE: Added support for HDAPS on various ThinkPads from Lenovo and IBM
+    OriginalAuthor: Klaus S. Madsen <ubuntu@hjernemadsen.org>
+    OriginalAuthor: Chuck Short <zulcss@ubuntu.com>
+  * SAUCE: Guest OS does not recognize a lun with non zero target id on
+    Vmware ESX Server
+  * SAUCE: orinoco_cs.ko missing
+  * Set CONFIG_FB_VESA=m for i386/amd64 Ignore: yes
+  * Set CONFIG_PM_DISABLE_CONSOLE=y for all flavours Ignore: yes
+  * Thorough review of amd64 -generic config Ignore: yes
+  * Build PPA packages for Hardy until the Intrepid archive is opened.
+  * Deleted obsolete flavours Ignore: yes
+  * Don't build docs for PPA Ignore: yes
+  * Build all standard packages in PPA. Ignore: yes
+  * Remove duplicate USB ids
+  * SAUCE: DVB-USB UMT-010 driver oops on install Bug: #115284
+  * Update configs after rebase to 2.6.26-rc1 Ignore: yes
+  * Update configs after rebase Ignore: yes
+  * Disable V4L until the build issues get ironed out. Ignore: yes
+  * Update configs after rebase. Ignore: yes
+  * Another device enable pass Ignore: yes
+  * Update configs after merge. Ignore: yes
+  * SAUCE: fn key doesn't work in hardy with macbook pro fourth generation
+    (4,1)
+    - LP: #207127
+  * Enabled CONFIG_CIFS_DFS_UPCALL=y and CONFIG_CIFS_UPCALL=y
+    - LP: #236830
+
+  [Upstream Kernel Changes]
+
+  * Revert "[WATCHDOG] hpwdt: Add CFLAGS to get driver working"
+  * mac80211: detect driver tx bugs
+  * hwmon: (lm85) Fix function RANGE_TO_REG()
+  * hwmon: (adt7473) Initialize max_duty_at_overheat before use
+  * hwmon: Update the sysfs interface documentation
+  * hwmon: (abituguru3) Identify Abit AW8D board as such
+  * hwmon: (w83791d) new maintainer
+  * hwmon: (abituguru3) update driver detection
+  * hwmon: (lm75) sensor reading bugfix
+  * ipv6: Remove options header when setsockopt's optlen is 0
+  * ipv6: Drop packets for loopback address from outside of the box.
+  * sched: rt: dont stop the period timer when there are tasks wanting to
+    run
+  * sched: fix wait_for_completion_timeout() spurious failure under heavy
+    load
+  * x86: fix NULL pointer deref in __switch_to
+  * xen: Use wmb instead of rmb in xen_evtchn_do_upcall().
+  * xen: mask unwanted pte bits in __supported_pte_mask
+  * xen: don't drop NX bit
+  * sched: refactor wait_for_completion_timeout()
+  * Ext4: Fix online resize block group descriptor corruption
+  * [IA64] SN2: security hole in sn2_ptc_proc_write
+  * alpha: fix module load failures on smp (bug #10926)
+  * alpha: link failure fix
+  * alpha: fix compile failures with gcc-4.3 (bug #10438)
+  * alpha: resurrect Cypress IDE quirk
+  * pppoe: warning fix
+  * sctp: Make sure N * sizeof(union sctp_addr) does not overflow.
+  * netns: Don't receive new packets in a dead network namespace.
+  * Add return value to reserve_bootmem_node()
+  * Slab: Fix memory leak in fallback_alloc()
+  * Fix performance regression on lmbench select benchmark
+  * ALSA: aw2 - Fix Oops at initialization
+  * ALSA: sb - Fix wrong assertions
+  * futexes: fix fault handling in futex_lock_pi
+  * IB/mthca: Clear ICM pages before handing to FW
+  * tty_driver: Update required method documentation
+  * removed unused var real_tty on n_tty_ioctl()
+  * Fix ZERO_PAGE breakage with vmware
+  * mm: fix race in COW logic
+  * NFS: Reduce the NFS mount code stack usage.
+  * NFS: Fix filehandle size comparisons in the mount code
+  * NFS: nfs_updatepage(): don't mark page as dirty if an error occurred
+  * alpha: fix compile error in arch/alpha/mm/init.c
+  * KVM: Fix race between timer migration and vcpu migration
+  * KVM: close timer injection race window in __vcpu_run
+  * KVM: MMU: Fix rmap_write_protect() hugepage iteration bug
+  * KVM: MMU: large page update_pte issue with non-PAE 32-bit guests
+    (resend)
+  * KVM: MMU: Fix oops on guest userspace access to guest pagetable
+  * KVM: ioapic: fix lost interrupt when changing a device's irq
+  * KVM: VMX: Fix host msr corruption with preemption enabled
+  * [GFS2] BUG: unable to handle kernel paging request at ffff81002690e000
+  * xen: remove support for non-PAE 32-bit
+  * kgdb: documentation update - remove kgdboe
+  * kgdb: sparse fix
+  * [IA64] Fix boot failure on ia64/sn2
+  * [IA64] Handle count==0 in sn2_ptc_proc_write()
+  * [IA64] Eliminate NULL test after alloc_bootmem in iosapic_alloc_rte()
+  * [GFS2] fix gfs2 block allocation (cleaned up)
+  * x86: Add structs and functions for paravirt clocksource
+  * x86: Make xen use the paravirt clocksource structs and functions
+  * KVM: Make kvm host use the paravirt clocksource structs
+  * x86: KVM guest: Use the paravirt clocksource structs and functions
+  * KVM: Remove now unused structs from kvm_para.h
+  * enable bus mastering on i915 at resume time
+  * Linux 2.6.26-rc8
+  * # Ubuntu external driver commit.
+  * # Ubuntu commit template.
+
+ -- Ben Collins <ben.collins@canonical.com>  Sat, 21 Jun 2008 09:05:15 -0400
+
+linux (2.6.26-2.6) intrepid; urgency=low
+
+  [Ben Collins]
+
+  * Revert "SAUCE: Export symbols for aufs (in lum) (not needed)
+  * config: Enable DVB devices
+  * ubuntu/aufs: Make aufs a bool config, since it needs to be built-in
+  * config: Build aufs into the kernels
+  * build: Fix arguments passed to link-headers script
+  * config: Disable early printk
+  * d-i: Move isofs to storage-core and kill st (scsi tape) from list
+  * config: Enable non-promiscuous access to /dev/mem
+  * x86: Add option to disable decompression info messages
+  * config: Enable no-bz-chatter config options
+  * build: Re-add linux-source package
+  * d-i: Re-add socket-modules. Accidentally removed
+    - LP: #241295
+
+  [Colin Ian King]
+
+  * Add dm-loop
+
+  [Tim Gardner]
+
+  * Revert "SAUCE: USB bluetooth device 0x0e5e:0x6622 floods errors to
+    syslog (merged upstream)
+
+ -- Ben Collins <ben.collins@canonical.com>  Mon, 16 Jun 2008 10:56:01 -0400
+
+linux (2.6.26-1.5) intrepid; urgency=low
+
+  * d-i: Make virtio-ring optional (it's built-in on i386)
+  * Rebased on 2.6.26-rc6
+
+  [Ubuntu-2.6.26-1.4 Changes below]
+
+  * build: linux-doc rules got broken when disabling html side. Fixed now.
+
+  [Ubuntu-2.6.26-1.3 Changes below]
+
+  * build: Remove install-source, obsolete and caused build failure
+
+  [Ubuntu-2.6.26-1.2 Changes below]
+
+  * Remove efi-modules from d-i module list (efivars is built-in). Caused a
+    build failure.
+  * Patch to arch/x86/xen/time.c to remove __divdi3 usage (build failure on
+    i386).
+
+  [Ubuntu-2.6.26-1.1 Changes below]
+
+  [Amit Kucheria]
+
+  * SAUCE: make fc transport removal of target configurable
+  * SAUCE: Add AGP support for Radeon Mobility 9000 chipset
+  * SAUCE: pm: Config option to disable handling of console during
+    suspend/resume
+
+  [Ben Collins]
+
+  * SAUCE: input/mouse/alps: Do not call psmouse_reset() for alps
+  * SAUCE: irda: Default to dongle type 9 on IBM hardware
+  * SAUCE: tulip: Let dmfe handle davicom on non-sparc
+  * SAUCE: tulip: Define ULI PCI ID's
+  * SAUCE: version: Implement version_signature proc file.
+  * build: Remove remnants of unused binary-custom infrastructure
+  * mmc_block: Fix bad allocation on 64-bit (zero len array)
+  * ubuntu: New modules, acer-acpi
+  * build: Remove -virtual, and rebuild configs
+  * ubuntu: Add drbd module
+  * ubuntu: Add iscsitarget module
+  * ubuntu: Add squashfs driver
+  * build/configs: The Great Config Consistency Check of 2008
+  * ubuntu: Add aufs module
+  * ubuntu: Added atl2 driver
+  * ubuntu: Add dm-radi4-5 driver
+  * build: Add CONFIG_DEBUG_SECTION_MISMATCH=y to get old style warnings
+    from build
+  * squashfs: Fixes for VFS changes
+  * ubuntu/dm-raid4-5: Fixups for moved/renamed headers/functions in core
+    md
+  * ubuntu: Add ndiswrapper driver
+  * d-i: Update module listings
+
+  [Chuck Short]
+
+  * SAUCE: ata: blacklist FUJITSU MHW2160BH PL
+  * SAUCE: [USB]: add ASUS LCM to the blacklist
+
+  [Colin Ian King]
+
+  * SAUCE: Enable speedstep for sonoma processors.
+  * SAUCE: airprime.c supports more devices
+
+  [Kyle McMartin]
+
+  * SAUCE: fix orinoco_cs oops
+
+  [Mario Limonciello]
+
+  * SAUCE: Enable Reset and SCO workaround on Dell 410 BT adapter
+
+  [Matthew Garrett]
+
+  * SAUCE: hostap: send events on data interface as well as master
+    interface
+
+  [Phillip Lougher]
+
+  * SAUCE: r8169: disable TSO by default for RTL8111/8168B chipsets.
+
+  [Stefan Bader]
+
+  * SAUCE: Export dm_disk function of device-mapper
+  * SAUCE: Restore VT fonts on switch
+  * SAUCE: Always use SCO protocol (disable eSCO support) Bug: #39414
+  * SAUCE: mmc: Increase power_up deleay to fix TI readers
+  * SAUCE: Add blacklist support to fix Belkin bluetooth dongle.
+  * SAUCE: Lower warning level of pci resource allocation messages.
+  * SAUCE: Lower message level for PCI memory and I/O allocation.
+    - LP: #159241
+  * Modify log generation to catch bug numbers when adding with git-am.
+
+  [Tim Gardner]
+
+  * SAUCE: hdaps module does not load on Thinkpad T61P
+  * SAUCE: Add extra headers to linux-libc-dev
+  * SAUCE: Export symbols for aufs (in lum).
+  * SAUCE: USB bluetooth device 0x0e5e:0x6622 floods errors to syslog
+  * SAUCE: Blacklist Bluetooth Dell Wireless 370 for SCO MTU
+  * SAUCE: Catch nonsense keycodes and silently ignore
+  * SAUCE: frame buffer regression - screen blank except for blinking
+    cursor after fbcon vtswitch
+  * SAUCE: Added support for HDAPS on various ThinkPads from Lenovo and IBM
+  * SAUCE: Guest OS does not recognize a lun with non zero target id on
+    Vmware ESX Server
+  * SAUCE: Modualrize vesafb
+  * SAUCE: DVB-USB UMT-010 driver oops on install
+  * SAUCE: fn key doesn't work in hardy with macbook pro fourth generation
+    (4,1)
+    - LP: #207127
+
+ -- Ben Collins <ben.collins@canonical.com>  Wed, 11 Jun 2008 05:28:35 -0400
--- linux-rt-2.6.31.orig/debian/rules
+++ linux-rt-2.6.31/debian/rules
@@ -0,0 +1,82 @@
+#!/usr/bin/make -f
+#
+# debian/rules for Ubuntu linux
+#
+# Use this however you want, just give credit where credit is due.
+#
+# Copyright (c) 2007 Ben Collins <bcollins@ubuntu.com>
+#
+
+# dpkg-buildpackage passes options that are incomptatible
+# with the kernel build.
+unexport CFLAGS
+unexport LDFLAGS
+
+# This is the debhelper compatability version to use.
+export DH_COMPAT=4
+export LC_ALL=C
+export SHELL=/bin/bash -e
+
+# Common variables for all architectures
+include debian/rules.d/0-common-vars.mk
+
+# Pill in some arch specific stuff
+include debian/rules.d/$(arch).mk
+
+# Maintainer targets
+include debian/rules.d/1-maintainer.mk
+
+# Debian Build System targets
+binary: binary-indep binary-arch
+
+#build: build-arch build-indep
+build: apply-patchset build-arch build-indep
+
+clean: debian/control deapply-patchset
+	dh_testdir
+	dh_testroot
+	dh_clean
+
+	# d-i stuff
+	rm -rf modules kernel-versions package-list
+	rm -rf debian/d-i-$(arch)
+
+	# normal build junk
+	rm -rf debian/abi/$(release)-$(revision)
+	rm -rf $(builddir)
+	rm -f $(stampdir)/stamp-*
+	rm -rf debian/linux-*
+
+	# This gets rid of the d-i packages in control
+	cp -f debian/control.stub debian/control
+
+# Builds the image, arch headers and debug packages
+include debian/rules.d/2-binary-arch.mk
+
+# Rules for building the udebs (debian-installer)
+#include debian/rules.d/5-udebs.mk
+
+# Builds the source, doc and linux-headers indep packages
+include debian/rules.d/3-binary-indep.mk
+
+# Various checks to be performed on builds
+include debian/rules.d/4-checks.mk
+
+# Misc stuff
+debian/control.stub: debian/scripts/control-create	\
+		debian/control.stub.in			\
+		debian/changelog			\
+		$(wildcard debian/control.d/* debian/sub-flavours/*.vars)
+#	for i in debian/control.stub.in; do
+	for i in debian/control.stub.in; do	\
+	  new=`echo $$i | sed 's/\.in$$//'`;					\
+	  cat $$i | sed -e 's/PKGVER/$(release)/g' -e 's/ABINUM/$(abinum)/g' >	\
+		$$new;								\
+	done
+	flavours="$(wildcard debian/control.d/vars.* debian/sub-flavours/*.vars)";\
+	for i in $$flavours; do							\
+	  $(SHELL) debian/scripts/control-create $$i |				\
+		sed -e 's/PKGVER/$(release)/g' -e 's/ABINUM/$(abinum)/g' >>	\
+		debian/control.stub;						\
+	done
+	cp debian/control.stub debian/control
--- linux-rt-2.6.31.orig/debian/control.stub
+++ linux-rt-2.6.31/debian/control.stub
@@ -0,0 +1,72 @@
+Source: linux-rt
+Section: devel
+Priority: optional
+Maintainer: Alessio Igor Bogani <abogani@ubuntu.com>
+Standards-Version: 3.6.1
+Build-Depends: debhelper (>= 3), module-init-tools, kernel-wedge (>= 2.24ubuntu1), makedumpfile [!armel], quilt, cpio
+Build-Depends-Indep: xmlto, docbook-utils, gs, transfig, bzip2, sharutils
+
+Package: linux-rt-headers-2.6.31-11
+Architecture: all
+Section: devel
+Priority: optional
+Depends: coreutils | fileutils (>= 4.0)
+Provides: linux-rt-headers, linux-rt-headers-2.6
+Description: Header files related to Linux kernel version 2.6.31
+ This package provides kernel header files for version 2.6.31, for sites
+ that want the latest kernel headers. Please read
+ /usr/share/doc/linux-headers-2.6.31-11/debian.README.gz for details
+
+Package: linux-image-2.6.31-11-rt
+Architecture: i386 amd64
+Section: base
+Priority: optional
+Pre-Depends: dpkg (>= 1.10.24)
+Provides: linux-image, linux-image-2.6, fuse-module, kvm-api-4, redhat-cluster-modules, ivtv-modules, ndiswrapper-modules-1.9
+Depends: initramfs-tools (>= 0.36ubuntu6), coreutils | fileutils (>= 4.0), module-init-tools (>= 3.3-pre11-4ubuntu3)
+Conflicts: hotplug (<< 0.0.20040105-1)
+Recommends: grub-pc | grub | lilo (>= 19.1)
+Suggests: fdutils, linux-doc-2.6.31 | linux-source-2.6.31
+Description: Linux kernel image for version 2.6.31 on Ingo Molnar's full real time preemption patch
+ This package contains the Linux kernel image for version 2.6.31 on
+ Ingo Molnar's full real time preemption patch.
+ .
+ Also includes the corresponding System.map file, the modules built by the
+ packager, and scripts that try to ensure that the system is not left in an
+ unbootable state after an update.
+ .
+ Supports Generic processors.
+ .
+ Geared toward real time systems.
+ .
+ You likely do not want to install this package directly. Instead, install
+ the linux-rt meta-package, which will ensure that upgrades work
+ correctly, and that supporting packages are also installed.
+
+Package: linux-headers-2.6.31-11-rt
+Architecture: i386 amd64
+Section: devel
+Priority: optional
+Depends: coreutils | fileutils (>= 4.0), linux-rt-headers-2.6.31-11, ${shlibs:Depends}
+Provides: linux-headers, linux-headers-2.6
+Description: Linux kernel headers for version 2.6.31 on Ingo Molnar's full real time preemption patch
+ This package provides kernel header files for version 2.6.31 on
+ Ingo Molnar's full real time preemption patch.
+ .
+ This is for sites that want the latest kernel headers.  Please read
+ /usr/share/doc/linux-headers-2.6.31-11/debian.README.gz for details.
+
+Package: linux-image-debug-2.6.31-11-rt
+Architecture: i386 amd64
+Section: devel
+Priority: optional
+Provides: linux-debug
+Description: Linux kernel debug image for version 2.6.31 on Ingo Molnar's full real time preemption patch
+ This package provides a kernel debug image for version 2.6.31 on
+ Ingo Molnar's full real time preemption patch.
+ .
+ This is for sites that wish to debug the kernel.
+ .
+ The kernel image contained in this package is NOT meant to boot from. It
+ is uncompressed, and unstripped. This package also includes the
+ unstripped modules.
--- linux-rt-2.6.31.orig/debian/control
+++ linux-rt-2.6.31/debian/control
@@ -0,0 +1,72 @@
+Source: linux-rt
+Section: devel
+Priority: optional
+Maintainer: Alessio Igor Bogani <abogani@ubuntu.com>
+Standards-Version: 3.6.1
+Build-Depends: debhelper (>= 3), module-init-tools, kernel-wedge (>= 2.24ubuntu1), makedumpfile [!armel], quilt, cpio
+Build-Depends-Indep: xmlto, docbook-utils, gs, transfig, bzip2, sharutils
+
+Package: linux-rt-headers-2.6.31-11
+Architecture: all
+Section: devel
+Priority: optional
+Depends: coreutils | fileutils (>= 4.0)
+Provides: linux-rt-headers, linux-rt-headers-2.6
+Description: Header files related to Linux kernel version 2.6.31
+ This package provides kernel header files for version 2.6.31, for sites
+ that want the latest kernel headers. Please read
+ /usr/share/doc/linux-headers-2.6.31-11/debian.README.gz for details
+
+Package: linux-image-2.6.31-11-rt
+Architecture: i386 amd64
+Section: base
+Priority: optional
+Pre-Depends: dpkg (>= 1.10.24)
+Provides: linux-image, linux-image-2.6, fuse-module, kvm-api-4, redhat-cluster-modules, ivtv-modules, ndiswrapper-modules-1.9
+Depends: initramfs-tools (>= 0.36ubuntu6), coreutils | fileutils (>= 4.0), module-init-tools (>= 3.3-pre11-4ubuntu3)
+Conflicts: hotplug (<< 0.0.20040105-1)
+Recommends: grub-pc | grub | lilo (>= 19.1)
+Suggests: fdutils, linux-doc-2.6.31 | linux-source-2.6.31
+Description: Linux kernel image for version 2.6.31 on Ingo Molnar's full real time preemption patch
+ This package contains the Linux kernel image for version 2.6.31 on
+ Ingo Molnar's full real time preemption patch.
+ .
+ Also includes the corresponding System.map file, the modules built by the
+ packager, and scripts that try to ensure that the system is not left in an
+ unbootable state after an update.
+ .
+ Supports Generic processors.
+ .
+ Geared toward real time systems.
+ .
+ You likely do not want to install this package directly. Instead, install
+ the linux-rt meta-package, which will ensure that upgrades work
+ correctly, and that supporting packages are also installed.
+
+Package: linux-headers-2.6.31-11-rt
+Architecture: i386 amd64
+Section: devel
+Priority: optional
+Depends: coreutils | fileutils (>= 4.0), linux-rt-headers-2.6.31-11, ${shlibs:Depends}
+Provides: linux-headers, linux-headers-2.6
+Description: Linux kernel headers for version 2.6.31 on Ingo Molnar's full real time preemption patch
+ This package provides kernel header files for version 2.6.31 on
+ Ingo Molnar's full real time preemption patch.
+ .
+ This is for sites that want the latest kernel headers.  Please read
+ /usr/share/doc/linux-headers-2.6.31-11/debian.README.gz for details.
+
+Package: linux-image-debug-2.6.31-11-rt
+Architecture: i386 amd64
+Section: devel
+Priority: optional
+Provides: linux-debug
+Description: Linux kernel debug image for version 2.6.31 on Ingo Molnar's full real time preemption patch
+ This package provides a kernel debug image for version 2.6.31 on
+ Ingo Molnar's full real time preemption patch.
+ .
+ This is for sites that wish to debug the kernel.
+ .
+ The kernel image contained in this package is NOT meant to boot from. It
+ is uncompressed, and unstripped. This package also includes the
+ unstripped modules.
--- linux-rt-2.6.31.orig/debian/control.stub.in
+++ linux-rt-2.6.31/debian/control.stub.in
@@ -0,0 +1,18 @@
+Source: linux-rt
+Section: devel
+Priority: optional
+Maintainer: Alessio Igor Bogani <abogani@ubuntu.com>
+Standards-Version: 3.6.1
+Build-Depends: debhelper (>= 3), module-init-tools, kernel-wedge (>= 2.24ubuntu1), makedumpfile [!armel], quilt, cpio
+Build-Depends-Indep: xmlto, docbook-utils, gs, transfig, bzip2, sharutils
+
+Package: linux-rt-headers-PKGVER-ABINUM
+Architecture: all
+Section: devel
+Priority: optional
+Depends: coreutils | fileutils (>= 4.0)
+Provides: linux-rt-headers, linux-rt-headers-2.6
+Description: Header files related to Linux kernel version PKGVER
+ This package provides kernel header files for version PKGVER, for sites
+ that want the latest kernel headers. Please read
+ /usr/share/doc/linux-headers-PKGVER-ABINUM/debian.README.gz for details
--- linux-rt-2.6.31.orig/debian/.pc/.version
+++ linux-rt-2.6.31/debian/.pc/.version
@@ -0,0 +1 @@
+2
--- linux-rt-2.6.31.orig/debian/tests/check-aliases
+++ linux-rt-2.6.31/debian/tests/check-aliases
@@ -0,0 +1,24 @@
+#!/usr/bin/perl -w
+
+my %map;
+
+print "Checking for dupe aliases in $ENV{'FLAVOUR'}...\n";
+
+$aliases =
+  "$ENV{'INSTALL_DIR'}/lib/modules/$ENV{'VERSION'}-$ENV{'FLAVOUR'}/modules.alias";
+
+open(ALIASES, "< $aliases") or die "Could not open $aliases";
+
+while (<ALIASES>) {
+	chomp;
+	my ($junk, $alias, $module) = split;
+
+	if (defined($map{$alias})) {
+		printf("%s %20s / %-20s : %s \n", ("$map{$alias}" eq "$module")
+			? "INT" : "   ", $map{$alias}, $module, $alias);
+	} else {
+		$map{$alias} = $module;
+	}
+}
+
+exit(0);
--- linux-rt-2.6.31.orig/debian/tests/README
+++ linux-rt-2.6.31/debian/tests/README
@@ -0,0 +1,21 @@
+Scripts placed in this directory get called one at a time by run-parts(8).
+The scripts are expected to perform some sort of sanity checks on the
+finished build. Scripts will be called once for each flavour.
+
+Some environment variables are exported to make life a little easier:
+
+DPKG_ARCH     : The dpkg architecture (e.g. "amd64")
+KERN_ARCH     : The kernel architecture (e.g. "x86_64")
+FLAVOUR       : The specific flavour for this run (e.g. "generic")
+VERSION       : The full version of this build (e.g. 2.6.22-1)
+REVISION      : The exact revision of this build (e.g. 1.3)
+PREV_REVISION : The revision prior to this one
+ABI_NUM       : The specific ABI number for this build (e.g. 2)
+PREV_ABI_NUM  : The previous ABI number. Can be the same as ABI_NUM.
+BUILD_DIR     : The directory where this build took place
+INSTALL_DIR   : The directory where the package is prepared
+SOURCE_DIR    : Where the main kernel source is
+
+Scripts are expected to have a zero exit status when no problems occur,
+and non-zero when an error occurs that should stop the build. Scripts
+should print whatever info they deem needed to deduce the problem.
--- linux-rt-2.6.31.orig/debian/control.d/flavour-control.stub
+++ linux-rt-2.6.31/debian/control.d/flavour-control.stub
@@ -0,0 +1,66 @@
+# Items that get replaced:
+# FLAVOUR
+# DESC
+# ARCH
+# SUPPORTED
+# TARGET
+# BOOTLOADER
+# =PROVIDES=
+#
+# Items marked with =FOO= are optional
+#
+# XXX: Leave the blank line before the first package!!
+
+Package: linux-image-PKGVER-ABINUM-FLAVOUR
+Architecture: ARCH
+Section: base
+Priority: optional
+Pre-Depends: dpkg (>= 1.10.24)
+Provides: linux-image, linux-image-2.6, fuse-module, =PROVIDES=
+Depends: initramfs-tools (>= 0.36ubuntu6), coreutils | fileutils (>= 4.0), module-init-tools (>= 3.3-pre11-4ubuntu3)
+Conflicts: hotplug (<< 0.0.20040105-1)
+Recommends: BOOTLOADER
+Suggests: fdutils, linux-doc-PKGVER | linux-source-PKGVER
+Description: Linux kernel image for version PKGVER on DESC
+ This package contains the Linux kernel image for version PKGVER on
+ DESC.
+ .
+ Also includes the corresponding System.map file, the modules built by the
+ packager, and scripts that try to ensure that the system is not left in an
+ unbootable state after an update.
+ .
+ Supports SUPPORTED processors.
+ .
+ TARGET
+ .
+ You likely do not want to install this package directly. Instead, install
+ the linux-FLAVOUR meta-package, which will ensure that upgrades work
+ correctly, and that supporting packages are also installed.
+
+Package: linux-headers-PKGVER-ABINUM-FLAVOUR
+Architecture: ARCH
+Section: devel
+Priority: optional
+Depends: coreutils | fileutils (>= 4.0), linux-rt-headers-PKGVER-ABINUM, ${shlibs:Depends}
+Provides: linux-headers, linux-headers-2.6
+Description: Linux kernel headers for version PKGVER on DESC
+ This package provides kernel header files for version PKGVER on
+ DESC.
+ .
+ This is for sites that want the latest kernel headers.  Please read
+ /usr/share/doc/linux-headers-PKGVER-ABINUM/debian.README.gz for details.
+
+Package: linux-image-debug-PKGVER-ABINUM-FLAVOUR
+Architecture: ARCH
+Section: devel
+Priority: optional
+Provides: linux-debug
+Description: Linux kernel debug image for version PKGVER on DESC
+ This package provides a kernel debug image for version PKGVER on
+ DESC.
+ .
+ This is for sites that wish to debug the kernel.
+ .
+ The kernel image contained in this package is NOT meant to boot from. It
+ is uncompressed, and unstripped. This package also includes the
+ unstripped modules.
--- linux-rt-2.6.31.orig/debian/control.d/vars.rt
+++ linux-rt-2.6.31/debian/control.d/vars.rt
@@ -0,0 +1,6 @@
+arch="i386 amd64"
+supported="Generic"
+target="Geared toward real time systems."
+desc="Ingo Molnar's full real time preemption patch"
+bootloader="grub-pc | grub | lilo (>= 19.1)"
+provides="kvm-api-4, redhat-cluster-modules, ivtv-modules, ndiswrapper-modules-1.9"
--- linux-rt-2.6.31.orig/debian/sub-flavours/README
+++ linux-rt-2.6.31/debian/sub-flavours/README
@@ -0,0 +1,12 @@
+Sub flavours are flavours that are built based on other builds. IOW, they
+are usually a subset of something else.
+
+Requirements:
+
+debian/sub-flavours/<sub>.list	: The file list, uses glob syntax
+debian/sub-flavours/<sub>.vars	: The make vars, similar to normal flavours
+debian/rules.d/<arch>.mk	: Add <base>_sub var listing the <sub>, e.g.
+				  server_sub = virtual would mean virtual is
+				  based on the server flavour.
+
+Note, the vars must include a conflicts with the flavour it was built on.
--- linux-rt-2.6.31.orig/debian/sub-flavours/control.stub
+++ linux-rt-2.6.31/debian/sub-flavours/control.stub
@@ -0,0 +1,39 @@
+# Items that get replaced:
+# FLAVOUR
+# DESC
+# ARCH
+# SUPPORTED
+# TARGET
+# BOOTLOADER
+# =PROVIDES=
+# =CONFLICTS=
+#
+# Items marked with =FOO= are optional
+#
+# XXX: Leave the blank line before the first package!!
+
+Package: linux-image-PKGVER-ABINUM-FLAVOUR
+Architecture: ARCH
+Section: base
+Priority: optional
+Pre-Depends: dpkg (>= 1.10.24)
+Provides: linux-image, linux-image-2.6, fuse-module, =PROVIDES=
+Depends: initramfs-tools (>= 0.36ubuntu6), coreutils | fileutils (>= 4.0), module-init-tools (>= 3.3-pre11-4ubuntu3)
+Conflicts: hotplug (<< 0.0.20040105-1), =CONFLICTS=
+Recommends: BOOTLOADER
+Suggests: fdutils, linux-doc-PKGVER | linux-source-PKGVER
+Description: Linux kernel image for version PKGVER on DESC
+ This package contains the Linux kernel image for version PKGVER on
+ DESC.
+ .
+ Also includes the corresponding System.map file, the modules built by the
+ packager, and scripts that try to ensure that the system is not left in an
+ unbootable state after an update.
+ .
+ Supports SUPPORTED processors.
+ .
+ TARGET
+ .
+ You likely do not want to install this package directly. Instead, install
+ the linux-FLAVOUR meta-package, which will ensure that upgrades work
+ correctly, and that supporting packages are also installed.
--- linux-rt-2.6.31.orig/debian/sub-flavours/virtual.list
+++ linux-rt-2.6.31/debian/sub-flavours/virtual.list
@@ -0,0 +1,111 @@
+arch/*/{crypto,kernel,oprofile}
+crypto/*
+drivers/acpi/*
+drivers/ata/ata_generic.ko
+drivers/ata/ata_piix.ko
+drivers/ata/libata.ko
+drivers/block/virtio_blk.ko
+drivers/block/nbd.ko
+drivers/block/loop.ko
+drivers/block/floppy.ko
+drivers/block/cryptoloop.ko
+drivers/block/xen-blkfront.ko
+drivers/cdrom/cdrom.ko
+drivers/char/hangcheck-timer.ko
+drivers/char/lp.ko
+drivers/char/nvram.ko
+drivers/char/ppdev.ko
+drivers/char/raw.ko
+drivers/input/evbug.ko
+drivers/input/evdev.ko
+drivers/input/gameport/gameport.ko
+drivers/input/mouse/psmouse.ko
+drivers/input/serio/serio_raw.ko
+drivers/input/serio/serport.ko
+drivers/input/joydev.ko
+drivers/input/misc/uinput.ko
+drivers/input/touchscreen/usbtouchscreen.ko
+drivers/input/xen-kbdfront.ko
+drivers/md/*
+drivers/message/fusion*
+drivers/misc/eeprom_93cx6.ko
+drivers/net/8139too.ko
+drivers/net/8139cp.ko
+drivers/net/appletalk/ipddp.ko
+drivers/net/bonding/bonding.ko
+drivers/net/bsd_comp.ko
+drivers/net/dummy.ko
+drivers/net/e1000/e1000.ko
+drivers/net/eql.ko
+drivers/net/ifb.ko
+drivers/net/mii.ko
+drivers/net/ne2k-pci.ko
+drivers/net/netconsole.ko
+drivers/net/pcnet32.ko
+drivers/net/ppp_async.ko
+drivers/net/ppp_deflate.ko
+drivers/net/ppp_generic.ko
+drivers/net/ppp_mppe.ko
+drivers/net/pppoe.ko
+drivers/net/pppol2tp.ko
+drivers/net/pppox.ko
+drivers/net/ppp_synctty.ko
+drivers/net/slhc.ko
+drivers/net/slip.ko
+drivers/net/tun.ko
+drivers/net/veth.ko
+drivers/net/virtio_net.ko
+drivers/net/xen-netfront.ko
+drivers/parport/parport.ko
+drivers/parport/parport_pc.ko
+drivers/net/tulip/tulip.ko
+drivers/net/virtio_net.ko
+drivers/scsi/BusLogic.ko
+drivers/scsi/iscsi_tcp.ko
+drivers/scsi/libiscsi.ko
+drivers/scsi/libsas/*
+drivers/scsi/libsas/libsas.ko
+drivers/scsi/qla1280.ko
+drivers/scsi/raid_class.ko
+drivers/scsi/scsi_mod.ko
+drivers/scsi/scsi_transport_fc.ko
+drivers/scsi/scsi_transport_iscsi.ko
+drivers/scsi/scsi_transport_sas.ko
+drivers/scsi/scsi_transport_spi.ko
+drivers/scsi/scsi_wait_scan.ko
+drivers/scsi/sd_mod.ko
+drivers/scsi/sg.ko
+drivers/scsi/sr_mod.ko
+drivers/usb/core/usbcore.ko
+drivers/usb/host/ehci-hcd.ko
+drivers/usb/host/uhci-hcd.ko
+drivers/usb/storage/usb-storage.ko
+drivers/video/cirrusfb.ko
+drivers/video/console/bitblit.ko
+drivers/video/console/fbcon.ko
+drivers/video/console/font.ko
+drivers/video/console/softcursor.ko
+drivers/video/console/tileblit.ko
+drivers/video/output.ko
+drivers/video/syscopyarea.ko
+drivers/video/sysfillrect.ko
+drivers/video/sysimgblt.ko
+drivers/video/vesafb.ko
+drivers/video/vga16fb.ko
+drivers/video/vgastate.ko
+drivers/video/xen-fbfront.ko
+drivers/virtio/virtio_balloon.ko
+drivers/virtio/virtio.ko
+drivers/virtio/virtio_pci.ko
+drivers/virtio/virtio_ring.ko
+drivers/watchdog/softdog.ko
+drivers/xen/*
+fs/*
+lib/*
+net/*
+sound/core/*
+sound/pci/snd-ens1370.ko
+sound/drivers/pcsp/snd-pcsp.ko
+ubuntu/e1000e/e1000e.ko
+ubuntu/squashfs/squashfs.ko
+ubuntu/iscsitarget/iscsi_trgt.ko
--- linux-rt-2.6.31.orig/debian/rules.d/1-maintainer.mk
+++ linux-rt-2.6.31/debian/rules.d/1-maintainer.mk
@@ -0,0 +1,105 @@
+# The following targets are for the maintainer only! do no run if you don't
+# know what they do.
+
+.PHONY: printenv updateconfigs printchanges insertchanges startnewrelease diffupstream help
+
+help:
+	@echo "These are the targets in addition to the normal debian ones:"
+	@echo
+	@echo "  printenv        : Print some variables used in the build"
+	@echo
+	@echo "  updateconfigs   : Update debian/config/*"
+	@echo
+	@echo "  editconfigs     : Update debian/config/* interactively"
+	@echo
+	@echo "  printchanges    : Print the current changelog entries (from git)"
+	@echo
+	@echo "  insertchanges   : Insert current changelog entries (from git)"
+	@echo
+	@echo "  startnewrelease : Start a new changelog set"
+	@echo
+	@echo "  diffupstream    : Diff stock kernel code against upstream (git)"
+	@echo
+	@echo "  help            : If you are kernel hacking, you need the professional"
+	@echo "                    version of this"
+	@echo
+	@echo "Environment variables:"
+	@echo
+	@echo "  NOKERNLOG       : Do not add upstream kernel commits to changelog"
+	@echo "  CONCURRENCY_LEVEL=X"
+	@echo "                  : Use -jX for kernel compile"
+	@echo "  PRINTSHAS       : Include SHAs for commits in changelog"
+
+ARCH_CONFIGS=i386 amd64
+
+updateconfigs:
+	dh_testdir
+	@for arch in $(ARCH_CONFIGS); do	\
+		$(SHELL) debian/scripts/misc/oldconfig $$arch;		\
+	done
+	rm -rf build
+
+editconfigs:
+	dh_testdir
+	@for arch in $(ARCH_CONFIGS); do	\
+		$(SHELL) debian/scripts/misc/doconfig $$arch;		\
+	done
+	rm -rf build
+
+printenv:
+	dh_testdir
+	@echo "release           = $(release)"
+	@echo "revisions         = $(revisions)"
+	@echo "revision          = $(revision)"
+	@echo "uploadnum         = $(uploadnum)"
+	@echo "prev_revisions    = $(prev_revisions)"
+	@echo "prev_revision     = $(prev_revision)"
+	@echo "abinum            = $(abinum)"
+	@echo "gitver            = $(gitver)"
+	@echo "flavours          = $(flavours)"
+	@echo "skipabi           = $(skipabi)"
+	@echo "skipmodule        = $(skipmodule)"
+	@echo "skipdbg           = $(skipdbg)"
+	@echo "ubuntu_log_opts   = $(ubuntu_log_opts)"
+ifneq ($(SUBLEVEL),)
+	@echo "SUBLEVEL          = $(SUBLEVEL)"
+endif
+	@echo "CONCURRENCY_LEVEL = $(CONCURRENCY_LEVEL)"
+
+printchanges:
+	@git log Ubuntu-$(release)-$(prev_revision)..HEAD | \
+		perl -w -f debian/scripts/misc/git-ubuntu-log $(ubuntu_log_opts)
+
+insertchanges:
+	@perl -w -f debian/scripts/misc/insert-changes.pl
+
+diffupstream:
+	@git diff-tree -p refs/remotes/linux-2.6/master..HEAD $(shell ls | grep -vE '^(ubuntu|debian|\.git.*)')
+
+startnewrelease:
+	dh_testdir
+	@nextminor=$(shell expr `echo $(revision) | awk -F. '{print $$2}'` + 1); \
+	now="$(shell date -R)"; \
+	echo "Creating new changelog set for $(abi_release).$$nextminor..."; \
+	echo -e "$(stub) ($(abi_release).$$nextminor) UNRELEASED; urgency=low\n" > debian/changelog.new; \
+	echo "  CHANGELOG: Do not edit directly. Autogenerated at release." >> \
+		debian/changelog.new; \
+	echo "  CHANGELOG: Use the printchanges target to see the curent changes." \
+		>> debian/changelog.new; \
+	echo "  CHANGELOG: Use the insertchanges target to create the final log." \
+		>> debian/changelog.new; \
+	echo -e "\n -- $$DEBFULLNAME <$$DEBEMAIL>  $$now\n" >> \
+		debian/changelog.new ; \
+	cat debian/changelog >> debian/changelog.new; \
+	mv debian/changelog.new debian/changelog
+#
+# If $(ppa_file) exists, then only the standard flavours are built for PPA, e.g.,
+# 386, 386-generic, and amd64-generic.
+#
+prepare-ppa:
+	@echo Execute debian/scripts/misc/prepare-ppa-source to prepare an upload
+	@echo for a PPA build. You must do this outside of debian/rules since it cannot
+	@echo nest.
+
+print-ppa-file-name:
+	@echo $(ppa_file)
--- linux-rt-2.6.31.orig/debian/rules.d/i386.mk
+++ linux-rt-2.6.31/debian/rules.d/i386.mk
@@ -0,0 +1,12 @@
+build_arch	= i386
+header_arch	= x86_64
+asm_link	= x86
+defconfig	= defconfig
+flavours        = rt
+build_image	= bzImage
+kernel_file	= arch/$(build_arch)/boot/bzImage
+install_file	= vmlinuz
+
+
+
+loader		= grub
--- linux-rt-2.6.31.orig/debian/rules.d/2-binary-arch.mk
+++ linux-rt-2.6.31/debian/rules.d/2-binary-arch.mk
@@ -0,0 +1,302 @@
+# We don't want make removing intermediary stamps
+.SECONDARY :
+
+# Unpack linux source package
+#unpack:
+#	@echo "Unpacking Ubuntu linux sources..."
+#	tar jxf /usr/src/linux-source-2.6.28.tar.bz2 -C $(CURDIR)/debian
+#	rm -fr $(CURDIR)/debian/linux-source-2.6.28/debian
+#	cp -a $(CURDIR)/debian/linux-source-2.6.28/* $(CURDIR)/
+#	rm -fr $(CURDIR)/debian/linux-source*
+#	touch $(stampdir)/stamp-unpack
+
+apply-patchset:
+	cd $(CURDIR); QUILT_PATCHES=$(CURDIR)/debian/patches quilt push -a
+
+deapply-patchset:
+	if [ -e $(CURDIR)/.pc ]; then \
+			cd $(CURDIR); QUILT_PATCHES=$(CURDIR)/debian/patches quilt pop -a; \
+	fi
+	rm -fr $(CURDIR)/localversion-rt
+	rm -fr $(CURDIR)/.pc
+
+# Prepare the out-of-tree build directory
+
+prepare-%: $(stampdir)/stamp-prepare-%
+	@# Empty for make to be happy
+$(stampdir)/stamp-prepare-%: target_flavour = $*
+$(stampdir)/stamp-prepare-%: $(confdir)/config $(confdir)/config.%
+	@echo "Preparing $*..."
+	install -d $(builddir)/build-$*
+	touch $(builddir)/build-$*/ubuntu-build
+	cat $^ | sed -e 's/.*CONFIG_VERSION_SIGNATURE.*/CONFIG_VERSION_SIGNATURE="Ubuntu $(release)-$(revision)-$*"/' > $(builddir)/build-$*/.config
+	find $(builddir)/build-$* -name "*.ko" | xargs rm -f
+	$(kmake) O=$(builddir)/build-$* silentoldconfig prepare scripts
+	touch $@
+
+
+# Do the actual build, including image and modules
+build-%: $(stampdir)/stamp-build-%
+	@# Empty for make to be happy
+$(stampdir)/stamp-build-%: target_flavour = $*
+$(stampdir)/stamp-build-%: $(stampdir)/stamp-prepare-%
+	@echo "Building $*..."
+	$(kmake) O=$(builddir)/build-$* $(conc_level) $(build_image)
+	$(kmake) O=$(builddir)/build-$* $(conc_level) modules
+	@touch $@
+
+# Install the finished build
+install-%: pkgdir = $(CURDIR)/debian/linux-image-$(abi_release)-$*
+install-%: dbgpkgdir = $(CURDIR)/debian/linux-image-debug-$(abi_release)-$*
+install-%: basepkg = linux-headers-$(abi_release)
+install-%: hdrdir = $(CURDIR)/debian/$(basepkg)-$*/usr/src/$(basepkg)-$*
+install-%: target_flavour = $*
+install-%: $(stampdir)/stamp-build-% checks-%
+	dh_testdir
+	dh_testroot
+	dh_clean -k -plinux-image-$(abi_release)-$*
+	dh_clean -k -plinux-headers-$(abi_release)-$*
+	dh_clean -k -plinux-image-debug-$(abi_release)-$*
+
+	# The main image
+	install -m644 -D $(builddir)/build-$*/$(kernel_file) \
+		$(pkgdir)/boot/$(install_file)-$(abi_release)-$*
+
+	install -m644 $(builddir)/build-$*/.config \
+		$(pkgdir)/boot/config-$(abi_release)-$*
+	install -m644 $(abidir)/$* \
+		$(pkgdir)/boot/abi-$(abi_release)-$*
+	install -m644 $(builddir)/build-$*/System.map \
+		$(pkgdir)/boot/System.map-$(abi_release)-$*
+ifeq ($(no_dumpfile),)
+	makedumpfile -g $(pkgdir)/boot/vmcoreinfo-$(abi_release)-$* \
+		-x $(builddir)/build-$*/vmlinux
+endif
+
+	$(kmake) O=$(builddir)/build-$* modules_install \
+		INSTALL_MOD_STRIP=1 INSTALL_MOD_PATH=$(pkgdir)/ \
+		INSTALL_FW_PATH=$(pkgdir)/lib/firmware/$(abi_release)-$*
+
+ifeq ($(no_dumpfile),)
+	makedumpfile -g $(pkgdir)/boot/vmcoreinfo-$(abi_release)-$* \
+		-x $(builddir)/build-$*/vmlinux
+endif
+	rm -f $(pkgdir)/lib/modules/$(abi_release)-$*/build
+	rm -f $(pkgdir)/lib/modules/$(abi_release)-$*/source
+
+	# Some initramfs-tools specific modules
+	install -d $(pkgdir)/lib/modules/$(abi_release)-$*/initrd
+	if [ -f $(pkgdir)/lib/modules/$(abi_release)-$*/kernel/drivers/video/vesafb.ko ]; then\
+	  ln -f $(pkgdir)/lib/modules/$(abi_release)-$*/kernel/drivers/video/vesafb.ko \
+		$(pkgdir)/lib/modules/$(abi_release)-$*/initrd/; \
+	fi
+
+	# Now the image scripts
+	install -d $(pkgdir)/DEBIAN
+	for script in postinst postrm preinst prerm; do				\
+	  sed -e 's/=V/$(abi_release)-$*/g' -e 's/=K/$(install_file)/g'		\
+	      -e 's/=L/$(loader)/g'         -e 's@=B@$(build_arch)@g'		\
+	       debian/control-scripts/$$script > $(pkgdir)/DEBIAN/$$script;	\
+	  chmod 755 $(pkgdir)/DEBIAN/$$script;					\
+	done
+
+ifneq ($(skipsub),true)
+	@set -e; for sub in $($(*)_sub); do					\
+		TO=$$sub FROM=$* ABI_RELEASE=$(abi_release) $(SHELL)		\
+			debian/scripts/sub-flavour;				\
+		/sbin/depmod -b debian/linux-image-$(abi_release)-$$sub		\
+			-ea -F debian/linux-image-$(abi_release)-$$sub/boot/System.map-$(abi_release)-$* \
+			$(abi_release)-$*;					\
+		install -d debian/linux-image-$(abi_release)-$$sub/DEBIAN;	\
+		for script in postinst postrm preinst prerm; do			\
+			sed -e 's/=V/$(abi_release)-$*/g'			\
+			    -e 's/=K/$(install_file)/g'				\
+			    -e 's/=L/$(loader)/g'				\
+			    -e 's@=B@$(build_arch)@g'				\
+				debian/control-scripts/$$script >		\
+				debian/linux-image-$(abi_release)-$$sub/DEBIAN/$$script;\
+			chmod 755  debian/linux-image-$(abi_release)-$$sub/DEBIAN/$$script;\
+		done;								\
+	done
+endif
+
+ifneq ($(skipdbg),true)
+	# Debug image is simple
+	install -m644 -D $(builddir)/build-$*/vmlinux \
+		$(dbgpkgdir)/usr/lib/debug/boot/vmlinux-$(abi_release)-$*
+	$(kmake) O=$(builddir)/build-$* modules_install \
+		INSTALL_MOD_PATH=$(dbgpkgdir)/usr/lib/debug
+	rm -f $(dbgpkgdir)/usr/lib/debug/lib/modules/$(abi_release)-$*/build
+	rm -f $(dbgpkgdir)/usr/lib/debug/lib/modules/$(abi_release)-$*/source
+	rm -f $(dbgpkgdir)/usr/lib/debug/lib/modules/$(abi_release)-$*/modules.*
+	rm -fr $(dbgpkgdir)/usr/lib/debug/lib/firmware
+endif
+
+	# The flavour specific headers image
+	# TODO: Would be nice if we didn't have to dupe the original builddir
+	install -d -m755 $(hdrdir)
+	cat $(builddir)/build-$*/.config | \
+		sed -e 's/.*CONFIG_DEBUG_INFO=.*/# CONFIG_DEBUG_INFO is not set/g' > \
+		$(hdrdir)/.config
+	chmod 644 $(hdrdir)/.config
+	$(kmake) O=$(hdrdir) silentoldconfig prepare scripts
+	# We'll symlink this stuff
+	rm -f $(hdrdir)/Makefile
+	rm -rf $(hdrdir)/include2
+	# Script to symlink everything up
+	$(SHELL) debian/scripts/link-headers "$(hdrdir)" "linux-rt-headers-$(release)-$(abinum)" "$*"
+	# Setup the proper asm symlink
+	rm -f $(hdrdir)/include/asm
+	ln -s asm-$(asm_link) $(hdrdir)/include/asm
+	# The build symlink
+	install -d debian/$(basepkg)-$*/lib/modules/$(abi_release)-$*
+	ln -s /usr/src/$(basepkg)-$* \
+		debian/$(basepkg)-$*/lib/modules/$(abi_release)-$*/build
+	# And finally the symvers
+	install -m644 $(builddir)/build-$*/Module.symvers \
+		$(hdrdir)/Module.symvers
+
+	# Now the header scripts
+	install -d $(CURDIR)/debian/$(basepkg)-$*/DEBIAN
+	for script in postinst; do						\
+	  sed -e 's/=V/$(abi_release)-$*/g' -e 's/=K/$(install_file)/g'	\
+		debian/control-scripts/headers-$$script > 			\
+			$(CURDIR)/debian/$(basepkg)-$*/DEBIAN/$$script;		\
+	  chmod 755 $(CURDIR)/debian/$(basepkg)-$*/DEBIAN/$$script;		\
+	done
+
+	# At the end of the package prep, call the tests
+	DPKG_ARCH="$(arch)" KERN_ARCH="$(build_arch)" FLAVOUR="$*"	\
+	 VERSION="$(abi_release)" REVISION="$(revision)"		\
+	 PREV_REVISION="$(prev_revision)" ABI_NUM="$(abinum)"		\
+	 PREV_ABI_NUM="$(prev_abinum)" BUILD_DIR="$(builddir)/build-$*"	\
+	 INSTALL_DIR="$(pkgdir)" SOURCE_DIR="$(CURDIR)"			\
+	 run-parts -v debian/tests
+
+	#
+	# Remove files which are generated at installation by postinst, except for
+	# modules.order.
+	#
+	mv $(pkgdir)/lib/modules/$(abi_release)-$*/modules.order \
+		$(pkgdir)/lib/modules/$(abi_release)-$*/_modules.order
+	rm -f $(pkgdir)/lib/modules/$(abi_release)-$*/modules.*
+	mv $(pkgdir)/lib/modules/$(abi_release)-$*/_modules.order \
+		$(pkgdir)/lib/modules/$(abi_release)-$*/modules.order
+
+headers_tmp := $(CURDIR)/debian/tmp-headers
+headers_dir := $(CURDIR)/debian/linux-libc-dev
+
+hmake := $(MAKE) -C $(CURDIR) O=$(headers_tmp) SUBLEVEL=$(SUBLEVEL) \
+	EXTRAVERSION=$(abinum) INSTALL_HDR_PATH=$(headers_tmp)/install \
+	SHELL="$(SHELL)" ARCH=$(header_arch)
+
+install-arch-headers:
+	dh_testdir
+	dh_testroot
+	dh_clean -k -plinux-libc-dev
+
+	rm -rf $(headers_tmp)
+	install -d $(headers_tmp) $(headers_dir)/usr/include/
+
+	$(hmake) $(defconfig)
+	mv $(headers_tmp)/.config $(headers_tmp)/.config.old
+	sed -e 's/^# \(CONFIG_MODVERSIONS\) is not set$$/\1=y/' \
+	  -e 's/.*CONFIG_LOCALVERSION_AUTO.*/# CONFIG_LOCALVERSION_AUTO is not set/' \
+	  $(headers_tmp)/.config.old > $(headers_tmp)/.config
+	$(hmake) silentoldconfig
+	$(hmake) headers_install
+
+	( cd $(headers_tmp)/install/include/ && \
+		find . -name '.' -o -name '.*' -prune -o -print | \
+                cpio -pvd --preserve-modification-time \
+			$(headers_dir)/usr/include/ )
+
+	rm -rf $(headers_tmp)
+
+binary-arch-headers: install-arch-headers
+	dh_testdir
+	dh_testroot
+
+	dh_installchangelogs -plinux-libc-dev
+	dh_installdocs -plinux-libc-dev
+	dh_compress -plinux-libc-dev
+	dh_fixperms -plinux-libc-dev
+	dh_installdeb -plinux-libc-dev
+	dh_gencontrol -plinux-libc-dev
+	dh_md5sums -plinux-libc-dev
+	dh_builddeb -plinux-libc-dev
+
+binary-%: pkgimg = linux-image-$(abi_release)-$*
+binary-%: pkghdr = linux-headers-$(abi_release)-$*
+binary-%: dbgpkg = linux-image-debug-$(abi_release)-$*
+binary-%: install-%
+	dh_testdir
+	dh_testroot
+
+	dh_installchangelogs -p$(pkgimg)
+	dh_installdocs -p$(pkgimg)
+	dh_compress -p$(pkgimg)
+	dh_fixperms -p$(pkgimg)
+	dh_installdeb -p$(pkgimg)
+	dh_gencontrol -p$(pkgimg)
+	dh_md5sums -p$(pkgimg)
+	dh_builddeb -p$(pkgimg) -- -Zbzip2 -z9
+
+	dh_installchangelogs -p$(pkghdr)
+	dh_installdocs -p$(pkghdr)
+	dh_compress -p$(pkghdr)
+	dh_fixperms -p$(pkghdr)
+	dh_shlibdeps -p$(pkghdr)
+	dh_installdeb -p$(pkghdr)
+	dh_gencontrol -p$(pkghdr)
+	dh_md5sums -p$(pkghdr)
+	dh_builddeb -p$(pkghdr)
+
+ifneq ($(skipsub),true)
+	@set -e; for sub in $($(*)_sub); do		\
+		pkg=linux-image-$(abi_release)-$$sub;	\
+		dh_installchangelogs -p$$pkg;		\
+		dh_installdocs -p$$pkg;			\
+		dh_compress -p$$pkg;			\
+		dh_fixperms -p$$pkg;			\
+		dh_shlibdeps -p$$pkg;			\
+		dh_installdeb -p$$pkg;			\
+		dh_gencontrol -p$$pkg;			\
+		dh_md5sums -p$$pkg;			\
+		dh_builddeb -p$$pkg;			\
+	done
+endif
+
+ifneq ($(skipdbg),true)
+	dh_installchangelogs -p$(dbgpkg)
+	dh_installdocs -p$(dbgpkg)
+	dh_compress -p$(dbgpkg)
+	dh_fixperms -p$(dbgpkg)
+	dh_installdeb -p$(dbgpkg)
+	dh_gencontrol -p$(dbgpkg)
+	dh_md5sums -p$(dbgpkg)
+	dh_builddeb -p$(dbgpkg)
+
+	# Hokay...here's where we do a little twiddling...
+	mv ../$(dbgpkg)_$(release)-$(revision)_$(arch).deb \
+		../$(dbgpkg)_$(release)-$(revision)_$(arch).ddeb
+	grep -v '^$(dbgpkg)_.*$$' debian/files > debian/files.new
+	mv debian/files.new debian/files
+	# Now, the package wont get into the archive, but it will get put
+	# into the debug system.
+endif
+
+$(stampdir)/stamp-flavours:
+	@echo $(flavours) > $@
+
+#binary-debs: $(stampdir)/stamp-flavours $(addprefix binary-,$(flavours)) \
+#		binary-arch-headers
+binary-debs: $(stampdir)/stamp-flavours $(addprefix binary-,$(flavours))
+
+build-arch: $(addprefix build-,$(flavours))
+
+binary-arch-deps = binary-debs
+#ifeq ($(AUTOBUILD),)
+#binary-arch-deps += binary-udebs
+#endif
+binary-arch: $(binary-arch-deps)
--- linux-rt-2.6.31.orig/debian/rules.d/amd64.mk
+++ linux-rt-2.6.31/debian/rules.d/amd64.mk
@@ -0,0 +1,12 @@
+build_arch	= x86_64
+header_arch	= $(build_arch)
+asm_link	= x86
+defconfig	= defconfig
+flavours	= rt
+build_image	= bzImage
+kernel_file	= arch/$(build_arch)/boot/bzImage
+install_file	= vmlinuz
+
+
+
+loader		= grub
--- linux-rt-2.6.31.orig/debian/rules.d/3-binary-indep.mk
+++ linux-rt-2.6.31/debian/rules.d/3-binary-indep.mk
@@ -0,0 +1,89 @@
+build-indep:
+
+docpkg = linux-doc-$(release)
+docdir = $(CURDIR)/debian/$(docpkg)/usr/share/doc/$(docpkg)
+install-doc:
+	dh_testdir
+	dh_testroot
+	dh_clean -k -p$(docpkg)
+
+	install -d $(docdir)
+
+	# First the html docs. We skip these for autobuilds
+	if [ -z "$(AUTOBUILD) nobuild" ]; then \
+		install -d $(docdir)/linux-doc-tmp; \
+		$(kmake) O=$(docdir)/linux-doc-tmp htmldocs; \
+		mv $(docdir)/linux-doc-tmp/Documentation/DocBook \
+			$(docdir)/html; \
+		rm -rf $(docdir)/linux-doc-tmp; \
+	fi
+
+	# Copy the rest
+	cp -a Documentation/* $(docdir)
+	rm -rf $(docdir)/DocBook
+
+indep_hdrpkg = linux-rt-headers-$(abi_release)
+indep_hdrdir = $(CURDIR)/debian/$(indep_hdrpkg)/usr/src/$(indep_hdrpkg)
+install-headers:
+	dh_testdir
+	dh_testroot
+	dh_clean -k -p$(indep_hdrpkg)
+
+	install -d $(indep_hdrdir)
+	find . -path './debian/*' -prune -o -path './include/*' -prune \
+	  -o -path './scripts/*' -prune -o -type f \
+	  \( -name 'Makefile*' -o -name 'Kconfig*' -o -name 'Kbuild*' -o \
+	     -name '*.sh' -o -name '*.pl' -o -name '*.lds' \) \
+	  -print | cpio -pd --preserve-modification-time $(indep_hdrdir)
+	cp -a drivers/media/dvb/dvb-core/*.h $(indep_hdrdir)/drivers/media/dvb/dvb-core
+	cp -a drivers/media/video/*.h $(indep_hdrdir)/drivers/media/video
+	cp -a drivers/media/dvb/frontends/*.h $(indep_hdrdir)/drivers/media/dvb/frontends
+	cp -a scripts include $(indep_hdrdir)
+	(find arch -name include -type d -print | \
+		xargs -n1 -i: find : -type f) | \
+		cpio -pd --preserve-modification-time $(indep_hdrdir)
+
+srcpkg = linux-rt-source-$(release)
+srcdir = $(CURDIR)/debian/$(srcpkg)/usr/src/$(srcpkg)
+install-source:
+	dh_testdir
+	dh_testroot
+	dh_clean -k -p$(srcpkg)
+
+	install -d $(srcdir)
+	find . -path './debian/*' -prune -o \
+		-path './.*' -prune -o -print | \
+		cpio -pd --preserve-modification-time $(srcdir)
+	(cd $(srcdir)/..; tar cf - $(srcpkg)) | bzip2 -9c > \
+		$(srcdir).tar.bz2
+	rm -rf $(srcdir)
+
+#install-indep: install-headers install-doc install-source
+install-indep: install-headers
+
+# This is just to make it easy to call manually. Normally done in
+# binary-indep target during builds.
+binary-headers: install-headers
+	dh_testdir
+	dh_testroot
+	dh_installchangelogs -p$(indep_hdrpkg)
+	dh_installdocs -p$(indep_hdrpkg)
+	dh_compress -p$(indep_hdrpkg)
+	dh_fixperms -p$(indep_hdrpkg)
+	dh_installdeb -p$(indep_hdrpkg)
+	dh_gencontrol -p$(indep_hdrpkg)
+	dh_md5sums -p$(indep_hdrpkg)
+	dh_builddeb -p$(indep_hdrpkg)
+
+binary-indep: install-indep
+	dh_testdir
+	dh_testroot
+
+	dh_installchangelogs -i
+	dh_installdocs -i
+	dh_compress -i
+	dh_fixperms -i
+	dh_installdeb -i
+	dh_gencontrol -i
+	dh_md5sums -i
+	dh_builddeb -i
--- linux-rt-2.6.31.orig/debian/rules.d/0-common-vars.mk
+++ linux-rt-2.6.31/debian/rules.d/0-common-vars.mk
@@ -0,0 +1,107 @@
+# Get some version info
+stub=linux-rt
+
+release := $(shell sed -n '1s/^.*(\(.*\)-.*).*$$/\1/p' debian/changelog)
+revisions := $(shell sed -n 's/^$(stub)\ .*($(release)-\(.*\)).*$$/\1/p' debian/changelog | tac)
+revision ?= $(word $(words $(revisions)),$(revisions))
+prev_revisions := $(filter-out $(revision),0.0 $(revisions))
+prev_revision := $(word $(words $(prev_revisions)),$(prev_revisions))
+
+# disable udeb building
+disable_di = true
+
+# This is an internally used mechanism for the daily kernel builds. It
+# creates packages who's ABI is suffixed with a minimal representation of
+# the current git HEAD sha. If .git/HEAD is not present, then it uses the
+# uuidgen program,
+#
+# AUTOBUILD can also be used by anyone wanting to build a custom kernel
+# image, or rebuild the entire set of Ubuntu packages using custom patches
+# or configs.
+AUTOBUILD=
+
+#
+# This is a way to support some external variables. A good example is
+# a local setup for ccache and distcc See LOCAL_ENV_CC and
+# LOCAL_ENV_DISTCC_HOSTS in the definition of kmake.
+# For example:
+#      LOCAL_ENV_CC="ccache distcc"
+#      LOCAL_ENV_DISTCC_HOSTS="localhost 10.0.2.5 10.0.2.221"
+#
+-include $(CURDIR)/../.jaunty-env
+
+ifneq ($(AUTOBUILD),)
+skipabi		= true
+skipmodule	= true
+skipdbg		= true
+gitver=$(shell if test -f .git/HEAD; then cat .git/HEAD; else uuidgen; fi)
+gitverpre=$(shell echo $(gitver) | cut -b -3)
+gitverpost=$(shell echo $(gitver) | cut -b 38-40)
+abi_suffix = -$(gitverpre)$(gitverpost)
+endif
+
+ifneq ($(NOKERNLOG),)
+ubuntu_log_opts += --no-kern-log
+endif
+ifneq ($(PRINTSHAS),)
+ubuntu_log_opts += --print-shas
+endif
+
+ifeq ($(wildcard /CurrentlyBuilding),)
+skipdbg=true
+endif
+
+abinum		:= $(shell echo $(revision) | sed -e 's/\..*//')$(abi_suffix)
+prev_abinum	:= $(shell echo $(prev_revision) | sed -e 's/\..*//')$(abi_suffix)
+
+abi_release	:= $(release)-$(abinum)
+
+uploadnum	:= $(shell echo $(revision) | sed -e 's/.*\.//')
+ifneq ($(wildcard /CurrentlyBuilding),)
+  uploadnum	:= $(uploadnum)-Ubuntu
+endif
+
+# We force the sublevel to be exactly what we want. The actual source may
+# be an in development git tree. We want to force it here instead of
+# committing changes to the top level Makefile
+SUBLEVEL	:= $(shell echo $(release) | awk -F. '{print $$3}')
+
+arch		:= $(shell dpkg-architecture -qDEB_HOST_ARCH)
+abidir		:= $(CURDIR)/debian/abi/$(release)-$(revision)/$(arch)
+prev_abidir	:= $(CURDIR)/debian/abi/$(release)-$(prev_revision)/$(arch)
+confdir		:= $(CURDIR)/debian/config/$(arch)
+builddir	:= $(CURDIR)/debian/build
+stampdir	:= $(CURDIR)/debian/stamps
+
+# Support parallel=<n> in DEB_BUILD_OPTIONS (see #209008)
+COMMA=,
+DEB_BUILD_OPTIONS_PARA = $(subst parallel=,,$(filter parallel=%,$(subst $(COMMA), ,$(DEB_BUILD_OPTIONS))))
+ifneq (,$(DEB_BUILD_OPTIONS_PARA))
+  CONCURRENCY_LEVEL := $(DEB_BUILD_OPTIONS_PARA)
+endif
+
+ifeq ($(CONCURRENCY_LEVEL),)
+  # Check the environment
+  CONCURRENCY_LEVEL := $(shell echo $$CONCURRENCY_LEVEL)
+  # No? Check if this is on a buildd
+  ifeq ($(CONCURRENCY_LEVEL),)
+    ifeq ($(wildcard /CurrentlyBuilding),)
+      CONCURRENCY_LEVEL := $(shell expr `getconf _NPROCESSORS_ONLN` \* 2)
+    endif
+  endif
+  # Oh hell, give 'em one
+  ifeq ($(CONCURRENCY_LEVEL),)
+    CONCURRENCY_LEVEL := 1
+  endif
+endif
+
+conc_level		= -j$(CONCURRENCY_LEVEL)
+
+# target_flavour is filled in for each step
+kmake = make ARCH=$(build_arch) \
+	EXTRAVERSION=-$(abinum)-$(target_flavour) \
+	CONFIG_DEBUG_SECTION_MISMATCH=y SUBLEVEL=$(SUBLEVEL) \
+ 	KBUILD_BUILD_VERSION="$(uploadnum)"
+ifneq ($(LOCAL_ENV_CC),)
+kmake += CC=$(LOCAL_ENV_CC) DISTCC_HOSTS=$(LOCAL_ENV_DISTCC_HOSTS)
+endif
--- linux-rt-2.6.31.orig/debian/rules.d/4-checks.mk
+++ linux-rt-2.6.31/debian/rules.d/4-checks.mk
@@ -0,0 +1,26 @@
+# Check ABI for package against last release (if not same abinum)
+abi-%: $(abidir)/%
+	@# Empty for make to be happy
+$(abidir)/%: $(stampdir)/stamp-build-%
+	install -d $(abidir)
+	sed -e 's/^\(.\+\)[[:space:]]\+\(.\+\)[[:space:]]\(.\+\)$$/\3 \2 \1/'	\
+		$(builddir)/build-$*/Module.symvers | sort > $@
+
+abi-check-%: $(abidir)/%
+	@perl -f debian/scripts/abi-check "$*" "$(prev_abinum)" "$(abinum)" \
+		"$(prev_abidir)" "$(abidir)" "$(skipabi)"
+
+# Check the module list against the last release (always)
+module-%: $(abidir)/%.modules
+	@# Empty for make to be happy
+$(abidir)/%.modules: $(stampdir)/stamp-build-%
+	install -d $(abidir)
+	find $(builddir)/build-$*/ -name \*.ko | \
+		sed -e 's/.*\/\([^\/]*\)\.ko/\1/' | sort > $@
+
+module-check-%: $(abidir)/%.modules
+	@perl -f debian/scripts/module-check "$*" \
+		"$(prev_abidir)" "$(abidir)" $(skipmodule)
+
+checks-%: abi-check-% module-check-%
+	@# Will be calling more stuff later
--- linux-rt-2.6.31.orig/debian/rules.d/5-udebs.mk
+++ linux-rt-2.6.31/debian/rules.d/5-udebs.mk
@@ -0,0 +1,33 @@
+# Do udebs if not disabled in the arch-specific makefile
+binary-udebs: binary-debs debian/control
+ifeq ($(disable_d_i),)
+	debian/rules do-binary-udebs;
+endif
+
+do-binary-udebs:
+	dh_testdir
+	dh_testroot
+
+	# unpack the kernels into a temporary directory
+	mkdir -p debian/d-i-${arch}
+
+	imagelist=$$(cat kernel-versions | grep ^${arch} | awk '{print $$4}') && \
+	for i in $$imagelist; do \
+	  dpkg -x $$(ls ../linux-image-$$i\_$(release)-$(revision)_${arch}.deb) \
+		debian/d-i-${arch}; \
+	  /sbin/depmod -b debian/d-i-${arch} $$i; \
+	done
+
+	touch ignore-dups
+	export SOURCEDIR=debian/d-i-${arch} && \
+	  kernel-wedge install-files && \
+	  kernel-wedge check
+
+        # Build just the udebs
+	dilist=$$(dh_listpackages -s | grep "\-di$$") && \
+	[ -z "$dilist" ] || \
+	for i in $$dilist; do \
+	  dh_fixperms -p$$i; \
+	  dh_gencontrol -p$$i; \
+	  dh_builddeb -p$$i; \
+	done
--- linux-rt-2.6.31.orig/debian/config/amd64/config.rt
+++ linux-rt-2.6.31/debian/config/amd64/config.rt
@@ -0,0 +1,3 @@
+#
+# Config options for config.rt automatically generated by splitconfig.pl
+#
--- linux-rt-2.6.31.orig/debian/config/amd64/config
+++ linux-rt-2.6.31/debian/config/amd64/config
@@ -0,0 +1,4069 @@
+#
+# Common config options automatically generated by splitconfig.pl
+#
+CONFIG_3C359=m
+CONFIG_60XX_WDT=m
+CONFIG_64BIT=y
+CONFIG_6PACK=m
+CONFIG_8139CP=m
+CONFIG_8139TOO=m
+CONFIG_8139TOO_8129=y
+CONFIG_8139TOO_PIO=y
+# CONFIG_8139TOO_TUNE_TWISTER is not set
+# CONFIG_8139_OLD_RX_RESET is not set
+CONFIG_9P_FS=m
+CONFIG_AB3100_CORE=m
+CONFIG_ABYSS=m
+CONFIG_AC97_BUS=m
+# CONFIG_ACCESSIBILITY is not set
+CONFIG_ACENIC=m
+# CONFIG_ACENIC_OMIT_TIGON_I is not set
+CONFIG_ACERHDF=m
+CONFIG_ACER_WMI=m
+CONFIG_ACORN_PARTITION=y
+# CONFIG_ACORN_PARTITION_ADFS is not set
+# CONFIG_ACORN_PARTITION_CUMANA is not set
+# CONFIG_ACORN_PARTITION_EESOX is not set
+CONFIG_ACORN_PARTITION_ICS=y
+# CONFIG_ACORN_PARTITION_POWERTEC is not set
+CONFIG_ACORN_PARTITION_RISCIX=y
+CONFIG_ACPI=y
+CONFIG_ACPI_AC=y
+# CONFIG_ACPI_ASUS is not set
+CONFIG_ACPI_BATTERY=y
+CONFIG_ACPI_BLACKLIST_YEAR=0
+CONFIG_ACPI_BUTTON=y
+CONFIG_ACPI_CONTAINER=y
+# CONFIG_ACPI_CUSTOM_DSDT is not set
+CONFIG_ACPI_CUSTOM_DSDT_FILE=""
+# CONFIG_ACPI_DEBUG is not set
+CONFIG_ACPI_DOCK=y
+CONFIG_ACPI_FAN=y
+CONFIG_ACPI_HOTPLUG_CPU=y
+CONFIG_ACPI_NUMA=y
+CONFIG_ACPI_PCI_SLOT=y
+CONFIG_ACPI_PROCESSOR=y
+CONFIG_ACPI_PROCFS=y
+CONFIG_ACPI_PROCFS_POWER=y
+CONFIG_ACPI_PROC_EVENT=y
+CONFIG_ACPI_SBS=y
+CONFIG_ACPI_SLEEP=y
+CONFIG_ACPI_SYSFS_POWER=y
+CONFIG_ACPI_THERMAL=y
+CONFIG_ACPI_TOSHIBA=m
+CONFIG_ACPI_VIDEO=m
+CONFIG_ACPI_WMI=y
+CONFIG_ACQUIRE_WDT=m
+CONFIG_ACT200L_DONGLE=m
+CONFIG_ACTISYS_DONGLE=m
+CONFIG_ADAPTEC_STARFIRE=m
+CONFIG_ADFS_FS=m
+# CONFIG_ADFS_FS_RW is not set
+CONFIG_ADM8211=m
+CONFIG_ADVANTECH_WDT=m
+CONFIG_AFFS_FS=m
+# CONFIG_AFS_DEBUG is not set
+CONFIG_AFS_FS=m
+# CONFIG_AFS_FSCACHE is not set
+CONFIG_AF_RXRPC=m
+# CONFIG_AF_RXRPC_DEBUG is not set
+CONFIG_AGNX=m
+CONFIG_AGP=y
+CONFIG_AGP_AMD64=y
+CONFIG_AGP_INTEL=m
+CONFIG_AGP_SIS=m
+CONFIG_AGP_VIA=m
+CONFIG_AIC79XX_CMDS_PER_DEVICE=32
+CONFIG_AIC79XX_DEBUG_ENABLE=y
+CONFIG_AIC79XX_DEBUG_MASK=0
+CONFIG_AIC79XX_REG_PRETTY_PRINT=y
+CONFIG_AIC79XX_RESET_DELAY_MS=5000
+CONFIG_AIC7XXX_CMDS_PER_DEVICE=8
+CONFIG_AIC7XXX_DEBUG_ENABLE=y
+CONFIG_AIC7XXX_DEBUG_MASK=0
+CONFIG_AIC7XXX_REG_PRETTY_PRINT=y
+CONFIG_AIC7XXX_RESET_DELAY_MS=15000
+# CONFIG_AIC94XX_DEBUG is not set
+CONFIG_AIO=y
+CONFIG_AIRO=m
+CONFIG_AIRO_CS=m
+CONFIG_ALIM1535_WDT=m
+CONFIG_ALIM7101_WDT=m
+CONFIG_ALI_FIR=m
+CONFIG_ALTERA_PCIE_CHDMA=m
+CONFIG_AMD8111_ETH=m
+CONFIG_AMD_IOMMU=y
+CONFIG_AMD_IOMMU_STATS=y
+CONFIG_AMIGA_PARTITION=y
+CONFIG_ANDROID=y
+CONFIG_ANDROID_BINDER_IPC=y
+CONFIG_ANDROID_LOGGER=m
+# CONFIG_ANDROID_LOW_MEMORY_KILLER is not set
+# CONFIG_ANDROID_RAM_CONSOLE is not set
+CONFIG_ANDROID_TIMED_GPIO=m
+CONFIG_ANDROID_TIMED_OUTPUT=y
+CONFIG_ANON_INODES=y
+CONFIG_APPLICOM=m
+CONFIG_AR9170_LEDS=y
+CONFIG_AR9170_USB=m
+CONFIG_ARCH_DEFCONFIG="arch/x86/configs/x86_64_defconfig"
+CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG=y
+CONFIG_ARCH_HAS_CACHE_LINE_SIZE=y
+CONFIG_ARCH_HAS_CPU_IDLE_WAIT=y
+CONFIG_ARCH_HAS_CPU_RELAX=y
+CONFIG_ARCH_HAS_DEFAULT_IDLE=y
+CONFIG_ARCH_HIBERNATION_HEADER=y
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARCH_MAY_HAVE_PC_FDC=y
+CONFIG_ARCH_PHYS_ADDR_T_64BIT=y
+CONFIG_ARCH_POPULATES_NODE_MAP=y
+CONFIG_ARCH_SELECT_MEMORY_MODEL=y
+CONFIG_ARCH_SPARSEMEM_DEFAULT=y
+CONFIG_ARCH_SPARSEMEM_ENABLE=y
+CONFIG_ARCH_SUPPORTS_DEBUG_PAGEALLOC=y
+CONFIG_ARCH_SUPPORTS_MSI=y
+CONFIG_ARCH_SUPPORTS_OPTIMIZED_INLINING=y
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_ARCH_WANT_FRAME_POINTERS=y
+CONFIG_ARCH_WANT_OPTIONAL_GPIOLIB=y
+CONFIG_ARCNET=m
+CONFIG_ARCNET_1051=m
+CONFIG_ARCNET_1201=m
+CONFIG_ARCNET_CAP=m
+CONFIG_ARCNET_COM20020=m
+CONFIG_ARCNET_COM20020_CS=m
+CONFIG_ARCNET_COM20020_PCI=m
+CONFIG_ARCNET_COM90xx=m
+CONFIG_ARCNET_COM90xxIO=m
+CONFIG_ARCNET_RAW=m
+CONFIG_ARCNET_RIM_I=m
+# CONFIG_ARPD is not set
+CONFIG_ASK_IP_FIB_HASH=y
+CONFIG_ASM_SEMAPHORES=y
+CONFIG_ASUS_LAPTOP=m
+CONFIG_ASUS_OLED=m
+CONFIG_ASYNC_CORE=m
+CONFIG_ASYNC_MEMCPY=m
+# CONFIG_ASYNC_TX_DMA is not set
+CONFIG_ASYNC_XOR=m
+CONFIG_AT76C50X_USB=m
+CONFIG_ATA=y
+CONFIG_ATALK=m
+CONFIG_ATARI_PARTITION=y
+CONFIG_ATA_ACPI=y
+CONFIG_ATA_GENERIC=y
+# CONFIG_ATA_NONSTANDARD is not set
+CONFIG_ATA_OVER_ETH=m
+CONFIG_ATA_PIIX=y
+CONFIG_ATA_SFF=y
+CONFIG_ATH5K=m
+# CONFIG_ATH5K_DEBUG is not set
+CONFIG_ATH9K=m
+CONFIG_ATH9K_DEBUG=y
+CONFIG_ATH_COMMON=m
+CONFIG_ATL1=m
+CONFIG_ATL1C=m
+CONFIG_ATL1E=m
+CONFIG_ATL2=m
+CONFIG_ATM=m
+CONFIG_ATMEL=m
+CONFIG_ATM_AMBASSADOR=m
+# CONFIG_ATM_AMBASSADOR_DEBUG is not set
+CONFIG_ATM_BR2684=m
+# CONFIG_ATM_BR2684_IPFILTER is not set
+CONFIG_ATM_CLIP=m
+# CONFIG_ATM_CLIP_NO_ICMP is not set
+CONFIG_ATM_DRIVERS=y
+# CONFIG_ATM_DUMMY is not set
+CONFIG_ATM_ENI=m
+# CONFIG_ATM_ENI_DEBUG is not set
+# CONFIG_ATM_ENI_TUNE_BURST is not set
+CONFIG_ATM_FIRESTREAM=m
+CONFIG_ATM_FORE200E=m
+CONFIG_ATM_FORE200E_DEBUG=0
+CONFIG_ATM_FORE200E_TX_RETRY=16
+# CONFIG_ATM_FORE200E_USE_TASKLET is not set
+CONFIG_ATM_HE=m
+CONFIG_ATM_HE_USE_SUNI=y
+CONFIG_ATM_HORIZON=m
+# CONFIG_ATM_HORIZON_DEBUG is not set
+CONFIG_ATM_IA=m
+# CONFIG_ATM_IA_DEBUG is not set
+CONFIG_ATM_IDT77252=m
+# CONFIG_ATM_IDT77252_DEBUG is not set
+# CONFIG_ATM_IDT77252_RCV_ALL is not set
+CONFIG_ATM_IDT77252_USE_SUNI=y
+CONFIG_ATM_LANAI=m
+CONFIG_ATM_LANE=m
+CONFIG_ATM_MPOA=m
+CONFIG_ATM_SOLOS=m
+CONFIG_ATM_TCP=m
+CONFIG_ATM_ZATM=m
+# CONFIG_ATM_ZATM_DEBUG is not set
+CONFIG_ATP=m
+CONFIG_AUDIT=y
+CONFIG_AUDITSYSCALL=y
+CONFIG_AUDIT_ARCH=y
+CONFIG_AUDIT_TREE=y
+CONFIG_AUFS_BDEV_LOOP=y
+# CONFIG_AUFS_BRANCH_MAX_1023 is not set
+CONFIG_AUFS_BRANCH_MAX_127=y
+# CONFIG_AUFS_BRANCH_MAX_32767 is not set
+# CONFIG_AUFS_BRANCH_MAX_511 is not set
+CONFIG_AUFS_BR_FUSE=y
+CONFIG_AUFS_BR_RAMFS=y
+# CONFIG_AUFS_DEBUG is not set
+# CONFIG_AUFS_EXPORT is not set
+CONFIG_AUFS_FS=m
+CONFIG_AUFS_HINOTIFY=y
+CONFIG_AUFS_POLL=y
+# CONFIG_AUFS_SHWH is not set
+CONFIG_AUTOFS4_FS=m
+CONFIG_AUTOFS_FS=m
+CONFIG_AUXDISPLAY=y
+CONFIG_AVERATEC_5100P=m
+CONFIG_AX25=m
+CONFIG_AX25_DAMA_SLAVE=y
+CONFIG_B3DFG=m
+CONFIG_B43=m
+CONFIG_B43LEGACY=m
+CONFIG_B43LEGACY_DEBUG=y
+CONFIG_B43LEGACY_DMA=y
+CONFIG_B43LEGACY_DMA_AND_PIO_MODE=y
+# CONFIG_B43LEGACY_DMA_MODE is not set
+CONFIG_B43LEGACY_HWRNG=y
+CONFIG_B43LEGACY_LEDS=y
+CONFIG_B43LEGACY_PCICORE_AUTOSELECT=y
+CONFIG_B43LEGACY_PCI_AUTOSELECT=y
+CONFIG_B43LEGACY_PIO=y
+# CONFIG_B43LEGACY_PIO_MODE is not set
+# CONFIG_B43_DEBUG is not set
+CONFIG_B43_HWRNG=y
+CONFIG_B43_LEDS=y
+CONFIG_B43_PCICORE_AUTOSELECT=y
+CONFIG_B43_PCI_AUTOSELECT=y
+# CONFIG_B43_PCMCIA is not set
+CONFIG_B44=m
+CONFIG_B44_PCI=y
+CONFIG_B44_PCICORE_AUTOSELECT=y
+CONFIG_B44_PCI_AUTOSELECT=y
+CONFIG_BACKLIGHT_CARILLO_RANCH=m
+CONFIG_BACKLIGHT_CLASS_DEVICE=y
+CONFIG_BACKLIGHT_DA903X=m
+CONFIG_BACKLIGHT_GENERIC=m
+CONFIG_BACKLIGHT_LCD_SUPPORT=y
+CONFIG_BACKLIGHT_MBP_NVIDIA=m
+CONFIG_BACKLIGHT_PROGEAR=m
+CONFIG_BACKLIGHT_SAHARA=m
+# CONFIG_BACKTRACE_SELF_TEST is not set
+CONFIG_BASE_FULL=y
+CONFIG_BASE_SMALL=0
+CONFIG_BATTERY_BQ27x00=m
+CONFIG_BATTERY_DA9030=m
+CONFIG_BATTERY_DS2760=m
+CONFIG_BATTERY_DS2782=m
+CONFIG_BATTERY_MAX17040=m
+CONFIG_BAYCOM_PAR=m
+CONFIG_BAYCOM_SER_FDX=m
+CONFIG_BAYCOM_SER_HDX=m
+CONFIG_BE2NET=m
+# CONFIG_BEFS_DEBUG is not set
+CONFIG_BEFS_FS=m
+CONFIG_BFS_FS=m
+CONFIG_BINARY_PRINTF=y
+CONFIG_BINFMT_ELF=y
+CONFIG_BINFMT_MISC=m
+CONFIG_BITREVERSE=y
+CONFIG_BLK_CPQ_CISS_DA=m
+CONFIG_BLK_CPQ_DA=m
+CONFIG_BLK_DEV=y
+CONFIG_BLK_DEV_3W_XXXX_RAID=m
+# CONFIG_BLK_DEV_BSG is not set
+CONFIG_BLK_DEV_COMPCACHE=m
+# CONFIG_BLK_DEV_COMPCACHE_DEBUG is not set
+# CONFIG_BLK_DEV_COMPCACHE_STATS is not set
+# CONFIG_BLK_DEV_COW_COMMON is not set
+CONFIG_BLK_DEV_CRYPTOLOOP=m
+CONFIG_BLK_DEV_DAC960=m
+CONFIG_BLK_DEV_DM=y
+CONFIG_BLK_DEV_DRBD=m
+CONFIG_BLK_DEV_FD=m
+# CONFIG_BLK_DEV_HD is not set
+CONFIG_BLK_DEV_INITRD=y
+CONFIG_BLK_DEV_INTEGRITY=y
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_MD=y
+CONFIG_BLK_DEV_NBD=m
+CONFIG_BLK_DEV_OSD=m
+CONFIG_BLK_DEV_RAM=y
+CONFIG_BLK_DEV_RAM_COUNT=16
+CONFIG_BLK_DEV_RAM_SIZE=65536
+CONFIG_BLK_DEV_SD=y
+CONFIG_BLK_DEV_SR=y
+# CONFIG_BLK_DEV_SR_VENDOR is not set
+CONFIG_BLK_DEV_SX8=m
+# CONFIG_BLK_DEV_UB is not set
+CONFIG_BLK_DEV_UMEM=m
+# CONFIG_BLK_DEV_XIP is not set
+CONFIG_BLOCK=y
+CONFIG_BLOCK_COMPAT=y
+CONFIG_BNX2=m
+CONFIG_BNX2X=m
+CONFIG_BONDING=m
+# CONFIG_BOOTPARAM_HUNG_TASK_PANIC is not set
+CONFIG_BOOTPARAM_HUNG_TASK_PANIC_VALUE=0
+# CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC is not set
+CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC_VALUE=0
+# CONFIG_BOOT_PRINTK_DELAY is not set
+CONFIG_BOUNCE=y
+CONFIG_BPQETHER=m
+CONFIG_BRIDGE=m
+CONFIG_BRIDGE_EBT_802_3=m
+CONFIG_BRIDGE_EBT_AMONG=m
+CONFIG_BRIDGE_EBT_ARP=m
+CONFIG_BRIDGE_EBT_ARPREPLY=m
+CONFIG_BRIDGE_EBT_BROUTE=m
+CONFIG_BRIDGE_EBT_DNAT=m
+CONFIG_BRIDGE_EBT_IP=m
+CONFIG_BRIDGE_EBT_IP6=m
+CONFIG_BRIDGE_EBT_LIMIT=m
+CONFIG_BRIDGE_EBT_LOG=m
+CONFIG_BRIDGE_EBT_MARK=m
+CONFIG_BRIDGE_EBT_MARK_T=m
+CONFIG_BRIDGE_EBT_NFLOG=m
+CONFIG_BRIDGE_EBT_PKTTYPE=m
+CONFIG_BRIDGE_EBT_REDIRECT=m
+CONFIG_BRIDGE_EBT_SNAT=m
+CONFIG_BRIDGE_EBT_STP=m
+CONFIG_BRIDGE_EBT_T_FILTER=m
+CONFIG_BRIDGE_EBT_T_NAT=m
+CONFIG_BRIDGE_EBT_ULOG=m
+CONFIG_BRIDGE_EBT_VLAN=m
+CONFIG_BRIDGE_NETFILTER=y
+CONFIG_BRIDGE_NF_EBTABLES=m
+CONFIG_BROADCOM_PHY=y
+CONFIG_BSD_DISKLABEL=y
+CONFIG_BSD_PROCESS_ACCT=y
+CONFIG_BSD_PROCESS_ACCT_V3=y
+CONFIG_BT=y
+CONFIG_BTRFS_FS=m
+CONFIG_BTRFS_FS_POSIX_ACL=y
+CONFIG_BT_BNEP=m
+CONFIG_BT_BNEP_MC_FILTER=y
+CONFIG_BT_BNEP_PROTO_FILTER=y
+CONFIG_BT_CMTP=m
+CONFIG_BT_HCIBCM203X=m
+CONFIG_BT_HCIBFUSB=m
+CONFIG_BT_HCIBLUECARD=m
+CONFIG_BT_HCIBPA10X=m
+CONFIG_BT_HCIBT3C=m
+CONFIG_BT_HCIBTSDIO=m
+CONFIG_BT_HCIBTUART=m
+CONFIG_BT_HCIBTUSB=m
+CONFIG_BT_HCIDTL1=m
+CONFIG_BT_HCIUART=m
+CONFIG_BT_HCIUART_BCSP=y
+CONFIG_BT_HCIUART_H4=y
+CONFIG_BT_HCIUART_LL=y
+CONFIG_BT_HCIVHCI=m
+CONFIG_BT_HIDP=m
+CONFIG_BT_L2CAP=y
+CONFIG_BT_RFCOMM=y
+CONFIG_BT_RFCOMM_TTY=y
+CONFIG_BT_SCO=y
+CONFIG_BUG=y
+CONFIG_C2PORT=m
+CONFIG_C2PORT_DURAMAR_2150=m
+CONFIG_CACHEFILES=m
+# CONFIG_CACHEFILES_DEBUG is not set
+# CONFIG_CACHEFILES_HISTOGRAM is not set
+CONFIG_CALGARY_IOMMU=y
+CONFIG_CALGARY_IOMMU_ENABLED_BY_DEFAULT=y
+CONFIG_CAN=m
+CONFIG_CAN_BCM=m
+# CONFIG_CAN_CALC_BITTIMING is not set
+# CONFIG_CAN_DEBUG_DEVICES is not set
+CONFIG_CAN_DEV=m
+CONFIG_CAN_EMS_PCI=m
+CONFIG_CAN_KVASER_PCI=m
+CONFIG_CAN_PM_TRACE=y
+CONFIG_CAN_RAW=m
+CONFIG_CAN_SJA1000=m
+CONFIG_CAN_SJA1000_PLATFORM=m
+CONFIG_CAN_VCAN=m
+CONFIG_CAPI_AVM=y
+CONFIG_CAPI_EICON=y
+CONFIG_CAPI_TRACE=y
+CONFIG_CARDBUS=y
+CONFIG_CARDMAN_4000=m
+CONFIG_CARDMAN_4040=m
+# CONFIG_CARMINE_DRAM_CUSTOM is not set
+CONFIG_CASSINI=m
+CONFIG_CB710_CORE=m
+# CONFIG_CB710_DEBUG is not set
+CONFIG_CB710_DEBUG_ASSUMPTIONS=y
+# CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
+CONFIG_CC_STACKPROTECTOR=y
+CONFIG_CC_STACKPROTECTOR_ALL=y
+CONFIG_CDROM_PKTCDVD=y
+CONFIG_CDROM_PKTCDVD_BUFFERS=8
+# CONFIG_CDROM_PKTCDVD_WCACHE is not set
+CONFIG_CFAG12864B=m
+CONFIG_CFAG12864B_RATE=20
+CONFIG_CFG80211=m
+CONFIG_CFG80211_DEBUGFS=y
+CONFIG_CFG80211_REG_DEBUG=y
+CONFIG_CGROUPS=y
+CONFIG_CGROUP_CPUACCT=y
+# CONFIG_CGROUP_DEBUG is not set
+# CONFIG_CGROUP_DEVICE is not set
+CONFIG_CGROUP_FREEZER=y
+CONFIG_CGROUP_MEM_RES_CTLR=y
+# CONFIG_CGROUP_MEM_RES_CTLR_SWAP is not set
+CONFIG_CGROUP_NS=y
+CONFIG_CGROUP_SCHED=y
+CONFIG_CHARGER_PCF50633=m
+CONFIG_CHECK_SIGNATURE=y
+CONFIG_CHELSIO_T1=m
+CONFIG_CHELSIO_T1_1G=y
+CONFIG_CHELSIO_T3=m
+CONFIG_CHELSIO_T3_DEPENDS=y
+CONFIG_CHR_DEV_OSST=m
+CONFIG_CHR_DEV_SCH=m
+CONFIG_CHR_DEV_SG=y
+CONFIG_CHR_DEV_ST=m
+CONFIG_CICADA_PHY=y
+CONFIG_CIFS=m
+# CONFIG_CIFS_DEBUG2 is not set
+CONFIG_CIFS_DFS_UPCALL=y
+CONFIG_CIFS_EXPERIMENTAL=y
+CONFIG_CIFS_POSIX=y
+# CONFIG_CIFS_STATS is not set
+CONFIG_CIFS_UPCALL=y
+CONFIG_CIFS_WEAK_PW_HASH=y
+CONFIG_CIFS_XATTR=y
+CONFIG_CISS_SCSI_TAPE=y
+# CONFIG_CLASSIC_RCU is not set
+CONFIG_CLOCKSOURCE_WATCHDOG=y
+CONFIG_CLS_U32_MARK=y
+# CONFIG_CLS_U32_PERF is not set
+# CONFIG_CMDLINE_BOOL is not set
+CONFIG_CNIC=m
+CONFIG_CODA_FS=m
+CONFIG_COMEDI=m
+# CONFIG_COMEDI_DEBUG is not set
+CONFIG_COMEDI_PCI_DRIVERS=m
+CONFIG_COMEDI_PCMCIA_DRIVERS=m
+CONFIG_COMEDI_USB_DRIVERS=m
+CONFIG_COMPAL_LAPTOP=m
+CONFIG_COMPAT=y
+CONFIG_COMPAT_BINFMT_ELF=y
+# CONFIG_COMPAT_BRK is not set
+CONFIG_COMPAT_FOR_U64_ALIGNMENT=y
+# CONFIG_COMPAT_VDSO is not set
+CONFIG_COMPUTONE=m
+CONFIG_CONFIGFS_FS=m
+CONFIG_CONNECTOR=y
+CONFIG_CONSOLE_POLL=y
+CONFIG_CONSOLE_TRANSLATIONS=y
+CONFIG_CONSTRUCTORS=y
+CONFIG_CONTEXT_SWITCH_TRACER=y
+# CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
+# CONFIG_CPA_DEBUG is not set
+CONFIG_CPU5_WDT=m
+CONFIG_CPUSETS=y
+CONFIG_CPU_FREQ=y
+# CONFIG_CPU_FREQ_DEBUG is not set
+# CONFIG_CPU_FREQ_DEFAULT_GOV_CONSERVATIVE is not set
+# CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND is not set
+CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE=y
+# CONFIG_CPU_FREQ_DEFAULT_GOV_POWERSAVE is not set
+# CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE is not set
+CONFIG_CPU_FREQ_GOV_CONSERVATIVE=y
+CONFIG_CPU_FREQ_GOV_ONDEMAND=y
+CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
+CONFIG_CPU_FREQ_GOV_POWERSAVE=y
+CONFIG_CPU_FREQ_GOV_USERSPACE=y
+CONFIG_CPU_FREQ_STAT=y
+CONFIG_CPU_FREQ_STAT_DETAILS=y
+CONFIG_CPU_FREQ_TABLE=y
+CONFIG_CPU_IDLE=y
+CONFIG_CPU_IDLE_GOV_LADDER=y
+CONFIG_CPU_IDLE_GOV_MENU=y
+CONFIG_CPU_SUP_AMD=y
+CONFIG_CPU_SUP_CENTAUR=y
+CONFIG_CPU_SUP_INTEL=y
+CONFIG_CRAMFS=m
+CONFIG_CRASH_DUMP=y
+CONFIG_CRC16=y
+CONFIG_CRC32=y
+CONFIG_CRC7=m
+CONFIG_CRC_CCITT=m
+CONFIG_CRC_ITU_T=m
+CONFIG_CRC_T10DIF=y
+CONFIG_CRYPTO=y
+CONFIG_CRYPTO_AEAD=m
+CONFIG_CRYPTO_AEAD2=y
+CONFIG_CRYPTO_AES=m
+CONFIG_CRYPTO_AES_NI_INTEL=m
+CONFIG_CRYPTO_AES_X86_64=m
+CONFIG_CRYPTO_ALGAPI=y
+CONFIG_CRYPTO_ALGAPI2=y
+CONFIG_CRYPTO_ANSI_CPRNG=m
+CONFIG_CRYPTO_ANUBIS=m
+CONFIG_CRYPTO_ARC4=m
+CONFIG_CRYPTO_AUTHENC=m
+CONFIG_CRYPTO_BLKCIPHER=m
+CONFIG_CRYPTO_BLKCIPHER2=y
+CONFIG_CRYPTO_BLOWFISH=m
+CONFIG_CRYPTO_CAMELLIA=m
+CONFIG_CRYPTO_CAST5=m
+CONFIG_CRYPTO_CAST6=m
+CONFIG_CRYPTO_CBC=m
+CONFIG_CRYPTO_CCM=m
+CONFIG_CRYPTO_CRC32C=m
+CONFIG_CRYPTO_CRC32C_INTEL=m
+CONFIG_CRYPTO_CRYPTD=m
+CONFIG_CRYPTO_CTR=m
+CONFIG_CRYPTO_CTS=m
+CONFIG_CRYPTO_DEFLATE=m
+CONFIG_CRYPTO_DES=m
+CONFIG_CRYPTO_DEV_HIFN_795X=m
+CONFIG_CRYPTO_DEV_HIFN_795X_RNG=y
+CONFIG_CRYPTO_DEV_PADLOCK=y
+CONFIG_CRYPTO_DEV_PADLOCK_AES=m
+CONFIG_CRYPTO_DEV_PADLOCK_SHA=m
+CONFIG_CRYPTO_ECB=m
+CONFIG_CRYPTO_FCRYPT=m
+CONFIG_CRYPTO_FIPS=y
+CONFIG_CRYPTO_FPU=m
+CONFIG_CRYPTO_GCM=m
+CONFIG_CRYPTO_GF128MUL=m
+CONFIG_CRYPTO_HASH=y
+CONFIG_CRYPTO_HASH2=y
+CONFIG_CRYPTO_HMAC=y
+CONFIG_CRYPTO_HW=y
+CONFIG_CRYPTO_KHAZAD=m
+CONFIG_CRYPTO_LRW=m
+CONFIG_CRYPTO_LZO=m
+CONFIG_CRYPTO_MANAGER=y
+CONFIG_CRYPTO_MANAGER2=y
+CONFIG_CRYPTO_MD4=m
+CONFIG_CRYPTO_MD5=y
+CONFIG_CRYPTO_MICHAEL_MIC=m
+CONFIG_CRYPTO_NULL=m
+CONFIG_CRYPTO_PCBC=m
+CONFIG_CRYPTO_PCOMP=y
+CONFIG_CRYPTO_RMD128=m
+CONFIG_CRYPTO_RMD160=m
+CONFIG_CRYPTO_RMD256=m
+CONFIG_CRYPTO_RMD320=m
+CONFIG_CRYPTO_RNG=m
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CRYPTO_SALSA20=m
+CONFIG_CRYPTO_SALSA20_X86_64=m
+CONFIG_CRYPTO_SEED=m
+CONFIG_CRYPTO_SEQIV=m
+CONFIG_CRYPTO_SERPENT=m
+CONFIG_CRYPTO_SHA1=m
+CONFIG_CRYPTO_SHA256=m
+CONFIG_CRYPTO_SHA512=m
+CONFIG_CRYPTO_TEA=m
+CONFIG_CRYPTO_TEST=m
+CONFIG_CRYPTO_TGR192=m
+CONFIG_CRYPTO_TWOFISH=m
+CONFIG_CRYPTO_TWOFISH_COMMON=m
+CONFIG_CRYPTO_TWOFISH_X86_64=m
+CONFIG_CRYPTO_WORKQUEUE=y
+CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_XCBC=m
+CONFIG_CRYPTO_XTS=m
+CONFIG_CRYPTO_ZLIB=m
+CONFIG_CUSE=m
+CONFIG_CYCLADES=m
+CONFIG_CYCLADES_SYNC=m
+CONFIG_CYCLOMX_X25=y
+# CONFIG_CYZ_INTR is not set
+CONFIG_DAB=y
+CONFIG_DAVICOM_PHY=y
+CONFIG_DCA=m
+CONFIG_DCB=y
+CONFIG_DCDBAS=m
+CONFIG_DE2104X=m
+CONFIG_DE2104X_DSL=0
+CONFIG_DE4X5=m
+CONFIG_DE600=m
+CONFIG_DE620=m
+# CONFIG_DEBUG_BLOCK_EXT_DEVT is not set
+# CONFIG_DEBUG_BOOT_PARAMS is not set
+CONFIG_DEBUG_BUGVERBOSE=y
+# CONFIG_DEBUG_DEVRES is not set
+# CONFIG_DEBUG_DRIVER is not set
+CONFIG_DEBUG_FS=y
+# CONFIG_DEBUG_GPIO is not set
+CONFIG_DEBUG_INFO=y
+CONFIG_DEBUG_KERNEL=y
+# CONFIG_DEBUG_KMEMLEAK is not set
+# CONFIG_DEBUG_KOBJECT is not set
+# CONFIG_DEBUG_LIST is not set
+# CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set
+# CONFIG_DEBUG_LOCK_ALLOC is not set
+CONFIG_DEBUG_MEMORY_INIT=y
+# CONFIG_DEBUG_NOTIFIERS is not set
+# CONFIG_DEBUG_NX_TEST is not set
+# CONFIG_DEBUG_OBJECTS is not set
+# CONFIG_DEBUG_PAGEALLOC is not set
+# CONFIG_DEBUG_PREEMPT is not set
+CONFIG_DEBUG_RODATA=y
+# CONFIG_DEBUG_RODATA_TEST is not set
+# CONFIG_DEBUG_RT_MUTEXES is not set
+# CONFIG_DEBUG_SG is not set
+# CONFIG_DEBUG_SHIRQ is not set
+# CONFIG_DEBUG_SLAB is not set
+# CONFIG_DEBUG_SPINLOCK is not set
+# CONFIG_DEBUG_SPINLOCK_SLEEP is not set
+# CONFIG_DEBUG_STACKOVERFLOW is not set
+# CONFIG_DEBUG_STACK_USAGE is not set
+# CONFIG_DEBUG_VIRTUAL is not set
+# CONFIG_DEBUG_VM is not set
+# CONFIG_DEBUG_WRITECOUNT is not set
+CONFIG_DECNET=m
+CONFIG_DECNET_NF_GRABULATOR=m
+# CONFIG_DECNET_ROUTER is not set
+CONFIG_DECOMPRESS_BZIP2=y
+CONFIG_DECOMPRESS_GZIP=y
+CONFIG_DECOMPRESS_LZMA=y
+# CONFIG_DEFAULT_AS is not set
+# CONFIG_DEFAULT_BIC is not set
+CONFIG_DEFAULT_CFQ=y
+CONFIG_DEFAULT_CUBIC=y
+# CONFIG_DEFAULT_DEADLINE is not set
+# CONFIG_DEFAULT_HTCP is not set
+CONFIG_DEFAULT_IOSCHED="cfq"
+CONFIG_DEFAULT_IO_DELAY_TYPE=1
+CONFIG_DEFAULT_MMAP_MIN_ADDR=65536
+# CONFIG_DEFAULT_NOOP is not set
+# CONFIG_DEFAULT_RENO is not set
+CONFIG_DEFAULT_TCP_CONG="cubic"
+# CONFIG_DEFAULT_VEGAS is not set
+# CONFIG_DEFAULT_WESTWOOD is not set
+CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config"
+CONFIG_DEFXX=m
+# CONFIG_DEFXX_MMIO is not set
+CONFIG_DELL_LAPTOP=m
+CONFIG_DELL_RBU=m
+CONFIG_DELL_WMI=m
+CONFIG_DETECT_HUNG_TASK=y
+CONFIG_DETECT_SOFTLOCKUP=y
+# CONFIG_DEVKMEM is not set
+CONFIG_DEVPORT=y
+CONFIG_DEVPTS_MULTIPLE_INSTANCES=y
+CONFIG_DEV_APPLETALK=m
+CONFIG_DE_AOC=y
+CONFIG_DIGIEPCA=m
+CONFIG_DIRECT_GBPAGES=y
+# CONFIG_DISCONTIGMEM_MANUAL is not set
+CONFIG_DISPLAY_SUPPORT=m
+# CONFIG_DL2K is not set
+CONFIG_DLCI=m
+CONFIG_DLCI_MAX=8
+CONFIG_DLM=m
+# CONFIG_DLM_DEBUG is not set
+CONFIG_DM9102=m
+CONFIG_DMADEVICES=y
+# CONFIG_DMATEST is not set
+# CONFIG_DMA_API_DEBUG is not set
+CONFIG_DMA_ENGINE=y
+CONFIG_DMI=y
+CONFIG_DMIID=y
+CONFIG_DM_CRYPT=m
+# CONFIG_DM_DEBUG is not set
+# CONFIG_DM_DELAY is not set
+# CONFIG_DM_LOG_USERSPACE is not set
+CONFIG_DM_MIRROR=y
+CONFIG_DM_MULTIPATH=y
+CONFIG_DM_MULTIPATH_QL=m
+CONFIG_DM_MULTIPATH_ST=m
+CONFIG_DM_RAID45=m
+CONFIG_DM_SNAPSHOT=y
+CONFIG_DM_UEVENT=y
+CONFIG_DM_ZERO=m
+CONFIG_DNET=m
+CONFIG_DNOTIFY=y
+CONFIG_DONGLE=y
+CONFIG_DRAGONRISE_FF=y
+CONFIG_DRM=m
+CONFIG_DRM_I810=m
+CONFIG_DRM_I830=m
+CONFIG_DRM_I915=m
+CONFIG_DRM_I915_KMS=y
+CONFIG_DRM_MGA=m
+CONFIG_DRM_R128=m
+CONFIG_DRM_RADEON=m
+CONFIG_DRM_RADEON_KMS=y
+CONFIG_DRM_SAVAGE=m
+CONFIG_DRM_SIS=m
+CONFIG_DRM_TDFX=m
+CONFIG_DRM_TTM=m
+CONFIG_DRM_VIA=m
+CONFIG_DS1682=m
+CONFIG_DSCC4=m
+CONFIG_DSCC4_PCISYNC=y
+CONFIG_DSCC4_PCI_RST=y
+CONFIG_DST=m
+# CONFIG_DST_DEBUG is not set
+CONFIG_DUMMY=m
+CONFIG_DUMMY_CONSOLE=y
+CONFIG_DVB_AF9013=m
+CONFIG_DVB_AU8522=m
+CONFIG_DVB_AV7110=m
+CONFIG_DVB_AV7110_OSD=y
+CONFIG_DVB_B2C2_FLEXCOP=m
+# CONFIG_DVB_B2C2_FLEXCOP_DEBUG is not set
+CONFIG_DVB_B2C2_FLEXCOP_PCI=m
+CONFIG_DVB_B2C2_FLEXCOP_USB=m
+CONFIG_DVB_BCM3510=m
+CONFIG_DVB_BT8XX=m
+CONFIG_DVB_BUDGET=m
+CONFIG_DVB_BUDGET_AV=m
+CONFIG_DVB_BUDGET_CI=m
+CONFIG_DVB_BUDGET_CORE=m
+CONFIG_DVB_BUDGET_PATCH=m
+CONFIG_DVB_CAPTURE_DRIVERS=y
+CONFIG_DVB_CORE=m
+CONFIG_DVB_CX22700=m
+CONFIG_DVB_CX22702=m
+CONFIG_DVB_CX24110=m
+CONFIG_DVB_CX24116=m
+CONFIG_DVB_CX24123=m
+CONFIG_DVB_DIB3000MB=m
+CONFIG_DVB_DIB3000MC=m
+CONFIG_DVB_DIB7000M=m
+CONFIG_DVB_DIB7000P=m
+CONFIG_DVB_DM1105=m
+CONFIG_DVB_DYNAMIC_MINORS=y
+# CONFIG_DVB_FE_CUSTOMISE is not set
+CONFIG_DVB_FIREDTV=m
+CONFIG_DVB_FIREDTV_IEEE1394=y
+CONFIG_DVB_FIREDTV_INPUT=y
+CONFIG_DVB_ISL6405=m
+CONFIG_DVB_ISL6421=m
+CONFIG_DVB_L64781=m
+CONFIG_DVB_LGDT3305=m
+CONFIG_DVB_LGDT330X=m
+CONFIG_DVB_LGS8GL5=m
+CONFIG_DVB_LNBP21=m
+CONFIG_DVB_MT312=m
+CONFIG_DVB_MT352=m
+CONFIG_DVB_NXT200X=m
+CONFIG_DVB_NXT6000=m
+CONFIG_DVB_OR51132=m
+CONFIG_DVB_OR51211=m
+CONFIG_DVB_PLL=m
+CONFIG_DVB_PLUTO2=m
+CONFIG_DVB_S5H1409=m
+CONFIG_DVB_S5H1411=m
+CONFIG_DVB_S5H1420=m
+CONFIG_DVB_SI21XX=m
+CONFIG_DVB_SP8870=m
+CONFIG_DVB_SP887X=m
+CONFIG_DVB_STB0899=m
+CONFIG_DVB_STB6000=m
+CONFIG_DVB_STB6100=m
+CONFIG_DVB_STV0288=m
+CONFIG_DVB_STV0297=m
+CONFIG_DVB_STV0299=m
+CONFIG_DVB_STV0900=m
+CONFIG_DVB_STV6110=m
+CONFIG_DVB_TDA10021=m
+CONFIG_DVB_TDA10023=m
+CONFIG_DVB_TDA10048=m
+CONFIG_DVB_TDA1004X=m
+CONFIG_DVB_TDA10086=m
+CONFIG_DVB_TDA8083=m
+CONFIG_DVB_TDA8261=m
+CONFIG_DVB_TDA826X=m
+CONFIG_DVB_TTUSB_BUDGET=m
+CONFIG_DVB_TTUSB_DEC=m
+CONFIG_DVB_TUA6100=m
+CONFIG_DVB_TUNER_CX24113=m
+CONFIG_DVB_TUNER_DIB0070=m
+CONFIG_DVB_TUNER_ITD1000=m
+CONFIG_DVB_USB=m
+CONFIG_DVB_USB_A800=m
+CONFIG_DVB_USB_AF9005=m
+CONFIG_DVB_USB_AF9005_REMOTE=m
+CONFIG_DVB_USB_AF9015=m
+CONFIG_DVB_USB_ANYSEE=m
+CONFIG_DVB_USB_AU6610=m
+CONFIG_DVB_USB_CE6230=m
+CONFIG_DVB_USB_CINERGY_T2=m
+CONFIG_DVB_USB_CXUSB=m
+# CONFIG_DVB_USB_DEBUG is not set
+CONFIG_DVB_USB_DIB0700=m
+CONFIG_DVB_USB_DIBUSB_MB=m
+# CONFIG_DVB_USB_DIBUSB_MB_FAULTY is not set
+CONFIG_DVB_USB_DIBUSB_MC=m
+CONFIG_DVB_USB_DIGITV=m
+CONFIG_DVB_USB_DTT200U=m
+CONFIG_DVB_USB_DTV5100=m
+CONFIG_DVB_USB_DW2102=m
+CONFIG_DVB_USB_GL861=m
+CONFIG_DVB_USB_GP8PSK=m
+CONFIG_DVB_USB_M920X=m
+CONFIG_DVB_USB_NOVA_T_USB2=m
+CONFIG_DVB_USB_OPERA1=m
+CONFIG_DVB_USB_TTUSB2=m
+CONFIG_DVB_USB_UMT_010=m
+CONFIG_DVB_USB_VP702X=m
+CONFIG_DVB_USB_VP7045=m
+CONFIG_DVB_VES1820=m
+CONFIG_DVB_VES1X93=m
+CONFIG_DVB_ZL10036=m
+CONFIG_DVB_ZL10353=m
+# CONFIG_DYNAMIC_DEBUG is not set
+CONFIG_E100=m
+CONFIG_E1000=m
+CONFIG_E1000E=m
+CONFIG_EARLY_PRINTK=y
+# CONFIG_EARLY_PRINTK_DBGP is not set
+CONFIG_ECHO=m
+CONFIG_ECONET=m
+CONFIG_ECONET_AUNUDP=y
+CONFIG_ECONET_NATIVE=y
+CONFIG_ECRYPT_FS=y
+CONFIG_EDAC=y
+CONFIG_EDAC_AMD64=m
+# CONFIG_EDAC_AMD64_ERROR_INJECTION is not set
+# CONFIG_EDAC_DEBUG is not set
+CONFIG_EDAC_E752X=m
+CONFIG_EDAC_I3000=m
+CONFIG_EDAC_I5000=m
+CONFIG_EDAC_I5100=m
+CONFIG_EDAC_I5400=m
+CONFIG_EDAC_I82975X=m
+CONFIG_EDAC_MM_EDAC=m
+CONFIG_EDAC_X38=m
+CONFIG_EDD=y
+CONFIG_EDD_OFF=y
+CONFIG_EEEPC_LAPTOP=m
+CONFIG_EEPROM_93CX6=m
+CONFIG_EEPROM_AT24=m
+CONFIG_EEPROM_AT25=m
+CONFIG_EEPROM_LEGACY=m
+CONFIG_EEPROM_MAX6875=m
+CONFIG_EFI=y
+CONFIG_EFI_PARTITION=y
+CONFIG_EFI_VARS=y
+CONFIG_EFS_FS=m
+CONFIG_ELF_CORE=y
+# CONFIG_EMBEDDED is not set
+# CONFIG_ENABLE_MUST_CHECK is not set
+# CONFIG_ENABLE_WARN_DEPRECATED is not set
+# CONFIG_ENC28J60 is not set
+CONFIG_ENCLOSURE_SERVICES=m
+CONFIG_ENIC=m
+CONFIG_EPIC100=m
+CONFIG_EPL=m
+CONFIG_EPOLL=y
+CONFIG_EQUALIZER=m
+CONFIG_ESI_DONGLE=m
+CONFIG_ET131X=m
+# CONFIG_ET131X_DEBUG is not set
+CONFIG_ETHOC=m
+CONFIG_EUROTECH_WDT=m
+CONFIG_EVENTFD=y
+CONFIG_EVENT_PROFILE=y
+CONFIG_EVENT_TRACING=y
+# CONFIG_EXOFS_DEBUG is not set
+CONFIG_EXOFS_FS=m
+CONFIG_EXPERIMENTAL=y
+CONFIG_EXPORTFS=m
+CONFIG_EXT2_FS=y
+CONFIG_EXT2_FS_POSIX_ACL=y
+CONFIG_EXT2_FS_SECURITY=y
+CONFIG_EXT2_FS_XATTR=y
+# CONFIG_EXT2_FS_XIP is not set
+# CONFIG_EXT3_DEFAULTS_TO_ORDERED is not set
+CONFIG_EXT3_FS=y
+CONFIG_EXT3_FS_POSIX_ACL=y
+CONFIG_EXT3_FS_SECURITY=y
+CONFIG_EXT3_FS_XATTR=y
+# CONFIG_EXT4DEV_COMPAT is not set
+CONFIG_EXT4_FS=y
+CONFIG_EXT4_FS_POSIX_ACL=y
+CONFIG_EXT4_FS_SECURITY=y
+CONFIG_EXT4_FS_XATTR=y
+CONFIG_EXTRA_FIRMWARE=""
+# CONFIG_EZX_PCAP is not set
+CONFIG_FAIR_GROUP_SCHED=y
+CONFIG_FARSYNC=m
+CONFIG_FAST_CMPXCHG_LOCAL=y
+CONFIG_FAT_DEFAULT_CODEPAGE=437
+CONFIG_FAT_DEFAULT_IOCHARSET="iso8859-1"
+CONFIG_FAT_FS=m
+# CONFIG_FAULT_INJECTION is not set
+CONFIG_FB=y
+CONFIG_FB_3DFX=m
+# CONFIG_FB_3DFX_ACCEL is not set
+CONFIG_FB_3DFX_I2C=y
+CONFIG_FB_ARC=m
+CONFIG_FB_ARK=m
+CONFIG_FB_ASILIANT=y
+CONFIG_FB_ATY=m
+CONFIG_FB_ATY128=m
+CONFIG_FB_ATY128_BACKLIGHT=y
+CONFIG_FB_ATY_BACKLIGHT=y
+CONFIG_FB_ATY_CT=y
+CONFIG_FB_ATY_GENERIC_LCD=y
+CONFIG_FB_ATY_GX=y
+CONFIG_FB_BACKLIGHT=y
+CONFIG_FB_BOOT_VESA_SUPPORT=y
+CONFIG_FB_BROADSHEET=m
+CONFIG_FB_CARILLO_RANCH=m
+CONFIG_FB_CARMINE=m
+CONFIG_FB_CARMINE_DRAM_EVAL=y
+CONFIG_FB_CFB_COPYAREA=y
+CONFIG_FB_CFB_FILLRECT=y
+CONFIG_FB_CFB_IMAGEBLIT=y
+# CONFIG_FB_CFB_REV_PIXELS_IN_BYTE is not set
+CONFIG_FB_CIRRUS=m
+CONFIG_FB_CYBER2000=m
+CONFIG_FB_DDC=m
+CONFIG_FB_DEFERRED_IO=y
+CONFIG_FB_EFI=y
+# CONFIG_FB_FOREIGN_ENDIAN is not set
+CONFIG_FB_GEODE=y
+CONFIG_FB_GEODE_GX=m
+CONFIG_FB_GEODE_GX1=m
+CONFIG_FB_GEODE_LX=m
+CONFIG_FB_HECUBA=m
+CONFIG_FB_HGA=m
+# CONFIG_FB_HGA_ACCEL is not set
+CONFIG_FB_IMSTT=y
+CONFIG_FB_KYRO=m
+CONFIG_FB_LE80578=m
+# CONFIG_FB_MACMODES is not set
+CONFIG_FB_MATROX=m
+CONFIG_FB_MATROX_G=y
+CONFIG_FB_MATROX_I2C=m
+CONFIG_FB_MATROX_MAVEN=m
+CONFIG_FB_MATROX_MILLENIUM=y
+CONFIG_FB_MATROX_MULTIHEAD=y
+CONFIG_FB_MATROX_MYSTIQUE=y
+CONFIG_FB_MB862XX=m
+CONFIG_FB_MB862XX_PCI_GDC=y
+CONFIG_FB_METRONOME=m
+CONFIG_FB_MODE_HELPERS=y
+CONFIG_FB_N411=m
+CONFIG_FB_NEOMAGIC=m
+CONFIG_FB_NVIDIA=m
+CONFIG_FB_NVIDIA_BACKLIGHT=y
+# CONFIG_FB_NVIDIA_DEBUG is not set
+CONFIG_FB_NVIDIA_I2C=y
+CONFIG_FB_PM2=m
+CONFIG_FB_PM2_FIFO_DISCONNECT=y
+CONFIG_FB_PM3=m
+CONFIG_FB_RADEON=m
+CONFIG_FB_RADEON_BACKLIGHT=y
+# CONFIG_FB_RADEON_DEBUG is not set
+CONFIG_FB_RADEON_I2C=y
+CONFIG_FB_RIVA=m
+CONFIG_FB_RIVA_BACKLIGHT=y
+# CONFIG_FB_RIVA_DEBUG is not set
+CONFIG_FB_RIVA_I2C=y
+CONFIG_FB_S1D13XXX=m
+CONFIG_FB_S3=m
+CONFIG_FB_SAVAGE=m
+CONFIG_FB_SAVAGE_ACCEL=y
+CONFIG_FB_SAVAGE_I2C=y
+CONFIG_FB_SIS=m
+CONFIG_FB_SIS_300=y
+CONFIG_FB_SIS_315=y
+CONFIG_FB_SM501=m
+CONFIG_FB_SVGALIB=m
+CONFIG_FB_SYS_COPYAREA=m
+CONFIG_FB_SYS_FILLRECT=m
+CONFIG_FB_SYS_FOPS=m
+CONFIG_FB_SYS_IMAGEBLIT=m
+CONFIG_FB_TILEBLITTING=y
+CONFIG_FB_TMIO=m
+CONFIG_FB_TMIO_ACCELL=y
+CONFIG_FB_TRIDENT=m
+CONFIG_FB_UDL=m
+CONFIG_FB_UVESA=m
+CONFIG_FB_VESA=m
+CONFIG_FB_VGA16=m
+CONFIG_FB_VIA=m
+# CONFIG_FB_VIRTUAL is not set
+CONFIG_FB_VOODOO1=m
+CONFIG_FB_VT8623=m
+CONFIG_FCOE=m
+CONFIG_FCOE_FNIC=m
+CONFIG_FDDI=y
+CONFIG_FEALNX=m
+CONFIG_FIB_RULES=y
+CONFIG_FILE_LOCKING=y
+CONFIG_FIREWIRE=m
+CONFIG_FIREWIRE_NET=m
+CONFIG_FIREWIRE_OHCI=m
+CONFIG_FIREWIRE_OHCI_DEBUG=y
+# CONFIG_FIREWIRE_OHCI_REMOTE_DMA is not set
+CONFIG_FIREWIRE_SBP2=m
+CONFIG_FIRMWARE_EDID=y
+CONFIG_FIRMWARE_IN_KERNEL=y
+CONFIG_FIRMWARE_MEMMAP=y
+CONFIG_FIXED_PHY=y
+CONFIG_FIX_EARLYCON_MEM=y
+# CONFIG_FLATMEM_MANUAL is not set
+# CONFIG_FONTS is not set
+CONFIG_FONT_8x16=y
+CONFIG_FONT_8x8=y
+CONFIG_FORCEDETH=m
+# CONFIG_FORCEDETH_NAPI is not set
+CONFIG_FRAMEBUFFER_CONSOLE=m
+# CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY is not set
+# CONFIG_FRAMEBUFFER_CONSOLE_ROTATION is not set
+CONFIG_FRAME_POINTER=y
+CONFIG_FRAME_WARN=1024
+CONFIG_FREEZER=y
+CONFIG_FSAM7400=m
+CONFIG_FSCACHE=m
+# CONFIG_FSCACHE_DEBUG is not set
+# CONFIG_FSCACHE_HISTOGRAM is not set
+# CONFIG_FSCACHE_STATS is not set
+CONFIG_FSNOTIFY=y
+CONFIG_FS_MBCACHE=y
+CONFIG_FS_POSIX_ACL=y
+CONFIG_FTL=m
+# CONFIG_FTRACE is not set
+CONFIG_FUJITSU_LAPTOP=m
+# CONFIG_FUJITSU_LAPTOP_DEBUG is not set
+CONFIG_FUSE_FS=y
+CONFIG_FUSION=y
+CONFIG_FUSION_CTL=m
+CONFIG_FUSION_FC=m
+CONFIG_FUSION_LAN=m
+CONFIG_FUSION_LOGGING=y
+CONFIG_FUSION_MAX_SGE=128
+CONFIG_FUSION_SAS=m
+CONFIG_FUSION_SPI=m
+CONFIG_FUTEX=y
+CONFIG_FW_LOADER=y
+CONFIG_GACT_PROB=y
+CONFIG_GAMEPORT=m
+CONFIG_GAMEPORT_EMU10K1=m
+CONFIG_GAMEPORT_FM801=m
+CONFIG_GAMEPORT_L4=m
+CONFIG_GAMEPORT_NS558=m
+CONFIG_GARP=m
+CONFIG_GART_IOMMU=y
+# CONFIG_GCOV_KERNEL is not set
+CONFIG_GENERIC_ACL=y
+CONFIG_GENERIC_ALLOCATOR=y
+CONFIG_GENERIC_BUG=y
+CONFIG_GENERIC_BUG_RELATIVE_POINTERS=y
+CONFIG_GENERIC_CALIBRATE_DELAY=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y
+CONFIG_GENERIC_CLOCKEVENTS_BUILD=y
+CONFIG_GENERIC_CMOS_UPDATE=y
+CONFIG_GENERIC_CPU=y
+CONFIG_GENERIC_FIND_FIRST_BIT=y
+CONFIG_GENERIC_FIND_LAST_BIT=y
+CONFIG_GENERIC_FIND_NEXT_BIT=y
+CONFIG_GENERIC_GPIO=y
+CONFIG_GENERIC_HARDIRQS=y
+CONFIG_GENERIC_HARDIRQS_NO__DO_IRQ=y
+CONFIG_GENERIC_HWEIGHT=y
+CONFIG_GENERIC_IOMAP=y
+CONFIG_GENERIC_IRQ_PROBE=y
+CONFIG_GENERIC_ISA_DMA=y
+CONFIG_GENERIC_PENDING_IRQ=y
+CONFIG_GENERIC_TIME=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
+CONFIG_GFS2_FS=m
+CONFIG_GFS2_FS_LOCKING_DLM=y
+CONFIG_GIGASET_BASE=m
+# CONFIG_GIGASET_DEBUG is not set
+CONFIG_GIGASET_M101=m
+CONFIG_GIGASET_M105=m
+CONFIG_GIRBIL_DONGLE=m
+CONFIG_GPIOLIB=y
+CONFIG_GPIO_MAX7301=m
+CONFIG_GPIO_MAX732X=m
+CONFIG_GPIO_MCP23S08=m
+CONFIG_GPIO_PCA953X=m
+CONFIG_GPIO_PCF857X=m
+CONFIG_GPIO_SYSFS=y
+CONFIG_GPIO_TWL4030=m
+CONFIG_GREENASIA_FF=y
+CONFIG_GROUP_SCHED=y
+CONFIG_HAMACHI=m
+CONFIG_HAMRADIO=y
+CONFIG_HANGCHECK_TIMER=m
+CONFIG_HAPPYMEAL=m
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT=y
+# CONFIG_HAVE_AOUT is not set
+CONFIG_HAVE_ARCH_EARLY_PFN_TO_NID=y
+CONFIG_HAVE_ARCH_KGDB=y
+CONFIG_HAVE_ARCH_KMEMCHECK=y
+CONFIG_HAVE_ARCH_TRACEHOOK=y
+CONFIG_HAVE_CPUMASK_OF_CPU_MAP=y
+CONFIG_HAVE_DMA_API_DEBUG=y
+CONFIG_HAVE_DMA_ATTRS=y
+CONFIG_HAVE_DYNAMIC_FTRACE=y
+CONFIG_HAVE_DYNAMIC_PER_CPU_AREA=y
+CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS=y
+CONFIG_HAVE_FTRACE_MCOUNT_RECORD=y
+CONFIG_HAVE_FUNCTION_GRAPH_FP_TEST=y
+CONFIG_HAVE_FUNCTION_GRAPH_TRACER=y
+CONFIG_HAVE_FUNCTION_TRACER=y
+CONFIG_HAVE_FUNCTION_TRACE_MCOUNT_TEST=y
+# CONFIG_HAVE_GENERIC_DMA_COHERENT is not set
+CONFIG_HAVE_IDE=y
+CONFIG_HAVE_IOREMAP_PROT=y
+CONFIG_HAVE_KERNEL_BZIP2=y
+CONFIG_HAVE_KERNEL_GZIP=y
+CONFIG_HAVE_KERNEL_LZMA=y
+CONFIG_HAVE_KPROBES=y
+CONFIG_HAVE_KRETPROBES=y
+CONFIG_HAVE_KVM=y
+CONFIG_HAVE_KVM_IRQCHIP=y
+CONFIG_HAVE_LATENCYTOP_SUPPORT=y
+CONFIG_HAVE_MEMORY_PRESENT=y
+CONFIG_HAVE_MLOCK=y
+CONFIG_HAVE_MLOCKED_PAGE_BIT=y
+CONFIG_HAVE_MMIOTRACE_SUPPORT=y
+CONFIG_HAVE_MTD_OTP=y
+CONFIG_HAVE_OPROFILE=y
+CONFIG_HAVE_PERF_COUNTERS=y
+CONFIG_HAVE_SETUP_PER_CPU_AREA=y
+CONFIG_HAVE_SYSCALL_TRACEPOINTS=y
+CONFIG_HAVE_UNSTABLE_SCHED_CLOCK=y
+CONFIG_HDLC=m
+CONFIG_HDLC_CISCO=m
+CONFIG_HDLC_FR=m
+CONFIG_HDLC_PPP=m
+CONFIG_HDLC_RAW=m
+CONFIG_HDLC_RAW_ETH=m
+CONFIG_HDLC_X25=m
+# CONFIG_HEADERS_CHECK is not set
+CONFIG_HECI=m
+CONFIG_HERMES=m
+CONFIG_HERMES_CACHE_FW_ON_INIT=y
+CONFIG_HFSPLUS_FS=m
+CONFIG_HFS_FS=m
+CONFIG_HIBERNATION=y
+CONFIG_HIBERNATION_NVS=y
+CONFIG_HID=y
+CONFIG_HIDRAW=y
+CONFIG_HID_A4TECH=m
+CONFIG_HID_APPLE=m
+CONFIG_HID_BELKIN=m
+CONFIG_HID_CHERRY=m
+CONFIG_HID_CHICONY=m
+CONFIG_HID_CYPRESS=m
+# CONFIG_HID_DEBUG is not set
+CONFIG_HID_DRAGONRISE=m
+CONFIG_HID_EZKEY=m
+CONFIG_HID_GREENASIA=m
+CONFIG_HID_GYRATION=m
+CONFIG_HID_KENSINGTON=m
+CONFIG_HID_KYE=m
+CONFIG_HID_LOGITECH=m
+CONFIG_HID_MICROSOFT=m
+CONFIG_HID_MONTEREY=m
+CONFIG_HID_NTRIG=m
+CONFIG_HID_PANTHERLORD=m
+CONFIG_HID_PETALYNX=m
+CONFIG_HID_PID=y
+CONFIG_HID_SAMSUNG=m
+CONFIG_HID_SMARTJOYPLUS=m
+CONFIG_HID_SONY=m
+CONFIG_HID_SUNPLUS=m
+CONFIG_HID_SUPPORT=y
+CONFIG_HID_THRUSTMASTER=m
+CONFIG_HID_TOPSEED=m
+CONFIG_HID_WACOM=m
+CONFIG_HID_ZEROPLUS=m
+CONFIG_HIGH_RES_TIMERS=y
+CONFIG_HIPPI=y
+CONFIG_HISAX_16_3=y
+CONFIG_HISAX_1TR6=y
+CONFIG_HISAX_AVM_A1_CS=m
+CONFIG_HISAX_AVM_A1_PCMCIA=y
+CONFIG_HISAX_BKM_A4T=y
+# CONFIG_HISAX_DEBUG is not set
+CONFIG_HISAX_DIEHLDIVA=y
+CONFIG_HISAX_ELSA=y
+CONFIG_HISAX_ELSA_CS=m
+CONFIG_HISAX_ENTERNOW_PCI=y
+CONFIG_HISAX_EURO=y
+CONFIG_HISAX_FRITZPCI=y
+CONFIG_HISAX_FRITZ_PCIPNP=m
+CONFIG_HISAX_GAZEL=y
+CONFIG_HISAX_HDLC=y
+CONFIG_HISAX_HFC4S8S=m
+CONFIG_HISAX_HFCUSB=m
+CONFIG_HISAX_HFC_PCI=y
+CONFIG_HISAX_HFC_SX=y
+CONFIG_HISAX_MAX_CARDS=8
+CONFIG_HISAX_NETJET=y
+CONFIG_HISAX_NETJET_U=y
+CONFIG_HISAX_NI1=y
+CONFIG_HISAX_NICCY=y
+# CONFIG_HISAX_NO_KEYPAD is not set
+# CONFIG_HISAX_NO_LLC is not set
+# CONFIG_HISAX_NO_SENDCOMPLETE is not set
+CONFIG_HISAX_S0BOX=y
+CONFIG_HISAX_SCT_QUADRO=y
+CONFIG_HISAX_SEDLBAUER=y
+CONFIG_HISAX_SEDLBAUER_CS=m
+CONFIG_HISAX_ST5481=m
+CONFIG_HISAX_TELESPCI=y
+CONFIG_HISAX_TELES_CS=m
+CONFIG_HISAX_W6692=y
+CONFIG_HOSTAP=m
+CONFIG_HOSTAP_CS=m
+CONFIG_HOSTAP_FIRMWARE=y
+CONFIG_HOSTAP_FIRMWARE_NVRAM=y
+CONFIG_HOSTAP_PCI=m
+CONFIG_HOSTAP_PLX=m
+CONFIG_HOTPLUG=y
+CONFIG_HOTPLUG_CPU=y
+CONFIG_HOTPLUG_PCI=y
+CONFIG_HOTPLUG_PCI_ACPI=m
+CONFIG_HOTPLUG_PCI_ACPI_IBM=m
+CONFIG_HOTPLUG_PCI_CPCI=y
+CONFIG_HOTPLUG_PCI_CPCI_GENERIC=m
+CONFIG_HOTPLUG_PCI_CPCI_ZT5550=m
+CONFIG_HOTPLUG_PCI_FAKE=m
+CONFIG_HOTPLUG_PCI_PCIE=y
+CONFIG_HOTPLUG_PCI_SHPC=m
+CONFIG_HP100=m
+CONFIG_HPET=y
+CONFIG_HPET_EMULATE_RTC=y
+CONFIG_HPET_MMAP=y
+CONFIG_HPET_TIMER=y
+CONFIG_HPFS_FS=m
+CONFIG_HP_ILO=m
+# CONFIG_HP_WATCHDOG is not set
+CONFIG_HP_WMI=m
+CONFIG_HTC_PASIC3=m
+CONFIG_HT_IRQ=y
+CONFIG_HUGETLBFS=y
+CONFIG_HUGETLB_PAGE=y
+CONFIG_HVC_DRIVER=y
+CONFIG_HVC_IRQ=y
+CONFIG_HVC_XEN=y
+# CONFIG_HWLAT_DETECTOR is not set
+CONFIG_HWMON=y
+# CONFIG_HWMON_DEBUG_CHIP is not set
+CONFIG_HWMON_VID=m
+CONFIG_HW_CONSOLE=y
+CONFIG_HW_RANDOM=y
+CONFIG_HW_RANDOM_AMD=m
+CONFIG_HW_RANDOM_INTEL=m
+CONFIG_HW_RANDOM_TIMERIOMEM=m
+CONFIG_HW_RANDOM_VIA=m
+CONFIG_HW_RANDOM_VIRTIO=m
+CONFIG_HYSDN=m
+CONFIG_HYSDN_CAPI=y
+CONFIG_HZ=1000
+# CONFIG_HZ_100 is not set
+CONFIG_HZ_1000=y
+# CONFIG_HZ_250 is not set
+# CONFIG_HZ_300 is not set
+CONFIG_I2C=y
+CONFIG_I2C_ALGOBIT=m
+CONFIG_I2C_ALGOPCA=m
+CONFIG_I2C_ALGOPCF=m
+CONFIG_I2C_ALI1535=m
+CONFIG_I2C_ALI1563=m
+CONFIG_I2C_ALI15X3=m
+CONFIG_I2C_AMD756=m
+CONFIG_I2C_AMD756_S4882=m
+CONFIG_I2C_AMD8111=m
+CONFIG_I2C_BOARDINFO=y
+CONFIG_I2C_CHARDEV=m
+# CONFIG_I2C_DEBUG_ALGO is not set
+# CONFIG_I2C_DEBUG_BUS is not set
+# CONFIG_I2C_DEBUG_CHIP is not set
+# CONFIG_I2C_DEBUG_CORE is not set
+CONFIG_I2C_GPIO=m
+# CONFIG_I2C_HELPER_AUTO is not set
+CONFIG_I2C_I801=m
+CONFIG_I2C_ISCH=m
+CONFIG_I2C_NFORCE2=m
+CONFIG_I2C_NFORCE2_S4985=m
+CONFIG_I2C_OCORES=m
+CONFIG_I2C_PARPORT=m
+CONFIG_I2C_PARPORT_LIGHT=m
+CONFIG_I2C_PCA_PLATFORM=m
+CONFIG_I2C_PIIX4=m
+CONFIG_I2C_SIMTEC=m
+CONFIG_I2C_SIS5595=m
+CONFIG_I2C_SIS630=m
+CONFIG_I2C_SIS96X=m
+CONFIG_I2C_STUB=m
+CONFIG_I2C_TAOS_EVM=m
+CONFIG_I2C_TINY_USB=m
+CONFIG_I2C_VIA=m
+CONFIG_I2C_VIAPRO=m
+CONFIG_I2C_VOODOO3=m
+CONFIG_I2O=m
+CONFIG_I2O_BLOCK=m
+CONFIG_I2O_BUS=m
+CONFIG_I2O_CONFIG=m
+CONFIG_I2O_CONFIG_OLD_IOCTL=y
+CONFIG_I2O_EXT_ADAPTEC=y
+CONFIG_I2O_EXT_ADAPTEC_DMA64=y
+CONFIG_I2O_LCT_NOTIFY_ON_CHANGES=y
+CONFIG_I2O_PROC=m
+CONFIG_I2O_SCSI=m
+CONFIG_I6300ESB_WDT=m
+CONFIG_I7300_IDLE=m
+CONFIG_I7300_IDLE_IOAT_CHANNEL=y
+CONFIG_I82092=m
+CONFIG_I8K=m
+# CONFIG_IA32_AOUT is not set
+CONFIG_IA32_EMULATION=y
+CONFIG_IB700_WDT=m
+CONFIG_IBMASR=m
+CONFIG_IBMOL=m
+CONFIG_IBM_ASM=m
+# CONFIG_IBM_NEW_EMAC_EMAC4 is not set
+# CONFIG_IBM_NEW_EMAC_MAL_CLR_ICINTSTAT is not set
+# CONFIG_IBM_NEW_EMAC_MAL_COMMON_ERR is not set
+# CONFIG_IBM_NEW_EMAC_NO_FLOW_CTRL is not set
+# CONFIG_IBM_NEW_EMAC_RGMII is not set
+# CONFIG_IBM_NEW_EMAC_TAH is not set
+# CONFIG_IBM_NEW_EMAC_ZMII is not set
+CONFIG_ICPLUS_PHY=y
+CONFIG_ICS932S401=m
+# CONFIG_IDE is not set
+CONFIG_IDE_PHISON=m
+CONFIG_IEEE1394=m
+CONFIG_IEEE1394_DV1394=m
+CONFIG_IEEE1394_ETH1394=m
+CONFIG_IEEE1394_ETH1394_ROM_ENTRY=y
+CONFIG_IEEE1394_OHCI1394=m
+CONFIG_IEEE1394_PCILYNX=m
+CONFIG_IEEE1394_RAWIO=m
+CONFIG_IEEE1394_SBP2=m
+# CONFIG_IEEE1394_SBP2_PHYS_DMA is not set
+# CONFIG_IEEE1394_VERBOSEDEBUG is not set
+CONFIG_IEEE1394_VIDEO1394=m
+CONFIG_IEEE802154=m
+CONFIG_IEEE802154_DRIVERS=m
+# CONFIG_IEEE802154_FAKEHARD is not set
+CONFIG_IFB=m
+CONFIG_IGB=m
+CONFIG_IGBVF=m
+CONFIG_IGB_DCA=y
+# CONFIG_IKCONFIG is not set
+# CONFIG_IMA is not set
+CONFIG_INET=y
+CONFIG_INET6_AH=m
+CONFIG_INET6_ESP=m
+CONFIG_INET6_IPCOMP=m
+CONFIG_INET6_TUNNEL=m
+CONFIG_INET6_XFRM_MODE_BEET=m
+CONFIG_INET6_XFRM_MODE_ROUTEOPTIMIZATION=m
+CONFIG_INET6_XFRM_MODE_TRANSPORT=m
+CONFIG_INET6_XFRM_MODE_TUNNEL=m
+CONFIG_INET6_XFRM_TUNNEL=m
+CONFIG_INET_AH=m
+CONFIG_INET_DCCP_DIAG=m
+CONFIG_INET_DIAG=y
+CONFIG_INET_ESP=m
+CONFIG_INET_IPCOMP=m
+CONFIG_INET_LRO=y
+CONFIG_INET_TCP_DIAG=y
+CONFIG_INET_TUNNEL=m
+CONFIG_INET_XFRM_MODE_BEET=m
+CONFIG_INET_XFRM_MODE_TRANSPORT=m
+CONFIG_INET_XFRM_MODE_TUNNEL=m
+CONFIG_INET_XFRM_TUNNEL=m
+CONFIG_INFINIBAND=m
+CONFIG_INFINIBAND_ADDR_TRANS=y
+CONFIG_INFINIBAND_AMSO1100=m
+CONFIG_INFINIBAND_AMSO1100_DEBUG=y
+CONFIG_INFINIBAND_CXGB3=m
+# CONFIG_INFINIBAND_CXGB3_DEBUG is not set
+CONFIG_INFINIBAND_IPATH=m
+CONFIG_INFINIBAND_IPOIB=m
+CONFIG_INFINIBAND_IPOIB_CM=y
+CONFIG_INFINIBAND_IPOIB_DEBUG=y
+# CONFIG_INFINIBAND_IPOIB_DEBUG_DATA is not set
+CONFIG_INFINIBAND_ISER=m
+CONFIG_INFINIBAND_MTHCA=m
+CONFIG_INFINIBAND_MTHCA_DEBUG=y
+# CONFIG_INFINIBAND_NES is not set
+CONFIG_INFINIBAND_SRP=m
+CONFIG_INFINIBAND_USER_ACCESS=m
+CONFIG_INFINIBAND_USER_MAD=m
+CONFIG_INFINIBAND_USER_MEM=y
+CONFIG_INFTL=m
+CONFIG_INITRAMFS_SOURCE=""
+CONFIG_INIT_ENV_ARG_LIMIT=32
+CONFIG_INOTIFY=y
+CONFIG_INOTIFY_USER=y
+CONFIG_INPUT=y
+# CONFIG_INPUT_APANEL is not set
+CONFIG_INPUT_ATI_REMOTE=m
+CONFIG_INPUT_ATI_REMOTE2=m
+CONFIG_INPUT_ATLAS_BTNS=m
+CONFIG_INPUT_CM109=m
+CONFIG_INPUT_EVBUG=m
+CONFIG_INPUT_EVDEV=y
+CONFIG_INPUT_FF_MEMLESS=m
+CONFIG_INPUT_GPIO_ROTARY_ENCODER=m
+CONFIG_INPUT_JOYDEV=m
+CONFIG_INPUT_JOYSTICK=y
+CONFIG_INPUT_KEYBOARD=y
+CONFIG_INPUT_KEYSPAN_REMOTE=m
+CONFIG_INPUT_MIMIO=m
+CONFIG_INPUT_MISC=y
+CONFIG_INPUT_MOUSE=y
+CONFIG_INPUT_MOUSEDEV=y
+CONFIG_INPUT_MOUSEDEV_PSAUX=y
+CONFIG_INPUT_MOUSEDEV_SCREEN_X=1024
+CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768
+CONFIG_INPUT_PCF50633_PMU=m
+CONFIG_INPUT_PCSPKR=m
+CONFIG_INPUT_POLLDEV=m
+CONFIG_INPUT_POWERMATE=m
+CONFIG_INPUT_TABLET=y
+CONFIG_INPUT_TOUCHSCREEN=y
+CONFIG_INPUT_TWL4030_PWRBUTTON=m
+CONFIG_INPUT_UINPUT=m
+CONFIG_INPUT_YEALINK=m
+CONFIG_INTEL_IOATDMA=m
+CONFIG_INTEL_MENLOW=m
+CONFIG_IOMMU_API=y
+# CONFIG_IOMMU_DEBUG is not set
+CONFIG_IOMMU_HELPER=y
+# CONFIG_IOMMU_STRESS is not set
+CONFIG_IOSCHED_AS=y
+CONFIG_IOSCHED_CFQ=y
+CONFIG_IOSCHED_DEADLINE=y
+CONFIG_IOSCHED_NOOP=y
+# CONFIG_IO_DELAY_0X80 is not set
+CONFIG_IO_DELAY_0XED=y
+# CONFIG_IO_DELAY_NONE is not set
+CONFIG_IO_DELAY_TYPE_0X80=0
+CONFIG_IO_DELAY_TYPE_0XED=1
+CONFIG_IO_DELAY_TYPE_NONE=3
+CONFIG_IO_DELAY_TYPE_UDELAY=2
+# CONFIG_IO_DELAY_UDELAY is not set
+CONFIG_IP1000=m
+CONFIG_IP6_NF_FILTER=m
+CONFIG_IP6_NF_IPTABLES=m
+CONFIG_IP6_NF_MANGLE=m
+CONFIG_IP6_NF_MATCH_AH=m
+CONFIG_IP6_NF_MATCH_EUI64=m
+CONFIG_IP6_NF_MATCH_FRAG=m
+CONFIG_IP6_NF_MATCH_HL=m
+CONFIG_IP6_NF_MATCH_IPV6HEADER=m
+CONFIG_IP6_NF_MATCH_MH=m
+CONFIG_IP6_NF_MATCH_OPTS=m
+CONFIG_IP6_NF_MATCH_RT=m
+CONFIG_IP6_NF_QUEUE=m
+CONFIG_IP6_NF_RAW=m
+CONFIG_IP6_NF_SECURITY=m
+CONFIG_IP6_NF_TARGET_HL=m
+CONFIG_IP6_NF_TARGET_LOG=m
+CONFIG_IP6_NF_TARGET_REJECT=m
+CONFIG_IPC_NS=y
+CONFIG_IPDDP=m
+CONFIG_IPDDP_DECAP=y
+CONFIG_IPDDP_ENCAP=y
+CONFIG_IPMI_DEVICE_INTERFACE=m
+CONFIG_IPMI_HANDLER=m
+# CONFIG_IPMI_PANIC_EVENT is not set
+CONFIG_IPMI_POWEROFF=m
+CONFIG_IPMI_SI=m
+CONFIG_IPMI_WATCHDOG=m
+CONFIG_IPPP_FILTER=y
+CONFIG_IPV6=y
+# CONFIG_IPV6_MIP6 is not set
+# CONFIG_IPV6_MROUTE is not set
+CONFIG_IPV6_MULTIPLE_TABLES=y
+CONFIG_IPV6_NDISC_NODETYPE=y
+# CONFIG_IPV6_OPTIMISTIC_DAD is not set
+CONFIG_IPV6_PRIVACY=y
+# CONFIG_IPV6_ROUTER_PREF is not set
+CONFIG_IPV6_SIT=m
+# CONFIG_IPV6_SUBTREES is not set
+CONFIG_IPV6_TUNNEL=m
+CONFIG_IPW2100=m
+# CONFIG_IPW2100_DEBUG is not set
+CONFIG_IPW2100_MONITOR=y
+CONFIG_IPW2200=m
+# CONFIG_IPW2200_DEBUG is not set
+CONFIG_IPW2200_MONITOR=y
+CONFIG_IPW2200_PROMISCUOUS=y
+CONFIG_IPW2200_QOS=y
+CONFIG_IPW2200_RADIOTAP=y
+CONFIG_IPWIRELESS=m
+CONFIG_IPX=m
+# CONFIG_IPX_INTERN is not set
+CONFIG_IP_ADVANCED_ROUTER=y
+CONFIG_IP_DCCP=m
+# CONFIG_IP_DCCP_CCID2_DEBUG is not set
+CONFIG_IP_DCCP_CCID3=y
+# CONFIG_IP_DCCP_CCID3_DEBUG is not set
+CONFIG_IP_DCCP_CCID3_RTO=100
+# CONFIG_IP_DCCP_DEBUG is not set
+CONFIG_IP_DCCP_TFRC_LIB=y
+CONFIG_IP_FIB_HASH=y
+# CONFIG_IP_FIB_TRIE is not set
+CONFIG_IP_MROUTE=y
+CONFIG_IP_MULTICAST=y
+CONFIG_IP_MULTIPLE_TABLES=y
+CONFIG_IP_NF_ARPFILTER=m
+CONFIG_IP_NF_ARPTABLES=m
+CONFIG_IP_NF_ARP_MANGLE=m
+CONFIG_IP_NF_FILTER=m
+CONFIG_IP_NF_IPTABLES=m
+CONFIG_IP_NF_MANGLE=m
+CONFIG_IP_NF_MATCH_ADDRTYPE=m
+CONFIG_IP_NF_MATCH_AH=m
+CONFIG_IP_NF_MATCH_ECN=m
+CONFIG_IP_NF_MATCH_TTL=m
+CONFIG_IP_NF_QUEUE=m
+CONFIG_IP_NF_RAW=m
+CONFIG_IP_NF_SECURITY=m
+CONFIG_IP_NF_TARGET_CLUSTERIP=m
+CONFIG_IP_NF_TARGET_ECN=m
+CONFIG_IP_NF_TARGET_LOG=m
+CONFIG_IP_NF_TARGET_MASQUERADE=m
+CONFIG_IP_NF_TARGET_NETMAP=m
+CONFIG_IP_NF_TARGET_REDIRECT=m
+CONFIG_IP_NF_TARGET_REJECT=m
+CONFIG_IP_NF_TARGET_TTL=m
+CONFIG_IP_NF_TARGET_ULOG=m
+CONFIG_IP_PIMSM_V1=y
+CONFIG_IP_PIMSM_V2=y
+# CONFIG_IP_PNP is not set
+CONFIG_IP_ROUTE_MULTIPATH=y
+CONFIG_IP_ROUTE_VERBOSE=y
+CONFIG_IP_SCTP=m
+CONFIG_IP_VS=m
+# CONFIG_IP_VS_DEBUG is not set
+CONFIG_IP_VS_DH=m
+CONFIG_IP_VS_FTP=m
+CONFIG_IP_VS_IPV6=y
+CONFIG_IP_VS_LBLC=m
+CONFIG_IP_VS_LBLCR=m
+CONFIG_IP_VS_LC=m
+CONFIG_IP_VS_NQ=m
+CONFIG_IP_VS_PROTO_AH=y
+CONFIG_IP_VS_PROTO_AH_ESP=y
+CONFIG_IP_VS_PROTO_ESP=y
+CONFIG_IP_VS_PROTO_TCP=y
+CONFIG_IP_VS_PROTO_UDP=y
+CONFIG_IP_VS_RR=m
+CONFIG_IP_VS_SED=m
+CONFIG_IP_VS_SH=m
+CONFIG_IP_VS_TAB_BITS=12
+CONFIG_IP_VS_WLC=m
+CONFIG_IP_VS_WRR=m
+CONFIG_IRCOMM=m
+CONFIG_IRDA=m
+CONFIG_IRDA_CACHE_LAST_LSAP=y
+CONFIG_IRDA_DEBUG=y
+CONFIG_IRDA_FAST_RR=y
+CONFIG_IRDA_ULTRA=y
+CONFIG_IRLAN=m
+CONFIG_IRNET=m
+CONFIG_IRTTY_SIR=m
+CONFIG_ISA_DMA_API=y
+CONFIG_ISCSI_IBFT=m
+CONFIG_ISCSI_IBFT_FIND=y
+CONFIG_ISCSI_TCP=m
+CONFIG_ISDN=y
+CONFIG_ISDN_AUDIO=y
+CONFIG_ISDN_CAPI=m
+CONFIG_ISDN_CAPI_CAPI20=m
+CONFIG_ISDN_CAPI_CAPIDRV=m
+CONFIG_ISDN_CAPI_CAPIFS=m
+CONFIG_ISDN_CAPI_CAPIFS_BOOL=y
+CONFIG_ISDN_CAPI_MIDDLEWARE=y
+CONFIG_ISDN_DIVAS=m
+CONFIG_ISDN_DIVAS_BRIPCI=y
+CONFIG_ISDN_DIVAS_DIVACAPI=m
+CONFIG_ISDN_DIVAS_MAINT=m
+CONFIG_ISDN_DIVAS_PRIPCI=y
+CONFIG_ISDN_DIVAS_USERIDI=m
+CONFIG_ISDN_DIVERSION=m
+CONFIG_ISDN_DRV_AVMB1_AVM_CS=m
+CONFIG_ISDN_DRV_AVMB1_B1PCI=m
+CONFIG_ISDN_DRV_AVMB1_B1PCIV4=y
+CONFIG_ISDN_DRV_AVMB1_B1PCMCIA=m
+CONFIG_ISDN_DRV_AVMB1_C4=m
+CONFIG_ISDN_DRV_AVMB1_T1PCI=m
+CONFIG_ISDN_DRV_AVMB1_VERBOSE_REASON=y
+CONFIG_ISDN_DRV_GIGASET=m
+CONFIG_ISDN_DRV_HISAX=m
+CONFIG_ISDN_I4L=m
+CONFIG_ISDN_MPP=y
+CONFIG_ISDN_PPP=y
+CONFIG_ISDN_PPP_BSDCOMP=m
+CONFIG_ISDN_PPP_VJ=y
+CONFIG_ISDN_TTY_FAX=y
+CONFIG_ISDN_X25=y
+# CONFIG_ISI is not set
+CONFIG_ISL29003=m
+CONFIG_ISO9660_FS=m
+CONFIG_ISTALLION=m
+CONFIG_IT8712F_WDT=m
+CONFIG_IT87_WDT=m
+CONFIG_ITCO_VENDOR_SUPPORT=y
+CONFIG_ITCO_WDT=m
+CONFIG_IWL3945=m
+CONFIG_IWL3945_SPECTRUM_MEASUREMENT=y
+CONFIG_IWL4965=y
+CONFIG_IWL5000=y
+CONFIG_IWLAGN=m
+CONFIG_IWLWIFI=m
+# CONFIG_IWLWIFI_DEBUG is not set
+CONFIG_IWLWIFI_LEDS=y
+# CONFIG_IWLWIFI_SPECTRUM_MEASUREMENT is not set
+CONFIG_IWM=m
+# CONFIG_IWM_DEBUG is not set
+CONFIG_IXGB=m
+CONFIG_IXGBE=m
+CONFIG_IXGBE_DCA=y
+CONFIG_IXGBE_DCB=y
+CONFIG_JBD=y
+CONFIG_JBD2=y
+# CONFIG_JBD2_DEBUG is not set
+# CONFIG_JBD_DEBUG is not set
+CONFIG_JFFS2_CMODE_FAVOURLZO=y
+# CONFIG_JFFS2_CMODE_NONE is not set
+# CONFIG_JFFS2_CMODE_PRIORITY is not set
+# CONFIG_JFFS2_CMODE_SIZE is not set
+CONFIG_JFFS2_COMPRESSION_OPTIONS=y
+CONFIG_JFFS2_FS=m
+CONFIG_JFFS2_FS_DEBUG=0
+# CONFIG_JFFS2_FS_WBUF_VERIFY is not set
+CONFIG_JFFS2_FS_WRITEBUFFER=y
+# CONFIG_JFFS2_FS_XATTR is not set
+CONFIG_JFFS2_LZO=y
+CONFIG_JFFS2_RTIME=y
+# CONFIG_JFFS2_RUBIN is not set
+# CONFIG_JFFS2_SUMMARY is not set
+CONFIG_JFFS2_ZLIB=y
+# CONFIG_JFS_DEBUG is not set
+CONFIG_JFS_FS=m
+CONFIG_JFS_POSIX_ACL=y
+CONFIG_JFS_SECURITY=y
+CONFIG_JFS_STATISTICS=y
+CONFIG_JME=m
+CONFIG_JOLIET=y
+CONFIG_JOYSTICK_A3D=m
+CONFIG_JOYSTICK_ADI=m
+CONFIG_JOYSTICK_ANALOG=m
+CONFIG_JOYSTICK_COBRA=m
+CONFIG_JOYSTICK_DB9=m
+CONFIG_JOYSTICK_GAMECON=m
+CONFIG_JOYSTICK_GF2K=m
+CONFIG_JOYSTICK_GRIP=m
+CONFIG_JOYSTICK_GRIP_MP=m
+CONFIG_JOYSTICK_GUILLEMOT=m
+CONFIG_JOYSTICK_IFORCE=m
+CONFIG_JOYSTICK_IFORCE_232=y
+CONFIG_JOYSTICK_IFORCE_USB=y
+CONFIG_JOYSTICK_INTERACT=m
+CONFIG_JOYSTICK_JOYDUMP=m
+CONFIG_JOYSTICK_MAGELLAN=m
+CONFIG_JOYSTICK_SIDEWINDER=m
+CONFIG_JOYSTICK_SPACEBALL=m
+CONFIG_JOYSTICK_SPACEORB=m
+CONFIG_JOYSTICK_STINGER=m
+CONFIG_JOYSTICK_TMDC=m
+CONFIG_JOYSTICK_TURBOGRAFX=m
+CONFIG_JOYSTICK_TWIDJOY=m
+CONFIG_JOYSTICK_WALKERA0701=m
+CONFIG_JOYSTICK_WARRIOR=m
+CONFIG_JOYSTICK_XPAD=m
+CONFIG_JOYSTICK_XPAD_FF=y
+CONFIG_JOYSTICK_XPAD_LEDS=y
+CONFIG_JOYSTICK_ZHENHUA=m
+CONFIG_K8_NB=y
+CONFIG_K8_NUMA=y
+CONFIG_KALLSYMS=y
+CONFIG_KALLSYMS_ALL=y
+# CONFIG_KALLSYMS_EXTRA_PASS is not set
+CONFIG_KARMA_PARTITION=y
+# CONFIG_KERNEL_BZIP2 is not set
+CONFIG_KERNEL_GZIP=y
+# CONFIG_KERNEL_LZMA is not set
+CONFIG_KEXEC=y
+CONFIG_KEXEC_JUMP=y
+CONFIG_KEYBOARD_ATKBD=y
+CONFIG_KEYBOARD_GPIO=m
+CONFIG_KEYBOARD_LKKBD=m
+CONFIG_KEYBOARD_LM8323=m
+CONFIG_KEYBOARD_MATRIX=m
+CONFIG_KEYBOARD_NEWTON=m
+CONFIG_KEYBOARD_STOWAWAY=m
+CONFIG_KEYBOARD_SUNKBD=m
+CONFIG_KEYBOARD_XTKBD=m
+CONFIG_KEYS=y
+# CONFIG_KEYS_DEBUG_PROC_KEYS is not set
+CONFIG_KGDB=y
+CONFIG_KGDB_SERIAL_CONSOLE=y
+# CONFIG_KGDB_TESTS is not set
+CONFIG_KINGSUN_DONGLE=m
+# CONFIG_KMEMCHECK is not set
+CONFIG_KPROBES=y
+# CONFIG_KPROBES_SANITY_TEST is not set
+CONFIG_KRETPROBES=y
+CONFIG_KS0108=m
+CONFIG_KS0108_DELAY=2
+CONFIG_KS0108_PORT=0x378
+CONFIG_KS8842=m
+CONFIG_KS8851=m
+CONFIG_KS959_DONGLE=m
+CONFIG_KSDAZZLE_DONGLE=m
+# CONFIG_KTIME_SCALAR is not set
+CONFIG_KVM=m
+CONFIG_KVM_AMD=m
+CONFIG_KVM_CLOCK=y
+CONFIG_KVM_GUEST=y
+CONFIG_KVM_INTEL=m
+# CONFIG_KVM_TRACE is not set
+CONFIG_LANMEDIA=m
+CONFIG_LAPB=m
+CONFIG_LAPBETHER=m
+CONFIG_LATENCYTOP=y
+CONFIG_LCD_CLASS_DEVICE=m
+CONFIG_LCD_ILI9320=m
+CONFIG_LCD_LTV350QV=m
+CONFIG_LCD_PLATFORM=m
+CONFIG_LCD_TDO24M=m
+CONFIG_LCD_VGG2432A4=m
+# CONFIG_LDM_DEBUG is not set
+CONFIG_LDM_PARTITION=y
+CONFIG_LEDS_ALIX2=m
+CONFIG_LEDS_BD2802=m
+CONFIG_LEDS_CLASS=m
+# CONFIG_LEDS_CLEVO_MAIL is not set
+CONFIG_LEDS_DA903X=m
+CONFIG_LEDS_DAC124S085=m
+CONFIG_LEDS_GPIO=m
+CONFIG_LEDS_GPIO_PLATFORM=y
+CONFIG_LEDS_LP3944=m
+CONFIG_LEDS_PCA9532=m
+CONFIG_LEDS_PCA955X=m
+CONFIG_LEDS_TRIGGERS=y
+CONFIG_LEDS_TRIGGER_BACKLIGHT=m
+CONFIG_LEDS_TRIGGER_DEFAULT_ON=m
+CONFIG_LEDS_TRIGGER_GPIO=m
+CONFIG_LEDS_TRIGGER_HEARTBEAT=m
+CONFIG_LEDS_TRIGGER_TIMER=m
+CONFIG_LEDS_WM8350=m
+CONFIG_LEGACY_PTYS=y
+CONFIG_LEGACY_PTY_COUNT=0
+CONFIG_LENOVO_SL_LAPTOP=m
+CONFIG_LIB80211=m
+CONFIG_LIB80211_CRYPT_CCMP=m
+CONFIG_LIB80211_CRYPT_TKIP=m
+CONFIG_LIB80211_CRYPT_WEP=m
+# CONFIG_LIB80211_DEBUG is not set
+CONFIG_LIBCRC32C=m
+CONFIG_LIBERTAS=m
+CONFIG_LIBERTAS_CS=m
+# CONFIG_LIBERTAS_DEBUG is not set
+CONFIG_LIBERTAS_SDIO=m
+CONFIG_LIBERTAS_SPI=m
+CONFIG_LIBERTAS_THINFIRM=m
+CONFIG_LIBERTAS_THINFIRM_USB=m
+CONFIG_LIBERTAS_USB=m
+CONFIG_LIBFC=m
+CONFIG_LIBFCOE=m
+CONFIG_LIBIPW=m
+CONFIG_LIBIPW_DEBUG=y
+CONFIG_LINE6_USB=m
+CONFIG_LIRC_ATIUSB=m
+CONFIG_LIRC_BT829=m
+CONFIG_LIRC_CONFIG_LIRC_WPC8769L=m
+CONFIG_LIRC_DEV=m
+CONFIG_LIRC_ENE0100=m
+# CONFIG_LIRC_GPIO is not set
+CONFIG_LIRC_I2C=m
+CONFIG_LIRC_IGORPLUGUSB=m
+CONFIG_LIRC_IMON=m
+CONFIG_LIRC_IT87=m
+# CONFIG_LIRC_ITE8709 is not set
+CONFIG_LIRC_MCEUSB=m
+# CONFIG_LIRC_PARALLEL is not set
+CONFIG_LIRC_SASEM=m
+CONFIG_LIRC_SERIAL=m
+CONFIG_LIRC_SIR=m
+CONFIG_LIRC_STREAMZAP=m
+CONFIG_LIRC_TTUSBIR=m
+CONFIG_LITELINK_DONGLE=m
+# CONFIG_LKDTM is not set
+CONFIG_LLC=y
+CONFIG_LLC2=m
+CONFIG_LOCALVERSION=""
+# CONFIG_LOCALVERSION_AUTO is not set
+CONFIG_LOCKD=m
+CONFIG_LOCKDEP_SUPPORT=y
+CONFIG_LOCKD_V4=y
+CONFIG_LOCK_KERNEL=y
+# CONFIG_LOCK_STAT is not set
+CONFIG_LOGIRUMBLEPAD2_FF=y
+CONFIG_LOGITECH_FF=y
+# CONFIG_LOGO is not set
+CONFIG_LOG_BUF_SHIFT=17
+# CONFIG_LP_CONSOLE is not set
+CONFIG_LSI_ET1011C_PHY=y
+CONFIG_LSM_MMAP_MIN_ADDR=0
+CONFIG_LXT_PHY=y
+CONFIG_LZO_COMPRESS=m
+CONFIG_LZO_DECOMPRESS=m
+CONFIG_M25PXX_USE_FAST_READ=y
+# CONFIG_M386 is not set
+# CONFIG_M486 is not set
+# CONFIG_M586 is not set
+# CONFIG_M586MMX is not set
+# CONFIG_M586TSC is not set
+# CONFIG_M686 is not set
+CONFIG_MA600_DONGLE=m
+CONFIG_MAC80211=m
+CONFIG_MAC80211_DEBUGFS=y
+# CONFIG_MAC80211_DEBUG_MENU is not set
+CONFIG_MAC80211_DEFAULT_PS=y
+CONFIG_MAC80211_DEFAULT_PS_VALUE=1
+CONFIG_MAC80211_HWSIM=m
+CONFIG_MAC80211_LEDS=y
+CONFIG_MAC80211_RC_DEFAULT="minstrel"
+CONFIG_MAC80211_RC_DEFAULT_MINSTREL=y
+# CONFIG_MAC80211_RC_DEFAULT_PID is not set
+CONFIG_MAC80211_RC_MINSTREL=y
+CONFIG_MACHZ_WDT=m
+CONFIG_MACINTOSH_DRIVERS=y
+CONFIG_MACVLAN=m
+CONFIG_MAC_EMUMOUSEBTN=y
+CONFIG_MAC_PARTITION=y
+CONFIG_MAGIC_SYSRQ=y
+CONFIG_MARVELL_PHY=y
+CONFIG_MAX_RAW_DEVS=256
+# CONFIG_MCORE2 is not set
+CONFIG_MCP2120_DONGLE=m
+# CONFIG_MCRUSOE is not set
+CONFIG_MCS_FIR=m
+# CONFIG_MCYRIXIII is not set
+CONFIG_MD=y
+CONFIG_MDIO=m
+CONFIG_MDIO_BITBANG=y
+CONFIG_MDIO_GPIO=y
+CONFIG_MD_AUTODETECT=y
+CONFIG_MD_FAULTY=m
+CONFIG_MD_LINEAR=m
+CONFIG_MD_MULTIPATH=m
+CONFIG_MD_RAID0=m
+CONFIG_MD_RAID1=m
+CONFIG_MD_RAID10=m
+CONFIG_MD_RAID456=m
+CONFIG_MD_RAID6_PQ=m
+CONFIG_ME0600=m
+CONFIG_ME0900=m
+CONFIG_ME1000=m
+CONFIG_ME1400=m
+CONFIG_ME1600=m
+CONFIG_ME4000=m
+CONFIG_ME4600=m
+CONFIG_ME6000=m
+CONFIG_ME8100=m
+CONFIG_ME8200=m
+CONFIG_MEDIA_ATTACH=y
+CONFIG_MEDIA_SUPPORT=m
+CONFIG_MEDIA_TUNER=m
+# CONFIG_MEDIA_TUNER_CUSTOMISE is not set
+CONFIG_MEDIA_TUNER_MC44S803=m
+CONFIG_MEDIA_TUNER_MT2060=m
+CONFIG_MEDIA_TUNER_MT20XX=m
+CONFIG_MEDIA_TUNER_MT2131=m
+CONFIG_MEDIA_TUNER_MT2266=m
+CONFIG_MEDIA_TUNER_MXL5005S=m
+CONFIG_MEDIA_TUNER_MXL5007T=m
+CONFIG_MEDIA_TUNER_QT1010=m
+CONFIG_MEDIA_TUNER_SIMPLE=m
+CONFIG_MEDIA_TUNER_TDA18271=m
+CONFIG_MEDIA_TUNER_TDA827X=m
+CONFIG_MEDIA_TUNER_TDA8290=m
+CONFIG_MEDIA_TUNER_TDA9887=m
+CONFIG_MEDIA_TUNER_TEA5761=m
+CONFIG_MEDIA_TUNER_TEA5767=m
+CONFIG_MEDIA_TUNER_XC2028=m
+CONFIG_MEDIA_TUNER_XC5000=m
+CONFIG_MEDUMMY=m
+# CONFIG_MEFFICEON is not set
+CONFIG_MEGARAID_LEGACY=m
+CONFIG_MEGARAID_MAILBOX=m
+CONFIG_MEGARAID_MM=m
+CONFIG_MEGARAID_NEWGEN=y
+CONFIG_MEGARAID_SAS=m
+CONFIG_MEILHAUS=m
+CONFIG_MEMSTICK=m
+# CONFIG_MEMSTICK_DEBUG is not set
+CONFIG_MEMSTICK_JMICRON_38X=m
+CONFIG_MEMSTICK_TIFM_MS=m
+# CONFIG_MEMSTICK_UNSAFE_RESUME is not set
+# CONFIG_MEMTEST is not set
+CONFIG_MFD_CORE=m
+CONFIG_MFD_PCF50633=m
+CONFIG_MFD_SM501=m
+# CONFIG_MFD_SM501_GPIO is not set
+# CONFIG_MFD_TMIO is not set
+CONFIG_MFD_WM8350=m
+CONFIG_MFD_WM8350_I2C=m
+CONFIG_MFD_WM8400=m
+# CONFIG_MGEODEGX1 is not set
+# CONFIG_MGEODE_LX is not set
+CONFIG_MICROCODE=m
+CONFIG_MICROCODE_AMD=y
+CONFIG_MICROCODE_INTEL=y
+CONFIG_MICROCODE_OLD_INTERFACE=y
+CONFIG_MIGRATION=y
+CONFIG_MII=m
+CONFIG_MINIX_FS=m
+CONFIG_MINIX_SUBPARTITION=y
+CONFIG_MISC_DEVICES=y
+CONFIG_MISC_FILESYSTEMS=y
+CONFIG_MISDN=m
+CONFIG_MISDN_DSP=m
+CONFIG_MISDN_HFCMULTI=m
+CONFIG_MISDN_HFCPCI=m
+CONFIG_MISDN_HFCUSB=m
+CONFIG_MISDN_L1OIP=m
+# CONFIG_MK6 is not set
+# CONFIG_MK7 is not set
+# CONFIG_MK8 is not set
+CONFIG_MKISS=m
+CONFIG_MLX4_CORE=m
+CONFIG_MLX4_DEBUG=y
+CONFIG_MLX4_EN=m
+CONFIG_MLX4_INFINIBAND=m
+CONFIG_MMC=y
+CONFIG_MMC_BLOCK=m
+CONFIG_MMC_BLOCK_BOUNCE=y
+CONFIG_MMC_CB710=m
+# CONFIG_MMC_DEBUG is not set
+CONFIG_MMC_RICOH_MMC=m
+CONFIG_MMC_SDHCI=m
+CONFIG_MMC_SDHCI_PCI=m
+CONFIG_MMC_SDHCI_PLTFM=m
+CONFIG_MMC_SDRICOH_CS=m
+CONFIG_MMC_SPI=m
+# CONFIG_MMC_TEST is not set
+CONFIG_MMC_TIFM_SD=m
+# CONFIG_MMC_UNSAFE_RESUME is not set
+CONFIG_MMC_VIA_SDMMC=m
+CONFIG_MMC_WBSD=m
+CONFIG_MMU=y
+CONFIG_MMU_NOTIFIER=y
+CONFIG_MM_OWNER=y
+CONFIG_MODULES=y
+# CONFIG_MODULE_FORCE_LOAD is not set
+# CONFIG_MODULE_FORCE_UNLOAD is not set
+CONFIG_MODULE_SRCVERSION_ALL=y
+CONFIG_MODULE_UNLOAD=y
+CONFIG_MODVERSIONS=y
+CONFIG_MOUSE_APPLETOUCH=m
+CONFIG_MOUSE_BCM5974=m
+CONFIG_MOUSE_GPIO=m
+CONFIG_MOUSE_PS2=m
+CONFIG_MOUSE_PS2_ALPS=y
+CONFIG_MOUSE_PS2_ELANTECH=y
+CONFIG_MOUSE_PS2_LIFEBOOK=y
+CONFIG_MOUSE_PS2_LOGIPS2PP=y
+CONFIG_MOUSE_PS2_SYNAPTICS=y
+# CONFIG_MOUSE_PS2_TOUCHKIT is not set
+CONFIG_MOUSE_PS2_TRACKPOINT=y
+CONFIG_MOUSE_SERIAL=m
+CONFIG_MOUSE_SYNAPTICS_I2C=m
+CONFIG_MOUSE_VSXXXAA=m
+CONFIG_MOXA_INTELLIO=m
+CONFIG_MOXA_SMARTIO=m
+# CONFIG_MPENTIUM4 is not set
+# CONFIG_MPENTIUMII is not set
+# CONFIG_MPENTIUMIII is not set
+# CONFIG_MPENTIUMM is not set
+# CONFIG_MPSC is not set
+CONFIG_MSDOS_FS=m
+CONFIG_MSDOS_PARTITION=y
+CONFIG_MSI_LAPTOP=m
+CONFIG_MSPRO_BLOCK=m
+CONFIG_MTD=m
+CONFIG_MTDRAM_ERASE_SIZE=128
+CONFIG_MTDRAM_TOTAL_SIZE=4096
+CONFIG_MTD_ABSENT=m
+CONFIG_MTD_ALAUDA=m
+CONFIG_MTD_AMD76XROM=m
+CONFIG_MTD_AR7_PARTS=m
+CONFIG_MTD_BLKDEVS=m
+CONFIG_MTD_BLOCK=m
+CONFIG_MTD_BLOCK2MTD=m
+CONFIG_MTD_BLOCK_RO=m
+CONFIG_MTD_CFI=m
+# CONFIG_MTD_CFI_ADV_OPTIONS is not set
+CONFIG_MTD_CFI_AMDSTD=m
+CONFIG_MTD_CFI_I1=y
+CONFIG_MTD_CFI_I2=y
+# CONFIG_MTD_CFI_I4 is not set
+# CONFIG_MTD_CFI_I8 is not set
+CONFIG_MTD_CFI_INTELEXT=m
+CONFIG_MTD_CFI_STAA=m
+CONFIG_MTD_CFI_UTIL=m
+CONFIG_MTD_CHAR=m
+CONFIG_MTD_CK804XROM=m
+CONFIG_MTD_COMPLEX_MAPPINGS=y
+CONFIG_MTD_CONCAT=m
+CONFIG_MTD_DATAFLASH=m
+CONFIG_MTD_DATAFLASH_OTP=y
+# CONFIG_MTD_DATAFLASH_WRITE_VERIFY is not set
+# CONFIG_MTD_DEBUG is not set
+CONFIG_MTD_DOC2000=m
+CONFIG_MTD_DOC2001=m
+CONFIG_MTD_DOC2001PLUS=m
+CONFIG_MTD_DOCECC=m
+CONFIG_MTD_DOCPROBE=m
+CONFIG_MTD_DOCPROBE_ADDRESS=0
+# CONFIG_MTD_DOCPROBE_ADVANCED is not set
+CONFIG_MTD_ESB2ROM=m
+CONFIG_MTD_GEN_PROBE=m
+CONFIG_MTD_ICHXROM=m
+CONFIG_MTD_INTEL_VR_NOR=m
+CONFIG_MTD_JEDECPROBE=m
+CONFIG_MTD_L440GX=m
+CONFIG_MTD_LPDDR=m
+CONFIG_MTD_M25P80=m
+CONFIG_MTD_MAP_BANK_WIDTH_1=y
+# CONFIG_MTD_MAP_BANK_WIDTH_16 is not set
+CONFIG_MTD_MAP_BANK_WIDTH_2=y
+# CONFIG_MTD_MAP_BANK_WIDTH_32 is not set
+CONFIG_MTD_MAP_BANK_WIDTH_4=y
+# CONFIG_MTD_MAP_BANK_WIDTH_8 is not set
+CONFIG_MTD_MTDRAM=m
+CONFIG_MTD_NAND=m
+CONFIG_MTD_NAND_CAFE=m
+CONFIG_MTD_NAND_DISKONCHIP=m
+# CONFIG_MTD_NAND_DISKONCHIP_BBTWRITE is not set
+CONFIG_MTD_NAND_DISKONCHIP_PROBE_ADDRESS=0
+# CONFIG_MTD_NAND_DISKONCHIP_PROBE_ADVANCED is not set
+# CONFIG_MTD_NAND_ECC_SMC is not set
+CONFIG_MTD_NAND_IDS=m
+# CONFIG_MTD_NAND_MUSEUM_IDS is not set
+CONFIG_MTD_NAND_NANDSIM=m
+CONFIG_MTD_NAND_PLATFORM=m
+# CONFIG_MTD_NAND_VERIFY_WRITE is not set
+CONFIG_MTD_NETSC520=m
+CONFIG_MTD_NETtel=m
+CONFIG_MTD_ONENAND=m
+CONFIG_MTD_ONENAND_2X_PROGRAM=y
+# CONFIG_MTD_ONENAND_OTP is not set
+CONFIG_MTD_ONENAND_SIM=m
+CONFIG_MTD_ONENAND_VERIFY_WRITE=y
+CONFIG_MTD_OOPS=m
+CONFIG_MTD_PARTITIONS=y
+CONFIG_MTD_PCI=m
+CONFIG_MTD_PHRAM=m
+CONFIG_MTD_PHYSMAP=m
+# CONFIG_MTD_PHYSMAP_COMPAT is not set
+CONFIG_MTD_PLATRAM=m
+CONFIG_MTD_PMC551=m
+# CONFIG_MTD_PMC551_BUGFIX is not set
+# CONFIG_MTD_PMC551_DEBUG is not set
+CONFIG_MTD_QINFO_PROBE=m
+CONFIG_MTD_RAM=m
+CONFIG_MTD_REDBOOT_DIRECTORY_BLOCK=-1
+CONFIG_MTD_REDBOOT_PARTS=m
+# CONFIG_MTD_REDBOOT_PARTS_READONLY is not set
+# CONFIG_MTD_REDBOOT_PARTS_UNALLOCATED is not set
+CONFIG_MTD_ROM=m
+CONFIG_MTD_SBC_GXX=m
+CONFIG_MTD_SC520CDP=m
+CONFIG_MTD_SCB2_FLASH=m
+CONFIG_MTD_SLRAM=m
+CONFIG_MTD_TESTS=m
+CONFIG_MTD_TS5500=m
+CONFIG_MTD_UBI=m
+CONFIG_MTD_UBI_BEB_RESERVE=1
+# CONFIG_MTD_UBI_DEBUG is not set
+CONFIG_MTD_UBI_GLUEBI=m
+CONFIG_MTD_UBI_WL_THRESHOLD=4096
+CONFIG_MTRR=y
+CONFIG_MTRR_SANITIZER=y
+CONFIG_MTRR_SANITIZER_ENABLE_DEFAULT=0
+CONFIG_MTRR_SANITIZER_SPARE_REG_NR_DEFAULT=1
+# CONFIG_MVIAC3_2 is not set
+# CONFIG_MVIAC7 is not set
+CONFIG_MWAVE=m
+# CONFIG_MWINCHIP3D is not set
+# CONFIG_MWINCHIPC6 is not set
+CONFIG_MWL8K=m
+CONFIG_MYRI10GE=m
+CONFIG_MYRI10GE_DCA=y
+CONFIG_NAMESPACES=y
+CONFIG_NATIONAL_PHY=y
+CONFIG_NATSEMI=m
+CONFIG_NCPFS_EXTRAS=y
+CONFIG_NCPFS_IOCTL_LOCKING=y
+CONFIG_NCPFS_NFS_NS=y
+CONFIG_NCPFS_NLS=y
+CONFIG_NCPFS_OS2_NS=y
+CONFIG_NCPFS_PACKET_SIGNING=y
+# CONFIG_NCPFS_SMALLDOS is not set
+CONFIG_NCPFS_STRONG=y
+CONFIG_NCP_FS=m
+CONFIG_NDISWRAPPER=m
+CONFIG_NE2K_PCI=m
+CONFIG_NEED_MULTIPLE_NODES=y
+CONFIG_NET=y
+CONFIG_NETCONSOLE=m
+CONFIG_NETCONSOLE_DYNAMIC=y
+CONFIG_NETDEVICES=y
+CONFIG_NETDEV_1000=y
+CONFIG_NETDEV_10000=y
+CONFIG_NETFILTER=y
+CONFIG_NETFILTER_ADVANCED=y
+# CONFIG_NETFILTER_DEBUG is not set
+CONFIG_NETFILTER_NETLINK=m
+CONFIG_NETFILTER_NETLINK_LOG=m
+CONFIG_NETFILTER_NETLINK_QUEUE=m
+CONFIG_NETFILTER_TPROXY=m
+CONFIG_NETFILTER_XTABLES=m
+CONFIG_NETFILTER_XT_MATCH_CLUSTER=m
+CONFIG_NETFILTER_XT_MATCH_COMMENT=m
+CONFIG_NETFILTER_XT_MATCH_CONNBYTES=m
+CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=m
+CONFIG_NETFILTER_XT_MATCH_CONNMARK=m
+CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
+CONFIG_NETFILTER_XT_MATCH_DCCP=m
+CONFIG_NETFILTER_XT_MATCH_DSCP=m
+CONFIG_NETFILTER_XT_MATCH_ESP=m
+CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=m
+CONFIG_NETFILTER_XT_MATCH_HELPER=m
+CONFIG_NETFILTER_XT_MATCH_HL=m
+CONFIG_NETFILTER_XT_MATCH_IPRANGE=m
+CONFIG_NETFILTER_XT_MATCH_LENGTH=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_MAC=m
+CONFIG_NETFILTER_XT_MATCH_MARK=m
+CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
+CONFIG_NETFILTER_XT_MATCH_OSF=m
+CONFIG_NETFILTER_XT_MATCH_OWNER=m
+CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
+CONFIG_NETFILTER_XT_MATCH_PKTTYPE=m
+CONFIG_NETFILTER_XT_MATCH_POLICY=m
+CONFIG_NETFILTER_XT_MATCH_QUOTA=m
+CONFIG_NETFILTER_XT_MATCH_RATEEST=m
+CONFIG_NETFILTER_XT_MATCH_REALM=m
+CONFIG_NETFILTER_XT_MATCH_RECENT=m
+# CONFIG_NETFILTER_XT_MATCH_RECENT_PROC_COMPAT is not set
+CONFIG_NETFILTER_XT_MATCH_SCTP=m
+CONFIG_NETFILTER_XT_MATCH_SOCKET=m
+CONFIG_NETFILTER_XT_MATCH_STATE=m
+CONFIG_NETFILTER_XT_MATCH_STATISTIC=m
+CONFIG_NETFILTER_XT_MATCH_STRING=m
+CONFIG_NETFILTER_XT_MATCH_TCPMSS=m
+CONFIG_NETFILTER_XT_MATCH_TIME=m
+CONFIG_NETFILTER_XT_MATCH_U32=m
+CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
+CONFIG_NETFILTER_XT_TARGET_CONNMARK=m
+CONFIG_NETFILTER_XT_TARGET_CONNSECMARK=m
+CONFIG_NETFILTER_XT_TARGET_DSCP=m
+CONFIG_NETFILTER_XT_TARGET_HL=m
+CONFIG_NETFILTER_XT_TARGET_LED=m
+CONFIG_NETFILTER_XT_TARGET_MARK=m
+CONFIG_NETFILTER_XT_TARGET_NFLOG=m
+CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m
+CONFIG_NETFILTER_XT_TARGET_NOTRACK=m
+CONFIG_NETFILTER_XT_TARGET_RATEEST=m
+CONFIG_NETFILTER_XT_TARGET_SECMARK=m
+CONFIG_NETFILTER_XT_TARGET_TCPMSS=m
+# CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP is not set
+CONFIG_NETFILTER_XT_TARGET_TPROXY=m
+CONFIG_NETFILTER_XT_TARGET_TRACE=m
+CONFIG_NETLABEL=y
+CONFIG_NETPOLL=y
+# CONFIG_NETPOLL_TRAP is not set
+CONFIG_NETROM=m
+CONFIG_NETWORK_FILESYSTEMS=y
+CONFIG_NETWORK_SECMARK=y
+CONFIG_NETXEN_NIC=m
+CONFIG_NET_9P=m
+# CONFIG_NET_9P_DEBUG is not set
+CONFIG_NET_9P_RDMA=m
+CONFIG_NET_9P_VIRTIO=m
+CONFIG_NET_ACT_GACT=m
+CONFIG_NET_ACT_IPT=m
+CONFIG_NET_ACT_MIRRED=m
+CONFIG_NET_ACT_NAT=m
+CONFIG_NET_ACT_PEDIT=m
+CONFIG_NET_ACT_POLICE=m
+CONFIG_NET_ACT_SIMP=m
+CONFIG_NET_ACT_SKBEDIT=m
+CONFIG_NET_CLS=y
+CONFIG_NET_CLS_ACT=y
+CONFIG_NET_CLS_BASIC=m
+CONFIG_NET_CLS_CGROUP=y
+CONFIG_NET_CLS_FLOW=m
+CONFIG_NET_CLS_FW=m
+# CONFIG_NET_CLS_IND is not set
+CONFIG_NET_CLS_ROUTE=y
+CONFIG_NET_CLS_ROUTE4=m
+CONFIG_NET_CLS_RSVP=m
+CONFIG_NET_CLS_RSVP6=m
+CONFIG_NET_CLS_TCINDEX=m
+CONFIG_NET_CLS_U32=m
+CONFIG_NET_DCCPPROBE=m
+CONFIG_NET_DMA=y
+# CONFIG_NET_DROP_MONITOR is not set
+CONFIG_NET_DSA=y
+CONFIG_NET_DSA_MV88E6060=y
+CONFIG_NET_DSA_MV88E6123_61_65=y
+CONFIG_NET_DSA_MV88E6131=y
+CONFIG_NET_DSA_MV88E6XXX=y
+CONFIG_NET_DSA_MV88E6XXX_NEED_PPU=y
+CONFIG_NET_DSA_TAG_DSA=y
+CONFIG_NET_DSA_TAG_EDSA=y
+CONFIG_NET_DSA_TAG_TRAILER=y
+CONFIG_NET_EMATCH=y
+CONFIG_NET_EMATCH_CMP=m
+CONFIG_NET_EMATCH_META=m
+CONFIG_NET_EMATCH_NBYTE=m
+CONFIG_NET_EMATCH_STACK=32
+CONFIG_NET_EMATCH_TEXT=m
+CONFIG_NET_EMATCH_U32=m
+CONFIG_NET_ETHERNET=y
+CONFIG_NET_FC=y
+CONFIG_NET_IPGRE=m
+CONFIG_NET_IPGRE_BROADCAST=y
+CONFIG_NET_IPIP=m
+CONFIG_NET_KEY=m
+# CONFIG_NET_KEY_MIGRATE is not set
+CONFIG_NET_NS=y
+CONFIG_NET_PCI=y
+CONFIG_NET_PCMCIA=y
+CONFIG_NET_PKTGEN=m
+CONFIG_NET_POCKET=y
+CONFIG_NET_POLL_CONTROLLER=y
+CONFIG_NET_SB1000=m
+CONFIG_NET_SCHED=y
+CONFIG_NET_SCH_ATM=m
+CONFIG_NET_SCH_CBQ=m
+CONFIG_NET_SCH_DRR=m
+CONFIG_NET_SCH_DSMARK=m
+CONFIG_NET_SCH_FIFO=y
+CONFIG_NET_SCH_GRED=m
+CONFIG_NET_SCH_HFSC=m
+CONFIG_NET_SCH_HTB=m
+CONFIG_NET_SCH_INGRESS=m
+CONFIG_NET_SCH_MULTIQ=m
+CONFIG_NET_SCH_NETEM=m
+CONFIG_NET_SCH_PRIO=m
+CONFIG_NET_SCH_RED=m
+CONFIG_NET_SCH_SFQ=m
+CONFIG_NET_SCH_TBF=m
+CONFIG_NET_SCH_TEQL=m
+CONFIG_NET_TCPPROBE=m
+CONFIG_NET_TULIP=y
+CONFIG_NET_VENDOR_3COM=y
+CONFIG_NEW_LEDS=y
+CONFIG_NFSD=m
+CONFIG_NFSD_V2_ACL=y
+CONFIG_NFSD_V3=y
+CONFIG_NFSD_V3_ACL=y
+CONFIG_NFSD_V4=y
+CONFIG_NFS_ACL_SUPPORT=m
+CONFIG_NFS_COMMON=y
+CONFIG_NFS_FS=m
+# CONFIG_NFS_FSCACHE is not set
+CONFIG_NFS_V3=y
+CONFIG_NFS_V3_ACL=y
+CONFIG_NFS_V4=y
+# CONFIG_NFS_V4_1 is not set
+CONFIG_NFTL=m
+CONFIG_NFTL_RW=y
+CONFIG_NF_CONNTRACK=m
+CONFIG_NF_CONNTRACK_AMANDA=m
+CONFIG_NF_CONNTRACK_EVENTS=y
+CONFIG_NF_CONNTRACK_FTP=m
+CONFIG_NF_CONNTRACK_H323=m
+CONFIG_NF_CONNTRACK_IPV4=m
+CONFIG_NF_CONNTRACK_IPV6=m
+CONFIG_NF_CONNTRACK_IRC=m
+CONFIG_NF_CONNTRACK_MARK=y
+CONFIG_NF_CONNTRACK_NETBIOS_NS=m
+CONFIG_NF_CONNTRACK_PPTP=m
+CONFIG_NF_CONNTRACK_PROC_COMPAT=y
+CONFIG_NF_CONNTRACK_SANE=m
+CONFIG_NF_CONNTRACK_SECMARK=y
+CONFIG_NF_CONNTRACK_SIP=m
+CONFIG_NF_CONNTRACK_TFTP=m
+CONFIG_NF_CT_ACCT=y
+CONFIG_NF_CT_NETLINK=m
+CONFIG_NF_CT_PROTO_DCCP=m
+CONFIG_NF_CT_PROTO_GRE=m
+CONFIG_NF_CT_PROTO_SCTP=m
+CONFIG_NF_CT_PROTO_UDPLITE=m
+CONFIG_NF_DEFRAG_IPV4=m
+CONFIG_NF_NAT=m
+CONFIG_NF_NAT_AMANDA=m
+CONFIG_NF_NAT_FTP=m
+CONFIG_NF_NAT_H323=m
+CONFIG_NF_NAT_IRC=m
+CONFIG_NF_NAT_NEEDED=y
+CONFIG_NF_NAT_PPTP=m
+CONFIG_NF_NAT_PROTO_DCCP=m
+CONFIG_NF_NAT_PROTO_GRE=m
+CONFIG_NF_NAT_PROTO_SCTP=m
+CONFIG_NF_NAT_PROTO_UDPLITE=m
+CONFIG_NF_NAT_SIP=m
+CONFIG_NF_NAT_SNMP_BASIC=m
+CONFIG_NF_NAT_TFTP=m
+CONFIG_NILFS2_FS=m
+CONFIG_NIU=m
+CONFIG_NLATTR=y
+CONFIG_NLS=y
+CONFIG_NLS_ASCII=m
+CONFIG_NLS_CODEPAGE_1250=m
+CONFIG_NLS_CODEPAGE_1251=m
+CONFIG_NLS_CODEPAGE_437=m
+CONFIG_NLS_CODEPAGE_737=m
+CONFIG_NLS_CODEPAGE_775=m
+CONFIG_NLS_CODEPAGE_850=m
+CONFIG_NLS_CODEPAGE_852=m
+CONFIG_NLS_CODEPAGE_855=m
+CONFIG_NLS_CODEPAGE_857=m
+CONFIG_NLS_CODEPAGE_860=m
+CONFIG_NLS_CODEPAGE_861=m
+CONFIG_NLS_CODEPAGE_862=m
+CONFIG_NLS_CODEPAGE_863=m
+CONFIG_NLS_CODEPAGE_864=m
+CONFIG_NLS_CODEPAGE_865=m
+CONFIG_NLS_CODEPAGE_866=m
+CONFIG_NLS_CODEPAGE_869=m
+CONFIG_NLS_CODEPAGE_874=m
+CONFIG_NLS_CODEPAGE_932=m
+CONFIG_NLS_CODEPAGE_936=m
+CONFIG_NLS_CODEPAGE_949=m
+CONFIG_NLS_CODEPAGE_950=m
+CONFIG_NLS_DEFAULT="cp437"
+CONFIG_NLS_ISO8859_1=m
+CONFIG_NLS_ISO8859_13=m
+CONFIG_NLS_ISO8859_14=m
+CONFIG_NLS_ISO8859_15=m
+CONFIG_NLS_ISO8859_2=m
+CONFIG_NLS_ISO8859_3=m
+CONFIG_NLS_ISO8859_4=m
+CONFIG_NLS_ISO8859_5=m
+CONFIG_NLS_ISO8859_6=m
+CONFIG_NLS_ISO8859_7=m
+CONFIG_NLS_ISO8859_8=m
+CONFIG_NLS_ISO8859_9=m
+CONFIG_NLS_KOI8_R=m
+CONFIG_NLS_KOI8_U=m
+CONFIG_NLS_UTF8=m
+CONFIG_NODES_SHIFT=6
+CONFIG_NODES_SPAN_OTHER_NODES=y
+CONFIG_NOP_TRACER=y
+CONFIG_NOP_USB_XCEIV=m
+CONFIG_NORTEL_HERMES=m
+CONFIG_NOZOMI=m
+CONFIG_NO_HZ=y
+CONFIG_NR_CPUS=64
+CONFIG_NS83820=m
+CONFIG_NSC_FIR=m
+CONFIG_NSC_GPIO=m
+# CONFIG_NTFS_DEBUG is not set
+CONFIG_NTFS_FS=m
+# CONFIG_NTFS_RW is not set
+CONFIG_NUMA=y
+# CONFIG_NUMA_EMU is not set
+CONFIG_NVRAM=m
+CONFIG_N_HDLC=m
+# CONFIG_OCFS2_DEBUG_FS is not set
+CONFIG_OCFS2_DEBUG_MASKLOG=y
+CONFIG_OCFS2_FS=m
+CONFIG_OCFS2_FS_O2CB=m
+CONFIG_OCFS2_FS_POSIX_ACL=y
+CONFIG_OCFS2_FS_STATS=y
+CONFIG_OCFS2_FS_USERSPACE_CLUSTER=m
+CONFIG_OLD_BELKIN_DONGLE=m
+CONFIG_OMFS_FS=m
+CONFIG_OPROFILE=m
+CONFIG_OPROFILE_IBS=y
+CONFIG_OPTIMIZE_INLINING=y
+CONFIG_OSF_PARTITION=y
+# CONFIG_OTUS is not set
+CONFIG_OUTPUT_FORMAT="elf64-x86-64"
+CONFIG_P54_COMMON=m
+CONFIG_P54_LEDS=y
+CONFIG_P54_PCI=m
+CONFIG_P54_SPI=m
+CONFIG_P54_USB=m
+CONFIG_PACKARDBELL_E5=m
+CONFIG_PACKET=y
+CONFIG_PACKET_MMAP=y
+CONFIG_PAGEFLAGS_EXTENDED=y
+CONFIG_PANASONIC_LAPTOP=m
+CONFIG_PANEL=m
+# CONFIG_PANEL_CHANGE_MESSAGE is not set
+CONFIG_PANEL_PARPORT=0
+CONFIG_PANEL_PROFILE=5
+CONFIG_PANTHERLORD_FF=y
+CONFIG_PARAVIRT=y
+CONFIG_PARAVIRT_CLOCK=y
+# CONFIG_PARAVIRT_DEBUG is not set
+CONFIG_PARAVIRT_GUEST=y
+CONFIG_PARAVIRT_SPINLOCKS=y
+CONFIG_PARIDE=m
+CONFIG_PARIDE_ATEN=m
+CONFIG_PARIDE_BPCK=m
+CONFIG_PARIDE_COMM=m
+CONFIG_PARIDE_DSTR=m
+CONFIG_PARIDE_EPAT=m
+# CONFIG_PARIDE_EPATC8 is not set
+CONFIG_PARIDE_EPIA=m
+CONFIG_PARIDE_FIT2=m
+CONFIG_PARIDE_FIT3=m
+CONFIG_PARIDE_FRIQ=m
+CONFIG_PARIDE_FRPW=m
+CONFIG_PARIDE_KBIC=m
+CONFIG_PARIDE_KTTI=m
+CONFIG_PARIDE_ON20=m
+CONFIG_PARIDE_ON26=m
+CONFIG_PARIDE_PCD=m
+CONFIG_PARIDE_PD=m
+CONFIG_PARIDE_PF=m
+CONFIG_PARIDE_PG=m
+CONFIG_PARIDE_PT=m
+CONFIG_PARPORT=m
+CONFIG_PARPORT_1284=y
+CONFIG_PARPORT_AX88796=m
+# CONFIG_PARPORT_GSC is not set
+CONFIG_PARPORT_NOT_PC=y
+CONFIG_PARPORT_PC=m
+CONFIG_PARPORT_PC_FIFO=y
+CONFIG_PARPORT_PC_PCMCIA=m
+# CONFIG_PARPORT_PC_SUPERIO is not set
+CONFIG_PARPORT_SERIAL=m
+CONFIG_PARTITION_ADVANCED=y
+CONFIG_PATA_ACPI=y
+CONFIG_PATA_ALI=y
+CONFIG_PATA_AMD=y
+CONFIG_PATA_ARTOP=y
+CONFIG_PATA_ATIIXP=y
+CONFIG_PATA_CMD640_PCI=m
+CONFIG_PATA_CMD64X=y
+CONFIG_PATA_CS5520=y
+CONFIG_PATA_CS5530=y
+CONFIG_PATA_CYPRESS=m
+CONFIG_PATA_EFAR=y
+CONFIG_PATA_HPT366=y
+CONFIG_PATA_HPT37X=y
+CONFIG_PATA_HPT3X2N=m
+CONFIG_PATA_HPT3X3=y
+# CONFIG_PATA_HPT3X3_DMA is not set
+CONFIG_PATA_IT8213=m
+CONFIG_PATA_IT821X=y
+CONFIG_PATA_JMICRON=y
+CONFIG_PATA_MARVELL=y
+CONFIG_PATA_MPIIX=y
+CONFIG_PATA_NETCELL=y
+CONFIG_PATA_NINJA32=m
+CONFIG_PATA_NS87410=y
+CONFIG_PATA_NS87415=y
+CONFIG_PATA_OLDPIIX=y
+CONFIG_PATA_OPTI=m
+CONFIG_PATA_OPTIDMA=m
+CONFIG_PATA_PCMCIA=m
+CONFIG_PATA_PDC2027X=y
+CONFIG_PATA_PDC_OLD=y
+CONFIG_PATA_RADISYS=m
+CONFIG_PATA_RZ1000=y
+CONFIG_PATA_SC1200=y
+CONFIG_PATA_SCH=y
+CONFIG_PATA_SERVERWORKS=y
+CONFIG_PATA_SIL680=y
+CONFIG_PATA_SIS=y
+CONFIG_PATA_TRIFLEX=y
+CONFIG_PATA_VIA=y
+CONFIG_PATA_WINBOND=y
+# CONFIG_PC300TOO is not set
+CONFIG_PC8736x_GPIO=m
+CONFIG_PC87413_WDT=m
+CONFIG_PCCARD=m
+CONFIG_PCCARD_NONSTATIC=m
+CONFIG_PCF50633_ADC=m
+CONFIG_PCF50633_GPIO=m
+CONFIG_PCI=y
+CONFIG_PCI200SYN=m
+CONFIG_PCIEAER=y
+# CONFIG_PCIEAER_INJECT is not set
+# CONFIG_PCIEASPM is not set
+CONFIG_PCIEPORTBUS=y
+# CONFIG_PCIE_ECRC is not set
+CONFIG_PCIPCWATCHDOG=m
+CONFIG_PCI_ATMEL=m
+# CONFIG_PCI_DEBUG is not set
+CONFIG_PCI_DIRECT=y
+CONFIG_PCI_DOMAINS=y
+CONFIG_PCI_HERMES=m
+CONFIG_PCI_IOV=y
+CONFIG_PCI_LEGACY=y
+CONFIG_PCI_MMCONFIG=y
+CONFIG_PCI_MSI=y
+CONFIG_PCI_QUIRKS=y
+CONFIG_PCI_STUB=m
+CONFIG_PCMCIA=m
+CONFIG_PCMCIA_3C574=m
+CONFIG_PCMCIA_3C589=m
+CONFIG_PCMCIA_ATMEL=m
+CONFIG_PCMCIA_AXNET=m
+# CONFIG_PCMCIA_DEBUG is not set
+CONFIG_PCMCIA_FDOMAIN=m
+CONFIG_PCMCIA_FMVJ18X=m
+CONFIG_PCMCIA_HERMES=m
+CONFIG_PCMCIA_IBMTR=m
+CONFIG_PCMCIA_IOCTL=y
+CONFIG_PCMCIA_LOAD_CIS=y
+CONFIG_PCMCIA_NETWAVE=m
+CONFIG_PCMCIA_NMCLAN=m
+CONFIG_PCMCIA_PCNET=m
+CONFIG_PCMCIA_QLOGIC=m
+CONFIG_PCMCIA_RAYCS=m
+CONFIG_PCMCIA_SMC91C92=m
+CONFIG_PCMCIA_SPECTRUM=m
+CONFIG_PCMCIA_SYM53C500=m
+CONFIG_PCMCIA_WAVELAN=m
+CONFIG_PCMCIA_WL3501=m
+CONFIG_PCMCIA_XIRC2PS=m
+CONFIG_PCMCIA_XIRCOM=m
+CONFIG_PCNET32=m
+CONFIG_PCSPKR_PLATFORM=y
+CONFIG_PD6729=m
+CONFIG_PDA_POWER=m
+CONFIG_PDC_ADMA=y
+CONFIG_PERF_COUNTERS=y
+CONFIG_PHANTOM=m
+CONFIG_PHONE=m
+CONFIG_PHONET=m
+CONFIG_PHONE_IXJ=m
+CONFIG_PHONE_IXJ_PCMCIA=m
+CONFIG_PHYLIB=y
+CONFIG_PHYSICAL_ALIGN=0x1000000
+CONFIG_PHYSICAL_START=0x200000
+CONFIG_PHYS_ADDR_T_64BIT=y
+CONFIG_PID_NS=y
+CONFIG_PLAN9AUTH=m
+CONFIG_PLIP=m
+CONFIG_PLX_HERMES=m
+CONFIG_PM=y
+CONFIG_PMIC_DA903X=y
+CONFIG_PM_DEBUG=y
+CONFIG_PM_DISABLE_CONSOLE=y
+CONFIG_PM_SLEEP=y
+CONFIG_PM_SLEEP_SMP=y
+CONFIG_PM_STD_PARTITION=""
+CONFIG_PM_TEST_SUSPEND=y
+CONFIG_PM_TRACE=y
+CONFIG_PM_TRACE_RTC=y
+# CONFIG_PM_VERBOSE is not set
+CONFIG_PNP=y
+CONFIG_PNPACPI=y
+CONFIG_PNP_DEBUG_MESSAGES=y
+CONFIG_POCH=m
+CONFIG_POHMELFS=m
+CONFIG_POHMELFS_CRYPTO=y
+# CONFIG_POHMELFS_DEBUG is not set
+CONFIG_POSIX_MQUEUE=y
+CONFIG_POSIX_MQUEUE_SYSCTL=y
+CONFIG_POWER_SUPPLY=y
+# CONFIG_POWER_SUPPLY_DEBUG is not set
+CONFIG_PPDEV=m
+CONFIG_PPP=y
+CONFIG_PPPOATM=m
+CONFIG_PPPOE=m
+CONFIG_PPPOL2TP=m
+CONFIG_PPP_ASYNC=m
+CONFIG_PPP_BSDCOMP=m
+CONFIG_PPP_DEFLATE=m
+CONFIG_PPP_FILTER=y
+CONFIG_PPP_MPPE=m
+CONFIG_PPP_MULTILINK=y
+CONFIG_PPP_SYNC_TTY=m
+CONFIG_PPS=m
+# CONFIG_PPS_DEBUG is not set
+CONFIG_PREEMPT=y
+# CONFIG_PREEMPT_DESKTOP is not set
+CONFIG_PREEMPT_HARDIRQS=y
+# CONFIG_PREEMPT_NONE is not set
+CONFIG_PREEMPT_NOTIFIERS=y
+CONFIG_PREEMPT_RCU=y
+# CONFIG_PREEMPT_RCU_TRACE is not set
+CONFIG_PREEMPT_RT=y
+CONFIG_PREEMPT_SOFTIRQS=y
+# CONFIG_PREEMPT_VOLUNTARY is not set
+CONFIG_PREVENT_FIRMWARE_BUILD=y
+CONFIG_PRINTER=m
+CONFIG_PRINTK=y
+CONFIG_PRINTK_TIME=y
+# CONFIG_PRINT_QUOTA_WARNING is not set
+CONFIG_PRISM2_USB=m
+CONFIG_PRISM54=m
+CONFIG_PROC_EVENTS=y
+CONFIG_PROC_FS=y
+CONFIG_PROC_KCORE=y
+CONFIG_PROC_PAGE_MONITOR=y
+CONFIG_PROC_PID_CPUSET=y
+CONFIG_PROC_SYSCTL=y
+CONFIG_PROC_VMCORE=y
+CONFIG_PROFILE_NMI=y
+CONFIG_PROFILING=y
+# CONFIG_PROVE_LOCKING is not set
+# CONFIG_PROVIDE_OHCI1394_DMA_INIT is not set
+# CONFIG_PSS_HAVE_BOOT is not set
+CONFIG_PSS_MIXER=y
+CONFIG_QFMT_V1=m
+CONFIG_QFMT_V2=m
+CONFIG_QLA3XXX=m
+CONFIG_QLGE=m
+CONFIG_QNX4FS_FS=m
+CONFIG_QSEMI_PHY=y
+CONFIG_QUOTA=y
+CONFIG_QUOTACTL=y
+CONFIG_QUOTA_NETLINK_INTERFACE=y
+CONFIG_QUOTA_TREE=m
+CONFIG_R3964=m
+# CONFIG_R6040 is not set
+CONFIG_R8169=m
+CONFIG_R8169_VLAN=y
+CONFIG_RADIO_ADAPTERS=y
+CONFIG_RADIO_GEMTEK_PCI=m
+CONFIG_RADIO_MAESTRO=m
+CONFIG_RADIO_MAXIRADIO=m
+CONFIG_RADIO_TEA5764=m
+CONFIG_RAID_ATTRS=m
+CONFIG_RAW_DRIVER=m
+# CONFIG_RCU_TORTURE_TEST is not set
+# CONFIG_RCU_TRACE is not set
+CONFIG_RDC_17F3101X=m
+CONFIG_RDS=m
+# CONFIG_RDS_DEBUG is not set
+CONFIG_RD_BZIP2=y
+CONFIG_RD_GZIP=y
+CONFIG_RD_LZMA=y
+CONFIG_REALTEK_PHY=y
+CONFIG_REED_SOLOMON=m
+CONFIG_REED_SOLOMON_DEC16=y
+CONFIG_REGULATOR=y
+CONFIG_REGULATOR_BQ24022=m
+CONFIG_REGULATOR_DA903X=m
+# CONFIG_REGULATOR_DEBUG is not set
+# CONFIG_REGULATOR_FIXED_VOLTAGE is not set
+CONFIG_REGULATOR_LP3971=m
+CONFIG_REGULATOR_MAX1586=m
+CONFIG_REGULATOR_PCF50633=m
+CONFIG_REGULATOR_TWL4030=y
+CONFIG_REGULATOR_USERSPACE_CONSUMER=m
+CONFIG_REGULATOR_VIRTUAL_CONSUMER=m
+CONFIG_REGULATOR_WM8350=m
+CONFIG_REGULATOR_WM8400=m
+# CONFIG_REISERFS_CHECK is not set
+CONFIG_REISERFS_FS=m
+CONFIG_REISERFS_FS_POSIX_ACL=y
+CONFIG_REISERFS_FS_SECURITY=y
+CONFIG_REISERFS_FS_XATTR=y
+# CONFIG_REISERFS_PROC_INFO is not set
+CONFIG_RELAY=y
+CONFIG_RELOCATABLE=y
+CONFIG_RESOURCE_COUNTERS=y
+CONFIG_RFD_FTL=m
+CONFIG_RFKILL=y
+CONFIG_RFKILL_INPUT=y
+CONFIG_RFKILL_LEDS=y
+CONFIG_RING_BUFFER=y
+CONFIG_RIO=m
+# CONFIG_RIO_OLDPCI is not set
+CONFIG_RISCOM8=m
+CONFIG_ROADRUNNER=m
+# CONFIG_ROADRUNNER_LARGE_RINGS is not set
+CONFIG_ROCKETPORT=m
+CONFIG_ROMFS_BACKED_BY_BLOCK=y
+# CONFIG_ROMFS_BACKED_BY_BOTH is not set
+# CONFIG_ROMFS_BACKED_BY_MTD is not set
+CONFIG_ROMFS_FS=m
+CONFIG_ROMFS_ON_BLOCK=y
+CONFIG_ROSE=m
+CONFIG_RPCSEC_GSS_KRB5=m
+CONFIG_RPCSEC_GSS_SPKM3=m
+CONFIG_RT2400PCI=m
+CONFIG_RT2500PCI=m
+CONFIG_RT2500USB=m
+CONFIG_RT2800USB=m
+CONFIG_RT2860=m
+CONFIG_RT2870=m
+CONFIG_RT2X00=m
+# CONFIG_RT2X00_DEBUG is not set
+CONFIG_RT2X00_LIB=m
+CONFIG_RT2X00_LIB_CRYPTO=y
+# CONFIG_RT2X00_LIB_DEBUGFS is not set
+CONFIG_RT2X00_LIB_FIRMWARE=y
+CONFIG_RT2X00_LIB_HT=y
+CONFIG_RT2X00_LIB_LEDS=y
+CONFIG_RT2X00_LIB_PCI=m
+CONFIG_RT2X00_LIB_RFKILL=y
+CONFIG_RT2X00_LIB_USB=m
+CONFIG_RT3070=m
+CONFIG_RT61PCI=m
+CONFIG_RT73USB=m
+CONFIG_RTC_CLASS=y
+# CONFIG_RTC_DEBUG is not set
+CONFIG_RTC_DRV_BQ4802=m
+CONFIG_RTC_DRV_CMOS=y
+CONFIG_RTC_DRV_DS1286=m
+CONFIG_RTC_DRV_DS1305=m
+CONFIG_RTC_DRV_DS1307=m
+CONFIG_RTC_DRV_DS1374=m
+CONFIG_RTC_DRV_DS1390=m
+CONFIG_RTC_DRV_DS1511=m
+CONFIG_RTC_DRV_DS1553=m
+CONFIG_RTC_DRV_DS1672=m
+CONFIG_RTC_DRV_DS1742=m
+CONFIG_RTC_DRV_DS3234=m
+CONFIG_RTC_DRV_FM3130=m
+CONFIG_RTC_DRV_ISL1208=m
+CONFIG_RTC_DRV_M41T80=m
+CONFIG_RTC_DRV_M41T80_WDT=y
+CONFIG_RTC_DRV_M41T94=m
+CONFIG_RTC_DRV_M48T35=m
+CONFIG_RTC_DRV_M48T59=m
+CONFIG_RTC_DRV_M48T86=m
+CONFIG_RTC_DRV_MAX6900=m
+CONFIG_RTC_DRV_MAX6902=m
+CONFIG_RTC_DRV_PCF50633=m
+CONFIG_RTC_DRV_PCF8563=m
+CONFIG_RTC_DRV_PCF8583=m
+CONFIG_RTC_DRV_R9701=m
+CONFIG_RTC_DRV_RS5C348=m
+CONFIG_RTC_DRV_RS5C372=m
+CONFIG_RTC_DRV_RX8025=m
+CONFIG_RTC_DRV_RX8581=m
+CONFIG_RTC_DRV_S35390A=m
+CONFIG_RTC_DRV_STK17TA8=m
+CONFIG_RTC_DRV_TEST=m
+CONFIG_RTC_DRV_TWL4030=m
+CONFIG_RTC_DRV_V3020=m
+CONFIG_RTC_DRV_WM8350=m
+CONFIG_RTC_DRV_X1205=m
+CONFIG_RTC_HCTOSYS=y
+CONFIG_RTC_HCTOSYS_DEVICE="rtc0"
+CONFIG_RTC_INTF_DEV=y
+CONFIG_RTC_INTF_DEV_UIE_EMUL=y
+CONFIG_RTC_INTF_PROC=y
+CONFIG_RTC_INTF_SYSFS=y
+CONFIG_RTC_LIB=y
+CONFIG_RTL8180=m
+CONFIG_RTL8187=m
+CONFIG_RTL8187SE=m
+CONFIG_RTL8187_LEDS=y
+CONFIG_RTL8192SU=m
+CONFIG_RT_GROUP_SCHED=y
+CONFIG_RT_MUTEXES=y
+# CONFIG_RT_MUTEX_TESTER is not set
+CONFIG_RWSEM_GENERIC_SPINLOCK=y
+CONFIG_RXKAD=m
+CONFIG_S2IO=m
+# CONFIG_SAMPLES is not set
+CONFIG_SATA_AHCI=y
+CONFIG_SATA_INIC162X=y
+CONFIG_SATA_MV=m
+CONFIG_SATA_NV=y
+CONFIG_SATA_PMP=y
+CONFIG_SATA_PROMISE=y
+CONFIG_SATA_QSTOR=y
+CONFIG_SATA_SIL=y
+CONFIG_SATA_SIL24=y
+CONFIG_SATA_SIS=y
+CONFIG_SATA_SVW=y
+CONFIG_SATA_SX4=y
+CONFIG_SATA_ULI=y
+CONFIG_SATA_VIA=m
+CONFIG_SATA_VITESSE=y
+CONFIG_SBC8360_WDT=m
+CONFIG_SBC_EPX_C3_WATCHDOG=m
+CONFIG_SBNI=m
+# CONFIG_SBNI_MULTILINE is not set
+CONFIG_SC1200_WDT=m
+CONFIG_SC520_WDT=m
+CONFIG_SC6600=y
+CONFIG_SC6600_CDROM=4
+CONFIG_SC6600_CDROMBASE=0
+CONFIG_SC6600_JOY=y
+CONFIG_SC92031=m
+CONFIG_SCHEDSTATS=y
+CONFIG_SCHED_DEBUG=y
+CONFIG_SCHED_HRTICK=y
+CONFIG_SCHED_MC=y
+CONFIG_SCHED_OMIT_FRAME_POINTER=y
+CONFIG_SCHED_SMT=y
+CONFIG_SCSI=y
+CONFIG_SCSI_3W_9XXX=m
+CONFIG_SCSI_AACRAID=m
+CONFIG_SCSI_ACARD=m
+CONFIG_SCSI_ADVANSYS=m
+CONFIG_SCSI_AIC79XX=m
+CONFIG_SCSI_AIC7XXX=m
+# CONFIG_SCSI_AIC7XXX_OLD is not set
+CONFIG_SCSI_AIC94XX=m
+CONFIG_SCSI_ARCMSR=m
+CONFIG_SCSI_ARCMSR_AER=y
+CONFIG_SCSI_BNX2_ISCSI=m
+CONFIG_SCSI_BUSLOGIC=m
+CONFIG_SCSI_CONSTANTS=y
+CONFIG_SCSI_CXGB3_ISCSI=m
+CONFIG_SCSI_DC390T=m
+CONFIG_SCSI_DC395x=m
+CONFIG_SCSI_DEBUG=m
+CONFIG_SCSI_DH=y
+CONFIG_SCSI_DH_ALUA=m
+CONFIG_SCSI_DH_EMC=m
+CONFIG_SCSI_DH_HP_SW=m
+CONFIG_SCSI_DH_RDAC=m
+CONFIG_SCSI_DMA=y
+CONFIG_SCSI_DMX3191D=m
+CONFIG_SCSI_DPT_I2O=m
+CONFIG_SCSI_EATA=m
+CONFIG_SCSI_EATA_LINKED_COMMANDS=y
+CONFIG_SCSI_EATA_MAX_TAGS=16
+CONFIG_SCSI_EATA_TAGGED_QUEUE=y
+CONFIG_SCSI_ENCLOSURE=m
+CONFIG_SCSI_FC_ATTRS=m
+CONFIG_SCSI_FC_TGT_ATTRS=y
+CONFIG_SCSI_FUTURE_DOMAIN=m
+CONFIG_SCSI_GDTH=m
+CONFIG_SCSI_HPTIOP=m
+CONFIG_SCSI_IMM=m
+CONFIG_SCSI_INIA100=m
+CONFIG_SCSI_INITIO=m
+CONFIG_SCSI_IPR=m
+# CONFIG_SCSI_IPR_DUMP is not set
+# CONFIG_SCSI_IPR_TRACE is not set
+CONFIG_SCSI_IPS=m
+CONFIG_SCSI_ISCSITARGET=m
+CONFIG_SCSI_ISCSI_ATTRS=m
+# CONFIG_SCSI_IZIP_EPP16 is not set
+# CONFIG_SCSI_IZIP_SLOW_CTR is not set
+CONFIG_SCSI_LOGGING=y
+CONFIG_SCSI_LOWLEVEL=y
+CONFIG_SCSI_LOWLEVEL_PCMCIA=y
+CONFIG_SCSI_LPFC=m
+CONFIG_SCSI_LPFC_DEBUG_FS=y
+CONFIG_SCSI_MPT2SAS=m
+# CONFIG_SCSI_MPT2SAS_LOGGING is not set
+CONFIG_SCSI_MPT2SAS_MAX_SGE=128
+CONFIG_SCSI_MULTI_LUN=y
+CONFIG_SCSI_MVSAS=m
+CONFIG_SCSI_MVSAS_DEBUG=y
+CONFIG_SCSI_NETLINK=y
+# CONFIG_SCSI_OSD_DEBUG is not set
+CONFIG_SCSI_OSD_DPRINT_SENSE=1
+CONFIG_SCSI_OSD_INITIATOR=m
+CONFIG_SCSI_OSD_ULD=m
+CONFIG_SCSI_PPA=m
+CONFIG_SCSI_PROC_FS=y
+CONFIG_SCSI_QLA_FC=m
+CONFIG_SCSI_QLA_ISCSI=m
+CONFIG_SCSI_QLOGIC_1280=m
+CONFIG_SCSI_SAS_ATA=y
+CONFIG_SCSI_SAS_ATTRS=m
+CONFIG_SCSI_SAS_HOST_SMP=y
+CONFIG_SCSI_SAS_LIBSAS=m
+# CONFIG_SCSI_SAS_LIBSAS_DEBUG is not set
+CONFIG_SCSI_SCAN_ASYNC=y
+CONFIG_SCSI_SPI_ATTRS=m
+CONFIG_SCSI_SRP=m
+CONFIG_SCSI_SRP_ATTRS=m
+CONFIG_SCSI_SRP_TGT_ATTRS=y
+CONFIG_SCSI_STEX=m
+CONFIG_SCSI_SYM53C8XX_2=m
+CONFIG_SCSI_SYM53C8XX_DEFAULT_TAGS=16
+CONFIG_SCSI_SYM53C8XX_DMA_ADDRESSING_MODE=1
+CONFIG_SCSI_SYM53C8XX_MAX_TAGS=64
+CONFIG_SCSI_SYM53C8XX_MMIO=y
+CONFIG_SCSI_TGT=m
+CONFIG_SCSI_WAIT_SCAN=m
+# CONFIG_SCTP_DBG_MSG is not set
+# CONFIG_SCTP_DBG_OBJCNT is not set
+CONFIG_SCTP_HMAC_MD5=y
+# CONFIG_SCTP_HMAC_NONE is not set
+# CONFIG_SCTP_HMAC_SHA1 is not set
+CONFIG_SDIO_UART=m
+CONFIG_SECCOMP=y
+CONFIG_SECURITY=y
+CONFIG_SECURITYFS=y
+CONFIG_SECURITY_APPARMOR=y
+CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE=1
+# CONFIG_SECURITY_APPARMOR_DISABLE is not set
+CONFIG_SECURITY_APPARMOR_NETWORK=y
+CONFIG_SECURITY_DEFAULT="apparmor"
+CONFIG_SECURITY_FILE_CAPABILITIES=y
+CONFIG_SECURITY_NETWORK=y
+# CONFIG_SECURITY_NETWORK_XFRM is not set
+CONFIG_SECURITY_PATH=y
+# CONFIG_SECURITY_ROOTPLUG is not set
+CONFIG_SECURITY_SELINUX=y
+CONFIG_SECURITY_SELINUX_AVC_STATS=y
+CONFIG_SECURITY_SELINUX_BOOTPARAM=y
+CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE=0
+CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE=1
+CONFIG_SECURITY_SELINUX_DEVELOP=y
+CONFIG_SECURITY_SELINUX_DISABLE=y
+# CONFIG_SECURITY_SELINUX_POLICYDB_VERSION_MAX is not set
+CONFIG_SECURITY_SMACK=y
+CONFIG_SECURITY_TOMOYO=y
+CONFIG_SELECT_MEMORY_MODEL=y
+CONFIG_SENSORS_ABITUGURU=m
+CONFIG_SENSORS_ABITUGURU3=m
+CONFIG_SENSORS_AD7414=m
+CONFIG_SENSORS_AD7418=m
+CONFIG_SENSORS_ADCXX=m
+CONFIG_SENSORS_ADM1021=m
+CONFIG_SENSORS_ADM1025=m
+CONFIG_SENSORS_ADM1026=m
+CONFIG_SENSORS_ADM1029=m
+CONFIG_SENSORS_ADM1031=m
+CONFIG_SENSORS_ADM9240=m
+CONFIG_SENSORS_ADS7828=m
+CONFIG_SENSORS_ADT7462=m
+CONFIG_SENSORS_ADT7470=m
+CONFIG_SENSORS_ADT7473=m
+CONFIG_SENSORS_ADT7475=m
+CONFIG_SENSORS_APPLESMC=m
+CONFIG_SENSORS_ASB100=m
+CONFIG_SENSORS_ATK0110=m
+CONFIG_SENSORS_ATXP1=m
+CONFIG_SENSORS_CORETEMP=m
+CONFIG_SENSORS_DME1737=m
+CONFIG_SENSORS_DS1621=m
+CONFIG_SENSORS_F71805F=m
+CONFIG_SENSORS_F71882FG=m
+CONFIG_SENSORS_F75375S=m
+CONFIG_SENSORS_FSCHER=m
+CONFIG_SENSORS_FSCHMD=m
+CONFIG_SENSORS_FSCPOS=m
+CONFIG_SENSORS_G760A=m
+CONFIG_SENSORS_GL518SM=m
+CONFIG_SENSORS_GL520SM=m
+CONFIG_SENSORS_HDAPS=m
+CONFIG_SENSORS_I5K_AMB=m
+CONFIG_SENSORS_IBMAEM=m
+CONFIG_SENSORS_IBMPEX=m
+CONFIG_SENSORS_IT87=m
+CONFIG_SENSORS_K8TEMP=m
+CONFIG_SENSORS_LIS3LV02D=m
+CONFIG_SENSORS_LM63=m
+CONFIG_SENSORS_LM70=m
+CONFIG_SENSORS_LM75=m
+CONFIG_SENSORS_LM77=m
+CONFIG_SENSORS_LM78=m
+CONFIG_SENSORS_LM80=m
+CONFIG_SENSORS_LM83=m
+CONFIG_SENSORS_LM85=m
+CONFIG_SENSORS_LM87=m
+CONFIG_SENSORS_LM90=m
+CONFIG_SENSORS_LM92=m
+CONFIG_SENSORS_LM93=m
+CONFIG_SENSORS_LM95241=m
+CONFIG_SENSORS_LTC4215=m
+CONFIG_SENSORS_LTC4245=m
+CONFIG_SENSORS_MAX1111=m
+CONFIG_SENSORS_MAX1619=m
+CONFIG_SENSORS_MAX6650=m
+CONFIG_SENSORS_PC87360=m
+CONFIG_SENSORS_PC87427=m
+CONFIG_SENSORS_PCF8591=m
+CONFIG_SENSORS_SHT15=m
+CONFIG_SENSORS_SIS5595=m
+CONFIG_SENSORS_SMSC47B397=m
+CONFIG_SENSORS_SMSC47M1=m
+CONFIG_SENSORS_SMSC47M192=m
+CONFIG_SENSORS_THMC50=m
+CONFIG_SENSORS_TMP401=m
+CONFIG_SENSORS_TSL2550=m
+CONFIG_SENSORS_VIA686A=m
+CONFIG_SENSORS_VT1211=m
+CONFIG_SENSORS_VT8231=m
+CONFIG_SENSORS_W83627EHF=m
+CONFIG_SENSORS_W83627HF=m
+CONFIG_SENSORS_W83781D=m
+CONFIG_SENSORS_W83791D=m
+CONFIG_SENSORS_W83792D=m
+CONFIG_SENSORS_W83793=m
+CONFIG_SENSORS_W83L785TS=m
+CONFIG_SENSORS_W83L786NG=m
+CONFIG_SERIAL_8250=y
+CONFIG_SERIAL_8250_CONSOLE=y
+CONFIG_SERIAL_8250_CS=m
+# CONFIG_SERIAL_8250_DETECT_IRQ is not set
+CONFIG_SERIAL_8250_EXTENDED=y
+CONFIG_SERIAL_8250_MANY_PORTS=y
+CONFIG_SERIAL_8250_NR_UARTS=48
+CONFIG_SERIAL_8250_PCI=y
+CONFIG_SERIAL_8250_PNP=y
+CONFIG_SERIAL_8250_RSA=y
+CONFIG_SERIAL_8250_RUNTIME_UARTS=4
+CONFIG_SERIAL_8250_SHARE_IRQ=y
+CONFIG_SERIAL_CORE=y
+CONFIG_SERIAL_CORE_CONSOLE=y
+CONFIG_SERIAL_JSM=m
+CONFIG_SERIAL_MAX3100=m
+CONFIG_SERIAL_NONSTANDARD=y
+CONFIG_SERIO=y
+CONFIG_SERIO_CT82C710=m
+CONFIG_SERIO_I8042=y
+CONFIG_SERIO_LIBPS2=y
+CONFIG_SERIO_PARKBD=m
+CONFIG_SERIO_PCIPS2=m
+CONFIG_SERIO_RAW=m
+CONFIG_SERIO_SERPORT=m
+CONFIG_SFC=m
+CONFIG_SFC_MTD=y
+CONFIG_SGI_IOC4=m
+CONFIG_SGI_PARTITION=y
+CONFIG_SHMEM=y
+CONFIG_SIGMATEL_FIR=m
+CONFIG_SIGNALFD=y
+CONFIG_SIS190=m
+CONFIG_SIS900=m
+CONFIG_SKFP=m
+CONFIG_SKGE=m
+# CONFIG_SKGE_DEBUG is not set
+CONFIG_SKY2=m
+# CONFIG_SKY2_DEBUG is not set
+CONFIG_SLAB=y
+CONFIG_SLABINFO=y
+CONFIG_SLHC=y
+CONFIG_SLICOSS=m
+CONFIG_SLIP=m
+CONFIG_SLIP_COMPRESSED=y
+CONFIG_SLIP_MODE_SLIP6=y
+CONFIG_SLIP_SMART=y
+# CONFIG_SLOB is not set
+CONFIG_SLOW_WORK=y
+# CONFIG_SLUB is not set
+CONFIG_SMARTJOYPLUS_FF=y
+CONFIG_SMB_FS=m
+# CONFIG_SMB_NLS_DEFAULT is not set
+CONFIG_SMC_IRCC_FIR=m
+CONFIG_SMP=y
+CONFIG_SMSC37B787_WDT=m
+CONFIG_SMSC9420=m
+CONFIG_SMSC_PHY=y
+CONFIG_SMSC_SCH311X_WDT=m
+CONFIG_SMS_SDIO_DRV=m
+CONFIG_SMS_SIANO_MDTV=m
+CONFIG_SMS_USB_DRV=m
+CONFIG_SND=m
+CONFIG_SND_AC97_CODEC=m
+CONFIG_SND_AC97_POWER_SAVE=y
+CONFIG_SND_AC97_POWER_SAVE_DEFAULT=0
+CONFIG_SND_AD1889=m
+CONFIG_SND_ALI5451=m
+CONFIG_SND_ALS300=m
+CONFIG_SND_ALS4000=m
+CONFIG_SND_ATIIXP=m
+CONFIG_SND_ATIIXP_MODEM=m
+CONFIG_SND_AU8810=m
+CONFIG_SND_AU8820=m
+CONFIG_SND_AU8830=m
+CONFIG_SND_AW2=m
+CONFIG_SND_AZT3328=m
+CONFIG_SND_BT87X=m
+# CONFIG_SND_BT87X_OVERCLOCK is not set
+CONFIG_SND_CA0106=m
+CONFIG_SND_CMIPCI=m
+CONFIG_SND_CS4281=m
+CONFIG_SND_CS46XX=m
+CONFIG_SND_CS46XX_NEW_DSP=y
+CONFIG_SND_CS5530=m
+CONFIG_SND_CTXFI=m
+CONFIG_SND_DARLA20=m
+CONFIG_SND_DARLA24=m
+# CONFIG_SND_DEBUG is not set
+CONFIG_SND_DRIVERS=y
+CONFIG_SND_DUMMY=m
+CONFIG_SND_DYNAMIC_MINORS=y
+CONFIG_SND_ECHO3G=m
+CONFIG_SND_EMU10K1=m
+CONFIG_SND_EMU10K1X=m
+CONFIG_SND_EMU10K1_SEQ=m
+CONFIG_SND_ENS1370=m
+CONFIG_SND_ENS1371=m
+CONFIG_SND_ES1938=m
+CONFIG_SND_ES1968=m
+CONFIG_SND_FM801=m
+CONFIG_SND_FM801_TEA575X=m
+CONFIG_SND_FM801_TEA575X_BOOL=y
+CONFIG_SND_GINA20=m
+CONFIG_SND_GINA24=m
+CONFIG_SND_HDA_CODEC_ANALOG=y
+CONFIG_SND_HDA_CODEC_ATIHDMI=y
+CONFIG_SND_HDA_CODEC_CA0110=y
+CONFIG_SND_HDA_CODEC_CMEDIA=y
+CONFIG_SND_HDA_CODEC_CONEXANT=y
+CONFIG_SND_HDA_CODEC_INTELHDMI=y
+CONFIG_SND_HDA_CODEC_NVHDMI=y
+CONFIG_SND_HDA_CODEC_REALTEK=y
+CONFIG_SND_HDA_CODEC_SI3054=y
+CONFIG_SND_HDA_CODEC_SIGMATEL=y
+CONFIG_SND_HDA_CODEC_VIA=y
+CONFIG_SND_HDA_ELD=y
+CONFIG_SND_HDA_GENERIC=y
+CONFIG_SND_HDA_HWDEP=y
+CONFIG_SND_HDA_INPUT_BEEP=y
+CONFIG_SND_HDA_INPUT_JACK=y
+CONFIG_SND_HDA_INTEL=m
+CONFIG_SND_HDA_POWER_SAVE=y
+CONFIG_SND_HDA_POWER_SAVE_DEFAULT=0
+CONFIG_SND_HDA_RECONFIG=y
+CONFIG_SND_HDSP=m
+CONFIG_SND_HDSPM=m
+CONFIG_SND_HIFIER=m
+CONFIG_SND_HRTIMER=m
+CONFIG_SND_HWDEP=m
+CONFIG_SND_ICE1712=m
+CONFIG_SND_ICE1724=m
+CONFIG_SND_INDIGO=m
+CONFIG_SND_INDIGODJ=m
+CONFIG_SND_INDIGODJX=m
+CONFIG_SND_INDIGOIO=m
+CONFIG_SND_INDIGOIOX=m
+CONFIG_SND_INTEL8X0=m
+CONFIG_SND_INTEL8X0M=m
+CONFIG_SND_JACK=y
+CONFIG_SND_KORG1212=m
+CONFIG_SND_LAYLA20=m
+CONFIG_SND_LAYLA24=m
+CONFIG_SND_LX6464ES=m
+CONFIG_SND_MAESTRO3=m
+CONFIG_SND_MIA=m
+CONFIG_SND_MIXART=m
+CONFIG_SND_MIXER_OSS=m
+CONFIG_SND_MONA=m
+CONFIG_SND_MPU401=m
+CONFIG_SND_MPU401_UART=m
+CONFIG_SND_MTPAV=m
+CONFIG_SND_MTS64=m
+CONFIG_SND_NM256=m
+CONFIG_SND_OPL3_LIB=m
+CONFIG_SND_OPL3_LIB_SEQ=m
+# CONFIG_SND_OPL4_LIB_SEQ is not set
+CONFIG_SND_OSSEMUL=y
+CONFIG_SND_OXYGEN=m
+CONFIG_SND_OXYGEN_LIB=m
+CONFIG_SND_PCI=y
+CONFIG_SND_PCM=m
+CONFIG_SND_PCMCIA=y
+CONFIG_SND_PCM_OSS=m
+CONFIG_SND_PCM_OSS_PLUGINS=y
+CONFIG_SND_PCSP=m
+CONFIG_SND_PCXHR=m
+CONFIG_SND_PDAUDIOCF=m
+CONFIG_SND_PORTMAN2X4=m
+CONFIG_SND_RAWMIDI=m
+CONFIG_SND_RAWMIDI_SEQ=m
+CONFIG_SND_RIPTIDE=m
+CONFIG_SND_RME32=m
+CONFIG_SND_RME96=m
+CONFIG_SND_RME9652=m
+CONFIG_SND_SB16_DSP=m
+# CONFIG_SND_SBAWE_SEQ is not set
+CONFIG_SND_SB_COMMON=m
+CONFIG_SND_SEQUENCER=m
+CONFIG_SND_SEQUENCER_OSS=y
+CONFIG_SND_SEQ_DUMMY=m
+CONFIG_SND_SEQ_HRTIMER_DEFAULT=y
+CONFIG_SND_SERIAL_U16550=m
+CONFIG_SND_SOC=m
+CONFIG_SND_SOC_AD73311=m
+CONFIG_SND_SOC_AK4104=m
+CONFIG_SND_SOC_AK4535=m
+CONFIG_SND_SOC_ALL_CODECS=m
+CONFIG_SND_SOC_CS4270=m
+CONFIG_SND_SOC_I2C_AND_SPI=m
+CONFIG_SND_SOC_L3=m
+CONFIG_SND_SOC_PCM3008=m
+CONFIG_SND_SOC_SPDIF=m
+CONFIG_SND_SOC_SSM2602=m
+CONFIG_SND_SOC_TLV320AIC23=m
+CONFIG_SND_SOC_TLV320AIC26=m
+CONFIG_SND_SOC_TLV320AIC3X=m
+CONFIG_SND_SOC_TWL4030=m
+CONFIG_SND_SOC_UDA134X=m
+CONFIG_SND_SOC_UDA1380=m
+CONFIG_SND_SOC_WM8350=m
+CONFIG_SND_SOC_WM8400=m
+CONFIG_SND_SOC_WM8510=m
+CONFIG_SND_SOC_WM8580=m
+CONFIG_SND_SOC_WM8728=m
+CONFIG_SND_SOC_WM8731=m
+CONFIG_SND_SOC_WM8750=m
+CONFIG_SND_SOC_WM8753=m
+CONFIG_SND_SOC_WM8900=m
+CONFIG_SND_SOC_WM8903=m
+CONFIG_SND_SOC_WM8940=m
+CONFIG_SND_SOC_WM8960=m
+CONFIG_SND_SOC_WM8971=m
+CONFIG_SND_SOC_WM8988=m
+CONFIG_SND_SOC_WM8990=m
+CONFIG_SND_SOC_WM9081=m
+CONFIG_SND_SONICVIBES=m
+CONFIG_SND_SPI=y
+CONFIG_SND_SUPPORT_OLD_API=y
+CONFIG_SND_TIMER=m
+CONFIG_SND_TRIDENT=m
+CONFIG_SND_USB=y
+CONFIG_SND_USB_AUDIO=m
+CONFIG_SND_USB_CAIAQ=m
+CONFIG_SND_USB_CAIAQ_INPUT=y
+CONFIG_SND_USB_US122L=m
+CONFIG_SND_USB_USX2Y=m
+# CONFIG_SND_VERBOSE_PRINTK is not set
+CONFIG_SND_VERBOSE_PROCFS=y
+CONFIG_SND_VIA82XX=m
+CONFIG_SND_VIA82XX_MODEM=m
+CONFIG_SND_VIRMIDI=m
+CONFIG_SND_VIRTUOSO=m
+CONFIG_SND_VMASTER=y
+CONFIG_SND_VX222=m
+CONFIG_SND_VXPOCKET=m
+CONFIG_SND_VX_LIB=m
+CONFIG_SND_YMFPCI=m
+CONFIG_SOC_CAMERA=m
+CONFIG_SOC_CAMERA_MT9M001=m
+CONFIG_SOC_CAMERA_MT9M111=m
+CONFIG_SOC_CAMERA_MT9T031=m
+CONFIG_SOC_CAMERA_MT9V022=m
+CONFIG_SOC_CAMERA_OV772X=m
+CONFIG_SOC_CAMERA_PLATFORM=m
+CONFIG_SOC_CAMERA_TW9910=m
+CONFIG_SOFT_WATCHDOG=m
+CONFIG_SOLARIS_X86_PARTITION=y
+CONFIG_SONYPI_COMPAT=y
+CONFIG_SONY_LAPTOP=m
+CONFIG_SOUND=m
+CONFIG_SOUND_AEDSP16=m
+CONFIG_SOUND_DMAP=y
+CONFIG_SOUND_KAHLUA=m
+CONFIG_SOUND_MPU401=m
+CONFIG_SOUND_MSS=m
+CONFIG_SOUND_OSS=m
+CONFIG_SOUND_OSS_CORE=y
+CONFIG_SOUND_PAS=m
+CONFIG_SOUND_PRIME=m
+CONFIG_SOUND_PSS=m
+CONFIG_SOUND_SB=m
+CONFIG_SOUND_SSCAPE=m
+# CONFIG_SOUND_TRACEINIT is not set
+CONFIG_SOUND_TRIX=m
+CONFIG_SOUND_UART6850=m
+CONFIG_SOUND_VMIDI=m
+CONFIG_SOUND_YM3812=m
+CONFIG_SPARSEMEM=y
+CONFIG_SPARSEMEM_EXTREME=y
+CONFIG_SPARSEMEM_MANUAL=y
+CONFIG_SPARSEMEM_VMEMMAP=y
+CONFIG_SPARSEMEM_VMEMMAP_ENABLE=y
+CONFIG_SPECIALIX=m
+CONFIG_SPI=y
+CONFIG_SPI_BITBANG=m
+CONFIG_SPI_BUTTERFLY=m
+# CONFIG_SPI_DEBUG is not set
+CONFIG_SPI_GPIO=m
+CONFIG_SPI_LM70_LLP=m
+CONFIG_SPI_MASTER=y
+CONFIG_SPI_SPIDEV=m
+CONFIG_SPI_TLE62X0=m
+CONFIG_SPLIT_PTLOCK_CPUS=4
+CONFIG_SQUASHFS=m
+# CONFIG_SQUASHFS_EMBEDDED is not set
+CONFIG_SQUASHFS_FRAGMENT_CACHE_SIZE=3
+CONFIG_SSB=m
+CONFIG_SSB_B43_PCI_BRIDGE=y
+# CONFIG_SSB_DEBUG is not set
+CONFIG_SSB_DRIVER_PCICORE=y
+CONFIG_SSB_DRIVER_PCICORE_POSSIBLE=y
+CONFIG_SSB_PCIHOST=y
+CONFIG_SSB_PCIHOST_POSSIBLE=y
+# CONFIG_SSB_PCMCIAHOST is not set
+CONFIG_SSB_PCMCIAHOST_POSSIBLE=y
+CONFIG_SSB_POSSIBLE=y
+CONFIG_SSB_SPROM=y
+CONFIG_SSFDC=m
+CONFIG_STACKTRACE=y
+CONFIG_STACKTRACE_SUPPORT=y
+CONFIG_STAGING=y
+# CONFIG_STAGING_EXCLUDE_BUILD is not set
+CONFIG_STALDRV=y
+CONFIG_STALLION=m
+# CONFIG_STANDALONE is not set
+CONFIG_STE10XP=y
+# CONFIG_STLC45XX is not set
+CONFIG_STOP_MACHINE=y
+CONFIG_STP=m
+CONFIG_STRICT_DEVMEM=y
+CONFIG_STRIP=m
+# CONFIG_STRIP_ASM_SYMS is not set
+CONFIG_SUNDANCE=m
+# CONFIG_SUNDANCE_MMIO is not set
+CONFIG_SUNGEM=m
+CONFIG_SUNRPC=m
+CONFIG_SUNRPC_GSS=m
+CONFIG_SUNRPC_XPRT_RDMA=m
+CONFIG_SUN_PARTITION=y
+CONFIG_SUSPEND=y
+CONFIG_SUSPEND_FREEZER=y
+CONFIG_SWAP=y
+CONFIG_SWIOTLB=y
+CONFIG_SX=m
+CONFIG_SXG=m
+CONFIG_SYNCLINK=m
+CONFIG_SYNCLINKMP=m
+CONFIG_SYNCLINK_CS=m
+CONFIG_SYNCLINK_GT=m
+CONFIG_SYN_COOKIES=y
+CONFIG_SYSCTL=y
+CONFIG_SYSCTL_SYSCALL=y
+CONFIG_SYSCTL_SYSCALL_CHECK=y
+CONFIG_SYSFS=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
+CONFIG_SYSV68_PARTITION=y
+CONFIG_SYSVIPC=y
+CONFIG_SYSVIPC_COMPAT=y
+CONFIG_SYSVIPC_SYSCTL=y
+CONFIG_SYSV_FS=m
+CONFIG_SYS_HYPERVISOR=y
+CONFIG_TABLET_USB_ACECAD=m
+CONFIG_TABLET_USB_AIPTEK=m
+CONFIG_TABLET_USB_GTCO=m
+CONFIG_TABLET_USB_KBTAB=m
+CONFIG_TABLET_USB_WACOM=m
+CONFIG_TASKSTATS=y
+# CONFIG_TASK_DELAY_ACCT is not set
+CONFIG_TASK_IO_ACCOUNTING=y
+CONFIG_TASK_XACCT=y
+CONFIG_TCG_ATMEL=m
+CONFIG_TCG_INFINEON=m
+CONFIG_TCG_NSC=m
+CONFIG_TCG_TIS=m
+CONFIG_TCG_TPM=m
+CONFIG_TCP_CONG_ADVANCED=y
+CONFIG_TCP_CONG_BIC=m
+CONFIG_TCP_CONG_CUBIC=y
+CONFIG_TCP_CONG_HSTCP=m
+CONFIG_TCP_CONG_HTCP=m
+CONFIG_TCP_CONG_HYBLA=m
+CONFIG_TCP_CONG_ILLINOIS=m
+CONFIG_TCP_CONG_LP=m
+CONFIG_TCP_CONG_SCALABLE=m
+CONFIG_TCP_CONG_VEGAS=m
+CONFIG_TCP_CONG_VENO=m
+CONFIG_TCP_CONG_WESTWOOD=m
+CONFIG_TCP_CONG_YEAH=m
+CONFIG_TCP_MD5SIG=y
+CONFIG_TEHUTI=m
+CONFIG_TEKRAM_DONGLE=m
+CONFIG_TELCLOCK=m
+CONFIG_TEXTSEARCH=y
+CONFIG_TEXTSEARCH_BM=m
+CONFIG_TEXTSEARCH_FSM=m
+CONFIG_TEXTSEARCH_KMP=m
+CONFIG_THERMAL=y
+CONFIG_THERMAL_HWMON=y
+CONFIG_THINKPAD_ACPI=m
+# CONFIG_THINKPAD_ACPI_DEBUG is not set
+CONFIG_THINKPAD_ACPI_DEBUGFACILITIES=y
+CONFIG_THINKPAD_ACPI_HOTKEY_POLL=y
+# CONFIG_THINKPAD_ACPI_UNSAFE_LEDS is not set
+CONFIG_THINKPAD_ACPI_VIDEO=y
+CONFIG_THRUSTMASTER_FF=y
+CONFIG_TICK_ONESHOT=y
+CONFIG_TIFM_7XX1=m
+CONFIG_TIFM_CORE=m
+CONFIG_TIGON3=m
+CONFIG_TIMERFD=y
+CONFIG_TIMER_STATS=y
+CONFIG_TIPC=m
+# CONFIG_TIPC_ADVANCED is not set
+# CONFIG_TIPC_DEBUG is not set
+CONFIG_TLAN=m
+CONFIG_TMD_HERMES=m
+CONFIG_TMPFS=y
+CONFIG_TMPFS_POSIX_ACL=y
+CONFIG_TMS380TR=m
+CONFIG_TMSPCI=m
+CONFIG_TOIM3232_DONGLE=m
+CONFIG_TOUCHSCREEN_AD7877=m
+CONFIG_TOUCHSCREEN_AD7879=m
+CONFIG_TOUCHSCREEN_AD7879_I2C=m
+CONFIG_TOUCHSCREEN_ADS7846=m
+CONFIG_TOUCHSCREEN_DA9034=m
+CONFIG_TOUCHSCREEN_EETI=m
+CONFIG_TOUCHSCREEN_ELO=m
+CONFIG_TOUCHSCREEN_FUJITSU=m
+CONFIG_TOUCHSCREEN_GUNZE=m
+CONFIG_TOUCHSCREEN_INEXIO=m
+CONFIG_TOUCHSCREEN_MK712=m
+CONFIG_TOUCHSCREEN_MTOUCH=m
+CONFIG_TOUCHSCREEN_PENMOUNT=m
+CONFIG_TOUCHSCREEN_TOUCHIT213=m
+CONFIG_TOUCHSCREEN_TOUCHRIGHT=m
+CONFIG_TOUCHSCREEN_TOUCHWIN=m
+CONFIG_TOUCHSCREEN_TSC2007=m
+CONFIG_TOUCHSCREEN_UCB1400=m
+CONFIG_TOUCHSCREEN_USB_3M=y
+CONFIG_TOUCHSCREEN_USB_COMPOSITE=m
+CONFIG_TOUCHSCREEN_USB_DMC_TSC10=y
+CONFIG_TOUCHSCREEN_USB_EGALAX=y
+CONFIG_TOUCHSCREEN_USB_ETURBO=y
+CONFIG_TOUCHSCREEN_USB_GENERAL_TOUCH=y
+CONFIG_TOUCHSCREEN_USB_GOTOP=y
+CONFIG_TOUCHSCREEN_USB_GUNZE=y
+CONFIG_TOUCHSCREEN_USB_IDEALTEK=y
+CONFIG_TOUCHSCREEN_USB_IRTOUCH=y
+CONFIG_TOUCHSCREEN_USB_ITM=y
+CONFIG_TOUCHSCREEN_USB_PANJIT=y
+CONFIG_TOUCHSCREEN_W90X900=m
+CONFIG_TOUCHSCREEN_WACOM_W8001=m
+CONFIG_TOUCHSCREEN_WM9705=y
+CONFIG_TOUCHSCREEN_WM9712=y
+CONFIG_TOUCHSCREEN_WM9713=y
+CONFIG_TOUCHSCREEN_WM97XX=m
+CONFIG_TPS65010=m
+CONFIG_TR=y
+CONFIG_TRACEPOINTS=y
+CONFIG_TRACE_IRQFLAGS_SUPPORT=y
+CONFIG_TRACING=y
+CONFIG_TRACING_SUPPORT=y
+CONFIG_TRANZPORT=m
+# CONFIG_TREE_RCU is not set
+# CONFIG_TREE_RCU_TRACE is not set
+CONFIG_TTPCI_EEPROM=m
+CONFIG_TULIP=m
+# CONFIG_TULIP_MMIO is not set
+# CONFIG_TULIP_MWI is not set
+# CONFIG_TULIP_NAPI is not set
+CONFIG_TUN=m
+CONFIG_TWL4030_CORE=y
+CONFIG_TWL4030_USB=m
+CONFIG_TWL4030_WATCHDOG=m
+CONFIG_TYPHOON=m
+CONFIG_UBIFS_FS=m
+# CONFIG_UBIFS_FS_ADVANCED_COMPR is not set
+# CONFIG_UBIFS_FS_DEBUG is not set
+CONFIG_UBIFS_FS_LZO=y
+CONFIG_UBIFS_FS_XATTR=y
+CONFIG_UBIFS_FS_ZLIB=y
+CONFIG_UCB1400_CORE=m
+CONFIG_UDF_FS=m
+CONFIG_UDF_NLS=y
+CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+# CONFIG_UFS_DEBUG is not set
+CONFIG_UFS_FS=m
+# CONFIG_UFS_FS_WRITE is not set
+CONFIG_UID16=y
+CONFIG_UIO=m
+CONFIG_UIO_AEC=m
+CONFIG_UIO_CIF=m
+CONFIG_UIO_PDRV=m
+CONFIG_UIO_PDRV_GENIRQ=m
+CONFIG_UIO_SERCOS3=m
+CONFIG_UIO_SMX=m
+CONFIG_ULI526X=m
+CONFIG_ULTRIX_PARTITION=y
+CONFIG_UNIX=y
+CONFIG_UNIX98_PTYS=y
+CONFIG_UNIXWARE_DISKLABEL=y
+CONFIG_UNUSED_SYMBOLS=y
+CONFIG_USB=y
+CONFIG_USBPCWATCHDOG=m
+CONFIG_USB_ACM=m
+CONFIG_USB_ADUTUX=m
+CONFIG_USB_ALI_M5632=y
+CONFIG_USB_AN2720=y
+# CONFIG_USB_ANNOUNCE_NEW_DEVICES is not set
+CONFIG_USB_APPLEDISPLAY=m
+CONFIG_USB_ARCH_HAS_EHCI=y
+CONFIG_USB_ARCH_HAS_HCD=y
+CONFIG_USB_ARCH_HAS_OHCI=y
+CONFIG_USB_ARMLINUX=y
+CONFIG_USB_ATM=m
+CONFIG_USB_ATMEL=m
+CONFIG_USB_AUDIO=m
+CONFIG_USB_BELKIN=y
+CONFIG_USB_BERRY_CHARGE=m
+CONFIG_USB_C67X00_HCD=m
+CONFIG_USB_CATC=m
+CONFIG_USB_CDC_COMPOSITE=m
+CONFIG_USB_CDC_PHONET=m
+CONFIG_USB_CPC=m
+CONFIG_USB_CXACRU=m
+CONFIG_USB_CYPRESS_CY7C63=m
+CONFIG_USB_CYTHERM=m
+CONFIG_USB_DABUSB=m
+# CONFIG_USB_DEBUG is not set
+CONFIG_USB_DEVICEFS=y
+# CONFIG_USB_DEVICE_CLASS is not set
+CONFIG_USB_DSBR=m
+# CONFIG_USB_DYNAMIC_MINORS is not set
+CONFIG_USB_EHCI_HCD=y
+CONFIG_USB_EHCI_ROOT_HUB_TT=y
+CONFIG_USB_EHCI_TT_NEWSCHED=y
+CONFIG_USB_EMI26=m
+CONFIG_USB_EMI62=m
+CONFIG_USB_EPSON2888=y
+CONFIG_USB_ET61X251=m
+CONFIG_USB_ETH=m
+CONFIG_USB_ETH_RNDIS=y
+CONFIG_USB_EZUSB=y
+CONFIG_USB_FILE_STORAGE=m
+# CONFIG_USB_FILE_STORAGE_TEST is not set
+CONFIG_USB_FTDI_ELAN=m
+CONFIG_USB_GADGET=m
+CONFIG_USB_GADGETFS=m
+# CONFIG_USB_GADGET_AMD5536UDC is not set
+# CONFIG_USB_GADGET_AT91 is not set
+# CONFIG_USB_GADGET_ATMEL_USBA is not set
+# CONFIG_USB_GADGET_CI13XXX is not set
+# CONFIG_USB_GADGET_DEBUG is not set
+# CONFIG_USB_GADGET_DEBUG_FILES is not set
+# CONFIG_USB_GADGET_DEBUG_FS is not set
+CONFIG_USB_GADGET_DUALSPEED=y
+# CONFIG_USB_GADGET_DUMMY_HCD is not set
+# CONFIG_USB_GADGET_FSL_QE is not set
+# CONFIG_USB_GADGET_FSL_USB2 is not set
+# CONFIG_USB_GADGET_GOKU is not set
+# CONFIG_USB_GADGET_IMX is not set
+# CONFIG_USB_GADGET_LANGWELL is not set
+# CONFIG_USB_GADGET_LH7A40X is not set
+# CONFIG_USB_GADGET_M66592 is not set
+# CONFIG_USB_GADGET_MUSB_HDRC is not set
+CONFIG_USB_GADGET_NET2280=y
+# CONFIG_USB_GADGET_OMAP is not set
+# CONFIG_USB_GADGET_PXA25X is not set
+# CONFIG_USB_GADGET_PXA27X is not set
+# CONFIG_USB_GADGET_S3C2410 is not set
+# CONFIG_USB_GADGET_S3C_HSOTG is not set
+CONFIG_USB_GADGET_SELECTED=y
+CONFIG_USB_GADGET_VBUS_DRAW=2
+CONFIG_USB_GPIO_VBUS=m
+CONFIG_USB_GSPCA=m
+CONFIG_USB_GSPCA_CONEX=m
+CONFIG_USB_GSPCA_ETOMS=m
+CONFIG_USB_GSPCA_FINEPIX=m
+CONFIG_USB_GSPCA_MARS=m
+CONFIG_USB_GSPCA_MR97310A=m
+CONFIG_USB_GSPCA_OV519=m
+CONFIG_USB_GSPCA_OV534=m
+CONFIG_USB_GSPCA_PAC207=m
+CONFIG_USB_GSPCA_PAC7311=m
+CONFIG_USB_GSPCA_SN9C20X=m
+# CONFIG_USB_GSPCA_SN9C20X_EVDEV is not set
+CONFIG_USB_GSPCA_SONIXB=m
+CONFIG_USB_GSPCA_SONIXJ=m
+CONFIG_USB_GSPCA_SPCA500=m
+CONFIG_USB_GSPCA_SPCA501=m
+CONFIG_USB_GSPCA_SPCA505=m
+CONFIG_USB_GSPCA_SPCA506=m
+CONFIG_USB_GSPCA_SPCA508=m
+CONFIG_USB_GSPCA_SPCA561=m
+CONFIG_USB_GSPCA_SQ905=m
+CONFIG_USB_GSPCA_SQ905C=m
+CONFIG_USB_GSPCA_STK014=m
+CONFIG_USB_GSPCA_SUNPLUS=m
+CONFIG_USB_GSPCA_T613=m
+CONFIG_USB_GSPCA_TV8532=m
+CONFIG_USB_GSPCA_VC032X=m
+CONFIG_USB_GSPCA_ZC3XX=m
+CONFIG_USB_G_PRINTER=m
+CONFIG_USB_G_SERIAL=m
+CONFIG_USB_HID=m
+CONFIG_USB_HIDDEV=y
+CONFIG_USB_HSO=m
+CONFIG_USB_HWA_HCD=m
+CONFIG_USB_IBMCAM=m
+CONFIG_USB_IDMOUSE=m
+CONFIG_USB_IOWARRIOR=m
+CONFIG_USB_IP_COMMON=m
+CONFIG_USB_IP_HOST=m
+CONFIG_USB_IP_VHCI_HCD=m
+CONFIG_USB_IRDA=m
+CONFIG_USB_ISIGHTFW=m
+CONFIG_USB_ISP116X_HCD=m
+CONFIG_USB_ISP1760_HCD=m
+CONFIG_USB_KAWETH=m
+CONFIG_USB_KC2190=y
+CONFIG_USB_KONICAWC=m
+CONFIG_USB_LCD=m
+CONFIG_USB_LD=m
+CONFIG_USB_LED=m
+CONFIG_USB_LEGOTOWER=m
+# CONFIG_USB_LIBUSUAL is not set
+CONFIG_USB_M5602=m
+CONFIG_USB_MDC800=m
+CONFIG_USB_MICROTEK=m
+CONFIG_USB_MIDI_GADGET=m
+CONFIG_USB_MON=y
+CONFIG_USB_MR800=m
+CONFIG_USB_NET2280=m
+CONFIG_USB_NET_AX8817X=m
+CONFIG_USB_NET_CDCETHER=m
+CONFIG_USB_NET_CDC_EEM=m
+CONFIG_USB_NET_CDC_SUBSET=m
+CONFIG_USB_NET_DM9601=m
+CONFIG_USB_NET_GL620A=m
+CONFIG_USB_NET_INT51X1=m
+CONFIG_USB_NET_MCS7830=m
+CONFIG_USB_NET_NET1080=m
+CONFIG_USB_NET_PLUSB=m
+CONFIG_USB_NET_RNDIS_HOST=m
+CONFIG_USB_NET_RNDIS_WLAN=m
+CONFIG_USB_NET_SMSC95XX=m
+CONFIG_USB_NET_ZAURUS=m
+# CONFIG_USB_OHCI_BIG_ENDIAN_DESC is not set
+# CONFIG_USB_OHCI_BIG_ENDIAN_MMIO is not set
+CONFIG_USB_OHCI_HCD=y
+CONFIG_USB_OHCI_LITTLE_ENDIAN=y
+# CONFIG_USB_OTG is not set
+CONFIG_USB_OTG_UTILS=y
+# CONFIG_USB_OV511 is not set
+CONFIG_USB_OXU210HP_HCD=m
+CONFIG_USB_PEGASUS=m
+CONFIG_USB_PRINTER=m
+CONFIG_USB_PWC=m
+# CONFIG_USB_PWC_DEBUG is not set
+CONFIG_USB_PWC_INPUT_EVDEV=y
+CONFIG_USB_QUICKCAM_MESSENGER=m
+CONFIG_USB_R8A66597_HCD=m
+CONFIG_USB_RIO500=m
+CONFIG_USB_RTL8150=m
+CONFIG_USB_S2255=m
+CONFIG_USB_SE401=m
+CONFIG_USB_SERIAL=m
+CONFIG_USB_SERIAL_AIRCABLE=m
+CONFIG_USB_SERIAL_ARK3116=m
+CONFIG_USB_SERIAL_BELKIN=m
+CONFIG_USB_SERIAL_CH341=m
+CONFIG_USB_SERIAL_CP210X=m
+CONFIG_USB_SERIAL_CYBERJACK=m
+CONFIG_USB_SERIAL_CYPRESS_M8=m
+CONFIG_USB_SERIAL_DEBUG=m
+CONFIG_USB_SERIAL_DIGI_ACCELEPORT=m
+CONFIG_USB_SERIAL_EDGEPORT=m
+CONFIG_USB_SERIAL_EDGEPORT_TI=m
+CONFIG_USB_SERIAL_EMPEG=m
+CONFIG_USB_SERIAL_FTDI_SIO=m
+CONFIG_USB_SERIAL_FUNSOFT=m
+CONFIG_USB_SERIAL_GARMIN=m
+CONFIG_USB_SERIAL_GENERIC=y
+CONFIG_USB_SERIAL_HP4X=m
+CONFIG_USB_SERIAL_IPAQ=m
+CONFIG_USB_SERIAL_IPW=m
+CONFIG_USB_SERIAL_IR=m
+CONFIG_USB_SERIAL_IUU=m
+CONFIG_USB_SERIAL_KEYSPAN=m
+CONFIG_USB_SERIAL_KEYSPAN_MPR=y
+CONFIG_USB_SERIAL_KEYSPAN_PDA=m
+CONFIG_USB_SERIAL_KEYSPAN_USA18X=y
+CONFIG_USB_SERIAL_KEYSPAN_USA19=y
+CONFIG_USB_SERIAL_KEYSPAN_USA19QI=y
+CONFIG_USB_SERIAL_KEYSPAN_USA19QW=y
+CONFIG_USB_SERIAL_KEYSPAN_USA19W=y
+CONFIG_USB_SERIAL_KEYSPAN_USA28=y
+CONFIG_USB_SERIAL_KEYSPAN_USA28X=y
+CONFIG_USB_SERIAL_KEYSPAN_USA28XA=y
+CONFIG_USB_SERIAL_KEYSPAN_USA28XB=y
+CONFIG_USB_SERIAL_KEYSPAN_USA49W=y
+CONFIG_USB_SERIAL_KEYSPAN_USA49WLC=y
+CONFIG_USB_SERIAL_KLSI=m
+CONFIG_USB_SERIAL_KOBIL_SCT=m
+CONFIG_USB_SERIAL_MCT_U232=m
+CONFIG_USB_SERIAL_MOS7720=m
+CONFIG_USB_SERIAL_MOS7840=m
+CONFIG_USB_SERIAL_MOTOROLA=m
+CONFIG_USB_SERIAL_NAVMAN=m
+CONFIG_USB_SERIAL_OMNINET=m
+CONFIG_USB_SERIAL_OPTICON=m
+CONFIG_USB_SERIAL_OPTION=m
+CONFIG_USB_SERIAL_OTI6858=m
+CONFIG_USB_SERIAL_PL2303=m
+CONFIG_USB_SERIAL_QUALCOMM=m
+CONFIG_USB_SERIAL_QUATECH2=m
+CONFIG_USB_SERIAL_SAFE=m
+# CONFIG_USB_SERIAL_SAFE_PADDED is not set
+CONFIG_USB_SERIAL_SIEMENS_MPI=m
+CONFIG_USB_SERIAL_SIERRAWIRELESS=m
+CONFIG_USB_SERIAL_SPCP8X5=m
+CONFIG_USB_SERIAL_SYMBOL=m
+CONFIG_USB_SERIAL_TI=m
+CONFIG_USB_SERIAL_VISOR=m
+CONFIG_USB_SERIAL_WHITEHEAT=m
+CONFIG_USB_SERIAL_XIRCOM=m
+CONFIG_USB_SEVSEG=m
+CONFIG_USB_SI470X=m
+CONFIG_USB_SISUSBVGA=m
+# CONFIG_USB_SISUSBVGA_CON is not set
+CONFIG_USB_SL811_CS=m
+CONFIG_USB_SL811_HCD=m
+CONFIG_USB_SN9C102=m
+CONFIG_USB_SPEEDTOUCH=m
+CONFIG_USB_STKWEBCAM=m
+CONFIG_USB_STORAGE=m
+CONFIG_USB_STORAGE_ALAUDA=m
+CONFIG_USB_STORAGE_CYPRESS_ATACB=m
+CONFIG_USB_STORAGE_DATAFAB=m
+# CONFIG_USB_STORAGE_DEBUG is not set
+CONFIG_USB_STORAGE_FREECOM=m
+CONFIG_USB_STORAGE_ISD200=m
+CONFIG_USB_STORAGE_JUMPSHOT=m
+CONFIG_USB_STORAGE_KARMA=m
+CONFIG_USB_STORAGE_ONETOUCH=m
+CONFIG_USB_STORAGE_SDDR09=m
+CONFIG_USB_STORAGE_SDDR55=m
+CONFIG_USB_STORAGE_USBAT=m
+CONFIG_USB_STV06XX=m
+CONFIG_USB_STV680=m
+CONFIG_USB_SUPPORT=y
+CONFIG_USB_SUSPEND=y
+CONFIG_USB_TEST=m
+CONFIG_USB_TMC=m
+CONFIG_USB_TRANCEVIBRATOR=m
+CONFIG_USB_U132_HCD=m
+CONFIG_USB_UEAGLEATM=m
+CONFIG_USB_UHCI_HCD=y
+CONFIG_USB_USBNET=m
+CONFIG_USB_USS720=m
+CONFIG_USB_VICAM=m
+CONFIG_USB_VIDEO_CLASS=m
+CONFIG_USB_VIDEO_CLASS_INPUT_EVDEV=y
+CONFIG_USB_VST=m
+CONFIG_USB_W9968CF=m
+CONFIG_USB_WDM=m
+CONFIG_USB_WHCI_HCD=m
+CONFIG_USB_WUSB=m
+CONFIG_USB_WUSB_CBAF=m
+# CONFIG_USB_WUSB_CBAF_DEBUG is not set
+CONFIG_USB_XHCI_HCD=m
+# CONFIG_USB_XHCI_HCD_DEBUGGING is not set
+CONFIG_USB_XUSBATM=m
+CONFIG_USB_ZC0301=m
+CONFIG_USB_ZD1201=m
+CONFIG_USB_ZERO=m
+CONFIG_USB_ZR364XX=m
+# CONFIG_USER_NS is not set
+# CONFIG_USER_SCHED is not set
+CONFIG_USER_STACKTRACE_SUPPORT=y
+CONFIG_USE_GENERIC_SMP_HELPERS=y
+CONFIG_UTS_NS=y
+CONFIG_UWB=m
+CONFIG_UWB_HWA=m
+CONFIG_UWB_I1480U=m
+CONFIG_UWB_I1480U_WLP=m
+CONFIG_UWB_WHCI=m
+CONFIG_UWB_WLP=m
+CONFIG_V4L_USB_DRIVERS=y
+CONFIG_VERSION_SIGNATURE=""
+CONFIG_VETH=m
+CONFIG_VFAT_FS=m
+# CONFIG_VGACON_SOFT_SCROLLBACK is not set
+CONFIG_VGASTATE=m
+CONFIG_VGA_CONSOLE=y
+CONFIG_VIA_FIR=m
+CONFIG_VIA_RHINE=m
+CONFIG_VIA_RHINE_MMIO=y
+CONFIG_VIA_VELOCITY=m
+CONFIG_VIDEOBUF_DMA_SG=m
+CONFIG_VIDEOBUF_DVB=m
+CONFIG_VIDEOBUF_GEN=m
+CONFIG_VIDEOBUF_VMALLOC=m
+CONFIG_VIDEO_ADV7170=m
+CONFIG_VIDEO_ADV7175=m
+# CONFIG_VIDEO_ADV_DEBUG is not set
+CONFIG_VIDEO_ALLOW_V4L1=y
+CONFIG_VIDEO_AU0828=m
+CONFIG_VIDEO_BT819=m
+CONFIG_VIDEO_BT848=m
+CONFIG_VIDEO_BT848_DVB=y
+CONFIG_VIDEO_BT856=m
+CONFIG_VIDEO_BT866=m
+CONFIG_VIDEO_BTCX=m
+CONFIG_VIDEO_BWQCAM=m
+CONFIG_VIDEO_CAFE_CCIC=m
+CONFIG_VIDEO_CAPTURE_DRIVERS=y
+CONFIG_VIDEO_CPIA=m
+CONFIG_VIDEO_CPIA2=m
+CONFIG_VIDEO_CPIA_PP=m
+CONFIG_VIDEO_CPIA_USB=m
+CONFIG_VIDEO_CQCAM=m
+CONFIG_VIDEO_CS5345=m
+CONFIG_VIDEO_CS53L32A=m
+CONFIG_VIDEO_CX18=m
+CONFIG_VIDEO_CX231XX=m
+CONFIG_VIDEO_CX231XX_ALSA=m
+CONFIG_VIDEO_CX231XX_DVB=m
+CONFIG_VIDEO_CX2341X=m
+CONFIG_VIDEO_CX23885=m
+CONFIG_VIDEO_CX25840=m
+CONFIG_VIDEO_CX88=m
+CONFIG_VIDEO_CX88_ALSA=m
+CONFIG_VIDEO_CX88_BLACKBIRD=m
+CONFIG_VIDEO_CX88_DVB=m
+CONFIG_VIDEO_CX88_MPEG=m
+CONFIG_VIDEO_CX88_VP3054=m
+CONFIG_VIDEO_DEV=m
+CONFIG_VIDEO_EM28XX=m
+CONFIG_VIDEO_EM28XX_ALSA=m
+CONFIG_VIDEO_EM28XX_DVB=m
+CONFIG_VIDEO_FB_IVTV=m
+# CONFIG_VIDEO_FIXED_MINOR_RANGES is not set
+CONFIG_VIDEO_GO7007=m
+CONFIG_VIDEO_GO7007_USB=m
+CONFIG_VIDEO_GO7007_USB_S2250_BOARD=m
+CONFIG_VIDEO_HDPVR=m
+CONFIG_VIDEO_HELPER_CHIPS_AUTO=y
+CONFIG_VIDEO_HEXIUM_GEMINI=m
+CONFIG_VIDEO_HEXIUM_ORION=m
+CONFIG_VIDEO_IR=m
+CONFIG_VIDEO_IR_I2C=m
+CONFIG_VIDEO_IVTV=m
+CONFIG_VIDEO_KS0127=m
+CONFIG_VIDEO_M52790=m
+CONFIG_VIDEO_MEDIA=m
+CONFIG_VIDEO_MEYE=m
+CONFIG_VIDEO_MSP3400=m
+CONFIG_VIDEO_MT9V011=m
+CONFIG_VIDEO_MXB=m
+CONFIG_VIDEO_OUTPUT_CONTROL=m
+CONFIG_VIDEO_OV7670=m
+CONFIG_VIDEO_OVCAMCHIP=m
+CONFIG_VIDEO_PVRUSB2=m
+# CONFIG_VIDEO_PVRUSB2_DEBUGIFC is not set
+CONFIG_VIDEO_PVRUSB2_DVB=y
+CONFIG_VIDEO_PVRUSB2_SYSFS=y
+CONFIG_VIDEO_SAA5246A=m
+CONFIG_VIDEO_SAA5249=m
+CONFIG_VIDEO_SAA6588=m
+CONFIG_VIDEO_SAA7110=m
+CONFIG_VIDEO_SAA711X=m
+CONFIG_VIDEO_SAA7127=m
+CONFIG_VIDEO_SAA7134=m
+CONFIG_VIDEO_SAA7134_ALSA=m
+CONFIG_VIDEO_SAA7134_DVB=m
+CONFIG_VIDEO_SAA7146=m
+CONFIG_VIDEO_SAA7146_VV=m
+CONFIG_VIDEO_SAA717X=m
+CONFIG_VIDEO_SAA7185=m
+CONFIG_VIDEO_STRADIS=m
+CONFIG_VIDEO_TDA7432=m
+CONFIG_VIDEO_TDA9840=m
+CONFIG_VIDEO_TEA6415C=m
+CONFIG_VIDEO_TEA6420=m
+CONFIG_VIDEO_TUNER=m
+CONFIG_VIDEO_TVAUDIO=m
+CONFIG_VIDEO_TVEEPROM=m
+CONFIG_VIDEO_TVP5150=m
+CONFIG_VIDEO_UPD64031A=m
+CONFIG_VIDEO_UPD64083=m
+CONFIG_VIDEO_USBVIDEO=m
+CONFIG_VIDEO_USBVISION=m
+CONFIG_VIDEO_V4L1=m
+CONFIG_VIDEO_V4L1_COMPAT=y
+CONFIG_VIDEO_V4L2=m
+CONFIG_VIDEO_V4L2_COMMON=m
+CONFIG_VIDEO_VIVI=m
+CONFIG_VIDEO_VP27SMPX=m
+CONFIG_VIDEO_VPX3220=m
+CONFIG_VIDEO_W9966=m
+CONFIG_VIDEO_WM8739=m
+CONFIG_VIDEO_WM8775=m
+CONFIG_VIDEO_ZORAN=m
+CONFIG_VIDEO_ZORAN_AVS6EYES=m
+CONFIG_VIDEO_ZORAN_BUZ=m
+CONFIG_VIDEO_ZORAN_DC10=m
+CONFIG_VIDEO_ZORAN_DC30=m
+CONFIG_VIDEO_ZORAN_LML33=m
+CONFIG_VIDEO_ZORAN_LML33R10=m
+CONFIG_VIDEO_ZORAN_ZR36060=m
+CONFIG_VIRTIO=m
+CONFIG_VIRTIO_BALLOON=m
+CONFIG_VIRTIO_BLK=m
+CONFIG_VIRTIO_CONSOLE=m
+CONFIG_VIRTIO_NET=m
+CONFIG_VIRTIO_PCI=m
+CONFIG_VIRTIO_RING=m
+CONFIG_VIRTUALIZATION=y
+CONFIG_VIRT_TO_BUS=y
+CONFIG_VITESSE_PHY=y
+CONFIG_VLAN_8021Q=m
+CONFIG_VLAN_8021Q_GVRP=y
+CONFIG_VLSI_FIR=m
+CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_VORTEX=m
+CONFIG_VT=y
+# CONFIG_VT6655 is not set
+CONFIG_VT_CONSOLE=y
+CONFIG_VT_HW_CONSOLE_BINDING=y
+CONFIG_VXFS_FS=m
+CONFIG_VXGE=m
+# CONFIG_VXGE_DEBUG_TRACE_ALL is not set
+CONFIG_W1=m
+CONFIG_W1_CON=y
+CONFIG_W1_MASTER_DS2482=m
+CONFIG_W1_MASTER_DS2490=m
+CONFIG_W1_MASTER_GPIO=m
+CONFIG_W1_MASTER_MATROX=m
+CONFIG_W1_SLAVE_BQ27000=m
+CONFIG_W1_SLAVE_DS2431=m
+CONFIG_W1_SLAVE_DS2433=m
+# CONFIG_W1_SLAVE_DS2433_CRC is not set
+CONFIG_W1_SLAVE_DS2760=m
+CONFIG_W1_SLAVE_SMEM=m
+CONFIG_W1_SLAVE_THERM=m
+CONFIG_W35UND=m
+CONFIG_W83627HF_WDT=m
+CONFIG_W83697HF_WDT=m
+CONFIG_W83697UG_WDT=m
+CONFIG_W83877F_WDT=m
+CONFIG_W83977F_WDT=m
+CONFIG_WAFER_WDT=m
+CONFIG_WAN=y
+CONFIG_WANXL=m
+CONFIG_WAN_ROUTER=m
+CONFIG_WAN_ROUTER_DRIVERS=m
+CONFIG_WATCHDOG=y
+# CONFIG_WATCHDOG_NOWAYOUT is not set
+CONFIG_WDTPCI=m
+CONFIG_WIMAX=m
+CONFIG_WIMAX_DEBUG_LEVEL=8
+CONFIG_WIMAX_I2400M=m
+CONFIG_WIMAX_I2400M_DEBUG_LEVEL=8
+CONFIG_WIMAX_I2400M_SDIO=m
+CONFIG_WIMAX_I2400M_USB=m
+CONFIG_WINBOND_840=m
+CONFIG_WINBOND_FIR=m
+CONFIG_WIRELESS=y
+CONFIG_WIRELESS_EXT=y
+CONFIG_WIRELESS_EXT_SYSFS=y
+# CONFIG_WIRELESS_OLD_REGULATORY is not set
+CONFIG_WL12XX=m
+CONFIG_WLAN_80211=y
+CONFIG_WLAN_PRE80211=y
+CONFIG_WM8350_POWER=m
+CONFIG_WM8350_WATCHDOG=m
+CONFIG_X25=m
+CONFIG_X25_ASY=m
+CONFIG_X86=y
+# CONFIG_X86_32 is not set
+CONFIG_X86_64=y
+CONFIG_X86_64_ACPI_NUMA=y
+CONFIG_X86_64_SMP=y
+CONFIG_X86_ACPI_CPUFREQ=y
+CONFIG_X86_BOOTPARAM_MEMORY_CORRUPTION_CHECK=y
+CONFIG_X86_CHECK_BIOS_CORRUPTION=y
+CONFIG_X86_CMOV=y
+CONFIG_X86_CMPXCHG=y
+CONFIG_X86_CMPXCHG64=y
+CONFIG_X86_CPU=y
+CONFIG_X86_CPUID=m
+CONFIG_X86_CPU_DEBUG=m
+CONFIG_X86_DEBUGCTLMSR=y
+# CONFIG_X86_DS is not set
+CONFIG_X86_EXTENDED_PLATFORM=y
+CONFIG_X86_HT=y
+CONFIG_X86_INTERNODE_CACHE_BYTES=64
+CONFIG_X86_IO_APIC=y
+CONFIG_X86_L1_CACHE_BYTES=64
+CONFIG_X86_L1_CACHE_SHIFT=6
+CONFIG_X86_LOCAL_APIC=y
+CONFIG_X86_MCE=y
+CONFIG_X86_MCE_AMD=y
+CONFIG_X86_MCE_INJECT=m
+CONFIG_X86_MCE_INTEL=y
+CONFIG_X86_MCE_THRESHOLD=y
+CONFIG_X86_MINIMUM_CPU_FAMILY=64
+CONFIG_X86_MPPARSE=y
+CONFIG_X86_MSR=m
+CONFIG_X86_NEW_MCE=y
+CONFIG_X86_P4_CLOCKMOD=m
+CONFIG_X86_PAT=y
+CONFIG_X86_PLATFORM_DEVICES=y
+CONFIG_X86_PM_TIMER=y
+CONFIG_X86_POWERNOW_K8=y
+# CONFIG_X86_PTDUMP is not set
+CONFIG_X86_REROUTE_FOR_BROKEN_BOOT_IRQS=y
+CONFIG_X86_RESERVE_LOW_64K=y
+CONFIG_X86_SPEEDSTEP_CENTRINO=y
+CONFIG_X86_SPEEDSTEP_LIB=m
+CONFIG_X86_THERMAL_VECTOR=y
+CONFIG_X86_TRAMPOLINE=y
+CONFIG_X86_TSC=y
+# CONFIG_X86_VERBOSE_BOOTUP is not set
+# CONFIG_X86_VSMP is not set
+CONFIG_X86_WP_WORKS_OK=y
+CONFIG_XEN=y
+CONFIG_XENFS=m
+CONFIG_XEN_BALLOON=y
+CONFIG_XEN_BLKDEV_FRONTEND=m
+CONFIG_XEN_COMPAT_XENFS=y
+# CONFIG_XEN_DEBUG_FS is not set
+CONFIG_XEN_DEV_EVTCHN=m
+CONFIG_XEN_FBDEV_FRONTEND=m
+CONFIG_XEN_KBDDEV_FRONTEND=m
+CONFIG_XEN_MAX_DOMAIN_MEMORY=32
+CONFIG_XEN_NETDEV_FRONTEND=m
+CONFIG_XEN_SAVE_RESTORE=y
+CONFIG_XEN_SCRUB_PAGES=y
+CONFIG_XEN_SYS_HYPERVISOR=y
+CONFIG_XFRM=y
+CONFIG_XFRM_IPCOMP=m
+# CONFIG_XFRM_MIGRATE is not set
+# CONFIG_XFRM_STATISTICS is not set
+# CONFIG_XFRM_SUB_POLICY is not set
+CONFIG_XFRM_USER=m
+# CONFIG_XFS_DEBUG is not set
+CONFIG_XFS_FS=m
+CONFIG_XFS_POSIX_ACL=y
+CONFIG_XFS_QUOTA=y
+CONFIG_XFS_RT=y
+CONFIG_XOR_BLOCKS=m
+CONFIG_YAM=m
+CONFIG_YELLOWFIN=m
+CONFIG_YENTA=m
+CONFIG_YENTA_ENE_TUNE=y
+CONFIG_YENTA_O2=y
+CONFIG_YENTA_RICOH=y
+CONFIG_YENTA_TI=y
+CONFIG_YENTA_TOSHIBA=y
+CONFIG_ZD1211RW=m
+# CONFIG_ZD1211RW_DEBUG is not set
+CONFIG_ZEROPLUS_FF=y
+CONFIG_ZISOFS=y
+CONFIG_ZLIB_DEFLATE=m
+CONFIG_ZLIB_INFLATE=y
+CONFIG_ZONE_DMA=y
+CONFIG_ZONE_DMA32=y
+CONFIG_ZONE_DMA_FLAG=1
--- linux-rt-2.6.31.orig/debian/config/i386/config.rt
+++ linux-rt-2.6.31/debian/config/i386/config.rt
@@ -0,0 +1,3 @@
+#
+# Config options for config.rt automatically generated by splitconfig.pl
+#
--- linux-rt-2.6.31.orig/debian/config/i386/config
+++ linux-rt-2.6.31/debian/config/i386/config
@@ -0,0 +1,4323 @@
+#
+# Common config options automatically generated by splitconfig.pl
+#
+CONFIG_3C359=m
+CONFIG_3C515=m
+# CONFIG_4KSTACKS is not set
+CONFIG_60XX_WDT=m
+# CONFIG_64BIT is not set
+CONFIG_6PACK=m
+CONFIG_8139CP=m
+CONFIG_8139TOO=m
+CONFIG_8139TOO_8129=y
+CONFIG_8139TOO_PIO=y
+# CONFIG_8139TOO_TUNE_TWISTER is not set
+# CONFIG_8139_OLD_RX_RESET is not set
+CONFIG_9P_FS=m
+CONFIG_AB3100_CORE=m
+CONFIG_ABYSS=m
+CONFIG_AC3200=m
+CONFIG_AC97_BUS=m
+# CONFIG_ACCESSIBILITY is not set
+CONFIG_ACENIC=m
+# CONFIG_ACENIC_OMIT_TIGON_I is not set
+CONFIG_ACERHDF=m
+CONFIG_ACER_WMI=m
+CONFIG_ACORN_PARTITION=y
+# CONFIG_ACORN_PARTITION_ADFS is not set
+# CONFIG_ACORN_PARTITION_CUMANA is not set
+# CONFIG_ACORN_PARTITION_EESOX is not set
+CONFIG_ACORN_PARTITION_ICS=y
+# CONFIG_ACORN_PARTITION_POWERTEC is not set
+CONFIG_ACORN_PARTITION_RISCIX=y
+CONFIG_ACPI=y
+CONFIG_ACPI_AC=y
+# CONFIG_ACPI_ASUS is not set
+CONFIG_ACPI_BATTERY=y
+CONFIG_ACPI_BLACKLIST_YEAR=2000
+CONFIG_ACPI_BUTTON=y
+CONFIG_ACPI_CONTAINER=y
+# CONFIG_ACPI_CUSTOM_DSDT is not set
+CONFIG_ACPI_CUSTOM_DSDT_FILE=""
+# CONFIG_ACPI_DEBUG is not set
+CONFIG_ACPI_DOCK=y
+CONFIG_ACPI_FAN=y
+CONFIG_ACPI_HOTPLUG_CPU=y
+CONFIG_ACPI_PCI_SLOT=y
+CONFIG_ACPI_PROCESSOR=y
+CONFIG_ACPI_PROCFS=y
+CONFIG_ACPI_PROCFS_POWER=y
+CONFIG_ACPI_PROC_EVENT=y
+CONFIG_ACPI_SBS=y
+CONFIG_ACPI_SLEEP=y
+CONFIG_ACPI_SYSFS_POWER=y
+CONFIG_ACPI_THERMAL=y
+CONFIG_ACPI_TOSHIBA=m
+CONFIG_ACPI_VIDEO=m
+CONFIG_ACPI_WMI=y
+CONFIG_ACQUIRE_WDT=m
+CONFIG_ACT200L_DONGLE=m
+CONFIG_ACTISYS_DONGLE=m
+CONFIG_ADAPTEC_STARFIRE=m
+CONFIG_ADFS_FS=m
+# CONFIG_ADFS_FS_RW is not set
+CONFIG_ADM8211=m
+CONFIG_ADVANTECH_WDT=m
+CONFIG_AFFS_FS=m
+# CONFIG_AFS_DEBUG is not set
+CONFIG_AFS_FS=m
+# CONFIG_AFS_FSCACHE is not set
+CONFIG_AF_RXRPC=m
+# CONFIG_AF_RXRPC_DEBUG is not set
+CONFIG_AGNX=m
+CONFIG_AGP=m
+CONFIG_AGP_ALI=m
+CONFIG_AGP_AMD=m
+CONFIG_AGP_AMD64=m
+CONFIG_AGP_ATI=m
+CONFIG_AGP_EFFICEON=m
+CONFIG_AGP_INTEL=m
+CONFIG_AGP_NVIDIA=m
+CONFIG_AGP_SIS=m
+CONFIG_AGP_SWORKS=m
+CONFIG_AGP_VIA=m
+CONFIG_AIC79XX_CMDS_PER_DEVICE=32
+CONFIG_AIC79XX_DEBUG_ENABLE=y
+CONFIG_AIC79XX_DEBUG_MASK=0
+CONFIG_AIC79XX_REG_PRETTY_PRINT=y
+CONFIG_AIC79XX_RESET_DELAY_MS=5000
+CONFIG_AIC7XXX_CMDS_PER_DEVICE=8
+CONFIG_AIC7XXX_DEBUG_ENABLE=y
+CONFIG_AIC7XXX_DEBUG_MASK=0
+CONFIG_AIC7XXX_REG_PRETTY_PRINT=y
+CONFIG_AIC7XXX_RESET_DELAY_MS=15000
+# CONFIG_AIC94XX_DEBUG is not set
+CONFIG_AIO=y
+CONFIG_AIRO=m
+CONFIG_AIRO_CS=m
+CONFIG_ALIM1535_WDT=m
+CONFIG_ALIM7101_WDT=m
+CONFIG_ALI_FIR=m
+CONFIG_ALTERA_PCIE_CHDMA=m
+CONFIG_AMD8111_ETH=m
+CONFIG_AMIGA_PARTITION=y
+CONFIG_ANDROID=y
+CONFIG_ANDROID_BINDER_IPC=y
+CONFIG_ANDROID_LOGGER=m
+# CONFIG_ANDROID_LOW_MEMORY_KILLER is not set
+# CONFIG_ANDROID_RAM_CONSOLE is not set
+CONFIG_ANDROID_TIMED_GPIO=m
+CONFIG_ANDROID_TIMED_OUTPUT=y
+CONFIG_ANON_INODES=y
+CONFIG_APM=m
+# CONFIG_APM_ALLOW_INTS is not set
+# CONFIG_APM_CPU_IDLE is not set
+# CONFIG_APM_DISPLAY_BLANK is not set
+# CONFIG_APM_DO_ENABLE is not set
+# CONFIG_APM_IGNORE_USER_SUSPEND is not set
+CONFIG_APPLICOM=m
+CONFIG_APRICOT=m
+CONFIG_AR9170_LEDS=y
+CONFIG_AR9170_USB=m
+CONFIG_ARCH_DEFCONFIG="arch/x86/configs/i386_defconfig"
+CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG=y
+CONFIG_ARCH_FLATMEM_ENABLE=y
+CONFIG_ARCH_HAS_CACHE_LINE_SIZE=y
+CONFIG_ARCH_HAS_CPU_IDLE_WAIT=y
+CONFIG_ARCH_HAS_CPU_RELAX=y
+CONFIG_ARCH_HAS_DEFAULT_IDLE=y
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARCH_MAY_HAVE_PC_FDC=y
+# CONFIG_ARCH_PHYS_ADDR_T_64BIT is not set
+CONFIG_ARCH_POPULATES_NODE_MAP=y
+CONFIG_ARCH_SELECT_MEMORY_MODEL=y
+CONFIG_ARCH_SPARSEMEM_ENABLE=y
+CONFIG_ARCH_SUPPORTS_DEBUG_PAGEALLOC=y
+CONFIG_ARCH_SUPPORTS_MSI=y
+CONFIG_ARCH_SUPPORTS_OPTIMIZED_INLINING=y
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_ARCH_WANT_FRAME_POINTERS=y
+CONFIG_ARCH_WANT_OPTIONAL_GPIOLIB=y
+CONFIG_ARCNET=m
+CONFIG_ARCNET_1051=m
+CONFIG_ARCNET_1201=m
+CONFIG_ARCNET_CAP=m
+CONFIG_ARCNET_COM20020=m
+CONFIG_ARCNET_COM20020_CS=m
+CONFIG_ARCNET_COM20020_ISA=m
+CONFIG_ARCNET_COM20020_PCI=m
+CONFIG_ARCNET_COM90xx=m
+CONFIG_ARCNET_COM90xxIO=m
+CONFIG_ARCNET_RAW=m
+CONFIG_ARCNET_RIM_I=m
+CONFIG_ARLAN=m
+# CONFIG_ARPD is not set
+CONFIG_ASK_IP_FIB_HASH=y
+CONFIG_ASM_SEMAPHORES=y
+CONFIG_ASUS_LAPTOP=m
+CONFIG_ASUS_OLED=m
+CONFIG_ASYNC_CORE=m
+CONFIG_ASYNC_MEMCPY=m
+CONFIG_ASYNC_TX_DMA=y
+CONFIG_ASYNC_XOR=m
+CONFIG_AT1700=m
+CONFIG_AT76C50X_USB=m
+CONFIG_ATA=y
+CONFIG_ATALK=m
+CONFIG_ATARI_PARTITION=y
+CONFIG_ATA_ACPI=y
+CONFIG_ATA_GENERIC=y
+# CONFIG_ATA_NONSTANDARD is not set
+CONFIG_ATA_OVER_ETH=m
+CONFIG_ATA_PIIX=y
+CONFIG_ATA_SFF=y
+CONFIG_ATH5K=m
+# CONFIG_ATH5K_DEBUG is not set
+CONFIG_ATH9K=m
+CONFIG_ATH9K_DEBUG=y
+CONFIG_ATH_COMMON=m
+CONFIG_ATL1=m
+CONFIG_ATL1C=m
+CONFIG_ATL1E=m
+CONFIG_ATL2=m
+CONFIG_ATM=m
+CONFIG_ATMEL=m
+CONFIG_ATM_AMBASSADOR=m
+# CONFIG_ATM_AMBASSADOR_DEBUG is not set
+CONFIG_ATM_BR2684=m
+# CONFIG_ATM_BR2684_IPFILTER is not set
+CONFIG_ATM_CLIP=m
+# CONFIG_ATM_CLIP_NO_ICMP is not set
+CONFIG_ATM_DRIVERS=y
+# CONFIG_ATM_DUMMY is not set
+CONFIG_ATM_ENI=m
+# CONFIG_ATM_ENI_DEBUG is not set
+# CONFIG_ATM_ENI_TUNE_BURST is not set
+CONFIG_ATM_FIRESTREAM=m
+CONFIG_ATM_FORE200E=m
+CONFIG_ATM_FORE200E_DEBUG=0
+CONFIG_ATM_FORE200E_TX_RETRY=16
+# CONFIG_ATM_FORE200E_USE_TASKLET is not set
+CONFIG_ATM_HE=m
+CONFIG_ATM_HE_USE_SUNI=y
+CONFIG_ATM_HORIZON=m
+# CONFIG_ATM_HORIZON_DEBUG is not set
+CONFIG_ATM_IA=m
+# CONFIG_ATM_IA_DEBUG is not set
+CONFIG_ATM_IDT77252=m
+# CONFIG_ATM_IDT77252_DEBUG is not set
+# CONFIG_ATM_IDT77252_RCV_ALL is not set
+CONFIG_ATM_IDT77252_USE_SUNI=y
+CONFIG_ATM_LANAI=m
+CONFIG_ATM_LANE=m
+CONFIG_ATM_MPOA=m
+CONFIG_ATM_NICSTAR=m
+# CONFIG_ATM_NICSTAR_USE_IDT77105 is not set
+# CONFIG_ATM_NICSTAR_USE_SUNI is not set
+CONFIG_ATM_SOLOS=m
+CONFIG_ATM_TCP=m
+CONFIG_ATM_ZATM=m
+# CONFIG_ATM_ZATM_DEBUG is not set
+CONFIG_ATP=m
+CONFIG_AUDIT=y
+CONFIG_AUDITSYSCALL=y
+# CONFIG_AUDIT_ARCH is not set
+CONFIG_AUDIT_GENERIC=y
+CONFIG_AUDIT_TREE=y
+CONFIG_AUFS_BDEV_LOOP=y
+# CONFIG_AUFS_BRANCH_MAX_1023 is not set
+CONFIG_AUFS_BRANCH_MAX_127=y
+# CONFIG_AUFS_BRANCH_MAX_32767 is not set
+# CONFIG_AUFS_BRANCH_MAX_511 is not set
+CONFIG_AUFS_BR_FUSE=y
+CONFIG_AUFS_BR_RAMFS=y
+# CONFIG_AUFS_DEBUG is not set
+# CONFIG_AUFS_EXPORT is not set
+CONFIG_AUFS_FS=m
+CONFIG_AUFS_HINOTIFY=y
+CONFIG_AUFS_POLL=y
+# CONFIG_AUFS_SHWH is not set
+CONFIG_AUTOFS4_FS=m
+CONFIG_AUTOFS_FS=m
+CONFIG_AUXDISPLAY=y
+CONFIG_AVERATEC_5100P=m
+CONFIG_AX25=m
+CONFIG_AX25_DAMA_SLAVE=y
+CONFIG_B3DFG=m
+CONFIG_B43=m
+CONFIG_B43LEGACY=m
+CONFIG_B43LEGACY_DEBUG=y
+CONFIG_B43LEGACY_DMA=y
+CONFIG_B43LEGACY_DMA_AND_PIO_MODE=y
+# CONFIG_B43LEGACY_DMA_MODE is not set
+CONFIG_B43LEGACY_HWRNG=y
+CONFIG_B43LEGACY_LEDS=y
+CONFIG_B43LEGACY_PCICORE_AUTOSELECT=y
+CONFIG_B43LEGACY_PCI_AUTOSELECT=y
+CONFIG_B43LEGACY_PIO=y
+# CONFIG_B43LEGACY_PIO_MODE is not set
+# CONFIG_B43_DEBUG is not set
+CONFIG_B43_HWRNG=y
+CONFIG_B43_LEDS=y
+CONFIG_B43_PCICORE_AUTOSELECT=y
+CONFIG_B43_PCI_AUTOSELECT=y
+# CONFIG_B43_PCMCIA is not set
+CONFIG_B44=m
+CONFIG_B44_PCI=y
+CONFIG_B44_PCICORE_AUTOSELECT=y
+CONFIG_B44_PCI_AUTOSELECT=y
+CONFIG_BACKLIGHT_CARILLO_RANCH=m
+CONFIG_BACKLIGHT_CLASS_DEVICE=y
+CONFIG_BACKLIGHT_DA903X=m
+CONFIG_BACKLIGHT_GENERIC=m
+CONFIG_BACKLIGHT_LCD_SUPPORT=y
+CONFIG_BACKLIGHT_MBP_NVIDIA=m
+CONFIG_BACKLIGHT_PROGEAR=m
+CONFIG_BACKLIGHT_SAHARA=m
+# CONFIG_BACKTRACE_SELF_TEST is not set
+CONFIG_BASE_FULL=y
+CONFIG_BASE_SMALL=0
+CONFIG_BATTERY_BQ27x00=m
+CONFIG_BATTERY_DA9030=m
+CONFIG_BATTERY_DS2760=m
+CONFIG_BATTERY_DS2782=m
+CONFIG_BATTERY_MAX17040=m
+CONFIG_BATTERY_OLPC=m
+CONFIG_BAYCOM_EPP=m
+CONFIG_BAYCOM_PAR=m
+CONFIG_BAYCOM_SER_FDX=m
+CONFIG_BAYCOM_SER_HDX=m
+CONFIG_BE2NET=m
+# CONFIG_BEFS_DEBUG is not set
+CONFIG_BEFS_FS=m
+CONFIG_BFS_FS=m
+CONFIG_BINARY_PRINTF=y
+CONFIG_BINFMT_AOUT=m
+CONFIG_BINFMT_ELF=y
+CONFIG_BINFMT_MISC=m
+CONFIG_BITREVERSE=y
+CONFIG_BLK_CPQ_CISS_DA=m
+CONFIG_BLK_CPQ_DA=m
+CONFIG_BLK_DEV=y
+CONFIG_BLK_DEV_3W_XXXX_RAID=m
+# CONFIG_BLK_DEV_BSG is not set
+CONFIG_BLK_DEV_COMPCACHE=m
+# CONFIG_BLK_DEV_COMPCACHE_DEBUG is not set
+# CONFIG_BLK_DEV_COMPCACHE_STATS is not set
+# CONFIG_BLK_DEV_COW_COMMON is not set
+CONFIG_BLK_DEV_CRYPTOLOOP=m
+CONFIG_BLK_DEV_DAC960=m
+CONFIG_BLK_DEV_DM=y
+CONFIG_BLK_DEV_DRBD=m
+CONFIG_BLK_DEV_FD=m
+# CONFIG_BLK_DEV_HD is not set
+CONFIG_BLK_DEV_INITRD=y
+CONFIG_BLK_DEV_INTEGRITY=y
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_MD=y
+CONFIG_BLK_DEV_NBD=m
+CONFIG_BLK_DEV_OSD=m
+CONFIG_BLK_DEV_RAM=y
+CONFIG_BLK_DEV_RAM_COUNT=16
+CONFIG_BLK_DEV_RAM_SIZE=65536
+CONFIG_BLK_DEV_SD=y
+CONFIG_BLK_DEV_SR=y
+# CONFIG_BLK_DEV_SR_VENDOR is not set
+CONFIG_BLK_DEV_SX8=m
+# CONFIG_BLK_DEV_UB is not set
+CONFIG_BLK_DEV_UMEM=m
+# CONFIG_BLK_DEV_XD is not set
+# CONFIG_BLK_DEV_XIP is not set
+CONFIG_BLOCK=y
+CONFIG_BNX2=m
+CONFIG_BNX2X=m
+CONFIG_BONDING=m
+# CONFIG_BOOTPARAM_HUNG_TASK_PANIC is not set
+CONFIG_BOOTPARAM_HUNG_TASK_PANIC_VALUE=0
+# CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC is not set
+CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC_VALUE=0
+# CONFIG_BOOT_PRINTK_DELAY is not set
+CONFIG_BOUNCE=y
+CONFIG_BPQETHER=m
+CONFIG_BRIDGE=m
+CONFIG_BRIDGE_EBT_802_3=m
+CONFIG_BRIDGE_EBT_AMONG=m
+CONFIG_BRIDGE_EBT_ARP=m
+CONFIG_BRIDGE_EBT_ARPREPLY=m
+CONFIG_BRIDGE_EBT_BROUTE=m
+CONFIG_BRIDGE_EBT_DNAT=m
+CONFIG_BRIDGE_EBT_IP=m
+CONFIG_BRIDGE_EBT_IP6=m
+CONFIG_BRIDGE_EBT_LIMIT=m
+CONFIG_BRIDGE_EBT_LOG=m
+CONFIG_BRIDGE_EBT_MARK=m
+CONFIG_BRIDGE_EBT_MARK_T=m
+CONFIG_BRIDGE_EBT_NFLOG=m
+CONFIG_BRIDGE_EBT_PKTTYPE=m
+CONFIG_BRIDGE_EBT_REDIRECT=m
+CONFIG_BRIDGE_EBT_SNAT=m
+CONFIG_BRIDGE_EBT_STP=m
+CONFIG_BRIDGE_EBT_T_FILTER=m
+CONFIG_BRIDGE_EBT_T_NAT=m
+CONFIG_BRIDGE_EBT_ULOG=m
+CONFIG_BRIDGE_EBT_VLAN=m
+CONFIG_BRIDGE_NETFILTER=y
+CONFIG_BRIDGE_NF_EBTABLES=m
+CONFIG_BROADCOM_PHY=y
+CONFIG_BSD_DISKLABEL=y
+CONFIG_BSD_PROCESS_ACCT=y
+CONFIG_BSD_PROCESS_ACCT_V3=y
+CONFIG_BT=y
+CONFIG_BTRFS_FS=m
+CONFIG_BTRFS_FS_POSIX_ACL=y
+CONFIG_BT_BNEP=m
+CONFIG_BT_BNEP_MC_FILTER=y
+CONFIG_BT_BNEP_PROTO_FILTER=y
+CONFIG_BT_CMTP=m
+CONFIG_BT_HCIBCM203X=m
+CONFIG_BT_HCIBFUSB=m
+CONFIG_BT_HCIBLUECARD=m
+CONFIG_BT_HCIBPA10X=m
+CONFIG_BT_HCIBT3C=m
+CONFIG_BT_HCIBTSDIO=m
+CONFIG_BT_HCIBTUART=m
+CONFIG_BT_HCIBTUSB=m
+CONFIG_BT_HCIDTL1=m
+CONFIG_BT_HCIUART=m
+CONFIG_BT_HCIUART_BCSP=y
+CONFIG_BT_HCIUART_H4=y
+CONFIG_BT_HCIUART_LL=y
+CONFIG_BT_HCIVHCI=m
+CONFIG_BT_HIDP=m
+CONFIG_BT_L2CAP=y
+CONFIG_BT_RFCOMM=y
+CONFIG_BT_RFCOMM_TTY=y
+CONFIG_BT_SCO=y
+CONFIG_BUG=y
+CONFIG_C101=m
+CONFIG_C2PORT=m
+CONFIG_C2PORT_DURAMAR_2150=m
+CONFIG_CACHEFILES=m
+# CONFIG_CACHEFILES_DEBUG is not set
+# CONFIG_CACHEFILES_HISTOGRAM is not set
+CONFIG_CAN=m
+CONFIG_CAN_BCM=m
+# CONFIG_CAN_CALC_BITTIMING is not set
+# CONFIG_CAN_DEBUG_DEVICES is not set
+CONFIG_CAN_DEV=m
+CONFIG_CAN_EMS_PCI=m
+CONFIG_CAN_KVASER_PCI=m
+CONFIG_CAN_PM_TRACE=y
+CONFIG_CAN_RAW=m
+CONFIG_CAN_SJA1000=m
+CONFIG_CAN_SJA1000_PLATFORM=m
+CONFIG_CAN_VCAN=m
+CONFIG_CAPI_AVM=y
+CONFIG_CAPI_EICON=y
+CONFIG_CAPI_TRACE=y
+CONFIG_CARDBUS=y
+CONFIG_CARDMAN_4000=m
+CONFIG_CARDMAN_4040=m
+# CONFIG_CARMINE_DRAM_CUSTOM is not set
+CONFIG_CASSINI=m
+CONFIG_CB710_CORE=m
+# CONFIG_CB710_DEBUG is not set
+CONFIG_CB710_DEBUG_ASSUMPTIONS=y
+# CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
+CONFIG_CC_STACKPROTECTOR=y
+CONFIG_CC_STACKPROTECTOR_ALL=y
+CONFIG_CDROM_PKTCDVD=y
+CONFIG_CDROM_PKTCDVD_BUFFERS=8
+# CONFIG_CDROM_PKTCDVD_WCACHE is not set
+CONFIG_CFAG12864B=m
+CONFIG_CFAG12864B_RATE=20
+CONFIG_CFG80211=m
+CONFIG_CFG80211_DEBUGFS=y
+CONFIG_CFG80211_REG_DEBUG=y
+CONFIG_CGROUPS=y
+CONFIG_CGROUP_CPUACCT=y
+# CONFIG_CGROUP_DEBUG is not set
+# CONFIG_CGROUP_DEVICE is not set
+CONFIG_CGROUP_FREEZER=y
+CONFIG_CGROUP_MEM_RES_CTLR=y
+# CONFIG_CGROUP_MEM_RES_CTLR_SWAP is not set
+CONFIG_CGROUP_NS=y
+CONFIG_CGROUP_SCHED=y
+CONFIG_CHARGER_PCF50633=m
+CONFIG_CHECK_SIGNATURE=y
+CONFIG_CHELSIO_T1=m
+CONFIG_CHELSIO_T1_1G=y
+CONFIG_CHELSIO_T3=m
+CONFIG_CHELSIO_T3_DEPENDS=y
+CONFIG_CHR_DEV_OSST=m
+CONFIG_CHR_DEV_SCH=m
+CONFIG_CHR_DEV_SG=y
+CONFIG_CHR_DEV_ST=m
+CONFIG_CICADA_PHY=y
+CONFIG_CIFS=m
+# CONFIG_CIFS_DEBUG2 is not set
+CONFIG_CIFS_DFS_UPCALL=y
+CONFIG_CIFS_EXPERIMENTAL=y
+CONFIG_CIFS_POSIX=y
+# CONFIG_CIFS_STATS is not set
+CONFIG_CIFS_UPCALL=y
+CONFIG_CIFS_WEAK_PW_HASH=y
+CONFIG_CIFS_XATTR=y
+CONFIG_CISS_SCSI_TAPE=y
+# CONFIG_CLASSIC_RCU is not set
+CONFIG_CLOCKSOURCE_WATCHDOG=y
+CONFIG_CLS_U32_MARK=y
+# CONFIG_CLS_U32_PERF is not set
+# CONFIG_CMDLINE_BOOL is not set
+CONFIG_CNIC=m
+CONFIG_CODA_FS=m
+CONFIG_COMEDI=m
+# CONFIG_COMEDI_DEBUG is not set
+CONFIG_COMEDI_PCI_DRIVERS=m
+CONFIG_COMEDI_PCMCIA_DRIVERS=m
+CONFIG_COMEDI_USB_DRIVERS=m
+CONFIG_COMPAL_LAPTOP=m
+# CONFIG_COMPAT_BRK is not set
+# CONFIG_COMPAT_VDSO is not set
+CONFIG_COMPUTONE=m
+CONFIG_CONFIGFS_FS=m
+CONFIG_CONNECTOR=y
+CONFIG_CONSOLE_POLL=y
+CONFIG_CONSOLE_TRANSLATIONS=y
+CONFIG_CONSTRUCTORS=y
+CONFIG_CONTEXT_SWITCH_TRACER=y
+# CONFIG_COPS is not set
+# CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
+CONFIG_COSA=m
+# CONFIG_CPA_DEBUG is not set
+CONFIG_CPU5_WDT=m
+CONFIG_CPUSETS=y
+CONFIG_CPU_FREQ=y
+# CONFIG_CPU_FREQ_DEBUG is not set
+# CONFIG_CPU_FREQ_DEFAULT_GOV_CONSERVATIVE is not set
+# CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND is not set
+CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE=y
+# CONFIG_CPU_FREQ_DEFAULT_GOV_POWERSAVE is not set
+# CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE is not set
+CONFIG_CPU_FREQ_GOV_CONSERVATIVE=y
+CONFIG_CPU_FREQ_GOV_ONDEMAND=y
+CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
+CONFIG_CPU_FREQ_GOV_POWERSAVE=y
+CONFIG_CPU_FREQ_GOV_USERSPACE=y
+CONFIG_CPU_FREQ_STAT=y
+CONFIG_CPU_FREQ_STAT_DETAILS=y
+CONFIG_CPU_FREQ_TABLE=y
+CONFIG_CPU_IDLE=y
+CONFIG_CPU_IDLE_GOV_LADDER=y
+CONFIG_CPU_IDLE_GOV_MENU=y
+CONFIG_CPU_SUP_AMD=y
+CONFIG_CPU_SUP_CENTAUR=y
+CONFIG_CPU_SUP_CYRIX_32=y
+CONFIG_CPU_SUP_INTEL=y
+CONFIG_CPU_SUP_TRANSMETA_32=y
+CONFIG_CPU_SUP_UMC_32=y
+CONFIG_CRAMFS=m
+CONFIG_CRASH_DUMP=y
+CONFIG_CRC16=y
+CONFIG_CRC32=y
+CONFIG_CRC7=m
+CONFIG_CRC_CCITT=m
+CONFIG_CRC_ITU_T=m
+CONFIG_CRC_T10DIF=y
+CONFIG_CRYPTO=y
+CONFIG_CRYPTO_AEAD=m
+CONFIG_CRYPTO_AEAD2=y
+CONFIG_CRYPTO_AES=m
+CONFIG_CRYPTO_AES_586=m
+CONFIG_CRYPTO_ALGAPI=y
+CONFIG_CRYPTO_ALGAPI2=y
+CONFIG_CRYPTO_ANSI_CPRNG=m
+CONFIG_CRYPTO_ANUBIS=m
+CONFIG_CRYPTO_ARC4=m
+CONFIG_CRYPTO_AUTHENC=m
+CONFIG_CRYPTO_BLKCIPHER=m
+CONFIG_CRYPTO_BLKCIPHER2=y
+CONFIG_CRYPTO_BLOWFISH=m
+CONFIG_CRYPTO_CAMELLIA=m
+CONFIG_CRYPTO_CAST5=m
+CONFIG_CRYPTO_CAST6=m
+CONFIG_CRYPTO_CBC=m
+CONFIG_CRYPTO_CCM=m
+CONFIG_CRYPTO_CRC32C=m
+CONFIG_CRYPTO_CRC32C_INTEL=m
+CONFIG_CRYPTO_CRYPTD=m
+CONFIG_CRYPTO_CTR=m
+CONFIG_CRYPTO_CTS=m
+CONFIG_CRYPTO_DEFLATE=m
+CONFIG_CRYPTO_DES=m
+CONFIG_CRYPTO_DEV_GEODE=m
+CONFIG_CRYPTO_DEV_HIFN_795X=m
+CONFIG_CRYPTO_DEV_HIFN_795X_RNG=y
+CONFIG_CRYPTO_DEV_PADLOCK=y
+CONFIG_CRYPTO_DEV_PADLOCK_AES=m
+CONFIG_CRYPTO_DEV_PADLOCK_SHA=m
+CONFIG_CRYPTO_ECB=m
+CONFIG_CRYPTO_FCRYPT=m
+CONFIG_CRYPTO_FIPS=y
+CONFIG_CRYPTO_GCM=m
+CONFIG_CRYPTO_GF128MUL=m
+CONFIG_CRYPTO_HASH=y
+CONFIG_CRYPTO_HASH2=y
+CONFIG_CRYPTO_HMAC=y
+CONFIG_CRYPTO_HW=y
+CONFIG_CRYPTO_KHAZAD=m
+CONFIG_CRYPTO_LRW=m
+CONFIG_CRYPTO_LZO=m
+CONFIG_CRYPTO_MANAGER=y
+CONFIG_CRYPTO_MANAGER2=y
+CONFIG_CRYPTO_MD4=m
+CONFIG_CRYPTO_MD5=y
+CONFIG_CRYPTO_MICHAEL_MIC=m
+CONFIG_CRYPTO_NULL=m
+CONFIG_CRYPTO_PCBC=m
+CONFIG_CRYPTO_PCOMP=y
+CONFIG_CRYPTO_RMD128=m
+CONFIG_CRYPTO_RMD160=m
+CONFIG_CRYPTO_RMD256=m
+CONFIG_CRYPTO_RMD320=m
+CONFIG_CRYPTO_RNG=m
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CRYPTO_SALSA20=m
+CONFIG_CRYPTO_SALSA20_586=m
+CONFIG_CRYPTO_SEED=m
+CONFIG_CRYPTO_SEQIV=m
+CONFIG_CRYPTO_SERPENT=m
+CONFIG_CRYPTO_SHA1=m
+CONFIG_CRYPTO_SHA256=m
+CONFIG_CRYPTO_SHA512=m
+CONFIG_CRYPTO_TEA=m
+CONFIG_CRYPTO_TEST=m
+CONFIG_CRYPTO_TGR192=m
+CONFIG_CRYPTO_TWOFISH=m
+CONFIG_CRYPTO_TWOFISH_586=m
+CONFIG_CRYPTO_TWOFISH_COMMON=m
+CONFIG_CRYPTO_WORKQUEUE=y
+CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_XCBC=m
+CONFIG_CRYPTO_XTS=m
+CONFIG_CRYPTO_ZLIB=m
+CONFIG_CS5535_GPIO=m
+CONFIG_CS89x0=m
+CONFIG_CUSE=m
+CONFIG_CYCLADES=m
+CONFIG_CYCLADES_SYNC=m
+CONFIG_CYCLOMX_X25=y
+# CONFIG_CYZ_INTR is not set
+CONFIG_DAB=y
+CONFIG_DAVICOM_PHY=y
+CONFIG_DCA=m
+CONFIG_DCB=y
+CONFIG_DCDBAS=m
+CONFIG_DE2104X=m
+CONFIG_DE2104X_DSL=0
+CONFIG_DE4X5=m
+CONFIG_DE600=m
+CONFIG_DE620=m
+# CONFIG_DEBUG_BLOCK_EXT_DEVT is not set
+# CONFIG_DEBUG_BOOT_PARAMS is not set
+CONFIG_DEBUG_BUGVERBOSE=y
+# CONFIG_DEBUG_DEVRES is not set
+# CONFIG_DEBUG_DRIVER is not set
+CONFIG_DEBUG_FS=y
+# CONFIG_DEBUG_GPIO is not set
+# CONFIG_DEBUG_HIGHMEM is not set
+CONFIG_DEBUG_INFO=y
+CONFIG_DEBUG_KERNEL=y
+# CONFIG_DEBUG_KMEMLEAK is not set
+# CONFIG_DEBUG_KOBJECT is not set
+# CONFIG_DEBUG_LIST is not set
+# CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set
+# CONFIG_DEBUG_LOCK_ALLOC is not set
+CONFIG_DEBUG_MEMORY_INIT=y
+# CONFIG_DEBUG_NOTIFIERS is not set
+# CONFIG_DEBUG_NX_TEST is not set
+# CONFIG_DEBUG_OBJECTS is not set
+# CONFIG_DEBUG_PAGEALLOC is not set
+# CONFIG_DEBUG_PREEMPT is not set
+CONFIG_DEBUG_RODATA=y
+# CONFIG_DEBUG_RODATA_TEST is not set
+# CONFIG_DEBUG_RT_MUTEXES is not set
+# CONFIG_DEBUG_SG is not set
+# CONFIG_DEBUG_SHIRQ is not set
+# CONFIG_DEBUG_SLAB is not set
+# CONFIG_DEBUG_SPINLOCK is not set
+# CONFIG_DEBUG_SPINLOCK_SLEEP is not set
+# CONFIG_DEBUG_STACKOVERFLOW is not set
+# CONFIG_DEBUG_STACK_USAGE is not set
+# CONFIG_DEBUG_VIRTUAL is not set
+# CONFIG_DEBUG_VM is not set
+# CONFIG_DEBUG_WRITECOUNT is not set
+CONFIG_DECNET=m
+CONFIG_DECNET_NF_GRABULATOR=m
+# CONFIG_DECNET_ROUTER is not set
+CONFIG_DECOMPRESS_BZIP2=y
+CONFIG_DECOMPRESS_GZIP=y
+CONFIG_DECOMPRESS_LZMA=y
+# CONFIG_DEFAULT_AS is not set
+# CONFIG_DEFAULT_BIC is not set
+CONFIG_DEFAULT_CFQ=y
+CONFIG_DEFAULT_CUBIC=y
+# CONFIG_DEFAULT_DEADLINE is not set
+# CONFIG_DEFAULT_HTCP is not set
+CONFIG_DEFAULT_IOSCHED="cfq"
+CONFIG_DEFAULT_IO_DELAY_TYPE=1
+CONFIG_DEFAULT_MMAP_MIN_ADDR=65536
+# CONFIG_DEFAULT_NOOP is not set
+# CONFIG_DEFAULT_RENO is not set
+CONFIG_DEFAULT_TCP_CONG="cubic"
+# CONFIG_DEFAULT_VEGAS is not set
+# CONFIG_DEFAULT_WESTWOOD is not set
+CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config"
+CONFIG_DEFXX=m
+# CONFIG_DEFXX_MMIO is not set
+CONFIG_DELL_LAPTOP=m
+CONFIG_DELL_RBU=m
+CONFIG_DELL_WMI=m
+CONFIG_DEPCA=m
+CONFIG_DETECT_HUNG_TASK=y
+CONFIG_DETECT_SOFTLOCKUP=y
+# CONFIG_DEVKMEM is not set
+CONFIG_DEVPORT=y
+CONFIG_DEVPTS_MULTIPLE_INSTANCES=y
+CONFIG_DEV_APPLETALK=m
+CONFIG_DE_AOC=y
+CONFIG_DIGIEPCA=m
+# CONFIG_DISCONTIGMEM_MANUAL is not set
+CONFIG_DISPLAY_SUPPORT=m
+# CONFIG_DL2K is not set
+CONFIG_DLCI=m
+CONFIG_DLCI_MAX=8
+CONFIG_DLM=m
+# CONFIG_DLM_DEBUG is not set
+CONFIG_DM9102=m
+CONFIG_DMADEVICES=y
+# CONFIG_DMATEST is not set
+# CONFIG_DMA_API_DEBUG is not set
+CONFIG_DMA_ENGINE=y
+CONFIG_DMI=y
+CONFIG_DMIID=y
+CONFIG_DM_CRYPT=m
+# CONFIG_DM_DEBUG is not set
+# CONFIG_DM_DELAY is not set
+# CONFIG_DM_LOG_USERSPACE is not set
+CONFIG_DM_MIRROR=y
+CONFIG_DM_MULTIPATH=y
+CONFIG_DM_MULTIPATH_QL=m
+CONFIG_DM_MULTIPATH_ST=m
+CONFIG_DM_RAID45=m
+CONFIG_DM_SNAPSHOT=y
+CONFIG_DM_UEVENT=y
+CONFIG_DM_ZERO=m
+CONFIG_DNET=m
+CONFIG_DNOTIFY=y
+CONFIG_DONGLE=y
+CONFIG_DOUBLEFAULT=y
+CONFIG_DRAGONRISE_FF=y
+CONFIG_DRM=m
+CONFIG_DRM_I810=m
+CONFIG_DRM_I830=m
+CONFIG_DRM_I915=m
+CONFIG_DRM_I915_KMS=y
+CONFIG_DRM_MGA=m
+CONFIG_DRM_R128=m
+CONFIG_DRM_RADEON=m
+CONFIG_DRM_RADEON_KMS=y
+CONFIG_DRM_SAVAGE=m
+CONFIG_DRM_SIS=m
+CONFIG_DRM_TDFX=m
+CONFIG_DRM_TTM=m
+CONFIG_DRM_VIA=m
+CONFIG_DS1682=m
+CONFIG_DSCC4=m
+CONFIG_DSCC4_PCISYNC=y
+CONFIG_DSCC4_PCI_RST=y
+CONFIG_DST=m
+# CONFIG_DST_DEBUG is not set
+CONFIG_DTLK=m
+CONFIG_DUMMY=m
+CONFIG_DUMMY_CONSOLE=y
+CONFIG_DVB_AF9013=m
+CONFIG_DVB_AU8522=m
+CONFIG_DVB_AV7110=m
+CONFIG_DVB_AV7110_OSD=y
+CONFIG_DVB_B2C2_FLEXCOP=m
+# CONFIG_DVB_B2C2_FLEXCOP_DEBUG is not set
+CONFIG_DVB_B2C2_FLEXCOP_PCI=m
+CONFIG_DVB_B2C2_FLEXCOP_USB=m
+CONFIG_DVB_BCM3510=m
+CONFIG_DVB_BT8XX=m
+CONFIG_DVB_BUDGET=m
+CONFIG_DVB_BUDGET_AV=m
+CONFIG_DVB_BUDGET_CI=m
+CONFIG_DVB_BUDGET_CORE=m
+CONFIG_DVB_BUDGET_PATCH=m
+CONFIG_DVB_CAPTURE_DRIVERS=y
+CONFIG_DVB_CORE=m
+CONFIG_DVB_CX22700=m
+CONFIG_DVB_CX22702=m
+CONFIG_DVB_CX24110=m
+CONFIG_DVB_CX24116=m
+CONFIG_DVB_CX24123=m
+CONFIG_DVB_DIB3000MB=m
+CONFIG_DVB_DIB3000MC=m
+CONFIG_DVB_DIB7000M=m
+CONFIG_DVB_DIB7000P=m
+CONFIG_DVB_DM1105=m
+CONFIG_DVB_DYNAMIC_MINORS=y
+# CONFIG_DVB_FE_CUSTOMISE is not set
+CONFIG_DVB_FIREDTV=m
+CONFIG_DVB_FIREDTV_IEEE1394=y
+CONFIG_DVB_FIREDTV_INPUT=y
+CONFIG_DVB_ISL6405=m
+CONFIG_DVB_ISL6421=m
+CONFIG_DVB_L64781=m
+CONFIG_DVB_LGDT3305=m
+CONFIG_DVB_LGDT330X=m
+CONFIG_DVB_LGS8GL5=m
+CONFIG_DVB_LNBP21=m
+CONFIG_DVB_MT312=m
+CONFIG_DVB_MT352=m
+CONFIG_DVB_NXT200X=m
+CONFIG_DVB_NXT6000=m
+CONFIG_DVB_OR51132=m
+CONFIG_DVB_OR51211=m
+CONFIG_DVB_PLL=m
+CONFIG_DVB_PLUTO2=m
+CONFIG_DVB_S5H1409=m
+CONFIG_DVB_S5H1411=m
+CONFIG_DVB_S5H1420=m
+CONFIG_DVB_SI21XX=m
+CONFIG_DVB_SP8870=m
+CONFIG_DVB_SP887X=m
+CONFIG_DVB_STB0899=m
+CONFIG_DVB_STB6000=m
+CONFIG_DVB_STB6100=m
+CONFIG_DVB_STV0288=m
+CONFIG_DVB_STV0297=m
+CONFIG_DVB_STV0299=m
+CONFIG_DVB_STV0900=m
+CONFIG_DVB_STV6110=m
+CONFIG_DVB_TDA10021=m
+CONFIG_DVB_TDA10023=m
+CONFIG_DVB_TDA10048=m
+CONFIG_DVB_TDA1004X=m
+CONFIG_DVB_TDA10086=m
+CONFIG_DVB_TDA8083=m
+CONFIG_DVB_TDA8261=m
+CONFIG_DVB_TDA826X=m
+CONFIG_DVB_TTUSB_BUDGET=m
+CONFIG_DVB_TTUSB_DEC=m
+CONFIG_DVB_TUA6100=m
+CONFIG_DVB_TUNER_CX24113=m
+CONFIG_DVB_TUNER_DIB0070=m
+CONFIG_DVB_TUNER_ITD1000=m
+CONFIG_DVB_USB=m
+CONFIG_DVB_USB_A800=m
+CONFIG_DVB_USB_AF9005=m
+CONFIG_DVB_USB_AF9005_REMOTE=m
+CONFIG_DVB_USB_AF9015=m
+CONFIG_DVB_USB_ANYSEE=m
+CONFIG_DVB_USB_AU6610=m
+CONFIG_DVB_USB_CE6230=m
+CONFIG_DVB_USB_CINERGY_T2=m
+CONFIG_DVB_USB_CXUSB=m
+# CONFIG_DVB_USB_DEBUG is not set
+CONFIG_DVB_USB_DIB0700=m
+CONFIG_DVB_USB_DIBUSB_MB=m
+# CONFIG_DVB_USB_DIBUSB_MB_FAULTY is not set
+CONFIG_DVB_USB_DIBUSB_MC=m
+CONFIG_DVB_USB_DIGITV=m
+CONFIG_DVB_USB_DTT200U=m
+CONFIG_DVB_USB_DTV5100=m
+CONFIG_DVB_USB_DW2102=m
+CONFIG_DVB_USB_GL861=m
+CONFIG_DVB_USB_GP8PSK=m
+CONFIG_DVB_USB_M920X=m
+CONFIG_DVB_USB_NOVA_T_USB2=m
+CONFIG_DVB_USB_OPERA1=m
+CONFIG_DVB_USB_TTUSB2=m
+CONFIG_DVB_USB_UMT_010=m
+CONFIG_DVB_USB_VP702X=m
+CONFIG_DVB_USB_VP7045=m
+CONFIG_DVB_VES1820=m
+CONFIG_DVB_VES1X93=m
+CONFIG_DVB_ZL10036=m
+CONFIG_DVB_ZL10353=m
+# CONFIG_DYNAMIC_DEBUG is not set
+CONFIG_E100=m
+CONFIG_E1000=m
+CONFIG_E1000E=m
+CONFIG_E2100=m
+CONFIG_EARLY_PRINTK=y
+# CONFIG_EARLY_PRINTK_DBGP is not set
+CONFIG_ECHO=m
+CONFIG_ECONET=m
+CONFIG_ECONET_AUNUDP=y
+CONFIG_ECONET_NATIVE=y
+CONFIG_ECRYPT_FS=y
+CONFIG_EDAC=y
+CONFIG_EDAC_AMD76X=m
+# CONFIG_EDAC_DEBUG is not set
+CONFIG_EDAC_E752X=m
+CONFIG_EDAC_E7XXX=m
+CONFIG_EDAC_I3000=m
+CONFIG_EDAC_I5000=m
+CONFIG_EDAC_I5100=m
+CONFIG_EDAC_I5400=m
+CONFIG_EDAC_I82860=m
+CONFIG_EDAC_I82875P=m
+CONFIG_EDAC_I82975X=m
+CONFIG_EDAC_MM_EDAC=m
+CONFIG_EDAC_R82600=m
+CONFIG_EDAC_X38=m
+CONFIG_EDD=y
+CONFIG_EDD_OFF=y
+CONFIG_EEEPC_LAPTOP=m
+CONFIG_EEPROM_93CX6=m
+CONFIG_EEPROM_AT24=m
+CONFIG_EEPROM_AT25=m
+CONFIG_EEPROM_LEGACY=m
+CONFIG_EEPROM_MAX6875=m
+CONFIG_EEXPRESS=m
+CONFIG_EEXPRESS_PRO=m
+CONFIG_EFI=y
+CONFIG_EFI_PARTITION=y
+CONFIG_EFI_VARS=y
+CONFIG_EFS_FS=m
+CONFIG_EISA=y
+CONFIG_EISA_NAMES=y
+CONFIG_EISA_PCI_EISA=y
+CONFIG_EISA_VIRTUAL_ROOT=y
+CONFIG_EISA_VLB_PRIMING=y
+CONFIG_EL1=m
+CONFIG_EL16=m
+CONFIG_EL2=m
+CONFIG_EL3=m
+CONFIG_ELF_CORE=y
+CONFIG_ELMC=m
+CONFIG_ELMC_II=m
+CONFIG_ELPLUS=m
+# CONFIG_EMBEDDED is not set
+# CONFIG_ENABLE_MUST_CHECK is not set
+# CONFIG_ENABLE_WARN_DEPRECATED is not set
+# CONFIG_ENC28J60 is not set
+CONFIG_ENCLOSURE_SERVICES=m
+CONFIG_ENIC=m
+CONFIG_EPIC100=m
+CONFIG_EPL=m
+CONFIG_EPOLL=y
+CONFIG_EQUALIZER=m
+CONFIG_ES3210=m
+CONFIG_ESI_DONGLE=m
+CONFIG_ET131X=m
+# CONFIG_ET131X_DEBUG is not set
+CONFIG_ETH16I=m
+CONFIG_ETHOC=m
+CONFIG_EUROTECH_WDT=m
+CONFIG_EVENTFD=y
+CONFIG_EVENT_PROFILE=y
+CONFIG_EVENT_TRACING=y
+CONFIG_EWRK3=m
+# CONFIG_EXOFS_DEBUG is not set
+CONFIG_EXOFS_FS=m
+CONFIG_EXPERIMENTAL=y
+CONFIG_EXPORTFS=m
+CONFIG_EXT2_FS=y
+CONFIG_EXT2_FS_POSIX_ACL=y
+CONFIG_EXT2_FS_SECURITY=y
+CONFIG_EXT2_FS_XATTR=y
+# CONFIG_EXT2_FS_XIP is not set
+# CONFIG_EXT3_DEFAULTS_TO_ORDERED is not set
+CONFIG_EXT3_FS=y
+CONFIG_EXT3_FS_POSIX_ACL=y
+CONFIG_EXT3_FS_SECURITY=y
+CONFIG_EXT3_FS_XATTR=y
+# CONFIG_EXT4DEV_COMPAT is not set
+CONFIG_EXT4_FS=y
+CONFIG_EXT4_FS_POSIX_ACL=y
+CONFIG_EXT4_FS_SECURITY=y
+CONFIG_EXT4_FS_XATTR=y
+CONFIG_EXTRA_FIRMWARE=""
+# CONFIG_EZX_PCAP is not set
+CONFIG_FAIR_GROUP_SCHED=y
+CONFIG_FARSYNC=m
+CONFIG_FAST_CMPXCHG_LOCAL=y
+CONFIG_FAT_DEFAULT_CODEPAGE=437
+CONFIG_FAT_DEFAULT_IOCHARSET="iso8859-1"
+CONFIG_FAT_FS=m
+# CONFIG_FAULT_INJECTION is not set
+CONFIG_FB=y
+CONFIG_FB_3DFX=m
+# CONFIG_FB_3DFX_ACCEL is not set
+CONFIG_FB_3DFX_I2C=y
+CONFIG_FB_ARC=m
+CONFIG_FB_ARK=m
+CONFIG_FB_ASILIANT=y
+CONFIG_FB_ATY=m
+CONFIG_FB_ATY128=m
+CONFIG_FB_ATY128_BACKLIGHT=y
+CONFIG_FB_ATY_BACKLIGHT=y
+CONFIG_FB_ATY_CT=y
+CONFIG_FB_ATY_GENERIC_LCD=y
+CONFIG_FB_ATY_GX=y
+CONFIG_FB_BACKLIGHT=y
+CONFIG_FB_BOOT_VESA_SUPPORT=y
+CONFIG_FB_BROADSHEET=m
+CONFIG_FB_CARILLO_RANCH=m
+CONFIG_FB_CARMINE=m
+CONFIG_FB_CARMINE_DRAM_EVAL=y
+CONFIG_FB_CFB_COPYAREA=y
+CONFIG_FB_CFB_FILLRECT=y
+CONFIG_FB_CFB_IMAGEBLIT=y
+# CONFIG_FB_CFB_REV_PIXELS_IN_BYTE is not set
+CONFIG_FB_CIRRUS=m
+CONFIG_FB_CYBER2000=m
+CONFIG_FB_DDC=m
+CONFIG_FB_DEFERRED_IO=y
+CONFIG_FB_EFI=y
+# CONFIG_FB_FOREIGN_ENDIAN is not set
+CONFIG_FB_GEODE=y
+CONFIG_FB_GEODE_GX=m
+CONFIG_FB_GEODE_GX1=m
+CONFIG_FB_GEODE_LX=m
+CONFIG_FB_HECUBA=m
+CONFIG_FB_HGA=m
+# CONFIG_FB_HGA_ACCEL is not set
+CONFIG_FB_I810=m
+# CONFIG_FB_I810_GTF is not set
+CONFIG_FB_IMSTT=y
+CONFIG_FB_KYRO=m
+CONFIG_FB_LE80578=m
+# CONFIG_FB_MACMODES is not set
+CONFIG_FB_MATROX=m
+CONFIG_FB_MATROX_G=y
+CONFIG_FB_MATROX_I2C=m
+CONFIG_FB_MATROX_MAVEN=m
+CONFIG_FB_MATROX_MILLENIUM=y
+CONFIG_FB_MATROX_MULTIHEAD=y
+CONFIG_FB_MATROX_MYSTIQUE=y
+CONFIG_FB_MB862XX=m
+CONFIG_FB_MB862XX_PCI_GDC=y
+CONFIG_FB_METRONOME=m
+CONFIG_FB_MODE_HELPERS=y
+CONFIG_FB_N411=m
+CONFIG_FB_NEOMAGIC=m
+CONFIG_FB_NVIDIA=m
+CONFIG_FB_NVIDIA_BACKLIGHT=y
+# CONFIG_FB_NVIDIA_DEBUG is not set
+CONFIG_FB_NVIDIA_I2C=y
+CONFIG_FB_PM2=m
+CONFIG_FB_PM2_FIFO_DISCONNECT=y
+CONFIG_FB_PM3=m
+CONFIG_FB_RADEON=m
+CONFIG_FB_RADEON_BACKLIGHT=y
+# CONFIG_FB_RADEON_DEBUG is not set
+CONFIG_FB_RADEON_I2C=y
+CONFIG_FB_RIVA=m
+CONFIG_FB_RIVA_BACKLIGHT=y
+# CONFIG_FB_RIVA_DEBUG is not set
+CONFIG_FB_RIVA_I2C=y
+CONFIG_FB_S1D13XXX=m
+CONFIG_FB_S3=m
+CONFIG_FB_SAVAGE=m
+CONFIG_FB_SAVAGE_ACCEL=y
+CONFIG_FB_SAVAGE_I2C=y
+CONFIG_FB_SIS=m
+CONFIG_FB_SIS_300=y
+CONFIG_FB_SIS_315=y
+CONFIG_FB_SM501=m
+CONFIG_FB_SVGALIB=m
+CONFIG_FB_SYS_COPYAREA=m
+CONFIG_FB_SYS_FILLRECT=m
+CONFIG_FB_SYS_FOPS=m
+CONFIG_FB_SYS_IMAGEBLIT=m
+CONFIG_FB_TILEBLITTING=y
+CONFIG_FB_TMIO=m
+CONFIG_FB_TMIO_ACCELL=y
+CONFIG_FB_TRIDENT=m
+CONFIG_FB_UDL=m
+CONFIG_FB_UVESA=m
+CONFIG_FB_VESA=m
+CONFIG_FB_VGA16=m
+CONFIG_FB_VIA=m
+# CONFIG_FB_VIRTUAL is not set
+CONFIG_FB_VOODOO1=m
+CONFIG_FB_VT8623=m
+CONFIG_FCOE=m
+CONFIG_FCOE_FNIC=m
+CONFIG_FDDI=y
+CONFIG_FEALNX=m
+CONFIG_FIB_RULES=y
+CONFIG_FILE_LOCKING=y
+CONFIG_FIREWIRE=m
+CONFIG_FIREWIRE_NET=m
+CONFIG_FIREWIRE_OHCI=m
+CONFIG_FIREWIRE_OHCI_DEBUG=y
+# CONFIG_FIREWIRE_OHCI_REMOTE_DMA is not set
+CONFIG_FIREWIRE_SBP2=m
+CONFIG_FIRMWARE_EDID=y
+CONFIG_FIRMWARE_IN_KERNEL=y
+CONFIG_FIRMWARE_MEMMAP=y
+CONFIG_FIXED_PHY=y
+CONFIG_FIX_EARLYCON_MEM=y
+CONFIG_FLATMEM=y
+CONFIG_FLATMEM_MANUAL=y
+CONFIG_FLAT_NODE_MEM_MAP=y
+# CONFIG_FONTS is not set
+CONFIG_FONT_8x16=y
+CONFIG_FONT_8x8=y
+CONFIG_FORCEDETH=m
+# CONFIG_FORCEDETH_NAPI is not set
+CONFIG_FRAMEBUFFER_CONSOLE=m
+# CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY is not set
+# CONFIG_FRAMEBUFFER_CONSOLE_ROTATION is not set
+CONFIG_FRAME_POINTER=y
+CONFIG_FRAME_WARN=1024
+CONFIG_FREEZER=y
+CONFIG_FSAM7400=m
+CONFIG_FSCACHE=m
+# CONFIG_FSCACHE_DEBUG is not set
+# CONFIG_FSCACHE_HISTOGRAM is not set
+# CONFIG_FSCACHE_STATS is not set
+CONFIG_FSNOTIFY=y
+CONFIG_FS_MBCACHE=y
+CONFIG_FS_POSIX_ACL=y
+CONFIG_FTL=m
+# CONFIG_FTRACE is not set
+CONFIG_FUJITSU_LAPTOP=m
+# CONFIG_FUJITSU_LAPTOP_DEBUG is not set
+CONFIG_FUSE_FS=y
+CONFIG_FUSION=y
+CONFIG_FUSION_CTL=m
+CONFIG_FUSION_FC=m
+CONFIG_FUSION_LAN=m
+CONFIG_FUSION_LOGGING=y
+CONFIG_FUSION_MAX_SGE=128
+CONFIG_FUSION_SAS=m
+CONFIG_FUSION_SPI=m
+CONFIG_FUTEX=y
+CONFIG_FW_LOADER=y
+CONFIG_GACT_PROB=y
+CONFIG_GAMEPORT=m
+CONFIG_GAMEPORT_EMU10K1=m
+CONFIG_GAMEPORT_FM801=m
+CONFIG_GAMEPORT_L4=m
+CONFIG_GAMEPORT_NS558=m
+CONFIG_GARP=m
+# CONFIG_GCOV_KERNEL is not set
+CONFIG_GENERIC_ACL=y
+CONFIG_GENERIC_ALLOCATOR=y
+CONFIG_GENERIC_BUG=y
+CONFIG_GENERIC_CALIBRATE_DELAY=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y
+CONFIG_GENERIC_CLOCKEVENTS_BUILD=y
+CONFIG_GENERIC_CMOS_UPDATE=y
+# CONFIG_GENERIC_CPU is not set
+CONFIG_GENERIC_FIND_FIRST_BIT=y
+CONFIG_GENERIC_FIND_LAST_BIT=y
+CONFIG_GENERIC_FIND_NEXT_BIT=y
+CONFIG_GENERIC_GPIO=y
+CONFIG_GENERIC_HARDIRQS=y
+CONFIG_GENERIC_HARDIRQS_NO__DO_IRQ=y
+CONFIG_GENERIC_HWEIGHT=y
+CONFIG_GENERIC_IOMAP=y
+CONFIG_GENERIC_IRQ_PROBE=y
+CONFIG_GENERIC_ISA_DMA=y
+CONFIG_GENERIC_PENDING_IRQ=y
+CONFIG_GENERIC_TIME=y
+# CONFIG_GENERIC_TIME_VSYSCALL is not set
+CONFIG_GFS2_FS=m
+CONFIG_GFS2_FS_LOCKING_DLM=y
+CONFIG_GIGASET_BASE=m
+# CONFIG_GIGASET_DEBUG is not set
+CONFIG_GIGASET_M101=m
+CONFIG_GIGASET_M105=m
+CONFIG_GIRBIL_DONGLE=m
+CONFIG_GPIOLIB=y
+CONFIG_GPIO_MAX7301=m
+CONFIG_GPIO_MAX732X=m
+CONFIG_GPIO_MCP23S08=m
+CONFIG_GPIO_PCA953X=m
+CONFIG_GPIO_PCF857X=m
+CONFIG_GPIO_SYSFS=y
+CONFIG_GPIO_TWL4030=m
+CONFIG_GREENASIA_FF=y
+CONFIG_GROUP_SCHED=y
+CONFIG_HAMACHI=m
+CONFIG_HAMRADIO=y
+CONFIG_HANGCHECK_TIMER=m
+CONFIG_HAPPYMEAL=m
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT=y
+CONFIG_HAVE_AOUT=y
+CONFIG_HAVE_ARCH_KGDB=y
+CONFIG_HAVE_ARCH_KMEMCHECK=y
+CONFIG_HAVE_ARCH_TRACEHOOK=y
+CONFIG_HAVE_ATOMIC_IOMAP=y
+# CONFIG_HAVE_CPUMASK_OF_CPU_MAP is not set
+CONFIG_HAVE_DMA_API_DEBUG=y
+CONFIG_HAVE_DMA_ATTRS=y
+CONFIG_HAVE_DYNAMIC_FTRACE=y
+CONFIG_HAVE_DYNAMIC_PER_CPU_AREA=y
+CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS=y
+CONFIG_HAVE_FTRACE_MCOUNT_RECORD=y
+CONFIG_HAVE_FUNCTION_GRAPH_FP_TEST=y
+CONFIG_HAVE_FUNCTION_GRAPH_TRACER=y
+CONFIG_HAVE_FUNCTION_TRACER=y
+CONFIG_HAVE_FUNCTION_TRACE_MCOUNT_TEST=y
+CONFIG_HAVE_GENERIC_DMA_COHERENT=y
+CONFIG_HAVE_IDE=y
+CONFIG_HAVE_IOREMAP_PROT=y
+CONFIG_HAVE_KERNEL_BZIP2=y
+CONFIG_HAVE_KERNEL_GZIP=y
+CONFIG_HAVE_KERNEL_LZMA=y
+CONFIG_HAVE_KPROBES=y
+CONFIG_HAVE_KRETPROBES=y
+CONFIG_HAVE_KVM=y
+CONFIG_HAVE_KVM_IRQCHIP=y
+CONFIG_HAVE_LATENCYTOP_SUPPORT=y
+CONFIG_HAVE_MLOCK=y
+CONFIG_HAVE_MLOCKED_PAGE_BIT=y
+CONFIG_HAVE_MMIOTRACE_SUPPORT=y
+CONFIG_HAVE_MTD_OTP=y
+CONFIG_HAVE_OPROFILE=y
+CONFIG_HAVE_PERF_COUNTERS=y
+CONFIG_HAVE_SETUP_PER_CPU_AREA=y
+CONFIG_HAVE_SYSCALL_TRACEPOINTS=y
+CONFIG_HAVE_UNSTABLE_SCHED_CLOCK=y
+CONFIG_HDLC=m
+CONFIG_HDLC_CISCO=m
+CONFIG_HDLC_FR=m
+CONFIG_HDLC_PPP=m
+CONFIG_HDLC_RAW=m
+CONFIG_HDLC_RAW_ETH=m
+CONFIG_HDLC_X25=m
+# CONFIG_HEADERS_CHECK is not set
+CONFIG_HECI=m
+CONFIG_HERMES=m
+CONFIG_HERMES_CACHE_FW_ON_INIT=y
+CONFIG_HFSPLUS_FS=m
+CONFIG_HFS_FS=m
+CONFIG_HIBERNATION=y
+CONFIG_HIBERNATION_NVS=y
+CONFIG_HID=y
+CONFIG_HIDRAW=y
+CONFIG_HID_A4TECH=m
+CONFIG_HID_APPLE=m
+CONFIG_HID_BELKIN=m
+CONFIG_HID_CHERRY=m
+CONFIG_HID_CHICONY=m
+CONFIG_HID_CYPRESS=m
+# CONFIG_HID_DEBUG is not set
+CONFIG_HID_DRAGONRISE=m
+CONFIG_HID_EZKEY=m
+CONFIG_HID_GREENASIA=m
+CONFIG_HID_GYRATION=m
+CONFIG_HID_KENSINGTON=m
+CONFIG_HID_KYE=m
+CONFIG_HID_LOGITECH=m
+CONFIG_HID_MICROSOFT=m
+CONFIG_HID_MONTEREY=m
+CONFIG_HID_NTRIG=m
+CONFIG_HID_PANTHERLORD=m
+CONFIG_HID_PETALYNX=m
+CONFIG_HID_PID=y
+CONFIG_HID_SAMSUNG=m
+CONFIG_HID_SMARTJOYPLUS=m
+CONFIG_HID_SONY=m
+CONFIG_HID_SUNPLUS=m
+CONFIG_HID_SUPPORT=y
+CONFIG_HID_THRUSTMASTER=m
+CONFIG_HID_TOPSEED=m
+CONFIG_HID_WACOM=m
+CONFIG_HID_ZEROPLUS=m
+CONFIG_HIGHMEM=y
+CONFIG_HIGHMEM4G=y
+# CONFIG_HIGHMEM64G is not set
+CONFIG_HIGHPTE=y
+CONFIG_HIGH_RES_TIMERS=y
+CONFIG_HIPPI=y
+CONFIG_HISAX_16_0=y
+CONFIG_HISAX_16_3=y
+CONFIG_HISAX_1TR6=y
+CONFIG_HISAX_ASUSCOM=y
+CONFIG_HISAX_AVM_A1=y
+CONFIG_HISAX_AVM_A1_CS=m
+CONFIG_HISAX_AVM_A1_PCMCIA=y
+CONFIG_HISAX_BKM_A4T=y
+# CONFIG_HISAX_DEBUG is not set
+CONFIG_HISAX_DIEHLDIVA=y
+CONFIG_HISAX_ELSA=y
+CONFIG_HISAX_ELSA_CS=m
+CONFIG_HISAX_ENTERNOW_PCI=y
+CONFIG_HISAX_EURO=y
+CONFIG_HISAX_FRITZPCI=y
+CONFIG_HISAX_FRITZ_PCIPNP=m
+CONFIG_HISAX_GAZEL=y
+CONFIG_HISAX_HDLC=y
+CONFIG_HISAX_HFC4S8S=m
+CONFIG_HISAX_HFCS=y
+CONFIG_HISAX_HFCUSB=m
+CONFIG_HISAX_HFC_PCI=y
+CONFIG_HISAX_HFC_SX=y
+CONFIG_HISAX_HSTSAPHIR=y
+CONFIG_HISAX_ISURF=y
+CONFIG_HISAX_IX1MICROR2=y
+CONFIG_HISAX_MAX_CARDS=8
+CONFIG_HISAX_MIC=y
+CONFIG_HISAX_NETJET=y
+CONFIG_HISAX_NETJET_U=y
+CONFIG_HISAX_NI1=y
+CONFIG_HISAX_NICCY=y
+# CONFIG_HISAX_NO_KEYPAD is not set
+# CONFIG_HISAX_NO_LLC is not set
+# CONFIG_HISAX_NO_SENDCOMPLETE is not set
+CONFIG_HISAX_S0BOX=y
+CONFIG_HISAX_SCT_QUADRO=y
+CONFIG_HISAX_SEDLBAUER=y
+CONFIG_HISAX_SEDLBAUER_CS=m
+CONFIG_HISAX_SPORTSTER=y
+CONFIG_HISAX_ST5481=m
+CONFIG_HISAX_TELEINT=y
+CONFIG_HISAX_TELESPCI=y
+CONFIG_HISAX_TELES_CS=m
+CONFIG_HISAX_W6692=y
+CONFIG_HOSTAP=m
+CONFIG_HOSTAP_CS=m
+CONFIG_HOSTAP_FIRMWARE=y
+CONFIG_HOSTAP_FIRMWARE_NVRAM=y
+CONFIG_HOSTAP_PCI=m
+CONFIG_HOSTAP_PLX=m
+CONFIG_HOSTESS_SV11=m
+CONFIG_HOTPLUG=y
+CONFIG_HOTPLUG_CPU=y
+CONFIG_HOTPLUG_PCI=y
+CONFIG_HOTPLUG_PCI_ACPI=m
+CONFIG_HOTPLUG_PCI_ACPI_IBM=m
+CONFIG_HOTPLUG_PCI_COMPAQ=m
+CONFIG_HOTPLUG_PCI_COMPAQ_NVRAM=y
+CONFIG_HOTPLUG_PCI_CPCI=y
+CONFIG_HOTPLUG_PCI_CPCI_GENERIC=m
+CONFIG_HOTPLUG_PCI_CPCI_ZT5550=m
+CONFIG_HOTPLUG_PCI_FAKE=m
+CONFIG_HOTPLUG_PCI_IBM=m
+CONFIG_HOTPLUG_PCI_PCIE=y
+CONFIG_HOTPLUG_PCI_SHPC=m
+CONFIG_HP100=m
+CONFIG_HPET=y
+CONFIG_HPET_EMULATE_RTC=y
+CONFIG_HPET_MMAP=y
+CONFIG_HPET_TIMER=y
+CONFIG_HPFS_FS=m
+CONFIG_HPLAN=m
+CONFIG_HPLAN_PLUS=m
+CONFIG_HP_ILO=m
+# CONFIG_HP_WATCHDOG is not set
+CONFIG_HP_WMI=m
+CONFIG_HTC_PASIC3=m
+CONFIG_HT_IRQ=y
+CONFIG_HUGETLBFS=y
+CONFIG_HUGETLB_PAGE=y
+CONFIG_HVC_DRIVER=y
+# CONFIG_HWLAT_DETECTOR is not set
+CONFIG_HWMON=y
+# CONFIG_HWMON_DEBUG_CHIP is not set
+CONFIG_HWMON_VID=m
+CONFIG_HW_CONSOLE=y
+CONFIG_HW_RANDOM=y
+CONFIG_HW_RANDOM_AMD=m
+CONFIG_HW_RANDOM_GEODE=m
+CONFIG_HW_RANDOM_INTEL=m
+CONFIG_HW_RANDOM_TIMERIOMEM=m
+CONFIG_HW_RANDOM_VIA=m
+CONFIG_HW_RANDOM_VIRTIO=m
+CONFIG_HYSDN=m
+CONFIG_HYSDN_CAPI=y
+CONFIG_HZ=1000
+# CONFIG_HZ_100 is not set
+CONFIG_HZ_1000=y
+# CONFIG_HZ_250 is not set
+# CONFIG_HZ_300 is not set
+CONFIG_I2C=y
+CONFIG_I2C_ALGOBIT=m
+CONFIG_I2C_ALGOPCA=m
+CONFIG_I2C_ALGOPCF=m
+CONFIG_I2C_ALI1535=m
+CONFIG_I2C_ALI1563=m
+CONFIG_I2C_ALI15X3=m
+CONFIG_I2C_AMD756=m
+CONFIG_I2C_AMD756_S4882=m
+CONFIG_I2C_AMD8111=m
+CONFIG_I2C_BOARDINFO=y
+CONFIG_I2C_CHARDEV=m
+# CONFIG_I2C_DEBUG_ALGO is not set
+# CONFIG_I2C_DEBUG_BUS is not set
+# CONFIG_I2C_DEBUG_CHIP is not set
+# CONFIG_I2C_DEBUG_CORE is not set
+CONFIG_I2C_GPIO=m
+# CONFIG_I2C_HELPER_AUTO is not set
+CONFIG_I2C_I801=m
+CONFIG_I2C_ISCH=m
+CONFIG_I2C_NFORCE2=m
+CONFIG_I2C_NFORCE2_S4985=m
+CONFIG_I2C_OCORES=m
+CONFIG_I2C_PARPORT=m
+CONFIG_I2C_PARPORT_LIGHT=m
+CONFIG_I2C_PCA_ISA=m
+CONFIG_I2C_PCA_PLATFORM=m
+CONFIG_I2C_PIIX4=m
+CONFIG_I2C_SIMTEC=m
+CONFIG_I2C_SIS5595=m
+CONFIG_I2C_SIS630=m
+CONFIG_I2C_SIS96X=m
+CONFIG_I2C_STUB=m
+CONFIG_I2C_TAOS_EVM=m
+CONFIG_I2C_TINY_USB=m
+CONFIG_I2C_VIA=m
+CONFIG_I2C_VIAPRO=m
+CONFIG_I2C_VOODOO3=m
+CONFIG_I2O=m
+CONFIG_I2O_BLOCK=m
+CONFIG_I2O_BUS=m
+CONFIG_I2O_CONFIG=m
+CONFIG_I2O_CONFIG_OLD_IOCTL=y
+CONFIG_I2O_EXT_ADAPTEC=y
+CONFIG_I2O_LCT_NOTIFY_ON_CHANGES=y
+CONFIG_I2O_PROC=m
+CONFIG_I2O_SCSI=m
+CONFIG_I6300ESB_WDT=m
+CONFIG_I82092=m
+CONFIG_I82365=m
+CONFIG_I8K=m
+CONFIG_IB700_WDT=m
+CONFIG_IBMASR=m
+CONFIG_IBMLANA=m
+CONFIG_IBMLS=m
+# CONFIG_IBMMCA_SCSI_DEV_RESET is not set
+CONFIG_IBMMCA_SCSI_ORDER_STANDARD=y
+CONFIG_IBMOL=m
+CONFIG_IBMTR=m
+CONFIG_IBM_ASM=m
+# CONFIG_IBM_NEW_EMAC_EMAC4 is not set
+# CONFIG_IBM_NEW_EMAC_MAL_CLR_ICINTSTAT is not set
+# CONFIG_IBM_NEW_EMAC_MAL_COMMON_ERR is not set
+# CONFIG_IBM_NEW_EMAC_NO_FLOW_CTRL is not set
+# CONFIG_IBM_NEW_EMAC_RGMII is not set
+# CONFIG_IBM_NEW_EMAC_TAH is not set
+# CONFIG_IBM_NEW_EMAC_ZMII is not set
+CONFIG_ICPLUS_PHY=y
+CONFIG_ICS932S401=m
+# CONFIG_IDE is not set
+CONFIG_IDE_PHISON=m
+CONFIG_IEEE1394=m
+CONFIG_IEEE1394_DV1394=m
+CONFIG_IEEE1394_ETH1394=m
+CONFIG_IEEE1394_ETH1394_ROM_ENTRY=y
+CONFIG_IEEE1394_OHCI1394=m
+CONFIG_IEEE1394_PCILYNX=m
+CONFIG_IEEE1394_RAWIO=m
+CONFIG_IEEE1394_SBP2=m
+# CONFIG_IEEE1394_SBP2_PHYS_DMA is not set
+# CONFIG_IEEE1394_VERBOSEDEBUG is not set
+CONFIG_IEEE1394_VIDEO1394=m
+CONFIG_IEEE802154=m
+CONFIG_IEEE802154_DRIVERS=m
+# CONFIG_IEEE802154_FAKEHARD is not set
+CONFIG_IFB=m
+CONFIG_IGB=m
+CONFIG_IGBVF=m
+CONFIG_IGB_DCA=y
+# CONFIG_IKCONFIG is not set
+# CONFIG_IMA is not set
+CONFIG_INET=y
+CONFIG_INET6_AH=m
+CONFIG_INET6_ESP=m
+CONFIG_INET6_IPCOMP=m
+CONFIG_INET6_TUNNEL=m
+CONFIG_INET6_XFRM_MODE_BEET=m
+CONFIG_INET6_XFRM_MODE_ROUTEOPTIMIZATION=m
+CONFIG_INET6_XFRM_MODE_TRANSPORT=m
+CONFIG_INET6_XFRM_MODE_TUNNEL=m
+CONFIG_INET6_XFRM_TUNNEL=m
+CONFIG_INET_AH=m
+CONFIG_INET_DCCP_DIAG=m
+CONFIG_INET_DIAG=y
+CONFIG_INET_ESP=m
+CONFIG_INET_IPCOMP=m
+CONFIG_INET_LRO=y
+CONFIG_INET_TCP_DIAG=y
+CONFIG_INET_TUNNEL=m
+CONFIG_INET_XFRM_MODE_BEET=m
+CONFIG_INET_XFRM_MODE_TRANSPORT=m
+CONFIG_INET_XFRM_MODE_TUNNEL=m
+CONFIG_INET_XFRM_TUNNEL=m
+CONFIG_INFINIBAND=m
+CONFIG_INFINIBAND_ADDR_TRANS=y
+CONFIG_INFINIBAND_AMSO1100=m
+CONFIG_INFINIBAND_AMSO1100_DEBUG=y
+CONFIG_INFINIBAND_CXGB3=m
+# CONFIG_INFINIBAND_CXGB3_DEBUG is not set
+CONFIG_INFINIBAND_IPOIB=m
+CONFIG_INFINIBAND_IPOIB_CM=y
+CONFIG_INFINIBAND_IPOIB_DEBUG=y
+# CONFIG_INFINIBAND_IPOIB_DEBUG_DATA is not set
+CONFIG_INFINIBAND_ISER=m
+CONFIG_INFINIBAND_MTHCA=m
+CONFIG_INFINIBAND_MTHCA_DEBUG=y
+# CONFIG_INFINIBAND_NES is not set
+CONFIG_INFINIBAND_SRP=m
+CONFIG_INFINIBAND_USER_ACCESS=m
+CONFIG_INFINIBAND_USER_MAD=m
+CONFIG_INFINIBAND_USER_MEM=y
+CONFIG_INFTL=m
+CONFIG_INITRAMFS_SOURCE=""
+CONFIG_INIT_ENV_ARG_LIMIT=32
+CONFIG_INOTIFY=y
+CONFIG_INOTIFY_USER=y
+CONFIG_INPUT=y
+# CONFIG_INPUT_APANEL is not set
+CONFIG_INPUT_ATI_REMOTE=m
+CONFIG_INPUT_ATI_REMOTE2=m
+CONFIG_INPUT_ATLAS_BTNS=m
+CONFIG_INPUT_CM109=m
+CONFIG_INPUT_EVBUG=m
+CONFIG_INPUT_EVDEV=y
+CONFIG_INPUT_FF_MEMLESS=m
+CONFIG_INPUT_GPIO_ROTARY_ENCODER=m
+CONFIG_INPUT_JOYDEV=m
+CONFIG_INPUT_JOYSTICK=y
+CONFIG_INPUT_KEYBOARD=y
+CONFIG_INPUT_KEYSPAN_REMOTE=m
+CONFIG_INPUT_MIMIO=m
+CONFIG_INPUT_MISC=y
+CONFIG_INPUT_MOUSE=y
+CONFIG_INPUT_MOUSEDEV=y
+CONFIG_INPUT_MOUSEDEV_PSAUX=y
+CONFIG_INPUT_MOUSEDEV_SCREEN_X=1024
+CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768
+CONFIG_INPUT_PCF50633_PMU=m
+CONFIG_INPUT_PCSPKR=m
+CONFIG_INPUT_POLLDEV=m
+CONFIG_INPUT_POWERMATE=m
+CONFIG_INPUT_TABLET=y
+CONFIG_INPUT_TOUCHSCREEN=y
+CONFIG_INPUT_TWL4030_PWRBUTTON=m
+CONFIG_INPUT_UINPUT=m
+CONFIG_INPUT_WISTRON_BTNS=m
+CONFIG_INPUT_YEALINK=m
+CONFIG_INTEL_IOATDMA=m
+CONFIG_INTEL_MENLOW=m
+# CONFIG_IOMMU_API is not set
+# CONFIG_IOMMU_HELPER is not set
+# CONFIG_IOMMU_STRESS is not set
+CONFIG_IOSCHED_AS=y
+CONFIG_IOSCHED_CFQ=y
+CONFIG_IOSCHED_DEADLINE=y
+CONFIG_IOSCHED_NOOP=y
+# CONFIG_IO_DELAY_0X80 is not set
+CONFIG_IO_DELAY_0XED=y
+# CONFIG_IO_DELAY_NONE is not set
+CONFIG_IO_DELAY_TYPE_0X80=0
+CONFIG_IO_DELAY_TYPE_0XED=1
+CONFIG_IO_DELAY_TYPE_NONE=3
+CONFIG_IO_DELAY_TYPE_UDELAY=2
+# CONFIG_IO_DELAY_UDELAY is not set
+CONFIG_IP1000=m
+CONFIG_IP6_NF_FILTER=m
+CONFIG_IP6_NF_IPTABLES=m
+CONFIG_IP6_NF_MANGLE=m
+CONFIG_IP6_NF_MATCH_AH=m
+CONFIG_IP6_NF_MATCH_EUI64=m
+CONFIG_IP6_NF_MATCH_FRAG=m
+CONFIG_IP6_NF_MATCH_HL=m
+CONFIG_IP6_NF_MATCH_IPV6HEADER=m
+CONFIG_IP6_NF_MATCH_MH=m
+CONFIG_IP6_NF_MATCH_OPTS=m
+CONFIG_IP6_NF_MATCH_RT=m
+CONFIG_IP6_NF_QUEUE=m
+CONFIG_IP6_NF_RAW=m
+CONFIG_IP6_NF_SECURITY=m
+CONFIG_IP6_NF_TARGET_HL=m
+CONFIG_IP6_NF_TARGET_LOG=m
+CONFIG_IP6_NF_TARGET_REJECT=m
+CONFIG_IPC_NS=y
+CONFIG_IPDDP=m
+CONFIG_IPDDP_DECAP=y
+CONFIG_IPDDP_ENCAP=y
+CONFIG_IPMI_DEVICE_INTERFACE=m
+CONFIG_IPMI_HANDLER=m
+# CONFIG_IPMI_PANIC_EVENT is not set
+CONFIG_IPMI_POWEROFF=m
+CONFIG_IPMI_SI=m
+CONFIG_IPMI_WATCHDOG=m
+CONFIG_IPPP_FILTER=y
+CONFIG_IPV6=y
+# CONFIG_IPV6_MIP6 is not set
+# CONFIG_IPV6_MROUTE is not set
+CONFIG_IPV6_MULTIPLE_TABLES=y
+CONFIG_IPV6_NDISC_NODETYPE=y
+# CONFIG_IPV6_OPTIMISTIC_DAD is not set
+CONFIG_IPV6_PRIVACY=y
+# CONFIG_IPV6_ROUTER_PREF is not set
+CONFIG_IPV6_SIT=m
+# CONFIG_IPV6_SUBTREES is not set
+CONFIG_IPV6_TUNNEL=m
+CONFIG_IPW2100=m
+# CONFIG_IPW2100_DEBUG is not set
+CONFIG_IPW2100_MONITOR=y
+CONFIG_IPW2200=m
+# CONFIG_IPW2200_DEBUG is not set
+CONFIG_IPW2200_MONITOR=y
+CONFIG_IPW2200_PROMISCUOUS=y
+CONFIG_IPW2200_QOS=y
+CONFIG_IPW2200_RADIOTAP=y
+CONFIG_IPWIRELESS=m
+CONFIG_IPX=m
+# CONFIG_IPX_INTERN is not set
+CONFIG_IP_ADVANCED_ROUTER=y
+CONFIG_IP_DCCP=m
+# CONFIG_IP_DCCP_CCID2_DEBUG is not set
+CONFIG_IP_DCCP_CCID3=y
+# CONFIG_IP_DCCP_CCID3_DEBUG is not set
+CONFIG_IP_DCCP_CCID3_RTO=100
+# CONFIG_IP_DCCP_DEBUG is not set
+CONFIG_IP_DCCP_TFRC_LIB=y
+CONFIG_IP_FIB_HASH=y
+# CONFIG_IP_FIB_TRIE is not set
+CONFIG_IP_MROUTE=y
+CONFIG_IP_MULTICAST=y
+CONFIG_IP_MULTIPLE_TABLES=y
+CONFIG_IP_NF_ARPFILTER=m
+CONFIG_IP_NF_ARPTABLES=m
+CONFIG_IP_NF_ARP_MANGLE=m
+CONFIG_IP_NF_FILTER=m
+CONFIG_IP_NF_IPTABLES=m
+CONFIG_IP_NF_MANGLE=m
+CONFIG_IP_NF_MATCH_ADDRTYPE=m
+CONFIG_IP_NF_MATCH_AH=m
+CONFIG_IP_NF_MATCH_ECN=m
+CONFIG_IP_NF_MATCH_TTL=m
+CONFIG_IP_NF_QUEUE=m
+CONFIG_IP_NF_RAW=m
+CONFIG_IP_NF_SECURITY=m
+CONFIG_IP_NF_TARGET_CLUSTERIP=m
+CONFIG_IP_NF_TARGET_ECN=m
+CONFIG_IP_NF_TARGET_LOG=m
+CONFIG_IP_NF_TARGET_MASQUERADE=m
+CONFIG_IP_NF_TARGET_NETMAP=m
+CONFIG_IP_NF_TARGET_REDIRECT=m
+CONFIG_IP_NF_TARGET_REJECT=m
+CONFIG_IP_NF_TARGET_TTL=m
+CONFIG_IP_NF_TARGET_ULOG=m
+CONFIG_IP_PIMSM_V1=y
+CONFIG_IP_PIMSM_V2=y
+# CONFIG_IP_PNP is not set
+CONFIG_IP_ROUTE_MULTIPATH=y
+CONFIG_IP_ROUTE_VERBOSE=y
+CONFIG_IP_SCTP=m
+CONFIG_IP_VS=m
+# CONFIG_IP_VS_DEBUG is not set
+CONFIG_IP_VS_DH=m
+CONFIG_IP_VS_FTP=m
+CONFIG_IP_VS_IPV6=y
+CONFIG_IP_VS_LBLC=m
+CONFIG_IP_VS_LBLCR=m
+CONFIG_IP_VS_LC=m
+CONFIG_IP_VS_NQ=m
+CONFIG_IP_VS_PROTO_AH=y
+CONFIG_IP_VS_PROTO_AH_ESP=y
+CONFIG_IP_VS_PROTO_ESP=y
+CONFIG_IP_VS_PROTO_TCP=y
+CONFIG_IP_VS_PROTO_UDP=y
+CONFIG_IP_VS_RR=m
+CONFIG_IP_VS_SED=m
+CONFIG_IP_VS_SH=m
+CONFIG_IP_VS_TAB_BITS=12
+CONFIG_IP_VS_WLC=m
+CONFIG_IP_VS_WRR=m
+CONFIG_IRCOMM=m
+CONFIG_IRDA=m
+CONFIG_IRDA_CACHE_LAST_LSAP=y
+CONFIG_IRDA_DEBUG=y
+CONFIG_IRDA_FAST_RR=y
+CONFIG_IRDA_ULTRA=y
+CONFIG_IRLAN=m
+CONFIG_IRNET=m
+CONFIG_IRTTY_SIR=m
+CONFIG_ISA=y
+CONFIG_ISAPNP=y
+CONFIG_ISA_DMA_API=y
+CONFIG_ISCSI_IBFT=m
+CONFIG_ISCSI_IBFT_FIND=y
+CONFIG_ISCSI_TCP=m
+CONFIG_ISDN=y
+CONFIG_ISDN_AUDIO=y
+CONFIG_ISDN_CAPI=m
+CONFIG_ISDN_CAPI_CAPI20=m
+CONFIG_ISDN_CAPI_CAPIDRV=m
+CONFIG_ISDN_CAPI_CAPIFS=m
+CONFIG_ISDN_CAPI_CAPIFS_BOOL=y
+CONFIG_ISDN_CAPI_MIDDLEWARE=y
+CONFIG_ISDN_DIVAS=m
+CONFIG_ISDN_DIVAS_BRIPCI=y
+CONFIG_ISDN_DIVAS_DIVACAPI=m
+CONFIG_ISDN_DIVAS_MAINT=m
+CONFIG_ISDN_DIVAS_PRIPCI=y
+CONFIG_ISDN_DIVAS_USERIDI=m
+CONFIG_ISDN_DIVERSION=m
+CONFIG_ISDN_DRV_ACT2000=m
+CONFIG_ISDN_DRV_AVMB1_AVM_CS=m
+CONFIG_ISDN_DRV_AVMB1_B1ISA=m
+CONFIG_ISDN_DRV_AVMB1_B1PCI=m
+CONFIG_ISDN_DRV_AVMB1_B1PCIV4=y
+CONFIG_ISDN_DRV_AVMB1_B1PCMCIA=m
+CONFIG_ISDN_DRV_AVMB1_C4=m
+CONFIG_ISDN_DRV_AVMB1_T1ISA=m
+CONFIG_ISDN_DRV_AVMB1_T1PCI=m
+CONFIG_ISDN_DRV_AVMB1_VERBOSE_REASON=y
+CONFIG_ISDN_DRV_GIGASET=m
+CONFIG_ISDN_DRV_HISAX=m
+CONFIG_ISDN_DRV_ICN=m
+CONFIG_ISDN_DRV_PCBIT=m
+CONFIG_ISDN_DRV_SC=m
+CONFIG_ISDN_I4L=m
+CONFIG_ISDN_MPP=y
+CONFIG_ISDN_PPP=y
+CONFIG_ISDN_PPP_BSDCOMP=m
+CONFIG_ISDN_PPP_VJ=y
+CONFIG_ISDN_TTY_FAX=y
+CONFIG_ISDN_X25=y
+# CONFIG_ISI is not set
+CONFIG_ISL29003=m
+CONFIG_ISO9660_FS=m
+CONFIG_ISTALLION=m
+CONFIG_IT8712F_WDT=m
+CONFIG_IT87_WDT=m
+CONFIG_ITCO_VENDOR_SUPPORT=y
+CONFIG_ITCO_WDT=m
+CONFIG_IWL3945=m
+CONFIG_IWL3945_SPECTRUM_MEASUREMENT=y
+CONFIG_IWL4965=y
+CONFIG_IWL5000=y
+CONFIG_IWLAGN=m
+CONFIG_IWLWIFI=m
+# CONFIG_IWLWIFI_DEBUG is not set
+CONFIG_IWLWIFI_LEDS=y
+# CONFIG_IWLWIFI_SPECTRUM_MEASUREMENT is not set
+CONFIG_IWM=m
+# CONFIG_IWM_DEBUG is not set
+CONFIG_IXGB=m
+CONFIG_IXGBE=m
+CONFIG_IXGBE_DCA=y
+CONFIG_IXGBE_DCB=y
+CONFIG_JBD=y
+CONFIG_JBD2=y
+# CONFIG_JBD2_DEBUG is not set
+# CONFIG_JBD_DEBUG is not set
+CONFIG_JFFS2_CMODE_FAVOURLZO=y
+# CONFIG_JFFS2_CMODE_NONE is not set
+# CONFIG_JFFS2_CMODE_PRIORITY is not set
+# CONFIG_JFFS2_CMODE_SIZE is not set
+CONFIG_JFFS2_COMPRESSION_OPTIONS=y
+CONFIG_JFFS2_FS=m
+CONFIG_JFFS2_FS_DEBUG=0
+# CONFIG_JFFS2_FS_WBUF_VERIFY is not set
+CONFIG_JFFS2_FS_WRITEBUFFER=y
+# CONFIG_JFFS2_FS_XATTR is not set
+CONFIG_JFFS2_LZO=y
+CONFIG_JFFS2_RTIME=y
+# CONFIG_JFFS2_RUBIN is not set
+# CONFIG_JFFS2_SUMMARY is not set
+CONFIG_JFFS2_ZLIB=y
+# CONFIG_JFS_DEBUG is not set
+CONFIG_JFS_FS=m
+CONFIG_JFS_POSIX_ACL=y
+CONFIG_JFS_SECURITY=y
+CONFIG_JFS_STATISTICS=y
+CONFIG_JME=m
+CONFIG_JOLIET=y
+CONFIG_JOYSTICK_A3D=m
+CONFIG_JOYSTICK_ADI=m
+CONFIG_JOYSTICK_ANALOG=m
+CONFIG_JOYSTICK_COBRA=m
+CONFIG_JOYSTICK_DB9=m
+CONFIG_JOYSTICK_GAMECON=m
+CONFIG_JOYSTICK_GF2K=m
+CONFIG_JOYSTICK_GRIP=m
+CONFIG_JOYSTICK_GRIP_MP=m
+CONFIG_JOYSTICK_GUILLEMOT=m
+CONFIG_JOYSTICK_IFORCE=m
+CONFIG_JOYSTICK_IFORCE_232=y
+CONFIG_JOYSTICK_IFORCE_USB=y
+CONFIG_JOYSTICK_INTERACT=m
+CONFIG_JOYSTICK_JOYDUMP=m
+CONFIG_JOYSTICK_MAGELLAN=m
+CONFIG_JOYSTICK_SIDEWINDER=m
+CONFIG_JOYSTICK_SPACEBALL=m
+CONFIG_JOYSTICK_SPACEORB=m
+CONFIG_JOYSTICK_STINGER=m
+CONFIG_JOYSTICK_TMDC=m
+CONFIG_JOYSTICK_TURBOGRAFX=m
+CONFIG_JOYSTICK_TWIDJOY=m
+CONFIG_JOYSTICK_WALKERA0701=m
+CONFIG_JOYSTICK_WARRIOR=m
+CONFIG_JOYSTICK_XPAD=m
+CONFIG_JOYSTICK_XPAD_FF=y
+CONFIG_JOYSTICK_XPAD_LEDS=y
+CONFIG_JOYSTICK_ZHENHUA=m
+CONFIG_K8_NB=y
+CONFIG_KALLSYMS=y
+CONFIG_KALLSYMS_ALL=y
+# CONFIG_KALLSYMS_EXTRA_PASS is not set
+CONFIG_KARMA_PARTITION=y
+# CONFIG_KERNEL_BZIP2 is not set
+CONFIG_KERNEL_GZIP=y
+# CONFIG_KERNEL_LZMA is not set
+CONFIG_KEXEC=y
+CONFIG_KEXEC_JUMP=y
+CONFIG_KEYBOARD_ATKBD=y
+CONFIG_KEYBOARD_GPIO=m
+CONFIG_KEYBOARD_LKKBD=m
+CONFIG_KEYBOARD_LM8323=m
+CONFIG_KEYBOARD_MATRIX=m
+CONFIG_KEYBOARD_NEWTON=m
+CONFIG_KEYBOARD_STOWAWAY=m
+CONFIG_KEYBOARD_SUNKBD=m
+CONFIG_KEYBOARD_XTKBD=m
+CONFIG_KEYS=y
+# CONFIG_KEYS_DEBUG_PROC_KEYS is not set
+CONFIG_KGDB=y
+CONFIG_KGDB_SERIAL_CONSOLE=y
+# CONFIG_KGDB_TESTS is not set
+CONFIG_KINGSUN_DONGLE=m
+# CONFIG_KMEMCHECK is not set
+CONFIG_KPROBES=y
+# CONFIG_KPROBES_SANITY_TEST is not set
+CONFIG_KRETPROBES=y
+CONFIG_KS0108=m
+CONFIG_KS0108_DELAY=2
+CONFIG_KS0108_PORT=0x378
+CONFIG_KS8842=m
+CONFIG_KS8851=m
+CONFIG_KS959_DONGLE=m
+CONFIG_KSDAZZLE_DONGLE=m
+CONFIG_KTIME_SCALAR=y
+CONFIG_KVM=m
+CONFIG_KVM_AMD=m
+CONFIG_KVM_CLOCK=y
+CONFIG_KVM_GUEST=y
+CONFIG_KVM_INTEL=m
+# CONFIG_KVM_TRACE is not set
+CONFIG_LANCE=m
+CONFIG_LANMEDIA=m
+CONFIG_LAPB=m
+CONFIG_LAPBETHER=m
+CONFIG_LATENCYTOP=y
+CONFIG_LBDAF=y
+CONFIG_LCD_CLASS_DEVICE=m
+CONFIG_LCD_ILI9320=m
+CONFIG_LCD_LTV350QV=m
+CONFIG_LCD_PLATFORM=m
+CONFIG_LCD_TDO24M=m
+CONFIG_LCD_VGG2432A4=m
+# CONFIG_LDM_DEBUG is not set
+CONFIG_LDM_PARTITION=y
+CONFIG_LEDS_ALIX2=m
+CONFIG_LEDS_BD2802=m
+CONFIG_LEDS_CLASS=m
+# CONFIG_LEDS_CLEVO_MAIL is not set
+CONFIG_LEDS_DA903X=m
+CONFIG_LEDS_DAC124S085=m
+CONFIG_LEDS_GPIO=m
+CONFIG_LEDS_GPIO_PLATFORM=y
+CONFIG_LEDS_LP3944=m
+CONFIG_LEDS_NET48XX=m
+CONFIG_LEDS_PCA9532=m
+CONFIG_LEDS_PCA955X=m
+CONFIG_LEDS_TRIGGERS=y
+CONFIG_LEDS_TRIGGER_BACKLIGHT=m
+CONFIG_LEDS_TRIGGER_DEFAULT_ON=m
+CONFIG_LEDS_TRIGGER_GPIO=m
+CONFIG_LEDS_TRIGGER_HEARTBEAT=m
+CONFIG_LEDS_TRIGGER_TIMER=m
+CONFIG_LEDS_WM8350=m
+CONFIG_LEDS_WRAP=m
+CONFIG_LEGACY_PTYS=y
+CONFIG_LEGACY_PTY_COUNT=0
+CONFIG_LENOVO_SL_LAPTOP=m
+# CONFIG_LGUEST is not set
+# CONFIG_LGUEST_GUEST is not set
+CONFIG_LIB80211=m
+CONFIG_LIB80211_CRYPT_CCMP=m
+CONFIG_LIB80211_CRYPT_TKIP=m
+CONFIG_LIB80211_CRYPT_WEP=m
+# CONFIG_LIB80211_DEBUG is not set
+CONFIG_LIBCRC32C=m
+CONFIG_LIBERTAS=m
+CONFIG_LIBERTAS_CS=m
+# CONFIG_LIBERTAS_DEBUG is not set
+CONFIG_LIBERTAS_SDIO=m
+CONFIG_LIBERTAS_SPI=m
+CONFIG_LIBERTAS_THINFIRM=m
+CONFIG_LIBERTAS_THINFIRM_USB=m
+CONFIG_LIBERTAS_USB=m
+CONFIG_LIBFC=m
+CONFIG_LIBFCOE=m
+CONFIG_LIBIPW=m
+CONFIG_LIBIPW_DEBUG=y
+CONFIG_LINE6_USB=m
+CONFIG_LIRC_ATIUSB=m
+CONFIG_LIRC_BT829=m
+CONFIG_LIRC_CONFIG_LIRC_WPC8769L=m
+CONFIG_LIRC_DEV=m
+CONFIG_LIRC_ENE0100=m
+# CONFIG_LIRC_GPIO is not set
+CONFIG_LIRC_I2C=m
+CONFIG_LIRC_IGORPLUGUSB=m
+CONFIG_LIRC_IMON=m
+CONFIG_LIRC_IT87=m
+# CONFIG_LIRC_ITE8709 is not set
+CONFIG_LIRC_MCEUSB=m
+# CONFIG_LIRC_PARALLEL is not set
+CONFIG_LIRC_SASEM=m
+CONFIG_LIRC_SERIAL=m
+CONFIG_LIRC_SIR=m
+CONFIG_LIRC_STREAMZAP=m
+CONFIG_LIRC_TTUSBIR=m
+CONFIG_LITELINK_DONGLE=m
+# CONFIG_LKDTM is not set
+CONFIG_LLC=y
+CONFIG_LLC2=m
+CONFIG_LNE390=m
+CONFIG_LOCALVERSION=""
+# CONFIG_LOCALVERSION_AUTO is not set
+CONFIG_LOCKD=m
+CONFIG_LOCKDEP_SUPPORT=y
+CONFIG_LOCKD_V4=y
+CONFIG_LOCK_KERNEL=y
+# CONFIG_LOCK_STAT is not set
+CONFIG_LOGIRUMBLEPAD2_FF=y
+CONFIG_LOGITECH_FF=y
+# CONFIG_LOGO is not set
+CONFIG_LOG_BUF_SHIFT=17
+CONFIG_LP486E=m
+# CONFIG_LP_CONSOLE is not set
+CONFIG_LSI_ET1011C_PHY=y
+CONFIG_LSM_MMAP_MIN_ADDR=0
+CONFIG_LTPC=m
+CONFIG_LXT_PHY=y
+CONFIG_LZO_COMPRESS=m
+CONFIG_LZO_DECOMPRESS=m
+CONFIG_M25PXX_USE_FAST_READ=y
+# CONFIG_M386 is not set
+# CONFIG_M486 is not set
+CONFIG_M586=y
+# CONFIG_M586MMX is not set
+# CONFIG_M586TSC is not set
+# CONFIG_M686 is not set
+CONFIG_MA600_DONGLE=m
+CONFIG_MAC80211=m
+CONFIG_MAC80211_DEBUGFS=y
+# CONFIG_MAC80211_DEBUG_MENU is not set
+CONFIG_MAC80211_DEFAULT_PS=y
+CONFIG_MAC80211_DEFAULT_PS_VALUE=1
+CONFIG_MAC80211_HWSIM=m
+CONFIG_MAC80211_LEDS=y
+CONFIG_MAC80211_RC_DEFAULT="minstrel"
+CONFIG_MAC80211_RC_DEFAULT_MINSTREL=y
+# CONFIG_MAC80211_RC_DEFAULT_PID is not set
+CONFIG_MAC80211_RC_MINSTREL=y
+CONFIG_MACHZ_WDT=m
+CONFIG_MACINTOSH_DRIVERS=y
+CONFIG_MACVLAN=m
+CONFIG_MAC_EMUMOUSEBTN=y
+CONFIG_MAC_PARTITION=y
+CONFIG_MADGEMC=m
+CONFIG_MAGIC_SYSRQ=y
+CONFIG_MARVELL_PHY=y
+# CONFIG_MATH_EMULATION is not set
+CONFIG_MAX_RAW_DEVS=256
+CONFIG_MCA=y
+CONFIG_MCA_LEGACY=y
+# CONFIG_MCA_PROC_FS is not set
+# CONFIG_MCORE2 is not set
+CONFIG_MCP2120_DONGLE=m
+# CONFIG_MCRUSOE is not set
+CONFIG_MCS_FIR=m
+# CONFIG_MCYRIXIII is not set
+CONFIG_MD=y
+CONFIG_MDA_CONSOLE=m
+CONFIG_MDIO=m
+CONFIG_MDIO_BITBANG=y
+CONFIG_MDIO_GPIO=y
+CONFIG_MD_AUTODETECT=y
+CONFIG_MD_FAULTY=m
+CONFIG_MD_LINEAR=m
+CONFIG_MD_MULTIPATH=m
+CONFIG_MD_RAID0=m
+CONFIG_MD_RAID1=m
+CONFIG_MD_RAID10=m
+CONFIG_MD_RAID456=m
+CONFIG_MD_RAID6_PQ=m
+CONFIG_ME0600=m
+CONFIG_ME0900=m
+CONFIG_ME1000=m
+CONFIG_ME1400=m
+CONFIG_ME1600=m
+CONFIG_ME4000=m
+CONFIG_ME4600=m
+CONFIG_ME6000=m
+CONFIG_ME8100=m
+CONFIG_ME8200=m
+CONFIG_MEDIA_ATTACH=y
+CONFIG_MEDIA_SUPPORT=m
+CONFIG_MEDIA_TUNER=m
+# CONFIG_MEDIA_TUNER_CUSTOMISE is not set
+CONFIG_MEDIA_TUNER_MC44S803=m
+CONFIG_MEDIA_TUNER_MT2060=m
+CONFIG_MEDIA_TUNER_MT20XX=m
+CONFIG_MEDIA_TUNER_MT2131=m
+CONFIG_MEDIA_TUNER_MT2266=m
+CONFIG_MEDIA_TUNER_MXL5005S=m
+CONFIG_MEDIA_TUNER_MXL5007T=m
+CONFIG_MEDIA_TUNER_QT1010=m
+CONFIG_MEDIA_TUNER_SIMPLE=m
+CONFIG_MEDIA_TUNER_TDA18271=m
+CONFIG_MEDIA_TUNER_TDA827X=m
+CONFIG_MEDIA_TUNER_TDA8290=m
+CONFIG_MEDIA_TUNER_TDA9887=m
+CONFIG_MEDIA_TUNER_TEA5761=m
+CONFIG_MEDIA_TUNER_TEA5767=m
+CONFIG_MEDIA_TUNER_XC2028=m
+CONFIG_MEDIA_TUNER_XC5000=m
+CONFIG_MEDUMMY=m
+# CONFIG_MEFFICEON is not set
+CONFIG_MEGARAID_LEGACY=m
+CONFIG_MEGARAID_MAILBOX=m
+CONFIG_MEGARAID_MM=m
+CONFIG_MEGARAID_NEWGEN=y
+CONFIG_MEGARAID_SAS=m
+CONFIG_MEILHAUS=m
+CONFIG_MEMSTICK=m
+# CONFIG_MEMSTICK_DEBUG is not set
+CONFIG_MEMSTICK_JMICRON_38X=m
+CONFIG_MEMSTICK_TIFM_MS=m
+# CONFIG_MEMSTICK_UNSAFE_RESUME is not set
+# CONFIG_MEMTEST is not set
+CONFIG_MFD_CORE=m
+CONFIG_MFD_PCF50633=m
+CONFIG_MFD_SM501=m
+# CONFIG_MFD_SM501_GPIO is not set
+# CONFIG_MFD_TMIO is not set
+CONFIG_MFD_WM8350=m
+CONFIG_MFD_WM8350_I2C=m
+CONFIG_MFD_WM8400=m
+# CONFIG_MGEODEGX1 is not set
+# CONFIG_MGEODE_LX is not set
+CONFIG_MICROCODE=m
+CONFIG_MICROCODE_AMD=y
+CONFIG_MICROCODE_INTEL=y
+CONFIG_MICROCODE_OLD_INTERFACE=y
+CONFIG_MII=m
+CONFIG_MINIX_FS=m
+CONFIG_MINIX_SUBPARTITION=y
+CONFIG_MISC_DEVICES=y
+CONFIG_MISC_FILESYSTEMS=y
+CONFIG_MISDN=m
+CONFIG_MISDN_DSP=m
+CONFIG_MISDN_HFCMULTI=m
+CONFIG_MISDN_HFCPCI=m
+CONFIG_MISDN_HFCUSB=m
+CONFIG_MISDN_L1OIP=m
+CONFIG_MIXCOMWD=m
+# CONFIG_MK6 is not set
+# CONFIG_MK7 is not set
+# CONFIG_MK8 is not set
+CONFIG_MKISS=m
+CONFIG_MLX4_CORE=m
+CONFIG_MLX4_DEBUG=y
+CONFIG_MLX4_EN=m
+CONFIG_MLX4_INFINIBAND=m
+CONFIG_MMC=y
+CONFIG_MMC_BLOCK=m
+CONFIG_MMC_BLOCK_BOUNCE=y
+CONFIG_MMC_CB710=m
+# CONFIG_MMC_DEBUG is not set
+CONFIG_MMC_RICOH_MMC=m
+CONFIG_MMC_SDHCI=m
+CONFIG_MMC_SDHCI_PCI=m
+CONFIG_MMC_SDHCI_PLTFM=m
+CONFIG_MMC_SDRICOH_CS=m
+# CONFIG_MMC_TEST is not set
+CONFIG_MMC_TIFM_SD=m
+# CONFIG_MMC_UNSAFE_RESUME is not set
+CONFIG_MMC_VIA_SDMMC=m
+CONFIG_MMC_WBSD=m
+CONFIG_MMU=y
+CONFIG_MMU_NOTIFIER=y
+CONFIG_MM_OWNER=y
+CONFIG_MODULES=y
+# CONFIG_MODULE_FORCE_LOAD is not set
+# CONFIG_MODULE_FORCE_UNLOAD is not set
+CONFIG_MODULE_SRCVERSION_ALL=y
+CONFIG_MODULE_UNLOAD=y
+CONFIG_MODVERSIONS=y
+CONFIG_MOUSE_APPLETOUCH=m
+# CONFIG_MOUSE_ATIXL is not set
+CONFIG_MOUSE_BCM5974=m
+CONFIG_MOUSE_GPIO=m
+CONFIG_MOUSE_INPORT=m
+CONFIG_MOUSE_LOGIBM=m
+CONFIG_MOUSE_PC110PAD=m
+CONFIG_MOUSE_PS2=m
+CONFIG_MOUSE_PS2_ALPS=y
+CONFIG_MOUSE_PS2_ELANTECH=y
+CONFIG_MOUSE_PS2_LIFEBOOK=y
+CONFIG_MOUSE_PS2_LOGIPS2PP=y
+CONFIG_MOUSE_PS2_OLPC=y
+CONFIG_MOUSE_PS2_SYNAPTICS=y
+# CONFIG_MOUSE_PS2_TOUCHKIT is not set
+CONFIG_MOUSE_PS2_TRACKPOINT=y
+CONFIG_MOUSE_SERIAL=m
+CONFIG_MOUSE_SYNAPTICS_I2C=m
+CONFIG_MOUSE_VSXXXAA=m
+CONFIG_MOXA_INTELLIO=m
+CONFIG_MOXA_SMARTIO=m
+# CONFIG_MPENTIUM4 is not set
+# CONFIG_MPENTIUMII is not set
+# CONFIG_MPENTIUMIII is not set
+# CONFIG_MPENTIUMM is not set
+# CONFIG_MPSC is not set
+CONFIG_MSDOS_FS=m
+CONFIG_MSDOS_PARTITION=y
+CONFIG_MSI_LAPTOP=m
+CONFIG_MSNDCLAS_INIT_FILE="/etc/sound/msndinit.bin"
+CONFIG_MSNDCLAS_PERM_FILE="/etc/sound/msndperm.bin"
+CONFIG_MSNDPIN_INIT_FILE="/etc/sound/pndspini.bin"
+CONFIG_MSNDPIN_PERM_FILE="/etc/sound/pndsperm.bin"
+CONFIG_MSPRO_BLOCK=m
+CONFIG_MTD=m
+CONFIG_MTDRAM_ERASE_SIZE=128
+CONFIG_MTDRAM_TOTAL_SIZE=4096
+CONFIG_MTD_ABSENT=m
+CONFIG_MTD_ALAUDA=m
+CONFIG_MTD_AMD76XROM=m
+CONFIG_MTD_AR7_PARTS=m
+CONFIG_MTD_BLKDEVS=m
+CONFIG_MTD_BLOCK=m
+CONFIG_MTD_BLOCK2MTD=m
+CONFIG_MTD_BLOCK_RO=m
+CONFIG_MTD_CFI=m
+# CONFIG_MTD_CFI_ADV_OPTIONS is not set
+CONFIG_MTD_CFI_AMDSTD=m
+CONFIG_MTD_CFI_I1=y
+CONFIG_MTD_CFI_I2=y
+# CONFIG_MTD_CFI_I4 is not set
+# CONFIG_MTD_CFI_I8 is not set
+CONFIG_MTD_CFI_INTELEXT=m
+CONFIG_MTD_CFI_STAA=m
+CONFIG_MTD_CFI_UTIL=m
+CONFIG_MTD_CHAR=m
+CONFIG_MTD_CK804XROM=m
+CONFIG_MTD_COMPLEX_MAPPINGS=y
+CONFIG_MTD_CONCAT=m
+CONFIG_MTD_DATAFLASH=m
+CONFIG_MTD_DATAFLASH_OTP=y
+# CONFIG_MTD_DATAFLASH_WRITE_VERIFY is not set
+# CONFIG_MTD_DEBUG is not set
+CONFIG_MTD_DOC2000=m
+CONFIG_MTD_DOC2001=m
+CONFIG_MTD_DOC2001PLUS=m
+CONFIG_MTD_DOCECC=m
+CONFIG_MTD_DOCPROBE=m
+CONFIG_MTD_DOCPROBE_ADDRESS=0
+# CONFIG_MTD_DOCPROBE_ADVANCED is not set
+CONFIG_MTD_ESB2ROM=m
+CONFIG_MTD_GEN_PROBE=m
+CONFIG_MTD_ICHXROM=m
+CONFIG_MTD_INTEL_VR_NOR=m
+CONFIG_MTD_JEDECPROBE=m
+CONFIG_MTD_L440GX=m
+CONFIG_MTD_LPDDR=m
+CONFIG_MTD_M25P80=m
+CONFIG_MTD_MAP_BANK_WIDTH_1=y
+# CONFIG_MTD_MAP_BANK_WIDTH_16 is not set
+CONFIG_MTD_MAP_BANK_WIDTH_2=y
+# CONFIG_MTD_MAP_BANK_WIDTH_32 is not set
+CONFIG_MTD_MAP_BANK_WIDTH_4=y
+# CONFIG_MTD_MAP_BANK_WIDTH_8 is not set
+CONFIG_MTD_MTDRAM=m
+CONFIG_MTD_NAND=m
+CONFIG_MTD_NAND_CAFE=m
+CONFIG_MTD_NAND_CS553X=m
+CONFIG_MTD_NAND_DISKONCHIP=m
+# CONFIG_MTD_NAND_DISKONCHIP_BBTWRITE is not set
+CONFIG_MTD_NAND_DISKONCHIP_PROBE_ADDRESS=0
+# CONFIG_MTD_NAND_DISKONCHIP_PROBE_ADVANCED is not set
+# CONFIG_MTD_NAND_ECC_SMC is not set
+CONFIG_MTD_NAND_IDS=m
+# CONFIG_MTD_NAND_MUSEUM_IDS is not set
+CONFIG_MTD_NAND_NANDSIM=m
+CONFIG_MTD_NAND_PLATFORM=m
+# CONFIG_MTD_NAND_VERIFY_WRITE is not set
+CONFIG_MTD_NETSC520=m
+CONFIG_MTD_NETtel=m
+CONFIG_MTD_ONENAND=m
+CONFIG_MTD_ONENAND_2X_PROGRAM=y
+# CONFIG_MTD_ONENAND_OTP is not set
+CONFIG_MTD_ONENAND_SIM=m
+CONFIG_MTD_ONENAND_VERIFY_WRITE=y
+CONFIG_MTD_OOPS=m
+CONFIG_MTD_PARTITIONS=y
+CONFIG_MTD_PCI=m
+CONFIG_MTD_PHRAM=m
+CONFIG_MTD_PHYSMAP=m
+# CONFIG_MTD_PHYSMAP_COMPAT is not set
+CONFIG_MTD_PLATRAM=m
+CONFIG_MTD_PMC551=m
+# CONFIG_MTD_PMC551_BUGFIX is not set
+# CONFIG_MTD_PMC551_DEBUG is not set
+CONFIG_MTD_QINFO_PROBE=m
+CONFIG_MTD_RAM=m
+CONFIG_MTD_REDBOOT_DIRECTORY_BLOCK=-1
+CONFIG_MTD_REDBOOT_PARTS=m
+# CONFIG_MTD_REDBOOT_PARTS_READONLY is not set
+# CONFIG_MTD_REDBOOT_PARTS_UNALLOCATED is not set
+CONFIG_MTD_ROM=m
+CONFIG_MTD_SBC_GXX=m
+CONFIG_MTD_SC520CDP=m
+CONFIG_MTD_SCB2_FLASH=m
+CONFIG_MTD_SCx200_DOCFLASH=m
+CONFIG_MTD_SLRAM=m
+CONFIG_MTD_TESTS=m
+CONFIG_MTD_TS5500=m
+CONFIG_MTD_UBI=m
+CONFIG_MTD_UBI_BEB_RESERVE=1
+# CONFIG_MTD_UBI_DEBUG is not set
+CONFIG_MTD_UBI_GLUEBI=m
+CONFIG_MTD_UBI_WL_THRESHOLD=4096
+CONFIG_MTRR=y
+CONFIG_MTRR_SANITIZER=y
+CONFIG_MTRR_SANITIZER_ENABLE_DEFAULT=0
+CONFIG_MTRR_SANITIZER_SPARE_REG_NR_DEFAULT=1
+# CONFIG_MVIAC3_2 is not set
+# CONFIG_MVIAC7 is not set
+CONFIG_MWAVE=m
+# CONFIG_MWINCHIP3D is not set
+# CONFIG_MWINCHIPC6 is not set
+CONFIG_MWL8K=m
+CONFIG_MYRI10GE=m
+CONFIG_MYRI10GE_DCA=y
+CONFIG_N2=m
+CONFIG_NAMESPACES=y
+CONFIG_NATIONAL_PHY=y
+CONFIG_NATSEMI=m
+CONFIG_NCPFS_EXTRAS=y
+CONFIG_NCPFS_IOCTL_LOCKING=y
+CONFIG_NCPFS_NFS_NS=y
+CONFIG_NCPFS_NLS=y
+CONFIG_NCPFS_OS2_NS=y
+CONFIG_NCPFS_PACKET_SIGNING=y
+# CONFIG_NCPFS_SMALLDOS is not set
+CONFIG_NCPFS_STRONG=y
+CONFIG_NCP_FS=m
+CONFIG_NDISWRAPPER=m
+CONFIG_NE2000=m
+CONFIG_NE2K_PCI=m
+CONFIG_NE2_MCA=m
+CONFIG_NE3210=m
+CONFIG_NET=y
+CONFIG_NETCONSOLE=m
+CONFIG_NETCONSOLE_DYNAMIC=y
+CONFIG_NETDEVICES=y
+CONFIG_NETDEV_1000=y
+CONFIG_NETDEV_10000=y
+CONFIG_NETFILTER=y
+CONFIG_NETFILTER_ADVANCED=y
+# CONFIG_NETFILTER_DEBUG is not set
+CONFIG_NETFILTER_NETLINK=m
+CONFIG_NETFILTER_NETLINK_LOG=m
+CONFIG_NETFILTER_NETLINK_QUEUE=m
+CONFIG_NETFILTER_TPROXY=m
+CONFIG_NETFILTER_XTABLES=m
+CONFIG_NETFILTER_XT_MATCH_CLUSTER=m
+CONFIG_NETFILTER_XT_MATCH_COMMENT=m
+CONFIG_NETFILTER_XT_MATCH_CONNBYTES=m
+CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=m
+CONFIG_NETFILTER_XT_MATCH_CONNMARK=m
+CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
+CONFIG_NETFILTER_XT_MATCH_DCCP=m
+CONFIG_NETFILTER_XT_MATCH_DSCP=m
+CONFIG_NETFILTER_XT_MATCH_ESP=m
+CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=m
+CONFIG_NETFILTER_XT_MATCH_HELPER=m
+CONFIG_NETFILTER_XT_MATCH_HL=m
+CONFIG_NETFILTER_XT_MATCH_IPRANGE=m
+CONFIG_NETFILTER_XT_MATCH_LENGTH=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_MAC=m
+CONFIG_NETFILTER_XT_MATCH_MARK=m
+CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
+CONFIG_NETFILTER_XT_MATCH_OSF=m
+CONFIG_NETFILTER_XT_MATCH_OWNER=m
+CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
+CONFIG_NETFILTER_XT_MATCH_PKTTYPE=m
+CONFIG_NETFILTER_XT_MATCH_POLICY=m
+CONFIG_NETFILTER_XT_MATCH_QUOTA=m
+CONFIG_NETFILTER_XT_MATCH_RATEEST=m
+CONFIG_NETFILTER_XT_MATCH_REALM=m
+CONFIG_NETFILTER_XT_MATCH_RECENT=m
+# CONFIG_NETFILTER_XT_MATCH_RECENT_PROC_COMPAT is not set
+CONFIG_NETFILTER_XT_MATCH_SCTP=m
+CONFIG_NETFILTER_XT_MATCH_SOCKET=m
+CONFIG_NETFILTER_XT_MATCH_STATE=m
+CONFIG_NETFILTER_XT_MATCH_STATISTIC=m
+CONFIG_NETFILTER_XT_MATCH_STRING=m
+CONFIG_NETFILTER_XT_MATCH_TCPMSS=m
+CONFIG_NETFILTER_XT_MATCH_TIME=m
+CONFIG_NETFILTER_XT_MATCH_U32=m
+CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
+CONFIG_NETFILTER_XT_TARGET_CONNMARK=m
+CONFIG_NETFILTER_XT_TARGET_CONNSECMARK=m
+CONFIG_NETFILTER_XT_TARGET_DSCP=m
+CONFIG_NETFILTER_XT_TARGET_HL=m
+CONFIG_NETFILTER_XT_TARGET_LED=m
+CONFIG_NETFILTER_XT_TARGET_MARK=m
+CONFIG_NETFILTER_XT_TARGET_NFLOG=m
+CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m
+CONFIG_NETFILTER_XT_TARGET_NOTRACK=m
+CONFIG_NETFILTER_XT_TARGET_RATEEST=m
+CONFIG_NETFILTER_XT_TARGET_SECMARK=m
+CONFIG_NETFILTER_XT_TARGET_TCPMSS=m
+# CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP is not set
+CONFIG_NETFILTER_XT_TARGET_TPROXY=m
+CONFIG_NETFILTER_XT_TARGET_TRACE=m
+CONFIG_NETLABEL=y
+CONFIG_NETPOLL=y
+# CONFIG_NETPOLL_TRAP is not set
+CONFIG_NETROM=m
+CONFIG_NETWORK_FILESYSTEMS=y
+CONFIG_NETWORK_SECMARK=y
+CONFIG_NETXEN_NIC=m
+CONFIG_NET_9P=m
+# CONFIG_NET_9P_DEBUG is not set
+CONFIG_NET_9P_RDMA=m
+CONFIG_NET_9P_VIRTIO=m
+CONFIG_NET_ACT_GACT=m
+CONFIG_NET_ACT_IPT=m
+CONFIG_NET_ACT_MIRRED=m
+CONFIG_NET_ACT_NAT=m
+CONFIG_NET_ACT_PEDIT=m
+CONFIG_NET_ACT_POLICE=m
+CONFIG_NET_ACT_SIMP=m
+CONFIG_NET_ACT_SKBEDIT=m
+CONFIG_NET_CLS=y
+CONFIG_NET_CLS_ACT=y
+CONFIG_NET_CLS_BASIC=m
+CONFIG_NET_CLS_CGROUP=y
+CONFIG_NET_CLS_FLOW=m
+CONFIG_NET_CLS_FW=m
+# CONFIG_NET_CLS_IND is not set
+CONFIG_NET_CLS_ROUTE=y
+CONFIG_NET_CLS_ROUTE4=m
+CONFIG_NET_CLS_RSVP=m
+CONFIG_NET_CLS_RSVP6=m
+CONFIG_NET_CLS_TCINDEX=m
+CONFIG_NET_CLS_U32=m
+CONFIG_NET_DCCPPROBE=m
+CONFIG_NET_DMA=y
+# CONFIG_NET_DROP_MONITOR is not set
+CONFIG_NET_DSA=y
+CONFIG_NET_DSA_MV88E6060=y
+CONFIG_NET_DSA_MV88E6123_61_65=y
+CONFIG_NET_DSA_MV88E6131=y
+CONFIG_NET_DSA_MV88E6XXX=y
+CONFIG_NET_DSA_MV88E6XXX_NEED_PPU=y
+CONFIG_NET_DSA_TAG_DSA=y
+CONFIG_NET_DSA_TAG_EDSA=y
+CONFIG_NET_DSA_TAG_TRAILER=y
+CONFIG_NET_EMATCH=y
+CONFIG_NET_EMATCH_CMP=m
+CONFIG_NET_EMATCH_META=m
+CONFIG_NET_EMATCH_NBYTE=m
+CONFIG_NET_EMATCH_STACK=32
+CONFIG_NET_EMATCH_TEXT=m
+CONFIG_NET_EMATCH_U32=m
+CONFIG_NET_ETHERNET=y
+CONFIG_NET_FC=y
+CONFIG_NET_IPGRE=m
+CONFIG_NET_IPGRE_BROADCAST=y
+CONFIG_NET_IPIP=m
+CONFIG_NET_ISA=y
+CONFIG_NET_KEY=m
+# CONFIG_NET_KEY_MIGRATE is not set
+CONFIG_NET_NS=y
+CONFIG_NET_PCI=y
+CONFIG_NET_PCMCIA=y
+CONFIG_NET_PKTGEN=m
+CONFIG_NET_POCKET=y
+CONFIG_NET_POLL_CONTROLLER=y
+CONFIG_NET_SB1000=m
+CONFIG_NET_SCHED=y
+CONFIG_NET_SCH_ATM=m
+CONFIG_NET_SCH_CBQ=m
+CONFIG_NET_SCH_DRR=m
+CONFIG_NET_SCH_DSMARK=m
+CONFIG_NET_SCH_FIFO=y
+CONFIG_NET_SCH_GRED=m
+CONFIG_NET_SCH_HFSC=m
+CONFIG_NET_SCH_HTB=m
+CONFIG_NET_SCH_INGRESS=m
+CONFIG_NET_SCH_MULTIQ=m
+CONFIG_NET_SCH_NETEM=m
+CONFIG_NET_SCH_PRIO=m
+CONFIG_NET_SCH_RED=m
+CONFIG_NET_SCH_SFQ=m
+CONFIG_NET_SCH_TBF=m
+CONFIG_NET_SCH_TEQL=m
+CONFIG_NET_TCPPROBE=m
+CONFIG_NET_TULIP=y
+CONFIG_NET_VENDOR_3COM=y
+CONFIG_NET_VENDOR_RACAL=y
+CONFIG_NET_VENDOR_SMC=y
+CONFIG_NEW_LEDS=y
+CONFIG_NFSD=m
+CONFIG_NFSD_V2_ACL=y
+CONFIG_NFSD_V3=y
+CONFIG_NFSD_V3_ACL=y
+CONFIG_NFSD_V4=y
+CONFIG_NFS_ACL_SUPPORT=m
+CONFIG_NFS_COMMON=y
+CONFIG_NFS_FS=m
+# CONFIG_NFS_FSCACHE is not set
+CONFIG_NFS_V3=y
+CONFIG_NFS_V3_ACL=y
+CONFIG_NFS_V4=y
+# CONFIG_NFS_V4_1 is not set
+CONFIG_NFTL=m
+CONFIG_NFTL_RW=y
+CONFIG_NF_CONNTRACK=m
+CONFIG_NF_CONNTRACK_AMANDA=m
+CONFIG_NF_CONNTRACK_EVENTS=y
+CONFIG_NF_CONNTRACK_FTP=m
+CONFIG_NF_CONNTRACK_H323=m
+CONFIG_NF_CONNTRACK_IPV4=m
+CONFIG_NF_CONNTRACK_IPV6=m
+CONFIG_NF_CONNTRACK_IRC=m
+CONFIG_NF_CONNTRACK_MARK=y
+CONFIG_NF_CONNTRACK_NETBIOS_NS=m
+CONFIG_NF_CONNTRACK_PPTP=m
+CONFIG_NF_CONNTRACK_PROC_COMPAT=y
+CONFIG_NF_CONNTRACK_SANE=m
+CONFIG_NF_CONNTRACK_SECMARK=y
+CONFIG_NF_CONNTRACK_SIP=m
+CONFIG_NF_CONNTRACK_TFTP=m
+CONFIG_NF_CT_ACCT=y
+CONFIG_NF_CT_NETLINK=m
+CONFIG_NF_CT_PROTO_DCCP=m
+CONFIG_NF_CT_PROTO_GRE=m
+CONFIG_NF_CT_PROTO_SCTP=m
+CONFIG_NF_CT_PROTO_UDPLITE=m
+CONFIG_NF_DEFRAG_IPV4=m
+CONFIG_NF_NAT=m
+CONFIG_NF_NAT_AMANDA=m
+CONFIG_NF_NAT_FTP=m
+CONFIG_NF_NAT_H323=m
+CONFIG_NF_NAT_IRC=m
+CONFIG_NF_NAT_NEEDED=y
+CONFIG_NF_NAT_PPTP=m
+CONFIG_NF_NAT_PROTO_DCCP=m
+CONFIG_NF_NAT_PROTO_GRE=m
+CONFIG_NF_NAT_PROTO_SCTP=m
+CONFIG_NF_NAT_PROTO_UDPLITE=m
+CONFIG_NF_NAT_SIP=m
+CONFIG_NF_NAT_SNMP_BASIC=m
+CONFIG_NF_NAT_TFTP=m
+CONFIG_NI52=m
+CONFIG_NI65=m
+CONFIG_NILFS2_FS=m
+CONFIG_NIU=m
+CONFIG_NLATTR=y
+CONFIG_NLS=y
+CONFIG_NLS_ASCII=m
+CONFIG_NLS_CODEPAGE_1250=m
+CONFIG_NLS_CODEPAGE_1251=m
+CONFIG_NLS_CODEPAGE_437=m
+CONFIG_NLS_CODEPAGE_737=m
+CONFIG_NLS_CODEPAGE_775=m
+CONFIG_NLS_CODEPAGE_850=m
+CONFIG_NLS_CODEPAGE_852=m
+CONFIG_NLS_CODEPAGE_855=m
+CONFIG_NLS_CODEPAGE_857=m
+CONFIG_NLS_CODEPAGE_860=m
+CONFIG_NLS_CODEPAGE_861=m
+CONFIG_NLS_CODEPAGE_862=m
+CONFIG_NLS_CODEPAGE_863=m
+CONFIG_NLS_CODEPAGE_864=m
+CONFIG_NLS_CODEPAGE_865=m
+CONFIG_NLS_CODEPAGE_866=m
+CONFIG_NLS_CODEPAGE_869=m
+CONFIG_NLS_CODEPAGE_874=m
+CONFIG_NLS_CODEPAGE_932=m
+CONFIG_NLS_CODEPAGE_936=m
+CONFIG_NLS_CODEPAGE_949=m
+CONFIG_NLS_CODEPAGE_950=m
+CONFIG_NLS_DEFAULT="cp437"
+CONFIG_NLS_ISO8859_1=m
+CONFIG_NLS_ISO8859_13=m
+CONFIG_NLS_ISO8859_14=m
+CONFIG_NLS_ISO8859_15=m
+CONFIG_NLS_ISO8859_2=m
+CONFIG_NLS_ISO8859_3=m
+CONFIG_NLS_ISO8859_4=m
+CONFIG_NLS_ISO8859_5=m
+CONFIG_NLS_ISO8859_6=m
+CONFIG_NLS_ISO8859_7=m
+CONFIG_NLS_ISO8859_8=m
+CONFIG_NLS_ISO8859_9=m
+CONFIG_NLS_KOI8_R=m
+CONFIG_NLS_KOI8_U=m
+CONFIG_NLS_UTF8=m
+# CONFIG_NOHIGHMEM is not set
+CONFIG_NOP_TRACER=y
+CONFIG_NOP_USB_XCEIV=m
+CONFIG_NORTEL_HERMES=m
+CONFIG_NOZOMI=m
+CONFIG_NO_HZ=y
+CONFIG_NR_CPUS=8
+CONFIG_NS83820=m
+CONFIG_NSC_FIR=m
+CONFIG_NSC_GPIO=m
+# CONFIG_NTFS_DEBUG is not set
+CONFIG_NTFS_FS=m
+# CONFIG_NTFS_RW is not set
+CONFIG_NVRAM=m
+CONFIG_N_HDLC=m
+# CONFIG_OCFS2_DEBUG_FS is not set
+CONFIG_OCFS2_DEBUG_MASKLOG=y
+CONFIG_OCFS2_FS=m
+CONFIG_OCFS2_FS_O2CB=m
+CONFIG_OCFS2_FS_POSIX_ACL=y
+CONFIG_OCFS2_FS_STATS=y
+CONFIG_OCFS2_FS_USERSPACE_CLUSTER=m
+CONFIG_OLD_BELKIN_DONGLE=m
+CONFIG_OLPC=y
+CONFIG_OMFS_FS=m
+CONFIG_OPROFILE=m
+CONFIG_OPROFILE_IBS=y
+CONFIG_OPTIMIZE_INLINING=y
+CONFIG_OSF_PARTITION=y
+# CONFIG_OTUS is not set
+CONFIG_OUTPUT_FORMAT="elf32-i386"
+CONFIG_P54_COMMON=m
+CONFIG_P54_LEDS=y
+CONFIG_P54_PCI=m
+CONFIG_P54_SPI=m
+CONFIG_P54_USB=m
+CONFIG_PACKARDBELL_E5=m
+CONFIG_PACKET=y
+CONFIG_PACKET_MMAP=y
+CONFIG_PAGEFLAGS_EXTENDED=y
+CONFIG_PAGE_OFFSET=0xC0000000
+CONFIG_PANASONIC_LAPTOP=m
+CONFIG_PANEL=m
+# CONFIG_PANEL_CHANGE_MESSAGE is not set
+CONFIG_PANEL_PARPORT=0
+CONFIG_PANEL_PROFILE=5
+CONFIG_PANTHERLORD_FF=y
+CONFIG_PARAVIRT=y
+CONFIG_PARAVIRT_CLOCK=y
+# CONFIG_PARAVIRT_DEBUG is not set
+CONFIG_PARAVIRT_GUEST=y
+CONFIG_PARAVIRT_SPINLOCKS=y
+CONFIG_PARIDE=m
+CONFIG_PARIDE_ATEN=m
+CONFIG_PARIDE_BPCK=m
+CONFIG_PARIDE_BPCK6=m
+CONFIG_PARIDE_COMM=m
+CONFIG_PARIDE_DSTR=m
+CONFIG_PARIDE_EPAT=m
+# CONFIG_PARIDE_EPATC8 is not set
+CONFIG_PARIDE_EPIA=m
+CONFIG_PARIDE_FIT2=m
+CONFIG_PARIDE_FIT3=m
+CONFIG_PARIDE_FRIQ=m
+CONFIG_PARIDE_FRPW=m
+CONFIG_PARIDE_KBIC=m
+CONFIG_PARIDE_KTTI=m
+CONFIG_PARIDE_ON20=m
+CONFIG_PARIDE_ON26=m
+CONFIG_PARIDE_PCD=m
+CONFIG_PARIDE_PD=m
+CONFIG_PARIDE_PF=m
+CONFIG_PARIDE_PG=m
+CONFIG_PARIDE_PT=m
+CONFIG_PARPORT=m
+CONFIG_PARPORT_1284=y
+CONFIG_PARPORT_AX88796=m
+# CONFIG_PARPORT_GSC is not set
+CONFIG_PARPORT_NOT_PC=y
+CONFIG_PARPORT_PC=m
+CONFIG_PARPORT_PC_FIFO=y
+CONFIG_PARPORT_PC_PCMCIA=m
+# CONFIG_PARPORT_PC_SUPERIO is not set
+CONFIG_PARPORT_SERIAL=m
+CONFIG_PARTITION_ADVANCED=y
+CONFIG_PATA_ACPI=y
+CONFIG_PATA_ALI=y
+CONFIG_PATA_AMD=y
+CONFIG_PATA_ARTOP=y
+CONFIG_PATA_ATIIXP=y
+CONFIG_PATA_CMD640_PCI=y
+CONFIG_PATA_CMD64X=y
+CONFIG_PATA_CS5520=y
+CONFIG_PATA_CS5530=y
+CONFIG_PATA_CS5535=m
+CONFIG_PATA_CS5536=y
+CONFIG_PATA_CYPRESS=m
+CONFIG_PATA_EFAR=y
+CONFIG_PATA_HPT366=y
+CONFIG_PATA_HPT37X=m
+CONFIG_PATA_HPT3X2N=y
+CONFIG_PATA_HPT3X3=y
+# CONFIG_PATA_HPT3X3_DMA is not set
+CONFIG_PATA_ISAPNP=m
+CONFIG_PATA_IT8213=m
+CONFIG_PATA_IT821X=y
+CONFIG_PATA_JMICRON=y
+CONFIG_PATA_LEGACY=m
+CONFIG_PATA_MARVELL=y
+CONFIG_PATA_MPIIX=y
+CONFIG_PATA_NETCELL=y
+CONFIG_PATA_NINJA32=m
+CONFIG_PATA_NS87410=y
+CONFIG_PATA_NS87415=y
+CONFIG_PATA_OLDPIIX=m
+CONFIG_PATA_OPTI=m
+CONFIG_PATA_OPTIDMA=m
+CONFIG_PATA_PCMCIA=m
+CONFIG_PATA_PDC2027X=y
+CONFIG_PATA_PDC_OLD=y
+CONFIG_PATA_QDI=y
+CONFIG_PATA_RADISYS=m
+CONFIG_PATA_RZ1000=y
+CONFIG_PATA_SC1200=y
+CONFIG_PATA_SCH=y
+CONFIG_PATA_SERVERWORKS=y
+CONFIG_PATA_SIL680=y
+CONFIG_PATA_SIS=y
+CONFIG_PATA_TRIFLEX=y
+CONFIG_PATA_VIA=y
+CONFIG_PATA_WINBOND=y
+CONFIG_PATA_WINBOND_VLB=m
+# CONFIG_PC300TOO is not set
+CONFIG_PC8736x_GPIO=m
+CONFIG_PC87413_WDT=m
+CONFIG_PCCARD=m
+CONFIG_PCCARD_NONSTATIC=m
+CONFIG_PCF50633_ADC=m
+CONFIG_PCF50633_GPIO=m
+CONFIG_PCI=y
+CONFIG_PCI200SYN=m
+CONFIG_PCIEAER=y
+# CONFIG_PCIEAER_INJECT is not set
+# CONFIG_PCIEASPM is not set
+CONFIG_PCIEPORTBUS=y
+# CONFIG_PCIE_ECRC is not set
+CONFIG_PCIPCWATCHDOG=m
+CONFIG_PCI_ATMEL=m
+CONFIG_PCI_BIOS=y
+# CONFIG_PCI_DEBUG is not set
+CONFIG_PCI_DIRECT=y
+CONFIG_PCI_DOMAINS=y
+CONFIG_PCI_GOANY=y
+# CONFIG_PCI_GOBIOS is not set
+# CONFIG_PCI_GODIRECT is not set
+# CONFIG_PCI_GOMMCONFIG is not set
+# CONFIG_PCI_GOOLPC is not set
+CONFIG_PCI_HERMES=m
+CONFIG_PCI_IOV=y
+CONFIG_PCI_LEGACY=y
+CONFIG_PCI_MMCONFIG=y
+CONFIG_PCI_MSI=y
+CONFIG_PCI_OLPC=y
+CONFIG_PCI_QUIRKS=y
+CONFIG_PCI_STUB=m
+CONFIG_PCMCIA=m
+CONFIG_PCMCIA_3C574=m
+CONFIG_PCMCIA_3C589=m
+CONFIG_PCMCIA_AHA152X=m
+CONFIG_PCMCIA_ATMEL=m
+CONFIG_PCMCIA_AXNET=m
+# CONFIG_PCMCIA_DEBUG is not set
+CONFIG_PCMCIA_FDOMAIN=m
+CONFIG_PCMCIA_FMVJ18X=m
+CONFIG_PCMCIA_HERMES=m
+CONFIG_PCMCIA_IBMTR=m
+CONFIG_PCMCIA_IOCTL=y
+CONFIG_PCMCIA_LOAD_CIS=y
+CONFIG_PCMCIA_NETWAVE=m
+CONFIG_PCMCIA_NINJA_SCSI=m
+CONFIG_PCMCIA_NMCLAN=m
+CONFIG_PCMCIA_PCNET=m
+CONFIG_PCMCIA_PROBE=y
+CONFIG_PCMCIA_QLOGIC=m
+CONFIG_PCMCIA_RAYCS=m
+CONFIG_PCMCIA_SMC91C92=m
+CONFIG_PCMCIA_SPECTRUM=m
+CONFIG_PCMCIA_SYM53C500=m
+CONFIG_PCMCIA_WAVELAN=m
+CONFIG_PCMCIA_WL3501=m
+CONFIG_PCMCIA_XIRC2PS=m
+CONFIG_PCMCIA_XIRCOM=m
+CONFIG_PCNET32=m
+CONFIG_PCSPKR_PLATFORM=y
+CONFIG_PCWATCHDOG=m
+CONFIG_PD6729=m
+CONFIG_PDA_POWER=m
+CONFIG_PDC_ADMA=y
+CONFIG_PERF_COUNTERS=y
+CONFIG_PHANTOM=m
+CONFIG_PHONE=m
+CONFIG_PHONET=m
+CONFIG_PHONE_IXJ=m
+CONFIG_PHONE_IXJ_PCMCIA=m
+CONFIG_PHYLIB=y
+CONFIG_PHYSICAL_ALIGN=0x100000
+CONFIG_PHYSICAL_START=0x100000
+# CONFIG_PHYS_ADDR_T_64BIT is not set
+CONFIG_PID_NS=y
+CONFIG_PLAN9AUTH=m
+CONFIG_PLIP=m
+CONFIG_PLX_HERMES=m
+CONFIG_PM=y
+CONFIG_PMIC_DA903X=y
+CONFIG_PM_DEBUG=y
+CONFIG_PM_DISABLE_CONSOLE=y
+CONFIG_PM_SLEEP=y
+CONFIG_PM_SLEEP_SMP=y
+CONFIG_PM_STD_PARTITION=""
+CONFIG_PM_TEST_SUSPEND=y
+CONFIG_PM_TRACE=y
+CONFIG_PM_TRACE_RTC=y
+# CONFIG_PM_VERBOSE is not set
+CONFIG_PNP=y
+CONFIG_PNPACPI=y
+CONFIG_PNPBIOS=y
+CONFIG_PNPBIOS_PROC_FS=y
+CONFIG_PNP_DEBUG_MESSAGES=y
+CONFIG_POCH=m
+CONFIG_POHMELFS=m
+CONFIG_POHMELFS_CRYPTO=y
+# CONFIG_POHMELFS_DEBUG is not set
+CONFIG_POSIX_MQUEUE=y
+CONFIG_POSIX_MQUEUE_SYSCTL=y
+CONFIG_POWER_SUPPLY=y
+# CONFIG_POWER_SUPPLY_DEBUG is not set
+CONFIG_PPDEV=m
+CONFIG_PPP=y
+CONFIG_PPPOATM=m
+CONFIG_PPPOE=m
+CONFIG_PPPOL2TP=m
+CONFIG_PPP_ASYNC=m
+CONFIG_PPP_BSDCOMP=m
+CONFIG_PPP_DEFLATE=m
+CONFIG_PPP_FILTER=y
+CONFIG_PPP_MPPE=m
+CONFIG_PPP_MULTILINK=y
+CONFIG_PPP_SYNC_TTY=m
+CONFIG_PPS=m
+# CONFIG_PPS_DEBUG is not set
+CONFIG_PREEMPT=y
+# CONFIG_PREEMPT_DESKTOP is not set
+CONFIG_PREEMPT_HARDIRQS=y
+# CONFIG_PREEMPT_NONE is not set
+CONFIG_PREEMPT_NOTIFIERS=y
+CONFIG_PREEMPT_RCU=y
+# CONFIG_PREEMPT_RCU_TRACE is not set
+CONFIG_PREEMPT_RT=y
+CONFIG_PREEMPT_SOFTIRQS=y
+# CONFIG_PREEMPT_VOLUNTARY is not set
+CONFIG_PREVENT_FIRMWARE_BUILD=y
+CONFIG_PRINTER=m
+CONFIG_PRINTK=y
+CONFIG_PRINTK_TIME=y
+# CONFIG_PRINT_QUOTA_WARNING is not set
+CONFIG_PRISM2_USB=m
+CONFIG_PRISM54=m
+CONFIG_PROC_EVENTS=y
+CONFIG_PROC_FS=y
+CONFIG_PROC_KCORE=y
+CONFIG_PROC_PAGE_MONITOR=y
+CONFIG_PROC_PID_CPUSET=y
+CONFIG_PROC_SYSCTL=y
+CONFIG_PROC_VMCORE=y
+CONFIG_PROFILE_NMI=y
+CONFIG_PROFILING=y
+CONFIG_PROTEON=m
+# CONFIG_PROVE_LOCKING is not set
+# CONFIG_PROVIDE_OHCI1394_DMA_INIT is not set
+# CONFIG_PSS_HAVE_BOOT is not set
+CONFIG_PSS_MIXER=y
+CONFIG_QFMT_V1=m
+CONFIG_QFMT_V2=m
+CONFIG_QLA3XXX=m
+CONFIG_QLGE=m
+CONFIG_QNX4FS_FS=m
+CONFIG_QSEMI_PHY=y
+CONFIG_QUOTA=y
+CONFIG_QUOTACTL=y
+CONFIG_QUOTA_NETLINK_INTERFACE=y
+CONFIG_QUOTA_TREE=m
+CONFIG_R3964=m
+# CONFIG_R6040 is not set
+CONFIG_R8169=m
+CONFIG_R8169_VLAN=y
+CONFIG_RADIO_ADAPTERS=y
+CONFIG_RADIO_AZTECH=m
+CONFIG_RADIO_CADET=m
+CONFIG_RADIO_GEMTEK=m
+CONFIG_RADIO_GEMTEK_PCI=m
+CONFIG_RADIO_MAESTRO=m
+CONFIG_RADIO_MAXIRADIO=m
+CONFIG_RADIO_RTRACK=m
+CONFIG_RADIO_RTRACK2=m
+CONFIG_RADIO_SF16FMI=m
+CONFIG_RADIO_SF16FMR2=m
+CONFIG_RADIO_TEA5764=m
+CONFIG_RADIO_TERRATEC=m
+CONFIG_RADIO_TRUST=m
+CONFIG_RADIO_TYPHOON=m
+CONFIG_RADIO_TYPHOON_PROC_FS=y
+CONFIG_RADIO_ZOLTRIX=m
+CONFIG_RAID_ATTRS=m
+CONFIG_RAW_DRIVER=m
+# CONFIG_RCU_TORTURE_TEST is not set
+# CONFIG_RCU_TRACE is not set
+CONFIG_RDC_17F3101X=m
+CONFIG_RDS=m
+# CONFIG_RDS_DEBUG is not set
+CONFIG_RD_BZIP2=y
+CONFIG_RD_GZIP=y
+CONFIG_RD_LZMA=y
+CONFIG_REALTEK_PHY=y
+CONFIG_REED_SOLOMON=m
+CONFIG_REED_SOLOMON_DEC16=y
+CONFIG_REGULATOR=y
+CONFIG_REGULATOR_BQ24022=m
+CONFIG_REGULATOR_DA903X=m
+CONFIG_REGULATOR_DEBUG=y
+# CONFIG_REGULATOR_FIXED_VOLTAGE is not set
+CONFIG_REGULATOR_LP3971=m
+CONFIG_REGULATOR_MAX1586=m
+CONFIG_REGULATOR_PCF50633=m
+CONFIG_REGULATOR_TWL4030=y
+CONFIG_REGULATOR_USERSPACE_CONSUMER=m
+CONFIG_REGULATOR_VIRTUAL_CONSUMER=m
+CONFIG_REGULATOR_WM8350=m
+CONFIG_REGULATOR_WM8400=m
+# CONFIG_REISERFS_CHECK is not set
+CONFIG_REISERFS_FS=m
+CONFIG_REISERFS_FS_POSIX_ACL=y
+CONFIG_REISERFS_FS_SECURITY=y
+CONFIG_REISERFS_FS_XATTR=y
+# CONFIG_REISERFS_PROC_INFO is not set
+CONFIG_RELAY=y
+CONFIG_RELOCATABLE=y
+CONFIG_RESOURCE_COUNTERS=y
+CONFIG_RFD_FTL=m
+CONFIG_RFKILL=y
+CONFIG_RFKILL_INPUT=y
+CONFIG_RFKILL_LEDS=y
+CONFIG_RING_BUFFER=y
+CONFIG_RIO=m
+# CONFIG_RIO_OLDPCI is not set
+CONFIG_RISCOM8=m
+CONFIG_ROADRUNNER=m
+# CONFIG_ROADRUNNER_LARGE_RINGS is not set
+CONFIG_ROCKETPORT=m
+CONFIG_ROMFS_BACKED_BY_BLOCK=y
+# CONFIG_ROMFS_BACKED_BY_BOTH is not set
+# CONFIG_ROMFS_BACKED_BY_MTD is not set
+CONFIG_ROMFS_FS=m
+CONFIG_ROMFS_ON_BLOCK=y
+CONFIG_ROSE=m
+CONFIG_RPCSEC_GSS_KRB5=m
+CONFIG_RPCSEC_GSS_SPKM3=m
+CONFIG_RT2400PCI=m
+CONFIG_RT2500PCI=m
+CONFIG_RT2500USB=m
+CONFIG_RT2800USB=m
+CONFIG_RT2860=m
+CONFIG_RT2870=m
+CONFIG_RT2X00=m
+# CONFIG_RT2X00_DEBUG is not set
+CONFIG_RT2X00_LIB=m
+CONFIG_RT2X00_LIB_CRYPTO=y
+# CONFIG_RT2X00_LIB_DEBUGFS is not set
+CONFIG_RT2X00_LIB_FIRMWARE=y
+CONFIG_RT2X00_LIB_HT=y
+CONFIG_RT2X00_LIB_LEDS=y
+CONFIG_RT2X00_LIB_PCI=m
+CONFIG_RT2X00_LIB_RFKILL=y
+CONFIG_RT2X00_LIB_USB=m
+CONFIG_RT3070=m
+CONFIG_RT61PCI=m
+CONFIG_RT73USB=m
+CONFIG_RTC_CLASS=y
+# CONFIG_RTC_DEBUG is not set
+CONFIG_RTC_DRV_BQ4802=m
+CONFIG_RTC_DRV_CMOS=y
+CONFIG_RTC_DRV_DS1286=m
+CONFIG_RTC_DRV_DS1305=m
+CONFIG_RTC_DRV_DS1307=m
+CONFIG_RTC_DRV_DS1374=m
+CONFIG_RTC_DRV_DS1390=m
+CONFIG_RTC_DRV_DS1511=m
+CONFIG_RTC_DRV_DS1553=m
+CONFIG_RTC_DRV_DS1672=m
+CONFIG_RTC_DRV_DS1742=m
+CONFIG_RTC_DRV_DS3234=m
+CONFIG_RTC_DRV_FM3130=m
+CONFIG_RTC_DRV_ISL1208=m
+CONFIG_RTC_DRV_M41T80=m
+CONFIG_RTC_DRV_M41T80_WDT=y
+CONFIG_RTC_DRV_M41T94=m
+CONFIG_RTC_DRV_M48T35=m
+CONFIG_RTC_DRV_M48T59=m
+CONFIG_RTC_DRV_M48T86=m
+CONFIG_RTC_DRV_MAX6900=m
+CONFIG_RTC_DRV_MAX6902=m
+CONFIG_RTC_DRV_PCF50633=m
+CONFIG_RTC_DRV_PCF8563=m
+CONFIG_RTC_DRV_PCF8583=m
+CONFIG_RTC_DRV_R9701=m
+CONFIG_RTC_DRV_RS5C348=m
+CONFIG_RTC_DRV_RS5C372=m
+CONFIG_RTC_DRV_RX8025=m
+CONFIG_RTC_DRV_RX8581=m
+CONFIG_RTC_DRV_S35390A=m
+CONFIG_RTC_DRV_STK17TA8=m
+CONFIG_RTC_DRV_TEST=m
+CONFIG_RTC_DRV_TWL4030=m
+CONFIG_RTC_DRV_V3020=m
+CONFIG_RTC_DRV_WM8350=m
+CONFIG_RTC_DRV_X1205=m
+CONFIG_RTC_HCTOSYS=y
+CONFIG_RTC_HCTOSYS_DEVICE="rtc0"
+CONFIG_RTC_INTF_DEV=y
+CONFIG_RTC_INTF_DEV_UIE_EMUL=y
+CONFIG_RTC_INTF_PROC=y
+CONFIG_RTC_INTF_SYSFS=y
+CONFIG_RTC_LIB=y
+CONFIG_RTL8180=m
+CONFIG_RTL8187=m
+CONFIG_RTL8187SE=m
+CONFIG_RTL8187_LEDS=y
+CONFIG_RTL8192SU=m
+CONFIG_RT_GROUP_SCHED=y
+CONFIG_RT_MUTEXES=y
+# CONFIG_RT_MUTEX_TESTER is not set
+CONFIG_RWSEM_GENERIC_SPINLOCK=y
+CONFIG_RXKAD=m
+CONFIG_S2IO=m
+# CONFIG_SAMPLES is not set
+CONFIG_SATA_AHCI=y
+CONFIG_SATA_INIC162X=y
+CONFIG_SATA_MV=m
+CONFIG_SATA_NV=y
+CONFIG_SATA_PMP=y
+CONFIG_SATA_PROMISE=y
+CONFIG_SATA_QSTOR=y
+CONFIG_SATA_SIL=y
+CONFIG_SATA_SIL24=y
+CONFIG_SATA_SIS=y
+CONFIG_SATA_SVW=y
+CONFIG_SATA_SX4=m
+CONFIG_SATA_ULI=y
+CONFIG_SATA_VIA=m
+CONFIG_SATA_VITESSE=y
+CONFIG_SBC7240_WDT=m
+CONFIG_SBC8360_WDT=m
+CONFIG_SBC_EPX_C3_WATCHDOG=m
+CONFIG_SBNI=m
+# CONFIG_SBNI_MULTILINE is not set
+CONFIG_SC1200_WDT=m
+CONFIG_SC520_WDT=m
+CONFIG_SC6600=y
+CONFIG_SC6600_CDROM=4
+CONFIG_SC6600_CDROMBASE=0
+CONFIG_SC6600_JOY=y
+CONFIG_SC92031=m
+CONFIG_SCC=m
+# CONFIG_SCC_DELAY is not set
+# CONFIG_SCC_TRXECHO is not set
+CONFIG_SCHEDSTATS=y
+CONFIG_SCHED_DEBUG=y
+CONFIG_SCHED_HRTICK=y
+CONFIG_SCHED_MC=y
+CONFIG_SCHED_OMIT_FRAME_POINTER=y
+CONFIG_SCHED_SMT=y
+CONFIG_SCSI=y
+CONFIG_SCSI_3W_9XXX=m
+CONFIG_SCSI_7000FASST=m
+CONFIG_SCSI_AACRAID=m
+CONFIG_SCSI_ACARD=m
+CONFIG_SCSI_ADVANSYS=m
+CONFIG_SCSI_AHA152X=m
+CONFIG_SCSI_AHA1542=m
+CONFIG_SCSI_AHA1740=m
+CONFIG_SCSI_AIC79XX=m
+CONFIG_SCSI_AIC7XXX=m
+# CONFIG_SCSI_AIC7XXX_OLD is not set
+CONFIG_SCSI_AIC94XX=m
+CONFIG_SCSI_ARCMSR=m
+CONFIG_SCSI_ARCMSR_AER=y
+CONFIG_SCSI_BNX2_ISCSI=m
+CONFIG_SCSI_BUSLOGIC=m
+CONFIG_SCSI_CONSTANTS=y
+CONFIG_SCSI_CXGB3_ISCSI=m
+CONFIG_SCSI_DC390T=m
+CONFIG_SCSI_DC395x=m
+CONFIG_SCSI_DEBUG=m
+CONFIG_SCSI_DH=y
+CONFIG_SCSI_DH_ALUA=m
+CONFIG_SCSI_DH_EMC=m
+CONFIG_SCSI_DH_HP_SW=m
+CONFIG_SCSI_DH_RDAC=m
+CONFIG_SCSI_DMA=y
+CONFIG_SCSI_DMX3191D=m
+CONFIG_SCSI_DPT_I2O=m
+CONFIG_SCSI_DTC3280=m
+CONFIG_SCSI_EATA=m
+CONFIG_SCSI_EATA_LINKED_COMMANDS=y
+CONFIG_SCSI_EATA_MAX_TAGS=16
+CONFIG_SCSI_EATA_TAGGED_QUEUE=y
+CONFIG_SCSI_ENCLOSURE=m
+CONFIG_SCSI_FC_ATTRS=m
+CONFIG_SCSI_FC_TGT_ATTRS=y
+CONFIG_SCSI_FD_MCS=m
+# CONFIG_SCSI_FLASHPOINT is not set
+CONFIG_SCSI_FUTURE_DOMAIN=m
+CONFIG_SCSI_GDTH=m
+CONFIG_SCSI_GENERIC_NCR5380=m
+CONFIG_SCSI_GENERIC_NCR5380_MMIO=m
+CONFIG_SCSI_GENERIC_NCR53C400=y
+CONFIG_SCSI_HPTIOP=m
+CONFIG_SCSI_IBMMCA=m
+CONFIG_SCSI_IMM=m
+CONFIG_SCSI_IN2000=m
+CONFIG_SCSI_INIA100=m
+CONFIG_SCSI_INITIO=m
+CONFIG_SCSI_IPR=m
+# CONFIG_SCSI_IPR_DUMP is not set
+# CONFIG_SCSI_IPR_TRACE is not set
+CONFIG_SCSI_IPS=m
+CONFIG_SCSI_ISCSITARGET=m
+CONFIG_SCSI_ISCSI_ATTRS=m
+# CONFIG_SCSI_IZIP_EPP16 is not set
+# CONFIG_SCSI_IZIP_SLOW_CTR is not set
+CONFIG_SCSI_LOGGING=y
+CONFIG_SCSI_LOWLEVEL=y
+CONFIG_SCSI_LOWLEVEL_PCMCIA=y
+CONFIG_SCSI_LPFC=m
+CONFIG_SCSI_LPFC_DEBUG_FS=y
+CONFIG_SCSI_MPT2SAS=m
+# CONFIG_SCSI_MPT2SAS_LOGGING is not set
+CONFIG_SCSI_MPT2SAS_MAX_SGE=128
+CONFIG_SCSI_MULTI_LUN=y
+CONFIG_SCSI_MVSAS=m
+CONFIG_SCSI_MVSAS_DEBUG=y
+CONFIG_SCSI_NCR53C406A=m
+CONFIG_SCSI_NCR53C8XX_DEFAULT_TAGS=8
+CONFIG_SCSI_NCR53C8XX_MAX_TAGS=4
+CONFIG_SCSI_NCR53C8XX_SYNC=5
+CONFIG_SCSI_NCR_D700=m
+CONFIG_SCSI_NCR_Q720=m
+CONFIG_SCSI_NETLINK=y
+CONFIG_SCSI_NSP32=m
+# CONFIG_SCSI_OSD_DEBUG is not set
+CONFIG_SCSI_OSD_DPRINT_SENSE=1
+CONFIG_SCSI_OSD_INITIATOR=m
+CONFIG_SCSI_OSD_ULD=m
+CONFIG_SCSI_PAS16=m
+CONFIG_SCSI_PPA=m
+CONFIG_SCSI_PROC_FS=y
+CONFIG_SCSI_QLA_FC=m
+CONFIG_SCSI_QLA_ISCSI=m
+CONFIG_SCSI_QLOGIC_1280=m
+CONFIG_SCSI_QLOGIC_FAS=m
+CONFIG_SCSI_SAS_ATA=y
+CONFIG_SCSI_SAS_ATTRS=m
+CONFIG_SCSI_SAS_HOST_SMP=y
+CONFIG_SCSI_SAS_LIBSAS=m
+# CONFIG_SCSI_SAS_LIBSAS_DEBUG is not set
+CONFIG_SCSI_SCAN_ASYNC=y
+CONFIG_SCSI_SIM710=m
+CONFIG_SCSI_SPI_ATTRS=m
+CONFIG_SCSI_SRP=m
+CONFIG_SCSI_SRP_ATTRS=m
+CONFIG_SCSI_SRP_TGT_ATTRS=y
+CONFIG_SCSI_STEX=m
+CONFIG_SCSI_SYM53C416=m
+CONFIG_SCSI_SYM53C8XX_2=m
+CONFIG_SCSI_SYM53C8XX_DEFAULT_TAGS=16
+CONFIG_SCSI_SYM53C8XX_DMA_ADDRESSING_MODE=1
+CONFIG_SCSI_SYM53C8XX_MAX_TAGS=64
+CONFIG_SCSI_SYM53C8XX_MMIO=y
+CONFIG_SCSI_T128=m
+CONFIG_SCSI_TGT=m
+CONFIG_SCSI_U14_34F=m
+CONFIG_SCSI_U14_34F_LINKED_COMMANDS=y
+CONFIG_SCSI_U14_34F_MAX_TAGS=8
+CONFIG_SCSI_U14_34F_TAGGED_QUEUE=y
+CONFIG_SCSI_ULTRASTOR=m
+CONFIG_SCSI_WAIT_SCAN=m
+# CONFIG_SCTP_DBG_MSG is not set
+# CONFIG_SCTP_DBG_OBJCNT is not set
+CONFIG_SCTP_HMAC_MD5=y
+# CONFIG_SCTP_HMAC_NONE is not set
+# CONFIG_SCTP_HMAC_SHA1 is not set
+CONFIG_SCx200=m
+CONFIG_SCx200HR_TIMER=m
+CONFIG_SCx200_ACB=m
+CONFIG_SCx200_GPIO=m
+CONFIG_SCx200_I2C=m
+CONFIG_SCx200_I2C_SCL=12
+CONFIG_SCx200_I2C_SDA=13
+CONFIG_SCx200_WDT=m
+CONFIG_SDIO_UART=m
+CONFIG_SDLA=m
+CONFIG_SEALEVEL_4021=m
+CONFIG_SECCOMP=y
+CONFIG_SECURITY=y
+CONFIG_SECURITYFS=y
+CONFIG_SECURITY_APPARMOR=y
+CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE=1
+# CONFIG_SECURITY_APPARMOR_DISABLE is not set
+CONFIG_SECURITY_APPARMOR_NETWORK=y
+CONFIG_SECURITY_DEFAULT="apparmor"
+CONFIG_SECURITY_FILE_CAPABILITIES=y
+CONFIG_SECURITY_NETWORK=y
+# CONFIG_SECURITY_NETWORK_XFRM is not set
+CONFIG_SECURITY_PATH=y
+# CONFIG_SECURITY_ROOTPLUG is not set
+CONFIG_SECURITY_SELINUX=y
+CONFIG_SECURITY_SELINUX_AVC_STATS=y
+CONFIG_SECURITY_SELINUX_BOOTPARAM=y
+CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE=0
+CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE=1
+CONFIG_SECURITY_SELINUX_DEVELOP=y
+CONFIG_SECURITY_SELINUX_DISABLE=y
+# CONFIG_SECURITY_SELINUX_POLICYDB_VERSION_MAX is not set
+CONFIG_SECURITY_SMACK=y
+CONFIG_SECURITY_TOMOYO=y
+CONFIG_SEEQ8005=m
+CONFIG_SELECT_MEMORY_MODEL=y
+CONFIG_SENSORS_ABITUGURU=m
+CONFIG_SENSORS_ABITUGURU3=m
+CONFIG_SENSORS_AD7414=m
+CONFIG_SENSORS_AD7418=m
+CONFIG_SENSORS_ADCXX=m
+CONFIG_SENSORS_ADM1021=m
+CONFIG_SENSORS_ADM1025=m
+CONFIG_SENSORS_ADM1026=m
+CONFIG_SENSORS_ADM1029=m
+CONFIG_SENSORS_ADM1031=m
+CONFIG_SENSORS_ADM9240=m
+CONFIG_SENSORS_ADS7828=m
+CONFIG_SENSORS_ADT7462=m
+CONFIG_SENSORS_ADT7470=m
+CONFIG_SENSORS_ADT7473=m
+CONFIG_SENSORS_ADT7475=m
+CONFIG_SENSORS_APPLESMC=m
+CONFIG_SENSORS_ASB100=m
+CONFIG_SENSORS_ATK0110=m
+CONFIG_SENSORS_ATXP1=m
+CONFIG_SENSORS_CORETEMP=m
+CONFIG_SENSORS_DME1737=m
+CONFIG_SENSORS_DS1621=m
+CONFIG_SENSORS_F71805F=m
+CONFIG_SENSORS_F71882FG=m
+CONFIG_SENSORS_F75375S=m
+CONFIG_SENSORS_FSCHER=m
+CONFIG_SENSORS_FSCHMD=m
+CONFIG_SENSORS_FSCPOS=m
+CONFIG_SENSORS_G760A=m
+CONFIG_SENSORS_GL518SM=m
+CONFIG_SENSORS_GL520SM=m
+CONFIG_SENSORS_HDAPS=m
+CONFIG_SENSORS_I5K_AMB=m
+CONFIG_SENSORS_IBMAEM=m
+CONFIG_SENSORS_IBMPEX=m
+CONFIG_SENSORS_IT87=m
+CONFIG_SENSORS_K8TEMP=m
+CONFIG_SENSORS_LIS3LV02D=m
+CONFIG_SENSORS_LM63=m
+CONFIG_SENSORS_LM70=m
+CONFIG_SENSORS_LM75=m
+CONFIG_SENSORS_LM77=m
+CONFIG_SENSORS_LM78=m
+CONFIG_SENSORS_LM80=m
+CONFIG_SENSORS_LM83=m
+CONFIG_SENSORS_LM85=m
+CONFIG_SENSORS_LM87=m
+CONFIG_SENSORS_LM90=m
+CONFIG_SENSORS_LM92=m
+CONFIG_SENSORS_LM93=m
+CONFIG_SENSORS_LM95241=m
+CONFIG_SENSORS_LTC4215=m
+CONFIG_SENSORS_LTC4245=m
+CONFIG_SENSORS_MAX1111=m
+CONFIG_SENSORS_MAX1619=m
+CONFIG_SENSORS_MAX6650=m
+CONFIG_SENSORS_PC87360=m
+CONFIG_SENSORS_PC87427=m
+CONFIG_SENSORS_PCF8591=m
+CONFIG_SENSORS_SHT15=m
+CONFIG_SENSORS_SIS5595=m
+CONFIG_SENSORS_SMSC47B397=m
+CONFIG_SENSORS_SMSC47M1=m
+CONFIG_SENSORS_SMSC47M192=m
+CONFIG_SENSORS_THMC50=m
+CONFIG_SENSORS_TMP401=m
+CONFIG_SENSORS_TSL2550=m
+CONFIG_SENSORS_VIA686A=m
+CONFIG_SENSORS_VT1211=m
+CONFIG_SENSORS_VT8231=m
+CONFIG_SENSORS_W83627EHF=m
+CONFIG_SENSORS_W83627HF=m
+CONFIG_SENSORS_W83781D=m
+CONFIG_SENSORS_W83791D=m
+CONFIG_SENSORS_W83792D=m
+CONFIG_SENSORS_W83793=m
+CONFIG_SENSORS_W83L785TS=m
+CONFIG_SENSORS_W83L786NG=m
+CONFIG_SERIAL_8250=y
+CONFIG_SERIAL_8250_ACCENT=m
+CONFIG_SERIAL_8250_BOCA=m
+CONFIG_SERIAL_8250_CONSOLE=y
+CONFIG_SERIAL_8250_CS=m
+# CONFIG_SERIAL_8250_DETECT_IRQ is not set
+CONFIG_SERIAL_8250_EXAR_ST16C554=m
+CONFIG_SERIAL_8250_EXTENDED=y
+CONFIG_SERIAL_8250_FOURPORT=m
+CONFIG_SERIAL_8250_HUB6=m
+CONFIG_SERIAL_8250_MANY_PORTS=y
+CONFIG_SERIAL_8250_MCA=m
+CONFIG_SERIAL_8250_NR_UARTS=48
+CONFIG_SERIAL_8250_PCI=y
+CONFIG_SERIAL_8250_PNP=y
+CONFIG_SERIAL_8250_RSA=y
+CONFIG_SERIAL_8250_RUNTIME_UARTS=4
+CONFIG_SERIAL_8250_SHARE_IRQ=y
+CONFIG_SERIAL_CORE=y
+CONFIG_SERIAL_CORE_CONSOLE=y
+CONFIG_SERIAL_JSM=m
+CONFIG_SERIAL_MAX3100=m
+CONFIG_SERIAL_NONSTANDARD=y
+CONFIG_SERIO=y
+CONFIG_SERIO_CT82C710=m
+CONFIG_SERIO_I8042=y
+CONFIG_SERIO_LIBPS2=y
+CONFIG_SERIO_PARKBD=m
+CONFIG_SERIO_PCIPS2=m
+CONFIG_SERIO_RAW=m
+CONFIG_SERIO_SERPORT=m
+CONFIG_SFC=m
+CONFIG_SFC_MTD=y
+CONFIG_SGI_IOC4=m
+CONFIG_SGI_PARTITION=y
+CONFIG_SHMEM=y
+CONFIG_SIGMATEL_FIR=m
+CONFIG_SIGNALFD=y
+CONFIG_SIS190=m
+CONFIG_SIS900=m
+CONFIG_SKFP=m
+CONFIG_SKGE=m
+# CONFIG_SKGE_DEBUG is not set
+CONFIG_SKISA=m
+CONFIG_SKY2=m
+# CONFIG_SKY2_DEBUG is not set
+CONFIG_SLAB=y
+CONFIG_SLABINFO=y
+CONFIG_SLHC=y
+CONFIG_SLICOSS=m
+CONFIG_SLIP=m
+CONFIG_SLIP_COMPRESSED=y
+CONFIG_SLIP_MODE_SLIP6=y
+CONFIG_SLIP_SMART=y
+# CONFIG_SLOB is not set
+CONFIG_SLOW_WORK=y
+# CONFIG_SLUB is not set
+CONFIG_SMARTJOYPLUS_FF=y
+CONFIG_SMB_FS=m
+# CONFIG_SMB_NLS_DEFAULT is not set
+CONFIG_SMC9194=m
+CONFIG_SMCTR=m
+CONFIG_SMC_IRCC_FIR=m
+CONFIG_SMP=y
+CONFIG_SMSC37B787_WDT=m
+CONFIG_SMSC9420=m
+CONFIG_SMSC_PHY=y
+CONFIG_SMSC_SCH311X_WDT=m
+CONFIG_SMS_SDIO_DRV=m
+CONFIG_SMS_SIANO_MDTV=m
+CONFIG_SMS_USB_DRV=m
+CONFIG_SND=m
+CONFIG_SND_AC97_CODEC=m
+CONFIG_SND_AC97_POWER_SAVE=y
+CONFIG_SND_AC97_POWER_SAVE_DEFAULT=0
+CONFIG_SND_AD1816A=m
+CONFIG_SND_AD1848=m
+CONFIG_SND_AD1889=m
+CONFIG_SND_ADLIB=m
+CONFIG_SND_ALI5451=m
+CONFIG_SND_ALS100=m
+CONFIG_SND_ALS300=m
+CONFIG_SND_ALS4000=m
+CONFIG_SND_ATIIXP=m
+CONFIG_SND_ATIIXP_MODEM=m
+CONFIG_SND_AU8810=m
+CONFIG_SND_AU8820=m
+CONFIG_SND_AU8830=m
+CONFIG_SND_AW2=m
+CONFIG_SND_AZT2320=m
+CONFIG_SND_AZT3328=m
+CONFIG_SND_BT87X=m
+# CONFIG_SND_BT87X_OVERCLOCK is not set
+CONFIG_SND_CA0106=m
+CONFIG_SND_CMI8330=m
+CONFIG_SND_CMIPCI=m
+CONFIG_SND_CS4231=m
+CONFIG_SND_CS4236=m
+CONFIG_SND_CS4281=m
+CONFIG_SND_CS46XX=m
+CONFIG_SND_CS46XX_NEW_DSP=y
+CONFIG_SND_CS5530=m
+CONFIG_SND_CS5535AUDIO=m
+CONFIG_SND_CTXFI=m
+CONFIG_SND_DARLA20=m
+CONFIG_SND_DARLA24=m
+# CONFIG_SND_DEBUG is not set
+CONFIG_SND_DRIVERS=y
+CONFIG_SND_DT019X=m
+CONFIG_SND_DUMMY=m
+CONFIG_SND_DYNAMIC_MINORS=y
+CONFIG_SND_ECHO3G=m
+CONFIG_SND_EMU10K1=m
+CONFIG_SND_EMU10K1X=m
+CONFIG_SND_EMU10K1_SEQ=m
+CONFIG_SND_ENS1370=m
+CONFIG_SND_ENS1371=m
+CONFIG_SND_ES1688=m
+CONFIG_SND_ES18XX=m
+CONFIG_SND_ES1938=m
+CONFIG_SND_ES1968=m
+CONFIG_SND_ES968=m
+CONFIG_SND_FM801=m
+CONFIG_SND_FM801_TEA575X=m
+CONFIG_SND_FM801_TEA575X_BOOL=y
+CONFIG_SND_GINA20=m
+CONFIG_SND_GINA24=m
+CONFIG_SND_GUSCLASSIC=m
+CONFIG_SND_GUSEXTREME=m
+CONFIG_SND_GUSMAX=m
+CONFIG_SND_HDA_CODEC_ANALOG=y
+CONFIG_SND_HDA_CODEC_ATIHDMI=y
+CONFIG_SND_HDA_CODEC_CA0110=y
+CONFIG_SND_HDA_CODEC_CMEDIA=y
+CONFIG_SND_HDA_CODEC_CONEXANT=y
+CONFIG_SND_HDA_CODEC_INTELHDMI=y
+CONFIG_SND_HDA_CODEC_NVHDMI=y
+CONFIG_SND_HDA_CODEC_REALTEK=y
+CONFIG_SND_HDA_CODEC_SI3054=y
+CONFIG_SND_HDA_CODEC_SIGMATEL=y
+CONFIG_SND_HDA_CODEC_VIA=y
+CONFIG_SND_HDA_ELD=y
+CONFIG_SND_HDA_GENERIC=y
+CONFIG_SND_HDA_HWDEP=y
+CONFIG_SND_HDA_INPUT_BEEP=y
+CONFIG_SND_HDA_INPUT_JACK=y
+CONFIG_SND_HDA_INTEL=m
+CONFIG_SND_HDA_POWER_SAVE=y
+CONFIG_SND_HDA_POWER_SAVE_DEFAULT=0
+CONFIG_SND_HDA_RECONFIG=y
+CONFIG_SND_HDSP=m
+CONFIG_SND_HDSPM=m
+CONFIG_SND_HIFIER=m
+CONFIG_SND_HRTIMER=m
+CONFIG_SND_HWDEP=m
+CONFIG_SND_ICE1712=m
+CONFIG_SND_ICE1724=m
+CONFIG_SND_INDIGO=m
+CONFIG_SND_INDIGODJ=m
+CONFIG_SND_INDIGODJX=m
+CONFIG_SND_INDIGOIO=m
+CONFIG_SND_INDIGOIOX=m
+CONFIG_SND_INTEL8X0=m
+CONFIG_SND_INTEL8X0M=m
+CONFIG_SND_INTERWAVE=m
+CONFIG_SND_INTERWAVE_STB=m
+CONFIG_SND_ISA=y
+CONFIG_SND_JACK=y
+CONFIG_SND_KORG1212=m
+CONFIG_SND_LAYLA20=m
+CONFIG_SND_LAYLA24=m
+CONFIG_SND_LX6464ES=m
+CONFIG_SND_MAESTRO3=m
+CONFIG_SND_MIA=m
+CONFIG_SND_MIRO=m
+CONFIG_SND_MIXART=m
+CONFIG_SND_MIXER_OSS=m
+CONFIG_SND_MONA=m
+CONFIG_SND_MPU401=m
+CONFIG_SND_MPU401_UART=m
+CONFIG_SND_MSND_CLASSIC=m
+CONFIG_SND_MSND_PINNACLE=m
+CONFIG_SND_MTPAV=m
+CONFIG_SND_MTS64=m
+CONFIG_SND_NM256=m
+CONFIG_SND_OPL3SA2=m
+CONFIG_SND_OPL3_LIB=m
+CONFIG_SND_OPL3_LIB_SEQ=m
+CONFIG_SND_OPL4_LIB=m
+CONFIG_SND_OPL4_LIB_SEQ=m
+CONFIG_SND_OPTI92X_AD1848=m
+CONFIG_SND_OPTI92X_CS4231=m
+CONFIG_SND_OPTI93X=m
+CONFIG_SND_OSSEMUL=y
+CONFIG_SND_OXYGEN=m
+CONFIG_SND_OXYGEN_LIB=m
+CONFIG_SND_PCI=y
+CONFIG_SND_PCM=m
+CONFIG_SND_PCMCIA=y
+CONFIG_SND_PCM_OSS=m
+CONFIG_SND_PCM_OSS_PLUGINS=y
+CONFIG_SND_PCSP=m
+CONFIG_SND_PCXHR=m
+CONFIG_SND_PDAUDIOCF=m
+CONFIG_SND_PORTMAN2X4=m
+CONFIG_SND_RAWMIDI=m
+CONFIG_SND_RAWMIDI_SEQ=m
+CONFIG_SND_RIPTIDE=m
+CONFIG_SND_RME32=m
+CONFIG_SND_RME96=m
+CONFIG_SND_RME9652=m
+CONFIG_SND_SB16=m
+CONFIG_SND_SB16_CSP=y
+CONFIG_SND_SB16_DSP=m
+CONFIG_SND_SB8=m
+CONFIG_SND_SB8_DSP=m
+CONFIG_SND_SBAWE=m
+CONFIG_SND_SBAWE_SEQ=m
+CONFIG_SND_SB_COMMON=m
+CONFIG_SND_SC6000=m
+CONFIG_SND_SEQUENCER=m
+CONFIG_SND_SEQUENCER_OSS=y
+CONFIG_SND_SEQ_DUMMY=m
+CONFIG_SND_SEQ_HRTIMER_DEFAULT=y
+CONFIG_SND_SERIAL_U16550=m
+CONFIG_SND_SGALAXY=m
+CONFIG_SND_SIS7019=m
+CONFIG_SND_SOC=m
+CONFIG_SND_SOC_AD73311=m
+CONFIG_SND_SOC_AK4104=m
+CONFIG_SND_SOC_AK4535=m
+CONFIG_SND_SOC_ALL_CODECS=m
+CONFIG_SND_SOC_CS4270=m
+CONFIG_SND_SOC_I2C_AND_SPI=m
+CONFIG_SND_SOC_L3=m
+CONFIG_SND_SOC_PCM3008=m
+CONFIG_SND_SOC_SPDIF=m
+CONFIG_SND_SOC_SSM2602=m
+CONFIG_SND_SOC_TLV320AIC23=m
+CONFIG_SND_SOC_TLV320AIC26=m
+CONFIG_SND_SOC_TLV320AIC3X=m
+CONFIG_SND_SOC_TWL4030=m
+CONFIG_SND_SOC_UDA134X=m
+CONFIG_SND_SOC_UDA1380=m
+CONFIG_SND_SOC_WM8350=m
+CONFIG_SND_SOC_WM8400=m
+CONFIG_SND_SOC_WM8510=m
+CONFIG_SND_SOC_WM8580=m
+CONFIG_SND_SOC_WM8728=m
+CONFIG_SND_SOC_WM8731=m
+CONFIG_SND_SOC_WM8750=m
+CONFIG_SND_SOC_WM8753=m
+CONFIG_SND_SOC_WM8900=m
+CONFIG_SND_SOC_WM8903=m
+CONFIG_SND_SOC_WM8940=m
+CONFIG_SND_SOC_WM8960=m
+CONFIG_SND_SOC_WM8971=m
+CONFIG_SND_SOC_WM8988=m
+CONFIG_SND_SOC_WM8990=m
+CONFIG_SND_SOC_WM9081=m
+CONFIG_SND_SONICVIBES=m
+CONFIG_SND_SPI=y
+CONFIG_SND_SSCAPE=m
+CONFIG_SND_SUPPORT_OLD_API=y
+CONFIG_SND_TIMER=m
+CONFIG_SND_TRIDENT=m
+CONFIG_SND_USB=y
+CONFIG_SND_USB_AUDIO=m
+CONFIG_SND_USB_CAIAQ=m
+CONFIG_SND_USB_CAIAQ_INPUT=y
+CONFIG_SND_USB_US122L=m
+CONFIG_SND_USB_USX2Y=m
+# CONFIG_SND_VERBOSE_PRINTK is not set
+CONFIG_SND_VERBOSE_PROCFS=y
+CONFIG_SND_VIA82XX=m
+CONFIG_SND_VIA82XX_MODEM=m
+CONFIG_SND_VIRMIDI=m
+CONFIG_SND_VIRTUOSO=m
+CONFIG_SND_VMASTER=y
+CONFIG_SND_VX222=m
+CONFIG_SND_VXPOCKET=m
+CONFIG_SND_VX_LIB=m
+CONFIG_SND_WAVEFRONT=m
+CONFIG_SND_WSS_LIB=m
+CONFIG_SND_YMFPCI=m
+CONFIG_SOC_CAMERA=m
+CONFIG_SOC_CAMERA_MT9M001=m
+CONFIG_SOC_CAMERA_MT9M111=m
+CONFIG_SOC_CAMERA_MT9T031=m
+CONFIG_SOC_CAMERA_MT9V022=m
+CONFIG_SOC_CAMERA_OV772X=m
+CONFIG_SOC_CAMERA_PLATFORM=m
+CONFIG_SOC_CAMERA_TW9910=m
+CONFIG_SOFT_WATCHDOG=m
+CONFIG_SOLARIS_X86_PARTITION=y
+CONFIG_SONYPI=m
+CONFIG_SONYPI_COMPAT=y
+CONFIG_SONY_LAPTOP=m
+CONFIG_SOUND=m
+CONFIG_SOUND_AEDSP16=m
+CONFIG_SOUND_DMAP=y
+CONFIG_SOUND_KAHLUA=m
+CONFIG_SOUND_MPU401=m
+CONFIG_SOUND_MSNDCLAS=m
+CONFIG_SOUND_MSNDPIN=m
+CONFIG_SOUND_MSS=m
+CONFIG_SOUND_OSS=m
+CONFIG_SOUND_OSS_CORE=y
+CONFIG_SOUND_PAS=m
+CONFIG_SOUND_PRIME=m
+CONFIG_SOUND_PSS=m
+CONFIG_SOUND_SB=m
+CONFIG_SOUND_SSCAPE=m
+# CONFIG_SOUND_TRACEINIT is not set
+CONFIG_SOUND_TRIX=m
+CONFIG_SOUND_UART6850=m
+CONFIG_SOUND_VMIDI=m
+CONFIG_SOUND_YM3812=m
+# CONFIG_SPARSEMEM_MANUAL is not set
+CONFIG_SPARSEMEM_STATIC=y
+CONFIG_SPECIALIX=m
+CONFIG_SPI=y
+CONFIG_SPI_BITBANG=m
+CONFIG_SPI_BUTTERFLY=m
+# CONFIG_SPI_DEBUG is not set
+CONFIG_SPI_GPIO=m
+CONFIG_SPI_LM70_LLP=m
+CONFIG_SPI_MASTER=y
+CONFIG_SPI_SPIDEV=m
+CONFIG_SPI_TLE62X0=m
+CONFIG_SPLIT_PTLOCK_CPUS=4
+CONFIG_SQUASHFS=m
+# CONFIG_SQUASHFS_EMBEDDED is not set
+CONFIG_SQUASHFS_FRAGMENT_CACHE_SIZE=3
+CONFIG_SSB=m
+CONFIG_SSB_B43_PCI_BRIDGE=y
+# CONFIG_SSB_DEBUG is not set
+CONFIG_SSB_DRIVER_PCICORE=y
+CONFIG_SSB_DRIVER_PCICORE_POSSIBLE=y
+CONFIG_SSB_PCIHOST=y
+CONFIG_SSB_PCIHOST_POSSIBLE=y
+# CONFIG_SSB_PCMCIAHOST is not set
+CONFIG_SSB_PCMCIAHOST_POSSIBLE=y
+CONFIG_SSB_POSSIBLE=y
+CONFIG_SSB_SPROM=y
+CONFIG_SSFDC=m
+CONFIG_STACKTRACE=y
+CONFIG_STACKTRACE_SUPPORT=y
+CONFIG_STAGING=y
+# CONFIG_STAGING_EXCLUDE_BUILD is not set
+CONFIG_STALDRV=y
+CONFIG_STALLION=m
+# CONFIG_STANDALONE is not set
+CONFIG_STE10XP=y
+# CONFIG_STLC45XX is not set
+CONFIG_STOP_MACHINE=y
+CONFIG_STP=m
+CONFIG_STRICT_DEVMEM=y
+CONFIG_STRIP=m
+# CONFIG_STRIP_ASM_SYMS is not set
+CONFIG_SUNDANCE=m
+# CONFIG_SUNDANCE_MMIO is not set
+CONFIG_SUNGEM=m
+CONFIG_SUNRPC=m
+CONFIG_SUNRPC_GSS=m
+CONFIG_SUNRPC_XPRT_RDMA=m
+CONFIG_SUN_PARTITION=y
+CONFIG_SUSPEND=y
+CONFIG_SUSPEND_FREEZER=y
+CONFIG_SWAP=y
+CONFIG_SX=m
+CONFIG_SXG=m
+CONFIG_SYNCLINK=m
+CONFIG_SYNCLINKMP=m
+CONFIG_SYNCLINK_CS=m
+CONFIG_SYNCLINK_GT=m
+CONFIG_SYN_COOKIES=y
+CONFIG_SYSCTL=y
+CONFIG_SYSCTL_SYSCALL=y
+CONFIG_SYSCTL_SYSCALL_CHECK=y
+CONFIG_SYSFS=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
+CONFIG_SYSV68_PARTITION=y
+CONFIG_SYSVIPC=y
+CONFIG_SYSVIPC_SYSCTL=y
+CONFIG_SYSV_FS=m
+# CONFIG_SYS_HYPERVISOR is not set
+CONFIG_TABLET_USB_ACECAD=m
+CONFIG_TABLET_USB_AIPTEK=m
+CONFIG_TABLET_USB_GTCO=m
+CONFIG_TABLET_USB_KBTAB=m
+CONFIG_TABLET_USB_WACOM=m
+CONFIG_TASKSTATS=y
+# CONFIG_TASK_DELAY_ACCT is not set
+CONFIG_TASK_IO_ACCOUNTING=y
+CONFIG_TASK_XACCT=y
+CONFIG_TC1100_WMI=m
+CONFIG_TCG_ATMEL=m
+CONFIG_TCG_INFINEON=m
+CONFIG_TCG_NSC=m
+CONFIG_TCG_TIS=m
+CONFIG_TCG_TPM=m
+CONFIG_TCIC=m
+CONFIG_TCP_CONG_ADVANCED=y
+CONFIG_TCP_CONG_BIC=m
+CONFIG_TCP_CONG_CUBIC=y
+CONFIG_TCP_CONG_HSTCP=m
+CONFIG_TCP_CONG_HTCP=m
+CONFIG_TCP_CONG_HYBLA=m
+CONFIG_TCP_CONG_ILLINOIS=m
+CONFIG_TCP_CONG_LP=m
+CONFIG_TCP_CONG_SCALABLE=m
+CONFIG_TCP_CONG_VEGAS=m
+CONFIG_TCP_CONG_VENO=m
+CONFIG_TCP_CONG_WESTWOOD=m
+CONFIG_TCP_CONG_YEAH=m
+CONFIG_TCP_MD5SIG=y
+CONFIG_TEHUTI=m
+CONFIG_TEKRAM_DONGLE=m
+CONFIG_TELCLOCK=m
+CONFIG_TEXTSEARCH=y
+CONFIG_TEXTSEARCH_BM=m
+CONFIG_TEXTSEARCH_FSM=m
+CONFIG_TEXTSEARCH_KMP=m
+CONFIG_THERMAL=y
+CONFIG_THERMAL_HWMON=y
+CONFIG_THINKPAD_ACPI=m
+# CONFIG_THINKPAD_ACPI_DEBUG is not set
+CONFIG_THINKPAD_ACPI_DEBUGFACILITIES=y
+CONFIG_THINKPAD_ACPI_HOTKEY_POLL=y
+# CONFIG_THINKPAD_ACPI_UNSAFE_LEDS is not set
+CONFIG_THINKPAD_ACPI_VIDEO=y
+CONFIG_THRUSTMASTER_FF=y
+CONFIG_TICK_ONESHOT=y
+CONFIG_TIFM_7XX1=m
+CONFIG_TIFM_CORE=m
+CONFIG_TIGON3=m
+CONFIG_TIMERFD=y
+CONFIG_TIMER_STATS=y
+CONFIG_TIPC=m
+# CONFIG_TIPC_ADVANCED is not set
+# CONFIG_TIPC_DEBUG is not set
+CONFIG_TLAN=m
+CONFIG_TMD_HERMES=m
+CONFIG_TMPFS=y
+CONFIG_TMPFS_POSIX_ACL=y
+CONFIG_TMS380TR=m
+CONFIG_TMSPCI=m
+CONFIG_TOIM3232_DONGLE=m
+# CONFIG_TOSHIBA is not set
+CONFIG_TOSHIBA_FIR=m
+CONFIG_TOUCHSCREEN_AD7877=m
+CONFIG_TOUCHSCREEN_AD7879=m
+CONFIG_TOUCHSCREEN_AD7879_I2C=m
+CONFIG_TOUCHSCREEN_ADS7846=m
+CONFIG_TOUCHSCREEN_DA9034=m
+CONFIG_TOUCHSCREEN_EETI=m
+CONFIG_TOUCHSCREEN_ELO=m
+CONFIG_TOUCHSCREEN_FUJITSU=m
+CONFIG_TOUCHSCREEN_GUNZE=m
+CONFIG_TOUCHSCREEN_HTCPEN=m
+CONFIG_TOUCHSCREEN_INEXIO=m
+CONFIG_TOUCHSCREEN_MK712=m
+CONFIG_TOUCHSCREEN_MTOUCH=m
+CONFIG_TOUCHSCREEN_PENMOUNT=m
+CONFIG_TOUCHSCREEN_TOUCHIT213=m
+CONFIG_TOUCHSCREEN_TOUCHRIGHT=m
+CONFIG_TOUCHSCREEN_TOUCHWIN=m
+CONFIG_TOUCHSCREEN_TSC2007=m
+CONFIG_TOUCHSCREEN_UCB1400=m
+CONFIG_TOUCHSCREEN_USB_3M=y
+CONFIG_TOUCHSCREEN_USB_COMPOSITE=m
+CONFIG_TOUCHSCREEN_USB_DMC_TSC10=y
+CONFIG_TOUCHSCREEN_USB_EGALAX=y
+CONFIG_TOUCHSCREEN_USB_ETURBO=y
+CONFIG_TOUCHSCREEN_USB_GENERAL_TOUCH=y
+CONFIG_TOUCHSCREEN_USB_GOTOP=y
+CONFIG_TOUCHSCREEN_USB_GUNZE=y
+CONFIG_TOUCHSCREEN_USB_IDEALTEK=y
+CONFIG_TOUCHSCREEN_USB_IRTOUCH=y
+CONFIG_TOUCHSCREEN_USB_ITM=y
+CONFIG_TOUCHSCREEN_USB_PANJIT=y
+CONFIG_TOUCHSCREEN_W90X900=m
+CONFIG_TOUCHSCREEN_WACOM_W8001=m
+CONFIG_TOUCHSCREEN_WM9705=y
+CONFIG_TOUCHSCREEN_WM9712=y
+CONFIG_TOUCHSCREEN_WM9713=y
+CONFIG_TOUCHSCREEN_WM97XX=m
+CONFIG_TPS65010=m
+CONFIG_TR=y
+CONFIG_TRACEPOINTS=y
+CONFIG_TRACE_IRQFLAGS_SUPPORT=y
+CONFIG_TRACING=y
+CONFIG_TRACING_SUPPORT=y
+CONFIG_TRANZPORT=m
+# CONFIG_TREE_RCU is not set
+# CONFIG_TREE_RCU_TRACE is not set
+CONFIG_TTPCI_EEPROM=m
+CONFIG_TULIP=m
+# CONFIG_TULIP_MMIO is not set
+# CONFIG_TULIP_MWI is not set
+# CONFIG_TULIP_NAPI is not set
+CONFIG_TUN=m
+CONFIG_TWL4030_CORE=y
+CONFIG_TWL4030_USB=m
+CONFIG_TWL4030_WATCHDOG=m
+CONFIG_TYPHOON=m
+CONFIG_UBIFS_FS=m
+# CONFIG_UBIFS_FS_ADVANCED_COMPR is not set
+# CONFIG_UBIFS_FS_DEBUG is not set
+CONFIG_UBIFS_FS_LZO=y
+CONFIG_UBIFS_FS_XATTR=y
+CONFIG_UBIFS_FS_ZLIB=y
+CONFIG_UCB1400_CORE=m
+CONFIG_UDF_FS=m
+CONFIG_UDF_NLS=y
+CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+# CONFIG_UFS_DEBUG is not set
+CONFIG_UFS_FS=m
+# CONFIG_UFS_FS_WRITE is not set
+CONFIG_UID16=y
+CONFIG_UIO=m
+CONFIG_UIO_AEC=m
+CONFIG_UIO_CIF=m
+CONFIG_UIO_PDRV=m
+CONFIG_UIO_PDRV_GENIRQ=m
+CONFIG_UIO_SERCOS3=m
+CONFIG_UIO_SMX=m
+CONFIG_ULI526X=m
+CONFIG_ULTRA=m
+CONFIG_ULTRA32=m
+CONFIG_ULTRAMCA=m
+CONFIG_ULTRIX_PARTITION=y
+CONFIG_UNIX=y
+CONFIG_UNIX98_PTYS=y
+CONFIG_UNIXWARE_DISKLABEL=y
+CONFIG_UNUSED_SYMBOLS=y
+CONFIG_USB=y
+CONFIG_USBPCWATCHDOG=m
+CONFIG_USB_ACM=m
+CONFIG_USB_ADUTUX=m
+CONFIG_USB_ALI_M5632=y
+CONFIG_USB_AN2720=y
+# CONFIG_USB_ANNOUNCE_NEW_DEVICES is not set
+CONFIG_USB_APPLEDISPLAY=m
+CONFIG_USB_ARCH_HAS_EHCI=y
+CONFIG_USB_ARCH_HAS_HCD=y
+CONFIG_USB_ARCH_HAS_OHCI=y
+CONFIG_USB_ARMLINUX=y
+CONFIG_USB_ATM=m
+CONFIG_USB_ATMEL=m
+CONFIG_USB_AUDIO=m
+CONFIG_USB_BELKIN=y
+CONFIG_USB_BERRY_CHARGE=m
+CONFIG_USB_C67X00_HCD=m
+CONFIG_USB_CATC=m
+CONFIG_USB_CDC_COMPOSITE=m
+CONFIG_USB_CDC_PHONET=m
+CONFIG_USB_CPC=m
+CONFIG_USB_CXACRU=m
+CONFIG_USB_CYPRESS_CY7C63=m
+CONFIG_USB_CYTHERM=m
+CONFIG_USB_DABUSB=m
+# CONFIG_USB_DEBUG is not set
+CONFIG_USB_DEVICEFS=y
+# CONFIG_USB_DEVICE_CLASS is not set
+CONFIG_USB_DSBR=m
+# CONFIG_USB_DYNAMIC_MINORS is not set
+CONFIG_USB_EHCI_HCD=y
+CONFIG_USB_EHCI_ROOT_HUB_TT=y
+CONFIG_USB_EHCI_TT_NEWSCHED=y
+CONFIG_USB_EMI26=m
+CONFIG_USB_EMI62=m
+CONFIG_USB_EPSON2888=y
+CONFIG_USB_ET61X251=m
+CONFIG_USB_ETH=m
+CONFIG_USB_ETH_RNDIS=y
+CONFIG_USB_EZUSB=y
+CONFIG_USB_FILE_STORAGE=m
+# CONFIG_USB_FILE_STORAGE_TEST is not set
+CONFIG_USB_FTDI_ELAN=m
+CONFIG_USB_GADGET=m
+CONFIG_USB_GADGETFS=m
+# CONFIG_USB_GADGET_AMD5536UDC is not set
+# CONFIG_USB_GADGET_AT91 is not set
+# CONFIG_USB_GADGET_ATMEL_USBA is not set
+# CONFIG_USB_GADGET_CI13XXX is not set
+# CONFIG_USB_GADGET_DEBUG is not set
+# CONFIG_USB_GADGET_DEBUG_FILES is not set
+# CONFIG_USB_GADGET_DEBUG_FS is not set
+CONFIG_USB_GADGET_DUALSPEED=y
+# CONFIG_USB_GADGET_DUMMY_HCD is not set
+# CONFIG_USB_GADGET_FSL_QE is not set
+# CONFIG_USB_GADGET_FSL_USB2 is not set
+# CONFIG_USB_GADGET_GOKU is not set
+# CONFIG_USB_GADGET_IMX is not set
+# CONFIG_USB_GADGET_LANGWELL is not set
+# CONFIG_USB_GADGET_LH7A40X is not set
+# CONFIG_USB_GADGET_M66592 is not set
+# CONFIG_USB_GADGET_MUSB_HDRC is not set
+CONFIG_USB_GADGET_NET2280=y
+# CONFIG_USB_GADGET_OMAP is not set
+# CONFIG_USB_GADGET_PXA25X is not set
+# CONFIG_USB_GADGET_PXA27X is not set
+# CONFIG_USB_GADGET_S3C2410 is not set
+# CONFIG_USB_GADGET_S3C_HSOTG is not set
+CONFIG_USB_GADGET_SELECTED=y
+CONFIG_USB_GADGET_VBUS_DRAW=2
+CONFIG_USB_GPIO_VBUS=m
+CONFIG_USB_GSPCA=m
+CONFIG_USB_GSPCA_CONEX=m
+CONFIG_USB_GSPCA_ETOMS=m
+CONFIG_USB_GSPCA_FINEPIX=m
+CONFIG_USB_GSPCA_MARS=m
+CONFIG_USB_GSPCA_MR97310A=m
+CONFIG_USB_GSPCA_OV519=m
+CONFIG_USB_GSPCA_OV534=m
+CONFIG_USB_GSPCA_PAC207=m
+CONFIG_USB_GSPCA_PAC7311=m
+CONFIG_USB_GSPCA_SN9C20X=m
+# CONFIG_USB_GSPCA_SN9C20X_EVDEV is not set
+CONFIG_USB_GSPCA_SONIXB=m
+CONFIG_USB_GSPCA_SONIXJ=m
+CONFIG_USB_GSPCA_SPCA500=m
+CONFIG_USB_GSPCA_SPCA501=m
+CONFIG_USB_GSPCA_SPCA505=m
+CONFIG_USB_GSPCA_SPCA506=m
+CONFIG_USB_GSPCA_SPCA508=m
+CONFIG_USB_GSPCA_SPCA561=m
+CONFIG_USB_GSPCA_SQ905=m
+CONFIG_USB_GSPCA_SQ905C=m
+CONFIG_USB_GSPCA_STK014=m
+CONFIG_USB_GSPCA_SUNPLUS=m
+CONFIG_USB_GSPCA_T613=m
+CONFIG_USB_GSPCA_TV8532=m
+CONFIG_USB_GSPCA_VC032X=m
+CONFIG_USB_GSPCA_ZC3XX=m
+CONFIG_USB_G_PRINTER=m
+CONFIG_USB_G_SERIAL=m
+CONFIG_USB_HID=m
+CONFIG_USB_HIDDEV=y
+CONFIG_USB_HSO=m
+CONFIG_USB_HWA_HCD=m
+CONFIG_USB_IBMCAM=m
+CONFIG_USB_IDMOUSE=m
+CONFIG_USB_IOWARRIOR=m
+CONFIG_USB_IP_COMMON=m
+CONFIG_USB_IP_HOST=m
+CONFIG_USB_IP_VHCI_HCD=m
+CONFIG_USB_IRDA=m
+CONFIG_USB_ISIGHTFW=m
+CONFIG_USB_ISP116X_HCD=m
+CONFIG_USB_ISP1760_HCD=m
+CONFIG_USB_KAWETH=m
+CONFIG_USB_KC2190=y
+CONFIG_USB_KONICAWC=m
+CONFIG_USB_LCD=m
+CONFIG_USB_LD=m
+CONFIG_USB_LED=m
+CONFIG_USB_LEGOTOWER=m
+# CONFIG_USB_LIBUSUAL is not set
+CONFIG_USB_M5602=m
+CONFIG_USB_MDC800=m
+CONFIG_USB_MICROTEK=m
+CONFIG_USB_MIDI_GADGET=m
+CONFIG_USB_MON=y
+CONFIG_USB_MR800=m
+CONFIG_USB_NET2280=m
+CONFIG_USB_NET_AX8817X=m
+CONFIG_USB_NET_CDCETHER=m
+CONFIG_USB_NET_CDC_EEM=m
+CONFIG_USB_NET_CDC_SUBSET=m
+CONFIG_USB_NET_DM9601=m
+CONFIG_USB_NET_GL620A=m
+CONFIG_USB_NET_INT51X1=m
+CONFIG_USB_NET_MCS7830=m
+CONFIG_USB_NET_NET1080=m
+CONFIG_USB_NET_PLUSB=m
+CONFIG_USB_NET_RNDIS_HOST=m
+CONFIG_USB_NET_RNDIS_WLAN=m
+CONFIG_USB_NET_SMSC95XX=m
+CONFIG_USB_NET_ZAURUS=m
+# CONFIG_USB_OHCI_BIG_ENDIAN_DESC is not set
+# CONFIG_USB_OHCI_BIG_ENDIAN_MMIO is not set
+CONFIG_USB_OHCI_HCD=y
+CONFIG_USB_OHCI_LITTLE_ENDIAN=y
+# CONFIG_USB_OTG is not set
+CONFIG_USB_OTG_UTILS=y
+# CONFIG_USB_OV511 is not set
+CONFIG_USB_OXU210HP_HCD=m
+CONFIG_USB_PEGASUS=m
+CONFIG_USB_PRINTER=m
+CONFIG_USB_PWC=m
+# CONFIG_USB_PWC_DEBUG is not set
+CONFIG_USB_PWC_INPUT_EVDEV=y
+CONFIG_USB_QUICKCAM_MESSENGER=m
+CONFIG_USB_R8A66597_HCD=m
+CONFIG_USB_RIO500=m
+CONFIG_USB_RTL8150=m
+CONFIG_USB_S2255=m
+CONFIG_USB_SE401=m
+CONFIG_USB_SERIAL=m
+CONFIG_USB_SERIAL_AIRCABLE=m
+CONFIG_USB_SERIAL_ARK3116=m
+CONFIG_USB_SERIAL_BELKIN=m
+CONFIG_USB_SERIAL_CH341=m
+CONFIG_USB_SERIAL_CP210X=m
+CONFIG_USB_SERIAL_CYBERJACK=m
+CONFIG_USB_SERIAL_CYPRESS_M8=m
+CONFIG_USB_SERIAL_DEBUG=m
+CONFIG_USB_SERIAL_DIGI_ACCELEPORT=m
+CONFIG_USB_SERIAL_EDGEPORT=m
+CONFIG_USB_SERIAL_EDGEPORT_TI=m
+CONFIG_USB_SERIAL_EMPEG=m
+CONFIG_USB_SERIAL_FTDI_SIO=m
+CONFIG_USB_SERIAL_FUNSOFT=m
+CONFIG_USB_SERIAL_GARMIN=m
+CONFIG_USB_SERIAL_GENERIC=y
+CONFIG_USB_SERIAL_HP4X=m
+CONFIG_USB_SERIAL_IPAQ=m
+CONFIG_USB_SERIAL_IPW=m
+CONFIG_USB_SERIAL_IR=m
+CONFIG_USB_SERIAL_IUU=m
+CONFIG_USB_SERIAL_KEYSPAN=m
+CONFIG_USB_SERIAL_KEYSPAN_MPR=y
+CONFIG_USB_SERIAL_KEYSPAN_PDA=m
+CONFIG_USB_SERIAL_KEYSPAN_USA18X=y
+CONFIG_USB_SERIAL_KEYSPAN_USA19=y
+CONFIG_USB_SERIAL_KEYSPAN_USA19QI=y
+CONFIG_USB_SERIAL_KEYSPAN_USA19QW=y
+CONFIG_USB_SERIAL_KEYSPAN_USA19W=y
+CONFIG_USB_SERIAL_KEYSPAN_USA28=y
+CONFIG_USB_SERIAL_KEYSPAN_USA28X=y
+CONFIG_USB_SERIAL_KEYSPAN_USA28XA=y
+CONFIG_USB_SERIAL_KEYSPAN_USA28XB=y
+CONFIG_USB_SERIAL_KEYSPAN_USA49W=y
+CONFIG_USB_SERIAL_KEYSPAN_USA49WLC=y
+CONFIG_USB_SERIAL_KLSI=m
+CONFIG_USB_SERIAL_KOBIL_SCT=m
+CONFIG_USB_SERIAL_MCT_U232=m
+CONFIG_USB_SERIAL_MOS7720=m
+CONFIG_USB_SERIAL_MOS7840=m
+CONFIG_USB_SERIAL_MOTOROLA=m
+CONFIG_USB_SERIAL_NAVMAN=m
+CONFIG_USB_SERIAL_OMNINET=m
+CONFIG_USB_SERIAL_OPTICON=m
+CONFIG_USB_SERIAL_OPTION=m
+CONFIG_USB_SERIAL_OTI6858=m
+CONFIG_USB_SERIAL_PL2303=m
+CONFIG_USB_SERIAL_QUALCOMM=m
+CONFIG_USB_SERIAL_QUATECH2=m
+CONFIG_USB_SERIAL_SAFE=m
+# CONFIG_USB_SERIAL_SAFE_PADDED is not set
+CONFIG_USB_SERIAL_SIEMENS_MPI=m
+CONFIG_USB_SERIAL_SIERRAWIRELESS=m
+CONFIG_USB_SERIAL_SPCP8X5=m
+CONFIG_USB_SERIAL_SYMBOL=m
+CONFIG_USB_SERIAL_TI=m
+CONFIG_USB_SERIAL_VISOR=m
+CONFIG_USB_SERIAL_WHITEHEAT=m
+CONFIG_USB_SERIAL_XIRCOM=m
+CONFIG_USB_SEVSEG=m
+CONFIG_USB_SI470X=m
+CONFIG_USB_SISUSBVGA=m
+# CONFIG_USB_SISUSBVGA_CON is not set
+CONFIG_USB_SL811_CS=m
+CONFIG_USB_SL811_HCD=m
+CONFIG_USB_SN9C102=m
+CONFIG_USB_SPEEDTOUCH=m
+CONFIG_USB_STKWEBCAM=m
+CONFIG_USB_STORAGE=m
+CONFIG_USB_STORAGE_ALAUDA=m
+CONFIG_USB_STORAGE_CYPRESS_ATACB=m
+CONFIG_USB_STORAGE_DATAFAB=m
+# CONFIG_USB_STORAGE_DEBUG is not set
+CONFIG_USB_STORAGE_FREECOM=m
+CONFIG_USB_STORAGE_ISD200=m
+CONFIG_USB_STORAGE_JUMPSHOT=m
+CONFIG_USB_STORAGE_KARMA=m
+CONFIG_USB_STORAGE_ONETOUCH=m
+CONFIG_USB_STORAGE_SDDR09=m
+CONFIG_USB_STORAGE_SDDR55=m
+CONFIG_USB_STORAGE_USBAT=m
+CONFIG_USB_STV06XX=m
+CONFIG_USB_STV680=m
+CONFIG_USB_SUPPORT=y
+CONFIG_USB_SUSPEND=y
+CONFIG_USB_TEST=m
+CONFIG_USB_TMC=m
+CONFIG_USB_TRANCEVIBRATOR=m
+CONFIG_USB_U132_HCD=m
+CONFIG_USB_UEAGLEATM=m
+CONFIG_USB_UHCI_HCD=y
+CONFIG_USB_USBNET=m
+CONFIG_USB_USS720=m
+CONFIG_USB_VICAM=m
+CONFIG_USB_VIDEO_CLASS=m
+CONFIG_USB_VIDEO_CLASS_INPUT_EVDEV=y
+CONFIG_USB_VST=m
+CONFIG_USB_W9968CF=m
+CONFIG_USB_WDM=m
+CONFIG_USB_WHCI_HCD=m
+CONFIG_USB_WUSB=m
+CONFIG_USB_WUSB_CBAF=m
+# CONFIG_USB_WUSB_CBAF_DEBUG is not set
+CONFIG_USB_XHCI_HCD=m
+# CONFIG_USB_XHCI_HCD_DEBUGGING is not set
+CONFIG_USB_XUSBATM=m
+CONFIG_USB_ZC0301=m
+CONFIG_USB_ZD1201=m
+CONFIG_USB_ZERO=m
+CONFIG_USB_ZR364XX=m
+# CONFIG_USER_NS is not set
+# CONFIG_USER_SCHED is not set
+CONFIG_USER_STACKTRACE_SUPPORT=y
+CONFIG_USE_GENERIC_SMP_HELPERS=y
+CONFIG_UTS_NS=y
+CONFIG_UWB=m
+CONFIG_UWB_HWA=m
+CONFIG_UWB_I1480U=m
+CONFIG_UWB_I1480U_WLP=m
+CONFIG_UWB_WHCI=m
+CONFIG_UWB_WLP=m
+CONFIG_V4L_USB_DRIVERS=y
+CONFIG_VERSION_SIGNATURE=""
+CONFIG_VETH=m
+CONFIG_VFAT_FS=m
+# CONFIG_VGACON_SOFT_SCROLLBACK is not set
+CONFIG_VGASTATE=m
+CONFIG_VGA_CONSOLE=y
+CONFIG_VIA_FIR=m
+CONFIG_VIA_RHINE=m
+CONFIG_VIA_RHINE_MMIO=y
+CONFIG_VIA_VELOCITY=m
+CONFIG_VIDEOBUF_DMA_SG=m
+CONFIG_VIDEOBUF_DVB=m
+CONFIG_VIDEOBUF_GEN=m
+CONFIG_VIDEOBUF_VMALLOC=m
+CONFIG_VIDEO_ADV7170=m
+CONFIG_VIDEO_ADV7175=m
+# CONFIG_VIDEO_ADV_DEBUG is not set
+CONFIG_VIDEO_ALLOW_V4L1=y
+CONFIG_VIDEO_AU0828=m
+CONFIG_VIDEO_BT819=m
+CONFIG_VIDEO_BT848=m
+CONFIG_VIDEO_BT848_DVB=y
+CONFIG_VIDEO_BT856=m
+CONFIG_VIDEO_BT866=m
+CONFIG_VIDEO_BTCX=m
+CONFIG_VIDEO_BWQCAM=m
+CONFIG_VIDEO_CAFE_CCIC=m
+CONFIG_VIDEO_CAPTURE_DRIVERS=y
+CONFIG_VIDEO_CPIA=m
+CONFIG_VIDEO_CPIA2=m
+CONFIG_VIDEO_CPIA_PP=m
+CONFIG_VIDEO_CPIA_USB=m
+CONFIG_VIDEO_CQCAM=m
+CONFIG_VIDEO_CS5345=m
+CONFIG_VIDEO_CS53L32A=m
+CONFIG_VIDEO_CX18=m
+CONFIG_VIDEO_CX231XX=m
+CONFIG_VIDEO_CX231XX_ALSA=m
+CONFIG_VIDEO_CX231XX_DVB=m
+CONFIG_VIDEO_CX2341X=m
+CONFIG_VIDEO_CX23885=m
+CONFIG_VIDEO_CX25840=m
+CONFIG_VIDEO_CX88=m
+CONFIG_VIDEO_CX88_ALSA=m
+CONFIG_VIDEO_CX88_BLACKBIRD=m
+CONFIG_VIDEO_CX88_DVB=m
+CONFIG_VIDEO_CX88_MPEG=m
+CONFIG_VIDEO_CX88_VP3054=m
+CONFIG_VIDEO_DEV=m
+CONFIG_VIDEO_EM28XX=m
+CONFIG_VIDEO_EM28XX_ALSA=m
+CONFIG_VIDEO_EM28XX_DVB=m
+CONFIG_VIDEO_FB_IVTV=m
+# CONFIG_VIDEO_FIXED_MINOR_RANGES is not set
+CONFIG_VIDEO_GO7007=m
+CONFIG_VIDEO_GO7007_USB=m
+CONFIG_VIDEO_GO7007_USB_S2250_BOARD=m
+CONFIG_VIDEO_HDPVR=m
+CONFIG_VIDEO_HELPER_CHIPS_AUTO=y
+CONFIG_VIDEO_HEXIUM_GEMINI=m
+CONFIG_VIDEO_HEXIUM_ORION=m
+CONFIG_VIDEO_IR=m
+CONFIG_VIDEO_IR_I2C=m
+CONFIG_VIDEO_IVTV=m
+CONFIG_VIDEO_KS0127=m
+CONFIG_VIDEO_M52790=m
+CONFIG_VIDEO_MEDIA=m
+CONFIG_VIDEO_MEYE=m
+CONFIG_VIDEO_MSP3400=m
+CONFIG_VIDEO_MT9V011=m
+CONFIG_VIDEO_MXB=m
+CONFIG_VIDEO_OUTPUT_CONTROL=m
+CONFIG_VIDEO_OV7670=m
+CONFIG_VIDEO_OVCAMCHIP=m
+CONFIG_VIDEO_PMS=m
+CONFIG_VIDEO_PVRUSB2=m
+# CONFIG_VIDEO_PVRUSB2_DEBUGIFC is not set
+CONFIG_VIDEO_PVRUSB2_DVB=y
+CONFIG_VIDEO_PVRUSB2_SYSFS=y
+CONFIG_VIDEO_SAA5246A=m
+CONFIG_VIDEO_SAA5249=m
+CONFIG_VIDEO_SAA6588=m
+CONFIG_VIDEO_SAA7110=m
+CONFIG_VIDEO_SAA711X=m
+CONFIG_VIDEO_SAA7127=m
+CONFIG_VIDEO_SAA7134=m
+CONFIG_VIDEO_SAA7134_ALSA=m
+CONFIG_VIDEO_SAA7134_DVB=m
+CONFIG_VIDEO_SAA7146=m
+CONFIG_VIDEO_SAA7146_VV=m
+CONFIG_VIDEO_SAA717X=m
+CONFIG_VIDEO_SAA7185=m
+CONFIG_VIDEO_STRADIS=m
+CONFIG_VIDEO_TDA7432=m
+CONFIG_VIDEO_TDA9840=m
+CONFIG_VIDEO_TEA6415C=m
+CONFIG_VIDEO_TEA6420=m
+CONFIG_VIDEO_TUNER=m
+CONFIG_VIDEO_TVAUDIO=m
+CONFIG_VIDEO_TVEEPROM=m
+CONFIG_VIDEO_TVP5150=m
+CONFIG_VIDEO_UPD64031A=m
+CONFIG_VIDEO_UPD64083=m
+CONFIG_VIDEO_USBVIDEO=m
+CONFIG_VIDEO_USBVISION=m
+CONFIG_VIDEO_V4L1=m
+CONFIG_VIDEO_V4L1_COMPAT=y
+CONFIG_VIDEO_V4L2=m
+CONFIG_VIDEO_V4L2_COMMON=m
+CONFIG_VIDEO_VIVI=m
+CONFIG_VIDEO_VP27SMPX=m
+CONFIG_VIDEO_VPX3220=m
+CONFIG_VIDEO_W9966=m
+CONFIG_VIDEO_WM8739=m
+CONFIG_VIDEO_WM8775=m
+CONFIG_VIDEO_ZORAN=m
+CONFIG_VIDEO_ZORAN_AVS6EYES=m
+CONFIG_VIDEO_ZORAN_BUZ=m
+CONFIG_VIDEO_ZORAN_DC10=m
+CONFIG_VIDEO_ZORAN_DC30=m
+CONFIG_VIDEO_ZORAN_LML33=m
+CONFIG_VIDEO_ZORAN_LML33R10=m
+CONFIG_VIDEO_ZORAN_ZR36060=m
+CONFIG_VIRTIO=m
+CONFIG_VIRTIO_BALLOON=m
+CONFIG_VIRTIO_BLK=m
+CONFIG_VIRTIO_CONSOLE=m
+CONFIG_VIRTIO_NET=m
+CONFIG_VIRTIO_PCI=m
+CONFIG_VIRTIO_RING=m
+CONFIG_VIRTUALIZATION=y
+CONFIG_VIRT_TO_BUS=y
+CONFIG_VITESSE_PHY=y
+CONFIG_VLAN_8021Q=m
+CONFIG_VLAN_8021Q_GVRP=y
+CONFIG_VLSI_FIR=m
+CONFIG_VM86=y
+CONFIG_VMI=y
+CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_VORTEX=m
+CONFIG_VT=y
+# CONFIG_VT6655 is not set
+CONFIG_VT_CONSOLE=y
+CONFIG_VT_HW_CONSOLE_BINDING=y
+CONFIG_VXFS_FS=m
+CONFIG_VXGE=m
+# CONFIG_VXGE_DEBUG_TRACE_ALL is not set
+CONFIG_W1=m
+CONFIG_W1_CON=y
+CONFIG_W1_MASTER_DS2482=m
+CONFIG_W1_MASTER_DS2490=m
+CONFIG_W1_MASTER_GPIO=m
+CONFIG_W1_MASTER_MATROX=m
+CONFIG_W1_SLAVE_BQ27000=m
+CONFIG_W1_SLAVE_DS2431=m
+CONFIG_W1_SLAVE_DS2433=m
+# CONFIG_W1_SLAVE_DS2433_CRC is not set
+CONFIG_W1_SLAVE_DS2760=m
+CONFIG_W1_SLAVE_SMEM=m
+CONFIG_W1_SLAVE_THERM=m
+CONFIG_W35UND=m
+CONFIG_W83627HF_WDT=m
+CONFIG_W83697HF_WDT=m
+CONFIG_W83697UG_WDT=m
+CONFIG_W83877F_WDT=m
+CONFIG_W83977F_WDT=m
+CONFIG_WAFER_WDT=m
+CONFIG_WAN=y
+CONFIG_WANXL=m
+CONFIG_WAN_ROUTER=m
+CONFIG_WAN_ROUTER_DRIVERS=m
+CONFIG_WATCHDOG=y
+# CONFIG_WATCHDOG_NOWAYOUT is not set
+CONFIG_WAVELAN=m
+CONFIG_WD80x3=m
+CONFIG_WDT=m
+CONFIG_WDTPCI=m
+CONFIG_WIMAX=m
+CONFIG_WIMAX_DEBUG_LEVEL=8
+CONFIG_WIMAX_I2400M=m
+CONFIG_WIMAX_I2400M_DEBUG_LEVEL=8
+CONFIG_WIMAX_I2400M_SDIO=m
+CONFIG_WIMAX_I2400M_USB=m
+CONFIG_WINBOND_840=m
+CONFIG_WINBOND_FIR=m
+CONFIG_WIRELESS=y
+CONFIG_WIRELESS_EXT=y
+CONFIG_WIRELESS_EXT_SYSFS=y
+# CONFIG_WIRELESS_OLD_REGULATORY is not set
+CONFIG_WL12XX=m
+CONFIG_WLAN_80211=y
+CONFIG_WLAN_PRE80211=y
+CONFIG_WM8350_POWER=m
+CONFIG_WM8350_WATCHDOG=m
+CONFIG_X25=m
+CONFIG_X25_ASY=m
+CONFIG_X86=y
+CONFIG_X86_32=y
+# CONFIG_X86_32_NON_STANDARD is not set
+CONFIG_X86_32_SMP=y
+# CONFIG_X86_64 is not set
+CONFIG_X86_ACPI_CPUFREQ=y
+CONFIG_X86_ALIGNMENT_16=y
+# CONFIG_X86_ANCIENT_MCE is not set
+CONFIG_X86_APM_BOOT=y
+# CONFIG_X86_BIGSMP is not set
+CONFIG_X86_BOOTPARAM_MEMORY_CORRUPTION_CHECK=y
+CONFIG_X86_BSWAP=y
+CONFIG_X86_CHECK_BIOS_CORRUPTION=y
+CONFIG_X86_CMPXCHG=y
+CONFIG_X86_CPU=y
+CONFIG_X86_CPUFREQ_NFORCE2=y
+CONFIG_X86_CPUID=m
+# CONFIG_X86_CPU_DEBUG is not set
+# CONFIG_X86_ELAN is not set
+CONFIG_X86_EXTENDED_PLATFORM=y
+CONFIG_X86_E_POWERSAVER=m
+CONFIG_X86_F00F_BUG=y
+CONFIG_X86_GENERIC=y
+CONFIG_X86_GX_SUSPMOD=y
+CONFIG_X86_HT=y
+CONFIG_X86_INTEL_USERCOPY=y
+CONFIG_X86_INTERNODE_CACHE_BYTES=64
+CONFIG_X86_INVLPG=y
+CONFIG_X86_IO_APIC=y
+CONFIG_X86_L1_CACHE_BYTES=64
+CONFIG_X86_L1_CACHE_SHIFT=5
+CONFIG_X86_LOCAL_APIC=y
+CONFIG_X86_LONGHAUL=y
+CONFIG_X86_LONGRUN=y
+CONFIG_X86_MCE=y
+CONFIG_X86_MCE_AMD=y
+CONFIG_X86_MCE_INJECT=m
+CONFIG_X86_MCE_INTEL=y
+CONFIG_X86_MCE_THRESHOLD=y
+CONFIG_X86_MINIMUM_CPU_FAMILY=4
+CONFIG_X86_MPPARSE=y
+CONFIG_X86_MSR=m
+CONFIG_X86_NEED_RELOCS=y
+CONFIG_X86_NEW_MCE=y
+# CONFIG_X86_OLD_MCE is not set
+CONFIG_X86_P4_CLOCKMOD=m
+CONFIG_X86_PAT=y
+CONFIG_X86_PLATFORM_DEVICES=y
+CONFIG_X86_PM_TIMER=y
+CONFIG_X86_POPAD_OK=y
+CONFIG_X86_POWERNOW_K6=y
+CONFIG_X86_POWERNOW_K7=y
+CONFIG_X86_POWERNOW_K7_ACPI=y
+CONFIG_X86_POWERNOW_K8=y
+CONFIG_X86_PPRO_FENCE=y
+# CONFIG_X86_PTDUMP is not set
+# CONFIG_X86_RDC321X is not set
+CONFIG_X86_REBOOTFIXUPS=y
+CONFIG_X86_REROUTE_FOR_BROKEN_BOOT_IRQS=y
+CONFIG_X86_RESERVE_LOW_64K=y
+CONFIG_X86_SPEEDSTEP_CENTRINO=y
+CONFIG_X86_SPEEDSTEP_CENTRINO_TABLE=y
+CONFIG_X86_SPEEDSTEP_ICH=y
+CONFIG_X86_SPEEDSTEP_LIB=y
+CONFIG_X86_SPEEDSTEP_RELAXED_CAP_CHECK=y
+CONFIG_X86_SPEEDSTEP_SMI=y
+CONFIG_X86_THERMAL_VECTOR=y
+CONFIG_X86_TRAMPOLINE=y
+# CONFIG_X86_VERBOSE_BOOTUP is not set
+CONFIG_X86_WP_WORKS_OK=y
+CONFIG_X86_XADD=y
+CONFIG_XFRM=y
+CONFIG_XFRM_IPCOMP=m
+# CONFIG_XFRM_MIGRATE is not set
+# CONFIG_XFRM_STATISTICS is not set
+# CONFIG_XFRM_SUB_POLICY is not set
+CONFIG_XFRM_USER=m
+# CONFIG_XFS_DEBUG is not set
+CONFIG_XFS_FS=m
+CONFIG_XFS_POSIX_ACL=y
+CONFIG_XFS_QUOTA=y
+CONFIG_XFS_RT=y
+CONFIG_XOR_BLOCKS=m
+CONFIG_YAM=m
+CONFIG_YELLOWFIN=m
+CONFIG_YENTA=m
+CONFIG_YENTA_ENE_TUNE=y
+CONFIG_YENTA_O2=y
+CONFIG_YENTA_RICOH=y
+CONFIG_YENTA_TI=y
+CONFIG_YENTA_TOSHIBA=y
+CONFIG_ZD1211RW=m
+# CONFIG_ZD1211RW_DEBUG is not set
+CONFIG_ZEROPLUS_FF=y
+CONFIG_ZISOFS=y
+CONFIG_ZLIB_DEFLATE=m
+CONFIG_ZLIB_INFLATE=y
+CONFIG_ZNET=m
+CONFIG_ZONE_DMA=y
+# CONFIG_ZONE_DMA32 is not set
+CONFIG_ZONE_DMA_FLAG=1
--- linux-rt-2.6.31.orig/debian/abi/2.6.31-10.153/amd64/ignore.modules
+++ linux-rt-2.6.31/debian/abi/2.6.31-10.153/amd64/ignore.modules
@@ -0,0 +1 @@
+1
--- linux-rt-2.6.31.orig/debian/abi/2.6.31-10.153/amd64/ignore
+++ linux-rt-2.6.31/debian/abi/2.6.31-10.153/amd64/ignore
@@ -0,0 +1 @@
+1
--- linux-rt-2.6.31.orig/debian/abi/2.6.31-10.153/i386/ignore.modules
+++ linux-rt-2.6.31/debian/abi/2.6.31-10.153/i386/ignore.modules
@@ -0,0 +1 @@
+1
--- linux-rt-2.6.31.orig/debian/abi/2.6.31-10.153/i386/ignore
+++ linux-rt-2.6.31/debian/abi/2.6.31-10.153/i386/ignore
@@ -0,0 +1 @@
+1
--- linux-rt-2.6.31.orig/debian/commit-templates/newrelease
+++ linux-rt-2.6.31/debian/commit-templates/newrelease
@@ -0,0 +1,3 @@
+UBUNTU: Start new release
+
+Ignore: yes
--- linux-rt-2.6.31.orig/debian/commit-templates/config-updates
+++ linux-rt-2.6.31/debian/commit-templates/config-updates
@@ -0,0 +1,15 @@
+#
+# This template is used for commit messages that don't need to
+# show up in debian/changelog. Administrative stuff like config
+# updates, ABI bumps, etc. Setting 'Ignore: yes' prevents
+# 'debian/rules insertchanges' from inserting this commit meesage
+# as a changelog entry.
+#
+# Please give a one-line description of the config change followed
+# by a detailed explanation if necessary
+
+UBUNTU: [Config] XXXX
+
+# BugLink: http://bugs.launchpad.net/bugs/<enter bug# here>
+# Ignore: yes
+# Other text below here.
--- linux-rt-2.6.31.orig/debian/commit-templates/bumpabi
+++ linux-rt-2.6.31/debian/commit-templates/bumpabi
@@ -0,0 +1,3 @@
+UBUNTU: Bump ABI
+
+Ignore: yes
--- linux-rt-2.6.31.orig/debian/commit-templates/upstream-patch
+++ linux-rt-2.6.31/debian/commit-templates/upstream-patch
@@ -0,0 +1,27 @@
+# Ubuntu commit template.
+#
+# NOTE: This gets reformatted for debian/changelog
+#
+# The initial UBUNTU is a flag that this is an Ubuntu commit. It will be
+# referenced to the Author in the debian/changelog entry.
+#
+# The text following is the short message that will be placed in the
+# changelog. Extra text on the following lines will be ignored, but left
+# in the git commit. Lines with # will be ignored in the commit.
+#
+# OriginalAuthor allows for alternate attribution.
+#
+# OriginalLocation allows for a URL or description of where the patch came
+# from.
+#
+# BugLink is a URL to a Malone bug.
+#
+# Ignore: yes will keep this commit from showing up in the changelog.
+#
+UBUNTU: [Upstream]
+
+# OriginalAuthor: 
+# OriginalLocation: 
+# BugLink: http://bugs.launchpad.net/bugs/<enter bug# here>
+# Ignore: yes
+# Other text below here.
--- linux-rt-2.6.31.orig/debian/commit-templates/patch
+++ linux-rt-2.6.31/debian/commit-templates/patch
@@ -0,0 +1,28 @@
+# Ubuntu commit template.
+#
+# NOTE: This gets reformatted for debian/changelog
+#
+# The initial UBUNTU is a flag that this is an Ubuntu commit. It will be
+# referenced to the Author in the debian/changelog entry.
+#
+# The text following is the short message that will be placed in the
+# changelog. Extra text on the following lines will be ignored, but left
+# in the git commit. Lines with # will be ignored in the commit.
+#
+# OriginalAuthor allows for alternate attribution.
+#
+# OriginalLocation allows for a URL or description of where the patch came
+# from.
+#
+# Bug is a reference to a Malone bug number. Be sure to include the '#' as
+# part of the bug number, e.g., 'Bug: #1'.
+#
+# Ignore: yes will keep this commit from showing up in the changelog.
+#
+UBUNTU: 
+
+# OriginalAuthor: 
+# OriginalLocation: 
+# Bug: #
+# Ignore: yes
+# Other text below here.
--- linux-rt-2.6.31.orig/debian/commit-templates/update-configs
+++ linux-rt-2.6.31/debian/commit-templates/update-configs
@@ -0,0 +1,10 @@
+#
+# This template is used for commit messages that don't need to
+# show up in debian/changelog. Administrative stuff like config
+# updates, ABI bumps, etc. Setting 'Ignore: yes' prevents
+# 'debian/rules insertchanges' from inserting this commit meesage
+# as a changelog entry.
+#
+UBUNTU: Updating configs
+
+Ignore: yes
--- linux-rt-2.6.31.orig/debian/commit-templates/missing-modules
+++ linux-rt-2.6.31/debian/commit-templates/missing-modules
@@ -0,0 +1,3 @@
+UBUNTU: build/modules: Add modules that have intentionally gone missing
+
+Ignore: yes
--- linux-rt-2.6.31.orig/debian/commit-templates/sauce-patch
+++ linux-rt-2.6.31/debian/commit-templates/sauce-patch
@@ -0,0 +1,38 @@
+# Ubuntu commit template.
+#
+# NOTE: This gets reformatted for debian/changelog
+#
+#
+# SAUCE refers to the fact that this patch might not go upstream, but we need to
+# carry it to successive releases. In most cases you DONOT want to use this
+# template. 
+#
+# An example of a SAUCE patch is the ACPI DSDT-in-initramfs patch which has been
+# refused upstream, but still provides useful functionality to users with broken
+# BIOSes.
+#
+#-------------------------------------------------------------------------
+#
+# The initial UBUNTU is a flag that this is an Ubuntu commit. It will be
+# referenced to the Author in the debian/changelog entry.
+#
+# The text following is the short message that will be placed in the
+# changelog. Extra text on the following lines will be ignored, but left
+# in the git commit. Lines with # will be ignored in the commit.
+#
+# OriginalAuthor allows for alternate attribution.
+#
+# OriginalLocation allows for a URL or description of where the patch came
+# from.
+#
+# Bug is a reference to a Malone bug number.
+#
+# Ignore: yes will keep this commit from showing up in the changelog.
+#
+UBUNTU: SAUCE: 
+
+# OriginalAuthor: 
+# OriginalLocation: 
+# Bug: #
+# Ignore: yes
+# Other text below here.
--- linux-rt-2.6.31.orig/debian/commit-templates/external-driver
+++ linux-rt-2.6.31/debian/commit-templates/external-driver
@@ -0,0 +1,20 @@
+# Ubuntu external driver commit.
+#
+# NOTE: This gets reformatted for README.Ubuntu-External-Drivers and
+# debian/changelog.
+#
+# This is only needed when a driver is added, updated or removed. It is
+# not needed when patches or fixes are applied to the driver. If the
+# driver is being removed, add the line:
+#
+# Removing: yes
+#
+# to the commit, and you can remove all other tags (except UBUNTU:).
+#
+UBUNTU: 
+
+ExternalDriver: 
+Description:
+Url:
+Mask:
+Version:
--- linux-rt-2.6.31.orig/debian/control-scripts/postrm
+++ linux-rt-2.6.31/debian/control-scripts/postrm
@@ -0,0 +1,353 @@
+#! /usr/bin/perl
+#                              -*- Mode: Cperl -*- 
+# image.postrm --- 
+# Author           : Manoj Srivastava ( srivasta@glaurung.green-gryphon.com ) 
+# Created On       : Sat May 15 11:05:13 1999
+# Created On Node  : glaurung.green-gryphon.com
+# Last Modified By : Manoj Srivastava
+# Last Modified On : Wed Sep 13 11:26:19 2006
+# Last Machine Used: glaurung.internal.golden-gryphon.com
+# Update Count     : 57
+# Status           : Unknown, Use with caution!
+# HISTORY          : 
+# Description      : 
+# 
+#     $Id: image.postrm,v 1.31 2003/10/07 16:24:20 srivasta Exp $
+#
+
+
+# 
+#use strict; #for debugging
+use Cwd 'abs_path';
+
+$|=1;
+
+# Predefined values:
+my $version           = "=V";
+my $link_in_boot      = "";	# Should be empty, mostly
+my $no_symlink        = "";	# Should be empty, mostly
+my $reverse_symlink   = "";	# Should be empty, mostly
+my $do_symlink        = "Yes";	# target machine defined
+my $do_boot_enable    = "Yes";	# target machine defined
+my $do_bootfloppy     = "Yes";	# target machine defined
+my $do_bootloader     = "Yes";	# target machine defined
+my $move_image        = '';       # target machine defined
+my $kimage            = "=K";	# Should be empty, mostly
+my $loader            = "=L";     # lilo, silo, quik, palo, vmelilo, or nettrom
+my $image_dir         = "/boot";     # where the image is located
+my $clobber_modules   = '';       # target machine defined
+my $initrd            = "YES";     # initrd kernel
+my $do_initrd         = '';       # Normally, we don't
+my $warn_initrd       = 'YES';    # Normally we do
+my $use_hard_links    = '';       # hardlinks do not work across fs boundaries
+my $postinst_hook     = '';       #Normally we do not
+my $postrm_hook       = '';       #Normally we do not
+my $preinst_hook      = '';       #Normally we do not
+my $prerm_hook        = '';       #Normally we do not
+my $minimal_swap      = '';       # Do not swap symlinks
+my $ignore_depmod_err = '';	# normally we do not
+my $relink_build_link = 'YES';	# There is no harm in checking the link
+my $force_build_link  = '';	# we shall not create a dangling link
+my $kernel_arch       = "=B";
+my $ramdisk           = "/usr/sbin/update-initramfs";
+my $package_name    = "linux-image-$version";
+
+my $Loader          = "NoLOADER"; # 
+$Loader             = "LILO"     if $loader =~ /^lilo/io;
+$Loader             = "SILO"     if $loader =~ /^silo/io;
+$Loader             = "QUIK"     if $loader =~ /^quik/io;
+$Loader             = "yaboot"   if $loader =~ /^yaboot/io;
+$Loader             = "PALO"     if $loader =~ /^palo/io;
+$Loader             = "NETTROM"  if $loader =~ /^nettrom/io;
+$Loader             = "VMELILO"  if $loader =~ /^vmelilo/io;
+$Loader             = "ZIPL"     if $loader =~ /^zipl/io;
+$Loader             = "ELILO"    if $loader =~ /^elilo/io;
+
+
+# This should not point to /tmp, because of security risks.
+my $temp_file_name = "/var/log/$loader" . "_log.$$";
+
+#known variables
+my @boilerplate     = ();
+my @silotemplate    = ();
+my @quiktemplate    = ();
+my @palotemplate    = ();
+my @vmelilotemplate = ();
+my $bootdevice      = '';
+my $rootdevice      = '';
+my $rootdisk        = '';
+my $rootpartition   = '';
+my $image_dest      = "/";
+my $realimageloc    = "/$image_dir/";
+my $have_conffile   = "";
+my $CONF_LOC        = '/etc/kernel-img.conf';
+my $relative_links = '';
+my $silent_modules  = '';
+my $silent_loader   = '';
+my $warn_reboot     = 'Yes';     # Warn that we are installing a version of
+                                 # the kernel we are running
+
+chdir('/')           or die "could not chdir to /:$!\n";
+# remove multiple leading slashes; make sure there is at least one.
+$realimageloc  =~ s|^/*|/|o;
+$realimageloc  =~ s|/+|/|o;
+
+
+if (-r "$CONF_LOC" && -f "$CONF_LOC"  ) {
+  if (open(CONF, "$CONF_LOC")) {
+    while (<CONF>) {
+      chomp;
+      s/\#.*$//g;
+      next if /^\s*$/;
+
+      $do_symlink      = "" if /^\s*do_symlinks\s*=\s*(no|false|0)\s*$/ig;
+      $no_symlink      = "" if /^\s*no_symlinks\s*=\s*(no|false|0)\s*$/ig;
+      $reverse_symlink = "" if /^\s*reverse_symlinks\s*=\s*(no|false|0)\s*$/ig;
+      $link_in_boot    = "" if /^\s*image_in_boot\s*=\s*(no|false|0)\s*$/ig;
+      $link_in_boot    = "" if /^\s*link_in_boot\s*=\s*(no|false|0)\s*$/ig;
+      $move_image      = "" if /^\s*move_image\s*=\s*(no|false|0)\s*$/ig;
+      $clobber_modules = '' if /^\s*clobber_modules\s*=\s*(no|false|0)\s*$/ig;
+      $do_boot_enable  = '' if /^\s*do_boot_enable\s*=\s*(no|false|0)\s*$/ig;
+      $do_bootfloppy   = '' if /^\s*do_bootfloppy\s*=\s*(no|false|0)\s*$/ig;
+      $relative_links  = '' if /^\s*relative_links \s*=\s*(no|false|0)\s*$/ig;
+      $do_bootloader   = '' if /^\s*do_bootloader\s*=\s*(no|false|0)\s*$/ig;
+      $do_initrd       = '' if /^\s*do_initrd\s*=\s*(no|false|0)\s*$/ig;
+      $warn_initrd     = '' if /^\s*warn_initrd\s*=\s*(no|false|0)\s*$/ig;
+      $use_hard_links  = '' if /^\s*use_hard_links\s*=\s*(no|false|0)\s*$/ig;
+      $silent_modules  = '' if /^\s*silent_modules\s*=\s*(no|false|0)\s*$/ig;
+      $silent_loader   = '' if /^\s*silent_loader\s*=\s*(no|false|0)\s*$/ig;
+      $warn_reboot     = '' if /^\s*warn_reboot\s*=\s*(no|false|0)\s*$/ig;
+      $minimal_swap    = '' if /^\s*minimal_swap\s*=\s*(no|false|0)\s*$/ig;
+      $ignore_depmod_err = '' if /^\s*ignore_depmod_err\s*=\s*(no|false|0)\s*$/ig;
+      $relink_build_link = '' if /^\s*relink_build_link\s*=\s*(no|false|0)\s*$/ig;
+      $force_build_link = '' if /^\s*force_build_link\s*=\s*(no|false|0)\s*$/ig;
+
+      $do_symlink      = "Yes" if /^\s*do_symlinks\s*=\s*(yes|true|1)\s*$/ig;
+      $no_symlink      = "Yes" if /^\s*no_symlinks\s*=\s*(yes|true|1)\s*$/ig;
+      $reverse_symlink = "Yes" if /^\s*reverse_symlinks\s*=\s*(yes|true|1)\s*$/ig;
+      $link_in_boot    = "Yes" if /^\s*image_in_boot\s*=\s*(yes|true|1)\s*$/ig;
+      $link_in_boot    = "Yes" if /^\s*link_in_boot\s*=\s*(yes|true|1)\s*$/ig;
+      $move_image      = "Yes" if /^\s*move_image\s*=\s*(yes|true|1)\s*$/ig;
+      $clobber_modules = "Yes" if /^\s*clobber_modules\s*=\s*(yes|true|1)\s*$/ig;
+      $do_boot_enable  = "Yes" if /^\s*do_boot_enable\s*=\s*(yes|true|1)\s*$/ig;
+      $do_bootfloppy   = "Yes" if /^\s*do_bootfloppy\s*=\s*(yes|true|1)\s*$/ig;
+      $do_bootloader   = "Yes" if /^\s*do_bootloader\s*=\s*(yes|true|1)\s*$/ig;
+      $relative_links  = "Yes" if /^\s*relative_links\s*=\s*(yes|true|1)\s*$/ig;
+      $do_initrd       = "Yes" if /^\s*do_initrd\s*=\s*(yes|true|1)\s*$/ig;
+      $warn_initrd     = "Yes" if /^\s*warn_initrd\s*=\s*(yes|true|1)\s*$/ig;
+      $use_hard_links  = "Yes" if /^\s*use_hard_links\s*=\s*(yes|true|1)\s*$/ig;
+      $silent_modules  = 'Yes' if /^\s*silent_modules\s*=\s*(yes|true|1)\s*$/ig;
+      $silent_loader   = 'Yes' if /^\s*silent_loader\s*=\s*(yes|true|1)\s*$/ig;
+      $warn_reboot     = 'Yes' if /^\s*warn_reboot\s*=\s*(yes|true|1)\s*$/ig;
+      $minimal_swap    = 'Yes' if /^\s*minimal_swap\s*=\s*(yes|true|1)\s*$/ig;
+      $ignore_depmod_err = 'Yes' if /^\s*ignore_depmod_err\s*=\s*(yes|true|1)\s*$/ig;
+      $relink_build_link = 'Yes' if /^\s*relink_build_link\s*=\s*(yes|true|1)\s*$/ig;
+      $force_build_link = 'Yes' if /^\s*force_build_link\s*=\s*(yes|true|1)\s*$/ig;
+
+      $image_dest      = "$1"  if /^\s*image_dest\s*=\s*(\S+)/ig;
+      $postinst_hook   = "$1"  if /^\s*postinst_hook\s*=\s*(\S+)/ig;
+      $postrm_hook     = "$1"  if /^\s*postrm_hook\s*=\s*(\S+)/ig;
+      $preinst_hook    = "$1"  if /^\s*preinst_hook\s*=\s*(\S+)/ig;
+      $prerm_hook      = "$1"  if /^\s*prerm_hook\s*=\s*(\S+)/ig;
+      $ramdisk         = "$1"  if /^\s*ramdisk\s*=\s*(.+)$/ig;
+    }
+    close CONF;
+    $have_conffile = "Yes";
+  }
+}
+
+if ($link_in_boot) {
+  $image_dest = "/$image_dir/";
+  $image_dest =~ s|^/*|/|o;
+}
+
+$image_dest = "$image_dest/";
+$image_dest =~ s|/+$|/|o;
+
+# The destdir may be gone by now.
+if (-d "$image_dest") {
+  chdir("$image_dest") or die "could not chdir to $image_dest:$!\n";
+}
+
+# Paranoid check to make sure that the correct value is put in there
+if (! $kimage)                    {$kimage = "vmlinuz"} # Hmm. empty
+elsif ($kimage =~ m/^b?zImage$/o) {$kimage = "vmlinuz"} # these produce vmlinuz
+elsif ($kimage =~ m/^[iI]mage$/o) { my $nop = $kimage;}
+elsif ($kimage =~ m/^vmlinux$/o)  { my $nop = $kimage;}
+else                              {$kimage = "vmlinuz"} # default
+
+$ENV{KERNEL_ARCH}=$kernel_arch if $kernel_arch;
+
+
+######################################################################
+######################################################################
+############
+######################################################################
+######################################################################
+sub remove_sym_link {
+  my $bad_image = $_[0];
+
+  warn "Removing symbolic link $bad_image \n";
+  if ($loader =~ /lilo/i) 
+    {
+      warn "Unless you used the optional flag in lilo, \n";
+    }
+  warn " you may need to re-run your boot loader" . ($loader ? "[$loader]":"")
+    . "\n";
+  # Remove the dangling link
+  unlink "$bad_image";
+}
+
+######################################################################
+######################################################################
+############
+######################################################################
+######################################################################
+sub CanonicalizePath {
+  my $path = join '/', @_;
+  my @work = split '/', $path;
+  my @out;
+  my $is_absolute;
+
+  if (@work && $work[0] eq "") { $is_absolute = 1; shift @work; }
+
+  while (@work) {
+    my $seg = shift @work;
+    if ($seg eq "." || $seg eq "") {
+    } elsif ($seg eq "..") {
+      if (@out && $out[-1] ne "..") {
+        pop @out;
+      } else {
+        # Leading "..", or "../..", etc.
+        push @out, $seg;
+      }
+    } else {
+      push @out, $seg;
+    }
+  }
+
+  unshift @out, "" if $is_absolute;
+  return join('/', @out);
+}
+
+######################################################################
+######################################################################
+############
+######################################################################
+######################################################################
+# This removes dangling symlinks. What do we do about hard links? Surely a 
+# something with the nane $image_dest . "$kimage" ought not to be left behind? 
+sub image_magic {
+  my $kimage = $_[0];
+  my $image_dest = $_[1];
+
+  if (-l "$kimage") {
+    # There is a symbolic link
+    my $force_move = 0;
+    my $vmlinuz_target = readlink "$kimage";
+    my $real_target = '';
+    $real_target = abs_path($vmlinuz_target) if defined ($vmlinuz_target);
+    if (!defined($vmlinuz_target) || ! -f "$real_target") {
+      # what, a dangling symlink?
+      warn "The link "  . $image_dest . "$kimage is a damaged link\n";
+      # Remove the dangling link
+      &remove_sym_link("$kimage");
+    }
+    else {
+      my $canonical_target = CanonicalizePath("$vmlinuz_target");
+      if (! -e $canonical_target) {
+	warn "The link "  . $image_dest . "$kimage is a dangling link\n";
+	&remove_sym_link("$kimage");
+      }
+    }
+  }
+}
+
+# set the env var stem
+$ENV{'STEM'} = "linux";
+
+sub exec_script {
+  my $type   = shift;
+  my $script = shift;
+  print STDERR "Running $type hook script $script.\n";
+  system ("$script $version $realimageloc$kimage-$version") &&
+    print STDERR "User $type hook script [$script] ";
+  if ($?) {
+    if ($? == -1) {
+      print STDERR "failed to execute: $!\n";
+    }
+    elsif ($? & 127) {
+      printf STDERR "died with signal %d, %s coredump\n",
+        ($? & 127),  ($? & 128) ? 'with' : 'without';
+    }
+    else {
+      printf STDERR "exited with value %d\n", $? >> 8;
+    }
+  }
+}
+sub run_hook {
+  my $type   = shift;
+  my $script = shift;
+  if ($script =~ m,^/,) {
+    # Full path provided for the hook script
+    if (-x "$script") {
+      &exec_script($type,$script);
+    }
+    else {
+      warn "The provided $type hook script [$script] could not be run.\n";
+    }
+  }
+  else {
+    # Look for it in a safe path
+    for my $path ('/bin', '/sbin', '/usr/bin', '/usr/sbin') {
+      if (-x "$path/$script") {
+        &exec_script($type, "$path/$script");
+        return 0;
+      }
+    }
+    # No luck
+    print STDERR "Could not find $type hook script [$script].\n";
+    warn "Looked in: '/bin', '/sbin', '/usr/bin', '/usr/sbin'\n";
+  }
+}
+
+## Run user hook script here, if any
+if ($postrm_hook) {
+  &run_hook("postrm", $postrm_hook);
+}
+if (-d "/etc/kernel/postrm.d") {
+  warn "Examining /etc/kernel/postrm.d .\n";
+  system ("run-parts --verbose --exit-on-error --arg=$version " .
+          "--arg=$realimageloc$kimage-$version " .
+          "/etc/kernel/postrm.d") &&
+            die "Failed to process /etc/kernel/postrm.d";
+}
+if (-d "/etc/kernel/postrm.d/$version") {
+  warn "Examining /etc/kernel/postrm.d/$version .\n";
+  system ("run-parts --verbose --exit-on-error --arg=$version " .
+          "--arg=$realimageloc$kimage-$version " .
+          "/etc/kernel/postrm.d/$version") &&
+            die "Failed to process /etc/kernel/postrm.d/$version";
+}
+
+# check and remove damaged and dangling symlinks
+if ($ARGV[0] !~ /upgrade/) {
+  system("$ramdisk -d -k " . $version . " > /dev/null 2>&1");
+  if (-f $realimageloc . "initrd.img-$version.bak") {
+    unlink $realimageloc . "initrd.img-$version.bak";
+  }
+  image_magic($kimage,          $image_dest);
+  image_magic($kimage . ".old", $image_dest);
+  image_magic("initrd.img",     $image_dest) if $initrd;
+  image_magic("initrd.img.old", $image_dest) if $initrd;
+}
+
+exit 0;
+
+__END__
+
+
+
+
+
+
--- linux-rt-2.6.31.orig/debian/control-scripts/preinst
+++ linux-rt-2.6.31/debian/control-scripts/preinst
@@ -0,0 +1,299 @@
+#! /usr/bin/perl
+#                              -*- Mode: Cperl -*-
+# image.preinst ---
+# Author           : Manoj Srivastava ( srivasta@tiamat.datasync.com )
+# Created On       : Sun Jun 14 03:38:02 1998
+# Created On Node  : tiamat.datasync.com
+# Last Modified By : Manoj Srivastava
+# Last Modified On : Sun Sep 24 14:04:42 2006
+# Last Machine Used: glaurung.internal.golden-gryphon.com
+# Update Count     : 99
+# Status           : Unknown, Use with caution!
+# HISTORY          :
+# Description      :
+#
+#
+
+#
+#use strict; #for debugging
+
+use Debconf::Client::ConfModule qw(:all);
+version('2.0');
+my $capb=capb("backup");
+
+$|=1;
+
+# Predefined values:
+my $version         = "=V";
+my $link_in_boot    = "";     # Should be empty, mostly
+my $no_symlink      = "";     # Should be empty, mostly
+my $reverse_symlink = "";     # Should be empty, mostly
+my $do_symlink      = "Yes";	# target machine defined
+my $do_boot_enable  = "Yes";	# target machine defined
+my $do_bootfloppy   = "Yes";	# target machine defined
+my $do_bootloader   = "Yes";	# target machine defined
+my $move_image      = '';       # target machine defined
+my $kimage          = "=K";     # Should be empty, mostly
+my $loader          = "=L";     # lilo, silo, quik, palo, vmelilo, nettrom
+                                # or elilo
+my $image_dir       = "/boot";     # where the image is located
+my $initrd          = "YES";     # initrd kernel
+my $use_hard_links  = '';       # hardlinks do not wirk across fs boundaries
+my $postinst_hook   = '';       #Normally we do not
+my $postrm_hook     = '';       #Normally we do not
+my $preinst_hook    = '';       #Normally we do not
+my $prerm_hook      = '';       #Normally we do not
+my $minimal_swap    = '';       # Do not swap symlinks
+my $ignore_depmod_err = '';    # normally we do not
+my $relink_src_link   = 'YES';	# There is no harm in checking the link
+my $relink_build_link = 'YES'; # There is no harm in checking the link
+my $force_build_link  = '';	 # There is no harm in checking the link
+my $kernel_arch       = "=B";
+my $ramdisk           = "/usr/sbin/update-initramfs";  # List of tools to create initial ram fs.
+my $package_name    = "linux-image-$version";
+
+my $Loader          = "NoLOADER"; #
+$Loader             = "LILO"     if $loader =~ /^lilo/io;
+$Loader             = "SILO"     if $loader =~ /^silo/io;
+$Loader             = "QUIK"     if $loader =~ /^quik/io;
+$Loader             = "yaboot"   if $loader =~ /^yaboot/io;
+$Loader             = "PALO"     if $loader =~ /^palo/io;
+$Loader             = "NETTROM"  if $loader =~ /^nettrom/io;
+$Loader             = "VMELILO"  if $loader =~ /^vmelilo/io;
+$Loader             = "ZIPL"     if $loader =~ /^zipl/io;
+$Loader             = "ELILO"    if $loader =~ /^elilo/io;
+
+
+#known variables
+my @boilerplate     = ();
+my @silotemplate    = ();
+my @quiktemplate    = ();
+my @palotemplate    = ();
+my @vmelilotemplate = ();
+my $bootdevice      = '';
+my $rootdevice      = '';
+my $rootdisk        = '';
+my $rootpartition   = '';
+my $image_dest      = "/";
+my $realimageloc    = "/$image_dir/";
+my $have_conffile   = "";
+my $CONF_LOC        = '/etc/kernel-img.conf';
+my $relative_links  = '';
+my $silent_loader   = '';
+my $warn_reboot     = '';        # Warn that we are installing a version of
+                                 # the kernel we are running
+
+my $modules_base    = '/lib/modules';
+
+die "Pre inst Internal error. Aborting." unless $version;
+
+exit 0 if $ARGV[0] =~ /abort-upgrade/;
+exit 1 unless $ARGV[0] =~ /(install|upgrade)/;
+
+# remove multiple leading slashes; make sure there is at least one.
+$realimageloc  =~ s|^/*|/|o;
+$realimageloc  =~ s|/+|/|o;
+
+if (-r "$CONF_LOC" && -f "$CONF_LOC"  ) {
+  if (open(CONF, "$CONF_LOC")) {
+    while (<CONF>) {
+      chomp;
+      s/\#.*$//g;
+      next if /^\s*$/;
+
+      $do_symlink      = "" if /^\s*do_symlinks\s*=\s*(no|false|0)\s*$/ig;
+      $no_symlink      = "" if /^\s*no_symlinks\s*=\s*(no|false|0)\s*$/ig;
+      $reverse_symlink = "" if /^\s*reverse_symlinks\s*=\s*(no|false|0)\s*$/ig;
+      $link_in_boot    = "" if /^\s*image_in_boot\s*=\s*(no|false|0)\s*$/ig;
+      $link_in_boot    = "" if /^\s*link_in_boot\s*=\s*(no|false|0)\s*$/ig;
+      $move_image      = "" if /^\s*move_image\s*=\s*(no|false|0)\s*$/ig;
+      $do_boot_enable  = '' if /^\s*do_boot_enable\s*=\s*(no|false|0)\s*$/ig;
+      $do_bootfloppy   = '' if /^\s*do_bootfloppy\s*=\s*(no|false|0)\s*$/ig;
+      $do_bootloader   = '' if /^\s*do_bootloader\s*=\s*(no|false|0)\s*$/ig;
+      $relative_links  = '' if /^\s*relative_links \s*=\s*(no|false|0)\s*$/ig;
+      $use_hard_links  = '' if /^\s*use_hard_links\s*=\s*(no|false|0)\s*$/ig;
+      $silent_loader   = '' if /^\s*silent_loader\s*=\s*(no|false|0)\s*$/ig;
+      $warn_reboot     = '' if /^\s*warn_reboot\s*=\s*(no|false|0)\s*$/ig;
+      $minimal_swap    = '' if /^\s*minimal_swap\s*=\s*(no|false|0)\s*$/ig;
+      $ignore_depmod_err = '' if /^\s*ignore_depmod_err\s*=\s*(no|false|0)\s*$/ig;
+      $relink_src_link   = '' if /^\s*relink_src_link\s*=\s*(no|false|0)\s*$/ig;
+      $relink_build_link = '' if /^\s*relink_build_link\s*=\s*(no|false|0)\s*$/ig;
+      $force_build_link = '' if /^\s*force_build_link\s*=\s*(no|false|0)\s*$/ig;
+
+      $do_symlink      = "Yes" if /^\s*do_symlinks\s*=\s*(yes|true|1)\s*$/ig;
+      $no_symlink      = "Yes" if /^\s*no_symlinks\s*=\s*(yes|true|1)\s*$/ig;
+      $reverse_symlink = "Yes" if /^\s*reverse_symlinks\s*=\s*(yes|true|1)\s*$/ig;
+      $link_in_boot    = "Yes" if /^\s*image_in_boot\s*=\s*(yes|true|1)\s*$/ig;
+      $link_in_boot    = "Yes" if /^\s*link_in_boot\s*=\s*(yes|true|1)\s*$/ig;
+      $move_image      = "Yes" if /^\s*move_image\s*=\s*(yes|true|1)\s*$/ig;
+      $do_boot_enable  = "Yes" if /^\s*do_boot_enable\s*=\s*(yes|true|1)\s*$/ig;
+      $do_bootfloppy   = "Yes" if /^\s*do_bootfloppy\s*=\s*(yes|true|1)\s*$/ig;
+      $do_bootloader   = "Yes" if /^\s*do_bootloader\s*=\s*(yes|true|1)\s*$/ig;
+      $relative_links  = "Yes" if /^\s*relative_links\s*=\s*(yes|true|1)\s*$/ig;
+      $use_hard_links  = "Yes" if /^\s*use_hard_links\s*=\s*(yes|true|1)\s*$/ig;
+      $silent_loader   = 'Yes' if /^\s*silent_loader\s*=\s*(yes|true|1)\s*$/ig;
+      $warn_reboot     = 'Yes' if /^\s*warn_reboot\s*=\s*(yes|true|1)\s*$/ig;
+      $minimal_swap    = 'Yes' if /^\s*minimal_swap\s*=\s*(yes|true|1)\s*$/ig;
+      $ignore_depmod_err = 'Yes' if /^\s*ignore_depmod_err\s*=\s*(yes|true|1)\s*$/ig;
+      $relink_src_link   = 'Yes' if /^\s*relink_src_link\s*=\s*(yes|true|1)\s*$/ig;
+      $relink_build_link = 'Yes' if /^\s*relink_build_link\s*=\s*(yes|true|1)\s*$/ig;
+      $force_build_link = 'Yes' if /^\s*force_build_link\s*=\s*(yes|true|1)\s*$/ig;
+
+      $image_dest      = "$1"  if /^\s*image_dest\s*=\s*(\S+)/ig;
+      $postinst_hook   = "$1"  if /^\s*postinst_hook\s*=\s*(\S+)/ig;
+      $postrm_hook     = "$1"  if /^\s*postrm_hook\s*=\s*(\S+)/ig;
+      $preinst_hook    = "$1"  if /^\s*preinst_hook\s*=\s*(\S+)/ig;
+      $prerm_hook      = "$1"  if /^\s*prerm_hook\s*=\s*(\S+)/ig;
+      $ramdisk         = "$1"  if /^\s*ramdisk\s*=\s*(.+)$/ig;
+    }
+    close CONF;
+    $have_conffile = "Yes";
+    $have_conffile = "Yes";	# stop perl complaining
+  }
+}
+
+$ENV{KERNEL_ARCH}=$kernel_arch if $kernel_arch;
+
+# About to upgrade this package from version $2 TO THIS VERSION.
+# "prerm upgrade" has already been called for the old version of
+# this package.
+
+sub find_initrd_tool {
+  my $hostversion = shift;
+  my $version = shift;
+  my @ramdisks =
+    grep {
+      my $args = 
+        "$_ " .
+          "--supported-host-version=$hostversion " .
+            "--supported-target-version=$version " .
+              "1>/dev/null 2>&1"
+                ;
+      system($args) == 0;
+    }
+      split (/[:,\s]+/, $ramdisk);
+}
+
+sub check {
+  my $version = shift;
+  my $lib_modules="$modules_base/$version";
+  my $message = '';
+
+  if (-d "$lib_modules") {
+    opendir(DIR, $lib_modules) || die "can’t opendir $lib_modules: $!";
+    my @children = readdir(DIR);
+    if ($#children > 1) {
+      my @dirs  = grep { -d "$lib_modules/$_" } @children;
+      if ($#dirs > 1) { # we have subdirs
+        my $dir_message='';
+        for my $dir (@dirs) {
+          if ($dir =~/kernel$/) {
+            $dir_message="An older install was detected.\n";
+          }
+          else {
+            $dir_message="Module sub-directories were detected.\n"
+              unless $dir_message;
+          }
+        }
+        $message += $dir_message if $dir_message;
+      }
+
+      my @links = grep { -l "$lib_modules/$_" } @children;
+      if ($#links > -1) {
+        my $links_message = '';
+        for my $link (@links) {
+          next if ($link =~ /^build$/);
+          next if ($link =~ /^source$/);
+          $links_message = "Symbolic links were detected in $modules_base/$version.\n";
+        }
+        $message += $links_message if $links_message;
+      }
+      my @files = grep { -f "$lib_modules/$_" } @children;
+      $message += "Additional files also exist in $modules_base/$version.\n"
+        if ($#files > -1);
+    }
+  }
+  else { $message .= "$lib_modules does not exist. ";}
+  return $message;
+}
+
+if (-d "$modules_base/$version") {
+  my $errors=check($version);
+  warn "Info:\n$errors\n" if $errors;
+}
+
+# set the env var stem
+$ENV{'STEM'} = "linux";
+
+sub exec_script {
+  my $type   = shift;
+  my $script = shift;
+  print STDERR "Running $type hook script $script.\n";
+  system ("$script $version $realimageloc$kimage-$version") &&
+    print STDERR "User $type hook script [$script] ";
+  if ($?) {
+    if ($? == -1) {
+      print STDERR "failed to execute: $!\n";
+    }
+    elsif ($? & 127) {
+      printf STDERR "died with signal %d, %s coredump\n",
+        ($? & 127),  ($? & 128) ? 'with' : 'without';
+    }
+    else {
+      printf STDERR "exited with value %d\n", $? >> 8;
+    }
+    exit $? >> 8;
+  }
+}
+sub run_hook {
+  my $type   = shift;
+  my $script = shift;
+  if ($script =~ m,^/,) {
+    # Full path provided for the hook script
+    if (-x "$script") {
+      &exec_script($type,$script);
+    }
+    else {
+      die "The provided $type hook script [$script] could not be run.\n";
+    }
+  }
+  else {
+    # Look for it in a safe path
+    for my $path ('/bin', '/sbin', '/usr/bin', '/usr/sbin') {
+      if (-x "$path/$script") {
+        &exec_script($type, "$path/$script");
+        return 0;
+      }
+    }
+    # No luck
+    print STDERR "Could not find $type hook script [$script].\n";
+    die "Looked in: '/bin', '/sbin', '/usr/bin', '/usr/sbin'\n";
+  }
+}
+
+
+## Run user hook script here, if any
+if (-x "$preinst_hook") {
+  &run_hook("preinst", $preinst_hook);
+}
+if (-d "/etc/kernel/preinst.d") {
+  print STDERR "Examining /etc/kernel/preinst.d/\n";
+  system ("run-parts --verbose --exit-on-error --arg=$version" .
+          " --arg=$realimageloc$kimage-$version" .
+          " /etc/kernel/preinst.d") &&
+            die "Failed to process /etc/kernel/preinst.d";
+}
+if (-d "/etc/kernel/preinst.d/$version") {
+  print STDERR "Examining /etc/kernel/preinst.d/$version.\n";
+  system ("run-parts --verbose --exit-on-error --arg=$version" .
+          " --arg=$realimageloc$kimage-$version" .
+          " /etc/kernel/preinst.d/$version") &&
+            die "Failed to process /etc/kernel/preinst.d/$version";
+}
+print STDERR "Done.\n";
+
+exit 0;
+
+__END__
+
+
--- linux-rt-2.6.31.orig/debian/control-scripts/postinst
+++ linux-rt-2.6.31/debian/control-scripts/postinst
@@ -0,0 +1,1087 @@
+#! /usr/bin/perl
+# OriginalAuthor : Manoj Srivastava ( srivasta@pilgrim.umass.edu )
+#
+# Customized for Ubuntu by: Ben Collins <bcollins@ubuntu.com>
+
+#use strict; #for debugging
+use Cwd 'abs_path';
+
+$|=1;
+
+# Predefined values:
+my $version           = "=V";
+my $link_in_boot      = "";  # Should be empty, mostly
+my $no_symlink        = "";   # Should be empty, mostly
+my $reverse_symlink   = "";   # Should be empty, mostly
+my $do_symlink        = "Yes";  # target machine defined
+my $do_boot_enable    = "Yes";  # target machine defined
+my $do_bootfloppy     = "Yes";  # target machine defined
+my $do_bootloader     = "Yes";  # target machine defined
+my $move_image        = '';     # target machine defined
+my $kimage            = "=K";   # Should be empty, mostly
+my $loader            = "=L"; # lilo, silo, quik, palo, vmelilo, nettrom, arcboot or delo
+my $image_dir         = "/boot";        # where the image is located
+my $clobber_modules   = '';          # target machine defined
+my $relative_links    = "";          # target machine defined
+my $initrd            = "YES";        # initrd kernel
+my $do_initrd         = '';     # Normally we do not
+my $use_hard_links    = ''; # hardlinks do not work across fs boundaries
+my $postinst_hook     = '';          #Normally we do not
+my $postrm_hook       = '';          #Normally we do not
+my $preinst_hook      = '';          #Normally we do not
+my $prerm_hook        = '';          #Normally we do not
+my $minimal_swap      = '';          # Do not swap symlinks
+my $ignore_depmod_err = '';          # normally we do not
+my $kernel_arch       = "=B";
+my $ramdisk           = "/usr/sbin/update-initramfs";  # List of tools to create initial ram fs.
+my $notifier          = "/usr/share/update-notifier/notify-reboot-required";
+my $package_name      = "linux-image-$version";
+my $explicit_do_loader = 'Yes';
+
+my $Loader          = "NoLOADER"; #
+$Loader             = "LILO"     if $loader =~ /^lilo/io;
+$Loader             = "SILO"     if $loader =~ /^silo/io;
+$Loader             = "QUIK"     if $loader =~ /^quik/io;
+$Loader             = "yaboot"   if $loader =~ /^yaboot/io;
+$Loader             = "PALO"     if $loader =~ /^palo/io;
+$Loader             = "NETTROM"  if $loader =~ /^nettrom/io;
+$Loader             = "VMELILO"  if $loader =~ /^vmelilo/io;
+$Loader             = "ZIPL"     if $loader =~ /^zipl/io;
+$Loader             = "ELILO"    if $loader =~ /^elilo/io;
+$Loader             = "ARCBOOT"  if $loader =~ /^arcboot/io;
+$Loader             = "DELO"     if $loader =~ /^delo/io;
+
+# This should not point to /tmp, because of security risks.
+my $temp_file_name = "/var/log/$loader" . "_log.$$";
+
+#known variables
+my $image_dest      = "/";
+my $realimageloc    = "/$image_dir/";
+my $have_conffile   = "";
+my $silent_modules  = '';
+my $silent_loader   = '';
+my $warn_reboot     = 'Yes';     # Warn that we are installing a version of
+                                 # the kernel we are running
+
+my $modules_base    = '/lib/modules';
+my $CONF_LOC        = '/etc/kernel-img.conf';
+
+# Ignore all invocations except when called on to configure.
+exit 0 unless $ARGV[0] =~ /configure/;
+
+my $DEBUG = 0;
+
+# Do some preliminary sanity checks here to ensure we actually have an
+# valid image dir
+chdir('/')           or die "could not chdir to /:$!\n";
+die "Internal Error: ($image_dir) is not a directory!\n"
+  unless -d $image_dir;
+
+# remove multiple leading slashes; make sure there is at least one.
+$realimageloc  =~ s|^/*|/|o;
+$realimageloc  =~ s|/+|/|o;
+die "Internal Error: ($realimageloc) is not a directory!\n"
+  unless -d $realimageloc;
+
+if (-r "$CONF_LOC" && -f "$CONF_LOC"  ) {
+  if (open(CONF, "$CONF_LOC")) {
+    while (<CONF>) {
+      chomp;
+      s/\#.*$//g;
+      next if /^\s*$/;
+
+      $do_symlink      = "" if /^\s*do_symlinks\s*=\s*(no|false|0)\s*$/ig;
+      $no_symlink      = "" if /^\s*no_symlinks\s*=\s*(no|false|0)\s*$/ig;
+      $reverse_symlink = "" if /^\s*reverse_symlink\s*=\s*(no|false|0)\s*$/ig;
+      $link_in_boot    = "" if /^\s*image_in_boot\s*=\s*(no|false|0)\s*$/ig;
+      $link_in_boot    = "" if /^\s*link_in_boot\s*=\s*(no|false|0)\s*$/ig;
+      $move_image      = "" if /^\s*move_image\s*=\s*(no|false|0)\s*$/ig;
+      $clobber_modules = '' if /^\s*clobber_modules\s*=\s*(no|false|0)\s*$/ig;
+      $do_boot_enable  = '' if /^\s*do_boot_enable\s*=\s*(no|false|0)\s*$/ig;
+      $do_bootfloppy   = '' if /^\s*do_bootfloppy\s*=\s*(no|false|0)\s*$/ig;
+      $relative_links  = '' if /^\s*relative_links \s*=\s*(no|false|0)\s*$/ig;
+      $do_bootloader   = '' if /^\s*do_bootloader\s*=\s*(no|false|0)\s*$/ig;
+      $explicit_do_loader = '' if /^\s*do_bootloader\s*=\s*(no|false|0)\s*$/ig;
+      $do_initrd       = '' if /^\s*do_initrd\s*=\s*(no|false|0)\s*$/ig;
+      $use_hard_links  = '' if /^\s*use_hard_links\s*=\s*(no|false|0)\s*$/ig;
+      $silent_modules  = '' if /^\s*silent_modules\s*=\s*(no|false|0)\s*$/ig;
+      $silent_loader   = '' if /^\s*silent_loader\s*=\s*(no|false|0)\s*$/ig;
+      $warn_reboot     = '' if /^\s*warn_reboot\s*=\s*(no|false|0)\s*$/ig;
+      $minimal_swap    = '' if /^\s*minimal_swap\s*=\s*(no|false|0)\s*$/ig;
+      $ignore_depmod_err = '' if /^\s*ignore_depmod_err\s*=\s*(no|false|0)\s*$/ig;
+
+      $do_symlink      = "Yes" if /^\s*do_symlinks\s*=\s*(yes|true|1)\s*$/ig;
+      $no_symlink      = "Yes" if /^\s*no_symlinks\s*=\s*(yes|true|1)\s*$/ig;
+      $reverse_symlink = "Yes" if /^\s*reverse_symlinks\s*=\s*(yes|true|1)\s*$/ig;
+      $link_in_boot    = "Yes" if /^\s*image_in_boot\s*=\s*(yes|true|1)\s*$/ig;
+      $link_in_boot    = "Yes" if /^\s*link_in_boot\s*=\s*(yes|true|1)\s*$/ig;
+      $move_image      = "Yes" if /^\s*move_image\s*=\s*(yes|true|1)\s*$/ig;
+      $clobber_modules = "Yes" if /^\s*clobber_modules\s*=\s*(yes|true|1)\s*$/ig;
+      $do_boot_enable  = "Yes" if /^\s*do_boot_enable\s*=\s*(yes|true|1)\s*$/ig;
+      $do_bootfloppy   = "Yes" if /^\s*do_bootfloppy\s*=\s*(yes|true|1)\s*$/ig;
+      $do_bootloader   = "Yes" if /^\s*do_bootloader\s*=\s*(yes|true|1)\s*$/ig;
+      $explicit_do_loader = "YES" if /^\s*do_bootloader\s*=\s*(yes|true|1)\s*$/ig;
+      $relative_links  = "Yes" if /^\s*relative_links\s*=\s*(yes|true|1)\s*$/ig;
+      $do_initrd       = "Yes" if /^\s*do_initrd\s*=\s*(yes|true|1)\s*$/ig;
+      $use_hard_links  = "Yes" if /^\s*use_hard_links\s*=\s*(yes|true|1)\s*$/ig;
+      $silent_modules  = 'Yes' if /^\s*silent_modules\s*=\s*(yes|true|1)\s*$/ig;
+      $silent_loader   = 'Yes' if /^\s*silent_loader\s*=\s*(yes|true|1)\s*$/ig;
+      $warn_reboot     = 'Yes' if /^\s*warn_reboot\s*=\s*(yes|true|1)\s*$/ig;
+      $minimal_swap    = 'Yes' if /^\s*minimal_swap\s*=\s*(yes|true|1)\s*$/ig;
+      $ignore_depmod_err = 'Yes' if /^\s*ignore_depmod_err\s*=\s*(yes|true|1)\s*$/ig;
+
+      $image_dest      = "$1"  if /^\s*image_dest\s*=\s*(\S+)/ig;
+      $postinst_hook   = "$1"  if /^\s*postinst_hook\s*=\s*(\S+)/ig;
+      $postrm_hook     = "$1"  if /^\s*postrm_hook\s*=\s*(\S+)/ig;
+      $preinst_hook    = "$1"  if /^\s*preinst_hook\s*=\s*(\S+)/ig;
+      $prerm_hook      = "$1"  if /^\s*prerm_hook\s*=\s*(\S+)/ig;
+      $ramdisk         = "$1"  if /^\s*ramdisk\s*=\s*(.+)$/ig;
+    }
+    close CONF;
+    $have_conffile = "Yes";
+  }
+}
+
+
+
+# For some versions of kernel-package, we had this warning in the
+# postinst, but the rules did not really interpolate the value in.
+# Here is a sanity check.
+my $pattern = "=" . "I";
+$initrd=~ s/^$pattern$//;
+
+if ($link_in_boot) {
+  $image_dest = "/$image_dir/"; # same as realimageloc
+}
+
+# Tack on at least one trainling /
+$image_dest = "$image_dest/";
+$image_dest =~ s|^/*|/|o;
+$image_dest =~ s|/+$|/|o;
+
+if (! -d "$image_dest") {
+  die "Expected Image Destination dir ($image_dest) to be a valid directory!\n";
+}
+
+# sanity
+if (!($do_bootfloppy || $do_bootloader)) {
+  $do_boot_enable = '';
+}
+if ($do_symlink && $no_symlink) {
+  warn "Both do_symlinks and no_symlinks options enabled; disabling no_symlinks\n";
+  $no_symlink = 0;
+}
+
+# most of our work is done in $image_dest (nominally /)
+chdir("$image_dest") or die "could not chdir to $image_dest:$!\n";
+
+# Paranoid check to make sure that the correct value is put in there
+if    (! $kimage)                 { $kimage = "vmlinuz"; } # Hmm. empty
+elsif ($kimage =~ m/^b?zImage$/o) { $kimage = "vmlinuz"; } # these produce vmlinuz
+elsif ($kimage =~ m/^[iI]mage$/o) { my $nop = $kimage;   }
+elsif ($kimage =~ m/^vmlinux$/o)  { my $nop = $kimage;   }
+else                              { $kimage = "vmlinuz"; } # Default
+
+$ENV{KERNEL_ARCH}=$kernel_arch if $kernel_arch;
+
+
+die "Internal Error: Could not find image (" . $realimageloc
+  . "$kimage-$version)\n" unless -e $realimageloc
+  . "$kimage-$version";
+
+# search for the boot loader in the path
+my $loader_exec;
+($loader_exec = $loader)  =~ s|.*/||;
+my ($loaderloc) = grep -x, map "$_/$loader_exec",
+  map { length($_) ? $_ : "." }  split /:/, $ENV{PATH};
+
+
+######################################################################
+######################################################################
+###########        Test whether a relative symlinkwould be OK #######
+######################################################################
+######################################################################
+sub test_relative {
+  my %params = @_;
+  my $cwd;
+
+  die "Internal Error: Missing Required paramater 'Old Dir' "
+    unless $params{'Old Dir'};
+  die "Internal Error: Missing Required paramater New Dir' "
+    unless $params{'New Dir'};
+
+
+  die "Internal Error: No such dir $params{'Old Dir'} "
+    unless -d $params{'Old Dir'};
+  die "Internal Error: No such dir $params{'New Dir'} "
+    unless -d $params{'New Dir'};
+
+  warn "Test relative: testing $params{'Old Dir'} -> $params{'New Dir'}"
+    if $DEBUG;
+  chomp($cwd = `pwd`);
+  chdir ($params{'New Dir'}) or die "Could not chdir to $params{'New Dir'}:$!";
+  my $ok = 0;
+  $params{'Old Dir'}  =~ s|^/*||o;
+  if (-d $params{'Old Dir'} ) {
+    if (defined $params{'Test File'}) {
+      if (-e $params{'Old Dir'} . $params{'Test File'}) {
+        $ok  = 1;
+      }
+    } else {
+      $ok = 1;                  # well, backward compatibility
+    }
+  }
+  chdir ($cwd) or die "Could not chdir to $params{'New Dir'}:$!";
+  return $ok;
+}
+
+######################################################################
+######################################################################
+############
+######################################################################
+######################################################################
+# sub CanonicalizePath {
+#   my $path = join '/', @_;
+#   my @work = split '/', $path;
+#   my @out;
+#   my $is_absolute;
+
+#   if (@work && $work[0] eq "") {
+#     $is_absolute = 1; shift @work;
+#   }
+
+#   while (@work) {
+#     my $seg = shift @work;
+#     if ($seg eq "." || $seg eq "") {
+#     } 
+#     elsif ($seg eq "..") {
+#       if (@out && $out[-1] ne "..") {
+#         pop @out;
+#       } 
+#       else {
+#         # Leading "..", or "../..", etc.
+#         push @out, $seg;
+#       }
+#     } 
+#     else {
+#       push @out, $seg;
+#     }
+#   }
+
+#   unshift @out, "" if $is_absolute;
+#   return join('/', @out);
+# }
+######################################################################
+######################################################################
+############
+######################################################################
+######################################################################
+
+sub spath {
+  my %params = @_;
+
+  die "Missing Required paramater 'Old'" unless $params{'Old'};
+  die "Missing Required paramater 'New'" unless  $params{'New'};
+
+  my @olddir  = split '/', `readlink -q -m $params{'Old'}`;
+  my @newdir  = split '/', `readlink -q -m $params{'New'}`;
+  my @outdir  = @olddir;
+
+  my $out = '';
+  my $i;
+  for ($i = 0; $i <= $#olddir && $i <= $#newdir; $i++) {
+    $out++ if ($olddir[$i] ne $newdir[$i]);
+    shift @outdir unless $out;
+    unshift @outdir, ".." if $out;
+  }
+  if ($#newdir > $#olddir) {
+    for ($i=0; $i < $#newdir; $i++) {
+      unshift @outdir, "..";
+    }
+  }
+  return join ('/', @outdir);
+}
+######################################################################
+######################################################################
+############
+######################################################################
+######################################################################
+
+
+# This routine actually moves the kernel image
+# From: $realimageloc/$kimage-$version (/boot/vmlinuz-2.6.12)
+# To:   $image_dest/$kimage-$version   (/vmlinuz-2.6.12)
+# Note that the image is moved to a versioned destination, but ordinary
+# symlinks we create otherwise are not normally versioned
+sub really_move_image {
+  my $src_dir  = $_[0];
+  my $target   = $_[1];
+  my $dest_dir = $_[2];
+
+  warn "Really move image: src_dir=$src_dir, target=$target,\n destdir=$dest_dir"
+    if $DEBUG;
+  if (-e "$target") {
+    # we should be in dir $dest_dir == $image_dest /, normally
+    rename("$target", "$target.$$") ||
+      die "failed to move " . $dest_dir . "$target:$!";
+    warn "mv $target $target.$$" if $DEBUG;
+  }
+  warn "mv -f $src_dir$target $target" if $DEBUG;
+  my $ret = system("mv -f " . $src_dir . "$target " .
+                   " $target");
+  if ($ret) {
+    die("Failed to move " . $src_dir . "$target to "
+        . $dest_dir . "$target.\n");
+  }
+  # Ok, now we may clobber the previous .old files
+  if (-e "$target.$$") {
+    rename("$target.$$", "$target.old") ||
+      die "failed to move " . $dest_dir . "$target:$!";
+    warn "mv $target.$$ $target " if $DEBUG;
+  }
+}
+
+# Normally called after really_move_image; and only called if we asked for 
+# reversed link this routine reverses the symbolic link that is notmally 
+# created. Since the real kernel image has been moved over to 
+# $image_dest/$kimage-$version. So, this routine links
+# From:   $image_dest/$kimage-$version   (/vmlinuz-2.6.12)
+# To:     $realimageloc/$kimage-$version (/boot/vmlinuz-2.6.12)
+sub really_reverse_link {
+  my $src_dir    = $_[0];
+  my $link_name  = $_[1];
+  my $dest_dir   = $_[2];
+  warn "Really reverse link: src_dir=$src_dir, link name=$link_name\n" .
+    "\tdestdir=$dest_dir" if $DEBUG;
+
+  my $Old = $dest_dir;
+  if (test_relative ('Old Dir' => $Old, 'New Dir' => $src_dir,
+                     'Test File' => "$link_name")) {
+    $Old   =~ s|^/*||o;
+  }
+  # Special case is they are in the same dir
+  my $rel_path = spath('Old' => "$Old", 'New' => "$src_dir" );
+  $Old ="" if $rel_path =~ m/^\s*$/o;
+
+  if ($use_hard_links =~ m/YES/i) {
+    link($Old . "$link_name", $src_dir . "$link_name") ||
+      die("Failed to symbolic-link " . $dest_dir . "$link_name to " . $src_dir
+          . "$link_name .\n");
+    warn "ln " . $Old . "$link_name " . $src_dir . "$link_name"  if $DEBUG;
+  }
+  else {
+    symlink($Old . "$link_name", $src_dir . "$link_name") ||
+      die("Failed to link " . $dest_dir . "$link_name to " . $src_dir . 
+          "$link_name .\n");
+    warn "ln -s " . $Old . "$link_name " . $src_dir . "$link_name" if $DEBUG;
+  }
+}
+
+# This routine is invoked if there is a symbolic link in place
+# in $image_dest/$kimage -- so a symlink exists in the destination.
+# What we are trying to determine is if we need to move the symbolic link over
+# to the the .old location
+sub move_p {
+  my $kimage     = $_[0];       # Name of the symbolic link
+  my $image_dest = $_[1];       # The directory the links goes into
+  my $image_name = $_[2]; 
+  my $src_dir    = $_[3]; 
+  my $force_move = 0;
+  warn "Move?: kimage=$kimage, image_dest=$image_dest, \n" .
+    "\timage_name=$image_name, src_dir=$src_dir" if $DEBUG;
+
+  if ($no_symlink || $reverse_symlink) {
+    # we do not want links, yet we have a symbolic link here!
+    warn "found a symbolic link in " . $image_dest . "$kimage \n" .
+      "even though no_symlink is defined\n" if $no_symlink;
+    warn "found a symbolic link in " . $image_dest . "$kimage \n" .
+      "even though reverse_symlink is defined\n" if $reverse_symlink;
+    # make sure we change this state of affairs
+    $force_move = 1;
+    return $force_move;
+  }
+
+  warn "DEBUG: OK. We found symlink, and we should have a symlink here.\n"
+    if $DEBUG;
+  my $vmlinuz_target = readlink "$kimage";
+  my $real_target = '';
+  my $target = `readlink -q -m "${realimageloc}${kimage-$version}"`;
+  $real_target = abs_path($vmlinuz_target) if defined($vmlinuz_target);
+
+  if (!defined($vmlinuz_target) || ! -f "$real_target") {
+    # what, a dangling symlink?
+    warn "The link "  . $image_dest . "$kimage is a dangling link" .
+      "to $real_target\n";
+    $force_move = 1;
+    return $force_move;
+  }
+
+
+  warn "DEBUG: The link $kimage points to ($vmlinuz_target)\n" if $DEBUG;
+  warn "DEBUG: ($vmlinuz_target) is really ($real_target)\n" if $DEBUG;
+  my $cwd;
+  chomp ($cwd=`pwd`);
+  if ($vmlinuz_target !~ m|^/|o) {
+    $vmlinuz_target = $cwd . "/" . $vmlinuz_target;
+    $vmlinuz_target =~ s|/+|/|o;
+  }
+  $vmlinuz_target = `readlink -q -m $vmlinuz_target`;
+
+  if ("$vmlinuz_target" ne "$target") {
+    warn "DEBUG: We need to handle this.\n" if $DEBUG;
+    if ($minimal_swap) {
+      warn "DEBUG: Minimal swap.\n" if $DEBUG;
+      if (-l "$kimage.old") {
+        warn "DEBUG: There is an old link at $kimage.old\n" if $DEBUG;
+        my $old_target = readlink "$kimage.old";
+        my $real_old_target = '';
+        $real_old_target=abs_path($old_target) if defined ($old_target);
+
+        if ($real_old_target  && -f "$real_old_target") {
+          if ($old_target !~ m|^/|o) {
+            $old_target = $cwd . "/" . $old_target;
+            $old_target =~ s|/+|/|o;
+          }
+          $old_target = `readlink -q -m $old_target`;
+          if ("$old_target"  ne "$target") {
+            $force_move = 1;
+            warn "DEBUG: Old link ($old_target) does not point to us ($target)\n"
+              if $DEBUG;
+          } 
+          else {            # The .old points to the current
+            warn "$kimage.old --> $target -- doing nothing";
+            $force_move = 0;
+          }
+        } 
+        else { 
+          warn "DEBUG: Well, the old link does not exist -- so we move\n"
+            if $DEBUG;
+          $force_move = 1;
+        }
+      } 
+      else {
+        warn "DEBUG: No .old link -- OK to move\n"
+          if $DEBUG;
+        $force_move = 1;
+      }
+    } 
+    else {
+      warn "DEBUG: ok, minimal swap is no-- so we move.\n"
+        if $DEBUG;
+      $force_move = 1;
+    }
+  }
+  else {                  # already have proper link
+    warn "$kimage($vmlinuz_target) points to $target ($real_target) -- doing nothing";
+    $force_move = 0;
+  }
+  return $force_move;
+}
+
+
+# This routine moves the symbolic link around (/vmlinuz -> /vmlinuz.old)
+# It pays attention to whether we should the fact whether we should be using
+# hard links or not.
+sub really_move_link {
+  my $kimage     = $_[0];       # Name of the symbolic link
+  my $image_dest = $_[1];       # The directory the links goes into
+  my $image_name = $_[2]; 
+  my $src_dir    = $_[3]; 
+  warn "really_move_link: kimage=$kimage, image_dest=$image_dest\n" .
+    "\t image_name=$image_name, src_dir=$src_dir" if $DEBUG;
+
+  # don't clobber $kimage.old quite yet
+  rename("$kimage", "$kimage.$$") ||
+    die "failed to move " . $image_dest . "$kimage:$!";
+  warn "mv $kimage $kimage.$$" if $DEBUG;
+  my $Old = $src_dir;
+  my $cwd;
+
+  chomp($cwd=`pwd`);
+  if (test_relative ('Old Dir' => $Old, 'New Dir' => $cwd,
+                     'Test File' => "$image_name")) {
+    $Old   =~ s|^/*||o;
+  }
+  # Special case is they are in the same dir
+  my $rel_path = spath('Old' => "$Old", 'New' => "$cwd" );
+  $Old ="" if $rel_path =~ m/^\s*$/o;
+
+  if ($use_hard_links =~ m/YES/i) {
+    warn "ln ${Old}${image_name} $kimage" if $DEBUG;
+    if (! link("${Old}${image_name}", "$kimage")) {
+      rename("$kimage.$$", "$kimage");
+      die("Failed to link ${Old}${image_name} to " .
+          "${image_dest}${kimage}.\n");
+    }
+  } 
+  else {
+    warn "ln -s ${Old}${image_name} $kimage" if $DEBUG;
+    if (! symlink("${Old}${image_name}", "$kimage")) {
+      rename("$kimage.$$", "$kimage");
+      die("Failed to symbolic-link ${Old}${image_name} to " .
+          "${image_dest}${kimage}.\n");
+    }
+  }
+
+  # Ok, now we may clobber the previous .old file
+  if (-l "$kimage.old" || ! -e "$kimage.old" ) {
+    rename("$kimage.$$", "$kimage.old");
+    warn "mv $kimage.$$ $kimage.old" if $DEBUG;
+  }
+  else {
+    warn "$kimage.old is not a symlink, not clobbering\n";
+    warn "rm $kimage.$$";
+    unlink "$kimage.$$" if $DEBUG;
+  }
+}
+
+# This routine handles a request to do symlinks, but there is no
+# symlink file already there.  Either we are supposed to use copy, or we are
+# installing on a pristine system, or the user does not want symbolic links at
+# all.  We use a configuration file to tell the last two cases apart, creating
+# a config file if needed.
+sub handle_missing_link {
+  my $kimage     = $_[0];       # Name of the symbolic link
+  my $image_dest = $_[1];       # The directory the links goes into
+  my $image_name = $_[2]; 
+  my $src_dir    = $_[3]; 
+  warn "handle_missing_link: kimage=$kimage, image_dest=$image_dest\n" .
+    "\t image_name=$image_name, src_dir=$src_dir" if $DEBUG;
+
+  if ($no_symlink) {
+    warn "cp -a --backup=t $realimageloc$image_name $kimage" if $DEBUG;
+    my $ret = system("cp -a --backup=t " . $realimageloc .
+                     "$image_name "   . " $kimage");
+    if ($ret) {
+      die("Failed to copy " . $realimageloc . "$image_name to "
+          . $image_dest . "$kimage .\n");
+    }
+  } 
+  elsif ($reverse_symlink) {
+    warn "mv -f $realimageloc$image_name $kimage" if $DEBUG;
+    my $ret = system("mv -f " . $realimageloc . "$image_name "
+                     . "$kimage");
+    if ($ret) {
+      die("Failed to move " . $realimageloc . "$image_name to "
+          . $image_dest . "$kimage .\n");
+    }
+  } 
+  else {
+    if (! $have_conffile) {
+      my $ret;
+      my $answer='';
+      $do_symlink = "Yes";
+
+      if (open(CONF, ">$CONF_LOC")) {
+        print CONF "# Kernel Image management overrides\n";
+        print CONF "# See kernel-img.conf(5) for details\n";
+        if ($loader =~ /palo/i) {
+          print CONF "link_in_boot = Yes\n";
+          print CONF "do_symlinks = Yes\n";
+          print CONF "relative_links = Yes\n";
+          print CONF "do_bootloader = No\n";
+        } else {
+          print CONF "do_symlinks = $do_symlink\n";
+        }
+        close CONF;
+      }
+      $have_conffile = "Yes";
+    }
+  }
+
+  if (! $no_symlink && $do_symlink =~ /Yes/i) {
+    my $Old = $realimageloc;
+    my $New = $image_dest;
+    my $Name = "$image_name";
+    my $Link_Dest = "$kimage";
+
+    if ($reverse_symlink) {
+      $Old = $image_dest;
+      $New = $realimageloc;
+      $Name = "$kimage";
+      $Link_Dest = $realimageloc . "$image_name";
+    }
+    if (test_relative ('Old Dir' => $Old,
+                       'New Dir' => $New,
+                       'Test File' => $Name)) {
+      $Old   =~ s|^/*||o;
+    }
+    # Special case is they are in the same dir
+    my $rel_path = spath('Old' => "$Old", 'New' => "$New" );
+    $Old ="" if $rel_path =~ m/^\s*$/o;
+
+    symlink($Old . "$Name", "$Link_Dest") ||
+      die("Failed to symbolic-link ${Old}$Name to $Link_Dest.\n");
+    warn "ln -s ${Old}$Name $Link_Dest" if $DEBUG;
+
+  }
+}
+
+# This routine handles the rest of the cases, where the user has requested 
+# non-traditional handling, like using cp, or reverse symlinks, or hard links.
+sub handle_non_symlinks {
+  my $kimage     = $_[0];       # Name of the symbolic link
+  my $image_dest = $_[1];       # The directory the links goes into
+  my $image_name = $_[2]; 
+  my $src_dir    = $_[3]; 
+  warn "handle_non_link: kimage=$kimage, image_dest=$image_dest\n" .
+    "\t image_name=$image_name, src_dir=$src_dir" if $DEBUG;
+
+  # Save the current image. We do this in all four cases
+  rename("$kimage", "$kimage.$$") || 
+    die "failed to move " . $image_dest . "$kimage:$!";
+  warn "mv $kimage $kimage.$$" if $DEBUG;
+
+  ##,#### 
+  # case One
+  #`####
+  if ($no_symlink) {
+    # Maybe /$image_dest is on a dos system?
+    warn "cp -a --backup=t $realimageloc$image_name $kimage" if $DEBUG;
+    my $ret = system("cp -a --backup=t " . $realimageloc
+                     . "$image_name " . "$kimage");
+    if ($ret) {
+      if (-e "$kimage.$$") {
+        rename("$kimage.$$", "$kimage");
+        warn "mv $kimage.$$ $kimage" if $DEBUG;
+      }
+      die("Failed to copy " . $realimageloc . "$image_name to "
+          . $image_dest . "$kimage .\n");
+    }
+  }
+  ##,#### 
+  # case Two
+  #`####
+  elsif ($reverse_symlink) {  # Maybe /$image_dest is on a dos system?
+    warn "mv -f  $realimageloc$image_name $kimage" if $DEBUG;
+    my $ret = system("mv -f " . $realimageloc . "$image_name "
+                     . $image_dest . "$kimage");
+    if ($ret) {
+      if (-e "$kimage.$$") {
+        rename("$kimage.$$", "$kimage");
+        warn "mv $kimage.$$ $kimage" if $DEBUG;
+      }
+      die("Failed to move " . $realimageloc . "$image_name to "
+          . $image_dest . "$kimage .\n");
+    }
+    my $Old = $image_dest;
+    if (test_relative ('Old Dir' => $Old, 'New Dir' => $realimageloc,
+                       'Test File' => "$kimage")) {
+      $Old   =~ s|^/*||o;
+    }
+    # Special case is they are in the same dir
+    my $rel_path = spath('Old' => "$Old", 'New' => "$realimageloc" );
+    $Old ="" if $rel_path =~ m/^\s*$/o;
+
+    if ($use_hard_links =~ m/YES/i) {
+      warn "ln " . $Old . "$kimage " . $realimageloc . "$image_name" if $DEBUG;
+      if (! link($Old . "$kimage", $realimageloc . "$image_name")) {
+        warn "Could not link " . $image_dest .
+          "$kimage to $image_name :$!";
+      }
+    }
+    else {
+      warn "ln -s " . $Old . "$kimage " . $realimageloc . "$image_name" if $DEBUG;
+      if (! symlink($Old . "$kimage", $realimageloc . "$image_name")) {
+        warn "Could not symlink " . $image_dest .
+          "$kimage to $image_name :$!";
+      }
+    }
+  }
+  ##,####
+  # case Three
+  #`####
+  elsif ($use_hard_links =~ m/YES/i ) {
+    # Ok then. this ought to be a hard link, and hence fair game
+    # don't clobber $kimage.old quite yet
+    my $Old = $realimageloc;
+    my $cwd;
+    chomp($cwd=`pwd`);
+    if (test_relative ('Old Dir' => $Old, 'New Dir' => $cwd,
+                       'Test File' => "$image_name")) {
+      $Old   =~ s|^/*||o;
+    }
+    # Special case is they are in the same dir
+    my $rel_path = spath('Old' => "$Old", 'New' => "$cwd" );
+    $Old ="" if $rel_path =~ m/^\s*$/o;
+
+    warn "ln " . $Old . "$image_name " . "$kimage" if $DEBUG;
+    if (! link($Old . "$image_name", "$kimage")) {
+      warn "mv $kimage.$$ $kimage" if $DEBUG;
+      rename("$kimage.$$", "$kimage");
+      die("Failed to link " . $realimageloc . "$image_name to "
+          . $image_dest . "$kimage .\n");
+    }
+  }
+  ##,####
+  # case Four
+  #`####
+  else {
+    # We just use cp
+    warn "cp -a --backup=t $realimageloc$image_name $kimage" if $DEBUG;
+    my $ret = system("cp -a --backup=t " . $realimageloc
+                     . "$image_name " . "$kimage");
+    if ($ret) {
+      if (-e "$kimage.$$") {
+        warn "mv $kimage.$$ $kimage" if $DEBUG;
+        rename("$kimage.$$", "$kimage");
+      }
+      die("Failed to copy " . $realimageloc . "$image_name to "
+          . $image_dest . "$kimage .\n");
+    }
+  }
+  # Ok, now we may clobber the previous .old file
+  warn "mv $kimage.$$ $kimage.old if -e $kimage.$$" if $DEBUG;
+  rename("$kimage.$$", "$kimage.old") if -e "$kimage.$$";
+}
+
+# This routine is responsible for setting up the symbolic links
+# So, the actual kernel image lives in
+# $realimageloc/$image_name (/boot/vmlinuz-2.6.12).
+# This routine creates symbolic links in $image_dest/$kimage (/vmlinuz)
+sub image_magic {
+  my $kimage     = $_[0];       # Name of the symbolic link
+  my $image_dest = $_[1];       # The directory the links goes into
+  my $image_name = "$kimage-$version";
+  my $src_dir    = $realimageloc;
+  warn "image_magic: kimage=$kimage, image_dest=$image_dest\n" .
+    "\t image_name=$image_name, src_dir=$src_dir" if $DEBUG;
+
+  # Well, in any case, if the destination (the symlink we are trying
+  # to create) is a directory, we should do nothing, except throw a
+  # diagnostic.
+  if (-d "$kimage" ) {
+    die ("Hmm. $kimage is a directory, which I did not expect.  I am\n" .
+         "trying to create a symbolic link with that name linked to \n" .
+         "$image_dest . Since a directory exists here, my assumptions \n" .
+         "are way off, and I am aborting.\n" );
+    exit (3);
+  }
+
+  if ($move_image) {   # Maybe $image_dest is in on dos, or something?
+    #                   source dir,    link name,        dest dir
+    really_move_image(  $realimageloc, $image_name, $image_dest);
+    really_reverse_link($realimageloc, $image_name, $image_dest)
+      if $reverse_symlink;
+    return;
+  }
+
+  if (-l "$kimage") {           # There is a symbolic link
+    warn "DEBUG: There is a symlink for $kimage\n" if $DEBUG;
+    my $force_move = move_p($kimage, $image_dest, $image_name, $src_dir);
+
+    if ($force_move) {
+      really_move_link($kimage, $image_dest, $image_name, $src_dir);
+    }
+  }
+  elsif (! -e "$kimage") {
+    # Hmm. Pristine system? How can that be? Installing from scratch?
+    # Or maybe the user does not want a symbolic link here.
+    # Possibly they do not want a link here. (we should be in /
+    # here[$image_dest, really]
+    handle_missing_link($kimage, $image_dest, $image_name, $src_dir);
+  }
+  elsif (-e "$kimage" ) {
+    # OK, $kimage exists -- but is not a link
+    handle_non_symlinks($kimage, $image_dest, $image_name, $src_dir);
+  }
+}
+
+######################################################################
+######################################################################
+######################################################################
+######################################################################
+
+# We may not have any modules installed
+if ( -d "$modules_base/$version" ) {
+  print STDERR "Running depmod.\n";
+  my $ret = system("depmod -a $version");
+  if ($ret) {
+    print STDERR "Failed to run depmod\n";
+    exit(1);
+  }
+}
+
+
+
+sub find_initrd_tool {
+  my $hostversion = shift;
+  my $version = shift;
+  print STDERR "Finding valid ramdisk creators.\n";
+  my @ramdisks =
+    grep {
+      my $args = 
+        "$_ " .
+          "--supported-host-version=$hostversion " .
+            "--supported-target-version=$version " .
+              "1>/dev/null 2>&1"
+                ;
+      system($args) == 0;
+    }
+      split (/[:,\s]+/, $ramdisk);
+}
+
+# The initrd symlink should probably be in the same dir that the
+# symlinks are in
+if ($initrd) {
+  my $success = 0;
+
+  # Update-initramfs is called slightly different than mkinitrd and
+  # mkinitramfs. XXX It should really be made compatible with this stuff
+  # some how.
+  my $upgrading = 1;
+  if (! defined $ARGV[1] || ! $ARGV[1] || $ARGV[1] =~ m/<unknown>/og) {
+    $upgrading = 0;
+  }
+  my $ret = system("$ramdisk " . ($upgrading ? "-u" : "-c") . " -k " . $version . " >&2");
+  $success = 1 unless $ret;
+  die "Failed to create initrd image.\n" unless $success;
+  if (! defined $ARGV[1] || ! $ARGV[1] || $ARGV[1] =~ m/<unknown>/og) {
+    image_magic("initrd.img", $image_dest);
+  }
+  else {
+    if (! -e "initrd.img") {
+      handle_missing_link("initrd.img", $image_dest, "initrd.img-$version",
+                          $realimageloc);
+    }
+    else {
+      print STDERR
+        "Not updating initrd symbolic links since we are being updated/reinstalled \n";
+      print STDERR
+        "($ARGV[1] was configured last, according to dpkg)\n";
+    }
+  }
+
+  if ($initrd && -l "initrd" ) {
+    unlink "initrd";
+  }
+
+  if ($initrd && -l "$image_dir/initrd" && ! $link_in_boot) {
+    unlink "$image_dir/initrd";
+  }
+}
+else {                        # Not making an initrd emage
+  if (-l "initrd.img") {
+    # Ooh, last image was an initrd image? in any case, we should move it. 
+    my $target = readlink "initrd.img";
+    my $real_target = '';
+    $real_target = abs_path($target) if defined ($target);
+
+    if (!defined($target) || ! -f "$real_target") {
+      # Eh. dangling link. can safely be removed.
+      unlink("initrd.img");
+    } else {
+      if (-l "initrd.img.old" || ! -e "initrd.img.old" ) {
+        rename("initrd.img", "initrd.img.old");
+      } else {
+        warn "initrd.img.old is not a symlink, not clobbering\n";
+        unlink("initrd.img");
+      }
+    }
+  }
+}
+
+# Warn of a reboot
+if (-x $notifier) {
+  system($notifier);
+}
+
+# Let programs know not to hibernate if the kernel that would be used for
+# resume-from-hibernate is likely to differ from the currently running kernel.
+system("mountpoint -q /var/run");
+if ($? eq 0) {
+	system("touch /var/run/do-not-hibernate");
+}
+
+# Only change the symlinks if we are not being upgraded
+if (! defined $ARGV[1] || ! $ARGV[1] || $ARGV[1] =~ m/<unknown>/og) {
+  image_magic($kimage, $image_dest);
+}
+else {
+  if (! -e "$kimage") {
+    handle_missing_link($kimage, $image_dest, "$kimage-$version", 
+                        $realimageloc);
+  }
+  else {
+    print STDERR
+      "Not updating image symbolic links since we are being updated/reinstalled \n";
+    print STDERR
+      "($ARGV[1] was configured last, according to dpkg)\n";
+  }
+}
+
+# We used to have System.* files in /
+if (-e "/System.map" || -e "/System.old") {
+  unlink '/System.map' if -e '/System.map';
+  unlink '/System.old' if -e '/System.old';
+}
+
+# creating some info about kernel and initrd
+if ($DEBUG) {
+  my $ksize=sprintf("%.0f",(stat($realimageloc .
+                                 "$kimage-$version"))[7]/1024)."kB";
+  my $initrdsize='';
+  if ($initrd) {
+    $initrdsize=sprintf("%.0f",(stat($realimageloc .
+                                     "initrd.img-$version"))[7]/1024)."kB";
+  }
+
+  print STDERR <<"EOMSG";
+A new kernel image has been installed at $realimageloc$kimage-$version
+ (Size: $ksize)
+
+Symbolic links, unless otherwise specified, can be found in $image_dest
+
+EOMSG
+  ;
+
+  if ($initrd) {
+    print STDERR <<"EOMSGA";
+
+ Initial rootdisk image: ${realimageloc}initrd.img-$version (Size: $initrdsize)
+EOMSGA
+    ;
+  }
+}
+
+# set the env var stem
+$ENV{'STEM'} = "linux";
+sub exec_script {
+  my $type   = shift;
+  my $script = shift;
+  print STDERR "Running $type hook script $script.\n";
+  system ("$script $version $realimageloc$kimage-$version") &&
+    print STDERR "User $type hook script [$script] ";
+  if ($?) {
+    if ($? == -1) {
+      print STDERR "failed to execute: $!\n";
+    }
+    elsif ($? & 127) {
+      printf STDERR "died with signal %d, %s coredump\n",
+        ($? & 127),  ($? & 128) ? 'with' : 'without';
+    }
+    else {
+      printf STDERR "exited with value %d\n", $? >> 8;
+    }
+    exit $? >> 8;
+  }
+}
+sub run_hook {
+  my $type   = shift;
+  my $script = shift;
+  if ($script =~ m,^/,) {
+    # Full path provided for the hook script
+    if (-x "$script") {
+      &exec_script($type,$script);
+    }
+    else {
+      die "The provided $type hook script [$script] could not be run.\n";
+    }
+  }
+  else {
+    # Look for it in a safe path
+    for my $path ('/bin', '/sbin', '/usr/bin', '/usr/sbin') {
+      if (-x "$path/$script") {
+        &exec_script($type, "$path/$script");
+        return 0;
+      }
+    }
+    # No luck
+    print STDERR "Could not find $type hook script [$script].\n";
+    die "Looked in: '/bin', '/sbin', '/usr/bin', '/usr/sbin'\n";
+  }
+}
+
+## Run user hook script here, if any
+if ($postinst_hook) {
+  &run_hook("postinst", $postinst_hook);
+}
+
+if (-d "/etc/kernel/postinst.d") {
+  print STDERR "Examining /etc/kernel/postinst.d.\n";
+  system ("run-parts --verbose --exit-on-error --arg=$version " .
+          "--arg=$realimageloc$kimage-$version " .
+          "/etc/kernel/postinst.d") &&
+            die "Failed to process /etc/kernel/postinst.d";
+}
+
+if (-d "/etc/kernel/postinst.d/$version") {
+  print STDERR "Examining /etc/kernel/postinst.d/$version.\n";
+  system ("run-parts --verbose --exit-on-error --arg=$version " .
+          "--arg=$realimageloc$kimage-$version " .
+          "/etc/kernel/postinst.d/$version") &&
+            die "Failed to process /etc/kernel/postinst.d/$version";
+}
+
+LOADER: {
+  last unless $do_boot_enable; # Exit if explicitly asked to
+
+  last if $loader =~ /silo/i; # SILO does not have to be executed.
+  last if $loader =~ /yaboot/i; # yaboot does not have to be executed.
+  last if $loader =~ /milo/i; # MILO does not have to be executed.
+  last if $loader =~ /nettrom/i; # NETTROM does not have to be executed.
+  last if $loader =~ /arcboot/i; # ARCBOOT does not have to be executed.
+  last if $loader =~ /delo/i; # DELO does not have to be executed.
+  last if $loader =~ /quik/i; # maintainer asked quik invocation to be ignored
+
+  last unless $loaderloc;
+  last unless -x $loaderloc;
+  last unless $do_bootloader;
+
+  if (-T "/etc/$loader.conf") {
+    # Trust and use the existing lilo.conf.
+    print STDERR "You already have a $Loader configuration in /etc/$loader.conf\n";
+    my $ret = &run_lilo();
+    exit $ret if $ret;
+  }
+}
+
+
+sub run_lilo (){
+  my $ret;
+  # Try and figure out if the user really wants lilo to be run --
+  # since the default is to run the boot laoder, which is ! grub -- but
+  # the user may be using grub now, and not changed the default.
+
+  # So, if the user has explicitly asked for the loader to be run, or
+  # if there is no postinst hook, or if there is no grub installed --
+  # we are OK. Or else, we ask.
+  if ($explicit_do_loader || (! ($postinst_hook && -x '/usr/sbin/grub')))  {
+    print STDERR "Running boot loader as requested\n";
+  } else {
+    print STDERR "Ok, not running $loader\n";
+  }
+  if ($loader =~ /^lilo/io or $loader =~ /vmelilo/io) {
+    print STDERR "Testing $loader.conf ... \n";
+    unlink $temp_file_name;     # security
+    $ret = system("$loaderloc -t >$temp_file_name 2>&1");
+    if ($ret) {
+      print STDERR "Boot loader test failed\n";
+      return $ret;
+    }
+    unlink "$temp_file_name";
+    print STDERR "Testing successful.\n";
+    print STDERR "Installing the ";
+    print STDERR "partition " if $loader =~ /^lilo/io;
+    print STDERR "boot sector... \n";
+  }
+
+  print STDERR "Running $loaderloc  ... \n";
+  if ($loader =~ /^elilo/io) {
+    $ret = system("$loaderloc 2>&1 | tee $temp_file_name");
+  } else {
+    $ret = system("$loaderloc >$temp_file_name 2>&1");
+  }
+  if ($ret) {
+    print STDERR "Boot loader failed to run\n";
+    return $ret;
+  }
+  unlink $temp_file_name;
+  print STDERR "Installation successful.\n";
+  return 0;
+}
+
+exit 0;
+
+__END__
+
--- linux-rt-2.6.31.orig/debian/control-scripts/prerm
+++ linux-rt-2.6.31/debian/control-scripts/prerm
@@ -0,0 +1,307 @@
+#! /usr/bin/perl
+#                              -*- Mode: Perl -*- 
+# image.prerm --- 
+# Author           : root ( root@melkor.pilgrim.umass.edu ) 
+# Created On       : Fri May 17 03:28:59 1996
+# Created On Node  : melkor.pilgrim.umass.edu
+# Last Modified By : Manoj Srivastava
+# Last Modified On : Sat Aug  5 13:14:17 2006
+# Last Machine Used: glaurung.internal.golden-gryphon.com
+# Update Count     : 85
+# Status           : Unknown, Use with caution!
+# HISTORY          : 
+# Description      : 
+# 
+#
+#    $Id: image.prerm,v 1.22 2003/10/07 16:24:20 srivasta Exp $
+#
+# 
+#use strict;
+
+$|=1;
+# Predefined values:
+my $version         = "=V";
+my $link_in_boot    = "";	# Should be empty, mostly
+my $no_symlink      = "";	# Should be empty, mostly
+my $reverse_symlink = "";	# Should be empty, mostly
+my $do_symlinks     = "Yes";	# target machine defined
+my $do_boot_enable  = "Yes";	# target machine defined
+my $do_bootfloppy   = "Yes";	# target machine defined
+my $do_bootloader   = "Yes";	# target machine defined
+my $move_image      = '';       # target machine defined
+my $kimage          = "=K";	# Should be empty, mostly
+my $loader          = "=L";     # lilo, silo, quik, palo, vmelilo, or nettrom
+my $image_dir       = "/boot";     # where the image is located
+my $clobber_modules = '';       # target machine defined
+my $initrd          = "YES";     # initrd kernel
+my $use_hard_links  = '';       # hardlinks do not wirk across fs boundaries
+my $postinst_hook   = '';       #Normally we do not
+my $postrm_hook     = '';       #Normally we do not
+my $preinst_hook    = '';       #Normally we do not
+my $prerm_hook      = '';       #Normally we do not
+my $minimal_swap    = '';       # Do not swap symlinks
+my $ignore_depmod_err = '';	# normally we do not
+my $relink_build_link = 'YES';	# There is no harm in checking the link
+my $force_build_link = '';	# There is no harm in checking the link
+my $kernel_arch       = "=B";
+my $ramdisk           = "/usr/sbin/update-initramfs";
+my $package_name    = "linux-image-$version";
+
+my $Loader          = "NoLOADER"; # 
+$Loader             = "LILO"     if $loader =~ /^lilo/io;
+$Loader             = "SILO"     if $loader =~ /^silo/io;
+$Loader             = "QUIK"     if $loader =~ /^quik/io;
+$Loader             = "yaboot"   if $loader =~ /^yaboot/io;
+$Loader             = "PALO"     if $loader =~ /^palo/io;
+$Loader             = "NETTROM"  if $loader =~ /^nettrom/io;
+$Loader             = "VMELILO"  if $loader =~ /^vmelilo/io;
+$Loader             = "ZIPL"     if $loader =~ /^zipl/io;
+$Loader             = "ELILO"    if $loader =~ /^elilo/io;
+
+
+# This should not point to /tmp, because of security risks.
+my $temp_file_name = "/var/log/$loader" . "_log.$$";
+
+#known variables
+my $image_dest      = "/";
+my $realimageloc    = "/$image_dir/";
+my $have_conffile   = "";
+my $CONF_LOC        = '/etc/kernel-img.conf';
+my $relative_links = '';
+my $silent_loader   = '';
+my $warn_reboot     = 'Yes';     # Warn that we are installing a version of
+                                 # the kernel we are running
+
+# remove multiple leading slashes; make sure there is at least one.
+$realimageloc  =~ s|^/*|/|o;
+$realimageloc  =~ s|/+|/|o;
+
+my $DEBUG = 0;
+
+# Variables used
+my $image='';
+my $ret=0;
+my $seen='';
+my $answer='';
+my $running = '';
+my $WouldInvalidate = 0;
+
+if ($ARGV[0] && ($ARGV[0] =~ /remove/ || $ARGV[0] =~ /upgrade/)) {
+  if (-l "/usr/doc/linux-image-$version") {
+    unlink "/usr/doc/linux-image-$version";
+  }
+}
+
+# Ignore all invocations uxcept when called on to remove
+exit 0 unless ($ARGV[0] && $ARGV[0] =~ /remove/) ;
+
+# Paranoid check to make sure that the correct value is put in there
+if (! $kimage)                    { $kimage = "vmlinuz";} # Hmm. empty
+elsif ($kimage =~ m/^b?zImage$/o) { $kimage = "vmlinuz";} # these produce vmlinuz
+elsif ($kimage =~ m/^[iI]mage$/o) { my $nop = $kimage;  }
+elsif ($kimage =~ m/^vmlinux$/o)  { my $nop = $kimage;  }
+else                              { $kimage = "vmlinuz";} # Default
+
+if (-r "$CONF_LOC" && -f "$CONF_LOC"  ) {
+  if (open(CONF, "$CONF_LOC")) {
+    while (<CONF>) {
+      chomp;
+      s/\#.*$//g;
+      next if /^\s*$/;
+
+      $do_symlink      = "" if /^\s*do_symlinks\s*=\s*(no|false|0)\s*$/ig;
+      $no_symlink      = "" if /^\s*no_symlinks\s*=\s*(no|false|0)\s*$/ig;
+      $reverse_symlink = "" if /^\s*reverse_symlinks\s*=\s*(no|false|0)\s*$/ig;
+      $link_in_boot    = "" if /^\s*image_in_boot\s*=\s*(no|false|0)\s*$/ig;
+      $link_in_boot    = "" if /^\s*link_in_boot\s*=\s*(no|false|0)\s*$/ig;
+      $move_image      = "" if /^\s*move_image\s*=\s*(no|false|0)\s*$/ig;
+      $clobber_modules = '' if /^\s*clobber_modules\s*=\s*(no|false|0)\s*$/ig;
+      $do_boot_enable  = '' if /^\s*do_boot_enable\s*=\s*(no|false|0)\s*$/ig;
+      $do_bootfloppy   = '' if /^\s*do_bootfloppy\s*=\s*(no|false|0)\s*$/ig;
+      $relative_links  = '' if /^\s*relative_links \s*=\s*(no|false|0)\s*$/ig;
+      $do_bootloader   = '' if /^\s*do_bootloader\s*=\s*(no|false|0)\s*$/ig;
+      $do_initrd       = '' if /^\s*do_initrd\s*=\s*(no|false|0)\s*$/ig;
+      $use_hard_links  = '' if /^\s*use_hard_links\s*=\s*(no|false|0)\s*$/ig;
+      $silent_loader   = '' if /^\s*silent_loader\s*=\s*(no|false|0)\s*$/ig;
+      $warn_reboot     = '' if /^\s*warn_reboot\s*=\s*(no|false|0)\s*$/ig;
+      $minimal_swap    = '' if /^\s*minimal_swap\s*=\s*(no|false|0)\s*$/ig;
+      $ignore_depmod_err = '' if /^\s*ignore_depmod_err\s*=\s*(no|false|0)\s*$/ig;
+      $relink_build_link = '' if /^\s*relink_build_link\s*=\s*(no|false|0)\s*$/ig;
+      $force_build_link = '' if /^\s*force_build_link\s*=\s*(no|false|0)\s*$/ig;
+
+
+      $do_symlink      = "Yes" if /^\s*do_symlinks\s*=\s*(yes|true|1)\s*$/ig;
+      $no_symlink      = "Yes" if /^\s*no_symlinks\s*=\s*(yes|true|1)\s*$/ig;
+      $reverse_symlink = "Yes" if /^\s*reverse_symlinks\s*=\s*(yes|true|1)\s*$/ig;
+      $link_in_boot    = "Yes" if /^\s*image_in_boot\s*=\s*(yes|true|1)\s*$/ig;
+      $link_in_boot    = "Yes" if /^\s*link_in_boot\s*=\s*(yes|true|1)\s*$/ig;
+      $move_image      = "Yes" if /^\s*move_image\s*=\s*(yes|true|1)\s*$/ig;
+      $clobber_modules = "Yes" if /^\s*clobber_modules\s*=\s*(yes|true|1)\s*$/ig;
+      $do_boot_enable  = "Yes" if /^\s*do_boot_enable\s*=\s*(yes|true|1)\s*$/ig;
+      $do_bootfloppy   = "Yes" if /^\s*do_bootfloppy\s*=\s*(yes|true|1)\s*$/ig;
+      $do_bootloader   = "Yes" if /^\s*do_bootloader\s*=\s*(yes|true|1)\s*$/ig;
+      $relative_links  = "Yes" if /^\s*relative_links\s*=\s*(yes|true|1)\s*$/ig;
+      $do_initrd       = "Yes" if /^\s*do_initrd\s*=\s*(yes|true|1)\s*$/ig;
+      $use_hard_links  = "Yes" if /^\s*use_hard_links\s*=\s*(yes|true|1)\s*$/ig;
+      $silent_loader   = 'Yes' if /^\s*silent_loader\s*=\s*(yes|true|1)\s*$/ig;
+      $warn_reboot     = 'Yes' if /^\s*warn_reboot\s*=\s*(yes|true|1)\s*$/ig;
+      $minimal_swap    = 'Yes' if /^\s*minimal_swap\s*=\s*(yes|true|1)\s*$/ig;
+      $ignore_depmod_err = 'Yes' if /^\s*ignore_depmod_err\s*=\s*(yes|true|1)\s*$/ig;
+      $relink_build_link = 'Yes' if /^\s*relink_build_link\s*=\s*(yes|true|1)\s*$/ig;
+      $force_build_link = 'Yes' if /^\s*force_build_link\s*=\s*(yes|true|1)\s*$/ig;
+
+      $image_dest      = "$1"  if /^\s*image_dest\s*=\s*(\S+)/ig;
+      $postinst_hook   = "$1"  if /^\s*postinst_hook\s*=\s*(\S+)/ig;
+      $postrm_hook     = "$1"  if /^\s*postrm_hook\s*=\s*(\S+)/ig;
+      $preinst_hook    = "$1"  if /^\s*preinst_hook\s*=\s*(\S+)/ig;
+      $prerm_hook      = "$1"  if /^\s*prerm_hook\s*=\s*(\S+)/ig;
+      $ramdisk         = "$1"  if /^\s*ramdisk\s*=\s*(.+)$/ig;
+    }
+    close CONF;
+    $have_conffile = "Yes";
+  }
+}
+
+
+$ENV{KERNEL_ARCH}=$kernel_arch if $kernel_arch;
+
+#check to see if we are trying to remove a running kernel
+# if so we abort right now.
+chop($running=`uname -r`);
+if ($running eq $version) {
+  print STDERR "WARN: Proceeding with removing running kernel image.\n";
+}
+
+#Now, they have an alternate kernel which they are currently running
+
+# This is just us being nice to lilo users.
+
+chdir("/") or die "could not chdir to /:$!\n";
+
+if (-f "/etc/$loader.conf") { #I know, could be a link, but ..
+  open (LILO, "/etc/$loader.conf") || &success(); # this is not critical
+  while (<LILO>) {
+    chop;
+    s/\#.*//;			  # nix the comments
+    next unless /^\s*image\s*=\s(\S+)/o;
+    $image = $1;
+    if ($image && -e $image) {
+      while (defined($image) && -l $image) {
+	$image = readlink ($image);
+      }
+      if (defined($image) && -e $image) {
+	$WouldInvalidate |= $image =~ /$kimage-$version/;
+      }
+      else {
+	&success(); # invalid $loader.conf file
+      }
+    }
+    else {
+      &success(); # invalid $loader.conf file
+    }
+  }
+  close (LILO);
+  if ($WouldInvalidate) {
+    print STFERR "WARN: Proceeding with removing running kernel image.\n";
+    &success();
+  }
+}
+
+
+# set the env var stem
+$ENV{'STEM'} = "linux";
+
+sub exec_script {
+  my $type   = shift;
+  my $script = shift;
+  print STDERR "Running $type hook script $script.\n";
+  system ("$script $version $realimageloc$kimage-$version") &&
+    print STDERR "User $type hook script [$script] ";
+  if ($?) {
+    if ($? == -1) {
+      print STDERR "failed to execute: $!\n";
+    }
+    elsif ($? & 127) {
+      printf STDERR "died with signal %d, %s coredump\n",
+        ($? & 127),  ($? & 128) ? 'with' : 'without';
+    }
+    else {
+      printf STDERR "exited with value %d\n", $? >> 8;
+    }
+    exit $? >> 8;
+  }
+}
+sub run_hook {
+  my $type   = shift;
+  my $script = shift;
+  if ($script =~ m,^/,) {
+    # Full path provided for the hook script
+    if (-x "$script") {
+      &exec_script($type,$script);
+    }
+    else {
+      die "The provided $type hook script [$script] could not be run.\n";
+    }
+  }
+  else {
+    # Look for it in a safe path
+    for my $path ('/bin', '/sbin', '/usr/bin', '/usr/sbin') {
+      if (-x "$path/$script") {
+        &exec_script($type, "$path/$script");
+        return 0;
+      }
+    }
+    # No luck
+    print STDERR "Could not find $type hook script [$script].\n";
+    die "Looked in: '/bin', '/sbin', '/usr/bin', '/usr/sbin'\n";
+  }
+}
+
+
+## Run user hook script here, if any
+if (-x "$prerm_hook") {
+  &run_hook("prerm", $prerm_hook);
+}
+if (-d "/etc/kernel/prerm.d") {
+  print STDERR "Examining /etc/kernel/prerm.d.\n";
+  system ("run-parts --verbose --exit-on-error --arg=$version " . 
+          "--arg=$realimageloc$kimage-$version /etc/kernel/prerm.d") &&
+            die "Failed to process /etc/kernel/prerm.d";
+}
+if (-d "/etc/kernel/prerm.d/$version") {
+  print STDERR "Examining /etc/kernel/prerm.d/$version.\n";
+  system ("run-parts --verbose --exit-on-error --arg=$version" .
+          " --arg=$realimageloc$kimage-$version " .
+          "/etc/kernel/prerm.d/$version") &&
+            die "Failed to process /etc/kernel/prerm.d/$version";
+}
+
+sub success () {
+  my @files_to_remove = qw{
+    modules.dep modules.isapnpmap modules.pcimap
+    modules.usbmap modules.parportmap
+    modules.generic_string modules.ieee1394map
+    modules.ieee1394map modules.pnpbiosmap
+    modules.alias modules.ccwmap modules.inputmap
+    modules.symbols modules.ofmap modules.seriomap
+    modules.alias.bin modules.dep.bin modules.symbols.bin
+  };
+
+  foreach my $extra_file (@files_to_remove) {
+    if (-f "/lib/modules/$version/$extra_file") {
+      unlink "/lib/modules/$version/$extra_file";
+    }
+  }
+  exit 0;
+}
+
+
+
+&success();
+exit 0;
+__END__
+
+
+
+
+
--- linux-rt-2.6.31.orig/debian/control-scripts/headers-postinst
+++ linux-rt-2.6.31/debian/control-scripts/headers-postinst
@@ -0,0 +1,126 @@
+#!/usr/bin/perl
+#                              -*- Mode: Cperl -*- 
+# debian.postinst ---
+# Author           : Manoj Srivastava ( srivasta@pilgrim.umass.edu )
+# Created On       : Sat Apr 27 05:42:43 1996
+# Created On Node  : melkor.pilgrim.umass.edu
+# Last Modified By : Manoj Srivastava
+# Last Modified On : Sat Aug  5 13:20:22 2006
+# Last Machine Used: glaurung.internal.golden-gryphon.com
+# Update Count     : 45
+# Status           : Unknown, Use with caution!
+# HISTORY          :
+# Description      :
+#
+#
+#
+#  arch-tag: 1c716174-2f0a-476d-a626-a1322e62503a
+#
+
+
+$|=1;
+
+# Predefined values:
+my $version           = "=V";
+my $kimage            = "=K";
+my $package_name    = "linux-image-$version";
+
+
+# Ignore all invocations uxcept when called on to configure.
+exit 0 unless ($ARGV[0] && $ARGV[0] =~ /configure/);
+
+#known variables
+my $image_dest      = "/";
+my $realimageloc    = "/boot/";
+my $silent_modules  = '';
+my $modules_base    = '/lib/modules';
+my $CONF_LOC        = '/etc/kernel-img.conf';
+# remove multiple leading slashes; make sure there is at least one.
+$realimageloc  =~ s|^/*|/|o;
+$realimageloc  =~ s|/+|/|o;
+
+chdir '/usr/src' or die "Could not chdir to /usr/src:$!";
+
+if (-r "$CONF_LOC" && -f "$CONF_LOC"  ) {
+  if (open(CONF, "$CONF_LOC")) {
+    while (<CONF>) {
+      chomp;
+      s/\#.*$//g;
+      next if /^\s*$/;
+
+      $header_postinst_hook   = "$1"  if /^\s*header_postinst_hook\s*=\s*(\S+)/ig;
+    }
+    close CONF;
+  }
+}
+
+sub exec_script {
+  my $type   = shift;
+  my $script = shift;
+  print STDERR "Running $type hook script $script.\n";
+  system ("$script $version $realimageloc$kimage-$version") &&
+    print STDERR "User $type hook script [$script] ";
+  if ($?) {
+    if ($? == -1) {
+      print STDERR "failed to execute: $!\n";
+    }
+    elsif ($? & 127) {
+      printf STDERR "died with signal %d, %s coredump\n",
+        ($? & 127),  ($? & 128) ? 'with' : 'without';
+    }
+    else {
+      printf STDERR "exited with value %d\n", $? >> 8;
+    }
+    exit $? >> 8;
+  }
+}
+sub run_hook {
+  my $type   = shift;
+  my $script = shift;
+  if ($script =~ m,^/,) {
+    # Full path provided for the hook script
+    if (-x "$script") {
+      &exec_script($type,$script);
+    }
+    else {
+      die "The provided $type hook script [$script] could not be run.\n";
+    }
+  }
+  else {
+    # Look for it in a safe path
+    for my $path ('/bin', '/sbin', '/usr/bin', '/usr/sbin') {
+      if (-x "$path/$script") {
+        &exec_script($type, "$path/$script");
+        return 0;
+      }
+    }
+    # No luck
+    print STDERR "Could not find $type hook script [$script].\n";
+    die "Looked in: '/bin', '/sbin', '/usr/bin', '/usr/sbin'\n";
+  }
+}
+
+## Run user hook script here, if any
+if (-x "$header_postinst_hook") {
+  &run_hook("postinst", $header_postinst_hook);
+}
+
+if (-d "/etc/kernel/header_postinst.d") {
+  print STDERR "Examining /etc/kernel/header_postinst.d.\n";
+  system ("run-parts --verbose --exit-on-error --arg=$version " .
+          "--arg=$realimageloc$kimage-$version " .
+          "/etc/kernel/header_postinst.d") &&
+            die "Failed to process /etc/kernel/header_postinst.d";
+}
+
+if (-d "/etc/kernel/header_postinst.d/$version") {
+  print STDERR "Examining /etc/kernel/header_postinst.d/$version.\n";
+  system ("run-parts --verbose --exit-on-error --arg=$version " .
+          "--arg=$realimageloc$kimage-$version " .
+          "/etc/kernel/header_postinst.d/$version") &&
+            die "Failed to process /etc/kernel/header_postinst.d/$version";
+}
+
+exit 0;
+
+__END__
--- linux-rt-2.6.31.orig/debian/scripts/module-check
+++ linux-rt-2.6.31/debian/scripts/module-check
@@ -0,0 +1,120 @@
+#!/usr/bin/perl -w
+
+$flavour = shift;
+$prev_abidir = shift;
+$abidir = shift;
+$skipmodule = shift;
+
+print "II: Checking modules for $flavour...";
+
+if (-f "$prev_abidir/ignore.modules"
+    or -f "$prev_abidir/$flavour.ignore.modules") {
+	print "explicitly ignoring modules\n";
+	exit(0);
+}
+
+if (not -f "$abidir/$flavour.modules" or not -f
+    "$prev_abidir/$flavour.modules") {
+	print "previous or current modules file missing!\n";
+	print "   $abidir/$flavour.modules\n";
+	print "   $prev_abidir/$flavour.modules\n";
+	if (defined($skipmodule)) {
+		exit(0);
+	} else {
+		exit(1);
+	}
+}
+
+print "\n";
+
+my %modules;
+my %modules_ignore;
+my $missing = 0;
+my $new = 0;
+my $errors = 0;
+
+# See if we have any ignores
+if (-f "$prev_abidir/../modules.ignore") {
+	my $ignore = 0;
+	open(IGNORE, "< $prev_abidir/../modules.ignore") or
+		die "Could not open $prev_abidir/../modules.ignore";
+	print "   reading modules to ignore...";
+	while (<IGNORE>) {
+		chomp;
+		next if /\s*#/;
+		$modules_ignore{$_} = 1;
+		$ignore++;
+	}
+	close(IGNORE);
+	print "read $ignore modules.\n";
+}
+
+# Read new modules first
+print "   reading new modules...";
+$new_count = 0;
+open(NEW, "< $abidir/$flavour.modules") or
+	die "Could not open $abidir/$flavour.modules";
+while (<NEW>) {
+	chomp;
+	$modules{$_} = 1;
+	$new_count++;
+}
+close(NEW);
+print "read $new_count modules.\n";
+
+# Now the old modules, checking for missing ones
+print "   reading old modules...";
+$old_count = 0;
+open(OLD, "< $prev_abidir/$flavour.modules") or
+	die "Could not open $prev_abidir/$flavour.modules";
+while (<OLD>) {
+	chomp;
+	if (not defined($modules{$_})) {
+		print "\n" if not $missing;
+		$missing++;
+		if (not defined($modules_ignore{$_})) {
+			print "      MISS: $_\n";
+			$errors++;
+		} else {
+			print "      MISS: $_ (ignored)\n";
+		}
+	} else {
+		$modules{$_}++;
+	}
+	$old_count++;
+}
+close(OLD);
+# Check for new modules
+foreach $mod (keys(%modules)) {
+	if ($modules{$mod} < 2) {
+		print "\n" if not $missing and not $new;
+		print "      NEW : $mod\n";
+		$new++;
+	}
+}
+if ($new or $missing) {
+	print "      read $old_count modules : new($new)  missing($missing)\n";
+} else {
+	print "read $old_count modules.\n";
+}
+
+
+# Let's see where we stand...
+if ($errors) {
+	if (defined($skipmodule)) {
+		print "WW: Explicitly asked to ignore failures (probably not good)\n";
+	} else {
+		print "EE: Missing modules (start begging for mercy)\n";
+		exit 1
+	}
+}
+
+if ($new) {
+	print "II: New modules (you've been busy, wipe the poop off your nose)\n";
+} else {
+	print "II: No new modules (hope you're happy, slacker)\n";
+}
+
+print "II: Done\n";
+
+exit(0);
--- linux-rt-2.6.31.orig/debian/scripts/control-create
+++ linux-rt-2.6.31/debian/scripts/control-create
@@ -0,0 +1,23 @@
+#!/bin/bash
+
+vars=$1
+
+. $vars
+
+if [ "$is_sub" = "" ]; then
+	flavour=$(basename $vars | sed 's/.*\.//')
+	stub=debian/control.d/flavour-control.stub
+else
+	flavour=$(basename $vars .vars)
+	stub=debian/sub-flavours/control.stub
+fi
+
+cat $stub | grep -v '^#' | sed			\
+	-e "s#FLAVOUR#$flavour#g"		\
+	-e "s#DESC#$desc#g"			\
+	-e "s#ARCH#$arch#g"			\
+	-e "s#SUPPORTED#$supported#g"		\
+	-e "s#TARGET#$target#g"			\
+	-e "s#BOOTLOADER#$bootloader#g" 	\
+	-e "s#=PROVIDES=#$provides#g"		\
+	-e "s#=CONFLICTS=#$conflicts#g"
--- linux-rt-2.6.31.orig/debian/scripts/sub-flavour
+++ linux-rt-2.6.31/debian/scripts/sub-flavour
@@ -0,0 +1,30 @@
+#!/bin/bash -e
+
+
+
+echo "SUB_PROCESS $FROM => $TO"
+
+export from_pkg="linux-image-$ABI_RELEASE-$FROM"
+export to_pkg="linux-image-$ABI_RELEASE-$TO"
+
+from_moddir="debian/$from_pkg/lib/modules/$ABI_RELEASE-$FROM"
+to_moddir="debian/$to_pkg/lib/modules/$ABI_RELEASE-$FROM"
+
+install -d "debian/$to_pkg/boot"
+install -m644 debian/$from_pkg/boot/{vmlinuz,System.map}-$ABI_RELEASE-$FROM \
+	debian/$to_pkg/boot/
+
+cat debian/sub-flavours/$TO.list | while read line; do
+	(cd debian/$from_pkg/lib/modules/$ABI_RELEASE-$FROM/kernel;
+	eval find $line -name '*.ko');
+done | while read mod; do
+	echo "SUB_INST $mod"
+	grep "^/lib/modules/$ABI_RELEASE-$FROM/kernel/$mod:" \
+		$from_moddir/modules.dep | sed -e 's/://' -e 's/ /\n/g' | \
+	while read m; do
+		test -f debian/$to_pkg/$m && continue
+		echo "SUB_INST $mod"
+		install -D -m644 debian/$from_pkg/$m \
+			debian/$to_pkg/$m
+	done
+done
--- linux-rt-2.6.31.orig/debian/scripts/link-headers
+++ linux-rt-2.6.31/debian/scripts/link-headers
@@ -0,0 +1,40 @@
+#!/bin/bash -e
+
+hdrdir="$1"
+symdir="$2"
+flavour="$3"
+
+echo "Symlinking and copying headers for $flavour..."
+
+excludes='( -path ./debian -prune -o -path ./.git ) -prune -o'
+
+(
+find . $excludes  -type f \
+	\( -name 'Makefile*' -o -name 'Kconfig*' -o -name 'Kbuild*' -o \
+	-name '*.sh' -o -name '*.pl' -o -name '*.lds' \) -print
+find ./include ./scripts -name .gitignore -prune -o -type f -print
+find ./include -mindepth 1 -maxdepth 1 $excludes -type d -print
+) | (
+while read file; do
+	dir=$file
+	lastdir=$file
+
+	if [ -e "$hdrdir/$file" -o -L "$hdrdir/$file" ]; then
+		continue
+	fi
+
+	while [ ! -e "$hdrdir/$dir" -a ! -L "$hdrdir/$dir" ]; do
+		lastdir=$dir
+		dir=`dirname $dir`
+	done
+	# If the last item to exist is a symlink we assume all is good
+	if [ ! -L "$hdrdir/$dir" ]; then
+		# Turns things like "./foo" into "../"
+		deref="`echo -n $lastdir | sed -e 's/^\.//' -e's,/[^/]*,../,g'`"
+		item="`echo -n $lastdir | sed -e 's/^\.\///'`"
+		ln -s $deref$symdir/$item $hdrdir/$item
+	fi
+done
+)
+
+exit
--- linux-rt-2.6.31.orig/debian/scripts/abi-check
+++ linux-rt-2.6.31/debian/scripts/abi-check
@@ -0,0 +1,210 @@
+#!/usr/bin/perl -w
+
+my $flavour = shift;
+my $prev_abinum = shift;
+my $abinum = shift;
+my $prev_abidir = shift;
+my $abidir = shift;
+my $skipabi = shift;
+
+my $fail_exit = 1;
+my $EE = "EE:";
+my $errors = 0;
+my $abiskip = 0;
+
+my $count;
+
+print "II: Checking ABI for $flavour...\n";
+
+if (-f "$prev_abidir/ignore"
+    or -f "$prev_abidir/$flavour.ignore" or "$skipabi" eq "true") {
+	print "WW: Explicitly asked to ignore ABI, running in no-fail mode\n";
+	$fail_exit = 0;
+	$abiskip = 1;
+	$EE = "WW:";
+}
+
+if ($prev_abinum != $abinum) {
+	print "II: Different ABI's, running in no-fail mode\n";
+	$fail_exit = 0;
+	$EE = "WW:";
+}
+
+if (not -f "$abidir/$flavour" or not -f "$prev_abidir/$flavour") {
+	print "EE: Previous or current ABI file missing!\n";
+	print "    $abidir/$flavour\n" if not -f "$abidir/$flavour";
+	print "    $prev_abidir/$flavour\n" if not -f "$prev_abidir/$flavour";
+
+	# Exit if the ABI files are missing, but return status based on whether
+	# skip ABI was indicated.
+	if ("$abiskip" eq "1") {
+		exit(0);
+	} else {
+		exit(1);
+	}
+}
+
+my %symbols;
+my %symbols_ignore;
+my %modules_ignore;
+my %module_syms;
+
+# See if we have any ignores
+my $ignore = 0;
+print "    Reading symbols/modules to ignore...";
+
+for $file ("$prev_abidir/../blacklist", "$prev_abidir/../../perm-blacklist") {
+	if (-f $file) {
+		open(IGNORE, "< $file") or
+			die "Could not open $file";
+		while (<IGNORE>) {
+			chomp;
+			if ($_ =~ m/M: (.*)/) {
+				$modules_ignore{$1} = 1;
+			} else {
+				$symbols_ignore{$_} = 1;
+			}
+			$ignore++;
+		}
+		close(IGNORE);
+	}
+}
+print "read $ignore symbols/modules.\n";
+
+sub is_ignored($$) {
+	my ($mod, $sym) = @_;
+
+	die "Missing module name in is_ignored()" if not defined($mod);
+	die "Missing symbol name in is_ignored()" if not defined($sym);
+
+	if (defined($symbols_ignore{$sym}) or defined($modules_ignore{$mod})) {
+		return 1;
+	}
+	return 0;
+}
+
+# Read new syms first
+print "    Reading new symbols ($abinum)...";
+$count = 0;
+open(NEW, "< $abidir/$flavour") or
+	die "Could not open $abidir/$flavour";
+while (<NEW>) {
+	chomp;
+	m/^(EXPORT_.+)\s(.+)\s(0x[0-9a-f]+)\s(.+)$/;
+	$symbols{$4}{'type'} = $1;
+	$symbols{$4}{'loc'} = $2;
+	$symbols{$4}{'hash'} = $3;
+	$module_syms{$2} = 0;
+	$count++;
+}
+close(NEW);
+print "read $count symbols.\n";
+
+# Now the old symbols, checking for missing ones
+print "    Reading old symbols ($prev_abinum)...";
+$count = 0;
+open(OLD, "< $prev_abidir/$flavour") or
+	die "Could not open $prev_abidir/$flavour";
+while (<OLD>) {
+	chomp;
+	m/^(EXPORT_.+)\s(.+)\s(0x[0-9a-f]+)\s(.+)$/;
+	$symbols{$4}{'old_type'} = $1;
+	$symbols{$4}{'old_loc'} = $2;
+	$symbols{$4}{'old_hash'} = $3;
+	$count++;
+}
+close(OLD);
+
+print "read $count symbols.\n";
+
+print "II: Checking for missing symbols in new ABI...";
+$count = 0;
+foreach $sym (keys(%symbols)) {
+	if (!defined($symbols{$sym}{'type'})) {
+		print "\n" if not $count;
+		printf("    MISS : %s%s\n", $sym,
+			is_ignored($symbols{$sym}{'old_loc'}, $sym) ? " (ignored)" : "");
+		$count++ if !is_ignored($symbols{$sym}{'old_loc'}, $sym);
+	}
+}
+print "    " if $count;
+print "found $count missing symbols\n";
+if ($count) {
+	print "$EE Symbols gone missing (what did you do!?!)\n";
+	$errors++;
+}
+
+
+print "II: Checking for new symbols in new ABI...";
+$count = 0;
+foreach $sym (keys(%symbols)) {
+	if (!defined($symbols{$sym}{'old_type'})) {
+		print "\n" if not $count;
+		print "    NEW : $sym\n";
+		$count++;
+	}
+}
+print "    " if $count;
+print "found $count new symbols\n";
+if ($count and $prev_abinum == $abinum) {
+	print "WW: Found new symbols within same ABI. Not recommended\n";
+}
+
+print "II: Checking for changes to ABI...\n";
+$count = 0;
+my $moved = 0;
+my $changed_type = 0;
+my $changed_hash = 0;
+foreach $sym (keys(%symbols)) {
+	if (!defined($symbols{$sym}{'old_type'}) or
+	    !defined($symbols{$sym}{'type'})) {
+		next;
+	}
+
+	# Changes in location don't hurt us, but log it anyway
+	if ($symbols{$sym}{'loc'} ne $symbols{$sym}{'old_loc'}) {
+		printf("    MOVE : %-40s : %s => %s\n", $sym, $symbols{$sym}{'old_loc'},
+			$symbols{$sym}{'loc'});
+		$moved++;
+	}
+
+	# Changes to export type are only bad if new type isn't
+	# EXPORT_SYMBOL. Changing things to GPL are bad.
+	if ($symbols{$sym}{'type'} ne $symbols{$sym}{'old_type'}) {
+		printf("    TYPE : %-40s : %s => %s%s\n", $sym, $symbols{$sym}{'old_type'}.
+			$symbols{$sym}{'type'}, is_ignored($symbols{$sym}{'loc'}, $sym)
+			? " (ignored)" : "");
+		$changed_type++ if $symbols{$sym}{'type'} ne "EXPORT_SYMBOL"
+			and !is_ignored($symbols{$sym}{'loc'}, $sym);
+	}
+
+	# Changes to the hash are always bad
+	if ($symbols{$sym}{'hash'} ne $symbols{$sym}{'old_hash'}) {
+		printf("    HASH : %-40s : %s => %s%s\n", $sym, $symbols{$sym}{'old_hash'},
+			$symbols{$sym}{'hash'}, is_ignored($symbols{$sym}{'loc'}, $sym)
+			? " (ignored)" : "");
+		$changed_hash++ if !is_ignored($symbols{$sym}{'loc'}, $sym);
+		$module_syms{$symbols{$sym}{'loc'}}++;
+	}
+}
+
+print "WW: $moved symbols changed location\n" if $moved;
+print "$EE $changed_type symbols changed export type and weren't ignored\n" if $changed_type;
+print "$EE $changed_hash symbols changed hash and weren't ignored\n" if $changed_hash;
+
+$errors++ if $changed_hash or $changed_type;
+if ($changed_hash) {
+	print "II: Module hash change summary...\n";
+	foreach $mod (sort { $module_syms{$b} <=> $module_syms{$a} } keys %module_syms) {
+		next if ! $module_syms{$mod};
+		printf("    %-40s: %d\n", $mod, $module_syms{$mod});
+	}
+}
+
+print "II: Done\n";
+
+if ($errors) {
+	exit($fail_exit);
+} else {
+	exit(0);
+}
--- linux-rt-2.6.31.orig/debian/scripts/misc/git-ubuntu-log
+++ linux-rt-2.6.31/debian/scripts/misc/git-ubuntu-log
@@ -0,0 +1,220 @@
+#!/usr/bin/perl -w
+
+use strict;
+use Text::Wrap;
+
+my $kernel_auth = "Upstream Kernel Changes";
+
+my (%map, @reverts);
+my $pstate = 1;
+my $no_kern_log = 0;
+my $print_shas = 0;
+my $first_print = 1;
+
+while (@ARGV) {
+	my $opt = $ARGV[0];
+	shift;
+	if ($opt eq "--no-kern-log") {
+		$no_kern_log = 1;
+	} elsif ($opt eq "--print-shas") {
+		$print_shas = 1;
+	} else {
+		print STDERR "Unknown options: $opt\n";
+		exit(1);
+	}
+}
+
+sub check_reverts($) {
+	my ($entry) = @_;
+	my ($check);
+
+	foreach $check (reverse @reverts) {
+		my $desc = "Revert \"" . $entry->{'desc'} . "\"";
+		if ($check->{'desc'} eq $desc) {
+			@reverts = grep($_->{'desc'} ne $desc, @reverts);
+			return 1;
+		}
+	}
+
+	return 0;
+}
+
+sub add_entry($) {
+	my ($entry) = @_;
+	my $key = $entry->{'author'};
+
+        # store description in array, in email->{desc list} map
+        if (exists $map{$key}) {
+                # grab ref
+                my $obj = $map{$key};
+
+                # add desc to array
+                push(@$obj, $entry);
+        } else {
+                # create new array, containing 1 item
+                my @arr = ($entry);
+
+                # store ref to array
+                $map{$key} = \@arr;
+        }
+}
+
+sub shortlog_entry($$$$$) {
+	my ($name, $desc, $bug, $cve, $commit) = @_;
+	my $entry;
+
+	$desc =~ s#/pub/scm/linux/kernel/git/#/.../#g;
+	$desc =~ s#\[PATCH\] ##g;
+
+	$desc =~ s#^\s*##g;
+	$desc =~ s# *UBUNTU: ##g;
+
+	$entry->{'desc'} = $desc;
+	$entry->{'bugno'} = $bug;
+	$entry->{'cve'} = $cve;
+	$entry->{'commit'} = $commit;
+	$entry->{'author'} = $name;
+
+	if ($desc =~ /^Revert "/) {
+		push(@reverts, $entry);
+		return;
+	}
+
+	return if check_reverts($entry);
+
+	add_entry($entry);
+}
+
+# sort comparison function
+sub by_name($$) {
+	my ($a, $b) = @_;
+
+	uc($a) cmp uc($b);
+}
+
+sub shortlog_output {
+	my ($obj, $key, $entry);
+
+	foreach $key (sort by_name keys %map) {
+		next if $key eq $kernel_auth and $no_kern_log;
+
+		print "\n" unless $first_print;
+		$first_print = 0;
+
+		# output author
+		printf "  [ %s ]\n\n", $key;
+
+		# output author's 1-line summaries
+		$obj = $map{$key};
+		foreach $entry (reverse @$obj) {
+			print wrap("  * ", "    ", $entry->{'desc'}) . "\n";
+			# For non upstream changes, add other info.
+			if ($key ne $kernel_auth) {
+				if ($print_shas) {
+					print "    - GIT-SHA " . $entry->{'commit'} .
+						"\n";
+				}
+			}
+			if (defined($entry->{'bugno'})) {
+				print "    - LP: #" .  $entry->{'bugno'} . "\n";
+			}
+			if (defined($entry->{'cve'})) {
+				print "    - " . $entry->{'cve'} . "\n";
+			}
+		}
+	}
+}
+
+sub changelog_input {
+	my ($author, $desc, $commit, $entry, $cve);
+
+	while (<STDIN>) {
+		# get commit
+		if ($pstate == 1) {
+			next unless /^commit (.*)/;
+
+			$commit = $1;
+
+			$pstate++;
+		}
+
+		# get author and email
+		elsif ($pstate == 2) {
+			my ($email);
+
+			next unless /^[Aa]uthor:?\s*(.*?)\s*<(.*)>/;
+
+			$author = $1;
+			$email = $2;
+			$desc = undef;
+			$cve = undef;
+
+			# cset author fixups
+			if (!$author) {
+				$author = $email;
+			}
+			$pstate++;
+		}
+
+		# skip to blank line
+		elsif ($pstate == 3) {
+			next unless /^\s*$/;
+			$pstate++;
+		}
+
+		# skip to non-blank line
+		elsif ($pstate == 4) {
+			next unless /^\s*?(.*)/;
+			my $ignore = 0;
+			my $bug = undef;
+
+			# skip lines that are obviously not
+			# a 1-line cset description
+			next if /^\s*From: /;
+
+			chomp;
+			$desc = $1;
+
+			if ($desc =~ /^ *(Revert "|)UBUNTU:/) {
+				while (<STDIN>) {
+					$ignore = 1 if /^ *Ignore: yes/i;
+					$bug = $2 if /^ *Bug: *(#|)(.*)/;
+					$cve = $1 if /^ *(CVE-.*)/;
+					last if /^commit /;
+				}
+			} else {
+				$author = $kernel_auth;
+				$ignore = 1 if $desc =~ /Merge /;
+				while (<STDIN>) {
+					$bug = $2 if /^ *Bug: *(#|)(.*)/;
+					$cve = $1 if /^ *(CVE-.*)/;
+					last if /^commit /;
+				}
+			}
+
+			if (!$ignore) {
+				&shortlog_entry($author, $desc, $bug,
+						$cve, $commit, 0);
+			}
+
+			$pstate = 1;
+			if ($_ && /^commit (.*)/) {
+				$commit = $1;
+				$pstate++;
+			}
+		}
+	
+		else {
+			die "invalid parse state $pstate";
+		}
+	}
+
+	foreach $entry (@reverts) {
+		add_entry($entry);
+	}	
+}
+
+&changelog_input;
+&shortlog_output;
+
+exit(0);
--- linux-rt-2.6.31.orig/debian/scripts/misc/insert-changes.pl
+++ linux-rt-2.6.31/debian/scripts/misc/insert-changes.pl
@@ -0,0 +1,30 @@
+#!/usr/bin/perl -w
+
+system("make -s -f debian/rules printchanges > debian/changes");
+
+open(CHANGELOG, "< debian/changelog") or die "Cannot open changelog";
+open(CHANGES, "< debian/changes") or die "Cannot open new changes";
+open(NEW, "> debian/changelog.new") or die "Cannot open new changelog";
+
+$printed = 0;
+
+while (<CHANGELOG>) {
+	if (/^  CHANGELOG: /) {
+		next if $printed;
+
+		while (<CHANGES>) {
+			print NEW;
+		}
+
+		$printed = 1;
+	} else {
+		print NEW;
+	}
+}
+
+close(NEW);
+close(CHANGES);
+close(CHANGELOG);
+
+rename("debian/changelog.new", "debian/changelog");
+unlink("debian/changes");
--- linux-rt-2.6.31.orig/debian/scripts/misc/splitconfig.pl
+++ linux-rt-2.6.31/debian/scripts/misc/splitconfig.pl
@@ -0,0 +1,110 @@
+#!/usr/bin/perl -w
+
+%configs = ();
+%common = ();
+
+print "Reading config's ...\n";
+
+opendir(DIR, ".");
+
+while (defined($config = readdir(DIR))) {
+	# Only config.*
+	next if $config !~ /^config\..*/;
+	# Nothing that is disabled, or remnant
+	next if $config =~ /.*\.(default|disabled|stub)$/;
+	# Server config's are standalone
+	#next if $config =~ /config.server-.*/;
+
+	%{$configs{$config}} = ();
+
+	print "  processing $config ... ";
+
+	open(CONFIG, "< $config");
+
+	while (<CONFIG>) {
+		/^#*\s*CONFIG_(\w+)[\s=](.*)$/ or next;
+
+		${$configs{$config}}{$1} = $2;
+
+		$common{$1} = $2;
+	}
+
+	close(CONFIG);
+
+	print "done.\n";
+}
+
+closedir(DIR);
+
+print "\n";
+
+print "Merging lists ... \n";
+
+for $config (keys(%configs)) {
+	my %options = %{$configs{$config}};
+
+	print "   processing $config ... ";
+
+	for $key (keys(%common)) {
+		next if not defined $common{$key};
+
+		# If we don't have the common option, then it isn't
+		# common. If we do have that option, it must have the same
+		# value (this is where the old split.py was broken). It
+		# also did the common check while it was parsing files, so
+		# that there were cases where a non-common option was in
+		# common anyway (ordering).
+		if (not defined($options{$key})) {
+			undef $common{$key};
+		} elsif ($common{$key} ne $options{$key}) {
+			undef $common{$key};
+		}
+	}
+
+	print "done.\n";
+}
+
+print "\n";
+
+print "Creating common config ... ";
+
+open(COMMON, "> config");
+print COMMON "#\n# Common config options automatically generated by splitconfig.pl\n#\n";
+
+for $key (sort(keys(%common))) {
+	next if not defined $common{$key};
+
+	if ($common{$key} eq "is not set") {
+		print COMMON "# CONFIG_$key is not set\n";
+	} else {
+		print COMMON "CONFIG_$key=$common{$key}\n";
+	}
+}
+close(COMMON);
+
+print "done.\n\n";
+
+print "Creating stub configs ...\n";
+
+for $config (keys(%configs)) {
+	my %options = %{$configs{$config}};
+
+	print "  processing $config ... ";
+
+	open(STUB, "> $config");
+	print STUB "#\n# Config options for $config automatically generated by splitconfig.pl\n#\n";
+
+	for $key (sort(keys(%options))) {
+		next if defined $common{$key};
+
+		if ($options{$key} eq "is not set") {
+			print STUB "# CONFIG_$key is not set\n";
+		} else {
+			print STUB "CONFIG_$key=$options{$key}\n";
+		}
+	}
+
+	close(STUB);
+
+	print "done.\n";
+}
--- linux-rt-2.6.31.orig/debian/scripts/misc/oldconfig
+++ linux-rt-2.6.31/debian/scripts/misc/oldconfig
@@ -0,0 +1,64 @@
+#!/bin/bash
+
+# We have to be in the top level kernel source directory
+if [ ! -f MAINTAINERS ] || [ ! -f Makefile ]; then
+	echo "This does not appear to be the kernel source directory." 1>&2
+	exit 1
+fi
+
+
+# One arg, and that's it. Just pass an architecture
+if [ $# -ne 1 ]; then
+	echo "Usage: $0 <arch>" 1>&2
+	exit 1
+fi
+
+arch="$1"
+
+case "$arch" in
+	amd64)	kernarch="x86_64"	;;
+	armel)	kernarch="arm"	;;
+	*)	kernarch="$arch"	;;
+esac
+
+confdir="`pwd`/debian/config/$arch"
+bindir="`pwd`/debian/scripts/misc"
+
+# Make sure the architecture exists
+if [ ! -d $confdir ]; then
+	echo "Could not find config directory for $arch" 1>&2
+	exit 1
+fi
+
+echo "Processing $arch ($kernarch) ... "
+
+configs=$(cd $confdir && ls config.*)
+
+if [ -f $confdir/config ]; then
+	for config in $configs; do
+		case $config in
+			*)
+				cat $confdir/config >> $confdir/$config
+				;;
+		esac
+	done
+	rm -f $confdir/config
+fi
+
+test -d build || mkdir build
+cd build
+for config in $configs; do
+	echo "Running silentoldconfig for $config ... "
+
+	cat $confdir/$config > .config
+
+	make -C ../ O=`pwd` silentoldconfig ARCH=$kernarch
+
+	cat .config > $confdir/$config
+done
+cd ..
+
+echo "Running splitconfig.pl ... "
+echo
+
+(cd $confdir ; $bindir/splitconfig.pl)
--- linux-rt-2.6.31.orig/debian/scripts/misc/prepare-ppa-source
+++ linux-rt-2.6.31/debian/scripts/misc/prepare-ppa-source
@@ -0,0 +1,106 @@
+#!/bin/sh
+#
+# This script prepares a source upload for a PPA build.
+#
+LAST_UPLOAD=../last-ppa-upload
+LAST_GIT_CHANGELOG=../last_git_changelog
+LAST_PPA_CHANGELOG=../last_ppa_changelog
+PPA_FILE="`make --no-print-directory -f debian/rules print-ppa-file-name`"
+
+if [ "$1" = "scrub" ]
+then
+	SCRUB=1
+fi
+
+#
+# The identity of the git committer must be known.
+#
+if [ ! -z "$GIT_AUTHOR_NAME" ] && [ ! -z "$GIT_AUTHOR_EMAIL" ]
+then
+	SIGNER_NAME="$GIT_AUTHOR_NAME"
+	SIGNER_EMAIL="$GIT_AUTHOR_EMAIL"
+elif [ ! -z "$GIT_COMMITTER_NAME" ] && [ ! -z "$GIT_COMMITTER_EMAIL" ]
+then
+	SIGNER_NAME="$GIT_COMMITTER_NAME"
+	SIGNER_EMAIL="$GIT_COMMITTER_EMAIL"
+else
+	echo Error: Unknown committer.
+	exit 1
+fi
+
+#
+# git current and cleanup.
+#
+git checkout -f
+git ls-files --others | xargs rm -rf
+
+#
+# Don't bother if the repo hasn't changed since the last upload.
+#
+if [ ! -f ${LAST_UPLOAD} ]
+then
+	touch ${LAST_UPLOAD}
+fi
+git log|head -n 1|sed 's/commit //' > ${LAST_UPLOAD}.tmp
+if cmp ${LAST_UPLOAD} ${LAST_UPLOAD}.tmp > /dev/null
+then
+	rm -f ${LAST_UPLOAD}.tmp
+	echo No upload needed.
+	exit 0
+fi
+mv ${LAST_UPLOAD}.tmp ${LAST_UPLOAD}
+
+#
+# The git HEAD can change without anyone updating the debian/changelog.
+# However, if the changelog version is updated, then we want to work
+# forward from that  version.
+#
+cp debian/changelog changelog.sav
+if [ -f ${LAST_GIT_CHANGELOG} ] && [ -f ${LAST_PPA_CHANGELOG} ]
+then
+	#
+	# If the changelog has not changed, then work forward from the
+	# last daily build version.
+	#
+	if cmp ${LAST_GIT_CHANGELOG} debian/changelog > /dev/null
+	then
+		cp ${LAST_PPA_CHANGELOG} debian/changelog
+	fi
+fi
+mv changelog.sav ${LAST_GIT_CHANGELOG}
+
+#
+# Notify the build scripts that this is a PPA build.
+#
+cp -v ${LAST_UPLOAD} ${PPA_FILE}
+
+#
+# In order to sign the package you must override the first signer's changelog entry.
+#
+export DEBEMAIL="$SIGNER_EMAIL"
+export DEBFULLNAME="$SIGNER_NAME"
+DEBCHANGE_COMMENT="PPA Upload from git HEAD `cat ${LAST_UPLOAD}`"
+debchange --increment --preserve "${DEBCHANGE_COMMENT}"
+if ! head -n 1 debian/changelog | grep ubuntu > /dev/null
+then
+	echo debchange did not work.
+	exit 1
+fi
+
+#
+# Make sure the third changelog field says hardy.
+#
+sed -i 's/) .*;/) hardy;/1' debian/changelog
+
+#
+# Make sure the next daily build works forward from this version if the git
+# changelog has not changed.
+#
+cp debian/changelog ${LAST_PPA_CHANGELOG}
+
+rm -rf ../linux* include/config .config
+dpkg-buildpackage -S -sa -rfakeroot -I.git -I.gitignore -i'\.git.*'
+
+rm -f ${PPA_FILE}
+exit 0
+
--- linux-rt-2.6.31.orig/debian/scripts/misc/getabis
+++ linux-rt-2.6.31/debian/scripts/misc/getabis
@@ -0,0 +1,82 @@
+#!/bin/bash
+
+if [ "$#" != "2" ]; then
+	echo "Usage: $0 <release> <revision>" 1>&2
+	exit 1
+fi
+
+ver=$1
+revision=$2
+abi=$(echo $revision | awk -F. '{print $1}')
+
+verabi=$ver-$abi
+verfull=$ver-$revision
+
+repo="http://archive.ubuntu.com/ubuntu/pool/main/l"
+repo_ports="http://ports.ubuntu.com/ubuntu-ports/pool/main/l"
+repo_uni="http://archive.ubuntu.com/ubuntu/pool/universe/l"
+
+WGET="wget --quiet -c"
+
+abidir="`pwd`/debian/abi/$verfull"
+tmpdir="`pwd`/abi-tmp-$verfull"
+origdir="`pwd`"
+
+test -d $tmpdir || mkdir $tmpdir
+
+getall() {
+	arch=$1
+	shift
+
+	mkdir -p $abidir/$arch
+
+	for sub in $@; do
+		if [ -f $abidir/$arch/$sub ]; then
+			echo "Exists: $sub"
+			continue
+		fi
+		echo -n "Fetching $sub..."
+		filename=linux-image-${verabi}-${sub}_${verfull}_${arch}.deb
+		cd $tmpdir
+		if ! [ -f $filename ]; then
+			$WGET $repo/linux-rt/$filename
+		fi
+		if ! [ -f $filename ]; then
+			$WGET $repo_ports/linux-rt/$filename
+		fi
+		if ! [ -f $filename ]; then
+			$WGET $repo_uni/linux-rt/$filename
+		fi
+		if [ "$?" = "0" ]; then
+			echo -n "extracting..."
+			dpkg-deb --extract $filename tmp
+			if [ -f tmp/boot/abi-* ]; then
+				mv tmp/boot/abi-* $abidir/$arch/$sub
+			else
+				echo -n "NO ABI FILE..."
+			fi
+			(cd tmp; find lib/modules/$verabi-$sub/kernel -name '*.ko') | \
+				sed -e 's/.*\/\([^\/]*\)\.ko/\1/' | sort > \
+				$abidir/$arch/$sub.modules
+			rm -rf tmp $filename
+			echo "done."
+		else
+			echo "FAILED."
+		fi
+		cd $origdir
+	done
+}
+
+# MAIN
+
+# Setup abi directory
+mkdir -p $abidir
+echo $abi > $abidir/abiname
+
+# NOTE: The flavours are hardcoded, because they may have changed from the
+# current build.
+
+getall amd64 rt
+getall i386 rt
+
+rmdir $tmpdir
--- linux-rt-2.6.31.orig/debian/scripts/misc/retag
+++ linux-rt-2.6.31/debian/scripts/misc/retag
@@ -0,0 +1,34 @@
+#!/usr/bin/perl -w
+
+open(TAGS, "git tag -l |") or die "Could not get list of tags";
+@tags = <TAGS>;
+close(TAGS);
+
+open(LOGS, "git log --pretty=short |") or die "ERROR: Calling git log";
+my $commit = "";
+
+while (<LOGS>) {
+	my $origtag;
+
+	if (m|^commit (.*)$|) {
+		$commit = $1;
+		next;
+	}
+
+	m|\s*UBUNTU: (Ubuntu-2\.6\..*)| or next;
+
+	$tag = $1;
+
+	($origtag) = grep(/^$tag.orig$/, @tags);
+
+	if (!defined($origtag)) {
+		print "I: Adding original tag for $tag\n";
+		system("git tag -m $tag $tag.orig $tag");
+	}
+
+	print "I: Tagging $tag => $commit\n";
+
+	system("git tag -f -m $tag $tag $commit");
+}
+
+close(LOGS);
--- linux-rt-2.6.31.orig/debian/scripts/misc/ppa-cron-job
+++ linux-rt-2.6.31/debian/scripts/misc/ppa-cron-job
@@ -0,0 +1,47 @@
+#!/bin/sh
+
+#
+# Use this script as a template for the daily kernel build cron job.
+# You should copy it somewhere outside of the git tree 'cause the whole
+# git tree gets removed and recreated.
+#
+KNAME=jaunty
+DAILY_BUILD_DIR=${KBDIR:=${HOME}/${KNAME}}
+KERNEL_GIT_REPO=${KREPO:=/srv/kernel.ubuntu.com/git/ubuntu/ubuntu-${KNAME}.git}
+
+#
+# Nothing works unless there is a dput configuration.
+#
+if [ ! -f ${HOME}/.dput.cf ]
+then
+	echo No dput configuration.
+	exit 1
+fi
+
+if [ ! -d ${DAILY_BUILD_DIR} ]
+then
+	rm -rf ${DAILY_BUILD_DIR}
+	mkdir -p ${DAILY_BUILD_DIR}
+fi
+
+#
+# Start with a fresh repo.
+#
+cd ${DAILY_BUILD_DIR}
+rm -rf ubuntu-${KNAME}
+git clone ${KERNEL_GIT_REPO}
+
+#
+# Remember that the success of prepare-ppa depends on
+# this user account having an un-passworded GPG key.
+# Otherwise it requires user intervention, e.g., a
+# user must enter the GPG key password.
+#
+rm -f *.changes
+(cd ubuntu-${KNAME}; debian/scripts/misc/prepare-ppa-source)
+
+find . -maxdepth 1 -type f -name "*.changes" | while read f
+do
+	echo dput my-ppa $f
+done
+
--- linux-rt-2.6.31.orig/debian/scripts/misc/doconfig
+++ linux-rt-2.6.31/debian/scripts/misc/doconfig
@@ -0,0 +1,65 @@
+#!/bin/bash
+
+# We have to be in the top level kernel source directory
+if [ ! -f MAINTAINERS ] || [ ! -f Makefile ]; then
+	echo "This does not appear to be the kernel source directory." 1>&2
+	exit 1
+fi
+
+
+# One arg, and that's it. Just pass an architecture
+if [ $# -ne 1 ]; then
+	echo "Usage: $0 <arch>" 1>&2
+	exit 1
+fi
+
+arch="$1"
+
+case "$arch" in
+	amd64)	kernarch="x86_64"	;;
+	armel)	kernarch="arm"	;;
+	*)	kernarch="$arch"	;;
+esac
+
+confdir="`pwd`/debian/config/$arch"
+bindir="`pwd`/debian/scripts/misc"
+
+# Make sure the architecture exists
+if [ ! -d $confdir ]; then
+	echo "Could not find config directory for $arch" 1>&2
+	exit 1
+fi
+
+echo "Processing $arch ($kernarch) ... "
+
+configs=$(cd $confdir && ls config.*)
+
+if [ -f $confdir/config ]; then
+	for config in $configs; do
+		case $config in
+			*)
+				cat $confdir/config >> $confdir/$config
+				;;
+		esac
+	done
+	rm -f $confdir/config
+fi
+
+test -d build || mkdir build
+cd build
+for config in $configs; do
+
+	cat $confdir/$config > .config
+
+	echo About to configure $arch $config
+	read 
+	make -C ../ O=`pwd` ARCH=$kernarch menuconfig
+
+	cat .config > $confdir/$config
+done
+cd ..
+
+echo "Running splitconfig.pl ... "
+echo
+
+(cd $confdir ; $bindir/splitconfig.pl)
--- linux-rt-2.6.31.orig/debian/stamps/keep-dir
+++ linux-rt-2.6.31/debian/stamps/keep-dir
@@ -0,0 +1 @@
+Place holder
--- linux-rt-2.6.31.orig/debian/patches/revert-369b8f6f
+++ linux-rt-2.6.31/debian/patches/revert-369b8f6f
@@ -0,0 +1,229 @@
+commit 369b8f6faf7762aba9ac7d840b4f2c0f534311bc
+Author: Ben Hutchings <ben@decadent.org.uk>
+Date:   Sun Aug 23 16:59:04 2009 +0100
+
+    drm/r128: Add test for initialisation to all ioctls that require it
+    
+    CVE-2009-3620
+    
+    Almost all r128's private ioctls require that the CCE state has
+    already been initialised.  However, most do not test that this has
+    been done, and will proceed to dereference a null pointer.  This may
+    result in a security vulnerability, since some ioctls are
+    unprivileged.
+    
+    This adds a macro for the common initialisation test and changes all
+    ioctl implementations that require prior initialisation to use that
+    macro.
+    
+    Also, r128_do_init_cce() does not test that the CCE state has not
+    been initialised already.  Repeated initialisation may lead to a crash
+    or resource leak.  This adds that test.
+    
+    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+    Signed-off-by: Dave Airlie <airlied@redhat.com>
+    (cherry picked from commit 7dc482dfeeeefcfd000d4271c4626937406756d7)
+    
+    Signed-off-by: Leann Ogasawara <leann.ogasawara@canonical.com>
+    Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
+
+diff --git b/drivers/gpu/drm/r128/r128_cce.c a/drivers/gpu/drm/r128/r128_cce.c
+index ebf9f63..c75fd35 100644
+--- b/drivers/gpu/drm/r128/r128_cce.c
++++ a/drivers/gpu/drm/r128/r128_cce.c
+@@ -353,11 +353,6 @@ static int r128_do_init_cce(struct drm_device * dev, drm_r128_init_t * init)
+ 
+ 	DRM_DEBUG("\n");
+ 
+-	if (dev->dev_private) {
+-		DRM_DEBUG("called when already initialized\n");
+-		return -EINVAL;
+-	}
+-
+ 	dev_priv = kzalloc(sizeof(drm_r128_private_t), GFP_KERNEL);
+ 	if (dev_priv == NULL)
+ 		return -ENOMEM;
+@@ -654,8 +649,6 @@ int r128_cce_start(struct drm_device *dev, void *data, struct drm_file *file_pri
+ 
+ 	LOCK_TEST_WITH_RETURN(dev, file_priv);
+ 
+-	DEV_INIT_TEST_WITH_RETURN(dev_priv);
+-
+ 	if (dev_priv->cce_running || dev_priv->cce_mode == R128_PM4_NONPM4) {
+ 		DRM_DEBUG("while CCE running\n");
+ 		return 0;
+@@ -678,8 +671,6 @@ int r128_cce_stop(struct drm_device *dev, void *data, struct drm_file *file_priv
+ 
+ 	LOCK_TEST_WITH_RETURN(dev, file_priv);
+ 
+-	DEV_INIT_TEST_WITH_RETURN(dev_priv);
+-
+ 	/* Flush any pending CCE commands.  This ensures any outstanding
+ 	 * commands are exectuted by the engine before we turn it off.
+ 	 */
+@@ -717,7 +708,10 @@ int r128_cce_reset(struct drm_device *dev, void *data, struct drm_file *file_pri
+ 
+ 	LOCK_TEST_WITH_RETURN(dev, file_priv);
+ 
+-	DEV_INIT_TEST_WITH_RETURN(dev_priv);
++	if (!dev_priv) {
++		DRM_DEBUG("called before init done\n");
++		return -EINVAL;
++	}
+ 
+ 	r128_do_cce_reset(dev_priv);
+ 
+@@ -734,8 +728,6 @@ int r128_cce_idle(struct drm_device *dev, void *data, struct drm_file *file_priv
+ 
+ 	LOCK_TEST_WITH_RETURN(dev, file_priv);
+ 
+-	DEV_INIT_TEST_WITH_RETURN(dev_priv);
+-
+ 	if (dev_priv->cce_running) {
+ 		r128_do_cce_flush(dev_priv);
+ 	}
+@@ -749,8 +741,6 @@ int r128_engine_reset(struct drm_device *dev, void *data, struct drm_file *file_
+ 
+ 	LOCK_TEST_WITH_RETURN(dev, file_priv);
+ 
+-	DEV_INIT_TEST_WITH_RETURN(dev->dev_private);
+-
+ 	return r128_do_engine_reset(dev);
+ }
+ 
+diff --git b/drivers/gpu/drm/r128/r128_drv.h a/drivers/gpu/drm/r128/r128_drv.h
+index 3c60829..797a26c 100644
+--- b/drivers/gpu/drm/r128/r128_drv.h
++++ a/drivers/gpu/drm/r128/r128_drv.h
+@@ -422,14 +422,6 @@ static __inline__ void r128_update_ring_snapshot(drm_r128_private_t * dev_priv)
+  * Misc helper macros
+  */
+ 
+-#define DEV_INIT_TEST_WITH_RETURN(_dev_priv)				\
+-do {									\
+-	if (!_dev_priv) {						\
+-		DRM_ERROR("called with no initialization\n");		\
+-		return -EINVAL;						\
+-	}								\
+-} while (0)
+-
+ #define RING_SPACE_TEST_WITH_RETURN( dev_priv )				\
+ do {									\
+ 	drm_r128_ring_buffer_t *ring = &dev_priv->ring; int i;		\
+diff --git b/drivers/gpu/drm/r128/r128_state.c a/drivers/gpu/drm/r128/r128_state.c
+index af2665c..026a48c 100644
+--- b/drivers/gpu/drm/r128/r128_state.c
++++ a/drivers/gpu/drm/r128/r128_state.c
+@@ -1244,18 +1244,14 @@ static void r128_cce_dispatch_stipple(struct drm_device * dev, u32 * stipple)
+ static int r128_cce_clear(struct drm_device *dev, void *data, struct drm_file *file_priv)
+ {
+ 	drm_r128_private_t *dev_priv = dev->dev_private;
+-	drm_r128_sarea_t *sarea_priv;
++	drm_r128_sarea_t *sarea_priv = dev_priv->sarea_priv;
+ 	drm_r128_clear_t *clear = data;
+ 	DRM_DEBUG("\n");
+ 
+ 	LOCK_TEST_WITH_RETURN(dev, file_priv);
+ 
+-	DEV_INIT_TEST_WITH_RETURN(dev_priv);
+-
+ 	RING_SPACE_TEST_WITH_RETURN(dev_priv);
+ 
+-	sarea_priv = dev_priv->sarea_priv;
+-
+ 	if (sarea_priv->nbox > R128_NR_SAREA_CLIPRECTS)
+ 		sarea_priv->nbox = R128_NR_SAREA_CLIPRECTS;
+ 
+@@ -1316,8 +1312,6 @@ static int r128_cce_flip(struct drm_device *dev, void *data, struct drm_file *fi
+ 
+ 	LOCK_TEST_WITH_RETURN(dev, file_priv);
+ 
+-	DEV_INIT_TEST_WITH_RETURN(dev_priv);
+-
+ 	RING_SPACE_TEST_WITH_RETURN(dev_priv);
+ 
+ 	if (!dev_priv->page_flipping)
+@@ -1337,8 +1331,6 @@ static int r128_cce_swap(struct drm_device *dev, void *data, struct drm_file *fi
+ 
+ 	LOCK_TEST_WITH_RETURN(dev, file_priv);
+ 
+-	DEV_INIT_TEST_WITH_RETURN(dev_priv);
+-
+ 	RING_SPACE_TEST_WITH_RETURN(dev_priv);
+ 
+ 	if (sarea_priv->nbox > R128_NR_SAREA_CLIPRECTS)
+@@ -1362,7 +1354,10 @@ static int r128_cce_vertex(struct drm_device *dev, void *data, struct drm_file *
+ 
+ 	LOCK_TEST_WITH_RETURN(dev, file_priv);
+ 
+-	DEV_INIT_TEST_WITH_RETURN(dev_priv);
++	if (!dev_priv) {
++		DRM_ERROR("called with no initialization\n");
++		return -EINVAL;
++	}
+ 
+ 	DRM_DEBUG("pid=%d index=%d count=%d discard=%d\n",
+ 		  DRM_CURRENTPID, vertex->idx, vertex->count, vertex->discard);
+@@ -1415,7 +1410,10 @@ static int r128_cce_indices(struct drm_device *dev, void *data, struct drm_file
+ 
+ 	LOCK_TEST_WITH_RETURN(dev, file_priv);
+ 
+-	DEV_INIT_TEST_WITH_RETURN(dev_priv);
++	if (!dev_priv) {
++		DRM_ERROR("called with no initialization\n");
++		return -EINVAL;
++	}
+ 
+ 	DRM_DEBUG("pid=%d buf=%d s=%d e=%d d=%d\n", DRM_CURRENTPID,
+ 		  elts->idx, elts->start, elts->end, elts->discard);
+@@ -1478,8 +1476,6 @@ static int r128_cce_blit(struct drm_device *dev, void *data, struct drm_file *fi
+ 
+ 	LOCK_TEST_WITH_RETURN(dev, file_priv);
+ 
+-	DEV_INIT_TEST_WITH_RETURN(dev_priv);
+-
+ 	DRM_DEBUG("pid=%d index=%d\n", DRM_CURRENTPID, blit->idx);
+ 
+ 	if (blit->idx < 0 || blit->idx >= dma->buf_count) {
+@@ -1505,8 +1501,6 @@ static int r128_cce_depth(struct drm_device *dev, void *data, struct drm_file *f
+ 
+ 	LOCK_TEST_WITH_RETURN(dev, file_priv);
+ 
+-	DEV_INIT_TEST_WITH_RETURN(dev_priv);
+-
+ 	RING_SPACE_TEST_WITH_RETURN(dev_priv);
+ 
+ 	ret = -EINVAL;
+@@ -1537,8 +1531,6 @@ static int r128_cce_stipple(struct drm_device *dev, void *data, struct drm_file
+ 
+ 	LOCK_TEST_WITH_RETURN(dev, file_priv);
+ 
+-	DEV_INIT_TEST_WITH_RETURN(dev_priv);
+-
+ 	if (DRM_COPY_FROM_USER(&mask, stipple->mask, 32 * sizeof(u32)))
+ 		return -EFAULT;
+ 
+@@ -1563,7 +1555,10 @@ static int r128_cce_indirect(struct drm_device *dev, void *data, struct drm_file
+ 
+ 	LOCK_TEST_WITH_RETURN(dev, file_priv);
+ 
+-	DEV_INIT_TEST_WITH_RETURN(dev_priv);
++	if (!dev_priv) {
++		DRM_ERROR("called with no initialization\n");
++		return -EINVAL;
++	}
+ 
+ 	DRM_DEBUG("idx=%d s=%d e=%d d=%d\n",
+ 		  indirect->idx, indirect->start, indirect->end,
+@@ -1625,7 +1620,10 @@ static int r128_getparam(struct drm_device *dev, void *data, struct drm_file *fi
+ 	drm_r128_getparam_t *param = data;
+ 	int value;
+ 
+-	DEV_INIT_TEST_WITH_RETURN(dev_priv);
++	if (!dev_priv) {
++		DRM_ERROR("called with no initialization\n");
++		return -EINVAL;
++	}
+ 
+ 	DRM_DEBUG("pid=%d\n", DRM_CURRENTPID);
+ 
--- linux-rt-2.6.31.orig/debian/patches/ndiswrapper.patch
+++ linux-rt-2.6.31/debian/patches/ndiswrapper.patch
@@ -0,0 +1,26 @@
+diff -ruNp linux-14.47/ubuntu/ndiswrapper/loader.c linux-rt-2.6.31/ubuntu/ndiswrapper/loader.c
+--- linux-14.47/ubuntu/ndiswrapper/loader.c	2009-10-14 23:11:23.000000000 +0200
++++ linux-rt-2.6.31/ubuntu/ndiswrapper/loader.c	2009-12-13 12:37:15.000000000 +0100
+@@ -847,7 +847,7 @@ int loader_init(void)
+ 
+ 	InitializeListHead(&wrap_drivers);
+ 	InitializeListHead(&wrap_devices);
+-	init_MUTEX(&loader_mutex);
++	semaphore_init(&loader_mutex);
+ 	init_completion(&loader_complete);
+ 	if ((err = misc_register(&wrapper_misc)) < 0 ) {
+ 		ERROR("couldn't register module (%d)", err);
+diff -ruNp linux-14.47/ubuntu/ndiswrapper/wrapndis.c linux-rt-2.6.31/ubuntu/ndiswrapper/wrapndis.c
+--- linux-14.47/ubuntu/ndiswrapper/wrapndis.c	2009-10-14 23:11:23.000000000 +0200
++++ linux-rt-2.6.31/ubuntu/ndiswrapper/wrapndis.c	2009-12-13 12:37:15.000000000 +0100
+@@ -2064,8 +2064,8 @@ static wstdcall NTSTATUS NdisAddDevice(s
+ 	}
+ 	nmb->next_device = IoAttachDeviceToDeviceStack(fdo, pdo);
+ 	spin_lock_init(&wnd->tx_ring_lock);
+-	init_MUTEX(&wnd->tx_ring_mutex);
+-	init_MUTEX(&wnd->ndis_req_mutex);
++	semaphore_init(&wnd->tx_ring_mutex);
++	semaphore_init(&wnd->ndis_req_mutex);
+ 	wnd->ndis_req_done = 0;
+ 	initialize_work(&wnd->tx_work, tx_worker, wnd);
+ 	wnd->tx_ring_start = 0;
--- linux-rt-2.6.31.orig/debian/patches/series
+++ linux-rt-2.6.31/debian/patches/series
@@ -0,0 +1,23 @@
+# Revert commits already present in preempt_rt patchset
+revert-369b8f6f
+revert-futex-changes.patch
+
+# This revert little changes to let preempt_rt apply cleanly
+revert-mmap-changes.patch
+
+# preempt_rt big patch
+patch-2.6.31.12-rt21
+
+# Re-apply one-line change to mmap.c
+reapply-mmap-changes.patch
+
+# Dynticks off by default
+linux-2.6-dynticks-off-by-default.patch
+
+# Various untested fix
+toshiba_acpi.patch
+quatech_daqp_cs.patch
+2870_rtmp_init.patch
+drbd_bitmap.patch
+target.patch
+ndiswrapper.patch
--- linux-rt-2.6.31.orig/debian/patches/toshiba_acpi.patch
+++ linux-rt-2.6.31/debian/patches/toshiba_acpi.patch
@@ -0,0 +1,12 @@
+diff -ruNp linux-14.47/drivers/platform/x86/toshiba_acpi.c linux-rt-2.6.31/drivers/platform/x86/toshiba_acpi.c
+--- linux-14.47/drivers/platform/x86/toshiba_acpi.c	2009-10-14 23:11:23.000000000 +0200
++++ linux-rt-2.6.31/drivers/platform/x86/toshiba_acpi.c	2009-12-13 12:37:15.000000000 +0100
+@@ -1127,7 +1127,7 @@ static int __init toshiba_acpi_init(void
+ 		printk(MY_INFO "ktoshkeyd will check %d time%s per second\n",
+ 			hotkeys_check_per_sec, hotkeys_check_per_sec==1?"":"s");
+ 		if (init_threaded_acpi() >= 0) {
+-			init_MUTEX_LOCKED(&thread_sem);
++			anon_semaphore_init_locked(&thread_sem);
+ 			kernel_thread(toshiba_acpi_thread, NULL, CLONE_KERNEL);
+ 			down(&thread_sem);
+ 		} else {
--- linux-rt-2.6.31.orig/debian/patches/revert-mmap-changes.patch
+++ linux-rt-2.6.31/debian/patches/revert-mmap-changes.patch
@@ -0,0 +1,10 @@
+--- a/mm/mmap.c.orig	2009-12-13 19:09:17.838386836 +0100
++++ b/mm/mmap.c	2009-12-13 19:09:26.948243835 +0100
+@@ -2217,7 +2217,6 @@ void exit_mmap(struct mm_struct *mm)
+ 	vm_unacct_memory(nr_accounted);
+ 	free_pgtables(tlb, vma, FIRST_USER_ADDRESS, 0);
+ 	tlb_finish_mmu(tlb, 0, end);
+-	arch_flush_exec_range(mm);
+ 
+ 	/*
+ 	 * Walk the list again, actually closing and freeing it,
--- linux-rt-2.6.31.orig/debian/patches/quatech_daqp_cs.patch
+++ linux-rt-2.6.31/debian/patches/quatech_daqp_cs.patch
@@ -0,0 +1,29 @@
+diff -ruNp linux-14.47/drivers/staging/comedi/drivers/quatech_daqp_cs.c linux-rt-2.6.31/drivers/staging/comedi/drivers/quatech_daqp_cs.c
+--- linux-14.47/drivers/staging/comedi/drivers/quatech_daqp_cs.c	2009-10-14 23:11:23.000000000 +0200
++++ linux-rt-2.6.31/drivers/staging/comedi/drivers/quatech_daqp_cs.c	2009-12-13 12:37:15.000000000 +0100
+@@ -47,6 +47,7 @@ Status: works
+ Devices: [Quatech] DAQP-208 (daqp), DAQP-308
+ */
+ 
++#include <linux/semaphore.h>
+ #include "../comedidev.h"
+ 
+ #include <pcmcia/cs_types.h>
+@@ -305,7 +306,7 @@ static void daqp_interrupt(int irq, void
+ 
+ 	case semaphore:
+ 
+-		up(&local->eos);
++		mutex_unlock(&local->eos);
+ 		break;
+ 
+ 	case buffer:
+@@ -431,7 +432,7 @@ static int daqp_ai_insn_read(struct come
+ 
+ 		/* Wait for interrupt service routine to unblock semaphore */
+ 		/* Maybe could use a timeout here, but it's interruptible */
+-		if (down_interruptible(&local->eos))
++		if (anon_down_interruptible(&local->eos))
+ 			return -EINTR;
+ 
+ 		data[i] = inb(dev->iobase + DAQP_FIFO);
--- linux-rt-2.6.31.orig/debian/patches/revert-futex-changes.patch
+++ linux-rt-2.6.31/debian/patches/revert-futex-changes.patch
@@ -0,0 +1,13 @@
+Index: linux-rt-2.6.31/kernel/futex.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/futex.c	2010-05-17 14:27:49.740885817 +0200
++++ linux-rt-2.6.31/kernel/futex.c	2010-05-17 14:27:58.858694015 +0200
+@@ -1957,7 +1957,7 @@
+ 	/* Unqueue and drop the lock */
+ 	unqueue_me_pi(&q);
+ 
+-	goto out_put_key;
++	goto out;
+ 
+ out_unlock_put_key:
+ 	queue_unlock(&q, hb);
--- linux-rt-2.6.31.orig/debian/patches/2870_rtmp_init.patch
+++ linux-rt-2.6.31/debian/patches/2870_rtmp_init.patch
@@ -0,0 +1,20 @@
+diff -ruNp linux-14.47/drivers/staging/rt2870/common/2870_rtmp_init.c linux-rt-2.6.31/drivers/staging/rt2870/common/2870_rtmp_init.c
+--- linux-14.47/drivers/staging/rt2870/common/2870_rtmp_init.c	2009-10-14 23:11:23.000000000 +0200
++++ linux-rt-2.6.31/drivers/staging/rt2870/common/2870_rtmp_init.c	2009-12-13 17:09:53.216771921 +0100
+@@ -751,13 +751,13 @@ NDIS_STATUS	 CreateThreads(
+ 
+ 	//init_MUTEX(&(pAd->usbdev_semaphore));
+ 
+-	semaphore_init_locked(&(pAd->mlme_semaphore));
++	anon_semaphore_init_locked(&(pAd->mlme_semaphore));
+ 	init_completion (&pAd->mlmeComplete);
+ 
+-	semaphore_init_locked(&(pAd->RTUSBCmd_semaphore));
++	anon_semaphore_init_locked(&(pAd->RTUSBCmd_semaphore));
+ 	init_completion (&pAd->CmdQComplete);
+ 
+-	semaphore_init_locked(&(pAd->RTUSBTimer_semaphore));
++	anon_semaphore_init_locked(&(pAd->RTUSBTimer_semaphore));
+ 	init_completion (&pAd->TimerQComplete);
+ 
+ 	// Creat MLME Thread
--- linux-rt-2.6.31.orig/debian/patches/reapply-mmap-changes.patch
+++ linux-rt-2.6.31/debian/patches/reapply-mmap-changes.patch
@@ -0,0 +1,10 @@
+--- a/mm/mmap.c.orig	2009-12-13 19:23:15.394642695 +0100
++++ b/mm/mmap.c	2009-12-13 19:23:38.228065114 +0100
+@@ -2223,6 +2223,7 @@ void exit_mmap(struct mm_struct *mm)
+ 	vm_unacct_memory(nr_accounted);
+ 	free_pgtables(&tlb, vma, FIRST_USER_ADDRESS, 0);
+ 	tlb_finish_mmu(&tlb, 0, end);
++	arch_flush_exec_range(mm);
+ 
+ 	/*
+ 	 * Walk the list again, actually closing and freeing it,
--- linux-rt-2.6.31.orig/debian/patches/linux-2.6-dynticks-off-by-default.patch
+++ linux-rt-2.6.31/debian/patches/linux-2.6-dynticks-off-by-default.patch
@@ -0,0 +1,24 @@
+Default boot behavior to dynticks off.
+
+From: Jon Masters <jcm redhat com>
+
+
+---
+
+ kernel/time/tick-sched.c |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+
+diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
+index a70a98c..ae7f394 100644
+--- a/kernel/time/tick-sched.c
++++ b/kernel/time/tick-sched.c
+@@ -95,7 +95,7 @@ static ktime_t tick_init_jiffy_update(void)
+ /*
+  * NO HZ enabled ?
+  */
+-static int tick_nohz_enabled __read_mostly  = 1;
++static int tick_nohz_enabled __read_mostly  = 0;
+ 
+ /*
+  * Enable / Disable tickless mode
--- linux-rt-2.6.31.orig/debian/patches/patch-2.6.31.12-rt21
+++ linux-rt-2.6.31/debian/patches/patch-2.6.31.12-rt21
@@ -0,0 +1,55494 @@
+Index: linux-rt-2.6.31/Documentation/hwlat_detector.txt
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ linux-rt-2.6.31/Documentation/hwlat_detector.txt	2010-05-17 14:23:19.888396254 +0200
+@@ -0,0 +1,64 @@
++Introduction:
++-------------
++
++The module hwlat_detector is a special purpose kernel module that is used to
++detect large system latencies induced by the behavior of certain underlying
++hardware or firmware, independent of Linux itself. The code was developed
++originally to detect SMIs (System Management Interrupts) on x86 systems,
++however there is nothing x86 specific about this patchset. It was
++originally written for use by the "RT" patch since the Real Time
++kernel is highly latency sensitive.
++
++SMIs are usually not serviced by the Linux kernel, which typically does not
++even know that they are occuring. SMIs are instead are set up by BIOS code
++and are serviced by BIOS code, usually for "critical" events such as
++management of thermal sensors and fans. Sometimes though, SMIs are used for
++other tasks and those tasks can spend an inordinate amount of time in the
++handler (sometimes measured in milliseconds). Obviously this is a problem if
++you are trying to keep event service latencies down in the microsecond range.
++
++The hardware latency detector works by hogging all of the cpus for configurable
++amounts of time (by calling stop_machine()), polling the CPU Time Stamp Counter
++for some period, then looking for gaps in the TSC data. Any gap indicates a
++time when the polling was interrupted and since the machine is stopped and
++interrupts turned off the only thing that could do that would be an SMI.
++
++Note that the SMI detector should *NEVER* be used in a production environment.
++It is intended to be run manually to determine if the hardware platform has a
++problem with long system firmware service routines.
++
++Usage:
++------
++
++Loading the module hwlat_detector passing the parameter "enabled=1" (or by
++setting the "enable" entry in "hwlat_detector" debugfs toggled on) is the only
++step required to start the hwlat_detector. It is possible to redefine the
++threshold in microseconds (us) above which latency spikes will be taken
++into account (parameter "threshold=").
++
++Example:
++
++	# modprobe hwlat_detector enabled=1 threshold=100
++
++After the module is loaded, it creates a directory named "hwlat_detector" under
++the debugfs mountpoint, "/debug/hwlat_detector" for this text. It is necessary
++to have debugfs mounted, which might be on /sys/debug on your system.
++
++The /debug/hwlat_detector interface contains the following files:
++
++count			- number of latency spikes observed since last reset
++enable			- a global enable/disable toggle (0/1), resets count
++max			- maximum hardware latency actually observed (usecs)
++sample			- a pipe from which to read current raw sample data
++			  in the format <timestamp> <latency observed usecs>
++			  (can be opened O_NONBLOCK for a single sample)
++threshold		- minimum latency value to be considered (usecs)
++width			- time period to sample with CPUs held (usecs)
++			  must be less than the total window size (enforced)
++window			- total period of sampling, width being inside (usecs)
++
++By default we will set width to 500,000 and window to 1,000,000, meaning that
++we will sample every 1,000,000 usecs (1s) for 500,000 usecs (0.5s). If we
++observe any latencies that exceed the threshold (initially 100 usecs),
++then we write to a global sample ring buffer of 8K samples, which is
++consumed by reading from the "sample" (pipe) debugfs file interface.
+Index: linux-rt-2.6.31/Documentation/kernel-parameters.txt
+===================================================================
+--- linux-rt-2.6.31.orig/Documentation/kernel-parameters.txt	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/Documentation/kernel-parameters.txt	2010-05-17 14:23:19.888396254 +0200
+@@ -2481,6 +2481,11 @@
+ 	trace_buf_size=nn[KMG]
+ 			[FTRACE] will set tracing buffer size.
+ 
++	trace_event=[event-list]
++			[FTRACE] Set and start specified trace events in order
++			to facilitate early boot debugging.
++			See also Documentation/trace/events.txt
++
+ 	trix=		[HW,OSS] MediaTrix AudioTrix Pro
+ 			Format:
+ 			<io>,<irq>,<dma>,<dma2>,<sb_io>,<sb_irq>,<sb_dma>,<mpu_io>,<mpu_irq>
+Index: linux-rt-2.6.31/Documentation/trace/events.txt
+===================================================================
+--- linux-rt-2.6.31.orig/Documentation/trace/events.txt	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/Documentation/trace/events.txt	2010-05-17 14:23:19.888396254 +0200
+@@ -1,7 +1,7 @@
+ 			     Event Tracing
+ 
+ 		Documentation written by Theodore Ts'o
+-			Updated by Li Zefan
++		Updated by Li Zefan and Tom Zanussi
+ 
+ 1. Introduction
+ ===============
+@@ -83,8 +83,199 @@
+  X - there is a mixture of events enabled and disabled
+  ? - this file does not affect any event
+ 
++2.3 Boot option
++---------------
++
++In order to facilitate early boot debugging, use boot option:
++
++	trace_event=[event-list]
++
++The format of this boot option is the same as described in section 2.1.
++
+ 3. Defining an event-enabled tracepoint
+ =======================================
+ 
+ See The example provided in samples/trace_events
+ 
++4. Event formats
++================
++
++Each trace event has a 'format' file associated with it that contains
++a description of each field in a logged event.  This information can
++be used to parse the binary trace stream, and is also the place to
++find the field names that can be used in event filters (see section 5).
++
++It also displays the format string that will be used to print the
++event in text mode, along with the event name and ID used for
++profiling.
++
++Every event has a set of 'common' fields associated with it; these are
++the fields prefixed with 'common_'.  The other fields vary between
++events and correspond to the fields defined in the TRACE_EVENT
++definition for that event.
++
++Each field in the format has the form:
++
++     field:field-type field-name; offset:N; size:N;
++
++where offset is the offset of the field in the trace record and size
++is the size of the data item, in bytes.
++
++For example, here's the information displayed for the 'sched_wakeup'
++event:
++
++# cat /debug/tracing/events/sched/sched_wakeup/format
++
++name: sched_wakeup
++ID: 60
++format:
++	field:unsigned short common_type;	offset:0;	size:2;
++	field:unsigned char common_flags;	offset:2;	size:1;
++	field:unsigned char common_preempt_count;	offset:3;	size:1;
++	field:int common_pid;	offset:4;	size:4;
++	field:int common_tgid;	offset:8;	size:4;
++
++	field:char comm[TASK_COMM_LEN];	offset:12;	size:16;
++	field:pid_t pid;	offset:28;	size:4;
++	field:int prio;	offset:32;	size:4;
++	field:int success;	offset:36;	size:4;
++	field:int cpu;	offset:40;	size:4;
++
++print fmt: "task %s:%d [%d] success=%d [%03d]", REC->comm, REC->pid,
++	   REC->prio, REC->success, REC->cpu
++
++This event contains 10 fields, the first 5 common and the remaining 5
++event-specific.  All the fields for this event are numeric, except for
++'comm' which is a string, a distinction important for event filtering.
++
++5. Event filtering
++==================
++
++Trace events can be filtered in the kernel by associating boolean
++'filter expressions' with them.  As soon as an event is logged into
++the trace buffer, its fields are checked against the filter expression
++associated with that event type.  An event with field values that
++'match' the filter will appear in the trace output, and an event whose
++values don't match will be discarded.  An event with no filter
++associated with it matches everything, and is the default when no
++filter has been set for an event.
++
++5.1 Expression syntax
++---------------------
++
++A filter expression consists of one or more 'predicates' that can be
++combined using the logical operators '&&' and '||'.  A predicate is
++simply a clause that compares the value of a field contained within a
++logged event with a constant value and returns either 0 or 1 depending
++on whether the field value matched (1) or didn't match (0):
++
++	  field-name relational-operator value
++
++Parentheses can be used to provide arbitrary logical groupings and
++double-quotes can be used to prevent the shell from interpreting
++operators as shell metacharacters.
++
++The field-names available for use in filters can be found in the
++'format' files for trace events (see section 4).
++
++The relational-operators depend on the type of the field being tested:
++
++The operators available for numeric fields are:
++
++==, !=, <, <=, >, >=
++
++And for string fields they are:
++
++==, !=
++
++Currently, only exact string matches are supported.
++
++Currently, the maximum number of predicates in a filter is 16.
++
++5.2 Setting filters
++-------------------
++
++A filter for an individual event is set by writing a filter expression
++to the 'filter' file for the given event.
++
++For example:
++
++# cd /debug/tracing/events/sched/sched_wakeup
++# echo "common_preempt_count > 4" > filter
++
++A slightly more involved example:
++
++# cd /debug/tracing/events/sched/sched_signal_send
++# echo "((sig >= 10 && sig < 15) || sig == 17) && comm != bash" > filter
++
++If there is an error in the expression, you'll get an 'Invalid
++argument' error when setting it, and the erroneous string along with
++an error message can be seen by looking at the filter e.g.:
++
++# cd /debug/tracing/events/sched/sched_signal_send
++# echo "((sig >= 10 && sig < 15) || dsig == 17) && comm != bash" > filter
++-bash: echo: write error: Invalid argument
++# cat filter
++((sig >= 10 && sig < 15) || dsig == 17) && comm != bash
++^
++parse_error: Field not found
++
++Currently the caret ('^') for an error always appears at the beginning of
++the filter string; the error message should still be useful though
++even without more accurate position info.
++
++5.3 Clearing filters
++--------------------
++
++To clear the filter for an event, write a '0' to the event's filter
++file.
++
++To clear the filters for all events in a subsystem, write a '0' to the
++subsystem's filter file.
++
++5.3 Subsystem filters
++---------------------
++
++For convenience, filters for every event in a subsystem can be set or
++cleared as a group by writing a filter expression into the filter file
++at the root of the subsytem.  Note however, that if a filter for any
++event within the subsystem lacks a field specified in the subsystem
++filter, or if the filter can't be applied for any other reason, the
++filter for that event will retain its previous setting.  This can
++result in an unintended mixture of filters which could lead to
++confusing (to the user who might think different filters are in
++effect) trace output.  Only filters that reference just the common
++fields can be guaranteed to propagate successfully to all events.
++
++Here are a few subsystem filter examples that also illustrate the
++above points:
++
++Clear the filters on all events in the sched subsytem:
++
++# cd /sys/kernel/debug/tracing/events/sched
++# echo 0 > filter
++# cat sched_switch/filter
++none
++# cat sched_wakeup/filter
++none
++
++Set a filter using only common fields for all events in the sched
++subsytem (all events end up with the same filter):
++
++# cd /sys/kernel/debug/tracing/events/sched
++# echo common_pid == 0 > filter
++# cat sched_switch/filter
++common_pid == 0
++# cat sched_wakeup/filter
++common_pid == 0
++
++Attempt to set a filter using a non-common field for all events in the
++sched subsytem (all events but those that have a prev_pid field retain
++their old filters):
++
++# cd /sys/kernel/debug/tracing/events/sched
++# echo prev_pid == 0 > filter
++# cat sched_switch/filter
++prev_pid == 0
++# cat sched_wakeup/filter
++common_pid == 0
+Index: linux-rt-2.6.31/Documentation/trace/ftrace.txt
+===================================================================
+--- linux-rt-2.6.31.orig/Documentation/trace/ftrace.txt	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/Documentation/trace/ftrace.txt	2010-05-17 14:23:19.888396254 +0200
+@@ -85,26 +85,19 @@
+ 	This file holds the output of the trace in a human
+ 	readable format (described below).
+ 
+-  latency_trace:
+-
+-	This file shows the same trace but the information
+-	is organized more to display possible latencies
+-	in the system (described below).
+-
+   trace_pipe:
+ 
+ 	The output is the same as the "trace" file but this
+ 	file is meant to be streamed with live tracing.
+-	Reads from this file will block until new data
+-	is retrieved. Unlike the "trace" and "latency_trace"
+-	files, this file is a consumer. This means reading
+-	from this file causes sequential reads to display
+-	more current data. Once data is read from this
+-	file, it is consumed, and will not be read
+-	again with a sequential read. The "trace" and
+-	"latency_trace" files are static, and if the
+-	tracer is not adding more data, they will display
+-	the same information every time they are read.
++	Reads from this file will block until new data is
++	retrieved.  Unlike the "trace" file, this file is a
++	consumer. This means reading from this file causes
++	sequential reads to display more current data. Once
++	data is read from this file, it is consumed, and
++	will not be read again with a sequential read. The
++	"trace" file is static, and if the tracer is not
++	adding more data,they will display the same
++	information every time they are read.
+ 
+   trace_options:
+ 
+@@ -117,10 +110,15 @@
+ 	Some of the tracers record the max latency.
+ 	For example, the time interrupts are disabled.
+ 	This time is saved in this file. The max trace
+-	will also be stored, and displayed by either
+-	"trace" or "latency_trace".  A new max trace will
+-	only be recorded if the latency is greater than
+-	the value in this file. (in microseconds)
++	will also be stored, and displayed by "trace".
++	A new max trace will only be recorded, if the
++	latency is greater than the value in this
++	file (in microseconds). Note that the max latency
++	recorded by the wakeup and the wakeup_rt tracer
++	do not necessarily reflect the worst-case latency
++	of the system, but may be erroneously high in
++	case two or more processes share the maximum
++	priority of the system.
+ 
+   buffer_size_kb:
+ 
+@@ -210,7 +208,7 @@
+ 	the trace with the longest max latency.
+ 	See tracing_max_latency. When a new max is recorded,
+ 	it replaces the old trace. It is best to view this
+-	trace via the latency_trace file.
++	trace with the latency-format option enabled.
+ 
+   "preemptoff"
+ 
+@@ -307,8 +305,8 @@
+ Latency trace format
+ --------------------
+ 
+-For traces that display latency times, the latency_trace file
+-gives somewhat more information to see why a latency happened.
++When the latency-format option is enabled, the trace file gives
++somewhat more information to see why a latency happened.
+ Here is a typical trace.
+ 
+ # tracer: irqsoff
+@@ -380,9 +378,10 @@
+ 
+ The above is mostly meaningful for kernel developers.
+ 
+-  time: This differs from the trace file output. The trace file output
+-	includes an absolute timestamp. The timestamp used by the
+-	latency_trace file is relative to the start of the trace.
++  time: When the latency-format option is enabled, the trace file
++	output includes a timestamp relative to the start of the
++	trace. This differs from the output when latency-format
++	is disabled, which includes an absolute timestamp.
+ 
+   delay: This is just to help catch your eye a bit better. And
+ 	 needs to be fixed to be only relative to the same CPU.
+@@ -440,7 +439,8 @@
+   sym-addr:
+    bash-4000  [01]  1477.606694: simple_strtoul <c0339346>
+ 
+-  verbose - This deals with the latency_trace file.
++  verbose - This deals with the trace file when the
++            latency-format option is enabled.
+ 
+     bash  4000 1 0 00000000 00010a95 [58127d26] 1720.415ms \
+     (+0.000ms): simple_strtoul (strict_strtoul)
+@@ -472,7 +472,7 @@
+ 		the app is no longer running
+ 
+ 		The lookup is performed when you read
+-		trace,trace_pipe,latency_trace. Example:
++		trace,trace_pipe. Example:
+ 
+ 		a.out-1623  [000] 40874.465068: /root/a.out[+0x480] <-/root/a.out[+0
+ x494] <- /root/a.out[+0x4a8] <- /lib/libc-2.7.so[+0x1e1a6]
+@@ -481,6 +481,11 @@
+ 	       every scheduling event. Will add overhead if
+ 	       there's a lot of tasks running at once.
+ 
++  latency-format - This option changes the trace. When
++                   it is enabled, the trace displays
++                   additional information about the
++                   latencies, as described in "Latency
++                   trace format".
+ 
+ sched_switch
+ ------------
+@@ -596,12 +601,13 @@
+ an example:
+ 
+  # echo irqsoff > current_tracer
++ # echo latency-format > trace_options
+  # echo 0 > tracing_max_latency
+  # echo 1 > tracing_enabled
+  # ls -ltr
+  [...]
+  # echo 0 > tracing_enabled
+- # cat latency_trace
++ # cat trace
+ # tracer: irqsoff
+ #
+ irqsoff latency trace v1.1.5 on 2.6.26
+@@ -703,12 +709,13 @@
+ is much like the irqsoff tracer.
+ 
+  # echo preemptoff > current_tracer
++ # echo latency-format > trace_options
+  # echo 0 > tracing_max_latency
+  # echo 1 > tracing_enabled
+  # ls -ltr
+  [...]
+  # echo 0 > tracing_enabled
+- # cat latency_trace
++ # cat trace
+ # tracer: preemptoff
+ #
+ preemptoff latency trace v1.1.5 on 2.6.26-rc8
+@@ -850,12 +857,13 @@
+ tracers.
+ 
+  # echo preemptirqsoff > current_tracer
++ # echo latency-format > trace_options
+  # echo 0 > tracing_max_latency
+  # echo 1 > tracing_enabled
+  # ls -ltr
+  [...]
+  # echo 0 > tracing_enabled
+- # cat latency_trace
++ # cat trace
+ # tracer: preemptirqsoff
+ #
+ preemptirqsoff latency trace v1.1.5 on 2.6.26-rc8
+@@ -1012,11 +1020,12 @@
+ 'chrt' which changes the priority of the task.
+ 
+  # echo wakeup > current_tracer
++ # echo latency-format > trace_options
+  # echo 0 > tracing_max_latency
+  # echo 1 > tracing_enabled
+  # chrt -f 5 sleep 1
+  # echo 0 > tracing_enabled
+- # cat latency_trace
++ # cat trace
+ # tracer: wakeup
+ #
+ wakeup latency trace v1.1.5 on 2.6.26-rc8
+Index: linux-rt-2.6.31/Documentation/trace/function-graph-fold.vim
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ linux-rt-2.6.31/Documentation/trace/function-graph-fold.vim	2010-05-17 14:23:19.888396254 +0200
+@@ -0,0 +1,42 @@
++" Enable folding for ftrace function_graph traces.
++"
++" To use, :source this file while viewing a function_graph trace, or use vim's
++" -S option to load from the command-line together with a trace.  You can then
++" use the usual vim fold commands, such as "za", to open and close nested
++" functions.  While closed, a fold will show the total time taken for a call,
++" as would normally appear on the line with the closing brace.  Folded
++" functions will not include finish_task_switch(), so folding should remain
++" relatively sane even through a context switch.
++"
++" Note that this will almost certainly only work well with a
++" single-CPU trace (e.g. trace-cmd report --cpu 1).
++
++function! FunctionGraphFoldExpr(lnum)
++  let line = getline(a:lnum)
++  if line[-1:] == '{'
++    if line =~ 'finish_task_switch() {$'
++      return '>1'
++    endif
++    return 'a1'
++  elseif line[-1:] == '}'
++    return 's1'
++  else
++    return '='
++  endif
++endfunction
++
++function! FunctionGraphFoldText()
++  let s = split(getline(v:foldstart), '|', 1)
++  if getline(v:foldend+1) =~ 'finish_task_switch() {$'
++    let s[2] = ' task switch  '
++  else
++    let e = split(getline(v:foldend), '|', 1)
++    let s[2] = e[2]
++  endif
++  return join(s, '|')
++endfunction
++
++setlocal foldexpr=FunctionGraphFoldExpr(v:lnum)
++setlocal foldtext=FunctionGraphFoldText()
++setlocal foldcolumn=12
++setlocal foldmethod=expr
+Index: linux-rt-2.6.31/Documentation/trace/histograms.txt
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ linux-rt-2.6.31/Documentation/trace/histograms.txt	2010-05-17 14:23:19.888396254 +0200
+@@ -0,0 +1,218 @@
++		Using the Linux Kernel Latency Histograms
++
++
++This document gives a short explanation how to enable, configure and use
++latency histograms. Latency histograms are primarily relevant in the
++context of real-time enabled kernels (CONFIG_PREEMPT/CONFIG_PREEMPT_RT)
++and are used in the quality management of the Linux real-time
++capabilities. Only processes with RT priority (SCHED_FIFO or SCHED_RR
++policy) are monitored.
++
++
++* Purpose of latency histograms
++
++A latency histogram continuously accumulates the frequencies of latency
++data. There are two types of histograms
++- potential sources of latencies
++- effective latencies
++
++
++* Potential sources of latencies
++
++Potential sources of latencies are code segments where interrupts,
++preemption or both are disabled (aka critical sections). To create
++histograms of potential sources of latency, the kernel stores the time
++stamp at the start of a critical section, determines the time elapsed
++when the end of the section is reached, and increments the frequency
++counter of that latency value - irrespective of whether any concurrently
++running process is affected by this latency or not.
++- Configuration items (in the Kernel hacking/Tracers submenu)
++  CONFIG_INTERRUPT_OFF_HIST
++  CONFIG_PREEMPT_OFF_HIST
++
++
++* Effective latencies
++There are two types of effective latencies, wakeup latencies and missed
++timer latencies
++
++* Wakeup latencies
++Wakeup latencies may occur during wakeup of a process. To determine
++wakeup latencies, the kernel stores the time stamp when a process is
++scheduled to be woken up, and determines the duration of the wakeup time
++shortly before control is passed over to this process. Note that the
++apparent latency in user space may be considerably longer, since
++i) interrupts may be disabled preventing the timer from waking up a process
++in time
++ii) the process may be interrupted after control is passed over to it
++but before user space execution takes place.
++If a particular wakeup latency is highest so far, details of the task
++that is suffering from this latency are stored as well (see below).
++- Configuration item (in the Kernel hacking/Tracers submenu)
++  CONFIG_WAKEUP_LATENCY_HIST
++
++* Missed timer latencies
++
++Missed timer latencies occur when a timer interrupt is serviced later
++than it should. This is mainly due to disabled interrupts. To determine
++the missed timer latency, the expected and the real execution time of a
++timer are compared. If the timer is executed later than expected and the
++timer is responsible to wakeup a sleeping process, the difference
++between the the expected and the real execution time is calculated and
++entered as latency into the missed timer offsets histogram. If the
++latency is highest so far among previous wakeup timers, details of the
++related task are stored as well (see below).
++- Configuration item (in the Kernel hacking/Tracers submenu)
++  CONFIG_MISSED_TIMER_OFFSETS_HIST
++
++
++* Usage
++
++The interface to the administration of the latency histograms is located
++in the debugfs file system. To mount it, either enter
++
++mount -t sysfs nodev /sys
++mount -t debugfs nodev /sys/kernel/debug
++
++from shell command line level, or add
++
++nodev	/sys			sysfs	defaults	0 0
++nodev	/sys/kernel/debug	debugfs	defaults	0 0
++
++to the file /etc/fstab in order to implicitly mount the debug file
++system at every reboot. All latency histogram related files are
++available in the directory /sys/kernel/debug/tracing/latency_hist. A
++particular histogram type is enabled by writing non-zero to the related
++variable in the /sys/kernel/debug/tracing/latency_hist/enable directory.
++Select "preemptirqsoff" for histograms of potential sources of
++latencies, "wakeup" for histograms of wakeup latencies and
++"missed_timer_offsets" for histograms of missed timer offsets,
++respectively.
++
++The histogram data - one per CPU - are available in the files
++/sys/kernel/debug/tracing/latency_hist/preemptoff/CPUx
++/sys/kernel/debug/tracing/latency_hist/irqsoff/CPUx
++/sys/kernel/debug/tracing/latency_hist/preemptirqsoff/CPUx
++/sys/kernel/debug/tracing/latency_hist/wakeup/CPUx.
++/sys/kernel/debug/tracing/latency_hist/wakeup/sharedprio/CPUx.
++/sys/kernel/debug/tracing/latency_hist/missed_timer_offsets/CPUx.
++
++The histograms are reset by writing non-zero to the file "reset" in a
++particular latency directory. To reset all latency data, use
++
++#!/bin/bash
++
++TRACINGDIR=/sys/kernel/debug/tracing
++HISTDIR=$TRACINGDIR/latency_hist
++
++if test -d $HISTDIR
++then
++  cd $HISTDIR
++  for i in `find . | grep /reset$`
++  do
++    echo 1 >$i
++  done
++fi
++
++
++* Data format
++
++Latency data are stored with a resolution of one microsecond. The
++maximum latency is 10,240 microseconds. Every output line contains the
++latency in microseconds in the first row and the number of samples in
++the second row. To display only lines with a positive latency count,
++use, for example,
++
++grep -v " 0$" /sys/kernel/debug/tracing/latency_hist/preemptoff/CPU0
++
++#Minimum latency: 0 microseconds
++#Average latency: 0 microseconds
++#Maximum latency: 25 microseconds
++#Total samples: 3104770694
++#There are 0 samples lower than 0 microseconds.
++#There are 0 samples greater or equal than 10240 microseconds.
++#usecs	         samples
++    0	      2984486876
++    1	        49843506
++    2	        58219047
++    3	         5348126
++    4	         2187960
++    5	         3388262
++    6	          959289
++    7	          208294
++    8	           40420
++    9	            4485
++   10	           14918
++   11	           18340
++   12	           25052
++   13	           19455
++   14	            5602
++   15	             969
++   16	              47
++   17	              18
++   18	              14
++   19	               1
++   20	               3
++   21	               2
++   22	               5
++   23	               2
++   25	               1
++
++
++* Two types of wakeup latency histograms
++
++Two different algorithms are used to determine the wakeup latency of a
++process. One of them only considers processes that exclusively use the
++highest priority of the system, the other one records the wakeup latency
++of a process even if it shares the highest system latency with other
++processes. The former is used to determine the worst-case latency of a
++system; if higher than expected, the hardware and or system software
++(e.g. the Linux kernel) may need to be debugged and fixed. The latter
++reflects the priority design of a given system; if higher than expected,
++the system design may need to be re-evaluated - the hardware
++manufacturer or the kernel developers must not be blamed for such
++latencies. The exclusive-priority wakeup latency histograms are located
++in the "wakeup" subdirectory, the shared-priority histograms are located
++in the "wakeup/sharedprio" subdirectory.
++
++
++* Wakeup latency of a selected process
++
++To only collect wakeup latency data of a particular process, write the
++PID of the requested process to
++
++/sys/kernel/debug/tracing/latency_hist/wakeup/pid.
++
++PIDs are not considered, if this variable is set to 0.
++
++
++* Missed timer offsets of a selected process
++
++To only collect missed timer offset data of a particular process, write the
++PID of the requested process to
++
++/sys/kernel/debug/tracing/latency_hist/missed_timer_offsets/pid.
++
++PIDs are not considered, if this variable is set to 0.
++
++
++* Details of processes with the highest wakeup or missed timer latency
++so far
++
++Selected data of processes that suffered from the highest wakeup or
++missed timer latency that occurred on a particular CPU are available in
++the files
++
++/sys/kernel/debug/tracing/latency_hist/wakeup/max_latency-CPUx
++/sys/kernel/debug/tracing/latency_hist/wakeup/sharedprio/max_latency-CPUx
++/sys/kernel/debug/tracing/latency_hist/missed_timer_offsets/max_latency-CPUx
++
++The format of the data is
++<PID> <Priority> <Latency> <Command>
++
++The priority <Priority> is given in user space format, i.e. the lowest
++RT priority is 1 and the highest RT priority is 99.
++
++These data are also reset when the related histograms are reset.
++Initially and after reset as long as no data are available yet, <PID> is
++set to -1, <Priority> to 100, <Latency> to -1 and <Command> to an empty
++string.
+Index: linux-rt-2.6.31/Documentation/trace/ring-buffer-design.txt
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ linux-rt-2.6.31/Documentation/trace/ring-buffer-design.txt	2010-05-17 14:23:19.888396254 +0200
+@@ -0,0 +1,955 @@
++		Lockless Ring Buffer Design
++		===========================
++
++Copyright 2009 Red Hat Inc.
++   Author:   Steven Rostedt <srostedt@redhat.com>
++  License:   The GNU Free Documentation License, Version 1.2
++               (dual licensed under the GPL v2)
++Reviewers:   Mathieu Desnoyers, Huang Ying, Hidetoshi Seto,
++	     and Frederic Weisbecker.
++
++
++Written for: 2.6.31
++
++Terminology used in this Document
++---------------------------------
++
++tail - where new writes happen in the ring buffer.
++
++head - where new reads happen in the ring buffer.
++
++producer - the task that writes into the ring buffer (same as writer)
++
++writer - same as producer
++
++consumer - the task that reads from the buffer (same as reader)
++
++reader - same as consumer.
++
++reader_page - A page outside the ring buffer used solely (for the most part)
++    by the reader.
++
++head_page - a pointer to the page that the reader will use next
++
++tail_page - a pointer to the page that will be written to next
++
++commit_page - a pointer to the page with the last finished non nested write.
++
++cmpxchg - hardware assisted atomic transaction that performs the following:
++
++   A = B iff previous A == C
++
++   R = cmpxchg(A, C, B) is saying that we replace A with B if and only if
++      current A is equal to C, and we put the old (current) A into R
++
++   R gets the previous A regardless if A is updated with B or not.
++
++   To see if the update was successful a compare of R == C may be used.
++
++The Generic Ring Buffer
++-----------------------
++
++The ring buffer can be used in either an overwrite mode or in
++producer/consumer mode.
++
++Producer/consumer mode is where the producer were to fill up the
++buffer before the consumer could free up anything, the producer
++will stop writing to the buffer. This will lose most recent events.
++
++Overwrite mode is where the produce were to fill up the buffer
++before the consumer could free up anything, the producer will
++overwrite the older data. This will lose the oldest events.
++
++No two writers can write at the same time (on the same per cpu buffer),
++but a writer may interrupt another writer, but it must finish writing
++before the previous writer may continue. This is very important to the
++algorithm. The writers act like a "stack". The way interrupts works
++enforces this behavior.
++
++
++  writer1 start
++     <preempted> writer2 start
++         <preempted> writer3 start
++                     writer3 finishes
++                 writer2 finishes
++  writer1 finishes
++
++This is very much like a writer being preempted by an interrupt and
++the interrupt doing a write as well.
++
++Readers can happen at any time. But no two readers may run at the
++same time, nor can a reader preempt/interrupt another reader. A reader
++can not preempt/interrupt a writer, but it may read/consume from the
++buffer at the same time as a writer is writing, but the reader must be
++on another processor to do so. A reader may read on its own processor
++and can be preempted by a writer.
++
++A writer can preempt a reader, but a reader can not preempt a writer.
++But a reader can read the buffer at the same time (on another processor)
++as a writer.
++
++The ring buffer is made up of a list of pages held together by a link list.
++
++At initialization a reader page is allocated for the reader that is not
++part of the ring buffer.
++
++The head_page, tail_page and commit_page are all initialized to point
++to the same page.
++
++The reader page is initialized to have its next pointer pointing to
++the head page, and its previous pointer pointing to a page before
++the head page.
++
++The reader has its own page to use. At start up time, this page is
++allocated but is not attached to the list. When the reader wants
++to read from the buffer, if its page is empty (like it is on start up)
++it will swap its page with the head_page. The old reader page will
++become part of the ring buffer and the head_page will be removed.
++The page after the inserted page (old reader_page) will become the
++new head page.
++
++Once the new page is given to the reader, the reader could do what
++it wants with it, as long as a writer has left that page.
++
++A sample of how the reader page is swapped: Note this does not
++show the head page in the buffer, it is for demonstrating a swap
++only.
++
++  +------+
++  |reader|          RING BUFFER
++  |page  |
++  +------+
++                  +---+   +---+   +---+
++                  |   |-->|   |-->|   |
++                  |   |<--|   |<--|   |
++                  +---+   +---+   +---+
++                   ^ |             ^ |
++                   | +-------------+ |
++                   +-----------------+
++
++
++  +------+
++  |reader|          RING BUFFER
++  |page  |-------------------+
++  +------+                   v
++    |             +---+   +---+   +---+
++    |             |   |-->|   |-->|   |
++    |             |   |<--|   |<--|   |<-+
++    |             +---+   +---+   +---+  |
++    |              ^ |             ^ |   |
++    |              | +-------------+ |   |
++    |              +-----------------+   |
++    +------------------------------------+
++
++  +------+
++  |reader|          RING BUFFER
++  |page  |-------------------+
++  +------+ <---------------+ v
++    |  ^          +---+   +---+   +---+
++    |  |          |   |-->|   |-->|   |
++    |  |          |   |   |   |<--|   |<-+
++    |  |          +---+   +---+   +---+  |
++    |  |             |             ^ |   |
++    |  |             +-------------+ |   |
++    |  +-----------------------------+   |
++    +------------------------------------+
++
++  +------+
++  |buffer|          RING BUFFER
++  |page  |-------------------+
++  +------+ <---------------+ v
++    |  ^          +---+   +---+   +---+
++    |  |          |   |   |   |-->|   |
++    |  |  New     |   |   |   |<--|   |<-+
++    |  | Reader   +---+   +---+   +---+  |
++    |  |  page ----^                 |   |
++    |  |                             |   |
++    |  +-----------------------------+   |
++    +------------------------------------+
++
++
++
++It is possible that the page swapped is the commit page and the tail page,
++if what is in the ring buffer is less than what is held in a buffer page.
++
++
++          reader page    commit page   tail page
++              |              |             |
++              v              |             |
++             +---+           |             |
++             |   |<----------+             |
++             |   |<------------------------+
++             |   |------+
++             +---+      |
++                        |
++                        v
++    +---+    +---+    +---+    +---+
++<---|   |--->|   |--->|   |--->|   |--->
++--->|   |<---|   |<---|   |<---|   |<---
++    +---+    +---+    +---+    +---+
++
++This case is still valid for this algorithm.
++When the writer leaves the page, it simply goes into the ring buffer
++since the reader page still points to the next location in the ring
++buffer.
++
++
++The main pointers:
++
++  reader page - The page used solely by the reader and is not part
++                of the ring buffer (may be swapped in)
++
++  head page - the next page in the ring buffer that will be swapped
++              with the reader page.
++
++  tail page - the page where the next write will take place.
++
++  commit page - the page that last finished a write.
++
++The commit page only is updated by the outer most writer in the
++writer stack. A writer that preempts another writer will not move the
++commit page.
++
++When data is written into the ring buffer, a position is reserved
++in the ring buffer and passed back to the writer. When the writer
++is finished writing data into that position, it commits the write.
++
++Another write (or a read) may take place at anytime during this
++transaction. If another write happens it must finish before continuing
++with the previous write.
++
++
++   Write reserve:
++
++       Buffer page
++      +---------+
++      |written  |
++      +---------+  <--- given back to writer (current commit)
++      |reserved |
++      +---------+ <--- tail pointer
++      | empty   |
++      +---------+
++
++   Write commit:
++
++       Buffer page
++      +---------+
++      |written  |
++      +---------+
++      |written  |
++      +---------+  <--- next positon for write (current commit)
++      | empty   |
++      +---------+
++
++
++ If a write happens after the first reserve:
++
++       Buffer page
++      +---------+
++      |written  |
++      +---------+  <-- current commit
++      |reserved |
++      +---------+  <--- given back to second writer
++      |reserved |
++      +---------+ <--- tail pointer
++
++  After second writer commits:
++
++
++       Buffer page
++      +---------+
++      |written  |
++      +---------+  <--(last full commit)
++      |reserved |
++      +---------+
++      |pending  |
++      |commit   |
++      +---------+ <--- tail pointer
++
++  When the first writer commits:
++
++       Buffer page
++      +---------+
++      |written  |
++      +---------+
++      |written  |
++      +---------+
++      |written  |
++      +---------+  <--(last full commit and tail pointer)
++
++
++The commit pointer points to the last write location that was
++committed without preempting another write. When a write that
++preempted another write is committed, it only becomes a pending commit
++and will not be a full commit till all writes have been committed.
++
++The commit page points to the page that has the last full commit.
++The tail page points to the page with the last write (before
++committing).
++
++The tail page is always equal to or after the commit page. It may
++be several pages ahead. If the tail page catches up to the commit
++page then no more writes may take place (regardless of the mode
++of the ring buffer: overwrite and produce/consumer).
++
++The order of pages are:
++
++ head page
++ commit page
++ tail page
++
++Possible scenario:
++                             tail page
++  head page         commit page  |
++      |                 |        |
++      v                 v        v
++    +---+    +---+    +---+    +---+
++<---|   |--->|   |--->|   |--->|   |--->
++--->|   |<---|   |<---|   |<---|   |<---
++    +---+    +---+    +---+    +---+
++
++There is a special case that the head page is after either the commit page
++and possibly the tail page. That is when the commit (and tail) page has been
++swapped with the reader page. This is because the head page is always
++part of the ring buffer, but the reader page is not. When ever there
++has been less than a full page that has been committed inside the ring buffer,
++and a reader swaps out a page, it will be swapping out the commit page.
++
++
++          reader page    commit page   tail page
++              |              |             |
++              v              |             |
++             +---+           |             |
++             |   |<----------+             |
++             |   |<------------------------+
++             |   |------+
++             +---+      |
++                        |
++                        v
++    +---+    +---+    +---+    +---+
++<---|   |--->|   |--->|   |--->|   |--->
++--->|   |<---|   |<---|   |<---|   |<---
++    +---+    +---+    +---+    +---+
++                        ^
++                        |
++                    head page
++
++
++In this case, the head page will not move when the tail and commit
++move back into the ring buffer.
++
++The reader can not swap a page into the ring buffer if the commit page
++is still on that page. If the read meets the last commit (real commit
++not pending or reserved), then there is nothing more to read.
++The buffer is considered empty until another full commit finishes.
++
++When the tail meets the head page, if the buffer is in overwrite mode,
++the head page will be pushed ahead one. If the buffer is in producer/consumer
++mode, the write will fail.
++
++Overwrite mode:
++
++            tail page
++               |
++               v
++    +---+    +---+    +---+    +---+
++<---|   |--->|   |--->|   |--->|   |--->
++--->|   |<---|   |<---|   |<---|   |<---
++    +---+    +---+    +---+    +---+
++                        ^
++                        |
++                    head page
++
++
++            tail page
++               |
++               v
++    +---+    +---+    +---+    +---+
++<---|   |--->|   |--->|   |--->|   |--->
++--->|   |<---|   |<---|   |<---|   |<---
++    +---+    +---+    +---+    +---+
++                                 ^
++                                 |
++                             head page
++
++
++                    tail page
++                        |
++                        v
++    +---+    +---+    +---+    +---+
++<---|   |--->|   |--->|   |--->|   |--->
++--->|   |<---|   |<---|   |<---|   |<---
++    +---+    +---+    +---+    +---+
++                                 ^
++                                 |
++                             head page
++
++Note, the reader page will still point to the previous head page.
++But when a swap takes place, it will use the most recent head page.
++
++
++Making the Ring Buffer Lockless:
++--------------------------------
++
++The main idea behind the lockless algorithm is to combine the moving
++of the head_page pointer with the swapping of pages with the reader.
++State flags are placed inside the pointer to the page. To do this,
++each page must be aligned in memory by 4 bytes. This will allow the 2
++least significant bits of the address to be used as flags. Since
++they will always be zero for the address. To get the address,
++simply mask out the flags.
++
++  MASK = ~3
++
++  address & MASK
++
++Two flags will be kept by these two bits:
++
++   HEADER - the page being pointed to is a head page
++
++   UPDATE - the page being pointed to is being updated by a writer
++          and was or is about to be a head page.
++
++
++          reader page
++              |
++              v
++             +---+
++             |   |------+
++             +---+      |
++                        |
++                        v
++    +---+    +---+    +---+    +---+
++<---|   |--->|   |-H->|   |--->|   |--->
++--->|   |<---|   |<---|   |<---|   |<---
++    +---+    +---+    +---+    +---+
++
++
++The above pointer "-H->" would have the HEADER flag set. That is
++the next page is the next page to be swapped out by the reader.
++This pointer means the next page is the head page.
++
++When the tail page meets the head pointer, it will use cmpxchg to
++change the pointer to the UPDATE state:
++
++
++            tail page
++               |
++               v
++    +---+    +---+    +---+    +---+
++<---|   |--->|   |-H->|   |--->|   |--->
++--->|   |<---|   |<---|   |<---|   |<---
++    +---+    +---+    +---+    +---+
++
++            tail page
++               |
++               v
++    +---+    +---+    +---+    +---+
++<---|   |--->|   |-U->|   |--->|   |--->
++--->|   |<---|   |<---|   |<---|   |<---
++    +---+    +---+    +---+    +---+
++
++"-U->" represents a pointer in the UPDATE state.
++
++Any access to the reader will need to take some sort of lock to serialize
++the readers. But the writers will never take a lock to write to the
++ring buffer. This means we only need to worry about a single reader,
++and writes only preempt in "stack" formation.
++
++When the reader tries to swap the page with the ring buffer, it
++will also use cmpxchg. If the flag bit in the pointer to the
++head page does not have the HEADER flag set, the compare will fail
++and the reader will need to look for the new head page and try again.
++Note, the flag UPDATE and HEADER are never set at the same time.
++
++The reader swaps the reader page as follows:
++
++  +------+
++  |reader|          RING BUFFER
++  |page  |
++  +------+
++                  +---+    +---+    +---+
++                  |   |--->|   |--->|   |
++                  |   |<---|   |<---|   |
++                  +---+    +---+    +---+
++                   ^ |               ^ |
++                   | +---------------+ |
++                   +-----H-------------+
++
++The reader sets the reader page next pointer as HEADER to the page after
++the head page.
++
++
++  +------+
++  |reader|          RING BUFFER
++  |page  |-------H-----------+
++  +------+                   v
++    |             +---+    +---+    +---+
++    |             |   |--->|   |--->|   |
++    |             |   |<---|   |<---|   |<-+
++    |             +---+    +---+    +---+  |
++    |              ^ |               ^ |   |
++    |              | +---------------+ |   |
++    |              +-----H-------------+   |
++    +--------------------------------------+
++
++It does a cmpxchg with the pointer to the previous head page to make it
++point to the reader page. Note that the new pointer does not have the HEADER
++flag set.  This action atomically moves the head page forward.
++
++  +------+
++  |reader|          RING BUFFER
++  |page  |-------H-----------+
++  +------+                   v
++    |  ^          +---+   +---+   +---+
++    |  |          |   |-->|   |-->|   |
++    |  |          |   |<--|   |<--|   |<-+
++    |  |          +---+   +---+   +---+  |
++    |  |             |             ^ |   |
++    |  |             +-------------+ |   |
++    |  +-----------------------------+   |
++    +------------------------------------+
++
++After the new head page is set, the previous pointer of the head page is
++updated to the reader page.
++
++  +------+
++  |reader|          RING BUFFER
++  |page  |-------H-----------+
++  +------+ <---------------+ v
++    |  ^          +---+   +---+   +---+
++    |  |          |   |-->|   |-->|   |
++    |  |          |   |   |   |<--|   |<-+
++    |  |          +---+   +---+   +---+  |
++    |  |             |             ^ |   |
++    |  |             +-------------+ |   |
++    |  +-----------------------------+   |
++    +------------------------------------+
++
++  +------+
++  |buffer|          RING BUFFER
++  |page  |-------H-----------+  <--- New head page
++  +------+ <---------------+ v
++    |  ^          +---+   +---+   +---+
++    |  |          |   |   |   |-->|   |
++    |  |  New     |   |   |   |<--|   |<-+
++    |  | Reader   +---+   +---+   +---+  |
++    |  |  page ----^                 |   |
++    |  |                             |   |
++    |  +-----------------------------+   |
++    +------------------------------------+
++
++Another important point. The page that the reader page points back to
++by its previous pointer (the one that now points to the new head page)
++never points back to the reader page. That is because the reader page is
++not part of the ring buffer. Traversing the ring buffer via the next pointers
++will always stay in the ring buffer. Traversing the ring buffer via the
++prev pointers may not.
++
++Note, the way to determine a reader page is simply by examining the previous
++pointer of the page. If the next pointer of the previous page does not
++point back to the original page, then the original page is a reader page:
++
++
++             +--------+
++             | reader |  next   +----+
++             |  page  |-------->|    |<====== (buffer page)
++             +--------+         +----+
++                 |                | ^
++                 |                v | next
++            prev |              +----+
++                 +------------->|    |
++                                +----+
++
++The way the head page moves forward:
++
++When the tail page meets the head page and the buffer is in overwrite mode
++and more writes take place, the head page must be moved forward before the
++writer may move the tail page. The way this is done is that the writer
++performs a cmpxchg to convert the pointer to the head page from the HEADER
++flag to have the UPDATE flag set. Once this is done, the reader will
++not be able to swap the head page from the buffer, nor will it be able to
++move the head page, until the writer is finished with the move.
++
++This eliminates any races that the reader can have on the writer. The reader
++must spin, and this is why the reader can not preempt the writer.
++
++            tail page
++               |
++               v
++    +---+    +---+    +---+    +---+
++<---|   |--->|   |-H->|   |--->|   |--->
++--->|   |<---|   |<---|   |<---|   |<---
++    +---+    +---+    +---+    +---+
++
++            tail page
++               |
++               v
++    +---+    +---+    +---+    +---+
++<---|   |--->|   |-U->|   |--->|   |--->
++--->|   |<---|   |<---|   |<---|   |<---
++    +---+    +---+    +---+    +---+
++
++The following page will be made into the new head page.
++
++           tail page
++               |
++               v
++    +---+    +---+    +---+    +---+
++<---|   |--->|   |-U->|   |-H->|   |--->
++--->|   |<---|   |<---|   |<---|   |<---
++    +---+    +---+    +---+    +---+
++
++After the new head page has been set, we can set the old head page
++pointer back to NORMAL.
++
++           tail page
++               |
++               v
++    +---+    +---+    +---+    +---+
++<---|   |--->|   |--->|   |-H->|   |--->
++--->|   |<---|   |<---|   |<---|   |<---
++    +---+    +---+    +---+    +---+
++
++After the head page has been moved, the tail page may now move forward.
++
++                    tail page
++                        |
++                        v
++    +---+    +---+    +---+    +---+
++<---|   |--->|   |--->|   |-H->|   |--->
++--->|   |<---|   |<---|   |<---|   |<---
++    +---+    +---+    +---+    +---+
++
++
++The above are the trivial updates. Now for the more complex scenarios.
++
++
++As stated before, if enough writes preempt the first write, the
++tail page may make it all the way around the buffer and meet the commit
++page. At this time, we must start dropping writes (usually with some kind
++of warning to the user). But what happens if the commit was still on the
++reader page? The commit page is not part of the ring buffer. The tail page
++must account for this.
++
++
++          reader page    commit page
++              |              |
++              v              |
++             +---+           |
++             |   |<----------+
++             |   |
++             |   |------+
++             +---+      |
++                        |
++                        v
++    +---+    +---+    +---+    +---+
++<---|   |--->|   |-H->|   |--->|   |--->
++--->|   |<---|   |<---|   |<---|   |<---
++    +---+    +---+    +---+    +---+
++               ^
++               |
++           tail page
++
++If the tail page were to simply push the head page forward, the commit when
++leaving the reader page would not be pointing to the correct page.
++
++The solution to this is to test if the commit page is on the reader page
++before pushing the head page. If it is, then it can be assumed that the
++tail page wrapped the buffer, and we must drop new writes.
++
++This is not a race condition, because the commit page can only be moved
++by the outter most writer (the writer that was preempted).
++This means that the commit will not move while a writer is moving the
++tail page. The reader can not swap the reader page if it is also being
++used as the commit page. The reader can simply check that the commit
++is off the reader page. Once the commit page leaves the reader page
++it will never go back on it unless a reader does another swap with the
++buffer page that is also the commit page.
++
++
++Nested writes
++-------------
++
++In the pushing forward of the tail page we must first push forward
++the head page if the head page is the next page. If the head page
++is not the next page, the tail page is simply updated with a cmpxchg.
++
++Only writers move the tail page. This must be done atomically to protect
++against nested writers.
++
++  temp_page = tail_page
++  next_page = temp_page->next
++  cmpxchg(tail_page, temp_page, next_page)
++
++The above will update the tail page if it is still pointing to the expected
++page. If this fails, a nested write pushed it forward, the the current write
++does not need to push it.
++
++
++           temp page
++               |
++               v
++            tail page
++               |
++               v
++    +---+    +---+    +---+    +---+
++<---|   |--->|   |--->|   |--->|   |--->
++--->|   |<---|   |<---|   |<---|   |<---
++    +---+    +---+    +---+    +---+
++
++Nested write comes in and moves the tail page forward:
++
++                    tail page (moved by nested writer)
++            temp page   |
++               |        |
++               v        v
++    +---+    +---+    +---+    +---+
++<---|   |--->|   |--->|   |--->|   |--->
++--->|   |<---|   |<---|   |<---|   |<---
++    +---+    +---+    +---+    +---+
++
++The above would fail the cmpxchg, but since the tail page has already
++been moved forward, the writer will just try again to reserve storage
++on the new tail page.
++
++But the moving of the head page is a bit more complex.
++
++            tail page
++               |
++               v
++    +---+    +---+    +---+    +---+
++<---|   |--->|   |-H->|   |--->|   |--->
++--->|   |<---|   |<---|   |<---|   |<---
++    +---+    +---+    +---+    +---+
++
++The write converts the head page pointer to UPDATE.
++
++            tail page
++               |
++               v
++    +---+    +---+    +---+    +---+
++<---|   |--->|   |-U->|   |--->|   |--->
++--->|   |<---|   |<---|   |<---|   |<---
++    +---+    +---+    +---+    +---+
++
++But if a nested writer preempts here. It will see that the next
++page is a head page, but it is also nested. It will detect that
++it is nested and will save that information. The detection is the
++fact that it sees the UPDATE flag instead of a HEADER or NORMAL
++pointer.
++
++The nested writer will set the new head page pointer.
++
++           tail page
++               |
++               v
++    +---+    +---+    +---+    +---+
++<---|   |--->|   |-U->|   |-H->|   |--->
++--->|   |<---|   |<---|   |<---|   |<---
++    +---+    +---+    +---+    +---+
++
++But it will not reset the update back to normal. Only the writer
++that converted a pointer from HEAD to UPDATE will convert it back
++to NORMAL.
++
++                    tail page
++                        |
++                        v
++    +---+    +---+    +---+    +---+
++<---|   |--->|   |-U->|   |-H->|   |--->
++--->|   |<---|   |<---|   |<---|   |<---
++    +---+    +---+    +---+    +---+
++
++After the nested writer finishes, the outer most writer will convert
++the UPDATE pointer to NORMAL.
++
++
++                    tail page
++                        |
++                        v
++    +---+    +---+    +---+    +---+
++<---|   |--->|   |--->|   |-H->|   |--->
++--->|   |<---|   |<---|   |<---|   |<---
++    +---+    +---+    +---+    +---+
++
++
++It can be even more complex if several nested writes came in and moved
++the tail page ahead several pages:
++
++
++(first writer)
++
++            tail page
++               |
++               v
++    +---+    +---+    +---+    +---+
++<---|   |--->|   |-H->|   |--->|   |--->
++--->|   |<---|   |<---|   |<---|   |<---
++    +---+    +---+    +---+    +---+
++
++The write converts the head page pointer to UPDATE.
++
++            tail page
++               |
++               v
++    +---+    +---+    +---+    +---+
++<---|   |--->|   |-U->|   |--->|   |--->
++--->|   |<---|   |<---|   |<---|   |<---
++    +---+    +---+    +---+    +---+
++
++Next writer comes in, and sees the update and sets up the new
++head page.
++
++(second writer)
++
++           tail page
++               |
++               v
++    +---+    +---+    +---+    +---+
++<---|   |--->|   |-U->|   |-H->|   |--->
++--->|   |<---|   |<---|   |<---|   |<---
++    +---+    +---+    +---+    +---+
++
++The nested writer moves the tail page forward. But does not set the old
++update page to NORMAL because it is not the outer most writer.
++
++                    tail page
++                        |
++                        v
++    +---+    +---+    +---+    +---+
++<---|   |--->|   |-U->|   |-H->|   |--->
++--->|   |<---|   |<---|   |<---|   |<---
++    +---+    +---+    +---+    +---+
++
++Another writer preempts and sees the page after the tail page is a head page.
++It changes it from HEAD to UPDATE.
++
++(third writer)
++
++                    tail page
++                        |
++                        v
++    +---+    +---+    +---+    +---+
++<---|   |--->|   |-U->|   |-U->|   |--->
++--->|   |<---|   |<---|   |<---|   |<---
++    +---+    +---+    +---+    +---+
++
++The writer will move the head page forward:
++
++
++(third writer)
++
++                    tail page
++                        |
++                        v
++    +---+    +---+    +---+    +---+
++<---|   |--->|   |-U->|   |-U->|   |-H->
++--->|   |<---|   |<---|   |<---|   |<---
++    +---+    +---+    +---+    +---+
++
++But now that the third writer did change the HEAD flag to UPDATE it
++will convert it to normal:
++
++
++(third writer)
++
++                    tail page
++                        |
++                        v
++    +---+    +---+    +---+    +---+
++<---|   |--->|   |-U->|   |--->|   |-H->
++--->|   |<---|   |<---|   |<---|   |<---
++    +---+    +---+    +---+    +---+
++
++
++Then it will move the tail page, and return back to the second writer.
++
++
++(second writer)
++
++                             tail page
++                                 |
++                                 v
++    +---+    +---+    +---+    +---+
++<---|   |--->|   |-U->|   |--->|   |-H->
++--->|   |<---|   |<---|   |<---|   |<---
++    +---+    +---+    +---+    +---+
++
++
++The second writer will fail to move the tail page because it was already
++moved, so it will try again and add its data to the new tail page.
++It will return to the first writer.
++
++
++(first writer)
++
++                             tail page
++                                 |
++                                 v
++    +---+    +---+    +---+    +---+
++<---|   |--->|   |-U->|   |--->|   |-H->
++--->|   |<---|   |<---|   |<---|   |<---
++    +---+    +---+    +---+    +---+
++
++The first writer can not know atomically test if the tail page moved
++while it updates the HEAD page. It will then update the head page to
++what it thinks is the new head page.
++
++
++(first writer)
++
++                             tail page
++                                 |
++                                 v
++    +---+    +---+    +---+    +---+
++<---|   |--->|   |-U->|   |-H->|   |-H->
++--->|   |<---|   |<---|   |<---|   |<---
++    +---+    +---+    +---+    +---+
++
++Since the cmpxchg returns the old value of the pointer the first writer
++will see it succeeded in updating the pointer from NORMAL to HEAD.
++But as we can see, this is not good enough. It must also check to see
++if the tail page is either where it use to be or on the next page:
++
++
++(first writer)
++
++               A        B    tail page
++               |        |        |
++               v        v        v
++    +---+    +---+    +---+    +---+
++<---|   |--->|   |-U->|   |-H->|   |-H->
++--->|   |<---|   |<---|   |<---|   |<---
++    +---+    +---+    +---+    +---+
++
++If tail page != A and tail page does not equal B, then it must reset the
++pointer back to NORMAL. The fact that it only needs to worry about
++nested writers, it only needs to check this after setting the HEAD page.
++
++
++(first writer)
++
++               A        B    tail page
++               |        |        |
++               v        v        v
++    +---+    +---+    +---+    +---+
++<---|   |--->|   |-U->|   |--->|   |-H->
++--->|   |<---|   |<---|   |<---|   |<---
++    +---+    +---+    +---+    +---+
++
++Now the writer can update the head page. This is also why the head page must
++remain in UPDATE and only reset by the outer most writer. This prevents
++the reader from seeing the incorrect head page.
++
++
++(first writer)
++
++               A        B    tail page
++               |        |        |
++               v        v        v
++    +---+    +---+    +---+    +---+
++<---|   |--->|   |--->|   |--->|   |-H->
++--->|   |<---|   |<---|   |<---|   |<---
++    +---+    +---+    +---+    +---+
++
+Index: linux-rt-2.6.31/MAINTAINERS
+===================================================================
+--- linux-rt-2.6.31.orig/MAINTAINERS	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/MAINTAINERS	2010-05-17 14:23:19.888396254 +0200
+@@ -2266,6 +2266,15 @@
+ S:	Maintained
+ F:	drivers/media/video/gspca/
+ 
++HARDWARE LATENCY DETECTOR
++P:	Jon Masters
++M:	jcm@jonmasters.org
++W:	http://www.kernel.org/pub/linux/kernel/people/jcm/hwlat_detector/
++S:	Supported
++L:	linux-kernel@vger.kernel.org
++F:	Documentation/hwlat_detector.txt
++F:	drivers/misc/hwlat_detector.c
++
+ HARDWARE MONITORING
+ L:	lm-sensors@lm-sensors.org
+ W:	http://www.lm-sensors.org/
+Index: linux-rt-2.6.31/Makefile
+===================================================================
+--- linux-rt-2.6.31.orig/Makefile	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/Makefile	2010-05-17 14:23:19.888396254 +0200
+@@ -1,7 +1,7 @@
+ VERSION = 2
+ PATCHLEVEL = 6
+ SUBLEVEL = 31
+-EXTRAVERSION = .12
++EXTRAVERSION =.12-rt21
+ NAME = Man-Eating Seals of Antiquity
+ 
+ # *DOCUMENTATION*
+Index: linux-rt-2.6.31/arch/Kconfig
+===================================================================
+--- linux-rt-2.6.31.orig/arch/Kconfig	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/Kconfig	2010-05-17 14:23:19.898484267 +0200
+@@ -33,6 +33,11 @@
+ config HAVE_OPROFILE
+ 	bool
+ 
++config PROFILE_NMI
++	bool
++	depends on OPROFILE
++	default y
++
+ config KPROBES
+ 	bool "Kprobes"
+ 	depends on KALLSYMS && MODULES
+Index: linux-rt-2.6.31/arch/alpha/include/asm/rwsem.h
+===================================================================
+--- linux-rt-2.6.31.orig/arch/alpha/include/asm/rwsem.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/alpha/include/asm/rwsem.h	2010-05-17 14:23:19.898484267 +0200
+@@ -18,15 +18,18 @@
+ 
+ struct rwsem_waiter;
+ 
+-extern struct rw_semaphore *rwsem_down_read_failed(struct rw_semaphore *sem);
+-extern struct rw_semaphore *rwsem_down_write_failed(struct rw_semaphore *sem);
+-extern struct rw_semaphore *rwsem_wake(struct rw_semaphore *);
+-extern struct rw_semaphore *rwsem_downgrade_wake(struct rw_semaphore *sem);
++extern struct rw_anon_semaphore *
++rwsem_down_read_failed(struct rw_anon_semaphore *sem);
++extern struct rw_anon_semaphore *
++rwsem_down_write_failed(struct rw_anon_semaphore *sem);
++extern struct rw_anon_semaphore *rwsem_wake(struct rw_anon_semaphore *);
++extern struct rw_anon_semaphore *
++rwsem_downgrade_wake(struct rw_anon_semaphore *sem);
+ 
+ /*
+  * the semaphore definition
+  */
+-struct rw_semaphore {
++struct rw_anon_semaphore {
+ 	long			count;
+ #define RWSEM_UNLOCKED_VALUE		0x0000000000000000L
+ #define RWSEM_ACTIVE_BIAS		0x0000000000000001L
+@@ -38,6 +41,31 @@
+ 	struct list_head	wait_list;
+ };
+ 
++#define __RWSEM_ANON_INITIALIZER(name) \
++	{ RWSEM_UNLOCKED_VALUE, SPIN_LOCK_UNLOCKED, \
++	LIST_HEAD_INIT((name).wait_list) }
++
++#define DECLARE_ANON_RWSEM(name) \
++	struct rw_anon_semaphore name = __RWSEM_ANON_INITIALIZER(name)
++
++static inline void init_anon_rwsem(struct rw_anon_semaphore *sem)
++{
++	sem->count = RWSEM_UNLOCKED_VALUE;
++	spin_lock_init(&sem->wait_lock);
++	INIT_LIST_HEAD(&sem->wait_list);
++}
++
++static inline int anon_rwsem_is_locked(struct rw_anon_semaphore *sem)
++{
++	return (sem->count != 0);
++}
++
++struct rw_semaphore {
++	long			count;
++	spinlock_t		wait_lock;
++	struct list_head	wait_list;
++};
++
+ #define __RWSEM_INITIALIZER(name) \
+ 	{ RWSEM_UNLOCKED_VALUE, SPIN_LOCK_UNLOCKED, \
+ 	LIST_HEAD_INIT((name).wait_list) }
+@@ -47,12 +75,15 @@
+ 
+ static inline void init_rwsem(struct rw_semaphore *sem)
+ {
+-	sem->count = RWSEM_UNLOCKED_VALUE;
+-	spin_lock_init(&sem->wait_lock);
+-	INIT_LIST_HEAD(&sem->wait_list);
++	init_anon_rwsem((struct rw_anon_semaphore *)sem);
+ }
+ 
+-static inline void __down_read(struct rw_semaphore *sem)
++static inline int rwsem_is_locked(struct rw_semaphore *sem)
++{
++	return (sem->count != 0);
++}
++
++static inline void __down_read(struct rw_anon_semaphore *sem)
+ {
+ 	long oldcount;
+ #ifndef	CONFIG_SMP
+@@ -79,7 +110,7 @@
+ /*
+  * trylock for reading -- returns 1 if successful, 0 if contention
+  */
+-static inline int __down_read_trylock(struct rw_semaphore *sem)
++static inline int __down_read_trylock(struct rw_anon_semaphore *sem)
+ {
+ 	long old, new, res;
+ 
+@@ -94,7 +125,7 @@
+ 	return res >= 0 ? 1 : 0;
+ }
+ 
+-static inline void __down_write(struct rw_semaphore *sem)
++static inline void __down_write(struct rw_anon_semaphore *sem)
+ {
+ 	long oldcount;
+ #ifndef	CONFIG_SMP
+@@ -121,7 +152,7 @@
+ /*
+  * trylock for writing -- returns 1 if successful, 0 if contention
+  */
+-static inline int __down_write_trylock(struct rw_semaphore *sem)
++static inline int __down_write_trylock(struct rw_anon_semaphore *sem)
+ {
+ 	long ret = cmpxchg(&sem->count, RWSEM_UNLOCKED_VALUE,
+ 			   RWSEM_ACTIVE_WRITE_BIAS);
+@@ -130,7 +161,7 @@
+ 	return 0;
+ }
+ 
+-static inline void __up_read(struct rw_semaphore *sem)
++static inline void __up_read(struct rw_anon_semaphore *sem)
+ {
+ 	long oldcount;
+ #ifndef	CONFIG_SMP
+@@ -155,7 +186,7 @@
+ 			rwsem_wake(sem);
+ }
+ 
+-static inline void __up_write(struct rw_semaphore *sem)
++static inline void __up_write(struct rw_anon_semaphore *sem)
+ {
+ 	long count;
+ #ifndef	CONFIG_SMP
+@@ -184,7 +215,7 @@
+ /*
+  * downgrade write lock to read lock
+  */
+-static inline void __downgrade_write(struct rw_semaphore *sem)
++static inline void __downgrade_write(struct rw_anon_semaphore *sem)
+ {
+ 	long oldcount;
+ #ifndef	CONFIG_SMP
+@@ -208,7 +239,7 @@
+ 		rwsem_downgrade_wake(sem);
+ }
+ 
+-static inline void rwsem_atomic_add(long val, struct rw_semaphore *sem)
++static inline void rwsem_atomic_add(long val, struct rw_anon_semaphore *sem)
+ {
+ #ifndef	CONFIG_SMP
+ 	sem->count += val;
+@@ -227,7 +258,7 @@
+ #endif
+ }
+ 
+-static inline long rwsem_atomic_update(long val, struct rw_semaphore *sem)
++static inline long rwsem_atomic_update(long val, struct rw_anon_semaphore *sem)
+ {
+ #ifndef	CONFIG_SMP
+ 	sem->count += val;
+@@ -250,10 +281,5 @@
+ #endif
+ }
+ 
+-static inline int rwsem_is_locked(struct rw_semaphore *sem)
+-{
+-	return (sem->count != 0);
+-}
+-
+ #endif /* __KERNEL__ */
+ #endif /* _ALPHA_RWSEM_H */
+Index: linux-rt-2.6.31/arch/alpha/kernel/irq.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/alpha/kernel/irq.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/alpha/kernel/irq.c	2010-05-17 14:23:19.898484267 +0200
+@@ -81,7 +81,7 @@
+ #endif
+ 
+ 	if (irq < ACTUAL_NR_IRQS) {
+-		spin_lock_irqsave(&irq_desc[irq].lock, flags);
++		atomic_spin_lock_irqsave(&irq_desc[irq].lock, flags);
+ 		action = irq_desc[irq].action;
+ 		if (!action) 
+ 			goto unlock;
+@@ -105,7 +105,7 @@
+ 
+ 		seq_putc(p, '\n');
+ unlock:
+-		spin_unlock_irqrestore(&irq_desc[irq].lock, flags);
++		atomic_spin_unlock_irqrestore(&irq_desc[irq].lock, flags);
+ 	} else if (irq == ACTUAL_NR_IRQS) {
+ #ifdef CONFIG_SMP
+ 		seq_puts(p, "IPI: ");
+Index: linux-rt-2.6.31/arch/alpha/kernel/time.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/alpha/kernel/time.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/alpha/kernel/time.c	2010-05-17 14:23:19.898484267 +0200
+@@ -106,7 +106,7 @@
+ 	profile_tick(CPU_PROFILING);
+ #endif
+ 
+-	write_seqlock(&xtime_lock);
++	write_atomic_seqlock(&xtime_lock);
+ 
+ 	/*
+ 	 * Calculate how many ticks have passed since the last update,
+@@ -136,7 +136,7 @@
+ 		state.last_rtc_update = xtime.tv_sec - (tmp ? 600 : 0);
+ 	}
+ 
+-	write_sequnlock(&xtime_lock);
++	write_atomic_sequnlock(&xtime_lock);
+ 
+ #ifndef CONFIG_SMP
+ 	while (nticks--)
+@@ -416,14 +416,14 @@
+ 	unsigned long delta_cycles, delta_usec, partial_tick;
+ 
+ 	do {
+-		seq = read_seqbegin_irqsave(&xtime_lock, flags);
++		seq = read_atomic_seqbegin_irqsave(&xtime_lock, flags);
+ 
+ 		delta_cycles = rpcc() - state.last_time;
+ 		sec = xtime.tv_sec;
+ 		usec = (xtime.tv_nsec / 1000);
+ 		partial_tick = state.partial_tick;
+ 
+-	} while (read_seqretry_irqrestore(&xtime_lock, seq, flags));
++	} while (read_atomic_seqretry_irqrestore(&xtime_lock, seq, flags));
+ 
+ #ifdef CONFIG_SMP
+ 	/* Until and unless we figure out how to get cpu cycle counters
+@@ -470,7 +470,7 @@
+ 	if ((unsigned long)tv->tv_nsec >= NSEC_PER_SEC)
+ 		return -EINVAL;
+ 
+-	write_seqlock_irq(&xtime_lock);
++	write_atomic_seqlock_irq(&xtime_lock);
+ 
+ 	/* The offset that is added into time in do_gettimeofday above
+ 	   must be subtracted out here to keep a coherent view of the
+@@ -496,7 +496,7 @@
+ 
+ 	ntp_clear();
+ 
+-	write_sequnlock_irq(&xtime_lock);
++	write_atomic_sequnlock_irq(&xtime_lock);
+ 	clock_was_set();
+ 	return 0;
+ }
+Index: linux-rt-2.6.31/arch/arm/Kconfig
+===================================================================
+--- linux-rt-2.6.31.orig/arch/arm/Kconfig	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/arm/Kconfig	2010-05-17 14:23:19.898484267 +0200
+@@ -962,18 +962,7 @@
+ 	  accounting to be spread across the timer interval, preventing a
+ 	  "thundering herd" at every timer tick.
+ 
+-config PREEMPT
+-	bool "Preemptible Kernel (EXPERIMENTAL)"
+-	depends on EXPERIMENTAL
+-	help
+-	  This option reduces the latency of the kernel when reacting to
+-	  real-time or interactive events by allowing a low priority process to
+-	  be preempted even if it is in kernel mode executing a system call.
+-	  This allows applications to run more reliably even when the system is
+-	  under load.
+-
+-	  Say Y here if you are building a kernel for a desktop, embedded
+-	  or real-time system.  Say N if you are unsure.
++source kernel/Kconfig.preempt
+ 
+ config HZ
+ 	int
+Index: linux-rt-2.6.31/arch/arm/include/asm/dma.h
+===================================================================
+--- linux-rt-2.6.31.orig/arch/arm/include/asm/dma.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/arm/include/asm/dma.h	2010-05-17 14:23:19.898484267 +0200
+@@ -31,18 +31,18 @@
+ #define DMA_MODE_CASCADE 0xc0
+ #define DMA_AUTOINIT	 0x10
+ 
+-extern spinlock_t  dma_spin_lock;
++extern atomic_spinlock_t  dma_spin_lock;
+ 
+ static inline unsigned long claim_dma_lock(void)
+ {
+ 	unsigned long flags;
+-	spin_lock_irqsave(&dma_spin_lock, flags);
++	atomic_spin_lock_irqsave(&dma_spin_lock, flags);
+ 	return flags;
+ }
+ 
+ static inline void release_dma_lock(unsigned long flags)
+ {
+-	spin_unlock_irqrestore(&dma_spin_lock, flags);
++	atomic_spin_unlock_irqrestore(&dma_spin_lock, flags);
+ }
+ 
+ /* Clear the 'DMA Pointer Flip Flop'.
+Index: linux-rt-2.6.31/arch/arm/include/asm/ftrace.h
+===================================================================
+--- linux-rt-2.6.31.orig/arch/arm/include/asm/ftrace.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/arm/include/asm/ftrace.h	2010-05-17 14:23:19.898484267 +0200
+@@ -11,4 +11,38 @@
+ 
+ #endif
+ 
++#ifndef __ASSEMBLY__
++
++#if defined(CONFIG_FRAME_POINTER) && !defined(CONFIG_ARM_UNWIND)
++/*
++ * return_address uses walk_stackframe to do it's work.  If both
++ * CONFIG_FRAME_POINTER=y and CONFIG_ARM_UNWIND=y walk_stackframe uses unwind
++ * information.  For this to work in the function tracer many functions would
++ * have to be marked with __notrace.  So for now just depend on
++ * !CONFIG_ARM_UNWIND.
++ */
++
++void *return_address(unsigned int);
++
++#else
++
++extern inline void *return_address(unsigned int level)
++{
++	return NULL;
++}
++
++#endif
++
++#define HAVE_ARCH_CALLER_ADDR
++
++#define CALLER_ADDR0 ((unsigned long)__builtin_return_address(0))
++#define CALLER_ADDR1 ((unsigned long)return_address(1))
++#define CALLER_ADDR2 ((unsigned long)return_address(2))
++#define CALLER_ADDR3 ((unsigned long)return_address(3))
++#define CALLER_ADDR4 ((unsigned long)return_address(4))
++#define CALLER_ADDR5 ((unsigned long)return_address(5))
++#define CALLER_ADDR6 ((unsigned long)return_address(6))
++
++#endif /* ifndef __ASSEMBLY__ */
++
+ #endif /* _ASM_ARM_FTRACE */
+Index: linux-rt-2.6.31/arch/arm/include/asm/mach/irq.h
+===================================================================
+--- linux-rt-2.6.31.orig/arch/arm/include/asm/mach/irq.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/arm/include/asm/mach/irq.h	2010-05-17 14:23:19.898484267 +0200
+@@ -26,9 +26,9 @@
+  */
+ #define do_bad_IRQ(irq,desc)				\
+ do {							\
+-	spin_lock(&desc->lock);				\
++	atomic_spin_lock(&desc->lock);			\
+ 	handle_bad_irq(irq, desc);			\
+-	spin_unlock(&desc->lock);			\
++	atomic_spin_unlock(&desc->lock);		\
+ } while(0)
+ 
+ #endif
+Index: linux-rt-2.6.31/arch/arm/include/asm/system.h
+===================================================================
+--- linux-rt-2.6.31.orig/arch/arm/include/asm/system.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/arm/include/asm/system.h	2010-05-17 14:23:19.898484267 +0200
+@@ -60,6 +60,8 @@
+ #include <linux/linkage.h>
+ #include <linux/irqflags.h>
+ 
++#include <asm/memory.h>
++
+ #define __exception	__attribute__((section(".exception.text")))
+ 
+ struct thread_info;
+Index: linux-rt-2.6.31/arch/arm/include/asm/tlb.h
+===================================================================
+--- linux-rt-2.6.31.orig/arch/arm/include/asm/tlb.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/arm/include/asm/tlb.h	2010-05-17 14:23:19.898484267 +0200
+@@ -40,17 +40,12 @@
+ 	unsigned long		range_end;
+ };
+ 
+-DECLARE_PER_CPU(struct mmu_gather, mmu_gathers);
+-
+-static inline struct mmu_gather *
+-tlb_gather_mmu(struct mm_struct *mm, unsigned int full_mm_flush)
++static inline void
++tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm,
++	       unsigned int full_mm_flush)
+ {
+-	struct mmu_gather *tlb = &get_cpu_var(mmu_gathers);
+-
+ 	tlb->mm = mm;
+ 	tlb->fullmm = full_mm_flush;
+-
+-	return tlb;
+ }
+ 
+ static inline void
+@@ -61,8 +56,6 @@
+ 
+ 	/* keep the page table cache within bounds */
+ 	check_pgt_cache();
+-
+-	put_cpu_var(mmu_gathers);
+ }
+ 
+ /*
+Index: linux-rt-2.6.31/arch/arm/kernel/Makefile
+===================================================================
+--- linux-rt-2.6.31.orig/arch/arm/kernel/Makefile	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/arch/arm/kernel/Makefile	2010-05-17 14:23:19.898484267 +0200
+@@ -9,10 +9,12 @@
+ CFLAGS_REMOVE_ftrace.o = -pg
+ endif
+ 
++CFLAGS_REMOVE_return_address.o = -pg
++
+ # Object file lists.
+ 
+ obj-y		:= compat.o elf.o entry-armv.o entry-common.o irq.o \
+-		   process.o ptrace.o setup.o signal.o \
++		   process.o ptrace.o return_address.o setup.o signal.o \
+ 		   sys_arm.o stacktrace.o time.o traps.o
+ 
+ obj-$(CONFIG_ISA_DMA_API)	+= dma.o
+Index: linux-rt-2.6.31/arch/arm/kernel/dma.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/arm/kernel/dma.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/arm/kernel/dma.c	2010-05-17 14:23:19.898484267 +0200
+@@ -21,7 +21,7 @@
+ 
+ #include <asm/mach/dma.h>
+ 
+-DEFINE_SPINLOCK(dma_spin_lock);
++DEFINE_ATOMIC_SPINLOCK(dma_spin_lock);
+ EXPORT_SYMBOL(dma_spin_lock);
+ 
+ static dma_t *dma_chan[MAX_DMA_CHANNELS];
+Index: linux-rt-2.6.31/arch/arm/kernel/entry-common.S
+===================================================================
+--- linux-rt-2.6.31.orig/arch/arm/kernel/entry-common.S	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/arch/arm/kernel/entry-common.S	2010-05-17 14:23:19.898484267 +0200
+@@ -59,7 +59,8 @@
+ 	b	ret_slow_syscall		@ Check work again
+ 
+ work_resched:
+-	bl	schedule
++	bl	__schedule
++
+ /*
+  * "slow" syscall return path.  "why" tells us if this was a real syscall.
+  */
+Index: linux-rt-2.6.31/arch/arm/kernel/irq.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/arm/kernel/irq.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/arm/kernel/irq.c	2010-05-17 14:23:19.898484267 +0200
+@@ -69,7 +69,7 @@
+ 	}
+ 
+ 	if (i < NR_IRQS) {
+-		spin_lock_irqsave(&irq_desc[i].lock, flags);
++		atomic_spin_lock_irqsave(&irq_desc[i].lock, flags);
+ 		action = irq_desc[i].action;
+ 		if (!action)
+ 			goto unlock;
+@@ -84,7 +84,7 @@
+ 
+ 		seq_putc(p, '\n');
+ unlock:
+-		spin_unlock_irqrestore(&irq_desc[i].lock, flags);
++		atomic_spin_unlock_irqrestore(&irq_desc[i].lock, flags);
+ 	} else if (i == NR_IRQS) {
+ #ifdef CONFIG_ARCH_ACORN
+ 		show_fiq_list(p, v);
+@@ -139,7 +139,7 @@
+ 	}
+ 
+ 	desc = irq_desc + irq;
+-	spin_lock_irqsave(&desc->lock, flags);
++	atomic_spin_lock_irqsave(&desc->lock, flags);
+ 	desc->status |= IRQ_NOREQUEST | IRQ_NOPROBE | IRQ_NOAUTOEN;
+ 	if (iflags & IRQF_VALID)
+ 		desc->status &= ~IRQ_NOREQUEST;
+@@ -147,7 +147,7 @@
+ 		desc->status &= ~IRQ_NOPROBE;
+ 	if (!(iflags & IRQF_NOAUTOEN))
+ 		desc->status &= ~IRQ_NOAUTOEN;
+-	spin_unlock_irqrestore(&desc->lock, flags);
++	atomic_spin_unlock_irqrestore(&desc->lock, flags);
+ }
+ 
+ void __init init_IRQ(void)
+@@ -166,9 +166,9 @@
+ {
+ 	pr_debug("IRQ%u: moving from cpu%u to cpu%u\n", irq, desc->node, cpu);
+ 
+-	spin_lock_irq(&desc->lock);
++	atomic_spin_lock_irq(&desc->lock);
+ 	desc->chip->set_affinity(irq, cpumask_of(cpu));
+-	spin_unlock_irq(&desc->lock);
++	atomic_spin_unlock_irq(&desc->lock);
+ }
+ 
+ /*
+Index: linux-rt-2.6.31/arch/arm/kernel/process.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/arm/kernel/process.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/arm/kernel/process.c	2010-05-17 14:23:19.898484267 +0200
+@@ -174,9 +174,11 @@
+ 		}
+ 		leds_event(led_idle_end);
+ 		tick_nohz_restart_sched_tick();
+-		preempt_enable_no_resched();
+-		schedule();
++		local_irq_disable();
++		__preempt_enable_no_resched();
++		__schedule();
+ 		preempt_disable();
++		local_irq_enable();
+ 	}
+ }
+ 
+Index: linux-rt-2.6.31/arch/arm/kernel/return_address.c
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ linux-rt-2.6.31/arch/arm/kernel/return_address.c	2010-05-17 14:23:19.898484267 +0200
+@@ -0,0 +1,71 @@
++/*
++ * arch/arm/kernel/return_address.c
++ *
++ * Copyright (C) 2009 Uwe Kleine-Koenig <u.kleine-koenig@pengutronix.de>
++ * for Pengutronix
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 2 as published by
++ * the Free Software Foundation.
++ */
++#include <linux/module.h>
++
++#if defined(CONFIG_FRAME_POINTER) && !defined(CONFIG_ARM_UNWIND)
++#include <linux/sched.h>
++
++#include <asm/stacktrace.h>
++
++struct return_address_data {
++	unsigned int level;
++	void *addr;
++};
++
++static int save_return_addr(struct stackframe *frame, void *d)
++{
++	struct return_address_data *data = d;
++
++	if (!data->level) {
++		data->addr = (void *)frame->lr;
++
++		return 1;
++	} else {
++		--data->level;
++		return 0;
++	}
++}
++
++void *return_address(unsigned int level)
++{
++	struct return_address_data data;
++	struct stackframe frame;
++	register unsigned long current_sp asm ("sp");
++
++	data.level = level + 1;
++
++	frame.fp = (unsigned long)__builtin_frame_address(0);
++	frame.sp = current_sp;
++	frame.lr = (unsigned long)__builtin_return_address(0);
++	frame.pc = (unsigned long)return_address;
++
++	walk_stackframe(&frame, save_return_addr, &data);
++
++	if (!data.level)
++		return data.addr;
++	else
++		return NULL;
++}
++
++#else /* if defined(CONFIG_FRAME_POINTER) && !defined(CONFIG_ARM_UNWIND) */
++
++#if defined(CONFIG_ARM_UNWIND)
++#warning "TODO: return_address should use unwind tables"
++#endif
++
++void *return_address(unsigned int level)
++{
++	return NULL;
++}
++
++#endif /* if defined(CONFIG_FRAME_POINTER) && !defined(CONFIG_ARM_UNWIND) / else */
++
++EXPORT_SYMBOL_GPL(return_address);
+Index: linux-rt-2.6.31/arch/arm/kernel/signal.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/arm/kernel/signal.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/arm/kernel/signal.c	2010-05-17 14:23:19.898484267 +0200
+@@ -627,6 +627,14 @@
+ 	siginfo_t info;
+ 	int signr;
+ 
++#ifdef CONFIG_PREEMPT_RT
++	/*
++	 * Fully-preemptible kernel does not need interrupts disabled:
++	 */
++	local_irq_enable();
++	preempt_check_resched();
++#endif
++
+ 	/*
+ 	 * We want the common case to go fast, which
+ 	 * is why we may in certain cases get here from
+Index: linux-rt-2.6.31/arch/arm/kernel/smp.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/arm/kernel/smp.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/arm/kernel/smp.c	2010-05-17 14:23:19.898484267 +0200
+@@ -451,17 +451,17 @@
+ 	local_timer_setup(evt);
+ }
+ 
+-static DEFINE_SPINLOCK(stop_lock);
++static DEFINE_ATOMIC_SPINLOCK(stop_lock);
+ 
+ /*
+  * ipi_cpu_stop - handle IPI from smp_send_stop()
+  */
+ static void ipi_cpu_stop(unsigned int cpu)
+ {
+-	spin_lock(&stop_lock);
++	atomic_spin_lock(&stop_lock);
+ 	printk(KERN_CRIT "CPU%u: stopping\n", cpu);
+ 	dump_stack();
+-	spin_unlock(&stop_lock);
++	atomic_spin_unlock(&stop_lock);
+ 
+ 	set_cpu_online(cpu, false);
+ 
+Index: linux-rt-2.6.31/arch/arm/kernel/stacktrace.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/arm/kernel/stacktrace.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/arm/kernel/stacktrace.c	2010-05-17 14:23:19.898484267 +0200
+@@ -21,7 +21,7 @@
+  * Note that with framepointer enabled, even the leaf functions have the same
+  * prologue and epilogue, therefore we can ignore the LR value in this case.
+  */
+-int unwind_frame(struct stackframe *frame)
++int notrace unwind_frame(struct stackframe *frame)
+ {
+ 	unsigned long high, low;
+ 	unsigned long fp = frame->fp;
+@@ -43,7 +43,7 @@
+ }
+ #endif
+ 
+-void walk_stackframe(struct stackframe *frame,
++void notrace walk_stackframe(struct stackframe *frame,
+ 		     int (*fn)(struct stackframe *, void *), void *data)
+ {
+ 	while (1) {
+Index: linux-rt-2.6.31/arch/arm/kernel/time.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/arm/kernel/time.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/arm/kernel/time.c	2010-05-17 14:23:19.898484267 +0200
+@@ -244,11 +244,11 @@
+ 	unsigned long usec, sec;
+ 
+ 	do {
+-		seq = read_seqbegin_irqsave(&xtime_lock, flags);
++		seq = read_atomic_seqbegin_irqsave(&xtime_lock, flags);
+ 		usec = system_timer->offset();
+ 		sec = xtime.tv_sec;
+ 		usec += xtime.tv_nsec / 1000;
+-	} while (read_seqretry_irqrestore(&xtime_lock, seq, flags));
++	} while (read_atomic_seqretry_irqrestore(&xtime_lock, seq, flags));
+ 
+ 	/* usec may have gone up a lot: be safe */
+ 	while (usec >= 1000000) {
+@@ -270,7 +270,7 @@
+ 	if ((unsigned long)tv->tv_nsec >= NSEC_PER_SEC)
+ 		return -EINVAL;
+ 
+-	write_seqlock_irq(&xtime_lock);
++	write_atomic_seqlock_irq(&xtime_lock);
+ 	/*
+ 	 * This is revolting. We need to set "xtime" correctly. However, the
+ 	 * value in this location is the value at the most recent update of
+@@ -286,7 +286,7 @@
+ 	set_normalized_timespec(&wall_to_monotonic, wtm_sec, wtm_nsec);
+ 
+ 	ntp_clear();
+-	write_sequnlock_irq(&xtime_lock);
++	write_atomic_sequnlock_irq(&xtime_lock);
+ 	clock_was_set();
+ 	return 0;
+ }
+@@ -336,9 +336,9 @@
+ 	profile_tick(CPU_PROFILING);
+ 	do_leds();
+ 	do_set_rtc();
+-	write_seqlock(&xtime_lock);
++	write_atomic_seqlock(&xtime_lock);
+ 	do_timer(1);
+-	write_sequnlock(&xtime_lock);
++	write_atomic_sequnlock(&xtime_lock);
+ #ifndef CONFIG_SMP
+ 	update_process_times(user_mode(get_irq_regs()));
+ #endif
+Index: linux-rt-2.6.31/arch/arm/kernel/traps.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/arm/kernel/traps.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/arm/kernel/traps.c	2010-05-17 14:23:19.898484267 +0200
+@@ -239,7 +239,7 @@
+ 	}
+ }
+ 
+-DEFINE_SPINLOCK(die_lock);
++DEFINE_ATOMIC_SPINLOCK(die_lock);
+ 
+ /*
+  * This function is protected against re-entrancy.
+@@ -251,12 +251,12 @@
+ 	oops_enter();
+ 
+ 	console_verbose();
+-	spin_lock_irq(&die_lock);
++	atomic_spin_lock_irq(&die_lock);
+ 	bust_spinlocks(1);
+ 	__die(str, err, thread, regs);
+ 	bust_spinlocks(0);
+ 	add_taint(TAINT_DIE);
+-	spin_unlock_irq(&die_lock);
++	atomic_spin_unlock_irq(&die_lock);
+ 
+ 	if (in_interrupt())
+ 		panic("Fatal exception in interrupt");
+@@ -282,24 +282,24 @@
+ }
+ 
+ static LIST_HEAD(undef_hook);
+-static DEFINE_SPINLOCK(undef_lock);
++static DEFINE_ATOMIC_SPINLOCK(undef_lock);
+ 
+ void register_undef_hook(struct undef_hook *hook)
+ {
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&undef_lock, flags);
++	atomic_spin_lock_irqsave(&undef_lock, flags);
+ 	list_add(&hook->node, &undef_hook);
+-	spin_unlock_irqrestore(&undef_lock, flags);
++	atomic_spin_unlock_irqrestore(&undef_lock, flags);
+ }
+ 
+ void unregister_undef_hook(struct undef_hook *hook)
+ {
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&undef_lock, flags);
++	atomic_spin_lock_irqsave(&undef_lock, flags);
+ 	list_del(&hook->node);
+-	spin_unlock_irqrestore(&undef_lock, flags);
++	atomic_spin_unlock_irqrestore(&undef_lock, flags);
+ }
+ 
+ static int call_undef_hook(struct pt_regs *regs, unsigned int instr)
+@@ -308,12 +308,12 @@
+ 	unsigned long flags;
+ 	int (*fn)(struct pt_regs *regs, unsigned int instr) = NULL;
+ 
+-	spin_lock_irqsave(&undef_lock, flags);
++	atomic_spin_lock_irqsave(&undef_lock, flags);
+ 	list_for_each_entry(hook, &undef_hook, node)
+ 		if ((instr & hook->instr_mask) == hook->instr_val &&
+ 		    (regs->ARM_cpsr & hook->cpsr_mask) == hook->cpsr_val)
+ 			fn = hook->fn;
+-	spin_unlock_irqrestore(&undef_lock, flags);
++	atomic_spin_unlock_irqrestore(&undef_lock, flags);
+ 
+ 	return fn ? fn(regs, instr) : 1;
+ }
+Index: linux-rt-2.6.31/arch/arm/mach-at91/gpio.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/arm/mach-at91/gpio.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/arm/mach-at91/gpio.c	2010-05-17 14:23:19.898484267 +0200
+@@ -375,12 +375,18 @@
+ 	}
+ }
+ 
++static void gpio_irq_ack_noop(unsigned int irq)
++{
++	/* Dummy function.  */
++}
++
+ static struct irq_chip gpio_irqchip = {
+ 	.name		= "GPIO",
+ 	.mask		= gpio_irq_mask,
+ 	.unmask		= gpio_irq_unmask,
+ 	.set_type	= gpio_irq_type,
+ 	.set_wake	= gpio_irq_set_wake,
++	.ack            = gpio_irq_ack_noop,
+ };
+ 
+ static void gpio_irq_handler(unsigned irq, struct irq_desc *desc)
+@@ -527,7 +533,7 @@
+ 			 * shorter, and the AIC handles interrupts sanely.
+ 			 */
+ 			set_irq_chip(pin, &gpio_irqchip);
+-			set_irq_handler(pin, handle_simple_irq);
++			set_irq_handler(pin, handle_edge_irq);
+ 			set_irq_flags(pin, IRQF_VALID);
+ 		}
+ 
+Index: linux-rt-2.6.31/arch/arm/mach-footbridge/include/mach/hardware.h
+===================================================================
+--- linux-rt-2.6.31.orig/arch/arm/mach-footbridge/include/mach/hardware.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/arm/mach-footbridge/include/mach/hardware.h	2010-05-17 14:23:19.898484267 +0200
+@@ -86,7 +86,7 @@
+ #define CPLD_FLASH_WR_ENABLE	1
+ 
+ #ifndef __ASSEMBLY__
+-extern spinlock_t nw_gpio_lock;
++extern atomic_spinlock_t nw_gpio_lock;
+ extern void nw_gpio_modify_op(unsigned int mask, unsigned int set);
+ extern void nw_gpio_modify_io(unsigned int mask, unsigned int in);
+ extern unsigned int nw_gpio_read(void);
+Index: linux-rt-2.6.31/arch/arm/mach-footbridge/netwinder-hw.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/arm/mach-footbridge/netwinder-hw.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/arm/mach-footbridge/netwinder-hw.c	2010-05-17 14:23:19.898484267 +0200
+@@ -68,7 +68,7 @@
+ /*
+  * This is a lock for accessing ports GP1_IO_BASE and GP2_IO_BASE
+  */
+-DEFINE_SPINLOCK(nw_gpio_lock);
++DEFINE_ATOMIC_SPINLOCK(nw_gpio_lock);
+ EXPORT_SYMBOL(nw_gpio_lock);
+ 
+ static unsigned int current_gpio_op;
+@@ -327,9 +327,9 @@
+ 	/*
+ 	 * Set Group1/Group2 outputs
+ 	 */
+-	spin_lock_irqsave(&nw_gpio_lock, flags);
++	atomic_spin_lock_irqsave(&nw_gpio_lock, flags);
+ 	nw_gpio_modify_op(-1, GPIO_RED_LED | GPIO_FAN);
+-	spin_unlock_irqrestore(&nw_gpio_lock, flags);
++	atomic_spin_unlock_irqrestore(&nw_gpio_lock, flags);
+ }
+ 
+ /*
+@@ -390,9 +390,9 @@
+ {
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&nw_gpio_lock, flags);
++	atomic_spin_lock_irqsave(&nw_gpio_lock, flags);
+ 	nw_cpld_modify(-1, CPLD_UNMUTE | CPLD_7111_DISABLE);
+-	spin_unlock_irqrestore(&nw_gpio_lock, flags);
++	atomic_spin_unlock_irqrestore(&nw_gpio_lock, flags);
+ }
+ 
+ static unsigned char rwa_unlock[] __initdata =
+@@ -616,9 +616,9 @@
+ 		cpld_init();
+ 		rwa010_init();
+ 
+-		spin_lock_irqsave(&nw_gpio_lock, flags);
++		atomic_spin_lock_irqsave(&nw_gpio_lock, flags);
+ 		nw_gpio_modify_op(GPIO_RED_LED|GPIO_GREEN_LED, DEFAULT_LEDS);
+-		spin_unlock_irqrestore(&nw_gpio_lock, flags);
++		atomic_spin_unlock_irqrestore(&nw_gpio_lock, flags);
+ 	}
+ 	return 0;
+ }
+Index: linux-rt-2.6.31/arch/arm/mach-footbridge/netwinder-leds.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/arm/mach-footbridge/netwinder-leds.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/arm/mach-footbridge/netwinder-leds.c	2010-05-17 14:23:19.898484267 +0200
+@@ -31,13 +31,13 @@
+ static char led_state;
+ static char hw_led_state;
+ 
+-static DEFINE_SPINLOCK(leds_lock);
++static DEFINE_ATOMIC_SPINLOCK(leds_lock);
+ 
+ static void netwinder_leds_event(led_event_t evt)
+ {
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&leds_lock, flags);
++	atomic_spin_lock_irqsave(&leds_lock, flags);
+ 
+ 	switch (evt) {
+ 	case led_start:
+@@ -117,12 +117,12 @@
+ 		break;
+ 	}
+ 
+-	spin_unlock_irqrestore(&leds_lock, flags);
++	atomic_spin_unlock_irqrestore(&leds_lock, flags);
+ 
+ 	if  (led_state & LED_STATE_ENABLED) {
+-		spin_lock_irqsave(&nw_gpio_lock, flags);
++		atomic_spin_lock_irqsave(&nw_gpio_lock, flags);
+ 		nw_gpio_modify_op(GPIO_RED_LED | GPIO_GREEN_LED, hw_led_state);
+-		spin_unlock_irqrestore(&nw_gpio_lock, flags);
++		atomic_spin_unlock_irqrestore(&nw_gpio_lock, flags);
+ 	}
+ }
+ 
+Index: linux-rt-2.6.31/arch/arm/mach-integrator/core.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/arm/mach-integrator/core.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/arm/mach-integrator/core.c	2010-05-17 14:23:19.898484267 +0200
+@@ -199,7 +199,7 @@
+ 
+ #define CM_CTRL	IO_ADDRESS(INTEGRATOR_HDR_BASE) + INTEGRATOR_HDR_CTRL_OFFSET
+ 
+-static DEFINE_SPINLOCK(cm_lock);
++static DEFINE_ATOMIC_SPINLOCK(cm_lock);
+ 
+ /**
+  * cm_control - update the CM_CTRL register.
+@@ -211,10 +211,10 @@
+ 	unsigned long flags;
+ 	u32 val;
+ 
+-	spin_lock_irqsave(&cm_lock, flags);
++	atomic_spin_lock_irqsave(&cm_lock, flags);
+ 	val = readl(CM_CTRL) & ~mask;
+ 	writel(val | set, CM_CTRL);
+-	spin_unlock_irqrestore(&cm_lock, flags);
++	atomic_spin_unlock_irqrestore(&cm_lock, flags);
+ }
+ 
+ EXPORT_SYMBOL(cm_control);
+Index: linux-rt-2.6.31/arch/arm/mach-integrator/pci_v3.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/arm/mach-integrator/pci_v3.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/arm/mach-integrator/pci_v3.c	2010-05-17 14:23:19.898484267 +0200
+@@ -162,7 +162,7 @@
+  *	 7:2	register number
+  *  
+  */
+-static DEFINE_SPINLOCK(v3_lock);
++static DEFINE_ATOMIC_SPINLOCK(v3_lock);
+ 
+ #define PCI_BUS_NONMEM_START	0x00000000
+ #define PCI_BUS_NONMEM_SIZE	SZ_256M
+@@ -283,7 +283,7 @@
+ 	unsigned long flags;
+ 	u32 v;
+ 
+-	spin_lock_irqsave(&v3_lock, flags);
++	atomic_spin_lock_irqsave(&v3_lock, flags);
+ 	addr = v3_open_config_window(bus, devfn, where);
+ 
+ 	switch (size) {
+@@ -301,7 +301,7 @@
+ 	}
+ 
+ 	v3_close_config_window();
+-	spin_unlock_irqrestore(&v3_lock, flags);
++	atomic_spin_unlock_irqrestore(&v3_lock, flags);
+ 
+ 	*val = v;
+ 	return PCIBIOS_SUCCESSFUL;
+@@ -313,7 +313,7 @@
+ 	unsigned long addr;
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&v3_lock, flags);
++	atomic_spin_lock_irqsave(&v3_lock, flags);
+ 	addr = v3_open_config_window(bus, devfn, where);
+ 
+ 	switch (size) {
+@@ -334,7 +334,7 @@
+ 	}
+ 
+ 	v3_close_config_window();
+-	spin_unlock_irqrestore(&v3_lock, flags);
++	atomic_spin_unlock_irqrestore(&v3_lock, flags);
+ 
+ 	return PCIBIOS_SUCCESSFUL;
+ }
+@@ -509,7 +509,7 @@
+ 	hook_fault_code(8, v3_pci_fault, SIGBUS, "external abort on non-linefetch");
+ 	hook_fault_code(10, v3_pci_fault, SIGBUS, "external abort on non-linefetch");
+ 
+-	spin_lock_irqsave(&v3_lock, flags);
++	atomic_spin_lock_irqsave(&v3_lock, flags);
+ 
+ 	/*
+ 	 * Unlock V3 registers, but only if they were previously locked.
+@@ -582,7 +582,7 @@
+ 		printk(KERN_ERR "PCI: unable to grab PCI error "
+ 		       "interrupt: %d\n", ret);
+ 
+-	spin_unlock_irqrestore(&v3_lock, flags);
++	atomic_spin_unlock_irqrestore(&v3_lock, flags);
+ }
+ 
+ void __init pci_v3_postinit(void)
+Index: linux-rt-2.6.31/arch/arm/mach-ixp2000/core.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/arm/mach-ixp2000/core.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/arm/mach-ixp2000/core.c	2010-05-17 14:23:19.898484267 +0200
+@@ -197,7 +197,7 @@
+ 	return offset / ticks_per_usec;
+ }
+ 
+-static int ixp2000_timer_interrupt(int irq, void *dev_id)
++static irqreturn_t ixp2000_timer_interrupt(int irq, void *dev_id)
+ {
+ 	/* clear timer 1 */
+ 	ixp2000_reg_wrb(IXP2000_T1_CLR, 1);
+Index: linux-rt-2.6.31/arch/arm/mach-ixp4xx/common-pci.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/arm/mach-ixp4xx/common-pci.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/arm/mach-ixp4xx/common-pci.c	2010-05-17 14:23:19.898484267 +0200
+@@ -54,7 +54,7 @@
+  * these transactions are atomic or we will end up
+  * with corrupt data on the bus or in a driver.
+  */
+-static DEFINE_SPINLOCK(ixp4xx_pci_lock);
++static DEFINE_ATOMIC_SPINLOCK(ixp4xx_pci_lock);
+ 
+ /*
+  * Read from PCI config space
+@@ -62,10 +62,10 @@
+ static void crp_read(u32 ad_cbe, u32 *data)
+ {
+ 	unsigned long flags;
+-	spin_lock_irqsave(&ixp4xx_pci_lock, flags);
++	atomic_spin_lock_irqsave(&ixp4xx_pci_lock, flags);
+ 	*PCI_CRP_AD_CBE = ad_cbe;
+ 	*data = *PCI_CRP_RDATA;
+-	spin_unlock_irqrestore(&ixp4xx_pci_lock, flags);
++	atomic_spin_unlock_irqrestore(&ixp4xx_pci_lock, flags);
+ }
+ 
+ /*
+@@ -74,10 +74,10 @@
+ static void crp_write(u32 ad_cbe, u32 data)
+ { 
+ 	unsigned long flags;
+-	spin_lock_irqsave(&ixp4xx_pci_lock, flags);
++	atomic_spin_lock_irqsave(&ixp4xx_pci_lock, flags);
+ 	*PCI_CRP_AD_CBE = CRP_AD_CBE_WRITE | ad_cbe;
+ 	*PCI_CRP_WDATA = data;
+-	spin_unlock_irqrestore(&ixp4xx_pci_lock, flags);
++	atomic_spin_unlock_irqrestore(&ixp4xx_pci_lock, flags);
+ }
+ 
+ static inline int check_master_abort(void)
+@@ -101,7 +101,7 @@
+ 	int retval = 0;
+ 	int i;
+ 
+-	spin_lock_irqsave(&ixp4xx_pci_lock, flags);
++	atomic_spin_lock_irqsave(&ixp4xx_pci_lock, flags);
+ 
+ 	*PCI_NP_AD = addr;
+ 
+@@ -118,7 +118,7 @@
+ 	if(check_master_abort())
+ 		retval = 1;
+ 
+-	spin_unlock_irqrestore(&ixp4xx_pci_lock, flags);
++	atomic_spin_unlock_irqrestore(&ixp4xx_pci_lock, flags);
+ 	return retval;
+ }
+ 
+@@ -127,7 +127,7 @@
+ 	unsigned long flags;
+ 	int retval = 0;
+ 
+-	spin_lock_irqsave(&ixp4xx_pci_lock, flags);
++	atomic_spin_lock_irqsave(&ixp4xx_pci_lock, flags);
+ 
+ 	*PCI_NP_AD = addr;
+ 
+@@ -140,7 +140,7 @@
+ 	if(check_master_abort())
+ 		retval = 1;
+ 
+-	spin_unlock_irqrestore(&ixp4xx_pci_lock, flags);
++	atomic_spin_unlock_irqrestore(&ixp4xx_pci_lock, flags);
+ 	return retval;
+ }
+ 
+@@ -149,7 +149,7 @@
+ 	unsigned long flags;
+ 	int retval = 0;
+ 
+-	spin_lock_irqsave(&ixp4xx_pci_lock, flags);
++	atomic_spin_lock_irqsave(&ixp4xx_pci_lock, flags);
+ 
+ 	*PCI_NP_AD = addr;
+ 
+@@ -162,7 +162,7 @@
+ 	if(check_master_abort())
+ 		retval = 1;
+ 
+-	spin_unlock_irqrestore(&ixp4xx_pci_lock, flags);
++	atomic_spin_unlock_irqrestore(&ixp4xx_pci_lock, flags);
+ 	return retval;
+ }
+ 
+Index: linux-rt-2.6.31/arch/arm/mach-msm/proc_comm.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/arm/mach-msm/proc_comm.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/arm/mach-msm/proc_comm.c	2010-05-17 14:23:19.898484267 +0200
+@@ -14,6 +14,7 @@
+  *
+  */
+ 
++#include <linux/cache.h>
+ #include <linux/delay.h>
+ #include <linux/errno.h>
+ #include <linux/io.h>
+Index: linux-rt-2.6.31/arch/arm/mach-ns9xxx/irq.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/arm/mach-ns9xxx/irq.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/arm/mach-ns9xxx/irq.c	2010-05-17 14:23:19.898484267 +0200
+@@ -66,7 +66,7 @@
+ 	struct irqaction *action;
+ 	irqreturn_t action_ret;
+ 
+-	spin_lock(&desc->lock);
++	atomic_spin_lock(&desc->lock);
+ 
+ 	BUG_ON(desc->status & IRQ_INPROGRESS);
+ 
+@@ -78,7 +78,7 @@
+ 		goto out_mask;
+ 
+ 	desc->status |= IRQ_INPROGRESS;
+-	spin_unlock(&desc->lock);
++	atomic_spin_unlock(&desc->lock);
+ 
+ 	action_ret = handle_IRQ_event(irq, action);
+ 
+@@ -87,7 +87,7 @@
+ 	 * Maybe this function should go to kernel/irq/chip.c? */
+ 	note_interrupt(irq, desc, action_ret);
+ 
+-	spin_lock(&desc->lock);
++	atomic_spin_lock(&desc->lock);
+ 	desc->status &= ~IRQ_INPROGRESS;
+ 
+ 	if (desc->status & IRQ_DISABLED)
+@@ -97,7 +97,7 @@
+ 	/* ack unconditionally to unmask lower prio irqs */
+ 	desc->chip->ack(irq);
+ 
+-	spin_unlock(&desc->lock);
++	atomic_spin_unlock(&desc->lock);
+ }
+ #define handle_irq handle_prio_irq
+ #endif
+Index: linux-rt-2.6.31/arch/arm/mach-s3c2440/Kconfig
+===================================================================
+--- linux-rt-2.6.31.orig/arch/arm/mach-s3c2440/Kconfig	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/arm/mach-s3c2440/Kconfig	2010-05-17 14:23:19.898484267 +0200
+@@ -90,6 +90,7 @@
+ 	select EEPROM_AT24
+ 	select LEDS_TRIGGER_BACKLIGHT
+ 	select SND_S3C24XX_SOC_S3C24XX_UDA134X
++	select S3C_DEV_USB_HOST
+ 	help
+ 	  Say Y here to select support for the MINI2440. Is a 10cm x 10cm board
+ 	  available via various sources. It can come with a 3.5" or 7" touch LCD.
+Index: linux-rt-2.6.31/arch/arm/mach-sa1100/badge4.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/arm/mach-sa1100/badge4.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/arm/mach-sa1100/badge4.c	2010-05-17 14:23:19.908411087 +0200
+@@ -240,15 +240,22 @@
+ 	/* detect on->off and off->on transitions */
+ 	if ((!old_5V_bitmap) && (badge4_5V_bitmap)) {
+ 		/* was off, now on */
+-		printk(KERN_INFO "%s: enabling 5V supply rail\n", __func__);
+ 		GPSR = BADGE4_GPIO_PCMEN5V;
+ 	} else if ((old_5V_bitmap) && (!badge4_5V_bitmap)) {
+ 		/* was on, now off */
+-		printk(KERN_INFO "%s: disabling 5V supply rail\n", __func__);
+ 		GPCR = BADGE4_GPIO_PCMEN5V;
+ 	}
+ 
+ 	local_irq_restore(flags);
++
++	/* detect on->off and off->on transitions */
++	if ((!old_5V_bitmap) && (badge4_5V_bitmap)) {
++		/* was off, now on */
++		printk(KERN_INFO "%s: enabling 5V supply rail\n", __FUNCTION__);
++	} else if ((old_5V_bitmap) && (!badge4_5V_bitmap)) {
++		/* was on, now off */
++		printk(KERN_INFO "%s: disabling 5V supply rail\n", __FUNCTION__);
++	}
+ }
+ EXPORT_SYMBOL(badge4_set_5V);
+ 
+Index: linux-rt-2.6.31/arch/arm/mach-shark/leds.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/arm/mach-shark/leds.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/arm/mach-shark/leds.c	2010-05-17 14:23:19.908411087 +0200
+@@ -36,7 +36,7 @@
+ static short hw_led_state;
+ static short saved_state;
+ 
+-static DEFINE_SPINLOCK(leds_lock);
++static DEFINE_ATOMIC_SPINLOCK(leds_lock);
+ 
+ short sequoia_read(int addr) {
+   outw(addr,0x24);
+@@ -52,7 +52,7 @@
+ {
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&leds_lock, flags);
++	atomic_spin_lock_irqsave(&leds_lock, flags);
+ 
+ 	hw_led_state = sequoia_read(0x09);
+ 
+@@ -144,7 +144,7 @@
+ 	if  (led_state & LED_STATE_ENABLED)
+ 		sequoia_write(hw_led_state,0x09);
+ 
+-	spin_unlock_irqrestore(&leds_lock, flags);
++	atomic_spin_unlock_irqrestore(&leds_lock, flags);
+ }
+ 
+ static int __init leds_init(void)
+Index: linux-rt-2.6.31/arch/arm/mach-w90x900/mfp-w90p910.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/arm/mach-w90x900/mfp-w90p910.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/arm/mach-w90x900/mfp-w90p910.c	2010-05-17 14:23:19.908411087 +0200
+@@ -34,7 +34,7 @@
+ #define GPSELEI0	(0x01 << 26)
+ #define GPSELEI1	(0x01 << 27)
+ 
+-static DECLARE_MUTEX(mfp_sem);
++static DEFINE_MUTEX(mfp_sem);
+ 
+ void mfp_set_groupf(struct device *dev)
+ {
+@@ -43,7 +43,7 @@
+ 
+ 	BUG_ON(!dev);
+ 
+-	down(&mfp_sem);
++	mutex_lock(&mfp_sem);
+ 
+ 	dev_id = dev_name(dev);
+ 
+@@ -56,7 +56,7 @@
+ 
+ 	__raw_writel(mfpen, REG_MFSEL);
+ 
+-	up(&mfp_sem);
++	mutex_unlock(&mfp_sem);
+ }
+ EXPORT_SYMBOL(mfp_set_groupf);
+ 
+@@ -67,7 +67,7 @@
+ 
+ 	BUG_ON(!dev);
+ 
+-	down(&mfp_sem);
++	mutex_lock(&mfp_sem);
+ 
+ 	dev_id = dev_name(dev);
+ 
+@@ -86,7 +86,7 @@
+ 
+ 	__raw_writel(mfpen, REG_MFSEL);
+ 
+-	up(&mfp_sem);
++	mutex_unlock(&mfp_sem);
+ }
+ EXPORT_SYMBOL(mfp_set_groupc);
+ 
+@@ -97,7 +97,7 @@
+ 
+ 	BUG_ON(!dev);
+ 
+-	down(&mfp_sem);
++	mutex_lock(&mfp_sem);
+ 
+ 	dev_id = dev_name(dev);
+ 
+@@ -110,7 +110,7 @@
+ 
+ 	__raw_writel(mfpen, REG_MFSEL);
+ 
+-	up(&mfp_sem);
++	mutex_unlock(&mfp_sem);
+ }
+ EXPORT_SYMBOL(mfp_set_groupi);
+ 
+Index: linux-rt-2.6.31/arch/arm/mm/cache-l2x0.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/arm/mm/cache-l2x0.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/arm/mm/cache-l2x0.c	2010-05-17 14:23:19.908411087 +0200
+@@ -26,19 +26,19 @@
+ #define CACHE_LINE_SIZE		32
+ 
+ static void __iomem *l2x0_base;
+-static DEFINE_SPINLOCK(l2x0_lock);
++static DEFINE_ATOMIC_SPINLOCK(l2x0_lock);
+ 
+ static inline void sync_writel(unsigned long val, unsigned long reg,
+ 			       unsigned long complete_mask)
+ {
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&l2x0_lock, flags);
++	atomic_spin_lock_irqsave(&l2x0_lock, flags);
+ 	writel(val, l2x0_base + reg);
+ 	/* wait for the operation to complete */
+ 	while (readl(l2x0_base + reg) & complete_mask)
+ 		;
+-	spin_unlock_irqrestore(&l2x0_lock, flags);
++	atomic_spin_unlock_irqrestore(&l2x0_lock, flags);
+ }
+ 
+ static inline void cache_sync(void)
+Index: linux-rt-2.6.31/arch/arm/mm/context.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/arm/mm/context.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/arm/mm/context.c	2010-05-17 14:23:19.908411087 +0200
+@@ -14,7 +14,7 @@
+ #include <asm/mmu_context.h>
+ #include <asm/tlbflush.h>
+ 
+-static DEFINE_SPINLOCK(cpu_asid_lock);
++static DEFINE_ATOMIC_SPINLOCK(cpu_asid_lock);
+ unsigned int cpu_last_asid = ASID_FIRST_VERSION;
+ 
+ /*
+@@ -32,7 +32,7 @@
+ {
+ 	unsigned int asid;
+ 
+-	spin_lock(&cpu_asid_lock);
++	atomic_spin_lock(&cpu_asid_lock);
+ 	asid = ++cpu_last_asid;
+ 	if (asid == 0)
+ 		asid = cpu_last_asid = ASID_FIRST_VERSION;
+@@ -57,7 +57,7 @@
+ 			dsb();
+ 		}
+ 	}
+-	spin_unlock(&cpu_asid_lock);
++	atomic_spin_unlock(&cpu_asid_lock);
+ 
+ 	mm->cpu_vm_mask = cpumask_of_cpu(smp_processor_id());
+ 	mm->context.id = asid;
+Index: linux-rt-2.6.31/arch/arm/mm/copypage-v4mc.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/arm/mm/copypage-v4mc.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/arm/mm/copypage-v4mc.c	2010-05-17 14:23:19.908411087 +0200
+@@ -30,7 +30,7 @@
+ #define minicache_pgprot __pgprot(L_PTE_PRESENT | L_PTE_YOUNG | \
+ 				  L_PTE_MT_MINICACHE)
+ 
+-static DEFINE_SPINLOCK(minicache_lock);
++static DEFINE_ATOMIC_SPINLOCK(minicache_lock);
+ 
+ /*
+  * ARMv4 mini-dcache optimised copy_user_highpage
+@@ -76,14 +76,14 @@
+ 	if (test_and_clear_bit(PG_dcache_dirty, &from->flags))
+ 		__flush_dcache_page(page_mapping(from), from);
+ 
+-	spin_lock(&minicache_lock);
++	atomic_spin_lock(&minicache_lock);
+ 
+ 	set_pte_ext(TOP_PTE(0xffff8000), pfn_pte(page_to_pfn(from), minicache_pgprot), 0);
+ 	flush_tlb_kernel_page(0xffff8000);
+ 
+ 	mc_copy_user_page((void *)0xffff8000, kto);
+ 
+-	spin_unlock(&minicache_lock);
++	atomic_spin_unlock(&minicache_lock);
+ 
+ 	kunmap_atomic(kto, KM_USER1);
+ }
+Index: linux-rt-2.6.31/arch/arm/mm/copypage-v6.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/arm/mm/copypage-v6.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/arm/mm/copypage-v6.c	2010-05-17 14:23:19.908411087 +0200
+@@ -27,7 +27,7 @@
+ #define from_address	(0xffff8000)
+ #define to_address	(0xffffc000)
+ 
+-static DEFINE_SPINLOCK(v6_lock);
++static DEFINE_ATOMIC_SPINLOCK(v6_lock);
+ 
+ /*
+  * Copy the user page.  No aliasing to deal with so we can just
+@@ -88,7 +88,7 @@
+ 	 * Now copy the page using the same cache colour as the
+ 	 * pages ultimate destination.
+ 	 */
+-	spin_lock(&v6_lock);
++	atomic_spin_lock(&v6_lock);
+ 
+ 	set_pte_ext(TOP_PTE(from_address) + offset, pfn_pte(page_to_pfn(from), PAGE_KERNEL), 0);
+ 	set_pte_ext(TOP_PTE(to_address) + offset, pfn_pte(page_to_pfn(to), PAGE_KERNEL), 0);
+@@ -101,7 +101,7 @@
+ 
+ 	copy_page((void *)kto, (void *)kfrom);
+ 
+-	spin_unlock(&v6_lock);
++	atomic_spin_unlock(&v6_lock);
+ }
+ 
+ /*
+@@ -121,13 +121,13 @@
+ 	 * Now clear the page using the same cache colour as
+ 	 * the pages ultimate destination.
+ 	 */
+-	spin_lock(&v6_lock);
++	atomic_spin_lock(&v6_lock);
+ 
+ 	set_pte_ext(TOP_PTE(to_address) + offset, pfn_pte(page_to_pfn(page), PAGE_KERNEL), 0);
+ 	flush_tlb_kernel_page(to);
+ 	clear_page((void *)to);
+ 
+-	spin_unlock(&v6_lock);
++	atomic_spin_unlock(&v6_lock);
+ }
+ 
+ struct cpu_user_fns v6_user_fns __initdata = {
+Index: linux-rt-2.6.31/arch/arm/mm/copypage-xscale.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/arm/mm/copypage-xscale.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/arm/mm/copypage-xscale.c	2010-05-17 14:23:19.908411087 +0200
+@@ -32,7 +32,7 @@
+ #define minicache_pgprot __pgprot(L_PTE_PRESENT | L_PTE_YOUNG | \
+ 				  L_PTE_MT_MINICACHE)
+ 
+-static DEFINE_SPINLOCK(minicache_lock);
++static DEFINE_ATOMIC_SPINLOCK(minicache_lock);
+ 
+ /*
+  * XScale mini-dcache optimised copy_user_highpage
+@@ -98,14 +98,14 @@
+ 	if (test_and_clear_bit(PG_dcache_dirty, &from->flags))
+ 		__flush_dcache_page(page_mapping(from), from);
+ 
+-	spin_lock(&minicache_lock);
++	atomic_spin_lock(&minicache_lock);
+ 
+ 	set_pte_ext(TOP_PTE(COPYPAGE_MINICACHE), pfn_pte(page_to_pfn(from), minicache_pgprot), 0);
+ 	flush_tlb_kernel_page(COPYPAGE_MINICACHE);
+ 
+ 	mc_copy_user_page((void *)COPYPAGE_MINICACHE, kto);
+ 
+-	spin_unlock(&minicache_lock);
++	atomic_spin_unlock(&minicache_lock);
+ 
+ 	kunmap_atomic(kto, KM_USER1);
+ }
+Index: linux-rt-2.6.31/arch/arm/mm/dma-mapping.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/arm/mm/dma-mapping.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/arm/mm/dma-mapping.c	2010-05-17 14:23:19.908411087 +0200
+@@ -41,7 +41,7 @@
+  * These are the page tables (2MB each) covering uncached, DMA consistent allocations
+  */
+ static pte_t *consistent_pte[NUM_CONSISTENT_PTES];
+-static DEFINE_SPINLOCK(consistent_lock);
++static DEFINE_ATOMIC_SPINLOCK(consistent_lock);
+ 
+ /*
+  * VM region handling support.
+@@ -97,7 +97,7 @@
+ 	if (!new)
+ 		goto out;
+ 
+-	spin_lock_irqsave(&consistent_lock, flags);
++	atomic_spin_lock_irqsave(&consistent_lock, flags);
+ 
+ 	list_for_each_entry(c, &head->vm_list, vm_list) {
+ 		if ((addr + size) < addr)
+@@ -118,11 +118,11 @@
+ 	new->vm_end = addr + size;
+ 	new->vm_active = 1;
+ 
+-	spin_unlock_irqrestore(&consistent_lock, flags);
++	atomic_spin_unlock_irqrestore(&consistent_lock, flags);
+ 	return new;
+ 
+  nospc:
+-	spin_unlock_irqrestore(&consistent_lock, flags);
++	atomic_spin_unlock_irqrestore(&consistent_lock, flags);
+ 	kfree(new);
+  out:
+ 	return NULL;
+@@ -317,9 +317,9 @@
+ 
+ 	user_size = (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
+ 
+-	spin_lock_irqsave(&consistent_lock, flags);
++	atomic_spin_lock_irqsave(&consistent_lock, flags);
+ 	c = arm_vm_region_find(&consistent_head, (unsigned long)cpu_addr);
+-	spin_unlock_irqrestore(&consistent_lock, flags);
++	atomic_spin_unlock_irqrestore(&consistent_lock, flags);
+ 
+ 	if (c) {
+ 		unsigned long off = vma->vm_pgoff;
+@@ -378,13 +378,13 @@
+ 
+ 	size = PAGE_ALIGN(size);
+ 
+-	spin_lock_irqsave(&consistent_lock, flags);
++	atomic_spin_lock_irqsave(&consistent_lock, flags);
+ 	c = arm_vm_region_find(&consistent_head, (unsigned long)cpu_addr);
+ 	if (!c)
+ 		goto no_area;
+ 
+ 	c->vm_active = 0;
+-	spin_unlock_irqrestore(&consistent_lock, flags);
++	atomic_spin_unlock_irqrestore(&consistent_lock, flags);
+ 
+ 	if ((c->vm_end - c->vm_start) != size) {
+ 		printk(KERN_ERR "%s: freeing wrong coherent size (%ld != %d)\n",
+@@ -431,15 +431,15 @@
+ 
+ 	flush_tlb_kernel_range(c->vm_start, c->vm_end);
+ 
+-	spin_lock_irqsave(&consistent_lock, flags);
++	atomic_spin_lock_irqsave(&consistent_lock, flags);
+ 	list_del(&c->vm_list);
+-	spin_unlock_irqrestore(&consistent_lock, flags);
++	atomic_spin_unlock_irqrestore(&consistent_lock, flags);
+ 
+ 	kfree(c);
+ 	return;
+ 
+  no_area:
+-	spin_unlock_irqrestore(&consistent_lock, flags);
++	atomic_spin_unlock_irqrestore(&consistent_lock, flags);
+ 	printk(KERN_ERR "%s: trying to free invalid coherent area: %p\n",
+ 	       __func__, cpu_addr);
+ 	dump_stack();
+Index: linux-rt-2.6.31/arch/arm/mm/fault.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/arm/mm/fault.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/arm/mm/fault.c	2010-05-17 14:23:19.908411087 +0200
+@@ -258,7 +258,7 @@
+ 	 * If we're in an interrupt or have no user
+ 	 * context, we must not take the fault..
+ 	 */
+-	if (in_atomic() || !mm)
++	if (in_atomic() || !mm || current->pagefault_disabled)
+ 		goto no_context;
+ 
+ 	/*
+Index: linux-rt-2.6.31/arch/arm/mm/mmu.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/arm/mm/mmu.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/arm/mm/mmu.c	2010-05-17 14:23:19.908411087 +0200
+@@ -29,8 +29,6 @@
+ 
+ #include "mm.h"
+ 
+-DEFINE_PER_CPU(struct mmu_gather, mmu_gathers);
+-
+ /*
+  * empty_zero_page is a special page that is used for
+  * zero-initialized data and COW.
+Index: linux-rt-2.6.31/arch/arm/oprofile/common.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/arm/oprofile/common.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/arm/oprofile/common.c	2010-05-17 14:23:19.908411087 +0200
+@@ -48,9 +48,9 @@
+ {
+ 	int ret;
+ 
+-	spin_lock(&oprofilefs_lock);
++	atomic_spin_lock(&oprofilefs_lock);
+ 	ret = op_arm_model->setup_ctrs();
+-	spin_unlock(&oprofilefs_lock);
++	atomic_spin_unlock(&oprofilefs_lock);
+ 	return ret;
+ }
+ 
+Index: linux-rt-2.6.31/arch/arm/oprofile/op_model_mpcore.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/arm/oprofile/op_model_mpcore.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/arm/oprofile/op_model_mpcore.c	2010-05-17 14:23:19.908411087 +0200
+@@ -263,10 +263,10 @@
+ 	struct irq_desc *desc = irq_desc + irq;
+ 	const struct cpumask *mask = cpumask_of(cpu);
+ 
+-	spin_lock_irq(&desc->lock);
++	atomic_spin_lock_irq(&desc->lock);
+ 	cpumask_copy(desc->affinity, mask);
+ 	desc->chip->set_affinity(irq, mask);
+-	spin_unlock_irq(&desc->lock);
++	atomic_spin_unlock_irq(&desc->lock);
+ }
+ 
+ static int em_setup(void)
+Index: linux-rt-2.6.31/arch/arm/oprofile/op_model_xscale.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/arm/oprofile/op_model_xscale.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/arm/oprofile/op_model_xscale.c	2010-05-17 14:23:19.908411087 +0200
+@@ -381,8 +381,9 @@
+ {
+ 	int ret;
+ 	u32 pmnc = read_pmnc();
++	unsigned long irq_flags = IRQF_DISABLED | IRQF_NODELAY;
+ 
+-	ret = request_irq(XSCALE_PMU_IRQ, xscale_pmu_interrupt, IRQF_DISABLED,
++	ret = request_irq(XSCALE_PMU_IRQ, xscale_pmu_interrupt, irq_flags,
+ 			"XScale PMU", (void *)results);
+ 
+ 	if (ret < 0) {
+Index: linux-rt-2.6.31/arch/arm/plat-omap/clock.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/arm/plat-omap/clock.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/arm/plat-omap/clock.c	2010-05-17 14:23:19.908411087 +0200
+@@ -108,15 +108,12 @@
+ 
+ unsigned long clk_get_rate(struct clk *clk)
+ {
+-	unsigned long flags;
+ 	unsigned long ret = 0;
+ 
+ 	if (clk == NULL || IS_ERR(clk))
+ 		return 0;
+ 
+-	spin_lock_irqsave(&clockfw_lock, flags);
+ 	ret = clk->rate;
+-	spin_unlock_irqrestore(&clockfw_lock, flags);
+ 
+ 	return ret;
+ }
+Index: linux-rt-2.6.31/arch/avr32/kernel/irq.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/avr32/kernel/irq.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/avr32/kernel/irq.c	2010-05-17 14:23:19.908411087 +0200
+@@ -51,7 +51,7 @@
+ 	}
+ 
+ 	if (i < NR_IRQS) {
+-		spin_lock_irqsave(&irq_desc[i].lock, flags);
++		atomic_spin_lock_irqsave(&irq_desc[i].lock, flags);
+ 		action = irq_desc[i].action;
+ 		if (!action)
+ 			goto unlock;
+@@ -66,7 +66,7 @@
+ 
+ 		seq_putc(p, '\n');
+ 	unlock:
+-		spin_unlock_irqrestore(&irq_desc[i].lock, flags);
++		atomic_spin_unlock_irqrestore(&irq_desc[i].lock, flags);
+ 	}
+ 
+ 	return 0;
+Index: linux-rt-2.6.31/arch/blackfin/kernel/irqchip.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/blackfin/kernel/irqchip.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/blackfin/kernel/irqchip.c	2010-05-17 14:23:19.908411087 +0200
+@@ -46,7 +46,7 @@
+ 
+ static struct irq_desc bad_irq_desc = {
+ 	.handle_irq = handle_bad_irq,
+-	.lock = __SPIN_LOCK_UNLOCKED(irq_desc->lock),
++	.lock = __ATOMIC_SPIN_LOCK_UNLOCKED(irq_desc->lock),
+ };
+ 
+ #ifdef CONFIG_CPUMASK_OFFSTACK
+@@ -62,7 +62,7 @@
+ 	unsigned long flags;
+ 
+ 	if (i < NR_IRQS) {
+-		spin_lock_irqsave(&irq_desc[i].lock, flags);
++		atomic_spin_lock_irqsave(&irq_desc[i].lock, flags);
+ 		action = irq_desc[i].action;
+ 		if (!action)
+ 			goto skip;
+@@ -76,7 +76,7 @@
+ 
+ 		seq_putc(p, '\n');
+  skip:
+-		spin_unlock_irqrestore(&irq_desc[i].lock, flags);
++		atomic_spin_unlock_irqrestore(&irq_desc[i].lock, flags);
+ 	} else if (i == NR_IRQS) {
+ 		seq_printf(p, "NMI: ");
+ 		for_each_online_cpu(j)
+Index: linux-rt-2.6.31/arch/blackfin/kernel/time.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/blackfin/kernel/time.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/blackfin/kernel/time.c	2010-05-17 14:23:19.908411087 +0200
+@@ -128,7 +128,7 @@
+ 	/* last time the cmos clock got updated */
+ 	static long last_rtc_update;
+ 
+-	write_seqlock(&xtime_lock);
++	write_atomic_seqlock(&xtime_lock);
+ 	do_timer(1);
+ 
+ 	/*
+@@ -148,7 +148,7 @@
+ 			/* Do it again in 60s. */
+ 			last_rtc_update = xtime.tv_sec - 600;
+ 	}
+-	write_sequnlock(&xtime_lock);
++	write_atomic_sequnlock(&xtime_lock);
+ 
+ #ifdef CONFIG_IPIPE
+ 	update_root_process_times(get_irq_regs());
+@@ -192,12 +192,12 @@
+ 	unsigned long usec, sec;
+ 
+ 	do {
+-		seq = read_seqbegin_irqsave(&xtime_lock, flags);
++		seq = read_atomic_seqbegin_irqsave(&xtime_lock, flags);
+ 		usec = gettimeoffset();
+ 		sec = xtime.tv_sec;
+ 		usec += (xtime.tv_nsec / NSEC_PER_USEC);
+ 	}
+-	while (read_seqretry_irqrestore(&xtime_lock, seq, flags));
++	while (read_atomic_seqretry_irqrestore(&xtime_lock, seq, flags));
+ 
+ 	while (usec >= USEC_PER_SEC) {
+ 		usec -= USEC_PER_SEC;
+@@ -217,7 +217,7 @@
+ 	if ((unsigned long)tv->tv_nsec >= NSEC_PER_SEC)
+ 		return -EINVAL;
+ 
+-	write_seqlock_irq(&xtime_lock);
++	write_atomic_seqlock_irq(&xtime_lock);
+ 	/*
+ 	 * This is revolting. We need to set the xtime.tv_usec
+ 	 * correctly. However, the value in this location is
+@@ -235,7 +235,7 @@
+ 
+ 	ntp_clear();
+ 
+-	write_sequnlock_irq(&xtime_lock);
++	write_atomic_sequnlock_irq(&xtime_lock);
+ 	clock_was_set();
+ 
+ 	return 0;
+Index: linux-rt-2.6.31/arch/cris/kernel/irq.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/cris/kernel/irq.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/cris/kernel/irq.c	2010-05-17 14:23:19.908411087 +0200
+@@ -57,7 +57,7 @@
+ 	}
+ 
+ 	if (i < NR_IRQS) {
+-		spin_lock_irqsave(&irq_desc[i].lock, flags);
++		atomic_spin_lock_irqsave(&irq_desc[i].lock, flags);
+ 		action = irq_desc[i].action;
+ 		if (!action)
+ 			goto skip;
+@@ -76,7 +76,7 @@
+ 
+ 		seq_putc(p, '\n');
+ skip:
+-		spin_unlock_irqrestore(&irq_desc[i].lock, flags);
++		atomic_spin_unlock_irqrestore(&irq_desc[i].lock, flags);
+ 	}
+ 	return 0;
+ }
+Index: linux-rt-2.6.31/arch/cris/kernel/time.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/cris/kernel/time.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/cris/kernel/time.c	2010-05-17 14:23:19.908411087 +0200
+@@ -87,7 +87,7 @@
+ 	if ((unsigned long)tv->tv_nsec >= NSEC_PER_SEC)
+ 		return -EINVAL;
+ 
+-	write_seqlock_irq(&xtime_lock);
++	write_atomic_seqlock_irq(&xtime_lock);
+ 	/*
+ 	 * This is revolting. We need to set "xtime" correctly. However, the
+ 	 * value in this location is the value at the most recent update of
+@@ -103,7 +103,7 @@
+ 	set_normalized_timespec(&wall_to_monotonic, wtm_sec, wtm_nsec);
+ 
+ 	ntp_clear();
+-	write_sequnlock_irq(&xtime_lock);
++	write_atomic_sequnlock_irq(&xtime_lock);
+ 	clock_was_set();
+ 	return 0;
+ }
+Index: linux-rt-2.6.31/arch/frv/include/asm/highmem.h
+===================================================================
+--- linux-rt-2.6.31.orig/arch/frv/include/asm/highmem.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/frv/include/asm/highmem.h	2010-05-17 14:23:19.908411087 +0200
+@@ -116,6 +116,7 @@
+ {
+ 	unsigned long paddr;
+ 
++	preempt_disable();
+ 	pagefault_disable();
+ 	debug_kmap_atomic(type);
+ 	paddr = page_to_phys(page);
+@@ -173,6 +174,7 @@
+ 		BUG();
+ 	}
+ 	pagefault_enable();
++	preempt_enable();
+ }
+ 
+ #endif /* !__ASSEMBLY__ */
+Index: linux-rt-2.6.31/arch/frv/kernel/irq.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/frv/kernel/irq.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/frv/kernel/irq.c	2010-05-17 14:23:19.908411087 +0200
+@@ -69,7 +69,7 @@
+ 	}
+ 
+ 	if (i < NR_IRQS) {
+-		spin_lock_irqsave(&irq_desc[i].lock, flags);
++		atomic_spin_lock_irqsave(&irq_desc[i].lock, flags);
+ 		action = irq_desc[i].action;
+ 		if (action) {
+ 			seq_printf(p, "%3d: ", i);
+@@ -85,7 +85,7 @@
+ 			seq_putc(p, '\n');
+ 		}
+ 
+-		spin_unlock_irqrestore(&irq_desc[i].lock, flags);
++		atomic_spin_unlock_irqrestore(&irq_desc[i].lock, flags);
+ 	} else if (i == NR_IRQS) {
+ 		seq_printf(p, "Err: %10u\n", atomic_read(&irq_err_count));
+ 	}
+Index: linux-rt-2.6.31/arch/frv/kernel/time.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/frv/kernel/time.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/frv/kernel/time.c	2010-05-17 14:23:19.908411087 +0200
+@@ -70,7 +70,7 @@
+ 	 * the irq version of write_lock because as just said we have irq
+ 	 * locally disabled. -arca
+ 	 */
+-	write_seqlock(&xtime_lock);
++	write_atomic_seqlock(&xtime_lock);
+ 
+ 	do_timer(1);
+ 
+@@ -96,7 +96,7 @@
+ 	__set_LEDS(n);
+ #endif /* CONFIG_HEARTBEAT */
+ 
+-	write_sequnlock(&xtime_lock);
++	write_atomic_sequnlock(&xtime_lock);
+ 
+ 	update_process_times(user_mode(get_irq_regs()));
+ 
+Index: linux-rt-2.6.31/arch/h8300/kernel/irq.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/h8300/kernel/irq.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/h8300/kernel/irq.c	2010-05-17 14:23:19.908411087 +0200
+@@ -191,7 +191,7 @@
+ 		seq_puts(p, "           CPU0");
+ 
+ 	if (i < NR_IRQS) {
+-		spin_lock_irqsave(&irq_desc[i].lock, flags);
++		atomic_spin_lock_irqsave(&irq_desc[i].lock, flags);
+ 		action = irq_desc[i].action;
+ 		if (!action)
+ 			goto unlock;
+@@ -205,7 +205,7 @@
+ 			seq_printf(p, ", %s", action->name);
+ 		seq_putc(p, '\n');
+ unlock:
+-		spin_unlock_irqrestore(&irq_desc[i].lock, flags);
++		atomic_spin_unlock_irqrestore(&irq_desc[i].lock, flags);
+ 	}
+ 	return 0;
+ }
+Index: linux-rt-2.6.31/arch/h8300/kernel/time.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/h8300/kernel/time.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/h8300/kernel/time.c	2010-05-17 14:23:19.908411087 +0200
+@@ -35,9 +35,9 @@
+ {
+ 	if (current->pid)
+ 		profile_tick(CPU_PROFILING);
+-	write_seqlock(&xtime_lock);
++	write_atomic_seqlock(&xtime_lock);
+ 	do_timer(1);
+-	write_sequnlock(&xtime_lock);
++	write_atomic_sequnlock(&xtime_lock);
+ 	update_process_times(user_mode(get_irq_regs()));
+ }
+ 
+Index: linux-rt-2.6.31/arch/ia64/include/asm/rwsem.h
+===================================================================
+--- linux-rt-2.6.31.orig/arch/ia64/include/asm/rwsem.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/ia64/include/asm/rwsem.h	2010-05-17 14:23:19.908411087 +0200
+@@ -33,7 +33,7 @@
+ /*
+  * the semaphore definition
+  */
+-struct rw_semaphore {
++struct rw_anon_semaphore {
+ 	signed long		count;
+ 	spinlock_t		wait_lock;
+ 	struct list_head	wait_list;
+@@ -51,26 +51,47 @@
+ 	  LIST_HEAD_INIT((name).wait_list) }
+ 
+ #define DECLARE_RWSEM(name) \
+-	struct rw_semaphore name = __RWSEM_INITIALIZER(name)
++	struct rw_anon_semaphore name = __RWSEM_INITIALIZER(name)
+ 
+-extern struct rw_semaphore *rwsem_down_read_failed(struct rw_semaphore *sem);
+-extern struct rw_semaphore *rwsem_down_write_failed(struct rw_semaphore *sem);
+-extern struct rw_semaphore *rwsem_wake(struct rw_semaphore *sem);
+-extern struct rw_semaphore *rwsem_downgrade_wake(struct rw_semaphore *sem);
++extern struct rw_anon_semaphore *
++rwsem_down_read_failed(struct rw_anon_semaphore *sem);
++extern struct rw_anon_semaphore *
++rwsem_down_write_failed(struct rw_anon_semaphore *sem);
++extern struct rw_anon_semaphore *
++rwsem_wake(struct rw_anon_semaphore *sem);
++extern struct rw_anon_semaphore *
++rwsem_downgrade_wake(struct rw_anon_semaphore *sem);
+ 
+-static inline void
+-init_rwsem (struct rw_semaphore *sem)
++static inline void init_anon_rwsem (struct rw_anon_semaphore *sem)
+ {
+ 	sem->count = RWSEM_UNLOCKED_VALUE;
+ 	spin_lock_init(&sem->wait_lock);
+ 	INIT_LIST_HEAD(&sem->wait_list);
+ }
+ 
++struct rw_anon_semaphore {
++	signed long		count;
++	spinlock_t		wait_lock;
++	struct list_head	wait_list;
++};
++
++#define __RWSEM_INITIALIZER(name) \
++	{ RWSEM_UNLOCKED_VALUE, SPIN_LOCK_UNLOCKED, \
++	LIST_HEAD_INIT((name).wait_list) }
++
++#define DECLARE_RWSEM(name) \
++	struct rw_semaphore name = __RWSEM_INITIALIZER(name)
++
++static inline void init_rwsem(struct rw_semaphore *sem)
++{
++	init_anon_rwsem((struct rw_anon_semaphore *)sem);
++}
++
+ /*
+  * lock for reading
+  */
+ static inline void
+-__down_read (struct rw_semaphore *sem)
++__down_read (struct rw_anon_semaphore *sem)
+ {
+ 	long result = ia64_fetchadd8_acq((unsigned long *)&sem->count, 1);
+ 
+@@ -82,7 +103,7 @@
+  * lock for writing
+  */
+ static inline void
+-__down_write (struct rw_semaphore *sem)
++__down_write (struct rw_anon_semaphore *sem)
+ {
+ 	long old, new;
+ 
+@@ -99,7 +120,7 @@
+  * unlock after reading
+  */
+ static inline void
+-__up_read (struct rw_semaphore *sem)
++__up_read (struct rw_anon_semaphore *sem)
+ {
+ 	long result = ia64_fetchadd8_rel((unsigned long *)&sem->count, -1);
+ 
+@@ -111,7 +132,7 @@
+  * unlock after writing
+  */
+ static inline void
+-__up_write (struct rw_semaphore *sem)
++__up_write (struct rw_anon_semaphore *sem)
+ {
+ 	long old, new;
+ 
+@@ -128,7 +149,7 @@
+  * trylock for reading -- returns 1 if successful, 0 if contention
+  */
+ static inline int
+-__down_read_trylock (struct rw_semaphore *sem)
++__down_read_trylock (struct rw_anon_semaphore *sem)
+ {
+ 	long tmp;
+ 	while ((tmp = sem->count) >= 0) {
+@@ -143,7 +164,7 @@
+  * trylock for writing -- returns 1 if successful, 0 if contention
+  */
+ static inline int
+-__down_write_trylock (struct rw_semaphore *sem)
++__down_write_trylock (struct rw_anon_semaphore *sem)
+ {
+ 	long tmp = cmpxchg_acq(&sem->count, RWSEM_UNLOCKED_VALUE,
+ 			      RWSEM_ACTIVE_WRITE_BIAS);
+@@ -154,7 +175,7 @@
+  * downgrade write lock to read lock
+  */
+ static inline void
+-__downgrade_write (struct rw_semaphore *sem)
++__downgrade_write (struct rw_anon_semaphore *sem)
+ {
+ 	long old, new;
+ 
+@@ -174,6 +195,11 @@
+ #define rwsem_atomic_add(delta, sem)	atomic64_add(delta, (atomic64_t *)(&(sem)->count))
+ #define rwsem_atomic_update(delta, sem)	atomic64_add_return(delta, (atomic64_t *)(&(sem)->count))
+ 
++static inline int anon_rwsem_is_locked(struct rw_anon_semaphore *sem)
++{
++	return (sem->count != 0);
++}
++
+ static inline int rwsem_is_locked(struct rw_semaphore *sem)
+ {
+ 	return (sem->count != 0);
+Index: linux-rt-2.6.31/arch/ia64/kernel/irq.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/ia64/kernel/irq.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/ia64/kernel/irq.c	2010-05-17 14:23:19.908411087 +0200
+@@ -71,7 +71,7 @@
+ 	}
+ 
+ 	if (i < NR_IRQS) {
+-		spin_lock_irqsave(&irq_desc[i].lock, flags);
++		atomic_spin_lock_irqsave(&irq_desc[i].lock, flags);
+ 		action = irq_desc[i].action;
+ 		if (!action)
+ 			goto skip;
+@@ -91,7 +91,7 @@
+ 
+ 		seq_putc(p, '\n');
+ skip:
+-		spin_unlock_irqrestore(&irq_desc[i].lock, flags);
++		atomic_spin_unlock_irqrestore(&irq_desc[i].lock, flags);
+ 	} else if (i == NR_IRQS)
+ 		seq_printf(p, "ERR: %10u\n", atomic_read(&irq_err_count));
+ 	return 0;
+Index: linux-rt-2.6.31/arch/ia64/kernel/irq_ia64.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/ia64/kernel/irq_ia64.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/ia64/kernel/irq_ia64.c	2010-05-17 14:23:19.908411087 +0200
+@@ -345,7 +345,7 @@
+ 
+ 		desc = irq_desc + irq;
+ 		cfg = irq_cfg + irq;
+-		spin_lock(&desc->lock);
++		atomic_spin_lock(&desc->lock);
+ 		if (!cfg->move_cleanup_count)
+ 			goto unlock;
+ 
+@@ -358,7 +358,7 @@
+ 		spin_unlock_irqrestore(&vector_lock, flags);
+ 		cfg->move_cleanup_count--;
+ 	unlock:
+-		spin_unlock(&desc->lock);
++		atomic_spin_unlock(&desc->lock);
+ 	}
+ 	return IRQ_HANDLED;
+ }
+Index: linux-rt-2.6.31/arch/ia64/kernel/salinfo.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/ia64/kernel/salinfo.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/ia64/kernel/salinfo.c	2010-05-17 14:23:19.908411087 +0200
+@@ -643,7 +643,7 @@
+ 	for (i = 0; i < ARRAY_SIZE(salinfo_log_name); i++) {
+ 		data = salinfo_data + i;
+ 		data->type = i;
+-		init_MUTEX(&data->mutex);
++		semaphore_init(&data->mutex);
+ 		dir = proc_mkdir(salinfo_log_name[i], salinfo_dir);
+ 		if (!dir)
+ 			continue;
+Index: linux-rt-2.6.31/arch/ia64/kernel/time.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/ia64/kernel/time.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/ia64/kernel/time.c	2010-05-17 14:23:19.908411087 +0200
+@@ -197,10 +197,10 @@
+ 			 * another CPU. We need to avoid to SMP race by acquiring the
+ 			 * xtime_lock.
+ 			 */
+-			write_seqlock(&xtime_lock);
++			write_atomic_seqlock(&xtime_lock);
+ 			do_timer(1);
+ 			local_cpu_data->itm_next = new_itm;
+-			write_sequnlock(&xtime_lock);
++			write_atomic_sequnlock(&xtime_lock);
+ 		} else
+ 			local_cpu_data->itm_next = new_itm;
+ 
+@@ -477,7 +477,7 @@
+ {
+         unsigned long flags;
+ 
+-        write_seqlock_irqsave(&fsyscall_gtod_data.lock, flags);
++	write_atomic_seqlock_irqsave(&fsyscall_gtod_data.lock, flags);
+ 
+         /* copy fsyscall clock data */
+         fsyscall_gtod_data.clk_mask = c->mask;
+@@ -500,6 +500,6 @@
+ 		fsyscall_gtod_data.monotonic_time.tv_sec++;
+ 	}
+ 
+-        write_sequnlock_irqrestore(&fsyscall_gtod_data.lock, flags);
++	write_atomic_sequnlock_irqrestore(&fsyscall_gtod_data.lock, flags);
+ }
+ 
+Index: linux-rt-2.6.31/arch/ia64/xen/time.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/ia64/xen/time.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/ia64/xen/time.c	2010-05-17 14:23:19.908411087 +0200
+@@ -141,10 +141,10 @@
+ 		delta_itm += local_cpu_data->itm_delta * (stolen + blocked);
+ 
+ 		if (cpu == time_keeper_id) {
+-			write_seqlock(&xtime_lock);
++			write_atomic_seqlock(&xtime_lock);
+ 			do_timer(stolen + blocked);
+ 			local_cpu_data->itm_next = delta_itm + new_itm;
+-			write_sequnlock(&xtime_lock);
++			write_atomic_sequnlock(&xtime_lock);
+ 		} else {
+ 			local_cpu_data->itm_next = delta_itm + new_itm;
+ 		}
+Index: linux-rt-2.6.31/arch/m32r/kernel/irq.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/m32r/kernel/irq.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/m32r/kernel/irq.c	2010-05-17 14:23:19.908411087 +0200
+@@ -40,7 +40,7 @@
+ 	}
+ 
+ 	if (i < NR_IRQS) {
+-		spin_lock_irqsave(&irq_desc[i].lock, flags);
++		atomic_spin_lock_irqsave(&irq_desc[i].lock, flags);
+ 		action = irq_desc[i].action;
+ 		if (!action)
+ 			goto skip;
+@@ -59,7 +59,7 @@
+ 
+ 		seq_putc(p, '\n');
+ skip:
+-		spin_unlock_irqrestore(&irq_desc[i].lock, flags);
++		atomic_spin_unlock_irqrestore(&irq_desc[i].lock, flags);
+ 	}
+ 	return 0;
+ }
+Index: linux-rt-2.6.31/arch/m32r/kernel/time.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/m32r/kernel/time.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/m32r/kernel/time.c	2010-05-17 14:23:19.908411087 +0200
+@@ -106,7 +106,7 @@
+ 	unsigned long max_ntp_tick = tick_usec - tickadj;
+ 
+ 	do {
+-		seq = read_seqbegin(&xtime_lock);
++		seq = read_atomic_seqbegin(&xtime_lock);
+ 
+ 		usec = do_gettimeoffset();
+ 
+@@ -120,7 +120,7 @@
+ 
+ 		sec = xtime.tv_sec;
+ 		usec += (xtime.tv_nsec / 1000);
+-	} while (read_seqretry(&xtime_lock, seq));
++	} while (read_atomic_seqretry(&xtime_lock, seq));
+ 
+ 	while (usec >= 1000000) {
+ 		usec -= 1000000;
+@@ -141,7 +141,7 @@
+ 	if ((unsigned long)tv->tv_nsec >= NSEC_PER_SEC)
+ 		return -EINVAL;
+ 
+-	write_seqlock_irq(&xtime_lock);
++	write_atomic_seqlock_irq(&xtime_lock);
+ 	/*
+ 	 * This is revolting. We need to set "xtime" correctly. However, the
+ 	 * value in this location is the value at the most recent update of
+@@ -157,7 +157,7 @@
+ 	set_normalized_timespec(&wall_to_monotonic, wtm_sec, wtm_nsec);
+ 
+ 	ntp_clear();
+-	write_sequnlock_irq(&xtime_lock);
++	write_atomic_sequnlock_irq(&xtime_lock);
+ 	clock_was_set();
+ 
+ 	return 0;
+@@ -202,7 +202,7 @@
+ 	 * CMOS clock accordingly every ~11 minutes. Set_rtc_mmss() has to be
+ 	 * called as close as possible to 500 ms before the new second starts.
+ 	 */
+-	write_seqlock(&xtime_lock);
++	write_atomic_seqlock(&xtime_lock);
+ 	if (ntp_synced()
+ 		&& xtime.tv_sec > last_rtc_update + 660
+ 		&& (xtime.tv_nsec / 1000) >= 500000 - ((unsigned)TICK_SIZE) / 2
+@@ -213,7 +213,7 @@
+ 		else	/* do it again in 60 s */
+ 			last_rtc_update = xtime.tv_sec - 600;
+ 	}
+-	write_sequnlock(&xtime_lock);
++	write_atomic_sequnlock(&xtime_lock);
+ 	/* As we return to user mode fire off the other CPU schedulers..
+ 	   this is basically because we don't yet share IRQ's around.
+ 	   This message is rigged to be safe on the 386 - basically it's
+Index: linux-rt-2.6.31/arch/m68k/kernel/time.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/m68k/kernel/time.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/m68k/kernel/time.c	2010-05-17 14:23:19.908411087 +0200
+@@ -102,7 +102,7 @@
+ 	unsigned long max_ntp_tick = tick_usec - tickadj;
+ 
+ 	do {
+-		seq = read_seqbegin_irqsave(&xtime_lock, flags);
++		seq = read_atomic_seqbegin_irqsave(&xtime_lock, flags);
+ 
+ 		usec = mach_gettimeoffset();
+ 
+@@ -116,7 +116,7 @@
+ 
+ 		sec = xtime.tv_sec;
+ 		usec += xtime.tv_nsec/1000;
+-	} while (read_seqretry_irqrestore(&xtime_lock, seq, flags));
++	} while (read_atomic_seqretry_irqrestore(&xtime_lock, seq, flags));
+ 
+ 
+ 	while (usec >= 1000000) {
+@@ -138,7 +138,7 @@
+ 	if ((unsigned long)tv->tv_nsec >= NSEC_PER_SEC)
+ 		return -EINVAL;
+ 
+-	write_seqlock_irq(&xtime_lock);
++	write_atomic_seqlock_irq(&xtime_lock);
+ 	/* This is revolting. We need to set the xtime.tv_nsec
+ 	 * correctly. However, the value in this location is
+ 	 * is value at the last tick.
+@@ -154,7 +154,7 @@
+ 	set_normalized_timespec(&wall_to_monotonic, wtm_sec, wtm_nsec);
+ 
+ 	ntp_clear();
+-	write_sequnlock_irq(&xtime_lock);
++	write_atomic_sequnlock_irq(&xtime_lock);
+ 	clock_was_set();
+ 	return 0;
+ }
+Index: linux-rt-2.6.31/arch/m68knommu/kernel/time.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/m68knommu/kernel/time.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/m68knommu/kernel/time.c	2010-05-17 14:23:19.908411087 +0200
+@@ -44,11 +44,11 @@
+ 	if (current->pid)
+ 		profile_tick(CPU_PROFILING);
+ 
+-	write_seqlock(&xtime_lock);
++	write_atomic_seqlock(&xtime_lock);
+ 
+ 	do_timer(1);
+ 
+-	write_sequnlock(&xtime_lock);
++	write_atomic_sequnlock(&xtime_lock);
+ 
+ #ifndef CONFIG_SMP
+ 	update_process_times(user_mode(get_irq_regs()));
+Index: linux-rt-2.6.31/arch/microblaze/kernel/irq.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/microblaze/kernel/irq.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/microblaze/kernel/irq.c	2010-05-17 14:23:19.908411087 +0200
+@@ -68,7 +68,7 @@
+ 	}
+ 
+ 	if (i < nr_irq) {
+-		spin_lock_irqsave(&irq_desc[i].lock, flags);
++		atomic_spin_lock_irqsave(&irq_desc[i].lock, flags);
+ 		action = irq_desc[i].action;
+ 		if (!action)
+ 			goto skip;
+@@ -89,7 +89,7 @@
+ 
+ 		seq_putc(p, '\n');
+ skip:
+-		spin_unlock_irqrestore(&irq_desc[i].lock, flags);
++		atomic_spin_unlock_irqrestore(&irq_desc[i].lock, flags);
+ 	}
+ 	return 0;
+ }
+Index: linux-rt-2.6.31/arch/mips/include/asm/i8253.h
+===================================================================
+--- linux-rt-2.6.31.orig/arch/mips/include/asm/i8253.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/mips/include/asm/i8253.h	2010-05-17 14:23:19.908411087 +0200
+@@ -12,7 +12,7 @@
+ #define PIT_CH0			0x40
+ #define PIT_CH2			0x42
+ 
+-extern spinlock_t i8253_lock;
++extern atomic_spinlock_t i8253_lock;
+ 
+ extern void setup_pit_timer(void);
+ 
+Index: linux-rt-2.6.31/arch/mips/kernel/i8253.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/mips/kernel/i8253.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/mips/kernel/i8253.c	2010-05-17 14:23:19.908411087 +0200
+@@ -15,7 +15,7 @@
+ #include <asm/io.h>
+ #include <asm/time.h>
+ 
+-DEFINE_SPINLOCK(i8253_lock);
++DEFINE_ATOMIC_SPINLOCK(i8253_lock);
+ EXPORT_SYMBOL(i8253_lock);
+ 
+ /*
+@@ -26,7 +26,7 @@
+ static void init_pit_timer(enum clock_event_mode mode,
+ 			   struct clock_event_device *evt)
+ {
+-	spin_lock(&i8253_lock);
++	atomic_spin_lock(&i8253_lock);
+ 
+ 	switch(mode) {
+ 	case CLOCK_EVT_MODE_PERIODIC:
+@@ -55,7 +55,7 @@
+ 		/* Nothing to do here */
+ 		break;
+ 	}
+-	spin_unlock(&i8253_lock);
++	atomic_spin_unlock(&i8253_lock);
+ }
+ 
+ /*
+@@ -65,10 +65,10 @@
+  */
+ static int pit_next_event(unsigned long delta, struct clock_event_device *evt)
+ {
+-	spin_lock(&i8253_lock);
++	atomic_spin_lock(&i8253_lock);
+ 	outb_p(delta & 0xff , PIT_CH0);	/* LSB */
+ 	outb(delta >> 8 , PIT_CH0);	/* MSB */
+-	spin_unlock(&i8253_lock);
++	atomic_spin_unlock(&i8253_lock);
+ 
+ 	return 0;
+ }
+@@ -137,7 +137,7 @@
+ 	static int old_count;
+ 	static u32 old_jifs;
+ 
+-	spin_lock_irqsave(&i8253_lock, flags);
++	atomic_spin_lock_irqsave(&i8253_lock, flags);
+ 	/*
+ 	 * Although our caller may have the read side of xtime_lock,
+ 	 * this is now a seqlock, and we are cheating in this routine
+@@ -183,7 +183,7 @@
+ 	old_count = count;
+ 	old_jifs = jifs;
+ 
+-	spin_unlock_irqrestore(&i8253_lock, flags);
++	atomic_spin_unlock_irqrestore(&i8253_lock, flags);
+ 
+ 	count = (LATCH - 1) - count;
+ 
+Index: linux-rt-2.6.31/arch/mips/kernel/irq.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/mips/kernel/irq.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/mips/kernel/irq.c	2010-05-17 14:23:19.908411087 +0200
+@@ -99,7 +99,7 @@
+ 	}
+ 
+ 	if (i < NR_IRQS) {
+-		spin_lock_irqsave(&irq_desc[i].lock, flags);
++		atomic_spin_lock_irqsave(&irq_desc[i].lock, flags);
+ 		action = irq_desc[i].action;
+ 		if (!action)
+ 			goto skip;
+@@ -118,7 +118,7 @@
+ 
+ 		seq_putc(p, '\n');
+ skip:
+-		spin_unlock_irqrestore(&irq_desc[i].lock, flags);
++		atomic_spin_unlock_irqrestore(&irq_desc[i].lock, flags);
+ 	} else if (i == NR_IRQS) {
+ 		seq_putc(p, '\n');
+ 		seq_printf(p, "ERR: %10u\n", atomic_read(&irq_err_count));
+Index: linux-rt-2.6.31/arch/mips/mm/fault.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/mips/mm/fault.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/mips/mm/fault.c	2010-05-17 14:23:19.908411087 +0200
+@@ -69,7 +69,7 @@
+ 	 * If we're in an interrupt or have no user
+ 	 * context, we must not take the fault..
+ 	 */
+-	if (in_atomic() || !mm)
++	if (in_atomic() || !mm || current->pagefault_disabled)
+ 		goto bad_area_nosemaphore;
+ 
+ 	down_read(&mm->mmap_sem);
+Index: linux-rt-2.6.31/arch/mips/mm/highmem.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/mips/mm/highmem.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/mips/mm/highmem.c	2010-05-17 14:23:19.908411087 +0200
+@@ -45,7 +45,7 @@
+ 	enum fixed_addresses idx;
+ 	unsigned long vaddr;
+ 
+-	/* even !CONFIG_PREEMPT needs this, for in_atomic in do_page_fault */
++	preempt_disable();
+ 	pagefault_disable();
+ 	if (!PageHighMem(page))
+ 		return page_address(page);
+@@ -71,6 +71,7 @@
+ 
+ 	if (vaddr < FIXADDR_START) { // FIXME
+ 		pagefault_enable();
++		preempt_enable();
+ 		return;
+ 	}
+ 
+@@ -85,6 +86,7 @@
+ #endif
+ 
+ 	pagefault_enable();
++	preempt_enable();
+ }
+ EXPORT_SYMBOL(__kunmap_atomic);
+ 
+@@ -97,6 +99,7 @@
+ 	enum fixed_addresses idx;
+ 	unsigned long vaddr;
+ 
++	preempt_disable();
+ 	pagefault_disable();
+ 
+ 	debug_kmap_atomic(type);
+Index: linux-rt-2.6.31/arch/mips/vr41xx/common/icu.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/mips/vr41xx/common/icu.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/mips/vr41xx/common/icu.c	2010-05-17 14:23:19.908411087 +0200
+@@ -159,9 +159,9 @@
+ 
+ 	if (current_cpu_type() == CPU_VR4111 ||
+ 	    current_cpu_type() == CPU_VR4121) {
+-		spin_lock_irqsave(&desc->lock, flags);
++		atomic_spin_lock_irqsave(&desc->lock, flags);
+ 		icu1_set(MPIUINTREG, mask);
+-		spin_unlock_irqrestore(&desc->lock, flags);
++		atomic_spin_unlock_irqrestore(&desc->lock, flags);
+ 	}
+ }
+ 
+@@ -174,9 +174,9 @@
+ 
+ 	if (current_cpu_type() == CPU_VR4111 ||
+ 	    current_cpu_type() == CPU_VR4121) {
+-		spin_lock_irqsave(&desc->lock, flags);
++		atomic_spin_lock_irqsave(&desc->lock, flags);
+ 		icu1_clear(MPIUINTREG, mask);
+-		spin_unlock_irqrestore(&desc->lock, flags);
++		atomic_spin_unlock_irqrestore(&desc->lock, flags);
+ 	}
+ }
+ 
+@@ -189,9 +189,9 @@
+ 
+ 	if (current_cpu_type() == CPU_VR4111 ||
+ 	    current_cpu_type() == CPU_VR4121) {
+-		spin_lock_irqsave(&desc->lock, flags);
++		atomic_spin_lock_irqsave(&desc->lock, flags);
+ 		icu1_set(MAIUINTREG, mask);
+-		spin_unlock_irqrestore(&desc->lock, flags);
++		atomic_spin_unlock_irqrestore(&desc->lock, flags);
+ 	}
+ }
+ 
+@@ -204,9 +204,9 @@
+ 
+ 	if (current_cpu_type() == CPU_VR4111 ||
+ 	    current_cpu_type() == CPU_VR4121) {
+-		spin_lock_irqsave(&desc->lock, flags);
++		atomic_spin_lock_irqsave(&desc->lock, flags);
+ 		icu1_clear(MAIUINTREG, mask);
+-		spin_unlock_irqrestore(&desc->lock, flags);
++		atomic_spin_unlock_irqrestore(&desc->lock, flags);
+ 	}
+ }
+ 
+@@ -219,9 +219,9 @@
+ 
+ 	if (current_cpu_type() == CPU_VR4111 ||
+ 	    current_cpu_type() == CPU_VR4121) {
+-		spin_lock_irqsave(&desc->lock, flags);
++		atomic_spin_lock_irqsave(&desc->lock, flags);
+ 		icu1_set(MKIUINTREG, mask);
+-		spin_unlock_irqrestore(&desc->lock, flags);
++		atomic_spin_unlock_irqrestore(&desc->lock, flags);
+ 	}
+ }
+ 
+@@ -234,9 +234,9 @@
+ 
+ 	if (current_cpu_type() == CPU_VR4111 ||
+ 	    current_cpu_type() == CPU_VR4121) {
+-		spin_lock_irqsave(&desc->lock, flags);
++		atomic_spin_lock_irqsave(&desc->lock, flags);
+ 		icu1_clear(MKIUINTREG, mask);
+-		spin_unlock_irqrestore(&desc->lock, flags);
++		atomic_spin_unlock_irqrestore(&desc->lock, flags);
+ 	}
+ }
+ 
+@@ -247,9 +247,9 @@
+ 	struct irq_desc *desc = irq_desc + ETHERNET_IRQ;
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&desc->lock, flags);
++	atomic_spin_lock_irqsave(&desc->lock, flags);
+ 	icu1_set(MMACINTREG, mask);
+-	spin_unlock_irqrestore(&desc->lock, flags);
++	atomic_spin_unlock_irqrestore(&desc->lock, flags);
+ }
+ 
+ EXPORT_SYMBOL(vr41xx_enable_macint);
+@@ -259,9 +259,9 @@
+ 	struct irq_desc *desc = irq_desc + ETHERNET_IRQ;
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&desc->lock, flags);
++	atomic_spin_lock_irqsave(&desc->lock, flags);
+ 	icu1_clear(MMACINTREG, mask);
+-	spin_unlock_irqrestore(&desc->lock, flags);
++	atomic_spin_unlock_irqrestore(&desc->lock, flags);
+ }
+ 
+ EXPORT_SYMBOL(vr41xx_disable_macint);
+@@ -271,9 +271,9 @@
+ 	struct irq_desc *desc = irq_desc + DSIU_IRQ;
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&desc->lock, flags);
++	atomic_spin_lock_irqsave(&desc->lock, flags);
+ 	icu1_set(MDSIUINTREG, mask);
+-	spin_unlock_irqrestore(&desc->lock, flags);
++	atomic_spin_unlock_irqrestore(&desc->lock, flags);
+ }
+ 
+ EXPORT_SYMBOL(vr41xx_enable_dsiuint);
+@@ -283,9 +283,9 @@
+ 	struct irq_desc *desc = irq_desc + DSIU_IRQ;
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&desc->lock, flags);
++	atomic_spin_lock_irqsave(&desc->lock, flags);
+ 	icu1_clear(MDSIUINTREG, mask);
+-	spin_unlock_irqrestore(&desc->lock, flags);
++	atomic_spin_unlock_irqrestore(&desc->lock, flags);
+ }
+ 
+ EXPORT_SYMBOL(vr41xx_disable_dsiuint);
+@@ -295,9 +295,9 @@
+ 	struct irq_desc *desc = irq_desc + FIR_IRQ;
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&desc->lock, flags);
++	atomic_spin_lock_irqsave(&desc->lock, flags);
+ 	icu2_set(MFIRINTREG, mask);
+-	spin_unlock_irqrestore(&desc->lock, flags);
++	atomic_spin_unlock_irqrestore(&desc->lock, flags);
+ }
+ 
+ EXPORT_SYMBOL(vr41xx_enable_firint);
+@@ -307,9 +307,9 @@
+ 	struct irq_desc *desc = irq_desc + FIR_IRQ;
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&desc->lock, flags);
++	atomic_spin_lock_irqsave(&desc->lock, flags);
+ 	icu2_clear(MFIRINTREG, mask);
+-	spin_unlock_irqrestore(&desc->lock, flags);
++	atomic_spin_unlock_irqrestore(&desc->lock, flags);
+ }
+ 
+ EXPORT_SYMBOL(vr41xx_disable_firint);
+@@ -322,9 +322,9 @@
+ 	if (current_cpu_type() == CPU_VR4122 ||
+ 	    current_cpu_type() == CPU_VR4131 ||
+ 	    current_cpu_type() == CPU_VR4133) {
+-		spin_lock_irqsave(&desc->lock, flags);
++		atomic_spin_lock_irqsave(&desc->lock, flags);
+ 		icu2_write(MPCIINTREG, PCIINT0);
+-		spin_unlock_irqrestore(&desc->lock, flags);
++		atomic_spin_unlock_irqrestore(&desc->lock, flags);
+ 	}
+ }
+ 
+@@ -338,9 +338,9 @@
+ 	if (current_cpu_type() == CPU_VR4122 ||
+ 	    current_cpu_type() == CPU_VR4131 ||
+ 	    current_cpu_type() == CPU_VR4133) {
+-		spin_lock_irqsave(&desc->lock, flags);
++		atomic_spin_lock_irqsave(&desc->lock, flags);
+ 		icu2_write(MPCIINTREG, 0);
+-		spin_unlock_irqrestore(&desc->lock, flags);
++		atomic_spin_unlock_irqrestore(&desc->lock, flags);
+ 	}
+ }
+ 
+@@ -354,9 +354,9 @@
+ 	if (current_cpu_type() == CPU_VR4122 ||
+ 	    current_cpu_type() == CPU_VR4131 ||
+ 	    current_cpu_type() == CPU_VR4133) {
+-		spin_lock_irqsave(&desc->lock, flags);
++		atomic_spin_lock_irqsave(&desc->lock, flags);
+ 		icu2_write(MSCUINTREG, SCUINT0);
+-		spin_unlock_irqrestore(&desc->lock, flags);
++		atomic_spin_unlock_irqrestore(&desc->lock, flags);
+ 	}
+ }
+ 
+@@ -370,9 +370,9 @@
+ 	if (current_cpu_type() == CPU_VR4122 ||
+ 	    current_cpu_type() == CPU_VR4131 ||
+ 	    current_cpu_type() == CPU_VR4133) {
+-		spin_lock_irqsave(&desc->lock, flags);
++		atomic_spin_lock_irqsave(&desc->lock, flags);
+ 		icu2_write(MSCUINTREG, 0);
+-		spin_unlock_irqrestore(&desc->lock, flags);
++		atomic_spin_unlock_irqrestore(&desc->lock, flags);
+ 	}
+ }
+ 
+@@ -386,9 +386,9 @@
+ 	if (current_cpu_type() == CPU_VR4122 ||
+ 	    current_cpu_type() == CPU_VR4131 ||
+ 	    current_cpu_type() == CPU_VR4133) {
+-		spin_lock_irqsave(&desc->lock, flags);
++		atomic_spin_lock_irqsave(&desc->lock, flags);
+ 		icu2_set(MCSIINTREG, mask);
+-		spin_unlock_irqrestore(&desc->lock, flags);
++		atomic_spin_unlock_irqrestore(&desc->lock, flags);
+ 	}
+ }
+ 
+@@ -402,9 +402,9 @@
+ 	if (current_cpu_type() == CPU_VR4122 ||
+ 	    current_cpu_type() == CPU_VR4131 ||
+ 	    current_cpu_type() == CPU_VR4133) {
+-		spin_lock_irqsave(&desc->lock, flags);
++		atomic_spin_lock_irqsave(&desc->lock, flags);
+ 		icu2_clear(MCSIINTREG, mask);
+-		spin_unlock_irqrestore(&desc->lock, flags);
++		atomic_spin_unlock_irqrestore(&desc->lock, flags);
+ 	}
+ }
+ 
+@@ -418,9 +418,9 @@
+ 	if (current_cpu_type() == CPU_VR4122 ||
+ 	    current_cpu_type() == CPU_VR4131 ||
+ 	    current_cpu_type() == CPU_VR4133) {
+-		spin_lock_irqsave(&desc->lock, flags);
++		atomic_spin_lock_irqsave(&desc->lock, flags);
+ 		icu2_write(MBCUINTREG, BCUINTR);
+-		spin_unlock_irqrestore(&desc->lock, flags);
++		atomic_spin_unlock_irqrestore(&desc->lock, flags);
+ 	}
+ }
+ 
+@@ -434,9 +434,9 @@
+ 	if (current_cpu_type() == CPU_VR4122 ||
+ 	    current_cpu_type() == CPU_VR4131 ||
+ 	    current_cpu_type() == CPU_VR4133) {
+-		spin_lock_irqsave(&desc->lock, flags);
++		atomic_spin_lock_irqsave(&desc->lock, flags);
+ 		icu2_write(MBCUINTREG, 0);
+-		spin_unlock_irqrestore(&desc->lock, flags);
++		atomic_spin_unlock_irqrestore(&desc->lock, flags);
+ 	}
+ }
+ 
+@@ -486,7 +486,7 @@
+ 
+ 	pin = SYSINT1_IRQ_TO_PIN(irq);
+ 
+-	spin_lock_irq(&desc->lock);
++	atomic_spin_lock_irq(&desc->lock);
+ 
+ 	intassign0 = icu1_read(INTASSIGN0);
+ 	intassign1 = icu1_read(INTASSIGN1);
+@@ -525,7 +525,7 @@
+ 		intassign1 |= (uint16_t)assign << 9;
+ 		break;
+ 	default:
+-		spin_unlock_irq(&desc->lock);
++		atomic_spin_unlock_irq(&desc->lock);
+ 		return -EINVAL;
+ 	}
+ 
+@@ -533,7 +533,7 @@
+ 	icu1_write(INTASSIGN0, intassign0);
+ 	icu1_write(INTASSIGN1, intassign1);
+ 
+-	spin_unlock_irq(&desc->lock);
++	atomic_spin_unlock_irq(&desc->lock);
+ 
+ 	return 0;
+ }
+@@ -546,7 +546,7 @@
+ 
+ 	pin = SYSINT2_IRQ_TO_PIN(irq);
+ 
+-	spin_lock_irq(&desc->lock);
++	atomic_spin_lock_irq(&desc->lock);
+ 
+ 	intassign2 = icu1_read(INTASSIGN2);
+ 	intassign3 = icu1_read(INTASSIGN3);
+@@ -593,7 +593,7 @@
+ 		intassign3 |= (uint16_t)assign << 12;
+ 		break;
+ 	default:
+-		spin_unlock_irq(&desc->lock);
++		atomic_spin_unlock_irq(&desc->lock);
+ 		return -EINVAL;
+ 	}
+ 
+@@ -601,7 +601,7 @@
+ 	icu1_write(INTASSIGN2, intassign2);
+ 	icu1_write(INTASSIGN3, intassign3);
+ 
+-	spin_unlock_irq(&desc->lock);
++	atomic_spin_unlock_irq(&desc->lock);
+ 
+ 	return 0;
+ }
+Index: linux-rt-2.6.31/arch/mn10300/kernel/irq.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/mn10300/kernel/irq.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/mn10300/kernel/irq.c	2010-05-17 14:23:19.918385259 +0200
+@@ -215,7 +215,7 @@
+ 
+ 		/* display information rows, one per active CPU */
+ 	case 1 ... NR_IRQS - 1:
+-		spin_lock_irqsave(&irq_desc[i].lock, flags);
++		atomic_spin_lock_irqsave(&irq_desc[i].lock, flags);
+ 
+ 		action = irq_desc[i].action;
+ 		if (action) {
+@@ -235,7 +235,7 @@
+ 			seq_putc(p, '\n');
+ 		}
+ 
+-		spin_unlock_irqrestore(&irq_desc[i].lock, flags);
++		atomic_spin_unlock_irqrestore(&irq_desc[i].lock, flags);
+ 		break;
+ 
+ 		/* polish off with NMI and error counters */
+Index: linux-rt-2.6.31/arch/mn10300/kernel/time.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/mn10300/kernel/time.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/mn10300/kernel/time.c	2010-05-17 14:23:19.918385259 +0200
+@@ -99,7 +99,7 @@
+ {
+ 	unsigned tsc, elapse;
+ 
+-	write_seqlock(&xtime_lock);
++	write_atomic_seqlock(&xtime_lock);
+ 
+ 	while (tsc = get_cycles(),
+ 	       elapse = mn10300_last_tsc - tsc, /* time elapsed since last
+@@ -114,7 +114,7 @@
+ 		check_rtc_time();
+ 	}
+ 
+-	write_sequnlock(&xtime_lock);
++	write_atomic_sequnlock(&xtime_lock);
+ 
+ 	update_process_times(user_mode(get_irq_regs()));
+ 
+Index: linux-rt-2.6.31/arch/parisc/kernel/irq.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/parisc/kernel/irq.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/parisc/kernel/irq.c	2010-05-17 14:23:19.918385259 +0200
+@@ -180,7 +180,7 @@
+ 	if (i < NR_IRQS) {
+ 		struct irqaction *action;
+ 
+-		spin_lock_irqsave(&irq_desc[i].lock, flags);
++		atomic_spin_lock_irqsave(&irq_desc[i].lock, flags);
+ 		action = irq_desc[i].action;
+ 		if (!action)
+ 			goto skip;
+@@ -224,7 +224,7 @@
+ 
+ 		seq_putc(p, '\n');
+  skip:
+-		spin_unlock_irqrestore(&irq_desc[i].lock, flags);
++		atomic_spin_unlock_irqrestore(&irq_desc[i].lock, flags);
+ 	}
+ 
+ 	return 0;
+Index: linux-rt-2.6.31/arch/parisc/kernel/time.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/parisc/kernel/time.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/parisc/kernel/time.c	2010-05-17 14:23:19.918385259 +0200
+@@ -163,9 +163,9 @@
+ 	}
+ 
+ 	if (cpu == 0) {
+-		write_seqlock(&xtime_lock);
++		write_atomic_seqlock(&xtime_lock);
+ 		do_timer(ticks_elapsed);
+-		write_sequnlock(&xtime_lock);
++		write_atomic_sequnlock(&xtime_lock);
+ 	}
+ 
+ 	return IRQ_HANDLED;
+@@ -268,12 +268,12 @@
+ 	if (pdc_tod_read(&tod_data) == 0) {
+ 		unsigned long flags;
+ 
+-		write_seqlock_irqsave(&xtime_lock, flags);
++		write_atomic_seqlock_irqsave(&xtime_lock, flags);
+ 		xtime.tv_sec = tod_data.tod_sec;
+ 		xtime.tv_nsec = tod_data.tod_usec * 1000;
+ 		set_normalized_timespec(&wall_to_monotonic,
+ 		                        -xtime.tv_sec, -xtime.tv_nsec);
+-		write_sequnlock_irqrestore(&xtime_lock, flags);
++		write_atomic_sequnlock_irqrestore(&xtime_lock, flags);
+ 	} else {
+ 		printk(KERN_ERR "Error reading tod clock\n");
+ 	        xtime.tv_sec = 0;
+Index: linux-rt-2.6.31/arch/powerpc/Kconfig
+===================================================================
+--- linux-rt-2.6.31.orig/arch/powerpc/Kconfig	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/arch/powerpc/Kconfig	2010-05-17 14:23:19.918385259 +0200
+@@ -68,13 +68,6 @@
+ 	bool
+ 	default y
+ 
+-config RWSEM_GENERIC_SPINLOCK
+-	bool
+-
+-config RWSEM_XCHGADD_ALGORITHM
+-	bool
+-	default y
+-
+ config GENERIC_LOCKBREAK
+ 	bool
+ 	default y
+@@ -252,6 +245,14 @@
+ source kernel/time/Kconfig
+ source kernel/Kconfig.hz
+ source kernel/Kconfig.preempt
++
++config RWSEM_GENERIC_SPINLOCK
++	bool
++	default y
++
++config RWSEM_XCHGADD_ALGORITHM
++	bool
++
+ source "fs/Kconfig.binfmt"
+ 
+ config HUGETLB_PAGE_SIZE_VARIABLE
+Index: linux-rt-2.6.31/arch/powerpc/include/asm/mpic.h
+===================================================================
+--- linux-rt-2.6.31.orig/arch/powerpc/include/asm/mpic.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/powerpc/include/asm/mpic.h	2010-05-17 14:23:19.918385259 +0200
+@@ -289,7 +289,7 @@
+ #ifdef CONFIG_MPIC_U3_HT_IRQS
+ 	/* The fixup table */
+ 	struct mpic_irq_fixup	*fixups;
+-	spinlock_t		fixup_lock;
++	atomic_spinlock_t	fixup_lock;
+ #endif
+ 
+ 	/* Register access method */
+Index: linux-rt-2.6.31/arch/powerpc/include/asm/pgtable-ppc64.h
+===================================================================
+--- linux-rt-2.6.31.orig/arch/powerpc/include/asm/pgtable-ppc64.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/powerpc/include/asm/pgtable-ppc64.h	2010-05-17 14:23:19.918385259 +0200
+@@ -202,8 +202,15 @@
+ 		assert_pte_locked(mm, addr);
+ 
+ #ifdef CONFIG_PPC_STD_MMU_64
+-	if (old & _PAGE_HASHPTE)
++	if (old & _PAGE_HASHPTE) {
++#ifdef CONFIG_PREEMPT_RT
++		preempt_disable();
++#endif
+ 		hpte_need_flush(mm, addr, ptep, old, huge);
++#ifdef CONFIG_PREEMPT_RT
++		preempt_enable();
++#endif
++	}
+ #endif
+ 
+ 	return old;
+Index: linux-rt-2.6.31/arch/powerpc/include/asm/pmac_feature.h
+===================================================================
+--- linux-rt-2.6.31.orig/arch/powerpc/include/asm/pmac_feature.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/powerpc/include/asm/pmac_feature.h	2010-05-17 14:23:19.918385259 +0200
+@@ -378,7 +378,7 @@
+  * Those are exported by pmac feature for internal use by arch code
+  * only like the platform function callbacks, do not use directly in drivers
+  */
+-extern spinlock_t feature_lock;
++extern atomic_spinlock_t feature_lock;
+ extern struct device_node *uninorth_node;
+ extern u32 __iomem *uninorth_base;
+ 
+Index: linux-rt-2.6.31/arch/powerpc/include/asm/rwsem.h
+===================================================================
+--- linux-rt-2.6.31.orig/arch/powerpc/include/asm/rwsem.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/powerpc/include/asm/rwsem.h	2010-05-17 14:23:19.918385259 +0200
+@@ -21,7 +21,7 @@
+ /*
+  * the semaphore definition
+  */
+-struct rw_semaphore {
++struct rw_anon_semaphore {
+ 	/* XXX this should be able to be an atomic_t  -- paulus */
+ 	signed int		count;
+ #define RWSEM_UNLOCKED_VALUE		0x00000000
+@@ -38,43 +38,47 @@
+ };
+ 
+ #ifdef CONFIG_DEBUG_LOCK_ALLOC
+-# define __RWSEM_DEP_MAP_INIT(lockname) , .dep_map = { .name = #lockname }
++# define __RWSEM_ANON_DEP_MAP_INIT(lockname) , .dep_map = { .name = #lockname }
+ #else
+-# define __RWSEM_DEP_MAP_INIT(lockname)
++# define __RWSEM_ANON_DEP_MAP_INIT(lockname)
+ #endif
+ 
+-#define __RWSEM_INITIALIZER(name) \
++#define __RWSEM_ANON_INITIALIZER(name) \
+ 	{ RWSEM_UNLOCKED_VALUE, __SPIN_LOCK_UNLOCKED((name).wait_lock), \
+-	  LIST_HEAD_INIT((name).wait_list) __RWSEM_DEP_MAP_INIT(name) }
++	  LIST_HEAD_INIT((name).wait_list) __RWSEM_ANON_DEP_MAP_INIT(name) }
+ 
+-#define DECLARE_RWSEM(name)		\
+-	struct rw_semaphore name = __RWSEM_INITIALIZER(name)
++#define DECLARE_ANON_RWSEM(name)		\
++	struct rw_anon_semaphore name = __RWSEM_ANON_INITIALIZER(name)
+ 
+-extern struct rw_semaphore *rwsem_down_read_failed(struct rw_semaphore *sem);
+-extern struct rw_semaphore *rwsem_down_write_failed(struct rw_semaphore *sem);
+-extern struct rw_semaphore *rwsem_wake(struct rw_semaphore *sem);
+-extern struct rw_semaphore *rwsem_downgrade_wake(struct rw_semaphore *sem);
++extern struct rw_anon_semaphore *
++rwsem_down_read_failed(struct rw_anon_semaphore *sem);
++extern struct rw_anon_semaphore *
++rwsem_down_write_failed(struct rw_anon_semaphore *sem);
++extern struct rw_anon_semaphore *
++rwsem_wake(struct rw_anon_semaphore *sem);
++extern struct rw_anon_semaphore *
++rwsem_downgrade_wake(struct rw_anon_semaphore *sem);
+ 
+-extern void __init_rwsem(struct rw_semaphore *sem, const char *name,
++extern void __init_anon_rwsem(struct rw_anon_semaphore *sem, const char *name,
+ 			 struct lock_class_key *key);
+ 
+-#define init_rwsem(sem)					\
++#define init_anon_rwsem(sem)				\
+ 	do {						\
+ 		static struct lock_class_key __key;	\
+ 							\
+-		__init_rwsem((sem), #sem, &__key);	\
++		__init_anon_rwsem((sem), #sem, &__key);	\
+ 	} while (0)
+ 
+ /*
+  * lock for reading
+  */
+-static inline void __down_read(struct rw_semaphore *sem)
++static inline void __down_read(struct rw_anon_semaphore *sem)
+ {
+ 	if (unlikely(atomic_inc_return((atomic_t *)(&sem->count)) <= 0))
+ 		rwsem_down_read_failed(sem);
+ }
+ 
+-static inline int __down_read_trylock(struct rw_semaphore *sem)
++static inline int __down_read_trylock(struct rw_anon_semaphore *sem)
+ {
+ 	int tmp;
+ 
+@@ -90,7 +94,7 @@
+ /*
+  * lock for writing
+  */
+-static inline void __down_write_nested(struct rw_semaphore *sem, int subclass)
++static inline void __down_write_nested(struct rw_anon_semaphore *sem, int subclass)
+ {
+ 	int tmp;
+ 
+@@ -100,12 +104,12 @@
+ 		rwsem_down_write_failed(sem);
+ }
+ 
+-static inline void __down_write(struct rw_semaphore *sem)
++static inline void __down_write(struct rw_anon_semaphore *sem)
+ {
+ 	__down_write_nested(sem, 0);
+ }
+ 
+-static inline int __down_write_trylock(struct rw_semaphore *sem)
++static inline int __down_write_trylock(struct rw_anon_semaphore *sem)
+ {
+ 	int tmp;
+ 
+@@ -117,7 +121,7 @@
+ /*
+  * unlock after reading
+  */
+-static inline void __up_read(struct rw_semaphore *sem)
++static inline void __up_read(struct rw_anon_semaphore *sem)
+ {
+ 	int tmp;
+ 
+@@ -129,7 +133,7 @@
+ /*
+  * unlock after writing
+  */
+-static inline void __up_write(struct rw_semaphore *sem)
++static inline void __up_write(struct rw_anon_semaphore *sem)
+ {
+ 	if (unlikely(atomic_sub_return(RWSEM_ACTIVE_WRITE_BIAS,
+ 			      (atomic_t *)(&sem->count)) < 0))
+@@ -139,7 +143,7 @@
+ /*
+  * implement atomic add functionality
+  */
+-static inline void rwsem_atomic_add(int delta, struct rw_semaphore *sem)
++static inline void rwsem_atomic_add(int delta, struct rw_anon_semaphore *sem)
+ {
+ 	atomic_add(delta, (atomic_t *)(&sem->count));
+ }
+@@ -147,7 +151,7 @@
+ /*
+  * downgrade write lock to read lock
+  */
+-static inline void __downgrade_write(struct rw_semaphore *sem)
++static inline void __downgrade_write(struct rw_anon_semaphore *sem)
+ {
+ 	int tmp;
+ 
+@@ -159,15 +163,59 @@
+ /*
+  * implement exchange and add functionality
+  */
+-static inline int rwsem_atomic_update(int delta, struct rw_semaphore *sem)
++static inline int rwsem_atomic_update(int delta, struct rw_anon_semaphore *sem)
+ {
+ 	return atomic_add_return(delta, (atomic_t *)(&sem->count));
+ }
+ 
++static inline int anon_rwsem_is_locked(struct rw_anon_semaphore *sem)
++{
++	return (sem->count != 0);
++}
++
++#ifndef CONFIG_PREEMPT_RT
++
++struct rw_semaphore {
++	/* XXX this should be able to be an atomic_t  -- paulus */
++	signed int		count;
++	spinlock_t		wait_lock;
++	struct list_head	wait_list;
++#ifdef CONFIG_DEBUG_LOCK_ALLOC
++	struct lockdep_map	dep_map;
++#endif
++};
++
++#ifdef CONFIG_DEBUG_LOCK_ALLOC
++# define __RWSEM_DEP_MAP_INIT(lockname) , .dep_map = { .name = #lockname }
++#else
++# define __RWSEM_DEP_MAP_INIT(lockname)
++#endif
++
++#define __RWSEM_INITIALIZER(name) \
++	{ RWSEM_UNLOCKED_VALUE, __SPIN_LOCK_UNLOCKED((name).wait_lock), \
++	  LIST_HEAD_INIT((name).wait_list) __RWSEM_DEP_MAP_INIT(name) }
++
++#define DECLARE_RWSEM(name)		\
++	struct rw_semaphore name = __RWSEM_INITIALIZER(name)
++
++static inline void __init_rwsem(struct rw_semaphore *sem, const char *name,
++				struct lock_class_key *key)
++{
++	__init_anon_rwsem((struct rw_anon_semaphore *)sem, name, key);
++}
++
++#define init_rwsem(sem)					\
++	do {						\
++		static struct lock_class_key __key;	\
++							\
++		__init_rwsem((sem), #sem, &__key);	\
++	} while (0)
++
+ static inline int rwsem_is_locked(struct rw_semaphore *sem)
+ {
+ 	return (sem->count != 0);
+ }
++#endif
+ 
+ #endif	/* __KERNEL__ */
+ #endif	/* _ASM_POWERPC_RWSEM_H */
+Index: linux-rt-2.6.31/arch/powerpc/include/asm/tlb.h
+===================================================================
+--- linux-rt-2.6.31.orig/arch/powerpc/include/asm/tlb.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/powerpc/include/asm/tlb.h	2010-05-17 14:23:19.918385259 +0200
+@@ -30,26 +30,38 @@
+ #define tlb_start_vma(tlb, vma)	do { } while (0)
+ #define tlb_end_vma(tlb, vma)	do { } while (0)
+ 
++#define HAVE_ARCH_MMU_GATHER 1
++
++struct pte_freelist_batch;
++
++struct arch_mmu_gather {
++	struct pte_freelist_batch *batch;
++};
++
++#define ARCH_MMU_GATHER_INIT (struct arch_mmu_gather){ .batch = NULL, }
++
+ #if !defined(CONFIG_PPC_STD_MMU)
+ 
+ #define tlb_flush(tlb)			flush_tlb_mm((tlb)->mm)
+ 
+ #elif defined(__powerpc64__)
+ 
+-extern void pte_free_finish(void);
++extern void pte_free_finish(struct mmu_gather *tlb);
+ 
+ static inline void tlb_flush(struct mmu_gather *tlb)
+ {
+-	struct ppc64_tlb_batch *tlbbatch = &__get_cpu_var(ppc64_tlb_batch);
++	struct ppc64_tlb_batch *tlbbatch = &get_cpu_var(ppc64_tlb_batch);
+ 
+ 	/* If there's a TLB batch pending, then we must flush it because the
+ 	 * pages are going to be freed and we really don't want to have a CPU
+ 	 * access a freed page because it has a stale TLB
+ 	 */
+-	if (tlbbatch->index)
++	if (tlbbatch->index) {
+ 		__flush_tlb_pending(tlbbatch);
++	}
+ 
+-	pte_free_finish();
++	put_cpu_var(ppc64_tlb_batch);
++	pte_free_finish(tlb);
+ }
+ 
+ #else
+Index: linux-rt-2.6.31/arch/powerpc/include/asm/tlbflush.h
+===================================================================
+--- linux-rt-2.6.31.orig/arch/powerpc/include/asm/tlbflush.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/powerpc/include/asm/tlbflush.h	2010-05-17 14:23:19.918385259 +0200
+@@ -101,18 +101,25 @@
+ 
+ static inline void arch_enter_lazy_mmu_mode(void)
+ {
+-	struct ppc64_tlb_batch *batch = &__get_cpu_var(ppc64_tlb_batch);
++	struct ppc64_tlb_batch *batch = &get_cpu_var(ppc64_tlb_batch);
+ 
+ 	batch->active = 1;
++
++	put_cpu_var(ppc64_tlb_batch);
+ }
+ 
+ static inline void arch_leave_lazy_mmu_mode(void)
+ {
+-	struct ppc64_tlb_batch *batch = &__get_cpu_var(ppc64_tlb_batch);
++	struct ppc64_tlb_batch *batch = &get_cpu_var(ppc64_tlb_batch);
++
++	if (batch->active) {
++		if (batch->index) {
++			__flush_tlb_pending(batch);
++		}
++		batch->active = 0;
++	}
+ 
+-	if (batch->index)
+-		__flush_tlb_pending(batch);
+-	batch->active = 0;
++	put_cpu_var(ppc64_tlb_batch);
+ }
+ 
+ #define arch_flush_lazy_mmu_mode()      do {} while (0)
+Index: linux-rt-2.6.31/arch/powerpc/kernel/entry_64.S
+===================================================================
+--- linux-rt-2.6.31.orig/arch/powerpc/kernel/entry_64.S	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/powerpc/kernel/entry_64.S	2010-05-17 14:23:19.918385259 +0200
+@@ -625,44 +625,52 @@
+ 	bne	restore
+ 	/* here we are preempting the current task */
+ 1:
++	/*
++	 * preempt_schedule_irq() expects interrupts disabled and returns
++	 * with interrupts disabled. No need to check preemption again,
++	 * preempt_schedule_irq just did that for us.
++	 */
++	bl	.preempt_schedule_irq
+ #ifdef CONFIG_TRACE_IRQFLAGS
+ 	bl	.trace_hardirqs_on
++#endif /* CONFIG_TRACE_IRQFLAGS */
++
+ 	/* Note: we just clobbered r10 which used to contain the previous
+ 	 * MSR before the hard-disabling done by the caller of do_work.
+ 	 * We don't have that value anymore, but it doesn't matter as
+ 	 * we will hard-enable unconditionally, we can just reload the
+ 	 * current MSR into r10
+ 	 */
++	bl		.preempt_schedule_irq
+ 	mfmsr	r10
+-#endif /* CONFIG_TRACE_IRQFLAGS */
+-	li	r0,1
+-	stb	r0,PACASOFTIRQEN(r13)
+-	stb	r0,PACAHARDIRQEN(r13)
+-	ori	r10,r10,MSR_EE
+-	mtmsrd	r10,1		/* reenable interrupts */
+-	bl	.preempt_schedule
+-	mfmsr	r10
+-	clrrdi	r9,r1,THREAD_SHIFT
+-	rldicl	r10,r10,48,1	/* disable interrupts again */
+-	rotldi	r10,r10,16
+-	mtmsrd	r10,1
+-	ld	r4,TI_FLAGS(r9)
+-	andi.	r0,r4,_TIF_NEED_RESCHED
+-	bne	1b
++	clrrdi  r9,r1,THREAD_SHIFT
++	rldicl  r10,r10,48,1    /* disable interrupts again */
++	rotldi  r10,r10,16
++	mtmsrd  r10,1
++	ld      r4,TI_FLAGS(r9)
++	andi.   r0,r4,(_TIF_NEED_RESCHED)
++	bne     1b
+ 	b	restore
+ 
+ user_work:
+ #endif
+-	/* Enable interrupts */
+-	ori	r10,r10,MSR_EE
+-	mtmsrd	r10,1
+-
+ 	andi.	r0,r4,_TIF_NEED_RESCHED
+ 	beq	1f
+-	bl	.schedule
++
++	/* preempt_schedule_irq() expects interrupts disabled. */
++	bl	.preempt_schedule_irq
+ 	b	.ret_from_except_lite
+ 
+-1:	bl	.save_nvgprs
++	/* here we are preempting the current task */
++1:	li	r0,1
++	stb	r0,PACASOFTIRQEN(r13)
++	stb	r0,PACAHARDIRQEN(r13)
++
++	/* Enable interrupts */
++	ori	r10,r10,MSR_EE
++	mtmsrd	r10,1
++
++	bl	.save_nvgprs
+ 	addi	r3,r1,STACK_FRAME_OVERHEAD
+ 	bl	.do_signal
+ 	b	.ret_from_except
+Index: linux-rt-2.6.31/arch/powerpc/kernel/idle.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/powerpc/kernel/idle.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/powerpc/kernel/idle.c	2010-05-17 14:23:19.918385259 +0200
+@@ -96,9 +96,11 @@
+ 		tick_nohz_restart_sched_tick();
+ 		if (cpu_should_die())
+ 			cpu_die();
+-		preempt_enable_no_resched();
+-		schedule();
++		local_irq_disable();
++		__preempt_enable_no_resched();
++		__schedule();
+ 		preempt_disable();
++		local_irq_enable();
+ 	}
+ }
+ 
+Index: linux-rt-2.6.31/arch/powerpc/kernel/irq.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/powerpc/kernel/irq.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/powerpc/kernel/irq.c	2010-05-17 14:23:19.918385259 +0200
+@@ -191,7 +191,7 @@
+ 
+ 	if (i < NR_IRQS) {
+ 		desc = get_irq_desc(i);
+-		spin_lock_irqsave(&desc->lock, flags);
++		atomic_spin_lock_irqsave(&desc->lock, flags);
+ 		action = desc->action;
+ 		if (!action || !action->handler)
+ 			goto skip;
+@@ -212,7 +212,7 @@
+ 			seq_printf(p, ", %s", action->name);
+ 		seq_putc(p, '\n');
+ skip:
+-		spin_unlock_irqrestore(&desc->lock, flags);
++		atomic_spin_unlock_irqrestore(&desc->lock, flags);
+ 	} else if (i == NR_IRQS) {
+ #if defined(CONFIG_PPC32) && defined(CONFIG_TAU_INT)
+ 		if (tau_initialized){
+@@ -453,7 +453,7 @@
+  */
+ 
+ static LIST_HEAD(irq_hosts);
+-static DEFINE_SPINLOCK(irq_big_lock);
++static DEFINE_ATOMIC_SPINLOCK(irq_big_lock);
+ static unsigned int revmap_trees_allocated;
+ static DEFINE_MUTEX(revmap_trees_mutex);
+ struct irq_map_entry irq_map[NR_IRQS];
+@@ -499,14 +499,14 @@
+ 	if (host->ops->match == NULL)
+ 		host->ops->match = default_irq_host_match;
+ 
+-	spin_lock_irqsave(&irq_big_lock, flags);
++	atomic_spin_lock_irqsave(&irq_big_lock, flags);
+ 
+ 	/* If it's a legacy controller, check for duplicates and
+ 	 * mark it as allocated (we use irq 0 host pointer for that
+ 	 */
+ 	if (revmap_type == IRQ_HOST_MAP_LEGACY) {
+ 		if (irq_map[0].host != NULL) {
+-			spin_unlock_irqrestore(&irq_big_lock, flags);
++			atomic_spin_unlock_irqrestore(&irq_big_lock, flags);
+ 			/* If we are early boot, we can't free the structure,
+ 			 * too bad...
+ 			 * this will be fixed once slab is made available early
+@@ -520,7 +520,7 @@
+ 	}
+ 
+ 	list_add(&host->link, &irq_hosts);
+-	spin_unlock_irqrestore(&irq_big_lock, flags);
++	atomic_spin_unlock_irqrestore(&irq_big_lock, flags);
+ 
+ 	/* Additional setups per revmap type */
+ 	switch(revmap_type) {
+@@ -571,13 +571,13 @@
+ 	 * the absence of a device node. This isn't a problem so far
+ 	 * yet though...
+ 	 */
+-	spin_lock_irqsave(&irq_big_lock, flags);
++	atomic_spin_lock_irqsave(&irq_big_lock, flags);
+ 	list_for_each_entry(h, &irq_hosts, link)
+ 		if (h->ops->match(h, node)) {
+ 			found = h;
+ 			break;
+ 		}
+-	spin_unlock_irqrestore(&irq_big_lock, flags);
++	atomic_spin_unlock_irqrestore(&irq_big_lock, flags);
+ 	return found;
+ }
+ EXPORT_SYMBOL_GPL(irq_find_host);
+@@ -935,7 +935,7 @@
+ 	if (count == 0 || count > (irq_virq_count - NUM_ISA_INTERRUPTS))
+ 		return NO_IRQ;
+ 
+-	spin_lock_irqsave(&irq_big_lock, flags);
++	atomic_spin_lock_irqsave(&irq_big_lock, flags);
+ 
+ 	/* Use hint for 1 interrupt if any */
+ 	if (count == 1 && hint >= NUM_ISA_INTERRUPTS &&
+@@ -959,7 +959,7 @@
+ 		}
+ 	}
+ 	if (found == NO_IRQ) {
+-		spin_unlock_irqrestore(&irq_big_lock, flags);
++		atomic_spin_unlock_irqrestore(&irq_big_lock, flags);
+ 		return NO_IRQ;
+ 	}
+  hint_found:
+@@ -968,7 +968,7 @@
+ 		smp_wmb();
+ 		irq_map[i].host = host;
+ 	}
+-	spin_unlock_irqrestore(&irq_big_lock, flags);
++	atomic_spin_unlock_irqrestore(&irq_big_lock, flags);
+ 	return found;
+ }
+ 
+@@ -980,7 +980,7 @@
+ 	WARN_ON (virq < NUM_ISA_INTERRUPTS);
+ 	WARN_ON (count == 0 || (virq + count) > irq_virq_count);
+ 
+-	spin_lock_irqsave(&irq_big_lock, flags);
++	atomic_spin_lock_irqsave(&irq_big_lock, flags);
+ 	for (i = virq; i < (virq + count); i++) {
+ 		struct irq_host *host;
+ 
+@@ -993,7 +993,7 @@
+ 		smp_wmb();
+ 		irq_map[i].host = NULL;
+ 	}
+-	spin_unlock_irqrestore(&irq_big_lock, flags);
++	atomic_spin_unlock_irqrestore(&irq_big_lock, flags);
+ }
+ 
+ void irq_early_init(void)
+@@ -1065,7 +1065,7 @@
+ 
+ 	for (i = 1; i < NR_IRQS; i++) {
+ 		desc = get_irq_desc(i);
+-		spin_lock_irqsave(&desc->lock, flags);
++		atomic_spin_lock_irqsave(&desc->lock, flags);
+ 
+ 		if (desc->action && desc->action->handler) {
+ 			seq_printf(m, "%5d  ", i);
+@@ -1084,7 +1084,7 @@
+ 			seq_printf(m, "%s\n", p);
+ 		}
+ 
+-		spin_unlock_irqrestore(&desc->lock, flags);
++		atomic_spin_unlock_irqrestore(&desc->lock, flags);
+ 	}
+ 
+ 	return 0;
+Index: linux-rt-2.6.31/arch/powerpc/kernel/kprobes.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/powerpc/kernel/kprobes.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/powerpc/kernel/kprobes.c	2010-05-17 14:23:19.918385259 +0200
+@@ -263,7 +263,7 @@
+ 
+ 			kcb->kprobe_status = KPROBE_HIT_SSDONE;
+ 			reset_current_kprobe();
+-			preempt_enable_no_resched();
++			preempt_enable();
+ 			return 1;
+ 		} else if (ret < 0) {
+ 			/*
+@@ -282,7 +282,7 @@
+ 	return 1;
+ 
+ no_kprobe:
+-	preempt_enable_no_resched();
++	preempt_enable();
+ 	return ret;
+ }
+ 
+@@ -412,7 +412,7 @@
+ 	}
+ 	reset_current_kprobe();
+ out:
+-	preempt_enable_no_resched();
++	preempt_enable();
+ 
+ 	/*
+ 	 * if somebody else is singlestepping across a probe point, msr
+Index: linux-rt-2.6.31/arch/powerpc/kernel/pmc.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/powerpc/kernel/pmc.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/powerpc/kernel/pmc.c	2010-05-17 14:23:19.918385259 +0200
+@@ -37,7 +37,7 @@
+ }
+ 
+ 
+-static DEFINE_SPINLOCK(pmc_owner_lock);
++static DEFINE_ATOMIC_SPINLOCK(pmc_owner_lock);
+ static void *pmc_owner_caller; /* mostly for debugging */
+ perf_irq_t perf_irq = dummy_perf;
+ 
+@@ -45,7 +45,7 @@
+ {
+ 	int err = 0;
+ 
+-	spin_lock(&pmc_owner_lock);
++	atomic_spin_lock(&pmc_owner_lock);
+ 
+ 	if (pmc_owner_caller) {
+ 		printk(KERN_WARNING "reserve_pmc_hardware: "
+@@ -59,21 +59,21 @@
+ 	perf_irq = new_perf_irq ? new_perf_irq : dummy_perf;
+ 
+  out:
+-	spin_unlock(&pmc_owner_lock);
++	atomic_spin_unlock(&pmc_owner_lock);
+ 	return err;
+ }
+ EXPORT_SYMBOL_GPL(reserve_pmc_hardware);
+ 
+ void release_pmc_hardware(void)
+ {
+-	spin_lock(&pmc_owner_lock);
++	atomic_spin_lock(&pmc_owner_lock);
+ 
+ 	WARN_ON(! pmc_owner_caller);
+ 
+ 	pmc_owner_caller = NULL;
+ 	perf_irq = dummy_perf;
+ 
+-	spin_unlock(&pmc_owner_lock);
++	atomic_spin_unlock(&pmc_owner_lock);
+ }
+ EXPORT_SYMBOL_GPL(release_pmc_hardware);
+ 
+Index: linux-rt-2.6.31/arch/powerpc/kernel/process.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/powerpc/kernel/process.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/arch/powerpc/kernel/process.c	2010-05-17 14:23:19.918385259 +0200
+@@ -305,6 +305,10 @@
+ 	struct thread_struct *new_thread, *old_thread;
+ 	unsigned long flags;
+ 	struct task_struct *last;
++#if defined(CONFIG_PPC64) && defined (CONFIG_PREEMPT_RT)
++	struct ppc64_tlb_batch *batch;
++	int hadbatch;
++#endif
+ 
+ #ifdef CONFIG_SMP
+ 	/* avoid complexity of lazy save/restore of fpu
+@@ -396,6 +400,17 @@
+ 		old_thread->accum_tb += (current_tb - start_tb);
+ 		new_thread->start_tb = current_tb;
+ 	}
++
++#ifdef CONFIG_PREEMPT_RT
++	batch = &__get_cpu_var(ppc64_tlb_batch);
++	if (batch->active) {
++		hadbatch = 1;
++		if (batch->index) {
++			__flush_tlb_pending(batch);
++		}
++		batch->active = 0;
++	}
++#endif /* #ifdef CONFIG_PREEMPT_RT */
+ #endif
+ 
+ 	local_irq_save(flags);
+@@ -414,6 +429,13 @@
+ 
+ 	local_irq_restore(flags);
+ 
++#if defined(CONFIG_PPC64) && defined(CONFIG_PREEMPT_RT)
++	if (hadbatch) {
++		batch = &__get_cpu_var(ppc64_tlb_batch);
++		batch->active = 1;
++	}
++#endif
++
+ 	return last;
+ }
+ 
+Index: linux-rt-2.6.31/arch/powerpc/kernel/prom.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/powerpc/kernel/prom.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/powerpc/kernel/prom.c	2010-05-17 14:23:19.918385259 +0200
+@@ -81,7 +81,7 @@
+ 
+ extern struct device_node *allnodes;	/* temporary while merging */
+ 
+-extern rwlock_t devtree_lock;	/* temporary while merging */
++extern atomic_spinlock_t devtree_lock;	/* temporary while merging */
+ 
+ /* export that to outside world */
+ struct device_node *of_chosen;
+@@ -1275,12 +1275,12 @@
+ {
+ 	struct device_node *np;
+ 
+-	read_lock(&devtree_lock);
++	atomic_spin_lock(&devtree_lock);
+ 	for (np = allnodes; np != 0; np = np->allnext)
+ 		if (np->linux_phandle == handle)
+ 			break;
+ 	of_node_get(np);
+-	read_unlock(&devtree_lock);
++	atomic_spin_unlock(&devtree_lock);
+ 	return np;
+ }
+ EXPORT_SYMBOL(of_find_node_by_phandle);
+@@ -1328,13 +1328,13 @@
+ {
+ 	struct device_node *np;
+ 
+-	read_lock(&devtree_lock);
++	atomic_spin_lock(&devtree_lock);
+ 	np = prev ? prev->allnext : allnodes;
+ 	for (; np != 0; np = np->allnext)
+ 		if (of_node_get(np))
+ 			break;
+ 	of_node_put(prev);
+-	read_unlock(&devtree_lock);
++	atomic_spin_unlock(&devtree_lock);
+ 	return np;
+ }
+ EXPORT_SYMBOL(of_find_all_nodes);
+@@ -1419,12 +1419,12 @@
+ {
+ 	unsigned long flags;
+ 
+-	write_lock_irqsave(&devtree_lock, flags);
++	atomic_spin_lock_irqsave(&devtree_lock, flags);
+ 	np->sibling = np->parent->child;
+ 	np->allnext = allnodes;
+ 	np->parent->child = np;
+ 	allnodes = np;
+-	write_unlock_irqrestore(&devtree_lock, flags);
++	atomic_spin_unlock_irqrestore(&devtree_lock, flags);
+ }
+ 
+ /*
+@@ -1437,7 +1437,7 @@
+ 	struct device_node *parent;
+ 	unsigned long flags;
+ 
+-	write_lock_irqsave(&devtree_lock, flags);
++	atomic_spin_lock_irqsave(&devtree_lock, flags);
+ 
+ 	parent = np->parent;
+ 	if (!parent)
+@@ -1468,7 +1468,7 @@
+ 	of_node_set_flag(np, OF_DETACHED);
+ 
+ out_unlock:
+-	write_unlock_irqrestore(&devtree_lock, flags);
++	atomic_spin_unlock_irqrestore(&devtree_lock, flags);
+ }
+ 
+ #ifdef CONFIG_PPC_PSERIES
+@@ -1552,18 +1552,18 @@
+ 	unsigned long flags;
+ 
+ 	prop->next = NULL;	
+-	write_lock_irqsave(&devtree_lock, flags);
++	atomic_spin_lock_irqsave(&devtree_lock, flags);
+ 	next = &np->properties;
+ 	while (*next) {
+ 		if (strcmp(prop->name, (*next)->name) == 0) {
+ 			/* duplicate ! don't insert it */
+-			write_unlock_irqrestore(&devtree_lock, flags);
++			atomic_spin_unlock_irqrestore(&devtree_lock, flags);
+ 			return -1;
+ 		}
+ 		next = &(*next)->next;
+ 	}
+ 	*next = prop;
+-	write_unlock_irqrestore(&devtree_lock, flags);
++	atomic_spin_unlock_irqrestore(&devtree_lock, flags);
+ 
+ #ifdef CONFIG_PROC_DEVICETREE
+ 	/* try to add to proc as well if it was initialized */
+@@ -1586,7 +1586,7 @@
+ 	unsigned long flags;
+ 	int found = 0;
+ 
+-	write_lock_irqsave(&devtree_lock, flags);
++	atomic_spin_lock_irqsave(&devtree_lock, flags);
+ 	next = &np->properties;
+ 	while (*next) {
+ 		if (*next == prop) {
+@@ -1599,7 +1599,7 @@
+ 		}
+ 		next = &(*next)->next;
+ 	}
+-	write_unlock_irqrestore(&devtree_lock, flags);
++	atomic_spin_unlock_irqrestore(&devtree_lock, flags);
+ 
+ 	if (!found)
+ 		return -ENODEV;
+@@ -1628,7 +1628,7 @@
+ 	unsigned long flags;
+ 	int found = 0;
+ 
+-	write_lock_irqsave(&devtree_lock, flags);
++	atomic_spin_lock_irqsave(&devtree_lock, flags);
+ 	next = &np->properties;
+ 	while (*next) {
+ 		if (*next == oldprop) {
+@@ -1642,7 +1642,7 @@
+ 		}
+ 		next = &(*next)->next;
+ 	}
+-	write_unlock_irqrestore(&devtree_lock, flags);
++	atomic_spin_unlock_irqrestore(&devtree_lock, flags);
+ 
+ 	if (!found)
+ 		return -ENODEV;
+Index: linux-rt-2.6.31/arch/powerpc/kernel/time.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/powerpc/kernel/time.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/powerpc/kernel/time.c	2010-05-17 14:23:19.918385259 +0200
+@@ -1000,7 +1000,7 @@
+ 	/* Save the current timebase to pretty up CONFIG_PRINTK_TIME */
+ 	boot_tb = get_tb_or_rtc();
+ 
+-	write_seqlock_irqsave(&xtime_lock, flags);
++	write_atomic_seqlock_irqsave(&xtime_lock, flags);
+ 
+ 	/* If platform provided a timezone (pmac), we correct the time */
+         if (timezone_offset) {
+@@ -1014,7 +1014,7 @@
+ 	vdso_data->stamp_xsec = (u64) xtime.tv_sec * XSEC_PER_SEC;
+ 	vdso_data->tb_to_xs = tb_to_xs;
+ 
+-	write_sequnlock_irqrestore(&xtime_lock, flags);
++	write_atomic_sequnlock_irqrestore(&xtime_lock, flags);
+ 
+ 	/* Register the clocksource, if we're not running on iSeries */
+ 	if (!firmware_has_feature(FW_FEATURE_ISERIES))
+Index: linux-rt-2.6.31/arch/powerpc/kernel/traps.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/powerpc/kernel/traps.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/powerpc/kernel/traps.c	2010-05-17 14:23:19.918385259 +0200
+@@ -102,11 +102,11 @@
+ int die(const char *str, struct pt_regs *regs, long err)
+ {
+ 	static struct {
+-		spinlock_t lock;
++		atomic_spinlock_t lock;
+ 		u32 lock_owner;
+ 		int lock_owner_depth;
+ 	} die = {
+-		.lock =			__SPIN_LOCK_UNLOCKED(die.lock),
++		.lock =			__ATOMIC_SPIN_LOCK_UNLOCKED(die.lock),
+ 		.lock_owner =		-1,
+ 		.lock_owner_depth =	0
+ 	};
+@@ -120,7 +120,7 @@
+ 
+ 	if (die.lock_owner != raw_smp_processor_id()) {
+ 		console_verbose();
+-		spin_lock_irqsave(&die.lock, flags);
++		atomic_spin_lock_irqsave(&die.lock, flags);
+ 		die.lock_owner = smp_processor_id();
+ 		die.lock_owner_depth = 0;
+ 		bust_spinlocks(1);
+@@ -155,7 +155,7 @@
+ 	bust_spinlocks(0);
+ 	die.lock_owner = -1;
+ 	add_taint(TAINT_DIE);
+-	spin_unlock_irqrestore(&die.lock, flags);
++	atomic_spin_unlock_irqrestore(&die.lock, flags);
+ 
+ 	if (kexec_should_crash(current) ||
+ 		kexec_sr_activated(smp_processor_id()))
+@@ -193,6 +193,11 @@
+ 				addr, regs->nip, regs->link, code);
+ 		}
+ 
++#ifdef CONFIG_PREEMPT_RT
++	local_irq_enable();
++	preempt_check_resched();
++#endif
++
+ 	memset(&info, 0, sizeof(info));
+ 	info.si_signo = signr;
+ 	info.si_code = code;
+Index: linux-rt-2.6.31/arch/powerpc/lib/locks.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/powerpc/lib/locks.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/powerpc/lib/locks.c	2010-05-17 14:23:19.918385259 +0200
+@@ -86,8 +86,10 @@
+ {
+ 	while (lock->slock) {
+ 		HMT_low();
++		preempt_disable();
+ 		if (SHARED_PROCESSOR)
+ 			__spin_yield(lock);
++		preempt_enable();
+ 	}
+ 	HMT_medium();
+ }
+Index: linux-rt-2.6.31/arch/powerpc/mm/fault.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/powerpc/mm/fault.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/powerpc/mm/fault.c	2010-05-17 14:23:19.918385259 +0200
+@@ -159,7 +159,7 @@
+ 	}
+ #endif /* !(CONFIG_4xx || CONFIG_BOOKE)*/
+ 
+-	if (in_atomic() || mm == NULL) {
++	if (in_atomic() || mm == NULL || current->pagefault_disabled) {
+ 		if (!user_mode(regs))
+ 			return SIGSEGV;
+ 		/* in_atomic() in user mode is really bad,
+Index: linux-rt-2.6.31/arch/powerpc/mm/hash_native_64.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/powerpc/mm/hash_native_64.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/powerpc/mm/hash_native_64.c	2010-05-17 14:23:19.918385259 +0200
+@@ -37,7 +37,7 @@
+ 
+ #define HPTE_LOCK_BIT 3
+ 
+-static DEFINE_SPINLOCK(native_tlbie_lock);
++static DEFINE_ATOMIC_SPINLOCK(native_tlbie_lock);
+ 
+ static inline void __tlbie(unsigned long va, int psize, int ssize)
+ {
+@@ -104,7 +104,7 @@
+ 	if (use_local)
+ 		use_local = mmu_psize_defs[psize].tlbiel;
+ 	if (lock_tlbie && !use_local)
+-		spin_lock(&native_tlbie_lock);
++		atomic_spin_lock(&native_tlbie_lock);
+ 	asm volatile("ptesync": : :"memory");
+ 	if (use_local) {
+ 		__tlbiel(va, psize, ssize);
+@@ -114,7 +114,7 @@
+ 		asm volatile("eieio; tlbsync; ptesync": : :"memory");
+ 	}
+ 	if (lock_tlbie && !use_local)
+-		spin_unlock(&native_tlbie_lock);
++		atomic_spin_unlock(&native_tlbie_lock);
+ }
+ 
+ static inline void native_lock_hpte(struct hash_pte *hptep)
+@@ -434,7 +434,7 @@
+ 	/* we take the tlbie lock and hold it.  Some hardware will
+ 	 * deadlock if we try to tlbie from two processors at once.
+ 	 */
+-	spin_lock(&native_tlbie_lock);
++	atomic_spin_lock(&native_tlbie_lock);
+ 
+ 	slots = pteg_count * HPTES_PER_GROUP;
+ 
+@@ -458,7 +458,7 @@
+ 	}
+ 
+ 	asm volatile("eieio; tlbsync; ptesync":::"memory");
+-	spin_unlock(&native_tlbie_lock);
++	atomic_spin_unlock(&native_tlbie_lock);
+ 	local_irq_restore(flags);
+ }
+ 
+@@ -521,7 +521,7 @@
+ 		int lock_tlbie = !cpu_has_feature(CPU_FTR_LOCKLESS_TLBIE);
+ 
+ 		if (lock_tlbie)
+-			spin_lock(&native_tlbie_lock);
++			atomic_spin_lock(&native_tlbie_lock);
+ 
+ 		asm volatile("ptesync":::"memory");
+ 		for (i = 0; i < number; i++) {
+@@ -536,7 +536,7 @@
+ 		asm volatile("eieio; tlbsync; ptesync":::"memory");
+ 
+ 		if (lock_tlbie)
+-			spin_unlock(&native_tlbie_lock);
++			atomic_spin_unlock(&native_tlbie_lock);
+ 	}
+ 
+ 	local_irq_restore(flags);
+Index: linux-rt-2.6.31/arch/powerpc/mm/highmem.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/powerpc/mm/highmem.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/powerpc/mm/highmem.c	2010-05-17 14:23:19.918385259 +0200
+@@ -35,6 +35,7 @@
+ 	unsigned long vaddr;
+ 
+ 	/* even !CONFIG_PREEMPT needs this, for in_atomic in do_page_fault */
++	preempt_disable();
+ 	pagefault_disable();
+ 	if (!PageHighMem(page))
+ 		return page_address(page);
+@@ -73,5 +74,6 @@
+ 	local_flush_tlb_page(NULL, vaddr);
+ #endif
+ 	pagefault_enable();
++	preempt_enable();
+ }
+ EXPORT_SYMBOL(kunmap_atomic);
+Index: linux-rt-2.6.31/arch/powerpc/mm/init_32.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/powerpc/mm/init_32.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/powerpc/mm/init_32.c	2010-05-17 14:23:19.918385259 +0200
+@@ -54,8 +54,6 @@
+ #endif
+ #define MAX_LOW_MEM	CONFIG_LOWMEM_SIZE
+ 
+-DEFINE_PER_CPU(struct mmu_gather, mmu_gathers);
+-
+ phys_addr_t total_memory;
+ phys_addr_t total_lowmem;
+ 
+Index: linux-rt-2.6.31/arch/powerpc/mm/mmu_context_nohash.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/powerpc/mm/mmu_context_nohash.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/powerpc/mm/mmu_context_nohash.c	2010-05-17 14:23:19.918385259 +0200
+@@ -46,7 +46,7 @@
+ static unsigned long *context_map;
+ static unsigned long *stale_map[NR_CPUS];
+ static struct mm_struct **context_mm;
+-static DEFINE_SPINLOCK(context_lock);
++static DEFINE_ATOMIC_SPINLOCK(context_lock);
+ 
+ #define CTX_MAP_SIZE	\
+ 	(sizeof(unsigned long) * (last_context / BITS_PER_LONG + 1))
+@@ -104,9 +104,9 @@
+ 	/* This will happen if you have more CPUs than available contexts,
+ 	 * all we can do here is wait a bit and try again
+ 	 */
+-	spin_unlock(&context_lock);
++	atomic_spin_unlock(&context_lock);
+ 	cpu_relax();
+-	spin_lock(&context_lock);
++	atomic_spin_lock(&context_lock);
+ 
+ 	/* This will cause the caller to try again */
+ 	return MMU_NO_CONTEXT;
+@@ -177,7 +177,7 @@
+ 	unsigned long *map;
+ 
+ 	/* No lockless fast path .. yet */
+-	spin_lock(&context_lock);
++	atomic_spin_lock(&context_lock);
+ 
+ #ifndef DEBUG_STEAL_ONLY
+ 	pr_devel("[%d] activating context for mm @%p, active=%d, id=%d\n",
+@@ -258,7 +258,7 @@
+ 
+ 	/* Flick the MMU and release lock */
+ 	set_context(id, next->pgd);
+-	spin_unlock(&context_lock);
++	atomic_spin_unlock(&context_lock);
+ }
+ 
+ /*
+@@ -285,7 +285,7 @@
+ 
+ 	WARN_ON(mm->context.active != 0);
+ 
+-	spin_lock_irqsave(&context_lock, flags);
++	atomic_spin_lock_irqsave(&context_lock, flags);
+ 	id = mm->context.id;
+ 	if (id != MMU_NO_CONTEXT) {
+ 		__clear_bit(id, context_map);
+@@ -296,7 +296,7 @@
+ 		context_mm[id] = NULL;
+ 		nr_free_contexts++;
+ 	}
+-	spin_unlock_irqrestore(&context_lock, flags);
++	atomic_spin_unlock_irqrestore(&context_lock, flags);
+ }
+ 
+ #ifdef CONFIG_SMP
+Index: linux-rt-2.6.31/arch/powerpc/mm/pgtable.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/powerpc/mm/pgtable.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/arch/powerpc/mm/pgtable.c	2010-05-17 14:23:19.918385259 +0200
+@@ -32,7 +32,6 @@
+ 
+ #include "mmu_decl.h"
+ 
+-static DEFINE_PER_CPU(struct pte_freelist_batch *, pte_freelist_cur);
+ static unsigned long pte_freelist_forced_free;
+ 
+ struct pte_freelist_batch
+@@ -83,11 +82,11 @@
+ 
+ void pgtable_free_tlb(struct mmu_gather *tlb, pgtable_free_t pgf)
+ {
+-	/* This is safe since tlb_gather_mmu has disabled preemption */
+-	struct pte_freelist_batch **batchp = &__get_cpu_var(pte_freelist_cur);
++	struct pte_freelist_batch **batchp;
+ 
+-	if (atomic_read(&tlb->mm->mm_users) < 2 ||
+-	    cpumask_equal(mm_cpumask(tlb->mm), cpumask_of(smp_processor_id()))){
++	batchp = &tlb->arch.batch;
++
++	if (atomic_read(&tlb->mm->mm_users) < 2) {
+ 		pgtable_free(pgf);
+ 		return;
+ 	}
+@@ -107,15 +106,16 @@
+ 	}
+ }
+ 
+-void pte_free_finish(void)
++void pte_free_finish(struct mmu_gather *tlb)
+ {
+-	/* This is safe since tlb_gather_mmu has disabled preemption */
+-	struct pte_freelist_batch **batchp = &__get_cpu_var(pte_freelist_cur);
++	struct pte_freelist_batch **batchp;
+ 
+-	if (*batchp == NULL)
+-		return;
+-	pte_free_submit(*batchp);
+-	*batchp = NULL;
++	batchp = &tlb->arch.batch;
++
++	if (*batchp) {
++		pte_free_submit(*batchp);
++		*batchp = NULL;
++	}
+ }
+ 
+ /*
+Index: linux-rt-2.6.31/arch/powerpc/mm/tlb_hash64.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/powerpc/mm/tlb_hash64.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/powerpc/mm/tlb_hash64.c	2010-05-17 14:23:19.918385259 +0200
+@@ -30,14 +30,10 @@
+ #include <asm/tlbflush.h>
+ #include <asm/tlb.h>
+ #include <asm/bug.h>
++#include <asm/machdep.h>
+ 
+ DEFINE_PER_CPU(struct ppc64_tlb_batch, ppc64_tlb_batch);
+ 
+-/* This is declared as we are using the more or less generic
+- * arch/powerpc/include/asm/tlb.h file -- tgall
+- */
+-DEFINE_PER_CPU(struct mmu_gather, mmu_gathers);
+-
+ /*
+  * A linux PTE was changed and the corresponding hash table entry
+  * neesd to be flushed. This function will either perform the flush
+@@ -49,7 +45,7 @@
+ void hpte_need_flush(struct mm_struct *mm, unsigned long addr,
+ 		     pte_t *ptep, unsigned long pte, int huge)
+ {
+-	struct ppc64_tlb_batch *batch = &__get_cpu_var(ppc64_tlb_batch);
++	struct ppc64_tlb_batch *batch = &get_cpu_var(ppc64_tlb_batch);
+ 	unsigned long vsid, vaddr;
+ 	unsigned int psize;
+ 	int ssize;
+@@ -100,6 +96,7 @@
+ 	 */
+ 	if (!batch->active) {
+ 		flush_hash_page(vaddr, rpte, psize, ssize, 0);
++		put_cpu_var(ppc64_tlb_batch);
+ 		return;
+ 	}
+ 
+@@ -126,8 +123,22 @@
+ 	batch->pte[i] = rpte;
+ 	batch->vaddr[i] = vaddr;
+ 	batch->index = ++i;
++
++#ifdef CONFIG_PREEMPT_RT
++	/*
++	 * Since flushing tlb needs expensive hypervisor call(s) on celleb,
++	 * always flush it on RT to reduce scheduling latency.
++	 */
++	if (machine_is(celleb)) {
++		__flush_tlb_pending(batch);
++		put_cpu_var(ppc64_tlb_batch);
++		return;
++	}
++#endif /* CONFIG_PREEMPT_RT */
++
+ 	if (i >= PPC64_TLB_BATCH_NR)
+ 		__flush_tlb_pending(batch);
++	put_cpu_var(ppc64_tlb_batch);
+ }
+ 
+ /*
+Index: linux-rt-2.6.31/arch/powerpc/mm/tlb_nohash.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/powerpc/mm/tlb_nohash.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/powerpc/mm/tlb_nohash.c	2010-05-17 14:23:19.918385259 +0200
+@@ -85,7 +85,7 @@
+  */
+ #ifdef CONFIG_SMP
+ 
+-static DEFINE_SPINLOCK(tlbivax_lock);
++static DEFINE_ATOMIC_SPINLOCK(tlbivax_lock);
+ 
+ struct tlb_flush_param {
+ 	unsigned long addr;
+@@ -158,10 +158,10 @@
+ 		if (mmu_has_feature(MMU_FTR_USE_TLBIVAX_BCAST)) {
+ 			int lock = mmu_has_feature(MMU_FTR_LOCK_BCAST_INVAL);
+ 			if (lock)
+-				spin_lock(&tlbivax_lock);
++				atomic_spin_lock(&tlbivax_lock);
+ 			_tlbivax_bcast(vmaddr, pid);
+ 			if (lock)
+-				spin_unlock(&tlbivax_lock);
++				atomic_spin_unlock(&tlbivax_lock);
+ 			goto bail;
+ 		} else {
+ 			struct tlb_flush_param p = { .pid = pid, .addr = vmaddr };
+@@ -189,7 +189,9 @@
+ 	_tlbil_pid(0);
+ 	preempt_enable();
+ #else
++	preempt_disable();
+ 	_tlbil_pid(0);
++	preempt_enable();
+ #endif
+ }
+ EXPORT_SYMBOL(flush_tlb_kernel_range);
+Index: linux-rt-2.6.31/arch/powerpc/platforms/52xx/media5200.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/powerpc/platforms/52xx/media5200.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/powerpc/platforms/52xx/media5200.c	2010-05-17 14:23:19.918385259 +0200
+@@ -86,9 +86,9 @@
+ 	u32 status, enable;
+ 
+ 	/* Mask off the cascaded IRQ */
+-	spin_lock(&desc->lock);
++	atomic_spin_lock(&desc->lock);
+ 	desc->chip->mask(virq);
+-	spin_unlock(&desc->lock);
++	atomic_spin_unlock(&desc->lock);
+ 
+ 	/* Ask the FPGA for IRQ status.  If 'val' is 0, then no irqs
+ 	 * are pending.  'ffs()' is 1 based */
+@@ -104,11 +104,11 @@
+ 	}
+ 
+ 	/* Processing done; can reenable the cascade now */
+-	spin_lock(&desc->lock);
++	atomic_spin_lock(&desc->lock);
+ 	desc->chip->ack(virq);
+ 	if (!(desc->status & IRQ_DISABLED))
+ 		desc->chip->unmask(virq);
+-	spin_unlock(&desc->lock);
++	atomic_spin_unlock(&desc->lock);
+ }
+ 
+ static int media5200_irq_map(struct irq_host *h, unsigned int virq,
+Index: linux-rt-2.6.31/arch/powerpc/platforms/cell/beat_htab.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/powerpc/platforms/cell/beat_htab.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/powerpc/platforms/cell/beat_htab.c	2010-05-17 14:23:19.918385259 +0200
+@@ -40,7 +40,7 @@
+ #define DBG_LOW(fmt...) do { } while (0)
+ #endif
+ 
+-static DEFINE_SPINLOCK(beat_htab_lock);
++static DEFINE_ATOMIC_SPINLOCK(beat_htab_lock);
+ 
+ static inline unsigned int beat_read_mask(unsigned hpte_group)
+ {
+@@ -114,18 +114,18 @@
+ 	if (rflags & _PAGE_NO_CACHE)
+ 		hpte_r &= ~_PAGE_COHERENT;
+ 
+-	spin_lock(&beat_htab_lock);
++	atomic_spin_lock(&beat_htab_lock);
+ 	lpar_rc = beat_read_mask(hpte_group);
+ 	if (lpar_rc == 0) {
+ 		if (!(vflags & HPTE_V_BOLTED))
+ 			DBG_LOW(" full\n");
+-		spin_unlock(&beat_htab_lock);
++		atomic_spin_unlock(&beat_htab_lock);
+ 		return -1;
+ 	}
+ 
+ 	lpar_rc = beat_insert_htab_entry(0, hpte_group, lpar_rc << 48,
+ 		hpte_v, hpte_r, &slot);
+-	spin_unlock(&beat_htab_lock);
++	atomic_spin_unlock(&beat_htab_lock);
+ 
+ 	/*
+ 	 * Since we try and ioremap PHBs we don't own, the pte insert
+@@ -198,17 +198,17 @@
+ 		"avpnv=%016lx, slot=%016lx, psize: %d, newpp %016lx ... ",
+ 		want_v & HPTE_V_AVPN, slot, psize, newpp);
+ 
+-	spin_lock(&beat_htab_lock);
++	atomic_spin_lock(&beat_htab_lock);
+ 	dummy0 = beat_lpar_hpte_getword0(slot);
+ 	if ((dummy0 & ~0x7FUL) != (want_v & ~0x7FUL)) {
+ 		DBG_LOW("not found !\n");
+-		spin_unlock(&beat_htab_lock);
++		atomic_spin_unlock(&beat_htab_lock);
+ 		return -1;
+ 	}
+ 
+ 	lpar_rc = beat_write_htab_entry(0, slot, 0, newpp, 0, 7, &dummy0,
+ 					&dummy1);
+-	spin_unlock(&beat_htab_lock);
++	atomic_spin_unlock(&beat_htab_lock);
+ 	if (lpar_rc != 0 || dummy0 == 0) {
+ 		DBG_LOW("not found !\n");
+ 		return -1;
+@@ -262,13 +262,13 @@
+ 	vsid = get_kernel_vsid(ea, MMU_SEGSIZE_256M);
+ 	va = (vsid << 28) | (ea & 0x0fffffff);
+ 
+-	spin_lock(&beat_htab_lock);
++	atomic_spin_lock(&beat_htab_lock);
+ 	slot = beat_lpar_hpte_find(va, psize);
+ 	BUG_ON(slot == -1);
+ 
+ 	lpar_rc = beat_write_htab_entry(0, slot, 0, newpp, 0, 7,
+ 		&dummy0, &dummy1);
+-	spin_unlock(&beat_htab_lock);
++	atomic_spin_unlock(&beat_htab_lock);
+ 
+ 	BUG_ON(lpar_rc != 0);
+ }
+@@ -285,18 +285,18 @@
+ 		slot, va, psize, local);
+ 	want_v = hpte_encode_v(va, psize, MMU_SEGSIZE_256M);
+ 
+-	spin_lock_irqsave(&beat_htab_lock, flags);
++	atomic_spin_lock_irqsave(&beat_htab_lock, flags);
+ 	dummy1 = beat_lpar_hpte_getword0(slot);
+ 
+ 	if ((dummy1 & ~0x7FUL) != (want_v & ~0x7FUL)) {
+ 		DBG_LOW("not found !\n");
+-		spin_unlock_irqrestore(&beat_htab_lock, flags);
++		atomic_spin_unlock_irqrestore(&beat_htab_lock, flags);
+ 		return;
+ 	}
+ 
+ 	lpar_rc = beat_write_htab_entry(0, slot, 0, 0, HPTE_V_VALID, 0,
+ 		&dummy1, &dummy2);
+-	spin_unlock_irqrestore(&beat_htab_lock, flags);
++	atomic_spin_unlock_irqrestore(&beat_htab_lock, flags);
+ 
+ 	BUG_ON(lpar_rc != 0);
+ }
+Index: linux-rt-2.6.31/arch/powerpc/platforms/cell/beat_interrupt.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/powerpc/platforms/cell/beat_interrupt.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/powerpc/platforms/cell/beat_interrupt.c	2010-05-17 14:23:19.918385259 +0200
+@@ -30,7 +30,7 @@
+ #include "beat_wrapper.h"
+ 
+ #define	MAX_IRQS	NR_IRQS
+-static DEFINE_SPINLOCK(beatic_irq_mask_lock);
++static DEFINE_ATOMIC_SPINLOCK(beatic_irq_mask_lock);
+ static uint64_t	beatic_irq_mask_enable[(MAX_IRQS+255)/64];
+ static uint64_t	beatic_irq_mask_ack[(MAX_IRQS+255)/64];
+ 
+@@ -65,30 +65,30 @@
+ {
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&beatic_irq_mask_lock, flags);
++	atomic_spin_lock_irqsave(&beatic_irq_mask_lock, flags);
+ 	beatic_irq_mask_enable[irq_plug/64] &= ~(1UL << (63 - (irq_plug%64)));
+ 	beatic_update_irq_mask(irq_plug);
+-	spin_unlock_irqrestore(&beatic_irq_mask_lock, flags);
++	atomic_spin_unlock_irqrestore(&beatic_irq_mask_lock, flags);
+ }
+ 
+ static void beatic_unmask_irq(unsigned int irq_plug)
+ {
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&beatic_irq_mask_lock, flags);
++	atomic_spin_lock_irqsave(&beatic_irq_mask_lock, flags);
+ 	beatic_irq_mask_enable[irq_plug/64] |= 1UL << (63 - (irq_plug%64));
+ 	beatic_update_irq_mask(irq_plug);
+-	spin_unlock_irqrestore(&beatic_irq_mask_lock, flags);
++	atomic_spin_unlock_irqrestore(&beatic_irq_mask_lock, flags);
+ }
+ 
+ static void beatic_ack_irq(unsigned int irq_plug)
+ {
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&beatic_irq_mask_lock, flags);
++	atomic_spin_lock_irqsave(&beatic_irq_mask_lock, flags);
+ 	beatic_irq_mask_ack[irq_plug/64] &= ~(1UL << (63 - (irq_plug%64)));
+ 	beatic_update_irq_mask(irq_plug);
+-	spin_unlock_irqrestore(&beatic_irq_mask_lock, flags);
++	atomic_spin_unlock_irqrestore(&beatic_irq_mask_lock, flags);
+ }
+ 
+ static void beatic_end_irq(unsigned int irq_plug)
+@@ -103,10 +103,10 @@
+ 
+ 		printk(KERN_ERR "IRQ over-downcounted, plug %d\n", irq_plug);
+ 	}
+-	spin_lock_irqsave(&beatic_irq_mask_lock, flags);
++	atomic_spin_lock_irqsave(&beatic_irq_mask_lock, flags);
+ 	beatic_irq_mask_ack[irq_plug/64] |= 1UL << (63 - (irq_plug%64));
+ 	beatic_update_irq_mask(irq_plug);
+-	spin_unlock_irqrestore(&beatic_irq_mask_lock, flags);
++	atomic_spin_unlock_irqrestore(&beatic_irq_mask_lock, flags);
+ }
+ 
+ static struct irq_chip beatic_pic = {
+Index: linux-rt-2.6.31/arch/powerpc/platforms/cell/interrupt.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/powerpc/platforms/cell/interrupt.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/powerpc/platforms/cell/interrupt.c	2010-05-17 14:23:19.918385259 +0200
+@@ -237,7 +237,7 @@
+ 
+ static void handle_iic_irq(unsigned int irq, struct irq_desc *desc)
+ {
+-	spin_lock(&desc->lock);
++	atomic_spin_lock(&desc->lock);
+ 
+ 	desc->status &= ~(IRQ_REPLAY | IRQ_WAITING);
+ 
+@@ -265,18 +265,18 @@
+ 			goto out_eoi;
+ 
+ 		desc->status &= ~IRQ_PENDING;
+-		spin_unlock(&desc->lock);
++		atomic_spin_unlock(&desc->lock);
+ 		action_ret = handle_IRQ_event(irq, action);
+ 		if (!noirqdebug)
+ 			note_interrupt(irq, desc, action_ret);
+-		spin_lock(&desc->lock);
++		atomic_spin_lock(&desc->lock);
+ 
+ 	} while ((desc->status & (IRQ_PENDING | IRQ_DISABLED)) == IRQ_PENDING);
+ 
+ 	desc->status &= ~IRQ_INPROGRESS;
+ out_eoi:
+ 	desc->chip->eoi(irq);
+-	spin_unlock(&desc->lock);
++	atomic_spin_unlock(&desc->lock);
+ }
+ 
+ static int iic_host_map(struct irq_host *h, unsigned int virq,
+Index: linux-rt-2.6.31/arch/powerpc/platforms/chrp/time.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/powerpc/platforms/chrp/time.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/powerpc/platforms/chrp/time.c	2010-05-17 14:23:19.918385259 +0200
+@@ -83,7 +83,12 @@
+ 	unsigned char save_control, save_freq_select;
+ 	struct rtc_time tm = *tmarg;
+ 
++#if CONFIG_PREEMPT_RT
++	if (!spin_trylock(&rtc_lock))
++		return -1;
++#else
+ 	spin_lock(&rtc_lock);
++#endif
+ 
+ 	save_control = chrp_cmos_clock_read(RTC_CONTROL); /* tell the clock it's being set */
+ 
+Index: linux-rt-2.6.31/arch/powerpc/platforms/iseries/irq.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/powerpc/platforms/iseries/irq.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/powerpc/platforms/iseries/irq.c	2010-05-17 14:23:19.918385259 +0200
+@@ -217,9 +217,9 @@
+ 		struct irq_desc *desc = get_irq_desc(irq);
+ 
+ 		if (desc && desc->chip && desc->chip->startup) {
+-			spin_lock_irqsave(&desc->lock, flags);
++			atomic_spin_lock_irqsave(&desc->lock, flags);
+ 			desc->chip->startup(irq);
+-			spin_unlock_irqrestore(&desc->lock, flags);
++			atomic_spin_unlock_irqrestore(&desc->lock, flags);
+ 		}
+ 	}
+ }
+Index: linux-rt-2.6.31/arch/powerpc/platforms/powermac/feature.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/powerpc/platforms/powermac/feature.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/powerpc/platforms/powermac/feature.c	2010-05-17 14:23:19.928426689 +0200
+@@ -59,10 +59,10 @@
+  * We use a single global lock to protect accesses. Each driver has
+  * to take care of its own locking
+  */
+-DEFINE_SPINLOCK(feature_lock);
++DEFINE_ATOMIC_SPINLOCK(feature_lock);
+ 
+-#define LOCK(flags)	spin_lock_irqsave(&feature_lock, flags);
+-#define UNLOCK(flags)	spin_unlock_irqrestore(&feature_lock, flags);
++#define LOCK(flags)	atomic_spin_lock_irqsave(&feature_lock, flags);
++#define UNLOCK(flags)	atomic_spin_unlock_irqrestore(&feature_lock, flags);
+ 
+ 
+ /*
+Index: linux-rt-2.6.31/arch/powerpc/platforms/powermac/nvram.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/powerpc/platforms/powermac/nvram.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/powerpc/platforms/powermac/nvram.c	2010-05-17 14:23:19.928426689 +0200
+@@ -80,7 +80,7 @@
+ static int core99_bank = 0;
+ static int nvram_partitions[3];
+ // XXX Turn that into a sem
+-static DEFINE_SPINLOCK(nv_lock);
++static DEFINE_ATOMIC_SPINLOCK(nv_lock);
+ 
+ static int (*core99_write_bank)(int bank, u8* datas);
+ static int (*core99_erase_bank)(int bank);
+@@ -165,10 +165,10 @@
+ 	unsigned char val;
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&nv_lock, flags);
++	atomic_spin_lock_irqsave(&nv_lock, flags);
+ 	out_8(nvram_addr, addr >> 5);
+ 	val = in_8(&nvram_data[(addr & 0x1f) << 4]);
+-	spin_unlock_irqrestore(&nv_lock, flags);
++	atomic_spin_unlock_irqrestore(&nv_lock, flags);
+ 
+ 	return val;
+ }
+@@ -177,10 +177,10 @@
+ {
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&nv_lock, flags);
++	atomic_spin_lock_irqsave(&nv_lock, flags);
+ 	out_8(nvram_addr, addr >> 5);
+ 	out_8(&nvram_data[(addr & 0x1f) << 4], val);
+-	spin_unlock_irqrestore(&nv_lock, flags);
++	atomic_spin_unlock_irqrestore(&nv_lock, flags);
+ }
+ 
+ 
+@@ -481,7 +481,7 @@
+ 	if (!is_core_99 || !nvram_data || !nvram_image)
+ 		return;
+ 
+-	spin_lock_irqsave(&nv_lock, flags);
++	atomic_spin_lock_irqsave(&nv_lock, flags);
+ 	if (!memcmp(nvram_image, (u8*)nvram_data + core99_bank*NVRAM_SIZE,
+ 		NVRAM_SIZE))
+ 		goto bail;
+@@ -503,7 +503,7 @@
+ 		if (core99_write_bank(core99_bank, nvram_image))
+ 			printk("nvram: Error writing bank %d\n", core99_bank);
+  bail:
+-	spin_unlock_irqrestore(&nv_lock, flags);
++	atomic_spin_unlock_irqrestore(&nv_lock, flags);
+ 
+ #ifdef DEBUG
+        	mdelay(2000);
+Index: linux-rt-2.6.31/arch/powerpc/platforms/powermac/pfunc_base.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/powerpc/platforms/powermac/pfunc_base.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/powerpc/platforms/powermac/pfunc_base.c	2010-05-17 14:23:19.928426689 +0200
+@@ -50,13 +50,13 @@
+ 		value = ~value;
+ 
+ 	/* Toggle the GPIO */
+-	spin_lock_irqsave(&feature_lock, flags);
++	atomic_spin_lock_irqsave(&feature_lock, flags);
+ 	tmp = readb(addr);
+ 	tmp = (tmp & ~mask) | (value & mask);
+ 	DBG("Do write 0x%02x to GPIO %s (%p)\n",
+ 	    tmp, func->node->full_name, addr);
+ 	writeb(tmp, addr);
+-	spin_unlock_irqrestore(&feature_lock, flags);
++	atomic_spin_unlock_irqrestore(&feature_lock, flags);
+ 
+ 	return 0;
+ }
+@@ -145,9 +145,9 @@
+ 	struct macio_chip *macio = func->driver_data;
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&feature_lock, flags);
++	atomic_spin_lock_irqsave(&feature_lock, flags);
+ 	MACIO_OUT32(offset, (MACIO_IN32(offset) & ~mask) | (value & mask));
+-	spin_unlock_irqrestore(&feature_lock, flags);
++	atomic_spin_unlock_irqrestore(&feature_lock, flags);
+ 	return 0;
+ }
+ 
+@@ -168,9 +168,9 @@
+ 	struct macio_chip *macio = func->driver_data;
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&feature_lock, flags);
++	atomic_spin_lock_irqsave(&feature_lock, flags);
+ 	MACIO_OUT8(offset, (MACIO_IN8(offset) & ~mask) | (value & mask));
+-	spin_unlock_irqrestore(&feature_lock, flags);
++	atomic_spin_unlock_irqrestore(&feature_lock, flags);
+ 	return 0;
+ }
+ 
+@@ -223,12 +223,12 @@
+ 	if (args == NULL || args->count == 0)
+ 		return -EINVAL;
+ 
+-	spin_lock_irqsave(&feature_lock, flags);
++	atomic_spin_lock_irqsave(&feature_lock, flags);
+ 	tmp = MACIO_IN32(offset);
+ 	val = args->u[0].v << shift;
+ 	tmp = (tmp & ~mask) | (val & mask);
+ 	MACIO_OUT32(offset, tmp);
+-	spin_unlock_irqrestore(&feature_lock, flags);
++	atomic_spin_unlock_irqrestore(&feature_lock, flags);
+ 	return 0;
+ }
+ 
+@@ -243,12 +243,12 @@
+ 	if (args == NULL || args->count == 0)
+ 		return -EINVAL;
+ 
+-	spin_lock_irqsave(&feature_lock, flags);
++	atomic_spin_lock_irqsave(&feature_lock, flags);
+ 	tmp = MACIO_IN8(offset);
+ 	val = args->u[0].v << shift;
+ 	tmp = (tmp & ~mask) | (val & mask);
+ 	MACIO_OUT8(offset, tmp);
+-	spin_unlock_irqrestore(&feature_lock, flags);
++	atomic_spin_unlock_irqrestore(&feature_lock, flags);
+ 	return 0;
+ }
+ 
+@@ -278,12 +278,12 @@
+ {
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&feature_lock, flags);
++	atomic_spin_lock_irqsave(&feature_lock, flags);
+ 	/* This is fairly bogus in darwin, but it should work for our needs
+ 	 * implemeted that way:
+ 	 */
+ 	UN_OUT(offset, (UN_IN(offset) & ~mask) | (value & mask));
+-	spin_unlock_irqrestore(&feature_lock, flags);
++	atomic_spin_unlock_irqrestore(&feature_lock, flags);
+ 	return 0;
+ }
+ 
+Index: linux-rt-2.6.31/arch/powerpc/platforms/powermac/pic.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/powerpc/platforms/powermac/pic.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/powerpc/platforms/powermac/pic.c	2010-05-17 14:23:19.928426689 +0200
+@@ -57,7 +57,7 @@
+ static int max_real_irqs;
+ static u32 level_mask[4];
+ 
+-static DEFINE_SPINLOCK(pmac_pic_lock);
++static DEFINE_ATOMIC_SPINLOCK(pmac_pic_lock);
+ 
+ #define NR_MASK_WORDS	((NR_IRQS + 31) / 32)
+ static unsigned long ppc_lost_interrupts[NR_MASK_WORDS];
+@@ -85,7 +85,7 @@
+         int i = src >> 5;
+         unsigned long flags;
+ 
+-	spin_lock_irqsave(&pmac_pic_lock, flags);
++	atomic_spin_lock_irqsave(&pmac_pic_lock, flags);
+         __clear_bit(src, ppc_cached_irq_mask);
+         if (__test_and_clear_bit(src, ppc_lost_interrupts))
+                 atomic_dec(&ppc_n_lost_interrupts);
+@@ -97,7 +97,7 @@
+                 mb();
+         } while((in_le32(&pmac_irq_hw[i]->enable) & bit)
+                 != (ppc_cached_irq_mask[i] & bit));
+-	spin_unlock_irqrestore(&pmac_pic_lock, flags);
++	atomic_spin_unlock_irqrestore(&pmac_pic_lock, flags);
+ }
+ 
+ static void pmac_ack_irq(unsigned int virq)
+@@ -107,12 +107,12 @@
+         int i = src >> 5;
+         unsigned long flags;
+ 
+-  	spin_lock_irqsave(&pmac_pic_lock, flags);
++	atomic_spin_lock_irqsave(&pmac_pic_lock, flags);
+ 	if (__test_and_clear_bit(src, ppc_lost_interrupts))
+                 atomic_dec(&ppc_n_lost_interrupts);
+         out_le32(&pmac_irq_hw[i]->ack, bit);
+         (void)in_le32(&pmac_irq_hw[i]->ack);
+-	spin_unlock_irqrestore(&pmac_pic_lock, flags);
++	atomic_spin_unlock_irqrestore(&pmac_pic_lock, flags);
+ }
+ 
+ static void __pmac_set_irq_mask(unsigned int irq_nr, int nokicklost)
+@@ -152,12 +152,12 @@
+         unsigned long bit = 1UL << (src & 0x1f);
+         int i = src >> 5;
+ 
+-  	spin_lock_irqsave(&pmac_pic_lock, flags);
++	atomic_spin_lock_irqsave(&pmac_pic_lock, flags);
+ 	if ((irq_desc[virq].status & IRQ_LEVEL) == 0)
+ 		out_le32(&pmac_irq_hw[i]->ack, bit);
+         __set_bit(src, ppc_cached_irq_mask);
+         __pmac_set_irq_mask(src, 0);
+-  	spin_unlock_irqrestore(&pmac_pic_lock, flags);
++	atomic_spin_unlock_irqrestore(&pmac_pic_lock, flags);
+ 
+ 	return 0;
+ }
+@@ -167,10 +167,10 @@
+ 	unsigned long flags;
+ 	unsigned int src = irq_map[virq].hwirq;
+ 
+-  	spin_lock_irqsave(&pmac_pic_lock, flags);
++	atomic_spin_lock_irqsave(&pmac_pic_lock, flags);
+         __clear_bit(src, ppc_cached_irq_mask);
+         __pmac_set_irq_mask(src, 1);
+-  	spin_unlock_irqrestore(&pmac_pic_lock, flags);
++	atomic_spin_unlock_irqrestore(&pmac_pic_lock, flags);
+ }
+ 
+ static void pmac_unmask_irq(unsigned int virq)
+@@ -178,19 +178,19 @@
+ 	unsigned long flags;
+ 	unsigned int src = irq_map[virq].hwirq;
+ 
+-	spin_lock_irqsave(&pmac_pic_lock, flags);
++	atomic_spin_lock_irqsave(&pmac_pic_lock, flags);
+ 	__set_bit(src, ppc_cached_irq_mask);
+         __pmac_set_irq_mask(src, 0);
+-  	spin_unlock_irqrestore(&pmac_pic_lock, flags);
++	atomic_spin_unlock_irqrestore(&pmac_pic_lock, flags);
+ }
+ 
+ static int pmac_retrigger(unsigned int virq)
+ {
+ 	unsigned long flags;
+ 
+-  	spin_lock_irqsave(&pmac_pic_lock, flags);
++	atomic_spin_lock_irqsave(&pmac_pic_lock, flags);
+ 	__pmac_retrigger(irq_map[virq].hwirq);
+-  	spin_unlock_irqrestore(&pmac_pic_lock, flags);
++	atomic_spin_unlock_irqrestore(&pmac_pic_lock, flags);
+ 	return 1;
+ }
+ 
+@@ -210,7 +210,7 @@
+ 	int irq, bits;
+ 	int rc = IRQ_NONE;
+ 
+-  	spin_lock_irqsave(&pmac_pic_lock, flags);
++	atomic_spin_lock_irqsave(&pmac_pic_lock, flags);
+ 	for (irq = max_irqs; (irq -= 32) >= max_real_irqs; ) {
+ 		int i = irq >> 5;
+ 		bits = in_le32(&pmac_irq_hw[i]->event) | ppc_lost_interrupts[i];
+@@ -220,12 +220,12 @@
+ 		if (bits == 0)
+ 			continue;
+ 		irq += __ilog2(bits);
+-		spin_unlock_irqrestore(&pmac_pic_lock, flags);
++		atomic_spin_unlock_irqrestore(&pmac_pic_lock, flags);
+ 		generic_handle_irq(irq);
+-		spin_lock_irqsave(&pmac_pic_lock, flags);
++		atomic_spin_lock_irqsave(&pmac_pic_lock, flags);
+ 		rc = IRQ_HANDLED;
+ 	}
+-  	spin_unlock_irqrestore(&pmac_pic_lock, flags);
++	atomic_spin_unlock_irqrestore(&pmac_pic_lock, flags);
+ 	return rc;
+ }
+ 
+@@ -244,7 +244,7 @@
+ 		return NO_IRQ_IGNORE;	/* ignore, already handled */
+         }
+ #endif /* CONFIG_SMP */
+-  	spin_lock_irqsave(&pmac_pic_lock, flags);
++	atomic_spin_lock_irqsave(&pmac_pic_lock, flags);
+ 	for (irq = max_real_irqs; (irq -= 32) >= 0; ) {
+ 		int i = irq >> 5;
+ 		bits = in_le32(&pmac_irq_hw[i]->event) | ppc_lost_interrupts[i];
+@@ -256,7 +256,7 @@
+ 		irq += __ilog2(bits);
+ 		break;
+ 	}
+-  	spin_unlock_irqrestore(&pmac_pic_lock, flags);
++	atomic_spin_unlock_irqrestore(&pmac_pic_lock, flags);
+ 	if (unlikely(irq < 0))
+ 		return NO_IRQ;
+ 	return irq_linear_revmap(pmac_pic_host, irq);
+Index: linux-rt-2.6.31/arch/powerpc/platforms/pseries/eeh.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/powerpc/platforms/pseries/eeh.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/powerpc/platforms/pseries/eeh.c	2010-05-17 14:23:19.928426689 +0200
+@@ -100,7 +100,7 @@
+ EXPORT_SYMBOL(eeh_subsystem_enabled);
+ 
+ /* Lock to avoid races due to multiple reports of an error */
+-static DEFINE_SPINLOCK(confirm_error_lock);
++static DEFINE_ATOMIC_SPINLOCK(confirm_error_lock);
+ 
+ /* Buffer for reporting slot-error-detail rtas calls. Its here
+  * in BSS, and not dynamically alloced, so that it ends up in
+@@ -436,7 +436,7 @@
+ void eeh_clear_slot (struct device_node *dn, int mode_flag)
+ {
+ 	unsigned long flags;
+-	spin_lock_irqsave(&confirm_error_lock, flags);
++	atomic_spin_lock_irqsave(&confirm_error_lock, flags);
+ 	
+ 	dn = find_device_pe (dn);
+ 	
+@@ -447,7 +447,7 @@
+ 	PCI_DN(dn)->eeh_mode &= ~mode_flag;
+ 	PCI_DN(dn)->eeh_check_count = 0;
+ 	__eeh_clear_slot(dn, mode_flag);
+-	spin_unlock_irqrestore(&confirm_error_lock, flags);
++	atomic_spin_unlock_irqrestore(&confirm_error_lock, flags);
+ }
+ 
+ /**
+@@ -506,7 +506,7 @@
+ 	 * in one slot might report errors simultaneously, and we
+ 	 * only want one error recovery routine running.
+ 	 */
+-	spin_lock_irqsave(&confirm_error_lock, flags);
++	atomic_spin_lock_irqsave(&confirm_error_lock, flags);
+ 	rc = 1;
+ 	if (pdn->eeh_mode & EEH_MODE_ISOLATED) {
+ 		pdn->eeh_check_count ++;
+@@ -575,7 +575,7 @@
+ 	 * with other functions on this device, and functions under
+ 	 * bridges. */
+ 	eeh_mark_slot (dn, EEH_MODE_ISOLATED);
+-	spin_unlock_irqrestore(&confirm_error_lock, flags);
++	atomic_spin_unlock_irqrestore(&confirm_error_lock, flags);
+ 
+ 	eeh_send_failure_event (dn, dev);
+ 
+@@ -586,7 +586,7 @@
+ 	return 1;
+ 
+ dn_unlock:
+-	spin_unlock_irqrestore(&confirm_error_lock, flags);
++	atomic_spin_unlock_irqrestore(&confirm_error_lock, flags);
+ 	return rc;
+ }
+ 
+@@ -1056,7 +1056,7 @@
+ 	struct device_node *phb, *np;
+ 	struct eeh_early_enable_info info;
+ 
+-	spin_lock_init(&confirm_error_lock);
++	atomic_spin_lock_init(&confirm_error_lock);
+ 	spin_lock_init(&slot_errbuf_lock);
+ 
+ 	np = of_find_node_by_path("/rtas");
+Index: linux-rt-2.6.31/arch/powerpc/platforms/pseries/eeh_driver.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/powerpc/platforms/pseries/eeh_driver.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/powerpc/platforms/pseries/eeh_driver.c	2010-05-17 14:23:19.928426689 +0200
+@@ -70,12 +70,12 @@
+ {
+ 	int rc = 0;
+ 	unsigned long flags;
+-   struct irq_desc *desc = irq_desc + irq;
++	struct irq_desc *desc = irq_desc + irq;
+ 
+-	spin_lock_irqsave(&desc->lock, flags);
++	atomic_spin_lock_irqsave(&desc->lock, flags);
+ 	if (desc->action)
+ 		rc = 1;
+-	spin_unlock_irqrestore(&desc->lock, flags);
++	atomic_spin_unlock_irqrestore(&desc->lock, flags);
+ 	return rc;
+ }
+ 
+Index: linux-rt-2.6.31/arch/powerpc/platforms/pseries/iommu.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/powerpc/platforms/pseries/iommu.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/powerpc/platforms/pseries/iommu.c	2010-05-17 14:23:19.928426689 +0200
+@@ -140,7 +140,7 @@
+ 	return ret;
+ }
+ 
+-static DEFINE_PER_CPU(u64 *, tce_page) = NULL;
++static DEFINE_PER_CPU_LOCKED(u64 *, tce_page) = NULL;
+ 
+ static int tce_buildmulti_pSeriesLP(struct iommu_table *tbl, long tcenum,
+ 				     long npages, unsigned long uaddr,
+@@ -154,13 +154,14 @@
+ 	long l, limit;
+ 	long tcenum_start = tcenum, npages_start = npages;
+ 	int ret = 0;
++	int cpu;
+ 
+ 	if (npages == 1) {
+ 		return tce_build_pSeriesLP(tbl, tcenum, npages, uaddr,
+ 		                           direction, attrs);
+ 	}
+ 
+-	tcep = __get_cpu_var(tce_page);
++	tcep = get_cpu_var_locked(tce_page, &cpu);
+ 
+ 	/* This is safe to do since interrupts are off when we're called
+ 	 * from iommu_alloc{,_sg}()
+@@ -169,10 +170,11 @@
+ 		tcep = (u64 *)__get_free_page(GFP_ATOMIC);
+ 		/* If allocation fails, fall back to the loop implementation */
+ 		if (!tcep) {
++			put_cpu_var_locked(tce_page, cpu);
+ 			return tce_build_pSeriesLP(tbl, tcenum, npages, uaddr,
+ 					    direction, attrs);
+ 		}
+-		__get_cpu_var(tce_page) = tcep;
++		per_cpu_var_locked(tce_page, cpu) = tcep;
+ 	}
+ 
+ 	rpn = (virt_to_abs(uaddr)) >> TCE_SHIFT;
+@@ -216,6 +218,7 @@
+ 		printk("\ttce[0] val = 0x%llx\n", tcep[0]);
+ 		show_stack(current, (unsigned long *)__get_SP());
+ 	}
++	put_cpu_var_locked(tce_page, cpu);
+ 	return ret;
+ }
+ 
+Index: linux-rt-2.6.31/arch/powerpc/platforms/pseries/rtasd.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/powerpc/platforms/pseries/rtasd.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/powerpc/platforms/pseries/rtasd.c	2010-05-17 14:23:19.928426689 +0200
+@@ -208,7 +208,7 @@
+ 		break;
+ 	case ERR_TYPE_KERNEL_PANIC:
+ 	default:
+-		WARN_ON_ONCE(!irqs_disabled()); /* @@@ DEBUG @@@ */
++		WARN_ON_ONCE_NONRT(!irqs_disabled()); /* @@@ DEBUG @@@ */
+ 		spin_unlock_irqrestore(&rtasd_log_lock, s);
+ 		return;
+ 	}
+@@ -228,7 +228,7 @@
+ 	/* Check to see if we need to or have stopped logging */
+ 	if (fatal || !logging_enabled) {
+ 		logging_enabled = 0;
+-		WARN_ON_ONCE(!irqs_disabled()); /* @@@ DEBUG @@@ */
++		WARN_ON_ONCE_NONRT(!irqs_disabled()); /* @@@ DEBUG @@@ */
+ 		spin_unlock_irqrestore(&rtasd_log_lock, s);
+ 		return;
+ 	}
+@@ -251,13 +251,13 @@
+ 		else
+ 			rtas_log_start += 1;
+ 
+-		WARN_ON_ONCE(!irqs_disabled()); /* @@@ DEBUG @@@ */
++		WARN_ON_ONCE_NONRT(!irqs_disabled()); /* @@@ DEBUG @@@ */
+ 		spin_unlock_irqrestore(&rtasd_log_lock, s);
+ 		wake_up_interruptible(&rtas_log_wait);
+ 		break;
+ 	case ERR_TYPE_KERNEL_PANIC:
+ 	default:
+-		WARN_ON_ONCE(!irqs_disabled()); /* @@@ DEBUG @@@ */
++		WARN_ON_ONCE_NONRT(!irqs_disabled()); /* @@@ DEBUG @@@ */
+ 		spin_unlock_irqrestore(&rtasd_log_lock, s);
+ 		return;
+ 	}
+Index: linux-rt-2.6.31/arch/powerpc/platforms/pseries/xics.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/powerpc/platforms/pseries/xics.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/arch/powerpc/platforms/pseries/xics.c	2010-05-17 14:23:19.928426689 +0200
+@@ -860,7 +860,7 @@
+ 		    || desc->chip->set_affinity == NULL)
+ 			continue;
+ 
+-		spin_lock_irqsave(&desc->lock, flags);
++		atomic_spin_lock_irqsave(&desc->lock, flags);
+ 
+ 		status = rtas_call(ibm_get_xive, 1, 3, xics_status, irq);
+ 		if (status) {
+@@ -884,7 +884,7 @@
+ 		cpumask_setall(irq_desc[virq].affinity);
+ 		desc->chip->set_affinity(virq, cpu_all_mask);
+ unlock:
+-		spin_unlock_irqrestore(&desc->lock, flags);
++		atomic_spin_unlock_irqrestore(&desc->lock, flags);
+ 	}
+ }
+ #endif
+Index: linux-rt-2.6.31/arch/powerpc/sysdev/fsl_msi.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/powerpc/sysdev/fsl_msi.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/powerpc/sysdev/fsl_msi.c	2010-05-17 14:23:19.928426689 +0200
+@@ -173,7 +173,7 @@
+ 	u32 intr_index;
+ 	u32 have_shift = 0;
+ 
+-	spin_lock(&desc->lock);
++	atomic_spin_lock(&desc->lock);
+ 	if ((msi_data->feature &  FSL_PIC_IP_MASK) == FSL_PIC_IP_IPIC) {
+ 		if (desc->chip->mask_ack)
+ 			desc->chip->mask_ack(irq);
+@@ -225,7 +225,7 @@
+ 		break;
+ 	}
+ unlock:
+-	spin_unlock(&desc->lock);
++	atomic_spin_unlock(&desc->lock);
+ }
+ 
+ static int __devinit fsl_of_msi_probe(struct of_device *dev,
+Index: linux-rt-2.6.31/arch/powerpc/sysdev/i8259.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/powerpc/sysdev/i8259.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/powerpc/sysdev/i8259.c	2010-05-17 14:23:19.928426689 +0200
+@@ -23,7 +23,7 @@
+ #define cached_A1 (cached_8259[0])
+ #define cached_21 (cached_8259[1])
+ 
+-static DEFINE_SPINLOCK(i8259_lock);
++static DEFINE_ATOMIC_SPINLOCK(i8259_lock);
+ 
+ static struct irq_host *i8259_host;
+ 
+@@ -42,7 +42,7 @@
+ 	if (pci_intack)
+ 		irq = readb(pci_intack);
+ 	else {
+-		spin_lock(&i8259_lock);
++		atomic_spin_lock(&i8259_lock);
+ 		lock = 1;
+ 
+ 		/* Perform an interrupt acknowledge cycle on controller 1. */
+@@ -74,7 +74,7 @@
+ 		irq = NO_IRQ;
+ 
+ 	if (lock)
+-		spin_unlock(&i8259_lock);
++		atomic_spin_unlock(&i8259_lock);
+ 	return irq;
+ }
+ 
+@@ -82,7 +82,7 @@
+ {
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&i8259_lock, flags);
++	atomic_spin_lock_irqsave(&i8259_lock, flags);
+ 	if (irq_nr > 7) {
+ 		cached_A1 |= 1 << (irq_nr-8);
+ 		inb(0xA1); 	/* DUMMY */
+@@ -95,7 +95,7 @@
+ 		outb(cached_21, 0x21);
+ 		outb(0x20, 0x20);	/* Non-specific EOI */
+ 	}
+-	spin_unlock_irqrestore(&i8259_lock, flags);
++	atomic_spin_unlock_irqrestore(&i8259_lock, flags);
+ }
+ 
+ static void i8259_set_irq_mask(int irq_nr)
+@@ -110,13 +110,13 @@
+ 
+ 	pr_debug("i8259_mask_irq(%d)\n", irq_nr);
+ 
+-	spin_lock_irqsave(&i8259_lock, flags);
++	atomic_spin_lock_irqsave(&i8259_lock, flags);
+ 	if (irq_nr < 8)
+ 		cached_21 |= 1 << irq_nr;
+ 	else
+ 		cached_A1 |= 1 << (irq_nr-8);
+ 	i8259_set_irq_mask(irq_nr);
+-	spin_unlock_irqrestore(&i8259_lock, flags);
++	atomic_spin_unlock_irqrestore(&i8259_lock, flags);
+ }
+ 
+ static void i8259_unmask_irq(unsigned int irq_nr)
+@@ -125,13 +125,13 @@
+ 
+ 	pr_debug("i8259_unmask_irq(%d)\n", irq_nr);
+ 
+-	spin_lock_irqsave(&i8259_lock, flags);
++	atomic_spin_lock_irqsave(&i8259_lock, flags);
+ 	if (irq_nr < 8)
+ 		cached_21 &= ~(1 << irq_nr);
+ 	else
+ 		cached_A1 &= ~(1 << (irq_nr-8));
+ 	i8259_set_irq_mask(irq_nr);
+-	spin_unlock_irqrestore(&i8259_lock, flags);
++	atomic_spin_unlock_irqrestore(&i8259_lock, flags);
+ }
+ 
+ static struct irq_chip i8259_pic = {
+@@ -241,7 +241,7 @@
+ 	unsigned long flags;
+ 
+ 	/* initialize the controller */
+-	spin_lock_irqsave(&i8259_lock, flags);
++	atomic_spin_lock_irqsave(&i8259_lock, flags);
+ 
+ 	/* Mask all first */
+ 	outb(0xff, 0xA1);
+@@ -273,7 +273,7 @@
+ 	outb(cached_A1, 0xA1);
+ 	outb(cached_21, 0x21);
+ 
+-	spin_unlock_irqrestore(&i8259_lock, flags);
++	atomic_spin_unlock_irqrestore(&i8259_lock, flags);
+ 
+ 	/* create a legacy host */
+ 	i8259_host = irq_alloc_host(node, IRQ_HOST_MAP_LEGACY,
+Index: linux-rt-2.6.31/arch/powerpc/sysdev/ipic.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/powerpc/sysdev/ipic.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/powerpc/sysdev/ipic.c	2010-05-17 14:23:19.928426689 +0200
+@@ -32,7 +32,7 @@
+ 
+ static struct ipic * primary_ipic;
+ static struct irq_chip ipic_level_irq_chip, ipic_edge_irq_chip;
+-static DEFINE_SPINLOCK(ipic_lock);
++static DEFINE_ATOMIC_SPINLOCK(ipic_lock);
+ 
+ static struct ipic_info ipic_info[] = {
+ 	[1] = {
+@@ -530,13 +530,13 @@
+ 	unsigned long flags;
+ 	u32 temp;
+ 
+-	spin_lock_irqsave(&ipic_lock, flags);
++	atomic_spin_lock_irqsave(&ipic_lock, flags);
+ 
+ 	temp = ipic_read(ipic->regs, ipic_info[src].mask);
+ 	temp |= (1 << (31 - ipic_info[src].bit));
+ 	ipic_write(ipic->regs, ipic_info[src].mask, temp);
+ 
+-	spin_unlock_irqrestore(&ipic_lock, flags);
++	atomic_spin_unlock_irqrestore(&ipic_lock, flags);
+ }
+ 
+ static void ipic_mask_irq(unsigned int virq)
+@@ -546,7 +546,7 @@
+ 	unsigned long flags;
+ 	u32 temp;
+ 
+-	spin_lock_irqsave(&ipic_lock, flags);
++	atomic_spin_lock_irqsave(&ipic_lock, flags);
+ 
+ 	temp = ipic_read(ipic->regs, ipic_info[src].mask);
+ 	temp &= ~(1 << (31 - ipic_info[src].bit));
+@@ -556,7 +556,7 @@
+ 	 * for nearly all cases. */
+ 	mb();
+ 
+-	spin_unlock_irqrestore(&ipic_lock, flags);
++	atomic_spin_unlock_irqrestore(&ipic_lock, flags);
+ }
+ 
+ static void ipic_ack_irq(unsigned int virq)
+@@ -566,7 +566,7 @@
+ 	unsigned long flags;
+ 	u32 temp;
+ 
+-	spin_lock_irqsave(&ipic_lock, flags);
++	atomic_spin_lock_irqsave(&ipic_lock, flags);
+ 
+ 	temp = 1 << (31 - ipic_info[src].bit);
+ 	ipic_write(ipic->regs, ipic_info[src].ack, temp);
+@@ -575,7 +575,7 @@
+ 	 * for nearly all cases. */
+ 	mb();
+ 
+-	spin_unlock_irqrestore(&ipic_lock, flags);
++	atomic_spin_unlock_irqrestore(&ipic_lock, flags);
+ }
+ 
+ static void ipic_mask_irq_and_ack(unsigned int virq)
+@@ -585,7 +585,7 @@
+ 	unsigned long flags;
+ 	u32 temp;
+ 
+-	spin_lock_irqsave(&ipic_lock, flags);
++	atomic_spin_lock_irqsave(&ipic_lock, flags);
+ 
+ 	temp = ipic_read(ipic->regs, ipic_info[src].mask);
+ 	temp &= ~(1 << (31 - ipic_info[src].bit));
+@@ -598,7 +598,7 @@
+ 	 * for nearly all cases. */
+ 	mb();
+ 
+-	spin_unlock_irqrestore(&ipic_lock, flags);
++	atomic_spin_unlock_irqrestore(&ipic_lock, flags);
+ }
+ 
+ static int ipic_set_irq_type(unsigned int virq, unsigned int flow_type)
+Index: linux-rt-2.6.31/arch/powerpc/sysdev/mpic.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/powerpc/sysdev/mpic.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/powerpc/sysdev/mpic.c	2010-05-17 14:23:19.928426689 +0200
+@@ -46,7 +46,7 @@
+ 
+ static struct mpic *mpics;
+ static struct mpic *mpic_primary;
+-static DEFINE_SPINLOCK(mpic_lock);
++static DEFINE_ATOMIC_SPINLOCK(mpic_lock);
+ 
+ #ifdef CONFIG_PPC32	/* XXX for now */
+ #ifdef CONFIG_IRQ_ALL_CPUS
+@@ -344,10 +344,10 @@
+ 		unsigned int mask = 1U << (fixup->index & 0x1f);
+ 		writel(mask, fixup->applebase + soff);
+ 	} else {
+-		spin_lock(&mpic->fixup_lock);
++		atomic_spin_lock(&mpic->fixup_lock);
+ 		writeb(0x11 + 2 * fixup->index, fixup->base + 2);
+ 		writel(fixup->data, fixup->base + 4);
+-		spin_unlock(&mpic->fixup_lock);
++		atomic_spin_unlock(&mpic->fixup_lock);
+ 	}
+ }
+ 
+@@ -363,7 +363,7 @@
+ 
+ 	DBG("startup_ht_interrupt(0x%x, 0x%x) index: %d\n",
+ 	    source, irqflags, fixup->index);
+-	spin_lock_irqsave(&mpic->fixup_lock, flags);
++	atomic_spin_lock_irqsave(&mpic->fixup_lock, flags);
+ 	/* Enable and configure */
+ 	writeb(0x10 + 2 * fixup->index, fixup->base + 2);
+ 	tmp = readl(fixup->base + 4);
+@@ -371,7 +371,7 @@
+ 	if (irqflags & IRQ_LEVEL)
+ 		tmp |= 0x22;
+ 	writel(tmp, fixup->base + 4);
+-	spin_unlock_irqrestore(&mpic->fixup_lock, flags);
++	atomic_spin_unlock_irqrestore(&mpic->fixup_lock, flags);
+ 
+ #ifdef CONFIG_PM
+ 	/* use the lowest bit inverted to the actual HW,
+@@ -393,12 +393,12 @@
+ 	DBG("shutdown_ht_interrupt(0x%x, 0x%x)\n", source, irqflags);
+ 
+ 	/* Disable */
+-	spin_lock_irqsave(&mpic->fixup_lock, flags);
++	atomic_spin_lock_irqsave(&mpic->fixup_lock, flags);
+ 	writeb(0x10 + 2 * fixup->index, fixup->base + 2);
+ 	tmp = readl(fixup->base + 4);
+ 	tmp |= 1;
+ 	writel(tmp, fixup->base + 4);
+-	spin_unlock_irqrestore(&mpic->fixup_lock, flags);
++	atomic_spin_unlock_irqrestore(&mpic->fixup_lock, flags);
+ 
+ #ifdef CONFIG_PM
+ 	/* use the lowest bit inverted to the actual HW,
+@@ -512,7 +512,7 @@
+ 	BUG_ON(mpic->fixups == NULL);
+ 
+ 	/* Init spinlock */
+-	spin_lock_init(&mpic->fixup_lock);
++	atomic_spin_lock_init(&mpic->fixup_lock);
+ 
+ 	/* Map U3 config space. We assume all IO-APICs are on the primary bus
+ 	 * so we only need to map 64kB.
+@@ -572,12 +572,12 @@
+ 	cpumask_copy(&mask, irq_desc[virt_irq].affinity);
+ 	if (cpus_equal(mask, CPU_MASK_ALL)) {
+ 		static int irq_rover;
+-		static DEFINE_SPINLOCK(irq_rover_lock);
++		static DEFINE_ATOMIC_SPINLOCK(irq_rover_lock);
+ 		unsigned long flags;
+ 
+ 		/* Round-robin distribution... */
+ 	do_round_robin:
+-		spin_lock_irqsave(&irq_rover_lock, flags);
++		atomic_spin_lock_irqsave(&irq_rover_lock, flags);
+ 
+ 		while (!cpu_online(irq_rover)) {
+ 			if (++irq_rover >= NR_CPUS)
+@@ -589,7 +589,7 @@
+ 				irq_rover = 0;
+ 		} while (!cpu_online(irq_rover));
+ 
+-		spin_unlock_irqrestore(&irq_rover_lock, flags);
++		atomic_spin_unlock_irqrestore(&irq_rover_lock, flags);
+ 	} else {
+ 		cpumask_t tmp;
+ 
+@@ -1372,14 +1372,14 @@
+ 	unsigned long flags;
+ 	u32 v;
+ 
+-	spin_lock_irqsave(&mpic_lock, flags);
++	atomic_spin_lock_irqsave(&mpic_lock, flags);
+ 	v = mpic_read(mpic->gregs, MPIC_GREG_GLOBAL_CONF_1);
+ 	if (enable)
+ 		v |= MPIC_GREG_GLOBAL_CONF_1_SIE;
+ 	else
+ 		v &= ~MPIC_GREG_GLOBAL_CONF_1_SIE;
+ 	mpic_write(mpic->gregs, MPIC_GREG_GLOBAL_CONF_1, v);
+-	spin_unlock_irqrestore(&mpic_lock, flags);
++	atomic_spin_unlock_irqrestore(&mpic_lock, flags);
+ }
+ 
+ void mpic_irq_set_priority(unsigned int irq, unsigned int pri)
+@@ -1392,7 +1392,7 @@
+ 	if (!mpic)
+ 		return;
+ 
+-	spin_lock_irqsave(&mpic_lock, flags);
++	atomic_spin_lock_irqsave(&mpic_lock, flags);
+ 	if (mpic_is_ipi(mpic, irq)) {
+ 		reg = mpic_ipi_read(src - mpic->ipi_vecs[0]) &
+ 			~MPIC_VECPRI_PRIORITY_MASK;
+@@ -1404,7 +1404,7 @@
+ 		mpic_irq_write(src, MPIC_INFO(IRQ_VECTOR_PRI),
+ 			       reg | (pri << MPIC_VECPRI_PRIORITY_SHIFT));
+ 	}
+-	spin_unlock_irqrestore(&mpic_lock, flags);
++	atomic_spin_unlock_irqrestore(&mpic_lock, flags);
+ }
+ 
+ void mpic_setup_this_cpu(void)
+@@ -1419,7 +1419,7 @@
+ 
+ 	DBG("%s: setup_this_cpu(%d)\n", mpic->name, hard_smp_processor_id());
+ 
+-	spin_lock_irqsave(&mpic_lock, flags);
++	atomic_spin_lock_irqsave(&mpic_lock, flags);
+ 
+  	/* let the mpic know we want intrs. default affinity is 0xffffffff
+ 	 * until changed via /proc. That's how it's done on x86. If we want
+@@ -1435,7 +1435,7 @@
+ 	/* Set current processor priority to 0 */
+ 	mpic_cpu_write(MPIC_INFO(CPU_CURRENT_TASK_PRI), 0);
+ 
+-	spin_unlock_irqrestore(&mpic_lock, flags);
++	atomic_spin_unlock_irqrestore(&mpic_lock, flags);
+ #endif /* CONFIG_SMP */
+ }
+ 
+@@ -1464,7 +1464,7 @@
+ 	BUG_ON(mpic == NULL);
+ 
+ 	DBG("%s: teardown_this_cpu(%d)\n", mpic->name, hard_smp_processor_id());
+-	spin_lock_irqsave(&mpic_lock, flags);
++	atomic_spin_lock_irqsave(&mpic_lock, flags);
+ 
+ 	/* let the mpic know we don't want intrs.  */
+ 	for (i = 0; i < mpic->num_sources ; i++)
+@@ -1478,7 +1478,7 @@
+ 	 */
+ 	mpic_eoi(mpic);
+ 
+-	spin_unlock_irqrestore(&mpic_lock, flags);
++	atomic_spin_unlock_irqrestore(&mpic_lock, flags);
+ }
+ 
+ 
+Index: linux-rt-2.6.31/arch/powerpc/sysdev/uic.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/powerpc/sysdev/uic.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/powerpc/sysdev/uic.c	2010-05-17 14:23:19.928426689 +0200
+@@ -225,12 +225,12 @@
+ 	int src;
+ 	int subvirq;
+ 
+-	spin_lock(&desc->lock);
++	atomic_spin_lock(&desc->lock);
+ 	if (desc->status & IRQ_LEVEL)
+ 		desc->chip->mask(virq);
+ 	else
+ 		desc->chip->mask_ack(virq);
+-	spin_unlock(&desc->lock);
++	atomic_spin_unlock(&desc->lock);
+ 
+ 	msr = mfdcr(uic->dcrbase + UIC_MSR);
+ 	if (!msr) /* spurious interrupt */
+@@ -242,12 +242,12 @@
+ 	generic_handle_irq(subvirq);
+ 
+ uic_irq_ret:
+-	spin_lock(&desc->lock);
++	atomic_spin_lock(&desc->lock);
+ 	if (desc->status & IRQ_LEVEL)
+ 		desc->chip->ack(virq);
+ 	if (!(desc->status & IRQ_DISABLED) && desc->chip->unmask)
+ 		desc->chip->unmask(virq);
+-	spin_unlock(&desc->lock);
++	atomic_spin_unlock(&desc->lock);
+ }
+ 
+ static struct uic * __init uic_init_one(struct device_node *node)
+Index: linux-rt-2.6.31/arch/powerpc/xmon/xmon.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/powerpc/xmon/xmon.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/powerpc/xmon/xmon.c	2010-05-17 14:23:19.928426689 +0200
+@@ -348,6 +348,7 @@
+ 	unsigned long timeout;
+ #endif
+ 
++	preempt_disable();
+ 	local_irq_save(flags);
+ 
+ 	bp = in_breakpoint_table(regs->nip, &offset);
+@@ -524,6 +525,7 @@
+ 	insert_cpu_bpts();
+ 
+ 	local_irq_restore(flags);
++	preempt_enable();
+ 
+ 	return cmd != 'X' && cmd != EOF;
+ }
+Index: linux-rt-2.6.31/arch/s390/Kconfig
+===================================================================
+--- linux-rt-2.6.31.orig/arch/s390/Kconfig	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/s390/Kconfig	2010-05-17 14:23:19.928426689 +0200
+@@ -84,7 +84,7 @@
+ 	select HAVE_FUNCTION_TRACER
+ 	select HAVE_FUNCTION_TRACE_MCOUNT_TEST
+ 	select HAVE_FTRACE_MCOUNT_RECORD
+-	select HAVE_FTRACE_SYSCALLS
++	select HAVE_SYSCALL_TRACEPOINTS
+ 	select HAVE_DYNAMIC_FTRACE
+ 	select HAVE_FUNCTION_GRAPH_TRACER
+ 	select HAVE_DEFAULT_NO_SPIN_MUTEXES
+Index: linux-rt-2.6.31/arch/s390/defconfig
+===================================================================
+--- linux-rt-2.6.31.orig/arch/s390/defconfig	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/s390/defconfig	2010-05-17 14:23:19.928426689 +0200
+@@ -900,7 +900,7 @@
+ CONFIG_HAVE_FUNCTION_TRACE_MCOUNT_TEST=y
+ CONFIG_HAVE_DYNAMIC_FTRACE=y
+ CONFIG_HAVE_FTRACE_MCOUNT_RECORD=y
+-CONFIG_HAVE_FTRACE_SYSCALLS=y
++CONFIG_HAVE_SYSCALL_TRACEPOINTS=y
+ CONFIG_TRACING_SUPPORT=y
+ CONFIG_FTRACE=y
+ # CONFIG_FUNCTION_TRACER is not set
+Index: linux-rt-2.6.31/arch/s390/include/asm/rwsem.h
+===================================================================
+--- linux-rt-2.6.31.orig/arch/s390/include/asm/rwsem.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/s390/include/asm/rwsem.h	2010-05-17 14:23:19.928426689 +0200
+@@ -48,16 +48,21 @@
+ 
+ struct rwsem_waiter;
+ 
+-extern struct rw_semaphore *rwsem_down_read_failed(struct rw_semaphore *);
+-extern struct rw_semaphore *rwsem_down_write_failed(struct rw_semaphore *);
+-extern struct rw_semaphore *rwsem_wake(struct rw_semaphore *);
+-extern struct rw_semaphore *rwsem_downgrade_wake(struct rw_semaphore *);
+-extern struct rw_semaphore *rwsem_downgrade_write(struct rw_semaphore *);
++extern struct rw_anon_semaphore *
++rwsem_down_read_failed(struct rw_anon_semaphore *);
++extern struct rw_anon_semaphore *
++rwsem_down_write_failed(struct rw_anon_semaphore *);
++extern struct rw_anon_semaphore *
++rwsem_wake(struct rw_anon_semaphore *);
++extern struct rw_anon_semaphore *
++rwsem_downgrade_wake(struct rw_anon_semaphore *);
++extern struct rw_anon_semaphore *
++rwsem_downgrade_write(struct rw_anon_semaphore *);
+ 
+ /*
+  * the semaphore definition
+  */
+-struct rw_semaphore {
++struct rw_anon_semaphore {
+ 	signed long		count;
+ 	spinlock_t		wait_lock;
+ 	struct list_head	wait_list;
+@@ -85,40 +90,40 @@
+  */
+ 
+ #ifdef CONFIG_DEBUG_LOCK_ALLOC
+-# define __RWSEM_DEP_MAP_INIT(lockname) , .dep_map = { .name = #lockname }
++# define __RWSEM_ANON_DEP_MAP_INIT(lockname) , .dep_map = { .name = #lockname }
+ #else
+-# define __RWSEM_DEP_MAP_INIT(lockname)
++# define __RWSEM_ANON_DEP_MAP_INIT(lockname)
+ #endif
+ 
+-#define __RWSEM_INITIALIZER(name) \
++#define __RWSEM_ANON_INITIALIZER(name) \
+  { RWSEM_UNLOCKED_VALUE, __SPIN_LOCK_UNLOCKED((name).wait.lock), \
+-   LIST_HEAD_INIT((name).wait_list) __RWSEM_DEP_MAP_INIT(name) }
++   LIST_HEAD_INIT((name).wait_list) __RWSEM_ANON_DEP_MAP_INIT(name) }
+ 
+-#define DECLARE_RWSEM(name) \
+-	struct rw_semaphore name = __RWSEM_INITIALIZER(name)
++#define DECLARE_ANON_RWSEM(name) \
++	struct rw_anon_semaphore name = __RWSEM_ANON_INITIALIZER(name)
+ 
+-static inline void init_rwsem(struct rw_semaphore *sem)
++static inline void init_anon_rwsem(struct rw_anon_semaphore *sem)
+ {
+ 	sem->count = RWSEM_UNLOCKED_VALUE;
+ 	spin_lock_init(&sem->wait_lock);
+ 	INIT_LIST_HEAD(&sem->wait_list);
+ }
+ 
+-extern void __init_rwsem(struct rw_semaphore *sem, const char *name,
+-			 struct lock_class_key *key);
++extern void __init_anon_rwsem(struct rw_anon_semaphore *sem, const char *name,
++			      struct lock_class_key *key);
+ 
+-#define init_rwsem(sem)				\
++#define init_anon_rwsem(sem)			\
+ do {						\
+ 	static struct lock_class_key __key;	\
+ 						\
+-	__init_rwsem((sem), #sem, &__key);	\
++	__init_anon_rwsem((sem), #sem, &__key);	\
+ } while (0)
+ 
+ 
+ /*
+  * lock for reading
+  */
+-static inline void __down_read(struct rw_semaphore *sem)
++static inline void __down_read(struct rw_anon_semaphore *sem)
+ {
+ 	signed long old, new;
+ 
+@@ -146,7 +151,7 @@
+ /*
+  * trylock for reading -- returns 1 if successful, 0 if contention
+  */
+-static inline int __down_read_trylock(struct rw_semaphore *sem)
++static inline int __down_read_trylock(struct rw_anon_semaphore *sem)
+ {
+ 	signed long old, new;
+ 
+@@ -177,7 +182,8 @@
+ /*
+  * lock for writing
+  */
+-static inline void __down_write_nested(struct rw_semaphore *sem, int subclass)
++static inline void
++__down_write_nested(struct rw_anon_semaphore *sem, int subclass)
+ {
+ 	signed long old, new, tmp;
+ 
+@@ -203,7 +209,7 @@
+ 		rwsem_down_write_failed(sem);
+ }
+ 
+-static inline void __down_write(struct rw_semaphore *sem)
++static inline void __down_write(struct rw_anon_semaphore *sem)
+ {
+ 	__down_write_nested(sem, 0);
+ }
+@@ -211,7 +217,7 @@
+ /*
+  * trylock for writing -- returns 1 if successful, 0 if contention
+  */
+-static inline int __down_write_trylock(struct rw_semaphore *sem)
++static inline int __down_write_trylock(struct rw_anon_semaphore *sem)
+ {
+ 	signed long old;
+ 
+@@ -239,7 +245,7 @@
+ /*
+  * unlock after reading
+  */
+-static inline void __up_read(struct rw_semaphore *sem)
++static inline void __up_read(struct rw_anon_semaphore *sem)
+ {
+ 	signed long old, new;
+ 
+@@ -269,7 +275,7 @@
+ /*
+  * unlock after writing
+  */
+-static inline void __up_write(struct rw_semaphore *sem)
++static inline void __up_write(struct rw_anon_semaphore *sem)
+ {
+ 	signed long old, new, tmp;
+ 
+@@ -299,7 +305,7 @@
+ /*
+  * downgrade write lock to read lock
+  */
+-static inline void __downgrade_write(struct rw_semaphore *sem)
++static inline void __downgrade_write(struct rw_anon_semaphore *sem)
+ {
+ 	signed long old, new, tmp;
+ 
+@@ -328,7 +334,7 @@
+ /*
+  * implement atomic add functionality
+  */
+-static inline void rwsem_atomic_add(long delta, struct rw_semaphore *sem)
++static inline void rwsem_atomic_add(long delta, struct rw_anon_semaphore *sem)
+ {
+ 	signed long old, new;
+ 
+@@ -354,7 +360,8 @@
+ /*
+  * implement exchange and add functionality
+  */
+-static inline long rwsem_atomic_update(long delta, struct rw_semaphore *sem)
++static inline long
++rwsem_atomic_update(long delta, struct rw_anon_semaphore *sem)
+ {
+ 	signed long old, new;
+ 
+@@ -378,10 +385,52 @@
+ 	return new;
+ }
+ 
+-static inline int rwsem_is_locked(struct rw_semaphore *sem)
++static inline int rwsem_is_locked(struct rw_anon_semaphore *sem)
+ {
+ 	return (sem->count != 0);
+ }
+ 
++struct rw_semaphore {
++	signed long		count;
++	spinlock_t		wait_lock;
++	struct list_head	wait_list;
++#ifdef CONFIG_DEBUG_LOCK_ALLOC
++	struct lockdep_map	dep_map;
++#endif
++};
++
++#ifdef CONFIG_DEBUG_LOCK_ALLOC
++# define __RWSEM_DEP_MAP_INIT(lockname) , .dep_map = { .name = #lockname }
++#else
++# define __RWSEM_DEP_MAP_INIT(lockname)
++#endif
++
++#define __RWSEM_INITIALIZER(name) \
++ { RWSEM_UNLOCKED_VALUE, __SPIN_LOCK_UNLOCKED((name).wait.lock), \
++   LIST_HEAD_INIT((name).wait_list) __RWSEM_DEP_MAP_INIT(name) }
++
++#define DECLARE_RWSEM(name) \
++	struct rw_anon_semaphore name = __RWSEM_INITIALIZER(name)
++
++static inline void init_rwsem(struct rw_anon_semaphore *sem)
++{
++	sem->count = RWSEM_UNLOCKED_VALUE;
++	spin_lock_init(&sem->wait_lock);
++	INIT_LIST_HEAD(&sem->wait_list);
++}
++
++static inline void __init_rwsem(struct rw_semaphore *sem, const char *name,
++				struct lock_class_key *key)
++{
++	__init_anon_rwsem((struct rw_anon_semaphore *)sem, name, key);
++}
++
++#define init_rwsem(sem)				\
++do {						\
++	static struct lock_class_key __key;	\
++						\
++	__init_rwsem((sem), #sem, &__key);	\
++} while (0)
++
+ #endif /* __KERNEL__ */
+ #endif /* _S390_RWSEM_H */
+Index: linux-rt-2.6.31/arch/s390/include/asm/thread_info.h
+===================================================================
+--- linux-rt-2.6.31.orig/arch/s390/include/asm/thread_info.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/s390/include/asm/thread_info.h	2010-05-17 14:23:19.928426689 +0200
+@@ -92,7 +92,7 @@
+ #define TIF_SYSCALL_TRACE	8	/* syscall trace active */
+ #define TIF_SYSCALL_AUDIT	9	/* syscall auditing active */
+ #define TIF_SECCOMP		10	/* secure computing */
+-#define TIF_SYSCALL_FTRACE	11	/* ftrace syscall instrumentation */
++#define TIF_SYSCALL_TRACEPOINT	11	/* syscall tracepoint instrumentation */
+ #define TIF_USEDFPU		16	/* FPU was used by this task this quantum (SMP) */
+ #define TIF_POLLING_NRFLAG	17	/* true if poll_idle() is polling 
+ 					   TIF_NEED_RESCHED */
+@@ -111,7 +111,7 @@
+ #define _TIF_SYSCALL_TRACE	(1<<TIF_SYSCALL_TRACE)
+ #define _TIF_SYSCALL_AUDIT	(1<<TIF_SYSCALL_AUDIT)
+ #define _TIF_SECCOMP		(1<<TIF_SECCOMP)
+-#define _TIF_SYSCALL_FTRACE	(1<<TIF_SYSCALL_FTRACE)
++#define _TIF_SYSCALL_TRACEPOINT	(1<<TIF_SYSCALL_TRACEPOINT)
+ #define _TIF_USEDFPU		(1<<TIF_USEDFPU)
+ #define _TIF_POLLING_NRFLAG	(1<<TIF_POLLING_NRFLAG)
+ #define _TIF_31BIT		(1<<TIF_31BIT)
+Index: linux-rt-2.6.31/arch/s390/kernel/entry.S
+===================================================================
+--- linux-rt-2.6.31.orig/arch/s390/kernel/entry.S	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/s390/kernel/entry.S	2010-05-17 14:23:19.928426689 +0200
+@@ -54,7 +54,7 @@
+ _TIF_WORK_INT = (_TIF_SIGPENDING | _TIF_NOTIFY_RESUME | _TIF_NEED_RESCHED | \
+ 		 _TIF_MCCK_PENDING)
+ _TIF_SYSCALL = (_TIF_SYSCALL_TRACE>>8 | _TIF_SYSCALL_AUDIT>>8 | \
+-		_TIF_SECCOMP>>8 | _TIF_SYSCALL_FTRACE>>8)
++		_TIF_SECCOMP>>8 | _TIF_SYSCALL_TRACEPOINT>>8)
+ 
+ STACK_SHIFT = PAGE_SHIFT + THREAD_ORDER
+ STACK_SIZE  = 1 << STACK_SHIFT
+Index: linux-rt-2.6.31/arch/s390/kernel/entry64.S
+===================================================================
+--- linux-rt-2.6.31.orig/arch/s390/kernel/entry64.S	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/s390/kernel/entry64.S	2010-05-17 14:23:19.928426689 +0200
+@@ -57,7 +57,7 @@
+ _TIF_WORK_INT = (_TIF_SIGPENDING | _TIF_NOTIFY_RESUME | _TIF_NEED_RESCHED | \
+ 		 _TIF_MCCK_PENDING)
+ _TIF_SYSCALL = (_TIF_SYSCALL_TRACE>>8 | _TIF_SYSCALL_AUDIT>>8 | \
+-		_TIF_SECCOMP>>8 | _TIF_SYSCALL_FTRACE>>8)
++		_TIF_SECCOMP>>8 | _TIF_SYSCALL_TRACEPOINT>>8)
+ 
+ #define BASED(name) name-system_call(%r13)
+ 
+Index: linux-rt-2.6.31/arch/s390/kernel/ftrace.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/s390/kernel/ftrace.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/s390/kernel/ftrace.c	2010-05-17 14:23:19.928426689 +0200
+@@ -220,6 +220,29 @@
+ 	return syscalls_metadata[nr];
+ }
+ 
++int syscall_name_to_nr(char *name)
++{
++	int i;
++
++	if (!syscalls_metadata)
++		return -1;
++	for (i = 0; i < NR_syscalls; i++)
++		if (syscalls_metadata[i])
++			if (!strcmp(syscalls_metadata[i]->name, name))
++				return i;
++	return -1;
++}
++
++void set_syscall_enter_id(int num, int id)
++{
++	syscalls_metadata[num]->enter_id = id;
++}
++
++void set_syscall_exit_id(int num, int id)
++{
++	syscalls_metadata[num]->exit_id = id;
++}
++
+ static struct syscall_metadata *find_syscall_meta(unsigned long syscall)
+ {
+ 	struct syscall_metadata *start;
+@@ -237,24 +260,19 @@
+ 	return NULL;
+ }
+ 
+-void arch_init_ftrace_syscalls(void)
++static int __init arch_init_ftrace_syscalls(void)
+ {
+ 	struct syscall_metadata *meta;
+ 	int i;
+-	static atomic_t refs;
+-
+-	if (atomic_inc_return(&refs) != 1)
+-		goto out;
+ 	syscalls_metadata = kzalloc(sizeof(*syscalls_metadata) * NR_syscalls,
+ 				    GFP_KERNEL);
+ 	if (!syscalls_metadata)
+-		goto out;
++		return -ENOMEM;
+ 	for (i = 0; i < NR_syscalls; i++) {
+ 		meta = find_syscall_meta((unsigned long)sys_call_table[i]);
+ 		syscalls_metadata[i] = meta;
+ 	}
+-	return;
+-out:
+-	atomic_dec(&refs);
++	return 0;
+ }
++arch_initcall(arch_init_ftrace_syscalls);
+ #endif
+Index: linux-rt-2.6.31/arch/s390/kernel/ptrace.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/s390/kernel/ptrace.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/s390/kernel/ptrace.c	2010-05-17 14:23:19.928426689 +0200
+@@ -51,6 +51,9 @@
+ #include "compat_ptrace.h"
+ #endif
+ 
++#define CREATE_TRACE_POINTS
++#include <trace/events/syscalls.h>
++
+ enum s390_regset {
+ 	REGSET_GENERAL,
+ 	REGSET_FP,
+@@ -661,8 +664,8 @@
+ 		ret = -1;
+ 	}
+ 
+-	if (unlikely(test_thread_flag(TIF_SYSCALL_FTRACE)))
+-		ftrace_syscall_enter(regs);
++	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
++		trace_sys_enter(regs, regs->gprs[2]);
+ 
+ 	if (unlikely(current->audit_context))
+ 		audit_syscall_entry(is_compat_task() ?
+@@ -679,8 +682,8 @@
+ 		audit_syscall_exit(AUDITSC_RESULT(regs->gprs[2]),
+ 				   regs->gprs[2]);
+ 
+-	if (unlikely(test_thread_flag(TIF_SYSCALL_FTRACE)))
+-		ftrace_syscall_exit(regs);
++	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
++		trace_sys_exit(regs, regs->gprs[2]);
+ 
+ 	if (test_thread_flag(TIF_SYSCALL_TRACE))
+ 		tracehook_report_syscall_exit(regs, 0);
+Index: linux-rt-2.6.31/arch/s390/kernel/time.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/s390/kernel/time.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/s390/kernel/time.c	2010-05-17 14:23:19.928426689 +0200
+@@ -272,14 +272,14 @@
+ 	 * small for /proc/uptime to be accurate.
+ 	 * Reset xtime and wall_to_monotonic to sane values.
+ 	 */
+-	write_seqlock_irqsave(&xtime_lock, flags);
++	write_atomic_seqlock_irqsave(&xtime_lock, flags);
+ 	now = get_clock();
+ 	tod_to_timeval(now - TOD_UNIX_EPOCH, &xtime);
+ 	clocksource_tod.cycle_last = now;
+ 	clocksource_tod.raw_time = xtime;
+ 	tod_to_timeval(sched_clock_base_cc - TOD_UNIX_EPOCH, &ts);
+ 	set_normalized_timespec(&wall_to_monotonic, -ts.tv_sec, -ts.tv_nsec);
+-	write_sequnlock_irqrestore(&xtime_lock, flags);
++	write_atomic_sequnlock_irqrestore(&xtime_lock, flags);
+ 
+ 	/* Enable TOD clock interrupts on the boot cpu. */
+ 	init_cpu_timer();
+Index: linux-rt-2.6.31/arch/sh/include/asm/rwsem.h
+===================================================================
+--- linux-rt-2.6.31.orig/arch/sh/include/asm/rwsem.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/sh/include/asm/rwsem.h	2010-05-17 14:23:19.928426689 +0200
+@@ -19,7 +19,7 @@
+ /*
+  * the semaphore definition
+  */
+-struct rw_semaphore {
++struct rw_anon_semaphore {
+ 	long		count;
+ #define RWSEM_UNLOCKED_VALUE		0x00000000
+ #define RWSEM_ACTIVE_BIAS		0x00000001
+@@ -35,35 +35,38 @@
+ };
+ 
+ #ifdef CONFIG_DEBUG_LOCK_ALLOC
+-# define __RWSEM_DEP_MAP_INIT(lockname) , .dep_map = { .name = #lockname }
++# define __RWSEM_ANON_DEP_MAP_INIT(lockname) , .dep_map = { .name = #lockname }
+ #else
+-# define __RWSEM_DEP_MAP_INIT(lockname)
++# define __RWSEM_ANON_DEP_MAP_INIT(lockname)
+ #endif
+ 
+-#define __RWSEM_INITIALIZER(name) \
++#define __RWSEM_ANON_INITIALIZER(name) \
+ 	{ RWSEM_UNLOCKED_VALUE, SPIN_LOCK_UNLOCKED, \
+ 	  LIST_HEAD_INIT((name).wait_list) \
+-	  __RWSEM_DEP_MAP_INIT(name) }
++	  __RWSEM_ANON_DEP_MAP_INIT(name) }
+ 
+-#define DECLARE_RWSEM(name)		\
+-	struct rw_semaphore name = __RWSEM_INITIALIZER(name)
++#define DECLARE_ANON_RWSEM(name)		\
++	struct rw_anon_semaphore name = __RWSEM_ANON_INITIALIZER(name)
+ 
+-extern struct rw_semaphore *rwsem_down_read_failed(struct rw_semaphore *sem);
+-extern struct rw_semaphore *rwsem_down_write_failed(struct rw_semaphore *sem);
+-extern struct rw_semaphore *rwsem_wake(struct rw_semaphore *sem);
+-extern struct rw_semaphore *rwsem_downgrade_wake(struct rw_semaphore *sem);
++extern struct rw_anon_semaphore *
++rwsem_down_read_failed(struct rw_anon_semaphore *sem);
++extern struct rw_anon_semaphore *
++rwsem_down_write_failed(struct rw_anon_semaphore *sem);
++extern struct rw_anon_semaphore *rwsem_wake(struct rw_anon_semaphore *sem);
++extern struct rw_anon_semaphore *
++rwsem_downgrade_wake(struct rw_anon_semaphore *sem);
+ 
+-extern void __init_rwsem(struct rw_semaphore *sem, const char *name,
+-			 struct lock_class_key *key);
++extern void __init_anon_rwsem(struct rw_anon_semaphore *sem, const char *name,
++			      struct lock_class_key *key);
+ 
+-#define init_rwsem(sem)				\
++#define init_anon_rwsem(sem)			\
+ do {						\
+ 	static struct lock_class_key __key;	\
+ 						\
+-	__init_rwsem((sem), #sem, &__key);	\
++	__init_anon_rwsem((sem), #sem, &__key);	\
+ } while (0)
+ 
+-static inline void init_rwsem(struct rw_semaphore *sem)
++static inline void init_anon_rwsem(struct rw_anon_semaphore *sem)
+ {
+ 	sem->count = RWSEM_UNLOCKED_VALUE;
+ 	spin_lock_init(&sem->wait_lock);
+@@ -73,7 +76,7 @@
+ /*
+  * lock for reading
+  */
+-static inline void __down_read(struct rw_semaphore *sem)
++static inline void __down_read(struct rw_anon_semaphore *sem)
+ {
+ 	if (atomic_inc_return((atomic_t *)(&sem->count)) > 0)
+ 		smp_wmb();
+@@ -81,7 +84,7 @@
+ 		rwsem_down_read_failed(sem);
+ }
+ 
+-static inline int __down_read_trylock(struct rw_semaphore *sem)
++static inline int __down_read_trylock(struct rw_anon_semaphore *sem)
+ {
+ 	int tmp;
+ 
+@@ -98,7 +101,7 @@
+ /*
+  * lock for writing
+  */
+-static inline void __down_write(struct rw_semaphore *sem)
++static inline void __down_write(struct rw_anon_semaphore *sem)
+ {
+ 	int tmp;
+ 
+@@ -110,7 +113,7 @@
+ 		rwsem_down_write_failed(sem);
+ }
+ 
+-static inline int __down_write_trylock(struct rw_semaphore *sem)
++static inline int __down_write_trylock(struct rw_anon_semaphore *sem)
+ {
+ 	int tmp;
+ 
+@@ -123,7 +126,7 @@
+ /*
+  * unlock after reading
+  */
+-static inline void __up_read(struct rw_semaphore *sem)
++static inline void __up_read(struct rw_anon_semaphore *sem)
+ {
+ 	int tmp;
+ 
+@@ -136,7 +139,7 @@
+ /*
+  * unlock after writing
+  */
+-static inline void __up_write(struct rw_semaphore *sem)
++static inline void __up_write(struct rw_anon_semaphore *sem)
+ {
+ 	smp_wmb();
+ 	if (atomic_sub_return(RWSEM_ACTIVE_WRITE_BIAS,
+@@ -147,7 +150,7 @@
+ /*
+  * implement atomic add functionality
+  */
+-static inline void rwsem_atomic_add(int delta, struct rw_semaphore *sem)
++static inline void rwsem_atomic_add(int delta, struct rw_anon_semaphore *sem)
+ {
+ 	atomic_add(delta, (atomic_t *)(&sem->count));
+ }
+@@ -155,7 +158,7 @@
+ /*
+  * downgrade write lock to read lock
+  */
+-static inline void __downgrade_write(struct rw_semaphore *sem)
++static inline void __downgrade_write(struct rw_anon_semaphore *sem)
+ {
+ 	int tmp;
+ 
+@@ -165,7 +168,8 @@
+ 		rwsem_downgrade_wake(sem);
+ }
+ 
+-static inline void __down_write_nested(struct rw_semaphore *sem, int subclass)
++static inline void
++ __down_write_nested(struct rw_anon_semaphore *sem, int subclass)
+ {
+ 	__down_write(sem);
+ }
+@@ -173,12 +177,60 @@
+ /*
+  * implement exchange and add functionality
+  */
+-static inline int rwsem_atomic_update(int delta, struct rw_semaphore *sem)
++static inline int rwsem_atomic_update(int delta, struct rw_anon_semaphore *sem)
+ {
+ 	smp_mb();
+ 	return atomic_add_return(delta, (atomic_t *)(&sem->count));
+ }
+ 
++static inline int anon_rwsem_is_locked(struct rw_anon_semaphore *sem)
++{
++	return (sem->count != 0);
++}
++
++struct rw_semaphore {
++	long		count;
++	spinlock_t		wait_lock;
++	struct list_head	wait_list;
++#ifdef CONFIG_DEBUG_LOCK_ALLOC
++	struct lockdep_map	dep_map;
++#endif
++};
++
++#ifdef CONFIG_DEBUG_LOCK_ALLOC
++# define __RWSEM_DEP_MAP_INIT(lockname) , .dep_map = { .name = #lockname }
++#else
++# define __RWSEM_DEP_MAP_INIT(lockname)
++#endif
++
++#define __RWSEM_INITIALIZER(name) \
++	{ RWSEM_UNLOCKED_VALUE, SPIN_LOCK_UNLOCKED, \
++	  LIST_HEAD_INIT((name).wait_list) \
++	  __RWSEM_DEP_MAP_INIT(name) }
++
++#define DECLARE_RWSEM(name)		\
++	struct rw_semaphore name = __RWSEM_INITIALIZER(name)
++
++static inline void __init_rwsem(struct rw_semaphore *sem, const char *name,
++				struct lock_class_key *key)
++{
++	__init_anon_rwsem((struct rw_anon_semaphore *)sem, name, key);
++}
++
++#define init_rwsem(sem)				\
++do {						\
++	static struct lock_class_key __key;	\
++						\
++	__init_rwsem((sem), #sem, &__key);	\
++} while (0)
++
++static inline void init_rwsem(struct rw_semaphore *sem)
++{
++	sem->count = RWSEM_UNLOCKED_VALUE;
++	spin_lock_init(&sem->wait_lock);
++	INIT_LIST_HEAD(&sem->wait_list);
++}
++
+ static inline int rwsem_is_locked(struct rw_semaphore *sem)
+ {
+ 	return (sem->count != 0);
+Index: linux-rt-2.6.31/arch/sh/kernel/irq.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/sh/kernel/irq.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/sh/kernel/irq.c	2010-05-17 14:23:19.928426689 +0200
+@@ -1,4 +1,4 @@
+-/*
++1/*
+  * linux/arch/sh/kernel/irq.c
+  *
+  *	Copyright (C) 1992, 1998 Linus Torvalds, Ingo Molnar
+@@ -67,7 +67,7 @@
+ 	if (!desc)
+ 		return 0;
+ 
+-	spin_lock_irqsave(&desc->lock, flags);
++	atomic_spin_lock_irqsave(&desc->lock, flags);
+ 	for_each_online_cpu(j)
+ 		any_count |= kstat_irqs_cpu(i, j);
+ 	action = desc->action;
+@@ -88,7 +88,7 @@
+ 
+ 	seq_putc(p, '\n');
+ out:
+-	spin_unlock_irqrestore(&desc->lock, flags);
++	atomic_spin_unlock_irqrestore(&desc->lock, flags);
+ 	return 0;
+ }
+ #endif
+Index: linux-rt-2.6.31/arch/sparc/include/asm/rwsem.h
+===================================================================
+--- linux-rt-2.6.31.orig/arch/sparc/include/asm/rwsem.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/sparc/include/asm/rwsem.h	2010-05-17 14:23:19.928426689 +0200
+@@ -19,7 +19,7 @@
+ 
+ struct rwsem_waiter;
+ 
+-struct rw_semaphore {
++struct rw_anon_semaphore {
+ 	signed int count;
+ 	spinlock_t		wait_lock;
+ 	struct list_head	wait_list;
+@@ -29,51 +29,92 @@
+ };
+ 
+ #ifdef CONFIG_DEBUG_LOCK_ALLOC
+-# define __RWSEM_DEP_MAP_INIT(lockname) , .dep_map = { .name = #lockname }
++# define __RWSEM_ANON_DEP_MAP_INIT(lockname) , .dep_map = { .name = #lockname }
+ #else
+-# define __RWSEM_DEP_MAP_INIT(lockname)
++# define __RWSEM_ANON_DEP_MAP_INIT(lockname)
+ #endif
+ 
+-#define __RWSEM_INITIALIZER(name) \
++#define __RWSEMANON__INITIALIZER(name) \
+ { RWSEM_UNLOCKED_VALUE, SPIN_LOCK_UNLOCKED, LIST_HEAD_INIT((name).wait_list) \
+-  __RWSEM_DEP_MAP_INIT(name) }
++  __RWSEM_ANON_DEP_MAP_INIT(name) }
+ 
+-#define DECLARE_RWSEM(name) \
+-	struct rw_semaphore name = __RWSEM_INITIALIZER(name)
++#define DECLARE_ANON_RWSEM(name) \
++	struct rw_anon_semaphore name = __RWSEM_ANON_INITIALIZER(name)
+ 
+-extern void __init_rwsem(struct rw_semaphore *sem, const char *name,
+-			 struct lock_class_key *key);
++extern void __init_anon_rwsem(struct rw_anon_semaphore *sem, const char *name,
++			      struct lock_class_key *key);
+ 
+-#define init_rwsem(sem)						\
++#define init_anon_rwsem(sem)					\
+ do {								\
+ 	static struct lock_class_key __key;			\
+ 								\
+-	__init_rwsem((sem), #sem, &__key);			\
++	__init_anon_rwsem((sem), #sem, &__key);			\
+ } while (0)
+ 
+-extern void __down_read(struct rw_semaphore *sem);
+-extern int __down_read_trylock(struct rw_semaphore *sem);
+-extern void __down_write(struct rw_semaphore *sem);
+-extern int __down_write_trylock(struct rw_semaphore *sem);
+-extern void __up_read(struct rw_semaphore *sem);
+-extern void __up_write(struct rw_semaphore *sem);
+-extern void __downgrade_write(struct rw_semaphore *sem);
++extern void __down_read(struct rw_anon_semaphore *sem);
++extern int __down_read_trylock(struct rw_anon_semaphore *sem);
++extern void __down_write(struct rw_anon_semaphore *sem);
++extern int __down_write_trylock(struct rw_anon_semaphore *sem);
++extern void __up_read(struct rw_anon_semaphore *sem);
++extern void __up_write(struct rw_anon_semaphore *sem);
++extern void __downgrade_write(struct rw_anon_semaphore *sem);
+ 
+-static inline void __down_write_nested(struct rw_semaphore *sem, int subclass)
++static inline void
++__down_write_nested(struct rw_anon_semaphore *sem, int subclass)
+ {
+ 	__down_write(sem);
+ }
+ 
+-static inline int rwsem_atomic_update(int delta, struct rw_semaphore *sem)
++static inline int rwsem_atomic_update(int delta, struct rw_anon_semaphore *sem)
+ {
+ 	return atomic_add_return(delta, (atomic_t *)(&sem->count));
+ }
+ 
+-static inline void rwsem_atomic_add(int delta, struct rw_semaphore *sem)
++static inline void rwsem_atomic_add(int delta, struct rw_anon_semaphore *sem)
+ {
+ 	atomic_add(delta, (atomic_t *)(&sem->count));
+ }
+ 
++static inline int anon_rwsem_is_locked(struct rw_semaphore *sem)
++{
++	return (sem->count != 0);
++}
++
++struct rw_semaphore {
++	signed int count;
++	spinlock_t		wait_lock;
++	struct list_head	wait_list;
++#ifdef CONFIG_DEBUG_LOCK_ALLOC
++	struct lockdep_map	dep_map;
++#endif
++};
++
++#ifdef CONFIG_DEBUG_LOCK_ALLOC
++# define __RWSEM_DEP_MAP_INIT(lockname) , .dep_map = { .name = #lockname }
++#else
++# define __RWSEM_DEP_MAP_INIT(lockname)
++#endif
++
++#define __RWSEM_INITIALIZER(name) \
++{ RWSEM_UNLOCKED_VALUE, SPIN_LOCK_UNLOCKED, LIST_HEAD_INIT((name).wait_list) \
++  __RWSEM_DEP_MAP_INIT(name) }
++
++#define DECLARE_RWSEM(name) \
++	struct rw_semaphore name = __RWSEM_INITIALIZER(name)
++
++static inline void __init_rwsem(struct rw_semaphore *sem, const char *name,
++				struct lock_class_key *key)
++{
++	__init_anon_rwsem((struct rw_anon_semaphore *)sem, name, key);
++}
++
++#define init_rwsem(sem)						\
++do {								\
++	static struct lock_class_key __key;			\
++								\
++	__init_rwsem((sem), #sem, &__key);			\
++} while (0)
++
+ static inline int rwsem_is_locked(struct rw_semaphore *sem)
+ {
+ 	return (sem->count != 0);
+Index: linux-rt-2.6.31/arch/sparc/kernel/irq_64.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/sparc/kernel/irq_64.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/sparc/kernel/irq_64.c	2010-05-17 14:23:19.928426689 +0200
+@@ -176,7 +176,7 @@
+ 	}
+ 
+ 	if (i < NR_IRQS) {
+-		spin_lock_irqsave(&irq_desc[i].lock, flags);
++		atomic_spin_lock_irqsave(&irq_desc[i].lock, flags);
+ 		action = irq_desc[i].action;
+ 		if (!action)
+ 			goto skip;
+@@ -195,7 +195,7 @@
+ 
+ 		seq_putc(p, '\n');
+ skip:
+-		spin_unlock_irqrestore(&irq_desc[i].lock, flags);
++		atomic_spin_unlock_irqrestore(&irq_desc[i].lock, flags);
+ 	} else if (i == NR_IRQS) {
+ 		seq_printf(p, "NMI: ");
+ 		for_each_online_cpu(j)
+@@ -785,14 +785,14 @@
+ 	for (irq = 0; irq < NR_IRQS; irq++) {
+ 		unsigned long flags;
+ 
+-		spin_lock_irqsave(&irq_desc[irq].lock, flags);
++		atomic_spin_lock_irqsave(&irq_desc[irq].lock, flags);
+ 		if (irq_desc[irq].action &&
+ 		    !(irq_desc[irq].status & IRQ_PER_CPU)) {
+ 			if (irq_desc[irq].chip->set_affinity)
+ 				irq_desc[irq].chip->set_affinity(irq,
+ 					irq_desc[irq].affinity);
+ 		}
+-		spin_unlock_irqrestore(&irq_desc[irq].lock, flags);
++		atomic_spin_unlock_irqrestore(&irq_desc[irq].lock, flags);
+ 	}
+ 
+ 	tick_ops->disable_irq();
+Index: linux-rt-2.6.31/arch/sparc/kernel/pcic.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/sparc/kernel/pcic.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/sparc/kernel/pcic.c	2010-05-17 14:23:19.928426689 +0200
+@@ -703,10 +703,10 @@
+ 
+ static irqreturn_t pcic_timer_handler (int irq, void *h)
+ {
+-	write_seqlock(&xtime_lock);	/* Dummy, to show that we remember */
++	write_atomic_seqlock(&xtime_lock); /* Dummy, to show that we remember */
+ 	pcic_clear_clock_irq();
+ 	do_timer(1);
+-	write_sequnlock(&xtime_lock);
++	write_atomic_sequnlock(&xtime_lock);
+ #ifndef CONFIG_SMP
+ 	update_process_times(user_mode(get_irq_regs()));
+ #endif
+@@ -766,7 +766,7 @@
+ 	unsigned long max_ntp_tick = tick_usec - tickadj;
+ 
+ 	do {
+-		seq = read_seqbegin_irqsave(&xtime_lock, flags);
++		seq = read_atomic_seqbegin_irqsave(&xtime_lock, flags);
+ 		usec = do_gettimeoffset();
+ 
+ 		/*
+@@ -779,7 +779,7 @@
+ 
+ 		sec = xtime.tv_sec;
+ 		usec += (xtime.tv_nsec / 1000);
+-	} while (read_seqretry_irqrestore(&xtime_lock, seq, flags));
++	} while (read_atomic_seqretry_irqrestore(&xtime_lock, seq, flags));
+ 
+ 	while (usec >= 1000000) {
+ 		usec -= 1000000;
+Index: linux-rt-2.6.31/arch/sparc/kernel/time_32.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/sparc/kernel/time_32.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/sparc/kernel/time_32.c	2010-05-17 14:23:19.938538240 +0200
+@@ -93,7 +93,7 @@
+ #endif
+ 
+ 	/* Protect counter clear so that do_gettimeoffset works */
+-	write_seqlock(&xtime_lock);
++	write_atomic_seqlock(&xtime_lock);
+ 
+ 	clear_clock_irq();
+ 
+@@ -109,7 +109,7 @@
+ 	  else
+ 	    last_rtc_update = xtime.tv_sec - 600; /* do it again in 60 s */
+ 	}
+-	write_sequnlock(&xtime_lock);
++	write_atomic_sequnlock(&xtime_lock);
+ 
+ #ifndef CONFIG_SMP
+ 	update_process_times(user_mode(get_irq_regs()));
+@@ -251,7 +251,7 @@
+ 	unsigned long max_ntp_tick = tick_usec - tickadj;
+ 
+ 	do {
+-		seq = read_seqbegin_irqsave(&xtime_lock, flags);
++		seq = read_atomic_seqbegin_irqsave(&xtime_lock, flags);
+ 		usec = do_gettimeoffset();
+ 
+ 		/*
+@@ -264,7 +264,7 @@
+ 
+ 		sec = xtime.tv_sec;
+ 		usec += (xtime.tv_nsec / 1000);
+-	} while (read_seqretry_irqrestore(&xtime_lock, seq, flags));
++	} while (read_atomic_seqretry_irqrestore(&xtime_lock, seq, flags));
+ 
+ 	while (usec >= 1000000) {
+ 		usec -= 1000000;
+@@ -281,9 +281,9 @@
+ {
+ 	int ret;
+ 
+-	write_seqlock_irq(&xtime_lock);
++	write_atomic_seqlock_irq(&xtime_lock);
+ 	ret = bus_do_settimeofday(tv);
+-	write_sequnlock_irq(&xtime_lock);
++	write_atomic_sequnlock_irq(&xtime_lock);
+ 	clock_was_set();
+ 	return ret;
+ }
+Index: linux-rt-2.6.31/arch/sparc/mm/highmem.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/sparc/mm/highmem.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/sparc/mm/highmem.c	2010-05-17 14:23:19.938538240 +0200
+@@ -34,7 +34,7 @@
+ 	unsigned long idx;
+ 	unsigned long vaddr;
+ 
+-	/* even !CONFIG_PREEMPT needs this, for in_atomic in do_page_fault */
++	preempt_disable();
+ 	pagefault_disable();
+ 	if (!PageHighMem(page))
+ 		return page_address(page);
+@@ -73,6 +73,7 @@
+ 
+ 	if (vaddr < FIXADDR_START) { // FIXME
+ 		pagefault_enable();
++		preempt_enable();
+ 		return;
+ 	}
+ 
+@@ -99,6 +100,7 @@
+ #endif
+ 
+ 	pagefault_enable();
++	preempt_enable();
+ }
+ EXPORT_SYMBOL(kunmap_atomic);
+ 
+Index: linux-rt-2.6.31/arch/um/kernel/irq.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/um/kernel/irq.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/um/kernel/irq.c	2010-05-17 14:23:19.938538240 +0200
+@@ -33,7 +33,7 @@
+ 	}
+ 
+ 	if (i < NR_IRQS) {
+-		spin_lock_irqsave(&irq_desc[i].lock, flags);
++		atomic_spin_lock_irqsave(&irq_desc[i].lock, flags);
+ 		action = irq_desc[i].action;
+ 		if (!action)
+ 			goto skip;
+@@ -52,7 +52,7 @@
+ 
+ 		seq_putc(p, '\n');
+ skip:
+-		spin_unlock_irqrestore(&irq_desc[i].lock, flags);
++		atomic_spin_unlock_irqrestore(&irq_desc[i].lock, flags);
+ 	} else if (i == NR_IRQS)
+ 		seq_putc(p, '\n');
+ 
+Index: linux-rt-2.6.31/arch/x86/Kconfig
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/Kconfig	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/Kconfig	2010-05-17 14:23:19.938538240 +0200
+@@ -38,7 +38,7 @@
+ 	select HAVE_FUNCTION_GRAPH_FP_TEST
+ 	select HAVE_FUNCTION_TRACE_MCOUNT_TEST
+ 	select HAVE_FTRACE_NMI_ENTER if DYNAMIC_FTRACE
+-	select HAVE_FTRACE_SYSCALLS
++	select HAVE_SYSCALL_TRACEPOINTS
+ 	select HAVE_KVM
+ 	select HAVE_ARCH_KGDB
+ 	select HAVE_ARCH_TRACEHOOK
+@@ -123,10 +123,18 @@
+ 	def_bool y
+ 
+ config RWSEM_GENERIC_SPINLOCK
+-	def_bool !X86_XADD
++	bool
++	depends on !X86_XADD || PREEMPT_RT
++	default y
++
++config ASM_SEMAPHORES
++	bool
++	default y
+ 
+ config RWSEM_XCHGADD_ALGORITHM
+-	def_bool X86_XADD
++	bool
++	depends on X86_XADD && !RWSEM_GENERIC_SPINLOCK && !PREEMPT_RT
++	default y
+ 
+ config ARCH_HAS_CPU_IDLE_WAIT
+ 	def_bool y
+@@ -273,6 +281,7 @@
+ config SPARSE_IRQ
+ 	bool "Support sparse irq numbering"
+ 	depends on PCI_MSI || HT_IRQ
++	depends on !PREEMPT_RT
+ 	---help---
+ 	  This enables support for sparse irqs. This is useful for distro
+ 	  kernels that want to define a high CONFIG_NR_CPUS value but still
+@@ -678,7 +687,7 @@
+ 
+ config MAXSMP
+ 	bool "Configure Maximum number of SMP Processors and NUMA Nodes"
+-	depends on X86_64 && SMP && DEBUG_KERNEL && EXPERIMENTAL
++	depends on 0 && X86_64 && SMP && DEBUG_KERNEL && EXPERIMENTAL
+ 	select CPUMASK_OFFSTACK
+ 	default n
+ 	---help---
+@@ -1900,7 +1909,7 @@
+ 
+ config DMAR
+ 	bool "Support for DMA Remapping Devices (EXPERIMENTAL)"
+-	depends on PCI_MSI && ACPI && EXPERIMENTAL
++	depends on PCI_MSI && ACPI && EXPERIMENTAL && !PREEMPT_RT
+ 	help
+ 	  DMA remapping (DMAR) devices support enables independent address
+ 	  translations for Direct Memory Access (DMA) from devices.
+@@ -1943,6 +1952,7 @@
+ config INTR_REMAP
+ 	bool "Support for Interrupt Remapping (EXPERIMENTAL)"
+ 	depends on X86_64 && X86_IO_APIC && PCI_MSI && ACPI && EXPERIMENTAL
++	depends on !PREEMPT_RT
+ 	---help---
+ 	  Supports Interrupt remapping for IO-APIC and MSI devices.
+ 	  To use x2apic mode in the CPU's which support x2APIC enhancements or
+Index: linux-rt-2.6.31/arch/x86/Kconfig.debug
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/Kconfig.debug	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/Kconfig.debug	2010-05-17 14:23:19.938538240 +0200
+@@ -76,6 +76,7 @@
+ 	bool "Debug access to per_cpu maps"
+ 	depends on DEBUG_KERNEL
+ 	depends on SMP
++	depends on !PREEMPT_RT
+ 	default n
+ 	---help---
+ 	  Say Y to verify that the per_cpu map being accessed has
+@@ -126,6 +127,7 @@
+ config 4KSTACKS
+ 	bool "Use 4Kb for kernel stacks instead of 8Kb"
+ 	depends on X86_32
++	default y
+ 	---help---
+ 	  If you say Y here the kernel will use a 4Kb stacksize for the
+ 	  kernel stack attached to each process/thread. This facilitates
+Index: linux-rt-2.6.31/arch/x86/configs/i386_defconfig
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/configs/i386_defconfig	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/configs/i386_defconfig	2010-05-17 14:23:19.938538240 +0200
+@@ -2355,7 +2355,7 @@
+ CONFIG_HAVE_DYNAMIC_FTRACE=y
+ CONFIG_HAVE_FTRACE_MCOUNT_RECORD=y
+ CONFIG_HAVE_HW_BRANCH_TRACER=y
+-CONFIG_HAVE_FTRACE_SYSCALLS=y
++CONFIG_HAVE_SYSCALL_TRACEPOINTS=y
+ CONFIG_RING_BUFFER=y
+ CONFIG_TRACING=y
+ CONFIG_TRACING_SUPPORT=y
+Index: linux-rt-2.6.31/arch/x86/configs/x86_64_defconfig
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/configs/x86_64_defconfig	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/configs/x86_64_defconfig	2010-05-17 14:23:19.938538240 +0200
+@@ -2329,7 +2329,7 @@
+ CONFIG_HAVE_DYNAMIC_FTRACE=y
+ CONFIG_HAVE_FTRACE_MCOUNT_RECORD=y
+ CONFIG_HAVE_HW_BRANCH_TRACER=y
+-CONFIG_HAVE_FTRACE_SYSCALLS=y
++CONFIG_HAVE_SYSCALL_TRACEPOINTS=y
+ CONFIG_RING_BUFFER=y
+ CONFIG_TRACING=y
+ CONFIG_TRACING_SUPPORT=y
+Index: linux-rt-2.6.31/arch/x86/include/asm/acpi.h
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/include/asm/acpi.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/include/asm/acpi.h	2010-05-17 14:23:19.938538240 +0200
+@@ -50,8 +50,8 @@
+ 
+ #define ACPI_ASM_MACROS
+ #define BREAKPOINT3
+-#define ACPI_DISABLE_IRQS() local_irq_disable()
+-#define ACPI_ENABLE_IRQS()  local_irq_enable()
++#define ACPI_DISABLE_IRQS() local_irq_disable_nort()
++#define ACPI_ENABLE_IRQS()  local_irq_enable_nort()
+ #define ACPI_FLUSH_CPU_CACHE()	wbinvd()
+ 
+ int __acpi_acquire_global_lock(unsigned int *lock);
+Index: linux-rt-2.6.31/arch/x86/include/asm/atomic_32.h
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/include/asm/atomic_32.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/include/asm/atomic_32.h	2010-05-17 14:23:19.938538240 +0200
+@@ -186,10 +186,10 @@
+ 
+ #ifdef CONFIG_M386
+ no_xadd: /* Legacy 386 processor */
+-	local_irq_save(flags);
++	raw_local_irq_save(flags);
+ 	__i = atomic_read(v);
+ 	atomic_set(v, i + __i);
+-	local_irq_restore(flags);
++	raw_local_irq_restore(flags);
+ 	return i + __i;
+ #endif
+ }
+Index: linux-rt-2.6.31/arch/x86/include/asm/cpufeature.h
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/include/asm/cpufeature.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/include/asm/cpufeature.h	2010-05-17 14:23:19.938538240 +0200
+@@ -95,6 +95,7 @@
+ #define X86_FEATURE_NONSTOP_TSC	(3*32+24) /* TSC does not stop in C states */
+ #define X86_FEATURE_CLFLUSH_MONITOR (3*32+25) /* "" clflush reqd with monitor */
+ #define X86_FEATURE_EXTD_APICID	(3*32+26) /* has extended APICID (8 bits) */
++#define X86_FEATURE_APERFMPERF	(3*32+27) /* APERFMPERF */
+ 
+ /* Intel-defined CPU features, CPUID level 0x00000001 (ecx), word 4 */
+ #define X86_FEATURE_XMM3	(4*32+ 0) /* "pni" SSE-3 */
+Index: linux-rt-2.6.31/arch/x86/include/asm/ftrace.h
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/include/asm/ftrace.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/include/asm/ftrace.h	2010-05-17 14:23:19.938538240 +0200
+@@ -28,13 +28,6 @@
+ 
+ #endif
+ 
+-/* FIXME: I don't want to stay hardcoded */
+-#ifdef CONFIG_X86_64
+-# define FTRACE_SYSCALL_MAX     296
+-#else
+-# define FTRACE_SYSCALL_MAX     333
+-#endif
+-
+ #ifdef CONFIG_FUNCTION_TRACER
+ #define MCOUNT_ADDR		((long)(mcount))
+ #define MCOUNT_INSN_SIZE	5 /* sizeof mcount call */
+Index: linux-rt-2.6.31/arch/x86/include/asm/highmem.h
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/include/asm/highmem.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/include/asm/highmem.h	2010-05-17 14:23:19.938538240 +0200
+@@ -58,16 +58,22 @@
+ extern void kunmap_high(struct page *page);
+ 
+ void *kmap(struct page *page);
++extern void kunmap_virt(void *ptr);
++extern struct page *kmap_to_page(void *ptr);
+ void kunmap(struct page *page);
+-void *kmap_atomic_prot(struct page *page, enum km_type type, pgprot_t prot);
+-void *kmap_atomic(struct page *page, enum km_type type);
+-void kunmap_atomic(void *kvaddr, enum km_type type);
+-void *kmap_atomic_pfn(unsigned long pfn, enum km_type type);
++
++void *__kmap_atomic_prot(struct page *page, enum km_type type, pgprot_t prot);
++void *__kmap_atomic(struct page *page, enum km_type type);
++void *__kmap_atomic_direct(struct page *page, enum km_type type);
++void __kunmap_atomic(void *kvaddr, enum km_type type);
++void *__kmap_atomic_pfn(unsigned long pfn, enum km_type type);
++struct page *__kmap_atomic_to_page(void *ptr);
++
+ void *kmap_atomic_prot_pfn(unsigned long pfn, enum km_type type, pgprot_t prot);
+-struct page *kmap_atomic_to_page(void *ptr);
+ 
+ #ifndef CONFIG_PARAVIRT
+-#define kmap_atomic_pte(page, type)	kmap_atomic(page, type)
++#define kmap_atomic_pte(page, type)		kmap_atomic(page, type)
++#define kmap_atomic_pte_direct(page, type)	kmap_atomic_direct(page, type)
+ #endif
+ 
+ #define flush_cache_kmaps()	do { } while (0)
+@@ -75,6 +81,27 @@
+ extern void add_highpages_with_active_regions(int nid, unsigned long start_pfn,
+ 					unsigned long end_pfn);
+ 
++/*
++ * on PREEMPT_RT kmap_atomic() is a wrapper that uses kmap():
++ */
++#ifdef CONFIG_PREEMPT_RT
++# define kmap_atomic_prot(page, type, prot)	({ pagefault_disable(); kmap(page); })
++# define kmap_atomic(page, type)	({ pagefault_disable(); kmap(page); })
++# define kmap_atomic_pfn(pfn, type)	kmap(pfn_to_page(pfn))
++# define kunmap_atomic(kvaddr, type)	do { pagefault_enable(); kunmap_virt(kvaddr); } while(0)
++# define kmap_atomic_to_page(kvaddr)	kmap_to_page(kvaddr)
++# define kmap_atomic_direct(page, type)	__kmap_atomic_direct(page, type)
++# define kunmap_atomic_direct(kvaddr, type)	__kunmap_atomic(kvaddr, type)
++#else
++# define kmap_atomic_prot(page, type, prot)	__kmap_atomic_prot(page, type, prot)
++# define kmap_atomic(page, type)	__kmap_atomic(page, type)
++# define kmap_atomic_pfn(pfn, type)	__kmap_atomic_pfn(pfn, type)
++# define kunmap_atomic(kvaddr, type)	__kunmap_atomic(kvaddr, type)
++# define kmap_atomic_to_page(kvaddr)	__kmap_atomic_to_page(kvaddr)
++# define kmap_atomic_direct(page, type)	__kmap_atomic(page, type)
++# define kunmap_atomic_direct(kvaddr, type)	__kunmap_atomic(kvaddr, type)
++#endif
++
+ #endif /* __KERNEL__ */
+ 
+ #endif /* _ASM_X86_HIGHMEM_H */
+Index: linux-rt-2.6.31/arch/x86/include/asm/i8253.h
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/include/asm/i8253.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/include/asm/i8253.h	2010-05-17 14:23:19.938538240 +0200
+@@ -6,7 +6,7 @@
+ #define PIT_CH0			0x40
+ #define PIT_CH2			0x42
+ 
+-extern spinlock_t i8253_lock;
++extern atomic_spinlock_t i8253_lock;
+ 
+ extern struct clock_event_device *global_clock_event;
+ 
+Index: linux-rt-2.6.31/arch/x86/include/asm/i8259.h
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/include/asm/i8259.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/include/asm/i8259.h	2010-05-17 14:23:19.938538240 +0200
+@@ -24,7 +24,7 @@
+ #define SLAVE_ICW4_DEFAULT	0x01
+ #define PIC_ICW4_AEOI		2
+ 
+-extern spinlock_t i8259A_lock;
++extern atomic_spinlock_t i8259A_lock;
+ 
+ extern void init_8259A(int auto_eoi);
+ extern void enable_8259A_irq(unsigned int irq);
+Index: linux-rt-2.6.31/arch/x86/include/asm/nops.h
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/include/asm/nops.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/include/asm/nops.h	2010-05-17 14:23:19.938538240 +0200
+@@ -65,6 +65,8 @@
+    6: osp nopl 0x00(%eax,%eax,1)
+    7: nopl 0x00000000(%eax)
+    8: nopl 0x00000000(%eax,%eax,1)
++   Note: All the above are assumed to be a single instruction.
++	There is kernel code that depends on this.
+ */
+ #define P6_NOP1	GENERIC_NOP1
+ #define P6_NOP2	".byte 0x66,0x90\n"
+Index: linux-rt-2.6.31/arch/x86/include/asm/page_64_types.h
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/include/asm/page_64_types.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/include/asm/page_64_types.h	2010-05-17 14:23:19.938538240 +0200
+@@ -14,12 +14,21 @@
+ #define IRQ_STACK_ORDER 2
+ #define IRQ_STACK_SIZE (PAGE_SIZE << IRQ_STACK_ORDER)
+ 
+-#define STACKFAULT_STACK 1
+-#define DOUBLEFAULT_STACK 2
+-#define NMI_STACK 3
+-#define DEBUG_STACK 4
+-#define MCE_STACK 5
+-#define N_EXCEPTION_STACKS 5  /* hw limit: 7 */
++#ifdef CONFIG_PREEMPT_RT
++# define STACKFAULT_STACK 0
++# define DOUBLEFAULT_STACK 1
++# define NMI_STACK 2
++# define DEBUG_STACK 0
++# define MCE_STACK 3
++# define N_EXCEPTION_STACKS 3  /* hw limit: 7 */
++#else
++# define STACKFAULT_STACK 1
++# define DOUBLEFAULT_STACK 2
++# define NMI_STACK 3
++# define DEBUG_STACK 4
++# define MCE_STACK 5
++# define N_EXCEPTION_STACKS 5  /* hw limit: 7 */
++#endif
+ 
+ #define PUD_PAGE_SIZE		(_AC(1, UL) << PUD_SHIFT)
+ #define PUD_PAGE_MASK		(~(PUD_PAGE_SIZE-1))
+Index: linux-rt-2.6.31/arch/x86/include/asm/paravirt.h
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/include/asm/paravirt.h	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/include/asm/paravirt.h	2010-05-17 14:23:19.938538240 +0200
+@@ -343,6 +343,7 @@
+ 
+ #ifdef CONFIG_HIGHPTE
+ 	void *(*kmap_atomic_pte)(struct page *page, enum km_type type);
++	void *(*kmap_atomic_pte_direct)(struct page *page, enum km_type type);
+ #endif
+ 
+ 	struct pv_lazy_ops lazy_mode;
+@@ -1147,6 +1148,14 @@
+ 	ret = PVOP_CALL2(unsigned long, pv_mmu_ops.kmap_atomic_pte, page, type);
+ 	return (void *)ret;
+ }
++
++static inline void *kmap_atomic_pte_direct(struct page *page, enum km_type type)
++{
++	unsigned long ret;
++	ret = PVOP_CALL2(unsigned long, pv_mmu_ops.kmap_atomic_pte_direct,
++			 page, type);
++	return (void *)ret;
++}
+ #endif
+ 
+ static inline void pte_update(struct mm_struct *mm, unsigned long addr,
+Index: linux-rt-2.6.31/arch/x86/include/asm/pci_x86.h
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/include/asm/pci_x86.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/include/asm/pci_x86.h	2010-05-17 14:23:19.938538240 +0200
+@@ -83,7 +83,7 @@
+ extern unsigned int pcibios_irq_mask;
+ 
+ extern int pcibios_scanned;
+-extern spinlock_t pci_config_lock;
++extern atomic_spinlock_t pci_config_lock;
+ 
+ extern int (*pcibios_enable_irq)(struct pci_dev *dev);
+ extern void (*pcibios_disable_irq)(struct pci_dev *dev);
+Index: linux-rt-2.6.31/arch/x86/include/asm/pgtable-3level.h
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/include/asm/pgtable-3level.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/include/asm/pgtable-3level.h	2010-05-17 14:23:19.938538240 +0200
+@@ -71,6 +71,7 @@
+ {
+ 	unsigned long pgd;
+ 
++	preempt_disable();
+ 	set_pud(pudp, __pud(0));
+ 
+ 	/*
+@@ -86,6 +87,7 @@
+ 	if (__pa(pudp) >= pgd && __pa(pudp) <
+ 	    (pgd + sizeof(pgd_t)*PTRS_PER_PGD))
+ 		write_cr3(pgd);
++	preempt_enable();
+ }
+ 
+ #ifdef CONFIG_SMP
+Index: linux-rt-2.6.31/arch/x86/include/asm/pgtable_32.h
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/include/asm/pgtable_32.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/include/asm/pgtable_32.h	2010-05-17 14:23:19.938538240 +0200
+@@ -59,14 +59,20 @@
+ #define pte_offset_map_nested(dir, address)				\
+ 	((pte_t *)kmap_atomic_pte(pmd_page(*(dir)), KM_PTE1) +		\
+ 	 pte_index((address)))
++#define pte_offset_map_direct(dir, address)				\
++	((pte_t *)kmap_atomic_pte_direct(pmd_page(*(dir)), __KM_PTE) +	\
++	 pte_index((address)))
+ #define pte_unmap(pte) kunmap_atomic((pte), __KM_PTE)
+ #define pte_unmap_nested(pte) kunmap_atomic((pte), KM_PTE1)
++#define pte_unmap_direct(pte) kunmap_atomic_direct((pte), __KM_PTE)
+ #else
+ #define pte_offset_map(dir, address)					\
+ 	((pte_t *)page_address(pmd_page(*(dir))) + pte_index((address)))
+ #define pte_offset_map_nested(dir, address) pte_offset_map((dir), (address))
++#define pte_offset_map_direct(dir, address) pte_offset_map((dir), (address))
+ #define pte_unmap(pte) do { } while (0)
+ #define pte_unmap_nested(pte) do { } while (0)
++#define pte_unmap_direct(pte) do { } while (0)
+ #endif
+ 
+ /* Clear a kernel PTE and flush it from the TLB */
+Index: linux-rt-2.6.31/arch/x86/include/asm/pgtable_64.h
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/include/asm/pgtable_64.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/include/asm/pgtable_64.h	2010-05-17 14:23:19.938538240 +0200
+@@ -126,8 +126,10 @@
+ /* x86-64 always has all page tables mapped. */
+ #define pte_offset_map(dir, address) pte_offset_kernel((dir), (address))
+ #define pte_offset_map_nested(dir, address) pte_offset_kernel((dir), (address))
+-#define pte_unmap(pte) /* NOP */
+-#define pte_unmap_nested(pte) /* NOP */
++#define pte_offset_map_direct(dir, address) pte_offset_kernel((dir), (address))
++#define pte_unmap(pte) do { } while (0)
++#define pte_unmap_nested(pte) do { }  while (0)
++#define pte_unmap_direct(pte) do { }  while (0)
+ 
+ #define update_mmu_cache(vma, address, pte) do { } while (0)
+ 
+Index: linux-rt-2.6.31/arch/x86/include/asm/processor.h
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/include/asm/processor.h	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/include/asm/processor.h	2010-05-17 14:23:19.938538240 +0200
+@@ -27,6 +27,7 @@
+ #include <linux/cpumask.h>
+ #include <linux/cache.h>
+ #include <linux/threads.h>
++#include <linux/math64.h>
+ #include <linux/init.h>
+ 
+ /*
+@@ -1010,4 +1011,33 @@
+ extern int get_tsc_mode(unsigned long adr);
+ extern int set_tsc_mode(unsigned int val);
+ 
++struct aperfmperf {
++	u64 aperf, mperf;
++};
++
++static inline void get_aperfmperf(struct aperfmperf *am)
++{
++	WARN_ON_ONCE(!boot_cpu_has(X86_FEATURE_APERFMPERF));
++
++	rdmsrl(MSR_IA32_APERF, am->aperf);
++	rdmsrl(MSR_IA32_MPERF, am->mperf);
++}
++
++#define APERFMPERF_SHIFT 10
++
++static inline
++unsigned long calc_aperfmperf_ratio(struct aperfmperf *old,
++				    struct aperfmperf *new)
++{
++	u64 aperf = new->aperf - old->aperf;
++	u64 mperf = new->mperf - old->mperf;
++	unsigned long ratio = aperf;
++
++	mperf >>= APERFMPERF_SHIFT;
++	if (mperf)
++		ratio = div64_u64(aperf, mperf);
++
++	return ratio;
++}
++
+ #endif /* _ASM_X86_PROCESSOR_H */
+Index: linux-rt-2.6.31/arch/x86/include/asm/rwsem.h
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/include/asm/rwsem.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/include/asm/rwsem.h	2010-05-17 14:23:19.938538240 +0200
+@@ -44,14 +44,14 @@
+ 
+ struct rwsem_waiter;
+ 
+-extern asmregparm struct rw_semaphore *
+- rwsem_down_read_failed(struct rw_semaphore *sem);
+-extern asmregparm struct rw_semaphore *
+- rwsem_down_write_failed(struct rw_semaphore *sem);
+-extern asmregparm struct rw_semaphore *
+- rwsem_wake(struct rw_semaphore *);
+-extern asmregparm struct rw_semaphore *
+- rwsem_downgrade_wake(struct rw_semaphore *sem);
++extern asmregparm struct rw_anon_semaphore *
++ rwsem_down_read_failed(struct rw_anon_semaphore *sem);
++extern asmregparm struct rw_anon_semaphore *
++ rwsem_down_write_failed(struct rw_anon_semaphore *sem);
++extern asmregparm struct rw_anon_semaphore *
++ rwsem_wake(struct rw_anon_semaphore *);
++extern asmregparm struct rw_anon_semaphore *
++ rwsem_downgrade_wake(struct rw_anon_semaphore *sem);
+ 
+ /*
+  * the semaphore definition
+@@ -64,7 +64,7 @@
+ #define RWSEM_ACTIVE_READ_BIAS		RWSEM_ACTIVE_BIAS
+ #define RWSEM_ACTIVE_WRITE_BIAS		(RWSEM_WAITING_BIAS + RWSEM_ACTIVE_BIAS)
+ 
+-struct rw_semaphore {
++struct rw_anon_semaphore {
+ 	signed long		count;
+ 	spinlock_t		wait_lock;
+ 	struct list_head	wait_list;
+@@ -74,35 +74,34 @@
+ };
+ 
+ #ifdef CONFIG_DEBUG_LOCK_ALLOC
+-# define __RWSEM_DEP_MAP_INIT(lockname) , .dep_map = { .name = #lockname }
++# define __RWSEM_ANON_DEP_MAP_INIT(lockname) , .dep_map = { .name = #lockname }
+ #else
+-# define __RWSEM_DEP_MAP_INIT(lockname)
++# define __RWSEM_ANON_DEP_MAP_INIT(lockname)
+ #endif
+ 
+-
+-#define __RWSEM_INITIALIZER(name)				\
++#define __RWSEM_ANON_INITIALIZER(name)				\
+ {								\
+ 	RWSEM_UNLOCKED_VALUE, __SPIN_LOCK_UNLOCKED((name).wait_lock), \
+ 	LIST_HEAD_INIT((name).wait_list) __RWSEM_DEP_MAP_INIT(name) \
+ }
+ 
+-#define DECLARE_RWSEM(name)					\
+-	struct rw_semaphore name = __RWSEM_INITIALIZER(name)
++#define DECLARE_ANON_RWSEM(name)					\
++	struct rw_anon_semaphore name = __RWSEM_ANON_INITIALIZER(name)
+ 
+-extern void __init_rwsem(struct rw_semaphore *sem, const char *name,
+-			 struct lock_class_key *key);
++extern void __init_anon_rwsem(struct rw_anon_semaphore *sem, const char *name,
++			      struct lock_class_key *key);
+ 
+-#define init_rwsem(sem)						\
++#define init_anon_rwsem(sem)						\
+ do {								\
+ 	static struct lock_class_key __key;			\
+ 								\
+-	__init_rwsem((sem), #sem, &__key);			\
++	__init_anon_rwsem((sem), #sem, &__key);			\
+ } while (0)
+ 
+ /*
+  * lock for reading
+  */
+-static inline void __down_read(struct rw_semaphore *sem)
++static inline void __down_read(struct rw_anon_semaphore *sem)
+ {
+ 	asm volatile("# beginning down_read\n\t"
+ 		     LOCK_PREFIX "  incl      (%%eax)\n\t"
+@@ -119,7 +118,7 @@
+ /*
+  * trylock for reading -- returns 1 if successful, 0 if contention
+  */
+-static inline int __down_read_trylock(struct rw_semaphore *sem)
++static inline int __down_read_trylock(struct rw_anon_semaphore *sem)
+ {
+ 	__s32 result, tmp;
+ 	asm volatile("# beginning __down_read_trylock\n\t"
+@@ -141,7 +140,8 @@
+ /*
+  * lock for writing
+  */
+-static inline void __down_write_nested(struct rw_semaphore *sem, int subclass)
++static inline void
++__down_write_nested(struct rw_anon_semaphore *sem, int subclass)
+ {
+ 	int tmp;
+ 
+@@ -160,7 +160,7 @@
+ 		     : "memory", "cc");
+ }
+ 
+-static inline void __down_write(struct rw_semaphore *sem)
++static inline void __down_write(struct rw_anon_semaphore *sem)
+ {
+ 	__down_write_nested(sem, 0);
+ }
+@@ -168,7 +168,7 @@
+ /*
+  * trylock for writing -- returns 1 if successful, 0 if contention
+  */
+-static inline int __down_write_trylock(struct rw_semaphore *sem)
++static inline int __down_write_trylock(struct rw_anon_semaphore *sem)
+ {
+ 	signed long ret = cmpxchg(&sem->count,
+ 				  RWSEM_UNLOCKED_VALUE,
+@@ -181,7 +181,7 @@
+ /*
+  * unlock after reading
+  */
+-static inline void __up_read(struct rw_semaphore *sem)
++static inline void __up_read(struct rw_anon_semaphore *sem)
+ {
+ 	__s32 tmp = -RWSEM_ACTIVE_READ_BIAS;
+ 	asm volatile("# beginning __up_read\n\t"
+@@ -199,7 +199,7 @@
+ /*
+  * unlock after writing
+  */
+-static inline void __up_write(struct rw_semaphore *sem)
++static inline void __up_write(struct rw_anon_semaphore *sem)
+ {
+ 	asm volatile("# beginning __up_write\n\t"
+ 		     "  movl      %2,%%edx\n\t"
+@@ -218,7 +218,7 @@
+ /*
+  * downgrade write lock to read lock
+  */
+-static inline void __downgrade_write(struct rw_semaphore *sem)
++static inline void __downgrade_write(struct rw_anon_semaphore *sem)
+ {
+ 	asm volatile("# beginning __downgrade_write\n\t"
+ 		     LOCK_PREFIX "  addl      %2,(%%eax)\n\t"
+@@ -235,7 +235,7 @@
+ /*
+  * implement atomic add functionality
+  */
+-static inline void rwsem_atomic_add(int delta, struct rw_semaphore *sem)
++static inline void rwsem_atomic_add(int delta, struct rw_anon_semaphore *sem)
+ {
+ 	asm volatile(LOCK_PREFIX "addl %1,%0"
+ 		     : "+m" (sem->count)
+@@ -245,7 +245,7 @@
+ /*
+  * implement exchange and add functionality
+  */
+-static inline int rwsem_atomic_update(int delta, struct rw_semaphore *sem)
++static inline int rwsem_atomic_update(int delta, struct rw_anon_semaphore *sem)
+ {
+ 	int tmp = delta;
+ 
+@@ -256,10 +256,54 @@
+ 	return tmp + delta;
+ }
+ 
++static inline int anon_rwsem_is_locked(struct rw_anon_semaphore *sem)
++{
++	return (sem->count != 0);
++}
++
++#ifndef CONFIG_PREEMPT_RT
++
++struct rw_semaphore {
++	signed long		count;
++	spinlock_t		wait_lock;
++	struct list_head	wait_list;
++#ifdef CONFIG_DEBUG_LOCK_ALLOC
++	struct lockdep_map dep_map;
++#endif
++};
++
++#ifdef CONFIG_DEBUG_LOCK_ALLOC
++# define __RWSEM_DEP_MAP_INIT(lockname) , .dep_map = { .name = #lockname }
++#else
++# define __RWSEM_DEP_MAP_INIT(lockname)
++#endif
++
++#define __RWSEM_INITIALIZER(name) \
++{ 0, __SPIN_LOCK_UNLOCKED(name.wait_lock), LIST_HEAD_INIT((name).wait_list) \
++  __RWSEM_DEP_MAP_INIT(name) }
++
++#define DECLARE_RWSEM(name) \
++	struct rw_semaphore name = __RWSEM_INITIALIZER(name)
++
++static inline void __init_rwsem(struct rw_semaphore *sem, const char *name,
++				struct lock_class_key *key)
++{
++	__init_anon_rwsem((struct rw_anon_semaphore *)sem, name, key);
++}
++
++#define init_rwsem(sem)						\
++do {								\
++	static struct lock_class_key __key;			\
++								\
++	__init_rwsem((sem), #sem, &__key);			\
++} while (0)
++
++
+ static inline int rwsem_is_locked(struct rw_semaphore *sem)
+ {
+ 	return (sem->count != 0);
+ }
++#endif
+ 
+ #endif /* __KERNEL__ */
+ #endif /* _ASM_X86_RWSEM_H */
+Index: linux-rt-2.6.31/arch/x86/include/asm/spinlock.h
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/include/asm/spinlock.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/include/asm/spinlock.h	2010-05-17 14:23:19.938538240 +0200
+@@ -298,9 +298,9 @@
+ #define __raw_read_lock_flags(lock, flags) __raw_read_lock(lock)
+ #define __raw_write_lock_flags(lock, flags) __raw_write_lock(lock)
+ 
+-#define _raw_spin_relax(lock)	cpu_relax()
+-#define _raw_read_relax(lock)	cpu_relax()
+-#define _raw_write_relax(lock)	cpu_relax()
++#define __raw_spin_relax(lock)	cpu_relax()
++#define __raw_read_relax(lock)	cpu_relax()
++#define __raw_write_relax(lock)	cpu_relax()
+ 
+ /* The {read|write|spin}_lock() on x86 are full memory barriers. */
+ static inline void smp_mb__after_lock(void) { }
+Index: linux-rt-2.6.31/arch/x86/include/asm/thread_info.h
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/include/asm/thread_info.h	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/include/asm/thread_info.h	2010-05-17 14:23:19.938538240 +0200
+@@ -94,7 +94,7 @@
+ #define TIF_DEBUGCTLMSR		25	/* uses thread_struct.debugctlmsr */
+ #define TIF_DS_AREA_MSR		26      /* uses thread_struct.ds_area_msr */
+ #define TIF_LAZY_MMU_UPDATES	27	/* task is updating the mmu lazily */
+-#define TIF_SYSCALL_FTRACE	28	/* for ftrace syscall instrumentation */
++#define TIF_SYSCALL_TRACEPOINT	28	/* syscall tracepoint instrumentation */
+ 
+ #define _TIF_SYSCALL_TRACE	(1 << TIF_SYSCALL_TRACE)
+ #define _TIF_NOTIFY_RESUME	(1 << TIF_NOTIFY_RESUME)
+@@ -116,17 +116,17 @@
+ #define _TIF_DEBUGCTLMSR	(1 << TIF_DEBUGCTLMSR)
+ #define _TIF_DS_AREA_MSR	(1 << TIF_DS_AREA_MSR)
+ #define _TIF_LAZY_MMU_UPDATES	(1 << TIF_LAZY_MMU_UPDATES)
+-#define _TIF_SYSCALL_FTRACE	(1 << TIF_SYSCALL_FTRACE)
++#define _TIF_SYSCALL_TRACEPOINT	(1 << TIF_SYSCALL_TRACEPOINT)
+ 
+ /* work to do in syscall_trace_enter() */
+ #define _TIF_WORK_SYSCALL_ENTRY	\
+-	(_TIF_SYSCALL_TRACE | _TIF_SYSCALL_EMU | _TIF_SYSCALL_FTRACE |	\
+-	 _TIF_SYSCALL_AUDIT | _TIF_SECCOMP | _TIF_SINGLESTEP)
++	(_TIF_SYSCALL_TRACE | _TIF_SYSCALL_EMU | _TIF_SYSCALL_AUDIT |	\
++	 _TIF_SECCOMP | _TIF_SINGLESTEP | _TIF_SYSCALL_TRACEPOINT)
+ 
+ /* work to do in syscall_trace_leave() */
+ #define _TIF_WORK_SYSCALL_EXIT	\
+ 	(_TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT | _TIF_SINGLESTEP |	\
+-	 _TIF_SYSCALL_FTRACE)
++	 _TIF_SYSCALL_TRACEPOINT)
+ 
+ /* work to do on interrupt/exception return */
+ #define _TIF_WORK_MASK							\
+@@ -135,7 +135,8 @@
+ 	   _TIF_SINGLESTEP|_TIF_SECCOMP|_TIF_SYSCALL_EMU))
+ 
+ /* work to do on any return to user space */
+-#define _TIF_ALLWORK_MASK ((0x0000FFFF & ~_TIF_SECCOMP) | _TIF_SYSCALL_FTRACE)
++#define _TIF_ALLWORK_MASK						\
++	((0x0000FFFF & ~_TIF_SECCOMP) | _TIF_SYSCALL_TRACEPOINT)
+ 
+ /* Only used for 64 bit */
+ #define _TIF_DO_NOTIFY_MASK						\
+Index: linux-rt-2.6.31/arch/x86/include/asm/timer.h
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/include/asm/timer.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/include/asm/timer.h	2010-05-17 14:23:19.938538240 +0200
+@@ -62,9 +62,9 @@
+ 	unsigned long long ns;
+ 	unsigned long flags;
+ 
+-	local_irq_save(flags);
++	raw_local_irq_save(flags);
+ 	ns = __cycles_2_ns(cyc);
+-	local_irq_restore(flags);
++	raw_local_irq_restore(flags);
+ 
+ 	return ns;
+ }
+Index: linux-rt-2.6.31/arch/x86/include/asm/tlbflush.h
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/include/asm/tlbflush.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/include/asm/tlbflush.h	2010-05-17 14:23:19.938538240 +0200
+@@ -7,6 +7,21 @@
+ #include <asm/processor.h>
+ #include <asm/system.h>
+ 
++/*
++ * TLB-flush needs to be nonpreemptible on PREEMPT_RT due to the
++ * following complex race scenario:
++ *
++ * if the current task is lazy-TLB and does a TLB flush and
++ * gets preempted after the movl %%r3, %0 but before the
++ * movl %0, %%cr3 then its ->active_mm might change and it will
++ * install the wrong cr3 when it switches back. This is not a
++ * problem for the lazy-TLB task itself, but if the next task it
++ * switches to has an ->mm that is also the lazy-TLB task's
++ * new ->active_mm, then the scheduler will assume that cr3 is
++ * the new one, while we overwrote it with the old one. The result
++ * is the wrong cr3 in the new (non-lazy-TLB) task, which typically
++ * causes an infinite pagefault upon the next userspace access.
++ */
+ #ifdef CONFIG_PARAVIRT
+ #include <asm/paravirt.h>
+ #else
+@@ -17,7 +32,9 @@
+ 
+ static inline void __native_flush_tlb(void)
+ {
++	preempt_disable();
+ 	native_write_cr3(native_read_cr3());
++	preempt_enable();
+ }
+ 
+ static inline void __native_flush_tlb_global(void)
+@@ -95,6 +112,13 @@
+ 
+ static inline void flush_tlb_mm(struct mm_struct *mm)
+ {
++	/*
++	 * This is safe on PREEMPT_RT because if we preempt
++	 * right after the check but before the __flush_tlb(),
++	 * and if ->active_mm changes, then we might miss a
++	 * TLB flush, but that TLB flush happened already when
++	 * ->active_mm was changed:
++	 */
+ 	if (mm == current->active_mm)
+ 		__flush_tlb();
+ }
+Index: linux-rt-2.6.31/arch/x86/include/asm/unistd_32.h
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/include/asm/unistd_32.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/include/asm/unistd_32.h	2010-05-17 14:23:19.938538240 +0200
+@@ -345,6 +345,8 @@
+ 
+ #ifdef __KERNEL__
+ 
++#define NR_syscalls 337
++
+ #define __ARCH_WANT_IPC_PARSE_VERSION
+ #define __ARCH_WANT_OLD_READDIR
+ #define __ARCH_WANT_OLD_STAT
+Index: linux-rt-2.6.31/arch/x86/include/asm/unistd_64.h
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/include/asm/unistd_64.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/include/asm/unistd_64.h	2010-05-17 14:23:19.938538240 +0200
+@@ -688,6 +688,12 @@
+ #endif	/* __NO_STUBS */
+ 
+ #ifdef __KERNEL__
++
++#ifndef COMPILE_OFFSETS
++#include <asm/asm-offsets.h>
++#define NR_syscalls (__NR_syscall_max + 1)
++#endif
++
+ /*
+  * "Conditional" syscalls
+  *
+Index: linux-rt-2.6.31/arch/x86/include/asm/vgtod.h
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/include/asm/vgtod.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/include/asm/vgtod.h	2010-05-17 14:23:19.938538240 +0200
+@@ -5,7 +5,7 @@
+ #include <linux/clocksource.h>
+ 
+ struct vsyscall_gtod_data {
+-	seqlock_t	lock;
++	atomic_seqlock_t lock;
+ 
+ 	/* open coded 'struct timespec' */
+ 	time_t		wall_time_sec;
+Index: linux-rt-2.6.31/arch/x86/include/asm/xor_32.h
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/include/asm/xor_32.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/include/asm/xor_32.h	2010-05-17 14:23:19.938538240 +0200
+@@ -865,7 +865,21 @@
+ #include <asm-generic/xor.h>
+ 
+ #undef XOR_TRY_TEMPLATES
+-#define XOR_TRY_TEMPLATES				\
++/*
++ * MMX/SSE ops disable preemption for long periods of time,
++ * so on PREEMPT_RT use the register-based ops only:
++ */
++#ifdef CONFIG_PREEMPT_RT
++# define XOR_TRY_TEMPLATES				\
++	do {						\
++		xor_speed(&xor_block_8regs);		\
++		xor_speed(&xor_block_8regs_p);		\
++		xor_speed(&xor_block_32regs);		\
++		xor_speed(&xor_block_32regs_p);		\
++	} while (0)
++# define XOR_SELECT_TEMPLATE(FASTEST) (FASTEST)
++#else
++# define XOR_TRY_TEMPLATES				\
+ do {							\
+ 	xor_speed(&xor_block_8regs);			\
+ 	xor_speed(&xor_block_8regs_p);			\
+@@ -882,7 +896,8 @@
+ /* We force the use of the SSE xor block because it can write around L2.
+    We may also be able to load into the L1 only depending on how the cpu
+    deals with a load to a line that is being prefetched.  */
+-#define XOR_SELECT_TEMPLATE(FASTEST)			\
++# define XOR_SELECT_TEMPLATE(FASTEST)			\
+ 	(cpu_has_xmm ? &xor_block_pIII_sse : FASTEST)
++#endif /* CONFIG_PREEMPT_RT */
+ 
+ #endif /* _ASM_X86_XOR_32_H */
+Index: linux-rt-2.6.31/arch/x86/kernel/apic/io_apic.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/kernel/apic/io_apic.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/kernel/apic/io_apic.c	2010-05-17 14:23:19.948410653 +0200
+@@ -73,8 +73,8 @@
+  */
+ int sis_apic_bug = -1;
+ 
+-static DEFINE_SPINLOCK(ioapic_lock);
+-static DEFINE_SPINLOCK(vector_lock);
++static DEFINE_ATOMIC_SPINLOCK(ioapic_lock);
++static DEFINE_ATOMIC_SPINLOCK(vector_lock);
+ 
+ /*
+  * # of IRQ routing registers
+@@ -413,7 +413,7 @@
+ 	struct irq_pin_list *entry;
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&ioapic_lock, flags);
++	atomic_spin_lock_irqsave(&ioapic_lock, flags);
+ 	entry = cfg->irq_2_pin;
+ 	for (;;) {
+ 		unsigned int reg;
+@@ -425,14 +425,14 @@
+ 		reg = io_apic_read(entry->apic, 0x10 + pin*2);
+ 		/* Is the remote IRR bit set? */
+ 		if (reg & IO_APIC_REDIR_REMOTE_IRR) {
+-			spin_unlock_irqrestore(&ioapic_lock, flags);
++			atomic_spin_unlock_irqrestore(&ioapic_lock, flags);
+ 			return true;
+ 		}
+ 		if (!entry->next)
+ 			break;
+ 		entry = entry->next;
+ 	}
+-	spin_unlock_irqrestore(&ioapic_lock, flags);
++	atomic_spin_unlock_irqrestore(&ioapic_lock, flags);
+ 
+ 	return false;
+ }
+@@ -446,10 +446,10 @@
+ {
+ 	union entry_union eu;
+ 	unsigned long flags;
+-	spin_lock_irqsave(&ioapic_lock, flags);
++	atomic_spin_lock_irqsave(&ioapic_lock, flags);
+ 	eu.w1 = io_apic_read(apic, 0x10 + 2 * pin);
+ 	eu.w2 = io_apic_read(apic, 0x11 + 2 * pin);
+-	spin_unlock_irqrestore(&ioapic_lock, flags);
++	atomic_spin_unlock_irqrestore(&ioapic_lock, flags);
+ 	return eu.entry;
+ }
+ 
+@@ -472,9 +472,9 @@
+ void ioapic_write_entry(int apic, int pin, struct IO_APIC_route_entry e)
+ {
+ 	unsigned long flags;
+-	spin_lock_irqsave(&ioapic_lock, flags);
++	atomic_spin_lock_irqsave(&ioapic_lock, flags);
+ 	__ioapic_write_entry(apic, pin, e);
+-	spin_unlock_irqrestore(&ioapic_lock, flags);
++	atomic_spin_unlock_irqrestore(&ioapic_lock, flags);
+ }
+ 
+ /*
+@@ -487,10 +487,10 @@
+ 	unsigned long flags;
+ 	union entry_union eu = { .entry.mask = 1 };
+ 
+-	spin_lock_irqsave(&ioapic_lock, flags);
++	atomic_spin_lock_irqsave(&ioapic_lock, flags);
+ 	io_apic_write(apic, 0x10 + 2*pin, eu.w1);
+ 	io_apic_write(apic, 0x11 + 2*pin, eu.w2);
+-	spin_unlock_irqrestore(&ioapic_lock, flags);
++	atomic_spin_unlock_irqrestore(&ioapic_lock, flags);
+ }
+ 
+ /*
+@@ -622,9 +622,9 @@
+ 
+ 	BUG_ON(!cfg);
+ 
+-	spin_lock_irqsave(&ioapic_lock, flags);
++	atomic_spin_lock_irqsave(&ioapic_lock, flags);
+ 	__mask_IO_APIC_irq(cfg);
+-	spin_unlock_irqrestore(&ioapic_lock, flags);
++	atomic_spin_unlock_irqrestore(&ioapic_lock, flags);
+ }
+ 
+ static void unmask_IO_APIC_irq_desc(struct irq_desc *desc)
+@@ -632,9 +632,9 @@
+ 	struct irq_cfg *cfg = desc->chip_data;
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&ioapic_lock, flags);
++	atomic_spin_lock_irqsave(&ioapic_lock, flags);
+ 	__unmask_IO_APIC_irq(cfg);
+-	spin_unlock_irqrestore(&ioapic_lock, flags);
++	atomic_spin_unlock_irqrestore(&ioapic_lock, flags);
+ }
+ 
+ static void mask_IO_APIC_irq(unsigned int irq)
+@@ -1158,12 +1158,12 @@
+ 	/* Used to the online set of cpus does not change
+ 	 * during assign_irq_vector.
+ 	 */
+-	spin_lock(&vector_lock);
++	atomic_spin_lock(&vector_lock);
+ }
+ 
+ void unlock_vector_lock(void)
+ {
+-	spin_unlock(&vector_lock);
++	atomic_spin_unlock(&vector_lock);
+ }
+ 
+ static int
+@@ -1251,9 +1251,9 @@
+ 	int err;
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&vector_lock, flags);
++	atomic_spin_lock_irqsave(&vector_lock, flags);
+ 	err = __assign_irq_vector(irq, cfg, mask);
+-	spin_unlock_irqrestore(&vector_lock, flags);
++	atomic_spin_unlock_irqrestore(&vector_lock, flags);
+ 	return err;
+ }
+ 
+@@ -1623,14 +1623,14 @@
+ 
+ 	for (apic = 0; apic < nr_ioapics; apic++) {
+ 
+-	spin_lock_irqsave(&ioapic_lock, flags);
++	atomic_spin_lock_irqsave(&ioapic_lock, flags);
+ 	reg_00.raw = io_apic_read(apic, 0);
+ 	reg_01.raw = io_apic_read(apic, 1);
+ 	if (reg_01.bits.version >= 0x10)
+ 		reg_02.raw = io_apic_read(apic, 2);
+ 	if (reg_01.bits.version >= 0x20)
+ 		reg_03.raw = io_apic_read(apic, 3);
+-	spin_unlock_irqrestore(&ioapic_lock, flags);
++	atomic_spin_unlock_irqrestore(&ioapic_lock, flags);
+ 
+ 	printk("\n");
+ 	printk(KERN_DEBUG "IO APIC #%d......\n", mp_ioapics[apic].apicid);
+@@ -1856,7 +1856,7 @@
+ 
+ 	printk(KERN_DEBUG "\nprinting PIC contents\n");
+ 
+-	spin_lock_irqsave(&i8259A_lock, flags);
++	atomic_spin_lock_irqsave(&i8259A_lock, flags);
+ 
+ 	v = inb(0xa1) << 8 | inb(0x21);
+ 	printk(KERN_DEBUG "... PIC  IMR: %04x\n", v);
+@@ -1870,7 +1870,7 @@
+ 	outb(0x0a,0xa0);
+ 	outb(0x0a,0x20);
+ 
+-	spin_unlock_irqrestore(&i8259A_lock, flags);
++	atomic_spin_unlock_irqrestore(&i8259A_lock, flags);
+ 
+ 	printk(KERN_DEBUG "... PIC  ISR: %04x\n", v);
+ 
+@@ -1909,9 +1909,9 @@
+ 	 * The number of IO-APIC IRQ registers (== #pins):
+ 	 */
+ 	for (apic = 0; apic < nr_ioapics; apic++) {
+-		spin_lock_irqsave(&ioapic_lock, flags);
++		atomic_spin_lock_irqsave(&ioapic_lock, flags);
+ 		reg_01.raw = io_apic_read(apic, 1);
+-		spin_unlock_irqrestore(&ioapic_lock, flags);
++		atomic_spin_unlock_irqrestore(&ioapic_lock, flags);
+ 		nr_ioapic_registers[apic] = reg_01.bits.entries+1;
+ 	}
+ 	for(apic = 0; apic < nr_ioapics; apic++) {
+@@ -2045,9 +2045,9 @@
+ 	for (apic_id = 0; apic_id < nr_ioapics; apic_id++) {
+ 
+ 		/* Read the register 0 value */
+-		spin_lock_irqsave(&ioapic_lock, flags);
++		atomic_spin_lock_irqsave(&ioapic_lock, flags);
+ 		reg_00.raw = io_apic_read(apic_id, 0);
+-		spin_unlock_irqrestore(&ioapic_lock, flags);
++		atomic_spin_unlock_irqrestore(&ioapic_lock, flags);
+ 
+ 		old_id = mp_ioapics[apic_id].apicid;
+ 
+@@ -2106,16 +2106,16 @@
+ 			mp_ioapics[apic_id].apicid);
+ 
+ 		reg_00.bits.ID = mp_ioapics[apic_id].apicid;
+-		spin_lock_irqsave(&ioapic_lock, flags);
++		atomic_spin_lock_irqsave(&ioapic_lock, flags);
+ 		io_apic_write(apic_id, 0, reg_00.raw);
+-		spin_unlock_irqrestore(&ioapic_lock, flags);
++		atomic_spin_unlock_irqrestore(&ioapic_lock, flags);
+ 
+ 		/*
+ 		 * Sanity check
+ 		 */
+-		spin_lock_irqsave(&ioapic_lock, flags);
++		atomic_spin_lock_irqsave(&ioapic_lock, flags);
+ 		reg_00.raw = io_apic_read(apic_id, 0);
+-		spin_unlock_irqrestore(&ioapic_lock, flags);
++		atomic_spin_unlock_irqrestore(&ioapic_lock, flags);
+ 		if (reg_00.bits.ID != mp_ioapics[apic_id].apicid)
+ 			printk("could not set ID!\n");
+ 		else
+@@ -2164,8 +2164,10 @@
+ 	 */
+ 
+ 	/* jiffies wrap? */
+-	if (time_after(jiffies, t1 + 4))
++	if (time_after(jiffies, t1 + 4) &&
++	    time_before(jiffies, t1 + 16))
+ 		return 1;
++
+ 	return 0;
+ }
+ 
+@@ -2198,7 +2200,7 @@
+ 	unsigned long flags;
+ 	struct irq_cfg *cfg;
+ 
+-	spin_lock_irqsave(&ioapic_lock, flags);
++	atomic_spin_lock_irqsave(&ioapic_lock, flags);
+ 	if (irq < NR_IRQS_LEGACY) {
+ 		disable_8259A_irq(irq);
+ 		if (i8259A_irq_pending(irq))
+@@ -2206,7 +2208,7 @@
+ 	}
+ 	cfg = irq_cfg(irq);
+ 	__unmask_IO_APIC_irq(cfg);
+-	spin_unlock_irqrestore(&ioapic_lock, flags);
++	atomic_spin_unlock_irqrestore(&ioapic_lock, flags);
+ 
+ 	return was_pending;
+ }
+@@ -2218,9 +2220,9 @@
+ 	struct irq_cfg *cfg = irq_cfg(irq);
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&vector_lock, flags);
++	atomic_spin_lock_irqsave(&vector_lock, flags);
+ 	apic->send_IPI_mask(cpumask_of(cpumask_first(cfg->domain)), cfg->vector);
+-	spin_unlock_irqrestore(&vector_lock, flags);
++	atomic_spin_unlock_irqrestore(&vector_lock, flags);
+ 
+ 	return 1;
+ }
+@@ -2333,7 +2335,7 @@
+ 	irq = desc->irq;
+ 	cfg = desc->chip_data;
+ 
+-	spin_lock_irqsave(&ioapic_lock, flags);
++	atomic_spin_lock_irqsave(&ioapic_lock, flags);
+ 	dest = set_desc_affinity(desc, mask);
+ 	if (dest != BAD_APICID) {
+ 		/* Only the high 8 bits are valid. */
+@@ -2341,7 +2343,7 @@
+ 		__target_IO_APIC_irq(irq, dest, cfg);
+ 		ret = 0;
+ 	}
+-	spin_unlock_irqrestore(&ioapic_lock, flags);
++	atomic_spin_unlock_irqrestore(&ioapic_lock, flags);
+ 
+ 	return ret;
+ }
+@@ -2454,7 +2456,7 @@
+ 			continue;
+ 
+ 		cfg = irq_cfg(irq);
+-		spin_lock(&desc->lock);
++		atomic_spin_lock(&desc->lock);
+ 		if (!cfg->move_cleanup_count)
+ 			goto unlock;
+ 
+@@ -2476,7 +2478,7 @@
+ 		__get_cpu_var(vector_irq)[vector] = -1;
+ 		cfg->move_cleanup_count--;
+ unlock:
+-		spin_unlock(&desc->lock);
++		atomic_spin_unlock(&desc->lock);
+ 	}
+ 
+ 	irq_exit();
+@@ -2526,7 +2528,8 @@
+ 	irq_complete_move(&desc);
+ #ifdef CONFIG_GENERIC_PENDING_IRQ
+ 	/* If we are moving the irq we need to mask it */
+-	if (unlikely(desc->status & IRQ_MOVE_PENDING)) {
++	if (unlikely(desc->status & IRQ_MOVE_PENDING) &&
++	    !(desc->status & IRQ_INPROGRESS)) {
+ 		do_unmask_irq = 1;
+ 		mask_IO_APIC_irq_desc(desc);
+ 	}
+@@ -2597,14 +2600,23 @@
+ 			move_masked_irq(irq);
+ 		unmask_IO_APIC_irq_desc(desc);
+ 	}
++#if (defined(CONFIG_GENERIC_PENDING_IRQ) || defined(CONFIG_IRQBALANCE)) && \
++	defined(CONFIG_PREEMPT_HARDIRQS)
++	/*
++	 * With threaded interrupts, we always have IRQ_INPROGRESS
++	 * when acking.
++	 */
++	else if (unlikely(desc->status & IRQ_MOVE_PENDING))
++		move_masked_irq(irq);
++#endif
+ 
+ #ifdef CONFIG_X86_32
+ 	if (!(v & (1 << (i & 0x1f)))) {
+ 		atomic_inc(&irq_mis_count);
+-		spin_lock(&ioapic_lock);
++		atomic_spin_lock(&ioapic_lock);
+ 		__mask_and_edge_IO_APIC_irq(cfg);
+ 		__unmask_and_level_IO_APIC_irq(cfg);
+-		spin_unlock(&ioapic_lock);
++		atomic_spin_unlock(&ioapic_lock);
+ 	}
+ #endif
+ }
+@@ -2638,9 +2650,9 @@
+ 	irq = desc->irq;
+ 	cfg = desc->chip_data;
+ 
+-	spin_lock_irqsave(&ioapic_lock, flags);
++	atomic_spin_lock_irqsave(&ioapic_lock, flags);
+ 	__eoi_ioapic_irq(irq, cfg);
+-	spin_unlock_irqrestore(&ioapic_lock, flags);
++	atomic_spin_unlock_irqrestore(&ioapic_lock, flags);
+ }
+ 
+ static void ir_ack_apic_edge(unsigned int irq)
+@@ -3116,13 +3128,13 @@
+ 	data = container_of(dev, struct sysfs_ioapic_data, dev);
+ 	entry = data->entry;
+ 
+-	spin_lock_irqsave(&ioapic_lock, flags);
++	atomic_spin_lock_irqsave(&ioapic_lock, flags);
+ 	reg_00.raw = io_apic_read(dev->id, 0);
+ 	if (reg_00.bits.ID != mp_ioapics[dev->id].apicid) {
+ 		reg_00.bits.ID = mp_ioapics[dev->id].apicid;
+ 		io_apic_write(dev->id, 0, reg_00.raw);
+ 	}
+-	spin_unlock_irqrestore(&ioapic_lock, flags);
++	atomic_spin_unlock_irqrestore(&ioapic_lock, flags);
+ 	for (i = 0; i < nr_ioapic_registers[dev->id]; i++)
+ 		ioapic_write_entry(dev->id, i, entry[i]);
+ 
+@@ -3186,7 +3198,6 @@
+ 	if (irq_want < nr_irqs_gsi)
+ 		irq_want = nr_irqs_gsi;
+ 
+-	spin_lock_irqsave(&vector_lock, flags);
+ 	for (new = irq_want; new < nr_irqs; new++) {
+ 		desc_new = irq_to_desc_alloc_node(new, node);
+ 		if (!desc_new) {
+@@ -3198,13 +3209,14 @@
+ 		if (cfg_new->vector != 0)
+ 			continue;
+ 
++		atomic_spin_lock_irqsave(&vector_lock, flags);
+ 		desc_new = move_irq_desc(desc_new, node);
+ 
+ 		if (__assign_irq_vector(new, cfg_new, apic->target_cpus()) == 0)
+ 			irq = new;
++		atomic_spin_unlock_irqrestore(&vector_lock, flags);
+ 		break;
+ 	}
+-	spin_unlock_irqrestore(&vector_lock, flags);
+ 
+ 	if (irq > 0) {
+ 		dynamic_irq_init(irq);
+@@ -3245,9 +3257,9 @@
+ 		desc->chip_data = cfg;
+ 
+ 	free_irte(irq);
+-	spin_lock_irqsave(&vector_lock, flags);
++	atomic_spin_lock_irqsave(&vector_lock, flags);
+ 	__clear_irq_vector(irq, cfg);
+-	spin_unlock_irqrestore(&vector_lock, flags);
++	atomic_spin_unlock_irqrestore(&vector_lock, flags);
+ }
+ 
+ /*
+@@ -3775,10 +3787,10 @@
+ 	if (err != 0)
+ 		return err;
+ 
+-	spin_lock_irqsave(&vector_lock, flags);
++	atomic_spin_lock_irqsave(&vector_lock, flags);
+ 	set_irq_chip_and_handler_name(irq, &uv_irq_chip, handle_percpu_irq,
+ 				      irq_name);
+-	spin_unlock_irqrestore(&vector_lock, flags);
++	atomic_spin_unlock_irqrestore(&vector_lock, flags);
+ 
+ 	mmr_value = 0;
+ 	entry = (struct uv_IO_APIC_route_entry *)&mmr_value;
+@@ -3825,9 +3837,9 @@
+ 	union IO_APIC_reg_01	reg_01;
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&ioapic_lock, flags);
++	atomic_spin_lock_irqsave(&ioapic_lock, flags);
+ 	reg_01.raw = io_apic_read(ioapic, 1);
+-	spin_unlock_irqrestore(&ioapic_lock, flags);
++	atomic_spin_unlock_irqrestore(&ioapic_lock, flags);
+ 
+ 	return reg_01.bits.entries;
+ }
+@@ -3968,9 +3980,9 @@
+ 	if (physids_empty(apic_id_map))
+ 		apic_id_map = apic->ioapic_phys_id_map(phys_cpu_present_map);
+ 
+-	spin_lock_irqsave(&ioapic_lock, flags);
++	atomic_spin_lock_irqsave(&ioapic_lock, flags);
+ 	reg_00.raw = io_apic_read(ioapic, 0);
+-	spin_unlock_irqrestore(&ioapic_lock, flags);
++	atomic_spin_unlock_irqrestore(&ioapic_lock, flags);
+ 
+ 	if (apic_id >= get_physical_broadcast()) {
+ 		printk(KERN_WARNING "IOAPIC[%d]: Invalid apic_id %d, trying "
+@@ -4004,10 +4016,10 @@
+ 	if (reg_00.bits.ID != apic_id) {
+ 		reg_00.bits.ID = apic_id;
+ 
+-		spin_lock_irqsave(&ioapic_lock, flags);
++		atomic_spin_lock_irqsave(&ioapic_lock, flags);
+ 		io_apic_write(ioapic, 0, reg_00.raw);
+ 		reg_00.raw = io_apic_read(ioapic, 0);
+-		spin_unlock_irqrestore(&ioapic_lock, flags);
++		atomic_spin_unlock_irqrestore(&ioapic_lock, flags);
+ 
+ 		/* Sanity check */
+ 		if (reg_00.bits.ID != apic_id) {
+@@ -4028,9 +4040,9 @@
+ 	union IO_APIC_reg_01	reg_01;
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&ioapic_lock, flags);
++	atomic_spin_lock_irqsave(&ioapic_lock, flags);
+ 	reg_01.raw = io_apic_read(ioapic, 1);
+-	spin_unlock_irqrestore(&ioapic_lock, flags);
++	atomic_spin_unlock_irqrestore(&ioapic_lock, flags);
+ 
+ 	return reg_01.bits.version;
+ }
+Index: linux-rt-2.6.31/arch/x86/kernel/apic/ipi.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/kernel/apic/ipi.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/kernel/apic/ipi.c	2010-05-17 14:23:19.948410653 +0200
+@@ -106,7 +106,7 @@
+ 	unsigned long mask = cpumask_bits(cpumask)[0];
+ 	unsigned long flags;
+ 
+-	if (WARN_ONCE(!mask, "empty IPI mask"))
++	if (!mask)
+ 		return;
+ 
+ 	local_irq_save(flags);
+Index: linux-rt-2.6.31/arch/x86/kernel/apic/nmi.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/kernel/apic/nmi.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/kernel/apic/nmi.c	2010-05-17 14:23:19.948410653 +0200
+@@ -90,7 +90,9 @@
+  */
+ static __init void nmi_cpu_busy(void *data)
+ {
++#ifndef CONFIG_PREEMPT_RT
+ 	local_irq_enable_in_hardirq();
++#endif
+ 	/*
+ 	 * Intentionally don't use cpu_relax here. This is
+ 	 * to make sure that the performance counter really ticks,
+@@ -416,12 +418,12 @@
+ 
+ 	/* We can be called before check_nmi_watchdog, hence NULL check. */
+ 	if (backtrace_mask != NULL && cpumask_test_cpu(cpu, backtrace_mask)) {
+-		static DEFINE_SPINLOCK(lock);	/* Serialise the printks */
++		static DEFINE_ATOMIC_SPINLOCK(lock);	/* Serialise the printks */
+ 
+-		spin_lock(&lock);
++		atomic_spin_lock(&lock);
+ 		printk(KERN_WARNING "NMI backtrace for cpu %d\n", cpu);
+ 		dump_stack();
+-		spin_unlock(&lock);
++		atomic_spin_unlock(&lock);
+ 		cpumask_clear_cpu(cpu, backtrace_mask);
+ 	}
+ 
+Index: linux-rt-2.6.31/arch/x86/kernel/apm_32.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/kernel/apm_32.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/kernel/apm_32.c	2010-05-17 14:23:19.948410653 +0200
+@@ -1216,7 +1216,7 @@
+ #ifdef INIT_TIMER_AFTER_SUSPEND
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&i8253_lock, flags);
++	atomic_spin_lock_irqsave(&i8253_lock, flags);
+ 	/* set the clock to HZ */
+ 	outb_pit(0x34, PIT_MODE);		/* binary, mode 2, LSB/MSB, ch 0 */
+ 	udelay(10);
+@@ -1224,7 +1224,7 @@
+ 	udelay(10);
+ 	outb_pit(LATCH >> 8, PIT_CH0);	/* MSB */
+ 	udelay(10);
+-	spin_unlock_irqrestore(&i8253_lock, flags);
++	atomic_spin_unlock_irqrestore(&i8253_lock, flags);
+ #endif
+ }
+ 
+Index: linux-rt-2.6.31/arch/x86/kernel/asm-offsets_64.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/kernel/asm-offsets_64.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/kernel/asm-offsets_64.c	2010-05-17 14:23:19.948410653 +0200
+@@ -3,6 +3,7 @@
+  * This code generates raw asm output which is post-processed to extract
+  * and format the required data.
+  */
++#define COMPILE_OFFSETS
+ 
+ #include <linux/crypto.h>
+ #include <linux/sched.h> 
+Index: linux-rt-2.6.31/arch/x86/kernel/cpu/Makefile
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/kernel/cpu/Makefile	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/kernel/cpu/Makefile	2010-05-17 14:23:19.948410653 +0200
+@@ -13,7 +13,9 @@
+ 
+ obj-y			:= intel_cacheinfo.o addon_cpuid_features.o
+ obj-y			+= proc.o capflags.o powerflags.o common.o
+-obj-y			+= vmware.o hypervisor.o
++obj-y			+= vmware.o hypervisor.o 
++
++obj-$(CONFIG_SMP)	+= sched.o
+ 
+ obj-$(CONFIG_X86_32)	+= bugs.o cmpxchg.o
+ obj-$(CONFIG_X86_64)	+= bugs_64.o
+Index: linux-rt-2.6.31/arch/x86/kernel/cpu/common.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/kernel/cpu/common.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/kernel/cpu/common.c	2010-05-17 14:23:19.948410653 +0200
+@@ -1017,7 +1017,9 @@
+  */
+ static const unsigned int exception_stack_sizes[N_EXCEPTION_STACKS] = {
+ 	  [0 ... N_EXCEPTION_STACKS - 1]	= EXCEPTION_STKSZ,
++#if DEBUG_STACK > 0
+ 	  [DEBUG_STACK - 1]			= DEBUG_STKSZ
++#endif
+ };
+ 
+ static DEFINE_PER_CPU_PAGE_ALIGNED(char, exception_stacks
+Index: linux-rt-2.6.31/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c	2010-05-17 14:23:19.948410653 +0200
+@@ -60,7 +60,6 @@
+ };
+ 
+ #define INTEL_MSR_RANGE		(0xffff)
+-#define CPUID_6_ECX_APERFMPERF_CAPABILITY	(0x1)
+ 
+ struct acpi_cpufreq_data {
+ 	struct acpi_processor_performance *acpi_data;
+@@ -71,11 +70,7 @@
+ 
+ static DEFINE_PER_CPU(struct acpi_cpufreq_data *, drv_data);
+ 
+-struct acpi_msr_data {
+-	u64 saved_aperf, saved_mperf;
+-};
+-
+-static DEFINE_PER_CPU(struct acpi_msr_data, msr_data);
++static DEFINE_PER_CPU(struct aperfmperf, old_perf);
+ 
+ DEFINE_TRACE(power_mark);
+ 
+@@ -244,23 +239,12 @@
+ 	return cmd.val;
+ }
+ 
+-struct perf_pair {
+-	union {
+-		struct {
+-			u32 lo;
+-			u32 hi;
+-		} split;
+-		u64 whole;
+-	} aperf, mperf;
+-};
+-
+ /* Called via smp_call_function_single(), on the target CPU */
+ static void read_measured_perf_ctrs(void *_cur)
+ {
+-	struct perf_pair *cur = _cur;
++	struct aperfmperf *am = _cur;
+ 
+-	rdmsr(MSR_IA32_APERF, cur->aperf.split.lo, cur->aperf.split.hi);
+-	rdmsr(MSR_IA32_MPERF, cur->mperf.split.lo, cur->mperf.split.hi);
++	get_aperfmperf(am);
+ }
+ 
+ /*
+@@ -279,63 +263,17 @@
+ static unsigned int get_measured_perf(struct cpufreq_policy *policy,
+ 				      unsigned int cpu)
+ {
+-	struct perf_pair readin, cur;
+-	unsigned int perf_percent;
++	struct aperfmperf perf;
++	unsigned long ratio;
+ 	unsigned int retval;
+ 
+-	if (smp_call_function_single(cpu, read_measured_perf_ctrs, &readin, 1))
++	if (smp_call_function_single(cpu, read_measured_perf_ctrs, &perf, 1))
+ 		return 0;
+ 
+-	cur.aperf.whole = readin.aperf.whole -
+-				per_cpu(msr_data, cpu).saved_aperf;
+-	cur.mperf.whole = readin.mperf.whole -
+-				per_cpu(msr_data, cpu).saved_mperf;
+-	per_cpu(msr_data, cpu).saved_aperf = readin.aperf.whole;
+-	per_cpu(msr_data, cpu).saved_mperf = readin.mperf.whole;
+-
+-#ifdef __i386__
+-	/*
+-	 * We dont want to do 64 bit divide with 32 bit kernel
+-	 * Get an approximate value. Return failure in case we cannot get
+-	 * an approximate value.
+-	 */
+-	if (unlikely(cur.aperf.split.hi || cur.mperf.split.hi)) {
+-		int shift_count;
+-		u32 h;
+-
+-		h = max_t(u32, cur.aperf.split.hi, cur.mperf.split.hi);
+-		shift_count = fls(h);
+-
+-		cur.aperf.whole >>= shift_count;
+-		cur.mperf.whole >>= shift_count;
+-	}
+-
+-	if (((unsigned long)(-1) / 100) < cur.aperf.split.lo) {
+-		int shift_count = 7;
+-		cur.aperf.split.lo >>= shift_count;
+-		cur.mperf.split.lo >>= shift_count;
+-	}
+-
+-	if (cur.aperf.split.lo && cur.mperf.split.lo)
+-		perf_percent = (cur.aperf.split.lo * 100) / cur.mperf.split.lo;
+-	else
+-		perf_percent = 0;
++	ratio = calc_aperfmperf_ratio(&per_cpu(old_perf, cpu), &perf);
++	per_cpu(old_perf, cpu) = perf;
+ 
+-#else
+-	if (unlikely(((unsigned long)(-1) / 100) < cur.aperf.whole)) {
+-		int shift_count = 7;
+-		cur.aperf.whole >>= shift_count;
+-		cur.mperf.whole >>= shift_count;
+-	}
+-
+-	if (cur.aperf.whole && cur.mperf.whole)
+-		perf_percent = (cur.aperf.whole * 100) / cur.mperf.whole;
+-	else
+-		perf_percent = 0;
+-
+-#endif
+-
+-	retval = (policy->cpuinfo.max_freq * perf_percent) / 100;
++	retval = (policy->cpuinfo.max_freq * ratio) >> APERFMPERF_SHIFT;
+ 
+ 	return retval;
+ }
+@@ -731,12 +669,8 @@
+ 	acpi_processor_notify_smm(THIS_MODULE);
+ 
+ 	/* Check for APERF/MPERF support in hardware */
+-	if (c->x86_vendor == X86_VENDOR_INTEL && c->cpuid_level >= 6) {
+-		unsigned int ecx;
+-		ecx = cpuid_ecx(6);
+-		if (ecx & CPUID_6_ECX_APERFMPERF_CAPABILITY)
+-			acpi_cpufreq_driver.getavg = get_measured_perf;
+-	}
++	if (cpu_has(c, X86_FEATURE_APERFMPERF))
++		acpi_cpufreq_driver.getavg = get_measured_perf;
+ 
+ 	dprintk("CPU%u - ACPI performance management activated.\n", cpu);
+ 	for (i = 0; i < perf->state_count; i++)
+Index: linux-rt-2.6.31/arch/x86/kernel/cpu/intel.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/kernel/cpu/intel.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/kernel/cpu/intel.c	2010-05-17 14:23:19.948410653 +0200
+@@ -349,6 +349,12 @@
+ 			set_cpu_cap(c, X86_FEATURE_ARCH_PERFMON);
+ 	}
+ 
++	if (c->cpuid_level > 6) {
++		unsigned ecx = cpuid_ecx(6);
++		if (ecx & 0x01)
++			set_cpu_cap(c, X86_FEATURE_APERFMPERF);
++	}
++
+ 	if (cpu_has_xmm2)
+ 		set_cpu_cap(c, X86_FEATURE_LFENCE_RDTSC);
+ 	if (cpu_has_ds) {
+Index: linux-rt-2.6.31/arch/x86/kernel/cpu/mtrr/generic.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/kernel/cpu/mtrr/generic.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/kernel/cpu/mtrr/generic.c	2010-05-17 14:23:19.948410653 +0200
+@@ -549,7 +549,7 @@
+ 
+ 
+ static unsigned long cr4 = 0;
+-static DEFINE_SPINLOCK(set_atomicity_lock);
++static DEFINE_ATOMIC_SPINLOCK(set_atomicity_lock);
+ 
+ /*
+  * Since we are disabling the cache don't allow any interrupts - they
+@@ -566,7 +566,7 @@
+ 	   for this CPU while the MTRRs are changed, but changing this requires
+ 	   more invasive changes to the way the kernel boots  */
+ 
+-	spin_lock(&set_atomicity_lock);
++	atomic_spin_lock(&set_atomicity_lock);
+ 
+ 	/*  Enter the no-fill (CD=1, NW=0) cache mode and flush caches. */
+ 	cr0 = read_cr0() | X86_CR0_CD;
+@@ -603,7 +603,7 @@
+ 	/*  Restore value of CR4  */
+ 	if ( cpu_has_pge )
+ 		write_cr4(cr4);
+-	spin_unlock(&set_atomicity_lock);
++	atomic_spin_unlock(&set_atomicity_lock);
+ }
+ 
+ static void generic_set_all(void)
+Index: linux-rt-2.6.31/arch/x86/kernel/cpu/sched.c
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ linux-rt-2.6.31/arch/x86/kernel/cpu/sched.c	2010-05-17 14:23:19.948410653 +0200
+@@ -0,0 +1,58 @@
++#include <linux/sched.h>
++#include <linux/math64.h>
++#include <linux/percpu.h>
++#include <linux/irqflags.h>
++
++#include <asm/cpufeature.h>
++#include <asm/processor.h>
++
++static DEFINE_PER_CPU(struct aperfmperf, old_aperfmperf);
++
++static unsigned long scale_aperfmperf(void)
++{
++	struct aperfmperf cur, val, *old = &__get_cpu_var(old_aperfmperf);
++	unsigned long ratio = SCHED_LOAD_SCALE;
++	unsigned long flags;
++
++	local_irq_save(flags);
++	get_aperfmperf(&val);
++	local_irq_restore(flags);
++
++	cur = val;
++	cur.aperf -= old->aperf;
++	cur.mperf -= old->mperf;
++	*old = val;
++
++	cur.mperf >>= SCHED_LOAD_SHIFT;
++	if (cur.mperf)
++		ratio = div_u64(cur.aperf, cur.mperf);
++
++	return ratio;
++}
++
++unsigned long arch_scale_freq_power(struct sched_domain *sd, int cpu)
++{
++	/*
++	 * do aperf/mperf on the cpu level because it includes things
++	 * like turbo mode, which are relevant to full cores.
++	 */
++	if (boot_cpu_has(X86_FEATURE_APERFMPERF))
++		return scale_aperfmperf();
++
++	/*
++	 * maybe have something cpufreq here
++	 */
++
++	return default_scale_freq_power(sd, cpu);
++}
++
++unsigned long arch_scale_smt_power(struct sched_domain *sd, int cpu)
++{
++	/*
++	 * aperf/mperf already includes the smt gain
++	 */
++	if (boot_cpu_has(X86_FEATURE_APERFMPERF))
++		return SCHED_LOAD_SCALE;
++
++	return default_scale_smt_power(sd, cpu);
++}
+Index: linux-rt-2.6.31/arch/x86/kernel/dumpstack_32.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/kernel/dumpstack_32.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/kernel/dumpstack_32.c	2010-05-17 14:23:19.948410653 +0200
+@@ -99,6 +99,12 @@
+ }
+ 
+ 
++#if defined(CONFIG_DEBUG_STACKOVERFLOW) && defined(CONFIG_EVENT_TRACE)
++extern unsigned long worst_stack_left;
++#else
++# define worst_stack_left -1L
++#endif
++
+ void show_registers(struct pt_regs *regs)
+ {
+ 	int i;
+Index: linux-rt-2.6.31/arch/x86/kernel/dumpstack_64.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/kernel/dumpstack_64.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/kernel/dumpstack_64.c	2010-05-17 14:23:19.948410653 +0200
+@@ -21,10 +21,14 @@
+ 
+ 
+ static char x86_stack_ids[][8] = {
++#if DEBUG_STACK > 0
+ 		[DEBUG_STACK - 1] = "#DB",
++#endif
+ 		[NMI_STACK - 1] = "NMI",
+ 		[DOUBLEFAULT_STACK - 1] = "#DF",
++#if STACKFAULT_STACK > 0
+ 		[STACKFAULT_STACK - 1] = "#SS",
++#endif
+ 		[MCE_STACK - 1] = "#MC",
+ #if DEBUG_STKSZ > EXCEPTION_STKSZ
+ 		[N_EXCEPTION_STACKS ...
+Index: linux-rt-2.6.31/arch/x86/kernel/early_printk.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/kernel/early_printk.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/kernel/early_printk.c	2010-05-17 14:23:19.948410653 +0200
+@@ -59,7 +59,7 @@
+ static struct console early_vga_console = {
+ 	.name =		"earlyvga",
+ 	.write =	early_vga_write,
+-	.flags =	CON_PRINTBUFFER,
++	.flags =	CON_PRINTBUFFER | CON_ATOMIC,
+ 	.index =	-1,
+ };
+ 
+@@ -156,7 +156,7 @@
+ static struct console early_serial_console = {
+ 	.name =		"earlyser",
+ 	.write =	early_serial_write,
+-	.flags =	CON_PRINTBUFFER,
++	.flags =	CON_PRINTBUFFER | CON_ATOMIC,
+ 	.index =	-1,
+ };
+ 
+@@ -881,7 +881,7 @@
+ 
+ asmlinkage void early_printk(const char *fmt, ...)
+ {
+-	char buf[512];
++	static char buf[512];
+ 	int n;
+ 	va_list ap;
+ 
+Index: linux-rt-2.6.31/arch/x86/kernel/entry_32.S
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/kernel/entry_32.S	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/kernel/entry_32.S	2010-05-17 14:23:19.948410653 +0200
+@@ -371,13 +371,13 @@
+ ENTRY(resume_kernel)
+ 	DISABLE_INTERRUPTS(CLBR_ANY)
+ 	cmpl $0,TI_preempt_count(%ebp)	# non-zero preempt_count ?
+-	jnz restore_all
++	jnz restore_nocheck
+ need_resched:
+ 	movl TI_flags(%ebp), %ecx	# need_resched set ?
+ 	testb $_TIF_NEED_RESCHED, %cl
+-	jz restore_all
++	jz restore_nocheck
+ 	testl $X86_EFLAGS_IF,PT_EFLAGS(%esp)	# interrupts off (exception path) ?
+-	jz restore_all
++	jz restore_nocheck
+ 	call preempt_schedule_irq
+ 	jmp need_resched
+ END(resume_kernel)
+@@ -627,12 +627,9 @@
+ 	testb $_TIF_NEED_RESCHED, %cl
+ 	jz work_notifysig
+ work_resched:
+-	call schedule
++	call __schedule
+ 	LOCKDEP_SYS_EXIT
+-	DISABLE_INTERRUPTS(CLBR_ANY)	# make sure we don't miss an interrupt
+-					# setting need_resched or sigpending
+-					# between sampling and the iret
+-	TRACE_IRQS_OFF
++
+ 	movl TI_flags(%ebp), %ecx
+ 	andl $_TIF_WORK_MASK, %ecx	# is there any work to be done other
+ 					# than syscall tracing?
+Index: linux-rt-2.6.31/arch/x86/kernel/entry_64.S
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/kernel/entry_64.S	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/kernel/entry_64.S	2010-05-17 14:23:19.948410653 +0200
+@@ -146,7 +146,7 @@
+ END(ftrace_graph_caller)
+ 
+ GLOBAL(return_to_handler)
+-	subq  $80, %rsp
++	subq  $24, %rsp
+ 
+ 	/* Save the return values */
+ 	movq %rax, (%rsp)
+@@ -155,10 +155,10 @@
+ 
+ 	call ftrace_return_to_handler
+ 
+-	movq %rax, 72(%rsp)
++	movq %rax, 16(%rsp)
+ 	movq 8(%rsp), %rdx
+ 	movq (%rsp), %rax
+-	addq $72, %rsp
++	addq $16, %rsp
+ 	retq
+ #endif
+ 
+Index: linux-rt-2.6.31/arch/x86/kernel/ftrace.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/kernel/ftrace.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/kernel/ftrace.c	2010-05-17 14:23:19.948410653 +0200
+@@ -417,10 +417,6 @@
+ 	unsigned long return_hooker = (unsigned long)
+ 				&return_to_handler;
+ 
+-	/* Nmi's are currently unsupported */
+-	if (unlikely(in_nmi()))
+-		return;
+-
+ 	if (unlikely(atomic_read(&current->tracing_graph_pause)))
+ 		return;
+ 
+@@ -498,37 +494,56 @@
+ 
+ struct syscall_metadata *syscall_nr_to_meta(int nr)
+ {
+-	if (!syscalls_metadata || nr >= FTRACE_SYSCALL_MAX || nr < 0)
++	if (!syscalls_metadata || nr >= NR_syscalls || nr < 0)
+ 		return NULL;
+ 
+ 	return syscalls_metadata[nr];
+ }
+ 
+-void arch_init_ftrace_syscalls(void)
++int syscall_name_to_nr(char *name)
++{
++	int i;
++
++	if (!syscalls_metadata)
++		return -1;
++
++	for (i = 0; i < NR_syscalls; i++) {
++		if (syscalls_metadata[i]) {
++			if (!strcmp(syscalls_metadata[i]->name, name))
++				return i;
++		}
++	}
++	return -1;
++}
++
++void set_syscall_enter_id(int num, int id)
++{
++	syscalls_metadata[num]->enter_id = id;
++}
++
++void set_syscall_exit_id(int num, int id)
++{
++	syscalls_metadata[num]->exit_id = id;
++}
++
++static int __init arch_init_ftrace_syscalls(void)
+ {
+ 	int i;
+ 	struct syscall_metadata *meta;
+ 	unsigned long **psys_syscall_table = &sys_call_table;
+-	static atomic_t refs;
+-
+-	if (atomic_inc_return(&refs) != 1)
+-		goto end;
+ 
+ 	syscalls_metadata = kzalloc(sizeof(*syscalls_metadata) *
+-					FTRACE_SYSCALL_MAX, GFP_KERNEL);
++					NR_syscalls, GFP_KERNEL);
+ 	if (!syscalls_metadata) {
+ 		WARN_ON(1);
+-		return;
++		return -ENOMEM;
+ 	}
+ 
+-	for (i = 0; i < FTRACE_SYSCALL_MAX; i++) {
++	for (i = 0; i < NR_syscalls; i++) {
+ 		meta = find_syscall_meta(psys_syscall_table[i]);
+ 		syscalls_metadata[i] = meta;
+ 	}
+-	return;
+-
+-	/* Paranoid: avoid overflow */
+-end:
+-	atomic_dec(&refs);
++	return 0;
+ }
++arch_initcall(arch_init_ftrace_syscalls);
+ #endif
+Index: linux-rt-2.6.31/arch/x86/kernel/head64.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/kernel/head64.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/kernel/head64.c	2010-05-17 14:23:19.948410653 +0200
+@@ -30,7 +30,11 @@
+ {
+ 	pgd_t *pgd = pgd_offset_k(0UL);
+ 	pgd_clear(pgd);
+-	__flush_tlb_all();
++	/*
++	 * preempt_disable/enable does not work this early in the
++	 * bootup yet:
++	 */
++	write_cr3(read_cr3());
+ }
+ 
+ /* Don't add a printk in there. printk relies on the PDA which is not initialized 
+Index: linux-rt-2.6.31/arch/x86/kernel/head_32.S
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/kernel/head_32.S	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/kernel/head_32.S	2010-05-17 14:23:19.948410653 +0200
+@@ -591,6 +591,7 @@
+ 	call dump_stack
+ 
+ 	addl $(5*4),%esp
++	call dump_stack
+ 	popl %ds
+ 	popl %es
+ 	popl %edx
+Index: linux-rt-2.6.31/arch/x86/kernel/i8253.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/kernel/i8253.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/kernel/i8253.c	2010-05-17 14:23:19.948410653 +0200
+@@ -16,7 +16,7 @@
+ #include <asm/hpet.h>
+ #include <asm/smp.h>
+ 
+-DEFINE_SPINLOCK(i8253_lock);
++DEFINE_ATOMIC_SPINLOCK(i8253_lock);
+ EXPORT_SYMBOL(i8253_lock);
+ 
+ #ifdef CONFIG_X86_32
+@@ -41,7 +41,7 @@
+ static void init_pit_timer(enum clock_event_mode mode,
+ 			   struct clock_event_device *evt)
+ {
+-	spin_lock(&i8253_lock);
++	atomic_spin_lock(&i8253_lock);
+ 
+ 	switch (mode) {
+ 	case CLOCK_EVT_MODE_PERIODIC:
+@@ -72,7 +72,7 @@
+ 		pit_enable_clocksource();
+ 		break;
+ 	}
+-	spin_unlock(&i8253_lock);
++	atomic_spin_unlock(&i8253_lock);
+ }
+ 
+ /*
+@@ -82,10 +82,10 @@
+  */
+ static int pit_next_event(unsigned long delta, struct clock_event_device *evt)
+ {
+-	spin_lock(&i8253_lock);
++	atomic_spin_lock(&i8253_lock);
+ 	outb_pit(delta & 0xff , PIT_CH0);	/* LSB */
+ 	outb_pit(delta >> 8 , PIT_CH0);		/* MSB */
+-	spin_unlock(&i8253_lock);
++	atomic_spin_unlock(&i8253_lock);
+ 
+ 	return 0;
+ }
+@@ -140,7 +140,7 @@
+ 	int count;
+ 	u32 jifs;
+ 
+-	spin_lock_irqsave(&i8253_lock, flags);
++	atomic_spin_lock_irqsave(&i8253_lock, flags);
+ 	/*
+ 	 * Although our caller may have the read side of xtime_lock,
+ 	 * this is now a seqlock, and we are cheating in this routine
+@@ -186,7 +186,7 @@
+ 	old_count = count;
+ 	old_jifs = jifs;
+ 
+-	spin_unlock_irqrestore(&i8253_lock, flags);
++	atomic_spin_unlock_irqrestore(&i8253_lock, flags);
+ 
+ 	count = (LATCH - 1) - count;
+ 
+Index: linux-rt-2.6.31/arch/x86/kernel/i8259.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/kernel/i8259.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/kernel/i8259.c	2010-05-17 14:23:19.948410653 +0200
+@@ -32,7 +32,7 @@
+  */
+ 
+ static int i8259A_auto_eoi;
+-DEFINE_SPINLOCK(i8259A_lock);
++DEFINE_ATOMIC_SPINLOCK(i8259A_lock);
+ static void mask_and_ack_8259A(unsigned int);
+ 
+ struct irq_chip i8259A_chip = {
+@@ -68,13 +68,13 @@
+ 	unsigned int mask = 1 << irq;
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&i8259A_lock, flags);
++	atomic_spin_lock_irqsave(&i8259A_lock, flags);
+ 	cached_irq_mask |= mask;
+ 	if (irq & 8)
+ 		outb(cached_slave_mask, PIC_SLAVE_IMR);
+ 	else
+ 		outb(cached_master_mask, PIC_MASTER_IMR);
+-	spin_unlock_irqrestore(&i8259A_lock, flags);
++	atomic_spin_unlock_irqrestore(&i8259A_lock, flags);
+ }
+ 
+ void enable_8259A_irq(unsigned int irq)
+@@ -82,13 +82,13 @@
+ 	unsigned int mask = ~(1 << irq);
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&i8259A_lock, flags);
++	atomic_spin_lock_irqsave(&i8259A_lock, flags);
+ 	cached_irq_mask &= mask;
+ 	if (irq & 8)
+ 		outb(cached_slave_mask, PIC_SLAVE_IMR);
+ 	else
+ 		outb(cached_master_mask, PIC_MASTER_IMR);
+-	spin_unlock_irqrestore(&i8259A_lock, flags);
++	atomic_spin_unlock_irqrestore(&i8259A_lock, flags);
+ }
+ 
+ int i8259A_irq_pending(unsigned int irq)
+@@ -97,12 +97,12 @@
+ 	unsigned long flags;
+ 	int ret;
+ 
+-	spin_lock_irqsave(&i8259A_lock, flags);
++	atomic_spin_lock_irqsave(&i8259A_lock, flags);
+ 	if (irq < 8)
+ 		ret = inb(PIC_MASTER_CMD) & mask;
+ 	else
+ 		ret = inb(PIC_SLAVE_CMD) & (mask >> 8);
+-	spin_unlock_irqrestore(&i8259A_lock, flags);
++	atomic_spin_unlock_irqrestore(&i8259A_lock, flags);
+ 
+ 	return ret;
+ }
+@@ -150,7 +150,7 @@
+ 	unsigned int irqmask = 1 << irq;
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&i8259A_lock, flags);
++	atomic_spin_lock_irqsave(&i8259A_lock, flags);
+ 	/*
+ 	 * Lightweight spurious IRQ detection. We do not want
+ 	 * to overdo spurious IRQ handling - it's usually a sign
+@@ -168,6 +168,8 @@
+ 	 */
+ 	if (cached_irq_mask & irqmask)
+ 		goto spurious_8259A_irq;
++	if (irq & 8)
++		outb(0x60+(irq&7), PIC_SLAVE_CMD); /* 'Specific EOI' to slave */
+ 	cached_irq_mask |= irqmask;
+ 
+ handle_real_irq:
+@@ -183,7 +185,7 @@
+ 		outb(cached_master_mask, PIC_MASTER_IMR);
+ 		outb(0x60+irq, PIC_MASTER_CMD);	/* 'Specific EOI to master */
+ 	}
+-	spin_unlock_irqrestore(&i8259A_lock, flags);
++	atomic_spin_unlock_irqrestore(&i8259A_lock, flags);
+ 	return;
+ 
+ spurious_8259A_irq:
+@@ -285,24 +287,24 @@
+ {
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&i8259A_lock, flags);
++	atomic_spin_lock_irqsave(&i8259A_lock, flags);
+ 
+ 	outb(0xff, PIC_MASTER_IMR);	/* mask all of 8259A-1 */
+ 	outb(0xff, PIC_SLAVE_IMR);	/* mask all of 8259A-2 */
+ 
+-	spin_unlock_irqrestore(&i8259A_lock, flags);
++	atomic_spin_unlock_irqrestore(&i8259A_lock, flags);
+ }
+ 
+ void unmask_8259A(void)
+ {
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&i8259A_lock, flags);
++	atomic_spin_lock_irqsave(&i8259A_lock, flags);
+ 
+ 	outb(cached_master_mask, PIC_MASTER_IMR); /* restore master IRQ mask */
+ 	outb(cached_slave_mask, PIC_SLAVE_IMR);	  /* restore slave IRQ mask */
+ 
+-	spin_unlock_irqrestore(&i8259A_lock, flags);
++	atomic_spin_unlock_irqrestore(&i8259A_lock, flags);
+ }
+ 
+ void init_8259A(int auto_eoi)
+@@ -311,7 +313,7 @@
+ 
+ 	i8259A_auto_eoi = auto_eoi;
+ 
+-	spin_lock_irqsave(&i8259A_lock, flags);
++	atomic_spin_lock_irqsave(&i8259A_lock, flags);
+ 
+ 	outb(0xff, PIC_MASTER_IMR);	/* mask all of 8259A-1 */
+ 	outb(0xff, PIC_SLAVE_IMR);	/* mask all of 8259A-2 */
+@@ -328,10 +330,10 @@
+ 	/* 8259A-1 (the master) has a slave on IR2 */
+ 	outb_pic(1U << PIC_CASCADE_IR, PIC_MASTER_IMR);
+ 
+-	if (auto_eoi)	/* master does Auto EOI */
+-		outb_pic(MASTER_ICW4_DEFAULT | PIC_ICW4_AEOI, PIC_MASTER_IMR);
+-	else		/* master expects normal EOI */
+-		outb_pic(MASTER_ICW4_DEFAULT, PIC_MASTER_IMR);
++	if (!auto_eoi)	/* master expects normal EOI */
++		outb_p(MASTER_ICW4_DEFAULT, PIC_MASTER_IMR);
++	else		/* master does Auto EOI */
++		outb_p(MASTER_ICW4_DEFAULT | PIC_ICW4_AEOI, PIC_MASTER_IMR);
+ 
+ 	outb_pic(0x11, PIC_SLAVE_CMD);	/* ICW1: select 8259A-2 init */
+ 
+@@ -356,5 +358,5 @@
+ 	outb(cached_master_mask, PIC_MASTER_IMR); /* restore master IRQ mask */
+ 	outb(cached_slave_mask, PIC_SLAVE_IMR);	  /* restore slave IRQ mask */
+ 
+-	spin_unlock_irqrestore(&i8259A_lock, flags);
++	atomic_spin_unlock_irqrestore(&i8259A_lock, flags);
+ }
+Index: linux-rt-2.6.31/arch/x86/kernel/irq.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/kernel/irq.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/kernel/irq.c	2010-05-17 14:23:19.948410653 +0200
+@@ -149,7 +149,7 @@
+ 	if (!desc)
+ 		return 0;
+ 
+-	spin_lock_irqsave(&desc->lock, flags);
++	atomic_spin_lock_irqsave(&desc->lock, flags);
+ 	for_each_online_cpu(j)
+ 		any_count |= kstat_irqs_cpu(i, j);
+ 	action = desc->action;
+@@ -170,7 +170,7 @@
+ 
+ 	seq_putc(p, '\n');
+ out:
+-	spin_unlock_irqrestore(&desc->lock, flags);
++	atomic_spin_unlock_irqrestore(&desc->lock, flags);
+ 	return 0;
+ }
+ 
+Index: linux-rt-2.6.31/arch/x86/kernel/irq_64.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/kernel/irq_64.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/kernel/irq_64.c	2010-05-17 14:23:19.948410653 +0200
+@@ -81,12 +81,12 @@
+ 			continue;
+ 
+ 		/* interrupt's are disabled at this point */
+-		spin_lock(&desc->lock);
++		atomic_spin_lock(&desc->lock);
+ 
+ 		affinity = desc->affinity;
+ 		if (!irq_has_action(irq) ||
+ 		    cpumask_equal(affinity, cpu_online_mask)) {
+-			spin_unlock(&desc->lock);
++			atomic_spin_unlock(&desc->lock);
+ 			continue;
+ 		}
+ 
+@@ -106,7 +106,7 @@
+ 		if (desc->chip->unmask)
+ 			desc->chip->unmask(irq);
+ 
+-		spin_unlock(&desc->lock);
++		atomic_spin_unlock(&desc->lock);
+ 
+ 		if (break_affinity && set_affinity)
+ 			printk("Broke affinity for irq %i\n", irq);
+Index: linux-rt-2.6.31/arch/x86/kernel/irqinit.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/kernel/irqinit.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/kernel/irqinit.c	2010-05-17 14:23:19.948410653 +0200
+@@ -72,6 +72,7 @@
+ static struct irqaction fpu_irq = {
+ 	.handler = math_error_irq,
+ 	.name = "fpu",
++	.flags = IRQF_NODELAY,
+ };
+ #endif
+ 
+@@ -81,6 +82,7 @@
+ static struct irqaction irq2 = {
+ 	.handler = no_action,
+ 	.name = "cascade",
++	.flags = IRQF_NODELAY,
+ };
+ 
+ DEFINE_PER_CPU(vector_irq_t, vector_irq) = {
+Index: linux-rt-2.6.31/arch/x86/kernel/kprobes.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/kernel/kprobes.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/kernel/kprobes.c	2010-05-17 14:23:19.948410653 +0200
+@@ -454,7 +454,7 @@
+ 		/* Boost up -- we can execute copied instructions directly */
+ 		reset_current_kprobe();
+ 		regs->ip = (unsigned long)p->ainsn.insn;
+-		preempt_enable_no_resched();
++		preempt_enable();
+ 		return;
+ 	}
+ #endif
+@@ -480,7 +480,7 @@
+ 		arch_disarm_kprobe(p);
+ 		regs->ip = (unsigned long)p->addr;
+ 		reset_current_kprobe();
+-		preempt_enable_no_resched();
++		preempt_enable();
+ 		break;
+ #endif
+ 	case KPROBE_HIT_ACTIVE:
+@@ -576,7 +576,7 @@
+ 		}
+ 	} /* else: not a kprobe fault; let the kernel handle it */
+ 
+-	preempt_enable_no_resched();
++	preempt_enable();
+ 	return 0;
+ }
+ 
+@@ -876,7 +876,7 @@
+ 	}
+ 	reset_current_kprobe();
+ out:
+-	preempt_enable_no_resched();
++	preempt_enable();
+ 
+ 	/*
+ 	 * if somebody else is singlestepping across a probe point, flags
+@@ -910,7 +910,7 @@
+ 			restore_previous_kprobe(kcb);
+ 		else
+ 			reset_current_kprobe();
+-		preempt_enable_no_resched();
++		preempt_enable();
+ 		break;
+ 	case KPROBE_HIT_ACTIVE:
+ 	case KPROBE_HIT_SSDONE:
+@@ -1051,7 +1051,7 @@
+ 		memcpy((kprobe_opcode_t *)(kcb->jprobe_saved_sp),
+ 		       kcb->jprobes_stack,
+ 		       MIN_STACK_SIZE(kcb->jprobe_saved_sp));
+-		preempt_enable_no_resched();
++		preempt_enable();
+ 		return 1;
+ 	}
+ 	return 0;
+Index: linux-rt-2.6.31/arch/x86/kernel/paravirt.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/kernel/paravirt.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/kernel/paravirt.c	2010-05-17 14:23:19.948410653 +0200
+@@ -425,6 +425,20 @@
+ #define PTE_IDENT	__PV_IS_CALLEE_SAVE(_paravirt_ident_64)
+ #endif
+ 
++#ifdef CONFIG_HIGHPTE
++/*
++ * kmap_atomic() might be an inline or a macro:
++ */
++static void *kmap_atomic_func(struct page *page, enum km_type idx)
++{
++	return kmap_atomic(page, idx);
++}
++static void *kmap_atomic_direct_func(struct page *page, enum km_type idx)
++{
++	return kmap_atomic_direct(page, idx);
++}
++#endif
++
+ struct pv_mmu_ops pv_mmu_ops = {
+ #ifndef CONFIG_X86_64
+ 	.pagetable_setup_start = native_pagetable_setup_start,
+@@ -465,7 +479,8 @@
+ 	.ptep_modify_prot_commit = __ptep_modify_prot_commit,
+ 
+ #ifdef CONFIG_HIGHPTE
+-	.kmap_atomic_pte = kmap_atomic,
++	.kmap_atomic_pte = kmap_atomic_func,
++	.kmap_atomic_pte_direct = kmap_atomic_direct_func,
+ #endif
+ 
+ #if PAGETABLE_LEVELS >= 3
+Index: linux-rt-2.6.31/arch/x86/kernel/process_32.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/kernel/process_32.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/kernel/process_32.c	2010-05-17 14:23:19.948410653 +0200
+@@ -105,7 +105,6 @@
+ 		tick_nohz_stop_sched_tick(1);
+ 		while (!need_resched()) {
+ 
+-			check_pgt_cache();
+ 			rmb();
+ 
+ 			if (cpu_is_offline(cpu))
+@@ -117,10 +116,12 @@
+ 			pm_idle();
+ 			start_critical_timings();
+ 		}
++		local_irq_disable();
+ 		tick_nohz_restart_sched_tick();
+-		preempt_enable_no_resched();
+-		schedule();
++		__preempt_enable_no_resched();
++		__schedule();
+ 		preempt_disable();
++		local_irq_enable();
+ 	}
+ }
+ 
+@@ -162,8 +163,10 @@
+ 		regs->ax, regs->bx, regs->cx, regs->dx);
+ 	printk("ESI: %08lx EDI: %08lx EBP: %08lx ESP: %08lx\n",
+ 		regs->si, regs->di, regs->bp, sp);
+-	printk(" DS: %04x ES: %04x FS: %04x GS: %04x SS: %04x\n",
+-	       (u16)regs->ds, (u16)regs->es, (u16)regs->fs, gs, ss);
++	printk(" DS: %04x ES: %04x FS: %04x GS: %04x SS: %04x"
++	       " preempt:%08x\n",
++	       (u16)regs->ds, (u16)regs->es, (u16)regs->fs, gs, ss,
++	       preempt_count());
+ 
+ 	if (!all)
+ 		return;
+Index: linux-rt-2.6.31/arch/x86/kernel/process_64.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/kernel/process_64.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/kernel/process_64.c	2010-05-17 14:23:19.958516267 +0200
+@@ -152,9 +152,11 @@
+ 		}
+ 
+ 		tick_nohz_restart_sched_tick();
+-		preempt_enable_no_resched();
+-		schedule();
++		local_irq_disable();
++		__preempt_enable_no_resched();
++		__schedule();
+ 		preempt_disable();
++		local_irq_enable();
+ 	}
+ }
+ 
+Index: linux-rt-2.6.31/arch/x86/kernel/ptrace.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/kernel/ptrace.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/kernel/ptrace.c	2010-05-17 14:23:19.958516267 +0200
+@@ -35,10 +35,11 @@
+ #include <asm/proto.h>
+ #include <asm/ds.h>
+ 
+-#include <trace/syscall.h>
+-
+ #include "tls.h"
+ 
++#define CREATE_TRACE_POINTS
++#include <trace/events/syscalls.h>
++
+ enum x86_regset {
+ 	REGSET_GENERAL,
+ 	REGSET_FP,
+@@ -1497,8 +1498,8 @@
+ 	    tracehook_report_syscall_entry(regs))
+ 		ret = -1L;
+ 
+-	if (unlikely(test_thread_flag(TIF_SYSCALL_FTRACE)))
+-		ftrace_syscall_enter(regs);
++	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
++		trace_sys_enter(regs, regs->orig_ax);
+ 
+ 	if (unlikely(current->audit_context)) {
+ 		if (IS_IA32)
+@@ -1523,8 +1524,8 @@
+ 	if (unlikely(current->audit_context))
+ 		audit_syscall_exit(AUDITSC_RESULT(regs->ax), regs->ax);
+ 
+-	if (unlikely(test_thread_flag(TIF_SYSCALL_FTRACE)))
+-		ftrace_syscall_exit(regs);
++	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
++		trace_sys_exit(regs, regs->ax);
+ 
+ 	if (test_thread_flag(TIF_SYSCALL_TRACE))
+ 		tracehook_report_syscall_exit(regs, 0);
+Index: linux-rt-2.6.31/arch/x86/kernel/signal.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/kernel/signal.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/kernel/signal.c	2010-05-17 14:23:19.958516267 +0200
+@@ -782,6 +782,13 @@
+ 	int signr;
+ 	sigset_t *oldset;
+ 
++#ifdef CONFIG_PREEMPT_RT
++	/*
++	 * Fully-preemptible kernel does not need interrupts disabled:
++	 */
++	local_irq_enable();
++	preempt_check_resched();
++#endif
+ 	/*
+ 	 * We want the common case to go fast, which is why we may in certain
+ 	 * cases get here from kernel mode. Just return without doing anything
+Index: linux-rt-2.6.31/arch/x86/kernel/smp.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/kernel/smp.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/kernel/smp.c	2010-05-17 14:23:19.958516267 +0200
+@@ -120,6 +120,16 @@
+ 	apic->send_IPI_mask(cpumask_of(cpu), RESCHEDULE_VECTOR);
+ }
+ 
++/*
++ * this function sends a 'reschedule' IPI to all other CPUs.
++ * This is used when RT tasks are starving and other CPUs
++ * might be able to run them:
++ */
++void smp_send_reschedule_allbutself(void)
++{
++	apic->send_IPI_allbutself(RESCHEDULE_VECTOR);
++}
++
+ void native_send_call_func_single_ipi(int cpu)
+ {
+ 	apic->send_IPI_mask(cpumask_of(cpu), CALL_FUNCTION_SINGLE_VECTOR);
+Index: linux-rt-2.6.31/arch/x86/kernel/sys_x86_64.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/kernel/sys_x86_64.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/kernel/sys_x86_64.c	2010-05-17 14:23:19.958516267 +0200
+@@ -18,9 +18,9 @@
+ #include <asm/ia32.h>
+ #include <asm/syscalls.h>
+ 
+-asmlinkage long sys_mmap(unsigned long addr, unsigned long len,
+-		unsigned long prot, unsigned long flags,
+-		unsigned long fd, unsigned long off)
++SYSCALL_DEFINE6(mmap, unsigned long, addr, unsigned long, len,
++		unsigned long, prot, unsigned long, flags,
++		unsigned long, fd, unsigned long, off)
+ {
+ 	long error;
+ 	error = -EINVAL;
+@@ -211,7 +211,7 @@
+ }
+ 
+ 
+-asmlinkage long sys_uname(struct new_utsname __user *name)
++SYSCALL_DEFINE1(uname, struct new_utsname __user *, name)
+ {
+ 	int err;
+ 	down_read(&uts_sem);
+Index: linux-rt-2.6.31/arch/x86/kernel/time_32.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/kernel/time_32.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/kernel/time_32.c	2010-05-17 14:23:19.958516267 +0200
+@@ -84,11 +84,11 @@
+ 		 * manually to deassert NMI lines for the watchdog if run
+ 		 * on an 82489DX-based system.
+ 		 */
+-		spin_lock(&i8259A_lock);
++		atomic_spin_lock(&i8259A_lock);
+ 		outb(0x0c, PIC_MASTER_OCW3);
+ 		/* Ack the IRQ; AEOI will end it automatically. */
+ 		inb(PIC_MASTER_POLL);
+-		spin_unlock(&i8259A_lock);
++		atomic_spin_unlock(&i8259A_lock);
+ 	}
+ #endif
+ 
+Index: linux-rt-2.6.31/arch/x86/kernel/traps.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/kernel/traps.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/kernel/traps.c	2010-05-17 14:23:19.958516267 +0200
+@@ -91,9 +91,10 @@
+ 		local_irq_enable();
+ }
+ 
+-static inline void preempt_conditional_sti(struct pt_regs *regs)
++static inline void preempt_conditional_sti(struct pt_regs *regs, int stack)
+ {
+-	inc_preempt_count();
++	if (stack)
++		inc_preempt_count();
+ 	if (regs->flags & X86_EFLAGS_IF)
+ 		local_irq_enable();
+ }
+@@ -104,11 +105,12 @@
+ 		local_irq_disable();
+ }
+ 
+-static inline void preempt_conditional_cli(struct pt_regs *regs)
++static inline void preempt_conditional_cli(struct pt_regs *regs, int stack)
+ {
+ 	if (regs->flags & X86_EFLAGS_IF)
+ 		local_irq_disable();
+-	dec_preempt_count();
++	if (stack)
++		dec_preempt_count();
+ }
+ 
+ #ifdef CONFIG_X86_32
+@@ -296,9 +298,9 @@
+ 	if (notify_die(DIE_TRAP, "stack segment", regs, error_code,
+ 			12, SIGBUS) == NOTIFY_STOP)
+ 		return;
+-	preempt_conditional_sti(regs);
++	preempt_conditional_sti(regs, STACKFAULT_STACK);
+ 	do_trap(12, SIGBUS, "stack segment", regs, error_code, NULL);
+-	preempt_conditional_cli(regs);
++	preempt_conditional_cli(regs, STACKFAULT_STACK);
+ }
+ 
+ dotraplinkage void do_double_fault(struct pt_regs *regs, long error_code)
+@@ -548,9 +550,9 @@
+ 		return;
+ #endif
+ 
+-	preempt_conditional_sti(regs);
++	preempt_conditional_sti(regs, DEBUG_STACK);
+ 	do_trap(3, SIGTRAP, "int3", regs, error_code, NULL);
+-	preempt_conditional_cli(regs);
++	preempt_conditional_cli(regs, DEBUG_STACK);
+ }
+ 
+ #ifdef CONFIG_X86_64
+@@ -627,7 +629,7 @@
+ 		return;
+ 
+ 	/* It's safe to allow irq's after DR6 has been saved */
+-	preempt_conditional_sti(regs);
++	preempt_conditional_sti(regs, DEBUG_STACK);
+ 
+ 	/* Mask out spurious debug traps due to lazy DR7 setting */
+ 	if (condition & (DR_TRAP0|DR_TRAP1|DR_TRAP2|DR_TRAP3)) {
+@@ -662,7 +664,7 @@
+ 	 */
+ clear_dr7:
+ 	set_debugreg(0, 7);
+-	preempt_conditional_cli(regs);
++	preempt_conditional_cli(regs, DEBUG_STACK);
+ 	return;
+ 
+ #ifdef CONFIG_X86_32
+@@ -677,7 +679,7 @@
+ clear_TF_reenable:
+ 	set_tsk_thread_flag(tsk, TIF_SINGLESTEP);
+ 	regs->flags &= ~X86_EFLAGS_TF;
+-	preempt_conditional_cli(regs);
++	preempt_conditional_cli(regs, DEBUG_STACK);
+ 	return;
+ }
+ 
+Index: linux-rt-2.6.31/arch/x86/kernel/tsc_sync.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/kernel/tsc_sync.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/kernel/tsc_sync.c	2010-05-17 14:23:19.958516267 +0200
+@@ -104,6 +104,7 @@
+  */
+ void __cpuinit check_tsc_sync_source(int cpu)
+ {
++	unsigned long flags;
+ 	int cpus = 2;
+ 
+ 	/*
+@@ -129,8 +130,11 @@
+ 	/*
+ 	 * Wait for the target to arrive:
+ 	 */
++	local_save_flags(flags);
++	local_irq_enable();
+ 	while (atomic_read(&start_count) != cpus-1)
+ 		cpu_relax();
++	local_irq_restore(flags);
+ 	/*
+ 	 * Trigger the target to continue into the measurement too:
+ 	 */
+Index: linux-rt-2.6.31/arch/x86/kernel/visws_quirks.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/kernel/visws_quirks.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/kernel/visws_quirks.c	2010-05-17 14:23:19.958516267 +0200
+@@ -581,7 +581,7 @@
+ 	struct irq_desc *desc;
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&i8259A_lock, flags);
++	atomic_spin_lock_irqsave(&i8259A_lock, flags);
+ 
+ 	/* Find out what's interrupting in the PIIX4 master 8259 */
+ 	outb(0x0c, 0x20);		/* OCW3 Poll command */
+@@ -618,7 +618,7 @@
+ 		outb(0x60 + realirq, 0x20);
+ 	}
+ 
+-	spin_unlock_irqrestore(&i8259A_lock, flags);
++	atomic_spin_unlock_irqrestore(&i8259A_lock, flags);
+ 
+ 	desc = irq_to_desc(realirq);
+ 
+@@ -636,18 +636,20 @@
+ 	return IRQ_HANDLED;
+ 
+ out_unlock:
+-	spin_unlock_irqrestore(&i8259A_lock, flags);
++	atomic_spin_unlock_irqrestore(&i8259A_lock, flags);
+ 	return IRQ_NONE;
+ }
+ 
+ static struct irqaction master_action = {
+ 	.handler =	piix4_master_intr,
+ 	.name =		"PIIX4-8259",
++	.flags =	IRQF_NODELAY,
+ };
+ 
+ static struct irqaction cascade_action = {
+ 	.handler = 	no_action,
+ 	.name =		"cascade",
++	.flags =	IRQF_NODELAY,
+ };
+ 
+ 
+Index: linux-rt-2.6.31/arch/x86/kernel/vm86_32.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/kernel/vm86_32.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/kernel/vm86_32.c	2010-05-17 14:23:19.958516267 +0200
+@@ -137,6 +137,7 @@
+ 	local_irq_enable();
+ 
+ 	if (!current->thread.vm86_info) {
++		local_irq_disable();
+ 		printk("no vm86_info: BAD\n");
+ 		do_exit(SIGSEGV);
+ 	}
+Index: linux-rt-2.6.31/arch/x86/kernel/vsyscall_64.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/kernel/vsyscall_64.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/kernel/vsyscall_64.c	2010-05-17 14:23:19.958516267 +0200
+@@ -59,7 +59,7 @@
+ 
+ struct vsyscall_gtod_data __vsyscall_gtod_data __section_vsyscall_gtod_data =
+ {
+-	.lock = SEQLOCK_UNLOCKED,
++	.lock = __ATOMIC_SEQLOCK_UNLOCKED(__vsyscall_gtod_data.lock),
+ 	.sysctl_enabled = 1,
+ };
+ 
+@@ -67,27 +67,54 @@
+ {
+ 	unsigned long flags;
+ 
+-	write_seqlock_irqsave(&vsyscall_gtod_data.lock, flags);
++	write_atomic_seqlock_irqsave(&vsyscall_gtod_data.lock, flags);
+ 	/* sys_tz has changed */
+ 	vsyscall_gtod_data.sys_tz = sys_tz;
+-	write_sequnlock_irqrestore(&vsyscall_gtod_data.lock, flags);
++	write_atomic_sequnlock_irqrestore(&vsyscall_gtod_data.lock, flags);
+ }
+ 
+ void update_vsyscall(struct timespec *wall_time, struct clocksource *clock)
+ {
+ 	unsigned long flags;
+ 
+-	write_seqlock_irqsave(&vsyscall_gtod_data.lock, flags);
++	write_atomic_seqlock_irqsave(&vsyscall_gtod_data.lock, flags);
++
++	if (likely(vsyscall_gtod_data.sysctl_enabled == 2)) {
++		struct timespec tmp = *(wall_time);
++		cycle_t (*vread)(void);
++		cycle_t now;
++
++		vread = vsyscall_gtod_data.clock.vread;
++		if (likely(vread))
++			now = vread();
++		else
++			now = clock->read(clock);
++
++		/* calculate interval: */
++		now = (now - clock->cycle_last) & clock->mask;
++		/* convert to nsecs: */
++		tmp.tv_nsec += ( now * clock->mult) >> clock->shift;
++
++		while (tmp.tv_nsec >= NSEC_PER_SEC) {
++			tmp.tv_sec += 1;
++			tmp.tv_nsec -= NSEC_PER_SEC;
++		}
++
++		vsyscall_gtod_data.wall_time_sec = tmp.tv_sec;
++		vsyscall_gtod_data.wall_time_nsec = tmp.tv_nsec;
++	} else {
++		vsyscall_gtod_data.wall_time_sec = wall_time->tv_sec;
++		vsyscall_gtod_data.wall_time_nsec = wall_time->tv_nsec;
++	}
++
+ 	/* copy vsyscall data */
+ 	vsyscall_gtod_data.clock.vread = clock->vread;
+ 	vsyscall_gtod_data.clock.cycle_last = clock->cycle_last;
+ 	vsyscall_gtod_data.clock.mask = clock->mask;
+ 	vsyscall_gtod_data.clock.mult = clock->mult;
+ 	vsyscall_gtod_data.clock.shift = clock->shift;
+-	vsyscall_gtod_data.wall_time_sec = wall_time->tv_sec;
+-	vsyscall_gtod_data.wall_time_nsec = wall_time->tv_nsec;
+ 	vsyscall_gtod_data.wall_to_monotonic = wall_to_monotonic;
+-	write_sequnlock_irqrestore(&vsyscall_gtod_data.lock, flags);
++	write_atomic_sequnlock_irqrestore(&vsyscall_gtod_data.lock, flags);
+ }
+ 
+ /* RED-PEN may want to readd seq locking, but then the variable should be
+@@ -123,8 +150,28 @@
+ 	unsigned seq;
+ 	unsigned long mult, shift, nsec;
+ 	cycle_t (*vread)(void);
++
++	if (likely(__vsyscall_gtod_data.sysctl_enabled == 2)) {
++		struct timeval tmp;
++
++		do {
++			barrier();
++			tv->tv_sec = __vsyscall_gtod_data.wall_time_sec;
++			tv->tv_usec = __vsyscall_gtod_data.wall_time_nsec;
++			barrier();
++			tmp.tv_sec = __vsyscall_gtod_data.wall_time_sec;
++			tmp.tv_usec = __vsyscall_gtod_data.wall_time_nsec;
++
++		} while (tmp.tv_usec != tv->tv_usec ||
++					tmp.tv_sec != tv->tv_sec);
++
++		tv->tv_usec /= NSEC_PER_MSEC;
++		tv->tv_usec *= USEC_PER_MSEC;
++		return;
++	}
++
+ 	do {
+-		seq = read_seqbegin(&__vsyscall_gtod_data.lock);
++		seq = read_atomic_seqbegin(&__vsyscall_gtod_data.lock);
+ 
+ 		vread = __vsyscall_gtod_data.clock.vread;
+ 		if (unlikely(!__vsyscall_gtod_data.sysctl_enabled || !vread)) {
+@@ -133,6 +180,7 @@
+ 		}
+ 
+ 		now = vread();
++
+ 		base = __vsyscall_gtod_data.clock.cycle_last;
+ 		mask = __vsyscall_gtod_data.clock.mask;
+ 		mult = __vsyscall_gtod_data.clock.mult;
+@@ -140,7 +188,9 @@
+ 
+ 		tv->tv_sec = __vsyscall_gtod_data.wall_time_sec;
+ 		nsec = __vsyscall_gtod_data.wall_time_nsec;
+-	} while (read_seqretry(&__vsyscall_gtod_data.lock, seq));
++	} while (read_atomic_seqretry(&__vsyscall_gtod_data.lock, seq));
++
++	now = vread();
+ 
+ 	/* calculate interval: */
+ 	cycle_delta = (now - base) & mask;
+Index: linux-rt-2.6.31/arch/x86/kvm/Kconfig
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/kvm/Kconfig	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/kvm/Kconfig	2010-05-17 14:23:19.958516267 +0200
+@@ -65,7 +65,7 @@
+ 
+ config KVM_TRACE
+ 	bool "KVM trace support"
+-	depends on KVM && SYSFS
++	depends on KVM && SYSFS && !PREEMPTRT
+ 	select MARKERS
+ 	select RELAY
+ 	select DEBUG_FS
+Index: linux-rt-2.6.31/arch/x86/kvm/i8254.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/kvm/i8254.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/kvm/i8254.c	2010-05-17 14:23:19.958516267 +0200
+@@ -240,11 +240,11 @@
+ {
+ 	struct kvm_kpit_state *ps = container_of(kian, struct kvm_kpit_state,
+ 						 irq_ack_notifier);
+-	spin_lock(&ps->inject_lock);
++	atomic_spin_lock(&ps->inject_lock);
+ 	if (atomic_dec_return(&ps->pit_timer.pending) < 0)
+ 		atomic_inc(&ps->pit_timer.pending);
+ 	ps->irq_ack = 1;
+-	spin_unlock(&ps->inject_lock);
++	atomic_spin_unlock(&ps->inject_lock);
+ }
+ 
+ void __kvm_migrate_pit_timer(struct kvm_vcpu *vcpu)
+@@ -583,7 +583,7 @@
+ 
+ 	mutex_init(&pit->pit_state.lock);
+ 	mutex_lock(&pit->pit_state.lock);
+-	spin_lock_init(&pit->pit_state.inject_lock);
++	atomic_spin_lock_init(&pit->pit_state.inject_lock);
+ 
+ 	/* Initialize PIO device */
+ 	pit->dev.read = pit_ioport_read;
+@@ -675,12 +675,12 @@
+ 		/* Try to inject pending interrupts when
+ 		 * last one has been acked.
+ 		 */
+-		spin_lock(&ps->inject_lock);
++		atomic_spin_lock(&ps->inject_lock);
+ 		if (atomic_read(&ps->pit_timer.pending) && ps->irq_ack) {
+ 			ps->irq_ack = 0;
+ 			inject = 1;
+ 		}
+-		spin_unlock(&ps->inject_lock);
++		atomic_spin_unlock(&ps->inject_lock);
+ 		if (inject)
+ 			__inject_pit_timer_intr(kvm);
+ 	}
+Index: linux-rt-2.6.31/arch/x86/kvm/i8254.h
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/kvm/i8254.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/kvm/i8254.h	2010-05-17 14:23:19.958516267 +0200
+@@ -26,7 +26,7 @@
+ 	u32    speaker_data_on;
+ 	struct mutex lock;
+ 	struct kvm_pit *pit;
+-	spinlock_t inject_lock;
++	atomic_spinlock_t inject_lock;
+ 	unsigned long irq_ack;
+ 	struct kvm_irq_ack_notifier irq_ack_notifier;
+ };
+Index: linux-rt-2.6.31/arch/x86/kvm/i8259.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/kvm/i8259.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/kvm/i8259.c	2010-05-17 14:23:19.958516267 +0200
+@@ -34,7 +34,7 @@
+ static void pic_lock(struct kvm_pic *s)
+ 	__acquires(&s->lock)
+ {
+-	spin_lock(&s->lock);
++	atomic_spin_lock(&s->lock);
+ }
+ 
+ static void pic_unlock(struct kvm_pic *s)
+@@ -48,7 +48,7 @@
+ 	s->pending_acks = 0;
+ 	s->wakeup_needed = false;
+ 
+-	spin_unlock(&s->lock);
++	atomic_spin_unlock(&s->lock);
+ 
+ 	while (acks) {
+ 		kvm_notify_acked_irq(kvm, SELECT_PIC(__ffs(acks)),
+@@ -522,7 +522,7 @@
+ 	s = kzalloc(sizeof(struct kvm_pic), GFP_KERNEL);
+ 	if (!s)
+ 		return NULL;
+-	spin_lock_init(&s->lock);
++	atomic_spin_lock_init(&s->lock);
+ 	s->kvm = kvm;
+ 	s->pics[0].elcr_mask = 0xf8;
+ 	s->pics[1].elcr_mask = 0xde;
+Index: linux-rt-2.6.31/arch/x86/kvm/irq.h
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/kvm/irq.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/kvm/irq.h	2010-05-17 14:23:19.958516267 +0200
+@@ -62,7 +62,7 @@
+ };
+ 
+ struct kvm_pic {
+-	spinlock_t lock;
++	atomic_spinlock_t lock;
+ 	bool wakeup_needed;
+ 	unsigned pending_acks;
+ 	struct kvm *kvm;
+Index: linux-rt-2.6.31/arch/x86/mm/fault.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/mm/fault.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/mm/fault.c	2010-05-17 14:23:19.958516267 +0200
+@@ -561,6 +561,7 @@
+ 		nr = (address - idt_descr.address) >> 3;
+ 
+ 		if (nr == 6) {
++			zap_rt_locks();
+ 			do_invalid_op(regs, 0);
+ 			return 1;
+ 		}
+@@ -1032,7 +1033,7 @@
+ 	 * If we're in an interrupt, have no user context or are running
+ 	 * in an atomic region then we must not take the fault:
+ 	 */
+-	if (unlikely(in_atomic() || !mm)) {
++	if (unlikely(in_atomic() || !mm || current->pagefault_disabled)) {
+ 		bad_area_nosemaphore(regs, error_code, address);
+ 		return;
+ 	}
+Index: linux-rt-2.6.31/arch/x86/mm/gup.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/mm/gup.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/mm/gup.c	2010-05-17 14:23:19.958516267 +0200
+@@ -77,13 +77,13 @@
+ 	if (write)
+ 		mask |= _PAGE_RW;
+ 
+-	ptep = pte_offset_map(&pmd, addr);
++	ptep = pte_offset_map_direct(&pmd, addr);
+ 	do {
+ 		pte_t pte = gup_get_pte(ptep);
+ 		struct page *page;
+ 
+ 		if ((pte_flags(pte) & (mask | _PAGE_SPECIAL)) != mask) {
+-			pte_unmap(ptep);
++			pte_unmap_direct(ptep);
+ 			return 0;
+ 		}
+ 		VM_BUG_ON(!pfn_valid(pte_pfn(pte)));
+@@ -93,7 +93,7 @@
+ 		(*nr)++;
+ 
+ 	} while (ptep++, addr += PAGE_SIZE, addr != end);
+-	pte_unmap(ptep - 1);
++	pte_unmap_direct(ptep - 1);
+ 
+ 	return 1;
+ }
+Index: linux-rt-2.6.31/arch/x86/mm/highmem_32.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/mm/highmem_32.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/mm/highmem_32.c	2010-05-17 14:23:19.958516267 +0200
+@@ -4,9 +4,9 @@
+ 
+ void *kmap(struct page *page)
+ {
+-	might_sleep();
+ 	if (!PageHighMem(page))
+ 		return page_address(page);
++	might_sleep();
+ 	return kmap_high(page);
+ }
+ 
+@@ -19,6 +19,27 @@
+ 	kunmap_high(page);
+ }
+ 
++void kunmap_virt(void *ptr)
++{
++	struct page *page;
++
++	if ((unsigned long)ptr < PKMAP_ADDR(0))
++		return;
++	page = pte_page(pkmap_page_table[PKMAP_NR((unsigned long)ptr)]);
++	kunmap(page);
++}
++
++struct page *kmap_to_page(void *ptr)
++{
++	struct page *page;
++
++	if ((unsigned long)ptr < PKMAP_ADDR(0))
++		return virt_to_page(ptr);
++	page = pte_page(pkmap_page_table[PKMAP_NR((unsigned long)ptr)]);
++	return page;
++}
++EXPORT_SYMBOL_GPL(kmap_to_page); /* PREEMPT_RT converts some modules to use this */
++
+ /*
+  * kmap_atomic/kunmap_atomic is significantly faster than kmap/kunmap because
+  * no global lock is needed and because the kmap code must perform a global TLB
+@@ -27,12 +48,13 @@
+  * However when holding an atomic kmap is is not legal to sleep, so atomic
+  * kmaps are appropriate for short, tight code paths only.
+  */
+-void *kmap_atomic_prot(struct page *page, enum km_type type, pgprot_t prot)
++void *__kmap_atomic_prot(struct page *page, enum km_type type, pgprot_t prot)
+ {
+ 	enum fixed_addresses idx;
+ 	unsigned long vaddr;
+ 
+ 	/* even !CONFIG_PREEMPT needs this, for in_atomic in do_page_fault */
++	preempt_disable();
+ 	pagefault_disable();
+ 
+ 	if (!PageHighMem(page))
+@@ -42,18 +64,23 @@
+ 
+ 	idx = type + KM_TYPE_NR*smp_processor_id();
+ 	vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
+-	BUG_ON(!pte_none(*(kmap_pte-idx)));
++	WARN_ON(!pte_none(*(kmap_pte-idx)));
+ 	set_pte(kmap_pte-idx, mk_pte(page, prot));
+ 
+ 	return (void *)vaddr;
+ }
+ 
+-void *kmap_atomic(struct page *page, enum km_type type)
++void *__kmap_atomic_direct(struct page *page, enum km_type type)
++{
++	return __kmap_atomic_prot(page, type, kmap_prot);
++}
++
++void *__kmap_atomic(struct page *page, enum km_type type)
+ {
+ 	return kmap_atomic_prot(page, type, kmap_prot);
+ }
+ 
+-void kunmap_atomic(void *kvaddr, enum km_type type)
++void __kunmap_atomic(void *kvaddr, enum km_type type)
+ {
+ 	unsigned long vaddr = (unsigned long) kvaddr & PAGE_MASK;
+ 	enum fixed_addresses idx = type + KM_TYPE_NR*smp_processor_id();
+@@ -74,19 +101,21 @@
+ 	}
+ 
+ 	pagefault_enable();
++	preempt_enable();
+ }
+ 
+ /*
+  * This is the same as kmap_atomic() but can map memory that doesn't
+  * have a struct page associated with it.
+  */
+-void *kmap_atomic_pfn(unsigned long pfn, enum km_type type)
++void *__kmap_atomic_pfn(unsigned long pfn, enum km_type type)
+ {
++	preempt_disable();
+ 	return kmap_atomic_prot_pfn(pfn, type, kmap_prot);
+ }
+-EXPORT_SYMBOL_GPL(kmap_atomic_pfn); /* temporarily in use by i915 GEM until vmap */
++EXPORT_SYMBOL_GPL(__kmap_atomic_pfn); /* temporarily in use by i915 GEM until vmap */
+ 
+-struct page *kmap_atomic_to_page(void *ptr)
++struct page *__kmap_atomic_to_page(void *ptr)
+ {
+ 	unsigned long idx, vaddr = (unsigned long)ptr;
+ 	pte_t *pte;
+@@ -101,9 +130,10 @@
+ 
+ EXPORT_SYMBOL(kmap);
+ EXPORT_SYMBOL(kunmap);
+-EXPORT_SYMBOL(kmap_atomic);
+-EXPORT_SYMBOL(kunmap_atomic);
+-EXPORT_SYMBOL(kmap_atomic_prot);
++EXPORT_SYMBOL(kunmap_virt);
++EXPORT_SYMBOL(__kmap_atomic);
++EXPORT_SYMBOL(__kunmap_atomic);
++EXPORT_SYMBOL(__kmap_atomic_prot);
+ 
+ void __init set_highmem_pages_init(void)
+ {
+Index: linux-rt-2.6.31/arch/x86/mm/init.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/mm/init.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/mm/init.c	2010-05-17 14:23:19.958516267 +0200
+@@ -14,8 +14,6 @@
+ #include <asm/tlb.h>
+ #include <asm/proto.h>
+ 
+-DEFINE_PER_CPU(struct mmu_gather, mmu_gathers);
+-
+ unsigned long __initdata e820_table_start;
+ unsigned long __meminitdata e820_table_end;
+ unsigned long __meminitdata e820_table_top;
+Index: linux-rt-2.6.31/arch/x86/mm/iomap_32.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/mm/iomap_32.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/mm/iomap_32.c	2010-05-17 14:23:19.958516267 +0200
+@@ -37,6 +37,7 @@
+ 	enum fixed_addresses idx;
+ 	unsigned long vaddr;
+ 
++	preempt_disable();
+ 	pagefault_disable();
+ 
+ 	debug_kmap_atomic(type);
+@@ -83,5 +84,6 @@
+ 		kpte_clear_flush(kmap_pte-idx, vaddr);
+ 
+ 	pagefault_enable();
++	preempt_enable();
+ }
+ EXPORT_SYMBOL_GPL(iounmap_atomic);
+Index: linux-rt-2.6.31/arch/x86/mm/pageattr.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/mm/pageattr.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/mm/pageattr.c	2010-05-17 14:23:19.958516267 +0200
+@@ -862,8 +862,10 @@
+ 		baddr = *addr;
+ 	}
+ 
++#if 0
+ 	/* Must avoid aliasing mappings in the highmem code */
+ 	kmap_flush_unused();
++#endif
+ 
+ 	vm_unmap_aliases();
+ 
+Index: linux-rt-2.6.31/arch/x86/mm/pgtable.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/mm/pgtable.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/mm/pgtable.c	2010-05-17 14:23:19.958516267 +0200
+@@ -132,6 +132,7 @@
+ 	   reserved at the pmd (PDPT) level. */
+ 	set_pud(pudp, __pud(__pa(pmd) | _PAGE_PRESENT));
+ 
++	preempt_disable();
+ 	/*
+ 	 * According to Intel App note "TLBs, Paging-Structure Caches,
+ 	 * and Their Invalidation", April 2007, document 317080-001,
+@@ -140,6 +141,7 @@
+ 	 */
+ 	if (mm == current->active_mm)
+ 		write_cr3(read_cr3());
++	preempt_enable();
+ }
+ #else  /* !CONFIG_X86_PAE */
+ 
+Index: linux-rt-2.6.31/arch/x86/mm/tlb.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/mm/tlb.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/mm/tlb.c	2010-05-17 14:23:19.958516267 +0200
+@@ -41,7 +41,7 @@
+ 	struct {
+ 		struct mm_struct *flush_mm;
+ 		unsigned long flush_va;
+-		spinlock_t tlbstate_lock;
++		atomic_spinlock_t tlbstate_lock;
+ 		DECLARE_BITMAP(flush_cpumask, NR_CPUS);
+ 	};
+ 	char pad[CONFIG_X86_INTERNODE_CACHE_BYTES];
+@@ -184,7 +184,7 @@
+ 	 * num_online_cpus() <= NUM_INVALIDATE_TLB_VECTORS, but it is
+ 	 * probably not worth checking this for a cache-hot lock.
+ 	 */
+-	spin_lock(&f->tlbstate_lock);
++	atomic_spin_lock(&f->tlbstate_lock);
+ 
+ 	f->flush_mm = mm;
+ 	f->flush_va = va;
+@@ -202,7 +202,7 @@
+ 
+ 	f->flush_mm = NULL;
+ 	f->flush_va = 0;
+-	spin_unlock(&f->tlbstate_lock);
++	atomic_spin_unlock(&f->tlbstate_lock);
+ }
+ 
+ void native_flush_tlb_others(const struct cpumask *cpumask,
+@@ -226,7 +226,7 @@
+ 	int i;
+ 
+ 	for (i = 0; i < ARRAY_SIZE(flush_state); i++)
+-		spin_lock_init(&flush_state[i].tlbstate_lock);
++		atomic_spin_lock_init(&flush_state[i].tlbstate_lock);
+ 
+ 	return 0;
+ }
+Index: linux-rt-2.6.31/arch/x86/oprofile/nmi_int.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/oprofile/nmi_int.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/oprofile/nmi_int.c	2010-05-17 14:23:19.958516267 +0200
+@@ -125,9 +125,9 @@
+ {
+ 	int cpu = smp_processor_id();
+ 	struct op_msrs *msrs = &per_cpu(cpu_msrs, cpu);
+-	spin_lock(&oprofilefs_lock);
++	atomic_spin_lock(&oprofilefs_lock);
+ 	model->setup_ctrs(msrs);
+-	spin_unlock(&oprofilefs_lock);
++	atomic_spin_unlock(&oprofilefs_lock);
+ 	per_cpu(saved_lvtpc, cpu) = apic_read(APIC_LVTPC);
+ 	apic_write(APIC_LVTPC, APIC_DM_NMI);
+ }
+Index: linux-rt-2.6.31/arch/x86/pci/common.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/pci/common.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/pci/common.c	2010-05-17 14:23:19.958516267 +0200
+@@ -81,7 +81,7 @@
+  * This interrupt-safe spinlock protects all accesses to PCI
+  * configuration space.
+  */
+-DEFINE_SPINLOCK(pci_config_lock);
++DEFINE_ATOMIC_SPINLOCK(pci_config_lock);
+ 
+ static int __devinit can_skip_ioresource_align(const struct dmi_system_id *d)
+ {
+Index: linux-rt-2.6.31/arch/x86/pci/direct.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/pci/direct.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/pci/direct.c	2010-05-17 14:23:19.958516267 +0200
+@@ -27,7 +27,7 @@
+ 		return -EINVAL;
+ 	}
+ 
+-	spin_lock_irqsave(&pci_config_lock, flags);
++	atomic_spin_lock_irqsave(&pci_config_lock, flags);
+ 
+ 	outl(PCI_CONF1_ADDRESS(bus, devfn, reg), 0xCF8);
+ 
+@@ -43,7 +43,7 @@
+ 		break;
+ 	}
+ 
+-	spin_unlock_irqrestore(&pci_config_lock, flags);
++	atomic_spin_unlock_irqrestore(&pci_config_lock, flags);
+ 
+ 	return 0;
+ }
+@@ -56,7 +56,7 @@
+ 	if ((bus > 255) || (devfn > 255) || (reg > 4095))
+ 		return -EINVAL;
+ 
+-	spin_lock_irqsave(&pci_config_lock, flags);
++	atomic_spin_lock_irqsave(&pci_config_lock, flags);
+ 
+ 	outl(PCI_CONF1_ADDRESS(bus, devfn, reg), 0xCF8);
+ 
+@@ -72,7 +72,7 @@
+ 		break;
+ 	}
+ 
+-	spin_unlock_irqrestore(&pci_config_lock, flags);
++	atomic_spin_unlock_irqrestore(&pci_config_lock, flags);
+ 
+ 	return 0;
+ }
+@@ -108,7 +108,7 @@
+ 	if (dev & 0x10) 
+ 		return PCIBIOS_DEVICE_NOT_FOUND;
+ 
+-	spin_lock_irqsave(&pci_config_lock, flags);
++	atomic_spin_lock_irqsave(&pci_config_lock, flags);
+ 
+ 	outb((u8)(0xF0 | (fn << 1)), 0xCF8);
+ 	outb((u8)bus, 0xCFA);
+@@ -127,7 +127,7 @@
+ 
+ 	outb(0, 0xCF8);
+ 
+-	spin_unlock_irqrestore(&pci_config_lock, flags);
++	atomic_spin_unlock_irqrestore(&pci_config_lock, flags);
+ 
+ 	return 0;
+ }
+@@ -147,7 +147,7 @@
+ 	if (dev & 0x10) 
+ 		return PCIBIOS_DEVICE_NOT_FOUND;
+ 
+-	spin_lock_irqsave(&pci_config_lock, flags);
++	atomic_spin_lock_irqsave(&pci_config_lock, flags);
+ 
+ 	outb((u8)(0xF0 | (fn << 1)), 0xCF8);
+ 	outb((u8)bus, 0xCFA);
+@@ -166,7 +166,7 @@
+ 
+ 	outb(0, 0xCF8);    
+ 
+-	spin_unlock_irqrestore(&pci_config_lock, flags);
++	atomic_spin_unlock_irqrestore(&pci_config_lock, flags);
+ 
+ 	return 0;
+ }
+@@ -223,16 +223,23 @@
+ 	unsigned int tmp;
+ 	int works = 0;
+ 
+-	local_irq_save(flags);
++	atomic_spin_lock_irqsave(&pci_config_lock, flags);
+ 
+ 	outb(0x01, 0xCFB);
+ 	tmp = inl(0xCF8);
+ 	outl(0x80000000, 0xCF8);
+-	if (inl(0xCF8) == 0x80000000 && pci_sanity_check(&pci_direct_conf1)) {
+-		works = 1;
++
++	if (inl(0xCF8) == 0x80000000) {
++		atomic_spin_unlock_irqrestore(&pci_config_lock, flags);
++
++		if (pci_sanity_check(&pci_direct_conf1))
++			works = 1;
++
++		atomic_spin_lock_irqsave(&pci_config_lock, flags);
+ 	}
+ 	outl(tmp, 0xCF8);
+-	local_irq_restore(flags);
++
++	atomic_spin_unlock_irqrestore(&pci_config_lock, flags);
+ 
+ 	return works;
+ }
+@@ -242,17 +249,19 @@
+ 	unsigned long flags;
+ 	int works = 0;
+ 
+-	local_irq_save(flags);
++	atomic_spin_lock_irqsave(&pci_config_lock, flags);
+ 
+ 	outb(0x00, 0xCFB);
+ 	outb(0x00, 0xCF8);
+ 	outb(0x00, 0xCFA);
+-	if (inb(0xCF8) == 0x00 && inb(0xCFA) == 0x00 &&
+-	    pci_sanity_check(&pci_direct_conf2)) {
+-		works = 1;
+-	}
+ 
+-	local_irq_restore(flags);
++	if (inb(0xCF8) == 0x00 && inb(0xCFA) == 0x00) {
++		atomic_spin_unlock_irqrestore(&pci_config_lock, flags);
++
++		if (pci_sanity_check(&pci_direct_conf2))
++			works = 1;
++	} else
++		atomic_spin_unlock_irqrestore(&pci_config_lock, flags);
+ 
+ 	return works;
+ }
+Index: linux-rt-2.6.31/arch/x86/pci/mmconfig_32.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/pci/mmconfig_32.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/pci/mmconfig_32.c	2010-05-17 14:23:19.958516267 +0200
+@@ -72,7 +72,7 @@
+ 	if (!base)
+ 		goto err;
+ 
+-	spin_lock_irqsave(&pci_config_lock, flags);
++	atomic_spin_lock_irqsave(&pci_config_lock, flags);
+ 
+ 	pci_exp_set_dev_base(base, bus, devfn);
+ 
+@@ -87,7 +87,7 @@
+ 		*value = mmio_config_readl(mmcfg_virt_addr + reg);
+ 		break;
+ 	}
+-	spin_unlock_irqrestore(&pci_config_lock, flags);
++	atomic_spin_unlock_irqrestore(&pci_config_lock, flags);
+ 
+ 	return 0;
+ }
+@@ -105,7 +105,7 @@
+ 	if (!base)
+ 		return -EINVAL;
+ 
+-	spin_lock_irqsave(&pci_config_lock, flags);
++	atomic_spin_lock_irqsave(&pci_config_lock, flags);
+ 
+ 	pci_exp_set_dev_base(base, bus, devfn);
+ 
+@@ -120,7 +120,7 @@
+ 		mmio_config_writel(mmcfg_virt_addr + reg, value);
+ 		break;
+ 	}
+-	spin_unlock_irqrestore(&pci_config_lock, flags);
++	atomic_spin_unlock_irqrestore(&pci_config_lock, flags);
+ 
+ 	return 0;
+ }
+Index: linux-rt-2.6.31/arch/x86/pci/numaq_32.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/pci/numaq_32.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/pci/numaq_32.c	2010-05-17 14:23:19.958516267 +0200
+@@ -41,7 +41,7 @@
+ 	if (!value || (bus >= MAX_MP_BUSSES) || (devfn > 255) || (reg > 255))
+ 		return -EINVAL;
+ 
+-	spin_lock_irqsave(&pci_config_lock, flags);
++	atomic_spin_lock_irqsave(&pci_config_lock, flags);
+ 
+ 	write_cf8(bus, devfn, reg);
+ 
+@@ -66,7 +66,7 @@
+ 		break;
+ 	}
+ 
+-	spin_unlock_irqrestore(&pci_config_lock, flags);
++	atomic_spin_unlock_irqrestore(&pci_config_lock, flags);
+ 
+ 	return 0;
+ }
+@@ -80,7 +80,7 @@
+ 	if ((bus >= MAX_MP_BUSSES) || (devfn > 255) || (reg > 255)) 
+ 		return -EINVAL;
+ 
+-	spin_lock_irqsave(&pci_config_lock, flags);
++	atomic_spin_lock_irqsave(&pci_config_lock, flags);
+ 
+ 	write_cf8(bus, devfn, reg);
+ 
+@@ -105,7 +105,7 @@
+ 		break;
+ 	}
+ 
+-	spin_unlock_irqrestore(&pci_config_lock, flags);
++	atomic_spin_unlock_irqrestore(&pci_config_lock, flags);
+ 
+ 	return 0;
+ }
+Index: linux-rt-2.6.31/arch/x86/pci/pcbios.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/pci/pcbios.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/pci/pcbios.c	2010-05-17 14:23:19.958516267 +0200
+@@ -161,7 +161,7 @@
+ 	if (!value || (bus > 255) || (devfn > 255) || (reg > 255))
+ 		return -EINVAL;
+ 
+-	spin_lock_irqsave(&pci_config_lock, flags);
++	atomic_spin_lock_irqsave(&pci_config_lock, flags);
+ 
+ 	switch (len) {
+ 	case 1:
+@@ -212,7 +212,7 @@
+ 		break;
+ 	}
+ 
+-	spin_unlock_irqrestore(&pci_config_lock, flags);
++	atomic_spin_unlock_irqrestore(&pci_config_lock, flags);
+ 
+ 	return (int)((result & 0xff00) >> 8);
+ }
+@@ -227,7 +227,7 @@
+ 	if ((bus > 255) || (devfn > 255) || (reg > 255)) 
+ 		return -EINVAL;
+ 
+-	spin_lock_irqsave(&pci_config_lock, flags);
++	atomic_spin_lock_irqsave(&pci_config_lock, flags);
+ 
+ 	switch (len) {
+ 	case 1:
+@@ -268,7 +268,7 @@
+ 		break;
+ 	}
+ 
+-	spin_unlock_irqrestore(&pci_config_lock, flags);
++	atomic_spin_unlock_irqrestore(&pci_config_lock, flags);
+ 
+ 	return (int)((result & 0xff00) >> 8);
+ }
+Index: linux-rt-2.6.31/arch/x86/vdso/vclock_gettime.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/x86/vdso/vclock_gettime.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/x86/vdso/vclock_gettime.c	2010-05-17 14:23:19.958516267 +0200
+@@ -47,11 +47,11 @@
+ {
+ 	unsigned long seq, ns;
+ 	do {
+-		seq = read_seqbegin(&gtod->lock);
++		seq = read_atomic_seqbegin(&gtod->lock);
+ 		ts->tv_sec = gtod->wall_time_sec;
+ 		ts->tv_nsec = gtod->wall_time_nsec;
+ 		ns = vgetns();
+-	} while (unlikely(read_seqretry(&gtod->lock, seq)));
++	} while (unlikely(read_atomic_seqretry(&gtod->lock, seq)));
+ 	timespec_add_ns(ts, ns);
+ 	return 0;
+ }
+@@ -76,12 +76,12 @@
+ {
+ 	unsigned long seq, ns, secs;
+ 	do {
+-		seq = read_seqbegin(&gtod->lock);
++		seq = read_atomic_seqbegin(&gtod->lock);
+ 		secs = gtod->wall_time_sec;
+ 		ns = gtod->wall_time_nsec + vgetns();
+ 		secs += gtod->wall_to_monotonic.tv_sec;
+ 		ns += gtod->wall_to_monotonic.tv_nsec;
+-	} while (unlikely(read_seqretry(&gtod->lock, seq)));
++	} while (unlikely(read_atomic_seqretry(&gtod->lock, seq)));
+ 	vset_normalized_timespec(ts, secs, ns);
+ 	return 0;
+ }
+Index: linux-rt-2.6.31/arch/xtensa/include/asm/rwsem.h
+===================================================================
+--- linux-rt-2.6.31.orig/arch/xtensa/include/asm/rwsem.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/xtensa/include/asm/rwsem.h	2010-05-17 14:23:19.958516267 +0200
+@@ -25,7 +25,7 @@
+ /*
+  * the semaphore definition
+  */
+-struct rw_semaphore {
++struct rw_anon_semaphore {
+ 	signed long		count;
+ #define RWSEM_UNLOCKED_VALUE		0x00000000
+ #define RWSEM_ACTIVE_BIAS		0x00000001
+@@ -37,29 +37,37 @@
+ 	struct list_head	wait_list;
+ };
+ 
+-#define __RWSEM_INITIALIZER(name) \
++#define __RWSEM_ANON_INITIALIZER(name) \
+ 	{ RWSEM_UNLOCKED_VALUE, SPIN_LOCK_UNLOCKED, \
+ 	  LIST_HEAD_INIT((name).wait_list) }
+ 
+-#define DECLARE_RWSEM(name)		\
+-	struct rw_semaphore name = __RWSEM_INITIALIZER(name)
++#define DECLARE_ANON_RWSEM(name)		\
++	struct rw_anon_semaphore name = __RWSEM_ANON_INITIALIZER(name)
+ 
+-extern struct rw_semaphore *rwsem_down_read_failed(struct rw_semaphore *sem);
+-extern struct rw_semaphore *rwsem_down_write_failed(struct rw_semaphore *sem);
+-extern struct rw_semaphore *rwsem_wake(struct rw_semaphore *sem);
+-extern struct rw_semaphore *rwsem_downgrade_wake(struct rw_semaphore *sem);
++extern struct rw_anon_semaphore *
++rwsem_down_read_failed(struct rw_anon_semaphore *sem);
++extern struct rw_anon_semaphore *
++rwsem_down_write_failed(struct rw_anon_semaphore *sem);
++extern struct rw_anon_semaphore *rwsem_wake(struct rw_anon_semaphore *sem);
++extern struct rw_anon_semaphore *
++rwsem_downgrade_wake(struct rw_anon_semaphore *sem);
+ 
+-static inline void init_rwsem(struct rw_semaphore *sem)
++static inline void init_anon_rwsem(struct rw_anon_semaphore *sem)
+ {
+ 	sem->count = RWSEM_UNLOCKED_VALUE;
+ 	spin_lock_init(&sem->wait_lock);
+ 	INIT_LIST_HEAD(&sem->wait_list);
+ }
+ 
++static inline int anon_rwsem_is_locked(struct rw_anon_semaphore *sem)
++{
++	return (sem->count != 0);
++}
++
+ /*
+  * lock for reading
+  */
+-static inline void __down_read(struct rw_semaphore *sem)
++static inline void __down_read(struct rw_anon_semaphore *sem)
+ {
+ 	if (atomic_add_return(1,(atomic_t *)(&sem->count)) > 0)
+ 		smp_wmb();
+@@ -67,7 +75,7 @@
+ 		rwsem_down_read_failed(sem);
+ }
+ 
+-static inline int __down_read_trylock(struct rw_semaphore *sem)
++static inline int __down_read_trylock(struct rw_anon_semaphore *sem)
+ {
+ 	int tmp;
+ 
+@@ -84,7 +92,7 @@
+ /*
+  * lock for writing
+  */
+-static inline void __down_write(struct rw_semaphore *sem)
++static inline void __down_write(struct rw_anon_semaphore *sem)
+ {
+ 	int tmp;
+ 
+@@ -96,7 +104,7 @@
+ 		rwsem_down_write_failed(sem);
+ }
+ 
+-static inline int __down_write_trylock(struct rw_semaphore *sem)
++static inline int __down_write_trylock(struct rw_anon_semaphore *sem)
+ {
+ 	int tmp;
+ 
+@@ -109,7 +117,7 @@
+ /*
+  * unlock after reading
+  */
+-static inline void __up_read(struct rw_semaphore *sem)
++static inline void __up_read(struct rw_anon_semaphore *sem)
+ {
+ 	int tmp;
+ 
+@@ -122,7 +130,7 @@
+ /*
+  * unlock after writing
+  */
+-static inline void __up_write(struct rw_semaphore *sem)
++static inline void __up_write(struct rw_anon_semaphore *sem)
+ {
+ 	smp_wmb();
+ 	if (atomic_sub_return(RWSEM_ACTIVE_WRITE_BIAS,
+@@ -133,7 +141,7 @@
+ /*
+  * implement atomic add functionality
+  */
+-static inline void rwsem_atomic_add(int delta, struct rw_semaphore *sem)
++static inline void rwsem_atomic_add(int delta, struct rw_anon_semaphore *sem)
+ {
+ 	atomic_add(delta, (atomic_t *)(&sem->count));
+ }
+@@ -141,7 +149,7 @@
+ /*
+  * downgrade write lock to read lock
+  */
+-static inline void __downgrade_write(struct rw_semaphore *sem)
++static inline void __downgrade_write(struct rw_anon_semaphore *sem)
+ {
+ 	int tmp;
+ 
+@@ -154,12 +162,37 @@
+ /*
+  * implement exchange and add functionality
+  */
+-static inline int rwsem_atomic_update(int delta, struct rw_semaphore *sem)
++static inline int rwsem_atomic_update(int delta, struct rw_anon_semaphore *sem)
+ {
+ 	smp_mb();
+ 	return atomic_add_return(delta, (atomic_t *)(&sem->count));
+ }
+ 
++static inline int anon_rwsem_is_locked(struct rw_anon_semaphore *sem)
++{
++	return (sem->count != 0);
++}
++
++struct rw_semaphore {
++	signed long		count;
++	spinlock_t		wait_lock;
++	struct list_head	wait_list;
++};
++
++#define __RWSEM_INITIALIZER(name) \
++	{ RWSEM_UNLOCKED_VALUE, SPIN_LOCK_UNLOCKED, \
++	  LIST_HEAD_INIT((name).wait_list) }
++
++#define DECLARE_RWSEM(name)		\
++	struct rw_semaphore name = __RWSEM_INITIALIZER(name)
++
++static inline void init_rwsem(struct rw_semaphore *sem)
++{
++	sem->count = RWSEM_UNLOCKED_VALUE;
++	spin_lock_init(&sem->wait_lock);
++	INIT_LIST_HEAD(&sem->wait_list);
++}
++
+ static inline int rwsem_is_locked(struct rw_semaphore *sem)
+ {
+ 	return (sem->count != 0);
+Index: linux-rt-2.6.31/arch/xtensa/kernel/irq.c
+===================================================================
+--- linux-rt-2.6.31.orig/arch/xtensa/kernel/irq.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/arch/xtensa/kernel/irq.c	2010-05-17 14:23:19.958516267 +0200
+@@ -90,7 +90,7 @@
+ 	}
+ 
+ 	if (i < NR_IRQS) {
+-		spin_lock_irqsave(&irq_desc[i].lock, flags);
++		atomic_spin_lock_irqsave(&irq_desc[i].lock, flags);
+ 		action = irq_desc[i].action;
+ 		if (!action)
+ 			goto skip;
+@@ -109,7 +109,7 @@
+ 
+ 		seq_putc(p, '\n');
+ skip:
+-		spin_unlock_irqrestore(&irq_desc[i].lock, flags);
++		atomic_spin_unlock_irqrestore(&irq_desc[i].lock, flags);
+ 	} else if (i == NR_IRQS) {
+ 		seq_printf(p, "NMI: ");
+ 		for_each_online_cpu(j)
+Index: linux-rt-2.6.31/block/blk-core.c
+===================================================================
+--- linux-rt-2.6.31.orig/block/blk-core.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/block/blk-core.c	2010-05-17 14:23:19.958516267 +0200
+@@ -201,7 +201,7 @@
+  */
+ void blk_plug_device(struct request_queue *q)
+ {
+-	WARN_ON(!irqs_disabled());
++	WARN_ON_NONRT(!irqs_disabled());
+ 
+ 	/*
+ 	 * don't plug a stopped queue, it must be paired with blk_start_queue()
+@@ -241,7 +241,7 @@
+  */
+ int blk_remove_plug(struct request_queue *q)
+ {
+-	WARN_ON(!irqs_disabled());
++	WARN_ON_NONRT(!irqs_disabled());
+ 
+ 	if (!queue_flag_test_and_clear(QUEUE_FLAG_PLUGGED, q))
+ 		return 0;
+@@ -333,7 +333,7 @@
+  **/
+ void blk_start_queue(struct request_queue *q)
+ {
+-	WARN_ON(!irqs_disabled());
++	WARN_ON_NONRT(!irqs_disabled());
+ 
+ 	queue_flag_clear(QUEUE_FLAG_STOPPED, q);
+ 	__blk_run_queue(q);
+Index: linux-rt-2.6.31/drivers/acpi/acpica/acglobal.h
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/acpi/acpica/acglobal.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/acpi/acpica/acglobal.h	2010-05-17 14:23:19.958516267 +0200
+@@ -197,7 +197,12 @@
+  * interrupt level
+  */
+ ACPI_EXTERN spinlock_t _acpi_gbl_gpe_lock;	/* For GPE data structs and registers */
+-ACPI_EXTERN spinlock_t _acpi_gbl_hardware_lock;	/* For ACPI H/W except GPE registers */
++
++/*
++ * Need to be raw because it might be used in acpi_processor_idle():
++ */
++ACPI_EXTERN atomic_spinlock_t _acpi_gbl_hardware_lock;	/* For ACPI H/W except GPE registers */
++
+ #define acpi_gbl_gpe_lock	&_acpi_gbl_gpe_lock
+ #define acpi_gbl_hardware_lock	&_acpi_gbl_hardware_lock
+ 
+Index: linux-rt-2.6.31/drivers/acpi/acpica/hwregs.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/acpi/acpica/hwregs.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/acpi/acpica/hwregs.c	2010-05-17 14:23:19.958516267 +0200
+@@ -85,7 +85,7 @@
+ 			  ACPI_BITMASK_ALL_FIXED_STATUS,
+ 			  ACPI_FORMAT_UINT64(acpi_gbl_xpm1a_status.address)));
+ 
+-	lock_flags = acpi_os_acquire_lock(acpi_gbl_hardware_lock);
++	atomic_spin_lock_irqsave(acpi_gbl_hardware_lock, lock_flags);
+ 
+ 	/* Clear the fixed events in PM1 A/B */
+ 
+@@ -100,7 +100,7 @@
+ 	status = acpi_ev_walk_gpe_list(acpi_hw_clear_gpe_block, NULL);
+ 
+       unlock_and_exit:
+-	acpi_os_release_lock(acpi_gbl_hardware_lock, lock_flags);
++	atomic_spin_unlock_irqrestore(acpi_gbl_hardware_lock, lock_flags);
+ 	return_ACPI_STATUS(status);
+ }
+ 
+Index: linux-rt-2.6.31/drivers/acpi/acpica/hwxface.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/acpi/acpica/hwxface.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/acpi/acpica/hwxface.c	2010-05-17 14:23:19.968533252 +0200
+@@ -341,7 +341,7 @@
+ 		return_ACPI_STATUS(AE_BAD_PARAMETER);
+ 	}
+ 
+-	lock_flags = acpi_os_acquire_lock(acpi_gbl_hardware_lock);
++	atomic_spin_lock_irqsave(acpi_gbl_hardware_lock, lock_flags);
+ 
+ 	/*
+ 	 * At this point, we know that the parent register is one of the
+@@ -402,7 +402,7 @@
+ 
+ unlock_and_exit:
+ 
+-	acpi_os_release_lock(acpi_gbl_hardware_lock, lock_flags);
++	atomic_spin_unlock_irqrestore(acpi_gbl_hardware_lock, lock_flags);
+ 	return_ACPI_STATUS(status);
+ }
+ 
+Index: linux-rt-2.6.31/drivers/acpi/acpica/utmutex.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/acpi/acpica/utmutex.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/acpi/acpica/utmutex.c	2010-05-17 14:23:19.968533252 +0200
+@@ -84,7 +84,7 @@
+ 	/* Create the spinlocks for use at interrupt level */
+ 
+ 	spin_lock_init(acpi_gbl_gpe_lock);
+-	spin_lock_init(acpi_gbl_hardware_lock);
++	atomic_spin_lock_init(acpi_gbl_hardware_lock);
+ 
+ 	/* Create the reader/writer lock for namespace access */
+ 
+@@ -117,11 +117,6 @@
+ 		(void)acpi_ut_delete_mutex(i);
+ 	}
+ 
+-	/* Delete the spinlocks */
+-
+-	acpi_os_delete_lock(acpi_gbl_gpe_lock);
+-	acpi_os_delete_lock(acpi_gbl_hardware_lock);
+-
+ 	/* Delete the reader/writer lock */
+ 
+ 	acpi_ut_delete_rw_lock(&acpi_gbl_namespace_rw_lock);
+Index: linux-rt-2.6.31/drivers/acpi/ec.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/acpi/ec.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/acpi/ec.c	2010-05-17 14:23:19.968533252 +0200
+@@ -573,8 +573,22 @@
+ 	if (test_bit(EC_FLAGS_GPE_MODE, &ec->flags)) {
+ 		gpe_transaction(ec, status);
+ 		if (ec_transaction_done(ec) &&
+-		    (status & ACPI_EC_FLAG_IBF) == 0)
++		    (status & ACPI_EC_FLAG_IBF) == 0) {
++
++#ifndef CONFIG_PREEMPT_RT
+ 			wake_up(&ec->wait);
++#else
++			// hack ...
++			if (waitqueue_active(&ec->wait)) {
++				struct task_struct *task;
++
++				task = list_entry(ec->wait.task_list.next,
++					  wait_queue_t, task_list)->private;
++				if (task)
++					wake_up_process(task);
++			}
++#endif
++		}
+ 	}
+ 
+ 	ec_check_sci(ec, status);
+Index: linux-rt-2.6.31/drivers/acpi/osl.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/acpi/osl.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/drivers/acpi/osl.c	2010-05-17 14:23:19.968533252 +0200
+@@ -833,14 +833,14 @@
+ acpi_status
+ acpi_os_create_semaphore(u32 max_units, u32 initial_units, acpi_handle * handle)
+ {
+-	struct semaphore *sem = NULL;
++	struct anon_semaphore *sem = NULL;
+ 
+-	sem = acpi_os_allocate(sizeof(struct semaphore));
++	sem = acpi_os_allocate(sizeof(struct anon_semaphore));
+ 	if (!sem)
+ 		return AE_NO_MEMORY;
+-	memset(sem, 0, sizeof(struct semaphore));
++	memset(sem, 0, sizeof(struct anon_semaphore));
+ 
+-	sema_init(sem, initial_units);
++	anon_sema_init(sem, initial_units);
+ 
+ 	*handle = (acpi_handle *) sem;
+ 
+@@ -859,7 +859,7 @@
+ 
+ acpi_status acpi_os_delete_semaphore(acpi_handle handle)
+ {
+-	struct semaphore *sem = (struct semaphore *)handle;
++	struct anon_semaphore *sem = (struct anon_semaphore *)handle;
+ 
+ 	if (!sem)
+ 		return AE_BAD_PARAMETER;
+@@ -879,7 +879,7 @@
+ acpi_status acpi_os_wait_semaphore(acpi_handle handle, u32 units, u16 timeout)
+ {
+ 	acpi_status status = AE_OK;
+-	struct semaphore *sem = (struct semaphore *)handle;
++	struct anon_semaphore *sem = (struct anon_semaphore *)handle;
+ 	long jiffies;
+ 	int ret = 0;
+ 
+@@ -897,7 +897,7 @@
+ 	else
+ 		jiffies = msecs_to_jiffies(timeout);
+ 	
+-	ret = down_timeout(sem, jiffies);
++	ret = anon_down_timeout(sem, jiffies);
+ 	if (ret)
+ 		status = AE_TIME;
+ 
+@@ -920,7 +920,7 @@
+  */
+ acpi_status acpi_os_signal_semaphore(acpi_handle handle, u32 units)
+ {
+-	struct semaphore *sem = (struct semaphore *)handle;
++	struct anon_semaphore *sem = (struct anon_semaphore *)handle;
+ 
+ 	if (!sem || (units < 1))
+ 		return AE_BAD_PARAMETER;
+@@ -931,7 +931,7 @@
+ 	ACPI_DEBUG_PRINT((ACPI_DB_MUTEX, "Signaling semaphore[%p|%d]\n", handle,
+ 			  units));
+ 
+-	up(sem);
++	anon_up(sem);
+ 
+ 	return AE_OK;
+ }
+Index: linux-rt-2.6.31/drivers/acpi/processor_idle.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/acpi/processor_idle.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/drivers/acpi/processor_idle.c	2010-05-17 14:23:19.968533252 +0200
+@@ -928,7 +928,7 @@
+ }
+ 
+ static int c3_cpu_count;
+-static DEFINE_SPINLOCK(c3_lock);
++static DEFINE_ATOMIC_SPINLOCK(c3_lock);
+ 
+ /**
+  * acpi_idle_enter_bm - enters C3 with proper BM handling
+@@ -1003,12 +1003,12 @@
+ 	 * without doing anything.
+ 	 */
+ 	if (pr->flags.bm_check && pr->flags.bm_control) {
+-		spin_lock(&c3_lock);
++		atomic_spin_lock(&c3_lock);
+ 		c3_cpu_count++;
+ 		/* Disable bus master arbitration when all CPUs are in C3 */
+ 		if (c3_cpu_count == num_online_cpus())
+ 			acpi_write_bit_register(ACPI_BITREG_ARB_DISABLE, 1);
+-		spin_unlock(&c3_lock);
++		atomic_spin_unlock(&c3_lock);
+ 	} else if (!pr->flags.bm_check) {
+ 		ACPI_FLUSH_CPU_CACHE();
+ 	}
+@@ -1017,10 +1017,10 @@
+ 
+ 	/* Re-enable bus master arbitration */
+ 	if (pr->flags.bm_check && pr->flags.bm_control) {
+-		spin_lock(&c3_lock);
++		atomic_spin_lock(&c3_lock);
+ 		acpi_write_bit_register(ACPI_BITREG_ARB_DISABLE, 0);
+ 		c3_cpu_count--;
+-		spin_unlock(&c3_lock);
++		atomic_spin_unlock(&c3_lock);
+ 	}
+ 	kt2 = ktime_get_real();
+ 	idle_time =  ktime_to_us(ktime_sub(kt2, kt1));
+Index: linux-rt-2.6.31/drivers/ata/libata-sff.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/ata/libata-sff.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/ata/libata-sff.c	2010-05-17 14:23:19.968533252 +0200
+@@ -837,9 +837,9 @@
+ 	unsigned long flags;
+ 	unsigned int consumed;
+ 
+-	local_irq_save(flags);
++	local_irq_save_nort(flags);
+ 	consumed = ata_sff_data_xfer(dev, buf, buflen, rw);
+-	local_irq_restore(flags);
++	local_irq_restore_nort(flags);
+ 
+ 	return consumed;
+ }
+@@ -878,7 +878,7 @@
+ 		unsigned long flags;
+ 
+ 		/* FIXME: use a bounce buffer */
+-		local_irq_save(flags);
++		local_irq_save_nort(flags);
+ 		buf = kmap_atomic(page, KM_IRQ0);
+ 
+ 		/* do the actual data transfer */
+@@ -886,7 +886,7 @@
+ 				       do_write);
+ 
+ 		kunmap_atomic(buf, KM_IRQ0);
+-		local_irq_restore(flags);
++		local_irq_restore_nort(flags);
+ 	} else {
+ 		buf = page_address(page);
+ 		ap->ops->sff_data_xfer(qc->dev, buf + offset, qc->sect_size,
+@@ -1016,7 +1016,7 @@
+ 		unsigned long flags;
+ 
+ 		/* FIXME: use bounce buffer */
+-		local_irq_save(flags);
++		local_irq_save_nort(flags);
+ 		buf = kmap_atomic(page, KM_IRQ0);
+ 
+ 		/* do the actual data transfer */
+@@ -1024,7 +1024,7 @@
+ 								count, rw);
+ 
+ 		kunmap_atomic(buf, KM_IRQ0);
+-		local_irq_restore(flags);
++		local_irq_restore_nort(flags);
+ 	} else {
+ 		buf = page_address(page);
+ 		consumed = ap->ops->sff_data_xfer(dev,  buf + offset,
+Index: linux-rt-2.6.31/drivers/base/bus.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/base/bus.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/drivers/base/bus.c	2010-05-17 14:23:19.968533252 +0200
+@@ -173,10 +173,10 @@
+ 	dev = bus_find_device_by_name(bus, NULL, buf);
+ 	if (dev && dev->driver == drv) {
+ 		if (dev->parent)	/* Needed for USB */
+-			down(&dev->parent->sem);
++			mutex_lock(&dev->parent->mutex);
+ 		device_release_driver(dev);
+ 		if (dev->parent)
+-			up(&dev->parent->sem);
++			mutex_unlock(&dev->parent->mutex);
+ 		err = count;
+ 	}
+ 	put_device(dev);
+@@ -200,12 +200,12 @@
+ 	dev = bus_find_device_by_name(bus, NULL, buf);
+ 	if (dev && dev->driver == NULL && driver_match_device(drv, dev)) {
+ 		if (dev->parent)	/* Needed for USB */
+-			down(&dev->parent->sem);
+-		down(&dev->sem);
++			mutex_lock(&dev->parent->mutex);
++		mutex_lock(&dev->mutex);
+ 		err = driver_probe_device(drv, dev);
+-		up(&dev->sem);
++		mutex_unlock(&dev->mutex);
+ 		if (dev->parent)
+-			up(&dev->parent->sem);
++			mutex_unlock(&dev->parent->mutex);
+ 
+ 		if (err > 0) {
+ 			/* success */
+@@ -739,10 +739,10 @@
+ 
+ 	if (!dev->driver) {
+ 		if (dev->parent)	/* Needed for USB */
+-			down(&dev->parent->sem);
++			mutex_lock(&dev->parent->mutex);
+ 		ret = device_attach(dev);
+ 		if (dev->parent)
+-			up(&dev->parent->sem);
++			mutex_unlock(&dev->parent->mutex);
+ 	}
+ 	return ret < 0 ? ret : 0;
+ }
+@@ -774,10 +774,10 @@
+ {
+ 	if (dev->driver) {
+ 		if (dev->parent)        /* Needed for USB */
+-			down(&dev->parent->sem);
++			mutex_lock(&dev->parent->mutex);
+ 		device_release_driver(dev);
+ 		if (dev->parent)
+-			up(&dev->parent->sem);
++			mutex_unlock(&dev->parent->mutex);
+ 	}
+ 	return bus_rescan_devices_helper(dev, NULL);
+ }
+Index: linux-rt-2.6.31/drivers/base/core.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/base/core.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/drivers/base/core.c	2010-05-17 14:23:19.968533252 +0200
+@@ -20,7 +20,6 @@
+ #include <linux/notifier.h>
+ #include <linux/genhd.h>
+ #include <linux/kallsyms.h>
+-#include <linux/semaphore.h>
+ #include <linux/mutex.h>
+ #include <linux/async.h>
+ 
+@@ -550,7 +549,8 @@
+ 	dev->kobj.kset = devices_kset;
+ 	kobject_init(&dev->kobj, &device_ktype);
+ 	INIT_LIST_HEAD(&dev->dma_pools);
+-	init_MUTEX(&dev->sem);
++	mutex_init(&dev->mutex);
++	lockdep_set_novalidate_class(&dev->mutex);
+ 	spin_lock_init(&dev->devres_lock);
+ 	INIT_LIST_HEAD(&dev->devres_head);
+ 	device_init_wakeup(dev, 0);
+Index: linux-rt-2.6.31/drivers/base/dd.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/base/dd.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/base/dd.c	2010-05-17 14:23:19.968533252 +0200
+@@ -84,7 +84,7 @@
+  * for before calling this. (It is ok to call with no other effort
+  * from a driver's probe() method.)
+  *
+- * This function must be called with @dev->sem held.
++ * This function must be called with @dev->mutex held.
+  */
+ int device_bind_driver(struct device *dev)
+ {
+@@ -189,8 +189,8 @@
+  * This function returns -ENODEV if the device is not registered,
+  * 1 if the device is bound sucessfully and 0 otherwise.
+  *
+- * This function must be called with @dev->sem held.  When called for a
+- * USB interface, @dev->parent->sem must be held as well.
++ * This function must be called with @dev->mutex held.  When called for a
++ * USB interface, @dev->parent->mutex must be held as well.
+  */
+ int driver_probe_device(struct device_driver *drv, struct device *dev)
+ {
+@@ -229,13 +229,13 @@
+  * 0 if no matching driver was found;
+  * -ENODEV if the device is not registered.
+  *
+- * When called for a USB interface, @dev->parent->sem must be held.
++ * When called for a USB interface, @dev->parent->mutex must be held.
+  */
+ int device_attach(struct device *dev)
+ {
+ 	int ret = 0;
+ 
+-	down(&dev->sem);
++	mutex_lock(&dev->mutex);
+ 	if (dev->driver) {
+ 		ret = device_bind_driver(dev);
+ 		if (ret == 0)
+@@ -247,7 +247,7 @@
+ 	} else {
+ 		ret = bus_for_each_drv(dev->bus, NULL, dev, __device_attach);
+ 	}
+-	up(&dev->sem);
++	mutex_unlock(&dev->mutex);
+ 	return ret;
+ }
+ EXPORT_SYMBOL_GPL(device_attach);
+@@ -270,13 +270,13 @@
+ 		return 0;
+ 
+ 	if (dev->parent)	/* Needed for USB */
+-		down(&dev->parent->sem);
+-	down(&dev->sem);
++		mutex_lock(&dev->parent->mutex);
++	mutex_lock(&dev->mutex);
+ 	if (!dev->driver)
+ 		driver_probe_device(drv, dev);
+-	up(&dev->sem);
++	mutex_unlock(&dev->mutex);
+ 	if (dev->parent)
+-		up(&dev->parent->sem);
++		mutex_unlock(&dev->parent->mutex);
+ 
+ 	return 0;
+ }
+@@ -297,8 +297,8 @@
+ EXPORT_SYMBOL_GPL(driver_attach);
+ 
+ /*
+- * __device_release_driver() must be called with @dev->sem held.
+- * When called for a USB interface, @dev->parent->sem must be held as well.
++ * __device_release_driver() must be called with @dev->mutex held.
++ * When called for a USB interface, @dev->parent->mutex must be held as well.
+  */
+ static void __device_release_driver(struct device *dev)
+ {
+@@ -332,7 +332,7 @@
+  * @dev: device.
+  *
+  * Manually detach device from driver.
+- * When called for a USB interface, @dev->parent->sem must be held.
++ * When called for a USB interface, @dev->parent->mutex must be held.
+  */
+ void device_release_driver(struct device *dev)
+ {
+@@ -341,9 +341,9 @@
+ 	 * within their ->remove callback for the same device, they
+ 	 * will deadlock right here.
+ 	 */
+-	down(&dev->sem);
++	mutex_lock(&dev->mutex);
+ 	__device_release_driver(dev);
+-	up(&dev->sem);
++	mutex_unlock(&dev->mutex);
+ }
+ EXPORT_SYMBOL_GPL(device_release_driver);
+ 
+@@ -370,13 +370,13 @@
+ 		spin_unlock(&drv->p->klist_devices.k_lock);
+ 
+ 		if (dev->parent)	/* Needed for USB */
+-			down(&dev->parent->sem);
+-		down(&dev->sem);
++			mutex_lock(&dev->parent->mutex);
++		mutex_lock(&dev->mutex);
+ 		if (dev->driver == drv)
+ 			__device_release_driver(dev);
+-		up(&dev->sem);
++		mutex_unlock(&dev->mutex);
+ 		if (dev->parent)
+-			up(&dev->parent->sem);
++			mutex_unlock(&dev->parent->mutex);
+ 		put_device(dev);
+ 	}
+ }
+Index: linux-rt-2.6.31/drivers/base/power/main.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/base/power/main.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/base/power/main.c	2010-05-17 14:23:19.968533252 +0200
+@@ -33,8 +33,8 @@
+  * because children are guaranteed to be discovered after parents, and
+  * are inserted at the back of the list on discovery.
+  *
+- * Since device_pm_add() may be called with a device semaphore held,
+- * we must never try to acquire a device semaphore while holding
++ * Since device_pm_add() may be called with a device mutex held,
++ * we must never try to acquire a device mutex while holding
+  * dpm_list_mutex.
+  */
+ 
+@@ -381,7 +381,7 @@
+ 	TRACE_DEVICE(dev);
+ 	TRACE_RESUME(0);
+ 
+-	down(&dev->sem);
++	mutex_lock(&dev->mutex);
+ 
+ 	if (dev->bus) {
+ 		if (dev->bus->pm) {
+@@ -414,7 +414,7 @@
+ 		}
+ 	}
+  End:
+-	up(&dev->sem);
++	mutex_unlock(&dev->mutex);
+ 
+ 	TRACE_RESUME(error);
+ 	return error;
+@@ -468,7 +468,7 @@
+  */
+ static void device_complete(struct device *dev, pm_message_t state)
+ {
+-	down(&dev->sem);
++	mutex_lock(&dev->mutex);
+ 
+ 	if (dev->class && dev->class->pm && dev->class->pm->complete) {
+ 		pm_dev_dbg(dev, state, "completing class ");
+@@ -485,7 +485,7 @@
+ 		dev->bus->pm->complete(dev);
+ 	}
+ 
+-	up(&dev->sem);
++	mutex_unlock(&dev->mutex);
+ }
+ 
+ /**
+@@ -619,7 +619,7 @@
+ {
+ 	int error = 0;
+ 
+-	down(&dev->sem);
++	mutex_lock(&dev->mutex);
+ 
+ 	if (dev->class) {
+ 		if (dev->class->pm) {
+@@ -654,7 +654,7 @@
+ 		}
+ 	}
+  End:
+-	up(&dev->sem);
++	mutex_unlock(&dev->mutex);
+ 
+ 	return error;
+ }
+@@ -705,7 +705,7 @@
+ {
+ 	int error = 0;
+ 
+-	down(&dev->sem);
++	mutex_lock(&dev->mutex);
+ 
+ 	if (dev->bus && dev->bus->pm && dev->bus->pm->prepare) {
+ 		pm_dev_dbg(dev, state, "preparing ");
+@@ -729,7 +729,7 @@
+ 		suspend_report_result(dev->class->pm->prepare, error);
+ 	}
+  End:
+-	up(&dev->sem);
++	mutex_unlock(&dev->mutex);
+ 
+ 	return error;
+ }
+Index: linux-rt-2.6.31/drivers/block/hd.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/block/hd.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/block/hd.c	2010-05-17 14:23:19.968533252 +0200
+@@ -165,12 +165,12 @@
+ 	unsigned long t, flags;
+ 	int i;
+ 
+-	spin_lock_irqsave(&i8253_lock, flags);
++	atomic_spin_lock_irqsave(&i8253_lock, flags);
+ 	t = jiffies * 11932;
+ 	outb_p(0, 0x43);
+ 	i = inb_p(0x40);
+ 	i |= inb(0x40) << 8;
+-	spin_unlock_irqrestore(&i8253_lock, flags);
++	atomic_spin_unlock_irqrestore(&i8253_lock, flags);
+ 	return(t - i);
+ }
+ #endif
+Index: linux-rt-2.6.31/drivers/block/paride/pseudo.h
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/block/paride/pseudo.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/block/paride/pseudo.h	2010-05-17 14:23:19.968533252 +0200
+@@ -43,7 +43,7 @@
+ static int ps_tq_active = 0;
+ static int ps_nice = 0;
+ 
+-static DEFINE_SPINLOCK(ps_spinlock __attribute__((unused)));
++static __attribute__((unused)) DEFINE_SPINLOCK(ps_spinlock);
+ 
+ static DECLARE_DELAYED_WORK(ps_tq, ps_tq_int);
+ 
+Index: linux-rt-2.6.31/drivers/char/random.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/char/random.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/char/random.c	2010-05-17 14:23:19.968533252 +0200
+@@ -623,8 +623,11 @@
+ 	preempt_disable();
+ 	/* if over the trickle threshold, use only 1 in 4096 samples */
+ 	if (input_pool.entropy_count > trickle_thresh &&
+-	    (__get_cpu_var(trickle_count)++ & 0xfff))
+-		goto out;
++	    (__get_cpu_var(trickle_count)++ & 0xfff)) {
++		preempt_enable();
++		return;
++	}
++	preempt_enable();
+ 
+ 	sample.jiffies = jiffies;
+ 	sample.cycles = get_cycles();
+@@ -666,8 +669,6 @@
+ 		credit_entropy_bits(&input_pool,
+ 				    min_t(int, fls(delta>>1), 11));
+ 	}
+-out:
+-	preempt_enable();
+ }
+ 
+ void add_input_randomness(unsigned int type, unsigned int code,
+Index: linux-rt-2.6.31/drivers/char/rtc.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/char/rtc.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/char/rtc.c	2010-05-17 14:23:19.968533252 +0200
+@@ -1197,10 +1197,12 @@
+ 
+ 	spin_unlock_irq(&rtc_lock);
+ 
++#ifndef CONFIG_PREEMPT_RT
+ 	if (printk_ratelimit()) {
+ 		printk(KERN_WARNING "rtc: lost some interrupts at %ldHz.\n",
+ 			freq);
+ 	}
++#endif
+ 
+ 	/* Now we have new data */
+ 	wake_up_interruptible(&rtc_wait);
+Index: linux-rt-2.6.31/drivers/char/tty_audit.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/char/tty_audit.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/char/tty_audit.c	2010-05-17 14:23:19.968533252 +0200
+@@ -188,25 +188,43 @@
+ }
+ 
+ /**
+- *	tty_audit_push_task	-	Flush task's pending audit data
++ * tty_audit_push_task	-	Flush task's pending audit data
++ * @tsk:		task pointer
++ * @loginuid:		sender login uid
++ * @sessionid:		sender session id
++ *
++ * Called with a ref on @tsk held. Try to lock sighand and get a
++ * reference to the tty audit buffer if available.
++ * Flush the buffer or return an appropriate error code.
+  */
+-void tty_audit_push_task(struct task_struct *tsk, uid_t loginuid, u32 sessionid)
++int tty_audit_push_task(struct task_struct *tsk, uid_t loginuid, u32 sessionid)
+ {
+-	struct tty_audit_buf *buf;
++	struct tty_audit_buf *buf = ERR_PTR(-EPERM);
++	unsigned long flags;
+ 
+-	spin_lock_irq(&tsk->sighand->siglock);
+-	buf = tsk->signal->tty_audit_buf;
+-	if (buf)
+-		atomic_inc(&buf->count);
+-	spin_unlock_irq(&tsk->sighand->siglock);
+-	if (!buf)
+-		return;
++	if (!lock_task_sighand(tsk, &flags))
++		return -ESRCH;
++
++	if (tsk->signal->audit_tty) {
++		buf = tsk->signal->tty_audit_buf;
++		if (buf)
++			atomic_inc(&buf->count);
++	}
++	unlock_task_sighand(tsk, &flags);
++
++	/*
++	 * We return 0 when the task is found, signal->audit_tty set,
++	 * but tsk->signal->tty_audit_buf == NULL.
++	 */
++	if (!buf || IS_ERR(buf))
++		return PTR_ERR(buf);
+ 
+ 	mutex_lock(&buf->mutex);
+ 	tty_audit_buf_push(tsk, loginuid, sessionid, buf);
+ 	mutex_unlock(&buf->mutex);
+ 
+ 	tty_audit_buf_put(buf);
++	return 0;
+ }
+ 
+ /**
+Index: linux-rt-2.6.31/drivers/char/tty_buffer.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/char/tty_buffer.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/drivers/char/tty_buffer.c	2010-05-17 14:23:19.968533252 +0200
+@@ -492,10 +492,14 @@
+ 		tty->buf.tail->commit = tty->buf.tail->used;
+ 	spin_unlock_irqrestore(&tty->buf.lock, flags);
+ 
++#ifndef CONFIG_PREEMPT_RT
+ 	if (tty->low_latency)
+ 		flush_to_ldisc(&tty->buf.work.work);
+ 	else
+ 		schedule_delayed_work(&tty->buf.work, 1);
++#else
++	flush_to_ldisc(&tty->buf.work.work);
++#endif
+ }
+ EXPORT_SYMBOL(tty_flip_buffer_push);
+ 
+Index: linux-rt-2.6.31/drivers/char/tty_ldisc.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/char/tty_ldisc.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/drivers/char/tty_ldisc.c	2010-05-17 14:23:19.968533252 +0200
+@@ -69,7 +69,7 @@
+ 	 * We really want an "atomic_dec_and_lock_irqsave()",
+ 	 * but we don't have it, so this does it by hand.
+ 	 */
+-	local_irq_save(flags);
++	local_irq_save_nort(flags);
+ 	if (atomic_dec_and_lock(&ld->users, &tty_ldisc_lock)) {
+ 		struct tty_ldisc_ops *ldo = ld->ops;
+ 
+@@ -80,7 +80,7 @@
+ 		kfree(ld);
+ 		return;
+ 	}
+-	local_irq_restore(flags);
++	local_irq_restore_nort(flags);
+ }
+ 
+ /**
+Index: linux-rt-2.6.31/drivers/char/vt.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/char/vt.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/char/vt.c	2010-05-17 14:23:19.968533252 +0200
+@@ -2537,7 +2537,7 @@
+ 	.write		= vt_console_print,
+ 	.device		= vt_console_device,
+ 	.unblank	= unblank_screen,
+-	.flags		= CON_PRINTBUFFER,
++	.flags		= CON_PRINTBUFFER | CON_ATOMIC,
+ 	.index		= -1,
+ };
+ #endif
+Index: linux-rt-2.6.31/drivers/firewire/core-device.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/firewire/core-device.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/firewire/core-device.c	2010-05-17 14:23:19.968533252 +0200
+@@ -762,9 +762,9 @@
+ 	struct fw_driver *driver = (struct fw_driver *)dev->driver;
+ 
+ 	if (is_fw_unit(dev) && driver != NULL && driver->update != NULL) {
+-		down(&dev->sem);
++		mutex_lock(&dev->mutex);
+ 		driver->update(unit);
+-		up(&dev->sem);
++		mutex_unlock(&dev->mutex);
+ 	}
+ 
+ 	return 0;
+Index: linux-rt-2.6.31/drivers/gpu/drm/r128/r128_cce.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/gpu/drm/r128/r128_cce.c	2010-05-17 14:22:32.000000000 +0200
++++ linux-rt-2.6.31/drivers/gpu/drm/r128/r128_cce.c	2010-05-17 14:23:19.968533252 +0200
+@@ -353,6 +353,11 @@
+ 
+ 	DRM_DEBUG("\n");
+ 
++	if (dev->dev_private) {
++		DRM_DEBUG("called when already initialized\n");
++		return -EINVAL;
++	}
++
+ 	dev_priv = kzalloc(sizeof(drm_r128_private_t), GFP_KERNEL);
+ 	if (dev_priv == NULL)
+ 		return -ENOMEM;
+@@ -649,6 +654,8 @@
+ 
+ 	LOCK_TEST_WITH_RETURN(dev, file_priv);
+ 
++	DEV_INIT_TEST_WITH_RETURN(dev_priv);
++
+ 	if (dev_priv->cce_running || dev_priv->cce_mode == R128_PM4_NONPM4) {
+ 		DRM_DEBUG("while CCE running\n");
+ 		return 0;
+@@ -671,6 +678,8 @@
+ 
+ 	LOCK_TEST_WITH_RETURN(dev, file_priv);
+ 
++	DEV_INIT_TEST_WITH_RETURN(dev_priv);
++
+ 	/* Flush any pending CCE commands.  This ensures any outstanding
+ 	 * commands are exectuted by the engine before we turn it off.
+ 	 */
+@@ -708,10 +717,7 @@
+ 
+ 	LOCK_TEST_WITH_RETURN(dev, file_priv);
+ 
+-	if (!dev_priv) {
+-		DRM_DEBUG("called before init done\n");
+-		return -EINVAL;
+-	}
++	DEV_INIT_TEST_WITH_RETURN(dev_priv);
+ 
+ 	r128_do_cce_reset(dev_priv);
+ 
+@@ -728,6 +734,8 @@
+ 
+ 	LOCK_TEST_WITH_RETURN(dev, file_priv);
+ 
++	DEV_INIT_TEST_WITH_RETURN(dev_priv);
++
+ 	if (dev_priv->cce_running) {
+ 		r128_do_cce_flush(dev_priv);
+ 	}
+@@ -741,6 +749,8 @@
+ 
+ 	LOCK_TEST_WITH_RETURN(dev, file_priv);
+ 
++	DEV_INIT_TEST_WITH_RETURN(dev->dev_private);
++
+ 	return r128_do_engine_reset(dev);
+ }
+ 
+Index: linux-rt-2.6.31/drivers/gpu/drm/r128/r128_drv.h
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/gpu/drm/r128/r128_drv.h	2010-05-17 14:22:32.000000000 +0200
++++ linux-rt-2.6.31/drivers/gpu/drm/r128/r128_drv.h	2010-05-17 14:23:19.968533252 +0200
+@@ -422,6 +422,14 @@
+  * Misc helper macros
+  */
+ 
++#define DEV_INIT_TEST_WITH_RETURN(_dev_priv)				\
++do {									\
++	if (!_dev_priv) {						\
++		DRM_ERROR("called with no initialization\n");		\
++		return -EINVAL;						\
++	}								\
++} while (0)
++
+ #define RING_SPACE_TEST_WITH_RETURN( dev_priv )				\
+ do {									\
+ 	drm_r128_ring_buffer_t *ring = &dev_priv->ring; int i;		\
+Index: linux-rt-2.6.31/drivers/gpu/drm/r128/r128_state.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/gpu/drm/r128/r128_state.c	2010-05-17 14:22:32.000000000 +0200
++++ linux-rt-2.6.31/drivers/gpu/drm/r128/r128_state.c	2010-05-17 14:23:19.968533252 +0200
+@@ -1244,14 +1244,18 @@
+ static int r128_cce_clear(struct drm_device *dev, void *data, struct drm_file *file_priv)
+ {
+ 	drm_r128_private_t *dev_priv = dev->dev_private;
+-	drm_r128_sarea_t *sarea_priv = dev_priv->sarea_priv;
++	drm_r128_sarea_t *sarea_priv;
+ 	drm_r128_clear_t *clear = data;
+ 	DRM_DEBUG("\n");
+ 
+ 	LOCK_TEST_WITH_RETURN(dev, file_priv);
+ 
++	DEV_INIT_TEST_WITH_RETURN(dev_priv);
++
+ 	RING_SPACE_TEST_WITH_RETURN(dev_priv);
+ 
++	sarea_priv = dev_priv->sarea_priv;
++
+ 	if (sarea_priv->nbox > R128_NR_SAREA_CLIPRECTS)
+ 		sarea_priv->nbox = R128_NR_SAREA_CLIPRECTS;
+ 
+@@ -1312,6 +1316,8 @@
+ 
+ 	LOCK_TEST_WITH_RETURN(dev, file_priv);
+ 
++	DEV_INIT_TEST_WITH_RETURN(dev_priv);
++
+ 	RING_SPACE_TEST_WITH_RETURN(dev_priv);
+ 
+ 	if (!dev_priv->page_flipping)
+@@ -1331,6 +1337,8 @@
+ 
+ 	LOCK_TEST_WITH_RETURN(dev, file_priv);
+ 
++	DEV_INIT_TEST_WITH_RETURN(dev_priv);
++
+ 	RING_SPACE_TEST_WITH_RETURN(dev_priv);
+ 
+ 	if (sarea_priv->nbox > R128_NR_SAREA_CLIPRECTS)
+@@ -1354,10 +1362,7 @@
+ 
+ 	LOCK_TEST_WITH_RETURN(dev, file_priv);
+ 
+-	if (!dev_priv) {
+-		DRM_ERROR("called with no initialization\n");
+-		return -EINVAL;
+-	}
++	DEV_INIT_TEST_WITH_RETURN(dev_priv);
+ 
+ 	DRM_DEBUG("pid=%d index=%d count=%d discard=%d\n",
+ 		  DRM_CURRENTPID, vertex->idx, vertex->count, vertex->discard);
+@@ -1410,10 +1415,7 @@
+ 
+ 	LOCK_TEST_WITH_RETURN(dev, file_priv);
+ 
+-	if (!dev_priv) {
+-		DRM_ERROR("called with no initialization\n");
+-		return -EINVAL;
+-	}
++	DEV_INIT_TEST_WITH_RETURN(dev_priv);
+ 
+ 	DRM_DEBUG("pid=%d buf=%d s=%d e=%d d=%d\n", DRM_CURRENTPID,
+ 		  elts->idx, elts->start, elts->end, elts->discard);
+@@ -1476,6 +1478,8 @@
+ 
+ 	LOCK_TEST_WITH_RETURN(dev, file_priv);
+ 
++	DEV_INIT_TEST_WITH_RETURN(dev_priv);
++
+ 	DRM_DEBUG("pid=%d index=%d\n", DRM_CURRENTPID, blit->idx);
+ 
+ 	if (blit->idx < 0 || blit->idx >= dma->buf_count) {
+@@ -1501,6 +1505,8 @@
+ 
+ 	LOCK_TEST_WITH_RETURN(dev, file_priv);
+ 
++	DEV_INIT_TEST_WITH_RETURN(dev_priv);
++
+ 	RING_SPACE_TEST_WITH_RETURN(dev_priv);
+ 
+ 	ret = -EINVAL;
+@@ -1531,6 +1537,8 @@
+ 
+ 	LOCK_TEST_WITH_RETURN(dev, file_priv);
+ 
++	DEV_INIT_TEST_WITH_RETURN(dev_priv);
++
+ 	if (DRM_COPY_FROM_USER(&mask, stipple->mask, 32 * sizeof(u32)))
+ 		return -EFAULT;
+ 
+@@ -1555,10 +1563,7 @@
+ 
+ 	LOCK_TEST_WITH_RETURN(dev, file_priv);
+ 
+-	if (!dev_priv) {
+-		DRM_ERROR("called with no initialization\n");
+-		return -EINVAL;
+-	}
++	DEV_INIT_TEST_WITH_RETURN(dev_priv);
+ 
+ 	DRM_DEBUG("idx=%d s=%d e=%d d=%d\n",
+ 		  indirect->idx, indirect->start, indirect->end,
+@@ -1620,10 +1625,7 @@
+ 	drm_r128_getparam_t *param = data;
+ 	int value;
+ 
+-	if (!dev_priv) {
+-		DRM_ERROR("called with no initialization\n");
+-		return -EINVAL;
+-	}
++	DEV_INIT_TEST_WITH_RETURN(dev_priv);
+ 
+ 	DRM_DEBUG("pid=%d\n", DRM_CURRENTPID);
+ 
+Index: linux-rt-2.6.31/drivers/ide/alim15x3.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/ide/alim15x3.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/ide/alim15x3.c	2010-05-17 14:23:19.968533252 +0200
+@@ -90,7 +90,7 @@
+ 		if (r_clc >= 16)
+ 			r_clc = 0;
+ 	}
+-	local_irq_save(flags);
++	local_irq_save_nort(flags);
+ 	
+ 	/* 
+ 	 * PIO mode => ATA FIFO on, ATAPI FIFO off
+@@ -112,7 +112,7 @@
+ 	
+ 	pci_write_config_byte(dev, port, s_clc);
+ 	pci_write_config_byte(dev, port + unit + 2, (a_clc << 4) | r_clc);
+-	local_irq_restore(flags);
++	local_irq_restore_nort(flags);
+ }
+ 
+ /**
+@@ -223,7 +223,7 @@
+ 
+ 	isa_dev = pci_get_device(PCI_VENDOR_ID_AL, PCI_DEVICE_ID_AL_M1533, NULL);
+ 
+-	local_irq_save(flags);
++	local_irq_save_nort(flags);
+ 
+ 	if (m5229_revision < 0xC2) {
+ 		/*
+@@ -314,7 +314,7 @@
+ 	}
+ 	pci_dev_put(north);
+ 	pci_dev_put(isa_dev);
+-	local_irq_restore(flags);
++	local_irq_restore_nort(flags);
+ 	return 0;
+ }
+ 
+@@ -376,7 +376,7 @@
+ 	unsigned long flags;
+ 	u8 cbl = ATA_CBL_PATA40, tmpbyte;
+ 
+-	local_irq_save(flags);
++	local_irq_save_nort(flags);
+ 
+ 	if (m5229_revision >= 0xC2) {
+ 		/*
+@@ -397,7 +397,7 @@
+ 		}
+ 	}
+ 
+-	local_irq_restore(flags);
++	local_irq_restore_nort(flags);
+ 
+ 	return cbl;
+ }
+Index: linux-rt-2.6.31/drivers/ide/hpt366.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/ide/hpt366.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/ide/hpt366.c	2010-05-17 14:23:19.968533252 +0200
+@@ -1302,7 +1302,7 @@
+ 
+ 	dma_old = inb(base + 2);
+ 
+-	local_irq_save(flags);
++	local_irq_save_nort(flags);
+ 
+ 	dma_new = dma_old;
+ 	pci_read_config_byte(dev, hwif->channel ? 0x4b : 0x43, &masterdma);
+@@ -1313,7 +1313,7 @@
+ 	if (dma_new != dma_old)
+ 		outb(dma_new, base + 2);
+ 
+-	local_irq_restore(flags);
++	local_irq_restore_nort(flags);
+ 
+ 	printk(KERN_INFO "    %s: BM-DMA at 0x%04lx-0x%04lx\n",
+ 			 hwif->name, base, base + 7);
+Index: linux-rt-2.6.31/drivers/ide/ide-io-std.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/ide/ide-io-std.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/ide/ide-io-std.c	2010-05-17 14:23:19.968533252 +0200
+@@ -174,7 +174,7 @@
+ 		unsigned long uninitialized_var(flags);
+ 
+ 		if ((io_32bit & 2) && !mmio) {
+-			local_irq_save(flags);
++			local_irq_save_nort(flags);
+ 			ata_vlb_sync(io_ports->nsect_addr);
+ 		}
+ 
+@@ -185,7 +185,7 @@
+ 			insl(data_addr, buf, words);
+ 
+ 		if ((io_32bit & 2) && !mmio)
+-			local_irq_restore(flags);
++			local_irq_restore_nort(flags);
+ 
+ 		if (((len + 1) & 3) < 2)
+ 			return;
+@@ -218,7 +218,7 @@
+ 		unsigned long uninitialized_var(flags);
+ 
+ 		if ((io_32bit & 2) && !mmio) {
+-			local_irq_save(flags);
++			local_irq_save_nort(flags);
+ 			ata_vlb_sync(io_ports->nsect_addr);
+ 		}
+ 
+@@ -229,7 +229,7 @@
+ 			outsl(data_addr, buf, words);
+ 
+ 		if ((io_32bit & 2) && !mmio)
+-			local_irq_restore(flags);
++			local_irq_restore_nort(flags);
+ 
+ 		if (((len + 1) & 3) < 2)
+ 			return;
+Index: linux-rt-2.6.31/drivers/ide/ide-io.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/ide/ide-io.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/ide/ide-io.c	2010-05-17 14:23:19.978385761 +0200
+@@ -667,7 +667,7 @@
+ 		/* disable_irq_nosync ?? */
+ 		disable_irq(hwif->irq);
+ 		/* local CPU only, as if we were handling an interrupt */
+-		local_irq_disable();
++		local_irq_disable_nort();
+ 		if (hwif->polling) {
+ 			startstop = handler(drive);
+ 		} else if (drive_is_ready(drive)) {
+Index: linux-rt-2.6.31/drivers/ide/ide-iops.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/ide/ide-iops.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/ide/ide-iops.c	2010-05-17 14:23:19.978385761 +0200
+@@ -129,12 +129,12 @@
+ 				if ((stat & ATA_BUSY) == 0)
+ 					break;
+ 
+-				local_irq_restore(flags);
++				local_irq_restore_nort(flags);
+ 				*rstat = stat;
+ 				return -EBUSY;
+ 			}
+ 		}
+-		local_irq_restore(flags);
++		local_irq_restore_nort(flags);
+ 	}
+ 	/*
+ 	 * Allow status to settle, then read it again.
+Index: linux-rt-2.6.31/drivers/ide/ide-probe.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/ide/ide-probe.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/drivers/ide/ide-probe.c	2010-05-17 14:23:19.978385761 +0200
+@@ -196,10 +196,10 @@
+ 	int bswap = 1;
+ 
+ 	/* local CPU only; some systems need this */
+-	local_irq_save(flags);
++	local_irq_save_nort(flags);
+ 	/* read 512 bytes of id info */
+ 	hwif->tp_ops->input_data(drive, NULL, id, SECTOR_SIZE);
+-	local_irq_restore(flags);
++	local_irq_restore_nort(flags);
+ 
+ 	drive->dev_flags |= IDE_DFLAG_ID_READ;
+ #ifdef DEBUG
+Index: linux-rt-2.6.31/drivers/ide/ide-taskfile.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/ide/ide-taskfile.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/ide/ide-taskfile.c	2010-05-17 14:23:19.978385761 +0200
+@@ -248,7 +248,7 @@
+ 		offset %= PAGE_SIZE;
+ 
+ 		if (PageHighMem(page))
+-			local_irq_save(flags);
++			local_irq_save_nort(flags);
+ 
+ 		buf = kmap_atomic(page, KM_BIO_SRC_IRQ) + offset;
+ 
+@@ -269,7 +269,7 @@
+ 		kunmap_atomic(buf, KM_BIO_SRC_IRQ);
+ 
+ 		if (PageHighMem(page))
+-			local_irq_restore(flags);
++			local_irq_restore_nort(flags);
+ 
+ 		len -= nr_bytes;
+ 	}
+@@ -406,7 +406,7 @@
+ 	}
+ 
+ 	if ((drive->dev_flags & IDE_DFLAG_UNMASK) == 0)
+-		local_irq_disable();
++		local_irq_disable_nort();
+ 
+ 	ide_set_handler(drive, &task_pio_intr, WAIT_WORSTCASE);
+ 
+Index: linux-rt-2.6.31/drivers/ieee1394/nodemgr.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/ieee1394/nodemgr.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/ieee1394/nodemgr.c	2010-05-17 14:23:19.978385761 +0200
+@@ -1397,9 +1397,9 @@
+ 			pdrv = container_of(drv, struct hpsb_protocol_driver,
+ 					    driver);
+ 			if (pdrv->update) {
+-				down(&ud->device.sem);
++				mutex_lock(&ud->device.mutex);
+ 				error = pdrv->update(ud);
+-				up(&ud->device.sem);
++				mutex_unlock(&ud->device.mutex);
+ 			}
+ 			if (error)
+ 				device_release_driver(&ud->device);
+Index: linux-rt-2.6.31/drivers/infiniband/core/user_mad.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/infiniband/core/user_mad.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/infiniband/core/user_mad.c	2010-05-17 14:23:19.978385761 +0200
+@@ -1003,7 +1003,7 @@
+ 
+ 	port->ib_dev   = device;
+ 	port->port_num = port_num;
+-	init_MUTEX(&port->sm_sem);
++	semaphore_init(&port->sm_sem);
+ 	mutex_init(&port->file_mutex);
+ 	INIT_LIST_HEAD(&port->file_list);
+ 
+Index: linux-rt-2.6.31/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/infiniband/ulp/ipoib/ipoib_multicast.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/infiniband/ulp/ipoib/ipoib_multicast.c	2010-05-17 14:23:19.978385761 +0200
+@@ -773,7 +773,7 @@
+ 
+ 	ipoib_mcast_stop_thread(dev, 0);
+ 
+-	local_irq_save(flags);
++	local_irq_save_nort(flags);
+ 	netif_addr_lock(dev);
+ 	spin_lock(&priv->lock);
+ 
+@@ -852,7 +852,7 @@
+ 
+ 	spin_unlock(&priv->lock);
+ 	netif_addr_unlock(dev);
+-	local_irq_restore(flags);
++	local_irq_restore_nort(flags);
+ 
+ 	/* We have to cancel outside of the spinlock */
+ 	list_for_each_entry_safe(mcast, tmcast, &remove_list, list) {
+Index: linux-rt-2.6.31/drivers/input/gameport/gameport.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/input/gameport/gameport.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/input/gameport/gameport.c	2010-05-17 14:23:19.978385761 +0200
+@@ -20,6 +20,7 @@
+ #include <linux/slab.h>
+ #include <linux/delay.h>
+ #include <linux/kthread.h>
++#include <linux/interrupt.h>
+ #include <linux/sched.h>	/* HZ */
+ #include <linux/mutex.h>
+ #include <linux/freezer.h>
+@@ -57,11 +58,11 @@
+ 	unsigned long flags;
+ 	unsigned int count;
+ 
+-	spin_lock_irqsave(&i8253_lock, flags);
++	atomic_spin_lock_irqsave(&i8253_lock, flags);
+ 	outb_p(0x00, 0x43);
+ 	count = inb_p(0x40);
+ 	count |= inb_p(0x40) << 8;
+-	spin_unlock_irqrestore(&i8253_lock, flags);
++	atomic_spin_unlock_irqrestore(&i8253_lock, flags);
+ 
+ 	return count;
+ }
+@@ -87,12 +88,12 @@
+ 	tx = 1 << 30;
+ 
+ 	for(i = 0; i < 50; i++) {
+-		local_irq_save(flags);
++		local_irq_save_nort(flags);
+ 		GET_TIME(t1);
+ 		for (t = 0; t < 50; t++) gameport_read(gameport);
+ 		GET_TIME(t2);
+ 		GET_TIME(t3);
+-		local_irq_restore(flags);
++		local_irq_restore_nort(flags);
+ 		udelay(i * 10);
+ 		if ((t = DELTA(t2,t1) - DELTA(t3,t2)) < tx) tx = t;
+ 	}
+@@ -111,11 +112,11 @@
+ 	tx = 1 << 30;
+ 
+ 	for(i = 0; i < 50; i++) {
+-		local_irq_save(flags);
++		local_irq_save_nort(flags);
+ 		rdtscl(t1);
+ 		for (t = 0; t < 50; t++) gameport_read(gameport);
+ 		rdtscl(t2);
+-		local_irq_restore(flags);
++		local_irq_restore_nort(flags);
+ 		udelay(i * 10);
+ 		if (t2 - t1 < tx) tx = t2 - t1;
+ 	}
+Index: linux-rt-2.6.31/drivers/input/joystick/analog.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/input/joystick/analog.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/input/joystick/analog.c	2010-05-17 14:23:19.978385761 +0200
+@@ -146,11 +146,11 @@
+         unsigned long flags;
+         unsigned int count;
+ 
+-        spin_lock_irqsave(&i8253_lock, flags);
++        atomic_spin_lock_irqsave(&i8253_lock, flags);
+         outb_p(0x00, 0x43);
+         count = inb_p(0x40);
+         count |= inb_p(0x40) << 8;
+-        spin_unlock_irqrestore(&i8253_lock, flags);
++        atomic_spin_unlock_irqrestore(&i8253_lock, flags);
+ 
+         return count;
+ }
+Index: linux-rt-2.6.31/drivers/input/keyboard/hil_kbd.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/input/keyboard/hil_kbd.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/input/keyboard/hil_kbd.c	2010-05-17 14:23:19.978385761 +0200
+@@ -277,7 +277,7 @@
+ 	serio_set_drvdata(serio, kbd);
+ 	kbd->serio = serio;
+ 
+-	init_MUTEX_LOCKED(&kbd->sem);
++	semaphore_init_locked(&kbd->sem);
+ 
+ 	/* Get device info.  MLC driver supplies devid/status/etc. */
+ 	serio->write(serio, 0);
+Index: linux-rt-2.6.31/drivers/input/misc/hp_sdc_rtc.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/input/misc/hp_sdc_rtc.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/input/misc/hp_sdc_rtc.c	2010-05-17 14:23:19.978385761 +0200
+@@ -104,7 +104,7 @@
+ 	t.endidx =		91;
+ 	t.seq =			tseq;
+ 	t.act.semaphore =	&tsem;
+-	init_MUTEX_LOCKED(&tsem);
++	semaphore_init_locked(&tsem);
+ 	
+ 	if (hp_sdc_enqueue_transaction(&t)) return -1;
+ 	
+@@ -686,7 +686,7 @@
+ 		return -ENODEV;
+ #endif
+ 
+-	init_MUTEX(&i8042tregs);
++	semaphore_init(&i8042tregs);
+ 
+ 	if ((ret = hp_sdc_request_timer_irq(&hp_sdc_rtc_isr)))
+ 		return ret;
+Index: linux-rt-2.6.31/drivers/input/misc/pcspkr.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/input/misc/pcspkr.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/input/misc/pcspkr.c	2010-05-17 14:23:19.978385761 +0200
+@@ -30,7 +30,7 @@
+ #include <asm/i8253.h>
+ #else
+ #include <asm/8253pit.h>
+-static DEFINE_SPINLOCK(i8253_lock);
++static DEFINE_ATOMIC_SPINLOCK(i8253_lock);
+ #endif
+ 
+ static int pcspkr_event(struct input_dev *dev, unsigned int type, unsigned int code, int value)
+@@ -50,7 +50,7 @@
+ 	if (value > 20 && value < 32767)
+ 		count = PIT_TICK_RATE / value;
+ 
+-	spin_lock_irqsave(&i8253_lock, flags);
++	atomic_spin_lock_irqsave(&i8253_lock, flags);
+ 
+ 	if (count) {
+ 		/* set command for counter 2, 2 byte write */
+@@ -65,7 +65,7 @@
+ 		outb(inb_p(0x61) & 0xFC, 0x61);
+ 	}
+ 
+-	spin_unlock_irqrestore(&i8253_lock, flags);
++	atomic_spin_unlock_irqrestore(&i8253_lock, flags);
+ 
+ 	return 0;
+ }
+Index: linux-rt-2.6.31/drivers/input/mouse/hil_ptr.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/input/mouse/hil_ptr.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/input/mouse/hil_ptr.c	2010-05-17 14:23:19.978385761 +0200
+@@ -270,7 +270,7 @@
+ 	serio_set_drvdata(serio, ptr);
+ 	ptr->serio = serio;
+ 
+-	init_MUTEX_LOCKED(&ptr->sem);
++	semaphore_init_locked(&ptr->sem);
+ 
+ 	/* Get device info.  MLC driver supplies devid/status/etc. */
+ 	serio->write(serio, 0);
+Index: linux-rt-2.6.31/drivers/input/serio/hil_mlc.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/input/serio/hil_mlc.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/input/serio/hil_mlc.c	2010-05-17 14:23:19.978385761 +0200
+@@ -914,15 +914,15 @@
+ 	mlc->ostarted = 0;
+ 
+ 	rwlock_init(&mlc->lock);
+-	init_MUTEX(&mlc->osem);
++	semaphore_init(&mlc->osem);
+ 
+-	init_MUTEX(&mlc->isem);
++	semaphore_init(&mlc->isem);
+ 	mlc->icount = -1;
+ 	mlc->imatch = 0;
+ 
+ 	mlc->opercnt = 0;
+ 
+-	init_MUTEX_LOCKED(&(mlc->csem));
++	semaphore_init(&(mlc->csem));
+ 
+ 	hil_mlc_clear_di_scratch(mlc);
+ 	hil_mlc_clear_di_map(mlc, 0);
+Index: linux-rt-2.6.31/drivers/input/serio/hp_sdc.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/input/serio/hp_sdc.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/input/serio/hp_sdc.c	2010-05-17 14:23:19.978385761 +0200
+@@ -1039,7 +1039,7 @@
+ 		return hp_sdc.dev_err;
+ 	}
+ 
+-	init_MUTEX_LOCKED(&tq_init_sem);
++	semaphore_init(&tq_init_sem);
+ 
+ 	tq_init.actidx		= 0;
+ 	tq_init.idx		= 1;
+Index: linux-rt-2.6.31/drivers/macintosh/adb.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/macintosh/adb.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/macintosh/adb.c	2010-05-17 14:23:19.978385761 +0200
+@@ -83,7 +83,7 @@
+ BLOCKING_NOTIFIER_HEAD(adb_client_list);
+ static int adb_got_sleep;
+ static int adb_inited;
+-static DECLARE_MUTEX(adb_probe_mutex);
++static DEFINE_SEMAPHORE(adb_probe_mutex);
+ static int sleepy_trackpad;
+ static int autopoll_devs;
+ int __adb_probe_sync;
+Index: linux-rt-2.6.31/drivers/media/dvb/dvb-core/dvb_frontend.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/media/dvb/dvb-core/dvb_frontend.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/media/dvb/dvb-core/dvb_frontend.c	2010-05-17 14:23:19.978385761 +0200
+@@ -101,7 +101,7 @@
+ 	struct dvb_device *dvbdev;
+ 	struct dvb_frontend_parameters parameters;
+ 	struct dvb_fe_events events;
+-	struct semaphore sem;
++	struct anon_semaphore sem;
+ 	struct list_head list_head;
+ 	wait_queue_head_t wait_queue;
+ 	struct task_struct *thread;
+@@ -189,12 +189,12 @@
+ 		if (flags & O_NONBLOCK)
+ 			return -EWOULDBLOCK;
+ 
+-		up(&fepriv->sem);
++		anon_up(&fepriv->sem);
+ 
+ 		ret = wait_event_interruptible (events->wait_queue,
+ 						events->eventw != events->eventr);
+ 
+-		if (down_interruptible (&fepriv->sem))
++		if (anon_down_interruptible (&fepriv->sem))
+ 			return -ERESTARTSYS;
+ 
+ 		if (ret < 0)
+@@ -534,7 +534,7 @@
+ 
+ 	set_freezable();
+ 	while (1) {
+-		up(&fepriv->sem);	    /* is locked when we enter the thread... */
++		anon_up(&fepriv->sem);	    /* is locked when we enter the thread... */
+ restart:
+ 		timeout = wait_event_interruptible_timeout(fepriv->wait_queue,
+ 			dvb_frontend_should_wakeup(fe) || kthread_should_stop()
+@@ -550,7 +550,7 @@
+ 		if (try_to_freeze())
+ 			goto restart;
+ 
+-		if (down_interruptible(&fepriv->sem))
++		if (anon_down_interruptible(&fepriv->sem))
+ 			break;
+ 
+ 		if (fepriv->reinitialise) {
+@@ -678,7 +678,7 @@
+ 
+ 	kthread_stop(fepriv->thread);
+ 
+-	init_MUTEX (&fepriv->sem);
++	anon_semaphore_init(&fepriv->sem);
+ 	fepriv->state = FESTATE_IDLE;
+ 
+ 	/* paranoia check in case a signal arrived */
+@@ -747,7 +747,7 @@
+ 
+ 	if (signal_pending(current))
+ 		return -EINTR;
+-	if (down_interruptible (&fepriv->sem))
++	if (anon_down_interruptible (&fepriv->sem))
+ 		return -EINTR;
+ 
+ 	fepriv->state = FESTATE_IDLE;
+@@ -760,7 +760,7 @@
+ 	if (IS_ERR(fe_thread)) {
+ 		ret = PTR_ERR(fe_thread);
+ 		printk("dvb_frontend_start: failed to start kthread (%d)\n", ret);
+-		up(&fepriv->sem);
++		anon_up(&fepriv->sem);
+ 		return ret;
+ 	}
+ 	fepriv->thread = fe_thread;
+@@ -1372,7 +1372,7 @@
+ 	     cmd == FE_DISEQC_RECV_SLAVE_REPLY))
+ 		return -EPERM;
+ 
+-	if (down_interruptible (&fepriv->sem))
++	if (anon_down_interruptible (&fepriv->sem))
+ 		return -ERESTARTSYS;
+ 
+ 	if ((cmd == FE_SET_PROPERTY) || (cmd == FE_GET_PROPERTY))
+@@ -1382,7 +1382,7 @@
+ 		err = dvb_frontend_ioctl_legacy(inode, file, cmd, parg);
+ 	}
+ 
+-	up(&fepriv->sem);
++	anon_up(&fepriv->sem);
+ 	return err;
+ }
+ 
+@@ -1909,7 +1909,7 @@
+ 	}
+ 	fepriv = fe->frontend_priv;
+ 
+-	init_MUTEX (&fepriv->sem);
++	anon_semaphore_init(&fepriv->sem);
+ 	init_waitqueue_head (&fepriv->wait_queue);
+ 	init_waitqueue_head (&fepriv->events.wait_queue);
+ 	mutex_init(&fepriv->events.mtx);
+Index: linux-rt-2.6.31/drivers/mfd/twl4030-irq.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/mfd/twl4030-irq.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/mfd/twl4030-irq.c	2010-05-17 14:23:19.978385761 +0200
+@@ -458,12 +458,12 @@
+ 
+ 		bytes[byte] &= ~(0x03 << off);
+ 
+-		spin_lock_irq(&d->lock);
++		atomic_spin_lock_irq(&d->lock);
+ 		if (d->status & IRQ_TYPE_EDGE_RISING)
+ 			bytes[byte] |= BIT(off + 1);
+ 		if (d->status & IRQ_TYPE_EDGE_FALLING)
+ 			bytes[byte] |= BIT(off + 0);
+-		spin_unlock_irq(&d->lock);
++		atomic_spin_unlock_irq(&d->lock);
+ 
+ 		edge_change &= ~BIT(i);
+ 	}
+Index: linux-rt-2.6.31/drivers/mfd/ucb1x00-core.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/mfd/ucb1x00-core.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/mfd/ucb1x00-core.c	2010-05-17 14:23:19.978385761 +0200
+@@ -24,6 +24,7 @@
+ #include <linux/interrupt.h>
+ #include <linux/device.h>
+ #include <linux/mutex.h>
++#include <linux/semaphore.h>
+ 
+ #include <mach/dma.h>
+ #include <mach/hardware.h>
+Index: linux-rt-2.6.31/drivers/misc/Kconfig
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/misc/Kconfig	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/misc/Kconfig	2010-05-17 14:23:19.978385761 +0200
+@@ -76,6 +76,35 @@
+ 	  information on the specific driver level and support statement
+ 	  for your IBM server.
+ 
++config HWLAT_DETECTOR
++	tristate "Testing module to detect hardware-induced latencies"
++	depends on DEBUG_FS
++	depends on RING_BUFFER
++	default m
++	---help---
++	  A simple hardware latency detector. Use this module to detect
++	  large latencies introduced by the behavior of the underlying
++	  system firmware external to Linux. We do this using periodic
++	  use of stop_machine to grab all available CPUs and measure
++	  for unexplainable gaps in the CPU timestamp counter(s). By
++	  default, the module is not enabled until the "enable" file
++	  within the "hwlat_detector" debugfs directory is toggled.
++
++	  This module is often used to detect SMI (System Management
++	  Interrupts) on x86 systems, though is not x86 specific. To
++	  this end, we default to using a sample window of 1 second,
++	  during which we will sample for 0.5 seconds. If an SMI or
++	  similar event occurs during that time, it is recorded
++	  into an 8K samples global ring buffer until retreived.
++
++	  WARNING: This software should never be enabled (it can be built
++	  but should not be turned on after it is loaded) in a production
++	  environment where high latencies are a concern since the
++	  sampling mechanism actually introduces latencies for
++	  regular tasks while the CPU(s) are being held.
++
++	  If unsure, say N
++
+ config PHANTOM
+ 	tristate "Sensable PHANToM (PCI)"
+ 	depends on PCI
+Index: linux-rt-2.6.31/drivers/misc/Makefile
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/misc/Makefile	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/misc/Makefile	2010-05-17 14:23:19.978385761 +0200
+@@ -22,3 +22,4 @@
+ obj-$(CONFIG_C2PORT)		+= c2port/
+ obj-y				+= eeprom/
+ obj-y				+= cb710/
++obj-$(CONFIG_HWLAT_DETECTOR)	+= hwlat_detector.o
+Index: linux-rt-2.6.31/drivers/misc/hwlat_detector.c
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ linux-rt-2.6.31/drivers/misc/hwlat_detector.c	2010-05-17 14:23:19.978385761 +0200
+@@ -0,0 +1,1210 @@
++/*
++ * hwlat_detector.c - A simple Hardware Latency detector.
++ *
++ * Use this module to detect large system latencies induced by the behavior of
++ * certain underlying system hardware or firmware, independent of Linux itself.
++ * The code was developed originally to detect the presence of SMIs on Intel
++ * and AMD systems, although there is no dependency upon x86 herein.
++ *
++ * The classical example usage of this module is in detecting the presence of
++ * SMIs or System Management Interrupts on Intel and AMD systems. An SMI is a
++ * somewhat special form of hardware interrupt spawned from earlier CPU debug
++ * modes in which the (BIOS/EFI/etc.) firmware arranges for the South Bridge
++ * LPC (or other device) to generate a special interrupt under certain
++ * circumstances, for example, upon expiration of a special SMI timer device,
++ * due to certain external thermal readings, on certain I/O address accesses,
++ * and other situations. An SMI hits a special CPU pin, triggers a special
++ * SMI mode (complete with special memory map), and the OS is unaware.
++ *
++ * Although certain hardware-inducing latencies are necessary (for example,
++ * a modern system often requires an SMI handler for correct thermal control
++ * and remote management) they can wreak havoc upon any OS-level performance
++ * guarantees toward low-latency, especially when the OS is not even made
++ * aware of the presence of these interrupts. For this reason, we need a
++ * somewhat brute force mechanism to detect these interrupts. In this case,
++ * we do it by hogging all of the CPU(s) for configurable timer intervals,
++ * sampling the built-in CPU timer, looking for discontiguous readings.
++ *
++ * WARNING: This implementation necessarily introduces latencies. Therefore,
++ *          you should NEVER use this module in a production environment
++ *          requiring any kind of low-latency performance guarantee(s).
++ *
++ * Copyright (C) 2008-2009 Jon Masters, Red Hat, Inc. <jcm@redhat.com>
++ *
++ * Includes useful feedback from Clark Williams <clark@redhat.com>
++ *
++ * This file is licensed under the terms of the GNU General Public
++ * License version 2. This program is licensed "as is" without any
++ * warranty of any kind, whether express or implied.
++ */
++
++#include <linux/module.h>
++#include <linux/init.h>
++#include <linux/ring_buffer.h>
++#include <linux/stop_machine.h>
++#include <linux/time.h>
++#include <linux/hrtimer.h>
++#include <linux/kthread.h>
++#include <linux/debugfs.h>
++#include <linux/seq_file.h>
++#include <linux/uaccess.h>
++#include <linux/version.h>
++#include <linux/delay.h>
++
++#define BUF_SIZE_DEFAULT	262144UL		/* 8K*(sizeof(entry)) */
++#define BUF_FLAGS		(RB_FL_OVERWRITE)	/* no block on full */
++#define U64STR_SIZE		22			/* 20 digits max */
++
++#define VERSION			"1.0.0"
++#define BANNER			"hwlat_detector: "
++#define DRVNAME			"hwlat_detector"
++#define DEFAULT_SAMPLE_WINDOW	1000000			/* 1s */
++#define DEFAULT_SAMPLE_WIDTH	500000			/* 0.5s */
++#define DEFAULT_LAT_THRESHOLD	10			/* 10us */
++
++/* Module metadata */
++
++MODULE_LICENSE("GPL");
++MODULE_AUTHOR("Jon Masters <jcm@redhat.com>");
++MODULE_DESCRIPTION("A simple hardware latency detector");
++MODULE_VERSION(VERSION);
++
++/* Module parameters */
++
++static int debug;
++static int enabled;
++static int threshold;
++
++module_param(debug, int, 0);			/* enable debug */
++module_param(enabled, int, 0);			/* enable detector */
++module_param(threshold, int, 0);		/* latency threshold */
++
++/* Buffering and sampling */
++
++static struct ring_buffer *ring_buffer;		/* sample buffer */
++static DEFINE_MUTEX(ring_buffer_mutex);		/* lock changes */
++static unsigned long buf_size = BUF_SIZE_DEFAULT;
++static struct task_struct *kthread;		/* sampling thread */
++
++/* DebugFS filesystem entries */
++
++static struct dentry *debug_dir;		/* debugfs directory */
++static struct dentry *debug_max;		/* maximum TSC delta */
++static struct dentry *debug_count;		/* total detect count */
++static struct dentry *debug_sample_width;	/* sample width us */
++static struct dentry *debug_sample_window;	/* sample window us */
++static struct dentry *debug_sample;		/* raw samples us */
++static struct dentry *debug_threshold;		/* threshold us */
++static struct dentry *debug_enable;         	/* enable/disable */
++
++/* Individual samples and global state */
++
++struct sample;					/* latency sample */
++struct data;					/* Global state */
++
++/* Sampling functions */
++static int __buffer_add_sample(struct sample *sample);
++static struct sample *buffer_get_sample(struct sample *sample);
++static int get_sample(void *unused);
++
++/* Threading and state */
++static int kthread_fn(void *unused);
++static int start_kthread(void);
++static int stop_kthread(void);
++static void __reset_stats(void);
++static int init_stats(void);
++
++/* Debugfs interface */
++static ssize_t simple_data_read(struct file *filp, char __user *ubuf,
++				size_t cnt, loff_t *ppos, const u64 *entry);
++static ssize_t simple_data_write(struct file *filp, const char __user *ubuf,
++				 size_t cnt, loff_t *ppos, u64 *entry);
++static int debug_sample_fopen(struct inode *inode, struct file *filp);
++static ssize_t debug_sample_fread(struct file *filp, char __user *ubuf,
++				  size_t cnt, loff_t *ppos);
++static int debug_sample_release(struct inode *inode, struct file *filp);
++static int debug_enable_fopen(struct inode *inode, struct file *filp);
++static ssize_t debug_enable_fread(struct file *filp, char __user *ubuf,
++				  size_t cnt, loff_t *ppos);
++static ssize_t debug_enable_fwrite(struct file *file,
++				   const char __user *user_buffer,
++				   size_t user_size, loff_t *offset);
++
++/* Initialization functions */
++static int init_debugfs(void);
++static void free_debugfs(void);
++static int detector_init(void);
++static void detector_exit(void);
++
++/* Individual latency samples are stored here when detected and packed into
++ * the ring_buffer circular buffer, where they are overwritten when
++ * more than buf_size/sizeof(sample) samples are received. */
++struct sample {
++	u64		seqnum;		/* unique sequence */
++	u64		duration;	/* ktime delta */
++	struct timespec	timestamp;	/* wall time */
++};
++
++/* keep the global state somewhere. Mostly used under stop_machine. */
++static struct data {
++
++	struct mutex lock;		/* protect changes */
++
++	u64	count;			/* total since reset */
++	u64	max_sample;		/* max hardware latency */
++	u64	threshold;		/* sample threshold level */
++
++	u64	sample_window;		/* total sampling window (on+off) */
++	u64	sample_width;		/* active sampling portion of window */
++
++	atomic_t sample_open;		/* whether the sample file is open */
++
++	wait_queue_head_t wq;		/* waitqeue for new sample values */
++
++} data;
++
++/**
++ * __buffer_add_sample - add a new latency sample recording to the ring buffer
++ * @sample: The new latency sample value
++ *
++ * This receives a new latency sample and records it in a global ring buffer.
++ * No additional locking is used in this case - suited for stop_machine use.
++ */
++static int __buffer_add_sample(struct sample *sample)
++{
++	return ring_buffer_write(ring_buffer,
++				 sizeof(struct sample), sample);
++}
++
++/**
++ * buffer_get_sample - remove a hardware latency sample from the ring buffer
++ * @sample: Pre-allocated storage for the sample
++ *
++ * This retrieves a hardware latency sample from the global circular buffer
++ */
++static struct sample *buffer_get_sample(struct sample *sample)
++{
++	struct ring_buffer_event *e = NULL;
++	struct sample *s = NULL;
++	unsigned int cpu = 0;
++
++	if (!sample)
++		return NULL;
++
++	mutex_lock(&ring_buffer_mutex);
++	for_each_online_cpu(cpu) {
++		e = ring_buffer_consume(ring_buffer, cpu, NULL);
++		if (e)
++			break;
++	}
++
++	if (e) {
++		s = ring_buffer_event_data(e);
++		memcpy(sample, s, sizeof(struct sample));
++	} else
++		sample = NULL;
++	mutex_unlock(&ring_buffer_mutex);
++
++	return sample;
++}
++
++/**
++ * get_sample - sample the CPU TSC and look for likely hardware latencies
++ * @unused: This is not used but is a part of the stop_machine API
++ *
++ * Used to repeatedly capture the CPU TSC (or similar), looking for potential
++ * hardware-induced latency. Called under stop_machine, with data.lock held.
++ */
++static int get_sample(void *unused)
++{
++	ktime_t start, t1, t2;
++	s64 diff, total = 0;
++	u64 sample = 0;
++	int ret = 1;
++
++	start = ktime_get(); /* start timestamp */
++
++	do {
++
++		t1 = ktime_get();	/* we'll look for a discontinuity */
++		t2 = ktime_get();
++
++		total = ktime_to_us(ktime_sub(t2, start)); /* sample width */
++		diff = ktime_to_us(ktime_sub(t2, t1));     /* current diff */
++
++		/* This shouldn't happen */
++		if (diff < 0) {
++			printk(KERN_ERR BANNER "time running backwards\n");
++			goto out;
++		}
++
++		if (diff > sample)
++			sample = diff; /* only want highest value */
++
++	} while (total <= data.sample_width);
++
++	/* If we exceed the threshold value, we have found a hardware latency */
++	if (sample > data.threshold) {
++		struct sample s;
++
++		data.count++;
++		s.seqnum = data.count;
++		s.duration = sample;
++		s.timestamp = CURRENT_TIME;
++		__buffer_add_sample(&s);
++
++		/* Keep a running maximum ever recorded hardware latency */
++		if (sample > data.max_sample)
++			data.max_sample = sample;
++	}
++
++	ret = 0;
++out:
++	return ret;
++}
++
++/*
++ * kthread_fn - The CPU time sampling/hardware latency detection kernel thread
++ * @unused: A required part of the kthread API.
++ *
++ * Used to periodically sample the CPU TSC via a call to get_sample. We
++ * use stop_machine, whith does (intentionally) introduce latency since we
++ * need to ensure nothing else might be running (and thus pre-empting).
++ * Obviously this should never be used in production environments.
++ *
++ * stop_machine will schedule us typically only on CPU0 which is fine for
++ * almost every real-world hardware latency situation - but we might later
++ * generalize this if we find there are any actualy systems with alternate
++ * SMI delivery or other non CPU0 hardware latencies.
++ */
++static int kthread_fn(void *unused)
++{
++	int err = 0;
++	u64 interval = 0;
++
++	while (!kthread_should_stop()) {
++
++		mutex_lock(&data.lock);
++
++		err = stop_machine(get_sample, unused, 0);
++		if (err) {
++			/* Houston, we have a problem */
++			mutex_unlock(&data.lock);
++			goto err_out;
++		}
++
++		wake_up(&data.wq); /* wake up reader(s) */
++
++		interval = data.sample_window - data.sample_width;
++		do_div(interval, USEC_PER_MSEC); /* modifies interval value */
++
++		mutex_unlock(&data.lock);
++
++		if (msleep_interruptible(interval))
++			goto out;
++	}
++		goto out;
++err_out:
++	printk(KERN_ERR BANNER "could not call stop_machine, disabling\n");
++	enabled = 0;
++out:
++	return err;
++
++}
++
++/**
++ * start_kthread - Kick off the hardware latency sampling/detector kthread
++ *
++ * This starts a kernel thread that will sit and sample the CPU timestamp
++ * counter (TSC or similar) and look for potential hardware latencies.
++ */
++static int start_kthread(void)
++{
++	kthread = kthread_run(kthread_fn, NULL,
++					DRVNAME);
++	if (IS_ERR(kthread)) {
++		printk(KERN_ERR BANNER "could not start sampling thread\n");
++		enabled = 0;
++		return -ENOMEM;
++	}
++
++	return 0;
++}
++
++/**
++ * stop_kthread - Inform the hardware latency samping/detector kthread to stop
++ *
++ * This kicks the running hardware latency sampling/detector kernel thread and
++ * tells it to stop sampling now. Use this on unload and at system shutdown.
++ */
++static int stop_kthread(void)
++{
++	int ret;
++
++	ret = kthread_stop(kthread);
++
++	return ret;
++}
++
++/**
++ * __reset_stats - Reset statistics for the hardware latency detector
++ *
++ * We use data to store various statistics and global state. We call this
++ * function in order to reset those when "enable" is toggled on or off, and
++ * also at initialization. Should be called with data.lock held.
++ */
++static void __reset_stats(void)
++{
++	data.count = 0;
++	data.max_sample = 0;
++	ring_buffer_reset(ring_buffer); /* flush out old sample entries */
++}
++
++/**
++ * init_stats - Setup global state statistics for the hardware latency detector
++ *
++ * We use data to store various statistics and global state. We also use
++ * a global ring buffer (ring_buffer) to keep raw samples of detected hardware
++ * induced system latencies. This function initializes these structures and
++ * allocates the global ring buffer also.
++ */
++static int init_stats(void)
++{
++	int ret = -ENOMEM;
++
++	mutex_init(&data.lock);
++	init_waitqueue_head(&data.wq);
++	atomic_set(&data.sample_open, 0);
++
++	ring_buffer = ring_buffer_alloc(buf_size, BUF_FLAGS);
++
++	if (WARN(!ring_buffer, KERN_ERR BANNER
++			       "failed to allocate ring buffer!\n"))
++		goto out;
++
++	__reset_stats();
++	data.threshold = DEFAULT_LAT_THRESHOLD;	    /* threshold us */
++	data.sample_window = DEFAULT_SAMPLE_WINDOW; /* window us */
++	data.sample_width = DEFAULT_SAMPLE_WIDTH;   /* width us */
++
++	ret = 0;
++
++out:
++	return ret;
++
++}
++
++/*
++ * simple_data_read - Wrapper read function for global state debugfs entries
++ * @filp: The active open file structure for the debugfs "file"
++ * @ubuf: The userspace provided buffer to read value into
++ * @cnt: The maximum number of bytes to read
++ * @ppos: The current "file" position
++ * @entry: The entry to read from
++ *
++ * This function provides a generic read implementation for the global state
++ * "data" structure debugfs filesystem entries. It would be nice to use
++ * simple_attr_read directly, but we need to make sure that the data.lock
++ * spinlock is held during the actual read (even though we likely won't ever
++ * actually race here as the updater runs under a stop_machine context).
++ */
++static ssize_t simple_data_read(struct file *filp, char __user *ubuf,
++				size_t cnt, loff_t *ppos, const u64 *entry)
++{
++	char buf[U64STR_SIZE];
++	u64 val = 0;
++	int len = 0;
++
++	memset(buf, 0, sizeof(buf));
++
++	if (!entry)
++		return -EFAULT;
++
++	mutex_lock(&data.lock);
++	val = *entry;
++	mutex_unlock(&data.lock);
++
++	len = snprintf(buf, sizeof(buf), "%llu\n", (unsigned long long)val);
++
++	return simple_read_from_buffer(ubuf, cnt, ppos, buf, len);
++
++}
++
++/*
++ * simple_data_write - Wrapper write function for global state debugfs entries
++ * @filp: The active open file structure for the debugfs "file"
++ * @ubuf: The userspace provided buffer to write value from
++ * @cnt: The maximum number of bytes to write
++ * @ppos: The current "file" position
++ * @entry: The entry to write to
++ *
++ * This function provides a generic write implementation for the global state
++ * "data" structure debugfs filesystem entries. It would be nice to use
++ * simple_attr_write directly, but we need to make sure that the data.lock
++ * spinlock is held during the actual write (even though we likely won't ever
++ * actually race here as the updater runs under a stop_machine context).
++ */
++static ssize_t simple_data_write(struct file *filp, const char __user *ubuf,
++				 size_t cnt, loff_t *ppos, u64 *entry)
++{
++	char buf[U64STR_SIZE];
++	int csize = min(cnt, sizeof(buf));
++	u64 val = 0;
++	int err = 0;
++
++	memset(buf, '\0', sizeof(buf));
++	if (copy_from_user(buf, ubuf, csize))
++		return -EFAULT;
++
++	buf[U64STR_SIZE-1] = '\0';			/* just in case */
++	err = strict_strtoull(buf, 10, &val);
++	if (err)
++		return -EINVAL;
++
++	mutex_lock(&data.lock);
++	*entry = val;
++	mutex_unlock(&data.lock);
++
++	return csize;
++}
++
++/**
++ * debug_count_fopen - Open function for "count" debugfs entry
++ * @inode: The in-kernel inode representation of the debugfs "file"
++ * @filp: The active open file structure for the debugfs "file"
++ *
++ * This function provides an open implementation for the "count" debugfs
++ * interface to the hardware latency detector.
++ */
++static int debug_count_fopen(struct inode *inode, struct file *filp)
++{
++	return 0;
++}
++
++/**
++ * debug_count_fread - Read function for "count" debugfs entry
++ * @filp: The active open file structure for the debugfs "file"
++ * @ubuf: The userspace provided buffer to read value into
++ * @cnt: The maximum number of bytes to read
++ * @ppos: The current "file" position
++ *
++ * This function provides a read implementation for the "count" debugfs
++ * interface to the hardware latency detector. Can be used to read the
++ * number of latency readings exceeding the configured threshold since
++ * the detector was last reset (e.g. by writing a zero into "count").
++ */
++static ssize_t debug_count_fread(struct file *filp, char __user *ubuf,
++				     size_t cnt, loff_t *ppos)
++{
++	return simple_data_read(filp, ubuf, cnt, ppos, &data.count);
++}
++
++/**
++ * debug_count_fwrite - Write function for "count" debugfs entry
++ * @filp: The active open file structure for the debugfs "file"
++ * @ubuf: The user buffer that contains the value to write
++ * @cnt: The maximum number of bytes to write to "file"
++ * @ppos: The current position in the debugfs "file"
++ *
++ * This function provides a write implementation for the "count" debugfs
++ * interface to the hardware latency detector. Can be used to write a
++ * desired value, especially to zero the total count.
++ */
++static ssize_t  debug_count_fwrite(struct file *filp,
++				       const char __user *ubuf,
++				       size_t cnt,
++				       loff_t *ppos)
++{
++	return simple_data_write(filp, ubuf, cnt, ppos, &data.count);
++}
++
++/**
++ * debug_enable_fopen - Dummy open function for "enable" debugfs interface
++ * @inode: The in-kernel inode representation of the debugfs "file"
++ * @filp: The active open file structure for the debugfs "file"
++ *
++ * This function provides an open implementation for the "enable" debugfs
++ * interface to the hardware latency detector.
++ */
++static int debug_enable_fopen(struct inode *inode, struct file *filp)
++{
++	return 0;
++}
++
++/**
++ * debug_enable_fread - Read function for "enable" debugfs interface
++ * @filp: The active open file structure for the debugfs "file"
++ * @ubuf: The userspace provided buffer to read value into
++ * @cnt: The maximum number of bytes to read
++ * @ppos: The current "file" position
++ *
++ * This function provides a read implementation for the "enable" debugfs
++ * interface to the hardware latency detector. Can be used to determine
++ * whether the detector is currently enabled ("0\n" or "1\n" returned).
++ */
++static ssize_t debug_enable_fread(struct file *filp, char __user *ubuf,
++				      size_t cnt, loff_t *ppos)
++{
++	char buf[4];
++
++	if ((cnt < sizeof(buf)) || (*ppos))
++		return 0;
++
++	buf[0] = enabled ? '1' : '0';
++	buf[1] = '\n';
++	buf[2] = '\0';
++	if (copy_to_user(ubuf, buf, strlen(buf)))
++		return -EFAULT;
++	return *ppos = strlen(buf);
++}
++
++/**
++ * debug_enable_fwrite - Write function for "enable" debugfs interface
++ * @filp: The active open file structure for the debugfs "file"
++ * @ubuf: The user buffer that contains the value to write
++ * @cnt: The maximum number of bytes to write to "file"
++ * @ppos: The current position in the debugfs "file"
++ *
++ * This function provides a write implementation for the "enable" debugfs
++ * interface to the hardware latency detector. Can be used to enable or
++ * disable the detector, which will have the side-effect of possibly
++ * also resetting the global stats and kicking off the measuring
++ * kthread (on an enable) or the converse (upon a disable).
++ */
++static ssize_t  debug_enable_fwrite(struct file *filp,
++					const char __user *ubuf,
++					size_t cnt,
++					loff_t *ppos)
++{
++	char buf[4];
++	int csize = min(cnt, sizeof(buf));
++	long val = 0;
++	int err = 0;
++
++	memset(buf, '\0', sizeof(buf));
++	if (copy_from_user(buf, ubuf, csize))
++		return -EFAULT;
++
++	buf[sizeof(buf)-1] = '\0';			/* just in case */
++	err = strict_strtoul(buf, 10, &val);
++	if (0 != err)
++		return -EINVAL;
++
++	if (val) {
++		if (enabled)
++			goto unlock;
++		enabled = 1;
++		__reset_stats();
++		if (start_kthread())
++			return -EFAULT;
++	} else {
++		if (!enabled)
++			goto unlock;
++		enabled = 0;
++		err = stop_kthread();
++		if (err) {
++			printk(KERN_ERR BANNER "cannot stop kthread\n");
++			return -EFAULT;
++		}
++		wake_up(&data.wq);		/* reader(s) should return */
++	}
++unlock:
++	return csize;
++}
++
++/**
++ * debug_max_fopen - Open function for "max" debugfs entry
++ * @inode: The in-kernel inode representation of the debugfs "file"
++ * @filp: The active open file structure for the debugfs "file"
++ *
++ * This function provides an open implementation for the "max" debugfs
++ * interface to the hardware latency detector.
++ */
++static int debug_max_fopen(struct inode *inode, struct file *filp)
++{
++	return 0;
++}
++
++/**
++ * debug_max_fread - Read function for "max" debugfs entry
++ * @filp: The active open file structure for the debugfs "file"
++ * @ubuf: The userspace provided buffer to read value into
++ * @cnt: The maximum number of bytes to read
++ * @ppos: The current "file" position
++ *
++ * This function provides a read implementation for the "max" debugfs
++ * interface to the hardware latency detector. Can be used to determine
++ * the maximum latency value observed since it was last reset.
++ */
++static ssize_t debug_max_fread(struct file *filp, char __user *ubuf,
++				   size_t cnt, loff_t *ppos)
++{
++	return simple_data_read(filp, ubuf, cnt, ppos, &data.max_sample);
++}
++
++/**
++ * debug_max_fwrite - Write function for "max" debugfs entry
++ * @filp: The active open file structure for the debugfs "file"
++ * @ubuf: The user buffer that contains the value to write
++ * @cnt: The maximum number of bytes to write to "file"
++ * @ppos: The current position in the debugfs "file"
++ *
++ * This function provides a write implementation for the "max" debugfs
++ * interface to the hardware latency detector. Can be used to reset the
++ * maximum or set it to some other desired value - if, then, subsequent
++ * measurements exceed this value, the maximum will be updated.
++ */
++static ssize_t  debug_max_fwrite(struct file *filp,
++				     const char __user *ubuf,
++				     size_t cnt,
++				     loff_t *ppos)
++{
++	return simple_data_write(filp, ubuf, cnt, ppos, &data.max_sample);
++}
++
++
++/**
++ * debug_sample_fopen - An open function for "sample" debugfs interface
++ * @inode: The in-kernel inode representation of this debugfs "file"
++ * @filp: The active open file structure for the debugfs "file"
++ *
++ * This function handles opening the "sample" file within the hardware
++ * latency detector debugfs directory interface. This file is used to read
++ * raw samples from the global ring_buffer and allows the user to see a
++ * running latency history. Can be opened blocking or non-blocking,
++ * affecting whether it behaves as a buffer read pipe, or does not.
++ * Implements simple locking to prevent multiple simultaneous use.
++ */
++static int debug_sample_fopen(struct inode *inode, struct file *filp)
++{
++	if (!atomic_add_unless(&data.sample_open, 1, 1))
++		return -EBUSY;
++	else
++		return 0;
++}
++
++/**
++ * debug_sample_fread - A read function for "sample" debugfs interface
++ * @filp: The active open file structure for the debugfs "file"
++ * @ubuf: The user buffer that will contain the samples read
++ * @cnt: The maximum bytes to read from the debugfs "file"
++ * @ppos: The current position in the debugfs "file"
++ *
++ * This function handles reading from the "sample" file within the hardware
++ * latency detector debugfs directory interface. This file is used to read
++ * raw samples from the global ring_buffer and allows the user to see a
++ * running latency history. By default this will block pending a new
++ * value written into the sample buffer, unless there are already a
++ * number of value(s) waiting in the buffer, or the sample file was
++ * previously opened in a non-blocking mode of operation.
++ */
++static ssize_t debug_sample_fread(struct file *filp, char __user *ubuf,
++					size_t cnt, loff_t *ppos)
++{
++	int len = 0;
++	char buf[64];
++	struct sample *sample = NULL;
++
++	if (!enabled)
++		return 0;
++
++	sample = kzalloc(sizeof(struct sample), GFP_KERNEL);
++	if (!sample)
++		return -ENOMEM;
++
++	while (!buffer_get_sample(sample)) {
++
++		DEFINE_WAIT(wait);
++
++		if (filp->f_flags & O_NONBLOCK) {
++			len = -EAGAIN;
++			goto out;
++		}
++
++		prepare_to_wait(&data.wq, &wait, TASK_INTERRUPTIBLE);
++		schedule();
++		finish_wait(&data.wq, &wait);
++
++		if (signal_pending(current)) {
++			len = -EINTR;
++			goto out;
++		}
++
++		if (!enabled) {			/* enable was toggled */
++			len = 0;
++			goto out;
++		}
++	}
++
++	len = snprintf(buf, sizeof(buf), "%010lu.%010lu\t%llu\n",
++		      sample->timestamp.tv_sec,
++		      sample->timestamp.tv_nsec,
++		      sample->duration);
++
++
++	/* handling partial reads is more trouble than it's worth */
++	if (len > cnt)
++		goto out;
++
++	if (copy_to_user(ubuf, buf, len))
++		len = -EFAULT;
++
++out:
++	kfree(sample);
++	return len;
++}
++
++/**
++ * debug_sample_release - Release function for "sample" debugfs interface
++ * @inode: The in-kernel inode represenation of the debugfs "file"
++ * @filp: The active open file structure for the debugfs "file"
++ *
++ * This function completes the close of the debugfs interface "sample" file.
++ * Frees the sample_open "lock" so that other users may open the interface.
++ */
++static int debug_sample_release(struct inode *inode, struct file *filp)
++{
++	atomic_dec(&data.sample_open);
++
++	return 0;
++}
++
++/**
++ * debug_threshold_fopen - Open function for "threshold" debugfs entry
++ * @inode: The in-kernel inode representation of the debugfs "file"
++ * @filp: The active open file structure for the debugfs "file"
++ *
++ * This function provides an open implementation for the "threshold" debugfs
++ * interface to the hardware latency detector.
++ */
++static int debug_threshold_fopen(struct inode *inode, struct file *filp)
++{
++	return 0;
++}
++
++/**
++ * debug_threshold_fread - Read function for "threshold" debugfs entry
++ * @filp: The active open file structure for the debugfs "file"
++ * @ubuf: The userspace provided buffer to read value into
++ * @cnt: The maximum number of bytes to read
++ * @ppos: The current "file" position
++ *
++ * This function provides a read implementation for the "threshold" debugfs
++ * interface to the hardware latency detector. It can be used to determine
++ * the current threshold level at which a latency will be recorded in the
++ * global ring buffer, typically on the order of 10us.
++ */
++static ssize_t debug_threshold_fread(struct file *filp, char __user *ubuf,
++					 size_t cnt, loff_t *ppos)
++{
++	return simple_data_read(filp, ubuf, cnt, ppos, &data.threshold);
++}
++
++/**
++ * debug_threshold_fwrite - Write function for "threshold" debugfs entry
++ * @filp: The active open file structure for the debugfs "file"
++ * @ubuf: The user buffer that contains the value to write
++ * @cnt: The maximum number of bytes to write to "file"
++ * @ppos: The current position in the debugfs "file"
++ *
++ * This function provides a write implementation for the "threshold" debugfs
++ * interface to the hardware latency detector. It can be used to configure
++ * the threshold level at which any subsequently detected latencies will
++ * be recorded into the global ring buffer.
++ */
++static ssize_t  debug_threshold_fwrite(struct file *filp,
++					const char __user *ubuf,
++					size_t cnt,
++					loff_t *ppos)
++{
++	int ret;
++
++	ret = simple_data_write(filp, ubuf, cnt, ppos, &data.threshold);
++
++	if (enabled)
++		wake_up_process(kthread);
++
++	return ret;
++}
++
++/**
++ * debug_width_fopen - Open function for "width" debugfs entry
++ * @inode: The in-kernel inode representation of the debugfs "file"
++ * @filp: The active open file structure for the debugfs "file"
++ *
++ * This function provides an open implementation for the "width" debugfs
++ * interface to the hardware latency detector.
++ */
++static int debug_width_fopen(struct inode *inode, struct file *filp)
++{
++	return 0;
++}
++
++/**
++ * debug_width_fread - Read function for "width" debugfs entry
++ * @filp: The active open file structure for the debugfs "file"
++ * @ubuf: The userspace provided buffer to read value into
++ * @cnt: The maximum number of bytes to read
++ * @ppos: The current "file" position
++ *
++ * This function provides a read implementation for the "width" debugfs
++ * interface to the hardware latency detector. It can be used to determine
++ * for how many us of the total window us we will actively sample for any
++ * hardware-induced latecy periods. Obviously, it is not possible to
++ * sample constantly and have the system respond to a sample reader, or,
++ * worse, without having the system appear to have gone out to lunch.
++ */
++static ssize_t debug_width_fread(struct file *filp, char __user *ubuf,
++				     size_t cnt, loff_t *ppos)
++{
++	return simple_data_read(filp, ubuf, cnt, ppos, &data.sample_width);
++}
++
++/**
++ * debug_width_fwrite - Write function for "width" debugfs entry
++ * @filp: The active open file structure for the debugfs "file"
++ * @ubuf: The user buffer that contains the value to write
++ * @cnt: The maximum number of bytes to write to "file"
++ * @ppos: The current position in the debugfs "file"
++ *
++ * This function provides a write implementation for the "width" debugfs
++ * interface to the hardware latency detector. It can be used to configure
++ * for how many us of the total window us we will actively sample for any
++ * hardware-induced latency periods. Obviously, it is not possible to
++ * sample constantly and have the system respond to a sample reader, or,
++ * worse, without having the system appear to have gone out to lunch. It
++ * is enforced that width is less that the total window size.
++ */
++static ssize_t  debug_width_fwrite(struct file *filp,
++				       const char __user *ubuf,
++				       size_t cnt,
++				       loff_t *ppos)
++{
++	char buf[U64STR_SIZE];
++	int csize = min(cnt, sizeof(buf));
++	u64 val = 0;
++	int err = 0;
++
++	memset(buf, '\0', sizeof(buf));
++	if (copy_from_user(buf, ubuf, csize))
++		return -EFAULT;
++
++	buf[U64STR_SIZE-1] = '\0';			/* just in case */
++	err = strict_strtoull(buf, 10, &val);
++	if (0 != err)
++		return -EINVAL;
++
++	mutex_lock(&data.lock);
++	if (val < data.sample_window)
++		data.sample_width = val;
++	else {
++		mutex_unlock(&data.lock);
++		return -EINVAL;
++	}
++	mutex_unlock(&data.lock);
++
++	if (enabled)
++		wake_up_process(kthread);
++
++	return csize;
++}
++
++/**
++ * debug_window_fopen - Open function for "window" debugfs entry
++ * @inode: The in-kernel inode representation of the debugfs "file"
++ * @filp: The active open file structure for the debugfs "file"
++ *
++ * This function provides an open implementation for the "window" debugfs
++ * interface to the hardware latency detector. The window is the total time
++ * in us that will be considered one sample period. Conceptually, windows
++ * occur back-to-back and contain a sample width period during which
++ * actual sampling occurs.
++ */
++static int debug_window_fopen(struct inode *inode, struct file *filp)
++{
++	return 0;
++}
++
++/**
++ * debug_window_fread - Read function for "window" debugfs entry
++ * @filp: The active open file structure for the debugfs "file"
++ * @ubuf: The userspace provided buffer to read value into
++ * @cnt: The maximum number of bytes to read
++ * @ppos: The current "file" position
++ *
++ * This function provides a read implementation for the "window" debugfs
++ * interface to the hardware latency detector. The window is the total time
++ * in us that will be considered one sample period. Conceptually, windows
++ * occur back-to-back and contain a sample width period during which
++ * actual sampling occurs. Can be used to read the total window size.
++ */
++static ssize_t debug_window_fread(struct file *filp, char __user *ubuf,
++				      size_t cnt, loff_t *ppos)
++{
++	return simple_data_read(filp, ubuf, cnt, ppos, &data.sample_window);
++}
++
++/**
++ * debug_window_fwrite - Write function for "window" debugfs entry
++ * @filp: The active open file structure for the debugfs "file"
++ * @ubuf: The user buffer that contains the value to write
++ * @cnt: The maximum number of bytes to write to "file"
++ * @ppos: The current position in the debugfs "file"
++ *
++ * This function provides a write implementation for the "window" debufds
++ * interface to the hardware latency detetector. The window is the total time
++ * in us that will be considered one sample period. Conceptually, windows
++ * occur back-to-back and contain a sample width period during which
++ * actual sampling occurs. Can be used to write a new total window size. It
++ * is enfoced that any value written must be greater than the sample width
++ * size, or an error results.
++ */
++static ssize_t  debug_window_fwrite(struct file *filp,
++					const char __user *ubuf,
++					size_t cnt,
++					loff_t *ppos)
++{
++	char buf[U64STR_SIZE];
++	int csize = min(cnt, sizeof(buf));
++	u64 val = 0;
++	int err = 0;
++
++	memset(buf, '\0', sizeof(buf));
++	if (copy_from_user(buf, ubuf, csize))
++		return -EFAULT;
++
++	buf[U64STR_SIZE-1] = '\0';			/* just in case */
++	err = strict_strtoull(buf, 10, &val);
++	if (0 != err)
++		return -EINVAL;
++
++	mutex_lock(&data.lock);
++	if (data.sample_width < val)
++		data.sample_window = val;
++	else {
++		mutex_unlock(&data.lock);
++		return -EINVAL;
++	}
++	mutex_unlock(&data.lock);
++
++	return csize;
++}
++
++/*
++ * Function pointers for the "count" debugfs file operations
++ */
++static const struct file_operations count_fops = {
++	.open		= debug_count_fopen,
++	.read		= debug_count_fread,
++	.write		= debug_count_fwrite,
++	.owner		= THIS_MODULE,
++};
++
++/*
++ * Function pointers for the "enable" debugfs file operations
++ */
++static const struct file_operations enable_fops = {
++	.open		= debug_enable_fopen,
++	.read		= debug_enable_fread,
++	.write		= debug_enable_fwrite,
++	.owner		= THIS_MODULE,
++};
++
++/*
++ * Function pointers for the "max" debugfs file operations
++ */
++static const struct file_operations max_fops = {
++	.open		= debug_max_fopen,
++	.read		= debug_max_fread,
++	.write		= debug_max_fwrite,
++	.owner		= THIS_MODULE,
++};
++
++/*
++ * Function pointers for the "sample" debugfs file operations
++ */
++static const struct file_operations sample_fops = {
++	.open 		= debug_sample_fopen,
++	.read		= debug_sample_fread,
++	.release	= debug_sample_release,
++	.owner		= THIS_MODULE,
++};
++
++/*
++ * Function pointers for the "threshold" debugfs file operations
++ */
++static const struct file_operations threshold_fops = {
++	.open		= debug_threshold_fopen,
++	.read		= debug_threshold_fread,
++	.write		= debug_threshold_fwrite,
++	.owner		= THIS_MODULE,
++};
++
++/*
++ * Function pointers for the "width" debugfs file operations
++ */
++static const struct file_operations width_fops = {
++	.open		= debug_width_fopen,
++	.read		= debug_width_fread,
++	.write		= debug_width_fwrite,
++	.owner		= THIS_MODULE,
++};
++
++/*
++ * Function pointers for the "window" debugfs file operations
++ */
++static const struct file_operations window_fops = {
++	.open		= debug_window_fopen,
++	.read		= debug_window_fread,
++	.write		= debug_window_fwrite,
++	.owner		= THIS_MODULE,
++};
++
++/**
++ * init_debugfs - A function to initialize the debugfs interface files
++ *
++ * This function creates entries in debugfs for "hwlat_detector", including
++ * files to read values from the detector, current samples, and the
++ * maximum sample that has been captured since the hardware latency
++ * dectector was started.
++ */
++static int init_debugfs(void)
++{
++	int ret = -ENOMEM;
++
++	debug_dir = debugfs_create_dir(DRVNAME, NULL);
++	if (!debug_dir)
++		goto err_debug_dir;
++
++	debug_sample = debugfs_create_file("sample", 0444,
++					       debug_dir, NULL,
++					       &sample_fops);
++	if (!debug_sample)
++		goto err_sample;
++
++	debug_count = debugfs_create_file("count", 0444,
++					      debug_dir, NULL,
++					      &count_fops);
++	if (!debug_count)
++		goto err_count;
++
++	debug_max = debugfs_create_file("max", 0444,
++					    debug_dir, NULL,
++					    &max_fops);
++	if (!debug_max)
++		goto err_max;
++
++	debug_sample_window = debugfs_create_file("window", 0644,
++						      debug_dir, NULL,
++						      &window_fops);
++	if (!debug_sample_window)
++		goto err_window;
++
++	debug_sample_width = debugfs_create_file("width", 0644,
++						     debug_dir, NULL,
++						     &width_fops);
++	if (!debug_sample_width)
++		goto err_width;
++
++	debug_threshold = debugfs_create_file("threshold", 0644,
++						  debug_dir, NULL,
++						  &threshold_fops);
++	if (!debug_threshold)
++		goto err_threshold;
++
++	debug_enable = debugfs_create_file("enable", 0644,
++					       debug_dir, &enabled,
++					       &enable_fops);
++	if (!debug_enable)
++		goto err_enable;
++
++	else {
++		ret = 0;
++		goto out;
++	}
++
++err_enable:
++	debugfs_remove(debug_threshold);
++err_threshold:
++	debugfs_remove(debug_sample_width);
++err_width:
++	debugfs_remove(debug_sample_window);
++err_window:
++	debugfs_remove(debug_max);
++err_max:
++	debugfs_remove(debug_count);
++err_count:
++	debugfs_remove(debug_sample);
++err_sample:
++	debugfs_remove(debug_dir);
++err_debug_dir:
++out:
++	return ret;
++}
++
++/**
++ * free_debugfs - A function to cleanup the debugfs file interface
++ */
++static void free_debugfs(void)
++{
++	/* could also use a debugfs_remove_recursive */
++	debugfs_remove(debug_enable);
++	debugfs_remove(debug_threshold);
++	debugfs_remove(debug_sample_width);
++	debugfs_remove(debug_sample_window);
++	debugfs_remove(debug_max);
++	debugfs_remove(debug_count);
++	debugfs_remove(debug_sample);
++	debugfs_remove(debug_dir);
++}
++
++/**
++ * detector_init - Standard module initialization code
++ */
++static int detector_init(void)
++{
++	int ret = -ENOMEM;
++
++	printk(KERN_INFO BANNER "version %s\n", VERSION);
++
++	ret = init_stats();
++	if (0 != ret)
++		goto out;
++
++	ret = init_debugfs();
++	if (0 != ret)
++		goto err_stats;
++
++	if (enabled)
++		ret = start_kthread();
++
++	goto out;
++
++err_stats:
++	ring_buffer_free(ring_buffer);
++out:
++	return ret;
++
++}
++
++/**
++ * detector_exit - Standard module cleanup code
++ */
++static void detector_exit(void)
++{
++	int err;
++
++	if (enabled) {
++		enabled = 0;
++		err = stop_kthread();
++		if (err)
++			printk(KERN_ERR BANNER "cannot stop kthread\n");
++	}
++
++	free_debugfs();
++	ring_buffer_free(ring_buffer);	/* free up the ring buffer */
++
++}
++
++module_init(detector_init);
++module_exit(detector_exit);
+Index: linux-rt-2.6.31/drivers/mmc/card/queue.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/mmc/card/queue.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/drivers/mmc/card/queue.c	2010-05-17 14:23:19.978385761 +0200
+@@ -194,7 +194,7 @@
+ 		sg_init_table(mq->sg, host->max_phys_segs);
+ 	}
+ 
+-	init_MUTEX(&mq->thread_sem);
++	semaphore_init(&mq->thread_sem);
+ 
+ 	mq->thread = kthread_run(mmc_queue_thread, mq, "mmcqd");
+ 	if (IS_ERR(mq->thread)) {
+Index: linux-rt-2.6.31/drivers/net/3c527.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/net/3c527.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/net/3c527.c	2010-05-17 14:23:19.978385761 +0200
+@@ -179,7 +179,7 @@
+ 
+ 	u16 rx_ring_tail;       /* index to rx de-queue end */
+ 
+-	struct semaphore cmd_mutex;    /* Serialises issuing of execute commands */
++	struct anon_semaphore cmd_mutex;    /* Serialises issuing of execute commands */
+         struct completion execution_cmd; /* Card has completed an execute command */
+ 	struct completion xceiver_cmd;   /* Card has completed a tx or rx command */
+ };
+@@ -521,7 +521,7 @@
+ 	lp->tx_len 		= lp->exec_box->data[9];   /* Transmit list count */
+ 	lp->rx_len 		= lp->exec_box->data[11];  /* Receive list count */
+ 
+-	init_MUTEX_LOCKED(&lp->cmd_mutex);
++	anon_semaphore_init_locked(&lp->cmd_mutex);
+ 	init_completion(&lp->execution_cmd);
+ 	init_completion(&lp->xceiver_cmd);
+ 
+@@ -580,7 +580,7 @@
+ 	int ioaddr = dev->base_addr;
+ 	int ret = -1;
+ 
+-	if (down_trylock(&lp->cmd_mutex) == 0)
++	if (anon_down_trylock(&lp->cmd_mutex) == 0)
+ 	{
+ 		lp->cmd_nonblocking=1;
+ 		lp->exec_box->mbox=0;
+@@ -626,7 +626,7 @@
+ 	int ioaddr = dev->base_addr;
+ 	int ret = 0;
+ 
+-	down(&lp->cmd_mutex);
++	anon_down(&lp->cmd_mutex);
+ 
+ 	/*
+ 	 *     My Turn
+@@ -646,7 +646,7 @@
+ 	if(lp->exec_box->mbox&(1<<13))
+ 		ret = -1;
+ 
+-	up(&lp->cmd_mutex);
++	anon_up(&lp->cmd_mutex);
+ 
+ 	/*
+ 	 *	A multicast set got blocked - try it now
+@@ -916,7 +916,7 @@
+ 	 *      Allow ourselves to issue commands
+ 	 */
+ 
+-	up(&lp->cmd_mutex);
++	anon_up(&lp->cmd_mutex);
+ 
+ 
+ 	/*
+@@ -1384,7 +1384,7 @@
+ 			 */
+ 
+ 			if (lp->cmd_nonblocking) {
+-				up(&lp->cmd_mutex);
++				anon_up(&lp->cmd_mutex);
+ 				if (lp->mc_reload_wait)
+ 					mc32_reset_multicast_list(dev);
+ 			}
+@@ -1461,7 +1461,7 @@
+ 
+ 	/* Ensure we issue no more commands beyond this point */
+ 
+-	down(&lp->cmd_mutex);
++	anon_down(&lp->cmd_mutex);
+ 
+ 	/* Ok the card is now stopping */
+ 
+Index: linux-rt-2.6.31/drivers/net/3c59x.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/net/3c59x.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/net/3c59x.c	2010-05-17 14:23:19.978385761 +0200
+@@ -795,9 +795,9 @@
+ {
+ 	struct vortex_private *vp = netdev_priv(dev);
+ 	unsigned long flags;
+-	local_irq_save(flags);
++	local_irq_save_nort(flags);
+ 	(vp->full_bus_master_rx ? boomerang_interrupt:vortex_interrupt)(dev->irq,dev);
+-	local_irq_restore(flags);
++	local_irq_restore_nort(flags);
+ }
+ #endif
+ 
+@@ -1766,6 +1766,7 @@
+ 	int next_tick = 60*HZ;
+ 	int ok = 0;
+ 	int media_status, old_window;
++	unsigned long flags;
+ 
+ 	if (vortex_debug > 2) {
+ 		pr_debug("%s: Media selection timer tick happened, %s.\n",
+@@ -1773,7 +1774,7 @@
+ 		pr_debug("dev->watchdog_timeo=%d\n", dev->watchdog_timeo);
+ 	}
+ 
+-	disable_irq_lockdep(dev->irq);
++	spin_lock_irqsave(&vp->lock, flags);
+ 	old_window = ioread16(ioaddr + EL3_CMD) >> 13;
+ 	EL3WINDOW(4);
+ 	media_status = ioread16(ioaddr + Wn4_Media);
+@@ -1796,10 +1797,7 @@
+ 	case XCVR_MII: case XCVR_NWAY:
+ 		{
+ 			ok = 1;
+-			/* Interrupts are already disabled */
+-			spin_lock(&vp->lock);
+ 			vortex_check_media(dev, 0);
+-			spin_unlock(&vp->lock);
+ 		}
+ 		break;
+ 	  default:					/* Other media types handled by Tx timeouts. */
+@@ -1853,7 +1851,7 @@
+ 			 dev->name, media_tbl[dev->if_port].name);
+ 
+ 	EL3WINDOW(old_window);
+-	enable_irq_lockdep(dev->irq);
++	spin_unlock_irqrestore(&vp->lock, flags);
+ 	mod_timer(&vp->timer, RUN_AT(next_tick));
+ 	if (vp->deferred)
+ 		iowrite16(FakeIntr, ioaddr + EL3_CMD);
+@@ -1887,12 +1885,12 @@
+ 			 * Block interrupts because vortex_interrupt does a bare spin_lock()
+ 			 */
+ 			unsigned long flags;
+-			local_irq_save(flags);
++			local_irq_save_nort(flags);
+ 			if (vp->full_bus_master_tx)
+ 				boomerang_interrupt(dev->irq, dev);
+ 			else
+ 				vortex_interrupt(dev->irq, dev);
+-			local_irq_restore(flags);
++			local_irq_restore_nort(flags);
+ 		}
+ 	}
+ 
+Index: linux-rt-2.6.31/drivers/net/8139too.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/net/8139too.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/net/8139too.c	2010-05-17 14:23:19.978385761 +0200
+@@ -2195,7 +2195,11 @@
+  */
+ static void rtl8139_poll_controller(struct net_device *dev)
+ {
+-	disable_irq(dev->irq);
++	/*
++	 * use _nosync() variant - might be used by netconsole
++	 * from atomic contexts:
++	 */
++	disable_irq_nosync(dev->irq);
+ 	rtl8139_interrupt(dev->irq, dev);
+ 	enable_irq(dev->irq);
+ }
+Index: linux-rt-2.6.31/drivers/net/arm/at91_ether.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/net/arm/at91_ether.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/net/arm/at91_ether.c	2010-05-17 14:23:19.988474194 +0200
+@@ -198,7 +198,9 @@
+ 	struct net_device *dev = (struct net_device *) dev_id;
+ 	struct at91_private *lp = netdev_priv(dev);
+ 	unsigned int phy;
++	unsigned long flags;
+ 
++	spin_lock_irqsave(&lp->lock, flags);
+ 	/*
+ 	 * This hander is triggered on both edges, but the PHY chips expect
+ 	 * level-triggering.  We therefore have to check if the PHY actually has
+@@ -240,6 +242,7 @@
+ 
+ done:
+ 	disable_mdi();
++	spin_unlock_irqrestore(&lp->lock, flags);
+ 
+ 	return IRQ_HANDLED;
+ }
+@@ -396,9 +399,11 @@
+ 	struct net_device *dev = (struct net_device *) dev_id;
+ 	struct at91_private *lp = netdev_priv(dev);
+ 
++	spin_lock_irq(&lp->lock);
+ 	enable_mdi();
+ 	update_linkspeed(dev, 1);
+ 	disable_mdi();
++	spin_unlock_irq(&lp->lock);
+ 
+ 	mod_timer(&lp->check_timer, jiffies + LINK_POLL_INTERVAL);
+ }
+Index: linux-rt-2.6.31/drivers/net/atl1c/atl1c_main.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/net/atl1c/atl1c_main.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/net/atl1c/atl1c_main.c	2010-05-17 14:23:19.988474194 +0200
+@@ -2069,11 +2069,8 @@
+ 	}
+ 
+ 	tpd_req = atl1c_cal_tpd_req(skb);
+-	if (!spin_trylock_irqsave(&adapter->tx_lock, flags)) {
+-		if (netif_msg_pktdata(adapter))
+-			dev_info(&adapter->pdev->dev, "tx locked\n");
+-		return NETDEV_TX_LOCKED;
+-	}
++	spin_lock_irqsave(&adapter->tx_lock, flags);
++
+ 	if (skb->mark == 0x01)
+ 		type = atl1c_trans_high;
+ 	else
+Index: linux-rt-2.6.31/drivers/net/atl1e/atl1e_main.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/net/atl1e/atl1e_main.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/net/atl1e/atl1e_main.c	2010-05-17 14:23:19.988474194 +0200
+@@ -1856,8 +1856,7 @@
+ 		return NETDEV_TX_OK;
+ 	}
+ 	tpd_req = atl1e_cal_tdp_req(skb);
+-	if (!spin_trylock_irqsave(&adapter->tx_lock, flags))
+-		return NETDEV_TX_LOCKED;
++	spin_lock_irqsave(&adapter->tx_lock, flags);
+ 
+ 	if (atl1e_tpd_avail(adapter) < tpd_req) {
+ 		/* no enough descriptor, just stop queue */
+Index: linux-rt-2.6.31/drivers/net/bnx2.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/net/bnx2.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/net/bnx2.c	2010-05-17 14:23:19.988474194 +0200
+@@ -2838,7 +2838,7 @@
+ 
+ 	if (unlikely(netif_tx_queue_stopped(txq)) &&
+ 		     (bnx2_tx_avail(bp, txr) > bp->tx_wake_thresh)) {
+-		__netif_tx_lock(txq, smp_processor_id());
++		__netif_tx_lock(txq);
+ 		if ((netif_tx_queue_stopped(txq)) &&
+ 		    (bnx2_tx_avail(bp, txr) > bp->tx_wake_thresh))
+ 			netif_tx_wake_queue(txq);
+Index: linux-rt-2.6.31/drivers/net/bnx2x_main.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/net/bnx2x_main.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/net/bnx2x_main.c	2010-05-17 14:23:19.988474194 +0200
+@@ -926,7 +926,7 @@
+ 	/* TBD need a thresh? */
+ 	if (unlikely(netif_tx_queue_stopped(txq))) {
+ 
+-		__netif_tx_lock(txq, smp_processor_id());
++		__netif_tx_lock(txq);
+ 
+ 		/* Need to make the tx_bd_cons update visible to start_xmit()
+ 		 * before checking for netif_tx_queue_stopped().  Without the
+Index: linux-rt-2.6.31/drivers/net/chelsio/sge.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/net/chelsio/sge.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/net/chelsio/sge.c	2010-05-17 14:23:19.988474194 +0200
+@@ -1671,8 +1671,7 @@
+ 	struct cmdQ *q = &sge->cmdQ[qid];
+ 	unsigned int credits, pidx, genbit, count, use_sched_skb = 0;
+ 
+-	if (!spin_trylock(&q->lock))
+-		return NETDEV_TX_LOCKED;
++	spin_lock(&q->lock);
+ 
+ 	reclaim_completed_tx(sge, q);
+ 
+Index: linux-rt-2.6.31/drivers/net/hamradio/6pack.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/net/hamradio/6pack.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/net/hamradio/6pack.c	2010-05-17 14:23:19.988474194 +0200
+@@ -120,7 +120,7 @@
+ 	struct timer_list	tx_t;
+ 	struct timer_list	resync_t;
+ 	atomic_t		refcnt;
+-	struct semaphore	dead_sem;
++	struct anon_semaphore	dead_sem;
+ 	spinlock_t		lock;
+ };
+ 
+@@ -412,7 +412,7 @@
+ static void sp_put(struct sixpack *sp)
+ {
+ 	if (atomic_dec_and_test(&sp->refcnt))
+-		up(&sp->dead_sem);
++		anon_up(&sp->dead_sem);
+ }
+ 
+ /*
+@@ -606,7 +606,7 @@
+ 
+ 	spin_lock_init(&sp->lock);
+ 	atomic_set(&sp->refcnt, 1);
+-	init_MUTEX_LOCKED(&sp->dead_sem);
++	anon_semaphore_init_locked(&sp->dead_sem);
+ 
+ 	/* !!! length of the buffers. MTU is IP MTU, not PACLEN!  */
+ 
+@@ -702,7 +702,7 @@
+ 	 * we have to wait for all existing users to finish.
+ 	 */
+ 	if (!atomic_dec_and_test(&sp->refcnt))
+-		down(&sp->dead_sem);
++		anon_down(&sp->dead_sem);
+ 
+ 	unregister_netdev(sp->dev);
+ 
+Index: linux-rt-2.6.31/drivers/net/hamradio/mkiss.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/net/hamradio/mkiss.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/net/hamradio/mkiss.c	2010-05-17 14:23:19.988474194 +0200
+@@ -82,7 +82,7 @@
+ #define CRC_MODE_SMACK_TEST	4
+ 
+ 	atomic_t		refcnt;
+-	struct semaphore	dead_sem;
++	struct anon_semaphore	dead_sem;
+ };
+ 
+ /*---------------------------------------------------------------------------*/
+@@ -718,7 +718,7 @@
+ static void mkiss_put(struct mkiss *ax)
+ {
+ 	if (atomic_dec_and_test(&ax->refcnt))
+-		up(&ax->dead_sem);
++		anon_up(&ax->dead_sem);
+ }
+ 
+ static int crc_force = 0;	/* Can be overridden with insmod */
+@@ -745,7 +745,7 @@
+ 
+ 	spin_lock_init(&ax->buflock);
+ 	atomic_set(&ax->refcnt, 1);
+-	init_MUTEX_LOCKED(&ax->dead_sem);
++	anon_semaphore_init_locked(&ax->dead_sem);
+ 
+ 	ax->tty = tty;
+ 	tty->disc_data = ax;
+@@ -824,7 +824,7 @@
+ 	 * we have to wait for all existing users to finish.
+ 	 */
+ 	if (!atomic_dec_and_test(&ax->refcnt))
+-		down(&ax->dead_sem);
++		anon_down(&ax->dead_sem);
+ 
+ 	unregister_netdev(ax->dev);
+ 
+Index: linux-rt-2.6.31/drivers/net/irda/sir_dev.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/net/irda/sir_dev.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/net/irda/sir_dev.c	2010-05-17 14:23:19.988474194 +0200
+@@ -908,7 +908,7 @@
+ 	dev->tx_skb = NULL;
+ 
+ 	spin_lock_init(&dev->tx_lock);
+-	init_MUTEX(&dev->fsm.sem);
++	semaphore_init(&dev->fsm.sem);
+ 
+ 	dev->drv = drv;
+ 	dev->netdev = ndev;
+Index: linux-rt-2.6.31/drivers/net/ixp2000/enp2611.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/net/ixp2000/enp2611.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/net/ixp2000/enp2611.c	2010-05-17 14:23:19.988474194 +0200
+@@ -119,24 +119,9 @@
+ 	}
+ };
+ 
+-struct enp2611_ixpdev_priv
+-{
+-	struct ixpdev_priv		ixpdev_priv;
+-	struct net_device_stats		stats;
+-};
+-
+ static struct net_device *nds[3];
+ static struct timer_list link_check_timer;
+ 
+-static struct net_device_stats *enp2611_get_stats(struct net_device *dev)
+-{
+-	struct enp2611_ixpdev_priv *ip = netdev_priv(dev);
+-
+-	pm3386_get_stats(ip->ixpdev_priv.channel, &(ip->stats));
+-
+-	return &(ip->stats);
+-}
+-
+ /* @@@ Poll the SFP moddef0 line too.  */
+ /* @@@ Try to use the pm3386 DOOL interrupt as well.  */
+ static void enp2611_check_link_status(unsigned long __dummy)
+@@ -203,14 +188,13 @@
+ 
+ 	ports = pm3386_port_count();
+ 	for (i = 0; i < ports; i++) {
+-		nds[i] = ixpdev_alloc(i, sizeof(struct enp2611_ixpdev_priv));
++		nds[i] = ixpdev_alloc(i, sizeof(struct ixpdev_priv));
+ 		if (nds[i] == NULL) {
+ 			while (--i >= 0)
+ 				free_netdev(nds[i]);
+ 			return -ENOMEM;
+ 		}
+ 
+-		nds[i]->get_stats = enp2611_get_stats;
+ 		pm3386_init_port(i);
+ 		pm3386_get_mac(i, nds[i]->dev_addr);
+ 	}
+Index: linux-rt-2.6.31/drivers/net/ixp2000/ixpdev.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/net/ixp2000/ixpdev.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/net/ixp2000/ixpdev.c	2010-05-17 14:23:19.988474194 +0200
+@@ -21,6 +21,7 @@
+ #include "ixp2400_tx.ucode"
+ #include "ixpdev_priv.h"
+ #include "ixpdev.h"
++#include "pm3386.h"
+ 
+ #define DRV_MODULE_VERSION	"0.2"
+ 
+@@ -271,6 +272,15 @@
+ 	return 0;
+ }
+ 
++static struct net_device_stats *ixpdev_get_stats(struct net_device *dev)
++{
++	struct ixpdev_priv *ip = netdev_priv(dev);
++
++	pm3386_get_stats(ip->channel, &(dev->stats));
++
++	return &(dev->stats);
++}
++
+ static const struct net_device_ops ixpdev_netdev_ops = {
+ 	.ndo_open		= ixpdev_open,
+ 	.ndo_stop		= ixpdev_close,
+@@ -278,6 +288,7 @@
+ 	.ndo_change_mtu		= eth_change_mtu,
+ 	.ndo_validate_addr	= eth_validate_addr,
+ 	.ndo_set_mac_address	= eth_mac_addr,
++	.ndo_get_stats		= ixpdev_get_stats,
+ #ifdef CONFIG_NET_POLL_CONTROLLER
+ 	.ndo_poll_controller	= ixpdev_poll_controller,
+ #endif
+Index: linux-rt-2.6.31/drivers/net/loopback.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/net/loopback.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/net/loopback.c	2010-05-17 14:23:19.988474194 +0200
+@@ -65,6 +65,14 @@
+ 	unsigned long drops;
+ };
+ 
++#ifdef CONFIG_PREEMPT_RT
++# define xmit_get_cpu()		get_cpu()
++# define xmit_put_cpu()		put_cpu()
++#else
++# define xmit_get_cpu()		smp_processor_id()
++# define xmit_put_cpu()		do { } while (0)
++#endif
++
+ /*
+  * The higher levels take care of making this non-reentrant (it's
+  * called with bh's disabled).
+@@ -72,22 +80,23 @@
+ static int loopback_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ 	struct pcpu_lstats *pcpu_lstats, *lb_stats;
+-	int len;
++	int len, res;
+ 
+ 	skb_orphan(skb);
+ 
+ 	skb->protocol = eth_type_trans(skb, dev);
++	len = skb->len;
++	res = netif_rx_ni(skb);
+ 
+-	/* it's OK to use per_cpu_ptr() because BHs are off */
+ 	pcpu_lstats = dev->ml_priv;
+-	lb_stats = per_cpu_ptr(pcpu_lstats, smp_processor_id());
++	lb_stats = per_cpu_ptr(pcpu_lstats, xmit_get_cpu());
+ 
+-	len = skb->len;
+-	if (likely(netif_rx(skb) == NET_RX_SUCCESS)) {
++	if (likely(res == NET_RX_SUCCESS)) {
+ 		lb_stats->bytes += len;
+ 		lb_stats->packets++;
+ 	} else
+ 		lb_stats->drops++;
++	xmit_put_cpu();
+ 
+ 	return 0;
+ }
+Index: linux-rt-2.6.31/drivers/net/mlx4/mlx4.h
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/net/mlx4/mlx4.h	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/drivers/net/mlx4/mlx4.h	2010-05-17 14:23:19.988474194 +0200
+@@ -40,6 +40,7 @@
+ #include <linux/mutex.h>
+ #include <linux/radix-tree.h>
+ #include <linux/timer.h>
++#include <linux/semaphore.h>
+ #include <linux/workqueue.h>
+ 
+ #include <linux/mlx4/device.h>
+Index: linux-rt-2.6.31/drivers/net/mv643xx_eth.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/net/mv643xx_eth.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/net/mv643xx_eth.c	2010-05-17 14:23:19.988474194 +0200
+@@ -508,7 +508,7 @@
+ 	struct netdev_queue *nq = netdev_get_tx_queue(mp->dev, txq->index);
+ 
+ 	if (netif_tx_queue_stopped(nq)) {
+-		__netif_tx_lock(nq, smp_processor_id());
++		__netif_tx_lock(nq);
+ 		if (txq->tx_ring_size - txq->tx_desc_count >= MAX_SKB_FRAGS + 1)
+ 			netif_tx_wake_queue(nq);
+ 		__netif_tx_unlock(nq);
+@@ -899,7 +899,7 @@
+ 	u32 hw_desc_ptr;
+ 	u32 expected_ptr;
+ 
+-	__netif_tx_lock(nq, smp_processor_id());
++	__netif_tx_lock(nq);
+ 
+ 	if (rdlp(mp, TXQ_COMMAND) & (1 << txq->index))
+ 		goto out;
+@@ -923,7 +923,7 @@
+ 	struct netdev_queue *nq = netdev_get_tx_queue(mp->dev, txq->index);
+ 	int reclaimed;
+ 
+-	__netif_tx_lock(nq, smp_processor_id());
++	__netif_tx_lock(nq);
+ 
+ 	reclaimed = 0;
+ 	while (reclaimed < budget && txq->tx_desc_count > 0) {
+Index: linux-rt-2.6.31/drivers/net/netxen/netxen_nic_init.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/net/netxen/netxen_nic_init.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/net/netxen/netxen_nic_init.c	2010-05-17 14:23:19.988474194 +0200
+@@ -1401,7 +1401,7 @@
+ 		smp_mb();
+ 
+ 		if (netif_queue_stopped(netdev) && netif_carrier_ok(netdev)) {
+-			__netif_tx_lock(tx_ring->txq, smp_processor_id());
++			__netif_tx_lock(tx_ring->txq);
+ 			if (netxen_tx_avail(tx_ring) > TX_STOP_THRESH)
+ 				netif_wake_queue(netdev);
+ 			__netif_tx_unlock(tx_ring->txq);
+Index: linux-rt-2.6.31/drivers/net/niu.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/net/niu.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/net/niu.c	2010-05-17 14:23:19.998449693 +0200
+@@ -3681,7 +3681,7 @@
+ out:
+ 	if (unlikely(netif_tx_queue_stopped(txq) &&
+ 		     (niu_tx_avail(rp) > NIU_TX_WAKEUP_THRESH(rp)))) {
+-		__netif_tx_lock(txq, smp_processor_id());
++		__netif_tx_lock(txq);
+ 		if (netif_tx_queue_stopped(txq) &&
+ 		    (niu_tx_avail(rp) > NIU_TX_WAKEUP_THRESH(rp)))
+ 			netif_tx_wake_queue(txq);
+Index: linux-rt-2.6.31/drivers/net/ppp_async.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/net/ppp_async.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/net/ppp_async.c	2010-05-17 14:23:19.998449693 +0200
+@@ -67,7 +67,7 @@
+ 	struct tasklet_struct tsk;
+ 
+ 	atomic_t	refcnt;
+-	struct semaphore dead_sem;
++	struct anon_semaphore dead_sem;
+ 	struct ppp_channel chan;	/* interface to generic ppp layer */
+ 	unsigned char	obuf[OBUFSIZE];
+ };
+@@ -145,7 +145,7 @@
+ static void ap_put(struct asyncppp *ap)
+ {
+ 	if (atomic_dec_and_test(&ap->refcnt))
+-		up(&ap->dead_sem);
++		anon_up(&ap->dead_sem);
+ }
+ 
+ /*
+@@ -183,7 +183,7 @@
+ 	tasklet_init(&ap->tsk, ppp_async_process, (unsigned long) ap);
+ 
+ 	atomic_set(&ap->refcnt, 1);
+-	init_MUTEX_LOCKED(&ap->dead_sem);
++	anon_semaphore_init_locked(&ap->dead_sem);
+ 
+ 	ap->chan.private = ap;
+ 	ap->chan.ops = &async_ops;
+@@ -232,7 +232,7 @@
+ 	 * by the time it returns.
+ 	 */
+ 	if (!atomic_dec_and_test(&ap->refcnt))
+-		down(&ap->dead_sem);
++		anon_down(&ap->dead_sem);
+ 	tasklet_kill(&ap->tsk);
+ 
+ 	ppp_unregister_channel(&ap->chan);
+Index: linux-rt-2.6.31/drivers/net/rionet.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/net/rionet.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/net/rionet.c	2010-05-17 14:23:19.998449693 +0200
+@@ -180,11 +180,7 @@
+ 	u16 destid;
+ 	unsigned long flags;
+ 
+-	local_irq_save(flags);
+-	if (!spin_trylock(&rnet->tx_lock)) {
+-		local_irq_restore(flags);
+-		return NETDEV_TX_LOCKED;
+-	}
++	spin_lock_irqsave(&rnet->tx_lock, flags);
+ 
+ 	if ((rnet->tx_cnt + 1) > RIONET_TX_RING_SIZE) {
+ 		netif_stop_queue(ndev);
+Index: linux-rt-2.6.31/drivers/net/s2io.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/net/s2io.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/net/s2io.c	2010-05-17 14:23:19.998449693 +0200
+@@ -4161,12 +4161,7 @@
+ 					[skb->priority & (MAX_TX_FIFOS - 1)];
+ 	fifo = &mac_control->fifos[queue];
+ 
+-	if (do_spin_lock)
+-		spin_lock_irqsave(&fifo->tx_lock, flags);
+-	else {
+-		if (unlikely(!spin_trylock_irqsave(&fifo->tx_lock, flags)))
+-			return NETDEV_TX_LOCKED;
+-	}
++	spin_lock_irqsave(&fifo->tx_lock, flags);
+ 
+ 	if (sp->config.multiq) {
+ 		if (__netif_subqueue_stopped(dev, fifo->fifo_no)) {
+Index: linux-rt-2.6.31/drivers/net/sungem.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/net/sungem.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/net/sungem.c	2010-05-17 14:23:19.998449693 +0200
+@@ -1032,12 +1032,8 @@
+ 			(csum_stuff_off << 21));
+ 	}
+ 
+-	local_irq_save(flags);
+-	if (!spin_trylock(&gp->tx_lock)) {
+-		/* Tell upper layer to requeue */
+-		local_irq_restore(flags);
+-		return NETDEV_TX_LOCKED;
+-	}
++	spin_lock_irqsave(&gp->tx_lock, flags);
++
+ 	/* We raced with gem_do_stop() */
+ 	if (!gp->running) {
+ 		spin_unlock_irqrestore(&gp->tx_lock, flags);
+Index: linux-rt-2.6.31/drivers/net/tehuti.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/net/tehuti.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/net/tehuti.c	2010-05-17 14:23:19.998449693 +0200
+@@ -1638,13 +1638,8 @@
+ 	unsigned long flags;
+ 
+ 	ENTER;
+-	local_irq_save(flags);
+-	if (!spin_trylock(&priv->tx_lock)) {
+-		local_irq_restore(flags);
+-		DBG("%s[%s]: TX locked, returning NETDEV_TX_LOCKED\n",
+-		    BDX_DRV_NAME, ndev->name);
+-		return NETDEV_TX_LOCKED;
+-	}
++
++	spin_lock_irqsave(&priv->tx_lock, flags);
+ 
+ 	/* build tx descriptor */
+ 	BDX_ASSERT(f->m.wptr >= f->m.memsz);	/* started with valid wptr */
+Index: linux-rt-2.6.31/drivers/net/tulip/tulip_core.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/net/tulip/tulip_core.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/drivers/net/tulip/tulip_core.c	2010-05-17 14:23:19.998449693 +0200
+@@ -1826,6 +1826,7 @@
+ 	pci_iounmap(pdev, tp->base_addr);
+ 	free_netdev (dev);
+ 	pci_release_regions (pdev);
++	pci_disable_device (pdev);
+ 	pci_set_drvdata (pdev, NULL);
+ 
+ 	/* pci_power_off (pdev, -1); */
+Index: linux-rt-2.6.31/drivers/net/wan/cosa.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/net/wan/cosa.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/net/wan/cosa.c	2010-05-17 14:23:19.998449693 +0200
+@@ -574,7 +574,7 @@
+ 
+ 		/* Initialize the chardev data structures */
+ 		mutex_init(&chan->rlock);
+-		init_MUTEX(&chan->wsem);
++		semaphore_init(&chan->wsem);
+ 
+ 		/* Register the network interface */
+ 		if (!(chan->netdev = alloc_hdlcdev(chan))) {
+Index: linux-rt-2.6.31/drivers/of/base.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/of/base.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/of/base.c	2010-05-17 14:23:19.998449693 +0200
+@@ -25,7 +25,7 @@
+ /* use when traversing tree through the allnext, child, sibling,
+  * or parent members of struct device_node.
+  */
+-DEFINE_RWLOCK(devtree_lock);
++DEFINE_ATOMIC_SPINLOCK(devtree_lock);
+ 
+ int of_n_addr_cells(struct device_node *np)
+ {
+@@ -59,16 +59,14 @@
+ }
+ EXPORT_SYMBOL(of_n_size_cells);
+ 
+-struct property *of_find_property(const struct device_node *np,
+-				  const char *name,
+-				  int *lenp)
++static struct property *__of_find_property(const struct device_node *np,
++					   const char *name, int *lenp)
+ {
+ 	struct property *pp;
+ 
+ 	if (!np)
+ 		return NULL;
+ 
+-	read_lock(&devtree_lock);
+ 	for (pp = np->properties; pp != 0; pp = pp->next) {
+ 		if (of_prop_cmp(pp->name, name) == 0) {
+ 			if (lenp != 0)
+@@ -76,7 +74,20 @@
+ 			break;
+ 		}
+ 	}
+-	read_unlock(&devtree_lock);
++
++	return pp;
++}
++
++struct property *of_find_property(const struct device_node *np,
++				  const char *name,
++				  int *lenp)
++{
++	struct property *pp;
++	unsigned long flags;
++
++	atomic_spin_lock_irqsave(&devtree_lock, flags);
++	pp = __of_find_property(np, name, lenp);
++	atomic_spin_unlock_irqrestore(&devtree_lock, flags);
+ 
+ 	return pp;
+ }
+@@ -86,8 +97,20 @@
+  * Find a property with a given name for a given node
+  * and return the value.
+  */
++static const void *__of_get_property(const struct device_node *np,
++				     const char *name, int *lenp)
++{
++	struct property *pp = __of_find_property(np, name, lenp);
++
++	return pp ? pp->value : NULL;
++}
++
++/*
++ * Find a property with a given name for a given node
++ * and return the value.
++ */
+ const void *of_get_property(const struct device_node *np, const char *name,
+-			 int *lenp)
++			    int *lenp)
+ {
+ 	struct property *pp = of_find_property(np, name, lenp);
+ 
+@@ -98,13 +121,13 @@
+ /** Checks if the given "compat" string matches one of the strings in
+  * the device's "compatible" property
+  */
+-int of_device_is_compatible(const struct device_node *device,
+-		const char *compat)
++static int __of_device_is_compatible(const struct device_node *device,
++				     const char *compat)
+ {
+ 	const char* cp;
+-	int cplen, l;
++	int uninitialized_var(cplen), l;
+ 
+-	cp = of_get_property(device, "compatible", &cplen);
++	cp = __of_get_property(device, "compatible", &cplen);
+ 	if (cp == NULL)
+ 		return 0;
+ 	while (cplen > 0) {
+@@ -117,6 +140,21 @@
+ 
+ 	return 0;
+ }
++
++/** Checks if the given "compat" string matches one of the strings in
++ * the device's "compatible" property
++ */
++int of_device_is_compatible(const struct device_node *device,
++		const char *compat)
++{
++	unsigned long flags;
++	int res;
++
++	atomic_spin_lock_irqsave(&devtree_lock, flags);
++	res = __of_device_is_compatible(device, compat);
++	atomic_spin_unlock_irqrestore(&devtree_lock, flags);
++	return res;
++}
+ EXPORT_SYMBOL(of_device_is_compatible);
+ 
+ /**
+@@ -155,13 +193,14 @@
+ struct device_node *of_get_parent(const struct device_node *node)
+ {
+ 	struct device_node *np;
++	unsigned long flags;
+ 
+ 	if (!node)
+ 		return NULL;
+ 
+-	read_lock(&devtree_lock);
++	atomic_spin_lock_irqsave(&devtree_lock, flags);
+ 	np = of_node_get(node->parent);
+-	read_unlock(&devtree_lock);
++	atomic_spin_unlock_irqrestore(&devtree_lock, flags);
+ 	return np;
+ }
+ EXPORT_SYMBOL(of_get_parent);
+@@ -180,14 +219,15 @@
+ struct device_node *of_get_next_parent(struct device_node *node)
+ {
+ 	struct device_node *parent;
++	unsigned long flags;
+ 
+ 	if (!node)
+ 		return NULL;
+ 
+-	read_lock(&devtree_lock);
++	atomic_spin_lock_irqsave(&devtree_lock, flags);
+ 	parent = of_node_get(node->parent);
+ 	of_node_put(node);
+-	read_unlock(&devtree_lock);
++	atomic_spin_unlock_irqrestore(&devtree_lock, flags);
+ 	return parent;
+ }
+ 
+@@ -203,14 +243,15 @@
+ 	struct device_node *prev)
+ {
+ 	struct device_node *next;
++	unsigned long flags;
+ 
+-	read_lock(&devtree_lock);
++	atomic_spin_lock_irqsave(&devtree_lock, flags);
+ 	next = prev ? prev->sibling : node->child;
+ 	for (; next; next = next->sibling)
+ 		if (of_node_get(next))
+ 			break;
+ 	of_node_put(prev);
+-	read_unlock(&devtree_lock);
++	atomic_spin_unlock_irqrestore(&devtree_lock, flags);
+ 	return next;
+ }
+ EXPORT_SYMBOL(of_get_next_child);
+@@ -225,14 +266,15 @@
+ struct device_node *of_find_node_by_path(const char *path)
+ {
+ 	struct device_node *np = allnodes;
++	unsigned long flags;
+ 
+-	read_lock(&devtree_lock);
++	atomic_spin_lock_irqsave(&devtree_lock, flags);
+ 	for (; np; np = np->allnext) {
+ 		if (np->full_name && (of_node_cmp(np->full_name, path) == 0)
+ 		    && of_node_get(np))
+ 			break;
+ 	}
+-	read_unlock(&devtree_lock);
++	atomic_spin_unlock_irqrestore(&devtree_lock, flags);
+ 	return np;
+ }
+ EXPORT_SYMBOL(of_find_node_by_path);
+@@ -252,15 +294,16 @@
+ 	const char *name)
+ {
+ 	struct device_node *np;
++	unsigned long flags;
+ 
+-	read_lock(&devtree_lock);
++	atomic_spin_lock_irqsave(&devtree_lock, flags);
+ 	np = from ? from->allnext : allnodes;
+ 	for (; np; np = np->allnext)
+ 		if (np->name && (of_node_cmp(np->name, name) == 0)
+ 		    && of_node_get(np))
+ 			break;
+ 	of_node_put(from);
+-	read_unlock(&devtree_lock);
++	atomic_spin_unlock_irqrestore(&devtree_lock, flags);
+ 	return np;
+ }
+ EXPORT_SYMBOL(of_find_node_by_name);
+@@ -281,15 +324,16 @@
+ 	const char *type)
+ {
+ 	struct device_node *np;
++	unsigned long flags;
+ 
+-	read_lock(&devtree_lock);
++	atomic_spin_lock_irqsave(&devtree_lock, flags);
+ 	np = from ? from->allnext : allnodes;
+ 	for (; np; np = np->allnext)
+ 		if (np->type && (of_node_cmp(np->type, type) == 0)
+ 		    && of_node_get(np))
+ 			break;
+ 	of_node_put(from);
+-	read_unlock(&devtree_lock);
++	atomic_spin_unlock_irqrestore(&devtree_lock, flags);
+ 	return np;
+ }
+ EXPORT_SYMBOL(of_find_node_by_type);
+@@ -312,18 +356,20 @@
+ 	const char *type, const char *compatible)
+ {
+ 	struct device_node *np;
++	unsigned long flags;
+ 
+-	read_lock(&devtree_lock);
++	atomic_spin_lock_irqsave(&devtree_lock, flags);
+ 	np = from ? from->allnext : allnodes;
+ 	for (; np; np = np->allnext) {
+ 		if (type
+ 		    && !(np->type && (of_node_cmp(np->type, type) == 0)))
+ 			continue;
+-		if (of_device_is_compatible(np, compatible) && of_node_get(np))
++		if (__of_device_is_compatible(np, compatible) &&
++		    of_node_get(np))
+ 			break;
+ 	}
+ 	of_node_put(from);
+-	read_unlock(&devtree_lock);
++	atomic_spin_unlock_irqrestore(&devtree_lock, flags);
+ 	return np;
+ }
+ EXPORT_SYMBOL(of_find_compatible_node);
+@@ -345,8 +391,9 @@
+ {
+ 	struct device_node *np;
+ 	struct property *pp;
++	unsigned long flags;
+ 
+-	read_lock(&devtree_lock);
++	atomic_spin_lock_irqsave(&devtree_lock, flags);
+ 	np = from ? from->allnext : allnodes;
+ 	for (; np; np = np->allnext) {
+ 		for (pp = np->properties; pp != 0; pp = pp->next) {
+@@ -358,20 +405,14 @@
+ 	}
+ out:
+ 	of_node_put(from);
+-	read_unlock(&devtree_lock);
++	atomic_spin_unlock_irqrestore(&devtree_lock, flags);
+ 	return np;
+ }
+ EXPORT_SYMBOL(of_find_node_with_property);
+ 
+-/**
+- * of_match_node - Tell if an device_node has a matching of_match structure
+- *	@matches:	array of of device match structures to search in
+- *	@node:		the of device structure to match against
+- *
+- *	Low level utility function used by device matching.
+- */
+-const struct of_device_id *of_match_node(const struct of_device_id *matches,
+-					 const struct device_node *node)
++static const struct of_device_id *
++__of_match_node(const struct of_device_id *matches,
++		const struct device_node *node)
+ {
+ 	while (matches->name[0] || matches->type[0] || matches->compatible[0]) {
+ 		int match = 1;
+@@ -382,14 +423,33 @@
+ 			match &= node->type
+ 				&& !strcmp(matches->type, node->type);
+ 		if (matches->compatible[0])
+-			match &= of_device_is_compatible(node,
+-						matches->compatible);
++			match &= __of_device_is_compatible(node,
++							   matches->compatible);
+ 		if (match)
+ 			return matches;
+ 		matches++;
+ 	}
+ 	return NULL;
+ }
++
++/**
++ * of_match_node - Tell if an device_node has a matching of_match structure
++ *	@matches:	array of of device match structures to search in
++ *	@node:		the of device structure to match against
++ *
++ *	Low level utility function used by device matching.
++ */
++const struct of_device_id *of_match_node(const struct of_device_id *matches,
++					 const struct device_node *node)
++{
++	const struct of_device_id *match;
++	unsigned long flags;
++
++	atomic_spin_lock_irqsave(&devtree_lock, flags);
++	match = __of_match_node(matches, node);
++	atomic_spin_unlock_irqrestore(&devtree_lock, flags);
++	return match;
++}
+ EXPORT_SYMBOL(of_match_node);
+ 
+ /**
+@@ -408,15 +468,16 @@
+ 					  const struct of_device_id *matches)
+ {
+ 	struct device_node *np;
++	unsigned long flags;
+ 
+-	read_lock(&devtree_lock);
++	atomic_spin_lock_irqsave(&devtree_lock, flags);
+ 	np = from ? from->allnext : allnodes;
+ 	for (; np; np = np->allnext) {
+-		if (of_match_node(matches, np) && of_node_get(np))
++		if (__of_match_node(matches, np) && of_node_get(np))
+ 			break;
+ 	}
+ 	of_node_put(from);
+-	read_unlock(&devtree_lock);
++	atomic_spin_unlock_irqrestore(&devtree_lock, flags);
+ 	return np;
+ }
+ EXPORT_SYMBOL(of_find_matching_node);
+Index: linux-rt-2.6.31/drivers/oprofile/event_buffer.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/oprofile/event_buffer.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/oprofile/event_buffer.c	2010-05-17 14:23:19.998449693 +0200
+@@ -72,10 +72,10 @@
+ 	int err = -ENOMEM;
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&oprofilefs_lock, flags);
++	atomic_spin_lock_irqsave(&oprofilefs_lock, flags);
+ 	buffer_size = oprofile_buffer_size;
+ 	buffer_watershed = oprofile_buffer_watershed;
+-	spin_unlock_irqrestore(&oprofilefs_lock, flags);
++	atomic_spin_unlock_irqrestore(&oprofilefs_lock, flags);
+ 
+ 	if (buffer_watershed >= buffer_size)
+ 		return -EINVAL;
+Index: linux-rt-2.6.31/drivers/oprofile/oprofilefs.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/oprofile/oprofilefs.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/oprofile/oprofilefs.c	2010-05-17 14:23:19.998449693 +0200
+@@ -21,7 +21,7 @@
+ 
+ #define OPROFILEFS_MAGIC 0x6f70726f
+ 
+-DEFINE_SPINLOCK(oprofilefs_lock);
++DEFINE_ATOMIC_SPINLOCK(oprofilefs_lock);
+ 
+ static struct inode *oprofilefs_get_inode(struct super_block *sb, int mode)
+ {
+@@ -75,9 +75,9 @@
+ 	if (copy_from_user(tmpbuf, buf, count))
+ 		return -EFAULT;
+ 
+-	spin_lock_irqsave(&oprofilefs_lock, flags);
++	atomic_spin_lock_irqsave(&oprofilefs_lock, flags);
+ 	*val = simple_strtoul(tmpbuf, NULL, 0);
+-	spin_unlock_irqrestore(&oprofilefs_lock, flags);
++	atomic_spin_unlock_irqrestore(&oprofilefs_lock, flags);
+ 	return 0;
+ }
+ 
+Index: linux-rt-2.6.31/drivers/parport/ieee1284.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/parport/ieee1284.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/parport/ieee1284.c	2010-05-17 14:23:19.998449693 +0200
+@@ -41,7 +41,7 @@
+  * It will be useful to call this from an interrupt handler. */
+ static void parport_ieee1284_wakeup (struct parport *port)
+ {
+-	up (&port->physport->ieee1284.irq);
++	anon_up (&port->physport->ieee1284.irq);
+ }
+ 
+ static struct parport *port_from_cookie[PARPORT_MAX];
+@@ -83,7 +83,7 @@
+ 	timer.data = port->number;
+ 
+ 	add_timer (&timer);
+-	ret = down_interruptible (&port->physport->ieee1284.irq);
++	ret = anon_down_interruptible (&port->physport->ieee1284.irq);
+ 	if (!del_timer_sync(&timer) && !ret)
+ 		/* Timed out. */
+ 		ret = 1;
+Index: linux-rt-2.6.31/drivers/parport/share.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/parport/share.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/parport/share.c	2010-05-17 14:23:19.998449693 +0200
+@@ -306,7 +306,7 @@
+ 	spin_lock_init(&tmp->pardevice_lock);
+ 	tmp->ieee1284.mode = IEEE1284_MODE_COMPAT;
+ 	tmp->ieee1284.phase = IEEE1284_PH_FWD_IDLE;
+-	init_MUTEX_LOCKED (&tmp->ieee1284.irq); /* actually a semaphore at 0 */
++	anon_semaphore_init_locked(&tmp->ieee1284.irq);
+ 	tmp->spintime = parport_default_spintime;
+ 	atomic_set (&tmp->ref_count, 1);
+ 	INIT_LIST_HEAD(&tmp->full_list);
+Index: linux-rt-2.6.31/drivers/pci/access.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/pci/access.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/pci/access.c	2010-05-17 14:23:20.008385732 +0200
+@@ -12,7 +12,7 @@
+  * configuration space.
+  */
+ 
+-static DEFINE_SPINLOCK(pci_lock);
++static DEFINE_ATOMIC_SPINLOCK(pci_lock);
+ 
+ /*
+  *  Wrappers for all PCI configuration access functions.  They just check
+@@ -32,10 +32,10 @@
+ 	unsigned long flags;						\
+ 	u32 data = 0;							\
+ 	if (PCI_##size##_BAD) return PCIBIOS_BAD_REGISTER_NUMBER;	\
+-	spin_lock_irqsave(&pci_lock, flags);				\
++	atomic_spin_lock_irqsave(&pci_lock, flags);			\
+ 	res = bus->ops->read(bus, devfn, pos, len, &data);		\
+ 	*value = (type)data;						\
+-	spin_unlock_irqrestore(&pci_lock, flags);			\
++	atomic_spin_unlock_irqrestore(&pci_lock, flags);		\
+ 	return res;							\
+ }
+ 
+@@ -46,9 +46,9 @@
+ 	int res;							\
+ 	unsigned long flags;						\
+ 	if (PCI_##size##_BAD) return PCIBIOS_BAD_REGISTER_NUMBER;	\
+-	spin_lock_irqsave(&pci_lock, flags);				\
++	atomic_spin_lock_irqsave(&pci_lock, flags);			\
+ 	res = bus->ops->write(bus, devfn, pos, len, value);		\
+-	spin_unlock_irqrestore(&pci_lock, flags);			\
++	atomic_spin_unlock_irqrestore(&pci_lock, flags);		\
+ 	return res;							\
+ }
+ 
+@@ -78,10 +78,10 @@
+ 	struct pci_ops *old_ops;
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&pci_lock, flags);
++	atomic_spin_lock_irqsave(&pci_lock, flags);
+ 	old_ops = bus->ops;
+ 	bus->ops = ops;
+-	spin_unlock_irqrestore(&pci_lock, flags);
++	atomic_spin_unlock_irqrestore(&pci_lock, flags);
+ 	return old_ops;
+ }
+ EXPORT_SYMBOL(pci_bus_set_ops);
+@@ -135,9 +135,9 @@
+ 	__add_wait_queue(&pci_ucfg_wait, &wait);
+ 	do {
+ 		set_current_state(TASK_UNINTERRUPTIBLE);
+-		spin_unlock_irq(&pci_lock);
++		atomic_spin_unlock_irq(&pci_lock);
+ 		schedule();
+-		spin_lock_irq(&pci_lock);
++		atomic_spin_lock_irq(&pci_lock);
+ 	} while (dev->block_ucfg_access);
+ 	__remove_wait_queue(&pci_ucfg_wait, &wait);
+ }
+@@ -149,11 +149,11 @@
+ 	int ret = 0;							\
+ 	u32 data = -1;							\
+ 	if (PCI_##size##_BAD) return PCIBIOS_BAD_REGISTER_NUMBER;	\
+-	spin_lock_irq(&pci_lock);					\
++	atomic_spin_lock_irq(&pci_lock);				\
+ 	if (unlikely(dev->block_ucfg_access)) pci_wait_ucfg(dev);	\
+ 	ret = dev->bus->ops->read(dev->bus, dev->devfn,			\
+ 					pos, sizeof(type), &data);	\
+-	spin_unlock_irq(&pci_lock);					\
++	atomic_spin_unlock_irq(&pci_lock);				\
+ 	*val = (type)data;						\
+ 	return ret;							\
+ }
+@@ -164,11 +164,11 @@
+ {									\
+ 	int ret = -EIO;							\
+ 	if (PCI_##size##_BAD) return PCIBIOS_BAD_REGISTER_NUMBER;	\
+-	spin_lock_irq(&pci_lock);					\
++	atomic_spin_lock_irq(&pci_lock);				\
+ 	if (unlikely(dev->block_ucfg_access)) pci_wait_ucfg(dev);	\
+ 	ret = dev->bus->ops->write(dev->bus, dev->devfn,		\
+ 					pos, sizeof(type), val);	\
+-	spin_unlock_irq(&pci_lock);					\
++	atomic_spin_unlock_irq(&pci_lock);				\
+ 	return ret;							\
+ }
+ 
+@@ -395,10 +395,10 @@
+ 	unsigned long flags;
+ 	int was_blocked;
+ 
+-	spin_lock_irqsave(&pci_lock, flags);
++	atomic_spin_lock_irqsave(&pci_lock, flags);
+ 	was_blocked = dev->block_ucfg_access;
+ 	dev->block_ucfg_access = 1;
+-	spin_unlock_irqrestore(&pci_lock, flags);
++	atomic_spin_unlock_irqrestore(&pci_lock, flags);
+ 
+ 	/* If we BUG() inside the pci_lock, we're guaranteed to hose
+ 	 * the machine */
+@@ -416,7 +416,7 @@
+ {
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&pci_lock, flags);
++	atomic_spin_lock_irqsave(&pci_lock, flags);
+ 
+ 	/* This indicates a problem in the caller, but we don't need
+ 	 * to kill them, unlike a double-block above. */
+@@ -424,6 +424,6 @@
+ 
+ 	dev->block_ucfg_access = 0;
+ 	wake_up_all(&pci_ucfg_wait);
+-	spin_unlock_irqrestore(&pci_lock, flags);
++	atomic_spin_unlock_irqrestore(&pci_lock, flags);
+ }
+ EXPORT_SYMBOL_GPL(pci_unblock_user_cfg_access);
+Index: linux-rt-2.6.31/drivers/pci/bus.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/pci/bus.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/pci/bus.c	2010-05-17 14:23:20.008385732 +0200
+@@ -240,9 +240,9 @@
+ 			next = dev->bus_list.next;
+ 
+ 		/* Run device routines with the device locked */
+-		down(&dev->dev.sem);
++		mutex_lock(&dev->dev.mutex);
+ 		retval = cb(dev, userdata);
+-		up(&dev->dev.sem);
++		mutex_unlock(&dev->dev.mutex);
+ 		if (retval)
+ 			break;
+ 	}
+Index: linux-rt-2.6.31/drivers/pci/hotplug/ibmphp_hpc.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/pci/hotplug/ibmphp_hpc.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/pci/hotplug/ibmphp_hpc.c	2010-05-17 14:23:20.008385732 +0200
+@@ -104,7 +104,7 @@
+ static struct mutex sem_hpcaccess;	// lock access to HPC
+ static struct semaphore semOperations;	// lock all operations and
+ 					// access to data structures
+-static struct semaphore sem_exit;	// make sure polling thread goes away
++static struct anon_semaphore sem_exit;	// make sure polling thread goes away
+ static struct task_struct *ibmphp_poll_thread;
+ //----------------------------------------------------------------------------
+ // local function prototypes
+@@ -132,8 +132,8 @@
+ 	debug ("%s - Entry\n", __func__);
+ 
+ 	mutex_init(&sem_hpcaccess);
+-	init_MUTEX (&semOperations);
+-	init_MUTEX_LOCKED (&sem_exit);
++	semaphore_init(&semOperations);
++	anon_semaphore_init_locked(&sem_exit);
+ 	to_debug = 0;
+ 
+ 	debug ("%s - Exit\n", __func__);
+@@ -906,7 +906,7 @@
+ 		/* sleep for a short time just for good measure */
+ 		msleep(100);
+ 	}
+-	up (&sem_exit);
++	anon_up (&sem_exit);
+ 	debug ("%s - Exit\n", __func__);
+ 	return 0;
+ }
+@@ -1076,7 +1076,7 @@
+ 	
+ 	// wait for poll thread to exit
+ 	debug ("before sem_exit down \n");
+-	down (&sem_exit);
++	anon_down (&sem_exit);
+ 	debug ("after sem_exit down \n");
+ 
+ 	// cleanup
+@@ -1085,7 +1085,7 @@
+ 	debug ("after free_hpc_access \n");
+ 	ibmphp_unlock_operations ();
+ 	debug ("after unlock operations \n");
+-	up (&sem_exit);
++	anon_up (&sem_exit);
+ 	debug ("after sem exit up\n");
+ 
+ 	debug ("%s - Exit\n", __func__);
+Index: linux-rt-2.6.31/drivers/pci/pci.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/pci/pci.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/drivers/pci/pci.c	2010-05-17 14:23:20.008385732 +0200
+@@ -2213,7 +2213,7 @@
+ 	if (!probe) {
+ 		pci_block_user_cfg_access(dev);
+ 		/* block PM suspend, driver probe, etc. */
+-		down(&dev->dev.sem);
++		mutex_lock(&dev->dev.mutex);
+ 	}
+ 
+ 	rc = pcie_flr(dev, probe);
+@@ -2231,7 +2231,7 @@
+ 	rc = pci_parent_bus_reset(dev, probe);
+ done:
+ 	if (!probe) {
+-		up(&dev->dev.sem);
++		mutex_unlock(&dev->dev.mutex);
+ 		pci_unblock_user_cfg_access(dev);
+ 	}
+ 
+Index: linux-rt-2.6.31/drivers/pcmcia/ds.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/pcmcia/ds.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/pcmcia/ds.c	2010-05-17 14:23:20.008385732 +0200
+@@ -1082,9 +1082,9 @@
+ {
+ 	int rc;
+ 
+-	down(&dev->sem);
++	mutex_lock(&dev->mutex);
+ 	rc = pcmcia_dev_suspend(dev, PMSG_SUSPEND);
+-	up(&dev->sem);
++	mutex_unlock(&dev->mutex);
+ 	return rc;
+ }
+ 
+@@ -1092,9 +1092,9 @@
+ {
+ 	int rc;
+ 
+-	down(&dev->sem);
++	mutex_lock(&dev->mutex);
+ 	rc = pcmcia_dev_resume(dev);
+-	up(&dev->sem);
++	mutex_unlock(&dev->mutex);
+ }
+ 
+ /************************ per-device sysfs output ***************************/
+Index: linux-rt-2.6.31/drivers/s390/cio/crw.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/s390/cio/crw.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/s390/cio/crw.c	2010-05-17 14:23:20.008385732 +0200
+@@ -137,7 +137,7 @@
+  */
+ static int __init crw_init_semaphore(void)
+ {
+-	init_MUTEX_LOCKED(&crw_semaphore);
++	semaphore_init_locked(&crw_semaphore);
+ 	return 0;
+ }
+ pure_initcall(crw_init_semaphore);
+Index: linux-rt-2.6.31/drivers/scsi/aacraid/aacraid.h
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/scsi/aacraid/aacraid.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/scsi/aacraid/aacraid.h	2010-05-17 14:23:20.008385732 +0200
+@@ -719,7 +719,7 @@
+ 	u32			unique;		// unique value representing this context
+ 	ulong			jiffies;	// used for cleanup - dmb changed to ulong
+ 	struct list_head	next;		// used to link context's into a linked list
+-	struct semaphore	wait_sem;	// this is used to wait for the next fib to arrive.
++	struct anon_semaphore	wait_sem;	// this is used to wait for the next fib to arrive.
+ 	int			wait;		// Set to true when thread is in WaitForSingleObject
+ 	unsigned long		count;		// total number of FIBs on FibList
+ 	struct list_head	fib_list;	// this holds fibs and their attachd hw_fibs
+@@ -789,7 +789,7 @@
+ 	 *	This is the event the sendfib routine will wait on if the
+ 	 *	caller did not pass one and this is synch io.
+ 	 */
+-	struct semaphore	event_wait;
++	struct anon_semaphore	event_wait;
+ 	spinlock_t		event_lock;
+ 
+ 	u32			done;	/* gets set to 1 when fib is complete */
+Index: linux-rt-2.6.31/drivers/scsi/aacraid/commctrl.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/scsi/aacraid/commctrl.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/scsi/aacraid/commctrl.c	2010-05-17 14:23:20.008385732 +0200
+@@ -190,7 +190,7 @@
+ 		/*
+ 		 *	Initialize the mutex used to wait for the next AIF.
+ 		 */
+-		init_MUTEX_LOCKED(&fibctx->wait_sem);
++		anon_semaphore_init_locked(&fibctx->wait_sem);
+ 		fibctx->wait = 0;
+ 		/*
+ 		 *	Initialize the fibs and set the count of fibs on
+@@ -321,7 +321,7 @@
+ 			ssleep(1);
+ 		}
+ 		if (f.wait) {
+-			if(down_interruptible(&fibctx->wait_sem) < 0) {
++			if(anon_down_interruptible(&fibctx->wait_sem) < 0) {
+ 				status = -EINTR;
+ 			} else {
+ 				/* Lock again and retry */
+Index: linux-rt-2.6.31/drivers/scsi/aacraid/commsup.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/scsi/aacraid/commsup.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/scsi/aacraid/commsup.c	2010-05-17 14:23:20.008385732 +0200
+@@ -124,7 +124,7 @@
+ 		fibptr->hw_fib_va = hw_fib;
+ 		fibptr->data = (void *) fibptr->hw_fib_va->data;
+ 		fibptr->next = fibptr+1;	/* Forward chain the fibs */
+-		init_MUTEX_LOCKED(&fibptr->event_wait);
++		anon_semaphore_init_locked(&fibptr->event_wait);
+ 		spin_lock_init(&fibptr->event_lock);
+ 		hw_fib->header.XferState = cpu_to_le32(0xffffffff);
+ 		hw_fib->header.SenderSize = cpu_to_le16(dev->max_fib_size);
+@@ -490,7 +490,7 @@
+ 			 * hardware failure has occurred.
+ 			 */
+ 			unsigned long count = 36000000L; /* 3 minutes */
+-			while (down_trylock(&fibptr->event_wait)) {
++			while (anon_down_trylock(&fibptr->event_wait)) {
+ 				int blink;
+ 				if (--count == 0) {
+ 					struct aac_queue * q = &dev->queues->queue[AdapNormCmdQueue];
+@@ -515,9 +515,9 @@
+ 				}
+ 				udelay(5);
+ 			}
+-		} else if (down_interruptible(&fibptr->event_wait)) {
++		} else if (anon_down_interruptible(&fibptr->event_wait)) {
+ 			fibptr->done = 2;
+-			up(&fibptr->event_wait);
++			anon_up(&fibptr->event_wait);
+ 		}
+ 		spin_lock_irqsave(&fibptr->event_lock, flags);
+ 		if ((fibptr->done == 0) || (fibptr->done == 2)) {
+@@ -1177,7 +1177,7 @@
+ 		  (fib->hw_fib_va->header.XferState & cpu_to_le32(ResponseExpected))) {
+ 			unsigned long flagv;
+ 			spin_lock_irqsave(&fib->event_lock, flagv);
+-			up(&fib->event_wait);
++			anon_up(&fib->event_wait);
+ 			spin_unlock_irqrestore(&fib->event_lock, flagv);
+ 			schedule();
+ 			retval = 0;
+@@ -1460,7 +1460,7 @@
+ 			 * Set the event to wake up the
+ 			 * thread that will waiting.
+ 			 */
+-			up(&fibctx->wait_sem);
++			anon_up(&fibctx->wait_sem);
+ 		} else {
+ 			printk(KERN_WARNING "aifd: didn't allocate NewFib.\n");
+ 			kfree(fib);
+@@ -1691,7 +1691,7 @@
+ 						 * Set the event to wake up the
+ 						 * thread that is waiting.
+ 						 */
+-						up(&fibctx->wait_sem);
++						anon_up(&fibctx->wait_sem);
+ 					} else {
+ 						printk(KERN_WARNING "aifd: didn't allocate NewFib.\n");
+ 					}
+Index: linux-rt-2.6.31/drivers/scsi/aacraid/dpcsup.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/scsi/aacraid/dpcsup.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/scsi/aacraid/dpcsup.c	2010-05-17 14:23:20.008385732 +0200
+@@ -127,7 +127,7 @@
+ 			spin_lock_irqsave(&fib->event_lock, flagv);
+ 			if (!fib->done)
+ 				fib->done = 1;
+-			up(&fib->event_wait);
++			anon_up(&fib->event_wait);
+ 			spin_unlock_irqrestore(&fib->event_lock, flagv);
+ 			FIB_COUNTER_INCREMENT(aac_config.NormalRecved);
+ 			if (fib->done == 2) {
+@@ -322,7 +322,7 @@
+ 			spin_lock_irqsave(&fib->event_lock, flagv);
+ 			if (!fib->done)
+ 				fib->done = 1;
+-			up(&fib->event_wait);
++			anon_up(&fib->event_wait);
+ 			spin_unlock_irqrestore(&fib->event_lock, flagv);
+ 			FIB_COUNTER_INCREMENT(aac_config.NormalRecved);
+ 		}
+Index: linux-rt-2.6.31/drivers/serial/8250.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/serial/8250.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/drivers/serial/8250.c	2010-05-17 14:23:20.008385732 +0200
+@@ -1593,7 +1593,12 @@
+ 
+ 		l = l->next;
+ 
+-		if (l == i->head && pass_counter++ > PASS_LIMIT) {
++		/*
++		 * On preempt-rt we can be preempted and run in our
++		 * own thread.
++		 */
++		if (!preempt_rt() && l == i->head &&
++		    pass_counter++ > PASS_LIMIT) {
+ 			/* If we hit this, we're dead. */
+ 			printk(KERN_ERR "serial8250: too much work for "
+ 				"irq%d\n", irq);
+@@ -2727,14 +2732,10 @@
+ 
+ 	touch_nmi_watchdog();
+ 
+-	local_irq_save(flags);
+-	if (up->port.sysrq) {
+-		/* serial8250_handle_port() already took the lock */
+-		locked = 0;
+-	} else if (oops_in_progress) {
+-		locked = spin_trylock(&up->port.lock);
+-	} else
+-		spin_lock(&up->port.lock);
++	if (up->port.sysrq || oops_in_progress || preempt_rt())
++		locked = spin_trylock_irqsave(&up->port.lock, flags);
++	else
++		spin_lock_irqsave(&up->port.lock, flags);
+ 
+ 	/*
+ 	 *	First save the IER then disable the interrupts
+@@ -2766,8 +2767,7 @@
+ 		check_modem_status(up);
+ 
+ 	if (locked)
+-		spin_unlock(&up->port.lock);
+-	local_irq_restore(flags);
++		spin_unlock_irqrestore(&up->port.lock, flags);
+ }
+ 
+ static int __init serial8250_console_setup(struct console *co, char *options)
+Index: linux-rt-2.6.31/drivers/staging/comedi/drivers/dt9812.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/staging/comedi/drivers/dt9812.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/staging/comedi/drivers/dt9812.c	2010-05-17 14:23:20.008385732 +0200
+@@ -262,7 +262,7 @@
+ 
+ #define DT9812_NUM_SLOTS	16
+ 
+-static DECLARE_MUTEX(dt9812_mutex);
++static DEFINE_SEMAPHORE(dt9812_mutex);
+ 
+ static struct usb_device_id dt9812_table[] = {
+ 	{USB_DEVICE(0x0867, 0x9812)},
+@@ -1121,7 +1121,7 @@
+ 
+ 	/* Initialize all driver slots */
+ 	for (i = 0; i < DT9812_NUM_SLOTS; i++) {
+-		init_MUTEX(&dt9812[i].mutex);
++		semaphore_init(&dt9812[i].mutex);
+ 		dt9812[i].serial = 0;
+ 		dt9812[i].usb = NULL;
+ 		dt9812[i].comedi = NULL;
+Index: linux-rt-2.6.31/drivers/staging/comedi/drivers/usbdux.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/staging/comedi/drivers/usbdux.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/staging/comedi/drivers/usbdux.c	2010-05-17 14:23:20.008385732 +0200
+@@ -307,7 +307,7 @@
+  */
+ static struct usbduxsub usbduxsub[NUMUSBDUX];
+ 
+-static DECLARE_MUTEX(start_stop_sem);
++static DEFINE_SEMAPHORE(start_stop_sem);
+ 
+ /*
+  * Stops the data acquision
+@@ -2349,7 +2349,7 @@
+ 	dev_dbg(dev, "comedi_: usbdux: "
+ 		"usbduxsub[%d] is ready to connect to comedi.\n", index);
+ 
+-	init_MUTEX(&(usbduxsub[index].sem));
++	semaphore_init(&(usbduxsub[index].sem));
+ 	/* save a pointer to the usb device */
+ 	usbduxsub[index].usbdev = udev;
+ 
+Index: linux-rt-2.6.31/drivers/staging/comedi/drivers/usbduxfast.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/staging/comedi/drivers/usbduxfast.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/staging/comedi/drivers/usbduxfast.c	2010-05-17 14:23:20.008385732 +0200
+@@ -201,7 +201,7 @@
+  */
+ static struct usbduxfastsub_s usbduxfastsub[NUMUSBDUXFAST];
+ 
+-static DECLARE_MUTEX(start_stop_sem);
++static DEFINE_SEMAPHORE(start_stop_sem);
+ 
+ /*
+  * bulk transfers to usbduxfast
+@@ -1500,7 +1500,7 @@
+ 	       "connect to comedi.\n", index);
+ #endif
+ 
+-	init_MUTEX(&(usbduxfastsub[index].sem));
++	semaphore_init(&(usbduxfastsub[index].sem));
+ 	/* save a pointer to the usb device */
+ 	usbduxfastsub[index].usbdev = udev;
+ 
+Index: linux-rt-2.6.31/drivers/staging/cpc-usb/cpc-usb_drv.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/staging/cpc-usb/cpc-usb_drv.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/staging/cpc-usb/cpc-usb_drv.c	2010-05-17 14:23:20.008385732 +0200
+@@ -83,7 +83,7 @@
+ static unsigned int CPCUsbCnt;
+ 
+ /* prevent races between open() and disconnect() */
+-static DECLARE_MUTEX(disconnect_sem);
++static DEFINE_SEMAPHORE(disconnect_sem);
+ 
+ /* local function prototypes */
+ static ssize_t cpcusb_read(struct file *file, char *buffer, size_t count,
+@@ -903,7 +903,7 @@
+ 	memset(chan, 0, sizeof(CPC_CHAN_T));
+ 	ResetBuffer(chan);
+ 
+-	init_MUTEX(&card->sem);
++	semaphore_init(&card->sem);
+ 	spin_lock_init(&card->slock);
+ 
+ 	card->udev = udev;
+Index: linux-rt-2.6.31/drivers/staging/frontier/alphatrack.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/staging/frontier/alphatrack.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/staging/frontier/alphatrack.c	2010-05-17 14:23:20.008385732 +0200
+@@ -678,7 +678,7 @@
+ 		dev_err(&intf->dev, "Out of memory\n");
+ 		goto exit;
+ 	}
+-	init_MUTEX(&dev->sem);
++	semaphore_init(&dev->sem);
+ 	dev->intf = intf;
+ 	init_waitqueue_head(&dev->read_wait);
+ 	init_waitqueue_head(&dev->write_wait);
+Index: linux-rt-2.6.31/drivers/staging/frontier/tranzport.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/staging/frontier/tranzport.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/staging/frontier/tranzport.c	2010-05-17 14:23:20.008385732 +0200
+@@ -800,7 +800,7 @@
+ 		dev_err(&intf->dev, "Out of memory\n");
+ 		goto exit;
+ 	}
+-	init_MUTEX(&dev->sem);
++	semaphore_init(&dev->sem);
+ 	dev->intf = intf;
+ 	init_waitqueue_head(&dev->read_wait);
+ 	init_waitqueue_head(&dev->write_wait);
+Index: linux-rt-2.6.31/drivers/staging/go7007/go7007-driver.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/staging/go7007/go7007-driver.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/staging/go7007/go7007-driver.c	2010-05-17 14:23:20.008385732 +0200
+@@ -604,7 +604,7 @@
+ 	go->tuner_type = -1;
+ 	go->channel_number = 0;
+ 	go->name[0] = 0;
+-	init_MUTEX(&go->hw_lock);
++	semaphore_init(&go->hw_lock);
+ 	init_waitqueue_head(&go->frame_waitq);
+ 	spin_lock_init(&go->spinlock);
+ 	go->video_dev = NULL;
+Index: linux-rt-2.6.31/drivers/staging/go7007/go7007-i2c.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/staging/go7007/go7007-i2c.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/staging/go7007/go7007-i2c.c	2010-05-17 14:23:20.008385732 +0200
+@@ -48,7 +48,7 @@
+ 
+ /* There is only one I2C port on the TW2804 that feeds all four GO7007 VIPs
+  * on the Adlink PCI-MPG24, so access is shared between all of them. */
+-static DECLARE_MUTEX(adlink_mpg24_i2c_lock);
++static DEFINE_SEMAPHORE(adlink_mpg24_i2c_lock);
+ 
+ static int go7007_i2c_xfer(struct go7007 *go, u16 addr, int read,
+ 		u16 command, int flags, u8 *data)
+Index: linux-rt-2.6.31/drivers/staging/go7007/go7007-usb.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/staging/go7007/go7007-usb.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/staging/go7007/go7007-usb.c	2010-05-17 14:23:20.008385732 +0200
+@@ -1065,7 +1065,7 @@
+ 	if (board->flags & GO7007_USB_EZUSB_I2C) {
+ 		memcpy(&go->i2c_adapter, &go7007_usb_adap_templ,
+ 				sizeof(go7007_usb_adap_templ));
+-		init_MUTEX(&usb->i2c_lock);
++		semaphore_init(&usb->i2c_lock);
+ 		go->i2c_adapter.dev.parent = go->dev;
+ 		i2c_set_adapdata(&go->i2c_adapter, go);
+ 		if (i2c_add_adapter(&go->i2c_adapter) < 0) {
+Index: linux-rt-2.6.31/drivers/staging/go7007/go7007-v4l2.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/staging/go7007/go7007-v4l2.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/staging/go7007/go7007-v4l2.c	2010-05-17 14:23:20.008385732 +0200
+@@ -101,7 +101,7 @@
+ 		return -ENOMEM;
+ 	++go->ref_count;
+ 	gofh->go = go;
+-	init_MUTEX(&gofh->lock);
++	semaphore_init(&gofh->lock);
+ 	gofh->buf_count = 0;
+ 	file->private_data = gofh;
+ 	return 0;
+Index: linux-rt-2.6.31/drivers/staging/go7007/s2250-loader.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/staging/go7007/s2250-loader.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/staging/go7007/s2250-loader.c	2010-05-17 14:23:20.008385732 +0200
+@@ -35,7 +35,7 @@
+ #define MAX_DEVICES 256
+ 
+ static pdevice_extension_t s2250_dev_table[MAX_DEVICES];
+-static DECLARE_MUTEX(s2250_dev_table_mutex);
++static DEFINE_SEMAPHORE(s2250_dev_table_mutex);
+ 
+ #define to_s2250loader_dev_common(d) container_of(d, device_extension_t, kref)
+ static void s2250loader_delete(struct kref *kref)
+Index: linux-rt-2.6.31/drivers/staging/mimio/mimio.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/staging/mimio/mimio.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/staging/mimio/mimio.c	2010-05-17 14:23:20.008385732 +0200
+@@ -160,7 +160,7 @@
+ 	.id_table = mimio_table,
+ };
+ 
+-static DECLARE_MUTEX(disconnect_sem);
++static DEFINE_SEMAPHORE(disconnect_sem);
+ 
+ static void mimio_close(struct input_dev *idev)
+ {
+Index: linux-rt-2.6.31/drivers/staging/octeon/ethernet-mdio.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/staging/octeon/ethernet-mdio.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/staging/octeon/ethernet-mdio.c	2010-05-17 14:23:20.018521377 +0200
+@@ -39,7 +39,7 @@
+ 
+ #include "cvmx-smix-defs.h"
+ 
+-DECLARE_MUTEX(mdio_sem);
++DEFINE_SEMAPHORE(mdio_sem);
+ 
+ /**
+  * Perform an MII read. Called by the generic MII routines
+Index: linux-rt-2.6.31/drivers/staging/otus/wwrap.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/staging/otus/wwrap.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/staging/otus/wwrap.c	2010-05-17 14:23:20.018521377 +0200
+@@ -1066,7 +1066,7 @@
+ 
+     /* Create Mutex and keventd */
+     INIT_WORK(&macp->kevent, kevent);
+-    init_MUTEX(&macp->ioctl_sem);
++    semaphore_init(&macp->ioctl_sem);
+ 
+     return 0;
+ }
+Index: linux-rt-2.6.31/drivers/staging/p9auth/p9auth.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/staging/p9auth/p9auth.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/staging/p9auth/p9auth.c	2010-05-17 14:23:20.018521377 +0200
+@@ -388,7 +388,7 @@
+ 	/* Initialize each device. */
+ 	for (i = 0; i < cap_nr_devs; i++) {
+ 		cap_devices[i].node_size = cap_node_size;
+-		init_MUTEX(&cap_devices[i].sem);
++		semaphore_init(&cap_devices[i].sem);
+ 		cap_setup_cdev(&cap_devices[i], i);
+ 	}
+ 
+Index: linux-rt-2.6.31/drivers/staging/rspiusb/rspiusb.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/staging/rspiusb/rspiusb.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/staging/rspiusb/rspiusb.c	2010-05-17 14:23:20.018521377 +0200
+@@ -63,7 +63,7 @@
+ #endif
+ 
+ /* prevent races between open() and disconnect() */
+-static DECLARE_MUTEX(disconnect_sem);
++static DEFINE_SEMAPHORE(disconnect_sem);
+ 
+ /* Structure to hold all of our device specific stuff */
+ struct device_extension {
+Index: linux-rt-2.6.31/drivers/staging/rt2870/common/2870_rtmp_init.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/staging/rt2870/common/2870_rtmp_init.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/staging/rt2870/common/2870_rtmp_init.c	2010-05-17 14:23:20.018521377 +0200
+@@ -751,13 +751,13 @@
+ 
+ 	//init_MUTEX(&(pAd->usbdev_semaphore));
+ 
+-	init_MUTEX_LOCKED(&(pAd->mlme_semaphore));
++	semaphore_init_locked(&(pAd->mlme_semaphore));
+ 	init_completion (&pAd->mlmeComplete);
+ 
+-	init_MUTEX_LOCKED(&(pAd->RTUSBCmd_semaphore));
++	semaphore_init_locked(&(pAd->RTUSBCmd_semaphore));
+ 	init_completion (&pAd->CmdQComplete);
+ 
+-	init_MUTEX_LOCKED(&(pAd->RTUSBTimer_semaphore));
++	semaphore_init_locked(&(pAd->RTUSBTimer_semaphore));
+ 	init_completion (&pAd->TimerQComplete);
+ 
+ 	// Creat MLME Thread
+Index: linux-rt-2.6.31/drivers/usb/core/devio.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/usb/core/devio.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/usb/core/devio.c	2010-05-17 14:23:20.018521377 +0200
+@@ -330,8 +330,9 @@
+ 	uid_t euid = 0;
+ 	u32 secid = 0;
+ 	int signr;
++	unsigned long flags;
+ 
+-	spin_lock(&ps->lock);
++	spin_lock_irqsave(&ps->lock, flags);
+ 	list_move_tail(&as->asynclist, &ps->async_completed);
+ 	as->status = urb->status;
+ 	signr = as->signr;
+@@ -347,7 +348,7 @@
+ 	}
+ 	snoop(&urb->dev->dev, "urb complete\n");
+ 	snoop_urb(urb, as->userurb);
+-	spin_unlock(&ps->lock);
++	spin_unlock_irqrestore(&ps->lock, flags);
+ 
+ 	if (signr)
+ 		kill_pid_info_as_uid(sinfo.si_signo, &sinfo, pid, uid,
+Index: linux-rt-2.6.31/drivers/usb/core/driver.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/usb/core/driver.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/drivers/usb/core/driver.c	2010-05-17 14:23:20.018521377 +0200
+@@ -391,10 +391,10 @@
+ 	if (device_is_registered(dev)) {
+ 		device_release_driver(dev);
+ 	} else {
+-		down(&dev->sem);
++		mutex_lock(&dev->mutex);
+ 		usb_unbind_interface(dev);
+ 		dev->driver = NULL;
+-		up(&dev->sem);
++		mutex_unlock(&dev->mutex);
+ 	}
+ }
+ EXPORT_SYMBOL_GPL(usb_driver_release_interface);
+Index: linux-rt-2.6.31/drivers/usb/core/hcd.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/usb/core/hcd.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/usb/core/hcd.c	2010-05-17 14:23:20.018521377 +0200
+@@ -1880,7 +1880,7 @@
+ 	 * when the first handler doesn't use it.  So let's just
+ 	 * assume it's never used.
+ 	 */
+-	local_irq_save(flags);
++	local_irq_save_nort(flags);
+ 
+ 	if (unlikely(hcd->state == HC_STATE_HALT ||
+ 		     !test_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags))) {
+@@ -1895,7 +1895,7 @@
+ 		rc = IRQ_HANDLED;
+ 	}
+ 
+-	local_irq_restore(flags);
++	local_irq_restore_nort(flags);
+ 	return rc;
+ }
+ 
+Index: linux-rt-2.6.31/drivers/usb/core/message.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/usb/core/message.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/usb/core/message.c	2010-05-17 14:23:20.018521377 +0200
+@@ -269,8 +269,9 @@
+ {
+ 	struct usb_sg_request *io = urb->context;
+ 	int status = urb->status;
++	unsigned long flags;
+ 
+-	spin_lock(&io->lock);
++	spin_lock_irqsave (&io->lock, flags);
+ 
+ 	/* In 2.5 we require hcds' endpoint queues not to progress after fault
+ 	 * reports, until the completion callback (this!) returns.  That lets
+@@ -304,7 +305,7 @@
+ 		 * unlink pending urbs so they won't rx/tx bad data.
+ 		 * careful: unlink can sometimes be synchronous...
+ 		 */
+-		spin_unlock(&io->lock);
++		spin_unlock_irqrestore (&io->lock, flags);
+ 		for (i = 0, found = 0; i < io->entries; i++) {
+ 			if (!io->urbs [i] || !io->urbs [i]->dev)
+ 				continue;
+@@ -319,7 +320,7 @@
+ 			} else if (urb == io->urbs [i])
+ 				found = 1;
+ 		}
+-		spin_lock(&io->lock);
++		spin_lock_irqsave (&io->lock, flags);
+ 	}
+ 	urb->dev = NULL;
+ 
+@@ -329,7 +330,7 @@
+ 	if (!io->count)
+ 		complete(&io->complete);
+ 
+-	spin_unlock(&io->lock);
++	spin_unlock_irqrestore (&io->lock, flags);
+ }
+ 
+ 
+@@ -643,7 +644,7 @@
+ 		int i;
+ 
+ 		io->status = -ECONNRESET;
+-		spin_unlock(&io->lock);
++		spin_unlock_irqrestore(&io->lock, flags);
+ 		for (i = 0; i < io->entries; i++) {
+ 			int retval;
+ 
+@@ -654,7 +655,7 @@
+ 				dev_warn(&io->dev->dev, "%s, unlink --> %d\n",
+ 					__func__, retval);
+ 		}
+-		spin_lock(&io->lock);
++		spin_lock_irqsave(&io->lock, flags);
+ 	}
+ 	spin_unlock_irqrestore(&io->lock, flags);
+ }
+Index: linux-rt-2.6.31/drivers/usb/gadget/inode.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/usb/gadget/inode.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/usb/gadget/inode.c	2010-05-17 14:23:20.018521377 +0200
+@@ -193,7 +193,7 @@
+ };
+ 
+ struct ep_data {
+-	struct semaphore		lock;
++	struct mutex			lock;
+ 	enum ep_state			state;
+ 	atomic_t			count;
+ 	struct dev_data			*dev;
+@@ -297,10 +297,10 @@
+ 	int	val;
+ 
+ 	if (f_flags & O_NONBLOCK) {
+-		if (down_trylock (&epdata->lock) != 0)
++		if (mutex_trylock(&epdata->lock) != 0)
+ 			goto nonblock;
+ 		if (epdata->state != STATE_EP_ENABLED) {
+-			up (&epdata->lock);
++			mutex_unlock(&epdata->lock);
+ nonblock:
+ 			val = -EAGAIN;
+ 		} else
+@@ -308,7 +308,8 @@
+ 		return val;
+ 	}
+ 
+-	if ((val = down_interruptible (&epdata->lock)) < 0)
++	val = mutex_lock_interruptible(&epdata->lock);
++	if (val < 0)
+ 		return val;
+ 
+ 	switch (epdata->state) {
+@@ -322,7 +323,7 @@
+ 		// FALLTHROUGH
+ 	case STATE_EP_UNBOUND:			/* clean disconnect */
+ 		val = -ENODEV;
+-		up (&epdata->lock);
++		mutex_unlock(&epdata->lock);
+ 	}
+ 	return val;
+ }
+@@ -392,7 +393,7 @@
+ 		if (likely (data->ep != NULL))
+ 			usb_ep_set_halt (data->ep);
+ 		spin_unlock_irq (&data->dev->lock);
+-		up (&data->lock);
++		mutex_unlock(&data->lock);
+ 		return -EBADMSG;
+ 	}
+ 
+@@ -410,7 +411,7 @@
+ 		value = -EFAULT;
+ 
+ free1:
+-	up (&data->lock);
++	mutex_unlock(&data->lock);
+ 	kfree (kbuf);
+ 	return value;
+ }
+@@ -435,7 +436,7 @@
+ 		if (likely (data->ep != NULL))
+ 			usb_ep_set_halt (data->ep);
+ 		spin_unlock_irq (&data->dev->lock);
+-		up (&data->lock);
++		mutex_unlock(&data->lock);
+ 		return -EBADMSG;
+ 	}
+ 
+@@ -454,7 +455,7 @@
+ 	VDEBUG (data->dev, "%s write %zu IN, status %d\n",
+ 		data->name, len, (int) value);
+ free1:
+-	up (&data->lock);
++	mutex_unlock(&data->lock);
+ 	kfree (kbuf);
+ 	return value;
+ }
+@@ -465,7 +466,8 @@
+ 	struct ep_data		*data = fd->private_data;
+ 	int value;
+ 
+-	if ((value = down_interruptible(&data->lock)) < 0)
++	value = mutex_lock_interruptible(&data->lock);
++	if (value < 0)
+ 		return value;
+ 
+ 	/* clean up if this can be reopened */
+@@ -475,7 +477,7 @@
+ 		data->hs_desc.bDescriptorType = 0;
+ 		usb_ep_disable(data->ep);
+ 	}
+-	up (&data->lock);
++	mutex_unlock(&data->lock);
+ 	put_ep (data);
+ 	return 0;
+ }
+@@ -506,7 +508,7 @@
+ 	} else
+ 		status = -ENODEV;
+ 	spin_unlock_irq (&data->dev->lock);
+-	up (&data->lock);
++	mutex_unlock(&data->lock);
+ 	return status;
+ }
+ 
+@@ -672,7 +674,7 @@
+ 		value = -ENODEV;
+ 	spin_unlock_irq(&epdata->dev->lock);
+ 
+-	up(&epdata->lock);
++	mutex_unlock(&epdata->lock);
+ 
+ 	if (unlikely(value)) {
+ 		kfree(priv);
+@@ -764,7 +766,8 @@
+ 	u32			tag;
+ 	int			value, length = len;
+ 
+-	if ((value = down_interruptible (&data->lock)) < 0)
++	value = mutex_lock_interruptible(&data->lock);
++	if (value < 0)
+ 		return value;
+ 
+ 	if (data->state != STATE_EP_READY) {
+@@ -853,7 +856,7 @@
+ 		data->desc.bDescriptorType = 0;
+ 		data->hs_desc.bDescriptorType = 0;
+ 	}
+-	up (&data->lock);
++	mutex_unlock(&data->lock);
+ 	return value;
+ fail0:
+ 	value = -EINVAL;
+@@ -869,7 +872,7 @@
+ 	struct ep_data		*data = inode->i_private;
+ 	int			value = -EBUSY;
+ 
+-	if (down_interruptible (&data->lock) != 0)
++	if (mutex_lock_interruptible(&data->lock) != 0)
+ 		return -EINTR;
+ 	spin_lock_irq (&data->dev->lock);
+ 	if (data->dev->state == STATE_DEV_UNBOUND)
+@@ -884,7 +887,7 @@
+ 		DBG (data->dev, "%s state %d\n",
+ 			data->name, data->state);
+ 	spin_unlock_irq (&data->dev->lock);
+-	up (&data->lock);
++	mutex_unlock(&data->lock);
+ 	return value;
+ }
+ 
+@@ -1630,7 +1633,7 @@
+ 		if (!data)
+ 			goto enomem0;
+ 		data->state = STATE_EP_DISABLED;
+-		init_MUTEX (&data->lock);
++		mutex_init(&data->lock);
+ 		init_waitqueue_head (&data->wait);
+ 
+ 		strncpy (data->name, ep->name, sizeof (data->name) - 1);
+Index: linux-rt-2.6.31/drivers/usb/misc/ftdi-elan.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/usb/misc/ftdi-elan.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/usb/misc/ftdi-elan.c	2010-05-17 14:23:20.018521377 +0200
+@@ -2766,7 +2766,7 @@
+         ftdi->sequence_num = ++ftdi_instances;
+         mutex_unlock(&ftdi_module_lock);
+         ftdi_elan_init_kref(ftdi);
+-        init_MUTEX(&ftdi->sw_lock);
++	semaphore_init(&ftdi->sw_lock);
+         ftdi->udev = usb_get_dev(interface_to_usbdev(interface));
+         ftdi->interface = interface;
+         mutex_init(&ftdi->u132_lock);
+Index: linux-rt-2.6.31/drivers/uwb/umc-bus.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/uwb/umc-bus.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/uwb/umc-bus.c	2010-05-17 14:23:20.018521377 +0200
+@@ -62,12 +62,12 @@
+ 	struct device *parent = umc->dev.parent;
+ 	int ret = 0;
+ 
+-	if(down_trylock(&parent->sem))
++	if (mutex_trylock(&parent->mutex))
+ 		return -EAGAIN;
+ 	ret = device_for_each_child(parent, parent, umc_bus_pre_reset_helper);
+ 	if (ret >= 0)
+ 		device_for_each_child(parent, parent, umc_bus_post_reset_helper);
+-	up(&parent->sem);
++	mutex_unlock(&parent->mutex);
+ 
+ 	return ret;
+ }
+Index: linux-rt-2.6.31/drivers/uwb/uwb-internal.h
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/uwb/uwb-internal.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/uwb/uwb-internal.h	2010-05-17 14:23:20.018521377 +0200
+@@ -366,12 +366,12 @@
+ 
+ static inline void uwb_dev_lock(struct uwb_dev *uwb_dev)
+ {
+-	down(&uwb_dev->dev.sem);
++	mutex_lock(&uwb_dev->dev.mutex);
+ }
+ 
+ static inline void uwb_dev_unlock(struct uwb_dev *uwb_dev)
+ {
+-	up(&uwb_dev->dev.sem);
++	mutex_unlock(&uwb_dev->dev.mutex);
+ }
+ 
+ #endif /* #ifndef __UWB_INTERNAL_H__ */
+Index: linux-rt-2.6.31/drivers/video/console/fbcon.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/video/console/fbcon.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/drivers/video/console/fbcon.c	2010-05-17 14:23:20.018521377 +0200
+@@ -1206,7 +1206,6 @@
+ {
+ 	struct fb_info *info = registered_fb[con2fb_map[vc->vc_num]];
+ 	struct fbcon_ops *ops = info->fbcon_par;
+-
+ 	struct display *p = &fb_display[vc->vc_num];
+ 	u_int y_break;
+ 
+@@ -1238,10 +1237,11 @@
+ 	struct display *p = &fb_display[vc->vc_num];
+ 	struct fbcon_ops *ops = info->fbcon_par;
+ 
+-	if (!fbcon_is_inactive(vc, info))
++	if (!fbcon_is_inactive(vc, info)) {
+ 		ops->putcs(vc, info, s, count, real_y(p, ypos), xpos,
+ 			   get_color(vc, info, scr_readw(s), 1),
+ 			   get_color(vc, info, scr_readw(s), 0));
++	}
+ }
+ 
+ static void fbcon_putc(struct vc_data *vc, int c, int ypos, int xpos)
+@@ -3235,6 +3235,7 @@
+ 	.con_screen_pos 	= fbcon_screen_pos,
+ 	.con_getxy 		= fbcon_getxy,
+ 	.con_resize             = fbcon_resize,
++	.con_preemptible 	= 1,
+ };
+ 
+ static struct notifier_block fbcon_event_notifier = {
+Index: linux-rt-2.6.31/drivers/video/console/vgacon.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/video/console/vgacon.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/video/console/vgacon.c	2010-05-17 14:23:20.018521377 +0200
+@@ -51,7 +51,7 @@
+ #include <video/vga.h>
+ #include <asm/io.h>
+ 
+-static DEFINE_SPINLOCK(vga_lock);
++static DEFINE_ATOMIC_SPINLOCK(vga_lock);
+ static int cursor_size_lastfrom;
+ static int cursor_size_lastto;
+ static u32 vgacon_xres;
+@@ -158,7 +158,7 @@
+ 	 * ddprintk might set the console position from interrupt
+ 	 * handlers, thus the write has to be IRQ-atomic.
+ 	 */
+-	spin_lock_irqsave(&vga_lock, flags);
++	atomic_spin_lock_irqsave(&vga_lock, flags);
+ 
+ #ifndef SLOW_VGA
+ 	v1 = reg + (val & 0xff00);
+@@ -171,7 +171,7 @@
+ 	outb_p(reg + 1, vga_video_port_reg);
+ 	outb_p(val & 0xff, vga_video_port_val);
+ #endif
+-	spin_unlock_irqrestore(&vga_lock, flags);
++	atomic_spin_unlock_irqrestore(&vga_lock, flags);
+ }
+ 
+ static inline void vga_set_mem_top(struct vc_data *c)
+@@ -662,7 +662,7 @@
+ 	cursor_size_lastfrom = from;
+ 	cursor_size_lastto = to;
+ 
+-	spin_lock_irqsave(&vga_lock, flags);
++	atomic_spin_lock_irqsave(&vga_lock, flags);
+ 	if (vga_video_type >= VIDEO_TYPE_VGAC) {
+ 		outb_p(VGA_CRTC_CURSOR_START, vga_video_port_reg);
+ 		curs = inb_p(vga_video_port_val);
+@@ -680,7 +680,7 @@
+ 	outb_p(curs, vga_video_port_val);
+ 	outb_p(VGA_CRTC_CURSOR_END, vga_video_port_reg);
+ 	outb_p(cure, vga_video_port_val);
+-	spin_unlock_irqrestore(&vga_lock, flags);
++	atomic_spin_unlock_irqrestore(&vga_lock, flags);
+ }
+ 
+ static void vgacon_cursor(struct vc_data *c, int mode)
+@@ -755,7 +755,7 @@
+ 	unsigned int scanlines = height * c->vc_font.height;
+ 	u8 scanlines_lo = 0, r7 = 0, vsync_end = 0, mode, max_scan;
+ 
+-	spin_lock_irqsave(&vga_lock, flags);
++	atomic_spin_lock_irqsave(&vga_lock, flags);
+ 
+ 	vgacon_xres = width * VGA_FONTWIDTH;
+ 	vgacon_yres = height * c->vc_font.height;
+@@ -806,7 +806,7 @@
+ 		outb_p(vsync_end, vga_video_port_val);
+ 	}
+ 
+-	spin_unlock_irqrestore(&vga_lock, flags);
++	atomic_spin_unlock_irqrestore(&vga_lock, flags);
+ 	return 0;
+ }
+ 
+@@ -889,11 +889,11 @@
+ {
+ 	/* save original values of VGA controller registers */
+ 	if (!vga_vesa_blanked) {
+-		spin_lock_irq(&vga_lock);
++		atomic_spin_lock_irq(&vga_lock);
+ 		vga_state.SeqCtrlIndex = vga_r(state->vgabase, VGA_SEQ_I);
+ 		vga_state.CrtCtrlIndex = inb_p(vga_video_port_reg);
+ 		vga_state.CrtMiscIO = vga_r(state->vgabase, VGA_MIS_R);
+-		spin_unlock_irq(&vga_lock);
++		atomic_spin_unlock_irq(&vga_lock);
+ 
+ 		outb_p(0x00, vga_video_port_reg);	/* HorizontalTotal */
+ 		vga_state.HorizontalTotal = inb_p(vga_video_port_val);
+@@ -916,7 +916,7 @@
+ 
+ 	/* assure that video is enabled */
+ 	/* "0x20" is VIDEO_ENABLE_bit in register 01 of sequencer */
+-	spin_lock_irq(&vga_lock);
++	atomic_spin_lock_irq(&vga_lock);
+ 	vga_wseq(state->vgabase, VGA_SEQ_CLOCK_MODE, vga_state.ClockingMode | 0x20);
+ 
+ 	/* test for vertical retrace in process.... */
+@@ -952,13 +952,13 @@
+ 	/* restore both index registers */
+ 	vga_w(state->vgabase, VGA_SEQ_I, vga_state.SeqCtrlIndex);
+ 	outb_p(vga_state.CrtCtrlIndex, vga_video_port_reg);
+-	spin_unlock_irq(&vga_lock);
++	atomic_spin_unlock_irq(&vga_lock);
+ }
+ 
+ static void vga_vesa_unblank(struct vgastate *state)
+ {
+ 	/* restore original values of VGA controller registers */
+-	spin_lock_irq(&vga_lock);
++	atomic_spin_lock_irq(&vga_lock);
+ 	vga_w(state->vgabase, VGA_MIS_W, vga_state.CrtMiscIO);
+ 
+ 	outb_p(0x00, vga_video_port_reg);	/* HorizontalTotal */
+@@ -983,7 +983,7 @@
+ 	/* restore index/control registers */
+ 	vga_w(state->vgabase, VGA_SEQ_I, vga_state.SeqCtrlIndex);
+ 	outb_p(vga_state.CrtCtrlIndex, vga_video_port_reg);
+-	spin_unlock_irq(&vga_lock);
++	atomic_spin_unlock_irq(&vga_lock);
+ }
+ 
+ static void vga_pal_blank(struct vgastate *state)
+@@ -1103,7 +1103,7 @@
+ #endif
+ 
+ 	unlock_kernel();
+-	spin_lock_irq(&vga_lock);
++	atomic_spin_lock_irq(&vga_lock);
+ 	/* First, the Sequencer */
+ 	vga_wseq(state->vgabase, VGA_SEQ_RESET, 0x1);
+ 	/* CPU writes only to map 2 */
+@@ -1119,7 +1119,7 @@
+ 	vga_wgfx(state->vgabase, VGA_GFX_MODE, 0x00);
+ 	/* map start at A000:0000 */
+ 	vga_wgfx(state->vgabase, VGA_GFX_MISC, 0x00);
+-	spin_unlock_irq(&vga_lock);
++	atomic_spin_unlock_irq(&vga_lock);
+ 
+ 	if (arg) {
+ 		if (set)
+@@ -1146,7 +1146,7 @@
+ 		}
+ 	}
+ 
+-	spin_lock_irq(&vga_lock);
++	atomic_spin_lock_irq(&vga_lock);
+ 	/* First, the sequencer, Synchronous reset */
+ 	vga_wseq(state->vgabase, VGA_SEQ_RESET, 0x01);	
+ 	/* CPU writes to maps 0 and 1 */
+@@ -1185,7 +1185,7 @@
+ 		inb_p(video_port_status);
+ 		vga_wattr(state->vgabase, VGA_AR_ENABLE_DISPLAY, 0);	
+ 	}
+-	spin_unlock_irq(&vga_lock);
++	atomic_spin_unlock_irq(&vga_lock);
+ 	lock_kernel();
+ 	return 0;
+ }
+@@ -1211,26 +1211,26 @@
+ 	   registers; they are write-only on EGA, but it appears that they
+ 	   are all don't care bits on EGA, so I guess it doesn't matter. */
+ 
+-	spin_lock_irq(&vga_lock);
++	atomic_spin_lock_irq(&vga_lock);
+ 	outb_p(0x07, vga_video_port_reg);	/* CRTC overflow register */
+ 	ovr = inb_p(vga_video_port_val);
+ 	outb_p(0x09, vga_video_port_reg);	/* Font size register */
+ 	fsr = inb_p(vga_video_port_val);
+-	spin_unlock_irq(&vga_lock);
++	atomic_spin_unlock_irq(&vga_lock);
+ 
+ 	vde = maxscan & 0xff;	/* Vertical display end reg */
+ 	ovr = (ovr & 0xbd) +	/* Overflow register */
+ 	    ((maxscan & 0x100) >> 7) + ((maxscan & 0x200) >> 3);
+ 	fsr = (fsr & 0xe0) + (fontheight - 1);	/*  Font size register */
+ 
+-	spin_lock_irq(&vga_lock);
++	atomic_spin_lock_irq(&vga_lock);
+ 	outb_p(0x07, vga_video_port_reg);	/* CRTC overflow register */
+ 	outb_p(ovr, vga_video_port_val);
+ 	outb_p(0x09, vga_video_port_reg);	/* Font size */
+ 	outb_p(fsr, vga_video_port_val);
+ 	outb_p(0x12, vga_video_port_reg);	/* Vertical display limit */
+ 	outb_p(vde, vga_video_port_val);
+-	spin_unlock_irq(&vga_lock);
++	atomic_spin_unlock_irq(&vga_lock);
+ 	vga_video_font_height = fontheight;
+ 
+ 	for (i = 0; i < MAX_NR_CONSOLES; i++) {
+Index: linux-rt-2.6.31/drivers/watchdog/davinci_wdt.c
+===================================================================
+--- linux-rt-2.6.31.orig/drivers/watchdog/davinci_wdt.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/drivers/watchdog/davinci_wdt.c	2010-05-17 14:23:20.018521377 +0200
+@@ -25,6 +25,7 @@
+ #include <linux/uaccess.h>
+ #include <linux/io.h>
+ #include <linux/device.h>
++#include <linux/clk.h>
+ 
+ #define MODULE_NAME "DAVINCI-WDT: "
+ 
+@@ -69,6 +70,7 @@
+ 
+ static struct resource	*wdt_mem;
+ static void __iomem	*wdt_base;
++struct clk		*wdt_clk;
+ 
+ static void wdt_service(void)
+ {
+@@ -86,6 +88,9 @@
+ {
+ 	u32 tgcr;
+ 	u32 timer_margin;
++	unsigned long wdt_freq;
++
++	wdt_freq = clk_get_rate(wdt_clk);
+ 
+ 	spin_lock(&io_lock);
+ 
+@@ -99,9 +104,9 @@
+ 	iowrite32(0, wdt_base + TIM12);
+ 	iowrite32(0, wdt_base + TIM34);
+ 	/* set timeout period */
+-	timer_margin = (((u64)heartbeat * CLOCK_TICK_RATE) & 0xffffffff);
++	timer_margin = (((u64)heartbeat * wdt_freq) & 0xffffffff);
+ 	iowrite32(timer_margin, wdt_base + PRD12);
+-	timer_margin = (((u64)heartbeat * CLOCK_TICK_RATE) >> 32);
++	timer_margin = (((u64)heartbeat * wdt_freq) >> 32);
+ 	iowrite32(timer_margin, wdt_base + PRD34);
+ 	/* enable run continuously */
+ 	iowrite32(ENAMODE12_PERIODIC, wdt_base + TCR);
+@@ -199,6 +204,12 @@
+ 	struct resource *res;
+ 	struct device *dev = &pdev->dev;
+ 
++	wdt_clk = clk_get(dev, NULL);
++	if (WARN_ON(IS_ERR(wdt_clk)))
++		return PTR_ERR(wdt_clk);
++
++	clk_enable(wdt_clk);
++
+ 	if (heartbeat < 1 || heartbeat > MAX_HEARTBEAT)
+ 		heartbeat = DEFAULT_HEARTBEAT;
+ 
+@@ -245,6 +256,10 @@
+ 		kfree(wdt_mem);
+ 		wdt_mem = NULL;
+ 	}
++
++	clk_disable(wdt_clk);
++	clk_put(wdt_clk);
++
+ 	return 0;
+ }
+ 
+Index: linux-rt-2.6.31/fs/affs/super.c
+===================================================================
+--- linux-rt-2.6.31.orig/fs/affs/super.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/fs/affs/super.c	2010-05-17 14:23:20.018521377 +0200
+@@ -113,8 +113,8 @@
+ {
+ 	struct affs_inode_info *ei = (struct affs_inode_info *) foo;
+ 
+-	init_MUTEX(&ei->i_link_lock);
+-	init_MUTEX(&ei->i_ext_lock);
++	semaphore_init(&ei->i_link_lock);
++	semaphore_init(&ei->i_ext_lock);
+ 	inode_init_once(&ei->vfs_inode);
+ }
+ 
+Index: linux-rt-2.6.31/fs/aio.c
+===================================================================
+--- linux-rt-2.6.31.orig/fs/aio.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/fs/aio.c	2010-05-17 14:23:20.018521377 +0200
+@@ -612,9 +612,11 @@
+ 	task_lock(tsk);
+ 	active_mm = tsk->active_mm;
+ 	atomic_inc(&mm->mm_count);
++	local_irq_disable(); // FIXME
++	switch_mm(active_mm, mm, tsk);
+ 	tsk->mm = mm;
+ 	tsk->active_mm = mm;
+-	switch_mm(active_mm, mm, tsk);
++	local_irq_enable();
+ 	task_unlock(tsk);
+ 
+ 	mmdrop(active_mm);
+Index: linux-rt-2.6.31/fs/attr.c
+===================================================================
+--- linux-rt-2.6.31.orig/fs/attr.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/fs/attr.c	2010-05-17 14:23:20.018521377 +0200
+@@ -164,7 +164,7 @@
+ 		return error;
+ 
+ 	if (ia_valid & ATTR_SIZE)
+-		down_write(&dentry->d_inode->i_alloc_sem);
++		anon_down_write(&dentry->d_inode->i_alloc_sem);
+ 
+ 	if (inode->i_op && inode->i_op->setattr) {
+ 		error = inode->i_op->setattr(dentry, attr);
+@@ -181,7 +181,7 @@
+ 	}
+ 
+ 	if (ia_valid & ATTR_SIZE)
+-		up_write(&dentry->d_inode->i_alloc_sem);
++		anon_up_write(&dentry->d_inode->i_alloc_sem);
+ 
+ 	if (!error)
+ 		fsnotify_change(dentry, ia_valid);
+Index: linux-rt-2.6.31/fs/btrfs/locking.c
+===================================================================
+--- linux-rt-2.6.31.orig/fs/btrfs/locking.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/fs/btrfs/locking.c	2010-05-17 14:23:20.018521377 +0200
+@@ -94,6 +94,7 @@
+  */
+ int btrfs_try_spin_lock(struct extent_buffer *eb)
+ {
++#ifndef CONFIG_PREEMPT_RT
+ 	int i;
+ 
+ 	if (btrfs_spin_on_block(eb)) {
+@@ -113,6 +114,7 @@
+ 			return 1;
+ 		spin_unlock(&eb->lock);
+ 	}
++#endif
+ 	return 0;
+ }
+ 
+Index: linux-rt-2.6.31/fs/buffer.c
+===================================================================
+--- linux-rt-2.6.31.orig/fs/buffer.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/fs/buffer.c	2010-05-17 14:23:20.018521377 +0200
+@@ -40,7 +40,6 @@
+ #include <linux/cpu.h>
+ #include <linux/bitops.h>
+ #include <linux/mpage.h>
+-#include <linux/bit_spinlock.h>
+ 
+ static int fsync_buffers_list(spinlock_t *lock, struct list_head *list);
+ 
+@@ -324,8 +323,7 @@
+ 	 * decide that the page is now completely done.
+ 	 */
+ 	first = page_buffers(page);
+-	local_irq_save(flags);
+-	bit_spin_lock(BH_Uptodate_Lock, &first->b_state);
++	spin_lock_irqsave(&first->b_uptodate_lock, flags);
+ 	clear_buffer_async_read(bh);
+ 	unlock_buffer(bh);
+ 	tmp = bh;
+@@ -338,8 +336,7 @@
+ 		}
+ 		tmp = tmp->b_this_page;
+ 	} while (tmp != bh);
+-	bit_spin_unlock(BH_Uptodate_Lock, &first->b_state);
+-	local_irq_restore(flags);
++	spin_unlock_irqrestore(&first->b_uptodate_lock, flags);
+ 
+ 	/*
+ 	 * If none of the buffers had errors and they are all
+@@ -351,8 +348,7 @@
+ 	return;
+ 
+ still_busy:
+-	bit_spin_unlock(BH_Uptodate_Lock, &first->b_state);
+-	local_irq_restore(flags);
++	spin_unlock_irqrestore(&first->b_uptodate_lock, flags);
+ 	return;
+ }
+ 
+@@ -387,8 +383,7 @@
+ 	}
+ 
+ 	first = page_buffers(page);
+-	local_irq_save(flags);
+-	bit_spin_lock(BH_Uptodate_Lock, &first->b_state);
++	spin_lock_irqsave(&first->b_uptodate_lock, flags);
+ 
+ 	clear_buffer_async_write(bh);
+ 	unlock_buffer(bh);
+@@ -400,14 +395,12 @@
+ 		}
+ 		tmp = tmp->b_this_page;
+ 	}
+-	bit_spin_unlock(BH_Uptodate_Lock, &first->b_state);
+-	local_irq_restore(flags);
++	spin_unlock_irqrestore(&first->b_uptodate_lock, flags);
+ 	end_page_writeback(page);
+ 	return;
+ 
+ still_busy:
+-	bit_spin_unlock(BH_Uptodate_Lock, &first->b_state);
+-	local_irq_restore(flags);
++	spin_unlock_irqrestore(&first->b_uptodate_lock, flags);
+ 	return;
+ }
+ 
+@@ -3251,6 +3244,8 @@
+ 	struct buffer_head *ret = kmem_cache_alloc(bh_cachep, gfp_flags);
+ 	if (ret) {
+ 		INIT_LIST_HEAD(&ret->b_assoc_buffers);
++		spin_lock_init(&ret->b_uptodate_lock);
++		spin_lock_init(&ret->b_state_lock);
+ 		get_cpu_var(bh_accounting).nr++;
+ 		recalc_bh_state();
+ 		put_cpu_var(bh_accounting);
+@@ -3262,6 +3257,8 @@
+ void free_buffer_head(struct buffer_head *bh)
+ {
+ 	BUG_ON(!list_empty(&bh->b_assoc_buffers));
++	BUG_ON(spin_is_locked(&bh->b_uptodate_lock));
++	BUG_ON(spin_is_locked(&bh->b_state_lock));
+ 	kmem_cache_free(bh_cachep, bh);
+ 	get_cpu_var(bh_accounting).nr--;
+ 	recalc_bh_state();
+Index: linux-rt-2.6.31/fs/cifs/cifsglob.h
+===================================================================
+--- linux-rt-2.6.31.orig/fs/cifs/cifsglob.h	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/fs/cifs/cifsglob.h	2010-05-17 14:23:20.028496807 +0200
+@@ -203,7 +203,7 @@
+ struct cifsSesInfo {
+ 	struct list_head smb_ses_list;
+ 	struct list_head tcon_list;
+-	struct semaphore sesSem;
++	struct mutex sesSem;
+ #if 0
+ 	struct cifsUidInfo *uidInfo;	/* pointer to user info */
+ #endif
+Index: linux-rt-2.6.31/fs/cifs/cifssmb.c
+===================================================================
+--- linux-rt-2.6.31.orig/fs/cifs/cifssmb.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/fs/cifs/cifssmb.c	2010-05-17 14:23:20.028496807 +0200
+@@ -154,7 +154,7 @@
+ 			nls_codepage = load_nls_default();
+ 		/* need to prevent multiple threads trying to
+ 		simultaneously reconnect the same SMB session */
+-			down(&tcon->ses->sesSem);
++			mutex_lock(&tcon->ses->sesSem);
+ 			if (tcon->ses->need_reconnect)
+ 				rc = cifs_setup_session(0, tcon->ses,
+ 							nls_codepage);
+@@ -162,7 +162,7 @@
+ 				mark_open_files_invalid(tcon);
+ 				rc = CIFSTCon(0, tcon->ses, tcon->treeName,
+ 					      tcon, nls_codepage);
+-				up(&tcon->ses->sesSem);
++				mutex_unlock(&tcon->ses->sesSem);
+ 				/* BB FIXME add code to check if wsize needs
+ 				   update due to negotiated smb buffer size
+ 				   shrinking */
+@@ -196,7 +196,7 @@
+ 					}
+ 				}
+ 			} else {
+-				up(&tcon->ses->sesSem);
++				mutex_unlock(&tcon->ses->sesSem);
+ 			}
+ 			unload_nls(nls_codepage);
+ 
+@@ -301,7 +301,7 @@
+ 			nls_codepage = load_nls_default();
+ 		/* need to prevent multiple threads trying to
+ 		simultaneously reconnect the same SMB session */
+-			down(&tcon->ses->sesSem);
++			mutex_lock(&tcon->ses->sesSem);
+ 			if (tcon->ses->need_reconnect)
+ 				rc = cifs_setup_session(0, tcon->ses,
+ 							nls_codepage);
+@@ -309,7 +309,7 @@
+ 				mark_open_files_invalid(tcon);
+ 				rc = CIFSTCon(0, tcon->ses, tcon->treeName,
+ 					      tcon, nls_codepage);
+-				up(&tcon->ses->sesSem);
++				mutex_unlock(&tcon->ses->sesSem);
+ 				/* BB FIXME add code to check if wsize needs
+ 				update due to negotiated smb buffer size
+ 				shrinking */
+@@ -343,7 +343,7 @@
+ 					}
+ 				}
+ 			} else {
+-				up(&tcon->ses->sesSem);
++				mutex_unlock(&tcon->ses->sesSem);
+ 			}
+ 			unload_nls(nls_codepage);
+ 
+@@ -765,13 +765,13 @@
+ 	if (!ses || !ses->server)
+ 		return -EIO;
+ 
+-	down(&ses->sesSem);
++	mutex_lock(&ses->sesSem);
+ 	if (ses->need_reconnect)
+ 		goto session_already_dead; /* no need to send SMBlogoff if uid
+ 					      already closed due to reconnect */
+ 	rc = small_smb_init(SMB_COM_LOGOFF_ANDX, 2, NULL, (void **)&pSMB);
+ 	if (rc) {
+-		up(&ses->sesSem);
++		mutex_unlock(&ses->sesSem);
+ 		return rc;
+ 	}
+ 
+@@ -786,7 +786,7 @@
+ 	pSMB->AndXCommand = 0xFF;
+ 	rc = SendReceiveNoRsp(xid, ses, (struct smb_hdr *) pSMB, 0);
+ session_already_dead:
+-	up(&ses->sesSem);
++	mutex_unlock(&ses->sesSem);
+ 
+ 	/* if session dead then we do not need to do ulogoff,
+ 		since server closed smb session, no sense reporting
+Index: linux-rt-2.6.31/fs/cifs/connect.c
+===================================================================
+--- linux-rt-2.6.31.orig/fs/cifs/connect.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/fs/cifs/connect.c	2010-05-17 14:23:20.028496807 +0200
+@@ -2346,13 +2346,13 @@
+ 		 */
+ 		cifs_put_tcp_session(srvTcp);
+ 
+-		down(&pSesInfo->sesSem);
++		mutex_lock(&pSesInfo->sesSem);
+ 		if (pSesInfo->need_reconnect) {
+ 			cFYI(1, ("Session needs reconnect"));
+ 			rc = cifs_setup_session(xid, pSesInfo,
+ 						cifs_sb->local_nls);
+ 		}
+-		up(&pSesInfo->sesSem);
++		mutex_unlock(&pSesInfo->sesSem);
+ 	} else if (!rc) {
+ 		cFYI(1, ("Existing smb sess not found"));
+ 		pSesInfo = sesInfoAlloc();
+@@ -2395,12 +2395,12 @@
+ 		}
+ 		pSesInfo->linux_uid = volume_info->linux_uid;
+ 		pSesInfo->overrideSecFlg = volume_info->secFlg;
+-		down(&pSesInfo->sesSem);
++		mutex_lock(&pSesInfo->sesSem);
+ 
+ 		/* BB FIXME need to pass vol->secFlgs BB */
+ 		rc = cifs_setup_session(xid, pSesInfo,
+ 					cifs_sb->local_nls);
+-		up(&pSesInfo->sesSem);
++		mutex_unlock(&pSesInfo->sesSem);
+ 	}
+ 
+ 	/* search for existing tcon to this server share */
+Index: linux-rt-2.6.31/fs/cifs/misc.c
+===================================================================
+--- linux-rt-2.6.31.orig/fs/cifs/misc.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/fs/cifs/misc.c	2010-05-17 14:23:20.028496807 +0200
+@@ -80,7 +80,7 @@
+ 		++ret_buf->ses_count;
+ 		INIT_LIST_HEAD(&ret_buf->smb_ses_list);
+ 		INIT_LIST_HEAD(&ret_buf->tcon_list);
+-		init_MUTEX(&ret_buf->sesSem);
++		mutex_init(&ret_buf->sesSem);
+ 	}
+ 	return ret_buf;
+ }
+Index: linux-rt-2.6.31/fs/dcache.c
+===================================================================
+--- linux-rt-2.6.31.orig/fs/dcache.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/fs/dcache.c	2010-05-17 14:23:20.028496807 +0200
+@@ -726,8 +726,9 @@
+ {
+ 	struct dentry *dentry;
+ 
+-	if (down_read_trylock(&sb->s_umount))
+-		BUG();
++// -rt: this might succeed there ...
++//	if (down_read_trylock(&sb->s_umount))
++//		BUG();
+ 
+ 	dentry = sb->s_root;
+ 	sb->s_root = NULL;
+Index: linux-rt-2.6.31/fs/direct-io.c
+===================================================================
+--- linux-rt-2.6.31.orig/fs/direct-io.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/fs/direct-io.c	2010-05-17 14:23:20.028496807 +0200
+@@ -242,7 +242,7 @@
+ 			    dio->map_bh.b_private);
+ 	if (dio->lock_type == DIO_LOCKING)
+ 		/* lockdep: non-owner release */
+-		up_read_non_owner(&dio->inode->i_alloc_sem);
++		anon_up_read_non_owner(&dio->inode->i_alloc_sem);
+ 
+ 	if (ret == 0)
+ 		ret = dio->page_errors;
+@@ -1192,7 +1192,7 @@
+ 
+ 		if (dio_lock_type == DIO_LOCKING)
+ 			/* lockdep: not the owner will release it */
+-			down_read_non_owner(&inode->i_alloc_sem);
++			anon_down_read_non_owner(&inode->i_alloc_sem);
+ 	}
+ 
+ 	/*
+Index: linux-rt-2.6.31/fs/exec.c
+===================================================================
+--- linux-rt-2.6.31.orig/fs/exec.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/fs/exec.c	2010-05-17 14:23:20.028496807 +0200
+@@ -48,6 +48,7 @@
+ #include <linux/security.h>
+ #include <linux/ima.h>
+ #include <linux/syscalls.h>
++#include <linux/delay.h>
+ #include <linux/tsacct_kern.h>
+ #include <linux/cn_proc.h>
+ #include <linux/audit.h>
+@@ -503,7 +504,7 @@
+ 	unsigned long length = old_end - old_start;
+ 	unsigned long new_start = old_start - shift;
+ 	unsigned long new_end = old_end - shift;
+-	struct mmu_gather *tlb;
++	struct mmu_gather tlb;
+ 
+ 	BUG_ON(new_start > new_end);
+ 
+@@ -528,12 +529,12 @@
+ 		return -ENOMEM;
+ 
+ 	lru_add_drain();
+-	tlb = tlb_gather_mmu(mm, 0);
++	tlb_gather_mmu(&tlb, mm, 0);
+ 	if (new_end > old_start) {
+ 		/*
+ 		 * when the old and new regions overlap clear from new_end.
+ 		 */
+-		free_pgd_range(tlb, new_end, old_end, new_end,
++		free_pgd_range(&tlb, new_end, old_end, new_end,
+ 			vma->vm_next ? vma->vm_next->vm_start : 0);
+ 	} else {
+ 		/*
+@@ -542,10 +543,10 @@
+ 		 * have constraints on va-space that make this illegal (IA64) -
+ 		 * for the others its just a little faster.
+ 		 */
+-		free_pgd_range(tlb, old_start, old_end, new_end,
++		free_pgd_range(&tlb, old_start, old_end, new_end,
+ 			vma->vm_next ? vma->vm_next->vm_start : 0);
+ 	}
+-	tlb_finish_mmu(tlb, new_end, old_end);
++	tlb_finish_mmu(&tlb, new_end, old_end);
+ 
+ 	/*
+ 	 * shrink the vma to just the new range.
+@@ -723,10 +724,12 @@
+ 		}
+ 	}
+ 	task_lock(tsk);
++	local_irq_disable();
+ 	active_mm = tsk->active_mm;
++	activate_mm(active_mm, mm);
+ 	tsk->mm = mm;
+ 	tsk->active_mm = mm;
+-	activate_mm(active_mm, mm);
++	local_irq_enable();
+ 	task_unlock(tsk);
+ 	arch_pick_mmap_layout(mm);
+ 	if (old_mm) {
+Index: linux-rt-2.6.31/fs/ext4/inode.c
+===================================================================
+--- linux-rt-2.6.31.orig/fs/ext4/inode.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/fs/ext4/inode.c	2010-05-17 14:23:20.028496807 +0200
+@@ -5762,7 +5762,7 @@
+ 	 * Get i_alloc_sem to stop truncates messing with the inode. We cannot
+ 	 * get i_mutex because we are already holding mmap_sem.
+ 	 */
+-	down_read(&inode->i_alloc_sem);
++	anon_down_read(&inode->i_alloc_sem);
+ 	size = i_size_read(inode);
+ 	if (page->mapping != mapping || size <= page_offset(page)
+ 	    || !PageUptodate(page)) {
+@@ -5812,6 +5812,6 @@
+ out_unlock:
+ 	if (ret)
+ 		ret = VM_FAULT_SIGBUS;
+-	up_read(&inode->i_alloc_sem);
++	anon_up_read(&inode->i_alloc_sem);
+ 	return ret;
+ }
+Index: linux-rt-2.6.31/fs/fat/inode.c
+===================================================================
+--- linux-rt-2.6.31.orig/fs/fat/inode.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/fs/fat/inode.c	2010-05-17 14:23:20.028496807 +0200
+@@ -202,9 +202,9 @@
+ 	sector_t blocknr;
+ 
+ 	/* fat_get_cluster() assumes the requested blocknr isn't truncated. */
+-	down_read(&mapping->host->i_alloc_sem);
++	anon_down_read(&mapping->host->i_alloc_sem);
+ 	blocknr = generic_block_bmap(mapping, block, fat_get_block);
+-	up_read(&mapping->host->i_alloc_sem);
++	anon_up_read(&mapping->host->i_alloc_sem);
+ 
+ 	return blocknr;
+ }
+Index: linux-rt-2.6.31/fs/file.c
+===================================================================
+--- linux-rt-2.6.31.orig/fs/file.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/fs/file.c	2010-05-17 14:23:20.028496807 +0200
+@@ -102,14 +102,15 @@
+ 		kfree(fdt->open_fds);
+ 		kfree(fdt);
+ 	} else {
+-		fddef = &get_cpu_var(fdtable_defer_list);
++
++		fddef = &per_cpu(fdtable_defer_list, raw_smp_processor_id());
++
+ 		spin_lock(&fddef->lock);
+ 		fdt->next = fddef->next;
+ 		fddef->next = fdt;
+ 		/* vmallocs are handled from the workqueue context */
+ 		schedule_work(&fddef->wq);
+ 		spin_unlock(&fddef->lock);
+-		put_cpu_var(fdtable_defer_list);
+ 	}
+ }
+ 
+Index: linux-rt-2.6.31/fs/hfs/bfind.c
+===================================================================
+--- linux-rt-2.6.31.orig/fs/hfs/bfind.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/fs/hfs/bfind.c	2010-05-17 14:23:20.028496807 +0200
+@@ -23,7 +23,7 @@
+ 	fd->search_key = ptr;
+ 	fd->key = ptr + tree->max_key_len + 2;
+ 	dprint(DBG_BNODE_REFS, "find_init: %d (%p)\n", tree->cnid, __builtin_return_address(0));
+-	down(&tree->tree_lock);
++	mutex_lock(&tree->tree_lock);
+ 	return 0;
+ }
+ 
+@@ -32,7 +32,7 @@
+ 	hfs_bnode_put(fd->bnode);
+ 	kfree(fd->search_key);
+ 	dprint(DBG_BNODE_REFS, "find_exit: %d (%p)\n", fd->tree->cnid, __builtin_return_address(0));
+-	up(&fd->tree->tree_lock);
++	mutex_unlock(&fd->tree->tree_lock);
+ 	fd->tree = NULL;
+ }
+ 
+Index: linux-rt-2.6.31/fs/hfs/btree.c
+===================================================================
+--- linux-rt-2.6.31.orig/fs/hfs/btree.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/fs/hfs/btree.c	2010-05-17 14:23:20.028496807 +0200
+@@ -26,7 +26,7 @@
+ 	if (!tree)
+ 		return NULL;
+ 
+-	init_MUTEX(&tree->tree_lock);
++	mutex_init(&tree->tree_lock);
+ 	spin_lock_init(&tree->hash_lock);
+ 	/* Set the correct compare function */
+ 	tree->sb = sb;
+Index: linux-rt-2.6.31/fs/hfs/btree.h
+===================================================================
+--- linux-rt-2.6.31.orig/fs/hfs/btree.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/fs/hfs/btree.h	2010-05-17 14:23:20.028496807 +0200
+@@ -33,7 +33,7 @@
+ 	unsigned int depth;
+ 
+ 	//unsigned int map1_size, map_size;
+-	struct semaphore tree_lock;
++	struct mutex tree_lock;
+ 
+ 	unsigned int pages_per_bnode;
+ 	spinlock_t hash_lock;
+Index: linux-rt-2.6.31/fs/hfsplus/bfind.c
+===================================================================
+--- linux-rt-2.6.31.orig/fs/hfsplus/bfind.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/fs/hfsplus/bfind.c	2010-05-17 14:23:20.028496807 +0200
+@@ -23,7 +23,7 @@
+ 	fd->search_key = ptr;
+ 	fd->key = ptr + tree->max_key_len + 2;
+ 	dprint(DBG_BNODE_REFS, "find_init: %d (%p)\n", tree->cnid, __builtin_return_address(0));
+-	down(&tree->tree_lock);
++	mutex_lock(&tree->tree_lock);
+ 	return 0;
+ }
+ 
+@@ -32,7 +32,7 @@
+ 	hfs_bnode_put(fd->bnode);
+ 	kfree(fd->search_key);
+ 	dprint(DBG_BNODE_REFS, "find_exit: %d (%p)\n", fd->tree->cnid, __builtin_return_address(0));
+-	up(&fd->tree->tree_lock);
++	mutex_unlock(&fd->tree->tree_lock);
+ 	fd->tree = NULL;
+ }
+ 
+Index: linux-rt-2.6.31/fs/hfsplus/btree.c
+===================================================================
+--- linux-rt-2.6.31.orig/fs/hfsplus/btree.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/fs/hfsplus/btree.c	2010-05-17 14:23:20.028496807 +0200
+@@ -30,7 +30,7 @@
+ 	if (!tree)
+ 		return NULL;
+ 
+-	init_MUTEX(&tree->tree_lock);
++	mutex_init(&tree->tree_lock);
+ 	spin_lock_init(&tree->hash_lock);
+ 	tree->sb = sb;
+ 	tree->cnid = id;
+Index: linux-rt-2.6.31/fs/hfsplus/hfsplus_fs.h
+===================================================================
+--- linux-rt-2.6.31.orig/fs/hfsplus/hfsplus_fs.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/fs/hfsplus/hfsplus_fs.h	2010-05-17 14:23:20.028496807 +0200
+@@ -62,7 +62,7 @@
+ 	unsigned int depth;
+ 
+ 	//unsigned int map1_size, map_size;
+-	struct semaphore tree_lock;
++	struct mutex tree_lock;
+ 
+ 	unsigned int pages_per_bnode;
+ 	spinlock_t hash_lock;
+Index: linux-rt-2.6.31/fs/hpfs/buffer.c
+===================================================================
+--- linux-rt-2.6.31.orig/fs/hpfs/buffer.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/fs/hpfs/buffer.c	2010-05-17 14:23:20.028496807 +0200
+@@ -13,7 +13,7 @@
+ #ifdef DEBUG_LOCKS
+ 	printk("lock creation\n");
+ #endif
+-	down(&hpfs_sb(s)->hpfs_creation_de);
++	mutex_lock(&hpfs_sb(s)->hpfs_creation_de);
+ }
+ 
+ void hpfs_unlock_creation(struct super_block *s)
+@@ -21,7 +21,7 @@
+ #ifdef DEBUG_LOCKS
+ 	printk("unlock creation\n");
+ #endif
+-	up(&hpfs_sb(s)->hpfs_creation_de);
++	mutex_unlock(&hpfs_sb(s)->hpfs_creation_de);
+ }
+ 
+ /* Map a sector into a buffer and return pointers to it and to the buffer. */
+Index: linux-rt-2.6.31/fs/hpfs/hpfs_fn.h
+===================================================================
+--- linux-rt-2.6.31.orig/fs/hpfs/hpfs_fn.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/fs/hpfs/hpfs_fn.h	2010-05-17 14:23:20.028496807 +0200
+@@ -87,7 +87,7 @@
+ 	unsigned *sb_bmp_dir;		/* main bitmap directory */
+ 	unsigned sb_c_bitmap;		/* current bitmap */
+ 	unsigned sb_max_fwd_alloc;	/* max forwad allocation */
+-	struct semaphore hpfs_creation_de; /* when creating dirents, nobody else
++	struct mutex hpfs_creation_de;	/* when creating dirents, nobody else
+ 					   can alloc blocks */
+ 	/*unsigned sb_mounting : 1;*/
+ 	int sb_timeshift;
+Index: linux-rt-2.6.31/fs/hpfs/super.c
+===================================================================
+--- linux-rt-2.6.31.orig/fs/hpfs/super.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/fs/hpfs/super.c	2010-05-17 14:23:20.038385913 +0200
+@@ -487,7 +487,7 @@
+ 	sbi->sb_bmp_dir = NULL;
+ 	sbi->sb_cp_table = NULL;
+ 
+-	init_MUTEX(&sbi->hpfs_creation_de);
++	mutex_init(&sbi->hpfs_creation_de);
+ 
+ 	uid = current_uid();
+ 	gid = current_gid();
+Index: linux-rt-2.6.31/fs/inode.c
+===================================================================
+--- linux-rt-2.6.31.orig/fs/inode.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/fs/inode.c	2010-05-17 14:23:20.038385913 +0200
+@@ -163,7 +163,7 @@
+ 	mutex_init(&inode->i_mutex);
+ 	lockdep_set_class(&inode->i_mutex, &sb->s_type->i_mutex_key);
+ 
+-	init_rwsem(&inode->i_alloc_sem);
++	init_anon_rwsem(&inode->i_alloc_sem);
+ 	lockdep_set_class(&inode->i_alloc_sem, &sb->s_type->i_alloc_sem_key);
+ 
+ 	mapping->a_ops = &empty_aops;
+Index: linux-rt-2.6.31/fs/ioprio.c
+===================================================================
+--- linux-rt-2.6.31.orig/fs/ioprio.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/fs/ioprio.c	2010-05-17 14:23:20.038385913 +0200
+@@ -230,6 +230,7 @@
+ 			if (!user)
+ 				break;
+ 
++			rcu_read_lock();
+ 			do_each_thread(g, p) {
+ 				if (__task_cred(p)->uid != user->uid)
+ 					continue;
+@@ -241,6 +242,7 @@
+ 				else
+ 					ret = ioprio_best(ret, tmpio);
+ 			} while_each_thread(g, p);
++			rcu_read_unlock();
+ 
+ 			if (who)
+ 				free_uid(user);
+Index: linux-rt-2.6.31/fs/jbd/transaction.c
+===================================================================
+--- linux-rt-2.6.31.orig/fs/jbd/transaction.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/fs/jbd/transaction.c	2010-05-17 14:23:20.038385913 +0200
+@@ -1576,7 +1576,7 @@
+ 	transaction_t *transaction;
+ 	struct buffer_head *bh = jh2bh(jh);
+ 
+-	J_ASSERT_JH(jh, jbd_is_locked_bh_state(bh));
++	J_ASSERT_JH_SMP(jh, jbd_is_locked_bh_state(bh));
+ 	transaction = jh->b_transaction;
+ 	if (transaction)
+ 		assert_spin_locked(&transaction->t_journal->j_list_lock);
+@@ -2028,7 +2028,7 @@
+ 	int was_dirty = 0;
+ 	struct buffer_head *bh = jh2bh(jh);
+ 
+-	J_ASSERT_JH(jh, jbd_is_locked_bh_state(bh));
++	J_ASSERT_JH_SMP(jh, jbd_is_locked_bh_state(bh));
+ 	assert_spin_locked(&transaction->t_journal->j_list_lock);
+ 
+ 	J_ASSERT_JH(jh, jh->b_jlist < BJ_Types);
+@@ -2122,7 +2122,7 @@
+ 	int was_dirty;
+ 	struct buffer_head *bh = jh2bh(jh);
+ 
+-	J_ASSERT_JH(jh, jbd_is_locked_bh_state(bh));
++	J_ASSERT_JH_SMP(jh, jbd_is_locked_bh_state(bh));
+ 	if (jh->b_transaction)
+ 		assert_spin_locked(&jh->b_transaction->t_journal->j_list_lock);
+ 
+Index: linux-rt-2.6.31/fs/jbd2/transaction.c
+===================================================================
+--- linux-rt-2.6.31.orig/fs/jbd2/transaction.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/fs/jbd2/transaction.c	2010-05-17 14:23:20.038385913 +0200
+@@ -1452,7 +1452,7 @@
+ 	transaction_t *transaction;
+ 	struct buffer_head *bh = jh2bh(jh);
+ 
+-	J_ASSERT_JH(jh, jbd_is_locked_bh_state(bh));
++	J_ASSERT_JH_SMP(jh, jbd_is_locked_bh_state(bh));
+ 	transaction = jh->b_transaction;
+ 	if (transaction)
+ 		assert_spin_locked(&transaction->t_journal->j_list_lock);
+@@ -1884,7 +1884,7 @@
+ 	int was_dirty = 0;
+ 	struct buffer_head *bh = jh2bh(jh);
+ 
+-	J_ASSERT_JH(jh, jbd_is_locked_bh_state(bh));
++	J_ASSERT_JH_SMP(jh, jbd_is_locked_bh_state(bh));
+ 	assert_spin_locked(&transaction->t_journal->j_list_lock);
+ 
+ 	J_ASSERT_JH(jh, jh->b_jlist < BJ_Types);
+@@ -1972,7 +1972,7 @@
+ 	int was_dirty;
+ 	struct buffer_head *bh = jh2bh(jh);
+ 
+-	J_ASSERT_JH(jh, jbd_is_locked_bh_state(bh));
++	J_ASSERT_JH_SMP(jh, jbd_is_locked_bh_state(bh));
+ 	if (jh->b_transaction)
+ 		assert_spin_locked(&jh->b_transaction->t_journal->j_list_lock);
+ 
+Index: linux-rt-2.6.31/fs/namespace.c
+===================================================================
+--- linux-rt-2.6.31.orig/fs/namespace.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/fs/namespace.c	2010-05-17 14:23:20.038385913 +0200
+@@ -265,8 +265,16 @@
+ 	 * incremented count after it has set MNT_WRITE_HOLD.
+ 	 */
+ 	smp_mb();
+-	while (mnt->mnt_flags & MNT_WRITE_HOLD)
+-		cpu_relax();
++	preempt_enable();
++	/*
++	 * HACK ALERT. on RT we can not spin here with cpu_relax() and
++	 * preemption disabled so we block on the vfsmount lock which is
++	 * held by mnt_make_readonly(). Works on !RT as well.
++	 */
++	while (mnt->mnt_flags & MNT_WRITE_HOLD) {
++		spin_lock(&vfsmount_lock);
++		spin_unlock(&vfsmount_lock);
++	}
+ 	/*
+ 	 * After the slowpath clears MNT_WRITE_HOLD, mnt_is_readonly will
+ 	 * be set to match its requirements. So we must not load that until
+@@ -274,12 +282,11 @@
+ 	 */
+ 	smp_rmb();
+ 	if (__mnt_is_readonly(mnt)) {
++		preempt_disable();
+ 		dec_mnt_writers(mnt);
++		preempt_enable();
+ 		ret = -EROFS;
+-		goto out;
+ 	}
+-out:
+-	preempt_enable();
+ 	return ret;
+ }
+ EXPORT_SYMBOL_GPL(mnt_want_write);
+Index: linux-rt-2.6.31/fs/nilfs2/mdt.c
+===================================================================
+--- linux-rt-2.6.31.orig/fs/nilfs2/mdt.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/fs/nilfs2/mdt.c	2010-05-17 14:23:20.038385913 +0200
+@@ -501,7 +501,7 @@
+ 
+ 		spin_lock_init(&inode->i_lock);
+ 		mutex_init(&inode->i_mutex);
+-		init_rwsem(&inode->i_alloc_sem);
++		init_anon_rwsem(&inode->i_alloc_sem);
+ 
+ 		mapping->host = NULL;  /* instead of inode */
+ 		mapping->flags = 0;
+Index: linux-rt-2.6.31/fs/ntfs/aops.c
+===================================================================
+--- linux-rt-2.6.31.orig/fs/ntfs/aops.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/fs/ntfs/aops.c	2010-05-17 14:23:20.038385913 +0200
+@@ -29,6 +29,7 @@
+ #include <linux/buffer_head.h>
+ #include <linux/writeback.h>
+ #include <linux/bit_spinlock.h>
++#include <linux/interrupt.h>
+ 
+ #include "aops.h"
+ #include "attrib.h"
+@@ -107,8 +108,7 @@
+ 				"0x%llx.", (unsigned long long)bh->b_blocknr);
+ 	}
+ 	first = page_buffers(page);
+-	local_irq_save(flags);
+-	bit_spin_lock(BH_Uptodate_Lock, &first->b_state);
++	spin_lock_irqsave(&first->b_uptodate_lock, flags);
+ 	clear_buffer_async_read(bh);
+ 	unlock_buffer(bh);
+ 	tmp = bh;
+@@ -123,8 +123,7 @@
+ 		}
+ 		tmp = tmp->b_this_page;
+ 	} while (tmp != bh);
+-	bit_spin_unlock(BH_Uptodate_Lock, &first->b_state);
+-	local_irq_restore(flags);
++	spin_unlock_irqrestore(&first->b_uptodate_lock, flags);
+ 	/*
+ 	 * If none of the buffers had errors then we can set the page uptodate,
+ 	 * but we first have to perform the post read mst fixups, if the
+@@ -145,13 +144,13 @@
+ 		recs = PAGE_CACHE_SIZE / rec_size;
+ 		/* Should have been verified before we got here... */
+ 		BUG_ON(!recs);
+-		local_irq_save(flags);
++		local_irq_save_nort(flags);
+ 		kaddr = kmap_atomic(page, KM_BIO_SRC_IRQ);
+ 		for (i = 0; i < recs; i++)
+ 			post_read_mst_fixup((NTFS_RECORD*)(kaddr +
+ 					i * rec_size), rec_size);
+ 		kunmap_atomic(kaddr, KM_BIO_SRC_IRQ);
+-		local_irq_restore(flags);
++		local_irq_restore_nort(flags);
+ 		flush_dcache_page(page);
+ 		if (likely(page_uptodate && !PageError(page)))
+ 			SetPageUptodate(page);
+@@ -159,8 +158,7 @@
+ 	unlock_page(page);
+ 	return;
+ still_busy:
+-	bit_spin_unlock(BH_Uptodate_Lock, &first->b_state);
+-	local_irq_restore(flags);
++	spin_unlock_irqrestore(&first->b_uptodate_lock, flags);
+ 	return;
+ }
+ 
+Index: linux-rt-2.6.31/fs/ntfs/file.c
+===================================================================
+--- linux-rt-2.6.31.orig/fs/ntfs/file.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/fs/ntfs/file.c	2010-05-17 14:23:20.038385913 +0200
+@@ -1845,9 +1845,9 @@
+ 	 * fails again.
+ 	 */
+ 	if (unlikely(NInoTruncateFailed(ni))) {
+-		down_write(&vi->i_alloc_sem);
++		anon_down_write(&vi->i_alloc_sem);
+ 		err = ntfs_truncate(vi);
+-		up_write(&vi->i_alloc_sem);
++		anon_up_write(&vi->i_alloc_sem);
+ 		if (err || NInoTruncateFailed(ni)) {
+ 			if (!err)
+ 				err = -EIO;
+Index: linux-rt-2.6.31/fs/ocfs2/aops.c
+===================================================================
+--- linux-rt-2.6.31.orig/fs/ocfs2/aops.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/fs/ocfs2/aops.c	2010-05-17 14:23:20.038385913 +0200
+@@ -643,7 +643,7 @@
+ 
+ 	level = ocfs2_iocb_rw_locked_level(iocb);
+ 	if (!level)
+-		up_read(&inode->i_alloc_sem);
++		anon_up_read(&inode->i_alloc_sem);
+ 	ocfs2_rw_unlock(inode, level);
+ }
+ 
+Index: linux-rt-2.6.31/fs/ocfs2/file.c
+===================================================================
+--- linux-rt-2.6.31.orig/fs/ocfs2/file.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/fs/ocfs2/file.c	2010-05-17 14:23:20.038385913 +0200
+@@ -1799,7 +1799,7 @@
+ relock:
+ 	/* to match setattr's i_mutex -> i_alloc_sem -> rw_lock ordering */
+ 	if (direct_io) {
+-		down_read(&inode->i_alloc_sem);
++		anon_down_read(&inode->i_alloc_sem);
+ 		have_alloc_sem = 1;
+ 	}
+ 
+@@ -1826,7 +1826,7 @@
+ 	 */
+ 	if (direct_io && !can_do_direct) {
+ 		ocfs2_rw_unlock(inode, rw_level);
+-		up_read(&inode->i_alloc_sem);
++		anon_up_read(&inode->i_alloc_sem);
+ 
+ 		have_alloc_sem = 0;
+ 		rw_level = -1;
+@@ -1915,7 +1915,7 @@
+ 
+ out_sems:
+ 	if (have_alloc_sem)
+-		up_read(&inode->i_alloc_sem);
++		anon_up_read(&inode->i_alloc_sem);
+ 
+ 	mutex_unlock(&inode->i_mutex);
+ 
+@@ -2079,7 +2079,7 @@
+ 	 * need locks to protect pending reads from racing with truncate.
+ 	 */
+ 	if (filp->f_flags & O_DIRECT) {
+-		down_read(&inode->i_alloc_sem);
++		anon_down_read(&inode->i_alloc_sem);
+ 		have_alloc_sem = 1;
+ 
+ 		ret = ocfs2_rw_lock(inode, 0);
+@@ -2123,7 +2123,7 @@
+ 
+ bail:
+ 	if (have_alloc_sem)
+-		up_read(&inode->i_alloc_sem);
++		anon_up_read(&inode->i_alloc_sem);
+ 	if (rw_level != -1) 
+ 		ocfs2_rw_unlock(inode, rw_level);
+ 	mlog_exit(ret);
+Index: linux-rt-2.6.31/fs/pipe.c
+===================================================================
+--- linux-rt-2.6.31.orig/fs/pipe.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/fs/pipe.c	2010-05-17 14:23:20.038385913 +0200
+@@ -434,8 +434,14 @@
+ 		wake_up_interruptible_sync(&pipe->wait);
+ 		kill_fasync(&pipe->fasync_writers, SIGIO, POLL_OUT);
+ 	}
++	/*
++	 * Hack: we turn off atime updates for -RT kernels.
++	 * Who uses them on pipes anyway?
++	 */
++#ifndef CONFIG_PREEMPT_RT
+ 	if (ret > 0)
+ 		file_accessed(filp);
++#endif
+ 	return ret;
+ }
+ 
+@@ -607,8 +613,14 @@
+ 		wake_up_interruptible_sync(&pipe->wait);
+ 		kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
+ 	}
++	/*
++	 * Hack: we turn off atime updates for -RT kernels.
++	 * Who uses them on pipes anyway?
++	 */
++#ifndef CONFIG_PREEMPT_RT
+ 	if (ret > 0)
+ 		file_update_time(filp);
++#endif
+ 	return ret;
+ }
+ 
+Index: linux-rt-2.6.31/fs/proc/array.c
+===================================================================
+--- linux-rt-2.6.31.orig/fs/proc/array.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/fs/proc/array.c	2010-05-17 14:23:20.038385913 +0200
+@@ -128,18 +128,22 @@
+ 
+ /*
+  * The task state array is a strange "bitmap" of
+- * reasons to sleep. Thus "running" is zero, and
+- * you can test for combinations of others with
++ * reasons to sleep. Thus, the first element is zero,
++ * and you can test for combinations of others with
+  * simple bit tests.
+  */
++#define TASK_STATE_X(num) TASK_STATE_##num " (" DESCR_TASK_STATE_##num ")"
+ static const char *task_state_array[] = {
+-	"R (running)",		/*  0 */
+-	"S (sleeping)",		/*  1 */
+-	"D (disk sleep)",	/*  2 */
+-	"T (stopped)",		/*  4 */
+-	"T (tracing stop)",	/*  8 */
+-	"Z (zombie)",		/* 16 */
+-	"X (dead)"		/* 32 */
++	TASK_STATE_X(0),
++	TASK_STATE_X(1),
++	TASK_STATE_X(2),
++	TASK_STATE_X(4),
++	TASK_STATE_X(8),
++	TASK_STATE_X(16),
++	TASK_STATE_X(32),
++	TASK_STATE_X(64),
++	TASK_STATE_X(128),
++	TASK_STATE_X(256)
+ };
+ 
+ static inline const char *get_task_state(struct task_struct *tsk)
+@@ -264,7 +268,9 @@
+ 		blocked = p->blocked;
+ 		collect_sigign_sigcatch(p, &ignored, &caught);
+ 		num_threads = atomic_read(&p->signal->count);
++		rcu_read_lock();
+ 		qsize = atomic_read(&__task_cred(p)->user->sigpending);
++		rcu_read_unlock();
+ 		qlim = p->signal->rlim[RLIMIT_SIGPENDING].rlim_cur;
+ 		unlock_task_sighand(p, &flags);
+ 	}
+@@ -321,6 +327,19 @@
+ 			p->nivcsw);
+ }
+ 
++#define get_blocked_on(t)	(-1)
++
++static inline void show_blocked_on(struct seq_file *m, struct task_struct *p)
++{
++	pid_t pid = get_blocked_on(p);
++
++	if (pid < 0)
++		return;
++
++	seq_printf(m, "BlckOn: %d\n", pid);
++}
++
++
+ int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
+ 			struct pid *pid, struct task_struct *task)
+ {
+@@ -340,6 +359,7 @@
+ 	task_show_regs(m, task);
+ #endif
+ 	task_context_switch_counts(m, task);
++	show_blocked_on(m, task);
+ 	return 0;
+ }
+ 
+Index: linux-rt-2.6.31/fs/proc/stat.c
+===================================================================
+--- linux-rt-2.6.31.orig/fs/proc/stat.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/fs/proc/stat.c	2010-05-17 14:23:20.038385913 +0200
+@@ -27,14 +27,14 @@
+ 	int i, j;
+ 	unsigned long jif;
+ 	cputime64_t user, nice, system, idle, iowait, irq, softirq, steal;
+-	cputime64_t guest;
++	cputime64_t guest, user_rt, system_rt;
+ 	u64 sum = 0;
+ 	u64 sum_softirq = 0;
+ 	unsigned int per_softirq_sums[NR_SOFTIRQS] = {0};
+ 	struct timespec boottime;
+ 	unsigned int per_irq_sum;
+ 
+-	user = nice = system = idle = iowait =
++	user_rt = system_rt = user = nice = system = idle = iowait =
+ 		irq = softirq = steal = cputime64_zero;
+ 	guest = cputime64_zero;
+ 	getboottime(&boottime);
+@@ -50,6 +50,8 @@
+ 		irq = cputime64_add(irq, kstat_cpu(i).cpustat.irq);
+ 		softirq = cputime64_add(softirq, kstat_cpu(i).cpustat.softirq);
+ 		steal = cputime64_add(steal, kstat_cpu(i).cpustat.steal);
++		user_rt = cputime64_add(user_rt, kstat_cpu(i).cpustat.user_rt);
++		system_rt = cputime64_add(system_rt, kstat_cpu(i).cpustat.system_rt);
+ 		guest = cputime64_add(guest, kstat_cpu(i).cpustat.guest);
+ 		for_each_irq_nr(j) {
+ 			sum += kstat_irqs_cpu(j, i);
+@@ -65,7 +67,10 @@
+ 	}
+ 	sum += arch_irq_stat();
+ 
+-	seq_printf(p, "cpu  %llu %llu %llu %llu %llu %llu %llu %llu %llu\n",
++	user = cputime64_add(user_rt, user);
++	system = cputime64_add(system_rt, system);
++
++	seq_printf(p, "cpu  %llu %llu %llu %llu %llu %llu %llu %llu %llu %llu %llu\n",
+ 		(unsigned long long)cputime64_to_clock_t(user),
+ 		(unsigned long long)cputime64_to_clock_t(nice),
+ 		(unsigned long long)cputime64_to_clock_t(system),
+@@ -74,13 +79,17 @@
+ 		(unsigned long long)cputime64_to_clock_t(irq),
+ 		(unsigned long long)cputime64_to_clock_t(softirq),
+ 		(unsigned long long)cputime64_to_clock_t(steal),
++		(unsigned long long)cputime64_to_clock_t(user_rt),
++		(unsigned long long)cputime64_to_clock_t(system_rt),
+ 		(unsigned long long)cputime64_to_clock_t(guest));
+ 	for_each_online_cpu(i) {
+ 
+ 		/* Copy values here to work around gcc-2.95.3, gcc-2.96 */
+-		user = kstat_cpu(i).cpustat.user;
++		user_rt = kstat_cpu(i).cpustat.user_rt;
++		system_rt = kstat_cpu(i).cpustat.system_rt;
++		user = cputime64_add(user_rt, kstat_cpu(i).cpustat.user);
+ 		nice = kstat_cpu(i).cpustat.nice;
+-		system = kstat_cpu(i).cpustat.system;
++ 		system = cputime64_add(system_rt, kstat_cpu(i).cpustat.system);
+ 		idle = kstat_cpu(i).cpustat.idle;
+ 		idle = cputime64_add(idle, arch_idle_time(i));
+ 		iowait = kstat_cpu(i).cpustat.iowait;
+@@ -89,7 +98,7 @@
+ 		steal = kstat_cpu(i).cpustat.steal;
+ 		guest = kstat_cpu(i).cpustat.guest;
+ 		seq_printf(p,
+-			"cpu%d %llu %llu %llu %llu %llu %llu %llu %llu %llu\n",
++			"cpu%d %llu %llu %llu %llu %llu %llu %llu %llu %llu %llu %llu\n",
+ 			i,
+ 			(unsigned long long)cputime64_to_clock_t(user),
+ 			(unsigned long long)cputime64_to_clock_t(nice),
+@@ -99,6 +108,8 @@
+ 			(unsigned long long)cputime64_to_clock_t(irq),
+ 			(unsigned long long)cputime64_to_clock_t(softirq),
+ 			(unsigned long long)cputime64_to_clock_t(steal),
++			(unsigned long long)cputime64_to_clock_t(user_rt),
++			(unsigned long long)cputime64_to_clock_t(system_rt),
+ 			(unsigned long long)cputime64_to_clock_t(guest));
+ 	}
+ 	seq_printf(p, "intr %llu", (unsigned long long)sum);
+Index: linux-rt-2.6.31/fs/proc/task_mmu.c
+===================================================================
+--- linux-rt-2.6.31.orig/fs/proc/task_mmu.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/fs/proc/task_mmu.c	2010-05-17 14:23:20.038385913 +0200
+@@ -138,8 +138,10 @@
+ 	vma = NULL;
+ 	if ((unsigned long)l < mm->map_count) {
+ 		vma = mm->mmap;
+-		while (l-- && vma)
++		while (l-- && vma) {
+ 			vma = vma->vm_next;
++			cond_resched();
++		}
+ 		goto out;
+ 	}
+ 
+Index: linux-rt-2.6.31/fs/reiserfs/xattr.c
+===================================================================
+--- linux-rt-2.6.31.orig/fs/reiserfs/xattr.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/fs/reiserfs/xattr.c	2010-05-17 14:23:20.038385913 +0200
+@@ -540,9 +540,9 @@
+ 			.ia_valid = ATTR_SIZE | ATTR_CTIME,
+ 		};
+ 		mutex_lock_nested(&dentry->d_inode->i_mutex, I_MUTEX_XATTR);
+-		down_write(&dentry->d_inode->i_alloc_sem);
++		anon_down_write(&dentry->d_inode->i_alloc_sem);
+ 		err = reiserfs_setattr(dentry, &newattrs);
+-		up_write(&dentry->d_inode->i_alloc_sem);
++		anon_up_write(&dentry->d_inode->i_alloc_sem);
+ 		mutex_unlock(&dentry->d_inode->i_mutex);
+ 	} else
+ 		update_ctime(inode);
+Index: linux-rt-2.6.31/fs/smbfs/inode.c
+===================================================================
+--- linux-rt-2.6.31.orig/fs/smbfs/inode.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/fs/smbfs/inode.c	2010-05-17 14:23:20.038385913 +0200
+@@ -536,7 +536,7 @@
+ 	server->mnt = NULL;
+ 	server->sock_file = NULL;
+ 	init_waitqueue_head(&server->conn_wq);
+-	init_MUTEX(&server->sem);
++	mutex_init(&server->mutex);
+ 	INIT_LIST_HEAD(&server->entry);
+ 	INIT_LIST_HEAD(&server->xmitq);
+ 	INIT_LIST_HEAD(&server->recvq);
+Index: linux-rt-2.6.31/fs/xfs/linux-2.6/mrlock.h
+===================================================================
+--- linux-rt-2.6.31.orig/fs/xfs/linux-2.6/mrlock.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/fs/xfs/linux-2.6/mrlock.h	2010-05-17 14:23:20.038385913 +0200
+@@ -21,7 +21,7 @@
+ #include <linux/rwsem.h>
+ 
+ typedef struct {
+-	struct rw_semaphore	mr_lock;
++	struct rw_anon_semaphore	mr_lock;
+ #ifdef DEBUG
+ 	int			mr_writer;
+ #endif
+@@ -29,10 +29,10 @@
+ 
+ #ifdef DEBUG
+ #define mrinit(mrp, name)	\
+-	do { (mrp)->mr_writer = 0; init_rwsem(&(mrp)->mr_lock); } while (0)
++	do { (mrp)->mr_writer = 0; init_anon_rwsem(&(mrp)->mr_lock); } while (0)
+ #else
+ #define mrinit(mrp, name)	\
+-	do { init_rwsem(&(mrp)->mr_lock); } while (0)
++	do { init_anon_rwsem(&(mrp)->mr_lock); } while (0)
+ #endif
+ 
+ #define mrlock_init(mrp, t,n,s)	mrinit(mrp, n)
+@@ -40,12 +40,12 @@
+ 
+ static inline void mraccess_nested(mrlock_t *mrp, int subclass)
+ {
+-	down_read_nested(&mrp->mr_lock, subclass);
++	anon_down_read_nested(&mrp->mr_lock, subclass);
+ }
+ 
+ static inline void mrupdate_nested(mrlock_t *mrp, int subclass)
+ {
+-	down_write_nested(&mrp->mr_lock, subclass);
++	anon_down_write_nested(&mrp->mr_lock, subclass);
+ #ifdef DEBUG
+ 	mrp->mr_writer = 1;
+ #endif
+@@ -53,12 +53,12 @@
+ 
+ static inline int mrtryaccess(mrlock_t *mrp)
+ {
+-	return down_read_trylock(&mrp->mr_lock);
++	return anon_down_read_trylock(&mrp->mr_lock);
+ }
+ 
+ static inline int mrtryupdate(mrlock_t *mrp)
+ {
+-	if (!down_write_trylock(&mrp->mr_lock))
++	if (!anon_down_write_trylock(&mrp->mr_lock))
+ 		return 0;
+ #ifdef DEBUG
+ 	mrp->mr_writer = 1;
+@@ -71,12 +71,12 @@
+ #ifdef DEBUG
+ 	mrp->mr_writer = 0;
+ #endif
+-	up_write(&mrp->mr_lock);
++	anon_up_write(&mrp->mr_lock);
+ }
+ 
+ static inline void mrunlock_shared(mrlock_t *mrp)
+ {
+-	up_read(&mrp->mr_lock);
++	anon_up_read(&mrp->mr_lock);
+ }
+ 
+ static inline void mrdemote(mrlock_t *mrp)
+@@ -84,7 +84,7 @@
+ #ifdef DEBUG
+ 	mrp->mr_writer = 0;
+ #endif
+-	downgrade_write(&mrp->mr_lock);
++	anon_downgrade_write(&mrp->mr_lock);
+ }
+ 
+ #endif /* __XFS_SUPPORT_MRLOCK_H__ */
+Index: linux-rt-2.6.31/fs/xfs/linux-2.6/xfs_buf.c
+===================================================================
+--- linux-rt-2.6.31.orig/fs/xfs/linux-2.6/xfs_buf.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/fs/xfs/linux-2.6/xfs_buf.c	2010-05-17 14:23:20.038385913 +0200
+@@ -263,7 +263,7 @@
+ 	init_completion(&bp->b_iowait);
+ 	INIT_LIST_HEAD(&bp->b_list);
+ 	INIT_LIST_HEAD(&bp->b_hash_list);
+-	init_MUTEX_LOCKED(&bp->b_sema); /* held, no waiters */
++	anon_semaphore_init_locked(&bp->b_sema); /* held, no waiters */
+ 	XB_SET_OWNER(bp);
+ 	bp->b_target = target;
+ 	bp->b_file_offset = range_base;
+@@ -545,7 +545,7 @@
+ 	 * if this does not work then we need to drop the
+ 	 * spinlock and do a hard attempt on the semaphore.
+ 	 */
+-	if (down_trylock(&bp->b_sema)) {
++	if (anon_down_trylock(&bp->b_sema)) {
+ 		if (!(flags & XBF_TRYLOCK)) {
+ 			/* wait for buffer ownership */
+ 			XB_TRACE(bp, "get_lock", 0);
+@@ -908,7 +908,7 @@
+ {
+ 	int			locked;
+ 
+-	locked = down_trylock(&bp->b_sema) == 0;
++	locked = anon_down_trylock(&bp->b_sema) == 0;
+ 	if (locked) {
+ 		XB_SET_OWNER(bp);
+ 	}
+@@ -938,7 +938,7 @@
+ 	XB_TRACE(bp, "lock", 0);
+ 	if (atomic_read(&bp->b_io_remaining))
+ 		blk_run_address_space(bp->b_target->bt_mapping);
+-	down(&bp->b_sema);
++	anon_down(&bp->b_sema);
+ 	XB_SET_OWNER(bp);
+ 	XB_TRACE(bp, "locked", 0);
+ }
+@@ -961,7 +961,7 @@
+ 	}
+ 
+ 	XB_CLEAR_OWNER(bp);
+-	up(&bp->b_sema);
++	anon_up(&bp->b_sema);
+ 	XB_TRACE(bp, "unlock", 0);
+ }
+ 
+Index: linux-rt-2.6.31/fs/xfs/linux-2.6/xfs_buf.h
+===================================================================
+--- linux-rt-2.6.31.orig/fs/xfs/linux-2.6/xfs_buf.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/fs/xfs/linux-2.6/xfs_buf.h	2010-05-17 14:23:20.038385913 +0200
+@@ -145,7 +145,7 @@
+ #define XB_PAGES	2
+ 
+ typedef struct xfs_buf {
+-	struct semaphore	b_sema;		/* semaphore for lockables */
++	struct anon_semaphore	b_sema;		/* semaphore for lockables */
+ 	unsigned long		b_queuetime;	/* time buffer was queued */
+ 	atomic_t		b_pin_count;	/* pin count */
+ 	wait_queue_head_t	b_waiters;	/* unpin waiters */
+Index: linux-rt-2.6.31/fs/xfs/xfs_alloc.c
+===================================================================
+--- linux-rt-2.6.31.orig/fs/xfs/xfs_alloc.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/fs/xfs/xfs_alloc.c	2010-05-17 14:23:20.038385913 +0200
+@@ -2412,7 +2412,7 @@
+ 		 * These three force us into a single a.g.
+ 		 */
+ 		args->agno = XFS_FSB_TO_AGNO(mp, args->fsbno);
+-		down_read(&mp->m_peraglock);
++		anon_down_read(&mp->m_peraglock);
+ 		args->pag = &mp->m_perag[args->agno];
+ 		args->minleft = 0;
+ 		error = xfs_alloc_fix_freelist(args, 0);
+@@ -2422,14 +2422,14 @@
+ 			goto error0;
+ 		}
+ 		if (!args->agbp) {
+-			up_read(&mp->m_peraglock);
++			anon_up_read(&mp->m_peraglock);
+ 			TRACE_ALLOC("noagbp", args);
+ 			break;
+ 		}
+ 		args->agbno = XFS_FSB_TO_AGBNO(mp, args->fsbno);
+ 		if ((error = xfs_alloc_ag_vextent(args)))
+ 			goto error0;
+-		up_read(&mp->m_peraglock);
++		anon_up_read(&mp->m_peraglock);
+ 		break;
+ 	case XFS_ALLOCTYPE_START_BNO:
+ 		/*
+@@ -2481,7 +2481,7 @@
+ 		 * Loop over allocation groups twice; first time with
+ 		 * trylock set, second time without.
+ 		 */
+-		down_read(&mp->m_peraglock);
++		anon_down_read(&mp->m_peraglock);
+ 		for (;;) {
+ 			args->pag = &mp->m_perag[args->agno];
+ 			if (no_min) args->minleft = 0;
+@@ -2541,7 +2541,7 @@
+ 				}
+ 			}
+ 		}
+-		up_read(&mp->m_peraglock);
++		anon_up_read(&mp->m_peraglock);
+ 		if (bump_rotor || (type == XFS_ALLOCTYPE_ANY_AG)) {
+ 			if (args->agno == sagno)
+ 				mp->m_agfrotor = (mp->m_agfrotor + 1) %
+@@ -2569,7 +2569,7 @@
+ 	}
+ 	return 0;
+ error0:
+-	up_read(&mp->m_peraglock);
++	anon_up_read(&mp->m_peraglock);
+ 	return error;
+ }
+ 
+@@ -2594,7 +2594,7 @@
+ 	args.agno = XFS_FSB_TO_AGNO(args.mp, bno);
+ 	ASSERT(args.agno < args.mp->m_sb.sb_agcount);
+ 	args.agbno = XFS_FSB_TO_AGBNO(args.mp, bno);
+-	down_read(&args.mp->m_peraglock);
++	anon_down_read(&args.mp->m_peraglock);
+ 	args.pag = &args.mp->m_perag[args.agno];
+ 	if ((error = xfs_alloc_fix_freelist(&args, XFS_ALLOC_FLAG_FREEING)))
+ 		goto error0;
+@@ -2605,7 +2605,7 @@
+ #endif
+ 	error = xfs_free_ag_extent(tp, args.agbp, args.agno, args.agbno, len, 0);
+ error0:
+-	up_read(&args.mp->m_peraglock);
++	anon_up_read(&args.mp->m_peraglock);
+ 	return error;
+ }
+ 
+Index: linux-rt-2.6.31/fs/xfs/xfs_bmap.c
+===================================================================
+--- linux-rt-2.6.31.orig/fs/xfs/xfs_bmap.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/fs/xfs/xfs_bmap.c	2010-05-17 14:23:20.038385913 +0200
+@@ -2780,13 +2780,13 @@
+ 		if (startag == NULLAGNUMBER)
+ 			startag = ag = 0;
+ 		notinit = 0;
+-		down_read(&mp->m_peraglock);
++		anon_down_read(&mp->m_peraglock);
+ 		while (blen < ap->alen) {
+ 			pag = &mp->m_perag[ag];
+ 			if (!pag->pagf_init &&
+ 			    (error = xfs_alloc_pagf_init(mp, args.tp,
+ 				    ag, XFS_ALLOC_FLAG_TRYLOCK))) {
+-				up_read(&mp->m_peraglock);
++				anon_up_read(&mp->m_peraglock);
+ 				return error;
+ 			}
+ 			/*
+@@ -2819,7 +2819,7 @@
+ 
+ 					error = xfs_filestream_new_ag(ap, &ag);
+ 					if (error) {
+-						up_read(&mp->m_peraglock);
++						anon_up_read(&mp->m_peraglock);
+ 						return error;
+ 					}
+ 
+@@ -2833,7 +2833,7 @@
+ 			if (ag == startag)
+ 				break;
+ 		}
+-		up_read(&mp->m_peraglock);
++		anon_up_read(&mp->m_peraglock);
+ 		/*
+ 		 * Since the above loop did a BUF_TRYLOCK, it is
+ 		 * possible that there is space for this request.
+Index: linux-rt-2.6.31/fs/xfs/xfs_filestream.c
+===================================================================
+--- linux-rt-2.6.31.orig/fs/xfs/xfs_filestream.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/fs/xfs/xfs_filestream.c	2010-05-17 14:23:20.048474346 +0200
+@@ -530,7 +530,7 @@
+ 
+ 	mp = pip->i_mount;
+ 	cache = mp->m_filestream;
+-	down_read(&mp->m_peraglock);
++	anon_down_read(&mp->m_peraglock);
+ 
+ 	/*
+ 	 * We have a problem, Houston.
+@@ -548,7 +548,7 @@
+ 	 * So, if we can't get the iolock without sleeping then just give up
+ 	 */
+ 	if (!xfs_ilock_nowait(pip, XFS_IOLOCK_EXCL)) {
+-		up_read(&mp->m_peraglock);
++		anon_up_read(&mp->m_peraglock);
+ 		return 1;
+ 	}
+ 
+@@ -605,7 +605,7 @@
+ 
+ exit:
+ 	xfs_iunlock(pip, XFS_IOLOCK_EXCL);
+-	up_read(&mp->m_peraglock);
++	anon_up_read(&mp->m_peraglock);
+ 	return -err;
+ }
+ 
+Index: linux-rt-2.6.31/fs/xfs/xfs_fsops.c
+===================================================================
+--- linux-rt-2.6.31.orig/fs/xfs/xfs_fsops.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/fs/xfs/xfs_fsops.c	2010-05-17 14:23:20.048474346 +0200
+@@ -176,16 +176,17 @@
+ 		if (!new_perag)
+ 			return XFS_ERROR(ENOMEM);
+ 
+-		down_write(&mp->m_peraglock);
++		anon_down_write(&mp->m_peraglock);
+ 		memcpy(new_perag, mp->m_perag, sizeof(xfs_perag_t) * oagcount);
+ 		old_perag = mp->m_perag;
+ 		mp->m_perag = new_perag;
+ 
+ 		mp->m_flags |= XFS_MOUNT_32BITINODES;
+ 		nagimax = xfs_initialize_perag(mp, nagcount);
+-		up_write(&mp->m_peraglock);
++		anon_up_write(&mp->m_peraglock);
+ 
+ 		kmem_free(old_perag);
++
+ 	}
+ 	tp = xfs_trans_alloc(mp, XFS_TRANS_GROWFS);
+ 	tp->t_flags |= XFS_TRANS_RESERVE;
+Index: linux-rt-2.6.31/fs/xfs/xfs_ialloc.c
+===================================================================
+--- linux-rt-2.6.31.orig/fs/xfs/xfs_ialloc.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/fs/xfs/xfs_ialloc.c	2010-05-17 14:23:20.048474346 +0200
+@@ -369,9 +369,9 @@
+ 	be32_add_cpu(&agi->agi_count, newlen);
+ 	be32_add_cpu(&agi->agi_freecount, newlen);
+ 	agno = be32_to_cpu(agi->agi_seqno);
+-	down_read(&args.mp->m_peraglock);
++	anon_down_read(&args.mp->m_peraglock);
+ 	args.mp->m_perag[agno].pagi_freecount += newlen;
+-	up_read(&args.mp->m_peraglock);
++	anon_up_read(&args.mp->m_peraglock);
+ 	agi->agi_newino = cpu_to_be32(newino);
+ 	/*
+ 	 * Insert records describing the new inode chunk into the btree.
+@@ -468,7 +468,7 @@
+ 	 */
+ 	agno = pagno;
+ 	flags = XFS_ALLOC_FLAG_TRYLOCK;
+-	down_read(&mp->m_peraglock);
++	anon_down_read(&mp->m_peraglock);
+ 	for (;;) {
+ 		pag = &mp->m_perag[agno];
+ 		if (!pag->pagi_init) {
+@@ -509,7 +509,7 @@
+ 					agbp = NULL;
+ 					goto nextag;
+ 				}
+-				up_read(&mp->m_peraglock);
++				anon_up_read(&mp->m_peraglock);
+ 				return agbp;
+ 			}
+ 		}
+@@ -522,7 +522,7 @@
+ 		 * down.
+ 		 */
+ 		if (XFS_FORCED_SHUTDOWN(mp)) {
+-			up_read(&mp->m_peraglock);
++			anon_up_read(&mp->m_peraglock);
+ 			return NULL;
+ 		}
+ 		agno++;
+@@ -530,7 +530,7 @@
+ 			agno = 0;
+ 		if (agno == pagno) {
+ 			if (flags == 0) {
+-				up_read(&mp->m_peraglock);
++				anon_up_read(&mp->m_peraglock);
+ 				return NULL;
+ 			}
+ 			flags = 0;
+@@ -697,13 +697,13 @@
+ 			*inop = NULLFSINO;
+ 			return noroom ? ENOSPC : 0;
+ 		}
+-		down_read(&mp->m_peraglock);
++		anon_down_read(&mp->m_peraglock);
+ 		if (mp->m_perag[tagno].pagi_inodeok == 0) {
+-			up_read(&mp->m_peraglock);
++			anon_up_read(&mp->m_peraglock);
+ 			goto nextag;
+ 		}
+ 		error = xfs_ialloc_read_agi(mp, tp, tagno, &agbp);
+-		up_read(&mp->m_peraglock);
++		anon_up_read(&mp->m_peraglock);
+ 		if (error)
+ 			goto nextag;
+ 		agi = XFS_BUF_TO_AGI(agbp);
+@@ -950,9 +950,9 @@
+ 		goto error0;
+ 	be32_add_cpu(&agi->agi_freecount, -1);
+ 	xfs_ialloc_log_agi(tp, agbp, XFS_AGI_FREECOUNT);
+-	down_read(&mp->m_peraglock);
++	anon_down_read(&mp->m_peraglock);
+ 	mp->m_perag[tagno].pagi_freecount--;
+-	up_read(&mp->m_peraglock);
++	anon_up_read(&mp->m_peraglock);
+ #ifdef DEBUG
+ 	if (cur->bc_nlevels == 1) {
+ 		int	freecount = 0;
+@@ -1046,9 +1046,9 @@
+ 	/*
+ 	 * Get the allocation group header.
+ 	 */
+-	down_read(&mp->m_peraglock);
++	anon_down_read(&mp->m_peraglock);
+ 	error = xfs_ialloc_read_agi(mp, tp, agno, &agbp);
+-	up_read(&mp->m_peraglock);
++	anon_up_read(&mp->m_peraglock);
+ 	if (error) {
+ 		cmn_err(CE_WARN,
+ 			"xfs_difree: xfs_ialloc_read_agi() returned an error %d on %s.  Returning error.",
+@@ -1130,9 +1130,9 @@
+ 		be32_add_cpu(&agi->agi_count, -ilen);
+ 		be32_add_cpu(&agi->agi_freecount, -(ilen - 1));
+ 		xfs_ialloc_log_agi(tp, agbp, XFS_AGI_COUNT | XFS_AGI_FREECOUNT);
+-		down_read(&mp->m_peraglock);
++		anon_down_read(&mp->m_peraglock);
+ 		mp->m_perag[agno].pagi_freecount -= ilen - 1;
+-		up_read(&mp->m_peraglock);
++		anon_up_read(&mp->m_peraglock);
+ 		xfs_trans_mod_sb(tp, XFS_TRANS_SB_ICOUNT, -ilen);
+ 		xfs_trans_mod_sb(tp, XFS_TRANS_SB_IFREE, -(ilen - 1));
+ 
+@@ -1159,9 +1159,9 @@
+ 		 */
+ 		be32_add_cpu(&agi->agi_freecount, 1);
+ 		xfs_ialloc_log_agi(tp, agbp, XFS_AGI_FREECOUNT);
+-		down_read(&mp->m_peraglock);
++		anon_down_read(&mp->m_peraglock);
+ 		mp->m_perag[agno].pagi_freecount++;
+-		up_read(&mp->m_peraglock);
++		anon_up_read(&mp->m_peraglock);
+ 		xfs_trans_mod_sb(tp, XFS_TRANS_SB_IFREE, 1);
+ 	}
+ 
+@@ -1303,9 +1303,9 @@
+ 		xfs_buf_t	*agbp;	/* agi buffer */
+ 		int		i;	/* temp state */
+ 
+-		down_read(&mp->m_peraglock);
++		anon_down_read(&mp->m_peraglock);
+ 		error = xfs_ialloc_read_agi(mp, tp, agno, &agbp);
+-		up_read(&mp->m_peraglock);
++		anon_up_read(&mp->m_peraglock);
+ 		if (error) {
+ 			xfs_fs_cmn_err(CE_ALERT, mp, "xfs_imap: "
+ 					"xfs_ialloc_read_agi() returned "
+Index: linux-rt-2.6.31/fs/xfs/xfs_itable.c
+===================================================================
+--- linux-rt-2.6.31.orig/fs/xfs/xfs_itable.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/fs/xfs/xfs_itable.c	2010-05-17 14:23:20.048474346 +0200
+@@ -418,9 +418,9 @@
+ 	while (XFS_BULKSTAT_UBLEFT(ubleft) && agno < mp->m_sb.sb_agcount) {
+ 		cond_resched();
+ 		bp = NULL;
+-		down_read(&mp->m_peraglock);
++		anon_down_read(&mp->m_peraglock);
+ 		error = xfs_ialloc_read_agi(mp, NULL, agno, &agbp);
+-		up_read(&mp->m_peraglock);
++		anon_up_read(&mp->m_peraglock);
+ 		if (error) {
+ 			/*
+ 			 * Skip this allocation group and go to the next one.
+@@ -840,9 +840,9 @@
+ 	agbp = NULL;
+ 	while (left > 0 && agno < mp->m_sb.sb_agcount) {
+ 		if (agbp == NULL) {
+-			down_read(&mp->m_peraglock);
++			anon_down_read(&mp->m_peraglock);
+ 			error = xfs_ialloc_read_agi(mp, NULL, agno, &agbp);
+-			up_read(&mp->m_peraglock);
++			anon_up_read(&mp->m_peraglock);
+ 			if (error) {
+ 				/*
+ 				 * If we can't read the AGI of this ag,
+Index: linux-rt-2.6.31/fs/xfs/xfs_mount.c
+===================================================================
+--- linux-rt-2.6.31.orig/fs/xfs/xfs_mount.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/fs/xfs/xfs_mount.c	2010-05-17 14:23:20.048474346 +0200
+@@ -1150,7 +1150,7 @@
+ 	/*
+ 	 * Allocate and initialize the per-ag data.
+ 	 */
+-	init_rwsem(&mp->m_peraglock);
++	init_anon_rwsem(&mp->m_peraglock);
+ 	mp->m_perag = kmem_zalloc(sbp->sb_agcount * sizeof(xfs_perag_t),
+ 				  KM_MAYFAIL);
+ 	if (!mp->m_perag)
+Index: linux-rt-2.6.31/fs/xfs/xfs_mount.h
+===================================================================
+--- linux-rt-2.6.31.orig/fs/xfs/xfs_mount.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/fs/xfs/xfs_mount.h	2010-05-17 14:23:20.048474346 +0200
+@@ -193,7 +193,7 @@
+ 	uint			m_bm_maxlevels[2]; /* XFS_BM_MAXLEVELS */
+ 	uint			m_in_maxlevels;	/* max inobt btree levels. */
+ 	struct xfs_perag	*m_perag;	/* per-ag accounting info */
+-	struct rw_semaphore	m_peraglock;	/* lock for m_perag (pointer) */
++	struct rw_anon_semaphore	m_peraglock;	/* lock for m_perag (pointer) */
+ 	struct mutex		m_growlock;	/* growfs mutex */
+ 	int			m_fixedfsid[2];	/* unchanged for life of FS */
+ 	uint			m_dmevmask;	/* DMI events for this FS */
+Index: linux-rt-2.6.31/include/acpi/acpiosxf.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/acpi/acpiosxf.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/acpi/acpiosxf.h	2010-05-17 14:23:20.048474346 +0200
+@@ -61,7 +61,7 @@
+ 	OSL_EC_BURST_HANDLER
+ } acpi_execute_type;
+ 
+-#define ACPI_NO_UNIT_LIMIT          ((u32) -1)
++#define ACPI_NO_UNIT_LIMIT          (INT_MAX/2)
+ #define ACPI_MUTEX_SEM              1
+ 
+ /* Functions for acpi_os_signal */
+Index: linux-rt-2.6.31/include/asm-generic/bug.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/asm-generic/bug.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/asm-generic/bug.h	2010-05-17 14:23:20.048474346 +0200
+@@ -3,6 +3,10 @@
+ 
+ #include <linux/compiler.h>
+ 
++#ifndef __ASSEMBLY__
++extern void __WARN_ON(const char *func, const char *file, const int line);
++#endif /* __ASSEMBLY__ */
++
+ #ifdef CONFIG_BUG
+ 
+ #ifdef CONFIG_GENERIC_BUG
+@@ -141,4 +145,20 @@
+ # define WARN_ON_SMP(x)			do { } while (0)
+ #endif
+ 
++#ifdef CONFIG_PREEMPT_RT
++# define BUG_ON_RT(c)			BUG_ON(c)
++# define BUG_ON_NONRT(c)		do { } while (0)
++# define WARN_ON_RT(condition)		WARN_ON(condition)
++# define WARN_ON_NONRT(condition)	do { } while (0)
++# define WARN_ON_ONCE_NONRT(condition)	do { } while (0)
++# define WARN_ONCE_NONRT		do { } while (0)
++#else
++# define BUG_ON_RT(c)			do { } while (0)
++# define BUG_ON_NONRT(c)		BUG_ON(c)
++# define WARN_ON_RT(condition)		do { } while (0)
++# define WARN_ON_NONRT(condition)	WARN_ON(condition)
++# define WARN_ON_ONCE_NONRT(condition)	WARN_ON_ONCE(condition)
++# define WARN_ONCE_NONRT(cond, fmt...)	WARN_ONCE(cond, fmt)
++#endif
++
+ #endif
+Index: linux-rt-2.6.31/include/asm-generic/cmpxchg-local.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/asm-generic/cmpxchg-local.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/asm-generic/cmpxchg-local.h	2010-05-17 14:23:20.048474346 +0200
+@@ -20,7 +20,7 @@
+ 	if (size == 8 && sizeof(unsigned long) != 8)
+ 		wrong_size_cmpxchg(ptr);
+ 
+-	local_irq_save(flags);
++	raw_local_irq_save(flags);
+ 	switch (size) {
+ 	case 1: prev = *(u8 *)ptr;
+ 		if (prev == old)
+@@ -41,7 +41,7 @@
+ 	default:
+ 		wrong_size_cmpxchg(ptr);
+ 	}
+-	local_irq_restore(flags);
++	raw_local_irq_restore(flags);
+ 	return prev;
+ }
+ 
+@@ -54,11 +54,11 @@
+ 	u64 prev;
+ 	unsigned long flags;
+ 
+-	local_irq_save(flags);
++	raw_local_irq_save(flags);
+ 	prev = *(u64 *)ptr;
+ 	if (prev == old)
+ 		*(u64 *)ptr = new;
+-	local_irq_restore(flags);
++	raw_local_irq_restore(flags);
+ 	return prev;
+ }
+ 
+Index: linux-rt-2.6.31/include/asm-generic/percpu.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/asm-generic/percpu.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/asm-generic/percpu.h	2010-05-17 14:23:20.048474346 +0200
+@@ -5,6 +5,9 @@
+ #include <linux/threads.h>
+ #include <linux/percpu-defs.h>
+ 
++#define __per_cpu_var_lock(var)	per_cpu__lock_##var##_locked
++#define __per_cpu_var_lock_var(var) per_cpu__##var##_locked
++
+ #ifdef CONFIG_SMP
+ 
+ /*
+@@ -56,6 +59,14 @@
+ #define __raw_get_cpu_var(var) \
+ 	(*SHIFT_PERCPU_PTR(&per_cpu_var(var), __my_cpu_offset))
+ 
++#define per_cpu_lock(var, cpu) \
++	(*SHIFT_PERCPU_PTR(&__per_cpu_var_lock(var), per_cpu_offset(cpu)))
++#define per_cpu_var_locked(var, cpu) \
++	(*SHIFT_PERCPU_PTR(&__per_cpu_var_lock_var(var), per_cpu_offset(cpu)))
++#define __get_cpu_lock(var, cpu) \
++		per_cpu_lock(var, cpu)
++#define __get_cpu_var_locked(var, cpu) \
++		per_cpu_var_locked(var, cpu)
+ 
+ #ifdef CONFIG_HAVE_SETUP_PER_CPU_AREA
+ extern void setup_per_cpu_areas(void);
+@@ -64,9 +75,11 @@
+ #else /* ! SMP */
+ 
+ #define per_cpu(var, cpu)			(*((void)(cpu), &per_cpu_var(var)))
++#define per_cpu_var_locked(var, cpu)		(*((void)(cpu), &__per_cpu_var_lock_var(var)))
+ #define __get_cpu_var(var)			per_cpu_var(var)
+ #define __raw_get_cpu_var(var)			per_cpu_var(var)
+-
++#define __get_cpu_lock(var, cpu)		__per_cpu_var_lock(var)
++#define __get_cpu_var_locked(var, cpu)		__per_cpu_var_lock_var(var)
+ #endif	/* SMP */
+ 
+ #ifndef PER_CPU_BASE_SECTION
+Index: linux-rt-2.6.31/include/asm-generic/tlb.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/asm-generic/tlb.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/asm-generic/tlb.h	2010-05-17 14:23:20.048474346 +0200
+@@ -22,14 +22,8 @@
+  * and page free order so much..
+  */
+ #ifdef CONFIG_SMP
+-  #ifdef ARCH_FREE_PTR_NR
+-    #define FREE_PTR_NR   ARCH_FREE_PTR_NR
+-  #else
+-    #define FREE_PTE_NR	506
+-  #endif
+   #define tlb_fast_mode(tlb) ((tlb)->nr == ~0U)
+ #else
+-  #define FREE_PTE_NR	1
+   #define tlb_fast_mode(tlb) 1
+ #endif
+ 
+@@ -39,30 +33,48 @@
+ struct mmu_gather {
+ 	struct mm_struct	*mm;
+ 	unsigned int		nr;	/* set to ~0U means fast mode */
++	unsigned int		max; 	/* nr < max */
+ 	unsigned int		need_flush;/* Really unmapped some ptes? */
+ 	unsigned int		fullmm; /* non-zero means full mm flush */
+-	struct page *		pages[FREE_PTE_NR];
++#ifdef HAVE_ARCH_MMU_GATHER
++	struct arch_mmu_gather	arch;
++#endif
++	struct page **		pages;
++	struct page *		local[8];
+ };
+ 
+-/* Users of the generic TLB shootdown code must declare this storage space. */
+-DECLARE_PER_CPU(struct mmu_gather, mmu_gathers);
++static inline void __tlb_alloc_pages(struct mmu_gather *tlb)
++{
++	unsigned long addr = __get_free_pages(GFP_ATOMIC, 0);
++
++	if (addr) {
++		tlb->pages = (void *)addr;
++		tlb->max = PAGE_SIZE / sizeof(struct page *);
++	}
++}
+ 
+ /* tlb_gather_mmu
+  *	Return a pointer to an initialized struct mmu_gather.
+  */
+-static inline struct mmu_gather *
+-tlb_gather_mmu(struct mm_struct *mm, unsigned int full_mm_flush)
++static inline void
++tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm, unsigned int full_mm_flush)
+ {
+-	struct mmu_gather *tlb = &get_cpu_var(mmu_gathers);
+-
+ 	tlb->mm = mm;
+ 
+-	/* Use fast mode if only one CPU is online */
+-	tlb->nr = num_online_cpus() > 1 ? 0U : ~0U;
++	tlb->max = ARRAY_SIZE(tlb->local);
++	tlb->pages = tlb->local;
++
++	if (num_online_cpus() > 1) {
++		tlb->nr = 0;
++		__tlb_alloc_pages(tlb);
++	} else /* Use fast mode if only one CPU is online */
++		tlb->nr = ~0U;
+ 
+ 	tlb->fullmm = full_mm_flush;
+ 
+-	return tlb;
++#ifdef HAVE_ARCH_MMU_GATHER
++	tlb->arch = ARCH_MMU_GATHER_INIT;
++#endif
+ }
+ 
+ static inline void
+@@ -75,6 +87,8 @@
+ 	if (!tlb_fast_mode(tlb)) {
+ 		free_pages_and_swap_cache(tlb->pages, tlb->nr);
+ 		tlb->nr = 0;
++		if (tlb->pages == tlb->local)
++			__tlb_alloc_pages(tlb);
+ 	}
+ }
+ 
+@@ -90,7 +104,8 @@
+ 	/* keep the page table cache within bounds */
+ 	check_pgt_cache();
+ 
+-	put_cpu_var(mmu_gathers);
++	if (tlb->pages != tlb->local)
++		free_pages((unsigned long)tlb->pages, 0);
+ }
+ 
+ /* tlb_remove_page
+@@ -106,7 +121,7 @@
+ 		return;
+ 	}
+ 	tlb->pages[tlb->nr++] = page;
+-	if (tlb->nr >= FREE_PTE_NR)
++	if (tlb->nr >= tlb->max)
+ 		tlb_flush_mmu(tlb, 0, 0);
+ }
+ 
+Index: linux-rt-2.6.31/include/asm-generic/vmlinux.lds.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/asm-generic/vmlinux.lds.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/asm-generic/vmlinux.lds.h	2010-05-17 14:23:20.048474346 +0200
+@@ -91,7 +91,8 @@
+ #endif
+ 
+ #ifdef CONFIG_FTRACE_MCOUNT_RECORD
+-#define MCOUNT_REC()	VMLINUX_SYMBOL(__start_mcount_loc) = .; \
++#define MCOUNT_REC()	. = ALIGN(8);				\
++			VMLINUX_SYMBOL(__start_mcount_loc) = .; \
+ 			*(__mcount_loc)				\
+ 			VMLINUX_SYMBOL(__stop_mcount_loc) = .;
+ #else
+@@ -331,7 +332,6 @@
+ 	/* __*init sections */						\
+ 	__init_rodata : AT(ADDR(__init_rodata) - LOAD_OFFSET) {		\
+ 		*(.ref.rodata)						\
+-		MCOUNT_REC()						\
+ 		DEV_KEEP(init.rodata)					\
+ 		DEV_KEEP(exit.rodata)					\
+ 		CPU_KEEP(init.rodata)					\
+@@ -455,6 +455,7 @@
+ 	MEM_DISCARD(init.data)						\
+ 	KERNEL_CTORS()							\
+ 	*(.init.rodata)							\
++	MCOUNT_REC()							\
+ 	DEV_DISCARD(init.rodata)					\
+ 	CPU_DISCARD(init.rodata)					\
+ 	MEM_DISCARD(init.rodata)
+Index: linux-rt-2.6.31/include/linux/bottom_half.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/bottom_half.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/bottom_half.h	2010-05-17 14:23:20.048474346 +0200
+@@ -1,9 +1,17 @@
+ #ifndef _LINUX_BH_H
+ #define _LINUX_BH_H
+ 
++#ifdef CONFIG_PREEMPT_HARDIRQS
++# define local_bh_disable()		do { } while (0)
++# define __local_bh_disable(ip)		do { } while (0)
++# define _local_bh_enable()		do { } while (0)
++# define local_bh_enable()		do { } while (0)
++# define local_bh_enable_ip(ip)		do { } while (0)
++#else
+ extern void local_bh_disable(void);
+ extern void _local_bh_enable(void);
+ extern void local_bh_enable(void);
+ extern void local_bh_enable_ip(unsigned long ip);
++#endif
+ 
+ #endif /* _LINUX_BH_H */
+Index: linux-rt-2.6.31/include/linux/buffer_head.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/buffer_head.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/buffer_head.h	2010-05-17 14:23:20.048474346 +0200
+@@ -21,10 +21,6 @@
+ 	BH_Dirty,	/* Is dirty */
+ 	BH_Lock,	/* Is locked */
+ 	BH_Req,		/* Has been submitted for I/O */
+-	BH_Uptodate_Lock,/* Used by the first bh in a page, to serialise
+-			  * IO completion of other buffers in the page
+-			  */
+-
+ 	BH_Mapped,	/* Has a disk mapping */
+ 	BH_New,		/* Disk mapping was newly created by get_block */
+ 	BH_Async_Read,	/* Is under end_buffer_async_read I/O */
+@@ -74,6 +70,8 @@
+ 	struct address_space *b_assoc_map;	/* mapping this buffer is
+ 						   associated with */
+ 	atomic_t b_count;		/* users using this buffer_head */
++	spinlock_t b_uptodate_lock;
++	spinlock_t b_state_lock;
+ };
+ 
+ /*
+Index: linux-rt-2.6.31/include/linux/console.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/console.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/console.h	2010-05-17 14:23:20.048474346 +0200
+@@ -55,6 +55,7 @@
+ 	void	(*con_invert_region)(struct vc_data *, u16 *, int);
+ 	u16    *(*con_screen_pos)(struct vc_data *, int);
+ 	unsigned long (*con_getxy)(struct vc_data *, unsigned long, int *, int *);
++	int	con_preemptible; // can it reschedule from within printk?
+ };
+ 
+ extern const struct consw *conswitchp;
+@@ -92,6 +93,17 @@
+ #define CON_BOOT	(8)
+ #define CON_ANYTIME	(16) /* Safe to call when cpu is offline */
+ #define CON_BRL		(32) /* Used for a braille device */
++#define CON_ATOMIC	(64) /* Safe to call in PREEMPT_RT atomic */
++
++#ifdef CONFIG_PREEMPT_RT
++# define console_atomic_safe(con)		\
++	(((con)->flags & CON_ATOMIC) ||		\
++	 (!in_atomic() && !irqs_disabled()) ||	\
++	 (system_state != SYSTEM_RUNNING) ||	\
++	 oops_in_progress)
++#else
++# define console_atomic_safe(con) (1)
++#endif
+ 
+ struct console {
+ 	char	name[16];
+Index: linux-rt-2.6.31/include/linux/device.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/device.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/device.h	2010-05-17 14:23:20.048474346 +0200
+@@ -21,7 +21,6 @@
+ #include <linux/types.h>
+ #include <linux/module.h>
+ #include <linux/pm.h>
+-#include <linux/semaphore.h>
+ #include <asm/atomic.h>
+ #include <asm/device.h>
+ 
+@@ -105,7 +104,7 @@
+ 
+ /* All 4 notifers below get called with the target struct device *
+  * as an argument. Note that those functions are likely to be called
+- * with the device semaphore held in the core, so be careful.
++ * with the device mutex held in the core, so be careful.
+  */
+ #define BUS_NOTIFY_ADD_DEVICE		0x00000001 /* device added */
+ #define BUS_NOTIFY_DEL_DEVICE		0x00000002 /* device removed */
+@@ -373,7 +372,7 @@
+ 	const char		*init_name; /* initial name of the device */
+ 	struct device_type	*type;
+ 
+-	struct semaphore	sem;	/* semaphore to synchronize calls to
++	struct mutex		mutex;	/* mutex to synchronize calls to
+ 					 * its driver.
+ 					 */
+ 
+Index: linux-rt-2.6.31/include/linux/fs.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/fs.h	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/include/linux/fs.h	2010-05-17 14:23:20.048474346 +0200
+@@ -738,7 +738,7 @@
+ 	umode_t			i_mode;
+ 	spinlock_t		i_lock;	/* i_blocks, i_bytes, maybe i_size */
+ 	struct mutex		i_mutex;
+-	struct rw_semaphore	i_alloc_sem;
++	struct rw_anon_semaphore	i_alloc_sem;
+ 	const struct inode_operations	*i_op;
+ 	const struct file_operations	*i_fop;	/* former ->i_op->default_file_ops */
+ 	struct super_block	*i_sb;
+Index: linux-rt-2.6.31/include/linux/ftrace_event.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/ftrace_event.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/ftrace_event.h	2010-05-17 14:23:20.048474346 +0200
+@@ -1,8 +1,8 @@
+ #ifndef _LINUX_FTRACE_EVENT_H
+ #define _LINUX_FTRACE_EVENT_H
+ 
+-#include <linux/trace_seq.h>
+ #include <linux/ring_buffer.h>
++#include <linux/trace_seq.h>
+ #include <linux/percpu.h>
+ 
+ struct trace_array;
+@@ -34,7 +34,7 @@
+ 	unsigned char		flags;
+ 	unsigned char		preempt_count;
+ 	int			pid;
+-	int			tgid;
++	int			lock_depth;
+ };
+ 
+ #define FTRACE_MAX_EVENT						\
+@@ -93,16 +93,22 @@
+ 				  unsigned long flags,
+ 				  int pc);
+ struct ring_buffer_event *
+-trace_current_buffer_lock_reserve(int type, unsigned long len,
++trace_current_buffer_lock_reserve(struct ring_buffer **current_buffer,
++				  int type, unsigned long len,
+ 				  unsigned long flags, int pc);
+-void trace_current_buffer_unlock_commit(struct ring_buffer_event *event,
++void trace_current_buffer_unlock_commit(struct ring_buffer *buffer,
++					struct ring_buffer_event *event,
+ 					unsigned long flags, int pc);
+-void trace_nowake_buffer_unlock_commit(struct ring_buffer_event *event,
++void trace_nowake_buffer_unlock_commit(struct ring_buffer *buffer,
++				       struct ring_buffer_event *event,
+ 					unsigned long flags, int pc);
+-void trace_current_buffer_discard_commit(struct ring_buffer_event *event);
++void trace_current_buffer_discard_commit(struct ring_buffer *buffer,
++					 struct ring_buffer_event *event);
+ 
+ void tracing_record_cmdline(struct task_struct *tsk);
+ 
++struct event_filter;
++
+ struct ftrace_event_call {
+ 	struct list_head	list;
+ 	char			*name;
+@@ -110,16 +116,18 @@
+ 	struct dentry		*dir;
+ 	struct trace_event	*event;
+ 	int			enabled;
+-	int			(*regfunc)(void);
+-	void			(*unregfunc)(void);
++	int			(*regfunc)(void *);
++	void			(*unregfunc)(void *);
+ 	int			id;
+ 	int			(*raw_init)(void);
+-	int			(*show_format)(struct trace_seq *s);
+-	int			(*define_fields)(void);
++	int			(*show_format)(struct ftrace_event_call *call,
++					       struct trace_seq *s);
++	int			(*define_fields)(struct ftrace_event_call *);
+ 	struct list_head	fields;
+ 	int			filter_active;
+-	void			*filter;
++	struct event_filter	*filter;
+ 	void			*mod;
++	void			*data;
+ 
+ 	atomic_t		profile_count;
+ 	int			(*profile_enable)(struct ftrace_event_call *);
+@@ -127,17 +135,27 @@
+ };
+ 
+ #define MAX_FILTER_PRED		32
+-#define MAX_FILTER_STR_VAL	128
++#define MAX_FILTER_STR_VAL	256	/* Should handle KSYM_SYMBOL_LEN */
+ 
+-extern int init_preds(struct ftrace_event_call *call);
+ extern void destroy_preds(struct ftrace_event_call *call);
+ extern int filter_match_preds(struct ftrace_event_call *call, void *rec);
+-extern int filter_current_check_discard(struct ftrace_event_call *call,
++extern int filter_current_check_discard(struct ring_buffer *buffer,
++					struct ftrace_event_call *call,
+ 					void *rec,
+ 					struct ring_buffer_event *event);
+ 
+-extern int trace_define_field(struct ftrace_event_call *call, char *type,
+-			      char *name, int offset, int size, int is_signed);
++enum {
++	FILTER_OTHER = 0,
++	FILTER_STATIC_STRING,
++	FILTER_DYN_STRING,
++	FILTER_PTR_STRING,
++};
++
++extern int trace_define_field(struct ftrace_event_call *call,
++			      const char *type, const char *name,
++			      int offset, int size, int is_signed,
++			      int filter_type);
++extern int trace_define_common_fields(struct ftrace_event_call *call);
+ 
+ #define is_signed_type(type)	(((type)(-1)) < 0)
+ 
+@@ -162,11 +180,4 @@
+ 		__trace_printk(ip, fmt, ##args);			\
+ } while (0)
+ 
+-#define __common_field(type, item, is_signed)				\
+-	ret = trace_define_field(event_call, #type, "common_" #item,	\
+-				 offsetof(typeof(field.ent), item),	\
+-				 sizeof(field.ent.item), is_signed);	\
+-	if (ret)							\
+-		return ret;
+-
+ #endif /* _LINUX_FTRACE_EVENT_H */
+Index: linux-rt-2.6.31/include/linux/hardirq.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/hardirq.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/hardirq.h	2010-05-17 14:23:20.048474346 +0200
+@@ -77,23 +77,15 @@
+  * Are we doing bottom half or hardware interrupt processing?
+  * Are we in a softirq context? Interrupt context?
+  */
+-#define in_irq()		(hardirq_count())
+-#define in_softirq()		(softirq_count())
+-#define in_interrupt()		(irq_count())
++#define in_irq()	(hardirq_count() || (current->flags & PF_HARDIRQ))
++#define in_softirq()	(softirq_count() || (current->flags & PF_SOFTIRQ))
++#define in_interrupt()	(irq_count())
+ 
+ /*
+  * Are we in NMI context?
+  */
+ #define in_nmi()	(preempt_count() & NMI_MASK)
+ 
+-#if defined(CONFIG_PREEMPT)
+-# define PREEMPT_INATOMIC_BASE kernel_locked()
+-# define PREEMPT_CHECK_OFFSET 1
+-#else
+-# define PREEMPT_INATOMIC_BASE 0
+-# define PREEMPT_CHECK_OFFSET 0
+-#endif
+-
+ /*
+  * Are we running in atomic context?  WARNING: this macro cannot
+  * always detect atomic context; in particular, it cannot know about
+@@ -101,14 +93,7 @@
+  * used in the general case to determine whether sleeping is possible.
+  * Do not use in_atomic() in driver code.
+  */
+-#define in_atomic()	((preempt_count() & ~PREEMPT_ACTIVE) != PREEMPT_INATOMIC_BASE)
+-
+-/*
+- * Check whether we were atomic before we did preempt_disable():
+- * (used by the scheduler, *after* releasing the kernel lock)
+- */
+-#define in_atomic_preempt_off() \
+-		((preempt_count() & ~PREEMPT_ACTIVE) != PREEMPT_CHECK_OFFSET)
++#define in_atomic()		((preempt_count() & ~PREEMPT_ACTIVE) != 0)
+ 
+ #ifdef CONFIG_PREEMPT
+ # define preemptible()	(preempt_count() == 0 && !irqs_disabled())
+Index: linux-rt-2.6.31/include/linux/hrtimer.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/hrtimer.h	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/include/linux/hrtimer.h	2010-05-17 14:23:20.048474346 +0200
+@@ -109,6 +109,7 @@
+ 	struct hrtimer_clock_base	*base;
+ 	unsigned long			state;
+ 	struct list_head		cb_entry;
++	int				irqsafe;
+ #ifdef CONFIG_TIMER_STATS
+ 	int				start_pid;
+ 	void				*start_site;
+@@ -144,6 +145,7 @@
+ 	struct hrtimer_cpu_base	*cpu_base;
+ 	clockid_t		index;
+ 	struct rb_root		active;
++	struct list_head	expired;
+ 	struct rb_node		*first;
+ 	ktime_t			resolution;
+ 	ktime_t			(*get_time)(void);
+@@ -170,13 +172,16 @@
+  * @nr_events:		Total number of timer interrupt events
+  */
+ struct hrtimer_cpu_base {
+-	spinlock_t			lock;
++	atomic_spinlock_t		lock;
+ 	struct hrtimer_clock_base	clock_base[HRTIMER_MAX_CLOCK_BASES];
+ #ifdef CONFIG_HIGH_RES_TIMERS
+ 	ktime_t				expires_next;
+ 	int				hres_active;
+ 	unsigned long			nr_events;
+ #endif
++#ifdef CONFIG_PREEMPT_SOFTIRQS
++	wait_queue_head_t		wait;
++#endif
+ };
+ 
+ static inline void hrtimer_set_expires(struct hrtimer *timer, ktime_t time)
+@@ -364,6 +369,13 @@
+ 	return hrtimer_start_expires(timer, HRTIMER_MODE_ABS);
+ }
+ 
++/* Softirq preemption could deadlock timer removal */
++#ifdef CONFIG_PREEMPT_SOFTIRQS
++  extern void hrtimer_wait_for_timer(const struct hrtimer *timer);
++#else
++# define hrtimer_wait_for_timer(timer)	do { cpu_relax(); } while (0)
++#endif
++
+ /* Query timers: */
+ extern ktime_t hrtimer_get_remaining(const struct hrtimer *timer);
+ extern int hrtimer_get_res(const clockid_t which_clock, struct timespec *tp);
+Index: linux-rt-2.6.31/include/linux/init_task.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/init_task.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/init_task.h	2010-05-17 14:23:20.048474346 +0200
+@@ -27,7 +27,7 @@
+ 	.cputimer	= { 						\
+ 		.cputime = INIT_CPUTIME,				\
+ 		.running = 0,						\
+-		.lock = __SPIN_LOCK_UNLOCKED(sig.cputimer.lock),	\
++		.lock = __ATOMIC_SPIN_LOCK_UNLOCKED(sig.cputimer.lock),	\
+ 	},								\
+ }
+ 
+@@ -159,8 +159,9 @@
+ 	.journal_info	= NULL,						\
+ 	.cpu_timers	= INIT_CPU_TIMERS(tsk.cpu_timers),		\
+ 	.fs_excl	= ATOMIC_INIT(0),				\
+-	.pi_lock	= __SPIN_LOCK_UNLOCKED(tsk.pi_lock),		\
++	.pi_lock	= __ATOMIC_SPIN_LOCK_UNLOCKED(tsk.pi_lock),	\
+ 	.timer_slack_ns = 50000, /* 50 usec default slack */		\
++	.posix_timer_list = NULL,					\
+ 	.pids = {							\
+ 		[PIDTYPE_PID]  = INIT_PID_LINK(PIDTYPE_PID),		\
+ 		[PIDTYPE_PGID] = INIT_PID_LINK(PIDTYPE_PGID),		\
+Index: linux-rt-2.6.31/include/linux/interrupt.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/interrupt.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/interrupt.h	2010-05-17 14:23:20.048474346 +0200
+@@ -50,15 +50,23 @@
+  * IRQF_IRQPOLL - Interrupt is used for polling (only the interrupt that is
+  *                registered first in an shared interrupt is considered for
+  *                performance reasons)
++ * IRQF_ONESHOT - Interrupt is not reenabled after the hardirq handler finished.
++ *                Used by threaded interrupts which need to keep the
++ *                irq line disabled until the threaded handler has been run.
++ * IRQF_NODELAY - Interrupt is not force threaded
+  */
+ #define IRQF_DISABLED		0x00000020
+ #define IRQF_SAMPLE_RANDOM	0x00000040
+ #define IRQF_SHARED		0x00000080
+ #define IRQF_PROBE_SHARED	0x00000100
+-#define IRQF_TIMER		0x00000200
++#define __IRQF_TIMER		0x00000200
+ #define IRQF_PERCPU		0x00000400
+ #define IRQF_NOBALANCING	0x00000800
+ #define IRQF_IRQPOLL		0x00001000
++#define IRQF_ONESHOT		0x00002000
++#define IRQF_NODELAY		0x00004000
++
++#define IRQF_TIMER		(__IRQF_TIMER | IRQF_NODELAY)
+ 
+ /*
+  * Bits used by threaded handlers:
+@@ -89,6 +97,7 @@
+  * @thread_fn:	interupt handler function for threaded interrupts
+  * @thread:	thread pointer for threaded interrupts
+  * @thread_flags:	flags related to @thread
++ * @thread_mask:	bit mask to account for forced threads
+  */
+ struct irqaction {
+ 	irq_handler_t handler;
+@@ -102,6 +111,7 @@
+ 	irq_handler_t thread_fn;
+ 	struct task_struct *thread;
+ 	unsigned long thread_flags;
++	unsigned long thread_mask;
+ };
+ 
+ extern irqreturn_t no_action(int cpl, void *dev_id);
+@@ -178,7 +188,7 @@
+ #ifdef CONFIG_LOCKDEP
+ # define local_irq_enable_in_hardirq()	do { } while (0)
+ #else
+-# define local_irq_enable_in_hardirq()	local_irq_enable()
++# define local_irq_enable_in_hardirq()	local_irq_enable_nort()
+ #endif
+ 
+ extern void disable_irq_nosync(unsigned int irq);
+@@ -318,6 +328,7 @@
+ 
+ #ifndef __ARCH_SET_SOFTIRQ_PENDING
+ #define set_softirq_pending(x) (local_softirq_pending() = (x))
++// FIXME: PREEMPT_RT: set_bit()?
+ #define or_softirq_pending(x)  (local_softirq_pending() |= (x))
+ #endif
+ 
+@@ -348,7 +359,6 @@
+ 	SCHED_SOFTIRQ,
+ 	HRTIMER_SOFTIRQ,
+ 	RCU_SOFTIRQ,	/* Preferable RCU should always be the last softirq */
+-
+ 	NR_SOFTIRQS
+ };
+ 
+@@ -366,14 +376,23 @@
+ 	void	(*action)(struct softirq_action *);
+ };
+ 
++#ifdef CONFIG_PREEMPT_HARDIRQS
++# define __raise_softirq_irqoff(nr) raise_softirq_irqoff(nr)
++# define __do_raise_softirq_irqoff(nr) \
++	do { or_softirq_pending(1UL << (nr)); } while (0)
++#else
++# define __raise_softirq_irqoff(nr) \
++	do { or_softirq_pending(1UL << (nr)); } while (0)
++# define __do_raise_softirq_irqoff(nr) __raise_softirq_irqoff(nr)
++#endif
++
+ asmlinkage void do_softirq(void);
+ asmlinkage void __do_softirq(void);
+ extern void open_softirq(int nr, void (*action)(struct softirq_action *));
+ extern void softirq_init(void);
+-#define __raise_softirq_irqoff(nr) do { or_softirq_pending(1UL << (nr)); } while (0)
+ extern void raise_softirq_irqoff(unsigned int nr);
+ extern void raise_softirq(unsigned int nr);
+-extern void wakeup_softirqd(void);
++extern void softirq_check_pending_idle(void);
+ 
+ /* This is the worklist that queues up per-cpu softirq work.
+  *
+@@ -408,8 +427,9 @@
+      to be executed on some cpu at least once after this.
+    * If the tasklet is already scheduled, but its excecution is still not
+      started, it will be executed only once.
+-   * If this tasklet is already running on another CPU (or schedule is called
+-     from tasklet itself), it is rescheduled for later.
++   * If this tasklet is already running on another CPU, it is rescheduled
++     for later.
++   * Schedule must not be called from the tasklet itself (a lockup occurs)
+    * Tasklet is strictly serialized wrt itself, but not
+      wrt another tasklets. If client needs some intertask synchronization,
+      he makes it with spinlocks.
+@@ -434,27 +454,36 @@
+ enum
+ {
+ 	TASKLET_STATE_SCHED,	/* Tasklet is scheduled for execution */
+-	TASKLET_STATE_RUN	/* Tasklet is running (SMP only) */
++	TASKLET_STATE_RUN,	/* Tasklet is running (SMP only) */
++	TASKLET_STATE_PENDING	/* Tasklet is pending */
+ };
+ 
+-#ifdef CONFIG_SMP
++#define TASKLET_STATEF_SCHED	(1 << TASKLET_STATE_SCHED)
++#define TASKLET_STATEF_RUN	(1 << TASKLET_STATE_RUN)
++#define TASKLET_STATEF_PENDING	(1 << TASKLET_STATE_PENDING)
++
++#if defined(CONFIG_SMP) || defined(CONFIG_PREEMPT_RT)
+ static inline int tasklet_trylock(struct tasklet_struct *t)
+ {
+ 	return !test_and_set_bit(TASKLET_STATE_RUN, &(t)->state);
+ }
+ 
++static inline int tasklet_tryunlock(struct tasklet_struct *t)
++{
++	return cmpxchg(&t->state, TASKLET_STATEF_RUN, 0) == TASKLET_STATEF_RUN;
++}
++
+ static inline void tasklet_unlock(struct tasklet_struct *t)
+ {
+ 	smp_mb__before_clear_bit(); 
+ 	clear_bit(TASKLET_STATE_RUN, &(t)->state);
+ }
+ 
+-static inline void tasklet_unlock_wait(struct tasklet_struct *t)
+-{
+-	while (test_bit(TASKLET_STATE_RUN, &(t)->state)) { barrier(); }
+-}
++extern void tasklet_unlock_wait(struct tasklet_struct *t);
++
+ #else
+ #define tasklet_trylock(t) 1
++#define tasklet_tryunlock(t)	1
+ #define tasklet_unlock_wait(t) do { } while (0)
+ #define tasklet_unlock(t) do { } while (0)
+ #endif
+@@ -503,22 +532,14 @@
+ 	smp_mb();
+ }
+ 
+-static inline void tasklet_enable(struct tasklet_struct *t)
+-{
+-	smp_mb__before_atomic_dec();
+-	atomic_dec(&t->count);
+-}
+-
+-static inline void tasklet_hi_enable(struct tasklet_struct *t)
+-{
+-	smp_mb__before_atomic_dec();
+-	atomic_dec(&t->count);
+-}
++extern  void tasklet_enable(struct tasklet_struct *t);
++extern  void tasklet_hi_enable(struct tasklet_struct *t);
+ 
+ extern void tasklet_kill(struct tasklet_struct *t);
+ extern void tasklet_kill_immediate(struct tasklet_struct *t, unsigned int cpu);
+ extern void tasklet_init(struct tasklet_struct *t,
+ 			 void (*func)(unsigned long), unsigned long data);
++extern void takeover_tasklets(unsigned int cpu);
+ 
+ struct tasklet_hrtimer {
+ 	struct hrtimer		timer;
+@@ -616,4 +637,19 @@
+ extern int arch_early_irq_init(void);
+ extern int arch_init_chip_data(struct irq_desc *desc, int node);
+ 
++/*
++ * local_irq* variants depending on RT/!RT
++ */
++#ifdef CONFIG_PREEMPT_RT
++# define local_irq_disable_nort()	do { } while (0)
++# define local_irq_enable_nort()	do { } while (0)
++# define local_irq_save_nort(flags)	do { local_save_flags(flags); } while (0)
++# define local_irq_restore_nort(flags)	do { (void)(flags); } while (0)
++#else
++# define local_irq_disable_nort()	local_irq_disable()
++# define local_irq_enable_nort()	local_irq_enable()
++# define local_irq_save_nort(flags)	local_irq_save(flags)
++# define local_irq_restore_nort(flags)	local_irq_restore(flags)
++#endif
++
+ #endif
+Index: linux-rt-2.6.31/include/linux/irq.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/irq.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/irq.h	2010-05-17 14:23:20.048474346 +0200
+@@ -69,6 +69,8 @@
+ #define IRQ_MOVE_PCNTXT		0x01000000	/* IRQ migration from process context */
+ #define IRQ_AFFINITY_SET	0x02000000	/* IRQ affinity was set from userspace*/
+ #define IRQ_SUSPENDED		0x04000000	/* IRQ has gone through suspend sequence */
++#define IRQ_ONESHOT		0x08000000	/* IRQ is not unmasked after hardirq */
++#define IRQ_NESTED_THREAD	0x10000000	/* IRQ is nested into another, no own handler thread */
+ 
+ #ifdef CONFIG_IRQ_PER_CPU
+ # define CHECK_IRQ_PER_CPU(var) ((var) & IRQ_PER_CPU)
+@@ -100,6 +102,9 @@
+  * @set_type:		set the flow type (IRQ_TYPE_LEVEL/etc.) of an IRQ
+  * @set_wake:		enable/disable power-management wake-on of an IRQ
+  *
++ * @bus_lock:		function to lock access to slow bus (i2c) chips
++ * @bus_sync_unlock:	function to sync and unlock slow bus (i2c) chips
++ *
+  * @release:		release function solely used by UML
+  * @typename:		obsoleted by name, kept as migration helper
+  */
+@@ -123,6 +128,9 @@
+ 	int		(*set_type)(unsigned int irq, unsigned int flow_type);
+ 	int		(*set_wake)(unsigned int irq, unsigned int on);
+ 
++	void		(*bus_lock)(unsigned int irq);
++	void		(*bus_sync_unlock)(unsigned int irq);
++
+ 	/* Currently used only by UML, might disappear one day.*/
+ #ifdef CONFIG_IRQ_RELEASE_METHOD
+ 	void		(*release)(unsigned int irq, void *dev_id);
+@@ -184,7 +192,7 @@
+ 	unsigned int		irq_count;	/* For detecting broken IRQs */
+ 	unsigned long		last_unhandled;	/* Aging timer for unhandled count */
+ 	unsigned int		irqs_unhandled;
+-	spinlock_t		lock;
++	atomic_spinlock_t	lock;
+ #ifdef CONFIG_SMP
+ 	cpumask_var_t		affinity;
+ 	unsigned int		node;
+@@ -193,6 +201,7 @@
+ #endif
+ #endif
+ 	atomic_t		threads_active;
++	unsigned long		forced_threads_active;
+ 	wait_queue_head_t       wait_for_threads;
+ #ifdef CONFIG_PROC_FS
+ 	struct proc_dir_entry	*dir;
+@@ -379,6 +388,8 @@
+ 	__set_irq_handler(irq, handle, 1, NULL);
+ }
+ 
++extern void set_irq_nested_thread(unsigned int irq, int nest);
++
+ extern void set_irq_noprobe(unsigned int irq);
+ extern void set_irq_probe(unsigned int irq);
+ 
+Index: linux-rt-2.6.31/include/linux/jbd.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/jbd.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/jbd.h	2010-05-17 14:23:20.048474346 +0200
+@@ -260,6 +260,15 @@
+ #define J_ASSERT_JH(jh, expr)	J_ASSERT(expr)
+ #endif
+ 
++/*
++ * For assertions that are only valid on SMP (e.g. spin_is_locked()):
++ */
++#ifdef CONFIG_SMP
++# define J_ASSERT_JH_SMP(jh, expr)	J_ASSERT_JH(jh, expr)
++#else
++# define J_ASSERT_JH_SMP(jh, assert)	do { } while (0)
++#endif
++
+ #if defined(JBD_PARANOID_IOFAIL)
+ #define J_EXPECT(expr, why...)		J_ASSERT(expr)
+ #define J_EXPECT_BH(bh, expr, why...)	J_ASSERT_BH(bh, expr)
+@@ -315,32 +324,32 @@
+ 
+ static inline void jbd_lock_bh_state(struct buffer_head *bh)
+ {
+-	bit_spin_lock(BH_State, &bh->b_state);
++	spin_lock(&bh->b_state_lock);
+ }
+ 
+ static inline int jbd_trylock_bh_state(struct buffer_head *bh)
+ {
+-	return bit_spin_trylock(BH_State, &bh->b_state);
++	return spin_trylock(&bh->b_state_lock);
+ }
+ 
+ static inline int jbd_is_locked_bh_state(struct buffer_head *bh)
+ {
+-	return bit_spin_is_locked(BH_State, &bh->b_state);
++	return spin_is_locked(&bh->b_state_lock);
+ }
+ 
+ static inline void jbd_unlock_bh_state(struct buffer_head *bh)
+ {
+-	bit_spin_unlock(BH_State, &bh->b_state);
++	spin_unlock(&bh->b_state_lock);
+ }
+ 
+ static inline void jbd_lock_bh_journal_head(struct buffer_head *bh)
+ {
+-	bit_spin_lock(BH_JournalHead, &bh->b_state);
++	spin_lock_irq(&bh->b_uptodate_lock);
+ }
+ 
+ static inline void jbd_unlock_bh_journal_head(struct buffer_head *bh)
+ {
+-	bit_spin_unlock(BH_JournalHead, &bh->b_state);
++	spin_unlock_irq(&bh->b_uptodate_lock);
+ }
+ 
+ struct jbd_revoke_table_s;
+Index: linux-rt-2.6.31/include/linux/jbd2.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/jbd2.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/jbd2.h	2010-05-17 14:23:20.048474346 +0200
+@@ -319,6 +319,15 @@
+ #define J_EXPECT_JH(jh, expr, why...)	__journal_expect(expr, ## why)
+ #endif
+ 
++/*
++ * For assertions that are only valid on SMP (e.g. spin_is_locked()):
++ */
++#ifdef CONFIG_SMP
++# define J_ASSERT_JH_SMP(jh, expr)	J_ASSERT_JH(jh, expr)
++#else
++# define J_ASSERT_JH_SMP(jh, assert)	do { } while (0)
++#endif
++
+ enum jbd_state_bits {
+ 	BH_JBD			/* Has an attached ext3 journal_head */
+ 	  = BH_PrivateStart,
+@@ -355,32 +364,32 @@
+ 
+ static inline void jbd_lock_bh_state(struct buffer_head *bh)
+ {
+-	bit_spin_lock(BH_State, &bh->b_state);
++	spin_lock(&bh->b_state_lock);
+ }
+ 
+ static inline int jbd_trylock_bh_state(struct buffer_head *bh)
+ {
+-	return bit_spin_trylock(BH_State, &bh->b_state);
++	return spin_trylock(&bh->b_state_lock);
+ }
+ 
+ static inline int jbd_is_locked_bh_state(struct buffer_head *bh)
+ {
+-	return bit_spin_is_locked(BH_State, &bh->b_state);
++	return spin_is_locked(&bh->b_state_lock);
+ }
+ 
+ static inline void jbd_unlock_bh_state(struct buffer_head *bh)
+ {
+-	bit_spin_unlock(BH_State, &bh->b_state);
++	spin_unlock(&bh->b_state_lock);
+ }
+ 
+ static inline void jbd_lock_bh_journal_head(struct buffer_head *bh)
+ {
+-	bit_spin_lock(BH_JournalHead, &bh->b_state);
++	spin_lock(&bh->b_uptodate_lock);
+ }
+ 
+ static inline void jbd_unlock_bh_journal_head(struct buffer_head *bh)
+ {
+-	bit_spin_unlock(BH_JournalHead, &bh->b_state);
++	spin_unlock(&bh->b_uptodate_lock);
+ }
+ 
+ /* Flags in jbd_inode->i_flags */
+Index: linux-rt-2.6.31/include/linux/kernel.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/kernel.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/kernel.h	2010-05-17 14:23:20.048474346 +0200
+@@ -124,7 +124,7 @@
+ # define might_resched() do { } while (0)
+ #endif
+ 
+-#ifdef CONFIG_DEBUG_SPINLOCK_SLEEP
++#if defined(CONFIG_DEBUG_SPINLOCK_SLEEP) || defined(CONFIG_DEBUG_PREEMPT)
+   void __might_sleep(char *file, int line);
+ /**
+  * might_sleep - annotation for functions that can sleep
+@@ -284,6 +284,12 @@
+ extern void asmlinkage __attribute__((format(printf, 1, 2)))
+ 	early_printk(const char *fmt, ...);
+ 
++#ifdef CONFIG_PREEMPT_RT
++extern void zap_rt_locks(void);
++#else
++# define zap_rt_locks() do { } while (0)
++#endif
++
+ unsigned long int_sqrt(unsigned long);
+ 
+ static inline void console_silent(void)
+@@ -313,6 +319,7 @@
+ /* Values used for system_state */
+ extern enum system_states {
+ 	SYSTEM_BOOTING,
++	SYSTEM_BOOTING_SCHEDULER_OK,
+ 	SYSTEM_RUNNING,
+ 	SYSTEM_HALT,
+ 	SYSTEM_POWER_OFF,
+Index: linux-rt-2.6.31/include/linux/kernel_stat.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/kernel_stat.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/kernel_stat.h	2010-05-17 14:23:20.048474346 +0200
+@@ -24,6 +24,8 @@
+ 	cputime64_t idle;
+ 	cputime64_t iowait;
+ 	cputime64_t steal;
++	cputime64_t user_rt;
++	cputime64_t system_rt;
+ 	cputime64_t guest;
+ };
+ 
+Index: linux-rt-2.6.31/include/linux/kprobes.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/kprobes.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/kprobes.h	2010-05-17 14:23:20.048474346 +0200
+@@ -170,7 +170,7 @@
+ 	int nmissed;
+ 	size_t data_size;
+ 	struct hlist_head free_instances;
+-	spinlock_t lock;
++	atomic_spinlock_t lock;
+ };
+ 
+ struct kretprobe_instance {
+Index: linux-rt-2.6.31/include/linux/list.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/list.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/list.h	2010-05-17 14:23:20.048474346 +0200
+@@ -345,6 +345,9 @@
+ #define list_first_entry(ptr, type, member) \
+ 	list_entry((ptr)->next, type, member)
+ 
++#define list_last_entry(ptr, type, member) \
++	list_entry((ptr)->prev, type, member)
++
+ /**
+  * list_for_each	-	iterate over a list
+  * @pos:	the &struct list_head to use as a loop cursor.
+Index: linux-rt-2.6.31/include/linux/lockdep.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/lockdep.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/lockdep.h	2010-05-17 14:23:20.048474346 +0200
+@@ -40,6 +40,8 @@
+ 	struct lockdep_subclass_key	subkeys[MAX_LOCKDEP_SUBCLASSES];
+ };
+ 
++extern struct lock_class_key __lockdep_no_validate__;
++
+ #define LOCKSTAT_POINTS		4
+ 
+ /*
+@@ -258,6 +260,9 @@
+ #define lockdep_set_subclass(lock, sub)	\
+ 		lockdep_init_map(&(lock)->dep_map, #lock, \
+ 				 (lock)->dep_map.key, sub)
++
++#define lockdep_set_novalidate_class(lock) \
++	lockdep_set_class(lock, &__lockdep_no_validate__)
+ /*
+  * Compare locking classes
+  */
+@@ -336,6 +341,9 @@
+ #define lockdep_set_class_and_subclass(lock, key, sub) \
+ 		do { (void)(key); } while (0)
+ #define lockdep_set_subclass(lock, sub)		do { } while (0)
++
++#define lockdep_set_novalidate_class(lock) do { } while (0)
++
+ /*
+  * We don't define lockdep_match_class() and lockdep_match_key() for !LOCKDEP
+  * case since the result is not well defined and the caller should rather
+Index: linux-rt-2.6.31/include/linux/mm.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/mm.h	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/include/linux/mm.h	2010-05-17 14:23:20.048474346 +0200
+@@ -587,23 +587,39 @@
+ #endif
+ 
+ #if defined(WANT_PAGE_VIRTUAL)
+-#define page_address(page) ((page)->virtual)
+-#define set_page_address(page, address)			\
+-	do {						\
+-		(page)->virtual = (address);		\
+-	} while(0)
+-#define page_address_init()  do { } while(0)
++/*
++ * wrap page->virtual so it is safe to set/read locklessly
++ */
++#define page_address(page) \
++	({ typeof((page)->virtual) v = (page)->virtual; \
++	 smp_read_barrier_depends(); \
++	 v; })
++
++static inline int set_page_address(struct page *page, void *address)
++{
++	if (address)
++		return cmpxchg(&page->virtual, NULL, address) == NULL;
++	else {
++		/*
++		 * cmpxchg is a bit abused because it is not guaranteed
++		 * safe wrt direct assignment on all platforms.
++		 */
++		void *virt = page->virtual;
++		return cmpxchg(&page->vitrual, virt, NULL) == virt;
++	}
++}
++void page_address_init(void);
+ #endif
+ 
+ #if defined(HASHED_PAGE_VIRTUAL)
+ void *page_address(struct page *page);
+-void set_page_address(struct page *page, void *virtual);
++int set_page_address(struct page *page, void *virtual);
+ void page_address_init(void);
+ #endif
+ 
+ #if !defined(HASHED_PAGE_VIRTUAL) && !defined(WANT_PAGE_VIRTUAL)
+ #define page_address(page) lowmem_page_address(page)
+-#define set_page_address(page, address)  do { } while(0)
++#define set_page_address(page, address)  (0)
+ #define page_address_init()  do { } while(0)
+ #endif
+ 
+@@ -744,7 +760,7 @@
+ 		unsigned long size);
+ unsigned long zap_page_range(struct vm_area_struct *vma, unsigned long address,
+ 		unsigned long size, struct zap_details *);
+-unsigned long unmap_vmas(struct mmu_gather **tlb,
++unsigned long unmap_vmas(struct mmu_gather *tlb,
+ 		struct vm_area_struct *start_vma, unsigned long start_addr,
+ 		unsigned long end_addr, unsigned long *nr_accounted,
+ 		struct zap_details *);
+@@ -923,27 +939,85 @@
+  * overflow into the next struct page (as it might with DEBUG_SPINLOCK).
+  * When freeing, reset page->mapping so free_pages_check won't complain.
+  */
++#ifndef CONFIG_PREEMPT_RT
++
+ #define __pte_lockptr(page)	&((page)->ptl)
+-#define pte_lock_init(_page)	do {					\
+-	spin_lock_init(__pte_lockptr(_page));				\
+-} while (0)
++
++static inline struct page *pte_lock_init(struct page *page)
++{
++	spin_lock_init(__pte_lockptr(page));
++	return page;
++}
++
+ #define pte_lock_deinit(page)	((page)->mapping = NULL)
++
++#else /* PREEMPT_RT */
++
++/*
++ * On PREEMPT_RT the spinlock_t's are too large to embed in the
++ * page frame, hence it only has a pointer and we need to dynamically
++ * allocate the lock when we allocate PTE-pages.
++ *
++ * This is an overall win, since only a small fraction of the pages
++ * will be PTE pages under normal circumstances.
++ */
++
++#define __pte_lockptr(page)	((page)->ptl)
++
++/*
++ * Heinous hack, relies on the caller doing something like:
++ *
++ *   pte = alloc_pages(PGALLOC_GFP, 0);
++ *   if (pte)
++ *     pgtable_page_ctor(pte);
++ *   return pte;
++ *
++ * This ensures we release the page and return NULL when the
++ * lock allocation fails.
++ */
++static inline struct page *pte_lock_init(struct page *page)
++{
++	page->ptl = kmalloc(sizeof(spinlock_t), GFP_KERNEL);
++	if (page->ptl) {
++		spin_lock_init(__pte_lockptr(page));
++	} else {
++		__free_page(page);
++		page = NULL;
++	}
++	return page;
++}
++
++static inline void pte_lock_deinit(struct page *page)
++{
++	kfree(page->ptl);
++	page->mapping = NULL;
++}
++
++#endif /* PREEMPT_RT */
++
+ #define pte_lockptr(mm, pmd)	({(void)(mm); __pte_lockptr(pmd_page(*(pmd)));})
+ #else	/* !USE_SPLIT_PTLOCKS */
+ /*
+  * We use mm->page_table_lock to guard all pagetable pages of the mm.
+  */
+-#define pte_lock_init(page)	do {} while (0)
++static inline struct page *pte_lock_init(struct page *page) { return page; }
+ #define pte_lock_deinit(page)	do {} while (0)
+ #define pte_lockptr(mm, pmd)	({(void)(pmd); &(mm)->page_table_lock;})
+ #endif /* USE_SPLIT_PTLOCKS */
+ 
+-static inline void pgtable_page_ctor(struct page *page)
++static inline struct page *__pgtable_page_ctor(struct page *page)
+ {
+-	pte_lock_init(page);
+-	inc_zone_page_state(page, NR_PAGETABLE);
++	page = pte_lock_init(page);
++	if (page)
++		inc_zone_page_state(page, NR_PAGETABLE);
++	return page;
+ }
+ 
++#define pgtable_page_ctor(page)				\
++do {							\
++	page = __pgtable_page_ctor(page);		\
++} while (0)
++
+ static inline void pgtable_page_dtor(struct page *page)
+ {
+ 	pte_lock_deinit(page);
+Index: linux-rt-2.6.31/include/linux/mm_types.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/mm_types.h	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/include/linux/mm_types.h	2010-05-17 14:23:20.048474346 +0200
+@@ -69,7 +69,11 @@
+ 						 */
+ 	    };
+ #if USE_SPLIT_PTLOCKS
++#ifndef CONFIG_PREEMPT_RT
+ 	    spinlock_t ptl;
++#else
++	    spinlock_t *ptl;
++#endif
+ #endif
+ 	    struct kmem_cache *slab;	/* SLUB: Pointer to slab */
+ 	    struct page *first_page;	/* Compound tail pages */
+@@ -248,6 +252,9 @@
+ 	/* Architecture-specific MM context */
+ 	mm_context_t context;
+ 
++	/* realtime bits */
++	struct list_head	delayed_drop;
++
+ 	/* Swap token stuff */
+ 	/*
+ 	 * Last value of global fault stamp as seen by this process.
+Index: linux-rt-2.6.31/include/linux/module.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/module.h	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/include/linux/module.h	2010-05-17 14:23:20.058392366 +0200
+@@ -17,10 +17,12 @@
+ #include <linux/moduleparam.h>
+ #include <linux/marker.h>
+ #include <linux/tracepoint.h>
+-#include <asm/local.h>
+ 
++#include <asm/local.h>
+ #include <asm/module.h>
+ 
++#include <trace/events/module.h>
++
+ /* Not Yet Implemented */
+ #define MODULE_SUPPORTED_DEVICE(name)
+ 
+@@ -462,7 +464,10 @@
+ static inline void __module_get(struct module *module)
+ {
+ 	if (module) {
+-		local_inc(__module_ref_addr(module, get_cpu()));
++		unsigned int cpu = get_cpu();
++		local_inc(__module_ref_addr(module, cpu));
++		trace_module_get(module, _THIS_IP_,
++				 local_read(__module_ref_addr(module, cpu)));
+ 		put_cpu();
+ 	}
+ }
+@@ -473,8 +478,11 @@
+ 
+ 	if (module) {
+ 		unsigned int cpu = get_cpu();
+-		if (likely(module_is_live(module)))
++		if (likely(module_is_live(module))) {
+ 			local_inc(__module_ref_addr(module, cpu));
++			trace_module_get(module, _THIS_IP_,
++				local_read(__module_ref_addr(module, cpu)));
++		}
+ 		else
+ 			ret = 0;
+ 		put_cpu();
+Index: linux-rt-2.6.31/include/linux/mutex.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/mutex.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/mutex.h	2010-05-17 14:23:20.058392366 +0200
+@@ -12,11 +12,85 @@
+ 
+ #include <linux/list.h>
+ #include <linux/spinlock_types.h>
++#include <linux/rt_lock.h>
+ #include <linux/linkage.h>
+ #include <linux/lockdep.h>
+ 
+ #include <asm/atomic.h>
+ 
++#ifdef CONFIG_DEBUG_LOCK_ALLOC
++# define __DEP_MAP_MUTEX_INITIALIZER(lockname) \
++		, .dep_map = { .name = #lockname }
++#else
++# define __DEP_MAP_MUTEX_INITIALIZER(lockname)
++#endif
++
++#ifdef CONFIG_PREEMPT_RT
++
++#include <linux/rtmutex.h>
++
++struct mutex {
++	struct rt_mutex		lock;
++#ifdef CONFIG_DEBUG_LOCK_ALLOC
++	struct lockdep_map	dep_map;
++#endif
++};
++
++
++#define __MUTEX_INITIALIZER(mutexname)					\
++	{								\
++		.lock = __RT_MUTEX_INITIALIZER(mutexname.lock)		\
++		__DEP_MAP_MUTEX_INITIALIZER(mutexname)			\
++	}
++
++#define DEFINE_MUTEX(mutexname)						\
++	struct mutex mutexname = __MUTEX_INITIALIZER(mutexname)
++
++extern void
++__mutex_init(struct mutex *lock, char *name, struct lock_class_key *key);
++
++extern void __lockfunc _mutex_lock(struct mutex *lock);
++extern int __lockfunc _mutex_lock_interruptible(struct mutex *lock);
++extern int __lockfunc _mutex_lock_killable(struct mutex *lock);
++extern void __lockfunc _mutex_lock_nested(struct mutex *lock, int subclass);
++extern int __lockfunc
++_mutex_lock_interruptible_nested(struct mutex *lock, int subclass);
++extern int __lockfunc
++_mutex_lock_killable_nested(struct mutex *lock, int subclass);
++extern int __lockfunc _mutex_trylock(struct mutex *lock);
++extern void __lockfunc _mutex_unlock(struct mutex *lock);
++
++#define mutex_is_locked(l)		rt_mutex_is_locked(&(l)->lock)
++#define mutex_lock(l)			_mutex_lock(l)
++#define mutex_lock_interruptible(l)	_mutex_lock_interruptible(l)
++#define mutex_lock_killable(l)		_mutex_lock_killable(l)
++#define mutex_trylock(l)		_mutex_trylock(l)
++#define mutex_unlock(l)			_mutex_unlock(l)
++#define mutex_destroy(l)		rt_mutex_destroy(&(l)->lock)
++
++#ifdef CONFIG_DEBUG_LOCK_ALLOC
++# define mutex_lock_nested(l, s)	_mutex_lock_nested(l, s)
++# define mutex_lock_interruptible_nested(l, s) \
++					_mutex_lock_interruptible_nested(l, s)
++# define mutex_lock_killable_nested(l, s) \
++					_mutex_lock_killable_nested(l, s)
++#else
++# define mutex_lock_nested(l, s)	_mutex_lock(l)
++# define mutex_lock_interruptible_nested(l, s) \
++					_mutex_lock_interruptible(l)
++# define mutex_lock_killable_nested(l, s) \
++					_mutex_lock_killable(l)
++#endif
++
++# define mutex_init(mutex)				\
++do {							\
++	static struct lock_class_key __key;		\
++							\
++	__mutex_init((mutex), #mutex, &__key);		\
++} while (0)
++
++#else /* PREEMPT_RT */
++
+ /*
+  * Simple, straightforward mutexes with strict semantics:
+  *
+@@ -87,13 +161,6 @@
+ # define mutex_destroy(mutex)				do { } while (0)
+ #endif
+ 
+-#ifdef CONFIG_DEBUG_LOCK_ALLOC
+-# define __DEP_MAP_MUTEX_INITIALIZER(lockname) \
+-		, .dep_map = { .name = #lockname }
+-#else
+-# define __DEP_MAP_MUTEX_INITIALIZER(lockname)
+-#endif
+-
+ #define __MUTEX_INITIALIZER(lockname) \
+ 		{ .count = ATOMIC_INIT(1) \
+ 		, .wait_lock = __SPIN_LOCK_UNLOCKED(lockname.wait_lock) \
+@@ -150,6 +217,8 @@
+  */
+ extern int mutex_trylock(struct mutex *lock);
+ extern void mutex_unlock(struct mutex *lock);
++#endif /* !PREEMPT_RT */
++
+ extern int atomic_dec_and_mutex_lock(atomic_t *cnt, struct mutex *lock);
+ 
+ #endif
+Index: linux-rt-2.6.31/include/linux/netdevice.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/netdevice.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/netdevice.h	2010-05-17 14:23:20.058392366 +0200
+@@ -477,7 +477,7 @@
+  * write mostly part
+  */
+ 	spinlock_t		_xmit_lock ____cacheline_aligned_in_smp;
+-	int			xmit_lock_owner;
++	void			*xmit_lock_owner;
+ 	/*
+ 	 * please use this field instead of dev->trans_start
+ 	 */
+@@ -1665,41 +1665,49 @@
+ 	return (1 << debug_value) - 1;
+ }
+ 
+-static inline void __netif_tx_lock(struct netdev_queue *txq, int cpu)
++static inline void __netif_tx_lock(struct netdev_queue *txq)
+ {
+ 	spin_lock(&txq->_xmit_lock);
+-	txq->xmit_lock_owner = cpu;
++	txq->xmit_lock_owner = (void *)current;
++}
++
++/*
++ * Do we hold the xmit_lock already?
++ */
++static inline int netif_tx_lock_recursion(struct netdev_queue *txq)
++{
++	return txq->xmit_lock_owner == (void *)current;
+ }
+ 
+ static inline void __netif_tx_lock_bh(struct netdev_queue *txq)
+ {
+ 	spin_lock_bh(&txq->_xmit_lock);
+-	txq->xmit_lock_owner = smp_processor_id();
++	txq->xmit_lock_owner = (void *)current;
+ }
+ 
+ static inline int __netif_tx_trylock(struct netdev_queue *txq)
+ {
+ 	int ok = spin_trylock(&txq->_xmit_lock);
+ 	if (likely(ok))
+-		txq->xmit_lock_owner = smp_processor_id();
++		txq->xmit_lock_owner = (void *)current;
+ 	return ok;
+ }
+ 
+ static inline void __netif_tx_unlock(struct netdev_queue *txq)
+ {
+-	txq->xmit_lock_owner = -1;
++	txq->xmit_lock_owner = (void *)-1;
+ 	spin_unlock(&txq->_xmit_lock);
+ }
+ 
+ static inline void __netif_tx_unlock_bh(struct netdev_queue *txq)
+ {
+-	txq->xmit_lock_owner = -1;
++	txq->xmit_lock_owner = (void *)-1;
+ 	spin_unlock_bh(&txq->_xmit_lock);
+ }
+ 
+ static inline void txq_trans_update(struct netdev_queue *txq)
+ {
+-	if (txq->xmit_lock_owner != -1)
++	if (txq->xmit_lock_owner != (void *)-1)
+ 		txq->trans_start = jiffies;
+ }
+ 
+@@ -1712,10 +1720,8 @@
+ static inline void netif_tx_lock(struct net_device *dev)
+ {
+ 	unsigned int i;
+-	int cpu;
+ 
+ 	spin_lock(&dev->tx_global_lock);
+-	cpu = smp_processor_id();
+ 	for (i = 0; i < dev->num_tx_queues; i++) {
+ 		struct netdev_queue *txq = netdev_get_tx_queue(dev, i);
+ 
+@@ -1725,7 +1731,7 @@
+ 		 * the ->hard_start_xmit() handler and already
+ 		 * checked the frozen bit.
+ 		 */
+-		__netif_tx_lock(txq, cpu);
++		__netif_tx_lock(txq);
+ 		set_bit(__QUEUE_STATE_FROZEN, &txq->state);
+ 		__netif_tx_unlock(txq);
+ 	}
+@@ -1761,9 +1767,9 @@
+ 	local_bh_enable();
+ }
+ 
+-#define HARD_TX_LOCK(dev, txq, cpu) {			\
++#define HARD_TX_LOCK(dev, txq) {			\
+ 	if ((dev->features & NETIF_F_LLTX) == 0) {	\
+-		__netif_tx_lock(txq, cpu);		\
++		__netif_tx_lock(txq);			\
+ 	}						\
+ }
+ 
+@@ -1776,14 +1782,12 @@
+ static inline void netif_tx_disable(struct net_device *dev)
+ {
+ 	unsigned int i;
+-	int cpu;
+ 
+ 	local_bh_disable();
+-	cpu = smp_processor_id();
+ 	for (i = 0; i < dev->num_tx_queues; i++) {
+ 		struct netdev_queue *txq = netdev_get_tx_queue(dev, i);
+ 
+-		__netif_tx_lock(txq, cpu);
++		__netif_tx_lock(txq);
+ 		netif_tx_stop_queue(txq);
+ 		__netif_tx_unlock(txq);
+ 	}
+Index: linux-rt-2.6.31/include/linux/netfilter/x_tables.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/netfilter/x_tables.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/netfilter/x_tables.h	2010-05-17 14:23:20.058392366 +0200
+@@ -468,22 +468,35 @@
+  * _Only_ that special combination of being per-cpu and never getting
+  * re-entered asynchronously means that the count is safe.
+  */
+-static inline void xt_info_rdlock_bh(void)
++static inline int xt_info_rdlock_bh(void)
+ {
+ 	struct xt_info_lock *lock;
++	int cpu;
+ 
+ 	local_bh_disable();
+-	lock = &__get_cpu_var(xt_info_locks);
+-	if (likely(!lock->readers++))
++	preempt_disable_rt();
++	cpu = smp_processor_id();
++	lock = &per_cpu(xt_info_locks, cpu);
++	if (likely(!lock->readers++)) {
++		preempt_enable_rt();
+ 		spin_lock(&lock->lock);
++	} else
++		preempt_enable_rt();
++	return cpu;
+ }
+ 
+-static inline void xt_info_rdunlock_bh(void)
++static inline void xt_info_rdunlock_bh(int cpu)
+ {
+-	struct xt_info_lock *lock = &__get_cpu_var(xt_info_locks);
++	struct xt_info_lock *lock = &per_cpu(xt_info_locks, cpu);
+ 
+-	if (likely(!--lock->readers))
++	preempt_disable_rt();
++
++	if (likely(!--lock->readers)) {
++		preempt_enable_rt();
+ 		spin_unlock(&lock->lock);
++	} else
++		preempt_enable_rt();
++
+ 	local_bh_enable();
+ }
+ 
+Index: linux-rt-2.6.31/include/linux/netpoll.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/netpoll.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/netpoll.h	2010-05-17 14:23:20.058392366 +0200
+@@ -84,7 +84,7 @@
+ 	rcu_read_lock(); /* deal with race on ->npinfo */
+ 	if (dev && dev->npinfo) {
+ 		spin_lock(&napi->poll_lock);
+-		napi->poll_owner = smp_processor_id();
++		napi->poll_owner = raw_smp_processor_id();
+ 		return napi;
+ 	}
+ 	return NULL;
+Index: linux-rt-2.6.31/include/linux/oprofile.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/oprofile.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/oprofile.h	2010-05-17 14:23:20.058392366 +0200
+@@ -153,7 +153,7 @@
+ int oprofilefs_ulong_from_user(unsigned long * val, char const __user * buf, size_t count);
+ 
+ /** lock for read/write safety */
+-extern spinlock_t oprofilefs_lock;
++extern atomic_spinlock_t oprofilefs_lock;
+ 
+ /**
+  * Add the contents of a circular buffer to the event buffer.
+Index: linux-rt-2.6.31/include/linux/page_cgroup.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/page_cgroup.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/page_cgroup.h	2010-05-17 14:23:20.058392366 +0200
+@@ -12,6 +12,7 @@
+  */
+ struct page_cgroup {
+ 	unsigned long flags;
++	spinlock_t lock;
+ 	struct mem_cgroup *mem_cgroup;
+ 	struct page *page;
+ 	struct list_head lru;		/* per cgroup LRU list */
+@@ -70,17 +71,17 @@
+ 
+ static inline void lock_page_cgroup(struct page_cgroup *pc)
+ {
+-	bit_spin_lock(PCG_LOCK, &pc->flags);
++	spin_lock(&pc->lock);
+ }
+ 
+ static inline int trylock_page_cgroup(struct page_cgroup *pc)
+ {
+-	return bit_spin_trylock(PCG_LOCK, &pc->flags);
++	return spin_trylock(&pc->lock);
+ }
+ 
+ static inline void unlock_page_cgroup(struct page_cgroup *pc)
+ {
+-	bit_spin_unlock(PCG_LOCK, &pc->flags);
++	spin_unlock(&pc->lock);
+ }
+ 
+ #else /* CONFIG_CGROUP_MEM_RES_CTLR */
+Index: linux-rt-2.6.31/include/linux/pagevec.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/pagevec.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/pagevec.h	2010-05-17 14:23:20.058392366 +0200
+@@ -9,7 +9,7 @@
+ #define _LINUX_PAGEVEC_H
+ 
+ /* 14 pointers + two long's align the pagevec structure to a power of two */
+-#define PAGEVEC_SIZE	14
++#define PAGEVEC_SIZE	8
+ 
+ struct page;
+ struct address_space;
+Index: linux-rt-2.6.31/include/linux/parport.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/parport.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/parport.h	2010-05-17 14:23:20.058392366 +0200
+@@ -264,7 +264,7 @@
+ struct ieee1284_info {
+ 	int mode;
+ 	volatile enum ieee1284_phase phase;
+-	struct semaphore irq;
++	struct anon_semaphore irq;
+ };
+ 
+ /* A parallel port */
+Index: linux-rt-2.6.31/include/linux/percpu-defs.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/percpu-defs.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/percpu-defs.h	2010-05-17 14:23:20.058392366 +0200
+@@ -38,6 +38,22 @@
+ 	DEFINE_PER_CPU_SECTION(type, name, "")
+ 
+ /*
++ * next two added for RT patch
++ * (wonder if we need corresponding DECLARE_*'s?) (clrkwllms)
++ */
++#define DEFINE_PER_CPU_SPINLOCK(name, section)				\
++	__attribute__((__section__(PER_CPU_BASE_SECTION section)))	\
++	PER_CPU_ATTRIBUTES __DEFINE_SPINLOCK(per_cpu__lock_##name##_locked);
++
++#define DECLARE_PER_CPU_LOCKED(type, name)				\
++	extern PER_CPU_ATTRIBUTES spinlock_t __per_cpu_var_lock(name);	\
++	extern PER_CPU_ATTRIBUTES __typeof__(type) __per_cpu_var_lock_var(name)
++
++#define DEFINE_PER_CPU_LOCKED(type, name)				\
++	DEFINE_PER_CPU_SPINLOCK(name, "")				\
++	DEFINE_PER_CPU_SECTION(type, name##_locked, "")
++
++/*
+  * Declaration/definition used for per-CPU variables that must come first in
+  * the set of variables.
+  */
+@@ -79,7 +95,9 @@
+  * Intermodule exports for per-CPU variables.
+  */
+ #define EXPORT_PER_CPU_SYMBOL(var) EXPORT_SYMBOL(per_cpu__##var)
++#define EXPORT_PER_CPU_LOCKED_SYMBOL(var) EXPORT_SYMBOL(per_cpu__##var##_locked)
+ #define EXPORT_PER_CPU_SYMBOL_GPL(var) EXPORT_SYMBOL_GPL(per_cpu__##var)
++#define EXPORT_PER_CPU_LOCKED_SYMBOL_GPL(var) EXPORT_SYMBOL_GPL(per_cpu__##var##_locked)
+ 
+ 
+ #endif /* _LINUX_PERCPU_DEFS_H */
+Index: linux-rt-2.6.31/include/linux/percpu.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/percpu.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/percpu.h	2010-05-17 14:23:20.058392366 +0200
+@@ -32,6 +32,51 @@
+ 	&__get_cpu_var(var); }))
+ #define put_cpu_var(var) preempt_enable()
+ 
++/*
++ * Per-CPU data structures with an additional lock - useful for
++ * PREEMPT_RT code that wants to reschedule but also wants
++ * per-CPU data structures.
++ *
++ * 'cpu' gets updated with the CPU the task is currently executing on.
++ *
++ * NOTE: on normal !PREEMPT_RT kernels these per-CPU variables
++ * are the same as the normal per-CPU variables, so there no
++ * runtime overhead.
++ */
++#ifdef CONFIG_PREEMPT_RT
++#define get_cpu_var_locked(var, cpuptr)			\
++(*({							\
++	spinlock_t *__lock;				\
++	int __cpu;					\
++							\
++again:							\
++	__cpu = raw_smp_processor_id();			\
++	__lock = &__get_cpu_lock(var, __cpu);		\
++	spin_lock(__lock);				\
++	if (!cpu_online(__cpu)) {			\
++		spin_unlock(__lock);			\
++		goto again;				\
++	}						\
++	*(cpuptr) = __cpu;				\
++	&__get_cpu_var_locked(var, __cpu);		\
++}))
++#else
++#define get_cpu_var_locked(var, cpuptr)			\
++(*({							\
++	int __cpu;					\
++							\
++	preempt_disable();				\
++	__cpu = smp_processor_id();			\
++	spin_lock(&__get_cpu_lock(var, __cpu));		\
++	preempt_enable();				\
++	*(cpuptr) = __cpu;				\
++	&__get_cpu_var_locked(var, __cpu);		\
++}))
++#endif
++
++#define put_cpu_var_locked(var, cpu) \
++	 do { (void)cpu; spin_unlock(&__get_cpu_lock(var, cpu)); } while (0)
++
+ #ifdef CONFIG_SMP
+ 
+ #ifdef CONFIG_HAVE_DYNAMIC_PER_CPU_AREA
+Index: linux-rt-2.6.31/include/linux/percpu_counter.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/percpu_counter.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/percpu_counter.h	2010-05-17 14:23:20.058392366 +0200
+@@ -16,7 +16,7 @@
+ #ifdef CONFIG_SMP
+ 
+ struct percpu_counter {
+-	spinlock_t lock;
++	atomic_spinlock_t lock;
+ 	s64 count;
+ #ifdef CONFIG_HOTPLUG_CPU
+ 	struct list_head list;	/* All percpu_counters are on a list */
+Index: linux-rt-2.6.31/include/linux/perf_counter.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/perf_counter.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/perf_counter.h	2010-05-17 14:23:20.058392366 +0200
+@@ -607,6 +607,9 @@
+ 	int				pending_kill;
+ 	int				pending_disable;
+ 	struct perf_pending_entry	pending;
++#ifdef CONFIG_PREEMPT_RT
++	struct perf_pending_entry	pending_softirq;
++#endif
+ 
+ 	atomic_t			event_limit;
+ 
+@@ -628,7 +631,7 @@
+ 	 * Protect the states of the counters in the list,
+ 	 * nr_active, and the list:
+ 	 */
+-	spinlock_t			lock;
++	atomic_spinlock_t		lock;
+ 	/*
+ 	 * Protect the list of counters.  Locking either mutex or lock
+ 	 * is sufficient to ensure the list doesn't change; to change
+@@ -698,6 +701,7 @@
+ extern void perf_counter_free_task(struct task_struct *task);
+ extern void set_perf_counter_pending(void);
+ extern void perf_counter_do_pending(void);
++extern void perf_counter_do_pending_softirq(void);
+ extern void perf_counter_print_debug(void);
+ extern void __perf_disable(void);
+ extern bool __perf_enable(void);
+@@ -761,6 +765,8 @@
+ extern int sysctl_perf_counter_sample_rate;
+ 
+ extern void perf_counter_init(void);
++extern void perf_tpcounter_event(int event_id, u64 addr, u64 count,
++				 void *record, int entry_size);
+ 
+ #ifndef perf_misc_flags
+ #define perf_misc_flags(regs)	(user_mode(regs) ? PERF_EVENT_MISC_USER : \
+@@ -780,6 +786,7 @@
+ static inline void perf_counter_exit_task(struct task_struct *child)	{ }
+ static inline void perf_counter_free_task(struct task_struct *task)	{ }
+ static inline void perf_counter_do_pending(void)			{ }
++static inline void perf_counter_do_pending_softirq(void)		{ }
+ static inline void perf_counter_print_debug(void)			{ }
+ static inline void perf_disable(void)					{ }
+ static inline void perf_enable(void)					{ }
+Index: linux-rt-2.6.31/include/linux/plist.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/plist.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/plist.h	2010-05-17 14:23:20.058392366 +0200
+@@ -75,13 +75,16 @@
+ 
+ #include <linux/kernel.h>
+ #include <linux/list.h>
+-#include <linux/spinlock_types.h>
++
++struct spinlock;
++struct atomic_spinlock;
+ 
+ struct plist_head {
+ 	struct list_head prio_list;
+ 	struct list_head node_list;
+ #ifdef CONFIG_DEBUG_PI_LIST
+-	spinlock_t *lock;
++	struct atomic_spinlock *alock;
++	struct spinlock *slock;
+ #endif
+ };
+ 
+@@ -91,9 +94,11 @@
+ };
+ 
+ #ifdef CONFIG_DEBUG_PI_LIST
+-# define PLIST_HEAD_LOCK_INIT(_lock)	.lock = _lock
++# define PLIST_HEAD_LOCK_INIT(_lock)		.slock = _lock
++# define PLIST_HEAD_LOCK_INIT_ATOMIC(_lock)	.alock = _lock
+ #else
+ # define PLIST_HEAD_LOCK_INIT(_lock)
++# define PLIST_HEAD_LOCK_INIT_ATOMIC(_lock)
+ #endif
+ 
+ #define _PLIST_HEAD_INIT(head)				\
+@@ -107,11 +112,22 @@
+  */
+ #define PLIST_HEAD_INIT(head, _lock)			\
+ {							\
+-        _PLIST_HEAD_INIT(head),                         \
++	_PLIST_HEAD_INIT(head),				\
+ 	PLIST_HEAD_LOCK_INIT(&(_lock))			\
+ }
+ 
+ /**
++ * PLIST_HEAD_INIT_ATOMIC - static struct plist_head initializer
++ * @head:	struct plist_head variable name
++ * @_lock:	lock to initialize for this list
++ */
++#define PLIST_HEAD_INIT_ATOMIC(head, _lock)		\
++{							\
++	_PLIST_HEAD_INIT(head),				\
++	PLIST_HEAD_LOCK_INIT_ATOMIC(&(_lock))		\
++}
++
++/**
+  * PLIST_NODE_INIT - static struct plist_node initializer
+  * @node:	struct plist_node variable name
+  * @__prio:	initial node priority
+@@ -119,7 +135,7 @@
+ #define PLIST_NODE_INIT(node, __prio)			\
+ {							\
+ 	.prio  = (__prio),				\
+-	.plist = { _PLIST_HEAD_INIT((node).plist) }, 	\
++	.plist = { _PLIST_HEAD_INIT((node).plist) },	\
+ }
+ 
+ /**
+@@ -128,12 +144,29 @@
+  * @lock:	list spinlock, remembered for debugging
+  */
+ static inline void
+-plist_head_init(struct plist_head *head, spinlock_t *lock)
++plist_head_init(struct plist_head *head, struct spinlock *lock)
++{
++	INIT_LIST_HEAD(&head->prio_list);
++	INIT_LIST_HEAD(&head->node_list);
++#ifdef CONFIG_DEBUG_PI_LIST
++	head->slock = lock;
++	head->alock = NULL;
++#endif
++}
++
++/**
++ * plist_head_init_atomic - dynamic struct plist_head initializer
++ * @head:	&struct plist_head pointer
++ * @lock:	list atomic_spinlock, remembered for debugging
++ */
++static inline void
++plist_head_init_atomic(struct plist_head *head, struct atomic_spinlock *lock)
+ {
+ 	INIT_LIST_HEAD(&head->prio_list);
+ 	INIT_LIST_HEAD(&head->node_list);
+ #ifdef CONFIG_DEBUG_PI_LIST
+-	head->lock = lock;
++	head->alock = lock;
++	head->slock = NULL;
+ #endif
+ }
+ 
+Index: linux-rt-2.6.31/include/linux/preempt.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/preempt.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/preempt.h	2010-05-17 14:23:20.058392366 +0200
+@@ -33,12 +33,24 @@
+ 	barrier(); \
+ } while (0)
+ 
+-#define preempt_enable_no_resched() \
++#define __preempt_enable_no_resched() \
+ do { \
+ 	barrier(); \
+ 	dec_preempt_count(); \
+ } while (0)
+ 
++#ifdef CONFIG_DEBUG_PREEMPT
++extern void notrace preempt_enable_no_resched(void);
++#else
++# define preempt_enable_no_resched() __preempt_enable_no_resched()
++#endif
++
++#define preempt_enable_and_schedule() \
++do { \
++	__preempt_enable_no_resched(); \
++	schedule(); \
++} while (0)
++
+ #define preempt_check_resched() \
+ do { \
+ 	if (unlikely(test_thread_flag(TIF_NEED_RESCHED))) \
+@@ -47,7 +59,7 @@
+ 
+ #define preempt_enable() \
+ do { \
+-	preempt_enable_no_resched(); \
++	__preempt_enable_no_resched(); \
+ 	barrier(); \
+ 	preempt_check_resched(); \
+ } while (0)
+@@ -84,6 +96,8 @@
+ 
+ #define preempt_disable()		do { } while (0)
+ #define preempt_enable_no_resched()	do { } while (0)
++#define __preempt_enable_no_resched()	do { } while (0)
++#define preempt_enable_and_schedule()	schedule()
+ #define preempt_enable()		do { } while (0)
+ #define preempt_check_resched()		do { } while (0)
+ 
+@@ -93,6 +107,18 @@
+ 
+ #endif
+ 
++#ifdef CONFIG_PREEMPT_RT
++# define preempt_disable_rt()		preempt_disable()
++# define preempt_enable_rt()		preempt_enable()
++# define preempt_disable_nort()		do { } while (0)
++# define preempt_enable_nort()		do { } while (0)
++#else
++# define preempt_disable_rt()		do { } while (0)
++# define preempt_enable_rt()		do { } while (0)
++# define preempt_disable_nort()		preempt_disable()
++# define preempt_enable_nort()		preempt_enable()
++#endif
++
+ #ifdef CONFIG_PREEMPT_NOTIFIERS
+ 
+ struct preempt_notifier;
+Index: linux-rt-2.6.31/include/linux/profile.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/profile.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/profile.h	2010-05-17 14:23:20.058392366 +0200
+@@ -8,10 +8,11 @@
+ 
+ #include <asm/errno.h>
+ 
+-#define CPU_PROFILING	1
+-#define SCHED_PROFILING	2
+-#define SLEEP_PROFILING	3
+-#define KVM_PROFILING	4
++#define CPU_PROFILING		1
++#define SCHED_PROFILING		2
++#define SLEEP_PROFILING		3
++#define KVM_PROFILING		4
++#define PREEMPT_PROFILING	5
+ 
+ struct proc_dir_entry;
+ struct pt_regs;
+@@ -36,6 +37,8 @@
+ 	PROFILE_MUNMAP
+ };
+ 
++extern int prof_pid;
++
+ #ifdef CONFIG_PROFILING
+ 
+ extern int prof_on __read_mostly;
+Index: linux-rt-2.6.31/include/linux/proportions.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/proportions.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/proportions.h	2010-05-17 14:23:20.058392366 +0200
+@@ -58,7 +58,7 @@
+ 	 */
+ 	int shift;
+ 	unsigned long period;
+-	spinlock_t lock;		/* protect the snapshot state */
++	atomic_spinlock_t lock;		/* protect the snapshot state */
+ };
+ 
+ int prop_local_init_percpu(struct prop_local_percpu *pl);
+@@ -106,11 +106,11 @@
+ 	 */
+ 	unsigned long period;
+ 	int shift;
+-	spinlock_t lock;		/* protect the snapshot state */
++	atomic_spinlock_t lock;		/* protect the snapshot state */
+ };
+ 
+ #define INIT_PROP_LOCAL_SINGLE(name)			\
+-{	.lock = __SPIN_LOCK_UNLOCKED(name.lock),	\
++{	.lock = __ATOMIC_SPIN_LOCK_UNLOCKED(name.lock),	\
+ }
+ 
+ int prop_local_init_single(struct prop_local_single *pl);
+Index: linux-rt-2.6.31/include/linux/quicklist.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/quicklist.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/quicklist.h	2010-05-17 14:23:20.058392366 +0200
+@@ -18,7 +18,7 @@
+ 	int nr_pages;
+ };
+ 
+-DECLARE_PER_CPU(struct quicklist, quicklist)[CONFIG_NR_QUICK];
++DECLARE_PER_CPU_LOCKED(struct quicklist, quicklist)[CONFIG_NR_QUICK];
+ 
+ /*
+  * The two key functions quicklist_alloc and quicklist_free are inline so
+@@ -30,19 +30,27 @@
+  * The fast patch in quicklist_alloc touched only a per cpu cacheline and
+  * the first cacheline of the page itself. There is minmal overhead involved.
+  */
+-static inline void *quicklist_alloc(int nr, gfp_t flags, void (*ctor)(void *))
++static inline void *__quicklist_alloc(struct quicklist *q)
+ {
+-	struct quicklist *q;
+-	void **p = NULL;
++	void **p = q->page;
+ 
+-	q =&get_cpu_var(quicklist)[nr];
+-	p = q->page;
+ 	if (likely(p)) {
+ 		q->page = p[0];
+ 		p[0] = NULL;
+ 		q->nr_pages--;
+ 	}
+-	put_cpu_var(quicklist);
++	return p;
++}
++
++static inline void *quicklist_alloc(int nr, gfp_t flags, void (*ctor)(void *))
++{
++	struct quicklist *q;
++	void **p;
++	int cpu;
++
++	q = &get_cpu_var_locked(quicklist, &cpu)[nr];
++	p = __quicklist_alloc(q);
++	put_cpu_var_locked(quicklist, cpu);
+ 	if (likely(p))
+ 		return p;
+ 
+@@ -56,12 +64,13 @@
+ 	struct page *page)
+ {
+ 	struct quicklist *q;
++	int cpu;
+ 
+-	q = &get_cpu_var(quicklist)[nr];
++	q = &get_cpu_var_locked(quicklist, &cpu)[nr];
+ 	*(void **)p = q->page;
+ 	q->page = p;
+ 	q->nr_pages++;
+-	put_cpu_var(quicklist);
++	put_cpu_var_locked(quicklist, cpu);
+ }
+ 
+ static inline void quicklist_free(int nr, void (*dtor)(void *), void *pp)
+Index: linux-rt-2.6.31/include/linux/radix-tree.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/radix-tree.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/radix-tree.h	2010-05-17 14:23:20.058392366 +0200
+@@ -169,7 +169,18 @@
+ 				unsigned long index, unsigned long max_scan);
+ unsigned long radix_tree_prev_hole(struct radix_tree_root *root,
+ 				unsigned long index, unsigned long max_scan);
++/*
++ * On a mutex based kernel we can freely schedule within the radix code:
++ */
++#ifdef CONFIG_PREEMPT_RT
++static inline int radix_tree_preload(gfp_t gfp_mask)
++{
++	return 0;
++}
++#else
+ int radix_tree_preload(gfp_t gfp_mask);
++#endif
++
+ void radix_tree_init(void);
+ void *radix_tree_tag_set(struct radix_tree_root *root,
+ 			unsigned long index, unsigned int tag);
+@@ -189,7 +200,9 @@
+ 
+ static inline void radix_tree_preload_end(void)
+ {
++#ifndef CONFIG_PREEMPT_RT
+ 	preempt_enable();
++#endif
+ }
+ 
+ #endif /* _LINUX_RADIX_TREE_H */
+Index: linux-rt-2.6.31/include/linux/ring_buffer.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/ring_buffer.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/ring_buffer.h	2010-05-17 14:23:20.058392366 +0200
+@@ -75,20 +75,6 @@
+ }
+ 
+ /*
+- * ring_buffer_event_discard can discard any event in the ring buffer.
+- *   it is up to the caller to protect against a reader from
+- *   consuming it or a writer from wrapping and replacing it.
+- *
+- * No external protection is needed if this is called before
+- * the event is commited. But in that case it would be better to
+- * use ring_buffer_discard_commit.
+- *
+- * Note, if an event that has not been committed is discarded
+- * with ring_buffer_event_discard, it must still be committed.
+- */
+-void ring_buffer_event_discard(struct ring_buffer_event *event);
+-
+-/*
+  * ring_buffer_discard_commit will remove an event that has not
+  *   ben committed yet. If this is used, then ring_buffer_unlock_commit
+  *   must not be called on the discarded event. This function
+@@ -154,8 +140,17 @@
+ void ring_buffer_reset_cpu(struct ring_buffer *buffer, int cpu);
+ void ring_buffer_reset(struct ring_buffer *buffer);
+ 
++#ifdef CONFIG_RING_BUFFER_ALLOW_SWAP
+ int ring_buffer_swap_cpu(struct ring_buffer *buffer_a,
+ 			 struct ring_buffer *buffer_b, int cpu);
++#else
++static inline int
++ring_buffer_swap_cpu(struct ring_buffer *buffer_a,
++		     struct ring_buffer *buffer_b, int cpu)
++{
++	return -ENODEV;
++}
++#endif
+ 
+ int ring_buffer_empty(struct ring_buffer *buffer);
+ int ring_buffer_empty_cpu(struct ring_buffer *buffer, int cpu);
+@@ -170,7 +165,6 @@
+ unsigned long ring_buffer_entries_cpu(struct ring_buffer *buffer, int cpu);
+ unsigned long ring_buffer_overrun_cpu(struct ring_buffer *buffer, int cpu);
+ unsigned long ring_buffer_commit_overrun_cpu(struct ring_buffer *buffer, int cpu);
+-unsigned long ring_buffer_nmi_dropped_cpu(struct ring_buffer *buffer, int cpu);
+ 
+ u64 ring_buffer_time_stamp(struct ring_buffer *buffer, int cpu);
+ void ring_buffer_normalize_time_stamp(struct ring_buffer *buffer,
+Index: linux-rt-2.6.31/include/linux/rt_lock.h
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ linux-rt-2.6.31/include/linux/rt_lock.h	2010-05-17 14:23:20.058392366 +0200
+@@ -0,0 +1,214 @@
++#ifndef __LINUX_RT_LOCK_H
++#define __LINUX_RT_LOCK_H
++
++/*
++ * Real-Time Preemption Support
++ *
++ * started by Ingo Molnar:
++ *
++ *  Copyright (C) 2004, 2005 Red Hat, Inc., Ingo Molnar <mingo@redhat.com>
++ *
++ * This file contains the main data structure definitions.
++ */
++#include <linux/rtmutex.h>
++#include <asm/atomic.h>
++#include <linux/spinlock_types.h>
++
++#ifdef CONFIG_PREEMPT_RT
++
++static inline int preempt_rt(void) { return 1; }
++
++/*
++ * spinlocks - an RT mutex plus lock-break field:
++ */
++typedef struct spinlock {
++	struct rt_mutex		lock;
++	unsigned int		break_lock;
++#ifdef CONFIG_DEBUG_LOCK_ALLOC
++	struct lockdep_map	dep_map;
++#endif
++} spinlock_t;
++
++#ifdef CONFIG_DEBUG_RT_MUTEXES
++# define __RT_SPIN_INITIALIZER(name) \
++	{ \
++	.wait_lock = __ATOMIC_SPIN_LOCK_UNLOCKED(name), \
++	.save_state = 1, \
++	.file = __FILE__, \
++	.line = __LINE__ , \
++	}
++#else
++# define __RT_SPIN_INITIALIZER(name) \
++	{ .wait_lock = __ATOMIC_SPIN_LOCK_UNLOCKED(name) }
++#endif
++
++#define __SPIN_LOCK_UNLOCKED(name)			\
++	{ .lock = __RT_SPIN_INITIALIZER(name),		\
++	  SPIN_DEP_MAP_INIT(name) }
++
++#define SPIN_LOCK_UNLOCKED	__SPIN_LOCK_UNLOCKED(spin_old_style)
++
++#define __DEFINE_SPINLOCK(name) \
++	spinlock_t name = __SPIN_LOCK_UNLOCKED(name)
++
++#define DEFINE_SPINLOCK(name) \
++	spinlock_t name __cacheline_aligned_in_smp = __SPIN_LOCK_UNLOCKED(name)
++
++extern void
++__rt_spin_lock_init(spinlock_t *lock, char *name, struct lock_class_key *key);
++
++#define spin_lock_init(lock)				\
++do {							\
++	static struct lock_class_key __key;		\
++							\
++	__rt_spin_lock_init(lock, #lock, &__key);	\
++} while (0)
++
++extern void __lockfunc rt_spin_lock(spinlock_t *lock);
++extern void __lockfunc rt_spin_lock_nested(spinlock_t *lock, int subclass);
++extern void __lockfunc rt_spin_unlock(spinlock_t *lock);
++extern void __lockfunc rt_spin_unlock_wait(spinlock_t *lock);
++extern int __lockfunc
++rt_spin_trylock_irqsave(spinlock_t *lock, unsigned long *flags);
++extern int __lockfunc rt_spin_trylock(spinlock_t *lock);
++extern int atomic_dec_and_spin_lock(atomic_t *atomic, spinlock_t *lock);
++
++/*
++ * lockdep-less calls, for derived types like rwlock:
++ * (for trylock they can use rt_mutex_trylock() directly.
++ */
++extern void __lockfunc __rt_spin_lock(struct rt_mutex *lock);
++extern void __lockfunc __rt_spin_unlock(struct rt_mutex *lock);
++
++/*
++ * rwlocks - an RW semaphore plus lock-break field:
++ */
++typedef struct {
++	struct rt_mutex		lock;
++	int			read_depth;
++	unsigned int		break_lock;
++#ifdef CONFIG_DEBUG_LOCK_ALLOC
++	struct lockdep_map	dep_map;
++#endif
++} rwlock_t;
++
++#ifdef CONFIG_DEBUG_LOCK_ALLOC
++# define RW_DEP_MAP_INIT(lockname)	.dep_map = { .name = #lockname }
++#else
++# define RW_DEP_MAP_INIT(lockname)
++#endif
++
++#define __RW_LOCK_UNLOCKED(name) \
++	{ .lock = __RT_SPIN_INITIALIZER(name),	\
++	  RW_DEP_MAP_INIT(name) }
++
++#define RW_LOCK_UNLOCKED	__RW_LOCK_UNLOCKED(rw_old_style)
++
++#define DEFINE_RWLOCK(name) \
++	rwlock_t name __cacheline_aligned_in_smp = __RW_LOCK_UNLOCKED(name)
++
++extern void __lockfunc rt_write_lock(rwlock_t *rwlock);
++extern void __lockfunc rt_read_lock(rwlock_t *rwlock);
++extern int __lockfunc rt_write_trylock(rwlock_t *rwlock);
++extern int __lockfunc rt_write_trylock_irqsave(rwlock_t *trylock,
++					       unsigned long *flags);
++extern int __lockfunc rt_read_trylock(rwlock_t *rwlock);
++extern void __lockfunc rt_write_unlock(rwlock_t *rwlock);
++extern void __lockfunc rt_read_unlock(rwlock_t *rwlock);
++extern unsigned long __lockfunc rt_write_lock_irqsave(rwlock_t *rwlock);
++extern unsigned long __lockfunc rt_read_lock_irqsave(rwlock_t *rwlock);
++extern void
++__rt_rwlock_init(rwlock_t *rwlock, char *name, struct lock_class_key *key);
++
++#define rwlock_init(rwl)				\
++do {							\
++	static struct lock_class_key __key;		\
++							\
++	__rt_rwlock_init(rwl, #rwl, &__key);		\
++} while (0)
++
++/*
++ * RW-semaphores are a spinlock plus a reader-depth count.
++ *
++ * Note that the semantics are different from the usual
++ * Linux rw-sems, in PREEMPT_RT mode we do not allow
++ * multiple readers to hold the lock at once, we only allow
++ * a read-lock owner to read-lock recursively. This is
++ * better for latency, makes the implementation inherently
++ * fair and makes it simpler as well:
++ */
++struct rw_semaphore {
++	struct rt_mutex		lock;
++	int			read_depth;
++#ifdef CONFIG_DEBUG_LOCK_ALLOC
++	struct lockdep_map	dep_map;
++#endif
++};
++
++#define __RWSEM_INITIALIZER(name) \
++	{ .lock = __RT_MUTEX_INITIALIZER(name.lock), \
++	  RW_DEP_MAP_INIT(name) }
++
++#define DECLARE_RWSEM(lockname) \
++	struct rw_semaphore lockname = __RWSEM_INITIALIZER(lockname)
++
++extern void  __rt_rwsem_init(struct rw_semaphore *rwsem, char *name,
++				     struct lock_class_key *key);
++
++# define rt_init_rwsem(sem)				\
++do {							\
++	static struct lock_class_key __key;		\
++							\
++	__rt_rwsem_init((sem), #sem, &__key);		\
++} while (0)
++
++extern void  rt_down_write(struct rw_semaphore *rwsem);
++extern void
++rt_down_read_nested(struct rw_semaphore *rwsem, int subclass);
++extern void
++rt_down_write_nested(struct rw_semaphore *rwsem, int subclass);
++extern void  rt_down_read(struct rw_semaphore *rwsem);
++extern int  rt_down_write_trylock(struct rw_semaphore *rwsem);
++extern int  rt_down_read_trylock(struct rw_semaphore *rwsem);
++extern void  rt_up_read(struct rw_semaphore *rwsem);
++extern void  rt_up_write(struct rw_semaphore *rwsem);
++extern void  rt_downgrade_write(struct rw_semaphore *rwsem);
++
++/*
++ * Semaphores - a spinlock plus the semaphore count:
++ */
++struct semaphore {
++	atomic_t		count;
++	struct rt_mutex		lock;
++};
++
++#define DEFINE_SEMAPHORE(name) \
++struct semaphore name = \
++	{ .count = { 1 }, .lock = __RT_MUTEX_INITIALIZER(name.lock) }
++
++extern void
++__sema_init(struct semaphore *sem, int val, char *name, char *file, int line);
++
++#define rt_sema_init(sem, val) \
++		__sema_init(sem, val, #sem, __FILE__, __LINE__)
++
++/*
++ * No locked initialization for RT semaphores
++ */
++extern void  rt_down(struct semaphore *sem);
++extern int  rt_down_interruptible(struct semaphore *sem);
++extern int  rt_down_timeout(struct semaphore *sem, long jiffies);
++extern int  rt_down_trylock(struct semaphore *sem);
++extern void  rt_up(struct semaphore *sem);
++
++#define rt_sem_is_locked(s)	rt_mutex_is_locked(&(s)->lock)
++#define rt_sema_count(s)	atomic_read(&(s)->count)
++
++#else
++
++static inline int preempt_rt(void) { return 0; }
++
++#endif /* CONFIG_PREEMPT_RT */
++
++#endif
++
+Index: linux-rt-2.6.31/include/linux/rtmutex.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/rtmutex.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/rtmutex.h	2010-05-17 14:23:20.058392366 +0200
+@@ -24,7 +24,7 @@
+  * @owner:	the mutex owner
+  */
+ struct rt_mutex {
+-	spinlock_t		wait_lock;
++	atomic_spinlock_t	wait_lock;
+ 	struct plist_head	wait_list;
+ 	struct task_struct	*owner;
+ #ifdef CONFIG_DEBUG_RT_MUTEXES
+@@ -63,8 +63,8 @@
+ #endif
+ 
+ #define __RT_MUTEX_INITIALIZER(mutexname) \
+-	{ .wait_lock = __SPIN_LOCK_UNLOCKED(mutexname.wait_lock) \
+-	, .wait_list = PLIST_HEAD_INIT(mutexname.wait_list, mutexname.wait_lock) \
++	{ .wait_lock = __ATOMIC_SPIN_LOCK_UNLOCKED(mutexname.wait_lock) \
++	, .wait_list = PLIST_HEAD_INIT_ATOMIC(mutexname.wait_list, mutexname.wait_lock) \
+ 	, .owner = NULL \
+ 	__DEBUG_RT_MUTEX_INITIALIZER(mutexname)}
+ 
+@@ -88,6 +88,8 @@
+ extern void rt_mutex_lock(struct rt_mutex *lock);
+ extern int rt_mutex_lock_interruptible(struct rt_mutex *lock,
+ 						int detect_deadlock);
++extern int rt_mutex_lock_killable(struct rt_mutex *lock,
++				  int detect_deadlock);
+ extern int rt_mutex_timed_lock(struct rt_mutex *lock,
+ 					struct hrtimer_sleeper *timeout,
+ 					int detect_deadlock);
+@@ -98,7 +100,7 @@
+ 
+ #ifdef CONFIG_RT_MUTEXES
+ # define INIT_RT_MUTEXES(tsk)						\
+-	.pi_waiters	= PLIST_HEAD_INIT(tsk.pi_waiters, tsk.pi_lock),	\
++	.pi_waiters	= PLIST_HEAD_INIT_ATOMIC(tsk.pi_waiters, tsk.pi_lock),	\
+ 	INIT_RT_MUTEX_DEBUG(tsk)
+ #else
+ # define INIT_RT_MUTEXES(tsk)
+Index: linux-rt-2.6.31/include/linux/rwlock.h
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ linux-rt-2.6.31/include/linux/rwlock.h	2010-05-17 14:23:20.058392366 +0200
+@@ -0,0 +1,206 @@
++#ifndef __LINUX_RWLOCK_H
++#define __LINUX_RWLOCK_H
++
++#ifndef __LINUX_SPINLOCK_H
++# error "please don't include this file directly"
++#endif
++
++#ifdef CONFIG_PREEMPT_RT
++
++#define read_trylock(lock)	__cond_lock(lock, rt_read_trylock(lock))
++#define write_trylock(lock)	__cond_lock(lock, rt_write_trylock(lock))
++
++#define write_trylock_irqsave(lock, flags)	\
++	__cond_lock(lock, rt_write_trylock_irqsave(lock, &flags))
++
++#define write_lock(lock)	rt_write_lock(lock)
++#define read_lock(lock)		rt_read_lock(lock)
++
++#define read_lock_irqsave(lock, flags)			\
++	do {						\
++		typecheck(unsigned long, flags);	\
++		flags = rt_read_lock_irqsave(lock);	\
++	} while (0)
++
++#define write_lock_irqsave(lock, flags)			\
++	do {						\
++		typecheck(unsigned long, flags);	\
++		flags = rt_write_lock_irqsave(lock);	\
++	} while (0)
++
++#define read_lock_irq(lock)	rt_read_lock(lock)
++#define read_lock_bh(lock)	rt_read_lock(lock)
++
++#define write_lock_irq(lock)	rt_write_lock(lock)
++#define write_lock_bh(lock)	rt_write_lock(lock)
++
++#define read_unlock(lock)	rt_read_unlock(lock)
++#define write_unlock(lock)	rt_write_unlock(lock)
++#define read_unlock_irq(lock)	rt_read_unlock(lock)
++#define write_unlock_irq(lock)	rt_write_unlock(lock)
++
++#define read_unlock_irqrestore(lock, flags)		\
++	do {						\
++		typecheck(unsigned long, flags);	\
++		(void) flags;				\
++		rt_read_unlock(lock);			\
++	} while (0)
++
++#define read_unlock_bh(lock)	rt_read_unlock(lock)
++
++#define write_unlock_irqrestore(lock, flags) \
++	do {						\
++		typecheck(unsigned long, flags);	\
++		(void) flags;				\
++		rt_write_unlock(lock);			\
++	} while (0)
++
++#define write_unlock_bh(lock)	rt_write_unlock(lock)
++
++#else
++
++/*
++ * rwlock related methods
++ *
++ * split out from spinlock.h
++ *
++ * portions Copyright 2005, Red Hat, Inc., Ingo Molnar
++ * Released under the General Public License (GPL).
++ */
++
++#ifdef CONFIG_DEBUG_SPINLOCK
++  extern void __rwlock_init(rwlock_t *lock, const char *name,
++			    struct lock_class_key *key);
++# define rwlock_init(lock)					\
++do {								\
++	static struct lock_class_key __key;			\
++								\
++	__rwlock_init((lock), #lock, &__key);			\
++} while (0)
++#else
++# define rwlock_init(lock)					\
++	do { *(lock) = RW_LOCK_UNLOCKED; } while (0)
++#endif
++
++#ifdef CONFIG_DEBUG_SPINLOCK
++ extern void _raw_read_lock(rwlock_t *lock);
++#define _raw_read_lock_flags(lock, flags) _raw_read_lock(lock)
++ extern int _raw_read_trylock(rwlock_t *lock);
++ extern void _raw_read_unlock(rwlock_t *lock);
++ extern void _raw_write_lock(rwlock_t *lock);
++#define _raw_write_lock_flags(lock, flags) _raw_write_lock(lock)
++ extern int _raw_write_trylock(rwlock_t *lock);
++ extern void _raw_write_unlock(rwlock_t *lock);
++#else
++# define _raw_read_lock(rwlock)		__raw_read_lock(&(rwlock)->raw_lock)
++# define _raw_read_lock_flags(lock, flags) \
++		__raw_read_lock_flags(&(lock)->raw_lock, *(flags))
++# define _raw_read_trylock(rwlock)	__raw_read_trylock(&(rwlock)->raw_lock)
++# define _raw_read_unlock(rwlock)	__raw_read_unlock(&(rwlock)->raw_lock)
++# define _raw_write_lock(rwlock)	__raw_write_lock(&(rwlock)->raw_lock)
++# define _raw_write_lock_flags(lock, flags) \
++		__raw_write_lock_flags(&(lock)->raw_lock, *(flags))
++# define _raw_write_trylock(rwlock)	__raw_write_trylock(&(rwlock)->raw_lock)
++# define _raw_write_unlock(rwlock)	__raw_write_unlock(&(rwlock)->raw_lock)
++#endif
++
++#define read_can_lock(rwlock)		__raw_read_can_lock(&(rwlock)->raw_lock)
++#define write_can_lock(rwlock)		__raw_write_can_lock(&(rwlock)->raw_lock)
++
++/*
++ * Define the various rw_lock methods.  Note we define these
++ * regardless of whether CONFIG_SMP or CONFIG_PREEMPT are set. The
++ * various methods are defined as nops in the case they are not
++ * required.
++ */
++#define read_trylock(lock)		__cond_lock(lock, _read_trylock(lock))
++#define write_trylock(lock)		__cond_lock(lock, _write_trylock(lock))
++
++#define write_lock(lock)		_write_lock(lock)
++#define read_lock(lock)			_read_lock(lock)
++
++#if defined(CONFIG_SMP) || defined(CONFIG_DEBUG_SPINLOCK)
++
++#define read_lock_irqsave(lock, flags)			\
++	do {						\
++		typecheck(unsigned long, flags);	\
++		flags = _read_lock_irqsave(lock);	\
++	} while (0)
++#define write_lock_irqsave(lock, flags)			\
++	do {						\
++		typecheck(unsigned long, flags);	\
++		flags = _write_lock_irqsave(lock);	\
++	} while (0)
++
++#else
++
++#define read_lock_irqsave(lock, flags)			\
++	do {						\
++		typecheck(unsigned long, flags);	\
++		_read_lock_irqsave(lock, flags);	\
++	} while (0)
++#define write_lock_irqsave(lock, flags)			\
++	do {						\
++		typecheck(unsigned long, flags);	\
++		_write_lock_irqsave(lock, flags);	\
++	} while (0)
++
++#endif
++
++#define read_lock_irq(lock)		_read_lock_irq(lock)
++#define read_lock_bh(lock)		_read_lock_bh(lock)
++
++#define write_lock_irq(lock)		_write_lock_irq(lock)
++#define write_lock_bh(lock)		_write_lock_bh(lock)
++
++/*
++ * We inline the unlock functions in the nondebug case:
++ */
++#if defined(CONFIG_DEBUG_SPINLOCK) || defined(CONFIG_PREEMPT) || \
++	!defined(CONFIG_SMP)
++# define read_unlock(lock)		_read_unlock(lock)
++# define write_unlock(lock)		_write_unlock(lock)
++# define read_unlock_irq(lock)		_read_unlock_irq(lock)
++# define write_unlock_irq(lock)		_write_unlock_irq(lock)
++#else
++# define read_unlock(lock) \
++    do {__raw_read_unlock(&(lock)->raw_lock); __release(lock); } while (0)
++# define write_unlock(lock) \
++    do {__raw_write_unlock(&(lock)->raw_lock); __release(lock); } while (0)
++# define read_unlock_irq(lock)			\
++do {						\
++	__raw_read_unlock(&(lock)->raw_lock);	\
++	__release(lock);			\
++	local_irq_enable();			\
++} while (0)
++# define write_unlock_irq(lock)			\
++do {						\
++	__raw_write_unlock(&(lock)->raw_lock);	\
++	__release(lock);			\
++	local_irq_enable();			\
++} while (0)
++#endif
++
++#define read_unlock_irqrestore(lock, flags)		\
++	do {						\
++		typecheck(unsigned long, flags);	\
++		_read_unlock_irqrestore(lock, flags);	\
++	} while (0)
++#define read_unlock_bh(lock)		_read_unlock_bh(lock)
++
++#define write_unlock_irqrestore(lock, flags)		\
++	do {						\
++		typecheck(unsigned long, flags);	\
++		_write_unlock_irqrestore(lock, flags);	\
++	} while (0)
++#define write_unlock_bh(lock)		_write_unlock_bh(lock)
++
++#define write_trylock_irqsave(lock, flags) \
++({ \
++	local_irq_save(flags); \
++	write_trylock(lock) ? \
++	1 : ({ local_irq_restore(flags); 0; }); \
++})
++#endif
++
++#endif /* __LINUX_RWLOCK_H */
+Index: linux-rt-2.6.31/include/linux/rwlock_types.h
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ linux-rt-2.6.31/include/linux/rwlock_types.h	2010-05-17 14:23:20.058392366 +0200
+@@ -0,0 +1,56 @@
++#ifndef __LINUX_RWLOCK_TYPES_H
++#define __LINUX_RWLOCK_TYPES_H
++
++/*
++ * include/linux/rwlock_types.h - generic rwlock type definitions
++ *				  and initializers
++ *
++ * portions Copyright 2005, Red Hat, Inc., Ingo Molnar
++ * Released under the General Public License (GPL).
++ */
++typedef struct {
++	raw_rwlock_t raw_lock;
++#ifdef CONFIG_GENERIC_LOCKBREAK
++	unsigned int break_lock;
++#endif
++#ifdef CONFIG_DEBUG_SPINLOCK
++	unsigned int magic, owner_cpu;
++	void *owner;
++#endif
++#ifdef CONFIG_DEBUG_LOCK_ALLOC
++	struct lockdep_map dep_map;
++#endif
++} rwlock_t;
++
++#define RWLOCK_MAGIC		0xdeaf1eed
++
++#ifdef CONFIG_DEBUG_LOCK_ALLOC
++# define RW_DEP_MAP_INIT(lockname)	.dep_map = { .name = #lockname }
++#else
++# define RW_DEP_MAP_INIT(lockname)
++#endif
++
++#ifdef CONFIG_DEBUG_SPINLOCK
++#define __RW_LOCK_UNLOCKED(lockname)					\
++	(rwlock_t)	{	.raw_lock = __RAW_RW_LOCK_UNLOCKED,	\
++				.magic = RWLOCK_MAGIC,			\
++				.owner = SPINLOCK_OWNER_INIT,		\
++				.owner_cpu = -1,			\
++				RW_DEP_MAP_INIT(lockname) }
++#else
++#define __RW_LOCK_UNLOCKED(lockname) \
++	(rwlock_t)	{	.raw_lock = __RAW_RW_LOCK_UNLOCKED,	\
++				RW_DEP_MAP_INIT(lockname) }
++#endif
++
++/*
++ * RW_LOCK_UNLOCKED defeat lockdep state tracking and is hence
++ * deprecated.
++ *
++ * Please use DEFINE_RWLOCK() or __RW_LOCK_UNLOCKED() as appropriate.
++ */
++#define RW_LOCK_UNLOCKED	__RW_LOCK_UNLOCKED(old_style_rw_init)
++
++#define DEFINE_RWLOCK(x)	rwlock_t x = __RW_LOCK_UNLOCKED(x)
++
++#endif /* __LINUX_RWLOCK_TYPES_H */
+Index: linux-rt-2.6.31/include/linux/rwsem-spinlock.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/rwsem-spinlock.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/rwsem-spinlock.h	2010-05-17 14:23:20.058392366 +0200
+@@ -22,6 +22,69 @@
+ struct rwsem_waiter;
+ 
+ /*
++ * the rw-anon-semaphore definition
++ * - if activity is 0 then there are no active readers or writers
++ * - if activity is +ve then that is the number of active readers
++ * - if activity is -1 then there is one active writer
++ * - if wait_list is not empty, then there are processes waiting for the semaphore
++ *
++ * the anon in the name documents that the semaphore has no full
++ * restrictions versus owner ship.
++ */
++struct rw_anon_semaphore {
++	__s32			activity;
++	spinlock_t		wait_lock;
++	struct list_head	wait_list;
++#ifdef CONFIG_DEBUG_LOCK_ALLOC
++	struct lockdep_map dep_map;
++#endif
++};
++
++#ifdef CONFIG_DEBUG_LOCK_ALLOC
++# define __RWSEM_ANON_DEP_MAP_INIT(lockname) , .dep_map = { .name = #lockname }
++#else
++# define __RWSEM_ANON_DEP_MAP_INIT(lockname)
++#endif
++
++#define __RWSEM_ANON_INITIALIZER(name) \
++{ 0, __SPIN_LOCK_UNLOCKED(name.wait_lock), LIST_HEAD_INIT((name).wait_list) \
++  __RWSEM_ANON_DEP_MAP_INIT(name) }
++
++#define DECLARE_ANON_RWSEM(name) \
++	struct rw_anon_semaphore name = __RWSEM_ANON_INITIALIZER(name)
++
++extern void __init_anon_rwsem(struct rw_anon_semaphore *sem, const char *name,
++			      struct lock_class_key *key);
++
++#define init_anon_rwsem(sem)					\
++do {								\
++	static struct lock_class_key __key;			\
++								\
++	__init_anon_rwsem((sem), #sem, &__key);			\
++} while (0)
++
++extern void __down_read(struct rw_anon_semaphore *sem);
++extern int __down_read_trylock(struct rw_anon_semaphore *sem);
++extern void __down_write(struct rw_anon_semaphore *sem);
++extern void __down_write_nested(struct rw_anon_semaphore *sem, int subclass);
++extern int __down_write_trylock(struct rw_anon_semaphore *sem);
++extern void __up_read(struct rw_anon_semaphore *sem);
++extern void __up_write(struct rw_anon_semaphore *sem);
++extern void __downgrade_write(struct rw_anon_semaphore *sem);
++
++static inline int anon_rwsem_is_locked(struct rw_anon_semaphore *sem)
++{
++	return (sem->activity != 0);
++}
++
++#ifndef CONFIG_PREEMPT_RT
++/*
++ * Non preempt-rt implementation of rw_semaphore. Same as above, but
++ * restricted vs. ownership. i.e. ownerless locked state and non owner
++ * release not allowed.
++ */
++
++/*
+  * the rw-semaphore definition
+  * - if activity is 0 then there are no active readers or writers
+  * - if activity is +ve then that is the number of active readers
+@@ -50,8 +113,11 @@
+ #define DECLARE_RWSEM(name) \
+ 	struct rw_semaphore name = __RWSEM_INITIALIZER(name)
+ 
+-extern void __init_rwsem(struct rw_semaphore *sem, const char *name,
+-			 struct lock_class_key *key);
++static inline void __init_rwsem(struct rw_semaphore *sem, const char *name,
++				struct lock_class_key *key)
++{
++	__init_anon_rwsem((struct rw_anon_semaphore *)sem, name, key);
++}
+ 
+ #define init_rwsem(sem)						\
+ do {								\
+@@ -60,19 +126,11 @@
+ 	__init_rwsem((sem), #sem, &__key);			\
+ } while (0)
+ 
+-extern void __down_read(struct rw_semaphore *sem);
+-extern int __down_read_trylock(struct rw_semaphore *sem);
+-extern void __down_write(struct rw_semaphore *sem);
+-extern void __down_write_nested(struct rw_semaphore *sem, int subclass);
+-extern int __down_write_trylock(struct rw_semaphore *sem);
+-extern void __up_read(struct rw_semaphore *sem);
+-extern void __up_write(struct rw_semaphore *sem);
+-extern void __downgrade_write(struct rw_semaphore *sem);
+-
+ static inline int rwsem_is_locked(struct rw_semaphore *sem)
+ {
+ 	return (sem->activity != 0);
+ }
++#endif
+ 
+ #endif /* __KERNEL__ */
+ #endif /* _LINUX_RWSEM_SPINLOCK_H */
+Index: linux-rt-2.6.31/include/linux/rwsem.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/rwsem.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/rwsem.h	2010-05-17 14:23:20.058392366 +0200
+@@ -11,9 +11,11 @@
+ 
+ #include <linux/types.h>
+ #include <linux/kernel.h>
++#include <linux/rt_lock.h>
+ #include <asm/system.h>
+ #include <asm/atomic.h>
+ 
++struct rw_anon_semaphore;
+ struct rw_semaphore;
+ 
+ #ifdef CONFIG_RWSEM_GENERIC_SPINLOCK
+@@ -25,37 +27,37 @@
+ /*
+  * lock for reading
+  */
+-extern void down_read(struct rw_semaphore *sem);
++extern void anon_down_read(struct rw_anon_semaphore *sem);
+ 
+ /*
+  * trylock for reading -- returns 1 if successful, 0 if contention
+  */
+-extern int down_read_trylock(struct rw_semaphore *sem);
++extern int anon_down_read_trylock(struct rw_anon_semaphore *sem);
+ 
+ /*
+  * lock for writing
+  */
+-extern void down_write(struct rw_semaphore *sem);
++extern void anon_down_write(struct rw_anon_semaphore *sem);
+ 
+ /*
+  * trylock for writing -- returns 1 if successful, 0 if contention
+  */
+-extern int down_write_trylock(struct rw_semaphore *sem);
++extern int anon_down_write_trylock(struct rw_anon_semaphore *sem);
+ 
+ /*
+  * release a read lock
+  */
+-extern void up_read(struct rw_semaphore *sem);
++extern void anon_up_read(struct rw_anon_semaphore *sem);
+ 
+ /*
+  * release a write lock
+  */
+-extern void up_write(struct rw_semaphore *sem);
++extern void anon_up_write(struct rw_anon_semaphore *sem);
+ 
+ /*
+  * downgrade write lock to read lock
+  */
+-extern void downgrade_write(struct rw_semaphore *sem);
++extern void anon_downgrade_write(struct rw_anon_semaphore *sem);
+ 
+ #ifdef CONFIG_DEBUG_LOCK_ALLOC
+ /*
+@@ -71,21 +73,123 @@
+  * lockdep_set_class() at lock initialization time.
+  * See Documentation/lockdep-design.txt for more details.)
+  */
+-extern void down_read_nested(struct rw_semaphore *sem, int subclass);
+-extern void down_write_nested(struct rw_semaphore *sem, int subclass);
++extern void anon_down_read_nested(struct rw_anon_semaphore *sem, int subclass);
++extern void anon_down_write_nested(struct rw_anon_semaphore *sem, int subclass);
+ /*
+  * Take/release a lock when not the owner will release it.
+  *
+  * [ This API should be avoided as much as possible - the
+  *   proper abstraction for this case is completions. ]
+  */
+-extern void down_read_non_owner(struct rw_semaphore *sem);
+-extern void up_read_non_owner(struct rw_semaphore *sem);
++extern void anon_down_read_non_owner(struct rw_anon_semaphore *sem);
++extern void anon_up_read_non_owner(struct rw_anon_semaphore *sem);
+ #else
+-# define down_read_nested(sem, subclass)		down_read(sem)
+-# define down_write_nested(sem, subclass)	down_write(sem)
+-# define down_read_non_owner(sem)		down_read(sem)
+-# define up_read_non_owner(sem)			up_read(sem)
++# define anon_down_read_nested(sem, subclass)	anon_down_read(sem)
++# define anon_down_write_nested(sem, subclass)	anon_down_write(sem)
++# define anon_down_read_non_owner(sem)		anon_down_read(sem)
++# define anon_up_read_non_owner(sem)		anon_up_read(sem)
++#endif
++
++#ifdef CONFIG_PREEMPT_RT
++
++#include <linux/rt_lock.h>
++
++#define init_rwsem(sem)		rt_init_rwsem(sem)
++#define rwsem_is_locked(s)	rt_mutex_is_locked(&(s)->lock)
++
++static inline void down_read(struct rw_semaphore *sem)
++{
++	rt_down_read(sem);
++}
++
++static inline int down_read_trylock(struct rw_semaphore *sem)
++{
++	return rt_down_read_trylock(sem);
++}
++
++static inline void down_write(struct rw_semaphore *sem)
++{
++	rt_down_write(sem);
++}
++
++static inline int down_write_trylock(struct rw_semaphore *sem)
++{
++	return rt_down_write_trylock(sem);
++}
++
++static inline void up_read(struct rw_semaphore *sem)
++{
++	rt_up_read(sem);
++}
++
++static inline void up_write(struct rw_semaphore *sem)
++{
++	rt_up_write(sem);
++}
++
++static inline void downgrade_write(struct rw_semaphore *sem)
++{
++	rt_downgrade_write(sem);
++}
++
++static inline void down_read_nested(struct rw_semaphore *sem, int subclass)
++{
++	return rt_down_read_nested(sem, subclass);
++}
++
++static inline void down_write_nested(struct rw_semaphore *sem, int subclass)
++{
++	rt_down_write_nested(sem, subclass);
++}
++
++#else
++/*
++ * Non preempt-rt implementations
++ */
++static inline void down_read(struct rw_semaphore *sem)
++{
++	anon_down_read((struct rw_anon_semaphore *)sem);
++}
++
++static inline int down_read_trylock(struct rw_semaphore *sem)
++{
++	return anon_down_read_trylock((struct rw_anon_semaphore *)sem);
++}
++
++static inline void down_write(struct rw_semaphore *sem)
++{
++	anon_down_write((struct rw_anon_semaphore *)sem);
++}
++
++static inline int down_write_trylock(struct rw_semaphore *sem)
++{
++	return anon_down_write_trylock((struct rw_anon_semaphore *)sem);
++}
++
++static inline void up_read(struct rw_semaphore *sem)
++{
++	anon_up_read((struct rw_anon_semaphore *)sem);
++}
++
++static inline void up_write(struct rw_semaphore *sem)
++{
++	anon_up_write((struct rw_anon_semaphore *)sem);
++}
++
++static inline void downgrade_write(struct rw_semaphore *sem)
++{
++	anon_downgrade_write((struct rw_anon_semaphore *)sem);
++}
++
++static inline void down_read_nested(struct rw_semaphore *sem, int subclass)
++{
++	return anon_down_read_nested((struct rw_anon_semaphore *)sem, subclass);
++}
++
++static inline void down_write_nested(struct rw_semaphore *sem, int subclass)
++{
++	anon_down_write_nested((struct rw_anon_semaphore *)sem, subclass);
++}
+ #endif
+ 
+ #endif /* _LINUX_RWSEM_H */
+Index: linux-rt-2.6.31/include/linux/sched.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/sched.h	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/include/linux/sched.h	2010-05-17 14:23:20.058392366 +0200
+@@ -100,6 +100,23 @@
+ struct bts_context;
+ struct perf_counter_context;
+ 
++#ifdef CONFIG_PREEMPT
++extern int kernel_preemption;
++#else
++# define kernel_preemption 0
++#endif
++#ifdef CONFIG_PREEMPT_VOLUNTARY
++extern int voluntary_preemption;
++#else
++# define voluntary_preemption 0
++#endif
++
++#ifdef CONFIG_PREEMPT_SOFTIRQS
++extern int softirq_preemption;
++#else
++# define softirq_preemption 0
++#endif
++
+ /*
+  * List of flags we want to share for kernel threads,
+  * if only because they are not used by them anyway.
+@@ -166,10 +183,13 @@
+ #endif
+ 
+ extern unsigned long long time_sync_thresh;
++extern struct semaphore kernel_sem;
+ 
+ /*
+  * Task state bitmask. NOTE! These bits are also
+- * encoded in fs/proc/array.c: get_task_state().
++ * used in fs/proc/array.c: get_task_state() and
++ * in include/trace/events/sched.h in the
++ * sched_switch trace event.
+  *
+  * We have two separate sets of flags: task->state
+  * is about runnability, while task->exit_state are
+@@ -177,17 +197,52 @@
+  * modifying one set can't modify the other one by
+  * mistake.
+  */
++
+ #define TASK_RUNNING		0
+-#define TASK_INTERRUPTIBLE	1
+-#define TASK_UNINTERRUPTIBLE	2
+-#define __TASK_STOPPED		4
+-#define __TASK_TRACED		8
++#define TASK_STATE_0		"R"
++#define DESCR_TASK_STATE_0	"running"
++
++#define TASK_RUNNING_MUTEX	1
++#define TASK_STATE_1		"M"
++#define DESCR_TASK_STATE_1	"running-mutex"
++
++#define TASK_INTERRUPTIBLE	2
++#define TASK_STATE_2		"S"
++#define DESCR_TASK_STATE_2	"sleeping"
++
++#define TASK_UNINTERRUPTIBLE	4
++#define TASK_STATE_4		"D"
++#define DESCR_TASK_STATE_4	"disk sleep"
++
++#define __TASK_STOPPED		8
++#define TASK_STATE_8		"T"
++#define DESCR_TASK_STATE_8	"stopped"
++
++#define __TASK_TRACED		16
++#define TASK_STATE_16		"t"
++#define DESCR_TASK_STATE_16	"tracing stop"
++
+ /* in tsk->exit_state */
+-#define EXIT_ZOMBIE		16
+-#define EXIT_DEAD		32
++#define EXIT_ZOMBIE		32
++#define TASK_STATE_32		"Z"
++#define DESCR_TASK_STATE_32	"zombie"
++
++#define EXIT_DEAD		64
++#define TASK_STATE_64		"X"
++#define DESCR_TASK_STATE_64	"dead"
++
+ /* in tsk->state again */
+-#define TASK_DEAD		64
+-#define TASK_WAKEKILL		128
++#define TASK_DEAD		128
++#define TASK_STATE_128		"x"
++#define DESCR_TASK_STATE_128	"dead"
++
++#define TASK_WAKEKILL		256
++#define TASK_STATE_256		"W"
++#define DESCR_TASK_STATE_256	"wakekill"
++
++#define TASK_STATE_TO_CHAR_STR \
++  TASK_STATE_0 TASK_STATE_1 TASK_STATE_2 TASK_STATE_4 TASK_STATE_8 \
++  TASK_STATE_16 TASK_STATE_32 TASK_STATE_64 TASK_STATE_128 TASK_STATE_256
+ 
+ /* Convenience macros for the sake of set_task_state */
+ #define TASK_KILLABLE		(TASK_WAKEKILL | TASK_UNINTERRUPTIBLE)
+@@ -199,7 +254,8 @@
+ #define TASK_ALL		(TASK_NORMAL | __TASK_STOPPED | __TASK_TRACED)
+ 
+ /* get_task_state() */
+-#define TASK_REPORT		(TASK_RUNNING | TASK_INTERRUPTIBLE | \
++#define TASK_REPORT		(TASK_RUNNING | TASK_RUNNING_MUTEX | \
++				 TASK_INTERRUPTIBLE | \
+ 				 TASK_UNINTERRUPTIBLE | __TASK_STOPPED | \
+ 				 __TASK_TRACED)
+ 
+@@ -216,6 +272,28 @@
+ #define set_task_state(tsk, state_value)		\
+ 	set_mb((tsk)->state, (state_value))
+ 
++// #define PREEMPT_DIRECT
++
++#ifdef CONFIG_X86_LOCAL_APIC
++extern void nmi_show_all_regs(void);
++#else
++# define nmi_show_all_regs() do { } while (0)
++#endif
++
++#include <linux/smp.h>
++#include <linux/sem.h>
++#include <linux/signal.h>
++#include <linux/securebits.h>
++#include <linux/fs_struct.h>
++#include <linux/compiler.h>
++#include <linux/completion.h>
++#include <linux/pid.h>
++#include <linux/percpu.h>
++#include <linux/topology.h>
++#include <linux/seccomp.h>
++
++struct exec_domain;
++
+ /*
+  * set_current_state() includes a barrier so that the write of current->state
+  * is correctly serialised wrt the caller's subsequent test of whether to
+@@ -345,6 +423,11 @@
+ asmlinkage void __schedule(void);
+ asmlinkage void schedule(void);
+ extern int mutex_spin_on_owner(struct mutex *lock, struct thread_info *owner);
++/*
++ * This one can be called with interrupts disabled, only
++ * to be used by lowlevel arch code!
++ */
++asmlinkage void __sched __schedule(void);
+ 
+ struct nsproxy;
+ struct user_namespace;
+@@ -523,7 +606,7 @@
+ struct thread_group_cputimer {
+ 	struct task_cputime cputime;
+ 	int running;
+-	spinlock_t lock;
++	atomic_spinlock_t lock;
+ };
+ 
+ /*
+@@ -799,18 +882,19 @@
+ #define SCHED_LOAD_SCALE_FUZZ	SCHED_LOAD_SCALE
+ 
+ #ifdef CONFIG_SMP
+-#define SD_LOAD_BALANCE		1	/* Do load balancing on this domain. */
+-#define SD_BALANCE_NEWIDLE	2	/* Balance when about to become idle */
+-#define SD_BALANCE_EXEC		4	/* Balance on exec */
+-#define SD_BALANCE_FORK		8	/* Balance on fork, clone */
+-#define SD_WAKE_IDLE		16	/* Wake to idle CPU on task wakeup */
+-#define SD_WAKE_AFFINE		32	/* Wake task to waking CPU */
+-#define SD_WAKE_BALANCE		64	/* Perform balancing at task wakeup */
+-#define SD_SHARE_CPUPOWER	128	/* Domain members share cpu power */
+-#define SD_POWERSAVINGS_BALANCE	256	/* Balance for power savings */
+-#define SD_SHARE_PKG_RESOURCES	512	/* Domain members share cpu pkg resources */
+-#define SD_SERIALIZE		1024	/* Only a single load balancing instance */
+-#define SD_WAKE_IDLE_FAR	2048	/* Gain latency sacrificing cache hit */
++#define SD_LOAD_BALANCE		0x0001	/* Do load balancing on this domain. */
++#define SD_BALANCE_NEWIDLE	0x0002	/* Balance when about to become idle */
++#define SD_BALANCE_EXEC		0x0004	/* Balance on exec */
++#define SD_BALANCE_FORK		0x0008	/* Balance on fork, clone */
++#define SD_WAKE_IDLE		0x0010	/* Wake to idle CPU on task wakeup */
++#define SD_WAKE_AFFINE		0x0020	/* Wake task to waking CPU */
++#define SD_WAKE_BALANCE		0x0040	/* Perform balancing at task wakeup */
++#define SD_SHARE_CPUPOWER	0x0080	/* Domain members share cpu power */
++#define SD_POWERSAVINGS_BALANCE	0x0100	/* Balance for power savings */
++#define SD_SHARE_PKG_RESOURCES	0x0200	/* Domain members share cpu pkg resources */
++#define SD_SERIALIZE		0x0400	/* Only a single load balancing instance */
++#define SD_WAKE_IDLE_FAR	0x0800	/* Gain latency sacrificing cache hit */
++#define SD_PREFER_SIBLING	0x1000	/* Prefer to place tasks in a sibling domain */
+ 
+ enum powersavings_balance_level {
+ 	POWERSAVINGS_BALANCE_NONE = 0,  /* No power saving load balance */
+@@ -830,7 +914,7 @@
+ 	if (sched_smt_power_savings)
+ 		return SD_POWERSAVINGS_BALANCE;
+ 
+-	return 0;
++	return SD_PREFER_SIBLING;
+ }
+ 
+ static inline int sd_balance_for_package_power(void)
+@@ -838,7 +922,7 @@
+ 	if (sched_mc_power_savings | sched_smt_power_savings)
+ 		return SD_POWERSAVINGS_BALANCE;
+ 
+-	return 0;
++	return SD_PREFER_SIBLING;
+ }
+ 
+ /*
+@@ -860,15 +944,9 @@
+ 
+ 	/*
+ 	 * CPU power of this group, SCHED_LOAD_SCALE being max power for a
+-	 * single CPU. This is read only (except for setup, hotplug CPU).
+-	 * Note : Never change cpu_power without recompute its reciprocal
+-	 */
+-	unsigned int __cpu_power;
+-	/*
+-	 * reciprocal value of cpu_power to avoid expensive divides
+-	 * (see include/linux/reciprocal_div.h)
++	 * single CPU.
+ 	 */
+-	u32 reciprocal_cpu_power;
++	unsigned int cpu_power;
+ 
+ 	/*
+ 	 * The CPUs this group covers.
+@@ -921,6 +999,7 @@
+ 	unsigned int newidle_idx;
+ 	unsigned int wake_idx;
+ 	unsigned int forkexec_idx;
++	unsigned int smt_gain;
+ 	int flags;			/* See SD_* */
+ 	enum sched_domain_level level;
+ 
+@@ -1007,6 +1086,10 @@
+ }
+ #endif	/* !CONFIG_SMP */
+ 
++struct sched_domain;
++unsigned long default_scale_freq_power(struct sched_domain *sd, int cpu);
++unsigned long default_scale_smt_power(struct sched_domain *sd, int cpu);
++
+ struct io_context;			/* See blkdev.h */
+ 
+ 
+@@ -1027,7 +1110,8 @@
+ struct sched_class {
+ 	const struct sched_class *next;
+ 
+-	void (*enqueue_task) (struct rq *rq, struct task_struct *p, int wakeup);
++	void (*enqueue_task) (struct rq *rq, struct task_struct *p, int wakeup,
++			      bool head);
+ 	void (*dequeue_task) (struct rq *rq, struct task_struct *p, int sleep);
+ 	void (*yield_task) (struct rq *rq);
+ 
+@@ -1176,10 +1260,8 @@
+ 	int lock_depth;		/* BKL lock depth */
+ 
+ #ifdef CONFIG_SMP
+-#ifdef __ARCH_WANT_UNLOCKED_CTXSW
+ 	int oncpu;
+ #endif
+-#endif
+ 
+ 	int prio, static_prio, normal_prio;
+ 	unsigned int rt_priority;
+@@ -1287,6 +1369,8 @@
+ 	struct task_cputime cputime_expires;
+ 	struct list_head cpu_timers[3];
+ 
++	struct task_struct* posix_timer_list;
++
+ /* process credentials */
+ 	const struct cred *real_cred;	/* objective and real subjective task
+ 					 * credentials (COW) */
+@@ -1321,6 +1405,7 @@
+ /* signal handlers */
+ 	struct signal_struct *signal;
+ 	struct sighand_struct *sighand;
++	struct sigqueue *sigqueue_cache;
+ 
+ 	sigset_t blocked, real_blocked;
+ 	sigset_t saved_sigmask;	/* restored if set_restore_sigmask() was used */
+@@ -1351,7 +1436,7 @@
+ #endif
+ 
+ 	/* Protection of the PI data structures: */
+-	spinlock_t pi_lock;
++	atomic_spinlock_t pi_lock;
+ 
+ #ifdef CONFIG_RT_MUTEXES
+ 	/* PI waiters blocked on a rt_mutex held by this task */
+@@ -1364,6 +1449,7 @@
+ 	/* mutex deadlock detection */
+ 	struct mutex_waiter *blocked_on;
+ #endif
++	int pagefault_disabled;
+ #ifdef CONFIG_TRACE_IRQFLAGS
+ 	unsigned int irq_events;
+ 	int hardirqs_enabled;
+@@ -1388,6 +1474,26 @@
+ 	gfp_t lockdep_reclaim_gfp;
+ #endif
+ 
++/* realtime bits */
++
++#define MAX_PREEMPT_TRACE 25
++#define MAX_LOCK_STACK	MAX_PREEMPT_TRACE
++#ifdef CONFIG_DEBUG_PREEMPT
++	atomic_t lock_count;
++# ifdef CONFIG_PREEMPT_RT
++	struct rt_mutex *owned_lock[MAX_LOCK_STACK];
++# endif
++#endif
++#ifdef CONFIG_DETECT_SOFTLOCKUP
++	unsigned long	softlockup_count; /* Count to keep track how long the
++					   *  thread is in the kernel without
++					   *  sleeping.
++					   */
++#endif
++#ifdef CONFIG_DEBUG_RT_MUTEXES
++	void *last_kernel_lock;
++#endif
++
+ /* journalling filesystem info */
+ 	void *journal_info;
+ 
+@@ -1482,12 +1588,28 @@
+ 	unsigned long trace;
+ 	/* bitmask of trace recursion */
+ 	unsigned long trace_recursion;
++#ifdef CONFIG_WAKEUP_LATENCY_HIST
++	u64 preempt_timestamp_hist;
++#endif
+ #endif /* CONFIG_TRACING */
++#ifdef CONFIG_PREEMPT_RT
++	/*
++	 * Temporary hack, until we find a solution to
++	 * handle printk in atomic operations.
++	 */
++	int in_printk;
++#endif
+ };
+ 
+ /* Future-safe accessor for struct task_struct's cpus_allowed. */
+ #define tsk_cpumask(tsk) (&(tsk)->cpus_allowed)
+ 
++#ifdef CONFIG_PREEMPT_RT
++# define set_printk_might_sleep(x) do { current->in_printk = x; } while(0)
++#else
++# define set_printk_might_sleep(x) do { } while(0)
++#endif
++
+ /*
+  * Priority of a process goes from 0..MAX_PRIO-1, valid RT
+  * priority is 0..MAX_RT_PRIO-1, and SCHED_NORMAL/SCHED_BATCH
+@@ -1656,6 +1778,15 @@
+ extern void free_task(struct task_struct *tsk);
+ #define get_task_struct(tsk) do { atomic_inc(&(tsk)->usage); } while(0)
+ 
++#ifdef CONFIG_PREEMPT_RT
++extern void __put_task_struct_cb(struct rcu_head *rhp);
++
++static inline void put_task_struct(struct task_struct *t)
++{
++	if (atomic_dec_and_test(&t->usage))
++		call_rcu(&t->rcu, __put_task_struct_cb);
++}
++#else
+ extern void __put_task_struct(struct task_struct *t);
+ 
+ static inline void put_task_struct(struct task_struct *t)
+@@ -1663,6 +1794,7 @@
+ 	if (atomic_dec_and_test(&t->usage))
+ 		__put_task_struct(t);
+ }
++#endif
+ 
+ extern cputime_t task_utime(struct task_struct *p);
+ extern cputime_t task_stime(struct task_struct *p);
+@@ -1677,7 +1809,9 @@
+ #define PF_EXITING	0x00000004	/* getting shut down */
+ #define PF_EXITPIDONE	0x00000008	/* pi exit done on shut down */
+ #define PF_VCPU		0x00000010	/* I'm a virtual CPU */
++#define PF_HARDIRQ	0x00000020	/* hardirq thread */
+ #define PF_FORKNOEXEC	0x00000040	/* forked but didn't exec */
++#define PF_KMAP		0x00000080	/* this context has a kmap */
+ #define PF_SUPERPRIV	0x00000100	/* used super-user privileges */
+ #define PF_DUMPCORE	0x00000200	/* dumped core */
+ #define PF_SIGNALED	0x00000400	/* killed by a signal */
+@@ -1697,6 +1831,7 @@
+ #define PF_SPREAD_PAGE	0x01000000	/* Spread page cache over cpuset */
+ #define PF_SPREAD_SLAB	0x02000000	/* Spread some slab caches over cpuset */
+ #define PF_THREAD_BOUND	0x04000000	/* Thread bound to specific cpu */
++#define PF_SOFTIRQ	0x08000000	/* softirq context */
+ #define PF_MEMPOLICY	0x10000000	/* Non-default NUMA mempolicy */
+ #define PF_MUTEX_TESTER	0x20000000	/* Thread belongs to the rt mutex tester */
+ #define PF_FREEZER_SKIP	0x40000000	/* Freezer should not count it as freezeable */
+@@ -1821,6 +1956,7 @@
+ extern unsigned int sysctl_sched_features;
+ extern unsigned int sysctl_sched_migration_cost;
+ extern unsigned int sysctl_sched_nr_migrate;
++extern unsigned int sysctl_sched_time_avg;
+ extern unsigned int sysctl_timer_migration;
+ 
+ int sched_nr_latency_handler(struct ctl_table *table, int write,
+@@ -1847,9 +1983,14 @@
+ 
+ extern unsigned int sysctl_sched_compat_yield;
+ 
++extern void task_setprio(struct task_struct *p, int prio);
++
+ #ifdef CONFIG_RT_MUTEXES
+ extern int rt_mutex_getprio(struct task_struct *p);
+-extern void rt_mutex_setprio(struct task_struct *p, int prio);
++static inline void rt_mutex_setprio(struct task_struct *p, int prio)
++{
++	task_setprio(p, prio);
++}
+ extern void rt_mutex_adjust_pi(struct task_struct *p);
+ #else
+ static inline int rt_mutex_getprio(struct task_struct *p)
+@@ -1871,8 +2012,10 @@
+ extern struct task_struct *idle_task(int cpu);
+ extern struct task_struct *curr_task(int cpu);
+ extern void set_curr_task(int cpu, struct task_struct *p);
++extern struct task_struct *rq_curr(struct rq *rq);
+ 
+ void yield(void);
++void __yield(void);
+ 
+ /*
+  * The default (Linux) execution domain.
+@@ -1934,6 +2077,9 @@
+ 
+ extern int wake_up_state(struct task_struct *tsk, unsigned int state);
+ extern int wake_up_process(struct task_struct *tsk);
++extern int wake_up_process_mutex(struct task_struct * tsk);
++extern int wake_up_process_sync(struct task_struct * tsk);
++extern int wake_up_process_mutex_sync(struct task_struct * tsk);
+ extern void wake_up_new_task(struct task_struct *tsk,
+ 				unsigned long clone_flags);
+ #ifdef CONFIG_SMP
+@@ -2029,12 +2175,20 @@
+ 
+ /* mmdrop drops the mm and the page tables */
+ extern void __mmdrop(struct mm_struct *);
++extern void __mmdrop_delayed(struct mm_struct *);
++
+ static inline void mmdrop(struct mm_struct * mm)
+ {
+ 	if (unlikely(atomic_dec_and_test(&mm->mm_count)))
+ 		__mmdrop(mm);
+ }
+ 
++static inline void mmdrop_delayed(struct mm_struct * mm)
++{
++	if (atomic_dec_and_test(&mm->mm_count))
++		__mmdrop_delayed(mm);
++}
++
+ /* mmput gets rid of the mappings and all user-space */
+ extern void mmput(struct mm_struct *);
+ /* Grab a reference to a task's mm, if it is not already going away */
+@@ -2308,6 +2462,7 @@
+ {
+ 	return _cond_resched();
+ }
++extern int cond_resched_softirq_context(void);
+ 
+ /*
+  * Does a critical section need to be broken due to another
+@@ -2332,7 +2487,7 @@
+ static inline void thread_group_cputime_init(struct signal_struct *sig)
+ {
+ 	sig->cputimer.cputime = INIT_CPUTIME;
+-	spin_lock_init(&sig->cputimer.lock);
++	atomic_spin_lock_init(&sig->cputimer.lock);
+ 	sig->cputimer.running = 0;
+ }
+ 
+@@ -2340,6 +2495,13 @@
+ {
+ }
+ 
++static inline int softirq_need_resched(void)
++{
++	if (softirq_preemption && (current->flags & PF_SOFTIRQ))
++		return need_resched();
++	return 0;
++}
++
+ /*
+  * Reevaluate whether the task has signals pending delivery.
+  * Wake the task if so.
+@@ -2486,7 +2648,12 @@
+ }
+ #endif /* CONFIG_MM_OWNER */
+ 
+-#define TASK_STATE_TO_CHAR_STR "RSDTtZX"
++#ifdef CONFIG_SMP
++static inline int task_is_current(struct task_struct *task)
++{
++	return task->oncpu;
++}
++#endif
+ 
+ #endif /* __KERNEL__ */
+ 
+Index: linux-rt-2.6.31/include/linux/semaphore.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/semaphore.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/semaphore.h	2010-05-17 14:23:20.058392366 +0200
+@@ -13,6 +13,94 @@
+ #include <linux/spinlock.h>
+ 
+ /* Please don't access any members of this structure directly */
++struct anon_semaphore {
++	spinlock_t		lock;
++	unsigned int		count;
++	struct list_head	wait_list;
++};
++
++#define __ANON_SEMAPHORE_INITIALIZER(name, n)				\
++{									\
++	.lock		= __SPIN_LOCK_UNLOCKED((name).lock),		\
++	.count		= n,						\
++	.wait_list	= LIST_HEAD_INIT((name).wait_list),		\
++}
++
++#define DEFINE_ANON_SEMAPHORE(name)	\
++	struct anon_semaphore name = __ANON_SEMAPHORE_INITIALIZER(name, 1)
++
++static inline void anon_sema_init(struct anon_semaphore *sem, int val)
++{
++	static struct lock_class_key __key;
++	*sem = (struct anon_semaphore) __ANON_SEMAPHORE_INITIALIZER(*sem, val);
++	lockdep_init_map(&sem->lock.dep_map, "semaphore->lock", &__key, 0);
++}
++
++static inline void anon_semaphore_init(struct anon_semaphore *sem)
++{
++	anon_sema_init(sem, 1);
++}
++
++/*
++ * semaphore_init_locked() is mostly a sign for a mutex which is
++ * abused as completion.
++ */
++static inline void __deprecated
++anon_semaphore_init_locked(struct anon_semaphore *sem)
++{
++	anon_sema_init(sem, 0);
++}
++
++extern void anon_down(struct anon_semaphore *sem);
++extern int __must_check anon_down_interruptible(struct anon_semaphore *sem);
++extern int __must_check anon_down_killable(struct anon_semaphore *sem);
++extern int __must_check anon_down_trylock(struct anon_semaphore *sem);
++extern int __must_check anon_down_timeout(struct anon_semaphore *sem, long jiffies);
++extern void anon_up(struct anon_semaphore *sem);
++
++#ifdef CONFIG_PREEMPT_RT
++
++static inline void sema_init(struct semaphore *sem, int val)
++{
++	rt_sema_init(sem, val);
++}
++
++static inline void semaphore_init(struct semaphore *sem)
++{
++	sema_init(sem, 1);
++}
++
++static inline void down(struct semaphore *sem)
++{
++	rt_down(sem);
++}
++
++static inline int __must_check down_interruptible(struct semaphore *sem)
++{
++	return rt_down_interruptible(sem);
++}
++
++static inline int __must_check down_trylock(struct semaphore *sem)
++{
++	return rt_down_trylock(sem);
++}
++
++static inline int __must_check
++down_timeout(struct semaphore *sem, long jiffies)
++{
++	return rt_down_timeout(sem, jiffies);
++}
++
++static inline void up(struct semaphore *sem)
++{
++	rt_up(sem);
++}
++
++
++#else
++/*
++ * Non preempt-rt maps semaphores to anon semaphores
++ */
+ struct semaphore {
+ 	spinlock_t		lock;
+ 	unsigned int		count;
+@@ -26,24 +114,57 @@
+ 	.wait_list	= LIST_HEAD_INIT((name).wait_list),		\
+ }
+ 
+-#define DECLARE_MUTEX(name)	\
+-	struct semaphore name = __SEMAPHORE_INITIALIZER(name, 1)
++#define DEFINE_SEMAPHORE(name)	\
++	struct semaphore name =  __SEMAPHORE_INITIALIZER(name, 1)
+ 
+ static inline void sema_init(struct semaphore *sem, int val)
+ {
+-	static struct lock_class_key __key;
+-	*sem = (struct semaphore) __SEMAPHORE_INITIALIZER(*sem, val);
+-	lockdep_init_map(&sem->lock.dep_map, "semaphore->lock", &__key, 0);
++	anon_sema_init((struct anon_semaphore *)sem, val);
+ }
+ 
+-#define init_MUTEX(sem)		sema_init(sem, 1)
+-#define init_MUTEX_LOCKED(sem)	sema_init(sem, 0)
++static inline void semaphore_init(struct semaphore *sem)
++{
++	anon_sema_init((struct anon_semaphore *)sem, 1);
++}
+ 
+-extern void down(struct semaphore *sem);
+-extern int __must_check down_interruptible(struct semaphore *sem);
+-extern int __must_check down_killable(struct semaphore *sem);
+-extern int __must_check down_trylock(struct semaphore *sem);
+-extern int __must_check down_timeout(struct semaphore *sem, long jiffies);
+-extern void up(struct semaphore *sem);
++/*
++ * semaphore_init_locked() is mostly a sign for a mutex which is
++ * abused as completion.
++ */
++static inline void __deprecated semaphore_init_locked(struct semaphore *sem)
++{
++	anon_sema_init((struct anon_semaphore *)sem, 0);
++}
++
++static inline void down(struct semaphore *sem)
++{
++	anon_down((struct anon_semaphore *)sem);
++}
++
++static inline int __must_check down_interruptible(struct semaphore *sem)
++{
++	return anon_down_interruptible((struct anon_semaphore *)sem);
++}
++static inline int __must_check down_killable(struct semaphore *sem)
++{
++	return anon_down_killable((struct anon_semaphore *)sem);
++}
++
++static inline int __must_check down_trylock(struct semaphore *sem)
++{
++	return anon_down_trylock((struct anon_semaphore *)sem);
++}
++
++static inline int __must_check
++down_timeout(struct semaphore *sem, long jiffies)
++{
++	return anon_down_timeout((struct anon_semaphore *)sem, jiffies);
++}
++
++static inline void up(struct semaphore *sem)
++{
++	anon_up((struct anon_semaphore *)sem);
++}
++#endif
+ 
+ #endif /* __LINUX_SEMAPHORE_H */
+Index: linux-rt-2.6.31/include/linux/seqlock.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/seqlock.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/seqlock.h	2010-05-17 14:23:20.058392366 +0200
+@@ -3,9 +3,11 @@
+ /*
+  * Reader/writer consistent mechanism without starving writers. This type of
+  * lock for data where the reader wants a consistent set of information
+- * and is willing to retry if the information changes.  Readers never
+- * block but they may have to retry if a writer is in
+- * progress. Writers do not wait for readers. 
++ * and is willing to retry if the information changes. Readers block
++ * on write contention (and where applicable, pi-boost the writer).
++ * Readers without contention on entry acquire the critical section
++ * without any atomic operations, but they may have to retry if a writer
++ * enters before the critical section ends. Writers do not wait for readers.
+  *
+  * This is not as cache friendly as brlock. Also, this will not work
+  * for data that contains pointers, because any writer could
+@@ -24,6 +26,8 @@
+  *
+  * Based on x86_64 vsyscall gettimeofday 
+  * by Keith Owens and Andrea Arcangeli
++ *
++ * Priority inheritance and live-lock avoidance by Gregory Haskins
+  */
+ 
+ #include <linux/spinlock.h>
+@@ -31,49 +35,80 @@
+ 
+ typedef struct {
+ 	unsigned sequence;
+-	spinlock_t lock;
++	atomic_spinlock_t lock;
++} atomic_seqlock_t;
++
++typedef struct {
++	unsigned sequence;
++	rwlock_t lock;
+ } seqlock_t;
+ 
+ /*
+  * These macros triggered gcc-3.x compile-time problems.  We think these are
+  * OK now.  Be cautious.
+  */
++#define __ATOMIC_SEQLOCK_UNLOCKED(lockname) \
++	{ 0, __ATOMIC_SPIN_LOCK_UNLOCKED(lockname) }
++
++#define seqlock_atomic_init(x)				\
++	do {						\
++		(x)->sequence = 0;			\
++		atomic_spin_lock_init(&(x)->lock);	\
++	} while (0)
++
++#define DEFINE_ATOMIC_SEQLOCK(x) \
++	atomic_seqlock_t x = __ATOMIC_SEQLOCK_UNLOCKED(x)
++
+ #define __SEQLOCK_UNLOCKED(lockname) \
+-		 { 0, __SPIN_LOCK_UNLOCKED(lockname) }
++	{ 0, __RW_LOCK_UNLOCKED(lockname) }
+ 
+ #define SEQLOCK_UNLOCKED \
+-		 __SEQLOCK_UNLOCKED(old_style_seqlock_init)
++	__SEQLOCK_UNLOCKED(old_style_seqlock_init)
+ 
+ #define seqlock_init(x)					\
+ 	do {						\
+ 		(x)->sequence = 0;			\
+-		spin_lock_init(&(x)->lock);		\
++		rwlock_init(&(x)->lock);		\
+ 	} while (0)
+ 
+ #define DEFINE_SEQLOCK(x) \
+-		seqlock_t x = __SEQLOCK_UNLOCKED(x)
++	seqlock_t x = __SEQLOCK_UNLOCKED(x)
+ 
+ /* Lock out other writers and update the count.
+  * Acts like a normal spin_lock/unlock.
+  * Don't need preempt_disable() because that is in the spin_lock already.
+  */
++static inline void write_atomic_seqlock(atomic_seqlock_t *sl)
++{
++	atomic_spin_lock(&sl->lock);
++	++sl->sequence;
++	smp_wmb();
++}
++
+ static inline void write_seqlock(seqlock_t *sl)
+ {
+-	spin_lock(&sl->lock);
++	write_lock(&sl->lock);
+ 	++sl->sequence;
+ 	smp_wmb();
+ }
+ 
++static inline void write_atomic_sequnlock(atomic_seqlock_t *sl)
++{
++	smp_wmb();
++	sl->sequence++;
++	atomic_spin_unlock(&sl->lock);
++}
++
+ static inline void write_sequnlock(seqlock_t *sl)
+ {
+ 	smp_wmb();
+ 	sl->sequence++;
+-	spin_unlock(&sl->lock);
++	write_unlock(&sl->lock);
+ }
+ 
+ static inline int write_tryseqlock(seqlock_t *sl)
+ {
+-	int ret = spin_trylock(&sl->lock);
++	int ret = write_trylock(&sl->lock);
+ 
+ 	if (ret) {
+ 		++sl->sequence;
+@@ -83,7 +118,7 @@
+ }
+ 
+ /* Start of read calculation -- fetch last complete writer token */
+-static __always_inline unsigned read_seqbegin(const seqlock_t *sl)
++static __always_inline unsigned read_atomic_seqbegin(const atomic_seqlock_t *sl)
+ {
+ 	unsigned ret;
+ 
+@@ -98,11 +133,42 @@
+ 	return ret;
+ }
+ 
++static __always_inline unsigned read_seqbegin(seqlock_t *sl)
++{
++	unsigned ret;
++
++	ret = sl->sequence;
++	smp_rmb();
++	if (unlikely(ret & 1)) {
++		cpu_relax();
++		/*
++		 * Serialze with the writer which will ensure they are
++		 * pi-boosted if necessary and prevent us from starving
++		 * them.
++		 */
++		read_lock(&sl->lock);
++		ret = sl->sequence;
++		read_unlock(&sl->lock);
++	}
++
++	BUG_ON(ret & 1);
++
++	return ret;
++}
++
+ /*
+  * Test if reader processed invalid data.
+  *
+  * If sequence value changed then writer changed data while in section.
+  */
++static __always_inline int
++read_atomic_seqretry(const atomic_seqlock_t *sl, unsigned start)
++{
++	smp_rmb();
++
++	return (sl->sequence != start);
++}
++
+ static __always_inline int read_seqretry(const seqlock_t *sl, unsigned start)
+ {
+ 	smp_rmb();
+@@ -170,12 +236,36 @@
+ /*
+  * Possible sw/hw IRQ protected versions of the interfaces.
+  */
++#define write_atomic_seqlock_irqsave(lock, flags)			\
++	do { local_irq_save(flags); write_atomic_seqlock(lock); } while (0)
++#define write_atomic_seqlock_irq(lock)					\
++	do { local_irq_disable();   write_atomic_seqlock(lock); } while (0)
++#define write_atomic_seqlock_bh(lock)					\
++	do { local_bh_disable();    write_atomic_seqlock(lock); } while (0)
++
++#define write_atomic_sequnlock_irqrestore(lock, flags)			\
++	do { write_atomic_sequnlock(lock); local_irq_restore(flags); } while(0)
++#define write_atomic_sequnlock_irq(lock)				\
++	do { write_atomic_sequnlock(lock); local_irq_enable(); } while(0)
++#define write_atomic_sequnlock_bh(lock)					\
++	do { write_atomic_sequnlock(lock); local_bh_enable(); } while(0)
++
++#define read_atomic_seqbegin_irqsave(lock, flags)			\
++	({ local_irq_save(flags);   read_atomic_seqbegin(lock); })
++
++#define read_atomic_seqretry_irqrestore(lock, iv, flags)		\
++	({								\
++		int ret = read_atomic_seqretry(lock, iv);		\
++		local_irq_restore(flags);				\
++		ret;							\
++	})
++
+ #define write_seqlock_irqsave(lock, flags)				\
+ 	do { local_irq_save(flags); write_seqlock(lock); } while (0)
+ #define write_seqlock_irq(lock)						\
+ 	do { local_irq_disable();   write_seqlock(lock); } while (0)
+ #define write_seqlock_bh(lock)						\
+-        do { local_bh_disable();    write_seqlock(lock); } while (0)
++	do { local_bh_disable();    write_seqlock(lock); } while (0)
+ 
+ #define write_sequnlock_irqrestore(lock, flags)				\
+ 	do { write_sequnlock(lock); local_irq_restore(flags); } while(0)
+Index: linux-rt-2.6.31/include/linux/signal.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/signal.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/signal.h	2010-05-17 14:23:20.058392366 +0200
+@@ -225,6 +225,7 @@
+ }
+ 
+ extern void flush_sigqueue(struct sigpending *queue);
++extern void flush_task_sigqueue(struct task_struct *tsk);
+ 
+ /* Test if 'sig' is valid signal. Use this instead of testing _NSIG directly */
+ static inline int valid_signal(unsigned long sig)
+Index: linux-rt-2.6.31/include/linux/skbuff.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/skbuff.h	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/include/linux/skbuff.h	2010-05-17 14:23:20.058392366 +0200
+@@ -98,6 +98,9 @@
+ #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
+ struct nf_conntrack {
+ 	atomic_t use;
++#ifdef CONFIG_PREEMPT_RT
++	struct rcu_head rcu;
++#endif
+ };
+ #endif
+ 
+Index: linux-rt-2.6.31/include/linux/smb_fs_sb.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/smb_fs_sb.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/smb_fs_sb.h	2010-05-17 14:23:20.068386444 +0200
+@@ -57,7 +57,7 @@
+ 	struct smb_conn_opt opt;
+ 	wait_queue_head_t conn_wq;
+ 	int conn_complete;
+-	struct semaphore sem;
++	struct mutex mutex;
+ 
+ 	unsigned char      header[SMB_HEADER_LEN + 20*2 + 2];
+ 	u32                header_len;
+@@ -79,19 +79,19 @@
+ static inline int
+ smb_lock_server_interruptible(struct smb_sb_info *server)
+ {
+-	return down_interruptible(&(server->sem));
++	return mutex_lock_interruptible(&server->mutex);
+ }
+ 
+ static inline void
+ smb_lock_server(struct smb_sb_info *server)
+ {
+-	down(&(server->sem));
++	mutex_lock(&server->mutex);
+ }
+ 
+ static inline void
+ smb_unlock_server(struct smb_sb_info *server)
+ {
+-	up(&(server->sem));
++	mutex_unlock(&server->mutex);
+ }
+ 
+ #endif
+Index: linux-rt-2.6.31/include/linux/smp.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/smp.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/smp.h	2010-05-17 14:23:20.068386444 +0200
+@@ -50,6 +50,16 @@
+  */
+ extern void smp_send_reschedule(int cpu);
+ 
++/*
++ * trigger a reschedule on all other CPUs:
++ */
++extern void smp_send_reschedule_allbutself(void);
++
++/*
++ * trigger a reschedule on all other CPUs:
++ */
++extern void smp_send_reschedule_allbutself(void);
++
+ 
+ /*
+  * Prepare machine for booting other CPUs.
+@@ -142,6 +152,7 @@
+ 		0;				\
+ 	})
+ static inline void smp_send_reschedule(int cpu) { }
++static inline void smp_send_reschedule_allbutself(void) { }
+ #define num_booting_cpus()			1
+ #define smp_prepare_boot_cpu()			do {} while (0)
+ #define smp_call_function_mask(mask, func, info, wait) \
+Index: linux-rt-2.6.31/include/linux/smp_lock.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/smp_lock.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/smp_lock.h	2010-05-17 14:23:20.068386444 +0200
+@@ -45,7 +45,7 @@
+ #define unlock_kernel()				do { } while(0)
+ #define release_kernel_lock(task)		do { } while(0)
+ #define cycle_kernel_lock()			do { } while(0)
+-#define reacquire_kernel_lock(task)		0
++#define reacquire_kernel_lock(task)		do { } while(0)
+ #define kernel_locked()				1
+ 
+ #endif /* CONFIG_LOCK_KERNEL */
+Index: linux-rt-2.6.31/include/linux/spinlock.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/spinlock.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/spinlock.h	2010-05-17 14:23:20.068386444 +0200
+@@ -58,23 +58,6 @@
+ #include <asm/system.h>
+ 
+ /*
+- * Must define these before including other files, inline functions need them
+- */
+-#define LOCK_SECTION_NAME ".text.lock."KBUILD_BASENAME
+-
+-#define LOCK_SECTION_START(extra)               \
+-        ".subsection 1\n\t"                     \
+-        extra                                   \
+-        ".ifndef " LOCK_SECTION_NAME "\n\t"     \
+-        LOCK_SECTION_NAME ":\n\t"               \
+-        ".endif\n"
+-
+-#define LOCK_SECTION_END                        \
+-        ".previous\n\t"
+-
+-#define __lockfunc __attribute__((section(".spinlock.text")))
+-
+-/*
+  * Pull the raw_spinlock_t and raw_rwlock_t definitions:
+  */
+ #include <linux/spinlock_types.h>
+@@ -91,44 +74,32 @@
+ #endif
+ 
+ #ifdef CONFIG_DEBUG_SPINLOCK
+-  extern void __spin_lock_init(spinlock_t *lock, const char *name,
+-			       struct lock_class_key *key);
+-# define spin_lock_init(lock)					\
+-do {								\
+-	static struct lock_class_key __key;			\
+-								\
+-	__spin_lock_init((lock), #lock, &__key);		\
+-} while (0)
++  extern void __atomic_spin_lock_init(atomic_spinlock_t *lock,
++				      const char *name,
++				      struct lock_class_key *key);
+ 
+-#else
+-# define spin_lock_init(lock)					\
+-	do { *(lock) = SPIN_LOCK_UNLOCKED; } while (0)
+-#endif
+-
+-#ifdef CONFIG_DEBUG_SPINLOCK
+-  extern void __rwlock_init(rwlock_t *lock, const char *name,
+-			    struct lock_class_key *key);
+-# define rwlock_init(lock)					\
++# define atomic_spin_lock_init(lock)				\
+ do {								\
+ 	static struct lock_class_key __key;			\
+ 								\
+-	__rwlock_init((lock), #lock, &__key);			\
++	__atomic_spin_lock_init((lock), #lock, &__key);		\
+ } while (0)
++
+ #else
+-# define rwlock_init(lock)					\
+-	do { *(lock) = RW_LOCK_UNLOCKED; } while (0)
++# define atomic_spin_lock_init(lock)				\
++	do { *(lock) = __ATOMIC_SPIN_LOCK_UNLOCKED(lock); } while (0)
+ #endif
+ 
+-#define spin_is_locked(lock)	__raw_spin_is_locked(&(lock)->raw_lock)
++#define atomic_spin_is_locked(lock)	__raw_spin_is_locked(&(lock)->raw_lock)
+ 
+ #ifdef CONFIG_GENERIC_LOCKBREAK
+-#define spin_is_contended(lock) ((lock)->break_lock)
++#define atomic_spin_is_contended(lock) ((lock)->break_lock)
+ #else
+ 
+ #ifdef __raw_spin_is_contended
+-#define spin_is_contended(lock)	__raw_spin_is_contended(&(lock)->raw_lock)
++#define atomic_spin_is_contended(lock)	__raw_spin_is_contended(&(lock)->raw_lock)
+ #else
+-#define spin_is_contended(lock)	(((void)(lock), 0))
++#define atomic_spin_is_contended(lock)	(((void)(lock), 0))
+ #endif /*__raw_spin_is_contended*/
+ #endif
+ 
+@@ -141,7 +112,7 @@
+  * spin_unlock_wait - wait until the spinlock gets unlocked
+  * @lock: the spinlock in question.
+  */
+-#define spin_unlock_wait(lock)	__raw_spin_unlock_wait(&(lock)->raw_lock)
++#define atomic_spin_unlock_wait(lock)	__raw_spin_unlock_wait(&(lock)->raw_lock)
+ 
+ /*
+  * Pull the _spin_*()/_read_*()/_write_*() functions/declarations:
+@@ -153,209 +124,128 @@
+ #endif
+ 
+ #ifdef CONFIG_DEBUG_SPINLOCK
+- extern void _raw_spin_lock(spinlock_t *lock);
++ extern void _raw_spin_lock(atomic_spinlock_t *lock);
+ #define _raw_spin_lock_flags(lock, flags) _raw_spin_lock(lock)
+- extern int _raw_spin_trylock(spinlock_t *lock);
+- extern void _raw_spin_unlock(spinlock_t *lock);
+- extern void _raw_read_lock(rwlock_t *lock);
+-#define _raw_read_lock_flags(lock, flags) _raw_read_lock(lock)
+- extern int _raw_read_trylock(rwlock_t *lock);
+- extern void _raw_read_unlock(rwlock_t *lock);
+- extern void _raw_write_lock(rwlock_t *lock);
+-#define _raw_write_lock_flags(lock, flags) _raw_write_lock(lock)
+- extern int _raw_write_trylock(rwlock_t *lock);
+- extern void _raw_write_unlock(rwlock_t *lock);
++ extern int _raw_spin_trylock(atomic_spinlock_t *lock);
++ extern void _raw_spin_unlock(atomic_spinlock_t *lock);
+ #else
+ # define _raw_spin_lock(lock)		__raw_spin_lock(&(lock)->raw_lock)
+ # define _raw_spin_lock_flags(lock, flags) \
+ 		__raw_spin_lock_flags(&(lock)->raw_lock, *(flags))
+ # define _raw_spin_trylock(lock)	__raw_spin_trylock(&(lock)->raw_lock)
+ # define _raw_spin_unlock(lock)		__raw_spin_unlock(&(lock)->raw_lock)
+-# define _raw_read_lock(rwlock)		__raw_read_lock(&(rwlock)->raw_lock)
+-# define _raw_read_lock_flags(lock, flags) \
+-		__raw_read_lock_flags(&(lock)->raw_lock, *(flags))
+-# define _raw_read_trylock(rwlock)	__raw_read_trylock(&(rwlock)->raw_lock)
+-# define _raw_read_unlock(rwlock)	__raw_read_unlock(&(rwlock)->raw_lock)
+-# define _raw_write_lock(rwlock)	__raw_write_lock(&(rwlock)->raw_lock)
+-# define _raw_write_lock_flags(lock, flags) \
+-		__raw_write_lock_flags(&(lock)->raw_lock, *(flags))
+-# define _raw_write_trylock(rwlock)	__raw_write_trylock(&(rwlock)->raw_lock)
+-# define _raw_write_unlock(rwlock)	__raw_write_unlock(&(rwlock)->raw_lock)
+ #endif
+ 
+-#define read_can_lock(rwlock)		__raw_read_can_lock(&(rwlock)->raw_lock)
+-#define write_can_lock(rwlock)		__raw_write_can_lock(&(rwlock)->raw_lock)
+-
+ /*
+- * Define the various spin_lock and rw_lock methods.  Note we define these
+- * regardless of whether CONFIG_SMP or CONFIG_PREEMPT are set. The various
+- * methods are defined as nops in the case they are not required.
+- */
+-#define spin_trylock(lock)		__cond_lock(lock, _spin_trylock(lock))
+-#define read_trylock(lock)		__cond_lock(lock, _read_trylock(lock))
+-#define write_trylock(lock)		__cond_lock(lock, _write_trylock(lock))
++ * Define the various spin_lock methods.  Note we define these
++ * regardless of whether CONFIG_SMP or CONFIG_PREEMPT are set. The
++ * various methods are defined as nops in the case they are not
++ * required.
++ */
++#define atomic_spin_trylock(lock)	__cond_lock(lock, _atomic_spin_trylock(lock))
+ 
+-#define spin_lock(lock)			_spin_lock(lock)
++#define atomic_spin_lock(lock)		_atomic_spin_lock(lock)
+ 
+ #ifdef CONFIG_DEBUG_LOCK_ALLOC
+-# define spin_lock_nested(lock, subclass) _spin_lock_nested(lock, subclass)
+-# define spin_lock_nest_lock(lock, nest_lock)				\
++# define atomic_spin_lock_nested(lock, subclass) \
++	_atomic_spin_lock_nested(lock, subclass)
++
++# define atomic_spin_lock_nest_lock(lock, nest_lock)			\
+ 	 do {								\
+ 		 typecheck(struct lockdep_map *, &(nest_lock)->dep_map);\
+-		 _spin_lock_nest_lock(lock, &(nest_lock)->dep_map);	\
++		 _atomic_spin_lock_nest_lock(lock, &(nest_lock)->dep_map);\
+ 	 } while (0)
+ #else
+-# define spin_lock_nested(lock, subclass) _spin_lock(lock)
+-# define spin_lock_nest_lock(lock, nest_lock) _spin_lock(lock)
++# define atomic_spin_lock_nested(lock, subclass) _atomic_spin_lock(lock)
++# define atomic_spin_lock_nest_lock(lock, nest_lock) _atomic_spin_lock(lock)
+ #endif
+ 
+-#define write_lock(lock)		_write_lock(lock)
+-#define read_lock(lock)			_read_lock(lock)
+-
+ #if defined(CONFIG_SMP) || defined(CONFIG_DEBUG_SPINLOCK)
+ 
+-#define spin_lock_irqsave(lock, flags)			\
++#define atomic_spin_lock_irqsave(lock, flags)		\
+ 	do {						\
+ 		typecheck(unsigned long, flags);	\
+-		flags = _spin_lock_irqsave(lock);	\
+-	} while (0)
+-#define read_lock_irqsave(lock, flags)			\
+-	do {						\
+-		typecheck(unsigned long, flags);	\
+-		flags = _read_lock_irqsave(lock);	\
+-	} while (0)
+-#define write_lock_irqsave(lock, flags)			\
+-	do {						\
+-		typecheck(unsigned long, flags);	\
+-		flags = _write_lock_irqsave(lock);	\
++		flags = _atomic_spin_lock_irqsave(lock);\
+ 	} while (0)
+ 
+ #ifdef CONFIG_DEBUG_LOCK_ALLOC
+-#define spin_lock_irqsave_nested(lock, flags, subclass)			\
++#define atomic_spin_lock_irqsave_nested(lock, flags, subclass)		\
+ 	do {								\
+ 		typecheck(unsigned long, flags);			\
+-		flags = _spin_lock_irqsave_nested(lock, subclass);	\
++		flags = _atomic_spin_lock_irqsave_nested(lock, subclass);\
+ 	} while (0)
+ #else
+-#define spin_lock_irqsave_nested(lock, flags, subclass)			\
++#define atomic_spin_lock_irqsave_nested(lock, flags, subclass)		\
+ 	do {								\
+ 		typecheck(unsigned long, flags);			\
+-		flags = _spin_lock_irqsave(lock);			\
++		flags = _atomic_spin_lock_irqsave(lock);		\
+ 	} while (0)
+ #endif
+ 
+ #else
+ 
+-#define spin_lock_irqsave(lock, flags)			\
++#define atomic_spin_lock_irqsave(lock, flags)		\
+ 	do {						\
+ 		typecheck(unsigned long, flags);	\
+-		_spin_lock_irqsave(lock, flags);	\
++		_atomic_spin_lock_irqsave(lock, flags);	\
+ 	} while (0)
+-#define read_lock_irqsave(lock, flags)			\
+-	do {						\
+-		typecheck(unsigned long, flags);	\
+-		_read_lock_irqsave(lock, flags);	\
+-	} while (0)
+-#define write_lock_irqsave(lock, flags)			\
+-	do {						\
+-		typecheck(unsigned long, flags);	\
+-		_write_lock_irqsave(lock, flags);	\
+-	} while (0)
+-#define spin_lock_irqsave_nested(lock, flags, subclass)	\
+-	spin_lock_irqsave(lock, flags)
+-
+-#endif
+ 
+-#define spin_lock_irq(lock)		_spin_lock_irq(lock)
+-#define spin_lock_bh(lock)		_spin_lock_bh(lock)
++#define atomic_spin_lock_irqsave_nested(lock, flags, subclass)	\
++	atomic_spin_lock_irqsave(lock, flags)
+ 
+-#define read_lock_irq(lock)		_read_lock_irq(lock)
+-#define read_lock_bh(lock)		_read_lock_bh(lock)
++#endif
+ 
+-#define write_lock_irq(lock)		_write_lock_irq(lock)
+-#define write_lock_bh(lock)		_write_lock_bh(lock)
++#define atomic_spin_lock_irq(lock)	_atomic_spin_lock_irq(lock)
++#define atomic_spin_lock_bh(lock)	_atomic_spin_lock_bh(lock)
+ 
+ /*
+  * We inline the unlock functions in the nondebug case:
+  */
+ #if defined(CONFIG_DEBUG_SPINLOCK) || defined(CONFIG_PREEMPT) || \
+ 	!defined(CONFIG_SMP)
+-# define spin_unlock(lock)		_spin_unlock(lock)
+-# define read_unlock(lock)		_read_unlock(lock)
+-# define write_unlock(lock)		_write_unlock(lock)
+-# define spin_unlock_irq(lock)		_spin_unlock_irq(lock)
+-# define read_unlock_irq(lock)		_read_unlock_irq(lock)
+-# define write_unlock_irq(lock)		_write_unlock_irq(lock)
++# define atomic_spin_unlock(lock)	_atomic_spin_unlock(lock)
++# define atomic_spin_unlock_irq(lock)	_atomic_spin_unlock_irq(lock)
+ #else
+-# define spin_unlock(lock) \
++# define atomic_spin_unlock(lock) \
+     do {__raw_spin_unlock(&(lock)->raw_lock); __release(lock); } while (0)
+-# define read_unlock(lock) \
+-    do {__raw_read_unlock(&(lock)->raw_lock); __release(lock); } while (0)
+-# define write_unlock(lock) \
+-    do {__raw_write_unlock(&(lock)->raw_lock); __release(lock); } while (0)
+-# define spin_unlock_irq(lock)			\
++
++# define atomic_spin_unlock_irq(lock)		\
+ do {						\
+ 	__raw_spin_unlock(&(lock)->raw_lock);	\
+ 	__release(lock);			\
+ 	local_irq_enable();			\
+ } while (0)
+-# define read_unlock_irq(lock)			\
+-do {						\
+-	__raw_read_unlock(&(lock)->raw_lock);	\
+-	__release(lock);			\
+-	local_irq_enable();			\
+-} while (0)
+-# define write_unlock_irq(lock)			\
+-do {						\
+-	__raw_write_unlock(&(lock)->raw_lock);	\
+-	__release(lock);			\
+-	local_irq_enable();			\
+-} while (0)
+ #endif
+ 
+-#define spin_unlock_irqrestore(lock, flags)		\
+-	do {						\
+-		typecheck(unsigned long, flags);	\
+-		_spin_unlock_irqrestore(lock, flags);	\
+-	} while (0)
+-#define spin_unlock_bh(lock)		_spin_unlock_bh(lock)
+-
+-#define read_unlock_irqrestore(lock, flags)		\
+-	do {						\
+-		typecheck(unsigned long, flags);	\
+-		_read_unlock_irqrestore(lock, flags);	\
+-	} while (0)
+-#define read_unlock_bh(lock)		_read_unlock_bh(lock)
+-
+-#define write_unlock_irqrestore(lock, flags)		\
++#define atomic_spin_unlock_irqrestore(lock, flags)	\
+ 	do {						\
+ 		typecheck(unsigned long, flags);	\
+-		_write_unlock_irqrestore(lock, flags);	\
++		_atomic_spin_unlock_irqrestore(lock, flags);\
+ 	} while (0)
+-#define write_unlock_bh(lock)		_write_unlock_bh(lock)
++#define atomic_spin_unlock_bh(lock)	_atomic_spin_unlock_bh(lock)
+ 
+-#define spin_trylock_bh(lock)	__cond_lock(lock, _spin_trylock_bh(lock))
++#define atomic_spin_trylock_bh(lock)	\
++	__cond_lock(lock, _atomic_spin_trylock_bh(lock))
+ 
+-#define spin_trylock_irq(lock) \
++#define atomic_spin_trylock_irq(lock) \
+ ({ \
+ 	local_irq_disable(); \
+-	spin_trylock(lock) ? \
++	atomic_spin_trylock(lock) ? \
+ 	1 : ({ local_irq_enable(); 0;  }); \
+ })
+ 
+-#define spin_trylock_irqsave(lock, flags) \
++#define atomic_spin_trylock_irqsave(lock, flags) \
+ ({ \
+ 	local_irq_save(flags); \
+-	spin_trylock(lock) ? \
++	atomic_spin_trylock(lock) ? \
+ 	1 : ({ local_irq_restore(flags); 0; }); \
+ })
+ 
+-#define write_trylock_irqsave(lock, flags) \
+-({ \
+-	local_irq_save(flags); \
+-	write_trylock(lock) ? \
+-	1 : ({ local_irq_restore(flags); 0; }); \
+-})
++/**
++ * spin_can_lock - would spin_trylock() succeed?
++ * @lock: the spinlock in question.
++ */
++#define atomic_spin_can_lock(lock)	(!atomic_spin_is_locked(lock))
+ 
+ /*
+  * Pull the atomic_t declaration:
+@@ -370,14 +260,246 @@
+  * Decrements @atomic by 1.  If the result is 0, returns true and locks
+  * @lock.  Returns false for all other cases.
+  */
+-extern int _atomic_dec_and_lock(atomic_t *atomic, spinlock_t *lock);
++extern int
++_atomic_dec_and_atomic_lock(atomic_t *atomic, atomic_spinlock_t *lock);
++
++#define atomic_dec_and_atomic_lock(atomic, lock) \
++	__cond_lock(lock, _atomic_dec_and_atomic_lock(atomic, lock))
++
++#ifdef CONFIG_PREEMPT_RT
++
++#include <linux/rt_lock.h>
++
++#define spin_lock(lock)			rt_spin_lock(lock)
++#define spin_lock_bh(lock)		rt_spin_lock(lock)
++
++#define spin_trylock(lock)		__cond_lock(lock, rt_spin_trylock(lock))
++
++#ifdef CONFIG_LOCKDEP
++# define spin_lock_nested(lock, subclass) \
++	rt_spin_lock_nested(lock, subclass)
++
++# define spin_lock_irqsave_nested(lock, flags, subclass) \
++do { \
++	typecheck(unsigned long, flags); \
++	flags = 0; \
++	rt_spin_lock_nested(lock, subclass); \
++} while (0)
++#else
++# define spin_lock_nested(lock, subclass) \
++	rt_spin_lock(lock)
++
++# define spin_lock_irqsave_nested(lock, flags, subclass) \
++do { \
++	typecheck(unsigned long, flags); \
++	flags = 0; \
++	rt_spin_lock(lock); \
++} while (0)
++#endif
++
++#define spin_lock_irq(lock)		rt_spin_lock(lock)
++
++#define spin_lock_irqsave(lock, flags) \
++do { \
++	typecheck(unsigned long, flags); \
++	flags = 0; \
++	rt_spin_lock(lock); \
++} while (0)
++
++/* FIXME: we need rt_spin_lock_nested */
++#define spin_lock_nest_lock(lock, nest_lock) spin_lock_nested(lock, 0)
++
++#define spin_unlock(lock)		rt_spin_unlock(lock)
++#define spin_unlock_bh(lock)		rt_spin_unlock(lock)
++#define spin_unlock_irq(lock)		rt_spin_unlock(lock)
++
++#define spin_unlock_irqrestore(lock, flags) \
++do { \
++	typecheck(unsigned long, flags); \
++	(void) flags; \
++	rt_spin_unlock(lock); \
++} while (0)
++
++#define spin_trylock_bh(lock)		__cond_lock(lock, rt_spin_trylock(lock))
++#define spin_trylock_irq(lock)		__cond_lock(lock, rt_spin_trylock(lock))
++
++#define spin_trylock_irqsave(lock, flags) \
++({				  \
++	typecheck(unsigned long, flags); \
++	flags = 0; \
++	__cond_lock(lock, rt_spin_trylock(lock));	\
++})
++
++#define spin_unlock_wait(lock)		rt_spin_unlock_wait(lock)
++
++#ifdef CONFIG_GENERIC_LOCKBREAK
++# define spin_is_contended(lock)	((lock)->break_lock)
++#else
++# define spin_is_contended(lock)	(((void)(lock), 0))
++#endif
++
++static inline int spin_can_locked(spinlock_t *lock)
++{
++	return !rt_mutex_is_locked(&lock->lock);
++}
++
++static inline int spin_is_locked(spinlock_t *lock)
++{
++	return rt_mutex_is_locked(&lock->lock);
++}
++
++static inline void assert_spin_locked(spinlock_t *lock)
++{
++	BUG_ON(!spin_is_locked(lock));
++}
++
++#define atomic_dec_and_lock(atomic, lock) \
++	atomic_dec_and_spin_lock(atomic, lock)
++
++#else
++
++/*
++ * Map spin* to atomic_spin* for PREEMPT_RT=n
++ */
++static inline void spin_lockcheck(spinlock_t *lock) { }
++
++#define spin_lock_init(lock) \
++do { \
++	spin_lockcheck(lock); \
++	atomic_spin_lock_init((atomic_spinlock_t *)lock); \
++} while (0)
++
++#define spin_lock(lock) \
++do { \
++	spin_lockcheck(lock); \
++	atomic_spin_lock((atomic_spinlock_t *)lock); \
++} while (0)
++
++#define spin_lock_bh(lock) \
++do { \
++	spin_lockcheck(lock); \
++	atomic_spin_lock_bh((atomic_spinlock_t *)lock);	\
++} while (0)
++
++#define spin_trylock(lock) \
++({ \
++	spin_lockcheck(lock);			\
++	atomic_spin_trylock((atomic_spinlock_t *)lock);	\
++})
++
++#define spin_lock_nested(lock, subclass) \
++do { \
++	spin_lockcheck(lock); \
++	atomic_spin_lock_nested((atomic_spinlock_t *)lock, subclass); \
++} while (0)
++
++#define spin_lock_nest_lock(lock, nest_lock) \
++do { \
++	spin_lockcheck(lock); \
++	atomic_spin_lock_nest_lock((atomic_spinlock_t *)lock, nest_lock); \
++} while (0)
++
++#define spin_lock_irq(lock) \
++do { \
++	spin_lockcheck(lock); \
++	atomic_spin_lock_irq((atomic_spinlock_t *)lock); \
++} while (0)
++
++#define spin_lock_irqsave(lock, flags) \
++do { \
++	spin_lockcheck(lock); \
++	atomic_spin_lock_irqsave((atomic_spinlock_t *)lock, flags);	\
++} while (0)
++
++#define spin_lock_irqsave_nested(lock, flags, subclass) \
++do { \
++	spin_lockcheck(lock); \
++	atomic_spin_lock_irqsave_nested((atomic_spinlock_t *)lock, flags, subclass); \
++} while (0)
++
++#define spin_unlock(lock) \
++do { \
++	spin_lockcheck(lock); \
++	atomic_spin_unlock((atomic_spinlock_t *)lock); \
++} while (0)
++
++#define spin_unlock_bh(lock) \
++do { \
++	spin_lockcheck(lock); \
++	atomic_spin_unlock_bh((atomic_spinlock_t *)lock); \
++} while (0)
++
++#define spin_unlock_irq(lock) \
++do { \
++	spin_lockcheck(lock); \
++	atomic_spin_unlock_irq((atomic_spinlock_t *)lock); \
++} while (0)
++
++#define spin_unlock_irqrestore(lock, flags) \
++do { \
++	spin_lockcheck(lock); \
++	atomic_spin_unlock_irqrestore((atomic_spinlock_t *)lock, flags); \
++} while (0)
++
++#define spin_trylock_bh(lock) \
++({ \
++	spin_lockcheck(lock); \
++	atomic_spin_trylock_bh((atomic_spinlock_t *)lock); \
++})
++
++#define spin_trylock_irq(lock) \
++({ \
++	spin_lockcheck(lock); \
++	atomic_spin_trylock_irq((atomic_spinlock_t *)lock); \
++})
++
++#define spin_trylock_irqsave(lock, flags) \
++({				  \
++	spin_lockcheck(lock); \
++	atomic_spin_trylock_irqsave((atomic_spinlock_t *)lock, flags); \
++})
++
++#define spin_unlock_wait(lock) \
++do { \
++	spin_lockcheck(lock); \
++	atomic_spin_unlock_wait((atomic_spinlock_t *)lock); \
++} while (0)
++
++#define spin_is_locked(lock) \
++({ \
++	spin_lockcheck(lock); \
++	atomic_spin_is_locked((atomic_spinlock_t *)lock); \
++})
++
++#define spin_is_contended(lock)	\
++({ \
++	spin_lockcheck(lock); \
++	atomic_spin_is_contended((atomic_spinlock_t *)lock); \
++})
++
++#define spin_can_lock(lock) \
++({ \
++	spin_lockcheck(lock); \
++	atomic_spin_can_lock((atomic_spinlock_t *)lock); \
++})
++
++#define assert_spin_locked(lock) \
++do { \
++	spin_lockcheck(lock); \
++	assert_atomic_spin_locked((atomic_spinlock_t *)lock); \
++} while (0)
++
+ #define atomic_dec_and_lock(atomic, lock) \
+-		__cond_lock(lock, _atomic_dec_and_lock(atomic, lock))
++({ \
++	spin_lockcheck(lock); \
++	atomic_dec_and_atomic_lock(atomic, (atomic_spinlock_t *)lock); \
++})
+ 
+-/**
+- * spin_can_lock - would spin_trylock() succeed?
+- * @lock: the spinlock in question.
++#endif /* !PREEMPT_RT */
++
++/*
++ * Get the rwlock part
+  */
+-#define spin_can_lock(lock)	(!spin_is_locked(lock))
++#include <linux/rwlock.h>
+ 
+ #endif /* __LINUX_SPINLOCK_H */
+Index: linux-rt-2.6.31/include/linux/spinlock_api_smp.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/spinlock_api_smp.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/spinlock_api_smp.h	2010-05-17 14:23:20.068386444 +0200
+@@ -17,47 +17,74 @@
+ 
+ int in_lock_functions(unsigned long addr);
+ 
+-#define assert_spin_locked(x)	BUG_ON(!spin_is_locked(x))
++#define assert_atomic_spin_locked(x)	BUG_ON(!atomic_spin_is_locked(x))
+ 
+-void __lockfunc _spin_lock(spinlock_t *lock)		__acquires(lock);
+-void __lockfunc _spin_lock_nested(spinlock_t *lock, int subclass)
++void __lockfunc
++_atomic_spin_lock(atomic_spinlock_t *lock)		__acquires(lock);
++
++void __lockfunc
++_atomic_spin_lock_nested(atomic_spinlock_t *lock, int subclass)
++							__acquires(lock);
++
++void __lockfunc
++_atomic_spin_lock_nest_lock(atomic_spinlock_t *lock, struct lockdep_map *map)
+ 							__acquires(lock);
+-void __lockfunc _spin_lock_nest_lock(spinlock_t *lock, struct lockdep_map *map)
++void __lockfunc
++_atomic_spin_lock_bh(atomic_spinlock_t *lock)		__acquires(lock);
++
++void __lockfunc
++_atomic_spin_lock_irq(atomic_spinlock_t *lock)		__acquires(lock);
++
++unsigned long __lockfunc
++_atomic_spin_lock_irqsave(atomic_spinlock_t *lock)	__acquires(lock);
++
++unsigned long __lockfunc
++_atomic_spin_lock_irqsave_nested(atomic_spinlock_t *lock, int subclass)
+ 							__acquires(lock);
++
++int __lockfunc _atomic_spin_trylock(atomic_spinlock_t *lock);
++int __lockfunc _atomic_spin_trylock_bh(atomic_spinlock_t *lock);
++
++void __lockfunc
++_atomic_spin_unlock(atomic_spinlock_t *lock)		__releases(lock);
++
++void __lockfunc
++_atomic_spin_unlock_bh(atomic_spinlock_t *lock)		__releases(lock);
++
++void __lockfunc
++_atomic_spin_unlock_irq(atomic_spinlock_t *lock)	__releases(lock);
++
++void __lockfunc
++_atomic_spin_unlock_irqrestore(atomic_spinlock_t *lock,	unsigned long flags)
++							__releases(lock);
++
++#ifndef CONFIG_PREEMPT_RT
+ void __lockfunc _read_lock(rwlock_t *lock)		__acquires(lock);
+ void __lockfunc _write_lock(rwlock_t *lock)		__acquires(lock);
+-void __lockfunc _spin_lock_bh(spinlock_t *lock)		__acquires(lock);
+ void __lockfunc _read_lock_bh(rwlock_t *lock)		__acquires(lock);
+ void __lockfunc _write_lock_bh(rwlock_t *lock)		__acquires(lock);
+-void __lockfunc _spin_lock_irq(spinlock_t *lock)	__acquires(lock);
+ void __lockfunc _read_lock_irq(rwlock_t *lock)		__acquires(lock);
+ void __lockfunc _write_lock_irq(rwlock_t *lock)		__acquires(lock);
+-unsigned long __lockfunc _spin_lock_irqsave(spinlock_t *lock)
+-							__acquires(lock);
+-unsigned long __lockfunc _spin_lock_irqsave_nested(spinlock_t *lock, int subclass)
+-							__acquires(lock);
++
+ unsigned long __lockfunc _read_lock_irqsave(rwlock_t *lock)
+ 							__acquires(lock);
+ unsigned long __lockfunc _write_lock_irqsave(rwlock_t *lock)
+ 							__acquires(lock);
+-int __lockfunc _spin_trylock(spinlock_t *lock);
+ int __lockfunc _read_trylock(rwlock_t *lock);
+ int __lockfunc _write_trylock(rwlock_t *lock);
+-int __lockfunc _spin_trylock_bh(spinlock_t *lock);
+-void __lockfunc _spin_unlock(spinlock_t *lock)		__releases(lock);
++
+ void __lockfunc _read_unlock(rwlock_t *lock)		__releases(lock);
+ void __lockfunc _write_unlock(rwlock_t *lock)		__releases(lock);
+-void __lockfunc _spin_unlock_bh(spinlock_t *lock)	__releases(lock);
+ void __lockfunc _read_unlock_bh(rwlock_t *lock)		__releases(lock);
+ void __lockfunc _write_unlock_bh(rwlock_t *lock)	__releases(lock);
+-void __lockfunc _spin_unlock_irq(spinlock_t *lock)	__releases(lock);
++
+ void __lockfunc _read_unlock_irq(rwlock_t *lock)	__releases(lock);
+ void __lockfunc _write_unlock_irq(rwlock_t *lock)	__releases(lock);
+-void __lockfunc _spin_unlock_irqrestore(spinlock_t *lock, unsigned long flags)
+-							__releases(lock);
++
+ void __lockfunc _read_unlock_irqrestore(rwlock_t *lock, unsigned long flags)
+ 							__releases(lock);
+ void __lockfunc _write_unlock_irqrestore(rwlock_t *lock, unsigned long flags)
+ 							__releases(lock);
++#endif
+ 
+ #endif /* __LINUX_SPINLOCK_API_SMP_H */
+Index: linux-rt-2.6.31/include/linux/spinlock_api_up.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/spinlock_api_up.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/spinlock_api_up.h	2010-05-17 14:23:20.068386444 +0200
+@@ -16,7 +16,7 @@
+ 
+ #define in_lock_functions(ADDR)		0
+ 
+-#define assert_spin_locked(lock)	do { (void)(lock); } while (0)
++#define assert_atomic_spin_locked(lock)	do { (void)(lock); } while (0)
+ 
+ /*
+  * In the UP-nondebug case there's no real locking going on, so the
+@@ -40,7 +40,8 @@
+   do { preempt_enable(); __release(lock); (void)(lock); } while (0)
+ 
+ #define __UNLOCK_BH(lock) \
+-  do { preempt_enable_no_resched(); local_bh_enable(); __release(lock); (void)(lock); } while (0)
++  do { __preempt_enable_no_resched(); local_bh_enable(); __release(lock); \
++	  (void)(lock); } while (0)
+ 
+ #define __UNLOCK_IRQ(lock) \
+   do { local_irq_enable(); __UNLOCK(lock); } while (0)
+@@ -48,33 +49,35 @@
+ #define __UNLOCK_IRQRESTORE(lock, flags) \
+   do { local_irq_restore(flags); __UNLOCK(lock); } while (0)
+ 
+-#define _spin_lock(lock)			__LOCK(lock)
+-#define _spin_lock_nested(lock, subclass)	__LOCK(lock)
++#define _atomic_spin_lock(lock)			__LOCK(lock)
++#define _atomic_spin_lock_nested(lock, subclass) \
++						__LOCK(lock)
+ #define _read_lock(lock)			__LOCK(lock)
+ #define _write_lock(lock)			__LOCK(lock)
+-#define _spin_lock_bh(lock)			__LOCK_BH(lock)
++#define _atomic_spin_lock_bh(lock)		__LOCK_BH(lock)
+ #define _read_lock_bh(lock)			__LOCK_BH(lock)
+ #define _write_lock_bh(lock)			__LOCK_BH(lock)
+-#define _spin_lock_irq(lock)			__LOCK_IRQ(lock)
++#define _atomic_spin_lock_irq(lock)		__LOCK_IRQ(lock)
+ #define _read_lock_irq(lock)			__LOCK_IRQ(lock)
+ #define _write_lock_irq(lock)			__LOCK_IRQ(lock)
+-#define _spin_lock_irqsave(lock, flags)		__LOCK_IRQSAVE(lock, flags)
++#define _atomic_spin_lock_irqsave(lock, flags)	__LOCK_IRQSAVE(lock, flags)
+ #define _read_lock_irqsave(lock, flags)		__LOCK_IRQSAVE(lock, flags)
+ #define _write_lock_irqsave(lock, flags)	__LOCK_IRQSAVE(lock, flags)
+-#define _spin_trylock(lock)			({ __LOCK(lock); 1; })
++#define _atomic_spin_trylock(lock)		({ __LOCK(lock); 1; })
+ #define _read_trylock(lock)			({ __LOCK(lock); 1; })
+ #define _write_trylock(lock)			({ __LOCK(lock); 1; })
+-#define _spin_trylock_bh(lock)			({ __LOCK_BH(lock); 1; })
+-#define _spin_unlock(lock)			__UNLOCK(lock)
++#define _atomic_spin_trylock_bh(lock)		({ __LOCK_BH(lock); 1; })
++#define _atomic_spin_unlock(lock)		__UNLOCK(lock)
+ #define _read_unlock(lock)			__UNLOCK(lock)
+ #define _write_unlock(lock)			__UNLOCK(lock)
+-#define _spin_unlock_bh(lock)			__UNLOCK_BH(lock)
++#define _atomic_spin_unlock_bh(lock)		__UNLOCK_BH(lock)
+ #define _write_unlock_bh(lock)			__UNLOCK_BH(lock)
+ #define _read_unlock_bh(lock)			__UNLOCK_BH(lock)
+-#define _spin_unlock_irq(lock)			__UNLOCK_IRQ(lock)
++#define _atomic_spin_unlock_irq(lock)		__UNLOCK_IRQ(lock)
+ #define _read_unlock_irq(lock)			__UNLOCK_IRQ(lock)
+ #define _write_unlock_irq(lock)			__UNLOCK_IRQ(lock)
+-#define _spin_unlock_irqrestore(lock, flags)	__UNLOCK_IRQRESTORE(lock, flags)
++#define _atomic_spin_unlock_irqrestore(lock, flags) \
++						__UNLOCK_IRQRESTORE(lock, flags)
+ #define _read_unlock_irqrestore(lock, flags)	__UNLOCK_IRQRESTORE(lock, flags)
+ #define _write_unlock_irqrestore(lock, flags)	__UNLOCK_IRQRESTORE(lock, flags)
+ 
+Index: linux-rt-2.6.31/include/linux/spinlock_types.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/spinlock_types.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/spinlock_types.h	2010-05-17 14:23:20.068386444 +0200
+@@ -9,6 +9,23 @@
+  * Released under the General Public License (GPL).
+  */
+ 
++/*
++ * Must define these before including other files, inline functions need them
++ */
++#define LOCK_SECTION_NAME ".text.lock."KBUILD_BASENAME
++
++#define LOCK_SECTION_START(extra)		\
++	".subsection 1\n\t"			\
++	extra					\
++	".ifndef " LOCK_SECTION_NAME "\n\t"     \
++	LOCK_SECTION_NAME ":\n\t"		\
++	".endif\n"
++
++#define LOCK_SECTION_END			\
++	".previous\n\t"
++
++#define __lockfunc __attribute__((section(".spinlock.text")))
++
+ #if defined(CONFIG_SMP)
+ # include <asm/spinlock_types.h>
+ #else
+@@ -17,7 +34,7 @@
+ 
+ #include <linux/lockdep.h>
+ 
+-typedef struct {
++typedef struct atomic_spinlock {
+ 	raw_spinlock_t raw_lock;
+ #ifdef CONFIG_GENERIC_LOCKBREAK
+ 	unsigned int break_lock;
+@@ -29,26 +46,10 @@
+ #ifdef CONFIG_DEBUG_LOCK_ALLOC
+ 	struct lockdep_map dep_map;
+ #endif
+-} spinlock_t;
++} atomic_spinlock_t;
+ 
+ #define SPINLOCK_MAGIC		0xdead4ead
+ 
+-typedef struct {
+-	raw_rwlock_t raw_lock;
+-#ifdef CONFIG_GENERIC_LOCKBREAK
+-	unsigned int break_lock;
+-#endif
+-#ifdef CONFIG_DEBUG_SPINLOCK
+-	unsigned int magic, owner_cpu;
+-	void *owner;
+-#endif
+-#ifdef CONFIG_DEBUG_LOCK_ALLOC
+-	struct lockdep_map dep_map;
+-#endif
+-} rwlock_t;
+-
+-#define RWLOCK_MAGIC		0xdeaf1eed
+-
+ #define SPINLOCK_OWNER_INIT	((void *)-1L)
+ 
+ #ifdef CONFIG_DEBUG_LOCK_ALLOC
+@@ -57,44 +58,75 @@
+ # define SPIN_DEP_MAP_INIT(lockname)
+ #endif
+ 
+-#ifdef CONFIG_DEBUG_LOCK_ALLOC
+-# define RW_DEP_MAP_INIT(lockname)	.dep_map = { .name = #lockname }
+-#else
+-# define RW_DEP_MAP_INIT(lockname)
+-#endif
+-
+ #ifdef CONFIG_DEBUG_SPINLOCK
+-# define __SPIN_LOCK_UNLOCKED(lockname)					\
+-	(spinlock_t)	{	.raw_lock = __RAW_SPIN_LOCK_UNLOCKED,	\
++# define __ATOMIC_SPIN_LOCK_UNLOCKED(lockname)				\
++	(atomic_spinlock_t) {	.raw_lock = __RAW_SPIN_LOCK_UNLOCKED,	\
+ 				.magic = SPINLOCK_MAGIC,		\
+ 				.owner = SPINLOCK_OWNER_INIT,		\
+ 				.owner_cpu = -1,			\
+ 				SPIN_DEP_MAP_INIT(lockname) }
+-#define __RW_LOCK_UNLOCKED(lockname)					\
+-	(rwlock_t)	{	.raw_lock = __RAW_RW_LOCK_UNLOCKED,	\
+-				.magic = RWLOCK_MAGIC,			\
+-				.owner = SPINLOCK_OWNER_INIT,		\
+-				.owner_cpu = -1,			\
+-				RW_DEP_MAP_INIT(lockname) }
+ #else
+-# define __SPIN_LOCK_UNLOCKED(lockname) \
+-	(spinlock_t)	{	.raw_lock = __RAW_SPIN_LOCK_UNLOCKED,	\
++# define __ATOMIC_SPIN_LOCK_UNLOCKED(lockname) \
++	(atomic_spinlock_t) {	.raw_lock = __RAW_SPIN_LOCK_UNLOCKED,	\
+ 				SPIN_DEP_MAP_INIT(lockname) }
+-#define __RW_LOCK_UNLOCKED(lockname) \
+-	(rwlock_t)	{	.raw_lock = __RAW_RW_LOCK_UNLOCKED,	\
+-				RW_DEP_MAP_INIT(lockname) }
+ #endif
+ 
+ /*
+- * SPIN_LOCK_UNLOCKED and RW_LOCK_UNLOCKED defeat lockdep state tracking and
+- * are hence deprecated.
+- * Please use DEFINE_SPINLOCK()/DEFINE_RWLOCK() or
+- * __SPIN_LOCK_UNLOCKED()/__RW_LOCK_UNLOCKED() as appropriate.
++ * SPIN_LOCK_UNLOCKED defeats lockdep state tracking and is hence
++ * deprecated.
++ *
++ * Please use DEFINE_SPINLOCK() or __SPIN_LOCK_UNLOCKED() as
++ * appropriate.
++ */
++#define DEFINE_ATOMIC_SPINLOCK(x)	\
++	atomic_spinlock_t x = __ATOMIC_SPIN_LOCK_UNLOCKED(x)
++
++#ifndef CONFIG_PREEMPT_RT
++/*
++ * For PREEMPT_RT=n we use the same data structures and the spinlock
++ * functions are mapped to the atomic_spinlock functions
++ */
++typedef struct spinlock {
++	raw_spinlock_t raw_lock;
++#ifdef CONFIG_GENERIC_LOCKBREAK
++	unsigned int break_lock;
++#endif
++#ifdef CONFIG_DEBUG_SPINLOCK
++	unsigned int magic, owner_cpu;
++	void *owner;
++#endif
++#ifdef CONFIG_DEBUG_LOCK_ALLOC
++	struct lockdep_map dep_map;
++#endif
++} spinlock_t;
++
++#ifdef CONFIG_DEBUG_SPINLOCK
++# define __SPIN_LOCK_UNLOCKED(lockname)				\
++	(spinlock_t) {	.raw_lock = __RAW_SPIN_LOCK_UNLOCKED,	\
++			.magic = SPINLOCK_MAGIC,		\
++			.owner = SPINLOCK_OWNER_INIT,		\
++			.owner_cpu = -1,			\
++			SPIN_DEP_MAP_INIT(lockname) }
++#else
++# define __SPIN_LOCK_UNLOCKED(lockname) \
++	(spinlock_t) {	.raw_lock = __RAW_SPIN_LOCK_UNLOCKED,	\
++			SPIN_DEP_MAP_INIT(lockname) }
++#endif
++
++/*
++ * SPIN_LOCK_UNLOCKED defeats lockdep state tracking and is hence
++ * deprecated.
++ *
++ * Please use DEFINE_SPINLOCK() or __SPIN_LOCK_UNLOCKED() as
++ * appropriate.
+  */
+ #define SPIN_LOCK_UNLOCKED	__SPIN_LOCK_UNLOCKED(old_style_spin_init)
+-#define RW_LOCK_UNLOCKED	__RW_LOCK_UNLOCKED(old_style_rw_init)
+ 
+-#define DEFINE_SPINLOCK(x)	spinlock_t x = __SPIN_LOCK_UNLOCKED(x)
+-#define DEFINE_RWLOCK(x)	rwlock_t x = __RW_LOCK_UNLOCKED(x)
++#define __DEFINE_SPINLOCK(x)	spinlock_t x = __SPIN_LOCK_UNLOCKED(x)
++#define DEFINE_SPINLOCK(x)	__DEFINE_SPINLOCK(x)
++
++#include <linux/rwlock_types.h>
++
++#endif
+ 
+ #endif /* __LINUX_SPINLOCK_TYPES_H */
+Index: linux-rt-2.6.31/include/linux/srcu.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/srcu.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/srcu.h	2010-05-17 14:23:20.068386444 +0200
+@@ -27,6 +27,8 @@
+ #ifndef _LINUX_SRCU_H
+ #define _LINUX_SRCU_H
+ 
++#include <linux/wait.h>
++
+ struct srcu_struct_array {
+ 	int c[2];
+ };
+@@ -50,4 +52,24 @@
+ void synchronize_srcu(struct srcu_struct *sp);
+ long srcu_batches_completed(struct srcu_struct *sp);
+ 
++/*
++ * fully compatible with srcu, but optimized for writers.
++ */
++
++struct qrcu_struct {
++	int completed;
++	atomic_t ctr[2];
++	wait_queue_head_t wq;
++	struct mutex mutex;
++};
++
++int init_qrcu_struct(struct qrcu_struct *qp);
++int qrcu_read_lock(struct qrcu_struct *qp);
++void qrcu_read_unlock(struct qrcu_struct *qp, int idx);
++void synchronize_qrcu(struct qrcu_struct *qp);
++
++static inline void cleanup_qrcu_struct(struct qrcu_struct *qp)
++{
++}
++
+ #endif
+Index: linux-rt-2.6.31/include/linux/syscalls.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/syscalls.h	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/include/linux/syscalls.h	2010-05-17 14:23:20.068386444 +0200
+@@ -64,6 +64,7 @@
+ #include <linux/sem.h>
+ #include <asm/siginfo.h>
+ #include <asm/signal.h>
++#include <linux/unistd.h>
+ #include <linux/quota.h>
+ #include <linux/key.h>
+ #include <trace/syscall.h>
+@@ -97,6 +98,53 @@
+ #define __SC_TEST5(t5, a5, ...)	__SC_TEST(t5); __SC_TEST4(__VA_ARGS__)
+ #define __SC_TEST6(t6, a6, ...)	__SC_TEST(t6); __SC_TEST5(__VA_ARGS__)
+ 
++#ifdef CONFIG_EVENT_PROFILE
++#define TRACE_SYS_ENTER_PROFILE(sname)					       \
++static int prof_sysenter_enable_##sname(struct ftrace_event_call *event_call)  \
++{									       \
++	int ret = 0;							       \
++	if (!atomic_inc_return(&event_enter_##sname.profile_count))	       \
++		ret = reg_prof_syscall_enter("sys"#sname);		       \
++	return ret;							       \
++}									       \
++									       \
++static void prof_sysenter_disable_##sname(struct ftrace_event_call *event_call)\
++{									       \
++	if (atomic_add_negative(-1, &event_enter_##sname.profile_count))       \
++		unreg_prof_syscall_enter("sys"#sname);			       \
++}
++
++#define TRACE_SYS_EXIT_PROFILE(sname)					       \
++static int prof_sysexit_enable_##sname(struct ftrace_event_call *event_call)   \
++{									       \
++	int ret = 0;							       \
++	if (!atomic_inc_return(&event_exit_##sname.profile_count))	       \
++		ret = reg_prof_syscall_exit("sys"#sname);		       \
++	return ret;							       \
++}									       \
++									       \
++static void prof_sysexit_disable_##sname(struct ftrace_event_call *event_call) \
++{                                                                              \
++	if (atomic_add_negative(-1, &event_exit_##sname.profile_count))	       \
++		unreg_prof_syscall_exit("sys"#sname);			       \
++}
++
++#define TRACE_SYS_ENTER_PROFILE_INIT(sname)				       \
++	.profile_count = ATOMIC_INIT(-1),				       \
++	.profile_enable = prof_sysenter_enable_##sname,			       \
++	.profile_disable = prof_sysenter_disable_##sname,
++
++#define TRACE_SYS_EXIT_PROFILE_INIT(sname)				       \
++	.profile_count = ATOMIC_INIT(-1),				       \
++	.profile_enable = prof_sysexit_enable_##sname,			       \
++	.profile_disable = prof_sysexit_disable_##sname,
++#else
++#define TRACE_SYS_ENTER_PROFILE(sname)
++#define TRACE_SYS_ENTER_PROFILE_INIT(sname)
++#define TRACE_SYS_EXIT_PROFILE(sname)
++#define TRACE_SYS_EXIT_PROFILE_INIT(sname)
++#endif
++
+ #ifdef CONFIG_FTRACE_SYSCALLS
+ #define __SC_STR_ADECL1(t, a)		#a
+ #define __SC_STR_ADECL2(t, a, ...)	#a, __SC_STR_ADECL1(__VA_ARGS__)
+@@ -112,7 +160,81 @@
+ #define __SC_STR_TDECL5(t, a, ...)	#t, __SC_STR_TDECL4(__VA_ARGS__)
+ #define __SC_STR_TDECL6(t, a, ...)	#t, __SC_STR_TDECL5(__VA_ARGS__)
+ 
++#define SYSCALL_TRACE_ENTER_EVENT(sname)				\
++	static struct ftrace_event_call event_enter_##sname;		\
++	struct trace_event enter_syscall_print_##sname = {		\
++		.trace                  = print_syscall_enter,		\
++	};								\
++	static int init_enter_##sname(void)				\
++	{								\
++		int num, id;						\
++		num = syscall_name_to_nr("sys"#sname);			\
++		if (num < 0)						\
++			return -ENOSYS;					\
++		id = register_ftrace_event(&enter_syscall_print_##sname);\
++		if (!id)						\
++			return -ENODEV;					\
++		event_enter_##sname.id = id;				\
++		set_syscall_enter_id(num, id);				\
++		INIT_LIST_HEAD(&event_enter_##sname.fields);		\
++		return 0;						\
++	}								\
++	TRACE_SYS_ENTER_PROFILE(sname);					\
++	static struct ftrace_event_call __used				\
++	  __attribute__((__aligned__(4)))				\
++	  __attribute__((section("_ftrace_events")))			\
++	  event_enter_##sname = {					\
++		.name                   = "sys_enter"#sname,		\
++		.system                 = "syscalls",			\
++		.event                  = &event_syscall_enter,		\
++		.raw_init		= init_enter_##sname,		\
++		.show_format		= syscall_enter_format,		\
++		.define_fields		= syscall_enter_define_fields,	\
++		.regfunc		= reg_event_syscall_enter,	\
++		.unregfunc		= unreg_event_syscall_enter,	\
++		.data			= "sys"#sname,			\
++		TRACE_SYS_ENTER_PROFILE_INIT(sname)			\
++	}
++
++#define SYSCALL_TRACE_EXIT_EVENT(sname)					\
++	static struct ftrace_event_call event_exit_##sname;		\
++	struct trace_event exit_syscall_print_##sname = {		\
++		.trace                  = print_syscall_exit,		\
++	};								\
++	static int init_exit_##sname(void)				\
++	{								\
++		int num, id;						\
++		num = syscall_name_to_nr("sys"#sname);			\
++		if (num < 0)						\
++			return -ENOSYS;					\
++		id = register_ftrace_event(&exit_syscall_print_##sname);\
++		if (!id)						\
++			return -ENODEV;					\
++		event_exit_##sname.id = id;				\
++		set_syscall_exit_id(num, id);				\
++		INIT_LIST_HEAD(&event_exit_##sname.fields);		\
++		return 0;						\
++	}								\
++	TRACE_SYS_EXIT_PROFILE(sname);					\
++	static struct ftrace_event_call __used				\
++	  __attribute__((__aligned__(4)))				\
++	  __attribute__((section("_ftrace_events")))			\
++	  event_exit_##sname = {					\
++		.name                   = "sys_exit"#sname,		\
++		.system                 = "syscalls",			\
++		.event                  = &event_syscall_exit,		\
++		.raw_init		= init_exit_##sname,		\
++		.show_format		= syscall_exit_format,		\
++		.define_fields		= syscall_exit_define_fields,	\
++		.regfunc		= reg_event_syscall_exit,	\
++		.unregfunc		= unreg_event_syscall_exit,	\
++		.data			= "sys"#sname,			\
++		TRACE_SYS_EXIT_PROFILE_INIT(sname)			\
++	}
++
+ #define SYSCALL_METADATA(sname, nb)				\
++	SYSCALL_TRACE_ENTER_EVENT(sname);			\
++	SYSCALL_TRACE_EXIT_EVENT(sname);			\
+ 	static const struct syscall_metadata __used		\
+ 	  __attribute__((__aligned__(4)))			\
+ 	  __attribute__((section("__syscalls_metadata")))	\
+@@ -121,18 +243,23 @@
+ 		.nb_args 	= nb,				\
+ 		.types		= types_##sname,		\
+ 		.args		= args_##sname,			\
+-	}
++		.enter_event	= &event_enter_##sname,		\
++		.exit_event	= &event_exit_##sname,		\
++	};
+ 
+ #define SYSCALL_DEFINE0(sname)					\
++	SYSCALL_TRACE_ENTER_EVENT(_##sname);			\
++	SYSCALL_TRACE_EXIT_EVENT(_##sname);			\
+ 	static const struct syscall_metadata __used		\
+ 	  __attribute__((__aligned__(4)))			\
+ 	  __attribute__((section("__syscalls_metadata")))	\
+ 	  __syscall_meta_##sname = {				\
+ 		.name 		= "sys_"#sname,			\
+ 		.nb_args 	= 0,				\
++		.enter_event	= &event_enter__##sname,	\
++		.exit_event	= &event_exit__##sname,		\
+ 	};							\
+ 	asmlinkage long sys_##sname(void)
+-
+ #else
+ #define SYSCALL_DEFINE0(name)	   asmlinkage long sys_##name(void)
+ #endif
+Index: linux-rt-2.6.31/include/linux/time.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/time.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/time.h	2010-05-17 14:23:20.068386444 +0200
+@@ -75,7 +75,7 @@
+ 			    const unsigned int day, const unsigned int hour,
+ 			    const unsigned int min, const unsigned int sec);
+ 
+-extern void set_normalized_timespec(struct timespec *ts, time_t sec, long nsec);
++extern void set_normalized_timespec(struct timespec *ts, time_t sec, s64 nsec);
+ extern struct timespec timespec_add_safe(const struct timespec lhs,
+ 					 const struct timespec rhs);
+ 
+@@ -99,7 +99,7 @@
+ 
+ extern struct timespec xtime;
+ extern struct timespec wall_to_monotonic;
+-extern seqlock_t xtime_lock;
++extern atomic_seqlock_t xtime_lock;
+ 
+ extern unsigned long read_persistent_clock(void);
+ extern int update_persistent_clock(struct timespec now);
+Index: linux-rt-2.6.31/include/linux/timer.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/timer.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/timer.h	2010-05-17 14:23:20.068386444 +0200
+@@ -230,10 +230,12 @@
+ 
+ extern void add_timer(struct timer_list *timer);
+ 
+-#ifdef CONFIG_SMP
++#if defined(CONFIG_SMP) || defined(CONFIG_PREEMPT_SOFTIRQS)
++  extern int timer_pending_sync(struct timer_list *timer);
+   extern int try_to_del_timer_sync(struct timer_list *timer);
+   extern int del_timer_sync(struct timer_list *timer);
+ #else
++# define timer_pending_sync(t)		timer_pending(t)
+ # define try_to_del_timer_sync(t)	del_timer(t)
+ # define del_timer_sync(t)		del_timer(t)
+ #endif
+Index: linux-rt-2.6.31/include/linux/timex.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/timex.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/timex.h	2010-05-17 14:23:20.068386444 +0200
+@@ -261,11 +261,7 @@
+ 
+ #define NTP_SCALE_SHIFT		32
+ 
+-#ifdef CONFIG_NO_HZ
+-#define NTP_INTERVAL_FREQ  (2)
+-#else
+ #define NTP_INTERVAL_FREQ  (HZ)
+-#endif
+ #define NTP_INTERVAL_LENGTH (NSEC_PER_SEC/NTP_INTERVAL_FREQ)
+ 
+ /* Returns how long ticks are at present, in ns / 2^NTP_SCALE_SHIFT. */
+Index: linux-rt-2.6.31/include/linux/topology.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/topology.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/topology.h	2010-05-17 14:23:20.068386444 +0200
+@@ -99,6 +99,7 @@
+ 				| SD_SHARE_CPUPOWER,	\
+ 	.last_balance		= jiffies,		\
+ 	.balance_interval	= 1,			\
++	.smt_gain		= 1178,	/* 15% */	\
+ }
+ #endif
+ #endif /* CONFIG_SCHED_SMT */
+Index: linux-rt-2.6.31/include/linux/tracepoint.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/tracepoint.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/tracepoint.h	2010-05-17 14:23:20.068386444 +0200
+@@ -23,6 +23,8 @@
+ struct tracepoint {
+ 	const char *name;		/* Tracepoint name */
+ 	int state;			/* State. */
++	void (*regfunc)(void);
++	void (*unregfunc)(void);
+ 	void **funcs;
+ } __attribute__((aligned(32)));		/*
+ 					 * Aligned on 32 bytes because it is
+@@ -78,12 +80,16 @@
+ 		return tracepoint_probe_unregister(#name, (void *)probe);\
+ 	}
+ 
+-#define DEFINE_TRACE(name)						\
++
++#define DEFINE_TRACE_FN(name, reg, unreg)				\
+ 	static const char __tpstrtab_##name[]				\
+ 	__attribute__((section("__tracepoints_strings"))) = #name;	\
+ 	struct tracepoint __tracepoint_##name				\
+ 	__attribute__((section("__tracepoints"), aligned(32))) =	\
+-		{ __tpstrtab_##name, 0, NULL }
++		{ __tpstrtab_##name, 0, reg, unreg, NULL }
++
++#define DEFINE_TRACE(name)						\
++	DEFINE_TRACE_FN(name, NULL, NULL);
+ 
+ #define EXPORT_TRACEPOINT_SYMBOL_GPL(name)				\
+ 	EXPORT_SYMBOL_GPL(__tracepoint_##name)
+@@ -108,6 +114,7 @@
+ 		return -ENOSYS;						\
+ 	}
+ 
++#define DEFINE_TRACE_FN(name, reg, unreg)
+ #define DEFINE_TRACE(name)
+ #define EXPORT_TRACEPOINT_SYMBOL_GPL(name)
+ #define EXPORT_TRACEPOINT_SYMBOL(name)
+@@ -158,6 +165,15 @@
+ 
+ #define PARAMS(args...) args
+ 
++#endif /* _LINUX_TRACEPOINT_H */
++
++/*
++ * Note: we keep the TRACE_EVENT outside the include file ifdef protection.
++ *  This is due to the way trace events work. If a file includes two
++ *  trace event headers under one "CREATE_TRACE_POINTS" the first include
++ *  will override the TRACE_EVENT and break the second include.
++ */
++
+ #ifndef TRACE_EVENT
+ /*
+  * For use with the TRACE_EVENT macro:
+@@ -259,10 +275,15 @@
+  * can also by used by generic instrumentation like SystemTap), and
+  * it is also used to expose a structured trace record in
+  * /sys/kernel/debug/tracing/events/.
++ *
++ * A set of (un)registration functions can be passed to the variant
++ * TRACE_EVENT_FN to perform any (un)registration work.
+  */
+ 
+ #define TRACE_EVENT(name, proto, args, struct, assign, print)	\
+ 	DECLARE_TRACE(name, PARAMS(proto), PARAMS(args))
+-#endif
++#define TRACE_EVENT_FN(name, proto, args, struct,		\
++		assign, print, reg, unreg)			\
++	DECLARE_TRACE(name, PARAMS(proto), PARAMS(args))
+ 
+-#endif
++#endif /* ifdef TRACE_EVENT (see note above) */
+Index: linux-rt-2.6.31/include/linux/tty.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/tty.h	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/include/linux/tty.h	2010-05-17 14:23:20.068386444 +0200
+@@ -486,8 +486,8 @@
+ extern void tty_audit_fork(struct signal_struct *sig);
+ extern void tty_audit_tiocsti(struct tty_struct *tty, char ch);
+ extern void tty_audit_push(struct tty_struct *tty);
+-extern void tty_audit_push_task(struct task_struct *tsk,
+-					uid_t loginuid, u32 sessionid);
++extern int tty_audit_push_task(struct task_struct *tsk,
++			       uid_t loginuid, u32 sessionid);
+ #else
+ static inline void tty_audit_add_data(struct tty_struct *tty,
+ 				      unsigned char *data, size_t size)
+@@ -505,9 +505,10 @@
+ static inline void tty_audit_push(struct tty_struct *tty)
+ {
+ }
+-static inline void tty_audit_push_task(struct task_struct *tsk,
+-					uid_t loginuid, u32 sessionid)
++static inline int tty_audit_push_task(struct task_struct *tsk,
++				      uid_t loginuid, u32 sessionid)
+ {
++	return 0;
+ }
+ #endif
+ 
+Index: linux-rt-2.6.31/include/linux/uaccess.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/uaccess.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/uaccess.h	2010-05-17 14:23:20.068386444 +0200
+@@ -6,37 +6,10 @@
+ 
+ /*
+  * These routines enable/disable the pagefault handler in that
+- * it will not take any locks and go straight to the fixup table.
+- *
+- * They have great resemblance to the preempt_disable/enable calls
+- * and in fact they are identical; this is because currently there is
+- * no other way to make the pagefault handlers do this. So we do
+- * disable preemption but we don't necessarily care about that.
++ * it will not take any MM locks and go straight to the fixup table.
+  */
+-static inline void pagefault_disable(void)
+-{
+-	inc_preempt_count();
+-	/*
+-	 * make sure to have issued the store before a pagefault
+-	 * can hit.
+-	 */
+-	barrier();
+-}
+-
+-static inline void pagefault_enable(void)
+-{
+-	/*
+-	 * make sure to issue those last loads/stores before enabling
+-	 * the pagefault handler again.
+-	 */
+-	barrier();
+-	dec_preempt_count();
+-	/*
+-	 * make sure we do..
+-	 */
+-	barrier();
+-	preempt_check_resched();
+-}
++extern void pagefault_disable(void);
++extern void pagefault_enable(void);
+ 
+ #ifndef ARCH_HAS_NOCACHE_UACCESS
+ 
+Index: linux-rt-2.6.31/include/linux/usb.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/usb.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/usb.h	2010-05-17 14:23:20.068386444 +0200
+@@ -529,9 +529,9 @@
+ extern void usb_put_dev(struct usb_device *dev);
+ 
+ /* USB device locking */
+-#define usb_lock_device(udev)		down(&(udev)->dev.sem)
+-#define usb_unlock_device(udev)		up(&(udev)->dev.sem)
+-#define usb_trylock_device(udev)	down_trylock(&(udev)->dev.sem)
++#define usb_lock_device(udev)		mutex_lock(&(udev)->dev.mutex)
++#define usb_unlock_device(udev)		mutex_unlock(&(udev)->dev.mutex)
++#define usb_trylock_device(udev)	mutex_trylock(&(udev)->dev.mutex)
+ extern int usb_lock_device_for_reset(struct usb_device *udev,
+ 				     const struct usb_interface *iface);
+ 
+Index: linux-rt-2.6.31/include/linux/vmstat.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/vmstat.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/vmstat.h	2010-05-17 14:23:20.068386444 +0200
+@@ -76,7 +76,12 @@
+ 
+ static inline void __count_vm_event(enum vm_event_item item)
+ {
++#ifdef CONFIG_PREEMPT_RT
++	get_cpu_var(vm_event_states).event[item]++;
++	put_cpu();
++#else
+ 	__get_cpu_var(vm_event_states).event[item]++;
++#endif
+ }
+ 
+ static inline void count_vm_event(enum vm_event_item item)
+@@ -87,7 +92,12 @@
+ 
+ static inline void __count_vm_events(enum vm_event_item item, long delta)
+ {
++#ifdef CONFIG_PREEMPT_RT
++	get_cpu_var(vm_event_states).event[item] += delta;
++	put_cpu();
++#else
+ 	__get_cpu_var(vm_event_states).event[item] += delta;
++#endif
+ }
+ 
+ static inline void count_vm_events(enum vm_event_item item, long delta)
+Index: linux-rt-2.6.31/include/linux/workqueue.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/linux/workqueue.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/linux/workqueue.h	2010-05-17 14:23:20.068386444 +0200
+@@ -195,6 +195,9 @@
+ #define create_freezeable_workqueue(name) __create_workqueue((name), 1, 1, 0)
+ #define create_singlethread_workqueue(name) __create_workqueue((name), 1, 0, 0)
+ 
++extern void set_workqueue_prio(struct workqueue_struct *wq, int policy,
++			       int rt_priority, int nice);
++
+ extern void destroy_workqueue(struct workqueue_struct *wq);
+ 
+ extern int queue_work(struct workqueue_struct *wq, struct work_struct *work);
+Index: linux-rt-2.6.31/include/net/bluetooth/hci_core.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/net/bluetooth/hci_core.h	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/include/net/bluetooth/hci_core.h	2010-05-17 14:23:20.068386444 +0200
+@@ -117,7 +117,7 @@
+ 	struct sk_buff		*sent_cmd;
+ 	struct sk_buff		*reassembly[3];
+ 
+-	struct semaphore	req_lock;
++	struct mutex		req_lock;
+ 	wait_queue_head_t	req_wait_q;
+ 	__u32			req_status;
+ 	__u32			req_result;
+@@ -704,8 +704,8 @@
+ #define HCI_REQ_PEND	  1
+ #define HCI_REQ_CANCELED  2
+ 
+-#define hci_req_lock(d)		down(&d->req_lock)
+-#define hci_req_unlock(d)	up(&d->req_lock)
++#define hci_req_lock(d)		mutex_lock(&d->req_lock)
++#define hci_req_unlock(d)	mutex_unlock(&d->req_lock)
+ 
+ void hci_req_complete(struct hci_dev *hdev, int result);
+ 
+Index: linux-rt-2.6.31/include/trace/define_trace.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/trace/define_trace.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/trace/define_trace.h	2010-05-17 14:23:20.068386444 +0200
+@@ -26,6 +26,11 @@
+ #define TRACE_EVENT(name, proto, args, tstruct, assign, print)	\
+ 	DEFINE_TRACE(name)
+ 
++#undef TRACE_EVENT_FN
++#define TRACE_EVENT_FN(name, proto, args, tstruct,		\
++		assign, print, reg, unreg)			\
++	DEFINE_TRACE_FN(name, reg, unreg)
++
+ #undef DECLARE_TRACE
+ #define DECLARE_TRACE(name, proto, args)	\
+ 	DEFINE_TRACE(name)
+@@ -56,6 +61,8 @@
+ #include <trace/ftrace.h>
+ #endif
+ 
++#undef TRACE_EVENT
++#undef TRACE_EVENT_FN
+ #undef TRACE_HEADER_MULTI_READ
+ 
+ /* Only undef what we defined in this file */
+Index: linux-rt-2.6.31/include/trace/events/block.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/trace/events/block.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/trace/events/block.h	2010-05-17 14:23:20.068386444 +0200
+@@ -171,6 +171,7 @@
+ 		  (unsigned long long)__entry->sector,
+ 		  __entry->nr_sector, __entry->errors)
+ );
++
+ TRACE_EVENT(block_bio_bounce,
+ 
+ 	TP_PROTO(struct request_queue *q, struct bio *bio),
+@@ -186,7 +187,8 @@
+ 	),
+ 
+ 	TP_fast_assign(
+-		__entry->dev		= bio->bi_bdev->bd_dev;
++		__entry->dev		= bio->bi_bdev ?
++					  bio->bi_bdev->bd_dev : 0;
+ 		__entry->sector		= bio->bi_sector;
+ 		__entry->nr_sector	= bio->bi_size >> 9;
+ 		blk_fill_rwbs(__entry->rwbs, bio->bi_rw, bio->bi_size);
+Index: linux-rt-2.6.31/include/trace/events/hist.h
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ linux-rt-2.6.31/include/trace/events/hist.h	2010-05-17 14:23:20.068386444 +0200
+@@ -0,0 +1,69 @@
++#undef TRACE_SYSTEM
++#define TRACE_SYSTEM hist
++
++#if !defined(_TRACE_HIST_H) || defined(TRACE_HEADER_MULTI_READ)
++#define _TRACE_HIST_H
++
++#include "latency_hist.h"
++#include <linux/tracepoint.h>
++
++#if !defined(CONFIG_PREEMPT_OFF_HIST) && !defined(CONFIG_INTERRUPT_OFF_HIST)
++#define trace_preemptirqsoff_hist(a,b)
++#else
++TRACE_EVENT(preemptirqsoff_hist,
++
++	TP_PROTO(int reason, int starthist),
++
++	TP_ARGS(reason, starthist),
++
++	TP_STRUCT__entry(
++		__field(int,	reason	)
++		__field(int,	starthist	)
++	),
++
++	TP_fast_assign(
++		__entry->reason		= reason;
++		__entry->starthist	= starthist;
++	),
++
++	TP_printk("reason=%s starthist=%s", getaction(__entry->reason),
++		  __entry->starthist ? "start" : "stop")
++);
++#endif
++
++#ifndef CONFIG_MISSED_TIMER_OFFSETS_HIST
++#define trace_hrtimer_interrupt(a,b,c,d)
++#else
++TRACE_EVENT(hrtimer_interrupt,
++
++	TP_PROTO(int cpu, long long offset, struct task_struct *curr, struct task_struct *task),
++
++	TP_ARGS(cpu, offset, curr, task),
++
++	TP_STRUCT__entry(
++		__field(int,		cpu	)
++		__field(long long,	offset	)
++		__array(char,		ccomm,	TASK_COMM_LEN)
++		__field(int,		cprio	)
++		__array(char,		tcomm,	TASK_COMM_LEN)
++		__field(int,		tprio	)
++	),
++
++	TP_fast_assign(
++		__entry->cpu	= cpu;
++		__entry->offset	= offset;
++		memcpy(__entry->ccomm, curr->comm, TASK_COMM_LEN);
++		__entry->cprio  = curr->prio;
++		memcpy(__entry->tcomm, task != NULL ? task->comm : "<none>", task != NULL ? TASK_COMM_LEN : 7);
++		__entry->tprio  = task != NULL ? task->prio : -1;
++	),
++
++	TP_printk("cpu=%d offset=%lld curr=%s[%d] thread=%s[%d]",
++		__entry->cpu, __entry->offset, __entry->ccomm, __entry->cprio, __entry->tcomm, __entry->tprio)
++);
++#endif
++
++#endif /* _TRACE_HIST_H */
++
++/* This part must be outside protection */
++#include <trace/define_trace.h>
+Index: linux-rt-2.6.31/include/trace/events/latency_hist.h
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ linux-rt-2.6.31/include/trace/events/latency_hist.h	2010-05-17 14:23:20.068386444 +0200
+@@ -0,0 +1,30 @@
++#ifndef _LATENCY_HIST_H
++#define _LATENCY_HIST_H
++
++enum hist_action {
++	IRQS_ON,
++	PREEMPT_ON,
++	TRACE_STOP,
++	IRQS_OFF,
++	PREEMPT_OFF,
++	TRACE_START,
++};
++
++static char *actions[] = {
++	"IRQS_ON",
++	"PREEMPT_ON",
++	"TRACE_STOP",
++	"IRQS_OFF",
++	"PREEMPT_OFF",
++	"TRACE_START",
++};
++
++static inline char *getaction(int action)
++{
++	if (action >= 0 && action <= sizeof(actions)/sizeof(actions[0]))
++		return(actions[action]);
++	return("unknown");
++}
++
++#endif /* _LATENCY_HIST_H */
++
+Index: linux-rt-2.6.31/include/trace/events/module.h
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ linux-rt-2.6.31/include/trace/events/module.h	2010-05-17 14:23:20.068386444 +0200
+@@ -0,0 +1,126 @@
++#undef TRACE_SYSTEM
++#define TRACE_SYSTEM module
++
++#if !defined(_TRACE_MODULE_H) || defined(TRACE_HEADER_MULTI_READ)
++#define _TRACE_MODULE_H
++
++#include <linux/tracepoint.h>
++
++#ifdef CONFIG_MODULES
++
++struct module;
++
++#define show_module_flags(flags) __print_flags(flags, "",	\
++	{ (1UL << TAINT_PROPRIETARY_MODULE),	"P" },		\
++	{ (1UL << TAINT_FORCED_MODULE),		"F" },		\
++	{ (1UL << TAINT_CRAP),			"C" })
++
++TRACE_EVENT(module_load,
++
++	TP_PROTO(struct module *mod),
++
++	TP_ARGS(mod),
++
++	TP_STRUCT__entry(
++		__field(	unsigned int,	taints		)
++		__string(	name,		mod->name	)
++	),
++
++	TP_fast_assign(
++		__entry->taints = mod->taints;
++		__assign_str(name, mod->name);
++	),
++
++	TP_printk("%s %s", __get_str(name), show_module_flags(__entry->taints))
++);
++
++TRACE_EVENT(module_free,
++
++	TP_PROTO(struct module *mod),
++
++	TP_ARGS(mod),
++
++	TP_STRUCT__entry(
++		__string(	name,		mod->name	)
++	),
++
++	TP_fast_assign(
++		__assign_str(name, mod->name);
++	),
++
++	TP_printk("%s", __get_str(name))
++);
++
++TRACE_EVENT(module_get,
++
++	TP_PROTO(struct module *mod, unsigned long ip, int refcnt),
++
++	TP_ARGS(mod, ip, refcnt),
++
++	TP_STRUCT__entry(
++		__field(	unsigned long,	ip		)
++		__field(	int,		refcnt		)
++		__string(	name,		mod->name	)
++	),
++
++	TP_fast_assign(
++		__entry->ip	= ip;
++		__entry->refcnt	= refcnt;
++		__assign_str(name, mod->name);
++	),
++
++	TP_printk("%s call_site=%pf refcnt=%d",
++		  __get_str(name), (void *)__entry->ip, __entry->refcnt)
++);
++
++TRACE_EVENT(module_put,
++
++	TP_PROTO(struct module *mod, unsigned long ip, int refcnt),
++
++	TP_ARGS(mod, ip, refcnt),
++
++	TP_STRUCT__entry(
++		__field(	unsigned long,	ip		)
++		__field(	int,		refcnt		)
++		__string(	name,		mod->name	)
++	),
++
++	TP_fast_assign(
++		__entry->ip	= ip;
++		__entry->refcnt	= refcnt;
++		__assign_str(name, mod->name);
++	),
++
++	TP_printk("%s call_site=%pf refcnt=%d",
++		  __get_str(name), (void *)__entry->ip, __entry->refcnt)
++);
++
++TRACE_EVENT(module_request,
++
++	TP_PROTO(char *name, bool wait, unsigned long ip),
++
++	TP_ARGS(name, wait, ip),
++
++	TP_STRUCT__entry(
++		__field(	bool,		wait		)
++		__field(	unsigned long,	ip		)
++		__string(	name,		name		)
++	),
++
++	TP_fast_assign(
++		__entry->wait	= wait;
++		__entry->ip	= ip;
++		__assign_str(name, name);
++	),
++
++	TP_printk("%s wait=%d call_site=%pf",
++		  __get_str(name), (int)__entry->wait, (void *)__entry->ip)
++);
++
++#endif /* CONFIG_MODULES */
++
++#endif /* _TRACE_MODULE_H */
++
++/* This part must be outside protection */
++#include <trace/define_trace.h>
++
+Index: linux-rt-2.6.31/include/trace/events/sched.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/trace/events/sched.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/trace/events/sched.h	2010-05-17 14:23:20.068386444 +0200
+@@ -94,6 +94,7 @@
+ 		__field(	pid_t,	pid			)
+ 		__field(	int,	prio			)
+ 		__field(	int,	success			)
++		__field(	int,	cpu			)
+ 	),
+ 
+ 	TP_fast_assign(
+@@ -101,11 +102,12 @@
+ 		__entry->pid		= p->pid;
+ 		__entry->prio		= p->prio;
+ 		__entry->success	= success;
++		__entry->cpu		= task_cpu(p);
+ 	),
+ 
+-	TP_printk("task %s:%d [%d] success=%d",
++	TP_printk("task %s:%d [%d] success=%d [%03d]",
+ 		  __entry->comm, __entry->pid, __entry->prio,
+-		  __entry->success)
++		  __entry->success, __entry->cpu)
+ );
+ 
+ /*
+@@ -125,6 +127,7 @@
+ 		__field(	pid_t,	pid			)
+ 		__field(	int,	prio			)
+ 		__field(	int,	success			)
++		__field(	int,	cpu			)
+ 	),
+ 
+ 	TP_fast_assign(
+@@ -132,11 +135,12 @@
+ 		__entry->pid		= p->pid;
+ 		__entry->prio		= p->prio;
+ 		__entry->success	= success;
++		__entry->cpu		= task_cpu(p);
+ 	),
+ 
+-	TP_printk("task %s:%d [%d] success=%d",
++	TP_printk("task %s:%d [%d] success=%d [%03d]",
+ 		  __entry->comm, __entry->pid, __entry->prio,
+-		  __entry->success)
++		  __entry->success, __entry->cpu)
+ );
+ 
+ /*
+@@ -176,9 +180,12 @@
+ 		__entry->prev_comm, __entry->prev_pid, __entry->prev_prio,
+ 		__entry->prev_state ?
+ 		  __print_flags(__entry->prev_state, "|",
+-				{ 1, "S"} , { 2, "D" }, { 4, "T" }, { 8, "t" },
+-				{ 16, "Z" }, { 32, "X" }, { 64, "x" },
+-				{ 128, "W" }) : "R",
++			{ 1, TASK_STATE_1} , { 2, TASK_STATE_2 },
++			{ 4, TASK_STATE_4 }, { 8, TASK_STATE_8 },
++			{ 16, TASK_STATE_16 }, { 32, TASK_STATE_32 },
++			{ 64, TASK_STATE_64 }, { 128, TASK_STATE_128 },
++			{ 256, TASK_STATE_256 }
++			) : TASK_STATE_0,
+ 		__entry->next_comm, __entry->next_pid, __entry->next_prio)
+ );
+ 
+@@ -263,6 +270,37 @@
+ );
+ 
+ /*
++ * Tracepoint for priority boosting/deboosting of a task:
++ *
++ * (NOTE: the 'rq' argument is not used by generic trace events,
++ *        but used by the latency tracer plugin. )
++ */
++TRACE_EVENT(sched_task_setprio,
++
++	TP_PROTO(struct rq *rq, struct task_struct *p, int oldprio),
++
++	TP_ARGS(rq, p, oldprio),
++
++	TP_STRUCT__entry(
++		__array(	char,	comm,	TASK_COMM_LEN	)
++		__field(	pid_t,	pid			)
++		__field(	int,	prio			)
++		__field(	int,	oldprio			)
++	),
++
++	TP_fast_assign(
++		memcpy(__entry->comm, p->comm, TASK_COMM_LEN);
++		__entry->pid		= p->pid;
++		__entry->prio		= p->prio;
++		__entry->oldprio	= oldprio;
++	),
++
++	TP_printk("task %s:%d [%d] oldprio=%d",
++		  __entry->comm, __entry->pid, __entry->prio,
++		  __entry->oldprio)
++);
++
++/*
+  * Tracepoint for a waiting task:
+  */
+ TRACE_EVENT(sched_process_wait,
+Index: linux-rt-2.6.31/include/trace/events/syscalls.h
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ linux-rt-2.6.31/include/trace/events/syscalls.h	2010-05-17 14:23:20.068386444 +0200
+@@ -0,0 +1,70 @@
++#undef TRACE_SYSTEM
++#define TRACE_SYSTEM syscalls
++
++#if !defined(_TRACE_EVENTS_SYSCALLS_H) || defined(TRACE_HEADER_MULTI_READ)
++#define _TRACE_EVENTS_SYSCALLS_H
++
++#include <linux/tracepoint.h>
++
++#include <asm/ptrace.h>
++#include <asm/syscall.h>
++
++
++#ifdef CONFIG_HAVE_SYSCALL_TRACEPOINTS
++
++extern void syscall_regfunc(void);
++extern void syscall_unregfunc(void);
++
++TRACE_EVENT_FN(sys_enter,
++
++	TP_PROTO(struct pt_regs *regs, long id),
++
++	TP_ARGS(regs, id),
++
++	TP_STRUCT__entry(
++		__field(	long,		id		)
++		__array(	unsigned long,	args,	6	)
++	),
++
++	TP_fast_assign(
++		__entry->id	= id;
++		syscall_get_arguments(current, regs, 0, 6, __entry->args);
++	),
++
++	TP_printk("NR %ld (%lx, %lx, %lx, %lx, %lx, %lx)",
++		  __entry->id,
++		  __entry->args[0], __entry->args[1], __entry->args[2],
++		  __entry->args[3], __entry->args[4], __entry->args[5]),
++
++	syscall_regfunc, syscall_unregfunc
++);
++
++TRACE_EVENT_FN(sys_exit,
++
++	TP_PROTO(struct pt_regs *regs, long ret),
++
++	TP_ARGS(regs, ret),
++
++	TP_STRUCT__entry(
++		__field(	long,	id	)
++		__field(	long,	ret	)
++	),
++
++	TP_fast_assign(
++		__entry->id	= syscall_get_nr(current, regs);
++		__entry->ret	= ret;
++	),
++
++	TP_printk("NR %ld = %ld",
++		  __entry->id, __entry->ret),
++
++	syscall_regfunc, syscall_unregfunc
++);
++
++#endif /* CONFIG_HAVE_SYSCALL_TRACEPOINTS */
++
++#endif /* _TRACE_EVENTS_SYSCALLS_H */
++
++/* This part must be outside protection */
++#include <trace/define_trace.h>
++
+Index: linux-rt-2.6.31/include/trace/ftrace.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/trace/ftrace.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/trace/ftrace.h	2010-05-17 14:23:20.068386444 +0200
+@@ -21,11 +21,14 @@
+ #undef __field
+ #define __field(type, item)		type	item;
+ 
++#undef __field_ext
++#define __field_ext(type, item, filter_type)	type	item;
++
+ #undef __array
+ #define __array(type, item, len)	type	item[len];
+ 
+ #undef __dynamic_array
+-#define __dynamic_array(type, item, len) unsigned short __data_loc_##item;
++#define __dynamic_array(type, item, len) u32 __data_loc_##item;
+ 
+ #undef __string
+ #define __string(item, src) __dynamic_array(char, item, -1)
+@@ -42,6 +45,16 @@
+ 	};							\
+ 	static struct ftrace_event_call event_##name
+ 
++#undef __cpparg
++#define __cpparg(arg...) arg
++
++/* Callbacks are meaningless to ftrace. */
++#undef TRACE_EVENT_FN
++#define TRACE_EVENT_FN(name, proto, args, tstruct,			\
++		assign, print, reg, unreg)				\
++	TRACE_EVENT(name, __cpparg(proto), __cpparg(args),		\
++		__cpparg(tstruct), __cpparg(assign), __cpparg(print))	\
++
+ #include TRACE_INCLUDE(TRACE_INCLUDE_FILE)
+ 
+ 
+@@ -51,23 +64,27 @@
+  * Include the following:
+  *
+  * struct ftrace_data_offsets_<call> {
+- *	int				<item1>;
+- *	int				<item2>;
++ *	u32				<item1>;
++ *	u32				<item2>;
+  *	[...]
+  * };
+  *
+- * The __dynamic_array() macro will create each int <item>, this is
++ * The __dynamic_array() macro will create each u32 <item>, this is
+  * to keep the offset of each array from the beginning of the event.
++ * The size of an array is also encoded, in the higher 16 bits of <item>.
+  */
+ 
+ #undef __field
+-#define __field(type, item);
++#define __field(type, item)
++
++#undef __field_ext
++#define __field_ext(type, item, filter_type)
+ 
+ #undef __array
+ #define __array(type, item, len)
+ 
+ #undef __dynamic_array
+-#define __dynamic_array(type, item, len)	int item;
++#define __dynamic_array(type, item, len)	u32 item;
+ 
+ #undef __string
+ #define __string(item, src) __dynamic_array(char, item, -1)
+@@ -109,6 +126,9 @@
+ 	if (!ret)							\
+ 		return 0;
+ 
++#undef __field_ext
++#define __field_ext(type, item, filter_type)	__field(type, item)
++
+ #undef __array
+ #define __array(type, item, len)						\
+ 	ret = trace_seq_printf(s, "\tfield:" #type " " #item "[" #len "];\t"	\
+@@ -120,7 +140,7 @@
+ 
+ #undef __dynamic_array
+ #define __dynamic_array(type, item, len)				       \
+-	ret = trace_seq_printf(s, "\tfield:__data_loc " #item ";\t"	       \
++	ret = trace_seq_printf(s, "\tfield:__data_loc " #type "[] " #item ";\t"\
+ 			       "offset:%u;\tsize:%u;\n",		       \
+ 			       (unsigned int)offsetof(typeof(field),	       \
+ 					__data_loc_##item),		       \
+@@ -150,7 +170,8 @@
+ #undef TRACE_EVENT
+ #define TRACE_EVENT(call, proto, args, tstruct, func, print)		\
+ static int								\
+-ftrace_format_##call(struct trace_seq *s)				\
++ftrace_format_##call(struct ftrace_event_call *unused,			\
++		      struct trace_seq *s)				\
+ {									\
+ 	struct ftrace_raw_##call field __attribute__((unused));		\
+ 	int ret = 0;							\
+@@ -210,7 +231,7 @@
+ 
+ #undef __get_dynamic_array
+ #define __get_dynamic_array(field)	\
+-		((void *)__entry + __entry->__data_loc_##field)
++		((void *)__entry + (__entry->__data_loc_##field & 0xffff))
+ 
+ #undef __get_str
+ #define __get_str(field) (char *)__get_dynamic_array(field)
+@@ -218,9 +239,9 @@
+ #undef __print_flags
+ #define __print_flags(flag, delim, flag_array...)			\
+ 	({								\
+-		static const struct trace_print_flags flags[] =		\
++		static const struct trace_print_flags __flags[] =	\
+ 			{ flag_array, { -1, NULL }};			\
+-		ftrace_print_flags_seq(p, delim, flag, flags);		\
++		ftrace_print_flags_seq(p, delim, flag, __flags);	\
+ 	})
+ 
+ #undef __print_symbolic
+@@ -233,7 +254,7 @@
+ 
+ #undef TRACE_EVENT
+ #define TRACE_EVENT(call, proto, args, tstruct, assign, print)		\
+-enum print_line_t							\
++static enum print_line_t						\
+ ftrace_raw_output_##call(struct trace_iterator *iter, int flags)	\
+ {									\
+ 	struct trace_seq *s = &iter->seq;				\
+@@ -263,46 +284,48 @@
+ 	
+ #include TRACE_INCLUDE(TRACE_INCLUDE_FILE)
+ 
+-#undef __field
+-#define __field(type, item)						\
++#undef __field_ext
++#define __field_ext(type, item, filter_type)				\
+ 	ret = trace_define_field(event_call, #type, #item,		\
+ 				 offsetof(typeof(field), item),		\
+-				 sizeof(field.item), is_signed_type(type));	\
++				 sizeof(field.item),			\
++				 is_signed_type(type), filter_type);	\
+ 	if (ret)							\
+ 		return ret;
+ 
++#undef __field
++#define __field(type, item)	__field_ext(type, item, FILTER_OTHER)
++
+ #undef __array
+ #define __array(type, item, len)					\
+ 	BUILD_BUG_ON(len > MAX_FILTER_STR_VAL);				\
+ 	ret = trace_define_field(event_call, #type "[" #len "]", #item,	\
+ 				 offsetof(typeof(field), item),		\
+-				 sizeof(field.item), 0);		\
++				 sizeof(field.item), 0, FILTER_OTHER);	\
+ 	if (ret)							\
+ 		return ret;
+ 
+ #undef __dynamic_array
+ #define __dynamic_array(type, item, len)				       \
+-	ret = trace_define_field(event_call, "__data_loc" "[" #type "]", #item,\
+-				offsetof(typeof(field), __data_loc_##item),    \
+-				 sizeof(field.__data_loc_##item), 0);
++	ret = trace_define_field(event_call, "__data_loc " #type "[]", #item,  \
++				 offsetof(typeof(field), __data_loc_##item),   \
++				 sizeof(field.__data_loc_##item), 0,	       \
++				 FILTER_OTHER);
+ 
+ #undef __string
+ #define __string(item, src) __dynamic_array(char, item, -1)
+ 
+ #undef TRACE_EVENT
+ #define TRACE_EVENT(call, proto, args, tstruct, func, print)		\
+-int									\
+-ftrace_define_fields_##call(void)					\
++static int								\
++ftrace_define_fields_##call(struct ftrace_event_call *event_call)	\
+ {									\
+ 	struct ftrace_raw_##call field;					\
+-	struct ftrace_event_call *event_call = &event_##call;		\
+ 	int ret;							\
+ 									\
+-	__common_field(int, type, 1);					\
+-	__common_field(unsigned char, flags, 0);			\
+-	__common_field(unsigned char, preempt_count, 0);		\
+-	__common_field(int, pid, 1);					\
+-	__common_field(int, tgid, 1);					\
++	ret = trace_define_common_fields(event_call);			\
++	if (ret)							\
++		return ret;						\
+ 									\
+ 	tstruct;							\
+ 									\
+@@ -321,6 +344,9 @@
+ #undef __field
+ #define __field(type, item)
+ 
++#undef __field_ext
++#define __field_ext(type, item, filter_type)
++
+ #undef __array
+ #define __array(type, item, len)
+ 
+@@ -328,6 +354,7 @@
+ #define __dynamic_array(type, item, len)				\
+ 	__data_offsets->item = __data_size +				\
+ 			       offsetof(typeof(*entry), __data);	\
++	__data_offsets->item |= (len * sizeof(type)) << 16;		\
+ 	__data_size += (len) * sizeof(type);
+ 
+ #undef __string
+@@ -433,13 +460,15 @@
+  * {
+  *	struct ring_buffer_event *event;
+  *	struct ftrace_raw_<call> *entry; <-- defined in stage 1
++ *	struct ring_buffer *buffer;
+  *	unsigned long irq_flags;
+  *	int pc;
+  *
+  *	local_save_flags(irq_flags);
+  *	pc = preempt_count();
+  *
+- *	event = trace_current_buffer_lock_reserve(event_<call>.id,
++ *	event = trace_current_buffer_lock_reserve(&buffer,
++ *				  event_<call>.id,
+  *				  sizeof(struct ftrace_raw_<call>),
+  *				  irq_flags, pc);
+  *	if (!event)
+@@ -449,7 +478,7 @@
+  *	<assign>;  <-- Here we assign the entries by the __field and
+  *			__array macros.
+  *
+- *	trace_current_buffer_unlock_commit(event, irq_flags, pc);
++ *	trace_current_buffer_unlock_commit(buffer, event, irq_flags, pc);
+  * }
+  *
+  * static int ftrace_raw_reg_event_<call>(void)
+@@ -541,6 +570,7 @@
+ 	struct ftrace_event_call *event_call = &event_##call;		\
+ 	struct ring_buffer_event *event;				\
+ 	struct ftrace_raw_##call *entry;				\
++	struct ring_buffer *buffer;					\
+ 	unsigned long irq_flags;					\
+ 	int __data_size;						\
+ 	int pc;								\
+@@ -550,7 +580,8 @@
+ 									\
+ 	__data_size = ftrace_get_offsets_##call(&__data_offsets, args); \
+ 									\
+-	event = trace_current_buffer_lock_reserve(event_##call.id,	\
++	event = trace_current_buffer_lock_reserve(&buffer,		\
++				 event_##call.id,			\
+ 				 sizeof(*entry) + __data_size,		\
+ 				 irq_flags, pc);			\
+ 	if (!event)							\
+@@ -562,11 +593,12 @@
+ 									\
+ 	{ assign; }							\
+ 									\
+-	if (!filter_current_check_discard(event_call, entry, event))	\
+-		trace_nowake_buffer_unlock_commit(event, irq_flags, pc); \
++	if (!filter_current_check_discard(buffer, event_call, entry, event)) \
++		trace_nowake_buffer_unlock_commit(buffer,		\
++						  event, irq_flags, pc); \
+ }									\
+ 									\
+-static int ftrace_raw_reg_event_##call(void)				\
++static int ftrace_raw_reg_event_##call(void *ptr)			\
+ {									\
+ 	int ret;							\
+ 									\
+@@ -577,7 +609,7 @@
+ 	return ret;							\
+ }									\
+ 									\
+-static void ftrace_raw_unreg_event_##call(void)				\
++static void ftrace_raw_unreg_event_##call(void *ptr)			\
+ {									\
+ 	unregister_trace_##call(ftrace_raw_event_##call);		\
+ }									\
+@@ -595,7 +627,6 @@
+ 		return -ENODEV;						\
+ 	event_##call.id = id;						\
+ 	INIT_LIST_HEAD(&event_##call.fields);				\
+-	init_preds(&event_##call);					\
+ 	return 0;							\
+ }									\
+ 									\
+Index: linux-rt-2.6.31/include/trace/syscall.h
+===================================================================
+--- linux-rt-2.6.31.orig/include/trace/syscall.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/include/trace/syscall.h	2010-05-17 14:23:20.068386444 +0200
+@@ -1,8 +1,13 @@
+ #ifndef _TRACE_SYSCALL_H
+ #define _TRACE_SYSCALL_H
+ 
++#include <linux/tracepoint.h>
++#include <linux/unistd.h>
++#include <linux/ftrace_event.h>
++
+ #include <asm/ptrace.h>
+ 
++
+ /*
+  * A syscall entry in the ftrace syscalls array.
+  *
+@@ -10,26 +15,49 @@
+  * @nb_args: number of parameters it takes
+  * @types: list of types as strings
+  * @args: list of args as strings (args[i] matches types[i])
++ * @enter_id: associated ftrace enter event id
++ * @exit_id: associated ftrace exit event id
++ * @enter_event: associated syscall_enter trace event
++ * @exit_event: associated syscall_exit trace event
+  */
+ struct syscall_metadata {
+ 	const char	*name;
+ 	int		nb_args;
+ 	const char	**types;
+ 	const char	**args;
++	int		enter_id;
++	int		exit_id;
++
++	struct ftrace_event_call *enter_event;
++	struct ftrace_event_call *exit_event;
+ };
+ 
+ #ifdef CONFIG_FTRACE_SYSCALLS
+-extern void arch_init_ftrace_syscalls(void);
+ extern struct syscall_metadata *syscall_nr_to_meta(int nr);
+-extern void start_ftrace_syscalls(void);
+-extern void stop_ftrace_syscalls(void);
+-extern void ftrace_syscall_enter(struct pt_regs *regs);
+-extern void ftrace_syscall_exit(struct pt_regs *regs);
+-#else
+-static inline void start_ftrace_syscalls(void)			{ }
+-static inline void stop_ftrace_syscalls(void)			{ }
+-static inline void ftrace_syscall_enter(struct pt_regs *regs)	{ }
+-static inline void ftrace_syscall_exit(struct pt_regs *regs)	{ }
++extern int syscall_name_to_nr(char *name);
++void set_syscall_enter_id(int num, int id);
++void set_syscall_exit_id(int num, int id);
++extern struct trace_event event_syscall_enter;
++extern struct trace_event event_syscall_exit;
++extern int reg_event_syscall_enter(void *ptr);
++extern void unreg_event_syscall_enter(void *ptr);
++extern int reg_event_syscall_exit(void *ptr);
++extern void unreg_event_syscall_exit(void *ptr);
++extern int syscall_enter_format(struct ftrace_event_call *call,
++				struct trace_seq *s);
++extern int syscall_exit_format(struct ftrace_event_call *call,
++				struct trace_seq *s);
++extern int syscall_enter_define_fields(struct ftrace_event_call *call);
++extern int syscall_exit_define_fields(struct ftrace_event_call *call);
++enum print_line_t print_syscall_enter(struct trace_iterator *iter, int flags);
++enum print_line_t print_syscall_exit(struct trace_iterator *iter, int flags);
++#endif
++#ifdef CONFIG_EVENT_PROFILE
++int reg_prof_syscall_enter(char *name);
++void unreg_prof_syscall_enter(char *name);
++int reg_prof_syscall_exit(char *name);
++void unreg_prof_syscall_exit(char *name);
++
+ #endif
+ 
+ #endif /* _TRACE_SYSCALL_H */
+Index: linux-rt-2.6.31/init/Kconfig
+===================================================================
+--- linux-rt-2.6.31.orig/init/Kconfig	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/init/Kconfig	2010-05-17 14:23:20.068386444 +0200
+@@ -327,6 +327,7 @@
+ 
+ config CLASSIC_RCU
+ 	bool "Classic RCU"
++	depends on !PREEMPT_RT
+ 	help
+ 	  This option selects the classic RCU implementation that is
+ 	  designed for best read-side performance on non-realtime
+@@ -336,6 +337,7 @@
+ 
+ config TREE_RCU
+ 	bool "Tree-based hierarchical RCU"
++	depends on !PREEMPT_RT
+ 	help
+ 	  This option selects the RCU implementation that is
+ 	  designed for very large SMP system with hundreds or
+@@ -1048,6 +1050,7 @@
+ 
+ config SLUB
+ 	bool "SLUB (Unqueued Allocator)"
++	depends on !PREEMPT_RT
+ 	help
+ 	   SLUB is a slab allocator that minimizes cache line usage
+ 	   instead of managing queues of cached objects (SLAB approach).
+@@ -1081,6 +1084,7 @@
+ 
+ config MARKERS
+ 	bool "Activate markers"
++	depends on !PREEMPT_RT
+ 	select TRACEPOINTS
+ 	help
+ 	  Place an empty function call at each marker site. Can be
+Index: linux-rt-2.6.31/init/Makefile
+===================================================================
+--- linux-rt-2.6.31.orig/init/Makefile	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/init/Makefile	2010-05-17 14:23:20.068386444 +0200
+@@ -33,4 +33,5 @@
+ include/linux/compile.h: FORCE
+ 	@$($(quiet)chk_compile.h)
+ 	$(Q)$(CONFIG_SHELL) $(srctree)/scripts/mkcompile_h $@ \
+-	"$(UTS_MACHINE)" "$(CONFIG_SMP)" "$(CONFIG_PREEMPT)" "$(CC) $(KBUILD_CFLAGS)"
++	"$(UTS_MACHINE)" "$(CONFIG_SMP)" "$(CONFIG_PREEMPT)" "$(CONFIG_PREEMPT_RT)" \
++	"$(CC) $(KBUILD_CFLAGS)"
+Index: linux-rt-2.6.31/init/main.c
+===================================================================
+--- linux-rt-2.6.31.orig/init/main.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/init/main.c	2010-05-17 14:23:20.078410414 +0200
+@@ -37,6 +37,7 @@
+ #include <linux/workqueue.h>
+ #include <linux/profile.h>
+ #include <linux/rcupdate.h>
++#include <linux/posix-timers.h>
+ #include <linux/moduleparam.h>
+ #include <linux/kallsyms.h>
+ #include <linux/writeback.h>
+@@ -446,6 +447,8 @@
+ {
+ 	int pid;
+ 
++	system_state = SYSTEM_BOOTING_SCHEDULER_OK;
++
+ 	kernel_thread(kernel_init, NULL, CLONE_FS | CLONE_SIGHAND);
+ 	numa_default_policy();
+ 	pid = kernel_thread(kthreadd, NULL, CLONE_FS | CLONE_FILES);
+@@ -458,8 +461,7 @@
+ 	 */
+ 	init_idle_bootup_task(current);
+ 	rcu_scheduler_starting();
+-	preempt_enable_no_resched();
+-	schedule();
++	preempt_enable_and_schedule();
+ 	preempt_disable();
+ 
+ 	/* Call into cpu_idle with preempt disabled */
+@@ -710,6 +712,9 @@
+ 
+ 	ftrace_init();
+ 
++#ifdef CONFIG_PREEMPT_RT
++	WARN_ON(irqs_disabled());
++#endif
+ 	/* Do the rest non-__init'ed, we're now alive */
+ 	rest_init();
+ }
+@@ -813,9 +818,11 @@
+ static void __init do_pre_smp_initcalls(void)
+ {
+ 	initcall_t *call;
++	extern int spawn_desched_task(void);
+ 
+ 	for (call = __initcall_start; call < __early_initcall_end; call++)
+ 		do_one_initcall(*call);
++	spawn_desched_task();
+ }
+ 
+ static void run_init_process(char *init_filename)
+@@ -851,6 +858,9 @@
+ 		printk(KERN_WARNING "Failed to execute %s\n",
+ 				ramdisk_execute_command);
+ 	}
++#ifdef CONFIG_PREEMPT_RT
++	WARN_ON(irqs_disabled());
++#endif
+ 
+ 	/*
+ 	 * We try each of these until one succeeds.
+@@ -917,7 +927,71 @@
+ 		ramdisk_execute_command = NULL;
+ 		prepare_namespace();
+ 	}
++#ifdef CONFIG_PREEMPT_RT
++	WARN_ON(irqs_disabled());
++#endif
+ 
++#define DEBUG_COUNT (defined(CONFIG_DEBUG_RT_MUTEXES) + \
++	defined(CONFIG_IRQSOFF_TRACER) + defined(CONFIG_PREEMPT_TRACER) + \
++	defined(CONFIG_STACK_TRACER) + defined(CONFIG_INTERRUPT_OFF_HIST) + \
++	defined(CONFIG_PREEMPT_OFF_HIST) + \
++	defined(CONFIG_WAKEUP_LATENCY_HIST) + \
++	defined(CONFIG_MISSED_TIMER_OFFSETS_HIST) + \
++	defined(CONFIG_DEBUG_SLAB) + defined(CONFIG_DEBUG_PAGEALLOC) + \
++	defined(CONFIG_LOCKDEP) + \
++	(defined(CONFIG_FTRACE) - defined(CONFIG_FTRACE_MCOUNT_RECORD)))
++
++#if DEBUG_COUNT > 0
++	printk(KERN_ERR "*****************************************************************************\n");
++	printk(KERN_ERR "*                                                                           *\n");
++#if DEBUG_COUNT == 1
++	printk(KERN_ERR "*  REMINDER, the following debugging option is turned on in your .config:   *\n");
++#else
++	printk(KERN_ERR "*  REMINDER, the following debugging options are turned on in your .config: *\n");
++#endif
++	printk(KERN_ERR "*                                                                           *\n");
++#ifdef CONFIG_DEBUG_RT_MUTEXES
++	printk(KERN_ERR "*        CONFIG_DEBUG_RT_MUTEXES                                            *\n");
++#endif
++#ifdef CONFIG_IRQSOFF_TRACER
++	printk(KERN_ERR "*        CONFIG_IRQSOFF_TRACER                                              *\n");
++#endif
++#ifdef CONFIG_PREEMPT_TRACER
++	printk(KERN_ERR "*        CONFIG_PREEMPT_TRACER                                              *\n");
++#endif
++#if defined(CONFIG_FTRACE) && !defined(CONFIG_FTRACE_MCOUNT_RECORD)
++	printk(KERN_ERR "*        CONFIG_FTRACE                                                      *\n");
++#endif
++#ifdef CONFIG_INTERRUPT_OFF_HIST
++	printk(KERN_ERR "*        CONFIG_INTERRUPT_OFF_HIST                                          *\n");
++#endif
++#ifdef CONFIG_PREEMPT_OFF_HIST
++	printk(KERN_ERR "*        CONFIG_PREEMPT_OFF_HIST                                            *\n");
++#endif
++#ifdef CONFIG_WAKEUP_LATENCY_HIST
++	printk(KERN_ERR "*        CONFIG_WAKEUP_LATENCY_HIST                                         *\n");
++#endif
++#ifdef CONFIG_MISSED_TIMER_OFFSETS_HIST
++	printk(KERN_ERR "*        CONFIG_MISSED_TIMER_OFFSETS_HIST                                   *\n");
++#endif
++#ifdef CONFIG_DEBUG_SLAB
++	printk(KERN_ERR "*        CONFIG_DEBUG_SLAB                                                  *\n");
++#endif
++#ifdef CONFIG_DEBUG_PAGEALLOC
++	printk(KERN_ERR "*        CONFIG_DEBUG_PAGEALLOC                                             *\n");
++#endif
++#ifdef CONFIG_LOCKDEP
++	printk(KERN_ERR "*        CONFIG_LOCKDEP                                                     *\n");
++#endif
++	printk(KERN_ERR "*                                                                           *\n");
++#if DEBUG_COUNT == 1
++	printk(KERN_ERR "*  it may increase runtime overhead and latencies.                          *\n");
++#else
++	printk(KERN_ERR "*  they may increase runtime overhead and latencies.                        *\n");
++#endif
++	printk(KERN_ERR "*                                                                           *\n");
++	printk(KERN_ERR "*****************************************************************************\n");
++#endif
+ 	/*
+ 	 * Ok, we have completed the initial bootup, and
+ 	 * we're essentially up and running. Get rid of the
+Index: linux-rt-2.6.31/ipc/mqueue.c
+===================================================================
+--- linux-rt-2.6.31.orig/ipc/mqueue.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/ipc/mqueue.c	2010-05-17 14:23:20.078410414 +0200
+@@ -820,12 +820,17 @@
+ 				  struct msg_msg *message,
+ 				  struct ext_wait_queue *receiver)
+ {
++	/*
++	 * Keep them in one critical section for PREEMPT_RT:
++	 */
++	preempt_disable_rt();
+ 	receiver->msg = message;
+ 	list_del(&receiver->list);
+ 	receiver->state = STATE_PENDING;
+ 	wake_up_process(receiver->task);
+ 	smp_wmb();
+ 	receiver->state = STATE_READY;
++	preempt_enable_rt();
+ }
+ 
+ /* pipelined_receive() - if there is task waiting in sys_mq_timedsend()
+Index: linux-rt-2.6.31/ipc/msg.c
+===================================================================
+--- linux-rt-2.6.31.orig/ipc/msg.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/ipc/msg.c	2010-05-17 14:23:20.078410414 +0200
+@@ -259,12 +259,20 @@
+ 	while (tmp != &msq->q_receivers) {
+ 		struct msg_receiver *msr;
+ 
++		/*
++		 * Make sure that the wakeup doesnt preempt
++		 * this CPU prematurely. (on PREEMPT_RT)
++		 */
++		preempt_disable_rt();
++
+ 		msr = list_entry(tmp, struct msg_receiver, r_list);
+ 		tmp = tmp->next;
+ 		msr->r_msg = NULL;
+ 		wake_up_process(msr->r_tsk);
+ 		smp_mb();
+ 		msr->r_msg = ERR_PTR(res);
++
++		preempt_enable_rt();
+ 	}
+ }
+ 
+@@ -611,6 +619,12 @@
+ 		    !security_msg_queue_msgrcv(msq, msg, msr->r_tsk,
+ 					       msr->r_msgtype, msr->r_mode)) {
+ 
++			/*
++			 * Make sure that the wakeup doesnt preempt
++			 * this CPU prematurely. (on PREEMPT_RT)
++			 */
++			preempt_disable_rt();
++
+ 			list_del(&msr->r_list);
+ 			if (msr->r_maxsize < msg->m_ts) {
+ 				msr->r_msg = NULL;
+@@ -624,9 +638,11 @@
+ 				wake_up_process(msr->r_tsk);
+ 				smp_mb();
+ 				msr->r_msg = msg;
++				preempt_enable_rt();
+ 
+ 				return 1;
+ 			}
++			preempt_enable_rt();
+ 		}
+ 	}
+ 	return 0;
+Index: linux-rt-2.6.31/ipc/sem.c
+===================================================================
+--- linux-rt-2.6.31.orig/ipc/sem.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/ipc/sem.c	2010-05-17 14:23:20.078410414 +0200
+@@ -415,6 +415,11 @@
+ 			struct sem_queue *n;
+ 
+ 			/*
++			 * make sure that the wakeup doesnt preempt
++			 * _this_ cpu prematurely. (on preempt_rt)
++			 */
++			preempt_disable_rt();
++			/*
+ 			 * Continue scanning. The next operation
+ 			 * that must be checked depends on the type of the
+ 			 * completed operation:
+@@ -450,6 +455,7 @@
+ 			 */
+ 			smp_wmb();
+ 			q->status = error;
++			preempt_enable_rt();
+ 			q = n;
+ 		} else {
+ 			q = list_entry(q->list.next, struct sem_queue, list);
+Index: linux-rt-2.6.31/kernel/Kconfig.preempt
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/Kconfig.preempt	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/Kconfig.preempt	2010-05-17 14:23:20.078410414 +0200
+@@ -1,14 +1,13 @@
+-
+ choice
+-	prompt "Preemption Model"
+-	default PREEMPT_NONE
++	prompt "Preemption Mode"
++	default PREEMPT_RT
+ 
+ config PREEMPT_NONE
+ 	bool "No Forced Preemption (Server)"
+ 	help
+-	  This is the traditional Linux preemption model, geared towards
++	  This is the traditional Linux preemption model geared towards
+ 	  throughput. It will still provide good latencies most of the
+-	  time, but there are no guarantees and occasional longer delays
++	  time but there are no guarantees and occasional long delays
+ 	  are possible.
+ 
+ 	  Select this option if you are building a kernel for a server or
+@@ -21,7 +20,7 @@
+ 	help
+ 	  This option reduces the latency of the kernel by adding more
+ 	  "explicit preemption points" to the kernel code. These new
+-	  preemption points have been selected to reduce the maximum
++	  preemption points have been selected to minimize the maximum
+ 	  latency of rescheduling, providing faster application reactions,
+ 	  at the cost of slightly lower throughput.
+ 
+@@ -33,22 +32,91 @@
+ 
+ 	  Select this if you are building a kernel for a desktop system.
+ 
+-config PREEMPT
++config PREEMPT_DESKTOP
+ 	bool "Preemptible Kernel (Low-Latency Desktop)"
+ 	help
+ 	  This option reduces the latency of the kernel by making
+-	  all kernel code (that is not executing in a critical section)
++	  all kernel code that is not executing in a critical section
+ 	  preemptible.  This allows reaction to interactive events by
+ 	  permitting a low priority process to be preempted involuntarily
+ 	  even if it is in kernel mode executing a system call and would
+-	  otherwise not be about to reach a natural preemption point.
+-	  This allows applications to run more 'smoothly' even when the
+-	  system is under load, at the cost of slightly lower throughput
+-	  and a slight runtime overhead to kernel code.
++	  otherwise not about to reach a preemption point.  This allows
++	  applications to run more 'smoothly' even when the system is
++	  under load, at the cost of slighly lower throughput and a
++	  slight runtime overhead to kernel code.
++
++	  (According to profiles, when this mode is selected then even
++	  during kernel-intense workloads the system is in an immediately
++	  preemptible state more than 50% of the time.)
+ 
+ 	  Select this if you are building a kernel for a desktop or
+ 	  embedded system with latency requirements in the milliseconds
+ 	  range.
+ 
++config PREEMPT_RT
++	bool "Complete Preemption (Real-Time)"
++	select PREEMPT_SOFTIRQS
++	select PREEMPT_HARDIRQS
++	select PREEMPT_RCU
++	select RT_MUTEXES
++	help
++	  This option further reduces the scheduling latency of the
++	  kernel by replacing almost every spinlock used by the kernel
++	  with preemptible mutexes and thus making all but the most
++	  critical kernel code involuntarily preemptible. The remaining
++	  handful of lowlevel non-preemptible codepaths are short and
++	  have a deterministic latency of a couple of tens of
++	  microseconds (depending on the hardware).  This also allows
++	  applications to run more 'smoothly' even when the system is
++	  under load, at the cost of lower throughput and runtime
++	  overhead to kernel code.
++
++	  (According to profiles, when this mode is selected then even
++	  during kernel-intense workloads the system is in an immediately
++	  preemptible state more than 95% of the time.)
++
++	  Select this if you are building a kernel for a desktop,
++	  embedded or real-time system with guaranteed latency
++	  requirements of 100 usecs or lower.
++
+ endchoice
+ 
++config PREEMPT
++	bool
++	default y
++	depends on PREEMPT_DESKTOP || PREEMPT_RT
++
++config PREEMPT_SOFTIRQS
++	bool "Thread Softirqs"
++	default n
++#	depends on PREEMPT
++	help
++	  This option reduces the latency of the kernel by 'threading'
++          soft interrupts. This means that all softirqs will execute
++          in softirqd's context. While this helps latency, it can also
++          reduce performance.
++
++          The threading of softirqs can also be controlled via
++          /proc/sys/kernel/softirq_preemption runtime flag and the
++          sofirq-preempt=0/1 boot-time option.
++
++	  Say N if you are unsure.
++
++config PREEMPT_HARDIRQS
++	bool "Thread Hardirqs"
++	default n
++	depends on GENERIC_HARDIRQS_NO__DO_IRQ
++	select PREEMPT_SOFTIRQS
++	help
++	  This option reduces the latency of the kernel by 'threading'
++          hardirqs. This means that all (or selected) hardirqs will run
++          in their own kernel thread context. While this helps latency,
++          this feature can also reduce performance.
++
++          The threading of hardirqs can also be controlled via the
++          /proc/sys/kernel/hardirq_preemption runtime flag and the
++          hardirq-preempt=0/1 boot-time option. Per-irq threading can
++          be enabled/disable via the /proc/irq/<IRQ>/<handler>/threaded
++          runtime flags.
++
++	  Say N if you are unsure.
+Index: linux-rt-2.6.31/kernel/Makefile
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/Makefile	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/Makefile	2010-05-17 14:23:20.078410414 +0200
+@@ -7,7 +7,7 @@
+ 	    sysctl.o capability.o ptrace.o timer.o user.o \
+ 	    signal.o sys.o kmod.o workqueue.o pid.o \
+ 	    rcupdate.o extable.o params.o posix-timers.o \
+-	    kthread.o wait.o kfifo.o sys_ni.o posix-cpu-timers.o mutex.o \
++	    kthread.o wait.o kfifo.o sys_ni.o posix-cpu-timers.o \
+ 	    hrtimer.o rwsem.o nsproxy.o srcu.o semaphore.o \
+ 	    notifier.o ksysfs.o pm_qos_params.o sched_clock.o cred.o \
+ 	    async.o
+@@ -28,7 +28,10 @@
+ obj-$(CONFIG_SYSCTL_SYSCALL_CHECK) += sysctl_check.o
+ obj-$(CONFIG_STACKTRACE) += stacktrace.o
+ obj-y += time/
++ifneq ($(CONFIG_PREEMPT_RT),y)
++obj-y += mutex.o
+ obj-$(CONFIG_DEBUG_MUTEXES) += mutex-debug.o
++endif
+ obj-$(CONFIG_LOCKDEP) += lockdep.o
+ ifeq ($(CONFIG_PROC_FS),y)
+ obj-$(CONFIG_LOCKDEP) += lockdep_proc.o
+@@ -40,14 +43,15 @@
+ obj-$(CONFIG_RT_MUTEXES) += rtmutex.o
+ obj-$(CONFIG_DEBUG_RT_MUTEXES) += rtmutex-debug.o
+ obj-$(CONFIG_RT_MUTEX_TESTER) += rtmutex-tester.o
++obj-$(CONFIG_PREEMPT_RT) += rt.o
+ obj-$(CONFIG_GENERIC_ISA_DMA) += dma.o
+ obj-$(CONFIG_USE_GENERIC_SMP_HELPERS) += smp.o
+ ifneq ($(CONFIG_SMP),y)
+ obj-y += up.o
+ endif
+-obj-$(CONFIG_SMP) += spinlock.o
+-obj-$(CONFIG_DEBUG_SPINLOCK) += spinlock.o
+-obj-$(CONFIG_PROVE_LOCKING) += spinlock.o
++obj-$(CONFIG_SMP) += spinlock.o rwlock.o
++obj-$(CONFIG_DEBUG_SPINLOCK) += spinlock.o rwlock.o
++obj-$(CONFIG_PROVE_LOCKING) += spinlock.o rwlock.o
+ obj-$(CONFIG_UID16) += uid16.o
+ obj-$(CONFIG_MODULES) += module.o
+ obj-$(CONFIG_KALLSYMS) += kallsyms.o
+Index: linux-rt-2.6.31/kernel/audit.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/audit.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/audit.c	2010-05-17 14:23:20.078410414 +0200
+@@ -467,23 +467,16 @@
+ 	struct task_struct *tsk;
+ 	int err;
+ 
+-	read_lock(&tasklist_lock);
++	rcu_read_lock();
+ 	tsk = find_task_by_vpid(pid);
+-	err = -ESRCH;
+-	if (!tsk)
+-		goto out;
+-	err = 0;
+-
+-	spin_lock_irq(&tsk->sighand->siglock);
+-	if (!tsk->signal->audit_tty)
+-		err = -EPERM;
+-	spin_unlock_irq(&tsk->sighand->siglock);
+-	if (err)
+-		goto out;
+-
+-	tty_audit_push_task(tsk, loginuid, sessionid);
+-out:
+-	read_unlock(&tasklist_lock);
++	if (!tsk) {
++		rcu_read_unlock();
++		return -ESRCH;
++	}
++	get_task_struct(tsk);
++	rcu_read_unlock();
++	err = tty_audit_push_task(tsk, loginuid, sessionid);
++	put_task_struct(tsk);
+ 	return err;
+ }
+ 
+@@ -874,40 +867,40 @@
+ 	case AUDIT_TTY_GET: {
+ 		struct audit_tty_status s;
+ 		struct task_struct *tsk;
++		unsigned long flags;
+ 
+-		read_lock(&tasklist_lock);
++		rcu_read_lock();
+ 		tsk = find_task_by_vpid(pid);
+-		if (!tsk)
+-			err = -ESRCH;
+-		else {
+-			spin_lock_irq(&tsk->sighand->siglock);
++		if (tsk && lock_task_sighand(tsk, &flags)) {
+ 			s.enabled = tsk->signal->audit_tty != 0;
+-			spin_unlock_irq(&tsk->sighand->siglock);
+-		}
+-		read_unlock(&tasklist_lock);
+-		audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_TTY_GET, 0, 0,
+-				 &s, sizeof(s));
++			unlock_task_sighand(tsk, &flags);
++		} else
++			err = -ESRCH;
++		rcu_read_unlock();
++
++		if (!err)
++			audit_send_reply(NETLINK_CB(skb).pid, seq,
++					 AUDIT_TTY_GET, 0, 0, &s, sizeof(s));
+ 		break;
+ 	}
+ 	case AUDIT_TTY_SET: {
+ 		struct audit_tty_status *s;
+ 		struct task_struct *tsk;
++		unsigned long flags;
+ 
+ 		if (nlh->nlmsg_len < sizeof(struct audit_tty_status))
+ 			return -EINVAL;
+ 		s = data;
+ 		if (s->enabled != 0 && s->enabled != 1)
+ 			return -EINVAL;
+-		read_lock(&tasklist_lock);
++		rcu_read_lock();
+ 		tsk = find_task_by_vpid(pid);
+-		if (!tsk)
+-			err = -ESRCH;
+-		else {
+-			spin_lock_irq(&tsk->sighand->siglock);
++		if (tsk && lock_task_sighand(tsk, &flags)) {
+ 			tsk->signal->audit_tty = s->enabled != 0;
+-			spin_unlock_irq(&tsk->sighand->siglock);
+-		}
+-		read_unlock(&tasklist_lock);
++			unlock_task_sighand(tsk, &flags);
++		} else
++			err = -ESRCH;
++		rcu_read_unlock();
+ 		break;
+ 	}
+ 	default:
+Index: linux-rt-2.6.31/kernel/capability.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/capability.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/capability.c	2010-05-17 14:23:20.078410414 +0200
+@@ -137,7 +137,7 @@
+ 	if (pid && (pid != task_pid_vnr(current))) {
+ 		struct task_struct *target;
+ 
+-		read_lock(&tasklist_lock);
++		rcu_read_lock();
+ 
+ 		target = find_task_by_vpid(pid);
+ 		if (!target)
+@@ -145,7 +145,7 @@
+ 		else
+ 			ret = security_capget(target, pEp, pIp, pPp);
+ 
+-		read_unlock(&tasklist_lock);
++		rcu_read_unlock();
+ 	} else
+ 		ret = security_capget(current, pEp, pIp, pPp);
+ 
+Index: linux-rt-2.6.31/kernel/cgroup.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/cgroup.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/cgroup.c	2010-05-17 14:23:20.078410414 +0200
+@@ -189,7 +189,7 @@
+ /* the list of cgroups eligible for automatic release. Protected by
+  * release_list_lock */
+ static LIST_HEAD(release_list);
+-static DEFINE_SPINLOCK(release_list_lock);
++static DEFINE_ATOMIC_SPINLOCK(release_list_lock);
+ static void cgroup_release_agent(struct work_struct *work);
+ static DECLARE_WORK(release_agent_work, cgroup_release_agent);
+ static void check_for_release(struct cgroup *cgrp);
+@@ -2802,11 +2802,11 @@
+ 	finish_wait(&cgroup_rmdir_waitq, &wait);
+ 	clear_bit(CGRP_WAIT_ON_RMDIR, &cgrp->flags);
+ 
+-	spin_lock(&release_list_lock);
++	atomic_spin_lock(&release_list_lock);
+ 	set_bit(CGRP_REMOVED, &cgrp->flags);
+ 	if (!list_empty(&cgrp->release_list))
+ 		list_del(&cgrp->release_list);
+-	spin_unlock(&release_list_lock);
++	atomic_spin_unlock(&release_list_lock);
+ 
+ 	cgroup_lock_hierarchy(cgrp->root);
+ 	/* delete this cgroup from parent->children */
+@@ -3342,13 +3342,13 @@
+ 		 * already queued for a userspace notification, queue
+ 		 * it now */
+ 		int need_schedule_work = 0;
+-		spin_lock(&release_list_lock);
++		atomic_spin_lock(&release_list_lock);
+ 		if (!cgroup_is_removed(cgrp) &&
+ 		    list_empty(&cgrp->release_list)) {
+ 			list_add(&cgrp->release_list, &release_list);
+ 			need_schedule_work = 1;
+ 		}
+-		spin_unlock(&release_list_lock);
++		atomic_spin_unlock(&release_list_lock);
+ 		if (need_schedule_work)
+ 			schedule_work(&release_agent_work);
+ 	}
+@@ -3395,7 +3395,7 @@
+ {
+ 	BUG_ON(work != &release_agent_work);
+ 	mutex_lock(&cgroup_mutex);
+-	spin_lock(&release_list_lock);
++	atomic_spin_lock(&release_list_lock);
+ 	while (!list_empty(&release_list)) {
+ 		char *argv[3], *envp[3];
+ 		int i;
+@@ -3404,7 +3404,7 @@
+ 						    struct cgroup,
+ 						    release_list);
+ 		list_del_init(&cgrp->release_list);
+-		spin_unlock(&release_list_lock);
++		atomic_spin_unlock(&release_list_lock);
+ 		pathbuf = kmalloc(PAGE_SIZE, GFP_KERNEL);
+ 		if (!pathbuf)
+ 			goto continue_free;
+@@ -3434,9 +3434,9 @@
+  continue_free:
+ 		kfree(pathbuf);
+ 		kfree(agentbuf);
+-		spin_lock(&release_list_lock);
++		atomic_spin_lock(&release_list_lock);
+ 	}
+-	spin_unlock(&release_list_lock);
++	atomic_spin_unlock(&release_list_lock);
+ 	mutex_unlock(&cgroup_mutex);
+ }
+ 
+Index: linux-rt-2.6.31/kernel/exit.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/exit.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/kernel/exit.c	2010-05-17 14:23:20.078410414 +0200
+@@ -67,7 +67,9 @@
+ 		detach_pid(p, PIDTYPE_SID);
+ 
+ 		list_del_rcu(&p->tasks);
++		preempt_disable();
+ 		__get_cpu_var(process_counts)--;
++		preempt_enable();
+ 	}
+ 	list_del_rcu(&p->thread_group);
+ 	list_del_init(&p->sibling);
+@@ -130,7 +132,7 @@
+ 	 * Do this under ->siglock, we can race with another thread
+ 	 * doing sigqueue_free() if we have SIGQUEUE_PREALLOC signals.
+ 	 */
+-	flush_sigqueue(&tsk->pending);
++	flush_task_sigqueue(tsk);
+ 
+ 	tsk->signal = NULL;
+ 	tsk->sighand = NULL;
+@@ -685,9 +687,11 @@
+ 	task_lock(tsk);
+ 	tsk->mm = NULL;
+ 	up_read(&mm->mmap_sem);
++	preempt_disable(); // FIXME
+ 	enter_lazy_tlb(mm, current);
+ 	/* We don't want this task to be frozen prematurely */
+ 	clear_freeze_flag(tsk);
++	preempt_enable();
+ 	task_unlock(tsk);
+ 	mm_update_next_owner(mm);
+ 	mmput(mm);
+@@ -930,7 +934,7 @@
+ 	 * an exiting task cleaning up the robust pi futexes.
+ 	 */
+ 	smp_mb();
+-	spin_unlock_wait(&tsk->pi_lock);
++	atomic_spin_unlock_wait(&tsk->pi_lock);
+ 
+ 	if (unlikely(in_atomic()))
+ 		printk(KERN_INFO "note: %s[%d] exited with preempt_count %d\n",
+@@ -1007,14 +1011,17 @@
+ 	if (tsk->splice_pipe)
+ 		__free_pipe_info(tsk->splice_pipe);
+ 
+-	preempt_disable();
++again:
++	local_irq_disable();
+ 	/* causes final put_task_struct in finish_task_switch(). */
+ 	tsk->state = TASK_DEAD;
+-	schedule();
+-	BUG();
+-	/* Avoid "noreturn function does return".  */
+-	for (;;)
+-		cpu_relax();	/* For when BUG is null */
++	__schedule();
++	printk(KERN_ERR "BUG: dead task %s:%d back from the grave!\n",
++		current->comm, current->pid);
++	printk(KERN_ERR ".... flags: %08x, count: %d, state: %08lx\n",
++		current->flags, atomic_read(&current->usage), current->state);
++	printk(KERN_ERR ".... trying again ...\n");
++	goto again;
+ }
+ 
+ EXPORT_SYMBOL_GPL(do_exit);
+@@ -1474,6 +1481,9 @@
+ 				int ptrace, struct task_struct *p)
+ {
+ 	int ret = eligible_child(wo, p);
++
++	BUG_ON(!atomic_read(&p->usage));
++
+ 	if (!ret)
+ 		return ret;
+ 
+Index: linux-rt-2.6.31/kernel/fork.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/fork.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/kernel/fork.c	2010-05-17 14:23:20.078410414 +0200
+@@ -38,6 +38,7 @@
+ #include <linux/syscalls.h>
+ #include <linux/jiffies.h>
+ #include <linux/tracehook.h>
++#include <linux/interrupt.h>
+ #include <linux/futex.h>
+ #include <linux/compat.h>
+ #include <linux/task_io_accounting_ops.h>
+@@ -48,6 +49,8 @@
+ #include <linux/memcontrol.h>
+ #include <linux/ftrace.h>
+ #include <linux/profile.h>
++#include <linux/kthread.h>
++#include <linux/notifier.h>
+ #include <linux/rmap.h>
+ #include <linux/acct.h>
+ #include <linux/tsacct_kern.h>
+@@ -82,7 +85,19 @@
+ 
+ DEFINE_PER_CPU(unsigned long, process_counts) = 0;
+ 
++#ifdef CONFIG_PREEMPT_RT
++DEFINE_RWLOCK(tasklist_lock);  /* outer */
++#else
+ __cacheline_aligned DEFINE_RWLOCK(tasklist_lock);  /* outer */
++#endif
++
++/*
++ * Delayed mmdrop. In the PREEMPT_RT case we
++ * dont want to do this from the scheduling
++ * context.
++ */
++static DEFINE_PER_CPU(struct task_struct *, desched_task);
++static DEFINE_PER_CPU(struct list_head, delayed_drop_list);
+ 
+ int nr_processes(void)
+ {
+@@ -160,6 +175,16 @@
+ 		free_task(tsk);
+ }
+ 
++#ifdef CONFIG_PREEMPT_RT
++void __put_task_struct_cb(struct rcu_head *rhp)
++{
++	struct task_struct *tsk = container_of(rhp, struct task_struct, rcu);
++
++	__put_task_struct(tsk);
++
++}
++#endif
++
+ /*
+  * macro override instead of weak attribute alias, to workaround
+  * gcc 4.1.0 and 4.1.1 bugs with weak attribute and empty functions.
+@@ -170,6 +195,8 @@
+ 
+ void __init fork_init(unsigned long mempages)
+ {
++	int i;
++
+ #ifndef __HAVE_ARCH_TASK_STRUCT_ALLOCATOR
+ #ifndef ARCH_MIN_TASKALIGN
+ #define ARCH_MIN_TASKALIGN	L1_CACHE_BYTES
+@@ -200,6 +227,9 @@
+ 	init_task.signal->rlim[RLIMIT_NPROC].rlim_max = max_threads/2;
+ 	init_task.signal->rlim[RLIMIT_SIGPENDING] =
+ 		init_task.signal->rlim[RLIMIT_NPROC];
++
++	for (i = 0; i < NR_CPUS; i++)
++		INIT_LIST_HEAD(&per_cpu(delayed_drop_list, i));
+ }
+ 
+ int __attribute__((weak)) arch_dup_task_struct(struct task_struct *dst,
+@@ -281,6 +311,7 @@
+ 	mm->locked_vm = 0;
+ 	mm->mmap = NULL;
+ 	mm->mmap_cache = NULL;
++	INIT_LIST_HEAD(&mm->delayed_drop);
+ 	mm->free_area_cache = oldmm->mmap_base;
+ 	mm->cached_hole_size = ~0UL;
+ 	mm->map_count = 0;
+@@ -900,10 +931,13 @@
+ 
+ static void rt_mutex_init_task(struct task_struct *p)
+ {
+-	spin_lock_init(&p->pi_lock);
++	atomic_spin_lock_init(&p->pi_lock);
+ #ifdef CONFIG_RT_MUTEXES
+-	plist_head_init(&p->pi_waiters, &p->pi_lock);
++	plist_head_init_atomic(&p->pi_waiters, &p->pi_lock);
+ 	p->pi_blocked_on = NULL;
++# ifdef CONFIG_DEBUG_RT_MUTEXES
++	p->last_kernel_lock = NULL;
++# endif
+ #endif
+ }
+ 
+@@ -1022,6 +1056,7 @@
+ 	spin_lock_init(&p->alloc_lock);
+ 
+ 	init_sigpending(&p->pending);
++	p->sigqueue_cache = NULL;
+ 
+ 	p->utime = cputime_zero;
+ 	p->stime = cputime_zero;
+@@ -1037,7 +1072,7 @@
+ 	acct_clear_integrals(p);
+ 
+ 	posix_cpu_timers_init(p);
+-
++	p->posix_timer_list = NULL;
+ 	p->lock_depth = -1;		/* -1 = no lock */
+ 	do_posix_clock_monotonic_gettime(&p->start_time);
+ 	p->real_start_time = p->start_time;
+@@ -1073,6 +1108,7 @@
+ 	p->hardirq_context = 0;
+ 	p->softirq_context = 0;
+ #endif
++	p->pagefault_disabled = 0;
+ #ifdef CONFIG_LOCKDEP
+ 	p->lockdep_depth = 0; /* no locks held yet */
+ 	p->curr_chain_key = 0;
+@@ -1114,6 +1150,9 @@
+ 	retval = copy_thread(clone_flags, stack_start, stack_size, p, regs);
+ 	if (retval)
+ 		goto bad_fork_cleanup_io;
++#ifdef CONFIG_DEBUG_PREEMPT
++	atomic_set(&p->lock_count, 0);
++#endif
+ 
+ 	if (pid != &init_struct_pid) {
+ 		retval = -ENOMEM;
+@@ -1198,11 +1237,13 @@
+ 	 * to ensure it is on a valid CPU (and if not, just force it back to
+ 	 * parent's CPU). This avoids alot of nasty races.
+ 	 */
++	preempt_disable();
+ 	p->cpus_allowed = current->cpus_allowed;
+ 	p->rt.nr_cpus_allowed = current->rt.nr_cpus_allowed;
+ 	if (unlikely(!cpu_isset(task_cpu(p), p->cpus_allowed) ||
+ 			!cpu_online(task_cpu(p))))
+ 		set_task_cpu(p, smp_processor_id());
++	preempt_enable();
+ 
+ 	/* CLONE_PARENT re-uses the old parent */
+ 	if (clone_flags & (CLONE_PARENT|CLONE_THREAD)) {
+@@ -1252,7 +1293,9 @@
+ 			attach_pid(p, PIDTYPE_PGID, task_pgrp(current));
+ 			attach_pid(p, PIDTYPE_SID, task_session(current));
+ 			list_add_tail_rcu(&p->tasks, &init_task.tasks);
++			preempt_disable();
+ 			__get_cpu_var(process_counts)++;
++			preempt_enable();
+ 		}
+ 		attach_pid(p, PIDTYPE_PID, pid);
+ 		nr_threads++;
+@@ -1729,3 +1772,138 @@
+ 	task_unlock(task);
+ 	return 0;
+ }
++
++static int mmdrop_complete(void)
++{
++	struct list_head *head;
++	int ret = 0;
++
++	head = &get_cpu_var(delayed_drop_list);
++	while (!list_empty(head)) {
++		struct mm_struct *mm = list_entry(head->next,
++					struct mm_struct, delayed_drop);
++		list_del(&mm->delayed_drop);
++		put_cpu_var(delayed_drop_list);
++
++		__mmdrop(mm);
++		ret = 1;
++
++		head = &get_cpu_var(delayed_drop_list);
++	}
++	put_cpu_var(delayed_drop_list);
++
++	return ret;
++}
++
++/*
++ * We dont want to do complex work from the scheduler, thus
++ * we delay the work to a per-CPU worker thread:
++ */
++void  __mmdrop_delayed(struct mm_struct *mm)
++{
++	struct task_struct *desched_task;
++	struct list_head *head;
++
++	head = &get_cpu_var(delayed_drop_list);
++	list_add_tail(&mm->delayed_drop, head);
++	desched_task = __get_cpu_var(desched_task);
++	if (desched_task)
++		wake_up_process(desched_task);
++	put_cpu_var(delayed_drop_list);
++}
++
++static void takeover_delayed_drop(int hotcpu)
++{
++	struct list_head *head = &per_cpu(delayed_drop_list, hotcpu);
++
++	while (!list_empty(head)) {
++		struct mm_struct *mm = list_entry(head->next,
++				struct mm_struct, delayed_drop);
++
++		list_del(&mm->delayed_drop);
++		__mmdrop_delayed(mm);
++	}
++}
++
++static int desched_thread(void * __bind_cpu)
++{
++	set_user_nice(current, -10);
++	current->flags |= PF_NOFREEZE | PF_SOFTIRQ;
++
++	set_current_state(TASK_INTERRUPTIBLE);
++
++	while (!kthread_should_stop()) {
++
++		if (mmdrop_complete())
++			continue;
++		schedule();
++
++		/*
++ 		 * This must be called from time to time on ia64, and is a
++ 		 * no-op on other archs. Used to be in cpu_idle(), but with
++ 		 * the new -rt semantics it can't stay there.
++		 */
++		check_pgt_cache();
++
++		set_current_state(TASK_INTERRUPTIBLE);
++	}
++	__set_current_state(TASK_RUNNING);
++	return 0;
++}
++
++static int __devinit cpu_callback(struct notifier_block *nfb,
++				  unsigned long action,
++				  void *hcpu)
++{
++	int hotcpu = (unsigned long)hcpu;
++	struct task_struct *p;
++
++	switch (action) {
++	case CPU_UP_PREPARE:
++
++		BUG_ON(per_cpu(desched_task, hotcpu));
++		INIT_LIST_HEAD(&per_cpu(delayed_drop_list, hotcpu));
++		p = kthread_create(desched_thread, hcpu, "desched/%d", hotcpu);
++		if (IS_ERR(p)) {
++			printk("desched_thread for %i failed\n", hotcpu);
++			return NOTIFY_BAD;
++		}
++		per_cpu(desched_task, hotcpu) = p;
++		kthread_bind(p, hotcpu);
++		break;
++	case CPU_ONLINE:
++
++		wake_up_process(per_cpu(desched_task, hotcpu));
++		break;
++#ifdef CONFIG_HOTPLUG_CPU
++	case CPU_UP_CANCELED:
++
++		/* Unbind so it can run.  Fall thru. */
++		kthread_bind(per_cpu(desched_task, hotcpu), smp_processor_id());
++	case CPU_DEAD:
++
++		p = per_cpu(desched_task, hotcpu);
++		per_cpu(desched_task, hotcpu) = NULL;
++		kthread_stop(p);
++		takeover_delayed_drop(hotcpu);
++		takeover_tasklets(hotcpu);
++		break;
++#endif /* CONFIG_HOTPLUG_CPU */
++	}
++	return NOTIFY_OK;
++}
++
++static struct notifier_block __devinitdata cpu_nfb = {
++	.notifier_call = cpu_callback
++};
++
++__init int spawn_desched_task(void)
++{
++	void *cpu = (void *)(long)smp_processor_id();
++
++	cpu_callback(&cpu_nfb, CPU_UP_PREPARE, cpu);
++	cpu_callback(&cpu_nfb, CPU_ONLINE, cpu);
++	register_cpu_notifier(&cpu_nfb);
++	return 0;
++}
++
+Index: linux-rt-2.6.31/kernel/futex.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/futex.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/kernel/futex.c	2010-05-17 14:23:20.078410414 +0200
+@@ -89,36 +89,36 @@
+ 	union futex_key key;
+ };
+ 
+-/*
+- * We use this hashed waitqueue instead of a normal wait_queue_t, so
++/**
++ * struct futex_q - The hashed futex queue entry, one per waiting task
++ * @task:		the task waiting on the futex
++ * @lock_ptr:		the hash bucket lock
++ * @key:		the key the futex is hashed on
++ * @pi_state:		optional priority inheritance state
++ * @rt_waiter:		rt_waiter storage for use with requeue_pi
++ * @requeue_pi_key:	the requeue_pi target futex key
++ * @bitset:		bitset for the optional bitmasked wakeup
++ *
++ * We use this hashed waitqueue, instead of a normal wait_queue_t, so
+  * we can wake only the relevant ones (hashed queues may be shared).
+  *
+  * A futex_q has a woken state, just like tasks have TASK_RUNNING.
+  * It is considered woken when plist_node_empty(&q->list) || q->lock_ptr == 0.
+  * The order of wakup is always to make the first condition true, then
+- * wake up q->waiter, then make the second condition true.
++ * the second.
++ *
++ * PI futexes are typically woken before they are removed from the hash list via
++ * the rt_mutex code. See unqueue_me_pi().
+  */
+ struct futex_q {
+ 	struct plist_node list;
+-	/* Waiter reference */
+-	struct task_struct *task;
+ 
+-	/* Which hash list lock to use: */
++	struct task_struct *task;
+ 	spinlock_t *lock_ptr;
+-
+-	/* Key which the futex is hashed on: */
+ 	union futex_key key;
+-
+-	/* Optional priority inheritance state: */
+ 	struct futex_pi_state *pi_state;
+-
+-	/* rt_waiter storage for requeue_pi: */
+ 	struct rt_mutex_waiter *rt_waiter;
+-
+-	/* The expected requeue pi target futex key: */
+ 	union futex_key *requeue_pi_key;
+-
+-	/* Bitset for the optional bitmasked wakeup */
+ 	u32 bitset;
+ };
+ 
+@@ -199,11 +199,10 @@
+ }
+ 
+ /**
+- * get_futex_key - Get parameters which are the keys for a futex.
+- * @uaddr: virtual address of the futex
+- * @fshared: 0 for a PROCESS_PRIVATE futex, 1 for PROCESS_SHARED
+- * @key: address where result is stored.
+- * @rw: mapping needs to be read/write (values: VERIFY_READ, VERIFY_WRITE)
++ * get_futex_key() - Get parameters which are the keys for a futex
++ * @uaddr:	virtual address of the futex
++ * @fshared:	0 for a PROCESS_PRIVATE futex, 1 for PROCESS_SHARED
++ * @key:	address where result is stored.
+  *
+  * Returns a negative error code or 0
+  * The key words are stored in *key on success.
+@@ -215,7 +214,7 @@
+  * lock_page() might sleep, the caller should not hold a spinlock.
+  */
+ static int
+-get_futex_key(u32 __user *uaddr, int fshared, union futex_key *key, int rw)
++get_futex_key(u32 __user *uaddr, int fshared, union futex_key *key)
+ {
+ 	unsigned long address = (unsigned long)uaddr;
+ 	struct mm_struct *mm = current->mm;
+@@ -238,7 +237,7 @@
+ 	 *        but access_ok() should be faster than find_vma()
+ 	 */
+ 	if (!fshared) {
+-		if (unlikely(!access_ok(rw, uaddr, sizeof(u32))))
++		if (unlikely(!access_ok(VERIFY_WRITE, uaddr, sizeof(u32))))
+ 			return -EFAULT;
+ 		key->private.mm = mm;
+ 		key->private.address = address;
+@@ -247,7 +246,7 @@
+ 	}
+ 
+ again:
+-	err = get_user_pages_fast(address, 1, rw == VERIFY_WRITE, &page);
++	err = get_user_pages_fast(address, 1, 1, &page);
+ 	if (err < 0)
+ 		return err;
+ 
+@@ -289,8 +288,8 @@
+ 	drop_futex_key_refs(key);
+ }
+ 
+-/*
+- * fault_in_user_writeable - fault in user address and verify RW access
++/**
++ * fault_in_user_writeable() - Fault in user address and verify RW access
+  * @uaddr:	pointer to faulting user space address
+  *
+  * Slow path to fixup the fault we just took in the atomic write
+@@ -316,8 +315,8 @@
+ 
+ /**
+  * futex_top_waiter() - Return the highest priority waiter on a futex
+- * @hb:     the hash bucket the futex_q's reside in
+- * @key:    the futex key (to distinguish it from other futex futex_q's)
++ * @hb:		the hash bucket the futex_q's reside in
++ * @key:	the futex key (to distinguish it from other futex futex_q's)
+  *
+  * Must be called with the hb lock held.
+  */
+@@ -402,9 +401,9 @@
+ 	 * and has cleaned up the pi_state already
+ 	 */
+ 	if (pi_state->owner) {
+-		spin_lock_irq(&pi_state->owner->pi_lock);
++		atomic_spin_lock_irq(&pi_state->owner->pi_lock);
+ 		list_del_init(&pi_state->list);
+-		spin_unlock_irq(&pi_state->owner->pi_lock);
++		atomic_spin_unlock_irq(&pi_state->owner->pi_lock);
+ 
+ 		rt_mutex_proxy_unlock(&pi_state->pi_mutex, pi_state->owner);
+ 	}
+@@ -469,18 +468,18 @@
+ 	 * pi_state_list anymore, but we have to be careful
+ 	 * versus waiters unqueueing themselves:
+ 	 */
+-	spin_lock_irq(&curr->pi_lock);
++	atomic_spin_lock_irq(&curr->pi_lock);
+ 	while (!list_empty(head)) {
+ 
+ 		next = head->next;
+ 		pi_state = list_entry(next, struct futex_pi_state, list);
+ 		key = pi_state->key;
+ 		hb = hash_futex(&key);
+-		spin_unlock_irq(&curr->pi_lock);
++		atomic_spin_unlock_irq(&curr->pi_lock);
+ 
+ 		spin_lock(&hb->lock);
+ 
+-		spin_lock_irq(&curr->pi_lock);
++		atomic_spin_lock_irq(&curr->pi_lock);
+ 		/*
+ 		 * We dropped the pi-lock, so re-check whether this
+ 		 * task still owns the PI-state:
+@@ -494,15 +493,15 @@
+ 		WARN_ON(list_empty(&pi_state->list));
+ 		list_del_init(&pi_state->list);
+ 		pi_state->owner = NULL;
+-		spin_unlock_irq(&curr->pi_lock);
++		atomic_spin_unlock_irq(&curr->pi_lock);
+ 
+ 		rt_mutex_unlock(&pi_state->pi_mutex);
+ 
+ 		spin_unlock(&hb->lock);
+ 
+-		spin_lock_irq(&curr->pi_lock);
++		atomic_spin_lock_irq(&curr->pi_lock);
+ 	}
+-	spin_unlock_irq(&curr->pi_lock);
++	atomic_spin_unlock_irq(&curr->pi_lock);
+ }
+ 
+ static int
+@@ -531,8 +530,25 @@
+ 				return -EINVAL;
+ 
+ 			WARN_ON(!atomic_read(&pi_state->refcount));
+-			WARN_ON(pid && pi_state->owner &&
+-				pi_state->owner->pid != pid);
++
++			/*
++			 * When pi_state->owner is NULL then the owner died
++			 * and another waiter is on the fly. pi_state->owner
++			 * is fixed up by the task which acquires
++			 * pi_state->rt_mutex.
++			 *
++			 * We do not check for pid == 0 which can happen when
++			 * the owner died and robust_list_exit() cleared the
++			 * TID.
++			 */
++			if (pid && pi_state->owner) {
++				/*
++				 * Bail out if user space manipulated the
++				 * futex value.
++				 */
++				if (pid != task_pid_vnr(pi_state->owner))
++					return -EINVAL;
++			}
+ 
+ 			atomic_inc(&pi_state->refcount);
+ 			*ps = pi_state;
+@@ -557,7 +573,7 @@
+ 	 * change of the task flags, we do this protected by
+ 	 * p->pi_lock:
+ 	 */
+-	spin_lock_irq(&p->pi_lock);
++	atomic_spin_lock_irq(&p->pi_lock);
+ 	if (unlikely(p->flags & PF_EXITING)) {
+ 		/*
+ 		 * The task is on the way out. When PF_EXITPIDONE is
+@@ -566,7 +582,7 @@
+ 		 */
+ 		int ret = (p->flags & PF_EXITPIDONE) ? -ESRCH : -EAGAIN;
+ 
+-		spin_unlock_irq(&p->pi_lock);
++		atomic_spin_unlock_irq(&p->pi_lock);
+ 		put_task_struct(p);
+ 		return ret;
+ 	}
+@@ -585,7 +601,7 @@
+ 	WARN_ON(!list_empty(&pi_state->list));
+ 	list_add(&pi_state->list, &p->pi_state_list);
+ 	pi_state->owner = p;
+-	spin_unlock_irq(&p->pi_lock);
++	atomic_spin_unlock_irq(&p->pi_lock);
+ 
+ 	put_task_struct(p);
+ 
+@@ -595,7 +611,7 @@
+ }
+ 
+ /**
+- * futex_lock_pi_atomic() - atomic work required to acquire a pi aware futex
++ * futex_lock_pi_atomic() - Atomic work required to acquire a pi aware futex
+  * @uaddr:		the pi futex user address
+  * @hb:			the pi futex hash bucket
+  * @key:		the futex key associated with uaddr and hb
+@@ -766,7 +782,14 @@
+ 	if (pi_state->owner != current)
+ 		return -EINVAL;
+ 
+-	spin_lock(&pi_state->pi_mutex.wait_lock);
++	/*
++	 * If current does not own the pi_state then the futex is
++	 * inconsistent and user space fiddled with the futex value.
++	 */
++	if (pi_state->owner != current)
++		return -EINVAL;
++
++	atomic_spin_lock(&pi_state->pi_mutex.wait_lock);
+ 	new_owner = rt_mutex_next_owner(&pi_state->pi_mutex);
+ 
+ 	/*
+@@ -795,23 +818,23 @@
+ 		else if (curval != uval)
+ 			ret = -EINVAL;
+ 		if (ret) {
+-			spin_unlock(&pi_state->pi_mutex.wait_lock);
++			atomic_spin_unlock(&pi_state->pi_mutex.wait_lock);
+ 			return ret;
+ 		}
+ 	}
+ 
+-	spin_lock_irq(&pi_state->owner->pi_lock);
++	atomic_spin_lock_irq(&pi_state->owner->pi_lock);
+ 	WARN_ON(list_empty(&pi_state->list));
+ 	list_del_init(&pi_state->list);
+-	spin_unlock_irq(&pi_state->owner->pi_lock);
++	atomic_spin_unlock_irq(&pi_state->owner->pi_lock);
+ 
+-	spin_lock_irq(&new_owner->pi_lock);
++	atomic_spin_lock_irq(&new_owner->pi_lock);
+ 	WARN_ON(!list_empty(&pi_state->list));
+ 	list_add(&pi_state->list, &new_owner->pi_state_list);
+ 	pi_state->owner = new_owner;
+-	spin_unlock_irq(&new_owner->pi_lock);
++	atomic_spin_unlock_irq(&new_owner->pi_lock);
+ 
+-	spin_unlock(&pi_state->pi_mutex.wait_lock);
++	atomic_spin_unlock(&pi_state->pi_mutex.wait_lock);
+ 	rt_mutex_unlock(&pi_state->pi_mutex);
+ 
+ 	return 0;
+@@ -873,7 +896,7 @@
+ 	if (!bitset)
+ 		return -EINVAL;
+ 
+-	ret = get_futex_key(uaddr, fshared, &key, VERIFY_READ);
++	ret = get_futex_key(uaddr, fshared, &key);
+ 	if (unlikely(ret != 0))
+ 		goto out;
+ 
+@@ -919,10 +942,10 @@
+ 	int ret, op_ret;
+ 
+ retry:
+-	ret = get_futex_key(uaddr1, fshared, &key1, VERIFY_READ);
++	ret = get_futex_key(uaddr1, fshared, &key1);
+ 	if (unlikely(ret != 0))
+ 		goto out;
+-	ret = get_futex_key(uaddr2, fshared, &key2, VERIFY_WRITE);
++	ret = get_futex_key(uaddr2, fshared, &key2);
+ 	if (unlikely(ret != 0))
+ 		goto out_put_key1;
+ 
+@@ -1016,7 +1039,7 @@
+ 		plist_add(&q->list, &hb2->chain);
+ 		q->lock_ptr = &hb2->lock;
+ #ifdef CONFIG_DEBUG_PI_LIST
+-		q->list.plist.lock = &hb2->lock;
++		q->list.plist.slock = &hb2->lock;
+ #endif
+ 	}
+ 	get_futex_key_refs(key2);
+@@ -1025,9 +1048,9 @@
+ 
+ /**
+  * requeue_pi_wake_futex() - Wake a task that acquired the lock during requeue
+- * q:	the futex_q
+- * key:	the key of the requeue target futex
+- * hb:  the hash_bucket of the requeue target futex
++ * @q:		the futex_q
++ * @key:	the key of the requeue target futex
++ * @hb:		the hash_bucket of the requeue target futex
+  *
+  * During futex_requeue, with requeue_pi=1, it is possible to acquire the
+  * target futex if it is uncontended or via a lock steal.  Set the futex_q key
+@@ -1052,7 +1075,7 @@
+ 
+ 	q->lock_ptr = &hb->lock;
+ #ifdef CONFIG_DEBUG_PI_LIST
+-	q->list.plist.lock = &hb->lock;
++	q->list.plist.slock = &hb->lock;
+ #endif
+ 
+ 	wake_up_state(q->task, TASK_NORMAL);
+@@ -1181,11 +1204,10 @@
+ 		pi_state = NULL;
+ 	}
+ 
+-	ret = get_futex_key(uaddr1, fshared, &key1, VERIFY_READ);
++	ret = get_futex_key(uaddr1, fshared, &key1);
+ 	if (unlikely(ret != 0))
+ 		goto out;
+-	ret = get_futex_key(uaddr2, fshared, &key2,
+-			    requeue_pi ? VERIFY_WRITE : VERIFY_READ);
++	ret = get_futex_key(uaddr2, fshared, &key2);
+ 	if (unlikely(ret != 0))
+ 		goto out_put_key1;
+ 
+@@ -1365,6 +1387,25 @@
+ 	return hb;
+ }
+ 
++static inline void
++queue_unlock(struct futex_q *q, struct futex_hash_bucket *hb)
++{
++	spin_unlock(&hb->lock);
++	drop_futex_key_refs(&q->key);
++}
++
++/**
++ * queue_me() - Enqueue the futex_q on the futex_hash_bucket
++ * @q:	The futex_q to enqueue
++ * @hb:	The destination hash bucket
++ *
++ * The hb->lock must be held by the caller, and is released here. A call to
++ * queue_me() is typically paired with exactly one call to unqueue_me().  The
++ * exceptions involve the PI related operations, which may use unqueue_me_pi()
++ * or nothing if the unqueue is done as part of the wake process and the unqueue
++ * state is implicit in the state of woken task (see futex_wait_requeue_pi() for
++ * an example).
++ */
+ static inline void queue_me(struct futex_q *q, struct futex_hash_bucket *hb)
+ {
+ 	int prio;
+@@ -1381,26 +1422,24 @@
+ 
+ 	plist_node_init(&q->list, prio);
+ #ifdef CONFIG_DEBUG_PI_LIST
+-	q->list.plist.lock = &hb->lock;
++	q->list.plist.slock = &hb->lock;
+ #endif
+ 	plist_add(&q->list, &hb->chain);
+ 	q->task = current;
+ 	spin_unlock(&hb->lock);
+ }
+ 
+-static inline void
+-queue_unlock(struct futex_q *q, struct futex_hash_bucket *hb)
+-{
+-	spin_unlock(&hb->lock);
+-	drop_futex_key_refs(&q->key);
+-}
+-
+-/*
+- * queue_me and unqueue_me must be called as a pair, each
+- * exactly once.  They are called with the hashed spinlock held.
++/**
++ * unqueue_me() - Remove the futex_q from its futex_hash_bucket
++ * @q:	The futex_q to unqueue
++ *
++ * The q->lock_ptr must not be held by the caller. A call to unqueue_me() must
++ * be paired with exactly one earlier call to queue_me().
++ *
++ * Returns:
++ *   1 - if the futex_q was still queued (and we removed unqueued it)
++ *   0 - if the futex_q was already removed by the waking thread
+  */
+-
+-/* Return 1 if we were still queued (ie. 0 means we were woken) */
+ static int unqueue_me(struct futex_q *q)
+ {
+ 	spinlock_t *lock_ptr;
+@@ -1518,18 +1557,18 @@
+ 	 * itself.
+ 	 */
+ 	if (pi_state->owner != NULL) {
+-		spin_lock_irq(&pi_state->owner->pi_lock);
++		atomic_spin_lock_irq(&pi_state->owner->pi_lock);
+ 		WARN_ON(list_empty(&pi_state->list));
+ 		list_del_init(&pi_state->list);
+-		spin_unlock_irq(&pi_state->owner->pi_lock);
++		atomic_spin_unlock_irq(&pi_state->owner->pi_lock);
+ 	}
+ 
+ 	pi_state->owner = newowner;
+ 
+-	spin_lock_irq(&newowner->pi_lock);
++	atomic_spin_lock_irq(&newowner->pi_lock);
+ 	WARN_ON(!list_empty(&pi_state->list));
+ 	list_add(&pi_state->list, &newowner->pi_state_list);
+-	spin_unlock_irq(&newowner->pi_lock);
++	atomic_spin_unlock_irq(&newowner->pi_lock);
+ 	return 0;
+ 
+ 	/*
+@@ -1653,6 +1692,12 @@
+ static void futex_wait_queue_me(struct futex_hash_bucket *hb, struct futex_q *q,
+ 				struct hrtimer_sleeper *timeout)
+ {
++	/*
++	 * The task state is guaranteed to be set before another task can
++	 * wake it. set_current_state() is implemented using set_mb() and
++	 * queue_me() calls spin_unlock() upon completion, both serializing
++	 * access to the hash list and forcing another memory barrier.
++	 */
+ 	set_current_state(TASK_INTERRUPTIBLE);
+ 	queue_me(q, hb);
+ 
+@@ -1721,7 +1766,7 @@
+ 	 */
+ retry:
+ 	q->key = FUTEX_KEY_INIT;
+-	ret = get_futex_key(uaddr, fshared, &q->key, VERIFY_READ);
++	ret = get_futex_key(uaddr, fshared, &q->key);
+ 	if (unlikely(ret != 0))
+ 		return ret;
+ 
+@@ -1887,7 +1932,7 @@
+ 	q.requeue_pi_key = NULL;
+ retry:
+ 	q.key = FUTEX_KEY_INIT;
+-	ret = get_futex_key(uaddr, fshared, &q.key, VERIFY_WRITE);
++	ret = get_futex_key(uaddr, fshared, &q.key);
+ 	if (unlikely(ret != 0))
+ 		goto out;
+ 
+@@ -2006,7 +2051,7 @@
+ 	if ((uval & FUTEX_TID_MASK) != task_pid_vnr(current))
+ 		return -EPERM;
+ 
+-	ret = get_futex_key(uaddr, fshared, &key, VERIFY_WRITE);
++	ret = get_futex_key(uaddr, fshared, &key);
+ 	if (unlikely(ret != 0))
+ 		goto out;
+ 
+@@ -2127,12 +2172,12 @@
+ 
+ /**
+  * futex_wait_requeue_pi() - Wait on uaddr and take uaddr2
+- * @uaddr:	the futex we initialyl wait on (non-pi)
++ * @uaddr:	the futex we initially wait on (non-pi)
+  * @fshared:	whether the futexes are shared (1) or not (0).  They must be
+  * 		the same type, no requeueing from private to shared, etc.
+  * @val:	the expected value of uaddr
+  * @abs_time:	absolute timeout
+- * @bitset:	32 bit wakeup bitset set by userspace, defaults to all.
++ * @bitset:	32 bit wakeup bitset set by userspace, defaults to all
+  * @clockrt:	whether to use CLOCK_REALTIME (1) or CLOCK_MONOTONIC (0)
+  * @uaddr2:	the pi futex we will take prior to returning to user-space
+  *
+@@ -2146,11 +2191,11 @@
+  * We call schedule in futex_wait_queue_me() when we enqueue and return there
+  * via the following:
+  * 1) wakeup on uaddr2 after an atomic lock acquisition by futex_requeue()
+- * 2) wakeup on uaddr2 after a requeue and subsequent unlock
+- * 3) signal (before or after requeue)
+- * 4) timeout (before or after requeue)
++ * 2) wakeup on uaddr2 after a requeue
++ * 3) signal
++ * 4) timeout
+  *
+- * If 3, we setup a restart_block with futex_wait_requeue_pi() as the function.
++ * If 3, cleanup and return -ERESTARTNOINTR.
+  *
+  * If 2, we may then block on trying to take the rt_mutex and return via:
+  * 5) successful lock
+@@ -2158,7 +2203,7 @@
+  * 7) timeout
+  * 8) other lock acquisition failure
+  *
+- * If 6, we setup a restart_block with futex_lock_pi() as the function.
++ * If 6, return -EWOULDBLOCK (restarting the syscall would do the same).
+  *
+  * If 4 or 7, we cleanup and return with -ETIMEDOUT.
+  *
+@@ -2198,7 +2243,7 @@
+ 	rt_waiter.task = NULL;
+ 
+ 	key2 = FUTEX_KEY_INIT;
+-	ret = get_futex_key(uaddr2, fshared, &key2, VERIFY_WRITE);
++	ret = get_futex_key(uaddr2, fshared, &key2);
+ 	if (unlikely(ret != 0))
+ 		goto out;
+ 
+@@ -2259,7 +2304,7 @@
+ 		res = fixup_owner(uaddr2, fshared, &q, !ret);
+ 		/*
+ 		 * If fixup_owner() returned an error, proprogate that.  If it
+-		 * acquired the lock, clear our -ETIMEDOUT or -EINTR.
++		 * acquired the lock, clear -ETIMEDOUT or -EINTR.
+ 		 */
+ 		if (res)
+ 			ret = (res < 0) ? res : 0;
+@@ -2277,14 +2322,11 @@
+ 			rt_mutex_unlock(pi_mutex);
+ 	} else if (ret == -EINTR) {
+ 		/*
+-		 * We've already been requeued, but we have no way to
+-		 * restart by calling futex_lock_pi() directly. We
+-		 * could restart the syscall, but that will look at
+-		 * the user space value and return right away. So we
+-		 * drop back with EWOULDBLOCK to tell user space that
+-		 * "val" has been changed. That's the same what the
+-		 * restart of the syscall would do in
+-		 * futex_wait_setup().
++		 * We've already been requeued, but cannot restart by calling
++		 * futex_lock_pi() directly. We could restart this syscall, but
++		 * it would detect that the user space "val" changed and return
++		 * -EWOULDBLOCK.  Save the overhead of the restart and return
++		 * -EWOULDBLOCK directly.
+ 		 */
+ 		ret = -EWOULDBLOCK;
+ 	}
+@@ -2318,9 +2360,9 @@
+  */
+ 
+ /**
+- * sys_set_robust_list - set the robust-futex list head of a task
+- * @head: pointer to the list-head
+- * @len: length of the list-head, as userspace expects
++ * sys_set_robust_list() - Set the robust-futex list head of a task
++ * @head:	pointer to the list-head
++ * @len:	length of the list-head, as userspace expects
+  */
+ SYSCALL_DEFINE2(set_robust_list, struct robust_list_head __user *, head,
+ 		size_t, len)
+@@ -2339,10 +2381,10 @@
+ }
+ 
+ /**
+- * sys_get_robust_list - get the robust-futex list head of a task
+- * @pid: pid of the process [zero for current task]
+- * @head_ptr: pointer to a list-head pointer, the kernel fills it in
+- * @len_ptr: pointer to a length field, the kernel fills in the header size
++ * sys_get_robust_list() - Get the robust-futex list head of a task
++ * @pid:	pid of the process [zero for current task]
++ * @head_ptr:	pointer to a list-head pointer, the kernel fills it in
++ * @len_ptr:	pointer to a length field, the kernel fills in the header size
+  */
+ SYSCALL_DEFINE3(get_robust_list, int, pid,
+ 		struct robust_list_head __user * __user *, head_ptr,
+Index: linux-rt-2.6.31/kernel/futex_compat.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/futex_compat.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/futex_compat.c	2010-05-17 14:23:20.078410414 +0200
+@@ -146,7 +146,7 @@
+ 		struct task_struct *p;
+ 
+ 		ret = -ESRCH;
+-		read_lock(&tasklist_lock);
++		rcu_read_lock();
+ 		p = find_task_by_vpid(pid);
+ 		if (!p)
+ 			goto err_unlock;
+@@ -157,7 +157,7 @@
+ 		    !capable(CAP_SYS_PTRACE))
+ 			goto err_unlock;
+ 		head = p->compat_robust_list;
+-		read_unlock(&tasklist_lock);
++		rcu_read_unlock();
+ 	}
+ 
+ 	if (put_user(sizeof(*head), len_ptr))
+@@ -165,7 +165,7 @@
+ 	return put_user(ptr_to_compat(head), head_ptr);
+ 
+ err_unlock:
+-	read_unlock(&tasklist_lock);
++	rcu_read_unlock();
+ 
+ 	return ret;
+ }
+Index: linux-rt-2.6.31/kernel/hrtimer.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/hrtimer.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/hrtimer.c	2010-05-17 14:23:20.078410414 +0200
+@@ -48,36 +48,7 @@
+ 
+ #include <asm/uaccess.h>
+ 
+-/**
+- * ktime_get - get the monotonic time in ktime_t format
+- *
+- * returns the time in ktime_t format
+- */
+-ktime_t ktime_get(void)
+-{
+-	struct timespec now;
+-
+-	ktime_get_ts(&now);
+-
+-	return timespec_to_ktime(now);
+-}
+-EXPORT_SYMBOL_GPL(ktime_get);
+-
+-/**
+- * ktime_get_real - get the real (wall-) time in ktime_t format
+- *
+- * returns the time in ktime_t format
+- */
+-ktime_t ktime_get_real(void)
+-{
+-	struct timespec now;
+-
+-	getnstimeofday(&now);
+-
+-	return timespec_to_ktime(now);
+-}
+-
+-EXPORT_SYMBOL_GPL(ktime_get_real);
++#include <trace/events/hist.h>
+ 
+ /*
+  * The timer bases:
+@@ -106,31 +77,6 @@
+ 	}
+ };
+ 
+-/**
+- * ktime_get_ts - get the monotonic clock in timespec format
+- * @ts:		pointer to timespec variable
+- *
+- * The function calculates the monotonic clock from the realtime
+- * clock and the wall_to_monotonic offset and stores the result
+- * in normalized timespec format in the variable pointed to by @ts.
+- */
+-void ktime_get_ts(struct timespec *ts)
+-{
+-	struct timespec tomono;
+-	unsigned long seq;
+-
+-	do {
+-		seq = read_seqbegin(&xtime_lock);
+-		getnstimeofday(ts);
+-		tomono = wall_to_monotonic;
+-
+-	} while (read_seqretry(&xtime_lock, seq));
+-
+-	set_normalized_timespec(ts, ts->tv_sec + tomono.tv_sec,
+-				ts->tv_nsec + tomono.tv_nsec);
+-}
+-EXPORT_SYMBOL_GPL(ktime_get_ts);
+-
+ /*
+  * Get the coarse grained time at the softirq based on xtime and
+  * wall_to_monotonic.
+@@ -142,10 +88,10 @@
+ 	unsigned long seq;
+ 
+ 	do {
+-		seq = read_seqbegin(&xtime_lock);
++		seq = read_atomic_seqbegin(&xtime_lock);
+ 		xts = current_kernel_time();
+ 		tom = wall_to_monotonic;
+-	} while (read_seqretry(&xtime_lock, seq));
++	} while (read_atomic_seqretry(&xtime_lock, seq));
+ 
+ 	xtim = timespec_to_ktime(xts);
+ 	tomono = timespec_to_ktime(tom);
+@@ -181,11 +127,12 @@
+ 	for (;;) {
+ 		base = timer->base;
+ 		if (likely(base != NULL)) {
+-			spin_lock_irqsave(&base->cpu_base->lock, *flags);
++			atomic_spin_lock_irqsave(&base->cpu_base->lock, *flags);
+ 			if (likely(base == timer->base))
+ 				return base;
+ 			/* The timer has migrated to another CPU: */
+-			spin_unlock_irqrestore(&base->cpu_base->lock, *flags);
++			atomic_spin_unlock_irqrestore(&base->cpu_base->lock,
++						      *flags);
+ 		}
+ 		cpu_relax();
+ 	}
+@@ -262,13 +209,13 @@
+ 
+ 		/* See the comment in lock_timer_base() */
+ 		timer->base = NULL;
+-		spin_unlock(&base->cpu_base->lock);
+-		spin_lock(&new_base->cpu_base->lock);
++		atomic_spin_unlock(&base->cpu_base->lock);
++		atomic_spin_lock(&new_base->cpu_base->lock);
+ 
+ 		if (cpu != this_cpu && hrtimer_check_target(timer, new_base)) {
+ 			cpu = this_cpu;
+-			spin_unlock(&new_base->cpu_base->lock);
+-			spin_lock(&base->cpu_base->lock);
++			atomic_spin_unlock(&new_base->cpu_base->lock);
++			atomic_spin_lock(&base->cpu_base->lock);
+ 			timer->base = base;
+ 			goto again;
+ 		}
+@@ -284,7 +231,7 @@
+ {
+ 	struct hrtimer_clock_base *base = timer->base;
+ 
+-	spin_lock_irqsave(&base->cpu_base->lock, *flags);
++	atomic_spin_lock_irqsave(&base->cpu_base->lock, *flags);
+ 
+ 	return base;
+ }
+@@ -532,9 +479,9 @@
+ /*
+  * Is the high resolution mode active ?
+  */
+-static inline int hrtimer_hres_active(void)
++static inline int hrtimer_hres_active(struct hrtimer_cpu_base *cpu_base)
+ {
+-	return __get_cpu_var(hrtimer_bases).hres_active;
++	return cpu_base->hres_active;
+ }
+ 
+ /*
+@@ -594,8 +541,7 @@
+ 	 * When the callback is running, we do not reprogram the clock event
+ 	 * device. The timer callback is either running on a different CPU or
+ 	 * the callback is executed in the hrtimer_interrupt context. The
+-	 * reprogramming is handled either by the softirq, which called the
+-	 * callback or at the end of the hrtimer_interrupt.
++	 * reprogramming is handled at the end of the hrtimer_interrupt.
+ 	 */
+ 	if (hrtimer_callback_running(timer))
+ 		return 0;
+@@ -629,29 +575,27 @@
+  */
+ static void retrigger_next_event(void *arg)
+ {
+-	struct hrtimer_cpu_base *base;
++	struct hrtimer_cpu_base *base = &__get_cpu_var(hrtimer_bases);
+ 	struct timespec realtime_offset;
+ 	unsigned long seq;
+ 
+-	if (!hrtimer_hres_active())
++	if (!hrtimer_hres_active(base))
+ 		return;
+ 
+ 	do {
+-		seq = read_seqbegin(&xtime_lock);
++		seq = read_atomic_seqbegin(&xtime_lock);
+ 		set_normalized_timespec(&realtime_offset,
+ 					-wall_to_monotonic.tv_sec,
+ 					-wall_to_monotonic.tv_nsec);
+-	} while (read_seqretry(&xtime_lock, seq));
+-
+-	base = &__get_cpu_var(hrtimer_bases);
++	} while (read_atomic_seqretry(&xtime_lock, seq));
+ 
+ 	/* Adjust CLOCK_REALTIME offset */
+-	spin_lock(&base->lock);
++	atomic_spin_lock(&base->lock);
+ 	base->clock_base[CLOCK_REALTIME].offset =
+ 		timespec_to_ktime(realtime_offset);
+ 
+ 	hrtimer_force_reprogram(base);
+-	spin_unlock(&base->lock);
++	atomic_spin_unlock(&base->lock);
+ }
+ 
+ /*
+@@ -699,6 +643,8 @@
+ {
+ }
+ 
++static void __run_hrtimer(struct hrtimer *timer);
++static int hrtimer_rt_defer(struct hrtimer *timer);
+ 
+ /*
+  * When High resolution timers are active, try to reprogram. Note, that in case
+@@ -710,11 +656,31 @@
+ 					    struct hrtimer_clock_base *base,
+ 					    int wakeup)
+ {
++#ifdef CONFIG_PREEMPT_RT
++again:
++#endif
+ 	if (base->cpu_base->hres_active && hrtimer_reprogram(timer, base)) {
++#ifdef CONFIG_PREEMPT_RT
++		/*
++		 * Move softirq based timers away from the rbtree in
++		 * case it expired already. Otherwise we would have a
++		 * stale base->first entry until the softirq runs.
++		 */
++		if (!hrtimer_rt_defer(timer)) {
++			__run_hrtimer(timer);
++			/*
++			 * __run_hrtimer might have requeued timer and
++			 * it could be base->first again.
++			 */
++			if (base->first == &timer->node)
++				goto again;
++			return 1;
++		}
++#endif
+ 		if (wakeup) {
+-			spin_unlock(&base->cpu_base->lock);
++			atomic_spin_unlock(&base->cpu_base->lock);
+ 			raise_softirq_irqoff(HRTIMER_SOFTIRQ);
+-			spin_lock(&base->cpu_base->lock);
++			atomic_spin_lock(&base->cpu_base->lock);
+ 		} else
+ 			__raise_softirq_irqoff(HRTIMER_SOFTIRQ);
+ 
+@@ -727,10 +693,8 @@
+ /*
+  * Switch to high resolution mode
+  */
+-static int hrtimer_switch_to_hres(void)
++static int hrtimer_switch_to_hres(struct hrtimer_cpu_base *base)
+ {
+-	int cpu = smp_processor_id();
+-	struct hrtimer_cpu_base *base = &per_cpu(hrtimer_bases, cpu);
+ 	unsigned long flags;
+ 
+ 	if (base->hres_active)
+@@ -741,7 +705,7 @@
+ 	if (tick_init_highres()) {
+ 		local_irq_restore(flags);
+ 		printk(KERN_WARNING "Could not switch to high resolution "
+-				    "mode on CPU %d\n", cpu);
++		       "mode on CPU %d\n", raw_smp_processor_id());
+ 		return 0;
+ 	}
+ 	base->hres_active = 1;
+@@ -753,16 +717,20 @@
+ 	/* "Retrigger" the interrupt to get things going */
+ 	retrigger_next_event(NULL);
+ 	local_irq_restore(flags);
+-	printk(KERN_DEBUG "Switched to high resolution mode on CPU %d\n",
+-	       smp_processor_id());
+ 	return 1;
+ }
+ 
+ #else
+ 
+-static inline int hrtimer_hres_active(void) { return 0; }
++static inline int hrtimer_hres_active(struct hrtimer_cpu_base *base)
++{
++	return 0;
++}
+ static inline int hrtimer_is_hres_enabled(void) { return 0; }
+-static inline int hrtimer_switch_to_hres(void) { return 0; }
++static inline int hrtimer_switch_to_hres(struct hrtimer_cpu_base *base)
++{
++	return 0;
++}
+ static inline void hrtimer_force_reprogram(struct hrtimer_cpu_base *base) { }
+ static inline int hrtimer_enqueue_reprogram(struct hrtimer *timer,
+ 					    struct hrtimer_clock_base *base,
+@@ -770,6 +738,13 @@
+ {
+ 	return 0;
+ }
++
++static inline int hrtimer_reprogram(struct hrtimer *timer,
++				    struct hrtimer_clock_base *base)
++{
++	return 0;
++}
++
+ static inline void hrtimer_init_hres(struct hrtimer_cpu_base *base) { }
+ static inline void hrtimer_init_timer_hres(struct hrtimer *timer) { }
+ 
+@@ -793,7 +768,7 @@
+ static inline
+ void unlock_hrtimer_base(const struct hrtimer *timer, unsigned long *flags)
+ {
+-	spin_unlock_irqrestore(&timer->base->cpu_base->lock, *flags);
++	atomic_spin_unlock_irqrestore(&timer->base->cpu_base->lock, *flags);
+ }
+ 
+ /**
+@@ -892,6 +867,32 @@
+ 	return leftmost;
+ }
+ 
++#ifdef CONFIG_PREEMPT_SOFTIRQS
++# define wake_up_timer_waiters(b)	wake_up(&(b)->wait)
++
++/**
++ * hrtimer_wait_for_timer - Wait for a running timer
++ *
++ * @timer:	timer to wait for
++ *
++ * The function waits in case the timers callback function is
++ * currently executed on the waitqueue of the timer base. The
++ * waitqueue is woken up after the timer callback function has
++ * finished execution.
++ */
++void hrtimer_wait_for_timer(const struct hrtimer *timer)
++{
++	struct hrtimer_clock_base *base = timer->base;
++
++	if (base && base->cpu_base && !timer->irqsafe)
++		wait_event(base->cpu_base->wait,
++			   !(timer->state & HRTIMER_STATE_CALLBACK));
++}
++
++#else
++# define wake_up_timer_waiters(b)	do { } while (0)
++#endif
++
+ /*
+  * __remove_hrtimer - internal function to remove a timer
+  *
+@@ -907,6 +908,11 @@
+ 			     unsigned long newstate, int reprogram)
+ {
+ 	if (timer->state & HRTIMER_STATE_ENQUEUED) {
++
++		if (unlikely(!list_empty(&timer->cb_entry))) {
++			list_del_init(&timer->cb_entry);
++			goto out;
++		}
+ 		/*
+ 		 * Remove the timer from the rbtree and replace the
+ 		 * first entry pointer if necessary.
+@@ -914,11 +920,12 @@
+ 		if (base->first == &timer->node) {
+ 			base->first = rb_next(&timer->node);
+ 			/* Reprogram the clock event device. if enabled */
+-			if (reprogram && hrtimer_hres_active())
++			if (reprogram && hrtimer_hres_active(base->cpu_base))
+ 				hrtimer_force_reprogram(base->cpu_base);
+ 		}
+ 		rb_erase(&timer->node, &base->active);
+ 	}
++out:
+ 	timer->state = newstate;
+ }
+ 
+@@ -1078,7 +1085,7 @@
+ 
+ 		if (ret >= 0)
+ 			return ret;
+-		cpu_relax();
++		hrtimer_wait_for_timer(timer);
+ 	}
+ }
+ EXPORT_SYMBOL_GPL(hrtimer_cancel);
+@@ -1116,9 +1123,9 @@
+ 	unsigned long flags;
+ 	int i;
+ 
+-	spin_lock_irqsave(&cpu_base->lock, flags);
++	atomic_spin_lock_irqsave(&cpu_base->lock, flags);
+ 
+-	if (!hrtimer_hres_active()) {
++	if (!hrtimer_hres_active(cpu_base)) {
+ 		for (i = 0; i < HRTIMER_MAX_CLOCK_BASES; i++, base++) {
+ 			struct hrtimer *timer;
+ 
+@@ -1133,7 +1140,7 @@
+ 		}
+ 	}
+ 
+-	spin_unlock_irqrestore(&cpu_base->lock, flags);
++	atomic_spin_unlock_irqrestore(&cpu_base->lock, flags);
+ 
+ 	if (mindelta.tv64 < 0)
+ 		mindelta.tv64 = 0;
+@@ -1216,9 +1223,9 @@
+ 	 * they get migrated to another cpu, therefore its safe to unlock
+ 	 * the timer base.
+ 	 */
+-	spin_unlock(&cpu_base->lock);
++	atomic_spin_unlock(&cpu_base->lock);
+ 	restart = fn(timer);
+-	spin_lock(&cpu_base->lock);
++	atomic_spin_lock(&cpu_base->lock);
+ 
+ 	/*
+ 	 * Note: We clear the CALLBACK bit after enqueue_hrtimer and
+@@ -1232,9 +1239,119 @@
+ 	timer->state &= ~HRTIMER_STATE_CALLBACK;
+ }
+ 
++#ifdef CONFIG_PREEMPT_RT
++
++static void hrtimer_rt_reprogram(int restart, struct hrtimer *timer,
++				 struct hrtimer_clock_base *base)
++{
++	/*
++	 * Note, we clear the callback flag before we requeue the
++	 * timer otherwise we trigger the callback_running() check
++	 * in hrtimer_reprogram().
++	 */
++	timer->state &= ~HRTIMER_STATE_CALLBACK;
++
++	if (restart != HRTIMER_NORESTART) {
++		BUG_ON(hrtimer_active(timer));
++		/*
++		 * Enqueue the timer, if it's the leftmost timer then
++		 * we need to reprogram it.
++		 */
++		if (!enqueue_hrtimer(timer, base))
++			return;
++
++		if (hrtimer_reprogram(timer, base))
++			goto requeue;
++
++	} else if (hrtimer_active(timer)) {
++		/*
++		 * If the timer was rearmed on another CPU, reprogram
++		 * the event device.
++		 */
++		if (base->first == &timer->node &&
++		    hrtimer_reprogram(timer, base))
++			goto requeue;
++	}
++	return;
++
++requeue:
++	/*
++	 * Timer is expired. Thus move it from tree to pending list
++	 * again.
++	 */
++	__remove_hrtimer(timer, base, timer->state, 0);
++	list_add_tail(&timer->cb_entry, &base->expired);
++}
++
++/*
++ * The changes in mainline which removed the callback modes from
++ * hrtimer are not yet working with -rt. The non wakeup_process()
++ * based callbacks which involve sleeping locks need to be treated
++ * seperately.
++ */
++static void hrtimer_rt_run_pending(void)
++{
++	enum hrtimer_restart (*fn)(struct hrtimer *);
++	struct hrtimer_cpu_base *cpu_base;
++	struct hrtimer_clock_base *base;
++	struct hrtimer *timer;
++	int index, restart;
++
++	local_irq_disable();
++	cpu_base = &per_cpu(hrtimer_bases, smp_processor_id());
++
++	atomic_spin_lock(&cpu_base->lock);
++
++	for (index = 0; index < HRTIMER_MAX_CLOCK_BASES; index++) {
++		base = &cpu_base->clock_base[index];
++
++		while (!list_empty(&base->expired)) {
++			timer = list_first_entry(&base->expired,
++						 struct hrtimer, cb_entry);
++
++			/*
++			 * Same as the above __run_hrtimer function
++			 * just we run with interrupts enabled.
++			 */
++			debug_hrtimer_deactivate(timer);
++			__remove_hrtimer(timer, base, HRTIMER_STATE_CALLBACK, 0);
++			timer_stats_account_hrtimer(timer);
++			fn = timer->function;
++
++			atomic_spin_unlock_irq(&cpu_base->lock);
++			restart = fn(timer);
++			atomic_spin_lock_irq(&cpu_base->lock);
++
++			hrtimer_rt_reprogram(restart, timer, base);
++		}
++	}
++
++	atomic_spin_unlock_irq(&cpu_base->lock);
++
++	wake_up_timer_waiters(cpu_base);
++}
++
++static int hrtimer_rt_defer(struct hrtimer *timer)
++{
++	if (timer->irqsafe)
++		return 0;
++
++	__remove_hrtimer(timer, timer->base, timer->state, 0);
++	list_add_tail(&timer->cb_entry, &timer->base->expired);
++	return 1;
++}
++
++#else
++
++static inline void hrtimer_rt_run_pending(void) { }
++static inline int hrtimer_rt_defer(struct hrtimer *timer) { return 0; }
++
++#endif
++
+ #ifdef CONFIG_HIGH_RES_TIMERS
+ 
+ static int force_clock_reprogram;
++static enum hrtimer_restart hrtimer_wakeup(struct hrtimer *timer);
+ 
+ /*
+  * After 5 iteration's attempts, we consider that hrtimer_interrupt()
+@@ -1267,7 +1384,7 @@
+ 	struct hrtimer_clock_base *base;
+ 	ktime_t expires_next, now;
+ 	int nr_retries = 0;
+-	int i;
++	int i, raise = 0;
+ 
+ 	BUG_ON(!cpu_base->hres_active);
+ 	cpu_base->nr_events++;
+@@ -1282,7 +1399,7 @@
+ 
+ 	expires_next.tv64 = KTIME_MAX;
+ 
+-	spin_lock(&cpu_base->lock);
++	atomic_spin_lock(&cpu_base->lock);
+ 	/*
+ 	 * We set expires_next to KTIME_MAX here with cpu_base->lock
+ 	 * held to prevent that a timer is enqueued in our queue via
+@@ -1305,6 +1422,14 @@
+ 
+ 			timer = rb_entry(node, struct hrtimer, node);
+ 
++			trace_hrtimer_interrupt(raw_smp_processor_id(),
++			    ktime_to_ns(ktime_sub(
++				hrtimer_get_expires(timer), basenow)),
++			    current,
++			    timer->function == hrtimer_wakeup ?
++			    container_of(timer, struct hrtimer_sleeper,
++				timer)->task : NULL);
++
+ 			/*
+ 			 * The immediate goal for using the softexpires is
+ 			 * minimizing wakeups, not running timers at the
+@@ -1328,7 +1453,10 @@
+ 				break;
+ 			}
+ 
+-			__run_hrtimer(timer);
++			if (!hrtimer_rt_defer(timer))
++				__run_hrtimer(timer);
++			else
++				raise = 1;
+ 		}
+ 		base++;
+ 	}
+@@ -1338,13 +1466,16 @@
+ 	 * against it.
+ 	 */
+ 	cpu_base->expires_next = expires_next;
+-	spin_unlock(&cpu_base->lock);
++	atomic_spin_unlock(&cpu_base->lock);
+ 
+ 	/* Reprogramming necessary ? */
+ 	if (expires_next.tv64 != KTIME_MAX) {
+ 		if (tick_program_event(expires_next, force_clock_reprogram))
+ 			goto retry;
+ 	}
++
++	if (raise)
++		raise_softirq_irqoff(HRTIMER_SOFTIRQ);
+ }
+ 
+ /*
+@@ -1353,9 +1484,11 @@
+  */
+ static void __hrtimer_peek_ahead_timers(void)
+ {
++	struct hrtimer_cpu_base *cpu_base;
+ 	struct tick_device *td;
+ 
+-	if (!hrtimer_hres_active())
++	cpu_base = &__get_cpu_var(hrtimer_bases);
++	if (!hrtimer_hres_active(cpu_base))
+ 		return;
+ 
+ 	td = &__get_cpu_var(tick_cpu_device);
+@@ -1381,17 +1514,17 @@
+ 	local_irq_restore(flags);
+ }
+ 
+-static void run_hrtimer_softirq(struct softirq_action *h)
+-{
+-	hrtimer_peek_ahead_timers();
+-}
+-
+ #else /* CONFIG_HIGH_RES_TIMERS */
+ 
+ static inline void __hrtimer_peek_ahead_timers(void) { }
+ 
+ #endif	/* !CONFIG_HIGH_RES_TIMERS */
+ 
++static void run_hrtimer_softirq(struct softirq_action *h)
++{
++	hrtimer_rt_run_pending();
++}
++
+ /*
+  * Called from timer softirq every jiffy, expire hrtimers:
+  *
+@@ -1401,7 +1534,9 @@
+  */
+ void hrtimer_run_pending(void)
+ {
+-	if (hrtimer_hres_active())
++	struct hrtimer_cpu_base *cpu_base = &__get_cpu_var(hrtimer_bases);
++
++	if (hrtimer_hres_active(cpu_base))
+ 		return;
+ 
+ 	/*
+@@ -1413,7 +1548,7 @@
+ 	 * deadlock vs. xtime_lock.
+ 	 */
+ 	if (tick_check_oneshot_change(!hrtimer_is_hres_enabled()))
+-		hrtimer_switch_to_hres();
++		hrtimer_switch_to_hres(cpu_base);
+ }
+ 
+ /*
+@@ -1422,11 +1557,12 @@
+ void hrtimer_run_queues(void)
+ {
+ 	struct rb_node *node;
+-	struct hrtimer_cpu_base *cpu_base = &__get_cpu_var(hrtimer_bases);
++	struct hrtimer_cpu_base *cpu_base;
+ 	struct hrtimer_clock_base *base;
+-	int index, gettime = 1;
++	int index, gettime = 1, raise = 0;
+ 
+-	if (hrtimer_hres_active())
++	cpu_base = &per_cpu(hrtimer_bases, raw_smp_processor_id());
++	if (hrtimer_hres_active(cpu_base))
+ 		return;
+ 
+ 	for (index = 0; index < HRTIMER_MAX_CLOCK_BASES; index++) {
+@@ -1440,7 +1576,7 @@
+ 			gettime = 0;
+ 		}
+ 
+-		spin_lock(&cpu_base->lock);
++		atomic_spin_lock(&cpu_base->lock);
+ 
+ 		while ((node = base->first)) {
+ 			struct hrtimer *timer;
+@@ -1450,10 +1586,16 @@
+ 					hrtimer_get_expires_tv64(timer))
+ 				break;
+ 
+-			__run_hrtimer(timer);
++			if (!hrtimer_rt_defer(timer))
++				__run_hrtimer(timer);
++			else
++				raise = 1;
+ 		}
+-		spin_unlock(&cpu_base->lock);
++		atomic_spin_unlock(&cpu_base->lock);
+ 	}
++
++	if (raise)
++		raise_softirq_irqoff(HRTIMER_SOFTIRQ);
+ }
+ 
+ /*
+@@ -1475,6 +1617,7 @@
+ void hrtimer_init_sleeper(struct hrtimer_sleeper *sl, struct task_struct *task)
+ {
+ 	sl->timer.function = hrtimer_wakeup;
++	sl->timer.irqsafe = 1;
+ 	sl->task = task;
+ }
+ 
+@@ -1607,12 +1750,17 @@
+ 	struct hrtimer_cpu_base *cpu_base = &per_cpu(hrtimer_bases, cpu);
+ 	int i;
+ 
+-	spin_lock_init(&cpu_base->lock);
++	atomic_spin_lock_init(&cpu_base->lock);
+ 
+-	for (i = 0; i < HRTIMER_MAX_CLOCK_BASES; i++)
++	for (i = 0; i < HRTIMER_MAX_CLOCK_BASES; i++) {
+ 		cpu_base->clock_base[i].cpu_base = cpu_base;
++		INIT_LIST_HEAD(&cpu_base->clock_base[i].expired);
++	}
+ 
+ 	hrtimer_init_hres(cpu_base);
++#ifdef CONFIG_PREEMPT_RT
++	init_waitqueue_head(&cpu_base->wait);
++#endif
+ }
+ 
+ #ifdef CONFIG_HOTPLUG_CPU
+@@ -1665,16 +1813,16 @@
+ 	 * The caller is globally serialized and nobody else
+ 	 * takes two locks at once, deadlock is not possible.
+ 	 */
+-	spin_lock(&new_base->lock);
+-	spin_lock_nested(&old_base->lock, SINGLE_DEPTH_NESTING);
++	atomic_spin_lock(&new_base->lock);
++	atomic_spin_lock_nested(&old_base->lock, SINGLE_DEPTH_NESTING);
+ 
+ 	for (i = 0; i < HRTIMER_MAX_CLOCK_BASES; i++) {
+ 		migrate_hrtimer_list(&old_base->clock_base[i],
+ 				     &new_base->clock_base[i]);
+ 	}
+ 
+-	spin_unlock(&old_base->lock);
+-	spin_unlock(&new_base->lock);
++	atomic_spin_unlock(&old_base->lock);
++	atomic_spin_unlock(&new_base->lock);
+ 
+ 	/* Check, if we got expired work to do */
+ 	__hrtimer_peek_ahead_timers();
+@@ -1725,9 +1873,7 @@
+ 	hrtimer_cpu_notify(&hrtimers_nb, (unsigned long)CPU_UP_PREPARE,
+ 			  (void *)(long)smp_processor_id());
+ 	register_cpu_notifier(&hrtimers_nb);
+-#ifdef CONFIG_HIGH_RES_TIMERS
+ 	open_softirq(HRTIMER_SOFTIRQ, run_hrtimer_softirq);
+-#endif
+ }
+ 
+ /**
+Index: linux-rt-2.6.31/kernel/irq/autoprobe.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/irq/autoprobe.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/irq/autoprobe.c	2010-05-17 14:23:20.078410414 +0200
+@@ -45,7 +45,7 @@
+ 	 * flush such a longstanding irq before considering it as spurious.
+ 	 */
+ 	for_each_irq_desc_reverse(i, desc) {
+-		spin_lock_irq(&desc->lock);
++		atomic_spin_lock_irq(&desc->lock);
+ 		if (!desc->action && !(desc->status & IRQ_NOPROBE)) {
+ 			/*
+ 			 * An old-style architecture might still have
+@@ -61,7 +61,7 @@
+ 				desc->chip->set_type(i, IRQ_TYPE_PROBE);
+ 			desc->chip->startup(i);
+ 		}
+-		spin_unlock_irq(&desc->lock);
++		atomic_spin_unlock_irq(&desc->lock);
+ 	}
+ 
+ 	/* Wait for longstanding interrupts to trigger. */
+@@ -73,13 +73,13 @@
+ 	 * happened in the previous stage, it may have masked itself)
+ 	 */
+ 	for_each_irq_desc_reverse(i, desc) {
+-		spin_lock_irq(&desc->lock);
++		atomic_spin_lock_irq(&desc->lock);
+ 		if (!desc->action && !(desc->status & IRQ_NOPROBE)) {
+ 			desc->status |= IRQ_AUTODETECT | IRQ_WAITING;
+ 			if (desc->chip->startup(i))
+ 				desc->status |= IRQ_PENDING;
+ 		}
+-		spin_unlock_irq(&desc->lock);
++		atomic_spin_unlock_irq(&desc->lock);
+ 	}
+ 
+ 	/*
+@@ -91,7 +91,7 @@
+ 	 * Now filter out any obviously spurious interrupts
+ 	 */
+ 	for_each_irq_desc(i, desc) {
+-		spin_lock_irq(&desc->lock);
++		atomic_spin_lock_irq(&desc->lock);
+ 		status = desc->status;
+ 
+ 		if (status & IRQ_AUTODETECT) {
+@@ -103,7 +103,7 @@
+ 				if (i < 32)
+ 					mask |= 1 << i;
+ 		}
+-		spin_unlock_irq(&desc->lock);
++		atomic_spin_unlock_irq(&desc->lock);
+ 	}
+ 
+ 	return mask;
+@@ -129,7 +129,7 @@
+ 	int i;
+ 
+ 	for_each_irq_desc(i, desc) {
+-		spin_lock_irq(&desc->lock);
++		atomic_spin_lock_irq(&desc->lock);
+ 		status = desc->status;
+ 
+ 		if (status & IRQ_AUTODETECT) {
+@@ -139,7 +139,7 @@
+ 			desc->status = status & ~IRQ_AUTODETECT;
+ 			desc->chip->shutdown(i);
+ 		}
+-		spin_unlock_irq(&desc->lock);
++		atomic_spin_unlock_irq(&desc->lock);
+ 	}
+ 	mutex_unlock(&probing_active);
+ 
+@@ -171,7 +171,7 @@
+ 	unsigned int status;
+ 
+ 	for_each_irq_desc(i, desc) {
+-		spin_lock_irq(&desc->lock);
++		atomic_spin_lock_irq(&desc->lock);
+ 		status = desc->status;
+ 
+ 		if (status & IRQ_AUTODETECT) {
+@@ -183,7 +183,7 @@
+ 			desc->status = status & ~IRQ_AUTODETECT;
+ 			desc->chip->shutdown(i);
+ 		}
+-		spin_unlock_irq(&desc->lock);
++		atomic_spin_unlock_irq(&desc->lock);
+ 	}
+ 	mutex_unlock(&probing_active);
+ 
+Index: linux-rt-2.6.31/kernel/irq/chip.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/irq/chip.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/irq/chip.c	2010-05-17 14:23:20.078410414 +0200
+@@ -34,7 +34,7 @@
+ 	}
+ 
+ 	/* Ensure we don't have left over values from a previous use of this irq */
+-	spin_lock_irqsave(&desc->lock, flags);
++	atomic_spin_lock_irqsave(&desc->lock, flags);
+ 	desc->status = IRQ_DISABLED;
+ 	desc->chip = &no_irq_chip;
+ 	desc->handle_irq = handle_bad_irq;
+@@ -51,7 +51,7 @@
+ 	cpumask_clear(desc->pending_mask);
+ #endif
+ #endif
+-	spin_unlock_irqrestore(&desc->lock, flags);
++	atomic_spin_unlock_irqrestore(&desc->lock, flags);
+ }
+ 
+ /**
+@@ -68,9 +68,9 @@
+ 		return;
+ 	}
+ 
+-	spin_lock_irqsave(&desc->lock, flags);
++	atomic_spin_lock_irqsave(&desc->lock, flags);
+ 	if (desc->action) {
+-		spin_unlock_irqrestore(&desc->lock, flags);
++		atomic_spin_unlock_irqrestore(&desc->lock, flags);
+ 		WARN(1, KERN_ERR "Destroying IRQ%d without calling free_irq\n",
+ 			irq);
+ 		return;
+@@ -82,7 +82,7 @@
+ 	desc->chip = &no_irq_chip;
+ 	desc->name = NULL;
+ 	clear_kstat_irqs(desc);
+-	spin_unlock_irqrestore(&desc->lock, flags);
++	atomic_spin_unlock_irqrestore(&desc->lock, flags);
+ }
+ 
+ 
+@@ -104,10 +104,10 @@
+ 	if (!chip)
+ 		chip = &no_irq_chip;
+ 
+-	spin_lock_irqsave(&desc->lock, flags);
++	atomic_spin_lock_irqsave(&desc->lock, flags);
+ 	irq_chip_set_defaults(chip);
+ 	desc->chip = chip;
+-	spin_unlock_irqrestore(&desc->lock, flags);
++	atomic_spin_unlock_irqrestore(&desc->lock, flags);
+ 
+ 	return 0;
+ }
+@@ -133,9 +133,9 @@
+ 	if (type == IRQ_TYPE_NONE)
+ 		return 0;
+ 
+-	spin_lock_irqsave(&desc->lock, flags);
++	atomic_spin_lock_irqsave(&desc->lock, flags);
+ 	ret = __irq_set_trigger(desc, irq, type);
+-	spin_unlock_irqrestore(&desc->lock, flags);
++	atomic_spin_unlock_irqrestore(&desc->lock, flags);
+ 	return ret;
+ }
+ EXPORT_SYMBOL(set_irq_type);
+@@ -158,9 +158,9 @@
+ 		return -EINVAL;
+ 	}
+ 
+-	spin_lock_irqsave(&desc->lock, flags);
++	atomic_spin_lock_irqsave(&desc->lock, flags);
+ 	desc->handler_data = data;
+-	spin_unlock_irqrestore(&desc->lock, flags);
++	atomic_spin_unlock_irqrestore(&desc->lock, flags);
+ 	return 0;
+ }
+ EXPORT_SYMBOL(set_irq_data);
+@@ -183,11 +183,11 @@
+ 		return -EINVAL;
+ 	}
+ 
+-	spin_lock_irqsave(&desc->lock, flags);
++	atomic_spin_lock_irqsave(&desc->lock, flags);
+ 	desc->msi_desc = entry;
+ 	if (entry)
+ 		entry->irq = irq;
+-	spin_unlock_irqrestore(&desc->lock, flags);
++	atomic_spin_unlock_irqrestore(&desc->lock, flags);
+ 	return 0;
+ }
+ 
+@@ -214,14 +214,42 @@
+ 		return -EINVAL;
+ 	}
+ 
+-	spin_lock_irqsave(&desc->lock, flags);
++	atomic_spin_lock_irqsave(&desc->lock, flags);
+ 	desc->chip_data = data;
+-	spin_unlock_irqrestore(&desc->lock, flags);
++	atomic_spin_unlock_irqrestore(&desc->lock, flags);
+ 
+ 	return 0;
+ }
+ EXPORT_SYMBOL(set_irq_chip_data);
+ 
++/**
++ *	set_irq_nested_thread - Set/Reset the IRQ_NESTED_THREAD flag of an irq
++ *
++ *	@irq:	Interrupt number
++ *	@nest:	0 to clear / 1 to set the IRQ_NESTED_THREAD flag
++ *
++ *	The IRQ_NESTED_THREAD flag indicates that on
++ *	request_threaded_irq() no separate interrupt thread should be
++ *	created for the irq as the handler are called nested in the
++ *	context of a demultiplexing interrupt handler thread.
++ */
++void set_irq_nested_thread(unsigned int irq, int nest)
++{
++	struct irq_desc *desc = irq_to_desc(irq);
++	unsigned long flags;
++
++	if (!desc)
++		return;
++
++	atomic_spin_lock_irqsave(&desc->lock, flags);
++	if (nest)
++		desc->status |= IRQ_NESTED_THREAD;
++	else
++		desc->status &= ~IRQ_NESTED_THREAD;
++	atomic_spin_unlock_irqrestore(&desc->lock, flags);
++}
++EXPORT_SYMBOL_GPL(set_irq_nested_thread);
++
+ /*
+  * default enable function
+  */
+@@ -247,6 +275,7 @@
+ {
+ 	struct irq_desc *desc = irq_to_desc(irq);
+ 
++	desc->status &= ~IRQ_MASKED;
+ 	desc->chip->enable(irq);
+ 	return 0;
+ }
+@@ -299,6 +328,45 @@
+ 	}
+ }
+ 
++/*
++ *	handle_nested_irq - Handle a nested irq from a irq thread
++ *	@irq:	the interrupt number
++ *
++ *	Handle interrupts which are nested into a threaded interrupt
++ *	handler. The handler function is called inside the calling
++ *	threads context.
++ */
++void handle_nested_irq(unsigned int irq)
++{
++	struct irq_desc *desc = irq_to_desc(irq);
++	struct irqaction *action;
++	irqreturn_t action_ret;
++
++	might_sleep();
++
++	atomic_spin_lock_irq(&desc->lock);
++
++	kstat_incr_irqs_this_cpu(irq, desc);
++
++	action = desc->action;
++	if (unlikely(!action || (desc->status & IRQ_DISABLED)))
++		goto out_unlock;
++
++	desc->status |= IRQ_INPROGRESS;
++	atomic_spin_unlock_irq(&desc->lock);
++
++	action_ret = action->thread_fn(action->irq, action->dev_id);
++	if (!noirqdebug)
++		note_interrupt(irq, desc, action_ret);
++
++	atomic_spin_lock_irq(&desc->lock);
++	desc->status &= ~IRQ_INPROGRESS;
++
++out_unlock:
++	atomic_spin_unlock_irq(&desc->lock);
++}
++EXPORT_SYMBOL_GPL(handle_nested_irq);
++
+ /**
+  *	handle_simple_irq - Simple and software-decoded IRQs.
+  *	@irq:	the interrupt number
+@@ -317,7 +385,7 @@
+ 	struct irqaction *action;
+ 	irqreturn_t action_ret;
+ 
+-	spin_lock(&desc->lock);
++	atomic_spin_lock(&desc->lock);
+ 
+ 	if (unlikely(desc->status & IRQ_INPROGRESS))
+ 		goto out_unlock;
+@@ -329,16 +397,16 @@
+ 		goto out_unlock;
+ 
+ 	desc->status |= IRQ_INPROGRESS;
+-	spin_unlock(&desc->lock);
++	atomic_spin_unlock(&desc->lock);
+ 
+ 	action_ret = handle_IRQ_event(irq, action);
+ 	if (!noirqdebug)
+ 		note_interrupt(irq, desc, action_ret);
+ 
+-	spin_lock(&desc->lock);
++	atomic_spin_lock(&desc->lock);
+ 	desc->status &= ~IRQ_INPROGRESS;
+ out_unlock:
+-	spin_unlock(&desc->lock);
++	atomic_spin_unlock(&desc->lock);
+ }
+ 
+ /**
+@@ -357,7 +425,7 @@
+ 	struct irqaction *action;
+ 	irqreturn_t action_ret;
+ 
+-	spin_lock(&desc->lock);
++	atomic_spin_lock(&desc->lock);
+ 	mask_ack_irq(desc, irq);
+ 
+ 	if (unlikely(desc->status & IRQ_INPROGRESS))
+@@ -374,18 +442,21 @@
+ 		goto out_unlock;
+ 
+ 	desc->status |= IRQ_INPROGRESS;
+-	spin_unlock(&desc->lock);
++	atomic_spin_unlock(&desc->lock);
+ 
+ 	action_ret = handle_IRQ_event(irq, action);
+ 	if (!noirqdebug)
+ 		note_interrupt(irq, desc, action_ret);
+ 
+-	spin_lock(&desc->lock);
++	atomic_spin_lock(&desc->lock);
+ 	desc->status &= ~IRQ_INPROGRESS;
+-	if (!(desc->status & IRQ_DISABLED) && desc->chip->unmask)
++
++	if (unlikely(desc->status & IRQ_ONESHOT))
++		desc->status |= IRQ_MASKED;
++	else if (!(desc->status & IRQ_DISABLED) && desc->chip->unmask)
+ 		desc->chip->unmask(irq);
+ out_unlock:
+-	spin_unlock(&desc->lock);
++	atomic_spin_unlock(&desc->lock);
+ }
+ EXPORT_SYMBOL_GPL(handle_level_irq);
+ 
+@@ -405,7 +476,7 @@
+ 	struct irqaction *action;
+ 	irqreturn_t action_ret;
+ 
+-	spin_lock(&desc->lock);
++	atomic_spin_lock(&desc->lock);
+ 
+ 	if (unlikely(desc->status & IRQ_INPROGRESS))
+ 		goto out;
+@@ -425,20 +496,23 @@
+ 		goto out;
+ 	}
+ 
++	if ((desc->status & IRQ_ONESHOT) && desc->chip->mask)
++		desc->chip->mask(irq);
++
+ 	desc->status |= IRQ_INPROGRESS;
+ 	desc->status &= ~IRQ_PENDING;
+-	spin_unlock(&desc->lock);
++	atomic_spin_unlock(&desc->lock);
+ 
+ 	action_ret = handle_IRQ_event(irq, action);
+ 	if (!noirqdebug)
+ 		note_interrupt(irq, desc, action_ret);
+ 
+-	spin_lock(&desc->lock);
++	atomic_spin_lock(&desc->lock);
+ 	desc->status &= ~IRQ_INPROGRESS;
+ out:
+ 	desc->chip->eoi(irq);
+ 
+-	spin_unlock(&desc->lock);
++	atomic_spin_unlock(&desc->lock);
+ }
+ 
+ /**
+@@ -460,9 +534,14 @@
+ void
+ handle_edge_irq(unsigned int irq, struct irq_desc *desc)
+ {
+-	spin_lock(&desc->lock);
++	atomic_spin_lock(&desc->lock);
+ 
+-	desc->status &= ~(IRQ_REPLAY | IRQ_WAITING);
++	/*
++	 * Edge irqs can be requested with IRQF_ONESHOT set. RT
++	 * (ab)uses this for enforced irq threading, but we do not
++	 * want to mask edge type interrupts. Clear the oneshot flag.
++	 */
++	desc->status &= ~(IRQ_REPLAY | IRQ_WAITING | IRQ_ONESHOT);
+ 
+ 	/*
+ 	 * If we're currently running this IRQ, or its disabled,
+@@ -477,7 +556,6 @@
+ 	}
+ 	kstat_incr_irqs_this_cpu(irq, desc);
+ 
+-	/* Start handling the irq */
+ 	if (desc->chip->ack)
+ 		desc->chip->ack(irq);
+ 
+@@ -506,17 +584,17 @@
+ 		}
+ 
+ 		desc->status &= ~IRQ_PENDING;
+-		spin_unlock(&desc->lock);
++		atomic_spin_unlock(&desc->lock);
+ 		action_ret = handle_IRQ_event(irq, action);
+ 		if (!noirqdebug)
+ 			note_interrupt(irq, desc, action_ret);
+-		spin_lock(&desc->lock);
++		atomic_spin_lock(&desc->lock);
+ 
+ 	} while ((desc->status & (IRQ_PENDING | IRQ_DISABLED)) == IRQ_PENDING);
+ 
+ 	desc->status &= ~IRQ_INPROGRESS;
+ out_unlock:
+-	spin_unlock(&desc->lock);
++	atomic_spin_unlock(&desc->lock);
+ }
+ 
+ /**
+@@ -572,7 +650,8 @@
+ 		desc->chip = &dummy_irq_chip;
+ 	}
+ 
+-	spin_lock_irqsave(&desc->lock, flags);
++	chip_bus_lock(irq, desc);
++	atomic_spin_lock_irqsave(&desc->lock, flags);
+ 
+ 	/* Uninstall? */
+ 	if (handle == handle_bad_irq) {
+@@ -590,7 +669,9 @@
+ 		desc->depth = 0;
+ 		desc->chip->startup(irq);
+ 	}
+-	spin_unlock_irqrestore(&desc->lock, flags);
++
++	atomic_spin_unlock_irqrestore(&desc->lock, flags);
++	chip_bus_sync_unlock(irq, desc);
+ }
+ EXPORT_SYMBOL_GPL(__set_irq_handler);
+ 
+@@ -620,9 +701,9 @@
+ 		return;
+ 	}
+ 
+-	spin_lock_irqsave(&desc->lock, flags);
++	atomic_spin_lock_irqsave(&desc->lock, flags);
+ 	desc->status |= IRQ_NOPROBE;
+-	spin_unlock_irqrestore(&desc->lock, flags);
++	atomic_spin_unlock_irqrestore(&desc->lock, flags);
+ }
+ 
+ void __init set_irq_probe(unsigned int irq)
+@@ -635,7 +716,7 @@
+ 		return;
+ 	}
+ 
+-	spin_lock_irqsave(&desc->lock, flags);
++	atomic_spin_lock_irqsave(&desc->lock, flags);
+ 	desc->status &= ~IRQ_NOPROBE;
+-	spin_unlock_irqrestore(&desc->lock, flags);
++	atomic_spin_unlock_irqrestore(&desc->lock, flags);
+ }
+Index: linux-rt-2.6.31/kernel/irq/handle.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/irq/handle.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/irq/handle.c	2010-05-17 14:23:20.078410414 +0200
+@@ -79,7 +79,7 @@
+ 	.chip	    = &no_irq_chip,
+ 	.handle_irq = handle_bad_irq,
+ 	.depth      = 1,
+-	.lock       = __SPIN_LOCK_UNLOCKED(irq_desc_init.lock),
++	.lock       = __ATOMIC_SPIN_LOCK_UNLOCKED(irq_desc_init.lock),
+ };
+ 
+ void __ref init_kstat_irqs(struct irq_desc *desc, int node, int nr)
+@@ -107,7 +107,7 @@
+ {
+ 	memcpy(desc, &irq_desc_init, sizeof(struct irq_desc));
+ 
+-	spin_lock_init(&desc->lock);
++	atomic_spin_lock_init(&desc->lock);
+ 	desc->irq = irq;
+ #ifdef CONFIG_SMP
+ 	desc->node = node;
+@@ -129,7 +129,7 @@
+ /*
+  * Protect the sparse_irqs:
+  */
+-DEFINE_SPINLOCK(sparse_irq_lock);
++DEFINE_ATOMIC_SPINLOCK(sparse_irq_lock);
+ 
+ struct irq_desc **irq_desc_ptrs __read_mostly;
+ 
+@@ -140,7 +140,7 @@
+ 		.chip	    = &no_irq_chip,
+ 		.handle_irq = handle_bad_irq,
+ 		.depth	    = 1,
+-		.lock	    = __SPIN_LOCK_UNLOCKED(irq_desc_init.lock),
++		.lock	    = __ATOMIC_SPIN_LOCK_UNLOCKED(irq_desc_init.lock),
+ 	}
+ };
+ 
+@@ -208,7 +208,7 @@
+ 	if (desc)
+ 		return desc;
+ 
+-	spin_lock_irqsave(&sparse_irq_lock, flags);
++	atomic_spin_lock_irqsave(&sparse_irq_lock, flags);
+ 
+ 	/* We have to check it to avoid races with another CPU */
+ 	desc = irq_desc_ptrs[irq];
+@@ -230,7 +230,7 @@
+ 	irq_desc_ptrs[irq] = desc;
+ 
+ out_unlock:
+-	spin_unlock_irqrestore(&sparse_irq_lock, flags);
++	atomic_spin_unlock_irqrestore(&sparse_irq_lock, flags);
+ 
+ 	return desc;
+ }
+@@ -243,7 +243,7 @@
+ 		.chip = &no_irq_chip,
+ 		.handle_irq = handle_bad_irq,
+ 		.depth = 1,
+-		.lock = __SPIN_LOCK_UNLOCKED(irq_desc->lock),
++		.lock = __ATOMIC_SPIN_LOCK_UNLOCKED(irq_desc->lock),
+ 	}
+ };
+ 
+@@ -356,6 +356,25 @@
+ 	       "but no thread function available.", irq, action->name);
+ }
+ 
++/*
++ * Momentary workaround until I have a brighter idea how to handle the
++ * accounting of forced threaded (shared) handlers.
++ */
++irqreturn_t handle_irq_action(unsigned int irq, struct irqaction *action)
++{
++	struct irq_desc *desc = irq_to_desc(irq);
++
++	if (desc->status & IRQ_ONESHOT) {
++		unsigned long flags;
++
++		atomic_spin_lock_irqsave(&desc->lock, flags);
++		desc->forced_threads_active |= action->thread_mask;
++		atomic_spin_unlock_irqrestore(&desc->lock, flags);
++		return IRQ_WAKE_THREAD;
++	}
++	return action->handler(irq, action->dev_id);
++}
++
+ /**
+  * handle_IRQ_event - irq action chain handler
+  * @irq:	the interrupt number
+@@ -373,7 +392,7 @@
+ 
+ 	do {
+ 		trace_irq_handler_entry(irq, action);
+-		ret = action->handler(irq, action->dev_id);
++		ret = handle_irq_action(irq, action);
+ 		trace_irq_handler_exit(irq, action, ret);
+ 
+ 		switch (ret) {
+@@ -420,8 +439,11 @@
+ 		action = action->next;
+ 	} while (action);
+ 
++#ifndef CONFIG_PREEMPT_RT
++	/* FIXME: Can we unbreak that ? */
+ 	if (status & IRQF_SAMPLE_RANDOM)
+ 		add_interrupt_randomness(irq);
++#endif
+ 	local_irq_disable();
+ 
+ 	return retval;
+@@ -450,6 +472,11 @@
+ 	struct irqaction *action;
+ 	unsigned int status;
+ 
++#ifdef CONFIG_PREEMPT_RT
++	printk(KERN_WARNING "__do_IRQ called for irq %d. "
++	       "PREEMPT_RT will crash your system soon\n", irq);
++	printk(KERN_WARNING "I hope you have a fire-extinguisher handy!\n");
++#endif
+ 	kstat_incr_irqs_this_cpu(irq, desc);
+ 
+ 	if (CHECK_IRQ_PER_CPU(desc->status)) {
+@@ -469,7 +496,7 @@
+ 		return 1;
+ 	}
+ 
+-	spin_lock(&desc->lock);
++	atomic_spin_lock(&desc->lock);
+ 	if (desc->chip->ack)
+ 		desc->chip->ack(irq);
+ 	/*
+@@ -513,13 +540,13 @@
+ 	for (;;) {
+ 		irqreturn_t action_ret;
+ 
+-		spin_unlock(&desc->lock);
++		atomic_spin_unlock(&desc->lock);
+ 
+ 		action_ret = handle_IRQ_event(irq, action);
+ 		if (!noirqdebug)
+ 			note_interrupt(irq, desc, action_ret);
+ 
+-		spin_lock(&desc->lock);
++		atomic_spin_lock(&desc->lock);
+ 		if (likely(!(desc->status & IRQ_PENDING)))
+ 			break;
+ 		desc->status &= ~IRQ_PENDING;
+@@ -532,7 +559,7 @@
+ 	 * disabled while the handler was running.
+ 	 */
+ 	desc->chip->end(irq);
+-	spin_unlock(&desc->lock);
++	atomic_spin_unlock(&desc->lock);
+ 
+ 	return 1;
+ }
+Index: linux-rt-2.6.31/kernel/irq/internals.h
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/irq/internals.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/irq/internals.h	2010-05-17 14:23:20.078410414 +0200
+@@ -18,7 +18,7 @@
+ extern struct lock_class_key irq_desc_lock_class;
+ extern void init_kstat_irqs(struct irq_desc *desc, int node, int nr);
+ extern void clear_kstat_irqs(struct irq_desc *desc);
+-extern spinlock_t sparse_irq_lock;
++extern atomic_spinlock_t sparse_irq_lock;
+ 
+ #ifdef CONFIG_SPARSE_IRQ
+ /* irq_desc_ptrs allocated at boot time */
+@@ -44,6 +44,19 @@
+ 
+ extern void irq_set_thread_affinity(struct irq_desc *desc);
+ 
++/* Inline functions for support of irq chips on slow busses */
++static inline void chip_bus_lock(unsigned int irq, struct irq_desc *desc)
++{
++	if (unlikely(desc->chip->bus_lock))
++		desc->chip->bus_lock(irq);
++}
++
++static inline void chip_bus_sync_unlock(unsigned int irq, struct irq_desc *desc)
++{
++	if (unlikely(desc->chip->bus_sync_unlock))
++		desc->chip->bus_sync_unlock(irq);
++}
++
+ /*
+  * Debugging printout:
+  */
+Index: linux-rt-2.6.31/kernel/irq/manage.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/irq/manage.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/irq/manage.c	2010-05-17 14:23:20.078410414 +0200
+@@ -46,9 +46,9 @@
+ 			cpu_relax();
+ 
+ 		/* Ok, that indicated we're done: double-check carefully. */
+-		spin_lock_irqsave(&desc->lock, flags);
++		atomic_spin_lock_irqsave(&desc->lock, flags);
+ 		status = desc->status;
+-		spin_unlock_irqrestore(&desc->lock, flags);
++		atomic_spin_unlock_irqrestore(&desc->lock, flags);
+ 
+ 		/* Oops, that failed? */
+ 	} while (status & IRQ_INPROGRESS);
+@@ -114,7 +114,7 @@
+ 	if (!desc->chip->set_affinity)
+ 		return -EINVAL;
+ 
+-	spin_lock_irqsave(&desc->lock, flags);
++	atomic_spin_lock_irqsave(&desc->lock, flags);
+ 
+ #ifdef CONFIG_GENERIC_PENDING_IRQ
+ 	if (desc->status & IRQ_MOVE_PCNTXT) {
+@@ -134,7 +134,7 @@
+ 	}
+ #endif
+ 	desc->status |= IRQ_AFFINITY_SET;
+-	spin_unlock_irqrestore(&desc->lock, flags);
++	atomic_spin_unlock_irqrestore(&desc->lock, flags);
+ 	return 0;
+ }
+ 
+@@ -181,11 +181,11 @@
+ 	unsigned long flags;
+ 	int ret;
+ 
+-	spin_lock_irqsave(&desc->lock, flags);
++	atomic_spin_lock_irqsave(&desc->lock, flags);
+ 	ret = setup_affinity(irq, desc);
+ 	if (!ret)
+ 		irq_set_thread_affinity(desc);
+-	spin_unlock_irqrestore(&desc->lock, flags);
++	atomic_spin_unlock_irqrestore(&desc->lock, flags);
+ 
+ 	return ret;
+ }
+@@ -230,9 +230,11 @@
+ 	if (!desc)
+ 		return;
+ 
+-	spin_lock_irqsave(&desc->lock, flags);
++	chip_bus_lock(irq, desc);
++	atomic_spin_lock_irqsave(&desc->lock, flags);
+ 	__disable_irq(desc, irq, false);
+-	spin_unlock_irqrestore(&desc->lock, flags);
++	atomic_spin_unlock_irqrestore(&desc->lock, flags);
++	chip_bus_sync_unlock(irq, desc);
+ }
+ EXPORT_SYMBOL(disable_irq_nosync);
+ 
+@@ -278,7 +280,8 @@
+ 			goto err_out;
+ 		/* Prevent probing on this irq: */
+ 		desc->status = status | IRQ_NOPROBE;
+-		check_irq_resend(desc, irq);
++		if (!desc->forced_threads_active)
++			check_irq_resend(desc, irq);
+ 		/* fall-through */
+ 	}
+ 	default:
+@@ -294,7 +297,8 @@
+  *	matches the last disable, processing of interrupts on this
+  *	IRQ line is re-enabled.
+  *
+- *	This function may be called from IRQ context.
++ *	This function may be called from IRQ context only when
++ *	desc->chip->bus_lock and desc->chip->bus_sync_unlock are NULL !
+  */
+ void enable_irq(unsigned int irq)
+ {
+@@ -304,9 +308,11 @@
+ 	if (!desc)
+ 		return;
+ 
+-	spin_lock_irqsave(&desc->lock, flags);
++	chip_bus_lock(irq, desc);
++	atomic_spin_lock_irqsave(&desc->lock, flags);
+ 	__enable_irq(desc, irq, false);
+-	spin_unlock_irqrestore(&desc->lock, flags);
++	atomic_spin_unlock_irqrestore(&desc->lock, flags);
++	chip_bus_sync_unlock(irq, desc);
+ }
+ EXPORT_SYMBOL(enable_irq);
+ 
+@@ -342,7 +348,7 @@
+ 	/* wakeup-capable irqs can be shared between drivers that
+ 	 * don't need to have the same sleep mode behaviors.
+ 	 */
+-	spin_lock_irqsave(&desc->lock, flags);
++	atomic_spin_lock_irqsave(&desc->lock, flags);
+ 	if (on) {
+ 		if (desc->wake_depth++ == 0) {
+ 			ret = set_irq_wake_real(irq, on);
+@@ -363,7 +369,7 @@
+ 		}
+ 	}
+ 
+-	spin_unlock_irqrestore(&desc->lock, flags);
++	atomic_spin_unlock_irqrestore(&desc->lock, flags);
+ 	return ret;
+ }
+ EXPORT_SYMBOL(set_irq_wake);
+@@ -436,7 +442,108 @@
+ 	return ret;
+ }
+ 
+-static int irq_wait_for_interrupt(struct irqaction *action)
++/*
++ * Default primary interrupt handler for threaded interrupts. Is
++ * assigned as primary handler when request_threaded_irq is called
++ * with handler == NULL. Useful for oneshot interrupts.
++ */
++static irqreturn_t irq_default_primary_handler(int irq, void *dev_id)
++{
++	return IRQ_WAKE_THREAD;
++}
++
++/*
++ * Primary handler for nested threaded interrupts. Should never be
++ * called.
++ */
++static irqreturn_t irq_nested_primary_handler(int irq, void *dev_id)
++{
++	WARN(1, "Primary handler called for nested irq %d\n", irq);
++	return IRQ_NONE;
++}
++
++#ifdef CONFIG_PREEMPT_HARDIRQS
++/*
++ * If the caller does not request irq threading then the handler
++ * becomes the thread function and we use the above handler as the
++ * primary hardirq context handler.
++ */
++static void preempt_hardirq_setup(struct irqaction *new)
++{
++	if (new->thread_fn || (new->flags & (IRQF_NODELAY | IRQF_PERCPU)))
++		return;
++
++	new->flags |= IRQF_ONESHOT;
++	new->thread_fn = new->handler;
++	new->handler = irq_default_primary_handler;
++}
++
++#else
++static inline void preempt_hardirq_setup(struct irqaction *new) { }
++#endif
++
++/*
++ * forced threaded interrupts need to unmask the interrupt line
++ */
++static int preempt_hardirq_thread_done(struct irq_desc *desc,
++					struct irqaction *action)
++{
++	unsigned long masked;
++
++	if (!(desc->status & IRQ_ONESHOT))
++		return 0;
++again:
++	atomic_spin_lock_irq(&desc->lock);
++	/*
++	 * Be careful. The hardirq handler might be running on the
++	 * other CPU.
++	 */
++	if (desc->status & IRQ_INPROGRESS) {
++		atomic_spin_unlock_irq(&desc->lock);
++		cpu_relax();
++		goto again;
++	}
++
++	/*
++	 * Now check again, whether the thread should run. Otherwise
++	 * we would clear the forced_threads_active bit which was just
++	 * set.
++	 */
++	if (test_bit(IRQTF_RUNTHREAD, &action->thread_flags)) {
++		atomic_spin_unlock_irq(&desc->lock);
++		return 1;
++	}
++
++	masked = desc->forced_threads_active;
++	desc->forced_threads_active &= ~action->thread_mask;
++
++	/*
++	 * Unmask the interrupt line when this is the last active
++	 * thread and the interrupt is not disabled.
++	 */
++	if (masked && !desc->forced_threads_active &&
++	    !(desc->status & IRQ_DISABLED)) {
++		if (desc->chip->unmask)
++			desc->chip->unmask(action->irq);
++		/*
++		 * Do we need to call check_irq_resend() here ?
++		 * No. check_irq_resend needs only to be checked when
++		 * we go from IRQ_DISABLED to IRQ_ENABLED state.
++		 */
++	}
++	atomic_spin_unlock_irq(&desc->lock);
++	return 0;
++}
++
++static inline void
++preempt_hardirq_cleanup(struct irq_desc *desc, struct irqaction *action)
++{
++	clear_bit(IRQTF_RUNTHREAD, &action->thread_flags);
++	preempt_hardirq_thread_done(desc, action);
++}
++
++static int
++irq_wait_for_interrupt(struct irq_desc *desc, struct irqaction *action)
+ {
+ 	while (!kthread_should_stop()) {
+ 		set_current_state(TASK_INTERRUPTIBLE);
+@@ -446,7 +553,8 @@
+ 			__set_current_state(TASK_RUNNING);
+ 			return 0;
+ 		}
+-		schedule();
++		if (!preempt_hardirq_thread_done(desc, action))
++			schedule();
+ 	}
+ 	return -1;
+ }
+@@ -472,9 +580,9 @@
+ 		return;
+ 	}
+ 
+-	spin_lock_irq(&desc->lock);
++	atomic_spin_lock_irq(&desc->lock);
+ 	cpumask_copy(mask, desc->affinity);
+-	spin_unlock_irq(&desc->lock);
++	atomic_spin_unlock_irq(&desc->lock);
+ 
+ 	set_cpus_allowed_ptr(current, mask);
+ 	free_cpumask_var(mask);
+@@ -495,15 +603,16 @@
+ 	int wake;
+ 
+ 	sched_setscheduler(current, SCHED_FIFO, &param);
++	current->flags |= PF_HARDIRQ;
+ 	current->irqaction = action;
+ 
+-	while (!irq_wait_for_interrupt(action)) {
++	while (!irq_wait_for_interrupt(desc, action)) {
+ 
+ 		irq_thread_check_affinity(desc, action);
+ 
+ 		atomic_inc(&desc->threads_active);
+ 
+-		spin_lock_irq(&desc->lock);
++		atomic_spin_lock_irq(&desc->lock);
+ 		if (unlikely(desc->status & IRQ_DISABLED)) {
+ 			/*
+ 			 * CHECKME: We might need a dedicated
+@@ -513,9 +622,9 @@
+ 			 * retriggers the interrupt itself --- tglx
+ 			 */
+ 			desc->status |= IRQ_PENDING;
+-			spin_unlock_irq(&desc->lock);
++			atomic_spin_unlock_irq(&desc->lock);
+ 		} else {
+-			spin_unlock_irq(&desc->lock);
++			atomic_spin_unlock_irq(&desc->lock);
+ 
+ 			action->thread_fn(action->irq, action->dev_id);
+ 		}
+@@ -526,6 +635,8 @@
+ 			wake_up(&desc->wait_for_threads);
+ 	}
+ 
++	preempt_hardirq_cleanup(desc, action);
++
+ 	/*
+ 	 * Clear irqaction. Otherwise exit_irq_thread() would make
+ 	 * fuzz about an active irq thread going into nirvana.
+@@ -564,8 +675,8 @@
+ {
+ 	struct irqaction *old, **old_ptr;
+ 	const char *old_name = NULL;
+-	unsigned long flags;
+-	int shared = 0;
++	unsigned long flags, thread_mask = 0;
++	int nested, shared = 0;
+ 	int ret;
+ 
+ 	if (!desc)
+@@ -590,10 +701,32 @@
+ 		rand_initialize_irq(irq);
+ 	}
+ 
++
++	/* Preempt-RT setup for forced threading */
++	preempt_hardirq_setup(new);
++
++	/*
++	 * Check whether the interrupt nests into another interrupt
++	 * thread.
++	 */
++	nested = desc->status & IRQ_NESTED_THREAD;
++	if (nested) {
++		if (!new->thread_fn)
++			return -EINVAL;
++		/*
++		 * Replace the primary handler which was provided from
++		 * the driver for non nested interrupt handling by the
++		 * dummy function which warns when called.
++		 */
++		new->handler = irq_nested_primary_handler;
++	}
++
+ 	/*
+-	 * Threaded handler ?
++	 * Create a handler thread when a thread function is supplied
++	 * and the interrupt does not nest into another interrupt
++	 * thread.
+ 	 */
+-	if (new->thread_fn) {
++	if (new->thread_fn && !nested) {
+ 		struct task_struct *t;
+ 
+ 		t = kthread_create(irq_thread, new, "irq/%d-%s", irq,
+@@ -612,7 +745,7 @@
+ 	/*
+ 	 * The following block of code has to be executed atomically
+ 	 */
+-	spin_lock_irqsave(&desc->lock, flags);
++	atomic_spin_lock_irqsave(&desc->lock, flags);
+ 	old_ptr = &desc->action;
+ 	old = *old_ptr;
+ 	if (old) {
+@@ -637,12 +770,20 @@
+ 
+ 		/* add new interrupt at end of irq queue */
+ 		do {
++			thread_mask |= old->thread_mask;
+ 			old_ptr = &old->next;
+ 			old = *old_ptr;
+ 		} while (old);
+ 		shared = 1;
+ 	}
+ 
++	/*
++	 * Setup the thread mask for this irqaction. No risk that ffz
++	 * will fail. If we have 32 resp. 64 devices sharing one irq
++	 * then .....
++	 */
++	new->thread_mask = 1 << ffz(thread_mask);
++
+ 	if (!shared) {
+ 		irq_chip_set_defaults(desc->chip);
+ 
+@@ -662,9 +803,12 @@
+ 			desc->status |= IRQ_PER_CPU;
+ #endif
+ 
+-		desc->status &= ~(IRQ_AUTODETECT | IRQ_WAITING |
++		desc->status &= ~(IRQ_AUTODETECT | IRQ_WAITING | IRQ_ONESHOT |
+ 				  IRQ_INPROGRESS | IRQ_SPURIOUS_DISABLED);
+ 
++		if (new->flags & IRQF_ONESHOT)
++			desc->status |= IRQ_ONESHOT;
++
+ 		if (!(desc->status & IRQ_NOAUTOEN)) {
+ 			desc->depth = 0;
+ 			desc->status &= ~IRQ_DISABLED;
+@@ -705,7 +849,7 @@
+ 		__enable_irq(desc, irq, false);
+ 	}
+ 
+-	spin_unlock_irqrestore(&desc->lock, flags);
++	atomic_spin_unlock_irqrestore(&desc->lock, flags);
+ 
+ 	/*
+ 	 * Strictly no need to wake it up, but hung_task complains
+@@ -732,7 +876,7 @@
+ 	ret = -EBUSY;
+ 
+ out_thread:
+-	spin_unlock_irqrestore(&desc->lock, flags);
++	atomic_spin_unlock_irqrestore(&desc->lock, flags);
+ 	if (new->thread) {
+ 		struct task_struct *t = new->thread;
+ 
+@@ -774,7 +918,7 @@
+ 	if (!desc)
+ 		return NULL;
+ 
+-	spin_lock_irqsave(&desc->lock, flags);
++	atomic_spin_lock_irqsave(&desc->lock, flags);
+ 
+ 	/*
+ 	 * There can be multiple actions per IRQ descriptor, find the right
+@@ -786,7 +930,7 @@
+ 
+ 		if (!action) {
+ 			WARN(1, "Trying to free already-free IRQ %d\n", irq);
+-			spin_unlock_irqrestore(&desc->lock, flags);
++			atomic_spin_unlock_irqrestore(&desc->lock, flags);
+ 
+ 			return NULL;
+ 		}
+@@ -814,7 +958,7 @@
+ 			desc->chip->disable(irq);
+ 	}
+ 
+-	spin_unlock_irqrestore(&desc->lock, flags);
++	atomic_spin_unlock_irqrestore(&desc->lock, flags);
+ 
+ 	unregister_handler_proc(irq, action);
+ 
+@@ -875,7 +1019,14 @@
+  */
+ void free_irq(unsigned int irq, void *dev_id)
+ {
++	struct irq_desc *desc = irq_to_desc(irq);
++
++	if (!desc)
++		return;
++
++	chip_bus_lock(irq, desc);
+ 	kfree(__free_irq(irq, dev_id));
++	chip_bus_sync_unlock(irq, desc);
+ }
+ EXPORT_SYMBOL(free_irq);
+ 
+@@ -884,6 +1035,8 @@
+  *	@irq: Interrupt line to allocate
+  *	@handler: Function to be called when the IRQ occurs.
+  *		  Primary handler for threaded interrupts
++ *		  If NULL and thread_fn != NULL the default
++ *		  primary handler is installed
+  *	@thread_fn: Function called from the irq handler thread
+  *		    If NULL, no irq thread is created
+  *	@irqflags: Interrupt type flags
+@@ -963,8 +1116,12 @@
+ 
+ 	if (desc->status & IRQ_NOREQUEST)
+ 		return -EINVAL;
+-	if (!handler)
+-		return -EINVAL;
++
++	if (!handler) {
++		if (!thread_fn)
++			return -EINVAL;
++		handler = irq_default_primary_handler;
++	}
+ 
+ 	action = kzalloc(sizeof(struct irqaction), GFP_KERNEL);
+ 	if (!action)
+@@ -976,12 +1133,15 @@
+ 	action->name = devname;
+ 	action->dev_id = dev_id;
+ 
++	chip_bus_lock(irq, desc);
+ 	retval = __setup_irq(irq, desc, action);
++	chip_bus_sync_unlock(irq, desc);
++
+ 	if (retval)
+ 		kfree(action);
+ 
+ #ifdef CONFIG_DEBUG_SHIRQ
+-	if (irqflags & IRQF_SHARED) {
++	if (!retval && (irqflags & IRQF_SHARED)) {
+ 		/*
+ 		 * It's a shared IRQ -- the driver ought to be prepared for it
+ 		 * to happen immediately, so let's make sure....
+@@ -989,13 +1149,18 @@
+ 		 * run in parallel with our fake.
+ 		 */
+ 		unsigned long flags;
++		irqreturn_t ret;
+ 
+ 		disable_irq(irq);
+ 		local_irq_save(flags);
+ 
+-		handler(irq, dev_id);
++		ret = action->handler(irq, dev_id);
+ 
+ 		local_irq_restore(flags);
++
++		if (ret == IRQ_WAKE_THREAD)
++			action->thread_fn(irq, dev_id);
++
+ 		enable_irq(irq);
+ 	}
+ #endif
+Index: linux-rt-2.6.31/kernel/irq/migration.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/irq/migration.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/irq/migration.c	2010-05-17 14:23:20.078410414 +0200
+@@ -27,7 +27,7 @@
+ 	if (!desc->chip->set_affinity)
+ 		return;
+ 
+-	assert_spin_locked(&desc->lock);
++	assert_atomic_spin_locked(&desc->lock);
+ 
+ 	/*
+ 	 * If there was a valid mask to work with, please
+@@ -54,6 +54,7 @@
+ void move_native_irq(int irq)
+ {
+ 	struct irq_desc *desc = irq_to_desc(irq);
++	int mask = 1;
+ 
+ 	if (likely(!(desc->status & IRQ_MOVE_PENDING)))
+ 		return;
+@@ -61,8 +62,18 @@
+ 	if (unlikely(desc->status & IRQ_DISABLED))
+ 		return;
+ 
+-	desc->chip->mask(irq);
++	/*
++	 * If the irq is already in progress, it should be masked.
++	 * If we unmask it, we might cause an interrupt storm on RT.
++	 */
++	if (unlikely(desc->status & IRQ_INPROGRESS ||
++		     desc->forced_threads_active))
++		mask = 0;
++
++	if (mask)
++		desc->chip->mask(irq);
+ 	move_masked_irq(irq);
+-	desc->chip->unmask(irq);
++	if (mask)
++		desc->chip->unmask(irq);
+ }
+ 
+Index: linux-rt-2.6.31/kernel/irq/numa_migrate.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/irq/numa_migrate.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/irq/numa_migrate.c	2010-05-17 14:23:20.078410414 +0200
+@@ -42,7 +42,7 @@
+ 				"for migration.\n", irq);
+ 		return false;
+ 	}
+-	spin_lock_init(&desc->lock);
++	atomic_spin_lock_init(&desc->lock);
+ 	desc->node = node;
+ 	lockdep_set_class(&desc->lock, &irq_desc_lock_class);
+ 	init_copy_kstat_irqs(old_desc, desc, node, nr_cpu_ids);
+@@ -67,7 +67,7 @@
+ 
+ 	irq = old_desc->irq;
+ 
+-	spin_lock_irqsave(&sparse_irq_lock, flags);
++	atomic_spin_lock_irqsave(&sparse_irq_lock, flags);
+ 
+ 	/* We have to check it to avoid races with another CPU */
+ 	desc = irq_desc_ptrs[irq];
+@@ -91,7 +91,7 @@
+ 	}
+ 
+ 	irq_desc_ptrs[irq] = desc;
+-	spin_unlock_irqrestore(&sparse_irq_lock, flags);
++	atomic_spin_unlock_irqrestore(&sparse_irq_lock, flags);
+ 
+ 	/* free the old one */
+ 	free_one_irq_desc(old_desc, desc);
+@@ -100,7 +100,7 @@
+ 	return desc;
+ 
+ out_unlock:
+-	spin_unlock_irqrestore(&sparse_irq_lock, flags);
++	atomic_spin_unlock_irqrestore(&sparse_irq_lock, flags);
+ 
+ 	return desc;
+ }
+Index: linux-rt-2.6.31/kernel/irq/pm.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/irq/pm.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/irq/pm.c	2010-05-17 14:23:20.078410414 +0200
+@@ -28,9 +28,9 @@
+ 	for_each_irq_desc(irq, desc) {
+ 		unsigned long flags;
+ 
+-		spin_lock_irqsave(&desc->lock, flags);
++		atomic_spin_lock_irqsave(&desc->lock, flags);
+ 		__disable_irq(desc, irq, true);
+-		spin_unlock_irqrestore(&desc->lock, flags);
++		atomic_spin_unlock_irqrestore(&desc->lock, flags);
+ 	}
+ 
+ 	for_each_irq_desc(irq, desc)
+@@ -56,9 +56,9 @@
+ 		if (!(desc->status & IRQ_SUSPENDED))
+ 			continue;
+ 
+-		spin_lock_irqsave(&desc->lock, flags);
++		atomic_spin_lock_irqsave(&desc->lock, flags);
+ 		__enable_irq(desc, irq, true);
+-		spin_unlock_irqrestore(&desc->lock, flags);
++		atomic_spin_unlock_irqrestore(&desc->lock, flags);
+ 	}
+ }
+ EXPORT_SYMBOL_GPL(resume_device_irqs);
+Index: linux-rt-2.6.31/kernel/irq/proc.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/irq/proc.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/irq/proc.c	2010-05-17 14:23:20.088518193 +0200
+@@ -169,7 +169,7 @@
+ 	unsigned long flags;
+ 	int ret = 1;
+ 
+-	spin_lock_irqsave(&desc->lock, flags);
++	atomic_spin_lock_irqsave(&desc->lock, flags);
+ 	for (action = desc->action ; action; action = action->next) {
+ 		if ((action != new_action) && action->name &&
+ 				!strcmp(new_action->name, action->name)) {
+@@ -177,7 +177,7 @@
+ 			break;
+ 		}
+ 	}
+-	spin_unlock_irqrestore(&desc->lock, flags);
++	atomic_spin_unlock_irqrestore(&desc->lock, flags);
+ 	return ret;
+ }
+ 
+Index: linux-rt-2.6.31/kernel/irq/spurious.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/irq/spurious.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/irq/spurious.c	2010-05-17 14:23:20.088518193 +0200
+@@ -28,7 +28,7 @@
+ 	struct irqaction *action;
+ 	int ok = 0, work = 0;
+ 
+-	spin_lock(&desc->lock);
++	atomic_spin_lock(&desc->lock);
+ 	/* Already running on another processor */
+ 	if (desc->status & IRQ_INPROGRESS) {
+ 		/*
+@@ -37,13 +37,13 @@
+ 		 */
+ 		if (desc->action && (desc->action->flags & IRQF_SHARED))
+ 			desc->status |= IRQ_PENDING;
+-		spin_unlock(&desc->lock);
++		atomic_spin_unlock(&desc->lock);
+ 		return ok;
+ 	}
+ 	/* Honour the normal IRQ locking */
+ 	desc->status |= IRQ_INPROGRESS;
+ 	action = desc->action;
+-	spin_unlock(&desc->lock);
++	atomic_spin_unlock(&desc->lock);
+ 
+ 	while (action) {
+ 		/* Only shared IRQ handlers are safe to call */
+@@ -54,9 +54,9 @@
+ 		}
+ 		action = action->next;
+ 	}
+-	local_irq_disable();
++
+ 	/* Now clean up the flags */
+-	spin_lock(&desc->lock);
++	atomic_spin_lock_irq(&desc->lock);
+ 	action = desc->action;
+ 
+ 	/*
+@@ -68,9 +68,9 @@
+ 		 * Perform real IRQ processing for the IRQ we deferred
+ 		 */
+ 		work = 1;
+-		spin_unlock(&desc->lock);
++		atomic_spin_unlock(&desc->lock);
+ 		handle_IRQ_event(irq, action);
+-		spin_lock(&desc->lock);
++		atomic_spin_lock(&desc->lock);
+ 		desc->status &= ~IRQ_PENDING;
+ 	}
+ 	desc->status &= ~IRQ_INPROGRESS;
+@@ -80,7 +80,7 @@
+ 	 */
+ 	if (work && desc->chip && desc->chip->end)
+ 		desc->chip->end(irq);
+-	spin_unlock(&desc->lock);
++	atomic_spin_unlock(&desc->lock);
+ 
+ 	return ok;
+ }
+@@ -288,6 +288,11 @@
+ 
+ static int __init irqfixup_setup(char *str)
+ {
++#ifdef CONFIG_PREEMPT_RT
++	printk(KERN_WARNING "irqfixup boot option not supported "
++		"w/ CONFIG_PREEMPT_RT\n");
++	return 1;
++#endif
+ 	irqfixup = 1;
+ 	printk(KERN_WARNING "Misrouted IRQ fixup support enabled.\n");
+ 	printk(KERN_WARNING "This may impact system performance.\n");
+@@ -301,6 +306,11 @@
+ 
+ static int __init irqpoll_setup(char *str)
+ {
++#ifdef CONFIG_PREEMPT_RT
++	printk(KERN_WARNING "irqpoll boot option not supported "
++		"w/ CONFIG_PREEMPT_RT\n");
++	return 1;
++#endif
+ 	irqfixup = 2;
+ 	printk(KERN_WARNING "Misrouted IRQ fixup and polling support "
+ 				"enabled\n");
+Index: linux-rt-2.6.31/kernel/itimer.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/itimer.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/itimer.c	2010-05-17 14:23:20.088518193 +0200
+@@ -161,6 +161,7 @@
+ 		/* We are sharing ->siglock with it_real_fn() */
+ 		if (hrtimer_try_to_cancel(timer) < 0) {
+ 			spin_unlock_irq(&tsk->sighand->siglock);
++			hrtimer_wait_for_timer(&tsk->signal->real_timer);
+ 			goto again;
+ 		}
+ 		expires = timeval_to_ktime(value->it_value);
+Index: linux-rt-2.6.31/kernel/kmod.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/kmod.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/kmod.c	2010-05-17 14:23:20.088518193 +0200
+@@ -37,6 +37,8 @@
+ #include <linux/suspend.h>
+ #include <asm/uaccess.h>
+ 
++#include <trace/events/module.h>
++
+ extern int max_threads;
+ 
+ static struct workqueue_struct *khelper_wq;
+@@ -108,6 +110,8 @@
+ 		return -ENOMEM;
+ 	}
+ 
++	trace_module_request(module_name, wait, _RET_IP_);
++
+ 	ret = call_usermodehelper(modprobe_path, argv, envp,
+ 			wait ? UMH_WAIT_PROC : UMH_WAIT_EXEC);
+ 	atomic_dec(&kmod_concurrent);
+Index: linux-rt-2.6.31/kernel/kprobes.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/kprobes.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/kprobes.c	2010-05-17 14:23:20.088518193 +0200
+@@ -73,10 +73,10 @@
+ static DEFINE_MUTEX(kprobe_mutex);	/* Protects kprobe_table */
+ static DEFINE_PER_CPU(struct kprobe *, kprobe_instance) = NULL;
+ static struct {
+-	spinlock_t lock ____cacheline_aligned_in_smp;
++	atomic_spinlock_t lock ____cacheline_aligned_in_smp;
+ } kretprobe_table_locks[KPROBE_TABLE_SIZE];
+ 
+-static spinlock_t *kretprobe_table_lock_ptr(unsigned long hash)
++static atomic_spinlock_t *kretprobe_table_lock_ptr(unsigned long hash)
+ {
+ 	return &(kretprobe_table_locks[hash].lock);
+ }
+@@ -103,7 +103,7 @@
+ #define INSNS_PER_PAGE	(PAGE_SIZE/(MAX_INSN_SIZE * sizeof(kprobe_opcode_t)))
+ 
+ struct kprobe_insn_page {
+-	struct hlist_node hlist;
++	struct list_head list;
+ 	kprobe_opcode_t *insns;		/* Page of instruction slots */
+ 	char slot_used[INSNS_PER_PAGE];
+ 	int nused;
+@@ -117,7 +117,7 @@
+ };
+ 
+ static DEFINE_MUTEX(kprobe_insn_mutex);	/* Protects kprobe_insn_pages */
+-static struct hlist_head kprobe_insn_pages;
++static LIST_HEAD(kprobe_insn_pages);
+ static int kprobe_garbage_slots;
+ static int collect_garbage_slots(void);
+ 
+@@ -152,10 +152,9 @@
+ static kprobe_opcode_t __kprobes *__get_insn_slot(void)
+ {
+ 	struct kprobe_insn_page *kip;
+-	struct hlist_node *pos;
+ 
+  retry:
+-	hlist_for_each_entry(kip, pos, &kprobe_insn_pages, hlist) {
++	list_for_each_entry(kip, &kprobe_insn_pages, list) {
+ 		if (kip->nused < INSNS_PER_PAGE) {
+ 			int i;
+ 			for (i = 0; i < INSNS_PER_PAGE; i++) {
+@@ -189,8 +188,8 @@
+ 		kfree(kip);
+ 		return NULL;
+ 	}
+-	INIT_HLIST_NODE(&kip->hlist);
+-	hlist_add_head(&kip->hlist, &kprobe_insn_pages);
++	INIT_LIST_HEAD(&kip->list);
++	list_add(&kip->list, &kprobe_insn_pages);
+ 	memset(kip->slot_used, SLOT_CLEAN, INSNS_PER_PAGE);
+ 	kip->slot_used[0] = SLOT_USED;
+ 	kip->nused = 1;
+@@ -219,12 +218,8 @@
+ 		 * so as not to have to set it up again the
+ 		 * next time somebody inserts a probe.
+ 		 */
+-		hlist_del(&kip->hlist);
+-		if (hlist_empty(&kprobe_insn_pages)) {
+-			INIT_HLIST_NODE(&kip->hlist);
+-			hlist_add_head(&kip->hlist,
+-				       &kprobe_insn_pages);
+-		} else {
++		if (!list_is_singular(&kprobe_insn_pages)) {
++			list_del(&kip->list);
+ 			module_free(NULL, kip->insns);
+ 			kfree(kip);
+ 		}
+@@ -235,14 +230,13 @@
+ 
+ static int __kprobes collect_garbage_slots(void)
+ {
+-	struct kprobe_insn_page *kip;
+-	struct hlist_node *pos, *next;
++	struct kprobe_insn_page *kip, *next;
+ 
+ 	/* Ensure no-one is preepmted on the garbages */
+ 	if (check_safety())
+ 		return -EAGAIN;
+ 
+-	hlist_for_each_entry_safe(kip, pos, next, &kprobe_insn_pages, hlist) {
++	list_for_each_entry_safe(kip, next, &kprobe_insn_pages, list) {
+ 		int i;
+ 		if (kip->ngarbage == 0)
+ 			continue;
+@@ -260,19 +254,17 @@
+ void __kprobes free_insn_slot(kprobe_opcode_t * slot, int dirty)
+ {
+ 	struct kprobe_insn_page *kip;
+-	struct hlist_node *pos;
+ 
+ 	mutex_lock(&kprobe_insn_mutex);
+-	hlist_for_each_entry(kip, pos, &kprobe_insn_pages, hlist) {
++	list_for_each_entry(kip, &kprobe_insn_pages, list) {
+ 		if (kip->insns <= slot &&
+ 		    slot < kip->insns + (INSNS_PER_PAGE * MAX_INSN_SIZE)) {
+ 			int i = (slot - kip->insns) / MAX_INSN_SIZE;
+ 			if (dirty) {
+ 				kip->slot_used[i] = SLOT_DIRTY;
+ 				kip->ngarbage++;
+-			} else {
++			} else
+ 				collect_one_slot(kip, i);
+-			}
+ 			break;
+ 		}
+ 	}
+@@ -415,9 +407,9 @@
+ 	hlist_del(&ri->hlist);
+ 	INIT_HLIST_NODE(&ri->hlist);
+ 	if (likely(rp)) {
+-		spin_lock(&rp->lock);
++		atomic_spin_lock(&rp->lock);
+ 		hlist_add_head(&ri->hlist, &rp->free_instances);
+-		spin_unlock(&rp->lock);
++		atomic_spin_unlock(&rp->lock);
+ 	} else
+ 		/* Unregistering */
+ 		hlist_add_head(&ri->hlist, head);
+@@ -427,34 +419,34 @@
+ 			 struct hlist_head **head, unsigned long *flags)
+ {
+ 	unsigned long hash = hash_ptr(tsk, KPROBE_HASH_BITS);
+-	spinlock_t *hlist_lock;
++	atomic_spinlock_t *hlist_lock;
+ 
+ 	*head = &kretprobe_inst_table[hash];
+ 	hlist_lock = kretprobe_table_lock_ptr(hash);
+-	spin_lock_irqsave(hlist_lock, *flags);
++	atomic_spin_lock_irqsave(hlist_lock, *flags);
+ }
+ 
+ static void __kprobes kretprobe_table_lock(unsigned long hash,
+ 	unsigned long *flags)
+ {
+-	spinlock_t *hlist_lock = kretprobe_table_lock_ptr(hash);
+-	spin_lock_irqsave(hlist_lock, *flags);
++	atomic_spinlock_t *hlist_lock = kretprobe_table_lock_ptr(hash);
++	atomic_spin_lock_irqsave(hlist_lock, *flags);
+ }
+ 
+ void __kprobes kretprobe_hash_unlock(struct task_struct *tsk,
+ 	unsigned long *flags)
+ {
+ 	unsigned long hash = hash_ptr(tsk, KPROBE_HASH_BITS);
+-	spinlock_t *hlist_lock;
++	atomic_spinlock_t *hlist_lock;
+ 
+ 	hlist_lock = kretprobe_table_lock_ptr(hash);
+-	spin_unlock_irqrestore(hlist_lock, *flags);
++	atomic_spin_unlock_irqrestore(hlist_lock, *flags);
+ }
+ 
+ void __kprobes kretprobe_table_unlock(unsigned long hash, unsigned long *flags)
+ {
+-	spinlock_t *hlist_lock = kretprobe_table_lock_ptr(hash);
+-	spin_unlock_irqrestore(hlist_lock, *flags);
++	atomic_spinlock_t *hlist_lock = kretprobe_table_lock_ptr(hash);
++	atomic_spin_unlock_irqrestore(hlist_lock, *flags);
+ }
+ 
+ /*
+@@ -969,12 +961,12 @@
+ 
+ 	/*TODO: consider to only swap the RA after the last pre_handler fired */
+ 	hash = hash_ptr(current, KPROBE_HASH_BITS);
+-	spin_lock_irqsave(&rp->lock, flags);
++	atomic_spin_lock_irqsave(&rp->lock, flags);
+ 	if (!hlist_empty(&rp->free_instances)) {
+ 		ri = hlist_entry(rp->free_instances.first,
+ 				struct kretprobe_instance, hlist);
+ 		hlist_del(&ri->hlist);
+-		spin_unlock_irqrestore(&rp->lock, flags);
++		atomic_spin_unlock_irqrestore(&rp->lock, flags);
+ 
+ 		ri->rp = rp;
+ 		ri->task = current;
+@@ -991,7 +983,7 @@
+ 		kretprobe_table_unlock(hash, &flags);
+ 	} else {
+ 		rp->nmissed++;
+-		spin_unlock_irqrestore(&rp->lock, flags);
++		atomic_spin_unlock_irqrestore(&rp->lock, flags);
+ 	}
+ 	return 0;
+ }
+@@ -1027,7 +1019,7 @@
+ 		rp->maxactive = NR_CPUS;
+ #endif
+ 	}
+-	spin_lock_init(&rp->lock);
++	atomic_spin_lock_init(&rp->lock);
+ 	INIT_HLIST_HEAD(&rp->free_instances);
+ 	for (i = 0; i < rp->maxactive; i++) {
+ 		inst = kmalloc(sizeof(struct kretprobe_instance) +
+@@ -1207,7 +1199,7 @@
+ 	for (i = 0; i < KPROBE_TABLE_SIZE; i++) {
+ 		INIT_HLIST_HEAD(&kprobe_table[i]);
+ 		INIT_HLIST_HEAD(&kretprobe_inst_table[i]);
+-		spin_lock_init(&(kretprobe_table_locks[i].lock));
++		atomic_spin_lock_init(&(kretprobe_table_locks[i].lock));
+ 	}
+ 
+ 	/*
+Index: linux-rt-2.6.31/kernel/latencytop.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/latencytop.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/latencytop.c	2010-05-17 14:23:20.088518193 +0200
+@@ -59,7 +59,7 @@
+ #include <linux/slab.h>
+ #include <linux/stacktrace.h>
+ 
+-static DEFINE_SPINLOCK(latency_lock);
++static DEFINE_ATOMIC_SPINLOCK(latency_lock);
+ 
+ #define MAXLR 128
+ static struct latency_record latency_record[MAXLR];
+@@ -73,19 +73,19 @@
+ 	if (!latencytop_enabled)
+ 		return;
+ 
+-	spin_lock_irqsave(&latency_lock, flags);
++	atomic_spin_lock_irqsave(&latency_lock, flags);
+ 	memset(&p->latency_record, 0, sizeof(p->latency_record));
+ 	p->latency_record_count = 0;
+-	spin_unlock_irqrestore(&latency_lock, flags);
++	atomic_spin_unlock_irqrestore(&latency_lock, flags);
+ }
+ 
+ static void clear_global_latency_tracing(void)
+ {
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&latency_lock, flags);
++	atomic_spin_lock_irqsave(&latency_lock, flags);
+ 	memset(&latency_record, 0, sizeof(latency_record));
+-	spin_unlock_irqrestore(&latency_lock, flags);
++	atomic_spin_unlock_irqrestore(&latency_lock, flags);
+ }
+ 
+ static void __sched
+@@ -191,7 +191,7 @@
+ 	lat.max = usecs;
+ 	store_stacktrace(tsk, &lat);
+ 
+-	spin_lock_irqsave(&latency_lock, flags);
++	atomic_spin_lock_irqsave(&latency_lock, flags);
+ 
+ 	account_global_scheduler_latency(tsk, &lat);
+ 
+@@ -233,7 +233,7 @@
+ 	memcpy(&tsk->latency_record[i], &lat, sizeof(struct latency_record));
+ 
+ out_unlock:
+-	spin_unlock_irqrestore(&latency_lock, flags);
++	atomic_spin_unlock_irqrestore(&latency_lock, flags);
+ }
+ 
+ static int lstats_show(struct seq_file *m, void *v)
+Index: linux-rt-2.6.31/kernel/lock-internals.h
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ linux-rt-2.6.31/kernel/lock-internals.h	2010-05-17 14:23:20.088518193 +0200
+@@ -0,0 +1,75 @@
++/*
++ * Macros shared by spinlock.c and rwlock.c
++ */
++/*
++ * This could be a long-held lock. We both prepare to spin for a long
++ * time (making _this_ CPU preemptable if possible), and we also signal
++ * towards that other CPU that it should break the lock ASAP.
++ *
++ * (We do this in a function because inlining it would be excessive.)
++ */
++
++#define BUILD_LOCK_OPS(prefix, op, locktype)				\
++void __lockfunc _##prefix##_lock(locktype##_t *lock)			\
++{									\
++	for (;;) {							\
++		preempt_disable();					\
++		if (likely(_raw_##op##_trylock(lock)))			\
++			break;						\
++		preempt_enable();					\
++									\
++		if (!(lock)->break_lock)				\
++			(lock)->break_lock = 1;				\
++		while (!prefix##_can_lock(lock) && (lock)->break_lock)	\
++			_raw_##op##_relax(&lock->raw_lock);		\
++	}								\
++	(lock)->break_lock = 0;						\
++}									\
++									\
++EXPORT_SYMBOL(_##prefix##_lock);					\
++									\
++unsigned long __lockfunc _##prefix##_lock_irqsave(locktype##_t *lock)	\
++{									\
++	unsigned long flags;						\
++									\
++	for (;;) {							\
++		preempt_disable();					\
++		local_irq_save(flags);					\
++		if (likely(_raw_##op##_trylock(lock)))			\
++			break;						\
++		local_irq_restore(flags);				\
++		preempt_enable();					\
++									\
++		if (!(lock)->break_lock)				\
++			(lock)->break_lock = 1;				\
++		while (!prefix##_can_lock(lock) && (lock)->break_lock)	\
++			_raw_##op##_relax(&lock->raw_lock);		\
++	}								\
++	(lock)->break_lock = 0;						\
++	return flags;							\
++}									\
++									\
++EXPORT_SYMBOL(_##prefix##_lock_irqsave);				\
++									\
++void __lockfunc _##prefix##_lock_irq(locktype##_t *lock)		\
++{									\
++	_##prefix##_lock_irqsave(lock);					\
++}									\
++									\
++EXPORT_SYMBOL(_##prefix##_lock_irq);					\
++									\
++void __lockfunc _##prefix##_lock_bh(locktype##_t *lock)			\
++{									\
++	unsigned long flags;						\
++									\
++	/*							*/	\
++	/* Careful: we must exclude softirqs too, hence the	*/	\
++	/* irq-disabling. We use the generic preemption-aware	*/	\
++	/* function:						*/	\
++	/**/								\
++	flags = _##prefix##_lock_irqsave(lock);				\
++	local_bh_disable();						\
++	local_irq_restore(flags);					\
++}									\
++									\
++EXPORT_SYMBOL(_##prefix##_lock_bh)
+Index: linux-rt-2.6.31/kernel/lockdep.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/lockdep.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/lockdep.c	2010-05-17 14:23:20.088518193 +0200
+@@ -846,6 +846,21 @@
+ 	return class;
+ }
+ 
++#if defined(CONFIG_PROVE_LOCKING) || defined(CONFIG_TRACE_IRQFLAGS)
++
++#define RECURSION_LIMIT 40
++
++static int noinline print_infinite_recursion_bug(void)
++{
++	if (!debug_locks_off_graph_unlock())
++		return 0;
++
++	WARN_ON(1);
++
++	return 0;
++}
++#endif /* CONFIG_PROVE_LOCKING || CONFIG_TRACE_IRQFLAGS */
++
+ #ifdef CONFIG_PROVE_LOCKING
+ /*
+  * Allocate a lockdep entry. (assumes the graph_lock held, returns
+@@ -977,18 +992,6 @@
+ 	return 0;
+ }
+ 
+-#define RECURSION_LIMIT 40
+-
+-static int noinline print_infinite_recursion_bug(void)
+-{
+-	if (!debug_locks_off_graph_unlock())
+-		return 0;
+-
+-	WARN_ON(1);
+-
+-	return 0;
+-}
+-
+ unsigned long __lockdep_count_forward_deps(struct lock_class *class,
+ 					   unsigned int depth)
+ {
+@@ -1181,6 +1184,7 @@
+ 	return 1;
+ }
+ 
++#ifdef CONFIG_PROVE_LOCKING
+ static int
+ print_bad_irq_dependency(struct task_struct *curr,
+ 			 struct held_lock *prev,
+@@ -1241,6 +1245,7 @@
+ 
+ 	return 0;
+ }
++#endif /* CONFIG_PROVE_LOCKING */
+ 
+ static int
+ check_usage(struct task_struct *curr, struct held_lock *prev,
+@@ -2524,6 +2529,8 @@
+ }
+ EXPORT_SYMBOL_GPL(lockdep_init_map);
+ 
++struct lock_class_key __lockdep_no_validate__;
++
+ /*
+  * This gets called for every mutex_lock*()/spin_lock*() operation.
+  * We maintain the dependency maps and validate the locking attempt:
+@@ -2556,6 +2563,9 @@
+ 		return 0;
+ 	}
+ 
++	if (lock->key == &__lockdep_no_validate__)
++		check = 1;
++
+ 	if (!subclass)
+ 		class = lock->class_cache;
+ 	/*
+Index: linux-rt-2.6.31/kernel/module.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/module.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/kernel/module.c	2010-05-17 14:23:20.088518193 +0200
+@@ -55,6 +55,11 @@
+ #include <linux/percpu.h>
+ #include <linux/kmemleak.h>
+ 
++#define CREATE_TRACE_POINTS
++#include <trace/events/module.h>
++
++EXPORT_TRACEPOINT_SYMBOL(module_get);
++
+ #if 0
+ #define DEBUGP printk
+ #else
+@@ -942,6 +947,8 @@
+ 	if (module) {
+ 		unsigned int cpu = get_cpu();
+ 		local_dec(__module_ref_addr(module, cpu));
++		trace_module_put(module, _RET_IP_,
++				 local_read(__module_ref_addr(module, cpu)));
+ 		/* Maybe they're waiting for us to drop reference? */
+ 		if (unlikely(!module_is_live(module)))
+ 			wake_up_process(module->waiter);
+@@ -1503,6 +1510,8 @@
+ /* Free a module, remove from lists, etc (must hold module_mutex). */
+ static void free_module(struct module *mod)
+ {
++	trace_module_free(mod);
++
+ 	/* Delete from various lists */
+ 	stop_machine(__unlink_module, mod, NULL);
+ 	remove_notes_attrs(mod);
+@@ -2370,6 +2379,8 @@
+ 	/* Get rid of temporary copy */
+ 	vfree(hdr);
+ 
++	trace_module_load(mod);
++
+ 	/* Done! */
+ 	return mod;
+ 
+Index: linux-rt-2.6.31/kernel/mutex-debug.h
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/mutex-debug.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/mutex-debug.h	2010-05-17 14:23:20.088518193 +0200
+@@ -41,7 +41,6 @@
+ 	do {						\
+ 		struct mutex *l = container_of(lock, struct mutex, wait_lock); \
+ 							\
+-		DEBUG_LOCKS_WARN_ON(in_interrupt());	\
+ 		local_irq_save(flags);			\
+ 		__raw_spin_lock(&(lock)->raw_lock);	\
+ 		DEBUG_LOCKS_WARN_ON(l->magic != l);	\
+Index: linux-rt-2.6.31/kernel/mutex.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/mutex.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/mutex.c	2010-05-17 14:23:20.088518193 +0200
+@@ -148,6 +148,9 @@
+ 
+ 	preempt_disable();
+ 	mutex_acquire(&lock->dep_map, subclass, 0, ip);
++
++	DEBUG_LOCKS_WARN_ON(in_interrupt());
++
+ #if defined(CONFIG_SMP) && !defined(CONFIG_DEBUG_MUTEXES) && \
+     !defined(CONFIG_HAVE_DEFAULT_NO_SPIN_MUTEXES)
+ 	/*
+@@ -249,9 +252,13 @@
+ 
+ 		/* didnt get the lock, go to sleep: */
+ 		spin_unlock_mutex(&lock->wait_lock, flags);
+-		preempt_enable_no_resched();
+-		schedule();
++
++		local_irq_disable();
++		__preempt_enable_no_resched();
++		__schedule();
+ 		preempt_disable();
++		local_irq_enable();
++
+ 		spin_lock_mutex(&lock->wait_lock, flags);
+ 	}
+ 
+Index: linux-rt-2.6.31/kernel/notifier.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/notifier.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/notifier.c	2010-05-17 14:23:20.088518193 +0200
+@@ -71,7 +71,7 @@
+  *	@returns:	notifier_call_chain returns the value returned by the
+  *			last notifier function called.
+  */
+-static int __kprobes notifier_call_chain(struct notifier_block **nl,
++static int __kprobes notrace notifier_call_chain(struct notifier_block **nl,
+ 					unsigned long val, void *v,
+ 					int nr_to_call,	int *nr_calls)
+ {
+@@ -217,7 +217,7 @@
+ 	 * not yet working and interrupts must remain disabled.  At
+ 	 * such times we must not call down_write().
+ 	 */
+-	if (unlikely(system_state == SYSTEM_BOOTING))
++	if (unlikely(system_state < SYSTEM_RUNNING))
+ 		return notifier_chain_register(&nh->head, n);
+ 
+ 	down_write(&nh->rwsem);
+Index: linux-rt-2.6.31/kernel/perf_counter.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/perf_counter.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/kernel/perf_counter.c	2010-05-17 14:23:20.088518193 +0200
+@@ -194,14 +194,14 @@
+ 		 * if so.  If we locked the right context, then it
+ 		 * can't get swapped on us any more.
+ 		 */
+-		spin_lock_irqsave(&ctx->lock, *flags);
++		atomic_spin_lock_irqsave(&ctx->lock, *flags);
+ 		if (ctx != rcu_dereference(task->perf_counter_ctxp)) {
+-			spin_unlock_irqrestore(&ctx->lock, *flags);
++			atomic_spin_unlock_irqrestore(&ctx->lock, *flags);
+ 			goto retry;
+ 		}
+ 
+ 		if (!atomic_inc_not_zero(&ctx->refcount)) {
+-			spin_unlock_irqrestore(&ctx->lock, *flags);
++			atomic_spin_unlock_irqrestore(&ctx->lock, *flags);
+ 			ctx = NULL;
+ 		}
+ 	}
+@@ -222,7 +222,7 @@
+ 	ctx = perf_lock_task_context(task, &flags);
+ 	if (ctx) {
+ 		++ctx->pin_count;
+-		spin_unlock_irqrestore(&ctx->lock, flags);
++		atomic_spin_unlock_irqrestore(&ctx->lock, flags);
+ 	}
+ 	return ctx;
+ }
+@@ -231,9 +231,9 @@
+ {
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&ctx->lock, flags);
++	atomic_spin_lock_irqsave(&ctx->lock, flags);
+ 	--ctx->pin_count;
+-	spin_unlock_irqrestore(&ctx->lock, flags);
++	atomic_spin_unlock_irqrestore(&ctx->lock, flags);
+ 	put_ctx(ctx);
+ }
+ 
+@@ -364,7 +364,7 @@
+ 	if (ctx->task && cpuctx->task_ctx != ctx)
+ 		return;
+ 
+-	spin_lock(&ctx->lock);
++	atomic_spin_lock(&ctx->lock);
+ 	/*
+ 	 * Protect the list operation against NMI by disabling the
+ 	 * counters on a global level.
+@@ -386,7 +386,7 @@
+ 	}
+ 
+ 	perf_enable();
+-	spin_unlock(&ctx->lock);
++	atomic_spin_unlock(&ctx->lock);
+ }
+ 
+ 
+@@ -425,12 +425,12 @@
+ 	task_oncpu_function_call(task, __perf_counter_remove_from_context,
+ 				 counter);
+ 
+-	spin_lock_irq(&ctx->lock);
++	atomic_spin_lock_irq(&ctx->lock);
+ 	/*
+ 	 * If the context is active we need to retry the smp call.
+ 	 */
+ 	if (ctx->nr_active && !list_empty(&counter->list_entry)) {
+-		spin_unlock_irq(&ctx->lock);
++		atomic_spin_unlock_irq(&ctx->lock);
+ 		goto retry;
+ 	}
+ 
+@@ -442,7 +442,7 @@
+ 	if (!list_empty(&counter->list_entry)) {
+ 		list_del_counter(counter, ctx);
+ 	}
+-	spin_unlock_irq(&ctx->lock);
++	atomic_spin_unlock_irq(&ctx->lock);
+ }
+ 
+ static inline u64 perf_clock(void)
+@@ -511,7 +511,7 @@
+ 	if (ctx->task && cpuctx->task_ctx != ctx)
+ 		return;
+ 
+-	spin_lock(&ctx->lock);
++	atomic_spin_lock(&ctx->lock);
+ 
+ 	/*
+ 	 * If the counter is on, turn it off.
+@@ -527,7 +527,7 @@
+ 		counter->state = PERF_COUNTER_STATE_OFF;
+ 	}
+ 
+-	spin_unlock(&ctx->lock);
++	atomic_spin_unlock(&ctx->lock);
+ }
+ 
+ /*
+@@ -560,12 +560,12 @@
+  retry:
+ 	task_oncpu_function_call(task, __perf_counter_disable, counter);
+ 
+-	spin_lock_irq(&ctx->lock);
++	atomic_spin_lock_irq(&ctx->lock);
+ 	/*
+ 	 * If the counter is still active, we need to retry the cross-call.
+ 	 */
+ 	if (counter->state == PERF_COUNTER_STATE_ACTIVE) {
+-		spin_unlock_irq(&ctx->lock);
++		atomic_spin_unlock_irq(&ctx->lock);
+ 		goto retry;
+ 	}
+ 
+@@ -578,7 +578,7 @@
+ 		counter->state = PERF_COUNTER_STATE_OFF;
+ 	}
+ 
+-	spin_unlock_irq(&ctx->lock);
++	atomic_spin_unlock_irq(&ctx->lock);
+ }
+ 
+ static int
+@@ -746,7 +746,7 @@
+ 		cpuctx->task_ctx = ctx;
+ 	}
+ 
+-	spin_lock(&ctx->lock);
++	atomic_spin_lock(&ctx->lock);
+ 	ctx->is_active = 1;
+ 	update_context_time(ctx);
+ 
+@@ -796,7 +796,7 @@
+  unlock:
+ 	perf_enable();
+ 
+-	spin_unlock(&ctx->lock);
++	atomic_spin_unlock(&ctx->lock);
+ }
+ 
+ /*
+@@ -832,12 +832,12 @@
+ 	task_oncpu_function_call(task, __perf_install_in_context,
+ 				 counter);
+ 
+-	spin_lock_irq(&ctx->lock);
++	atomic_spin_lock_irq(&ctx->lock);
+ 	/*
+ 	 * we need to retry the smp call.
+ 	 */
+ 	if (ctx->is_active && list_empty(&counter->list_entry)) {
+-		spin_unlock_irq(&ctx->lock);
++		atomic_spin_unlock_irq(&ctx->lock);
+ 		goto retry;
+ 	}
+ 
+@@ -848,7 +848,7 @@
+ 	 */
+ 	if (list_empty(&counter->list_entry))
+ 		add_counter_to_ctx(counter, ctx);
+-	spin_unlock_irq(&ctx->lock);
++	atomic_spin_unlock_irq(&ctx->lock);
+ }
+ 
+ /*
+@@ -893,7 +893,7 @@
+ 		cpuctx->task_ctx = ctx;
+ 	}
+ 
+-	spin_lock(&ctx->lock);
++	atomic_spin_lock(&ctx->lock);
+ 	ctx->is_active = 1;
+ 	update_context_time(ctx);
+ 
+@@ -935,7 +935,7 @@
+ 	}
+ 
+  unlock:
+-	spin_unlock(&ctx->lock);
++	atomic_spin_unlock(&ctx->lock);
+ }
+ 
+ /*
+@@ -961,7 +961,7 @@
+ 		return;
+ 	}
+ 
+-	spin_lock_irq(&ctx->lock);
++	atomic_spin_lock_irq(&ctx->lock);
+ 	if (counter->state >= PERF_COUNTER_STATE_INACTIVE)
+ 		goto out;
+ 
+@@ -976,10 +976,10 @@
+ 		counter->state = PERF_COUNTER_STATE_OFF;
+ 
+  retry:
+-	spin_unlock_irq(&ctx->lock);
++	atomic_spin_unlock_irq(&ctx->lock);
+ 	task_oncpu_function_call(task, __perf_counter_enable, counter);
+ 
+-	spin_lock_irq(&ctx->lock);
++	atomic_spin_lock_irq(&ctx->lock);
+ 
+ 	/*
+ 	 * If the context is active and the counter is still off,
+@@ -996,7 +996,7 @@
+ 		__perf_counter_mark_enabled(counter, ctx);
+ 
+  out:
+-	spin_unlock_irq(&ctx->lock);
++	atomic_spin_unlock_irq(&ctx->lock);
+ }
+ 
+ static int perf_counter_refresh(struct perf_counter *counter, int refresh)
+@@ -1018,7 +1018,7 @@
+ {
+ 	struct perf_counter *counter;
+ 
+-	spin_lock(&ctx->lock);
++	atomic_spin_lock(&ctx->lock);
+ 	ctx->is_active = 0;
+ 	if (likely(!ctx->nr_counters))
+ 		goto out;
+@@ -1035,7 +1035,7 @@
+ 	}
+ 	perf_enable();
+  out:
+-	spin_unlock(&ctx->lock);
++	atomic_spin_unlock(&ctx->lock);
+ }
+ 
+ /*
+@@ -1175,8 +1175,8 @@
+ 		 * order we take the locks because no other cpu could
+ 		 * be trying to lock both of these tasks.
+ 		 */
+-		spin_lock(&ctx->lock);
+-		spin_lock_nested(&next_ctx->lock, SINGLE_DEPTH_NESTING);
++		atomic_spin_lock(&ctx->lock);
++		atomic_spin_lock_nested(&next_ctx->lock, SINGLE_DEPTH_NESTING);
+ 		if (context_equiv(ctx, next_ctx)) {
+ 			/*
+ 			 * XXX do we need a memory barrier of sorts
+@@ -1190,8 +1190,8 @@
+ 
+ 			perf_counter_sync_stat(ctx, next_ctx);
+ 		}
+-		spin_unlock(&next_ctx->lock);
+-		spin_unlock(&ctx->lock);
++		atomic_spin_unlock(&next_ctx->lock);
++		atomic_spin_unlock(&ctx->lock);
+ 	}
+ 	rcu_read_unlock();
+ 
+@@ -1233,7 +1233,7 @@
+ 	struct perf_counter *counter;
+ 	int can_add_hw = 1;
+ 
+-	spin_lock(&ctx->lock);
++	atomic_spin_lock(&ctx->lock);
+ 	ctx->is_active = 1;
+ 	if (likely(!ctx->nr_counters))
+ 		goto out;
+@@ -1298,7 +1298,7 @@
+ 	}
+ 	perf_enable();
+  out:
+-	spin_unlock(&ctx->lock);
++	atomic_spin_unlock(&ctx->lock);
+ }
+ 
+ /*
+@@ -1362,7 +1362,7 @@
+ 	struct hw_perf_counter *hwc;
+ 	u64 interrupts, freq;
+ 
+-	spin_lock(&ctx->lock);
++	atomic_spin_lock(&ctx->lock);
+ 	list_for_each_entry_rcu(counter, &ctx->counter_list, event_entry) {
+ 		if (counter->state != PERF_COUNTER_STATE_ACTIVE)
+ 			continue;
+@@ -1417,7 +1417,7 @@
+ 			perf_enable();
+ 		}
+ 	}
+-	spin_unlock(&ctx->lock);
++	atomic_spin_unlock(&ctx->lock);
+ }
+ 
+ /*
+@@ -1430,7 +1430,7 @@
+ 	if (!ctx->nr_counters)
+ 		return;
+ 
+-	spin_lock(&ctx->lock);
++	atomic_spin_lock(&ctx->lock);
+ 	/*
+ 	 * Rotate the first entry last (works just fine for group counters too):
+ 	 */
+@@ -1441,7 +1441,7 @@
+ 	}
+ 	perf_enable();
+ 
+-	spin_unlock(&ctx->lock);
++	atomic_spin_unlock(&ctx->lock);
+ }
+ 
+ void perf_counter_task_tick(struct task_struct *curr, int cpu)
+@@ -1490,7 +1490,7 @@
+ 
+ 	__perf_counter_task_sched_out(ctx);
+ 
+-	spin_lock(&ctx->lock);
++	atomic_spin_lock(&ctx->lock);
+ 
+ 	list_for_each_entry(counter, &ctx->counter_list, list_entry) {
+ 		if (!counter->attr.enable_on_exec)
+@@ -1508,7 +1508,7 @@
+ 	if (enabled)
+ 		unclone_ctx(ctx);
+ 
+-	spin_unlock(&ctx->lock);
++	atomic_spin_unlock(&ctx->lock);
+ 
+ 	perf_counter_task_sched_in(task, smp_processor_id());
+  out:
+@@ -1567,7 +1567,7 @@
+ 			    struct task_struct *task)
+ {
+ 	memset(ctx, 0, sizeof(*ctx));
+-	spin_lock_init(&ctx->lock);
++	atomic_spin_lock_init(&ctx->lock);
+ 	mutex_init(&ctx->mutex);
+ 	INIT_LIST_HEAD(&ctx->counter_list);
+ 	INIT_LIST_HEAD(&ctx->event_list);
+@@ -1637,7 +1637,7 @@
+ 	ctx = perf_lock_task_context(task, &flags);
+ 	if (ctx) {
+ 		unclone_ctx(ctx);
+-		spin_unlock_irqrestore(&ctx->lock, flags);
++		atomic_spin_unlock_irqrestore(&ctx->lock, flags);
+ 	}
+ 
+ 	if (!ctx) {
+@@ -1959,7 +1959,7 @@
+ 	if (!value)
+ 		return -EINVAL;
+ 
+-	spin_lock_irq(&ctx->lock);
++	atomic_spin_lock_irq(&ctx->lock);
+ 	if (counter->attr.freq) {
+ 		if (value > sysctl_perf_counter_sample_rate) {
+ 			ret = -EINVAL;
+@@ -1972,7 +1972,7 @@
+ 		counter->hw.sample_period = value;
+ 	}
+ unlock:
+-	spin_unlock_irq(&ctx->lock);
++	atomic_spin_unlock_irq(&ctx->lock);
+ 
+ 	return ret;
+ }
+@@ -2382,11 +2382,26 @@
+ 		__perf_counter_disable(counter);
+ 	}
+ 
++#ifndef CONFIG_PREEMPT_RT
++	if (counter->pending_wakeup) {
++		counter->pending_wakeup = 0;
++		perf_counter_wakeup(counter);
++	}
++#endif
++}
++
++#ifdef CONFIG_PREEMPT_RT
++static void perf_pending_counter_softirq(struct perf_pending_entry *entry)
++{
++	struct perf_counter *counter = container_of(entry,
++			struct perf_counter, pending_softirq);
++
+ 	if (counter->pending_wakeup) {
+ 		counter->pending_wakeup = 0;
+ 		perf_counter_wakeup(counter);
+ 	}
+ }
++#endif
+ 
+ #define PENDING_TAIL ((struct perf_pending_entry *)-1UL)
+ 
+@@ -2394,33 +2409,43 @@
+ 	PENDING_TAIL,
+ };
+ 
+-static void perf_pending_queue(struct perf_pending_entry *entry,
+-			       void (*func)(struct perf_pending_entry *))
++static DEFINE_PER_CPU(struct perf_pending_entry *, perf_pending_softirq_head) =
+ {
+-	struct perf_pending_entry **head;
++	PENDING_TAIL,
++};
+ 
++static void __perf_pending_queue(struct perf_pending_entry **head,
++				 struct perf_pending_entry *entry,
++				 void (*func)(struct perf_pending_entry *))
++{
+ 	if (cmpxchg(&entry->next, NULL, PENDING_TAIL) != NULL)
+ 		return;
+ 
+ 	entry->func = func;
+ 
+-	head = &get_cpu_var(perf_pending_head);
+-
+ 	do {
+ 		entry->next = *head;
+ 	} while (cmpxchg(head, entry->next, entry) != entry->next);
++}
+ 
+-	set_perf_counter_pending();
++static void perf_pending_queue(struct perf_pending_entry *entry,
++			       void (*func)(struct perf_pending_entry *))
++{
++	struct perf_pending_entry **head;
+ 
++	head = &get_cpu_var(perf_pending_head);
++	__perf_pending_queue(head, entry, func);
+ 	put_cpu_var(perf_pending_head);
++
++	set_perf_counter_pending();
+ }
+ 
+-static int __perf_pending_run(void)
++static int __perf_pending_run(struct perf_pending_entry **head)
+ {
+ 	struct perf_pending_entry *list;
+ 	int nr = 0;
+ 
+-	list = xchg(&__get_cpu_var(perf_pending_head), PENDING_TAIL);
++	list = xchg(head, PENDING_TAIL);
+ 	while (list != PENDING_TAIL) {
+ 		void (*func)(struct perf_pending_entry *);
+ 		struct perf_pending_entry *entry = list;
+@@ -2449,9 +2474,8 @@
+ 	 * If we flush on whatever cpu we run, there is a chance we don't
+ 	 * need to wait.
+ 	 */
+-	get_cpu();
+-	__perf_pending_run();
+-	put_cpu();
++	__perf_pending_run(&__raw_get_cpu_var(perf_pending_head));
++	__perf_pending_run(&__raw_get_cpu_var(perf_pending_softirq_head));
+ 
+ 	/*
+ 	 * Ensure we see the proper queue state before going to sleep
+@@ -2468,7 +2492,13 @@
+ 
+ void perf_counter_do_pending(void)
+ {
+-	__perf_pending_run();
++	__perf_pending_run(&__get_cpu_var(perf_pending_head));
++}
++
++void perf_counter_do_pending_softirq(void)
++{
++	__perf_pending_run(&__raw_get_cpu_var(perf_pending_head));
++	__perf_pending_run(&__raw_get_cpu_var(perf_pending_softirq_head));
+ }
+ 
+ /*
+@@ -2526,12 +2556,23 @@
+ {
+ 	atomic_set(&handle->data->poll, POLL_IN);
+ 
++#ifndef CONFIG_PREEMPT_RT
+ 	if (handle->nmi) {
+ 		handle->counter->pending_wakeup = 1;
+ 		perf_pending_queue(&handle->counter->pending,
+ 				   perf_pending_counter);
+ 	} else
+ 		perf_counter_wakeup(handle->counter);
++#else
++	/*
++	 * Move it always to the softirq. This code is called with
++	 * interrupts disabled.
++	 */
++	handle->counter->pending_wakeup = 1;
++	__perf_pending_queue(&__get_cpu_var(perf_pending_softirq_head),
++			     &handle->counter->pending_softirq,
++			     perf_pending_counter_softirq);
++#endif
+ }
+ 
+ /*
+@@ -4517,7 +4558,7 @@
+ 	 * reading child->perf_counter_ctxp, we wait until it has
+ 	 * incremented the context's refcount before we do put_ctx below.
+ 	 */
+-	spin_lock(&child_ctx->lock);
++	atomic_spin_lock(&child_ctx->lock);
+ 	child->perf_counter_ctxp = NULL;
+ 	/*
+ 	 * If this context is a clone; unclone it so it can't get
+@@ -4525,7 +4566,7 @@
+ 	 * the counters from it.
+ 	 */
+ 	unclone_ctx(child_ctx);
+-	spin_unlock_irqrestore(&child_ctx->lock, flags);
++	atomic_spin_unlock_irqrestore(&child_ctx->lock, flags);
+ 
+ 	/*
+ 	 * Report the task dead after unscheduling the counters so that we
+@@ -4811,11 +4852,11 @@
+ 	perf_reserved_percpu = val;
+ 	for_each_online_cpu(cpu) {
+ 		cpuctx = &per_cpu(perf_cpu_context, cpu);
+-		spin_lock_irq(&cpuctx->ctx.lock);
++		atomic_spin_lock_irq(&cpuctx->ctx.lock);
+ 		mpt = min(perf_max_counters - cpuctx->ctx.nr_counters,
+ 			  perf_max_counters - perf_reserved_percpu);
+ 		cpuctx->max_pertask = mpt;
+-		spin_unlock_irq(&cpuctx->ctx.lock);
++		atomic_spin_unlock_irq(&cpuctx->ctx.lock);
+ 	}
+ 	spin_unlock(&perf_resource_lock);
+ 
+Index: linux-rt-2.6.31/kernel/posix-cpu-timers.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/posix-cpu-timers.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/posix-cpu-timers.c	2010-05-17 14:23:20.088518193 +0200
+@@ -279,7 +279,7 @@
+ 	struct task_cputime sum;
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&cputimer->lock, flags);
++	atomic_spin_lock_irqsave(&cputimer->lock, flags);
+ 	if (!cputimer->running) {
+ 		cputimer->running = 1;
+ 		/*
+@@ -292,7 +292,7 @@
+ 		update_gt_cputime(&cputimer->cputime, &sum);
+ 	}
+ 	*times = cputimer->cputime;
+-	spin_unlock_irqrestore(&cputimer->lock, flags);
++	atomic_spin_unlock_irqrestore(&cputimer->lock, flags);
+ }
+ 
+ /*
+@@ -559,7 +559,7 @@
+ 		p->cpu_timers : p->signal->cpu_timers);
+ 	head += CPUCLOCK_WHICH(timer->it_clock);
+ 
+-	BUG_ON(!irqs_disabled());
++	BUG_ON_NONRT(!irqs_disabled());
+ 	spin_lock(&p->sighand->siglock);
+ 
+ 	listpos = head;
+@@ -747,7 +747,7 @@
+ 	/*
+ 	 * Disarm any old timer after extracting its expiry time.
+ 	 */
+-	BUG_ON(!irqs_disabled());
++	BUG_ON_NONRT(!irqs_disabled());
+ 
+ 	ret = 0;
+ 	spin_lock(&p->sighand->siglock);
+@@ -1066,9 +1066,9 @@
+ 	if (!cputimer->running)
+ 		return;
+ 
+-	spin_lock_irqsave(&cputimer->lock, flags);
++	atomic_spin_lock_irqsave(&cputimer->lock, flags);
+ 	cputimer->running = 0;
+-	spin_unlock_irqrestore(&cputimer->lock, flags);
++	atomic_spin_unlock_irqrestore(&cputimer->lock, flags);
+ }
+ 
+ /*
+@@ -1381,12 +1381,11 @@
+  * already updated our counts.  We need to check if any timers fire now.
+  * Interrupts are disabled.
+  */
+-void run_posix_cpu_timers(struct task_struct *tsk)
++void __run_posix_cpu_timers(struct task_struct *tsk)
+ {
+ 	LIST_HEAD(firing);
+ 	struct k_itimer *timer, *next;
+ 
+-	BUG_ON(!irqs_disabled());
+ 
+ 	/*
+ 	 * The fast path checks that there are no expired thread or thread
+@@ -1438,6 +1437,177 @@
+ 	}
+ }
+ 
++#include <linux/kthread.h>
++#include <linux/cpu.h>
++DEFINE_PER_CPU(struct task_struct *, posix_timer_task);
++DEFINE_PER_CPU(struct task_struct *, posix_timer_tasklist);
++
++static int posix_cpu_timers_thread(void *data)
++{
++	int cpu = (long)data;
++
++	BUG_ON(per_cpu(posix_timer_task,cpu) != current);
++
++	while (!kthread_should_stop()) {
++		struct task_struct *tsk = NULL;
++		struct task_struct *next = NULL;
++
++		if (cpu_is_offline(cpu))
++			goto wait_to_die;
++
++		/* grab task list */
++		raw_local_irq_disable();
++		tsk = per_cpu(posix_timer_tasklist, cpu);
++		per_cpu(posix_timer_tasklist, cpu) = NULL;
++		raw_local_irq_enable();
++
++		/* its possible the list is empty, just return */
++		if (!tsk) {
++			set_current_state(TASK_INTERRUPTIBLE);
++			schedule();
++			__set_current_state(TASK_RUNNING);
++			continue;
++		}
++
++		/* Process task list */
++		while (1) {
++			/* save next */
++			next = tsk->posix_timer_list;
++
++			/* run the task timers, clear its ptr and
++			 * unreference it
++			 */
++			__run_posix_cpu_timers(tsk);
++			tsk->posix_timer_list = NULL;
++			put_task_struct(tsk);
++
++			/* check if this is the last on the list */
++			if (next == tsk)
++				break;
++			tsk = next;
++		}
++	}
++	return 0;
++
++wait_to_die:
++	/* Wait for kthread_stop */
++	set_current_state(TASK_INTERRUPTIBLE);
++	while (!kthread_should_stop()) {
++		schedule();
++		set_current_state(TASK_INTERRUPTIBLE);
++	}
++	__set_current_state(TASK_RUNNING);
++	return 0;
++}
++
++static inline int __fastpath_timer_check(struct task_struct *tsk)
++{
++	/* tsk == current, ensure it is safe to use ->signal/sighand */
++	if (unlikely(tsk->exit_state))
++		return 0;
++
++	if (!task_cputime_zero(&tsk->cputime_expires))
++			return 1;
++
++	if (!task_cputime_zero(&tsk->signal->cputime_expires))
++			return 1;
++
++	return 0;
++}
++
++void run_posix_cpu_timers(struct task_struct *tsk)
++{
++	unsigned long cpu = smp_processor_id();
++	struct task_struct *tasklist;
++
++	BUG_ON(!irqs_disabled());
++	if(!per_cpu(posix_timer_task, cpu))
++		return;
++	/* get per-cpu references */
++	tasklist = per_cpu(posix_timer_tasklist, cpu);
++
++	/* check to see if we're already queued */
++	if (!tsk->posix_timer_list && __fastpath_timer_check(tsk)) {
++		get_task_struct(tsk);
++		if (tasklist) {
++			tsk->posix_timer_list = tasklist;
++		} else {
++			/*
++			 * The list is terminated by a self-pointing
++			 * task_struct
++			 */
++			tsk->posix_timer_list = tsk;
++		}
++		per_cpu(posix_timer_tasklist, cpu) = tsk;
++
++		wake_up_process(per_cpu(posix_timer_task, cpu));
++	}
++}
++
++/*
++ * posix_cpu_thread_call - callback that gets triggered when a CPU is added.
++ * Here we can start up the necessary migration thread for the new CPU.
++ */
++static int posix_cpu_thread_call(struct notifier_block *nfb,
++				 unsigned long action, void *hcpu)
++{
++	int cpu = (long)hcpu;
++	struct task_struct *p;
++	struct sched_param param;
++
++	switch (action) {
++	case CPU_UP_PREPARE:
++		p = kthread_create(posix_cpu_timers_thread, hcpu,
++					"posixcputmr/%d",cpu);
++		if (IS_ERR(p))
++			return NOTIFY_BAD;
++		p->flags |= PF_NOFREEZE;
++		kthread_bind(p, cpu);
++		/* Must be high prio to avoid getting starved */
++		param.sched_priority = MAX_RT_PRIO-1;
++		sched_setscheduler(p, SCHED_FIFO, &param);
++		per_cpu(posix_timer_task,cpu) = p;
++		break;
++	case CPU_ONLINE:
++		/* Strictly unneccessary, as first user will wake it. */
++		wake_up_process(per_cpu(posix_timer_task,cpu));
++		break;
++#ifdef CONFIG_HOTPLUG_CPU
++	case CPU_UP_CANCELED:
++		/* Unbind it from offline cpu so it can run.  Fall thru. */
++		kthread_bind(per_cpu(posix_timer_task,cpu),
++			     any_online_cpu(cpu_online_map));
++		kthread_stop(per_cpu(posix_timer_task,cpu));
++		per_cpu(posix_timer_task,cpu) = NULL;
++		break;
++	case CPU_DEAD:
++		kthread_stop(per_cpu(posix_timer_task,cpu));
++		per_cpu(posix_timer_task,cpu) = NULL;
++		break;
++#endif
++	}
++	return NOTIFY_OK;
++}
++
++/* Register at highest priority so that task migration (migrate_all_tasks)
++ * happens before everything else.
++ */
++static struct notifier_block __devinitdata posix_cpu_thread_notifier = {
++	.notifier_call = posix_cpu_thread_call,
++	.priority = 10
++};
++
++static int __init posix_cpu_thread_init(void)
++{
++	void *cpu = (void *)(long)smp_processor_id();
++	/* Start one for boot CPU. */
++	posix_cpu_thread_call(&posix_cpu_thread_notifier, CPU_UP_PREPARE, cpu);
++	posix_cpu_thread_call(&posix_cpu_thread_notifier, CPU_ONLINE, cpu);
++	register_cpu_notifier(&posix_cpu_thread_notifier);
++	return 0;
++}
++early_initcall(posix_cpu_thread_init);
++
+ /*
+  * Set one of the process-wide special case CPU timers.
+  * The tsk->sighand->siglock must be held by the caller.
+@@ -1703,6 +1873,12 @@
+ 		.nsleep = thread_cpu_nsleep,
+ 		.nsleep_restart = thread_cpu_nsleep_restart,
+ 	};
++	unsigned long cpu;
++
++	/* init the per-cpu posix_timer_tasklets */
++	for_each_cpu_mask(cpu, cpu_possible_map) {
++		per_cpu(posix_timer_tasklist, cpu) = NULL;
++	}
+ 
+ 	register_posix_clock(CLOCK_PROCESS_CPUTIME_ID, &process);
+ 	register_posix_clock(CLOCK_THREAD_CPUTIME_ID, &thread);
+Index: linux-rt-2.6.31/kernel/posix-timers.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/posix-timers.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/posix-timers.c	2010-05-17 14:23:20.088518193 +0200
+@@ -427,6 +427,7 @@
+ static struct pid *good_sigevent(sigevent_t * event)
+ {
+ 	struct task_struct *rtn = current->group_leader;
++	int sig = event->sigev_signo;
+ 
+ 	if ((event->sigev_notify & SIGEV_THREAD_ID ) &&
+ 		(!(rtn = find_task_by_vpid(event->sigev_notify_thread_id)) ||
+@@ -435,7 +436,8 @@
+ 		return NULL;
+ 
+ 	if (((event->sigev_notify & ~SIGEV_THREAD_ID) != SIGEV_NONE) &&
+-	    ((event->sigev_signo <= 0) || (event->sigev_signo > SIGRTMAX)))
++	    (sig <= 0 || sig > SIGRTMAX || sig_kernel_only(sig) ||
++	     sig_kernel_coredump(sig)))
+ 		return NULL;
+ 
+ 	return task_pid(rtn);
+@@ -794,6 +796,7 @@
+ 
+ 	unlock_timer(timr, flag);
+ 	if (error == TIMER_RETRY) {
++		hrtimer_wait_for_timer(&timr->it.real.timer);
+ 		rtn = NULL;	// We already got the old time...
+ 		goto retry;
+ 	}
+@@ -832,6 +835,7 @@
+ 
+ 	if (timer_delete_hook(timer) == TIMER_RETRY) {
+ 		unlock_timer(timer, flags);
++		hrtimer_wait_for_timer(&timer->it.real.timer);
+ 		goto retry_delete;
+ 	}
+ 
+@@ -861,6 +865,7 @@
+ 
+ 	if (timer_delete_hook(timer) == TIMER_RETRY) {
+ 		unlock_timer(timer, flags);
++		hrtimer_wait_for_timer(&timer->it.real.timer);
+ 		goto retry_delete;
+ 	}
+ 	list_del(&timer->list);
+Index: linux-rt-2.6.31/kernel/printk.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/printk.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/printk.c	2010-05-17 14:23:20.088518193 +0200
+@@ -33,6 +33,7 @@
+ #include <linux/bootmem.h>
+ #include <linux/syscalls.h>
+ #include <linux/kexec.h>
++#include <linux/semaphore.h>
+ 
+ #include <asm/uaccess.h>
+ 
+@@ -73,7 +74,7 @@
+  * provides serialisation for access to the entire console
+  * driver system.
+  */
+-static DECLARE_MUTEX(console_sem);
++static DEFINE_SEMAPHORE(console_sem);
+ struct console *console_drivers;
+ EXPORT_SYMBOL_GPL(console_drivers);
+ 
+@@ -92,7 +93,7 @@
+  * It is also used in interesting ways to provide interlocking in
+  * release_console_sem().
+  */
+-static DEFINE_SPINLOCK(logbuf_lock);
++static DEFINE_ATOMIC_SPINLOCK(logbuf_lock);
+ 
+ #define LOG_BUF_MASK (log_buf_len-1)
+ #define LOG_BUF(idx) (log_buf[(idx) & LOG_BUF_MASK])
+@@ -171,7 +172,7 @@
+ 			goto out;
+ 		}
+ 
+-		spin_lock_irqsave(&logbuf_lock, flags);
++		atomic_spin_lock_irqsave(&logbuf_lock, flags);
+ 		log_buf_len = size;
+ 		log_buf = new_log_buf;
+ 
+@@ -185,7 +186,7 @@
+ 		log_start -= offset;
+ 		con_start -= offset;
+ 		log_end -= offset;
+-		spin_unlock_irqrestore(&logbuf_lock, flags);
++		atomic_spin_unlock_irqrestore(&logbuf_lock, flags);
+ 
+ 		printk(KERN_NOTICE "log_buf_len: %d\n", log_buf_len);
+ 	}
+@@ -297,18 +298,18 @@
+ 		if (error)
+ 			goto out;
+ 		i = 0;
+-		spin_lock_irq(&logbuf_lock);
++		atomic_spin_lock_irq(&logbuf_lock);
+ 		while (!error && (log_start != log_end) && i < len) {
+ 			c = LOG_BUF(log_start);
+ 			log_start++;
+-			spin_unlock_irq(&logbuf_lock);
++			atomic_spin_unlock_irq(&logbuf_lock);
+ 			error = __put_user(c,buf);
+ 			buf++;
+ 			i++;
+ 			cond_resched();
+-			spin_lock_irq(&logbuf_lock);
++			atomic_spin_lock_irq(&logbuf_lock);
+ 		}
+-		spin_unlock_irq(&logbuf_lock);
++		atomic_spin_unlock_irq(&logbuf_lock);
+ 		if (!error)
+ 			error = i;
+ 		break;
+@@ -329,7 +330,7 @@
+ 		count = len;
+ 		if (count > log_buf_len)
+ 			count = log_buf_len;
+-		spin_lock_irq(&logbuf_lock);
++		atomic_spin_lock_irq(&logbuf_lock);
+ 		if (count > logged_chars)
+ 			count = logged_chars;
+ 		if (do_clear)
+@@ -346,12 +347,12 @@
+ 			if (j + log_buf_len < log_end)
+ 				break;
+ 			c = LOG_BUF(j);
+-			spin_unlock_irq(&logbuf_lock);
++			atomic_spin_unlock_irq(&logbuf_lock);
+ 			error = __put_user(c,&buf[count-1-i]);
+ 			cond_resched();
+-			spin_lock_irq(&logbuf_lock);
++			atomic_spin_lock_irq(&logbuf_lock);
+ 		}
+-		spin_unlock_irq(&logbuf_lock);
++		atomic_spin_unlock_irq(&logbuf_lock);
+ 		if (error)
+ 			break;
+ 		error = i;
+@@ -414,9 +415,13 @@
+ 
+ 	for (con = console_drivers; con; con = con->next) {
+ 		if ((con->flags & CON_ENABLED) && con->write &&
+-				(cpu_online(smp_processor_id()) ||
+-				(con->flags & CON_ANYTIME)))
++				console_atomic_safe(con) &&
++				(cpu_online(raw_smp_processor_id()) ||
++				 (con->flags & CON_ANYTIME))) {
++			set_printk_might_sleep(1);
+ 			con->write(con, &LOG_BUF(start), end - start);
++			set_printk_might_sleep(0);
++		}
+ 	}
+ }
+ 
+@@ -527,9 +532,10 @@
+ 	oops_timestamp = jiffies;
+ 
+ 	/* If a crash is occurring, make sure we can't deadlock */
+-	spin_lock_init(&logbuf_lock);
++	atomic_spin_lock_init(&logbuf_lock);
+ 	/* And make sure that we print immediately */
+-	init_MUTEX(&console_sem);
++	semaphore_init(&console_sem);
++	zap_rt_locks();
+ }
+ 
+ #if defined(CONFIG_PRINTK_TIME)
+@@ -611,7 +617,8 @@
+  * interrupts disabled. It should return with 'lockbuf_lock'
+  * released but interrupts still disabled.
+  */
+-static int acquire_console_semaphore_for_printk(unsigned int cpu)
++static int acquire_console_semaphore_for_printk(unsigned int cpu,
++						unsigned long flags)
+ {
+ 	int retval = 0;
+ 
+@@ -631,7 +638,9 @@
+ 		}
+ 	}
+ 	printk_cpu = UINT_MAX;
+-	spin_unlock(&logbuf_lock);
++	atomic_spin_unlock(&logbuf_lock);
++	lockdep_on();
++	local_irq_restore(flags);
+ 	return retval;
+ }
+ static const char recursion_bug_msg [] =
+@@ -653,7 +662,7 @@
+ 	preempt_disable();
+ 	/* This stops the holder of console_sem just where we want him */
+ 	raw_local_irq_save(flags);
+-	this_cpu = smp_processor_id();
++	this_cpu = raw_smp_processor_id();
+ 
+ 	/*
+ 	 * Ouch, printk recursed into itself!
+@@ -668,14 +677,16 @@
+ 		 */
+ 		if (!oops_in_progress) {
+ 			recursion_bug = 1;
+-			goto out_restore_irqs;
++			raw_local_irq_restore(flags);
++			goto out;
+ 		}
+ 		zap_locks();
+ 	}
+ 
+ 	lockdep_off();
+-	spin_lock(&logbuf_lock);
++	atomic_spin_lock(&logbuf_lock);
+ 	printk_cpu = this_cpu;
++	preempt_enable();
+ 
+ 	if (recursion_bug) {
+ 		recursion_bug = 0;
+@@ -760,14 +771,10 @@
+ 	 * will release 'logbuf_lock' regardless of whether it
+ 	 * actually gets the semaphore or not.
+ 	 */
+-	if (acquire_console_semaphore_for_printk(this_cpu))
++	if (acquire_console_semaphore_for_printk(this_cpu, flags))
+ 		release_console_sem();
+ 
+-	lockdep_on();
+-out_restore_irqs:
+-	raw_local_irq_restore(flags);
+-
+-	preempt_enable();
++out:
+ 	return printed_len;
+ }
+ EXPORT_SYMBOL(printk);
+@@ -1023,22 +1030,43 @@
+ 	console_may_schedule = 0;
+ 
+ 	for ( ; ; ) {
+-		spin_lock_irqsave(&logbuf_lock, flags);
++		atomic_spin_lock_irqsave(&logbuf_lock, flags);
+ 		wake_klogd |= log_start - log_end;
+ 		if (con_start == log_end)
+ 			break;			/* Nothing to print */
+ 		_con_start = con_start;
+ 		_log_end = log_end;
+ 		con_start = log_end;		/* Flush */
+-		spin_unlock(&logbuf_lock);
++
++		/*
++		 * on PREEMPT_RT, call console drivers with
++		 * interrupts enabled (if printk was called
++		 * with interrupts disabled):
++		 */
++#ifdef CONFIG_PREEMPT_RT
++		atomic_spin_unlock_irqrestore(&logbuf_lock, flags);
++#else
++		atomic_spin_unlock(&logbuf_lock);
+ 		stop_critical_timings();	/* don't trace print latency */
++#endif
+ 		call_console_drivers(_con_start, _log_end);
+ 		start_critical_timings();
++#ifndef CONFIG_PREEMPT_RT
+ 		local_irq_restore(flags);
++#endif
+ 	}
+ 	console_locked = 0;
++	atomic_spin_unlock_irqrestore(&logbuf_lock, flags);
+ 	up(&console_sem);
+-	spin_unlock_irqrestore(&logbuf_lock, flags);
++	/*
++	 * On PREEMPT_RT kernels __wake_up may sleep, so wake syslogd
++	 * up only if we are in a preemptible section. We normally dont
++	 * printk from non-preemptible sections so this is for the emergency
++	 * case only.
++	 */
++#ifdef CONFIG_PREEMPT_RT
++	if (!in_atomic() && !irqs_disabled())
++#endif
+ 	if (wake_klogd)
+ 		wake_up_klogd();
+ }
+@@ -1240,9 +1268,9 @@
+ 		 * release_console_sem() will print out the buffered messages
+ 		 * for us.
+ 		 */
+-		spin_lock_irqsave(&logbuf_lock, flags);
++		atomic_spin_lock_irqsave(&logbuf_lock, flags);
+ 		con_start = log_start;
+-		spin_unlock_irqrestore(&logbuf_lock, flags);
++		atomic_spin_unlock_irqrestore(&logbuf_lock, flags);
+ 	}
+ 	release_console_sem();
+ }
+@@ -1314,6 +1342,23 @@
+ }
+ EXPORT_SYMBOL(printk_ratelimit);
+ 
++static DEFINE_ATOMIC_SPINLOCK(warn_lock);
++
++void __WARN_ON(const char *func, const char *file, const int line)
++{
++	unsigned long flags;
++
++	atomic_spin_lock_irqsave(&warn_lock, flags);
++	printk("%s/%d[CPU#%d]: BUG in %s at %s:%d\n",
++		current->comm, current->pid, raw_smp_processor_id(),
++		func, file, line);
++	dump_stack();
++	atomic_spin_unlock_irqrestore(&warn_lock, flags);
++}
++
++EXPORT_SYMBOL(__WARN_ON);
++
++
+ /**
+  * printk_timed_ratelimit - caller-controlled printk ratelimiting
+  * @caller_jiffies: pointer to caller's state
+Index: linux-rt-2.6.31/kernel/rcupreempt.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/rcupreempt.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/rcupreempt.c	2010-05-17 14:23:20.088518193 +0200
+@@ -71,7 +71,7 @@
+  */
+ #define GP_STAGES    2
+ struct rcu_data {
+-	spinlock_t	lock;		/* Protect rcu_data fields. */
++	atomic_spinlock_t lock;		/* Protect rcu_data fields. */
+ 	long		completed;	/* Number of last completed batch. */
+ 	int		waitlistcount;
+ 	struct rcu_head *nextlist;
+@@ -138,7 +138,7 @@
+ };
+ 
+ struct rcu_ctrlblk {
+-	spinlock_t	fliplock;	/* Protect state-machine transitions. */
++	atomic_spinlock_t fliplock;	/* Protect state-machine transitions. */
+ 	long		completed;	/* Number of last completed batch. */
+ 	enum rcu_try_flip_states rcu_try_flip_state; /* The current state of
+ 							the rcu state machine */
+@@ -193,7 +193,7 @@
+ static DEFINE_PER_CPU(struct rcu_data, rcu_data);
+ 
+ static struct rcu_ctrlblk rcu_ctrlblk = {
+-	.fliplock = __SPIN_LOCK_UNLOCKED(rcu_ctrlblk.fliplock),
++	.fliplock = __ATOMIC_SPIN_LOCK_UNLOCKED(rcu_ctrlblk.fliplock),
+ 	.completed = 0,
+ 	.rcu_try_flip_state = rcu_try_flip_idle_state,
+ 	.schedlock = __SPIN_LOCK_UNLOCKED(rcu_ctrlblk.schedlock),
+@@ -910,7 +910,7 @@
+ 	unsigned long flags;
+ 
+ 	RCU_TRACE_ME(rcupreempt_trace_try_flip_1);
+-	if (unlikely(!spin_trylock_irqsave(&rcu_ctrlblk.fliplock, flags))) {
++	if (unlikely(!atomic_spin_trylock_irqsave(&rcu_ctrlblk.fliplock, flags))) {
+ 		RCU_TRACE_ME(rcupreempt_trace_try_flip_e1);
+ 		return;
+ 	}
+@@ -941,7 +941,7 @@
+ 			rcu_ctrlblk.rcu_try_flip_state =
+ 				rcu_try_flip_idle_state;
+ 	}
+-	spin_unlock_irqrestore(&rcu_ctrlblk.fliplock, flags);
++	atomic_spin_unlock_irqrestore(&rcu_ctrlblk.fliplock, flags);
+ }
+ 
+ /*
+@@ -986,13 +986,13 @@
+ 	rcu_check_mb(cpu);
+ 	if (rcu_ctrlblk.completed == rdp->completed)
+ 		rcu_try_flip();
+-	spin_lock_irqsave(&rdp->lock, flags);
++	atomic_spin_lock_irqsave(&rdp->lock, flags);
+ 	RCU_TRACE_RDP(rcupreempt_trace_check_callbacks, rdp);
+ 	__rcu_advance_callbacks(rdp);
+ 	if (rdp->donelist == NULL) {
+-		spin_unlock_irqrestore(&rdp->lock, flags);
++		atomic_spin_unlock_irqrestore(&rdp->lock, flags);
+ 	} else {
+-		spin_unlock_irqrestore(&rdp->lock, flags);
++		atomic_spin_unlock_irqrestore(&rdp->lock, flags);
+ 		raise_softirq(RCU_SOFTIRQ);
+ 	}
+ }
+@@ -1011,10 +1011,10 @@
+ 		if (rcu_ctrlblk.completed == rdp->completed)
+ 			return;
+ 	}
+-	spin_lock_irqsave(&rdp->lock, flags);
++	atomic_spin_lock_irqsave(&rdp->lock, flags);
+ 	RCU_TRACE_RDP(rcupreempt_trace_check_callbacks, rdp);
+ 	__rcu_advance_callbacks(rdp);
+-	spin_unlock_irqrestore(&rdp->lock, flags);
++	atomic_spin_unlock_irqrestore(&rdp->lock, flags);
+ }
+ 
+ #ifdef CONFIG_HOTPLUG_CPU
+@@ -1042,7 +1042,7 @@
+ 	 * Otherwise rcu_barrier() will fail
+ 	 */
+ 
+-	spin_lock_irqsave(&rdp->lock, flags);
++	atomic_spin_lock_irqsave(&rdp->lock, flags);
+ 	rcu_offline_cpu_enqueue(rdp->donelist, rdp->donetail, list, tail);
+ 	for (i = GP_STAGES - 1; i >= 0; i--)
+ 		rcu_offline_cpu_enqueue(rdp->waitlist[i], rdp->waittail[i],
+@@ -1053,12 +1053,12 @@
+ 	rcu_offline_cpu_enqueue(rdp->nextschedlist, rdp->nextschedtail,
+ 				schedlist, schedtail);
+ 	rdp->rcu_sched_sleeping = 0;
+-	spin_unlock_irqrestore(&rdp->lock, flags);
++	atomic_spin_unlock_irqrestore(&rdp->lock, flags);
+ 	rdp->waitlistcount = 0;
+ 
+ 	/* Disengage the newly dead CPU from the grace-period computation. */
+ 
+-	spin_lock_irqsave(&rcu_ctrlblk.fliplock, flags);
++	atomic_spin_lock_irqsave(&rcu_ctrlblk.fliplock, flags);
+ 	rcu_check_mb(cpu);
+ 	if (per_cpu(rcu_flip_flag, cpu) == rcu_flipped) {
+ 		smp_mb();  /* Subsequent counter accesses must see new value */
+@@ -1075,7 +1075,7 @@
+ 
+ 	cpumask_clear_cpu(cpu, to_cpumask(rcu_cpu_online_map));
+ 
+-	spin_unlock_irqrestore(&rcu_ctrlblk.fliplock, flags);
++	atomic_spin_unlock_irqrestore(&rcu_ctrlblk.fliplock, flags);
+ 
+ 	/*
+ 	 * Place the removed callbacks on the current CPU's queue.
+@@ -1089,14 +1089,14 @@
+ 
+ 	local_irq_save(flags);  /* disable preempt till we know what lock. */
+ 	rdp = RCU_DATA_ME();
+-	spin_lock(&rdp->lock);
++	atomic_spin_lock(&rdp->lock);
+ 	*rdp->nexttail = list;
+ 	if (list)
+ 		rdp->nexttail = tail;
+ 	*rdp->nextschedtail = schedlist;
+ 	if (schedlist)
+ 		rdp->nextschedtail = schedtail;
+-	spin_unlock_irqrestore(&rdp->lock, flags);
++	atomic_spin_unlock_irqrestore(&rdp->lock, flags);
+ }
+ 
+ #else /* #ifdef CONFIG_HOTPLUG_CPU */
+@@ -1112,9 +1112,9 @@
+ 	unsigned long flags;
+ 	struct rcu_data *rdp;
+ 
+-	spin_lock_irqsave(&rcu_ctrlblk.fliplock, flags);
++	atomic_spin_lock_irqsave(&rcu_ctrlblk.fliplock, flags);
+ 	cpumask_set_cpu(cpu, to_cpumask(rcu_cpu_online_map));
+-	spin_unlock_irqrestore(&rcu_ctrlblk.fliplock, flags);
++	atomic_spin_unlock_irqrestore(&rcu_ctrlblk.fliplock, flags);
+ 
+ 	/*
+ 	 * The rcu_sched grace-period processing might have bypassed
+@@ -1126,9 +1126,9 @@
+ 	 */
+ 
+ 	rdp = RCU_DATA_CPU(cpu);
+-	spin_lock_irqsave(&rdp->lock, flags);
++	atomic_spin_lock_irqsave(&rdp->lock, flags);
+ 	rdp->rcu_sched_sleeping = 1;
+-	spin_unlock_irqrestore(&rdp->lock, flags);
++	atomic_spin_unlock_irqrestore(&rdp->lock, flags);
+ }
+ 
+ static void rcu_process_callbacks(struct softirq_action *unused)
+@@ -1139,16 +1139,16 @@
+ 
+ 	local_irq_save(flags);
+ 	rdp = RCU_DATA_ME();
+-	spin_lock(&rdp->lock);
++	atomic_spin_lock(&rdp->lock);
+ 	list = rdp->donelist;
+ 	if (list == NULL) {
+-		spin_unlock_irqrestore(&rdp->lock, flags);
++		atomic_spin_unlock_irqrestore(&rdp->lock, flags);
+ 		return;
+ 	}
+ 	rdp->donelist = NULL;
+ 	rdp->donetail = &rdp->donelist;
+ 	RCU_TRACE_RDP(rcupreempt_trace_done_remove, rdp);
+-	spin_unlock_irqrestore(&rdp->lock, flags);
++	atomic_spin_unlock_irqrestore(&rdp->lock, flags);
+ 	while (list) {
+ 		next = list->next;
+ 		list->func(list);
+@@ -1166,12 +1166,12 @@
+ 	head->next = NULL;
+ 	local_irq_save(flags);
+ 	rdp = RCU_DATA_ME();
+-	spin_lock(&rdp->lock);
++	atomic_spin_lock(&rdp->lock);
+ 	__rcu_advance_callbacks(rdp);
+ 	*rdp->nexttail = head;
+ 	rdp->nexttail = &head->next;
+ 	RCU_TRACE_RDP(rcupreempt_trace_next_add, rdp);
+-	spin_unlock_irqrestore(&rdp->lock, flags);
++	atomic_spin_unlock_irqrestore(&rdp->lock, flags);
+ }
+ EXPORT_SYMBOL_GPL(call_rcu);
+ 
+@@ -1185,7 +1185,7 @@
+ 	head->next = NULL;
+ 	local_irq_save(flags);
+ 	rdp = RCU_DATA_ME();
+-	spin_lock(&rdp->lock);
++	atomic_spin_lock(&rdp->lock);
+ 	*rdp->nextschedtail = head;
+ 	rdp->nextschedtail = &head->next;
+ 	if (rdp->rcu_sched_sleeping) {
+@@ -1195,7 +1195,7 @@
+ 		rdp->rcu_sched_sleeping = 0;
+ 		wake_gp = 1;
+ 	}
+-	spin_unlock_irqrestore(&rdp->lock, flags);
++	atomic_spin_unlock_irqrestore(&rdp->lock, flags);
+ 	if (wake_gp) {
+ 
+ 		/* Wake up grace-period processing, unless someone beat us. */
+@@ -1291,7 +1291,7 @@
+ 		for_each_online_cpu(cpu) {
+ 
+ 			rdp = RCU_DATA_CPU(cpu);
+-			spin_lock_irqsave(&rdp->lock, flags);
++			atomic_spin_lock_irqsave(&rdp->lock, flags);
+ 
+ 			/*
+ 			 * We are running on this CPU irq-disabled, so no
+@@ -1330,7 +1330,7 @@
+ 
+ 			rdp->rcu_sched_sleeping = couldsleep;
+ 
+-			spin_unlock_irqrestore(&rdp->lock, flags);
++			atomic_spin_unlock_irqrestore(&rdp->lock, flags);
+ 		}
+ 
+ 		/* If we saw callbacks on the last scan, go deal with them. */
+@@ -1452,7 +1452,7 @@
+ 	printk(KERN_NOTICE "Preemptible RCU implementation.\n");
+ 	for_each_possible_cpu(cpu) {
+ 		rdp = RCU_DATA_CPU(cpu);
+-		spin_lock_init(&rdp->lock);
++		atomic_spin_lock_init(&rdp->lock);
+ 		rdp->completed = 0;
+ 		rdp->waitlistcount = 0;
+ 		rdp->nextlist = NULL;
+Index: linux-rt-2.6.31/kernel/rcutorture.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/rcutorture.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/rcutorture.c	2010-05-17 14:23:20.088518193 +0200
+@@ -752,7 +752,7 @@
+ 		if (p == NULL) {
+ 			/* Wait for rcu_torture_writer to get underway */
+ 			cur_ops->readunlock(idx);
+-			schedule_timeout_interruptible(HZ);
++			schedule_timeout_interruptible(round_jiffies_relative(HZ));
+ 			continue;
+ 		}
+ 		if (p->rtort_mbtest == 0)
+Index: linux-rt-2.6.31/kernel/relay.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/relay.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/relay.c	2010-05-17 14:23:20.088518193 +0200
+@@ -343,6 +343,10 @@
+ {
+ 	struct rchan_buf *buf = (struct rchan_buf *)data;
+ 	wake_up_interruptible(&buf->read_wait);
++	/*
++	 * Stupid polling for now:
++	 */
++	mod_timer(&buf->timer, jiffies + 1);
+ }
+ 
+ /**
+@@ -360,6 +364,7 @@
+ 		init_waitqueue_head(&buf->read_wait);
+ 		kref_init(&buf->kref);
+ 		setup_timer(&buf->timer, wakeup_readers, (unsigned long)buf);
++		mod_timer(&buf->timer, jiffies + 1);
+ 	} else
+ 		del_timer_sync(&buf->timer);
+ 
+@@ -740,15 +745,6 @@
+ 		else
+ 			buf->early_bytes += buf->chan->subbuf_size -
+ 					    buf->padding[old_subbuf];
+-		smp_mb();
+-		if (waitqueue_active(&buf->read_wait))
+-			/*
+-			 * Calling wake_up_interruptible() from here
+-			 * will deadlock if we happen to be logging
+-			 * from the scheduler (trying to re-grab
+-			 * rq->lock), so defer it.
+-			 */
+-			mod_timer(&buf->timer, jiffies + 1);
+ 	}
+ 
+ 	old = buf->data;
+Index: linux-rt-2.6.31/kernel/res_counter.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/res_counter.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/res_counter.c	2010-05-17 14:23:20.088518193 +0200
+@@ -14,6 +14,7 @@
+ #include <linux/res_counter.h>
+ #include <linux/uaccess.h>
+ #include <linux/mm.h>
++#include <linux/interrupt.h>
+ 
+ void res_counter_init(struct res_counter *counter, struct res_counter *parent)
+ {
+@@ -43,7 +44,7 @@
+ 	struct res_counter *c, *u;
+ 
+ 	*limit_fail_at = NULL;
+-	local_irq_save(flags);
++	local_irq_save_nort(flags);
+ 	for (c = counter; c != NULL; c = c->parent) {
+ 		spin_lock(&c->lock);
+ 		ret = res_counter_charge_locked(c, val);
+@@ -62,7 +63,7 @@
+ 		spin_unlock(&u->lock);
+ 	}
+ done:
+-	local_irq_restore(flags);
++	local_irq_restore_nort(flags);
+ 	return ret;
+ }
+ 
+@@ -79,13 +80,13 @@
+ 	unsigned long flags;
+ 	struct res_counter *c;
+ 
+-	local_irq_save(flags);
++	local_irq_save_nort(flags);
+ 	for (c = counter; c != NULL; c = c->parent) {
+ 		spin_lock(&c->lock);
+ 		res_counter_uncharge_locked(c, val);
+ 		spin_unlock(&c->lock);
+ 	}
+-	local_irq_restore(flags);
++	local_irq_restore_nort(flags);
+ }
+ 
+ 
+Index: linux-rt-2.6.31/kernel/rt.c
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ linux-rt-2.6.31/kernel/rt.c	2010-05-17 14:23:20.088518193 +0200
+@@ -0,0 +1,566 @@
++/*
++ * kernel/rt.c
++ *
++ * Real-Time Preemption Support
++ *
++ * started by Ingo Molnar:
++ *
++ *  Copyright (C) 2004-2006 Red Hat, Inc., Ingo Molnar <mingo@redhat.com>
++ *  Copyright (C) 2006, Timesys Corp., Thomas Gleixner <tglx@timesys.com>
++ *
++ * historic credit for proving that Linux spinlocks can be implemented via
++ * RT-aware mutexes goes to many people: The Pmutex project (Dirk Grambow
++ * and others) who prototyped it on 2.4 and did lots of comparative
++ * research and analysis; TimeSys, for proving that you can implement a
++ * fully preemptible kernel via the use of IRQ threading and mutexes;
++ * Bill Huey for persuasively arguing on lkml that the mutex model is the
++ * right one; and to MontaVista, who ported pmutexes to 2.6.
++ *
++ * This code is a from-scratch implementation and is not based on pmutexes,
++ * but the idea of converting spinlocks to mutexes is used here too.
++ *
++ * lock debugging, locking tree, deadlock detection:
++ *
++ *  Copyright (C) 2004, LynuxWorks, Inc., Igor Manyilov, Bill Huey
++ *  Released under the General Public License (GPL).
++ *
++ * Includes portions of the generic R/W semaphore implementation from:
++ *
++ *  Copyright (c) 2001   David Howells (dhowells@redhat.com).
++ *  - Derived partially from idea by Andrea Arcangeli <andrea@suse.de>
++ *  - Derived also from comments by Linus
++ *
++ * Pending ownership of locks and ownership stealing:
++ *
++ *  Copyright (C) 2005, Kihon Technologies Inc., Steven Rostedt
++ *
++ *   (also by Steven Rostedt)
++ *    - Converted single pi_lock to individual task locks.
++ *
++ * By Esben Nielsen:
++ *    Doing priority inheritance with help of the scheduler.
++ *
++ *  Copyright (C) 2006, Timesys Corp., Thomas Gleixner <tglx@timesys.com>
++ *  - major rework based on Esben Nielsens initial patch
++ *  - replaced thread_info references by task_struct refs
++ *  - removed task->pending_owner dependency
++ *  - BKL drop/reacquire for semaphore style locks to avoid deadlocks
++ *    in the scheduler return path as discussed with Steven Rostedt
++ *
++ *  Copyright (C) 2006, Kihon Technologies Inc.
++ *    Steven Rostedt <rostedt@goodmis.org>
++ *  - debugged and patched Thomas Gleixner's rework.
++ *  - added back the cmpxchg to the rework.
++ *  - turned atomic require back on for SMP.
++ */
++
++#include <linux/spinlock.h>
++#include <linux/sched.h>
++#include <linux/delay.h>
++#include <linux/module.h>
++#include <linux/spinlock.h>
++#include <linux/kallsyms.h>
++#include <linux/syscalls.h>
++#include <linux/interrupt.h>
++#include <linux/plist.h>
++#include <linux/fs.h>
++#include <linux/futex.h>
++#include <linux/hrtimer.h>
++
++#include "rtmutex_common.h"
++
++#ifdef CONFIG_PREEMPT_RT
++/*
++ * Unlock these on crash:
++ */
++void zap_rt_locks(void)
++{
++	//trace_lock_init();
++}
++#endif
++
++/*
++ * struct mutex functions
++ */
++void __mutex_init(struct mutex *lock, char *name, struct lock_class_key *key)
++{
++#ifdef CONFIG_DEBUG_LOCK_ALLOC
++	/*
++	 * Make sure we are not reinitializing a held lock:
++	 */
++	debug_check_no_locks_freed((void *)lock, sizeof(*lock));
++	lockdep_init_map(&lock->dep_map, name, key, 0);
++#endif
++	__rt_mutex_init(&lock->lock, name);
++}
++EXPORT_SYMBOL(__mutex_init);
++
++void __lockfunc _mutex_lock(struct mutex *lock)
++{
++	mutex_acquire(&lock->dep_map, 0, 0, _RET_IP_);
++	rt_mutex_lock(&lock->lock);
++}
++EXPORT_SYMBOL(_mutex_lock);
++
++int __lockfunc _mutex_lock_interruptible(struct mutex *lock)
++{
++	int ret;
++
++	mutex_acquire(&lock->dep_map, 0, 0, _RET_IP_);
++	ret = rt_mutex_lock_interruptible(&lock->lock, 0);
++	if (ret)
++		mutex_release(&lock->dep_map, 1, _RET_IP_);
++	return ret;
++}
++EXPORT_SYMBOL(_mutex_lock_interruptible);
++
++int __lockfunc _mutex_lock_killable(struct mutex *lock)
++{
++	int ret;
++
++	mutex_acquire(&lock->dep_map, 0, 0, _RET_IP_);
++	ret = rt_mutex_lock_killable(&lock->lock, 0);
++	if (ret)
++		mutex_release(&lock->dep_map, 1, _RET_IP_);
++	return ret;
++}
++EXPORT_SYMBOL(_mutex_lock_killable);
++
++#ifdef CONFIG_DEBUG_LOCK_ALLOC
++void __lockfunc _mutex_lock_nested(struct mutex *lock, int subclass)
++{
++	mutex_acquire(&lock->dep_map, subclass, 0, _RET_IP_);
++	rt_mutex_lock(&lock->lock);
++}
++EXPORT_SYMBOL(_mutex_lock_nested);
++
++int __lockfunc _mutex_lock_interruptible_nested(struct mutex *lock, int subclass)
++{
++	int ret;
++
++	mutex_acquire(&lock->dep_map, subclass, 0, _RET_IP_);
++	ret = rt_mutex_lock_interruptible(&lock->lock, 0);
++	if (ret)
++		mutex_release(&lock->dep_map, 1, _RET_IP_);
++	return ret;
++}
++EXPORT_SYMBOL(_mutex_lock_interruptible_nested);
++
++int __lockfunc _mutex_lock_killable_nested(struct mutex *lock, int subclass)
++{
++	int ret;
++
++	mutex_acquire(&lock->dep_map, subclass, 0, _RET_IP_);
++	ret = rt_mutex_lock_killable(&lock->lock, 0);
++	if (ret)
++		mutex_release(&lock->dep_map, 1, _RET_IP_);
++	return ret;
++}
++EXPORT_SYMBOL(_mutex_lock_killable_nested);
++#endif
++
++int __lockfunc _mutex_trylock(struct mutex *lock)
++{
++	int ret = rt_mutex_trylock(&lock->lock);
++
++	if (ret)
++		mutex_acquire(&lock->dep_map, 0, 1, _RET_IP_);
++
++	return ret;
++}
++EXPORT_SYMBOL(_mutex_trylock);
++
++void __lockfunc _mutex_unlock(struct mutex *lock)
++{
++	mutex_release(&lock->dep_map, 1, _RET_IP_);
++	rt_mutex_unlock(&lock->lock);
++}
++EXPORT_SYMBOL(_mutex_unlock);
++
++/*
++ * rwlock_t functions
++ */
++int __lockfunc rt_write_trylock(rwlock_t *rwlock)
++{
++	int ret = rt_mutex_trylock(&rwlock->lock);
++
++	if (ret)
++		rwlock_acquire(&rwlock->dep_map, 0, 1, _RET_IP_);
++
++	return ret;
++}
++EXPORT_SYMBOL(rt_write_trylock);
++
++int __lockfunc rt_write_trylock_irqsave(rwlock_t *rwlock, unsigned long *flags)
++{
++	*flags = 0;
++	return rt_write_trylock(rwlock);
++}
++EXPORT_SYMBOL(rt_write_trylock_irqsave);
++
++int __lockfunc rt_read_trylock(rwlock_t *rwlock)
++{
++	struct rt_mutex *lock = &rwlock->lock;
++	int ret = 1;
++
++	/*
++	 * recursive read locks succeed when current owns the lock,
++	 * but not when read_depth == 0 which means that the lock is
++	 * write locked.
++	 */
++	if (rt_mutex_real_owner(lock) != current)
++		ret = rt_mutex_trylock(lock);
++	else if (!rwlock->read_depth)
++		ret = 0;
++
++	if (ret) {
++		rwlock->read_depth++;
++		rwlock_acquire_read(&rwlock->dep_map, 0, 1, _RET_IP_);
++	}
++
++	return ret;
++}
++EXPORT_SYMBOL(rt_read_trylock);
++
++void __lockfunc rt_write_lock(rwlock_t *rwlock)
++{
++	rwlock_acquire(&rwlock->dep_map, 0, 0, _RET_IP_);
++	__rt_spin_lock(&rwlock->lock);
++}
++EXPORT_SYMBOL(rt_write_lock);
++
++void __lockfunc rt_read_lock(rwlock_t *rwlock)
++{
++	struct rt_mutex *lock = &rwlock->lock;
++
++	rwlock_acquire_read(&rwlock->dep_map, 0, 0, _RET_IP_);
++
++	/*
++	 * recursive read locks succeed when current owns the lock
++	 */
++	if (rt_mutex_real_owner(lock) != current)
++		__rt_spin_lock(lock);
++	rwlock->read_depth++;
++}
++
++EXPORT_SYMBOL(rt_read_lock);
++
++void __lockfunc rt_write_unlock(rwlock_t *rwlock)
++{
++	/* NOTE: we always pass in '1' for nested, for simplicity */
++	rwlock_release(&rwlock->dep_map, 1, _RET_IP_);
++	__rt_spin_unlock(&rwlock->lock);
++}
++EXPORT_SYMBOL(rt_write_unlock);
++
++void __lockfunc rt_read_unlock(rwlock_t *rwlock)
++{
++	rwlock_release(&rwlock->dep_map, 1, _RET_IP_);
++
++	/* Release the lock only when read_depth is down to 0 */
++	if (--rwlock->read_depth == 0)
++		__rt_spin_unlock(&rwlock->lock);
++}
++EXPORT_SYMBOL(rt_read_unlock);
++
++unsigned long __lockfunc rt_write_lock_irqsave(rwlock_t *rwlock)
++{
++	rt_write_lock(rwlock);
++
++	return 0;
++}
++EXPORT_SYMBOL(rt_write_lock_irqsave);
++
++unsigned long __lockfunc rt_read_lock_irqsave(rwlock_t *rwlock)
++{
++	rt_read_lock(rwlock);
++
++	return 0;
++}
++EXPORT_SYMBOL(rt_read_lock_irqsave);
++
++void __rt_rwlock_init(rwlock_t *rwlock, char *name, struct lock_class_key *key)
++{
++#ifdef CONFIG_DEBUG_LOCK_ALLOC
++	/*
++	 * Make sure we are not reinitializing a held lock:
++	 */
++	debug_check_no_locks_freed((void *)rwlock, sizeof(*rwlock));
++	lockdep_init_map(&rwlock->dep_map, name, key, 0);
++#endif
++	__rt_mutex_init(&rwlock->lock, name);
++	rwlock->read_depth = 0;
++}
++EXPORT_SYMBOL(__rt_rwlock_init);
++
++/*
++ * rw_semaphores
++ */
++
++void  rt_up_write(struct rw_semaphore *rwsem)
++{
++	rwsem_release(&rwsem->dep_map, 1, _RET_IP_);
++	rt_mutex_unlock(&rwsem->lock);
++}
++EXPORT_SYMBOL(rt_up_write);
++
++void  rt_up_read(struct rw_semaphore *rwsem)
++{
++	rwsem_release(&rwsem->dep_map, 1, _RET_IP_);
++	if (--rwsem->read_depth == 0)
++		rt_mutex_unlock(&rwsem->lock);
++}
++EXPORT_SYMBOL(rt_up_read);
++
++/*
++ * downgrade a write lock into a read lock
++ * - just wake up any readers at the front of the queue
++ */
++void  rt_downgrade_write(struct rw_semaphore *rwsem)
++{
++	BUG_ON(rt_mutex_real_owner(&rwsem->lock) != current);
++	rwsem->read_depth = 1;
++}
++EXPORT_SYMBOL(rt_downgrade_write);
++
++int  rt_down_write_trylock(struct rw_semaphore *rwsem)
++{
++	int ret = rt_mutex_trylock(&rwsem->lock);
++
++	if (ret)
++		rwsem_acquire(&rwsem->dep_map, 0, 1, _RET_IP_);
++	return ret;
++}
++EXPORT_SYMBOL(rt_down_write_trylock);
++
++void  rt_down_write(struct rw_semaphore *rwsem)
++{
++	rwsem_acquire(&rwsem->dep_map, 0, 0, _RET_IP_);
++	rt_mutex_lock(&rwsem->lock);
++}
++EXPORT_SYMBOL(rt_down_write);
++
++void  rt_down_write_nested(struct rw_semaphore *rwsem, int subclass)
++{
++	rwsem_acquire(&rwsem->dep_map, subclass, 0, _RET_IP_);
++	rt_mutex_lock(&rwsem->lock);
++}
++EXPORT_SYMBOL(rt_down_write_nested);
++
++int  rt_down_read_trylock(struct rw_semaphore *rwsem)
++{
++	struct rt_mutex *lock = &rwsem->lock;
++	int ret = 1;
++
++	/*
++	 * recursive read locks succeed when current owns the rwsem,
++	 * but not when read_depth == 0 which means that the rwsem is
++	 * write locked.
++	 */
++	if (rt_mutex_real_owner(lock) != current)
++		ret = rt_mutex_trylock(&rwsem->lock);
++	else if (!rwsem->read_depth)
++		ret = 0;
++
++	if (ret) {
++		rwsem->read_depth++;
++		rwsem_acquire(&rwsem->dep_map, 0, 1, _RET_IP_);
++	}
++	return ret;
++}
++EXPORT_SYMBOL(rt_down_read_trylock);
++
++static void __rt_down_read(struct rw_semaphore *rwsem, int subclass)
++{
++	struct rt_mutex *lock = &rwsem->lock;
++
++	rwsem_acquire_read(&rwsem->dep_map, subclass, 0, _RET_IP_);
++
++	if (rt_mutex_real_owner(lock) != current)
++		rt_mutex_lock(&rwsem->lock);
++	rwsem->read_depth++;
++}
++
++void  rt_down_read(struct rw_semaphore *rwsem)
++{
++	__rt_down_read(rwsem, 0);
++}
++EXPORT_SYMBOL(rt_down_read);
++
++void  rt_down_read_nested(struct rw_semaphore *rwsem, int subclass)
++{
++	__rt_down_read(rwsem, subclass);
++}
++EXPORT_SYMBOL(rt_down_read_nested);
++
++void  __rt_rwsem_init(struct rw_semaphore *rwsem, char *name,
++			      struct lock_class_key *key)
++{
++#ifdef CONFIG_DEBUG_LOCK_ALLOC
++	/*
++	 * Make sure we are not reinitializing a held lock:
++	 */
++	debug_check_no_locks_freed((void *)rwsem, sizeof(*rwsem));
++	lockdep_init_map(&rwsem->dep_map, name, key, 0);
++#endif
++	__rt_mutex_init(&rwsem->lock, name);
++	rwsem->read_depth = 0;
++}
++EXPORT_SYMBOL(__rt_rwsem_init);
++
++/*
++ * Semaphores
++ */
++/*
++ * Linux Semaphores implemented via RT-mutexes.
++ *
++ * In the down() variants we use the mutex as the semaphore blocking
++ * object: we always acquire it, decrease the counter and keep the lock
++ * locked if we did the 1->0 transition. The next down() will then block.
++ *
++ * In the up() path we atomically increase the counter and do the
++ * unlock if we were the one doing the 0->1 transition.
++ */
++
++static inline void __down_complete(struct semaphore *sem)
++{
++	int count = atomic_dec_return(&sem->count);
++
++	if (unlikely(count > 0))
++		rt_mutex_unlock(&sem->lock);
++}
++
++void  rt_down(struct semaphore *sem)
++{
++	rt_mutex_lock(&sem->lock);
++	__down_complete(sem);
++}
++EXPORT_SYMBOL(rt_down);
++
++int  rt_down_interruptible(struct semaphore *sem)
++{
++	int ret;
++
++	ret = rt_mutex_lock_interruptible(&sem->lock, 0);
++	if (ret)
++		return ret;
++	__down_complete(sem);
++	return 0;
++}
++EXPORT_SYMBOL(rt_down_interruptible);
++
++int rt_down_timeout(struct semaphore *sem, long jiff)
++{
++	struct hrtimer_sleeper t;
++	struct timespec ts;
++	unsigned long expires = jiffies + jiff + 1;
++	int ret;
++
++	/*
++	 * rt_mutex_slowlock can use an interruptible, but this needs to
++	 * be TASK_INTERRUPTIBLE. The down_timeout uses TASK_UNINTERRUPTIBLE.
++	 * To handle this we loop if a signal caused the timeout and the
++	 * we recalculate the new timeout.
++	 * Yes Thomas, this is a hack! But we can fix it right later.
++	 */
++	do {
++		jiffies_to_timespec(jiff, &ts);
++		hrtimer_init_on_stack(&t.timer, HRTIMER_MODE_REL, CLOCK_MONOTONIC);
++		t.timer._expires = timespec_to_ktime(ts);
++
++		ret = rt_mutex_timed_lock(&sem->lock, &t, 0);
++		if (ret != -EINTR)
++			break;
++
++		/* signal occured, but the down_timeout doesn't handle them */
++		jiff = expires - jiffies;
++
++	} while (jiff > 0);
++
++	if (!ret)
++		__down_complete(sem);
++	else
++		ret = -ETIME;
++
++	return ret;
++}
++EXPORT_SYMBOL(rt_down_timeout);
++
++/*
++ * try to down the semaphore, 0 on success and 1 on failure. (inverted)
++ */
++int  rt_down_trylock(struct semaphore *sem)
++{
++	/*
++	 * Here we are a tiny bit different from ordinary Linux semaphores,
++	 * because we can get 'transient' locking-failures when say a
++	 * process decreases the count from 9 to 8 and locks/releases the
++	 * embedded mutex internally. It would be quite complex to remove
++	 * these transient failures so lets try it the simple way first:
++	 */
++	if (rt_mutex_trylock(&sem->lock)) {
++		__down_complete(sem);
++		return 0;
++	}
++	return 1;
++}
++EXPORT_SYMBOL(rt_down_trylock);
++
++void  rt_up(struct semaphore *sem)
++{
++	int count;
++
++	/*
++	 * Disable preemption to make sure a highprio trylock-er cannot
++	 * preempt us here and get into an infinite loop:
++	 */
++	preempt_disable();
++	count = atomic_inc_return(&sem->count);
++	/*
++	 * If we did the 0 -> 1 transition then we are the ones to unlock it:
++	 */
++	if (likely(count == 1))
++		rt_mutex_unlock(&sem->lock);
++	preempt_enable();
++}
++EXPORT_SYMBOL(rt_up);
++
++void  __sema_init(struct semaphore *sem, int val,
++			  char *name, char *file, int line)
++{
++	atomic_set(&sem->count, val);
++	switch (val) {
++	case 0:
++		__rt_mutex_init(&sem->lock, name);
++		rt_mutex_lock(&sem->lock);
++		break;
++	default:
++		__rt_mutex_init(&sem->lock, name);
++		break;
++	}
++}
++EXPORT_SYMBOL(__sema_init);
++
++/**
++ * atomic_dec_and_mutex_lock - return holding mutex if we dec to 0
++ * @cnt: the atomic which we are to dec
++ * @lock: the mutex to return holding if we dec to 0
++ *
++ * return true and hold lock if we dec to 0, return false otherwise
++ */
++int atomic_dec_and_mutex_lock(atomic_t *cnt, struct mutex *lock)
++{
++	/* dec if we can't possibly hit 0 */
++	if (atomic_add_unless(cnt, -1, 1))
++		return 0;
++	/* we might hit 0, so take the lock */
++	mutex_lock(lock);
++	if (!atomic_dec_and_test(cnt)) {
++		/* when we actually did the dec, we didn't hit 0 */
++		mutex_unlock(lock);
++		return 0;
++	}
++	/* we hit 0, and we hold the lock */
++	return 1;
++}
++EXPORT_SYMBOL(atomic_dec_and_mutex_lock);
+Index: linux-rt-2.6.31/kernel/rtmutex-debug.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/rtmutex-debug.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/rtmutex-debug.c	2010-05-17 14:23:20.088518193 +0200
+@@ -29,61 +29,6 @@
+ 
+ #include "rtmutex_common.h"
+ 
+-# define TRACE_WARN_ON(x)			WARN_ON(x)
+-# define TRACE_BUG_ON(x)			BUG_ON(x)
+-
+-# define TRACE_OFF()						\
+-do {								\
+-	if (rt_trace_on) {					\
+-		rt_trace_on = 0;				\
+-		console_verbose();				\
+-		if (spin_is_locked(&current->pi_lock))		\
+-			spin_unlock(&current->pi_lock);		\
+-	}							\
+-} while (0)
+-
+-# define TRACE_OFF_NOLOCK()					\
+-do {								\
+-	if (rt_trace_on) {					\
+-		rt_trace_on = 0;				\
+-		console_verbose();				\
+-	}							\
+-} while (0)
+-
+-# define TRACE_BUG_LOCKED()			\
+-do {						\
+-	TRACE_OFF();				\
+-	BUG();					\
+-} while (0)
+-
+-# define TRACE_WARN_ON_LOCKED(c)		\
+-do {						\
+-	if (unlikely(c)) {			\
+-		TRACE_OFF();			\
+-		WARN_ON(1);			\
+-	}					\
+-} while (0)
+-
+-# define TRACE_BUG_ON_LOCKED(c)			\
+-do {						\
+-	if (unlikely(c))			\
+-		TRACE_BUG_LOCKED();		\
+-} while (0)
+-
+-#ifdef CONFIG_SMP
+-# define SMP_TRACE_BUG_ON_LOCKED(c)	TRACE_BUG_ON_LOCKED(c)
+-#else
+-# define SMP_TRACE_BUG_ON_LOCKED(c)	do { } while (0)
+-#endif
+-
+-/*
+- * deadlock detection flag. We turn it off when we detect
+- * the first problem because we dont want to recurse back
+- * into the tracing code when doing error printk or
+- * executing a BUG():
+- */
+-static int rt_trace_on = 1;
+-
+ static void printk_task(struct task_struct *p)
+ {
+ 	if (p)
+@@ -111,8 +56,8 @@
+ 
+ void rt_mutex_debug_task_free(struct task_struct *task)
+ {
+-	WARN_ON(!plist_head_empty(&task->pi_waiters));
+-	WARN_ON(task->pi_blocked_on);
++	DEBUG_LOCKS_WARN_ON(!plist_head_empty(&task->pi_waiters));
++	DEBUG_LOCKS_WARN_ON(task->pi_blocked_on);
+ }
+ 
+ /*
+@@ -125,7 +70,7 @@
+ {
+ 	struct task_struct *task;
+ 
+-	if (!rt_trace_on || detect || !act_waiter)
++	if (!debug_locks || detect || !act_waiter)
+ 		return;
+ 
+ 	task = rt_mutex_owner(act_waiter->lock);
+@@ -139,7 +84,7 @@
+ {
+ 	struct task_struct *task;
+ 
+-	if (!waiter->deadlock_lock || !rt_trace_on)
++	if (!waiter->deadlock_lock || !debug_locks)
+ 		return;
+ 
+ 	rcu_read_lock();
+@@ -149,7 +94,8 @@
+ 		return;
+ 	}
+ 
+-	TRACE_OFF_NOLOCK();
++	if (!debug_locks_off())
++		return;
+ 
+ 	printk("\n============================================\n");
+ 	printk(  "[ BUG: circular locking deadlock detected! ]\n");
+@@ -180,7 +126,6 @@
+ 
+ 	printk("[ turning off deadlock detection."
+ 	       "Please report this trace. ]\n\n");
+-	local_irq_disable();
+ }
+ 
+ void debug_rt_mutex_lock(struct rt_mutex *lock)
+@@ -189,7 +134,8 @@
+ 
+ void debug_rt_mutex_unlock(struct rt_mutex *lock)
+ {
+-	TRACE_WARN_ON_LOCKED(rt_mutex_owner(lock) != current);
++	if (debug_locks)
++		DEBUG_LOCKS_WARN_ON(rt_mutex_owner(lock) != current);
+ }
+ 
+ void
+@@ -199,7 +145,7 @@
+ 
+ void debug_rt_mutex_proxy_unlock(struct rt_mutex *lock)
+ {
+-	TRACE_WARN_ON_LOCKED(!rt_mutex_owner(lock));
++	DEBUG_LOCKS_WARN_ON(!rt_mutex_owner(lock));
+ }
+ 
+ void debug_rt_mutex_init_waiter(struct rt_mutex_waiter *waiter)
+@@ -213,9 +159,9 @@
+ void debug_rt_mutex_free_waiter(struct rt_mutex_waiter *waiter)
+ {
+ 	put_pid(waiter->deadlock_task_pid);
+-	TRACE_WARN_ON(!plist_node_empty(&waiter->list_entry));
+-	TRACE_WARN_ON(!plist_node_empty(&waiter->pi_list_entry));
+-	TRACE_WARN_ON(waiter->task);
++	DEBUG_LOCKS_WARN_ON(!plist_node_empty(&waiter->list_entry));
++	DEBUG_LOCKS_WARN_ON(!plist_node_empty(&waiter->pi_list_entry));
++	DEBUG_LOCKS_WARN_ON(waiter->task);
+ 	memset(waiter, 0x22, sizeof(*waiter));
+ }
+ 
+@@ -231,9 +177,36 @@
+ void
+ rt_mutex_deadlock_account_lock(struct rt_mutex *lock, struct task_struct *task)
+ {
++#ifdef CONFIG_DEBUG_PREEMPT
++	if (atomic_read(&task->lock_count) >= MAX_LOCK_STACK) {
++		if (!debug_locks_off())
++			return;
++		printk("BUG: %s/%d: lock count overflow!\n",
++			task->comm, task->pid);
++		dump_stack();
++		return;
++	}
++#ifdef CONFIG_PREEMPT_RT
++	task->owned_lock[atomic_read(&task->lock_count)] = lock;
++#endif
++	atomic_inc(&task->lock_count);
++#endif
+ }
+ 
+ void rt_mutex_deadlock_account_unlock(struct task_struct *task)
+ {
++#ifdef CONFIG_DEBUG_PREEMPT
++	if (!atomic_read(&task->lock_count)) {
++		if (!debug_locks_off())
++			return;
++		printk("BUG: %s/%d: lock count underflow!\n",
++			task->comm, task->pid);
++		dump_stack();
++		return;
++	}
++	atomic_dec(&task->lock_count);
++#ifdef CONFIG_PREEMPT_RT
++	task->owned_lock[atomic_read(&task->lock_count)] = NULL;
++#endif
++#endif
+ }
+-
+Index: linux-rt-2.6.31/kernel/rtmutex-debug.h
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/rtmutex-debug.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/rtmutex-debug.h	2010-05-17 14:23:20.088518193 +0200
+@@ -17,17 +17,17 @@
+ extern void debug_rt_mutex_init(struct rt_mutex *lock, const char *name);
+ extern void debug_rt_mutex_lock(struct rt_mutex *lock);
+ extern void debug_rt_mutex_unlock(struct rt_mutex *lock);
+-extern void debug_rt_mutex_proxy_lock(struct rt_mutex *lock,
+-				      struct task_struct *powner);
++extern void
++debug_rt_mutex_proxy_lock(struct rt_mutex *lock, struct task_struct *powner);
+ extern void debug_rt_mutex_proxy_unlock(struct rt_mutex *lock);
+ extern void debug_rt_mutex_deadlock(int detect, struct rt_mutex_waiter *waiter,
+ 				    struct rt_mutex *lock);
+ extern void debug_rt_mutex_print_deadlock(struct rt_mutex_waiter *waiter);
+-# define debug_rt_mutex_reset_waiter(w)			\
++# define debug_rt_mutex_reset_waiter(w) \
+ 	do { (w)->deadlock_lock = NULL; } while (0)
+ 
+-static inline int debug_rt_mutex_detect_deadlock(struct rt_mutex_waiter *waiter,
+-						 int detect)
++static inline int
++debug_rt_mutex_detect_deadlock(struct rt_mutex_waiter *waiter, int detect)
+ {
+-	return (waiter != NULL);
++	return waiter != NULL;
+ }
+Index: linux-rt-2.6.31/kernel/rtmutex.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/rtmutex.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/rtmutex.c	2010-05-17 14:23:20.098387185 +0200
+@@ -8,12 +8,20 @@
+  *  Copyright (C) 2005 Kihon Technologies Inc., Steven Rostedt
+  *  Copyright (C) 2006 Esben Nielsen
+  *
++ * Adaptive Spinlocks:
++ *  Copyright (C) 2008 Novell, Inc., Gregory Haskins, Sven Dietrich,
++ *                                   and Peter Morreale,
++ * Adaptive Spinlocks simplification:
++ *  Copyright (C) 2008 Red Hat, Inc., Steven Rostedt <srostedt@redhat.com>
++ *
+  *  See Documentation/rt-mutex-design.txt for details.
+  */
+ #include <linux/spinlock.h>
+ #include <linux/module.h>
+ #include <linux/sched.h>
+ #include <linux/timer.h>
++#include <linux/hardirq.h>
++#include <linux/semaphore.h>
+ 
+ #include "rtmutex_common.h"
+ 
+@@ -97,6 +105,22 @@
+ }
+ #endif
+ 
++int pi_initialized;
++
++/*
++ * we initialize the wait_list runtime. (Could be done build-time and/or
++ * boot-time.)
++ */
++static inline void init_lists(struct rt_mutex *lock)
++{
++	if (unlikely(!lock->wait_list.prio_list.prev)) {
++		plist_head_init_atomic(&lock->wait_list, &lock->wait_lock);
++#ifdef CONFIG_DEBUG_RT_MUTEXES
++		pi_initialized++;
++#endif
++	}
++}
++
+ /*
+  * Calculate task priority from the waiter list priority
+  *
+@@ -131,16 +155,16 @@
+  *
+  * (Note: We do this outside of the protection of lock->wait_lock to
+  * allow the lock to be taken while or before we readjust the priority
+- * of task. We do not use the spin_xx_mutex() variants here as we are
++ * of task. We do not use the atomic_spin_xx_mutex() variants here as we are
+  * outside of the debug path.)
+  */
+ static void rt_mutex_adjust_prio(struct task_struct *task)
+ {
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&task->pi_lock, flags);
++	atomic_spin_lock_irqsave(&task->pi_lock, flags);
+ 	__rt_mutex_adjust_prio(task);
+-	spin_unlock_irqrestore(&task->pi_lock, flags);
++	atomic_spin_unlock_irqrestore(&task->pi_lock, flags);
+ }
+ 
+ /*
+@@ -195,7 +219,7 @@
+ 	/*
+ 	 * Task can not go away as we did a get_task() before !
+ 	 */
+-	spin_lock_irqsave(&task->pi_lock, flags);
++	atomic_spin_lock_irqsave(&task->pi_lock, flags);
+ 
+ 	waiter = task->pi_blocked_on;
+ 	/*
+@@ -231,8 +255,8 @@
+ 		goto out_unlock_pi;
+ 
+ 	lock = waiter->lock;
+-	if (!spin_trylock(&lock->wait_lock)) {
+-		spin_unlock_irqrestore(&task->pi_lock, flags);
++	if (!atomic_spin_trylock(&lock->wait_lock)) {
++		atomic_spin_unlock_irqrestore(&task->pi_lock, flags);
+ 		cpu_relax();
+ 		goto retry;
+ 	}
+@@ -240,7 +264,7 @@
+ 	/* Deadlock detection */
+ 	if (lock == orig_lock || rt_mutex_owner(lock) == top_task) {
+ 		debug_rt_mutex_deadlock(deadlock_detect, orig_waiter, lock);
+-		spin_unlock(&lock->wait_lock);
++		atomic_spin_unlock(&lock->wait_lock);
+ 		ret = deadlock_detect ? -EDEADLK : 0;
+ 		goto out_unlock_pi;
+ 	}
+@@ -253,13 +277,13 @@
+ 	plist_add(&waiter->list_entry, &lock->wait_list);
+ 
+ 	/* Release the task */
+-	spin_unlock_irqrestore(&task->pi_lock, flags);
++	atomic_spin_unlock(&task->pi_lock);
+ 	put_task_struct(task);
+ 
+ 	/* Grab the next task */
+ 	task = rt_mutex_owner(lock);
+ 	get_task_struct(task);
+-	spin_lock_irqsave(&task->pi_lock, flags);
++	atomic_spin_lock(&task->pi_lock);
+ 
+ 	if (waiter == rt_mutex_top_waiter(lock)) {
+ 		/* Boost the owner */
+@@ -277,10 +301,10 @@
+ 		__rt_mutex_adjust_prio(task);
+ 	}
+ 
+-	spin_unlock_irqrestore(&task->pi_lock, flags);
++	atomic_spin_unlock(&task->pi_lock);
+ 
+ 	top_waiter = rt_mutex_top_waiter(lock);
+-	spin_unlock(&lock->wait_lock);
++	atomic_spin_unlock_irqrestore(&lock->wait_lock, flags);
+ 
+ 	if (!detect_deadlock && waiter != top_waiter)
+ 		goto out_put_task;
+@@ -288,7 +312,7 @@
+ 	goto again;
+ 
+  out_unlock_pi:
+-	spin_unlock_irqrestore(&task->pi_lock, flags);
++	atomic_spin_unlock_irqrestore(&task->pi_lock, flags);
+  out_put_task:
+ 	put_task_struct(task);
+ 
+@@ -301,11 +325,10 @@
+  * lock yet]:
+  */
+ static inline int try_to_steal_lock(struct rt_mutex *lock,
+-				    struct task_struct *task)
++				    struct task_struct *task, int mode)
+ {
+ 	struct task_struct *pendowner = rt_mutex_owner(lock);
+ 	struct rt_mutex_waiter *next;
+-	unsigned long flags;
+ 
+ 	if (!rt_mutex_owner_pending(lock))
+ 		return 0;
+@@ -313,9 +336,9 @@
+ 	if (pendowner == task)
+ 		return 1;
+ 
+-	spin_lock_irqsave(&pendowner->pi_lock, flags);
+-	if (task->prio >= pendowner->prio) {
+-		spin_unlock_irqrestore(&pendowner->pi_lock, flags);
++	atomic_spin_lock(&pendowner->pi_lock);
++	if (!lock_is_stealable(task, pendowner, mode)) {
++		atomic_spin_unlock(&pendowner->pi_lock);
+ 		return 0;
+ 	}
+ 
+@@ -325,7 +348,7 @@
+ 	 * priority.
+ 	 */
+ 	if (likely(!rt_mutex_has_waiters(lock))) {
+-		spin_unlock_irqrestore(&pendowner->pi_lock, flags);
++		atomic_spin_unlock(&pendowner->pi_lock);
+ 		return 1;
+ 	}
+ 
+@@ -333,7 +356,7 @@
+ 	next = rt_mutex_top_waiter(lock);
+ 	plist_del(&next->pi_list_entry, &pendowner->pi_waiters);
+ 	__rt_mutex_adjust_prio(pendowner);
+-	spin_unlock_irqrestore(&pendowner->pi_lock, flags);
++	atomic_spin_unlock(&pendowner->pi_lock);
+ 
+ 	/*
+ 	 * We are going to steal the lock and a waiter was
+@@ -350,10 +373,10 @@
+ 	 * might be task:
+ 	 */
+ 	if (likely(next->task != task)) {
+-		spin_lock_irqsave(&task->pi_lock, flags);
++		atomic_spin_lock(&task->pi_lock);
+ 		plist_add(&next->pi_list_entry, &task->pi_waiters);
+ 		__rt_mutex_adjust_prio(task);
+-		spin_unlock_irqrestore(&task->pi_lock, flags);
++		atomic_spin_unlock(&task->pi_lock);
+ 	}
+ 	return 1;
+ }
+@@ -367,7 +390,7 @@
+  *
+  * Must be called with lock->wait_lock held.
+  */
+-static int try_to_take_rt_mutex(struct rt_mutex *lock)
++static int do_try_to_take_rt_mutex(struct rt_mutex *lock, int mode)
+ {
+ 	/*
+ 	 * We have to be careful here if the atomic speedups are
+@@ -390,7 +413,7 @@
+ 	 */
+ 	mark_rt_mutex_waiters(lock);
+ 
+-	if (rt_mutex_owner(lock) && !try_to_steal_lock(lock, current))
++	if (rt_mutex_owner(lock) && !try_to_steal_lock(lock, current, mode))
+ 		return 0;
+ 
+ 	/* We got the lock. */
+@@ -403,6 +426,11 @@
+ 	return 1;
+ }
+ 
++static inline int try_to_take_rt_mutex(struct rt_mutex *lock)
++{
++	return do_try_to_take_rt_mutex(lock, STEAL_NORMAL);
++}
++
+ /*
+  * Task blocks on lock.
+  *
+@@ -413,14 +441,13 @@
+ static int task_blocks_on_rt_mutex(struct rt_mutex *lock,
+ 				   struct rt_mutex_waiter *waiter,
+ 				   struct task_struct *task,
+-				   int detect_deadlock)
++				   int detect_deadlock, unsigned long flags)
+ {
+ 	struct task_struct *owner = rt_mutex_owner(lock);
+ 	struct rt_mutex_waiter *top_waiter = waiter;
+-	unsigned long flags;
+ 	int chain_walk = 0, res;
+ 
+-	spin_lock_irqsave(&task->pi_lock, flags);
++	atomic_spin_lock(&task->pi_lock);
+ 	__rt_mutex_adjust_prio(task);
+ 	waiter->task = task;
+ 	waiter->lock = lock;
+@@ -434,17 +461,17 @@
+ 
+ 	task->pi_blocked_on = waiter;
+ 
+-	spin_unlock_irqrestore(&task->pi_lock, flags);
++	atomic_spin_unlock(&task->pi_lock);
+ 
+ 	if (waiter == rt_mutex_top_waiter(lock)) {
+-		spin_lock_irqsave(&owner->pi_lock, flags);
++		atomic_spin_lock(&owner->pi_lock);
+ 		plist_del(&top_waiter->pi_list_entry, &owner->pi_waiters);
+ 		plist_add(&waiter->pi_list_entry, &owner->pi_waiters);
+ 
+ 		__rt_mutex_adjust_prio(owner);
+ 		if (owner->pi_blocked_on)
+ 			chain_walk = 1;
+-		spin_unlock_irqrestore(&owner->pi_lock, flags);
++		atomic_spin_unlock(&owner->pi_lock);
+ 	}
+ 	else if (debug_rt_mutex_detect_deadlock(waiter, detect_deadlock))
+ 		chain_walk = 1;
+@@ -459,12 +486,12 @@
+ 	 */
+ 	get_task_struct(owner);
+ 
+-	spin_unlock(&lock->wait_lock);
++	atomic_spin_unlock_irqrestore(&lock->wait_lock, flags);
+ 
+ 	res = rt_mutex_adjust_prio_chain(owner, detect_deadlock, lock, waiter,
+ 					 task);
+ 
+-	spin_lock(&lock->wait_lock);
++	atomic_spin_lock_irq(&lock->wait_lock);
+ 
+ 	return res;
+ }
+@@ -477,13 +504,13 @@
+  *
+  * Called with lock->wait_lock held.
+  */
+-static void wakeup_next_waiter(struct rt_mutex *lock)
++static void wakeup_next_waiter(struct rt_mutex *lock, int savestate)
+ {
+ 	struct rt_mutex_waiter *waiter;
+ 	struct task_struct *pendowner;
+-	unsigned long flags;
++	struct rt_mutex_waiter *next;
+ 
+-	spin_lock_irqsave(&current->pi_lock, flags);
++	atomic_spin_lock(&current->pi_lock);
+ 
+ 	waiter = rt_mutex_top_waiter(lock);
+ 	plist_del(&waiter->list_entry, &lock->wait_list);
+@@ -498,9 +525,44 @@
+ 	pendowner = waiter->task;
+ 	waiter->task = NULL;
+ 
++	/*
++	 * Do the wakeup before the ownership change to give any spinning
++	 * waiter grantees a headstart over the other threads that will
++	 * trigger once owner changes.
++	 */
++	if (!savestate)
++		wake_up_process(pendowner);
++	else {
++		/*
++		 * We can skip the actual (expensive) wakeup if the
++		 * waiter is already running, but we have to be careful
++		 * of race conditions because they may be about to sleep.
++		 *
++		 * The waiter-side protocol has the following pattern:
++		 * 1: Set state != RUNNING
++		 * 2: Conditionally sleep if waiter->task != NULL;
++		 *
++		 * And the owner-side has the following:
++		 * A: Set waiter->task = NULL
++		 * B: Conditionally wake if the state != RUNNING
++		 *
++		 * As long as we ensure 1->2 order, and A->B order, we
++		 * will never miss a wakeup.
++		 *
++		 * Therefore, this barrier ensures that waiter->task = NULL
++		 * is visible before we test the pendowner->state.  The
++		 * corresponding barrier is in the sleep logic.
++		 */
++		smp_mb();
++
++		/* If !RUNNING && !RUNNING_MUTEX */
++		if (pendowner->state & ~TASK_RUNNING_MUTEX)
++			wake_up_process_mutex(pendowner);
++	}
++
+ 	rt_mutex_set_owner(lock, pendowner, RT_MUTEX_OWNER_PENDING);
+ 
+-	spin_unlock_irqrestore(&current->pi_lock, flags);
++	atomic_spin_unlock(&current->pi_lock);
+ 
+ 	/*
+ 	 * Clear the pi_blocked_on variable and enqueue a possible
+@@ -509,7 +571,13 @@
+ 	 * waiter with higher priority than pending-owner->normal_prio
+ 	 * is blocked on the unboosted (pending) owner.
+ 	 */
+-	spin_lock_irqsave(&pendowner->pi_lock, flags);
++
++	if (rt_mutex_has_waiters(lock))
++		next = rt_mutex_top_waiter(lock);
++	else
++		next = NULL;
++
++	atomic_spin_lock(&pendowner->pi_lock);
+ 
+ 	WARN_ON(!pendowner->pi_blocked_on);
+ 	WARN_ON(pendowner->pi_blocked_on != waiter);
+@@ -517,15 +585,10 @@
+ 
+ 	pendowner->pi_blocked_on = NULL;
+ 
+-	if (rt_mutex_has_waiters(lock)) {
+-		struct rt_mutex_waiter *next;
+-
+-		next = rt_mutex_top_waiter(lock);
++	if (next)
+ 		plist_add(&next->pi_list_entry, &pendowner->pi_waiters);
+-	}
+-	spin_unlock_irqrestore(&pendowner->pi_lock, flags);
+ 
+-	wake_up_process(pendowner);
++	atomic_spin_unlock(&pendowner->pi_lock);
+ }
+ 
+ /*
+@@ -534,22 +597,22 @@
+  * Must be called with lock->wait_lock held
+  */
+ static void remove_waiter(struct rt_mutex *lock,
+-			  struct rt_mutex_waiter *waiter)
++			  struct rt_mutex_waiter *waiter,
++			  unsigned long flags)
+ {
+ 	int first = (waiter == rt_mutex_top_waiter(lock));
+ 	struct task_struct *owner = rt_mutex_owner(lock);
+-	unsigned long flags;
+ 	int chain_walk = 0;
+ 
+-	spin_lock_irqsave(&current->pi_lock, flags);
++	atomic_spin_lock(&current->pi_lock);
+ 	plist_del(&waiter->list_entry, &lock->wait_list);
+ 	waiter->task = NULL;
+ 	current->pi_blocked_on = NULL;
+-	spin_unlock_irqrestore(&current->pi_lock, flags);
++	atomic_spin_unlock(&current->pi_lock);
+ 
+ 	if (first && owner != current) {
+ 
+-		spin_lock_irqsave(&owner->pi_lock, flags);
++		atomic_spin_lock(&owner->pi_lock);
+ 
+ 		plist_del(&waiter->pi_list_entry, &owner->pi_waiters);
+ 
+@@ -564,7 +627,7 @@
+ 		if (owner->pi_blocked_on)
+ 			chain_walk = 1;
+ 
+-		spin_unlock_irqrestore(&owner->pi_lock, flags);
++		atomic_spin_unlock(&owner->pi_lock);
+ 	}
+ 
+ 	WARN_ON(!plist_node_empty(&waiter->pi_list_entry));
+@@ -575,11 +638,11 @@
+ 	/* gets dropped in rt_mutex_adjust_prio_chain()! */
+ 	get_task_struct(owner);
+ 
+-	spin_unlock(&lock->wait_lock);
++	atomic_spin_unlock_irqrestore(&lock->wait_lock, flags);
+ 
+ 	rt_mutex_adjust_prio_chain(owner, 0, lock, NULL, current);
+ 
+-	spin_lock(&lock->wait_lock);
++	atomic_spin_lock_irq(&lock->wait_lock);
+ }
+ 
+ /*
+@@ -592,26 +655,399 @@
+ 	struct rt_mutex_waiter *waiter;
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&task->pi_lock, flags);
++	atomic_spin_lock_irqsave(&task->pi_lock, flags);
+ 
+ 	waiter = task->pi_blocked_on;
+ 	if (!waiter || waiter->list_entry.prio == task->prio) {
+-		spin_unlock_irqrestore(&task->pi_lock, flags);
++		atomic_spin_unlock_irqrestore(&task->pi_lock, flags);
+ 		return;
+ 	}
+ 
+-	spin_unlock_irqrestore(&task->pi_lock, flags);
+-
+ 	/* gets dropped in rt_mutex_adjust_prio_chain()! */
+ 	get_task_struct(task);
++	atomic_spin_unlock_irqrestore(&task->pi_lock, flags);
+ 	rt_mutex_adjust_prio_chain(task, 0, NULL, NULL, task);
+ }
+ 
++/*
++ * preemptible spin_lock functions:
++ */
++
++#ifdef CONFIG_PREEMPT_RT
++
++static inline void
++rt_spin_lock_fastlock(struct rt_mutex *lock,
++		void  (*slowfn)(struct rt_mutex *lock))
++{
++	/* Temporary HACK! */
++	if (likely(!current->in_printk))
++		might_sleep();
++	else if (in_atomic() || irqs_disabled())
++		/* don't grab locks for printk in atomic */
++		return;
++
++	if (likely(rt_mutex_cmpxchg(lock, NULL, current)))
++		rt_mutex_deadlock_account_lock(lock, current);
++	else
++		slowfn(lock);
++}
++
++static inline void
++rt_spin_lock_fastunlock(struct rt_mutex *lock,
++			void  (*slowfn)(struct rt_mutex *lock))
++{
++	/* Temporary HACK! */
++	if (unlikely(rt_mutex_owner(lock) != current) && current->in_printk)
++		/* don't grab locks for printk in atomic */
++		return;
++
++	if (likely(rt_mutex_cmpxchg(lock, current, NULL)))
++		rt_mutex_deadlock_account_unlock(current);
++	else
++		slowfn(lock);
++}
++
++
++#ifdef CONFIG_SMP
++static int adaptive_wait(struct rt_mutex_waiter *waiter,
++			 struct task_struct *orig_owner)
++{
++	for (;;) {
++
++		/* we are the owner? */
++		if (!waiter->task)
++			return 0;
++
++		/* Owner changed? Then lets update the original */
++		if (orig_owner != rt_mutex_owner(waiter->lock))
++			return 0;
++
++		/* Owner went to bed, so should we */
++		if (!task_is_current(orig_owner))
++			return 1;
++
++		cpu_relax();
++	}
++}
++#else
++static int adaptive_wait(struct rt_mutex_waiter *waiter,
++			 struct task_struct *orig_owner)
++{
++	return 1;
++}
++#endif
++
++/*
++ * The state setting needs to preserve the original state and needs to
++ * take care of non rtmutex wakeups.
++ *
++ * Called with rtmutex->wait_lock held to serialize against rtmutex
++ * wakeups().
++ */
++static inline unsigned long
++rt_set_current_blocked_state(unsigned long saved_state)
++{
++	unsigned long state, block_state;
++
++	/*
++	 * If state is TASK_INTERRUPTIBLE, then we set the state for
++	 * blocking to TASK_INTERRUPTIBLE as well, otherwise we would
++	 * miss real wakeups via wake_up_interruptible(). If such a
++	 * wakeup happens we see the running state and preserve it in
++	 * saved_state. Now we can ignore further wakeups as we will
++	 * return in state running from our "spin" sleep.
++	 */
++	if (saved_state == TASK_INTERRUPTIBLE)
++		block_state = TASK_INTERRUPTIBLE;
++	else
++		block_state = TASK_UNINTERRUPTIBLE;
++
++	state = xchg(&current->state, block_state);
++	/*
++	 * Take care of non rtmutex wakeups. rtmutex wakeups
++	 * or TASK_RUNNING_MUTEX to (UN)INTERRUPTIBLE.
++	 */
++	if (state == TASK_RUNNING)
++		saved_state = TASK_RUNNING;
++
++	return saved_state;
++}
++
++static inline void rt_restore_current_state(unsigned long saved_state)
++{
++	unsigned long state = xchg(&current->state, saved_state);
++
++	if (state == TASK_RUNNING)
++		current->state = TASK_RUNNING;
++}
++
++/*
++ * Slow path lock function spin_lock style: this variant is very
++ * careful not to miss any non-lock wakeups.
++ *
++ * The wakeup side uses wake_up_process_mutex, which, combined with
++ * the xchg code of this function is a transparent sleep/wakeup
++ * mechanism nested within any existing sleep/wakeup mechanism. This
++ * enables the seemless use of arbitrary (blocking) spinlocks within
++ * sleep/wakeup event loops.
++ */
++static void  noinline __sched
++rt_spin_lock_slowlock(struct rt_mutex *lock)
++{
++	struct rt_mutex_waiter waiter;
++	unsigned long saved_state, flags;
++	struct task_struct *orig_owner;
++
++	debug_rt_mutex_init_waiter(&waiter);
++	waiter.task = NULL;
++
++	atomic_spin_lock_irqsave(&lock->wait_lock, flags);
++	init_lists(lock);
++
++	BUG_ON(rt_mutex_owner(lock) == current);
++
++	/*
++	 * Here we save whatever state the task was in originally,
++	 * we'll restore it at the end of the function and we'll take
++	 * any intermediate wakeup into account as well, independently
++	 * of the lock sleep/wakeup mechanism. When we get a real
++	 * wakeup the task->state is TASK_RUNNING and we change
++	 * saved_state accordingly. If we did not get a real wakeup
++	 * then we return with the saved state. We need to be careful
++	 * about original state TASK_INTERRUPTIBLE as well, as we
++	 * could miss a wakeup_interruptible()
++	 */
++	saved_state = rt_set_current_blocked_state(current->state);
++
++	for (;;) {
++		int saved_lock_depth = current->lock_depth;
++
++		/* Try to acquire the lock */
++		if (do_try_to_take_rt_mutex(lock, STEAL_LATERAL))
++			break;
++
++		/*
++		 * waiter.task is NULL the first time we come here and
++		 * when we have been woken up by the previous owner
++		 * but the lock got stolen by an higher prio task.
++		 */
++		if (!waiter.task) {
++			task_blocks_on_rt_mutex(lock, &waiter, current, 0,
++						flags);
++			/* Wakeup during boost ? */
++			if (unlikely(!waiter.task))
++				continue;
++		}
++
++		/*
++		 * Prevent schedule() to drop BKL, while waiting for
++		 * the lock ! We restore lock_depth when we come back.
++		 */
++		current->lock_depth = -1;
++		orig_owner = rt_mutex_owner(lock);
++		get_task_struct(orig_owner);
++		atomic_spin_unlock_irqrestore(&lock->wait_lock, flags);
++
++		debug_rt_mutex_print_deadlock(&waiter);
++
++		if (adaptive_wait(&waiter, orig_owner)) {
++			put_task_struct(orig_owner);
++
++			if (waiter.task)
++				schedule_rt_mutex(lock);
++		} else
++			put_task_struct(orig_owner);
++
++		atomic_spin_lock_irqsave(&lock->wait_lock, flags);
++		current->lock_depth = saved_lock_depth;
++		saved_state = rt_set_current_blocked_state(saved_state);
++	}
++
++	rt_restore_current_state(saved_state);
++
++	/*
++	 * Extremely rare case, if we got woken up by a non-mutex wakeup,
++	 * and we managed to steal the lock despite us not being the
++	 * highest-prio waiter (due to SCHED_OTHER changing prio), then we
++	 * can end up with a non-NULL waiter.task:
++	 */
++	if (unlikely(waiter.task))
++		remove_waiter(lock, &waiter, flags);
++	/*
++	 * try_to_take_rt_mutex() sets the waiter bit
++	 * unconditionally. We might have to fix that up:
++	 */
++	fixup_rt_mutex_waiters(lock);
++
++	atomic_spin_unlock_irqrestore(&lock->wait_lock, flags);
++
++	debug_rt_mutex_free_waiter(&waiter);
++}
++
++/*
++ * Slow path to release a rt_mutex spin_lock style
++ */
++static void  noinline __sched
++rt_spin_lock_slowunlock(struct rt_mutex *lock)
++{
++	unsigned long flags;
++
++	atomic_spin_lock_irqsave(&lock->wait_lock, flags);
++
++	debug_rt_mutex_unlock(lock);
++
++	rt_mutex_deadlock_account_unlock(current);
++
++	if (!rt_mutex_has_waiters(lock)) {
++		lock->owner = NULL;
++		atomic_spin_unlock_irqrestore(&lock->wait_lock, flags);
++		return;
++	}
++
++	wakeup_next_waiter(lock, 1);
++
++	atomic_spin_unlock_irqrestore(&lock->wait_lock, flags);
++
++	/* Undo pi boosting.when necessary */
++	rt_mutex_adjust_prio(current);
++}
++
++void __lockfunc rt_spin_lock(spinlock_t *lock)
++{
++	rt_spin_lock_fastlock(&lock->lock, rt_spin_lock_slowlock);
++	spin_acquire(&lock->dep_map, 0, 0, _RET_IP_);
++}
++EXPORT_SYMBOL(rt_spin_lock);
++
++void __lockfunc __rt_spin_lock(struct rt_mutex *lock)
++{
++	rt_spin_lock_fastlock(lock, rt_spin_lock_slowlock);
++}
++EXPORT_SYMBOL(__rt_spin_lock);
++
++#ifdef CONFIG_DEBUG_LOCK_ALLOC
++
++void __lockfunc rt_spin_lock_nested(spinlock_t *lock, int subclass)
++{
++	rt_spin_lock_fastlock(&lock->lock, rt_spin_lock_slowlock);
++	spin_acquire(&lock->dep_map, subclass, 0, _RET_IP_);
++}
++EXPORT_SYMBOL(rt_spin_lock_nested);
++
++#endif
++
++void __lockfunc rt_spin_unlock(spinlock_t *lock)
++{
++	/* NOTE: we always pass in '1' for nested, for simplicity */
++	spin_release(&lock->dep_map, 1, _RET_IP_);
++	rt_spin_lock_fastunlock(&lock->lock, rt_spin_lock_slowunlock);
++}
++EXPORT_SYMBOL(rt_spin_unlock);
++
++void __lockfunc __rt_spin_unlock(struct rt_mutex *lock)
++{
++	rt_spin_lock_fastunlock(lock, rt_spin_lock_slowunlock);
++}
++EXPORT_SYMBOL(__rt_spin_unlock);
++
++/*
++ * Wait for the lock to get unlocked: instead of polling for an unlock
++ * (like raw spinlocks do), we lock and unlock, to force the kernel to
++ * schedule if there's contention:
++ */
++void __lockfunc rt_spin_unlock_wait(spinlock_t *lock)
++{
++	spin_lock(lock);
++	spin_unlock(lock);
++}
++EXPORT_SYMBOL(rt_spin_unlock_wait);
++
++int __lockfunc rt_spin_trylock(spinlock_t *lock)
++{
++	int ret = rt_mutex_trylock(&lock->lock);
++
++	if (ret)
++		spin_acquire(&lock->dep_map, 0, 1, _RET_IP_);
++
++	return ret;
++}
++EXPORT_SYMBOL(rt_spin_trylock);
++
++int __lockfunc rt_spin_trylock_irqsave(spinlock_t *lock, unsigned long *flags)
++{
++	int ret;
++
++	*flags = 0;
++	ret = rt_mutex_trylock(&lock->lock);
++	if (ret)
++		spin_acquire(&lock->dep_map, 0, 1, _RET_IP_);
++
++	return ret;
++}
++EXPORT_SYMBOL(rt_spin_trylock_irqsave);
++
++int atomic_dec_and_spin_lock(atomic_t *atomic, spinlock_t *lock)
++{
++	/* Subtract 1 from counter unless that drops it to 0 (ie. it was 1) */
++	if (atomic_add_unless(atomic, -1, 1))
++		return 0;
++	rt_spin_lock(lock);
++	if (atomic_dec_and_test(atomic))
++		return 1;
++	rt_spin_unlock(lock);
++	return 0;
++}
++EXPORT_SYMBOL(atomic_dec_and_spin_lock);
++
++void
++__rt_spin_lock_init(spinlock_t *lock, char *name, struct lock_class_key *key)
++{
++#ifdef CONFIG_DEBUG_LOCK_ALLOC
++	/*
++	 * Make sure we are not reinitializing a held lock:
++	 */
++	debug_check_no_locks_freed((void *)lock, sizeof(*lock));
++	lockdep_init_map(&lock->dep_map, name, key, 0);
++#endif
++	__rt_mutex_init(&lock->lock, name);
++}
++EXPORT_SYMBOL(__rt_spin_lock_init);
++
++#endif
++
++static inline int rt_release_bkl(struct rt_mutex *lock, unsigned long flags)
++{
++	int saved_lock_depth = current->lock_depth;
++
++#ifdef CONFIG_LOCK_KERNEL
++	current->lock_depth = -1;
++	/*
++	 * try_to_take_lock set the waiters, make sure it's
++	 * still correct.
++	 */
++	fixup_rt_mutex_waiters(lock);
++	atomic_spin_unlock_irqrestore(&lock->wait_lock, flags);
++
++	up(&kernel_sem);
++
++	atomic_spin_lock_irq(&lock->wait_lock);
++#endif
++	return saved_lock_depth;
++}
++
++static inline void rt_reacquire_bkl(int saved_lock_depth)
++{
++#ifdef CONFIG_LOCK_KERNEL
++	down(&kernel_sem);
++	current->lock_depth = saved_lock_depth;
++#endif
++}
++
+ /**
+  * __rt_mutex_slowlock() - Perform the wait-wake-try-to-take loop
+  * @lock:		 the rt_mutex to take
+  * @state:		 the state the task should block in (TASK_INTERRUPTIBLE
+- * 			 or TASK_UNINTERRUPTIBLE)
++ *			 or TASK_UNINTERRUPTIBLE)
+  * @timeout:		 the pre-initialized and started timer, or NULL for none
+  * @waiter:		 the pre-initialized rt_mutex_waiter
+  * @detect_deadlock:	 passed to task_blocks_on_rt_mutex
+@@ -622,7 +1058,7 @@
+ __rt_mutex_slowlock(struct rt_mutex *lock, int state,
+ 		    struct hrtimer_sleeper *timeout,
+ 		    struct rt_mutex_waiter *waiter,
+-		    int detect_deadlock)
++		    int detect_deadlock, unsigned long flags)
+ {
+ 	int ret = 0;
+ 
+@@ -652,7 +1088,7 @@
+ 		 */
+ 		if (!waiter->task) {
+ 			ret = task_blocks_on_rt_mutex(lock, waiter, current,
+-						      detect_deadlock);
++						      detect_deadlock, flags);
+ 			/*
+ 			 * If we got woken up by the owner then start loop
+ 			 * all over without going into schedule to try
+@@ -672,14 +1108,15 @@
+ 				break;
+ 		}
+ 
+-		spin_unlock(&lock->wait_lock);
++		atomic_spin_unlock_irq(&lock->wait_lock);
+ 
+ 		debug_rt_mutex_print_deadlock(waiter);
+ 
+ 		if (waiter->task)
+ 			schedule_rt_mutex(lock);
+ 
+-		spin_lock(&lock->wait_lock);
++		atomic_spin_lock_irq(&lock->wait_lock);
++
+ 		set_current_state(state);
+ 	}
+ 
+@@ -694,20 +1131,29 @@
+ 		  struct hrtimer_sleeper *timeout,
+ 		  int detect_deadlock)
+ {
++	int ret = 0, saved_lock_depth = -1;
+ 	struct rt_mutex_waiter waiter;
+-	int ret = 0;
++	unsigned long flags;
+ 
+ 	debug_rt_mutex_init_waiter(&waiter);
+ 	waiter.task = NULL;
+ 
+-	spin_lock(&lock->wait_lock);
++	atomic_spin_lock_irqsave(&lock->wait_lock, flags);
++	init_lists(lock);
+ 
+ 	/* Try to acquire the lock again: */
+ 	if (try_to_take_rt_mutex(lock)) {
+-		spin_unlock(&lock->wait_lock);
++		atomic_spin_unlock_irqrestore(&lock->wait_lock, flags);
+ 		return 0;
+ 	}
+ 
++	/*
++	 * We drop the BKL here before we go into the wait loop to avoid a
++	 * possible deadlock in the scheduler.
++	 */
++	if (unlikely(current->lock_depth >= 0))
++		saved_lock_depth = rt_release_bkl(lock, flags);
++
+ 	set_current_state(state);
+ 
+ 	/* Setup the timer, when timeout != NULL */
+@@ -718,12 +1164,12 @@
+ 	}
+ 
+ 	ret = __rt_mutex_slowlock(lock, state, timeout, &waiter,
+-				  detect_deadlock);
++				  detect_deadlock, flags);
+ 
+ 	set_current_state(TASK_RUNNING);
+ 
+ 	if (unlikely(waiter.task))
+-		remove_waiter(lock, &waiter);
++		remove_waiter(lock, &waiter, flags);
+ 
+ 	/*
+ 	 * try_to_take_rt_mutex() sets the waiter bit
+@@ -731,7 +1177,7 @@
+ 	 */
+ 	fixup_rt_mutex_waiters(lock);
+ 
+-	spin_unlock(&lock->wait_lock);
++	atomic_spin_unlock_irqrestore(&lock->wait_lock, flags);
+ 
+ 	/* Remove pending timer: */
+ 	if (unlikely(timeout))
+@@ -745,6 +1191,10 @@
+ 	if (unlikely(ret))
+ 		rt_mutex_adjust_prio(current);
+ 
++	/* Must we reaquire the BKL? */
++	if (unlikely(saved_lock_depth >= 0))
++		rt_reacquire_bkl(saved_lock_depth);
++
+ 	debug_rt_mutex_free_waiter(&waiter);
+ 
+ 	return ret;
+@@ -756,12 +1206,15 @@
+ static inline int
+ rt_mutex_slowtrylock(struct rt_mutex *lock)
+ {
++	unsigned long flags;
+ 	int ret = 0;
+ 
+-	spin_lock(&lock->wait_lock);
++	atomic_spin_lock_irqsave(&lock->wait_lock, flags);
+ 
+ 	if (likely(rt_mutex_owner(lock) != current)) {
+ 
++		init_lists(lock);
++
+ 		ret = try_to_take_rt_mutex(lock);
+ 		/*
+ 		 * try_to_take_rt_mutex() sets the lock waiters
+@@ -770,7 +1223,7 @@
+ 		fixup_rt_mutex_waiters(lock);
+ 	}
+ 
+-	spin_unlock(&lock->wait_lock);
++	atomic_spin_unlock_irqrestore(&lock->wait_lock, flags);
+ 
+ 	return ret;
+ }
+@@ -781,7 +1234,9 @@
+ static void __sched
+ rt_mutex_slowunlock(struct rt_mutex *lock)
+ {
+-	spin_lock(&lock->wait_lock);
++	unsigned long flags;
++
++	atomic_spin_lock_irqsave(&lock->wait_lock, flags);
+ 
+ 	debug_rt_mutex_unlock(lock);
+ 
+@@ -789,13 +1244,13 @@
+ 
+ 	if (!rt_mutex_has_waiters(lock)) {
+ 		lock->owner = NULL;
+-		spin_unlock(&lock->wait_lock);
++		atomic_spin_unlock_irqrestore(&lock->wait_lock, flags);
+ 		return;
+ 	}
+ 
+-	wakeup_next_waiter(lock);
++	wakeup_next_waiter(lock, 0);
+ 
+-	spin_unlock(&lock->wait_lock);
++	atomic_spin_unlock_irqrestore(&lock->wait_lock, flags);
+ 
+ 	/* Undo pi boosting if necessary: */
+ 	rt_mutex_adjust_prio(current);
+@@ -857,6 +1312,27 @@
+ }
+ 
+ /**
++ * rt_mutex_lock_killable - lock a rt_mutex killable
++ *
++ * @lock: 		the rt_mutex to be locked
++ * @detect_deadlock:	deadlock detection on/off
++ *
++ * Returns:
++ *  0 		on success
++ * -EINTR 	when interrupted by a signal
++ * -EDEADLK	when the lock would deadlock (when deadlock detection is on)
++ */
++int __sched rt_mutex_lock_killable(struct rt_mutex *lock,
++				   int detect_deadlock)
++{
++	might_sleep();
++
++	return rt_mutex_fastlock(lock, TASK_KILLABLE,
++				 detect_deadlock, rt_mutex_slowlock);
++}
++EXPORT_SYMBOL_GPL(rt_mutex_lock_killable);
++
++/**
+  * rt_mutex_lock - lock a rt_mutex
+  *
+  * @lock: the rt_mutex to be locked
+@@ -970,8 +1446,8 @@
+ void __rt_mutex_init(struct rt_mutex *lock, const char *name)
+ {
+ 	lock->owner = NULL;
+-	spin_lock_init(&lock->wait_lock);
+-	plist_head_init(&lock->wait_list, &lock->wait_lock);
++	atomic_spin_lock_init(&lock->wait_lock);
++	plist_head_init_atomic(&lock->wait_list, &lock->wait_lock);
+ 
+ 	debug_rt_mutex_init(lock, name);
+ }
+@@ -1030,22 +1506,25 @@
+ 			      struct rt_mutex_waiter *waiter,
+ 			      struct task_struct *task, int detect_deadlock)
+ {
++	unsigned long flags;
+ 	int ret;
+ 
+-	spin_lock(&lock->wait_lock);
++	atomic_spin_lock_irqsave(&lock->wait_lock, flags);
+ 
+ 	mark_rt_mutex_waiters(lock);
+ 
+-	if (!rt_mutex_owner(lock) || try_to_steal_lock(lock, task)) {
++	if (!rt_mutex_owner(lock) ||
++	    try_to_steal_lock(lock, task, STEAL_NORMAL)) {
+ 		/* We got the lock for task. */
+ 		debug_rt_mutex_lock(lock);
+ 		rt_mutex_set_owner(lock, task, 0);
+-		spin_unlock(&lock->wait_lock);
++		atomic_spin_unlock(&lock->wait_lock);
+ 		rt_mutex_deadlock_account_lock(lock, task);
+ 		return 1;
+ 	}
+ 
+-	ret = task_blocks_on_rt_mutex(lock, waiter, task, detect_deadlock);
++	ret = task_blocks_on_rt_mutex(lock, waiter, task, detect_deadlock,
++				      flags);
+ 
+ 	if (ret && !waiter->task) {
+ 		/*
+@@ -1056,7 +1535,7 @@
+ 		 */
+ 		ret = 0;
+ 	}
+-	spin_unlock(&lock->wait_lock);
++	atomic_spin_unlock_irqrestore(&lock->wait_lock, flags);
+ 
+ 	debug_rt_mutex_print_deadlock(waiter);
+ 
+@@ -1104,19 +1583,20 @@
+ 			       struct rt_mutex_waiter *waiter,
+ 			       int detect_deadlock)
+ {
++	unsigned long flags;
+ 	int ret;
+ 
+-	spin_lock(&lock->wait_lock);
++	atomic_spin_lock_irqsave(&lock->wait_lock, flags);
+ 
+ 	set_current_state(TASK_INTERRUPTIBLE);
+ 
+ 	ret = __rt_mutex_slowlock(lock, TASK_INTERRUPTIBLE, to, waiter,
+-				  detect_deadlock);
++				  detect_deadlock, flags);
+ 
+ 	set_current_state(TASK_RUNNING);
+ 
+ 	if (unlikely(waiter->task))
+-		remove_waiter(lock, waiter);
++		remove_waiter(lock, waiter, flags);
+ 
+ 	/*
+ 	 * try_to_take_rt_mutex() sets the waiter bit unconditionally. We might
+@@ -1124,7 +1604,7 @@
+ 	 */
+ 	fixup_rt_mutex_waiters(lock);
+ 
+-	spin_unlock(&lock->wait_lock);
++	atomic_spin_unlock_irqrestore(&lock->wait_lock, flags);
+ 
+ 	/*
+ 	 * Readjust priority, when we did not get the lock. We might have been
+Index: linux-rt-2.6.31/kernel/rtmutex_common.h
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/rtmutex_common.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/rtmutex_common.h	2010-05-17 14:23:20.098387185 +0200
+@@ -129,6 +129,26 @@
+ 				      struct rt_mutex_waiter *waiter,
+ 				      int detect_deadlock);
+ 
++
++#define STEAL_LATERAL 1
++#define STEAL_NORMAL  0
++
++/*
++ * Note that RT tasks are excluded from lateral-steals to prevent the
++ * introduction of an unbounded latency
++ */
++static inline int lock_is_stealable(struct task_struct *task,
++				    struct task_struct *pendowner, int mode)
++{
++    if (mode == STEAL_NORMAL || rt_task(task)) {
++	    if (task->prio >= pendowner->prio)
++		    return 0;
++    } else if (task->prio > pendowner->prio)
++	    return 0;
++
++    return 1;
++}
++
+ #ifdef CONFIG_DEBUG_RT_MUTEXES
+ # include "rtmutex-debug.h"
+ #else
+Index: linux-rt-2.6.31/kernel/rwlock.c
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ linux-rt-2.6.31/kernel/rwlock.c	2010-05-17 14:23:20.098387185 +0200
+@@ -0,0 +1,226 @@
++/*
++ * Copyright (2004) Linus Torvalds
++ *
++ * Author: Zwane Mwaikambo <zwane@fsmlabs.com>
++ *
++ * Copyright (2004, 2005) Ingo Molnar
++ *
++ * This file contains the spinlock/rwlock implementations for the
++ * SMP and the DEBUG_SPINLOCK cases. (UP-nondebug inlines them)
++ *
++ * Note that some architectures have special knowledge about the
++ * stack frames of these functions in their profile_pc. If you
++ * change anything significant here that could change the stack
++ * frame contact the architecture maintainers.
++ */
++
++#ifndef CONFIG_PREEMPT_RT
++
++#include <linux/linkage.h>
++#include <linux/preempt.h>
++#include <linux/spinlock.h>
++#include <linux/interrupt.h>
++#include <linux/debug_locks.h>
++#include <linux/module.h>
++
++#include "lock-internals.h"
++
++int __lockfunc _read_trylock(rwlock_t *lock)
++{
++	preempt_disable();
++	if (_raw_read_trylock(lock)) {
++		rwlock_acquire_read(&lock->dep_map, 0, 1, _RET_IP_);
++		return 1;
++	}
++
++	preempt_enable();
++	return 0;
++}
++EXPORT_SYMBOL(_read_trylock);
++
++int __lockfunc _write_trylock(rwlock_t *lock)
++{
++	preempt_disable();
++	if (_raw_write_trylock(lock)) {
++		rwlock_acquire(&lock->dep_map, 0, 1, _RET_IP_);
++		return 1;
++	}
++
++	preempt_enable();
++	return 0;
++}
++EXPORT_SYMBOL(_write_trylock);
++
++/*
++ * If lockdep is enabled then we use the non-preemption spin-ops
++ * even on CONFIG_PREEMPT, because lockdep assumes that interrupts are
++ * not re-enabled during lock-acquire (which the preempt-spin-ops do):
++ */
++#if !defined(CONFIG_GENERIC_LOCKBREAK) || defined(CONFIG_DEBUG_LOCK_ALLOC)
++
++void __lockfunc _read_lock(rwlock_t *lock)
++{
++	preempt_disable();
++	rwlock_acquire_read(&lock->dep_map, 0, 0, _RET_IP_);
++	LOCK_CONTENDED(lock, _raw_read_trylock, _raw_read_lock);
++}
++EXPORT_SYMBOL(_read_lock);
++
++unsigned long __lockfunc _read_lock_irqsave(rwlock_t *lock)
++{
++	unsigned long flags;
++
++	local_irq_save(flags);
++	preempt_disable();
++	rwlock_acquire_read(&lock->dep_map, 0, 0, _RET_IP_);
++	LOCK_CONTENDED_FLAGS(lock, _raw_read_trylock, _raw_read_lock,
++			     _raw_read_lock_flags, &flags);
++	return flags;
++}
++EXPORT_SYMBOL(_read_lock_irqsave);
++
++void __lockfunc _read_lock_irq(rwlock_t *lock)
++{
++	local_irq_disable();
++	preempt_disable();
++	rwlock_acquire_read(&lock->dep_map, 0, 0, _RET_IP_);
++	LOCK_CONTENDED(lock, _raw_read_trylock, _raw_read_lock);
++}
++EXPORT_SYMBOL(_read_lock_irq);
++
++void __lockfunc _read_lock_bh(rwlock_t *lock)
++{
++	local_bh_disable();
++	preempt_disable();
++	rwlock_acquire_read(&lock->dep_map, 0, 0, _RET_IP_);
++	LOCK_CONTENDED(lock, _raw_read_trylock, _raw_read_lock);
++}
++EXPORT_SYMBOL(_read_lock_bh);
++
++unsigned long __lockfunc _write_lock_irqsave(rwlock_t *lock)
++{
++	unsigned long flags;
++
++	local_irq_save(flags);
++	preempt_disable();
++	rwlock_acquire(&lock->dep_map, 0, 0, _RET_IP_);
++	LOCK_CONTENDED_FLAGS(lock, _raw_write_trylock, _raw_write_lock,
++			     _raw_write_lock_flags, &flags);
++	return flags;
++}
++EXPORT_SYMBOL(_write_lock_irqsave);
++
++void __lockfunc _write_lock_irq(rwlock_t *lock)
++{
++	local_irq_disable();
++	preempt_disable();
++	rwlock_acquire(&lock->dep_map, 0, 0, _RET_IP_);
++	LOCK_CONTENDED(lock, _raw_write_trylock, _raw_write_lock);
++}
++EXPORT_SYMBOL(_write_lock_irq);
++
++void __lockfunc _write_lock_bh(rwlock_t *lock)
++{
++	local_bh_disable();
++	preempt_disable();
++	rwlock_acquire(&lock->dep_map, 0, 0, _RET_IP_);
++	LOCK_CONTENDED(lock, _raw_write_trylock, _raw_write_lock);
++}
++EXPORT_SYMBOL(_write_lock_bh);
++
++void __lockfunc _write_lock(rwlock_t *lock)
++{
++	preempt_disable();
++	rwlock_acquire(&lock->dep_map, 0, 0, _RET_IP_);
++	LOCK_CONTENDED(lock, _raw_write_trylock, _raw_write_lock);
++}
++
++EXPORT_SYMBOL(_write_lock);
++
++#else /* CONFIG_PREEMPT: */
++
++/*
++ * Build preemption-friendly versions of the following
++ * lock-spinning functions:
++ *
++ *         _[read|write]_lock()
++ *         _[read|write]_lock_irq()
++ *         _[read|write]_lock_irqsave()
++ *         _[read|write]_lock_bh()
++ */
++BUILD_LOCK_OPS(read, read, rwlock);
++BUILD_LOCK_OPS(write, write, rwlock);
++
++#endif /* CONFIG_PREEMPT */
++
++void __lockfunc _write_unlock(rwlock_t *lock)
++{
++	rwlock_release(&lock->dep_map, 1, _RET_IP_);
++	_raw_write_unlock(lock);
++	preempt_enable();
++}
++EXPORT_SYMBOL(_write_unlock);
++
++void __lockfunc _read_unlock(rwlock_t *lock)
++{
++	rwlock_release(&lock->dep_map, 1, _RET_IP_);
++	_raw_read_unlock(lock);
++	preempt_enable();
++}
++EXPORT_SYMBOL(_read_unlock);
++
++void __lockfunc _read_unlock_irqrestore(rwlock_t *lock, unsigned long flags)
++{
++	rwlock_release(&lock->dep_map, 1, _RET_IP_);
++	_raw_read_unlock(lock);
++	local_irq_restore(flags);
++	preempt_enable();
++}
++EXPORT_SYMBOL(_read_unlock_irqrestore);
++
++void __lockfunc _read_unlock_irq(rwlock_t *lock)
++{
++	rwlock_release(&lock->dep_map, 1, _RET_IP_);
++	_raw_read_unlock(lock);
++	local_irq_enable();
++	preempt_enable();
++}
++EXPORT_SYMBOL(_read_unlock_irq);
++
++void __lockfunc _read_unlock_bh(rwlock_t *lock)
++{
++	rwlock_release(&lock->dep_map, 1, _RET_IP_);
++	_raw_read_unlock(lock);
++	__preempt_enable_no_resched();
++	local_bh_enable_ip((unsigned long)__builtin_return_address(0));
++}
++EXPORT_SYMBOL(_read_unlock_bh);
++
++void __lockfunc _write_unlock_irqrestore(rwlock_t *lock, unsigned long flags)
++{
++	rwlock_release(&lock->dep_map, 1, _RET_IP_);
++	_raw_write_unlock(lock);
++	local_irq_restore(flags);
++	preempt_enable();
++}
++EXPORT_SYMBOL(_write_unlock_irqrestore);
++
++void __lockfunc _write_unlock_irq(rwlock_t *lock)
++{
++	rwlock_release(&lock->dep_map, 1, _RET_IP_);
++	_raw_write_unlock(lock);
++	local_irq_enable();
++	preempt_enable();
++}
++EXPORT_SYMBOL(_write_unlock_irq);
++
++void __lockfunc _write_unlock_bh(rwlock_t *lock)
++{
++	rwlock_release(&lock->dep_map, 1, _RET_IP_);
++	_raw_write_unlock(lock);
++	__preempt_enable_no_resched();
++	local_bh_enable_ip((unsigned long)__builtin_return_address(0));
++}
++EXPORT_SYMBOL(_write_unlock_bh);
++
++#endif
+Index: linux-rt-2.6.31/kernel/rwsem.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/rwsem.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/rwsem.c	2010-05-17 14:23:20.098387185 +0200
+@@ -16,20 +16,19 @@
+ /*
+  * lock for reading
+  */
+-void __sched down_read(struct rw_semaphore *sem)
++void __sched anon_down_read(struct rw_anon_semaphore *sem)
+ {
+ 	might_sleep();
+ 	rwsem_acquire_read(&sem->dep_map, 0, 0, _RET_IP_);
+ 
+ 	LOCK_CONTENDED(sem, __down_read_trylock, __down_read);
+ }
+-
+-EXPORT_SYMBOL(down_read);
++EXPORT_SYMBOL(anon_down_read);
+ 
+ /*
+  * trylock for reading -- returns 1 if successful, 0 if contention
+  */
+-int down_read_trylock(struct rw_semaphore *sem)
++int anon_down_read_trylock(struct rw_anon_semaphore *sem)
+ {
+ 	int ret = __down_read_trylock(sem);
+ 
+@@ -37,26 +36,24 @@
+ 		rwsem_acquire_read(&sem->dep_map, 0, 1, _RET_IP_);
+ 	return ret;
+ }
+-
+-EXPORT_SYMBOL(down_read_trylock);
++EXPORT_SYMBOL(anon_down_read_trylock);
+ 
+ /*
+  * lock for writing
+  */
+-void __sched down_write(struct rw_semaphore *sem)
++void __sched anon_down_write(struct rw_anon_semaphore *sem)
+ {
+ 	might_sleep();
+ 	rwsem_acquire(&sem->dep_map, 0, 0, _RET_IP_);
+ 
+ 	LOCK_CONTENDED(sem, __down_write_trylock, __down_write);
+ }
+-
+-EXPORT_SYMBOL(down_write);
++EXPORT_SYMBOL(anon_down_write);
+ 
+ /*
+  * trylock for writing -- returns 1 if successful, 0 if contention
+  */
+-int down_write_trylock(struct rw_semaphore *sem)
++int anon_down_write_trylock(struct rw_anon_semaphore *sem)
+ {
+ 	int ret = __down_write_trylock(sem);
+ 
+@@ -64,37 +61,34 @@
+ 		rwsem_acquire(&sem->dep_map, 0, 1, _RET_IP_);
+ 	return ret;
+ }
+-
+-EXPORT_SYMBOL(down_write_trylock);
++EXPORT_SYMBOL(anon_down_write_trylock);
+ 
+ /*
+  * release a read lock
+  */
+-void up_read(struct rw_semaphore *sem)
++void anon_up_read(struct rw_anon_semaphore *sem)
+ {
+ 	rwsem_release(&sem->dep_map, 1, _RET_IP_);
+ 
+ 	__up_read(sem);
+ }
+-
+-EXPORT_SYMBOL(up_read);
++EXPORT_SYMBOL(anon_up_read);
+ 
+ /*
+  * release a write lock
+  */
+-void up_write(struct rw_semaphore *sem)
++void anon_up_write(struct rw_anon_semaphore *sem)
+ {
+ 	rwsem_release(&sem->dep_map, 1, _RET_IP_);
+ 
+ 	__up_write(sem);
+ }
+-
+-EXPORT_SYMBOL(up_write);
++EXPORT_SYMBOL(anon_up_write);
+ 
+ /*
+  * downgrade write lock to read lock
+  */
+-void downgrade_write(struct rw_semaphore *sem)
++void anon_downgrade_write(struct rw_anon_semaphore *sem)
+ {
+ 	/*
+ 	 * lockdep: a downgraded write will live on as a write
+@@ -102,46 +96,41 @@
+ 	 */
+ 	__downgrade_write(sem);
+ }
+-
+-EXPORT_SYMBOL(downgrade_write);
++EXPORT_SYMBOL(anon_downgrade_write);
+ 
+ #ifdef CONFIG_DEBUG_LOCK_ALLOC
+ 
+-void down_read_nested(struct rw_semaphore *sem, int subclass)
++void anon_down_read_nested(struct rw_anon_semaphore *sem, int subclass)
+ {
+ 	might_sleep();
+ 	rwsem_acquire_read(&sem->dep_map, subclass, 0, _RET_IP_);
+ 
+ 	LOCK_CONTENDED(sem, __down_read_trylock, __down_read);
+ }
++EXPORT_SYMBOL(anon_down_read_nested);
+ 
+-EXPORT_SYMBOL(down_read_nested);
+-
+-void down_read_non_owner(struct rw_semaphore *sem)
++void anon_down_read_non_owner(struct rw_anon_semaphore *sem)
+ {
+ 	might_sleep();
+ 
+ 	__down_read(sem);
+ }
++EXPORT_SYMBOL(anon_down_read_non_owner);
+ 
+-EXPORT_SYMBOL(down_read_non_owner);
+-
+-void down_write_nested(struct rw_semaphore *sem, int subclass)
++void anon_down_write_nested(struct rw_anon_semaphore *sem, int subclass)
+ {
+ 	might_sleep();
+ 	rwsem_acquire(&sem->dep_map, subclass, 0, _RET_IP_);
+ 
+ 	LOCK_CONTENDED(sem, __down_write_trylock, __down_write);
+ }
++EXPORT_SYMBOL(anon_down_write_nested);
+ 
+-EXPORT_SYMBOL(down_write_nested);
+-
+-void up_read_non_owner(struct rw_semaphore *sem)
++void anon_up_read_non_owner(struct rw_anon_semaphore *sem)
+ {
+ 	__up_read(sem);
+ }
+-
+-EXPORT_SYMBOL(up_read_non_owner);
++EXPORT_SYMBOL(anon_up_read_non_owner);
+ 
+ #endif
+ 
+Index: linux-rt-2.6.31/kernel/sched.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/sched.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/kernel/sched.c	2010-05-17 14:23:20.098387185 +0200
+@@ -4,6 +4,7 @@
+  *  Kernel scheduler and related syscalls
+  *
+  *  Copyright (C) 1991-2002  Linus Torvalds
++ *  Copyright (C) 2004 Red Hat, Inc., Ingo Molnar <mingo@redhat.com>
+  *
+  *  1996-12-23  Modified by Dave Grothe to fix bugs in semaphores and
+  *		make semaphores SMP safe
+@@ -16,6 +17,7 @@
+  *		by Davide Libenzi, preemptible kernel bits by Robert Love.
+  *  2003-09-03	Interactivity tuning by Con Kolivas.
+  *  2004-04-02	Scheduler domains code by Nick Piggin
++ *  2004-10-13  Real-Time Preemption support by Ingo Molnar
+  *  2007-04-15  Work begun on replacing all interactivity tuning with a
+  *              fair scheduling design by Con Kolivas.
+  *  2007-05-05  Load balancing (smp-nice) and other improvements
+@@ -61,6 +63,7 @@
+ #include <linux/sysctl.h>
+ #include <linux/syscalls.h>
+ #include <linux/times.h>
++#include <linux/kallsyms.h>
+ #include <linux/tsacct_kern.h>
+ #include <linux/kprobes.h>
+ #include <linux/delayacct.h>
+@@ -107,6 +110,20 @@
+ #define NICE_0_LOAD		SCHED_LOAD_SCALE
+ #define NICE_0_SHIFT		SCHED_LOAD_SHIFT
+ 
++#if (BITS_PER_LONG < 64)
++#define JIFFIES_TO_NS64(TIME) \
++	((unsigned long long)(TIME) * ((unsigned long) (1000000000 / HZ)))
++
++#define NS64_TO_JIFFIES(TIME) \
++	((((unsigned long long)((TIME)) >> BITS_PER_LONG) * \
++	(1 + NS_TO_JIFFIES(~0UL))) + NS_TO_JIFFIES((unsigned long)(TIME)))
++#else /* BITS_PER_LONG < 64 */
++
++#define NS64_TO_JIFFIES(TIME) NS_TO_JIFFIES(TIME)
++#define JIFFIES_TO_NS64(TIME) JIFFIES_TO_NS(TIME)
++
++#endif /* BITS_PER_LONG < 64 */
++
+ /*
+  * These are the 'tuning knobs' of the scheduler:
+  *
+@@ -120,28 +137,32 @@
+  */
+ #define RUNTIME_INF	((u64)~0ULL)
+ 
+-#ifdef CONFIG_SMP
+-
+ static void double_rq_lock(struct rq *rq1, struct rq *rq2);
+ 
++#define TASK_PREEMPTS_CURR(p, rq) \
++	((p)->prio < (rq)->curr->prio)
++
+ /*
+- * Divide a load by a sched group cpu_power : (load / sg->__cpu_power)
+- * Since cpu_power is a 'constant', we can use a reciprocal divide.
++ * Tweaks for current
+  */
+-static inline u32 sg_div_cpu_power(const struct sched_group *sg, u32 load)
+-{
+-	return reciprocal_divide(load, sg->reciprocal_cpu_power);
+-}
++
++#ifdef CURRENT_PTR
++struct task_struct * const ___current = &init_task;
++struct task_struct ** const current_ptr = (struct task_struct ** const)&___current;
++struct thread_info * const current_ti = &init_thread_union.thread_info;
++struct thread_info ** const current_ti_ptr = (struct thread_info ** const)&current_ti;
++
++EXPORT_SYMBOL(___current);
++EXPORT_SYMBOL(current_ti);
+ 
+ /*
+- * Each time a sched group cpu_power is changed,
+- * we must compute its reciprocal value
++ * The scheduler itself doesnt want 'current' to be cached
++ * during context-switches:
+  */
+-static inline void sg_inc_cpu_power(struct sched_group *sg, u32 val)
+-{
+-	sg->__cpu_power += val;
+-	sg->reciprocal_cpu_power = reciprocal_value(sg->__cpu_power);
+-}
++# undef current
++# define current __current()
++# undef current_thread_info
++# define current_thread_info() __current_thread_info()
+ #endif
+ 
+ static inline int rt_policy(int policy)
+@@ -166,7 +187,7 @@
+ 
+ struct rt_bandwidth {
+ 	/* nests inside the rq lock: */
+-	spinlock_t		rt_runtime_lock;
++	atomic_spinlock_t	rt_runtime_lock;
+ 	ktime_t			rt_period;
+ 	u64			rt_runtime;
+ 	struct hrtimer		rt_period_timer;
+@@ -203,10 +224,11 @@
+ 	rt_b->rt_period = ns_to_ktime(period);
+ 	rt_b->rt_runtime = runtime;
+ 
+-	spin_lock_init(&rt_b->rt_runtime_lock);
++	atomic_spin_lock_init(&rt_b->rt_runtime_lock);
+ 
+ 	hrtimer_init(&rt_b->rt_period_timer,
+ 			CLOCK_MONOTONIC, HRTIMER_MODE_REL);
++	rt_b->rt_period_timer.irqsafe = 1;
+ 	rt_b->rt_period_timer.function = sched_rt_period_timer;
+ }
+ 
+@@ -225,7 +247,7 @@
+ 	if (hrtimer_active(&rt_b->rt_period_timer))
+ 		return;
+ 
+-	spin_lock(&rt_b->rt_runtime_lock);
++	atomic_spin_lock(&rt_b->rt_runtime_lock);
+ 	for (;;) {
+ 		unsigned long delta;
+ 		ktime_t soft, hard;
+@@ -242,7 +264,7 @@
+ 		__hrtimer_start_range_ns(&rt_b->rt_period_timer, soft, delta,
+ 				HRTIMER_MODE_ABS_PINNED, 0);
+ 	}
+-	spin_unlock(&rt_b->rt_runtime_lock);
++	atomic_spin_unlock(&rt_b->rt_runtime_lock);
+ }
+ 
+ #ifdef CONFIG_RT_GROUP_SCHED
+@@ -497,11 +519,12 @@
+ 	int overloaded;
+ 	struct plist_head pushable_tasks;
+ #endif
++	unsigned long rt_nr_uninterruptible;
+ 	int rt_throttled;
+ 	u64 rt_time;
+ 	u64 rt_runtime;
+ 	/* Nests inside the rq lock: */
+-	spinlock_t rt_runtime_lock;
++	atomic_spinlock_t rt_runtime_lock;
+ 
+ #ifdef CONFIG_RT_GROUP_SCHED
+ 	unsigned long rt_nr_boosted;
+@@ -564,7 +587,7 @@
+  */
+ struct rq {
+ 	/* runqueue lock: */
+-	spinlock_t lock;
++	atomic_spinlock_t lock;
+ 
+ 	/*
+ 	 * nr_running and cpu_load should be in the same cacheline because
+@@ -602,6 +625,8 @@
+ 	 */
+ 	unsigned long nr_uninterruptible;
+ 
++	unsigned long switch_timestamp;
++	unsigned long slice_avg;
+ 	struct task_struct *curr, *idle;
+ 	unsigned long next_balance;
+ 	struct mm_struct *prev_mm;
+@@ -626,6 +651,9 @@
+ 
+ 	struct task_struct *migration_thread;
+ 	struct list_head migration_queue;
++
++	u64 rt_avg;
++	u64 age_stamp;
+ #endif
+ 
+ 	/* calc_load related fields */
+@@ -660,9 +688,21 @@
+ 
+ 	/* BKL stats */
+ 	unsigned int bkl_count;
++
++	/* RT-overload stats: */
++	unsigned long rto_schedule;
++	unsigned long rto_schedule_tail;
++	unsigned long rto_wakeup;
++	unsigned long rto_pulled;
++	unsigned long rto_pushed;
+ #endif
+ };
+ 
++struct task_struct *rq_curr(struct rq *rq)
++{
++	return rq->curr;
++}
++
+ static DEFINE_PER_CPU_SHARED_ALIGNED(struct rq, runqueues);
+ 
+ static inline void check_preempt_curr(struct rq *rq, struct task_struct *p, int sync)
+@@ -699,6 +739,13 @@
+ 	rq->clock = sched_clock_cpu(cpu_of(rq));
+ }
+ 
++#ifndef CONFIG_SMP
++int task_is_current(struct task_struct *task)
++{
++	return task_rq(task)->curr == task;
++}
++#endif
++
+ /*
+  * Tunables that become constants when CONFIG_SCHED_DEBUG is off:
+  */
+@@ -721,7 +768,7 @@
+ 	struct rq *rq = cpu_rq(cpu);
+ 	int ret;
+ 
+-	ret = spin_is_locked(&rq->lock);
++	ret = atomic_spin_is_locked(&rq->lock);
+ 	put_cpu();
+ 	return ret;
+ }
+@@ -861,6 +908,14 @@
+ unsigned int sysctl_sched_shares_thresh = 4;
+ 
+ /*
++ * period over which we average the RT time consumption, measured
++ * in ms.
++ *
++ * default: 1s
++ */
++const_debug unsigned int sysctl_sched_time_avg = MSEC_PER_SEC;
++
++/*
+  * period over which we measure -rt task cpu usage in us.
+  * default: 1s
+  */
+@@ -887,11 +942,23 @@
+ 	return (u64)sysctl_sched_rt_runtime * NSEC_PER_USEC;
+ }
+ 
++/*
++ * We really dont want to do anything complex within switch_to()
++ * on PREEMPT_RT - this check enforces this.
++ */
++#ifdef prepare_arch_switch
++# ifdef CONFIG_PREEMPT_RT
++#   error FIXME
++# else
++#  define _finish_arch_switch finish_arch_switch
++# endif
++#endif
++
+ #ifndef prepare_arch_switch
+ # define prepare_arch_switch(next)	do { } while (0)
+ #endif
+ #ifndef finish_arch_switch
+-# define finish_arch_switch(prev)	do { } while (0)
++# define _finish_arch_switch(prev)	do { } while (0)
+ #endif
+ 
+ static inline int task_current(struct rq *rq, struct task_struct *p)
+@@ -899,18 +966,39 @@
+ 	return rq->curr == p;
+ }
+ 
+-#ifndef __ARCH_WANT_UNLOCKED_CTXSW
+ static inline int task_running(struct rq *rq, struct task_struct *p)
+ {
++#ifdef CONFIG_SMP
++	return p->oncpu;
++#else
+ 	return task_current(rq, p);
++#endif
+ }
+ 
++#ifndef __ARCH_WANT_UNLOCKED_CTXSW
+ static inline void prepare_lock_switch(struct rq *rq, struct task_struct *next)
+ {
++#ifdef CONFIG_SMP
++	/*
++	 * We can optimise this out completely for !SMP, because the
++	 * SMP rebalancing from interrupt is the only thing that cares
++	 * here.
++	 */
++	next->oncpu = 1;
++#endif
+ }
+ 
+ static inline void finish_lock_switch(struct rq *rq, struct task_struct *prev)
+ {
++#ifdef CONFIG_SMP
++	/*
++	 * After ->oncpu is cleared, the task can be moved to a different CPU.
++	 * We must ensure this doesn't happen until the switch is completely
++	 * finished.
++	 */
++	smp_wmb();
++	prev->oncpu = 0;
++#endif
+ #ifdef CONFIG_DEBUG_SPINLOCK
+ 	/* this is a valid case when another task releases the spinlock */
+ 	rq->lock.owner = current;
+@@ -922,18 +1010,10 @@
+ 	 */
+ 	spin_acquire(&rq->lock.dep_map, 0, 0, _THIS_IP_);
+ 
+-	spin_unlock_irq(&rq->lock);
++	atomic_spin_unlock(&rq->lock);
+ }
+ 
+ #else /* __ARCH_WANT_UNLOCKED_CTXSW */
+-static inline int task_running(struct rq *rq, struct task_struct *p)
+-{
+-#ifdef CONFIG_SMP
+-	return p->oncpu;
+-#else
+-	return task_current(rq, p);
+-#endif
+-}
+ 
+ static inline void prepare_lock_switch(struct rq *rq, struct task_struct *next)
+ {
+@@ -946,9 +1026,9 @@
+ 	next->oncpu = 1;
+ #endif
+ #ifdef __ARCH_WANT_INTERRUPTS_ON_CTXSW
+-	spin_unlock_irq(&rq->lock);
++	atomic_spin_unlock_irq(&rq->lock);
+ #else
+-	spin_unlock(&rq->lock);
++	atomic_spin_unlock(&rq->lock);
+ #endif
+ }
+ 
+@@ -963,8 +1043,8 @@
+ 	smp_wmb();
+ 	prev->oncpu = 0;
+ #endif
+-#ifndef __ARCH_WANT_INTERRUPTS_ON_CTXSW
+-	local_irq_enable();
++#ifdef __ARCH_WANT_INTERRUPTS_ON_CTXSW
++	local_irq_disable();
+ #endif
+ }
+ #endif /* __ARCH_WANT_UNLOCKED_CTXSW */
+@@ -978,10 +1058,10 @@
+ {
+ 	for (;;) {
+ 		struct rq *rq = task_rq(p);
+-		spin_lock(&rq->lock);
++		atomic_spin_lock(&rq->lock);
+ 		if (likely(rq == task_rq(p)))
+ 			return rq;
+-		spin_unlock(&rq->lock);
++		atomic_spin_unlock(&rq->lock);
+ 	}
+ }
+ 
+@@ -998,10 +1078,10 @@
+ 	for (;;) {
+ 		local_irq_save(*flags);
+ 		rq = task_rq(p);
+-		spin_lock(&rq->lock);
++		atomic_spin_lock(&rq->lock);
+ 		if (likely(rq == task_rq(p)))
+ 			return rq;
+-		spin_unlock_irqrestore(&rq->lock, *flags);
++		atomic_spin_unlock_irqrestore(&rq->lock, *flags);
+ 	}
+ }
+ 
+@@ -1010,19 +1090,19 @@
+ 	struct rq *rq = task_rq(p);
+ 
+ 	smp_mb(); /* spin-unlock-wait is not a full memory barrier */
+-	spin_unlock_wait(&rq->lock);
++	atomic_spin_unlock_wait(&rq->lock);
+ }
+ 
+ static void __task_rq_unlock(struct rq *rq)
+ 	__releases(rq->lock)
+ {
+-	spin_unlock(&rq->lock);
++	atomic_spin_unlock(&rq->lock);
+ }
+ 
+ static inline void task_rq_unlock(struct rq *rq, unsigned long *flags)
+ 	__releases(rq->lock)
+ {
+-	spin_unlock_irqrestore(&rq->lock, *flags);
++	atomic_spin_unlock_irqrestore(&rq->lock, *flags);
+ }
+ 
+ /*
+@@ -1035,7 +1115,7 @@
+ 
+ 	local_irq_disable();
+ 	rq = this_rq();
+-	spin_lock(&rq->lock);
++	atomic_spin_lock(&rq->lock);
+ 
+ 	return rq;
+ }
+@@ -1082,10 +1162,10 @@
+ 
+ 	WARN_ON_ONCE(cpu_of(rq) != smp_processor_id());
+ 
+-	spin_lock(&rq->lock);
++	atomic_spin_lock(&rq->lock);
+ 	update_rq_clock(rq);
+ 	rq->curr->sched_class->task_tick(rq, rq->curr, 1);
+-	spin_unlock(&rq->lock);
++	atomic_spin_unlock(&rq->lock);
+ 
+ 	return HRTIMER_NORESTART;
+ }
+@@ -1098,10 +1178,10 @@
+ {
+ 	struct rq *rq = arg;
+ 
+-	spin_lock(&rq->lock);
++	atomic_spin_lock(&rq->lock);
+ 	hrtimer_restart(&rq->hrtick_timer);
+ 	rq->hrtick_csd_pending = 0;
+-	spin_unlock(&rq->lock);
++	atomic_spin_unlock(&rq->lock);
+ }
+ 
+ /*
+@@ -1176,6 +1256,7 @@
+ 
+ 	hrtimer_init(&rq->hrtick_timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+ 	rq->hrtick_timer.function = hrtick;
++	rq->hrtick_timer.irqsafe = 1;
+ }
+ #else	/* CONFIG_SCHED_HRTICK */
+ static inline void hrtick_clear(struct rq *rq)
+@@ -1208,7 +1289,7 @@
+ {
+ 	int cpu;
+ 
+-	assert_spin_locked(&task_rq(p)->lock);
++	assert_atomic_spin_locked(&task_rq(p)->lock);
+ 
+ 	if (test_tsk_need_resched(p))
+ 		return;
+@@ -1230,10 +1311,10 @@
+ 	struct rq *rq = cpu_rq(cpu);
+ 	unsigned long flags;
+ 
+-	if (!spin_trylock_irqsave(&rq->lock, flags))
++	if (!atomic_spin_trylock_irqsave(&rq->lock, flags))
+ 		return;
+ 	resched_task(cpu_curr(cpu));
+-	spin_unlock_irqrestore(&rq->lock, flags);
++	atomic_spin_unlock_irqrestore(&rq->lock, flags);
+ }
+ 
+ #ifdef CONFIG_NO_HZ
+@@ -1251,7 +1332,7 @@
+ {
+ 	struct rq *rq = cpu_rq(cpu);
+ 
+-	if (cpu == smp_processor_id())
++	if (cpu == raw_smp_processor_id())
+ 		return;
+ 
+ 	/*
+@@ -1278,12 +1359,37 @@
+ }
+ #endif /* CONFIG_NO_HZ */
+ 
++static u64 sched_avg_period(void)
++{
++	return (u64)sysctl_sched_time_avg * NSEC_PER_MSEC / 2;
++}
++
++static void sched_avg_update(struct rq *rq)
++{
++	s64 period = sched_avg_period();
++
++	while ((s64)(rq->clock - rq->age_stamp) > period) {
++		rq->age_stamp += period;
++		rq->rt_avg /= 2;
++	}
++}
++
++static void sched_rt_avg_update(struct rq *rq, u64 rt_delta)
++{
++	rq->rt_avg += rt_delta;
++	sched_avg_update(rq);
++}
++
+ #else /* !CONFIG_SMP */
+ static void resched_task(struct task_struct *p)
+ {
+-	assert_spin_locked(&task_rq(p)->lock);
++	assert_atomic_spin_locked(&task_rq(p)->lock);
+ 	set_tsk_need_resched(p);
+ }
++
++static void sched_rt_avg_update(struct rq *rq, u64 rt_delta)
++{
++}
+ #endif /* CONFIG_SMP */
+ 
+ #if BITS_PER_LONG == 32
+@@ -1394,7 +1500,8 @@
+  /*  15 */ 119304647, 148102320, 186737708, 238609294, 286331153,
+ };
+ 
+-static void activate_task(struct rq *rq, struct task_struct *p, int wakeup);
++static void activate_task(struct rq *rq, struct task_struct *p, int wakeup,
++			  bool head);
+ 
+ /*
+  * runqueue iterator, to support SMP load-balancing between different
+@@ -1544,11 +1651,11 @@
+ 		struct rq *rq = cpu_rq(cpu);
+ 		unsigned long flags;
+ 
+-		spin_lock_irqsave(&rq->lock, flags);
++		atomic_spin_lock_irqsave(&rq->lock, flags);
+ 		tg->cfs_rq[cpu]->shares = shares;
+ 
+ 		__set_se_shares(tg->se[cpu], shares);
+-		spin_unlock_irqrestore(&rq->lock, flags);
++		atomic_spin_unlock_irqrestore(&rq->lock, flags);
+ 	}
+ }
+ 
+@@ -1627,9 +1734,9 @@
+ 
+ static void update_shares_locked(struct rq *rq, struct sched_domain *sd)
+ {
+-	spin_unlock(&rq->lock);
++	atomic_spin_unlock(&rq->lock);
+ 	update_shares(sd);
+-	spin_lock(&rq->lock);
++	atomic_spin_lock(&rq->lock);
+ }
+ 
+ static void update_h_load(long cpu)
+@@ -1664,7 +1771,7 @@
+ 	__acquires(busiest->lock)
+ 	__acquires(this_rq->lock)
+ {
+-	spin_unlock(&this_rq->lock);
++	atomic_spin_unlock(&this_rq->lock);
+ 	double_rq_lock(this_rq, busiest);
+ 
+ 	return 1;
+@@ -1685,14 +1792,14 @@
+ {
+ 	int ret = 0;
+ 
+-	if (unlikely(!spin_trylock(&busiest->lock))) {
++	if (unlikely(!atomic_spin_trylock(&busiest->lock))) {
+ 		if (busiest < this_rq) {
+-			spin_unlock(&this_rq->lock);
+-			spin_lock(&busiest->lock);
+-			spin_lock_nested(&this_rq->lock, SINGLE_DEPTH_NESTING);
++			atomic_spin_unlock(&this_rq->lock);
++			atomic_spin_lock(&busiest->lock);
++			atomic_spin_lock_nested(&this_rq->lock, SINGLE_DEPTH_NESTING);
+ 			ret = 1;
+ 		} else
+-			spin_lock_nested(&busiest->lock, SINGLE_DEPTH_NESTING);
++			atomic_spin_lock_nested(&busiest->lock, SINGLE_DEPTH_NESTING);
+ 	}
+ 	return ret;
+ }
+@@ -1706,7 +1813,7 @@
+ {
+ 	if (unlikely(!irqs_disabled())) {
+ 		/* printk() doesn't work good under rq->lock */
+-		spin_unlock(&this_rq->lock);
++		atomic_spin_unlock(&this_rq->lock);
+ 		BUG_ON(1);
+ 	}
+ 
+@@ -1716,7 +1823,7 @@
+ static inline void double_unlock_balance(struct rq *this_rq, struct rq *busiest)
+ 	__releases(busiest->lock)
+ {
+-	spin_unlock(&busiest->lock);
++	atomic_spin_unlock(&busiest->lock);
+ 	lock_set_subclass(&this_rq->lock.dep_map, 0, _RET_IP_);
+ }
+ #endif
+@@ -1781,13 +1888,14 @@
+ 	*avg += diff >> 3;
+ }
+ 
+-static void enqueue_task(struct rq *rq, struct task_struct *p, int wakeup)
++static void
++enqueue_task(struct rq *rq, struct task_struct *p, int wakeup, bool head)
+ {
+ 	if (wakeup)
+ 		p->se.start_runtime = p->se.sum_exec_runtime;
+ 
+ 	sched_info_queued(p);
+-	p->sched_class->enqueue_task(rq, p, wakeup);
++	p->sched_class->enqueue_task(rq, p, wakeup, head);
+ 	p->se.on_rq = 1;
+ }
+ 
+@@ -1832,6 +1940,8 @@
+ 		prio = MAX_RT_PRIO-1 - p->rt_priority;
+ 	else
+ 		prio = __normal_prio(p);
++
++//	trace_special_pid(p->pid, PRIO(p), __PRIO(prio));
+ 	return prio;
+ }
+ 
+@@ -1858,12 +1968,13 @@
+ /*
+  * activate_task - move a task to the runqueue.
+  */
+-static void activate_task(struct rq *rq, struct task_struct *p, int wakeup)
++static void
++activate_task(struct rq *rq, struct task_struct *p, int wakeup, bool head)
+ {
+ 	if (task_contributes_to_load(p))
+ 		rq->nr_uninterruptible--;
+ 
+-	enqueue_task(rq, p, wakeup);
++	enqueue_task(rq, p, wakeup, head);
+ 	inc_nr_running(rq);
+ }
+ 
+@@ -2156,7 +2267,10 @@
+ 		 * yield - it could be a while.
+ 		 */
+ 		if (unlikely(on_rq)) {
+-			schedule_timeout_uninterruptible(1);
++			ktime_t to = ktime_set(0, NSEC_PER_SEC/HZ);
++
++			set_current_state(TASK_UNINTERRUPTIBLE);
++			schedule_hrtimeout(&to, HRTIMER_MODE_REL);
+ 			continue;
+ 		}
+ 
+@@ -2268,8 +2382,7 @@
+ 		}
+ 
+ 		/* Adjust by relative CPU power of the group */
+-		avg_load = sg_div_cpu_power(group,
+-				avg_load * SCHED_LOAD_SCALE);
++		avg_load = (avg_load * SCHED_LOAD_SCALE) / group->cpu_power;
+ 
+ 		if (local_group) {
+ 			this_load = avg_load;
+@@ -2412,7 +2525,8 @@
+  *
+  * returns failure only if the task is already active.
+  */
+-static int try_to_wake_up(struct task_struct *p, unsigned int state, int sync)
++static int
++try_to_wake_up(struct task_struct *p, unsigned int state, int sync, int mutex)
+ {
+ 	int cpu, orig_cpu, this_cpu, success = 0;
+ 	unsigned long flags;
+@@ -2438,6 +2552,13 @@
+ 	}
+ #endif
+ 
++#ifdef CONFIG_PREEMPT_RT
++	/*
++	 * sync wakeups can increase wakeup latencies:
++	 */
++	if (rt_task(p))
++		sync = 0;
++#endif
+ 	smp_wmb();
+ 	rq = task_rq_lock(p, &flags);
+ 	update_rq_clock(rq);
+@@ -2498,7 +2619,7 @@
+ 		schedstat_inc(p, se.nr_wakeups_local);
+ 	else
+ 		schedstat_inc(p, se.nr_wakeups_remote);
+-	activate_task(rq, p, 1);
++	activate_task(rq, p, 1, false);
+ 	success = 1;
+ 
+ 	/*
+@@ -2521,7 +2642,18 @@
+ 	trace_sched_wakeup(rq, p, success);
+ 	check_preempt_curr(rq, p, sync);
+ 
+-	p->state = TASK_RUNNING;
++	/*
++	 * For a mutex wakeup we or TASK_RUNNING_MUTEX to the task
++	 * state to preserve the original state, so a real wakeup
++	 * still can see the (UN)INTERRUPTIBLE bits in the state check
++	 * above. We dont have to worry about the | TASK_RUNNING_MUTEX
++	 * here. The waiter is serialized by the mutex lock and nobody
++	 * else can fiddle with p->state as we hold rq lock.
++	 */
++	if (mutex)
++		p->state |= TASK_RUNNING_MUTEX;
++	else
++		p->state = TASK_RUNNING;
+ #ifdef CONFIG_SMP
+ 	if (p->sched_class->task_wake_up)
+ 		p->sched_class->task_wake_up(rq, p);
+@@ -2545,13 +2677,31 @@
+  */
+ int wake_up_process(struct task_struct *p)
+ {
+-	return try_to_wake_up(p, TASK_ALL, 0);
++	return try_to_wake_up(p, TASK_ALL, 0, 0);
+ }
+ EXPORT_SYMBOL(wake_up_process);
+ 
++int  wake_up_process_sync(struct task_struct * p)
++{
++	return try_to_wake_up(p, TASK_ALL, 1, 0);
++}
++EXPORT_SYMBOL(wake_up_process_sync);
++
++int  wake_up_process_mutex(struct task_struct * p)
++{
++	return try_to_wake_up(p, TASK_ALL, 0, 1);
++}
++EXPORT_SYMBOL(wake_up_process_mutex);
++
++int  wake_up_process_mutex_sync(struct task_struct * p)
++{
++	return try_to_wake_up(p, TASK_ALL, 1, 1);
++}
++EXPORT_SYMBOL(wake_up_process_mutex_sync);
++
+ int wake_up_state(struct task_struct *p, unsigned int state)
+ {
+-	return try_to_wake_up(p, state, 0);
++	return try_to_wake_up(p, state, 0, 0);
+ }
+ 
+ /*
+@@ -2647,7 +2797,7 @@
+ 	if (likely(sched_info_on()))
+ 		memset(&p->sched_info, 0, sizeof(p->sched_info));
+ #endif
+-#if defined(CONFIG_SMP) && defined(__ARCH_WANT_UNLOCKED_CTXSW)
++#if defined(CONFIG_SMP)
+ 	p->oncpu = 0;
+ #endif
+ #ifdef CONFIG_PREEMPT
+@@ -2678,7 +2828,7 @@
+ 	p->prio = effective_prio(p);
+ 
+ 	if (!p->sched_class->task_new || !current->se.on_rq) {
+-		activate_task(rq, p, 0);
++		activate_task(rq, p, 0, false);
+ 	} else {
+ 		/*
+ 		 * Let the scheduling class do new task startup
+@@ -2725,8 +2875,17 @@
+ 	struct preempt_notifier *notifier;
+ 	struct hlist_node *node;
+ 
++	if (hlist_empty(&curr->preempt_notifiers))
++		return;
++
++	/*
++	 * The KVM sched in notifier expects to be called with
++	 * interrupts enabled.
++	 */
++	local_irq_enable();
+ 	hlist_for_each_entry(notifier, node, &curr->preempt_notifiers, link)
+ 		notifier->ops->sched_in(notifier, raw_smp_processor_id());
++	local_irq_disable();
+ }
+ 
+ static void
+@@ -2817,7 +2976,7 @@
+ 	 *		Manfred Spraul <manfred@colorfullife.com>
+ 	 */
+ 	prev_state = prev->state;
+-	finish_arch_switch(prev);
++	_finish_arch_switch(prev);
+ 	perf_counter_task_sched_in(current, cpu_of(rq));
+ 	finish_lock_switch(rq, prev);
+ #ifdef CONFIG_SMP
+@@ -2826,8 +2985,12 @@
+ #endif
+ 
+ 	fire_sched_in_preempt_notifiers(current);
++	/*
++	 * Delay the final freeing of the mm or task, so that we dont have
++	 * to do complex work from within the scheduler:
++	 */
+ 	if (mm)
+-		mmdrop(mm);
++ 		mmdrop_delayed(mm);
+ 	if (unlikely(prev_state == TASK_DEAD)) {
+ 		/*
+ 		 * Remove function-return probe instances associated with this
+@@ -2845,12 +3008,15 @@
+ asmlinkage void schedule_tail(struct task_struct *prev)
+ 	__releases(rq->lock)
+ {
+-	struct rq *rq = this_rq();
+-
+-	finish_task_switch(rq, prev);
++	preempt_disable();
++	finish_task_switch(this_rq(), prev);
++	__preempt_enable_no_resched();
++	local_irq_enable();
+ #ifdef __ARCH_WANT_UNLOCKED_CTXSW
+ 	/* In this case, finish_task_switch does not reenable preemption */
+ 	preempt_enable();
++#else
++	preempt_check_resched();
+ #endif
+ 	if (current->set_child_tid)
+ 		put_user(task_pid_vnr(current), current->set_child_tid);
+@@ -2898,6 +3064,11 @@
+ 	spin_release(&rq->lock.dep_map, 1, _THIS_IP_);
+ #endif
+ 
++#ifdef CURRENT_PTR
++	barrier();
++	*current_ptr = next;
++	*current_ti_ptr = next->thread_info;
++#endif
+ 	/* Here we just switch the register state and the stack. */
+ 	switch_to(prev, next, prev);
+ 
+@@ -2944,6 +3115,11 @@
+ 	return sum;
+ }
+ 
++unsigned long nr_uninterruptible_cpu(int cpu)
++{
++	return cpu_rq(cpu)->nr_uninterruptible;
++}
++
+ unsigned long long nr_context_switches(void)
+ {
+ 	int i;
+@@ -2962,6 +3138,13 @@
+ 	for_each_possible_cpu(i)
+ 		sum += atomic_read(&cpu_rq(i)->nr_iowait);
+ 
++	/*
++	 * Since we read the counters lockless, it might be slightly
++	 * inaccurate. Do not allow it to go below zero though:
++	 */
++	if (unlikely((long)sum < 0))
++		sum = 0;
++
+ 	return sum;
+ }
+ 
+@@ -3091,15 +3274,17 @@
+ {
+ 	BUG_ON(!irqs_disabled());
+ 	if (rq1 == rq2) {
+-		spin_lock(&rq1->lock);
++		atomic_spin_lock(&rq1->lock);
+ 		__acquire(rq2->lock);	/* Fake it out ;) */
+ 	} else {
+ 		if (rq1 < rq2) {
+-			spin_lock(&rq1->lock);
+-			spin_lock_nested(&rq2->lock, SINGLE_DEPTH_NESTING);
++			atomic_spin_lock(&rq1->lock);
++			atomic_spin_lock_nested(&rq2->lock,
++						SINGLE_DEPTH_NESTING);
+ 		} else {
+-			spin_lock(&rq2->lock);
+-			spin_lock_nested(&rq1->lock, SINGLE_DEPTH_NESTING);
++			atomic_spin_lock(&rq2->lock);
++			atomic_spin_lock_nested(&rq1->lock,
++						SINGLE_DEPTH_NESTING);
+ 		}
+ 	}
+ 	update_rq_clock(rq1);
+@@ -3116,9 +3301,9 @@
+ 	__releases(rq1->lock)
+ 	__releases(rq2->lock)
+ {
+-	spin_unlock(&rq1->lock);
++	atomic_spin_unlock(&rq1->lock);
+ 	if (rq1 != rq2)
+-		spin_unlock(&rq2->lock);
++		atomic_spin_unlock(&rq2->lock);
+ 	else
+ 		__release(rq2->lock);
+ }
+@@ -3179,7 +3364,7 @@
+ {
+ 	deactivate_task(src_rq, p, 0);
+ 	set_task_cpu(p, this_cpu);
+-	activate_task(this_rq, p, 0);
++	activate_task(this_rq, p, 0, false);
+ 	/*
+ 	 * Note that idle threads have a prio of MAX_PRIO, for this test
+ 	 * to be always true for them.
+@@ -3544,7 +3729,7 @@
+ 	 * capacity but still has some space to pick up some load
+ 	 * from other group and save more power
+ 	 */
+-	if (sgs->sum_nr_running > sgs->group_capacity - 1)
++	if (sgs->sum_nr_running + 1 > sgs->group_capacity)
+ 		return;
+ 
+ 	if (sgs->sum_nr_running > sds->leader_nr_running ||
+@@ -3612,6 +3797,94 @@
+ #endif /* CONFIG_SCHED_MC || CONFIG_SCHED_SMT */
+ 
+ 
++unsigned long default_scale_freq_power(struct sched_domain *sd, int cpu)
++{
++	return SCHED_LOAD_SCALE;
++}
++
++unsigned long __weak arch_scale_freq_power(struct sched_domain *sd, int cpu)
++{
++	return default_scale_freq_power(sd, cpu);
++}
++
++unsigned long default_scale_smt_power(struct sched_domain *sd, int cpu)
++{
++	unsigned long weight = cpumask_weight(sched_domain_span(sd));
++	unsigned long smt_gain = sd->smt_gain;
++
++	smt_gain /= weight;
++
++	return smt_gain;
++}
++
++unsigned long __weak arch_scale_smt_power(struct sched_domain *sd, int cpu)
++{
++	return default_scale_smt_power(sd, cpu);
++}
++
++unsigned long scale_rt_power(int cpu)
++{
++	struct rq *rq = cpu_rq(cpu);
++	u64 total, available;
++
++	sched_avg_update(rq);
++
++	total = sched_avg_period() + (rq->clock - rq->age_stamp);
++	available = total - rq->rt_avg;
++
++	if (unlikely((s64)total < SCHED_LOAD_SCALE))
++		total = SCHED_LOAD_SCALE;
++
++	total >>= SCHED_LOAD_SHIFT;
++
++	return div_u64(available, total);
++}
++
++static void update_cpu_power(struct sched_domain *sd, int cpu)
++{
++	unsigned long weight = cpumask_weight(sched_domain_span(sd));
++	unsigned long power = SCHED_LOAD_SCALE;
++	struct sched_group *sdg = sd->groups;
++
++	power *= arch_scale_freq_power(sd, cpu);
++	power >>= SCHED_LOAD_SHIFT;
++
++	if ((sd->flags & SD_SHARE_CPUPOWER) && weight > 1) {
++		power *= arch_scale_smt_power(sd, cpu);
++		power >>= SCHED_LOAD_SHIFT;
++	}
++
++	power *= scale_rt_power(cpu);
++	power >>= SCHED_LOAD_SHIFT;
++
++	if (!power)
++		power = 1;
++
++	sdg->cpu_power = power;
++}
++
++static void update_group_power(struct sched_domain *sd, int cpu)
++{
++	struct sched_domain *child = sd->child;
++	struct sched_group *group, *sdg = sd->groups;
++	unsigned long power;
++
++	if (!child) {
++		update_cpu_power(sd, cpu);
++		return;
++	}
++
++	power = 0;
++
++	group = child->groups;
++	do {
++		power += group->cpu_power;
++		group = group->next;
++	} while (group != child->groups);
++
++	sdg->cpu_power = power;
++}
++
+ /**
+  * update_sg_lb_stats - Update sched_group's statistics for load balancing.
+  * @group: sched_group whose statistics are to be updated.
+@@ -3624,7 +3897,8 @@
+  * @balance: Should we balance.
+  * @sgs: variable to hold the statistics for this group.
+  */
+-static inline void update_sg_lb_stats(struct sched_group *group, int this_cpu,
++static inline void update_sg_lb_stats(struct sched_domain *sd,
++			struct sched_group *group, int this_cpu,
+ 			enum cpu_idle_type idle, int load_idx, int *sd_idle,
+ 			int local_group, const struct cpumask *cpus,
+ 			int *balance, struct sg_lb_stats *sgs)
+@@ -3635,8 +3909,11 @@
+ 	unsigned long sum_avg_load_per_task;
+ 	unsigned long avg_load_per_task;
+ 
+-	if (local_group)
++	if (local_group) {
+ 		balance_cpu = group_first_cpu(group);
++		if (balance_cpu == this_cpu)
++			update_group_power(sd, this_cpu);
++	}
+ 
+ 	/* Tally up the load of all CPUs in the group */
+ 	sum_avg_load_per_task = avg_load_per_task = 0;
+@@ -3685,8 +3962,7 @@
+ 	}
+ 
+ 	/* Adjust by relative CPU power of the group */
+-	sgs->avg_load = sg_div_cpu_power(group,
+-			sgs->group_load * SCHED_LOAD_SCALE);
++	sgs->avg_load = (sgs->group_load * SCHED_LOAD_SCALE) / group->cpu_power;
+ 
+ 
+ 	/*
+@@ -3698,14 +3974,14 @@
+ 	 *      normalized nr_running number somewhere that negates
+ 	 *      the hierarchy?
+ 	 */
+-	avg_load_per_task = sg_div_cpu_power(group,
+-			sum_avg_load_per_task * SCHED_LOAD_SCALE);
++	avg_load_per_task = (sum_avg_load_per_task * SCHED_LOAD_SCALE) /
++		group->cpu_power;
+ 
+ 	if ((max_cpu_load - min_cpu_load) > 2*avg_load_per_task)
+ 		sgs->group_imb = 1;
+ 
+-	sgs->group_capacity = group->__cpu_power / SCHED_LOAD_SCALE;
+-
++	sgs->group_capacity =
++		DIV_ROUND_CLOSEST(group->cpu_power, SCHED_LOAD_SCALE);
+ }
+ 
+ /**
+@@ -3723,9 +3999,13 @@
+ 			const struct cpumask *cpus, int *balance,
+ 			struct sd_lb_stats *sds)
+ {
++	struct sched_domain *child = sd->child;
+ 	struct sched_group *group = sd->groups;
+ 	struct sg_lb_stats sgs;
+-	int load_idx;
++	int load_idx, prefer_sibling = 0;
++
++	if (child && child->flags & SD_PREFER_SIBLING)
++		prefer_sibling = 1;
+ 
+ 	init_sd_power_savings_stats(sd, sds, idle);
+ 	load_idx = get_sd_load_idx(sd, idle);
+@@ -3736,14 +4016,22 @@
+ 		local_group = cpumask_test_cpu(this_cpu,
+ 					       sched_group_cpus(group));
+ 		memset(&sgs, 0, sizeof(sgs));
+-		update_sg_lb_stats(group, this_cpu, idle, load_idx, sd_idle,
++		update_sg_lb_stats(sd, group, this_cpu, idle, load_idx, sd_idle,
+ 				local_group, cpus, balance, &sgs);
+ 
+ 		if (local_group && balance && !(*balance))
+ 			return;
+ 
+ 		sds->total_load += sgs.group_load;
+-		sds->total_pwr += group->__cpu_power;
++		sds->total_pwr += group->cpu_power;
++
++		/*
++		 * In case the child domain prefers tasks go to siblings
++		 * first, lower the group capacity to one so that we'll try
++		 * and move all the excess tasks away.
++		 */
++		if (prefer_sibling)
++			sgs.group_capacity = min(sgs.group_capacity, 1UL);
+ 
+ 		if (local_group) {
+ 			sds->this_load = sgs.avg_load;
+@@ -3763,7 +4051,6 @@
+ 		update_sd_power_savings_stats(group, sds, local_group, &sgs);
+ 		group = group->next;
+ 	} while (group != sd->groups);
+-
+ }
+ 
+ /**
+@@ -3801,28 +4088,28 @@
+ 	 * moving them.
+ 	 */
+ 
+-	pwr_now += sds->busiest->__cpu_power *
++	pwr_now += sds->busiest->cpu_power *
+ 			min(sds->busiest_load_per_task, sds->max_load);
+-	pwr_now += sds->this->__cpu_power *
++	pwr_now += sds->this->cpu_power *
+ 			min(sds->this_load_per_task, sds->this_load);
+ 	pwr_now /= SCHED_LOAD_SCALE;
+ 
+ 	/* Amount of load we'd subtract */
+-	tmp = sg_div_cpu_power(sds->busiest,
+-			sds->busiest_load_per_task * SCHED_LOAD_SCALE);
++	tmp = (sds->busiest_load_per_task * SCHED_LOAD_SCALE) /
++		sds->busiest->cpu_power;
+ 	if (sds->max_load > tmp)
+-		pwr_move += sds->busiest->__cpu_power *
++		pwr_move += sds->busiest->cpu_power *
+ 			min(sds->busiest_load_per_task, sds->max_load - tmp);
+ 
+ 	/* Amount of load we'd add */
+-	if (sds->max_load * sds->busiest->__cpu_power <
++	if (sds->max_load * sds->busiest->cpu_power <
+ 		sds->busiest_load_per_task * SCHED_LOAD_SCALE)
+-		tmp = sg_div_cpu_power(sds->this,
+-			sds->max_load * sds->busiest->__cpu_power);
++		tmp = (sds->max_load * sds->busiest->cpu_power) /
++			sds->this->cpu_power;
+ 	else
+-		tmp = sg_div_cpu_power(sds->this,
+-			sds->busiest_load_per_task * SCHED_LOAD_SCALE);
+-	pwr_move += sds->this->__cpu_power *
++		tmp = (sds->busiest_load_per_task * SCHED_LOAD_SCALE) /
++			sds->this->cpu_power;
++	pwr_move += sds->this->cpu_power *
+ 			min(sds->this_load_per_task, sds->this_load + tmp);
+ 	pwr_move /= SCHED_LOAD_SCALE;
+ 
+@@ -3857,8 +4144,8 @@
+ 			sds->max_load - sds->busiest_load_per_task);
+ 
+ 	/* How much load to actually move to equalise the imbalance */
+-	*imbalance = min(max_pull * sds->busiest->__cpu_power,
+-		(sds->avg_load - sds->this_load) * sds->this->__cpu_power)
++	*imbalance = min(max_pull * sds->busiest->cpu_power,
++		(sds->avg_load - sds->this_load) * sds->this->cpu_power)
+ 			/ SCHED_LOAD_SCALE;
+ 
+ 	/*
+@@ -3976,6 +4263,26 @@
+ 	return NULL;
+ }
+ 
++static struct sched_group *group_of(int cpu)
++{
++	struct sched_domain *sd = rcu_dereference(cpu_rq(cpu)->sd);
++
++	if (!sd)
++		return NULL;
++
++	return sd->groups;
++}
++
++static unsigned long power_of(int cpu)
++{
++	struct sched_group *group = group_of(cpu);
++
++	if (!group)
++		return SCHED_LOAD_SCALE;
++
++	return group->cpu_power;
++}
++
+ /*
+  * find_busiest_queue - find the busiest runqueue among the cpus in group.
+  */
+@@ -3988,15 +4295,18 @@
+ 	int i;
+ 
+ 	for_each_cpu(i, sched_group_cpus(group)) {
++		unsigned long power = power_of(i);
++		unsigned long capacity = DIV_ROUND_CLOSEST(power, SCHED_LOAD_SCALE);
+ 		unsigned long wl;
+ 
+ 		if (!cpumask_test_cpu(i, cpus))
+ 			continue;
+ 
+ 		rq = cpu_rq(i);
+-		wl = weighted_cpuload(i);
++		wl = weighted_cpuload(i) * SCHED_LOAD_SCALE;
++		wl /= power;
+ 
+-		if (rq->nr_running == 1 && wl > imbalance)
++		if (capacity && rq->nr_running == 1 && wl > imbalance)
+ 			continue;
+ 
+ 		if (wl > max_load) {
+@@ -4105,14 +4415,15 @@
+ 
+ 		if (unlikely(sd->nr_balance_failed > sd->cache_nice_tries+2)) {
+ 
+-			spin_lock_irqsave(&busiest->lock, flags);
++			atomic_spin_lock_irqsave(&busiest->lock, flags);
+ 
+ 			/* don't kick the migration_thread, if the curr
+ 			 * task on busiest cpu can't be moved to this_cpu
+ 			 */
+ 			if (!cpumask_test_cpu(this_cpu,
+ 					      &busiest->curr->cpus_allowed)) {
+-				spin_unlock_irqrestore(&busiest->lock, flags);
++				atomic_spin_unlock_irqrestore(&busiest->lock,
++							      flags);
+ 				all_pinned = 1;
+ 				goto out_one_pinned;
+ 			}
+@@ -4122,7 +4433,7 @@
+ 				busiest->push_cpu = this_cpu;
+ 				active_balance = 1;
+ 			}
+-			spin_unlock_irqrestore(&busiest->lock, flags);
++			atomic_spin_unlock_irqrestore(&busiest->lock, flags);
+ 			if (active_balance)
+ 				wake_up_process(busiest->migration_thread);
+ 
+@@ -4304,10 +4615,10 @@
+ 		/*
+ 		 * Should not call ttwu while holding a rq->lock
+ 		 */
+-		spin_unlock(&this_rq->lock);
++		atomic_spin_unlock(&this_rq->lock);
+ 		if (active_balance)
+ 			wake_up_process(busiest->migration_thread);
+-		spin_lock(&this_rq->lock);
++		atomic_spin_lock(&this_rq->lock);
+ 
+ 	} else
+ 		sd->nr_balance_failed = 0;
+@@ -4712,7 +5023,7 @@
+  */
+ static void run_rebalance_domains(struct softirq_action *h)
+ {
+-	int this_cpu = smp_processor_id();
++	int this_cpu = raw_smp_processor_id();
+ 	struct rq *this_rq = cpu_rq(this_cpu);
+ 	enum cpu_idle_type idle = this_rq->idle_at_tick ?
+ 						CPU_IDLE : CPU_NOT_IDLE;
+@@ -4921,7 +5232,9 @@
+ 
+ 	/* Add user time to cpustat. */
+ 	tmp = cputime_to_cputime64(cputime);
+-	if (TASK_NICE(p) > 0)
++	if (rt_task(p))
++		cpustat->user_rt = cputime64_add(cpustat->user_rt, tmp);
++	else if (TASK_NICE(p) > 0)
+ 		cpustat->nice = cputime64_add(cpustat->nice, tmp);
+ 	else
+ 		cpustat->user = cputime64_add(cpustat->user, tmp);
+@@ -4983,8 +5296,10 @@
+ 	tmp = cputime_to_cputime64(cputime);
+ 	if (hardirq_count() - hardirq_offset)
+ 		cpustat->irq = cputime64_add(cpustat->irq, tmp);
+-	else if (softirq_count())
++	else if (softirq_count() || (p->flags & PF_SOFTIRQ))
+ 		cpustat->softirq = cputime64_add(cpustat->softirq, tmp);
++	else if (rt_task(p))
++		cpustat->system_rt = cputime64_add(cpustat->system_rt, tmp);
+ 	else
+ 		cpustat->system = cputime64_add(cpustat->system, tmp);
+ 
+@@ -5139,11 +5454,14 @@
+ 
+ 	sched_clock_tick();
+ 
+-	spin_lock(&rq->lock);
++	BUG_ON(!irqs_disabled());
++
++	atomic_spin_lock(&rq->lock);
+ 	update_rq_clock(rq);
+ 	update_cpu_load(rq);
+-	curr->sched_class->task_tick(rq, curr, 0);
+-	spin_unlock(&rq->lock);
++	if (curr != rq->idle && curr->se.on_rq)
++		curr->sched_class->task_tick(rq, curr, 0);
++	atomic_spin_unlock(&rq->lock);
+ 
+ 	perf_counter_task_tick(curr, cpu);
+ 
+@@ -5163,6 +5481,19 @@
+ 	return addr;
+ }
+ 
++#ifdef CONFIG_DEBUG_PREEMPT
++void notrace preempt_enable_no_resched(void)
++{
++	barrier();
++	dec_preempt_count();
++
++	WARN_ONCE(!preempt_count(),
++	     KERN_ERR "BUG: %s:%d task might have lost a preemption check!\n",
++	     current->comm, current->pid);
++}
++EXPORT_SYMBOL(preempt_enable_no_resched);
++#endif
++
+ #if defined(CONFIG_PREEMPT) && (defined(CONFIG_DEBUG_PREEMPT) || \
+ 				defined(CONFIG_PREEMPT_TRACER))
+ 
+@@ -5219,8 +5550,8 @@
+ {
+ 	struct pt_regs *regs = get_irq_regs();
+ 
+-	printk(KERN_ERR "BUG: scheduling while atomic: %s/%d/0x%08x\n",
+-		prev->comm, prev->pid, preempt_count());
++	printk(KERN_ERR "BUG: scheduling while atomic: %s/0x%08x/%d, CPU#%d\n",
++	       prev->comm, preempt_count(), prev->pid, smp_processor_id());
+ 
+ 	debug_show_held_locks(prev);
+ 	print_modules();
+@@ -5238,12 +5569,14 @@
+  */
+ static inline void schedule_debug(struct task_struct *prev)
+ {
++//	WARN_ON(system_state == SYSTEM_BOOTING);
++
+ 	/*
+ 	 * Test if we are atomic. Since do_exit() needs to call into
+ 	 * schedule() atomically, we ignore that path for now.
+ 	 * Otherwise, whine if we are scheduling when we should not be.
+ 	 */
+-	if (unlikely(in_atomic_preempt_off() && !prev->exit_state))
++	if (unlikely(in_atomic() && !prev->exit_state))
+ 		__schedule_bug(prev);
+ 
+ 	profile_hit(SCHED_PROFILING, __builtin_return_address(0));
+@@ -5314,15 +5647,13 @@
+ /*
+  * schedule() is the main scheduler function.
+  */
+-asmlinkage void __sched schedule(void)
++asmlinkage void __sched __schedule(void)
+ {
+ 	struct task_struct *prev, *next;
+ 	unsigned long *switch_count;
+ 	struct rq *rq;
+ 	int cpu;
+ 
+-need_resched:
+-	preempt_disable();
+ 	cpu = smp_processor_id();
+ 	rq = cpu_rq(cpu);
+ 	rcu_qsctr_inc(cpu);
+@@ -5330,25 +5661,32 @@
+ 	switch_count = &prev->nivcsw;
+ 
+ 	release_kernel_lock(prev);
+-need_resched_nonpreemptible:
+ 
+ 	schedule_debug(prev);
+ 
++	preempt_disable();
++
+ 	if (sched_feat(HRTICK))
+ 		hrtick_clear(rq);
+ 
+-	spin_lock_irq(&rq->lock);
++	atomic_spin_lock_irq(&rq->lock);
+ 	update_rq_clock(rq);
+ 	clear_tsk_need_resched(prev);
+ 
+-	if (prev->state && !(preempt_count() & PREEMPT_ACTIVE)) {
++	if (!(prev->state & TASK_RUNNING_MUTEX) && prev->state &&
++	    !(preempt_count() & PREEMPT_ACTIVE)) {
+ 		if (unlikely(signal_pending_state(prev->state, prev)))
+ 			prev->state = TASK_RUNNING;
+-		else
++		else {
++			touch_softlockup_watchdog();
+ 			deactivate_task(rq, prev, 1);
++		}
+ 		switch_count = &prev->nvcsw;
+ 	}
+ 
++	if (preempt_count() & PREEMPT_ACTIVE)
++		sub_preempt_count(PREEMPT_ACTIVE);
++
+ #ifdef CONFIG_SMP
+ 	if (prev->sched_class->pre_schedule)
+ 		prev->sched_class->pre_schedule(rq, prev);
+@@ -5375,19 +5713,28 @@
+ 		 */
+ 		cpu = smp_processor_id();
+ 		rq = cpu_rq(cpu);
+-	} else
+-		spin_unlock_irq(&rq->lock);
++		__preempt_enable_no_resched();
++	} else {
++		__preempt_enable_no_resched();
++		atomic_spin_unlock(&rq->lock);
++	}
+ 
+-	if (unlikely(reacquire_kernel_lock(current) < 0))
+-		goto need_resched_nonpreemptible;
++	reacquire_kernel_lock(current);
++}
++
++asmlinkage void __sched schedule(void)
++{
++need_resched:
++	local_irq_disable();
++	__schedule();
++	local_irq_enable();
+ 
+-	preempt_enable_no_resched();
+ 	if (need_resched())
+ 		goto need_resched;
+ }
+ EXPORT_SYMBOL(schedule);
+ 
+-#ifdef CONFIG_SMP
++#if defined(CONFIG_SMP) && !defined(CONFIG_PREEMPT_RT)
+ /*
+  * Look out! "owner" is an entirely speculative pointer
+  * access and not reliable.
+@@ -5449,6 +5796,35 @@
+ #endif
+ 
+ #ifdef CONFIG_PREEMPT
++
++/*
++ * Global flag to turn preemption off on a CONFIG_PREEMPT kernel:
++ */
++int kernel_preemption = 1;
++
++static int __init preempt_setup (char *str)
++{
++	if (!strncmp(str, "off", 3)) {
++		if (kernel_preemption) {
++			printk(KERN_INFO "turning off kernel preemption!\n");
++			kernel_preemption = 0;
++		}
++		return 1;
++	}
++	if (!strncmp(str, "on", 2)) {
++		if (!kernel_preemption) {
++			printk(KERN_INFO "turning on kernel preemption!\n");
++			kernel_preemption = 1;
++		}
++		return 1;
++	}
++	get_option(&str, &kernel_preemption);
++
++	return 1;
++}
++
++__setup("preempt=", preempt_setup);
++
+ /*
+  * this is the entry point to schedule() from in-kernel preemption
+  * off of preempt_enable. Kernel preemptions off return from interrupt
+@@ -5457,7 +5833,11 @@
+ asmlinkage void __sched preempt_schedule(void)
+ {
+ 	struct thread_info *ti = current_thread_info();
++	struct task_struct *task = current;
++	int saved_lock_depth;
+ 
++	if (!kernel_preemption)
++		return;
+ 	/*
+ 	 * If there is a non-zero preempt_count or interrupts are disabled,
+ 	 * we do not want to preempt the current task. Just return..
+@@ -5466,9 +5846,19 @@
+ 		return;
+ 
+ 	do {
++		local_irq_disable();
+ 		add_preempt_count(PREEMPT_ACTIVE);
+-		schedule();
+-		sub_preempt_count(PREEMPT_ACTIVE);
++
++		/*
++		 * We keep the big kernel semaphore locked, but we
++		 * clear ->lock_depth so that schedule() doesnt
++		 * auto-release the semaphore:
++		 */
++		saved_lock_depth = task->lock_depth;
++		task->lock_depth = -1;
++		__schedule();
++		task->lock_depth = saved_lock_depth;
++		local_irq_enable();
+ 
+ 		/*
+ 		 * Check again in case we missed a preemption opportunity
+@@ -5480,24 +5870,40 @@
+ EXPORT_SYMBOL(preempt_schedule);
+ 
+ /*
+- * this is the entry point to schedule() from kernel preemption
+- * off of irq context.
+- * Note, that this is called and return with irqs disabled. This will
+- * protect us against recursive calling from irq.
++ * this is is the entry point for the IRQ return path. Called with
++ * interrupts disabled.  To avoid infinite irq-entry recursion problems
++ * with fast-paced IRQ sources we do all of this carefully to never
++ * enable interrupts again.
+  */
+ asmlinkage void __sched preempt_schedule_irq(void)
+ {
+ 	struct thread_info *ti = current_thread_info();
++	struct task_struct *task = current;
++	int saved_lock_depth;
+ 
+-	/* Catch callers which need to be fixed */
+-	BUG_ON(ti->preempt_count || !irqs_disabled());
++	if (!kernel_preemption)
++		return;
++	/*
++	 * If there is a non-zero preempt_count then just return.
++	 * (interrupts are disabled)
++	 */
++	if (unlikely(ti->preempt_count))
++		return;
+ 
+ 	do {
++		local_irq_disable();
+ 		add_preempt_count(PREEMPT_ACTIVE);
+-		local_irq_enable();
+-		schedule();
++
++		/*
++		 * We keep the big kernel semaphore locked, but we
++		 * clear ->lock_depth so that schedule() doesnt
++		 * auto-release the semaphore:
++		 */
++		saved_lock_depth = task->lock_depth;
++		task->lock_depth = -1;
++		__schedule();
+ 		local_irq_disable();
+-		sub_preempt_count(PREEMPT_ACTIVE);
++		task->lock_depth = saved_lock_depth;
+ 
+ 		/*
+ 		 * Check again in case we missed a preemption opportunity
+@@ -5512,7 +5918,7 @@
+ int default_wake_function(wait_queue_t *curr, unsigned mode, int sync,
+ 			  void *key)
+ {
+-	return try_to_wake_up(curr->private, mode, sync);
++	return try_to_wake_up(curr->private, mode, sync, 0);
+ }
+ EXPORT_SYMBOL(default_wake_function);
+ 
+@@ -5555,7 +5961,7 @@
+ 	unsigned long flags;
+ 
+ 	spin_lock_irqsave(&q->lock, flags);
+-	__wake_up_common(q, mode, nr_exclusive, 0, key);
++	__wake_up_common(q, mode, nr_exclusive, 1, key);
+ 	spin_unlock_irqrestore(&q->lock, flags);
+ }
+ EXPORT_SYMBOL(__wake_up);
+@@ -5635,7 +6041,7 @@
+ 
+ 	spin_lock_irqsave(&x->wait.lock, flags);
+ 	x->done++;
+-	__wake_up_common(&x->wait, TASK_NORMAL, 1, 0, NULL);
++	__wake_up_common(&x->wait, TASK_NORMAL, 1, 1, NULL);
+ 	spin_unlock_irqrestore(&x->wait.lock, flags);
+ }
+ EXPORT_SYMBOL(complete);
+@@ -5655,7 +6061,7 @@
+ 
+ 	spin_lock_irqsave(&x->wait.lock, flags);
+ 	x->done += UINT_MAX/2;
+-	__wake_up_common(&x->wait, TASK_NORMAL, 0, 0, NULL);
++	__wake_up_common(&x->wait, TASK_NORMAL, 0, 1, NULL);
+ 	spin_unlock_irqrestore(&x->wait.lock, flags);
+ }
+ EXPORT_SYMBOL(complete_all);
+@@ -5869,31 +6275,51 @@
+ }
+ EXPORT_SYMBOL(sleep_on_timeout);
+ 
+-#ifdef CONFIG_RT_MUTEXES
+-
+ /*
+- * rt_mutex_setprio - set the current priority of a task
++ * task_setprio - set the current priority of a task
+  * @p: task
+  * @prio: prio value (kernel-internal form)
+  *
+  * This function changes the 'effective' priority of a task. It does
+  * not touch ->normal_prio like __setscheduler().
+  *
+- * Used by the rt_mutex code to implement priority inheritance logic.
++ * Used by the rt_mutex code to implement priority inheritance logic
++ * and by rcupreempt-boost to boost priorities of tasks sleeping
++ * with rcu locks.
+  */
+-void rt_mutex_setprio(struct task_struct *p, int prio)
++void task_setprio(struct task_struct *p, int prio)
+ {
+ 	unsigned long flags;
+ 	int oldprio, on_rq, running;
+ 	struct rq *rq;
+-	const struct sched_class *prev_class = p->sched_class;
++	const struct sched_class *prev_class;
+ 
+ 	BUG_ON(prio < 0 || prio > MAX_PRIO);
+ 
+ 	rq = task_rq_lock(p, &flags);
++
++	/*
++	 * Idle task boosting is a nono in general. There is one
++	 * exception, when NOHZ is active:
++	 *
++	 * The idle task calls get_next_timer_interrupt() and holds
++	 * the timer wheel base->lock on the CPU and another CPU wants
++	 * to access the timer (probably to cancel it). We can safely
++	 * ignore the boosting request, as the idle CPU runs this code
++	 * with interrupts disabled and will complete the lock
++	 * protected section without being interrupted. So there is no
++	 * real need to boost.
++	 */
++	if (unlikely(p == rq->idle)) {
++		WARN_ON(p != rq->curr);
++		WARN_ON(p->pi_blocked_on);
++		goto out_unlock;
++	}
++
+ 	update_rq_clock(rq);
+ 
+ 	oldprio = p->prio;
++	prev_class = p->sched_class;
+ 	on_rq = p->se.on_rq;
+ 	running = task_current(rq, p);
+ 	if (on_rq)
+@@ -5908,18 +6334,20 @@
+ 
+ 	p->prio = prio;
+ 
++	trace_sched_task_setprio(rq, p, oldprio);
++
+ 	if (running)
+ 		p->sched_class->set_curr_task(rq);
+ 	if (on_rq) {
+-		enqueue_task(rq, p, 0);
++		enqueue_task(rq, p, 0, oldprio < prio);
+ 
+ 		check_class_changed(rq, p, prev_class, oldprio, running);
+ 	}
++
++out_unlock:
+ 	task_rq_unlock(rq, &flags);
+ }
+ 
+-#endif
+-
+ void set_user_nice(struct task_struct *p, long nice)
+ {
+ 	int old_prio, delta, on_rq;
+@@ -5955,7 +6383,7 @@
+ 	delta = p->prio - old_prio;
+ 
+ 	if (on_rq) {
+-		enqueue_task(rq, p, 0);
++		enqueue_task(rq, p, 0, false);
+ 		/*
+ 		 * If the task increased its priority or is running and
+ 		 * lowered its priority, then reschedule its CPU:
+@@ -6121,7 +6549,7 @@
+ {
+ 	int retval, oldprio, oldpolicy = -1, on_rq, running;
+ 	unsigned long flags;
+-	const struct sched_class *prev_class = p->sched_class;
++	const struct sched_class *prev_class;
+ 	struct rq *rq;
+ 
+ 	/* may grab non-irq protected spin_locks */
+@@ -6199,7 +6627,7 @@
+ 	 * make sure no PI-waiters arrive (or leave) while we are
+ 	 * changing the priority of the task:
+ 	 */
+-	spin_lock_irqsave(&p->pi_lock, flags);
++	atomic_spin_lock_irqsave(&p->pi_lock, flags);
+ 	/*
+ 	 * To be able to change p->policy safely, the apropriate
+ 	 * runqueue lock must be held.
+@@ -6209,7 +6637,7 @@
+ 	if (unlikely(oldpolicy != -1 && oldpolicy != p->policy)) {
+ 		policy = oldpolicy = -1;
+ 		__task_rq_unlock(rq);
+-		spin_unlock_irqrestore(&p->pi_lock, flags);
++		atomic_spin_unlock_irqrestore(&p->pi_lock, flags);
+ 		goto recheck;
+ 	}
+ 	update_rq_clock(rq);
+@@ -6221,17 +6649,36 @@
+ 		p->sched_class->put_prev_task(rq, p);
+ 
+ 	oldprio = p->prio;
++	prev_class = p->sched_class;
+ 	__setscheduler(rq, p, policy, param->sched_priority);
+ 
+ 	if (running)
+ 		p->sched_class->set_curr_task(rq);
+ 	if (on_rq) {
+-		activate_task(rq, p, 0);
++		/*
++		 * Workaround to make prio ceiling work as expected:
++		 *
++		 * Queue task to head when task is running and task is
++		 * lowering its priority. This works around the non-
++		 * availability of a sched_setprio syscall which was
++		 * tinkered into the posix spec to make prio ceiling
++		 * work correctly.
++		 *
++		 * This workaround violates the posix scheduling
++		 * semantics of tail queueing in the case that the
++		 * priority was changed by anything else than
++		 * sched_setprio, but there is no other breakage
++		 * lurking than some specification fetishists going
++		 * berserk on me.
++		 *
++		 * Fixing this in mainline needs more thoughts.
++		 */
++		activate_task(rq, p, 0, running && oldprio < p->prio);
+ 
+ 		check_class_changed(rq, p, prev_class, oldprio, running);
+ 	}
+ 	__task_rq_unlock(rq);
+-	spin_unlock_irqrestore(&p->pi_lock, flags);
++	atomic_spin_unlock_irqrestore(&p->pi_lock, flags);
+ 
+ 	rt_mutex_adjust_pi(p);
+ 
+@@ -6331,14 +6778,14 @@
+ 		return -EINVAL;
+ 
+ 	retval = -ESRCH;
+-	read_lock(&tasklist_lock);
++	rcu_read_lock();
+ 	p = find_process_by_pid(pid);
+ 	if (p) {
+ 		retval = security_task_getscheduler(p);
+ 		if (!retval)
+ 			retval = p->policy;
+ 	}
+-	read_unlock(&tasklist_lock);
++	rcu_read_unlock();
+ 	return retval;
+ }
+ 
+@@ -6356,7 +6803,7 @@
+ 	if (!param || pid < 0)
+ 		return -EINVAL;
+ 
+-	read_lock(&tasklist_lock);
++	rcu_read_lock();
+ 	p = find_process_by_pid(pid);
+ 	retval = -ESRCH;
+ 	if (!p)
+@@ -6367,7 +6814,7 @@
+ 		goto out_unlock;
+ 
+ 	lp.sched_priority = p->rt_priority;
+-	read_unlock(&tasklist_lock);
++	rcu_read_unlock();
+ 
+ 	/*
+ 	 * This one might sleep, we cannot do it with a spinlock held ...
+@@ -6377,7 +6824,7 @@
+ 	return retval;
+ 
+ out_unlock:
+-	read_unlock(&tasklist_lock);
++	rcu_read_unlock();
+ 	return retval;
+ }
+ 
+@@ -6388,22 +6835,18 @@
+ 	int retval;
+ 
+ 	get_online_cpus();
+-	read_lock(&tasklist_lock);
++	rcu_read_lock();
+ 
+ 	p = find_process_by_pid(pid);
+ 	if (!p) {
+-		read_unlock(&tasklist_lock);
++		rcu_read_unlock();
+ 		put_online_cpus();
+ 		return -ESRCH;
+ 	}
+ 
+-	/*
+-	 * It is not safe to call set_cpus_allowed with the
+-	 * tasklist_lock held. We will bump the task_struct's
+-	 * usage count and then drop tasklist_lock.
+-	 */
++	/* Prevent p going away */
+ 	get_task_struct(p);
+-	read_unlock(&tasklist_lock);
++	rcu_read_unlock();
+ 
+ 	if (!alloc_cpumask_var(&cpus_allowed, GFP_KERNEL)) {
+ 		retval = -ENOMEM;
+@@ -6415,11 +6858,11 @@
+ 	}
+ 	retval = -EPERM;
+ 	if (!check_same_owner(p) && !capable(CAP_SYS_NICE))
+-		goto out_unlock;
++		goto out_free;
+ 
+ 	retval = security_task_setscheduler(p, 0, NULL);
+ 	if (retval)
+-		goto out_unlock;
++		goto out_free;
+ 
+ 	cpuset_cpus_allowed(p, cpus_allowed);
+ 	cpumask_and(new_mask, in_mask, cpus_allowed);
+@@ -6438,7 +6881,7 @@
+ 			goto again;
+ 		}
+ 	}
+-out_unlock:
++out_free:
+ 	free_cpumask_var(new_mask);
+ out_free_cpus_allowed:
+ 	free_cpumask_var(cpus_allowed);
+@@ -6484,10 +6927,12 @@
+ long sched_getaffinity(pid_t pid, struct cpumask *mask)
+ {
+ 	struct task_struct *p;
++	unsigned long flags;
++	struct rq *rq;
+ 	int retval;
+ 
+ 	get_online_cpus();
+-	read_lock(&tasklist_lock);
++	rcu_read_lock();
+ 
+ 	retval = -ESRCH;
+ 	p = find_process_by_pid(pid);
+@@ -6498,10 +6943,12 @@
+ 	if (retval)
+ 		goto out_unlock;
+ 
++	rq = task_rq_lock(p, &flags);
+ 	cpumask_and(mask, &p->cpus_allowed, cpu_online_mask);
++	task_rq_unlock(rq, &flags);
+ 
+ out_unlock:
+-	read_unlock(&tasklist_lock);
++	rcu_read_unlock();
+ 	put_online_cpus();
+ 
+ 	return retval;
+@@ -6557,9 +7004,9 @@
+ 	__release(rq->lock);
+ 	spin_release(&rq->lock.dep_map, 1, _THIS_IP_);
+ 	_raw_spin_unlock(&rq->lock);
+-	preempt_enable_no_resched();
++	local_irq_enable();
+ 
+-	schedule();
++	preempt_enable_and_schedule();
+ 
+ 	return 0;
+ }
+@@ -6569,9 +7016,40 @@
+ 	return need_resched() && !(preempt_count() & PREEMPT_ACTIVE);
+ }
+ 
++#if defined(CONFIG_DEBUG_SPINLOCK_SLEEP) || defined(CONFIG_DEBUG_PREEMPT)
++void __might_sleep(char *file, int line)
++{
++#ifdef in_atomic
++	static unsigned long prev_jiffy;	/* ratelimiting */
++
++	if ((!in_atomic() && !irqs_disabled()) ||
++		    system_state != SYSTEM_RUNNING || oops_in_progress)
++		return;
++
++	if (time_before(jiffies, prev_jiffy + HZ) && prev_jiffy)
++		return;
++	prev_jiffy = jiffies;
++
++	printk(KERN_ERR
++		"BUG: sleeping function called from invalid context at %s:%d\n",
++			file, line);
++	printk(KERN_ERR
++		"in_atomic(): %d, irqs_disabled(): %d, pid: %d, name: %s\n",
++			in_atomic(), irqs_disabled(),
++			current->pid, current->comm);
++
++	debug_show_held_locks(current);
++	if (irqs_disabled())
++		print_irqtrace_events(current);
++	dump_stack();
++#endif
++}
++EXPORT_SYMBOL(__might_sleep);
++#endif
++
+ static void __cond_resched(void)
+ {
+-#ifdef CONFIG_DEBUG_SPINLOCK_SLEEP
++#if defined(CONFIG_DEBUG_SPINLOCK_SLEEP) || defined(CONFIG_DEBUG_PREEMPT)
+ 	__might_sleep(__FILE__, __LINE__);
+ #endif
+ 	/*
+@@ -6580,10 +7058,11 @@
+ 	 * cond_resched() call.
+ 	 */
+ 	do {
++		local_irq_disable();
+ 		add_preempt_count(PREEMPT_ACTIVE);
+-		schedule();
+-		sub_preempt_count(PREEMPT_ACTIVE);
++		__schedule();
+ 	} while (need_resched());
++	local_irq_enable();
+ }
+ 
+ int __sched _cond_resched(void)
+@@ -6622,9 +7101,16 @@
+ }
+ EXPORT_SYMBOL(cond_resched_lock);
+ 
++/*
++ * Voluntarily preempt a process context that has softirqs disabled:
++ */
+ int __sched cond_resched_softirq(void)
+ {
+-	BUG_ON(!in_softirq());
++#ifndef CONFIG_PREEMPT_SOFTIRQS
++	WARN_ON_ONCE(!in_softirq());
++	if (!in_softirq())
++		return 0;
++#endif
+ 
+ 	if (should_resched()) {
+ 		local_bh_enable();
+@@ -6636,17 +7122,75 @@
+ }
+ EXPORT_SYMBOL(cond_resched_softirq);
+ 
++/*
++ * Voluntarily preempt a softirq context (possible with softirq threading):
++ */
++int __sched cond_resched_softirq_context(void)
++{
++	WARN_ON_ONCE(!in_softirq());
++
++	if (softirq_need_resched() && system_state == SYSTEM_RUNNING) {
++		raw_local_irq_disable();
++		_local_bh_enable();
++		raw_local_irq_enable();
++		__cond_resched();
++		local_bh_disable();
++		return 1;
++	}
++	return 0;
++}
++EXPORT_SYMBOL(cond_resched_softirq_context);
++
++#ifdef CONFIG_PREEMPT_VOLUNTARY
++int voluntary_preemption = 1;
++EXPORT_SYMBOL(voluntary_preemption);
++
++static int __init voluntary_preempt_setup (char *str)
++{
++	if (!strncmp(str, "off", 3))
++		voluntary_preemption = 0;
++	else
++		get_option(&str, &voluntary_preemption);
++	if (!voluntary_preemption)
++		printk("turning off voluntary preemption!\n");
++
++	return 1;
++}
++
++__setup("voluntary-preempt=", voluntary_preempt_setup);
++
++#endif
++
+ /**
+  * yield - yield the current processor to other threads.
+  *
+  * This is a shortcut for kernel-space yielding - it marks the
+  * thread runnable and calls sys_sched_yield().
+  */
+-void __sched yield(void)
++void __sched __yield(void)
+ {
+ 	set_current_state(TASK_RUNNING);
+ 	sys_sched_yield();
+ }
++
++void __sched yield(void)
++{
++	static int once = 1;
++
++	/*
++	 * it's a bug to rely on yield() with RT priorities. We print
++	 * the first occurance after bootup ... this will still give
++	 * us an idea about the scope of the problem, without spamming
++	 * the syslog:
++	 */
++	if (once && rt_task(current)) {
++		once = 0;
++		printk(KERN_ERR "BUG: %s:%d RT task yield()-ing!\n",
++			current->comm, current->pid);
++		dump_stack();
++	}
++	__yield();
++}
+ EXPORT_SYMBOL(yield);
+ 
+ /*
+@@ -6750,7 +7294,7 @@
+ 		return -EINVAL;
+ 
+ 	retval = -ESRCH;
+-	read_lock(&tasklist_lock);
++	rcu_read_lock();
+ 	p = find_process_by_pid(pid);
+ 	if (!p)
+ 		goto out_unlock;
+@@ -6776,13 +7320,13 @@
+ 			time_slice = NS_TO_JIFFIES(sched_slice(&rq->cfs, se));
+ 		task_rq_unlock(rq, &flags);
+ 	}
+-	read_unlock(&tasklist_lock);
++	rcu_read_unlock();
+ 	jiffies_to_timespec(time_slice, &t);
+ 	retval = copy_to_user(interval, &t, sizeof(t)) ? -EFAULT : 0;
+ 	return retval;
+ 
+ out_unlock:
+-	read_unlock(&tasklist_lock);
++	rcu_read_unlock();
+ 	return retval;
+ }
+ 
+@@ -6820,6 +7364,7 @@
+ void show_state_filter(unsigned long state_filter)
+ {
+ 	struct task_struct *g, *p;
++	int do_unlock = 1;
+ 
+ #if BITS_PER_LONG == 32
+ 	printk(KERN_INFO
+@@ -6828,7 +7373,16 @@
+ 	printk(KERN_INFO
+ 		"  task                        PC stack   pid father\n");
+ #endif
++#ifdef CONFIG_PREEMPT_RT
++	if (!read_trylock(&tasklist_lock)) {
++		printk("hm, tasklist_lock write-locked.\n");
++		printk("ignoring ...\n");
++		do_unlock = 0;
++	}
++#else
+ 	read_lock(&tasklist_lock);
++#endif
++
+ 	do_each_thread(g, p) {
+ 		/*
+ 		 * reset the NMI-timeout, listing all files on a slow
+@@ -6844,7 +7398,8 @@
+ #ifdef CONFIG_SCHED_DEBUG
+ 	sysrq_sched_debug_show();
+ #endif
+-	read_unlock(&tasklist_lock);
++	if (do_unlock)
++		read_unlock(&tasklist_lock);
+ 	/*
+ 	 * Only show locks if all tasks are dumped:
+ 	 */
+@@ -6870,7 +7425,7 @@
+ 	struct rq *rq = cpu_rq(cpu);
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&rq->lock, flags);
++	atomic_spin_lock_irqsave(&rq->lock, flags);
+ 
+ 	__sched_fork(idle);
+ 	idle->se.exec_start = sched_clock();
+@@ -6880,17 +7435,14 @@
+ 	__set_task_cpu(idle, cpu);
+ 
+ 	rq->curr = rq->idle = idle;
+-#if defined(CONFIG_SMP) && defined(__ARCH_WANT_UNLOCKED_CTXSW)
++#if defined(CONFIG_SMP)
+ 	idle->oncpu = 1;
+ #endif
+-	spin_unlock_irqrestore(&rq->lock, flags);
++	atomic_spin_unlock_irqrestore(&rq->lock, flags);
+ 
+ 	/* Set the preempt count _outside_ the spinlocks! */
+-#if defined(CONFIG_PREEMPT)
+-	task_thread_info(idle)->preempt_count = (idle->lock_depth >= 0);
+-#else
+ 	task_thread_info(idle)->preempt_count = 0;
+-#endif
++
+ 	/*
+ 	 * The idle tasks have their own, simple scheduling class:
+ 	 */
+@@ -7019,11 +7571,18 @@
+ static int __migrate_task(struct task_struct *p, int src_cpu, int dest_cpu)
+ {
+ 	struct rq *rq_dest, *rq_src;
++	unsigned long flags;
+ 	int ret = 0, on_rq;
+ 
+ 	if (unlikely(!cpu_active(dest_cpu)))
+ 		return ret;
+ 
++	 /*
++	  * PREEMPT_RT: this relies on write_lock_irq(&tasklist_lock)
++	  * disabling interrupts - which on PREEMPT_RT does not do:
++	  */
++	local_irq_save(flags);
++
+ 	rq_src = cpu_rq(src_cpu);
+ 	rq_dest = cpu_rq(dest_cpu);
+ 
+@@ -7041,13 +7600,15 @@
+ 
+ 	set_task_cpu(p, dest_cpu);
+ 	if (on_rq) {
+-		activate_task(rq_dest, p, 0);
++		activate_task(rq_dest, p, 0, false);
+ 		check_preempt_curr(rq_dest, p, 0);
+ 	}
+ done:
+ 	ret = 1;
+ fail:
+ 	double_rq_unlock(rq_src, rq_dest);
++	local_irq_restore(flags);
++
+ 	return ret;
+ }
+ 
+@@ -7069,10 +7630,10 @@
+ 		struct migration_req *req;
+ 		struct list_head *head;
+ 
+-		spin_lock_irq(&rq->lock);
++		atomic_spin_lock_irq(&rq->lock);
+ 
+ 		if (cpu_is_offline(cpu)) {
+-			spin_unlock_irq(&rq->lock);
++			atomic_spin_unlock_irq(&rq->lock);
+ 			break;
+ 		}
+ 
+@@ -7084,7 +7645,7 @@
+ 		head = &rq->migration_queue;
+ 
+ 		if (list_empty(head)) {
+-			spin_unlock_irq(&rq->lock);
++			atomic_spin_unlock_irq(&rq->lock);
+ 			schedule();
+ 			set_current_state(TASK_INTERRUPTIBLE);
+ 			continue;
+@@ -7092,7 +7653,7 @@
+ 		req = list_entry(head->next, struct migration_req, list);
+ 		list_del_init(head->next);
+ 
+-		spin_unlock(&rq->lock);
++		atomic_spin_unlock(&rq->lock);
+ 		__migrate_task(req->task, cpu, req->dest_cpu);
+ 		local_irq_enable();
+ 
+@@ -7214,14 +7775,14 @@
+ 	 * Strictly not necessary since rest of the CPUs are stopped by now
+ 	 * and interrupts disabled on the current cpu.
+ 	 */
+-	spin_lock_irqsave(&rq->lock, flags);
++	atomic_spin_lock_irqsave(&rq->lock, flags);
+ 
+ 	__setscheduler(rq, p, SCHED_FIFO, MAX_RT_PRIO-1);
+ 
+ 	update_rq_clock(rq);
+-	activate_task(rq, p, 0);
++	activate_task(rq, p, 0, false);
+ 
+-	spin_unlock_irqrestore(&rq->lock, flags);
++	atomic_spin_unlock_irqrestore(&rq->lock, flags);
+ }
+ 
+ /*
+@@ -7236,7 +7797,11 @@
+ 
+ 	if (mm != &init_mm)
+ 		switch_mm(mm, &init_mm, current);
++#ifdef CONFIG_PREEMPT_RT
++	mmdrop_delayed(mm);
++#else
+ 	mmdrop(mm);
++#endif
+ }
+ 
+ /* called under rq->lock with disabled interrupts */
+@@ -7257,9 +7822,9 @@
+ 	 * that's OK. No task can be added to this CPU, so iteration is
+ 	 * fine.
+ 	 */
+-	spin_unlock_irq(&rq->lock);
++	atomic_spin_unlock_irq(&rq->lock);
+ 	move_task_off_dead_cpu(dead_cpu, p);
+-	spin_lock_irq(&rq->lock);
++	atomic_spin_lock_irq(&rq->lock);
+ 
+ 	put_task_struct(p);
+ }
+@@ -7526,13 +8091,13 @@
+ 
+ 		/* Update our root-domain */
+ 		rq = cpu_rq(cpu);
+-		spin_lock_irqsave(&rq->lock, flags);
++		atomic_spin_lock_irqsave(&rq->lock, flags);
+ 		if (rq->rd) {
+ 			BUG_ON(!cpumask_test_cpu(cpu, rq->rd->span));
+ 
+ 			set_rq_online(rq);
+ 		}
+-		spin_unlock_irqrestore(&rq->lock, flags);
++		atomic_spin_unlock_irqrestore(&rq->lock, flags);
+ 		break;
+ 
+ #ifdef CONFIG_HOTPLUG_CPU
+@@ -7557,14 +8122,14 @@
+ 		put_task_struct(rq->migration_thread);
+ 		rq->migration_thread = NULL;
+ 		/* Idle task back to normal (off runqueue, low prio) */
+-		spin_lock_irq(&rq->lock);
++		atomic_spin_lock_irq(&rq->lock);
+ 		update_rq_clock(rq);
+ 		deactivate_task(rq, rq->idle, 0);
+ 		rq->idle->static_prio = MAX_PRIO;
+ 		__setscheduler(rq, rq->idle, SCHED_NORMAL, 0);
+ 		rq->idle->sched_class = &idle_sched_class;
+ 		migrate_dead_tasks(cpu);
+-		spin_unlock_irq(&rq->lock);
++		atomic_spin_unlock_irq(&rq->lock);
+ 		cpuset_unlock();
+ 		migrate_nr_uninterruptible(rq);
+ 		BUG_ON(rq->nr_running != 0);
+@@ -7574,30 +8139,30 @@
+ 		 * they didn't take sched_hotcpu_mutex. Just wake up
+ 		 * the requestors.
+ 		 */
+-		spin_lock_irq(&rq->lock);
++		atomic_spin_lock_irq(&rq->lock);
+ 		while (!list_empty(&rq->migration_queue)) {
+ 			struct migration_req *req;
+ 
+ 			req = list_entry(rq->migration_queue.next,
+ 					 struct migration_req, list);
+ 			list_del_init(&req->list);
+-			spin_unlock_irq(&rq->lock);
++			atomic_spin_unlock_irq(&rq->lock);
+ 			complete(&req->done);
+-			spin_lock_irq(&rq->lock);
++			atomic_spin_lock_irq(&rq->lock);
+ 		}
+-		spin_unlock_irq(&rq->lock);
++		atomic_spin_unlock_irq(&rq->lock);
+ 		break;
+ 
+ 	case CPU_DYING:
+ 	case CPU_DYING_FROZEN:
+ 		/* Update our root-domain */
+ 		rq = cpu_rq(cpu);
+-		spin_lock_irqsave(&rq->lock, flags);
++		atomic_spin_lock_irqsave(&rq->lock, flags);
+ 		if (rq->rd) {
+ 			BUG_ON(!cpumask_test_cpu(cpu, rq->rd->span));
+ 			set_rq_offline(rq);
+ 		}
+-		spin_unlock_irqrestore(&rq->lock, flags);
++		atomic_spin_unlock_irqrestore(&rq->lock, flags);
+ 		break;
+ #endif
+ 	}
+@@ -7625,7 +8190,7 @@
+ 	migration_call(&migration_notifier, CPU_ONLINE, cpu);
+ 	register_cpu_notifier(&migration_notifier);
+ 
+-	return err;
++	return 0;
+ }
+ early_initcall(migration_init);
+ #endif
+@@ -7672,7 +8237,7 @@
+ 			break;
+ 		}
+ 
+-		if (!group->__cpu_power) {
++		if (!group->cpu_power) {
+ 			printk(KERN_CONT "\n");
+ 			printk(KERN_ERR "ERROR: domain->cpu_power not "
+ 					"set\n");
+@@ -7696,9 +8261,9 @@
+ 		cpulist_scnprintf(str, sizeof(str), sched_group_cpus(group));
+ 
+ 		printk(KERN_CONT " %s", str);
+-		if (group->__cpu_power != SCHED_LOAD_SCALE) {
+-			printk(KERN_CONT " (__cpu_power = %d)",
+-				group->__cpu_power);
++		if (group->cpu_power != SCHED_LOAD_SCALE) {
++			printk(KERN_CONT " (cpu_power = %d)",
++				group->cpu_power);
+ 		}
+ 
+ 		group = group->next;
+@@ -7818,7 +8383,7 @@
+ 	struct root_domain *old_rd = NULL;
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&rq->lock, flags);
++	atomic_spin_lock_irqsave(&rq->lock, flags);
+ 
+ 	if (rq->rd) {
+ 		old_rd = rq->rd;
+@@ -7844,7 +8409,7 @@
+ 	if (cpumask_test_cpu(rq->cpu, cpu_online_mask))
+ 		set_rq_online(rq);
+ 
+-	spin_unlock_irqrestore(&rq->lock, flags);
++	atomic_spin_unlock_irqrestore(&rq->lock, flags);
+ 
+ 	if (old_rd)
+ 		free_rootdomain(old_rd);
+@@ -7984,7 +8549,7 @@
+ 			continue;
+ 
+ 		cpumask_clear(sched_group_cpus(sg));
+-		sg->__cpu_power = 0;
++		sg->cpu_power = 0;
+ 
+ 		for_each_cpu(j, span) {
+ 			if (group_fn(j, cpu_map, NULL, tmpmask) != group)
+@@ -8209,7 +8774,7 @@
+ 				continue;
+ 			}
+ 
+-			sg_inc_cpu_power(sg, sd->groups->__cpu_power);
++			sg->cpu_power += sd->groups->cpu_power;
+ 		}
+ 		sg = sg->next;
+ 	} while (sg != group_head);
+@@ -8267,15 +8832,13 @@
+  * there are asymmetries in the topology. If there are asymmetries, group
+  * having more cpu_power will pickup more load compared to the group having
+  * less cpu_power.
+- *
+- * cpu_power will be a multiple of SCHED_LOAD_SCALE. This multiple represents
+- * the maximum number of tasks a group can handle in the presence of other idle
+- * or lightly loaded groups in the same sched domain.
+  */
+ static void init_sched_groups_power(int cpu, struct sched_domain *sd)
+ {
+ 	struct sched_domain *child;
+ 	struct sched_group *group;
++	long power;
++	int weight;
+ 
+ 	WARN_ON(!sd || !sd->groups);
+ 
+@@ -8284,28 +8847,32 @@
+ 
+ 	child = sd->child;
+ 
+-	sd->groups->__cpu_power = 0;
++	sd->groups->cpu_power = 0;
+ 
+-	/*
+-	 * For perf policy, if the groups in child domain share resources
+-	 * (for example cores sharing some portions of the cache hierarchy
+-	 * or SMT), then set this domain groups cpu_power such that each group
+-	 * can handle only one task, when there are other idle groups in the
+-	 * same sched domain.
+-	 */
+-	if (!child || (!(sd->flags & SD_POWERSAVINGS_BALANCE) &&
+-		       (child->flags &
+-			(SD_SHARE_CPUPOWER | SD_SHARE_PKG_RESOURCES)))) {
+-		sg_inc_cpu_power(sd->groups, SCHED_LOAD_SCALE);
++	if (!child) {
++		power = SCHED_LOAD_SCALE;
++		weight = cpumask_weight(sched_domain_span(sd));
++		/*
++		 * SMT siblings share the power of a single core.
++		 * Usually multiple threads get a better yield out of
++		 * that one core than a single thread would have,
++		 * reflect that in sd->smt_gain.
++		 */
++		if ((sd->flags & SD_SHARE_CPUPOWER) && weight > 1) {
++			power *= sd->smt_gain;
++			power /= weight;
++			power >>= SCHED_LOAD_SHIFT;
++		}
++		sd->groups->cpu_power += power;
+ 		return;
+ 	}
+ 
+ 	/*
+-	 * add cpu_power of each child group to this groups cpu_power
++	 * Add cpu_power of each child group to this groups cpu_power.
+ 	 */
+ 	group = child->groups;
+ 	do {
+-		sg_inc_cpu_power(sd->groups, group->__cpu_power);
++		sd->groups->cpu_power += group->cpu_power;
+ 		group = group->next;
+ 	} while (group != child->groups);
+ }
+@@ -8578,7 +9145,7 @@
+ 			sd = &per_cpu(node_domains, j).sd;
+ 			sd->groups = sg;
+ 		}
+-		sg->__cpu_power = 0;
++		sg->cpu_power = 0;
+ 		cpumask_copy(sched_group_cpus(sg), nodemask);
+ 		sg->next = sg;
+ 		cpumask_or(covered, covered, nodemask);
+@@ -8605,7 +9172,7 @@
+ 				"Can not alloc domain group for node %d\n", j);
+ 				goto error;
+ 			}
+-			sg->__cpu_power = 0;
++			sg->cpu_power = 0;
+ 			cpumask_copy(sched_group_cpus(sg), tmpmask);
+ 			sg->next = prev->next;
+ 			cpumask_or(covered, covered, tmpmask);
+@@ -9098,13 +9665,13 @@
+ #ifdef CONFIG_SMP
+ 	rt_rq->rt_nr_migratory = 0;
+ 	rt_rq->overloaded = 0;
+-	plist_head_init(&rt_rq->pushable_tasks, &rq->lock);
++	plist_head_init_atomic(&rt_rq->pushable_tasks, &rq->lock);
+ #endif
+ 
+ 	rt_rq->rt_time = 0;
+ 	rt_rq->rt_throttled = 0;
+ 	rt_rq->rt_runtime = 0;
+-	spin_lock_init(&rt_rq->rt_runtime_lock);
++	atomic_spin_lock_init(&rt_rq->rt_runtime_lock);
+ 
+ #ifdef CONFIG_RT_GROUP_SCHED
+ 	rt_rq->rt_nr_boosted = 0;
+@@ -9264,7 +9831,7 @@
+ 		struct rq *rq;
+ 
+ 		rq = cpu_rq(i);
+-		spin_lock_init(&rq->lock);
++		atomic_spin_lock_init(&rq->lock);
+ 		rq->nr_running = 0;
+ 		rq->calc_load_active = 0;
+ 		rq->calc_load_update = jiffies + LOAD_FREQ;
+@@ -9359,7 +9926,7 @@
+ #endif
+ 
+ #ifdef CONFIG_RT_MUTEXES
+-	plist_head_init(&init_task.pi_waiters, &init_task.pi_lock);
++	plist_head_init_atomic(&init_task.pi_waiters, &init_task.pi_lock);
+ #endif
+ 
+ 	/*
+@@ -9368,6 +9935,9 @@
+ 	atomic_inc(&init_mm.mm_count);
+ 	enter_lazy_tlb(&init_mm, current);
+ 
++#ifdef CONFIG_PREEMPT_RT
++	printk("Real-Time Preemption Support (C) 2004-2007 Ingo Molnar\n");
++#endif
+ 	/*
+ 	 * Make us the idle thread. Technically, schedule() should not be
+ 	 * called from this thread, however somewhere below it might be,
+@@ -9400,36 +9970,6 @@
+ 	scheduler_running = 1;
+ }
+ 
+-#ifdef CONFIG_DEBUG_SPINLOCK_SLEEP
+-void __might_sleep(char *file, int line)
+-{
+-#ifdef in_atomic
+-	static unsigned long prev_jiffy;	/* ratelimiting */
+-
+-	if ((!in_atomic() && !irqs_disabled()) ||
+-		    system_state != SYSTEM_RUNNING || oops_in_progress)
+-		return;
+-	if (time_before(jiffies, prev_jiffy + HZ) && prev_jiffy)
+-		return;
+-	prev_jiffy = jiffies;
+-
+-	printk(KERN_ERR
+-		"BUG: sleeping function called from invalid context at %s:%d\n",
+-			file, line);
+-	printk(KERN_ERR
+-		"in_atomic(): %d, irqs_disabled(): %d, pid: %d, name: %s\n",
+-			in_atomic(), irqs_disabled(),
+-			current->pid, current->comm);
+-
+-	debug_show_held_locks(current);
+-	if (irqs_disabled())
+-		print_irqtrace_events(current);
+-	dump_stack();
+-#endif
+-}
+-EXPORT_SYMBOL(__might_sleep);
+-#endif
+-
+ #ifdef CONFIG_MAGIC_SYSRQ
+ static void normalize_task(struct rq *rq, struct task_struct *p)
+ {
+@@ -9441,7 +9981,7 @@
+ 		deactivate_task(rq, p, 0);
+ 	__setscheduler(rq, p, SCHED_NORMAL, 0);
+ 	if (on_rq) {
+-		activate_task(rq, p, 0);
++		activate_task(rq, p, 0, false);
+ 		resched_task(rq->curr);
+ 	}
+ }
+@@ -9477,13 +10017,13 @@
+ 			continue;
+ 		}
+ 
+-		spin_lock(&p->pi_lock);
++		atomic_spin_lock(&p->pi_lock);
+ 		rq = __task_rq_lock(p);
+ 
+ 		normalize_task(rq, p);
+ 
+ 		__task_rq_unlock(rq);
+-		spin_unlock(&p->pi_lock);
++		atomic_spin_unlock(&p->pi_lock);
+ 	} while_each_thread(g, p);
+ 
+ 	read_unlock_irqrestore(&tasklist_lock, flags);
+@@ -9813,7 +10353,7 @@
+ 	if (unlikely(running))
+ 		tsk->sched_class->set_curr_task(rq);
+ 	if (on_rq)
+-		enqueue_task(rq, tsk, 0);
++		enqueue_task(rq, tsk, 0, false);
+ 
+ 	task_rq_unlock(rq, &flags);
+ }
+@@ -9842,9 +10382,9 @@
+ 	struct rq *rq = cfs_rq->rq;
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&rq->lock, flags);
++	atomic_spin_lock_irqsave(&rq->lock, flags);
+ 	__set_se_shares(se, shares);
+-	spin_unlock_irqrestore(&rq->lock, flags);
++	atomic_spin_unlock_irqrestore(&rq->lock, flags);
+ }
+ 
+ static DEFINE_MUTEX(shares_mutex);
+@@ -10029,18 +10569,18 @@
+ 	if (err)
+ 		goto unlock;
+ 
+-	spin_lock_irq(&tg->rt_bandwidth.rt_runtime_lock);
++	atomic_spin_lock_irq(&tg->rt_bandwidth.rt_runtime_lock);
+ 	tg->rt_bandwidth.rt_period = ns_to_ktime(rt_period);
+ 	tg->rt_bandwidth.rt_runtime = rt_runtime;
+ 
+ 	for_each_possible_cpu(i) {
+ 		struct rt_rq *rt_rq = tg->rt_rq[i];
+ 
+-		spin_lock(&rt_rq->rt_runtime_lock);
++		atomic_spin_lock(&rt_rq->rt_runtime_lock);
+ 		rt_rq->rt_runtime = rt_runtime;
+-		spin_unlock(&rt_rq->rt_runtime_lock);
++		atomic_spin_unlock(&rt_rq->rt_runtime_lock);
+ 	}
+-	spin_unlock_irq(&tg->rt_bandwidth.rt_runtime_lock);
++	atomic_spin_unlock_irq(&tg->rt_bandwidth.rt_runtime_lock);
+  unlock:
+ 	read_unlock(&tasklist_lock);
+ 	mutex_unlock(&rt_constraints_mutex);
+@@ -10145,15 +10685,15 @@
+ 	if (sysctl_sched_rt_runtime == 0)
+ 		return -EBUSY;
+ 
+-	spin_lock_irqsave(&def_rt_bandwidth.rt_runtime_lock, flags);
++	atomic_spin_lock_irqsave(&def_rt_bandwidth.rt_runtime_lock, flags);
+ 	for_each_possible_cpu(i) {
+ 		struct rt_rq *rt_rq = &cpu_rq(i)->rt;
+ 
+-		spin_lock(&rt_rq->rt_runtime_lock);
++		atomic_spin_lock(&rt_rq->rt_runtime_lock);
+ 		rt_rq->rt_runtime = global_rt_runtime();
+-		spin_unlock(&rt_rq->rt_runtime_lock);
++		atomic_spin_unlock(&rt_rq->rt_runtime_lock);
+ 	}
+-	spin_unlock_irqrestore(&def_rt_bandwidth.rt_runtime_lock, flags);
++	atomic_spin_unlock_irqrestore(&def_rt_bandwidth.rt_runtime_lock, flags);
+ 
+ 	return 0;
+ }
+@@ -10415,9 +10955,9 @@
+ 	/*
+ 	 * Take rq->lock to make 64-bit read safe on 32-bit platforms.
+ 	 */
+-	spin_lock_irq(&cpu_rq(cpu)->lock);
++	atomic_spin_lock_irq(&cpu_rq(cpu)->lock);
+ 	data = *cpuusage;
+-	spin_unlock_irq(&cpu_rq(cpu)->lock);
++	atomic_spin_unlock_irq(&cpu_rq(cpu)->lock);
+ #else
+ 	data = *cpuusage;
+ #endif
+@@ -10433,9 +10973,9 @@
+ 	/*
+ 	 * Take rq->lock to make 64-bit write safe on 32-bit platforms.
+ 	 */
+-	spin_lock_irq(&cpu_rq(cpu)->lock);
++	atomic_spin_lock_irq(&cpu_rq(cpu)->lock);
+ 	*cpuusage = val;
+-	spin_unlock_irq(&cpu_rq(cpu)->lock);
++	atomic_spin_unlock_irq(&cpu_rq(cpu)->lock);
+ #else
+ 	*cpuusage = val;
+ #endif
+Index: linux-rt-2.6.31/kernel/sched_cpupri.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/sched_cpupri.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/sched_cpupri.c	2010-05-17 14:23:20.098387185 +0200
+@@ -132,27 +132,27 @@
+ 	if (likely(oldpri != CPUPRI_INVALID)) {
+ 		struct cpupri_vec *vec  = &cp->pri_to_cpu[oldpri];
+ 
+-		spin_lock_irqsave(&vec->lock, flags);
++		atomic_spin_lock_irqsave(&vec->lock, flags);
+ 
+ 		vec->count--;
+ 		if (!vec->count)
+ 			clear_bit(oldpri, cp->pri_active);
+ 		cpumask_clear_cpu(cpu, vec->mask);
+ 
+-		spin_unlock_irqrestore(&vec->lock, flags);
++		atomic_spin_unlock_irqrestore(&vec->lock, flags);
+ 	}
+ 
+ 	if (likely(newpri != CPUPRI_INVALID)) {
+ 		struct cpupri_vec *vec = &cp->pri_to_cpu[newpri];
+ 
+-		spin_lock_irqsave(&vec->lock, flags);
++		atomic_spin_lock_irqsave(&vec->lock, flags);
+ 
+ 		cpumask_set_cpu(cpu, vec->mask);
+ 		vec->count++;
+ 		if (vec->count == 1)
+ 			set_bit(newpri, cp->pri_active);
+ 
+-		spin_unlock_irqrestore(&vec->lock, flags);
++		atomic_spin_unlock_irqrestore(&vec->lock, flags);
+ 	}
+ 
+ 	*currpri = newpri;
+@@ -178,7 +178,7 @@
+ 	for (i = 0; i < CPUPRI_NR_PRIORITIES; i++) {
+ 		struct cpupri_vec *vec = &cp->pri_to_cpu[i];
+ 
+-		spin_lock_init(&vec->lock);
++		atomic_spin_lock_init(&vec->lock);
+ 		vec->count = 0;
+ 		if (!zalloc_cpumask_var(&vec->mask, gfp))
+ 			goto cleanup;
+Index: linux-rt-2.6.31/kernel/sched_cpupri.h
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/sched_cpupri.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/sched_cpupri.h	2010-05-17 14:23:20.098387185 +0200
+@@ -12,7 +12,7 @@
+ /* values 2-101 are RT priorities 0-99 */
+ 
+ struct cpupri_vec {
+-	spinlock_t lock;
++	atomic_spinlock_t lock;
+ 	int        count;
+ 	cpumask_var_t mask;
+ };
+Index: linux-rt-2.6.31/kernel/sched_debug.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/sched_debug.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/sched_debug.c	2010-05-17 14:23:20.098387185 +0200
+@@ -184,7 +184,7 @@
+ 	SEQ_printf(m, "  .%-30s: %Ld.%06ld\n", "exec_clock",
+ 			SPLIT_NS(cfs_rq->exec_clock));
+ 
+-	spin_lock_irqsave(&rq->lock, flags);
++	atomic_spin_lock_irqsave(&rq->lock, flags);
+ 	if (cfs_rq->rb_leftmost)
+ 		MIN_vruntime = (__pick_next_entity(cfs_rq))->vruntime;
+ 	last = __pick_last_entity(cfs_rq);
+@@ -192,7 +192,7 @@
+ 		max_vruntime = last->vruntime;
+ 	min_vruntime = cfs_rq->min_vruntime;
+ 	rq0_min_vruntime = cpu_rq(0)->cfs.min_vruntime;
+-	spin_unlock_irqrestore(&rq->lock, flags);
++	atomic_spin_unlock_irqrestore(&rq->lock, flags);
+ 	SEQ_printf(m, "  .%-30s: %Ld.%06ld\n", "MIN_vruntime",
+ 			SPLIT_NS(MIN_vruntime));
+ 	SEQ_printf(m, "  .%-30s: %Ld.%06ld\n", "min_vruntime",
+@@ -280,6 +280,19 @@
+ 	P(cpu_load[2]);
+ 	P(cpu_load[3]);
+ 	P(cpu_load[4]);
++#ifdef CONFIG_PREEMPT_RT
++	/* Print rt related rq stats */
++	P(rt.rt_nr_running);
++	P(rt.rt_nr_uninterruptible);
++# ifdef CONFIG_SCHEDSTATS
++	P(rto_schedule);
++	P(rto_schedule_tail);
++	P(rto_wakeup);
++	P(rto_pulled);
++	P(rto_pushed);
++# endif
++#endif
++
+ #undef P
+ #undef PN
+ 
+Index: linux-rt-2.6.31/kernel/sched_fair.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/sched_fair.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/sched_fair.c	2010-05-17 14:23:20.098387185 +0200
+@@ -956,7 +956,8 @@
+  * increased. Here we update the fair scheduling stats and
+  * then put the task into the rbtree:
+  */
+-static void enqueue_task_fair(struct rq *rq, struct task_struct *p, int wakeup)
++static void
++enqueue_task_fair(struct rq *rq, struct task_struct *p, int wakeup, bool head)
+ {
+ 	struct cfs_rq *cfs_rq;
+ 	struct sched_entity *se = &p->se;
+@@ -1040,39 +1041,58 @@
+ 	se->vruntime = rightmost->vruntime + 1;
+ }
+ 
++#if defined(ARCH_HAS_SCHED_WAKE_IDLE)
++/*
++ * At POWERSAVINGS_BALANCE_WAKEUP level, if both this_cpu and prev_cpu
++ * are idle and this is not a kernel thread and this task's affinity
++ * allows it to be moved to preferred cpu, then just move!
++ *
++ * XXX - can generate significant overload on perferred_wakeup_cpu
++ *       with plenty of idle cpus, leading to a significant loss in
++ *       throughput.
++ *
++ * Returns: <  0 - no placement decision made
++ *          >= 0 - place on cpu
++ */
++static int wake_idle_power_save(int cpu, struct task_struct *p)
++{
++	int this_cpu = smp_processor_id();
++	int wakeup_cpu;
++
++	if (sched_mc_power_savings < POWERSAVINGS_BALANCE_WAKEUP)
++		return -1;
++
++	if (!idle_cpu(cpu) || !idle_cpu(this_cpu))
++		return -1;
++
++	if (!p->mm || (p->flags & PF_KTHREAD))
++		return -1;
++
++	wakeup_cpu = cpu_rq(this_cpu)->rd->sched_mc_preferred_wakeup_cpu;
++
++	if (!cpu_isset(wakeup_cpu, p->cpus_allowed))
++		return -1;
++
++	return wakeup_cpu;
++}
++
+ /*
+  * wake_idle() will wake a task on an idle cpu if task->cpu is
+  * not idle and an idle cpu is available.  The span of cpus to
+  * search starts with cpus closest then further out as needed,
+  * so we always favor a closer, idle cpu.
+- * Domains may include CPUs that are not usable for migration,
+- * hence we need to mask them out (cpu_active_mask)
+  *
+  * Returns the CPU we should wake onto.
+  */
+-#if defined(ARCH_HAS_SCHED_WAKE_IDLE)
+ static int wake_idle(int cpu, struct task_struct *p)
+ {
+-	struct sched_domain *sd;
++	struct rq *task_rq = task_rq(p);
++	struct sched_domain *sd, *child = NULL;
+ 	int i;
+-	unsigned int chosen_wakeup_cpu;
+-	int this_cpu;
+-
+-	/*
+-	 * At POWERSAVINGS_BALANCE_WAKEUP level, if both this_cpu and prev_cpu
+-	 * are idle and this is not a kernel thread and this task's affinity
+-	 * allows it to be moved to preferred cpu, then just move!
+-	 */
+-
+-	this_cpu = smp_processor_id();
+-	chosen_wakeup_cpu =
+-		cpu_rq(this_cpu)->rd->sched_mc_preferred_wakeup_cpu;
+ 
+-	if (sched_mc_power_savings >= POWERSAVINGS_BALANCE_WAKEUP &&
+-		idle_cpu(cpu) && idle_cpu(this_cpu) &&
+-		p->mm && !(p->flags & PF_KTHREAD) &&
+-		cpu_isset(chosen_wakeup_cpu, p->cpus_allowed))
+-		return chosen_wakeup_cpu;
++	i = wake_idle_power_save(cpu, p);
++	if (i >= 0)
++		return i;
+ 
+ 	/*
+ 	 * If it is idle, then it is the best cpu to run this task.
+@@ -1081,29 +1101,39 @@
+ 	 * Siblings must be also busy(in most cases) as they didn't already
+ 	 * pickup the extra load from this cpu and hence we need not check
+ 	 * sibling runqueue info. This will avoid the checks and cache miss
+-	 * penalities associated with that.
++	 * penalties associated with that.
+ 	 */
+ 	if (idle_cpu(cpu) || cpu_rq(cpu)->cfs.nr_running > 1)
+ 		return cpu;
+ 
+-	for_each_domain(cpu, sd) {
+-		if ((sd->flags & SD_WAKE_IDLE)
+-		    || ((sd->flags & SD_WAKE_IDLE_FAR)
+-			&& !task_hot(p, task_rq(p)->clock, sd))) {
+-			for_each_cpu_and(i, sched_domain_span(sd),
+-					 &p->cpus_allowed) {
+-				if (cpu_active(i) && idle_cpu(i)) {
+-					if (i != task_cpu(p)) {
+-						schedstat_inc(p,
+-						       se.nr_wakeups_idle);
+-					}
+-					return i;
+-				}
+-			}
+-		} else {
++	rcu_read_lock();
++ 	for_each_domain(cpu, sd) {
++		if (!(sd->flags & SD_LOAD_BALANCE))
++ 			break;
++
++		if (!(sd->flags & SD_WAKE_IDLE) &&
++		    (task_hot(p, task_rq->clock, sd) || !(sd->flags & SD_WAKE_IDLE_FAR)))
+ 			break;
+-		}
+-	}
++
++		for_each_cpu_and(i, sched_domain_span(sd), &p->cpus_allowed) {
++			if (child && cpumask_test_cpu(i, sched_domain_span(child)))
++				continue;
++
++			if (!idle_cpu(i))
++				continue;
++
++			if (task_cpu(p) != i)
++				schedstat_inc(p, se.nr_wakeups_idle);
++
++			cpu = i;
++			goto unlock;
++ 		}
++
++		child = sd;
++ 	}
++unlock:
++	rcu_read_unlock();
++
+ 	return cpu;
+ }
+ #else /* !ARCH_HAS_SCHED_WAKE_IDLE*/
+@@ -1235,7 +1265,17 @@
+ 	tg = task_group(p);
+ 	weight = p->se.load.weight;
+ 
+-	balanced = 100*(tl + effective_load(tg, this_cpu, weight, weight)) <=
++	/*
++	 * In low-load situations, where prev_cpu is idle and this_cpu is idle
++	 * due to the sync cause above having dropped tl to 0, we'll always have
++	 * an imbalance, but there's really nothing you can do about that, so
++	 * that's good too.
++	 *
++	 * Otherwise check if either cpus are near enough in load to allow this
++	 * task to be woken on this_cpu.
++	 */
++	balanced = !tl ||
++		100*(tl + effective_load(tg, this_cpu, weight, weight)) <=
+ 		imbalance*(load + effective_load(tg, prev_cpu, 0, weight));
+ 
+ 	/*
+@@ -1734,7 +1774,7 @@
+ 		resched_task(rq->curr);
+ 	}
+ 
+-	enqueue_task_fair(rq, p, 0);
++	enqueue_task_fair(rq, p, 0, false);
+ }
+ 
+ /*
+Index: linux-rt-2.6.31/kernel/sched_idletask.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/sched_idletask.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/sched_idletask.c	2010-05-17 14:23:20.098387185 +0200
+@@ -34,10 +34,10 @@
+ static void
+ dequeue_task_idle(struct rq *rq, struct task_struct *p, int sleep)
+ {
+-	spin_unlock_irq(&rq->lock);
++	atomic_spin_unlock_irq(&rq->lock);
+ 	printk(KERN_ERR "bad: scheduling from the idle thread!\n");
+ 	dump_stack();
+-	spin_lock_irq(&rq->lock);
++	atomic_spin_lock_irq(&rq->lock);
+ }
+ 
+ static void put_prev_task_idle(struct rq *rq, struct task_struct *prev)
+Index: linux-rt-2.6.31/kernel/sched_rt.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/sched_rt.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/sched_rt.c	2010-05-17 14:23:20.098387185 +0200
+@@ -181,7 +181,7 @@
+ 	return rt_se->my_q;
+ }
+ 
+-static void enqueue_rt_entity(struct sched_rt_entity *rt_se);
++static void enqueue_rt_entity(struct sched_rt_entity *rt_se, bool head);
+ static void dequeue_rt_entity(struct sched_rt_entity *rt_se);
+ 
+ static void sched_rt_rq_enqueue(struct rt_rq *rt_rq)
+@@ -191,7 +191,7 @@
+ 
+ 	if (rt_rq->rt_nr_running) {
+ 		if (rt_se && !on_rt_rq(rt_se))
+-			enqueue_rt_entity(rt_se);
++			enqueue_rt_entity(rt_se, false);
+ 		if (rt_rq->highest_prio.curr < curr->prio)
+ 			resched_task(curr);
+ 	}
+@@ -314,7 +314,7 @@
+ 
+ 	weight = cpumask_weight(rd->span);
+ 
+-	spin_lock(&rt_b->rt_runtime_lock);
++	atomic_spin_lock(&rt_b->rt_runtime_lock);
+ 	rt_period = ktime_to_ns(rt_b->rt_period);
+ 	for_each_cpu(i, rd->span) {
+ 		struct rt_rq *iter = sched_rt_period_rt_rq(rt_b, i);
+@@ -323,7 +323,7 @@
+ 		if (iter == rt_rq)
+ 			continue;
+ 
+-		spin_lock(&iter->rt_runtime_lock);
++		atomic_spin_lock(&iter->rt_runtime_lock);
+ 		/*
+ 		 * Either all rqs have inf runtime and there's nothing to steal
+ 		 * or __disable_runtime() below sets a specific rq to inf to
+@@ -345,14 +345,14 @@
+ 			rt_rq->rt_runtime += diff;
+ 			more = 1;
+ 			if (rt_rq->rt_runtime == rt_period) {
+-				spin_unlock(&iter->rt_runtime_lock);
++				atomic_spin_unlock(&iter->rt_runtime_lock);
+ 				break;
+ 			}
+ 		}
+ next:
+-		spin_unlock(&iter->rt_runtime_lock);
++		atomic_spin_unlock(&iter->rt_runtime_lock);
+ 	}
+-	spin_unlock(&rt_b->rt_runtime_lock);
++	atomic_spin_unlock(&rt_b->rt_runtime_lock);
+ 
+ 	return more;
+ }
+@@ -373,8 +373,8 @@
+ 		s64 want;
+ 		int i;
+ 
+-		spin_lock(&rt_b->rt_runtime_lock);
+-		spin_lock(&rt_rq->rt_runtime_lock);
++		atomic_spin_lock(&rt_b->rt_runtime_lock);
++		atomic_spin_lock(&rt_rq->rt_runtime_lock);
+ 		/*
+ 		 * Either we're all inf and nobody needs to borrow, or we're
+ 		 * already disabled and thus have nothing to do, or we have
+@@ -383,7 +383,7 @@
+ 		if (rt_rq->rt_runtime == RUNTIME_INF ||
+ 				rt_rq->rt_runtime == rt_b->rt_runtime)
+ 			goto balanced;
+-		spin_unlock(&rt_rq->rt_runtime_lock);
++		atomic_spin_unlock(&rt_rq->rt_runtime_lock);
+ 
+ 		/*
+ 		 * Calculate the difference between what we started out with
+@@ -405,7 +405,7 @@
+ 			if (iter == rt_rq || iter->rt_runtime == RUNTIME_INF)
+ 				continue;
+ 
+-			spin_lock(&iter->rt_runtime_lock);
++			atomic_spin_lock(&iter->rt_runtime_lock);
+ 			if (want > 0) {
+ 				diff = min_t(s64, iter->rt_runtime, want);
+ 				iter->rt_runtime -= diff;
+@@ -414,13 +414,13 @@
+ 				iter->rt_runtime -= want;
+ 				want -= want;
+ 			}
+-			spin_unlock(&iter->rt_runtime_lock);
++			atomic_spin_unlock(&iter->rt_runtime_lock);
+ 
+ 			if (!want)
+ 				break;
+ 		}
+ 
+-		spin_lock(&rt_rq->rt_runtime_lock);
++		atomic_spin_lock(&rt_rq->rt_runtime_lock);
+ 		/*
+ 		 * We cannot be left wanting - that would mean some runtime
+ 		 * leaked out of the system.
+@@ -432,8 +432,8 @@
+ 		 * runtime - in which case borrowing doesn't make sense.
+ 		 */
+ 		rt_rq->rt_runtime = RUNTIME_INF;
+-		spin_unlock(&rt_rq->rt_runtime_lock);
+-		spin_unlock(&rt_b->rt_runtime_lock);
++		atomic_spin_unlock(&rt_rq->rt_runtime_lock);
++		atomic_spin_unlock(&rt_b->rt_runtime_lock);
+ 	}
+ }
+ 
+@@ -441,9 +441,9 @@
+ {
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&rq->lock, flags);
++	atomic_spin_lock_irqsave(&rq->lock, flags);
+ 	__disable_runtime(rq);
+-	spin_unlock_irqrestore(&rq->lock, flags);
++	atomic_spin_unlock_irqrestore(&rq->lock, flags);
+ }
+ 
+ static void __enable_runtime(struct rq *rq)
+@@ -459,13 +459,13 @@
+ 	for_each_leaf_rt_rq(rt_rq, rq) {
+ 		struct rt_bandwidth *rt_b = sched_rt_bandwidth(rt_rq);
+ 
+-		spin_lock(&rt_b->rt_runtime_lock);
+-		spin_lock(&rt_rq->rt_runtime_lock);
++		atomic_spin_lock(&rt_b->rt_runtime_lock);
++		atomic_spin_lock(&rt_rq->rt_runtime_lock);
+ 		rt_rq->rt_runtime = rt_b->rt_runtime;
+ 		rt_rq->rt_time = 0;
+ 		rt_rq->rt_throttled = 0;
+-		spin_unlock(&rt_rq->rt_runtime_lock);
+-		spin_unlock(&rt_b->rt_runtime_lock);
++		atomic_spin_unlock(&rt_rq->rt_runtime_lock);
++		atomic_spin_unlock(&rt_b->rt_runtime_lock);
+ 	}
+ }
+ 
+@@ -473,9 +473,9 @@
+ {
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&rq->lock, flags);
++	atomic_spin_lock_irqsave(&rq->lock, flags);
+ 	__enable_runtime(rq);
+-	spin_unlock_irqrestore(&rq->lock, flags);
++	atomic_spin_unlock_irqrestore(&rq->lock, flags);
+ }
+ 
+ static int balance_runtime(struct rt_rq *rt_rq)
+@@ -483,9 +483,9 @@
+ 	int more = 0;
+ 
+ 	if (rt_rq->rt_time > rt_rq->rt_runtime) {
+-		spin_unlock(&rt_rq->rt_runtime_lock);
++		atomic_spin_unlock(&rt_rq->rt_runtime_lock);
+ 		more = do_balance_runtime(rt_rq);
+-		spin_lock(&rt_rq->rt_runtime_lock);
++		atomic_spin_lock(&rt_rq->rt_runtime_lock);
+ 	}
+ 
+ 	return more;
+@@ -511,11 +511,11 @@
+ 		struct rt_rq *rt_rq = sched_rt_period_rt_rq(rt_b, i);
+ 		struct rq *rq = rq_of_rt_rq(rt_rq);
+ 
+-		spin_lock(&rq->lock);
++		atomic_spin_lock(&rq->lock);
+ 		if (rt_rq->rt_time) {
+ 			u64 runtime;
+ 
+-			spin_lock(&rt_rq->rt_runtime_lock);
++			atomic_spin_lock(&rt_rq->rt_runtime_lock);
+ 			if (rt_rq->rt_throttled)
+ 				balance_runtime(rt_rq);
+ 			runtime = rt_rq->rt_runtime;
+@@ -526,13 +526,13 @@
+ 			}
+ 			if (rt_rq->rt_time || rt_rq->rt_nr_running)
+ 				idle = 0;
+-			spin_unlock(&rt_rq->rt_runtime_lock);
++			atomic_spin_unlock(&rt_rq->rt_runtime_lock);
+ 		} else if (rt_rq->rt_nr_running)
+ 			idle = 0;
+ 
+ 		if (enqueue)
+ 			sched_rt_rq_enqueue(rt_rq);
+-		spin_unlock(&rq->lock);
++		atomic_spin_unlock(&rq->lock);
+ 	}
+ 
+ 	return idle;
+@@ -602,6 +602,8 @@
+ 	curr->se.exec_start = rq->clock;
+ 	cpuacct_charge(curr, delta_exec);
+ 
++	sched_rt_avg_update(rq, delta_exec);
++
+ 	if (!rt_bandwidth_enabled())
+ 		return;
+ 
+@@ -609,11 +611,11 @@
+ 		rt_rq = rt_rq_of_se(rt_se);
+ 
+ 		if (sched_rt_runtime(rt_rq) != RUNTIME_INF) {
+-			spin_lock(&rt_rq->rt_runtime_lock);
++			atomic_spin_lock(&rt_rq->rt_runtime_lock);
+ 			rt_rq->rt_time += delta_exec;
+ 			if (sched_rt_runtime_exceeded(rt_rq))
+ 				resched_task(curr);
+-			spin_unlock(&rt_rq->rt_runtime_lock);
++			atomic_spin_unlock(&rt_rq->rt_runtime_lock);
+ 		}
+ 	}
+ }
+@@ -788,7 +790,7 @@
+ 	dec_rt_group(rt_se, rt_rq);
+ }
+ 
+-static void __enqueue_rt_entity(struct sched_rt_entity *rt_se)
++static void __enqueue_rt_entity(struct sched_rt_entity *rt_se, bool head)
+ {
+ 	struct rt_rq *rt_rq = rt_rq_of_se(rt_se);
+ 	struct rt_prio_array *array = &rt_rq->active;
+@@ -804,7 +806,10 @@
+ 	if (group_rq && (rt_rq_throttled(group_rq) || !group_rq->rt_nr_running))
+ 		return;
+ 
+-	list_add_tail(&rt_se->run_list, queue);
++	if (head)
++		list_add(&rt_se->run_list, queue);
++	else
++		list_add_tail(&rt_se->run_list, queue);
+ 	__set_bit(rt_se_prio(rt_se), array->bitmap);
+ 
+ 	inc_rt_tasks(rt_se, rt_rq);
+@@ -841,11 +846,11 @@
+ 	}
+ }
+ 
+-static void enqueue_rt_entity(struct sched_rt_entity *rt_se)
++static void enqueue_rt_entity(struct sched_rt_entity *rt_se, bool head)
+ {
+ 	dequeue_rt_stack(rt_se);
+ 	for_each_sched_rt_entity(rt_se)
+-		__enqueue_rt_entity(rt_se);
++		__enqueue_rt_entity(rt_se, head);
+ }
+ 
+ static void dequeue_rt_entity(struct sched_rt_entity *rt_se)
+@@ -856,26 +861,77 @@
+ 		struct rt_rq *rt_rq = group_rt_rq(rt_se);
+ 
+ 		if (rt_rq && rt_rq->rt_nr_running)
+-			__enqueue_rt_entity(rt_se);
++			__enqueue_rt_entity(rt_se, false);
+ 	}
+ }
+ 
++static inline void incr_rt_nr_uninterruptible(struct task_struct *p,
++					      struct rq *rq)
++{
++	rq->rt.rt_nr_uninterruptible++;
++}
++
++static inline void decr_rt_nr_uninterruptible(struct task_struct *p,
++					      struct rq *rq)
++{
++	rq->rt.rt_nr_uninterruptible--;
++}
++
++unsigned long rt_nr_running(void)
++{
++	unsigned long i, sum = 0;
++
++	for_each_online_cpu(i)
++		sum += cpu_rq(i)->rt.rt_nr_running;
++
++	return sum;
++}
++
++unsigned long rt_nr_running_cpu(int cpu)
++{
++	return cpu_rq(cpu)->rt.rt_nr_running;
++}
++
++unsigned long rt_nr_uninterruptible(void)
++{
++	unsigned long i, sum = 0;
++
++	for_each_online_cpu(i)
++		sum += cpu_rq(i)->rt.rt_nr_uninterruptible;
++
++	/*
++	 * Since we read the counters lockless, it might be slightly
++	 * inaccurate. Do not allow it to go below zero though:
++	 */
++	if (unlikely((long)sum < 0))
++		sum = 0;
++
++	return sum;
++}
++
++unsigned long rt_nr_uninterruptible_cpu(int cpu)
++{
++	return cpu_rq(cpu)->rt.rt_nr_uninterruptible;
++}
++
+ /*
+  * Adding/removing a task to/from a priority array:
+  */
+-static void enqueue_task_rt(struct rq *rq, struct task_struct *p, int wakeup)
++static void
++enqueue_task_rt(struct rq *rq, struct task_struct *p, int wakeup, bool head)
+ {
+ 	struct sched_rt_entity *rt_se = &p->rt;
+ 
+ 	if (wakeup)
+ 		rt_se->timeout = 0;
+ 
+-	enqueue_rt_entity(rt_se);
++	enqueue_rt_entity(rt_se, head);
++
++	if (p->state == TASK_UNINTERRUPTIBLE)
++		decr_rt_nr_uninterruptible(p, rq);
+ 
+ 	if (!task_current(rq, p) && p->rt.nr_cpus_allowed > 1)
+ 		enqueue_pushable_task(rq, p);
+-
+-	inc_cpu_load(rq, p->se.load.weight);
+ }
+ 
+ static void dequeue_task_rt(struct rq *rq, struct task_struct *p, int sleep)
+@@ -883,11 +939,13 @@
+ 	struct sched_rt_entity *rt_se = &p->rt;
+ 
+ 	update_curr_rt(rq);
++
++	if (p->state == TASK_UNINTERRUPTIBLE)
++		incr_rt_nr_uninterruptible(p, rq);
++
+ 	dequeue_rt_entity(rt_se);
+ 
+ 	dequeue_pushable_task(rq, p);
+-
+-	dec_cpu_load(rq, p->se.load.weight);
+ }
+ 
+ /*
+@@ -956,6 +1014,17 @@
+ 	}
+ 
+ 	/*
++	 * If the new task is an RT task, current is not an RT task
++	 * and the new one may run on the current CPU, run it here.
++	 * This avoids sending reschedule IPIs across CPUs.
++	 */
++	if (unlikely(rt_task(p)) && !rt_task(rq->curr)) {
++		int cpu = smp_processor_id();
++		if (cpumask_test_cpu(cpu, &p->cpus_allowed))
++			return cpu;
++	}
++
++	/*
+ 	 * Otherwise, just let it ride on the affined RQ and the
+ 	 * post-schedule router will push the preempted task away
+ 	 */
+@@ -1244,7 +1313,7 @@
+ 				     task_running(rq, task) ||
+ 				     !task->se.on_rq)) {
+ 
+-				spin_unlock(&lowest_rq->lock);
++				atomic_spin_unlock(&lowest_rq->lock);
+ 				lowest_rq = NULL;
+ 				break;
+ 			}
+@@ -1361,7 +1430,7 @@
+ 
+ 	deactivate_task(rq, next_task, 0);
+ 	set_task_cpu(next_task, lowest_rq->cpu);
+-	activate_task(lowest_rq, next_task, 0);
++	activate_task(lowest_rq, next_task, 0, false);
+ 
+ 	resched_task(lowest_rq->curr);
+ 
+@@ -1444,7 +1513,7 @@
+ 
+ 			deactivate_task(src_rq, p, 0);
+ 			set_task_cpu(p, this_cpu);
+-			activate_task(this_rq, p, 0);
++			activate_task(this_rq, p, 0, false);
+ 			/*
+ 			 * We continue with the search, just in
+ 			 * case there's an even higher prio task
+@@ -1462,8 +1531,10 @@
+ static void pre_schedule_rt(struct rq *rq, struct task_struct *prev)
+ {
+ 	/* Try to pull RT tasks here if we lower this rq's prio */
+-	if (unlikely(rt_task(prev)) && rq->rt.highest_prio.curr > prev->prio)
++	if (unlikely(rt_task(prev)) && rq->rt.highest_prio.curr > prev->prio) {
+ 		pull_rt_task(rq);
++		schedstat_inc(rq, rto_schedule);
++	}
+ }
+ 
+ /*
+@@ -1476,13 +1547,15 @@
+ 
+ static void post_schedule_rt(struct rq *rq)
+ {
++	unsigned long flags;
++
+ 	/*
+ 	 * This is only called if needs_post_schedule_rt() indicates that
+ 	 * we need to push tasks away
+ 	 */
+-	spin_lock_irq(&rq->lock);
++	atomic_spin_lock_irqsave(&rq->lock, flags);
+ 	push_rt_tasks(rq);
+-	spin_unlock_irq(&rq->lock);
++	atomic_spin_unlock_irqrestore(&rq->lock, flags);
+ }
+ 
+ /*
+@@ -1545,7 +1618,6 @@
+ 			 */
+ 			if (weight > 1)
+ 				enqueue_pushable_task(rq, p);
+-
+ 		}
+ 
+ 		if ((p->rt.nr_cpus_allowed <= 1) && (weight > 1)) {
+Index: linux-rt-2.6.31/kernel/sched_stats.h
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/sched_stats.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/sched_stats.h	2010-05-17 14:23:20.098387185 +0200
+@@ -306,10 +306,10 @@
+ 	if (!cputimer->running)
+ 		return;
+ 
+-	spin_lock(&cputimer->lock);
++	atomic_spin_lock(&cputimer->lock);
+ 	cputimer->cputime.utime =
+ 		cputime_add(cputimer->cputime.utime, cputime);
+-	spin_unlock(&cputimer->lock);
++	atomic_spin_unlock(&cputimer->lock);
+ }
+ 
+ /**
+@@ -336,10 +336,10 @@
+ 	if (!cputimer->running)
+ 		return;
+ 
+-	spin_lock(&cputimer->lock);
++	atomic_spin_lock(&cputimer->lock);
+ 	cputimer->cputime.stime =
+ 		cputime_add(cputimer->cputime.stime, cputime);
+-	spin_unlock(&cputimer->lock);
++	atomic_spin_unlock(&cputimer->lock);
+ }
+ 
+ /**
+@@ -369,7 +369,7 @@
+ 	if (!cputimer->running)
+ 		return;
+ 
+-	spin_lock(&cputimer->lock);
++	atomic_spin_lock(&cputimer->lock);
+ 	cputimer->cputime.sum_exec_runtime += ns;
+-	spin_unlock(&cputimer->lock);
++	atomic_spin_unlock(&cputimer->lock);
+ }
+Index: linux-rt-2.6.31/kernel/semaphore.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/semaphore.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/semaphore.c	2010-05-17 14:23:20.098387185 +0200
+@@ -33,11 +33,11 @@
+ #include <linux/spinlock.h>
+ #include <linux/ftrace.h>
+ 
+-static noinline void __down(struct semaphore *sem);
+-static noinline int __down_interruptible(struct semaphore *sem);
+-static noinline int __down_killable(struct semaphore *sem);
+-static noinline int __down_timeout(struct semaphore *sem, long jiffies);
+-static noinline void __up(struct semaphore *sem);
++static noinline void __down(struct anon_semaphore *sem);
++static noinline int __down_interruptible(struct anon_semaphore *sem);
++static noinline int __down_killable(struct anon_semaphore *sem);
++static noinline int __down_timeout(struct anon_semaphore *sem, long jiffies);
++static noinline void __up(struct anon_semaphore *sem);
+ 
+ /**
+  * down - acquire the semaphore
+@@ -50,7 +50,7 @@
+  * Use of this function is deprecated, please use down_interruptible() or
+  * down_killable() instead.
+  */
+-void down(struct semaphore *sem)
++void anon_down(struct anon_semaphore *sem)
+ {
+ 	unsigned long flags;
+ 
+@@ -61,7 +61,7 @@
+ 		__down(sem);
+ 	spin_unlock_irqrestore(&sem->lock, flags);
+ }
+-EXPORT_SYMBOL(down);
++EXPORT_SYMBOL(anon_down);
+ 
+ /**
+  * down_interruptible - acquire the semaphore unless interrupted
+@@ -72,7 +72,7 @@
+  * If the sleep is interrupted by a signal, this function will return -EINTR.
+  * If the semaphore is successfully acquired, this function returns 0.
+  */
+-int down_interruptible(struct semaphore *sem)
++int anon_down_interruptible(struct anon_semaphore *sem)
+ {
+ 	unsigned long flags;
+ 	int result = 0;
+@@ -86,7 +86,7 @@
+ 
+ 	return result;
+ }
+-EXPORT_SYMBOL(down_interruptible);
++EXPORT_SYMBOL(anon_down_interruptible);
+ 
+ /**
+  * down_killable - acquire the semaphore unless killed
+@@ -98,7 +98,7 @@
+  * -EINTR.  If the semaphore is successfully acquired, this function returns
+  * 0.
+  */
+-int down_killable(struct semaphore *sem)
++int anon_down_killable(struct anon_semaphore *sem)
+ {
+ 	unsigned long flags;
+ 	int result = 0;
+@@ -112,7 +112,7 @@
+ 
+ 	return result;
+ }
+-EXPORT_SYMBOL(down_killable);
++EXPORT_SYMBOL(anon_down_killable);
+ 
+ /**
+  * down_trylock - try to acquire the semaphore, without waiting
+@@ -127,7 +127,7 @@
+  * Unlike mutex_trylock, this function can be used from interrupt context,
+  * and the semaphore can be released by any task or interrupt.
+  */
+-int down_trylock(struct semaphore *sem)
++int anon_down_trylock(struct anon_semaphore *sem)
+ {
+ 	unsigned long flags;
+ 	int count;
+@@ -140,7 +140,7 @@
+ 
+ 	return (count < 0);
+ }
+-EXPORT_SYMBOL(down_trylock);
++EXPORT_SYMBOL(anon_down_trylock);
+ 
+ /**
+  * down_timeout - acquire the semaphore within a specified time
+@@ -152,7 +152,7 @@
+  * If the semaphore is not released within the specified number of jiffies,
+  * this function returns -ETIME.  It returns 0 if the semaphore was acquired.
+  */
+-int down_timeout(struct semaphore *sem, long jiffies)
++int anon_down_timeout(struct anon_semaphore *sem, long jiffies)
+ {
+ 	unsigned long flags;
+ 	int result = 0;
+@@ -166,7 +166,7 @@
+ 
+ 	return result;
+ }
+-EXPORT_SYMBOL(down_timeout);
++EXPORT_SYMBOL(anon_down_timeout);
+ 
+ /**
+  * up - release the semaphore
+@@ -175,7 +175,7 @@
+  * Release the semaphore.  Unlike mutexes, up() may be called from any
+  * context and even by tasks which have never called down().
+  */
+-void up(struct semaphore *sem)
++void anon_up(struct anon_semaphore *sem)
+ {
+ 	unsigned long flags;
+ 
+@@ -186,7 +186,7 @@
+ 		__up(sem);
+ 	spin_unlock_irqrestore(&sem->lock, flags);
+ }
+-EXPORT_SYMBOL(up);
++EXPORT_SYMBOL(anon_up);
+ 
+ /* Functions for the contended case */
+ 
+@@ -201,7 +201,7 @@
+  * constant, and thus optimised away by the compiler.  Likewise the
+  * 'timeout' parameter for the cases without timeouts.
+  */
+-static inline int __sched __down_common(struct semaphore *sem, long state,
++static inline int __sched __down_common(struct anon_semaphore *sem, long state,
+ 								long timeout)
+ {
+ 	struct task_struct *task = current;
+@@ -233,27 +233,27 @@
+ 	return -EINTR;
+ }
+ 
+-static noinline void __sched __down(struct semaphore *sem)
++static noinline void __sched __down(struct anon_semaphore *sem)
+ {
+ 	__down_common(sem, TASK_UNINTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT);
+ }
+ 
+-static noinline int __sched __down_interruptible(struct semaphore *sem)
++static noinline int __sched __down_interruptible(struct anon_semaphore *sem)
+ {
+ 	return __down_common(sem, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT);
+ }
+ 
+-static noinline int __sched __down_killable(struct semaphore *sem)
++static noinline int __sched __down_killable(struct anon_semaphore *sem)
+ {
+ 	return __down_common(sem, TASK_KILLABLE, MAX_SCHEDULE_TIMEOUT);
+ }
+ 
+-static noinline int __sched __down_timeout(struct semaphore *sem, long jiffies)
++static noinline int __sched __down_timeout(struct anon_semaphore *sem, long jiffies)
+ {
+ 	return __down_common(sem, TASK_UNINTERRUPTIBLE, jiffies);
+ }
+ 
+-static noinline void __sched __up(struct semaphore *sem)
++static noinline void __sched __up(struct anon_semaphore *sem)
+ {
+ 	struct semaphore_waiter *waiter = list_first_entry(&sem->wait_list,
+ 						struct semaphore_waiter, list);
+Index: linux-rt-2.6.31/kernel/signal.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/signal.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/kernel/signal.c	2010-05-17 14:23:20.098387185 +0200
+@@ -188,29 +188,66 @@
+ 	return sig;
+ }
+ 
++#ifdef __HAVE_ARCH_CMPXCHG
++static inline struct sigqueue *get_task_cache(struct task_struct *t)
++{
++	struct sigqueue *q = t->sigqueue_cache;
++
++	if (cmpxchg(&t->sigqueue_cache, q, NULL) != q)
++		return NULL;
++
++	return q;
++}
++
++static inline int put_task_cache(struct task_struct *t, struct sigqueue *q)
++{
++	if (cmpxchg(&t->sigqueue_cache, NULL, q) == NULL)
++		return 0;
++
++	return 1;
++}
++
++#else
++
++static inline struct sigqueue *get_task_cache(struct task_struct *t)
++{
++	return NULL;
++}
++
++static inline int put_task_cache(struct task_struct *t, struct sigqueue *q)
++{
++	return 1;
++}
++
++#endif
++
+ /*
+  * allocate a new signal queue record
+  * - this may be called without locks if and only if t == current, otherwise an
+  *   appopriate lock must be held to stop the target task from exiting
+  */
+-static struct sigqueue *__sigqueue_alloc(struct task_struct *t, gfp_t flags,
+-					 int override_rlimit)
++static struct sigqueue *__sigqueue_do_alloc(struct task_struct *t, gfp_t flags,
++					    int override_rlimit, int fromslab)
+ {
+ 	struct sigqueue *q = NULL;
+ 	struct user_struct *user;
+ 
+-	/*
+-	 * We won't get problems with the target's UID changing under us
+-	 * because changing it requires RCU be used, and if t != current, the
+-	 * caller must be holding the RCU readlock (by way of a spinlock) and
+-	 * we use RCU protection here
+-	 */
++	rcu_read_lock();
+ 	user = get_uid(__task_cred(t)->user);
++	rcu_read_unlock();
++
+ 	atomic_inc(&user->sigpending);
++
+ 	if (override_rlimit ||
+ 	    atomic_read(&user->sigpending) <=
+-			t->signal->rlim[RLIMIT_SIGPENDING].rlim_cur)
+-		q = kmem_cache_alloc(sigqueue_cachep, flags);
++	    t->signal->rlim[RLIMIT_SIGPENDING].rlim_cur) {
++
++		if (!fromslab)
++			q = get_task_cache(t);
++		if (!q)
++			q = kmem_cache_alloc(sigqueue_cachep, flags);
++	}
++
+ 	if (unlikely(q == NULL)) {
+ 		atomic_dec(&user->sigpending);
+ 		free_uid(user);
+@@ -223,6 +260,12 @@
+ 	return q;
+ }
+ 
++static struct sigqueue *__sigqueue_alloc(struct task_struct *t, gfp_t flags,
++					 int override_rlimit)
++{
++	return __sigqueue_do_alloc(t, flags, override_rlimit, 0);
++}
++
+ static void __sigqueue_free(struct sigqueue *q)
+ {
+ 	if (q->flags & SIGQUEUE_PREALLOC)
+@@ -232,6 +275,21 @@
+ 	kmem_cache_free(sigqueue_cachep, q);
+ }
+ 
++static void sigqueue_free_current(struct sigqueue *q)
++{
++	struct user_struct *up;
++
++	if (q->flags & SIGQUEUE_PREALLOC)
++		return;
++
++	up = q->user;
++	if (rt_prio(current->normal_prio) && !put_task_cache(current, q)) {
++		atomic_dec(&up->sigpending);
++		free_uid(up);
++	} else
++		  __sigqueue_free(q);
++}
++
+ void flush_sigqueue(struct sigpending *queue)
+ {
+ 	struct sigqueue *q;
+@@ -245,6 +303,21 @@
+ }
+ 
+ /*
++ * Called from __exit_signal. Flush tsk->pending and
++ * tsk->sigqueue_cache
++ */
++void flush_task_sigqueue(struct task_struct *tsk)
++{
++	struct sigqueue *q;
++
++	flush_sigqueue(&tsk->pending);
++
++	q = get_task_cache(tsk);
++	if (q)
++		kmem_cache_free(sigqueue_cachep, q);
++}
++
++/*
+  * Flush all pending signals for a task.
+  */
+ void __flush_signals(struct task_struct *t)
+@@ -392,7 +465,7 @@
+ still_pending:
+ 		list_del_init(&first->list);
+ 		copy_siginfo(info, &first->info);
+-		__sigqueue_free(first);
++		sigqueue_free_current(first);
+ 	} else {
+ 		/* Ok, it wasn't in the queue.  This must be
+ 		   a fast-pathed signal or we must have been
+@@ -437,6 +510,8 @@
+ {
+ 	int signr;
+ 
++	WARN_ON_ONCE(tsk != current);
++
+ 	/* We only dequeue private signals from ourselves, we don't let
+ 	 * signalfd steal them
+ 	 */
+@@ -519,6 +594,9 @@
+ 
+ 	set_tsk_thread_flag(t, TIF_SIGPENDING);
+ 
++	if (unlikely(t == current))
++		return;
++
+ 	/*
+ 	 * For SIGKILL, we want to wake it up in the stopped/traced/killable
+ 	 * case. We don't check t->state here because there is a race with it
+@@ -836,8 +914,9 @@
+ 
+ 	trace_sched_signal_send(sig, t);
+ 
++#ifdef CONFIG_SMP
+ 	assert_spin_locked(&t->sighand->siglock);
+-
++#endif
+ 	if (!prepare_signal(sig, t, from_ancestor_ns))
+ 		return 0;
+ 
+@@ -914,7 +993,7 @@
+ static int send_signal(int sig, struct siginfo *info, struct task_struct *t,
+ 			int group)
+ {
+-	int from_ancestor_ns = 0;
++	int ret, from_ancestor_ns = 0;
+ 
+ #ifdef CONFIG_PID_NS
+ 	if (!is_si_special(info) && SI_FROMUSER(info) &&
+@@ -1146,11 +1225,12 @@
+ 	int ret = -EINVAL;
+ 	struct task_struct *p;
+ 	const struct cred *pcred;
++	unsigned long flags;
+ 
+ 	if (!valid_signal(sig))
+ 		return ret;
+ 
+-	read_lock(&tasklist_lock);
++	rcu_read_lock();
+ 	p = pid_task(pid, PIDTYPE_PID);
+ 	if (!p) {
+ 		ret = -ESRCH;
+@@ -1167,14 +1247,16 @@
+ 	ret = security_task_kill(p, info, sig, secid);
+ 	if (ret)
+ 		goto out_unlock;
+-	if (sig && p->sighand) {
+-		unsigned long flags;
+-		spin_lock_irqsave(&p->sighand->siglock, flags);
+-		ret = __send_signal(sig, info, p, 1, 0);
+-		spin_unlock_irqrestore(&p->sighand->siglock, flags);
++
++	if (sig) {
++		if (lock_task_sighand(p, &flags)) {
++			ret = __send_signal(sig, info, p, 1, 0);
++			unlock_task_sighand(p, &flags);
++		} else
++			ret = -ESRCH;
+ 	}
+ out_unlock:
+-	read_unlock(&tasklist_lock);
++	rcu_read_unlock();
+ 	return ret;
+ }
+ EXPORT_SYMBOL_GPL(kill_pid_info_as_uid);
+@@ -1313,7 +1395,8 @@
+ {
+ 	struct sigqueue *q;
+ 
+-	if ((q = __sigqueue_alloc(current, GFP_KERNEL, 0)))
++	/* Preallocated sigqueue objects always from the slabcache ! */
++	if ((q = __sigqueue_do_alloc(current, GFP_KERNEL, 0, 1)))
+ 		q->flags |= SIGQUEUE_PREALLOC;
+ 	return(q);
+ }
+@@ -1612,15 +1695,7 @@
+ 	read_lock(&tasklist_lock);
+ 	if (may_ptrace_stop()) {
+ 		do_notify_parent_cldstop(current, CLD_TRAPPED);
+-		/*
+-		 * Don't want to allow preemption here, because
+-		 * sys_ptrace() needs this task to be inactive.
+-		 *
+-		 * XXX: implement read_unlock_no_resched().
+-		 */
+-		preempt_disable();
+ 		read_unlock(&tasklist_lock);
+-		preempt_enable_no_resched();
+ 		schedule();
+ 	} else {
+ 		/*
+Index: linux-rt-2.6.31/kernel/smp.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/smp.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/smp.c	2010-05-17 14:23:20.098387185 +0200
+@@ -16,11 +16,11 @@
+ 
+ static struct {
+ 	struct list_head	queue;
+-	spinlock_t		lock;
++	atomic_spinlock_t	lock;
+ } call_function __cacheline_aligned_in_smp =
+ 	{
+-		.queue		= LIST_HEAD_INIT(call_function.queue),
+-		.lock		= __SPIN_LOCK_UNLOCKED(call_function.lock),
++		.queue	= LIST_HEAD_INIT(call_function.queue),
++		.lock	= __ATOMIC_SPIN_LOCK_UNLOCKED(call_function.lock),
+ 	};
+ 
+ enum {
+@@ -29,18 +29,18 @@
+ 
+ struct call_function_data {
+ 	struct call_single_data	csd;
+-	spinlock_t		lock;
++	atomic_spinlock_t	lock;
+ 	unsigned int		refs;
+ 	cpumask_var_t		cpumask;
+ };
+ 
+ struct call_single_queue {
+ 	struct list_head	list;
+-	spinlock_t		lock;
++	atomic_spinlock_t	lock;
+ };
+ 
+ static DEFINE_PER_CPU(struct call_function_data, cfd_data) = {
+-	.lock			= __SPIN_LOCK_UNLOCKED(cfd_data.lock),
++	.lock			= __ATOMIC_SPIN_LOCK_UNLOCKED(cfd_data.lock),
+ };
+ 
+ static int
+@@ -83,7 +83,7 @@
+ 	for_each_possible_cpu(i) {
+ 		struct call_single_queue *q = &per_cpu(call_single_queue, i);
+ 
+-		spin_lock_init(&q->lock);
++		atomic_spin_lock_init(&q->lock);
+ 		INIT_LIST_HEAD(&q->list);
+ 	}
+ 
+@@ -144,10 +144,10 @@
+ 	unsigned long flags;
+ 	int ipi;
+ 
+-	spin_lock_irqsave(&dst->lock, flags);
++	atomic_spin_lock_irqsave(&dst->lock, flags);
+ 	ipi = list_empty(&dst->list);
+ 	list_add_tail(&data->list, &dst->list);
+-	spin_unlock_irqrestore(&dst->lock, flags);
++	atomic_spin_unlock_irqrestore(&dst->lock, flags);
+ 
+ 	/*
+ 	 * The list addition should be visible before sending the IPI
+@@ -191,25 +191,25 @@
+ 	list_for_each_entry_rcu(data, &call_function.queue, csd.list) {
+ 		int refs;
+ 
+-		spin_lock(&data->lock);
++		atomic_spin_lock(&data->lock);
+ 		if (!cpumask_test_cpu(cpu, data->cpumask)) {
+-			spin_unlock(&data->lock);
++			atomic_spin_unlock(&data->lock);
+ 			continue;
+ 		}
+ 		cpumask_clear_cpu(cpu, data->cpumask);
+-		spin_unlock(&data->lock);
++		atomic_spin_unlock(&data->lock);
+ 
+ 		data->csd.func(data->csd.info);
+ 
+-		spin_lock(&data->lock);
++		atomic_spin_lock(&data->lock);
+ 		WARN_ON(data->refs == 0);
+ 		refs = --data->refs;
+ 		if (!refs) {
+-			spin_lock(&call_function.lock);
++			atomic_spin_lock(&call_function.lock);
+ 			list_del_rcu(&data->csd.list);
+-			spin_unlock(&call_function.lock);
++			atomic_spin_unlock(&call_function.lock);
+ 		}
+-		spin_unlock(&data->lock);
++		atomic_spin_unlock(&data->lock);
+ 
+ 		if (refs)
+ 			continue;
+@@ -230,9 +230,9 @@
+ 	unsigned int data_flags;
+ 	LIST_HEAD(list);
+ 
+-	spin_lock(&q->lock);
++	atomic_spin_lock(&q->lock);
+ 	list_replace_init(&q->list, &list);
+-	spin_unlock(&q->lock);
++	atomic_spin_unlock(&q->lock);
+ 
+ 	while (!list_empty(&list)) {
+ 		struct call_single_data *data;
+@@ -391,23 +391,23 @@
+ 	data = &__get_cpu_var(cfd_data);
+ 	csd_lock(&data->csd);
+ 
+-	spin_lock_irqsave(&data->lock, flags);
++	atomic_spin_lock_irqsave(&data->lock, flags);
+ 	data->csd.func = func;
+ 	data->csd.info = info;
+ 	cpumask_and(data->cpumask, mask, cpu_online_mask);
+ 	cpumask_clear_cpu(this_cpu, data->cpumask);
+ 	data->refs = cpumask_weight(data->cpumask);
+ 
+-	spin_lock(&call_function.lock);
++	atomic_spin_lock(&call_function.lock);
+ 	/*
+ 	 * Place entry at the _HEAD_ of the list, so that any cpu still
+ 	 * observing the entry in generic_smp_call_function_interrupt()
+ 	 * will not miss any other list entries:
+ 	 */
+ 	list_add_rcu(&data->csd.list, &call_function.queue);
+-	spin_unlock(&call_function.lock);
++	atomic_spin_unlock(&call_function.lock);
+ 
+-	spin_unlock_irqrestore(&data->lock, flags);
++	atomic_spin_unlock_irqrestore(&data->lock, flags);
+ 
+ 	/*
+ 	 * Make the list addition visible before sending the ipi.
+@@ -453,20 +453,20 @@
+ 
+ void ipi_call_lock(void)
+ {
+-	spin_lock(&call_function.lock);
++	atomic_spin_lock(&call_function.lock);
+ }
+ 
+ void ipi_call_unlock(void)
+ {
+-	spin_unlock(&call_function.lock);
++	atomic_spin_unlock(&call_function.lock);
+ }
+ 
+ void ipi_call_lock_irq(void)
+ {
+-	spin_lock_irq(&call_function.lock);
++	atomic_spin_lock_irq(&call_function.lock);
+ }
+ 
+ void ipi_call_unlock_irq(void)
+ {
+-	spin_unlock_irq(&call_function.lock);
++	atomic_spin_unlock_irq(&call_function.lock);
+ }
+Index: linux-rt-2.6.31/kernel/softirq.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/softirq.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/softirq.c	2010-05-17 14:23:20.108490005 +0200
+@@ -8,15 +8,23 @@
+  *	Rewritten. Old one was good in 2.2, but in 2.3 it was immoral. --ANK (990903)
+  *
+  *	Remote softirq infrastructure is by Jens Axboe.
++ *
++ *	Softirq-split implemetation by
++ *	Copyright (C) 2005 Thomas Gleixner, Ingo Molnar
+  */
+ 
+ #include <linux/module.h>
++#include <linux/kallsyms.h>
++#include <linux/syscalls.h>
++#include <linux/wait.h>
+ #include <linux/kernel_stat.h>
+ #include <linux/interrupt.h>
+ #include <linux/init.h>
++#include <linux/delay.h>
+ #include <linux/mm.h>
+ #include <linux/notifier.h>
+ #include <linux/percpu.h>
++#include <linux/delay.h>
+ #include <linux/cpu.h>
+ #include <linux/freezer.h>
+ #include <linux/kthread.h>
+@@ -54,29 +62,122 @@
+ 
+ static struct softirq_action softirq_vec[NR_SOFTIRQS] __cacheline_aligned_in_smp;
+ 
+-static DEFINE_PER_CPU(struct task_struct *, ksoftirqd);
++struct softirqdata {
++	int			nr;
++	unsigned long		cpu;
++	struct task_struct	*tsk;
++	int			running;
++};
++
++static DEFINE_PER_CPU(struct softirqdata [NR_SOFTIRQS], ksoftirqd);
+ 
+ char *softirq_to_name[NR_SOFTIRQS] = {
+ 	"HI", "TIMER", "NET_TX", "NET_RX", "BLOCK",
+ 	"TASKLET", "SCHED", "HRTIMER",	"RCU"
+ };
+ 
++#ifdef CONFIG_PREEMPT_RT
++/*
++ * On preempt-rt a softirq might be blocked on a lock. There might be
++ * no other runnable task on this CPU because the lock owner runs on
++ * some other CPU. So we have to go into idle with the pending bit
++ * set. Therefor we need to check this otherwise we warn about false
++ * positives which confuses users and defeats the whole purpose of
++ * this test.
++ *
++ * This code is called with interrupts disabled.
++ */
++void softirq_check_pending_idle(void)
++{
++	static int rate_limit;
++	u32 warnpending = 0, pending = local_softirq_pending();
++	int curr = 0;
++
++	if (rate_limit >= 10)
++		return;
++
++	while (pending) {
++		if (pending & 1) {
++			struct task_struct *tsk;
++
++			tsk = __get_cpu_var(ksoftirqd)[curr].tsk;
++			/*
++			 * The wakeup code in rtmutex.c wakes up the
++			 * task _before_ it sets pi_blocked_on to NULL
++			 * under tsk->pi_lock. So we need to check for
++			 * both: state and pi_blocked_on.
++			 */
++			atomic_spin_lock(&tsk->pi_lock);
++
++			if (!tsk->pi_blocked_on &&
++			    !(tsk->state == TASK_RUNNING) &&
++			    !(tsk->state & TASK_RUNNING_MUTEX))
++				warnpending |= 1 << curr;
++
++			atomic_spin_unlock(&tsk->pi_lock);
++		}
++		pending >>= 1;
++		curr++;
++	}
++
++	if (warnpending) {
++		printk(KERN_ERR "NOHZ: local_softirq_pending %02x\n",
++		       warnpending);
++		rate_limit++;
++	}
++}
++
++#else
++/*
++ * On !PREEMPT_RT we just printk rate limited:
++ */
++void softirq_check_pending_idle(void)
++{
++	static int rate_limit;
++
++	if (rate_limit < 10) {
++		printk(KERN_ERR "NOHZ: local_softirq_pending %02x\n",
++		       local_softirq_pending());
++		rate_limit++;
++	}
++}
++
++#endif
++
+ /*
+  * we cannot loop indefinitely here to avoid userspace starvation,
+  * but we also don't want to introduce a worst case 1/HZ latency
+  * to the pending events, so lets the scheduler to balance
+  * the softirq load for us.
+  */
+-void wakeup_softirqd(void)
++static void wakeup_softirqd(int softirq)
+ {
+ 	/* Interrupts are disabled: no need to stop preemption */
+-	struct task_struct *tsk = __get_cpu_var(ksoftirqd);
++	struct task_struct *tsk = __get_cpu_var(ksoftirqd)[softirq].tsk;
+ 
+ 	if (tsk && tsk->state != TASK_RUNNING)
+ 		wake_up_process(tsk);
+ }
+ 
+ /*
++ * Wake up the softirq threads which have work
++ */
++static void trigger_softirqs(void)
++{
++	u32 pending = local_softirq_pending();
++	int curr = 0;
++
++	while (pending) {
++		if (pending & 1)
++			wakeup_softirqd(curr);
++		pending >>= 1;
++		curr++;
++	}
++}
++
++#ifndef CONFIG_PREEMPT_HARDIRQS
++
++/*
+  * This one is for softirq.c-internal use,
+  * where hardirqs are disabled legitimately:
+  */
+@@ -128,7 +229,6 @@
+  */
+ void _local_bh_enable(void)
+ {
+-	WARN_ON_ONCE(in_irq());
+ 	WARN_ON_ONCE(!irqs_disabled());
+ 
+ 	if (softirq_count() == SOFTIRQ_OFFSET)
+@@ -138,45 +238,72 @@
+ 
+ EXPORT_SYMBOL(_local_bh_enable);
+ 
+-static inline void _local_bh_enable_ip(unsigned long ip)
++void local_bh_enable(void)
+ {
+-	WARN_ON_ONCE(in_irq() || irqs_disabled());
+ #ifdef CONFIG_TRACE_IRQFLAGS
+-	local_irq_disable();
++	unsigned long flags;
++
++	WARN_ON_ONCE(in_irq());
++#endif
++
++#ifdef CONFIG_TRACE_IRQFLAGS
++	local_irq_save(flags);
+ #endif
+ 	/*
+ 	 * Are softirqs going to be turned on now:
+ 	 */
+ 	if (softirq_count() == SOFTIRQ_OFFSET)
+-		trace_softirqs_on(ip);
++		trace_softirqs_on((unsigned long)__builtin_return_address(0));
+ 	/*
+ 	 * Keep preemption disabled until we are done with
+ 	 * softirq processing:
+- 	 */
+- 	sub_preempt_count(SOFTIRQ_OFFSET - 1);
++	 */
++	sub_preempt_count(SOFTIRQ_OFFSET - 1);
+ 
+ 	if (unlikely(!in_interrupt() && local_softirq_pending()))
+ 		do_softirq();
+ 
+ 	dec_preempt_count();
+ #ifdef CONFIG_TRACE_IRQFLAGS
+-	local_irq_enable();
++	local_irq_restore(flags);
+ #endif
+ 	preempt_check_resched();
+ }
+-
+-void local_bh_enable(void)
+-{
+-	_local_bh_enable_ip((unsigned long)__builtin_return_address(0));
+-}
+ EXPORT_SYMBOL(local_bh_enable);
+ 
+ void local_bh_enable_ip(unsigned long ip)
+ {
+-	_local_bh_enable_ip(ip);
++#ifdef CONFIG_TRACE_IRQFLAGS
++	unsigned long flags;
++
++	WARN_ON_ONCE(in_irq());
++
++	local_irq_save(flags);
++#endif
++	/*
++	 * Are softirqs going to be turned on now:
++	 */
++	if (softirq_count() == SOFTIRQ_OFFSET)
++		trace_softirqs_on(ip);
++	/*
++	 * Keep preemption disabled until we are done with
++	 * softirq processing:
++	 */
++	sub_preempt_count(SOFTIRQ_OFFSET - 1);
++
++	if (unlikely(!in_interrupt() && local_softirq_pending()))
++		do_softirq();
++
++	dec_preempt_count();
++#ifdef CONFIG_TRACE_IRQFLAGS
++	local_irq_restore(flags);
++#endif
++	preempt_check_resched();
+ }
+ EXPORT_SYMBOL(local_bh_enable_ip);
+ 
++#endif
++
+ /*
+  * We restart softirq processing MAX_SOFTIRQ_RESTART times,
+  * and we fall back to softirqd after that.
+@@ -186,66 +313,148 @@
+  * we want to handle softirqs as soon as possible, but they
+  * should not be able to lock up the box.
+  */
+-#define MAX_SOFTIRQ_RESTART 10
++#define MAX_SOFTIRQ_RESTART 20
+ 
+-asmlinkage void __do_softirq(void)
++static DEFINE_PER_CPU(u32, softirq_running);
++
++/*
++ * Debug check for leaking preempt counts in h->action handlers:
++ */
++
++static inline void debug_check_preempt_count_start(__u32 *preempt_count)
+ {
+-	struct softirq_action *h;
+-	__u32 pending;
++#ifdef CONFIG_DEBUG_PREEMPT
++	*preempt_count = preempt_count();
++#endif
++}
++
++static inline void
++debug_check_preempt_count_stop(__u32 *preempt_count, struct softirq_action *h)
++{
++#ifdef CONFIG_DEBUG_PREEMPT
++	if (*preempt_count == preempt_count())
++		return;
++
++	print_symbol("BUG: %Ps exited with wrong preemption count!\n",
++		     (unsigned long)h->action);
++	printk("=> enter: %08x, exit: %08x.\n", *preempt_count, preempt_count());
++	preempt_count() = *preempt_count;
++#endif
++}
++
++/*
++ * Execute softirq handlers:
++ */
++static void ___do_softirq(const int same_prio_only)
++{
++	__u32 pending, available_mask, same_prio_skipped, preempt_count;
+ 	int max_restart = MAX_SOFTIRQ_RESTART;
+-	int cpu;
++	struct softirq_action *h;
++	int cpu, softirq;
+ 
+ 	pending = local_softirq_pending();
+ 	account_system_vtime(current);
+ 
+-	__local_bh_disable((unsigned long)__builtin_return_address(0));
+-	lockdep_softirq_enter();
+-
+ 	cpu = smp_processor_id();
+ restart:
++	available_mask = -1;
++	softirq = 0;
++	same_prio_skipped = 0;
++
+ 	/* Reset the pending bitmask before enabling irqs */
+ 	set_softirq_pending(0);
+ 
+-	local_irq_enable();
+-
+ 	h = softirq_vec;
+ 
+ 	do {
+-		if (pending & 1) {
+-			int prev_count = preempt_count();
+-			kstat_incr_softirqs_this_cpu(h - softirq_vec);
++		u32 softirq_mask = 1 << softirq;
+ 
+-			trace_softirq_entry(h, softirq_vec);
+-			h->action(h);
+-			trace_softirq_exit(h, softirq_vec);
+-			if (unlikely(prev_count != preempt_count())) {
+-				printk(KERN_ERR "huh, entered softirq %td %s %p"
+-				       "with preempt_count %08x,"
+-				       " exited with %08x?\n", h - softirq_vec,
+-				       softirq_to_name[h - softirq_vec],
+-				       h->action, prev_count, preempt_count());
+-				preempt_count() = prev_count;
+-			}
++		if (!(pending & 1))
++			goto next;
+ 
+-			rcu_bh_qsctr_inc(cpu);
++		debug_check_preempt_count_start(&preempt_count);
++
++#if defined(CONFIG_PREEMPT_SOFTIRQS) && defined(CONFIG_PREEMPT_HARDIRQS)
++		/*
++		 * If executed by a same-prio hardirq thread
++		 * then skip pending softirqs that belong
++		 * to softirq threads with different priority:
++		 */
++		if (same_prio_only) {
++			struct task_struct *tsk;
++
++			tsk = __get_cpu_var(ksoftirqd)[softirq].tsk;
++			if (tsk && tsk->normal_prio != current->normal_prio) {
++				same_prio_skipped |= softirq_mask;
++				available_mask &= ~softirq_mask;
++				goto next;
++			}
+ 		}
++#endif
++		/*
++		 * Is this softirq already being processed?
++		 */
++		if (per_cpu(softirq_running, cpu) & softirq_mask) {
++			available_mask &= ~softirq_mask;
++			goto next;
++  		}
++		per_cpu(softirq_running, cpu) |= softirq_mask;
++		kstat_incr_softirqs_this_cpu(h - softirq_vec);
++		local_irq_enable();
++
++		trace_softirq_entry(h, softirq_vec);
++		h->action(h);
++		trace_softirq_exit(h, softirq_vec);
++
++		debug_check_preempt_count_stop(&preempt_count, h);
++
++		rcu_bh_qsctr_inc(cpu);
++		cond_resched_softirq_context();
++		local_irq_disable();
++		per_cpu(softirq_running, cpu) &= ~softirq_mask;
++
++next:
+ 		h++;
++		softirq++;
+ 		pending >>= 1;
+ 	} while (pending);
+ 
+-	local_irq_disable();
+-
++	or_softirq_pending(same_prio_skipped);
+ 	pending = local_softirq_pending();
+-	if (pending && --max_restart)
+-		goto restart;
++	if (pending & available_mask) {
++		if (--max_restart)
++			goto restart;
++	}
+ 
+ 	if (pending)
+-		wakeup_softirqd();
++		trigger_softirqs();
++}
++
++asmlinkage void __do_softirq(void)
++{
++#ifdef CONFIG_PREEMPT_SOFTIRQS
++	/*
++	 * 'preempt harder'. Push all softirq processing off to ksoftirqd.
++	 */
++	if (softirq_preemption) {
++		if (local_softirq_pending())
++			trigger_softirqs();
++		return;
++	}
++#endif
++	/*
++	 * 'immediate' softirq execution:
++	 */
++	__local_bh_disable((unsigned long)__builtin_return_address(0));
++	lockdep_softirq_enter();
++
++	___do_softirq(0);
+ 
+ 	lockdep_softirq_exit();
+ 
+ 	account_system_vtime(current);
+ 	_local_bh_enable();
++
+ }
+ 
+ #ifndef __ARCH_HAS_DO_SOFTIRQ
+@@ -308,7 +517,7 @@
+ 	if (idle_cpu(smp_processor_id()) && !in_interrupt() && !need_resched())
+ 		tick_nohz_stop_sched_tick(0);
+ #endif
+-	preempt_enable_no_resched();
++	__preempt_enable_no_resched();
+ }
+ 
+ /*
+@@ -316,19 +525,11 @@
+  */
+ inline void raise_softirq_irqoff(unsigned int nr)
+ {
+-	__raise_softirq_irqoff(nr);
++	__do_raise_softirq_irqoff(nr);
+ 
+-	/*
+-	 * If we're in an interrupt or softirq, we're done
+-	 * (this also catches softirq-disabled code). We will
+-	 * actually run the softirq once we return from
+-	 * the irq or softirq.
+-	 *
+-	 * Otherwise we wake up ksoftirqd to make sure we
+-	 * schedule the softirq soon.
+-	 */
+-	if (!in_interrupt())
+-		wakeup_softirqd();
++#ifdef CONFIG_PREEMPT_SOFTIRQS
++	wakeup_softirqd(nr);
++#endif
+ }
+ 
+ void raise_softirq(unsigned int nr)
+@@ -357,15 +558,45 @@
+ static DEFINE_PER_CPU(struct tasklet_head, tasklet_vec);
+ static DEFINE_PER_CPU(struct tasklet_head, tasklet_hi_vec);
+ 
++static void inline
++__tasklet_common_schedule(struct tasklet_struct *t, struct tasklet_head *head, unsigned int nr)
++{
++	if (tasklet_trylock(t)) {
++again:
++		/* We may have been preempted before tasklet_trylock
++		 * and __tasklet_action may have already run.
++		 * So double check the sched bit while the takslet
++		 * is locked before adding it to the list.
++		 */
++		if (test_bit(TASKLET_STATE_SCHED, &t->state)) {
++			t->next = NULL;
++			*head->tail = t;
++			head->tail = &(t->next);
++			raise_softirq_irqoff(nr);
++			tasklet_unlock(t);
++		} else {
++			/* This is subtle. If we hit the corner case above
++			 * It is possible that we get preempted right here,
++			 * and another task has successfully called
++			 * tasklet_schedule(), then this function, and
++			 * failed on the trylock. Thus we must be sure
++			 * before releasing the tasklet lock, that the
++			 * SCHED_BIT is clear. Otherwise the tasklet
++			 * may get its SCHED_BIT set, but not added to the
++			 * list
++			 */
++			if (!tasklet_tryunlock(t))
++				goto again;
++		}
++	}
++}
++
+ void __tasklet_schedule(struct tasklet_struct *t)
+ {
+ 	unsigned long flags;
+ 
+ 	local_irq_save(flags);
+-	t->next = NULL;
+-	*__get_cpu_var(tasklet_vec).tail = t;
+-	__get_cpu_var(tasklet_vec).tail = &(t->next);
+-	raise_softirq_irqoff(TASKLET_SOFTIRQ);
++	__tasklet_common_schedule(t, &__get_cpu_var(tasklet_vec), TASKLET_SOFTIRQ);
+ 	local_irq_restore(flags);
+ }
+ 
+@@ -376,10 +607,7 @@
+ 	unsigned long flags;
+ 
+ 	local_irq_save(flags);
+-	t->next = NULL;
+-	*__get_cpu_var(tasklet_hi_vec).tail = t;
+-	__get_cpu_var(tasklet_hi_vec).tail = &(t->next);
+-	raise_softirq_irqoff(HI_SOFTIRQ);
++	__tasklet_common_schedule(t, &__get_cpu_var(tasklet_hi_vec), HI_SOFTIRQ);
+ 	local_irq_restore(flags);
+ }
+ 
+@@ -387,50 +615,119 @@
+ 
+ void __tasklet_hi_schedule_first(struct tasklet_struct *t)
+ {
+-	BUG_ON(!irqs_disabled());
+-
+-	t->next = __get_cpu_var(tasklet_hi_vec).head;
+-	__get_cpu_var(tasklet_hi_vec).head = t;
+-	__raise_softirq_irqoff(HI_SOFTIRQ);
++	__tasklet_hi_schedule(t);
+ }
+ 
+ EXPORT_SYMBOL(__tasklet_hi_schedule_first);
+ 
+-static void tasklet_action(struct softirq_action *a)
++void  tasklet_enable(struct tasklet_struct *t)
+ {
+-	struct tasklet_struct *list;
++	if (!atomic_dec_and_test(&t->count))
++		return;
++	if (test_and_clear_bit(TASKLET_STATE_PENDING, &t->state))
++		tasklet_schedule(t);
++}
+ 
+-	local_irq_disable();
+-	list = __get_cpu_var(tasklet_vec).head;
+-	__get_cpu_var(tasklet_vec).head = NULL;
+-	__get_cpu_var(tasklet_vec).tail = &__get_cpu_var(tasklet_vec).head;
+-	local_irq_enable();
++EXPORT_SYMBOL(tasklet_enable);
++
++void  tasklet_hi_enable(struct tasklet_struct *t)
++{
++	if (!atomic_dec_and_test(&t->count))
++		return;
++	if (test_and_clear_bit(TASKLET_STATE_PENDING, &t->state))
++		tasklet_hi_schedule(t);
++}
++
++EXPORT_SYMBOL(tasklet_hi_enable);
++
++static void
++__tasklet_action(struct softirq_action *a, struct tasklet_struct *list)
++{
++	int loops = 1000000;
+ 
+ 	while (list) {
+ 		struct tasklet_struct *t = list;
+ 
+ 		list = list->next;
+ 
+-		if (tasklet_trylock(t)) {
+-			if (!atomic_read(&t->count)) {
+-				if (!test_and_clear_bit(TASKLET_STATE_SCHED, &t->state))
+-					BUG();
+-				t->func(t->data);
+-				tasklet_unlock(t);
+-				continue;
+-			}
+-			tasklet_unlock(t);
++		/*
++		 * Should always succeed - after a tasklist got on the
++		 * list (after getting the SCHED bit set from 0 to 1),
++		 * nothing but the tasklet softirq it got queued to can
++		 * lock it:
++		 */
++		if (!tasklet_trylock(t)) {
++			WARN_ON(1);
++			continue;
+ 		}
+ 
+-		local_irq_disable();
+ 		t->next = NULL;
+-		*__get_cpu_var(tasklet_vec).tail = t;
+-		__get_cpu_var(tasklet_vec).tail = &(t->next);
+-		__raise_softirq_irqoff(TASKLET_SOFTIRQ);
+-		local_irq_enable();
++
++		/*
++		 * If we cannot handle the tasklet because it's disabled,
++		 * mark it as pending. tasklet_enable() will later
++		 * re-schedule the tasklet.
++		 */
++		if (unlikely(atomic_read(&t->count))) {
++out_disabled:
++			/* implicit unlock: */
++			wmb();
++			t->state = TASKLET_STATEF_PENDING;
++			continue;
++		}
++
++		/*
++		 * After this point on the tasklet might be rescheduled
++		 * on another CPU, but it can only be added to another
++		 * CPU's tasklet list if we unlock the tasklet (which we
++		 * dont do yet).
++		 */
++		if (!test_and_clear_bit(TASKLET_STATE_SCHED, &t->state))
++			WARN_ON(1);
++
++again:
++		t->func(t->data);
++
++		/*
++		 * Try to unlock the tasklet. We must use cmpxchg, because
++		 * another CPU might have scheduled or disabled the tasklet.
++		 * We only allow the STATE_RUN -> 0 transition here.
++		 */
++		while (!tasklet_tryunlock(t)) {
++			/*
++			 * If it got disabled meanwhile, bail out:
++			 */
++			if (atomic_read(&t->count))
++				goto out_disabled;
++			/*
++			 * If it got scheduled meanwhile, re-execute
++			 * the tasklet function:
++			 */
++			if (test_and_clear_bit(TASKLET_STATE_SCHED, &t->state))
++				goto again;
++			if (!--loops) {
++				printk("hm, tasklet state: %08lx\n", t->state);
++				WARN_ON(1);
++				tasklet_unlock(t);
++				break;
++			}
++		}
+ 	}
+ }
+ 
++static void tasklet_action(struct softirq_action *a)
++{
++	struct tasklet_struct *list;
++
++	local_irq_disable();
++	list = __get_cpu_var(tasklet_vec).head;
++	__get_cpu_var(tasklet_vec).head = NULL;
++	__get_cpu_var(tasklet_vec).tail = &__get_cpu_var(tasklet_vec).head;
++	local_irq_enable();
++
++	__tasklet_action(a, list);
++}
++
+ static void tasklet_hi_action(struct softirq_action *a)
+ {
+ 	struct tasklet_struct *list;
+@@ -441,29 +738,7 @@
+ 	__get_cpu_var(tasklet_hi_vec).tail = &__get_cpu_var(tasklet_hi_vec).head;
+ 	local_irq_enable();
+ 
+-	while (list) {
+-		struct tasklet_struct *t = list;
+-
+-		list = list->next;
+-
+-		if (tasklet_trylock(t)) {
+-			if (!atomic_read(&t->count)) {
+-				if (!test_and_clear_bit(TASKLET_STATE_SCHED, &t->state))
+-					BUG();
+-				t->func(t->data);
+-				tasklet_unlock(t);
+-				continue;
+-			}
+-			tasklet_unlock(t);
+-		}
+-
+-		local_irq_disable();
+-		t->next = NULL;
+-		*__get_cpu_var(tasklet_hi_vec).tail = t;
+-		__get_cpu_var(tasklet_hi_vec).tail = &(t->next);
+-		__raise_softirq_irqoff(HI_SOFTIRQ);
+-		local_irq_enable();
+-	}
++	__tasklet_action(a, list);
+ }
+ 
+ 
+@@ -486,7 +761,7 @@
+ 
+ 	while (test_and_set_bit(TASKLET_STATE_SCHED, &t->state)) {
+ 		do {
+-			yield();
++			msleep(1);
+ 		} while (test_bit(TASKLET_STATE_SCHED, &t->state));
+ 	}
+ 	tasklet_unlock_wait(t);
+@@ -697,34 +972,89 @@
+ 	open_softirq(HI_SOFTIRQ, tasklet_hi_action);
+ }
+ 
+-static int ksoftirqd(void * __bind_cpu)
++#if defined(CONFIG_SMP) || defined(CONFIG_PREEMPT_RT)
++
++void tasklet_unlock_wait(struct tasklet_struct *t)
++{
++	while (test_bit(TASKLET_STATE_RUN, &(t)->state)) {
++		/*
++		 * Hack for now to avoid this busy-loop:
++		 */
++#ifdef CONFIG_PREEMPT_RT
++		msleep(1);
++#else
++		barrier();
++#endif
++	}
++}
++EXPORT_SYMBOL(tasklet_unlock_wait);
++
++#endif
++
++static int ksoftirqd(void * __data)
+ {
++	/* Priority needs to be below hardirqs */
++	struct sched_param param = { .sched_priority = MAX_USER_RT_PRIO/2 - 1};
++	struct softirqdata *data = __data;
++	u32 softirq_mask = (1 << data->nr);
++	struct softirq_action *h;
++	int cpu = data->cpu;
++
++	sys_sched_setscheduler(current->pid, SCHED_FIFO, &param);
++	current->flags |= PF_SOFTIRQ;
+ 	set_current_state(TASK_INTERRUPTIBLE);
+ 
+ 	while (!kthread_should_stop()) {
+ 		preempt_disable();
+-		if (!local_softirq_pending()) {
+-			preempt_enable_no_resched();
+-			schedule();
++		if (!(local_softirq_pending() & softirq_mask)) {
++sleep_more:
++			preempt_enable_and_schedule();
+ 			preempt_disable();
+ 		}
+ 
+ 		__set_current_state(TASK_RUNNING);
++		data->running = 1;
+ 
+-		while (local_softirq_pending()) {
++		while (local_softirq_pending() & softirq_mask) {
+ 			/* Preempt disable stops cpu going offline.
+ 			   If already offline, we'll be on wrong CPU:
+ 			   don't process */
+-			if (cpu_is_offline((long)__bind_cpu))
++			if (cpu_is_offline(cpu))
+ 				goto wait_to_die;
+-			do_softirq();
+-			preempt_enable_no_resched();
++
++			/*
++			 * Is the softirq already being executed by
++			 * a hardirq context?
++			 */
++			local_irq_disable();
++			if (per_cpu(softirq_running, cpu) & softirq_mask) {
++				local_irq_enable();
++				set_current_state(TASK_INTERRUPTIBLE);
++				goto sleep_more;
++			}
++			per_cpu(softirq_running, cpu) |= softirq_mask;
++			set_softirq_pending(local_softirq_pending() & ~softirq_mask);
++			local_bh_disable();
++			local_irq_enable();
++			preempt_enable();
++
++			h = &softirq_vec[data->nr];
++			if (h)
++				h->action(h);
++			rcu_bh_qsctr_inc(data->cpu);
++
++			local_irq_disable();
++			per_cpu(softirq_running, cpu) &= ~softirq_mask;
++			_local_bh_enable();
++			local_irq_enable();
++
+ 			cond_resched();
+ 			preempt_disable();
+-			rcu_qsctr_inc((long)__bind_cpu);
++			rcu_qsctr_inc(data->cpu);
+ 		}
+ 		preempt_enable();
+ 		set_current_state(TASK_INTERRUPTIBLE);
++		data->running = 0;
+ 	}
+ 	__set_current_state(TASK_RUNNING);
+ 	return 0;
+@@ -774,7 +1104,7 @@
+ 	BUG();
+ }
+ 
+-static void takeover_tasklets(unsigned int cpu)
++void takeover_tasklets(unsigned int cpu)
+ {
+ 	/* CPU is dead, so no lock needed. */
+ 	local_irq_disable();
+@@ -800,49 +1130,75 @@
+ }
+ #endif /* CONFIG_HOTPLUG_CPU */
+ 
++static const char *softirq_names [] =
++{
++  [HI_SOFTIRQ]		= "high",
++  [SCHED_SOFTIRQ]	= "sched",
++  [TIMER_SOFTIRQ]	= "timer",
++  [NET_TX_SOFTIRQ]	= "net-tx",
++  [NET_RX_SOFTIRQ]	= "net-rx",
++  [BLOCK_SOFTIRQ]	= "block",
++  [TASKLET_SOFTIRQ]	= "tasklet",
++  [HRTIMER_SOFTIRQ]	= "hrtimer",
++  [RCU_SOFTIRQ]		= "rcu",
++};
++
+ static int __cpuinit cpu_callback(struct notifier_block *nfb,
+ 				  unsigned long action,
+ 				  void *hcpu)
+ {
+-	int hotcpu = (unsigned long)hcpu;
++	int hotcpu = (unsigned long)hcpu, i;
+ 	struct task_struct *p;
+ 
+ 	switch (action) {
+ 	case CPU_UP_PREPARE:
+ 	case CPU_UP_PREPARE_FROZEN:
+-		p = kthread_create(ksoftirqd, hcpu, "ksoftirqd/%d", hotcpu);
+-		if (IS_ERR(p)) {
+-			printk("ksoftirqd for %i failed\n", hotcpu);
+-			return NOTIFY_BAD;
+-		}
+-		kthread_bind(p, hotcpu);
+-  		per_cpu(ksoftirqd, hotcpu) = p;
+- 		break;
++		for (i = 0; i < NR_SOFTIRQS; i++) {
++			per_cpu(ksoftirqd, hotcpu)[i].nr = i;
++			per_cpu(ksoftirqd, hotcpu)[i].cpu = hotcpu;
++			per_cpu(ksoftirqd, hotcpu)[i].tsk = NULL;
++		}
++		for (i = 0; i < NR_SOFTIRQS; i++) {
++			p = kthread_create(ksoftirqd,
++					   &per_cpu(ksoftirqd, hotcpu)[i],
++					   "sirq-%s/%d", softirq_names[i],
++					   hotcpu);
++			if (IS_ERR(p)) {
++				printk("ksoftirqd %d for %i failed\n", i,
++				       hotcpu);
++				return NOTIFY_BAD;
++			}
++			kthread_bind(p, hotcpu);
++			per_cpu(ksoftirqd, hotcpu)[i].tsk = p;
++		}
++		break;
++	break;
+ 	case CPU_ONLINE:
+ 	case CPU_ONLINE_FROZEN:
+-		wake_up_process(per_cpu(ksoftirqd, hotcpu));
++		for (i = 0; i < NR_SOFTIRQS; i++)
++			wake_up_process(per_cpu(ksoftirqd, hotcpu)[i].tsk);
+ 		break;
+ #ifdef CONFIG_HOTPLUG_CPU
+ 	case CPU_UP_CANCELED:
+ 	case CPU_UP_CANCELED_FROZEN:
+-		if (!per_cpu(ksoftirqd, hotcpu))
+-			break;
+-		/* Unbind so it can run.  Fall thru. */
+-		kthread_bind(per_cpu(ksoftirqd, hotcpu),
+-			     cpumask_any(cpu_online_mask));
++		/* Fall trough */
++
+ 	case CPU_DEAD:
+ 	case CPU_DEAD_FROZEN: {
+-		struct sched_param param = { .sched_priority = MAX_RT_PRIO-1 };
++		struct sched_param param;
+ 
+-		p = per_cpu(ksoftirqd, hotcpu);
+-		per_cpu(ksoftirqd, hotcpu) = NULL;
+-		sched_setscheduler_nocheck(p, SCHED_FIFO, &param);
+-		kthread_stop(p);
++		for (i = 0; i < NR_SOFTIRQS; i++) {
++			param.sched_priority = MAX_RT_PRIO-1;
++			p = per_cpu(ksoftirqd, hotcpu)[i].tsk;
++			sched_setscheduler(p, SCHED_FIFO, &param);
++			per_cpu(ksoftirqd, hotcpu)[i].tsk = NULL;
++			kthread_stop(p);
++		}
+ 		takeover_tasklets(hotcpu);
+ 		break;
+ 	}
+ #endif /* CONFIG_HOTPLUG_CPU */
+- 	}
++	}
+ 	return NOTIFY_OK;
+ }
+ 
+@@ -862,6 +1218,34 @@
+ }
+ early_initcall(spawn_ksoftirqd);
+ 
++
++#ifdef CONFIG_PREEMPT_SOFTIRQS
++
++int softirq_preemption = 1;
++
++EXPORT_SYMBOL(softirq_preemption);
++
++/*
++ * Real-Time Preemption depends on softirq threading:
++ */
++#ifndef CONFIG_PREEMPT_RT
++
++static int __init softirq_preempt_setup (char *str)
++{
++	if (!strncmp(str, "off", 3))
++		softirq_preemption = 0;
++	else
++		get_option(&str, &softirq_preemption);
++	if (!softirq_preemption)
++		printk("turning off softirq preemption!\n");
++
++	return 1;
++}
++
++__setup("softirq-preempt=", softirq_preempt_setup);
++#endif
++#endif
++
+ #ifdef CONFIG_SMP
+ /*
+  * Call a function on all processors
+Index: linux-rt-2.6.31/kernel/softlockup.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/softlockup.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/softlockup.c	2010-05-17 14:23:20.108490005 +0200
+@@ -20,7 +20,7 @@
+ 
+ #include <asm/irq_regs.h>
+ 
+-static DEFINE_SPINLOCK(print_lock);
++static DEFINE_ATOMIC_SPINLOCK(print_lock);
+ 
+ static DEFINE_PER_CPU(unsigned long, touch_timestamp);
+ static DEFINE_PER_CPU(unsigned long, print_timestamp);
+@@ -149,7 +149,7 @@
+ 
+ 	per_cpu(print_timestamp, this_cpu) = touch_timestamp;
+ 
+-	spin_lock(&print_lock);
++	atomic_spin_lock(&print_lock);
+ 	printk(KERN_ERR "BUG: soft lockup - CPU#%d stuck for %lus! [%s:%d]\n",
+ 			this_cpu, now - touch_timestamp,
+ 			current->comm, task_pid_nr(current));
+@@ -159,7 +159,7 @@
+ 		show_regs(regs);
+ 	else
+ 		dump_stack();
+-	spin_unlock(&print_lock);
++	atomic_spin_unlock(&print_lock);
+ 
+ 	if (softlockup_panic)
+ 		panic("softlockup: hung tasks");
+Index: linux-rt-2.6.31/kernel/spinlock.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/spinlock.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/spinlock.c	2010-05-17 14:23:20.108490005 +0200
+@@ -21,44 +21,19 @@
+ #include <linux/debug_locks.h>
+ #include <linux/module.h>
+ 
+-int __lockfunc _spin_trylock(spinlock_t *lock)
++#include "lock-internals.h"
++
++int __lockfunc _atomic_spin_trylock(atomic_spinlock_t *lock)
+ {
+ 	preempt_disable();
+ 	if (_raw_spin_trylock(lock)) {
+ 		spin_acquire(&lock->dep_map, 0, 1, _RET_IP_);
+ 		return 1;
+ 	}
+-	
+-	preempt_enable();
+-	return 0;
+-}
+-EXPORT_SYMBOL(_spin_trylock);
+-
+-int __lockfunc _read_trylock(rwlock_t *lock)
+-{
+-	preempt_disable();
+-	if (_raw_read_trylock(lock)) {
+-		rwlock_acquire_read(&lock->dep_map, 0, 1, _RET_IP_);
+-		return 1;
+-	}
+-
+ 	preempt_enable();
+ 	return 0;
+ }
+-EXPORT_SYMBOL(_read_trylock);
+-
+-int __lockfunc _write_trylock(rwlock_t *lock)
+-{
+-	preempt_disable();
+-	if (_raw_write_trylock(lock)) {
+-		rwlock_acquire(&lock->dep_map, 0, 1, _RET_IP_);
+-		return 1;
+-	}
+-
+-	preempt_enable();
+-	return 0;
+-}
+-EXPORT_SYMBOL(_write_trylock);
++EXPORT_SYMBOL(_atomic_spin_trylock);
+ 
+ /*
+  * If lockdep is enabled then we use the non-preemption spin-ops
+@@ -67,15 +42,7 @@
+  */
+ #if !defined(CONFIG_GENERIC_LOCKBREAK) || defined(CONFIG_DEBUG_LOCK_ALLOC)
+ 
+-void __lockfunc _read_lock(rwlock_t *lock)
+-{
+-	preempt_disable();
+-	rwlock_acquire_read(&lock->dep_map, 0, 0, _RET_IP_);
+-	LOCK_CONTENDED(lock, _raw_read_trylock, _raw_read_lock);
+-}
+-EXPORT_SYMBOL(_read_lock);
+-
+-unsigned long __lockfunc _spin_lock_irqsave(spinlock_t *lock)
++unsigned long __lockfunc _atomic_spin_lock_irqsave(atomic_spinlock_t *lock)
+ {
+ 	unsigned long flags;
+ 
+@@ -94,207 +61,61 @@
+ #endif
+ 	return flags;
+ }
+-EXPORT_SYMBOL(_spin_lock_irqsave);
++EXPORT_SYMBOL(_atomic_spin_lock_irqsave);
+ 
+-void __lockfunc _spin_lock_irq(spinlock_t *lock)
++void __lockfunc _atomic_spin_lock_irq(atomic_spinlock_t *lock)
+ {
+ 	local_irq_disable();
+ 	preempt_disable();
+ 	spin_acquire(&lock->dep_map, 0, 0, _RET_IP_);
+ 	LOCK_CONTENDED(lock, _raw_spin_trylock, _raw_spin_lock);
+ }
+-EXPORT_SYMBOL(_spin_lock_irq);
++EXPORT_SYMBOL(_atomic_spin_lock_irq);
+ 
+-void __lockfunc _spin_lock_bh(spinlock_t *lock)
++void __lockfunc _atomic_spin_lock_bh(atomic_spinlock_t *lock)
+ {
+ 	local_bh_disable();
+ 	preempt_disable();
+ 	spin_acquire(&lock->dep_map, 0, 0, _RET_IP_);
+ 	LOCK_CONTENDED(lock, _raw_spin_trylock, _raw_spin_lock);
+ }
+-EXPORT_SYMBOL(_spin_lock_bh);
+-
+-unsigned long __lockfunc _read_lock_irqsave(rwlock_t *lock)
+-{
+-	unsigned long flags;
+-
+-	local_irq_save(flags);
+-	preempt_disable();
+-	rwlock_acquire_read(&lock->dep_map, 0, 0, _RET_IP_);
+-	LOCK_CONTENDED_FLAGS(lock, _raw_read_trylock, _raw_read_lock,
+-			     _raw_read_lock_flags, &flags);
+-	return flags;
+-}
+-EXPORT_SYMBOL(_read_lock_irqsave);
+-
+-void __lockfunc _read_lock_irq(rwlock_t *lock)
+-{
+-	local_irq_disable();
+-	preempt_disable();
+-	rwlock_acquire_read(&lock->dep_map, 0, 0, _RET_IP_);
+-	LOCK_CONTENDED(lock, _raw_read_trylock, _raw_read_lock);
+-}
+-EXPORT_SYMBOL(_read_lock_irq);
+-
+-void __lockfunc _read_lock_bh(rwlock_t *lock)
+-{
+-	local_bh_disable();
+-	preempt_disable();
+-	rwlock_acquire_read(&lock->dep_map, 0, 0, _RET_IP_);
+-	LOCK_CONTENDED(lock, _raw_read_trylock, _raw_read_lock);
+-}
+-EXPORT_SYMBOL(_read_lock_bh);
+-
+-unsigned long __lockfunc _write_lock_irqsave(rwlock_t *lock)
+-{
+-	unsigned long flags;
+-
+-	local_irq_save(flags);
+-	preempt_disable();
+-	rwlock_acquire(&lock->dep_map, 0, 0, _RET_IP_);
+-	LOCK_CONTENDED_FLAGS(lock, _raw_write_trylock, _raw_write_lock,
+-			     _raw_write_lock_flags, &flags);
+-	return flags;
+-}
+-EXPORT_SYMBOL(_write_lock_irqsave);
+-
+-void __lockfunc _write_lock_irq(rwlock_t *lock)
+-{
+-	local_irq_disable();
+-	preempt_disable();
+-	rwlock_acquire(&lock->dep_map, 0, 0, _RET_IP_);
+-	LOCK_CONTENDED(lock, _raw_write_trylock, _raw_write_lock);
+-}
+-EXPORT_SYMBOL(_write_lock_irq);
++EXPORT_SYMBOL(_atomic_spin_lock_bh);
+ 
+-void __lockfunc _write_lock_bh(rwlock_t *lock)
+-{
+-	local_bh_disable();
+-	preempt_disable();
+-	rwlock_acquire(&lock->dep_map, 0, 0, _RET_IP_);
+-	LOCK_CONTENDED(lock, _raw_write_trylock, _raw_write_lock);
+-}
+-EXPORT_SYMBOL(_write_lock_bh);
+-
+-void __lockfunc _spin_lock(spinlock_t *lock)
++void __lockfunc _atomic_spin_lock(atomic_spinlock_t *lock)
+ {
+ 	preempt_disable();
+ 	spin_acquire(&lock->dep_map, 0, 0, _RET_IP_);
+ 	LOCK_CONTENDED(lock, _raw_spin_trylock, _raw_spin_lock);
+ }
+-
+-EXPORT_SYMBOL(_spin_lock);
+-
+-void __lockfunc _write_lock(rwlock_t *lock)
+-{
+-	preempt_disable();
+-	rwlock_acquire(&lock->dep_map, 0, 0, _RET_IP_);
+-	LOCK_CONTENDED(lock, _raw_write_trylock, _raw_write_lock);
+-}
+-
+-EXPORT_SYMBOL(_write_lock);
++EXPORT_SYMBOL(_atomic_spin_lock);
+ 
+ #else /* CONFIG_PREEMPT: */
+ 
+ /*
+- * This could be a long-held lock. We both prepare to spin for a long
+- * time (making _this_ CPU preemptable if possible), and we also signal
+- * towards that other CPU that it should break the lock ASAP.
+- *
+- * (We do this in a function because inlining it would be excessive.)
+- */
+-
+-#define BUILD_LOCK_OPS(op, locktype)					\
+-void __lockfunc _##op##_lock(locktype##_t *lock)			\
+-{									\
+-	for (;;) {							\
+-		preempt_disable();					\
+-		if (likely(_raw_##op##_trylock(lock)))			\
+-			break;						\
+-		preempt_enable();					\
+-									\
+-		if (!(lock)->break_lock)				\
+-			(lock)->break_lock = 1;				\
+-		while (!op##_can_lock(lock) && (lock)->break_lock)	\
+-			_raw_##op##_relax(&lock->raw_lock);		\
+-	}								\
+-	(lock)->break_lock = 0;						\
+-}									\
+-									\
+-EXPORT_SYMBOL(_##op##_lock);						\
+-									\
+-unsigned long __lockfunc _##op##_lock_irqsave(locktype##_t *lock)	\
+-{									\
+-	unsigned long flags;						\
+-									\
+-	for (;;) {							\
+-		preempt_disable();					\
+-		local_irq_save(flags);					\
+-		if (likely(_raw_##op##_trylock(lock)))			\
+-			break;						\
+-		local_irq_restore(flags);				\
+-		preempt_enable();					\
+-									\
+-		if (!(lock)->break_lock)				\
+-			(lock)->break_lock = 1;				\
+-		while (!op##_can_lock(lock) && (lock)->break_lock)	\
+-			_raw_##op##_relax(&lock->raw_lock);		\
+-	}								\
+-	(lock)->break_lock = 0;						\
+-	return flags;							\
+-}									\
+-									\
+-EXPORT_SYMBOL(_##op##_lock_irqsave);					\
+-									\
+-void __lockfunc _##op##_lock_irq(locktype##_t *lock)			\
+-{									\
+-	_##op##_lock_irqsave(lock);					\
+-}									\
+-									\
+-EXPORT_SYMBOL(_##op##_lock_irq);					\
+-									\
+-void __lockfunc _##op##_lock_bh(locktype##_t *lock)			\
+-{									\
+-	unsigned long flags;						\
+-									\
+-	/*							*/	\
+-	/* Careful: we must exclude softirqs too, hence the	*/	\
+-	/* irq-disabling. We use the generic preemption-aware	*/	\
+-	/* function:						*/	\
+-	/**/								\
+-	flags = _##op##_lock_irqsave(lock);				\
+-	local_bh_disable();						\
+-	local_irq_restore(flags);					\
+-}									\
+-									\
+-EXPORT_SYMBOL(_##op##_lock_bh)
+-
+-/*
+  * Build preemption-friendly versions of the following
+  * lock-spinning functions:
+  *
+- *         _[spin|read|write]_lock()
+- *         _[spin|read|write]_lock_irq()
+- *         _[spin|read|write]_lock_irqsave()
+- *         _[spin|read|write]_lock_bh()
++ *         _atomic_spin_lock()
++ *         _atomic_spin_lock_irq()
++ *         _atomic_spin_lock_irqsave()
++ *         _atomic_spin_lock_bh()
+  */
+-BUILD_LOCK_OPS(spin, spinlock);
+-BUILD_LOCK_OPS(read, rwlock);
+-BUILD_LOCK_OPS(write, rwlock);
++BUILD_LOCK_OPS(atomic_spin, spin, atomic_spinlock);
+ 
+ #endif /* CONFIG_PREEMPT */
+ 
+ #ifdef CONFIG_DEBUG_LOCK_ALLOC
+ 
+-void __lockfunc _spin_lock_nested(spinlock_t *lock, int subclass)
++void __lockfunc _atomic_spin_lock_nested(atomic_spinlock_t *lock, int subclass)
+ {
+ 	preempt_disable();
+ 	spin_acquire(&lock->dep_map, subclass, 0, _RET_IP_);
+ 	LOCK_CONTENDED(lock, _raw_spin_trylock, _raw_spin_lock);
+ }
+-EXPORT_SYMBOL(_spin_lock_nested);
++EXPORT_SYMBOL(_atomic_spin_lock_nested);
+ 
+-unsigned long __lockfunc _spin_lock_irqsave_nested(spinlock_t *lock, int subclass)
++unsigned long __lockfunc
++_atomic_spin_lock_irqsave_nested(atomic_spinlock_t *lock, int subclass)
+ {
+ 	unsigned long flags;
+ 
+@@ -305,125 +126,56 @@
+ 				_raw_spin_lock_flags, &flags);
+ 	return flags;
+ }
+-EXPORT_SYMBOL(_spin_lock_irqsave_nested);
++EXPORT_SYMBOL(_atomic_spin_lock_irqsave_nested);
+ 
+-void __lockfunc _spin_lock_nest_lock(spinlock_t *lock,
++void __lockfunc _atomic_spin_lock_nest_lock(atomic_spinlock_t *lock,
+ 				     struct lockdep_map *nest_lock)
+ {
+ 	preempt_disable();
+ 	spin_acquire_nest(&lock->dep_map, 0, 0, nest_lock, _RET_IP_);
+ 	LOCK_CONTENDED(lock, _raw_spin_trylock, _raw_spin_lock);
+ }
+-EXPORT_SYMBOL(_spin_lock_nest_lock);
++EXPORT_SYMBOL(_atomic_spin_lock_nest_lock);
+ 
+ #endif
+ 
+-void __lockfunc _spin_unlock(spinlock_t *lock)
++void __lockfunc _atomic_spin_unlock(atomic_spinlock_t *lock)
+ {
+ 	spin_release(&lock->dep_map, 1, _RET_IP_);
+ 	_raw_spin_unlock(lock);
+ 	preempt_enable();
+ }
+-EXPORT_SYMBOL(_spin_unlock);
+-
+-void __lockfunc _write_unlock(rwlock_t *lock)
+-{
+-	rwlock_release(&lock->dep_map, 1, _RET_IP_);
+-	_raw_write_unlock(lock);
+-	preempt_enable();
+-}
+-EXPORT_SYMBOL(_write_unlock);
++EXPORT_SYMBOL(_atomic_spin_unlock);
+ 
+-void __lockfunc _read_unlock(rwlock_t *lock)
+-{
+-	rwlock_release(&lock->dep_map, 1, _RET_IP_);
+-	_raw_read_unlock(lock);
+-	preempt_enable();
+-}
+-EXPORT_SYMBOL(_read_unlock);
+-
+-void __lockfunc _spin_unlock_irqrestore(spinlock_t *lock, unsigned long flags)
++void __lockfunc
++_atomic_spin_unlock_irqrestore(atomic_spinlock_t *lock, unsigned long flags)
+ {
+ 	spin_release(&lock->dep_map, 1, _RET_IP_);
+ 	_raw_spin_unlock(lock);
+ 	local_irq_restore(flags);
+ 	preempt_enable();
+ }
+-EXPORT_SYMBOL(_spin_unlock_irqrestore);
++EXPORT_SYMBOL(_atomic_spin_unlock_irqrestore);
+ 
+-void __lockfunc _spin_unlock_irq(spinlock_t *lock)
++void __lockfunc _atomic_spin_unlock_irq(atomic_spinlock_t *lock)
+ {
+ 	spin_release(&lock->dep_map, 1, _RET_IP_);
+ 	_raw_spin_unlock(lock);
+ 	local_irq_enable();
+ 	preempt_enable();
+ }
+-EXPORT_SYMBOL(_spin_unlock_irq);
++EXPORT_SYMBOL(_atomic_spin_unlock_irq);
+ 
+-void __lockfunc _spin_unlock_bh(spinlock_t *lock)
++void __lockfunc _atomic_spin_unlock_bh(atomic_spinlock_t *lock)
+ {
+ 	spin_release(&lock->dep_map, 1, _RET_IP_);
+ 	_raw_spin_unlock(lock);
+-	preempt_enable_no_resched();
+-	local_bh_enable_ip((unsigned long)__builtin_return_address(0));
+-}
+-EXPORT_SYMBOL(_spin_unlock_bh);
+-
+-void __lockfunc _read_unlock_irqrestore(rwlock_t *lock, unsigned long flags)
+-{
+-	rwlock_release(&lock->dep_map, 1, _RET_IP_);
+-	_raw_read_unlock(lock);
+-	local_irq_restore(flags);
+-	preempt_enable();
+-}
+-EXPORT_SYMBOL(_read_unlock_irqrestore);
+-
+-void __lockfunc _read_unlock_irq(rwlock_t *lock)
+-{
+-	rwlock_release(&lock->dep_map, 1, _RET_IP_);
+-	_raw_read_unlock(lock);
+-	local_irq_enable();
+-	preempt_enable();
+-}
+-EXPORT_SYMBOL(_read_unlock_irq);
+-
+-void __lockfunc _read_unlock_bh(rwlock_t *lock)
+-{
+-	rwlock_release(&lock->dep_map, 1, _RET_IP_);
+-	_raw_read_unlock(lock);
+-	preempt_enable_no_resched();
+-	local_bh_enable_ip((unsigned long)__builtin_return_address(0));
+-}
+-EXPORT_SYMBOL(_read_unlock_bh);
+-
+-void __lockfunc _write_unlock_irqrestore(rwlock_t *lock, unsigned long flags)
+-{
+-	rwlock_release(&lock->dep_map, 1, _RET_IP_);
+-	_raw_write_unlock(lock);
+-	local_irq_restore(flags);
+-	preempt_enable();
+-}
+-EXPORT_SYMBOL(_write_unlock_irqrestore);
+-
+-void __lockfunc _write_unlock_irq(rwlock_t *lock)
+-{
+-	rwlock_release(&lock->dep_map, 1, _RET_IP_);
+-	_raw_write_unlock(lock);
+-	local_irq_enable();
+-	preempt_enable();
+-}
+-EXPORT_SYMBOL(_write_unlock_irq);
+-
+-void __lockfunc _write_unlock_bh(rwlock_t *lock)
+-{
+-	rwlock_release(&lock->dep_map, 1, _RET_IP_);
+-	_raw_write_unlock(lock);
+-	preempt_enable_no_resched();
++	__preempt_enable_no_resched();
+ 	local_bh_enable_ip((unsigned long)__builtin_return_address(0));
+ }
+-EXPORT_SYMBOL(_write_unlock_bh);
++EXPORT_SYMBOL(_atomic_spin_unlock_bh);
+ 
+-int __lockfunc _spin_trylock_bh(spinlock_t *lock)
++int __lockfunc _atomic_spin_trylock_bh(atomic_spinlock_t *lock)
+ {
+ 	local_bh_disable();
+ 	preempt_disable();
+@@ -432,11 +184,11 @@
+ 		return 1;
+ 	}
+ 
+-	preempt_enable_no_resched();
++	__preempt_enable_no_resched();
+ 	local_bh_enable_ip((unsigned long)__builtin_return_address(0));
+ 	return 0;
+ }
+-EXPORT_SYMBOL(_spin_trylock_bh);
++EXPORT_SYMBOL(_atomic_spin_trylock_bh);
+ 
+ notrace int in_lock_functions(unsigned long addr)
+ {
+Index: linux-rt-2.6.31/kernel/srcu.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/srcu.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/srcu.c	2010-05-17 14:23:20.108490005 +0200
+@@ -255,3 +255,89 @@
+ EXPORT_SYMBOL_GPL(srcu_read_unlock);
+ EXPORT_SYMBOL_GPL(synchronize_srcu);
+ EXPORT_SYMBOL_GPL(srcu_batches_completed);
++
++int init_qrcu_struct(struct qrcu_struct *qp)
++{
++	qp->completed = 0;
++	atomic_set(qp->ctr + 0, 1);
++	atomic_set(qp->ctr + 1, 0);
++	init_waitqueue_head(&qp->wq);
++	mutex_init(&qp->mutex);
++
++	return 0;
++}
++
++int qrcu_read_lock(struct qrcu_struct *qp)
++{
++	for (;;) {
++		int idx = qp->completed & 0x1;
++		if (likely(atomic_inc_not_zero(qp->ctr + idx)))
++			return idx;
++	}
++}
++
++void qrcu_read_unlock(struct qrcu_struct *qp, int idx)
++{
++	if (atomic_dec_and_test(qp->ctr + idx))
++		wake_up(&qp->wq);
++}
++
++void synchronize_qrcu(struct qrcu_struct *qp)
++{
++	int idx;
++
++	smp_mb();  /* Force preceding change to happen before fastpath check. */
++
++	/*
++	 * Fastpath: If the two counters sum to "1" at a given point in
++	 * time, there are no readers.  However, it takes two separate
++	 * loads to sample both counters, which won't occur simultaneously.
++	 * So we might race with a counter switch, so that we might see
++	 * ctr[0]==0, then the counter might switch, then we might see
++	 * ctr[1]==1 (unbeknownst to us because there is a reader still
++	 * there).  So we do a read memory barrier and recheck.  If the
++	 * same race happens again, there must have been a second counter
++	 * switch.  This second counter switch could not have happened
++	 * until all preceding readers finished, so if the condition
++	 * is true both times, we may safely proceed.
++	 *
++	 * This relies critically on the atomic increment and atomic
++	 * decrement being seen as executing in order.
++	 */
++
++	if (atomic_read(&qp->ctr[0]) + atomic_read(&qp->ctr[1]) <= 1) {
++		smp_rmb();  /* Keep two checks independent. */
++		if (atomic_read(&qp->ctr[0]) + atomic_read(&qp->ctr[1]) <= 1)
++			goto out;
++	}
++
++	mutex_lock(&qp->mutex);
++
++	idx = qp->completed & 0x1;
++	if (atomic_read(qp->ctr + idx) == 1)
++		goto out_unlock;
++
++	atomic_inc(qp->ctr + (idx ^ 0x1));
++
++	/*
++	 * Prevent subsequent decrement from being seen before previous
++	 * increment -- such an inversion could cause the fastpath
++	 * above to falsely conclude that there were no readers.  Also,
++	 * reduce the likelihood that qrcu_read_lock() will loop.
++	 */
++
++	smp_mb__after_atomic_inc();
++	qp->completed++;
++
++	atomic_dec(qp->ctr + idx);
++	__wait_event(qp->wq, !atomic_read(qp->ctr + idx));
++out_unlock:
++	mutex_unlock(&qp->mutex);
++out:
++	smp_mb(); /* force subsequent free after qrcu_read_unlock(). */
++}
++
++EXPORT_SYMBOL_GPL(init_qrcu_struct);
++EXPORT_SYMBOL_GPL(qrcu_read_lock);
++EXPORT_SYMBOL_GPL(qrcu_read_unlock);
++EXPORT_SYMBOL_GPL(synchronize_qrcu);
+Index: linux-rt-2.6.31/kernel/stop_machine.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/stop_machine.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/stop_machine.c	2010-05-17 14:23:20.108490005 +0200
+@@ -40,6 +40,8 @@
+ static DEFINE_MUTEX(lock);
+ /* setup_lock protects refcount, stop_machine_wq and stop_machine_work. */
+ static DEFINE_MUTEX(setup_lock);
++/* do not start up until all worklets have been placed: */
++static DEFINE_MUTEX(startup_lock);
+ /* Users of stop_machine. */
+ static int refcount;
+ static struct workqueue_struct *stop_machine_wq;
+@@ -71,6 +73,15 @@
+ 	int cpu = smp_processor_id();
+ 	int err;
+ 
++	/*
++	 * Wait for the startup loop to finish:
++	 */
++	mutex_lock(&startup_lock);
++	/*
++	 * Let other threads continue too:
++	 */
++	mutex_unlock(&startup_lock);
++
+ 	if (!active_cpus) {
+ 		if (cpu == cpumask_first(cpu_online_mask))
+ 			smdata = &active;
+@@ -166,16 +177,21 @@
+ 
+ 	set_state(STOPMACHINE_PREPARE);
+ 
+-	/* Schedule the stop_cpu work on all cpus: hold this CPU so one
+-	 * doesn't hit this CPU until we're ready. */
+-	get_cpu();
++	/*
++	 * Schedule the stop_cpu work on all cpus before allowing any
++	 * of the CPUs to execute it:
++	 */
++	mutex_lock(&startup_lock);
++
+ 	for_each_online_cpu(i) {
+ 		sm_work = per_cpu_ptr(stop_machine_work, i);
+ 		INIT_WORK(sm_work, stop_cpu);
+ 		queue_work_on(i, stop_machine_wq, sm_work);
+ 	}
+-	/* This will release the thread on our CPU. */
+-	put_cpu();
++
++	/* This will release the thread on all CPUs: */
++	mutex_unlock(&startup_lock);
++
+ 	flush_workqueue(stop_machine_wq);
+ 	ret = active.fnret;
+ 	mutex_unlock(&lock);
+Index: linux-rt-2.6.31/kernel/sys.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/sys.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/sys.c	2010-05-17 14:23:20.108490005 +0200
+@@ -33,6 +33,7 @@
+ #include <linux/getcpu.h>
+ #include <linux/task_io_accounting_ops.h>
+ #include <linux/seccomp.h>
++#include <linux/hardirq.h>
+ #include <linux/cpu.h>
+ #include <linux/ptrace.h>
+ #include <linux/fs_struct.h>
+@@ -164,6 +165,7 @@
+ 		niceval = 19;
+ 
+ 	read_lock(&tasklist_lock);
++	rcu_read_lock();
+ 	switch (which) {
+ 		case PRIO_PROCESS:
+ 			if (who)
+@@ -199,6 +201,7 @@
+ 			break;
+ 	}
+ out_unlock:
++	rcu_read_unlock();
+ 	read_unlock(&tasklist_lock);
+ out:
+ 	return error;
+@@ -280,6 +283,15 @@
+  */
+ void emergency_restart(void)
+ {
++	/*
++	 * Call the notifier chain if we are not in an
++	 * atomic context:
++	 */
++#ifdef CONFIG_PREEMPT
++	if (!in_atomic() && !irqs_disabled())
++		blocking_notifier_call_chain(&reboot_notifier_list,
++					     SYS_RESTART, NULL);
++#endif
+ 	machine_emergency_restart();
+ }
+ EXPORT_SYMBOL_GPL(emergency_restart);
+Index: linux-rt-2.6.31/kernel/sysctl.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/sysctl.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/sysctl.c	2010-05-17 14:23:20.108490005 +0200
+@@ -332,6 +332,14 @@
+ 	},
+ 	{
+ 		.ctl_name	= CTL_UNNUMBERED,
++		.procname	= "sched_time_avg",
++		.data		= &sysctl_sched_time_avg,
++		.maxlen		= sizeof(unsigned int),
++		.mode		= 0644,
++		.proc_handler	= &proc_dointvec,
++	},
++	{
++		.ctl_name	= CTL_UNNUMBERED,
+ 		.procname	= "timer_migration",
+ 		.data		= &sysctl_timer_migration,
+ 		.maxlen		= sizeof(unsigned int),
+Index: linux-rt-2.6.31/kernel/time.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/time.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/time.c	2010-05-17 14:23:20.108490005 +0200
+@@ -133,11 +133,10 @@
+  */
+ static inline void warp_clock(void)
+ {
+-	write_seqlock_irq(&xtime_lock);
++	write_atomic_seqlock_irq(&xtime_lock);
+ 	wall_to_monotonic.tv_sec -= sys_tz.tz_minuteswest * 60;
+ 	xtime.tv_sec += sys_tz.tz_minuteswest * 60;
+-	update_xtime_cache(0);
+-	write_sequnlock_irq(&xtime_lock);
++	write_atomic_sequnlock_irq(&xtime_lock);
+ 	clock_was_set();
+ }
+ 
+@@ -370,13 +369,20 @@
+  *	0 <= tv_nsec < NSEC_PER_SEC
+  * For negative values only the tv_sec field is negative !
+  */
+-void set_normalized_timespec(struct timespec *ts, time_t sec, long nsec)
++void set_normalized_timespec(struct timespec *ts, time_t sec, s64 nsec)
+ {
+ 	while (nsec >= NSEC_PER_SEC) {
++		/*
++		 * The following asm() prevents the compiler from
++		 * optimising this loop into a modulo operation. See
++		 * also __iter_div_u64_rem() in include/linux/time.h
++		 */
++		asm("" : "+rm"(nsec));
+ 		nsec -= NSEC_PER_SEC;
+ 		++sec;
+ 	}
+ 	while (nsec < 0) {
++		asm("" : "+rm"(nsec));
+ 		nsec += NSEC_PER_SEC;
+ 		--sec;
+ 	}
+@@ -662,9 +668,9 @@
+ 	u64 ret;
+ 
+ 	do {
+-		seq = read_seqbegin(&xtime_lock);
++		seq = read_atomic_seqbegin(&xtime_lock);
+ 		ret = jiffies_64;
+-	} while (read_seqretry(&xtime_lock, seq));
++	} while (read_atomic_seqretry(&xtime_lock, seq));
+ 	return ret;
+ }
+ EXPORT_SYMBOL(get_jiffies_64);
+Index: linux-rt-2.6.31/kernel/time/clockevents.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/time/clockevents.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/kernel/time/clockevents.c	2010-05-17 14:23:20.108490005 +0200
+@@ -20,6 +20,8 @@
+ #include <linux/sysdev.h>
+ #include <linux/tick.h>
+ 
++#include "tick-internal.h"
++
+ /* The registered clock event devices */
+ static LIST_HEAD(clockevent_devices);
+ static LIST_HEAD(clockevents_released);
+@@ -28,7 +30,7 @@
+ static RAW_NOTIFIER_HEAD(clockevents_chain);
+ 
+ /* Protection for the above */
+-static DEFINE_SPINLOCK(clockevents_lock);
++static DEFINE_ATOMIC_SPINLOCK(clockevents_lock);
+ 
+ /**
+  * clockevents_delta2ns - Convert a latch value (device ticks) to nanoseconds
+@@ -140,9 +142,9 @@
+ 	unsigned long flags;
+ 	int ret;
+ 
+-	spin_lock_irqsave(&clockevents_lock, flags);
++	atomic_spin_lock_irqsave(&clockevents_lock, flags);
+ 	ret = raw_notifier_chain_register(&clockevents_chain, nb);
+-	spin_unlock_irqrestore(&clockevents_lock, flags);
++	atomic_spin_unlock_irqrestore(&clockevents_lock, flags);
+ 
+ 	return ret;
+ }
+@@ -184,13 +186,13 @@
+ 	BUG_ON(dev->mode != CLOCK_EVT_MODE_UNUSED);
+ 	BUG_ON(!dev->cpumask);
+ 
+-	spin_lock_irqsave(&clockevents_lock, flags);
++	atomic_spin_lock_irqsave(&clockevents_lock, flags);
+ 
+ 	list_add(&dev->list, &clockevent_devices);
+ 	clockevents_do_notify(CLOCK_EVT_NOTIFY_ADD, dev);
+ 	clockevents_notify_released();
+ 
+-	spin_unlock_irqrestore(&clockevents_lock, flags);
++	atomic_spin_unlock_irqrestore(&clockevents_lock, flags);
+ }
+ EXPORT_SYMBOL_GPL(clockevents_register_device);
+ 
+@@ -241,7 +243,8 @@
+ 	unsigned long flags;
+ 	int cpu;
+ 
+-	spin_lock_irqsave(&clockevents_lock, flags);
++	atomic_spin_lock_irqsave(&clockevents_lock, flags);
++
+ 	clockevents_do_notify(reason, arg);
+ 
+ 	switch (reason) {
+@@ -258,7 +261,8 @@
+ 		cpu = *((int *)arg);
+ 		list_for_each_entry_safe(dev, tmp, &clockevent_devices, list) {
+ 			if (cpumask_test_cpu(cpu, dev->cpumask) &&
+-			    cpumask_weight(dev->cpumask) == 1) {
++			    cpumask_weight(dev->cpumask) == 1 &&
++			    !tick_is_broadcast_device(dev)) {
+ 				BUG_ON(dev->mode != CLOCK_EVT_MODE_UNUSED);
+ 				list_del(&dev->list);
+ 			}
+@@ -267,7 +271,7 @@
+ 	default:
+ 		break;
+ 	}
+-	spin_unlock_irqrestore(&clockevents_lock, flags);
++	atomic_spin_unlock_irqrestore(&clockevents_lock, flags);
+ }
+ EXPORT_SYMBOL_GPL(clockevents_notify);
+ #endif
+Index: linux-rt-2.6.31/kernel/time/clocksource.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/time/clocksource.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/time/clocksource.c	2010-05-17 14:23:20.108490005 +0200
+@@ -127,7 +127,7 @@
+ static struct clocksource *next_clocksource;
+ static struct clocksource *clocksource_override;
+ static LIST_HEAD(clocksource_list);
+-static DEFINE_SPINLOCK(clocksource_lock);
++static DEFINE_ATOMIC_SPINLOCK(clocksource_lock);
+ static char override_name[32];
+ static int finished_booting;
+ 
+@@ -296,7 +296,7 @@
+ 	struct clocksource *cs;
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&clocksource_lock, flags);
++	atomic_spin_lock_irqsave(&clocksource_lock, flags);
+ 
+ 	list_for_each_entry(cs, &clocksource_list, list) {
+ 		if (cs->resume)
+@@ -305,7 +305,7 @@
+ 
+ 	clocksource_resume_watchdog();
+ 
+-	spin_unlock_irqrestore(&clocksource_lock, flags);
++	atomic_spin_unlock_irqrestore(&clocksource_lock, flags);
+ }
+ 
+ /**
+@@ -328,12 +328,12 @@
+ {
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&clocksource_lock, flags);
++	atomic_spin_lock_irqsave(&clocksource_lock, flags);
+ 	if (next_clocksource && finished_booting) {
+ 		curr_clocksource = next_clocksource;
+ 		next_clocksource = NULL;
+ 	}
+-	spin_unlock_irqrestore(&clocksource_lock, flags);
++	atomic_spin_unlock_irqrestore(&clocksource_lock, flags);
+ 
+ 	return curr_clocksource;
+ }
+@@ -402,11 +402,11 @@
+ 	unsigned long flags;
+ 	int ret;
+ 
+-	spin_lock_irqsave(&clocksource_lock, flags);
++	atomic_spin_lock_irqsave(&clocksource_lock, flags);
+ 	ret = clocksource_enqueue(c);
+ 	if (!ret)
+ 		next_clocksource = select_clocksource();
+-	spin_unlock_irqrestore(&clocksource_lock, flags);
++	atomic_spin_unlock_irqrestore(&clocksource_lock, flags);
+ 	if (!ret)
+ 		clocksource_check_watchdog(c);
+ 	return ret;
+@@ -421,12 +421,12 @@
+ {
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&clocksource_lock, flags);
++	atomic_spin_lock_irqsave(&clocksource_lock, flags);
+ 	list_del(&cs->list);
+ 	cs->rating = rating;
+ 	clocksource_enqueue(cs);
+ 	next_clocksource = select_clocksource();
+-	spin_unlock_irqrestore(&clocksource_lock, flags);
++	atomic_spin_unlock_irqrestore(&clocksource_lock, flags);
+ }
+ 
+ /**
+@@ -436,12 +436,12 @@
+ {
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&clocksource_lock, flags);
++	atomic_spin_lock_irqsave(&clocksource_lock, flags);
+ 	list_del(&cs->list);
+ 	if (clocksource_override == cs)
+ 		clocksource_override = NULL;
+ 	next_clocksource = select_clocksource();
+-	spin_unlock_irqrestore(&clocksource_lock, flags);
++	atomic_spin_unlock_irqrestore(&clocksource_lock, flags);
+ }
+ 
+ #ifdef CONFIG_SYSFS
+@@ -458,9 +458,9 @@
+ {
+ 	ssize_t count = 0;
+ 
+-	spin_lock_irq(&clocksource_lock);
++	atomic_spin_lock_irq(&clocksource_lock);
+ 	count = snprintf(buf, PAGE_SIZE, "%s\n", curr_clocksource->name);
+-	spin_unlock_irq(&clocksource_lock);
++	atomic_spin_unlock_irq(&clocksource_lock);
+ 
+ 	return count;
+ }
+@@ -490,7 +490,7 @@
+ 	if (buf[count-1] == '\n')
+ 		count--;
+ 
+-	spin_lock_irq(&clocksource_lock);
++	atomic_spin_lock_irq(&clocksource_lock);
+ 
+ 	if (count > 0)
+ 		memcpy(override_name, buf, count);
+@@ -527,7 +527,7 @@
+ 		next_clocksource = select_clocksource();
+ 	}
+ 
+-	spin_unlock_irq(&clocksource_lock);
++	atomic_spin_unlock_irq(&clocksource_lock);
+ 
+ 	return ret;
+ }
+@@ -547,7 +547,7 @@
+ 	struct clocksource *src;
+ 	ssize_t count = 0;
+ 
+-	spin_lock_irq(&clocksource_lock);
++	atomic_spin_lock_irq(&clocksource_lock);
+ 	list_for_each_entry(src, &clocksource_list, list) {
+ 		/*
+ 		 * Don't show non-HRES clocksource if the tick code is
+@@ -559,7 +559,7 @@
+ 				  max((ssize_t)PAGE_SIZE - count, (ssize_t)0),
+ 				  "%s ", src->name);
+ 	}
+-	spin_unlock_irq(&clocksource_lock);
++	atomic_spin_unlock_irq(&clocksource_lock);
+ 
+ 	count += snprintf(buf + count,
+ 			  max((ssize_t)PAGE_SIZE - count, (ssize_t)0), "\n");
+@@ -615,10 +615,10 @@
+ static int __init boot_override_clocksource(char* str)
+ {
+ 	unsigned long flags;
+-	spin_lock_irqsave(&clocksource_lock, flags);
++	atomic_spin_lock_irqsave(&clocksource_lock, flags);
+ 	if (str)
+ 		strlcpy(override_name, str, sizeof(override_name));
+-	spin_unlock_irqrestore(&clocksource_lock, flags);
++	atomic_spin_unlock_irqrestore(&clocksource_lock, flags);
+ 	return 1;
+ }
+ 
+Index: linux-rt-2.6.31/kernel/time/ntp.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/time/ntp.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/time/ntp.c	2010-05-17 14:23:20.108490005 +0200
+@@ -188,7 +188,7 @@
+ {
+ 	enum hrtimer_restart res = HRTIMER_NORESTART;
+ 
+-	write_seqlock(&xtime_lock);
++	write_atomic_seqlock(&xtime_lock);
+ 
+ 	switch (time_state) {
+ 	case TIME_OK:
+@@ -221,7 +221,7 @@
+ 	}
+ 	update_vsyscall(&xtime, clock);
+ 
+-	write_sequnlock(&xtime_lock);
++	write_atomic_sequnlock(&xtime_lock);
+ 
+ 	return res;
+ }
+@@ -479,7 +479,7 @@
+ 
+ 	getnstimeofday(&ts);
+ 
+-	write_seqlock_irq(&xtime_lock);
++	write_atomic_seqlock_irq(&xtime_lock);
+ 
+ 	if (txc->modes & ADJ_ADJTIME) {
+ 		long save_adjust = time_adjust;
+@@ -527,7 +527,7 @@
+ 	txc->errcnt	   = 0;
+ 	txc->stbcnt	   = 0;
+ 
+-	write_sequnlock_irq(&xtime_lock);
++	write_atomic_sequnlock_irq(&xtime_lock);
+ 
+ 	txc->time.tv_sec = ts.tv_sec;
+ 	txc->time.tv_usec = ts.tv_nsec;
+Index: linux-rt-2.6.31/kernel/time/tick-broadcast.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/time/tick-broadcast.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/time/tick-broadcast.c	2010-05-17 14:23:20.108490005 +0200
+@@ -31,7 +31,7 @@
+ /* FIXME: Use cpumask_var_t. */
+ static DECLARE_BITMAP(tick_broadcast_mask, NR_CPUS);
+ static DECLARE_BITMAP(tmpmask, NR_CPUS);
+-static DEFINE_SPINLOCK(tick_broadcast_lock);
++static DEFINE_ATOMIC_SPINLOCK(tick_broadcast_lock);
+ static int tick_broadcast_force;
+ 
+ #ifdef CONFIG_TICK_ONESHOT
+@@ -96,7 +96,7 @@
+ 	unsigned long flags;
+ 	int ret = 0;
+ 
+-	spin_lock_irqsave(&tick_broadcast_lock, flags);
++	atomic_spin_lock_irqsave(&tick_broadcast_lock, flags);
+ 
+ 	/*
+ 	 * Devices might be registered with both periodic and oneshot
+@@ -122,7 +122,7 @@
+ 			tick_broadcast_clear_oneshot(cpu);
+ 		}
+ 	}
+-	spin_unlock_irqrestore(&tick_broadcast_lock, flags);
++	atomic_spin_unlock_irqrestore(&tick_broadcast_lock, flags);
+ 	return ret;
+ }
+ 
+@@ -161,13 +161,13 @@
+  */
+ static void tick_do_periodic_broadcast(void)
+ {
+-	spin_lock(&tick_broadcast_lock);
++	atomic_spin_lock(&tick_broadcast_lock);
+ 
+ 	cpumask_and(to_cpumask(tmpmask),
+ 		    cpu_online_mask, tick_get_broadcast_mask());
+ 	tick_do_broadcast(to_cpumask(tmpmask));
+ 
+-	spin_unlock(&tick_broadcast_lock);
++	atomic_spin_unlock(&tick_broadcast_lock);
+ }
+ 
+ /*
+@@ -212,7 +212,7 @@
+ 	unsigned long flags;
+ 	int cpu, bc_stopped;
+ 
+-	spin_lock_irqsave(&tick_broadcast_lock, flags);
++	atomic_spin_lock_irqsave(&tick_broadcast_lock, flags);
+ 
+ 	cpu = smp_processor_id();
+ 	td = &per_cpu(tick_cpu_device, cpu);
+@@ -263,7 +263,7 @@
+ 			tick_broadcast_setup_oneshot(bc);
+ 	}
+ out:
+-	spin_unlock_irqrestore(&tick_broadcast_lock, flags);
++	atomic_spin_unlock_irqrestore(&tick_broadcast_lock, flags);
+ }
+ 
+ /*
+@@ -299,7 +299,7 @@
+ 	unsigned long flags;
+ 	unsigned int cpu = *cpup;
+ 
+-	spin_lock_irqsave(&tick_broadcast_lock, flags);
++	atomic_spin_lock_irqsave(&tick_broadcast_lock, flags);
+ 
+ 	bc = tick_broadcast_device.evtdev;
+ 	cpumask_clear_cpu(cpu, tick_get_broadcast_mask());
+@@ -309,7 +309,7 @@
+ 			clockevents_shutdown(bc);
+ 	}
+ 
+-	spin_unlock_irqrestore(&tick_broadcast_lock, flags);
++	atomic_spin_unlock_irqrestore(&tick_broadcast_lock, flags);
+ }
+ 
+ void tick_suspend_broadcast(void)
+@@ -317,13 +317,13 @@
+ 	struct clock_event_device *bc;
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&tick_broadcast_lock, flags);
++	atomic_spin_lock_irqsave(&tick_broadcast_lock, flags);
+ 
+ 	bc = tick_broadcast_device.evtdev;
+ 	if (bc)
+ 		clockevents_shutdown(bc);
+ 
+-	spin_unlock_irqrestore(&tick_broadcast_lock, flags);
++	atomic_spin_unlock_irqrestore(&tick_broadcast_lock, flags);
+ }
+ 
+ int tick_resume_broadcast(void)
+@@ -332,7 +332,7 @@
+ 	unsigned long flags;
+ 	int broadcast = 0;
+ 
+-	spin_lock_irqsave(&tick_broadcast_lock, flags);
++	atomic_spin_lock_irqsave(&tick_broadcast_lock, flags);
+ 
+ 	bc = tick_broadcast_device.evtdev;
+ 
+@@ -351,7 +351,7 @@
+ 			break;
+ 		}
+ 	}
+-	spin_unlock_irqrestore(&tick_broadcast_lock, flags);
++	atomic_spin_unlock_irqrestore(&tick_broadcast_lock, flags);
+ 
+ 	return broadcast;
+ }
+@@ -405,7 +405,7 @@
+ 	ktime_t now, next_event;
+ 	int cpu;
+ 
+-	spin_lock(&tick_broadcast_lock);
++	atomic_spin_lock(&tick_broadcast_lock);
+ again:
+ 	dev->next_event.tv64 = KTIME_MAX;
+ 	next_event.tv64 = KTIME_MAX;
+@@ -443,7 +443,7 @@
+ 		if (tick_broadcast_set_event(next_event, 0))
+ 			goto again;
+ 	}
+-	spin_unlock(&tick_broadcast_lock);
++	atomic_spin_unlock(&tick_broadcast_lock);
+ }
+ 
+ /*
+@@ -457,7 +457,7 @@
+ 	unsigned long flags;
+ 	int cpu;
+ 
+-	spin_lock_irqsave(&tick_broadcast_lock, flags);
++	atomic_spin_lock_irqsave(&tick_broadcast_lock, flags);
+ 
+ 	/*
+ 	 * Periodic mode does not care about the enter/exit of power
+@@ -492,7 +492,7 @@
+ 	}
+ 
+ out:
+-	spin_unlock_irqrestore(&tick_broadcast_lock, flags);
++	atomic_spin_unlock_irqrestore(&tick_broadcast_lock, flags);
+ }
+ 
+ /*
+@@ -563,13 +563,13 @@
+ 	struct clock_event_device *bc;
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&tick_broadcast_lock, flags);
++	atomic_spin_lock_irqsave(&tick_broadcast_lock, flags);
+ 
+ 	tick_broadcast_device.mode = TICKDEV_MODE_ONESHOT;
+ 	bc = tick_broadcast_device.evtdev;
+ 	if (bc)
+ 		tick_broadcast_setup_oneshot(bc);
+-	spin_unlock_irqrestore(&tick_broadcast_lock, flags);
++	atomic_spin_unlock_irqrestore(&tick_broadcast_lock, flags);
+ }
+ 
+ 
+@@ -581,7 +581,7 @@
+ 	unsigned long flags;
+ 	unsigned int cpu = *cpup;
+ 
+-	spin_lock_irqsave(&tick_broadcast_lock, flags);
++	atomic_spin_lock_irqsave(&tick_broadcast_lock, flags);
+ 
+ 	/*
+ 	 * Clear the broadcast mask flag for the dead cpu, but do not
+@@ -589,7 +589,7 @@
+ 	 */
+ 	cpumask_clear_cpu(cpu, tick_get_broadcast_oneshot_mask());
+ 
+-	spin_unlock_irqrestore(&tick_broadcast_lock, flags);
++	atomic_spin_unlock_irqrestore(&tick_broadcast_lock, flags);
+ }
+ 
+ /*
+Index: linux-rt-2.6.31/kernel/time/tick-common.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/time/tick-common.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/time/tick-common.c	2010-05-17 14:23:20.108490005 +0200
+@@ -34,7 +34,7 @@
+ ktime_t tick_next_period;
+ ktime_t tick_period;
+ int tick_do_timer_cpu __read_mostly = TICK_DO_TIMER_BOOT;
+-DEFINE_SPINLOCK(tick_device_lock);
++DEFINE_ATOMIC_SPINLOCK(tick_device_lock);
+ 
+ /*
+  * Debugging: see timer_list.c
+@@ -60,13 +60,13 @@
+ static void tick_periodic(int cpu)
+ {
+ 	if (tick_do_timer_cpu == cpu) {
+-		write_seqlock(&xtime_lock);
++		write_atomic_seqlock(&xtime_lock);
+ 
+ 		/* Keep track of the next tick event */
+ 		tick_next_period = ktime_add(tick_next_period, tick_period);
+ 
+ 		do_timer(1);
+-		write_sequnlock(&xtime_lock);
++		write_atomic_sequnlock(&xtime_lock);
+ 	}
+ 
+ 	update_process_times(user_mode(get_irq_regs()));
+@@ -127,9 +127,9 @@
+ 		ktime_t next;
+ 
+ 		do {
+-			seq = read_seqbegin(&xtime_lock);
++			seq = read_atomic_seqbegin(&xtime_lock);
+ 			next = tick_next_period;
+-		} while (read_seqretry(&xtime_lock, seq));
++		} while (read_atomic_seqretry(&xtime_lock, seq));
+ 
+ 		clockevents_set_mode(dev, CLOCK_EVT_MODE_ONESHOT);
+ 
+@@ -209,7 +209,7 @@
+ 	int cpu, ret = NOTIFY_OK;
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&tick_device_lock, flags);
++	atomic_spin_lock_irqsave(&tick_device_lock, flags);
+ 
+ 	cpu = smp_processor_id();
+ 	if (!cpumask_test_cpu(cpu, newdev->cpumask))
+@@ -268,7 +268,7 @@
+ 	if (newdev->features & CLOCK_EVT_FEAT_ONESHOT)
+ 		tick_oneshot_notify();
+ 
+-	spin_unlock_irqrestore(&tick_device_lock, flags);
++	atomic_spin_unlock_irqrestore(&tick_device_lock, flags);
+ 	return NOTIFY_STOP;
+ 
+ out_bc:
+@@ -278,7 +278,7 @@
+ 	if (tick_check_broadcast_device(newdev))
+ 		ret = NOTIFY_STOP;
+ 
+-	spin_unlock_irqrestore(&tick_device_lock, flags);
++	atomic_spin_unlock_irqrestore(&tick_device_lock, flags);
+ 
+ 	return ret;
+ }
+@@ -311,7 +311,7 @@
+ 	struct clock_event_device *dev = td->evtdev;
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&tick_device_lock, flags);
++	atomic_spin_lock_irqsave(&tick_device_lock, flags);
+ 	td->mode = TICKDEV_MODE_PERIODIC;
+ 	if (dev) {
+ 		/*
+@@ -322,7 +322,7 @@
+ 		clockevents_exchange_device(dev, NULL);
+ 		td->evtdev = NULL;
+ 	}
+-	spin_unlock_irqrestore(&tick_device_lock, flags);
++	atomic_spin_unlock_irqrestore(&tick_device_lock, flags);
+ }
+ 
+ static void tick_suspend(void)
+@@ -330,9 +330,9 @@
+ 	struct tick_device *td = &__get_cpu_var(tick_cpu_device);
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&tick_device_lock, flags);
++	atomic_spin_lock_irqsave(&tick_device_lock, flags);
+ 	clockevents_shutdown(td->evtdev);
+-	spin_unlock_irqrestore(&tick_device_lock, flags);
++	atomic_spin_unlock_irqrestore(&tick_device_lock, flags);
+ }
+ 
+ static void tick_resume(void)
+@@ -341,7 +341,7 @@
+ 	unsigned long flags;
+ 	int broadcast = tick_resume_broadcast();
+ 
+-	spin_lock_irqsave(&tick_device_lock, flags);
++	atomic_spin_lock_irqsave(&tick_device_lock, flags);
+ 	clockevents_set_mode(td->evtdev, CLOCK_EVT_MODE_RESUME);
+ 
+ 	if (!broadcast) {
+@@ -350,7 +350,7 @@
+ 		else
+ 			tick_resume_oneshot();
+ 	}
+-	spin_unlock_irqrestore(&tick_device_lock, flags);
++	atomic_spin_unlock_irqrestore(&tick_device_lock, flags);
+ }
+ 
+ /*
+Index: linux-rt-2.6.31/kernel/time/tick-internal.h
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/time/tick-internal.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/time/tick-internal.h	2010-05-17 14:23:20.108490005 +0200
+@@ -6,7 +6,7 @@
+ #define TICK_DO_TIMER_BOOT	-2
+ 
+ DECLARE_PER_CPU(struct tick_device, tick_cpu_device);
+-extern spinlock_t tick_device_lock;
++extern atomic_spinlock_t tick_device_lock;
+ extern ktime_t tick_next_period;
+ extern ktime_t tick_period;
+ extern int tick_do_timer_cpu __read_mostly;
+Index: linux-rt-2.6.31/kernel/time/tick-sched.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/time/tick-sched.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/kernel/time/tick-sched.c	2010-05-17 14:23:20.108490005 +0200
+@@ -57,7 +57,7 @@
+ 		return;
+ 
+ 	/* Reevalute with xtime_lock held */
+-	write_seqlock(&xtime_lock);
++	write_atomic_seqlock(&xtime_lock);
+ 
+ 	delta = ktime_sub(now, last_jiffies_update);
+ 	if (delta.tv64 >= tick_period.tv64) {
+@@ -80,7 +80,7 @@
+ 		/* Keep the tick_next_period variable up to date */
+ 		tick_next_period = ktime_add(last_jiffies_update, tick_period);
+ 	}
+-	write_sequnlock(&xtime_lock);
++	write_atomic_sequnlock(&xtime_lock);
+ }
+ 
+ /*
+@@ -90,12 +90,12 @@
+ {
+ 	ktime_t period;
+ 
+-	write_seqlock(&xtime_lock);
++	write_atomic_seqlock(&xtime_lock);
+ 	/* Did we start the jiffies update yet ? */
+ 	if (last_jiffies_update.tv64 == 0)
+ 		last_jiffies_update = tick_next_period;
+ 	period = last_jiffies_update;
+-	write_sequnlock(&xtime_lock);
++	write_atomic_sequnlock(&xtime_lock);
+ 	return period;
+ }
+ 
+@@ -259,23 +259,17 @@
+ 		goto end;
+ 
+ 	if (unlikely(local_softirq_pending() && cpu_online(cpu))) {
+-		static int ratelimit;
+-
+-		if (ratelimit < 10) {
+-			printk(KERN_ERR "NOHZ: local_softirq_pending %02x\n",
+-			       local_softirq_pending());
+-			ratelimit++;
+-		}
++		softirq_check_pending_idle();
+ 		goto end;
+ 	}
+ 
+ 	ts->idle_calls++;
+ 	/* Read jiffies and the time when jiffies were updated last */
+ 	do {
+-		seq = read_seqbegin(&xtime_lock);
++		seq = read_atomic_seqbegin(&xtime_lock);
+ 		last_update = last_jiffies_update;
+ 		last_jiffies = jiffies;
+-	} while (read_seqretry(&xtime_lock, seq));
++	} while (read_atomic_seqretry(&xtime_lock, seq));
+ 
+ 	/* Get the next timer wheel timer */
+ 	next_jiffies = get_next_timer_interrupt(last_jiffies);
+@@ -698,6 +692,7 @@
+ 	 * Emulate tick processing via per-CPU hrtimers:
+ 	 */
+ 	hrtimer_init(&ts->sched_timer, CLOCK_MONOTONIC, HRTIMER_MODE_ABS);
++	ts->sched_timer.irqsafe = 1;
+ 	ts->sched_timer.function = tick_sched_timer;
+ 
+ 	/* Get the next period (per cpu) */
+Index: linux-rt-2.6.31/kernel/time/timekeeping.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/time/timekeeping.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/time/timekeeping.c	2010-05-17 14:23:20.108490005 +0200
+@@ -24,8 +24,7 @@
+  * This read-write spinlock protects us from races in SMP while
+  * playing with xtime.
+  */
+-__cacheline_aligned_in_smp DEFINE_SEQLOCK(xtime_lock);
+-
++__cacheline_aligned_in_smp DEFINE_ATOMIC_SEQLOCK(xtime_lock);
+ 
+ /*
+  * The current time
+@@ -49,16 +48,8 @@
+ /* flag for if timekeeping is suspended */
+ int __read_mostly timekeeping_suspended;
+ 
+-static struct timespec xtime_cache __attribute__ ((aligned (16)));
+-void update_xtime_cache(u64 nsec)
+-{
+-	xtime_cache = xtime;
+-	timespec_add_ns(&xtime_cache, nsec);
+-}
+-
+ struct clocksource *clock;
+ 
+-
+ #ifdef CONFIG_GENERIC_TIME
+ /**
+  * clocksource_forward_now - update clock to the current time
+@@ -102,7 +93,7 @@
+ 	WARN_ON(timekeeping_suspended);
+ 
+ 	do {
+-		seq = read_seqbegin(&xtime_lock);
++		seq = read_atomic_seqbegin(&xtime_lock);
+ 
+ 		*ts = xtime;
+ 
+@@ -118,13 +109,82 @@
+ 		/* If arch requires, add in gettimeoffset() */
+ 		nsecs += arch_gettimeoffset();
+ 
+-	} while (read_seqretry(&xtime_lock, seq));
++	} while (read_atomic_seqretry(&xtime_lock, seq));
+ 
+ 	timespec_add_ns(ts, nsecs);
+ }
+ 
+ EXPORT_SYMBOL(getnstimeofday);
+ 
++ktime_t ktime_get(void)
++{
++	cycle_t cycle_now, cycle_delta;
++	unsigned int seq;
++	s64 secs, nsecs;
++
++	WARN_ON(timekeeping_suspended);
++
++	do {
++		seq = read_atomic_seqbegin(&xtime_lock);
++		secs = xtime.tv_sec + wall_to_monotonic.tv_sec;
++		nsecs = xtime.tv_nsec + wall_to_monotonic.tv_nsec;
++
++		/* read clocksource: */
++		cycle_now = clocksource_read(clock);
++
++		/* calculate the delta since the last update_wall_time: */
++		cycle_delta = (cycle_now - clock->cycle_last) & clock->mask;
++
++		/* convert to nanoseconds: */
++		nsecs += cyc2ns(clock, cycle_delta);
++
++	} while (read_atomic_seqretry(&xtime_lock, seq));
++	/*
++	 * Use ktime_set/ktime_add_ns to create a proper ktime on
++	 * 32-bit architectures without CONFIG_KTIME_SCALAR.
++	 */
++	return ktime_add_ns(ktime_set(secs, 0), nsecs);
++}
++EXPORT_SYMBOL_GPL(ktime_get);
++
++/**
++ * ktime_get_ts - get the monotonic clock in timespec format
++ * @ts:		pointer to timespec variable
++ *
++ * The function calculates the monotonic clock from the realtime
++ * clock and the wall_to_monotonic offset and stores the result
++ * in normalized timespec format in the variable pointed to by @ts.
++ */
++void ktime_get_ts(struct timespec *ts)
++{
++	cycle_t cycle_now, cycle_delta;
++	struct timespec tomono;
++	unsigned int seq;
++	s64 nsecs;
++
++	WARN_ON(timekeeping_suspended);
++
++	do {
++		seq = read_atomic_seqbegin(&xtime_lock);
++		*ts = xtime;
++		tomono = wall_to_monotonic;
++
++		/* read clocksource: */
++		cycle_now = clocksource_read(clock);
++
++		/* calculate the delta since the last update_wall_time: */
++		cycle_delta = (cycle_now - clock->cycle_last) & clock->mask;
++
++		/* convert to nanoseconds: */
++		nsecs = cyc2ns(clock, cycle_delta);
++
++	} while (read_atomic_seqretry(&xtime_lock, seq));
++
++	set_normalized_timespec(ts, ts->tv_sec + tomono.tv_sec,
++				ts->tv_nsec + tomono.tv_nsec + nsecs);
++}
++EXPORT_SYMBOL_GPL(ktime_get_ts);
++
+ /**
+  * do_gettimeofday - Returns the time of day in a timeval
+  * @tv:		pointer to the timeval to be set
+@@ -155,7 +215,7 @@
+ 	if ((unsigned long)tv->tv_nsec >= NSEC_PER_SEC)
+ 		return -EINVAL;
+ 
+-	write_seqlock_irqsave(&xtime_lock, flags);
++	write_atomic_seqlock_irqsave(&xtime_lock, flags);
+ 
+ 	clocksource_forward_now();
+ 
+@@ -165,14 +225,12 @@
+ 
+ 	xtime = *tv;
+ 
+-	update_xtime_cache(0);
+-
+ 	clock->error = 0;
+ 	ntp_clear();
+ 
+ 	update_vsyscall(&xtime, clock);
+ 
+-	write_sequnlock_irqrestore(&xtime_lock, flags);
++	write_atomic_sequnlock_irqrestore(&xtime_lock, flags);
+ 
+ 	/* signal hrtimers about time change */
+ 	clock_was_set();
+@@ -221,10 +279,65 @@
+ 	       clock->name);
+ 	 */
+ }
+-#else
++#else /* GENERIC_TIME */
+ static inline void clocksource_forward_now(void) { }
+ static inline void change_clocksource(void) { }
+-#endif
++
++/**
++ * ktime_get - get the monotonic time in ktime_t format
++ *
++ * returns the time in ktime_t format
++ */
++ktime_t ktime_get(void)
++{
++	struct timespec now;
++
++	ktime_get_ts(&now);
++
++	return timespec_to_ktime(now);
++}
++EXPORT_SYMBOL_GPL(ktime_get);
++
++/**
++ * ktime_get_ts - get the monotonic clock in timespec format
++ * @ts:		pointer to timespec variable
++ *
++ * The function calculates the monotonic clock from the realtime
++ * clock and the wall_to_monotonic offset and stores the result
++ * in normalized timespec format in the variable pointed to by @ts.
++ */
++void ktime_get_ts(struct timespec *ts)
++{
++	struct timespec tomono;
++	unsigned long seq;
++
++	do {
++		seq = read_atomic_seqbegin(&xtime_lock);
++		getnstimeofday(ts);
++		tomono = wall_to_monotonic;
++
++	} while (read_atomic_seqretry(&xtime_lock, seq));
++
++	set_normalized_timespec(ts, ts->tv_sec + tomono.tv_sec,
++				ts->tv_nsec + tomono.tv_nsec);
++}
++EXPORT_SYMBOL_GPL(ktime_get_ts);
++#endif /* !GENERIC_TIME */
++
++/**
++ * ktime_get_real - get the real (wall-) time in ktime_t format
++ *
++ * returns the time in ktime_t format
++ */
++ktime_t ktime_get_real(void)
++{
++	struct timespec now;
++
++	getnstimeofday(&now);
++
++	return timespec_to_ktime(now);
++}
++EXPORT_SYMBOL_GPL(ktime_get_real);
+ 
+ /**
+  * getrawmonotonic - Returns the raw monotonic time in a timespec
+@@ -239,7 +352,7 @@
+ 	cycle_t cycle_now, cycle_delta;
+ 
+ 	do {
+-		seq = read_seqbegin(&xtime_lock);
++		seq = read_atomic_seqbegin(&xtime_lock);
+ 
+ 		/* read clocksource: */
+ 		cycle_now = clocksource_read(clock);
+@@ -252,7 +365,7 @@
+ 
+ 		*ts = clock->raw_time;
+ 
+-	} while (read_seqretry(&xtime_lock, seq));
++	} while (read_atomic_seqretry(&xtime_lock, seq));
+ 
+ 	timespec_add_ns(ts, nsecs);
+ }
+@@ -268,11 +381,11 @@
+ 	int ret;
+ 
+ 	do {
+-		seq = read_seqbegin(&xtime_lock);
++		seq = read_atomic_seqbegin(&xtime_lock);
+ 
+ 		ret = clock->flags & CLOCK_SOURCE_VALID_FOR_HRES;
+ 
+-	} while (read_seqretry(&xtime_lock, seq));
++	} while (read_atomic_seqretry(&xtime_lock, seq));
+ 
+ 	return ret;
+ }
+@@ -299,7 +412,7 @@
+ 	unsigned long flags;
+ 	unsigned long sec = read_persistent_clock();
+ 
+-	write_seqlock_irqsave(&xtime_lock, flags);
++	write_atomic_seqlock_irqsave(&xtime_lock, flags);
+ 
+ 	ntp_init();
+ 
+@@ -311,10 +424,9 @@
+ 	xtime.tv_sec = sec;
+ 	xtime.tv_nsec = 0;
+ 	set_normalized_timespec(&wall_to_monotonic,
+-		-xtime.tv_sec, -xtime.tv_nsec);
+-	update_xtime_cache(0);
++				-xtime.tv_sec, -xtime.tv_nsec);
+ 	total_sleep_time = 0;
+-	write_sequnlock_irqrestore(&xtime_lock, flags);
++	write_atomic_sequnlock_irqrestore(&xtime_lock, flags);
+ }
+ 
+ /* time in seconds when suspend began */
+@@ -335,7 +447,7 @@
+ 
+ 	clocksource_resume();
+ 
+-	write_seqlock_irqsave(&xtime_lock, flags);
++	write_atomic_seqlock_irqsave(&xtime_lock, flags);
+ 
+ 	if (now && (now > timekeeping_suspend_time)) {
+ 		unsigned long sleep_length = now - timekeeping_suspend_time;
+@@ -344,13 +456,12 @@
+ 		wall_to_monotonic.tv_sec -= sleep_length;
+ 		total_sleep_time += sleep_length;
+ 	}
+-	update_xtime_cache(0);
+ 	/* re-base the last cycle value */
+ 	clock->cycle_last = 0;
+ 	clock->cycle_last = clocksource_read(clock);
+ 	clock->error = 0;
+ 	timekeeping_suspended = 0;
+-	write_sequnlock_irqrestore(&xtime_lock, flags);
++	write_atomic_sequnlock_irqrestore(&xtime_lock, flags);
+ 
+ 	touch_softlockup_watchdog();
+ 
+@@ -368,10 +479,10 @@
+ 
+ 	timekeeping_suspend_time = read_persistent_clock();
+ 
+-	write_seqlock_irqsave(&xtime_lock, flags);
++	write_atomic_seqlock_irqsave(&xtime_lock, flags);
+ 	clocksource_forward_now();
+ 	timekeeping_suspended = 1;
+-	write_sequnlock_irqrestore(&xtime_lock, flags);
++	write_atomic_sequnlock_irqrestore(&xtime_lock, flags);
+ 
+ 	clockevents_notify(CLOCK_EVT_NOTIFY_SUSPEND, NULL);
+ 
+@@ -486,6 +597,49 @@
+ }
+ 
+ /**
++ * logarithmic_accumulation - shifted accumulation of cycles
++ *
++ * This functions accumulates a shifted interval of cycles into
++ * into a shifted interval nanoseconds. Allows for O(log) accumulation
++ * loop.
++ *
++ * Returns the unconsumed cycles.
++ */
++static cycle_t logarithmic_accumulation(cycle_t offset, int shift)
++{
++	u64 nsecps = (u64)NSEC_PER_SEC << clock->shift;
++
++	/* If the offset is smaller then a shifted interval, do nothing */
++	if (offset < clock->cycle_interval<<shift)
++		return offset;
++
++	/* Accumulate one shifted interval */
++	offset -= clock->cycle_interval << shift;
++	clock->cycle_last += clock->cycle_interval << shift;
++
++	clock->xtime_nsec += clock->xtime_interval << shift;
++	while (clock->xtime_nsec >= nsecps) {
++		clock->xtime_nsec -= nsecps;
++		xtime.tv_sec++;
++		second_overflow();
++	}
++
++	/* Accumulate into raw time */
++	clock->raw_time.tv_nsec += clock->raw_interval << shift;;
++	while (clock->raw_time.tv_nsec >= NSEC_PER_SEC) {
++		clock->raw_time.tv_nsec -= NSEC_PER_SEC;
++		clock->raw_time.tv_sec++;
++	}
++
++	/* Accumulate error between NTP and clock interval */
++	clock->error += tick_length << shift;
++	clock->error -= clock->xtime_interval <<
++				(NTP_SCALE_SHIFT - clock->shift + shift);
++
++	return offset;
++}
++
++/**
+  * update_wall_time - Uses the current clocksource to increment the wall time
+  *
+  * Called from the timer interrupt, must hold a write on xtime_lock.
+@@ -493,6 +647,7 @@
+ void update_wall_time(void)
+ {
+ 	cycle_t offset;
++	int shift = 0, maxshift;
+ 
+ 	/* Make sure we're fully resumed: */
+ 	if (unlikely(timekeeping_suspended))
+@@ -505,30 +660,22 @@
+ #endif
+ 	clock->xtime_nsec = (s64)xtime.tv_nsec << clock->shift;
+ 
+-	/* normally this loop will run just once, however in the
+-	 * case of lost or late ticks, it will accumulate correctly.
++	/*
++	 * With NO_HZ we may have to accumulate many cycle_intervals
++	 * (think "ticks") worth of time at once. To do this efficiently,
++	 * we calculate the largest doubling multiple of cycle_intervals
++	 * that is smaller then the offset. We then accumulate that
++	 * chunk in one go, and then try to consume the next smaller
++	 * doubled multiple.
+ 	 */
++	shift = ilog2(offset) - ilog2(clock->cycle_interval);
++	shift = max(0, shift);
++	/* Bound shift to one less then what overflows tick_length */
++	maxshift = (8*sizeof(tick_length) - (ilog2(tick_length)+1)) - 1;
++	shift = min(shift, maxshift);
+ 	while (offset >= clock->cycle_interval) {
+-		/* accumulate one interval */
+-		offset -= clock->cycle_interval;
+-		clock->cycle_last += clock->cycle_interval;
+-
+-		clock->xtime_nsec += clock->xtime_interval;
+-		if (clock->xtime_nsec >= (u64)NSEC_PER_SEC << clock->shift) {
+-			clock->xtime_nsec -= (u64)NSEC_PER_SEC << clock->shift;
+-			xtime.tv_sec++;
+-			second_overflow();
+-		}
+-
+-		clock->raw_time.tv_nsec += clock->raw_interval;
+-		if (clock->raw_time.tv_nsec >= NSEC_PER_SEC) {
+-			clock->raw_time.tv_nsec -= NSEC_PER_SEC;
+-			clock->raw_time.tv_sec++;
+-		}
+-
+-		/* accumulate error between NTP and clock interval */
+-		clock->error += tick_length;
+-		clock->error -= clock->xtime_interval << (NTP_SCALE_SHIFT - clock->shift);
++		offset = logarithmic_accumulation(offset, shift);
++		shift--;
+ 	}
+ 
+ 	/* correct the clock when NTP error is too big */
+@@ -563,8 +710,6 @@
+ 	clock->xtime_nsec -= (s64)xtime.tv_nsec << clock->shift;
+ 	clock->error += clock->xtime_nsec << (NTP_SCALE_SHIFT - clock->shift);
+ 
+-	update_xtime_cache(cyc2ns(clock, offset));
+-
+ 	/* check to see if there is a new clocksource to use */
+ 	change_clocksource();
+ 	update_vsyscall(&xtime, clock);
+@@ -599,22 +744,21 @@
+ 
+ unsigned long get_seconds(void)
+ {
+-	return xtime_cache.tv_sec;
++	return xtime.tv_sec;
+ }
+ EXPORT_SYMBOL(get_seconds);
+ 
+-
+ struct timespec current_kernel_time(void)
+ {
+ 	struct timespec now;
+ 	unsigned long seq;
+ 
+ 	do {
+-		seq = read_seqbegin(&xtime_lock);
+-
+-		now = xtime_cache;
+-	} while (read_seqretry(&xtime_lock, seq));
++		seq = read_atomic_seqbegin(&xtime_lock);
++		now = xtime;
++	} while (read_atomic_seqretry(&xtime_lock, seq));
+ 
+ 	return now;
+ }
+ EXPORT_SYMBOL(current_kernel_time);
++
+Index: linux-rt-2.6.31/kernel/time/timer_list.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/time/timer_list.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/time/timer_list.c	2010-05-17 14:23:20.108490005 +0200
+@@ -84,7 +84,7 @@
+ 
+ next_one:
+ 	i = 0;
+-	spin_lock_irqsave(&base->cpu_base->lock, flags);
++	atomic_spin_lock_irqsave(&base->cpu_base->lock, flags);
+ 
+ 	curr = base->first;
+ 	/*
+@@ -100,13 +100,13 @@
+ 
+ 		timer = rb_entry(curr, struct hrtimer, node);
+ 		tmp = *timer;
+-		spin_unlock_irqrestore(&base->cpu_base->lock, flags);
++		atomic_spin_unlock_irqrestore(&base->cpu_base->lock, flags);
+ 
+ 		print_timer(m, timer, &tmp, i, now);
+ 		next++;
+ 		goto next_one;
+ 	}
+-	spin_unlock_irqrestore(&base->cpu_base->lock, flags);
++	atomic_spin_unlock_irqrestore(&base->cpu_base->lock, flags);
+ }
+ 
+ static void
+Index: linux-rt-2.6.31/kernel/time/timer_stats.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/time/timer_stats.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/time/timer_stats.c	2010-05-17 14:23:20.108490005 +0200
+@@ -81,12 +81,12 @@
+ /*
+  * Spinlock protecting the tables - not taken during lookup:
+  */
+-static DEFINE_SPINLOCK(table_lock);
++static DEFINE_ATOMIC_SPINLOCK(table_lock);
+ 
+ /*
+  * Per-CPU lookup locks for fast hash lookup:
+  */
+-static DEFINE_PER_CPU(spinlock_t, lookup_lock);
++static DEFINE_PER_CPU(atomic_spinlock_t, lookup_lock);
+ 
+ /*
+  * Mutex to serialize state changes with show-stats activities:
+@@ -188,7 +188,7 @@
+ 	prev = NULL;
+ 	curr = *head;
+ 
+-	spin_lock(&table_lock);
++	atomic_spin_lock(&table_lock);
+ 	/*
+ 	 * Make sure we have not raced with another CPU:
+ 	 */
+@@ -215,7 +215,7 @@
+ 			*head = curr;
+ 	}
+  out_unlock:
+-	spin_unlock(&table_lock);
++	atomic_spin_unlock(&table_lock);
+ 
+ 	return curr;
+ }
+@@ -238,7 +238,7 @@
+ 	/*
+ 	 * It doesnt matter which lock we take:
+ 	 */
+-	spinlock_t *lock;
++	atomic_spinlock_t *lock;
+ 	struct entry *entry, input;
+ 	unsigned long flags;
+ 
+@@ -253,7 +253,7 @@
+ 	input.pid = pid;
+ 	input.timer_flag = timer_flag;
+ 
+-	spin_lock_irqsave(lock, flags);
++	atomic_spin_lock_irqsave(lock, flags);
+ 	if (!timer_stats_active)
+ 		goto out_unlock;
+ 
+@@ -264,7 +264,7 @@
+ 		atomic_inc(&overflow_count);
+ 
+  out_unlock:
+-	spin_unlock_irqrestore(lock, flags);
++	atomic_spin_unlock_irqrestore(lock, flags);
+ }
+ 
+ static void print_name_offset(struct seq_file *m, unsigned long addr)
+@@ -348,9 +348,9 @@
+ 	int cpu;
+ 
+ 	for_each_online_cpu(cpu) {
+-		spin_lock_irqsave(&per_cpu(lookup_lock, cpu), flags);
++		atomic_spin_lock_irqsave(&per_cpu(lookup_lock, cpu), flags);
+ 		/* nothing */
+-		spin_unlock_irqrestore(&per_cpu(lookup_lock, cpu), flags);
++		atomic_spin_unlock_irqrestore(&per_cpu(lookup_lock, cpu), flags);
+ 	}
+ }
+ 
+@@ -408,7 +408,7 @@
+ 	int cpu;
+ 
+ 	for_each_possible_cpu(cpu)
+-		spin_lock_init(&per_cpu(lookup_lock, cpu));
++		atomic_spin_lock_init(&per_cpu(lookup_lock, cpu));
+ }
+ 
+ static int __init init_tstats_procfs(void)
+Index: linux-rt-2.6.31/kernel/timer.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/timer.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/timer.c	2010-05-17 14:23:20.108490005 +0200
+@@ -34,6 +34,7 @@
+ #include <linux/posix-timers.h>
+ #include <linux/cpu.h>
+ #include <linux/syscalls.h>
++#include <linux/kallsyms.h>
+ #include <linux/delay.h>
+ #include <linux/tick.h>
+ #include <linux/kallsyms.h>
+@@ -71,6 +72,7 @@
+ struct tvec_base {
+ 	spinlock_t lock;
+ 	struct timer_list *running_timer;
++	wait_queue_head_t wait_for_running_timer;
+ 	unsigned long timer_jiffies;
+ 	struct tvec_root tv1;
+ 	struct tvec tv2;
+@@ -318,9 +320,7 @@
+ static inline void set_running_timer(struct tvec_base *base,
+ 					struct timer_list *timer)
+ {
+-#ifdef CONFIG_SMP
+ 	base->running_timer = timer;
+-#endif
+ }
+ 
+ static void internal_add_timer(struct tvec_base *base, struct timer_list *timer)
+@@ -630,8 +630,8 @@
+ 
+ 	debug_timer_activate(timer);
+ 
++	preempt_disable();
+ 	new_base = __get_cpu_var(tvec_bases);
+-
+ 	cpu = smp_processor_id();
+ 
+ #if defined(CONFIG_NO_HZ) && defined(CONFIG_SMP)
+@@ -642,6 +642,8 @@
+ 			cpu = preferred_cpu;
+ 	}
+ #endif
++	preempt_enable();
++
+ 	new_base = per_cpu(tvec_bases, cpu);
+ 
+ 	if (base != new_base) {
+@@ -661,7 +663,6 @@
+ 			timer_set_base(timer, base);
+ 		}
+ 	}
+-
+ 	timer->expires = expires;
+ 	internal_add_timer(base, timer);
+ 
+@@ -795,6 +796,18 @@
+ }
+ EXPORT_SYMBOL_GPL(add_timer_on);
+ 
++/*
++ * Wait for a running timer
++ */
++void wait_for_running_timer(struct timer_list *timer)
++{
++	struct tvec_base *base = timer->base;
++
++	if (base->running_timer == timer)
++		wait_event(base->wait_for_running_timer,
++			   base->running_timer != timer);
++}
++
+ /**
+  * del_timer - deactive a timer.
+  * @timer: the timer to be deactivated
+@@ -826,7 +839,34 @@
+ }
+ EXPORT_SYMBOL(del_timer);
+ 
+-#ifdef CONFIG_SMP
++#if defined(CONFIG_SMP) || defined(CONFIG_PREEMPT_SOFTIRQS)
++/*
++ * This function checks whether a timer is active and not running on any
++ * CPU. Upon successful (ret >= 0) exit the timer is not queued and the
++ * handler is not running on any CPU.
++ *
++ * It must not be called from interrupt contexts.
++ */
++int timer_pending_sync(struct timer_list *timer)
++{
++	struct tvec_base *base;
++	unsigned long flags;
++	int ret = -1;
++
++	base = lock_timer_base(timer, &flags);
++
++	if (base->running_timer == timer)
++		goto out;
++
++	ret = 0;
++	if (timer_pending(timer))
++		ret = 1;
++out:
++	spin_unlock_irqrestore(&base->lock, flags);
++
++	return ret;
++}
++
+ /**
+  * try_to_del_timer_sync - Try to deactivate a timer
+  * @timer: timer do del
+@@ -891,7 +931,7 @@
+ 		int ret = try_to_del_timer_sync(timer);
+ 		if (ret >= 0)
+ 			return ret;
+-		cpu_relax();
++		wait_for_running_timer(timer);
+ 	}
+ }
+ EXPORT_SYMBOL(del_timer_sync);
+@@ -936,6 +976,20 @@
+ 		struct list_head *head = &work_list;
+ 		int index = base->timer_jiffies & TVR_MASK;
+ 
++		if (softirq_need_resched()) {
++			spin_unlock_irq(&base->lock);
++			wake_up(&base->wait_for_running_timer);
++			cond_resched_softirq_context();
++			cpu_relax();
++			spin_lock_irq(&base->lock);
++			/*
++			 * We can simply continue after preemption, nobody
++			 * else can touch timer_jiffies so 'index' is still
++			 * valid. Any new jiffy will be taken care of in
++			 * subsequent loops:
++			 */
++		}
++
+ 		/*
+ 		 * Cascade timers:
+ 		 */
+@@ -989,18 +1043,17 @@
+ 				lock_map_release(&lockdep_map);
+ 
+ 				if (preempt_count != preempt_count()) {
+-					printk(KERN_ERR "huh, entered %p "
+-					       "with preempt_count %08x, exited"
+-					       " with %08x?\n",
+-					       fn, preempt_count,
+-					       preempt_count());
+-					BUG();
++					print_symbol("BUG: unbalanced timer-handler preempt count in %s!\n", (unsigned long) fn);
++					printk("entered with %08x, exited with %08x.\n", preempt_count, preempt_count());
++					preempt_count() = preempt_count;
+ 				}
+ 			}
++			set_running_timer(base, NULL);
++			cond_resched_softirq_context();
+ 			spin_lock_irq(&base->lock);
+ 		}
+ 	}
+-	set_running_timer(base, NULL);
++	wake_up(&base->wait_for_running_timer);
+ 	spin_unlock_irq(&base->lock);
+ }
+ 
+@@ -1133,9 +1186,22 @@
+ 	struct tvec_base *base = __get_cpu_var(tvec_bases);
+ 	unsigned long expires;
+ 
++#ifdef CONFIG_PREEMPT_RT
++	/*
++	 * On PREEMPT_RT we cannot sleep here. If the trylock does not
++	 * succeed then we return the worst-case 'expires in 1 tick'
++	 * value:
++	 */
++	if (spin_trylock(&base->lock)) {
++		expires = __next_timer_interrupt(base);
++		spin_unlock(&base->lock);
++	} else
++		expires = now + 1;
++#else
+ 	spin_lock(&base->lock);
+ 	expires = __next_timer_interrupt(base);
+ 	spin_unlock(&base->lock);
++#endif
+ 
+ 	if (time_before_eq(expires, now))
+ 		return now;
+@@ -1155,11 +1221,10 @@
+ 
+ 	/* Note: this timer irq context must be accounted for as well. */
+ 	account_process_tick(p, user_tick);
++	scheduler_tick();
+ 	run_local_timers();
+ 	if (rcu_pending(cpu))
+ 		rcu_check_callbacks(cpu, user_tick);
+-	printk_tick();
+-	scheduler_tick();
+ 	run_posix_cpu_timers(p);
+ }
+ 
+@@ -1168,10 +1233,11 @@
+  */
+ static void run_timer_softirq(struct softirq_action *h)
+ {
+-	struct tvec_base *base = __get_cpu_var(tvec_bases);
++	struct tvec_base *base = per_cpu(tvec_bases, raw_smp_processor_id());
+ 
+-	perf_counter_do_pending();
++	perf_counter_do_pending_softirq();
+ 
++	printk_tick();
+ 	hrtimer_run_pending();
+ 
+ 	if (time_after_eq(jiffies, base->timer_jiffies))
+@@ -1512,6 +1578,7 @@
+ 	}
+ 
+ 	spin_lock_init(&base->lock);
++	init_waitqueue_head(&base->wait_for_running_timer);
+ 
+ 	for (j = 0; j < TVN_SIZE; j++) {
+ 		INIT_LIST_HEAD(base->tv5.vec + j);
+@@ -1543,6 +1610,7 @@
+ {
+ 	struct tvec_base *old_base;
+ 	struct tvec_base *new_base;
++	unsigned long flags;
+ 	int i;
+ 
+ 	BUG_ON(cpu_online(cpu));
+@@ -1552,8 +1620,11 @@
+ 	 * The caller is globally serialized and nobody else
+ 	 * takes two locks at once, deadlock is not possible.
+ 	 */
+-	spin_lock_irq(&new_base->lock);
+-	spin_lock_nested(&old_base->lock, SINGLE_DEPTH_NESTING);
++	local_irq_save(flags);
++	while (!spin_trylock(&new_base->lock))
++		cpu_relax();
++	while (!spin_trylock(&old_base->lock))
++		cpu_relax();
+ 
+ 	BUG_ON(old_base->running_timer);
+ 
+@@ -1567,7 +1638,9 @@
+ 	}
+ 
+ 	spin_unlock(&old_base->lock);
+-	spin_unlock_irq(&new_base->lock);
++	spin_unlock(&new_base->lock);
++	local_irq_restore(flags);
++
+ 	put_cpu_var(tvec_bases);
+ }
+ #endif /* CONFIG_HOTPLUG_CPU */
+Index: linux-rt-2.6.31/kernel/trace/Kconfig
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/trace/Kconfig	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/trace/Kconfig	2010-05-17 14:23:20.108490005 +0200
+@@ -41,7 +41,7 @@
+ config HAVE_HW_BRANCH_TRACER
+ 	bool
+ 
+-config HAVE_FTRACE_SYSCALLS
++config HAVE_SYSCALL_TRACEPOINTS
+ 	bool
+ 
+ config TRACER_MAX_TRACE
+@@ -60,9 +60,14 @@
+ 	bool
+ 
+ config CONTEXT_SWITCH_TRACER
+-	select MARKERS
+ 	bool
+ 
++config RING_BUFFER_ALLOW_SWAP
++	bool
++	help
++	 Allow the use of ring_buffer_swap_cpu.
++	 Adds a very slight overhead to tracing when enabled.
++
+ # All tracer options should select GENERIC_TRACER. For those options that are
+ # enabled by all tracers (context switch and event tracer) they select TRACING.
+ # This allows those options to appear when no other tracer is selected. But the
+@@ -138,7 +143,6 @@
+ 	  the return value. This is done by setting the current return 
+ 	  address on the current task structure into a stack of calls.
+ 
+-
+ config IRQSOFF_TRACER
+ 	bool "Interrupts-off Latency Tracer"
+ 	default n
+@@ -147,6 +151,7 @@
+ 	select TRACE_IRQFLAGS
+ 	select GENERIC_TRACER
+ 	select TRACER_MAX_TRACE
++	select RING_BUFFER_ALLOW_SWAP
+ 	help
+ 	  This option measures the time spent in irqs-off critical
+ 	  sections, with microsecond accuracy.
+@@ -161,6 +166,24 @@
+ 	  enabled. This option and the preempt-off timing option can be
+ 	  used together or separately.)
+ 
++config INTERRUPT_OFF_HIST
++	bool "Interrupts-off Latency Histogram"
++	depends on IRQSOFF_TRACER
++	help
++	  This option generates continuously updated histograms (one per cpu)
++	  of the duration of time periods with interrupts disabled. The
++	  histograms are disabled by default. To enable them, write a non-zero
++	  number to
++
++	      /sys/kernel/debug/tracing/latency_hist/enable/preemptirqsoff
++
++	  If PREEMPT_OFF_HIST is also selected, additional histograms (one
++	  per cpu) are generated that accumulate the duration of time periods
++	  when both interrupts and preemption are disabled. The histogram data
++	  will be located in the debug file system at
++
++	      /sys/kernel/debug/tracing/latency_hist/irqsoff
++
+ config PREEMPT_TRACER
+ 	bool "Preemption-off Latency Tracer"
+ 	default n
+@@ -168,6 +191,7 @@
+ 	depends on PREEMPT
+ 	select GENERIC_TRACER
+ 	select TRACER_MAX_TRACE
++	select RING_BUFFER_ALLOW_SWAP
+ 	help
+ 	  This option measures the time spent in preemption off critical
+ 	  sections, with microsecond accuracy.
+@@ -182,14 +206,23 @@
+ 	  enabled. This option and the irqs-off timing option can be
+ 	  used together or separately.)
+ 
+-config SYSPROF_TRACER
+-	bool "Sysprof Tracer"
+-	depends on X86
+-	select GENERIC_TRACER
+-	select CONTEXT_SWITCH_TRACER
+-	help
+-	  This tracer provides the trace needed by the 'Sysprof' userspace
+-	  tool.
++config PREEMPT_OFF_HIST
++	bool "Preemption-off Latency Histogram"
++	depends on PREEMPT_TRACER
++	help
++	  This option generates continuously updated histograms (one per cpu)
++	  of the duration of time periods with preemption disabled. The
++	  histograms are disabled by default. To enable them, write a non-zero
++	  number to
++
++	      /sys/kernel/debug/tracing/latency_hist/enable/preemptirqsoff
++
++	  If INTERRUPT_OFF_HIST is also selected, additional histograms (one
++	  per cpu) are generated that accumulate the duration of time periods
++	  when both interrupts and preemption are disabled. The histogram data
++	  will be located in the debug file system at
++
++	      /sys/kernel/debug/tracing/latency_hist/preemptoff
+ 
+ config SCHED_TRACER
+ 	bool "Scheduling Latency Tracer"
+@@ -200,6 +233,55 @@
+ 	  This tracer tracks the latency of the highest priority task
+ 	  to be scheduled in, starting from the point it has woken up.
+ 
++config WAKEUP_LATENCY_HIST
++	bool "Scheduling Latency Histogram"
++	depends on SCHED_TRACER
++	help
++	  This option generates continuously updated histograms (one per cpu)
++	  of the scheduling latency of the highest priority task.
++	  The histograms are disabled by default. To enable them, write a
++	  non-zero number to
++
++	      /sys/kernel/debug/tracing/latency_hist/enable/wakeup
++
++	  Two different algorithms are used, one to determine the latency of
++	  processes that exclusively use the highest priority of the system and
++	  another one to determine the latency of processes that share the
++	  highest system priority with other processes. The former is used to
++	  improve hardware and system software, the latter to optimize the
++	  priority design of a given system. The histogram data will be
++	  located in the debug file system at
++
++	      /sys/kernel/debug/tracing/latency_hist/wakeup
++
++	  and
++
++	      /sys/kernel/debug/tracing/latency_hist/wakeup/sharedprio
++
++config MISSED_TIMER_OFFSETS_HIST
++	depends on GENERIC_TIME
++	select GENERIC_TRACER
++	bool "Missed timer offsets histogram"
++	help
++	  Generate a histogram of missed timer offsets in microseconds. The
++	  histograms are disabled by default. To enable them, write a non-zero
++	  number to
++
++	      /sys/kernel/debug/tracing/latency_hist/enable/missed_timer_offsets
++
++ 	  The histogram data will be located in the debug file system at
++
++	      /sys/kernel/debug/tracing/latency_hist/missed_timer_offsets
++
++config SYSPROF_TRACER
++	bool "Sysprof Tracer"
++	depends on X86
++	select GENERIC_TRACER
++	select CONTEXT_SWITCH_TRACER
++	help
++	  This tracer provides the trace needed by the 'Sysprof' userspace
++	  tool.
++
+ config ENABLE_DEFAULT_TRACERS
+ 	bool "Trace process context switches and events"
+ 	depends on !GENERIC_TRACER
+@@ -211,7 +293,7 @@
+ 
+ config FTRACE_SYSCALLS
+ 	bool "Trace syscalls"
+-	depends on HAVE_FTRACE_SYSCALLS
++	depends on HAVE_SYSCALL_TRACEPOINTS
+ 	select GENERIC_TRACER
+ 	select KALLSYMS
+ 	help
+@@ -349,6 +431,7 @@
+ 
+ config HW_BRANCH_TRACER
+ 	depends on HAVE_HW_BRANCH_TRACER
++	depends on !PREEMPT_RT
+ 	bool "Trace hw branches"
+ 	select GENERIC_TRACER
+ 	help
+@@ -376,7 +459,7 @@
+ 	  If unsure, say N.
+ 
+ config WORKQUEUE_TRACER
+-	bool "Trace workqueues"
++	bool "Trace workqueues" if !PREEMPT_RT
+ 	select GENERIC_TRACER
+ 	help
+ 	  The workqueue tracer provides some statistical informations
+@@ -462,6 +545,18 @@
+ 	  functioning properly. It will do tests on all the configured
+ 	  tracers of ftrace.
+ 
++config EVENT_TRACE_TEST_SYSCALLS
++	bool "Run selftest on syscall events"
++	depends on FTRACE_STARTUP_TEST
++	help
++	 This option will also enable testing every syscall event.
++	 It only enables the event and disables it and runs various loads
++	 with the event enabled. This adds a bit more time for kernel boot
++	 up since it runs this on every system call defined.
++
++	 TBD - enable a way to actually call the syscalls as we test their
++	       events
++
+ config MMIOTRACE
+ 	bool "Memory mapped IO tracing"
+ 	depends on HAVE_MMIOTRACE_SUPPORT && PCI
+Index: linux-rt-2.6.31/kernel/trace/Makefile
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/trace/Makefile	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/trace/Makefile	2010-05-17 14:23:20.108490005 +0200
+@@ -35,6 +35,10 @@
+ obj-$(CONFIG_IRQSOFF_TRACER) += trace_irqsoff.o
+ obj-$(CONFIG_PREEMPT_TRACER) += trace_irqsoff.o
+ obj-$(CONFIG_SCHED_TRACER) += trace_sched_wakeup.o
++obj-$(CONFIG_INTERRUPT_OFF_HIST) += latency_hist.o
++obj-$(CONFIG_PREEMPT_OFF_HIST) += latency_hist.o
++obj-$(CONFIG_WAKEUP_LATENCY_HIST) += latency_hist.o
++obj-$(CONFIG_MISSED_TIMER_OFFSETS_HIST) += latency_hist.o
+ obj-$(CONFIG_NOP_TRACER) += trace_nop.o
+ obj-$(CONFIG_STACK_TRACER) += trace_stack.o
+ obj-$(CONFIG_MMIOTRACE) += trace_mmiotrace.o
+Index: linux-rt-2.6.31/kernel/trace/blktrace.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/trace/blktrace.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/trace/blktrace.c	2010-05-17 14:23:20.108490005 +0200
+@@ -65,13 +65,15 @@
+ {
+ 	struct blk_io_trace *t;
+ 	struct ring_buffer_event *event = NULL;
++	struct ring_buffer *buffer = NULL;
+ 	int pc = 0;
+ 	int cpu = smp_processor_id();
+ 	bool blk_tracer = blk_tracer_enabled;
+ 
+ 	if (blk_tracer) {
++		buffer = blk_tr->buffer;
+ 		pc = preempt_count();
+-		event = trace_buffer_lock_reserve(blk_tr, TRACE_BLK,
++		event = trace_buffer_lock_reserve(buffer, TRACE_BLK,
+ 						  sizeof(*t) + len,
+ 						  0, pc);
+ 		if (!event)
+@@ -96,7 +98,7 @@
+ 		memcpy((void *) t + sizeof(*t), data, len);
+ 
+ 		if (blk_tracer)
+-			trace_buffer_unlock_commit(blk_tr, event, 0, pc);
++			trace_buffer_unlock_commit(buffer, event, 0, pc);
+ 	}
+ }
+ 
+@@ -179,6 +181,7 @@
+ {
+ 	struct task_struct *tsk = current;
+ 	struct ring_buffer_event *event = NULL;
++	struct ring_buffer *buffer = NULL;
+ 	struct blk_io_trace *t;
+ 	unsigned long flags = 0;
+ 	unsigned long *sequence;
+@@ -204,8 +207,9 @@
+ 	if (blk_tracer) {
+ 		tracing_record_cmdline(current);
+ 
++		buffer = blk_tr->buffer;
+ 		pc = preempt_count();
+-		event = trace_buffer_lock_reserve(blk_tr, TRACE_BLK,
++		event = trace_buffer_lock_reserve(buffer, TRACE_BLK,
+ 						  sizeof(*t) + pdu_len,
+ 						  0, pc);
+ 		if (!event)
+@@ -252,7 +256,7 @@
+ 			memcpy((void *) t + sizeof(*t), pdu_data, pdu_len);
+ 
+ 		if (blk_tracer) {
+-			trace_buffer_unlock_commit(blk_tr, event, 0, pc);
++			trace_buffer_unlock_commit(buffer, event, 0, pc);
+ 			return;
+ 		}
+ 	}
+Index: linux-rt-2.6.31/kernel/trace/ftrace.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/trace/ftrace.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/kernel/trace/ftrace.c	2010-05-17 14:23:20.118466134 +0200
+@@ -377,7 +377,8 @@
+ #ifdef CONFIG_FUNCTION_GRAPH_TRACER
+ 	seq_printf(m, "    ");
+ 	avg = rec->time;
+-	do_div(avg, rec->counter);
++	if (rec->counter)
++		do_div(avg, rec->counter);
+ 
+ 	mutex_lock(&mutex);
+ 	trace_seq_init(&s);
+@@ -1016,71 +1017,35 @@
+ __ftrace_replace_code(struct dyn_ftrace *rec, int enable)
+ {
+ 	unsigned long ftrace_addr;
+-	unsigned long ip, fl;
++	unsigned long flag = 0UL;
+ 
+ 	ftrace_addr = (unsigned long)FTRACE_ADDR;
+ 
+-	ip = rec->ip;
+-
+ 	/*
+-	 * If this record is not to be traced and
+-	 * it is not enabled then do nothing.
++	 * If this record is not to be traced or we want to disable it,
++	 * then disable it.
+ 	 *
+-	 * If this record is not to be traced and
+-	 * it is enabled then disable it.
++	 * If we want to enable it and filtering is off, then enable it.
+ 	 *
++	 * If we want to enable it and filtering is on, enable it only if
++	 * it's filtered
+ 	 */
+-	if (rec->flags & FTRACE_FL_NOTRACE) {
+-		if (rec->flags & FTRACE_FL_ENABLED)
+-			rec->flags &= ~FTRACE_FL_ENABLED;
+-		else
+-			return 0;
+-
+-	} else if (ftrace_filtered && enable) {
+-		/*
+-		 * Filtering is on:
+-		 */
+-
+-		fl = rec->flags & (FTRACE_FL_FILTER | FTRACE_FL_ENABLED);
+-
+-		/* Record is filtered and enabled, do nothing */
+-		if (fl == (FTRACE_FL_FILTER | FTRACE_FL_ENABLED))
+-			return 0;
+-
+-		/* Record is not filtered or enabled, do nothing */
+-		if (!fl)
+-			return 0;
+-
+-		/* Record is not filtered but enabled, disable it */
+-		if (fl == FTRACE_FL_ENABLED)
+-			rec->flags &= ~FTRACE_FL_ENABLED;
+-		else
+-		/* Otherwise record is filtered but not enabled, enable it */
+-			rec->flags |= FTRACE_FL_ENABLED;
+-	} else {
+-		/* Disable or not filtered */
+-
+-		if (enable) {
+-			/* if record is enabled, do nothing */
+-			if (rec->flags & FTRACE_FL_ENABLED)
+-				return 0;
+-
+-			rec->flags |= FTRACE_FL_ENABLED;
+-
+-		} else {
++	if (enable && !(rec->flags & FTRACE_FL_NOTRACE)) {
++		if (!ftrace_filtered || (rec->flags & FTRACE_FL_FILTER))
++			flag = FTRACE_FL_ENABLED;
++	}
+ 
+-			/* if record is not enabled, do nothing */
+-			if (!(rec->flags & FTRACE_FL_ENABLED))
+-				return 0;
++	/* If the state of this record hasn't changed, then do nothing */
++	if ((rec->flags & FTRACE_FL_ENABLED) == flag)
++		return 0;
+ 
+-			rec->flags &= ~FTRACE_FL_ENABLED;
+-		}
++	if (flag) {
++		rec->flags |= FTRACE_FL_ENABLED;
++		return ftrace_make_call(rec, ftrace_addr);
+ 	}
+ 
+-	if (rec->flags & FTRACE_FL_ENABLED)
+-		return ftrace_make_call(rec, ftrace_addr);
+-	else
+-		return ftrace_make_nop(NULL, rec, ftrace_addr);
++	rec->flags &= ~FTRACE_FL_ENABLED;
++	return ftrace_make_nop(NULL, rec, ftrace_addr);
+ }
+ 
+ static void ftrace_replace_code(int enable)
+@@ -1354,11 +1319,10 @@
+ 
+ enum {
+ 	FTRACE_ITER_FILTER	= (1 << 0),
+-	FTRACE_ITER_CONT	= (1 << 1),
+-	FTRACE_ITER_NOTRACE	= (1 << 2),
+-	FTRACE_ITER_FAILURES	= (1 << 3),
+-	FTRACE_ITER_PRINTALL	= (1 << 4),
+-	FTRACE_ITER_HASH	= (1 << 5),
++	FTRACE_ITER_NOTRACE	= (1 << 1),
++	FTRACE_ITER_FAILURES	= (1 << 2),
++	FTRACE_ITER_PRINTALL	= (1 << 3),
++	FTRACE_ITER_HASH	= (1 << 4),
+ };
+ 
+ #define FTRACE_BUFF_MAX (KSYM_SYMBOL_LEN+4) /* room for wildcards */
+@@ -1368,9 +1332,7 @@
+ 	int			hidx;
+ 	int			idx;
+ 	unsigned		flags;
+-	unsigned char		buffer[FTRACE_BUFF_MAX+1];
+-	unsigned		buffer_idx;
+-	unsigned		filtered;
++	struct trace_parser	parser;
+ };
+ 
+ static void *
+@@ -1433,18 +1395,13 @@
+ {
+ 	struct ftrace_func_probe *rec;
+ 	struct hlist_node *hnd = v;
+-	char str[KSYM_SYMBOL_LEN];
+ 
+ 	rec = hlist_entry(hnd, struct ftrace_func_probe, node);
+ 
+ 	if (rec->ops->print)
+ 		return rec->ops->print(m, rec->ip, rec->ops, rec->data);
+ 
+-	kallsyms_lookup(rec->ip, NULL, NULL, NULL, str);
+-	seq_printf(m, "%s:", str);
+-
+-	kallsyms_lookup((unsigned long)rec->ops->func, NULL, NULL, NULL, str);
+-	seq_printf(m, "%s", str);
++	seq_printf(m, "%pf:%pf", (void *)rec->ip, (void *)rec->ops->func);
+ 
+ 	if (rec->data)
+ 		seq_printf(m, ":%p", rec->data);
+@@ -1542,7 +1499,6 @@
+ {
+ 	struct ftrace_iterator *iter = m->private;
+ 	struct dyn_ftrace *rec = v;
+-	char str[KSYM_SYMBOL_LEN];
+ 
+ 	if (iter->flags & FTRACE_ITER_HASH)
+ 		return t_hash_show(m, v);
+@@ -1555,9 +1511,7 @@
+ 	if (!rec)
+ 		return 0;
+ 
+-	kallsyms_lookup(rec->ip, NULL, NULL, NULL, str);
+-
+-	seq_printf(m, "%s\n", str);
++	seq_printf(m, "%pf\n", (void *)rec->ip);
+ 
+ 	return 0;
+ }
+@@ -1596,17 +1550,6 @@
+ 	return ret;
+ }
+ 
+-int ftrace_avail_release(struct inode *inode, struct file *file)
+-{
+-	struct seq_file *m = (struct seq_file *)file->private_data;
+-	struct ftrace_iterator *iter = m->private;
+-
+-	seq_release(inode, file);
+-	kfree(iter);
+-
+-	return 0;
+-}
+-
+ static int
+ ftrace_failures_open(struct inode *inode, struct file *file)
+ {
+@@ -1655,6 +1598,11 @@
+ 	if (!iter)
+ 		return -ENOMEM;
+ 
++	if (trace_parser_get_init(&iter->parser, FTRACE_BUFF_MAX)) {
++		kfree(iter);
++		return -ENOMEM;
++	}
++
+ 	mutex_lock(&ftrace_regex_lock);
+ 	if ((file->f_mode & FMODE_WRITE) &&
+ 	    (file->f_flags & O_TRUNC))
+@@ -2247,9 +2195,8 @@
+ 		   size_t cnt, loff_t *ppos, int enable)
+ {
+ 	struct ftrace_iterator *iter;
+-	char ch;
+-	size_t read = 0;
+-	ssize_t ret;
++	struct trace_parser *parser;
++	ssize_t ret, read;
+ 
+ 	if (!cnt || cnt < 0)
+ 		return 0;
+@@ -2262,73 +2209,23 @@
+ 	} else
+ 		iter = file->private_data;
+ 
+-	if (!*ppos) {
+-		iter->flags &= ~FTRACE_ITER_CONT;
+-		iter->buffer_idx = 0;
+-	}
+-
+-	ret = get_user(ch, ubuf++);
+-	if (ret)
+-		goto out;
+-	read++;
+-	cnt--;
+-
+-	/*
+-	 * If the parser haven't finished with the last write,
+-	 * continue reading the user input without skipping spaces.
+-	 */
+-	if (!(iter->flags & FTRACE_ITER_CONT)) {
+-		/* skip white space */
+-		while (cnt && isspace(ch)) {
+-			ret = get_user(ch, ubuf++);
+-			if (ret)
+-				goto out;
+-			read++;
+-			cnt--;
+-		}
+-
+-		/* only spaces were written */
+-		if (isspace(ch)) {
+-			*ppos += read;
+-			ret = read;
+-			goto out;
+-		}
++	parser = &iter->parser;
++	read = trace_get_user(parser, ubuf, cnt, ppos);
+ 
+-		iter->buffer_idx = 0;
+-	}
+-
+-	while (cnt && !isspace(ch)) {
+-		if (iter->buffer_idx < FTRACE_BUFF_MAX)
+-			iter->buffer[iter->buffer_idx++] = ch;
+-		else {
+-			ret = -EINVAL;
+-			goto out;
+-		}
+-		ret = get_user(ch, ubuf++);
++	if (trace_parser_loaded(parser) &&
++	    !trace_parser_cont(parser)) {
++		ret = ftrace_process_regex(parser->buffer,
++					   parser->idx, enable);
+ 		if (ret)
+ 			goto out;
+-		read++;
+-		cnt--;
+-	}
+ 
+-	if (isspace(ch)) {
+-		iter->filtered++;
+-		iter->buffer[iter->buffer_idx] = 0;
+-		ret = ftrace_process_regex(iter->buffer,
+-					   iter->buffer_idx, enable);
+-		if (ret)
+-			goto out;
+-		iter->buffer_idx = 0;
+-	} else {
+-		iter->flags |= FTRACE_ITER_CONT;
+-		iter->buffer[iter->buffer_idx++] = ch;
++		trace_parser_clear(parser);
+ 	}
+ 
+-	*ppos += read;
+ 	ret = read;
+- out:
+-	mutex_unlock(&ftrace_regex_lock);
+ 
++	mutex_unlock(&ftrace_regex_lock);
++out:
+ 	return ret;
+ }
+ 
+@@ -2433,6 +2330,7 @@
+ {
+ 	struct seq_file *m = (struct seq_file *)file->private_data;
+ 	struct ftrace_iterator *iter;
++	struct trace_parser *parser;
+ 
+ 	mutex_lock(&ftrace_regex_lock);
+ 	if (file->f_mode & FMODE_READ) {
+@@ -2442,10 +2340,10 @@
+ 	} else
+ 		iter = file->private_data;
+ 
+-	if (iter->buffer_idx) {
+-		iter->filtered++;
+-		iter->buffer[iter->buffer_idx] = 0;
+-		ftrace_match_records(iter->buffer, iter->buffer_idx, enable);
++	parser = &iter->parser;
++	if (trace_parser_loaded(parser)) {
++		parser->buffer[parser->idx] = 0;
++		ftrace_match_records(parser->buffer, parser->idx, enable);
+ 	}
+ 
+ 	mutex_lock(&ftrace_lock);
+@@ -2453,7 +2351,9 @@
+ 		ftrace_run_update_code(FTRACE_ENABLE_CALLS);
+ 	mutex_unlock(&ftrace_lock);
+ 
++	trace_parser_put(parser);
+ 	kfree(iter);
++
+ 	mutex_unlock(&ftrace_regex_lock);
+ 	return 0;
+ }
+@@ -2474,14 +2374,14 @@
+ 	.open = ftrace_avail_open,
+ 	.read = seq_read,
+ 	.llseek = seq_lseek,
+-	.release = ftrace_avail_release,
++	.release = seq_release_private,
+ };
+ 
+ static const struct file_operations ftrace_failures_fops = {
+ 	.open = ftrace_failures_open,
+ 	.read = seq_read,
+ 	.llseek = seq_lseek,
+-	.release = ftrace_avail_release,
++	.release = seq_release_private,
+ };
+ 
+ static const struct file_operations ftrace_filter_fops = {
+@@ -2543,7 +2443,6 @@
+ static int g_show(struct seq_file *m, void *v)
+ {
+ 	unsigned long *ptr = v;
+-	char str[KSYM_SYMBOL_LEN];
+ 
+ 	if (!ptr)
+ 		return 0;
+@@ -2553,9 +2452,7 @@
+ 		return 0;
+ 	}
+ 
+-	kallsyms_lookup(*ptr, NULL, NULL, NULL, str);
+-
+-	seq_printf(m, "%s\n", str);
++	seq_printf(m, "%pf\n", (void *)*ptr);
+ 
+ 	return 0;
+ }
+@@ -2658,12 +2555,10 @@
+ ftrace_graph_write(struct file *file, const char __user *ubuf,
+ 		   size_t cnt, loff_t *ppos)
+ {
+-	unsigned char buffer[FTRACE_BUFF_MAX+1];
++	struct trace_parser parser;
+ 	unsigned long *array;
+ 	size_t read = 0;
+ 	ssize_t ret;
+-	int index = 0;
+-	char ch;
+ 
+ 	if (!cnt || cnt < 0)
+ 		return 0;
+@@ -2681,51 +2576,26 @@
+ 	} else
+ 		array = file->private_data;
+ 
+-	ret = get_user(ch, ubuf++);
+-	if (ret)
++	if (trace_parser_get_init(&parser, FTRACE_BUFF_MAX)) {
++		ret = -ENOMEM;
+ 		goto out;
+-	read++;
+-	cnt--;
+-
+-	/* skip white space */
+-	while (cnt && isspace(ch)) {
+-		ret = get_user(ch, ubuf++);
+-		if (ret)
+-			goto out;
+-		read++;
+-		cnt--;
+ 	}
+ 
+-	if (isspace(ch)) {
+-		*ppos += read;
+-		ret = read;
+-		goto out;
+-	}
++	read = trace_get_user(&parser, ubuf, cnt, ppos);
+ 
+-	while (cnt && !isspace(ch)) {
+-		if (index < FTRACE_BUFF_MAX)
+-			buffer[index++] = ch;
+-		else {
+-			ret = -EINVAL;
+-			goto out;
+-		}
+-		ret = get_user(ch, ubuf++);
++	if (trace_parser_loaded((&parser))) {
++		parser.buffer[parser.idx] = 0;
++
++		/* we allow only one expression at a time */
++		ret = ftrace_set_func(array, &ftrace_graph_count,
++					parser.buffer);
+ 		if (ret)
+ 			goto out;
+-		read++;
+-		cnt--;
+ 	}
+-	buffer[index] = 0;
+-
+-	/* we allow only one expression at a time */
+-	ret = ftrace_set_func(array, &ftrace_graph_count, buffer);
+-	if (ret)
+-		goto out;
+-
+-	file->f_pos += read;
+ 
+ 	ret = read;
+  out:
++	trace_parser_put(&parser);
+ 	mutex_unlock(&graph_lock);
+ 
+ 	return ret;
+Index: linux-rt-2.6.31/kernel/trace/kmemtrace.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/trace/kmemtrace.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/trace/kmemtrace.c	2010-05-17 14:23:20.118466134 +0200
+@@ -183,11 +183,9 @@
+ 
+ static int kmem_trace_init(struct trace_array *tr)
+ {
+-	int cpu;
+ 	kmemtrace_array = tr;
+ 
+-	for_each_cpu(cpu, cpu_possible_mask)
+-		tracing_reset(tr, cpu);
++	tracing_reset_online_cpus(tr);
+ 
+ 	kmemtrace_start_probes();
+ 
+@@ -239,12 +237,52 @@
+ };
+ 
+ static enum print_line_t
+-kmemtrace_print_alloc_user(struct trace_iterator *iter,
+-			   struct kmemtrace_alloc_entry *entry)
++kmemtrace_print_alloc(struct trace_iterator *iter, int flags)
++{
++	struct trace_seq *s = &iter->seq;
++	struct kmemtrace_alloc_entry *entry;
++	int ret;
++
++	trace_assign_type(entry, iter->ent);
++
++	ret = trace_seq_printf(s, "type_id %d call_site %pF ptr %lu "
++	    "bytes_req %lu bytes_alloc %lu gfp_flags %lu node %d\n",
++	    entry->type_id, (void *)entry->call_site, (unsigned long)entry->ptr,
++	    (unsigned long)entry->bytes_req, (unsigned long)entry->bytes_alloc,
++	    (unsigned long)entry->gfp_flags, entry->node);
++
++	if (!ret)
++		return TRACE_TYPE_PARTIAL_LINE;
++	return TRACE_TYPE_HANDLED;
++}
++
++static enum print_line_t
++kmemtrace_print_free(struct trace_iterator *iter, int flags)
++{
++	struct trace_seq *s = &iter->seq;
++	struct kmemtrace_free_entry *entry;
++	int ret;
++
++	trace_assign_type(entry, iter->ent);
++
++	ret = trace_seq_printf(s, "type_id %d call_site %pF ptr %lu\n",
++			       entry->type_id, (void *)entry->call_site,
++			       (unsigned long)entry->ptr);
++
++	if (!ret)
++		return TRACE_TYPE_PARTIAL_LINE;
++	return TRACE_TYPE_HANDLED;
++}
++
++static enum print_line_t
++kmemtrace_print_alloc_user(struct trace_iterator *iter, int flags)
+ {
+-	struct kmemtrace_user_event_alloc *ev_alloc;
+ 	struct trace_seq *s = &iter->seq;
++	struct kmemtrace_alloc_entry *entry;
+ 	struct kmemtrace_user_event *ev;
++	struct kmemtrace_user_event_alloc *ev_alloc;
++
++	trace_assign_type(entry, iter->ent);
+ 
+ 	ev = trace_seq_reserve(s, sizeof(*ev));
+ 	if (!ev)
+@@ -271,12 +309,14 @@
+ }
+ 
+ static enum print_line_t
+-kmemtrace_print_free_user(struct trace_iterator *iter,
+-			  struct kmemtrace_free_entry *entry)
++kmemtrace_print_free_user(struct trace_iterator *iter, int flags)
+ {
+ 	struct trace_seq *s = &iter->seq;
++	struct kmemtrace_free_entry *entry;
+ 	struct kmemtrace_user_event *ev;
+ 
++	trace_assign_type(entry, iter->ent);
++
+ 	ev = trace_seq_reserve(s, sizeof(*ev));
+ 	if (!ev)
+ 		return TRACE_TYPE_PARTIAL_LINE;
+@@ -294,12 +334,14 @@
+ 
+ /* The two other following provide a more minimalistic output */
+ static enum print_line_t
+-kmemtrace_print_alloc_compress(struct trace_iterator *iter,
+-					struct kmemtrace_alloc_entry *entry)
++kmemtrace_print_alloc_compress(struct trace_iterator *iter)
+ {
++	struct kmemtrace_alloc_entry *entry;
+ 	struct trace_seq *s = &iter->seq;
+ 	int ret;
+ 
++	trace_assign_type(entry, iter->ent);
++
+ 	/* Alloc entry */
+ 	ret = trace_seq_printf(s, "  +      ");
+ 	if (!ret)
+@@ -345,29 +387,24 @@
+ 	if (!ret)
+ 		return TRACE_TYPE_PARTIAL_LINE;
+ 
+-	/* Node */
+-	ret = trace_seq_printf(s, "%4d   ", entry->node);
+-	if (!ret)
+-		return TRACE_TYPE_PARTIAL_LINE;
+-
+-	/* Call site */
+-	ret = seq_print_ip_sym(s, entry->call_site, 0);
++	/* Node and call site*/
++	ret = trace_seq_printf(s, "%4d   %pf\n", entry->node,
++						 (void *)entry->call_site);
+ 	if (!ret)
+ 		return TRACE_TYPE_PARTIAL_LINE;
+ 
+-	if (!trace_seq_printf(s, "\n"))
+-		return TRACE_TYPE_PARTIAL_LINE;
+-
+ 	return TRACE_TYPE_HANDLED;
+ }
+ 
+ static enum print_line_t
+-kmemtrace_print_free_compress(struct trace_iterator *iter,
+-			      struct kmemtrace_free_entry *entry)
++kmemtrace_print_free_compress(struct trace_iterator *iter)
+ {
++	struct kmemtrace_free_entry *entry;
+ 	struct trace_seq *s = &iter->seq;
+ 	int ret;
+ 
++	trace_assign_type(entry, iter->ent);
++
+ 	/* Free entry */
+ 	ret = trace_seq_printf(s, "  -      ");
+ 	if (!ret)
+@@ -401,19 +438,11 @@
+ 	if (!ret)
+ 		return TRACE_TYPE_PARTIAL_LINE;
+ 
+-	/* Skip node */
+-	ret = trace_seq_printf(s, "       ");
+-	if (!ret)
+-		return TRACE_TYPE_PARTIAL_LINE;
+-
+-	/* Call site */
+-	ret = seq_print_ip_sym(s, entry->call_site, 0);
++	/* Skip node and print call site*/
++	ret = trace_seq_printf(s, "       %pf\n", (void *)entry->call_site);
+ 	if (!ret)
+ 		return TRACE_TYPE_PARTIAL_LINE;
+ 
+-	if (!trace_seq_printf(s, "\n"))
+-		return TRACE_TYPE_PARTIAL_LINE;
+-
+ 	return TRACE_TYPE_HANDLED;
+ }
+ 
+@@ -421,32 +450,31 @@
+ {
+ 	struct trace_entry *entry = iter->ent;
+ 
+-	switch (entry->type) {
+-	case TRACE_KMEM_ALLOC: {
+-		struct kmemtrace_alloc_entry *field;
+-
+-		trace_assign_type(field, entry);
+-		if (kmem_tracer_flags.val & TRACE_KMEM_OPT_MINIMAL)
+-			return kmemtrace_print_alloc_compress(iter, field);
+-		else
+-			return kmemtrace_print_alloc_user(iter, field);
+-	}
+-
+-	case TRACE_KMEM_FREE: {
+-		struct kmemtrace_free_entry *field;
+-
+-		trace_assign_type(field, entry);
+-		if (kmem_tracer_flags.val & TRACE_KMEM_OPT_MINIMAL)
+-			return kmemtrace_print_free_compress(iter, field);
+-		else
+-			return kmemtrace_print_free_user(iter, field);
+-	}
++	if (!(kmem_tracer_flags.val & TRACE_KMEM_OPT_MINIMAL))
++		return TRACE_TYPE_UNHANDLED;
+ 
++	switch (entry->type) {
++	case TRACE_KMEM_ALLOC:
++		return kmemtrace_print_alloc_compress(iter);
++	case TRACE_KMEM_FREE:
++		return kmemtrace_print_free_compress(iter);
+ 	default:
+ 		return TRACE_TYPE_UNHANDLED;
+ 	}
+ }
+ 
++static struct trace_event kmem_trace_alloc = {
++	.type			= TRACE_KMEM_ALLOC,
++	.trace			= kmemtrace_print_alloc,
++	.binary			= kmemtrace_print_alloc_user,
++};
++
++static struct trace_event kmem_trace_free = {
++	.type			= TRACE_KMEM_FREE,
++	.trace			= kmemtrace_print_free,
++	.binary			= kmemtrace_print_free_user,
++};
++
+ static struct tracer kmem_tracer __read_mostly = {
+ 	.name			= "kmemtrace",
+ 	.init			= kmem_trace_init,
+@@ -463,6 +491,21 @@
+ 
+ static int __init init_kmem_tracer(void)
+ {
+-	return register_tracer(&kmem_tracer);
++	if (!register_ftrace_event(&kmem_trace_alloc)) {
++		pr_warning("Warning: could not register kmem events\n");
++		return 1;
++	}
++
++	if (!register_ftrace_event(&kmem_trace_free)) {
++		pr_warning("Warning: could not register kmem events\n");
++		return 1;
++	}
++
++	if (!register_tracer(&kmem_tracer)) {
++		pr_warning("Warning: could not register the kmem tracer\n");
++		return 1;
++	}
++
++	return 0;
+ }
+ device_initcall(init_kmem_tracer);
+Index: linux-rt-2.6.31/kernel/trace/latency_hist.c
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ linux-rt-2.6.31/kernel/trace/latency_hist.c	2010-05-17 14:23:20.118466134 +0200
+@@ -0,0 +1,1035 @@
++/*
++ * kernel/trace/latency_hist.c
++ *
++ * Add support for histograms of preemption-off latency and
++ * interrupt-off latency and wakeup latency, it depends on
++ * Real-Time Preemption Support.
++ *
++ *  Copyright (C) 2005 MontaVista Software, Inc.
++ *  Yi Yang <yyang@ch.mvista.com>
++ *
++ *  Converted to work with the new latency tracer.
++ *  Copyright (C) 2008 Red Hat, Inc.
++ *    Steven Rostedt <srostedt@redhat.com>
++ *
++ */
++#include <linux/module.h>
++#include <linux/debugfs.h>
++#include <linux/seq_file.h>
++#include <linux/percpu.h>
++#include <linux/kallsyms.h>
++#include <linux/uaccess.h>
++#include <linux/sched.h>
++#include <asm/atomic.h>
++#include <asm/div64.h>
++
++#include "trace.h"
++#include <trace/events/sched.h>
++
++#define CREATE_TRACE_POINTS
++#include <trace/events/hist.h>
++
++enum {
++	IRQSOFF_LATENCY = 0,
++	PREEMPTOFF_LATENCY,
++	PREEMPTIRQSOFF_LATENCY,
++	WAKEUP_LATENCY,
++	WAKEUP_LATENCY_SHAREDPRIO,
++	MISSED_TIMER_OFFSETS,
++	MAX_LATENCY_TYPE,
++};
++
++#define MAX_ENTRY_NUM 10240
++
++struct hist_data {
++	atomic_t hist_mode; /* 0 log, 1 don't log */
++	long offset; /* set it to MAX_ENTRY_NUM/2 for a bipolar scale */
++	unsigned long min_lat;
++	unsigned long max_lat;
++	unsigned long long below_hist_bound_samples;
++	unsigned long long above_hist_bound_samples;
++	unsigned long long accumulate_lat;
++	unsigned long long total_samples;
++	unsigned long long hist_array[MAX_ENTRY_NUM];
++};
++
++struct enable_data {
++	int latency_type;
++	int enabled;
++};
++
++static char *latency_hist_dir_root = "latency_hist";
++
++#ifdef CONFIG_INTERRUPT_OFF_HIST
++static DEFINE_PER_CPU(struct hist_data, irqsoff_hist);
++static char *irqsoff_hist_dir = "irqsoff";
++static DEFINE_PER_CPU(cycles_t, hist_irqsoff_start);
++static DEFINE_PER_CPU(int, hist_irqsoff_counting);
++#endif
++
++#ifdef CONFIG_PREEMPT_OFF_HIST
++static DEFINE_PER_CPU(struct hist_data, preemptoff_hist);
++static char *preemptoff_hist_dir = "preemptoff";
++static DEFINE_PER_CPU(cycles_t, hist_preemptoff_start);
++static DEFINE_PER_CPU(int, hist_preemptoff_counting);
++#endif
++
++#if defined(CONFIG_PREEMPT_OFF_HIST) && defined(CONFIG_INTERRUPT_OFF_HIST)
++static DEFINE_PER_CPU(struct hist_data, preemptirqsoff_hist);
++static char *preemptirqsoff_hist_dir = "preemptirqsoff";
++static DEFINE_PER_CPU(cycles_t, hist_preemptirqsoff_start);
++static DEFINE_PER_CPU(int, hist_preemptirqsoff_counting);
++#endif
++
++#if defined(CONFIG_PREEMPT_OFF_HIST) || defined(CONFIG_INTERRUPT_OFF_HIST)
++static notrace void probe_preemptirqsoff_hist(int reason, int start);
++static struct enable_data preemptirqsoff_enabled_data = {
++	.latency_type = PREEMPTIRQSOFF_LATENCY,
++	.enabled = 0,
++};
++#endif
++
++#if defined(CONFIG_WAKEUP_LATENCY_HIST) || \
++    defined(CONFIG_MISSED_TIMER_OFFSETS_HIST)
++struct maxlatproc_data {
++	char comm[FIELD_SIZEOF(struct task_struct, comm)];
++	int pid;
++	int prio;
++	long latency;
++};
++#endif
++
++#ifdef CONFIG_WAKEUP_LATENCY_HIST
++static DEFINE_PER_CPU(struct hist_data, wakeup_latency_hist);
++static DEFINE_PER_CPU(struct hist_data, wakeup_latency_hist_sharedprio);
++static char *wakeup_latency_hist_dir = "wakeup";
++static char *wakeup_latency_hist_dir_sharedprio = "sharedprio";
++static notrace void probe_wakeup_latency_hist_start(struct rq *rq,
++    struct task_struct *p, int success);
++static notrace void probe_wakeup_latency_hist_stop(struct rq *rq,
++    struct task_struct *prev, struct task_struct *next);
++static notrace void probe_sched_migrate_task(struct task_struct *task,
++    int cpu);
++static struct enable_data wakeup_latency_enabled_data = {
++	.latency_type = WAKEUP_LATENCY,
++	.enabled = 0,
++};
++static DEFINE_PER_CPU(struct maxlatproc_data, wakeup_maxlatproc);
++static DEFINE_PER_CPU(struct maxlatproc_data, wakeup_maxlatproc_sharedprio);
++static DEFINE_PER_CPU(struct task_struct *, wakeup_task);
++static DEFINE_PER_CPU(int, wakeup_sharedprio);
++static unsigned long wakeup_pid;
++#endif
++
++#ifdef CONFIG_MISSED_TIMER_OFFSETS_HIST
++static DEFINE_PER_CPU(struct hist_data, missed_timer_offsets);
++static char *missed_timer_offsets_dir = "missed_timer_offsets";
++static notrace void probe_hrtimer_interrupt(int cpu,
++    long long offset, struct task_struct *curr, struct task_struct *task);
++static struct enable_data missed_timer_offsets_enabled_data = {
++	.latency_type = MISSED_TIMER_OFFSETS,
++	.enabled = 0,
++};
++static DEFINE_PER_CPU(struct maxlatproc_data, missed_timer_offsets_maxlatproc);
++static unsigned long missed_timer_offsets_pid;
++#endif
++
++void notrace latency_hist(int latency_type, int cpu, unsigned long latency,
++			  struct task_struct *p)
++{
++	struct hist_data *my_hist;
++#if defined(CONFIG_WAKEUP_LATENCY_HIST) || \
++    defined(CONFIG_MISSED_TIMER_OFFSETS_HIST)
++	struct maxlatproc_data *mp = NULL;
++#endif
++
++	if (cpu < 0 || cpu >= NR_CPUS || latency_type < 0 ||
++	    latency_type >= MAX_LATENCY_TYPE)
++		return;
++
++	switch (latency_type) {
++#ifdef CONFIG_INTERRUPT_OFF_HIST
++	case IRQSOFF_LATENCY:
++		my_hist = &per_cpu(irqsoff_hist, cpu);
++		break;
++#endif
++#ifdef CONFIG_PREEMPT_OFF_HIST
++	case PREEMPTOFF_LATENCY:
++		my_hist = &per_cpu(preemptoff_hist, cpu);
++		break;
++#endif
++#if defined(CONFIG_PREEMPT_OFF_HIST) && defined(CONFIG_INTERRUPT_OFF_HIST)
++	case PREEMPTIRQSOFF_LATENCY:
++		my_hist = &per_cpu(preemptirqsoff_hist, cpu);
++		break;
++#endif
++#ifdef CONFIG_WAKEUP_LATENCY_HIST
++	case WAKEUP_LATENCY:
++		my_hist = &per_cpu(wakeup_latency_hist, cpu);
++		mp = &per_cpu(wakeup_maxlatproc, cpu);
++		break;
++	case WAKEUP_LATENCY_SHAREDPRIO:
++		my_hist = &per_cpu(wakeup_latency_hist_sharedprio, cpu);
++		mp = &per_cpu(wakeup_maxlatproc_sharedprio, cpu);
++		break;
++#endif
++#ifdef CONFIG_MISSED_TIMER_OFFSETS_HIST
++	case MISSED_TIMER_OFFSETS:
++		my_hist = &per_cpu(missed_timer_offsets, cpu);
++		mp = &per_cpu(missed_timer_offsets_maxlatproc, cpu);
++		break;
++#endif
++	default:
++		return;
++	}
++
++	if (atomic_read(&my_hist->hist_mode) == 0)
++		return;
++
++	latency += my_hist->offset;
++
++	if (latency < 0 || latency >= MAX_ENTRY_NUM) {
++		if (latency < 0)
++			my_hist->below_hist_bound_samples++;
++		else
++			my_hist->above_hist_bound_samples++;
++	} else
++		my_hist->hist_array[latency]++;
++
++	if (latency < my_hist->min_lat)
++		my_hist->min_lat = latency;
++	if (latency > my_hist->max_lat) {
++#if defined(CONFIG_WAKEUP_LATENCY_HIST) || \
++    defined(CONFIG_MISSED_TIMER_OFFSETS_HIST)
++		if (latency_type == WAKEUP_LATENCY ||
++		    latency_type == WAKEUP_LATENCY_SHAREDPRIO ||
++		    latency_type == MISSED_TIMER_OFFSETS) {
++			strncpy(mp->comm, p->comm, sizeof(mp->comm));
++			mp->pid = task_pid_nr(p);
++			mp->prio = p->prio;
++			mp->latency = latency;
++		}
++#endif
++		my_hist->max_lat = latency;
++	}
++	my_hist->total_samples++;
++	my_hist->accumulate_lat += latency;
++}
++
++static void *l_start(struct seq_file *m, loff_t *pos)
++{
++	loff_t *index_ptr = kmalloc(sizeof(loff_t), GFP_KERNEL);
++	loff_t index = *pos;
++	struct hist_data *my_hist = m->private;
++
++	if (!index_ptr)
++		return NULL;
++
++	if (index == 0) {
++		char minstr[32], avgstr[32], maxstr[32];
++
++		atomic_dec(&my_hist->hist_mode);
++
++		if (likely(my_hist->total_samples)) {
++			unsigned long avg = (unsigned long)
++			    div64_u64(my_hist->accumulate_lat,
++			    my_hist->total_samples);
++			snprintf(minstr, sizeof(minstr), "%ld",
++			    (long) my_hist->min_lat - my_hist->offset);
++			snprintf(avgstr, sizeof(avgstr), "%ld",
++			    (long) avg - my_hist->offset);
++			snprintf(maxstr, sizeof(maxstr), "%ld",
++			    (long) my_hist->max_lat - my_hist->offset);
++		} else {
++			strcpy(minstr, "<undef>");
++			strcpy(avgstr, minstr);
++			strcpy(maxstr, minstr);
++		}
++
++		seq_printf(m, "#Minimum latency: %s microseconds\n"
++			   "#Average latency: %s microseconds\n"
++			   "#Maximum latency: %s microseconds\n"
++			   "#Total samples: %llu\n"
++			   "#There are %llu samples lower than %ld"
++			   " microseconds.\n"
++			   "#There are %llu samples greater or equal"
++			   " than %ld microseconds.\n"
++			   "#usecs\t%16s\n",
++			   minstr, avgstr, maxstr,
++			   my_hist->total_samples,
++			   my_hist->below_hist_bound_samples,
++			   -my_hist->offset,
++			   my_hist->above_hist_bound_samples,
++			   MAX_ENTRY_NUM - my_hist->offset,
++			   "samples");
++	}
++	if (index >= MAX_ENTRY_NUM)
++		return NULL;
++
++	*index_ptr = index;
++	return index_ptr;
++}
++
++static void *l_next(struct seq_file *m, void *p, loff_t *pos)
++{
++	loff_t *index_ptr = p;
++	struct hist_data *my_hist = m->private;
++
++	if (++*pos >= MAX_ENTRY_NUM) {
++		atomic_inc(&my_hist->hist_mode);
++		return NULL;
++	}
++	*index_ptr = *pos;
++	return index_ptr;
++}
++
++static void l_stop(struct seq_file *m, void *p)
++{
++	kfree(p);
++}
++
++static int l_show(struct seq_file *m, void *p)
++{
++	int index = *(loff_t *) p;
++	struct hist_data *my_hist = m->private;
++
++	seq_printf(m, "%6ld\t%16llu\n", index - my_hist->offset,
++	    my_hist->hist_array[index]);
++	return 0;
++}
++
++static struct seq_operations latency_hist_seq_op = {
++	.start = l_start,
++	.next  = l_next,
++	.stop  = l_stop,
++	.show  = l_show
++};
++
++static int latency_hist_open(struct inode *inode, struct file *file)
++{
++	int ret;
++
++	ret = seq_open(file, &latency_hist_seq_op);
++	if (!ret) {
++		struct seq_file *seq = file->private_data;
++		seq->private = inode->i_private;
++	}
++	return ret;
++}
++
++static struct file_operations latency_hist_fops = {
++	.open = latency_hist_open,
++	.read = seq_read,
++	.llseek = seq_lseek,
++	.release = seq_release,
++};
++
++static void hist_reset(struct hist_data *hist)
++{
++	atomic_dec(&hist->hist_mode);
++
++	memset(hist->hist_array, 0, sizeof(hist->hist_array));
++	hist->below_hist_bound_samples = 0ULL;
++	hist->above_hist_bound_samples = 0ULL;
++	hist->min_lat = 0xFFFFFFFFUL;
++	hist->max_lat = 0UL;
++	hist->total_samples = 0ULL;
++	hist->accumulate_lat = 0ULL;
++
++	atomic_inc(&hist->hist_mode);
++}
++
++static ssize_t
++latency_hist_reset(struct file *file, const char __user *a,
++		   size_t size, loff_t *off)
++{
++	int cpu;
++	struct hist_data *hist = NULL;
++#if defined(CONFIG_WAKEUP_LATENCY_HIST) || \
++    defined(CONFIG_MISSED_TIMER_OFFSETS_HIST)
++	struct maxlatproc_data *mp = NULL;
++#endif
++	off_t latency_type = (off_t) file->private_data;
++
++	for_each_online_cpu(cpu) {
++
++		switch (latency_type) {
++#ifdef CONFIG_PREEMPT_OFF_HIST
++		case PREEMPTOFF_LATENCY:
++			hist = &per_cpu(preemptoff_hist, cpu);
++			break;
++#endif
++#ifdef CONFIG_INTERRUPT_OFF_HIST
++		case IRQSOFF_LATENCY:
++			hist = &per_cpu(irqsoff_hist, cpu);
++			break;
++#endif
++#if defined(CONFIG_INTERRUPT_OFF_HIST) && defined(CONFIG_PREEMPT_OFF_HIST)
++		case PREEMPTIRQSOFF_LATENCY:
++			hist = &per_cpu(preemptirqsoff_hist, cpu);
++			break;
++#endif
++#ifdef CONFIG_WAKEUP_LATENCY_HIST
++		case WAKEUP_LATENCY:
++			hist = &per_cpu(wakeup_latency_hist, cpu);
++			mp = &per_cpu(wakeup_maxlatproc, cpu);
++			break;
++		case WAKEUP_LATENCY_SHAREDPRIO:
++			hist = &per_cpu(wakeup_latency_hist_sharedprio, cpu);
++			mp = &per_cpu(wakeup_maxlatproc_sharedprio, cpu);
++			break;
++#endif
++#ifdef CONFIG_MISSED_TIMER_OFFSETS_HIST
++		case MISSED_TIMER_OFFSETS:
++			hist = &per_cpu(missed_timer_offsets, cpu);
++			mp = &per_cpu(missed_timer_offsets_maxlatproc, cpu);
++			break;
++#endif
++		}
++
++		hist_reset(hist);
++#if defined(CONFIG_WAKEUP_LATENCY_HIST) || \
++    defined(CONFIG_MISSED_TIMER_OFFSETS_HIST)
++		if (latency_type == WAKEUP_LATENCY ||
++		    latency_type == WAKEUP_LATENCY_SHAREDPRIO ||
++		    latency_type == MISSED_TIMER_OFFSETS) {
++			mp->comm[0] = '\0';
++			mp->prio = mp->pid = mp->latency = -1;
++		}
++#endif
++	}
++
++	return size;
++}
++
++#ifdef CONFIG_WAKEUP_LATENCY_HIST
++static ssize_t
++show_pid(struct file *file, char __user *ubuf, size_t cnt, loff_t *ppos)
++{
++	char buf[64];
++	int r;
++	unsigned long *this_pid = file->private_data;
++
++	r = snprintf(buf, sizeof(buf), "%lu\n", *this_pid);
++	return simple_read_from_buffer(ubuf, cnt, ppos, buf, r);
++}
++
++static ssize_t do_pid(struct file *file, const char __user *ubuf,
++		      size_t cnt, loff_t *ppos)
++{
++	char buf[64];
++	unsigned long pid;
++	unsigned long *this_pid = file->private_data;
++
++	if (cnt >= sizeof(buf))
++		return -EINVAL;
++
++	if (copy_from_user(&buf, ubuf, cnt))
++		return -EFAULT;
++
++	buf[cnt] = '\0';
++
++	if (strict_strtoul(buf, 10, &pid))
++		return(-EINVAL);
++
++	*this_pid = pid;
++
++	return cnt;
++}
++#endif
++
++#if defined(CONFIG_WAKEUP_LATENCY_HIST) || \
++    defined(CONFIG_MISSED_TIMER_OFFSETS_HIST)
++static ssize_t
++show_maxlatproc(struct file *file, char __user *ubuf, size_t cnt, loff_t *ppos)
++{
++	char buf[1024];
++	int r;
++	struct maxlatproc_data *mp = file->private_data;
++
++	r = snprintf(buf, sizeof(buf), "%d %d %ld %s\n",
++	    mp->pid, MAX_RT_PRIO-1 - mp->prio, mp->latency, mp->comm);
++	return simple_read_from_buffer(ubuf, cnt, ppos, buf, r);
++}
++#endif
++
++static ssize_t
++show_enable(struct file *file, char __user *ubuf, size_t cnt, loff_t *ppos)
++{
++	char buf[64];
++	struct enable_data *ed = file->private_data;
++	int r;
++
++	r = snprintf(buf, sizeof(buf), "%d\n", ed->enabled);
++	return simple_read_from_buffer(ubuf, cnt, ppos, buf, r);
++}
++
++static ssize_t
++do_enable(struct file *file, const char __user *ubuf, size_t cnt, loff_t *ppos)
++{
++	char buf[64];
++	long enable;
++	struct enable_data *ed = file->private_data;
++
++	if (cnt >= sizeof(buf))
++		return -EINVAL;
++
++	if (copy_from_user(&buf, ubuf, cnt))
++		return -EFAULT;
++
++	buf[cnt] = 0;
++
++	if (strict_strtol(buf, 10, &enable))
++		return(-EINVAL);
++
++	if ((enable && ed->enabled) || (!enable && !ed->enabled))
++		return cnt;
++
++	if (enable) {
++		int ret;
++
++		switch (ed->latency_type) {
++#if defined(CONFIG_INTERRUPT_OFF_HIST) || defined(CONFIG_PREEMPT_OFF_HIST)
++		case PREEMPTIRQSOFF_LATENCY:
++			ret = register_trace_preemptirqsoff_hist(
++			    probe_preemptirqsoff_hist);
++			if (ret) {
++				pr_info("wakeup trace: Couldn't assign "
++				    "probe_preemptirqsoff_hist "
++				    "to trace_preemptirqsoff_hist\n");
++				return ret;
++			}
++			break;
++#endif
++#ifdef CONFIG_WAKEUP_LATENCY_HIST
++		case WAKEUP_LATENCY:
++			ret = register_trace_sched_wakeup(
++			    probe_wakeup_latency_hist_start);
++			if (ret) {
++				pr_info("wakeup trace: Couldn't assign "
++				    "probe_wakeup_latency_hist_start "
++				    "to trace_sched_wakeup\n");
++				return ret;
++			}
++			ret = register_trace_sched_wakeup_new(
++			    probe_wakeup_latency_hist_start);
++			if (ret) {
++				pr_info("wakeup trace: Couldn't assign "
++				    "probe_wakeup_latency_hist_start "
++				    "to trace_sched_wakeup_new\n");
++				unregister_trace_sched_wakeup(
++				    probe_wakeup_latency_hist_start);
++				return ret;
++			}
++			ret = register_trace_sched_switch(
++			    probe_wakeup_latency_hist_stop);
++			if (ret) {
++				pr_info("wakeup trace: Couldn't assign "
++				    "probe_wakeup_latency_hist_stop "
++				    "to trace_sched_switch\n");
++				unregister_trace_sched_wakeup(
++				    probe_wakeup_latency_hist_start);
++				unregister_trace_sched_wakeup_new(
++				    probe_wakeup_latency_hist_start);
++				return ret;
++			}
++			ret = register_trace_sched_migrate_task(
++			    probe_sched_migrate_task);
++			if (ret) {
++				pr_info("wakeup trace: Couldn't assign "
++				    "probe_sched_migrate_task "
++				    "to trace_sched_migrate_task\n");
++				unregister_trace_sched_wakeup(
++				    probe_wakeup_latency_hist_start);
++				unregister_trace_sched_wakeup_new(
++				    probe_wakeup_latency_hist_start);
++				unregister_trace_sched_switch(
++				    probe_wakeup_latency_hist_stop);
++				return ret;
++			}
++			break;
++#endif
++#ifdef CONFIG_MISSED_TIMER_OFFSETS_HIST
++		case MISSED_TIMER_OFFSETS:
++			ret = register_trace_hrtimer_interrupt(
++			    probe_hrtimer_interrupt);
++			if (ret) {
++				pr_info("wakeup trace: Couldn't assign "
++				    "probe_hrtimer_interrupt "
++				    "to trace_hrtimer_interrupt\n");
++				return ret;
++			}
++			break;
++#endif
++		default:
++			break;
++		}
++	} else {
++		switch (ed->latency_type) {
++#if defined(CONFIG_INTERRUPT_OFF_HIST) || defined(CONFIG_PREEMPT_OFF_HIST)
++		case PREEMPTIRQSOFF_LATENCY:
++			{
++				int cpu;
++
++				unregister_trace_preemptirqsoff_hist(
++				    probe_preemptirqsoff_hist);
++				for_each_online_cpu(cpu) {
++#ifdef CONFIG_INTERRUPT_OFF_HIST
++					per_cpu(hist_irqsoff_counting,
++					    cpu) = 0;
++#endif
++#ifdef CONFIG_PREEMPT_OFF_HIST
++					per_cpu(hist_preemptoff_counting,
++					    cpu) = 0;
++#endif
++#if defined(CONFIG_INTERRUPT_OFF_HIST) && defined(CONFIG_PREEMPT_OFF_HIST)
++					per_cpu(hist_preemptirqsoff_counting,
++					    cpu) = 0;
++#endif
++				}
++			}
++			break;
++#endif
++#ifdef CONFIG_WAKEUP_LATENCY_HIST
++		case WAKEUP_LATENCY:
++			{
++				int cpu;
++
++				unregister_trace_sched_wakeup(
++				    probe_wakeup_latency_hist_start);
++				unregister_trace_sched_wakeup_new(
++				    probe_wakeup_latency_hist_start);
++				unregister_trace_sched_switch(
++				    probe_wakeup_latency_hist_stop);
++				unregister_trace_sched_migrate_task(
++				    probe_sched_migrate_task);
++
++				for_each_online_cpu(cpu) {
++					per_cpu(wakeup_task, cpu) = NULL;
++					per_cpu(wakeup_sharedprio, cpu) = 0;
++				}
++			}
++			break;
++#endif
++#ifdef CONFIG_MISSED_TIMER_OFFSETS_HIST
++		case MISSED_TIMER_OFFSETS:
++			unregister_trace_hrtimer_interrupt(
++			    probe_hrtimer_interrupt);
++			break;
++#endif
++		default:
++			break;
++		}
++	}
++	ed->enabled = enable;
++	return cnt;
++}
++
++static const struct file_operations latency_hist_reset_fops = {
++	.open = tracing_open_generic,
++	.write = latency_hist_reset,
++};
++
++static const struct file_operations enable_fops = {
++	.open = tracing_open_generic,
++	.read = show_enable,
++	.write = do_enable,
++};
++
++#if defined(CONFIG_WAKEUP_LATENCY_HIST) || \
++    defined(CONFIG_MISSED_TIMER_OFFSETS_HIST)
++static const struct file_operations pid_fops = {
++	.open = tracing_open_generic,
++	.read = show_pid,
++	.write = do_pid,
++};
++
++static const struct file_operations maxlatproc_fops = {
++	.open = tracing_open_generic,
++	.read = show_maxlatproc,
++};
++#endif
++
++#if defined(CONFIG_INTERRUPT_OFF_HIST) || defined(CONFIG_PREEMPT_OFF_HIST)
++static notrace void probe_preemptirqsoff_hist(int reason, int starthist)
++{
++	int cpu = raw_smp_processor_id();
++	int time_set = 0;
++
++	if (starthist) {
++		cycle_t uninitialized_var(start);
++
++		if (!preempt_count() && !irqs_disabled())
++			return;
++
++#ifdef CONFIG_INTERRUPT_OFF_HIST
++		if ((reason == IRQS_OFF || reason == TRACE_START) &&
++		    !per_cpu(hist_irqsoff_counting, cpu)) {
++			per_cpu(hist_irqsoff_counting, cpu) = 1;
++			start = ftrace_now(cpu);
++			time_set++;
++			per_cpu(hist_irqsoff_start, cpu) = start;
++		}
++#endif
++
++#ifdef CONFIG_PREEMPT_OFF_HIST
++		if ((reason == PREEMPT_OFF || reason == TRACE_START) &&
++		    !per_cpu(hist_preemptoff_counting, cpu)) {
++			per_cpu(hist_preemptoff_counting, cpu) = 1;
++			if (!(time_set++))
++				start = ftrace_now(cpu);
++			per_cpu(hist_preemptoff_start, cpu) = start;
++		}
++#endif
++
++#if defined(CONFIG_INTERRUPT_OFF_HIST) && defined(CONFIG_PREEMPT_OFF_HIST)
++		if (per_cpu(hist_irqsoff_counting, cpu) &&
++		    per_cpu(hist_preemptoff_counting, cpu) &&
++		    !per_cpu(hist_preemptirqsoff_counting, cpu)) {
++			per_cpu(hist_preemptirqsoff_counting, cpu) = 1;
++			if (!time_set)
++				start = ftrace_now(cpu);
++			per_cpu(hist_preemptirqsoff_start, cpu) = start;
++		}
++#endif
++	} else {
++		cycle_t uninitialized_var(stop);
++
++#ifdef CONFIG_INTERRUPT_OFF_HIST
++		if ((reason == IRQS_ON || reason == TRACE_STOP) &&
++		    per_cpu(hist_irqsoff_counting, cpu)) {
++			cycle_t start = per_cpu(hist_irqsoff_start, cpu);
++
++			stop = ftrace_now(cpu);
++			time_set++;
++			if (start && stop >= start) {
++				unsigned long latency =
++				    nsecs_to_usecs(stop - start);
++
++				latency_hist(IRQSOFF_LATENCY, cpu, latency,
++				    NULL);
++			}
++			per_cpu(hist_irqsoff_counting, cpu) = 0;
++		}
++#endif
++
++#ifdef CONFIG_PREEMPT_OFF_HIST
++		if ((reason == PREEMPT_ON || reason == TRACE_STOP) &&
++		    per_cpu(hist_preemptoff_counting, cpu)) {
++			cycle_t start = per_cpu(hist_preemptoff_start, cpu);
++
++			if (!(time_set++))
++				stop = ftrace_now(cpu);
++			if (start && stop >= start) {
++				unsigned long latency =
++				    nsecs_to_usecs(stop - start);
++
++				latency_hist(PREEMPTOFF_LATENCY, cpu, latency,
++				    NULL);
++			}
++			per_cpu(hist_preemptoff_counting, cpu) = 0;
++		}
++#endif
++
++#if defined(CONFIG_INTERRUPT_OFF_HIST) && defined(CONFIG_PREEMPT_OFF_HIST)
++		if ((!per_cpu(hist_irqsoff_counting, cpu) ||
++		     !per_cpu(hist_preemptoff_counting, cpu)) &&
++		   per_cpu(hist_preemptirqsoff_counting, cpu)) {
++			cycle_t start = per_cpu(hist_preemptirqsoff_start, cpu);
++
++			if (!time_set)
++				stop = ftrace_now(cpu);
++			if (start && stop >= start) {
++				unsigned long latency =
++				    nsecs_to_usecs(stop - start);
++				latency_hist(PREEMPTIRQSOFF_LATENCY, cpu,
++				    latency, NULL);
++			}
++			per_cpu(hist_preemptirqsoff_counting, cpu) = 0;
++		}
++#endif
++	}
++}
++#endif
++
++#ifdef CONFIG_WAKEUP_LATENCY_HIST
++static DEFINE_ATOMIC_SPINLOCK(wakeup_lock);
++static notrace void probe_sched_migrate_task(struct task_struct *task, int cpu)
++{
++        int old_cpu = task_cpu(task);
++
++	if (cpu != old_cpu) {
++		unsigned long flags;
++		struct task_struct *cpu_wakeup_task;
++
++		atomic_spin_lock_irqsave(&wakeup_lock, flags);
++
++		cpu_wakeup_task = per_cpu(wakeup_task, old_cpu);
++		if (task == cpu_wakeup_task) {
++			put_task_struct(cpu_wakeup_task);
++			per_cpu(wakeup_task, old_cpu) = NULL;
++			cpu_wakeup_task = per_cpu(wakeup_task, cpu) = task;
++			get_task_struct(cpu_wakeup_task);
++		}
++
++		atomic_spin_unlock_irqrestore(&wakeup_lock, flags);
++	}
++}
++
++static notrace void probe_wakeup_latency_hist_start(struct rq *rq,
++    struct task_struct *p, int success)
++{
++	unsigned long flags;
++	struct task_struct *curr = rq_curr(rq);
++	int cpu = task_cpu(p);
++	struct task_struct *cpu_wakeup_task;
++
++	atomic_spin_lock_irqsave(&wakeup_lock, flags);
++
++	cpu_wakeup_task = per_cpu(wakeup_task, cpu);
++
++	if (wakeup_pid) {
++		if ((cpu_wakeup_task && p->prio == cpu_wakeup_task->prio) ||
++		    p->prio == curr->prio)
++			per_cpu(wakeup_sharedprio, cpu) = 1;
++		if (likely(wakeup_pid != task_pid_nr(p)))
++			goto out;
++	} else {
++		if (likely(!rt_task(p)) ||
++		    (cpu_wakeup_task && p->prio > cpu_wakeup_task->prio) ||
++		    p->prio > curr->prio)
++			goto out;
++		if ((cpu_wakeup_task && p->prio == cpu_wakeup_task->prio) ||
++		    p->prio == curr->prio)
++			per_cpu(wakeup_sharedprio, cpu) = 1;
++	}
++
++	if (cpu_wakeup_task)
++		put_task_struct(cpu_wakeup_task);
++	cpu_wakeup_task = per_cpu(wakeup_task, cpu) = p;
++	get_task_struct(cpu_wakeup_task);
++	cpu_wakeup_task->preempt_timestamp_hist =
++		ftrace_now(raw_smp_processor_id());
++out:
++	atomic_spin_unlock_irqrestore(&wakeup_lock, flags);
++}
++
++static notrace void probe_wakeup_latency_hist_stop(struct rq *rq,
++    struct task_struct *prev, struct task_struct *next)
++{
++	unsigned long flags;
++	int cpu = task_cpu(next);
++	unsigned long latency;
++	cycle_t stop;
++	struct task_struct *cpu_wakeup_task;
++
++	atomic_spin_lock_irqsave(&wakeup_lock, flags);
++
++	cpu_wakeup_task = per_cpu(wakeup_task, cpu);
++
++	if (cpu_wakeup_task == NULL)
++		goto out;
++
++	/* Already running? */
++	if (unlikely(current == cpu_wakeup_task))
++		goto out_reset;
++
++	if (next != cpu_wakeup_task) {
++		if (next->prio < cpu_wakeup_task->prio)
++			goto out_reset;
++
++		if (next->prio == cpu_wakeup_task->prio)
++			per_cpu(wakeup_sharedprio, cpu) = 1;
++
++		goto out;
++	}
++
++	/*
++	 * The task we are waiting for is about to be switched to.
++	 * Calculate latency and store it in histogram.
++	 */
++	stop = ftrace_now(raw_smp_processor_id());
++
++	latency = nsecs_to_usecs(stop - next->preempt_timestamp_hist);
++
++	if (per_cpu(wakeup_sharedprio, cpu)) {
++		latency_hist(WAKEUP_LATENCY_SHAREDPRIO, cpu, latency, next);
++		per_cpu(wakeup_sharedprio, cpu) = 0;
++	} else
++		latency_hist(WAKEUP_LATENCY, cpu, latency, next);
++
++out_reset:
++	put_task_struct(cpu_wakeup_task);
++	per_cpu(wakeup_task, cpu) = NULL;
++out:
++	atomic_spin_unlock_irqrestore(&wakeup_lock, flags);
++}
++#endif
++
++#ifdef CONFIG_MISSED_TIMER_OFFSETS_HIST
++static notrace void probe_hrtimer_interrupt(int cpu, long long latency_ns,
++    struct task_struct *curr, struct task_struct *task)
++{
++	if (latency_ns <= 0 && task != NULL && rt_task(task) &&
++	    task->prio < curr->prio) {
++		unsigned long latency;
++
++		if (missed_timer_offsets_pid) {
++			if (likely(missed_timer_offsets_pid !=
++			    task_pid_nr(task)))
++				return;
++		}
++
++		latency = (unsigned long) div_s64(-latency_ns, 1000);
++		latency_hist(MISSED_TIMER_OFFSETS, cpu, latency, task);
++	}
++}
++#endif
++
++static __init int latency_hist_init(void)
++{
++	struct dentry *latency_hist_root = NULL;
++	struct dentry *dentry;
++#ifdef CONFIG_WAKEUP_LATENCY_HIST
++	struct dentry *dentry_sharedprio;
++#endif
++	struct dentry *entry;
++	struct dentry *enable_root;
++	int i = 0;
++	struct hist_data *my_hist;
++	char name[64];
++	char *cpufmt = "CPU%d";
++#if defined(CONFIG_WAKEUP_LATENCY_HIST) || \
++    defined(CONFIG_MISSED_TIMER_OFFSETS_HIST)
++	char *cpufmt_maxlatproc = "max_latency-CPU%d";
++	struct maxlatproc_data *mp = NULL;
++#endif
++
++	dentry = tracing_init_dentry();
++	latency_hist_root = debugfs_create_dir(latency_hist_dir_root, dentry);
++	enable_root = debugfs_create_dir("enable", latency_hist_root);
++
++#ifdef CONFIG_INTERRUPT_OFF_HIST
++	dentry = debugfs_create_dir(irqsoff_hist_dir, latency_hist_root);
++	for_each_possible_cpu(i) {
++		sprintf(name, cpufmt, i);
++		entry = debugfs_create_file(name, 0444, dentry,
++		    &per_cpu(irqsoff_hist, i), &latency_hist_fops);
++		my_hist = &per_cpu(irqsoff_hist, i);
++		atomic_set(&my_hist->hist_mode, 1);
++		my_hist->min_lat = 0xFFFFFFFFUL;
++	}
++	entry = debugfs_create_file("reset", 0644, dentry,
++	    (void *)IRQSOFF_LATENCY, &latency_hist_reset_fops);
++#endif
++
++#ifdef CONFIG_PREEMPT_OFF_HIST
++	dentry = debugfs_create_dir(preemptoff_hist_dir,
++	    latency_hist_root);
++	for_each_possible_cpu(i) {
++		sprintf(name, cpufmt, i);
++		entry = debugfs_create_file(name, 0444, dentry,
++		    &per_cpu(preemptoff_hist, i), &latency_hist_fops);
++		my_hist = &per_cpu(preemptoff_hist, i);
++		atomic_set(&my_hist->hist_mode, 1);
++		my_hist->min_lat = 0xFFFFFFFFUL;
++	}
++	entry = debugfs_create_file("reset", 0644, dentry,
++	    (void *)PREEMPTOFF_LATENCY, &latency_hist_reset_fops);
++#endif
++
++#if defined(CONFIG_INTERRUPT_OFF_HIST) && defined(CONFIG_PREEMPT_OFF_HIST)
++	dentry = debugfs_create_dir(preemptirqsoff_hist_dir,
++	    latency_hist_root);
++	for_each_possible_cpu(i) {
++		sprintf(name, cpufmt, i);
++		entry = debugfs_create_file(name, 0444, dentry,
++		    &per_cpu(preemptirqsoff_hist, i), &latency_hist_fops);
++		my_hist = &per_cpu(preemptirqsoff_hist, i);
++		atomic_set(&my_hist->hist_mode, 1);
++		my_hist->min_lat = 0xFFFFFFFFUL;
++	}
++	entry = debugfs_create_file("reset", 0644, dentry,
++	    (void *)PREEMPTIRQSOFF_LATENCY, &latency_hist_reset_fops);
++#endif
++
++#if defined(CONFIG_INTERRUPT_OFF_HIST) || defined(CONFIG_PREEMPT_OFF_HIST)
++	entry = debugfs_create_file("preemptirqsoff", 0644,
++	    enable_root, (void *)&preemptirqsoff_enabled_data,
++	    &enable_fops);
++#endif
++
++#ifdef CONFIG_WAKEUP_LATENCY_HIST
++	dentry = debugfs_create_dir(wakeup_latency_hist_dir,
++	    latency_hist_root);
++	dentry_sharedprio = debugfs_create_dir(
++	    wakeup_latency_hist_dir_sharedprio, dentry);
++	for_each_possible_cpu(i) {
++		sprintf(name, cpufmt, i);
++
++		entry = debugfs_create_file(name, 0444, dentry,
++		    &per_cpu(wakeup_latency_hist, i),
++		    &latency_hist_fops);
++		my_hist = &per_cpu(wakeup_latency_hist, i);
++		atomic_set(&my_hist->hist_mode, 1);
++		my_hist->min_lat = 0xFFFFFFFFUL;
++
++		entry = debugfs_create_file(name, 0444, dentry_sharedprio,
++		    &per_cpu(wakeup_latency_hist_sharedprio, i),
++		    &latency_hist_fops);
++		my_hist = &per_cpu(wakeup_latency_hist_sharedprio, i);
++		atomic_set(&my_hist->hist_mode, 1);
++		my_hist->min_lat = 0xFFFFFFFFUL;
++
++		sprintf(name, cpufmt_maxlatproc, i);
++
++		mp = &per_cpu(wakeup_maxlatproc, i);
++		entry = debugfs_create_file(name, 0444, dentry, mp,
++		    &maxlatproc_fops);
++		mp->prio = mp->pid = mp->latency = -1;
++
++		mp = &per_cpu(wakeup_maxlatproc_sharedprio, i);
++		entry = debugfs_create_file(name, 0444, dentry_sharedprio, mp,
++		    &maxlatproc_fops);
++		mp->prio = mp->pid = mp->latency = -1;
++	}
++	entry = debugfs_create_file("pid", 0644, dentry,
++	    (void *)&wakeup_pid, &pid_fops);
++	entry = debugfs_create_file("reset", 0644, dentry,
++	    (void *)WAKEUP_LATENCY, &latency_hist_reset_fops);
++	entry = debugfs_create_file("reset", 0644, dentry_sharedprio,
++	    (void *)WAKEUP_LATENCY_SHAREDPRIO, &latency_hist_reset_fops);
++	entry = debugfs_create_file("wakeup", 0644,
++	    enable_root, (void *)&wakeup_latency_enabled_data,
++	    &enable_fops);
++#endif
++
++#ifdef CONFIG_MISSED_TIMER_OFFSETS_HIST
++	dentry = debugfs_create_dir(missed_timer_offsets_dir,
++	    latency_hist_root);
++	for_each_possible_cpu(i) {
++		sprintf(name, cpufmt, i);
++		entry = debugfs_create_file(name, 0444, dentry,
++		    &per_cpu(missed_timer_offsets, i), &latency_hist_fops);
++		my_hist = &per_cpu(missed_timer_offsets, i);
++		atomic_set(&my_hist->hist_mode, 1);
++		my_hist->min_lat = 0xFFFFFFFFUL;
++
++		sprintf(name, cpufmt_maxlatproc, i);
++		mp = &per_cpu(missed_timer_offsets_maxlatproc, i);
++		entry = debugfs_create_file(name, 0444, dentry, mp,
++		    &maxlatproc_fops);
++		mp->prio = mp->pid = mp->latency = -1;
++	}
++	entry = debugfs_create_file("pid", 0644, dentry,
++	    (void *)&missed_timer_offsets_pid, &pid_fops);
++	entry = debugfs_create_file("reset", 0644, dentry,
++	    (void *)MISSED_TIMER_OFFSETS, &latency_hist_reset_fops);
++	entry = debugfs_create_file("missed_timer_offsets", 0644,
++	    enable_root, (void *)&missed_timer_offsets_enabled_data,
++	    &enable_fops);
++#endif
++	return 0;
++}
++
++__initcall(latency_hist_init);
+Index: linux-rt-2.6.31/kernel/trace/ring_buffer.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/trace/ring_buffer.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/trace/ring_buffer.c	2010-05-17 14:23:20.118466134 +0200
+@@ -218,17 +218,12 @@
+ 
+ static inline int rb_null_event(struct ring_buffer_event *event)
+ {
+-	return event->type_len == RINGBUF_TYPE_PADDING
+-			&& event->time_delta == 0;
+-}
+-
+-static inline int rb_discarded_event(struct ring_buffer_event *event)
+-{
+-	return event->type_len == RINGBUF_TYPE_PADDING && event->time_delta;
++	return event->type_len == RINGBUF_TYPE_PADDING && !event->time_delta;
+ }
+ 
+ static void rb_event_set_padding(struct ring_buffer_event *event)
+ {
++	/* padding has a NULL time_delta */
+ 	event->type_len = RINGBUF_TYPE_PADDING;
+ 	event->time_delta = 0;
+ }
+@@ -322,6 +317,14 @@
+ 	unsigned char	 data[];	/* data of buffer page */
+ };
+ 
++/*
++ * Note, the buffer_page list must be first. The buffer pages
++ * are allocated in cache lines, which means that each buffer
++ * page will be at the beginning of a cache line, and thus
++ * the least significant bits will be zero. We use this to
++ * add flags in the list struct pointers, to make the ring buffer
++ * lockless.
++ */
+ struct buffer_page {
+ 	struct list_head list;		/* list of buffer pages */
+ 	local_t		 write;		/* index for next write */
+@@ -330,6 +333,21 @@
+ 	struct buffer_data_page *page;	/* Actual data page */
+ };
+ 
++/*
++ * The buffer page counters, write and entries, must be reset
++ * atomically when crossing page boundaries. To synchronize this
++ * update, two counters are inserted into the number. One is
++ * the actual counter for the write position or count on the page.
++ *
++ * The other is a counter of updaters. Before an update happens
++ * the update partition of the counter is incremented. This will
++ * allow the updater to update the counter atomically.
++ *
++ * The counter is 20 bits, and the state data is 12.
++ */
++#define RB_WRITE_MASK		0xfffff
++#define RB_WRITE_INTCNT		(1 << 20)
++
+ static void rb_init_page(struct buffer_data_page *bpage)
+ {
+ 	local_set(&bpage->commit, 0);
+@@ -403,21 +421,20 @@
+ struct ring_buffer_per_cpu {
+ 	int				cpu;
+ 	struct ring_buffer		*buffer;
+-	spinlock_t			reader_lock; /* serialize readers */
++	atomic_spinlock_t		reader_lock;	/* serialize readers */
+ 	raw_spinlock_t			lock;
+ 	struct lock_class_key		lock_key;
+-	struct list_head		pages;
++	struct list_head		*pages;
+ 	struct buffer_page		*head_page;	/* read from head */
+ 	struct buffer_page		*tail_page;	/* write to tail */
+ 	struct buffer_page		*commit_page;	/* committed pages */
+ 	struct buffer_page		*reader_page;
+-	unsigned long			nmi_dropped;
+-	unsigned long			commit_overrun;
+-	unsigned long			overrun;
+-	unsigned long			read;
++	local_t				commit_overrun;
++	local_t				overrun;
+ 	local_t				entries;
+ 	local_t				committing;
+ 	local_t				commits;
++	unsigned long			read;
+ 	u64				write_stamp;
+ 	u64				read_stamp;
+ 	atomic_t			record_disabled;
+@@ -450,14 +467,19 @@
+ };
+ 
+ /* buffer may be either ring_buffer or ring_buffer_per_cpu */
+-#define RB_WARN_ON(buffer, cond)				\
+-	({							\
+-		int _____ret = unlikely(cond);			\
+-		if (_____ret) {					\
+-			atomic_inc(&buffer->record_disabled);	\
+-			WARN_ON(1);				\
+-		}						\
+-		_____ret;					\
++#define RB_WARN_ON(b, cond)						\
++	({								\
++		int _____ret = unlikely(cond);				\
++		if (_____ret) {						\
++			if (__same_type(*(b), struct ring_buffer_per_cpu)) { \
++				struct ring_buffer_per_cpu *__b =	\
++					(void *)b;			\
++				atomic_inc(&__b->buffer->record_disabled); \
++			} else						\
++				atomic_inc(&b->record_disabled);	\
++			WARN_ON(1);					\
++		}							\
++		_____ret;						\
+ 	})
+ 
+ /* Up this if you want to test the TIME_EXTENTS and normalization */
+@@ -489,6 +511,390 @@
+ }
+ EXPORT_SYMBOL_GPL(ring_buffer_normalize_time_stamp);
+ 
++/*
++ * Making the ring buffer lockless makes things tricky.
++ * Although writes only happen on the CPU that they are on,
++ * and they only need to worry about interrupts. Reads can
++ * happen on any CPU.
++ *
++ * The reader page is always off the ring buffer, but when the
++ * reader finishes with a page, it needs to swap its page with
++ * a new one from the buffer. The reader needs to take from
++ * the head (writes go to the tail). But if a writer is in overwrite
++ * mode and wraps, it must push the head page forward.
++ *
++ * Here lies the problem.
++ *
++ * The reader must be careful to replace only the head page, and
++ * not another one. As described at the top of the file in the
++ * ASCII art, the reader sets its old page to point to the next
++ * page after head. It then sets the page after head to point to
++ * the old reader page. But if the writer moves the head page
++ * during this operation, the reader could end up with the tail.
++ *
++ * We use cmpxchg to help prevent this race. We also do something
++ * special with the page before head. We set the LSB to 1.
++ *
++ * When the writer must push the page forward, it will clear the
++ * bit that points to the head page, move the head, and then set
++ * the bit that points to the new head page.
++ *
++ * We also don't want an interrupt coming in and moving the head
++ * page on another writer. Thus we use the second LSB to catch
++ * that too. Thus:
++ *
++ * head->list->prev->next        bit 1          bit 0
++ *                              -------        -------
++ * Normal page                     0              0
++ * Points to head page             0              1
++ * New head page                   1              0
++ *
++ * Note we can not trust the prev pointer of the head page, because:
++ *
++ * +----+       +-----+        +-----+
++ * |    |------>|  T  |---X--->|  N  |
++ * |    |<------|     |        |     |
++ * +----+       +-----+        +-----+
++ *   ^                           ^ |
++ *   |          +-----+          | |
++ *   +----------|  R  |----------+ |
++ *              |     |<-----------+
++ *              +-----+
++ *
++ * Key:  ---X-->  HEAD flag set in pointer
++ *         T      Tail page
++ *         R      Reader page
++ *         N      Next page
++ *
++ * (see __rb_reserve_next() to see where this happens)
++ *
++ *  What the above shows is that the reader just swapped out
++ *  the reader page with a page in the buffer, but before it
++ *  could make the new header point back to the new page added
++ *  it was preempted by a writer. The writer moved forward onto
++ *  the new page added by the reader and is about to move forward
++ *  again.
++ *
++ *  You can see, it is legitimate for the previous pointer of
++ *  the head (or any page) not to point back to itself. But only
++ *  temporarially.
++ */
++
++#define RB_PAGE_NORMAL		0UL
++#define RB_PAGE_HEAD		1UL
++#define RB_PAGE_UPDATE		2UL
++
++
++#define RB_FLAG_MASK		3UL
++
++/* PAGE_MOVED is not part of the mask */
++#define RB_PAGE_MOVED		4UL
++
++/*
++ * rb_list_head - remove any bit
++ */
++static struct list_head *rb_list_head(struct list_head *list)
++{
++	unsigned long val = (unsigned long)list;
++
++	return (struct list_head *)(val & ~RB_FLAG_MASK);
++}
++
++/*
++ * rb_is_head_page - test if the give page is the head page
++ *
++ * Because the reader may move the head_page pointer, we can
++ * not trust what the head page is (it may be pointing to
++ * the reader page). But if the next page is a header page,
++ * its flags will be non zero.
++ */
++static int inline
++rb_is_head_page(struct ring_buffer_per_cpu *cpu_buffer,
++		struct buffer_page *page, struct list_head *list)
++{
++	unsigned long val;
++
++	val = (unsigned long)list->next;
++
++	if ((val & ~RB_FLAG_MASK) != (unsigned long)&page->list)
++		return RB_PAGE_MOVED;
++
++	return val & RB_FLAG_MASK;
++}
++
++/*
++ * rb_is_reader_page
++ *
++ * The unique thing about the reader page, is that, if the
++ * writer is ever on it, the previous pointer never points
++ * back to the reader page.
++ */
++static int rb_is_reader_page(struct buffer_page *page)
++{
++	struct list_head *list = page->list.prev;
++
++	return rb_list_head(list->next) != &page->list;
++}
++
++/*
++ * rb_set_list_to_head - set a list_head to be pointing to head.
++ */
++static void rb_set_list_to_head(struct ring_buffer_per_cpu *cpu_buffer,
++				struct list_head *list)
++{
++	unsigned long *ptr;
++
++	ptr = (unsigned long *)&list->next;
++	*ptr |= RB_PAGE_HEAD;
++	*ptr &= ~RB_PAGE_UPDATE;
++}
++
++/*
++ * rb_head_page_activate - sets up head page
++ */
++static void rb_head_page_activate(struct ring_buffer_per_cpu *cpu_buffer)
++{
++	struct buffer_page *head;
++
++	head = cpu_buffer->head_page;
++	if (!head)
++		return;
++
++	/*
++	 * Set the previous list pointer to have the HEAD flag.
++	 */
++	rb_set_list_to_head(cpu_buffer, head->list.prev);
++}
++
++static void rb_list_head_clear(struct list_head *list)
++{
++	unsigned long *ptr = (unsigned long *)&list->next;
++
++	*ptr &= ~RB_FLAG_MASK;
++}
++
++/*
++ * rb_head_page_dactivate - clears head page ptr (for free list)
++ */
++static void
++rb_head_page_deactivate(struct ring_buffer_per_cpu *cpu_buffer)
++{
++	struct list_head *hd;
++
++	/* Go through the whole list and clear any pointers found. */
++	rb_list_head_clear(cpu_buffer->pages);
++
++	list_for_each(hd, cpu_buffer->pages)
++		rb_list_head_clear(hd);
++}
++
++static int rb_head_page_set(struct ring_buffer_per_cpu *cpu_buffer,
++			    struct buffer_page *head,
++			    struct buffer_page *prev,
++			    int old_flag, int new_flag)
++{
++	struct list_head *list;
++	unsigned long val = (unsigned long)&head->list;
++	unsigned long ret;
++
++	list = &prev->list;
++
++	val &= ~RB_FLAG_MASK;
++
++	ret = cmpxchg((unsigned long *)&list->next,
++		      val | old_flag, val | new_flag);
++
++	/* check if the reader took the page */
++	if ((ret & ~RB_FLAG_MASK) != val)
++		return RB_PAGE_MOVED;
++
++	return ret & RB_FLAG_MASK;
++}
++
++static int rb_head_page_set_update(struct ring_buffer_per_cpu *cpu_buffer,
++				   struct buffer_page *head,
++				   struct buffer_page *prev,
++				   int old_flag)
++{
++	return rb_head_page_set(cpu_buffer, head, prev,
++				old_flag, RB_PAGE_UPDATE);
++}
++
++static int rb_head_page_set_head(struct ring_buffer_per_cpu *cpu_buffer,
++				 struct buffer_page *head,
++				 struct buffer_page *prev,
++				 int old_flag)
++{
++	return rb_head_page_set(cpu_buffer, head, prev,
++				old_flag, RB_PAGE_HEAD);
++}
++
++static int rb_head_page_set_normal(struct ring_buffer_per_cpu *cpu_buffer,
++				   struct buffer_page *head,
++				   struct buffer_page *prev,
++				   int old_flag)
++{
++	return rb_head_page_set(cpu_buffer, head, prev,
++				old_flag, RB_PAGE_NORMAL);
++}
++
++static inline void rb_inc_page(struct ring_buffer_per_cpu *cpu_buffer,
++			       struct buffer_page **bpage)
++{
++	struct list_head *p = rb_list_head((*bpage)->list.next);
++
++	*bpage = list_entry(p, struct buffer_page, list);
++}
++
++static struct buffer_page *
++rb_set_head_page(struct ring_buffer_per_cpu *cpu_buffer)
++{
++	struct buffer_page *head;
++	struct buffer_page *page;
++	struct list_head *list;
++	int i;
++
++	if (RB_WARN_ON(cpu_buffer, !cpu_buffer->head_page))
++		return NULL;
++
++	/* sanity check */
++	list = cpu_buffer->pages;
++	if (RB_WARN_ON(cpu_buffer, rb_list_head(list->prev->next) != list))
++		return NULL;
++
++	page = head = cpu_buffer->head_page;
++	/*
++	 * It is possible that the writer moves the header behind
++	 * where we started, and we miss in one loop.
++	 * A second loop should grab the header, but we'll do
++	 * three loops just because I'm paranoid.
++	 */
++	for (i = 0; i < 3; i++) {
++		do {
++			if (rb_is_head_page(cpu_buffer, page, page->list.prev)) {
++				cpu_buffer->head_page = page;
++				return page;
++			}
++			rb_inc_page(cpu_buffer, &page);
++		} while (page != head);
++	}
++
++	RB_WARN_ON(cpu_buffer, 1);
++
++	return NULL;
++}
++
++static int rb_head_page_replace(struct buffer_page *old,
++				struct buffer_page *new)
++{
++	unsigned long *ptr = (unsigned long *)&old->list.prev->next;
++	unsigned long val;
++	unsigned long ret;
++
++	val = *ptr & ~RB_FLAG_MASK;
++	val |= RB_PAGE_HEAD;
++
++	ret = cmpxchg(ptr, val, (unsigned long)&new->list);
++
++	return ret == val;
++}
++
++/*
++ * rb_tail_page_update - move the tail page forward
++ *
++ * Returns 1 if moved tail page, 0 if someone else did.
++ */
++static int rb_tail_page_update(struct ring_buffer_per_cpu *cpu_buffer,
++			       struct buffer_page *tail_page,
++			       struct buffer_page *next_page)
++{
++	struct buffer_page *old_tail;
++	unsigned long old_entries;
++	unsigned long old_write;
++	int ret = 0;
++
++	/*
++	 * The tail page now needs to be moved forward.
++	 *
++	 * We need to reset the tail page, but without messing
++	 * with possible erasing of data brought in by interrupts
++	 * that have moved the tail page and are currently on it.
++	 *
++	 * We add a counter to the write field to denote this.
++	 */
++	old_write = local_add_return(RB_WRITE_INTCNT, &next_page->write);
++	old_entries = local_add_return(RB_WRITE_INTCNT, &next_page->entries);
++
++	/*
++	 * Just make sure we have seen our old_write and synchronize
++	 * with any interrupts that come in.
++	 */
++	barrier();
++
++	/*
++	 * If the tail page is still the same as what we think
++	 * it is, then it is up to us to update the tail
++	 * pointer.
++	 */
++	if (tail_page == cpu_buffer->tail_page) {
++		/* Zero the write counter */
++		unsigned long val = old_write & ~RB_WRITE_MASK;
++		unsigned long eval = old_entries & ~RB_WRITE_MASK;
++
++		/*
++		 * This will only succeed if an interrupt did
++		 * not come in and change it. In which case, we
++		 * do not want to modify it.
++		 *
++		 * We add (void) to let the compiler know that we do not care
++		 * about the return value of these functions. We use the
++		 * cmpxchg to only update if an interrupt did not already
++		 * do it for us. If the cmpxchg fails, we don't care.
++		 */
++		(void)local_cmpxchg(&next_page->write, old_write, val);
++		(void)local_cmpxchg(&next_page->entries, old_entries, eval);
++
++		/*
++		 * No need to worry about races with clearing out the commit.
++		 * it only can increment when a commit takes place. But that
++		 * only happens in the outer most nested commit.
++		 */
++		local_set(&next_page->page->commit, 0);
++
++		old_tail = cmpxchg(&cpu_buffer->tail_page,
++				   tail_page, next_page);
++
++		if (old_tail == tail_page)
++			ret = 1;
++	}
++
++	return ret;
++}
++
++static int rb_check_bpage(struct ring_buffer_per_cpu *cpu_buffer,
++			  struct buffer_page *bpage)
++{
++	unsigned long val = (unsigned long)bpage;
++
++	if (RB_WARN_ON(cpu_buffer, val & RB_FLAG_MASK))
++		return 1;
++
++	return 0;
++}
++
++/**
++ * rb_check_list - make sure a pointer to a list has the last bits zero
++ */
++static int rb_check_list(struct ring_buffer_per_cpu *cpu_buffer,
++			 struct list_head *list)
++{
++	if (RB_WARN_ON(cpu_buffer, rb_list_head(list->prev) != list->prev))
++		return 1;
++	if (RB_WARN_ON(cpu_buffer, rb_list_head(list->next) != list->next))
++		return 1;
++	return 0;
++}
++
+ /**
+  * check_pages - integrity check of buffer pages
+  * @cpu_buffer: CPU buffer with pages to test
+@@ -498,14 +904,19 @@
+  */
+ static int rb_check_pages(struct ring_buffer_per_cpu *cpu_buffer)
+ {
+-	struct list_head *head = &cpu_buffer->pages;
++	struct list_head *head = cpu_buffer->pages;
+ 	struct buffer_page *bpage, *tmp;
+ 
++	rb_head_page_deactivate(cpu_buffer);
++
+ 	if (RB_WARN_ON(cpu_buffer, head->next->prev != head))
+ 		return -1;
+ 	if (RB_WARN_ON(cpu_buffer, head->prev->next != head))
+ 		return -1;
+ 
++	if (rb_check_list(cpu_buffer, head))
++		return -1;
++
+ 	list_for_each_entry_safe(bpage, tmp, head, list) {
+ 		if (RB_WARN_ON(cpu_buffer,
+ 			       bpage->list.next->prev != &bpage->list))
+@@ -513,25 +924,33 @@
+ 		if (RB_WARN_ON(cpu_buffer,
+ 			       bpage->list.prev->next != &bpage->list))
+ 			return -1;
++		if (rb_check_list(cpu_buffer, &bpage->list))
++			return -1;
+ 	}
+ 
++	rb_head_page_activate(cpu_buffer);
++
+ 	return 0;
+ }
+ 
+ static int rb_allocate_pages(struct ring_buffer_per_cpu *cpu_buffer,
+ 			     unsigned nr_pages)
+ {
+-	struct list_head *head = &cpu_buffer->pages;
+ 	struct buffer_page *bpage, *tmp;
+ 	unsigned long addr;
+ 	LIST_HEAD(pages);
+ 	unsigned i;
+ 
++	WARN_ON(!nr_pages);
++
+ 	for (i = 0; i < nr_pages; i++) {
+ 		bpage = kzalloc_node(ALIGN(sizeof(*bpage), cache_line_size()),
+ 				    GFP_KERNEL, cpu_to_node(cpu_buffer->cpu));
+ 		if (!bpage)
+ 			goto free_pages;
++
++		rb_check_bpage(cpu_buffer, bpage);
++
+ 		list_add(&bpage->list, &pages);
+ 
+ 		addr = __get_free_page(GFP_KERNEL);
+@@ -541,7 +960,13 @@
+ 		rb_init_page(bpage->page);
+ 	}
+ 
+-	list_splice(&pages, head);
++	/*
++	 * The ring buffer page list is a circular list that does not
++	 * start and end with a list head. All page list items point to
++	 * other pages.
++	 */
++	cpu_buffer->pages = pages.next;
++	list_del(&pages);
+ 
+ 	rb_check_pages(cpu_buffer);
+ 
+@@ -570,16 +995,17 @@
+ 
+ 	cpu_buffer->cpu = cpu;
+ 	cpu_buffer->buffer = buffer;
+-	spin_lock_init(&cpu_buffer->reader_lock);
++	atomic_spin_lock_init(&cpu_buffer->reader_lock);
+ 	lockdep_set_class(&cpu_buffer->reader_lock, buffer->reader_lock_key);
+ 	cpu_buffer->lock = (raw_spinlock_t)__RAW_SPIN_LOCK_UNLOCKED;
+-	INIT_LIST_HEAD(&cpu_buffer->pages);
+ 
+ 	bpage = kzalloc_node(ALIGN(sizeof(*bpage), cache_line_size()),
+ 			    GFP_KERNEL, cpu_to_node(cpu));
+ 	if (!bpage)
+ 		goto fail_free_buffer;
+ 
++	rb_check_bpage(cpu_buffer, bpage);
++
+ 	cpu_buffer->reader_page = bpage;
+ 	addr = __get_free_page(GFP_KERNEL);
+ 	if (!addr)
+@@ -594,9 +1020,11 @@
+ 		goto fail_free_reader;
+ 
+ 	cpu_buffer->head_page
+-		= list_entry(cpu_buffer->pages.next, struct buffer_page, list);
++		= list_entry(cpu_buffer->pages, struct buffer_page, list);
+ 	cpu_buffer->tail_page = cpu_buffer->commit_page = cpu_buffer->head_page;
+ 
++	rb_head_page_activate(cpu_buffer);
++
+ 	return cpu_buffer;
+ 
+  fail_free_reader:
+@@ -609,15 +1037,22 @@
+ 
+ static void rb_free_cpu_buffer(struct ring_buffer_per_cpu *cpu_buffer)
+ {
+-	struct list_head *head = &cpu_buffer->pages;
++	struct list_head *head = cpu_buffer->pages;
+ 	struct buffer_page *bpage, *tmp;
+ 
+ 	free_buffer_page(cpu_buffer->reader_page);
+ 
+-	list_for_each_entry_safe(bpage, tmp, head, list) {
+-		list_del_init(&bpage->list);
++	rb_head_page_deactivate(cpu_buffer);
++
++	if (head) {
++		list_for_each_entry_safe(bpage, tmp, head, list) {
++			list_del_init(&bpage->list);
++			free_buffer_page(bpage);
++		}
++		bpage = list_entry(head, struct buffer_page, list);
+ 		free_buffer_page(bpage);
+ 	}
++
+ 	kfree(cpu_buffer);
+ }
+ 
+@@ -760,15 +1195,17 @@
+ 	atomic_inc(&cpu_buffer->record_disabled);
+ 	synchronize_sched();
+ 
++	rb_head_page_deactivate(cpu_buffer);
++
+ 	for (i = 0; i < nr_pages; i++) {
+-		if (RB_WARN_ON(cpu_buffer, list_empty(&cpu_buffer->pages)))
++		if (RB_WARN_ON(cpu_buffer, list_empty(cpu_buffer->pages)))
+ 			return;
+-		p = cpu_buffer->pages.next;
++		p = cpu_buffer->pages->next;
+ 		bpage = list_entry(p, struct buffer_page, list);
+ 		list_del_init(&bpage->list);
+ 		free_buffer_page(bpage);
+ 	}
+-	if (RB_WARN_ON(cpu_buffer, list_empty(&cpu_buffer->pages)))
++	if (RB_WARN_ON(cpu_buffer, list_empty(cpu_buffer->pages)))
+ 		return;
+ 
+ 	rb_reset_cpu(cpu_buffer);
+@@ -790,15 +1227,19 @@
+ 	atomic_inc(&cpu_buffer->record_disabled);
+ 	synchronize_sched();
+ 
++	atomic_spin_lock_irq(&cpu_buffer->reader_lock);
++	rb_head_page_deactivate(cpu_buffer);
++
+ 	for (i = 0; i < nr_pages; i++) {
+ 		if (RB_WARN_ON(cpu_buffer, list_empty(pages)))
+ 			return;
+ 		p = pages->next;
+ 		bpage = list_entry(p, struct buffer_page, list);
+ 		list_del_init(&bpage->list);
+-		list_add_tail(&bpage->list, &cpu_buffer->pages);
++		list_add_tail(&bpage->list, cpu_buffer->pages);
+ 	}
+ 	rb_reset_cpu(cpu_buffer);
++	atomic_spin_unlock_irq(&cpu_buffer->reader_lock);
+ 
+ 	rb_check_pages(cpu_buffer);
+ 
+@@ -949,21 +1390,14 @@
+ }
+ 
+ static inline struct ring_buffer_event *
+-rb_head_event(struct ring_buffer_per_cpu *cpu_buffer)
+-{
+-	return __rb_page_index(cpu_buffer->head_page,
+-			       cpu_buffer->head_page->read);
+-}
+-
+-static inline struct ring_buffer_event *
+ rb_iter_head_event(struct ring_buffer_iter *iter)
+ {
+ 	return __rb_page_index(iter->head_page, iter->head);
+ }
+ 
+-static inline unsigned rb_page_write(struct buffer_page *bpage)
++static inline unsigned long rb_page_write(struct buffer_page *bpage)
+ {
+-	return local_read(&bpage->write);
++	return local_read(&bpage->write) & RB_WRITE_MASK;
+ }
+ 
+ static inline unsigned rb_page_commit(struct buffer_page *bpage)
+@@ -971,6 +1405,11 @@
+ 	return local_read(&bpage->page->commit);
+ }
+ 
++static inline unsigned long rb_page_entries(struct buffer_page *bpage)
++{
++	return local_read(&bpage->entries) & RB_WRITE_MASK;
++}
++
+ /* Size is determined by what has been commited */
+ static inline unsigned rb_page_size(struct buffer_page *bpage)
+ {
+@@ -983,22 +1422,6 @@
+ 	return rb_page_commit(cpu_buffer->commit_page);
+ }
+ 
+-static inline unsigned rb_head_size(struct ring_buffer_per_cpu *cpu_buffer)
+-{
+-	return rb_page_commit(cpu_buffer->head_page);
+-}
+-
+-static inline void rb_inc_page(struct ring_buffer_per_cpu *cpu_buffer,
+-			       struct buffer_page **bpage)
+-{
+-	struct list_head *p = (*bpage)->list.next;
+-
+-	if (p == &cpu_buffer->pages)
+-		p = p->next;
+-
+-	*bpage = list_entry(p, struct buffer_page, list);
+-}
+-
+ static inline unsigned
+ rb_event_index(struct ring_buffer_event *event)
+ {
+@@ -1024,6 +1447,8 @@
+ static void
+ rb_set_commit_to_write(struct ring_buffer_per_cpu *cpu_buffer)
+ {
++	unsigned long max_count;
++
+ 	/*
+ 	 * We only race with interrupts and NMIs on this CPU.
+ 	 * If we own the commit event, then we can commit
+@@ -1033,9 +1458,16 @@
+ 	 * assign the commit to the tail.
+ 	 */
+  again:
++	max_count = cpu_buffer->buffer->pages * 100;
++
+ 	while (cpu_buffer->commit_page != cpu_buffer->tail_page) {
+-		cpu_buffer->commit_page->page->commit =
+-			cpu_buffer->commit_page->write;
++		if (RB_WARN_ON(cpu_buffer, !(--max_count)))
++			return;
++		if (RB_WARN_ON(cpu_buffer,
++			       rb_is_reader_page(cpu_buffer->tail_page)))
++			return;
++		local_set(&cpu_buffer->commit_page->page->commit,
++			  rb_page_write(cpu_buffer->commit_page));
+ 		rb_inc_page(cpu_buffer, &cpu_buffer->commit_page);
+ 		cpu_buffer->write_stamp =
+ 			cpu_buffer->commit_page->page->time_stamp;
+@@ -1044,8 +1476,12 @@
+ 	}
+ 	while (rb_commit_index(cpu_buffer) !=
+ 	       rb_page_write(cpu_buffer->commit_page)) {
+-		cpu_buffer->commit_page->page->commit =
+-			cpu_buffer->commit_page->write;
++
++		local_set(&cpu_buffer->commit_page->page->commit,
++			  rb_page_write(cpu_buffer->commit_page));
++		RB_WARN_ON(cpu_buffer,
++			   local_read(&cpu_buffer->commit_page->page->commit) &
++			   ~RB_WRITE_MASK);
+ 		barrier();
+ 	}
+ 
+@@ -1078,7 +1514,7 @@
+ 	 * to the head page instead of next.
+ 	 */
+ 	if (iter->head_page == cpu_buffer->reader_page)
+-		iter->head_page = cpu_buffer->head_page;
++		iter->head_page = rb_set_head_page(cpu_buffer);
+ 	else
+ 		rb_inc_page(cpu_buffer, &iter->head_page);
+ 
+@@ -1122,6 +1558,163 @@
+ 	}
+ }
+ 
++/*
++ * rb_handle_head_page - writer hit the head page
++ *
++ * Returns: +1 to retry page
++ *           0 to continue
++ *          -1 on error
++ */
++static int
++rb_handle_head_page(struct ring_buffer_per_cpu *cpu_buffer,
++		    struct buffer_page *tail_page,
++		    struct buffer_page *next_page)
++{
++	struct buffer_page *new_head;
++	int entries;
++	int type;
++	int ret;
++
++	entries = rb_page_entries(next_page);
++
++	/*
++	 * The hard part is here. We need to move the head
++	 * forward, and protect against both readers on
++	 * other CPUs and writers coming in via interrupts.
++	 */
++	type = rb_head_page_set_update(cpu_buffer, next_page, tail_page,
++				       RB_PAGE_HEAD);
++
++	/*
++	 * type can be one of four:
++	 *  NORMAL - an interrupt already moved it for us
++	 *  HEAD   - we are the first to get here.
++	 *  UPDATE - we are the interrupt interrupting
++	 *           a current move.
++	 *  MOVED  - a reader on another CPU moved the next
++	 *           pointer to its reader page. Give up
++	 *           and try again.
++	 */
++
++	switch (type) {
++	case RB_PAGE_HEAD:
++		/*
++		 * We changed the head to UPDATE, thus
++		 * it is our responsibility to update
++		 * the counters.
++		 */
++		local_add(entries, &cpu_buffer->overrun);
++
++		/*
++		 * The entries will be zeroed out when we move the
++		 * tail page.
++		 */
++
++		/* still more to do */
++		break;
++
++	case RB_PAGE_UPDATE:
++		/*
++		 * This is an interrupt that interrupt the
++		 * previous update. Still more to do.
++		 */
++		break;
++	case RB_PAGE_NORMAL:
++		/*
++		 * An interrupt came in before the update
++		 * and processed this for us.
++		 * Nothing left to do.
++		 */
++		return 1;
++	case RB_PAGE_MOVED:
++		/*
++		 * The reader is on another CPU and just did
++		 * a swap with our next_page.
++		 * Try again.
++		 */
++		return 1;
++	default:
++		RB_WARN_ON(cpu_buffer, 1); /* WTF??? */
++		return -1;
++	}
++
++	/*
++	 * Now that we are here, the old head pointer is
++	 * set to UPDATE. This will keep the reader from
++	 * swapping the head page with the reader page.
++	 * The reader (on another CPU) will spin till
++	 * we are finished.
++	 *
++	 * We just need to protect against interrupts
++	 * doing the job. We will set the next pointer
++	 * to HEAD. After that, we set the old pointer
++	 * to NORMAL, but only if it was HEAD before.
++	 * otherwise we are an interrupt, and only
++	 * want the outer most commit to reset it.
++	 */
++	new_head = next_page;
++	rb_inc_page(cpu_buffer, &new_head);
++
++	ret = rb_head_page_set_head(cpu_buffer, new_head, next_page,
++				    RB_PAGE_NORMAL);
++
++	/*
++	 * Valid returns are:
++	 *  HEAD   - an interrupt came in and already set it.
++	 *  NORMAL - One of two things:
++	 *            1) We really set it.
++	 *            2) A bunch of interrupts came in and moved
++	 *               the page forward again.
++	 */
++	switch (ret) {
++	case RB_PAGE_HEAD:
++	case RB_PAGE_NORMAL:
++		/* OK */
++		break;
++	default:
++		RB_WARN_ON(cpu_buffer, 1);
++		return -1;
++	}
++
++	/*
++	 * It is possible that an interrupt came in,
++	 * set the head up, then more interrupts came in
++	 * and moved it again. When we get back here,
++	 * the page would have been set to NORMAL but we
++	 * just set it back to HEAD.
++	 *
++	 * How do you detect this? Well, if that happened
++	 * the tail page would have moved.
++	 */
++	if (ret == RB_PAGE_NORMAL) {
++		/*
++		 * If the tail had moved passed next, then we need
++		 * to reset the pointer.
++		 */
++		if (cpu_buffer->tail_page != tail_page &&
++		    cpu_buffer->tail_page != next_page)
++			rb_head_page_set_normal(cpu_buffer, new_head,
++						next_page,
++						RB_PAGE_HEAD);
++	}
++
++	/*
++	 * If this was the outer most commit (the one that
++	 * changed the original pointer from HEAD to UPDATE),
++	 * then it is up to us to reset it to NORMAL.
++	 */
++	if (type == RB_PAGE_HEAD) {
++		ret = rb_head_page_set_normal(cpu_buffer, next_page,
++					      tail_page,
++					      RB_PAGE_UPDATE);
++		if (RB_WARN_ON(cpu_buffer,
++			       ret != RB_PAGE_UPDATE))
++			return -1;
++	}
++
++	return 0;
++}
++
+ static unsigned rb_calculate_event_length(unsigned length)
+ {
+ 	struct ring_buffer_event event; /* Used only for sizeof array */
+@@ -1185,9 +1778,6 @@
+ 	event->type_len = RINGBUF_TYPE_PADDING;
+ 	/* time delta must be non zero */
+ 	event->time_delta = 1;
+-	/* Account for this as an entry */
+-	local_inc(&tail_page->entries);
+-	local_inc(&cpu_buffer->entries);
+ 
+ 	/* Set write to end of buffer */
+ 	length = (tail + length) - BUF_PAGE_SIZE;
+@@ -1200,96 +1790,93 @@
+ 	     struct buffer_page *commit_page,
+ 	     struct buffer_page *tail_page, u64 *ts)
+ {
+-	struct buffer_page *next_page, *head_page, *reader_page;
+ 	struct ring_buffer *buffer = cpu_buffer->buffer;
+-	bool lock_taken = false;
+-	unsigned long flags;
++	struct buffer_page *next_page;
++	int ret;
+ 
+ 	next_page = tail_page;
+ 
+-	local_irq_save(flags);
+-	/*
+-	 * Since the write to the buffer is still not
+-	 * fully lockless, we must be careful with NMIs.
+-	 * The locks in the writers are taken when a write
+-	 * crosses to a new page. The locks protect against
+-	 * races with the readers (this will soon be fixed
+-	 * with a lockless solution).
+-	 *
+-	 * Because we can not protect against NMIs, and we
+-	 * want to keep traces reentrant, we need to manage
+-	 * what happens when we are in an NMI.
+-	 *
+-	 * NMIs can happen after we take the lock.
+-	 * If we are in an NMI, only take the lock
+-	 * if it is not already taken. Otherwise
+-	 * simply fail.
+-	 */
+-	if (unlikely(in_nmi())) {
+-		if (!__raw_spin_trylock(&cpu_buffer->lock)) {
+-			cpu_buffer->nmi_dropped++;
+-			goto out_reset;
+-		}
+-	} else
+-		__raw_spin_lock(&cpu_buffer->lock);
+-
+-	lock_taken = true;
+-
+ 	rb_inc_page(cpu_buffer, &next_page);
+ 
+-	head_page = cpu_buffer->head_page;
+-	reader_page = cpu_buffer->reader_page;
+-
+-	/* we grabbed the lock before incrementing */
+-	if (RB_WARN_ON(cpu_buffer, next_page == reader_page))
+-		goto out_reset;
+-
+ 	/*
+ 	 * If for some reason, we had an interrupt storm that made
+ 	 * it all the way around the buffer, bail, and warn
+ 	 * about it.
+ 	 */
+ 	if (unlikely(next_page == commit_page)) {
+-		cpu_buffer->commit_overrun++;
++		local_inc(&cpu_buffer->commit_overrun);
+ 		goto out_reset;
+ 	}
+ 
+-	if (next_page == head_page) {
+-		if (!(buffer->flags & RB_FL_OVERWRITE))
+-			goto out_reset;
+-
+-		/* tail_page has not moved yet? */
+-		if (tail_page == cpu_buffer->tail_page) {
+-			/* count overflows */
+-			cpu_buffer->overrun +=
+-				local_read(&head_page->entries);
+-
+-			rb_inc_page(cpu_buffer, &head_page);
+-			cpu_buffer->head_page = head_page;
+-			cpu_buffer->head_page->read = 0;
+-		}
+-	}
+-
+ 	/*
+-	 * If the tail page is still the same as what we think
+-	 * it is, then it is up to us to update the tail
+-	 * pointer.
++	 * This is where the fun begins!
++	 *
++	 * We are fighting against races between a reader that
++	 * could be on another CPU trying to swap its reader
++	 * page with the buffer head.
++	 *
++	 * We are also fighting against interrupts coming in and
++	 * moving the head or tail on us as well.
++	 *
++	 * If the next page is the head page then we have filled
++	 * the buffer, unless the commit page is still on the
++	 * reader page.
+ 	 */
+-	if (tail_page == cpu_buffer->tail_page) {
+-		local_set(&next_page->write, 0);
+-		local_set(&next_page->entries, 0);
+-		local_set(&next_page->page->commit, 0);
+-		cpu_buffer->tail_page = next_page;
++	if (rb_is_head_page(cpu_buffer, next_page, &tail_page->list)) {
+ 
+-		/* reread the time stamp */
++		/*
++		 * If the commit is not on the reader page, then
++		 * move the header page.
++		 */
++		if (!rb_is_reader_page(cpu_buffer->commit_page)) {
++			/*
++			 * If we are not in overwrite mode,
++			 * this is easy, just stop here.
++			 */
++			if (!(buffer->flags & RB_FL_OVERWRITE))
++				goto out_reset;
++
++			ret = rb_handle_head_page(cpu_buffer,
++						  tail_page,
++						  next_page);
++			if (ret < 0)
++				goto out_reset;
++			if (ret)
++				goto out_again;
++		} else {
++			/*
++			 * We need to be careful here too. The
++			 * commit page could still be on the reader
++			 * page. We could have a small buffer, and
++			 * have filled up the buffer with events
++			 * from interrupts and such, and wrapped.
++			 *
++			 * Note, if the tail page is also the on the
++			 * reader_page, we let it move out.
++			 */
++			if (unlikely((cpu_buffer->commit_page !=
++				      cpu_buffer->tail_page) &&
++				     (cpu_buffer->commit_page ==
++				      cpu_buffer->reader_page))) {
++				local_inc(&cpu_buffer->commit_overrun);
++				goto out_reset;
++			}
++		}
++	}
++
++	ret = rb_tail_page_update(cpu_buffer, tail_page, next_page);
++	if (ret) {
++		/*
++		 * Nested commits always have zero deltas, so
++		 * just reread the time stamp
++		 */
+ 		*ts = rb_time_stamp(buffer, cpu_buffer->cpu);
+-		cpu_buffer->tail_page->page->time_stamp = *ts;
++		next_page->page->time_stamp = *ts;
+ 	}
+ 
+-	rb_reset_tail(cpu_buffer, tail_page, tail, length);
++ out_again:
+ 
+-	__raw_spin_unlock(&cpu_buffer->lock);
+-	local_irq_restore(flags);
++	rb_reset_tail(cpu_buffer, tail_page, tail, length);
+ 
+ 	/* fail and let the caller try again */
+ 	return ERR_PTR(-EAGAIN);
+@@ -1298,9 +1885,6 @@
+ 	/* reset write */
+ 	rb_reset_tail(cpu_buffer, tail_page, tail, length);
+ 
+-	if (likely(lock_taken))
+-		__raw_spin_unlock(&cpu_buffer->lock);
+-	local_irq_restore(flags);
+ 	return NULL;
+ }
+ 
+@@ -1317,6 +1901,9 @@
+ 	barrier();
+ 	tail_page = cpu_buffer->tail_page;
+ 	write = local_add_return(length, &tail_page->write);
++
++	/* set write to only the index of the write */
++	write &= RB_WRITE_MASK;
+ 	tail = write - length;
+ 
+ 	/* See if we shot pass the end of this buffer page */
+@@ -1361,12 +1948,16 @@
+ 	bpage = cpu_buffer->tail_page;
+ 
+ 	if (bpage->page == (void *)addr && rb_page_write(bpage) == old_index) {
++		unsigned long write_mask =
++			local_read(&bpage->write) & ~RB_WRITE_MASK;
+ 		/*
+ 		 * This is on the tail page. It is possible that
+ 		 * a write could come in and move the tail page
+ 		 * and write to the next page. That is fine
+ 		 * because we just shorten what is on this page.
+ 		 */
++		old_index += write_mask;
++		new_index += write_mask;
+ 		index = local_cmpxchg(&bpage->write, old_index, new_index);
+ 		if (index == old_index)
+ 			return 1;
+@@ -1482,7 +2073,8 @@
+ }
+ 
+ static struct ring_buffer_event *
+-rb_reserve_next_event(struct ring_buffer_per_cpu *cpu_buffer,
++rb_reserve_next_event(struct ring_buffer *buffer,
++		      struct ring_buffer_per_cpu *cpu_buffer,
+ 		      unsigned long length)
+ {
+ 	struct ring_buffer_event *event;
+@@ -1492,6 +2084,21 @@
+ 
+ 	rb_start_commit(cpu_buffer);
+ 
++#ifdef CONFIG_RING_BUFFER_ALLOW_SWAP
++	/*
++	 * Due to the ability to swap a cpu buffer from a buffer
++	 * it is possible it was swapped before we committed.
++	 * (committing stops a swap). We check for it here and
++	 * if it happened, we have to fail the write.
++	 */
++	barrier();
++	if (unlikely(ACCESS_ONCE(cpu_buffer->buffer) != buffer)) {
++		local_dec(&cpu_buffer->committing);
++		local_dec(&cpu_buffer->commits);
++		return NULL;
++	}
++#endif
++
+ 	length = rb_calculate_event_length(length);
+  again:
+ 	/*
+@@ -1652,7 +2259,7 @@
+ 	if (length > BUF_MAX_DATA_SIZE)
+ 		goto out;
+ 
+-	event = rb_reserve_next_event(cpu_buffer, length);
++	event = rb_reserve_next_event(buffer, cpu_buffer, length);
+ 	if (!event)
+ 		goto out;
+ 
+@@ -1675,18 +2282,23 @@
+ }
+ EXPORT_SYMBOL_GPL(ring_buffer_lock_reserve);
+ 
+-static void rb_commit(struct ring_buffer_per_cpu *cpu_buffer,
++static void
++rb_update_write_stamp(struct ring_buffer_per_cpu *cpu_buffer,
+ 		      struct ring_buffer_event *event)
+ {
+-	local_inc(&cpu_buffer->entries);
+-
+ 	/*
+ 	 * The event first in the commit queue updates the
+ 	 * time stamp.
+ 	 */
+ 	if (rb_event_is_commit(cpu_buffer, event))
+ 		cpu_buffer->write_stamp += event->time_delta;
++}
+ 
++static void rb_commit(struct ring_buffer_per_cpu *cpu_buffer,
++		      struct ring_buffer_event *event)
++{
++	local_inc(&cpu_buffer->entries);
++	rb_update_write_stamp(cpu_buffer, event);
+ 	rb_end_commit(cpu_buffer);
+ }
+ 
+@@ -1733,32 +2345,57 @@
+ 		event->time_delta = 1;
+ }
+ 
+-/**
+- * ring_buffer_event_discard - discard any event in the ring buffer
+- * @event: the event to discard
+- *
+- * Sometimes a event that is in the ring buffer needs to be ignored.
+- * This function lets the user discard an event in the ring buffer
+- * and then that event will not be read later.
+- *
+- * Note, it is up to the user to be careful with this, and protect
+- * against races. If the user discards an event that has been consumed
+- * it is possible that it could corrupt the ring buffer.
++/*
++ * Decrement the entries to the page that an event is on.
++ * The event does not even need to exist, only the pointer
++ * to the page it is on. This may only be called before the commit
++ * takes place.
+  */
+-void ring_buffer_event_discard(struct ring_buffer_event *event)
++static inline void
++rb_decrement_entry(struct ring_buffer_per_cpu *cpu_buffer,
++		   struct ring_buffer_event *event)
+ {
+-	rb_event_discard(event);
++	unsigned long addr = (unsigned long)event;
++	struct buffer_page *bpage = cpu_buffer->commit_page;
++	struct buffer_page *start;
++
++	addr &= PAGE_MASK;
++
++	/* Do the likely case first */
++	if (likely(bpage->page == (void *)addr)) {
++		local_dec(&bpage->entries);
++		return;
++	}
++
++	/*
++	 * Because the commit page may be on the reader page we
++	 * start with the next page and check the end loop there.
++	 */
++	rb_inc_page(cpu_buffer, &bpage);
++	start = bpage;
++	do {
++		if (bpage->page == (void *)addr) {
++			local_dec(&bpage->entries);
++			return;
++		}
++		rb_inc_page(cpu_buffer, &bpage);
++	} while (bpage != start);
++
++	/* commit not part of this buffer?? */
++	RB_WARN_ON(cpu_buffer, 1);
+ }
+-EXPORT_SYMBOL_GPL(ring_buffer_event_discard);
+ 
+ /**
+  * ring_buffer_commit_discard - discard an event that has not been committed
+  * @buffer: the ring buffer
+  * @event: non committed event to discard
+  *
+- * This is similar to ring_buffer_event_discard but must only be
+- * performed on an event that has not been committed yet. The difference
+- * is that this will also try to free the event from the ring buffer
++ * Sometimes an event that is in the ring buffer needs to be ignored.
++ * This function lets the user discard an event in the ring buffer
++ * and then that event will not be read later.
++ *
++ * This function only works if it is called before the the item has been
++ * committed. It will try to free the event from the ring buffer
+  * if another event has not been added behind it.
+  *
+  * If another event has been added behind it, it will set the event
+@@ -1786,14 +2423,15 @@
+ 	 */
+ 	RB_WARN_ON(buffer, !local_read(&cpu_buffer->committing));
+ 
++	rb_decrement_entry(cpu_buffer, event);
+ 	if (rb_try_to_discard(cpu_buffer, event))
+ 		goto out;
+ 
+ 	/*
+ 	 * The commit is still visible by the reader, so we
+-	 * must increment entries.
++	 * must still update the timestamp.
+ 	 */
+-	local_inc(&cpu_buffer->entries);
++	rb_update_write_stamp(cpu_buffer, event);
+  out:
+ 	rb_end_commit(cpu_buffer);
+ 
+@@ -1854,7 +2492,7 @@
+ 	if (length > BUF_MAX_DATA_SIZE)
+ 		goto out;
+ 
+-	event = rb_reserve_next_event(cpu_buffer, length);
++	event = rb_reserve_next_event(buffer, cpu_buffer, length);
+ 	if (!event)
+ 		goto out;
+ 
+@@ -1875,9 +2513,13 @@
+ static int rb_per_cpu_empty(struct ring_buffer_per_cpu *cpu_buffer)
+ {
+ 	struct buffer_page *reader = cpu_buffer->reader_page;
+-	struct buffer_page *head = cpu_buffer->head_page;
++	struct buffer_page *head = rb_set_head_page(cpu_buffer);
+ 	struct buffer_page *commit = cpu_buffer->commit_page;
+ 
++	/* In case of error, head will be NULL */
++	if (unlikely(!head))
++		return 1;
++
+ 	return reader->read == rb_page_commit(reader) &&
+ 		(commit == reader ||
+ 		 (commit == head &&
+@@ -1968,7 +2610,7 @@
+ 		return 0;
+ 
+ 	cpu_buffer = buffer->buffers[cpu];
+-	ret = (local_read(&cpu_buffer->entries) - cpu_buffer->overrun)
++	ret = (local_read(&cpu_buffer->entries) - local_read(&cpu_buffer->overrun))
+ 		- cpu_buffer->read;
+ 
+ 	return ret;
+@@ -1989,33 +2631,13 @@
+ 		return 0;
+ 
+ 	cpu_buffer = buffer->buffers[cpu];
+-	ret = cpu_buffer->overrun;
++	ret = local_read(&cpu_buffer->overrun);
+ 
+ 	return ret;
+ }
+ EXPORT_SYMBOL_GPL(ring_buffer_overrun_cpu);
+ 
+ /**
+- * ring_buffer_nmi_dropped_cpu - get the number of nmis that were dropped
+- * @buffer: The ring buffer
+- * @cpu: The per CPU buffer to get the number of overruns from
+- */
+-unsigned long ring_buffer_nmi_dropped_cpu(struct ring_buffer *buffer, int cpu)
+-{
+-	struct ring_buffer_per_cpu *cpu_buffer;
+-	unsigned long ret;
+-
+-	if (!cpumask_test_cpu(cpu, buffer->cpumask))
+-		return 0;
+-
+-	cpu_buffer = buffer->buffers[cpu];
+-	ret = cpu_buffer->nmi_dropped;
+-
+-	return ret;
+-}
+-EXPORT_SYMBOL_GPL(ring_buffer_nmi_dropped_cpu);
+-
+-/**
+  * ring_buffer_commit_overrun_cpu - get the number of overruns caused by commits
+  * @buffer: The ring buffer
+  * @cpu: The per CPU buffer to get the number of overruns from
+@@ -2030,7 +2652,7 @@
+ 		return 0;
+ 
+ 	cpu_buffer = buffer->buffers[cpu];
+-	ret = cpu_buffer->commit_overrun;
++	ret = local_read(&cpu_buffer->commit_overrun);
+ 
+ 	return ret;
+ }
+@@ -2053,7 +2675,7 @@
+ 	for_each_buffer_cpu(buffer, cpu) {
+ 		cpu_buffer = buffer->buffers[cpu];
+ 		entries += (local_read(&cpu_buffer->entries) -
+-			    cpu_buffer->overrun) - cpu_buffer->read;
++			    local_read(&cpu_buffer->overrun)) - cpu_buffer->read;
+ 	}
+ 
+ 	return entries;
+@@ -2076,7 +2698,7 @@
+ 	/* if you care about this being correct, lock the buffer */
+ 	for_each_buffer_cpu(buffer, cpu) {
+ 		cpu_buffer = buffer->buffers[cpu];
+-		overruns += cpu_buffer->overrun;
++		overruns += local_read(&cpu_buffer->overrun);
+ 	}
+ 
+ 	return overruns;
+@@ -2089,8 +2711,10 @@
+ 
+ 	/* Iterator usage is expected to have record disabled */
+ 	if (list_empty(&cpu_buffer->reader_page->list)) {
+-		iter->head_page = cpu_buffer->head_page;
+-		iter->head = cpu_buffer->head_page->read;
++		iter->head_page = rb_set_head_page(cpu_buffer);
++		if (unlikely(!iter->head_page))
++			return;
++		iter->head = iter->head_page->read;
+ 	} else {
+ 		iter->head_page = cpu_buffer->reader_page;
+ 		iter->head = cpu_buffer->reader_page->read;
+@@ -2118,9 +2742,9 @@
+ 
+ 	cpu_buffer = iter->cpu_buffer;
+ 
+-	spin_lock_irqsave(&cpu_buffer->reader_lock, flags);
++	atomic_spin_lock_irqsave(&cpu_buffer->reader_lock, flags);
+ 	rb_iter_reset(iter);
+-	spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags);
++	atomic_spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags);
+ }
+ EXPORT_SYMBOL_GPL(ring_buffer_iter_reset);
+ 
+@@ -2207,6 +2831,7 @@
+ 	struct buffer_page *reader = NULL;
+ 	unsigned long flags;
+ 	int nr_loops = 0;
++	int ret;
+ 
+ 	local_irq_save(flags);
+ 	__raw_spin_lock(&cpu_buffer->lock);
+@@ -2240,30 +2865,56 @@
+ 		goto out;
+ 
+ 	/*
+-	 * Splice the empty reader page into the list around the head.
+ 	 * Reset the reader page to size zero.
+ 	 */
++	local_set(&cpu_buffer->reader_page->write, 0);
++	local_set(&cpu_buffer->reader_page->entries, 0);
++	local_set(&cpu_buffer->reader_page->page->commit, 0);
+ 
+-	reader = cpu_buffer->head_page;
++ spin:
++	/*
++	 * Splice the empty reader page into the list around the head.
++	 */
++	reader = rb_set_head_page(cpu_buffer);
+ 	cpu_buffer->reader_page->list.next = reader->list.next;
+ 	cpu_buffer->reader_page->list.prev = reader->list.prev;
+ 
+-	local_set(&cpu_buffer->reader_page->write, 0);
+-	local_set(&cpu_buffer->reader_page->entries, 0);
+-	local_set(&cpu_buffer->reader_page->page->commit, 0);
++	/*
++	 * cpu_buffer->pages just needs to point to the buffer, it
++	 *  has no specific buffer page to point to. Lets move it out
++	 *  of our way so we don't accidently swap it.
++	 */
++	cpu_buffer->pages = reader->list.prev;
+ 
+-	/* Make the reader page now replace the head */
+-	reader->list.prev->next = &cpu_buffer->reader_page->list;
+-	reader->list.next->prev = &cpu_buffer->reader_page->list;
++	/* The reader page will be pointing to the new head */
++	rb_set_list_to_head(cpu_buffer, &cpu_buffer->reader_page->list);
+ 
+ 	/*
+-	 * If the tail is on the reader, then we must set the head
+-	 * to the inserted page, otherwise we set it one before.
++	 * Here's the tricky part.
++	 *
++	 * We need to move the pointer past the header page.
++	 * But we can only do that if a writer is not currently
++	 * moving it. The page before the header page has the
++	 * flag bit '1' set if it is pointing to the page we want.
++	 * but if the writer is in the process of moving it
++	 * than it will be '2' or already moved '0'.
+ 	 */
+-	cpu_buffer->head_page = cpu_buffer->reader_page;
+ 
+-	if (cpu_buffer->commit_page != reader)
+-		rb_inc_page(cpu_buffer, &cpu_buffer->head_page);
++	ret = rb_head_page_replace(reader, cpu_buffer->reader_page);
++
++	/*
++	 * If we did not convert it, then we must try again.
++	 */
++	if (!ret)
++		goto spin;
++
++	/*
++	 * Yeah! We succeeded in replacing the page.
++	 *
++	 * Now make the new head point back to the reader page.
++	 */
++	reader->list.next->prev = &cpu_buffer->reader_page->list;
++	rb_inc_page(cpu_buffer, &cpu_buffer->head_page);
+ 
+ 	/* Finally update the reader page to the new head */
+ 	cpu_buffer->reader_page = reader;
+@@ -2292,8 +2943,7 @@
+ 
+ 	event = rb_reader_event(cpu_buffer);
+ 
+-	if (event->type_len <= RINGBUF_TYPE_DATA_TYPE_LEN_MAX
+-			|| rb_discarded_event(event))
++	if (event->type_len <= RINGBUF_TYPE_DATA_TYPE_LEN_MAX)
+ 		cpu_buffer->read++;
+ 
+ 	rb_update_read_stamp(cpu_buffer, event);
+@@ -2347,15 +2997,12 @@
+ }
+ 
+ static struct ring_buffer_event *
+-rb_buffer_peek(struct ring_buffer *buffer, int cpu, u64 *ts)
++rb_buffer_peek(struct ring_buffer_per_cpu *cpu_buffer, u64 *ts)
+ {
+-	struct ring_buffer_per_cpu *cpu_buffer;
+ 	struct ring_buffer_event *event;
+ 	struct buffer_page *reader;
+ 	int nr_loops = 0;
+ 
+-	cpu_buffer = buffer->buffers[cpu];
+-
+  again:
+ 	/*
+ 	 * We repeat when a timestamp is encountered. It is possible
+@@ -2399,7 +3046,7 @@
+ 	case RINGBUF_TYPE_DATA:
+ 		if (ts) {
+ 			*ts = cpu_buffer->read_stamp + event->time_delta;
+-			ring_buffer_normalize_time_stamp(buffer,
++			ring_buffer_normalize_time_stamp(cpu_buffer->buffer,
+ 							 cpu_buffer->cpu, ts);
+ 		}
+ 		return event;
+@@ -2517,18 +3164,16 @@
+  again:
+ 	local_irq_save(flags);
+ 	if (dolock)
+-		spin_lock(&cpu_buffer->reader_lock);
+-	event = rb_buffer_peek(buffer, cpu, ts);
++		atomic_spin_lock(&cpu_buffer->reader_lock);
++	event = rb_buffer_peek(cpu_buffer, ts);
+ 	if (event && event->type_len == RINGBUF_TYPE_PADDING)
+ 		rb_advance_reader(cpu_buffer);
+ 	if (dolock)
+-		spin_unlock(&cpu_buffer->reader_lock);
++		atomic_spin_unlock(&cpu_buffer->reader_lock);
+ 	local_irq_restore(flags);
+ 
+-	if (event && event->type_len == RINGBUF_TYPE_PADDING) {
+-		cpu_relax();
++	if (event && event->type_len == RINGBUF_TYPE_PADDING)
+ 		goto again;
+-	}
+ 
+ 	return event;
+ }
+@@ -2549,14 +3194,12 @@
+ 	unsigned long flags;
+ 
+  again:
+-	spin_lock_irqsave(&cpu_buffer->reader_lock, flags);
++	atomic_spin_lock_irqsave(&cpu_buffer->reader_lock, flags);
+ 	event = rb_iter_peek(iter, ts);
+-	spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags);
++	atomic_spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags);
+ 
+-	if (event && event->type_len == RINGBUF_TYPE_PADDING) {
+-		cpu_relax();
++	if (event && event->type_len == RINGBUF_TYPE_PADDING)
+ 		goto again;
+-	}
+ 
+ 	return event;
+ }
+@@ -2589,23 +3232,21 @@
+ 	cpu_buffer = buffer->buffers[cpu];
+ 	local_irq_save(flags);
+ 	if (dolock)
+-		spin_lock(&cpu_buffer->reader_lock);
++		atomic_spin_lock(&cpu_buffer->reader_lock);
+ 
+-	event = rb_buffer_peek(buffer, cpu, ts);
++	event = rb_buffer_peek(cpu_buffer, ts);
+ 	if (event)
+ 		rb_advance_reader(cpu_buffer);
+ 
+ 	if (dolock)
+-		spin_unlock(&cpu_buffer->reader_lock);
++		atomic_spin_unlock(&cpu_buffer->reader_lock);
+ 	local_irq_restore(flags);
+ 
+  out:
+ 	preempt_enable();
+ 
+-	if (event && event->type_len == RINGBUF_TYPE_PADDING) {
+-		cpu_relax();
++	if (event && event->type_len == RINGBUF_TYPE_PADDING)
+ 		goto again;
+-	}
+ 
+ 	return event;
+ }
+@@ -2644,11 +3285,11 @@
+ 	atomic_inc(&cpu_buffer->record_disabled);
+ 	synchronize_sched();
+ 
+-	spin_lock_irqsave(&cpu_buffer->reader_lock, flags);
++	atomic_spin_lock_irqsave(&cpu_buffer->reader_lock, flags);
+ 	__raw_spin_lock(&cpu_buffer->lock);
+ 	rb_iter_reset(iter);
+ 	__raw_spin_unlock(&cpu_buffer->lock);
+-	spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags);
++	atomic_spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags);
+ 
+ 	return iter;
+ }
+@@ -2685,20 +3326,18 @@
+ 	struct ring_buffer_per_cpu *cpu_buffer = iter->cpu_buffer;
+ 	unsigned long flags;
+ 
++	atomic_spin_lock_irqsave(&cpu_buffer->reader_lock, flags);
+  again:
+-	spin_lock_irqsave(&cpu_buffer->reader_lock, flags);
+ 	event = rb_iter_peek(iter, ts);
+ 	if (!event)
+ 		goto out;
+ 
++	if (event->type_len == RINGBUF_TYPE_PADDING)
++		goto again;
++
+ 	rb_advance_iter(iter);
+  out:
+-	spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags);
+-
+-	if (event && event->type_len == RINGBUF_TYPE_PADDING) {
+-		cpu_relax();
+-		goto again;
+-	}
++	atomic_spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags);
+ 
+ 	return event;
+ }
+@@ -2717,8 +3356,10 @@
+ static void
+ rb_reset_cpu(struct ring_buffer_per_cpu *cpu_buffer)
+ {
++	rb_head_page_deactivate(cpu_buffer);
++
+ 	cpu_buffer->head_page
+-		= list_entry(cpu_buffer->pages.next, struct buffer_page, list);
++		= list_entry(cpu_buffer->pages, struct buffer_page, list);
+ 	local_set(&cpu_buffer->head_page->write, 0);
+ 	local_set(&cpu_buffer->head_page->entries, 0);
+ 	local_set(&cpu_buffer->head_page->page->commit, 0);
+@@ -2734,16 +3375,17 @@
+ 	local_set(&cpu_buffer->reader_page->page->commit, 0);
+ 	cpu_buffer->reader_page->read = 0;
+ 
+-	cpu_buffer->nmi_dropped = 0;
+-	cpu_buffer->commit_overrun = 0;
+-	cpu_buffer->overrun = 0;
+-	cpu_buffer->read = 0;
++	local_set(&cpu_buffer->commit_overrun, 0);
++	local_set(&cpu_buffer->overrun, 0);
+ 	local_set(&cpu_buffer->entries, 0);
+ 	local_set(&cpu_buffer->committing, 0);
+ 	local_set(&cpu_buffer->commits, 0);
++	cpu_buffer->read = 0;
+ 
+ 	cpu_buffer->write_stamp = 0;
+ 	cpu_buffer->read_stamp = 0;
++
++	rb_head_page_activate(cpu_buffer);
+ }
+ 
+ /**
+@@ -2761,7 +3403,10 @@
+ 
+ 	atomic_inc(&cpu_buffer->record_disabled);
+ 
+-	spin_lock_irqsave(&cpu_buffer->reader_lock, flags);
++	atomic_spin_lock_irqsave(&cpu_buffer->reader_lock, flags);
++
++	if (RB_WARN_ON(cpu_buffer, local_read(&cpu_buffer->committing)))
++		goto out;
+ 
+ 	__raw_spin_lock(&cpu_buffer->lock);
+ 
+@@ -2769,7 +3414,8 @@
+ 
+ 	__raw_spin_unlock(&cpu_buffer->lock);
+ 
+-	spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags);
++ out:
++	atomic_spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags);
+ 
+ 	atomic_dec(&cpu_buffer->record_disabled);
+ }
+@@ -2807,10 +3453,10 @@
+ 		cpu_buffer = buffer->buffers[cpu];
+ 		local_irq_save(flags);
+ 		if (dolock)
+-			spin_lock(&cpu_buffer->reader_lock);
++			atomic_spin_lock(&cpu_buffer->reader_lock);
+ 		ret = rb_per_cpu_empty(cpu_buffer);
+ 		if (dolock)
+-			spin_unlock(&cpu_buffer->reader_lock);
++			atomic_spin_unlock(&cpu_buffer->reader_lock);
+ 		local_irq_restore(flags);
+ 
+ 		if (!ret)
+@@ -2841,16 +3487,17 @@
+ 	cpu_buffer = buffer->buffers[cpu];
+ 	local_irq_save(flags);
+ 	if (dolock)
+-		spin_lock(&cpu_buffer->reader_lock);
++		atomic_spin_lock(&cpu_buffer->reader_lock);
+ 	ret = rb_per_cpu_empty(cpu_buffer);
+ 	if (dolock)
+-		spin_unlock(&cpu_buffer->reader_lock);
++		atomic_spin_unlock(&cpu_buffer->reader_lock);
+ 	local_irq_restore(flags);
+ 
+ 	return ret;
+ }
+ EXPORT_SYMBOL_GPL(ring_buffer_empty_cpu);
+ 
++#ifdef CONFIG_RING_BUFFER_ALLOW_SWAP
+ /**
+  * ring_buffer_swap_cpu - swap a CPU buffer between two ring buffers
+  * @buffer_a: One buffer to swap with
+@@ -2905,20 +3552,28 @@
+ 	atomic_inc(&cpu_buffer_a->record_disabled);
+ 	atomic_inc(&cpu_buffer_b->record_disabled);
+ 
++	ret = -EBUSY;
++	if (local_read(&cpu_buffer_a->committing))
++		goto out_dec;
++	if (local_read(&cpu_buffer_b->committing))
++		goto out_dec;
++
+ 	buffer_a->buffers[cpu] = cpu_buffer_b;
+ 	buffer_b->buffers[cpu] = cpu_buffer_a;
+ 
+ 	cpu_buffer_b->buffer = buffer_a;
+ 	cpu_buffer_a->buffer = buffer_b;
+ 
++	ret = 0;
++
++out_dec:
+ 	atomic_dec(&cpu_buffer_a->record_disabled);
+ 	atomic_dec(&cpu_buffer_b->record_disabled);
+-
+-	ret = 0;
+ out:
+ 	return ret;
+ }
+ EXPORT_SYMBOL_GPL(ring_buffer_swap_cpu);
++#endif /* CONFIG_RING_BUFFER_ALLOW_SWAP */
+ 
+ /**
+  * ring_buffer_alloc_read_page - allocate a page to read from buffer
+@@ -3030,7 +3685,7 @@
+ 	if (!bpage)
+ 		goto out;
+ 
+-	spin_lock_irqsave(&cpu_buffer->reader_lock, flags);
++	atomic_spin_lock_irqsave(&cpu_buffer->reader_lock, flags);
+ 
+ 	reader = rb_get_reader_page(cpu_buffer);
+ 	if (!reader)
+@@ -3091,7 +3746,7 @@
+ 		read = 0;
+ 	} else {
+ 		/* update the entry counter */
+-		cpu_buffer->read += local_read(&reader->entries);
++		cpu_buffer->read += rb_page_entries(reader);
+ 
+ 		/* swap the pages */
+ 		rb_init_page(bpage);
+@@ -3105,7 +3760,7 @@
+ 	ret = read;
+ 
+  out_unlock:
+-	spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags);
++	atomic_spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags);
+ 
+  out:
+ 	return ret;
+Index: linux-rt-2.6.31/kernel/trace/trace.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/trace/trace.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/trace/trace.c	2010-05-17 14:23:20.118466134 +0200
+@@ -43,14 +43,11 @@
+ 
+ #define TRACE_BUFFER_FLAGS	(RB_FL_OVERWRITE)
+ 
+-unsigned long __read_mostly	tracing_max_latency;
+-unsigned long __read_mostly	tracing_thresh;
+-
+ /*
+  * On boot up, the ring buffer is set to the minimum size, so that
+  * we do not waste memory on systems that are not using tracing.
+  */
+-static int ring_buffer_expanded;
++int ring_buffer_expanded;
+ 
+ /*
+  * We need to change this state when a selftest is running.
+@@ -64,7 +61,7 @@
+ /*
+  * If a tracer is running, we do not want to run SELFTEST.
+  */
+-static bool __read_mostly tracing_selftest_disabled;
++bool __read_mostly tracing_selftest_disabled;
+ 
+ /* For tracers that don't implement custom flags */
+ static struct tracer_opt dummy_tracer_opt[] = {
+@@ -89,7 +86,7 @@
+  */
+ static int tracing_disabled = 1;
+ 
+-static DEFINE_PER_CPU(local_t, ftrace_cpu_disabled);
++DEFINE_PER_CPU(local_t, ftrace_cpu_disabled);
+ 
+ static inline void ftrace_disable_cpu(void)
+ {
+@@ -172,10 +169,11 @@
+ 
+ static DEFINE_PER_CPU(struct trace_array_cpu, global_trace_cpu);
+ 
+-int filter_current_check_discard(struct ftrace_event_call *call, void *rec,
++int filter_current_check_discard(struct ring_buffer *buffer,
++				 struct ftrace_event_call *call, void *rec,
+ 				 struct ring_buffer_event *event)
+ {
+-	return filter_check_discard(call, rec, global_trace.buffer, event);
++	return filter_check_discard(call, rec, buffer, event);
+ }
+ EXPORT_SYMBOL_GPL(filter_current_check_discard);
+ 
+@@ -266,6 +264,9 @@
+ 	TRACE_ITER_ANNOTATE | TRACE_ITER_CONTEXT_INFO | TRACE_ITER_SLEEP_TIME |
+ 	TRACE_ITER_GRAPH_TIME;
+ 
++static int trace_stop_count;
++static DEFINE_ATOMIC_SPINLOCK(tracing_start_lock);
++
+ /**
+  * trace_wake_up - wake up tasks waiting for trace input
+  *
+@@ -274,6 +275,10 @@
+  */
+ void trace_wake_up(void)
+ {
++#ifdef CONFIG_PREEMPT_RT
++	if (in_atomic() || irqs_disabled())
++		return;
++#endif
+ 	/*
+ 	 * The runqueue_is_locked() can fail, but this is the best we
+ 	 * have for now:
+@@ -323,49 +328,125 @@
+ 	"printk-msg-only",
+ 	"context-info",
+ 	"latency-format",
+-	"global-clock",
+ 	"sleep-time",
+ 	"graph-time",
+ 	NULL
+ };
+ 
++static struct {
++	u64 (*func)(void);
++	const char *name;
++} trace_clocks[] = {
++	{ trace_clock_local,	"local" },
++	{ trace_clock_global,	"global" },
++};
++
++int trace_clock_id;
++
+ /*
+- * ftrace_max_lock is used to protect the swapping of buffers
+- * when taking a max snapshot. The buffers themselves are
+- * protected by per_cpu spinlocks. But the action of the swap
+- * needs its own lock.
+- *
+- * This is defined as a raw_spinlock_t in order to help
+- * with performance when lockdep debugging is enabled.
++ * trace_parser_get_init - gets the buffer for trace parser
+  */
+-static raw_spinlock_t ftrace_max_lock =
+-	(raw_spinlock_t)__RAW_SPIN_LOCK_UNLOCKED;
++int trace_parser_get_init(struct trace_parser *parser, int size)
++{
++	memset(parser, 0, sizeof(*parser));
++
++	parser->buffer = kmalloc(size, GFP_KERNEL);
++	if (!parser->buffer)
++		return 1;
++
++	parser->size = size;
++	return 0;
++}
+ 
+ /*
+- * Copy the new maximum trace into the separate maximum-trace
+- * structure. (this way the maximum trace is permanently saved,
+- * for later retrieval via /sys/kernel/debug/tracing/latency_trace)
++ * trace_parser_put - frees the buffer for trace parser
+  */
+-static void
+-__update_max_tr(struct trace_array *tr, struct task_struct *tsk, int cpu)
++void trace_parser_put(struct trace_parser *parser)
+ {
+-	struct trace_array_cpu *data = tr->data[cpu];
++	kfree(parser->buffer);
++}
+ 
+-	max_tr.cpu = cpu;
+-	max_tr.time_start = data->preempt_timestamp;
++/*
++ * trace_get_user - reads the user input string separated by  space
++ * (matched by isspace(ch))
++ *
++ * For each string found the 'struct trace_parser' is updated,
++ * and the function returns.
++ *
++ * Returns number of bytes read.
++ *
++ * See kernel/trace/trace.h for 'struct trace_parser' details.
++ */
++int trace_get_user(struct trace_parser *parser, const char __user *ubuf,
++	size_t cnt, loff_t *ppos)
++{
++	char ch;
++	size_t read = 0;
++	ssize_t ret;
+ 
+-	data = max_tr.data[cpu];
+-	data->saved_latency = tracing_max_latency;
++	if (!*ppos)
++		trace_parser_clear(parser);
+ 
+-	memcpy(data->comm, tsk->comm, TASK_COMM_LEN);
+-	data->pid = tsk->pid;
+-	data->uid = task_uid(tsk);
+-	data->nice = tsk->static_prio - 20 - MAX_RT_PRIO;
+-	data->policy = tsk->policy;
+-	data->rt_priority = tsk->rt_priority;
++	ret = get_user(ch, ubuf++);
++	if (ret)
++		goto out;
+ 
+-	/* record this tasks comm */
+-	tracing_record_cmdline(tsk);
++	read++;
++	cnt--;
++
++	/*
++	 * The parser is not finished with the last write,
++	 * continue reading the user input without skipping spaces.
++	 */
++	if (!parser->cont) {
++		/* skip white space */
++		while (cnt && isspace(ch)) {
++			ret = get_user(ch, ubuf++);
++			if (ret)
++				goto out;
++			read++;
++			cnt--;
++		}
++
++		/* only spaces were written */
++		if (isspace(ch)) {
++			*ppos += read;
++			ret = read;
++			goto out;
++		}
++
++		parser->idx = 0;
++	}
++
++	/* read the non-space input */
++	while (cnt && !isspace(ch)) {
++		if (parser->idx < parser->size)
++			parser->buffer[parser->idx++] = ch;
++		else {
++			ret = -EINVAL;
++			goto out;
++		}
++		ret = get_user(ch, ubuf++);
++		if (ret)
++			goto out;
++		read++;
++		cnt--;
++	}
++
++	/* We either got finished input or we have to wait for another call. */
++	if (isspace(ch)) {
++		parser->buffer[parser->idx] = 0;
++		parser->cont = false;
++	} else {
++		parser->cont = true;
++		parser->buffer[parser->idx++] = ch;
++	}
++
++	*ppos += read;
++	ret = read;
++
++out:
++	return ret;
+ }
+ 
+ ssize_t trace_seq_to_user(struct trace_seq *s, char __user *ubuf, size_t cnt)
+@@ -411,6 +492,56 @@
+ 	return cnt;
+ }
+ 
++/*
++ * ftrace_max_lock is used to protect the swapping of buffers
++ * when taking a max snapshot. The buffers themselves are
++ * protected by per_cpu spinlocks. But the action of the swap
++ * needs its own lock.
++ *
++ * This is defined as a raw_spinlock_t in order to help
++ * with performance when lockdep debugging is enabled.
++ *
++ * It is also used in other places outside the update_max_tr
++ * so it needs to be defined outside of the
++ * CONFIG_TRACER_MAX_TRACE.
++ */
++static raw_spinlock_t ftrace_max_lock =
++	(raw_spinlock_t)__RAW_SPIN_LOCK_UNLOCKED;
++
++#ifdef CONFIG_TRACER_MAX_TRACE
++unsigned long __read_mostly	tracing_max_latency;
++unsigned long __read_mostly	tracing_thresh;
++
++/*
++ * Copy the new maximum trace into the separate maximum-trace
++ * structure. (this way the maximum trace is permanently saved,
++ * for later retrieval via /sys/kernel/debug/tracing/latency_trace)
++ */
++static void
++__update_max_tr(struct trace_array *tr, struct task_struct *tsk, int cpu)
++{
++	struct trace_array_cpu *data = tr->data[cpu];
++	struct trace_array_cpu *max_data = tr->data[cpu];
++
++	max_tr.cpu = cpu;
++	max_tr.time_start = data->preempt_timestamp;
++
++	max_data = max_tr.data[cpu];
++	max_data->saved_latency = tracing_max_latency;
++	max_data->critical_start = data->critical_start;
++	max_data->critical_end = data->critical_end;
++
++	memcpy(data->comm, tsk->comm, TASK_COMM_LEN);
++	max_data->pid = tsk->pid;
++	max_data->uid = task_uid(tsk);
++	max_data->nice = tsk->static_prio - 20 - MAX_RT_PRIO;
++	max_data->policy = tsk->policy;
++	max_data->rt_priority = tsk->rt_priority;
++
++	/* record this tasks comm */
++	tracing_record_cmdline(tsk);
++}
++
+ /**
+  * update_max_tr - snapshot all trace buffers from global_trace to max_tr
+  * @tr: tracer
+@@ -425,16 +556,15 @@
+ {
+ 	struct ring_buffer *buf = tr->buffer;
+ 
++	if (trace_stop_count)
++		return;
++
+ 	WARN_ON_ONCE(!irqs_disabled());
+ 	__raw_spin_lock(&ftrace_max_lock);
+ 
+ 	tr->buffer = max_tr.buffer;
+ 	max_tr.buffer = buf;
+ 
+-	ftrace_disable_cpu();
+-	ring_buffer_reset(tr->buffer);
+-	ftrace_enable_cpu();
+-
+ 	__update_max_tr(tr, tsk, cpu);
+ 	__raw_spin_unlock(&ftrace_max_lock);
+ }
+@@ -452,21 +582,35 @@
+ {
+ 	int ret;
+ 
++	if (trace_stop_count)
++		return;
++
+ 	WARN_ON_ONCE(!irqs_disabled());
+ 	__raw_spin_lock(&ftrace_max_lock);
+ 
+ 	ftrace_disable_cpu();
+ 
+-	ring_buffer_reset(max_tr.buffer);
+ 	ret = ring_buffer_swap_cpu(max_tr.buffer, tr->buffer, cpu);
+ 
++	if (ret == -EBUSY) {
++		/*
++		 * We failed to swap the buffer due to a commit taking
++		 * place on this CPU. We fail to record, but we reset
++		 * the max trace buffer (no one writes directly to it)
++		 * and flag that it failed.
++		 */
++		trace_array_printk(&max_tr, _THIS_IP_,
++			"Failed to swap buffers due to commit in progress\n");
++	}
++
+ 	ftrace_enable_cpu();
+ 
+-	WARN_ON_ONCE(ret && ret != -EAGAIN);
++	WARN_ON_ONCE(ret && ret != -EAGAIN && ret != -EBUSY);
+ 
+ 	__update_max_tr(tr, tsk, cpu);
+ 	__raw_spin_unlock(&ftrace_max_lock);
+ }
++#endif /* CONFIG_TRACER_MAX_TRACE */
+ 
+ /**
+  * register_tracer - register a tracer with the ftrace system.
+@@ -523,7 +667,6 @@
+ 	if (type->selftest && !tracing_selftest_disabled) {
+ 		struct tracer *saved_tracer = current_trace;
+ 		struct trace_array *tr = &global_trace;
+-		int i;
+ 
+ 		/*
+ 		 * Run a selftest on this tracer.
+@@ -532,8 +675,7 @@
+ 		 * internal tracing to verify that everything is in order.
+ 		 * If we fail, we do not register this tracer.
+ 		 */
+-		for_each_tracing_cpu(i)
+-			tracing_reset(tr, i);
++		tracing_reset_online_cpus(tr);
+ 
+ 		current_trace = type;
+ 		/* the test is responsible for initializing and enabling */
+@@ -546,8 +688,7 @@
+ 			goto out;
+ 		}
+ 		/* Only reset on passing, to avoid touching corrupted buffers */
+-		for_each_tracing_cpu(i)
+-			tracing_reset(tr, i);
++		tracing_reset_online_cpus(tr);
+ 
+ 		printk(KERN_CONT "PASSED\n");
+ 	}
+@@ -622,21 +763,42 @@
+ 	mutex_unlock(&trace_types_lock);
+ }
+ 
+-void tracing_reset(struct trace_array *tr, int cpu)
++static void __tracing_reset(struct trace_array *tr, int cpu)
+ {
+ 	ftrace_disable_cpu();
+ 	ring_buffer_reset_cpu(tr->buffer, cpu);
+ 	ftrace_enable_cpu();
+ }
+ 
++void tracing_reset(struct trace_array *tr, int cpu)
++{
++	struct ring_buffer *buffer = tr->buffer;
++
++	ring_buffer_record_disable(buffer);
++
++	/* Make sure all commits have finished */
++	synchronize_sched();
++	__tracing_reset(tr, cpu);
++
++	ring_buffer_record_enable(buffer);
++}
++
+ void tracing_reset_online_cpus(struct trace_array *tr)
+ {
++	struct ring_buffer *buffer = tr->buffer;
+ 	int cpu;
+ 
++	ring_buffer_record_disable(buffer);
++
++	/* Make sure all commits have finished */
++	synchronize_sched();
++
+ 	tr->time_start = ftrace_now(tr->cpu);
+ 
+ 	for_each_online_cpu(cpu)
+-		tracing_reset(tr, cpu);
++		__tracing_reset(tr, cpu);
++
++	ring_buffer_record_enable(buffer);
+ }
+ 
+ void tracing_reset_current(int cpu)
+@@ -667,8 +829,10 @@
+ 	cmdline_idx = 0;
+ }
+ 
+-static int trace_stop_count;
+-static DEFINE_SPINLOCK(tracing_start_lock);
++int is_tracing_stopped(void)
++{
++	return trace_stop_count;
++}
+ 
+ /**
+  * ftrace_off_permanent - disable all ftrace code permanently
+@@ -699,7 +863,7 @@
+ 	if (tracing_disabled)
+ 		return;
+ 
+-	spin_lock_irqsave(&tracing_start_lock, flags);
++	atomic_spin_lock_irqsave(&tracing_start_lock, flags);
+ 	if (--trace_stop_count) {
+ 		if (trace_stop_count < 0) {
+ 			/* Someone screwed up their debugging */
+@@ -720,7 +884,7 @@
+ 
+ 	ftrace_start();
+  out:
+-	spin_unlock_irqrestore(&tracing_start_lock, flags);
++	atomic_spin_unlock_irqrestore(&tracing_start_lock, flags);
+ }
+ 
+ /**
+@@ -735,7 +899,7 @@
+ 	unsigned long flags;
+ 
+ 	ftrace_stop();
+-	spin_lock_irqsave(&tracing_start_lock, flags);
++	atomic_spin_lock_irqsave(&tracing_start_lock, flags);
+ 	if (trace_stop_count++)
+ 		goto out;
+ 
+@@ -748,7 +912,7 @@
+ 		ring_buffer_record_disable(buffer);
+ 
+  out:
+-	spin_unlock_irqrestore(&tracing_start_lock, flags);
++	atomic_spin_unlock_irqrestore(&tracing_start_lock, flags);
+ }
+ 
+ void trace_stop_cmdline_recording(void);
+@@ -837,7 +1001,7 @@
+ 
+ 	entry->preempt_count		= pc & 0xff;
+ 	entry->pid			= (tsk) ? tsk->pid : 0;
+-	entry->tgid			= (tsk) ? tsk->tgid : 0;
++	entry->lock_depth		= (tsk) ? tsk->lock_depth : 0;
+ 	entry->flags =
+ #ifdef CONFIG_TRACE_IRQFLAGS_SUPPORT
+ 		(irqs_disabled_flags(flags) ? TRACE_FLAG_IRQS_OFF : 0) |
+@@ -850,14 +1014,15 @@
+ }
+ EXPORT_SYMBOL_GPL(tracing_generic_entry_update);
+ 
+-struct ring_buffer_event *trace_buffer_lock_reserve(struct trace_array *tr,
+-						    int type,
+-						    unsigned long len,
+-						    unsigned long flags, int pc)
++struct ring_buffer_event *
++trace_buffer_lock_reserve(struct ring_buffer *buffer,
++			  int type,
++			  unsigned long len,
++			  unsigned long flags, int pc)
+ {
+ 	struct ring_buffer_event *event;
+ 
+-	event = ring_buffer_lock_reserve(tr->buffer, len);
++	event = ring_buffer_lock_reserve(buffer, len);
+ 	if (event != NULL) {
+ 		struct trace_entry *ent = ring_buffer_event_data(event);
+ 
+@@ -867,58 +1032,60 @@
+ 
+ 	return event;
+ }
+-static void ftrace_trace_stack(struct trace_array *tr,
+-			       unsigned long flags, int skip, int pc);
+-static void ftrace_trace_userstack(struct trace_array *tr,
+-				   unsigned long flags, int pc);
+ 
+-static inline void __trace_buffer_unlock_commit(struct trace_array *tr,
+-					struct ring_buffer_event *event,
+-					unsigned long flags, int pc,
+-					int wake)
++static inline void
++__trace_buffer_unlock_commit(struct ring_buffer *buffer,
++			     struct ring_buffer_event *event,
++			     unsigned long flags, int pc,
++			     int wake)
+ {
+-	ring_buffer_unlock_commit(tr->buffer, event);
++	ring_buffer_unlock_commit(buffer, event);
+ 
+-	ftrace_trace_stack(tr, flags, 6, pc);
+-	ftrace_trace_userstack(tr, flags, pc);
++	ftrace_trace_stack(buffer, flags, 6, pc);
++	ftrace_trace_userstack(buffer, flags, pc);
+ 
+ 	if (wake)
+ 		trace_wake_up();
+ }
+ 
+-void trace_buffer_unlock_commit(struct trace_array *tr,
+-					struct ring_buffer_event *event,
+-					unsigned long flags, int pc)
++void trace_buffer_unlock_commit(struct ring_buffer *buffer,
++				struct ring_buffer_event *event,
++				unsigned long flags, int pc)
+ {
+-	__trace_buffer_unlock_commit(tr, event, flags, pc, 1);
++	__trace_buffer_unlock_commit(buffer, event, flags, pc, 1);
+ }
+ 
+ struct ring_buffer_event *
+-trace_current_buffer_lock_reserve(int type, unsigned long len,
++trace_current_buffer_lock_reserve(struct ring_buffer **current_rb,
++				  int type, unsigned long len,
+ 				  unsigned long flags, int pc)
+ {
+-	return trace_buffer_lock_reserve(&global_trace,
++	*current_rb = global_trace.buffer;
++	return trace_buffer_lock_reserve(*current_rb,
+ 					 type, len, flags, pc);
+ }
+ EXPORT_SYMBOL_GPL(trace_current_buffer_lock_reserve);
+ 
+-void trace_current_buffer_unlock_commit(struct ring_buffer_event *event,
++void trace_current_buffer_unlock_commit(struct ring_buffer *buffer,
++					struct ring_buffer_event *event,
+ 					unsigned long flags, int pc)
+ {
+-	__trace_buffer_unlock_commit(&global_trace, event, flags, pc, 1);
++	__trace_buffer_unlock_commit(buffer, event, flags, pc, 1);
+ }
+ EXPORT_SYMBOL_GPL(trace_current_buffer_unlock_commit);
+ 
+-void trace_nowake_buffer_unlock_commit(struct ring_buffer_event *event,
+-					unsigned long flags, int pc)
++void trace_nowake_buffer_unlock_commit(struct ring_buffer *buffer,
++				       struct ring_buffer_event *event,
++				       unsigned long flags, int pc)
+ {
+-	__trace_buffer_unlock_commit(&global_trace, event, flags, pc, 0);
++	__trace_buffer_unlock_commit(buffer, event, flags, pc, 0);
+ }
+ EXPORT_SYMBOL_GPL(trace_nowake_buffer_unlock_commit);
+ 
+-void trace_current_buffer_discard_commit(struct ring_buffer_event *event)
++void trace_current_buffer_discard_commit(struct ring_buffer *buffer,
++					 struct ring_buffer_event *event)
+ {
+-	ring_buffer_discard_commit(global_trace.buffer, event);
++	ring_buffer_discard_commit(buffer, event);
+ }
+ EXPORT_SYMBOL_GPL(trace_current_buffer_discard_commit);
+ 
+@@ -928,6 +1095,7 @@
+ 	       int pc)
+ {
+ 	struct ftrace_event_call *call = &event_function;
++	struct ring_buffer *buffer = tr->buffer;
+ 	struct ring_buffer_event *event;
+ 	struct ftrace_entry *entry;
+ 
+@@ -935,7 +1103,7 @@
+ 	if (unlikely(local_read(&__get_cpu_var(ftrace_cpu_disabled))))
+ 		return;
+ 
+-	event = trace_buffer_lock_reserve(tr, TRACE_FN, sizeof(*entry),
++	event = trace_buffer_lock_reserve(buffer, TRACE_FN, sizeof(*entry),
+ 					  flags, pc);
+ 	if (!event)
+ 		return;
+@@ -943,58 +1111,10 @@
+ 	entry->ip			= ip;
+ 	entry->parent_ip		= parent_ip;
+ 
+-	if (!filter_check_discard(call, entry, tr->buffer, event))
+-		ring_buffer_unlock_commit(tr->buffer, event);
+-}
+-
+-#ifdef CONFIG_FUNCTION_GRAPH_TRACER
+-static int __trace_graph_entry(struct trace_array *tr,
+-				struct ftrace_graph_ent *trace,
+-				unsigned long flags,
+-				int pc)
+-{
+-	struct ftrace_event_call *call = &event_funcgraph_entry;
+-	struct ring_buffer_event *event;
+-	struct ftrace_graph_ent_entry *entry;
+-
+-	if (unlikely(local_read(&__get_cpu_var(ftrace_cpu_disabled))))
+-		return 0;
+-
+-	event = trace_buffer_lock_reserve(&global_trace, TRACE_GRAPH_ENT,
+-					  sizeof(*entry), flags, pc);
+-	if (!event)
+-		return 0;
+-	entry	= ring_buffer_event_data(event);
+-	entry->graph_ent			= *trace;
+-	if (!filter_current_check_discard(call, entry, event))
+-		ring_buffer_unlock_commit(global_trace.buffer, event);
+-
+-	return 1;
++	if (!filter_check_discard(call, entry, buffer, event))
++		ring_buffer_unlock_commit(buffer, event);
+ }
+ 
+-static void __trace_graph_return(struct trace_array *tr,
+-				struct ftrace_graph_ret *trace,
+-				unsigned long flags,
+-				int pc)
+-{
+-	struct ftrace_event_call *call = &event_funcgraph_exit;
+-	struct ring_buffer_event *event;
+-	struct ftrace_graph_ret_entry *entry;
+-
+-	if (unlikely(local_read(&__get_cpu_var(ftrace_cpu_disabled))))
+-		return;
+-
+-	event = trace_buffer_lock_reserve(&global_trace, TRACE_GRAPH_RET,
+-					  sizeof(*entry), flags, pc);
+-	if (!event)
+-		return;
+-	entry	= ring_buffer_event_data(event);
+-	entry->ret				= *trace;
+-	if (!filter_current_check_discard(call, entry, event))
+-		ring_buffer_unlock_commit(global_trace.buffer, event);
+-}
+-#endif
+-
+ void
+ ftrace(struct trace_array *tr, struct trace_array_cpu *data,
+        unsigned long ip, unsigned long parent_ip, unsigned long flags,
+@@ -1004,17 +1124,17 @@
+ 		trace_function(tr, ip, parent_ip, flags, pc);
+ }
+ 
+-static void __ftrace_trace_stack(struct trace_array *tr,
++#ifdef CONFIG_STACKTRACE
++static void __ftrace_trace_stack(struct ring_buffer *buffer,
+ 				 unsigned long flags,
+ 				 int skip, int pc)
+ {
+-#ifdef CONFIG_STACKTRACE
+ 	struct ftrace_event_call *call = &event_kernel_stack;
+ 	struct ring_buffer_event *event;
+ 	struct stack_entry *entry;
+ 	struct stack_trace trace;
+ 
+-	event = trace_buffer_lock_reserve(tr, TRACE_STACK,
++	event = trace_buffer_lock_reserve(buffer, TRACE_STACK,
+ 					  sizeof(*entry), flags, pc);
+ 	if (!event)
+ 		return;
+@@ -1027,32 +1147,28 @@
+ 	trace.entries		= entry->caller;
+ 
+ 	save_stack_trace(&trace);
+-	if (!filter_check_discard(call, entry, tr->buffer, event))
+-		ring_buffer_unlock_commit(tr->buffer, event);
+-#endif
++	if (!filter_check_discard(call, entry, buffer, event))
++		ring_buffer_unlock_commit(buffer, event);
+ }
+ 
+-static void ftrace_trace_stack(struct trace_array *tr,
+-			       unsigned long flags,
+-			       int skip, int pc)
++void ftrace_trace_stack(struct ring_buffer *buffer, unsigned long flags,
++			int skip, int pc)
+ {
+ 	if (!(trace_flags & TRACE_ITER_STACKTRACE))
+ 		return;
+ 
+-	__ftrace_trace_stack(tr, flags, skip, pc);
++	__ftrace_trace_stack(buffer, flags, skip, pc);
+ }
+ 
+-void __trace_stack(struct trace_array *tr,
+-		   unsigned long flags,
+-		   int skip, int pc)
++void __trace_stack(struct trace_array *tr, unsigned long flags, int skip,
++		   int pc)
+ {
+-	__ftrace_trace_stack(tr, flags, skip, pc);
++	__ftrace_trace_stack(tr->buffer, flags, skip, pc);
+ }
+ 
+-static void ftrace_trace_userstack(struct trace_array *tr,
+-				   unsigned long flags, int pc)
++void
++ftrace_trace_userstack(struct ring_buffer *buffer, unsigned long flags, int pc)
+ {
+-#ifdef CONFIG_STACKTRACE
+ 	struct ftrace_event_call *call = &event_user_stack;
+ 	struct ring_buffer_event *event;
+ 	struct userstack_entry *entry;
+@@ -1061,12 +1177,13 @@
+ 	if (!(trace_flags & TRACE_ITER_USERSTACKTRACE))
+ 		return;
+ 
+-	event = trace_buffer_lock_reserve(tr, TRACE_USER_STACK,
++	event = trace_buffer_lock_reserve(buffer, TRACE_USER_STACK,
+ 					  sizeof(*entry), flags, pc);
+ 	if (!event)
+ 		return;
+ 	entry	= ring_buffer_event_data(event);
+ 
++	entry->tgid		= current->tgid;
+ 	memset(&entry->caller, 0, sizeof(entry->caller));
+ 
+ 	trace.nr_entries	= 0;
+@@ -1075,9 +1192,8 @@
+ 	trace.entries		= entry->caller;
+ 
+ 	save_stack_trace_user(&trace);
+-	if (!filter_check_discard(call, entry, tr->buffer, event))
+-		ring_buffer_unlock_commit(tr->buffer, event);
+-#endif
++	if (!filter_check_discard(call, entry, buffer, event))
++		ring_buffer_unlock_commit(buffer, event);
+ }
+ 
+ #ifdef UNUSED
+@@ -1087,16 +1203,20 @@
+ }
+ #endif /* UNUSED */
+ 
++#endif /* CONFIG_STACKTRACE */
++
+ static void
+ ftrace_trace_special(void *__tr,
+ 		     unsigned long arg1, unsigned long arg2, unsigned long arg3,
+ 		     int pc)
+ {
++	struct ftrace_event_call *call = &event_special;
+ 	struct ring_buffer_event *event;
+ 	struct trace_array *tr = __tr;
++	struct ring_buffer *buffer = tr->buffer;
+ 	struct special_entry *entry;
+ 
+-	event = trace_buffer_lock_reserve(tr, TRACE_SPECIAL,
++	event = trace_buffer_lock_reserve(buffer, TRACE_SPECIAL,
+ 					  sizeof(*entry), 0, pc);
+ 	if (!event)
+ 		return;
+@@ -1104,7 +1224,9 @@
+ 	entry->arg1			= arg1;
+ 	entry->arg2			= arg2;
+ 	entry->arg3			= arg3;
+-	trace_buffer_unlock_commit(tr, event, 0, pc);
++
++	if (!filter_check_discard(call, entry, buffer, event))
++		trace_buffer_unlock_commit(buffer, event, 0, pc);
+ }
+ 
+ void
+@@ -1115,62 +1237,6 @@
+ }
+ 
+ void
+-tracing_sched_switch_trace(struct trace_array *tr,
+-			   struct task_struct *prev,
+-			   struct task_struct *next,
+-			   unsigned long flags, int pc)
+-{
+-	struct ftrace_event_call *call = &event_context_switch;
+-	struct ring_buffer_event *event;
+-	struct ctx_switch_entry *entry;
+-
+-	event = trace_buffer_lock_reserve(tr, TRACE_CTX,
+-					  sizeof(*entry), flags, pc);
+-	if (!event)
+-		return;
+-	entry	= ring_buffer_event_data(event);
+-	entry->prev_pid			= prev->pid;
+-	entry->prev_prio		= prev->prio;
+-	entry->prev_state		= prev->state;
+-	entry->next_pid			= next->pid;
+-	entry->next_prio		= next->prio;
+-	entry->next_state		= next->state;
+-	entry->next_cpu	= task_cpu(next);
+-
+-	if (!filter_check_discard(call, entry, tr->buffer, event))
+-		trace_buffer_unlock_commit(tr, event, flags, pc);
+-}
+-
+-void
+-tracing_sched_wakeup_trace(struct trace_array *tr,
+-			   struct task_struct *wakee,
+-			   struct task_struct *curr,
+-			   unsigned long flags, int pc)
+-{
+-	struct ftrace_event_call *call = &event_wakeup;
+-	struct ring_buffer_event *event;
+-	struct ctx_switch_entry *entry;
+-
+-	event = trace_buffer_lock_reserve(tr, TRACE_WAKE,
+-					  sizeof(*entry), flags, pc);
+-	if (!event)
+-		return;
+-	entry	= ring_buffer_event_data(event);
+-	entry->prev_pid			= curr->pid;
+-	entry->prev_prio		= curr->prio;
+-	entry->prev_state		= curr->state;
+-	entry->next_pid			= wakee->pid;
+-	entry->next_prio		= wakee->prio;
+-	entry->next_state		= wakee->state;
+-	entry->next_cpu			= task_cpu(wakee);
+-
+-	if (!filter_check_discard(call, entry, tr->buffer, event))
+-		ring_buffer_unlock_commit(tr->buffer, event);
+-	ftrace_trace_stack(tr, flags, 6, pc);
+-	ftrace_trace_userstack(tr, flags, pc);
+-}
+-
+-void
+ ftrace_special(unsigned long arg1, unsigned long arg2, unsigned long arg3)
+ {
+ 	struct trace_array *tr = &global_trace;
+@@ -1194,68 +1260,6 @@
+ 	local_irq_restore(flags);
+ }
+ 
+-#ifdef CONFIG_FUNCTION_GRAPH_TRACER
+-int trace_graph_entry(struct ftrace_graph_ent *trace)
+-{
+-	struct trace_array *tr = &global_trace;
+-	struct trace_array_cpu *data;
+-	unsigned long flags;
+-	long disabled;
+-	int ret;
+-	int cpu;
+-	int pc;
+-
+-	if (!ftrace_trace_task(current))
+-		return 0;
+-
+-	if (!ftrace_graph_addr(trace->func))
+-		return 0;
+-
+-	local_irq_save(flags);
+-	cpu = raw_smp_processor_id();
+-	data = tr->data[cpu];
+-	disabled = atomic_inc_return(&data->disabled);
+-	if (likely(disabled == 1)) {
+-		pc = preempt_count();
+-		ret = __trace_graph_entry(tr, trace, flags, pc);
+-	} else {
+-		ret = 0;
+-	}
+-	/* Only do the atomic if it is not already set */
+-	if (!test_tsk_trace_graph(current))
+-		set_tsk_trace_graph(current);
+-
+-	atomic_dec(&data->disabled);
+-	local_irq_restore(flags);
+-
+-	return ret;
+-}
+-
+-void trace_graph_return(struct ftrace_graph_ret *trace)
+-{
+-	struct trace_array *tr = &global_trace;
+-	struct trace_array_cpu *data;
+-	unsigned long flags;
+-	long disabled;
+-	int cpu;
+-	int pc;
+-
+-	local_irq_save(flags);
+-	cpu = raw_smp_processor_id();
+-	data = tr->data[cpu];
+-	disabled = atomic_inc_return(&data->disabled);
+-	if (likely(disabled == 1)) {
+-		pc = preempt_count();
+-		__trace_graph_return(tr, trace, flags, pc);
+-	}
+-	if (!trace->depth)
+-		clear_tsk_trace_graph(current);
+-	atomic_dec(&data->disabled);
+-	local_irq_restore(flags);
+-}
+-#endif /* CONFIG_FUNCTION_GRAPH_TRACER */
+-
+-
+ /**
+  * trace_vbprintk - write binary msg to tracing buffer
+  *
+@@ -1268,6 +1272,7 @@
+ 
+ 	struct ftrace_event_call *call = &event_bprint;
+ 	struct ring_buffer_event *event;
++	struct ring_buffer *buffer;
+ 	struct trace_array *tr = &global_trace;
+ 	struct trace_array_cpu *data;
+ 	struct bprint_entry *entry;
+@@ -1300,7 +1305,9 @@
+ 		goto out_unlock;
+ 
+ 	size = sizeof(*entry) + sizeof(u32) * len;
+-	event = trace_buffer_lock_reserve(tr, TRACE_BPRINT, size, flags, pc);
++	buffer = tr->buffer;
++	event = trace_buffer_lock_reserve(buffer, TRACE_BPRINT, size,
++					  flags, pc);
+ 	if (!event)
+ 		goto out_unlock;
+ 	entry = ring_buffer_event_data(event);
+@@ -1308,8 +1315,8 @@
+ 	entry->fmt			= fmt;
+ 
+ 	memcpy(entry->buf, trace_buf, sizeof(u32) * len);
+-	if (!filter_check_discard(call, entry, tr->buffer, event))
+-		ring_buffer_unlock_commit(tr->buffer, event);
++	if (!filter_check_discard(call, entry, buffer, event))
++		ring_buffer_unlock_commit(buffer, event);
+ 
+ out_unlock:
+ 	__raw_spin_unlock(&trace_buf_lock);
+@@ -1324,14 +1331,30 @@
+ }
+ EXPORT_SYMBOL_GPL(trace_vbprintk);
+ 
+-int trace_vprintk(unsigned long ip, const char *fmt, va_list args)
++int trace_array_printk(struct trace_array *tr,
++		       unsigned long ip, const char *fmt, ...)
++{
++	int ret;
++	va_list ap;
++
++	if (!(trace_flags & TRACE_ITER_PRINTK))
++		return 0;
++
++	va_start(ap, fmt);
++	ret = trace_array_vprintk(tr, ip, fmt, ap);
++	va_end(ap);
++	return ret;
++}
++
++int trace_array_vprintk(struct trace_array *tr,
++			unsigned long ip, const char *fmt, va_list args)
+ {
+ 	static raw_spinlock_t trace_buf_lock = __RAW_SPIN_LOCK_UNLOCKED;
+ 	static char trace_buf[TRACE_BUF_SIZE];
+ 
+ 	struct ftrace_event_call *call = &event_print;
+ 	struct ring_buffer_event *event;
+-	struct trace_array *tr = &global_trace;
++	struct ring_buffer *buffer;
+ 	struct trace_array_cpu *data;
+ 	int cpu, len = 0, size, pc;
+ 	struct print_entry *entry;
+@@ -1355,20 +1378,19 @@
+ 	__raw_spin_lock(&trace_buf_lock);
+ 	len = vsnprintf(trace_buf, TRACE_BUF_SIZE, fmt, args);
+ 
+-	len = min(len, TRACE_BUF_SIZE-1);
+-	trace_buf[len] = 0;
+-
+ 	size = sizeof(*entry) + len + 1;
+-	event = trace_buffer_lock_reserve(tr, TRACE_PRINT, size, irq_flags, pc);
++	buffer = tr->buffer;
++	event = trace_buffer_lock_reserve(buffer, TRACE_PRINT, size,
++					  irq_flags, pc);
+ 	if (!event)
+ 		goto out_unlock;
+ 	entry = ring_buffer_event_data(event);
+-	entry->ip			= ip;
++	entry->ip = ip;
+ 
+ 	memcpy(&entry->buf, trace_buf, len);
+-	entry->buf[len] = 0;
+-	if (!filter_check_discard(call, entry, tr->buffer, event))
+-		ring_buffer_unlock_commit(tr->buffer, event);
++	entry->buf[len] = '\0';
++	if (!filter_check_discard(call, entry, buffer, event))
++		ring_buffer_unlock_commit(buffer, event);
+ 
+  out_unlock:
+ 	__raw_spin_unlock(&trace_buf_lock);
+@@ -1380,6 +1402,11 @@
+ 
+ 	return len;
+ }
++
++int trace_vprintk(unsigned long ip, const char *fmt, va_list args)
++{
++	return trace_array_vprintk(&global_trace, ip, fmt, args);
++}
+ EXPORT_SYMBOL_GPL(trace_vprintk);
+ 
+ enum trace_file_type {
+@@ -1519,6 +1546,37 @@
+ 	return ent;
+ }
+ 
++static void tracing_iter_reset(struct trace_iterator *iter, int cpu)
++{
++	struct trace_array *tr = iter->tr;
++	struct ring_buffer_event *event;
++	struct ring_buffer_iter *buf_iter;
++	unsigned long entries = 0;
++	u64 ts;
++
++	tr->data[cpu]->skipped_entries = 0;
++
++	if (!iter->buffer_iter[cpu])
++		return;
++
++	buf_iter = iter->buffer_iter[cpu];
++	ring_buffer_iter_reset(buf_iter);
++
++	/*
++	 * We could have the case with the max latency tracers
++	 * that a reset never took place on a cpu. This is evident
++	 * by the timestamp being before the start of the buffer.
++	 */
++	while ((event = ring_buffer_iter_peek(buf_iter, &ts))) {
++		if (ts >= iter->tr->time_start)
++			break;
++		entries++;
++		ring_buffer_read(buf_iter, NULL);
++	}
++
++	tr->data[cpu]->skipped_entries = entries;
++}
++
+ /*
+  * No necessary locking here. The worst thing which can
+  * happen is loosing events consumed at the same time
+@@ -1557,10 +1615,9 @@
+ 
+ 		if (cpu_file == TRACE_PIPE_ALL_CPU) {
+ 			for_each_tracing_cpu(cpu)
+-				ring_buffer_iter_reset(iter->buffer_iter[cpu]);
++				tracing_iter_reset(iter, cpu);
+ 		} else
+-			ring_buffer_iter_reset(iter->buffer_iter[cpu_file]);
+-
++			tracing_iter_reset(iter, cpu_file);
+ 
+ 		ftrace_enable_cpu();
+ 
+@@ -1589,10 +1646,10 @@
+ 	seq_puts(m, "#                | / _----=> need-resched    \n");
+ 	seq_puts(m, "#                || / _---=> hardirq/softirq \n");
+ 	seq_puts(m, "#                ||| / _--=> preempt-depth   \n");
+-	seq_puts(m, "#                |||| /                      \n");
+-	seq_puts(m, "#                |||||     delay             \n");
+-	seq_puts(m, "#  cmd     pid   ||||| time  |   caller      \n");
+-	seq_puts(m, "#     \\   /      |||||   \\   |   /           \n");
++	seq_puts(m, "#                |||| /_--=> lock-depth       \n");
++	seq_puts(m, "#                |||||/     delay             \n");
++	seq_puts(m, "#  cmd     pid   |||||| time  |   caller      \n");
++	seq_puts(m, "#     \\   /      ||||||   \\   |   /           \n");
+ }
+ 
+ static void print_func_help_header(struct seq_file *m)
+@@ -1609,16 +1666,32 @@
+ 	struct trace_array *tr = iter->tr;
+ 	struct trace_array_cpu *data = tr->data[tr->cpu];
+ 	struct tracer *type = current_trace;
+-	unsigned long total;
+-	unsigned long entries;
++	unsigned long entries = 0;
++	unsigned long total = 0;
++	unsigned long count;
+ 	const char *name = "preemption";
++	int cpu;
+ 
+ 	if (type)
+ 		name = type->name;
+ 
+-	entries = ring_buffer_entries(iter->tr->buffer);
+-	total = entries +
+-		ring_buffer_overruns(iter->tr->buffer);
++
++	for_each_tracing_cpu(cpu) {
++		count = ring_buffer_entries_cpu(tr->buffer, cpu);
++		/*
++		 * If this buffer has skipped entries, then we hold all
++		 * entries for the trace and we need to ignore the
++		 * ones before the time stamp.
++		 */
++		if (tr->data[cpu]->skipped_entries) {
++			count -= tr->data[cpu]->skipped_entries;
++			/* total is the same as the entries */
++			total += count;
++		} else
++			total += count +
++				ring_buffer_overrun_cpu(tr->buffer, cpu);
++		entries += count;
++	}
+ 
+ 	seq_printf(m, "# %s latency trace v1.1.5 on %s\n",
+ 		   name, UTS_RELEASE);
+@@ -1660,7 +1733,7 @@
+ 		seq_puts(m, "\n#  => ended at:   ");
+ 		seq_print_ip_sym(&iter->seq, data->critical_end, sym_flags);
+ 		trace_print_seq(m, &iter->seq);
+-		seq_puts(m, "#\n");
++		seq_puts(m, "\n#\n");
+ 	}
+ 
+ 	seq_puts(m, "#\n");
+@@ -1679,6 +1752,9 @@
+ 	if (cpumask_test_cpu(iter->cpu, iter->started))
+ 		return;
+ 
++	if (iter->tr->data[iter->cpu]->skipped_entries)
++		return;
++
+ 	cpumask_set_cpu(iter->cpu, iter->started);
+ 
+ 	/* Don't print started cpu buffer for the first entry of the trace */
+@@ -1941,19 +2017,23 @@
+ 	if (ring_buffer_overruns(iter->tr->buffer))
+ 		iter->iter_flags |= TRACE_FILE_ANNOTATE;
+ 
++	/* stop the trace while dumping */
++	tracing_stop();
++
+ 	if (iter->cpu_file == TRACE_PIPE_ALL_CPU) {
+ 		for_each_tracing_cpu(cpu) {
+ 
+ 			iter->buffer_iter[cpu] =
+ 				ring_buffer_read_start(iter->tr->buffer, cpu);
++			tracing_iter_reset(iter, cpu);
+ 		}
+ 	} else {
+ 		cpu = iter->cpu_file;
+ 		iter->buffer_iter[cpu] =
+ 				ring_buffer_read_start(iter->tr->buffer, cpu);
++		tracing_iter_reset(iter, cpu);
+ 	}
+ 
+-	/* TODO stop tracer */
+ 	ret = seq_open(file, &tracer_seq_ops);
+ 	if (ret < 0) {
+ 		fail_ret = ERR_PTR(ret);
+@@ -1963,9 +2043,6 @@
+ 	m = file->private_data;
+ 	m->private = iter;
+ 
+-	/* stop the trace while dumping */
+-	tracing_stop();
+-
+ 	mutex_unlock(&trace_types_lock);
+ 
+ 	return iter;
+@@ -1976,6 +2053,7 @@
+ 			ring_buffer_read_finish(iter->buffer_iter[cpu]);
+ 	}
+ 	free_cpumask_var(iter->started);
++	tracing_start();
+  fail:
+ 	mutex_unlock(&trace_types_lock);
+ 	kfree(iter->trace);
+@@ -2257,8 +2335,8 @@
+ 		len += 3; /* "no" and newline */
+ 	}
+ 
+-	/* +2 for \n and \0 */
+-	buf = kmalloc(len + 2, GFP_KERNEL);
++	/* +1 for \0 */
++	buf = kmalloc(len + 1, GFP_KERNEL);
+ 	if (!buf) {
+ 		mutex_unlock(&trace_types_lock);
+ 		return -ENOMEM;
+@@ -2281,7 +2359,7 @@
+ 	}
+ 	mutex_unlock(&trace_types_lock);
+ 
+-	WARN_ON(r >= len + 2);
++	WARN_ON(r >= len + 1);
+ 
+ 	r = simple_read_from_buffer(ubuf, cnt, ppos, buf, r);
+ 
+@@ -2292,23 +2370,23 @@
+ /* Try to assign a tracer specific option */
+ static int set_tracer_option(struct tracer *trace, char *cmp, int neg)
+ {
+-	struct tracer_flags *trace_flags = trace->flags;
++	struct tracer_flags *tracer_flags = trace->flags;
+ 	struct tracer_opt *opts = NULL;
+ 	int ret = 0, i = 0;
+ 	int len;
+ 
+-	for (i = 0; trace_flags->opts[i].name; i++) {
+-		opts = &trace_flags->opts[i];
++	for (i = 0; tracer_flags->opts[i].name; i++) {
++		opts = &tracer_flags->opts[i];
+ 		len = strlen(opts->name);
+ 
+ 		if (strncmp(cmp, opts->name, len) == 0) {
+-			ret = trace->set_flag(trace_flags->val,
++			ret = trace->set_flag(tracer_flags->val,
+ 				opts->bit, !neg);
+ 			break;
+ 		}
+ 	}
+ 	/* Not found */
+-	if (!trace_flags->opts[i].name)
++	if (!tracer_flags->opts[i].name)
+ 		return -EINVAL;
+ 
+ 	/* Refused to handle */
+@@ -2316,9 +2394,9 @@
+ 		return ret;
+ 
+ 	if (neg)
+-		trace_flags->val &= ~opts->bit;
++		tracer_flags->val &= ~opts->bit;
+ 	else
+-		trace_flags->val |= opts->bit;
++		tracer_flags->val |= opts->bit;
+ 
+ 	return 0;
+ }
+@@ -2333,22 +2411,6 @@
+ 		trace_flags |= mask;
+ 	else
+ 		trace_flags &= ~mask;
+-
+-	if (mask == TRACE_ITER_GLOBAL_CLK) {
+-		u64 (*func)(void);
+-
+-		if (enabled)
+-			func = trace_clock_global;
+-		else
+-			func = trace_clock_local;
+-
+-		mutex_lock(&trace_types_lock);
+-		ring_buffer_set_clock(global_trace.buffer, func);
+-
+-		if (max_tr.buffer)
+-			ring_buffer_set_clock(max_tr.buffer, func);
+-		mutex_unlock(&trace_types_lock);
+-	}
+ }
+ 
+ static ssize_t
+@@ -3286,7 +3348,6 @@
+ 					size_t cnt, loff_t *fpos)
+ {
+ 	char *buf;
+-	char *end;
+ 
+ 	if (tracing_disabled)
+ 		return -EINVAL;
+@@ -3294,7 +3355,7 @@
+ 	if (cnt > TRACE_BUF_SIZE)
+ 		cnt = TRACE_BUF_SIZE;
+ 
+-	buf = kmalloc(cnt + 1, GFP_KERNEL);
++	buf = kmalloc(cnt + 2, GFP_KERNEL);
+ 	if (buf == NULL)
+ 		return -ENOMEM;
+ 
+@@ -3302,20 +3363,75 @@
+ 		kfree(buf);
+ 		return -EFAULT;
+ 	}
++	if (buf[cnt-1] != '\n') {
++		buf[cnt] = '\n';
++		buf[cnt+1] = '\0';
++	} else
++		buf[cnt] = '\0';
+ 
+-	/* Cut from the first nil or newline. */
+-	buf[cnt] = '\0';
+-	end = strchr(buf, '\n');
+-	if (end)
+-		*end = '\0';
+-
+-	cnt = mark_printk("%s\n", buf);
++	cnt = mark_printk("%s", buf);
+ 	kfree(buf);
+ 	*fpos += cnt;
+ 
+ 	return cnt;
+ }
+ 
++static ssize_t tracing_clock_read(struct file *filp, char __user *ubuf,
++				  size_t cnt, loff_t *ppos)
++{
++	char buf[64];
++	int bufiter = 0;
++	int i;
++
++	for (i = 0; i < ARRAY_SIZE(trace_clocks); i++)
++		bufiter += snprintf(buf + bufiter, sizeof(buf) - bufiter,
++			"%s%s%s%s", i ? " " : "",
++			i == trace_clock_id ? "[" : "", trace_clocks[i].name,
++			i == trace_clock_id ? "]" : "");
++	bufiter += snprintf(buf + bufiter, sizeof(buf) - bufiter, "\n");
++
++	return simple_read_from_buffer(ubuf, cnt, ppos, buf, bufiter);
++}
++
++static ssize_t tracing_clock_write(struct file *filp, const char __user *ubuf,
++				   size_t cnt, loff_t *fpos)
++{
++	char buf[64];
++	const char *clockstr;
++	int i;
++
++	if (cnt >= sizeof(buf))
++		return -EINVAL;
++
++	if (copy_from_user(&buf, ubuf, cnt))
++		return -EFAULT;
++
++	buf[cnt] = 0;
++
++	clockstr = strstrip(buf);
++
++	for (i = 0; i < ARRAY_SIZE(trace_clocks); i++) {
++		if (strcmp(trace_clocks[i].name, clockstr) == 0)
++			break;
++	}
++	if (i == ARRAY_SIZE(trace_clocks))
++		return -EINVAL;
++
++	trace_clock_id = i;
++
++	mutex_lock(&trace_types_lock);
++
++	ring_buffer_set_clock(global_trace.buffer, trace_clocks[i].func);
++	if (max_tr.buffer)
++		ring_buffer_set_clock(max_tr.buffer, trace_clocks[i].func);
++
++	mutex_unlock(&trace_types_lock);
++
++	*fpos += cnt;
++
++	return cnt;
++}
++
+ static const struct file_operations tracing_max_lat_fops = {
+ 	.open		= tracing_open_generic,
+ 	.read		= tracing_max_lat_read,
+@@ -3353,6 +3469,12 @@
+ 	.write		= tracing_mark_write,
+ };
+ 
++static const struct file_operations trace_clock_fops = {
++	.open		= tracing_open_generic,
++	.read		= tracing_clock_read,
++	.write		= tracing_clock_write,
++};
++
+ struct ftrace_buffer_info {
+ 	struct trace_array	*tr;
+ 	void			*spare;
+@@ -3633,9 +3755,6 @@
+ 	cnt = ring_buffer_commit_overrun_cpu(tr->buffer, cpu);
+ 	trace_seq_printf(s, "commit overrun: %ld\n", cnt);
+ 
+-	cnt = ring_buffer_nmi_dropped_cpu(tr->buffer, cpu);
+-	trace_seq_printf(s, "nmi dropped: %ld\n", cnt);
+-
+ 	count = simple_read_from_buffer(ubuf, count, ppos, s->buffer, s->len);
+ 
+ 	kfree(s);
+@@ -4066,11 +4185,13 @@
+ 	trace_create_file("current_tracer", 0644, d_tracer,
+ 			&global_trace, &set_tracer_fops);
+ 
++#ifdef CONFIG_TRACER_MAX_TRACE
+ 	trace_create_file("tracing_max_latency", 0644, d_tracer,
+ 			&tracing_max_latency, &tracing_max_lat_fops);
+ 
+ 	trace_create_file("tracing_thresh", 0644, d_tracer,
+ 			&tracing_thresh, &tracing_max_lat_fops);
++#endif
+ 
+ 	trace_create_file("README", 0444, d_tracer,
+ 			NULL, &tracing_readme_fops);
+@@ -4087,6 +4208,9 @@
+ 	trace_create_file("saved_cmdlines", 0444, d_tracer,
+ 			NULL, &tracing_saved_cmdlines_fops);
+ 
++	trace_create_file("trace_clock", 0644, d_tracer, NULL,
++			  &trace_clock_fops);
++
+ #ifdef CONFIG_DYNAMIC_FTRACE
+ 	trace_create_file("dyn_ftrace_total_info", 0444, d_tracer,
+ 			&ftrace_update_tot_cnt, &tracing_dyn_info_fops);
+@@ -4265,7 +4389,6 @@
+ 
+ __init static int tracer_alloc_buffers(void)
+ {
+-	struct trace_array_cpu *data;
+ 	int ring_buf_size;
+ 	int i;
+ 	int ret = -ENOMEM;
+@@ -4315,7 +4438,7 @@
+ 
+ 	/* Allocate the first page for all buffers */
+ 	for_each_tracing_cpu(i) {
+-		data = global_trace.data[i] = &per_cpu(global_trace_cpu, i);
++		global_trace.data[i] = &per_cpu(global_trace_cpu, i);
+ 		max_tr.data[i] = &per_cpu(max_data, i);
+ 	}
+ 
+Index: linux-rt-2.6.31/kernel/trace/trace.h
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/trace/trace.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/trace/trace.h	2010-05-17 14:23:20.118466134 +0200
+@@ -7,6 +7,7 @@
+ #include <linux/clocksource.h>
+ #include <linux/ring_buffer.h>
+ #include <linux/mmiotrace.h>
++#include <linux/tracepoint.h>
+ #include <linux/ftrace.h>
+ #include <trace/boot.h>
+ #include <linux/kmemtrace.h>
+@@ -34,8 +35,6 @@
+ 	TRACE_GRAPH_ENT,
+ 	TRACE_USER_STACK,
+ 	TRACE_HW_BRANCHES,
+-	TRACE_SYSCALL_ENTER,
+-	TRACE_SYSCALL_EXIT,
+ 	TRACE_KMEM_ALLOC,
+ 	TRACE_KMEM_FREE,
+ 	TRACE_POWER,
+@@ -44,157 +43,54 @@
+ 	__TRACE_LAST_TYPE,
+ };
+ 
+-/*
+- * Function trace entry - function address and parent function addres:
+- */
+-struct ftrace_entry {
+-	struct trace_entry	ent;
+-	unsigned long		ip;
+-	unsigned long		parent_ip;
+-};
+-
+-/* Function call entry */
+-struct ftrace_graph_ent_entry {
+-	struct trace_entry		ent;
+-	struct ftrace_graph_ent		graph_ent;
++enum kmemtrace_type_id {
++	KMEMTRACE_TYPE_KMALLOC = 0,	/* kmalloc() or kfree(). */
++	KMEMTRACE_TYPE_CACHE,		/* kmem_cache_*(). */
++	KMEMTRACE_TYPE_PAGES,		/* __get_free_pages() and friends. */
+ };
+ 
+-/* Function return entry */
+-struct ftrace_graph_ret_entry {
+-	struct trace_entry		ent;
+-	struct ftrace_graph_ret		ret;
+-};
+ extern struct tracer boot_tracer;
+ 
+-/*
+- * Context switch trace entry - which task (and prio) we switched from/to:
+- */
+-struct ctx_switch_entry {
+-	struct trace_entry	ent;
+-	unsigned int		prev_pid;
+-	unsigned char		prev_prio;
+-	unsigned char		prev_state;
+-	unsigned int		next_pid;
+-	unsigned char		next_prio;
+-	unsigned char		next_state;
+-	unsigned int		next_cpu;
+-};
+-
+-/*
+- * Special (free-form) trace entry:
+- */
+-struct special_entry {
+-	struct trace_entry	ent;
+-	unsigned long		arg1;
+-	unsigned long		arg2;
+-	unsigned long		arg3;
+-};
+-
+-/*
+- * Stack-trace entry:
+- */
+-
+-#define FTRACE_STACK_ENTRIES	8
+-
+-struct stack_entry {
+-	struct trace_entry	ent;
+-	unsigned long		caller[FTRACE_STACK_ENTRIES];
+-};
+-
+-struct userstack_entry {
+-	struct trace_entry	ent;
+-	unsigned long		caller[FTRACE_STACK_ENTRIES];
+-};
++#undef __field
++#define __field(type, item)		type	item;
+ 
+-/*
+- * trace_printk entry:
+- */
+-struct bprint_entry {
+-	struct trace_entry	ent;
+-	unsigned long		ip;
+-	const char		*fmt;
+-	u32			buf[];
+-};
++#undef __field_struct
++#define __field_struct(type, item)	__field(type, item)
+ 
+-struct print_entry {
+-	struct trace_entry	ent;
+-	unsigned long		ip;
+-	char			buf[];
+-};
++#undef __field_desc
++#define __field_desc(type, container, item)
+ 
+-#define TRACE_OLD_SIZE		88
++#undef __array
++#define __array(type, item, size)	type	item[size];
+ 
+-struct trace_field_cont {
+-	unsigned char		type;
+-	/* Temporary till we get rid of this completely */
+-	char			buf[TRACE_OLD_SIZE - 1];
+-};
++#undef __array_desc
++#define __array_desc(type, container, item, size)
+ 
+-struct trace_mmiotrace_rw {
+-	struct trace_entry	ent;
+-	struct mmiotrace_rw	rw;
+-};
++#undef __dynamic_array
++#define __dynamic_array(type, item)	type	item[];
+ 
+-struct trace_mmiotrace_map {
+-	struct trace_entry	ent;
+-	struct mmiotrace_map	map;
+-};
+-
+-struct trace_boot_call {
+-	struct trace_entry	ent;
+-	struct boot_trace_call boot_call;
+-};
+-
+-struct trace_boot_ret {
+-	struct trace_entry	ent;
+-	struct boot_trace_ret boot_ret;
+-};
+-
+-#define TRACE_FUNC_SIZE 30
+-#define TRACE_FILE_SIZE 20
+-struct trace_branch {
+-	struct trace_entry	ent;
+-	unsigned	        line;
+-	char			func[TRACE_FUNC_SIZE+1];
+-	char			file[TRACE_FILE_SIZE+1];
+-	char			correct;
+-};
++#undef F_STRUCT
++#define F_STRUCT(args...)		args
+ 
+-struct hw_branch_entry {
+-	struct trace_entry	ent;
+-	u64			from;
+-	u64			to;
+-};
++#undef FTRACE_ENTRY
++#define FTRACE_ENTRY(name, struct_name, id, tstruct, print)	\
++	struct struct_name {					\
++		struct trace_entry	ent;			\
++		tstruct						\
++	}
+ 
+-struct trace_power {
+-	struct trace_entry	ent;
+-	struct power_trace	state_data;
+-};
++#undef TP_ARGS
++#define TP_ARGS(args...)	args
+ 
+-enum kmemtrace_type_id {
+-	KMEMTRACE_TYPE_KMALLOC = 0,	/* kmalloc() or kfree(). */
+-	KMEMTRACE_TYPE_CACHE,		/* kmem_cache_*(). */
+-	KMEMTRACE_TYPE_PAGES,		/* __get_free_pages() and friends. */
+-};
++#undef FTRACE_ENTRY_DUP
++#define FTRACE_ENTRY_DUP(name, name_struct, id, tstruct, printk)
+ 
+-struct kmemtrace_alloc_entry {
+-	struct trace_entry	ent;
+-	enum kmemtrace_type_id type_id;
+-	unsigned long call_site;
+-	const void *ptr;
+-	size_t bytes_req;
+-	size_t bytes_alloc;
+-	gfp_t gfp_flags;
+-	int node;
+-};
+-
+-struct kmemtrace_free_entry {
+-	struct trace_entry	ent;
+-	enum kmemtrace_type_id type_id;
+-	unsigned long call_site;
+-	const void *ptr;
+-};
++#include "trace_entries.h"
+ 
++/*
++ * syscalls are special, and need special handling, this is why
++ * they are not included in trace_entries.h
++ */
+ struct syscall_trace_enter {
+ 	struct trace_entry	ent;
+ 	int			nr;
+@@ -207,13 +103,12 @@
+ 	unsigned long		ret;
+ };
+ 
+-
+ /*
+  * trace_flag_type is an enumeration that holds different
+  * states when a trace occurs. These are:
+  *  IRQS_OFF		- interrupts were disabled
+  *  IRQS_NOSUPPORT	- arch does not support irqs_disabled_flags
+- *  NEED_RESCED		- reschedule is requested
++ *  NEED_RESCHED	- reschedule is requested
+  *  HARDIRQ		- inside an interrupt handler
+  *  SOFTIRQ		- inside a softirq handler
+  */
+@@ -236,9 +131,6 @@
+ 	atomic_t		disabled;
+ 	void			*buffer_page;	/* ring buffer spare */
+ 
+-	/* these fields get copied into max-trace: */
+-	unsigned long		trace_idx;
+-	unsigned long		overrun;
+ 	unsigned long		saved_latency;
+ 	unsigned long		critical_start;
+ 	unsigned long		critical_end;
+@@ -246,6 +138,7 @@
+ 	unsigned long		nice;
+ 	unsigned long		policy;
+ 	unsigned long		rt_priority;
++	unsigned long		skipped_entries;
+ 	cycle_t			preempt_timestamp;
+ 	pid_t			pid;
+ 	uid_t			uid;
+@@ -319,10 +212,6 @@
+ 			  TRACE_KMEM_ALLOC);	\
+ 		IF_ASSIGN(var, ent, struct kmemtrace_free_entry,	\
+ 			  TRACE_KMEM_FREE);	\
+-		IF_ASSIGN(var, ent, struct syscall_trace_enter,		\
+-			  TRACE_SYSCALL_ENTER);				\
+-		IF_ASSIGN(var, ent, struct syscall_trace_exit,		\
+-			  TRACE_SYSCALL_EXIT);				\
+ 		__ftrace_bad_type();					\
+ 	} while (0)
+ 
+@@ -398,7 +287,6 @@
+ 	struct tracer		*next;
+ 	int			print_max;
+ 	struct tracer_flags	*flags;
+-	struct tracer_stat	*stats;
+ };
+ 
+ 
+@@ -423,12 +311,13 @@
+ 
+ struct ring_buffer_event;
+ 
+-struct ring_buffer_event *trace_buffer_lock_reserve(struct trace_array *tr,
+-						    int type,
+-						    unsigned long len,
+-						    unsigned long flags,
+-						    int pc);
+-void trace_buffer_unlock_commit(struct trace_array *tr,
++struct ring_buffer_event *
++trace_buffer_lock_reserve(struct ring_buffer *buffer,
++			  int type,
++			  unsigned long len,
++			  unsigned long flags,
++			  int pc);
++void trace_buffer_unlock_commit(struct ring_buffer *buffer,
+ 				struct ring_buffer_event *event,
+ 				unsigned long flags, int pc);
+ 
+@@ -467,6 +356,7 @@
+ 
+ void trace_graph_return(struct ftrace_graph_ret *trace);
+ int trace_graph_entry(struct ftrace_graph_ent *trace);
++void set_graph_array(struct trace_array *tr);
+ 
+ void tracing_start_cmdline_record(void);
+ void tracing_stop_cmdline_record(void);
+@@ -475,35 +365,46 @@
+ void tracing_start_sched_switch_record(void);
+ int register_tracer(struct tracer *type);
+ void unregister_tracer(struct tracer *type);
++int is_tracing_stopped(void);
+ 
+ extern unsigned long nsecs_to_usecs(unsigned long nsecs);
+ 
++#ifdef CONFIG_TRACER_MAX_TRACE
+ extern unsigned long tracing_max_latency;
+ extern unsigned long tracing_thresh;
+ 
+ void update_max_tr(struct trace_array *tr, struct task_struct *tsk, int cpu);
+ void update_max_tr_single(struct trace_array *tr,
+ 			  struct task_struct *tsk, int cpu);
++#endif /* CONFIG_TRACER_MAX_TRACE */
+ 
+-void __trace_stack(struct trace_array *tr,
+-		   unsigned long flags,
+-		   int skip, int pc);
++#ifdef CONFIG_STACKTRACE
++void ftrace_trace_stack(struct ring_buffer *buffer, unsigned long flags,
++			int skip, int pc);
+ 
+-extern cycle_t ftrace_now(int cpu);
++void ftrace_trace_userstack(struct ring_buffer *buffer, unsigned long flags,
++			    int pc);
+ 
+-#ifdef CONFIG_CONTEXT_SWITCH_TRACER
+-typedef void
+-(*tracer_switch_func_t)(void *private,
+-			void *__rq,
+-			struct task_struct *prev,
+-			struct task_struct *next);
+-
+-struct tracer_switch_ops {
+-	tracer_switch_func_t		func;
+-	void				*private;
+-	struct tracer_switch_ops	*next;
+-};
+-#endif /* CONFIG_CONTEXT_SWITCH_TRACER */
++void __trace_stack(struct trace_array *tr, unsigned long flags, int skip,
++		   int pc);
++#else
++static inline void ftrace_trace_stack(struct trace_array *tr,
++				      unsigned long flags, int skip, int pc)
++{
++}
++
++static inline void ftrace_trace_userstack(struct trace_array *tr,
++					  unsigned long flags, int pc)
++{
++}
++
++static inline void __trace_stack(struct trace_array *tr, unsigned long flags,
++				 int skip, int pc)
++{
++}
++#endif /* CONFIG_STACKTRACE */
++
++extern cycle_t ftrace_now(int cpu);
+ 
+ extern void trace_find_cmdline(int pid, char comm[]);
+ 
+@@ -513,6 +414,10 @@
+ extern int DYN_FTRACE_TEST_NAME(void);
+ #endif
+ 
++extern int ring_buffer_expanded;
++extern bool tracing_selftest_disabled;
++DECLARE_PER_CPU(local_t, ftrace_cpu_disabled);
++
+ #ifdef CONFIG_FTRACE_STARTUP_TEST
+ extern int trace_selftest_startup_function(struct tracer *trace,
+ 					   struct trace_array *tr);
+@@ -544,9 +449,16 @@
+ trace_vbprintk(unsigned long ip, const char *fmt, va_list args);
+ extern int
+ trace_vprintk(unsigned long ip, const char *fmt, va_list args);
++extern int
++trace_array_vprintk(struct trace_array *tr,
++		    unsigned long ip, const char *fmt, va_list args);
++int trace_array_printk(struct trace_array *tr,
++		       unsigned long ip, const char *fmt, ...);
+ 
+ extern unsigned long trace_flags;
+ 
++extern int trace_clock_id;
++
+ /* Standard output formatting function used for function return traces */
+ #ifdef CONFIG_FUNCTION_GRAPH_TRACER
+ extern enum print_line_t print_graph_function(struct trace_iterator *iter);
+@@ -609,6 +521,41 @@
+ #endif
+ 
+ /*
++ * struct trace_parser - servers for reading the user input separated by spaces
++ * @cont: set if the input is not complete - no final space char was found
++ * @buffer: holds the parsed user input
++ * @idx: user input lenght
++ * @size: buffer size
++ */
++struct trace_parser {
++	bool		cont;
++	char		*buffer;
++	unsigned	idx;
++	unsigned	size;
++};
++
++static inline bool trace_parser_loaded(struct trace_parser *parser)
++{
++	return (parser->idx != 0);
++}
++
++static inline bool trace_parser_cont(struct trace_parser *parser)
++{
++	return parser->cont;
++}
++
++static inline void trace_parser_clear(struct trace_parser *parser)
++{
++	parser->cont = false;
++	parser->idx = 0;
++}
++
++extern int trace_parser_get_init(struct trace_parser *parser, int size);
++extern void trace_parser_put(struct trace_parser *parser);
++extern int trace_get_user(struct trace_parser *parser, const char __user *ubuf,
++	size_t cnt, loff_t *ppos);
++
++/*
+  * trace_iterator_flags is an enumeration that defines bit
+  * positions into trace_flags that controls the output.
+  *
+@@ -635,9 +582,8 @@
+ 	TRACE_ITER_PRINTK_MSGONLY	= 0x10000,
+ 	TRACE_ITER_CONTEXT_INFO		= 0x20000, /* Print pid/cpu/time */
+ 	TRACE_ITER_LATENCY_FMT		= 0x40000,
+-	TRACE_ITER_GLOBAL_CLK		= 0x80000,
+-	TRACE_ITER_SLEEP_TIME		= 0x100000,
+-	TRACE_ITER_GRAPH_TIME		= 0x200000,
++	TRACE_ITER_SLEEP_TIME		= 0x80000,
++	TRACE_ITER_GRAPH_TIME		= 0x100000,
+ };
+ 
+ /*
+@@ -734,6 +680,7 @@
+ 	struct list_head	link;
+ 	char			*name;
+ 	char			*type;
++	int			filter_type;
+ 	int			offset;
+ 	int			size;
+ 	int			is_signed;
+@@ -743,13 +690,15 @@
+ 	int			n_preds;
+ 	struct filter_pred	**preds;
+ 	char			*filter_string;
++	bool			no_reset;
+ };
+ 
+ struct event_subsystem {
+ 	struct list_head	list;
+ 	const char		*name;
+ 	struct dentry		*entry;
+-	void			*filter;
++	struct event_filter	*filter;
++	int			nr_events;
+ };
+ 
+ struct filter_pred;
+@@ -777,6 +726,7 @@
+ 					char *filter_string);
+ extern void print_subsystem_event_filter(struct event_subsystem *system,
+ 					 struct trace_seq *s);
++extern int filter_assign_type(const char *type);
+ 
+ static inline int
+ filter_check_discard(struct ftrace_event_call *call, void *rec,
+@@ -791,58 +741,18 @@
+ 	return 0;
+ }
+ 
+-#define DEFINE_COMPARISON_PRED(type)					\
+-static int filter_pred_##type(struct filter_pred *pred, void *event,	\
+-			      int val1, int val2)			\
+-{									\
+-	type *addr = (type *)(event + pred->offset);			\
+-	type val = (type)pred->val;					\
+-	int match = 0;							\
+-									\
+-	switch (pred->op) {						\
+-	case OP_LT:							\
+-		match = (*addr < val);					\
+-		break;							\
+-	case OP_LE:							\
+-		match = (*addr <= val);					\
+-		break;							\
+-	case OP_GT:							\
+-		match = (*addr > val);					\
+-		break;							\
+-	case OP_GE:							\
+-		match = (*addr >= val);					\
+-		break;							\
+-	default:							\
+-		break;							\
+-	}								\
+-									\
+-	return match;							\
+-}
+-
+-#define DEFINE_EQUALITY_PRED(size)					\
+-static int filter_pred_##size(struct filter_pred *pred, void *event,	\
+-			      int val1, int val2)			\
+-{									\
+-	u##size *addr = (u##size *)(event + pred->offset);		\
+-	u##size val = (u##size)pred->val;				\
+-	int match;							\
+-									\
+-	match = (val == *addr) ^ pred->not;				\
+-									\
+-	return match;							\
+-}
+-
+ extern struct mutex event_mutex;
+ extern struct list_head ftrace_events;
+ 
+ extern const char *__start___trace_bprintk_fmt[];
+ extern const char *__stop___trace_bprintk_fmt[];
+ 
+-#undef TRACE_EVENT_FORMAT
+-#define TRACE_EVENT_FORMAT(call, proto, args, fmt, tstruct, tpfmt)	\
++#undef FTRACE_ENTRY
++#define FTRACE_ENTRY(call, struct_name, id, tstruct, print)		\
+ 	extern struct ftrace_event_call event_##call;
+-#undef TRACE_EVENT_FORMAT_NOFILTER
+-#define TRACE_EVENT_FORMAT_NOFILTER(call, proto, args, fmt, tstruct, tpfmt)
+-#include "trace_event_types.h"
++#undef FTRACE_ENTRY_DUP
++#define FTRACE_ENTRY_DUP(call, struct_name, id, tstruct, print)		\
++	FTRACE_ENTRY(call, struct_name, id, PARAMS(tstruct), PARAMS(print))
++#include "trace_entries.h"
+ 
+ #endif /* _LINUX_KERNEL_TRACE_H */
+Index: linux-rt-2.6.31/kernel/trace/trace_boot.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/trace/trace_boot.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/trace/trace_boot.c	2010-05-17 14:23:20.118466134 +0200
+@@ -41,14 +41,12 @@
+ 
+ static int boot_trace_init(struct trace_array *tr)
+ {
+-	int cpu;
+ 	boot_trace = tr;
+ 
+ 	if (!tr)
+ 		return 0;
+ 
+-	for_each_cpu(cpu, cpu_possible_mask)
+-		tracing_reset(tr, cpu);
++	tracing_reset_online_cpus(tr);
+ 
+ 	tracing_sched_switch_assign_trace(tr);
+ 	return 0;
+@@ -131,7 +129,9 @@
+ 
+ void trace_boot_call(struct boot_trace_call *bt, initcall_t fn)
+ {
++	struct ftrace_event_call *call = &event_boot_call;
+ 	struct ring_buffer_event *event;
++	struct ring_buffer *buffer;
+ 	struct trace_boot_call *entry;
+ 	struct trace_array *tr = boot_trace;
+ 
+@@ -144,20 +144,24 @@
+ 	sprint_symbol(bt->func, (unsigned long)fn);
+ 	preempt_disable();
+ 
+-	event = trace_buffer_lock_reserve(tr, TRACE_BOOT_CALL,
++	buffer = tr->buffer;
++	event = trace_buffer_lock_reserve(buffer, TRACE_BOOT_CALL,
+ 					  sizeof(*entry), 0, 0);
+ 	if (!event)
+ 		goto out;
+ 	entry	= ring_buffer_event_data(event);
+ 	entry->boot_call = *bt;
+-	trace_buffer_unlock_commit(tr, event, 0, 0);
++	if (!filter_check_discard(call, entry, buffer, event))
++		trace_buffer_unlock_commit(buffer, event, 0, 0);
+  out:
+ 	preempt_enable();
+ }
+ 
+ void trace_boot_ret(struct boot_trace_ret *bt, initcall_t fn)
+ {
++	struct ftrace_event_call *call = &event_boot_ret;
+ 	struct ring_buffer_event *event;
++	struct ring_buffer *buffer;
+ 	struct trace_boot_ret *entry;
+ 	struct trace_array *tr = boot_trace;
+ 
+@@ -167,13 +171,15 @@
+ 	sprint_symbol(bt->func, (unsigned long)fn);
+ 	preempt_disable();
+ 
+-	event = trace_buffer_lock_reserve(tr, TRACE_BOOT_RET,
++	buffer = tr->buffer;
++	event = trace_buffer_lock_reserve(buffer, TRACE_BOOT_RET,
+ 					  sizeof(*entry), 0, 0);
+ 	if (!event)
+ 		goto out;
+ 	entry	= ring_buffer_event_data(event);
+ 	entry->boot_ret = *bt;
+-	trace_buffer_unlock_commit(tr, event, 0, 0);
++	if (!filter_check_discard(call, entry, buffer, event))
++		trace_buffer_unlock_commit(buffer, event, 0, 0);
+  out:
+ 	preempt_enable();
+ }
+Index: linux-rt-2.6.31/kernel/trace/trace_entries.h
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ linux-rt-2.6.31/kernel/trace/trace_entries.h	2010-05-17 14:23:20.118466134 +0200
+@@ -0,0 +1,383 @@
++/*
++ * This file defines the trace event structures that go into the ring
++ * buffer directly. They are created via macros so that changes for them
++ * appear in the format file. Using macros will automate this process.
++ *
++ * The macro used to create a ftrace data structure is:
++ *
++ * FTRACE_ENTRY( name, struct_name, id, structure, print )
++ *
++ * @name: the name used the event name, as well as the name of
++ *   the directory that holds the format file.
++ *
++ * @struct_name: the name of the structure that is created.
++ *
++ * @id: The event identifier that is used to detect what event
++ *    this is from the ring buffer.
++ *
++ * @structure: the structure layout
++ *
++ *  - __field(	type,	item	)
++ *	  This is equivalent to declaring
++ *		type	item;
++ *	  in the structure.
++ *  - __array(	type,	item,	size	)
++ *	  This is equivalent to declaring
++ *		type	item[size];
++ *	  in the structure.
++ *
++ *   * for structures within structures, the format of the internal
++ *	structure is layed out. This allows the internal structure
++ *	to be deciphered for the format file. Although these macros
++ *	may become out of sync with the internal structure, they
++ *	will create a compile error if it happens. Since the
++ *	internel structures are just tracing helpers, this is not
++ *	an issue.
++ *
++ *	When an internal structure is used, it should use:
++ *
++ *	__field_struct(	type,	item	)
++ *
++ *	instead of __field. This will prevent it from being shown in
++ *	the output file. The fields in the structure should use.
++ *
++ *	__field_desc(	type,	container,	item		)
++ *	__array_desc(	type,	container,	item,	len	)
++ *
++ *	type, item and len are the same as __field and __array, but
++ *	container is added. This is the name of the item in
++ *	__field_struct that this is describing.
++ *
++ *
++ * @print: the print format shown to users in the format file.
++ */
++
++/*
++ * Function trace entry - function address and parent function addres:
++ */
++FTRACE_ENTRY(function, ftrace_entry,
++
++	TRACE_FN,
++
++	F_STRUCT(
++		__field(	unsigned long,	ip		)
++		__field(	unsigned long,	parent_ip	)
++	),
++
++	F_printk(" %lx <-- %lx", __entry->ip, __entry->parent_ip)
++);
++
++/* Function call entry */
++FTRACE_ENTRY(funcgraph_entry, ftrace_graph_ent_entry,
++
++	TRACE_GRAPH_ENT,
++
++	F_STRUCT(
++		__field_struct(	struct ftrace_graph_ent,	graph_ent	)
++		__field_desc(	unsigned long,	graph_ent,	func		)
++		__field_desc(	int,		graph_ent,	depth		)
++	),
++
++	F_printk("--> %lx (%d)", __entry->func, __entry->depth)
++);
++
++/* Function return entry */
++FTRACE_ENTRY(funcgraph_exit, ftrace_graph_ret_entry,
++
++	TRACE_GRAPH_RET,
++
++	F_STRUCT(
++		__field_struct(	struct ftrace_graph_ret,	ret	)
++		__field_desc(	unsigned long,	ret,		func	)
++		__field_desc(	unsigned long long, ret,	calltime)
++		__field_desc(	unsigned long long, ret,	rettime	)
++		__field_desc(	unsigned long,	ret,		overrun	)
++		__field_desc(	int,		ret,		depth	)
++	),
++
++	F_printk("<-- %lx (%d) (start: %llx  end: %llx) over: %d",
++		 __entry->func, __entry->depth,
++		 __entry->calltime, __entry->rettime,
++		 __entry->depth)
++);
++
++/*
++ * Context switch trace entry - which task (and prio) we switched from/to:
++ *
++ * This is used for both wakeup and context switches. We only want
++ * to create one structure, but we need two outputs for it.
++ */
++#define FTRACE_CTX_FIELDS					\
++	__field(	unsigned int,	prev_pid	)	\
++	__field(	unsigned char,	prev_prio	)	\
++	__field(	unsigned char,	prev_state	)	\
++	__field(	unsigned int,	next_pid	)	\
++	__field(	unsigned char,	next_prio	)	\
++	__field(	unsigned char,	next_state	)	\
++	__field(	unsigned int,	next_cpu	)
++
++FTRACE_ENTRY(context_switch, ctx_switch_entry,
++
++	TRACE_CTX,
++
++	F_STRUCT(
++		FTRACE_CTX_FIELDS
++	),
++
++	F_printk("%u:%u:%u  ==> %u:%u:%u [%03u]",
++		 __entry->prev_pid, __entry->prev_prio, __entry->prev_state,
++		 __entry->next_pid, __entry->next_prio, __entry->next_state,
++		 __entry->next_cpu
++		)
++);
++
++/*
++ * FTRACE_ENTRY_DUP only creates the format file, it will not
++ *  create another structure.
++ */
++FTRACE_ENTRY_DUP(wakeup, ctx_switch_entry,
++
++	TRACE_WAKE,
++
++	F_STRUCT(
++		FTRACE_CTX_FIELDS
++	),
++
++	F_printk("%u:%u:%u  ==+ %u:%u:%u [%03u]",
++		 __entry->prev_pid, __entry->prev_prio, __entry->prev_state,
++		 __entry->next_pid, __entry->next_prio, __entry->next_state,
++		 __entry->next_cpu
++		)
++);
++
++/*
++ * Special (free-form) trace entry:
++ */
++FTRACE_ENTRY(special, special_entry,
++
++	TRACE_SPECIAL,
++
++	F_STRUCT(
++		__field(	unsigned long,	arg1	)
++		__field(	unsigned long,	arg2	)
++		__field(	unsigned long,	arg3	)
++	),
++
++	F_printk("(%08lx) (%08lx) (%08lx)",
++		 __entry->arg1, __entry->arg2, __entry->arg3)
++);
++
++/*
++ * Stack-trace entry:
++ */
++
++#define FTRACE_STACK_ENTRIES	8
++
++FTRACE_ENTRY(kernel_stack, stack_entry,
++
++	TRACE_STACK,
++
++	F_STRUCT(
++		__array(	unsigned long,	caller, FTRACE_STACK_ENTRIES	)
++	),
++
++	F_printk("\t=> (%08lx)\n\t=> (%08lx)\n\t=> (%08lx)\n\t=> (%08lx)\n"
++		 "\t=> (%08lx)\n\t=> (%08lx)\n\t=> (%08lx)\n\t=> (%08lx)\n",
++		 __entry->caller[0], __entry->caller[1], __entry->caller[2],
++		 __entry->caller[3], __entry->caller[4], __entry->caller[5],
++		 __entry->caller[6], __entry->caller[7])
++);
++
++FTRACE_ENTRY(user_stack, userstack_entry,
++
++	TRACE_USER_STACK,
++
++	F_STRUCT(
++		__field(	unsigned int,	tgid	)
++		__array(	unsigned long,	caller, FTRACE_STACK_ENTRIES	)
++	),
++
++	F_printk("\t=> (%08lx)\n\t=> (%08lx)\n\t=> (%08lx)\n\t=> (%08lx)\n"
++		 "\t=> (%08lx)\n\t=> (%08lx)\n\t=> (%08lx)\n\t=> (%08lx)\n",
++		 __entry->caller[0], __entry->caller[1], __entry->caller[2],
++		 __entry->caller[3], __entry->caller[4], __entry->caller[5],
++		 __entry->caller[6], __entry->caller[7])
++);
++
++/*
++ * trace_printk entry:
++ */
++FTRACE_ENTRY(bprint, bprint_entry,
++
++	TRACE_BPRINT,
++
++	F_STRUCT(
++		__field(	unsigned long,	ip	)
++		__field(	const char *,	fmt	)
++		__dynamic_array(	u32,	buf	)
++	),
++
++	F_printk("%08lx fmt:%p",
++		 __entry->ip, __entry->fmt)
++);
++
++FTRACE_ENTRY(print, print_entry,
++
++	TRACE_PRINT,
++
++	F_STRUCT(
++		__field(	unsigned long,	ip	)
++		__dynamic_array(	char,	buf	)
++	),
++
++	F_printk("%08lx %s",
++		 __entry->ip, __entry->buf)
++);
++
++FTRACE_ENTRY(mmiotrace_rw, trace_mmiotrace_rw,
++
++	TRACE_MMIO_RW,
++
++	F_STRUCT(
++		__field_struct(	struct mmiotrace_rw,	rw	)
++		__field_desc(	resource_size_t, rw,	phys	)
++		__field_desc(	unsigned long,	rw,	value	)
++		__field_desc(	unsigned long,	rw,	pc	)
++		__field_desc(	int, 		rw,	map_id	)
++		__field_desc(	unsigned char,	rw,	opcode	)
++		__field_desc(	unsigned char,	rw,	width	)
++	),
++
++	F_printk("%lx %lx %lx %d %x %x",
++		 (unsigned long)__entry->phys, __entry->value, __entry->pc,
++		 __entry->map_id, __entry->opcode, __entry->width)
++);
++
++FTRACE_ENTRY(mmiotrace_map, trace_mmiotrace_map,
++
++	TRACE_MMIO_MAP,
++
++	F_STRUCT(
++		__field_struct(	struct mmiotrace_map,	map	)
++		__field_desc(	resource_size_t, map,	phys	)
++		__field_desc(	unsigned long,	map,	virt	)
++		__field_desc(	unsigned long,	map,	len	)
++		__field_desc(	int, 		map,	map_id	)
++		__field_desc(	unsigned char,	map,	opcode	)
++	),
++
++	F_printk("%lx %lx %lx %d %x",
++		 (unsigned long)__entry->phys, __entry->virt, __entry->len,
++		 __entry->map_id, __entry->opcode)
++);
++
++FTRACE_ENTRY(boot_call, trace_boot_call,
++
++	TRACE_BOOT_CALL,
++
++	F_STRUCT(
++		__field_struct(	struct boot_trace_call,	boot_call	)
++		__field_desc(	pid_t,	boot_call,	caller		)
++		__array_desc(	char,	boot_call,	func,	KSYM_SYMBOL_LEN)
++	),
++
++	F_printk("%d  %s", __entry->caller, __entry->func)
++);
++
++FTRACE_ENTRY(boot_ret, trace_boot_ret,
++
++	TRACE_BOOT_RET,
++
++	F_STRUCT(
++		__field_struct(	struct boot_trace_ret,	boot_ret	)
++		__array_desc(	char,	boot_ret,	func,	KSYM_SYMBOL_LEN)
++		__field_desc(	int,	boot_ret,	result		)
++		__field_desc(	unsigned long, boot_ret, duration	)
++	),
++
++	F_printk("%s %d %lx",
++		 __entry->func, __entry->result, __entry->duration)
++);
++
++#define TRACE_FUNC_SIZE 30
++#define TRACE_FILE_SIZE 20
++
++FTRACE_ENTRY(branch, trace_branch,
++
++	TRACE_BRANCH,
++
++	F_STRUCT(
++		__field(	unsigned int,	line				)
++		__array(	char,		func,	TRACE_FUNC_SIZE+1	)
++		__array(	char,		file,	TRACE_FILE_SIZE+1	)
++		__field(	char,		correct				)
++	),
++
++	F_printk("%u:%s:%s (%u)",
++		 __entry->line,
++		 __entry->func, __entry->file, __entry->correct)
++);
++
++FTRACE_ENTRY(hw_branch, hw_branch_entry,
++
++	TRACE_HW_BRANCHES,
++
++	F_STRUCT(
++		__field(	u64,	from	)
++		__field(	u64,	to	)
++	),
++
++	F_printk("from: %llx to: %llx", __entry->from, __entry->to)
++);
++
++FTRACE_ENTRY(power, trace_power,
++
++	TRACE_POWER,
++
++	F_STRUCT(
++		__field_struct(	struct power_trace,	state_data	)
++		__field_desc(	s64,	state_data,	stamp		)
++		__field_desc(	s64,	state_data,	end		)
++		__field_desc(	int,	state_data,	type		)
++		__field_desc(	int,	state_data,	state		)
++	),
++
++	F_printk("%llx->%llx type:%u state:%u",
++		 __entry->stamp, __entry->end,
++		 __entry->type, __entry->state)
++);
++
++FTRACE_ENTRY(kmem_alloc, kmemtrace_alloc_entry,
++
++	TRACE_KMEM_ALLOC,
++
++	F_STRUCT(
++		__field(	enum kmemtrace_type_id,	type_id		)
++		__field(	unsigned long,		call_site	)
++		__field(	const void *,		ptr		)
++		__field(	size_t,			bytes_req	)
++		__field(	size_t,			bytes_alloc	)
++		__field(	gfp_t,			gfp_flags	)
++		__field(	int,			node		)
++	),
++
++	F_printk("type:%u call_site:%lx ptr:%p req:%zi alloc:%zi"
++		 " flags:%x node:%d",
++		 __entry->type_id, __entry->call_site, __entry->ptr,
++		 __entry->bytes_req, __entry->bytes_alloc,
++		 __entry->gfp_flags, __entry->node)
++);
++
++FTRACE_ENTRY(kmem_free, kmemtrace_free_entry,
++
++	TRACE_KMEM_FREE,
++
++	F_STRUCT(
++		__field(	enum kmemtrace_type_id,	type_id		)
++		__field(	unsigned long,		call_site	)
++		__field(	const void *,		ptr		)
++	),
++
++	F_printk("type:%u call_site:%lx ptr:%p",
++		 __entry->type_id, __entry->call_site, __entry->ptr)
++);
+Index: linux-rt-2.6.31/kernel/trace/trace_event_profile.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/trace/trace_event_profile.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/trace/trace_event_profile.c	2010-05-17 14:23:20.118466134 +0200
+@@ -5,6 +5,7 @@
+  *
+  */
+ 
++#include <linux/module.h>
+ #include "trace.h"
+ 
+ int ftrace_profile_enable(int event_id)
+@@ -14,7 +15,8 @@
+ 
+ 	mutex_lock(&event_mutex);
+ 	list_for_each_entry(event, &ftrace_events, list) {
+-		if (event->id == event_id && event->profile_enable) {
++		if (event->id == event_id && event->profile_enable &&
++		    try_module_get(event->mod)) {
+ 			ret = event->profile_enable(event);
+ 			break;
+ 		}
+@@ -32,6 +34,7 @@
+ 	list_for_each_entry(event, &ftrace_events, list) {
+ 		if (event->id == event_id) {
+ 			event->profile_disable(event);
++			module_put(event->mod);
+ 			break;
+ 		}
+ 	}
+Index: linux-rt-2.6.31/kernel/trace/trace_event_types.h
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/trace/trace_event_types.h	2009-09-10 00:13:59.000000000 +0200
++++ /dev/null	1970-01-01 00:00:00.000000000 +0000
+@@ -1,178 +0,0 @@
+-#undef TRACE_SYSTEM
+-#define TRACE_SYSTEM	ftrace
+-
+-/*
+- * We cheat and use the proto type field as the ID
+- * and args as the entry type (minus 'struct')
+- */
+-TRACE_EVENT_FORMAT(function, TRACE_FN, ftrace_entry, ignore,
+-	TRACE_STRUCT(
+-		TRACE_FIELD(unsigned long, ip, ip)
+-		TRACE_FIELD(unsigned long, parent_ip, parent_ip)
+-	),
+-	TP_RAW_FMT(" %lx <-- %lx")
+-);
+-
+-TRACE_EVENT_FORMAT(funcgraph_entry, TRACE_GRAPH_ENT,
+-		   ftrace_graph_ent_entry, ignore,
+-	TRACE_STRUCT(
+-		TRACE_FIELD(unsigned long, graph_ent.func, func)
+-		TRACE_FIELD(int, graph_ent.depth, depth)
+-	),
+-	TP_RAW_FMT("--> %lx (%d)")
+-);
+-
+-TRACE_EVENT_FORMAT(funcgraph_exit, TRACE_GRAPH_RET,
+-		   ftrace_graph_ret_entry, ignore,
+-	TRACE_STRUCT(
+-		TRACE_FIELD(unsigned long, ret.func, func)
+-		TRACE_FIELD(unsigned long long, ret.calltime, calltime)
+-		TRACE_FIELD(unsigned long long, ret.rettime, rettime)
+-		TRACE_FIELD(unsigned long, ret.overrun, overrun)
+-		TRACE_FIELD(int, ret.depth, depth)
+-	),
+-	TP_RAW_FMT("<-- %lx (%d)")
+-);
+-
+-TRACE_EVENT_FORMAT(wakeup, TRACE_WAKE, ctx_switch_entry, ignore,
+-	TRACE_STRUCT(
+-		TRACE_FIELD(unsigned int, prev_pid, prev_pid)
+-		TRACE_FIELD(unsigned char, prev_prio, prev_prio)
+-		TRACE_FIELD(unsigned char, prev_state, prev_state)
+-		TRACE_FIELD(unsigned int, next_pid, next_pid)
+-		TRACE_FIELD(unsigned char, next_prio, next_prio)
+-		TRACE_FIELD(unsigned char, next_state, next_state)
+-		TRACE_FIELD(unsigned int, next_cpu, next_cpu)
+-	),
+-	TP_RAW_FMT("%u:%u:%u  ==+ %u:%u:%u [%03u]")
+-);
+-
+-TRACE_EVENT_FORMAT(context_switch, TRACE_CTX, ctx_switch_entry, ignore,
+-	TRACE_STRUCT(
+-		TRACE_FIELD(unsigned int, prev_pid, prev_pid)
+-		TRACE_FIELD(unsigned char, prev_prio, prev_prio)
+-		TRACE_FIELD(unsigned char, prev_state, prev_state)
+-		TRACE_FIELD(unsigned int, next_pid, next_pid)
+-		TRACE_FIELD(unsigned char, next_prio, next_prio)
+-		TRACE_FIELD(unsigned char, next_state, next_state)
+-		TRACE_FIELD(unsigned int, next_cpu, next_cpu)
+-	),
+-	TP_RAW_FMT("%u:%u:%u  ==+ %u:%u:%u [%03u]")
+-);
+-
+-TRACE_EVENT_FORMAT_NOFILTER(special, TRACE_SPECIAL, special_entry, ignore,
+-	TRACE_STRUCT(
+-		TRACE_FIELD(unsigned long, arg1, arg1)
+-		TRACE_FIELD(unsigned long, arg2, arg2)
+-		TRACE_FIELD(unsigned long, arg3, arg3)
+-	),
+-	TP_RAW_FMT("(%08lx) (%08lx) (%08lx)")
+-);
+-
+-/*
+- * Stack-trace entry:
+- */
+-
+-/* #define FTRACE_STACK_ENTRIES   8 */
+-
+-TRACE_EVENT_FORMAT(kernel_stack, TRACE_STACK, stack_entry, ignore,
+-	TRACE_STRUCT(
+-		TRACE_FIELD(unsigned long, caller[0], stack0)
+-		TRACE_FIELD(unsigned long, caller[1], stack1)
+-		TRACE_FIELD(unsigned long, caller[2], stack2)
+-		TRACE_FIELD(unsigned long, caller[3], stack3)
+-		TRACE_FIELD(unsigned long, caller[4], stack4)
+-		TRACE_FIELD(unsigned long, caller[5], stack5)
+-		TRACE_FIELD(unsigned long, caller[6], stack6)
+-		TRACE_FIELD(unsigned long, caller[7], stack7)
+-	),
+-	TP_RAW_FMT("\t=> (%08lx)\n\t=> (%08lx)\n\t=> (%08lx)\n\t=> (%08lx)\n"
+-		 "\t=> (%08lx)\n\t=> (%08lx)\n\t=> (%08lx)\n\t=> (%08lx)\n")
+-);
+-
+-TRACE_EVENT_FORMAT(user_stack, TRACE_USER_STACK, userstack_entry, ignore,
+-	TRACE_STRUCT(
+-		TRACE_FIELD(unsigned long, caller[0], stack0)
+-		TRACE_FIELD(unsigned long, caller[1], stack1)
+-		TRACE_FIELD(unsigned long, caller[2], stack2)
+-		TRACE_FIELD(unsigned long, caller[3], stack3)
+-		TRACE_FIELD(unsigned long, caller[4], stack4)
+-		TRACE_FIELD(unsigned long, caller[5], stack5)
+-		TRACE_FIELD(unsigned long, caller[6], stack6)
+-		TRACE_FIELD(unsigned long, caller[7], stack7)
+-	),
+-	TP_RAW_FMT("\t=> (%08lx)\n\t=> (%08lx)\n\t=> (%08lx)\n\t=> (%08lx)\n"
+-		 "\t=> (%08lx)\n\t=> (%08lx)\n\t=> (%08lx)\n\t=> (%08lx)\n")
+-);
+-
+-TRACE_EVENT_FORMAT(bprint, TRACE_BPRINT, bprint_entry, ignore,
+-	TRACE_STRUCT(
+-		TRACE_FIELD(unsigned long, ip, ip)
+-		TRACE_FIELD(char *, fmt, fmt)
+-		TRACE_FIELD_ZERO_CHAR(buf)
+-	),
+-	TP_RAW_FMT("%08lx (%d) fmt:%p %s")
+-);
+-
+-TRACE_EVENT_FORMAT(print, TRACE_PRINT, print_entry, ignore,
+-	TRACE_STRUCT(
+-		TRACE_FIELD(unsigned long, ip, ip)
+-		TRACE_FIELD_ZERO_CHAR(buf)
+-	),
+-	TP_RAW_FMT("%08lx (%d) fmt:%p %s")
+-);
+-
+-TRACE_EVENT_FORMAT(branch, TRACE_BRANCH, trace_branch, ignore,
+-	TRACE_STRUCT(
+-		TRACE_FIELD(unsigned int, line, line)
+-		TRACE_FIELD_SPECIAL(char func[TRACE_FUNC_SIZE+1], func,
+-				    TRACE_FUNC_SIZE+1, func)
+-		TRACE_FIELD_SPECIAL(char file[TRACE_FUNC_SIZE+1], file,
+-				    TRACE_FUNC_SIZE+1, file)
+-		TRACE_FIELD(char, correct, correct)
+-	),
+-	TP_RAW_FMT("%u:%s:%s (%u)")
+-);
+-
+-TRACE_EVENT_FORMAT(hw_branch, TRACE_HW_BRANCHES, hw_branch_entry, ignore,
+-	TRACE_STRUCT(
+-		TRACE_FIELD(u64, from, from)
+-		TRACE_FIELD(u64, to, to)
+-	),
+-	TP_RAW_FMT("from: %llx to: %llx")
+-);
+-
+-TRACE_EVENT_FORMAT(power, TRACE_POWER, trace_power, ignore,
+-	TRACE_STRUCT(
+-		TRACE_FIELD_SIGN(ktime_t, state_data.stamp, stamp, 1)
+-		TRACE_FIELD_SIGN(ktime_t, state_data.end, end, 1)
+-		TRACE_FIELD(int, state_data.type, type)
+-		TRACE_FIELD(int, state_data.state, state)
+-	),
+-	TP_RAW_FMT("%llx->%llx type:%u state:%u")
+-);
+-
+-TRACE_EVENT_FORMAT(kmem_alloc, TRACE_KMEM_ALLOC, kmemtrace_alloc_entry, ignore,
+-	TRACE_STRUCT(
+-		TRACE_FIELD(enum kmemtrace_type_id, type_id, type_id)
+-		TRACE_FIELD(unsigned long, call_site, call_site)
+-		TRACE_FIELD(const void *, ptr, ptr)
+-		TRACE_FIELD(size_t, bytes_req, bytes_req)
+-		TRACE_FIELD(size_t, bytes_alloc, bytes_alloc)
+-		TRACE_FIELD(gfp_t, gfp_flags, gfp_flags)
+-		TRACE_FIELD(int, node, node)
+-	),
+-	TP_RAW_FMT("type:%u call_site:%lx ptr:%p req:%lu alloc:%lu"
+-		 " flags:%x node:%d")
+-);
+-
+-TRACE_EVENT_FORMAT(kmem_free, TRACE_KMEM_FREE, kmemtrace_free_entry, ignore,
+-	TRACE_STRUCT(
+-		TRACE_FIELD(enum kmemtrace_type_id, type_id, type_id)
+-		TRACE_FIELD(unsigned long, call_site, call_site)
+-		TRACE_FIELD(const void *, ptr, ptr)
+-	),
+-	TP_RAW_FMT("type:%u call_site:%lx ptr:%p")
+-);
+-
+-#undef TRACE_SYSTEM
+Index: linux-rt-2.6.31/kernel/trace/trace_events.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/trace/trace_events.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/trace/trace_events.c	2010-05-17 14:23:20.118466134 +0200
+@@ -17,16 +17,20 @@
+ #include <linux/ctype.h>
+ #include <linux/delay.h>
+ 
++#include <asm/setup.h>
++
+ #include "trace_output.h"
+ 
++#undef TRACE_SYSTEM
+ #define TRACE_SYSTEM "TRACE_SYSTEM"
+ 
+ DEFINE_MUTEX(event_mutex);
+ 
+ LIST_HEAD(ftrace_events);
+ 
+-int trace_define_field(struct ftrace_event_call *call, char *type,
+-		       char *name, int offset, int size, int is_signed)
++int trace_define_field(struct ftrace_event_call *call, const char *type,
++		       const char *name, int offset, int size, int is_signed,
++		       int filter_type)
+ {
+ 	struct ftrace_event_field *field;
+ 
+@@ -42,9 +46,15 @@
+ 	if (!field->type)
+ 		goto err;
+ 
++	if (filter_type == FILTER_OTHER)
++		field->filter_type = filter_assign_type(type);
++	else
++		field->filter_type = filter_type;
++
+ 	field->offset = offset;
+ 	field->size = size;
+ 	field->is_signed = is_signed;
++
+ 	list_add(&field->link, &call->fields);
+ 
+ 	return 0;
+@@ -60,6 +70,29 @@
+ }
+ EXPORT_SYMBOL_GPL(trace_define_field);
+ 
++#define __common_field(type, item)					\
++	ret = trace_define_field(call, #type, "common_" #item,		\
++				 offsetof(typeof(ent), item),		\
++				 sizeof(ent.item),			\
++				 is_signed_type(type), FILTER_OTHER);	\
++	if (ret)							\
++		return ret;
++
++int trace_define_common_fields(struct ftrace_event_call *call)
++{
++	int ret;
++	struct trace_entry ent;
++
++	__common_field(unsigned short, type);
++	__common_field(unsigned char, flags);
++	__common_field(unsigned char, preempt_count);
++	__common_field(int, pid);
++	__common_field(int, lock_depth);
++
++	return ret;
++}
++EXPORT_SYMBOL_GPL(trace_define_common_fields);
++
+ #ifdef CONFIG_MODULES
+ 
+ static void trace_destroy_fields(struct ftrace_event_call *call)
+@@ -84,14 +117,14 @@
+ 		if (call->enabled) {
+ 			call->enabled = 0;
+ 			tracing_stop_cmdline_record();
+-			call->unregfunc();
++			call->unregfunc(call->data);
+ 		}
+ 		break;
+ 	case 1:
+ 		if (!call->enabled) {
+ 			call->enabled = 1;
+ 			tracing_start_cmdline_record();
+-			call->regfunc();
++			call->regfunc(call->data);
+ 		}
+ 		break;
+ 	}
+@@ -198,11 +231,9 @@
+ ftrace_event_write(struct file *file, const char __user *ubuf,
+ 		   size_t cnt, loff_t *ppos)
+ {
++	struct trace_parser parser;
+ 	size_t read = 0;
+-	int i, set = 1;
+ 	ssize_t ret;
+-	char *buf;
+-	char ch;
+ 
+ 	if (!cnt || cnt < 0)
+ 		return 0;
+@@ -211,60 +242,28 @@
+ 	if (ret < 0)
+ 		return ret;
+ 
+-	ret = get_user(ch, ubuf++);
+-	if (ret)
+-		return ret;
+-	read++;
+-	cnt--;
+-
+-	/* skip white space */
+-	while (cnt && isspace(ch)) {
+-		ret = get_user(ch, ubuf++);
+-		if (ret)
+-			return ret;
+-		read++;
+-		cnt--;
+-	}
+-
+-	/* Only white space found? */
+-	if (isspace(ch)) {
+-		file->f_pos += read;
+-		ret = read;
+-		return ret;
+-	}
+-
+-	buf = kmalloc(EVENT_BUF_SIZE+1, GFP_KERNEL);
+-	if (!buf)
++	if (trace_parser_get_init(&parser, EVENT_BUF_SIZE + 1))
+ 		return -ENOMEM;
+ 
+-	if (cnt > EVENT_BUF_SIZE)
+-		cnt = EVENT_BUF_SIZE;
++	read = trace_get_user(&parser, ubuf, cnt, ppos);
++
++	if (trace_parser_loaded((&parser))) {
++		int set = 1;
+ 
+-	i = 0;
+-	while (cnt && !isspace(ch)) {
+-		if (!i && ch == '!')
++		if (*parser.buffer == '!')
+ 			set = 0;
+-		else
+-			buf[i++] = ch;
+ 
+-		ret = get_user(ch, ubuf++);
++		parser.buffer[parser.idx] = 0;
++
++		ret = ftrace_set_clr_event(parser.buffer + !set, set);
+ 		if (ret)
+-			goto out_free;
+-		read++;
+-		cnt--;
++			goto out_put;
+ 	}
+-	buf[i] = 0;
+-
+-	file->f_pos += read;
+-
+-	ret = ftrace_set_clr_event(buf, set);
+-	if (ret)
+-		goto out_free;
+ 
+ 	ret = read;
+ 
+- out_free:
+-	kfree(buf);
++ out_put:
++	trace_parser_put(&parser);
+ 
+ 	return ret;
+ }
+@@ -546,7 +545,7 @@
+ 				FIELD(unsigned char, flags),
+ 				FIELD(unsigned char, preempt_count),
+ 				FIELD(int, pid),
+-				FIELD(int, tgid));
++				FIELD(int, lock_depth));
+ }
+ 
+ static ssize_t
+@@ -574,7 +573,7 @@
+ 	trace_seq_printf(s, "format:\n");
+ 	trace_write_header(s);
+ 
+-	r = call->show_format(s);
++	r = call->show_format(call, s);
+ 	if (!r) {
+ 		/*
+ 		 * ug!  The format output is bigger than a PAGE!!
+@@ -849,8 +848,10 @@
+ 
+ 	/* First see if we did not already create this dir */
+ 	list_for_each_entry(system, &event_subsystems, list) {
+-		if (strcmp(system->name, name) == 0)
++		if (strcmp(system->name, name) == 0) {
++			system->nr_events++;
+ 			return system->entry;
++		}
+ 	}
+ 
+ 	/* need to create new entry */
+@@ -869,6 +870,7 @@
+ 		return d_events;
+ 	}
+ 
++	system->nr_events = 1;
+ 	system->name = kstrdup(name, GFP_KERNEL);
+ 	if (!system->name) {
+ 		debugfs_remove(system->entry);
+@@ -920,15 +922,6 @@
+ 	if (strcmp(call->system, TRACE_SYSTEM) != 0)
+ 		d_events = event_subsystem_dir(call->system, d_events);
+ 
+-	if (call->raw_init) {
+-		ret = call->raw_init();
+-		if (ret < 0) {
+-			pr_warning("Could not initialize trace point"
+-				   " events/%s\n", call->name);
+-			return ret;
+-		}
+-	}
+-
+ 	call->dir = debugfs_create_dir(call->name, d_events);
+ 	if (!call->dir) {
+ 		pr_warning("Could not create debugfs "
+@@ -945,7 +938,7 @@
+ 					  id);
+ 
+ 	if (call->define_fields) {
+-		ret = call->define_fields();
++		ret = call->define_fields(call);
+ 		if (ret < 0) {
+ 			pr_warning("Could not initialize trace point"
+ 				   " events/%s\n", call->name);
+@@ -987,6 +980,32 @@
+ 	struct file_operations		filter;
+ };
+ 
++static void remove_subsystem_dir(const char *name)
++{
++	struct event_subsystem *system;
++
++	if (strcmp(name, TRACE_SYSTEM) == 0)
++		return;
++
++	list_for_each_entry(system, &event_subsystems, list) {
++		if (strcmp(system->name, name) == 0) {
++			if (!--system->nr_events) {
++				struct event_filter *filter = system->filter;
++
++				debugfs_remove_recursive(system->entry);
++				list_del(&system->list);
++				if (filter) {
++					kfree(filter->filter_string);
++					kfree(filter);
++				}
++				kfree(system->name);
++				kfree(system);
++			}
++			break;
++		}
++	}
++}
++
+ static struct ftrace_module_file_ops *
+ trace_create_file_ops(struct module *mod)
+ {
+@@ -1027,6 +1046,7 @@
+ 	struct ftrace_module_file_ops *file_ops = NULL;
+ 	struct ftrace_event_call *call, *start, *end;
+ 	struct dentry *d_events;
++	int ret;
+ 
+ 	start = mod->trace_events;
+ 	end = mod->trace_events + mod->num_trace_events;
+@@ -1042,7 +1062,15 @@
+ 		/* The linker may leave blanks */
+ 		if (!call->name)
+ 			continue;
+-
++		if (call->raw_init) {
++			ret = call->raw_init();
++			if (ret < 0) {
++				if (ret != -ENOSYS)
++					pr_warning("Could not initialize trace "
++					"point events/%s\n", call->name);
++				continue;
++			}
++		}
+ 		/*
+ 		 * This module has events, create file ops for this module
+ 		 * if not already done.
+@@ -1077,6 +1105,7 @@
+ 			list_del(&call->list);
+ 			trace_destroy_fields(call);
+ 			destroy_preds(call);
++			remove_subsystem_dir(call->system);
+ 		}
+ 	}
+ 
+@@ -1125,7 +1154,7 @@
+ }
+ #endif /* CONFIG_MODULES */
+ 
+-struct notifier_block trace_module_nb = {
++static struct notifier_block trace_module_nb = {
+ 	.notifier_call = trace_module_notify,
+ 	.priority = 0,
+ };
+@@ -1133,6 +1162,18 @@
+ extern struct ftrace_event_call __start_ftrace_events[];
+ extern struct ftrace_event_call __stop_ftrace_events[];
+ 
++static char bootup_event_buf[COMMAND_LINE_SIZE] __initdata;
++
++static __init int setup_trace_event(char *str)
++{
++	strlcpy(bootup_event_buf, str, COMMAND_LINE_SIZE);
++	ring_buffer_expanded = 1;
++	tracing_selftest_disabled = 1;
++
++	return 1;
++}
++__setup("trace_event=", setup_trace_event);
++
+ static __init int event_trace_init(void)
+ {
+ 	struct ftrace_event_call *call;
+@@ -1140,6 +1181,8 @@
+ 	struct dentry *entry;
+ 	struct dentry *d_events;
+ 	int ret;
++	char *buf = bootup_event_buf;
++	char *token;
+ 
+ 	d_tracer = tracing_init_dentry();
+ 	if (!d_tracer)
+@@ -1179,12 +1222,34 @@
+ 		/* The linker may leave blanks */
+ 		if (!call->name)
+ 			continue;
++		if (call->raw_init) {
++			ret = call->raw_init();
++			if (ret < 0) {
++				if (ret != -ENOSYS)
++					pr_warning("Could not initialize trace "
++					"point events/%s\n", call->name);
++				continue;
++			}
++		}
+ 		list_add(&call->list, &ftrace_events);
+ 		event_create_dir(call, d_events, &ftrace_event_id_fops,
+ 				 &ftrace_enable_fops, &ftrace_event_filter_fops,
+ 				 &ftrace_event_format_fops);
+ 	}
+ 
++	while (true) {
++		token = strsep(&buf, ",");
++
++		if (!token)
++			break;
++		if (!*token)
++			continue;
++
++		ret = ftrace_set_clr_event(token, 1);
++		if (ret)
++			pr_warning("Failed to enable trace event: %s\n", token);
++	}
++
+ 	ret = register_module_notifier(&trace_module_nb);
+ 	if (ret)
+ 		pr_warning("Failed to register trace events module notifier\n");
+@@ -1261,6 +1326,18 @@
+ 		if (!call->regfunc)
+ 			continue;
+ 
++/*
++ * Testing syscall events here is pretty useless, but
++ * we still do it if configured. But this is time consuming.
++ * What we really need is a user thread to perform the
++ * syscalls as we test.
++ */
++#ifndef CONFIG_EVENT_TRACE_TEST_SYSCALLS
++		if (call->system &&
++		    strcmp(call->system, "syscalls") == 0)
++			continue;
++#endif
++
+ 		pr_info("Testing event %s: ", call->name);
+ 
+ 		/*
+@@ -1340,6 +1417,7 @@
+ function_test_events_call(unsigned long ip, unsigned long parent_ip)
+ {
+ 	struct ring_buffer_event *event;
++	struct ring_buffer *buffer;
+ 	struct ftrace_entry *entry;
+ 	unsigned long flags;
+ 	long disabled;
+@@ -1357,7 +1435,8 @@
+ 
+ 	local_save_flags(flags);
+ 
+-	event = trace_current_buffer_lock_reserve(TRACE_FN, sizeof(*entry),
++	event = trace_current_buffer_lock_reserve(&buffer,
++						  TRACE_FN, sizeof(*entry),
+ 						  flags, pc);
+ 	if (!event)
+ 		goto out;
+@@ -1365,7 +1444,7 @@
+ 	entry->ip			= ip;
+ 	entry->parent_ip		= parent_ip;
+ 
+-	trace_nowake_buffer_unlock_commit(event, flags, pc);
++	trace_nowake_buffer_unlock_commit(buffer, event, flags, pc);
+ 
+  out:
+ 	atomic_dec(&per_cpu(test_event_disable, cpu));
+@@ -1392,10 +1471,10 @@
+ 
+ static __init int event_trace_self_tests_init(void)
+ {
+-
+-	event_trace_self_tests();
+-
+-	event_trace_self_test_with_function();
++	if (!tracing_selftest_disabled) {
++		event_trace_self_tests();
++		event_trace_self_test_with_function();
++	}
+ 
+ 	return 0;
+ }
+Index: linux-rt-2.6.31/kernel/trace/trace_events_filter.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/trace/trace_events_filter.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/kernel/trace/trace_events_filter.c	2010-05-17 14:23:20.118466134 +0200
+@@ -121,6 +121,47 @@
+ 	} operand;
+ };
+ 
++#define DEFINE_COMPARISON_PRED(type)					\
++static int filter_pred_##type(struct filter_pred *pred, void *event,	\
++			      int val1, int val2)			\
++{									\
++	type *addr = (type *)(event + pred->offset);			\
++	type val = (type)pred->val;					\
++	int match = 0;							\
++									\
++	switch (pred->op) {						\
++	case OP_LT:							\
++		match = (*addr < val);					\
++		break;							\
++	case OP_LE:							\
++		match = (*addr <= val);					\
++		break;							\
++	case OP_GT:							\
++		match = (*addr > val);					\
++		break;							\
++	case OP_GE:							\
++		match = (*addr >= val);					\
++		break;							\
++	default:							\
++		break;							\
++	}								\
++									\
++	return match;							\
++}
++
++#define DEFINE_EQUALITY_PRED(size)					\
++static int filter_pred_##size(struct filter_pred *pred, void *event,	\
++			      int val1, int val2)			\
++{									\
++	u##size *addr = (u##size *)(event + pred->offset);		\
++	u##size val = (u##size)pred->val;				\
++	int match;							\
++									\
++	match = (val == *addr) ^ pred->not;				\
++									\
++	return match;							\
++}
++
+ DEFINE_COMPARISON_PRED(s64);
+ DEFINE_COMPARISON_PRED(u64);
+ DEFINE_COMPARISON_PRED(s32);
+@@ -163,6 +204,20 @@
+ 	return match;
+ }
+ 
++/* Filter predicate for char * pointers */
++static int filter_pred_pchar(struct filter_pred *pred, void *event,
++			     int val1, int val2)
++{
++	char **addr = (char **)(event + pred->offset);
++	int cmp, match;
++
++	cmp = strncmp(*addr, pred->str_val, pred->str_len);
++
++	match = (!cmp) ^ pred->not;
++
++	return match;
++}
++
+ /*
+  * Filter predicate for dynamic sized arrays of characters.
+  * These are implemented through a list of strings at the end
+@@ -176,11 +231,13 @@
+ static int filter_pred_strloc(struct filter_pred *pred, void *event,
+ 			      int val1, int val2)
+ {
+-	unsigned short str_loc = *(unsigned short *)(event + pred->offset);
++	u32 str_item = *(u32 *)(event + pred->offset);
++	int str_loc = str_item & 0xffff;
++	int str_len = str_item >> 16;
+ 	char *addr = (char *)(event + str_loc);
+ 	int cmp, match;
+ 
+-	cmp = strncmp(addr, pred->str_val, pred->str_len);
++	cmp = strncmp(addr, pred->str_val, str_len);
+ 
+ 	match = (!cmp) ^ pred->not;
+ 
+@@ -293,7 +350,7 @@
+ 	struct event_filter *filter = call->filter;
+ 
+ 	mutex_lock(&event_mutex);
+-	if (filter->filter_string)
++	if (filter && filter->filter_string)
+ 		trace_seq_printf(s, "%s\n", filter->filter_string);
+ 	else
+ 		trace_seq_printf(s, "none\n");
+@@ -306,7 +363,7 @@
+ 	struct event_filter *filter = system->filter;
+ 
+ 	mutex_lock(&event_mutex);
+-	if (filter->filter_string)
++	if (filter && filter->filter_string)
+ 		trace_seq_printf(s, "%s\n", filter->filter_string);
+ 	else
+ 		trace_seq_printf(s, "none\n");
+@@ -374,6 +431,9 @@
+ 	struct event_filter *filter = call->filter;
+ 	int i;
+ 
++	if (!filter)
++		return;
++
+ 	for (i = 0; i < MAX_FILTER_PRED; i++) {
+ 		if (filter->preds[i])
+ 			filter_free_pred(filter->preds[i]);
+@@ -384,17 +444,19 @@
+ 	call->filter = NULL;
+ }
+ 
+-int init_preds(struct ftrace_event_call *call)
++static int init_preds(struct ftrace_event_call *call)
+ {
+ 	struct event_filter *filter;
+ 	struct filter_pred *pred;
+ 	int i;
+ 
++	if (call->filter)
++		return 0;
++
+ 	filter = call->filter = kzalloc(sizeof(*filter), GFP_KERNEL);
+ 	if (!call->filter)
+ 		return -ENOMEM;
+ 
+-	call->filter_active = 0;
+ 	filter->n_preds = 0;
+ 
+ 	filter->preds = kzalloc(MAX_FILTER_PRED * sizeof(pred), GFP_KERNEL);
+@@ -416,30 +478,55 @@
+ 
+ 	return -ENOMEM;
+ }
+-EXPORT_SYMBOL_GPL(init_preds);
+ 
+-static void filter_free_subsystem_preds(struct event_subsystem *system)
++static int init_subsystem_preds(struct event_subsystem *system)
+ {
+-	struct event_filter *filter = system->filter;
+ 	struct ftrace_event_call *call;
+-	int i;
++	int err;
+ 
+-	if (filter->n_preds) {
+-		for (i = 0; i < filter->n_preds; i++)
+-			filter_free_pred(filter->preds[i]);
+-		kfree(filter->preds);
+-		filter->preds = NULL;
+-		filter->n_preds = 0;
++	list_for_each_entry(call, &ftrace_events, list) {
++		if (!call->define_fields)
++			continue;
++
++		if (strcmp(call->system, system->name) != 0)
++			continue;
++
++		err = init_preds(call);
++		if (err)
++			return err;
+ 	}
+ 
++	return 0;
++}
++
++enum {
++	FILTER_DISABLE_ALL,
++	FILTER_INIT_NO_RESET,
++	FILTER_SKIP_NO_RESET,
++};
++
++static void filter_free_subsystem_preds(struct event_subsystem *system,
++					int flag)
++{
++	struct ftrace_event_call *call;
++
+ 	list_for_each_entry(call, &ftrace_events, list) {
+ 		if (!call->define_fields)
+ 			continue;
+ 
+-		if (!strcmp(call->system, system->name)) {
+-			filter_disable_preds(call);
+-			remove_filter_string(call->filter);
++		if (strcmp(call->system, system->name) != 0)
++			continue;
++
++		if (flag == FILTER_INIT_NO_RESET) {
++			call->filter->no_reset = false;
++			continue;
+ 		}
++
++		if (flag == FILTER_SKIP_NO_RESET && call->filter->no_reset)
++			continue;
++
++		filter_disable_preds(call);
++		remove_filter_string(call->filter);
+ 	}
+ }
+ 
+@@ -468,12 +555,7 @@
+ 	return 0;
+ }
+ 
+-enum {
+-	FILTER_STATIC_STRING = 1,
+-	FILTER_DYN_STRING
+-};
+-
+-static int is_string_field(const char *type)
++int filter_assign_type(const char *type)
+ {
+ 	if (strstr(type, "__data_loc") && strstr(type, "char"))
+ 		return FILTER_DYN_STRING;
+@@ -481,12 +563,19 @@
+ 	if (strchr(type, '[') && strstr(type, "char"))
+ 		return FILTER_STATIC_STRING;
+ 
+-	return 0;
++	return FILTER_OTHER;
++}
++
++static bool is_string_field(struct ftrace_event_field *field)
++{
++	return field->filter_type == FILTER_DYN_STRING ||
++	       field->filter_type == FILTER_STATIC_STRING ||
++	       field->filter_type == FILTER_PTR_STRING;
+ }
+ 
+ static int is_legal_op(struct ftrace_event_field *field, int op)
+ {
+-	if (is_string_field(field->type) && (op != OP_EQ && op != OP_NE))
++	if (is_string_field(field) && (op != OP_EQ && op != OP_NE))
+ 		return 0;
+ 
+ 	return 1;
+@@ -537,22 +626,24 @@
+ 
+ static int filter_add_pred(struct filter_parse_state *ps,
+ 			   struct ftrace_event_call *call,
+-			   struct filter_pred *pred)
++			   struct filter_pred *pred,
++			   bool dry_run)
+ {
+ 	struct ftrace_event_field *field;
+ 	filter_pred_fn_t fn;
+ 	unsigned long long val;
+-	int string_type;
+ 	int ret;
+ 
+ 	pred->fn = filter_pred_none;
+ 
+ 	if (pred->op == OP_AND) {
+ 		pred->pop_n = 2;
+-		return filter_add_pred_fn(ps, call, pred, filter_pred_and);
++		fn = filter_pred_and;
++		goto add_pred_fn;
+ 	} else if (pred->op == OP_OR) {
+ 		pred->pop_n = 2;
+-		return filter_add_pred_fn(ps, call, pred, filter_pred_or);
++		fn = filter_pred_or;
++		goto add_pred_fn;
+ 	}
+ 
+ 	field = find_event_field(call, pred->field_name);
+@@ -568,16 +659,17 @@
+ 		return -EINVAL;
+ 	}
+ 
+-	string_type = is_string_field(field->type);
+-	if (string_type) {
+-		if (string_type == FILTER_STATIC_STRING)
++	if (is_string_field(field)) {
++		pred->str_len = field->size;
++
++		if (field->filter_type == FILTER_STATIC_STRING)
+ 			fn = filter_pred_string;
+-		else
++		else if (field->filter_type == FILTER_DYN_STRING)
+ 			fn = filter_pred_strloc;
+-		pred->str_len = field->size;
+-		if (pred->op == OP_NE)
+-			pred->not = 1;
+-		return filter_add_pred_fn(ps, call, pred, fn);
++		else {
++			fn = filter_pred_pchar;
++			pred->str_len = strlen(pred->str_val);
++		}
+ 	} else {
+ 		if (field->is_signed)
+ 			ret = strict_strtoll(pred->str_val, 0, &val);
+@@ -588,41 +680,33 @@
+ 			return -EINVAL;
+ 		}
+ 		pred->val = val;
+-	}
+ 
+-	fn = select_comparison_fn(pred->op, field->size, field->is_signed);
+-	if (!fn) {
+-		parse_error(ps, FILT_ERR_INVALID_OP, 0);
+-		return -EINVAL;
++		fn = select_comparison_fn(pred->op, field->size,
++					  field->is_signed);
++		if (!fn) {
++			parse_error(ps, FILT_ERR_INVALID_OP, 0);
++			return -EINVAL;
++		}
+ 	}
+ 
+ 	if (pred->op == OP_NE)
+ 		pred->not = 1;
+ 
+-	return filter_add_pred_fn(ps, call, pred, fn);
++add_pred_fn:
++	if (!dry_run)
++		return filter_add_pred_fn(ps, call, pred, fn);
++	return 0;
+ }
+ 
+ static int filter_add_subsystem_pred(struct filter_parse_state *ps,
+ 				     struct event_subsystem *system,
+ 				     struct filter_pred *pred,
+-				     char *filter_string)
++				     char *filter_string,
++				     bool dry_run)
+ {
+-	struct event_filter *filter = system->filter;
+ 	struct ftrace_event_call *call;
+ 	int err = 0;
+-
+-	if (!filter->preds) {
+-		filter->preds = kzalloc(MAX_FILTER_PRED * sizeof(pred),
+-					GFP_KERNEL);
+-
+-		if (!filter->preds)
+-			return -ENOMEM;
+-	}
+-
+-	if (filter->n_preds == MAX_FILTER_PRED) {
+-		parse_error(ps, FILT_ERR_TOO_MANY_PREDS, 0);
+-		return -ENOSPC;
+-	}
++	bool fail = true;
+ 
+ 	list_for_each_entry(call, &ftrace_events, list) {
+ 
+@@ -632,19 +716,24 @@
+ 		if (strcmp(call->system, system->name))
+ 			continue;
+ 
+-		err = filter_add_pred(ps, call, pred);
+-		if (err) {
+-			filter_free_subsystem_preds(system);
+-			parse_error(ps, FILT_ERR_BAD_SUBSYS_FILTER, 0);
+-			goto out;
+-		}
+-		replace_filter_string(call->filter, filter_string);
++		if (call->filter->no_reset)
++			continue;
++
++		err = filter_add_pred(ps, call, pred, dry_run);
++		if (err)
++			call->filter->no_reset = true;
++		else
++			fail = false;
++
++		if (!dry_run)
++			replace_filter_string(call->filter, filter_string);
+ 	}
+ 
+-	filter->preds[filter->n_preds] = pred;
+-	filter->n_preds++;
+-out:
+-	return err;
++	if (fail) {
++		parse_error(ps, FILT_ERR_BAD_SUBSYS_FILTER, 0);
++		return err;
++	}
++	return 0;
+ }
+ 
+ static void parse_init(struct filter_parse_state *ps,
+@@ -1004,12 +1093,14 @@
+ static int replace_preds(struct event_subsystem *system,
+ 			 struct ftrace_event_call *call,
+ 			 struct filter_parse_state *ps,
+-			 char *filter_string)
++			 char *filter_string,
++			 bool dry_run)
+ {
+ 	char *operand1 = NULL, *operand2 = NULL;
+ 	struct filter_pred *pred;
+ 	struct postfix_elt *elt;
+ 	int err;
++	int n_preds = 0;
+ 
+ 	err = check_preds(ps);
+ 	if (err)
+@@ -1028,24 +1119,14 @@
+ 			continue;
+ 		}
+ 
++		if (n_preds++ == MAX_FILTER_PRED) {
++			parse_error(ps, FILT_ERR_TOO_MANY_PREDS, 0);
++			return -ENOSPC;
++		}
++
+ 		if (elt->op == OP_AND || elt->op == OP_OR) {
+ 			pred = create_logical_pred(elt->op);
+-			if (!pred)
+-				return -ENOMEM;
+-			if (call) {
+-				err = filter_add_pred(ps, call, pred);
+-				filter_free_pred(pred);
+-			} else {
+-				err = filter_add_subsystem_pred(ps, system,
+-							pred, filter_string);
+-				if (err)
+-					filter_free_pred(pred);
+-			}
+-			if (err)
+-				return err;
+-
+-			operand1 = operand2 = NULL;
+-			continue;
++			goto add_pred;
+ 		}
+ 
+ 		if (!operand1 || !operand2) {
+@@ -1054,17 +1135,15 @@
+ 		}
+ 
+ 		pred = create_pred(elt->op, operand1, operand2);
++add_pred:
+ 		if (!pred)
+ 			return -ENOMEM;
+-		if (call) {
+-			err = filter_add_pred(ps, call, pred);
+-			filter_free_pred(pred);
+-		} else {
++		if (call)
++			err = filter_add_pred(ps, call, pred, false);
++		else
+ 			err = filter_add_subsystem_pred(ps, system, pred,
+-							filter_string);
+-			if (err)
+-				filter_free_pred(pred);
+-		}
++						filter_string, dry_run);
++		filter_free_pred(pred);
+ 		if (err)
+ 			return err;
+ 
+@@ -1082,6 +1161,10 @@
+ 
+ 	mutex_lock(&event_mutex);
+ 
++	err = init_preds(call);
++	if (err)
++		goto out_unlock;
++
+ 	if (!strcmp(strstrip(filter_string), "0")) {
+ 		filter_disable_preds(call);
+ 		remove_filter_string(call->filter);
+@@ -1104,7 +1187,7 @@
+ 		goto out;
+ 	}
+ 
+-	err = replace_preds(NULL, call, ps, filter_string);
++	err = replace_preds(NULL, call, ps, filter_string, false);
+ 	if (err)
+ 		append_filter_err(ps, call->filter);
+ 
+@@ -1127,8 +1210,12 @@
+ 
+ 	mutex_lock(&event_mutex);
+ 
++	err = init_subsystem_preds(system);
++	if (err)
++		goto out_unlock;
++
+ 	if (!strcmp(strstrip(filter_string), "0")) {
+-		filter_free_subsystem_preds(system);
++		filter_free_subsystem_preds(system, FILTER_DISABLE_ALL);
+ 		remove_filter_string(system->filter);
+ 		mutex_unlock(&event_mutex);
+ 		return 0;
+@@ -1139,7 +1226,6 @@
+ 	if (!ps)
+ 		goto out_unlock;
+ 
+-	filter_free_subsystem_preds(system);
+ 	replace_filter_string(system->filter, filter_string);
+ 
+ 	parse_init(ps, filter_ops, filter_string);
+@@ -1149,9 +1235,23 @@
+ 		goto out;
+ 	}
+ 
+-	err = replace_preds(system, NULL, ps, filter_string);
+-	if (err)
++	filter_free_subsystem_preds(system, FILTER_INIT_NO_RESET);
++
++	/* try to see the filter can be applied to which events */
++	err = replace_preds(system, NULL, ps, filter_string, true);
++	if (err) {
+ 		append_filter_err(ps, system->filter);
++		goto out;
++	}
++
++	filter_free_subsystem_preds(system, FILTER_SKIP_NO_RESET);
++
++	/* really apply the filter to the events */
++	err = replace_preds(system, NULL, ps, filter_string, false);
++	if (err) {
++		append_filter_err(ps, system->filter);
++		filter_free_subsystem_preds(system, 2);
++	}
+ 
+ out:
+ 	filter_opstack_clear(ps);
+Index: linux-rt-2.6.31/kernel/trace/trace_export.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/trace/trace_export.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/trace/trace_export.c	2010-05-17 14:23:20.118466134 +0200
+@@ -15,116 +15,209 @@
+ 
+ #include "trace_output.h"
+ 
++#undef TRACE_SYSTEM
++#define TRACE_SYSTEM	ftrace
+ 
+-#undef TRACE_STRUCT
+-#define TRACE_STRUCT(args...) args
++/* not needed for this file */
++#undef __field_struct
++#define __field_struct(type, item)
++
++#undef __field
++#define __field(type, item)				type item;
++
++#undef __field_desc
++#define __field_desc(type, container, item)		type item;
++
++#undef __array
++#define __array(type, item, size)			type item[size];
++
++#undef __array_desc
++#define __array_desc(type, container, item, size)	type item[size];
++
++#undef __dynamic_array
++#define __dynamic_array(type, item)			type item[];
++
++#undef F_STRUCT
++#define F_STRUCT(args...)				args
++
++#undef F_printk
++#define F_printk(fmt, args...) fmt, args
++
++#undef FTRACE_ENTRY
++#define FTRACE_ENTRY(name, struct_name, id, tstruct, print)	\
++struct ____ftrace_##name {					\
++	tstruct							\
++};								\
++static void __used ____ftrace_check_##name(void)		\
++{								\
++	struct ____ftrace_##name *__entry = NULL;		\
++								\
++	/* force cmpile-time check on F_printk() */		\
++	printk(print);						\
++}
++
++#undef FTRACE_ENTRY_DUP
++#define FTRACE_ENTRY_DUP(name, struct_name, id, tstruct, print)	\
++	FTRACE_ENTRY(name, struct_name, id, PARAMS(tstruct), PARAMS(print))
++
++#include "trace_entries.h"
+ 
+-extern void __bad_type_size(void);
+ 
+-#undef TRACE_FIELD
+-#define TRACE_FIELD(type, item, assign)					\
+-	if (sizeof(type) != sizeof(field.item))				\
+-		__bad_type_size();					\
++#undef __field
++#define __field(type, item)						\
++	ret = trace_seq_printf(s, "\tfield:" #type " " #item ";\t"	\
++			       "offset:%zu;\tsize:%zu;\n",		\
++			       offsetof(typeof(field), item),		\
++			       sizeof(field.item));			\
++	if (!ret)							\
++		return 0;
++
++#undef __field_desc
++#define __field_desc(type, container, item)				\
+ 	ret = trace_seq_printf(s, "\tfield:" #type " " #item ";\t"	\
+-			       "offset:%u;\tsize:%u;\n",		\
+-			       (unsigned int)offsetof(typeof(field), item), \
+-			       (unsigned int)sizeof(field.item));	\
++			       "offset:%zu;\tsize:%zu;\n",		\
++			       offsetof(typeof(field), container.item),	\
++			       sizeof(field.container.item));		\
+ 	if (!ret)							\
+ 		return 0;
+ 
++#undef __array
++#define __array(type, item, len)					\
++	ret = trace_seq_printf(s, "\tfield:" #type " " #item "[" #len "];\t" \
++			       "offset:%zu;\tsize:%zu;\n",		\
++			       offsetof(typeof(field), item),	\
++			       sizeof(field.item));		\
++	if (!ret)							\
++		return 0;
+ 
+-#undef TRACE_FIELD_SPECIAL
+-#define TRACE_FIELD_SPECIAL(type_item, item, len, cmd)			\
+-	ret = trace_seq_printf(s, "\tfield special:" #type_item ";\t"	\
+-			       "offset:%u;\tsize:%u;\n",		\
+-			       (unsigned int)offsetof(typeof(field), item), \
+-			       (unsigned int)sizeof(field.item));	\
++#undef __array_desc
++#define __array_desc(type, container, item, len)			\
++	ret = trace_seq_printf(s, "\tfield:" #type " " #item "[" #len "];\t" \
++			       "offset:%zu;\tsize:%zu;\n",		\
++			       offsetof(typeof(field), container.item),	\
++			       sizeof(field.container.item));		\
+ 	if (!ret)							\
+ 		return 0;
+ 
+-#undef TRACE_FIELD_ZERO_CHAR
+-#define TRACE_FIELD_ZERO_CHAR(item)					\
+-	ret = trace_seq_printf(s, "\tfield:char " #item ";\t"		\
+-			       "offset:%u;\tsize:0;\n",			\
+-			       (unsigned int)offsetof(typeof(field), item)); \
++#undef __dynamic_array
++#define __dynamic_array(type, item)					\
++	ret = trace_seq_printf(s, "\tfield:" #type " " #item ";\t"	\
++			       "offset:%zu;\tsize:0;\n",		\
++			       offsetof(typeof(field), item));		\
+ 	if (!ret)							\
+ 		return 0;
+ 
+-#undef TRACE_FIELD_SIGN
+-#define TRACE_FIELD_SIGN(type, item, assign, is_signed)	\
+-	TRACE_FIELD(type, item, assign)
++#undef F_printk
++#define F_printk(fmt, args...) "%s, %s\n", #fmt, __stringify(args)
+ 
+-#undef TP_RAW_FMT
+-#define TP_RAW_FMT(args...) args
++#undef __entry
++#define __entry REC
+ 
+-#undef TRACE_EVENT_FORMAT
+-#define TRACE_EVENT_FORMAT(call, proto, args, fmt, tstruct, tpfmt)	\
++#undef FTRACE_ENTRY
++#define FTRACE_ENTRY(name, struct_name, id, tstruct, print)		\
+ static int								\
+-ftrace_format_##call(struct trace_seq *s)				\
++ftrace_format_##name(struct ftrace_event_call *unused,			\
++		     struct trace_seq *s)				\
+ {									\
+-	struct args field;						\
+-	int ret;							\
++	struct struct_name field __attribute__((unused));		\
++	int ret = 0;							\
+ 									\
+ 	tstruct;							\
+ 									\
+-	trace_seq_printf(s, "\nprint fmt: \"%s\"\n", tpfmt);		\
++	trace_seq_printf(s, "\nprint fmt: " print);			\
+ 									\
+ 	return ret;							\
+ }
+ 
+-#undef TRACE_EVENT_FORMAT_NOFILTER
+-#define TRACE_EVENT_FORMAT_NOFILTER(call, proto, args, fmt, tstruct,	\
+-				    tpfmt)				\
+-static int								\
+-ftrace_format_##call(struct trace_seq *s)				\
++#include "trace_entries.h"
++
++
++#undef __field
++#define __field(type, item)						\
++	ret = trace_define_field(event_call, #type, #item,		\
++				 offsetof(typeof(field), item),		\
++				 sizeof(field.item),			\
++				 is_signed_type(type), FILTER_OTHER);	\
++	if (ret)							\
++		return ret;
++
++#undef __field_desc
++#define __field_desc(type, container, item)	\
++	ret = trace_define_field(event_call, #type, #item,		\
++				 offsetof(typeof(field),		\
++					  container.item),		\
++				 sizeof(field.container.item),		\
++				 is_signed_type(type), FILTER_OTHER);	\
++	if (ret)							\
++		return ret;
++
++#undef __array
++#define __array(type, item, len)					\
++	BUILD_BUG_ON(len > MAX_FILTER_STR_VAL);				\
++	ret = trace_define_field(event_call, #type "[" #len "]", #item,	\
++				 offsetof(typeof(field), item),		\
++				 sizeof(field.item), 0, FILTER_OTHER);	\
++	if (ret)							\
++		return ret;
++
++#undef __array_desc
++#define __array_desc(type, container, item, len)			\
++	BUILD_BUG_ON(len > MAX_FILTER_STR_VAL);				\
++	ret = trace_define_field(event_call, #type "[" #len "]", #item,	\
++				 offsetof(typeof(field),		\
++					  container.item),		\
++				 sizeof(field.container.item), 0,	\
++				 FILTER_OTHER);				\
++	if (ret)							\
++		return ret;
++
++#undef __dynamic_array
++#define __dynamic_array(type, item)
++
++#undef FTRACE_ENTRY
++#define FTRACE_ENTRY(name, struct_name, id, tstruct, print)		\
++int									\
++ftrace_define_fields_##name(struct ftrace_event_call *event_call)	\
+ {									\
+-	struct args field;						\
++	struct struct_name field;					\
+ 	int ret;							\
+ 									\
+-	tstruct;							\
++	ret = trace_define_common_fields(event_call);			\
++	if (ret)							\
++		return ret;						\
+ 									\
+-	trace_seq_printf(s, "\nprint fmt: \"%s\"\n", tpfmt);		\
++	tstruct;							\
+ 									\
+ 	return ret;							\
+ }
+ 
+-#include "trace_event_types.h"
++#include "trace_entries.h"
+ 
+-#undef TRACE_ZERO_CHAR
+-#define TRACE_ZERO_CHAR(arg)
+ 
+-#undef TRACE_FIELD
+-#define TRACE_FIELD(type, item, assign)\
+-	entry->item = assign;
++#undef __field
++#define __field(type, item)
+ 
+-#undef TRACE_FIELD
+-#define TRACE_FIELD(type, item, assign)\
+-	entry->item = assign;
++#undef __field_desc
++#define __field_desc(type, container, item)
+ 
+-#undef TRACE_FIELD_SIGN
+-#define TRACE_FIELD_SIGN(type, item, assign, is_signed)	\
+-	TRACE_FIELD(type, item, assign)
++#undef __array
++#define __array(type, item, len)
+ 
+-#undef TP_CMD
+-#define TP_CMD(cmd...)	cmd
++#undef __array_desc
++#define __array_desc(type, container, item, len)
+ 
+-#undef TRACE_ENTRY
+-#define TRACE_ENTRY	entry
++#undef __dynamic_array
++#define __dynamic_array(type, item)
+ 
+-#undef TRACE_FIELD_SPECIAL
+-#define TRACE_FIELD_SPECIAL(type_item, item, len, cmd)	\
+-	cmd;
+-
+-#undef TRACE_EVENT_FORMAT
+-#define TRACE_EVENT_FORMAT(call, proto, args, fmt, tstruct, tpfmt)	\
+-int ftrace_define_fields_##call(void);					\
++#undef FTRACE_ENTRY
++#define FTRACE_ENTRY(call, struct_name, type, tstruct, print)		\
+ static int ftrace_raw_init_event_##call(void);				\
+ 									\
+ struct ftrace_event_call __used						\
+ __attribute__((__aligned__(4)))						\
+ __attribute__((section("_ftrace_events"))) event_##call = {		\
+ 	.name			= #call,				\
+-	.id			= proto,				\
++	.id			= type,					\
+ 	.system			= __stringify(TRACE_SYSTEM),		\
+ 	.raw_init		= ftrace_raw_init_event_##call,		\
+ 	.show_format		= ftrace_format_##call,			\
+@@ -133,74 +226,7 @@
+ static int ftrace_raw_init_event_##call(void)				\
+ {									\
+ 	INIT_LIST_HEAD(&event_##call.fields);				\
+-	init_preds(&event_##call);					\
+ 	return 0;							\
+ }									\
+ 
+-#undef TRACE_EVENT_FORMAT_NOFILTER
+-#define TRACE_EVENT_FORMAT_NOFILTER(call, proto, args, fmt, tstruct,	\
+-				    tpfmt)				\
+-									\
+-struct ftrace_event_call __used						\
+-__attribute__((__aligned__(4)))						\
+-__attribute__((section("_ftrace_events"))) event_##call = {		\
+-	.name			= #call,				\
+-	.id			= proto,				\
+-	.system			= __stringify(TRACE_SYSTEM),		\
+-	.show_format		= ftrace_format_##call,			\
+-};
+-
+-#include "trace_event_types.h"
+-
+-#undef TRACE_FIELD
+-#define TRACE_FIELD(type, item, assign)					\
+-	ret = trace_define_field(event_call, #type, #item,		\
+-				 offsetof(typeof(field), item),		\
+-				 sizeof(field.item), is_signed_type(type));	\
+-	if (ret)							\
+-		return ret;
+-
+-#undef TRACE_FIELD_SPECIAL
+-#define TRACE_FIELD_SPECIAL(type, item, len, cmd)			\
+-	ret = trace_define_field(event_call, #type "[" #len "]", #item,	\
+-				 offsetof(typeof(field), item),		\
+-				 sizeof(field.item), 0);		\
+-	if (ret)							\
+-		return ret;
+-
+-#undef TRACE_FIELD_SIGN
+-#define TRACE_FIELD_SIGN(type, item, assign, is_signed)			\
+-	ret = trace_define_field(event_call, #type, #item,		\
+-				 offsetof(typeof(field), item),		\
+-				 sizeof(field.item), is_signed);	\
+-	if (ret)							\
+-		return ret;
+-
+-#undef TRACE_FIELD_ZERO_CHAR
+-#define TRACE_FIELD_ZERO_CHAR(item)
+-
+-#undef TRACE_EVENT_FORMAT
+-#define TRACE_EVENT_FORMAT(call, proto, args, fmt, tstruct, tpfmt)	\
+-int									\
+-ftrace_define_fields_##call(void)					\
+-{									\
+-	struct ftrace_event_call *event_call = &event_##call;		\
+-	struct args field;						\
+-	int ret;							\
+-									\
+-	__common_field(unsigned char, type, 0);				\
+-	__common_field(unsigned char, flags, 0);			\
+-	__common_field(unsigned char, preempt_count, 0);		\
+-	__common_field(int, pid, 1);					\
+-	__common_field(int, tgid, 1);					\
+-									\
+-	tstruct;							\
+-									\
+-	return ret;							\
+-}
+-
+-#undef TRACE_EVENT_FORMAT_NOFILTER
+-#define TRACE_EVENT_FORMAT_NOFILTER(call, proto, args, fmt, tstruct,	\
+-				    tpfmt)
+-
+-#include "trace_event_types.h"
++#include "trace_entries.h"
+Index: linux-rt-2.6.31/kernel/trace/trace_functions.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/trace/trace_functions.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/trace/trace_functions.c	2010-05-17 14:23:20.128387716 +0200
+@@ -288,11 +288,9 @@
+ ftrace_trace_onoff_print(struct seq_file *m, unsigned long ip,
+ 			 struct ftrace_probe_ops *ops, void *data)
+ {
+-	char str[KSYM_SYMBOL_LEN];
+ 	long count = (long)data;
+ 
+-	kallsyms_lookup(ip, NULL, NULL, NULL, str);
+-	seq_printf(m, "%s:", str);
++	seq_printf(m, "%pf:", (void *)ip);
+ 
+ 	if (ops == &traceon_probe_ops)
+ 		seq_printf(m, "traceon");
+Index: linux-rt-2.6.31/kernel/trace/trace_functions_graph.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/trace/trace_functions_graph.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/trace/trace_functions_graph.c	2010-05-17 14:23:20.128387716 +0200
+@@ -52,7 +52,7 @@
+ 	.opts = trace_opts
+ };
+ 
+-/* pid on the last trace processed */
++static struct trace_array *graph_array;
+ 
+ 
+ /* Add a function return address to the trace stack on thread info.*/
+@@ -166,10 +166,123 @@
+ 	return ret;
+ }
+ 
++static int __trace_graph_entry(struct trace_array *tr,
++				struct ftrace_graph_ent *trace,
++				unsigned long flags,
++				int pc)
++{
++	struct ftrace_event_call *call = &event_funcgraph_entry;
++	struct ring_buffer_event *event;
++	struct ring_buffer *buffer = tr->buffer;
++	struct ftrace_graph_ent_entry *entry;
++
++	if (unlikely(local_read(&__get_cpu_var(ftrace_cpu_disabled))))
++		return 0;
++
++	event = trace_buffer_lock_reserve(buffer, TRACE_GRAPH_ENT,
++					  sizeof(*entry), flags, pc);
++	if (!event)
++		return 0;
++	entry	= ring_buffer_event_data(event);
++	entry->graph_ent			= *trace;
++	if (!filter_current_check_discard(buffer, call, entry, event))
++		ring_buffer_unlock_commit(buffer, event);
++
++	return 1;
++}
++
++int trace_graph_entry(struct ftrace_graph_ent *trace)
++{
++	struct trace_array *tr = graph_array;
++	struct trace_array_cpu *data;
++	unsigned long flags;
++	long disabled;
++	int ret;
++	int cpu;
++	int pc;
++
++	if (unlikely(!tr))
++		return 0;
++
++	if (!ftrace_trace_task(current))
++		return 0;
++
++	if (!ftrace_graph_addr(trace->func))
++		return 0;
++
++	local_irq_save(flags);
++	cpu = raw_smp_processor_id();
++	data = tr->data[cpu];
++	disabled = atomic_inc_return(&data->disabled);
++	if (likely(disabled == 1)) {
++		pc = preempt_count();
++		ret = __trace_graph_entry(tr, trace, flags, pc);
++	} else {
++		ret = 0;
++	}
++	/* Only do the atomic if it is not already set */
++	if (!test_tsk_trace_graph(current))
++		set_tsk_trace_graph(current);
++
++	atomic_dec(&data->disabled);
++	local_irq_restore(flags);
++
++	return ret;
++}
++
++static void __trace_graph_return(struct trace_array *tr,
++				struct ftrace_graph_ret *trace,
++				unsigned long flags,
++				int pc)
++{
++	struct ftrace_event_call *call = &event_funcgraph_exit;
++	struct ring_buffer_event *event;
++	struct ring_buffer *buffer = tr->buffer;
++	struct ftrace_graph_ret_entry *entry;
++
++	if (unlikely(local_read(&__get_cpu_var(ftrace_cpu_disabled))))
++		return;
++
++	event = trace_buffer_lock_reserve(buffer, TRACE_GRAPH_RET,
++					  sizeof(*entry), flags, pc);
++	if (!event)
++		return;
++	entry	= ring_buffer_event_data(event);
++	entry->ret				= *trace;
++	if (!filter_current_check_discard(buffer, call, entry, event))
++		ring_buffer_unlock_commit(buffer, event);
++}
++
++void trace_graph_return(struct ftrace_graph_ret *trace)
++{
++	struct trace_array *tr = graph_array;
++	struct trace_array_cpu *data;
++	unsigned long flags;
++	long disabled;
++	int cpu;
++	int pc;
++
++	local_irq_save(flags);
++	cpu = raw_smp_processor_id();
++	data = tr->data[cpu];
++	disabled = atomic_inc_return(&data->disabled);
++	if (likely(disabled == 1)) {
++		pc = preempt_count();
++		__trace_graph_return(tr, trace, flags, pc);
++	}
++	if (!trace->depth)
++		clear_tsk_trace_graph(current);
++	atomic_dec(&data->disabled);
++	local_irq_restore(flags);
++}
++
+ static int graph_trace_init(struct trace_array *tr)
+ {
+-	int ret = register_ftrace_graph(&trace_graph_return,
+-					&trace_graph_entry);
++	int ret;
++
++	graph_array = tr;
++	ret = register_ftrace_graph(&trace_graph_return,
++				    &trace_graph_entry);
+ 	if (ret)
+ 		return ret;
+ 	tracing_start_cmdline_record();
+@@ -177,49 +290,30 @@
+ 	return 0;
+ }
+ 
++void set_graph_array(struct trace_array *tr)
++{
++	graph_array = tr;
++}
++
+ static void graph_trace_reset(struct trace_array *tr)
+ {
+ 	tracing_stop_cmdline_record();
+ 	unregister_ftrace_graph();
+ }
+ 
+-static inline int log10_cpu(int nb)
+-{
+-	if (nb / 100)
+-		return 3;
+-	if (nb / 10)
+-		return 2;
+-	return 1;
+-}
++static int max_bytes_for_cpu;
+ 
+ static enum print_line_t
+ print_graph_cpu(struct trace_seq *s, int cpu)
+ {
+-	int i;
+ 	int ret;
+-	int log10_this = log10_cpu(cpu);
+-	int log10_all = log10_cpu(cpumask_weight(cpu_online_mask));
+-
+ 
+ 	/*
+ 	 * Start with a space character - to make it stand out
+ 	 * to the right a bit when trace output is pasted into
+ 	 * email:
+ 	 */
+-	ret = trace_seq_printf(s, " ");
+-
+-	/*
+-	 * Tricky - we space the CPU field according to the max
+-	 * number of online CPUs. On a 2-cpu system it would take
+-	 * a maximum of 1 digit - on a 128 cpu system it would
+-	 * take up to 3 digits:
+-	 */
+-	for (i = 0; i < log10_all - log10_this; i++) {
+-		ret = trace_seq_printf(s, " ");
+-		if (!ret)
+-			return TRACE_TYPE_PARTIAL_LINE;
+-	}
+-	ret = trace_seq_printf(s, "%d) ", cpu);
++	ret = trace_seq_printf(s, " %*d) ", max_bytes_for_cpu, cpu);
+ 	if (!ret)
+ 		return TRACE_TYPE_PARTIAL_LINE;
+ 
+@@ -270,6 +364,15 @@
+ }
+ 
+ 
++static enum print_line_t
++print_graph_lat_fmt(struct trace_seq *s, struct trace_entry *entry)
++{
++	if (!trace_seq_putc(s, ' '))
++		return 0;
++
++	return trace_print_lat_fmt(s, entry);
++}
++
+ /* If the pid changed since the last trace, output this event */
+ static enum print_line_t
+ verif_pid(struct trace_seq *s, pid_t pid, int cpu, struct fgraph_data *data)
+@@ -427,6 +530,7 @@
+ 		if (ret == TRACE_TYPE_PARTIAL_LINE)
+ 			return TRACE_TYPE_PARTIAL_LINE;
+ 	}
++
+ 	/* Proc */
+ 	if (tracer_flags.val & TRACE_GRAPH_PRINT_PROC) {
+ 		ret = print_graph_proc(s, pid);
+@@ -470,7 +574,7 @@
+ 	int ret, len;
+ 	int i;
+ 
+-	sprintf(msecs_str, "%lu", (unsigned long) duration);
++	snprintf(msecs_str, sizeof(msecs_str), "%lu", (unsigned long) duration);
+ 
+ 	/* Print msecs */
+ 	ret = trace_seq_printf(s, "%s", msecs_str);
+@@ -565,11 +669,7 @@
+ 			return TRACE_TYPE_PARTIAL_LINE;
+ 	}
+ 
+-	ret = seq_print_ip_sym(s, call->func, 0);
+-	if (!ret)
+-		return TRACE_TYPE_PARTIAL_LINE;
+-
+-	ret = trace_seq_printf(s, "();\n");
++	ret = trace_seq_printf(s, "%pf();\n", (void *)call->func);
+ 	if (!ret)
+ 		return TRACE_TYPE_PARTIAL_LINE;
+ 
+@@ -612,11 +712,7 @@
+ 			return TRACE_TYPE_PARTIAL_LINE;
+ 	}
+ 
+-	ret = seq_print_ip_sym(s, call->func, 0);
+-	if (!ret)
+-		return TRACE_TYPE_PARTIAL_LINE;
+-
+-	ret = trace_seq_printf(s, "() {\n");
++	ret = trace_seq_printf(s, "%pf() {\n", (void *)call->func);
+ 	if (!ret)
+ 		return TRACE_TYPE_PARTIAL_LINE;
+ 
+@@ -672,6 +768,13 @@
+ 			return TRACE_TYPE_PARTIAL_LINE;
+ 	}
+ 
++	/* Latency format */
++	if (trace_flags & TRACE_ITER_LATENCY_FMT) {
++		ret = print_graph_lat_fmt(s, ent);
++		if (ret == TRACE_TYPE_PARTIAL_LINE)
++			return TRACE_TYPE_PARTIAL_LINE;
++	}
++
+ 	return 0;
+ }
+ 
+@@ -866,28 +969,59 @@
+ 	return TRACE_TYPE_HANDLED;
+ }
+ 
++static void print_lat_header(struct seq_file *s)
++{
++	static const char spaces[] = "                "	/* 16 spaces */
++		"    "					/* 4 spaces */
++		"                 ";			/* 17 spaces */
++	int size = 0;
++
++	if (tracer_flags.val & TRACE_GRAPH_PRINT_ABS_TIME)
++		size += 16;
++	if (tracer_flags.val & TRACE_GRAPH_PRINT_CPU)
++		size += 4;
++	if (tracer_flags.val & TRACE_GRAPH_PRINT_PROC)
++		size += 17;
++
++	seq_printf(s, "#%.*s  _-----=> irqs-off        \n", size, spaces);
++	seq_printf(s, "#%.*s / _----=> need-resched    \n", size, spaces);
++	seq_printf(s, "#%.*s| / _---=> hardirq/softirq \n", size, spaces);
++	seq_printf(s, "#%.*s|| / _--=> preempt-depth   \n", size, spaces);
++	seq_printf(s, "#%.*s||| / _-=> lock-depth      \n", size, spaces);
++	seq_printf(s, "#%.*s|||| /                     \n", size, spaces);
++}
++
+ static void print_graph_headers(struct seq_file *s)
+ {
++	int lat = trace_flags & TRACE_ITER_LATENCY_FMT;
++
++	if (lat)
++		print_lat_header(s);
++
+ 	/* 1st line */
+-	seq_printf(s, "# ");
++	seq_printf(s, "#");
+ 	if (tracer_flags.val & TRACE_GRAPH_PRINT_ABS_TIME)
+ 		seq_printf(s, "     TIME       ");
+ 	if (tracer_flags.val & TRACE_GRAPH_PRINT_CPU)
+-		seq_printf(s, "CPU");
++		seq_printf(s, " CPU");
+ 	if (tracer_flags.val & TRACE_GRAPH_PRINT_PROC)
+-		seq_printf(s, "  TASK/PID      ");
++		seq_printf(s, "  TASK/PID       ");
++	if (lat)
++		seq_printf(s, "|||||");
+ 	if (tracer_flags.val & TRACE_GRAPH_PRINT_DURATION)
+ 		seq_printf(s, "  DURATION   ");
+ 	seq_printf(s, "               FUNCTION CALLS\n");
+ 
+ 	/* 2nd line */
+-	seq_printf(s, "# ");
++	seq_printf(s, "#");
+ 	if (tracer_flags.val & TRACE_GRAPH_PRINT_ABS_TIME)
+ 		seq_printf(s, "      |         ");
+ 	if (tracer_flags.val & TRACE_GRAPH_PRINT_CPU)
+-		seq_printf(s, "|  ");
++		seq_printf(s, " |  ");
+ 	if (tracer_flags.val & TRACE_GRAPH_PRINT_PROC)
+-		seq_printf(s, "  |    |        ");
++		seq_printf(s, "   |    |        ");
++	if (lat)
++		seq_printf(s, "|||||");
+ 	if (tracer_flags.val & TRACE_GRAPH_PRINT_DURATION)
+ 		seq_printf(s, "   |   |      ");
+ 	seq_printf(s, "               |   |   |   |\n");
+@@ -934,6 +1068,8 @@
+ 
+ static __init int init_graph_trace(void)
+ {
++	max_bytes_for_cpu = snprintf(NULL, 0, "%d", nr_cpu_ids - 1);
++
+ 	return register_tracer(&graph_trace);
+ }
+ 
+Index: linux-rt-2.6.31/kernel/trace/trace_irqsoff.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/trace/trace_irqsoff.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/trace/trace_irqsoff.c	2010-05-17 14:23:20.128387716 +0200
+@@ -17,13 +17,14 @@
+ #include <linux/fs.h>
+ 
+ #include "trace.h"
++#include <trace/events/hist.h>
+ 
+ static struct trace_array		*irqsoff_trace __read_mostly;
+ static int				tracer_enabled __read_mostly;
+ 
+ static DEFINE_PER_CPU(int, tracing_cpu);
+ 
+-static DEFINE_SPINLOCK(max_trace_lock);
++static DEFINE_ATOMIC_SPINLOCK(max_trace_lock);
+ 
+ enum {
+ 	TRACER_IRQS_OFF		= (1 << 1),
+@@ -129,15 +130,10 @@
+ 		      unsigned long parent_ip,
+ 		      int cpu)
+ {
+-	unsigned long latency, t0, t1;
+ 	cycle_t T0, T1, delta;
+ 	unsigned long flags;
+ 	int pc;
+ 
+-	/*
+-	 * usecs conversion is slow so we try to delay the conversion
+-	 * as long as possible:
+-	 */
+ 	T0 = data->preempt_timestamp;
+ 	T1 = ftrace_now(cpu);
+ 	delta = T1-T0;
+@@ -149,7 +145,7 @@
+ 	if (!report_latency(delta))
+ 		goto out;
+ 
+-	spin_lock_irqsave(&max_trace_lock, flags);
++	atomic_spin_lock_irqsave(&max_trace_lock, flags);
+ 
+ 	/* check if we are still the max latency */
+ 	if (!report_latency(delta))
+@@ -157,28 +153,24 @@
+ 
+ 	trace_function(tr, CALLER_ADDR0, parent_ip, flags, pc);
+ 
+-	latency = nsecs_to_usecs(delta);
+-
+ 	if (data->critical_sequence != max_sequence)
+ 		goto out_unlock;
+ 
+-	tracing_max_latency = delta;
+-	t0 = nsecs_to_usecs(T0);
+-	t1 = nsecs_to_usecs(T1);
+-
+ 	data->critical_end = parent_ip;
+ 
+-	update_max_tr_single(tr, current, cpu);
++	if (likely(!is_tracing_stopped())) {
++		tracing_max_latency = delta;
++		update_max_tr_single(tr, current, cpu);
++	}
+ 
+ 	max_sequence++;
+ 
+ out_unlock:
+-	spin_unlock_irqrestore(&max_trace_lock, flags);
++	atomic_spin_unlock_irqrestore(&max_trace_lock, flags);
+ 
+ out:
+ 	data->critical_sequence = max_sequence;
+ 	data->preempt_timestamp = ftrace_now(cpu);
+-	tracing_reset(tr, cpu);
+ 	trace_function(tr, CALLER_ADDR0, parent_ip, flags, pc);
+ }
+ 
+@@ -208,7 +200,6 @@
+ 	data->critical_sequence = max_sequence;
+ 	data->preempt_timestamp = ftrace_now(cpu);
+ 	data->critical_start = parent_ip ? : ip;
+-	tracing_reset(tr, cpu);
+ 
+ 	local_save_flags(flags);
+ 
+@@ -257,11 +248,13 @@
+ {
+ 	if (preempt_trace() || irq_trace())
+ 		start_critical_timing(CALLER_ADDR0, CALLER_ADDR1);
++	trace_preemptirqsoff_hist(TRACE_START, 1);
+ }
+ EXPORT_SYMBOL_GPL(start_critical_timings);
+ 
+ void stop_critical_timings(void)
+ {
++	trace_preemptirqsoff_hist(TRACE_STOP, 0);
+ 	if (preempt_trace() || irq_trace())
+ 		stop_critical_timing(CALLER_ADDR0, CALLER_ADDR1);
+ }
+@@ -271,6 +264,7 @@
+ #ifdef CONFIG_PROVE_LOCKING
+ void time_hardirqs_on(unsigned long a0, unsigned long a1)
+ {
++	trace_preemptirqsoff_hist(IRQS_ON, 0);
+ 	if (!preempt_trace() && irq_trace())
+ 		stop_critical_timing(a0, a1);
+ }
+@@ -279,6 +273,7 @@
+ {
+ 	if (!preempt_trace() && irq_trace())
+ 		start_critical_timing(a0, a1);
++	trace_preemptirqsoff_hist(IRQS_OFF, 1);
+ }
+ 
+ #else /* !CONFIG_PROVE_LOCKING */
+@@ -312,6 +307,7 @@
+  */
+ void trace_hardirqs_on(void)
+ {
++	trace_preemptirqsoff_hist(IRQS_ON, 0);
+ 	if (!preempt_trace() && irq_trace())
+ 		stop_critical_timing(CALLER_ADDR0, CALLER_ADDR1);
+ }
+@@ -321,11 +317,13 @@
+ {
+ 	if (!preempt_trace() && irq_trace())
+ 		start_critical_timing(CALLER_ADDR0, CALLER_ADDR1);
++	trace_preemptirqsoff_hist(IRQS_OFF, 1);
+ }
+ EXPORT_SYMBOL(trace_hardirqs_off);
+ 
+ void trace_hardirqs_on_caller(unsigned long caller_addr)
+ {
++	trace_preemptirqsoff_hist(IRQS_ON, 0);
+ 	if (!preempt_trace() && irq_trace())
+ 		stop_critical_timing(CALLER_ADDR0, caller_addr);
+ }
+@@ -335,6 +333,7 @@
+ {
+ 	if (!preempt_trace() && irq_trace())
+ 		start_critical_timing(CALLER_ADDR0, caller_addr);
++	trace_preemptirqsoff_hist(IRQS_OFF, 1);
+ }
+ EXPORT_SYMBOL(trace_hardirqs_off_caller);
+ 
+@@ -344,12 +343,14 @@
+ #ifdef CONFIG_PREEMPT_TRACER
+ void trace_preempt_on(unsigned long a0, unsigned long a1)
+ {
++	trace_preemptirqsoff_hist(PREEMPT_ON, 0);
+ 	if (preempt_trace())
+ 		stop_critical_timing(a0, a1);
+ }
+ 
+ void trace_preempt_off(unsigned long a0, unsigned long a1)
+ {
++	trace_preemptirqsoff_hist(PREEMPT_OFF, 1);
+ 	if (preempt_trace())
+ 		start_critical_timing(a0, a1);
+ }
+@@ -379,6 +380,7 @@
+ 	irqsoff_trace = tr;
+ 	/* make sure that the tracer is visible */
+ 	smp_wmb();
++	tracing_reset_online_cpus(tr);
+ 	start_irqsoff_tracer(tr);
+ }
+ 
+Index: linux-rt-2.6.31/kernel/trace/trace_mmiotrace.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/trace/trace_mmiotrace.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/trace/trace_mmiotrace.c	2010-05-17 14:23:20.128387716 +0200
+@@ -307,11 +307,13 @@
+ 				struct trace_array_cpu *data,
+ 				struct mmiotrace_rw *rw)
+ {
++	struct ftrace_event_call *call = &event_mmiotrace_rw;
++	struct ring_buffer *buffer = tr->buffer;
+ 	struct ring_buffer_event *event;
+ 	struct trace_mmiotrace_rw *entry;
+ 	int pc = preempt_count();
+ 
+-	event = trace_buffer_lock_reserve(tr, TRACE_MMIO_RW,
++	event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_RW,
+ 					  sizeof(*entry), 0, pc);
+ 	if (!event) {
+ 		atomic_inc(&dropped_count);
+@@ -319,7 +321,9 @@
+ 	}
+ 	entry	= ring_buffer_event_data(event);
+ 	entry->rw			= *rw;
+-	trace_buffer_unlock_commit(tr, event, 0, pc);
++
++	if (!filter_check_discard(call, entry, buffer, event))
++		trace_buffer_unlock_commit(buffer, event, 0, pc);
+ }
+ 
+ void mmio_trace_rw(struct mmiotrace_rw *rw)
+@@ -333,11 +337,13 @@
+ 				struct trace_array_cpu *data,
+ 				struct mmiotrace_map *map)
+ {
++	struct ftrace_event_call *call = &event_mmiotrace_map;
++	struct ring_buffer *buffer = tr->buffer;
+ 	struct ring_buffer_event *event;
+ 	struct trace_mmiotrace_map *entry;
+ 	int pc = preempt_count();
+ 
+-	event = trace_buffer_lock_reserve(tr, TRACE_MMIO_MAP,
++	event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_MAP,
+ 					  sizeof(*entry), 0, pc);
+ 	if (!event) {
+ 		atomic_inc(&dropped_count);
+@@ -345,7 +351,9 @@
+ 	}
+ 	entry	= ring_buffer_event_data(event);
+ 	entry->map			= *map;
+-	trace_buffer_unlock_commit(tr, event, 0, pc);
++
++	if (!filter_check_discard(call, entry, buffer, event))
++		trace_buffer_unlock_commit(buffer, event, 0, pc);
+ }
+ 
+ void mmio_trace_mapping(struct mmiotrace_map *map)
+Index: linux-rt-2.6.31/kernel/trace/trace_output.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/trace/trace_output.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/trace/trace_output.c	2010-05-17 14:23:20.128387716 +0200
+@@ -407,7 +407,7 @@
+ 		 * since individual threads might have already quit!
+ 		 */
+ 		rcu_read_lock();
+-		task = find_task_by_vpid(entry->ent.tgid);
++		task = find_task_by_vpid(entry->tgid);
+ 		if (task)
+ 			mm = get_task_mm(task);
+ 		rcu_read_unlock();
+@@ -460,18 +460,23 @@
+ 	return ret;
+ }
+ 
+-static int
+-lat_print_generic(struct trace_seq *s, struct trace_entry *entry, int cpu)
++/**
++ * trace_print_lat_fmt - print the irq, preempt and lockdep fields
++ * @s: trace seq struct to write to
++ * @entry: The trace entry field from the ring buffer
++ *
++ * Prints the generic fields of irqs off, in hard or softirq, preempt
++ * count and lock depth.
++ */
++int trace_print_lat_fmt(struct trace_seq *s, struct trace_entry *entry)
+ {
+ 	int hardirq, softirq;
+-	char comm[TASK_COMM_LEN];
++	int ret;
+ 
+-	trace_find_cmdline(entry->pid, comm);
+ 	hardirq = entry->flags & TRACE_FLAG_HARDIRQ;
+ 	softirq = entry->flags & TRACE_FLAG_SOFTIRQ;
+ 
+-	if (!trace_seq_printf(s, "%8.8s-%-5d %3d%c%c%c",
+-			      comm, entry->pid, cpu,
++	if (!trace_seq_printf(s, "%c%c%c",
+ 			      (entry->flags & TRACE_FLAG_IRQS_OFF) ? 'd' :
+ 				(entry->flags & TRACE_FLAG_IRQS_NOSUPPORT) ?
+ 				  'X' : '.',
+@@ -482,8 +487,31 @@
+ 		return 0;
+ 
+ 	if (entry->preempt_count)
+-		return trace_seq_printf(s, "%x", entry->preempt_count);
+-	return trace_seq_puts(s, ".");
++		ret = trace_seq_printf(s, "%x", entry->preempt_count);
++	else
++		ret = trace_seq_putc(s, '.');
++
++	if (!ret)
++		return 0;
++
++	if (entry->lock_depth < 0)
++		return trace_seq_putc(s, '.');
++
++	return trace_seq_printf(s, "%d", entry->lock_depth);
++}
++
++static int
++lat_print_generic(struct trace_seq *s, struct trace_entry *entry, int cpu)
++{
++	char comm[TASK_COMM_LEN];
++
++	trace_find_cmdline(entry->pid, comm);
++
++	if (!trace_seq_printf(s, "%8.8s-%-5d %3d",
++			      comm, entry->pid, cpu))
++		return 0;
++
++	return trace_print_lat_fmt(s, entry);
+ }
+ 
+ static unsigned long preempt_mark_thresh = 100;
+Index: linux-rt-2.6.31/kernel/trace/trace_output.h
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/trace/trace_output.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/trace/trace_output.h	2010-05-17 14:23:20.128387716 +0200
+@@ -26,6 +26,8 @@
+ 
+ extern enum print_line_t trace_nop_print(struct trace_iterator *iter,
+ 					 int flags);
++extern int
++trace_print_lat_fmt(struct trace_seq *s, struct trace_entry *entry);
+ 
+ /* used by module unregistering */
+ extern int __unregister_ftrace_event(struct trace_event *event);
+Index: linux-rt-2.6.31/kernel/trace/trace_power.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/trace/trace_power.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/trace/trace_power.c	2010-05-17 14:23:20.128387716 +0200
+@@ -38,6 +38,7 @@
+ {
+ 	struct ftrace_event_call *call = &event_power;
+ 	struct ring_buffer_event *event;
++	struct ring_buffer *buffer;
+ 	struct trace_power *entry;
+ 	struct trace_array_cpu *data;
+ 	struct trace_array *tr = power_trace;
+@@ -45,18 +46,20 @@
+ 	if (!trace_power_enabled)
+ 		return;
+ 
++	buffer = tr->buffer;
++
+ 	preempt_disable();
+ 	it->end = ktime_get();
+ 	data = tr->data[smp_processor_id()];
+ 
+-	event = trace_buffer_lock_reserve(tr, TRACE_POWER,
++	event = trace_buffer_lock_reserve(buffer, TRACE_POWER,
+ 					  sizeof(*entry), 0, 0);
+ 	if (!event)
+ 		goto out;
+ 	entry	= ring_buffer_event_data(event);
+ 	entry->state_data = *it;
+-	if (!filter_check_discard(call, entry, tr->buffer, event))
+-		trace_buffer_unlock_commit(tr, event, 0, 0);
++	if (!filter_check_discard(call, entry, buffer, event))
++		trace_buffer_unlock_commit(buffer, event, 0, 0);
+  out:
+ 	preempt_enable();
+ }
+@@ -66,6 +69,7 @@
+ {
+ 	struct ftrace_event_call *call = &event_power;
+ 	struct ring_buffer_event *event;
++	struct ring_buffer *buffer;
+ 	struct trace_power *entry;
+ 	struct trace_array_cpu *data;
+ 	struct trace_array *tr = power_trace;
+@@ -73,6 +77,8 @@
+ 	if (!trace_power_enabled)
+ 		return;
+ 
++	buffer = tr->buffer;
++
+ 	memset(it, 0, sizeof(struct power_trace));
+ 	it->state = level;
+ 	it->type = type;
+@@ -81,14 +87,14 @@
+ 	it->end = it->stamp;
+ 	data = tr->data[smp_processor_id()];
+ 
+-	event = trace_buffer_lock_reserve(tr, TRACE_POWER,
++	event = trace_buffer_lock_reserve(buffer, TRACE_POWER,
+ 					  sizeof(*entry), 0, 0);
+ 	if (!event)
+ 		goto out;
+ 	entry	= ring_buffer_event_data(event);
+ 	entry->state_data = *it;
+-	if (!filter_check_discard(call, entry, tr->buffer, event))
+-		trace_buffer_unlock_commit(tr, event, 0, 0);
++	if (!filter_check_discard(call, entry, buffer, event))
++		trace_buffer_unlock_commit(buffer, event, 0, 0);
+  out:
+ 	preempt_enable();
+ }
+@@ -144,14 +150,12 @@
+ 
+ static int power_trace_init(struct trace_array *tr)
+ {
+-	int cpu;
+ 	power_trace = tr;
+ 
+ 	trace_power_enabled = 1;
+ 	tracing_power_register();
+ 
+-	for_each_cpu(cpu, cpu_possible_mask)
+-		tracing_reset(tr, cpu);
++	tracing_reset_online_cpus(tr);
+ 	return 0;
+ }
+ 
+Index: linux-rt-2.6.31/kernel/trace/trace_sched_switch.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/trace/trace_sched_switch.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/trace/trace_sched_switch.c	2010-05-17 14:23:20.128387716 +0200
+@@ -20,6 +20,35 @@
+ static DEFINE_MUTEX(sched_register_mutex);
+ static int			sched_stopped;
+ 
++
++void
++tracing_sched_switch_trace(struct trace_array *tr,
++			   struct task_struct *prev,
++			   struct task_struct *next,
++			   unsigned long flags, int pc)
++{
++	struct ftrace_event_call *call = &event_context_switch;
++	struct ring_buffer *buffer = tr->buffer;
++	struct ring_buffer_event *event;
++	struct ctx_switch_entry *entry;
++
++	event = trace_buffer_lock_reserve(buffer, TRACE_CTX,
++					  sizeof(*entry), flags, pc);
++	if (!event)
++		return;
++	entry	= ring_buffer_event_data(event);
++	entry->prev_pid			= prev->pid;
++	entry->prev_prio		= prev->prio;
++	entry->prev_state		= prev->state;
++	entry->next_pid			= next->pid;
++	entry->next_prio		= next->prio;
++	entry->next_state		= next->state;
++	entry->next_cpu	= task_cpu(next);
++
++	if (!filter_check_discard(call, entry, buffer, event))
++		trace_buffer_unlock_commit(buffer, event, flags, pc);
++}
++
+ static void
+ probe_sched_switch(struct rq *__rq, struct task_struct *prev,
+ 			struct task_struct *next)
+@@ -49,6 +78,36 @@
+ 	local_irq_restore(flags);
+ }
+ 
++void
++tracing_sched_wakeup_trace(struct trace_array *tr,
++			   struct task_struct *wakee,
++			   struct task_struct *curr,
++			   unsigned long flags, int pc)
++{
++	struct ftrace_event_call *call = &event_wakeup;
++	struct ring_buffer_event *event;
++	struct ctx_switch_entry *entry;
++	struct ring_buffer *buffer = tr->buffer;
++
++	event = trace_buffer_lock_reserve(buffer, TRACE_WAKE,
++					  sizeof(*entry), flags, pc);
++	if (!event)
++		return;
++	entry	= ring_buffer_event_data(event);
++	entry->prev_pid			= curr->pid;
++	entry->prev_prio		= curr->prio;
++	entry->prev_state		= curr->state;
++	entry->next_pid			= wakee->pid;
++	entry->next_prio		= wakee->prio;
++	entry->next_state		= wakee->state;
++	entry->next_cpu			= task_cpu(wakee);
++
++	if (!filter_check_discard(call, entry, buffer, event))
++		ring_buffer_unlock_commit(buffer, event);
++	ftrace_trace_stack(tr->buffer, flags, 6, pc);
++	ftrace_trace_userstack(tr->buffer, flags, pc);
++}
++
+ static void
+ probe_sched_wakeup(struct rq *__rq, struct task_struct *wakee, int success)
+ {
+Index: linux-rt-2.6.31/kernel/trace/trace_sched_wakeup.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/trace/trace_sched_wakeup.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/trace/trace_sched_wakeup.c	2010-05-17 14:23:20.128387716 +0200
+@@ -24,6 +24,7 @@
+ 
+ static struct task_struct	*wakeup_task;
+ static int			wakeup_cpu;
++static int			wakeup_current_cpu;
+ static unsigned			wakeup_prio = -1;
+ static int			wakeup_rt;
+ 
+@@ -56,33 +57,23 @@
+ 	resched = ftrace_preempt_disable();
+ 
+ 	cpu = raw_smp_processor_id();
++	if (cpu != wakeup_current_cpu)
++		goto out_enable;
++
+ 	data = tr->data[cpu];
+ 	disabled = atomic_inc_return(&data->disabled);
+ 	if (unlikely(disabled != 1))
+ 		goto out;
+ 
+ 	local_irq_save(flags);
+-	__raw_spin_lock(&wakeup_lock);
+-
+-	if (unlikely(!wakeup_task))
+-		goto unlock;
+-
+-	/*
+-	 * The task can't disappear because it needs to
+-	 * wake up first, and we have the wakeup_lock.
+-	 */
+-	if (task_cpu(wakeup_task) != cpu)
+-		goto unlock;
+ 
+ 	trace_function(tr, ip, parent_ip, flags, pc);
+ 
+- unlock:
+-	__raw_spin_unlock(&wakeup_lock);
+ 	local_irq_restore(flags);
+ 
+  out:
+ 	atomic_dec(&data->disabled);
+-
++ out_enable:
+ 	ftrace_preempt_enable(resched);
+ }
+ 
+@@ -107,11 +98,18 @@
+ 	return 1;
+ }
+ 
++static void probe_wakeup_migrate_task(struct task_struct *task, int cpu)
++{
++	if (task != wakeup_task)
++		return;
++
++	wakeup_current_cpu = cpu;
++}
++
+ static void notrace
+ probe_wakeup_sched_switch(struct rq *rq, struct task_struct *prev,
+ 	struct task_struct *next)
+ {
+-	unsigned long latency = 0, t0 = 0, t1 = 0;
+ 	struct trace_array_cpu *data;
+ 	cycle_t T0, T1, delta;
+ 	unsigned long flags;
+@@ -133,6 +131,14 @@
+ 	 */
+ 	smp_rmb();
+ 
++	/* The task we are waiting for is already running */
++	if (unlikely(current == wakeup_task)) {
++		cpu = raw_smp_processor_id();
++		local_irq_save(flags);
++		__raw_spin_lock(&wakeup_lock);
++		goto out_unlock;
++	}
++
+ 	if (next != wakeup_task)
+ 		return;
+ 
+@@ -157,10 +163,6 @@
+ 	trace_function(wakeup_trace, CALLER_ADDR0, CALLER_ADDR1, flags, pc);
+ 	tracing_sched_switch_trace(wakeup_trace, prev, next, flags, pc);
+ 
+-	/*
+-	 * usecs conversion is slow so we try to delay the conversion
+-	 * as long as possible:
+-	 */
+ 	T0 = data->preempt_timestamp;
+ 	T1 = ftrace_now(cpu);
+ 	delta = T1-T0;
+@@ -168,13 +170,10 @@
+ 	if (!report_latency(delta))
+ 		goto out_unlock;
+ 
+-	latency = nsecs_to_usecs(delta);
+-
+-	tracing_max_latency = delta;
+-	t0 = nsecs_to_usecs(T0);
+-	t1 = nsecs_to_usecs(T1);
+-
+-	update_max_tr(wakeup_trace, wakeup_task, wakeup_cpu);
++	if (likely(!is_tracing_stopped())) {
++		tracing_max_latency = delta;
++		update_max_tr(wakeup_trace, wakeup_task, wakeup_cpu);
++	}
+ 
+ out_unlock:
+ 	__wakeup_reset(wakeup_trace);
+@@ -186,11 +185,6 @@
+ 
+ static void __wakeup_reset(struct trace_array *tr)
+ {
+-	int cpu;
+-
+-	for_each_possible_cpu(cpu)
+-		tracing_reset(tr, cpu);
+-
+ 	wakeup_cpu = -1;
+ 	wakeup_prio = -1;
+ 
+@@ -204,6 +198,8 @@
+ {
+ 	unsigned long flags;
+ 
++	tracing_reset_online_cpus(tr);
++
+ 	local_irq_save(flags);
+ 	__raw_spin_lock(&wakeup_lock);
+ 	__wakeup_reset(tr);
+@@ -247,6 +243,7 @@
+ 	__wakeup_reset(wakeup_trace);
+ 
+ 	wakeup_cpu = task_cpu(p);
++	wakeup_current_cpu = wakeup_cpu;
+ 	wakeup_prio = p->prio;
+ 
+ 	wakeup_task = p;
+@@ -296,6 +293,13 @@
+ 		goto fail_deprobe_wake_new;
+ 	}
+ 
++	ret = register_trace_sched_migrate_task(probe_wakeup_migrate_task);
++	if (ret) {
++		pr_info("wakeup trace: Couldn't activate tracepoint"
++			" probe to kernel_sched_migrate_task\n");
++		return;
++	}
++
+ 	wakeup_reset(tr);
+ 
+ 	/*
+@@ -328,6 +332,7 @@
+ 	unregister_trace_sched_switch(probe_wakeup_sched_switch);
+ 	unregister_trace_sched_wakeup_new(probe_wakeup);
+ 	unregister_trace_sched_wakeup(probe_wakeup);
++	unregister_trace_sched_migrate_task(probe_wakeup_migrate_task);
+ }
+ 
+ static int __wakeup_tracer_init(struct trace_array *tr)
+Index: linux-rt-2.6.31/kernel/trace/trace_selftest.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/trace/trace_selftest.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/trace/trace_selftest.c	2010-05-17 14:23:20.128387716 +0200
+@@ -288,6 +288,7 @@
+ 	 * to detect and recover from possible hangs
+ 	 */
+ 	tracing_reset_online_cpus(tr);
++	set_graph_array(tr);
+ 	ret = register_ftrace_graph(&trace_graph_return,
+ 				    &trace_graph_entry_watchdog);
+ 	if (ret) {
+Index: linux-rt-2.6.31/kernel/trace/trace_stack.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/trace/trace_stack.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/trace/trace_stack.c	2010-05-17 14:23:20.128387716 +0200
+@@ -186,43 +186,33 @@
+ };
+ 
+ static void *
+-t_next(struct seq_file *m, void *v, loff_t *pos)
++__next(struct seq_file *m, loff_t *pos)
+ {
+-	long i;
++	long n = *pos - 1;
+ 
+-	(*pos)++;
+-
+-	if (v == SEQ_START_TOKEN)
+-		i = 0;
+-	else {
+-		i = *(long *)v;
+-		i++;
+-	}
+-
+-	if (i >= max_stack_trace.nr_entries ||
+-	    stack_dump_trace[i] == ULONG_MAX)
++	if (n >= max_stack_trace.nr_entries || stack_dump_trace[n] == ULONG_MAX)
+ 		return NULL;
+ 
+-	m->private = (void *)i;
+-
++	m->private = (void *)n;
+ 	return &m->private;
+ }
+ 
+-static void *t_start(struct seq_file *m, loff_t *pos)
++static void *
++t_next(struct seq_file *m, void *v, loff_t *pos)
+ {
+-	void *t = SEQ_START_TOKEN;
+-	loff_t l = 0;
++	(*pos)++;
++	return __next(m, pos);
++}
+ 
++static void *t_start(struct seq_file *m, loff_t *pos)
++{
+ 	local_irq_disable();
+ 	__raw_spin_lock(&max_stack_lock);
+ 
+ 	if (*pos == 0)
+ 		return SEQ_START_TOKEN;
+ 
+-	for (; t && l < *pos; t = t_next(m, t, &l))
+-		;
+-
+-	return t;
++	return __next(m, pos);
+ }
+ 
+ static void t_stop(struct seq_file *m, void *p)
+@@ -234,15 +224,8 @@
+ static int trace_lookup_stack(struct seq_file *m, long i)
+ {
+ 	unsigned long addr = stack_dump_trace[i];
+-#ifdef CONFIG_KALLSYMS
+-	char str[KSYM_SYMBOL_LEN];
+-
+-	sprint_symbol(str, addr);
+ 
+-	return seq_printf(m, "%s\n", str);
+-#else
+-	return seq_printf(m, "%p\n", (void*)addr);
+-#endif
++	return seq_printf(m, "%pF\n", (void *)addr);
+ }
+ 
+ static void print_disabled(struct seq_file *m)
+Index: linux-rt-2.6.31/kernel/trace/trace_stat.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/trace/trace_stat.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/trace/trace_stat.c	2010-05-17 14:23:20.128387716 +0200
+@@ -49,7 +49,8 @@
+  * but it will at least advance closer to the next one
+  * to be released.
+  */
+-static struct rb_node *release_next(struct rb_node *node)
++static struct rb_node *release_next(struct tracer_stat *ts,
++				    struct rb_node *node)
+ {
+ 	struct stat_node *snode;
+ 	struct rb_node *parent = rb_parent(node);
+@@ -67,6 +68,8 @@
+ 			parent->rb_right = NULL;
+ 
+ 		snode = container_of(node, struct stat_node, node);
++		if (ts->stat_release)
++			ts->stat_release(snode->stat);
+ 		kfree(snode);
+ 
+ 		return parent;
+@@ -78,7 +81,7 @@
+ 	struct rb_node *node = session->stat_root.rb_node;
+ 
+ 	while (node)
+-		node = release_next(node);
++		node = release_next(session->ts, node);
+ 
+ 	session->stat_root = RB_ROOT;
+ }
+@@ -200,17 +203,21 @@
+ {
+ 	struct stat_session *session = s->private;
+ 	struct rb_node *node;
++	int n = *pos;
+ 	int i;
+ 
+ 	/* Prevent from tracer switch or rbtree modification */
+ 	mutex_lock(&session->stat_mutex);
+ 
+ 	/* If we are in the beginning of the file, print the headers */
+-	if (!*pos && session->ts->stat_headers)
+-		return SEQ_START_TOKEN;
++	if (session->ts->stat_headers) {
++		if (n == 0)
++			return SEQ_START_TOKEN;
++		n--;
++	}
+ 
+ 	node = rb_first(&session->stat_root);
+-	for (i = 0; node && i < *pos; i++)
++	for (i = 0; node && i < n; i++)
+ 		node = rb_next(node);
+ 
+ 	return node;
+Index: linux-rt-2.6.31/kernel/trace/trace_stat.h
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/trace/trace_stat.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/trace/trace_stat.h	2010-05-17 14:23:20.128387716 +0200
+@@ -18,6 +18,8 @@
+ 	int			(*stat_cmp)(void *p1, void *p2);
+ 	/* Print a stat entry */
+ 	int			(*stat_show)(struct seq_file *s, void *p);
++	/* Release an entry */
++	void			(*stat_release)(void *stat);
+ 	/* Print the headers of your stat entries */
+ 	int			(*stat_headers)(struct seq_file *s);
+ };
+Index: linux-rt-2.6.31/kernel/trace/trace_syscalls.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/trace/trace_syscalls.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/trace/trace_syscalls.c	2010-05-17 14:23:20.128387716 +0200
+@@ -1,30 +1,18 @@
+ #include <trace/syscall.h>
++#include <trace/events/syscalls.h>
+ #include <linux/kernel.h>
++#include <linux/ftrace.h>
++#include <linux/perf_counter.h>
+ #include <asm/syscall.h>
+ 
+ #include "trace_output.h"
+ #include "trace.h"
+ 
+-/* Keep a counter of the syscall tracing users */
+-static int refcount;
+-
+-/* Prevent from races on thread flags toggling */
+ static DEFINE_MUTEX(syscall_trace_lock);
+-
+-/* Option to display the parameters types */
+-enum {
+-	TRACE_SYSCALLS_OPT_TYPES = 0x1,
+-};
+-
+-static struct tracer_opt syscalls_opts[] = {
+-	{ TRACER_OPT(syscall_arg_type, TRACE_SYSCALLS_OPT_TYPES) },
+-	{ }
+-};
+-
+-static struct tracer_flags syscalls_flags = {
+-	.val = 0, /* By default: no parameters types */
+-	.opts = syscalls_opts
+-};
++static int sys_refcount_enter;
++static int sys_refcount_exit;
++static DECLARE_BITMAP(enabled_enter_syscalls, NR_syscalls);
++static DECLARE_BITMAP(enabled_exit_syscalls, NR_syscalls);
+ 
+ enum print_line_t
+ print_syscall_enter(struct trace_iterator *iter, int flags)
+@@ -35,35 +23,46 @@
+ 	struct syscall_metadata *entry;
+ 	int i, ret, syscall;
+ 
+-	trace_assign_type(trace, ent);
+-
++	trace = (typeof(trace))ent;
+ 	syscall = trace->nr;
+-
+ 	entry = syscall_nr_to_meta(syscall);
++
+ 	if (!entry)
+ 		goto end;
+ 
++	if (entry->enter_id != ent->type) {
++		WARN_ON_ONCE(1);
++		goto end;
++	}
++
+ 	ret = trace_seq_printf(s, "%s(", entry->name);
+ 	if (!ret)
+ 		return TRACE_TYPE_PARTIAL_LINE;
+ 
+ 	for (i = 0; i < entry->nb_args; i++) {
+ 		/* parameter types */
+-		if (syscalls_flags.val & TRACE_SYSCALLS_OPT_TYPES) {
++		if (trace_flags & TRACE_ITER_VERBOSE) {
+ 			ret = trace_seq_printf(s, "%s ", entry->types[i]);
+ 			if (!ret)
+ 				return TRACE_TYPE_PARTIAL_LINE;
+ 		}
+ 		/* parameter values */
+-		ret = trace_seq_printf(s, "%s: %lx%s ", entry->args[i],
++		ret = trace_seq_printf(s, "%s: %lx%s", entry->args[i],
+ 				       trace->args[i],
+-				       i == entry->nb_args - 1 ? ")" : ",");
++				       i == entry->nb_args - 1 ? "" : ", ");
+ 		if (!ret)
+ 			return TRACE_TYPE_PARTIAL_LINE;
+ 	}
+ 
++	ret = trace_seq_putc(s, ')');
++	if (!ret)
++		return TRACE_TYPE_PARTIAL_LINE;
++
+ end:
+-	trace_seq_printf(s, "\n");
++	ret =  trace_seq_putc(s, '\n');
++	if (!ret)
++		return TRACE_TYPE_PARTIAL_LINE;
++
+ 	return TRACE_TYPE_HANDLED;
+ }
+ 
+@@ -77,16 +76,20 @@
+ 	struct syscall_metadata *entry;
+ 	int ret;
+ 
+-	trace_assign_type(trace, ent);
+-
++	trace = (typeof(trace))ent;
+ 	syscall = trace->nr;
+-
+ 	entry = syscall_nr_to_meta(syscall);
++
+ 	if (!entry) {
+ 		trace_seq_printf(s, "\n");
+ 		return TRACE_TYPE_HANDLED;
+ 	}
+ 
++	if (entry->exit_id != ent->type) {
++		WARN_ON_ONCE(1);
++		return TRACE_TYPE_UNHANDLED;
++	}
++
+ 	ret = trace_seq_printf(s, "%s -> 0x%lx\n", entry->name,
+ 				trace->ret);
+ 	if (!ret)
+@@ -95,62 +98,140 @@
+ 	return TRACE_TYPE_HANDLED;
+ }
+ 
+-void start_ftrace_syscalls(void)
++extern char *__bad_type_size(void);
++
++#define SYSCALL_FIELD(type, name)					\
++	sizeof(type) != sizeof(trace.name) ?				\
++		__bad_type_size() :					\
++		#type, #name, offsetof(typeof(trace), name), sizeof(trace.name)
++
++int syscall_enter_format(struct ftrace_event_call *call, struct trace_seq *s)
+ {
+-	unsigned long flags;
+-	struct task_struct *g, *t;
++	int i;
++	int nr;
++	int ret;
++	struct syscall_metadata *entry;
++	struct syscall_trace_enter trace;
++	int offset = offsetof(struct syscall_trace_enter, args);
+ 
+-	mutex_lock(&syscall_trace_lock);
++	nr = syscall_name_to_nr(call->data);
++	entry = syscall_nr_to_meta(nr);
+ 
+-	/* Don't enable the flag on the tasks twice */
+-	if (++refcount != 1)
+-		goto unlock;
++	if (!entry)
++		return 0;
+ 
+-	arch_init_ftrace_syscalls();
+-	read_lock_irqsave(&tasklist_lock, flags);
++	ret = trace_seq_printf(s, "\tfield:%s %s;\toffset:%zu;\tsize:%zu;\n",
++			       SYSCALL_FIELD(int, nr));
++	if (!ret)
++		return 0;
+ 
+-	do_each_thread(g, t) {
+-		set_tsk_thread_flag(t, TIF_SYSCALL_FTRACE);
+-	} while_each_thread(g, t);
++	for (i = 0; i < entry->nb_args; i++) {
++		ret = trace_seq_printf(s, "\tfield:%s %s;", entry->types[i],
++				        entry->args[i]);
++		if (!ret)
++			return 0;
++		ret = trace_seq_printf(s, "\toffset:%d;\tsize:%zu;\n", offset,
++				       sizeof(unsigned long));
++		if (!ret)
++			return 0;
++		offset += sizeof(unsigned long);
++	}
+ 
+-	read_unlock_irqrestore(&tasklist_lock, flags);
++	trace_seq_puts(s, "\nprint fmt: \"");
++	for (i = 0; i < entry->nb_args; i++) {
++		ret = trace_seq_printf(s, "%s: 0x%%0%zulx%s", entry->args[i],
++				        sizeof(unsigned long),
++					i == entry->nb_args - 1 ? "" : ", ");
++		if (!ret)
++			return 0;
++	}
++	trace_seq_putc(s, '"');
+ 
+-unlock:
+-	mutex_unlock(&syscall_trace_lock);
++	for (i = 0; i < entry->nb_args; i++) {
++		ret = trace_seq_printf(s, ", ((unsigned long)(REC->%s))",
++				       entry->args[i]);
++		if (!ret)
++			return 0;
++	}
++
++	return trace_seq_putc(s, '\n');
+ }
+ 
+-void stop_ftrace_syscalls(void)
++int syscall_exit_format(struct ftrace_event_call *call, struct trace_seq *s)
+ {
+-	unsigned long flags;
+-	struct task_struct *g, *t;
++	int ret;
++	struct syscall_trace_exit trace;
+ 
+-	mutex_lock(&syscall_trace_lock);
++	ret = trace_seq_printf(s,
++			       "\tfield:%s %s;\toffset:%zu;\tsize:%zu;\n"
++			       "\tfield:%s %s;\toffset:%zu;\tsize:%zu;\n",
++			       SYSCALL_FIELD(int, nr),
++			       SYSCALL_FIELD(unsigned long, ret));
++	if (!ret)
++		return 0;
+ 
+-	/* There are perhaps still some users */
+-	if (--refcount)
+-		goto unlock;
++	return trace_seq_printf(s, "\nprint fmt: \"0x%%lx\", REC->ret\n");
++}
+ 
+-	read_lock_irqsave(&tasklist_lock, flags);
++int syscall_enter_define_fields(struct ftrace_event_call *call)
++{
++	struct syscall_trace_enter trace;
++	struct syscall_metadata *meta;
++	int ret;
++	int nr;
++	int i;
++	int offset = offsetof(typeof(trace), args);
++
++	nr = syscall_name_to_nr(call->data);
++	meta = syscall_nr_to_meta(nr);
++
++	if (!meta)
++		return 0;
++
++	ret = trace_define_common_fields(call);
++	if (ret)
++		return ret;
++
++	for (i = 0; i < meta->nb_args; i++) {
++		ret = trace_define_field(call, meta->types[i],
++					 meta->args[i], offset,
++					 sizeof(unsigned long), 0,
++					 FILTER_OTHER);
++		offset += sizeof(unsigned long);
++	}
+ 
+-	do_each_thread(g, t) {
+-		clear_tsk_thread_flag(t, TIF_SYSCALL_FTRACE);
+-	} while_each_thread(g, t);
++	return ret;
++}
+ 
+-	read_unlock_irqrestore(&tasklist_lock, flags);
++int syscall_exit_define_fields(struct ftrace_event_call *call)
++{
++	struct syscall_trace_exit trace;
++	int ret;
+ 
+-unlock:
+-	mutex_unlock(&syscall_trace_lock);
++	ret = trace_define_common_fields(call);
++	if (ret)
++		return ret;
++
++	ret = trace_define_field(call, SYSCALL_FIELD(unsigned long, ret), 0,
++				 FILTER_OTHER);
++
++	return ret;
+ }
+ 
+-void ftrace_syscall_enter(struct pt_regs *regs)
++void ftrace_syscall_enter(struct pt_regs *regs, long id)
+ {
+ 	struct syscall_trace_enter *entry;
+ 	struct syscall_metadata *sys_data;
+ 	struct ring_buffer_event *event;
++	struct ring_buffer *buffer;
+ 	int size;
+ 	int syscall_nr;
+ 
+ 	syscall_nr = syscall_get_nr(current, regs);
++	if (syscall_nr < 0)
++		return;
++	if (!test_bit(syscall_nr, enabled_enter_syscalls))
++		return;
+ 
+ 	sys_data = syscall_nr_to_meta(syscall_nr);
+ 	if (!sys_data)
+@@ -158,8 +239,8 @@
+ 
+ 	size = sizeof(*entry) + sizeof(unsigned long) * sys_data->nb_args;
+ 
+-	event = trace_current_buffer_lock_reserve(TRACE_SYSCALL_ENTER, size,
+-							0, 0);
++	event = trace_current_buffer_lock_reserve(&buffer, sys_data->enter_id,
++						  size, 0, 0);
+ 	if (!event)
+ 		return;
+ 
+@@ -167,24 +248,30 @@
+ 	entry->nr = syscall_nr;
+ 	syscall_get_arguments(current, regs, 0, sys_data->nb_args, entry->args);
+ 
+-	trace_current_buffer_unlock_commit(event, 0, 0);
+-	trace_wake_up();
++	if (!filter_current_check_discard(buffer, sys_data->enter_event,
++					  entry, event))
++		trace_current_buffer_unlock_commit(buffer, event, 0, 0);
+ }
+ 
+-void ftrace_syscall_exit(struct pt_regs *regs)
++void ftrace_syscall_exit(struct pt_regs *regs, long ret)
+ {
+ 	struct syscall_trace_exit *entry;
+ 	struct syscall_metadata *sys_data;
+ 	struct ring_buffer_event *event;
++	struct ring_buffer *buffer;
+ 	int syscall_nr;
+ 
+ 	syscall_nr = syscall_get_nr(current, regs);
++	if (syscall_nr < 0)
++		return;
++	if (!test_bit(syscall_nr, enabled_exit_syscalls))
++		return;
+ 
+ 	sys_data = syscall_nr_to_meta(syscall_nr);
+ 	if (!sys_data)
+ 		return;
+ 
+-	event = trace_current_buffer_lock_reserve(TRACE_SYSCALL_EXIT,
++	event = trace_current_buffer_lock_reserve(&buffer, sys_data->exit_id,
+ 				sizeof(*entry), 0, 0);
+ 	if (!event)
+ 		return;
+@@ -193,58 +280,244 @@
+ 	entry->nr = syscall_nr;
+ 	entry->ret = syscall_get_return_value(current, regs);
+ 
+-	trace_current_buffer_unlock_commit(event, 0, 0);
+-	trace_wake_up();
++	if (!filter_current_check_discard(buffer, sys_data->exit_event,
++					  entry, event))
++		trace_current_buffer_unlock_commit(buffer, event, 0, 0);
+ }
+ 
+-static int init_syscall_tracer(struct trace_array *tr)
++int reg_event_syscall_enter(void *ptr)
+ {
+-	start_ftrace_syscalls();
++	int ret = 0;
++	int num;
++	char *name;
++
++	name = (char *)ptr;
++	num = syscall_name_to_nr(name);
++	if (num < 0 || num >= NR_syscalls)
++		return -ENOSYS;
++	mutex_lock(&syscall_trace_lock);
++	if (!sys_refcount_enter)
++		ret = register_trace_sys_enter(ftrace_syscall_enter);
++	if (ret) {
++		pr_info("event trace: Could not activate"
++				"syscall entry trace point");
++	} else {
++		set_bit(num, enabled_enter_syscalls);
++		sys_refcount_enter++;
++	}
++	mutex_unlock(&syscall_trace_lock);
++	return ret;
++}
++
++void unreg_event_syscall_enter(void *ptr)
++{
++	int num;
++	char *name;
+ 
+-	return 0;
++	name = (char *)ptr;
++	num = syscall_name_to_nr(name);
++	if (num < 0 || num >= NR_syscalls)
++		return;
++	mutex_lock(&syscall_trace_lock);
++	sys_refcount_enter--;
++	clear_bit(num, enabled_enter_syscalls);
++	if (!sys_refcount_enter)
++		unregister_trace_sys_enter(ftrace_syscall_enter);
++	mutex_unlock(&syscall_trace_lock);
+ }
+ 
+-static void reset_syscall_tracer(struct trace_array *tr)
++int reg_event_syscall_exit(void *ptr)
+ {
+-	stop_ftrace_syscalls();
+-	tracing_reset_online_cpus(tr);
++	int ret = 0;
++	int num;
++	char *name;
++
++	name = (char *)ptr;
++	num = syscall_name_to_nr(name);
++	if (num < 0 || num >= NR_syscalls)
++		return -ENOSYS;
++	mutex_lock(&syscall_trace_lock);
++	if (!sys_refcount_exit)
++		ret = register_trace_sys_exit(ftrace_syscall_exit);
++	if (ret) {
++		pr_info("event trace: Could not activate"
++				"syscall exit trace point");
++	} else {
++		set_bit(num, enabled_exit_syscalls);
++		sys_refcount_exit++;
++	}
++	mutex_unlock(&syscall_trace_lock);
++	return ret;
+ }
+ 
+-static struct trace_event syscall_enter_event = {
+-	.type	 	= TRACE_SYSCALL_ENTER,
+-	.trace		= print_syscall_enter,
+-};
++void unreg_event_syscall_exit(void *ptr)
++{
++	int num;
++	char *name;
++
++	name = (char *)ptr;
++	num = syscall_name_to_nr(name);
++	if (num < 0 || num >= NR_syscalls)
++		return;
++	mutex_lock(&syscall_trace_lock);
++	sys_refcount_exit--;
++	clear_bit(num, enabled_exit_syscalls);
++	if (!sys_refcount_exit)
++		unregister_trace_sys_exit(ftrace_syscall_exit);
++	mutex_unlock(&syscall_trace_lock);
++}
+ 
+-static struct trace_event syscall_exit_event = {
+-	.type	 	= TRACE_SYSCALL_EXIT,
+-	.trace		= print_syscall_exit,
++struct trace_event event_syscall_enter = {
++	.trace			= print_syscall_enter,
+ };
+ 
+-static struct tracer syscall_tracer __read_mostly = {
+-	.name	     	= "syscall",
+-	.init		= init_syscall_tracer,
+-	.reset		= reset_syscall_tracer,
+-	.flags		= &syscalls_flags,
++struct trace_event event_syscall_exit = {
++	.trace			= print_syscall_exit,
+ };
+ 
+-__init int register_ftrace_syscalls(void)
++#ifdef CONFIG_EVENT_PROFILE
++
++static DECLARE_BITMAP(enabled_prof_enter_syscalls, NR_syscalls);
++static DECLARE_BITMAP(enabled_prof_exit_syscalls, NR_syscalls);
++static int sys_prof_refcount_enter;
++static int sys_prof_refcount_exit;
++
++static void prof_syscall_enter(struct pt_regs *regs, long id)
+ {
+-	int ret;
++	struct syscall_trace_enter *rec;
++	struct syscall_metadata *sys_data;
++	int syscall_nr;
++	int size;
+ 
+-	ret = register_ftrace_event(&syscall_enter_event);
+-	if (!ret) {
+-		printk(KERN_WARNING "event %d failed to register\n",
+-		       syscall_enter_event.type);
+-		WARN_ON_ONCE(1);
++	syscall_nr = syscall_get_nr(current, regs);
++	if (!test_bit(syscall_nr, enabled_prof_enter_syscalls))
++		return;
++
++	sys_data = syscall_nr_to_meta(syscall_nr);
++	if (!sys_data)
++		return;
++
++	/* get the size after alignment with the u32 buffer size field */
++	size = sizeof(unsigned long) * sys_data->nb_args + sizeof(*rec);
++	size = ALIGN(size + sizeof(u32), sizeof(u64));
++	size -= sizeof(u32);
++
++	do {
++		char raw_data[size];
++
++		/* zero the dead bytes from align to not leak stack to user */
++		*(u64 *)(&raw_data[size - sizeof(u64)]) = 0ULL;
++
++		rec = (struct syscall_trace_enter *) raw_data;
++		tracing_generic_entry_update(&rec->ent, 0, 0);
++		rec->ent.type = sys_data->enter_id;
++		rec->nr = syscall_nr;
++		syscall_get_arguments(current, regs, 0, sys_data->nb_args,
++				       (unsigned long *)&rec->args);
++		perf_tpcounter_event(sys_data->enter_id, 0, 1, rec, size);
++	} while(0);
++}
++
++int reg_prof_syscall_enter(char *name)
++{
++	int ret = 0;
++	int num;
++
++	num = syscall_name_to_nr(name);
++	if (num < 0 || num >= NR_syscalls)
++		return -ENOSYS;
++
++	mutex_lock(&syscall_trace_lock);
++	if (!sys_prof_refcount_enter)
++		ret = register_trace_sys_enter(prof_syscall_enter);
++	if (ret) {
++		pr_info("event trace: Could not activate"
++				"syscall entry trace point");
++	} else {
++		set_bit(num, enabled_prof_enter_syscalls);
++		sys_prof_refcount_enter++;
+ 	}
++	mutex_unlock(&syscall_trace_lock);
++	return ret;
++}
+ 
+-	ret = register_ftrace_event(&syscall_exit_event);
+-	if (!ret) {
+-		printk(KERN_WARNING "event %d failed to register\n",
+-		       syscall_exit_event.type);
+-		WARN_ON_ONCE(1);
++void unreg_prof_syscall_enter(char *name)
++{
++	int num;
++
++	num = syscall_name_to_nr(name);
++	if (num < 0 || num >= NR_syscalls)
++		return;
++
++	mutex_lock(&syscall_trace_lock);
++	sys_prof_refcount_enter--;
++	clear_bit(num, enabled_prof_enter_syscalls);
++	if (!sys_prof_refcount_enter)
++		unregister_trace_sys_enter(prof_syscall_enter);
++	mutex_unlock(&syscall_trace_lock);
++}
++
++static void prof_syscall_exit(struct pt_regs *regs, long ret)
++{
++	struct syscall_metadata *sys_data;
++	struct syscall_trace_exit rec;
++	int syscall_nr;
++
++	syscall_nr = syscall_get_nr(current, regs);
++	if (!test_bit(syscall_nr, enabled_prof_exit_syscalls))
++		return;
++
++	sys_data = syscall_nr_to_meta(syscall_nr);
++	if (!sys_data)
++		return;
++
++	tracing_generic_entry_update(&rec.ent, 0, 0);
++	rec.ent.type = sys_data->exit_id;
++	rec.nr = syscall_nr;
++	rec.ret = syscall_get_return_value(current, regs);
++
++	perf_tpcounter_event(sys_data->exit_id, 0, 1, &rec, sizeof(rec));
++}
++
++int reg_prof_syscall_exit(char *name)
++{
++	int ret = 0;
++	int num;
++
++	num = syscall_name_to_nr(name);
++	if (num < 0 || num >= NR_syscalls)
++		return -ENOSYS;
++
++	mutex_lock(&syscall_trace_lock);
++	if (!sys_prof_refcount_exit)
++		ret = register_trace_sys_exit(prof_syscall_exit);
++	if (ret) {
++		pr_info("event trace: Could not activate"
++				"syscall entry trace point");
++	} else {
++		set_bit(num, enabled_prof_exit_syscalls);
++		sys_prof_refcount_exit++;
+ 	}
++	mutex_unlock(&syscall_trace_lock);
++	return ret;
++}
+ 
+-	return register_tracer(&syscall_tracer);
++void unreg_prof_syscall_exit(char *name)
++{
++	int num;
++
++	num = syscall_name_to_nr(name);
++	if (num < 0 || num >= NR_syscalls)
++		return;
++
++	mutex_lock(&syscall_trace_lock);
++	sys_prof_refcount_exit--;
++	clear_bit(num, enabled_prof_exit_syscalls);
++	if (!sys_prof_refcount_exit)
++		unregister_trace_sys_exit(prof_syscall_exit);
++	mutex_unlock(&syscall_trace_lock);
+ }
+-device_initcall(register_ftrace_syscalls);
++
++#endif
++
++
+Index: linux-rt-2.6.31/kernel/trace/trace_workqueue.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/trace/trace_workqueue.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/trace/trace_workqueue.c	2010-05-17 14:23:20.128387716 +0200
+@@ -9,6 +9,7 @@
+ #include <trace/events/workqueue.h>
+ #include <linux/list.h>
+ #include <linux/percpu.h>
++#include <linux/kref.h>
+ #include "trace_stat.h"
+ #include "trace.h"
+ 
+@@ -16,6 +17,7 @@
+ /* A cpu workqueue thread */
+ struct cpu_workqueue_stats {
+ 	struct list_head            list;
++	struct kref                 kref;
+ 	int		            cpu;
+ 	pid_t			    pid;
+ /* Can be inserted from interrupt or user context, need to be atomic */
+@@ -39,6 +41,11 @@
+ static DEFINE_PER_CPU(struct workqueue_global_stats, all_workqueue_stat);
+ #define workqueue_cpu_stat(cpu) (&per_cpu(all_workqueue_stat, cpu))
+ 
++static void cpu_workqueue_stat_free(struct kref *kref)
++{
++	kfree(container_of(kref, struct cpu_workqueue_stats, kref));
++}
++
+ /* Insertion of a work */
+ static void
+ probe_workqueue_insertion(struct task_struct *wq_thread,
+@@ -96,8 +103,8 @@
+ 		return;
+ 	}
+ 	INIT_LIST_HEAD(&cws->list);
++	kref_init(&cws->kref);
+ 	cws->cpu = cpu;
+-
+ 	cws->pid = wq_thread->pid;
+ 
+ 	spin_lock_irqsave(&workqueue_cpu_stat(cpu)->lock, flags);
+@@ -118,7 +125,7 @@
+ 							list) {
+ 		if (node->pid == wq_thread->pid) {
+ 			list_del(&node->list);
+-			kfree(node);
++			kref_put(&node->kref, cpu_workqueue_stat_free);
+ 			goto found;
+ 		}
+ 	}
+@@ -137,9 +144,11 @@
+ 
+ 	spin_lock_irqsave(&workqueue_cpu_stat(cpu)->lock, flags);
+ 
+-	if (!list_empty(&workqueue_cpu_stat(cpu)->list))
++	if (!list_empty(&workqueue_cpu_stat(cpu)->list)) {
+ 		ret = list_entry(workqueue_cpu_stat(cpu)->list.next,
+ 				 struct cpu_workqueue_stats, list);
++		kref_get(&ret->kref);
++	}
+ 
+ 	spin_unlock_irqrestore(&workqueue_cpu_stat(cpu)->lock, flags);
+ 
+@@ -162,9 +171,9 @@
+ static void *workqueue_stat_next(void *prev, int idx)
+ {
+ 	struct cpu_workqueue_stats *prev_cws = prev;
++	struct cpu_workqueue_stats *ret;
+ 	int cpu = prev_cws->cpu;
+ 	unsigned long flags;
+-	void *ret = NULL;
+ 
+ 	spin_lock_irqsave(&workqueue_cpu_stat(cpu)->lock, flags);
+ 	if (list_is_last(&prev_cws->list, &workqueue_cpu_stat(cpu)->list)) {
+@@ -175,11 +184,14 @@
+ 				return NULL;
+ 		} while (!(ret = workqueue_stat_start_cpu(cpu)));
+ 		return ret;
++	} else {
++		ret = list_entry(prev_cws->list.next,
++				 struct cpu_workqueue_stats, list);
++		kref_get(&ret->kref);
+ 	}
+ 	spin_unlock_irqrestore(&workqueue_cpu_stat(cpu)->lock, flags);
+ 
+-	return list_entry(prev_cws->list.next, struct cpu_workqueue_stats,
+-			  list);
++	return ret;
+ }
+ 
+ static int workqueue_stat_show(struct seq_file *s, void *p)
+@@ -203,6 +215,13 @@
+ 	return 0;
+ }
+ 
++static void workqueue_stat_release(void *stat)
++{
++	struct cpu_workqueue_stats *node = stat;
++
++	kref_put(&node->kref, cpu_workqueue_stat_free);
++}
++
+ static int workqueue_stat_headers(struct seq_file *s)
+ {
+ 	seq_printf(s, "# CPU  INSERTED  EXECUTED   NAME\n");
+@@ -215,6 +234,7 @@
+ 	.stat_start = workqueue_stat_start,
+ 	.stat_next = workqueue_stat_next,
+ 	.stat_show = workqueue_stat_show,
++	.stat_release = workqueue_stat_release,
+ 	.stat_headers = workqueue_stat_headers
+ };
+ 
+Index: linux-rt-2.6.31/kernel/tracepoint.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/tracepoint.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/tracepoint.c	2010-05-17 14:23:20.128387716 +0200
+@@ -24,6 +24,7 @@
+ #include <linux/tracepoint.h>
+ #include <linux/err.h>
+ #include <linux/slab.h>
++#include <linux/sched.h>
+ 
+ extern struct tracepoint __start___tracepoints[];
+ extern struct tracepoint __stop___tracepoints[];
+@@ -242,6 +243,11 @@
+ {
+ 	WARN_ON(strcmp((*entry)->name, elem->name) != 0);
+ 
++	if (elem->regfunc && !elem->state && active)
++		elem->regfunc();
++	else if (elem->unregfunc && elem->state && !active)
++		elem->unregfunc();
++
+ 	/*
+ 	 * rcu_assign_pointer has a smp_wmb() which makes sure that the new
+ 	 * probe callbacks array is consistent before setting a pointer to it.
+@@ -261,6 +267,9 @@
+  */
+ static void disable_tracepoint(struct tracepoint *elem)
+ {
++	if (elem->unregfunc && elem->state)
++		elem->unregfunc();
++
+ 	elem->state = 0;
+ 	rcu_assign_pointer(elem->funcs, NULL);
+ }
+@@ -554,9 +563,6 @@
+ 
+ 	switch (val) {
+ 	case MODULE_STATE_COMING:
+-		tracepoint_update_probe_range(mod->tracepoints,
+-			mod->tracepoints + mod->num_tracepoints);
+-		break;
+ 	case MODULE_STATE_GOING:
+ 		tracepoint_update_probe_range(mod->tracepoints,
+ 			mod->tracepoints + mod->num_tracepoints);
+@@ -577,3 +583,41 @@
+ __initcall(init_tracepoints);
+ 
+ #endif /* CONFIG_MODULES */
++
++#ifdef CONFIG_HAVE_SYSCALL_TRACEPOINTS
++
++/* NB: reg/unreg are called while guarded with the tracepoints_mutex */
++static int sys_tracepoint_refcount;
++
++void syscall_regfunc(void)
++{
++	unsigned long flags;
++	struct task_struct *g, *t;
++
++	if (!sys_tracepoint_refcount) {
++		read_lock_irqsave(&tasklist_lock, flags);
++		do_each_thread(g, t) {
++			/* Skip kernel threads. */
++			if (t->mm)
++				set_tsk_thread_flag(t, TIF_SYSCALL_TRACEPOINT);
++		} while_each_thread(g, t);
++		read_unlock_irqrestore(&tasklist_lock, flags);
++	}
++	sys_tracepoint_refcount++;
++}
++
++void syscall_unregfunc(void)
++{
++	unsigned long flags;
++	struct task_struct *g, *t;
++
++	sys_tracepoint_refcount--;
++	if (!sys_tracepoint_refcount) {
++		read_lock_irqsave(&tasklist_lock, flags);
++		do_each_thread(g, t) {
++			clear_tsk_thread_flag(t, TIF_SYSCALL_TRACEPOINT);
++		} while_each_thread(g, t);
++		read_unlock_irqrestore(&tasklist_lock, flags);
++	}
++}
++#endif
+Index: linux-rt-2.6.31/kernel/user.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/user.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/kernel/user.c	2010-05-17 14:23:20.128387716 +0200
+@@ -416,11 +416,11 @@
+ 	if (!up)
+ 		return;
+ 
+-	local_irq_save(flags);
++	local_irq_save_nort(flags);
+ 	if (atomic_dec_and_lock(&up->__count, &uidhash_lock))
+ 		free_user(up, flags);
+ 	else
+-		local_irq_restore(flags);
++		local_irq_restore_nort(flags);
+ }
+ 
+ struct user_struct *alloc_uid(struct user_namespace *ns, uid_t uid)
+Index: linux-rt-2.6.31/kernel/workqueue.c
+===================================================================
+--- linux-rt-2.6.31.orig/kernel/workqueue.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/kernel/workqueue.c	2010-05-17 14:23:20.128387716 +0200
+@@ -26,6 +26,7 @@
+ #include <linux/slab.h>
+ #include <linux/cpu.h>
+ #include <linux/notifier.h>
++#include <linux/syscalls.h>
+ #include <linux/kthread.h>
+ #include <linux/hardirq.h>
+ #include <linux/mempolicy.h>
+@@ -36,6 +37,8 @@
+ #define CREATE_TRACE_POINTS
+ #include <trace/events/workqueue.h>
+ 
++#include <asm/uaccess.h>
++
+ /*
+  * The per-CPU workqueue (if single thread, we always use the first
+  * possible cpu).
+@@ -159,13 +162,14 @@
+  *
+  * We queue the work to the CPU on which it was submitted, but if the CPU dies
+  * it can be processed by another CPU.
++ *
++ * Especially no such guarantee on PREEMPT_RT.
+  */
+ int queue_work(struct workqueue_struct *wq, struct work_struct *work)
+ {
+-	int ret;
++	int ret = 0, cpu = raw_smp_processor_id();
+ 
+-	ret = queue_work_on(get_cpu(), wq, work);
+-	put_cpu();
++	ret = queue_work_on(cpu, wq, work);
+ 
+ 	return ret;
+ }
+@@ -202,7 +206,7 @@
+ 	struct cpu_workqueue_struct *cwq = get_wq_data(&dwork->work);
+ 	struct workqueue_struct *wq = cwq->wq;
+ 
+-	__queue_work(wq_per_cpu(wq, smp_processor_id()), &dwork->work);
++	__queue_work(wq_per_cpu(wq, raw_smp_processor_id()), &dwork->work);
+ }
+ 
+ /**
+@@ -883,6 +887,49 @@
+ 	cwq->thread = NULL;
+ }
+ 
++void set_workqueue_thread_prio(struct workqueue_struct *wq, int cpu,
++			       int policy, int rt_priority, int nice)
++{
++	struct sched_param param = { .sched_priority = rt_priority };
++	struct cpu_workqueue_struct *cwq;
++	mm_segment_t oldfs = get_fs();
++	struct task_struct *p;
++	unsigned long flags;
++	int ret;
++
++	cwq = per_cpu_ptr(wq->cpu_wq, cpu);
++	spin_lock_irqsave(&cwq->lock, flags);
++	p = cwq->thread;
++	spin_unlock_irqrestore(&cwq->lock, flags);
++
++	set_user_nice(p, nice);
++
++	set_fs(KERNEL_DS);
++	ret = sys_sched_setscheduler(p->pid, policy, &param);
++	set_fs(oldfs);
++
++	WARN_ON(ret);
++}
++
++void set_workqueue_prio(struct workqueue_struct *wq, int policy,
++			int rt_priority, int nice)
++{
++	int cpu;
++
++	/* We don't need the distraction of CPUs appearing and vanishing. */
++	get_online_cpus();
++	spin_lock(&workqueue_lock);
++	if (is_wq_single_threaded(wq))
++		set_workqueue_thread_prio(wq, 0, policy, rt_priority, nice);
++	else {
++		for_each_online_cpu(cpu)
++			set_workqueue_thread_prio(wq, cpu, policy,
++						  rt_priority, nice);
++	}
++	spin_unlock(&workqueue_lock);
++	put_online_cpus();
++}
++
+ /**
+  * destroy_workqueue - safely terminate a workqueue
+  * @wq: target workqueue
+@@ -1015,4 +1062,5 @@
+ 	hotcpu_notifier(workqueue_cpu_callback, 0);
+ 	keventd_wq = create_workqueue("events");
+ 	BUG_ON(!keventd_wq);
++	set_workqueue_prio(keventd_wq, SCHED_FIFO, 1, -20);
+ }
+Index: linux-rt-2.6.31/lib/Kconfig
+===================================================================
+--- linux-rt-2.6.31.orig/lib/Kconfig	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/lib/Kconfig	2010-05-17 14:23:20.128387716 +0200
+@@ -179,6 +179,7 @@
+ 
+ config CPUMASK_OFFSTACK
+ 	bool "Force CPU masks off stack" if DEBUG_PER_CPU_MAPS
++	depends on !PREEMPT_RT && BROKEN
+ 	help
+ 	  Use dynamic allocation for cpumask_var_t, instead of putting
+ 	  them on the stack.  This is a bit more expensive, but avoids
+Index: linux-rt-2.6.31/lib/Kconfig.debug
+===================================================================
+--- linux-rt-2.6.31.orig/lib/Kconfig.debug	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/lib/Kconfig.debug	2010-05-17 14:23:20.128387716 +0200
+@@ -397,6 +397,8 @@
+ 	help
+ 	 This allows rt mutex semantics violations and rt mutex related
+ 	 deadlocks (lockups) to be detected and reported automatically.
++	 When realtime preemption is enabled this includes spinlocks,
++	 rwlocks, mutexes and (rw)semaphores
+ 
+ config DEBUG_PI_LIST
+ 	bool
+@@ -420,7 +422,7 @@
+ 
+ config DEBUG_MUTEXES
+ 	bool "Mutex debugging: basic checks"
+-	depends on DEBUG_KERNEL
++	depends on DEBUG_KERNEL && !PREEMPT_RT
+ 	help
+ 	 This feature allows mutex semantics violations to be detected and
+ 	 reported.
+Index: linux-rt-2.6.31/lib/Makefile
+===================================================================
+--- linux-rt-2.6.31.orig/lib/Makefile	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/lib/Makefile	2010-05-17 14:23:20.128387716 +0200
+@@ -34,7 +34,8 @@
+ obj-$(CONFIG_CHECK_SIGNATURE) += check_signature.o
+ obj-$(CONFIG_DEBUG_LOCKING_API_SELFTESTS) += locking-selftest.o
+ obj-$(CONFIG_DEBUG_SPINLOCK) += spinlock_debug.o
+-lib-$(CONFIG_RWSEM_GENERIC_SPINLOCK) += rwsem-spinlock.o
++obj-$(CONFIG_PREEMPT_RT) += plist.o
++obj-$(CONFIG_RWSEM_GENERIC_SPINLOCK) += rwsem-spinlock.o
+ lib-$(CONFIG_RWSEM_XCHGADD_ALGORITHM) += rwsem.o
+ lib-$(CONFIG_GENERIC_FIND_FIRST_BIT) += find_next_bit.o
+ lib-$(CONFIG_GENERIC_FIND_NEXT_BIT) += find_next_bit.o
+Index: linux-rt-2.6.31/lib/debugobjects.c
+===================================================================
+--- linux-rt-2.6.31.orig/lib/debugobjects.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/lib/debugobjects.c	2010-05-17 14:23:20.128387716 +0200
+@@ -25,14 +25,14 @@
+ 
+ struct debug_bucket {
+ 	struct hlist_head	list;
+-	spinlock_t		lock;
++	atomic_spinlock_t	lock;
+ };
+ 
+ static struct debug_bucket	obj_hash[ODEBUG_HASH_SIZE];
+ 
+ static struct debug_obj		obj_static_pool[ODEBUG_POOL_SIZE] __initdata;
+ 
+-static DEFINE_SPINLOCK(pool_lock);
++static DEFINE_ATOMIC_SPINLOCK(pool_lock);
+ 
+ static HLIST_HEAD(obj_pool);
+ 
+@@ -95,10 +95,10 @@
+ 		if (!new)
+ 			return obj_pool_free;
+ 
+-		spin_lock_irqsave(&pool_lock, flags);
++		atomic_spin_lock_irqsave(&pool_lock, flags);
+ 		hlist_add_head(&new->node, &obj_pool);
+ 		obj_pool_free++;
+-		spin_unlock_irqrestore(&pool_lock, flags);
++		atomic_spin_unlock_irqrestore(&pool_lock, flags);
+ 	}
+ 	return obj_pool_free;
+ }
+@@ -132,7 +132,7 @@
+ {
+ 	struct debug_obj *obj = NULL;
+ 
+-	spin_lock(&pool_lock);
++	atomic_spin_lock(&pool_lock);
+ 	if (obj_pool.first) {
+ 		obj	    = hlist_entry(obj_pool.first, typeof(*obj), node);
+ 
+@@ -151,7 +151,7 @@
+ 		if (obj_pool_free < obj_pool_min_free)
+ 			obj_pool_min_free = obj_pool_free;
+ 	}
+-	spin_unlock(&pool_lock);
++	atomic_spin_unlock(&pool_lock);
+ 
+ 	return obj;
+ }
+@@ -164,7 +164,7 @@
+ 	struct debug_obj *obj;
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&pool_lock, flags);
++	atomic_spin_lock_irqsave(&pool_lock, flags);
+ 	while (obj_pool_free > ODEBUG_POOL_SIZE) {
+ 		obj = hlist_entry(obj_pool.first, typeof(*obj), node);
+ 		hlist_del(&obj->node);
+@@ -173,11 +173,11 @@
+ 		 * We release pool_lock across kmem_cache_free() to
+ 		 * avoid contention on pool_lock.
+ 		 */
+-		spin_unlock_irqrestore(&pool_lock, flags);
++		atomic_spin_unlock_irqrestore(&pool_lock, flags);
+ 		kmem_cache_free(obj_cache, obj);
+-		spin_lock_irqsave(&pool_lock, flags);
++		atomic_spin_lock_irqsave(&pool_lock, flags);
+ 	}
+-	spin_unlock_irqrestore(&pool_lock, flags);
++	atomic_spin_unlock_irqrestore(&pool_lock, flags);
+ }
+ 
+ /*
+@@ -189,7 +189,7 @@
+ 	unsigned long flags;
+ 	int sched = 0;
+ 
+-	spin_lock_irqsave(&pool_lock, flags);
++	atomic_spin_lock_irqsave(&pool_lock, flags);
+ 	/*
+ 	 * schedule work when the pool is filled and the cache is
+ 	 * initialized:
+@@ -199,7 +199,7 @@
+ 	hlist_add_head(&obj->node, &obj_pool);
+ 	obj_pool_free++;
+ 	obj_pool_used--;
+-	spin_unlock_irqrestore(&pool_lock, flags);
++	atomic_spin_unlock_irqrestore(&pool_lock, flags);
+ 	if (sched)
+ 		schedule_work(&debug_obj_work);
+ }
+@@ -220,9 +220,9 @@
+ 	printk(KERN_WARNING "ODEBUG: Out of memory. ODEBUG disabled\n");
+ 
+ 	for (i = 0; i < ODEBUG_HASH_SIZE; i++, db++) {
+-		spin_lock_irqsave(&db->lock, flags);
++		atomic_spin_lock_irqsave(&db->lock, flags);
+ 		hlist_move_list(&db->list, &freelist);
+-		spin_unlock_irqrestore(&db->lock, flags);
++		atomic_spin_unlock_irqrestore(&db->lock, flags);
+ 
+ 		/* Now free them */
+ 		hlist_for_each_entry_safe(obj, node, tmp, &freelist, node) {
+@@ -302,14 +302,14 @@
+ 
+ 	db = get_bucket((unsigned long) addr);
+ 
+-	spin_lock_irqsave(&db->lock, flags);
++	atomic_spin_lock_irqsave(&db->lock, flags);
+ 
+ 	obj = lookup_object(addr, db);
+ 	if (!obj) {
+ 		obj = alloc_object(addr, db, descr);
+ 		if (!obj) {
+ 			debug_objects_enabled = 0;
+-			spin_unlock_irqrestore(&db->lock, flags);
++			atomic_spin_unlock_irqrestore(&db->lock, flags);
+ 			debug_objects_oom();
+ 			return;
+ 		}
+@@ -326,7 +326,7 @@
+ 	case ODEBUG_STATE_ACTIVE:
+ 		debug_print_object(obj, "init");
+ 		state = obj->state;
+-		spin_unlock_irqrestore(&db->lock, flags);
++		atomic_spin_unlock_irqrestore(&db->lock, flags);
+ 		debug_object_fixup(descr->fixup_init, addr, state);
+ 		return;
+ 
+@@ -337,7 +337,7 @@
+ 		break;
+ 	}
+ 
+-	spin_unlock_irqrestore(&db->lock, flags);
++	atomic_spin_unlock_irqrestore(&db->lock, flags);
+ }
+ 
+ /**
+@@ -384,7 +384,7 @@
+ 
+ 	db = get_bucket((unsigned long) addr);
+ 
+-	spin_lock_irqsave(&db->lock, flags);
++	atomic_spin_lock_irqsave(&db->lock, flags);
+ 
+ 	obj = lookup_object(addr, db);
+ 	if (obj) {
+@@ -397,7 +397,7 @@
+ 		case ODEBUG_STATE_ACTIVE:
+ 			debug_print_object(obj, "activate");
+ 			state = obj->state;
+-			spin_unlock_irqrestore(&db->lock, flags);
++			atomic_spin_unlock_irqrestore(&db->lock, flags);
+ 			debug_object_fixup(descr->fixup_activate, addr, state);
+ 			return;
+ 
+@@ -407,11 +407,11 @@
+ 		default:
+ 			break;
+ 		}
+-		spin_unlock_irqrestore(&db->lock, flags);
++		atomic_spin_unlock_irqrestore(&db->lock, flags);
+ 		return;
+ 	}
+ 
+-	spin_unlock_irqrestore(&db->lock, flags);
++	atomic_spin_unlock_irqrestore(&db->lock, flags);
+ 	/*
+ 	 * This happens when a static object is activated. We
+ 	 * let the type specific code decide whether this is
+@@ -437,7 +437,7 @@
+ 
+ 	db = get_bucket((unsigned long) addr);
+ 
+-	spin_lock_irqsave(&db->lock, flags);
++	atomic_spin_lock_irqsave(&db->lock, flags);
+ 
+ 	obj = lookup_object(addr, db);
+ 	if (obj) {
+@@ -462,7 +462,7 @@
+ 		debug_print_object(&o, "deactivate");
+ 	}
+ 
+-	spin_unlock_irqrestore(&db->lock, flags);
++	atomic_spin_unlock_irqrestore(&db->lock, flags);
+ }
+ 
+ /**
+@@ -482,7 +482,7 @@
+ 
+ 	db = get_bucket((unsigned long) addr);
+ 
+-	spin_lock_irqsave(&db->lock, flags);
++	atomic_spin_lock_irqsave(&db->lock, flags);
+ 
+ 	obj = lookup_object(addr, db);
+ 	if (!obj)
+@@ -497,7 +497,7 @@
+ 	case ODEBUG_STATE_ACTIVE:
+ 		debug_print_object(obj, "destroy");
+ 		state = obj->state;
+-		spin_unlock_irqrestore(&db->lock, flags);
++		atomic_spin_unlock_irqrestore(&db->lock, flags);
+ 		debug_object_fixup(descr->fixup_destroy, addr, state);
+ 		return;
+ 
+@@ -508,7 +508,7 @@
+ 		break;
+ 	}
+ out_unlock:
+-	spin_unlock_irqrestore(&db->lock, flags);
++	atomic_spin_unlock_irqrestore(&db->lock, flags);
+ }
+ 
+ /**
+@@ -528,7 +528,7 @@
+ 
+ 	db = get_bucket((unsigned long) addr);
+ 
+-	spin_lock_irqsave(&db->lock, flags);
++	atomic_spin_lock_irqsave(&db->lock, flags);
+ 
+ 	obj = lookup_object(addr, db);
+ 	if (!obj)
+@@ -538,17 +538,17 @@
+ 	case ODEBUG_STATE_ACTIVE:
+ 		debug_print_object(obj, "free");
+ 		state = obj->state;
+-		spin_unlock_irqrestore(&db->lock, flags);
++		atomic_spin_unlock_irqrestore(&db->lock, flags);
+ 		debug_object_fixup(descr->fixup_free, addr, state);
+ 		return;
+ 	default:
+ 		hlist_del(&obj->node);
+-		spin_unlock_irqrestore(&db->lock, flags);
++		atomic_spin_unlock_irqrestore(&db->lock, flags);
+ 		free_object(obj);
+ 		return;
+ 	}
+ out_unlock:
+-	spin_unlock_irqrestore(&db->lock, flags);
++	atomic_spin_unlock_irqrestore(&db->lock, flags);
+ }
+ 
+ #ifdef CONFIG_DEBUG_OBJECTS_FREE
+@@ -574,7 +574,7 @@
+ 
+ repeat:
+ 		cnt = 0;
+-		spin_lock_irqsave(&db->lock, flags);
++		atomic_spin_lock_irqsave(&db->lock, flags);
+ 		hlist_for_each_entry_safe(obj, node, tmp, &db->list, node) {
+ 			cnt++;
+ 			oaddr = (unsigned long) obj->object;
+@@ -586,7 +586,7 @@
+ 				debug_print_object(obj, "free");
+ 				descr = obj->descr;
+ 				state = obj->state;
+-				spin_unlock_irqrestore(&db->lock, flags);
++				atomic_spin_unlock_irqrestore(&db->lock, flags);
+ 				debug_object_fixup(descr->fixup_free,
+ 						   (void *) oaddr, state);
+ 				goto repeat;
+@@ -596,7 +596,7 @@
+ 				break;
+ 			}
+ 		}
+-		spin_unlock_irqrestore(&db->lock, flags);
++		atomic_spin_unlock_irqrestore(&db->lock, flags);
+ 
+ 		/* Now free them */
+ 		hlist_for_each_entry_safe(obj, node, tmp, &freelist, node) {
+@@ -782,7 +782,7 @@
+ 
+ 	db = get_bucket((unsigned long) addr);
+ 
+-	spin_lock_irqsave(&db->lock, flags);
++	atomic_spin_lock_irqsave(&db->lock, flags);
+ 
+ 	obj = lookup_object(addr, db);
+ 	if (!obj && state != ODEBUG_STATE_NONE) {
+@@ -806,7 +806,7 @@
+ 	}
+ 	res = 0;
+ out:
+-	spin_unlock_irqrestore(&db->lock, flags);
++	atomic_spin_unlock_irqrestore(&db->lock, flags);
+ 	if (res)
+ 		debug_objects_enabled = 0;
+ 	return res;
+@@ -906,7 +906,7 @@
+ 	int i;
+ 
+ 	for (i = 0; i < ODEBUG_HASH_SIZE; i++)
+-		spin_lock_init(&obj_hash[i].lock);
++		atomic_spin_lock_init(&obj_hash[i].lock);
+ 
+ 	for (i = 0; i < ODEBUG_POOL_SIZE; i++)
+ 		hlist_add_head(&obj_static_pool[i].node, &obj_pool);
+Index: linux-rt-2.6.31/lib/dec_and_lock.c
+===================================================================
+--- linux-rt-2.6.31.orig/lib/dec_and_lock.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/lib/dec_and_lock.c	2010-05-17 14:23:20.128387716 +0200
+@@ -17,18 +17,18 @@
+  * because the spin-lock and the decrement must be
+  * "atomic".
+  */
+-int _atomic_dec_and_lock(atomic_t *atomic, spinlock_t *lock)
++int _atomic_dec_and_atomic_lock(atomic_t *atomic, atomic_spinlock_t *lock)
+ {
+ 	/* Subtract 1 from counter unless that drops it to 0 (ie. it was 1) */
+ 	if (atomic_add_unless(atomic, -1, 1))
+ 		return 0;
+ 
+ 	/* Otherwise do it the slow way */
+-	spin_lock(lock);
++	atomic_spin_lock(lock);
+ 	if (atomic_dec_and_test(atomic))
+ 		return 1;
+-	spin_unlock(lock);
++	atomic_spin_unlock(lock);
+ 	return 0;
+ }
+ 
+-EXPORT_SYMBOL(_atomic_dec_and_lock);
++EXPORT_SYMBOL(_atomic_dec_and_atomic_lock);
+Index: linux-rt-2.6.31/lib/kernel_lock.c
+===================================================================
+--- linux-rt-2.6.31.orig/lib/kernel_lock.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/lib/kernel_lock.c	2010-05-17 14:23:20.128387716 +0200
+@@ -11,121 +11,89 @@
+ #include <linux/semaphore.h>
+ 
+ /*
+- * The 'big kernel lock'
++ * The 'big kernel semaphore'
+  *
+- * This spinlock is taken and released recursively by lock_kernel()
++ * This mutex is taken and released recursively by lock_kernel()
+  * and unlock_kernel().  It is transparently dropped and reacquired
+  * over schedule().  It is used to protect legacy code that hasn't
+  * been migrated to a proper locking design yet.
+  *
++ * Note: code locked by this semaphore will only be serialized against
++ * other code using the same locking facility. The code guarantees that
++ * the task remains on the same CPU.
++ *
+  * Don't use in new code.
+  */
+-static  __cacheline_aligned_in_smp DEFINE_SPINLOCK(kernel_flag);
+-
++DEFINE_SEMAPHORE(kernel_sem);
+ 
+ /*
+- * Acquire/release the underlying lock from the scheduler.
++ * Re-acquire the kernel semaphore.
+  *
+- * This is called with preemption disabled, and should
+- * return an error value if it cannot get the lock and
+- * TIF_NEED_RESCHED gets set.
++ * This function is called with preemption off.
+  *
+- * If it successfully gets the lock, it should increment
+- * the preemption count like any spinlock does.
++ * We are executing in schedule() so the code must be extremely careful
++ * about recursion, both due to the down() and due to the enabling of
++ * preemption. schedule() will re-check the preemption flag after
++ * reacquiring the semaphore.
+  *
+- * (This works on UP too - _raw_spin_trylock will never
+- * return false in that case)
++ * Called with interrupts disabled.
+  */
+ int __lockfunc __reacquire_kernel_lock(void)
+ {
+-	while (!_raw_spin_trylock(&kernel_flag)) {
+-		if (need_resched())
+-			return -EAGAIN;
+-		cpu_relax();
+-	}
+-	preempt_disable();
++	struct task_struct *task = current;
++	int saved_lock_depth = task->lock_depth;
++
++	BUG_ON(saved_lock_depth < 0);
++
++	task->lock_depth = -1;
++	local_irq_enable();
++
++	down(&kernel_sem);
++
++	local_irq_disable();
++	task->lock_depth = saved_lock_depth;
++
+ 	return 0;
+ }
+ 
+ void __lockfunc __release_kernel_lock(void)
+ {
+-	_raw_spin_unlock(&kernel_flag);
+-	preempt_enable_no_resched();
++	up(&kernel_sem);
+ }
+ 
+ /*
+- * These are the BKL spinlocks - we try to be polite about preemption.
+- * If SMP is not on (ie UP preemption), this all goes away because the
+- * _raw_spin_trylock() will always succeed.
++ * Getting the big kernel semaphore.
+  */
+-#ifdef CONFIG_PREEMPT
+-static inline void __lock_kernel(void)
++void __lockfunc lock_kernel(void)
+ {
+-	preempt_disable();
+-	if (unlikely(!_raw_spin_trylock(&kernel_flag))) {
+-		/*
+-		 * If preemption was disabled even before this
+-		 * was called, there's nothing we can be polite
+-		 * about - just spin.
+-		 */
+-		if (preempt_count() > 1) {
+-			_raw_spin_lock(&kernel_flag);
+-			return;
+-		}
++	struct task_struct *task = current;
++	int depth = task->lock_depth + 1;
+ 
++	if (likely(!depth)) {
+ 		/*
+-		 * Otherwise, let's wait for the kernel lock
+-		 * with preemption enabled..
++		 * No recursion worries - we set up lock_depth _after_
+ 		 */
+-		do {
+-			preempt_enable();
+-			while (spin_is_locked(&kernel_flag))
+-				cpu_relax();
+-			preempt_disable();
+-		} while (!_raw_spin_trylock(&kernel_flag));
++		down(&kernel_sem);
++#ifdef CONFIG_DEBUG_RT_MUTEXES
++		current->last_kernel_lock = __builtin_return_address(0);
++#endif
+ 	}
+-}
+-
+-#else
+ 
+-/*
+- * Non-preemption case - just get the spinlock
+- */
+-static inline void __lock_kernel(void)
+-{
+-	_raw_spin_lock(&kernel_flag);
++	task->lock_depth = depth;
+ }
+-#endif
+ 
+-static inline void __unlock_kernel(void)
++void __lockfunc unlock_kernel(void)
+ {
+-	/*
+-	 * the BKL is not covered by lockdep, so we open-code the
+-	 * unlocking sequence (and thus avoid the dep-chain ops):
+-	 */
+-	_raw_spin_unlock(&kernel_flag);
+-	preempt_enable();
+-}
++	struct task_struct *task = current;
+ 
+-/*
+- * Getting the big kernel lock.
+- *
+- * This cannot happen asynchronously, so we only need to
+- * worry about other CPU's.
+- */
+-void __lockfunc lock_kernel(void)
+-{
+-	int depth = current->lock_depth+1;
+-	if (likely(!depth))
+-		__lock_kernel();
+-	current->lock_depth = depth;
+-}
++	BUG_ON(task->lock_depth < 0);
+ 
+-void __lockfunc unlock_kernel(void)
+-{
+-	BUG_ON(current->lock_depth < 0);
+-	if (likely(--current->lock_depth < 0))
+-		__unlock_kernel();
++	if (likely(--task->lock_depth < 0)) {
++#ifdef CONFIG_DEBUG_RT_MUTEXES
++		current->last_kernel_lock = NULL;
++#endif
++		up(&kernel_sem);
++	}
+ }
+ 
+ EXPORT_SYMBOL(lock_kernel);
+Index: linux-rt-2.6.31/lib/locking-selftest.c
+===================================================================
+--- linux-rt-2.6.31.orig/lib/locking-selftest.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/lib/locking-selftest.c	2010-05-17 14:23:20.128387716 +0200
+@@ -158,7 +158,7 @@
+ 		local_bh_disable();		\
+ 		local_irq_disable();		\
+ 		lockdep_softirq_enter();	\
+-		WARN_ON(!in_softirq());
++		/* FIXME: preemptible softirqs. WARN_ON(!in_softirq()); */
+ 
+ #define SOFTIRQ_EXIT()				\
+ 		lockdep_softirq_exit();		\
+@@ -550,6 +550,11 @@
+ #undef E
+ 
+ /*
++ * FIXME: turns these into raw-spinlock tests on -rt
++ */
++#ifndef CONFIG_PREEMPT_RT
++
++/*
+  * locking an irq-safe lock with irqs enabled:
+  */
+ #define E1()				\
+@@ -890,6 +895,8 @@
+ #include "locking-selftest-softirq.h"
+ // GENERATE_PERMUTATIONS_3_EVENTS(irq_read_recursion2_soft)
+ 
++#endif /* !CONFIG_PREEMPT_RT */
++
+ #ifdef CONFIG_DEBUG_LOCK_ALLOC
+ # define I_SPINLOCK(x)	lockdep_reset_lock(&lock_##x.dep_map)
+ # define I_RWLOCK(x)	lockdep_reset_lock(&rwlock_##x.dep_map)
+@@ -998,7 +1005,7 @@
+ 
+ #define DO_TESTCASE_1(desc, name, nr)				\
+ 	print_testname(desc"/"#nr);				\
+-	dotest(name##_##nr, SUCCESS, LOCKTYPE_RWLOCK);		\
++	dotest(name##_##nr, SUCCESS, LOCKTYPE_RWLOCK);	\
+ 	printk("\n");
+ 
+ #define DO_TESTCASE_1B(desc, name, nr)				\
+@@ -1006,17 +1013,17 @@
+ 	dotest(name##_##nr, FAILURE, LOCKTYPE_RWLOCK);		\
+ 	printk("\n");
+ 
+-#define DO_TESTCASE_3(desc, name, nr)				\
+-	print_testname(desc"/"#nr);				\
+-	dotest(name##_spin_##nr, FAILURE, LOCKTYPE_SPIN);	\
+-	dotest(name##_wlock_##nr, FAILURE, LOCKTYPE_RWLOCK);	\
++#define DO_TESTCASE_3(desc, name, nr)					\
++	print_testname(desc"/"#nr);					\
++	dotest(name##_spin_##nr, FAILURE, LOCKTYPE_SPIN);		\
++	dotest(name##_wlock_##nr, FAILURE, LOCKTYPE_RWLOCK);		\
+ 	dotest(name##_rlock_##nr, SUCCESS, LOCKTYPE_RWLOCK);	\
+ 	printk("\n");
+ 
+-#define DO_TESTCASE_3RW(desc, name, nr)				\
+-	print_testname(desc"/"#nr);				\
++#define DO_TESTCASE_3RW(desc, name, nr)					\
++	print_testname(desc"/"#nr);					\
+ 	dotest(name##_spin_##nr, FAILURE, LOCKTYPE_SPIN|LOCKTYPE_RWLOCK);\
+-	dotest(name##_wlock_##nr, FAILURE, LOCKTYPE_RWLOCK);	\
++	dotest(name##_wlock_##nr, FAILURE, LOCKTYPE_RWLOCK);		\
+ 	dotest(name##_rlock_##nr, SUCCESS, LOCKTYPE_RWLOCK);	\
+ 	printk("\n");
+ 
+@@ -1047,7 +1054,7 @@
+ 	print_testname(desc);					\
+ 	dotest(name##_spin, FAILURE, LOCKTYPE_SPIN);		\
+ 	dotest(name##_wlock, FAILURE, LOCKTYPE_RWLOCK);		\
+-	dotest(name##_rlock, SUCCESS, LOCKTYPE_RWLOCK);		\
++	dotest(name##_rlock, SUCCESS, LOCKTYPE_RWLOCK);	\
+ 	dotest(name##_mutex, FAILURE, LOCKTYPE_MUTEX);		\
+ 	dotest(name##_wsem, FAILURE, LOCKTYPE_RWSEM);		\
+ 	dotest(name##_rsem, FAILURE, LOCKTYPE_RWSEM);		\
+@@ -1179,6 +1186,7 @@
+ 	/*
+ 	 * irq-context testcases:
+ 	 */
++#ifndef CONFIG_PREEMPT_RT
+ 	DO_TESTCASE_2x6("irqs-on + irq-safe-A", irqsafe1);
+ 	DO_TESTCASE_2x3("sirq-safe-A => hirqs-on", irqsafe2A);
+ 	DO_TESTCASE_2x6("safe-A + irqs-on", irqsafe2B);
+@@ -1188,6 +1196,7 @@
+ 
+ 	DO_TESTCASE_6x2("irq read-recursion", irq_read_recursion);
+ //	DO_TESTCASE_6x2B("irq read-recursion #2", irq_read_recursion2);
++#endif
+ 
+ 	if (unexpected_testcase_failures) {
+ 		printk("-----------------------------------------------------------------\n");
+Index: linux-rt-2.6.31/lib/percpu_counter.c
+===================================================================
+--- linux-rt-2.6.31.orig/lib/percpu_counter.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/lib/percpu_counter.c	2010-05-17 14:23:20.128387716 +0200
+@@ -16,13 +16,13 @@
+ {
+ 	int cpu;
+ 
+-	spin_lock(&fbc->lock);
++	atomic_spin_lock(&fbc->lock);
+ 	for_each_possible_cpu(cpu) {
+ 		s32 *pcount = per_cpu_ptr(fbc->counters, cpu);
+ 		*pcount = 0;
+ 	}
+ 	fbc->count = amount;
+-	spin_unlock(&fbc->lock);
++	atomic_spin_unlock(&fbc->lock);
+ }
+ EXPORT_SYMBOL(percpu_counter_set);
+ 
+@@ -35,10 +35,10 @@
+ 	pcount = per_cpu_ptr(fbc->counters, cpu);
+ 	count = *pcount + amount;
+ 	if (count >= batch || count <= -batch) {
+-		spin_lock(&fbc->lock);
++		atomic_spin_lock(&fbc->lock);
+ 		fbc->count += count;
+ 		*pcount = 0;
+-		spin_unlock(&fbc->lock);
++		atomic_spin_unlock(&fbc->lock);
+ 	} else {
+ 		*pcount = count;
+ 	}
+@@ -55,13 +55,13 @@
+ 	s64 ret;
+ 	int cpu;
+ 
+-	spin_lock(&fbc->lock);
++	atomic_spin_lock(&fbc->lock);
+ 	ret = fbc->count;
+ 	for_each_online_cpu(cpu) {
+ 		s32 *pcount = per_cpu_ptr(fbc->counters, cpu);
+ 		ret += *pcount;
+ 	}
+-	spin_unlock(&fbc->lock);
++	atomic_spin_unlock(&fbc->lock);
+ 	return ret;
+ }
+ EXPORT_SYMBOL(__percpu_counter_sum);
+@@ -69,7 +69,7 @@
+ int __percpu_counter_init(struct percpu_counter *fbc, s64 amount,
+ 			  struct lock_class_key *key)
+ {
+-	spin_lock_init(&fbc->lock);
++	atomic_spin_lock_init(&fbc->lock);
+ 	lockdep_set_class(&fbc->lock, key);
+ 	fbc->count = amount;
+ 	fbc->counters = alloc_percpu(s32);
+@@ -126,11 +126,11 @@
+ 		s32 *pcount;
+ 		unsigned long flags;
+ 
+-		spin_lock_irqsave(&fbc->lock, flags);
++		atomic_spin_lock_irqsave(&fbc->lock, flags);
+ 		pcount = per_cpu_ptr(fbc->counters, cpu);
+ 		fbc->count += *pcount;
+ 		*pcount = 0;
+-		spin_unlock_irqrestore(&fbc->lock, flags);
++		atomic_spin_unlock_irqrestore(&fbc->lock, flags);
+ 	}
+ 	mutex_unlock(&percpu_counters_lock);
+ #endif
+Index: linux-rt-2.6.31/lib/plist.c
+===================================================================
+--- linux-rt-2.6.31.orig/lib/plist.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/lib/plist.c	2010-05-17 14:23:20.128387716 +0200
+@@ -54,9 +54,11 @@
+ 
+ static void plist_check_head(struct plist_head *head)
+ {
+-	WARN_ON(!head->lock);
+-	if (head->lock)
+-		WARN_ON_SMP(!spin_is_locked(head->lock));
++	WARN_ON(!head->alock && !head->slock);
++	if (head->alock)
++		WARN_ON_SMP(!atomic_spin_is_locked(head->alock));
++	if (head->slock)
++		WARN_ON_SMP(!spin_is_locked(head->slock));
+ 	plist_check_list(&head->prio_list);
+ 	plist_check_list(&head->node_list);
+ }
+Index: linux-rt-2.6.31/lib/proportions.c
+===================================================================
+--- linux-rt-2.6.31.orig/lib/proportions.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/lib/proportions.c	2010-05-17 14:23:20.128387716 +0200
+@@ -190,7 +190,7 @@
+ 
+ int prop_local_init_percpu(struct prop_local_percpu *pl)
+ {
+-	spin_lock_init(&pl->lock);
++	atomic_spin_lock_init(&pl->lock);
+ 	pl->shift = 0;
+ 	pl->period = 0;
+ 	return percpu_counter_init(&pl->events, 0);
+@@ -226,7 +226,7 @@
+ 	if (pl->period == global_period)
+ 		return;
+ 
+-	spin_lock_irqsave(&pl->lock, flags);
++	atomic_spin_lock_irqsave(&pl->lock, flags);
+ 	prop_adjust_shift(&pl->shift, &pl->period, pg->shift);
+ 
+ 	/*
+@@ -247,7 +247,7 @@
+ 		percpu_counter_set(&pl->events, 0);
+ 
+ 	pl->period = global_period;
+-	spin_unlock_irqrestore(&pl->lock, flags);
++	atomic_spin_unlock_irqrestore(&pl->lock, flags);
+ }
+ 
+ /*
+@@ -324,7 +324,7 @@
+ 
+ int prop_local_init_single(struct prop_local_single *pl)
+ {
+-	spin_lock_init(&pl->lock);
++	atomic_spin_lock_init(&pl->lock);
+ 	pl->shift = 0;
+ 	pl->period = 0;
+ 	pl->events = 0;
+@@ -356,7 +356,7 @@
+ 	if (pl->period == global_period)
+ 		return;
+ 
+-	spin_lock_irqsave(&pl->lock, flags);
++	atomic_spin_lock_irqsave(&pl->lock, flags);
+ 	prop_adjust_shift(&pl->shift, &pl->period, pg->shift);
+ 	/*
+ 	 * For each missed period, we half the local counter.
+@@ -367,7 +367,7 @@
+ 	else
+ 		pl->events = 0;
+ 	pl->period = global_period;
+-	spin_unlock_irqrestore(&pl->lock, flags);
++	atomic_spin_unlock_irqrestore(&pl->lock, flags);
+ }
+ 
+ /*
+Index: linux-rt-2.6.31/lib/radix-tree.c
+===================================================================
+--- linux-rt-2.6.31.orig/lib/radix-tree.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/lib/radix-tree.c	2010-05-17 14:23:20.128387716 +0200
+@@ -157,12 +157,14 @@
+ 		 * succeed in getting a node here (and never reach
+ 		 * kmem_cache_alloc)
+ 		 */
++		rtp = &get_cpu_var(radix_tree_preloads);
+ 		rtp = &__get_cpu_var(radix_tree_preloads);
+ 		if (rtp->nr) {
+ 			ret = rtp->nodes[rtp->nr - 1];
+ 			rtp->nodes[rtp->nr - 1] = NULL;
+ 			rtp->nr--;
+ 		}
++		put_cpu_var(radix_tree_preloads);
+ 	}
+ 	if (ret == NULL)
+ 		ret = kmem_cache_alloc(radix_tree_node_cachep, gfp_mask);
+@@ -195,6 +197,8 @@
+ 	call_rcu(&node->rcu_head, radix_tree_node_rcu_free);
+ }
+ 
++#ifndef CONFIG_PREEMPT_RT
++
+ /*
+  * Load up this CPU's radix_tree_node buffer with sufficient objects to
+  * ensure that the addition of a single element in the tree cannot fail.  On
+@@ -227,6 +231,8 @@
+ }
+ EXPORT_SYMBOL(radix_tree_preload);
+ 
++#endif
++
+ /*
+  *	Return the maximum key which can be store into a
+  *	radix tree with height HEIGHT.
+Index: linux-rt-2.6.31/lib/ratelimit.c
+===================================================================
+--- linux-rt-2.6.31.orig/lib/ratelimit.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/lib/ratelimit.c	2010-05-17 14:23:20.128387716 +0200
+@@ -14,7 +14,7 @@
+ #include <linux/jiffies.h>
+ #include <linux/module.h>
+ 
+-static DEFINE_SPINLOCK(ratelimit_lock);
++static DEFINE_ATOMIC_SPINLOCK(ratelimit_lock);
+ 
+ /*
+  * __ratelimit - rate limiting
+@@ -30,7 +30,7 @@
+ 	if (!rs->interval)
+ 		return 1;
+ 
+-	spin_lock_irqsave(&ratelimit_lock, flags);
++	atomic_spin_lock_irqsave(&ratelimit_lock, flags);
+ 	if (!rs->begin)
+ 		rs->begin = jiffies;
+ 
+@@ -46,12 +46,12 @@
+ 		goto print;
+ 
+ 	rs->missed++;
+-	spin_unlock_irqrestore(&ratelimit_lock, flags);
++	atomic_spin_unlock_irqrestore(&ratelimit_lock, flags);
+ 	return 0;
+ 
+ print:
+ 	rs->printed++;
+-	spin_unlock_irqrestore(&ratelimit_lock, flags);
++	atomic_spin_unlock_irqrestore(&ratelimit_lock, flags);
+ 	return 1;
+ }
+ EXPORT_SYMBOL(__ratelimit);
+Index: linux-rt-2.6.31/lib/rwsem-spinlock.c
+===================================================================
+--- linux-rt-2.6.31.orig/lib/rwsem-spinlock.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/lib/rwsem-spinlock.c	2010-05-17 14:23:20.128387716 +0200
+@@ -20,8 +20,8 @@
+ /*
+  * initialise the semaphore
+  */
+-void __init_rwsem(struct rw_semaphore *sem, const char *name,
+-		  struct lock_class_key *key)
++void __init_anon_rwsem(struct rw_anon_semaphore *sem, const char *name,
++		       struct lock_class_key *key)
+ {
+ #ifdef CONFIG_DEBUG_LOCK_ALLOC
+ 	/*
+@@ -44,8 +44,8 @@
+  * - woken process blocks are discarded from the list after having task zeroed
+  * - writers are only woken if wakewrite is non-zero
+  */
+-static inline struct rw_semaphore *
+-__rwsem_do_wake(struct rw_semaphore *sem, int wakewrite)
++static inline struct rw_anon_semaphore *
++__rwsem_do_wake(struct rw_anon_semaphore *sem, int wakewrite)
+ {
+ 	struct rwsem_waiter *waiter;
+ 	struct task_struct *tsk;
+@@ -103,8 +103,8 @@
+ /*
+  * wake a single writer
+  */
+-static inline struct rw_semaphore *
+-__rwsem_wake_one_writer(struct rw_semaphore *sem)
++static inline struct rw_anon_semaphore *
++__rwsem_wake_one_writer(struct rw_anon_semaphore *sem)
+ {
+ 	struct rwsem_waiter *waiter;
+ 	struct task_struct *tsk;
+@@ -125,7 +125,7 @@
+ /*
+  * get a read lock on the semaphore
+  */
+-void __sched __down_read(struct rw_semaphore *sem)
++void __sched __down_read(struct rw_anon_semaphore *sem)
+ {
+ 	struct rwsem_waiter waiter;
+ 	struct task_struct *tsk;
+@@ -168,7 +168,7 @@
+ /*
+  * trylock for reading -- returns 1 if successful, 0 if contention
+  */
+-int __down_read_trylock(struct rw_semaphore *sem)
++int __down_read_trylock(struct rw_anon_semaphore *sem)
+ {
+ 	unsigned long flags;
+ 	int ret = 0;
+@@ -191,7 +191,7 @@
+  * get a write lock on the semaphore
+  * - we increment the waiting count anyway to indicate an exclusive lock
+  */
+-void __sched __down_write_nested(struct rw_semaphore *sem, int subclass)
++void __sched __down_write_nested(struct rw_anon_semaphore *sem, int subclass)
+ {
+ 	struct rwsem_waiter waiter;
+ 	struct task_struct *tsk;
+@@ -231,7 +231,7 @@
+ 	;
+ }
+ 
+-void __sched __down_write(struct rw_semaphore *sem)
++void __sched __down_write(struct rw_anon_semaphore *sem)
+ {
+ 	__down_write_nested(sem, 0);
+ }
+@@ -239,7 +239,7 @@
+ /*
+  * trylock for writing -- returns 1 if successful, 0 if contention
+  */
+-int __down_write_trylock(struct rw_semaphore *sem)
++int __down_write_trylock(struct rw_anon_semaphore *sem)
+ {
+ 	unsigned long flags;
+ 	int ret = 0;
+@@ -260,7 +260,7 @@
+ /*
+  * release a read lock on the semaphore
+  */
+-void __up_read(struct rw_semaphore *sem)
++void __up_read(struct rw_anon_semaphore *sem)
+ {
+ 	unsigned long flags;
+ 
+@@ -275,7 +275,7 @@
+ /*
+  * release a write lock on the semaphore
+  */
+-void __up_write(struct rw_semaphore *sem)
++void __up_write(struct rw_anon_semaphore *sem)
+ {
+ 	unsigned long flags;
+ 
+@@ -292,7 +292,7 @@
+  * downgrade a write lock into a read lock
+  * - just wake up any readers at the front of the queue
+  */
+-void __downgrade_write(struct rw_semaphore *sem)
++void __downgrade_write(struct rw_anon_semaphore *sem)
+ {
+ 	unsigned long flags;
+ 
+@@ -305,7 +305,7 @@
+ 	spin_unlock_irqrestore(&sem->wait_lock, flags);
+ }
+ 
+-EXPORT_SYMBOL(__init_rwsem);
++EXPORT_SYMBOL(__init_anon_rwsem);
+ EXPORT_SYMBOL(__down_read);
+ EXPORT_SYMBOL(__down_read_trylock);
+ EXPORT_SYMBOL(__down_write_nested);
+Index: linux-rt-2.6.31/lib/rwsem.c
+===================================================================
+--- linux-rt-2.6.31.orig/lib/rwsem.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/lib/rwsem.c	2010-05-17 14:23:20.128387716 +0200
+@@ -11,8 +11,8 @@
+ /*
+  * Initialize an rwsem:
+  */
+-void __init_rwsem(struct rw_semaphore *sem, const char *name,
+-		  struct lock_class_key *key)
++void __init_anon_rwsem(struct rw_anon_semaphore *sem, const char *name,
++		       struct lock_class_key *key)
+ {
+ #ifdef CONFIG_DEBUG_LOCK_ALLOC
+ 	/*
+@@ -25,8 +25,7 @@
+ 	spin_lock_init(&sem->wait_lock);
+ 	INIT_LIST_HEAD(&sem->wait_list);
+ }
+-
+-EXPORT_SYMBOL(__init_rwsem);
++EXPORT_SYMBOL(__init_anon_rwsem);
+ 
+ struct rwsem_waiter {
+ 	struct list_head list;
+@@ -46,8 +45,8 @@
+  * - woken process blocks are discarded from the list after having task zeroed
+  * - writers are only woken if downgrading is false
+  */
+-static inline struct rw_semaphore *
+-__rwsem_do_wake(struct rw_semaphore *sem, int downgrading)
++static inline struct rw_anon_semaphore *
++__rwsem_do_wake(struct rw_anon_semaphore *sem, int downgrading)
+ {
+ 	struct rwsem_waiter *waiter;
+ 	struct task_struct *tsk;
+@@ -146,9 +145,9 @@
+ /*
+  * wait for a lock to be granted
+  */
+-static struct rw_semaphore __sched *
+-rwsem_down_failed_common(struct rw_semaphore *sem,
+-			struct rwsem_waiter *waiter, signed long adjustment)
++static struct rw_anon_semaphore __sched *
++rwsem_down_failed_common(struct rw_anon_semaphore *sem,
++			 struct rwsem_waiter *waiter, signed long adjustment)
+ {
+ 	struct task_struct *tsk = current;
+ 	signed long count;
+@@ -187,8 +186,8 @@
+ /*
+  * wait for the read lock to be granted
+  */
+-asmregparm struct rw_semaphore __sched *
+-rwsem_down_read_failed(struct rw_semaphore *sem)
++asmregparm struct rw_anon_semaphore __sched *
++rwsem_down_read_failed(struct rw_anon_semaphore *sem)
+ {
+ 	struct rwsem_waiter waiter;
+ 
+@@ -201,8 +200,8 @@
+ /*
+  * wait for the write lock to be granted
+  */
+-asmregparm struct rw_semaphore __sched *
+-rwsem_down_write_failed(struct rw_semaphore *sem)
++asmregparm struct rw_anon_semaphore __sched *
++rwsem_down_write_failed(struct rw_anon_semaphore *sem)
+ {
+ 	struct rwsem_waiter waiter;
+ 
+@@ -216,7 +215,7 @@
+  * handle waking up a waiter on the semaphore
+  * - up_read/up_write has decremented the active part of count if we come here
+  */
+-asmregparm struct rw_semaphore *rwsem_wake(struct rw_semaphore *sem)
++asmregparm struct rw_anon_semaphore *rwsem_wake(struct rw_anon_semaphore *sem)
+ {
+ 	unsigned long flags;
+ 
+@@ -236,7 +235,8 @@
+  * - caller incremented waiting part of count and discovered it still negative
+  * - just wake up any readers at the front of the queue
+  */
+-asmregparm struct rw_semaphore *rwsem_downgrade_wake(struct rw_semaphore *sem)
++asmregparm struct rw_anon_semaphore *
++rwsem_downgrade_wake(struct rw_anon_semaphore *sem)
+ {
+ 	unsigned long flags;
+ 
+Index: linux-rt-2.6.31/lib/scatterlist.c
+===================================================================
+--- linux-rt-2.6.31.orig/lib/scatterlist.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/lib/scatterlist.c	2010-05-17 14:23:20.128387716 +0200
+@@ -9,6 +9,7 @@
+ #include <linux/module.h>
+ #include <linux/scatterlist.h>
+ #include <linux/highmem.h>
++#include <linux/interrupt.h>
+ 
+ /**
+  * sg_next - return the next scatterlist entry in a list
+@@ -399,7 +400,7 @@
+ 			flush_kernel_dcache_page(miter->page);
+ 
+ 		if (miter->__flags & SG_MITER_ATOMIC) {
+-			WARN_ON(!irqs_disabled());
++			WARN_ON_NONRT(!irqs_disabled());
+ 			kunmap_atomic(miter->addr, KM_BIO_SRC_IRQ);
+ 		} else
+ 			kunmap(miter->page);
+@@ -439,7 +440,7 @@
+ 
+ 	sg_miter_start(&miter, sgl, nents, sg_flags);
+ 
+-	local_irq_save(flags);
++	local_irq_save_nort(flags);
+ 
+ 	while (sg_miter_next(&miter) && offset < buflen) {
+ 		unsigned int len;
+@@ -456,7 +457,7 @@
+ 
+ 	sg_miter_stop(&miter);
+ 
+-	local_irq_restore(flags);
++	local_irq_restore_nort(flags);
+ 	return offset;
+ }
+ 
+Index: linux-rt-2.6.31/lib/spinlock_debug.c
+===================================================================
+--- linux-rt-2.6.31.orig/lib/spinlock_debug.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/lib/spinlock_debug.c	2010-05-17 14:23:20.128387716 +0200
+@@ -13,8 +13,8 @@
+ #include <linux/delay.h>
+ #include <linux/module.h>
+ 
+-void __spin_lock_init(spinlock_t *lock, const char *name,
+-		      struct lock_class_key *key)
++void __atomic_spin_lock_init(atomic_spinlock_t *lock, const char *name,
++			     struct lock_class_key *key)
+ {
+ #ifdef CONFIG_DEBUG_LOCK_ALLOC
+ 	/*
+@@ -29,8 +29,9 @@
+ 	lock->owner_cpu = -1;
+ }
+ 
+-EXPORT_SYMBOL(__spin_lock_init);
++EXPORT_SYMBOL(__atomic_spin_lock_init);
+ 
++#ifndef CONFIG_PREEMPT_RT
+ void __rwlock_init(rwlock_t *lock, const char *name,
+ 		   struct lock_class_key *key)
+ {
+@@ -46,10 +47,10 @@
+ 	lock->owner = SPINLOCK_OWNER_INIT;
+ 	lock->owner_cpu = -1;
+ }
+-
+ EXPORT_SYMBOL(__rwlock_init);
++#endif
+ 
+-static void spin_bug(spinlock_t *lock, const char *msg)
++static void spin_bug(atomic_spinlock_t *lock, const char *msg)
+ {
+ 	struct task_struct *owner = NULL;
+ 
+@@ -73,7 +74,7 @@
+ #define SPIN_BUG_ON(cond, lock, msg) if (unlikely(cond)) spin_bug(lock, msg)
+ 
+ static inline void
+-debug_spin_lock_before(spinlock_t *lock)
++debug_spin_lock_before(atomic_spinlock_t *lock)
+ {
+ 	SPIN_BUG_ON(lock->magic != SPINLOCK_MAGIC, lock, "bad magic");
+ 	SPIN_BUG_ON(lock->owner == current, lock, "recursion");
+@@ -81,16 +82,16 @@
+ 							lock, "cpu recursion");
+ }
+ 
+-static inline void debug_spin_lock_after(spinlock_t *lock)
++static inline void debug_spin_lock_after(atomic_spinlock_t *lock)
+ {
+ 	lock->owner_cpu = raw_smp_processor_id();
+ 	lock->owner = current;
+ }
+ 
+-static inline void debug_spin_unlock(spinlock_t *lock)
++static inline void debug_spin_unlock(atomic_spinlock_t *lock)
+ {
+ 	SPIN_BUG_ON(lock->magic != SPINLOCK_MAGIC, lock, "bad magic");
+-	SPIN_BUG_ON(!spin_is_locked(lock), lock, "already unlocked");
++	SPIN_BUG_ON(!atomic_spin_is_locked(lock), lock, "already unlocked");
+ 	SPIN_BUG_ON(lock->owner != current, lock, "wrong owner");
+ 	SPIN_BUG_ON(lock->owner_cpu != raw_smp_processor_id(),
+ 							lock, "wrong CPU");
+@@ -98,7 +99,7 @@
+ 	lock->owner_cpu = -1;
+ }
+ 
+-static void __spin_lock_debug(spinlock_t *lock)
++static void __spin_lock_debug(atomic_spinlock_t *lock)
+ {
+ 	u64 i;
+ 	u64 loops = loops_per_jiffy * HZ;
+@@ -125,7 +126,7 @@
+ 	}
+ }
+ 
+-void _raw_spin_lock(spinlock_t *lock)
++void _raw_spin_lock(atomic_spinlock_t *lock)
+ {
+ 	debug_spin_lock_before(lock);
+ 	if (unlikely(!__raw_spin_trylock(&lock->raw_lock)))
+@@ -133,7 +134,7 @@
+ 	debug_spin_lock_after(lock);
+ }
+ 
+-int _raw_spin_trylock(spinlock_t *lock)
++int _raw_spin_trylock(atomic_spinlock_t *lock)
+ {
+ 	int ret = __raw_spin_trylock(&lock->raw_lock);
+ 
+@@ -148,12 +149,14 @@
+ 	return ret;
+ }
+ 
+-void _raw_spin_unlock(spinlock_t *lock)
++void _raw_spin_unlock(atomic_spinlock_t *lock)
+ {
+ 	debug_spin_unlock(lock);
+ 	__raw_spin_unlock(&lock->raw_lock);
+ }
+ 
++#ifndef CONFIG_PREEMPT_RT
++
+ static void rwlock_bug(rwlock_t *lock, const char *msg)
+ {
+ 	if (!debug_locks_off())
+@@ -295,3 +298,4 @@
+ 	debug_write_unlock(lock);
+ 	__raw_write_unlock(&lock->raw_lock);
+ }
++#endif
+Index: linux-rt-2.6.31/mm/bounce.c
+===================================================================
+--- linux-rt-2.6.31.orig/mm/bounce.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/mm/bounce.c	2010-05-17 14:23:20.128387716 +0200
+@@ -13,6 +13,7 @@
+ #include <linux/init.h>
+ #include <linux/hash.h>
+ #include <linux/highmem.h>
++#include <linux/interrupt.h>
+ #include <asm/tlbflush.h>
+ 
+ #include <trace/events/block.h>
+@@ -49,11 +50,11 @@
+ 	unsigned long flags;
+ 	unsigned char *vto;
+ 
+-	local_irq_save(flags);
++	local_irq_save_nort(flags);
+ 	vto = kmap_atomic(to->bv_page, KM_BOUNCE_READ);
+ 	memcpy(vto + to->bv_offset, vfrom, to->bv_len);
+ 	kunmap_atomic(vto, KM_BOUNCE_READ);
+-	local_irq_restore(flags);
++	local_irq_restore_nort(flags);
+ }
+ 
+ #else /* CONFIG_HIGHMEM */
+Index: linux-rt-2.6.31/mm/filemap.c
+===================================================================
+--- linux-rt-2.6.31.orig/mm/filemap.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/mm/filemap.c	2010-05-17 14:23:20.138567292 +0200
+@@ -1890,7 +1890,7 @@
+ 	char *kaddr;
+ 	size_t copied;
+ 
+-	BUG_ON(!in_atomic());
++//	BUG_ON(!in_atomic());
+ 	kaddr = kmap_atomic(page, KM_USER0);
+ 	if (likely(i->nr_segs == 1)) {
+ 		int left;
+Index: linux-rt-2.6.31/mm/highmem.c
+===================================================================
+--- linux-rt-2.6.31.orig/mm/highmem.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/mm/highmem.c	2010-05-17 14:23:20.138567292 +0200
+@@ -14,6 +14,11 @@
+  * based on Linus' idea.
+  *
+  * Copyright (C) 1999 Ingo Molnar <mingo@redhat.com>
++ *
++ * Largely rewritten to get rid of all global locks
++ *
++ * Copyright (C) 2006 Red Hat, Inc., Peter Zijlstra <pzijlstr@redhat.com>
++ *
+  */
+ 
+ #include <linux/mm.h>
+@@ -26,18 +31,15 @@
+ #include <linux/init.h>
+ #include <linux/hash.h>
+ #include <linux/highmem.h>
++#include <linux/hardirq.h>
++
+ #include <asm/tlbflush.h>
++#include <asm/pgtable.h>
+ 
+-/*
+- * Virtual_count is not a pure "count".
+- *  0 means that it is not mapped, and has not been mapped
+- *    since a TLB flush - it is usable.
+- *  1 means that there are no users, but it has been mapped
+- *    since the last TLB flush - so we can't use it.
+- *  n means that there are (n-1) current users of it.
+- */
+ #ifdef CONFIG_HIGHMEM
+ 
++static int __set_page_address(struct page *page, void *virtual, int pos);
++
+ unsigned long totalhigh_pages __read_mostly;
+ EXPORT_SYMBOL(totalhigh_pages);
+ 
+@@ -58,13 +60,21 @@
+ 	return pages;
+ }
+ 
+-static int pkmap_count[LAST_PKMAP];
+-static unsigned int last_pkmap_nr;
+-static  __cacheline_aligned_in_smp DEFINE_SPINLOCK(kmap_lock);
++/*
++ * count is not a pure "count".
++ *  0 means its owned exclusively by someone
++ *  1 means its free for use - either mapped or not.
++ *  n means that there are (n-1) current users of it.
++ */
++static atomic_t pkmap_count[LAST_PKMAP];
++static atomic_t pkmap_hand;
++static atomic_t pkmap_free;
++static atomic_t pkmap_users;
+ 
+ pte_t * pkmap_page_table;
+ 
+-static DECLARE_WAIT_QUEUE_HEAD(pkmap_map_wait);
++static DECLARE_WAIT_QUEUE_HEAD(pkmap_wait);
++
+ 
+ /*
+  * Most architectures have no use for kmap_high_get(), so let's abstract
+@@ -85,131 +95,261 @@
+ 		do { spin_unlock(&kmap_lock); (void)(flags); } while (0)
+ #endif
+ 
+-static void flush_all_zero_pkmaps(void)
++/*
++ * Try to free a given kmap slot.
++ *
++ * Returns:
++ *  -1 - in use
++ *   0 - free, no TLB flush needed
++ *   1 - free, needs TLB flush
++ */
++static int pkmap_try_free(int pos)
++{
++	if (atomic_cmpxchg(&pkmap_count[pos], 1, 0) != 1)
++		return -1;
++	atomic_dec(&pkmap_free);
++	/*
++	 * TODO: add a young bit to make it CLOCK
++	 */
++	if (!pte_none(pkmap_page_table[pos])) {
++		struct page *page = pte_page(pkmap_page_table[pos]);
++		unsigned long addr = PKMAP_ADDR(pos);
++		pte_t *ptep = &pkmap_page_table[pos];
++
++		VM_BUG_ON(addr != (unsigned long)page_address(page));
++
++		if (!__set_page_address(page, NULL, pos))
++			BUG();
++		flush_kernel_dcache_page(page);
++		pte_clear(&init_mm, addr, ptep);
++
++
++		return 1;
++	}
++
++	return 0;
++}
++
++static inline void pkmap_put(atomic_t *counter)
+ {
+-	int i;
+-	int need_flush = 0;
++	switch (atomic_dec_return(counter)) {
++	case 0:
++		BUG();
++
++	case 1:
++		atomic_inc(&pkmap_free);
++		wake_up(&pkmap_wait);
++	}
++}
+ 
+-	flush_cache_kmaps();
++#define TLB_BATCH	32
+ 
++static int pkmap_get_free(void)
++{
++	int i, pos, flush;
++
++restart:
+ 	for (i = 0; i < LAST_PKMAP; i++) {
+-		struct page *page;
++		pos = atomic_inc_return(&pkmap_hand) & LAST_PKMAP_MASK;
++		flush = pkmap_try_free(pos);
++		if (flush >= 0)
++			goto got_one;
++	}
++
++	atomic_dec(&pkmap_free);
++	/*
++	 * wait for somebody else to unmap their entries
++	 */
++	if (likely(!in_interrupt()))
++		wait_event(pkmap_wait, atomic_read(&pkmap_free) != 0);
++
++	goto restart;
++
++got_one:
++	if (flush) {
++#if 0
++		flush_tlb_kernel_range(PKMAP_ADDR(pos), PKMAP_ADDR(pos+1));
++#else
++		int pos2 = (pos + 1) & LAST_PKMAP_MASK;
++		int nr;
++		int entries[TLB_BATCH];
+ 
+ 		/*
+-		 * zero means we don't have anything to do,
+-		 * >1 means that it is still in use. Only
+-		 * a count of 1 means that it is free but
+-		 * needs to be unmapped
++		 * For those architectures that cannot help but flush the
++		 * whole TLB, flush some more entries to make it worthwhile.
++		 * Scan ahead of the hand to minimise search distances.
+ 		 */
+-		if (pkmap_count[i] != 1)
+-			continue;
+-		pkmap_count[i] = 0;
++		for (i = 0, nr = 0; i < LAST_PKMAP && nr < TLB_BATCH;
++				i++, pos2 = (pos2 + 1) & LAST_PKMAP_MASK) {
+ 
+-		/* sanity check */
+-		BUG_ON(pte_none(pkmap_page_table[i]));
++			flush = pkmap_try_free(pos2);
++			if (flush < 0)
++				continue;
++
++			if (!flush) {
++				atomic_t *counter = &pkmap_count[pos2];
++				VM_BUG_ON(atomic_read(counter) != 0);
++				atomic_set(counter, 2);
++				pkmap_put(counter);
++			} else
++				entries[nr++] = pos2;
++		}
++		flush_tlb_kernel_range(PKMAP_ADDR(0), PKMAP_ADDR(LAST_PKMAP));
++
++		for (i = 0; i < nr; i++) {
++			atomic_t *counter = &pkmap_count[entries[i]];
++			VM_BUG_ON(atomic_read(counter) != 0);
++			atomic_set(counter, 2);
++			pkmap_put(counter);
++		}
++#endif
++	}
++	return pos;
++}
++
++static unsigned long pkmap_insert(struct page *page)
++{
++	int pos = pkmap_get_free();
++	unsigned long vaddr = PKMAP_ADDR(pos);
++	pte_t *ptep = &pkmap_page_table[pos];
++	pte_t entry = mk_pte(page, kmap_prot);
++	atomic_t *counter = &pkmap_count[pos];
+ 
++	VM_BUG_ON(atomic_read(counter) != 0);
++
++	set_pte_at(&init_mm, vaddr, ptep, entry);
++	if (unlikely(!__set_page_address(page, (void *)vaddr, pos))) {
+ 		/*
+-		 * Don't need an atomic fetch-and-clear op here;
+-		 * no-one has the page mapped, and cannot get at
+-		 * its virtual address (and hence PTE) without first
+-		 * getting the kmap_lock (which is held here).
+-		 * So no dangers, even with speculative execution.
++		 * concurrent pkmap_inserts for this page -
++		 * the other won the race, release this entry.
++		 *
++		 * we can still clear the pte without a tlb flush since
++		 * it couldn't have been used yet.
+ 		 */
+-		page = pte_page(pkmap_page_table[i]);
+-		pte_clear(&init_mm, (unsigned long)page_address(page),
+-			  &pkmap_page_table[i]);
++		pte_clear(&init_mm, vaddr, ptep);
++		VM_BUG_ON(atomic_read(counter) != 0);
++		atomic_set(counter, 2);
++		pkmap_put(counter);
++		vaddr = 0;
++	} else
++		atomic_set(counter, 2);
+ 
+-		set_page_address(page, NULL);
+-		need_flush = 1;
+-	}
+-	if (need_flush)
+-		flush_tlb_kernel_range(PKMAP_ADDR(0), PKMAP_ADDR(LAST_PKMAP));
++	return vaddr;
+ }
+ 
+-/**
+- * kmap_flush_unused - flush all unused kmap mappings in order to remove stray mappings
++/*
++ * Flush all unused kmap mappings in order to remove stray mappings.
+  */
+ void kmap_flush_unused(void)
+ {
+-	lock_kmap();
+-	flush_all_zero_pkmaps();
+-	unlock_kmap();
++	WARN_ON_ONCE(1);
+ }
+ 
+-static inline unsigned long map_new_virtual(struct page *page)
++/*
++ * Avoid starvation deadlock by limiting the number of tasks that can obtain a
++ * kmap to (LAST_PKMAP - KM_TYPE_NR*NR_CPUS)/2.
++ */
++static void kmap_account(void)
+ {
+-	unsigned long vaddr;
+-	int count;
++	int weight;
+ 
+-start:
+-	count = LAST_PKMAP;
+-	/* Find an empty entry */
+-	for (;;) {
+-		last_pkmap_nr = (last_pkmap_nr + 1) & LAST_PKMAP_MASK;
+-		if (!last_pkmap_nr) {
+-			flush_all_zero_pkmaps();
+-			count = LAST_PKMAP;
+-		}
+-		if (!pkmap_count[last_pkmap_nr])
+-			break;	/* Found a usable entry */
+-		if (--count)
+-			continue;
++#ifndef CONFIG_PREEMPT_RT
++	if (in_interrupt()) {
++		/* irqs can always get them */
++		weight = -1;
++	} else
++#endif
++	if (current->flags & PF_KMAP) {
++		current->flags &= ~PF_KMAP;
++		/* we already accounted the second */
++		weight = 0;
++	} else {
++		/* mark 1, account 2 */
++		current->flags |= PF_KMAP;
++		weight = 2;
++	}
+ 
++	if (weight > 0) {
+ 		/*
+-		 * Sleep for somebody else to unmap their entries
++		 * reserve KM_TYPE_NR maps per CPU for interrupt context
+ 		 */
+-		{
+-			DECLARE_WAITQUEUE(wait, current);
+-
+-			__set_current_state(TASK_UNINTERRUPTIBLE);
+-			add_wait_queue(&pkmap_map_wait, &wait);
+-			unlock_kmap();
+-			schedule();
+-			remove_wait_queue(&pkmap_map_wait, &wait);
+-			lock_kmap();
+-
+-			/* Somebody else might have mapped it while we slept */
+-			if (page_address(page))
+-				return (unsigned long)page_address(page);
++		const int target = LAST_PKMAP
++#ifndef CONFIG_PREEMPT_RT
++				- KM_TYPE_NR*NR_CPUS
++#endif
++			;
+ 
+-			/* Re-start */
+-			goto start;
++again:
++		wait_event(pkmap_wait,
++			atomic_read(&pkmap_users) + weight <= target);
++
++		if (atomic_add_return(weight, &pkmap_users) > target) {
++			atomic_sub(weight, &pkmap_users);
++			goto again;
+ 		}
+ 	}
+-	vaddr = PKMAP_ADDR(last_pkmap_nr);
+-	set_pte_at(&init_mm, vaddr,
+-		   &(pkmap_page_table[last_pkmap_nr]), mk_pte(page, kmap_prot));
++}
+ 
+-	pkmap_count[last_pkmap_nr] = 1;
+-	set_page_address(page, (void *)vaddr);
++static void kunmap_account(void)
++{
++	int weight;
+ 
+-	return vaddr;
++#ifndef CONFIG_PREEMPT_RT
++	if (in_irq()) {
++		weight = -1;
++	} else
++#endif
++	if (current->flags & PF_KMAP) {
++		/* there was only 1 kmap, un-account both */
++		current->flags &= ~PF_KMAP;
++		weight = 2;
++	} else {
++		/* there were two kmaps, un-account per kunmap */
++		weight = 1;
++	}
++
++	if (weight > 0)
++		atomic_sub(weight, &pkmap_users);
++	wake_up(&pkmap_wait);
+ }
+ 
+-/**
+- * kmap_high - map a highmem page into memory
+- * @page: &struct page to map
+- *
+- * Returns the page's virtual memory address.
+- *
+- * We cannot call this from interrupts, as it may block.
+- */
+ void *kmap_high(struct page *page)
+ {
+ 	unsigned long vaddr;
+ 
+-	/*
+-	 * For highmem pages, we can't trust "virtual" until
+-	 * after we have the lock.
+-	 */
+-	lock_kmap();
++
++	kmap_account();
++again:
+ 	vaddr = (unsigned long)page_address(page);
++	if (vaddr) {
++		atomic_t *counter = &pkmap_count[PKMAP_NR(vaddr)];
++		if (atomic_inc_not_zero(counter)) {
++			/*
++			 * atomic_inc_not_zero implies a (memory) barrier on success
++			 * so page address will be reloaded.
++			 */
++			unsigned long vaddr2 = (unsigned long)page_address(page);
++			if (likely(vaddr == vaddr2))
++				return (void *)vaddr;
++
++			/*
++			 * Oops, we got someone else.
++			 *
++			 * This can happen if we get preempted after
++			 * page_address() and before atomic_inc_not_zero()
++			 * and during that preemption this slot is freed and
++			 * reused.
++			 */
++			pkmap_put(counter);
++			goto again;
++		}
++	}
++
++	vaddr = pkmap_insert(page);
+ 	if (!vaddr)
+-		vaddr = map_new_virtual(page);
+-	pkmap_count[PKMAP_NR(vaddr)]++;
+-	BUG_ON(pkmap_count[PKMAP_NR(vaddr)] < 2);
+-	unlock_kmap();
+-	return (void*) vaddr;
++		goto again;
++
++	return (void *)vaddr;
+ }
+ 
+ EXPORT_SYMBOL(kmap_high);
+@@ -240,51 +380,12 @@
+ }
+ #endif
+ 
+-/**
+- * kunmap_high - map a highmem page into memory
+- * @page: &struct page to unmap
+- *
+- * If ARCH_NEEDS_KMAP_HIGH_GET is not defined then this may be called
+- * only from user context.
+- */
+-void kunmap_high(struct page *page)
++ void kunmap_high(struct page *page)
+ {
+-	unsigned long vaddr;
+-	unsigned long nr;
+-	unsigned long flags;
+-	int need_wakeup;
+-
+-	lock_kmap_any(flags);
+-	vaddr = (unsigned long)page_address(page);
++	unsigned long vaddr = (unsigned long)page_address(page);
+ 	BUG_ON(!vaddr);
+-	nr = PKMAP_NR(vaddr);
+-
+-	/*
+-	 * A count must never go down to zero
+-	 * without a TLB flush!
+-	 */
+-	need_wakeup = 0;
+-	switch (--pkmap_count[nr]) {
+-	case 0:
+-		BUG();
+-	case 1:
+-		/*
+-		 * Avoid an unnecessary wake_up() function call.
+-		 * The common case is pkmap_count[] == 1, but
+-		 * no waiters.
+-		 * The tasks queued in the wait-queue are guarded
+-		 * by both the lock in the wait-queue-head and by
+-		 * the kmap_lock.  As the kmap_lock is held here,
+-		 * no need for the wait-queue-head's lock.  Simply
+-		 * test if the queue is empty.
+-		 */
+-		need_wakeup = waitqueue_active(&pkmap_map_wait);
+-	}
+-	unlock_kmap_any(flags);
+-
+-	/* do wake-up, if needed, race-free outside of the spin lock */
+-	if (need_wakeup)
+-		wake_up(&pkmap_map_wait);
++	pkmap_put(&pkmap_count[PKMAP_NR(vaddr)]);
++	kunmap_account();
+ }
+ 
+ EXPORT_SYMBOL(kunmap_high);
+@@ -295,19 +396,13 @@
+ #define PA_HASH_ORDER	7
+ 
+ /*
+- * Describes one page->virtual association
++ * Describes one page->virtual address association.
+  */
+-struct page_address_map {
++static struct page_address_map {
+ 	struct page *page;
+ 	void *virtual;
+ 	struct list_head list;
+-};
+-
+-/*
+- * page_address_map freelist, allocated from page_address_maps.
+- */
+-static struct list_head page_address_pool;	/* freelist */
+-static spinlock_t pool_lock;			/* protects page_address_pool */
++} page_address_maps[LAST_PKMAP];
+ 
+ /*
+  * Hash table bucket
+@@ -328,29 +423,37 @@
+  *
+  * Returns the page's virtual address.
+  */
+-void *page_address(struct page *page)
+-{
+-	unsigned long flags;
+-	void *ret;
+-	struct page_address_slot *pas;
+ 
+-	if (!PageHighMem(page))
+-		return lowmem_page_address(page);
++static void *__page_address(struct page_address_slot *pas, struct page *page)
++{
++	void *ret = NULL;
+ 
+-	pas = page_slot(page);
+-	ret = NULL;
+-	spin_lock_irqsave(&pas->lock, flags);
+ 	if (!list_empty(&pas->lh)) {
+ 		struct page_address_map *pam;
+ 
+ 		list_for_each_entry(pam, &pas->lh, list) {
+ 			if (pam->page == page) {
+ 				ret = pam->virtual;
+-				goto done;
++				break;
+ 			}
+ 		}
+ 	}
+-done:
++
++	return ret;
++}
++
++void *page_address(struct page *page)
++{
++	unsigned long flags;
++	void *ret;
++	struct page_address_slot *pas;
++
++	if (!PageHighMem(page))
++		return lowmem_page_address(page);
++
++	pas = page_slot(page);
++	spin_lock_irqsave(&pas->lock, flags);
++	ret = __page_address(pas, page);
+ 	spin_unlock_irqrestore(&pas->lock, flags);
+ 	return ret;
+ }
+@@ -362,62 +465,90 @@
+  * @page: &struct page to set
+  * @virtual: virtual address to use
+  */
+-void set_page_address(struct page *page, void *virtual)
++static int __set_page_address(struct page *page, void *virtual, int pos)
+ {
++	int ret = 0;
+ 	unsigned long flags;
+ 	struct page_address_slot *pas;
+ 	struct page_address_map *pam;
+ 
+-	BUG_ON(!PageHighMem(page));
++	VM_BUG_ON(!PageHighMem(page));
++	VM_BUG_ON(atomic_read(&pkmap_count[pos]) != 0);
++	VM_BUG_ON(pos < 0 || pos >= LAST_PKMAP);
+ 
+ 	pas = page_slot(page);
+-	if (virtual) {		/* Add */
+-		BUG_ON(list_empty(&page_address_pool));
++	pam = &page_address_maps[pos];
+ 
+-		spin_lock_irqsave(&pool_lock, flags);
+-		pam = list_entry(page_address_pool.next,
+-				struct page_address_map, list);
+-		list_del(&pam->list);
+-		spin_unlock_irqrestore(&pool_lock, flags);
+-
+-		pam->page = page;
+-		pam->virtual = virtual;
+-
+-		spin_lock_irqsave(&pas->lock, flags);
+-		list_add_tail(&pam->list, &pas->lh);
+-		spin_unlock_irqrestore(&pas->lock, flags);
+-	} else {		/* Remove */
+-		spin_lock_irqsave(&pas->lock, flags);
+-		list_for_each_entry(pam, &pas->lh, list) {
+-			if (pam->page == page) {
+-				list_del(&pam->list);
+-				spin_unlock_irqrestore(&pas->lock, flags);
+-				spin_lock_irqsave(&pool_lock, flags);
+-				list_add_tail(&pam->list, &page_address_pool);
+-				spin_unlock_irqrestore(&pool_lock, flags);
+-				goto done;
+-			}
++	spin_lock_irqsave(&pas->lock, flags);
++	if (virtual) { /* add */
++		VM_BUG_ON(!list_empty(&pam->list));
++
++		if (!__page_address(pas, page)) {
++			pam->page = page;
++			pam->virtual = virtual;
++			list_add_tail(&pam->list, &pas->lh);
++			ret = 1;
++		}
++	} else { /* remove */
++		if (!list_empty(&pam->list)) {
++			list_del_init(&pam->list);
++			ret = 1;
+ 		}
+-		spin_unlock_irqrestore(&pas->lock, flags);
+ 	}
+-done:
+-	return;
++	spin_unlock_irqrestore(&pas->lock, flags);
++
++	return ret;
+ }
+ 
+-static struct page_address_map page_address_maps[LAST_PKMAP];
++int set_page_address(struct page *page, void *virtual)
++{
++	/*
++	 * set_page_address is not supposed to be called when using
++	 * hashed virtual addresses.
++	 */
++	BUG();
++	return 0;
++}
+ 
+-void __init page_address_init(void)
++void __init __page_address_init(void)
+ {
+ 	int i;
+ 
+-	INIT_LIST_HEAD(&page_address_pool);
+ 	for (i = 0; i < ARRAY_SIZE(page_address_maps); i++)
+-		list_add(&page_address_maps[i].list, &page_address_pool);
++		INIT_LIST_HEAD(&page_address_maps[i].list);
++
+ 	for (i = 0; i < ARRAY_SIZE(page_address_htable); i++) {
+ 		INIT_LIST_HEAD(&page_address_htable[i].lh);
+ 		spin_lock_init(&page_address_htable[i].lock);
+ 	}
+-	spin_lock_init(&pool_lock);
++}
++
++#elif defined (CONFIG_HIGHMEM) /* HASHED_PAGE_VIRTUAL */
++
++static int __set_page_address(struct page *page, void *virtual, int pos)
++{
++	return set_page_address(page, virtual);
++}
++
++#endif	/* defined(CONFIG_HIGHMEM) && !defined(WANT_PAGE_VIRTUAL) */
++
++#if defined(CONFIG_HIGHMEM) || defined(HASHED_PAGE_VIRTUAL)
++
++void __init page_address_init(void)
++{
++#ifdef CONFIG_HIGHMEM
++	int i;
++
++	for (i = 0; i < ARRAY_SIZE(pkmap_count); i++)
++		atomic_set(&pkmap_count[i], 1);
++	atomic_set(&pkmap_hand, 0);
++	atomic_set(&pkmap_free, LAST_PKMAP);
++	atomic_set(&pkmap_users, 0);
++#endif
++
++#ifdef HASHED_PAGE_VIRTUAL
++	__page_address_init();
++#endif
+ }
+ 
+ #endif	/* defined(CONFIG_HIGHMEM) && !defined(WANT_PAGE_VIRTUAL) */
+Index: linux-rt-2.6.31/mm/memcontrol.c
+===================================================================
+--- linux-rt-2.6.31.orig/mm/memcontrol.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/mm/memcontrol.c	2010-05-17 14:23:20.138567292 +0200
+@@ -954,13 +954,14 @@
+ 		goto done;
+ 
+ 	/*
+-	 * Preemption is already disabled, we don't need get_cpu()
++	 * Preemption is already disabled, we don't need get_cpu(), but
++	 * that's not true for RT :)
+ 	 */
+-	cpu = smp_processor_id();
++	cpu = get_cpu();
+ 	stat = &mem->stat;
+ 	cpustat = &stat->cpustat[cpu];
+-
+ 	__mem_cgroup_stat_add_safe(cpustat, MEM_CGROUP_STAT_MAPPED_FILE, val);
++	put_cpu();
+ done:
+ 	unlock_page_cgroup(pc);
+ }
+Index: linux-rt-2.6.31/mm/memory.c
+===================================================================
+--- linux-rt-2.6.31.orig/mm/memory.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/mm/memory.c	2010-05-17 14:23:20.138567292 +0200
+@@ -923,10 +923,13 @@
+ 	return addr;
+ }
+ 
+-#ifdef CONFIG_PREEMPT
++#if defined(CONFIG_PREEMPT) && !defined(CONFIG_PREEMPT_RT)
+ # define ZAP_BLOCK_SIZE	(8 * PAGE_SIZE)
+ #else
+-/* No preempt: go for improved straight-line efficiency */
++/*
++ * No preempt: go for improved straight-line efficiency
++ * on PREEMPT_RT this is not a critical latency-path.
++ */
+ # define ZAP_BLOCK_SIZE	(1024 * PAGE_SIZE)
+ #endif
+ 
+@@ -956,17 +959,14 @@
+  * ensure that any thus-far unmapped pages are flushed before unmap_vmas()
+  * drops the lock and schedules.
+  */
+-unsigned long unmap_vmas(struct mmu_gather **tlbp,
++unsigned long unmap_vmas(struct mmu_gather *tlb,
+ 		struct vm_area_struct *vma, unsigned long start_addr,
+ 		unsigned long end_addr, unsigned long *nr_accounted,
+ 		struct zap_details *details)
+ {
+ 	long zap_work = ZAP_BLOCK_SIZE;
+-	unsigned long tlb_start = 0;	/* For tlb_finish_mmu */
+-	int tlb_start_valid = 0;
+ 	unsigned long start = start_addr;
+ 	spinlock_t *i_mmap_lock = details? details->i_mmap_lock: NULL;
+-	int fullmm = (*tlbp)->fullmm;
+ 	struct mm_struct *mm = vma->vm_mm;
+ 
+ 	mmu_notifier_invalidate_range_start(mm, start_addr, end_addr);
+@@ -987,11 +987,6 @@
+ 			untrack_pfn_vma(vma, 0, 0);
+ 
+ 		while (start != end) {
+-			if (!tlb_start_valid) {
+-				tlb_start = start;
+-				tlb_start_valid = 1;
+-			}
+-
+ 			if (unlikely(is_vm_hugetlb_page(vma))) {
+ 				/*
+ 				 * It is undesirable to test vma->vm_file as it
+@@ -1012,7 +1007,7 @@
+ 
+ 				start = end;
+ 			} else
+-				start = unmap_page_range(*tlbp, vma,
++				start = unmap_page_range(tlb, vma,
+ 						start, end, &zap_work, details);
+ 
+ 			if (zap_work > 0) {
+@@ -1020,19 +1015,13 @@
+ 				break;
+ 			}
+ 
+-			tlb_finish_mmu(*tlbp, tlb_start, start);
+-
+ 			if (need_resched() ||
+ 				(i_mmap_lock && spin_needbreak(i_mmap_lock))) {
+-				if (i_mmap_lock) {
+-					*tlbp = NULL;
++				if (i_mmap_lock)
+ 					goto out;
+-				}
+ 				cond_resched();
+ 			}
+ 
+-			*tlbp = tlb_gather_mmu(vma->vm_mm, fullmm);
+-			tlb_start_valid = 0;
+ 			zap_work = ZAP_BLOCK_SIZE;
+ 		}
+ 	}
+@@ -1052,16 +1041,15 @@
+ 		unsigned long size, struct zap_details *details)
+ {
+ 	struct mm_struct *mm = vma->vm_mm;
+-	struct mmu_gather *tlb;
++	struct mmu_gather tlb;
+ 	unsigned long end = address + size;
+ 	unsigned long nr_accounted = 0;
+ 
+ 	lru_add_drain();
+-	tlb = tlb_gather_mmu(mm, 0);
++	tlb_gather_mmu(&tlb, mm, 0);
+ 	update_hiwater_rss(mm);
+ 	end = unmap_vmas(&tlb, vma, address, end, &nr_accounted, details);
+-	if (tlb)
+-		tlb_finish_mmu(tlb, address, end);
++	tlb_finish_mmu(&tlb, address, end);
+ 	return end;
+ }
+ 
+@@ -2480,12 +2468,12 @@
+ 		return -ENOSYS;
+ 
+ 	mutex_lock(&inode->i_mutex);
+-	down_write(&inode->i_alloc_sem);
++	anon_down_write(&inode->i_alloc_sem);
+ 	unmap_mapping_range(mapping, offset, (end - offset), 1);
+ 	truncate_inode_pages_range(mapping, offset, end);
+ 	unmap_mapping_range(mapping, offset, (end - offset), 1);
+ 	inode->i_op->truncate_range(inode, offset, end);
+-	up_write(&inode->i_alloc_sem);
++	anon_up_write(&inode->i_alloc_sem);
+ 	mutex_unlock(&inode->i_mutex);
+ 
+ 	return 0;
+@@ -2957,6 +2945,28 @@
+ 	return 0;
+ }
+ 
++void pagefault_disable(void)
++{
++	current->pagefault_disabled++;
++	/*
++	 * make sure to have issued the store before a pagefault
++	 * can hit.
++	 */
++	barrier();
++}
++EXPORT_SYMBOL(pagefault_disable);
++
++void pagefault_enable(void)
++{
++	/*
++	 * make sure to issue those last loads/stores before enabling
++	 * the pagefault handler again.
++	 */
++	barrier();
++	current->pagefault_disabled--;
++}
++EXPORT_SYMBOL(pagefault_enable);
++
+ /*
+  * By the time we get here, we already hold the mm semaphore
+  */
+Index: linux-rt-2.6.31/mm/mmap.c
+===================================================================
+--- linux-rt-2.6.31.orig/mm/mmap.c	2010-05-17 14:22:33.000000000 +0200
++++ linux-rt-2.6.31/mm/mmap.c	2010-05-17 14:23:20.138567292 +0200
+@@ -1878,17 +1878,17 @@
+ 		unsigned long start, unsigned long end)
+ {
+ 	struct vm_area_struct *next = prev? prev->vm_next: mm->mmap;
+-	struct mmu_gather *tlb;
++	struct mmu_gather tlb;
+ 	unsigned long nr_accounted = 0;
+ 
+ 	lru_add_drain();
+-	tlb = tlb_gather_mmu(mm, 0);
++	tlb_gather_mmu(&tlb, mm, 0);
+ 	update_hiwater_rss(mm);
+ 	unmap_vmas(&tlb, vma, start, end, &nr_accounted, NULL);
+ 	vm_unacct_memory(nr_accounted);
+-	free_pgtables(tlb, vma, prev? prev->vm_end: FIRST_USER_ADDRESS,
++	free_pgtables(&tlb, vma, prev? prev->vm_end: FIRST_USER_ADDRESS,
+ 				 next? next->vm_start: 0);
+-	tlb_finish_mmu(tlb, start, end);
++	tlb_finish_mmu(&tlb, start, end);
+ }
+ 
+ /*
+@@ -2074,10 +2074,16 @@
+ static inline void verify_mm_writelocked(struct mm_struct *mm)
+ {
+ #ifdef CONFIG_DEBUG_VM
+-	if (unlikely(down_read_trylock(&mm->mmap_sem))) {
++# ifdef CONFIG_PREEMPT_RT
++	if (unlikely(!rwsem_is_locked(&mm->mmap_sem))) {
+ 		WARN_ON(1);
+-		up_read(&mm->mmap_sem);
+ 	}
++# else
++        if (unlikely(down_read_trylock(&mm->mmap_sem))) {
++		WARN_ON(1);
++		up_read(&mm->mmap_sem);
++        }
++# endif
+ #endif
+ }
+ 
+@@ -2185,7 +2191,7 @@
+ /* Release all mmaps. */
+ void exit_mmap(struct mm_struct *mm)
+ {
+-	struct mmu_gather *tlb;
++	struct mmu_gather tlb;
+ 	struct vm_area_struct *vma;
+ 	unsigned long nr_accounted = 0;
+ 	unsigned long end;
+@@ -2210,13 +2216,13 @@
+ 
+ 	lru_add_drain();
+ 	flush_cache_mm(mm);
+-	tlb = tlb_gather_mmu(mm, 1);
++	tlb_gather_mmu(&tlb, mm, 1);
+ 	/* update_hiwater_rss(mm) here? but nobody should be looking */
+ 	/* Use -1 here to ensure all VMAs in the mm are unmapped */
+ 	end = unmap_vmas(&tlb, vma, 0, -1, &nr_accounted, NULL);
+ 	vm_unacct_memory(nr_accounted);
+-	free_pgtables(tlb, vma, FIRST_USER_ADDRESS, 0);
+-	tlb_finish_mmu(tlb, 0, end);
++	free_pgtables(&tlb, vma, FIRST_USER_ADDRESS, 0);
++	tlb_finish_mmu(&tlb, 0, end);
+ 
+ 	/*
+ 	 * Walk the list again, actually closing and freeing it,
+Index: linux-rt-2.6.31/mm/oom_kill.c
+===================================================================
+--- linux-rt-2.6.31.orig/mm/oom_kill.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/mm/oom_kill.c	2010-05-17 14:23:20.138567292 +0200
+@@ -303,7 +303,7 @@
+ 			continue;
+ 		}
+ 		printk(KERN_INFO "[%5d] %5d %5d %8lu %8lu %3d     %3d %s\n",
+-		       p->pid, __task_cred(p)->uid, p->tgid, mm->total_vm,
++		       p->pid, task_uid(p), p->tgid, mm->total_vm,
+ 		       get_mm_rss(mm), (int)task_cpu(p), p->oomkilladj,
+ 		       p->comm);
+ 		task_unlock(p);
+Index: linux-rt-2.6.31/mm/page_alloc.c
+===================================================================
+--- linux-rt-2.6.31.orig/mm/page_alloc.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/mm/page_alloc.c	2010-05-17 14:23:20.138567292 +0200
+@@ -161,6 +161,53 @@
+   EXPORT_SYMBOL(movable_zone);
+ #endif /* CONFIG_ARCH_POPULATES_NODE_MAP */
+ 
++#ifdef CONFIG_PREEMPT_RT
++static DEFINE_PER_CPU_LOCKED(int, pcp_locks);
++#endif
++
++static inline void __lock_cpu_pcp(unsigned long *flags, int cpu)
++{
++#ifdef CONFIG_PREEMPT_RT
++	spin_lock(&__get_cpu_lock(pcp_locks, cpu));
++	flags = 0;
++#else
++	local_irq_save(*flags);
++#endif
++}
++
++static inline void lock_cpu_pcp(unsigned long *flags, int *this_cpu)
++{
++#ifdef CONFIG_PREEMPT_RT
++	(void)get_cpu_var_locked(pcp_locks, this_cpu);
++	flags = 0;
++#else
++	local_irq_save(*flags);
++	*this_cpu = smp_processor_id();
++#endif
++}
++
++static inline void unlock_cpu_pcp(unsigned long flags, int this_cpu)
++{
++#ifdef CONFIG_PREEMPT_RT
++	put_cpu_var_locked(pcp_locks, this_cpu);
++#else
++	local_irq_restore(flags);
++#endif
++}
++
++static struct per_cpu_pageset *
++get_zone_pcp(struct zone *zone, unsigned long *flags, int *this_cpu)
++{
++	lock_cpu_pcp(flags, this_cpu);
++	return zone_pcp(zone, *this_cpu);
++}
++
++static void
++put_zone_pcp(struct zone *zone, unsigned long flags, int this_cpu)
++{
++	unlock_cpu_pcp(flags, this_cpu);
++}
++
+ #if MAX_NUMNODES > 1
+ int nr_node_ids __read_mostly = MAX_NUMNODES;
+ int nr_online_nodes __read_mostly = 1;
+@@ -523,7 +570,9 @@
+ static void free_pages_bulk(struct zone *zone, int count,
+ 					struct list_head *list, int order)
+ {
+-	spin_lock(&zone->lock);
++	unsigned long flags;
++
++	spin_lock_irqsave(&zone->lock, flags);
+ 	zone_clear_flag(zone, ZONE_ALL_UNRECLAIMABLE);
+ 	zone->pages_scanned = 0;
+ 
+@@ -536,27 +585,31 @@
+ 		/* have to delete it as __free_one_page list manipulates */
+ 		list_del(&page->lru);
+ 		__free_one_page(page, zone, order, page_private(page));
++#ifdef CONFIG_PREEMPT_RT
++		cond_resched_lock(&zone->lock);
++#endif
+ 	}
+-	spin_unlock(&zone->lock);
++	spin_unlock_irqrestore(&zone->lock, flags);
+ }
+ 
+ static void free_one_page(struct zone *zone, struct page *page, int order,
+ 				int migratetype)
+ {
+-	spin_lock(&zone->lock);
++	unsigned long flags;
++
++	spin_lock_irqsave(&zone->lock, flags);
+ 	zone_clear_flag(zone, ZONE_ALL_UNRECLAIMABLE);
+ 	zone->pages_scanned = 0;
+ 
+ 	__mod_zone_page_state(zone, NR_FREE_PAGES, 1 << order);
+ 	__free_one_page(page, zone, order, migratetype);
+-	spin_unlock(&zone->lock);
++	spin_unlock_irqrestore(&zone->lock, flags);
+ }
+ 
+ static void __free_pages_ok(struct page *page, unsigned int order)
+ {
+ 	unsigned long flags;
+-	int i;
+-	int bad = 0;
++	int i, this_cpu, bad = 0;
+ 	int wasMlocked = TestClearPageMlocked(page);
+ 
+ 	kmemcheck_free_shadow(page, order);
+@@ -574,13 +627,13 @@
+ 	arch_free_page(page, order);
+ 	kernel_map_pages(page, 1 << order, 0);
+ 
+-	local_irq_save(flags);
++	lock_cpu_pcp(&flags, &this_cpu);
+ 	if (unlikely(wasMlocked))
+ 		free_page_mlock(page);
+-	__count_vm_events(PGFREE, 1 << order);
++	count_vm_events(PGFREE, 1 << order);
++	unlock_cpu_pcp(flags, this_cpu);
+ 	free_one_page(page_zone(page), page, order,
+-					get_pageblock_migratetype(page));
+-	local_irq_restore(flags);
++		      get_pageblock_migratetype(page));
+ }
+ 
+ /*
+@@ -915,6 +968,16 @@
+ 	return i;
+ }
+ 
++static void
++isolate_pcp_pages(int count, struct list_head *src, struct list_head *dst)
++{
++	while (count--) {
++		struct page *page = list_last_entry(src, struct page, lru);
++		list_move(&page->lru, dst);
++	}
++}
++
++
+ #ifdef CONFIG_NUMA
+ /*
+  * Called from the vmstat counter updater to drain pagesets of this
+@@ -926,17 +989,20 @@
+  */
+ void drain_zone_pages(struct zone *zone, struct per_cpu_pages *pcp)
+ {
++	LIST_HEAD(free_list);
+ 	unsigned long flags;
+ 	int to_drain;
++	int this_cpu;
+ 
+-	local_irq_save(flags);
++	lock_cpu_pcp(&flags, &this_cpu);
+ 	if (pcp->count >= pcp->batch)
+ 		to_drain = pcp->batch;
+ 	else
+ 		to_drain = pcp->count;
+-	free_pages_bulk(zone, to_drain, &pcp->list, 0);
++	isolate_pcp_pages(to_drain, &pcp->list, &free_list);
+ 	pcp->count -= to_drain;
+-	local_irq_restore(flags);
++	unlock_cpu_pcp(flags, this_cpu);
++	free_pages_bulk(zone, to_drain, &free_list, 0);
+ }
+ #endif
+ 
+@@ -955,14 +1021,22 @@
+ 	for_each_populated_zone(zone) {
+ 		struct per_cpu_pageset *pset;
+ 		struct per_cpu_pages *pcp;
++		LIST_HEAD(free_list);
++		int count;
+ 
++		__lock_cpu_pcp(&flags, cpu);
+ 		pset = zone_pcp(zone, cpu);
+-
++		if (!pset) {
++			unlock_cpu_pcp(flags, cpu);
++			WARN_ON(1);
++			continue;
++		}
+ 		pcp = &pset->pcp;
+-		local_irq_save(flags);
+-		free_pages_bulk(zone, pcp->count, &pcp->list, 0);
++		isolate_pcp_pages(pcp->count, &pcp->list, &free_list);
++		count = pcp->count;
+ 		pcp->count = 0;
+-		local_irq_restore(flags);
++		unlock_cpu_pcp(flags, cpu);
++		free_pages_bulk(zone, count, &free_list, 0);
+ 	}
+ }
+ 
+@@ -974,12 +1048,52 @@
+ 	drain_pages(smp_processor_id());
+ }
+ 
++#ifdef CONFIG_PREEMPT_RT
++static void drain_local_pages_work(struct work_struct *wrk)
++{
++	drain_pages(smp_processor_id());
++}
++#endif
++
+ /*
+  * Spill all the per-cpu pages from all CPUs back into the buddy allocator
+  */
+ void drain_all_pages(void)
+ {
++#ifdef CONFIG_PREEMPT_RT
++	/*
++	 * HACK!!!!!
++	 *  For RT we can't use IPIs to run drain_local_pages, since
++	 *  that code will call spin_locks that will now sleep.
++	 *  But, schedule_on_each_cpu will call kzalloc, which will
++	 *  call page_alloc which was what calls this.
++	 *
++	 *  Luckily, there's a condition to get here, and that is if
++	 *  the order passed in to alloc_pages is greater than 0
++	 *  (alloced more than a page size).  The slabs only allocate
++	 *  what is needed, and the allocation made by schedule_on_each_cpu
++	 *  does an alloc of "sizeof(void *)*nr_cpu_ids".
++	 *
++	 *  So we can safely call schedule_on_each_cpu if that number
++	 *  is less than a page. Otherwise don't bother. At least warn of
++	 *  this issue.
++	 *
++	 * And yes, this is one big hack.  Please fix ;-)
++	 */
++	if (sizeof(void *)*nr_cpu_ids < PAGE_SIZE)
++		schedule_on_each_cpu(drain_local_pages_work);
++	else {
++		static int once;
++		if (!once) {
++			printk(KERN_ERR "Can't drain all CPUS due to possible recursion\n");
++			once = 1;
++		}
++		drain_local_pages(NULL);
++	}
++
++#else
+ 	on_each_cpu(drain_local_pages, NULL, 1);
++#endif
+ }
+ 
+ #ifdef CONFIG_HIBERNATION
+@@ -1024,9 +1138,10 @@
+ static void free_hot_cold_page(struct page *page, int cold)
+ {
+ 	struct zone *zone = page_zone(page);
++	struct per_cpu_pageset *pset;
+ 	struct per_cpu_pages *pcp;
+ 	unsigned long flags;
+-	int wasMlocked = TestClearPageMlocked(page);
++	int count, this_cpu, wasMlocked = TestClearPageMlocked(page);
+ 
+ 	kmemcheck_free_shadow(page, 0);
+ 
+@@ -1042,12 +1157,12 @@
+ 	arch_free_page(page, 0);
+ 	kernel_map_pages(page, 1, 0);
+ 
+-	pcp = &zone_pcp(zone, get_cpu())->pcp;
++	pset = get_zone_pcp(zone, &flags, &this_cpu);
++	pcp = &pset->pcp;
+ 	set_page_private(page, get_pageblock_migratetype(page));
+-	local_irq_save(flags);
+ 	if (unlikely(wasMlocked))
+ 		free_page_mlock(page);
+-	__count_vm_event(PGFREE);
++	count_vm_event(PGFREE);
+ 
+ 	if (cold)
+ 		list_add_tail(&page->lru, &pcp->list);
+@@ -1055,11 +1170,15 @@
+ 		list_add(&page->lru, &pcp->list);
+ 	pcp->count++;
+ 	if (pcp->count >= pcp->high) {
+-		free_pages_bulk(zone, pcp->batch, &pcp->list, 0);
++		LIST_HEAD(free_list);
++
++		isolate_pcp_pages(pcp->batch, &pcp->list, &free_list);
+ 		pcp->count -= pcp->batch;
+-	}
+-	local_irq_restore(flags);
+-	put_cpu();
++		count = pcp->batch;
++		put_zone_pcp(zone, flags, this_cpu);
++		free_pages_bulk(zone, count, &free_list, 0);
++	} else
++		put_zone_pcp(zone, flags, this_cpu);
+ }
+ 
+ void free_hot_page(struct page *page)
+@@ -1113,15 +1232,15 @@
+ 	unsigned long flags;
+ 	struct page *page;
+ 	int cold = !!(gfp_flags & __GFP_COLD);
+-	int cpu;
++	struct per_cpu_pageset *pset;
++	int this_cpu;
+ 
+ again:
+-	cpu  = get_cpu();
++	pset = get_zone_pcp(zone, &flags, &this_cpu);
++
+ 	if (likely(order == 0)) {
+-		struct per_cpu_pages *pcp;
++		struct per_cpu_pages *pcp = &pset->pcp;
+ 
+-		pcp = &zone_pcp(zone, cpu)->pcp;
+-		local_irq_save(flags);
+ 		if (!pcp->count) {
+ 			pcp->count = rmqueue_bulk(zone, 0,
+ 					pcp->batch, &pcp->list,
+@@ -1165,7 +1284,7 @@
+ 			 */
+ 			WARN_ON_ONCE(order > 1);
+ 		}
+-		spin_lock_irqsave(&zone->lock, flags);
++		spin_lock(&zone->lock);
+ 		page = __rmqueue(zone, order, migratetype);
+ 		__mod_zone_page_state(zone, NR_FREE_PAGES, -(1 << order));
+ 		spin_unlock(&zone->lock);
+@@ -1175,8 +1294,7 @@
+ 
+ 	__count_zone_vm_events(PGALLOC, zone, 1 << order);
+ 	zone_statistics(preferred_zone, zone);
+-	local_irq_restore(flags);
+-	put_cpu();
++	put_zone_pcp(zone, flags, this_cpu);
+ 
+ 	VM_BUG_ON(bad_range(zone, page));
+ 	if (prep_new_page(page, order, gfp_flags))
+@@ -1184,8 +1302,7 @@
+ 	return page;
+ 
+ failed:
+-	local_irq_restore(flags);
+-	put_cpu();
++	put_zone_pcp(zone, flags, this_cpu);
+ 	return NULL;
+ }
+ 
+@@ -3061,7 +3178,23 @@
+ 	struct zone *zone;
+ 
+ 	for_each_zone(zone) {
+-		struct per_cpu_pageset *pset = zone_pcp(zone, cpu);
++		unsigned long flags;
++		struct per_cpu_pageset *pset;
++
++		/*
++		 * On PREEMPT_RT the allocator is preemptible, therefore
++		 * kstopmachine can preempt a process in the middle of an
++		 * allocation, freeing the pset underneath such a process
++		 * isn't a good idea.
++		 *
++		 * Take the per-cpu pcp lock to allow the task to complete
++		 * before we free it. New tasks will be held off by the
++		 * cpu_online() check in get_cpu_var_locked().
++		 */
++		__lock_cpu_pcp(&flags, cpu);
++		pset = zone_pcp(zone, cpu);
++		zone_pcp(zone, cpu) = NULL;
++		unlock_cpu_pcp(flags, cpu);
+ 
+ 		/* Free per_cpu_pageset if it is slab allocated */
+ 		if (pset != &boot_pageset[cpu])
+Index: linux-rt-2.6.31/mm/page_cgroup.c
+===================================================================
+--- linux-rt-2.6.31.orig/mm/page_cgroup.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/mm/page_cgroup.c	2010-05-17 14:23:20.138567292 +0200
+@@ -14,6 +14,7 @@
+ __init_page_cgroup(struct page_cgroup *pc, unsigned long pfn)
+ {
+ 	pc->flags = 0;
++	spin_lock_init(&pc->lock);
+ 	pc->mem_cgroup = NULL;
+ 	pc->page = pfn_to_page(pfn);
+ 	INIT_LIST_HEAD(&pc->lru);
+Index: linux-rt-2.6.31/mm/quicklist.c
+===================================================================
+--- linux-rt-2.6.31.orig/mm/quicklist.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/mm/quicklist.c	2010-05-17 14:23:20.138567292 +0200
+@@ -19,7 +19,7 @@
+ #include <linux/module.h>
+ #include <linux/quicklist.h>
+ 
+-DEFINE_PER_CPU(struct quicklist, quicklist)[CONFIG_NR_QUICK];
++DEFINE_PER_CPU_LOCKED(struct quicklist, quicklist)[CONFIG_NR_QUICK];
+ 
+ #define FRACTION_OF_NODE_MEM	16
+ 
+@@ -66,17 +66,14 @@
+ {
+ 	long pages_to_free;
+ 	struct quicklist *q;
++	int cpu;
+ 
+-	q = &get_cpu_var(quicklist)[nr];
++	q = &get_cpu_var_locked(quicklist, &cpu)[nr];
+ 	if (q->nr_pages > min_pages) {
+ 		pages_to_free = min_pages_to_free(q, min_pages, max_free);
+ 
+ 		while (pages_to_free > 0) {
+-			/*
+-			 * We pass a gfp_t of 0 to quicklist_alloc here
+-			 * because we will never call into the page allocator.
+-			 */
+-			void *p = quicklist_alloc(nr, 0, NULL);
++			void *p = __quicklist_alloc(q);
+ 
+ 			if (dtor)
+ 				dtor(p);
+@@ -84,7 +81,7 @@
+ 			pages_to_free--;
+ 		}
+ 	}
+-	put_cpu_var(quicklist);
++	put_cpu_var_locked(quicklist, cpu);
+ }
+ 
+ unsigned long quicklist_total_size(void)
+@@ -94,7 +91,7 @@
+ 	struct quicklist *ql, *q;
+ 
+ 	for_each_online_cpu(cpu) {
+-		ql = per_cpu(quicklist, cpu);
++		ql = per_cpu_var_locked(quicklist, cpu);
+ 		for (q = ql; q < ql + CONFIG_NR_QUICK; q++)
+ 			count += q->nr_pages;
+ 	}
+Index: linux-rt-2.6.31/mm/slab.c
+===================================================================
+--- linux-rt-2.6.31.orig/mm/slab.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/mm/slab.c	2010-05-17 14:23:20.138567292 +0200
+@@ -121,6 +121,157 @@
+ #include	<asm/page.h>
+ 
+ /*
++ * On !PREEMPT_RT, raw irq flags are used as a per-CPU locking
++ * mechanism.
++ *
++ * On PREEMPT_RT, we use per-CPU locks for this. That's why the
++ * calling convention is changed slightly: a new 'flags' argument
++ * is passed to 'irq disable/enable' - the PREEMPT_RT code stores
++ * the CPU number of the lock there.
++ */
++#ifndef CONFIG_PREEMPT_RT
++
++# define slab_irq_disable(cpu) \
++	do { local_irq_disable(); (cpu) = smp_processor_id(); } while (0)
++# define slab_irq_enable(cpu)		local_irq_enable()
++
++static inline void slab_irq_disable_this_rt(int cpu)
++{
++}
++
++static inline void slab_irq_enable_rt(int cpu)
++{
++}
++
++# define slab_irq_save(flags, cpu) \
++	do { local_irq_save(flags); (cpu) = smp_processor_id(); } while (0)
++# define slab_irq_restore(flags, cpu)	local_irq_restore(flags)
++
++/*
++ * In the __GFP_WAIT case we enable/disable interrupts on !PREEMPT_RT,
++ * which has no per-CPU locking effect since we are holding the cache
++ * lock in that case already.
++ */
++static void slab_irq_enable_GFP_WAIT(gfp_t flags, int *cpu)
++{
++	if (flags & __GFP_WAIT)
++		local_irq_enable();
++}
++
++static void slab_irq_disable_GFP_WAIT(gfp_t flags, int *cpu)
++{
++	if (flags & __GFP_WAIT)
++		local_irq_disable();
++}
++
++#define slab_spin_trylock_irq(lock, cpu) \
++	({ int __l = spin_trylock_irq(lock); if (__l) (cpu) = smp_processor_id(); __l; })
++
++# define slab_spin_lock_irq(lock, cpu) \
++	do { spin_lock_irq(lock); (cpu) = smp_processor_id(); } while (0)
++# define slab_spin_unlock_irq(lock, cpu) spin_unlock_irq(lock)
++
++# define slab_spin_lock_irqsave(lock, flags, cpu) \
++	do { spin_lock_irqsave(lock, flags); (cpu) = smp_processor_id(); } while (0)
++# define slab_spin_unlock_irqrestore(lock, flags, cpu) \
++	do { spin_unlock_irqrestore(lock, flags); } while (0)
++
++#else /* CONFIG_PREEMPT_RT */
++
++/*
++ * Instead of serializing the per-cpu state by disabling interrupts we do so
++ * by a lock. This keeps the code preemptable - albeit at the cost of remote
++ * memory access when the task does get migrated away.
++ */
++DEFINE_PER_CPU_LOCKED(struct list_head, slab) = { 0, };
++
++static void _slab_irq_disable(int *cpu)
++{
++	(void)get_cpu_var_locked(slab, cpu);
++}
++
++#define slab_irq_disable(cpu) _slab_irq_disable(&(cpu))
++
++static inline void slab_irq_enable(int cpu)
++{
++	LIST_HEAD(list);
++
++	list_splice_init(&__get_cpu_var_locked(slab, cpu), &list);
++	put_cpu_var_locked(slab, cpu);
++
++	while (!list_empty(&list)) {
++		struct page *page = list_first_entry(&list, struct page, lru);
++		list_del(&page->lru);
++		__free_pages(page, page->index);
++	}
++}
++
++static inline void slab_irq_disable_this_rt(int cpu)
++{
++	spin_lock(&__get_cpu_lock(slab, cpu));
++}
++
++static inline void slab_irq_enable_rt(int cpu)
++{
++	LIST_HEAD(list);
++
++	list_splice_init(&__get_cpu_var_locked(slab, cpu), &list);
++	spin_unlock(&__get_cpu_lock(slab, cpu));
++
++	while (!list_empty(&list)) {
++		struct page *page = list_first_entry(&list, struct page, lru);
++		list_del(&page->lru);
++		__free_pages(page, page->index);
++	}
++}
++
++# define slab_irq_save(flags, cpu) \
++	do { slab_irq_disable(cpu); (void) (flags); } while (0)
++# define slab_irq_restore(flags, cpu) \
++	do { slab_irq_enable(cpu); (void) (flags); } while (0)
++
++/*
++ * On PREEMPT_RT we have to drop the locks unconditionally to avoid lock
++ * recursion on the cache_grow()->alloc_slabmgmt() path.
++ */
++static void slab_irq_enable_GFP_WAIT(gfp_t flags, int *cpu)
++{
++	slab_irq_enable(*cpu);
++}
++
++static void slab_irq_disable_GFP_WAIT(gfp_t flags, int *cpu)
++{
++	slab_irq_disable(*cpu);
++}
++
++static int _slab_spin_trylock_irq(spinlock_t *lock, int *cpu)
++{
++	int locked;
++
++	slab_irq_disable(*cpu);
++	locked = spin_trylock(lock);
++	if (!locked)
++		slab_irq_enable(*cpu);
++
++	return locked;
++}
++
++# define slab_spin_trylock_irq(lock, cpu) \
++	_slab_spin_trylock_irq((lock), &(cpu))
++
++# define slab_spin_lock_irq(lock, cpu) \
++		do { slab_irq_disable(cpu); spin_lock(lock); } while (0)
++# define slab_spin_unlock_irq(lock, cpu) \
++		do { spin_unlock(lock); slab_irq_enable(cpu); } while (0)
++
++# define slab_spin_lock_irqsave(lock, flags, cpu) \
++	do { slab_irq_disable(cpu); spin_lock_irqsave(lock, flags); } while (0)
++# define slab_spin_unlock_irqrestore(lock, flags, cpu) \
++	do { spin_unlock_irqrestore(lock, flags); slab_irq_enable(cpu); } while (0)
++
++#endif /* CONFIG_PREEMPT_RT */
++
++/*
+  * DEBUG	- 1 for kmem_cache_create() to honour; SLAB_RED_ZONE & SLAB_POISON.
+  *		  0 for faster, smaller code (especially in the critical paths).
+  *
+@@ -316,7 +467,7 @@
+ static int drain_freelist(struct kmem_cache *cache,
+ 			struct kmem_list3 *l3, int tofree);
+ static void free_block(struct kmem_cache *cachep, void **objpp, int len,
+-			int node);
++		       int node, int *this_cpu);
+ static int enable_cpucache(struct kmem_cache *cachep, gfp_t gfp);
+ static void cache_reap(struct work_struct *unused);
+ 
+@@ -687,9 +838,10 @@
+ 
+ static DEFINE_PER_CPU(struct delayed_work, reap_work);
+ 
+-static inline struct array_cache *cpu_cache_get(struct kmem_cache *cachep)
++static inline struct array_cache *
++cpu_cache_get(struct kmem_cache *cachep, int this_cpu)
+ {
+-	return cachep->array[smp_processor_id()];
++	return cachep->array[this_cpu];
+ }
+ 
+ static inline struct kmem_cache *__find_general_cachep(size_t size,
+@@ -930,7 +1082,7 @@
+ #ifndef CONFIG_NUMA
+ 
+ #define drain_alien_cache(cachep, alien) do { } while (0)
+-#define reap_alien(cachep, l3) do { } while (0)
++#define reap_alien(cachep, l3) 0
+ 
+ static inline struct array_cache **alloc_alien_cache(int node, int limit, gfp_t gfp)
+ {
+@@ -941,27 +1093,28 @@
+ {
+ }
+ 
+-static inline int cache_free_alien(struct kmem_cache *cachep, void *objp)
++static inline int
++cache_free_alien(struct kmem_cache *cachep, void *objp, int *this_cpu)
+ {
+ 	return 0;
+ }
+ 
+ static inline void *alternate_node_alloc(struct kmem_cache *cachep,
+-		gfp_t flags)
++					 gfp_t flags, int *this_cpu)
+ {
+ 	return NULL;
+ }
+ 
+ static inline void *____cache_alloc_node(struct kmem_cache *cachep,
+-		 gfp_t flags, int nodeid)
++					 gfp_t flags, int nodeid, int *this_cpu)
+ {
+ 	return NULL;
+ }
+ 
+ #else	/* CONFIG_NUMA */
+ 
+-static void *____cache_alloc_node(struct kmem_cache *, gfp_t, int);
+-static void *alternate_node_alloc(struct kmem_cache *, gfp_t);
++static void *____cache_alloc_node(struct kmem_cache *, gfp_t, int, int *);
++static void *alternate_node_alloc(struct kmem_cache *, gfp_t, int *);
+ 
+ static struct array_cache **alloc_alien_cache(int node, int limit, gfp_t gfp)
+ {
+@@ -1002,7 +1155,8 @@
+ }
+ 
+ static void __drain_alien_cache(struct kmem_cache *cachep,
+-				struct array_cache *ac, int node)
++				struct array_cache *ac, int node,
++				int *this_cpu)
+ {
+ 	struct kmem_list3 *rl3 = cachep->nodelists[node];
+ 
+@@ -1016,7 +1170,7 @@
+ 		if (rl3->shared)
+ 			transfer_objects(rl3->shared, ac, ac->limit);
+ 
+-		free_block(cachep, ac->entry, ac->avail, node);
++		free_block(cachep, ac->entry, ac->avail, node, this_cpu);
+ 		ac->avail = 0;
+ 		spin_unlock(&rl3->list_lock);
+ 	}
+@@ -1025,38 +1179,43 @@
+ /*
+  * Called from cache_reap() to regularly drain alien caches round robin.
+  */
+-static void reap_alien(struct kmem_cache *cachep, struct kmem_list3 *l3)
++static int
++reap_alien(struct kmem_cache *cachep, struct kmem_list3 *l3)
+ {
+ 	int node = __get_cpu_var(reap_node);
++	int this_cpu;
+ 
+ 	if (l3->alien) {
+ 		struct array_cache *ac = l3->alien[node];
+ 
+-		if (ac && ac->avail && spin_trylock_irq(&ac->lock)) {
+-			__drain_alien_cache(cachep, ac, node);
+-			spin_unlock_irq(&ac->lock);
++		if (ac && ac->avail && slab_spin_trylock_irq(&ac->lock, this_cpu)) {
++			__drain_alien_cache(cachep, ac, node, &this_cpu);
++			slab_spin_unlock_irq(&ac->lock, this_cpu);
++			return 1;
+ 		}
+ 	}
++	return 0;
+ }
+ 
+ static void drain_alien_cache(struct kmem_cache *cachep,
+ 				struct array_cache **alien)
+ {
+-	int i = 0;
++	int i = 0, this_cpu;
+ 	struct array_cache *ac;
+ 	unsigned long flags;
+ 
+ 	for_each_online_node(i) {
+ 		ac = alien[i];
+ 		if (ac) {
+-			spin_lock_irqsave(&ac->lock, flags);
+-			__drain_alien_cache(cachep, ac, i);
+-			spin_unlock_irqrestore(&ac->lock, flags);
++			slab_spin_lock_irqsave(&ac->lock, flags, this_cpu);
++			__drain_alien_cache(cachep, ac, i, &this_cpu);
++			slab_spin_unlock_irqrestore(&ac->lock, flags, this_cpu);
+ 		}
+ 	}
+ }
+ 
+-static inline int cache_free_alien(struct kmem_cache *cachep, void *objp)
++static inline int
++cache_free_alien(struct kmem_cache *cachep, void *objp, int *this_cpu)
+ {
+ 	struct slab *slabp = virt_to_slab(objp);
+ 	int nodeid = slabp->nodeid;
+@@ -1064,7 +1223,7 @@
+ 	struct array_cache *alien = NULL;
+ 	int node;
+ 
+-	node = numa_node_id();
++	node = cpu_to_node(*this_cpu);
+ 
+ 	/*
+ 	 * Make sure we are not freeing a object from another node to the array
+@@ -1080,20 +1239,20 @@
+ 		spin_lock(&alien->lock);
+ 		if (unlikely(alien->avail == alien->limit)) {
+ 			STATS_INC_ACOVERFLOW(cachep);
+-			__drain_alien_cache(cachep, alien, nodeid);
++			__drain_alien_cache(cachep, alien, nodeid, this_cpu);
+ 		}
+ 		alien->entry[alien->avail++] = objp;
+ 		spin_unlock(&alien->lock);
+ 	} else {
+ 		spin_lock(&(cachep->nodelists[nodeid])->list_lock);
+-		free_block(cachep, &objp, 1, nodeid);
++		free_block(cachep, &objp, 1, nodeid, this_cpu);
+ 		spin_unlock(&(cachep->nodelists[nodeid])->list_lock);
+ 	}
+ 	return 1;
+ }
+ #endif
+ 
+-static void __cpuinit cpuup_canceled(long cpu)
++static void __cpuinit cpuup_canceled(int cpu)
+ {
+ 	struct kmem_cache *cachep;
+ 	struct kmem_list3 *l3 = NULL;
+@@ -1104,6 +1263,7 @@
+ 		struct array_cache *nc;
+ 		struct array_cache *shared;
+ 		struct array_cache **alien;
++		int orig_cpu = cpu;
+ 
+ 		/* cpu is dead; no one can alloc from it. */
+ 		nc = cachep->array[cpu];
+@@ -1118,7 +1278,8 @@
+ 		/* Free limit for this kmem_list3 */
+ 		l3->free_limit -= cachep->batchcount;
+ 		if (nc)
+-			free_block(cachep, nc->entry, nc->avail, node);
++			free_block(cachep, nc->entry, nc->avail, node,
++				   &cpu);
+ 
+ 		if (!cpus_empty(*mask)) {
+ 			spin_unlock_irq(&l3->list_lock);
+@@ -1128,7 +1289,7 @@
+ 		shared = l3->shared;
+ 		if (shared) {
+ 			free_block(cachep, shared->entry,
+-				   shared->avail, node);
++				   shared->avail, node, &cpu);
+ 			l3->shared = NULL;
+ 		}
+ 
+@@ -1144,6 +1305,7 @@
+ 		}
+ free_array_cache:
+ 		kfree(nc);
++		BUG_ON(cpu != orig_cpu);
+ 	}
+ 	/*
+ 	 * In the previous loop, all the objects were freed to
+@@ -1158,7 +1320,7 @@
+ 	}
+ }
+ 
+-static int __cpuinit cpuup_prepare(long cpu)
++static int __cpuinit cpuup_prepare(int cpu)
+ {
+ 	struct kmem_cache *cachep;
+ 	struct kmem_list3 *l3 = NULL;
+@@ -1266,10 +1428,19 @@
+ 	long cpu = (long)hcpu;
+ 	int err = 0;
+ 
++
+ 	switch (action) {
+ 	case CPU_UP_PREPARE:
+ 	case CPU_UP_PREPARE_FROZEN:
+ 		mutex_lock(&cache_chain_mutex);
++		/*
++		 * lock/unlock cycle to push any holders away -- no new ones
++		 * can come in due to the cpu still being offline.
++		 *
++		 * XXX -- weird case anyway, can it happen?
++		 */
++		slab_irq_disable_this_rt(cpu);
++		slab_irq_enable_rt(cpu);
+ 		err = cpuup_prepare(cpu);
+ 		mutex_unlock(&cache_chain_mutex);
+ 		break;
+@@ -1309,10 +1480,14 @@
+ 	case CPU_UP_CANCELED:
+ 	case CPU_UP_CANCELED_FROZEN:
+ 		mutex_lock(&cache_chain_mutex);
++		slab_irq_disable_this_rt(cpu);
+ 		cpuup_canceled(cpu);
++		slab_irq_enable_rt(cpu);
+ 		mutex_unlock(&cache_chain_mutex);
+ 		break;
+ 	}
++
++
+ 	return err ? NOTIFY_BAD : NOTIFY_OK;
+ }
+ 
+@@ -1370,6 +1545,12 @@
+ 	int order;
+ 	int node;
+ 
++#ifdef CONFIG_PREEMPT_RT
++	for_each_possible_cpu(i) {
++		INIT_LIST_HEAD(&__get_cpu_var_locked(slab, i));
++	}
++#endif
++
+ 	if (num_possible_nodes() == 1)
+ 		use_alien_caches = 0;
+ 
+@@ -1499,32 +1680,34 @@
+ 	/* 4) Replace the bootstrap head arrays */
+ 	{
+ 		struct array_cache *ptr;
++		int cpu = smp_processor_id();
+ 
+ 		ptr = kmalloc(sizeof(struct arraycache_init), GFP_NOWAIT);
+ 
+-		BUG_ON(cpu_cache_get(&cache_cache) != &initarray_cache.cache);
+-		memcpy(ptr, cpu_cache_get(&cache_cache),
++		BUG_ON(cpu_cache_get(&cache_cache, cpu) !=
++		       &initarray_cache.cache);
++		memcpy(ptr, cpu_cache_get(&cache_cache, cpu),
+ 		       sizeof(struct arraycache_init));
+ 		/*
+ 		 * Do not assume that spinlocks can be initialized via memcpy:
+ 		 */
+ 		spin_lock_init(&ptr->lock);
+ 
+-		cache_cache.array[smp_processor_id()] = ptr;
++		cache_cache.array[cpu] = ptr;
+ 
+ 		ptr = kmalloc(sizeof(struct arraycache_init), GFP_NOWAIT);
+ 
+-		BUG_ON(cpu_cache_get(malloc_sizes[INDEX_AC].cs_cachep)
++		BUG_ON(cpu_cache_get(malloc_sizes[INDEX_AC].cs_cachep, cpu)
+ 		       != &initarray_generic.cache);
+-		memcpy(ptr, cpu_cache_get(malloc_sizes[INDEX_AC].cs_cachep),
++		memcpy(ptr,
++		       cpu_cache_get(malloc_sizes[INDEX_AC].cs_cachep, cpu),
+ 		       sizeof(struct arraycache_init));
+ 		/*
+ 		 * Do not assume that spinlocks can be initialized via memcpy:
+ 		 */
+ 		spin_lock_init(&ptr->lock);
+ 
+-		malloc_sizes[INDEX_AC].cs_cachep->array[smp_processor_id()] =
+-		    ptr;
++		malloc_sizes[INDEX_AC].cs_cachep->array[cpu] = ptr;
+ 	}
+ 	/* 5) Replace the bootstrap kmem_list3's */
+ 	{
+@@ -1642,12 +1825,14 @@
+ /*
+  * Interface to system's page release.
+  */
+-static void kmem_freepages(struct kmem_cache *cachep, void *addr)
++static void kmem_freepages(struct kmem_cache *cachep, void *addr, int cpu)
+ {
+ 	unsigned long i = (1 << cachep->gfporder);
+-	struct page *page = virt_to_page(addr);
++	struct page *page, *basepage = virt_to_page(addr);
+ 	const unsigned long nr_freed = i;
+ 
++	page = basepage;
++
+ 	kmemcheck_free_shadow(page, cachep->gfporder);
+ 
+ 	if (cachep->flags & SLAB_RECLAIM_ACCOUNT)
+@@ -1656,6 +1841,7 @@
+ 	else
+ 		sub_zone_page_state(page_zone(page),
+ 				NR_SLAB_UNRECLAIMABLE, nr_freed);
++
+ 	while (i--) {
+ 		BUG_ON(!PageSlab(page));
+ 		__ClearPageSlab(page);
+@@ -1663,6 +1849,13 @@
+ 	}
+ 	if (current->reclaim_state)
+ 		current->reclaim_state->reclaimed_slab += nr_freed;
++
++#ifdef CONFIG_PREEMPT_RT
++	if (cpu >= 0) {
++		basepage->index = cachep->gfporder;
++		list_add(&basepage->lru, &__get_cpu_var_locked(slab, cpu));
++	} else
++#endif
+ 	free_pages((unsigned long)addr, cachep->gfporder);
+ }
+ 
+@@ -1671,7 +1864,7 @@
+ 	struct slab_rcu *slab_rcu = (struct slab_rcu *)head;
+ 	struct kmem_cache *cachep = slab_rcu->cachep;
+ 
+-	kmem_freepages(cachep, slab_rcu->addr);
++	kmem_freepages(cachep, slab_rcu->addr, -1);
+ 	if (OFF_SLAB(cachep))
+ 		kmem_cache_free(cachep->slabp_cache, slab_rcu);
+ }
+@@ -1691,7 +1884,7 @@
+ 
+ 	*addr++ = 0x12345678;
+ 	*addr++ = caller;
+-	*addr++ = smp_processor_id();
++	*addr++ = raw_smp_processor_id();
+ 	size -= 3 * sizeof(unsigned long);
+ 	{
+ 		unsigned long *sptr = &caller;
+@@ -1881,6 +2074,10 @@
+ }
+ #endif
+ 
++static void
++__cache_free(struct kmem_cache *cachep, void *objp, int *this_cpu);
++
++
+ /**
+  * slab_destroy - destroy and release all objects in a slab
+  * @cachep: cache pointer being destroyed
+@@ -1890,7 +2087,8 @@
+  * Before calling the slab must have been unlinked from the cache.  The
+  * cache-lock is not held/needed.
+  */
+-static void slab_destroy(struct kmem_cache *cachep, struct slab *slabp)
++static void
++slab_destroy(struct kmem_cache *cachep, struct slab *slabp, int *this_cpu)
+ {
+ 	void *addr = slabp->s_mem - slabp->colouroff;
+ 
+@@ -1903,9 +2101,13 @@
+ 		slab_rcu->addr = addr;
+ 		call_rcu(&slab_rcu->head, kmem_rcu_free);
+ 	} else {
+-		kmem_freepages(cachep, addr);
+-		if (OFF_SLAB(cachep))
+-			kmem_cache_free(cachep->slabp_cache, slabp);
++		kmem_freepages(cachep, addr, *this_cpu);
++		if (OFF_SLAB(cachep)) {
++			if (this_cpu)
++				__cache_free(cachep->slabp_cache, slabp, this_cpu);
++			else
++				kmem_cache_free(cachep->slabp_cache, slabp);
++		}
+ 	}
+ }
+ 
+@@ -2002,6 +2204,8 @@
+ 
+ static int __init_refok setup_cpu_cache(struct kmem_cache *cachep, gfp_t gfp)
+ {
++	int this_cpu;
++
+ 	if (g_cpucache_up == FULL)
+ 		return enable_cpucache(cachep, gfp);
+ 
+@@ -2045,10 +2249,12 @@
+ 			jiffies + REAPTIMEOUT_LIST3 +
+ 			((unsigned long)cachep) % REAPTIMEOUT_LIST3;
+ 
+-	cpu_cache_get(cachep)->avail = 0;
+-	cpu_cache_get(cachep)->limit = BOOT_CPUCACHE_ENTRIES;
+-	cpu_cache_get(cachep)->batchcount = 1;
+-	cpu_cache_get(cachep)->touched = 0;
++	this_cpu = raw_smp_processor_id();
++
++	cpu_cache_get(cachep, this_cpu)->avail = 0;
++	cpu_cache_get(cachep, this_cpu)->limit = BOOT_CPUCACHE_ENTRIES;
++	cpu_cache_get(cachep, this_cpu)->batchcount = 1;
++	cpu_cache_get(cachep, this_cpu)->touched = 0;
+ 	cachep->batchcount = 1;
+ 	cachep->limit = BOOT_CPUCACHE_ENTRIES;
+ 	return 0;
+@@ -2358,19 +2564,19 @@
+ #if DEBUG
+ static void check_irq_off(void)
+ {
++/*
++ * On PREEMPT_RT we use locks to protect the per-CPU lists,
++ * and keep interrupts enabled.
++ */
++#ifndef CONFIG_PREEMPT_RT
+ 	BUG_ON(!irqs_disabled());
++#endif
+ }
+ 
+ static void check_irq_on(void)
+ {
++#ifndef CONFIG_PREEMPT_RT
+ 	BUG_ON(irqs_disabled());
+-}
+-
+-static void check_spinlock_acquired(struct kmem_cache *cachep)
+-{
+-#ifdef CONFIG_SMP
+-	check_irq_off();
+-	assert_spin_locked(&cachep->nodelists[numa_node_id()]->list_lock);
+ #endif
+ }
+ 
+@@ -2385,34 +2591,67 @@
+ #else
+ #define check_irq_off()	do { } while(0)
+ #define check_irq_on()	do { } while(0)
+-#define check_spinlock_acquired(x) do { } while(0)
+ #define check_spinlock_acquired_node(x, y) do { } while(0)
+ #endif
+ 
+-static void drain_array(struct kmem_cache *cachep, struct kmem_list3 *l3,
++static int drain_array(struct kmem_cache *cachep, struct kmem_list3 *l3,
+ 			struct array_cache *ac,
+ 			int force, int node);
+ 
+-static void do_drain(void *arg)
++static void __do_drain(void *arg, int this_cpu)
+ {
+ 	struct kmem_cache *cachep = arg;
++	int node = cpu_to_node(this_cpu);
+ 	struct array_cache *ac;
+-	int node = numa_node_id();
+ 
+ 	check_irq_off();
+-	ac = cpu_cache_get(cachep);
++	ac = cpu_cache_get(cachep, this_cpu);
+ 	spin_lock(&cachep->nodelists[node]->list_lock);
+-	free_block(cachep, ac->entry, ac->avail, node);
++	free_block(cachep, ac->entry, ac->avail, node, &this_cpu);
+ 	spin_unlock(&cachep->nodelists[node]->list_lock);
+ 	ac->avail = 0;
+ }
+ 
++#ifdef CONFIG_PREEMPT_RT
++static void do_drain(void *arg, int this_cpu)
++{
++	__do_drain(arg, this_cpu);
++}
++#else
++static void do_drain(void *arg)
++{
++	__do_drain(arg, smp_processor_id());
++}
++#endif
++
++#ifdef CONFIG_PREEMPT_RT
++/*
++ * execute func() for all CPUs. On PREEMPT_RT we dont actually have
++ * to run on the remote CPUs - we only have to take their CPU-locks.
++ * (This is a rare operation, so cacheline bouncing is not an issue.)
++ */
++static void
++slab_on_each_cpu(void (*func)(void *arg, int this_cpu), void *arg)
++{
++	unsigned int i;
++
++	check_irq_on();
++	for_each_online_cpu(i) {
++		spin_lock(&__get_cpu_lock(slab, i));
++		func(arg, i);
++		spin_unlock(&__get_cpu_lock(slab, i));
++	}
++}
++#else
++# define slab_on_each_cpu(func, cachep) on_each_cpu(func, cachep, 1)
++#endif
++
+ static void drain_cpu_caches(struct kmem_cache *cachep)
+ {
+ 	struct kmem_list3 *l3;
+ 	int node;
+ 
+-	on_each_cpu(do_drain, cachep, 1);
++	slab_on_each_cpu(do_drain, cachep);
+ 	check_irq_on();
+ 	for_each_online_node(node) {
+ 		l3 = cachep->nodelists[node];
+@@ -2437,16 +2676,16 @@
+ 			struct kmem_list3 *l3, int tofree)
+ {
+ 	struct list_head *p;
+-	int nr_freed;
++	int nr_freed, this_cpu;
+ 	struct slab *slabp;
+ 
+ 	nr_freed = 0;
+ 	while (nr_freed < tofree && !list_empty(&l3->slabs_free)) {
+ 
+-		spin_lock_irq(&l3->list_lock);
++		slab_spin_lock_irq(&l3->list_lock, this_cpu);
+ 		p = l3->slabs_free.prev;
+ 		if (p == &l3->slabs_free) {
+-			spin_unlock_irq(&l3->list_lock);
++			slab_spin_unlock_irq(&l3->list_lock, this_cpu);
+ 			goto out;
+ 		}
+ 
+@@ -2455,13 +2694,9 @@
+ 		BUG_ON(slabp->inuse);
+ #endif
+ 		list_del(&slabp->list);
+-		/*
+-		 * Safe to drop the lock. The slab is no longer linked
+-		 * to the cache.
+-		 */
+ 		l3->free_objects -= cache->num;
+-		spin_unlock_irq(&l3->list_lock);
+-		slab_destroy(cache, slabp);
++		slab_destroy(cache, slabp, &this_cpu);
++		slab_spin_unlock_irq(&l3->list_lock, this_cpu);
+ 		nr_freed++;
+ 	}
+ out:
+@@ -2725,8 +2960,8 @@
+  * Grow (by 1) the number of slabs within a cache.  This is called by
+  * kmem_cache_alloc() when there are no active objs left in a cache.
+  */
+-static int cache_grow(struct kmem_cache *cachep,
+-		gfp_t flags, int nodeid, void *objp)
++static int cache_grow(struct kmem_cache *cachep, gfp_t flags, int nodeid,
++		      void *objp, int *this_cpu)
+ {
+ 	struct slab *slabp;
+ 	size_t offset;
+@@ -2754,8 +2989,7 @@
+ 
+ 	offset *= cachep->colour_off;
+ 
+-	if (local_flags & __GFP_WAIT)
+-		local_irq_enable();
++	slab_irq_enable_GFP_WAIT(local_flags, this_cpu);
+ 
+ 	/*
+ 	 * The test for missing atomic flag is performed here, rather than
+@@ -2784,8 +3018,8 @@
+ 
+ 	cache_init_objs(cachep, slabp);
+ 
+-	if (local_flags & __GFP_WAIT)
+-		local_irq_disable();
++	slab_irq_disable_GFP_WAIT(local_flags, this_cpu);
++
+ 	check_irq_off();
+ 	spin_lock(&l3->list_lock);
+ 
+@@ -2796,10 +3030,9 @@
+ 	spin_unlock(&l3->list_lock);
+ 	return 1;
+ opps1:
+-	kmem_freepages(cachep, objp);
++	kmem_freepages(cachep, objp, -1);
+ failed:
+-	if (local_flags & __GFP_WAIT)
+-		local_irq_disable();
++	slab_irq_disable_GFP_WAIT(local_flags, this_cpu);
+ 	return 0;
+ }
+ 
+@@ -2921,7 +3154,8 @@
+ #define check_slabp(x,y) do { } while(0)
+ #endif
+ 
+-static void *cache_alloc_refill(struct kmem_cache *cachep, gfp_t flags)
++static void *
++cache_alloc_refill(struct kmem_cache *cachep, gfp_t flags, int *this_cpu)
+ {
+ 	int batchcount;
+ 	struct kmem_list3 *l3;
+@@ -2931,7 +3165,7 @@
+ retry:
+ 	check_irq_off();
+ 	node = numa_node_id();
+-	ac = cpu_cache_get(cachep);
++	ac = cpu_cache_get(cachep, *this_cpu);
+ 	batchcount = ac->batchcount;
+ 	if (!ac->touched && batchcount > BATCHREFILL_LIMIT) {
+ 		/*
+@@ -2941,7 +3175,7 @@
+ 		 */
+ 		batchcount = BATCHREFILL_LIMIT;
+ 	}
+-	l3 = cachep->nodelists[node];
++	l3 = cachep->nodelists[cpu_to_node(*this_cpu)];
+ 
+ 	BUG_ON(ac->avail > 0 || !l3);
+ 	spin_lock(&l3->list_lock);
+@@ -2964,7 +3198,7 @@
+ 
+ 		slabp = list_entry(entry, struct slab, list);
+ 		check_slabp(cachep, slabp);
+-		check_spinlock_acquired(cachep);
++		check_spinlock_acquired_node(cachep, cpu_to_node(*this_cpu));
+ 
+ 		/*
+ 		 * The slab was either on partial or free list so
+@@ -2978,8 +3212,9 @@
+ 			STATS_INC_ACTIVE(cachep);
+ 			STATS_SET_HIGH(cachep);
+ 
+-			ac->entry[ac->avail++] = slab_get_obj(cachep, slabp,
+-							    node);
++			ac->entry[ac->avail++] =
++				slab_get_obj(cachep, slabp,
++					     cpu_to_node(*this_cpu));
+ 		}
+ 		check_slabp(cachep, slabp);
+ 
+@@ -2998,10 +3233,10 @@
+ 
+ 	if (unlikely(!ac->avail)) {
+ 		int x;
+-		x = cache_grow(cachep, flags | GFP_THISNODE, node, NULL);
++		x = cache_grow(cachep, flags | GFP_THISNODE, cpu_to_node(*this_cpu), NULL, this_cpu);
+ 
+ 		/* cache_grow can reenable interrupts, then ac could change. */
+-		ac = cpu_cache_get(cachep);
++		ac = cpu_cache_get(cachep, *this_cpu);
+ 		if (!x && ac->avail == 0)	/* no objects in sight? abort */
+ 			return NULL;
+ 
+@@ -3088,21 +3323,22 @@
+ 	return should_failslab(obj_size(cachep), flags);
+ }
+ 
+-static inline void *____cache_alloc(struct kmem_cache *cachep, gfp_t flags)
++static inline void *
++____cache_alloc(struct kmem_cache *cachep, gfp_t flags, int *this_cpu)
+ {
+ 	void *objp;
+ 	struct array_cache *ac;
+ 
+ 	check_irq_off();
+ 
+-	ac = cpu_cache_get(cachep);
++	ac = cpu_cache_get(cachep, *this_cpu);
+ 	if (likely(ac->avail)) {
+ 		STATS_INC_ALLOCHIT(cachep);
+ 		ac->touched = 1;
+ 		objp = ac->entry[--ac->avail];
+ 	} else {
+ 		STATS_INC_ALLOCMISS(cachep);
+-		objp = cache_alloc_refill(cachep, flags);
++		objp = cache_alloc_refill(cachep, flags, this_cpu);
+ 	}
+ 	/*
+ 	 * To avoid a false negative, if an object that is in one of the
+@@ -3120,7 +3356,8 @@
+  * If we are in_interrupt, then process context, including cpusets and
+  * mempolicy, may not apply and should not be used for allocation policy.
+  */
+-static void *alternate_node_alloc(struct kmem_cache *cachep, gfp_t flags)
++static void *alternate_node_alloc(struct kmem_cache *cachep, gfp_t flags,
++				int *this_cpu)
+ {
+ 	int nid_alloc, nid_here;
+ 
+@@ -3132,7 +3369,7 @@
+ 	else if (current->mempolicy)
+ 		nid_alloc = slab_node(current->mempolicy);
+ 	if (nid_alloc != nid_here)
+-		return ____cache_alloc_node(cachep, flags, nid_alloc);
++		return ____cache_alloc_node(cachep, flags, nid_alloc, this_cpu);
+ 	return NULL;
+ }
+ 
+@@ -3144,7 +3381,7 @@
+  * allocator to do its reclaim / fallback magic. We then insert the
+  * slab into the proper nodelist and then allocate from it.
+  */
+-static void *fallback_alloc(struct kmem_cache *cache, gfp_t flags)
++static void *fallback_alloc(struct kmem_cache *cache, gfp_t flags, int *this_cpu)
+ {
+ 	struct zonelist *zonelist;
+ 	gfp_t local_flags;
+@@ -3172,7 +3409,8 @@
+ 			cache->nodelists[nid] &&
+ 			cache->nodelists[nid]->free_objects) {
+ 				obj = ____cache_alloc_node(cache,
+-					flags | GFP_THISNODE, nid);
++					flags | GFP_THISNODE, nid,
++					this_cpu);
+ 				if (obj)
+ 					break;
+ 		}
+@@ -3185,20 +3423,21 @@
+ 		 * We may trigger various forms of reclaim on the allowed
+ 		 * set and go into memory reserves if necessary.
+ 		 */
+-		if (local_flags & __GFP_WAIT)
+-			local_irq_enable();
++		slab_irq_enable_GFP_WAIT(local_flags, this_cpu);
++
+ 		kmem_flagcheck(cache, flags);
+-		obj = kmem_getpages(cache, local_flags, numa_node_id());
+-		if (local_flags & __GFP_WAIT)
+-			local_irq_disable();
++		obj = kmem_getpages(cache, local_flags, cpu_to_node(*this_cpu));
++
++		slab_irq_disable_GFP_WAIT(local_flags, this_cpu);
++
+ 		if (obj) {
+ 			/*
+ 			 * Insert into the appropriate per node queues
+ 			 */
+ 			nid = page_to_nid(virt_to_page(obj));
+-			if (cache_grow(cache, flags, nid, obj)) {
++			if (cache_grow(cache, flags, nid, obj, this_cpu)) {
+ 				obj = ____cache_alloc_node(cache,
+-					flags | GFP_THISNODE, nid);
++					flags | GFP_THISNODE, nid, this_cpu);
+ 				if (!obj)
+ 					/*
+ 					 * Another processor may allocate the
+@@ -3219,7 +3458,7 @@
+  * A interface to enable slab creation on nodeid
+  */
+ static void *____cache_alloc_node(struct kmem_cache *cachep, gfp_t flags,
+-				int nodeid)
++				int nodeid, int *this_cpu)
+ {
+ 	struct list_head *entry;
+ 	struct slab *slabp;
+@@ -3267,11 +3506,11 @@
+ 
+ must_grow:
+ 	spin_unlock(&l3->list_lock);
+-	x = cache_grow(cachep, flags | GFP_THISNODE, nodeid, NULL);
++	x = cache_grow(cachep, flags | GFP_THISNODE, nodeid, NULL, this_cpu);
+ 	if (x)
+ 		goto retry;
+ 
+-	return fallback_alloc(cachep, flags);
++	return fallback_alloc(cachep, flags, this_cpu);
+ 
+ done:
+ 	return obj;
+@@ -3294,6 +3533,7 @@
+ 		   void *caller)
+ {
+ 	unsigned long save_flags;
++	int this_cpu, this_node;
+ 	void *ptr;
+ 
+ 	flags &= gfp_allowed_mask;
+@@ -3304,32 +3544,34 @@
+ 		return NULL;
+ 
+ 	cache_alloc_debugcheck_before(cachep, flags);
+-	local_irq_save(save_flags);
+ 
++	slab_irq_save(save_flags, this_cpu);
++
++	this_node = cpu_to_node(this_cpu);
+ 	if (unlikely(nodeid == -1))
+-		nodeid = numa_node_id();
++		nodeid = this_node;
+ 
+ 	if (unlikely(!cachep->nodelists[nodeid])) {
+ 		/* Node not bootstrapped yet */
+-		ptr = fallback_alloc(cachep, flags);
++		ptr = fallback_alloc(cachep, flags, &this_cpu);
+ 		goto out;
+ 	}
+ 
+-	if (nodeid == numa_node_id()) {
++	if (nodeid == this_node) {
+ 		/*
+ 		 * Use the locally cached objects if possible.
+ 		 * However ____cache_alloc does not allow fallback
+ 		 * to other nodes. It may fail while we still have
+ 		 * objects on other nodes available.
+ 		 */
+-		ptr = ____cache_alloc(cachep, flags);
++		ptr = ____cache_alloc(cachep, flags, &this_cpu);
+ 		if (ptr)
+ 			goto out;
+ 	}
+ 	/* ___cache_alloc_node can fall back to other nodes */
+-	ptr = ____cache_alloc_node(cachep, flags, nodeid);
++	ptr = ____cache_alloc_node(cachep, flags, nodeid, &this_cpu);
+   out:
+-	local_irq_restore(save_flags);
++	slab_irq_restore(save_flags, this_cpu);
+ 	ptr = cache_alloc_debugcheck_after(cachep, flags, ptr, caller);
+ 	kmemleak_alloc_recursive(ptr, obj_size(cachep), 1, cachep->flags,
+ 				 flags);
+@@ -3344,33 +3586,33 @@
+ }
+ 
+ static __always_inline void *
+-__do_cache_alloc(struct kmem_cache *cache, gfp_t flags)
++__do_cache_alloc(struct kmem_cache *cache, gfp_t flags, int *this_cpu)
+ {
+ 	void *objp;
+ 
+ 	if (unlikely(current->flags & (PF_SPREAD_SLAB | PF_MEMPOLICY))) {
+-		objp = alternate_node_alloc(cache, flags);
++		objp = alternate_node_alloc(cache, flags, this_cpu);
+ 		if (objp)
+ 			goto out;
+ 	}
+-	objp = ____cache_alloc(cache, flags);
+ 
++	objp = ____cache_alloc(cache, flags, this_cpu);
+ 	/*
+ 	 * We may just have run out of memory on the local node.
+ 	 * ____cache_alloc_node() knows how to locate memory on other nodes
+ 	 */
+- 	if (!objp)
+- 		objp = ____cache_alloc_node(cache, flags, numa_node_id());
+-
++	if (!objp)
++		objp = ____cache_alloc_node(cache, flags,
++					    cpu_to_node(*this_cpu), this_cpu);
+   out:
+ 	return objp;
+ }
+ #else
+ 
+ static __always_inline void *
+-__do_cache_alloc(struct kmem_cache *cachep, gfp_t flags)
++__do_cache_alloc(struct kmem_cache *cachep, gfp_t flags, int *this_cpu)
+ {
+-	return ____cache_alloc(cachep, flags);
++	return ____cache_alloc(cachep, flags, this_cpu);
+ }
+ 
+ #endif /* CONFIG_NUMA */
+@@ -3379,6 +3621,7 @@
+ __cache_alloc(struct kmem_cache *cachep, gfp_t flags, void *caller)
+ {
+ 	unsigned long save_flags;
++	int this_cpu;
+ 	void *objp;
+ 
+ 	flags &= gfp_allowed_mask;
+@@ -3389,9 +3632,9 @@
+ 		return NULL;
+ 
+ 	cache_alloc_debugcheck_before(cachep, flags);
+-	local_irq_save(save_flags);
+-	objp = __do_cache_alloc(cachep, flags);
+-	local_irq_restore(save_flags);
++	slab_irq_save(save_flags, this_cpu);
++	objp = __do_cache_alloc(cachep, flags, &this_cpu);
++	slab_irq_restore(save_flags, this_cpu);
+ 	objp = cache_alloc_debugcheck_after(cachep, flags, objp, caller);
+ 	kmemleak_alloc_recursive(objp, obj_size(cachep), 1, cachep->flags,
+ 				 flags);
+@@ -3410,7 +3653,7 @@
+  * Caller needs to acquire correct kmem_list's list_lock
+  */
+ static void free_block(struct kmem_cache *cachep, void **objpp, int nr_objects,
+-		       int node)
++		       int node, int *this_cpu)
+ {
+ 	int i;
+ 	struct kmem_list3 *l3;
+@@ -3439,7 +3682,7 @@
+ 				 * a different cache, refer to comments before
+ 				 * alloc_slabmgmt.
+ 				 */
+-				slab_destroy(cachep, slabp);
++				slab_destroy(cachep, slabp, this_cpu);
+ 			} else {
+ 				list_add(&slabp->list, &l3->slabs_free);
+ 			}
+@@ -3453,11 +3696,12 @@
+ 	}
+ }
+ 
+-static void cache_flusharray(struct kmem_cache *cachep, struct array_cache *ac)
++static void
++cache_flusharray(struct kmem_cache *cachep, struct array_cache *ac, int *this_cpu)
+ {
+ 	int batchcount;
+ 	struct kmem_list3 *l3;
+-	int node = numa_node_id();
++	int node = cpu_to_node(*this_cpu);
+ 
+ 	batchcount = ac->batchcount;
+ #if DEBUG
+@@ -3479,7 +3723,7 @@
+ 		}
+ 	}
+ 
+-	free_block(cachep, ac->entry, batchcount, node);
++	free_block(cachep, ac->entry, batchcount, node, this_cpu);
+ free_done:
+ #if STATS
+ 	{
+@@ -3508,9 +3752,10 @@
+  * Release an obj back to its cache. If the obj has a constructed state, it must
+  * be in this state _before_ it is released.  Called with disabled ints.
+  */
+-static inline void __cache_free(struct kmem_cache *cachep, void *objp)
++static inline void
++__cache_free(struct kmem_cache *cachep, void *objp, int *this_cpu)
+ {
+-	struct array_cache *ac = cpu_cache_get(cachep);
++	struct array_cache *ac = cpu_cache_get(cachep, *this_cpu);
+ 
+ 	check_irq_off();
+ 	kmemleak_free_recursive(objp, cachep->flags);
+@@ -3525,7 +3770,7 @@
+ 	 * variable to skip the call, which is mostly likely to be present in
+ 	 * the cache.
+ 	 */
+-	if (nr_online_nodes > 1 && cache_free_alien(cachep, objp))
++	if (nr_online_nodes > 1 && cache_free_alien(cachep, objp, this_cpu))
+ 		return;
+ 
+ 	if (likely(ac->avail < ac->limit)) {
+@@ -3534,7 +3779,7 @@
+ 		return;
+ 	} else {
+ 		STATS_INC_FREEMISS(cachep);
+-		cache_flusharray(cachep, ac);
++		cache_flusharray(cachep, ac, this_cpu);
+ 		ac->entry[ac->avail++] = objp;
+ 	}
+ }
+@@ -3733,13 +3978,14 @@
+ void kmem_cache_free(struct kmem_cache *cachep, void *objp)
+ {
+ 	unsigned long flags;
++	int this_cpu;
+ 
+-	local_irq_save(flags);
++	slab_irq_save(flags, this_cpu);
+ 	debug_check_no_locks_freed(objp, obj_size(cachep));
+ 	if (!(cachep->flags & SLAB_DEBUG_OBJECTS))
+ 		debug_check_no_obj_freed(objp, obj_size(cachep));
+-	__cache_free(cachep, objp);
+-	local_irq_restore(flags);
++	__cache_free(cachep, objp, &this_cpu);
++	slab_irq_restore(flags, this_cpu);
+ 
+ 	trace_kmem_cache_free(_RET_IP_, objp);
+ }
+@@ -3758,18 +4004,19 @@
+ {
+ 	struct kmem_cache *c;
+ 	unsigned long flags;
++	int this_cpu;
+ 
+ 	trace_kfree(_RET_IP_, objp);
+ 
+ 	if (unlikely(ZERO_OR_NULL_PTR(objp)))
+ 		return;
+-	local_irq_save(flags);
++	slab_irq_save(flags, this_cpu);
+ 	kfree_debugcheck(objp);
+ 	c = virt_to_cache(objp);
+ 	debug_check_no_locks_freed(objp, obj_size(c));
+ 	debug_check_no_obj_freed(objp, obj_size(c));
+-	__cache_free(c, (void *)objp);
+-	local_irq_restore(flags);
++	__cache_free(c, (void *)objp, &this_cpu);
++	slab_irq_restore(flags, this_cpu);
+ }
+ EXPORT_SYMBOL(kfree);
+ 
+@@ -3790,7 +4037,7 @@
+  */
+ static int alloc_kmemlist(struct kmem_cache *cachep, gfp_t gfp)
+ {
+-	int node;
++	int node, this_cpu;
+ 	struct kmem_list3 *l3;
+ 	struct array_cache *new_shared;
+ 	struct array_cache **new_alien = NULL;
+@@ -3818,11 +4065,11 @@
+ 		if (l3) {
+ 			struct array_cache *shared = l3->shared;
+ 
+-			spin_lock_irq(&l3->list_lock);
++			slab_spin_lock_irq(&l3->list_lock, this_cpu);
+ 
+ 			if (shared)
+ 				free_block(cachep, shared->entry,
+-						shared->avail, node);
++					   shared->avail, node, &this_cpu);
+ 
+ 			l3->shared = new_shared;
+ 			if (!l3->alien) {
+@@ -3831,7 +4078,7 @@
+ 			}
+ 			l3->free_limit = (1 + nr_cpus_node(node)) *
+ 					cachep->batchcount + cachep->num;
+-			spin_unlock_irq(&l3->list_lock);
++			slab_spin_unlock_irq(&l3->list_lock, this_cpu);
+ 			kfree(shared);
+ 			free_alien_cache(new_alien);
+ 			continue;
+@@ -3878,24 +4125,36 @@
+ 	struct array_cache *new[NR_CPUS];
+ };
+ 
+-static void do_ccupdate_local(void *info)
++static void __do_ccupdate_local(void *info, int this_cpu)
+ {
+ 	struct ccupdate_struct *new = info;
+ 	struct array_cache *old;
+ 
+ 	check_irq_off();
+-	old = cpu_cache_get(new->cachep);
++	old = cpu_cache_get(new->cachep, this_cpu);
++
++	new->cachep->array[this_cpu] = new->new[this_cpu];
++	new->new[this_cpu] = old;
++}
+ 
+-	new->cachep->array[smp_processor_id()] = new->new[smp_processor_id()];
+-	new->new[smp_processor_id()] = old;
++#ifdef CONFIG_PREEMPT_RT
++static void do_ccupdate_local(void *arg, int this_cpu)
++{
++	__do_ccupdate_local(arg, this_cpu);
++}
++#else
++static void do_ccupdate_local(void *arg)
++{
++	__do_ccupdate_local(arg, smp_processor_id());
+ }
++#endif
+ 
+ /* Always called with the cache_chain_mutex held */
+ static int do_tune_cpucache(struct kmem_cache *cachep, int limit,
+ 				int batchcount, int shared, gfp_t gfp)
+ {
+ 	struct ccupdate_struct *new;
+-	int i;
++	int i, this_cpu;
+ 
+ 	new = kzalloc(sizeof(*new), gfp);
+ 	if (!new)
+@@ -3913,7 +4172,7 @@
+ 	}
+ 	new->cachep = cachep;
+ 
+-	on_each_cpu(do_ccupdate_local, (void *)new, 1);
++	slab_on_each_cpu(do_ccupdate_local, (void *)new);
+ 
+ 	check_irq_on();
+ 	cachep->batchcount = batchcount;
+@@ -3924,9 +4183,12 @@
+ 		struct array_cache *ccold = new->new[i];
+ 		if (!ccold)
+ 			continue;
+-		spin_lock_irq(&cachep->nodelists[cpu_to_node(i)]->list_lock);
+-		free_block(cachep, ccold->entry, ccold->avail, cpu_to_node(i));
+-		spin_unlock_irq(&cachep->nodelists[cpu_to_node(i)]->list_lock);
++		slab_spin_lock_irq(&cachep->nodelists[cpu_to_node(i)]->list_lock,
++				   this_cpu);
++		free_block(cachep, ccold->entry, ccold->avail, cpu_to_node(i),
++			   &this_cpu);
++		slab_spin_unlock_irq(&cachep->nodelists[cpu_to_node(i)]->list_lock,
++				     this_cpu);
+ 		kfree(ccold);
+ 	}
+ 	kfree(new);
+@@ -3991,29 +4253,31 @@
+  * Drain an array if it contains any elements taking the l3 lock only if
+  * necessary. Note that the l3 listlock also protects the array_cache
+  * if drain_array() is used on the shared array.
++ * returns non-zero if some work is done
+  */
+-void drain_array(struct kmem_cache *cachep, struct kmem_list3 *l3,
+-			 struct array_cache *ac, int force, int node)
++int drain_array(struct kmem_cache *cachep, struct kmem_list3 *l3,
++		 struct array_cache *ac, int force, int node)
+ {
+-	int tofree;
++	int tofree, this_cpu;
+ 
+ 	if (!ac || !ac->avail)
+-		return;
++		return 0;
+ 	if (ac->touched && !force) {
+ 		ac->touched = 0;
+ 	} else {
+-		spin_lock_irq(&l3->list_lock);
++		slab_spin_lock_irq(&l3->list_lock, this_cpu);
+ 		if (ac->avail) {
+ 			tofree = force ? ac->avail : (ac->limit + 4) / 5;
+ 			if (tofree > ac->avail)
+ 				tofree = (ac->avail + 1) / 2;
+-			free_block(cachep, ac->entry, tofree, node);
++			free_block(cachep, ac->entry, tofree, node, &this_cpu);
+ 			ac->avail -= tofree;
+ 			memmove(ac->entry, &(ac->entry[tofree]),
+ 				sizeof(void *) * ac->avail);
+ 		}
+-		spin_unlock_irq(&l3->list_lock);
++		slab_spin_unlock_irq(&l3->list_lock, this_cpu);
+ 	}
++	return 1;
+ }
+ 
+ /**
+@@ -4030,10 +4294,11 @@
+  */
+ static void cache_reap(struct work_struct *w)
+ {
++	int this_cpu = smp_processor_id(), node = cpu_to_node(this_cpu);
+ 	struct kmem_cache *searchp;
+ 	struct kmem_list3 *l3;
+-	int node = numa_node_id();
+ 	struct delayed_work *work = to_delayed_work(w);
++	int work_done = 0;
+ 
+ 	if (!mutex_trylock(&cache_chain_mutex))
+ 		/* Give up. Setup the next iteration. */
+@@ -4049,9 +4314,12 @@
+ 		 */
+ 		l3 = searchp->nodelists[node];
+ 
+-		reap_alien(searchp, l3);
++		work_done += reap_alien(searchp, l3);
++
++		node = cpu_to_node(this_cpu);
+ 
+-		drain_array(searchp, l3, cpu_cache_get(searchp), 0, node);
++		work_done += drain_array(searchp, l3,
++			    cpu_cache_get(searchp, this_cpu), 0, node);
+ 
+ 		/*
+ 		 * These are racy checks but it does not matter
+@@ -4062,7 +4330,7 @@
+ 
+ 		l3->next_reap = jiffies + REAPTIMEOUT_LIST3;
+ 
+-		drain_array(searchp, l3, l3->shared, 0, node);
++		work_done += drain_array(searchp, l3, l3->shared, 0, node);
+ 
+ 		if (l3->free_touched)
+ 			l3->free_touched = 0;
+@@ -4081,7 +4349,8 @@
+ 	next_reap_node();
+ out:
+ 	/* Set up the next iteration */
+-	schedule_delayed_work(work, round_jiffies_relative(REAPTIMEOUT_CPUC));
++	schedule_delayed_work(work,
++		round_jiffies_relative((1+!work_done) * REAPTIMEOUT_CPUC));
+ }
+ 
+ #ifdef CONFIG_SLABINFO
+@@ -4140,7 +4409,7 @@
+ 	unsigned long num_slabs, free_objects = 0, shared_avail = 0;
+ 	const char *name;
+ 	char *error = NULL;
+-	int node;
++	int this_cpu, node;
+ 	struct kmem_list3 *l3;
+ 
+ 	active_objs = 0;
+@@ -4151,7 +4420,7 @@
+ 			continue;
+ 
+ 		check_irq_on();
+-		spin_lock_irq(&l3->list_lock);
++		slab_spin_lock_irq(&l3->list_lock, this_cpu);
+ 
+ 		list_for_each_entry(slabp, &l3->slabs_full, list) {
+ 			if (slabp->inuse != cachep->num && !error)
+@@ -4176,7 +4445,7 @@
+ 		if (l3->shared)
+ 			shared_avail += l3->shared->avail;
+ 
+-		spin_unlock_irq(&l3->list_lock);
++		slab_spin_unlock_irq(&l3->list_lock, this_cpu);
+ 	}
+ 	num_slabs += active_slabs;
+ 	num_objs = num_slabs * cachep->num;
+@@ -4386,7 +4655,7 @@
+ 	struct kmem_list3 *l3;
+ 	const char *name;
+ 	unsigned long *n = m->private;
+-	int node;
++	int node, this_cpu;
+ 	int i;
+ 
+ 	if (!(cachep->flags & SLAB_STORE_USER))
+@@ -4404,13 +4673,13 @@
+ 			continue;
+ 
+ 		check_irq_on();
+-		spin_lock_irq(&l3->list_lock);
++		slab_spin_lock_irq(&l3->list_lock, this_cpu);
+ 
+ 		list_for_each_entry(slabp, &l3->slabs_full, list)
+ 			handle_slab(n, cachep, slabp);
+ 		list_for_each_entry(slabp, &l3->slabs_partial, list)
+ 			handle_slab(n, cachep, slabp);
+-		spin_unlock_irq(&l3->list_lock);
++		slab_spin_unlock_irq(&l3->list_lock, this_cpu);
+ 	}
+ 	name = cachep->name;
+ 	if (n[0] == n[1]) {
+Index: linux-rt-2.6.31/mm/swap.c
+===================================================================
+--- linux-rt-2.6.31.orig/mm/swap.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/mm/swap.c	2010-05-17 14:23:20.138567292 +0200
+@@ -30,15 +30,93 @@
+ #include <linux/notifier.h>
+ #include <linux/backing-dev.h>
+ #include <linux/memcontrol.h>
++#include <linux/interrupt.h>
+ 
+ #include "internal.h"
+ 
+ /* How many pages do we try to swap or page in/out together? */
+ int page_cluster;
+ 
++#ifdef CONFIG_PREEMPT_RT
++/*
++ * On PREEMPT_RT we don't want to disable preemption for cpu variables.
++ * We grab a cpu and then use that cpu to lock the variables accordingly.
++ *
++ * (On !PREEMPT_RT this turns into normal preempt-off sections, as before.)
++ */
++static DEFINE_PER_CPU_LOCKED(struct pagevec[NR_LRU_LISTS], lru_add_pvecs);
++static DEFINE_PER_CPU_LOCKED(struct pagevec, lru_rotate_pvecs);
++
++#define swap_get_cpu_var_irq_save(var, flags, cpu)	\
++	({						\
++		(void)flags;				\
++		&get_cpu_var_locked(var, &cpu);		\
++	})
++
++#define swap_put_cpu_var_irq_restore(var, flags, cpu)	\
++	put_cpu_var_locked(var, cpu)
++
++#define swap_get_cpu_var(var, cpu)			\
++	&get_cpu_var_locked(var, &cpu)
++
++#define swap_put_cpu_var(var, cpu)			\
++	put_cpu_var_locked(var, cpu)
++
++#define swap_per_cpu_lock(var, cpu)			\
++	({						\
++		spin_lock(&__get_cpu_lock(var, cpu));	\
++		&__get_cpu_var_locked(var, cpu);	\
++	})
++
++#define swap_per_cpu_unlock(var, cpu)			\
++	spin_unlock(&__get_cpu_lock(var, cpu));
++
++#define swap_get_cpu() raw_smp_processor_id()
++
++#define swap_put_cpu() do { } while (0)
++
++#define swap_irq_save(flags) do { (void)flags; } while (0)
++
++#define swap_irq_restore(flags) do { (void)flags; } while (0)
++
++#else
++
+ static DEFINE_PER_CPU(struct pagevec[NR_LRU_LISTS], lru_add_pvecs);
+ static DEFINE_PER_CPU(struct pagevec, lru_rotate_pvecs);
+ 
++#define swap_get_cpu_var_irq_save(var, flags, cpu)	\
++	({						\
++		(void)cpu;				\
++		local_irq_save(flags);			\
++		&__get_cpu_var(var);			\
++	})
++
++#define swap_put_cpu_var_irq_restore(var, flags, cpu)	\
++	local_irq_restore(flags)
++
++#define swap_get_cpu_var(var, cpu)			\
++	&get_cpu_var(var)			\
++
++#define swap_put_cpu_var(var, cpu)		\
++	({					\
++		(void)cpu;			\
++		put_cpu_var(var);		\
++	 })
++
++#define swap_per_cpu_lock(var, cpu)	&per_cpu(var, cpu)
++
++#define swap_per_cpu_unlock(var, cpu)	do { } while (0)
++
++#define swap_get_cpu() get_cpu()
++
++#define swap_put_cpu() put_cpu()
++
++#define swap_irq_save(flags) local_irq_save(flags)
++
++#define swap_irq_restore(flags) local_irq_restore(flags)
++
++#endif
++
+ /*
+  * This path almost never happens for VM activity - pages are normally
+  * freed via pagevecs.  But it gets used by networking.
+@@ -141,13 +219,13 @@
+ 	    !PageUnevictable(page) && PageLRU(page)) {
+ 		struct pagevec *pvec;
+ 		unsigned long flags;
++		int cpu;
+ 
+ 		page_cache_get(page);
+-		local_irq_save(flags);
+-		pvec = &__get_cpu_var(lru_rotate_pvecs);
++		pvec = swap_get_cpu_var_irq_save(lru_rotate_pvecs, flags, cpu);
+ 		if (!pagevec_add(pvec, page))
+ 			pagevec_move_tail(pvec);
+-		local_irq_restore(flags);
++		swap_put_cpu_var_irq_restore(lru_rotate_pvecs, flags, cpu);
+ 	}
+ }
+ 
+@@ -216,12 +294,14 @@
+ 
+ void __lru_cache_add(struct page *page, enum lru_list lru)
+ {
+-	struct pagevec *pvec = &get_cpu_var(lru_add_pvecs)[lru];
++	struct pagevec *pvec;
++	int cpu;
+ 
++	pvec = swap_get_cpu_var(lru_add_pvecs, cpu)[lru];
+ 	page_cache_get(page);
+ 	if (!pagevec_add(pvec, page))
+ 		____pagevec_lru_add(pvec, lru);
+-	put_cpu_var(lru_add_pvecs);
++	swap_put_cpu_var(lru_add_pvecs, cpu);
+ }
+ 
+ /**
+@@ -271,31 +351,33 @@
+  */
+ static void drain_cpu_pagevecs(int cpu)
+ {
+-	struct pagevec *pvecs = per_cpu(lru_add_pvecs, cpu);
+-	struct pagevec *pvec;
++	struct pagevec *pvecs, *pvec;
+ 	int lru;
+ 
++	pvecs = swap_per_cpu_lock(lru_add_pvecs, cpu)[0];
+ 	for_each_lru(lru) {
+ 		pvec = &pvecs[lru - LRU_BASE];
+ 		if (pagevec_count(pvec))
+ 			____pagevec_lru_add(pvec, lru);
+ 	}
++	swap_per_cpu_unlock(lru_add_pvecs, cpu);
+ 
+-	pvec = &per_cpu(lru_rotate_pvecs, cpu);
++	pvec = swap_per_cpu_lock(lru_rotate_pvecs, cpu);
+ 	if (pagevec_count(pvec)) {
+ 		unsigned long flags;
+ 
+ 		/* No harm done if a racing interrupt already did this */
+-		local_irq_save(flags);
++		swap_irq_save(flags);
+ 		pagevec_move_tail(pvec);
+-		local_irq_restore(flags);
++		swap_irq_restore(flags);
+ 	}
++	swap_per_cpu_unlock(lru_rotate_pvecs, cpu);
+ }
+ 
+ void lru_add_drain(void)
+ {
+-	drain_cpu_pagevecs(get_cpu());
+-	put_cpu();
++	drain_cpu_pagevecs(swap_get_cpu());
++	swap_put_cpu();
+ }
+ 
+ static void lru_add_drain_per_cpu(struct work_struct *dummy)
+@@ -369,7 +451,7 @@
+ 			}
+ 			__pagevec_free(&pages_to_free);
+ 			pagevec_reinit(&pages_to_free);
+-  		}
++		}
+ 	}
+ 	if (zone)
+ 		spin_unlock_irqrestore(&zone->lru_lock, flags);
+Index: linux-rt-2.6.31/mm/vmscan.c
+===================================================================
+--- linux-rt-2.6.31.orig/mm/vmscan.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/mm/vmscan.c	2010-05-17 14:23:20.138567292 +0200
+@@ -23,6 +23,7 @@
+ #include <linux/file.h>
+ #include <linux/writeback.h>
+ #include <linux/blkdev.h>
++#include <linux/interrupt.h>
+ #include <linux/buffer_head.h>	/* for try_to_release_page(),
+ 					buffer_heads_over_limit */
+ #include <linux/mm_inline.h>
+@@ -1123,7 +1124,7 @@
+ 		}
+ 
+ 		nr_reclaimed += nr_freed;
+-		local_irq_disable();
++		local_irq_disable_nort();
+ 		if (current_is_kswapd()) {
+ 			__count_zone_vm_events(PGSCAN_KSWAPD, zone, nr_scan);
+ 			__count_vm_events(KSWAPD_STEAL, nr_freed);
+@@ -1164,9 +1165,14 @@
+ 			}
+ 		}
+   	} while (nr_scanned < max_scan);
++	/*
++	 * Non-PREEMPT_RT relies on IRQs-off protecting the page_states
++	 * per-CPU data. PREEMPT_RT has that data protected even in
++	 * __mod_page_state(), so no need to keep IRQs disabled.
++	 */
+ 	spin_unlock(&zone->lru_lock);
+ done:
+-	local_irq_enable();
++	local_irq_enable_nort();
+ 	pagevec_release(&pvec);
+ 	return nr_reclaimed;
+ }
+Index: linux-rt-2.6.31/mm/vmstat.c
+===================================================================
+--- linux-rt-2.6.31.orig/mm/vmstat.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/mm/vmstat.c	2010-05-17 14:23:20.138567292 +0200
+@@ -149,17 +149,16 @@
+ void __mod_zone_page_state(struct zone *zone, enum zone_stat_item item,
+ 				int delta)
+ {
+-	struct per_cpu_pageset *pcp = zone_pcp(zone, smp_processor_id());
++	struct per_cpu_pageset *pcp = zone_pcp(zone, get_cpu());
+ 	s8 *p = pcp->vm_stat_diff + item;
+-	long x;
+-
+-	x = delta + *p;
++	long x = delta + *p;
+ 
+ 	if (unlikely(x > pcp->stat_threshold || x < -pcp->stat_threshold)) {
+ 		zone_page_state_add(x, zone, item);
+ 		x = 0;
+ 	}
+ 	*p = x;
++	put_cpu();
+ }
+ EXPORT_SYMBOL(__mod_zone_page_state);
+ 
+@@ -202,7 +201,7 @@
+  */
+ void __inc_zone_state(struct zone *zone, enum zone_stat_item item)
+ {
+-	struct per_cpu_pageset *pcp = zone_pcp(zone, smp_processor_id());
++	struct per_cpu_pageset *pcp = zone_pcp(zone, get_cpu());
+ 	s8 *p = pcp->vm_stat_diff + item;
+ 
+ 	(*p)++;
+@@ -213,17 +212,28 @@
+ 		zone_page_state_add(*p + overstep, zone, item);
+ 		*p = -overstep;
+ 	}
++	put_cpu();
+ }
+ 
+ void __inc_zone_page_state(struct page *page, enum zone_stat_item item)
+ {
++#ifdef CONFIG_PREEMPT_RT
++	unsigned long flags;
++	struct zone *zone;
++
++	zone = page_zone(page);
++	local_irq_save(flags);
++	__inc_zone_state(zone, item);
++	local_irq_restore(flags);
++#else
+ 	__inc_zone_state(page_zone(page), item);
++#endif
+ }
+ EXPORT_SYMBOL(__inc_zone_page_state);
+ 
+ void __dec_zone_state(struct zone *zone, enum zone_stat_item item)
+ {
+-	struct per_cpu_pageset *pcp = zone_pcp(zone, smp_processor_id());
++	struct per_cpu_pageset *pcp = zone_pcp(zone, get_cpu());
+ 	s8 *p = pcp->vm_stat_diff + item;
+ 
+ 	(*p)--;
+@@ -234,6 +244,7 @@
+ 		zone_page_state_add(*p - overstep, zone, item);
+ 		*p = overstep;
+ 	}
++	put_cpu();
+ }
+ 
+ void __dec_zone_page_state(struct page *page, enum zone_stat_item item)
+Index: linux-rt-2.6.31/net/bluetooth/hci_core.c
+===================================================================
+--- linux-rt-2.6.31.orig/net/bluetooth/hci_core.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/net/bluetooth/hci_core.c	2010-05-17 14:23:20.138567292 +0200
+@@ -911,7 +911,7 @@
+ 		hdev->reassembly[i] = NULL;
+ 
+ 	init_waitqueue_head(&hdev->req_wait_q);
+-	init_MUTEX(&hdev->req_lock);
++	mutex_init(&hdev->req_lock);
+ 
+ 	inquiry_cache_init(hdev);
+ 
+Index: linux-rt-2.6.31/net/core/dev.c
+===================================================================
+--- linux-rt-2.6.31.orig/net/core/dev.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/net/core/dev.c	2010-05-17 14:23:20.148465269 +0200
+@@ -1888,42 +1888,52 @@
+ 	   Check this and shot the lock. It is not prone from deadlocks.
+ 	   Either shot noqueue qdisc, it is even simpler 8)
+ 	 */
+-	if (dev->flags & IFF_UP) {
+-		int cpu = smp_processor_id(); /* ok because BHs are off */
++	if (!(dev->flags & IFF_UP))
++		goto err;
+ 
+-		if (txq->xmit_lock_owner != cpu) {
++	/* Recursion is detected! It is possible, unfortunately: */
++	if (netif_tx_lock_recursion(txq))
++		goto err_recursion;
+ 
+-			HARD_TX_LOCK(dev, txq, cpu);
++	HARD_TX_LOCK(dev, txq);
+ 
+-			if (!netif_tx_queue_stopped(txq)) {
+-				rc = 0;
+-				if (!dev_hard_start_xmit(skb, dev, txq)) {
+-					HARD_TX_UNLOCK(dev, txq);
+-					goto out;
+-				}
+-			}
+-			HARD_TX_UNLOCK(dev, txq);
+-			if (net_ratelimit())
+-				printk(KERN_CRIT "Virtual device %s asks to "
+-				       "queue packet!\n", dev->name);
+-		} else {
+-			/* Recursion is detected! It is possible,
+-			 * unfortunately */
+-			if (net_ratelimit())
+-				printk(KERN_CRIT "Dead loop on virtual device "
+-				       "%s, fix it urgently!\n", dev->name);
+-		}
++	if (netif_tx_queue_stopped(txq))
++		goto err_tx_unlock;
++
++	if (dev_hard_start_xmit(skb, dev, txq))
++		goto err_tx_unlock;
++
++	rc = 0;
++	HARD_TX_UNLOCK(dev, txq);
++
++out:
++	rcu_read_unlock_bh();
++	return rc;
++
++err_recursion:
++	if (net_ratelimit()) {
++		printk(KERN_CRIT
++		       "Dead loop on virtual device %s, fix it urgently!\n",
++			dev->name);
++	}
++	goto err;
++
++err_tx_unlock:
++	HARD_TX_UNLOCK(dev, txq);
++
++	if (net_ratelimit()) {
++		printk(KERN_CRIT "Virtual device %s asks to queue packet!\n",
++			dev->name);
+ 	}
++	/* Fall through: */
+ 
++err:
+ 	rc = -ENETDOWN;
+ 	rcu_read_unlock_bh();
+ 
+ out_kfree_skb:
+ 	kfree_skb(skb);
+ 	return rc;
+-out:
+-	rcu_read_unlock_bh();
+-	return rc;
+ }
+ 
+ 
+@@ -1996,8 +2006,8 @@
+ {
+ 	int err;
+ 
+-	preempt_disable();
+ 	err = netif_rx(skb);
++	preempt_disable();
+ 	if (local_softirq_pending())
+ 		do_softirq();
+ 	preempt_enable();
+@@ -2009,7 +2019,8 @@
+ 
+ static void net_tx_action(struct softirq_action *h)
+ {
+-	struct softnet_data *sd = &__get_cpu_var(softnet_data);
++	struct softnet_data *sd = &per_cpu(softnet_data,
++					   raw_smp_processor_id());
+ 
+ 	if (sd->completion_queue) {
+ 		struct sk_buff *clist;
+@@ -2025,6 +2036,11 @@
+ 
+ 			WARN_ON(atomic_read(&skb->users));
+ 			__kfree_skb(skb);
++			/*
++			 * Safe to reschedule - the list is private
++			 * at this point.
++			 */
++			cond_resched_softirq_context();
+ 		}
+ 	}
+ 
+@@ -2043,6 +2059,22 @@
+ 			head = head->next_sched;
+ 
+ 			root_lock = qdisc_lock(q);
++			/*
++			 * We are executing in softirq context here, and
++			 * if softirqs are preemptible, we must avoid
++			 * infinite reactivation of the softirq by
++			 * either the tx handler, or by netif_schedule().
++			 * (it would result in an infinitely looping
++			 *  softirq context)
++			 * So we take the spinlock unconditionally.
++			 */
++#ifdef CONFIG_PREEMPT_SOFTIRQS
++			spin_lock(root_lock);
++			smp_mb__before_clear_bit();
++			clear_bit(__QDISC_STATE_SCHED, &q->state);
++			qdisc_run(q);
++			spin_unlock(root_lock);
++#else
+ 			if (spin_trylock(root_lock)) {
+ 				smp_mb__before_clear_bit();
+ 				clear_bit(__QDISC_STATE_SCHED,
+@@ -2059,6 +2091,7 @@
+ 						  &q->state);
+ 				}
+ 			}
++#endif
+ 		}
+ 	}
+ }
+@@ -2271,7 +2304,7 @@
+ 			skb->dev = orig_dev->master;
+ 	}
+ 
+-	__get_cpu_var(netdev_rx_stat).total++;
++	per_cpu(netdev_rx_stat, raw_smp_processor_id()).total++;
+ 
+ 	skb_reset_network_header(skb);
+ 	skb_reset_transport_header(skb);
+@@ -2661,9 +2694,10 @@
+ static int process_backlog(struct napi_struct *napi, int quota)
+ {
+ 	int work = 0;
+-	struct softnet_data *queue = &__get_cpu_var(softnet_data);
++	struct softnet_data *queue;
+ 	unsigned long start_time = jiffies;
+ 
++	queue = &per_cpu(softnet_data, raw_smp_processor_id());
+ 	napi->weight = weight_p;
+ 	do {
+ 		struct sk_buff *skb;
+@@ -2695,7 +2729,7 @@
+ 
+ 	local_irq_save(flags);
+ 	list_add_tail(&n->poll_list, &__get_cpu_var(softnet_data).poll_list);
+-	__raise_softirq_irqoff(NET_RX_SOFTIRQ);
++	raise_softirq_irqoff(NET_RX_SOFTIRQ);
+ 	local_irq_restore(flags);
+ }
+ EXPORT_SYMBOL(__napi_schedule);
+@@ -2849,7 +2883,7 @@
+ 
+ softnet_break:
+ 	__get_cpu_var(netdev_rx_stat).time_squeeze++;
+-	__raise_softirq_irqoff(NET_RX_SOFTIRQ);
++	raise_softirq_irqoff(NET_RX_SOFTIRQ);
+ 	goto out;
+ }
+ 
+@@ -4645,7 +4679,7 @@
+ {
+ 	spin_lock_init(&dev_queue->_xmit_lock);
+ 	netdev_set_xmit_lockdep_class(&dev_queue->_xmit_lock, dev->type);
+-	dev_queue->xmit_lock_owner = -1;
++	dev_queue->xmit_lock_owner = (void *)-1;
+ }
+ 
+ static void netdev_init_queue_locks(struct net_device *dev)
+Index: linux-rt-2.6.31/net/core/flow.c
+===================================================================
+--- linux-rt-2.6.31.orig/net/core/flow.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/net/core/flow.c	2010-05-17 14:23:20.148465269 +0200
+@@ -39,9 +39,10 @@
+ 
+ static u32 flow_hash_shift;
+ #define flow_hash_size	(1 << flow_hash_shift)
+-static DEFINE_PER_CPU(struct flow_cache_entry **, flow_tables) = { NULL };
+ 
+-#define flow_table(cpu) (per_cpu(flow_tables, cpu))
++static DEFINE_PER_CPU_LOCKED(struct flow_cache_entry **, flow_tables);
++
++#define flow_table(cpu) (per_cpu_var_locked(flow_tables, cpu))
+ 
+ static struct kmem_cache *flow_cachep __read_mostly;
+ 
+@@ -168,24 +169,24 @@
+ void *flow_cache_lookup(struct net *net, struct flowi *key, u16 family, u8 dir,
+ 			flow_resolve_t resolver)
+ {
+-	struct flow_cache_entry *fle, **head;
++	struct flow_cache_entry **table, *fle, **head;
+ 	unsigned int hash;
+ 	int cpu;
+ 
+ 	local_bh_disable();
+-	cpu = smp_processor_id();
++	table = get_cpu_var_locked(flow_tables, &cpu);
+ 
+ 	fle = NULL;
+ 	/* Packet really early in init?  Making flow_cache_init a
+ 	 * pre-smp initcall would solve this.  --RR */
+-	if (!flow_table(cpu))
++	if (!table)
+ 		goto nocache;
+ 
+ 	if (flow_hash_rnd_recalc(cpu))
+ 		flow_new_hash_rnd(cpu);
+ 	hash = flow_hash_code(key, cpu);
+ 
+-	head = &flow_table(cpu)[hash];
++	head = &table[hash];
+ 	for (fle = *head; fle; fle = fle->next) {
+ 		if (fle->family == family &&
+ 		    fle->dir == dir &&
+@@ -195,6 +196,7 @@
+ 
+ 				if (ret)
+ 					atomic_inc(fle->object_ref);
++				put_cpu_var_locked(flow_tables, cpu);
+ 				local_bh_enable();
+ 
+ 				return ret;
+@@ -220,6 +222,8 @@
+ 	}
+ 
+ nocache:
++	put_cpu_var_locked(flow_tables, cpu);
++
+ 	{
+ 		int err;
+ 		void *obj;
+@@ -249,14 +253,15 @@
+ static void flow_cache_flush_tasklet(unsigned long data)
+ {
+ 	struct flow_flush_info *info = (void *)data;
++	struct flow_cache_entry **table;
+ 	int i;
+ 	int cpu;
+ 
+-	cpu = smp_processor_id();
++	table = get_cpu_var_locked(flow_tables, &cpu);
+ 	for (i = 0; i < flow_hash_size; i++) {
+ 		struct flow_cache_entry *fle;
+ 
+-		fle = flow_table(cpu)[i];
++		fle = table[i];
+ 		for (; fle; fle = fle->next) {
+ 			unsigned genid = atomic_read(&flow_cache_genid);
+ 
+@@ -267,6 +272,7 @@
+ 			atomic_dec(fle->object_ref);
+ 		}
+ 	}
++	put_cpu_var_locked(flow_tables, cpu);
+ 
+ 	if (atomic_dec_and_test(&info->cpuleft))
+ 		complete(&info->completion);
+Index: linux-rt-2.6.31/net/core/netpoll.c
+===================================================================
+--- linux-rt-2.6.31.orig/net/core/netpoll.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/net/core/netpoll.c	2010-05-17 14:23:20.148465269 +0200
+@@ -69,20 +69,20 @@
+ 
+ 		txq = netdev_get_tx_queue(dev, skb_get_queue_mapping(skb));
+ 
+-		local_irq_save(flags);
+-		__netif_tx_lock(txq, smp_processor_id());
++		local_irq_save_nort(flags);
++		__netif_tx_lock(txq);
+ 		if (netif_tx_queue_stopped(txq) ||
+ 		    netif_tx_queue_frozen(txq) ||
+ 		    ops->ndo_start_xmit(skb, dev) != NETDEV_TX_OK) {
+ 			skb_queue_head(&npinfo->txq, skb);
+ 			__netif_tx_unlock(txq);
+-			local_irq_restore(flags);
++			local_irq_restore_nort(flags);
+ 
+ 			schedule_delayed_work(&npinfo->tx_work, HZ/10);
+ 			return;
+ 		}
+ 		__netif_tx_unlock(txq);
+-		local_irq_restore(flags);
++		local_irq_restore_nort(flags);
+ 	}
+ }
+ 
+@@ -153,7 +153,7 @@
+ 	int budget = 16;
+ 
+ 	list_for_each_entry(napi, &dev->napi_list, dev_list) {
+-		if (napi->poll_owner != smp_processor_id() &&
++		if (napi->poll_owner != raw_smp_processor_id() &&
+ 		    spin_trylock(&napi->poll_lock)) {
+ 			budget = poll_one_napi(dev->npinfo, napi, budget);
+ 			spin_unlock(&napi->poll_lock);
+@@ -214,30 +214,35 @@
+ 
+ static void zap_completion_queue(void)
+ {
+-	unsigned long flags;
+ 	struct softnet_data *sd = &get_cpu_var(softnet_data);
++	struct sk_buff *clist = NULL;
++	unsigned long flags;
+ 
+ 	if (sd->completion_queue) {
+-		struct sk_buff *clist;
+ 
+ 		local_irq_save(flags);
+ 		clist = sd->completion_queue;
+ 		sd->completion_queue = NULL;
+ 		local_irq_restore(flags);
+-
+-		while (clist != NULL) {
+-			struct sk_buff *skb = clist;
+-			clist = clist->next;
+-			if (skb->destructor) {
+-				atomic_inc(&skb->users);
+-				dev_kfree_skb_any(skb); /* put this one back */
+-			} else {
+-				__kfree_skb(skb);
+-			}
+-		}
+ 	}
+ 
++
++	/*
++	 * Took the list private, can drop our softnet
++	 * reference:
++	 */
+ 	put_cpu_var(softnet_data);
++
++	while (clist != NULL) {
++		struct sk_buff *skb = clist;
++		clist = clist->next;
++		if (skb->destructor) {
++			atomic_inc(&skb->users);
++			dev_kfree_skb_any(skb); /* put this one back */
++		} else {
++			__kfree_skb(skb);
++		}
++	}
+ }
+ 
+ static struct sk_buff *find_skb(struct netpoll *np, int len, int reserve)
+@@ -245,13 +250,26 @@
+ 	int count = 0;
+ 	struct sk_buff *skb;
+ 
++#ifdef CONFIG_PREEMPT_RT
++	/*
++	 * On -rt skb_pool.lock is schedulable, so if we are
++	 * in an atomic context we just try to dequeue from the
++	 * pool and fail if we cannot get one.
++	 */
++	if (in_atomic() || irqs_disabled())
++		goto pick_atomic;
++#endif
+ 	zap_completion_queue();
+ 	refill_skbs();
+ repeat:
+ 
+ 	skb = alloc_skb(len, GFP_ATOMIC);
+-	if (!skb)
++	if (!skb) {
++#ifdef CONFIG_PREEMPT_RT
++pick_atomic:
++#endif
+ 		skb = skb_dequeue(&skb_pool);
++	}
+ 
+ 	if (!skb) {
+ 		if (++count < 10) {
+@@ -271,7 +289,7 @@
+ 	struct napi_struct *napi;
+ 
+ 	list_for_each_entry(napi, &dev->napi_list, dev_list) {
+-		if (napi->poll_owner == smp_processor_id())
++		if (napi->poll_owner == raw_smp_processor_id())
+ 			return 1;
+ 	}
+ 	return 0;
+@@ -297,7 +315,7 @@
+ 
+ 		txq = netdev_get_tx_queue(dev, skb_get_queue_mapping(skb));
+ 
+-		local_irq_save(flags);
++		local_irq_save_nort(flags);
+ 		/* try until next clock tick */
+ 		for (tries = jiffies_to_usecs(1)/USEC_PER_POLL;
+ 		     tries > 0; --tries) {
+@@ -319,12 +337,10 @@
+ 
+ 			udelay(USEC_PER_POLL);
+ 		}
+-
+ 		WARN_ONCE(!irqs_disabled(),
+ 			"netpoll_send_skb(): %s enabled interrupts in poll (%pF)\n",
+ 			dev->name, ops->ndo_start_xmit);
+-
+-		local_irq_restore(flags);
++		local_irq_restore_nort(flags);
+ 	}
+ 
+ 	if (status != NETDEV_TX_OK) {
+Index: linux-rt-2.6.31/net/core/skbuff.c
+===================================================================
+--- linux-rt-2.6.31.orig/net/core/skbuff.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/net/core/skbuff.c	2010-05-17 14:23:20.148465269 +0200
+@@ -395,7 +395,7 @@
+ 	secpath_put(skb->sp);
+ #endif
+ 	if (skb->destructor) {
+-		WARN_ON(in_irq());
++//		WARN_ON(in_irq());
+ 		skb->destructor(skb);
+ 	}
+ #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
+Index: linux-rt-2.6.31/net/core/sock.c
+===================================================================
+--- linux-rt-2.6.31.orig/net/core/sock.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/net/core/sock.c	2010-05-17 14:23:20.148465269 +0200
+@@ -2085,8 +2085,9 @@
+ #ifdef CONFIG_NET_NS
+ void sock_prot_inuse_add(struct net *net, struct proto *prot, int val)
+ {
+-	int cpu = smp_processor_id();
++	int cpu = get_cpu();
+ 	per_cpu_ptr(net->core.inuse, cpu)->val[prot->inuse_idx] += val;
++	put_cpu();
+ }
+ EXPORT_SYMBOL_GPL(sock_prot_inuse_add);
+ 
+@@ -2132,7 +2133,9 @@
+ 
+ void sock_prot_inuse_add(struct net *net, struct proto *prot, int val)
+ {
+-	__get_cpu_var(prot_inuse).val[prot->inuse_idx] += val;
++	int cpu = get_cpu();
++	per_cpu(prot_inuse, cpu).val[prot->inuse_idx] += val;
++	put_cpu();
+ }
+ EXPORT_SYMBOL_GPL(sock_prot_inuse_add);
+ 
+Index: linux-rt-2.6.31/net/ipv4/icmp.c
+===================================================================
+--- linux-rt-2.6.31.orig/net/ipv4/icmp.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/net/ipv4/icmp.c	2010-05-17 14:23:20.148465269 +0200
+@@ -201,7 +201,10 @@
+  */
+ static struct sock *icmp_sk(struct net *net)
+ {
+-	return net->ipv4.icmp_sk[smp_processor_id()];
++	/*
++	 * Should be safe on PREEMPT_SOFTIRQS/HARDIRQS to use raw-smp-processor-id:
++	 */
++	return net->ipv4.icmp_sk[raw_smp_processor_id()];
+ }
+ 
+ static inline struct sock *icmp_xmit_lock(struct net *net)
+Index: linux-rt-2.6.31/net/ipv4/netfilter/arp_tables.c
+===================================================================
+--- linux-rt-2.6.31.orig/net/ipv4/netfilter/arp_tables.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/net/ipv4/netfilter/arp_tables.c	2010-05-17 14:23:20.148465269 +0200
+@@ -252,6 +252,7 @@
+ 	void *table_base;
+ 	const struct xt_table_info *private;
+ 	struct xt_target_param tgpar;
++	int cpu;
+ 
+ 	if (!pskb_may_pull(skb, arp_hdr_len(skb->dev)))
+ 		return NF_DROP;
+@@ -259,9 +260,9 @@
+ 	indev = in ? in->name : nulldevname;
+ 	outdev = out ? out->name : nulldevname;
+ 
+-	xt_info_rdlock_bh();
++	cpu = xt_info_rdlock_bh();
+ 	private = table->private;
+-	table_base = private->entries[smp_processor_id()];
++	table_base = private->entries[cpu];
+ 
+ 	e = get_entry(table_base, private->hook_entry[hook]);
+ 	back = get_entry(table_base, private->underflow[hook]);
+@@ -332,7 +333,7 @@
+ 			/* Verdict */
+ 			break;
+ 	} while (!hotdrop);
+-	xt_info_rdunlock_bh();
++	xt_info_rdunlock_bh(cpu);
+ 
+ 	if (hotdrop)
+ 		return NF_DROP;
+@@ -709,7 +710,7 @@
+ {
+ 	unsigned int cpu;
+ 	unsigned int i;
+-	unsigned int curcpu;
++	unsigned int curcpu = NR_CPUS;
+ 
+ 	/* Instead of clearing (by a previous call to memset())
+ 	 * the counters and using adds, we set the counters
+@@ -719,6 +720,7 @@
+ 	 * if new softirq were to run and call ipt_do_table
+ 	 */
+ 	local_bh_disable();
++#ifndef CONFIG_PREEMPT_RT
+ 	curcpu = smp_processor_id();
+ 
+ 	i = 0;
+@@ -727,7 +729,7 @@
+ 			   set_entry_to_counter,
+ 			   counters,
+ 			   &i);
+-
++#endif
+ 	for_each_possible_cpu(cpu) {
+ 		if (cpu == curcpu)
+ 			continue;
+@@ -1183,7 +1185,7 @@
+ 
+ 	i = 0;
+ 	/* Choose the copy that is on our node */
+-	curcpu = smp_processor_id();
++	curcpu = raw_smp_processor_id();
+ 	loc_cpu_entry = private->entries[curcpu];
+ 	xt_info_wrlock(curcpu);
+ 	ARPT_ENTRY_ITERATE(loc_cpu_entry,
+Index: linux-rt-2.6.31/net/ipv4/netfilter/ip_tables.c
+===================================================================
+--- linux-rt-2.6.31.orig/net/ipv4/netfilter/ip_tables.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/net/ipv4/netfilter/ip_tables.c	2010-05-17 14:23:20.148465269 +0200
+@@ -325,6 +325,7 @@
+ 	struct xt_table_info *private;
+ 	struct xt_match_param mtpar;
+ 	struct xt_target_param tgpar;
++	int cpu;
+ 
+ 	/* Initialization */
+ 	ip = ip_hdr(skb);
+@@ -346,9 +347,9 @@
+ 	mtpar.hooknum = tgpar.hooknum = hook;
+ 
+ 	IP_NF_ASSERT(table->valid_hooks & (1 << hook));
+-	xt_info_rdlock_bh();
++	cpu = xt_info_rdlock_bh();
+ 	private = table->private;
+-	table_base = private->entries[smp_processor_id()];
++	table_base = private->entries[cpu];
+ 
+ 	e = get_entry(table_base, private->hook_entry[hook]);
+ 
+@@ -435,7 +436,7 @@
+ 			/* Verdict */
+ 			break;
+ 	} while (!hotdrop);
+-	xt_info_rdunlock_bh();
++	xt_info_rdunlock_bh(cpu);
+ 
+ #ifdef DEBUG_ALLOW_ALL
+ 	return NF_ACCEPT;
+@@ -892,7 +893,7 @@
+ {
+ 	unsigned int cpu;
+ 	unsigned int i;
+-	unsigned int curcpu;
++	unsigned int curcpu = NR_CPUS;
+ 
+ 	/* Instead of clearing (by a previous call to memset())
+ 	 * the counters and using adds, we set the counters
+@@ -902,6 +903,7 @@
+ 	 * if new softirq were to run and call ipt_do_table
+ 	 */
+ 	local_bh_disable();
++#ifndef CONFIG_PREEMPT_RT
+ 	curcpu = smp_processor_id();
+ 
+ 	i = 0;
+@@ -910,7 +912,7 @@
+ 			  set_entry_to_counter,
+ 			  counters,
+ 			  &i);
+-
++#endif
+ 	for_each_possible_cpu(cpu) {
+ 		if (cpu == curcpu)
+ 			continue;
+@@ -1391,7 +1393,7 @@
+ 
+ 	i = 0;
+ 	/* Choose the copy that is on our node */
+-	curcpu = smp_processor_id();
++	curcpu = raw_smp_processor_id();
+ 	loc_cpu_entry = private->entries[curcpu];
+ 	xt_info_wrlock(curcpu);
+ 	IPT_ENTRY_ITERATE(loc_cpu_entry,
+Index: linux-rt-2.6.31/net/ipv4/route.c
+===================================================================
+--- linux-rt-2.6.31.orig/net/ipv4/route.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/net/ipv4/route.c	2010-05-17 14:23:20.148465269 +0200
+@@ -204,13 +204,13 @@
+ };
+ 
+ #if defined(CONFIG_SMP) || defined(CONFIG_DEBUG_SPINLOCK) || \
+-	defined(CONFIG_PROVE_LOCKING)
++	defined(CONFIG_PROVE_LOCKING) || defined(CONFIG_PREEMPT_RT)
+ /*
+  * Instead of using one spinlock for each rt_hash_bucket, we use a table of spinlocks
+  * The size of this table is a power of two and depends on the number of CPUS.
+  * (on lockdep we have a quite big spinlock_t, so keep the size down there)
+  */
+-#ifdef CONFIG_LOCKDEP
++#if defined(CONFIG_LOCKDEP) || defined(CONFIG_PREEMPT_RT)
+ # define RT_HASH_LOCK_SZ	256
+ #else
+ # if NR_CPUS >= 32
+@@ -242,7 +242,7 @@
+ 		spin_lock_init(&rt_hash_locks[i]);
+ }
+ #else
+-# define rt_hash_lock_addr(slot) NULL
++# define rt_hash_lock_addr(slot) ((spinlock_t *)NULL)
+ 
+ static inline void rt_hash_lock_init(void)
+ {
+Index: linux-rt-2.6.31/net/ipv4/tcp.c
+===================================================================
+--- linux-rt-2.6.31.orig/net/ipv4/tcp.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/net/ipv4/tcp.c	2010-05-17 14:23:20.148465269 +0200
+@@ -1365,11 +1365,11 @@
+ 		    (len > sysctl_tcp_dma_copybreak) && !(flags & MSG_PEEK) &&
+ 		    !sysctl_tcp_low_latency &&
+ 		    dma_find_channel(DMA_MEMCPY)) {
+-			preempt_enable_no_resched();
++			preempt_enable();
+ 			tp->ucopy.pinned_list =
+ 					dma_pin_iovec_pages(msg->msg_iov, len);
+ 		} else {
+-			preempt_enable_no_resched();
++			preempt_enable();
+ 		}
+ 	}
+ #endif
+Index: linux-rt-2.6.31/net/ipv6/netfilter/ip6_tables.c
+===================================================================
+--- linux-rt-2.6.31.orig/net/ipv6/netfilter/ip6_tables.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/net/ipv6/netfilter/ip6_tables.c	2010-05-17 14:23:20.148465269 +0200
+@@ -355,6 +355,7 @@
+ 	struct xt_table_info *private;
+ 	struct xt_match_param mtpar;
+ 	struct xt_target_param tgpar;
++	int cpu;
+ 
+ 	/* Initialization */
+ 	indev = in ? in->name : nulldevname;
+@@ -373,9 +374,9 @@
+ 
+ 	IP_NF_ASSERT(table->valid_hooks & (1 << hook));
+ 
+-	xt_info_rdlock_bh();
++	cpu = xt_info_rdlock_bh();
+ 	private = table->private;
+-	table_base = private->entries[smp_processor_id()];
++	table_base = private->entries[cpu];
+ 
+ 	e = get_entry(table_base, private->hook_entry[hook]);
+ 
+@@ -464,7 +465,7 @@
+ #ifdef CONFIG_NETFILTER_DEBUG
+ 	tb_comefrom = NETFILTER_LINK_POISON;
+ #endif
+-	xt_info_rdunlock_bh();
++	xt_info_rdunlock_bh(cpu);
+ 
+ #ifdef DEBUG_ALLOW_ALL
+ 	return NF_ACCEPT;
+@@ -921,7 +922,7 @@
+ {
+ 	unsigned int cpu;
+ 	unsigned int i;
+-	unsigned int curcpu;
++	unsigned int curcpu = NR_CPUS;
+ 
+ 	/* Instead of clearing (by a previous call to memset())
+ 	 * the counters and using adds, we set the counters
+@@ -931,6 +932,8 @@
+ 	 * if new softirq were to run and call ipt_do_table
+ 	 */
+ 	local_bh_disable();
++
++#ifndef CONFIG_PREEMPT_RT
+ 	curcpu = smp_processor_id();
+ 
+ 	i = 0;
+@@ -939,7 +942,7 @@
+ 			   set_entry_to_counter,
+ 			   counters,
+ 			   &i);
+-
++#endif
+ 	for_each_possible_cpu(cpu) {
+ 		if (cpu == curcpu)
+ 			continue;
+@@ -960,12 +963,13 @@
+ 	unsigned int countersize;
+ 	struct xt_counters *counters;
+ 	struct xt_table_info *private = table->private;
++	int node = cpu_to_node(raw_smp_processor_id());
+ 
+ 	/* We need atomic snapshot of counters: rest doesn't change
+ 	   (other than comefrom, which userspace doesn't care
+ 	   about). */
+ 	countersize = sizeof(struct xt_counters) * private->number;
+-	counters = vmalloc_node(countersize, numa_node_id());
++	counters = vmalloc_node(countersize, node);
+ 
+ 	if (counters == NULL)
+ 		return ERR_PTR(-ENOMEM);
+@@ -1423,7 +1427,7 @@
+ 
+ 	i = 0;
+ 	/* Choose the copy that is on our node */
+-	curcpu = smp_processor_id();
++	curcpu = raw_smp_processor_id();
+ 	xt_info_wrlock(curcpu);
+ 	loc_cpu_entry = private->entries[curcpu];
+ 	IP6T_ENTRY_ITERATE(loc_cpu_entry,
+Index: linux-rt-2.6.31/net/netfilter/core.c
+===================================================================
+--- linux-rt-2.6.31.orig/net/netfilter/core.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/net/netfilter/core.c	2010-05-17 14:23:20.148465269 +0200
+@@ -233,7 +233,7 @@
+ void (*nf_ct_destroy)(struct nf_conntrack *);
+ EXPORT_SYMBOL(nf_ct_destroy);
+ 
+-void nf_conntrack_destroy(struct nf_conntrack *nfct)
++static void __nf_conntrack_destroy(struct nf_conntrack *nfct)
+ {
+ 	void (*destroy)(struct nf_conntrack *);
+ 
+@@ -243,6 +243,28 @@
+ 	destroy(nfct);
+ 	rcu_read_unlock();
+ }
++
++#ifdef CONFIG_PREEMPT_RT
++/*
++ * nf_contrack_destroy is called with preemption disabled
++ * and will call functions that might schedule in PREEMPT_RT.
++ * For PREEMPT_RT we use a rcu callback instead to handle
++ * the destroying.
++ */
++static void nf_conntrack_destroy_rcu(struct rcu_head *rhp)
++{
++	__nf_conntrack_destroy(container_of(rhp, struct nf_conntrack, rcu));
++}
++void nf_conntrack_destroy(struct nf_conntrack *nfct)
++{
++	call_rcu(&nfct->rcu, nf_conntrack_destroy_rcu);
++}
++#else /* !PREEMPT_RT */
++void nf_conntrack_destroy(struct nf_conntrack *nfct)
++{
++	__nf_conntrack_destroy(nfct);
++}
++#endif /* PREEMPT_RT */
+ EXPORT_SYMBOL(nf_conntrack_destroy);
+ #endif /* CONFIG_NF_CONNTRACK */
+ 
+Index: linux-rt-2.6.31/net/netlink/af_netlink.c
+===================================================================
+--- linux-rt-2.6.31.orig/net/netlink/af_netlink.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/net/netlink/af_netlink.c	2010-05-17 14:23:20.148465269 +0200
+@@ -1061,7 +1061,7 @@
+ 		return -ENOBUFS;
+ 
+ 	if (info.delivered) {
+-		if (info.congested && (allocation & __GFP_WAIT))
++		if (info.congested && (allocation & __GFP_WAIT) && !rt_task(current))
+ 			yield();
+ 		return 0;
+ 	}
+Index: linux-rt-2.6.31/net/sched/sch_generic.c
+===================================================================
+--- linux-rt-2.6.31.orig/net/sched/sch_generic.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/net/sched/sch_generic.c	2010-05-17 14:23:20.148465269 +0200
+@@ -12,6 +12,7 @@
+  */
+ 
+ #include <linux/bitops.h>
++#include <linux/kallsyms.h>
+ #include <linux/module.h>
+ #include <linux/types.h>
+ #include <linux/kernel.h>
+@@ -24,6 +25,7 @@
+ #include <linux/init.h>
+ #include <linux/rcupdate.h>
+ #include <linux/list.h>
++#include <linux/delay.h>
+ #include <net/pkt_sched.h>
+ 
+ /* Main transmission queue. */
+@@ -78,7 +80,7 @@
+ {
+ 	int ret;
+ 
+-	if (unlikely(dev_queue->xmit_lock_owner == smp_processor_id())) {
++	if (unlikely(netif_tx_lock_recursion(dev_queue))) {
+ 		/*
+ 		 * Same CPU holding the lock. It may be a transient
+ 		 * configuration error, when hard_start_xmit() recurses. We
+@@ -95,7 +97,9 @@
+ 		 * Another cpu is holding lock, requeue & delay xmits for
+ 		 * some time.
+ 		 */
++		preempt_disable(); /* FIXME: we need an _rt version of this */
+ 		__get_cpu_var(netdev_rx_stat).cpu_collision++;
++		preempt_enable();
+ 		ret = dev_requeue_skb(skb, q);
+ 	}
+ 
+@@ -141,7 +145,7 @@
+ 	dev = qdisc_dev(q);
+ 	txq = netdev_get_tx_queue(dev, skb_get_queue_mapping(skb));
+ 
+-	HARD_TX_LOCK(dev, txq, smp_processor_id());
++	HARD_TX_LOCK(dev, txq);
+ 	if (!netif_tx_queue_stopped(txq) &&
+ 	    !netif_tx_queue_frozen(txq))
+ 		ret = dev_hard_start_xmit(skb, dev, txq);
+@@ -713,9 +717,12 @@
+ 	/* Wait for outstanding qdisc-less dev_queue_xmit calls. */
+ 	synchronize_rcu();
+ 
+-	/* Wait for outstanding qdisc_run calls. */
++	/*
++	 * Wait for outstanding qdisc_run calls.
++	 * TODO: shouldnt this be wakeup-based, instead of polling it?
++	 */
+ 	while (some_qdisc_is_busy(dev))
+-		yield();
++		msleep(1);
+ }
+ 
+ static void dev_init_scheduler_queue(struct net_device *dev,
+Index: linux-rt-2.6.31/scripts/Kbuild.include
+===================================================================
+--- linux-rt-2.6.31.orig/scripts/Kbuild.include	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/scripts/Kbuild.include	2010-05-17 14:23:20.148465269 +0200
+@@ -98,8 +98,9 @@
+ # as-instr
+ # Usage: cflags-y += $(call as-instr,instr,option1,option2)
+ 
+-as-instr = $(call try-run,\
+-	echo -e "$(1)" | $(CC) $(KBUILD_AFLAGS) -c -xassembler -o "$$TMP" -,$(2),$(3))
++as-instr = $(call try-run,		\
++	echo -e "$(1)" > "$$TMP"; 	\
++	$(CC) $(KBUILD_AFLAGS) -c -xassembler -o /dev/null "$$TMP",$(2),$(3))
+ 
+ # cc-option
+ # Usage: cflags-y += $(call cc-option,-march=winchip-c6,-march=i586)
+Index: linux-rt-2.6.31/scripts/checkpatch.pl
+===================================================================
+--- linux-rt-2.6.31.orig/scripts/checkpatch.pl	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/scripts/checkpatch.pl	2010-05-17 14:23:20.148465269 +0200
+@@ -2512,14 +2512,11 @@
+ 			WARN("__func__ should be used instead of gcc specific __FUNCTION__\n"  . $herecurr);
+ 		}
+ 
+-# check for semaphores used as mutexes
+-		if ($line =~ /^.\s*(DECLARE_MUTEX|init_MUTEX)\s*\(/) {
+-			WARN("mutexes are preferred for single holder semaphores\n" . $herecurr);
+-		}
+-# check for semaphores used as mutexes
+-		if ($line =~ /^.\s*init_MUTEX_LOCKED\s*\(/) {
++# check for semaphores initialized locked
++		if ($line =~ /^.\s*semaphore_init_locked\s*\(/) {
+ 			WARN("consider using a completion\n" . $herecurr);
+ 		}
++
+ # recommend strict_strto* over simple_strto*
+ 		if ($line =~ /\bsimple_(strto.*?)\s*\(/) {
+ 			WARN("consider using strict_$1 in preference to simple_$1\n" . $herecurr);
+Index: linux-rt-2.6.31/scripts/mkcompile_h
+===================================================================
+--- linux-rt-2.6.31.orig/scripts/mkcompile_h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/scripts/mkcompile_h	2010-05-17 14:23:20.148465269 +0200
+@@ -2,7 +2,8 @@
+ ARCH=$2
+ SMP=$3
+ PREEMPT=$4
+-CC=$5
++PREEMPT_RT=$5
++CC=$6
+ 
+ vecho() { [ "${quiet}" = "silent_" ] || echo "$@" ; }
+ 
+@@ -45,6 +46,7 @@
+ CONFIG_FLAGS=""
+ if [ -n "$SMP" ] ; then CONFIG_FLAGS="SMP"; fi
+ if [ -n "$PREEMPT" ] ; then CONFIG_FLAGS="$CONFIG_FLAGS PREEMPT"; fi
++if [ -n "$PREEMPT_RT" ] ; then CONFIG_FLAGS="$CONFIG_FLAGS RT"; fi
+ UTS_VERSION="$UTS_VERSION $CONFIG_FLAGS $TIMESTAMP"
+ 
+ # Truncate to maximum length
+Index: linux-rt-2.6.31/scripts/recordmcount.pl
+===================================================================
+--- linux-rt-2.6.31.orig/scripts/recordmcount.pl	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/scripts/recordmcount.pl	2010-05-17 14:23:20.148465269 +0200
+@@ -57,7 +57,6 @@
+ #        call mcount  (offset: 0x5)
+ #        [...]
+ #        ret
+-#  .globl my_func
+ #  other_func:
+ #        [...]
+ #        call mcount (offset: 0x1b)
+Index: linux-rt-2.6.31/security/keys/permission.c
+===================================================================
+--- linux-rt-2.6.31.orig/security/keys/permission.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/security/keys/permission.c	2010-05-17 14:23:20.148465269 +0200
+@@ -23,8 +23,7 @@
+  * Check to see whether permission is granted to use a key in the desired way,
+  * but permit the security modules to override.
+  *
+- * The caller must hold either a ref on cred or must hold the RCU readlock or a
+- * spinlock.
++ * The caller must hold either a ref on cred or must hold the RCU readlock.
+  */
+ int key_task_permission(const key_ref_t key_ref, const struct cred *cred,
+ 			key_perm_t perm)
+Index: linux-rt-2.6.31/security/keys/proc.c
+===================================================================
+--- linux-rt-2.6.31.orig/security/keys/proc.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/security/keys/proc.c	2010-05-17 14:23:20.148465269 +0200
+@@ -159,8 +159,6 @@
+ 
+ 	/* check whether the current task is allowed to view the key (assuming
+ 	 * non-possession)
+-	 * - the caller holds a spinlock, and thus the RCU read lock, making our
+-	 *   access to __current_cred() safe
+ 	 */
+ 	rc = key_task_permission(make_key_ref(key, 0), current_cred(),
+ 				 KEY_VIEW);
+Index: linux-rt-2.6.31/sound/drivers/pcsp/pcsp.h
+===================================================================
+--- linux-rt-2.6.31.orig/sound/drivers/pcsp/pcsp.h	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/sound/drivers/pcsp/pcsp.h	2010-05-17 14:23:20.148465269 +0200
+@@ -16,7 +16,7 @@
+ #include <asm/i8253.h>
+ #else
+ #include <asm/8253pit.h>
+-static DEFINE_SPINLOCK(i8253_lock);
++static DEFINE_ATOMIC_SPINLOCK(i8253_lock);
+ #endif
+ 
+ #define PCSP_SOUND_VERSION 0x400	/* read 4.00 */
+Index: linux-rt-2.6.31/sound/drivers/pcsp/pcsp_input.c
+===================================================================
+--- linux-rt-2.6.31.orig/sound/drivers/pcsp/pcsp_input.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/sound/drivers/pcsp/pcsp_input.c	2010-05-17 14:23:20.148465269 +0200
+@@ -21,7 +21,7 @@
+ {
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&i8253_lock, flags);
++	atomic_spin_lock_irqsave(&i8253_lock, flags);
+ 
+ 	if (count) {
+ 		/* set command for counter 2, 2 byte write */
+@@ -36,7 +36,7 @@
+ 		outb(inb_p(0x61) & 0xFC, 0x61);
+ 	}
+ 
+-	spin_unlock_irqrestore(&i8253_lock, flags);
++	atomic_spin_unlock_irqrestore(&i8253_lock, flags);
+ }
+ 
+ void pcspkr_stop_sound(void)
+Index: linux-rt-2.6.31/sound/drivers/pcsp/pcsp_lib.c
+===================================================================
+--- linux-rt-2.6.31.orig/sound/drivers/pcsp/pcsp_lib.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/sound/drivers/pcsp/pcsp_lib.c	2010-05-17 14:23:20.148465269 +0200
+@@ -70,7 +70,7 @@
+ 	timer_cnt = val * CUR_DIV() / 256;
+ 
+ 	if (timer_cnt && chip->enable) {
+-		spin_lock_irqsave(&i8253_lock, flags);
++		atomic_spin_lock_irqsave(&i8253_lock, flags);
+ 		if (!nforce_wa) {
+ 			outb_p(chip->val61, 0x61);
+ 			outb_p(timer_cnt, 0x42);
+@@ -79,7 +79,7 @@
+ 			outb(chip->val61 ^ 2, 0x61);
+ 			chip->thalf = 1;
+ 		}
+-		spin_unlock_irqrestore(&i8253_lock, flags);
++		atomic_spin_unlock_irqrestore(&i8253_lock, flags);
+ 	}
+ 
+ 	chip->ns_rem = PCSP_PERIOD_NS();
+@@ -152,10 +152,10 @@
+ 		return -EIO;
+ 	}
+ 
+-	spin_lock(&i8253_lock);
++	atomic_spin_lock(&i8253_lock);
+ 	chip->val61 = inb(0x61) | 0x03;
+ 	outb_p(0x92, 0x43);	/* binary, mode 1, LSB only, ch 2 */
+-	spin_unlock(&i8253_lock);
++	atomic_spin_unlock(&i8253_lock);
+ 	atomic_set(&chip->timer_active, 1);
+ 	chip->thalf = 0;
+ 
+@@ -176,11 +176,11 @@
+ 		return;
+ 
+ 	atomic_set(&chip->timer_active, 0);
+-	spin_lock(&i8253_lock);
++	atomic_spin_lock(&i8253_lock);
+ 	/* restore the timer */
+ 	outb_p(0xb6, 0x43);	/* binary, mode 3, LSB/MSB, ch 2 */
+ 	outb(chip->val61 & 0xFC, 0x61);
+-	spin_unlock(&i8253_lock);
++	atomic_spin_unlock(&i8253_lock);
+ }
+ 
+ /*
+Index: linux-rt-2.6.31/sound/soc/s3c24xx/s3c2443-ac97.c
+===================================================================
+--- linux-rt-2.6.31.orig/sound/soc/s3c24xx/s3c2443-ac97.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/sound/soc/s3c24xx/s3c2443-ac97.c	2010-05-17 14:23:20.148465269 +0200
+@@ -47,7 +47,7 @@
+ 
+ static DECLARE_COMPLETION(ac97_completion);
+ static u32 codec_ready;
+-static DECLARE_MUTEX(ac97_mutex);
++static DEFINE_MUTEX(ac97_mutex);
+ 
+ static unsigned short s3c2443_ac97_read(struct snd_ac97 *ac97,
+ 	unsigned short reg)
+@@ -56,7 +56,7 @@
+ 	u32 ac_codec_cmd;
+ 	u32 stat, addr, data;
+ 
+-	down(&ac97_mutex);
++	mutex_lock(&ac97_mutex);
+ 
+ 	codec_ready = S3C_AC97_GLBSTAT_CODECREADY;
+ 	ac_codec_cmd = readl(s3c24xx_ac97.regs + S3C_AC97_CODEC_CMD);
+@@ -79,7 +79,7 @@
+ 		printk(KERN_ERR "s3c24xx-ac97: req addr = %02x,"
+ 				" rep addr = %02x\n", reg, addr);
+ 
+-	up(&ac97_mutex);
++	mutex_unlock(&ac97_mutex);
+ 
+ 	return (unsigned short)data;
+ }
+@@ -90,7 +90,7 @@
+ 	u32 ac_glbctrl;
+ 	u32 ac_codec_cmd;
+ 
+-	down(&ac97_mutex);
++	mutex_lock(&ac97_mutex);
+ 
+ 	codec_ready = S3C_AC97_GLBSTAT_CODECREADY;
+ 	ac_codec_cmd = readl(s3c24xx_ac97.regs + S3C_AC97_CODEC_CMD);
+@@ -109,7 +109,7 @@
+ 	ac_codec_cmd |= S3C_AC97_CODEC_CMD_READ;
+ 	writel(ac_codec_cmd, s3c24xx_ac97.regs + S3C_AC97_CODEC_CMD);
+ 
+-	up(&ac97_mutex);
++	mutex_unlock(&ac97_mutex);
+ 
+ }
+ 
+Index: linux-rt-2.6.31/tools/perf/util/parse-events.c
+===================================================================
+--- linux-rt-2.6.31.orig/tools/perf/util/parse-events.c	2009-09-10 00:13:59.000000000 +0200
++++ linux-rt-2.6.31/tools/perf/util/parse-events.c	2010-05-17 14:23:20.158386991 +0200
+@@ -616,7 +616,7 @@
+ 								evt_path, st) {
+ 			snprintf(evt_path, MAXPATHLEN, "%s:%s",
+ 				 sys_dirent.d_name, evt_dirent.d_name);
+-			fprintf(stderr, "  %-40s [%s]\n", evt_path,
++			fprintf(stderr, "  %-42s [%s]\n", evt_path,
+ 				event_type_descriptors[PERF_TYPE_TRACEPOINT+1]);
+ 		}
+ 		closedir(evt_dir);
+@@ -650,7 +650,7 @@
+ 			sprintf(name, "%s OR %s", syms->symbol, syms->alias);
+ 		else
+ 			strcpy(name, syms->symbol);
+-		fprintf(stderr, "  %-40s [%s]\n", name,
++		fprintf(stderr, "  %-42s [%s]\n", name,
+ 			event_type_descriptors[type]);
+ 
+ 		prev_type = type;
+@@ -664,7 +664,7 @@
+ 				continue;
+ 
+ 			for (i = 0; i < PERF_COUNT_HW_CACHE_RESULT_MAX; i++) {
+-				fprintf(stderr, "  %-40s [%s]\n",
++				fprintf(stderr, "  %-42s [%s]\n",
+ 					event_cache_name(type, op, i),
+ 					event_type_descriptors[4]);
+ 			}
+@@ -672,7 +672,7 @@
+ 	}
+ 
+ 	fprintf(stderr, "\n");
+-	fprintf(stderr, "  %-40s [raw hardware event descriptor]\n",
++	fprintf(stderr, "  %-42s [raw hardware event descriptor]\n",
+ 		"rNNN");
+ 	fprintf(stderr, "\n");
+ 
+Index: linux-rt-2.6.31/virt/kvm/kvm_main.c
+===================================================================
+--- linux-rt-2.6.31.orig/virt/kvm/kvm_main.c	2010-05-17 14:17:45.000000000 +0200
++++ linux-rt-2.6.31/virt/kvm/kvm_main.c	2010-05-17 14:23:20.158386991 +0200
+@@ -745,8 +745,8 @@
+ 	if (alloc_cpumask_var(&cpus, GFP_ATOMIC))
+ 		cpumask_clear(cpus);
+ 
+-	me = get_cpu();
+ 	spin_lock(&kvm->requests_lock);
++	me = get_cpu();
+ 	for (i = 0; i < KVM_MAX_VCPUS; ++i) {
+ 		vcpu = kvm->vcpus[i];
+ 		if (!vcpu)
+@@ -763,8 +763,8 @@
+ 		smp_call_function_many(cpus, ack_flush, NULL, 1);
+ 	else
+ 		called = false;
+-	spin_unlock(&kvm->requests_lock);
+ 	put_cpu();
++	spin_unlock(&kvm->requests_lock);
+ 	free_cpumask_var(cpus);
+ 	return called;
+ }
--- linux-rt-2.6.31.orig/debian/patches/target.patch
+++ linux-rt-2.6.31/debian/patches/target.patch
@@ -0,0 +1,21 @@
+diff -ruNp linux-14.47/ubuntu/iscsitarget/target.c linux-rt-2.6.31/ubuntu/iscsitarget/target.c
+--- linux-14.47/ubuntu/iscsitarget/target.c	2009-10-14 23:11:23.000000000 +0200
++++ linux-rt-2.6.31/ubuntu/iscsitarget/target.c	2009-12-13 12:37:15.000000000 +0100
+@@ -11,7 +11,7 @@
+ #define	MAX_NR_TARGETS	(1UL << 30)
+ 
+ static LIST_HEAD(target_list);
+-static DECLARE_MUTEX(target_list_sem);
++static DEFINE_MUTEX(target_list_sem);
+ static u32 next_target_id;
+ static u32 nr_targets;
+ 
+@@ -157,7 +157,7 @@ static int iscsi_target_create(struct ta
+ 
+ 	strncpy(target->name, name, sizeof(target->name) - 1);
+ 
+-	init_MUTEX(&target->target_sem);
++	semaphore_init(&target->target_sem);
+ 
+ 	INIT_LIST_HEAD(&target->session_list);
+ 	INIT_LIST_HEAD(&target->volumes);
--- linux-rt-2.6.31.orig/debian/patches/drbd_bitmap.patch
+++ linux-rt-2.6.31/debian/patches/drbd_bitmap.patch
@@ -0,0 +1,12 @@
+diff -ruNp linux-14.47/ubuntu/drbd/drbd_bitmap.c linux-rt-2.6.31/ubuntu/drbd/drbd_bitmap.c
+--- linux-14.47/ubuntu/drbd/drbd_bitmap.c	2009-10-14 23:11:23.000000000 +0200
++++ linux-rt-2.6.31/ubuntu/drbd/drbd_bitmap.c	2009-12-13 12:37:15.000000000 +0100
+@@ -288,7 +288,7 @@ int drbd_bm_init(struct drbd_conf *mdev)
+ 	if (!b)
+ 		return -ENOMEM;
+ 	spin_lock_init(&b->bm_lock);
+-	init_MUTEX(&b->bm_change);
++	semaphore_init(&b->bm_change);
+ 	init_waitqueue_head(&b->bm_io_wait);
+ 
+ 	mdev->bitmap = b;
--- linux-rt-2.6.31.orig/debian/d-i/exclude-modules.armel-orion5x
+++ linux-rt-2.6.31/debian/d-i/exclude-modules.armel-orion5x
@@ -0,0 +1,3 @@
+fat-modules
+nic-pcmcia-modules
+nic-usb-modules
--- linux-rt-2.6.31.orig/debian/d-i/exclude-modules.armel-ixp4xx
+++ linux-rt-2.6.31/debian/d-i/exclude-modules.armel-ixp4xx
@@ -0,0 +1,4 @@
+fat-modules
+storage-core-modules
+nic-pcmcia-modules
+nic-usb-modules
--- linux-rt-2.6.31.orig/debian/d-i/package-list
+++ linux-rt-2.6.31/debian/d-i/package-list
@@ -0,0 +1,169 @@
+Package: kernel-image
+Provides_armel: crypto-modules, ext2-modules, ext3-modules, socket-modules, fat-modules
+Provides_armel_versatile: crypto-modules, ext2-modules, ext3-modules, socket-modules, fb-modules
+
+Package: fat-modules
+Depends: kernel-image
+Priority: standard
+Description: FAT filesystem support
+ This includes Windows FAT and VFAT support.
+
+Package: fb-modules
+Depends: kernel-image
+Priority: standard
+Description: Framebuffer modules
+
+Package: firewire-core-modules
+Depends: kernel-image, storage-core-modules
+Priority: standard
+Description: Firewire (IEEE-1394) Support
+
+Package: floppy-modules
+Depends: kernel-image
+Priority: standard
+Description: Floppy driver support
+
+Package: fs-core-modules
+Depends: kernel-image
+Priority: standard
+Provides: jfs-modules, reiserfs-modules, xfs-modules
+Provides_armel: jfs-modules, reiserfs-modules, xfs-modules
+Description: Base filesystem modules
+ This includes jfs, reiserfs and xfs.
+
+Package: fs-secondary-modules
+Depends: kernel-image, fat-modules
+Priority: standard
+Provides: ntfs-modules, hfs-modules
+Description: Extra filesystem modules
+ This includes support for Windows NTFS and MacOS HFS/HFSPlus
+
+Package: input-modules
+Depends: kernel-image, usb-modules
+Priority: standard
+Description: Support for various input methods
+
+Package: irda-modules
+Depends: kernel-image, nic-shared-modules
+Priority: standard
+Description: Support for Infrared protocols
+
+Package: md-modules
+Depends: kernel-image
+Priority: standard
+Description: Multi-device support (raid, device-mapper, lvm)
+
+Package: nic-modules
+Depends: kernel-image, nic-shared-modules, virtio-modules
+Priority: standard
+Description: Network interface support
+
+Package: nic-pcmcia-modules
+Depends: kernel-image, nic-shared-modules, nic-modules
+Priority: standard
+Description: PCMCIA network interface support
+
+Package: nic-usb-modules
+Depends: kernel-image, nic-shared-modules, usb-modules
+Priority: standard
+Description: USB network interface support
+
+Package: parport-modules
+Depends: kernel-image
+Priority: standard
+Description: Parallel port support
+
+Package: pata-modules
+Depends: kernel-image, storage-core-modules
+Priority: standard
+Description: PATA support modules
+
+Package: pcmcia-modules
+Depends: kernel-image
+Priority: standard
+Description: PCMCIA Modules
+
+Package: pcmcia-storage-modules
+Depends: kernel-image, scsi-modules
+Priority: standard
+Description: PCMCIA storage support
+
+Package: plip-modules
+Depends: kernel-image, nic-shared-modules, parport-modules
+Priority: standard
+Description: PLIP (parallel port) networking support
+
+Package: ppp-modules
+Depends: kernel-image, nic-shared-modules, serial-modules
+Priority: standard
+Description: PPP (serial port) networking support
+
+Package: sata-modules
+Depends: kernel-image, storage-core-modules
+Priority: standard
+Description: SATA storage support
+
+Package: scsi-modules
+Depends: kernel-image, storage-core-modules
+Priority: standard
+Description: SCSI storage support
+
+Package: serial-modules
+Depends: kernel-image
+Priority: standard
+Description: Serial port support
+
+Package: storage-core-modules
+Depends: kernel-image
+Priority: standard
+Provides: loop-modules
+Description: Core storage support
+ Includes core SCSI, LibATA, USB-Storage. Also includes related block
+ devices for CD, Disk and Tape medium (and IDE Floppy).
+
+Package: usb-modules
+Depends: kernel-image, storage-core-modules
+Priority: standard
+Description: Core USB support
+
+Package: nfs-modules
+Priority: standard
+Depends: kernel-image
+Description: NFS filesystem drivers
+ Includes the NFS client driver, and supporting modules.
+
+Package: block-modules
+Priority: standard
+Depends: kernel-image, storage-core-modules, parport-modules, virtio-modules
+Description: Block storage devices
+ This package contains the block storage devices, including DAC960 and
+ paraide.
+
+Package: message-modules
+Priority: standard
+Depends: kernel-image, storage-core-modules, scsi-modules
+Description: Fusion and i2o storage modules
+ This package containes the fusion and i2o storage modules.
+
+Package: crypto-modules
+Priority: extra
+Depends: kernel-image
+Description: crypto modules
+ This package contains crypto modules.
+
+Package: virtio-modules
+Priority: standard
+Depends: kernel-image
+Description: VirtIO Modules
+ Includes modules for VirtIO (virtual machine, generally kvm guests)
+
+Package: socket-modules
+Depends: kernel-image
+Priority: standard
+Description: Unix socket support
+
+Package: mouse-modules
+Depends: kernel-image, input-modules, usb-modules
+Priority: extra
+Description: Mouse support
+ This package contains mouse drivers for the Linux kernel.
--- linux-rt-2.6.31.orig/debian/d-i/exclude-modules.armel-iop32x
+++ linux-rt-2.6.31/debian/d-i/exclude-modules.armel-iop32x
@@ -0,0 +1,4 @@
+fat-modules
+storage-core-modules
+nic-pcmcia-modules
+nic-usb-modules
--- linux-rt-2.6.31.orig/debian/d-i/exclude-modules.armel
+++ linux-rt-2.6.31/debian/d-i/exclude-modules.armel
@@ -0,0 +1,27 @@
+acpi-modules
+block-modules
+crypto-modules
+ext2-modules
+ext3-modules
+fb-modules
+firewire-core-modules
+floppy-modules
+input-modules
+irda-modules
+md-modules
+message-modules
+mouse-modules
+nfs-modules
+nic-pcmcia-modules
+nic-shared-modules
+parport-modules
+pata-modules
+pcmcia-modules
+pcmcia-storage-modules
+plip-modules
+ppp-modules
+sata-modules
+serial-modules
+socket-modules
+usb-modules
+virtio-modules
--- linux-rt-2.6.31.orig/debian/d-i/kernel-versions
+++ linux-rt-2.6.31/debian/d-i/kernel-versions
@@ -0,0 +1,9 @@
+# arch	version		flavour		installedname			suffix	bdep
+amd64	2.6.28-1	generic		2.6.28-1-generic		-	
+
+armel	2.6.28-1	iop32x		2.6.28-1-iop32x		y
+armel	2.6.28-1	ixp4xx		2.6.28-1-ixp4xx		y
+armel	2.6.28-1	orion5x		2.6.28-1-orion5x		y
+armel	2.6.28-1	versatile	2.6.28-1-versatile		y
+
+i386	2.6.28-1	generic		2.6.28-1-generic		-	
--- linux-rt-2.6.31.orig/debian/d-i/exclude-modules.armel-versatile
+++ linux-rt-2.6.31/debian/d-i/exclude-modules.armel-versatile
@@ -0,0 +1,8 @@
+fb-modules
+fs-core-modules
+fs-secondary-modules
+nic-modules
+nic-pcmcia-modules
+nic-usb-modules
+scsi-modules
+storage-core-modules
--- linux-rt-2.6.31.orig/debian/d-i/kernel-versions.in
+++ linux-rt-2.6.31/debian/d-i/kernel-versions.in
@@ -0,0 +1,9 @@
+# arch	version		flavour		installedname			suffix	bdep
+amd64	PKGVER-ABINUM	generic		PKGVER-ABINUM-generic		-	
+
+armel	PKGVER-ABINUM	iop32x		PKGVER-ABINUM-iop32x		y
+armel	PKGVER-ABINUM	ixp4xx		PKGVER-ABINUM-ixp4xx		y
+armel	PKGVER-ABINUM	orion5x		PKGVER-ABINUM-orion5x		y
+armel	PKGVER-ABINUM	versatile	PKGVER-ABINUM-versatile		y
+
+i386	PKGVER-ABINUM	generic		PKGVER-ABINUM-generic		-	
--- linux-rt-2.6.31.orig/debian/d-i/modules/scsi-modules
+++ linux-rt-2.6.31/debian/d-i/modules/scsi-modules
@@ -0,0 +1,113 @@
+# SCSI
+raid_class ?
+scsi_transport_spi ?
+scsi_transport_fc ?
+scsi_transport_iscsi ?
+scsi_transport_sas ?
+iscsi_tcp ?
+libiscsi ?
+amiga7xx ?
+a3000 ?
+a2091 ?
+gvp11 ?
+mvme147 ?
+sgiwd93 ?
+cyberstorm ?
+cyberstormII ?
+blz2060 ?
+blz1230 ?
+fastlane ?
+oktagon_esp_mod ?
+atari_scsi ?
+mac_scsi ?
+mac_esp ?
+sun3_scsi ?
+mvme16x ?
+bvme6000 ?
+sim710 ?
+advansys ?
+psi240i ?
+BusLogic ?
+dpt_i2o ?
+u14-34f ?
+ultrastor ?
+aha152x ?
+aha1542 ?
+aha1740 ?
+aic7xxx_old ?
+ips ?
+fd_mcs ?
+fdomain ?
+in2000 ?
+g_NCR5380 ?
+g_NCR5380_mmio ?
+NCR53c406a ?
+NCR_D700 ?
+NCR_Q720_mod ?
+sym53c416 ?
+qlogicfas408 ?
+qla1280 ?
+pas16 ?
+seagate ?
+seagate ?
+t128 ?
+dmx3191d ?
+dtc ?
+zalon7xx ?
+eata_pio ?
+wd7000 ?
+mca_53c9x ?
+ibmmca ?
+eata ?
+dc395x ?
+tmscsim ?
+megaraid ?
+atp870u ?
+esp ?
+gdth ?
+initio ?
+a100u2w ?
+qlogicpti ?
+ide-scsi ?
+mesh ?
+mac53c94 ?
+pluto ?
+dec_esp ?
+3w-xxxx ?
+3w-9xxx ?
+ppa ?
+imm ?
+jazz_esp ?
+sun3x_esp ?
+fcal ?
+lasi700 ?
+nsp32 ?
+ipr ?
+hptiop ?
+stex ?
+osst ?
+sg ?
+ch ?
+scsi_debug ?
+aacraid ?
+aic7xxx ?
+aic79xx ?
+aic94xx ?
+arcmsr ?
+acornscsi_mod ?
+arxescsi ?
+cumana_1 ?
+cumana_2 ?
+ecoscsi ?
+oak ?
+powertec ?
+eesox ?
+ibmvscsic ?
+libsas ?
+lpfc ?
+megaraid_mm ?
+megaraid_mbox ?
+megaraid_sas ?
+qla2xxx ?
+sym53c8xx ?
+qla4xxx ?
--- linux-rt-2.6.31.orig/debian/d-i/modules/parport-modules
+++ linux-rt-2.6.31/debian/d-i/modules/parport-modules
@@ -0,0 +1,2 @@
+parport
+parport_pc
--- linux-rt-2.6.31.orig/debian/d-i/modules/pata-modules
+++ linux-rt-2.6.31/debian/d-i/modules/pata-modules
@@ -0,0 +1,2 @@
+pata_it8213
+pata_ninja32
--- linux-rt-2.6.31.orig/debian/d-i/modules/virtio-modules
+++ linux-rt-2.6.31/debian/d-i/modules/virtio-modules
@@ -0,0 +1,4 @@
+virtio_balloon
+virtio_pci
+virtio_ring ?
+virtio-rng
--- linux-rt-2.6.31.orig/debian/d-i/modules/usb-modules
+++ linux-rt-2.6.31/debian/d-i/modules/usb-modules
@@ -0,0 +1,9 @@
+ehci-hcd
+isp116x-hcd
+isp1760
+ohci-hcd
+r8a66597-hcd
+sl811_cs
+sl811-hcd
+u132-hcd
+uhci-hcd
--- linux-rt-2.6.31.orig/debian/d-i/modules/serial-modules
+++ linux-rt-2.6.31/debian/d-i/modules/serial-modules
@@ -0,0 +1,3 @@
+generic_serial
+serial_cs
+synclink_cs
--- linux-rt-2.6.31.orig/debian/d-i/modules/message-modules
+++ linux-rt-2.6.31/debian/d-i/modules/message-modules
@@ -0,0 +1,13 @@
+mptbase
+mptctl
+mptfc
+mptlan
+mptsas
+mptscsih
+mptspi
+i2o_block
+i2o_bus
+i2o_config
+i2o_core
+i2o_proc
+i2o_scsi
--- linux-rt-2.6.31.orig/debian/d-i/modules/firewire-core-modules
+++ linux-rt-2.6.31/debian/d-i/modules/firewire-core-modules
@@ -0,0 +1,4 @@
+ieee1394
+ohci1394
+sbp2
+eth1394
--- linux-rt-2.6.31.orig/debian/d-i/modules/nic-shared-modules
+++ linux-rt-2.6.31/debian/d-i/modules/nic-shared-modules
@@ -0,0 +1,21 @@
+# PHY
+8390
+mii
+
+# CRC modules
+crc-ccitt
+crc-itu-t
+
+# mac80211 stuff
+mac80211
+cfg80211
+
+# rt2x00 lib (since rt2x00 is split across usb/pci/cb
+rt2x00lib
+
+# Wireless 802.11 modules
+ieee80211
+ieee80211_crypt
+ieee80211_crypt_ccmp
+ieee80211_crypt_tkip
+ieee80211_crypt_wep
--- linux-rt-2.6.31.orig/debian/d-i/modules/nic-modules
+++ linux-rt-2.6.31/debian/d-i/modules/nic-modules
@@ -0,0 +1,150 @@
+3c359 ?
+3c501 ?
+3c503 ?
+3c505 ?
+3c507 ?
+3c509 ?
+3c515 ?
+3c523 ?
+3c527 ?
+3c59x ?
+8139cp ?
+8139too ?
+82596 ?
+abyss ?
+ac3200 ?
+adm8211 ?
+airo ?
+airport ?
+amd8111e ?
+arc4 ?
+arcnet ?
+arc-rawmode ?
+arc-rimi ?
+arlan ?
+at1700 ?
+atl1 ?
+atl1e ?
+atl2 ?
+atmel ?
+atmel_pci ?
+b44 ?
+bcm43xx ?
+bcm43xx-mac80211 ?
+bmac ?
+bnx2 ?
+bonding ?
+cassini ?
+com20020 ?
+com20020-pci ?
+com90io ?
+com90xx ?
+cs89x0 ?
+de2104x ?
+de4x5 ?
+de600 ?
+de620 ?
+defxx ?
+depca ?
+dl2k ?
+dmfe ?
+dummy ?
+e100 ?
+e1000 ?
+e1000e ?
+e2100 ?
+eepro ?
+eepro100 ?
+eexpress ?
+epic100 ?
+eql ?
+es3210 ?
+eth16i ?
+ewrk3 ?
+fealnx ?
+forcedeth ?
+igb ?
+ps3_gelic ?
+hamachi ?
+hermes ?
+hp ?
+hp100 ?
+hp-plus ?
+ibmtr ?
+ipddp ?
+ipw2100 ?
+ipw2200 ?
+ipw3945 ?
+ixgb ?
+lance ?
+lanstreamer ?
+lasi_82596 ?
+lne390 ?
+lp486e ?
+mace ?
+mv643xx_eth ?
+myri_sbus ?
+natsemi ?
+ne ?
+ne2 ?
+ne2k-pci ?
+ne3210 ?
+netconsole ?
+ni5010 ?
+ni52 ?
+ni65 ?
+niu ?
+ns83820 ?
+olympic ?
+orinoco ?
+orinoco_pci ?
+orinoco_plx ?
+orinoco_tmd ?
+pcnet32 ?
+prism54 ?
+r8169 ?
+rate_control ?
+rfc1051 ?
+rfc1201 ?
+rrunner ?
+rt2400 ?
+rt2500 ?
+rt61pci ?
+s2io ?
+shaper ?
+sis190 ?
+sis900 ?
+spidernet ?
+skfp ?
+skge ?
+sk98lin ?
+sky2 ?
+smc9194 ?
+smc-ultra ?
+smc-ultra32 ?
+starfire ?
+strip ?
+sunbmac ?
+sundance ?
+sungem ?
+sungem_phy ?
+sunhme ?
+sunlance ?
+sunqe ?
+sunvnet ?
+tg3 ?
+tlan ?
+tms380tr ?
+tmspci ?
+tulip ?
+tun ?
+typhoon ?
+uli526x ?
+via-rhine ?
+via-velocity ?
+virtio_net ?
+wavelan ?
+wd ?
+winbond-840 ?
+yellowfin ?
+znet ?
--- linux-rt-2.6.31.orig/debian/d-i/modules/pcmcia-storage-modules
+++ linux-rt-2.6.31/debian/d-i/modules/pcmcia-storage-modules
@@ -0,0 +1,6 @@
+pata_pcmcia
+qlogic_cs
+fdomain_cs
+aha152x_cs ?
+nsp_cs ?
+sym53c500_cs
--- linux-rt-2.6.31.orig/debian/d-i/modules/fs-secondary-modules
+++ linux-rt-2.6.31/debian/d-i/modules/fs-secondary-modules
@@ -0,0 +1,4 @@
+fuse ?
+ntfs ?
+hfs ?
+hfsplus ?
--- linux-rt-2.6.31.orig/debian/d-i/modules/nic-pcmcia-modules
+++ linux-rt-2.6.31/debian/d-i/modules/nic-pcmcia-modules
@@ -0,0 +1,19 @@
+3c574_cs ?
+3c589_cs ?
+airo_cs ?
+atmel_cs ?
+axnet_cs ?
+com20020_cs ?
+fmvj18x_cs ?
+ibmtr_cs ?
+netwave_cs ?
+nmclan_cs ?
+orinoco_cs ?
+pcnet_cs ?
+ray_cs ?
+smc91c92_cs ?
+wavelan_cs ?
+wl3501_cs ?
+xirc2ps_cs ?
+xircom_cb ?
+xircom_tulip_cb ?
--- linux-rt-2.6.31.orig/debian/d-i/modules/input-modules
+++ linux-rt-2.6.31/debian/d-i/modules/input-modules
@@ -0,0 +1,22 @@
+hid_a4tech ?
+hid_apple ?
+hid_belkin ?
+hid_bright ?
+hid_cherry ?
+hid_chicony ?
+hid_cypress ?
+hid_dell ?
+hid_ezkey ?
+hid_gyration ?
+hid_logitech ?
+hid_microsoft ?
+hid_monterey ?
+hid_petalynx ?
+hid_pl ?
+hid_samsung ?
+hid_sony ?
+hid_sunplus ?
+hid_tmff ?
+hid_zpff ?
+usbhid
+usbkbd
--- linux-rt-2.6.31.orig/debian/d-i/modules/nfs-modules
+++ linux-rt-2.6.31/debian/d-i/modules/nfs-modules
@@ -0,0 +1,4 @@
+nfs
+nfs_acl
+lockd
+sunrpc
--- linux-rt-2.6.31.orig/debian/d-i/modules/fs-core-modules
+++ linux-rt-2.6.31/debian/d-i/modules/fs-core-modules
@@ -0,0 +1,3 @@
+jfs
+reiserfs
+xfs
--- linux-rt-2.6.31.orig/debian/d-i/modules/md-modules
+++ linux-rt-2.6.31/debian/d-i/modules/md-modules
@@ -0,0 +1,14 @@
+dm-crypt
+dm-zero
+faulty
+linear
+multipath
+raid0
+raid1
+raid10
+raid456
+
+# Extras
+dm-raid4-5 ?
+dm-loop
+dm-bbr
--- linux-rt-2.6.31.orig/debian/d-i/modules/crypto-modules
+++ linux-rt-2.6.31/debian/d-i/modules/crypto-modules
@@ -0,0 +1,8 @@
+aes_generic
+blowfish
+twofish
+serpent
+sha256_generic
+cbc
+ecb
+crc32c
--- linux-rt-2.6.31.orig/debian/d-i/modules/irda-modules
+++ linux-rt-2.6.31/debian/d-i/modules/irda-modules
@@ -0,0 +1,30 @@
+act200l-sir
+actisys-sir
+ali-ircc
+donauboe ?
+esi-sir
+girbil-sir
+ircomm
+ircomm-tty
+irda
+irda-usb
+irlan
+irnet
+irport ?
+irtty-sir
+kingsun-sir
+ks959-sir
+ksdazzle-sir
+litelink-sir
+ma600-sir
+mcp2120-sir
+mcs7780
+nsc-ircc
+old_belkin-sir
+sir-dev
+smsc-ircc2
+stir4200
+tekram-sir
+via-ircc
+vlsi_ir
+w83977af_ir
--- linux-rt-2.6.31.orig/debian/d-i/modules/fb-modules
+++ linux-rt-2.6.31/debian/d-i/modules/fb-modules
@@ -0,0 +1,3 @@
+fbcon
+vesafb
+vga16fb
--- linux-rt-2.6.31.orig/debian/d-i/modules/mouse-modules
+++ linux-rt-2.6.31/debian/d-i/modules/mouse-modules
@@ -0,0 +1,2 @@
+psmouse
+usbmouse ?
--- linux-rt-2.6.31.orig/debian/d-i/modules/storage-core-modules
+++ linux-rt-2.6.31/debian/d-i/modules/storage-core-modules
@@ -0,0 +1,10 @@
+# Core stacks
+usb-storage
+
+# Block level
+
+# Loop modules
+cryptoloop
+
+# Needs to be here for better cdrom initrd layout
+isofs
--- linux-rt-2.6.31.orig/debian/d-i/modules/ppp-modules
+++ linux-rt-2.6.31/debian/d-i/modules/ppp-modules
@@ -0,0 +1,7 @@
+ppp_async
+ppp_deflate
+ppp_mppe
+pppoe
+pppox
+ppp_synctty
+syncppp
--- linux-rt-2.6.31.orig/debian/d-i/modules/pcmcia-modules
+++ linux-rt-2.6.31/debian/d-i/modules/pcmcia-modules
@@ -0,0 +1,8 @@
+i82092
+i82365 ?
+pcmcia
+pcmcia_core
+pd6729
+rsrc_nonstatic
+tcic ?
+yenta_socket
--- linux-rt-2.6.31.orig/debian/d-i/modules/fat-modules
+++ linux-rt-2.6.31/debian/d-i/modules/fat-modules
@@ -0,0 +1,7 @@
+fat
+vfat
+
+# Supporting modules ?
+nls_cp437 ?
+nls_iso8859-1 ?
+nls_utf8 ?
--- linux-rt-2.6.31.orig/debian/d-i/modules/sata-modules
+++ linux-rt-2.6.31/debian/d-i/modules/sata-modules
@@ -0,0 +1,2 @@
+
+sata_mv
--- linux-rt-2.6.31.orig/debian/d-i/modules/plip-modules
+++ linux-rt-2.6.31/debian/d-i/modules/plip-modules
@@ -0,0 +1 @@
+plip
--- linux-rt-2.6.31.orig/debian/d-i/modules/block-modules
+++ linux-rt-2.6.31/debian/d-i/modules/block-modules
@@ -0,0 +1,30 @@
+aoe
+aten
+bpck
+bpck6 ?
+cciss
+comm
+cpqarray
+DAC960
+dstr
+epat
+epia
+fit2
+fit3
+friq
+frpw
+kbic
+ktti
+nbd
+on20
+on26
+paride
+pcd
+pd
+pf
+pg
+pt
+sx8
+ub
+umem
+virtio_blk ?
--- linux-rt-2.6.31.orig/debian/d-i/modules/floppy-modules
+++ linux-rt-2.6.31/debian/d-i/modules/floppy-modules
@@ -0,0 +1 @@
+floppy
--- linux-rt-2.6.31.orig/debian/d-i/modules/nic-usb-modules
+++ linux-rt-2.6.31/debian/d-i/modules/nic-usb-modules
@@ -0,0 +1,11 @@
+catc ?
+kaweth ?
+pegasus ?
+prism2_usb ?
+rtl8150 ?
+usbnet ?
+zd1211rw ?
+zd1201 ?
+rt2500usb ?
+rt73usb ?
+rt2570 ?
--- linux-rt-2.6.31.orig/debian/d-i/modules-armel-orion5x/storage-core-modules
+++ linux-rt-2.6.31/debian/d-i/modules-armel-orion5x/storage-core-modules
@@ -0,0 +1,6 @@
+# Block level
+cdrom
+sr_mod ?
+
+# Needs to be here for better cdrom initrd layout
+isofs
--- linux-rt-2.6.31.orig/debian/d-i/modules-armel/fs-core-modules
+++ linux-rt-2.6.31/debian/d-i/modules-armel/fs-core-modules
@@ -0,0 +1,5 @@
+# ext2 and ext3 are built-in.
+
+jfs ?
+reiserfs ?
+xfs ?
--- linux-rt-2.6.31.orig/arch/m68knommu/kernel/syscalltable.S
+++ linux-rt-2.6.31/arch/m68knommu/kernel/syscalltable.S
@@ -210,7 +210,7 @@
 	.long sys_ni_syscall	/* streams2 */
 	.long sys_vfork		/* 190 */
 	.long sys_getrlimit
-	.long sys_mmap2
+	.long sys_mmap_pgoff
 	.long sys_truncate64
 	.long sys_ftruncate64
 	.long sys_stat64	/* 195 */
--- linux-rt-2.6.31.orig/arch/m68knommu/kernel/sys_m68k.c
+++ linux-rt-2.6.31/arch/m68knommu/kernel/sys_m68k.c
@@ -28,39 +28,6 @@
 #include <asm/cacheflush.h>
 #include <asm/unistd.h>
 
-/* common code for old and new mmaps */
-static inline long do_mmap2(
-	unsigned long addr, unsigned long len,
-	unsigned long prot, unsigned long flags,
-	unsigned long fd, unsigned long pgoff)
-{
-	int error = -EBADF;
-	struct file * file = NULL;
-
-	flags &= ~(MAP_EXECUTABLE | MAP_DENYWRITE);
-	if (!(flags & MAP_ANONYMOUS)) {
-		file = fget(fd);
-		if (!file)
-			goto out;
-	}
-
-	down_write(&current->mm->mmap_sem);
-	error = do_mmap_pgoff(file, addr, len, prot, flags, pgoff);
-	up_write(&current->mm->mmap_sem);
-
-	if (file)
-		fput(file);
-out:
-	return error;
-}
-
-asmlinkage long sys_mmap2(unsigned long addr, unsigned long len,
-	unsigned long prot, unsigned long flags,
-	unsigned long fd, unsigned long pgoff)
-{
-	return do_mmap2(addr, len, prot, flags, fd, pgoff);
-}
-
 /*
  * Perform the select(nd, in, out, ex, tv) and mmap() system
  * calls. Linux/m68k cloned Linux/i386, which didn't use to be able to
@@ -89,9 +56,8 @@
 	if (a.offset & ~PAGE_MASK)
 		goto out;
 
-	a.flags &= ~(MAP_EXECUTABLE | MAP_DENYWRITE);
-
-	error = do_mmap2(a.addr, a.len, a.prot, a.flags, a.fd, a.offset >> PAGE_SHIFT);
+	error = sys_mmap_pgoff(a.addr, a.len, a.prot, a.flags, a.fd,
+				a.offset >> PAGE_SHIFT);
 out:
 	return error;
 }
--- linux-rt-2.6.31.orig/arch/alpha/kernel/pci_impl.h
+++ linux-rt-2.6.31/arch/alpha/kernel/pci_impl.h
@@ -198,7 +198,7 @@
 
 extern int iommu_reserve(struct pci_iommu_arena *, long, long);
 extern int iommu_release(struct pci_iommu_arena *, long, long);
-extern int iommu_bind(struct pci_iommu_arena *, long, long, unsigned long *);
+extern int iommu_bind(struct pci_iommu_arena *, long, long, struct page **);
 extern int iommu_unbind(struct pci_iommu_arena *, long, long);
 
 
--- linux-rt-2.6.31.orig/arch/alpha/kernel/pci_iommu.c
+++ linux-rt-2.6.31/arch/alpha/kernel/pci_iommu.c
@@ -880,7 +880,7 @@
 
 int
 iommu_bind(struct pci_iommu_arena *arena, long pg_start, long pg_count, 
-	   unsigned long *physaddrs)
+	   struct page **pages)
 {
 	unsigned long flags;
 	unsigned long *ptes;
@@ -900,7 +900,7 @@
 	}
 		
 	for(i = 0, j = pg_start; i < pg_count; i++, j++)
-		ptes[j] = mk_iommu_pte(physaddrs[i]);
+		ptes[j] = mk_iommu_pte(page_to_phys(pages[i]));
 
 	spin_unlock_irqrestore(&arena->lock, flags);
 
--- linux-rt-2.6.31.orig/arch/alpha/kernel/osf_sys.c
+++ linux-rt-2.6.31/arch/alpha/kernel/osf_sys.c
@@ -178,25 +178,18 @@
 		unsigned long, prot, unsigned long, flags, unsigned long, fd,
 		unsigned long, off)
 {
-	struct file *file = NULL;
-	unsigned long ret = -EBADF;
+	unsigned long ret = -EINVAL;
 
 #if 0
 	if (flags & (_MAP_HASSEMAPHORE | _MAP_INHERIT | _MAP_UNALIGNED))
 		printk("%s: unimplemented OSF mmap flags %04lx\n", 
 			current->comm, flags);
 #endif
-	if (!(flags & MAP_ANONYMOUS)) {
-		file = fget(fd);
-		if (!file)
-			goto out;
-	}
-	flags &= ~(MAP_EXECUTABLE | MAP_DENYWRITE);
-	down_write(&current->mm->mmap_sem);
-	ret = do_mmap(file, addr, len, prot, flags, off);
-	up_write(&current->mm->mmap_sem);
-	if (file)
-		fput(file);
+	if ((off + PAGE_ALIGN(len)) < off)
+		goto out;
+	if (off & ~PAGE_MASK)
+		goto out;
+	ret = sys_mmap_pgoff(addr, len, prot, flags, fd, off >> PAGE_SHIFT);
  out:
 	return ret;
 }
--- linux-rt-2.6.31.orig/arch/alpha/kernel/vmlinux.lds.S
+++ linux-rt-2.6.31/arch/alpha/kernel/vmlinux.lds.S
@@ -1,4 +1,5 @@
 #include <asm-generic/vmlinux.lds.h>
+#include <asm/thread_info.h>
 #include <asm/page.h>
 
 OUTPUT_FORMAT("elf64-alpha")
--- linux-rt-2.6.31.orig/arch/alpha/kernel/core_titan.c
+++ linux-rt-2.6.31/arch/alpha/kernel/core_titan.c
@@ -680,7 +680,7 @@
 {
 	struct titan_agp_aperture *aper = agp->aperture.sysdata;
 	return iommu_bind(aper->arena, aper->pg_start + pg_start, 
-			  mem->page_count, mem->memory);
+			  mem->page_count, mem->pages);
 }
 
 static int 
--- linux-rt-2.6.31.orig/arch/alpha/kernel/core_marvel.c
+++ linux-rt-2.6.31/arch/alpha/kernel/core_marvel.c
@@ -1016,7 +1016,7 @@
 {
 	struct marvel_agp_aperture *aper = agp->aperture.sysdata;
 	return iommu_bind(aper->arena, aper->pg_start + pg_start, 
-			  mem->page_count, mem->memory);
+			  mem->page_count, mem->pages);
 }
 
 static int 
--- linux-rt-2.6.31.orig/arch/s390/include/asm/kvm.h
+++ linux-rt-2.6.31/arch/s390/include/asm/kvm.h
@@ -1,6 +1,5 @@
 #ifndef __LINUX_KVM_S390_H
 #define __LINUX_KVM_S390_H
-
 /*
  * asm-s390/kvm.h - KVM s390 specific structures and definitions
  *
@@ -24,6 +23,8 @@
 	/* no IOAPIC for s390 */
 };
 
+#define __KVM_S390
+
 /* for KVM_GET_REGS and KVM_SET_REGS */
 struct kvm_regs {
 	/* general purpose regs for s390 */
--- linux-rt-2.6.31.orig/arch/s390/kernel/sys_s390.c
+++ linux-rt-2.6.31/arch/s390/kernel/sys_s390.c
@@ -33,32 +33,6 @@
 #include <asm/uaccess.h>
 #include "entry.h"
 
-/* common code for old and new mmaps */
-static inline long do_mmap2(
-	unsigned long addr, unsigned long len,
-	unsigned long prot, unsigned long flags,
-	unsigned long fd, unsigned long pgoff)
-{
-	long error = -EBADF;
-	struct file * file = NULL;
-
-	flags &= ~(MAP_EXECUTABLE | MAP_DENYWRITE);
-	if (!(flags & MAP_ANONYMOUS)) {
-		file = fget(fd);
-		if (!file)
-			goto out;
-	}
-
-	down_write(&current->mm->mmap_sem);
-	error = do_mmap_pgoff(file, addr, len, prot, flags, pgoff);
-	up_write(&current->mm->mmap_sem);
-
-	if (file)
-		fput(file);
-out:
-	return error;
-}
-
 /*
  * Perform the select(nd, in, out, ex, tv) and mmap() system
  * calls. Linux for S/390 isn't able to handle more than 5
@@ -82,7 +56,7 @@
 
 	if (copy_from_user(&a, arg, sizeof(a)))
 		goto out;
-	error = do_mmap2(a.addr, a.len, a.prot, a.flags, a.fd, a.offset);
+	error = sys_mmap_pgoff(a.addr, a.len, a.prot, a.flags, a.fd, a.offset);
 out:
 	return error;
 }
@@ -99,7 +73,7 @@
 	if (a.offset & ~PAGE_MASK)
 		goto out;
 
-	error = do_mmap2(a.addr, a.len, a.prot, a.flags, a.fd, a.offset >> PAGE_SHIFT);
+	error = sys_mmap_pgoff(a.addr, a.len, a.prot, a.flags, a.fd, a.offset >> PAGE_SHIFT);
 out:
 	return error;
 }
--- linux-rt-2.6.31.orig/arch/s390/kernel/compat_linux.c
+++ linux-rt-2.6.31/arch/s390/kernel/compat_linux.c
@@ -722,38 +722,6 @@
 	u32	offset;
 };
 
-/* common code for old and new mmaps */
-static inline long do_mmap2(
-	unsigned long addr, unsigned long len,
-	unsigned long prot, unsigned long flags,
-	unsigned long fd, unsigned long pgoff)
-{
-	struct file * file = NULL;
-	unsigned long error = -EBADF;
-
-	flags &= ~(MAP_EXECUTABLE | MAP_DENYWRITE);
-	if (!(flags & MAP_ANONYMOUS)) {
-		file = fget(fd);
-		if (!file)
-			goto out;
-	}
-
-	down_write(&current->mm->mmap_sem);
-	error = do_mmap_pgoff(file, addr, len, prot, flags, pgoff);
-	if (!IS_ERR((void *) error) && error + len >= 0x80000000ULL) {
-		/* Result is out of bounds.  */
-		do_munmap(current->mm, addr, len);
-		error = -ENOMEM;
-	}
-	up_write(&current->mm->mmap_sem);
-
-	if (file)
-		fput(file);
-out:    
-	return error;
-}
-
-
 asmlinkage unsigned long
 old32_mmap(struct mmap_arg_struct_emu31 __user *arg)
 {
@@ -767,7 +735,8 @@
 	if (a.offset & ~PAGE_MASK)
 		goto out;
 
-	error = do_mmap2(a.addr, a.len, a.prot, a.flags, a.fd, a.offset >> PAGE_SHIFT); 
+	error = sys_mmap_pgoff(a.addr, a.len, a.prot, a.flags, a.fd,
+			       a.offset >> PAGE_SHIFT);
 out:
 	return error;
 }
@@ -780,7 +749,7 @@
 
 	if (copy_from_user(&a, arg, sizeof(a)))
 		goto out;
-	error = do_mmap2(a.addr, a.len, a.prot, a.flags, a.fd, a.offset);
+	error = sys_mmap_pgoff(a.addr, a.len, a.prot, a.flags, a.fd, a.offset);
 out:
 	return error;
 }
--- linux-rt-2.6.31.orig/arch/s390/kvm/kvm-s390.c
+++ linux-rt-2.6.31/arch/s390/kvm/kvm-s390.c
@@ -115,10 +115,16 @@
 
 int kvm_dev_ioctl_check_extension(long ext)
 {
+	int r;
+
 	switch (ext) {
+	case KVM_CAP_S390_PSW:
+		r = 1;
+		break;
 	default:
-		return 0;
+		r = 0;
 	}
+	return r;
 }
 
 /* Section: vm related */
@@ -422,8 +428,10 @@
 	vcpu_load(vcpu);
 	if (atomic_read(&vcpu->arch.sie_block->cpuflags) & CPUSTAT_RUNNING)
 		rc = -EBUSY;
-	else
-		vcpu->arch.sie_block->gpsw = psw;
+	else {
+		vcpu->run->psw_mask = psw.mask;
+		vcpu->run->psw_addr = psw.addr;
+	}
 	vcpu_put(vcpu);
 	return rc;
 }
@@ -505,9 +513,6 @@
 
 	switch (kvm_run->exit_reason) {
 	case KVM_EXIT_S390_SIEIC:
-		vcpu->arch.sie_block->gpsw.mask = kvm_run->s390_sieic.mask;
-		vcpu->arch.sie_block->gpsw.addr = kvm_run->s390_sieic.addr;
-		break;
 	case KVM_EXIT_UNKNOWN:
 	case KVM_EXIT_S390_RESET:
 		break;
@@ -515,6 +520,9 @@
 		BUG();
 	}
 
+	vcpu->arch.sie_block->gpsw.mask = kvm_run->psw_mask;
+	vcpu->arch.sie_block->gpsw.addr = kvm_run->psw_addr;
+
 	might_fault();
 
 	do {
@@ -529,8 +537,6 @@
 		/* intercept cannot be handled in-kernel, prepare kvm-run */
 		kvm_run->exit_reason         = KVM_EXIT_S390_SIEIC;
 		kvm_run->s390_sieic.icptcode = vcpu->arch.sie_block->icptcode;
-		kvm_run->s390_sieic.mask     = vcpu->arch.sie_block->gpsw.mask;
-		kvm_run->s390_sieic.addr     = vcpu->arch.sie_block->gpsw.addr;
 		kvm_run->s390_sieic.ipa      = vcpu->arch.sie_block->ipa;
 		kvm_run->s390_sieic.ipb      = vcpu->arch.sie_block->ipb;
 		rc = 0;
@@ -542,6 +548,9 @@
 		rc = 0;
 	}
 
+	kvm_run->psw_mask     = vcpu->arch.sie_block->gpsw.mask;
+	kvm_run->psw_addr     = vcpu->arch.sie_block->gpsw.addr;
+
 	if (vcpu->sigset_active)
 		sigprocmask(SIG_SETMASK, &sigsaved, NULL);
 
--- linux-rt-2.6.31.orig/arch/arm/Makefile
+++ linux-rt-2.6.31/arch/arm/Makefile
@@ -14,7 +14,7 @@
 ifeq ($(CONFIG_CPU_ENDIAN_BE8),y)
 LDFLAGS_vmlinux	+= --be8
 endif
-CPPFLAGS_vmlinux.lds = -DTEXT_OFFSET=$(TEXT_OFFSET)
+
 OBJCOPYFLAGS	:=-O binary -R .note -R .note.gnu.build-id -R .comment -S
 GZFLAGS		:=-9
 #KBUILD_CFLAGS	+=-pipe
--- linux-rt-2.6.31.orig/arch/arm/include/asm/kmap_types.h
+++ linux-rt-2.6.31/arch/arm/include/asm/kmap_types.h
@@ -22,4 +22,10 @@
 	KM_TYPE_NR
 };
 
+#ifdef CONFIG_DEBUG_HIGHMEM
+#define KM_NMI		(-1)
+#define KM_NMI_PTE	(-1)
+#define KM_IRQ_PTE	(-1)
+#endif
+
 #endif
--- linux-rt-2.6.31.orig/arch/arm/include/asm/mman.h
+++ linux-rt-2.6.31/arch/arm/include/asm/mman.h
@@ -14,4 +14,7 @@
 #define MCL_CURRENT	1		/* lock all current mappings */
 #define MCL_FUTURE	2		/* lock all future mappings */
 
+#define arch_mmap_check(addr, len, flags) \
+	(((flags) & MAP_FIXED && (addr) < FIRST_USER_ADDRESS) ? -EINVAL : 0)
+
 #endif /* __ARM_MMAN_H__ */
--- linux-rt-2.6.31.orig/arch/arm/mm/highmem.c
+++ linux-rt-2.6.31/arch/arm/mm/highmem.c
@@ -40,11 +40,16 @@
 {
 	unsigned int idx;
 	unsigned long vaddr;
+	void *kmap;
 
 	pagefault_disable();
 	if (!PageHighMem(page))
 		return page_address(page);
 
+	kmap = kmap_high_get(page);
+	if (kmap)
+		return kmap;
+
 	idx = type + KM_TYPE_NR * smp_processor_id();
 	vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
 #ifdef CONFIG_DEBUG_HIGHMEM
@@ -80,6 +85,9 @@
 #else
 		(void) idx;  /* to kill a warning */
 #endif
+	} else if (vaddr >= PKMAP_ADDR(0) && vaddr < PKMAP_ADDR(LAST_PKMAP)) {
+		/* this address was obtained through kmap_high_get() */
+		kunmap_high(pte_page(pkmap_page_table[PKMAP_NR(vaddr)]));
 	}
 	pagefault_enable();
 }
--- linux-rt-2.6.31.orig/arch/arm/mm/mmap.c
+++ linux-rt-2.6.31/arch/arm/mm/mmap.c
@@ -54,7 +54,8 @@
 	 * We enforce the MAP_FIXED case.
 	 */
 	if (flags & MAP_FIXED) {
-		if (aliasing && flags & MAP_SHARED && addr & (SHMLBA - 1))
+		if (aliasing && flags & MAP_SHARED &&
+		    (addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1))
 			return -EINVAL;
 		return addr;
 	}
--- linux-rt-2.6.31.orig/arch/arm/kernel/calls.S
+++ linux-rt-2.6.31/arch/arm/kernel/calls.S
@@ -172,7 +172,7 @@
 /* 160 */	CALL(sys_sched_get_priority_min)
 		CALL(sys_sched_rr_get_interval)
 		CALL(sys_nanosleep)
-		CALL(sys_arm_mremap)
+		CALL(sys_mremap)
 		CALL(sys_setresuid16)
 /* 165 */	CALL(sys_getresuid16)
 		CALL(sys_ni_syscall)		/* vm86 */
--- linux-rt-2.6.31.orig/arch/arm/kernel/sys_arm.c
+++ linux-rt-2.6.31/arch/arm/kernel/sys_arm.c
@@ -29,41 +29,6 @@
 #include <linux/ipc.h>
 #include <linux/uaccess.h>
 
-extern unsigned long do_mremap(unsigned long addr, unsigned long old_len,
-			       unsigned long new_len, unsigned long flags,
-			       unsigned long new_addr);
-
-/* common code for old and new mmaps */
-inline long do_mmap2(
-	unsigned long addr, unsigned long len,
-	unsigned long prot, unsigned long flags,
-	unsigned long fd, unsigned long pgoff)
-{
-	int error = -EINVAL;
-	struct file * file = NULL;
-
-	flags &= ~(MAP_EXECUTABLE | MAP_DENYWRITE);
-
-	if (flags & MAP_FIXED && addr < FIRST_USER_ADDRESS)
-		goto out;
-
-	error = -EBADF;
-	if (!(flags & MAP_ANONYMOUS)) {
-		file = fget(fd);
-		if (!file)
-			goto out;
-	}
-
-	down_write(&current->mm->mmap_sem);
-	error = do_mmap_pgoff(file, addr, len, prot, flags, pgoff);
-	up_write(&current->mm->mmap_sem);
-
-	if (file)
-		fput(file);
-out:
-	return error;
-}
-
 struct mmap_arg_struct {
 	unsigned long addr;
 	unsigned long len;
@@ -85,29 +50,11 @@
 	if (a.offset & ~PAGE_MASK)
 		goto out;
 
-	error = do_mmap2(a.addr, a.len, a.prot, a.flags, a.fd, a.offset >> PAGE_SHIFT);
+	error = sys_mmap_pgoff(a.addr, a.len, a.prot, a.flags, a.fd, a.offset >> PAGE_SHIFT);
 out:
 	return error;
 }
 
-asmlinkage unsigned long
-sys_arm_mremap(unsigned long addr, unsigned long old_len,
-	       unsigned long new_len, unsigned long flags,
-	       unsigned long new_addr)
-{
-	unsigned long ret = -EINVAL;
-
-	if (flags & MREMAP_FIXED && new_addr < FIRST_USER_ADDRESS)
-		goto out;
-
-	down_write(&current->mm->mmap_sem);
-	ret = do_mremap(addr, old_len, new_len, flags, new_addr);
-	up_write(&current->mm->mmap_sem);
-
-out:
-	return ret;
-}
-
 /*
  * Perform the select(nd, in, out, ex, tv) and mmap() system
  * calls.
--- linux-rt-2.6.31.orig/arch/arm/kernel/Makefile
+++ linux-rt-2.6.31/arch/arm/kernel/Makefile
@@ -2,7 +2,8 @@
 # Makefile for the linux kernel.
 #
 
-AFLAGS_head.o := -DTEXT_OFFSET=$(TEXT_OFFSET)
+CPPFLAGS_vmlinux.lds := -DTEXT_OFFSET=$(TEXT_OFFSET)
+AFLAGS_head.o        := -DTEXT_OFFSET=$(TEXT_OFFSET)
 
 ifdef CONFIG_DYNAMIC_FTRACE
 CFLAGS_REMOVE_ftrace.o = -pg
--- linux-rt-2.6.31.orig/arch/arm/kernel/entry-common.S
+++ linux-rt-2.6.31/arch/arm/kernel/entry-common.S
@@ -419,12 +419,12 @@
 		tst	r5, #PGOFF_MASK
 		moveq	r5, r5, lsr #PAGE_SHIFT - 12
 		streq	r5, [sp, #4]
-		beq	do_mmap2
+		beq	sys_mmap_pgoff
 		mov	r0, #-EINVAL
 		mov	pc, lr
 #else
 		str	r5, [sp, #4]
-		b	do_mmap2
+		b	sys_mmap_pgoff
 #endif
 ENDPROC(sys_mmap2)
 
--- linux-rt-2.6.31.orig/arch/arm/mach-pxa/sharpsl_pm.c
+++ linux-rt-2.6.31/arch/arm/mach-pxa/sharpsl_pm.c
@@ -678,8 +678,8 @@
 		dev_dbg(sharpsl_pm.dev, "User triggered wakeup in offline charger.\n");
 	}
 
-	if ((!sharpsl_pm.machinfo->read_devdata(SHARPSL_STATUS_LOCK)) || (sharpsl_fatal_check() < 0) )
-	{
+	if ((!sharpsl_pm.machinfo->read_devdata(SHARPSL_STATUS_LOCK)) ||
+	    (!sharpsl_pm.machinfo->read_devdata(SHARPSL_STATUS_FATAL)))	{
 		dev_err(sharpsl_pm.dev, "Fatal condition. Suspend.\n");
 		corgi_goto_sleep(alarm_time, alarm_enable, state);
 		return 1;
--- linux-rt-2.6.31.orig/arch/arm/mach-pxa/cpufreq-pxa2xx.c
+++ linux-rt-2.6.31/arch/arm/mach-pxa/cpufreq-pxa2xx.c
@@ -155,7 +155,7 @@
 
 static pxa_freqs_t pxa27x_freqs[] = {
 	{104000, 104000, PXA27x_CCCR(1,	 8, 2), 0, CCLKCFG2(1, 0, 1),  900000, 1705000 },
-	{156000, 104000, PXA27x_CCCR(1,	 8, 6), 0, CCLKCFG2(1, 1, 1), 1000000, 1705000 },
+	{156000, 104000, PXA27x_CCCR(1,	 8, 3), 0, CCLKCFG2(1, 0, 1), 1000000, 1705000 },
 	{208000, 208000, PXA27x_CCCR(0, 16, 2), 1, CCLKCFG2(0, 0, 1), 1180000, 1705000 },
 	{312000, 208000, PXA27x_CCCR(1, 16, 3), 1, CCLKCFG2(1, 0, 1), 1250000, 1705000 },
 	{416000, 208000, PXA27x_CCCR(1, 16, 4), 1, CCLKCFG2(1, 0, 1), 1350000, 1705000 },
--- linux-rt-2.6.31.orig/arch/arm/mach-pxa/em-x270.c
+++ linux-rt-2.6.31/arch/arm/mach-pxa/em-x270.c
@@ -497,16 +497,15 @@
 		goto err_free_vbus_gpio;
 
 	/* USB Hub power-on and reset */
-	gpio_direction_output(usb_hub_reset, 0);
+	gpio_direction_output(usb_hub_reset, 1);
+	gpio_direction_output(GPIO9_USB_VBUS_EN, 0);
 	regulator_enable(em_x270_usb_ldo);
-	gpio_set_value(usb_hub_reset, 1);
 	gpio_set_value(usb_hub_reset, 0);
+	gpio_set_value(usb_hub_reset, 1);
 	regulator_disable(em_x270_usb_ldo);
 	regulator_enable(em_x270_usb_ldo);
-	gpio_set_value(usb_hub_reset, 1);
-
-	/* enable VBUS */
-	gpio_direction_output(GPIO9_USB_VBUS_EN, 1);
+	gpio_set_value(usb_hub_reset, 0);
+	gpio_set_value(GPIO9_USB_VBUS_EN, 1);
 
 	return 0;
 
--- linux-rt-2.6.31.orig/arch/um/Makefile
+++ linux-rt-2.6.31/arch/um/Makefile
@@ -96,11 +96,10 @@
 	$(call cc-option, -fno-stack-protector,) \
 	$(call cc-option, -fno-stack-protector-all,)
 
-CONFIG_KERNEL_STACK_ORDER ?= 2
-STACK_SIZE := $(shell echo $$[ 4096 * (1 << $(CONFIG_KERNEL_STACK_ORDER)) ] )
-
-CPPFLAGS_vmlinux.lds = -U$(SUBARCH) -DSTART=$(START) -DELF_ARCH=$(ELF_ARCH) \
-	-DELF_FORMAT="$(ELF_FORMAT)" -DKERNEL_STACK_SIZE=$(STACK_SIZE)
+# Options used by linker script
+export LDS_START      := $(START)
+export LDS_ELF_ARCH   := $(ELF_ARCH)
+export LDS_ELF_FORMAT := $(ELF_FORMAT)
 
 # The wrappers will select whether using "malloc" or the kernel allocator.
 LINK_WRAPS = -Wl,--wrap,malloc -Wl,--wrap,free -Wl,--wrap,calloc
--- linux-rt-2.6.31.orig/arch/um/kernel/Makefile
+++ linux-rt-2.6.31/arch/um/kernel/Makefile
@@ -3,6 +3,9 @@
 # Licensed under the GPL
 #
 
+CPPFLAGS_vmlinux.lds := -U$(SUBARCH) -DSTART=$(LDS_START) \
+                        -DELF_ARCH=$(LDS_ELF_ARCH)        \
+                        -DELF_FORMAT=$(LDS_ELF_FORMAT)
 extra-y := vmlinux.lds
 clean-files :=
 
--- linux-rt-2.6.31.orig/arch/um/kernel/vmlinux.lds.S
+++ linux-rt-2.6.31/arch/um/kernel/vmlinux.lds.S
@@ -1,3 +1,6 @@
+
+KERNEL_STACK_SIZE = 4096 * (1 << CONFIG_KERNEL_STACK_ORDER);
+
 #ifdef CONFIG_LD_SCRIPT_STATIC
 #include "uml.lds.S"
 #else
--- linux-rt-2.6.31.orig/arch/um/kernel/syscall.c
+++ linux-rt-2.6.31/arch/um/kernel/syscall.c
@@ -8,6 +8,7 @@
 #include "linux/mm.h"
 #include "linux/sched.h"
 #include "linux/utsname.h"
+#include "linux/syscalls.h"
 #include "asm/current.h"
 #include "asm/mman.h"
 #include "asm/uaccess.h"
@@ -37,31 +38,6 @@
 	return ret;
 }
 
-/* common code for old and new mmaps */
-long sys_mmap2(unsigned long addr, unsigned long len,
-	       unsigned long prot, unsigned long flags,
-	       unsigned long fd, unsigned long pgoff)
-{
-	long error = -EBADF;
-	struct file * file = NULL;
-
-	flags &= ~(MAP_EXECUTABLE | MAP_DENYWRITE);
-	if (!(flags & MAP_ANONYMOUS)) {
-		file = fget(fd);
-		if (!file)
-			goto out;
-	}
-
-	down_write(&current->mm->mmap_sem);
-	error = do_mmap_pgoff(file, addr, len, prot, flags, pgoff);
-	up_write(&current->mm->mmap_sem);
-
-	if (file)
-		fput(file);
- out:
-	return error;
-}
-
 long old_mmap(unsigned long addr, unsigned long len,
 	      unsigned long prot, unsigned long flags,
 	      unsigned long fd, unsigned long offset)
@@ -70,7 +46,7 @@
 	if (offset & ~PAGE_MASK)
 		goto out;
 
-	err = sys_mmap2(addr, len, prot, flags, fd, offset >> PAGE_SHIFT);
+	err = sys_mmap_pgoff(addr, len, prot, flags, fd, offset >> PAGE_SHIFT);
  out:
 	return err;
 }
--- linux-rt-2.6.31.orig/arch/um/sys-i386/shared/sysdep/syscalls.h
+++ linux-rt-2.6.31/arch/um/sys-i386/shared/sysdep/syscalls.h
@@ -20,7 +20,3 @@
 #define EXECUTE_SYSCALL(syscall, regs) \
 	((long (*)(struct syscall_args)) \
 	 (*sys_call_table[syscall]))(SYSCALL_ARGS(&regs->regs))
-
-extern long sys_mmap2(unsigned long addr, unsigned long len,
-		      unsigned long prot, unsigned long flags,
-		      unsigned long fd, unsigned long pgoff);
--- linux-rt-2.6.31.orig/arch/mn10300/include/asm/mman.h
+++ linux-rt-2.6.31/arch/mn10300/include/asm/mman.h
@@ -25,4 +25,9 @@
 #define MCL_CURRENT	1		/* lock all current mappings */
 #define MCL_FUTURE	2		/* lock all future mappings */
 
+#define MIN_MAP_ADDR	PAGE_SIZE	/* minimum fixed mmap address */
+
+#define arch_mmap_check(addr, len, flags) \
+	(((flags) & MAP_FIXED && (addr) < MIN_MAP_ADDR) ? -EINVAL : 0)
+
 #endif /* _ASM_MMAN_H */
--- linux-rt-2.6.31.orig/arch/mn10300/kernel/sys_mn10300.c
+++ linux-rt-2.6.31/arch/mn10300/kernel/sys_mn10300.c
@@ -24,47 +24,13 @@
 
 #include <asm/uaccess.h>
 
-#define MIN_MAP_ADDR	PAGE_SIZE	/* minimum fixed mmap address */
-
-/*
- * memory mapping syscall
- */
-asmlinkage long sys_mmap2(unsigned long addr, unsigned long len,
-			  unsigned long prot, unsigned long flags,
-			  unsigned long fd, unsigned long pgoff)
-{
-	struct file *file = NULL;
-	long error = -EINVAL;
-
-	flags &= ~(MAP_EXECUTABLE | MAP_DENYWRITE);
-
-	if (flags & MAP_FIXED && addr < MIN_MAP_ADDR)
-		goto out;
-
-	error = -EBADF;
-	if (!(flags & MAP_ANONYMOUS)) {
-		file = fget(fd);
-		if (!file)
-			goto out;
-	}
-
-	down_write(&current->mm->mmap_sem);
-	error = do_mmap_pgoff(file, addr, len, prot, flags, pgoff);
-	up_write(&current->mm->mmap_sem);
-
-	if (file)
-		fput(file);
-out:
-	return error;
-}
-
 asmlinkage long old_mmap(unsigned long addr, unsigned long len,
 			 unsigned long prot, unsigned long flags,
 			 unsigned long fd, unsigned long offset)
 {
 	if (offset & ~PAGE_MASK)
 		return -EINVAL;
-	return sys_mmap2(addr, len, prot, flags, fd, offset >> PAGE_SHIFT);
+	return sys_mmap_pgoff(addr, len, prot, flags, fd, offset >> PAGE_SHIFT);
 }
 
 struct sel_arg_struct {
--- linux-rt-2.6.31.orig/arch/mn10300/kernel/entry.S
+++ linux-rt-2.6.31/arch/mn10300/kernel/entry.S
@@ -578,7 +578,7 @@
 	.long sys_ni_syscall	/* reserved for streams2 */
 	.long sys_vfork		/* 190 */
 	.long sys_getrlimit
-	.long sys_mmap2
+	.long sys_mmap_pgoff
 	.long sys_truncate64
 	.long sys_ftruncate64
 	.long sys_stat64	/* 195 */
--- linux-rt-2.6.31.orig/arch/blackfin/kernel/sys_bfin.c
+++ linux-rt-2.6.31/arch/blackfin/kernel/sys_bfin.c
@@ -44,39 +44,6 @@
 #include <asm/cacheflush.h>
 #include <asm/dma.h>
 
-/* common code for old and new mmaps */
-static inline long
-do_mmap2(unsigned long addr, unsigned long len,
-	 unsigned long prot, unsigned long flags,
-	 unsigned long fd, unsigned long pgoff)
-{
-	int error = -EBADF;
-	struct file *file = NULL;
-
-	flags &= ~(MAP_EXECUTABLE | MAP_DENYWRITE);
-	if (!(flags & MAP_ANONYMOUS)) {
-		file = fget(fd);
-		if (!file)
-			goto out;
-	}
-
-	down_write(&current->mm->mmap_sem);
-	error = do_mmap_pgoff(file, addr, len, prot, flags, pgoff);
-	up_write(&current->mm->mmap_sem);
-
-	if (file)
-		fput(file);
- out:
-	return error;
-}
-
-asmlinkage long sys_mmap2(unsigned long addr, unsigned long len,
-			  unsigned long prot, unsigned long flags,
-			  unsigned long fd, unsigned long pgoff)
-{
-	return do_mmap2(addr, len, prot, flags, fd, pgoff);
-}
-
 asmlinkage void *sys_sram_alloc(size_t size, unsigned long flags)
 {
 	return sram_alloc_with_lsl(size, flags);
--- linux-rt-2.6.31.orig/arch/blackfin/mach-common/entry.S
+++ linux-rt-2.6.31/arch/blackfin/mach-common/entry.S
@@ -1434,7 +1434,7 @@
 	.long _sys_ni_syscall	/* streams2 */
 	.long _sys_vfork		/* 190 */
 	.long _sys_getrlimit
-	.long _sys_mmap2
+	.long _sys_mmap_pgoff
 	.long _sys_truncate64
 	.long _sys_ftruncate64
 	.long _sys_stat64	/* 195 */
--- linux-rt-2.6.31.orig/arch/microblaze/kernel/sys_microblaze.c
+++ linux-rt-2.6.31/arch/microblaze/kernel/sys_microblaze.c
@@ -63,46 +63,14 @@
 	return error;
 }
 
-asmlinkage long
-sys_mmap2(unsigned long addr, unsigned long len,
-	unsigned long prot, unsigned long flags,
-	unsigned long fd, unsigned long pgoff)
-{
-	struct file *file = NULL;
-	int ret = -EBADF;
-
-	flags &= ~(MAP_EXECUTABLE | MAP_DENYWRITE);
-	if (!(flags & MAP_ANONYMOUS)) {
-		file = fget(fd);
-		if (!file) {
-			printk(KERN_INFO "no fd in mmap\r\n");
-			goto out;
-		}
-	}
-
-	down_write(&current->mm->mmap_sem);
-	ret = do_mmap_pgoff(file, addr, len, prot, flags, pgoff);
-	up_write(&current->mm->mmap_sem);
-	if (file)
-		fput(file);
-out:
-	return ret;
-}
-
 asmlinkage long sys_mmap(unsigned long addr, unsigned long len,
 			unsigned long prot, unsigned long flags,
 			unsigned long fd, off_t pgoff)
 {
-	int err = -EINVAL;
-
-	if (pgoff & ~PAGE_MASK) {
-		printk(KERN_INFO "no pagemask in mmap\r\n");
-		goto out;
-	}
+	if (pgoff & ~PAGE_MASK)
+		return -EINVAL;
 
-	err = sys_mmap2(addr, len, prot, flags, fd, pgoff >> PAGE_SHIFT);
-out:
-	return err;
+	return sys_mmap_pgoff(addr, len, prot, flags, fd, pgoff >> PAGE_SHIFT);
 }
 
 /*
--- linux-rt-2.6.31.orig/arch/microblaze/kernel/syscall_table.S
+++ linux-rt-2.6.31/arch/microblaze/kernel/syscall_table.S
@@ -196,7 +196,7 @@
 	.long sys_ni_syscall		/* reserved for streams2 */
 	.long sys_vfork		/* 190 */
 	.long sys_getrlimit
-	.long sys_mmap2			/* mmap2 */
+	.long sys_mmap_pgoff		/* mmap2 */
 	.long sys_truncate64
 	.long sys_ftruncate64
 	.long sys_stat64		/* 195 */
--- linux-rt-2.6.31.orig/arch/sh/mm/mmap.c
+++ linux-rt-2.6.31/arch/sh/mm/mmap.c
@@ -54,7 +54,8 @@
 		/* We do not accept a shared mapping if it would violate
 		 * cache aliasing constraints.
 		 */
-		if ((flags & MAP_SHARED) && (addr & shm_align_mask))
+		if ((flags & MAP_SHARED) &&
+		    ((addr - (pgoff << PAGE_SHIFT)) & shm_align_mask))
 			return -EINVAL;
 		return addr;
 	}
--- linux-rt-2.6.31.orig/arch/sh/kernel/process_64.c
+++ linux-rt-2.6.31/arch/sh/kernel/process_64.c
@@ -367,7 +367,7 @@
 void flush_thread(void)
 {
 
-	/* Called by fs/exec.c (flush_old_exec) to remove traces of a
+	/* Called by fs/exec.c (setup_new_exec) to remove traces of a
 	 * previously running executable. */
 #ifdef CONFIG_SH_FPU
 	if (last_task_used_math == current) {
--- linux-rt-2.6.31.orig/arch/sh/kernel/sys_sh.c
+++ linux-rt-2.6.31/arch/sh/kernel/sys_sh.c
@@ -26,37 +26,13 @@
 #include <asm/uaccess.h>
 #include <asm/unistd.h>
 
-static inline long
-do_mmap2(unsigned long addr, unsigned long len, unsigned long prot,
-	 unsigned long flags, int fd, unsigned long pgoff)
-{
-	int error = -EBADF;
-	struct file *file = NULL;
-
-	flags &= ~(MAP_EXECUTABLE | MAP_DENYWRITE);
-	if (!(flags & MAP_ANONYMOUS)) {
-		file = fget(fd);
-		if (!file)
-			goto out;
-	}
-
-	down_write(&current->mm->mmap_sem);
-	error = do_mmap_pgoff(file, addr, len, prot, flags, pgoff);
-	up_write(&current->mm->mmap_sem);
-
-	if (file)
-		fput(file);
-out:
-	return error;
-}
-
 asmlinkage int old_mmap(unsigned long addr, unsigned long len,
 	unsigned long prot, unsigned long flags,
 	int fd, unsigned long off)
 {
 	if (off & ~PAGE_MASK)
 		return -EINVAL;
-	return do_mmap2(addr, len, prot, flags, fd, off>>PAGE_SHIFT);
+	return sys_mmap_pgoff(addr, len, prot, flags, fd, off>>PAGE_SHIFT);
 }
 
 asmlinkage long sys_mmap2(unsigned long addr, unsigned long len,
@@ -72,7 +48,7 @@
 
 	pgoff >>= PAGE_SHIFT - 12;
 
-	return do_mmap2(addr, len, prot, flags, fd, pgoff);
+	return sys_mmap_pgoff(addr, len, prot, flags, fd, pgoff);
 }
 
 /*
--- linux-rt-2.6.31.orig/arch/powerpc/Makefile
+++ linux-rt-2.6.31/arch/powerpc/Makefile
@@ -158,8 +158,6 @@
 # Default to zImage, override when needed
 all: zImage
 
-CPPFLAGS_vmlinux.lds	:= -Upowerpc
-
 BOOT_TARGETS = zImage zImage.initrd uImage zImage% dtbImage% treeImage.% cuImage.% simpleImage.%
 
 PHONY += $(BOOT_TARGETS)
--- linux-rt-2.6.31.orig/arch/powerpc/Kconfig
+++ linux-rt-2.6.31/arch/powerpc/Kconfig
@@ -925,6 +925,8 @@
 
 source "drivers/Kconfig"
 
+source "ubuntu/Kconfig"
+
 source "fs/Kconfig"
 
 source "arch/powerpc/sysdev/qe_lib/Kconfig"
--- linux-rt-2.6.31.orig/arch/powerpc/include/asm/thread_info.h
+++ linux-rt-2.6.31/arch/powerpc/include/asm/thread_info.h
@@ -111,7 +111,6 @@
 #define TIF_NOTIFY_RESUME	13	/* callback before returning to user */
 #define TIF_FREEZE		14	/* Freezing for suspend */
 #define TIF_RUNLATCH		15	/* Is the runlatch enabled? */
-#define TIF_ABI_PENDING		16	/* 32/64 bit switch needed */
 
 /* as above, but as bit values */
 #define _TIF_SYSCALL_TRACE	(1<<TIF_SYSCALL_TRACE)
@@ -129,7 +128,6 @@
 #define _TIF_NOTIFY_RESUME	(1<<TIF_NOTIFY_RESUME)
 #define _TIF_FREEZE		(1<<TIF_FREEZE)
 #define _TIF_RUNLATCH		(1<<TIF_RUNLATCH)
-#define _TIF_ABI_PENDING	(1<<TIF_ABI_PENDING)
 #define _TIF_SYSCALL_T_OR_A	(_TIF_SYSCALL_TRACE|_TIF_SYSCALL_AUDIT|_TIF_SECCOMP)
 
 #define _TIF_USER_WORK_MASK	(_TIF_SIGPENDING | _TIF_NEED_RESCHED | \
--- linux-rt-2.6.31.orig/arch/powerpc/include/asm/pmc.h
+++ linux-rt-2.6.31/arch/powerpc/include/asm/pmc.h
@@ -27,10 +27,22 @@
 
 int reserve_pmc_hardware(perf_irq_t new_perf_irq);
 void release_pmc_hardware(void);
+void ppc_enable_pmcs(void);
 
 #ifdef CONFIG_PPC64
-void power4_enable_pmcs(void);
-void pasemi_enable_pmcs(void);
+#include <asm/lppaca.h>
+
+static inline void ppc_set_pmu_inuse(int inuse)
+{
+	get_lppaca()->pmcregs_in_use = inuse;
+}
+
+extern void power4_enable_pmcs(void);
+
+#else /* CONFIG_PPC64 */
+
+static inline void ppc_set_pmu_inuse(int inuse) { }
+
 #endif
 
 #endif /* __KERNEL__ */
--- linux-rt-2.6.31.orig/arch/powerpc/include/asm/kmap_types.h
+++ linux-rt-2.6.31/arch/powerpc/include/asm/kmap_types.h
@@ -29,5 +29,16 @@
 	KM_TYPE_NR
 };
 
+/*
+ * This is a temporary build fix that (so they say on lkml....) should no longer
+ * be required after 2.6.33, because of changes planned to the kmap code.
+ * Let's try to remove this cruft then.
+ */
+#ifdef CONFIG_DEBUG_HIGHMEM
+#define KM_NMI		(-1)
+#define KM_NMI_PTE	(-1)
+#define KM_IRQ_PTE	(-1)
+#endif
+
 #endif	/* __KERNEL__ */
 #endif	/* _ASM_POWERPC_KMAP_TYPES_H */
--- linux-rt-2.6.31.orig/arch/powerpc/include/asm/elf.h
+++ linux-rt-2.6.31/arch/powerpc/include/asm/elf.h
@@ -236,14 +236,10 @@
 #ifdef __powerpc64__
 # define SET_PERSONALITY(ex)					\
 do {								\
-	unsigned long new_flags = 0;				\
 	if ((ex).e_ident[EI_CLASS] == ELFCLASS32)		\
-		new_flags = _TIF_32BIT;				\
-	if ((current_thread_info()->flags & _TIF_32BIT)		\
-	    != new_flags)					\
-		set_thread_flag(TIF_ABI_PENDING);		\
+		set_thread_flag(TIF_32BIT);			\
 	else							\
-		clear_thread_flag(TIF_ABI_PENDING);		\
+		clear_thread_flag(TIF_32BIT);			\
 	if (personality(current->personality) != PER_LINUX32)	\
 		set_personality(PER_LINUX |			\
 			(current->personality & (~PER_MASK)));	\
--- linux-rt-2.6.31.orig/arch/powerpc/include/asm/mmu-hash64.h
+++ linux-rt-2.6.31/arch/powerpc/include/asm/mmu-hash64.h
@@ -41,6 +41,7 @@
 
 #define SLB_NUM_BOLTED		3
 #define SLB_CACHE_ENTRIES	8
+#define SLB_MIN_SIZE		32
 
 /* Bits in the SLB ESID word */
 #define SLB_ESID_V		ASM_CONST(0x0000000008000000) /* valid */
@@ -296,6 +297,7 @@
 extern void stab_initialize(unsigned long stab);
 
 extern void slb_vmalloc_update(void);
+extern void slb_set_size(u16 size);
 #endif /* __ASSEMBLY__ */
 
 /*
--- linux-rt-2.6.31.orig/arch/powerpc/include/asm/pte-common.h
+++ linux-rt-2.6.31/arch/powerpc/include/asm/pte-common.h
@@ -176,7 +176,7 @@
 #define HAVE_PAGE_AGP
 
 /* Advertise support for _PAGE_SPECIAL */
-#ifdef _PAGE_SPECIAL
+#if _PAGE_SPECIAL != 0
 #define __HAVE_ARCH_PTE_SPECIAL
 #endif
 
--- linux-rt-2.6.31.orig/arch/powerpc/platforms/powermac/cpufreq_32.c
+++ linux-rt-2.6.31/arch/powerpc/platforms/powermac/cpufreq_32.c
@@ -44,14 +44,6 @@
  */
 #undef DEBUG_FREQ
 
-/*
- * There is a problem with the core cpufreq code on SMP kernels,
- * it won't recalculate the Bogomips properly
- */
-#ifdef CONFIG_SMP
-#warning "WARNING, CPUFREQ not recommended on SMP kernels"
-#endif
-
 extern void low_choose_7447a_dfs(int dfs);
 extern void low_choose_750fx_pll(int pll);
 extern void low_sleep_handler(void);
--- linux-rt-2.6.31.orig/arch/powerpc/platforms/powermac/smp.c
+++ linux-rt-2.6.31/arch/powerpc/platforms/powermac/smp.c
@@ -408,7 +408,7 @@
 	/* reset the entry point so if we get another intr we won't
 	 * try to startup again */
 	out_be32(psurge_start, 0x100);
-	if (setup_irq(30, &psurge_irqaction))
+	if (setup_irq(irq_create_mapping(NULL, 30), &psurge_irqaction))
 		printk(KERN_ERR "Couldn't get primary IPI interrupt");
 }
 
--- linux-rt-2.6.31.orig/arch/powerpc/platforms/powermac/low_i2c.c
+++ linux-rt-2.6.31/arch/powerpc/platforms/powermac/low_i2c.c
@@ -540,8 +540,11 @@
 	/* Make sure IRQ is disabled */
 	kw_write_reg(reg_ier, 0);
 
-	/* Request chip interrupt */
-	if (request_irq(host->irq, kw_i2c_irq, 0, "keywest i2c", host))
+	/* Request chip interrupt. We set IRQF_TIMER because we don't
+	 * want that interrupt disabled between the 2 passes of driver
+	 * suspend or we'll have issues running the pfuncs
+	 */
+	if (request_irq(host->irq, kw_i2c_irq, IRQF_TIMER, "keywest i2c", host))
 		host->irq = NO_IRQ;
 
 	printk(KERN_INFO "KeyWest i2c @0x%08x irq %d %s\n",
--- linux-rt-2.6.31.orig/arch/powerpc/platforms/powermac/pci.c
+++ linux-rt-2.6.31/arch/powerpc/platforms/powermac/pci.c
@@ -1286,3 +1286,64 @@
 }
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_SERVERWORKS, 0x0240, fixup_k2_sata);
 
+/*
+ * On U4 (aka CPC945) the PCIe root complex "P2P" bridge resource ranges aren't
+ * configured by the firmware. The bridge itself seems to ignore them but it
+ * causes problems with Linux which then re-assigns devices below the bridge,
+ * thus changing addresses of those devices from what was in the device-tree,
+ * which sucks when those are video cards using offb
+ *
+ * We could just mark it transparent but I prefer fixing up the resources to
+ * properly show what's going on here, as I have some doubts about having them
+ * badly configured potentially being an issue for DMA.
+ *
+ * We leave PIO alone, it seems to be fine
+ *
+ * Oh and there's another funny bug. The OF properties advertize the region
+ * 0xf1000000..0xf1ffffff as being forwarded as memory space. But that's
+ * actually not true, this region is the memory mapped config space. So we
+ * also need to filter it out or we'll map things in the wrong place.
+ */
+static void fixup_u4_pcie(struct pci_dev* dev)
+{
+	struct pci_controller *host = pci_bus_to_host(dev->bus);
+	struct resource *region = NULL;
+	u32 reg;
+	int i;
+
+	/* Only do that on PowerMac */
+	if (!machine_is(powermac))
+		return;
+
+	/* Find the largest MMIO region */
+	for (i = 0; i < 3; i++) {
+		struct resource *r = &host->mem_resources[i];
+		if (!(r->flags & IORESOURCE_MEM))
+			continue;
+		/* Skip the 0xf0xxxxxx..f2xxxxxx regions, we know they
+		 * are reserved by HW for other things
+		 */
+		if (r->start >= 0xf0000000 && r->start < 0xf3000000)
+			continue;
+		if (!region || (r->end - r->start) >
+		    (region->end - region->start))
+			region = r;
+	}
+	/* Nothing found, bail */
+	if (region == 0)
+		return;
+
+	/* Print things out */
+	printk(KERN_INFO "PCI: Fixup U4 PCIe bridge range: %pR\n", region);
+
+	/* Fixup bridge config space. We know it's a Mac, resource aren't
+	 * offset so let's just blast them as-is. We also know that they
+	 * fit in 32 bits
+	 */
+	reg = ((region->start >> 16) & 0xfff0) | (region->end & 0xfff00000);
+	pci_write_config_dword(dev, PCI_MEMORY_BASE, reg);
+	pci_write_config_dword(dev, PCI_PREF_BASE_UPPER32, 0);
+	pci_write_config_dword(dev, PCI_PREF_LIMIT_UPPER32, 0);
+	pci_write_config_dword(dev, PCI_PREF_MEMORY_BASE, 0);
+}
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_APPLE, PCI_DEVICE_ID_APPLE_U4_PCIE, fixup_u4_pcie);
--- linux-rt-2.6.31.orig/arch/powerpc/platforms/pseries/xics.c
+++ linux-rt-2.6.31/arch/powerpc/platforms/pseries/xics.c
@@ -18,6 +18,7 @@
 #include <linux/init.h>
 #include <linux/radix-tree.h>
 #include <linux/cpu.h>
+#include <linux/msi.h>
 #include <linux/of.h>
 
 #include <asm/firmware.h>
@@ -219,6 +220,14 @@
 
 static unsigned int xics_startup(unsigned int virq)
 {
+	/*
+	 * The generic MSI code returns with the interrupt disabled on the
+	 * card, using the MSI mask bits. Firmware doesn't appear to unmask
+	 * at that level, so we do it here by hand.
+	 */
+	if (irq_to_desc(virq)->msi_desc)
+		unmask_msi_irq(virq);
+
 	/* unmask it */
 	xics_unmask_irq(virq);
 	return 0;
--- linux-rt-2.6.31.orig/arch/powerpc/platforms/pseries/msi.c
+++ linux-rt-2.6.31/arch/powerpc/platforms/pseries/msi.c
@@ -432,8 +432,6 @@
 		/* Read config space back so we can restore after reset */
 		read_msi_msg(virq, &msg);
 		entry->msg = msg;
-
-		unmask_msi_irq(virq);
 	}
 
 	return 0;
--- linux-rt-2.6.31.orig/arch/powerpc/platforms/pseries/setup.c
+++ linux-rt-2.6.31/arch/powerpc/platforms/pseries/setup.c
@@ -223,10 +223,6 @@
 	set = 1UL << 63;
 	reset = 0;
 	plpar_hcall_norets(H_PERFMON, set, reset);
-
-	/* instruct hypervisor to maintain PMCs */
-	if (firmware_has_feature(FW_FEATURE_SPLPAR))
-		get_lppaca()->pmcregs_in_use = 1;
 }
 
 static void __init pseries_discover_pic(void)
--- linux-rt-2.6.31.orig/arch/powerpc/platforms/pseries/reconfig.c
+++ linux-rt-2.6.31/arch/powerpc/platforms/pseries/reconfig.c
@@ -20,6 +20,7 @@
 #include <asm/machdep.h>
 #include <asm/uaccess.h>
 #include <asm/pSeries_reconfig.h>
+#include <asm/mmu.h>
 
 
 
@@ -439,9 +440,15 @@
 	if (!newprop)
 		return -ENOMEM;
 
+	if (!strcmp(name, "slb-size") || !strcmp(name, "ibm,slb-size"))
+		slb_set_size(*(int *)value);
+
 	oldprop = of_find_property(np, name,NULL);
-	if (!oldprop)
+	if (!oldprop) {
+		if (strlen(name))
+			return prom_add_property(np, newprop);
 		return -ENODEV;
+	}
 
 	rc = prom_update_property(np, newprop, oldprop);
 	if (rc)
--- linux-rt-2.6.31.orig/arch/powerpc/mm/pgtable.c
+++ linux-rt-2.6.31/arch/powerpc/mm/pgtable.c
@@ -30,6 +30,8 @@
 #include <asm/tlbflush.h>
 #include <asm/tlb.h>
 
+#include "mmu_decl.h"
+
 static DEFINE_PER_CPU(struct pte_freelist_batch *, pte_freelist_cur);
 static unsigned long pte_freelist_forced_free;
 
@@ -119,7 +121,7 @@
 /*
  * Handle i/d cache flushing, called from set_pte_at() or ptep_set_access_flags()
  */
-static pte_t do_dcache_icache_coherency(pte_t pte)
+static pte_t do_dcache_icache_coherency(pte_t pte, unsigned long addr)
 {
 	unsigned long pfn = pte_pfn(pte);
 	struct page *page;
@@ -128,6 +130,17 @@
 		return pte;
 	page = pfn_to_page(pfn);
 
+#ifdef CONFIG_8xx
+       /* On 8xx, cache control instructions (particularly
+        * "dcbst" from flush_dcache_icache) fault as write
+        * operation if there is an unpopulated TLB entry
+        * for the address in question. To workaround that,
+        * we invalidate the TLB here, thus avoiding dcbst
+        * misbehaviour.
+        */
+       _tlbil_va(addr, 0 /* 8xx doesn't care about PID */);
+#endif
+
 	if (!PageReserved(page) && !test_bit(PG_arch_1, &page->flags)) {
 		pr_devel("do_dcache_icache_coherency... flushing\n");
 		flush_dcache_icache_page(page);
@@ -198,7 +211,7 @@
 	 */
 	pte = __pte(pte_val(pte) & ~_PAGE_HPTEFLAGS);
 	if (pte_need_exec_flush(pte, 1))
-		pte = do_dcache_icache_coherency(pte);
+		pte = do_dcache_icache_coherency(pte, addr);
 
 	/* Perform the setting of the PTE */
 	__set_pte_at(mm, addr, ptep, pte, 0);
@@ -216,7 +229,7 @@
 {
 	int changed;
 	if (!dirty && pte_need_exec_flush(entry, 0))
-		entry = do_dcache_icache_coherency(entry);
+		entry = do_dcache_icache_coherency(entry, address);
 	changed = !pte_same(*(ptep), entry);
 	if (changed) {
 		if (!(vma->vm_flags & VM_HUGETLB))
--- linux-rt-2.6.31.orig/arch/powerpc/mm/slb.c
+++ linux-rt-2.6.31/arch/powerpc/mm/slb.c
@@ -240,14 +240,22 @@
 static inline void patch_slb_encoding(unsigned int *insn_addr,
 				      unsigned int immed)
 {
-	/* Assume the instruction had a "0" immediate value, just
-	 * "or" in the new value
-	 */
-	*insn_addr |= immed;
+	*insn_addr = (*insn_addr & 0xffff0000) | immed;
 	flush_icache_range((unsigned long)insn_addr, 4+
 			   (unsigned long)insn_addr);
 }
 
+void slb_set_size(u16 size)
+{
+	extern unsigned int *slb_compare_rr_to_size;
+
+	if (mmu_slb_size == size)
+		return;
+
+	mmu_slb_size = size;
+	patch_slb_encoding(slb_compare_rr_to_size, mmu_slb_size);
+}
+
 void slb_initialize(void)
 {
 	unsigned long linear_llp, vmalloc_llp, io_llp;
--- linux-rt-2.6.31.orig/arch/powerpc/kernel/perf_counter.c
+++ linux-rt-2.6.31/arch/powerpc/kernel/perf_counter.c
@@ -32,6 +32,9 @@
 	unsigned long mmcr[3];
 	struct perf_counter *limited_counter[MAX_LIMITED_HWCOUNTERS];
 	u8  limited_hwidx[MAX_LIMITED_HWCOUNTERS];
+	u64 alternatives[MAX_HWCOUNTERS][MAX_EVENT_ALTERNATIVES];
+	unsigned long amasks[MAX_HWCOUNTERS][MAX_EVENT_ALTERNATIVES];
+	unsigned long avalues[MAX_HWCOUNTERS][MAX_EVENT_ALTERNATIVES];
 };
 DEFINE_PER_CPU(struct cpu_hw_counters, cpu_hw_counters);
 
@@ -62,7 +65,6 @@
 {
 	return 0;
 }
-static inline void perf_set_pmu_inuse(int inuse) { }
 static inline void perf_get_data_addr(struct pt_regs *regs, u64 *addrp) { }
 static inline u32 perf_get_misc_flags(struct pt_regs *regs)
 {
@@ -93,11 +95,6 @@
 	return 0;
 }
 
-static inline void perf_set_pmu_inuse(int inuse)
-{
-	get_lppaca()->pmcregs_in_use = inuse;
-}
-
 /*
  * The user wants a data address recorded.
  * If we're not doing instruction sampling, give them the SDAR
@@ -245,13 +242,11 @@
  * and see if any combination of alternative codes is feasible.
  * The feasible set is returned in event[].
  */
-static int power_check_constraints(u64 event[], unsigned int cflags[],
+static int power_check_constraints(struct cpu_hw_counters *cpuhw,
+				   u64 event[], unsigned int cflags[],
 				   int n_ev)
 {
 	unsigned long mask, value, nv;
-	u64 alternatives[MAX_HWCOUNTERS][MAX_EVENT_ALTERNATIVES];
-	unsigned long amasks[MAX_HWCOUNTERS][MAX_EVENT_ALTERNATIVES];
-	unsigned long avalues[MAX_HWCOUNTERS][MAX_EVENT_ALTERNATIVES];
 	unsigned long smasks[MAX_HWCOUNTERS], svalues[MAX_HWCOUNTERS];
 	int n_alt[MAX_HWCOUNTERS], choice[MAX_HWCOUNTERS];
 	int i, j;
@@ -266,21 +261,23 @@
 		if ((cflags[i] & PPMU_LIMITED_PMC_REQD)
 		    && !ppmu->limited_pmc_event(event[i])) {
 			ppmu->get_alternatives(event[i], cflags[i],
-					       alternatives[i]);
-			event[i] = alternatives[i][0];
+					       cpuhw->alternatives[i]);
+			event[i] = cpuhw->alternatives[i][0];
 		}
-		if (ppmu->get_constraint(event[i], &amasks[i][0],
-					 &avalues[i][0]))
+		if (ppmu->get_constraint(event[i], &cpuhw->amasks[i][0],
+					 &cpuhw->avalues[i][0]))
 			return -1;
 	}
 	value = mask = 0;
 	for (i = 0; i < n_ev; ++i) {
-		nv = (value | avalues[i][0]) + (value & avalues[i][0] & addf);
+		nv = (value | cpuhw->avalues[i][0]) +
+			(value & cpuhw->avalues[i][0] & addf);
 		if ((((nv + tadd) ^ value) & mask) != 0 ||
-		    (((nv + tadd) ^ avalues[i][0]) & amasks[i][0]) != 0)
+		    (((nv + tadd) ^ cpuhw->avalues[i][0]) &
+		     cpuhw->amasks[i][0]) != 0)
 			break;
 		value = nv;
-		mask |= amasks[i][0];
+		mask |= cpuhw->amasks[i][0];
 	}
 	if (i == n_ev)
 		return 0;	/* all OK */
@@ -291,10 +288,11 @@
 	for (i = 0; i < n_ev; ++i) {
 		choice[i] = 0;
 		n_alt[i] = ppmu->get_alternatives(event[i], cflags[i],
-						  alternatives[i]);
+						  cpuhw->alternatives[i]);
 		for (j = 1; j < n_alt[i]; ++j)
-			ppmu->get_constraint(alternatives[i][j],
-					     &amasks[i][j], &avalues[i][j]);
+			ppmu->get_constraint(cpuhw->alternatives[i][j],
+					     &cpuhw->amasks[i][j],
+					     &cpuhw->avalues[i][j]);
 	}
 
 	/* enumerate all possibilities and see if any will work */
@@ -313,11 +311,11 @@
 		 * where k > j, will satisfy the constraints.
 		 */
 		while (++j < n_alt[i]) {
-			nv = (value | avalues[i][j]) +
-				(value & avalues[i][j] & addf);
+			nv = (value | cpuhw->avalues[i][j]) +
+				(value & cpuhw->avalues[i][j] & addf);
 			if ((((nv + tadd) ^ value) & mask) == 0 &&
-			    (((nv + tadd) ^ avalues[i][j])
-			     & amasks[i][j]) == 0)
+			    (((nv + tadd) ^ cpuhw->avalues[i][j])
+			     & cpuhw->amasks[i][j]) == 0)
 				break;
 		}
 		if (j >= n_alt[i]) {
@@ -339,7 +337,7 @@
 			svalues[i] = value;
 			smasks[i] = mask;
 			value = nv;
-			mask |= amasks[i][j];
+			mask |= cpuhw->amasks[i][j];
 			++i;
 			j = -1;
 		}
@@ -347,7 +345,7 @@
 
 	/* OK, we have a feasible combination, tell the caller the solution */
 	for (i = 0; i < n_ev; ++i)
-		event[i] = alternatives[i][choice[i]];
+		event[i] = cpuhw->alternatives[i][choice[i]];
 	return 0;
 }
 
@@ -531,8 +529,7 @@
 		 * Check if we ever enabled the PMU on this cpu.
 		 */
 		if (!cpuhw->pmcs_enabled) {
-			if (ppc_md.enable_pmcs)
-				ppc_md.enable_pmcs();
+			ppc_enable_pmcs();
 			cpuhw->pmcs_enabled = 1;
 		}
 
@@ -594,7 +591,7 @@
 		mtspr(SPRN_MMCRA, cpuhw->mmcr[2] & ~MMCRA_SAMPLE_ENABLE);
 		mtspr(SPRN_MMCR1, cpuhw->mmcr[1]);
 		if (cpuhw->n_counters == 0)
-			perf_set_pmu_inuse(0);
+			ppc_set_pmu_inuse(0);
 		goto out_enable;
 	}
 
@@ -627,7 +624,7 @@
 	 * bit set and set the hardware counters to their initial values.
 	 * Then unfreeze the counters.
 	 */
-	perf_set_pmu_inuse(1);
+	ppc_set_pmu_inuse(1);
 	mtspr(SPRN_MMCRA, cpuhw->mmcr[2] & ~MMCRA_SAMPLE_ENABLE);
 	mtspr(SPRN_MMCR1, cpuhw->mmcr[1]);
 	mtspr(SPRN_MMCR0, (cpuhw->mmcr[0] & ~(MMCR0_PMC1CE | MMCR0_PMCjCE))
@@ -752,7 +749,7 @@
 		return -EAGAIN;
 	if (check_excludes(cpuhw->counter, cpuhw->flags, n0, n))
 		return -EAGAIN;
-	i = power_check_constraints(cpuhw->events, cpuhw->flags, n + n0);
+	i = power_check_constraints(cpuhw, cpuhw->events, cpuhw->flags, n + n0);
 	if (i < 0)
 		return -EAGAIN;
 	cpuhw->n_counters = n0 + n;
@@ -807,7 +804,7 @@
 	cpuhw->flags[n0] = counter->hw.counter_base;
 	if (check_excludes(cpuhw->counter, cpuhw->flags, n0, 1))
 		goto out;
-	if (power_check_constraints(cpuhw->events, cpuhw->flags, n0 + 1))
+	if (power_check_constraints(cpuhw, cpuhw->events, cpuhw->flags, n0 + 1))
 		goto out;
 
 	counter->hw.config = cpuhw->events[n0];
@@ -1012,6 +1009,7 @@
 	unsigned int cflags[MAX_HWCOUNTERS];
 	int n;
 	int err;
+	struct cpu_hw_counters *cpuhw;
 
 	if (!ppmu)
 		return ERR_PTR(-ENXIO);
@@ -1090,7 +1088,11 @@
 	cflags[n] = flags;
 	if (check_excludes(ctrs, cflags, n, 1))
 		return ERR_PTR(-EINVAL);
-	if (power_check_constraints(events, cflags, n + 1))
+
+	cpuhw = &get_cpu_var(cpu_hw_counters);
+	err = power_check_constraints(cpuhw, events, cflags, n + 1);
+	put_cpu_var(cpu_hw_counters);
+	if (err)
 		return ERR_PTR(-EINVAL);
 
 	counter->hw.config = events[n];
--- linux-rt-2.6.31.orig/arch/powerpc/kernel/lparcfg.c
+++ linux-rt-2.6.31/arch/powerpc/kernel/lparcfg.c
@@ -35,6 +35,7 @@
 #include <asm/prom.h>
 #include <asm/vdso_datapage.h>
 #include <asm/vio.h>
+#include <asm/mmu.h>
 
 #define MODULE_VERS "1.8"
 #define MODULE_NAME "lparcfg"
@@ -537,6 +538,8 @@
 
 	seq_printf(m, "shared_processor_mode=%d\n", lppaca[0].shared_proc);
 
+	seq_printf(m, "slb_size=%d\n", mmu_slb_size);
+
 	return 0;
 }
 
--- linux-rt-2.6.31.orig/arch/powerpc/kernel/process.c
+++ linux-rt-2.6.31/arch/powerpc/kernel/process.c
@@ -554,18 +554,6 @@
 
 void flush_thread(void)
 {
-#ifdef CONFIG_PPC64
-	struct thread_info *t = current_thread_info();
-
-	if (test_ti_thread_flag(t, TIF_ABI_PENDING)) {
-		clear_ti_thread_flag(t, TIF_ABI_PENDING);
-		if (test_ti_thread_flag(t, TIF_32BIT))
-			clear_ti_thread_flag(t, TIF_32BIT);
-		else
-			set_ti_thread_flag(t, TIF_32BIT);
-	}
-#endif
-
 	discard_lazy_cpu_state();
 
 	if (current->thread.dabr) {
--- linux-rt-2.6.31.orig/arch/powerpc/kernel/sysfs.c
+++ linux-rt-2.6.31/arch/powerpc/kernel/sysfs.c
@@ -17,6 +17,7 @@
 #include <asm/prom.h>
 #include <asm/machdep.h>
 #include <asm/smp.h>
+#include <asm/pmc.h>
 
 #include "cacheinfo.h"
 
@@ -123,6 +124,8 @@
 
 void ppc_enable_pmcs(void)
 {
+	ppc_set_pmu_inuse(1);
+
 	/* Only need to enable them once */
 	if (__get_cpu_var(pmcs_enabled))
 		return;
--- linux-rt-2.6.31.orig/arch/powerpc/kernel/pci-common.c
+++ linux-rt-2.6.31/arch/powerpc/kernel/pci-common.c
@@ -1115,6 +1115,12 @@
 	list_for_each_entry(dev, &bus->devices, bus_list) {
 		struct dev_archdata *sd = &dev->dev.archdata;
 
+		/* Cardbus can call us to add new devices to a bus, so ignore
+		 * those who are already fully discovered
+		 */
+		if (dev->is_added)
+			continue;
+
 		/* Setup OF node pointer in archdata */
 		sd->of_node = pci_device_to_OF_node(dev);
 
@@ -1155,6 +1161,13 @@
 }
 EXPORT_SYMBOL(pcibios_fixup_bus);
 
+void __devinit pci_fixup_cardbus(struct pci_bus *bus)
+{
+	/* Now fixup devices on that bus */
+	pcibios_setup_bus_devices(bus);
+}
+
+
 static int skip_isa_ioresource_align(struct pci_dev *dev)
 {
 	if ((ppc_pci_flags & PPC_PCI_CAN_SKIP_ISA_ALIGN) &&
--- linux-rt-2.6.31.orig/arch/powerpc/kernel/syscalls.c
+++ linux-rt-2.6.31/arch/powerpc/kernel/syscalls.c
@@ -140,7 +140,6 @@
 			unsigned long prot, unsigned long flags,
 			unsigned long fd, unsigned long off, int shift)
 {
-	struct file * file = NULL;
 	unsigned long ret = -EINVAL;
 
 	if (!arch_validate_prot(prot))
@@ -151,20 +150,8 @@
 			goto out;
 		off >>= shift;
 	}
-		
-	ret = -EBADF;
-	if (!(flags & MAP_ANONYMOUS)) {
-		if (!(file = fget(fd)))
-			goto out;
-	}
-
-	flags &= ~(MAP_EXECUTABLE | MAP_DENYWRITE);
 
-	down_write(&current->mm->mmap_sem);
-	ret = do_mmap_pgoff(file, addr, len, prot, flags, off);
-	up_write(&current->mm->mmap_sem);
-	if (file)
-		fput(file);
+	ret = sys_mmap_pgoff(addr, len, prot, flags, fd, off);
 out:
 	return ret;
 }
--- linux-rt-2.6.31.orig/arch/powerpc/kernel/rtas.c
+++ linux-rt-2.6.31/arch/powerpc/kernel/rtas.c
@@ -39,6 +39,7 @@
 #include <asm/smp.h>
 #include <asm/atomic.h>
 #include <asm/time.h>
+#include <asm/mmu.h>
 
 struct rtas_t rtas = {
 	.lock = __RAW_SPIN_LOCK_UNLOCKED
@@ -713,6 +714,7 @@
 {
 	long rc = H_SUCCESS;
 	unsigned long msr_save;
+	u16 slb_size = mmu_slb_size;
 	int cpu;
 	struct rtas_suspend_me_data *data =
 		(struct rtas_suspend_me_data *)info;
@@ -735,13 +737,16 @@
 		/* All other cpus are in H_JOIN, this cpu does
 		 * the suspend.
 		 */
+		slb_set_size(SLB_MIN_SIZE);
 		printk(KERN_DEBUG "calling ibm,suspend-me on cpu %i\n",
 		       smp_processor_id());
 		data->error = rtas_call(data->token, 0, 1, NULL);
 
-		if (data->error)
+		if (data->error) {
 			printk(KERN_DEBUG "ibm,suspend-me returned %d\n",
 			       data->error);
+			slb_set_size(slb_size);
+		}
 	} else {
 		printk(KERN_ERR "H_JOIN on cpu %i failed with rc = %ld\n",
 		       smp_processor_id(), rc);
--- linux-rt-2.6.31.orig/arch/powerpc/kernel/vector.S
+++ linux-rt-2.6.31/arch/powerpc/kernel/vector.S
@@ -58,7 +58,7 @@
 	 * all 1's
 	 */
 	mfspr	r4,SPRN_VRSAVE
-	cmpdi	0,r4,0
+	cmpwi	0,r4,0
 	bne+	1f
 	li	r4,-1
 	mtspr	SPRN_VRSAVE,r4
--- linux-rt-2.6.31.orig/arch/h8300/kernel/sys_h8300.c
+++ linux-rt-2.6.31/arch/h8300/kernel/sys_h8300.c
@@ -27,39 +27,6 @@
 #include <asm/traps.h>
 #include <asm/unistd.h>
 
-/* common code for old and new mmaps */
-static inline long do_mmap2(
-	unsigned long addr, unsigned long len,
-	unsigned long prot, unsigned long flags,
-	unsigned long fd, unsigned long pgoff)
-{
-	int error = -EBADF;
-	struct file * file = NULL;
-
-	flags &= ~(MAP_EXECUTABLE | MAP_DENYWRITE);
-	if (!(flags & MAP_ANONYMOUS)) {
-		file = fget(fd);
-		if (!file)
-			goto out;
-	}
-
-	down_write(&current->mm->mmap_sem);
-	error = do_mmap_pgoff(file, addr, len, prot, flags, pgoff);
-	up_write(&current->mm->mmap_sem);
-
-	if (file)
-		fput(file);
-out:
-	return error;
-}
-
-asmlinkage long sys_mmap2(unsigned long addr, unsigned long len,
-	unsigned long prot, unsigned long flags,
-	unsigned long fd, unsigned long pgoff)
-{
-	return do_mmap2(addr, len, prot, flags, fd, pgoff);
-}
-
 /*
  * Perform the select(nd, in, out, ex, tv) and mmap() system
  * calls. Linux/m68k cloned Linux/i386, which didn't use to be able to
@@ -88,58 +55,12 @@
 	if (a.offset & ~PAGE_MASK)
 		goto out;
 
-	a.flags &= ~(MAP_EXECUTABLE | MAP_DENYWRITE);
-
-	error = do_mmap2(a.addr, a.len, a.prot, a.flags, a.fd, a.offset >> PAGE_SHIFT);
+	error = sys_mmap_pgoff(a.addr, a.len, a.prot, a.flags, a.fd,
+			       a.offset >> PAGE_SHIFT);
 out:
 	return error;
 }
 
-#if 0 /* DAVIDM - do we want this */
-struct mmap_arg_struct64 {
-	__u32 addr;
-	__u32 len;
-	__u32 prot;
-	__u32 flags;
-	__u64 offset; /* 64 bits */
-	__u32 fd;
-};
-
-asmlinkage long sys_mmap64(struct mmap_arg_struct64 *arg)
-{
-	int error = -EFAULT;
-	struct file * file = NULL;
-	struct mmap_arg_struct64 a;
-	unsigned long pgoff;
-
-	if (copy_from_user(&a, arg, sizeof(a)))
-		return -EFAULT;
-
-	if ((long)a.offset & ~PAGE_MASK)
-		return -EINVAL;
-
-	pgoff = a.offset >> PAGE_SHIFT;
-	if ((a.offset >> PAGE_SHIFT) != pgoff)
-		return -EINVAL;
-
-	if (!(a.flags & MAP_ANONYMOUS)) {
-		error = -EBADF;
-		file = fget(a.fd);
-		if (!file)
-			goto out;
-	}
-	a.flags &= ~(MAP_EXECUTABLE | MAP_DENYWRITE);
-
-	down_write(&current->mm->mmap_sem);
-	error = do_mmap_pgoff(file, a.addr, a.len, a.prot, a.flags, pgoff);
-	up_write(&current->mm->mmap_sem);
-	if (file)
-		fput(file);
-out:
-	return error;
-}
-#endif
-
 struct sel_arg_struct {
 	unsigned long n;
 	fd_set *inp, *outp, *exp;
--- linux-rt-2.6.31.orig/arch/h8300/kernel/syscalls.S
+++ linux-rt-2.6.31/arch/h8300/kernel/syscalls.S
@@ -206,7 +206,7 @@
 	.long SYMBOL_NAME(sys_ni_syscall)	/* streams2 */
 	.long SYMBOL_NAME(sys_vfork)            /* 190 */
 	.long SYMBOL_NAME(sys_getrlimit)
-	.long SYMBOL_NAME(sys_mmap2)
+	.long SYMBOL_NAME(sys_mmap_pgoff)
 	.long SYMBOL_NAME(sys_truncate64)
 	.long SYMBOL_NAME(sys_ftruncate64)
 	.long SYMBOL_NAME(sys_stat64)		/* 195 */
--- linux-rt-2.6.31.orig/arch/parisc/kernel/sys_parisc.c
+++ linux-rt-2.6.31/arch/parisc/kernel/sys_parisc.c
@@ -110,37 +110,14 @@
 	return addr;
 }
 
-static unsigned long do_mmap2(unsigned long addr, unsigned long len,
-	unsigned long prot, unsigned long flags, unsigned long fd,
-	unsigned long pgoff)
-{
-	struct file * file = NULL;
-	unsigned long error = -EBADF;
-	if (!(flags & MAP_ANONYMOUS)) {
-		file = fget(fd);
-		if (!file)
-			goto out;
-	}
-
-	flags &= ~(MAP_EXECUTABLE | MAP_DENYWRITE);
-
-	down_write(&current->mm->mmap_sem);
-	error = do_mmap_pgoff(file, addr, len, prot, flags, pgoff);
-	up_write(&current->mm->mmap_sem);
-
-	if (file != NULL)
-		fput(file);
-out:
-	return error;
-}
-
 asmlinkage unsigned long sys_mmap2(unsigned long addr, unsigned long len,
 	unsigned long prot, unsigned long flags, unsigned long fd,
 	unsigned long pgoff)
 {
 	/* Make sure the shift for mmap2 is constant (12), no matter what PAGE_SIZE
 	   we have. */
-	return do_mmap2(addr, len, prot, flags, fd, pgoff >> (PAGE_SHIFT - 12));
+	return sys_mmap_pgoff(addr, len, prot, flags, fd,
+			      pgoff >> (PAGE_SHIFT - 12));
 }
 
 asmlinkage unsigned long sys_mmap(unsigned long addr, unsigned long len,
@@ -148,7 +125,8 @@
 		unsigned long offset)
 {
 	if (!(offset & ~PAGE_MASK)) {
-		return do_mmap2(addr, len, prot, flags, fd, offset >> PAGE_SHIFT);
+		return sys_mmap_pgoff(addr, len, prot, flags, fd,
+					offset >> PAGE_SHIFT);
 	} else {
 		return -EINVAL;
 	}
--- linux-rt-2.6.31.orig/arch/x86/Kconfig
+++ linux-rt-2.6.31/arch/x86/Kconfig
@@ -366,6 +366,12 @@
 # Following is an alphabetically sorted list of 32 bit extended platforms
 # Please maintain the alphabetic order if and when there are additions
 
+config X86_LPIA
+	bool "LPIA-compatible"
+	depends on X86_32 && X86_PC
+	help
+	  Choose this option if your computer is an LPIA platform.
+
 config X86_ELAN
 	bool "AMD Elan"
 	depends on X86_32
@@ -2082,6 +2088,8 @@
 
 source "drivers/Kconfig"
 
+source "ubuntu/Kconfig"
+
 source "drivers/firmware/Kconfig"
 
 source "fs/Kconfig"
--- linux-rt-2.6.31.orig/arch/x86/ia32/ia32entry.S
+++ linux-rt-2.6.31/arch/x86/ia32/ia32entry.S
@@ -21,8 +21,8 @@
 #define __AUDIT_ARCH_LE	   0x40000000
 
 #ifndef CONFIG_AUDITSYSCALL
-#define sysexit_audit int_ret_from_sys_call
-#define sysretl_audit int_ret_from_sys_call
+#define sysexit_audit ia32_ret_from_sys_call
+#define sysretl_audit ia32_ret_from_sys_call
 #endif
 
 #define IA32_NR_syscalls ((ia32_syscall_end - ia32_sys_call_table)/8)
@@ -39,12 +39,12 @@
 	.endm 
 
 	/* clobbers %eax */	
-	.macro  CLEAR_RREGS _r9=rax
+	.macro  CLEAR_RREGS offset=0, _r9=rax
 	xorl 	%eax,%eax
-	movq	%rax,R11(%rsp)
-	movq	%rax,R10(%rsp)
-	movq	%\_r9,R9(%rsp)
-	movq	%rax,R8(%rsp)
+	movq	%rax,\offset+R11(%rsp)
+	movq	%rax,\offset+R10(%rsp)
+	movq	%\_r9,\offset+R9(%rsp)
+	movq	%rax,\offset+R8(%rsp)
 	.endm
 
 	/*
@@ -172,6 +172,10 @@
 	movl	RIP-R11(%rsp),%edx		/* User %eip */
 	CFI_REGISTER rip,rdx
 	RESTORE_ARGS 1,24,1,1,1,1
+	xorq	%r8,%r8
+	xorq	%r9,%r9
+	xorq	%r10,%r10
+	xorq	%r11,%r11
 	popfq
 	CFI_ADJUST_CFA_OFFSET -8
 	/*CFI_RESTORE rflags*/
@@ -200,9 +204,9 @@
 	movl RDI-ARGOFFSET(%rsp),%r8d	/* reload 5th syscall arg */
 	.endm
 
-	.macro auditsys_exit exit,ebpsave=RBP
+	.macro auditsys_exit exit
 	testl $(_TIF_ALLWORK_MASK & ~_TIF_SYSCALL_AUDIT),TI_flags(%r10)
-	jnz int_ret_from_sys_call
+	jnz ia32_ret_from_sys_call
 	TRACE_IRQS_ON
 	sti
 	movl %eax,%esi		/* second arg, syscall return value */
@@ -213,13 +217,13 @@
 	call audit_syscall_exit
 	GET_THREAD_INFO(%r10)
 	movl RAX-ARGOFFSET(%rsp),%eax	/* reload syscall return value */
-	movl \ebpsave-ARGOFFSET(%rsp),%ebp /* reload user register value */
 	movl $(_TIF_ALLWORK_MASK & ~_TIF_SYSCALL_AUDIT),%edi
 	cli
 	TRACE_IRQS_OFF
 	testl %edi,TI_flags(%r10)
-	jnz int_with_check
-	jmp \exit
+	jz \exit
+	CLEAR_RREGS -ARGOFFSET
+	jmp int_with_check
 	.endm
 
 sysenter_auditsys:
@@ -329,6 +333,9 @@
 	CFI_REGISTER rip,rcx
 	movl EFLAGS-ARGOFFSET(%rsp),%r11d	
 	/*CFI_REGISTER rflags,r11*/
+	xorq	%r10,%r10
+	xorq	%r9,%r9
+	xorq	%r8,%r8
 	TRACE_IRQS_ON
 	movl RSP-ARGOFFSET(%rsp),%esp
 	CFI_RESTORE rsp
@@ -343,7 +350,7 @@
 	jmp cstar_dispatch
 
 sysretl_audit:
-	auditsys_exit sysretl_from_sys_call, RCX /* user %ebp in RCX slot */
+	auditsys_exit sysretl_from_sys_call
 #endif
 
 cstar_tracesys:
@@ -353,7 +360,7 @@
 #endif
 	xchgl %r9d,%ebp
 	SAVE_REST
-	CLEAR_RREGS r9
+	CLEAR_RREGS 0, r9
 	movq $-ENOSYS,RAX(%rsp)	/* ptrace can change this for a bad syscall */
 	movq %rsp,%rdi        /* &pt_regs -> arg1 */
 	call syscall_trace_enter
@@ -425,6 +432,8 @@
 	call *ia32_sys_call_table(,%rax,8) # xxx: rip relative
 ia32_sysret:
 	movq %rax,RAX-ARGOFFSET(%rsp)
+ia32_ret_from_sys_call:
+	CLEAR_RREGS -ARGOFFSET
 	jmp int_ret_from_sys_call 
 
 ia32_tracesys:			 
@@ -442,8 +451,8 @@
 
 ia32_badsys:
 	movq $0,ORIG_RAX-ARGOFFSET(%rsp)
-	movq $-ENOSYS,RAX-ARGOFFSET(%rsp)
-	jmp int_ret_from_sys_call
+	movq $-ENOSYS,%rax
+	jmp ia32_sysret
 
 quiet_ni_syscall:
 	movq $-ENOSYS,%rax
@@ -687,7 +696,7 @@
 	.quad quiet_ni_syscall		/* streams2 */
 	.quad stub32_vfork            /* 190 */
 	.quad compat_sys_getrlimit
-	.quad sys32_mmap2
+	.quad sys_mmap_pgoff
 	.quad sys32_truncate64
 	.quad sys32_ftruncate64
 	.quad sys32_stat64		/* 195 */
--- linux-rt-2.6.31.orig/arch/x86/ia32/ia32_aout.c
+++ linux-rt-2.6.31/arch/x86/ia32/ia32_aout.c
@@ -308,14 +308,15 @@
 	if (retval)
 		return retval;
 
-	regs->cs = __USER32_CS;
-	regs->r8 = regs->r9 = regs->r10 = regs->r11 = regs->r12 =
-		regs->r13 = regs->r14 = regs->r15 = 0;
-
 	/* OK, This is the point of no return */
 	set_personality(PER_LINUX);
 	set_thread_flag(TIF_IA32);
-	clear_thread_flag(TIF_ABI_PENDING);
+
+	setup_new_exec(bprm);
+
+	regs->cs = __USER32_CS;
+	regs->r8 = regs->r9 = regs->r10 = regs->r11 = regs->r12 =
+		regs->r13 = regs->r14 = regs->r15 = 0;
 
 	current->mm->end_code = ex.a_text +
 		(current->mm->start_code = N_TXTADDR(ex));
--- linux-rt-2.6.31.orig/arch/x86/ia32/sys_ia32.c
+++ linux-rt-2.6.31/arch/x86/ia32/sys_ia32.c
@@ -155,9 +155,6 @@
 asmlinkage long sys32_mmap(struct mmap_arg_struct __user *arg)
 {
 	struct mmap_arg_struct a;
-	struct file *file = NULL;
-	unsigned long retval;
-	struct mm_struct *mm ;
 
 	if (copy_from_user(&a, arg, sizeof(a)))
 		return -EFAULT;
@@ -165,22 +162,8 @@
 	if (a.offset & ~PAGE_MASK)
 		return -EINVAL;
 
-	if (!(a.flags & MAP_ANONYMOUS)) {
-		file = fget(a.fd);
-		if (!file)
-			return -EBADF;
-	}
-
-	mm = current->mm;
-	down_write(&mm->mmap_sem);
-	retval = do_mmap_pgoff(file, a.addr, a.len, a.prot, a.flags,
+	return sys_mmap_pgoff(a.addr, a.len, a.prot, a.flags, a.fd,
 			       a.offset>>PAGE_SHIFT);
-	if (file)
-		fput(file);
-
-	up_write(&mm->mmap_sem);
-
-	return retval;
 }
 
 asmlinkage long sys32_mprotect(unsigned long start, size_t len,
@@ -553,30 +536,6 @@
 	return ret;
 }
 
-asmlinkage long sys32_mmap2(unsigned long addr, unsigned long len,
-			    unsigned long prot, unsigned long flags,
-			    unsigned long fd, unsigned long pgoff)
-{
-	struct mm_struct *mm = current->mm;
-	unsigned long error;
-	struct file *file = NULL;
-
-	flags &= ~(MAP_EXECUTABLE | MAP_DENYWRITE);
-	if (!(flags & MAP_ANONYMOUS)) {
-		file = fget(fd);
-		if (!file)
-			return -EBADF;
-	}
-
-	down_write(&mm->mmap_sem);
-	error = do_mmap_pgoff(file, addr, len, prot, flags, pgoff);
-	up_write(&mm->mmap_sem);
-
-	if (file)
-		fput(file);
-	return error;
-}
-
 asmlinkage long sys32_olduname(struct oldold_utsname __user *name)
 {
 	char *arch = "x86_64";
--- linux-rt-2.6.31.orig/arch/x86/include/asm/kvm_x86_emulate.h
+++ linux-rt-2.6.31/arch/x86/include/asm/kvm_x86_emulate.h
@@ -129,7 +129,7 @@
 	u8 seg_override;
 	unsigned int d;
 	unsigned long regs[NR_VCPU_REGS];
-	unsigned long eip;
+	unsigned long eip, eip_orig;
 	/* modrm */
 	u8 modrm;
 	u8 modrm_mod;
--- linux-rt-2.6.31.orig/arch/x86/include/asm/desc.h
+++ linux-rt-2.6.31/arch/x86/include/asm/desc.h
@@ -5,6 +5,7 @@
 #include <asm/ldt.h>
 #include <asm/mmu.h>
 #include <linux/smp.h>
+#include <linux/mm_types.h>
 
 static inline void fill_ldt(struct desc_struct *desc,
 			    const struct user_desc *info)
@@ -93,6 +94,9 @@
 
 #define load_TLS(t, cpu) native_load_tls(t, cpu)
 #define set_ldt native_set_ldt
+#ifdef CONFIG_X86_32
+#define load_user_cs_desc native_load_user_cs_desc
+#endif /*CONFIG_X86_32*/
 
 #define write_ldt_entry(dt, entry, desc)	\
 	native_write_ldt_entry(dt, entry, desc)
@@ -379,4 +383,25 @@
 	_set_gate(n, GATE_INTERRUPT, addr, 0x3, ist, __KERNEL_CS);
 }
 
+#ifdef CONFIG_X86_32
+static inline void set_user_cs(struct desc_struct *desc, unsigned long limit)
+{
+	limit = (limit - 1) / PAGE_SIZE;
+	desc->a = limit & 0xffff;
+	desc->b = (limit & 0xf0000) | 0x00c0fb00;
+}
+
+static inline void native_load_user_cs_desc(int cpu, struct mm_struct *mm)
+{
+	get_cpu_gdt_table(cpu)[GDT_ENTRY_DEFAULT_USER_CS] = (mm)->context.user_cs;
+}
+
+#define arch_add_exec_range arch_add_exec_range
+#define arch_remove_exec_range arch_remove_exec_range
+#define arch_flush_exec_range arch_flush_exec_range
+extern void arch_add_exec_range(struct mm_struct *mm, unsigned long limit);
+extern void arch_remove_exec_range(struct mm_struct *mm, unsigned long limit);
+extern void arch_flush_exec_range(struct mm_struct *mm);
+#endif /* CONFIG_X86_32 */
+
 #endif /* _ASM_X86_DESC_H */
--- linux-rt-2.6.31.orig/arch/x86/include/asm/processor.h
+++ linux-rt-2.6.31/arch/x86/include/asm/processor.h
@@ -179,7 +179,7 @@
 				unsigned int *ecx, unsigned int *edx)
 {
 	/* ecx is often an input as well as an output. */
-	asm("cpuid"
+	asm volatile("cpuid"
 	    : "=a" (*eax),
 	      "=b" (*ebx),
 	      "=c" (*ecx),
@@ -403,7 +403,17 @@
 extern asmlinkage void ignore_sysret(void);
 #else	/* X86_64 */
 #ifdef CONFIG_CC_STACKPROTECTOR
-DECLARE_PER_CPU(unsigned long, stack_canary);
+/*
+ * Make sure stack canary segment base is cached-aligned:
+ *   "For Intel Atom processors, avoid non zero segment base address
+ *    that is not aligned to cache line boundary at all cost."
+ * (Optim Ref Manual Assembly/Compiler Coding Rule 15.)
+ */
+struct stack_canary {
+	char __pad[20];		/* canary at %gs:20 */
+	unsigned long canary;
+};
+DECLARE_PER_CPU(struct stack_canary, stack_canary) ____cacheline_aligned;
 #endif
 #endif	/* X86_64 */
 
--- linux-rt-2.6.31.orig/arch/x86/include/asm/stackprotector.h
+++ linux-rt-2.6.31/arch/x86/include/asm/stackprotector.h
@@ -78,14 +78,14 @@
 #ifdef CONFIG_X86_64
 	percpu_write(irq_stack_union.stack_canary, canary);
 #else
-	percpu_write(stack_canary, canary);
+	percpu_write(stack_canary.canary, canary);
 #endif
 }
 
 static inline void setup_stack_canary_segment(int cpu)
 {
 #ifdef CONFIG_X86_32
-	unsigned long canary = (unsigned long)&per_cpu(stack_canary, cpu) - 20;
+	unsigned long canary = (unsigned long)&per_cpu(stack_canary, cpu);
 	struct desc_struct *gdt_table = get_cpu_gdt_table(cpu);
 	struct desc_struct desc;
 
--- linux-rt-2.6.31.orig/arch/x86/include/asm/thread_info.h
+++ linux-rt-2.6.31/arch/x86/include/asm/thread_info.h
@@ -86,7 +86,6 @@
 #define TIF_NOTSC		16	/* TSC is not accessible in userland */
 #define TIF_IA32		17	/* 32bit process */
 #define TIF_FORK		18	/* ret_from_fork */
-#define TIF_ABI_PENDING		19
 #define TIF_MEMDIE		20
 #define TIF_DEBUG		21	/* uses debug registers */
 #define TIF_IO_BITMAP		22	/* uses I/O bitmap */
@@ -110,7 +109,6 @@
 #define _TIF_NOTSC		(1 << TIF_NOTSC)
 #define _TIF_IA32		(1 << TIF_IA32)
 #define _TIF_FORK		(1 << TIF_FORK)
-#define _TIF_ABI_PENDING	(1 << TIF_ABI_PENDING)
 #define _TIF_DEBUG		(1 << TIF_DEBUG)
 #define _TIF_IO_BITMAP		(1 << TIF_IO_BITMAP)
 #define _TIF_FREEZE		(1 << TIF_FREEZE)
--- linux-rt-2.6.31.orig/arch/x86/include/asm/checksum_32.h
+++ linux-rt-2.6.31/arch/x86/include/asm/checksum_32.h
@@ -161,7 +161,8 @@
 	    "adcl $0, %0	;\n"
 	    : "=&r" (sum)
 	    : "r" (saddr), "r" (daddr),
-	      "r" (htonl(len)), "r" (htonl(proto)), "0" (sum));
+	      "r" (htonl(len)), "r" (htonl(proto)), "0" (sum)
+	    : "memory");
 
 	return csum_fold(sum);
 }
--- linux-rt-2.6.31.orig/arch/x86/include/asm/syscalls.h
+++ linux-rt-2.6.31/arch/x86/include/asm/syscalls.h
@@ -55,8 +55,6 @@
 struct oldold_utsname;
 struct old_utsname;
 
-asmlinkage long sys_mmap2(unsigned long, unsigned long, unsigned long,
-			  unsigned long, unsigned long, unsigned long);
 asmlinkage int old_mmap(struct mmap_arg_struct __user *);
 asmlinkage int old_select(struct sel_arg_struct __user *);
 asmlinkage int sys_ipc(uint, int, int, int, void __user *, long);
--- linux-rt-2.6.31.orig/arch/x86/include/asm/mce.h
+++ linux-rt-2.6.31/arch/x86/include/asm/mce.h
@@ -214,5 +214,11 @@
 static inline void mce_log_therm_throt_event(__u64 status) {}
 #endif
 
+#ifdef CONFIG_X86_THERMAL_VECTOR
+extern void mcheck_intel_therm_init(void);
+#else
+static inline void mcheck_intel_therm_init(void) { }
+#endif
+
 #endif /* __KERNEL__ */
 #endif /* _ASM_X86_MCE_H */
--- linux-rt-2.6.31.orig/arch/x86/include/asm/elf.h
+++ linux-rt-2.6.31/arch/x86/include/asm/elf.h
@@ -197,15 +197,8 @@
 	set_fs(USER_DS);				\
 } while (0)
 
-#define COMPAT_SET_PERSONALITY(ex)			\
-do {							\
-	if (test_thread_flag(TIF_IA32))			\
-		clear_thread_flag(TIF_ABI_PENDING);	\
-	else						\
-		set_thread_flag(TIF_ABI_PENDING);	\
-	current->personality |= force_personality32;	\
-} while (0)
-
+void set_personality_ia32(void);
+#define COMPAT_SET_PERSONALITY(ex) set_personality_ia32()
 #define COMPAT_ELF_PLATFORM			("i686")
 
 /*
@@ -299,6 +292,8 @@
 
 #ifdef CONFIG_X86_32
 
+#define STACK_RND_MASK (0x7ff)
+
 #define VDSO_HIGH_BASE		(__fix_to_virt(FIX_VDSO))
 
 #define ARCH_DLINFO		ARCH_DLINFO_IA32(vdso_enabled)
--- linux-rt-2.6.31.orig/arch/x86/include/asm/mmu.h
+++ linux-rt-2.6.31/arch/x86/include/asm/mmu.h
@@ -7,12 +7,19 @@
 /*
  * The x86 doesn't have a mmu context, but
  * we put the segment information here.
+ *
+ * exec_limit is used to track the range PROT_EXEC
+ * mappings span.
  */
 typedef struct {
 	void *ldt;
 	int size;
 	struct mutex lock;
 	void *vdso;
+#ifdef CONFIG_X86_32
+	struct desc_struct user_cs;
+	unsigned long exec_limit;
+#endif
 } mm_context_t;
 
 #ifdef CONFIG_SMP
--- linux-rt-2.6.31.orig/arch/x86/include/asm/sys_ia32.h
+++ linux-rt-2.6.31/arch/x86/include/asm/sys_ia32.h
@@ -62,9 +62,6 @@
 asmlinkage long sys32_personality(unsigned long);
 asmlinkage long sys32_sendfile(int, int, compat_off_t __user *, s32);
 
-asmlinkage long sys32_mmap2(unsigned long, unsigned long, unsigned long,
-			    unsigned long, unsigned long, unsigned long);
-
 struct oldold_utsname;
 struct old_utsname;
 asmlinkage long sys32_olduname(struct oldold_utsname __user *);
--- linux-rt-2.6.31.orig/arch/x86/include/asm/kvm_host.h
+++ linux-rt-2.6.31/arch/x86/include/asm/kvm_host.h
@@ -618,6 +618,7 @@
 void kvm_queue_exception_e(struct kvm_vcpu *vcpu, unsigned nr, u32 error_code);
 void kvm_inject_page_fault(struct kvm_vcpu *vcpu, unsigned long cr2,
 			   u32 error_code);
+bool kvm_require_cpl(struct kvm_vcpu *vcpu, int required_cpl);
 
 int kvm_pic_set_irq(void *opaque, int irq, int level);
 
--- linux-rt-2.6.31.orig/arch/x86/include/asm/paravirt.h
+++ linux-rt-2.6.31/arch/x86/include/asm/paravirt.h
@@ -139,6 +139,9 @@
 	void (*store_gdt)(struct desc_ptr *);
 	void (*store_idt)(struct desc_ptr *);
 	void (*set_ldt)(const void *desc, unsigned entries);
+#ifdef CONFIG_X86_32
+	void (*load_user_cs_desc)(int cpu, struct mm_struct *mm);
+#endif /*CONFIG_X86_32*/
 	unsigned long (*store_tr)(void);
 	void (*load_tls)(struct thread_struct *t, unsigned int cpu);
 #ifdef CONFIG_X86_64
@@ -528,10 +531,11 @@
 #define EXTRA_CLOBBERS
 #define VEXTRA_CLOBBERS
 #else  /* CONFIG_X86_64 */
+/* [re]ax isn't an arg, but the return val */
 #define PVOP_VCALL_ARGS					\
 	unsigned long __edi = __edi, __esi = __esi,	\
-		__edx = __edx, __ecx = __ecx
-#define PVOP_CALL_ARGS		PVOP_VCALL_ARGS, __eax
+		__edx = __edx, __ecx = __ecx, __eax = __eax
+#define PVOP_CALL_ARGS		PVOP_VCALL_ARGS
 
 #define PVOP_CALL_ARG1(x)		"D" ((unsigned long)(x))
 #define PVOP_CALL_ARG2(x)		"S" ((unsigned long)(x))
@@ -543,6 +547,7 @@
 				"=c" (__ecx)
 #define PVOP_CALL_CLOBBERS	PVOP_VCALL_CLOBBERS, "=a" (__eax)
 
+/* void functions are still allowed [re]ax for scratch */
 #define PVOP_VCALLEE_CLOBBERS	"=a" (__eax)
 #define PVOP_CALLEE_CLOBBERS	PVOP_VCALLEE_CLOBBERS
 
@@ -617,8 +622,8 @@
 		       VEXTRA_CLOBBERS,					\
 		       pre, post, ##__VA_ARGS__)
 
-#define __PVOP_VCALLEESAVE(rettype, op, pre, post, ...)			\
-	____PVOP_CALL(rettype, op.func, CLBR_RET_REG,			\
+#define __PVOP_VCALLEESAVE(op, pre, post, ...)				\
+	____PVOP_VCALL(op.func, CLBR_RET_REG,				\
 		      PVOP_VCALLEE_CLOBBERS, ,				\
 		      pre, post, ##__VA_ARGS__)
 
@@ -955,6 +960,12 @@
 {
 	PVOP_VCALL2(pv_cpu_ops.set_ldt, addr, entries);
 }
+#ifdef CONFIG_X86_32
+static inline void load_user_cs_desc(unsigned int cpu, struct mm_struct *mm)
+{
+	PVOP_VCALL2(pv_cpu_ops.load_user_cs_desc, cpu, mm);
+}
+#endif /*CONFIG_X86_32*/
 static inline void store_gdt(struct desc_ptr *dtr)
 {
 	PVOP_VCALL1(pv_cpu_ops.store_gdt, dtr);
@@ -1565,42 +1576,22 @@
 
 static inline unsigned long __raw_local_save_flags(void)
 {
-	unsigned long f;
-
-	asm volatile(paravirt_alt(PARAVIRT_CALL)
-		     : "=a"(f)
-		     : paravirt_type(pv_irq_ops.save_fl),
-		       paravirt_clobber(CLBR_EAX)
-		     : "memory", "cc");
-	return f;
+	return PVOP_CALLEE0(unsigned long, pv_irq_ops.save_fl);
 }
 
 static inline void raw_local_irq_restore(unsigned long f)
 {
-	asm volatile(paravirt_alt(PARAVIRT_CALL)
-		     : "=a"(f)
-		     : PV_FLAGS_ARG(f),
-		       paravirt_type(pv_irq_ops.restore_fl),
-		       paravirt_clobber(CLBR_EAX)
-		     : "memory", "cc");
+	PVOP_VCALLEE1(pv_irq_ops.restore_fl, f);
 }
 
 static inline void raw_local_irq_disable(void)
 {
-	asm volatile(paravirt_alt(PARAVIRT_CALL)
-		     :
-		     : paravirt_type(pv_irq_ops.irq_disable),
-		       paravirt_clobber(CLBR_EAX)
-		     : "memory", "eax", "cc");
+	PVOP_VCALLEE0(pv_irq_ops.irq_disable);
 }
 
 static inline void raw_local_irq_enable(void)
 {
-	asm volatile(paravirt_alt(PARAVIRT_CALL)
-		     :
-		     : paravirt_type(pv_irq_ops.irq_enable),
-		       paravirt_clobber(CLBR_EAX)
-		     : "memory", "eax", "cc");
+	PVOP_VCALLEE0(pv_irq_ops.irq_enable);
 }
 
 static inline unsigned long __raw_local_irq_save(void)
--- linux-rt-2.6.31.orig/arch/x86/include/asm/system.h
+++ linux-rt-2.6.31/arch/x86/include/asm/system.h
@@ -31,7 +31,7 @@
 	"movl %P[task_canary](%[next]), %%ebx\n\t"			\
 	"movl %%ebx, "__percpu_arg([stack_canary])"\n\t"
 #define __switch_canary_oparam						\
-	, [stack_canary] "=m" (per_cpu_var(stack_canary))
+	, [stack_canary] "=m" (per_cpu_var(stack_canary.canary))
 #define __switch_canary_iparam						\
 	, [task_canary] "i" (offsetof(struct task_struct, stack_canary))
 #else	/* CC_STACKPROTECTOR */
--- linux-rt-2.6.31.orig/arch/x86/include/asm/amd_iommu.h
+++ linux-rt-2.6.31/arch/x86/include/asm/amd_iommu.h
@@ -30,6 +30,7 @@
 extern void amd_iommu_flush_all_domains(void);
 extern void amd_iommu_flush_all_devices(void);
 extern void amd_iommu_shutdown(void);
+extern void amd_iommu_apply_erratum_63(u16 devid);
 #else
 static inline int amd_iommu_init(void) { return -ENODEV; }
 static inline void amd_iommu_detect(void) { }
--- linux-rt-2.6.31.orig/arch/x86/include/asm/uv/uv_hub.h
+++ linux-rt-2.6.31/arch/x86/include/asm/uv/uv_hub.h
@@ -18,6 +18,8 @@
 #include <asm/types.h>
 #include <asm/percpu.h>
 #include <asm/uv/uv_mmrs.h>
+#include <asm/irq_vectors.h>
+#include <asm/io_apic.h>
 
 
 /*
@@ -420,9 +422,14 @@
 static inline void uv_hub_send_ipi(int pnode, int apicid, int vector)
 {
 	unsigned long val;
+	unsigned long dmode = dest_Fixed;
+
+	if (vector == NMI_VECTOR)
+		dmode = dest_NMI;
 
 	val = (1UL << UVH_IPI_INT_SEND_SHFT) |
-			((apicid & 0x3f) << UVH_IPI_INT_APIC_ID_SHFT) |
+			((apicid) << UVH_IPI_INT_APIC_ID_SHFT) |
+			(dmode << UVH_IPI_INT_DELIVERY_MODE_SHFT) |
 			(vector << UVH_IPI_INT_VECTOR_SHFT);
 	uv_write_global_mmr64(pnode, UVH_IPI_INT, val);
 }
--- linux-rt-2.6.31.orig/arch/x86/pci/i386.c
+++ linux-rt-2.6.31/arch/x86/pci/i386.c
@@ -129,7 +129,7 @@
 					continue;
 				if (!r->start ||
 				    pci_claim_resource(dev, idx) < 0) {
-					dev_info(&dev->dev, "BAR %d: can't allocate resource\n", idx);
+					dev_warn(&dev->dev, "BAR %d: can't allocate resource\n", idx);
 					/*
 					 * Something is wrong with the region.
 					 * Invalidate the resource to prevent
@@ -169,7 +169,7 @@
 					(unsigned long long) r->end,
 					r->flags, disabled, pass);
 				if (pci_claim_resource(dev, idx) < 0) {
-					dev_info(&dev->dev, "BAR %d: can't allocate resource\n", idx);
+					dev_warn(&dev->dev, "BAR %d: can't allocate resource\n", idx);
 					/* We'll assign a new address later */
 					r->end -= r->start;
 					r->start = 0;
--- linux-rt-2.6.31.orig/arch/x86/mm/tlb.c
+++ linux-rt-2.6.31/arch/x86/mm/tlb.c
@@ -6,6 +6,7 @@
 #include <linux/interrupt.h>
 #include <linux/module.h>
 
+#include <asm/desc.h>
 #include <asm/tlbflush.h>
 #include <asm/mmu_context.h>
 #include <asm/apic.h>
@@ -129,6 +130,10 @@
 	union smp_flush_state *f;
 
 	cpu = smp_processor_id();
+#ifdef CONFIG_X86_32
+	if (current->active_mm)
+                load_user_cs_desc(cpu, current->active_mm);
+#endif
 	/*
 	 * orig_rax contains the negated interrupt vector.
 	 * Use that to determine where the sender put the data.
--- linux-rt-2.6.31.orig/arch/x86/mm/pageattr.c
+++ linux-rt-2.6.31/arch/x86/mm/pageattr.c
@@ -143,6 +143,7 @@
 
 	mb();
 }
+EXPORT_SYMBOL_GPL(clflush_cache_range);
 
 static void __cpa_flush_all(void *arg)
 {
@@ -822,6 +823,7 @@
 {
 	struct cpa_data cpa;
 	int ret, cache, checkalias;
+	unsigned long baddr = 0;
 
 	/*
 	 * Check, if we are requested to change a not supported
@@ -853,6 +855,11 @@
 			 */
 			WARN_ON_ONCE(1);
 		}
+		/*
+		 * Save address for cache flush. *addr is modified in the call
+		 * to __change_page_attr_set_clr() below.
+		 */
+		baddr = *addr;
 	}
 
 	/* Must avoid aliasing mappings in the highmem code */
@@ -900,7 +907,7 @@
 			cpa_flush_array(addr, numpages, cache,
 					cpa.flags, pages);
 		} else
-			cpa_flush_range(*addr, numpages, cache);
+			cpa_flush_range(baddr, numpages, cache);
 	} else
 		cpa_flush_all(cache);
 
--- linux-rt-2.6.31.orig/arch/x86/mm/init.c
+++ linux-rt-2.6.31/arch/x86/mm/init.c
@@ -77,6 +77,7 @@
 #else
 static inline void set_nx(void)
 {
+	nx_enabled = _PAGE_NX && ((__supported_pte_mask & _PAGE_NX) == _PAGE_NX);
 }
 #endif
 
@@ -212,6 +213,14 @@
 	set_nx();
 	if (nx_enabled)
 		printk(KERN_INFO "NX (Execute Disable) protection: active\n");
+	else
+#ifdef CONFIG_X86_32
+		printk(KERN_INFO "Using x86 segment limits to approximate "
+			"NX protection\n");
+#else
+		printk(KERN_WARNING "Warning: NX (Execute Disable) protection "
+			"missing in CPU or disabled in BIOS!\n");
+#endif
 
 	/* Enable PSE if available */
 	if (cpu_has_pse)
--- linux-rt-2.6.31.orig/arch/x86/mm/Makefile
+++ linux-rt-2.6.31/arch/x86/mm/Makefile
@@ -1,6 +1,11 @@
 obj-y	:=  init.o init_$(BITS).o fault.o ioremap.o extable.o pageattr.o mmap.o \
 	    pat.o pgtable.o gup.o
 
+# Make sure __phys_addr has no stackprotector
+nostackp := $(call cc-option, -fno-stack-protector)
+CFLAGS_ioremap.o		:= $(nostackp)
+CFLAGS_init.o			:= $(nostackp)
+
 obj-$(CONFIG_SMP)		+= tlb.o
 
 obj-$(CONFIG_X86_32)		+= pgtable_32.o iomap_32.o
--- linux-rt-2.6.31.orig/arch/x86/mm/mmap.c
+++ linux-rt-2.6.31/arch/x86/mm/mmap.c
@@ -29,13 +29,26 @@
 #include <linux/random.h>
 #include <linux/limits.h>
 #include <linux/sched.h>
+#include <asm/elf.h>
+
+static unsigned int stack_maxrandom_size(void)
+{
+	unsigned int max = 0;
+	if ((current->flags & PF_RANDOMIZE) &&
+		!(current->personality & ADDR_NO_RANDOMIZE)) {
+		max = ((-1U) & STACK_RND_MASK) << PAGE_SHIFT;
+	}
+
+	return max;
+}
+
 
 /*
  * Top of mmap area (just below the process stack).
  *
- * Leave an at least ~128 MB hole.
+ * Leave an at least ~128 MB hole with possible stack randomization.
  */
-#define MIN_GAP (128*1024*1024)
+#define MIN_GAP (128*1024*1024UL + stack_maxrandom_size())
 #define MAX_GAP (TASK_SIZE/6*5)
 
 /*
@@ -118,6 +131,11 @@
 	} else {
 		mm->mmap_base = mmap_base();
 		mm->get_unmapped_area = arch_get_unmapped_area_topdown;
+#ifdef CONFIG_X86_32
+		if (!nx_enabled && !(current->personality & READ_IMPLIES_EXEC)
+		    && mmap_is_ia32())
+			mm->get_unmapped_exec_area = arch_get_unmapped_exec_area;
+#endif
 		mm->unmap_area = arch_unmap_area_topdown;
 	}
 }
--- linux-rt-2.6.31.orig/arch/x86/kernel/process_64.c
+++ linux-rt-2.6.31/arch/x86/kernel/process_64.c
@@ -525,6 +525,18 @@
 	current->personality &= ~READ_IMPLIES_EXEC;
 }
 
+void set_personality_ia32(void)
+{
+	/* inherit personality from parent */
+
+	/* Make sure to be in 32bit mode */
+	set_thread_flag(TIF_IA32);
+	current->personality |= force_personality32;
+
+	/* Prepare the first "return" to user space */
+	current_thread_info()->status |= TS_COMPAT;
+}
+
 asmlinkage long
 sys_clone(unsigned long clone_flags, unsigned long newsp,
 	  void __user *parent_tid, void __user *child_tid, struct pt_regs *regs)
--- linux-rt-2.6.31.orig/arch/x86/kernel/i8253.c
+++ linux-rt-2.6.31/arch/x86/kernel/i8253.c
@@ -21,8 +21,10 @@
 
 #ifdef CONFIG_X86_32
 static void pit_disable_clocksource(void);
+static void pit_enable_clocksource(void);
 #else
 static inline void pit_disable_clocksource(void) { }
+static inline void pit_enable_clocksource(void) { }
 #endif
 
 /*
@@ -67,7 +69,7 @@
 		break;
 
 	case CLOCK_EVT_MODE_RESUME:
-		/* Nothing to do here */
+		pit_enable_clocksource();
 		break;
 	}
 	spin_unlock(&i8253_lock);
@@ -200,19 +202,27 @@
 	.shift		= 20,
 };
 
+int pit_cs_registered;
 static void pit_disable_clocksource(void)
 {
-	/*
-	 * Use mult to check whether it is registered or not
-	 */
-	if (pit_cs.mult) {
+	if (pit_cs_registered) {
 		clocksource_unregister(&pit_cs);
-		pit_cs.mult = 0;
+		pit_cs_registered = 0;
+	}
+}
+
+static void pit_enable_clocksource(void)
+{
+	if (!pit_cs_registered && !clocksource_register(&pit_cs)) {
+		pit_cs_registered = 1;
 	}
 }
 
+
+
 static int __init init_pit_clocksource(void)
 {
+	int ret;
 	 /*
 	  * Several reasons not to register PIT as a clocksource:
 	  *
@@ -226,7 +236,10 @@
 
 	pit_cs.mult = clocksource_hz2mult(CLOCK_TICK_RATE, pit_cs.shift);
 
-	return clocksource_register(&pit_cs);
+	ret = clocksource_register(&pit_cs);
+	if (!ret)
+		pit_cs_registered = 1;
+	return ret;
 }
 arch_initcall(init_pit_clocksource);
 
--- linux-rt-2.6.31.orig/arch/x86/kernel/reboot.c
+++ linux-rt-2.6.31/arch/x86/kernel/reboot.c
@@ -217,6 +217,15 @@
 			DMI_MATCH(DMI_PRODUCT_NAME, "Precision WorkStation T5400"),
 		},
 	},
+	{	/* Handle problems with rebooting on Dell Dimension 9200 */
+		.callback = set_bios_reboot,
+		.ident = "Dell Dimension 9200",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Dell DXP061"),
+			DMI_MATCH(DMI_BOARD_NAME, "0CT017"),
+		},
+	},
 	{	/* Handle problems with rebooting on HP laptops */
 		.callback = set_bios_reboot,
 		.ident = "HP Compaq Laptop",
@@ -257,6 +266,34 @@
 			DMI_MATCH(DMI_PRODUCT_NAME, "SBC-FITPC2"),
 		},
 	},
+#ifdef CONFIG_X86_LPIA
+	{	/* Handle problems with rebooting on Intel Crown Beach board */
+		.callback = set_bios_reboot,
+		.ident = "Intel Crown Beach board",
+		.matches = {
+			/* Currently the DMI info is not customized and indicates 
+                         * OEM need change that */
+			DMI_MATCH(DMI_SYS_VENDOR, "To Be Filled By O.E.M."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "To Be Filled By O.E.M."),
+		},
+	},
+#endif
+	{	/* Handle problems with rebooting on Dell XPS710 */
+		.callback = set_bios_reboot,
+		.ident = "Dell XPS710",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Dell XPS710"),
+		},
+	},
+	{       /* Handle problems with rebooting on ASUS P4S800 */
+		.callback = set_bios_reboot,
+		.ident = "ASUS P4S800",
+		.matches = {
+			DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK Computer INC."),
+			DMI_MATCH(DMI_BOARD_NAME, "P4S800"),
+		},
+	},
 	{ }
 };
 
--- linux-rt-2.6.31.orig/arch/x86/kernel/tlb_uv.c
+++ linux-rt-2.6.31/arch/x86/kernel/tlb_uv.c
@@ -843,8 +843,8 @@
 				       GFP_KERNEL, cpu_to_node(cur_cpu));
 
 	uv_bau_retry_limit = 1;
-	uv_nshift = uv_hub_info->n_val;
-	uv_mmask = (1UL << uv_hub_info->n_val) - 1;
+	uv_nshift = uv_hub_info->m_val;
+	uv_mmask = (1UL << uv_hub_info->m_val) - 1;
 	nblades = uv_num_possible_blades();
 
 	uv_bau_table_bases = (struct bau_control **)
--- linux-rt-2.6.31.orig/arch/x86/kernel/paravirt.c
+++ linux-rt-2.6.31/arch/x86/kernel/paravirt.c
@@ -369,6 +369,9 @@
 	.read_tscp = native_read_tscp,
 	.load_tr_desc = native_load_tr_desc,
 	.set_ldt = native_set_ldt,
+#ifdef CONFIG_X86_32
+	.load_user_cs_desc = native_load_user_cs_desc,
+#endif /*CONFIG_X86_32*/
 	.load_gdt = native_load_gdt,
 	.load_idt = native_load_idt,
 	.store_gdt = native_store_gdt,
--- linux-rt-2.6.31.orig/arch/x86/kernel/amd_iommu_init.c
+++ linux-rt-2.6.31/arch/x86/kernel/amd_iommu_init.c
@@ -240,7 +240,7 @@
 	writel(ctrl, iommu->mmio_base + MMIO_CONTROL_OFFSET);
 }
 
-static void __init iommu_feature_disable(struct amd_iommu *iommu, u8 bit)
+static void iommu_feature_disable(struct amd_iommu *iommu, u8 bit)
 {
 	u32 ctrl;
 
@@ -509,6 +509,26 @@
 	amd_iommu_dev_table[devid].data[i] |= (1 << _bit);
 }
 
+static int get_dev_entry_bit(u16 devid, u8 bit)
+{
+	int i = (bit >> 5) & 0x07;
+	int _bit = bit & 0x1f;
+
+	return (amd_iommu_dev_table[devid].data[i] & (1 << _bit)) >> _bit;
+}
+
+
+void amd_iommu_apply_erratum_63(u16 devid)
+{
+	int sysmgt;
+
+	sysmgt = get_dev_entry_bit(devid, DEV_ENTRY_SYSMGT1) |
+		 (get_dev_entry_bit(devid, DEV_ENTRY_SYSMGT2) << 1);
+
+	if (sysmgt == 0x01)
+		set_dev_entry_bit(devid, DEV_ENTRY_IW);
+}
+
 /* Writes the specific IOMMU for a device into the rlookup table */
 static void __init set_iommu_for_device(struct amd_iommu *iommu, u16 devid)
 {
@@ -537,6 +557,8 @@
 	if (flags & ACPI_DEVFLAG_LINT1)
 		set_dev_entry_bit(devid, DEV_ENTRY_LINT1_PASS);
 
+	amd_iommu_apply_erratum_63(devid);
+
 	set_iommu_for_device(iommu, devid);
 }
 
@@ -893,7 +915,7 @@
  *
  ****************************************************************************/
 
-static int __init iommu_setup_msi(struct amd_iommu *iommu)
+static int iommu_setup_msi(struct amd_iommu *iommu)
 {
 	int r;
 
--- linux-rt-2.6.31.orig/arch/x86/kernel/sys_x86_64.c
+++ linux-rt-2.6.31/arch/x86/kernel/sys_x86_64.c
@@ -23,26 +23,11 @@
 		unsigned long fd, unsigned long off)
 {
 	long error;
-	struct file *file;
-
 	error = -EINVAL;
 	if (off & ~PAGE_MASK)
 		goto out;
 
-	error = -EBADF;
-	file = NULL;
-	flags &= ~(MAP_EXECUTABLE | MAP_DENYWRITE);
-	if (!(flags & MAP_ANONYMOUS)) {
-		file = fget(fd);
-		if (!file)
-			goto out;
-	}
-	down_write(&current->mm->mmap_sem);
-	error = do_mmap_pgoff(file, addr, len, prot, flags, off >> PAGE_SHIFT);
-	up_write(&current->mm->mmap_sem);
-
-	if (file)
-		fput(file);
+	error = sys_mmap_pgoff(addr, len, prot, flags, fd, off >> PAGE_SHIFT);
 out:
 	return error;
 }
--- linux-rt-2.6.31.orig/arch/x86/kernel/syscall_table_32.S
+++ linux-rt-2.6.31/arch/x86/kernel/syscall_table_32.S
@@ -191,7 +191,7 @@
 	.long sys_ni_syscall	/* reserved for streams2 */
 	.long ptregs_vfork	/* 190 */
 	.long sys_getrlimit
-	.long sys_mmap2
+	.long sys_mmap_pgoff
 	.long sys_truncate64
 	.long sys_ftruncate64
 	.long sys_stat64	/* 195 */
--- linux-rt-2.6.31.orig/arch/x86/kernel/pci-dma.c
+++ linux-rt-2.6.31/arch/x86/kernel/pci-dma.c
@@ -203,7 +203,7 @@
 		if (!strncmp(p, "allowdac", 8))
 			forbid_dac = 0;
 		if (!strncmp(p, "nodac", 5))
-			forbid_dac = -1;
+			forbid_dac = 1;
 		if (!strncmp(p, "usedac", 6)) {
 			forbid_dac = -1;
 			return 1;
--- linux-rt-2.6.31.orig/arch/x86/kernel/process_32.c
+++ linux-rt-2.6.31/arch/x86/kernel/process_32.c
@@ -299,6 +299,8 @@
 void
 start_thread(struct pt_regs *regs, unsigned long new_ip, unsigned long new_sp)
 {
+	int cpu;
+
 	set_user_gs(regs, 0);
 	regs->fs		= 0;
 	set_fs(USER_DS);
@@ -308,6 +310,11 @@
 	regs->cs		= __USER_CS;
 	regs->ip		= new_ip;
 	regs->sp		= new_sp;
+
+	cpu = get_cpu();
+	load_user_cs_desc(cpu, current->mm);
+	put_cpu();
+
 	/*
 	 * Free the old FP and other extended state
 	 */
@@ -354,7 +361,8 @@
 	/* never put a printk in __switch_to... printk() calls wake_up*() indirectly */
 
 	__unlazy_fpu(prev_p);
-
+	if (next_p->mm)
+		load_user_cs_desc(cpu, next_p->mm);
 
 	/* we're going to use this soon, after a few expensive things */
 	if (next_p->fpu_counter > 5)
@@ -495,3 +503,40 @@
 	return 0;
 }
 
+static void modify_cs(struct mm_struct *mm, unsigned long limit)
+{
+	mm->context.exec_limit = limit;
+	set_user_cs(&mm->context.user_cs, limit);
+	if (mm == current->mm) {
+		int cpu;
+
+		cpu = get_cpu();
+		load_user_cs_desc(cpu, mm);
+		put_cpu();
+	}
+}
+
+void arch_add_exec_range(struct mm_struct *mm, unsigned long limit)
+{
+	if (limit > mm->context.exec_limit)
+		modify_cs(mm, limit);
+}
+
+void arch_remove_exec_range(struct mm_struct *mm, unsigned long old_end)
+{
+	struct vm_area_struct *vma;
+	unsigned long limit = PAGE_SIZE;
+
+	if (old_end == mm->context.exec_limit) {
+		for (vma = mm->mmap; vma; vma = vma->vm_next)
+			if ((vma->vm_flags & VM_EXEC) && (vma->vm_end > limit))
+				limit = vma->vm_end;
+		modify_cs(mm, limit);
+	}
+}
+
+void arch_flush_exec_range(struct mm_struct *mm)
+{
+	mm->context.exec_limit = 0;
+	set_user_cs(&mm->context.user_cs, 0);
+}
--- linux-rt-2.6.31.orig/arch/x86/kernel/sys_i386_32.c
+++ linux-rt-2.6.31/arch/x86/kernel/sys_i386_32.c
@@ -24,31 +24,6 @@
 
 #include <asm/syscalls.h>
 
-asmlinkage long sys_mmap2(unsigned long addr, unsigned long len,
-			  unsigned long prot, unsigned long flags,
-			  unsigned long fd, unsigned long pgoff)
-{
-	int error = -EBADF;
-	struct file *file = NULL;
-	struct mm_struct *mm = current->mm;
-
-	flags &= ~(MAP_EXECUTABLE | MAP_DENYWRITE);
-	if (!(flags & MAP_ANONYMOUS)) {
-		file = fget(fd);
-		if (!file)
-			goto out;
-	}
-
-	down_write(&mm->mmap_sem);
-	error = do_mmap_pgoff(file, addr, len, prot, flags, pgoff);
-	up_write(&mm->mmap_sem);
-
-	if (file)
-		fput(file);
-out:
-	return error;
-}
-
 /*
  * Perform the select(nd, in, out, ex, tv) and mmap() system
  * calls. Linux/i386 didn't use to be able to handle more than
@@ -77,7 +52,7 @@
 	if (a.offset & ~PAGE_MASK)
 		goto out;
 
-	err = sys_mmap2(a.addr, a.len, a.prot, a.flags,
+	err = sys_mmap_pgoff(a.addr, a.len, a.prot, a.flags,
 			a.fd, a.offset >> PAGE_SHIFT);
 out:
 	return err;
--- linux-rt-2.6.31.orig/arch/x86/kernel/process.c
+++ linux-rt-2.6.31/arch/x86/kernel/process.c
@@ -94,18 +94,6 @@
 {
 	struct task_struct *tsk = current;
 
-#ifdef CONFIG_X86_64
-	if (test_tsk_thread_flag(tsk, TIF_ABI_PENDING)) {
-		clear_tsk_thread_flag(tsk, TIF_ABI_PENDING);
-		if (test_tsk_thread_flag(tsk, TIF_IA32)) {
-			clear_tsk_thread_flag(tsk, TIF_IA32);
-		} else {
-			set_tsk_thread_flag(tsk, TIF_IA32);
-			current_thread_info()->status |= TS_COMPAT;
-		}
-	}
-#endif
-
 	clear_tsk_thread_flag(tsk, TIF_DEBUG);
 
 	tsk->thread.debugreg0 = 0;
@@ -622,6 +610,16 @@
 unsigned long arch_randomize_brk(struct mm_struct *mm)
 {
 	unsigned long range_end = mm->brk + 0x02000000;
-	return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
+	unsigned long bump = 0;
+#ifdef CONFIG_X86_32
+	/* in the case of NX emulation, shove the brk segment way out of the
+           way of the exec randomization area, since it can collide with
+	   future allocations if not. */
+	if ( (mm->get_unmapped_exec_area == arch_get_unmapped_exec_area) &&
+	     (mm->brk < 0x08000000) ) {
+		bump = (TASK_SIZE/6);
+	}
+#endif
+	return bump + (randomize_range(mm->brk, range_end, 0) ? : mm->brk);
 }
 
--- linux-rt-2.6.31.orig/arch/x86/kernel/kvm.c
+++ linux-rt-2.6.31/arch/x86/kernel/kvm.c
@@ -34,7 +34,6 @@
 struct kvm_para_state {
 	u8 mmu_queue[MMU_QUEUE_SIZE];
 	int mmu_queue_len;
-	enum paravirt_lazy_mode mode;
 };
 
 static DEFINE_PER_CPU(struct kvm_para_state, para_state);
@@ -77,7 +76,7 @@
 {
 	struct kvm_para_state *state = kvm_para_state();
 
-	if (state->mode != PARAVIRT_LAZY_MMU) {
+	if (paravirt_get_lazy_mode() != PARAVIRT_LAZY_MMU) {
 		kvm_mmu_op(buffer, len);
 		return;
 	}
@@ -185,10 +184,7 @@
 
 static void kvm_enter_lazy_mmu(void)
 {
-	struct kvm_para_state *state = kvm_para_state();
-
 	paravirt_enter_lazy_mmu();
-	state->mode = paravirt_get_lazy_mode();
 }
 
 static void kvm_leave_lazy_mmu(void)
@@ -197,7 +193,6 @@
 
 	mmu_queue_flush(state);
 	paravirt_leave_lazy_mmu();
-	state->mode = paravirt_get_lazy_mode();
 }
 
 static void __init paravirt_ops_setup(void)
--- linux-rt-2.6.31.orig/arch/x86/kernel/kvmclock.c
+++ linux-rt-2.6.31/arch/x86/kernel/kvmclock.c
@@ -50,8 +50,8 @@
 	struct timespec ts;
 	int low, high;
 
-	low = (int)__pa(&wall_clock);
-	high = ((u64)__pa(&wall_clock) >> 32);
+	low = (int)__pa_symbol(&wall_clock);
+	high = ((u64)__pa_symbol(&wall_clock) >> 32);
 	native_write_msr(MSR_KVM_WALL_CLOCK, low, high);
 
 	vcpu_time = &get_cpu_var(hv_clock);
--- linux-rt-2.6.31.orig/arch/x86/kernel/head_32.S
+++ linux-rt-2.6.31/arch/x86/kernel/head_32.S
@@ -439,7 +439,6 @@
 	jne 1f
 	movl $per_cpu__gdt_page,%eax
 	movl $per_cpu__stack_canary,%ecx
-	subl $20, %ecx
 	movw %cx, 8 * GDT_ENTRY_STACK_CANARY + 2(%eax)
 	shrl $16, %ecx
 	movb %cl, 8 * GDT_ENTRY_STACK_CANARY + 4(%eax)
--- linux-rt-2.6.31.orig/arch/x86/kernel/setup.c
+++ linux-rt-2.6.31/arch/x86/kernel/setup.c
@@ -107,6 +107,7 @@
 #ifdef CONFIG_X86_64
 #include <asm/numa_64.h>
 #endif
+#include <asm/mce.h>
 
 #ifndef ARCH_SETUP
 #define ARCH_SETUP
@@ -1030,6 +1031,8 @@
 	conswitchp = &dummy_con;
 #endif
 #endif
+
+	mcheck_intel_therm_init();
 }
 
 #ifdef CONFIG_X86_32
--- linux-rt-2.6.31.orig/arch/x86/kernel/pci-gart_64.c
+++ linux-rt-2.6.31/arch/x86/kernel/pci-gart_64.c
@@ -856,7 +856,7 @@
 #endif
 	if (isdigit(*p) && get_option(&p, &arg))
 		iommu_size = arg;
-	if (!strncmp(p, "fullflush", 8))
+	if (!strncmp(p, "fullflush", 9))
 		iommu_fullflush = 1;
 	if (!strncmp(p, "nofullflush", 11))
 		iommu_fullflush = 0;
--- linux-rt-2.6.31.orig/arch/x86/kernel/traps.c
+++ linux-rt-2.6.31/arch/x86/kernel/traps.c
@@ -118,6 +118,67 @@
 	if (!user_mode_vm(regs))
 		die(str, regs, err);
 }
+
+static inline int
+__compare_user_cs_desc(const struct desc_struct *desc1,
+	const struct desc_struct *desc2)
+{
+	return ((desc1->limit0 != desc2->limit0) ||
+		(desc1->limit != desc2->limit) ||
+		(desc1->base0 != desc2->base0) ||
+		(desc1->base1 != desc2->base1) ||
+		(desc1->base2 != desc2->base2));
+}
+
+/*
+ * lazy-check for CS validity on exec-shield binaries:
+ *
+ * the original non-exec stack patch was written by
+ * Solar Designer <solar at openwall.com>. Thanks!
+ */
+static int
+check_lazy_exec_limit(int cpu, struct pt_regs *regs, long error_code)
+{
+	struct desc_struct *desc1, *desc2;
+	struct vm_area_struct *vma;
+	unsigned long limit;
+
+	if (current->mm == NULL)
+		return 0;
+
+	limit = -1UL;
+	if (current->mm->context.exec_limit != -1UL) {
+		limit = PAGE_SIZE;
+		spin_lock(&current->mm->page_table_lock);
+		for (vma = current->mm->mmap; vma; vma = vma->vm_next)
+			if ((vma->vm_flags & VM_EXEC) && (vma->vm_end > limit))
+				limit = vma->vm_end;
+		vma = get_gate_vma(current);
+		if (vma && (vma->vm_flags & VM_EXEC) && (vma->vm_end > limit))
+			limit = vma->vm_end;
+		spin_unlock(&current->mm->page_table_lock);
+		if (limit >= TASK_SIZE)
+			limit = -1UL;
+		current->mm->context.exec_limit = limit;
+	}
+	set_user_cs(&current->mm->context.user_cs, limit);
+
+	desc1 = &current->mm->context.user_cs;
+	desc2 = get_cpu_gdt_table(cpu) + GDT_ENTRY_DEFAULT_USER_CS;
+
+	if (__compare_user_cs_desc(desc1, desc2)) {
+		/*
+		 * The CS was not in sync - reload it and retry the
+		 * instruction. If the instruction still faults then
+		 * we won't hit this branch next time around.
+		 */
+		load_user_cs_desc(cpu, current->mm);
+
+		return 1;
+	}
+
+	return 0;
+}
 #endif
 
 static void __kprobes
@@ -276,6 +337,20 @@
 	if (!user_mode(regs))
 		goto gp_in_kernel;
 
+#ifdef CONFIG_X86_32
+{
+	int cpu;
+	int ok;
+
+	cpu = get_cpu();
+	ok = check_lazy_exec_limit(cpu, regs, error_code);
+	put_cpu();
+
+	if (ok)
+		return;
+}
+#endif
+
 	tsk->thread.error_code = error_code;
 	tsk->thread.trap_no = 13;
 
@@ -892,11 +967,29 @@
 }
 
 #ifdef CONFIG_X86_32
+/*
+ * The fixup code for errors in iret jumps to here (iret_exc). It loses
+ * the original trap number and erorr code. The bogus trap 32 and error
+ * code 0 are what the vanilla kernel delivers via:
+ * DO_ERROR_INFO(32, SIGSEGV, "iret exception", iret_error, ILL_BADSTK, 0, 1)
+ *
+ * NOTE: Because of the final "1" in the macro we need to enable interrupts.
+ *
+ * In case of a general protection fault in the iret instruction, we
+ * need to check for a lazy CS update for exec-shield.
+ */
 dotraplinkage void do_iret_error(struct pt_regs *regs, long error_code)
 {
 	siginfo_t info;
+	int ok;
+	int cpu;
 	local_irq_enable();
 
+	cpu = get_cpu();
+	ok = check_lazy_exec_limit(cpu, regs, error_code);
+	put_cpu();
+	if (ok) return;
+
 	info.si_signo = SIGILL;
 	info.si_errno = 0;
 	info.si_code = ILL_BADSTK;
--- linux-rt-2.6.31.orig/arch/x86/kernel/pci-calgary_64.c
+++ linux-rt-2.6.31/arch/x86/kernel/pci-calgary_64.c
@@ -318,13 +318,15 @@
 
 	pdev = to_pci_dev(dev);
 
+	/* search up the device tree for an iommu */
 	pbus = pdev->bus;
-
-	/* is the device behind a bridge? Look for the root bus */
-	while (pbus->parent)
+	do {
+		tbl = pci_iommu(pbus);
+		if (tbl && tbl->it_busno == pbus->number)
+			break;
+		tbl = NULL;
 		pbus = pbus->parent;
-
-	tbl = pci_iommu(pbus);
+	} while (pbus);
 
 	BUG_ON(tbl && (tbl->it_busno != pbus->number));
 
--- linux-rt-2.6.31.orig/arch/x86/kernel/e820.c
+++ linux-rt-2.6.31/arch/x86/kernel/e820.c
@@ -1378,8 +1378,8 @@
 	if (mb < 16)
 		return 1024*1024;
 
-	/* To 32MB for anything above that */
-	return 32*1024*1024;
+	/* To 64MB for anything above that */
+	return 64*1024*1024;
 }
 
 #define MAX_RESOURCE_SIZE ((resource_size_t)-1)
--- linux-rt-2.6.31.orig/arch/x86/kernel/amd_iommu.c
+++ linux-rt-2.6.31/arch/x86/kernel/amd_iommu.c
@@ -485,8 +485,6 @@
 	int i;
 
 	for (i = 0; i <= amd_iommu_last_bdf; ++i) {
-		if (amd_iommu_pd_table[i] == NULL)
-			continue;
 
 		iommu = amd_iommu_rlookup_table[i];
 		if (!iommu)
@@ -1114,6 +1112,8 @@
 	amd_iommu_dev_table[devid].data[1] = 0;
 	amd_iommu_dev_table[devid].data[2] = 0;
 
+	amd_iommu_apply_erratum_63(devid);
+
 	/* decrease reference counter */
 	domain->dev_cnt -= 1;
 
@@ -1873,10 +1873,10 @@
 	struct pci_dev *dev = NULL;
 	struct dma_ops_domain *dma_dom;
 	struct amd_iommu *iommu;
-	u16 devid;
+	u16 devid, __devid;
 
 	while ((dev = pci_get_device(PCI_ANY_ID, PCI_ANY_ID, dev)) != NULL) {
-		devid = calc_devid(dev->bus->number, dev->devfn);
+		__devid = devid = calc_devid(dev->bus->number, dev->devfn);
 		if (devid > amd_iommu_last_bdf)
 			continue;
 		devid = amd_iommu_alias_table[devid];
@@ -1891,6 +1891,10 @@
 		init_unity_mappings_for_device(dma_dom, devid);
 		dma_dom->target_dev = devid;
 
+		attach_device(iommu, &dma_dom->domain, devid);
+		if (__devid != devid)
+			attach_device(iommu, &dma_dom->domain, __devid);
+
 		list_add_tail(&dma_dom->list, &iommu_pd_list);
 	}
 }
--- linux-rt-2.6.31.orig/arch/x86/kernel/alternative.c
+++ linux-rt-2.6.31/arch/x86/kernel/alternative.c
@@ -417,6 +417,8 @@
 
 void __init alternative_instructions(void)
 {
+	unsigned long flags;
+
 	/* The patching is not fully atomic, so try to avoid local interruptions
 	   that might execute the to be patched code.
 	   Other CPUs are not running. */
@@ -433,7 +435,9 @@
 	 * patching.
 	 */
 
+	local_irq_save(flags);
 	apply_alternatives(__alt_instructions, __alt_instructions_end);
+	local_irq_restore(flags);
 
 	/* switch to patch-once-at-boottime-only mode and free the
 	 * tables in case we know the number of CPUs will never ever
@@ -463,7 +467,9 @@
 			alternatives_smp_switch(0);
 	}
 #endif
+	local_irq_save(flags);
  	apply_paravirt(__parainstructions, __parainstructions_end);
+	local_irq_restore(flags);
 
 	if (smp_alt_once)
 		free_init_pages("SMP alternatives",
--- linux-rt-2.6.31.orig/arch/x86/kernel/ptrace.c
+++ linux-rt-2.6.31/arch/x86/kernel/ptrace.c
@@ -417,14 +417,14 @@
 {
 	if (kbuf) {
 		unsigned long *k = kbuf;
-		while (count > 0) {
+		while (count >= sizeof(*k)) {
 			*k++ = getreg(target, pos);
 			count -= sizeof(*k);
 			pos += sizeof(*k);
 		}
 	} else {
 		unsigned long __user *u = ubuf;
-		while (count > 0) {
+		while (count >= sizeof(*u)) {
 			if (__put_user(getreg(target, pos), u++))
 				return -EFAULT;
 			count -= sizeof(*u);
@@ -443,14 +443,14 @@
 	int ret = 0;
 	if (kbuf) {
 		const unsigned long *k = kbuf;
-		while (count > 0 && !ret) {
+		while (count >= sizeof(*k) && !ret) {
 			ret = putreg(target, pos, *k++);
 			count -= sizeof(*k);
 			pos += sizeof(*k);
 		}
 	} else {
 		const unsigned long  __user *u = ubuf;
-		while (count > 0 && !ret) {
+		while (count >= sizeof(*u) && !ret) {
 			unsigned long word;
 			ret = __get_user(word, u++);
 			if (ret)
@@ -1223,14 +1223,14 @@
 {
 	if (kbuf) {
 		compat_ulong_t *k = kbuf;
-		while (count > 0) {
+		while (count >= sizeof(*k)) {
 			getreg32(target, pos, k++);
 			count -= sizeof(*k);
 			pos += sizeof(*k);
 		}
 	} else {
 		compat_ulong_t __user *u = ubuf;
-		while (count > 0) {
+		while (count >= sizeof(*u)) {
 			compat_ulong_t word;
 			getreg32(target, pos, &word);
 			if (__put_user(word, u++))
@@ -1251,14 +1251,14 @@
 	int ret = 0;
 	if (kbuf) {
 		const compat_ulong_t *k = kbuf;
-		while (count > 0 && !ret) {
+		while (count >= sizeof(*k) && !ret) {
 			ret = putreg32(target, pos, *k++);
 			count -= sizeof(*k);
 			pos += sizeof(*k);
 		}
 	} else {
 		const compat_ulong_t __user *u = ubuf;
-		while (count > 0 && !ret) {
+		while (count >= sizeof(*u) && !ret) {
 			compat_ulong_t word;
 			ret = __get_user(word, u++);
 			if (ret)
--- linux-rt-2.6.31.orig/arch/x86/kernel/cpu/common.c
+++ linux-rt-2.6.31/arch/x86/kernel/cpu/common.c
@@ -799,6 +799,19 @@
 	/* Filter out anything that depends on CPUID levels we don't have */
 	filter_cpuid_features(c, true);
 
+#ifdef CONFIG_X86_32
+	/*
+	 *  emulation of NX with segment limits unfortunately means
+	 *  we have to disable the fast system calls, due to the way that
+	 *  sysexit clears the segment limits on return.
+	 *  If we have NX, then we don't need to do this.
+	 */
+#ifdef CONFIG_X86_PAE
+		if (!test_cpu_cap(c, X86_FEATURE_NX))
+#endif
+			clear_cpu_cap(c, X86_FEATURE_SEP);
+#endif /*CONFIG_X86_32*/
+
 	/* If the model name is still unset, do table lookup. */
 	if (!c->x86_model_id[0]) {
 		const char *p;
@@ -1043,7 +1056,7 @@
 #else	/* CONFIG_X86_64 */
 
 #ifdef CONFIG_CC_STACKPROTECTOR
-DEFINE_PER_CPU(unsigned long, stack_canary);
+DEFINE_PER_CPU(struct stack_canary, stack_canary) ____cacheline_aligned;
 #endif
 
 /* Make sure %fs and %gs are initialized properly in idle threads */
--- linux-rt-2.6.31.orig/arch/x86/kernel/cpu/intel_cacheinfo.c
+++ linux-rt-2.6.31/arch/x86/kernel/cpu/intel_cacheinfo.c
@@ -93,7 +93,7 @@
 	{ 0xd1, LVL_3,    1024 },	/* 4-way set assoc, 64 byte line size */
 	{ 0xd2, LVL_3,    2048 },	/* 4-way set assoc, 64 byte line size */
 	{ 0xd6, LVL_3,    1024 },	/* 8-way set assoc, 64 byte line size */
-	{ 0xd7, LVL_3,    2038 },	/* 8-way set assoc, 64 byte line size */
+	{ 0xd7, LVL_3,    2048 },	/* 8-way set assoc, 64 byte line size */
 	{ 0xd8, LVL_3,    4096 },	/* 12-way set assoc, 64 byte line size */
 	{ 0xdc, LVL_3,    2048 },	/* 12-way set assoc, 64 byte line size */
 	{ 0xdd, LVL_3,    4096 },	/* 12-way set assoc, 64 byte line size */
@@ -101,6 +101,9 @@
 	{ 0xe2, LVL_3,    2048 },	/* 16-way set assoc, 64 byte line size */
 	{ 0xe3, LVL_3,    4096 },	/* 16-way set assoc, 64 byte line size */
 	{ 0xe4, LVL_3,    8192 },	/* 16-way set assoc, 64 byte line size */
+	{ 0xea, LVL_3,    12288 },	/* 24-way set assoc, 64 byte line size */
+	{ 0xeb, LVL_3,    18432 },	/* 24-way set assoc, 64 byte line size */
+	{ 0xec, LVL_3,    24576 },	/* 24-way set assoc, 64 byte line size */
 	{ 0x00, 0, 0}
 };
 
--- linux-rt-2.6.31.orig/arch/x86/kernel/cpu/perfctr-watchdog.c
+++ linux-rt-2.6.31/arch/x86/kernel/cpu/perfctr-watchdog.c
@@ -711,7 +711,7 @@
 	switch (boot_cpu_data.x86_vendor) {
 	case X86_VENDOR_AMD:
 		if (boot_cpu_data.x86 != 6 && boot_cpu_data.x86 != 15 &&
-		    boot_cpu_data.x86 != 16)
+		    boot_cpu_data.x86 != 16 && boot_cpu_data.x86 != 17)
 			return;
 		wd_ops = &k7_wd_ops;
 		break;
--- linux-rt-2.6.31.orig/arch/x86/kernel/cpu/cpufreq/Makefile
+++ linux-rt-2.6.31/arch/x86/kernel/cpu/cpufreq/Makefile
@@ -18,3 +18,4 @@
 obj-$(CONFIG_X86_SPEEDSTEP_CENTRINO)	+= speedstep-centrino.o
 obj-$(CONFIG_X86_P4_CLOCKMOD)		+= p4-clockmod.o
 obj-$(CONFIG_X86_CPUFREQ_NFORCE2)	+= cpufreq-nforce2.o
+
--- linux-rt-2.6.31.orig/arch/x86/kernel/cpu/cpufreq/speedstep-ich.c
+++ linux-rt-2.6.31/arch/x86/kernel/cpu/cpufreq/speedstep-ich.c
@@ -232,28 +232,23 @@
 	return 0;
 }
 
-struct get_freq_data {
-	unsigned int speed;
-	unsigned int processor;
-};
-
-static void get_freq_data(void *_data)
+static void get_freq_data(void *_speed)
 {
-	struct get_freq_data *data = _data;
+	unsigned int *speed = _speed;
 
-	data->speed = speedstep_get_frequency(data->processor);
+	*speed = speedstep_get_frequency(speedstep_processor);
 }
 
 static unsigned int speedstep_get(unsigned int cpu)
 {
-	struct get_freq_data data = { .processor = cpu };
+	unsigned int speed;
 
 	/* You're supposed to ensure CPU is online. */
-	if (smp_call_function_single(cpu, get_freq_data, &data, 1) != 0)
+	if (smp_call_function_single(cpu, get_freq_data, &speed, 1) != 0)
 		BUG();
 
-	dprintk("detected %u kHz as current frequency\n", data.speed);
-	return data.speed;
+	dprintk("detected %u kHz as current frequency\n", speed);
+	return speed;
 }
 
 /**
--- linux-rt-2.6.31.orig/arch/x86/kernel/cpu/cpufreq/speedstep-centrino.c
+++ linux-rt-2.6.31/arch/x86/kernel/cpu/cpufreq/speedstep-centrino.c
@@ -45,6 +45,7 @@
 	CPU_DOTHAN_A1,
 	CPU_DOTHAN_A2,
 	CPU_DOTHAN_B0,
+	CPU_DOTHAN_C0,
 	CPU_MP4HT_D0,
 	CPU_MP4HT_E0,
 };
@@ -54,6 +55,7 @@
 	[CPU_DOTHAN_A1]	= { 6, 13, 1 },
 	[CPU_DOTHAN_A2]	= { 6, 13, 2 },
 	[CPU_DOTHAN_B0]	= { 6, 13, 6 },
+	[CPU_DOTHAN_C0]	= { 6, 13, 8 },
 	[CPU_MP4HT_D0]	= {15,  3, 4 },
 	[CPU_MP4HT_E0]	= {15,  4, 1 },
 };
@@ -196,6 +198,88 @@
 };
 #undef OP
 
+
+#define OPEX(mhz, base, mva, mvb, mvc, mvd)                     \
+{                                                               \
+        .frequency = (mhz) * 1000,                              \
+        .index = (((mhz)/(base)) << 8) | ((mva - 700) / 16)     \
+}
+
+/* Intel Pentium M processor 730 / 1.60 GHz (Sonoma) */
+static struct cpufreq_frequency_table sonoma_1596[] =
+{
+        OPEX( 798, 133,  988,  988,  988,  988),
+        OPEX(1064, 133, 1116, 1111, 1084, 1079),
+        OPEX(1330, 133, 1244, 1233, 1180, 1169),
+        OPEX(1596, 133, 1356, 1356, 1260, 1260),
+        { .frequency = CPUFREQ_TABLE_END }
+};
+
+/* Intel Pentium M processor 740 / 1.73 GHz (Sonoma) */
+static struct cpufreq_frequency_table sonoma_1729[] =
+{
+        OPEX( 798, 133,  988,  988,  988,  988),
+        OPEX(1064, 133, 1100, 1093, 1068, 1066),
+        OPEX(1330, 133, 1212, 1198, 1148, 1143),
+        OPEX(1729, 133, 1356, 1356, 1260, 1260),
+        { .frequency = CPUFREQ_TABLE_END }
+};
+
+/* Intel Pentium M processor 750 / 1.86 GHz (Sonoma) */
+static struct cpufreq_frequency_table sonoma_1862[] =
+{
+        OPEX( 798, 133,  988,  988,  988,  988),
+        OPEX(1064, 133, 1084, 1080, 1068, 1056),
+        OPEX(1330, 133, 1180, 1172, 1132, 1124),
+        OPEX(1596, 133, 1276, 1264, 1196, 1192),
+        OPEX(1862, 133, 1356, 1356, 1260, 1260),
+        { .frequency = CPUFREQ_TABLE_END }
+};
+
+/* Intel Pentium M processor 760 / 2.00 GHz (Sonoma) */
+static struct cpufreq_frequency_table sonoma_1995[] =
+{
+        OPEX( 798, 133, 988, 988, 988, 988),
+        OPEX(1064, 133, 1084, 1070, 1052, 1048),
+        OPEX(1330, 133, 1164, 1152, 1116, 1109),
+        OPEX(1596, 133, 1244, 1233, 1180, 1169),
+        OPEX(1995, 133, 1356, 1356, 1260, 1260),
+        { .frequency = CPUFREQ_TABLE_END }
+};
+/* Intel Pentium M processor 770 / 2.13 GHz (Sonoma) */
+static struct cpufreq_frequency_table sonoma_2128[] =
+{
+        OPEX( 798, 133, 988, 988, 988, 988),
+        OPEX(1064, 133, 1068, 1065, 1052, 1042),
+        OPEX(1330, 133, 1148, 1142, 1100, 1097),
+        OPEX(1596, 133, 1228, 1218, 1164, 1151),
+        OPEX(1862, 133, 1308, 1295, 1212, 1206),
+        OPEX(2128, 133, 1372, 1372, 1260, 1260),
+        { .frequency = CPUFREQ_TABLE_END }
+};
+
+/* Intel Pentium M processor 780 / 2.26 GHz (Sonoma) */
+static struct cpufreq_frequency_table sonoma_2261[] =
+{
+        OPEX( 798, 133, 988, 988, 988, 988),
+        OPEX(1064, 133, 1068, 1064, 1052, 1037),
+        OPEX(1330, 133, 1148, 1139, 1100, 1087),
+        OPEX(1596, 133, 1228, 1215, 1148, 1136),
+        OPEX(1862, 133, 1292, 1291, 1196, 1186),
+        OPEX(2261, 133, 1404, 1404, 1260, 1260),
+        { .frequency = CPUFREQ_TABLE_END }
+};
+
+#undef OPEX
+
+#define SONOMA(cpuid, max, base, name)  \
+{       .cpu_id         = cpuid,        \
+        .model_name     = "Intel(R) Pentium(R) M processor " name "GHz", \
+        .max_freq       = (max)*1000,   \
+        .op_points      = sonoma_##max, \
+}
+
+
 #define _BANIAS(cpuid, max, name)	\
 {	.cpu_id		= cpuid,	\
 	.model_name	= "Intel(R) Pentium(R) M processor " name "MHz", \
@@ -218,6 +302,15 @@
 	BANIAS(1600),
 	BANIAS(1700),
 
+        /* Builtin tables for Dothan C0 CPUs, a.k.a Sonoma */
+        SONOMA(&cpu_ids[CPU_DOTHAN_C0], 1596, 133, "1.60"),
+        SONOMA(&cpu_ids[CPU_DOTHAN_C0], 1729, 133, "1.73"),
+        SONOMA(&cpu_ids[CPU_DOTHAN_C0], 1862, 133, "1.86"),
+        SONOMA(&cpu_ids[CPU_DOTHAN_C0], 1995, 133, "2.00"),
+        SONOMA(&cpu_ids[CPU_DOTHAN_C0], 2128, 133, "2.13"),
+        SONOMA(&cpu_ids[CPU_DOTHAN_C0], 2261, 133, "2.26"),
+
+
 	/* NULL model_name is a wildcard */
 	{ &cpu_ids[CPU_DOTHAN_A1], NULL, 0, NULL },
 	{ &cpu_ids[CPU_DOTHAN_A2], NULL, 0, NULL },
--- linux-rt-2.6.31.orig/arch/x86/kernel/cpu/cpufreq/powernow-k8.c
+++ linux-rt-2.6.31/arch/x86/kernel/cpu/cpufreq/powernow-k8.c
@@ -605,9 +605,10 @@
 	return 0;
 }
 
-static void invalidate_entry(struct powernow_k8_data *data, unsigned int entry)
+static void invalidate_entry(struct cpufreq_frequency_table *powernow_table,
+		unsigned int entry)
 {
-	data->powernow_table[entry].frequency = CPUFREQ_ENTRY_INVALID;
+	powernow_table[entry].frequency = CPUFREQ_ENTRY_INVALID;
 }
 
 static void print_basics(struct powernow_k8_data *data)
@@ -914,13 +915,13 @@
 					"bad value %d.\n", i, index);
 			printk(KERN_ERR PFX "Please report to BIOS "
 					"manufacturer\n");
-			invalidate_entry(data, i);
+			invalidate_entry(powernow_table, i);
 			continue;
 		}
 		rdmsr(MSR_PSTATE_DEF_BASE + index, lo, hi);
 		if (!(hi & HW_PSTATE_VALID_MASK)) {
 			dprintk("invalid pstate %d, ignoring\n", index);
-			invalidate_entry(data, i);
+			invalidate_entry(powernow_table, i);
 			continue;
 		}
 
@@ -970,7 +971,7 @@
 		/* verify frequency is OK */
 		if ((freq > (MAX_FREQ * 1000)) || (freq < (MIN_FREQ * 1000))) {
 			dprintk("invalid freq %u kHz, ignoring\n", freq);
-			invalidate_entry(data, i);
+			invalidate_entry(powernow_table, i);
 			continue;
 		}
 
@@ -978,7 +979,7 @@
 		 * BIOSs are using "off" to indicate invalid */
 		if (vid == VID_OFF) {
 			dprintk("invalid vid %u, ignoring\n", vid);
-			invalidate_entry(data, i);
+			invalidate_entry(powernow_table, i);
 			continue;
 		}
 
@@ -997,7 +998,7 @@
 
 				dprintk("double low frequency table entry, "
 						"ignoring it.\n");
-				invalidate_entry(data, i);
+				invalidate_entry(powernow_table, i);
 				continue;
 			} else
 				cntlofreq = i;
@@ -1009,7 +1010,7 @@
 				(unsigned int)
 				(data->acpi_data.states[i].core_frequency
 				 * 1000));
-			invalidate_entry(data, i);
+			invalidate_entry(powernow_table, i);
 			continue;
 		}
 	}
--- linux-rt-2.6.31.orig/arch/x86/kernel/cpu/mcheck/mce.c
+++ linux-rt-2.6.31/arch/x86/kernel/cpu/mcheck/mce.c
@@ -1327,13 +1327,14 @@
 	struct timer_list *t = &__get_cpu_var(mce_timer);
 	int *n = &__get_cpu_var(next_interval);
 
+	setup_timer(t, mcheck_timer, smp_processor_id());
+
 	if (mce_ignore_ce)
 		return;
 
 	*n = check_interval * HZ;
 	if (!*n)
 		return;
-	setup_timer(t, mcheck_timer, smp_processor_id());
 	t->expires = round_jiffies(jiffies + *n);
 	add_timer_on(t, smp_processor_id());
 }
--- linux-rt-2.6.31.orig/arch/x86/kernel/cpu/mcheck/therm_throt.c
+++ linux-rt-2.6.31/arch/x86/kernel/cpu/mcheck/therm_throt.c
@@ -34,20 +34,33 @@
 /* How long to wait between reporting thermal events */
 #define CHECK_INTERVAL		(300 * HZ)
 
-static DEFINE_PER_CPU(__u64, next_check) = INITIAL_JIFFIES;
-static DEFINE_PER_CPU(unsigned long, thermal_throttle_count);
-static DEFINE_PER_CPU(bool, thermal_throttle_active);
+/*
+ * Current thermal throttling state:
+ */
+struct thermal_state {
+	bool			is_throttled;
+
+	u64			next_check;
+	unsigned long		throttle_count;
+	unsigned long		last_throttle_count;
+};
+
+static DEFINE_PER_CPU(struct thermal_state, thermal_state);
+
+static atomic_t therm_throt_en	= ATOMIC_INIT(0);
 
-static atomic_t therm_throt_en		= ATOMIC_INIT(0);
+static u32 lvtthmr_init __read_mostly;
 
 #ifdef CONFIG_SYSFS
 #define define_therm_throt_sysdev_one_ro(_name)				\
 	static SYSDEV_ATTR(_name, 0444, therm_throt_sysdev_show_##_name, NULL)
 
 #define define_therm_throt_sysdev_show_func(name)			\
-static ssize_t therm_throt_sysdev_show_##name(struct sys_device *dev,	\
-					struct sysdev_attribute *attr,	\
-					      char *buf)		\
+									\
+static ssize_t therm_throt_sysdev_show_##name(				\
+			struct sys_device *dev,				\
+			struct sysdev_attribute *attr,			\
+			char *buf)					\
 {									\
 	unsigned int cpu = dev->id;					\
 	ssize_t ret;							\
@@ -55,7 +68,7 @@
 	preempt_disable();	/* CPU hotplug */			\
 	if (cpu_online(cpu))						\
 		ret = sprintf(buf, "%lu\n",				\
-			      per_cpu(thermal_throttle_##name, cpu));	\
+			      per_cpu(thermal_state, cpu).name);	\
 	else								\
 		ret = 0;						\
 	preempt_enable();						\
@@ -63,11 +76,11 @@
 	return ret;							\
 }
 
-define_therm_throt_sysdev_show_func(count);
-define_therm_throt_sysdev_one_ro(count);
+define_therm_throt_sysdev_show_func(throttle_count);
+define_therm_throt_sysdev_one_ro(throttle_count);
 
 static struct attribute *thermal_throttle_attrs[] = {
-	&attr_count.attr,
+	&attr_throttle_count.attr,
 	NULL
 };
 
@@ -93,33 +106,39 @@
  *          1 : Event should be logged further, and a message has been
  *              printed to the syslog.
  */
-static int therm_throt_process(int curr)
+static int therm_throt_process(bool is_throttled)
 {
-	unsigned int cpu = smp_processor_id();
-	__u64 tmp_jiffs = get_jiffies_64();
-	bool was_throttled = __get_cpu_var(thermal_throttle_active);
-	bool is_throttled = __get_cpu_var(thermal_throttle_active) = curr;
+	struct thermal_state *state;
+	unsigned int this_cpu;
+	bool was_throttled;
+	u64 now;
+
+	this_cpu = smp_processor_id();
+	now = get_jiffies_64();
+	state = &per_cpu(thermal_state, this_cpu);
+
+	was_throttled = state->is_throttled;
+	state->is_throttled = is_throttled;
 
 	if (is_throttled)
-		__get_cpu_var(thermal_throttle_count)++;
+		state->throttle_count++;
 
-	if (!(was_throttled ^ is_throttled) &&
-	    time_before64(tmp_jiffs, __get_cpu_var(next_check)))
+	if (time_before64(now, state->next_check) &&
+			state->throttle_count != state->last_throttle_count)
 		return 0;
 
-	__get_cpu_var(next_check) = tmp_jiffs + CHECK_INTERVAL;
+	state->next_check = now + CHECK_INTERVAL;
+	state->last_throttle_count = state->throttle_count;
 
 	/* if we just entered the thermal event */
 	if (is_throttled) {
-		printk(KERN_CRIT "CPU%d: Temperature above threshold, "
-		       "cpu clock throttled (total events = %lu)\n",
-		       cpu, __get_cpu_var(thermal_throttle_count));
+		printk(KERN_CRIT "CPU%d: Temperature above threshold, cpu clock throttled (total events = %lu)\n", this_cpu, state->throttle_count);
 
 		add_taint(TAINT_MACHINE_CHECK);
 		return 1;
 	}
 	if (was_throttled) {
-		printk(KERN_INFO "CPU%d: Temperature/speed normal\n", cpu);
+		printk(KERN_INFO "CPU%d: Temperature/speed normal\n", this_cpu);
 		return 1;
 	}
 
@@ -213,7 +232,7 @@
 	__u64 msr_val;
 
 	rdmsrl(MSR_IA32_THERM_STATUS, msr_val);
-	if (therm_throt_process(msr_val & THERM_STATUS_PROCHOT))
+	if (therm_throt_process((msr_val & THERM_STATUS_PROCHOT) != 0))
 		mce_log_therm_throt_event(msr_val);
 }
 
@@ -237,6 +256,18 @@
 	ack_APIC_irq();
 }
 
+void __init mcheck_intel_therm_init(void)
+{
+	/*
+	 * This function is only called on boot CPU. Save the init thermal
+	 * LVT value on BSP and use that value to restore APs' thermal LVT
+	 * entry BIOS programmed later
+	 */
+	if (cpu_has(&boot_cpu_data, X86_FEATURE_ACPI) &&
+		cpu_has(&boot_cpu_data, X86_FEATURE_ACC))
+		lvtthmr_init = apic_read(APIC_LVTTHMR);
+}
+
 void intel_init_thermal(struct cpuinfo_x86 *c)
 {
 	unsigned int cpu = smp_processor_id();
@@ -253,7 +284,20 @@
 	 * since it might be delivered via SMI already:
 	 */
 	rdmsr(MSR_IA32_MISC_ENABLE, l, h);
-	h = apic_read(APIC_LVTTHMR);
+
+	/*
+	 * The initial value of thermal LVT entries on all APs always reads
+	 * 0x10000 because APs are woken up by BSP issuing INIT-SIPI-SIPI
+	 * sequence to them and LVT registers are reset to 0s except for
+	 * the mask bits which are set to 1s when APs receive INIT IPI.
+	 * Always restore the value that BIOS has programmed on AP based on
+	 * BSP's info we saved since BIOS is always setting the same value
+	 * for all threads/cores
+	 */
+	apic_write(APIC_LVTTHMR, lvtthmr_init);
+
+	h = lvtthmr_init;
+
 	if ((l & MSR_IA32_MISC_ENABLE_TM1) && (h & APIC_DM_SMI)) {
 		printk(KERN_DEBUG
 		       "CPU%d: Thermal monitoring handled by SMI\n", cpu);
--- linux-rt-2.6.31.orig/arch/x86/kernel/acpi/cstate.c
+++ linux-rt-2.6.31/arch/x86/kernel/acpi/cstate.c
@@ -48,7 +48,7 @@
 	 * P4, Core and beyond CPUs
 	 */
 	if (c->x86_vendor == X86_VENDOR_INTEL &&
-	    (c->x86 > 0x6 || (c->x86 == 6 && c->x86_model >= 14)))
+	    (c->x86 > 0xf || (c->x86 == 6 && c->x86_model >= 0x0f)))
 			flags->bm_control = 0;
 }
 EXPORT_SYMBOL(acpi_processor_power_init_bm_check);
--- linux-rt-2.6.31.orig/arch/x86/kernel/acpi/processor.c
+++ linux-rt-2.6.31/arch/x86/kernel/acpi/processor.c
@@ -79,7 +79,8 @@
 	struct cpuinfo_x86 *c = &cpu_data(pr->id);
 
 	pr->pdc = NULL;
-	if (c->x86_vendor == X86_VENDOR_INTEL)
+	if (c->x86_vendor == X86_VENDOR_INTEL ||
+	    c->x86_vendor == X86_VENDOR_CENTAUR)
 		init_intel_pdc(pr, c);
 
 	return;
--- linux-rt-2.6.31.orig/arch/x86/kernel/apic/x2apic_uv_x.c
+++ linux-rt-2.6.31/arch/x86/kernel/apic/x2apic_uv_x.c
@@ -352,14 +352,14 @@
 
 	for (i = 0; i < ARRAY_SIZE(redir_addrs); i++) {
 		alias.v = uv_read_local_mmr(redir_addrs[i].alias);
-		if (alias.s.base == 0) {
+		if (alias.s.enable && alias.s.base == 0) {
 			*size = (1UL << alias.s.m_alias);
 			redirect.v = uv_read_local_mmr(redir_addrs[i].redirect);
 			*base = (unsigned long)redirect.s.dest_base << DEST_SHIFT;
 			return;
 		}
 	}
-	BUG();
+	*base = *size = 0;
 }
 
 enum map_type {map_wb, map_uc};
@@ -609,12 +609,12 @@
 		uv_cpu_hub_info(cpu)->lowmem_remap_base = lowmem_redir_base;
 		uv_cpu_hub_info(cpu)->lowmem_remap_top = lowmem_redir_size;
 		uv_cpu_hub_info(cpu)->m_val = m_val;
-		uv_cpu_hub_info(cpu)->n_val = m_val;
+		uv_cpu_hub_info(cpu)->n_val = n_val;
 		uv_cpu_hub_info(cpu)->numa_blade_id = blade;
 		uv_cpu_hub_info(cpu)->blade_processor_id = lcpu;
 		uv_cpu_hub_info(cpu)->pnode = pnode;
 		uv_cpu_hub_info(cpu)->pnode_mask = pnode_mask;
-		uv_cpu_hub_info(cpu)->gpa_mask = (1 << (m_val + n_val)) - 1;
+		uv_cpu_hub_info(cpu)->gpa_mask = (1UL << (m_val + n_val)) - 1;
 		uv_cpu_hub_info(cpu)->gnode_upper = gnode_upper;
 		uv_cpu_hub_info(cpu)->gnode_extra = gnode_extra;
 		uv_cpu_hub_info(cpu)->global_mmr_base = mmr_base;
--- linux-rt-2.6.31.orig/arch/x86/kernel/apic/es7000_32.c
+++ linux-rt-2.6.31/arch/x86/kernel/apic/es7000_32.c
@@ -167,7 +167,7 @@
 {
 	/* MPENTIUMIII */
 	if (boot_cpu_data.x86 == 6 &&
-	    (boot_cpu_data.x86_model >= 7 || boot_cpu_data.x86_model <= 11))
+	    (boot_cpu_data.x86_model >= 7 && boot_cpu_data.x86_model <= 11))
 		return 1;
 
 	return 0;
--- linux-rt-2.6.31.orig/arch/x86/vdso/vdso32-setup.c
+++ linux-rt-2.6.31/arch/x86/vdso/vdso32-setup.c
@@ -331,7 +331,7 @@
 	if (compat)
 		addr = VDSO_HIGH_BASE;
 	else {
-		addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, 0);
+		addr = get_unmapped_area_prot(NULL, 0, PAGE_SIZE, 0, 0, 1);
 		if (IS_ERR_VALUE(addr)) {
 			ret = addr;
 			goto up_fail;
--- linux-rt-2.6.31.orig/arch/x86/kvm/i8254.c
+++ linux-rt-2.6.31/arch/x86/kvm/i8254.c
@@ -116,7 +116,7 @@
 	 * itself with the initial count and continues counting
 	 * from there.
 	 */
-	remaining = hrtimer_expires_remaining(&ps->pit_timer.timer);
+	remaining = hrtimer_get_remaining(&ps->pit_timer.timer);
 	elapsed = ps->pit_timer.period - ktime_to_ns(remaining);
 	elapsed = mod_64(elapsed, ps->pit_timer.period);
 
@@ -433,6 +433,9 @@
 	struct kvm_kpit_channel_state *s;
 
 	addr &= KVM_PIT_CHANNEL_MASK;
+	if (addr == 3)
+		return;
+
 	s = &pit_state->channels[addr];
 
 	mutex_lock(&pit_state->lock);
--- linux-rt-2.6.31.orig/arch/x86/kvm/lapic.c
+++ linux-rt-2.6.31/arch/x86/kvm/lapic.c
@@ -464,7 +464,7 @@
 	if (apic_get_reg(apic, APIC_TMICT) == 0)
 		return 0;
 
-	remaining = hrtimer_expires_remaining(&apic->lapic_timer.timer);
+	remaining = hrtimer_get_remaining(&apic->lapic_timer.timer);
 	if (ktime_to_ns(remaining) < 0)
 		remaining = ktime_set(0, 0);
 
@@ -567,12 +567,21 @@
 {
 	ktime_t now = apic->lapic_timer.timer.base->get_time();
 
-	apic->lapic_timer.period = apic_get_reg(apic, APIC_TMICT) *
+	apic->lapic_timer.period = (u64)apic_get_reg(apic, APIC_TMICT) *
 		    APIC_BUS_CYCLE_NS * apic->divide_count;
 	atomic_set(&apic->lapic_timer.pending, 0);
 
 	if (!apic->lapic_timer.period)
 		return;
+	/*
+	 * Do not allow the guest to program periodic timers with small
+	 * interval, since the hrtimers are not throttled by the host
+	 * scheduler.
+	 */
+	if (apic_lvtt_period(apic)) {
+		if (apic->lapic_timer.period < NSEC_PER_MSEC/2)
+			apic->lapic_timer.period = NSEC_PER_MSEC/2;
+	}
 
 	hrtimer_start(&apic->lapic_timer.timer,
 		      ktime_add_ns(now, apic->lapic_timer.period),
--- linux-rt-2.6.31.orig/arch/x86/kvm/mmu.c
+++ linux-rt-2.6.31/arch/x86/kvm/mmu.c
@@ -2633,7 +2633,8 @@
 
 void __kvm_mmu_free_some_pages(struct kvm_vcpu *vcpu)
 {
-	while (vcpu->kvm->arch.n_free_mmu_pages < KVM_REFILL_PAGES) {
+	while (vcpu->kvm->arch.n_free_mmu_pages < KVM_REFILL_PAGES &&
+	       !list_empty(&vcpu->kvm->arch.active_mmu_pages)) {
 		struct kvm_mmu_page *sp;
 
 		sp = container_of(vcpu->kvm->arch.active_mmu_pages.prev,
@@ -2712,12 +2713,6 @@
 
 	ASSERT(vcpu);
 
-	if (vcpu->kvm->arch.n_requested_mmu_pages)
-		vcpu->kvm->arch.n_free_mmu_pages =
-					vcpu->kvm->arch.n_requested_mmu_pages;
-	else
-		vcpu->kvm->arch.n_free_mmu_pages =
-					vcpu->kvm->arch.n_alloc_mmu_pages;
 	/*
 	 * When emulating 32-bit mode, cr3 is only 32 bits even on x86_64.
 	 * Therefore we need to allocate shadow page tables in the first
--- linux-rt-2.6.31.orig/arch/x86/kvm/x86_emulate.c
+++ linux-rt-2.6.31/arch/x86/kvm/x86_emulate.c
@@ -60,6 +60,7 @@
 #define SrcImmByte  (6<<4)	/* 8-bit sign-extended immediate operand. */
 #define SrcOne      (7<<4)	/* Implied '1' */
 #define SrcImmUByte (8<<4)      /* 8-bit unsigned immediate operand. */
+#define SrcImmU     (9<<4)      /* Immediate operand, unsigned */
 #define SrcMask     (0xf<<4)
 /* Generic ModRM decode. */
 #define ModRM       (1<<8)
@@ -195,7 +196,7 @@
 	ByteOp | SrcImmUByte, SrcImmUByte,
 	/* 0xE8 - 0xEF */
 	SrcImm | Stack, SrcImm | ImplicitOps,
-	SrcImm | Src2Imm16, SrcImmByte | ImplicitOps,
+	SrcImmU | Src2Imm16, SrcImmByte | ImplicitOps,
 	SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps,
 	SrcNone | ByteOp | ImplicitOps, SrcNone | ImplicitOps,
 	/* 0xF0 - 0xF7 */
@@ -605,6 +606,9 @@
 {
 	int rc = 0;
 
+	/* x86 instructions are limited to 15 bytes. */
+	if (eip + size - ctxt->decode.eip_orig > 15)
+		return X86EMUL_UNHANDLEABLE;
 	eip += ctxt->cs_base;
 	while (size--) {
 		rc = do_fetch_insn_byte(ctxt, ops, eip++, dest++);
@@ -863,7 +867,7 @@
 	/* Shadow copy of register state. Committed on successful emulation. */
 
 	memset(c, 0, sizeof(struct decode_cache));
-	c->eip = kvm_rip_read(ctxt->vcpu);
+	c->eip = c->eip_orig = kvm_rip_read(ctxt->vcpu);
 	ctxt->cs_base = seg_base(ctxt, VCPU_SREG_CS);
 	memcpy(c->regs, ctxt->vcpu->arch.regs, sizeof c->regs);
 
@@ -1027,6 +1031,7 @@
 		c->src.type = OP_MEM;
 		break;
 	case SrcImm:
+	case SrcImmU:
 		c->src.type = OP_IMM;
 		c->src.ptr = (unsigned long *)c->eip;
 		c->src.bytes = (c->d & ByteOp) ? 1 : c->op_bytes;
@@ -1044,6 +1049,19 @@
 			c->src.val = insn_fetch(s32, 4, c->eip);
 			break;
 		}
+		if ((c->d & SrcMask) == SrcImmU) {
+			switch (c->src.bytes) {
+			case 1:
+				c->src.val &= 0xff;
+				break;
+			case 2:
+				c->src.val &= 0xffff;
+				break;
+			case 4:
+				c->src.val &= 0xffffffff;
+				break;
+			}
+		}
 		break;
 	case SrcImmByte:
 	case SrcImmUByte:
--- linux-rt-2.6.31.orig/arch/x86/kvm/svm.c
+++ linux-rt-2.6.31/arch/x86/kvm/svm.c
@@ -709,6 +709,8 @@
 		rdtscll(tsc_this);
 		delta = vcpu->arch.host_tsc - tsc_this;
 		svm->vmcb->control.tsc_offset += delta;
+		if (is_nested(svm))
+			svm->hsave->control.tsc_offset += delta;
 		vcpu->cpu = cpu;
 		kvm_migrate_timers(vcpu);
 		svm->asid_generation = 0;
@@ -1954,10 +1956,14 @@
 
 	switch (ecx) {
 	case MSR_IA32_TIME_STAMP_COUNTER: {
-		u64 tsc;
+		u64 tsc_offset;
 
-		rdtscll(tsc);
-		*data = svm->vmcb->control.tsc_offset + tsc;
+		if (is_nested(svm))
+			tsc_offset = svm->hsave->control.tsc_offset;
+		else
+			tsc_offset = svm->vmcb->control.tsc_offset;
+
+		*data = tsc_offset + native_read_tsc();
 		break;
 	}
 	case MSR_K6_STAR:
@@ -2044,10 +2050,17 @@
 
 	switch (ecx) {
 	case MSR_IA32_TIME_STAMP_COUNTER: {
-		u64 tsc;
+		u64 tsc_offset = data - native_read_tsc();
+		u64 g_tsc_offset = 0;
+
+		if (is_nested(svm)) {
+			g_tsc_offset = svm->vmcb->control.tsc_offset -
+				       svm->hsave->control.tsc_offset;
+			svm->hsave->control.tsc_offset = tsc_offset;
+		}
+
+		svm->vmcb->control.tsc_offset = tsc_offset + g_tsc_offset;
 
-		rdtscll(tsc);
-		svm->vmcb->control.tsc_offset = data - tsc;
 		break;
 	}
 	case MSR_K6_STAR:
--- linux-rt-2.6.31.orig/arch/x86/kvm/vmx.c
+++ linux-rt-2.6.31/arch/x86/kvm/vmx.c
@@ -661,7 +661,7 @@
 	if (vcpu->cpu != cpu) {
 		vcpu_clear(vmx);
 		kvm_migrate_timers(vcpu);
-		vpid_sync_vcpu_all(vmx);
+		set_bit(KVM_REQ_TLB_FLUSH, &vcpu->requests);
 		local_irq_disable();
 		list_add(&vmx->local_vcpus_link,
 			 &per_cpu(vcpus_on_cpu, cpu));
@@ -1217,12 +1217,9 @@
 	if (_cpu_based_2nd_exec_control & SECONDARY_EXEC_ENABLE_EPT) {
 		/* CR3 accesses and invlpg don't need to cause VM Exits when EPT
 		   enabled */
-		min &= ~(CPU_BASED_CR3_LOAD_EXITING |
-			 CPU_BASED_CR3_STORE_EXITING |
-			 CPU_BASED_INVLPG_EXITING);
-		if (adjust_vmx_controls(min, opt, MSR_IA32_VMX_PROCBASED_CTLS,
-					&_cpu_based_exec_control) < 0)
-			return -EIO;
+		_cpu_based_exec_control &= ~(CPU_BASED_CR3_LOAD_EXITING |
+					     CPU_BASED_CR3_STORE_EXITING |
+					     CPU_BASED_INVLPG_EXITING);
 		rdmsr(MSR_IA32_VMX_EPT_VPID_CAP,
 		      vmx_capability.ept, vmx_capability.vpid);
 	}
@@ -1572,7 +1569,6 @@
 		vcpu->arch.cr0 = cr0;
 		vmx_set_cr4(vcpu, vcpu->arch.cr4);
 		*hw_cr0 |= X86_CR0_PE | X86_CR0_PG;
-		*hw_cr0 &= ~X86_CR0_WP;
 	} else if (!is_paging(vcpu)) {
 		/* From nonpaging to paging */
 		vmcs_write32(CPU_BASED_VM_EXEC_CONTROL,
@@ -1581,9 +1577,10 @@
 			       CPU_BASED_CR3_STORE_EXITING));
 		vcpu->arch.cr0 = cr0;
 		vmx_set_cr4(vcpu, vcpu->arch.cr4);
-		if (!(vcpu->arch.cr0 & X86_CR0_WP))
-			*hw_cr0 &= ~X86_CR0_WP;
 	}
+
+	if (!(cr0 & X86_CR0_WP))
+		*hw_cr0 &= ~X86_CR0_WP;
 }
 
 static void ept_update_paging_mode_cr4(unsigned long *hw_cr4,
@@ -2841,6 +2838,8 @@
 	unsigned long val;
 	int dr, reg;
 
+	if (!kvm_require_cpl(vcpu, 0))
+		return 1;
 	dr = vmcs_readl(GUEST_DR7);
 	if (dr & DR7_GD) {
 		/*
--- linux-rt-2.6.31.orig/arch/x86/kvm/x86.c
+++ linux-rt-2.6.31/arch/x86/kvm/x86.c
@@ -215,6 +215,19 @@
 }
 
 /*
+ * Checks if cpl <= required_cpl; if true, return true.  Otherwise queue
+ * a #GP and return false.
+ */
+bool kvm_require_cpl(struct kvm_vcpu *vcpu, int required_cpl)
+{
+	if (kvm_x86_ops->get_cpl(vcpu) <= required_cpl)
+		return true;
+	kvm_queue_exception_e(vcpu, GP_VECTOR, 0);
+	return false;
+}
+EXPORT_SYMBOL_GPL(kvm_require_cpl);
+
+/*
  * Load the pae pdptrs.  Return true is they are all valid.
  */
 int load_pdptrs(struct kvm_vcpu *vcpu, unsigned long cr3)
@@ -936,6 +949,7 @@
 	case MSR_P6_EVNTSEL0:
 	case MSR_P6_EVNTSEL1:
 	case MSR_K7_EVNTSEL0:
+	case MSR_K8_INT_PENDING_MSG:
 		data = 0;
 		break;
 	case MSR_MTRRcap:
@@ -1416,6 +1430,8 @@
 
 	if (cpuid->nent < 1)
 		goto out;
+	if (cpuid->nent > KVM_MAX_CPUID_ENTRIES)
+		cpuid->nent = KVM_MAX_CPUID_ENTRIES;
 	r = -ENOMEM;
 	cpuid_entries = vmalloc(sizeof(struct kvm_cpuid_entry2) * cpuid->nent);
 	if (!cpuid_entries)
@@ -1435,6 +1451,10 @@
 	for (func = 0x80000001; func <= limit && nent < cpuid->nent; ++func)
 		do_cpuid_ent(&cpuid_entries[nent], func, 0,
 			     &nent, cpuid->nent);
+	r = -E2BIG;
+	if (nent >= cpuid->nent)
+		goto out_free;
+
 	r = -EFAULT;
 	if (copy_to_user(entries, cpuid_entries,
 			 nent * sizeof(struct kvm_cpuid_entry2)))
@@ -2898,6 +2918,11 @@
 		a3 &= 0xFFFFFFFF;
 	}
 
+	if (kvm_x86_ops->get_cpl(vcpu) != 0) {
+		ret = -KVM_EPERM;
+		goto out;
+	}
+
 	switch (nr) {
 	case KVM_HC_VAPIC_POLL_IRQ:
 		ret = 0;
@@ -2909,6 +2934,7 @@
 		ret = -KVM_ENOSYS;
 		break;
 	}
+out:
 	kvm_register_write(vcpu, VCPU_REGS_RAX, ret);
 	++vcpu->stat.hypercalls;
 	return r;
@@ -3179,6 +3205,9 @@
 	if (!kvm_x86_ops->update_cr8_intercept)
 		return;
 
+	if (!vcpu->arch.apic)
+		return;
+
 	if (!vcpu->arch.apic->vapic_addr)
 		max_irr = kvm_lapic_find_highest_irr(vcpu);
 	else
@@ -3733,7 +3762,7 @@
 	return kvm_write_guest(vcpu->kvm, gpa, seg_desc, 8);
 }
 
-static u32 get_tss_base_addr(struct kvm_vcpu *vcpu,
+static gpa_t get_tss_base_addr(struct kvm_vcpu *vcpu,
 			     struct desc_struct *seg_desc)
 {
 	u32 base_addr;
@@ -4099,13 +4128,7 @@
 
 	vcpu->arch.cr2 = sregs->cr2;
 	mmu_reset_needed |= vcpu->arch.cr3 != sregs->cr3;
-
-	down_read(&vcpu->kvm->slots_lock);
-	if (gfn_to_memslot(vcpu->kvm, sregs->cr3 >> PAGE_SHIFT))
-		vcpu->arch.cr3 = sregs->cr3;
-	else
-		set_bit(KVM_REQ_TRIPLE_FAULT, &vcpu->requests);
-	up_read(&vcpu->kvm->slots_lock);
+	vcpu->arch.cr3 = sregs->cr3;
 
 	kvm_set_cr8(vcpu, sregs->cr8);
 
--- linux-rt-2.6.31.orig/arch/x86/xen/Makefile
+++ linux-rt-2.6.31/arch/x86/xen/Makefile
@@ -8,6 +8,7 @@
 # Make sure early boot has no stackprotector
 nostackp := $(call cc-option, -fno-stack-protector)
 CFLAGS_enlighten.o		:= $(nostackp)
+CFLAGS_mmu.o			:= $(nostackp)
 
 obj-y		:= enlighten.o setup.o multicalls.o mmu.o irq.o \
 			time.o xen-asm.o xen-asm_$(BITS).o \
@@ -16,3 +17,4 @@
 obj-$(CONFIG_SMP)		+= smp.o
 obj-$(CONFIG_PARAVIRT_SPINLOCKS)+= spinlock.o
 obj-$(CONFIG_XEN_DEBUG_FS)	+= debugfs.o
+
--- linux-rt-2.6.31.orig/arch/x86/xen/smp.c
+++ linux-rt-2.6.31/arch/x86/xen/smp.c
@@ -236,6 +236,7 @@
 	ctxt->user_regs.ss = __KERNEL_DS;
 #ifdef CONFIG_X86_32
 	ctxt->user_regs.fs = __KERNEL_PERCPU;
+	ctxt->user_regs.gs = __KERNEL_STACK_CANARY;
 #else
 	ctxt->gs_base_kernel = per_cpu_offset(cpu);
 #endif
--- linux-rt-2.6.31.orig/arch/x86/xen/enlighten.c
+++ linux-rt-2.6.31/arch/x86/xen/enlighten.c
@@ -51,6 +51,7 @@
 #include <asm/pgtable.h>
 #include <asm/tlbflush.h>
 #include <asm/reboot.h>
+#include <asm/stackprotector.h>
 
 #include "xen-ops.h"
 #include "mmu.h"
@@ -177,6 +178,7 @@
 static void xen_cpuid(unsigned int *ax, unsigned int *bx,
 		      unsigned int *cx, unsigned int *dx)
 {
+	unsigned maskebx = ~0;
 	unsigned maskecx = ~0;
 	unsigned maskedx = ~0;
 
@@ -184,9 +186,16 @@
 	 * Mask out inconvenient features, to try and disable as many
 	 * unsupported kernel subsystems as possible.
 	 */
-	if (*ax == 1) {
+	switch (*ax) {
+	case 1:
 		maskecx = cpuid_leaf1_ecx_mask;
 		maskedx = cpuid_leaf1_edx_mask;
+		break;
+
+	case 0xb:
+		/* Suppress extended topology stuff */
+		maskebx = 0;
+		break;
 	}
 
 	asm(XEN_EMULATE_PREFIX "cpuid"
@@ -196,6 +205,7 @@
 		  "=d" (*dx)
 		: "0" (*ax), "2" (*cx));
 
+	*bx &= maskebx;
 	*cx &= maskecx;
 	*dx &= maskedx;
 }
@@ -322,6 +332,24 @@
 	xen_mc_issue(PARAVIRT_LAZY_CPU);
 }
 
+#ifdef CONFIG_X86_32
+static void xen_load_user_cs_desc(int cpu, struct mm_struct *mm)
+{
+	void *gdt;
+	xmaddr_t mgdt;
+	u64 descriptor;
+	struct desc_struct user_cs;
+
+	gdt = &get_cpu_gdt_table(cpu)[GDT_ENTRY_DEFAULT_USER_CS];
+	mgdt = virt_to_machine(gdt);
+
+	user_cs = mm->context.user_cs;
+	descriptor = (u64) user_cs.a | ((u64) user_cs.b) << 32;
+
+	HYPERVISOR_update_descriptor(mgdt.maddr, descriptor);
+}
+#endif /*CONFIG_X86_32*/
+
 static void xen_load_gdt(const struct desc_ptr *dtr)
 {
 	unsigned long va = dtr->address;
@@ -330,18 +358,28 @@
 	unsigned long frames[pages];
 	int f;
 
-	/* A GDT can be up to 64k in size, which corresponds to 8192
-	   8-byte entries, or 16 4k pages.. */
+	/*
+	 * A GDT can be up to 64k in size, which corresponds to 8192
+	 * 8-byte entries, or 16 4k pages..
+	 */
 
 	BUG_ON(size > 65536);
 	BUG_ON(va & ~PAGE_MASK);
 
 	for (f = 0; va < dtr->address + size; va += PAGE_SIZE, f++) {
 		int level;
-		pte_t *ptep = lookup_address(va, &level);
+		pte_t *ptep;
 		unsigned long pfn, mfn;
 		void *virt;
 
+		/*
+		 * The GDT is per-cpu and is in the percpu data area.
+		 * That can be virtually mapped, so we need to do a
+		 * page-walk to get the underlying MFN for the
+		 * hypercall.  The page can also be in the kernel's
+		 * linear range, so we need to RO that mapping too.
+		 */
+		ptep = lookup_address(va, &level);
 		BUG_ON(ptep == NULL);
 
 		pfn = pte_pfn(*ptep);
@@ -358,6 +396,44 @@
 		BUG();
 }
 
+/*
+ * load_gdt for early boot, when the gdt is only mapped once
+ */
+static __init void xen_load_gdt_boot(const struct desc_ptr *dtr)
+{
+	unsigned long va = dtr->address;
+	unsigned int size = dtr->size + 1;
+	unsigned pages = (size + PAGE_SIZE - 1) / PAGE_SIZE;
+	unsigned long frames[pages];
+	int f;
+
+	/*
+	 * A GDT can be up to 64k in size, which corresponds to 8192
+	 * 8-byte entries, or 16 4k pages..
+	 */
+
+	BUG_ON(size > 65536);
+	BUG_ON(va & ~PAGE_MASK);
+
+	for (f = 0; va < dtr->address + size; va += PAGE_SIZE, f++) {
+		pte_t pte;
+		unsigned long pfn, mfn;
+
+		pfn = virt_to_pfn(va);
+		mfn = pfn_to_mfn(pfn);
+
+		pte = pfn_pte(pfn, PAGE_KERNEL_RO);
+
+		if (HYPERVISOR_update_va_mapping((unsigned long)va, pte, 0))
+			BUG();
+
+		frames[f] = mfn;
+	}
+
+	if (HYPERVISOR_set_gdt(frames, size / sizeof(struct desc_struct)))
+		BUG();
+}
+
 static void load_TLS_descriptor(struct thread_struct *t,
 				unsigned int cpu, unsigned int i)
 {
@@ -581,6 +657,29 @@
 	preempt_enable();
 }
 
+/*
+ * Version of write_gdt_entry for use at early boot-time needed to
+ * update an entry as simply as possible.
+ */
+static __init void xen_write_gdt_entry_boot(struct desc_struct *dt, int entry,
+					    const void *desc, int type)
+{
+	switch (type) {
+	case DESC_LDT:
+	case DESC_TSS:
+		/* ignore */
+		break;
+
+	default: {
+		xmaddr_t maddr = virt_to_machine(&dt[entry]);
+
+		if (HYPERVISOR_update_descriptor(maddr.maddr, *(u64 *)desc))
+			dt[entry] = *(struct desc_struct *)desc;
+	}
+
+	}
+}
+
 static void xen_load_sp0(struct tss_struct *tss,
 			 struct thread_struct *thread)
 {
@@ -887,6 +986,9 @@
 
 	.load_tr_desc = paravirt_nop,
 	.set_ldt = xen_set_ldt,
+#ifdef CONFIG_X86_32
+	.load_user_cs_desc = xen_load_user_cs_desc,
+#endif /*CONFIG_X86_32*/
 	.load_gdt = xen_load_gdt,
 	.load_idt = xen_load_idt,
 	.load_tls = xen_load_tls,
@@ -965,6 +1067,23 @@
 	.emergency_restart = xen_emergency_restart,
 };
 
+/*
+ * Set up the GDT and segment registers for -fstack-protector.  Until
+ * we do this, we have to be careful not to call any stack-protected
+ * function, which is most of the kernel.
+ */
+static void __init xen_setup_stackprotector(void)
+{
+	pv_cpu_ops.write_gdt_entry = xen_write_gdt_entry_boot;
+	pv_cpu_ops.load_gdt = xen_load_gdt_boot;
+
+	setup_stack_canary_segment(0);
+	switch_to_new_gdt(0);
+
+	pv_cpu_ops.write_gdt_entry = xen_write_gdt_entry;
+	pv_cpu_ops.load_gdt = xen_load_gdt;
+}
+
 /* First C function to be called on Xen boot */
 asmlinkage void __init xen_start_kernel(void)
 {
@@ -983,14 +1102,34 @@
 	pv_apic_ops = xen_apic_ops;
 	pv_mmu_ops = xen_mmu_ops;
 
-#ifdef CONFIG_X86_64
 	/*
-	 * Setup percpu state.  We only need to do this for 64-bit
-	 * because 32-bit already has %fs set properly.
+	 * Set up some pagetable state before starting to set any ptes.
 	 */
-	load_percpu_segment(0);
+
+	/* Prevent unwanted bits from being set in PTEs. */
+	__supported_pte_mask &= ~_PAGE_GLOBAL;
+	if (!xen_initial_domain())
+		__supported_pte_mask &= ~(_PAGE_PWT | _PAGE_PCD);
+
+	__supported_pte_mask |= _PAGE_IOMAP;
+
+#ifdef CONFIG_X86_64
+	/* Work out if we support NX */
+	check_efer();
 #endif
 
+	xen_setup_features();
+
+	/* Get mfn list */
+	if (!xen_feature(XENFEAT_auto_translated_physmap))
+		xen_build_dynamic_phys_to_machine();
+
+	/*
+	 * Set up kernel GDT and segment registers, mainly so that
+	 * -fstack-protector code can be executed.
+	 */
+	xen_setup_stackprotector();
+
 	xen_init_irq_ops();
 	xen_init_cpuid_mask();
 
@@ -1001,8 +1140,6 @@
 	set_xen_basic_apic_ops();
 #endif
 
-	xen_setup_features();
-
 	if (xen_feature(XENFEAT_mmu_pt_update_preserve_ad)) {
 		pv_mmu_ops.ptep_modify_prot_start = xen_ptep_modify_prot_start;
 		pv_mmu_ops.ptep_modify_prot_commit = xen_ptep_modify_prot_commit;
@@ -1019,22 +1156,8 @@
 
 	xen_smp_init();
 
-	/* Get mfn list */
-	if (!xen_feature(XENFEAT_auto_translated_physmap))
-		xen_build_dynamic_phys_to_machine();
-
 	pgd = (pgd_t *)xen_start_info->pt_base;
 
-	/* Prevent unwanted bits from being set in PTEs. */
-	__supported_pte_mask &= ~_PAGE_GLOBAL;
-	if (!xen_initial_domain())
-		__supported_pte_mask &= ~(_PAGE_PWT | _PAGE_PCD);
-
-#ifdef CONFIG_X86_64
-	/* Work out if we support NX */
-	check_efer();
-#endif
-
 	/* Don't do the full vcpu_info placement stuff until we have a
 	   possible map and a non-dummy shared_info. */
 	per_cpu(xen_vcpu, 0) = &HYPERVISOR_shared_info->vcpu_info[0];
--- linux-rt-2.6.31.orig/arch/x86/xen/spinlock.c
+++ linux-rt-2.6.31/arch/x86/xen/spinlock.c
@@ -187,7 +187,6 @@
 	struct xen_spinlock *prev;
 	int irq = __get_cpu_var(lock_kicker_irq);
 	int ret;
-	unsigned long flags;
 	u64 start;
 
 	/* If kicker interrupts not initialized yet, just spin */
@@ -199,16 +198,12 @@
 	/* announce we're spinning */
 	prev = spinning_lock(xl);
 
-	flags = __raw_local_save_flags();
-	if (irq_enable) {
-		ADD_STATS(taken_slow_irqenable, 1);
-		raw_local_irq_enable();
-	}
-
 	ADD_STATS(taken_slow, 1);
 	ADD_STATS(taken_slow_nested, prev != NULL);
 
 	do {
+		unsigned long flags;
+
 		/* clear pending */
 		xen_clear_irq_pending(irq);
 
@@ -228,6 +223,12 @@
 			goto out;
 		}
 
+		flags = __raw_local_save_flags();
+		if (irq_enable) {
+			ADD_STATS(taken_slow_irqenable, 1);
+			raw_local_irq_enable();
+		}
+
 		/*
 		 * Block until irq becomes pending.  If we're
 		 * interrupted at this point (after the trylock but
@@ -238,13 +239,15 @@
 		 * pending.
 		 */
 		xen_poll_irq(irq);
+
+		raw_local_irq_restore(flags);
+
 		ADD_STATS(taken_slow_spurious, !xen_test_irq_pending(irq));
 	} while (!xen_test_irq_pending(irq)); /* check for spurious wakeups */
 
 	kstat_incr_irqs_this_cpu(irq, irq_to_desc(irq));
 
 out:
-	raw_local_irq_restore(flags);
 	unspinning_lock(xl, prev);
 	spin_time_accum_blocked(start);
 
@@ -323,8 +326,13 @@
 	smp_wmb();		/* make sure no writes get moved after unlock */
 	xl->lock = 0;		/* release lock */
 
-	/* make sure unlock happens before kick */
-	barrier();
+	/*
+	 * Make sure unlock happens before checking for waiting
+	 * spinners.  We need a strong barrier to enforce the
+	 * write-read ordering to different memory locations, as the
+	 * CPU makes no implied guarantees about their ordering.
+	 */
+	mb();
 
 	if (unlikely(xl->spinners))
 		xen_spin_unlock_slow(xl);
--- linux-rt-2.6.31.orig/arch/xtensa/include/asm/unistd.h
+++ linux-rt-2.6.31/arch/xtensa/include/asm/unistd.h
@@ -189,7 +189,7 @@
 /* File Map / Shared Memory Operations */
 
 #define __NR_mmap2 				 80
-__SYSCALL( 80, xtensa_mmap2, 6)
+__SYSCALL( 80, sys_mmap_pgoff, 6)
 #define __NR_munmap 				 81
 __SYSCALL( 81, sys_munmap, 2)
 #define __NR_mprotect 				 82
--- linux-rt-2.6.31.orig/arch/xtensa/include/asm/syscall.h
+++ linux-rt-2.6.31/arch/xtensa/include/asm/syscall.h
@@ -13,8 +13,6 @@
 asmlinkage long xtensa_execve(char*, char**, char**, struct pt_regs*);
 asmlinkage long xtensa_clone(unsigned long, unsigned long, struct pt_regs*);
 asmlinkage long xtensa_pipe(int __user *);
-asmlinkage long xtensa_mmap2(unsigned long, unsigned long, unsigned long,
-    			     unsigned long, unsigned long, unsigned long);
 asmlinkage long xtensa_ptrace(long, long, long, long);
 asmlinkage long xtensa_sigreturn(struct pt_regs*);
 asmlinkage long xtensa_rt_sigreturn(struct pt_regs*);
--- linux-rt-2.6.31.orig/arch/xtensa/kernel/Makefile
+++ linux-rt-2.6.31/arch/xtensa/kernel/Makefile
@@ -27,7 +27,8 @@
 	-e 's/(\(\.text\.[a-z]*\))/(\1.literal \1)/g'
 
 quiet_cmd__cpp_lds_S = LDS     $@
-      cmd__cpp_lds_S = $(CPP) $(cpp_flags) -D__ASSEMBLY__ $< | sed $(sed-y) >$@
+      cmd__cpp_lds_S = $(CPP) $(cpp_flags) -P -C -Uxtensa -D__ASSEMBLY__ $< \
+                       | sed $(sed-y) >$@
 
 $(obj)/vmlinux.lds: $(src)/vmlinux.lds.S FORCE
 	$(call if_changed_dep,_cpp_lds_S)
--- linux-rt-2.6.31.orig/arch/xtensa/kernel/syscall.c
+++ linux-rt-2.6.31/arch/xtensa/kernel/syscall.c
@@ -57,31 +57,6 @@
 	return error;
 }
 
-
-asmlinkage long xtensa_mmap2(unsigned long addr, unsigned long len,
-   			     unsigned long prot, unsigned long flags,
-			     unsigned long fd, unsigned long pgoff)
-{
-	int error = -EBADF;
-	struct file * file = NULL;
-
-	flags &= ~(MAP_EXECUTABLE | MAP_DENYWRITE);
-	if (!(flags & MAP_ANONYMOUS)) {
-		file = fget(fd);
-		if (!file)
-			goto out;
-	}
-
-	down_write(&current->mm->mmap_sem);
-	error = do_mmap_pgoff(file, addr, len, prot, flags, pgoff);
-	up_write(&current->mm->mmap_sem);
-
-	if (file)
-		fput(file);
-out:
-	return error;
-}
-
 asmlinkage long xtensa_shmat(int shmid, char __user *shmaddr, int shmflg)
 {
 	unsigned long ret;
--- linux-rt-2.6.31.orig/arch/sparc/Makefile
+++ linux-rt-2.6.31/arch/sparc/Makefile
@@ -27,11 +27,11 @@
 LDFLAGS        := -m elf32_sparc
 CHECKFLAGS     += -D__sparc__
 export BITS    := 32
+UTS_MACHINE    := sparc
 
 #KBUILD_CFLAGS += -g -pipe -fcall-used-g5 -fcall-used-g7
 KBUILD_CFLAGS += -m32 -pipe -mno-fpu -fcall-used-g5 -fcall-used-g7
 KBUILD_AFLAGS += -m32
-CPPFLAGS_vmlinux.lds += -m32
 
 #LDFLAGS_vmlinux = -N -Ttext 0xf0004000
 #  Since 2.5.40, the first stage is left not btfix-ed.
@@ -49,11 +49,9 @@
 
 CHECKFLAGS      += -D__sparc__ -D__sparc_v9__ -D__arch64__ -m64
 
-# Undefine sparc when processing vmlinux.lds - it is used
-# And teach CPP we are doing 64 bit builds (for this case)
-CPPFLAGS_vmlinux.lds += -m64 -Usparc
 LDFLAGS              := -m elf64_sparc
 export BITS          := 64
+UTS_MACHINE          := sparc64
 
 KBUILD_CFLAGS += -m64 -pipe -mno-fpu -mcpu=ultrasparc -mcmodel=medlow   \
                  -ffixed-g4 -ffixed-g5 -fcall-used-g7 -Wno-sign-compare \
--- linux-rt-2.6.31.orig/arch/sparc/lib/mcount.S
+++ linux-rt-2.6.31/arch/sparc/lib/mcount.S
@@ -64,8 +64,9 @@
 2:	 sethi		%hi(softirq_stack), %g3
 	or		%g3, %lo(softirq_stack), %g3
 	ldx		[%g3 + %g1], %g7
+	sub		%g7, STACK_BIAS, %g7
 	cmp		%sp, %g7
-	bleu,pt		%xcc, 2f
+	bleu,pt		%xcc, 3f
 	 sethi		%hi(THREAD_SIZE), %g3
 	add		%g7, %g3, %g7
 	cmp		%sp, %g7
@@ -75,7 +76,7 @@
 	 * again, we are already trying to output the stack overflow
 	 * message.
 	 */
-	sethi		%hi(ovstack), %g7		! cant move to panic stack fast enough
+3:	sethi		%hi(ovstack), %g7		! cant move to panic stack fast enough
 	 or		%g7, %lo(ovstack), %g7
 	add		%g7, OVSTACKSIZE, %g3
 	sub		%g3, STACK_BIAS + 192, %g3
--- linux-rt-2.6.31.orig/arch/sparc/include/asm/thread_info_64.h
+++ linux-rt-2.6.31/arch/sparc/include/asm/thread_info_64.h
@@ -232,7 +232,7 @@
  *       in using in assembly, else we can't use the mask as
  *       an immediate value in instructions such as andcc.
  */
-#define TIF_ABI_PENDING		12
+/* flag bit 12 is available */
 #define TIF_MEMDIE		13
 #define TIF_POLLING_NRFLAG	14
 #define TIF_FREEZE		15	/* is freezing for suspend */
@@ -246,7 +246,6 @@
 #define _TIF_32BIT		(1<<TIF_32BIT)
 #define _TIF_SECCOMP		(1<<TIF_SECCOMP)
 #define _TIF_SYSCALL_AUDIT	(1<<TIF_SYSCALL_AUDIT)
-#define _TIF_ABI_PENDING	(1<<TIF_ABI_PENDING)
 #define _TIF_POLLING_NRFLAG	(1<<TIF_POLLING_NRFLAG)
 #define _TIF_FREEZE		(1<<TIF_FREEZE)
 
--- linux-rt-2.6.31.orig/arch/sparc/include/asm/elf_64.h
+++ linux-rt-2.6.31/arch/sparc/include/asm/elf_64.h
@@ -196,17 +196,10 @@
 #define ELF_PLATFORM	(NULL)
 
 #define SET_PERSONALITY(ex)				\
-do {	unsigned long new_flags = current_thread_info()->flags; \
-	new_flags &= _TIF_32BIT;			\
-	if ((ex).e_ident[EI_CLASS] == ELFCLASS32)	\
-		new_flags |= _TIF_32BIT;		\
+	do {   if ((ex).e_ident[EI_CLASS] == ELFCLASS32)       \
+		set_thread_flag(TIF_32BIT);             \
 	else						\
-		new_flags &= ~_TIF_32BIT;		\
-	if ((current_thread_info()->flags & _TIF_32BIT) \
-	    != new_flags)				\
-		set_thread_flag(TIF_ABI_PENDING);	\
-	else						\
-		clear_thread_flag(TIF_ABI_PENDING);	\
+		clear_thread_flag(TIF_32BIT);           \
 	/* flush_thread will update pgd cache */	\
 	if (personality(current->personality) != PER_LINUX32)	\
 		set_personality(PER_LINUX |		\
--- linux-rt-2.6.31.orig/arch/sparc/mm/init_64.h
+++ linux-rt-2.6.31/arch/sparc/mm/init_64.h
@@ -45,7 +45,7 @@
 #define VMEMMAP_ALIGN(x)	(((x)+VMEMMAP_CHUNK-1UL)&VMEMMAP_CHUNK_MASK)
 
 #define VMEMMAP_SIZE	((((1UL << MAX_PHYSADDR_BITS) >> PAGE_SHIFT) * \
-			  sizeof(struct page *)) >> VMEMMAP_CHUNK_SHIFT)
+			  sizeof(struct page)) >> VMEMMAP_CHUNK_SHIFT)
 extern unsigned long vmemmap_table[VMEMMAP_SIZE];
 #endif
 
--- linux-rt-2.6.31.orig/arch/sparc/kernel/process_64.c
+++ linux-rt-2.6.31/arch/sparc/kernel/process_64.c
@@ -365,14 +365,6 @@
 	struct thread_info *t = current_thread_info();
 	struct mm_struct *mm;
 
-	if (test_ti_thread_flag(t, TIF_ABI_PENDING)) {
-		clear_ti_thread_flag(t, TIF_ABI_PENDING);
-		if (test_ti_thread_flag(t, TIF_32BIT))
-			clear_ti_thread_flag(t, TIF_32BIT);
-		else
-			set_ti_thread_flag(t, TIF_32BIT);
-	}
-
 	mm = t->task->mm;
 	if (mm)
 		tsb_context_switch(mm);
--- linux-rt-2.6.31.orig/arch/sparc/kernel/prom_common.c
+++ linux-rt-2.6.31/arch/sparc/kernel/prom_common.c
@@ -76,6 +76,7 @@
 
 	err = -ENODEV;
 
+	mutex_lock(&of_set_property_mutex);
 	write_lock(&devtree_lock);
 	prevp = &dp->properties;
 	while (*prevp) {
@@ -85,9 +86,7 @@
 			void *old_val = prop->value;
 			int ret;
 
-			mutex_lock(&of_set_property_mutex);
 			ret = prom_setprop(dp->node, name, val, len);
-			mutex_unlock(&of_set_property_mutex);
 
 			err = -EINVAL;
 			if (ret >= 0) {
@@ -106,6 +105,7 @@
 		prevp = &(*prevp)->next;
 	}
 	write_unlock(&devtree_lock);
+	mutex_unlock(&of_set_property_mutex);
 
 	/* XXX Upate procfs if necessary... */
 
--- linux-rt-2.6.31.orig/arch/sparc/kernel/sys_sparc_64.c
+++ linux-rt-2.6.31/arch/sparc/kernel/sys_sparc_64.c
@@ -317,10 +317,14 @@
 unsigned long get_fb_unmapped_area(struct file *filp, unsigned long orig_addr, unsigned long len, unsigned long pgoff, unsigned long flags)
 {
 	unsigned long align_goal, addr = -ENOMEM;
+	unsigned long (*get_area)(struct file *, unsigned long,
+				  unsigned long, unsigned long, unsigned long);
+
+	get_area = current->mm->get_unmapped_area;
 
 	if (flags & MAP_FIXED) {
 		/* Ok, don't mess with it. */
-		return get_unmapped_area(NULL, orig_addr, len, pgoff, flags);
+		return get_area(NULL, orig_addr, len, pgoff, flags);
 	}
 	flags &= ~MAP_SHARED;
 
@@ -333,7 +337,7 @@
 		align_goal = (64UL * 1024);
 
 	do {
-		addr = get_unmapped_area(NULL, orig_addr, len + (align_goal - PAGE_SIZE), pgoff, flags);
+		addr = get_area(NULL, orig_addr, len + (align_goal - PAGE_SIZE), pgoff, flags);
 		if (!(addr & ~PAGE_MASK)) {
 			addr = (addr + (align_goal - 1UL)) & ~(align_goal - 1UL);
 			break;
@@ -351,7 +355,7 @@
 	 * be obtained.
 	 */
 	if (addr & ~PAGE_MASK)
-		addr = get_unmapped_area(NULL, orig_addr, len, pgoff, flags);
+		addr = get_area(NULL, orig_addr, len, pgoff, flags);
 
 	return addr;
 }
@@ -399,18 +403,6 @@
 	}
 }
 
-SYSCALL_DEFINE1(sparc_brk, unsigned long, brk)
-{
-	/* People could try to be nasty and use ta 0x6d in 32bit programs */
-	if (test_thread_flag(TIF_32BIT) && brk >= STACK_TOP32)
-		return current->mm->brk;
-
-	if (unlikely(straddles_64bit_va_hole(current->mm->brk, brk)))
-		return current->mm->brk;
-
-	return sys_brk(brk);
-}
-                                                                
 /*
  * sys_pipe() is the normal C calling standard for creating
  * a pipe. It's not the way unix traditionally does this, though.
@@ -568,23 +560,13 @@
 		unsigned long, prot, unsigned long, flags, unsigned long, fd,
 		unsigned long, off)
 {
-	struct file * file = NULL;
-	unsigned long retval = -EBADF;
-
-	if (!(flags & MAP_ANONYMOUS)) {
-		file = fget(fd);
-		if (!file)
-			goto out;
-	}
-	flags &= ~(MAP_EXECUTABLE | MAP_DENYWRITE);
-	len = PAGE_ALIGN(len);
+	unsigned long retval = -EINVAL;
 
-	down_write(&current->mm->mmap_sem);
-	retval = do_mmap(file, addr, len, prot, flags, off);
-	up_write(&current->mm->mmap_sem);
-
-	if (file)
-		fput(file);
+	if ((off + PAGE_ALIGN(len)) < off)
+		goto out;
+	if (off & ~PAGE_MASK)
+		goto out;
+	retval = sys_mmap_pgoff(addr, len, prot, flags, fd, off >> PAGE_SHIFT);
 out:
 	return retval;
 }
@@ -614,12 +596,6 @@
 
 	if (test_thread_flag(TIF_32BIT))
 		goto out;
-	if (unlikely(new_len >= VA_EXCLUDE_START))
-		goto out;
-	if (unlikely(sparc_mmap_check(addr, old_len)))
-		goto out;
-	if (unlikely(sparc_mmap_check(new_addr, new_len)))
-		goto out;
 
 	down_write(&current->mm->mmap_sem);
 	ret = do_mremap(addr, old_len, new_len, flags, new_addr);
--- linux-rt-2.6.31.orig/arch/sparc/kernel/systbls.h
+++ linux-rt-2.6.31/arch/sparc/kernel/systbls.h
@@ -8,7 +8,6 @@
 #include <asm/signal.h>
 
 extern asmlinkage unsigned long sys_getpagesize(void);
-extern asmlinkage unsigned long sparc_brk(unsigned long brk);
 extern asmlinkage long sparc_pipe(struct pt_regs *regs);
 extern asmlinkage long sys_ipc(unsigned int call, int first,
 			       unsigned long second,
--- linux-rt-2.6.31.orig/arch/sparc/kernel/Makefile
+++ linux-rt-2.6.31/arch/sparc/kernel/Makefile
@@ -7,7 +7,11 @@
 
 extra-y     := head_$(BITS).o
 extra-y     += init_task.o
-extra-y     += vmlinux.lds
+
+# Undefine sparc when processing vmlinux.lds - it is used
+# And teach CPP we are doing $(BITS) builds (for this case)
+CPPFLAGS_vmlinux.lds := -Usparc -m$(BITS)
+extra-y              += vmlinux.lds
 
 obj-$(CONFIG_SPARC32)   += entry.o wof.o wuf.o
 obj-$(CONFIG_SPARC32)   += etrap_32.o
--- linux-rt-2.6.31.orig/arch/sparc/kernel/ldc.c
+++ linux-rt-2.6.31/arch/sparc/kernel/ldc.c
@@ -1242,13 +1242,13 @@
 	snprintf(lp->tx_irq_name, LDC_IRQ_NAME_MAX, "%s TX", name);
 
 	err = request_irq(lp->cfg.rx_irq, ldc_rx,
-			  IRQF_SAMPLE_RANDOM | IRQF_SHARED,
+			  IRQF_SAMPLE_RANDOM | IRQF_DISABLED,
 			  lp->rx_irq_name, lp);
 	if (err)
 		return err;
 
 	err = request_irq(lp->cfg.tx_irq, ldc_tx,
-			  IRQF_SAMPLE_RANDOM | IRQF_SHARED,
+			  IRQF_SAMPLE_RANDOM | IRQF_DISABLED,
 			  lp->tx_irq_name, lp);
 	if (err) {
 		free_irq(lp->cfg.rx_irq, lp);
--- linux-rt-2.6.31.orig/arch/sparc/kernel/visemul.c
+++ linux-rt-2.6.31/arch/sparc/kernel/visemul.c
@@ -617,7 +617,7 @@
 		rs2 = fps_regval(f, RS2(insn));
 
 		rd_val = 0;
-		src2 = (rs2 >> (opf == FMUL8x16AU_OPF) ? 16 : 0);
+		src2 = rs2 >> (opf == FMUL8x16AU_OPF ? 16 : 0);
 		for (byte = 0; byte < 4; byte++) {
 			u16 src1 = (rs1 >> (byte * 8)) & 0x00ff;
 			u32 prod = src1 * src2;
--- linux-rt-2.6.31.orig/arch/sparc/kernel/sys_sparc_32.c
+++ linux-rt-2.6.31/arch/sparc/kernel/sys_sparc_32.c
@@ -45,7 +45,8 @@
 		/* We do not accept a shared mapping if it would violate
 		 * cache aliasing constraints.
 		 */
-		if ((flags & MAP_SHARED) && (addr & (SHMLBA - 1)))
+		if ((flags & MAP_SHARED) &&
+		    ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
 			return -EINVAL;
 		return addr;
 	}
@@ -79,15 +80,6 @@
 	}
 }
 
-asmlinkage unsigned long sparc_brk(unsigned long brk)
-{
-	if(ARCH_SUN4C) {
-		if ((brk & 0xe0000000) != (current->mm->brk & 0xe0000000))
-			return current->mm->brk;
-	}
-	return sys_brk(brk);
-}
-
 /*
  * sys_pipe() is the normal C calling standard for creating
  * a pipe. It's not the way unix traditionally does this, though.
@@ -234,31 +226,6 @@
 }
 
 /* Linux version of mmap */
-static unsigned long do_mmap2(unsigned long addr, unsigned long len,
-	unsigned long prot, unsigned long flags, unsigned long fd,
-	unsigned long pgoff)
-{
-	struct file * file = NULL;
-	unsigned long retval = -EBADF;
-
-	if (!(flags & MAP_ANONYMOUS)) {
-		file = fget(fd);
-		if (!file)
-			goto out;
-	}
-
-	len = PAGE_ALIGN(len);
-	flags &= ~(MAP_EXECUTABLE | MAP_DENYWRITE);
-
-	down_write(&current->mm->mmap_sem);
-	retval = do_mmap_pgoff(file, addr, len, prot, flags, pgoff);
-	up_write(&current->mm->mmap_sem);
-
-	if (file)
-		fput(file);
-out:
-	return retval;
-}
 
 asmlinkage unsigned long sys_mmap2(unsigned long addr, unsigned long len,
 	unsigned long prot, unsigned long flags, unsigned long fd,
@@ -266,14 +233,16 @@
 {
 	/* Make sure the shift for mmap2 is constant (12), no matter what PAGE_SIZE
 	   we have. */
-	return do_mmap2(addr, len, prot, flags, fd, pgoff >> (PAGE_SHIFT - 12));
+	return sys_mmap_pgoff(addr, len, prot, flags, fd,
+			      pgoff >> (PAGE_SHIFT - 12));
 }
 
 asmlinkage unsigned long sys_mmap(unsigned long addr, unsigned long len,
 	unsigned long prot, unsigned long flags, unsigned long fd,
 	unsigned long off)
 {
-	return do_mmap2(addr, len, prot, flags, fd, off >> PAGE_SHIFT);
+	/* no alignment check? */
+	return sys_mmap_pgoff(addr, len, prot, flags, fd, off >> PAGE_SHIFT);
 }
 
 long sparc_remap_file_pages(unsigned long start, unsigned long size,
@@ -287,27 +256,6 @@
 				    (pgoff >> (PAGE_SHIFT - 12)), flags);
 }
 
-extern unsigned long do_mremap(unsigned long addr,
-	unsigned long old_len, unsigned long new_len,
-	unsigned long flags, unsigned long new_addr);
-                
-asmlinkage unsigned long sparc_mremap(unsigned long addr,
-	unsigned long old_len, unsigned long new_len,
-	unsigned long flags, unsigned long new_addr)
-{
-	unsigned long ret = -EINVAL;
-
-	if (unlikely(sparc_mmap_check(addr, old_len)))
-		goto out;
-	if (unlikely(sparc_mmap_check(new_addr, new_len)))
-		goto out;
-	down_write(&current->mm->mmap_sem);
-	ret = do_mremap(addr, old_len, new_len, flags, new_addr);
-	up_write(&current->mm->mmap_sem);
-out:
-	return ret;       
-}
-
 /* we come to here via sys_nis_syscall so it can setup the regs argument */
 asmlinkage unsigned long
 c_sys_nis_syscall (struct pt_regs *regs)
--- linux-rt-2.6.31.orig/arch/sparc/kernel/systbls_32.S
+++ linux-rt-2.6.31/arch/sparc/kernel/systbls_32.S
@@ -19,7 +19,7 @@
 /*0*/	.long sys_restart_syscall, sys_exit, sys_fork, sys_read, sys_write
 /*5*/	.long sys_open, sys_close, sys_wait4, sys_creat, sys_link
 /*10*/  .long sys_unlink, sunos_execv, sys_chdir, sys_chown16, sys_mknod
-/*15*/	.long sys_chmod, sys_lchown16, sparc_brk, sys_nis_syscall, sys_lseek
+/*15*/	.long sys_chmod, sys_lchown16, sys_brk, sys_nis_syscall, sys_lseek
 /*20*/	.long sys_getpid, sys_capget, sys_capset, sys_setuid16, sys_getuid16
 /*25*/	.long sys_vmsplice, sys_ptrace, sys_alarm, sys_sigaltstack, sys_pause
 /*30*/	.long sys_utime, sys_lchown, sys_fchown, sys_access, sys_nice
@@ -67,7 +67,7 @@
 /*235*/	.long sys_fstatfs64, sys_llseek, sys_mlock, sys_munlock, sys_mlockall
 /*240*/	.long sys_munlockall, sys_sched_setparam, sys_sched_getparam, sys_sched_setscheduler, sys_sched_getscheduler
 /*245*/	.long sys_sched_yield, sys_sched_get_priority_max, sys_sched_get_priority_min, sys_sched_rr_get_interval, sys_nanosleep
-/*250*/	.long sparc_mremap, sys_sysctl, sys_getsid, sys_fdatasync, sys_nfsservctl
+/*250*/	.long sys_mremap, sys_sysctl, sys_getsid, sys_fdatasync, sys_nfsservctl
 /*255*/	.long sys_sync_file_range, sys_clock_settime, sys_clock_gettime, sys_clock_getres, sys_clock_nanosleep
 /*260*/	.long sys_sched_getaffinity, sys_sched_setaffinity, sys_timer_settime, sys_timer_gettime, sys_timer_getoverrun
 /*265*/	.long sys_timer_delete, sys_timer_create, sys_nis_syscall, sys_io_setup, sys_io_destroy
--- linux-rt-2.6.31.orig/arch/sparc/kernel/of_device_64.c
+++ linux-rt-2.6.31/arch/sparc/kernel/of_device_64.c
@@ -104,9 +104,19 @@
 	int i;
 
 	/* Check address type match */
-	if ((addr[0] ^ range[0]) & 0x03000000)
-		return -EINVAL;
+	if (!((addr[0] ^ range[0]) & 0x03000000))
+		goto type_match;
+
+	/* Special exception, we can map a 64-bit address into
+	 * a 32-bit range.
+	 */
+	if ((addr[0] & 0x03000000) == 0x03000000 &&
+	    (range[0] & 0x03000000) == 0x02000000)
+		goto type_match;
+
+	return -EINVAL;
 
+type_match:
 	if (of_out_of_range(addr + 1, range + 1, range + na + pna,
 			    na - 1, ns))
 		return -EINVAL;
--- linux-rt-2.6.31.orig/arch/sparc/kernel/systbls_64.S
+++ linux-rt-2.6.31/arch/sparc/kernel/systbls_64.S
@@ -21,7 +21,7 @@
 /*0*/	.word sys_restart_syscall, sys32_exit, sys_fork, sys_read, sys_write
 /*5*/	.word sys32_open, sys_close, sys32_wait4, sys32_creat, sys_link
 /*10*/  .word sys_unlink, sunos_execv, sys_chdir, sys_chown16, sys32_mknod
-/*15*/	.word sys_chmod, sys_lchown16, sys_sparc_brk, sys32_perfctr, sys32_lseek
+/*15*/	.word sys_chmod, sys_lchown16, sys_brk, sys32_perfctr, sys32_lseek
 /*20*/	.word sys_getpid, sys_capget, sys_capset, sys_setuid16, sys_getuid16
 /*25*/	.word sys32_vmsplice, compat_sys_ptrace, sys_alarm, sys32_sigaltstack, sys_pause
 /*30*/	.word compat_sys_utime, sys_lchown, sys_fchown, sys32_access, sys32_nice
@@ -96,7 +96,7 @@
 /*0*/	.word sys_restart_syscall, sparc_exit, sys_fork, sys_read, sys_write
 /*5*/	.word sys_open, sys_close, sys_wait4, sys_creat, sys_link
 /*10*/  .word sys_unlink, sys_nis_syscall, sys_chdir, sys_chown, sys_mknod
-/*15*/	.word sys_chmod, sys_lchown, sys_sparc_brk, sys_perfctr, sys_lseek
+/*15*/	.word sys_chmod, sys_lchown, sys_brk, sys_perfctr, sys_lseek
 /*20*/	.word sys_getpid, sys_capget, sys_capset, sys_setuid, sys_getuid
 /*25*/	.word sys_vmsplice, sys_ptrace, sys_alarm, sys_sigaltstack, sys_nis_syscall
 /*30*/	.word sys_utime, sys_nis_syscall, sys_nis_syscall, sys_access, sys_nice
--- linux-rt-2.6.31.orig/arch/m32r/kernel/sys_m32r.c
+++ linux-rt-2.6.31/arch/m32r/kernel/sys_m32r.c
@@ -76,30 +76,6 @@
 	return oldval;
 }
 
-asmlinkage long sys_mmap2(unsigned long addr, unsigned long len,
-	unsigned long prot, unsigned long flags,
-	unsigned long fd, unsigned long pgoff)
-{
-	int error = -EBADF;
-	struct file *file = NULL;
-
-	flags &= ~(MAP_EXECUTABLE | MAP_DENYWRITE);
-	if (!(flags & MAP_ANONYMOUS)) {
-		file = fget(fd);
-		if (!file)
-			goto out;
-	}
-
-	down_write(&current->mm->mmap_sem);
-	error = do_mmap_pgoff(file, addr, len, prot, flags, pgoff);
-	up_write(&current->mm->mmap_sem);
-
-	if (file)
-		fput(file);
-out:
-	return error;
-}
-
 /*
  * sys_ipc() is the de-multiplexer for the SysV IPC calls..
  *
--- linux-rt-2.6.31.orig/arch/m32r/kernel/syscall_table.S
+++ linux-rt-2.6.31/arch/m32r/kernel/syscall_table.S
@@ -191,7 +191,7 @@
 	.long sys_ni_syscall		/* streams2 */
 	.long sys_vfork			/* 190 */
 	.long sys_getrlimit
-	.long sys_mmap2
+	.long sys_mmap_pgoff
 	.long sys_truncate64
 	.long sys_ftruncate64
 	.long sys_stat64		/* 195 */
--- linux-rt-2.6.31.orig/arch/frv/kernel/sys_frv.c
+++ linux-rt-2.6.31/arch/frv/kernel/sys_frv.c
@@ -32,9 +32,6 @@
 			  unsigned long prot, unsigned long flags,
 			  unsigned long fd, unsigned long pgoff)
 {
-	int error = -EBADF;
-	struct file * file = NULL;
-
 	/* As with sparc32, make sure the shift for mmap2 is constant
 	   (12), no matter what PAGE_SIZE we have.... */
 
@@ -42,69 +39,10 @@
 	   trying to map something we can't */
 	if (pgoff & ((1 << (PAGE_SHIFT - 12)) - 1))
 		return -EINVAL;
-	pgoff >>= PAGE_SHIFT - 12;
-
-	flags &= ~(MAP_EXECUTABLE | MAP_DENYWRITE);
-	if (!(flags & MAP_ANONYMOUS)) {
-		file = fget(fd);
-		if (!file)
-			goto out;
-	}
-
-	down_write(&current->mm->mmap_sem);
-	error = do_mmap_pgoff(file, addr, len, prot, flags, pgoff);
-	up_write(&current->mm->mmap_sem);
-
-	if (file)
-		fput(file);
-out:
-	return error;
-}
-
-#if 0 /* DAVIDM - do we want this */
-struct mmap_arg_struct64 {
-	__u32 addr;
-	__u32 len;
-	__u32 prot;
-	__u32 flags;
-	__u64 offset; /* 64 bits */
-	__u32 fd;
-};
-
-asmlinkage long sys_mmap64(struct mmap_arg_struct64 *arg)
-{
-	int error = -EFAULT;
-	struct file * file = NULL;
-	struct mmap_arg_struct64 a;
-	unsigned long pgoff;
-
-	if (copy_from_user(&a, arg, sizeof(a)))
-		return -EFAULT;
-
-	if ((long)a.offset & ~PAGE_MASK)
-		return -EINVAL;
-
-	pgoff = a.offset >> PAGE_SHIFT;
-	if ((a.offset >> PAGE_SHIFT) != pgoff)
-		return -EINVAL;
-
-	if (!(a.flags & MAP_ANONYMOUS)) {
-		error = -EBADF;
-		file = fget(a.fd);
-		if (!file)
-			goto out;
-	}
-	a.flags &= ~(MAP_EXECUTABLE | MAP_DENYWRITE);
 
-	down_write(&current->mm->mmap_sem);
-	error = do_mmap_pgoff(file, a.addr, a.len, a.prot, a.flags, pgoff);
-	up_write(&current->mm->mmap_sem);
-	if (file)
-		fput(file);
-out:
-	return error;
+	return sys_mmap_pgoff(addr, len, prot, flags, fd,
+			      pgoff >> (PAGE_SHIFT - 12));
 }
-#endif
 
 /*
  * sys_ipc() is the de-multiplexer for the SysV IPC calls..
--- linux-rt-2.6.31.orig/arch/cris/Makefile
+++ linux-rt-2.6.31/arch/cris/Makefile
@@ -42,8 +42,6 @@
 
 OBJCOPYFLAGS := -O binary -R .note -R .comment -S
 
-CPPFLAGS_vmlinux.lds = -DDRAM_VIRTUAL_BASE=0x$(CONFIG_ETRAX_DRAM_VIRTUAL_BASE)
-
 KBUILD_AFLAGS += -mlinux -march=$(arch-y) $(inc)
 KBUILD_CFLAGS += -mlinux -march=$(arch-y) -pipe $(inc)
 KBUILD_CPPFLAGS += $(inc)
--- linux-rt-2.6.31.orig/arch/cris/kernel/Makefile
+++ linux-rt-2.6.31/arch/cris/kernel/Makefile
@@ -3,6 +3,7 @@
 # Makefile for the linux kernel.
 #
 
+CPPFLAGS_vmlinux.lds := -DDRAM_VIRTUAL_BASE=0x$(CONFIG_ETRAX_DRAM_VIRTUAL_BASE)
 extra-y	:= vmlinux.lds
 
 obj-y   := process.o traps.o irq.o ptrace.o setup.o time.o sys_cris.o
--- linux-rt-2.6.31.orig/arch/cris/kernel/sys_cris.c
+++ linux-rt-2.6.31/arch/cris/kernel/sys_cris.c
@@ -26,31 +26,6 @@
 #include <asm/uaccess.h>
 #include <asm/segment.h>
 
-/* common code for old and new mmaps */
-static inline long
-do_mmap2(unsigned long addr, unsigned long len, unsigned long prot,
-        unsigned long flags, unsigned long fd, unsigned long pgoff)
-{
-        int error = -EBADF;
-        struct file * file = NULL;
-
-        flags &= ~(MAP_EXECUTABLE | MAP_DENYWRITE);
-        if (!(flags & MAP_ANONYMOUS)) {
-                file = fget(fd);
-                if (!file)
-                        goto out;
-        }
-
-        down_write(&current->mm->mmap_sem);
-        error = do_mmap_pgoff(file, addr, len, prot, flags, pgoff);
-        up_write(&current->mm->mmap_sem);
-
-        if (file)
-                fput(file);
-out:
-        return error;
-}
-
 asmlinkage unsigned long old_mmap(unsigned long __user *args)
 {        
 	unsigned long buffer[6];
@@ -63,7 +38,7 @@
 	if (buffer[5] & ~PAGE_MASK) /* verify that offset is on page boundary */
 		goto out;
 
-	err = do_mmap2(buffer[0], buffer[1], buffer[2], buffer[3],
+	err = sys_mmap_pgoff(buffer[0], buffer[1], buffer[2], buffer[3],
                        buffer[4], buffer[5] >> PAGE_SHIFT);
 out:
 	return err;
@@ -73,7 +48,8 @@
 sys_mmap2(unsigned long addr, unsigned long len, unsigned long prot,
           unsigned long flags, unsigned long fd, unsigned long pgoff)
 {
-        return do_mmap2(addr, len, prot, flags, fd, pgoff);
+	/* bug(?): 8Kb pages here */
+        return sys_mmap_pgoff(addr, len, prot, flags, fd, pgoff);
 }
 
 /*
--- linux-rt-2.6.31.orig/arch/mips/Makefile
+++ linux-rt-2.6.31/arch/mips/Makefile
@@ -615,16 +615,6 @@
 cflags-y			+= -I$(srctree)/arch/mips/include/asm/mach-generic
 drivers-$(CONFIG_PCI)		+= arch/mips/pci/
 
-ifdef CONFIG_32BIT
-ifdef CONFIG_CPU_LITTLE_ENDIAN
-JIFFIES			= jiffies_64
-else
-JIFFIES			= jiffies_64 + 4
-endif
-else
-JIFFIES			= jiffies_64
-endif
-
 #
 # Automatically detect the build format. By default we choose
 # the elf format according to the load address.
@@ -648,8 +638,9 @@
 endif
 
 KBUILD_AFLAGS	+= $(cflags-y)
-KBUILD_CFLAGS	+= $(cflags-y) \
-			-D"VMLINUX_LOAD_ADDRESS=$(load-y)"
+KBUILD_CFLAGS	+= $(cflags-y)
+KBUILD_CPPFLAGS += -D"VMLINUX_LOAD_ADDRESS=$(load-y)"
+KBUILD_CPPFLAGS += -D"DATAOFFSET=$(if $(dataoffset-y),$(dataoffset-y),0)"
 
 LDFLAGS			+= -m $(ld-emul)
 
@@ -664,18 +655,6 @@
 
 OBJCOPYFLAGS		+= --remove-section=.reginfo
 
-#
-# Choosing incompatible machines durings configuration will result in
-# error messages during linking.  Select a default linkscript if
-# none has been choosen above.
-#
-
-CPPFLAGS_vmlinux.lds := \
-	$(KBUILD_CFLAGS) \
-	-D"LOADADDR=$(load-y)" \
-	-D"JIFFIES=$(JIFFIES)" \
-	-D"DATAOFFSET=$(if $(dataoffset-y),$(dataoffset-y),0)"
-
 head-y := arch/mips/kernel/head.o arch/mips/kernel/init_task.o
 
 libs-y			+= arch/mips/lib/
--- linux-rt-2.6.31.orig/arch/mips/kernel/Makefile
+++ linux-rt-2.6.31/arch/mips/kernel/Makefile
@@ -2,6 +2,8 @@
 # Makefile for the Linux/MIPS kernel.
 #
 
+CPPFLAGS_vmlinux.lds := $(KBUILD_CFLAGS)
+
 extra-y		:= head.o init_task.o vmlinux.lds
 
 obj-y		+= cpu-probe.o branch.o entry.o genex.o irq.o process.o \
--- linux-rt-2.6.31.orig/arch/mips/kernel/vmlinux.lds.S
+++ linux-rt-2.6.31/arch/mips/kernel/vmlinux.lds.S
@@ -9,7 +9,16 @@
 	text PT_LOAD FLAGS(7);	/* RWX */
 	note PT_NOTE FLAGS(4);	/* R__ */
 }
-jiffies = JIFFIES;
+
+#ifdef CONFIG_32BIT
+	#ifdef CONFIG_CPU_LITTLE_ENDIAN
+		jiffies  = jiffies_64;
+	#else
+		jiffies  = jiffies_64 + 4;
+	#endif
+#else
+	jiffies  = jiffies_64;
+#endif
 
 SECTIONS
 {
@@ -28,7 +37,7 @@
 	/* . = 0xa800000000300000; */
 	. = 0xffffffff80300000;
 #endif
-	. = LOADADDR;
+	. = VMLINUX_LOAD_ADDRESS;
 	/* read-only */
 	_text = .;	/* Text and read-only data */
 	.text : {
--- linux-rt-2.6.31.orig/arch/mips/kernel/syscall.c
+++ linux-rt-2.6.31/arch/mips/kernel/syscall.c
@@ -91,7 +91,8 @@
 		 * We do not accept a shared mapping if it would violate
 		 * cache aliasing constraints.
 		 */
-		if ((flags & MAP_SHARED) && (addr & shm_align_mask))
+		if ((flags & MAP_SHARED) &&
+		    ((addr - (pgoff << PAGE_SHIFT)) & shm_align_mask))
 			return -EINVAL;
 		return addr;
 	}
@@ -127,31 +128,6 @@
 	}
 }
 
-/* common code for old and new mmaps */
-static inline unsigned long
-do_mmap2(unsigned long addr, unsigned long len, unsigned long prot,
-        unsigned long flags, unsigned long fd, unsigned long pgoff)
-{
-	unsigned long error = -EBADF;
-	struct file * file = NULL;
-
-	flags &= ~(MAP_EXECUTABLE | MAP_DENYWRITE);
-	if (!(flags & MAP_ANONYMOUS)) {
-		file = fget(fd);
-		if (!file)
-			goto out;
-	}
-
-	down_write(&current->mm->mmap_sem);
-	error = do_mmap_pgoff(file, addr, len, prot, flags, pgoff);
-	up_write(&current->mm->mmap_sem);
-
-	if (file)
-		fput(file);
-out:
-	return error;
-}
-
 SYSCALL_DEFINE6(mips_mmap, unsigned long, addr, unsigned long, len,
 	unsigned long, prot, unsigned long, flags, unsigned long,
 	fd, off_t, offset)
@@ -162,7 +138,7 @@
 	if (offset & ~PAGE_MASK)
 		goto out;
 
-	result = do_mmap2(addr, len, prot, flags, fd, offset >> PAGE_SHIFT);
+	result = sys_mmap_pgoff(addr, len, prot, flags, fd, offset >> PAGE_SHIFT);
 
 out:
 	return result;
@@ -175,7 +151,7 @@
 	if (pgoff & (~PAGE_MASK >> 12))
 		return -EINVAL;
 
-	return do_mmap2(addr, len, prot, flags, fd, pgoff >> (PAGE_SHIFT-12));
+	return sys_mmap_pgoff(addr, len, prot, flags, fd, pgoff >> (PAGE_SHIFT-12));
 }
 
 save_static_function(sys_fork);
--- linux-rt-2.6.31.orig/arch/mips/kernel/linux32.c
+++ linux-rt-2.6.31/arch/mips/kernel/linux32.c
@@ -67,28 +67,13 @@
 	unsigned long, prot, unsigned long, flags, unsigned long, fd,
 	unsigned long, pgoff)
 {
-	struct file * file = NULL;
 	unsigned long error;
 
 	error = -EINVAL;
 	if (pgoff & (~PAGE_MASK >> 12))
 		goto out;
-	pgoff >>= PAGE_SHIFT-12;
-
-	if (!(flags & MAP_ANONYMOUS)) {
-		error = -EBADF;
-		file = fget(fd);
-		if (!file)
-			goto out;
-	}
-	flags &= ~(MAP_EXECUTABLE | MAP_DENYWRITE);
-
-	down_write(&current->mm->mmap_sem);
-	error = do_mmap_pgoff(file, addr, len, prot, flags, pgoff);
-	up_write(&current->mm->mmap_sem);
-	if (file)
-		fput(file);
-
+	error = sys_mmap_pgoff(addr, len, prot, flags, fd,
+			       pgoff >> (PAGE_SHIFT-12));
 out:
 	return error;
 }
--- linux-rt-2.6.31.orig/arch/ia64/kernel/sys_ia64.c
+++ linux-rt-2.6.31/arch/ia64/kernel/sys_ia64.c
@@ -100,51 +100,7 @@
 asmlinkage unsigned long
 ia64_brk (unsigned long brk)
 {
-	unsigned long rlim, retval, newbrk, oldbrk;
-	struct mm_struct *mm = current->mm;
-
-	/*
-	 * Most of this replicates the code in sys_brk() except for an additional safety
-	 * check and the clearing of r8.  However, we can't call sys_brk() because we need
-	 * to acquire the mmap_sem before we can do the test...
-	 */
-	down_write(&mm->mmap_sem);
-
-	if (brk < mm->end_code)
-		goto out;
-	newbrk = PAGE_ALIGN(brk);
-	oldbrk = PAGE_ALIGN(mm->brk);
-	if (oldbrk == newbrk)
-		goto set_brk;
-
-	/* Always allow shrinking brk. */
-	if (brk <= mm->brk) {
-		if (!do_munmap(mm, newbrk, oldbrk-newbrk))
-			goto set_brk;
-		goto out;
-	}
-
-	/* Check against unimplemented/unmapped addresses: */
-	if ((newbrk - oldbrk) > RGN_MAP_LIMIT || REGION_OFFSET(newbrk) > RGN_MAP_LIMIT)
-		goto out;
-
-	/* Check against rlimit.. */
-	rlim = current->signal->rlim[RLIMIT_DATA].rlim_cur;
-	if (rlim < RLIM_INFINITY && brk - mm->start_data > rlim)
-		goto out;
-
-	/* Check against existing mmap mappings. */
-	if (find_vma_intersection(mm, oldbrk, newbrk+PAGE_SIZE))
-		goto out;
-
-	/* Ok, looks good - let it rip. */
-	if (do_brk(oldbrk, newbrk-oldbrk) != oldbrk)
-		goto out;
-set_brk:
-	mm->brk = brk;
-out:
-	retval = mm->brk;
-	up_write(&mm->mmap_sem);
+	unsigned long retval = sys_brk(brk);
 	force_successful_syscall_return();
 	return retval;
 }
@@ -185,39 +141,6 @@
 	return 0;
 }
 
-static inline unsigned long
-do_mmap2 (unsigned long addr, unsigned long len, int prot, int flags, int fd, unsigned long pgoff)
-{
-	struct file *file = NULL;
-
-	flags &= ~(MAP_EXECUTABLE | MAP_DENYWRITE);
-	if (!(flags & MAP_ANONYMOUS)) {
-		file = fget(fd);
-		if (!file)
-			return -EBADF;
-
-		if (!file->f_op || !file->f_op->mmap) {
-			addr = -ENODEV;
-			goto out;
-		}
-	}
-
-	/* Careful about overflows.. */
-	len = PAGE_ALIGN(len);
-	if (!len || len > TASK_SIZE) {
-		addr = -EINVAL;
-		goto out;
-	}
-
-	down_write(&current->mm->mmap_sem);
-	addr = do_mmap_pgoff(file, addr, len, prot, flags, pgoff);
-	up_write(&current->mm->mmap_sem);
-
-out:	if (file)
-		fput(file);
-	return addr;
-}
-
 /*
  * mmap2() is like mmap() except that the offset is expressed in units
  * of PAGE_SIZE (instead of bytes).  This allows to mmap2() (pieces
@@ -226,7 +149,7 @@
 asmlinkage unsigned long
 sys_mmap2 (unsigned long addr, unsigned long len, int prot, int flags, int fd, long pgoff)
 {
-	addr = do_mmap2(addr, len, prot, flags, fd, pgoff);
+	addr = sys_mmap_pgoff(addr, len, prot, flags, fd, pgoff);
 	if (!IS_ERR((void *) addr))
 		force_successful_syscall_return();
 	return addr;
@@ -238,7 +161,7 @@
 	if (offset_in_page(off) != 0)
 		return -EINVAL;
 
-	addr = do_mmap2(addr, len, prot, flags, fd, off >> PAGE_SHIFT);
+	addr = sys_mmap_pgoff(addr, len, prot, flags, fd, off >> PAGE_SHIFT);
 	if (!IS_ERR((void *) addr))
 		force_successful_syscall_return();
 	return addr;
--- linux-rt-2.6.31.orig/arch/avr32/include/asm/syscalls.h
+++ linux-rt-2.6.31/arch/avr32/include/asm/syscalls.h
@@ -29,10 +29,6 @@
 			       struct pt_regs *);
 asmlinkage int sys_rt_sigreturn(struct pt_regs *);
 
-/* kernel/sys_avr32.c */
-asmlinkage long sys_mmap2(unsigned long, unsigned long, unsigned long,
-			  unsigned long, unsigned long, off_t);
-
 /* mm/cache.c */
 asmlinkage int sys_cacheflush(int, void __user *, size_t);
 
--- linux-rt-2.6.31.orig/arch/avr32/kernel/syscall-stubs.S
+++ linux-rt-2.6.31/arch/avr32/kernel/syscall-stubs.S
@@ -61,7 +61,7 @@
 __sys_mmap2:
 	pushm	lr
 	st.w	--sp, ARG6
-	call	sys_mmap2
+	call	sys_mmap_pgoff
 	sub	sp, -4
 	popm	pc
 
--- linux-rt-2.6.31.orig/arch/avr32/kernel/sys_avr32.c
+++ linux-rt-2.6.31/arch/avr32/kernel/sys_avr32.c
@@ -5,39 +5,8 @@
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
-#include <linux/errno.h>
-#include <linux/fs.h>
-#include <linux/file.h>
-#include <linux/mm.h>
 #include <linux/unistd.h>
 
-#include <asm/mman.h>
-#include <asm/uaccess.h>
-#include <asm/syscalls.h>
-
-asmlinkage long sys_mmap2(unsigned long addr, unsigned long len,
-			  unsigned long prot, unsigned long flags,
-			  unsigned long fd, off_t offset)
-{
-	int error = -EBADF;
-	struct file *file = NULL;
-
-	flags &= ~(MAP_EXECUTABLE | MAP_DENYWRITE);
-	if (!(flags & MAP_ANONYMOUS)) {
-		file = fget(fd);
-		if (!file)
-			return error;
-	}
-
-	down_write(&current->mm->mmap_sem);
-	error = do_mmap_pgoff(file, addr, len, prot, flags, offset);
-	up_write(&current->mm->mmap_sem);
-
-	if (file)
-		fput(file);
-	return error;
-}
-
 int kernel_execve(const char *file, char **argv, char **envp)
 {
 	register long scno asm("r8") = __NR_execve;
--- linux-rt-2.6.31.orig/arch/m68k/kernel/sys_m68k.c
+++ linux-rt-2.6.31/arch/m68k/kernel/sys_m68k.c
@@ -30,37 +30,16 @@
 #include <asm/page.h>
 #include <asm/unistd.h>
 
-/* common code for old and new mmaps */
-static inline long do_mmap2(
-	unsigned long addr, unsigned long len,
-	unsigned long prot, unsigned long flags,
-	unsigned long fd, unsigned long pgoff)
-{
-	int error = -EBADF;
-	struct file * file = NULL;
-
-	flags &= ~(MAP_EXECUTABLE | MAP_DENYWRITE);
-	if (!(flags & MAP_ANONYMOUS)) {
-		file = fget(fd);
-		if (!file)
-			goto out;
-	}
-
-	down_write(&current->mm->mmap_sem);
-	error = do_mmap_pgoff(file, addr, len, prot, flags, pgoff);
-	up_write(&current->mm->mmap_sem);
-
-	if (file)
-		fput(file);
-out:
-	return error;
-}
-
 asmlinkage long sys_mmap2(unsigned long addr, unsigned long len,
 	unsigned long prot, unsigned long flags,
 	unsigned long fd, unsigned long pgoff)
 {
-	return do_mmap2(addr, len, prot, flags, fd, pgoff);
+	/*
+	 * This is wrong for sun3 - there PAGE_SIZE is 8Kb,
+	 * so we need to shift the argument down by 1; m68k mmap64(3)
+	 * (in libc) expects the last argument of mmap2 in 4Kb units.
+	 */
+	return sys_mmap_pgoff(addr, len, prot, flags, fd, pgoff);
 }
 
 /*
@@ -91,57 +70,11 @@
 	if (a.offset & ~PAGE_MASK)
 		goto out;
 
-	a.flags &= ~(MAP_EXECUTABLE | MAP_DENYWRITE);
-
-	error = do_mmap2(a.addr, a.len, a.prot, a.flags, a.fd, a.offset >> PAGE_SHIFT);
-out:
-	return error;
-}
-
-#if 0
-struct mmap_arg_struct64 {
-	__u32 addr;
-	__u32 len;
-	__u32 prot;
-	__u32 flags;
-	__u64 offset; /* 64 bits */
-	__u32 fd;
-};
-
-asmlinkage long sys_mmap64(struct mmap_arg_struct64 *arg)
-{
-	int error = -EFAULT;
-	struct file * file = NULL;
-	struct mmap_arg_struct64 a;
-	unsigned long pgoff;
-
-	if (copy_from_user(&a, arg, sizeof(a)))
-		return -EFAULT;
-
-	if ((long)a.offset & ~PAGE_MASK)
-		return -EINVAL;
-
-	pgoff = a.offset >> PAGE_SHIFT;
-	if ((a.offset >> PAGE_SHIFT) != pgoff)
-		return -EINVAL;
-
-	if (!(a.flags & MAP_ANONYMOUS)) {
-		error = -EBADF;
-		file = fget(a.fd);
-		if (!file)
-			goto out;
-	}
-	a.flags &= ~(MAP_EXECUTABLE | MAP_DENYWRITE);
-
-	down_write(&current->mm->mmap_sem);
-	error = do_mmap_pgoff(file, a.addr, a.len, a.prot, a.flags, pgoff);
-	up_write(&current->mm->mmap_sem);
-	if (file)
-		fput(file);
+	error = sys_mmap_pgoff(a.addr, a.len, a.prot, a.flags, a.fd,
+			       a.offset >> PAGE_SHIFT);
 out:
 	return error;
 }
-#endif
 
 struct sel_arg_struct {
 	unsigned long n;
--- linux-rt-2.6.31.orig/tools/perf/builtin-stat.c
+++ linux-rt-2.6.31/tools/perf/builtin-stat.c
@@ -82,19 +82,32 @@
 static u64			event_res[MAX_RUN][MAX_COUNTERS][3];
 static u64			event_scaled[MAX_RUN][MAX_COUNTERS];
 
-static u64			event_res_avg[MAX_COUNTERS][3];
-static u64			event_res_noise[MAX_COUNTERS][3];
+struct stats
+{
+	double sum;
+	double sum_sq;
+};
 
-static u64			event_scaled_avg[MAX_COUNTERS];
+static double avg_stats(struct stats *stats)
+{
+	return stats->sum / run_count;
+}
 
-static u64			runtime_nsecs_avg;
-static u64			runtime_nsecs_noise;
+/*
+ * stddev = sqrt(1/N (\Sum n_i^2) - avg(n)^2)
+ */
+static double stddev_stats(struct stats *stats)
+{
+	double avg = stats->sum / run_count;
 
-static u64			walltime_nsecs_avg;
-static u64			walltime_nsecs_noise;
+	return sqrt(stats->sum_sq/run_count - avg*avg);
+}
 
-static u64			runtime_cycles_avg;
-static u64			runtime_cycles_noise;
+struct stats			event_res_stats[MAX_COUNTERS][3];
+struct stats			event_scaled_stats[MAX_COUNTERS];
+struct stats			runtime_nsecs_stats;
+struct stats			walltime_nsecs_stats;
+struct stats			runtime_cycles_stats;
 
 #define MATCH_EVENT(t, c, counter)			\
 	(attrs[counter].type == PERF_TYPE_##t &&	\
@@ -278,42 +291,37 @@
 	return WEXITSTATUS(status);
 }
 
-static void print_noise(u64 *count, u64 *noise)
+static void print_noise(double avg, double stddev)
 {
 	if (run_count > 1)
-		fprintf(stderr, "   ( +- %7.3f%% )",
-			(double)noise[0]/(count[0]+1)*100.0);
+		fprintf(stderr, "   ( +- %7.3f%% )", 100*stddev / avg);
 }
 
-static void nsec_printout(int counter, u64 *count, u64 *noise)
+static void nsec_printout(int counter, double avg, double stddev)
 {
-	double msecs = (double)count[0] / 1000000;
+	double msecs = avg / 1e6;
 
 	fprintf(stderr, " %14.6f  %-24s", msecs, event_name(counter));
 
 	if (MATCH_EVENT(SOFTWARE, SW_TASK_CLOCK, counter)) {
-		if (walltime_nsecs_avg)
-			fprintf(stderr, " # %10.3f CPUs ",
-				(double)count[0] / (double)walltime_nsecs_avg);
+		fprintf(stderr, " # %10.3f CPUs ",
+				avg / avg_stats(&walltime_nsecs_stats));
 	}
-	print_noise(count, noise);
+	print_noise(avg, stddev);
 }
 
-static void abs_printout(int counter, u64 *count, u64 *noise)
+static void abs_printout(int counter, double avg, double stddev)
 {
-	fprintf(stderr, " %14Ld  %-24s", count[0], event_name(counter));
+	fprintf(stderr, " %14.0f  %-24s", avg, event_name(counter));
 
-	if (runtime_cycles_avg &&
-	    MATCH_EVENT(HARDWARE, HW_INSTRUCTIONS, counter)) {
+	if (MATCH_EVENT(HARDWARE, HW_INSTRUCTIONS, counter)) {
 		fprintf(stderr, " # %10.3f IPC  ",
-			(double)count[0] / (double)runtime_cycles_avg);
+				avg / avg_stats(&runtime_cycles_stats));
 	} else {
-		if (runtime_nsecs_avg) {
-			fprintf(stderr, " # %10.3f M/sec",
-				(double)count[0]/runtime_nsecs_avg*1000.0);
-		}
+		fprintf(stderr, " # %10.3f M/sec",
+				1000.0 * avg / avg_stats(&runtime_nsecs_stats));
 	}
-	print_noise(count, noise);
+	print_noise(avg, stddev);
 }
 
 /*
@@ -321,12 +329,12 @@
  */
 static void print_counter(int counter)
 {
-	u64 *count, *noise;
+	double avg, stddev;
 	int scaled;
 
-	count = event_res_avg[counter];
-	noise = event_res_noise[counter];
-	scaled = event_scaled_avg[counter];
+	avg    = avg_stats(&event_res_stats[counter][0]);
+	stddev = stddev_stats(&event_res_stats[counter][0]);
+	scaled = avg_stats(&event_scaled_stats[counter]);
 
 	if (scaled == -1) {
 		fprintf(stderr, " %14s  %-24s\n",
@@ -335,36 +343,34 @@
 	}
 
 	if (nsec_counter(counter))
-		nsec_printout(counter, count, noise);
+		nsec_printout(counter, avg, stddev);
 	else
-		abs_printout(counter, count, noise);
+		abs_printout(counter, avg, stddev);
+
+	if (scaled) {
+		double avg_enabled, avg_running;
+
+		avg_enabled = avg_stats(&event_res_stats[counter][1]);
+		avg_running = avg_stats(&event_res_stats[counter][2]);
 
-	if (scaled)
 		fprintf(stderr, "  (scaled from %.2f%%)",
-			(double) count[2] / count[1] * 100);
+				100 * avg_running / avg_enabled);
+	}
 
 	fprintf(stderr, "\n");
 }
 
-/*
- * normalize_noise noise values down to stddev:
- */
-static void normalize_noise(u64 *val)
+static void update_stats(const char *name, int idx, struct stats *stats, u64 *val)
 {
-	double res;
+	double sq = *val;
 
-	res = (double)*val / (run_count * sqrt((double)run_count));
-
-	*val = (u64)res;
-}
-
-static void update_avg(const char *name, int idx, u64 *avg, u64 *val)
-{
-	*avg += *val;
+	stats->sum += *val;
+	stats->sum_sq += sq * sq;
 
 	if (verbose > 1)
 		fprintf(stderr, "debug: %20s[%d]: %Ld\n", name, idx, *val);
 }
+
 /*
  * Calculate the averages and noises:
  */
@@ -376,61 +382,22 @@
 		fprintf(stderr, "\n");
 
 	for (i = 0; i < run_count; i++) {
-		update_avg("runtime", 0, &runtime_nsecs_avg, runtime_nsecs + i);
-		update_avg("walltime", 0, &walltime_nsecs_avg, walltime_nsecs + i);
-		update_avg("runtime_cycles", 0, &runtime_cycles_avg, runtime_cycles + i);
+		update_stats("runtime", 0, &runtime_nsecs_stats, runtime_nsecs + i);
+		update_stats("walltime", 0, &walltime_nsecs_stats, walltime_nsecs + i);
+		update_stats("runtime_cycles", 0, &runtime_cycles_stats, runtime_cycles + i);
 
 		for (j = 0; j < nr_counters; j++) {
-			update_avg("counter/0", j,
-				event_res_avg[j]+0, event_res[i][j]+0);
-			update_avg("counter/1", j,
-				event_res_avg[j]+1, event_res[i][j]+1);
-			update_avg("counter/2", j,
-				event_res_avg[j]+2, event_res[i][j]+2);
+			update_stats("counter/0", j,
+				event_res_stats[j]+0, event_res[i][j]+0);
+			update_stats("counter/1", j,
+				event_res_stats[j]+1, event_res[i][j]+1);
+			update_stats("counter/2", j,
+				event_res_stats[j]+2, event_res[i][j]+2);
 			if (event_scaled[i][j] != (u64)-1)
-				update_avg("scaled", j,
-					event_scaled_avg + j, event_scaled[i]+j);
-			else
-				event_scaled_avg[j] = -1;
-		}
-	}
-	runtime_nsecs_avg /= run_count;
-	walltime_nsecs_avg /= run_count;
-	runtime_cycles_avg /= run_count;
-
-	for (j = 0; j < nr_counters; j++) {
-		event_res_avg[j][0] /= run_count;
-		event_res_avg[j][1] /= run_count;
-		event_res_avg[j][2] /= run_count;
-	}
-
-	for (i = 0; i < run_count; i++) {
-		runtime_nsecs_noise +=
-			abs((s64)(runtime_nsecs[i] - runtime_nsecs_avg));
-		walltime_nsecs_noise +=
-			abs((s64)(walltime_nsecs[i] - walltime_nsecs_avg));
-		runtime_cycles_noise +=
-			abs((s64)(runtime_cycles[i] - runtime_cycles_avg));
-
-		for (j = 0; j < nr_counters; j++) {
-			event_res_noise[j][0] +=
-				abs((s64)(event_res[i][j][0] - event_res_avg[j][0]));
-			event_res_noise[j][1] +=
-				abs((s64)(event_res[i][j][1] - event_res_avg[j][1]));
-			event_res_noise[j][2] +=
-				abs((s64)(event_res[i][j][2] - event_res_avg[j][2]));
+				update_stats("scaled", j,
+					event_scaled_stats + j, event_scaled[i]+j);
 		}
 	}
-
-	normalize_noise(&runtime_nsecs_noise);
-	normalize_noise(&walltime_nsecs_noise);
-	normalize_noise(&runtime_cycles_noise);
-
-	for (j = 0; j < nr_counters; j++) {
-		normalize_noise(&event_res_noise[j][0]);
-		normalize_noise(&event_res_noise[j][1]);
-		normalize_noise(&event_res_noise[j][2]);
-	}
 }
 
 static void print_stat(int argc, const char **argv)
@@ -457,10 +424,11 @@
 
 	fprintf(stderr, "\n");
 	fprintf(stderr, " %14.9f  seconds time elapsed",
-			(double)walltime_nsecs_avg/1e9);
+			avg_stats(&walltime_nsecs_stats)/1e9);
 	if (run_count > 1) {
 		fprintf(stderr, "   ( +- %7.3f%% )",
-			100.0*(double)walltime_nsecs_noise/(double)walltime_nsecs_avg);
+				100*stddev_stats(&walltime_nsecs_stats) /
+				avg_stats(&walltime_nsecs_stats));
 	}
 	fprintf(stderr, "\n\n");
 }
--- linux-rt-2.6.31.orig/tools/perf/builtin-report.c
+++ linux-rt-2.6.31/tools/perf/builtin-report.c
@@ -1857,8 +1857,8 @@
 		exit(-1);
 	}
 
-	if (!force && (stat.st_uid != geteuid())) {
-		fprintf(stderr, "file: %s not owned by current user\n", input_name);
+	if (!force && stat.st_uid && (stat.st_uid != geteuid())) {
+		fprintf(stderr, "file: %s not owned by current user or root\n", input_name);
 		exit(-1);
 	}
 
--- linux-rt-2.6.31.orig/tools/perf/builtin-annotate.c
+++ linux-rt-2.6.31/tools/perf/builtin-annotate.c
@@ -1335,8 +1335,8 @@
 		exit(-1);
 	}
 
-	if (!force && (stat.st_uid != geteuid())) {
-		fprintf(stderr, "file: %s not owned by current user\n", input_name);
+	if (!force && stat.st_uid && (stat.st_uid != geteuid())) {
+		fprintf(stderr, "file: %s not owned by current user or root\n", input_name);
 		exit(-1);
 	}
 
--- linux-rt-2.6.31.orig/tools/perf/util/module.c
+++ linux-rt-2.6.31/tools/perf/util/module.c
@@ -422,7 +422,7 @@
 	len += strlen(uts.release);
 	len += strlen("/modules.dep");
 
-	path = calloc(1, len);
+	path = calloc(1, len + 1);
 	if (path == NULL)
 		goto out_failure;
 
--- linux-rt-2.6.31.orig/ubuntu/LIST
+++ linux-rt-2.6.31/ubuntu/LIST
@@ -0,0 +1,50 @@
+AUFS_BDEV_LOOP
+AUFS_BRANCH_MAX_1023
+AUFS_BRANCH_MAX_127
+AUFS_BRANCH_MAX_32767
+AUFS_BRANCH_MAX_511
+AUFS_BR_FUSE
+AUFS_BR_RAMFS
+AUFS_DEBUG
+AUFS_EXPORT
+AUFS_FS
+AUFS_HINOTIFY
+AUFS_INO_T_64
+AUFS_MAGIC_SYSRQ
+AUFS_POLL
+AUFS_SHWH
+AVERATEC_5100P
+BLK_DEV_COMPCACHE
+BLK_DEV_COMPCACHE_DEBUG
+BLK_DEV_COMPCACHE_STATS
+BLK_DEV_DRBD
+DM_RAID45
+FSAM7400
+LENOVO_SL_LAPTOP
+LIRC_ATIUSB
+LIRC_BT829
+LIRC_ENE0100
+LIRC_CONFIG_LIRC_WPC8769L
+LIRC_DEV
+LIRC_GPIO
+LIRC_I2C
+LIRC_IGORPLUGUSB
+LIRC_IMON
+LIRC_IT87
+LIRC_ITE8709
+LIRC_MCEUSB
+LIRC_PARALLEL
+LIRC_SASEM
+LIRC_SERIAL
+LIRC_SIR
+LIRC_STREAMZAP
+LIRC_TTUSBIR
+LMPCM_USB
+NDISWRAPPER
+PACKARDBELL_E5
+SCSI_ISCSITARGET
+SECURITY_APPARMOR
+SECURITY_APPARMOR_BOOTPARAM_VALUE
+SECURITY_APPARMOR_DISABLE
+SECURITY_APPARMOR_NETWORK
+TLSUP
--- linux-rt-2.6.31.orig/ubuntu/Makefile
+++ linux-rt-2.6.31/ubuntu/Makefile
@@ -0,0 +1,19 @@
+#
+# Makefile for the Linux kernel ubuntu supplied third-party device drivers.
+#
+
+obj-$(CONFIG_SECURITY_APPARMOR)        += apparmor/
+
+obj-$(CONFIG_BLK_DEV_DRBD)	+= drbd/
+obj-$(CONFIG_SCSI_ISCSITARGET)	+= iscsitarget/
+obj-$(CONFIG_AUFS_FS)		+= aufs/
+obj-$(CONFIG_DM_RAID45)		+= dm-raid4-5/
+obj-$(CONFIG_NDISWRAPPER)	+= ndiswrapper/
+obj-$(CONFIG_BLK_DEV_COMPCACHE)	+= compcache/
+obj-$(CONFIG_LIRC_DEV)          += lirc/
+obj-$(CONFIG_LENOVO_SL_LAPTOP)	+= lenovo-sl-laptop/
+
+obj-m				+= misc/ rfkill/
+
+# This is a stupid trick to get kbuild to create ubuntu/built-in.o
+obj- += foo.o
--- linux-rt-2.6.31.orig/ubuntu/Kconfig
+++ linux-rt-2.6.31/ubuntu/Kconfig
@@ -0,0 +1,16 @@
+menu "Ubuntu Supplied Third-Party Device Drivers"
+
+source "ubuntu/apparmor/Kconfig"
+
+source "ubuntu/drbd/Kconfig"
+source "ubuntu/iscsitarget/Kconfig"
+source "ubuntu/aufs/Kconfig"
+source "ubuntu/dm-raid4-5/Kconfig"
+source "ubuntu/ndiswrapper/Kconfig"
+source "ubuntu/compcache/Kconfig"
+source "ubuntu/lirc/Kconfig"
+source "ubuntu/misc/Kconfig"
+source "ubuntu/rfkill/Kconfig"
+source "ubuntu/lenovo-sl-laptop/Kconfig"
+
+endmenu
--- linux-rt-2.6.31.orig/ubuntu/rfkill/BOM
+++ linux-rt-2.6.31/ubuntu/rfkill/BOM
@@ -0,0 +1,6 @@
+Downloaded from:	http://sourceforge.net/project/showfiles.php?group_id=108766
+Current Version:	1.3
+Comments:
+
+Had to change &proc_root to NULL due to changes in create/remove proc
+entry usage.
--- linux-rt-2.6.31.orig/ubuntu/rfkill/Makefile
+++ linux-rt-2.6.31/ubuntu/rfkill/Makefile
@@ -0,0 +1,6 @@
+#
+# Makefile for Ubuntu additional drivers
+#
+
+obj-$(CONFIG_AVERATEC_5100P)	+= av5100.o
+obj-$(CONFIG_PACKARDBELL_E5)	+= pbe5.o
--- linux-rt-2.6.31.orig/ubuntu/rfkill/Kconfig
+++ linux-rt-2.6.31/ubuntu/rfkill/Kconfig
@@ -0,0 +1,7 @@
+config AVERATEC_5100P
+	tristate "Software kill switch for Averatec 5100P"
+	default m
+
+config PACKARDBELL_E5
+	tristate "Software kill switch for Packard Bell EasyNote E5"
+	default m
--- linux-rt-2.6.31.orig/ubuntu/rfkill/av5100.c
+++ linux-rt-2.6.31/ubuntu/rfkill/av5100.c
@@ -0,0 +1,174 @@
+/*******************************************************************************
+  
+  Copyright(c) 2003 - 2004 Intel Corporation. All rights reserved.
+  
+  This program is free software; you can redistribute it and/or modify it 
+  under the terms of version 2 of the GNU General Public License as 
+  published by the Free Software Foundation.
+  
+  This program is distributed in the hope that it will be useful, but WITHOUT 
+  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 
+  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for 
+  more details.
+  
+  You should have received a copy of the GNU General Public License along with
+  this program; if not, write to the Free Software Foundation, Inc., 59 
+  Temple Place - Suite 330, Boston, MA  02111-1307, USA.
+  
+  The full GNU General Public License is included in this distribution in the
+  file called LICENSE.
+  
+  Contact Information:
+  James P. Ketrenos <ipw2100-admin@linux.intel.com>
+  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+
+*******************************************************************************/
+#include <linux/compiler.h>
+#include <linux/errno.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/types.h>
+#include <linux/netdevice.h>
+#include <linux/version.h>
+#include <linux/proc_fs.h>
+#include <linux/ioport.h>
+#include <asm/uaccess.h>
+#include <asm/io.h>
+
+
+#define DRV_NAME		"av5100"
+#define DRV_VERSION		"1.3"
+#define DRV_DESCRIPTION		"SW RF kill switch for Averatec 5100P"
+#define DRV_COPYRIGHT		"Copyright(c) 2003-2004 Intel Corporation"
+
+static int radio = 1;
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,0)
+
+MODULE_PARM(radio, "i");
+
+#else /* LINUX_VERSION_CODE < 2.6.0 */
+
+#include <linux/moduleparam.h>
+module_param(radio, int, 1);
+
+#endif /* LINUX_VERSION_CODE < 2.6.0 */
+
+MODULE_PARM_DESC(radio, "controls state of radio (1=on, 0=off)");
+
+MODULE_DESCRIPTION(DRV_DESCRIPTION);
+MODULE_AUTHOR(DRV_COPYRIGHT);
+MODULE_LICENSE("GPL");
+
+#define AV5100_RADIO_ON (0xe0)
+#define AV5100_RADIO_OFF (0xe1)
+
+static int av5100_radio = AV5100_RADIO_OFF;
+
+static void av5100_set_radio(int state)
+{
+	printk(KERN_INFO DRV_NAME ": Radio being turned %s\n",
+	       (state  == AV5100_RADIO_ON) ? "ON" : "OFF");
+	outl(0x80020800, 0xcf8);
+	outb(0x6f, 0x0072);
+	outl(0x1800ffff, 0x1184); 
+	outb(state, 0x00b2);
+	av5100_radio = state;
+}
+
+
+/*
+ * proc stuff
+ */
+static struct proc_dir_entry *dir_base = NULL;
+
+static int proc_set_radio(struct file *file, const char *buffer, 
+			  unsigned long count, void *data)
+{
+	av5100_set_radio(buffer[0] == '0' ? AV5100_RADIO_OFF : AV5100_RADIO_ON);
+	
+	return count;
+}
+
+static int proc_get_radio(char *page, char **start, off_t offset,
+			  int count, int *eof, void *data)
+{
+	int len = 0;
+	
+	len += snprintf(page, count, DRV_NAME ": %d\n", 
+			av5100_radio == AV5100_RADIO_OFF ? 0 : 1);
+	
+	*eof = 1;
+	return len;
+}
+
+
+static void av5100_proc_cleanup(void)
+{
+	if (dir_base) {
+		remove_proc_entry("radio", dir_base);
+		remove_proc_entry(DRV_NAME, NULL);
+		dir_base = NULL;
+	}
+}
+
+
+static int av5100_proc_init(void)
+{
+	struct proc_dir_entry *ent;
+	int err = 0;
+
+	dir_base = create_proc_entry(DRV_NAME, S_IFDIR, NULL);
+	if (dir_base == NULL) {
+		printk(KERN_ERR DRV_NAME ": Unable to initialise /proc/" 
+		       DRV_NAME "\n");
+		err = -ENOMEM;
+		goto fail;
+	}
+
+
+	ent = create_proc_entry("radio", S_IFREG | S_IRUGO | S_IWUSR, 
+				dir_base);
+	if (ent) {
+		ent->read_proc = proc_get_radio;
+		ent->write_proc = proc_set_radio;
+	} else {
+		printk(KERN_ERR
+		       "Unable to initialize /proc/" DRV_NAME "/radio\n");
+		err = -ENOMEM;
+		goto fail;
+	}
+
+	return 0;
+
+ fail:
+	av5100_proc_cleanup();
+	return err;
+}
+
+/*
+ * module stuff
+ */
+static int __init av5100_init(void)
+{
+	av5100_proc_init();
+
+	av5100_set_radio((radio == 1) ? AV5100_RADIO_ON : AV5100_RADIO_OFF);
+	
+	return 0;
+}
+
+static void __exit av5100_exit(void)
+{
+	av5100_set_radio(AV5100_RADIO_OFF);
+
+	av5100_proc_cleanup();
+}
+
+module_init(av5100_init);
+module_exit(av5100_exit);
+
+/*
+         1         2         3         4         5         6         7
+12345678901234567890123456789012345678901234567890123456789012345678901234567890
+*/
--- linux-rt-2.6.31.orig/ubuntu/rfkill/pbe5.c
+++ linux-rt-2.6.31/ubuntu/rfkill/pbe5.c
@@ -0,0 +1,205 @@
+/*******************************************************************************
+  
+  This program is free software; you can redistribute it and/or modify it 
+  under the terms of version 2 of the GNU General Public License as 
+  published by the Free Software Foundation.
+  
+  This program is distributed in the hope that it will be useful, but WITHOUT 
+  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 
+  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for 
+  more details.
+  
+  You should have received a copy of the GNU General Public License along with
+  this program; if not, write to the Free Software Foundation, Inc., 59 
+  Temple Place - Suite 330, Boston, MA  02111-1307, USA.
+  
+  The full GNU General Public License is included in this distribution in the
+  file called LICENSE.
+  
+  Author:
+  Pedro Ramalhais <pmr09313@students.fct.unl.pt>
+  
+  Based on:
+  av5100.c from http://ipw2100.sourceforge.net/
+
+*******************************************************************************/
+
+#include <linux/compiler.h>
+#include <linux/errno.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/types.h>
+#include <linux/netdevice.h>
+#include <linux/version.h>
+#include <linux/proc_fs.h>
+#include <linux/ioport.h>
+#include <asm/uaccess.h>
+#include <asm/io.h>
+
+#define DRV_NAME		"pbe5"
+#define DRV_VERSION		"1.3"
+#define DRV_DESCRIPTION		"SW RF kill switch for Packard Bell EasyNote E5"
+#define DRV_AUTHOR		"Pedro Ramalhais"
+#define DRV_LICENSE		"GPL"
+
+static int radio = 1;
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,0)
+
+MODULE_PARM(radio, "i");
+
+#else /* LINUX_VERSION_CODE < 2.6.0 */
+
+#include <linux/moduleparam.h>
+module_param(radio, int, 1);
+
+#endif /* LINUX_VERSION_CODE < 2.6.0 */
+
+MODULE_PARM_DESC(radio, "controls state of radio (1=on, 0=off)");
+
+MODULE_DESCRIPTION(DRV_DESCRIPTION);
+MODULE_AUTHOR(DRV_AUTHOR);
+MODULE_LICENSE(DRV_LICENSE);
+
+/*
+ * NOTE: These values were obtained from disassembling the Icon.exe program
+ * installed in the Packard Bell EasyNote E5 laptop. The names were guessed,
+ * so don't rely on them.
+ */
+#define PBE5_PORT_TOGGLE	0x0b3
+#define PBE5_VALUE_TOGGLE_ON	0x01
+#define PBE5_VALUE_TOGGLE_OFF	0x00
+#define PBE5_PORT_APPLY		0x0b2
+#define PBE5_VALUE_APPLY	0xef
+
+// Some "booleans" =;-)
+#define PBE5_RADIO_OFF	0
+#define PBE5_RADIO_ON	1
+
+static int pbe5_radio_status = PBE5_RADIO_ON;
+
+unsigned char pbe5_get_radio(void)
+{
+	unsigned char val = 0x00;
+
+	val = inb(PBE5_PORT_TOGGLE);
+
+	return val;
+}
+
+static void pbe5_set_radio(int state_set)
+{
+	pbe5_radio_status = pbe5_get_radio();
+
+	if (pbe5_radio_status != state_set) {
+		// Set the radio toggle register
+		outb(PBE5_VALUE_TOGGLE_ON, PBE5_PORT_TOGGLE);
+		// Commit the radio toggle register value
+		outb(PBE5_VALUE_APPLY, PBE5_PORT_APPLY);
+		// Update the radio status
+		pbe5_radio_status = pbe5_get_radio();
+
+		printk(KERN_INFO DRV_NAME ": Radio turned %s\n",
+			(state_set  == PBE5_RADIO_ON) ? "ON" : "OFF");
+	} else {
+		printk(KERN_INFO DRV_NAME ": Radio already %s\n",
+			(state_set  == PBE5_RADIO_ON) ? "ON" : "OFF");
+	}
+}
+
+
+/*
+ * proc stuff
+ */
+static struct proc_dir_entry *dir_base = NULL;
+
+static int proc_set_radio(struct file *file, const char *buffer, 
+			  unsigned long count, void *data)
+{
+	pbe5_set_radio(buffer[0] == '0' ? PBE5_RADIO_OFF : PBE5_RADIO_ON);
+
+	return count;
+}
+
+static int proc_get_radio(char *page, char **start, off_t offset,
+			  int count, int *eof, void *data)
+{
+	int len = 0;
+
+	len += snprintf(page, count, DRV_NAME ": %d\n", 
+			pbe5_radio_status == PBE5_RADIO_OFF ? 0 : 1);
+
+	*eof = 1;
+	return len;
+}
+
+
+static void pbe5_proc_cleanup(void)
+{
+	if (dir_base) {
+		remove_proc_entry("radio", dir_base);
+		remove_proc_entry(DRV_NAME, NULL);
+		dir_base = NULL;
+	}
+}
+
+
+static int pbe5_proc_init(void)
+{
+	struct proc_dir_entry *ent;
+	int err = 0;
+
+	dir_base = create_proc_entry(DRV_NAME, S_IFDIR, NULL);
+	if (dir_base == NULL) {
+		printk(KERN_ERR DRV_NAME ": Unable to initialise /proc/"
+		       DRV_NAME "\n");
+		err = -ENOMEM;
+		goto fail;
+	}
+
+
+	ent = create_proc_entry("radio", S_IFREG | S_IRUGO | S_IWUSR,
+				dir_base);
+	if (ent) {
+		ent->read_proc = proc_get_radio;
+		ent->write_proc = proc_set_radio;
+	} else {
+		printk(KERN_ERR
+		       "Unable to initialize /proc/" DRV_NAME "/radio\n");
+		err = -ENOMEM;
+		goto fail;
+	}
+
+	return 0;
+
+ fail:
+	pbe5_proc_cleanup();
+	return err;
+}
+
+/*
+ * module stuff
+ */
+static int __init pbe5_init(void)
+{
+	pbe5_proc_init();
+
+	pbe5_set_radio((radio == 1) ? PBE5_RADIO_ON : PBE5_RADIO_OFF);
+
+	return 0;
+}
+
+static void __exit pbe5_exit(void)
+{
+	pbe5_set_radio(PBE5_RADIO_OFF);
+
+	pbe5_proc_cleanup();
+}
+
+module_init(pbe5_init);
+module_exit(pbe5_exit);
+
+/*
+         1         2         3         4         5         6         7
+12345678901234567890123456789012345678901234567890123456789012345678901234567890
+*/
--- linux-rt-2.6.31.orig/ubuntu/dm-raid4-5/dm-raid4-5.c
+++ linux-rt-2.6.31/ubuntu/dm-raid4-5/dm-raid4-5.c
@@ -0,0 +1,4547 @@
+/*[A[A
+ * Copyright (C) 2005-2009 Red Hat, Inc. All rights reserved.
+ *
+ * Module Author: Heinz Mauelshagen <heinzm@redhat.com>
+ *
+ * This file is released under the GPL.
+ *
+ *
+ * Linux 2.6 Device Mapper RAID4 and RAID5 target.
+ *
+ * Supports:
+ *	o RAID4 with dedicated and selectable parity device
+ *	o RAID5 with rotating parity (left+right, symmetric+asymmetric)
+ *	o recovery of out of sync device for initial
+ *	  RAID set creation or after dead drive replacement
+ *	o run time optimization of xor algorithm used to calculate parity
+ *
+ *
+ * Thanks to MD for:
+ *    o the raid address calculation algorithm
+ *    o the base of the biovec <-> page list copier.
+ *
+ *
+ * Uses region hash to keep track of how many writes are in flight to
+ * regions in order to use dirty log to keep state of regions to recover:
+ *
+ *    o clean regions (those which are synchronized
+ * 	and don't have write io in flight)
+ *    o dirty regions (those with write io in flight)
+ *
+ *
+ * On startup, any dirty regions are migrated to the
+ * 'nosync' state and are subject to recovery by the daemon.
+ *
+ * See raid_ctr() for table definition.
+ *
+ * FIXME: recovery bandwidth
+ */ 
+
+static const char *version = "v0.2594b";
+
+#include "dm.h"
+#include "dm-memcache.h"
+#include "dm-message.h"
+#include "dm-raid45.h"
+
+#include <linux/kernel.h>
+#include <linux/vmalloc.h>
+#include <linux/raid/xor.h>
+
+#include <linux/bio.h>
+#include <linux/dm-io.h>
+#include <linux/dm-dirty-log.h>
+#include "dm-region-hash.h"
+
+
+/*
+ * Configurable parameters
+ */
+
+/* Minimum/maximum and default # of selectable stripes. */
+#define	STRIPES_MIN		8
+#define	STRIPES_MAX		16384
+#define	STRIPES_DEFAULT		80
+
+/* Maximum and default chunk size in sectors if not set in constructor. */
+#define	CHUNK_SIZE_MIN		8
+#define	CHUNK_SIZE_MAX		16384
+#define	CHUNK_SIZE_DEFAULT	64
+
+/* Default io size in sectors if not set in constructor. */
+#define	IO_SIZE_MIN		CHUNK_SIZE_MIN
+#define	IO_SIZE_DEFAULT		IO_SIZE_MIN
+
+/* Recover io size default in sectors. */
+#define	RECOVER_IO_SIZE_MIN		64
+#define	RECOVER_IO_SIZE_DEFAULT		256
+
+/* Default, minimum and maximum percentage of recover io bandwidth. */
+#define	BANDWIDTH_DEFAULT	10
+#define	BANDWIDTH_MIN		1
+#define	BANDWIDTH_MAX		100
+
+/* # of parallel recovered regions */
+#define RECOVERY_STRIPES_MIN	1
+#define RECOVERY_STRIPES_MAX	64
+#define RECOVERY_STRIPES_DEFAULT	RECOVERY_STRIPES_MIN
+/*
+ * END Configurable parameters
+ */
+
+#define	TARGET	"dm-raid45"
+#define	DAEMON	"kraid45d"
+#define	DM_MSG_PREFIX	TARGET
+
+#define	SECTORS_PER_PAGE	(PAGE_SIZE >> SECTOR_SHIFT)
+
+/* Amount/size for __xor(). */
+#define	XOR_SIZE	PAGE_SIZE
+
+/* Check value in range. */
+#define	range_ok(i, min, max)	(i >= min && i <= max)
+
+/* Check argument is power of 2. */
+#define POWER_OF_2(a) (!(a & (a - 1)))
+
+/* Structure access macros. */
+/* Derive raid_set from stripe_cache pointer. */
+#define	RS(x)	container_of(x, struct raid_set, sc)
+
+/* Page reference. */
+#define PAGE(stripe, p)  ((stripe)->obj[p].pl->page)
+
+/* Stripe chunk reference. */
+#define CHUNK(stripe, p) ((stripe)->chunk + p)
+
+/* Bio list reference. */
+#define	BL(stripe, p, rw)	(stripe->chunk[p].bl + rw)
+#define	BL_CHUNK(chunk, rw)	(chunk->bl + rw)
+
+/* Page list reference. */
+#define	PL(stripe, p)		(stripe->obj[p].pl)
+/* END: structure access macros. */
+
+/* Factor out to dm-bio-list.h */
+static inline void bio_list_push(struct bio_list *bl, struct bio *bio)
+{
+	bio->bi_next = bl->head;
+	bl->head = bio;
+
+	if (!bl->tail)
+		bl->tail = bio;
+}
+
+/* Factor out to dm.h */
+#define TI_ERR_RET(str, ret) \
+	do { ti->error = str; return ret; } while (0);
+#define TI_ERR(str)     TI_ERR_RET(str, -EINVAL)
+
+/* Macro to define access IO flags access inline functions. */
+#define	BITOPS(name, what, var, flag) \
+static inline int TestClear ## name ## what(struct var *v) \
+{ return test_and_clear_bit(flag, &v->io.flags); } \
+static inline int TestSet ## name ## what(struct var *v) \
+{ return test_and_set_bit(flag, &v->io.flags); } \
+static inline void Clear ## name ## what(struct var *v) \
+{ clear_bit(flag, &v->io.flags); } \
+static inline void Set ## name ## what(struct var *v) \
+{ set_bit(flag, &v->io.flags); } \
+static inline int name ## what(struct var *v) \
+{ return test_bit(flag, &v->io.flags); }
+
+/*-----------------------------------------------------------------
+ * Stripe cache
+ *
+ * Cache for all reads and writes to raid sets (operational or degraded)
+ *
+ * We need to run all data to and from a RAID set through this cache,
+ * because parity chunks need to get calculated from data chunks
+ * or, in the degraded/resynchronization case, missing chunks need
+ * to be reconstructed using the other chunks of the stripe.
+ *---------------------------------------------------------------*/
+/* A chunk within a stripe (holds bios hanging off). */
+/* IO status flags for chunks of a stripe. */
+enum chunk_flags {
+	CHUNK_DIRTY,		/* Pages of chunk dirty; need writing. */
+	CHUNK_ERROR,		/* IO error on any chunk page. */
+	CHUNK_IO,		/* Allow/prohibit IO on chunk pages. */
+	CHUNK_LOCKED,		/* Chunk pages locked during IO. */
+	CHUNK_MUST_IO,		/* Chunk must io. */
+	CHUNK_UNLOCK,		/* Enforce chunk unlock. */
+	CHUNK_UPTODATE,		/* Chunk pages are uptodate. */
+};
+
+#if READ != 0 || WRITE != 1
+#error dm-raid45: READ/WRITE != 0/1 used as index!!!
+#endif
+
+enum bl_type {
+	WRITE_QUEUED = WRITE + 1,
+	WRITE_MERGED,
+	NR_BL_TYPES,	/* Must be last one! */
+};
+struct stripe_chunk {
+	atomic_t cnt;		/* Reference count. */
+	struct stripe *stripe;	/* Backpointer to stripe for endio(). */
+	/* Bio lists for reads, writes, and writes merged. */
+	struct bio_list bl[NR_BL_TYPES];
+	struct {
+		unsigned long flags; /* IO status flags. */
+	} io;
+};
+
+/* Define chunk bit operations. */
+BITOPS(Chunk, Dirty,	 stripe_chunk, CHUNK_DIRTY)
+BITOPS(Chunk, Error,	 stripe_chunk, CHUNK_ERROR)
+BITOPS(Chunk, Io,	 stripe_chunk, CHUNK_IO)
+BITOPS(Chunk, Locked,	 stripe_chunk, CHUNK_LOCKED)
+BITOPS(Chunk, MustIo,	 stripe_chunk, CHUNK_MUST_IO)
+BITOPS(Chunk, Unlock,	 stripe_chunk, CHUNK_UNLOCK)
+BITOPS(Chunk, Uptodate,	 stripe_chunk, CHUNK_UPTODATE)
+
+/*
+ * Stripe linked list indexes. Keep order, because the stripe
+ * and the stripe cache rely on the first 3!
+ */
+enum list_types {
+	LIST_FLUSH,	/* Stripes to flush for io. */
+	LIST_ENDIO,	/* Stripes to endio. */
+	LIST_LRU,	/* Least recently used stripes. */
+	SC_NR_LISTS,	/* # of lists in stripe cache. */
+	LIST_HASH = SC_NR_LISTS,	/* Hashed stripes. */
+	LIST_RECOVER = LIST_HASH, /* For recovery type stripes only. */
+	STRIPE_NR_LISTS,/* To size array in struct stripe. */
+};
+
+/* Adressing region recovery. */
+struct recover_addr {
+	struct dm_region *reg;	/* Actual region to recover. */
+	sector_t pos;	/* Position within region to recover. */
+	sector_t end;	/* End of region to recover. */
+};
+
+/* A stripe: the io object to handle all reads and writes to a RAID set. */
+struct stripe {
+	atomic_t cnt;			/* Reference count. */
+	struct stripe_cache *sc;	/* Backpointer to stripe cache. */
+
+	/*
+	 * 4 linked lists:
+	 *   o io list to flush io
+	 *   o endio list
+	 *   o LRU list to put stripes w/o reference count on
+	 *   o stripe cache hash
+	 */
+	struct list_head lists[STRIPE_NR_LISTS];
+
+	sector_t key;	 /* Hash key. */
+	region_t region; /* Region stripe is mapped to. */
+
+	struct {
+		unsigned long flags;	/* Stripe state flags (see below). */
+
+		/*
+		 * Pending ios in flight:
+		 *
+		 * used to control move of stripe to endio list
+		 */
+		atomic_t pending;
+
+		/* Sectors to read and write for multi page stripe sets. */
+		unsigned size;
+	} io;
+
+	/* Address region recovery. */
+	struct recover_addr *recover;
+
+	/* Lock on stripe (Future: for clustering). */
+	void *lock;
+
+	struct {
+		unsigned short parity;	/* Parity chunk index. */
+		short recover;		/* Recovery chunk index. */
+	} idx;
+
+	/*
+	 * This stripe's memory cache object (dm-mem-cache);
+	 * i.e. the io chunk pages.
+	 */
+	struct dm_mem_cache_object *obj;
+
+	/* Array of stripe sets (dynamically allocated). */
+	struct stripe_chunk chunk[0];
+};
+
+/* States stripes can be in (flags field). */
+enum stripe_states {
+	STRIPE_ERROR,		/* io error on stripe. */
+	STRIPE_MERGED,		/* Writes got merged to be written. */
+	STRIPE_RBW,		/* Read-before-write stripe. */
+	STRIPE_RECONSTRUCT,	/* Reconstruct of a missing chunk required. */
+	STRIPE_RECONSTRUCTED,	/* Reconstructed of a missing chunk. */
+	STRIPE_RECOVER,		/* Stripe used for RAID set recovery. */
+};
+
+/* Define stripe bit operations. */
+BITOPS(Stripe, Error,	      stripe, STRIPE_ERROR)
+BITOPS(Stripe, Merged,        stripe, STRIPE_MERGED)
+BITOPS(Stripe, RBW,	      stripe, STRIPE_RBW)
+BITOPS(Stripe, Reconstruct,   stripe, STRIPE_RECONSTRUCT)
+BITOPS(Stripe, Reconstructed, stripe, STRIPE_RECONSTRUCTED)
+BITOPS(Stripe, Recover,	      stripe, STRIPE_RECOVER)
+
+/* A stripe hash. */
+struct stripe_hash {
+	struct list_head *hash;
+	unsigned buckets;
+	unsigned mask;
+	unsigned prime;
+	unsigned shift;
+};
+
+enum sc_lock_types {
+	LOCK_ENDIO,	/* Protect endio list. */
+	LOCK_LRU,	/* Protect LRU list. */
+	NR_LOCKS,       /* To size array in struct stripe_cache. */
+};
+
+/* A stripe cache. */
+struct stripe_cache {
+	/* Stripe hash. */
+	struct stripe_hash hash;
+
+	spinlock_t locks[NR_LOCKS];	/* Locks to protect lists. */
+
+	/* Stripes with io to flush, stripes to endio and LRU lists. */
+	struct list_head lists[SC_NR_LISTS];
+
+	/* Slab cache to allocate stripes from. */
+	struct {
+		struct kmem_cache *cache;	/* Cache itself. */
+		char name[32];	/* Unique name. */
+	} kc;
+
+	struct dm_io_client *dm_io_client; /* dm-io client resource context. */
+
+	/* dm-mem-cache client resource context. */
+	struct dm_mem_cache_client *mem_cache_client;
+
+	int stripes_parm;	    /* # stripes parameter from constructor. */
+	atomic_t stripes;	    /* actual # of stripes in cache. */
+	atomic_t stripes_to_set;    /* # of stripes to resize cache to. */
+	atomic_t stripes_last;	    /* last # of stripes in cache. */
+	atomic_t active_stripes;    /* actual # of active stripes in cache. */
+
+	/* REMOVEME: */
+	atomic_t active_stripes_max; /* actual # of active stripes in cache. */
+};
+
+/* Flag specs for raid_dev */ ;
+enum raid_dev_flags {
+	DEV_FAILED,	/* Device failed. */
+	DEV_IO_QUEUED,	/* Io got queued to device. */
+};
+
+/* The raid device in a set. */
+struct raid_dev {
+	struct dm_dev *dev;
+	sector_t start;		/* Offset to map to. */
+	struct {	/* Using struct to be able to BITOPS(). */
+		unsigned long flags;	/* raid_dev_flags. */
+	} io;
+};
+
+BITOPS(Dev, Failed,   raid_dev, DEV_FAILED)
+BITOPS(Dev, IoQueued, raid_dev, DEV_IO_QUEUED)
+
+/* Flags spec for raid_set. */
+enum raid_set_flags {
+	RS_CHECK_OVERWRITE,	/* Check for chunk overwrites. */
+	RS_DEAD,		/* RAID set inoperational. */
+	RS_DEGRADED,		/* Io errors on RAID device. */
+	RS_DEVEL_STATS,		/* REMOVEME: display status information. */
+	RS_RECOVER,		/* Do recovery. */
+	RS_RECOVERY_BANDWIDTH,	/* Allow recovery bandwidth (delayed bios). */
+	RS_SC_BUSY,		/* Stripe cache busy -> send an event. */
+	RS_SUSPEND,		/* Suspend RAID set. */
+};
+
+/* REMOVEME: devel stats counters. */
+enum stats_types {
+	S_BIOS_READ,
+	S_BIOS_ADDED_READ,
+	S_BIOS_ENDIO_READ,
+	S_BIOS_WRITE,
+	S_BIOS_ADDED_WRITE,
+	S_BIOS_ENDIO_WRITE,
+	S_CAN_MERGE,
+	S_CANT_MERGE,
+	S_CONGESTED,
+	S_DM_IO_READ,
+	S_DM_IO_WRITE,
+	S_BANDWIDTH,
+	S_BARRIER,
+	S_BIO_COPY_PL_NEXT,
+	S_DEGRADED,
+	S_DELAYED_BIOS,
+	S_FLUSHS,
+	S_HITS_1ST,
+	S_IOS_POST,
+	S_INSCACHE,
+	S_MAX_LOOKUP,
+	S_CHUNK_LOCKED,
+	S_NO_BANDWIDTH,
+	S_NOT_CONGESTED,
+	S_NO_RW,
+	S_NOSYNC,
+	S_OVERWRITE,
+	S_PROHIBITCHUNKIO,
+	S_RECONSTRUCT_EI,
+	S_RECONSTRUCT_DEV,
+	S_RECONSTRUCT_SET,
+	S_RECONSTRUCTED,
+	S_REQUEUE,
+	S_STRIPE_ERROR,
+	S_SUM_DELAYED_BIOS,
+	S_XORS,
+	S_NR_STATS,	/* # of stats counters. Must be last! */
+};
+
+/* Status type -> string mappings. */
+struct stats_map {
+	const enum stats_types type;
+	const char *str;
+};
+
+static struct stats_map stats_map[] = {
+	{ S_BIOS_READ, "r=" },
+	{ S_BIOS_ADDED_READ, "/" },
+	{ S_BIOS_ENDIO_READ, "/" },
+	{ S_BIOS_WRITE, " w=" },
+	{ S_BIOS_ADDED_WRITE, "/" },
+	{ S_BIOS_ENDIO_WRITE, "/" },
+	{ S_DM_IO_READ, " rc=" },
+	{ S_DM_IO_WRITE, " wc=" },
+	{ S_BANDWIDTH, "\nbw=" },
+	{ S_NO_BANDWIDTH, " no_bw=" },
+	{ S_BARRIER, "\nbarrier=" },
+	{ S_BIO_COPY_PL_NEXT, "\nbio_cp_next=" },
+	{ S_CAN_MERGE, "\nmerge=" },
+	{ S_CANT_MERGE, "/no_merge=" },
+	{ S_CHUNK_LOCKED, "\nchunk_locked=" },
+	{ S_CONGESTED, "\ncgst=" },
+	{ S_NOT_CONGESTED, "/not_cgst=" },
+	{ S_DEGRADED, "\ndegraded=" },
+	{ S_DELAYED_BIOS, "\ndel_bios=" },
+	{ S_SUM_DELAYED_BIOS, "/sum_del_bios=" },
+	{ S_FLUSHS, "\nflushs=" },
+	{ S_HITS_1ST, "\nhits_1st=" },
+	{ S_IOS_POST, " ios_post=" },
+	{ S_INSCACHE, " inscache=" },
+	{ S_MAX_LOOKUP, " maxlookup=" },
+	{ S_NO_RW, "\nno_rw=" },
+	{ S_NOSYNC, " nosync=" },
+	{ S_OVERWRITE, " ovr=" },
+	{ S_PROHIBITCHUNKIO, " prhbt_io=" },
+	{ S_RECONSTRUCT_EI, "\nrec_ei=" },
+	{ S_RECONSTRUCT_DEV, " rec_dev=" },
+	{ S_RECONSTRUCT_SET, " rec_set=" },
+	{ S_RECONSTRUCTED, " rec=" },
+	{ S_REQUEUE, " requeue=" },
+	{ S_STRIPE_ERROR, " stripe_err=" },
+	{ S_XORS, " xors=" },
+};
+
+/*
+ * A RAID set.
+ */
+#define	dm_rh_client	dm_region_hash
+enum count_type { IO_WORK = 0, IO_RECOVER, IO_NR_COUNT };
+typedef void (*xor_function_t)(unsigned count, unsigned long **data);
+struct raid_set {
+	struct dm_target *ti;	/* Target pointer. */
+
+	struct {
+		unsigned long flags;	/* State flags. */
+		struct mutex in_lock;	/* Protects central input list below. */
+		struct bio_list in;	/* Pending ios (central input list). */
+		struct bio_list work;	/* ios work set. */
+		wait_queue_head_t suspendq;	/* suspend synchronization. */
+		atomic_t in_process;	/* counter of queued bios (suspendq). */
+		atomic_t in_process_max;/* counter of queued bios max. */
+
+		/* io work. */
+		struct workqueue_struct *wq;
+		struct delayed_work dws_do_raid;	/* For main worker. */
+		struct work_struct ws_do_table_event;	/* For event worker. */
+	} io;
+
+	/* Stripe locking abstraction. */
+	struct dm_raid45_locking_type *locking;
+
+	struct stripe_cache sc;	/* Stripe cache for this set. */
+
+	/* Xor optimization. */
+	struct {
+		struct xor_func *f;
+		unsigned chunks;
+		unsigned speed;
+	} xor;
+
+	/* Recovery parameters. */
+	struct recover {
+		struct dm_dirty_log *dl;	/* Dirty log. */
+		struct dm_rh_client *rh;	/* Region hash. */
+
+		struct dm_io_client *dm_io_client; /* recovery dm-io client. */
+		/* dm-mem-cache client resource context for recovery stripes. */
+		struct dm_mem_cache_client *mem_cache_client;
+
+		struct list_head stripes;	/* List of recovery stripes. */
+
+		region_t nr_regions;
+		region_t nr_regions_to_recover;
+		region_t nr_regions_recovered;
+		unsigned long start_jiffies;
+		unsigned long end_jiffies;
+
+		unsigned bandwidth;	 /* Recovery bandwidth [%]. */
+		unsigned bandwidth_work; /* Recovery bandwidth [factor]. */
+		unsigned bandwidth_parm; /*  " constructor parm. */
+		unsigned io_size;        /* recovery io size <= region size. */
+		unsigned io_size_parm;   /* recovery io size ctr parameter. */
+		unsigned recovery;	 /* Recovery allowed/prohibited. */
+		unsigned recovery_stripes; /* # of parallel recovery stripes. */
+
+		/* recovery io throttling. */
+		atomic_t io_count[IO_NR_COUNT];	/* counter recover/regular io.*/
+		unsigned long last_jiffies;
+	} recover;
+
+	/* RAID set parameters. */
+	struct {
+		struct raid_type *raid_type;	/* RAID type (eg, RAID4). */
+		unsigned raid_parms;	/* # variable raid parameters. */
+
+		unsigned chunk_size;	/* Sectors per chunk. */
+		unsigned chunk_size_parm;
+		unsigned chunk_shift;	/* rsector chunk size shift. */
+
+		unsigned io_size;	/* Sectors per io. */
+		unsigned io_size_parm;
+		unsigned io_mask;	/* Mask for bio_copy_page_list(). */
+		unsigned io_inv_mask;	/* Mask for raid_address(). */
+
+		sector_t sectors_per_dev;	/* Sectors per device. */
+
+		atomic_t failed_devs;		/* Amount of devices failed. */
+
+		/* Index of device to initialize. */
+		int dev_to_init;
+		int dev_to_init_parm;
+
+		/* Raid devices dynamically allocated. */
+		unsigned raid_devs;	/* # of RAID devices below. */
+		unsigned data_devs;	/* # of RAID data devices. */
+
+		int ei;		/* index of failed RAID device. */
+
+		/* Index of dedicated parity device (i.e. RAID4). */
+		int pi;
+		int pi_parm;	/* constructor parm for status output. */
+	} set;
+
+	/* REMOVEME: devel stats counters. */
+	atomic_t stats[S_NR_STATS];
+
+	/* Dynamically allocated temporary pointers for xor(). */
+	unsigned long **data;
+
+	/* Dynamically allocated RAID devices. Alignment? */
+	struct raid_dev dev[0];
+};
+
+/* Define RAID set bit operations. */
+BITOPS(RS, Bandwidth, raid_set, RS_RECOVERY_BANDWIDTH)
+BITOPS(RS, CheckOverwrite, raid_set, RS_CHECK_OVERWRITE)
+BITOPS(RS, Dead, raid_set, RS_DEAD)
+BITOPS(RS, Degraded, raid_set, RS_DEGRADED)
+BITOPS(RS, DevelStats, raid_set, RS_DEVEL_STATS)
+BITOPS(RS, Recover, raid_set, RS_RECOVER)
+BITOPS(RS, ScBusy, raid_set, RS_SC_BUSY)
+BITOPS(RS, Suspend, raid_set, RS_SUSPEND)
+#undef BITOPS
+
+/*-----------------------------------------------------------------
+ * Raid-4/5 set structures.
+ *---------------------------------------------------------------*/
+/* RAID level definitions. */
+enum raid_level {
+	raid4,
+	raid5,
+};
+
+/* Symmetric/Asymmetric, Left/Right parity rotating algorithms. */
+enum raid_algorithm {
+	none,
+	left_asym,
+	right_asym,
+	left_sym,
+	right_sym,
+};
+
+struct raid_type {
+	const char *name;		/* RAID algorithm. */
+	const char *descr;		/* Descriptor text for logging. */
+	const unsigned parity_devs;	/* # of parity devices. */
+	const unsigned minimal_devs;	/* minimal # of devices in set. */
+	const enum raid_level level;		/* RAID level. */
+	const enum raid_algorithm algorithm;	/* RAID algorithm. */
+};
+
+/* Supported raid types and properties. */
+static struct raid_type raid_types[] = {
+	{"raid4",    "RAID4 (dedicated parity disk)", 1, 3, raid4, none},
+	{"raid5_la", "RAID5 (left asymmetric)",       1, 3, raid5, left_asym},
+	{"raid5_ra", "RAID5 (right asymmetric)",      1, 3, raid5, right_asym},
+	{"raid5_ls", "RAID5 (left symmetric)",        1, 3, raid5, left_sym},
+	{"raid5_rs", "RAID5 (right symmetric)",       1, 3, raid5, right_sym},
+};
+
+/* Address as calculated by raid_address(). */
+struct raid_address {
+	sector_t key;		/* Hash key (address of stripe % chunk_size). */
+	unsigned di, pi;	/* Data and parity disks index. */
+};
+
+/* REMOVEME: reset statistics counters. */
+static void stats_reset(struct raid_set *rs)
+{
+	unsigned s = S_NR_STATS;
+
+	while (s--)
+		atomic_set(rs->stats + s, 0);
+}
+
+/*----------------------------------------------------------------
+ * RAID set management routines.
+ *--------------------------------------------------------------*/
+/*
+ * Begin small helper functions.
+ */
+/* No need to be called from region hash indirectly at dm_rh_dec(). */
+static void wake_dummy(void *context) {}
+
+/* Return # of io reference. */
+static int io_ref(struct raid_set *rs)
+{
+	return atomic_read(&rs->io.in_process);
+}
+
+/* Get an io reference. */
+static void io_get(struct raid_set *rs)
+{
+	int p = atomic_inc_return(&rs->io.in_process);
+
+	if (p > atomic_read(&rs->io.in_process_max))
+		atomic_set(&rs->io.in_process_max, p); /* REMOVEME: max. */
+}
+
+/* Put the io reference and conditionally wake io waiters. */
+static void io_put(struct raid_set *rs)
+{
+	/* Intel: rebuild data corrupter? */
+	if (atomic_dec_and_test(&rs->io.in_process))
+		wake_up(&rs->io.suspendq);
+	else
+		BUG_ON(io_ref(rs) < 0);
+}
+
+/* Wait until all io has been processed. */
+static void wait_ios(struct raid_set *rs)
+{
+	wait_event(rs->io.suspendq, !io_ref(rs));
+}
+
+/* Queue (optionally delayed) io work. */
+static void wake_do_raid_delayed(struct raid_set *rs, unsigned long delay)
+{
+	queue_delayed_work(rs->io.wq, &rs->io.dws_do_raid, delay);
+}
+
+/* Queue io work immediately (called from region hash too). */
+static void wake_do_raid(void *context)
+{
+	struct raid_set *rs = context;
+
+	queue_work(rs->io.wq, &rs->io.dws_do_raid.work);
+}
+
+/* Calculate device sector offset. */
+static sector_t _sector(struct raid_set *rs, struct bio *bio)
+{
+	sector_t sector = bio->bi_sector;
+
+	sector_div(sector, rs->set.data_devs);
+	return sector;
+}
+
+/* Return # of active stripes in stripe cache. */
+static int sc_active(struct stripe_cache *sc)
+{
+	return atomic_read(&sc->active_stripes);
+}
+
+/* Stripe cache busy indicator. */
+static int sc_busy(struct raid_set *rs)
+{
+	return sc_active(&rs->sc) >
+	       atomic_read(&rs->sc.stripes) - (STRIPES_MIN / 2);
+}
+
+/* Set chunks states. */
+enum chunk_dirty_type { CLEAN, DIRTY, ERROR };
+static void chunk_set(struct stripe_chunk *chunk, enum chunk_dirty_type type)
+{
+	switch (type) {
+	case CLEAN:
+		ClearChunkDirty(chunk);
+		break;
+	case DIRTY:
+		SetChunkDirty(chunk);
+		break;
+	case ERROR:
+		SetChunkError(chunk);
+		SetStripeError(chunk->stripe);
+		return;
+	default:
+		BUG();
+	}
+
+	SetChunkUptodate(chunk);
+	SetChunkIo(chunk);
+	ClearChunkError(chunk);
+}
+
+/* Return region state for a sector. */
+static int region_state(struct raid_set *rs, sector_t sector, 
+			enum dm_rh_region_states state)
+{
+	struct dm_rh_client *rh = rs->recover.rh;
+	region_t region = dm_rh_sector_to_region(rh, sector);
+
+	return !!(dm_rh_get_state(rh, region, 1) & state);
+}
+
+/*
+ * Return true in case a chunk should be read/written
+ *
+ * Conditions to read/write:
+ *	o chunk not uptodate
+ *	o chunk dirty
+ *
+ * Conditios to avoid io:
+ *	o io already ongoing on chunk
+ *	o io explitely prohibited
+ */
+static int chunk_io(struct stripe_chunk *chunk)
+{
+	/* 2nd run optimization (flag set below on first run). */
+	if (TestClearChunkMustIo(chunk))
+		return 1;
+
+	/* Avoid io if prohibited or a locked chunk. */
+	if (!ChunkIo(chunk) || ChunkLocked(chunk))
+		return 0;
+
+	if (!ChunkUptodate(chunk) || ChunkDirty(chunk)) {
+		SetChunkMustIo(chunk); /* 2nd run optimization. */
+		return 1;
+	}
+
+	return 0;
+}
+
+/* Call a function on each chunk needing io unless device failed. */
+static unsigned for_each_io_dev(struct stripe *stripe,
+			        void (*f_io)(struct stripe *stripe, unsigned p))
+{
+	struct raid_set *rs = RS(stripe->sc);
+	unsigned p, r = 0;
+
+	for (p = 0; p < rs->set.raid_devs; p++) {
+		if (chunk_io(CHUNK(stripe, p)) && !DevFailed(rs->dev + p)) {
+			f_io(stripe, p);
+			r++;
+		}
+	}
+
+	return r;
+}
+
+/*
+ * Index of device to calculate parity on.
+ *
+ * Either the parity device index *or* the selected
+ * device to init after a spare replacement.
+ */
+static int dev_for_parity(struct stripe *stripe, int *sync)
+{
+	struct raid_set *rs = RS(stripe->sc);
+	int r = region_state(rs, stripe->key, DM_RH_NOSYNC | DM_RH_RECOVERING);
+
+	*sync = !r;
+
+	/* Reconstruct a particular device ?. */
+	if (r && rs->set.dev_to_init > -1)
+		return rs->set.dev_to_init;
+	else if (rs->set.raid_type->level == raid4)
+		return rs->set.pi;
+	else if (!StripeRecover(stripe))
+		return stripe->idx.parity;
+	else
+		return -1;
+}
+
+/* RAID set congested function. */
+static int rs_congested(void *congested_data, int bdi_bits)
+{
+	int r;
+	unsigned p;
+	struct raid_set *rs = congested_data;
+
+	if (sc_busy(rs) || RSSuspend(rs))
+		r = 1;
+	else for (r = 0, p = rs->set.raid_devs; !r && p--; ) {
+		/* If any of our component devices are overloaded. */
+		struct request_queue *q = bdev_get_queue(rs->dev[p].dev->bdev);
+
+		r |= bdi_congested(&q->backing_dev_info, bdi_bits);
+	}
+
+	/* REMOVEME: statistics. */
+	atomic_inc(rs->stats + (r ? S_CONGESTED : S_NOT_CONGESTED));
+	return r;
+}
+
+/* RAID device degrade check. */
+static void rs_check_degrade_dev(struct raid_set *rs,
+				       struct stripe *stripe, unsigned p)
+{
+	if (TestSetDevFailed(rs->dev + p))
+		return;
+
+	/* Through an event in case of member device errors. */
+	if (atomic_inc_return(&rs->set.failed_devs) >
+	    rs->set.raid_type->parity_devs &&
+	    !TestSetRSDead(rs)) {
+		/* Display RAID set dead message once. */
+		unsigned p;
+		char buf[BDEVNAME_SIZE];
+
+		DMERR("FATAL: too many devices failed -> RAID set broken");
+		for (p = 0; p < rs->set.raid_devs; p++) {
+			if (DevFailed(rs->dev + p))
+				DMERR("device /dev/%s failed",
+				      bdevname(rs->dev[p].dev->bdev, buf));
+		}
+	}
+
+	/* Only log the first member error. */
+	if (!TestSetRSDegraded(rs)) {
+		char buf[BDEVNAME_SIZE];
+
+		/* Store index for recovery. */
+		rs->set.ei = p;
+		DMERR("CRITICAL: %sio error on device /dev/%s "
+		      "in region=%llu; DEGRADING RAID set\n",
+		      stripe ? "" : "FAKED ",
+		      bdevname(rs->dev[p].dev->bdev, buf),
+		      (unsigned long long) (stripe ? stripe->key : 0));
+		DMERR("further device error messages suppressed");
+	}
+
+	schedule_work(&rs->io.ws_do_table_event);
+}
+
+/* RAID set degrade check. */
+static void rs_check_degrade(struct stripe *stripe)
+{
+	struct raid_set *rs = RS(stripe->sc);
+	unsigned p = rs->set.raid_devs;
+
+	while (p--) {
+		if (ChunkError(CHUNK(stripe, p)))
+			rs_check_degrade_dev(rs, stripe, p);
+	}
+}
+
+/* Lookup a RAID device by name or by major:minor number. */
+static int raid_dev_lookup(struct raid_set *rs, struct raid_dev *dev_lookup)
+{
+	unsigned p;
+	struct raid_dev *dev;
+
+	/*
+	 * Must be an incremental loop, because the device array
+	 * can have empty slots still on calls from raid_ctr()
+	 */
+	for (dev = rs->dev, p = 0;
+	     dev->dev && p < rs->set.raid_devs;
+	     dev++, p++) {
+		if (dev_lookup->dev->bdev->bd_dev == dev->dev->bdev->bd_dev)
+			return p;
+	}
+
+	return -ENODEV;
+}
+/*
+ * End small helper functions.
+ */
+
+/*
+ * Stripe hash functions
+ */
+/* Initialize/destroy stripe hash. */
+static int hash_init(struct stripe_hash *hash, unsigned stripes)
+{
+	unsigned buckets = 2, max_buckets = stripes >> 1;
+	static unsigned hash_primes[] = {
+		/* Table of primes for hash_fn/table size optimization. */
+		1, 2, 3, 7, 13, 27, 53, 97, 193, 389, 769,
+		1543, 3079, 6151, 12289, 24593, 49157, 98317,
+	};
+
+	/* Calculate number of buckets (2^^n <= stripes / 2). */
+	while (buckets < max_buckets)
+		buckets <<= 1;
+
+	/* Allocate stripe hash buckets. */
+	hash->hash = vmalloc(buckets * sizeof(*hash->hash));
+	if (!hash->hash)
+		return -ENOMEM;
+
+	hash->buckets = buckets;
+	hash->mask = buckets - 1;
+	hash->shift = ffs(buckets);
+	if (hash->shift > ARRAY_SIZE(hash_primes))
+		hash->shift = ARRAY_SIZE(hash_primes) - 1;
+
+	BUG_ON(hash->shift < 2);
+	hash->prime = hash_primes[hash->shift];
+
+	/* Initialize buckets. */
+	while (buckets--)
+		INIT_LIST_HEAD(hash->hash + buckets);
+	return 0;
+}
+
+static void hash_exit(struct stripe_hash *hash)
+{
+	if (hash->hash) {
+		vfree(hash->hash);
+		hash->hash = NULL;
+	}
+}
+
+static unsigned hash_fn(struct stripe_hash *hash, sector_t key)
+{
+	return (unsigned) (((key * hash->prime) >> hash->shift) & hash->mask);
+}
+
+static struct list_head *hash_bucket(struct stripe_hash *hash, sector_t key)
+{
+	return hash->hash + hash_fn(hash, key);
+}
+
+/* Insert an entry into a hash. */
+static void stripe_insert(struct stripe_hash *hash, struct stripe *stripe)
+{
+	list_add(stripe->lists + LIST_HASH, hash_bucket(hash, stripe->key));
+}
+
+/* Lookup an entry in the stripe hash. */
+static struct stripe *stripe_lookup(struct stripe_cache *sc, sector_t key)
+{
+	unsigned look = 0;
+	struct stripe *stripe;
+	struct list_head *bucket = hash_bucket(&sc->hash, key);
+
+	list_for_each_entry(stripe, bucket, lists[LIST_HASH]) {
+		look++;
+
+		if (stripe->key == key) {
+			/* REMOVEME: statisics. */
+			if (look > atomic_read(RS(sc)->stats + S_MAX_LOOKUP))
+				atomic_set(RS(sc)->stats + S_MAX_LOOKUP, look);
+			return stripe;
+		}
+	}
+
+	return NULL;
+}
+
+/* Resize the stripe cache hash on size changes. */
+static int sc_hash_resize(struct stripe_cache *sc)
+{
+	/* Resize indicated ? */
+	if (atomic_read(&sc->stripes) != atomic_read(&sc->stripes_last)) {
+		int r;
+		struct stripe_hash hash;
+
+		r = hash_init(&hash, atomic_read(&sc->stripes));
+		if (r)
+			return r;
+
+		if (sc->hash.hash) {
+			unsigned b = sc->hash.buckets;
+			struct list_head *pos, *tmp;
+
+			/* Walk old buckets and insert into new. */
+			while (b--) {
+				list_for_each_safe(pos, tmp, sc->hash.hash + b)
+				    stripe_insert(&hash,
+						  list_entry(pos, struct stripe,
+							     lists[LIST_HASH]));
+			}
+
+		}
+
+		hash_exit(&sc->hash);
+		memcpy(&sc->hash, &hash, sizeof(sc->hash));
+		atomic_set(&sc->stripes_last, atomic_read(&sc->stripes));
+	}
+
+	return 0;
+}
+/* End hash stripe hash function. */
+
+/* List add, delete, push and pop functions. */
+/* Add stripe to flush list. */
+#define	DEL_LIST(lh) \
+	if (!list_empty(lh)) \
+		list_del_init(lh);
+
+/* Delete stripe from hash. */
+static void stripe_hash_del(struct stripe *stripe)
+{
+	DEL_LIST(stripe->lists + LIST_HASH);
+}
+
+/* Return stripe reference count. */
+static inline int stripe_ref(struct stripe *stripe)
+{
+	return atomic_read(&stripe->cnt);
+}
+
+static void stripe_flush_add(struct stripe *stripe)
+{
+	struct stripe_cache *sc = stripe->sc;
+	struct list_head *lh = stripe->lists + LIST_FLUSH;
+
+	if (!StripeReconstruct(stripe) && list_empty(lh))
+		list_add_tail(lh, sc->lists + LIST_FLUSH);
+}
+
+/*
+ * Add stripe to LRU (inactive) list.
+ *
+ * Need lock, because of concurrent access from message interface.
+ */
+static void stripe_lru_add(struct stripe *stripe)
+{
+	if (!StripeRecover(stripe)) {
+		unsigned long flags;
+		struct list_head *lh = stripe->lists + LIST_LRU;
+		spinlock_t *lock = stripe->sc->locks + LOCK_LRU;
+
+		spin_lock_irqsave(lock, flags);
+		if (list_empty(lh))
+			list_add_tail(lh, stripe->sc->lists + LIST_LRU);
+		spin_unlock_irqrestore(lock, flags);
+	}
+}
+
+#define POP_LIST(list) \
+	do { \
+		if (list_empty(sc->lists + (list))) \
+			stripe = NULL; \
+		else { \
+			stripe = list_first_entry(sc->lists + (list), \
+						  struct stripe, \
+						  lists[(list)]); \
+			list_del_init(stripe->lists + (list)); \
+		} \
+	} while (0);
+
+/* Pop an available stripe off the LRU list. */
+static struct stripe *stripe_lru_pop(struct stripe_cache *sc)
+{
+	struct stripe *stripe;
+	spinlock_t *lock = sc->locks + LOCK_LRU;
+
+	spin_lock_irq(lock);
+	POP_LIST(LIST_LRU);
+	spin_unlock_irq(lock);
+
+	return stripe;
+}
+
+/* Pop an available stripe off the io list. */
+static struct stripe *stripe_io_pop(struct stripe_cache *sc)
+{
+	struct stripe *stripe;
+
+	POP_LIST(LIST_FLUSH);
+	return stripe;
+}
+
+/* Push a stripe safely onto the endio list to be handled by do_endios(). */
+static void stripe_endio_push(struct stripe *stripe)
+{
+	unsigned long flags;
+	struct stripe_cache *sc = stripe->sc;
+	struct list_head *stripe_list = stripe->lists + LIST_ENDIO,
+			 *sc_list = sc->lists + LIST_ENDIO;
+	spinlock_t *lock = sc->locks + LOCK_ENDIO;
+
+	/* This runs in parallel with do_endios(). */
+	spin_lock_irqsave(lock, flags);
+	if (list_empty(stripe_list))
+		list_add_tail(stripe_list, sc_list);
+	spin_unlock_irqrestore(lock, flags);
+
+	wake_do_raid(RS(sc)); /* Wake myself. */
+}
+
+/* Pop a stripe off safely off the endio list. */
+static struct stripe *stripe_endio_pop(struct stripe_cache *sc)
+{
+	struct stripe *stripe;
+	spinlock_t *lock = sc->locks + LOCK_ENDIO;
+
+	/* This runs in parallel with endio(). */
+	spin_lock_irq(lock);
+	POP_LIST(LIST_ENDIO)
+	spin_unlock_irq(lock);
+	return stripe;
+}
+#undef POP_LIST
+
+/*
+ * Stripe cache locking functions
+ */
+/* Dummy lock function for single host RAID4+5. */
+static void *no_lock(sector_t key, enum dm_lock_type type)
+{
+	return &no_lock;
+}
+
+/* Dummy unlock function for single host RAID4+5. */
+static void no_unlock(void *lock_handle)
+{
+}
+
+/* No locking (for single host RAID 4+5). */
+static struct dm_raid45_locking_type locking_none = {
+	.lock = no_lock,
+	.unlock = no_unlock,
+};
+
+/* Lock a stripe (for clustering). */
+static int
+stripe_lock(struct stripe *stripe, int rw, sector_t key)
+{
+	stripe->lock = RS(stripe->sc)->locking->lock(key, rw == READ ? DM_RAID45_SHARED : DM_RAID45_EX);
+	return stripe->lock ? 0 : -EPERM;
+}
+
+/* Unlock a stripe (for clustering). */
+static void stripe_unlock(struct stripe *stripe)
+{
+	RS(stripe->sc)->locking->unlock(stripe->lock);
+	stripe->lock = NULL;
+}
+
+/* Test io pending on stripe. */
+static int stripe_io_ref(struct stripe *stripe)
+{
+	return atomic_read(&stripe->io.pending);
+}
+
+static void stripe_io_get(struct stripe *stripe)
+{
+	if (atomic_inc_return(&stripe->io.pending) == 1)
+		/* REMOVEME: statistics */
+		atomic_inc(&stripe->sc->active_stripes);
+	else
+		BUG_ON(stripe_io_ref(stripe) < 0);
+}
+
+static void stripe_io_put(struct stripe *stripe)
+{
+	if (atomic_dec_and_test(&stripe->io.pending)) {
+		if (unlikely(StripeRecover(stripe)))
+			/* Don't put recovery stripe on endio list. */
+			wake_do_raid(RS(stripe->sc));
+		else
+			/* Add regular stripe to endio list and wake daemon. */
+			stripe_endio_push(stripe);
+
+		/* REMOVEME: statistics */
+		atomic_dec(&stripe->sc->active_stripes);
+	} else
+		BUG_ON(stripe_io_ref(stripe) < 0);
+}
+
+/* Take stripe reference out. */
+static int stripe_get(struct stripe *stripe)
+{
+	int r;
+	struct list_head *lh = stripe->lists + LIST_LRU;
+	spinlock_t *lock = stripe->sc->locks + LOCK_LRU;
+
+	/* Delete stripe from LRU (inactive) list if on. */
+	spin_lock_irq(lock);
+	DEL_LIST(lh);
+	spin_unlock_irq(lock);
+
+	BUG_ON(stripe_ref(stripe) < 0);
+
+	/* Lock stripe on first reference */
+	r = (atomic_inc_return(&stripe->cnt) == 1) ?
+	    stripe_lock(stripe, WRITE, stripe->key) : 0;
+
+	return r;
+}
+#undef DEL_LIST
+
+/* Return references on a chunk. */
+static int chunk_ref(struct stripe_chunk *chunk)
+{
+	return atomic_read(&chunk->cnt);
+}
+
+/* Take out reference on a chunk. */
+static int chunk_get(struct stripe_chunk *chunk)
+{
+	return atomic_inc_return(&chunk->cnt);
+}
+
+/* Drop reference on a chunk. */
+static void chunk_put(struct stripe_chunk *chunk)
+{
+	BUG_ON(atomic_dec_return(&chunk->cnt) < 0);
+}
+
+/*
+ * Drop reference on a stripe.
+ *
+ * Move it to list of LRU stripes if zero.
+ */
+static void stripe_put(struct stripe *stripe)
+{
+	if (atomic_dec_and_test(&stripe->cnt)) {
+		BUG_ON(stripe_io_ref(stripe));
+		stripe_unlock(stripe);
+	} else
+		BUG_ON(stripe_ref(stripe) < 0);
+}
+
+/* Helper needed by for_each_io_dev(). */
+static void stripe_get_references(struct stripe *stripe, unsigned p)
+{
+
+	/*
+	 * Another one to reference the stripe in
+	 * order to protect vs. LRU list moves.
+	 */
+	io_get(RS(stripe->sc));	/* Global io references. */
+	stripe_get(stripe);
+	stripe_io_get(stripe);	/* One for each chunk io. */
+}
+
+/* Helper for endio() to put all take references. */
+static void stripe_put_references(struct stripe *stripe)
+{
+	stripe_io_put(stripe);	/* One for each chunk io. */
+	stripe_put(stripe);
+	io_put(RS(stripe->sc));
+}
+
+/*
+ * Stripe cache functions.
+ */
+/*
+ * Invalidate all chunks (i.e. their pages)  of a stripe.
+ *
+ * I only keep state for the whole chunk.
+ */
+static inline void stripe_chunk_invalidate(struct stripe_chunk *chunk)
+{
+	chunk->io.flags = 0;
+}
+
+static void
+stripe_chunks_invalidate(struct stripe *stripe)
+{
+	unsigned p = RS(stripe->sc)->set.raid_devs;
+
+	while (p--)
+		stripe_chunk_invalidate(CHUNK(stripe, p));
+}
+
+/* Prepare stripe for (re)use. */
+static void stripe_invalidate(struct stripe *stripe)
+{
+	stripe->io.flags = 0;
+	stripe->idx.parity = stripe->idx.recover = -1;
+	stripe_chunks_invalidate(stripe);
+}
+
+/*
+ * Allow io on all chunks of a stripe.
+ * If not set, IO will not occur; i.e. it's prohibited.
+ *
+ * Actual IO submission for allowed chunks depends
+ * on their !uptodate or dirty state.
+ */
+static void stripe_allow_io(struct stripe *stripe)
+{
+	unsigned p = RS(stripe->sc)->set.raid_devs;
+
+	while (p--)
+		SetChunkIo(CHUNK(stripe, p));
+}
+
+/* Initialize a stripe. */
+static void stripe_init(struct stripe_cache *sc, struct stripe *stripe)
+{
+	unsigned i, p = RS(sc)->set.raid_devs;
+
+	/* Work all io chunks. */
+	while (p--) {
+		struct stripe_chunk *chunk = CHUNK(stripe, p);
+
+		atomic_set(&chunk->cnt, 0);
+		chunk->stripe = stripe;
+		i = ARRAY_SIZE(chunk->bl);
+		while (i--)
+			bio_list_init(chunk->bl + i);
+	}
+
+	stripe->sc = sc;
+
+
+	i = ARRAY_SIZE(stripe->lists);
+	while (i--)
+		INIT_LIST_HEAD(stripe->lists + i);
+
+	stripe->io.size = RS(sc)->set.io_size;
+	atomic_set(&stripe->cnt, 0);
+	atomic_set(&stripe->io.pending, 0);
+	stripe_invalidate(stripe);
+}
+
+/* Number of pages per chunk. */
+static inline unsigned chunk_pages(unsigned sectors)
+{
+	return dm_div_up(sectors, SECTORS_PER_PAGE);
+}
+
+/* Number of pages per stripe. */
+static inline unsigned stripe_pages(struct raid_set *rs, unsigned io_size)
+{
+	return chunk_pages(io_size) * rs->set.raid_devs;
+}
+
+/* Initialize part of page_list (recovery). */
+static void stripe_zero_pl_part(struct stripe *stripe, int p,
+				unsigned start, unsigned count)
+{
+	unsigned o = start / SECTORS_PER_PAGE, pages = chunk_pages(count);
+	/* Get offset into the page_list. */
+	struct page_list *pl = pl_elem(PL(stripe, p), o);
+
+	BUG_ON(!pl);
+	while (pl && pages--) {
+		BUG_ON(!pl->page);
+		memset(page_address(pl->page), 0, PAGE_SIZE);
+		pl = pl->next;
+	}
+}
+
+/* Initialize parity chunk of stripe. */
+static void stripe_zero_chunk(struct stripe *stripe, int p)
+{
+	if (p > -1)
+		stripe_zero_pl_part(stripe, p, 0, stripe->io.size);
+}
+
+/* Return dynamic stripe structure size. */
+static size_t stripe_size(struct raid_set *rs)
+{
+	return sizeof(struct stripe) +
+		      rs->set.raid_devs * sizeof(struct stripe_chunk);
+}
+
+/* Allocate a stripe and its memory object. */
+/* XXX adjust to cope with stripe cache and recovery stripe caches. */
+enum grow { SC_GROW, SC_KEEP };
+static struct stripe *stripe_alloc(struct stripe_cache *sc,
+				   struct dm_mem_cache_client *mc,
+				   enum grow grow)
+{
+	int r;
+	struct stripe *stripe;
+
+	stripe = kmem_cache_zalloc(sc->kc.cache, GFP_KERNEL);
+	if (stripe) {
+		/* Grow the dm-mem-cache by one object. */
+		if (grow == SC_GROW) {
+			r = dm_mem_cache_grow(mc, 1);
+			if (r)
+				goto err_free;
+		}
+
+		stripe->obj = dm_mem_cache_alloc(mc);
+		if (!stripe->obj)
+			goto err_shrink;
+
+		stripe_init(sc, stripe);
+	}
+
+	return stripe;
+
+err_shrink:
+	if (grow == SC_GROW)
+		dm_mem_cache_shrink(mc, 1);
+err_free:
+	kmem_cache_free(sc->kc.cache, stripe);
+	return NULL;
+}
+
+/*
+ * Free a stripes memory object, shrink the
+ * memory cache and free the stripe itself.
+ */
+static void stripe_free(struct stripe *stripe, struct dm_mem_cache_client *mc)
+{
+	dm_mem_cache_free(mc, stripe->obj);
+	dm_mem_cache_shrink(mc, 1);
+	kmem_cache_free(stripe->sc->kc.cache, stripe);
+}
+
+/* Free the recovery stripe. */
+static void stripe_recover_free(struct raid_set *rs)
+{
+	struct recover *rec = &rs->recover;
+	struct dm_mem_cache_client *mc;
+
+	mc = rec->mem_cache_client;
+	rec->mem_cache_client = NULL;
+	if (mc) {
+		struct stripe *stripe;
+
+		while (!list_empty(&rec->stripes)) {
+			stripe = list_first_entry(&rec->stripes, struct stripe,
+						  lists[LIST_RECOVER]);
+			list_del(stripe->lists + LIST_RECOVER);
+			kfree(stripe->recover);
+			stripe_free(stripe, mc);
+		}
+	
+		dm_mem_cache_client_destroy(mc);
+		dm_io_client_destroy(rec->dm_io_client);
+		rec->dm_io_client = NULL;
+	}
+}
+
+/* Grow stripe cache. */
+static int sc_grow(struct stripe_cache *sc, unsigned stripes, enum grow grow)
+{
+	int r = 0;
+
+	/* Try to allocate this many (additional) stripes. */
+	while (stripes--) {
+		struct stripe *stripe =
+			stripe_alloc(sc, sc->mem_cache_client, grow);
+
+		if (likely(stripe)) {
+			stripe_lru_add(stripe);
+			atomic_inc(&sc->stripes);
+		} else {
+			r = -ENOMEM;
+			break;
+		}
+	}
+
+	return r ? r : sc_hash_resize(sc);
+}
+
+/* Shrink stripe cache. */
+static int sc_shrink(struct stripe_cache *sc, unsigned stripes)
+{
+	int r = 0;
+
+	/* Try to get unused stripe from LRU list. */
+	while (stripes--) {
+		struct stripe *stripe;
+
+		stripe = stripe_lru_pop(sc);
+		if (stripe) {
+			/* An LRU stripe may never have ios pending! */
+			BUG_ON(stripe_io_ref(stripe));
+			BUG_ON(stripe_ref(stripe));
+			atomic_dec(&sc->stripes);
+			/* Remove from hash if on before deletion. */
+			stripe_hash_del(stripe);
+			stripe_free(stripe, sc->mem_cache_client);
+		} else {
+			r = -ENOENT;
+			break;
+		}
+	}
+
+	/* Check if stats are still sane. */
+	if (atomic_read(&sc->active_stripes_max) >
+	    atomic_read(&sc->stripes))
+		atomic_set(&sc->active_stripes_max, 0);
+
+	if (r)
+		return r;
+
+	return atomic_read(&sc->stripes) ? sc_hash_resize(sc) : 0;
+}
+
+/* Create stripe cache and recovery. */
+static int sc_init(struct raid_set *rs, unsigned stripes)
+{
+	unsigned i, r, rstripes;
+	struct stripe_cache *sc = &rs->sc;
+	struct stripe *stripe;
+	struct recover *rec = &rs->recover;
+	struct mapped_device *md;
+	struct gendisk *disk;
+
+	/* Initialize lists and locks. */
+	i = ARRAY_SIZE(sc->lists);
+	while (i--)
+		INIT_LIST_HEAD(sc->lists + i);
+
+	INIT_LIST_HEAD(&rec->stripes);
+
+	/* Initialize endio and LRU list locks. */
+	i = NR_LOCKS;
+	while (i--)
+		spin_lock_init(sc->locks + i);
+
+	/* Initialize atomic variables. */
+	atomic_set(&sc->stripes, 0);
+	atomic_set(&sc->stripes_to_set, 0);
+	atomic_set(&sc->active_stripes, 0);
+	atomic_set(&sc->active_stripes_max, 0);	/* REMOVEME: statistics. */
+
+	/*
+	 * We need a runtime unique # to suffix the kmem cache name
+	 * because we'll have one for each active RAID set.
+	 */
+	md = dm_table_get_md(rs->ti->table);
+	disk = dm_disk(md);
+	sprintf(sc->kc.name, "%s-%d", TARGET, disk->first_minor);
+	dm_put(md);
+	sc->kc.cache = kmem_cache_create(sc->kc.name, stripe_size(rs),
+					 0, 0, NULL);
+	if (!sc->kc.cache)
+		return -ENOMEM;
+
+	/* Create memory cache client context for RAID stripe cache. */
+	sc->mem_cache_client =
+		dm_mem_cache_client_create(stripes, rs->set.raid_devs,
+					   chunk_pages(rs->set.io_size));
+	if (IS_ERR(sc->mem_cache_client))
+		return PTR_ERR(sc->mem_cache_client);
+
+	/* Create memory cache client context for RAID recovery stripe(s). */
+	rstripes = rec->recovery_stripes;
+	rec->mem_cache_client =
+		dm_mem_cache_client_create(rstripes, rs->set.raid_devs,
+					   chunk_pages(rec->io_size));
+	if (IS_ERR(rec->mem_cache_client))
+		return PTR_ERR(rec->mem_cache_client);
+
+	/* Create dm-io client context for IO stripes. */
+	sc->dm_io_client =
+		dm_io_client_create((stripes > 32 ? 32 : stripes) *
+				    rs->set.raid_devs *
+				    chunk_pages(rs->set.io_size));
+	if (IS_ERR(sc->dm_io_client))
+		return PTR_ERR(sc->dm_io_client);
+
+	/* FIXME: intermingeled with stripe cache initialization. */
+	/* Create dm-io client context for recovery stripes. */
+	rec->dm_io_client =
+		dm_io_client_create(rstripes * rs->set.raid_devs *
+				    chunk_pages(rec->io_size));
+	if (IS_ERR(rec->dm_io_client))
+		return PTR_ERR(rec->dm_io_client);
+
+	/* Allocate stripes for set recovery. */
+	while (rstripes--) {
+		stripe = stripe_alloc(sc, rec->mem_cache_client, SC_KEEP);
+		if (!stripe)
+			return -ENOMEM;
+
+		stripe->recover = kzalloc(sizeof(*stripe->recover), GFP_KERNEL);
+		if (!stripe->recover) {
+			stripe_free(stripe, rec->mem_cache_client);
+			return -ENOMEM;
+		}
+
+		SetStripeRecover(stripe);
+		stripe->io.size = rec->io_size;
+		list_add_tail(stripe->lists + LIST_RECOVER, &rec->stripes);
+		/* Don't add recovery stripes to LRU list! */
+	}
+
+	/*
+	 * Allocate the stripe objetcs from the
+	 * cache and add them to the LRU list.
+	 */
+	r = sc_grow(sc, stripes, SC_KEEP);
+	if (!r)
+		atomic_set(&sc->stripes_last, stripes);
+
+	return r;
+}
+
+/* Destroy the stripe cache. */
+static void sc_exit(struct stripe_cache *sc)
+{
+	struct raid_set *rs = RS(sc);
+
+	if (sc->kc.cache) {
+		stripe_recover_free(rs);
+		BUG_ON(sc_shrink(sc, atomic_read(&sc->stripes)));
+		kmem_cache_destroy(sc->kc.cache);
+		sc->kc.cache = NULL;
+
+		if (sc->mem_cache_client && !IS_ERR(sc->mem_cache_client))
+			dm_mem_cache_client_destroy(sc->mem_cache_client);
+
+		if (sc->dm_io_client && !IS_ERR(sc->dm_io_client))
+			dm_io_client_destroy(sc->dm_io_client);
+
+		hash_exit(&sc->hash);
+	}
+}
+
+/*
+ * Calculate RAID address
+ *
+ * Delivers tuple with the index of the data disk holding the chunk
+ * in the set, the parity disks index and the start of the stripe
+ * within the address space of the set (used as the stripe cache hash key).
+ */
+/* thx MD. */
+static struct raid_address *raid_address(struct raid_set *rs, sector_t sector,
+					 struct raid_address *addr)
+{
+	sector_t stripe, tmp;
+
+	/*
+	 * chunk_number = sector / chunk_size
+	 * stripe_number = chunk_number / data_devs
+	 * di = stripe % data_devs;
+	 */
+	stripe = sector >> rs->set.chunk_shift;
+	addr->di = sector_div(stripe, rs->set.data_devs);
+
+	switch (rs->set.raid_type->level) {
+	case raid4:
+		addr->pi = rs->set.pi;
+		goto check_shift_di;
+	case raid5:
+		tmp = stripe;
+		addr->pi = sector_div(tmp, rs->set.raid_devs);
+
+		switch (rs->set.raid_type->algorithm) {
+		case left_asym:		/* Left asymmetric. */
+			addr->pi = rs->set.data_devs - addr->pi;
+		case right_asym:	/* Right asymmetric. */
+check_shift_di:
+			if (addr->di >= addr->pi)
+				addr->di++;
+			break;
+		case left_sym:		/* Left symmetric. */
+			addr->pi = rs->set.data_devs - addr->pi;
+		case right_sym:		/* Right symmetric. */
+			addr->di = (addr->pi + addr->di + 1) %
+				   rs->set.raid_devs;
+			break;
+		case none: /* Ain't happen: RAID4 algorithm placeholder. */
+			BUG();
+		}
+	}
+
+	/*
+	 * Start offset of the stripes chunk on any single device of the RAID
+	 * set, adjusted in case io size differs from chunk size.
+	 */
+	addr->key = (stripe << rs->set.chunk_shift) +
+		    (sector & rs->set.io_inv_mask);
+	return addr;
+}
+
+/*
+ * Copy data across between stripe pages and bio vectors.
+ *
+ * Pay attention to data alignment in stripe and bio pages.
+ */
+static void bio_copy_page_list(int rw, struct stripe *stripe,
+			       struct page_list *pl, struct bio *bio)
+{
+	unsigned i, page_offset;
+	void *page_addr;
+	struct raid_set *rs = RS(stripe->sc);
+	struct bio_vec *bv;
+
+	/* Get start page in page list for this sector. */
+	i = (bio->bi_sector & rs->set.io_mask) / SECTORS_PER_PAGE;
+	pl = pl_elem(pl, i);
+	BUG_ON(!pl);
+	BUG_ON(!pl->page);
+
+	page_addr = page_address(pl->page);
+	page_offset = to_bytes(bio->bi_sector & (SECTORS_PER_PAGE - 1));
+
+	/* Walk all segments and copy data across between bio_vecs and pages. */
+	bio_for_each_segment(bv, bio, i) {
+		int len = bv->bv_len, size;
+		unsigned bio_offset = 0;
+		void *bio_addr = __bio_kmap_atomic(bio, i, KM_USER0);
+redo:
+		size = (page_offset + len > PAGE_SIZE) ?
+		       PAGE_SIZE - page_offset : len;
+
+		if (rw == READ)
+			memcpy(bio_addr + bio_offset,
+			       page_addr + page_offset, size);
+		else
+			memcpy(page_addr + page_offset,
+			       bio_addr + bio_offset, size);
+
+		page_offset += size;
+		if (page_offset == PAGE_SIZE) {
+			/*
+			 * We reached the end of the chunk page ->
+			 * need to refer to the next one to copy more data.
+			 */
+			len -= size;
+			if (len) {
+				/* Get next page. */
+				pl = pl->next;
+				BUG_ON(!pl);
+				BUG_ON(!pl->page);
+				page_addr = page_address(pl->page);
+				page_offset = 0;
+				bio_offset += size;
+				/* REMOVEME: statistics. */
+				atomic_inc(rs->stats + S_BIO_COPY_PL_NEXT);
+				goto redo;
+			}
+		}
+
+		__bio_kunmap_atomic(bio_addr, KM_USER0);
+	}
+}
+
+/*
+ * Xor optimization macros.
+ */
+/* Xor data pointer declaration and initialization macros. */
+#define DECLARE_2	unsigned long *d0 = data[0], *d1 = data[1]
+#define DECLARE_3	DECLARE_2, *d2 = data[2]
+#define DECLARE_4	DECLARE_3, *d3 = data[3]
+#define DECLARE_5	DECLARE_4, *d4 = data[4]
+#define DECLARE_6	DECLARE_5, *d5 = data[5]
+#define DECLARE_7	DECLARE_6, *d6 = data[6]
+#define DECLARE_8	DECLARE_7, *d7 = data[7]
+
+/* Xor unrole macros. */
+#define D2(n)	d0[n] = d0[n] ^ d1[n]
+#define D3(n)	D2(n) ^ d2[n]
+#define D4(n)	D3(n) ^ d3[n]
+#define D5(n)	D4(n) ^ d4[n]
+#define D6(n)	D5(n) ^ d5[n]
+#define D7(n)	D6(n) ^ d6[n]
+#define D8(n)	D7(n) ^ d7[n]
+
+#define	X_2(macro, offset)	macro(offset); macro(offset + 1);
+#define	X_4(macro, offset)	X_2(macro, offset); X_2(macro, offset + 2);
+#define	X_8(macro, offset)	X_4(macro, offset); X_4(macro, offset + 4);
+#define	X_16(macro, offset)	X_8(macro, offset); X_8(macro, offset + 8);
+#define	X_32(macro, offset)	X_16(macro, offset); X_16(macro, offset + 16);
+#define	X_64(macro, offset)	X_32(macro, offset); X_32(macro, offset + 32);
+
+/* Define a _xor_#chunks_#xors_per_run() function. */
+#define	_XOR(chunks, xors_per_run) \
+static void _xor ## chunks ## _ ## xors_per_run(unsigned long **data) \
+{ \
+	unsigned end = XOR_SIZE / sizeof(data[0]), i; \
+	DECLARE_ ## chunks; \
+\
+	for (i = 0; i < end; i += xors_per_run) { \
+		X_ ## xors_per_run(D ## chunks, i); \
+	} \
+}
+
+/* Define xor functions for 2 - 8 chunks and xors per run. */
+#define	MAKE_XOR_PER_RUN(xors_per_run) \
+	_XOR(2, xors_per_run); _XOR(3, xors_per_run); \
+	_XOR(4, xors_per_run); _XOR(5, xors_per_run); \
+	_XOR(6, xors_per_run); _XOR(7, xors_per_run); \
+	_XOR(8, xors_per_run);
+
+MAKE_XOR_PER_RUN(8)	/* Define _xor_*_8() functions. */
+MAKE_XOR_PER_RUN(16)	/* Define _xor_*_16() functions. */
+MAKE_XOR_PER_RUN(32)	/* Define _xor_*_32() functions. */
+MAKE_XOR_PER_RUN(64)	/* Define _xor_*_64() functions. */
+
+#define MAKE_XOR(xors_per_run) \
+struct { \
+	void (*f)(unsigned long **); \
+} static xor_funcs ## xors_per_run[] = { \
+	{ NULL }, /* NULL pointers to optimize indexing in xor(). */ \
+	{ NULL }, \
+	{ _xor2_ ## xors_per_run }, \
+	{ _xor3_ ## xors_per_run }, \
+	{ _xor4_ ## xors_per_run }, \
+	{ _xor5_ ## xors_per_run }, \
+	{ _xor6_ ## xors_per_run }, \
+	{ _xor7_ ## xors_per_run }, \
+	{ _xor8_ ## xors_per_run }, \
+}; \
+\
+static void xor_ ## xors_per_run(unsigned n, unsigned long **data) \
+{ \
+	/* Call respective function for amount of chunks. */ \
+	xor_funcs ## xors_per_run[n].f(data); \
+}
+
+/* Define xor_8() - xor_64 functions. */
+MAKE_XOR(8)
+MAKE_XOR(16)
+MAKE_XOR(32)
+MAKE_XOR(64)
+
+/* Maximum number of chunks, which can be xor'ed in one go. */
+#define	XOR_CHUNKS_MAX	(ARRAY_SIZE(xor_funcs8) - 1)
+
+static void xor_blocks_wrapper(unsigned n, unsigned long **data)
+{
+	BUG_ON(n < 2 || n > MAX_XOR_BLOCKS + 1);
+	xor_blocks(n - 1, XOR_SIZE, (void *) data[0], (void **) data + 1);
+}
+
+struct xor_func {
+	xor_function_t f;
+	const char *name;
+} static xor_funcs[] = {
+	{ xor_8,   "xor_8"  },
+	{ xor_16,  "xor_16" },
+	{ xor_32,  "xor_32" },
+	{ xor_64,  "xor_64" },
+	{ xor_blocks_wrapper, "xor_blocks" },
+};
+
+/*
+ * Check, if chunk has to be xored in/out:
+ *
+ * o if writes are queued
+ * o if writes are merged
+ * o if stripe is to be reconstructed
+ * o if recovery stripe
+ */
+static inline int chunk_must_xor(struct stripe_chunk *chunk)
+{
+	if (ChunkUptodate(chunk)) {
+		BUG_ON(!bio_list_empty(BL_CHUNK(chunk, WRITE_QUEUED)) &&
+		       !bio_list_empty(BL_CHUNK(chunk, WRITE_MERGED)));
+
+		if (!bio_list_empty(BL_CHUNK(chunk, WRITE_QUEUED)) ||
+		    !bio_list_empty(BL_CHUNK(chunk, WRITE_MERGED)))
+			return 1;
+
+		if (StripeReconstruct(chunk->stripe) ||
+		    StripeRecover(chunk->stripe))
+			return 1;
+	}
+
+	return 0;
+}
+
+/*
+ * Calculate crc.
+ *
+ * This indexes into the chunks of a stripe and their pages.
+ *
+ * All chunks will be xored into the indexed (@pi)
+ * chunk in maximum groups of xor.chunks.
+ *
+ */
+static void xor(struct stripe *stripe, unsigned pi, unsigned sector)
+{
+	struct raid_set *rs = RS(stripe->sc);
+	unsigned max_chunks = rs->xor.chunks, n = 1,
+		 o = sector / SECTORS_PER_PAGE, /* Offset into the page_list. */
+		 p = rs->set.raid_devs;
+	unsigned long **d = rs->data;
+	xor_function_t xor_f = rs->xor.f->f;
+
+	BUG_ON(sector > stripe->io.size);
+
+	/* Address of parity page to xor into. */
+	d[0] = page_address(pl_elem(PL(stripe, pi), o)->page);
+
+	while (p--) {
+		/* Preset pointers to data pages. */
+		if (p != pi && chunk_must_xor(CHUNK(stripe, p)))
+			d[n++] = page_address(pl_elem(PL(stripe, p), o)->page);
+
+		/* If max chunks -> xor. */
+		if (n == max_chunks) {
+			xor_f(n, d);
+			n = 1;
+		}
+	}
+
+	/* If chunks -> xor. */
+	if (n > 1)
+		xor_f(n, d);
+}
+
+/* Common xor loop through all stripe page lists. */
+static void common_xor(struct stripe *stripe, sector_t count,
+		       unsigned off, unsigned pi)
+{
+	unsigned sector;
+
+	BUG_ON(!count);
+	for (sector = off; sector < count; sector += SECTORS_PER_PAGE)
+		xor(stripe, pi, sector);
+
+	/* Set parity page uptodate and clean. */
+	chunk_set(CHUNK(stripe, pi), CLEAN);
+	atomic_inc(RS(stripe->sc)->stats + S_XORS); /* REMOVEME: statistics. */
+}
+
+/*
+ * Calculate parity sectors on intact stripes.
+ *
+ * Need to calculate raid address for recover stripe, because its
+ * chunk sizes differs and is typically larger than io chunk size.
+ */
+static void parity_xor(struct stripe *stripe)
+{
+	struct raid_set *rs = RS(stripe->sc);
+	unsigned chunk_size = rs->set.chunk_size, io_size = stripe->io.size,
+		 xor_size = chunk_size > io_size ? io_size : chunk_size;
+	sector_t off;
+
+	/* This can be the recover stripe with a larger io size. */
+	for (off = 0; off < io_size; off += xor_size) {
+		/*
+		 * Recover stripe is likely bigger than regular io
+		 * ones and has no precalculated parity disk index ->
+		 * need to calculate RAID address.
+		 */
+		if (unlikely(StripeRecover(stripe))) {
+			struct raid_address addr;
+
+			raid_address(rs,
+				     (stripe->key + off) * rs->set.data_devs,
+				     &addr);
+			stripe->idx.parity = addr.pi;
+			stripe_zero_pl_part(stripe, addr.pi, off, xor_size);
+		}
+
+		common_xor(stripe, xor_size, off, stripe->idx.parity);
+		chunk_set(CHUNK(stripe, stripe->idx.parity), DIRTY);
+	}
+}
+
+/* Reconstruct missing chunk. */
+static void stripe_reconstruct(struct stripe *stripe)
+{
+	struct raid_set *rs = RS(stripe->sc);
+	int p = rs->set.raid_devs, pr = stripe->idx.recover;
+
+	BUG_ON(pr < 0);
+
+	/* Check if all but the chunk to be reconstructed are uptodate. */
+	while (p--)
+		BUG_ON(p != pr && !ChunkUptodate(CHUNK(stripe, p)));
+
+	/* REMOVEME: statistics. */
+	atomic_inc(rs->stats + (RSDegraded(rs) ? S_RECONSTRUCT_EI :
+						 S_RECONSTRUCT_DEV));
+	/* Zero chunk to be reconstructed. */
+	stripe_zero_chunk(stripe, pr);
+	common_xor(stripe, stripe->io.size, 0, pr);
+	stripe->idx.recover = -1;
+}
+
+/*
+ * Recovery io throttling
+ */
+/* Conditionally reset io counters. */
+static int recover_io_reset(struct raid_set *rs)
+{
+	unsigned long j = jiffies;
+
+	/* Pay attention to jiffies overflows. */
+	if (j > rs->recover.last_jiffies + HZ / 20 ||
+	    j < rs->recover.last_jiffies) {
+		atomic_set(rs->recover.io_count + IO_WORK, 0);
+		atomic_set(rs->recover.io_count + IO_RECOVER, 0);
+		rs->recover.last_jiffies = j;
+		return 1;
+	}
+
+	return 0;
+}
+
+/* Count ios. */
+static void recover_io_count(struct stripe *stripe)
+{
+	struct raid_set *rs = RS(stripe->sc);
+
+	recover_io_reset(rs);
+	atomic_inc(rs->recover.io_count +
+		   (StripeRecover(stripe) ? IO_RECOVER : IO_WORK));
+}
+
+/* Try getting a stripe either from the hash or from the LRU list. */
+static struct stripe *stripe_find(struct raid_set *rs,
+				  struct raid_address *addr)
+{
+	int r;
+	struct stripe_cache *sc = &rs->sc;
+	struct stripe *stripe;
+
+	/* Try stripe from hash. */
+	stripe = stripe_lookup(sc, addr->key);
+	if (stripe) {
+		r = stripe_get(stripe);
+		if (r)
+			goto get_lock_failed;
+
+		atomic_inc(rs->stats + S_HITS_1ST); /* REMOVEME: statistics. */
+	} else {
+		/* Not in hash -> try to get an LRU stripe. */
+		stripe = stripe_lru_pop(sc);
+		if (stripe) {
+			/*
+			 * An LRU stripe may not be referenced
+			 * and may never have ios pending!
+			 */
+			BUG_ON(stripe_ref(stripe));
+			BUG_ON(stripe_io_ref(stripe));
+
+			/* Remove from hash if on before reuse. */
+			stripe_hash_del(stripe);
+
+			/* Invalidate before reinserting with changed key. */
+			stripe_invalidate(stripe);
+
+			stripe->key = addr->key;
+			stripe->region = dm_rh_sector_to_region(rs->recover.rh,
+								addr->key);
+			stripe->idx.parity = addr->pi;
+			r = stripe_get(stripe);
+			if (r)
+				goto get_lock_failed;
+
+			/* Insert stripe into the stripe hash. */
+			stripe_insert(&sc->hash, stripe);
+			/* REMOVEME: statistics. */
+			atomic_inc(rs->stats + S_INSCACHE);
+		}
+	}
+
+	return stripe;
+
+get_lock_failed:
+	stripe_put(stripe);
+	return NULL;
+}
+
+/*
+ * Process end io
+ *
+ * I need to do it here because I can't in interrupt
+ */
+/* End io all bios on a bio list. */
+static void bio_list_endio(struct stripe *stripe, struct bio_list *bl,
+			   int p, int error)
+{
+	struct raid_set *rs = RS(stripe->sc);
+	struct bio *bio;
+	struct page_list *pl = PL(stripe, p);
+	struct stripe_chunk *chunk = CHUNK(stripe, p);
+
+	/* Update region counters. */
+	while ((bio = bio_list_pop(bl))) {
+		if (bio_data_dir(bio) == WRITE)
+			/* Drop io pending count for any writes. */
+			dm_rh_dec(rs->recover.rh, stripe->region);
+		else if (!error)
+			/* Copy data accross. */
+			bio_copy_page_list(READ, stripe, pl, bio);
+
+		bio_endio(bio, error);
+
+		/* REMOVEME: statistics. */
+		atomic_inc(rs->stats + (bio_data_dir(bio) == READ ?
+			   S_BIOS_ENDIO_READ : S_BIOS_ENDIO_WRITE));
+
+		chunk_put(chunk);
+		stripe_put(stripe);
+		io_put(rs);	/* Wake any suspend waiters on last bio. */
+	}
+}
+
+/*
+ * End io all reads/writes on a stripe copying
+ * read data accross from stripe to bios and
+ * decrementing region counters for writes.
+ *
+ * Processing of ios depeding on state:
+ * o no chunk error -> endio ok
+ * o degraded:
+ *   - chunk error and read -> ignore to be requeued
+ *   - chunk error and write -> endio ok
+ * o dead (more than parity_devs failed) and chunk_error-> endio failed
+ */
+static void stripe_endio(int rw, struct stripe *stripe)
+{
+	struct raid_set *rs = RS(stripe->sc);
+	unsigned p = rs->set.raid_devs;
+	int write = (rw != READ);
+
+	while (p--) {
+		struct stripe_chunk *chunk = CHUNK(stripe, p);
+		struct bio_list *bl;
+
+		BUG_ON(ChunkLocked(chunk));
+
+		bl = BL_CHUNK(chunk, rw);
+		if (bio_list_empty(bl))
+			continue;
+
+		if (unlikely(ChunkError(chunk) || !ChunkUptodate(chunk))) {
+			/* RAID set dead. */
+			if (unlikely(RSDead(rs)))
+				bio_list_endio(stripe, bl, p, -EIO);
+			/* RAID set degraded. */
+			else if (write)
+				bio_list_endio(stripe, bl, p, 0);
+		} else {
+			BUG_ON(!RSDegraded(rs) && ChunkDirty(chunk));
+			bio_list_endio(stripe, bl, p, 0);
+		}
+	}
+}
+
+/* Fail all ios hanging off all bio lists of a stripe. */
+static void stripe_fail_io(struct stripe *stripe)
+{
+	struct raid_set *rs = RS(stripe->sc);
+	unsigned p = rs->set.raid_devs;
+
+	while (p--) {
+		struct stripe_chunk *chunk = CHUNK(stripe, p);
+		int i = ARRAY_SIZE(chunk->bl);
+
+		/* Fail all bios on all bio lists of the stripe. */
+		while (i--) {
+			struct bio_list *bl = chunk->bl + i;
+
+			if (!bio_list_empty(bl))
+				bio_list_endio(stripe, bl, p, -EIO);
+		}
+	}
+
+	/* Put stripe on LRU list. */
+	BUG_ON(stripe_io_ref(stripe));
+	BUG_ON(stripe_ref(stripe));
+}
+
+/* Unlock all required chunks. */
+static void stripe_chunks_unlock(struct stripe *stripe)
+{
+	unsigned p = RS(stripe->sc)->set.raid_devs;
+	struct stripe_chunk *chunk;
+
+	while (p--) {
+		chunk = CHUNK(stripe, p);
+
+		if (TestClearChunkUnlock(chunk))
+			ClearChunkLocked(chunk);
+	}
+}
+
+/*
+ * Queue reads and writes to a stripe by hanging
+ * their bios off the stripesets read/write lists.
+ */
+static int stripe_queue_bio(struct raid_set *rs, struct bio *bio,
+			    struct bio_list *reject)
+{
+	struct raid_address addr;
+	struct stripe *stripe;
+
+	stripe = stripe_find(rs, raid_address(rs, bio->bi_sector, &addr));
+	if (stripe) {
+		int r = 0, rw = bio_data_dir(bio);
+
+		/* Distinguish reads and writes. */
+		bio_list_add(BL(stripe, addr.di, rw), bio);
+	
+		if (rw == READ)
+			/* REMOVEME: statistics. */
+			atomic_inc(rs->stats + S_BIOS_ADDED_READ);
+		else {
+			/* Inrement pending write count on region. */
+			dm_rh_inc(rs->recover.rh, stripe->region);
+			r = 1;
+
+			/* REMOVEME: statistics. */
+			atomic_inc(rs->stats + S_BIOS_ADDED_WRITE);
+		}
+
+		/*
+		 * Put on io (flush) list in case of
+		 * initial bio queued to chunk.
+		 */
+		if (chunk_get(CHUNK(stripe, addr.di)) == 1)
+			stripe_flush_add(stripe);
+
+		return r;
+	}
+
+	/* Got no stripe from cache or failed to lock it -> reject bio. */
+	bio_list_add(reject, bio);
+	atomic_inc(rs->stats + S_IOS_POST); /* REMOVEME: statistics. */
+	return 0;
+}
+
+/*
+ * Handle all stripes by handing them to the daemon, because we can't
+ * map their chunk pages to copy the data in interrupt context.
+ *
+ * We don't want to handle them here either, while interrupts are disabled.
+ */
+
+/* Read/write endio function for dm-io (interrupt context). */
+static void endio(unsigned long error, void *context)
+{
+	struct stripe_chunk *chunk = context;
+
+	if (unlikely(error)) {
+		chunk_set(chunk, ERROR);
+		/* REMOVEME: statistics. */
+		atomic_inc(RS(chunk->stripe->sc)->stats + S_STRIPE_ERROR);
+	} else
+		chunk_set(chunk, CLEAN);
+
+	/*
+	 * For recovery stripes, I need to reset locked locked
+	 * here, because those aren't processed in do_endios().
+	 */
+	if (unlikely(StripeRecover(chunk->stripe)))
+		ClearChunkLocked(chunk);
+	else
+		SetChunkUnlock(chunk);
+
+	/* Indirectly puts stripe on cache's endio list via stripe_io_put(). */
+	stripe_put_references(chunk->stripe);
+}
+
+/* Read/Write a chunk asynchronously. */
+static void stripe_chunk_rw(struct stripe *stripe, unsigned p)
+{
+	struct stripe_cache *sc = stripe->sc;
+	struct raid_set *rs = RS(sc);
+	struct dm_mem_cache_object *obj = stripe->obj + p;
+	struct page_list *pl = obj->pl;
+	struct stripe_chunk *chunk = CHUNK(stripe, p);
+	struct raid_dev *dev = rs->dev + p;
+	struct dm_io_region io = {
+		.bdev = dev->dev->bdev,
+		.sector = stripe->key,
+		.count = stripe->io.size,
+	};
+	struct dm_io_request control = {
+		.bi_rw = ChunkDirty(chunk) ? WRITE : READ,
+		.mem = {
+			.type = DM_IO_PAGE_LIST,
+			.ptr.pl = pl,
+			.offset = 0,
+		},
+		.notify = {
+			.fn = endio,
+			.context = chunk,
+		},
+		.client = StripeRecover(stripe) ? rs->recover.dm_io_client :
+						  sc->dm_io_client,
+	};
+
+	BUG_ON(ChunkLocked(chunk));
+	BUG_ON(!ChunkUptodate(chunk) && ChunkDirty(chunk));
+	BUG_ON(ChunkUptodate(chunk) && !ChunkDirty(chunk));
+
+	/*
+	 * Don't rw past end of device, which can happen, because
+	 * typically sectors_per_dev isn't divisible by io_size.
+	 */
+	if (unlikely(io.sector + io.count > rs->set.sectors_per_dev))
+		io.count = rs->set.sectors_per_dev - io.sector;
+
+	BUG_ON(!io.count);
+	io.sector += dev->start;	/* Add <offset>. */
+	if (RSRecover(rs))
+		recover_io_count(stripe);	/* Recovery io accounting. */
+
+	/* REMOVEME: statistics. */
+	atomic_inc(rs->stats + (ChunkDirty(chunk) ? S_DM_IO_WRITE :
+						    S_DM_IO_READ));
+	SetChunkLocked(chunk);
+	SetDevIoQueued(dev);
+	BUG_ON(dm_io(&control, 1, &io, NULL));
+}
+
+/*
+ * Write dirty or read not uptodate page lists of a stripe.
+ */
+static int stripe_chunks_rw(struct stripe *stripe)
+{
+	int r;
+	struct raid_set *rs = RS(stripe->sc);
+
+	/*
+	 * Increment the pending count on the stripe
+	 * first, so that we don't race in endio().
+	 *
+	 * An inc (IO) is needed for any chunk unless !ChunkIo(chunk):
+	 *
+	 * o not uptodate
+	 * o dirtied by writes merged
+	 * o dirtied by parity calculations
+	 */
+	r = for_each_io_dev(stripe, stripe_get_references);
+	if (r) {
+		/* Io needed: chunks are either not uptodate or dirty. */
+		int max;	/* REMOVEME: */
+		struct stripe_cache *sc = &rs->sc;
+
+		/* Submit actual io. */
+		for_each_io_dev(stripe, stripe_chunk_rw);
+
+		/* REMOVEME: statistics */
+		max = sc_active(sc);
+		if (atomic_read(&sc->active_stripes_max) < max)
+			atomic_set(&sc->active_stripes_max, max);
+
+		atomic_inc(rs->stats + S_FLUSHS);
+		/* END REMOVEME: statistics */
+	}
+
+	return r;
+}
+
+/* Merge in all writes hence dirtying respective chunks. */
+static void stripe_merge_writes(struct stripe *stripe)
+{
+	unsigned p = RS(stripe->sc)->set.raid_devs;
+
+	while (p--) {
+		struct stripe_chunk *chunk = CHUNK(stripe, p);
+		struct bio_list *write = BL_CHUNK(chunk, WRITE_QUEUED);
+	
+		if (!bio_list_empty(write)) {
+			struct bio *bio;
+			struct page_list *pl = stripe->obj[p].pl;
+
+			/*
+			 * We can play with the lists without holding a lock,
+			 * because it is just us accessing them anyway.
+			 */
+			bio_list_for_each(bio, write)
+				bio_copy_page_list(WRITE, stripe, pl, bio);
+
+			bio_list_merge(BL_CHUNK(chunk, WRITE_MERGED), write);
+			bio_list_init(write);
+			chunk_set(chunk, DIRTY);
+		}
+	}
+}
+
+/* Queue all writes to get merged. */
+static int stripe_queue_writes(struct stripe *stripe)
+{
+	int r = 0;
+	unsigned p = RS(stripe->sc)->set.raid_devs;
+
+	while (p--) {
+		struct stripe_chunk *chunk = CHUNK(stripe, p);
+		struct bio_list *write = BL_CHUNK(chunk, WRITE);
+
+		if (!bio_list_empty(write)) {
+			bio_list_merge(BL_CHUNK(chunk, WRITE_QUEUED), write);
+			bio_list_init(write);
+SetChunkIo(chunk);
+			r = 1;
+		}
+	}
+
+	return r;
+}
+
+
+/* Check, if a chunk gets completely overwritten. */
+static int stripe_check_chunk_overwrite(struct stripe *stripe, unsigned p)
+{
+	unsigned sectors = 0;
+	struct bio *bio;
+	struct bio_list *bl = BL(stripe, p, WRITE_QUEUED);
+
+	bio_list_for_each(bio, bl)
+		sectors += bio_sectors(bio);
+
+	BUG_ON(sectors > RS(stripe->sc)->set.io_size);
+	return sectors == RS(stripe->sc)->set.io_size;
+}
+
+/*
+ * Avoid io on broken/reconstructed drive in order to
+ * reconstruct date on endio.
+ *
+ * (*1*) We set StripeReconstruct() in here, so that _do_endios()
+ *	 will trigger a reconstruct call before resetting it.
+ */
+static int stripe_chunk_set_io_flags(struct stripe *stripe, int pr)
+{
+	struct stripe_chunk *chunk = CHUNK(stripe, pr);
+
+	/*
+	 * Allow io on all chunks but the indexed one,
+	 * because we're either degraded or prohibit it
+	 * on the one for later reconstruction.
+	 */
+	/* Includes ClearChunkIo(), ClearChunkUptodate(). */
+	stripe_chunk_invalidate(chunk);
+	stripe->idx.recover = pr;
+	SetStripeReconstruct(stripe);
+
+	/* REMOVEME: statistics. */
+	atomic_inc(RS(stripe->sc)->stats + S_PROHIBITCHUNKIO);
+	return -EPERM;
+}
+
+/* Chunk locked/uptodate and device failed tests. */
+static struct stripe_chunk *
+stripe_chunk_check(struct stripe *stripe, unsigned p, unsigned *chunks_uptodate)
+{
+	struct raid_set *rs = RS(stripe->sc);
+	struct stripe_chunk *chunk = CHUNK(stripe, p);
+
+	/* Can't access active chunks. */
+	if (ChunkLocked(chunk)) {
+		/* REMOVEME: statistics. */
+		atomic_inc(rs->stats + S_CHUNK_LOCKED);
+		return NULL;
+	}
+
+	/* Can't access broken devive. */
+	if (ChunkError(chunk) || DevFailed(rs->dev + p))
+		return NULL;
+
+	/* Can access uptodate chunks. */
+	if (ChunkUptodate(chunk)) {
+		(*chunks_uptodate)++;
+		return NULL;
+	}
+
+	return chunk;
+}
+
+/*
+ * Degraded/reconstruction mode.
+ *
+ * Check stripe state to figure which chunks don't need IO.
+ *
+ * Returns 0 for fully operational, -EPERM for degraded/resynchronizing.
+ */
+static int stripe_check_reconstruct(struct stripe *stripe)
+{
+	struct raid_set *rs = RS(stripe->sc);
+
+	if (RSDead(rs)) {
+		ClearStripeReconstruct(stripe);
+		ClearStripeReconstructed(stripe);
+		stripe_allow_io(stripe);
+		return 0;
+	}
+
+	/* Avoid further reconstruction setting, when already set. */
+	if (StripeReconstruct(stripe)) {
+		/* REMOVEME: statistics. */
+		atomic_inc(rs->stats + S_RECONSTRUCT_SET);
+		return -EBUSY;
+	}
+
+	/* Initially allow io on all chunks. */
+	stripe_allow_io(stripe);
+
+	/* Return if stripe is already reconstructed. */
+	if (StripeReconstructed(stripe)) {
+		atomic_inc(rs->stats + S_RECONSTRUCTED);
+		return 0;
+	}
+
+	/*
+	 * Degraded/reconstruction mode (device failed) ->
+	 * avoid io on the failed device.
+	 */
+	if (unlikely(RSDegraded(rs))) {
+		/* REMOVEME: statistics. */
+		atomic_inc(rs->stats + S_DEGRADED);
+		/* Allow IO on all devices but the dead one. */
+		BUG_ON(rs->set.ei < 0);
+		return stripe_chunk_set_io_flags(stripe, rs->set.ei);
+	} else {
+		int sync, pi = dev_for_parity(stripe, &sync);
+
+		/*
+		 * Reconstruction mode (ie. a particular (replaced) device or
+		 * some (rotating) parity chunk is being resynchronized) ->
+		 *   o make sure all needed chunks are read in
+		 *   o writes are allowed to go through
+		 */
+		if (!sync) {
+			/* REMOVEME: statistics. */
+			atomic_inc(rs->stats + S_NOSYNC);
+			/* Allow IO on all devs but the one to reconstruct. */
+			return stripe_chunk_set_io_flags(stripe, pi);
+		}
+	}
+
+	return 0;
+}
+
+/*
+ * Check, if stripe is ready to merge writes.
+ * I.e. if all chunks present to allow to merge bios.
+ *
+ * We prohibit io on:
+ *
+ * o chunks without bios
+ * o chunks which get completely written over
+ */
+static int stripe_merge_possible(struct stripe *stripe, int nosync)
+{
+	struct raid_set *rs = RS(stripe->sc);
+	unsigned chunks_overwrite = 0, chunks_prohibited = 0,
+		 chunks_uptodate = 0, p = rs->set.raid_devs;
+
+	/* Walk all chunks. */
+	while (p--) {
+		struct stripe_chunk *chunk;
+
+		/* Prohibit io on broken devices. */
+		if (DevFailed(rs->dev + p)) {
+			chunk = CHUNK(stripe, p);
+			goto prohibit_io;
+		}
+
+		/* We can't optimize any further if no chunk. */
+		chunk = stripe_chunk_check(stripe, p, &chunks_uptodate);
+		if (!chunk || nosync)
+			continue;
+
+		/*
+		 * We have a chunk, which is not uptodate.
+		 *
+		 * If this is not parity and we don't have
+		 * reads queued, we can optimize further.
+		 */
+		if (p != stripe->idx.parity &&
+		    bio_list_empty(BL_CHUNK(chunk, READ)) &&
+		    bio_list_empty(BL_CHUNK(chunk, WRITE_MERGED))) {
+			if (bio_list_empty(BL_CHUNK(chunk, WRITE_QUEUED)))
+				goto prohibit_io;
+			else if (RSCheckOverwrite(rs) &&
+				 stripe_check_chunk_overwrite(stripe, p))
+				/* Completely overwritten chunk. */
+				chunks_overwrite++;
+		}
+
+		/* Allow io for chunks with bios and overwritten ones. */
+		SetChunkIo(chunk);
+		continue;
+
+prohibit_io:
+		/* No io for broken devices or for chunks w/o bios. */
+		ClearChunkIo(chunk);
+		chunks_prohibited++;
+		/* REMOVEME: statistics. */
+		atomic_inc(RS(stripe->sc)->stats + S_PROHIBITCHUNKIO);
+	}
+
+	/* All data chunks will get written over. */
+	if (chunks_overwrite == rs->set.data_devs)
+		atomic_inc(rs->stats + S_OVERWRITE); /* REMOVEME: statistics.*/
+	else if (chunks_uptodate + chunks_prohibited < rs->set.raid_devs) {
+		/* We don't have enough chunks to merge. */
+		atomic_inc(rs->stats + S_CANT_MERGE); /* REMOVEME: statistics.*/
+		return -EPERM;
+	}
+
+	/*
+	 * If we have all chunks up to date or overwrite them, we
+	 * just zero the parity chunk and let stripe_rw() recreate it.
+	 */
+	if (chunks_uptodate == rs->set.raid_devs ||
+	    chunks_overwrite == rs->set.data_devs) {
+		stripe_zero_chunk(stripe, stripe->idx.parity);
+		BUG_ON(StripeReconstruct(stripe));
+		SetStripeReconstruct(stripe);	/* Enforce xor in caller. */
+	} else {
+		/*
+		 * With less chunks, we xor parity out.
+		 *
+		 * (*4*) We rely on !StripeReconstruct() in chunk_must_xor(),
+		 *	 so that only chunks with queued or merged writes 
+		 *	 are being xored.
+		 */
+		parity_xor(stripe);
+	}
+
+	/*
+	 * We do have enough chunks to merge.
+	 * All chunks are uptodate or get written over.
+	 */
+	atomic_inc(rs->stats + S_CAN_MERGE); /* REMOVEME: statistics. */
+	return 0;
+}
+
+/*
+ * Avoid reading chunks in case we're fully operational.
+ *
+ * We prohibit io on any chunks without bios but the parity chunk.
+ */
+static void stripe_avoid_reads(struct stripe *stripe)
+{
+	struct raid_set *rs = RS(stripe->sc);
+	unsigned dummy = 0, p = rs->set.raid_devs;
+
+	/* Walk all chunks. */
+	while (p--) {
+		struct stripe_chunk *chunk =
+			stripe_chunk_check(stripe, p, &dummy);
+
+		if (!chunk)
+			continue;
+
+		/* If parity or any bios pending -> allow io. */
+		if (chunk_ref(chunk) || p == stripe->idx.parity)
+			SetChunkIo(chunk);
+		else {
+			ClearChunkIo(chunk);
+			/* REMOVEME: statistics. */
+			atomic_inc(RS(stripe->sc)->stats + S_PROHIBITCHUNKIO);
+		}
+	}
+}
+
+/*
+ * Read/write a stripe.
+ *
+ * All stripe read/write activity goes through this function
+ * unless recovery, which has to call stripe_chunk_rw() directly.
+ *
+ * Make sure we don't try already merged stripes in order
+ * to avoid data corruption.
+ *
+ * Check the state of the RAID set and if degraded (or
+ * resynchronizing for reads), read in all other chunks but
+ * the one on the dead/resynchronizing device in order to be
+ * able to reconstruct the missing one in _do_endios().
+ *
+ * Can be called on active stripes in order
+ * to dispatch new io on inactive chunks.
+ *
+ * States to cover:
+ *   o stripe to read and/or write
+ *   o stripe with error to reconstruct
+ */
+static void stripe_rw(struct stripe *stripe)
+{
+	int nosync, r;
+	struct raid_set *rs = RS(stripe->sc);
+
+	/*
+ 	 * Check, if a chunk needs to be reconstructed
+ 	 * because of a degraded set or a region out of sync.
+ 	 */
+	nosync = stripe_check_reconstruct(stripe);
+	switch (nosync) {
+	case -EBUSY:
+		return; /* Wait for stripe reconstruction to finish. */
+	case -EPERM:
+		goto io;
+	}
+
+	/*
+	 * If we don't have merged writes pending, we can schedule
+	 * queued writes to be merged next without corrupting data.
+	 */
+	if (!StripeMerged(stripe)) {
+		r = stripe_queue_writes(stripe);
+		if (r)
+			/* Writes got queued -> flag RBW. */
+			SetStripeRBW(stripe);
+	}
+
+	/*
+	 * Merge all writes hanging off uptodate/overwritten
+	 * chunks of the stripe.
+	 */
+	if (StripeRBW(stripe)) {
+		r = stripe_merge_possible(stripe, nosync);
+		if (!r) { /* Merge possible. */
+			struct stripe_chunk *chunk;
+
+			/*
+			 * I rely on valid parity in order
+			 * to xor a fraction of chunks out
+			 * of parity and back in.
+			 */
+			stripe_merge_writes(stripe);	/* Merge writes in. */
+			parity_xor(stripe);		/* Update parity. */
+			ClearStripeReconstruct(stripe);	/* Reset xor enforce. */
+			SetStripeMerged(stripe);	/* Writes merged. */
+			ClearStripeRBW(stripe);		/* Disable RBW. */
+
+			/*
+			 * REMOVEME: sanity check on parity chunk
+			 * 	     states after writes got merged.
+			 */
+			chunk = CHUNK(stripe, stripe->idx.parity);
+			BUG_ON(ChunkLocked(chunk));
+			BUG_ON(!ChunkUptodate(chunk));
+			BUG_ON(!ChunkDirty(chunk));
+			BUG_ON(!ChunkIo(chunk));
+		}
+	} else if (!nosync && !StripeMerged(stripe))
+		/* Read avoidance if not degraded/resynchronizing/merged. */
+		stripe_avoid_reads(stripe);
+
+io:
+	/* Now submit any reads/writes for non-uptodate or dirty chunks. */
+	r = stripe_chunks_rw(stripe);
+	if (!r) {
+		/*
+		 * No io submitted because of chunk io
+		 * prohibited or locked chunks/failed devices
+		 * -> push to end io list for processing.
+		 */
+		stripe_endio_push(stripe);
+		atomic_inc(rs->stats + S_NO_RW); /* REMOVEME: statistics. */
+	}
+}
+
+/*
+ * Recovery functions
+ */
+/* Read a stripe off a raid set for recovery. */
+static int stripe_recover_read(struct stripe *stripe, int pi)
+{
+	BUG_ON(stripe_io_ref(stripe));
+
+	/* Invalidate all chunks so that they get read in. */
+	stripe_chunks_invalidate(stripe);
+	stripe_allow_io(stripe); /* Allow io on all recovery chunks. */
+
+	/*
+	 * If we are reconstructing a perticular device, we can avoid
+ 	 * reading the respective chunk in, because we're going to
+	 * reconstruct it anyway.
+	 *
+	 * We can't do that for resynchronization of rotating parity,
+	 * because the recovery stripe chunk size is typically larger
+	 * than the sets chunk size.
+	 */
+	if (pi > -1)
+		ClearChunkIo(CHUNK(stripe, pi));
+
+	return stripe_chunks_rw(stripe);
+}
+
+/* Write a stripe to a raid set for recovery. */
+static int stripe_recover_write(struct stripe *stripe, int pi)
+{
+	BUG_ON(stripe_io_ref(stripe));
+
+	/*
+	 * If this is a reconstruct of a particular device, then
+	 * reconstruct the respective chunk, else create parity chunk.
+	 */
+	if (pi > -1) {
+		stripe_zero_chunk(stripe, pi);
+		common_xor(stripe, stripe->io.size, 0, pi);
+		chunk_set(CHUNK(stripe, pi), DIRTY);
+	} else
+		parity_xor(stripe);
+
+	return stripe_chunks_rw(stripe);
+}
+
+/* Read/write a recovery stripe. */
+static int stripe_recover_rw(struct stripe *stripe)
+{
+	int r = 0, sync = 0;
+
+	/* Read/write flip-flop. */
+	if (TestClearStripeRBW(stripe)) {
+		SetStripeMerged(stripe);
+		stripe->key = stripe->recover->pos;
+		r = stripe_recover_read(stripe, dev_for_parity(stripe, &sync));
+		BUG_ON(!r);
+	} else if (TestClearStripeMerged(stripe)) {
+		r = stripe_recover_write(stripe, dev_for_parity(stripe, &sync));
+		BUG_ON(!r);
+	}
+
+	BUG_ON(sync);
+	return r;
+}
+
+/* Recover bandwidth available ?. */
+static int recover_bandwidth(struct raid_set *rs)
+{
+	int r, work;
+
+	/* On reset or when bios delayed -> allow recovery. */
+	r = recover_io_reset(rs);
+	if (r || RSBandwidth(rs))
+		goto out;
+
+	work = atomic_read(rs->recover.io_count + IO_WORK);
+	if (work) {
+		/* Pay attention to larger recover stripe size. */
+		int recover = atomic_read(rs->recover.io_count + IO_RECOVER) *
+					  rs->recover.io_size / rs->set.io_size;
+
+		/*
+		 * Don't use more than given bandwidth
+		 * of the work io for recovery.
+		 */
+		if (recover > work / rs->recover.bandwidth_work) {
+			/* REMOVEME: statistics. */
+			atomic_inc(rs->stats + S_NO_BANDWIDTH);
+			return 0;
+		}
+	}
+
+out:
+	atomic_inc(rs->stats + S_BANDWIDTH);	/* REMOVEME: statistics. */
+	return 1;
+}
+
+/* Try to get a region to recover. */
+static int stripe_recover_get_region(struct stripe *stripe)
+{
+	struct raid_set *rs = RS(stripe->sc);
+	struct recover *rec = &rs->recover;
+	struct recover_addr *addr = stripe->recover;
+	struct dm_dirty_log *dl = rec->dl;
+	struct dm_rh_client *rh = rec->rh;
+
+	BUG_ON(!dl);
+	BUG_ON(!rh);
+
+	/* Return, that we have region first to finish it during suspension. */
+	if (addr->reg)
+		return 1;
+
+	if (RSSuspend(rs))
+		return -EPERM;
+
+	if (dl->type->get_sync_count(dl) >= rec->nr_regions)
+		return -ENOENT;
+
+	/* If we don't have enough bandwidth, we don't proceed recovering. */
+	if (!recover_bandwidth(rs))
+		return -EAGAIN;
+
+	/* Start quiescing a region. */
+	dm_rh_recovery_prepare(rh);
+	addr->reg = dm_rh_recovery_start(rh);
+	if (!addr->reg)
+		return -EAGAIN;
+
+	addr->pos = dm_rh_region_to_sector(rh, dm_rh_get_region_key(addr->reg));
+	addr->end = addr->pos + dm_rh_get_region_size(rh);
+
+	/*
+	 * Take one global io reference out for the
+	 * whole region, which is going to be released
+	 * when the region is completely done with.
+	 */
+	io_get(rs);
+	return 0;
+}
+
+/* Update region hash state. */
+enum recover_type { REC_FAILURE = 0, REC_SUCCESS = 1 };
+static void recover_rh_update(struct stripe *stripe, enum recover_type success)
+{
+	struct recover_addr *addr = stripe->recover;
+	struct raid_set *rs = RS(stripe->sc);
+	struct recover *rec = &rs->recover;
+
+	if (!addr->reg) {
+		DMERR("%s- Called w/o region", __func__);
+		return;
+	}
+
+	dm_rh_recovery_end(addr->reg, success);
+	if (success)
+		rec->nr_regions_recovered++;
+
+	addr->reg = NULL;
+
+	/*
+	 * Completely done with this region ->
+	 * release the 1st io reference.
+	 */
+	io_put(rs);
+}
+
+/* Set start of recovery state. */
+static void set_start_recovery(struct raid_set *rs)
+{
+	/* Initialize recovery. */
+	rs->recover.start_jiffies = jiffies;
+	rs->recover.end_jiffies = 0;
+}
+
+/* Set end of recovery state. */
+static void set_end_recovery(struct raid_set *rs)
+{
+	ClearRSRecover(rs);
+	rs->set.dev_to_init = -1;
+
+	/* Check for jiffies overrun. */
+	rs->recover.end_jiffies = jiffies;
+	if (rs->recover.end_jiffies < rs->recover.start_jiffies)
+		rs->recover.end_jiffies = ~0;
+}
+
+/* Handle recovery on one recovery stripe. */
+static int _do_recovery(struct stripe *stripe)
+{
+	int r;
+	struct raid_set *rs = RS(stripe->sc);
+	struct recover_addr *addr = stripe->recover;
+
+	/* If recovery is active -> return. */
+	if (stripe_io_ref(stripe))
+		return 1;
+
+	/* IO error is fatal for recovery -> stop it. */
+	if (unlikely(StripeError(stripe)))
+		goto err;
+
+	/* Recovery end required. */
+	if (!RSRecover(rs))
+		goto err;
+
+	/* Get a region to recover. */
+	r = stripe_recover_get_region(stripe);
+	switch (r) {
+	case 0:	/* Got a new region: flag initial read before write. */
+		SetStripeRBW(stripe);
+	case 1:	/* Have a region in the works. */
+		break;
+	case -EAGAIN:
+		/* No bandwidth/quiesced region yet, try later. */
+		if (!io_ref(rs))
+			wake_do_raid_delayed(rs, HZ / 4);
+	case -EPERM:
+		/* Suspend. */
+		return 1;
+	case -ENOENT:	/* No more regions to recover. */
+		schedule_work(&rs->io.ws_do_table_event);
+		return 0;
+	default:
+		BUG();
+	}
+
+	/* Read/write a recover stripe. */
+	r = stripe_recover_rw(stripe);
+	if (r)
+		/* IO initiated. */
+		return 1;
+
+	/* Read and write finished-> update recovery position within region. */
+	addr->pos += stripe->io.size;
+
+	/* If we're at end of region, update region hash. */
+	if (addr->pos >= addr->end ||
+	    addr->pos >= rs->set.sectors_per_dev)
+		recover_rh_update(stripe, REC_SUCCESS);
+	else
+		/* Prepare to read next region segment. */
+		SetStripeRBW(stripe);
+
+	/* Schedule myself for another round... */
+	wake_do_raid(rs);
+	return 1;
+
+err:
+	/* FIXME: rather try recovering other regions on error? */
+	rs_check_degrade(stripe);
+	recover_rh_update(stripe, REC_FAILURE);
+
+	/* Check state of partially recovered array. */
+	if (RSDegraded(rs) && !RSDead(rs) &&
+	    rs->set.dev_to_init != -1 &&
+	    rs->set.ei != rs->set.dev_to_init)
+		/* Broken drive != drive to recover -> FATAL. */
+		SetRSDead(rs);
+
+	if (StripeError(stripe)) {
+		char buf[BDEVNAME_SIZE];
+
+		DMERR("stopping recovery due to "
+		      "ERROR on /dev/%s, stripe at offset %llu",
+		      bdevname(rs->dev[rs->set.ei].dev->bdev, buf),
+		      (unsigned long long) stripe->key);
+
+	}
+
+	/* Make sure, that all quiesced regions get released. */
+	while (addr->reg) {
+		dm_rh_recovery_end(addr->reg, -EIO);
+		addr->reg = dm_rh_recovery_start(rs->recover.rh);
+	}
+
+	return 0;
+}
+
+/* Called by main io daemon to recover regions. */
+static void do_recovery(struct raid_set *rs)
+{
+	if (RSRecover(rs)) {
+		int r = 0;
+		struct stripe *stripe;
+
+		list_for_each_entry(stripe, &rs->recover.stripes,
+				    lists[LIST_RECOVER])
+			r += _do_recovery(stripe);
+
+		if (!r) {
+			set_end_recovery(rs);
+			stripe_recover_free(rs);
+		}
+	}
+}
+
+/*
+ * END recovery functions
+ */
+
+/* End io process all stripes handed in by endio() callback. */
+static void _do_endios(struct raid_set *rs, struct stripe *stripe,
+		       struct list_head *flush_list)
+{
+	/* First unlock all required chunks. */
+	stripe_chunks_unlock(stripe);
+
+	/*
+	 * If an io error on a stripe occured, degrade the RAID set
+	 * and try to endio as many bios as possible. If any bios can't
+	 * be endio processed, requeue the stripe (stripe_ref() != 0).
+	 */
+	if (TestClearStripeError(stripe)) {
+		/*
+		 * FIXME: if read, rewrite the failed chunk after reconstruction
+		 *        in order to trigger disk bad sector relocation.
+		 */
+		rs_check_degrade(stripe); /* Resets ChunkError(). */
+		ClearStripeReconstruct(stripe);
+		ClearStripeReconstructed(stripe);
+	}
+
+	/* Got to reconstruct a missing chunk. */
+	if (StripeReconstruct(stripe)) {
+		/*
+		 * (*2*) We use StripeReconstruct() to allow for
+		 *	 all chunks to be xored into the reconstructed
+		 *	 one (see chunk_must_xor()).
+		 */
+		stripe_reconstruct(stripe);
+
+		/*
+		 * (*3*) Now we reset StripeReconstruct() and flag
+		 * 	 StripeReconstructed() to show to stripe_rw(),
+		 * 	 that we have reconstructed a missing chunk.
+		 */
+		ClearStripeReconstruct(stripe);
+		SetStripeReconstructed(stripe);
+
+		/* FIXME: reschedule to be written in case of read. */
+		// if (!StripeRBW(stripe)) {
+		// 	chunk_set(CHUNK(stripe, pr), DIRTY);
+		// 	stripe_chunks_rw(stripe);
+		// }
+	}
+
+	/*
+	 * Now that we eventually got a complete stripe, we
+	 * can process the rest of the end ios on reads.
+	 */
+	stripe_endio(READ, stripe);
+
+	/* End io all merged writes. */
+	if (TestClearStripeMerged(stripe))
+		stripe_endio(WRITE_MERGED, stripe);
+
+	/* If RAID set is dead -> fail any ios to dead drives. */
+	if (RSDead(rs)) {
+		DMERR_LIMIT("RAID set dead: failing ios to dead devices");
+		stripe_fail_io(stripe);
+	}
+
+	/*
+	 * We have stripe references still,
+	 * beacuse of read befeore writes or IO errors ->
+	 * got to put on flush list for processing.
+	 */
+	if (stripe_ref(stripe)) {
+		BUG_ON(!list_empty(stripe->lists + LIST_LRU));
+		list_add_tail(stripe->lists + LIST_FLUSH, flush_list);
+		atomic_inc(rs->stats + S_REQUEUE); /* REMOVEME: statistics. */
+	} else
+		stripe_lru_add(stripe);
+}
+
+/* Pop any endio stripes off of the endio list and belabour them. */
+static void do_endios(struct raid_set *rs)
+{
+	struct stripe_cache *sc = &rs->sc;
+	struct stripe *stripe;
+	/* IO flush list for sorted requeued stripes. */
+	struct list_head flush_list;
+
+	INIT_LIST_HEAD(&flush_list);
+
+	while ((stripe = stripe_endio_pop(sc))) {
+		/* Avoid endio on stripes with newly io'ed chunks. */
+		if (!stripe_io_ref(stripe))
+			_do_endios(rs, stripe, &flush_list);
+	}
+
+	/*
+	 * Insert any requeued stripes in the proper
+	 * order at the beginning of the io (flush) list.
+	 */
+	list_splice(&flush_list, sc->lists + LIST_FLUSH);
+}
+
+/* Flush any stripes on the io list. */
+static void do_flush(struct raid_set *rs)
+{
+	struct stripe *stripe;
+
+	while ((stripe = stripe_io_pop(&rs->sc)))
+		stripe_rw(stripe); /* Read/write stripe. */
+}
+
+/* Stripe cache resizing. */
+static void do_sc_resize(struct raid_set *rs)
+{
+	unsigned set = atomic_read(&rs->sc.stripes_to_set);
+
+	if (set) {
+		unsigned cur = atomic_read(&rs->sc.stripes);
+		int r = (set > cur) ? sc_grow(&rs->sc, set - cur, SC_GROW) :
+				      sc_shrink(&rs->sc, cur - set);
+
+		/* Flag end of resizeing if ok. */
+		if (!r)
+			atomic_set(&rs->sc.stripes_to_set, 0);
+	}
+}
+
+/*
+ * Process all ios
+ *
+ * We do different things with the io depending
+ * on the state of the region that it is in:
+ *
+ * o reads: hang off stripe cache or postpone if full
+ *
+ * o writes:
+ *
+ *  CLEAN/DIRTY/NOSYNC:	increment pending and hang io off stripe's stripe set.
+ *			In case stripe cache is full or busy, postpone the io.
+ *
+ *  RECOVERING:		delay the io until recovery of the region completes.
+ *
+ */
+static void do_ios(struct raid_set *rs, struct bio_list *ios)
+{
+	int r;
+	unsigned flush = 0, delay = 0;
+	sector_t sector;
+	struct dm_rh_client *rh = rs->recover.rh;
+	struct bio *bio;
+	struct bio_list reject;
+
+	bio_list_init(&reject);
+
+	/*
+	 * Classify each io:
+	 *    o delay writes to recovering regions (let reads go through)
+	 *    o queue io to all other regions
+	 */
+	while ((bio = bio_list_pop(ios))) {
+		/*
+		 * In case we get a barrier bio, push it back onto
+		 * the input queue unless all work queues are empty
+		 * and the stripe cache is inactive.
+		 */
+		if (unlikely(bio_barrier(bio))) {
+			/* REMOVEME: statistics. */
+			atomic_inc(rs->stats + S_BARRIER);
+			if (delay ||
+			    !list_empty(rs->sc.lists + LIST_FLUSH) ||
+			    !bio_list_empty(&reject) ||
+			    sc_active(&rs->sc)) {
+				bio_list_push(ios, bio);
+				break;
+			}
+		}
+
+		/* Check for recovering regions. */
+		sector = _sector(rs, bio);
+		r = region_state(rs, sector, DM_RH_RECOVERING);
+		if (unlikely(r && bio_data_dir(bio) == WRITE)) {
+			delay++;
+			/* Wait writing to recovering regions. */
+			dm_rh_delay_by_region(rh, bio,
+					      dm_rh_sector_to_region(rh,
+								     sector));
+			/* REMOVEME: statistics.*/
+			atomic_inc(rs->stats + S_DELAYED_BIOS);
+			atomic_inc(rs->stats + S_SUM_DELAYED_BIOS);
+
+			/* Force bandwidth tests in recovery. */
+			SetRSBandwidth(rs);
+		} else {
+			/*
+			 * Process ios to non-recovering regions by queueing
+			 * them to stripes (does dm_rh_inc()) for writes).
+			 */
+			flush += stripe_queue_bio(rs, bio, &reject);
+		}
+	}
+
+	if (flush) {
+		/* FIXME: better error handling. */
+		r = dm_rh_flush(rh); /* Writes got queued -> flush dirty log. */
+		if (r)
+			DMERR_LIMIT("dirty log flush");
+	}
+
+	/* Merge any rejected bios back to the head of the input list. */
+	bio_list_merge_head(ios, &reject);
+}
+
+/* Unplug: let any queued io role on the sets devices. */
+static void do_unplug(struct raid_set *rs)
+{
+	struct raid_dev *dev = rs->dev + rs->set.raid_devs;
+
+	while (dev-- > rs->dev) {
+		/* Only call any device unplug function, if io got queued. */
+		if (TestClearDevIoQueued(dev))
+			blk_unplug(bdev_get_queue(dev->dev->bdev));
+	}
+}
+
+/* Send an event in case we're getting too busy. */
+static void do_busy_event(struct raid_set *rs)
+{
+	if (sc_busy(rs)) {
+		if (!TestSetRSScBusy(rs))
+			schedule_work(&rs->io.ws_do_table_event);
+	}
+
+	ClearRSScBusy(rs);
+}
+
+/* Throw an event. */
+static void do_table_event(struct work_struct *ws)
+{
+	struct raid_set *rs = container_of(ws, struct raid_set,
+					   io.ws_do_table_event);
+	dm_table_event(rs->ti->table);
+}
+
+
+/*-----------------------------------------------------------------
+ * RAID daemon
+ *---------------------------------------------------------------*/
+/*
+ * o belabour all end ios
+ * o update the region hash states
+ * o optionally shrink the stripe cache
+ * o optionally do recovery
+ * o unplug any component raid devices with queued bios
+ * o grab the input queue
+ * o work an all requeued or new ios and perform stripe cache flushs
+ * o unplug any component raid devices with queued bios
+ * o check, if the stripe cache gets too busy and throw an event if so
+ */
+static void do_raid(struct work_struct *ws)
+{
+	struct raid_set *rs = container_of(ws, struct raid_set,
+					   io.dws_do_raid.work);
+	struct bio_list *ios = &rs->io.work, *ios_in = &rs->io.in;
+
+	/*
+	 * We always need to end io, so that ios can get errored in
+	 * case the set failed and the region counters get decremented
+	 * before we update region hash states and go any further.
+	 */
+	do_endios(rs);
+	dm_rh_update_states(rs->recover.rh, 1);
+
+	/*
+	 * Now that we've end io'd, which may have put stripes on the LRU list
+	 * to allow for shrinking, we resize the stripe cache if requested.
+	 */
+	do_sc_resize(rs);
+
+	/* Try to recover regions. */
+	do_recovery(rs);
+	do_unplug(rs);		/* Unplug the sets device queues. */
+
+	/* Quickly grab all new ios queued and add them to the work list. */
+	mutex_lock(&rs->io.in_lock);
+	bio_list_merge(ios, ios_in);
+	bio_list_init(ios_in);
+	mutex_unlock(&rs->io.in_lock);
+
+	if (!bio_list_empty(ios))
+		do_ios(rs, ios); /* Got ios to work into the cache. */
+
+	do_flush(rs);		/* Flush any stripes on io list. */
+	do_unplug(rs);		/* Unplug the sets device queues. */
+	do_busy_event(rs);	/* Check if we got too busy. */
+}
+
+/*
+ * Callback for region hash to dispatch
+ * delayed bios queued to recovered regions
+ * (gets called via dm_rh_update_states()).
+ */
+static void dispatch_delayed_bios(void *context, struct bio_list *bl)
+{
+	struct raid_set *rs = context;
+	struct bio *bio;
+
+	/* REMOVEME: statistics; decrement pending delayed bios counter. */
+	bio_list_for_each(bio, bl)
+		atomic_dec(rs->stats + S_DELAYED_BIOS);
+
+	/* Merge region hash private list to work list. */
+	bio_list_merge_head(&rs->io.work, bl);
+	bio_list_init(bl);
+	ClearRSBandwidth(rs);
+}
+
+/*************************************************************
+ * Constructor helpers
+ *************************************************************/
+/* Calculate MB/sec. */
+static unsigned mbpers(struct raid_set *rs, unsigned speed)
+{
+	return to_bytes(speed * rs->set.data_devs *
+			rs->recover.io_size * HZ >> 10) >> 10;
+}
+
+/*
+ * Discover fastest xor algorithm and # of chunks combination.
+ */
+/* Calculate speed for algorithm and # of chunks. */
+static unsigned xor_speed(struct stripe *stripe)
+{
+	unsigned r = 0;
+	unsigned long j;
+
+	/* Wait for next tick. */
+	for (j = jiffies; j == jiffies; )
+		;
+
+	/* Do xors for a full tick. */
+	for (j = jiffies; j == jiffies; ) {
+		mb();
+		common_xor(stripe, stripe->io.size, 0, 0);
+		mb();
+		r++;
+	}
+
+	return r;
+}
+
+/* Optimize xor algorithm for this RAID set. */
+static unsigned xor_optimize(struct raid_set *rs)
+{
+	unsigned chunks_max = 2, p = rs->set.raid_devs, speed_max = 0;
+	struct xor_func *f = ARRAY_END(xor_funcs), *f_max = NULL;
+	struct stripe *stripe;
+
+	BUG_ON(list_empty(&rs->recover.stripes));
+	stripe = list_first_entry(&rs->recover.stripes, struct stripe,
+				  lists[LIST_RECOVER]);
+
+	/* Must set uptodate so that xor() will belabour chunks. */
+	while (p--)
+		SetChunkUptodate(CHUNK(stripe, p));
+
+	/* Try all xor functions. */
+	while (f-- > xor_funcs) {
+		unsigned speed;
+
+		/* Set actual xor function for common_xor(). */
+		rs->xor.f = f;
+		rs->xor.chunks = (f->f == xor_blocks_wrapper ?
+				  (MAX_XOR_BLOCKS + 1) : XOR_CHUNKS_MAX) + 1;
+
+		while (rs->xor.chunks-- > 2) {
+			speed = xor_speed(stripe);
+			if (speed > speed_max) {
+				speed_max = speed;
+				chunks_max = rs->xor.chunks;
+				f_max = f;
+			}
+		}
+	}
+
+	/* Memorize optimum parameters. */
+	rs->xor.f = f_max;
+	rs->xor.chunks = chunks_max;
+	return speed_max;
+}
+
+/*
+ * Allocate a RAID context (a RAID set)
+ */
+/* Structure for variable RAID parameters. */
+struct variable_parms {
+	int bandwidth;
+	int bandwidth_parm;
+	int chunk_size;
+	int chunk_size_parm;
+	int io_size;
+	int io_size_parm;
+	int stripes;
+	int stripes_parm;
+	int recover_io_size;
+	int recover_io_size_parm;
+	int raid_parms;
+	int recovery;
+	int recovery_stripes;
+	int recovery_stripes_parm;
+};
+
+static struct raid_set *
+context_alloc(struct raid_type *raid_type, struct variable_parms *p,
+	      unsigned raid_devs, sector_t sectors_per_dev,
+	      struct dm_target *ti, unsigned dl_parms, char **argv)
+{
+	int r;
+	size_t len;
+	sector_t region_size, ti_len;
+	struct raid_set *rs = NULL;
+	struct dm_dirty_log *dl;
+	struct recover *rec;
+
+	/*
+	 * Create the dirty log
+	 *
+	 * We need to change length for the dirty log constructor,
+	 * because we want an amount of regions for all stripes derived
+	 * from the single device size, so that we can keep region
+	 * size = 2^^n independant of the number of devices
+	 */
+	ti_len = ti->len;
+	ti->len = sectors_per_dev;
+	dl = dm_dirty_log_create(argv[0], ti, dl_parms, argv + 2);
+	ti->len = ti_len;
+	if (!dl)
+		goto bad_dirty_log;
+
+	/* Chunk size *must* be smaller than region size. */
+	region_size = dl->type->get_region_size(dl);
+	if (p->chunk_size > region_size)
+		goto bad_chunk_size;
+
+	/* Recover io size *must* be smaller than region size as well. */
+	if (p->recover_io_size > region_size)
+		goto bad_recover_io_size;
+
+	/* Size and allocate the RAID set structure. */
+	len = sizeof(*rs->data) + sizeof(*rs->dev);
+	if (dm_array_too_big(sizeof(*rs), len, raid_devs))
+		goto bad_array;
+
+	len = sizeof(*rs) + raid_devs * len;
+	rs = kzalloc(len, GFP_KERNEL);
+	if (!rs)
+		goto bad_alloc;
+
+	rec = &rs->recover;
+	atomic_set(&rs->io.in_process, 0);
+	atomic_set(&rs->io.in_process_max, 0);
+	rec->io_size = p->recover_io_size;
+
+	/* Pointer to data array. */
+	rs->data = (unsigned long **)
+		   ((void *) rs->dev + raid_devs * sizeof(*rs->dev));
+	rec->dl = dl;
+	rs->set.raid_devs = raid_devs;
+	rs->set.data_devs = raid_devs - raid_type->parity_devs;
+	rs->set.raid_type = raid_type;
+
+	rs->set.raid_parms = p->raid_parms;
+	rs->set.chunk_size_parm = p->chunk_size_parm;
+	rs->set.io_size_parm = p->io_size_parm;
+	rs->sc.stripes_parm = p->stripes_parm;
+	rec->io_size_parm = p->recover_io_size_parm;
+	rec->bandwidth_parm = p->bandwidth_parm;
+	rec->recovery = p->recovery;
+	rec->recovery_stripes = p->recovery_stripes;
+
+	/*
+	 * Set chunk and io size and respective shifts
+	 * (used to avoid divisions)
+	 */
+	rs->set.chunk_size = p->chunk_size;
+	rs->set.chunk_shift = ffs(p->chunk_size) - 1;
+
+	rs->set.io_size = p->io_size;
+	rs->set.io_mask = p->io_size - 1;
+	/* Mask to adjust address key in case io_size != chunk_size. */
+	rs->set.io_inv_mask = (p->chunk_size - 1) & ~rs->set.io_mask;
+
+	rs->set.sectors_per_dev = sectors_per_dev;
+
+	rs->set.ei = -1;	/* Indicate no failed device. */
+	atomic_set(&rs->set.failed_devs, 0);
+
+	rs->ti = ti;
+
+	atomic_set(rec->io_count + IO_WORK, 0);
+	atomic_set(rec->io_count + IO_RECOVER, 0);
+
+	/* Initialize io lock and queues. */
+	mutex_init(&rs->io.in_lock);
+	bio_list_init(&rs->io.in);
+	bio_list_init(&rs->io.work);
+
+	init_waitqueue_head(&rs->io.suspendq);	/* Suspend waiters (dm-io). */
+
+	rec->nr_regions = dm_sector_div_up(sectors_per_dev, region_size);
+	rec->rh = dm_region_hash_create(rs, dispatch_delayed_bios,
+			wake_dummy, wake_do_raid, 0, p->recovery_stripes,
+			dl, region_size, rec->nr_regions);
+	if (IS_ERR(rec->rh))
+		goto bad_rh;
+
+	/* Initialize stripe cache. */
+	r = sc_init(rs, p->stripes);
+	if (r)
+		goto bad_sc;
+
+	/* REMOVEME: statistics. */
+	stats_reset(rs);
+	ClearRSDevelStats(rs);	/* Disnable development status. */
+	return rs;
+
+bad_dirty_log:
+	TI_ERR_RET("Error creating dirty log", ERR_PTR(-ENOMEM));
+
+bad_chunk_size:
+	dm_dirty_log_destroy(dl);
+	TI_ERR_RET("Chunk size larger than region size", ERR_PTR(-EINVAL));
+
+bad_recover_io_size:
+	dm_dirty_log_destroy(dl);
+	TI_ERR_RET("Recover stripe io size larger than region size",
+			ERR_PTR(-EINVAL));
+
+bad_array:
+	dm_dirty_log_destroy(dl);
+	TI_ERR_RET("Arry too big", ERR_PTR(-EINVAL));
+
+bad_alloc:
+	dm_dirty_log_destroy(dl);
+	TI_ERR_RET("Cannot allocate raid context", ERR_PTR(-ENOMEM));
+
+bad_rh:
+	dm_dirty_log_destroy(dl);
+	ti->error = DM_MSG_PREFIX "Error creating dirty region hash";
+	goto free_rs;
+
+bad_sc:
+	dm_region_hash_destroy(rec->rh); /* Destroys dirty log too. */
+	sc_exit(&rs->sc);
+	ti->error = DM_MSG_PREFIX "Error creating stripe cache";
+free_rs:
+	kfree(rs);
+	return ERR_PTR(-ENOMEM);
+}
+
+/* Free a RAID context (a RAID set). */
+static void context_free(struct raid_set *rs, unsigned p)
+{
+	while (p--)
+		dm_put_device(rs->ti, rs->dev[p].dev);
+
+	sc_exit(&rs->sc);
+	dm_region_hash_destroy(rs->recover.rh); /* Destroys dirty log too. */
+	kfree(rs);
+}
+
+/* Create work queue and initialize delayed work. */
+static int rs_workqueue_init(struct raid_set *rs)
+{
+	struct dm_target *ti = rs->ti;
+
+	rs->io.wq = create_singlethread_workqueue(DAEMON);
+	if (!rs->io.wq)
+		TI_ERR_RET("failed to create " DAEMON, -ENOMEM);
+
+	INIT_DELAYED_WORK(&rs->io.dws_do_raid, do_raid);
+	INIT_WORK(&rs->io.ws_do_table_event, do_table_event);
+	return 0;
+}
+
+/* Return pointer to raid_type structure for raid name. */
+static struct raid_type *get_raid_type(char *name)
+{
+	struct raid_type *r = ARRAY_END(raid_types);
+
+	while (r-- > raid_types) {
+		if (!strcmp(r->name, name))
+			return r;
+	}
+
+	return NULL;
+}
+
+/* FIXME: factor out to dm core. */
+static int multiple(sector_t a, sector_t b, sector_t *n)
+{
+	sector_t r = a;
+
+	sector_div(r, b);
+	*n = r;
+	return a == r * b;
+}
+
+/* Log RAID set information to kernel log. */
+static void rs_log(struct raid_set *rs, unsigned speed)
+{
+	unsigned p;
+	char buf[BDEVNAME_SIZE];
+
+	for (p = 0; p < rs->set.raid_devs; p++)
+		DMINFO("/dev/%s is raid disk %u%s",
+				bdevname(rs->dev[p].dev->bdev, buf), p,
+				(p == rs->set.pi) ? " (parity)" : "");
+
+	DMINFO("%d/%d/%d sectors chunk/io/recovery size, %u stripes\n"
+	       "algorithm \"%s\", %u chunks with %uMB/s\n"
+	       "%s set with net %u/%u devices",
+	       rs->set.chunk_size, rs->set.io_size, rs->recover.io_size,
+	       atomic_read(&rs->sc.stripes),
+	       rs->xor.f->name, rs->xor.chunks, mbpers(rs, speed),
+	       rs->set.raid_type->descr, rs->set.data_devs, rs->set.raid_devs);
+}
+
+/* Get all devices and offsets. */
+static int dev_parms(struct raid_set *rs, char **argv, int *p)
+{
+	struct dm_target *ti = rs->ti;
+
+	for (*p = 0; *p < rs->set.raid_devs; (*p)++, argv += 2) {
+		int r;
+		unsigned long long tmp;
+		struct raid_dev *dev = rs->dev + *p;
+
+		/* Get offset and device. */
+		if (sscanf(argv[1], "%llu", &tmp) != 1 ||
+		    tmp > rs->set.sectors_per_dev)
+			TI_ERR("Invalid RAID device offset parameter");
+
+		dev->start = tmp;
+		r = dm_get_device(ti, *argv, dev->start,
+				  rs->set.sectors_per_dev,
+				  dm_table_get_mode(ti->table), &dev->dev);
+		if (r)
+			TI_ERR_RET("RAID device lookup failure", r);
+
+		r = raid_dev_lookup(rs, dev);
+		if (r != -ENODEV && r < *p) {
+			(*p)++;	/* Ensure dm_put_device() on actual device. */
+			TI_ERR_RET("Duplicate RAID device", -ENXIO);
+		}
+	}
+
+	return 0;
+}
+
+/* Set recovery bandwidth. */
+static void
+recover_set_bandwidth(struct raid_set *rs, unsigned bandwidth)
+{
+	rs->recover.bandwidth = bandwidth;
+	rs->recover.bandwidth_work = 100 / bandwidth;
+}
+
+/* Handle variable number of RAID parameters. */
+static int get_raid_variable_parms(struct dm_target *ti, char **argv, 
+				   struct variable_parms *vp)
+{
+	int p, value;
+	struct {
+		int action; /* -1: skip, 0: no pwer2 check, 1: power2 check */
+		char *errmsg;
+		int min, max;
+		int *var, *var2, *var3;
+	} argctr[] = {
+		{ 1,
+		  "Invalid chunk size; must be -1 or 2^^n and <= 16384",
+ 		  IO_SIZE_MIN, CHUNK_SIZE_MAX,
+		  &vp->chunk_size_parm, &vp->chunk_size, &vp->io_size },
+		{ 0,
+		  "Invalid number of stripes: must be -1 or >= 8 and <= 16384",
+		  STRIPES_MIN, STRIPES_MAX,
+		  &vp->stripes_parm, &vp->stripes, NULL },
+		{ 1,
+		  "Invalid io size; must -1 or >= 8, 2^^n and less equal "
+		  "min(BIO_MAX_SECTORS/2, chunk size)",
+		  IO_SIZE_MIN, 0, /* Needs to be updated in loop below. */
+		  &vp->io_size_parm, &vp->io_size, NULL },
+		{ 1,
+		  "Invalid recovery io size; must be -1 or "
+		  "2^^n and less equal BIO_MAX_SECTORS/2",
+		  RECOVER_IO_SIZE_MIN, BIO_MAX_SECTORS / 2,
+		  &vp->recover_io_size_parm, &vp->recover_io_size, NULL },
+		{ 0,
+		  "Invalid recovery bandwidth percentage; "
+		  "must be -1 or > 0 and <= 100",
+		  BANDWIDTH_MIN, BANDWIDTH_MAX,
+		  &vp->bandwidth_parm, &vp->bandwidth, NULL },
+		/* Handle sync argument seperately in loop. */
+		{ -1,
+		  "Invalid recovery switch; must be \"sync\" or \"nosync\"" },
+		{ 0,
+		  "Invalid number of recovery stripes;"
+		  "must be -1, > 0 and <= 16384",
+		  RECOVERY_STRIPES_MIN, RECOVERY_STRIPES_MAX,
+		  &vp->recovery_stripes_parm, &vp->recovery_stripes, NULL },
+	}, *varp;
+
+	/* Fetch # of variable raid parameters. */
+	if (sscanf(*(argv++), "%d", &vp->raid_parms) != 1 ||
+	    !range_ok(vp->raid_parms, 0, 7))
+		TI_ERR("Bad variable raid parameters number");
+
+	/* Preset variable RAID parameters. */
+	vp->chunk_size = CHUNK_SIZE_DEFAULT;
+	vp->io_size = IO_SIZE_DEFAULT;
+	vp->stripes = STRIPES_DEFAULT;
+	vp->recover_io_size = RECOVER_IO_SIZE_DEFAULT;
+	vp->bandwidth = BANDWIDTH_DEFAULT;
+	vp->recovery = 1;
+	vp->recovery_stripes = RECOVERY_STRIPES_DEFAULT;
+
+	/* Walk the array of argument constraints for all given ones. */
+	for (p = 0, varp = argctr; p < vp->raid_parms; p++, varp++) {
+	     	BUG_ON(varp >= ARRAY_END(argctr));
+
+		/* Special case for "[no]sync" string argument. */
+		if (varp->action < 0) {
+			if (!strcmp(*argv, "sync"))
+				;
+			else if (!strcmp(*argv, "nosync"))
+				vp->recovery = 0;
+			else
+				TI_ERR(varp->errmsg);
+
+			argv++;
+			continue;
+		}
+
+		/*
+		 * Special case for io_size depending
+		 * on previously set chunk size.
+		 */
+		if (p == 2)
+			varp->max = min(BIO_MAX_SECTORS / 2, vp->chunk_size);
+
+		if (sscanf(*(argv++), "%d", &value) != 1 ||
+		    (value != -1 &&
+		     ((varp->action && !POWER_OF_2(value)) ||
+		      !range_ok(value, varp->min, varp->max))))
+			TI_ERR(varp->errmsg);
+
+		*varp->var = value;
+		if (value != -1) {
+			if (varp->var2)
+				*varp->var2 = value;
+			if (varp->var3)
+				*varp->var3 = value;
+		}
+	}
+
+	return 0;
+}
+
+/* Parse optional locking parameters. */
+static int get_raid_locking_parms(struct dm_target *ti, char **argv,
+				  int *locking_parms,
+				  struct dm_raid45_locking_type **locking_type)
+{
+	if (!strnicmp(argv[0], "locking", strlen(argv[0]))) {
+		char *lckstr = argv[1];
+		size_t lcksz = strlen(lckstr);
+
+		if (!strnicmp(lckstr, "none", lcksz)) {
+			*locking_type = &locking_none;
+			*locking_parms = 2;
+		} else if (!strnicmp(lckstr, "cluster", lcksz)) {
+			DMERR("locking type \"%s\" not yet implemented",
+			      lckstr);
+			return -EINVAL;
+		} else {
+			DMERR("unknown locking type \"%s\"", lckstr);
+			return -EINVAL;
+		}
+	}
+
+	*locking_parms = 0;
+	*locking_type = &locking_none;
+	return 0;
+}
+
+/* Set backing device read ahead properties of RAID set. */
+static void rs_set_read_ahead(struct raid_set *rs,
+			      unsigned sectors, unsigned stripes)
+{
+	unsigned ra_pages = dm_div_up(sectors, SECTORS_PER_PAGE);
+	struct mapped_device *md = dm_table_get_md(rs->ti->table);
+	struct backing_dev_info *bdi = &dm_disk(md)->queue->backing_dev_info;
+
+	/* Set read-ahead for the RAID set and the component devices. */
+	if (ra_pages) {
+		unsigned p = rs->set.raid_devs;
+
+		bdi->ra_pages = stripes * ra_pages * rs->set.data_devs;
+
+		while (p--) {
+			struct request_queue *q =
+				bdev_get_queue(rs->dev[p].dev->bdev);
+
+			q->backing_dev_info.ra_pages = ra_pages;
+		}
+	}
+
+	dm_put(md);
+}
+
+/* Set congested function. */
+static void rs_set_congested_fn(struct raid_set *rs)
+{
+	struct mapped_device *md = dm_table_get_md(rs->ti->table);
+	struct backing_dev_info *bdi = &dm_disk(md)->queue->backing_dev_info;
+
+	/* Set congested function and data. */
+	bdi->congested_fn = rs_congested;
+	bdi->congested_data = rs;
+	dm_put(md);
+}
+
+/*
+ * Construct a RAID4/5 mapping:
+ *
+ * log_type #log_params <log_params> \
+ * raid_type [#parity_dev] #raid_variable_params <raid_params> \
+ * [locking "none"/"cluster"]
+ * #raid_devs #dev_to_initialize [<dev_path> <offset>]{3,}
+ *
+ * log_type = "core"/"disk",
+ * #log_params = 1-3 (1-2 for core dirty log type, 3 for disk dirty log only)
+ * log_params = [dirty_log_path] region_size [[no]sync])
+ *
+ * raid_type = "raid4", "raid5_la", "raid5_ra", "raid5_ls", "raid5_rs"
+ *
+ * #parity_dev = N if raid_type = "raid4"
+ * o N = -1: pick default = last device
+ * o N >= 0 and < #raid_devs: parity device index
+ *
+ * #raid_variable_params = 0-7; raid_params (-1 = default):
+ *   [chunk_size [#stripes [io_size [recover_io_size \
+ *    [%recovery_bandwidth [recovery_switch [#recovery_stripes]]]]]]]
+ *   o chunk_size (unit to calculate drive addresses; must be 2^^n, > 8
+ *     and <= CHUNK_SIZE_MAX)
+ *   o #stripes is number of stripes allocated to stripe cache
+ *     (must be > 1 and < STRIPES_MAX)
+ *   o io_size (io unit size per device in sectors; must be 2^^n and > 8)
+ *   o recover_io_size (io unit size per device for recovery in sectors;
+ must be 2^^n, > SECTORS_PER_PAGE and <= region_size)
+ *   o %recovery_bandwith is the maximum amount spend for recovery during
+ *     application io (1-100%)
+ *   o recovery switch = [sync|nosync]
+ *   o #recovery_stripes is the number of recovery stripes used for
+ *     parallel recovery of the RAID set
+ * If raid_variable_params = 0, defaults will be used.
+ * Any raid_variable_param can be set to -1 to apply a default
+ *
+ * #raid_devs = N (N >= 3)
+ *
+ * #dev_to_initialize = N
+ * -1: initialize parity on all devices
+ * >= 0 and < #raid_devs: initialize raid_path; used to force reconstruction
+ * of a failed devices content after replacement
+ *
+ * <dev_path> = device_path (eg, /dev/sdd1)
+ * <offset>   = begin at offset on <dev_path>
+ *
+ */
+#define	MIN_PARMS	13
+static int raid_ctr(struct dm_target *ti, unsigned argc, char **argv)
+{
+	int dev_to_init, dl_parms, i, locking_parms,
+	    parity_parm, pi = -1, r, raid_devs;
+	unsigned speed;
+	sector_t tmp, sectors_per_dev;
+	struct dm_raid45_locking_type *locking;
+	struct raid_set *rs;
+	struct raid_type *raid_type;
+	struct variable_parms parms;
+
+	/* Ensure minimum number of parameters. */
+	if (argc < MIN_PARMS)
+		TI_ERR("Not enough parameters");
+
+	/* Fetch # of dirty log parameters. */
+	if (sscanf(argv[1], "%d", &dl_parms) != 1 ||
+	    !range_ok(dl_parms, 1, 4711)) /* ;-) */
+		TI_ERR("Bad dirty log parameters number");
+
+	/* Check raid_type. */
+	raid_type = get_raid_type(argv[dl_parms + 2]);
+	if (!raid_type)
+		TI_ERR("Bad raid type");
+
+	/* In case of RAID4, parity drive is selectable. */
+	parity_parm = !!(raid_type->level == raid4);
+
+	/* Handle variable number of RAID parameters. */
+	r = get_raid_variable_parms(ti, argv + dl_parms + parity_parm + 3,
+				    &parms);
+	if (r)
+		return r;
+
+	/* Handle any locking parameters. */
+	r = get_raid_locking_parms(ti,
+				   argv + dl_parms + parity_parm +
+				   parms.raid_parms + 4,
+				   &locking_parms, &locking);
+	if (r)
+		return r;
+
+	/* # of raid devices. */
+	i = dl_parms + parity_parm + parms.raid_parms + locking_parms + 4;
+	if (sscanf(argv[i], "%d", &raid_devs) != 1 ||
+	    raid_devs < raid_type->minimal_devs)
+		TI_ERR("Invalid number of raid devices");
+
+	/* In case of RAID4, check parity drive index is in limits. */
+	if (raid_type->level == raid4) {
+		/* Fetch index of parity device. */
+		if (sscanf(argv[dl_parms + 3], "%d", &pi) != 1 ||
+		    (pi != -1 && !range_ok(pi, 0, raid_devs - 1)))
+			TI_ERR("Invalid RAID4 parity device index");
+	}
+
+	/*
+	 * Index of device to initialize starts at 0
+	 *
+	 * o -1 -> don't initialize a selected device;
+	 *         initialize parity conforming to algorithm
+	 * o 0..raid_devs-1 -> initialize respective device
+	 *   (used for reconstruction of a replaced device)
+	 */
+	if (sscanf(argv[dl_parms + parity_parm + parms.raid_parms +
+		   locking_parms + 5], "%d", &dev_to_init) != 1 ||
+	    !range_ok(dev_to_init, -1, raid_devs - 1))
+		TI_ERR("Invalid number for raid device to initialize");
+
+	/* Check # of raid device arguments. */
+	if (argc - dl_parms - parity_parm - parms.raid_parms - 6 !=
+	    2 * raid_devs)
+		TI_ERR("Wrong number of raid device/offset arguments");
+
+	/*
+	 * Check that the table length is devisable
+	 * w/o rest by (raid_devs - parity_devs)
+	 */
+	if (!multiple(ti->len, raid_devs - raid_type->parity_devs,
+		      &sectors_per_dev))
+		TI_ERR("Target length not divisible by number of data devices");
+
+	/*
+	 * Check that the device size is
+	 * devisable w/o rest by chunk size
+	 */
+	if (!multiple(sectors_per_dev, parms.chunk_size, &tmp))
+		TI_ERR("Device length not divisible by chunk_size");
+
+	/****************************************************************
+	 * Now that we checked the constructor arguments ->
+	 * let's allocate the RAID set
+	 ****************************************************************/
+	rs = context_alloc(raid_type, &parms, raid_devs, sectors_per_dev,
+			   ti, dl_parms, argv);
+	if (IS_ERR(rs))
+		return PTR_ERR(rs);
+
+
+	rs->set.dev_to_init = rs->set.dev_to_init_parm = dev_to_init;
+	rs->set.pi = rs->set.pi_parm = pi;
+
+	/* Set RAID4 parity drive index. */
+	if (raid_type->level == raid4)
+		rs->set.pi = (pi == -1) ? rs->set.data_devs : pi;
+
+	recover_set_bandwidth(rs, parms.bandwidth);
+
+	/* Use locking type to lock stripe access. */
+	rs->locking = locking;
+
+	/* Get the device/offset tupels. */
+	argv += dl_parms + 6 + parity_parm + parms.raid_parms;
+	r = dev_parms(rs, argv, &i);
+	if (r)
+		goto err;
+
+	/* Set backing device information (eg. read ahead). */
+	rs_set_read_ahead(rs, 2 * rs->set.chunk_size, 4 /* stripes */);
+	rs_set_congested_fn(rs); /* Set congested function. */
+	SetRSCheckOverwrite(rs); /* Allow chunk overwrite checks. */
+	speed = xor_optimize(rs); /* Select best xor algorithm. */
+
+	/* Set for recovery of any nosync regions. */
+	if (parms.recovery)
+		SetRSRecover(rs);
+	else {
+		/*
+		 * Need to free recovery stripe(s) here in case
+		 * of nosync, because xor_optimize uses one.
+		 */
+		set_start_recovery(rs);
+		set_end_recovery(rs);
+		stripe_recover_free(rs);
+	}
+
+	/*
+	 * Make sure that dm core only hands maximum io size
+	 * length down and pays attention to io boundaries.
+	 */
+	ti->split_io = rs->set.io_size;
+	ti->private = rs;
+
+	/* Initialize work queue to handle this RAID set's io. */
+	r = rs_workqueue_init(rs);
+	if (r)
+		goto err;
+
+	rs_log(rs, speed); /* Log information about RAID set. */
+	return 0;
+
+err:
+	context_free(rs, i);
+	return r;
+}
+
+/*
+ * Destruct a raid mapping
+ */
+static void raid_dtr(struct dm_target *ti)
+{
+	struct raid_set *rs = ti->private;
+
+	destroy_workqueue(rs->io.wq);
+	context_free(rs, rs->set.raid_devs);
+}
+
+/* Raid mapping function. */
+static int raid_map(struct dm_target *ti, struct bio *bio,
+		    union map_info *map_context)
+{
+	/* I don't want to waste stripe cache capacity. */
+	if (bio_rw(bio) == READA)
+		return -EIO;
+	else {
+		struct raid_set *rs = ti->private;
+
+		/*
+		 * Get io reference to be waiting for to drop
+		 * to zero on device suspension/destruction.
+		 */
+		io_get(rs);
+		bio->bi_sector -= ti->begin;	/* Remap sector. */
+
+		/* Queue io to RAID set. */
+		mutex_lock(&rs->io.in_lock);
+		bio_list_add(&rs->io.in, bio);
+		mutex_unlock(&rs->io.in_lock);
+
+		/* Wake daemon to process input list. */
+		wake_do_raid(rs);
+
+		/* REMOVEME: statistics. */
+		atomic_inc(rs->stats + (bio_data_dir(bio) == READ ?
+				        S_BIOS_READ : S_BIOS_WRITE));
+		return DM_MAPIO_SUBMITTED;	/* Handle later. */
+	}
+}
+
+/* Device suspend. */
+static void raid_presuspend(struct dm_target *ti)
+{
+	struct raid_set *rs = ti->private;
+	struct dm_dirty_log *dl = rs->recover.dl;
+
+	SetRSSuspend(rs);
+
+	if (RSRecover(rs))
+		dm_rh_stop_recovery(rs->recover.rh);
+
+	cancel_delayed_work(&rs->io.dws_do_raid);
+	flush_workqueue(rs->io.wq);
+	wait_ios(rs);	/* Wait for completion of all ios being processed. */
+
+	if (dl->type->presuspend && dl->type->presuspend(dl))
+		/* FIXME: need better error handling. */
+		DMWARN("log presuspend failed");
+}
+
+static void raid_postsuspend(struct dm_target *ti)
+{
+	struct raid_set *rs = ti->private;
+	struct dm_dirty_log *dl = rs->recover.dl;
+
+	if (dl->type->postsuspend && dl->type->postsuspend(dl))
+		/* FIXME: need better error handling. */
+		DMWARN("log postsuspend failed");
+
+}
+
+/* Device resume. */
+static void raid_resume(struct dm_target *ti)
+{
+	struct raid_set *rs = ti->private;
+	struct recover *rec = &rs->recover;
+	struct dm_dirty_log *dl = rec->dl;
+
+	if (dl->type->resume && dl->type->resume(dl))
+		/* Resume dirty log. */
+		/* FIXME: need better error handling. */
+		DMWARN("log resume failed");
+
+	rec->nr_regions_to_recover =
+		rec->nr_regions - dl->type->get_sync_count(dl);
+
+	/* Restart any unfinished recovery. */
+	if (RSRecover(rs)) {
+		set_start_recovery(rs);
+		dm_rh_start_recovery(rec->rh);
+	}
+
+	ClearRSSuspend(rs);
+	wake_do_raid(rs);
+}
+
+/* Return stripe cache size. */
+static unsigned sc_size(struct raid_set *rs)
+{
+	return to_sector(atomic_read(&rs->sc.stripes) *
+			 (sizeof(struct stripe) +
+			  (sizeof(struct stripe_chunk) +
+			   (sizeof(struct page_list) +
+			    to_bytes(rs->set.io_size) *
+			    rs->set.raid_devs)) +
+			  (rs->recover.end_jiffies ?
+			   0 : rs->recover.recovery_stripes *
+			   to_bytes(rs->set.raid_devs * rs->recover.io_size))));
+}
+
+/* REMOVEME: status output for development. */
+static void raid_devel_stats(struct dm_target *ti, char *result,
+			     unsigned *size, unsigned maxlen)
+{
+	unsigned sz = *size;
+	unsigned long j;
+	char buf[BDEVNAME_SIZE], *p;
+	struct stats_map *sm;
+	struct raid_set *rs = ti->private;
+	struct recover *rec = &rs->recover;
+	struct timespec ts;
+
+	DMEMIT("%s %s %u\n", version, rs->xor.f->name, rs->xor.chunks);
+	DMEMIT("act_ios=%d ", io_ref(rs));
+	DMEMIT("act_ios_max=%d\n", atomic_read(&rs->io.in_process_max));
+	DMEMIT("act_stripes=%d ", sc_active(&rs->sc));
+	DMEMIT("act_stripes_max=%d\n",
+	       atomic_read(&rs->sc.active_stripes_max));
+
+	for (sm = stats_map; sm < ARRAY_END(stats_map); sm++)
+		DMEMIT("%s%d", sm->str, atomic_read(rs->stats + sm->type));
+
+	DMEMIT(" checkovr=%s\n", RSCheckOverwrite(rs) ? "on" : "off");
+	DMEMIT("sc=%u/%u/%u/%u/%u/%u/%u\n", rs->set.chunk_size,
+	       atomic_read(&rs->sc.stripes), rs->set.io_size,
+	       rec->recovery_stripes, rec->io_size, rs->sc.hash.buckets,
+	       sc_size(rs));
+
+	j = (rec->end_jiffies ? rec->end_jiffies : jiffies) -
+	    rec->start_jiffies;
+	jiffies_to_timespec(j, &ts);
+	sprintf(buf, "%ld.%ld", ts.tv_sec, ts.tv_nsec);
+	p = strchr(buf, '.');
+	p[3] = 0;
+
+	DMEMIT("rg=%llu/%llu/%llu/%u %s\n",
+	       (unsigned long long) rec->nr_regions_recovered,
+	       (unsigned long long) rec->nr_regions_to_recover,
+	       (unsigned long long) rec->nr_regions, rec->bandwidth, buf);
+
+	*size = sz;
+}
+
+static int raid_status(struct dm_target *ti, status_type_t type,
+		       char *result, unsigned maxlen)
+{
+	unsigned p, sz = 0;
+	char buf[BDEVNAME_SIZE];
+	struct raid_set *rs = ti->private;
+	int raid_parms[] = {
+		rs->set.chunk_size_parm,
+		rs->sc.stripes_parm,
+		rs->set.io_size_parm,
+		rs->recover.io_size_parm,
+		rs->recover.bandwidth_parm,
+		-2,
+		rs->recover.recovery_stripes,
+	};
+
+	switch (type) {
+	case STATUSTYPE_INFO:
+		/* REMOVEME: statistics. */
+		if (RSDevelStats(rs))
+			raid_devel_stats(ti, result, &sz, maxlen);
+
+		DMEMIT("%u ", rs->set.raid_devs);
+
+		for (p = 0; p < rs->set.raid_devs; p++)
+			DMEMIT("%s ",
+			       format_dev_t(buf, rs->dev[p].dev->bdev->bd_dev));
+
+		DMEMIT("1 ");
+		for (p = 0; p < rs->set.raid_devs; p++) {
+			DMEMIT("%c", !DevFailed(rs->dev + p) ? 'A' : 'D');
+
+			if (p == rs->set.pi)
+				DMEMIT("p");
+
+			if (rs->set.dev_to_init == p)
+				DMEMIT("i");
+		}
+
+		break;
+	case STATUSTYPE_TABLE:
+		sz = rs->recover.dl->type->status(rs->recover.dl, type,
+						  result, maxlen);
+		DMEMIT("%s %u ", rs->set.raid_type->name,
+		       rs->set.raid_parms);
+
+		for (p = 0; p < rs->set.raid_parms; p++) {
+			if (raid_parms[p] > -2)
+				DMEMIT("%d ", raid_parms[p]);
+			else
+				DMEMIT("%s ", rs->recover.recovery ?
+					      "sync" : "nosync");
+		}
+
+		DMEMIT("%u %d ", rs->set.raid_devs, rs->set.dev_to_init);
+
+		for (p = 0; p < rs->set.raid_devs; p++)
+			DMEMIT("%s %llu ",
+			       format_dev_t(buf, rs->dev[p].dev->bdev->bd_dev),
+			       (unsigned long long) rs->dev[p].start);
+	}
+
+	return 0;
+}
+
+/*
+ * Message interface
+ */
+enum raid_msg_actions {
+	act_bw,			/* Recovery bandwidth switch. */
+	act_dev,		/* Device failure switch. */
+	act_overwrite,		/* Stripe overwrite check. */
+	act_stats,		/* Development statistics switch. */
+	act_sc,			/* Stripe cache switch. */
+
+	act_on,			/* Set entity on. */
+	act_off,		/* Set entity off. */
+	act_reset,		/* Reset entity. */
+
+	act_set = act_on,	/* Set # absolute. */
+	act_grow = act_off,	/* Grow # by an amount. */
+	act_shrink = act_reset,	/* Shrink # by an amount. */
+};
+
+/* Turn a delta into an absolute value. */
+static int _absolute(unsigned long action, int act, int r)
+{
+	/* Make delta absolute. */
+	if (test_bit(act_set, &action))
+		;
+	else if (test_bit(act_grow, &action))
+		r += act;
+	else if (test_bit(act_shrink, &action))
+		r = act - r;
+	else
+		r = -EINVAL;
+
+	return r;
+}
+
+ /* Change recovery io bandwidth. */
+static int bandwidth_change(struct dm_msg *msg, void *context)
+{
+	struct raid_set *rs = context;
+	int act = rs->recover.bandwidth;
+	int bandwidth = DM_MSG_INT_ARG(msg);
+
+	if (range_ok(bandwidth, BANDWIDTH_MIN, BANDWIDTH_MAX)) {
+		/* Make delta bandwidth absolute. */
+		bandwidth = _absolute(msg->action, act, bandwidth);
+
+		/* Check range. */
+		if (range_ok(bandwidth, BANDWIDTH_MIN, BANDWIDTH_MAX)) {
+			recover_set_bandwidth(rs, bandwidth);
+			return 0;
+		}
+	}
+
+	set_bit(dm_msg_ret_arg, &msg->ret);
+	set_bit(dm_msg_ret_inval, &msg->ret);
+	return -EINVAL;
+}
+
+/* Set/reset development feature flags. */
+static int devel_flags(struct dm_msg *msg, void *context)
+{
+	struct raid_set *rs = context;
+
+	if (test_bit(act_on, &msg->action))
+		return test_and_set_bit(msg->spec->parm,
+					&rs->io.flags) ? -EPERM : 0;
+	else if (test_bit(act_off, &msg->action))
+		return test_and_clear_bit(msg->spec->parm,
+					  &rs->io.flags) ? 0 : -EPERM;
+	else if (test_bit(act_reset, &msg->action)) {
+		if (test_bit(act_stats, &msg->action)) {
+			stats_reset(rs);
+			goto on;
+		} else if (test_bit(act_overwrite, &msg->action)) {
+on:
+			set_bit(msg->spec->parm, &rs->io.flags);
+			return 0;
+		}
+	}
+
+	return -EINVAL;
+}
+
+/* Resize the stripe cache. */
+static int sc_resize(struct dm_msg *msg, void *context)
+{
+	int act, stripes;
+	struct raid_set *rs = context;
+
+	/* Deny permission in case the daemon is still resizing!. */
+	if (atomic_read(&rs->sc.stripes_to_set))
+		return -EPERM;
+
+	stripes = DM_MSG_INT_ARG(msg);
+	if (stripes > 0) {
+		act = atomic_read(&rs->sc.stripes);
+
+		/* Make delta stripes absolute. */
+		stripes = _absolute(msg->action, act, stripes);
+
+		/*
+		 * Check range and that the # of stripes changes.
+		 * We leave the resizing to the wroker.
+		 */
+		if (range_ok(stripes, STRIPES_MIN, STRIPES_MAX) &&
+		    stripes != atomic_read(&rs->sc.stripes)) {
+			atomic_set(&rs->sc.stripes_to_set, stripes);
+			wake_do_raid(rs);
+			return 0;
+		}
+	}
+
+	set_bit(dm_msg_ret_arg, &msg->ret);
+	set_bit(dm_msg_ret_inval, &msg->ret);
+	return -EINVAL;
+}
+
+/* Parse the RAID message action. */
+/*
+ * 'ba[ndwidth] {se[t],g[row],sh[rink]} #'	# e.g 'ba se 50'
+ * "o[verwrite]  {on,of[f],r[eset]}'		# e.g. 'o of'
+ * 'sta[tistics] {on,of[f],r[eset]}'		# e.g. 'stat of'
+ * 'str[ipecache] {se[t],g[row],sh[rink]} #'	# e.g. 'stripe set 1024'
+ *
+ */
+static int raid_message(struct dm_target *ti, unsigned argc, char **argv)
+{
+	/* Variables to store the parsed parameters im. */
+	static int i[2];
+	static unsigned long *i_arg[] = {
+		(unsigned long *) i + 0,
+		(unsigned long *) i + 1,
+	};
+
+	/* Declare all message option strings. */
+	static char *str_sgs[] = { "set", "grow", "shrink" };
+	static char *str_oor[] = { "on", "off", "reset" };
+
+	/* Declare all actions. */
+	static unsigned long act_sgs[] = { act_set, act_grow, act_shrink };
+	static unsigned long act_oor[] = { act_on, act_off, act_reset };
+
+	/* Bandwidth option. */
+	static struct dm_message_option bw_opt = { 3, str_sgs, act_sgs };
+	static struct dm_message_argument bw_args = {
+		1, i_arg, { dm_msg_int_t }
+	};
+
+	static struct dm_message_argument null_args = {
+		0, NULL, { dm_msg_int_t }
+	};
+
+	/* Overwrite and statistics option. */
+	static struct dm_message_option ovr_stats_opt = { 3, str_oor, act_oor };
+
+	/* Sripecache option. */
+	static struct dm_message_option stripe_opt = { 3, str_sgs, act_sgs };
+
+	/* Declare messages. */
+	static struct dm_msg_spec specs[] = {
+		{ "bandwidth", act_bw, &bw_opt, &bw_args,
+		  0, bandwidth_change },
+		{ "overwrite", act_overwrite, &ovr_stats_opt, &null_args,
+		  RS_CHECK_OVERWRITE, devel_flags },
+		{ "statistics", act_stats, &ovr_stats_opt, &null_args,
+		  RS_DEVEL_STATS, devel_flags },
+		{ "stripecache", act_sc, &stripe_opt, &bw_args,
+		  0, sc_resize },
+	};
+
+	/* The message for the parser. */
+	struct dm_msg msg = {
+		.num_specs = ARRAY_SIZE(specs),
+		.specs = specs,
+	};
+
+	return dm_message_parse(TARGET, &msg, ti->private, argc, argv);
+}
+/*
+ * END message interface
+ */
+
+static struct target_type raid_target = {
+	.name = "raid45",
+	.version = {1, 0, 0},
+	.module = THIS_MODULE,
+	.ctr = raid_ctr,
+	.dtr = raid_dtr,
+	.map = raid_map,
+	.presuspend = raid_presuspend,
+	.postsuspend = raid_postsuspend,
+	.resume = raid_resume,
+	.status = raid_status,
+	.message = raid_message,
+};
+
+static void init_exit(const char *bad_msg, const char *good_msg, int r)
+{
+	if (r)
+		DMERR("Failed to %sregister target [%d]", bad_msg, r);
+	else
+		DMINFO("%s %s", good_msg, version);
+}
+
+static int __init dm_raid_init(void)
+{
+	int r = dm_register_target(&raid_target);
+
+	init_exit("", "initialized", r);
+	return r;
+}
+
+static void __exit dm_raid_exit(void)
+{
+	dm_unregister_target(&raid_target);
+	init_exit("un", "exit", 0);
+}
+
+/* Module hooks. */
+module_init(dm_raid_init);
+module_exit(dm_raid_exit);
+
+MODULE_DESCRIPTION(DM_NAME " raid4/5 target");
+MODULE_AUTHOR("Heinz Mauelshagen <hjm@redhat.com>");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("dm-raid4");
+MODULE_ALIAS("dm-raid5");
--- linux-rt-2.6.31.orig/ubuntu/dm-raid4-5/dm-message.c
+++ linux-rt-2.6.31/ubuntu/dm-raid4-5/dm-message.c
@@ -0,0 +1,183 @@
+/*
+ * Copyright (C) 2007,2008 Red Hat Inc. All rights reserved.
+ *
+ * Module Author: Heinz Mauelshagen <heinzm@redhat.com>
+ *
+ * General device-mapper message interface argument parser.
+ *
+ * This file is released under the GPL.
+ *
+ * device-mapper message parser.
+ *
+ */
+
+#include "dm.h"
+#include "dm-message.h"
+#include <linux/kernel.h>
+
+#define DM_MSG_PREFIX	"dm_message"
+
+/* Basename of a path. */
+static inline char *
+basename(char *s)
+{
+	char *p = strrchr(s, '/');
+
+	return p ? p + 1 : s;
+}
+
+/* Get an argument depending on type. */
+static void
+message_arguments(struct dm_msg *msg, int argc, char **argv)
+{
+
+	if (argc) {
+		int i;
+		struct dm_message_argument *args = msg->spec->args;
+
+		for (i = 0; i < args->num_args; i++) {
+			int r;
+			unsigned long **ptr = args->ptr;
+			enum dm_message_argument_type type = args->types[i];
+
+			switch (type) {
+			case dm_msg_base_t:
+				((char **) ptr)[i] = basename(argv[i]);
+				break;
+
+			case dm_msg_str_t:
+				((char **) ptr)[i] = argv[i];
+				break;
+
+			case dm_msg_int_t:
+				r = sscanf(argv[i], "%d", ((int **) ptr)[i]);
+				goto check;
+
+			case dm_msg_uint_t:
+				r = sscanf(argv[i], "%u",
+					   ((unsigned **) ptr)[i]);
+				goto check;
+
+			case dm_msg_uint64_t:
+				r = sscanf(argv[i], "%llu",
+					   ((unsigned long long **) ptr)[i]);
+
+check:
+				if (r != 1) {
+					set_bit(dm_msg_ret_undef, &msg->ret);
+					set_bit(dm_msg_ret_arg, &msg->ret);
+				}
+			}
+		}
+	}
+}
+
+/* Parse message options. */
+static void
+message_options_parse(struct dm_msg *msg, int argc, char **argv)
+{
+	int hit = 0;
+	unsigned long *action;
+	size_t l1 = strlen(*argv), l_hit = 0;
+	struct dm_message_option *o = msg->spec->options;
+	char **option, **option_end = o->options + o->num_options;
+
+	for (option = o->options, action = o->actions;
+	     option < option_end; option++, action++) {
+		size_t l2 = strlen(*option);
+
+		if (!strnicmp(*argv, *option, min(l1, l2))) {
+			hit++;
+			l_hit = l2;
+			set_bit(*action, &msg->action);
+		}
+	}
+
+	/* Assume error. */
+	msg->ret = 0;
+	set_bit(dm_msg_ret_option, &msg->ret);
+	if (!hit || l1 > l_hit)
+		set_bit(dm_msg_ret_undef, &msg->ret);	/* Undefined option. */
+	else if (hit > 1)
+		set_bit(dm_msg_ret_ambiguous, &msg->ret); /* Ambiguous option.*/
+	else {
+		clear_bit(dm_msg_ret_option, &msg->ret); /* Option OK. */
+		message_arguments(msg, --argc, ++argv);
+	}
+}
+
+static inline void
+print_ret(const char *caller, unsigned long ret)
+{
+	struct {
+		unsigned long err;
+		const char *err_str;
+	} static err_msg[] = {
+		{ dm_msg_ret_ambiguous, "message ambiguous" },
+		{ dm_msg_ret_inval, "message invalid" },
+		{ dm_msg_ret_undef, "message undefined" },
+		{ dm_msg_ret_arg, "message argument" },
+		{ dm_msg_ret_argcount, "message argument count" },
+		{ dm_msg_ret_option, "option" },
+	}, *e = ARRAY_END(err_msg);
+
+	while (e-- > err_msg) {
+		if (test_bit(e->err, &ret))
+			DMERR("%s %s", caller, e->err_str);
+	}
+}
+
+/* Parse a message action. */
+int
+dm_message_parse(const char *caller, struct dm_msg *msg, void *context,
+		 int argc, char **argv)
+{
+	int hit = 0;
+	size_t l1, l_hit = 0;
+	struct dm_msg_spec *s, *s_hit = NULL,
+			   *s_end = msg->specs + msg->num_specs;
+
+	if (argc < 2)
+		return -EINVAL;
+
+	l1 = strlen(*argv);
+	for (s = msg->specs; s < s_end; s++) {
+		size_t l2 = strlen(s->cmd);
+
+		if (!strnicmp(*argv, s->cmd, min(l1, l2))) {
+			hit++;
+			l_hit = l2;
+			s_hit = s;
+		}
+	}
+
+	msg->ret = 0;
+	if (!hit || l1 > l_hit)	/* No hit or message string too long. */
+		set_bit(dm_msg_ret_undef, &msg->ret);
+	else if (hit > 1)	/* Ambiguous message. */
+		set_bit(dm_msg_ret_ambiguous, &msg->ret);
+	else if (argc - 2 != s_hit->args->num_args) {
+		set_bit(dm_msg_ret_undef, &msg->ret);
+		set_bit(dm_msg_ret_argcount, &msg->ret);
+	}
+
+	if (msg->ret)
+		goto bad;
+
+	msg->action = 0;
+	msg->spec = s_hit;
+	set_bit(s_hit->action, &msg->action);
+	message_options_parse(msg, --argc, ++argv);
+
+	if (!msg->ret)
+		return msg->spec->f(msg, context);
+
+bad:
+	print_ret(caller, msg->ret);
+	return -EINVAL;
+}
+EXPORT_SYMBOL(dm_message_parse);
+
+MODULE_DESCRIPTION(DM_NAME " device-mapper target message parser");
+MODULE_AUTHOR("Heinz Mauelshagen <hjm@redhat.com>");
+MODULE_LICENSE("GPL");
--- linux-rt-2.6.31.orig/ubuntu/dm-raid4-5/BOM
+++ linux-rt-2.6.31/ubuntu/dm-raid4-5/BOM
@@ -0,0 +1,3 @@
+Downloaded from:	http://people.redhat.com/~heinzm/sw/dm/dm-raid45/
+Current Version:	2009.04.24 (2.6.30-rc3)
+Comments:		All of the patches to dmraid1/dm-log, etc are upstream.
--- linux-rt-2.6.31.orig/ubuntu/dm-raid4-5/dm-raid4-5.h
+++ linux-rt-2.6.31/ubuntu/dm-raid4-5/dm-raid4-5.h
@@ -0,0 +1,27 @@
+/*
+ * Copyright (C) 2006  Red Hat GmbH
+ *
+ * Module Author: Heinz Mauelshagen (Mauelshagen@RedHat.com)
+ *
+ * This file is released under the GPL.
+ *
+ */
+
+#ifndef _DM_RAID45_H
+#define _DM_RAID45_H
+
+/* Factor out to dm.h! */
+#define	STR_LEN(ptr, str) ptr, str, strlen(ptr)
+
+enum lock_type { RAID45_EX, RAID45_SHARED };
+
+struct dmraid45_locking_type {
+        /* Request a lock on a stripe. */
+        void* (*lock)(sector_t key, enum lock_type type);
+
+        /* Release a lock on a stripe. */
+        void (*unlock)(void *lock_handle);
+
+};
+
+#endif
--- linux-rt-2.6.31.orig/ubuntu/dm-raid4-5/Makefile
+++ linux-rt-2.6.31/ubuntu/dm-raid4-5/Makefile
@@ -0,0 +1,4 @@
+EXTRA_CFLAGS += -I$(srctree)/drivers/md
+
+obj-$(CONFIG_DM_RAID45) := dm-raid45.o
+dm-raid45-objs := dm-raid4-5.o dm-memcache.o dm-region-hash.o dm-message.o
--- linux-rt-2.6.31.orig/ubuntu/dm-raid4-5/dm-region-hash.h
+++ linux-rt-2.6.31/ubuntu/dm-raid4-5/dm-region-hash.h
@@ -0,0 +1,108 @@
+/*
+ * Copyright (C) 2003 Sistina Software Limited.
+ * Copyright (C) 2004-2008 Red Hat, Inc. All rights reserved.
+ *
+ * Device-Mapper dirty region hash interface.
+ *
+ * This file is released under the GPL.
+ */
+
+#ifndef DM_REGION_HASH_H
+#define DM_REGION_HASH_H
+
+#include <linux/dm-dirty-log.h>
+
+/*-----------------------------------------------------------------
+ * Region hash
+ *----------------------------------------------------------------*/
+struct dm_region_hash;
+struct dm_region;
+
+/*
+ * States a region can have.
+ */
+enum dm_rh_region_states {
+	DM_RH_CLEAN	 = 0x01,	/* No writes in flight. */
+	DM_RH_DIRTY	 = 0x02,	/* Writes in flight. */
+	DM_RH_NOSYNC	 = 0x04,	/* Out of sync. */
+	DM_RH_RECOVERING = 0x08,	/* Under resynchronization. */
+};
+
+/*
+ * Region hash create/destroy.
+ */
+struct bio_list;
+struct dm_region_hash *dm_region_hash_create(
+		void *context, void (*dispatch_bios)(void *context,
+						     struct bio_list *bios),
+		void (*wakeup_workers)(void *context),
+		void (*wakeup_all_recovery_waiters)(void *context),
+		sector_t target_begin, unsigned max_recovery,
+		struct dm_dirty_log *log, uint32_t region_size,
+		region_t nr_regions);
+void dm_region_hash_destroy(struct dm_region_hash *rh);
+
+struct dm_dirty_log *dm_rh_dirty_log(struct dm_region_hash *rh);
+
+/*
+ * Conversion functions.
+ */
+region_t dm_rh_bio_to_region(struct dm_region_hash *rh, struct bio *bio);
+sector_t dm_rh_region_to_sector(struct dm_region_hash *rh, region_t region);
+region_t dm_rh_sector_to_region(struct dm_region_hash *rh, sector_t sector);
+void *dm_rh_region_context(struct dm_region *reg);
+
+/*
+ * Get region size and key (ie. number of the region).
+ */
+sector_t dm_rh_get_region_size(struct dm_region_hash *rh);
+region_t dm_rh_get_region_key(struct dm_region *reg);
+
+/*
+ * Get/set/update region state (and dirty log).
+ *
+ */
+int dm_rh_get_state(struct dm_region_hash *rh, region_t region, int may_block);
+void dm_rh_set_state(struct dm_region_hash *rh, region_t region,
+		     enum dm_rh_region_states state, int may_block);
+
+/* Non-zero errors_handled leaves the state of the region NOSYNC */
+void dm_rh_update_states(struct dm_region_hash *rh, int errors_handled);
+
+/* Flush the region hash and dirty log. */
+int dm_rh_flush(struct dm_region_hash *rh);
+
+/* Inc/dec pending count on regions. */
+void dm_rh_inc(struct dm_region_hash *rh, region_t region);
+void dm_rh_inc_pending(struct dm_region_hash *rh, struct bio_list *bios);
+void dm_rh_dec(struct dm_region_hash *rh, region_t region);
+
+/* Delay bios on regions. */
+void dm_rh_delay(struct dm_region_hash *rh, struct bio *bio);
+void dm_rh_delay_by_region(struct dm_region_hash *rh, struct bio *bio,
+			   region_t region);
+
+void dm_rh_mark_nosync(struct dm_region_hash *rh,
+		       struct bio *bio, unsigned done, int error);
+
+/*
+ * Region recovery control.
+ */
+
+/* Prepare some regions for recovery by starting to quiesce them. */
+void dm_rh_recovery_prepare(struct dm_region_hash *rh);
+
+/* Try fetching a quiesced region for recovery. */
+struct dm_region *dm_rh_recovery_start(struct dm_region_hash *rh);
+
+/* Report recovery end on a region. */
+void dm_rh_recovery_end(struct dm_region *reg, int error);
+
+/* Returns number of regions with recovery work outstanding. */
+int dm_rh_recovery_in_flight(struct dm_region_hash *rh);
+
+/* Start/stop recovery. */
+void dm_rh_start_recovery(struct dm_region_hash *rh);
+void dm_rh_stop_recovery(struct dm_region_hash *rh);
+
+#endif /* DM_REGION_HASH_H */
--- linux-rt-2.6.31.orig/ubuntu/dm-raid4-5/Kconfig
+++ linux-rt-2.6.31/ubuntu/dm-raid4-5/Kconfig
@@ -0,0 +1,6 @@
+config DM_RAID45
+	tristate "RAID 4/5 target (EXPERIMENTAL)"
+	depends on BLK_DEV_DM && EXPERIMENTAL
+	default m
+	---help---
+	A target that supports RAID4 and RAID5 mappings.
--- linux-rt-2.6.31.orig/ubuntu/dm-raid4-5/dm-message.h
+++ linux-rt-2.6.31/ubuntu/dm-raid4-5/dm-message.h
@@ -0,0 +1,91 @@
+/*
+ * Copyright (C) 2007,2008 Red Hat, Inc. All rights reserved.
+ *
+ * Module Author: Heinz Mauelshagen <Mauelshagen@RedHat.de>
+ *
+ * General device-mapper message interface argument parser.
+ *
+ * This file is released under the GPL.
+ *
+ */
+
+#ifndef DM_MESSAGE_H
+#define DM_MESSAGE_H
+
+/* Factor out to dm.h. */
+/* Reference to array end. */
+#define ARRAY_END(a)    ((a) + ARRAY_SIZE(a))
+
+/* Message return bits. */
+enum dm_message_return {
+	dm_msg_ret_ambiguous,		/* Action ambiguous. */
+	dm_msg_ret_inval,		/* Action invalid. */
+	dm_msg_ret_undef,		/* Action undefined. */
+
+	dm_msg_ret_option,		/* Option error. */
+	dm_msg_ret_arg,			/* Argument error. */
+	dm_msg_ret_argcount,		/* Argument count error. */
+};
+
+/* Message argument type conversions. */
+enum dm_message_argument_type {
+	dm_msg_base_t,		/* Basename string. */
+	dm_msg_str_t,		/* String. */
+	dm_msg_int_t,		/* Signed int. */
+	dm_msg_uint_t,		/* Unsigned int. */
+	dm_msg_uint64_t,	/* Unsigned int 64. */
+};
+
+/* A message option. */
+struct dm_message_option {
+	unsigned num_options;
+	char **options;
+	unsigned long *actions;
+};
+
+/* Message arguments and types. */
+struct dm_message_argument {
+	unsigned num_args;
+	unsigned long **ptr;
+	enum dm_message_argument_type types[];
+};
+
+/* Client message. */
+struct dm_msg {
+	unsigned long action;		/* Identified action. */
+	unsigned long ret;		/* Return bits. */
+	unsigned num_specs;		/* # of sepcifications listed. */
+	struct dm_msg_spec *specs;	/* Specification list. */
+	struct dm_msg_spec *spec;	/* Specification selected. */
+};
+
+/* Secification of the message. */
+struct dm_msg_spec {
+	const char *cmd;	/* Name of the command (i.e. 'bandwidth'). */
+	unsigned long action;
+	struct dm_message_option *options;
+	struct dm_message_argument *args;
+	unsigned long parm;	/* Parameter to pass through to callback. */
+	/* Function to process for action. */
+	int (*f) (struct dm_msg *msg, void *context);
+};
+
+/* Parameter access macros. */
+#define	DM_MSG_PARM(msg) ((msg)->spec->parm)
+
+#define	DM_MSG_STR_ARGS(msg, idx) ((char *) *(msg)->spec->args->ptr[idx])
+#define	DM_MSG_INT_ARGS(msg, idx) ((int) *(msg)->spec->args->ptr[idx])
+#define	DM_MSG_UINT_ARGS(msg, idx) ((unsigned) DM_MSG_INT_ARG(msg, idx))
+#define	DM_MSG_UINT64_ARGS(msg, idx) ((uint64_t)  *(msg)->spec->args->ptr[idx])
+
+#define	DM_MSG_STR_ARG(msg)	DM_MSG_STR_ARGS(msg, 0)
+#define	DM_MSG_INT_ARG(msg)	DM_MSG_INT_ARGS(msg, 0)
+#define	DM_MSG_UINT_ARG(msg)	DM_MSG_UINT_ARGS(msg, 0)
+#define	DM_MSG_UINT64_ARG(msg)	DM_MSG_UINT64_ARGS(msg, 0)
+
+
+/* Parse a message and its options and optionally call a function back. */
+int dm_message_parse(const char *caller, struct dm_msg *msg, void *context,
+		     int argc, char **argv);
+
+#endif
--- linux-rt-2.6.31.orig/ubuntu/dm-raid4-5/dm-raid45.h
+++ linux-rt-2.6.31/ubuntu/dm-raid4-5/dm-raid45.h
@@ -0,0 +1,28 @@
+/*
+ * Copyright (C) 2006-2008 Red Hat, Inc. All rights reserved.
+ *
+ * Module Author: Heinz Mauelshagen (Mauelshagen@RedHat.com)
+ *
+ * Locking definitions for the device-mapper RAID45 target.
+ *
+ * This file is released under the GPL.
+ *
+ */
+
+#ifndef _DM_RAID45_H
+#define _DM_RAID45_H
+
+/* Factor out to dm.h! */
+#define	STR_LEN(ptr, str)	(ptr), (str), strlen((ptr))
+
+enum dm_lock_type { DM_RAID45_EX, DM_RAID45_SHARED };
+
+struct dm_raid45_locking_type {
+	/* Request a lock on a stripe. */
+	void* (*lock)(sector_t key, enum dm_lock_type type);
+
+	/* Release a lock on a stripe. */
+	void (*unlock)(void *lock_handle);
+};
+
+#endif
--- linux-rt-2.6.31.orig/ubuntu/dm-raid4-5/dm-memcache.h
+++ linux-rt-2.6.31/ubuntu/dm-raid4-5/dm-memcache.h
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2006-2008 Red Hat, Inc. All rights reserved.
+ *
+ * Module Author: Heinz Mauelshagen <Mauelshagen@RedHat.com>
+ *
+ * Device-mapper memory object handling:
+ *
+ * o allocate/free total_pages in a per client page pool.
+ *
+ * o allocate/free memory objects with chunks (1..n) of
+ *   pages_per_chunk pages hanging off.
+ *
+ * This file is released under the GPL.
+ */
+
+#ifndef _DM_MEM_CACHE_H
+#define _DM_MEM_CACHE_H
+
+#define	DM_MEM_CACHE_H_VERSION	"0.1"
+
+#include "dm.h"
+#include <linux/dm-io.h>
+
+static inline struct page_list *pl_elem(struct page_list *pl, unsigned p)
+{
+	while (pl && p--)
+		pl = pl->next;
+
+	return pl;
+}
+
+struct dm_mem_cache_object {
+	struct page_list *pl; /* Dynamically allocated array */
+	void *private;	      /* Caller context reference */
+};
+
+struct dm_mem_cache_client;
+
+/*
+ * Create/destroy dm memory cache client resources.
+ *
+ * On creation, a number of @objects with @chunks of
+ * @pages_per_chunk pages will be allocated.
+ */
+struct dm_mem_cache_client *
+dm_mem_cache_client_create(unsigned objects, unsigned chunks,
+			   unsigned pages_per_chunk);
+void dm_mem_cache_client_destroy(struct dm_mem_cache_client *client);
+
+/*
+ * Grow/shrink a dm memory cache client resources
+ * by @objetcs amount of objects.
+ */
+int dm_mem_cache_grow(struct dm_mem_cache_client *client, unsigned objects);
+int dm_mem_cache_shrink(struct dm_mem_cache_client *client, unsigned objects);
+
+/*
+ * Allocate/free a memory object
+ *
+ * On allocation one object with an amount of chunks and
+ * an amount of pages per chunk will be returned on success.
+ */
+struct dm_mem_cache_object *
+dm_mem_cache_alloc(struct dm_mem_cache_client *client);
+void dm_mem_cache_free(struct dm_mem_cache_client *client,
+		       struct dm_mem_cache_object *object);
+
+#endif
--- linux-rt-2.6.31.orig/ubuntu/dm-raid4-5/dm-region-hash.c
+++ linux-rt-2.6.31/ubuntu/dm-raid4-5/dm-region-hash.c
@@ -0,0 +1,718 @@
+/*
+ * Copyright (C) 2003 Sistina Software Limited.
+ * Copyright (C) 2004-2008 Red Hat, Inc. All rights reserved.
+ *
+ * This file is released under the GPL.
+ */
+
+#include <linux/dm-dirty-log.h>
+#include "dm-region-hash.h"
+
+#include <linux/ctype.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/vmalloc.h>
+
+#include "dm.h"
+
+#define	DM_MSG_PREFIX	"region hash"
+
+/*-----------------------------------------------------------------
+ * Region hash
+ *
+ * The mirror splits itself up into discrete regions.  Each
+ * region can be in one of three states: clean, dirty,
+ * nosync.  There is no need to put clean regions in the hash.
+ *
+ * In addition to being present in the hash table a region _may_
+ * be present on one of three lists.
+ *
+ *   clean_regions: Regions on this list have no io pending to
+ *   them, they are in sync, we are no longer interested in them,
+ *   they are dull.  dm_rh_update_states() will remove them from the
+ *   hash table.
+ *
+ *   quiesced_regions: These regions have been spun down, ready
+ *   for recovery.  rh_recovery_start() will remove regions from
+ *   this list and hand them to kmirrord, which will schedule the
+ *   recovery io with kcopyd.
+ *
+ *   recovered_regions: Regions that kcopyd has successfully
+ *   recovered.  dm_rh_update_states() will now schedule any delayed
+ *   io, up the recovery_count, and remove the region from the
+ *   hash.
+ *
+ * There are 2 locks:
+ *   A rw spin lock 'hash_lock' protects just the hash table,
+ *   this is never held in write mode from interrupt context,
+ *   which I believe means that we only have to disable irqs when
+ *   doing a write lock.
+ *
+ *   An ordinary spin lock 'region_lock' that protects the three
+ *   lists in the region_hash, with the 'state', 'list' and
+ *   'delayed_bios' fields of the regions.  This is used from irq
+ *   context, so all other uses will have to suspend local irqs.
+ *---------------------------------------------------------------*/
+struct dm_region_hash {
+	uint32_t region_size;
+	unsigned region_shift;
+
+	/* holds persistent region state */
+	struct dm_dirty_log *log;
+
+	/* hash table */
+	rwlock_t hash_lock;
+	mempool_t *region_pool;
+	unsigned mask;
+	unsigned nr_buckets;
+	unsigned prime;
+	unsigned shift;
+	struct list_head *buckets;
+
+	unsigned max_recovery; /* Max # of regions to recover in parallel */
+
+	spinlock_t region_lock;
+	atomic_t recovery_in_flight;
+	struct semaphore recovery_count;
+	struct list_head clean_regions;
+	struct list_head quiesced_regions;
+	struct list_head recovered_regions;
+	struct list_head failed_recovered_regions;
+
+	void *context;
+	sector_t target_begin;
+
+	/* Callback function to schedule bios writes */
+	void (*dispatch_bios)(void *context, struct bio_list *bios);
+
+	/* Callback function to wakeup callers worker thread. */
+	void (*wakeup_workers)(void *context);
+
+	/* Callback function to wakeup callers recovery waiters. */
+	void (*wakeup_all_recovery_waiters)(void *context);
+};
+
+struct dm_region {
+	struct dm_region_hash *rh;	/* FIXME: can we get rid of this ? */
+	region_t key;
+	int state;
+
+	struct list_head hash_list;
+	struct list_head list;
+
+	atomic_t pending;
+	struct bio_list delayed_bios;
+};
+
+/*
+ * Conversion fns
+ */
+region_t dm_rh_sector_to_region(struct dm_region_hash *rh, sector_t sector)
+{
+	return sector >> rh->region_shift;
+}
+// EXPORT_SYMBOL_GPL(dm_rh_sector_to_region);
+
+sector_t dm_rh_region_to_sector(struct dm_region_hash *rh, region_t region)
+{
+	return region << rh->region_shift;
+}
+// EXPORT_SYMBOL_GPL(dm_rh_region_to_sector);
+
+region_t dm_rh_bio_to_region(struct dm_region_hash *rh, struct bio *bio)
+{
+	return dm_rh_sector_to_region(rh, bio->bi_sector - rh->target_begin);
+}
+// EXPORT_SYMBOL_GPL(dm_rh_bio_to_region);
+
+void *dm_rh_region_context(struct dm_region *reg)
+{
+	return reg->rh->context;
+}
+// EXPORT_SYMBOL_GPL(dm_rh_region_context);
+
+region_t dm_rh_get_region_key(struct dm_region *reg)
+{
+	return reg->key;
+}
+// EXPORT_SYMBOL_GPL(dm_rh_get_region_key);
+
+sector_t dm_rh_get_region_size(struct dm_region_hash *rh)
+{
+	return rh->region_size;
+}
+// EXPORT_SYMBOL_GPL(dm_rh_get_region_size);
+
+/*
+ * FIXME: shall we pass in a structure instead of all these args to
+ * dm_region_hash_create()????
+ */
+#define RH_HASH_MULT 2654435387U
+#define RH_HASH_SHIFT 12
+
+#define MIN_REGIONS 64
+struct dm_region_hash *dm_region_hash_create(
+		void *context, void (*dispatch_bios)(void *context,
+						     struct bio_list *bios),
+		void (*wakeup_workers)(void *context),
+		void (*wakeup_all_recovery_waiters)(void *context),
+		sector_t target_begin, unsigned max_recovery,
+		struct dm_dirty_log *log, uint32_t region_size,
+		region_t nr_regions)
+{
+	struct dm_region_hash *rh;
+	unsigned nr_buckets, max_buckets;
+	size_t i;
+
+	/*
+	 * Calculate a suitable number of buckets for our hash
+	 * table.
+	 */
+	max_buckets = nr_regions >> 6;
+	for (nr_buckets = 128u; nr_buckets < max_buckets; nr_buckets <<= 1)
+		;
+	nr_buckets >>= 1;
+
+	rh = kmalloc(sizeof(*rh), GFP_KERNEL);
+	if (!rh) {
+		DMERR("unable to allocate region hash memory");
+		return ERR_PTR(-ENOMEM);
+	}
+
+	rh->context = context;
+	rh->dispatch_bios = dispatch_bios;
+	rh->wakeup_workers = wakeup_workers;
+	rh->wakeup_all_recovery_waiters = wakeup_all_recovery_waiters;
+	rh->target_begin = target_begin;
+	rh->max_recovery = max_recovery;
+	rh->log = log;
+	rh->region_size = region_size;
+	rh->region_shift = ffs(region_size) - 1;
+	rwlock_init(&rh->hash_lock);
+	rh->mask = nr_buckets - 1;
+	rh->nr_buckets = nr_buckets;
+
+	rh->shift = RH_HASH_SHIFT;
+	rh->prime = RH_HASH_MULT;
+
+	rh->buckets = vmalloc(nr_buckets * sizeof(*rh->buckets));
+	if (!rh->buckets) {
+		DMERR("unable to allocate region hash bucket memory");
+		kfree(rh);
+		return ERR_PTR(-ENOMEM);
+	}
+
+	for (i = 0; i < nr_buckets; i++)
+		INIT_LIST_HEAD(rh->buckets + i);
+
+	spin_lock_init(&rh->region_lock);
+	sema_init(&rh->recovery_count, 0);
+	atomic_set(&rh->recovery_in_flight, 0);
+	INIT_LIST_HEAD(&rh->clean_regions);
+	INIT_LIST_HEAD(&rh->quiesced_regions);
+	INIT_LIST_HEAD(&rh->recovered_regions);
+	INIT_LIST_HEAD(&rh->failed_recovered_regions);
+
+	rh->region_pool = mempool_create_kmalloc_pool(MIN_REGIONS,
+						      sizeof(struct dm_region));
+	if (!rh->region_pool) {
+		vfree(rh->buckets);
+		kfree(rh);
+		rh = ERR_PTR(-ENOMEM);
+	}
+
+	return rh;
+}
+// EXPORT_SYMBOL_GPL(dm_region_hash_create);
+
+void dm_region_hash_destroy(struct dm_region_hash *rh)
+{
+	unsigned h;
+	struct dm_region *reg, *nreg;
+
+	BUG_ON(!list_empty(&rh->quiesced_regions));
+	for (h = 0; h < rh->nr_buckets; h++) {
+		list_for_each_entry_safe(reg, nreg, rh->buckets + h,
+					 hash_list) {
+			BUG_ON(atomic_read(&reg->pending));
+			mempool_free(reg, rh->region_pool);
+		}
+	}
+
+	if (rh->log)
+		dm_dirty_log_destroy(rh->log);
+
+	if (rh->region_pool)
+		mempool_destroy(rh->region_pool);
+
+	vfree(rh->buckets);
+	kfree(rh);
+}
+// EXPORT_SYMBOL_GPL(dm_region_hash_destroy);
+
+struct dm_dirty_log *dm_rh_dirty_log(struct dm_region_hash *rh)
+{
+	return rh->log;
+}
+// EXPORT_SYMBOL_GPL(dm_rh_dirty_log);
+
+static unsigned rh_hash(struct dm_region_hash *rh, region_t region)
+{
+	return (unsigned) ((region * rh->prime) >> rh->shift) & rh->mask;
+}
+
+static struct dm_region *__rh_lookup(struct dm_region_hash *rh, region_t region)
+{
+	struct dm_region *reg;
+	struct list_head *bucket = rh->buckets + rh_hash(rh, region);
+
+	list_for_each_entry(reg, bucket, hash_list)
+		if (reg->key == region)
+			return reg;
+
+	return NULL;
+}
+
+static void __rh_insert(struct dm_region_hash *rh, struct dm_region *reg)
+{
+	list_add(&reg->hash_list, rh->buckets + rh_hash(rh, reg->key));
+}
+
+static struct dm_region *__rh_alloc(struct dm_region_hash *rh, region_t region)
+{
+	struct dm_region *reg, *nreg;
+
+	nreg = mempool_alloc(rh->region_pool, GFP_ATOMIC);
+	if (unlikely(!nreg))
+		nreg = kmalloc(sizeof(*nreg), GFP_NOIO | __GFP_NOFAIL);
+
+	nreg->state = rh->log->type->in_sync(rh->log, region, 1) ?
+		      DM_RH_CLEAN : DM_RH_NOSYNC;
+	nreg->rh = rh;
+	nreg->key = region;
+	INIT_LIST_HEAD(&nreg->list);
+	atomic_set(&nreg->pending, 0);
+	bio_list_init(&nreg->delayed_bios);
+
+	write_lock_irq(&rh->hash_lock);
+	reg = __rh_lookup(rh, region);
+	if (reg)
+		/* We lost the race. */
+		mempool_free(nreg, rh->region_pool);
+	else {
+		__rh_insert(rh, nreg);
+		if (nreg->state == DM_RH_CLEAN) {
+			spin_lock(&rh->region_lock);
+			list_add(&nreg->list, &rh->clean_regions);
+			spin_unlock(&rh->region_lock);
+		}
+
+		reg = nreg;
+	}
+	write_unlock_irq(&rh->hash_lock);
+
+	return reg;
+}
+
+static struct dm_region *__rh_find(struct dm_region_hash *rh, region_t region)
+{
+	struct dm_region *reg;
+
+	reg = __rh_lookup(rh, region);
+	if (!reg) {
+		read_unlock(&rh->hash_lock);
+		reg = __rh_alloc(rh, region);
+		read_lock(&rh->hash_lock);
+	}
+
+	return reg;
+}
+
+int dm_rh_get_state(struct dm_region_hash *rh, region_t region, int may_block)
+{
+	int r;
+	struct dm_region *reg;
+
+	read_lock(&rh->hash_lock);
+	reg = __rh_lookup(rh, region);
+	read_unlock(&rh->hash_lock);
+
+	if (reg)
+		return reg->state;
+
+	/*
+	 * The region wasn't in the hash, so we fall back to the
+	 * dirty log.
+	 */
+	r = rh->log->type->in_sync(rh->log, region, may_block);
+
+	/*
+	 * Any error from the dirty log (eg. -EWOULDBLOCK) gets
+	 * taken as a DM_RH_NOSYNC
+	 */
+	return r == 1 ? DM_RH_CLEAN : DM_RH_NOSYNC;
+}
+// EXPORT_SYMBOL_GPL(dm_rh_get_state);
+
+static void complete_resync_work(struct dm_region *reg, int success)
+{
+	struct dm_region_hash *rh = reg->rh;
+
+	rh->log->type->set_region_sync(rh->log, reg->key, success);
+
+	/*
+	 * Dispatch the bios before we call 'wake_up_all'.
+	 * This is important because if we are suspending,
+	 * we want to know that recovery is complete and
+	 * the work queue is flushed.  If we wake_up_all
+	 * before we dispatch_bios (queue bios and call wake()),
+	 * then we risk suspending before the work queue
+	 * has been properly flushed.
+	 */
+	rh->dispatch_bios(rh->context, &reg->delayed_bios);
+	if (atomic_dec_and_test(&rh->recovery_in_flight))
+		rh->wakeup_all_recovery_waiters(rh->context);
+	up(&rh->recovery_count);
+}
+
+/* dm_rh_mark_nosync
+ * @ms
+ * @bio
+ * @done
+ * @error
+ *
+ * The bio was written on some mirror(s) but failed on other mirror(s).
+ * We can successfully endio the bio but should avoid the region being
+ * marked clean by setting the state DM_RH_NOSYNC.
+ *
+ * This function is _not_ safe in interrupt context!
+ */
+void dm_rh_mark_nosync(struct dm_region_hash *rh,
+		       struct bio *bio, unsigned done, int error)
+{
+	unsigned long flags;
+	struct dm_dirty_log *log = rh->log;
+	struct dm_region *reg;
+	region_t region = dm_rh_bio_to_region(rh, bio);
+	int recovering = 0;
+
+	/* We must inform the log that the sync count has changed. */
+	log->type->set_region_sync(log, region, 0);
+
+	read_lock(&rh->hash_lock);
+	reg = __rh_find(rh, region);
+	read_unlock(&rh->hash_lock);
+
+	/* region hash entry should exist because write was in-flight */
+	BUG_ON(!reg);
+	BUG_ON(!list_empty(&reg->list));
+
+	spin_lock_irqsave(&rh->region_lock, flags);
+	/*
+	 * Possible cases:
+	 *   1) DM_RH_DIRTY
+	 *   2) DM_RH_NOSYNC: was dirty, other preceeding writes failed
+	 *   3) DM_RH_RECOVERING: flushing pending writes
+	 * Either case, the region should have not been connected to list.
+	 */
+	recovering = (reg->state == DM_RH_RECOVERING);
+	reg->state = DM_RH_NOSYNC;
+	BUG_ON(!list_empty(&reg->list));
+	spin_unlock_irqrestore(&rh->region_lock, flags);
+
+	bio_endio(bio, error);
+	if (recovering)
+		complete_resync_work(reg, 0);
+}
+// EXPORT_SYMBOL_GPL(dm_rh_mark_nosync);
+
+void dm_rh_update_states(struct dm_region_hash *rh, int errors_handled)
+{
+	struct dm_region *reg, *next;
+
+	LIST_HEAD(clean);
+	LIST_HEAD(recovered);
+	LIST_HEAD(failed_recovered);
+
+	/*
+	 * Quickly grab the lists.
+	 */
+	write_lock_irq(&rh->hash_lock);
+	spin_lock(&rh->region_lock);
+	if (!list_empty(&rh->clean_regions)) {
+		list_splice_init(&rh->clean_regions, &clean);
+
+		list_for_each_entry(reg, &clean, list)
+			list_del(&reg->hash_list);
+	}
+
+	if (!list_empty(&rh->recovered_regions)) {
+		list_splice_init(&rh->recovered_regions, &recovered);
+
+		list_for_each_entry(reg, &recovered, list)
+			list_del(&reg->hash_list);
+	}
+
+	if (!list_empty(&rh->failed_recovered_regions)) {
+		list_splice_init(&rh->failed_recovered_regions,
+				 &failed_recovered);
+
+		list_for_each_entry(reg, &failed_recovered, list)
+			list_del(&reg->hash_list);
+	}
+
+	spin_unlock(&rh->region_lock);
+	write_unlock_irq(&rh->hash_lock);
+
+	/*
+	 * All the regions on the recovered and clean lists have
+	 * now been pulled out of the system, so no need to do
+	 * any more locking.
+	 */
+	list_for_each_entry_safe(reg, next, &recovered, list) {
+		rh->log->type->clear_region(rh->log, reg->key);
+		complete_resync_work(reg, 1);
+		mempool_free(reg, rh->region_pool);
+	}
+
+	list_for_each_entry_safe(reg, next, &failed_recovered, list) {
+		complete_resync_work(reg, errors_handled ? 0 : 1);
+		mempool_free(reg, rh->region_pool);
+	}
+
+	list_for_each_entry_safe(reg, next, &clean, list) {
+		rh->log->type->clear_region(rh->log, reg->key);
+		mempool_free(reg, rh->region_pool);
+	}
+
+	rh->log->type->flush(rh->log);
+}
+// EXPORT_SYMBOL_GPL(dm_rh_update_states);
+
+void dm_rh_inc(struct dm_region_hash *rh, region_t region)
+{
+	struct dm_region *reg;
+
+	read_lock(&rh->hash_lock);
+	reg = __rh_find(rh, region);
+
+	spin_lock_irq(&rh->region_lock);
+	atomic_inc(&reg->pending);
+
+	if (reg->state == DM_RH_CLEAN) {
+		reg->state = DM_RH_DIRTY;
+		list_del_init(&reg->list);	/* take off the clean list */
+		spin_unlock_irq(&rh->region_lock);
+
+		rh->log->type->mark_region(rh->log, reg->key);
+	} else
+		spin_unlock_irq(&rh->region_lock);
+
+
+	read_unlock(&rh->hash_lock);
+}
+// EXPORT_SYMBOL_GPL(dm_rh_inc);
+
+void dm_rh_inc_pending(struct dm_region_hash *rh, struct bio_list *bios)
+{
+	struct bio *bio;
+
+	for (bio = bios->head; bio; bio = bio->bi_next)
+		dm_rh_inc(rh, dm_rh_bio_to_region(rh, bio));
+}
+// EXPORT_SYMBOL_GPL(dm_rh_inc_pending);
+
+void dm_rh_dec(struct dm_region_hash *rh, region_t region)
+{
+	unsigned long flags;
+	struct dm_region *reg;
+	int should_wake = 0;
+
+	read_lock(&rh->hash_lock);
+	reg = __rh_lookup(rh, region);
+	read_unlock(&rh->hash_lock);
+
+	spin_lock_irqsave(&rh->region_lock, flags);
+	if (atomic_dec_and_test(&reg->pending)) {
+		/*
+		 * There is no pending I/O for this region.
+		 * We can move the region to corresponding list for next action.
+		 * At this point, the region is not yet connected to any list.
+		 *
+		 * If the state is DM_RH_NOSYNC, the region should be kept off
+		 * from clean list.
+		 * The hash entry for DM_RH_NOSYNC will remain in memory
+		 * until the region is recovered or the map is reloaded.
+		 */
+
+		/* do nothing for DM_RH_NOSYNC */
+		if (reg->state == DM_RH_RECOVERING) {
+			list_add_tail(&reg->list, &rh->quiesced_regions);
+		} else if (reg->state == DM_RH_DIRTY) {
+			reg->state = DM_RH_CLEAN;
+			list_add(&reg->list, &rh->clean_regions);
+		}
+		should_wake = 1;
+	}
+	spin_unlock_irqrestore(&rh->region_lock, flags);
+
+	if (should_wake)
+		rh->wakeup_workers(rh->context);
+}
+// EXPORT_SYMBOL_GPL(dm_rh_dec);
+
+/*
+ * Starts quiescing a region in preparation for recovery.
+ */
+static int __rh_recovery_prepare(struct dm_region_hash *rh)
+{
+	int r;
+	region_t region;
+	struct dm_region *reg;
+
+	/*
+	 * Ask the dirty log what's next.
+	 */
+	r = rh->log->type->get_resync_work(rh->log, &region);
+	if (r <= 0)
+		return r;
+
+	/*
+	 * Get this region, and start it quiescing by setting the
+	 * recovering flag.
+	 */
+	read_lock(&rh->hash_lock);
+	reg = __rh_find(rh, region);
+	read_unlock(&rh->hash_lock);
+
+	spin_lock_irq(&rh->region_lock);
+	reg->state = DM_RH_RECOVERING;
+
+	/* Already quiesced ? */
+	if (atomic_read(&reg->pending))
+		list_del_init(&reg->list);
+	else
+		list_move(&reg->list, &rh->quiesced_regions);
+
+	spin_unlock_irq(&rh->region_lock);
+
+	return 1;
+}
+
+void dm_rh_recovery_prepare(struct dm_region_hash *rh)
+{
+	/* Extra reference to avoid race with dm_rh_stop_recovery */
+	atomic_inc(&rh->recovery_in_flight);
+
+	while (!down_trylock(&rh->recovery_count)) {
+		atomic_inc(&rh->recovery_in_flight);
+		if (__rh_recovery_prepare(rh) <= 0) {
+			atomic_dec(&rh->recovery_in_flight);
+			up(&rh->recovery_count);
+			break;
+		}
+	}
+
+	/* Drop the extra reference */
+	if (atomic_dec_and_test(&rh->recovery_in_flight))
+		rh->wakeup_all_recovery_waiters(rh->context);
+}
+// EXPORT_SYMBOL_GPL(dm_rh_recovery_prepare);
+
+/*
+ * Returns any quiesced regions.
+ */
+struct dm_region *dm_rh_recovery_start(struct dm_region_hash *rh)
+{
+	struct dm_region *reg = NULL;
+
+	spin_lock_irq(&rh->region_lock);
+	if (!list_empty(&rh->quiesced_regions)) {
+		reg = list_entry(rh->quiesced_regions.next,
+				 struct dm_region, list);
+		list_del_init(&reg->list);  /* remove from the quiesced list */
+	}
+	spin_unlock_irq(&rh->region_lock);
+
+	return reg;
+}
+// EXPORT_SYMBOL_GPL(dm_rh_recovery_start);
+
+void dm_rh_recovery_end(struct dm_region *reg, int success)
+{
+	struct dm_region_hash *rh = reg->rh;
+
+	spin_lock_irq(&rh->region_lock);
+	if (success)
+		list_add(&reg->list, &reg->rh->recovered_regions);
+	else {
+		reg->state = DM_RH_NOSYNC;
+		list_add(&reg->list, &reg->rh->failed_recovered_regions);
+	}
+	spin_unlock_irq(&rh->region_lock);
+
+	rh->wakeup_workers(rh->context);
+}
+// EXPORT_SYMBOL_GPL(dm_rh_recovery_end);
+
+/* Return recovery in flight count. */
+int dm_rh_recovery_in_flight(struct dm_region_hash *rh)
+{
+	return atomic_read(&rh->recovery_in_flight);
+}
+// EXPORT_SYMBOL_GPL(dm_rh_recovery_in_flight);
+
+int dm_rh_flush(struct dm_region_hash *rh)
+{
+	return rh->log->type->flush(rh->log);
+}
+// EXPORT_SYMBOL_GPL(dm_rh_flush);
+
+void dm_rh_delay(struct dm_region_hash *rh, struct bio *bio)
+{
+	struct dm_region *reg;
+
+	read_lock(&rh->hash_lock);
+	reg = __rh_find(rh, dm_rh_bio_to_region(rh, bio));
+	bio_list_add(&reg->delayed_bios, bio);
+	read_unlock(&rh->hash_lock);
+}
+// EXPORT_SYMBOL_GPL(dm_rh_delay);
+
+void dm_rh_delay_by_region(struct dm_region_hash *rh,
+			   struct bio *bio, region_t region)
+{
+	struct dm_region *reg;
+
+	/* FIXME: locking. */
+	read_lock(&rh->hash_lock);
+	reg = __rh_find(rh, region);
+	bio_list_add(&reg->delayed_bios, bio);
+	read_unlock(&rh->hash_lock);
+}
+// EXPORT_SYMBOL_GPL(dm_rh_delay_by_region);
+
+void dm_rh_stop_recovery(struct dm_region_hash *rh)
+{
+	int i;
+
+	/* wait for any recovering regions */
+	for (i = 0; i < rh->max_recovery; i++)
+		down(&rh->recovery_count);
+}
+// EXPORT_SYMBOL_GPL(dm_rh_stop_recovery);
+
+void dm_rh_start_recovery(struct dm_region_hash *rh)
+{
+	int i;
+
+	for (i = 0; i < rh->max_recovery; i++)
+		up(&rh->recovery_count);
+
+	rh->wakeup_workers(rh->context);
+}
+// EXPORT_SYMBOL_GPL(dm_rh_start_recovery);
+
+MODULE_DESCRIPTION(DM_NAME " region hash");
+MODULE_AUTHOR("Joe Thornber/Heinz Mauelshagen <dm-devel@redhat.com>");
+MODULE_LICENSE("GPL");
--- linux-rt-2.6.31.orig/ubuntu/dm-raid4-5/dm-memcache.c
+++ linux-rt-2.6.31/ubuntu/dm-raid4-5/dm-memcache.c
@@ -0,0 +1,301 @@
+/*
+ * Copyright (C) 2006-2008 Red Hat, Inc. All rights reserved.
+ *
+ * Module Author: Heinz Mauelshagen <heinzm@redhat.com>
+ *
+ * Device-mapper memory object handling:
+ *
+ * o allocate/free total_pages in a per client page pool.
+ *
+ * o allocate/free memory objects with chunks (1..n) of
+ *   pages_per_chunk pages hanging off.
+ *
+ * This file is released under the GPL.
+ */
+
+#define	DM_MEM_CACHE_VERSION	"0.2"
+
+#include "dm.h"
+#include "dm-memcache.h"
+#include <linux/dm-io.h>
+
+struct dm_mem_cache_client {
+	spinlock_t lock;
+	mempool_t *objs_pool;
+	struct page_list *free_list;
+	unsigned objects;
+	unsigned chunks;
+	unsigned pages_per_chunk;
+	unsigned free_pages;
+	unsigned total_pages;
+};
+
+/*
+ * Free pages and page_list elements of client.
+ */
+static void free_cache_pages(struct page_list *list)
+{
+	while (list) {
+		struct page_list *pl = list;
+
+		list = pl->next;
+		BUG_ON(!pl->page);
+		__free_page(pl->page);
+		kfree(pl);
+	}
+}
+
+/*
+ * Alloc number of pages and page_list elements as required by client.
+ */
+static struct page_list *alloc_cache_pages(unsigned pages)
+{
+	struct page_list *pl, *ret = NULL;
+	struct page *page;
+
+	while (pages--) {
+		page = alloc_page(GFP_NOIO);
+		if (!page)
+			goto err;
+
+		pl = kmalloc(sizeof(*pl), GFP_NOIO);
+		if (!pl) {
+			__free_page(page);
+			goto err;
+		}
+
+		pl->page = page;
+		pl->next = ret;
+		ret = pl;
+	}
+
+	return ret;
+
+err:
+	free_cache_pages(ret);
+	return NULL;
+}
+
+/*
+ * Allocate page_list elements from the pool to chunks of the memory object.
+ */
+static void alloc_chunks(struct dm_mem_cache_client *cl,
+			 struct dm_mem_cache_object *obj)
+{
+	unsigned chunks = cl->chunks;
+	unsigned long flags;
+
+	local_irq_save(flags);
+	local_irq_disable();
+	while (chunks--) {
+		unsigned p = cl->pages_per_chunk;
+
+		obj[chunks].pl = NULL;
+
+		while (p--) {
+			struct page_list *pl;
+
+			/* Take next element from free list */
+			spin_lock(&cl->lock);
+			pl = cl->free_list;
+			BUG_ON(!pl);
+			cl->free_list = pl->next;
+			spin_unlock(&cl->lock);
+
+			pl->next = obj[chunks].pl;
+			obj[chunks].pl = pl;
+		}
+	}
+
+	local_irq_restore(flags);
+}
+
+/*
+ * Free page_list elements putting them back onto free list
+ */
+static void free_chunks(struct dm_mem_cache_client *cl,
+			struct dm_mem_cache_object *obj)
+{
+	unsigned chunks = cl->chunks;
+	unsigned long flags;
+	struct page_list *next, *pl;
+
+	local_irq_save(flags);
+	local_irq_disable();
+	while (chunks--) {
+		for (pl = obj[chunks].pl; pl; pl = next) {
+			next = pl->next;
+
+			spin_lock(&cl->lock);
+			pl->next = cl->free_list;
+			cl->free_list = pl;
+			cl->free_pages++;
+			spin_unlock(&cl->lock);
+		}
+	}
+
+	local_irq_restore(flags);
+}
+
+/*
+ * Create/destroy dm memory cache client resources.
+ */
+struct dm_mem_cache_client *
+dm_mem_cache_client_create(unsigned objects, unsigned chunks,
+			   unsigned pages_per_chunk)
+{
+	unsigned total_pages = objects * chunks * pages_per_chunk;
+	struct dm_mem_cache_client *client;
+
+	BUG_ON(!total_pages);
+	client = kzalloc(sizeof(*client), GFP_KERNEL);
+	if (!client)
+		return ERR_PTR(-ENOMEM);
+
+	client->objs_pool = mempool_create_kmalloc_pool(objects,
+				chunks * sizeof(struct dm_mem_cache_object));
+	if (!client->objs_pool)
+		goto err;
+
+	client->free_list = alloc_cache_pages(total_pages);
+	if (!client->free_list)
+		goto err1;
+
+	spin_lock_init(&client->lock);
+	client->objects = objects;
+	client->chunks = chunks;
+	client->pages_per_chunk = pages_per_chunk;
+	client->free_pages = client->total_pages = total_pages;
+	return client;
+
+err1:
+	mempool_destroy(client->objs_pool);
+err:
+	kfree(client);
+	return ERR_PTR(-ENOMEM);
+}
+EXPORT_SYMBOL(dm_mem_cache_client_create);
+
+void dm_mem_cache_client_destroy(struct dm_mem_cache_client *cl)
+{
+	BUG_ON(cl->free_pages != cl->total_pages);
+	free_cache_pages(cl->free_list);
+	mempool_destroy(cl->objs_pool);
+	kfree(cl);
+}
+EXPORT_SYMBOL(dm_mem_cache_client_destroy);
+
+/*
+ * Grow a clients cache by an amount of pages.
+ *
+ * Don't call from interrupt context!
+ */
+int dm_mem_cache_grow(struct dm_mem_cache_client *cl, unsigned objects)
+{
+	unsigned pages = objects * cl->chunks * cl->pages_per_chunk;
+	struct page_list *pl, *last;
+
+	BUG_ON(!pages);
+	pl = alloc_cache_pages(pages);
+	if (!pl)
+		return -ENOMEM;
+
+	last = pl;
+	while (last->next)
+		last = last->next;
+
+	spin_lock_irq(&cl->lock);
+	last->next = cl->free_list;
+	cl->free_list = pl;
+	cl->free_pages += pages;
+	cl->total_pages += pages;
+	cl->objects++;
+	spin_unlock_irq(&cl->lock);
+
+	mempool_resize(cl->objs_pool, cl->objects, GFP_NOIO);
+	return 0;
+}
+EXPORT_SYMBOL(dm_mem_cache_grow);
+
+/* Shrink a clients cache by an amount of pages */
+int dm_mem_cache_shrink(struct dm_mem_cache_client *cl, unsigned objects)
+{
+	int r;
+	unsigned pages = objects * cl->chunks * cl->pages_per_chunk, p = pages;
+	unsigned long flags;
+	struct page_list *last = NULL, *pl, *pos;
+
+	BUG_ON(!pages);
+
+	spin_lock_irqsave(&cl->lock, flags);
+	pl = pos = cl->free_list;
+	while (p-- && pos->next) {
+		last = pos;
+		pos = pos->next;
+	}
+
+	if (++p)
+		r = -ENOMEM;
+	else {
+		r = 0;
+		cl->free_list = pos;
+		cl->free_pages -= pages;
+		cl->total_pages -= pages;
+		cl->objects--;
+		last->next = NULL;
+	}
+	spin_unlock_irqrestore(&cl->lock, flags);
+
+	if (!r) {
+		free_cache_pages(pl);
+		mempool_resize(cl->objs_pool, cl->objects, GFP_NOIO);
+	}
+
+	return r;
+}
+EXPORT_SYMBOL(dm_mem_cache_shrink);
+
+/*
+ * Allocate/free a memory object
+ *
+ * Can be called from interrupt context
+ */
+struct dm_mem_cache_object *dm_mem_cache_alloc(struct dm_mem_cache_client *cl)
+{
+	int r = 0;
+	unsigned pages = cl->chunks * cl->pages_per_chunk;
+	unsigned long flags;
+	struct dm_mem_cache_object *obj;
+
+	obj = mempool_alloc(cl->objs_pool, GFP_NOIO);
+	if (!obj)
+		return ERR_PTR(-ENOMEM);
+
+	spin_lock_irqsave(&cl->lock, flags);
+	if (pages > cl->free_pages)
+		r = -ENOMEM;
+	else
+		cl->free_pages -= pages;
+	spin_unlock_irqrestore(&cl->lock, flags);
+
+	if (r) {
+		mempool_free(obj, cl->objs_pool);
+		return ERR_PTR(r);
+	}
+
+	alloc_chunks(cl, obj);
+	return obj;
+}
+EXPORT_SYMBOL(dm_mem_cache_alloc);
+
+void dm_mem_cache_free(struct dm_mem_cache_client *cl,
+		       struct dm_mem_cache_object *obj)
+{
+	free_chunks(cl, obj);
+	mempool_free(obj, cl->objs_pool);
+}
+EXPORT_SYMBOL(dm_mem_cache_free);
+
+MODULE_DESCRIPTION(DM_NAME " dm memory cache");
+MODULE_AUTHOR("Heinz Mauelshagen <hjm@redhat.com>");
+MODULE_LICENSE("GPL");
--- linux-rt-2.6.31.orig/ubuntu/lenovo-sl-laptop/BOM
+++ linux-rt-2.6.31/ubuntu/lenovo-sl-laptop/BOM
@@ -0,0 +1,3 @@
+Downloaded from:	http://github.com/tetromino/lenovo-sl-laptop/tree/master
+Current Version:	0.02
+Description:		Linux kernel support for the Lenovo SL series ThinkPads
--- linux-rt-2.6.31.orig/ubuntu/lenovo-sl-laptop/Makefile
+++ linux-rt-2.6.31/ubuntu/lenovo-sl-laptop/Makefile
@@ -0,0 +1,2 @@
+
+obj-$(CONFIG_LENOVO_SL_LAPTOP) := lenovo-sl-laptop.o
--- linux-rt-2.6.31.orig/ubuntu/lenovo-sl-laptop/Kconfig
+++ linux-rt-2.6.31/ubuntu/lenovo-sl-laptop/Kconfig
@@ -0,0 +1,5 @@
+config LENOVO_SL_LAPTOP
+	tristate "Lenovo SL Thinkpads support"
+	depends on X86
+	default m
+
--- linux-rt-2.6.31.orig/ubuntu/lenovo-sl-laptop/README
+++ linux-rt-2.6.31/ubuntu/lenovo-sl-laptop/README
@@ -0,0 +1,45 @@
+lenoso-sl-laptop
+
+This is an experimental driver for the Lenovo ThinkPad SL
+series, since those laptops are currently not supported by
+the thinkpad_acpi driver.
+
+Works: hotkeys, bluetooth, the Lenovo Care LED, the fan
+Experimental: backlight brightness WWAN
+Not tested: UWB
+Not implemented: hdaps accelerometer
+
+NB: to make the Lenovo Care LED blink, make sure the LED timer
+trigger is enabled (CONFIG_LEDS_TRIGGERS_TIMER) and do
+echo "timer" > /sys/class/leds/lensl::lenovocare/trigger
+
+
+The backlight brightness control is useful because the SL
+series use the ACPI brightness API in a non-standard manner,
+causing buggy behavior with the standard ACPI video module
+backlight control.
+
+To enable the brightness control, load the module with the 
+"control_backlight=1" module parameter (i.e.
+insmod lenovo-sl-laptop.ko control_backlight=1 )
+
+Note that the brightness control will likely conflict with
+the ACPI video driver brightness control. So, if you have
+the ACPI video driver loaded (and you probably do):
+
+echo 0 > /sys/module/video/parameters/brightness_switch_enabled
+insmod lenovo-sl-laptop.ko control_backlight=1
+and then restart X.
+
+Alternatively, you can try to use the "acpi_backlight=vendor"
+kernel boot parameter (recognized by kernel versions 2.6.28
+and higher).
+
+Alternatively alternatively, simply unload the ACPI video
+driver (rmmod video).
+
+
+To build the module for your current kernel, run make.
+Note that you will need to have the sources or headers for 
+your kernel in the correct location (depends on the distro).
+
--- linux-rt-2.6.31.orig/ubuntu/lenovo-sl-laptop/lenovo-sl-laptop.c
+++ linux-rt-2.6.31/ubuntu/lenovo-sl-laptop/lenovo-sl-laptop.c
@@ -0,0 +1,1420 @@
+/*
+ *  lenovo-sl-laptop.c - Lenovo ThinkPad SL Series Extras Driver
+ *
+ *
+ *  Copyright (C) 2008-2009 Alexandre Rostovtsev <tetromino@gmail.com>
+ *
+ *  Largely based on thinkpad_acpi.c, eeepc-laptop.c, and video.c which
+ *  are copyright their respective authors.
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ *  02110-1301, USA.
+ *
+ */
+
+#define LENSL_LAPTOP_VERSION "0.02"
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/version.h>
+#include <linux/init.h>
+#include <linux/acpi.h>
+#include <linux/pci_ids.h>
+#include <linux/rfkill.h>
+#include <linux/hwmon.h>
+#include <linux/hwmon-sysfs.h>
+#include <linux/backlight.h>
+#include <linux/platform_device.h>
+
+#include <linux/input.h>
+#include <linux/kthread.h>
+#include <linux/freezer.h>
+
+#include <linux/proc_fs.h>
+#include <linux/uaccess.h>
+
+#define LENSL_MODULE_DESC "Lenovo ThinkPad SL Series Extras driver"
+#define LENSL_MODULE_NAME "lenovo-sl-laptop"
+
+MODULE_AUTHOR("Alexandre Rostovtsev");
+MODULE_DESCRIPTION(LENSL_MODULE_DESC);
+MODULE_LICENSE("GPL");
+
+/* #define instead of enum needed for macro */
+#define LENSL_EMERG	0
+#define LENSL_ALERT	1
+#define LENSL_CRIT	2
+#define LENSL_ERR	3
+#define LENSL_WARNING	4
+#define LENSL_NOTICE	5
+#define LENSL_INFO	6
+#define LENSL_DEBUG	7
+
+#define vdbg_printk_(a_dbg_level, format, arg...) \
+	do { if (dbg_level >= a_dbg_level) \
+		printk("<" #a_dbg_level ">" LENSL_MODULE_NAME ": " \
+			format, ## arg); \
+	} while (0)
+#define vdbg_printk(a_dbg_level, format, arg...) \
+	vdbg_printk_(a_dbg_level, format, ## arg)
+
+#define LENSL_HKEY_FILE LENSL_MODULE_NAME
+#define LENSL_DRVR_NAME LENSL_MODULE_NAME
+
+/* FIXME : we use "thinkpad_screen" for now to ensure compatibility with
+   the xf86-video-intel driver (it checks the name against a fixed list
+   of strings, see i830_lvds.c) but this is obviously suboptimal since
+   this string is usually used by thinkpad_acpi.c */
+#define LENSL_BACKLIGHT_NAME "thinkpad_screen"
+
+#define LENSL_HKEY_POLL_KTHREAD_NAME "klensl_hkeyd"
+#define LENSL_WORKQUEUE_NAME "klensl_wq"
+
+#define LENSL_EC0 "\\_SB.PCI0.SBRG.EC0"
+#define LENSL_HKEY LENSL_EC0 ".HKEY"
+#define LENSL_LCDD "\\_SB.PCI0.VGA.LCDD"
+
+#define LENSL_MAX_ACPI_ARGS 3
+
+/* parameters */
+
+static unsigned int dbg_level = LENSL_INFO;
+static int debug_ec;
+static int control_backlight;
+static int bluetooth_auto_enable = 1;
+static int wwan_auto_enable = 1;
+static int uwb_auto_enable = 1;
+module_param(debug_ec, bool, S_IRUGO);
+MODULE_PARM_DESC(debug_ec,
+	"Present EC debugging interface in procfs. WARNING: writing to the "
+	"EC can hang your system and possibly damage your hardware.");
+module_param(control_backlight, bool, S_IRUGO);
+MODULE_PARM_DESC(control_backlight,
+	"Control backlight brightness; can conflict with ACPI video driver.");
+module_param_named(debug, dbg_level, uint, S_IRUGO);
+MODULE_PARM_DESC(debug,
+	"Set debug verbosity level (0 = nothing, 7 = everything).");
+module_param(bluetooth_auto_enable, bool, S_IRUGO);
+MODULE_PARM_DESC(bluetooth_auto_enable,
+	"Automatically enable bluetooth (if supported by hardware) when the "
+	"module is loaded.");
+module_param(wwan_auto_enable, bool, S_IRUGO);
+MODULE_PARM_DESC(wwan_auto_enable,
+	"Automatically enable WWAN (if supported by hardware) when the "
+	"module is loaded.");
+module_param(uwb_auto_enable, bool, S_IRUGO);
+MODULE_PARM_DESC(wwan_auto_enable,
+	"Automatically enable UWB (if supported by hardware) when the "
+	"module is loaded.");
+
+/* general */
+
+static acpi_handle hkey_handle, ec0_handle;
+static struct platform_device *lensl_pdev;
+static struct input_dev *hkey_inputdev;
+static struct workqueue_struct *lensl_wq;
+
+static int parse_strtoul(const char *buf,
+		unsigned long max, unsigned long *value)
+{
+	int res;
+
+	res = strict_strtoul(buf, 0, value);
+	if (res)
+		return res;
+	if (*value > max)
+		return -EINVAL;
+	return 0;
+}
+
+static int lensl_acpi_int_func(acpi_handle handle, char *pathname, int *ret,
+				int n_arg, ...)
+{
+	acpi_status status;
+	struct acpi_object_list params;
+	union acpi_object in_obj[LENSL_MAX_ACPI_ARGS], out_obj;
+	struct acpi_buffer result, *resultp;
+	int i;
+	va_list ap;
+
+	if (!handle)
+		return -EINVAL;
+	if (n_arg < 0 || n_arg > LENSL_MAX_ACPI_ARGS)
+		return -EINVAL;
+	va_start(ap, n_arg);
+	for (i = 0; i < n_arg; i++) {
+		in_obj[i].integer.value = va_arg(ap, int);
+		in_obj[i].type = ACPI_TYPE_INTEGER;
+	}
+	va_end(ap);
+	params.count = n_arg;
+	params.pointer = in_obj;
+
+	if (ret) {
+		result.length = sizeof(out_obj);
+		result.pointer = &out_obj;
+		resultp = &result;
+	} else
+		resultp = NULL;
+
+	status = acpi_evaluate_object(handle, pathname, &params, resultp);
+	if (ACPI_FAILURE(status))
+		return -EIO;
+	if (ret)
+		*ret = out_obj.integer.value;
+
+	vdbg_printk(LENSL_DEBUG, "ACPI : %s(", pathname);
+	if (dbg_level >= LENSL_DEBUG) {
+		for (i = 0; i < n_arg; i++) {
+			if (i)
+				printk(", ");
+			printk("%d", (int)in_obj[i].integer.value);
+		}
+		printk(")");
+		if (ret)
+			printk(" == %d", *ret);
+		printk("\n");
+	}
+	return 0;
+}
+
+/*************************************************************************
+    Bluetooth, WWAN, UWB
+ *************************************************************************/
+
+enum {
+	/* ACPI GBDC/SBDC, GWAN/SWAN, GUWB/SUWB bits */
+	LENSL_RADIO_HWPRESENT	= 0x01, /* hardware is available */
+	LENSL_RADIO_RADIOSSW	= 0x02, /* radio is enabled */
+	LENSL_RADIO_RESUMECTRL	= 0x04, /* state at resume: off/last state */
+};
+
+typedef enum {
+	LENSL_BLUETOOTH = 0,
+	LENSL_WWAN,
+	LENSL_UWB,
+} lensl_radio_type;
+
+/* pretend_blocked indicates whether we pretend that the device is
+   hardware-blocked (used primarily to prevent the device from coming
+   online when the module is loaded) */
+struct lensl_radio {
+	lensl_radio_type type;
+	enum rfkill_type rfktype;
+	int present;
+	char *name;
+	char *rfkname;
+	struct rfkill *rfk;
+	int (*get_acpi)(int *);
+	int (*set_acpi)(int);
+	int *auto_enable;
+};
+
+static inline int get_wlsw(int *value)
+{
+	return lensl_acpi_int_func(hkey_handle, "WLSW", value, 0);
+}
+
+static inline int get_gbdc(int *value)
+{
+	return lensl_acpi_int_func(hkey_handle, "GBDC", value, 0);
+}
+
+static inline int get_gwan(int *value)
+{
+	return lensl_acpi_int_func(hkey_handle, "GWAN", value, 0);
+}
+
+static inline int get_guwb(int *value)
+{
+	return lensl_acpi_int_func(hkey_handle, "GUWB", value, 0);
+}
+
+static inline int set_sbdc(int value)
+{
+	return lensl_acpi_int_func(hkey_handle, "SBDC", NULL, 1, value);
+}
+
+static inline int set_swan(int value)
+{
+	return lensl_acpi_int_func(hkey_handle, "SWAN", NULL, 1, value);
+}
+
+static inline int set_suwb(int value)
+{
+	return lensl_acpi_int_func(hkey_handle, "SUWB", NULL, 1, value);
+}
+
+static int lensl_radio_get(struct lensl_radio *radio, int *hw_blocked,
+				int *value)
+{
+	int wlsw;
+
+	*hw_blocked = 0;
+	if (!radio)
+		return -EINVAL;
+	if (!radio->present)
+		return -ENODEV;
+	if (!get_wlsw(&wlsw) && !wlsw)
+		*hw_blocked = 1;
+	if (radio->get_acpi(value))
+		return -EIO;
+	return 0;
+}
+
+static int lensl_radio_set_on(struct lensl_radio *radio, int *hw_blocked,
+				bool on)
+{
+	int value, ret;
+	if ((ret = lensl_radio_get(radio, hw_blocked, &value)) < 0)
+		return ret;
+	/* WLSW overrides radio in firmware/hardware, but there is
+	   no reason to risk weird behaviour. */
+	if (*hw_blocked)
+		return ret;
+	if (on)
+		value |= LENSL_RADIO_RADIOSSW;
+	else
+		value &= ~LENSL_RADIO_RADIOSSW;
+	if (radio->set_acpi(value))
+		return -EIO;
+	return 0;
+}
+
+/* Bluetooth/WWAN/UWB rfkill interface */
+
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,30)
+
+static int lensl_radio_rfkill_get_state(void *data, enum rfkill_state *state)
+{
+	int ret, value, hw_blocked = 0;
+	ret = lensl_radio_get((struct lensl_radio *)data,
+		&hw_blocked, &value);
+
+	if (hw_blocked) {
+		*state = RFKILL_STATE_HARD_BLOCKED;
+		return 0;
+	}
+
+	if (ret)
+		return ret;
+
+	if (value & LENSL_RADIO_RADIOSSW)
+		*state = RFKILL_STATE_UNBLOCKED;
+	else
+		*state = RFKILL_STATE_SOFT_BLOCKED;
+	return 0;
+}
+
+static int lensl_radio_rfkill_toggle_radio(void *data, enum rfkill_state state)
+{
+	int ret, value, hw_blocked = 0;
+	ret = lensl_radio_get((struct lensl_radio *)data,
+		&hw_blocked, &value);
+
+	if (state == RFKILL_STATE_UNBLOCKED) {
+		if (hw_blocked)
+			return -EPERM;
+		if (ret)
+			return ret;
+		value = 1;
+	} else {
+		if (ret && !hw_blocked)
+			return ret;
+		value = 0;
+	}
+
+	ret = lensl_radio_set_on((struct lensl_radio *)data,
+		&hw_blocked, value);
+
+	if (hw_blocked)
+		return 0;
+	return ret;
+}
+
+static int lensl_radio_new_rfkill(struct lensl_radio *radio,
+			struct rfkill **rfk, bool sw_blocked,
+			bool hw_blocked)
+{
+	int res;
+
+	*rfk = rfkill_allocate(&lensl_pdev->dev, radio->rfktype);
+	if (!*rfk) {
+		vdbg_printk(LENSL_ERR,
+			"Failed to allocate memory for rfkill class\n");
+		return -ENOMEM;
+	}
+
+	(*rfk)->name = radio->rfkname;
+	(*rfk)->get_state = lensl_radio_rfkill_get_state;
+	(*rfk)->toggle_radio = lensl_radio_rfkill_toggle_radio;
+	(*rfk)->data = radio;
+
+	if (hw_blocked)
+		(*rfk)->state = RFKILL_STATE_HARD_BLOCKED;
+	else if (sw_blocked)
+		(*rfk)->state = RFKILL_STATE_SOFT_BLOCKED;
+	else
+		(*rfk)->state = RFKILL_STATE_UNBLOCKED;
+
+	res = rfkill_register(*rfk);
+	if (res < 0) {
+		vdbg_printk(LENSL_ERR,
+			"Failed to register %s rfkill switch: %d\n",
+			radio->rfkname, res);
+		rfkill_free(*rfk);
+		*rfk = NULL;
+		return res;
+	}
+
+	return 0;
+}
+
+#else
+
+static void lensl_radio_rfkill_query(struct rfkill *rfk, void *data)
+{
+	int ret, value = 0;
+	ret = get_wlsw(&value);
+	if (ret)
+		return;
+	rfkill_set_hw_state(rfk, !value);
+}
+
+static int lensl_radio_rfkill_set_block(void *data, bool blocked)
+{
+	int ret, hw_blocked = 0;
+	ret = lensl_radio_set_on((struct lensl_radio *)data,
+		&hw_blocked, !blocked);
+	/* rfkill spec: just return 0 on hard block */
+	return ret;
+}
+
+static struct rfkill_ops rfkops = {
+	NULL,
+	lensl_radio_rfkill_query,
+	lensl_radio_rfkill_set_block,
+};
+
+static int lensl_radio_new_rfkill(struct lensl_radio *radio,
+			struct rfkill **rfk, bool sw_blocked,
+			bool hw_blocked)
+{
+	int res;
+		
+	*rfk = rfkill_alloc(radio->rfkname, &lensl_pdev->dev, radio->rfktype,
+			&rfkops, radio);
+	if (!*rfk) {
+		vdbg_printk(LENSL_ERR,
+			"Failed to allocate memory for rfkill class\n");
+		return -ENOMEM;
+	}
+
+	rfkill_set_hw_state(*rfk, hw_blocked);
+	rfkill_set_sw_state(*rfk, sw_blocked);
+
+	res = rfkill_register(*rfk);
+	if (res < 0) {
+		vdbg_printk(LENSL_ERR,
+			"Failed to register %s rfkill switch: %d\n",
+			radio->rfkname, res);
+		rfkill_destroy(*rfk);
+		*rfk = NULL;
+		return res;
+	}
+
+	return 0;
+}
+
+#endif /* LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,30) */
+
+/* Bluetooth/WWAN/UWB init and exit */
+
+static struct lensl_radio lensl_radios[3] = {
+	{
+		LENSL_BLUETOOTH,
+		RFKILL_TYPE_BLUETOOTH,
+		0,
+		"bluetooth",
+		"lensl_bluetooth_sw",
+		NULL,
+		get_gbdc,
+		set_sbdc,
+		&bluetooth_auto_enable,
+	},
+	{
+		LENSL_WWAN,
+		RFKILL_TYPE_WWAN,
+		0,
+		"WWAN",
+		"lensl_wwan_sw",
+		NULL,
+		get_gwan,
+		set_swan,
+		&wwan_auto_enable,
+	},
+	{
+		LENSL_UWB,
+		RFKILL_TYPE_UWB,
+		0,
+		"UWB",
+		"lensl_uwb_sw",
+		NULL,
+		get_guwb,
+		set_suwb,
+		&uwb_auto_enable,
+	},
+};
+
+static void radio_exit(lensl_radio_type type)
+{
+	if (lensl_radios[type].rfk)
+		rfkill_unregister(lensl_radios[type].rfk);
+}
+
+static int radio_init(lensl_radio_type type)
+{
+	int value, res, hw_blocked = 0, sw_blocked;
+
+	if (!hkey_handle)
+		return -ENODEV;
+	lensl_radios[type].present = 1; /* need for lensl_radio_get */
+	res = lensl_radio_get(&lensl_radios[type], &hw_blocked, &value);
+	lensl_radios[type].present = 0;
+	if (res && !hw_blocked)
+		return -EIO;
+	if (!(value & LENSL_RADIO_HWPRESENT))
+		return -ENODEV;
+	lensl_radios[type].present = 1;
+
+	if (*lensl_radios[type].auto_enable) {
+		sw_blocked = 0;
+		value |= LENSL_RADIO_RADIOSSW;
+		lensl_radios[type].set_acpi(value);
+	} else {
+		sw_blocked = 1;
+		value &= ~LENSL_RADIO_RADIOSSW;
+		lensl_radios[type].set_acpi(value);
+	}
+
+	res = lensl_radio_new_rfkill(&lensl_radios[type], &lensl_radios[type].rfk,
+					sw_blocked, hw_blocked);
+
+	if (res) {
+		radio_exit(type);
+		return res;
+	}
+	vdbg_printk(LENSL_DEBUG, "Initialized %s subdriver\n",
+		lensl_radios[type].name);
+
+	return 0;
+}
+
+/*************************************************************************
+    backlight control - based on video.c
+ *************************************************************************/
+
+/* NB: the reason why this needs to be implemented here is that the SL series
+   uses the ACPI interface for controlling the backlight in a non-standard
+   manner. See http://bugzilla.kernel.org/show_bug.cgi?id=12249  */
+
+static acpi_handle lcdd_handle;
+static struct backlight_device *backlight;
+static struct lensl_vector {
+	int count;
+	int *values;
+} backlight_levels;
+
+static int get_bcl(struct lensl_vector *levels)
+{
+	int i, status;
+	struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
+	union acpi_object *o, *obj;
+
+	if (!levels)
+		return -EINVAL;
+	if (levels->count) {
+		levels->count = 0;
+		kfree(levels->values);
+	}
+
+	/* _BCL returns an array sorted from high to low; the first two values
+	   are *not* special (non-standard behavior) */
+	status = acpi_evaluate_object(lcdd_handle, "_BCL", NULL, &buffer);
+	if (!ACPI_SUCCESS(status))
+		return status;
+	obj = (union acpi_object *)buffer.pointer;
+	if (!obj || (obj->type != ACPI_TYPE_PACKAGE)) {
+		vdbg_printk(LENSL_ERR, "Invalid _BCL data\n");
+		status = -EFAULT;
+		goto out;
+	}
+
+	levels->count = obj->package.count;
+	if (!levels->count)
+		goto out;
+	levels->values = kmalloc(levels->count * sizeof(int), GFP_KERNEL);
+	if (!levels->values) {
+		vdbg_printk(LENSL_ERR,
+			"Failed to allocate memory for brightness levels\n");
+		status = -ENOMEM;
+		goto out;
+	}
+
+	for (i = 0; i < obj->package.count; i++) {
+		o = (union acpi_object *)&obj->package.elements[i];
+		if (o->type != ACPI_TYPE_INTEGER) {
+			vdbg_printk(LENSL_ERR, "Invalid brightness data\n");
+			goto err;
+		}
+		levels->values[i] = (int) o->integer.value;
+	}
+	goto out;
+
+err:
+	levels->count = 0;
+	kfree(levels->values);
+
+out:
+	kfree(buffer.pointer);
+
+	return status;
+}
+
+static inline int set_bcm(int level)
+{
+	/* standard behavior */
+	return lensl_acpi_int_func(lcdd_handle, "_BCM", NULL, 1, level);
+}
+
+static inline int get_bqc(int *level)
+{
+	/* returns an index from the bottom into the _BCL package
+	   (non-standard behavior) */
+	return lensl_acpi_int_func(lcdd_handle, "_BQC", level, 0);
+}
+
+/* backlight device sysfs support */
+static int lensl_bd_get_brightness(struct backlight_device *bd)
+{
+	int level = 0;
+
+	if (get_bqc(&level))
+		return 0;
+
+	return level;
+}
+
+static int lensl_bd_set_brightness_int(int request_level)
+{
+	int n;
+	n = backlight_levels.count - request_level - 1;
+	if (n >= 0 && n < backlight_levels.count)
+		return set_bcm(backlight_levels.values[n]);
+
+	return -EINVAL;
+}
+
+static int lensl_bd_set_brightness(struct backlight_device *bd)
+{
+	if (!bd)
+		return -EINVAL;
+
+	return lensl_bd_set_brightness_int(bd->props.brightness);
+}
+
+static struct backlight_ops lensl_backlight_ops = {
+	.get_brightness = lensl_bd_get_brightness,
+	.update_status  = lensl_bd_set_brightness,
+};
+
+static void backlight_exit(void)
+{
+	backlight_device_unregister(backlight);
+	backlight = NULL;
+	if (backlight_levels.count) {
+		kfree(backlight_levels.values);
+		backlight_levels.count = 0;
+	}
+}
+
+static int backlight_init(void)
+{
+	int status = 0;
+
+	lcdd_handle = NULL;
+	backlight = NULL;
+	backlight_levels.count = 0;
+	backlight_levels.values = NULL;
+
+	status = acpi_get_handle(NULL, LENSL_LCDD, &lcdd_handle);
+	if (ACPI_FAILURE(status)) {
+		vdbg_printk(LENSL_ERR,
+			"Failed to get ACPI handle for %s\n", LENSL_LCDD);
+		return -EIO;
+	}
+
+	status = get_bcl(&backlight_levels);
+	if (status || !backlight_levels.count)
+		goto err;
+
+	backlight = backlight_device_register(LENSL_BACKLIGHT_NAME,
+			NULL, NULL, &lensl_backlight_ops);
+	backlight->props.max_brightness = backlight_levels.count - 1;
+	backlight->props.brightness = lensl_bd_get_brightness(backlight);
+	vdbg_printk(LENSL_INFO, "Started backlight brightness control\n");
+	goto out;
+err:
+	if (backlight_levels.count) {
+		kfree(backlight_levels.values);
+		backlight_levels.count = 0;
+	}
+	vdbg_printk(LENSL_ERR,
+		"Failed to start backlight brightness control\n");
+out:
+	return status;
+}
+
+/*************************************************************************
+    LEDs
+ *************************************************************************/
+
+#ifdef CONFIG_NEW_LEDS
+
+#define LENSL_LED_TV_OFF   0
+#define LENSL_LED_TV_ON    0x02
+#define LENSL_LED_TV_BLINK 0x01
+#define LENSL_LED_TV_DIM   0x100
+
+/* equivalent to the ThinkVantage LED on other ThinkPads */
+#define LENSL_LED_TV_NAME "lensl::lenovocare"
+
+struct {
+	struct led_classdev cdev;
+	enum led_brightness brightness;
+	int supported, new_code;
+	struct work_struct work;
+} led_tv;
+
+static inline int set_tvls(int code)
+{
+	return lensl_acpi_int_func(hkey_handle, "TVLS", NULL, 1, code);
+}
+
+static void led_tv_worker(struct work_struct *work)
+{
+	if (!led_tv.supported)
+		return;
+	set_tvls(led_tv.new_code);
+	if (led_tv.new_code)
+		led_tv.brightness = LED_FULL;
+	else
+		led_tv.brightness = LED_OFF;
+}
+
+static void led_tv_brightness_set_sysfs(struct led_classdev *led_cdev,
+				enum led_brightness brightness)
+{
+	switch (brightness) {
+	case LED_OFF:
+		led_tv.new_code = LENSL_LED_TV_OFF;
+		break;
+	case LED_FULL:
+		led_tv.new_code = LENSL_LED_TV_ON;
+		break;
+	default:
+		return;
+	}
+	queue_work(lensl_wq, &led_tv.work);
+}
+
+static enum led_brightness led_tv_brightness_get_sysfs(
+					struct led_classdev *led_cdev)
+{
+	return led_tv.brightness;
+}
+
+static int led_tv_blink_set_sysfs(struct led_classdev *led_cdev,
+			unsigned long *delay_on, unsigned long *delay_off)
+{
+	if (*delay_on == 0 && *delay_off == 0) {
+		/* If we can choose the flash rate, use dimmed blinking --
+		   it looks better */
+		led_tv.new_code = LENSL_LED_TV_ON |
+			LENSL_LED_TV_BLINK | LENSL_LED_TV_DIM;
+		*delay_on = 2000;
+		*delay_off = 2000;
+	} else if (*delay_on + *delay_off == 4000) {
+		/* User wants dimmed blinking */
+		led_tv.new_code = LENSL_LED_TV_ON |
+			LENSL_LED_TV_BLINK | LENSL_LED_TV_DIM;
+	} else if (*delay_on == 7250 && *delay_off == 500) {
+		/* User wants standard blinking mode */
+		led_tv.new_code = LENSL_LED_TV_ON | LENSL_LED_TV_BLINK;
+	} else
+		return -EINVAL;
+	queue_work(lensl_wq, &led_tv.work);
+	return 0;
+}
+
+static void led_exit(void)
+{
+	if (led_tv.supported) {
+		led_classdev_unregister(&led_tv.cdev);
+		led_tv.supported = 0;
+		set_tvls(LENSL_LED_TV_OFF);
+	}
+}
+
+static int led_init(void)
+{
+	int res;
+
+	memset(&led_tv, 0, sizeof(led_tv));
+	led_tv.cdev.brightness_get = led_tv_brightness_get_sysfs;
+	led_tv.cdev.brightness_set = led_tv_brightness_set_sysfs;
+	led_tv.cdev.blink_set = led_tv_blink_set_sysfs;
+	led_tv.cdev.name = LENSL_LED_TV_NAME;
+	INIT_WORK(&led_tv.work, led_tv_worker);
+	set_tvls(LENSL_LED_TV_OFF);
+	res = led_classdev_register(&lensl_pdev->dev, &led_tv.cdev);
+	if (res) {
+		vdbg_printk(LENSL_WARNING, "Failed to register LED device\n");
+		return res;
+	}
+	led_tv.supported = 1;
+	vdbg_printk(LENSL_DEBUG, "Initialized LED subdriver\n");
+	return 0;
+}
+
+#else /* CONFIG_NEW_LEDS */
+
+static void led_exit(void)
+{
+}
+
+static int led_init(void)
+{
+	return -ENODEV;
+}
+
+#endif /* CONFIG_NEW_LEDS */
+
+/*************************************************************************
+    hwmon & fans
+ *************************************************************************/
+
+static struct device *lensl_hwmon_device;
+/* we do not have a reliable way of reading it from ACPI */
+static int pwm1_value = -1;
+/* corresponds to ~2700 rpm */
+#define DEFAULT_PWM1 126
+
+static inline int get_tach(int *value, int fan)
+{
+	return lensl_acpi_int_func(ec0_handle, "TACH", value, 1, fan);
+}
+
+static inline int get_decf(int *value)
+{
+	return lensl_acpi_int_func(ec0_handle, "DECF", value, 0);
+}
+
+/* speed must be in range 0 .. 255 */
+static inline int set_sfnv(int action, int speed)
+{
+	return lensl_acpi_int_func(ec0_handle, "SFNV", NULL, 2, action, speed);
+}
+
+static int pwm1_enable_get_current(void)
+{
+	int res;
+	int value;
+
+	res = get_decf(&value);
+	if (res)
+		return res;
+	if (value & 1)
+		return 1;
+	return 0;
+}
+
+static ssize_t fan1_input_show(struct device *dev,
+				struct device_attribute *attr, char *buf)
+{
+	int res;
+	int rpm;
+
+	res = get_tach(&rpm, 0);
+	if (res)
+		return res;
+	return snprintf(buf, PAGE_SIZE, "%u\n", rpm);
+}
+
+static ssize_t pwm1_show(struct device *dev,
+				struct device_attribute *attr, char *buf)
+{
+	if (pwm1_value > -1)
+		return snprintf(buf, PAGE_SIZE, "%u\n", pwm1_value);
+	return -EPERM;
+}
+
+static ssize_t pwm1_store(struct device *dev,
+				struct device_attribute *attr,
+				const char *buf, size_t count)
+{
+	int status, res = 0;
+	unsigned long speed;
+	if (parse_strtoul(buf, 255, &speed))
+		return -EINVAL;
+	status = pwm1_enable_get_current();
+	if (status < 0)
+		return status;
+	if (status > 0)
+		res = set_sfnv(1, speed);
+
+	if (res)
+		return res;
+	pwm1_value = speed;
+	return count;
+}
+
+static ssize_t pwm1_enable_show(struct device *dev,
+				struct device_attribute *attr, char *buf)
+{
+	int status;
+	status = pwm1_enable_get_current();
+	if (status < 0)
+		return status;
+	return snprintf(buf, PAGE_SIZE, "%u\n", status);
+}
+
+static ssize_t pwm1_enable_store(struct device *dev,
+				struct device_attribute *attr,
+				const char *buf, size_t count)
+{
+	int res, speed;
+	unsigned long status;
+
+	if (parse_strtoul(buf, 1, &status))
+		return -EINVAL;
+
+	if (status && pwm1_value > -1)
+		speed = pwm1_value;
+	else
+		speed = DEFAULT_PWM1;
+
+	res = set_sfnv(status, speed);
+
+	if (res)
+		return res;
+	pwm1_value = speed;
+	return count;
+}
+
+static struct device_attribute dev_attr_fan1_input =
+	__ATTR(fan1_input, S_IRUGO,
+		fan1_input_show, NULL);
+static struct device_attribute dev_attr_pwm1 =
+	__ATTR(pwm1, S_IWUSR | S_IRUGO,
+		pwm1_show, pwm1_store);
+static struct device_attribute dev_attr_pwm1_enable =
+	__ATTR(pwm1_enable, S_IWUSR | S_IRUGO,
+		pwm1_enable_show, pwm1_enable_store);
+
+static struct attribute *hwmon_attributes[] = {
+	&dev_attr_pwm1_enable.attr, &dev_attr_pwm1.attr,
+	&dev_attr_fan1_input.attr,
+	NULL
+};
+
+static const struct attribute_group hwmon_attr_group = {
+	.attrs = hwmon_attributes,
+};
+
+static void hwmon_exit(void)
+{
+	if (!lensl_hwmon_device)
+		return;
+
+	sysfs_remove_group(&lensl_hwmon_device->kobj,
+			   &hwmon_attr_group);
+	hwmon_device_unregister(lensl_hwmon_device);
+	lensl_hwmon_device = NULL;
+	/* switch fans to automatic mode on module unload */
+	set_sfnv(0, DEFAULT_PWM1);
+}
+
+static int hwmon_init(void)
+{
+	int res;
+
+	pwm1_value = -1;
+	lensl_hwmon_device = hwmon_device_register(&lensl_pdev->dev);
+	if (!lensl_hwmon_device) {
+		vdbg_printk(LENSL_ERR, "Failed to register hwmon device\n");
+		return -ENODEV;
+	}
+
+	res = sysfs_create_group(&lensl_hwmon_device->kobj,
+				 &hwmon_attr_group);
+	if (res < 0) {
+		vdbg_printk(LENSL_ERR, "Failed to create hwmon sysfs group\n");
+		hwmon_device_unregister(lensl_hwmon_device);
+		lensl_hwmon_device = NULL;
+		return -ENODEV;
+	}
+	vdbg_printk(LENSL_DEBUG, "Initialized hwmon subdriver\n");
+	return 0;
+}
+
+/*************************************************************************
+    hotkeys
+ *************************************************************************/
+
+static int hkey_poll_hz = 5;
+static u8 hkey_ec_prev_offset;
+static struct mutex hkey_poll_mutex;
+static struct task_struct *hkey_poll_task;
+
+struct key_entry {
+	char type;
+	u8 scancode;
+	int keycode;
+};
+
+enum { KE_KEY, KE_END };
+
+static struct key_entry ec_keymap[] = {
+	/* Fn F2 */
+	{KE_KEY, 0x0B, KEY_COFFEE },
+	/* Fn F3 */
+	{KE_KEY, 0x0C, KEY_BATTERY },
+	/* Fn F4; dispatches an ACPI event */
+	{KE_KEY, 0x0D, /* KEY_SLEEP */ KEY_RESERVED },
+	/* Fn F5; FIXME: should this be KEY_BLUETOOTH? */
+	{KE_KEY, 0x0E, KEY_WLAN },
+	/* Fn F7; dispatches an ACPI event */
+	{KE_KEY, 0x10, /* KEY_SWITCHVIDEOMODE */ KEY_RESERVED },
+	/* Fn F8 - ultranav; FIXME: find some keycode that fits this properly */
+	{KE_KEY, 0x11, KEY_PROG1 },
+	/* Fn F9 */
+	{KE_KEY, 0x12, KEY_EJECTCD },
+	/* Fn F12 */
+	{KE_KEY, 0x15, KEY_SUSPEND },
+	{KE_KEY, 0x69, KEY_VOLUMEUP },
+	{KE_KEY, 0x6A, KEY_VOLUMEDOWN },
+	{KE_KEY, 0x6B, KEY_MUTE },
+	/* Fn Home; dispatches an ACPI event */
+	{KE_KEY, 0x6C, KEY_BRIGHTNESSDOWN /*KEY_RESERVED*/ },
+	/* Fn End; dispatches an ACPI event */
+	{KE_KEY, 0x6D, KEY_BRIGHTNESSUP /*KEY_RESERVED*/ },
+	/* Fn spacebar - zoom */
+	{KE_KEY, 0x71, KEY_ZOOM },
+	/* Lenovo Care key */
+	{KE_KEY, 0x80, KEY_VENDOR },
+	{KE_END, 0},
+};
+
+static int ec_scancode_to_keycode(u8 scancode)
+{
+	struct key_entry *key;
+
+	for (key = ec_keymap; key->type != KE_END; key++)
+		if (scancode == key->scancode)
+			return key->keycode;
+
+	return -EINVAL;
+}
+
+static int hkey_inputdev_getkeycode(struct input_dev *dev, int scancode,
+					int *keycode)
+{
+	int result;
+
+	if (!dev)
+		return -EINVAL;
+
+	result = ec_scancode_to_keycode(scancode);
+	if (result >= 0) {
+		*keycode = result;
+		return 0;
+	}
+	return result;
+}
+
+static int hkey_inputdev_setkeycode(struct input_dev *dev, int scancode,
+					int keycode)
+{
+	struct key_entry *key;
+
+	if (!dev)
+		return -EINVAL;
+
+	for (key = ec_keymap; key->type != KE_END; key++)
+		if (scancode == key->scancode) {
+			clear_bit(key->keycode, dev->keybit);
+			key->keycode = keycode;
+			set_bit(key->keycode, dev->keybit);
+			return 0;
+		}
+
+	return -EINVAL;
+}
+
+static int hkey_ec_get_offset(void)
+{
+	/* Hotkey events are stored in EC registers 0x0A .. 0x11
+	 * Address of last event is stored in EC registers 0x12 and
+	 * 0x14; if address is 0x01, last event is in register 0x0A;
+	 * if address is 0x07, last event is in register 0x10;
+	 * if address is 0x00, last event is in register 0x11 */
+
+	u8 offset;
+
+	if (ec_read(0x12, &offset))
+		return -EINVAL;
+	if (!offset)
+		offset = 8;
+	offset -= 1;
+	if (offset > 7)
+		return -EINVAL;
+	return offset;
+}
+
+static int hkey_poll_kthread(void *data)
+{
+	unsigned long t = 0;
+	int offset, level;
+	unsigned int keycode;
+	u8 scancode;
+
+	mutex_lock(&hkey_poll_mutex);
+
+	offset = hkey_ec_get_offset();
+	if (offset < 0) {
+		vdbg_printk(LENSL_WARNING,
+			"Failed to read hotkey register offset from EC\n");
+		hkey_ec_prev_offset = 0;
+	} else
+		hkey_ec_prev_offset = offset;
+
+	while (!kthread_should_stop() && hkey_poll_hz) {
+		if (t == 0)
+			t = 1000/hkey_poll_hz;
+		t = msleep_interruptible(t);
+		if (unlikely(kthread_should_stop()))
+			break;
+		try_to_freeze();
+		if (t > 0)
+			continue;
+		offset = hkey_ec_get_offset();
+		if (offset < 0) {
+			vdbg_printk(LENSL_WARNING,
+			   "Failed to read hotkey register offset from EC\n");
+			continue;
+		}
+		if (offset == hkey_ec_prev_offset)
+			continue;
+
+		if (ec_read(0x0A + offset, &scancode)) {
+			vdbg_printk(LENSL_WARNING,
+				"Failed to read hotkey code from EC\n");
+			continue;
+		}
+		keycode = ec_scancode_to_keycode(scancode);
+		vdbg_printk(LENSL_DEBUG,
+		   "Got hotkey keycode %d (scancode %d)\n", keycode, scancode);
+
+		/* Special handling for brightness keys. We do it here and not
+		   via an ACPI notifier in order to prevent possible conflicts
+		   with video.c */
+		if (keycode == KEY_BRIGHTNESSDOWN) {
+			if (control_backlight && backlight) {
+				level = lensl_bd_get_brightness(backlight);
+				if (0 <= --level)
+					lensl_bd_set_brightness_int(level);
+			} else
+				keycode = KEY_RESERVED;
+		} else if (keycode == KEY_BRIGHTNESSUP) {
+			if (control_backlight && backlight) {
+				level = lensl_bd_get_brightness(backlight);
+				if (backlight_levels.count > ++level)
+					lensl_bd_set_brightness_int(level);
+			} else
+				keycode = KEY_RESERVED;
+		}
+
+		if (keycode != KEY_RESERVED) {
+			input_report_key(hkey_inputdev, keycode, 1);
+			input_sync(hkey_inputdev);
+			input_report_key(hkey_inputdev, keycode, 0);
+			input_sync(hkey_inputdev);
+		}
+		hkey_ec_prev_offset = offset;
+	}
+
+	mutex_unlock(&hkey_poll_mutex);
+	return 0;
+}
+
+static void hkey_poll_start(void)
+{
+	hkey_ec_prev_offset = 0;
+	mutex_lock(&hkey_poll_mutex);
+	hkey_poll_task = kthread_run(hkey_poll_kthread,
+		NULL, LENSL_HKEY_POLL_KTHREAD_NAME);
+	if (IS_ERR(hkey_poll_task)) {
+		hkey_poll_task = NULL;
+		vdbg_printk(LENSL_ERR,
+			"Could not create kernel thread for hotkey polling\n");
+	}
+	mutex_unlock(&hkey_poll_mutex);
+}
+
+static void hkey_poll_stop(void)
+{
+	if (hkey_poll_task) {
+		if (frozen(hkey_poll_task) || freezing(hkey_poll_task))
+			thaw_process(hkey_poll_task);
+
+		kthread_stop(hkey_poll_task);
+		hkey_poll_task = NULL;
+		mutex_lock(&hkey_poll_mutex);
+		/* at this point, the thread did exit */
+		mutex_unlock(&hkey_poll_mutex);
+	}
+}
+
+static void hkey_inputdev_exit(void)
+{
+	if (hkey_inputdev)
+		input_unregister_device(hkey_inputdev);
+	hkey_inputdev = NULL;
+}
+
+static int hkey_inputdev_init(void)
+{
+	int result;
+	struct key_entry *key;
+
+	hkey_inputdev = input_allocate_device();
+	if (!hkey_inputdev) {
+		vdbg_printk(LENSL_ERR,
+			"Failed to allocate hotkey input device\n");
+		return -ENODEV;
+	}
+	hkey_inputdev->name = "Lenovo ThinkPad SL Series extra buttons";
+	hkey_inputdev->phys = LENSL_HKEY_FILE "/input0";
+	hkey_inputdev->uniq = LENSL_HKEY_FILE;
+	hkey_inputdev->id.bustype = BUS_HOST;
+	hkey_inputdev->id.vendor = PCI_VENDOR_ID_LENOVO;
+	hkey_inputdev->getkeycode = hkey_inputdev_getkeycode;
+	hkey_inputdev->setkeycode = hkey_inputdev_setkeycode;
+	set_bit(EV_KEY, hkey_inputdev->evbit);
+
+	for (key = ec_keymap; key->type != KE_END; key++)
+		set_bit(key->keycode, hkey_inputdev->keybit);
+
+	result = input_register_device(hkey_inputdev);
+	if (result) {
+		vdbg_printk(LENSL_ERR,
+			"Failed to register hotkey input device\n");
+		input_free_device(hkey_inputdev);
+		hkey_inputdev = NULL;
+		return -ENODEV;
+	}
+	vdbg_printk(LENSL_DEBUG, "Initialized hotkey subdriver\n");
+	return 0;
+}
+
+
+/*************************************************************************
+    procfs debugging interface
+ *************************************************************************/
+
+#define LENSL_PROC_EC "ec0"
+#define LENSL_PROC_DIRNAME LENSL_MODULE_NAME
+
+static struct proc_dir_entry *proc_dir;
+
+int lensl_ec_read_procmem(char *buf, char **start, off_t offset,
+		int count, int *eof, void *data)
+{
+	int err, len = 0;
+	u8 i, result;
+	/* note: ec_read at i = 255 locks up my SL300 hard. -AR */
+	for (i = 0; i < 255; i++) {
+		if (!(i % 16)) {
+			if (i)
+				len += sprintf(buf+len, "\n");
+			len += sprintf(buf+len, "%02X:", i);
+		}
+		err = ec_read(i, &result);
+		if (!err)
+			len += sprintf(buf+len, " %02X", result);
+		else
+			len += sprintf(buf+len, " **");
+	}
+	len += sprintf(buf+len, "\n");
+	*eof = 1;
+	return len;
+}
+
+/* we expect input in the format "%02X %02X", where the first number is
+   the EC register and the second is the value to be written */
+int lensl_ec_write_procmem(struct file *file, const char *buffer,
+				unsigned long count, void *data)
+{
+	char s[7];
+	unsigned int reg, val;
+
+	if (count > 6)
+		return -EINVAL;
+	memset(s, 0, 7);
+	if (copy_from_user(s, buffer, count))
+		return -EFAULT;
+	if (sscanf(s, "%02X %02X", &reg, &val) < 2)
+		return -EINVAL;
+	if (reg > 255 || val > 255)
+		return -EINVAL;
+	if (ec_write(reg, val))
+		return -EIO;
+	return count;
+}
+
+static void lenovo_sl_procfs_exit(void)
+{
+	if (proc_dir) {
+		remove_proc_entry(LENSL_PROC_EC, proc_dir);
+		remove_proc_entry(LENSL_PROC_DIRNAME, acpi_root_dir);
+	}
+}
+
+static int lenovo_sl_procfs_init(void)
+{
+	struct proc_dir_entry *proc_ec;
+
+	proc_dir = proc_mkdir(LENSL_PROC_DIRNAME, acpi_root_dir);
+	if (!proc_dir) {
+		vdbg_printk(LENSL_ERR,
+		   "Failed to create proc dir acpi/%s/\n", LENSL_PROC_DIRNAME);
+		return -ENOENT;
+	}
+	proc_ec = create_proc_entry(LENSL_PROC_EC, 0600, proc_dir);
+	if (!proc_ec) {
+		vdbg_printk(LENSL_ERR,
+			"Failed to create proc entry acpi/%s/%s\n",
+			LENSL_PROC_DIRNAME, LENSL_PROC_EC);
+		return -ENOENT;
+	}
+	proc_ec->read_proc = lensl_ec_read_procmem;
+	proc_ec->write_proc = lensl_ec_write_procmem;
+	vdbg_printk(LENSL_DEBUG, "Initialized procfs debugging interface\n");
+
+	return 0;
+}
+
+/*************************************************************************
+    init/exit
+ *************************************************************************/
+
+static int __init lenovo_sl_laptop_init(void)
+{
+	int ret;
+	acpi_status status;
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,28)
+	if (!acpi_video_backlight_support())
+		control_backlight = 1;
+#endif
+
+	hkey_handle = ec0_handle = NULL;
+
+	if (acpi_disabled)
+		return -ENODEV;
+
+	lensl_wq = create_singlethread_workqueue(LENSL_WORKQUEUE_NAME);
+	if (!lensl_wq) {
+		vdbg_printk(LENSL_ERR, "Failed to create a workqueue\n");
+		return -ENOMEM;
+	}
+
+	status = acpi_get_handle(NULL, LENSL_HKEY, &hkey_handle);
+	if (ACPI_FAILURE(status)) {
+		vdbg_printk(LENSL_ERR,
+			"Failed to get ACPI handle for %s\n", LENSL_HKEY);
+		return -ENODEV;
+	}
+	status = acpi_get_handle(NULL, LENSL_EC0, &ec0_handle);
+	if (ACPI_FAILURE(status)) {
+		vdbg_printk(LENSL_ERR,
+			"Failed to get ACPI handle for %s\n", LENSL_EC0);
+		return -ENODEV;
+	}
+
+	lensl_pdev = platform_device_register_simple(LENSL_DRVR_NAME, -1,
+							NULL, 0);
+	if (IS_ERR(lensl_pdev)) {
+		ret = PTR_ERR(lensl_pdev);
+		lensl_pdev = NULL;
+		vdbg_printk(LENSL_ERR, "Failed to register platform device\n");
+		return ret;
+	}
+
+	ret = hkey_inputdev_init();
+	if (ret)
+		return -ENODEV;
+
+	radio_init(LENSL_BLUETOOTH);
+	radio_init(LENSL_WWAN);
+	radio_init(LENSL_UWB);
+	if (control_backlight)
+		backlight_init();
+
+	led_init();
+	mutex_init(&hkey_poll_mutex);
+	hkey_poll_start();
+	hwmon_init();
+
+	if (debug_ec)
+		lenovo_sl_procfs_init();
+
+	vdbg_printk(LENSL_INFO, "Loaded Lenovo ThinkPad SL Series driver\n");
+	return 0;
+}
+
+static void __exit lenovo_sl_laptop_exit(void)
+{
+	lenovo_sl_procfs_exit();
+	hwmon_exit();
+	hkey_poll_stop();
+	led_exit();
+	backlight_exit();
+	radio_exit(LENSL_UWB);
+	radio_exit(LENSL_WWAN);
+	radio_exit(LENSL_BLUETOOTH);
+	hkey_inputdev_exit();
+	if (lensl_pdev)
+		platform_device_unregister(lensl_pdev);
+	destroy_workqueue(lensl_wq);
+	vdbg_printk(LENSL_INFO, "Unloaded Lenovo ThinkPad SL Series driver\n");
+}
+
+MODULE_ALIAS("dmi:bvnLENOVO:*:svnLENOVO:*:pvrThinkPad SL*:rvnLENOVO:*");
+MODULE_ALIAS("dmi:bvnLENOVO:*:svnLENOVO.:*:pvrThinkPadSL*:rvnLENOVO:*");
+
+module_init(lenovo_sl_laptop_init);
+module_exit(lenovo_sl_laptop_exit);
--- linux-rt-2.6.31.orig/ubuntu/include/README
+++ linux-rt-2.6.31/ubuntu/include/README
@@ -0,0 +1,4 @@
+Only use this directory for things which need to share their headers with
+other parts of the kernel or other modules in ubuntu/
+
+Otherwise, keep them local to the module directory.
--- linux-rt-2.6.31.orig/ubuntu/include/linux/aufs_type.h
+++ linux-rt-2.6.31/ubuntu/include/linux/aufs_type.h
@@ -0,0 +1,109 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef __AUFS_TYPE_H__
+#define __AUFS_TYPE_H__
+
+#include <linux/ioctl.h>
+
+#define AUFS_VERSION	"2-standalone.tree-30-20090727"
+
+/* todo? move this to linux-2.6.19/include/magic.h */
+#define AUFS_SUPER_MAGIC	('a' << 24 | 'u' << 16 | 'f' << 8 | 's')
+
+/* ---------------------------------------------------------------------- */
+
+#ifdef CONFIG_AUFS_BRANCH_MAX_127
+/* some environments treat 'char' as 'unsigned char' by default */
+typedef signed char aufs_bindex_t;
+#define AUFS_BRANCH_MAX 127
+#else
+typedef short aufs_bindex_t;
+#ifdef CONFIG_AUFS_BRANCH_MAX_511
+#define AUFS_BRANCH_MAX 511
+#elif defined(CONFIG_AUFS_BRANCH_MAX_1023)
+#define AUFS_BRANCH_MAX 1023
+#elif defined(CONFIG_AUFS_BRANCH_MAX_32767)
+#define AUFS_BRANCH_MAX 32767
+#endif
+#endif
+
+#ifdef __KERNEL__
+#ifndef AUFS_BRANCH_MAX
+#error unknown CONFIG_AUFS_BRANCH_MAX value
+#endif
+#endif /* __KERNEL__ */
+
+/* ---------------------------------------------------------------------- */
+
+#define AUFS_NAME		"aufs"
+#define AUFS_FSTYPE		AUFS_NAME
+
+#define AUFS_ROOT_INO		2
+#define AUFS_FIRST_INO		11
+
+#define AUFS_WH_PFX		".wh."
+#define AUFS_WH_PFX_LEN		((int)sizeof(AUFS_WH_PFX) - 1)
+#define AUFS_XINO_FNAME		"." AUFS_NAME ".xino"
+#define AUFS_XINO_DEFPATH	"/tmp/" AUFS_XINO_FNAME
+#define AUFS_XINO_TRUNC_INIT	64 /* blocks */
+#define AUFS_XINO_TRUNC_STEP	4  /* blocks */
+#define AUFS_DIRWH_DEF		3
+#define AUFS_RDCACHE_DEF	10 /* seconds */
+#define AUFS_RDBLK_DEF		512 /* bytes */
+#define AUFS_RDHASH_DEF		32
+#define AUFS_WKQ_NAME		AUFS_NAME "d"
+#define AUFS_NWKQ_DEF		4
+#define AUFS_MFS_SECOND_DEF	30 /* seconds */
+#define AUFS_PLINK_WARN		100 /* number of plinks */
+
+#define AUFS_DIROPQ_NAME	AUFS_WH_PFX ".opq" /* whiteouted doubly */
+#define AUFS_WH_DIROPQ		AUFS_WH_PFX AUFS_DIROPQ_NAME
+
+#define AUFS_BASE_NAME		AUFS_WH_PFX AUFS_NAME
+#define AUFS_PLINKDIR_NAME	AUFS_WH_PFX "plnk"
+#define AUFS_ORPHDIR_NAME	AUFS_WH_PFX "orph"
+
+/* doubly whiteouted */
+#define AUFS_WH_BASE		AUFS_WH_PFX AUFS_BASE_NAME
+#define AUFS_WH_PLINKDIR	AUFS_WH_PFX AUFS_PLINKDIR_NAME
+#define AUFS_WH_ORPHDIR		AUFS_WH_PFX AUFS_ORPHDIR_NAME
+
+/* branch permission */
+#define AUFS_BRPERM_RW		"rw"
+#define AUFS_BRPERM_RO		"ro"
+#define AUFS_BRPERM_RR		"rr"
+#define AUFS_BRPERM_WH		"wh"
+#define AUFS_BRPERM_NLWH	"nolwh"
+#define AUFS_BRPERM_ROWH	AUFS_BRPERM_RO "+" AUFS_BRPERM_WH
+#define AUFS_BRPERM_RRWH	AUFS_BRPERM_RR "+" AUFS_BRPERM_WH
+#define AUFS_BRPERM_RWNLWH	AUFS_BRPERM_RW "+" AUFS_BRPERM_NLWH
+
+/* ---------------------------------------------------------------------- */
+
+/* ioctl */
+enum {
+	AuCtl_PLINK_MAINT,
+	AuCtl_PLINK_CLEAN
+};
+
+#define AuCtlType		'A'
+#define AUFS_CTL_PLINK_MAINT	_IO(AuCtlType, AuCtl_PLINK_MAINT)
+#define AUFS_CTL_PLINK_CLEAN	_IO(AuCtlType, AuCtl_PLINK_CLEAN)
+
+#endif /* __AUFS_TYPE_H__ */
--- linux-rt-2.6.31.orig/ubuntu/aufs/rwsem.h
+++ linux-rt-2.6.31/ubuntu/aufs/rwsem.h
@@ -0,0 +1,186 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * simple read-write semaphore wrappers
+ */
+
+#ifndef __AUFS_RWSEM_H__
+#define __AUFS_RWSEM_H__
+
+#ifdef __KERNEL__
+
+#include <linux/rwsem.h>
+
+struct au_rwsem {
+	struct rw_semaphore	rwsem;
+#ifdef CONFIG_AUFS_DEBUG
+	/* just for debugging, not almighty counter */
+	atomic_t		rcnt, wcnt;
+#endif
+};
+
+#ifdef CONFIG_AUFS_DEBUG
+#define AuDbgCntInit(rw) do { \
+	atomic_set(&(rw)->rcnt, 0); \
+	atomic_set(&(rw)->wcnt, 0); \
+	smp_mb(); /* atomic set */ \
+} while (0)
+
+#define AuDbgRcntInc(rw)	atomic_inc_return(&(rw)->rcnt)
+#define AuDbgRcntDec(rw)	WARN_ON(atomic_dec_return(&(rw)->rcnt) < 0)
+#define AuDbgWcntInc(rw)	WARN_ON(atomic_inc_return(&(rw)->wcnt) > 1)
+#define AuDbgWcntDec(rw)	WARN_ON(atomic_dec_return(&(rw)->wcnt) < 0)
+#else
+#define AuDbgCntInit(rw)	do {} while (0)
+#define AuDbgRcntInc(rw)	do {} while (0)
+#define AuDbgRcntDec(rw)	do {} while (0)
+#define AuDbgWcntInc(rw)	do {} while (0)
+#define AuDbgWcntDec(rw)	do {} while (0)
+#endif /* CONFIG_AUFS_DEBUG */
+
+/* to debug easier, do not make them inlined functions */
+#define AuRwMustNoWaiters(rw)	AuDebugOn(!list_empty(&(rw)->rwsem.wait_list))
+/* rwsem_is_locked() is unusable */
+#define AuRwMustReadLock(rw)	AuDebugOn(atomic_read(&(rw)->rcnt) <= 0)
+#define AuRwMustWriteLock(rw)	AuDebugOn(atomic_read(&(rw)->wcnt) <= 0)
+#define AuRwMustAnyLock(rw)	AuDebugOn(atomic_read(&(rw)->rcnt) <= 0 \
+					&& atomic_read(&(rw)->wcnt) <= 0)
+#define AuRwDestroy(rw)		AuDebugOn(atomic_read(&(rw)->rcnt) \
+					|| atomic_read(&(rw)->wcnt))
+
+static inline void au_rw_init(struct au_rwsem *rw)
+{
+	AuDbgCntInit(rw);
+	init_rwsem(&rw->rwsem);
+}
+
+static inline void au_rw_init_wlock(struct au_rwsem *rw)
+{
+	au_rw_init(rw);
+	down_write(&rw->rwsem);
+	AuDbgWcntInc(rw);
+}
+
+static inline void au_rw_init_wlock_nested(struct au_rwsem *rw,
+					   unsigned int lsc)
+{
+	au_rw_init(rw);
+	down_write_nested(&rw->rwsem, lsc);
+	AuDbgWcntInc(rw);
+}
+
+static inline void au_rw_read_lock(struct au_rwsem *rw)
+{
+	down_read(&rw->rwsem);
+	AuDbgRcntInc(rw);
+}
+
+static inline void au_rw_read_lock_nested(struct au_rwsem *rw, unsigned int lsc)
+{
+	down_read_nested(&rw->rwsem, lsc);
+	AuDbgRcntInc(rw);
+}
+
+static inline void au_rw_read_unlock(struct au_rwsem *rw)
+{
+	AuRwMustReadLock(rw);
+	AuDbgRcntDec(rw);
+	up_read(&rw->rwsem);
+}
+
+static inline void au_rw_dgrade_lock(struct au_rwsem *rw)
+{
+	AuRwMustWriteLock(rw);
+	AuDbgRcntInc(rw);
+	AuDbgWcntDec(rw);
+	downgrade_write(&rw->rwsem);
+}
+
+static inline void au_rw_write_lock(struct au_rwsem *rw)
+{
+	down_write(&rw->rwsem);
+	AuDbgWcntInc(rw);
+}
+
+static inline void au_rw_write_lock_nested(struct au_rwsem *rw,
+					   unsigned int lsc)
+{
+	down_write_nested(&rw->rwsem, lsc);
+	AuDbgWcntInc(rw);
+}
+
+static inline void au_rw_write_unlock(struct au_rwsem *rw)
+{
+	AuRwMustWriteLock(rw);
+	AuDbgWcntDec(rw);
+	up_write(&rw->rwsem);
+}
+
+/* why is not _nested version defined */
+static inline int au_rw_read_trylock(struct au_rwsem *rw)
+{
+	int ret = down_read_trylock(&rw->rwsem);
+	if (ret)
+		AuDbgRcntInc(rw);
+	return ret;
+}
+
+static inline int au_rw_write_trylock(struct au_rwsem *rw)
+{
+	int ret = down_write_trylock(&rw->rwsem);
+	if (ret)
+		AuDbgWcntInc(rw);
+	return ret;
+}
+
+#undef AuDbgCntInit
+#undef AuDbgRcntInc
+#undef AuDbgRcntDec
+#undef AuDbgWcntInc
+#undef AuDbgWcntDec
+
+#define AuSimpleLockRwsemFuncs(prefix, param, rwsem) \
+static inline void prefix##_read_lock(param) \
+{ au_rw_read_lock(rwsem); } \
+static inline void prefix##_write_lock(param) \
+{ au_rw_write_lock(rwsem); } \
+static inline int prefix##_read_trylock(param) \
+{ return au_rw_read_trylock(rwsem); } \
+static inline int prefix##_write_trylock(param) \
+{ return au_rw_write_trylock(rwsem); }
+/* why is not _nested version defined */
+/* static inline void prefix##_read_trylock_nested(param, lsc)
+{ au_rw_read_trylock_nested(rwsem, lsc)); }
+static inline void prefix##_write_trylock_nestd(param, lsc)
+{ au_rw_write_trylock_nested(rwsem, lsc); } */
+
+#define AuSimpleUnlockRwsemFuncs(prefix, param, rwsem) \
+static inline void prefix##_read_unlock(param) \
+{ au_rw_read_unlock(rwsem); } \
+static inline void prefix##_write_unlock(param) \
+{ au_rw_write_unlock(rwsem); } \
+static inline void prefix##_downgrade_lock(param) \
+{ au_rw_dgrade_lock(rwsem); }
+
+#define AuSimpleRwsemFuncs(prefix, param, rwsem) \
+	AuSimpleLockRwsemFuncs(prefix, param, rwsem) \
+	AuSimpleUnlockRwsemFuncs(prefix, param, rwsem)
+
+#endif /* __KERNEL__ */
+#endif /* __AUFS_RWSEM_H__ */
--- linux-rt-2.6.31.orig/ubuntu/aufs/file.c
+++ linux-rt-2.6.31/ubuntu/aufs/file.c
@@ -0,0 +1,578 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * handling file/dir, and address_space operation
+ */
+
+#include <linux/file.h>
+#include <linux/fsnotify.h>
+#include <linux/namei.h>
+#include <linux/pagemap.h>
+#include "aufs.h"
+
+/*
+ * a dirty trick for handling deny_write_access().
+ * because FMODE_EXEC flag is not passed to f_op->open(),
+ * set it to file->private_data temporary.
+ */
+void au_store_oflag(struct nameidata *nd, struct inode *inode)
+{
+	if (nd
+	    /* && !(nd->flags & LOOKUP_CONTINUE) */
+	    && (nd->flags & LOOKUP_OPEN)
+	    && (nd->intent.open.flags & vfsub_fmode_to_uint(FMODE_EXEC))
+	    && inode
+	    && S_ISREG(inode->i_mode)) {
+		/* suppress a warning in lp64 */
+		unsigned long flags = nd->intent.open.flags;
+		nd->intent.open.file->private_data = (void *)flags;
+		/* smp_mb(); */
+	}
+}
+
+/* drop flags for writing */
+unsigned int au_file_roflags(unsigned int flags)
+{
+	flags &= ~(O_WRONLY | O_RDWR | O_APPEND | O_CREAT | O_TRUNC);
+	flags |= O_RDONLY | O_NOATIME;
+	return flags;
+}
+
+/* common functions to regular file and dir */
+struct file *au_h_open(struct dentry *dentry, aufs_bindex_t bindex, int flags,
+		       struct file *file)
+{
+	struct file *h_file;
+	struct dentry *h_dentry;
+	struct inode *h_inode;
+	struct super_block *sb;
+	struct au_branch *br;
+	int err;
+
+	/* a race condition can happen between open and unlink/rmdir */
+	h_file = ERR_PTR(-ENOENT);
+	h_dentry = au_h_dptr(dentry, bindex);
+	if (au_test_nfsd(current) && !h_dentry)
+		goto out;
+	h_inode = h_dentry->d_inode;
+	if (au_test_nfsd(current) && !h_inode)
+		goto out;
+	if (unlikely((!d_unhashed(dentry) && d_unhashed(h_dentry))
+		     || !h_inode))
+		goto out;
+
+	sb = dentry->d_sb;
+	br = au_sbr(sb, bindex);
+	h_file = ERR_PTR(-EACCES);
+	if (file && (file->f_mode & FMODE_EXEC)
+	    && (br->br_mnt->mnt_flags & MNT_NOEXEC))
+		goto out;
+
+	/* drop flags for writing */
+	if (au_test_ro(sb, bindex, dentry->d_inode))
+		flags = au_file_roflags(flags);
+	flags &= ~O_CREAT;
+	atomic_inc(&br->br_count);
+	h_file = dentry_open(dget(h_dentry), mntget(br->br_mnt), flags,
+			     current_cred());
+	if (IS_ERR(h_file))
+		goto out_br;
+
+	if (file && (file->f_mode & FMODE_EXEC)) {
+		h_file->f_mode |= FMODE_EXEC;
+		err = deny_write_access(h_file);
+		if (unlikely(err)) {
+			fput(h_file);
+			h_file = ERR_PTR(err);
+			goto out_br;
+		}
+	}
+	fsnotify_open(h_dentry);
+	goto out; /* success */
+
+ out_br:
+	atomic_dec(&br->br_count);
+ out:
+	return h_file;
+}
+
+int au_do_open(struct file *file, int (*open)(struct file *file, int flags))
+{
+	int err;
+	struct dentry *dentry;
+	struct super_block *sb;
+
+	dentry = file->f_dentry;
+	sb = dentry->d_sb;
+	si_read_lock(sb, AuLock_FLUSH);
+	err = au_finfo_init(file);
+	if (unlikely(err))
+		goto out;
+
+	di_read_lock_child(dentry, AuLock_IR);
+	err = open(file, file->f_flags);
+	di_read_unlock(dentry, AuLock_IR);
+
+	fi_write_unlock(file);
+	if (unlikely(err))
+		au_finfo_fin(file);
+ out:
+	si_read_unlock(sb);
+	return err;
+}
+
+int au_reopen_nondir(struct file *file)
+{
+	int err;
+	aufs_bindex_t bstart, bindex, bend;
+	struct dentry *dentry;
+	struct file *h_file, *h_file_tmp;
+
+	dentry = file->f_dentry;
+	bstart = au_dbstart(dentry);
+	h_file_tmp = NULL;
+	if (au_fbstart(file) == bstart) {
+		h_file = au_h_fptr(file, bstart);
+		if (file->f_mode == h_file->f_mode)
+			return 0; /* success */
+		h_file_tmp = h_file;
+		get_file(h_file_tmp);
+		au_set_h_fptr(file, bstart, NULL);
+	}
+	AuDebugOn(au_fbstart(file) < bstart
+		  || au_fi(file)->fi_hfile[0 + bstart].hf_file);
+
+	h_file = au_h_open(dentry, bstart, file->f_flags & ~O_TRUNC, file);
+	err = PTR_ERR(h_file);
+	if (IS_ERR(h_file))
+		goto out; /* todo: close all? */
+
+	err = 0;
+	au_set_fbstart(file, bstart);
+	au_set_h_fptr(file, bstart, h_file);
+	au_update_figen(file);
+	/* todo: necessary? */
+	/* file->f_ra = h_file->f_ra; */
+
+	/* close lower files */
+	bend = au_fbend(file);
+	for (bindex = bstart + 1; bindex <= bend; bindex++)
+		au_set_h_fptr(file, bindex, NULL);
+	au_set_fbend(file, bstart);
+
+ out:
+	if (h_file_tmp)
+		fput(h_file_tmp);
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+static int au_reopen_wh(struct file *file, aufs_bindex_t btgt,
+			struct dentry *hi_wh)
+{
+	int err;
+	aufs_bindex_t bstart;
+	struct au_dinfo *dinfo;
+	struct dentry *h_dentry;
+
+	dinfo = au_di(file->f_dentry);
+	AuRwMustWriteLock(&dinfo->di_rwsem);
+
+	bstart = dinfo->di_bstart;
+	dinfo->di_bstart = btgt;
+	h_dentry = dinfo->di_hdentry[0 + btgt].hd_dentry;
+	dinfo->di_hdentry[0 + btgt].hd_dentry = hi_wh;
+	err = au_reopen_nondir(file);
+	dinfo->di_hdentry[0 + btgt].hd_dentry = h_dentry;
+	dinfo->di_bstart = bstart;
+
+	return err;
+}
+
+static int au_ready_to_write_wh(struct file *file, loff_t len,
+				aufs_bindex_t bcpup)
+{
+	int err;
+	struct inode *inode;
+	struct dentry *dentry, *hi_wh;
+	struct super_block *sb;
+
+	dentry = file->f_dentry;
+	inode = dentry->d_inode;
+	hi_wh = au_hi_wh(inode, bcpup);
+	if (!hi_wh)
+		err = au_sio_cpup_wh(dentry, bcpup, len, file);
+	else
+		/* already copied-up after unlink */
+		err = au_reopen_wh(file, bcpup, hi_wh);
+
+	sb = dentry->d_sb;
+	if (!err && inode->i_nlink > 1 && au_opt_test(au_mntflags(sb), PLINK))
+		au_plink_append(inode, bcpup, au_h_dptr(dentry, bcpup));
+
+	return err;
+}
+
+/*
+ * prepare the @file for writing.
+ */
+int au_ready_to_write(struct file *file, loff_t len, struct au_pin *pin)
+{
+	int err;
+	aufs_bindex_t bstart, bcpup;
+	struct dentry *dentry, *parent, *h_dentry;
+	struct inode *h_inode, *inode;
+	struct super_block *sb;
+
+	dentry = file->f_dentry;
+	sb = dentry->d_sb;
+	bstart = au_fbstart(file);
+	inode = dentry->d_inode;
+	err = au_test_ro(sb, bstart, inode);
+	if (!err && (au_h_fptr(file, bstart)->f_mode & FMODE_WRITE)) {
+		err = au_pin(pin, dentry, bstart, AuOpt_UDBA_NONE, /*flags*/0);
+		goto out;
+	}
+
+	/* need to cpup */
+	parent = dget_parent(dentry);
+	di_write_lock_parent(parent);
+	err = AuWbrCopyup(au_sbi(sb), dentry);
+	bcpup = err;
+	if (unlikely(err < 0))
+		goto out_dgrade;
+	err = 0;
+
+	if (!au_h_dptr(parent, bcpup)) {
+		err = au_cpup_dirs(dentry, bcpup);
+		if (unlikely(err))
+			goto out_dgrade;
+	}
+
+	err = au_pin(pin, dentry, bcpup, AuOpt_UDBA_NONE,
+		     AuPin_DI_LOCKED | AuPin_MNT_WRITE);
+	if (unlikely(err))
+		goto out_dgrade;
+
+	h_dentry = au_h_fptr(file, bstart)->f_dentry;
+	h_inode = h_dentry->d_inode;
+	mutex_lock_nested(&h_inode->i_mutex, AuLsc_I_CHILD);
+	if (d_unhashed(dentry) /* || d_unhashed(h_dentry) */
+	    /* || !h_inode->i_nlink */) {
+		err = au_ready_to_write_wh(file, len, bcpup);
+		di_downgrade_lock(parent, AuLock_IR);
+	} else {
+		di_downgrade_lock(parent, AuLock_IR);
+		if (!au_h_dptr(dentry, bcpup))
+			err = au_sio_cpup_simple(dentry, bcpup, len,
+						 AuCpup_DTIME);
+		if (!err)
+			err = au_reopen_nondir(file);
+	}
+	mutex_unlock(&h_inode->i_mutex);
+
+	if (!err) {
+		au_pin_set_parent_lflag(pin, /*lflag*/0);
+		goto out_dput; /* success */
+	}
+	au_unpin(pin);
+	goto out_unlock;
+
+ out_dgrade:
+	di_downgrade_lock(parent, AuLock_IR);
+ out_unlock:
+	di_read_unlock(parent, AuLock_IR);
+ out_dput:
+	dput(parent);
+ out:
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+static int au_file_refresh_by_inode(struct file *file, int *need_reopen)
+{
+	int err;
+	aufs_bindex_t bstart;
+	struct au_pin pin;
+	struct au_finfo *finfo;
+	struct dentry *dentry, *parent, *hi_wh;
+	struct inode *inode;
+	struct super_block *sb;
+
+	FiMustWriteLock(file);
+
+	err = 0;
+	finfo = au_fi(file);
+	dentry = file->f_dentry;
+	sb = dentry->d_sb;
+	inode = dentry->d_inode;
+	bstart = au_ibstart(inode);
+	if (bstart == finfo->fi_bstart)
+		goto out;
+
+	parent = dget_parent(dentry);
+	if (au_test_ro(sb, bstart, inode)) {
+		di_read_lock_parent(parent, !AuLock_IR);
+		err = AuWbrCopyup(au_sbi(sb), dentry);
+		bstart = err;
+		di_read_unlock(parent, !AuLock_IR);
+		if (unlikely(err < 0))
+			goto out_parent;
+		err = 0;
+	}
+
+	di_read_lock_parent(parent, AuLock_IR);
+	hi_wh = au_hi_wh(inode, bstart);
+	if (au_opt_test(au_mntflags(sb), PLINK)
+	    && au_plink_test(inode)
+	    && !d_unhashed(dentry)) {
+		err = au_test_and_cpup_dirs(dentry, bstart);
+		if (unlikely(err))
+			goto out_unlock;
+
+		/* always superio. */
+		err = au_pin(&pin, dentry, bstart, AuOpt_UDBA_NONE,
+			     AuPin_DI_LOCKED | AuPin_MNT_WRITE);
+		if (!err)
+			err = au_sio_cpup_simple(dentry, bstart, -1,
+						 AuCpup_DTIME);
+		au_unpin(&pin);
+	} else if (hi_wh) {
+		/* already copied-up after unlink */
+		err = au_reopen_wh(file, bstart, hi_wh);
+		*need_reopen = 0;
+	}
+
+ out_unlock:
+	di_read_unlock(parent, AuLock_IR);
+ out_parent:
+	dput(parent);
+ out:
+	return err;
+}
+
+static void au_do_refresh_file(struct file *file)
+{
+	aufs_bindex_t bindex, bend, new_bindex, brid;
+	struct au_hfile *p, tmp, *q;
+	struct au_finfo *finfo;
+	struct super_block *sb;
+
+	FiMustWriteLock(file);
+
+	sb = file->f_dentry->d_sb;
+	finfo = au_fi(file);
+	p = finfo->fi_hfile + finfo->fi_bstart;
+	brid = p->hf_br->br_id;
+	bend = finfo->fi_bend;
+	for (bindex = finfo->fi_bstart; bindex <= bend; bindex++, p++) {
+		if (!p->hf_file)
+			continue;
+
+		new_bindex = au_br_index(sb, p->hf_br->br_id);
+		if (new_bindex == bindex)
+			continue;
+		if (new_bindex < 0) {
+			au_set_h_fptr(file, bindex, NULL);
+			continue;
+		}
+
+		/* swap two lower inode, and loop again */
+		q = finfo->fi_hfile + new_bindex;
+		tmp = *q;
+		*q = *p;
+		*p = tmp;
+		if (tmp.hf_file) {
+			bindex--;
+			p--;
+		}
+	}
+
+	p = finfo->fi_hfile;
+	if (!au_test_mmapped(file) && !d_unhashed(file->f_dentry)) {
+		bend = au_sbend(sb);
+		for (finfo->fi_bstart = 0; finfo->fi_bstart <= bend;
+		     finfo->fi_bstart++, p++)
+			if (p->hf_file) {
+				if (p->hf_file->f_dentry
+				    && p->hf_file->f_dentry->d_inode)
+					break;
+				else
+					au_hfput(p, file);
+			}
+	} else {
+		bend = au_br_index(sb, brid);
+		for (finfo->fi_bstart = 0; finfo->fi_bstart < bend;
+		     finfo->fi_bstart++, p++)
+			if (p->hf_file)
+				au_hfput(p, file);
+		bend = au_sbend(sb);
+	}
+
+	p = finfo->fi_hfile + bend;
+	for (finfo->fi_bend = bend; finfo->fi_bend >= finfo->fi_bstart;
+	     finfo->fi_bend--, p--)
+		if (p->hf_file) {
+			if (p->hf_file->f_dentry
+			    && p->hf_file->f_dentry->d_inode)
+				break;
+			else
+				au_hfput(p, file);
+		}
+	AuDebugOn(finfo->fi_bend < finfo->fi_bstart);
+}
+
+/*
+ * after branch manipulating, refresh the file.
+ */
+static int refresh_file(struct file *file, int (*reopen)(struct file *file))
+{
+	int err, need_reopen;
+	struct dentry *dentry;
+	aufs_bindex_t bend, bindex;
+
+	dentry = file->f_dentry;
+	err = au_fi_realloc(au_fi(file), au_sbend(dentry->d_sb) + 1);
+	if (unlikely(err))
+		goto out;
+	au_do_refresh_file(file);
+
+	err = 0;
+	need_reopen = 1;
+	if (!au_test_mmapped(file))
+		err = au_file_refresh_by_inode(file, &need_reopen);
+	if (!err && need_reopen && !d_unhashed(dentry))
+		err = reopen(file);
+	if (!err) {
+		au_update_figen(file);
+		return 0; /* success */
+	}
+
+	/* error, close all lower files */
+	bend = au_fbend(file);
+	for (bindex = au_fbstart(file); bindex <= bend; bindex++)
+		au_set_h_fptr(file, bindex, NULL);
+
+ out:
+	return err;
+}
+
+/* common function to regular file and dir */
+int au_reval_and_lock_fdi(struct file *file, int (*reopen)(struct file *file),
+			  int wlock)
+{
+	int err;
+	unsigned int sigen, figen;
+	aufs_bindex_t bstart;
+	unsigned char pseudo_link;
+	struct dentry *dentry;
+
+	err = 0;
+	dentry = file->f_dentry;
+	sigen = au_sigen(dentry->d_sb);
+	fi_write_lock(file);
+	figen = au_figen(file);
+	di_write_lock_child(dentry);
+	bstart = au_dbstart(dentry);
+	pseudo_link = (bstart != au_ibstart(dentry->d_inode));
+	if (sigen == figen && !pseudo_link && au_fbstart(file) == bstart) {
+		if (!wlock) {
+			di_downgrade_lock(dentry, AuLock_IR);
+			fi_downgrade_lock(file);
+		}
+		goto out; /* success */
+	}
+
+	AuDbg("sigen %d, figen %d\n", sigen, figen);
+	if (sigen != au_digen(dentry)
+	    || sigen != au_iigen(dentry->d_inode)) {
+		err = au_reval_dpath(dentry, sigen);
+		if (unlikely(err < 0))
+			goto out;
+		AuDebugOn(au_digen(dentry) != sigen
+			  || au_iigen(dentry->d_inode) != sigen);
+	}
+
+	err = refresh_file(file, reopen);
+	if (!err) {
+		if (!wlock) {
+			di_downgrade_lock(dentry, AuLock_IR);
+			fi_downgrade_lock(file);
+		}
+	} else {
+		di_write_unlock(dentry);
+		fi_write_unlock(file);
+	}
+
+ out:
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+/* cf. aufs_nopage() */
+/* for madvise(2) */
+static int aufs_readpage(struct file *file __maybe_unused, struct page *page)
+{
+	unlock_page(page);
+	return 0;
+}
+
+/* they will never be called. */
+#ifdef CONFIG_AUFS_DEBUG
+static int aufs_write_begin(struct file *file, struct address_space *mapping,
+			    loff_t pos, unsigned len, unsigned flags,
+			    struct page **pagep, void **fsdata)
+{ AuUnsupport(); return 0; }
+static int aufs_write_end(struct file *file, struct address_space *mapping,
+			  loff_t pos, unsigned len, unsigned copied,
+			  struct page *page, void *fsdata)
+{ AuUnsupport(); return 0; }
+static int aufs_writepage(struct page *page, struct writeback_control *wbc)
+{ AuUnsupport(); return 0; }
+static void aufs_sync_page(struct page *page)
+{ AuUnsupport(); }
+
+static int aufs_set_page_dirty(struct page *page)
+{ AuUnsupport(); return 0; }
+static void aufs_invalidatepage(struct page *page, unsigned long offset)
+{ AuUnsupport(); }
+static int aufs_releasepage(struct page *page, gfp_t gfp)
+{ AuUnsupport(); return 0; }
+static ssize_t aufs_direct_IO(int rw, struct kiocb *iocb,
+			      const struct iovec *iov, loff_t offset,
+			      unsigned long nr_segs)
+{ AuUnsupport(); return 0; }
+#endif /* CONFIG_AUFS_DEBUG */
+
+struct address_space_operations aufs_aop = {
+	.readpage	= aufs_readpage,
+#ifdef CONFIG_AUFS_DEBUG
+	.writepage	= aufs_writepage,
+	.sync_page	= aufs_sync_page,
+	.set_page_dirty	= aufs_set_page_dirty,
+	.write_begin	= aufs_write_begin,
+	.write_end	= aufs_write_end,
+	.invalidatepage	= aufs_invalidatepage,
+	.releasepage	= aufs_releasepage,
+	.direct_IO	= aufs_direct_IO,
+#endif /* CONFIG_AUFS_DEBUG */
+};
--- linux-rt-2.6.31.orig/ubuntu/aufs/fstype.h
+++ linux-rt-2.6.31/ubuntu/aufs/fstype.h
@@ -0,0 +1,474 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * judging filesystem type
+ */
+
+#ifndef __AUFS_FSTYPE_H__
+#define __AUFS_FSTYPE_H__
+
+#ifdef __KERNEL__
+
+#include <linux/cramfs_fs.h>
+#include <linux/fs.h>
+#include <linux/magic.h>
+#include <linux/romfs_fs.h>
+#include <linux/aufs_type.h>
+
+static inline int au_test_aufs(struct super_block *sb)
+{
+	return sb->s_magic == AUFS_SUPER_MAGIC;
+}
+
+static inline const char *au_sbtype(struct super_block *sb)
+{
+	return sb->s_type->name;
+}
+
+static inline int au_test_iso9660(struct super_block *sb __maybe_unused)
+{
+#if defined(CONFIG_ROMFS_FS) || defined(CONFIG_ROMFS_FS_MODULE)
+	return sb->s_magic == ROMFS_MAGIC;
+#else
+	return 0;
+#endif
+}
+
+static inline int au_test_romfs(struct super_block *sb __maybe_unused)
+{
+#if defined(CONFIG_ISO9660_FS) || defined(CONFIG_ISO9660_FS_MODULE)
+	return sb->s_magic == ISOFS_SUPER_MAGIC;
+#else
+	return 0;
+#endif
+}
+
+static inline int au_test_cramfs(struct super_block *sb __maybe_unused)
+{
+#if defined(CONFIG_CRAMFS) || defined(CONFIG_CRAMFS_MODULE)
+	return sb->s_magic == CRAMFS_MAGIC;
+#endif
+	return 0;
+}
+
+static inline int au_test_nfs(struct super_block *sb __maybe_unused)
+{
+#if defined(CONFIG_NFS_FS) || defined(CONFIG_NFS_FS_MODULE)
+	return sb->s_magic == NFS_SUPER_MAGIC;
+#else
+	return 0;
+#endif
+}
+
+static inline int au_test_fuse(struct super_block *sb __maybe_unused)
+{
+#if defined(CONFIG_FUSE_FS) || defined(CONFIG_FUSE_FS_MODULE)
+	return sb->s_magic == FUSE_SUPER_MAGIC;
+#else
+	return 0;
+#endif
+}
+
+static inline int au_test_xfs(struct super_block *sb __maybe_unused)
+{
+#if defined(CONFIG_XFS_FS) || defined(CONFIG_XFS_FS_MODULE)
+	return sb->s_magic == XFS_SB_MAGIC;
+#else
+	return 0;
+#endif
+}
+
+static inline int au_test_tmpfs(struct super_block *sb __maybe_unused)
+{
+#ifdef CONFIG_TMPFS
+	return sb->s_magic == TMPFS_MAGIC;
+#else
+	return 0;
+#endif
+}
+
+static inline int au_test_ecryptfs(struct super_block *sb __maybe_unused)
+{
+#if defined(CONFIG_ECRYPT_FS) || defined(CONFIG_ECRYPT_FS_MODULE)
+	return !strcmp(au_sbtype(sb), "ecryptfs");
+#else
+	return 0;
+#endif
+}
+
+static inline int au_test_smbfs(struct super_block *sb __maybe_unused)
+{
+#if defined(CONFIG_SMB_FS) || defined(CONFIG_SMB_FS_MODULE)
+	return sb->s_magic == SMB_SUPER_MAGIC;
+#else
+	return 0;
+#endif
+}
+
+static inline int au_test_ocfs2(struct super_block *sb __maybe_unused)
+{
+#if defined(CONFIG_OCFS2_FS) || defined(CONFIG_OCFS2_FS_MODULE)
+	return sb->s_magic == OCFS2_SUPER_MAGIC;
+#else
+	return 0;
+#endif
+}
+
+static inline int au_test_ocfs2_dlmfs(struct super_block *sb __maybe_unused)
+{
+#if defined(CONFIG_OCFS2_FS_O2CB) || defined(CONFIG_OCFS2_FS_O2CB_MODULE)
+	return sb->s_magic == DLMFS_MAGIC;
+#else
+	return 0;
+#endif
+}
+
+static inline int au_test_coda(struct super_block *sb __maybe_unused)
+{
+#if defined(CONFIG_CODA_FS) || defined(CONFIG_CODA_FS_MODULE)
+	return sb->s_magic == CODA_SUPER_MAGIC;
+#else
+	return 0;
+#endif
+}
+
+static inline int au_test_v9fs(struct super_block *sb __maybe_unused)
+{
+#if defined(CONFIG_9P_FS) || defined(CONFIG_9P_FS_MODULE)
+	return sb->s_magic == V9FS_MAGIC;
+#else
+	return 0;
+#endif
+}
+
+static inline int au_test_ext4(struct super_block *sb __maybe_unused)
+{
+#if defined(CONFIG_EXT4DEV_FS) || defined(CONFIG_EXT4DEV_FS_MODULE)
+	return sb->s_magic == EXT4_SUPER_MAGIC;
+#else
+	return 0;
+#endif
+}
+
+static inline int au_test_sysv(struct super_block *sb __maybe_unused)
+{
+#if defined(CONFIG_SYSV_FS) || defined(CONFIG_SYSV_FS_MODULE)
+	return !strcmp(au_sbtype(sb), "sysv");
+#else
+	return 0;
+#endif
+}
+
+static inline int au_test_ramfs(struct super_block *sb)
+{
+	return sb->s_magic == RAMFS_MAGIC;
+}
+
+static inline int au_test_ubifs(struct super_block *sb __maybe_unused)
+{
+#if defined(CONFIG_UBIFS_FS) || defined(CONFIG_UBIFS_FS_MODULE)
+	return sb->s_magic == UBIFS_SUPER_MAGIC;
+#else
+	return 0;
+#endif
+}
+
+static inline int au_test_procfs(struct super_block *sb __maybe_unused)
+{
+#ifdef CONFIG_PROC_FS
+	return sb->s_magic == PROC_SUPER_MAGIC;
+#else
+	return 0;
+#endif
+}
+
+static inline int au_test_sysfs(struct super_block *sb __maybe_unused)
+{
+#ifdef CONFIG_SYSFS
+	return sb->s_magic == SYSFS_MAGIC;
+#else
+	return 0;
+#endif
+}
+
+static inline int au_test_configfs(struct super_block *sb __maybe_unused)
+{
+#if defined(CONFIG_CONFIGFS_FS) || defined(CONFIG_CONFIGFS_FS_MODULE)
+	return sb->s_magic == CONFIGFS_MAGIC;
+#else
+	return 0;
+#endif
+}
+
+static inline int au_test_minix(struct super_block *sb __maybe_unused)
+{
+#if defined(CONFIG_MINIX_FS) || defined(CONFIG_MINIX_FS_MODULE)
+	return sb->s_magic == MINIX3_SUPER_MAGIC
+		|| sb->s_magic == MINIX2_SUPER_MAGIC
+		|| sb->s_magic == MINIX2_SUPER_MAGIC2
+		|| sb->s_magic == MINIX_SUPER_MAGIC
+		|| sb->s_magic == MINIX_SUPER_MAGIC2;
+#else
+	return 0;
+#endif
+}
+
+static inline int au_test_cifs(struct super_block *sb __maybe_unused)
+{
+#if defined(CONFIG_CIFS_FS) || defined(CONFIGCIFS_FS_MODULE)
+	return sb->s_magic == CIFS_MAGIC_NUMBER;
+#else
+	return 0;
+#endif
+}
+
+static inline int au_test_fat(struct super_block *sb __maybe_unused)
+{
+#if defined(CONFIG_FAT_FS) || defined(CONFIG_FAT_FS_MODULE)
+	return sb->s_magic == MSDOS_SUPER_MAGIC;
+#else
+	return 0;
+#endif
+}
+
+static inline int au_test_msdos(struct super_block *sb)
+{
+	return au_test_fat(sb);
+}
+
+static inline int au_test_vfat(struct super_block *sb)
+{
+	return au_test_fat(sb);
+}
+
+static inline int au_test_securityfs(struct super_block *sb __maybe_unused)
+{
+#ifdef CONFIG_SECURITYFS
+	return sb->s_magic == SECURITYFS_MAGIC;
+#else
+	return 0;
+#endif
+}
+
+static inline int au_test_squashfs(struct super_block *sb __maybe_unused)
+{
+#if defined(CONFIG_SQUASHFS) || defined(CONFIG_SQUASHFS_MODULE)
+	return sb->s_magic == SQUASHFS_MAGIC;
+#else
+	return 0;
+#endif
+}
+
+static inline int au_test_btrfs(struct super_block *sb __maybe_unused)
+{
+#if defined(CONFIG_BTRFS_FS) || defined(CONFIG_BTRFS_FS_MODULE)
+	return sb->s_magic == BTRFS_SUPER_MAGIC;
+#else
+	return 0;
+#endif
+}
+
+static inline int au_test_xenfs(struct super_block *sb __maybe_unused)
+{
+#if defined(CONFIG_XENFS) || defined(CONFIG_XENFS_MODULE)
+	return sb->s_magic == XENFS_SUPER_MAGIC;
+#else
+	return 0;
+#endif
+}
+
+static inline int au_test_debugfs(struct super_block *sb __maybe_unused)
+{
+#ifdef CONFIG_DEBUG_FS
+	return sb->s_magic == DEBUGFS_MAGIC;
+#else
+	return 0;
+#endif
+}
+
+/* ---------------------------------------------------------------------- */
+/*
+ * they can't be an aufs branch.
+ */
+static inline int au_test_fs_unsuppoted(struct super_block *sb)
+{
+	return
+#ifndef CONFIG_AUFS_BR_RAMFS
+		au_test_ramfs(sb) ||
+#endif
+		au_test_procfs(sb)
+		|| au_test_sysfs(sb)
+		|| au_test_configfs(sb)
+		|| au_test_debugfs(sb)
+		|| au_test_securityfs(sb)
+		|| au_test_xenfs(sb)
+		/* || !strcmp(au_sbtype(sb), "unionfs") */
+		|| au_test_aufs(sb); /* will be supported in next version */
+}
+
+/*
+ * If the filesystem supports NFS-export, then it has to support NULL as
+ * a nameidata parameter for ->create(), ->lookup() and ->d_revalidate().
+ * We can apply this principle when we handle a lower filesystem.
+ */
+static inline int au_test_fs_null_nd(struct super_block *sb)
+{
+	return !!sb->s_export_op;
+}
+
+static inline int au_test_fs_remote(struct super_block *sb)
+{
+	return !au_test_tmpfs(sb)
+#ifdef CONFIG_AUFS_BR_RAMFS
+		&& !au_test_ramfs(sb)
+#endif
+		&& !(sb->s_type->fs_flags & FS_REQUIRES_DEV);
+}
+
+/* ---------------------------------------------------------------------- */
+
+/*
+ * Note: these functions (below) are created after reading ->getattr() in all
+ * filesystems under linux/fs. it means we have to do so in every update...
+ */
+
+/*
+ * some filesystems require getattr to refresh the inode attributes before
+ * referencing.
+ * in most cases, we can rely on the inode attribute in NFS (or every remote fs)
+ * and leave the work for d_revalidate()
+ */
+static inline int au_test_fs_refresh_iattr(struct super_block *sb)
+{
+	return au_test_nfs(sb)
+		|| au_test_fuse(sb)
+		/* || au_test_smbfs(sb) */	/* untested */
+		/* || au_test_ocfs2(sb) */	/* untested */
+		/* || au_test_btrfs(sb) */	/* untested */
+		/* || au_test_coda(sb) */	/* untested */
+		/* || au_test_v9fs(sb) */	/* untested */
+		;
+}
+
+/*
+ * filesystems which don't maintain i_size or i_blocks.
+ */
+static inline int au_test_fs_bad_iattr_size(struct super_block *sb)
+{
+	return au_test_xfs(sb)
+		/* || au_test_ext4(sb) */	/* untested */
+		/* || au_test_ocfs2(sb) */	/* untested */
+		/* || au_test_ocfs2_dlmfs(sb) */ /* untested */
+		/* || au_test_sysv(sb) */	/* untested */
+		/* || au_test_ubifs(sb) */	/* untested */
+		/* || au_test_minix(sb) */	/* untested */
+		;
+}
+
+/*
+ * filesystems which don't store the correct value in some of their inode
+ * attributes.
+ */
+static inline int au_test_fs_bad_iattr(struct super_block *sb)
+{
+	return au_test_fs_bad_iattr_size(sb)
+		/* || au_test_cifs(sb) */	/* untested */
+		|| au_test_fat(sb)
+		|| au_test_msdos(sb)
+		|| au_test_vfat(sb);
+}
+
+/* they don't check i_nlink in link(2) */
+static inline int au_test_fs_no_limit_nlink(struct super_block *sb)
+{
+	return au_test_tmpfs(sb)
+#ifdef CONFIG_AUFS_BR_RAMFS
+		|| au_test_ramfs(sb)
+#endif
+		|| au_test_ubifs(sb);
+}
+
+/*
+ * filesystems which sets S_NOATIME and S_NOCMTIME.
+ */
+static inline int au_test_fs_notime(struct super_block *sb)
+{
+	return au_test_nfs(sb)
+		|| au_test_fuse(sb)
+		|| au_test_ubifs(sb)
+		/* || au_test_cifs(sb) */	/* untested */
+		;
+}
+
+/*
+ * filesystems which requires replacing i_mapping.
+ */
+static inline int au_test_fs_bad_mapping(struct super_block *sb)
+{
+	return au_test_fuse(sb)
+		|| au_test_ubifs(sb);
+}
+
+/* temporary support for i#1 in cramfs */
+static inline int au_test_fs_unique_ino(struct inode *inode)
+{
+	if (au_test_cramfs(inode->i_sb))
+		return inode->i_ino != 1;
+	return 1;
+}
+
+/* ---------------------------------------------------------------------- */
+
+/*
+ * the filesystem where the xino files placed must support i/o after unlink and
+ * maintain i_size and i_blocks.
+ */
+static inline int au_test_fs_bad_xino(struct super_block *sb)
+{
+	return au_test_fs_remote(sb)
+		|| au_test_fs_bad_iattr_size(sb)
+#ifdef CONFIG_AUFS_BR_RAMFS
+		|| !(au_test_ramfs(sb) || au_test_fs_null_nd(sb))
+#else
+		|| !au_test_fs_null_nd(sb) /* to keep xino code simple */
+#endif
+		/* don't want unnecessary work for xino */
+		|| au_test_aufs(sb)
+		|| au_test_ecryptfs(sb);
+}
+
+static inline int au_test_fs_trunc_xino(struct super_block *sb)
+{
+	return au_test_tmpfs(sb)
+		|| au_test_ramfs(sb);
+}
+
+/*
+ * test if the @sb is real-readonly.
+ */
+static inline int au_test_fs_rr(struct super_block *sb)
+{
+	return au_test_squashfs(sb)
+		|| au_test_iso9660(sb)
+		|| au_test_cramfs(sb)
+		|| au_test_romfs(sb);
+}
+
+#endif /* __KERNEL__ */
+#endif /* __AUFS_FSTYPE_H__ */
--- linux-rt-2.6.31.orig/ubuntu/aufs/vfsub.h
+++ linux-rt-2.6.31/ubuntu/aufs/vfsub.h
@@ -0,0 +1,172 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * sub-routines for VFS
+ */
+
+#ifndef __AUFS_VFSUB_H__
+#define __AUFS_VFSUB_H__
+
+#ifdef __KERNEL__
+
+#include <linux/fs.h>
+#include <linux/fs_stack.h>
+
+/* ---------------------------------------------------------------------- */
+
+/* lock subclass for lower inode */
+/* default MAX_LOCKDEP_SUBCLASSES(8) is not enough */
+/* reduce? gave up. */
+enum {
+	AuLsc_I_Begin = I_MUTEX_QUOTA, /* 4 */
+	AuLsc_I_PARENT,		/* lower inode, parent first */
+	AuLsc_I_PARENT2,	/* copyup dirs */
+	AuLsc_I_PARENT3,	/* copyup wh */
+	AuLsc_I_CHILD,
+	AuLsc_I_CHILD2,
+	AuLsc_I_End
+};
+
+/* to debug easier, do not make them inlined functions */
+#define MtxMustLock(mtx)	AuDebugOn(!mutex_is_locked(mtx))
+#define IMustLock(i)		MtxMustLock(&(i)->i_mutex)
+
+/* ---------------------------------------------------------------------- */
+
+static inline void vfsub_copy_inode_size(struct inode *inode,
+					 struct inode *h_inode)
+{
+	spin_lock(&inode->i_lock);
+	fsstack_copy_inode_size(inode, h_inode);
+	spin_unlock(&inode->i_lock);
+}
+
+int vfsub_update_h_iattr(struct path *h_path, int *did);
+struct file *vfsub_filp_open(const char *path, int oflags, int mode);
+int vfsub_kern_path(const char *name, unsigned int flags, struct path *path);
+struct dentry *vfsub_lookup_one_len(const char *name, struct dentry *parent,
+				    int len);
+struct dentry *vfsub_lookup_hash(struct nameidata *nd);
+
+/* ---------------------------------------------------------------------- */
+
+struct au_hinode;
+struct dentry *vfsub_lock_rename(struct dentry *d1, struct au_hinode *hdir1,
+				 struct dentry *d2, struct au_hinode *hdir2);
+void vfsub_unlock_rename(struct dentry *d1, struct au_hinode *hdir1,
+			 struct dentry *d2, struct au_hinode *hdir2);
+
+int vfsub_create(struct inode *dir, struct path *path, int mode);
+int vfsub_symlink(struct inode *dir, struct path *path,
+		  const char *symname);
+int vfsub_mknod(struct inode *dir, struct path *path, int mode, dev_t dev);
+int vfsub_link(struct dentry *src_dentry, struct inode *dir,
+	       struct path *path);
+int vfsub_rename(struct inode *src_hdir, struct dentry *src_dentry,
+		 struct inode *hdir, struct path *path);
+int vfsub_mkdir(struct inode *dir, struct path *path, int mode);
+int vfsub_rmdir(struct inode *dir, struct path *path);
+
+/* ---------------------------------------------------------------------- */
+
+ssize_t vfsub_read_u(struct file *file, char __user *ubuf, size_t count,
+		     loff_t *ppos);
+ssize_t vfsub_read_k(struct file *file, void *kbuf, size_t count,
+			loff_t *ppos);
+ssize_t vfsub_write_u(struct file *file, const char __user *ubuf, size_t count,
+		      loff_t *ppos);
+ssize_t vfsub_write_k(struct file *file, void *kbuf, size_t count,
+		      loff_t *ppos);
+int vfsub_readdir(struct file *file, filldir_t filldir, void *arg);
+
+static inline void vfsub_file_accessed(struct file *h_file)
+{
+	file_accessed(h_file);
+	vfsub_update_h_iattr(&h_file->f_path, /*did*/NULL); /*ignore*/
+}
+
+static inline void vfsub_touch_atime(struct vfsmount *h_mnt,
+				     struct dentry *h_dentry)
+{
+	struct path h_path = {
+		.dentry	= h_dentry,
+		.mnt	= h_mnt
+	};
+	touch_atime(h_mnt, h_dentry);
+	vfsub_update_h_iattr(&h_path, /*did*/NULL); /*ignore*/
+}
+
+long vfsub_splice_to(struct file *in, loff_t *ppos,
+		     struct pipe_inode_info *pipe, size_t len,
+		     unsigned int flags);
+long vfsub_splice_from(struct pipe_inode_info *pipe, struct file *out,
+		       loff_t *ppos, size_t len, unsigned int flags);
+int vfsub_trunc(struct path *h_path, loff_t length, unsigned int attr,
+		struct file *h_file);
+
+/* ---------------------------------------------------------------------- */
+
+static inline loff_t vfsub_llseek(struct file *file, loff_t offset, int origin)
+{
+	loff_t err;
+
+	lockdep_off();
+	err = vfs_llseek(file, offset, origin);
+	lockdep_on();
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+/* dirty workaround for strict type of fmode_t */
+union vfsub_fmu {
+	fmode_t fm;
+	unsigned int ui;
+};
+
+static inline unsigned int vfsub_fmode_to_uint(fmode_t fm)
+{
+	union vfsub_fmu u = {
+		.fm = fm
+	};
+
+	BUILD_BUG_ON(sizeof(u.fm) != sizeof(u.ui));
+
+	return u.ui;
+}
+
+static inline fmode_t vfsub_uint_to_fmode(unsigned int ui)
+{
+	union vfsub_fmu u = {
+		.ui = ui
+	};
+
+	return u.fm;
+}
+
+/* ---------------------------------------------------------------------- */
+
+int vfsub_sio_mkdir(struct inode *dir, struct path *path, int mode);
+int vfsub_sio_rmdir(struct inode *dir, struct path *path);
+int vfsub_sio_notify_change(struct path *path, struct iattr *ia);
+int vfsub_notify_change(struct path *path, struct iattr *ia);
+int vfsub_unlink(struct inode *dir, struct path *path, int force);
+
+#endif /* __KERNEL__ */
+#endif /* __AUFS_VFSUB_H__ */
--- linux-rt-2.6.31.orig/ubuntu/aufs/module.h
+++ linux-rt-2.6.31/ubuntu/aufs/module.h
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * module initialization and module-global
+ */
+
+#ifndef __AUFS_MODULE_H__
+#define __AUFS_MODULE_H__
+
+#ifdef __KERNEL__
+
+#include <linux/slab.h>
+
+struct path;
+struct seq_file;
+
+/* module parameters */
+extern short aufs_nwkq;
+extern int sysaufs_brs;
+
+/* ---------------------------------------------------------------------- */
+
+extern int au_dir_roflags;
+
+void *au_kzrealloc(void *p, unsigned int nused, unsigned int new_sz, gfp_t gfp);
+int au_seq_path(struct seq_file *seq, struct path *path);
+
+/* ---------------------------------------------------------------------- */
+
+/* kmem cache */
+enum {
+	AuCache_DINFO,
+	AuCache_ICNTNR,
+	AuCache_FINFO,
+	AuCache_VDIR,
+	AuCache_DEHSTR,
+#ifdef CONFIG_AUFS_HINOTIFY
+	AuCache_HINOTIFY,
+#endif
+	AuCache_Last
+};
+
+#define AuCache(type)	KMEM_CACHE(type, SLAB_RECLAIM_ACCOUNT)
+
+extern struct kmem_cache *au_cachep[];
+
+#define AuCacheFuncs(name, index) \
+static inline void *au_cache_alloc_##name(void) \
+{ return kmem_cache_alloc(au_cachep[AuCache_##index], GFP_NOFS); } \
+static inline void au_cache_free_##name(void *p) \
+{ kmem_cache_free(au_cachep[AuCache_##index], p); }
+
+AuCacheFuncs(dinfo, DINFO);
+AuCacheFuncs(icntnr, ICNTNR);
+AuCacheFuncs(finfo, FINFO);
+AuCacheFuncs(vdir, VDIR);
+AuCacheFuncs(dehstr, DEHSTR);
+
+/*  ---------------------------------------------------------------------- */
+
+#endif /* __KERNEL__ */
+#endif /* __AUFS_MODULE_H__ */
--- linux-rt-2.6.31.orig/ubuntu/aufs/magic.mk
+++ linux-rt-2.6.31/ubuntu/aufs/magic.mk
@@ -0,0 +1,52 @@
+
+# defined in ${srctree}/fs/fuse/inode.c
+# tristate
+ifdef CONFIG_FUSE_FS
+ccflags-y += -DFUSE_SUPER_MAGIC=0x65735546
+endif
+
+# defined in ${srctree}/fs/ocfs2/ocfs2_fs.h
+# tristate
+ifdef CONFIG_OCFS2_FS
+ccflags-y += -DOCFS2_SUPER_MAGIC=0x7461636f
+endif
+
+# defined in ${srctree}/fs/ocfs2/dlm/userdlm.h
+# tristate
+ifdef CONFIG_OCFS2_FS_O2CB
+ccflags-y += -DDLMFS_MAGIC=0x76a9f425
+endif
+
+# defined in ${srctree}/fs/ramfs/inode.c
+# always true
+ccflags-y += -DRAMFS_MAGIC=0x858458f6
+
+# defined in ${srctree}/fs/cifs/cifsfs.c
+# tristate
+ifdef CONFIG_CIFS_FS
+ccflags-y += -DCIFS_MAGIC_NUMBER=0xFF534D42
+endif
+
+# defined in ${srctree}/fs/xfs/xfs_sb.h
+# tristate
+ifdef CONFIG_XFS_FS
+ccflags-y += -DXFS_SB_MAGIC=0x58465342
+endif
+
+# defined in ${srctree}/fs/configfs/mount.c
+# tristate
+ifdef CONFIG_CONFIGFS_FS
+ccflags-y += -DCONFIGFS_MAGIC=0x62656570
+endif
+
+# defined in ${srctree}/fs/9p/v9fs.h
+# tristate
+ifdef CONFIG_9P_FS
+ccflags-y += -DV9FS_MAGIC=0x01021997
+endif
+
+# defined in ${srctree}/fs/ubifs/ubifs.h
+# tristate
+ifdef CONFIG_UBIFS_FS
+ccflags-y += -DUBIFS_SUPER_MAGIC=0x24051905
+endif
--- linux-rt-2.6.31.orig/ubuntu/aufs/debug.h
+++ linux-rt-2.6.31/ubuntu/aufs/debug.h
@@ -0,0 +1,261 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * debug print functions
+ */
+
+#ifndef __AUFS_DEBUG_H__
+#define __AUFS_DEBUG_H__
+
+#ifdef __KERNEL__
+
+#include <asm/system.h>
+#include <linux/bug.h>
+/* #include <linux/err.h> */
+#include <linux/init.h>
+/* #include <linux/kernel.h> */
+#include <linux/delay.h>
+/* #include <linux/kd.h> */
+/* #include <linux/vt_kern.h> */
+#include <linux/sysrq.h>
+#include <linux/aufs_type.h>
+
+#ifdef CONFIG_AUFS_DEBUG
+#define AuDebugOn(a)		BUG_ON(a)
+
+/* module parameter */
+extern int aufs_debug;
+static inline void au_debug(int n)
+{
+	aufs_debug = n;
+	smp_mb();
+}
+
+static inline int au_debug_test(void)
+{
+	return aufs_debug;
+}
+#else
+#define AuDebugOn(a)		do {} while (0)
+#define au_debug()		do {} while (0)
+static inline int au_debug_test(void)
+{
+	return 0;
+}
+#endif /* CONFIG_AUFS_DEBUG */
+
+/* ---------------------------------------------------------------------- */
+
+/* debug print */
+
+#define AuDpri(lvl, fmt, arg...) \
+	printk(lvl AUFS_NAME " %s:%d:%s[%d]: " fmt, \
+	       __func__, __LINE__, current->comm, current->pid, ##arg)
+#define AuDbg(fmt, arg...) do { \
+	if (au_debug_test()) \
+		AuDpri(KERN_DEBUG, "DEBUG: " fmt, ##arg); \
+} while (0)
+#define AuLabel(l) 		AuDbg(#l "\n")
+#define AuInfo(fmt, arg...)	AuDpri(KERN_INFO, fmt, ##arg)
+#define AuWarn(fmt, arg...)	AuDpri(KERN_WARNING, fmt, ##arg)
+#define AuErr(fmt, arg...)	AuDpri(KERN_ERR, fmt, ##arg)
+#define AuIOErr(fmt, arg...)	AuErr("I/O Error, " fmt, ##arg)
+#define AuWarn1(fmt, arg...) do { \
+	static unsigned char _c; \
+	if (!_c++) \
+		AuWarn(fmt, ##arg); \
+} while (0)
+
+#define AuErr1(fmt, arg...) do { \
+	static unsigned char _c; \
+	if (!_c++) \
+		AuErr(fmt, ##arg); \
+} while (0)
+
+#define AuIOErr1(fmt, arg...) do { \
+	static unsigned char _c; \
+	if (!_c++) \
+		AuIOErr(fmt, ##arg); \
+} while (0)
+
+#define AuUnsupportMsg	"This operation is not supported." \
+			" Please report this application to aufs-users ML."
+#define AuUnsupport(fmt, args...) do { \
+	AuErr(AuUnsupportMsg "\n" fmt, ##args); \
+	dump_stack(); \
+} while (0)
+
+#define AuTraceErr(e) do { \
+	if (unlikely((e) < 0)) \
+		AuDbg("err %d\n", (int)(e)); \
+} while (0)
+
+#define AuTraceErrPtr(p) do { \
+	if (IS_ERR(p)) \
+		AuDbg("err %ld\n", PTR_ERR(p)); \
+} while (0)
+
+/* dirty macros for debug print, use with "%.*s" and caution */
+#define AuLNPair(qstr)		(qstr)->len, (qstr)->name
+#define AuDLNPair(d)		AuLNPair(&(d)->d_name)
+
+/* ---------------------------------------------------------------------- */
+
+struct au_sbinfo;
+struct au_finfo;
+struct dentry;
+#ifdef CONFIG_AUFS_DEBUG
+extern char *au_plevel;
+struct au_nhash;
+void au_dpri_whlist(struct au_nhash *whlist);
+struct au_vdir;
+void au_dpri_vdir(struct au_vdir *vdir);
+struct inode;
+void au_dpri_inode(struct inode *inode);
+void au_dpri_dentry(struct dentry *dentry);
+struct file;
+void au_dpri_file(struct file *filp);
+struct super_block;
+void au_dpri_sb(struct super_block *sb);
+
+void au_dbg_sleep_jiffy(int jiffy);
+struct iattr;
+void au_dbg_iattr(struct iattr *ia);
+
+void au_dbg_verify_dir_parent(struct dentry *dentry, unsigned int sigen);
+void au_dbg_verify_nondir_parent(struct dentry *dentry, unsigned int sigen);
+void au_dbg_verify_gen(struct dentry *parent, unsigned int sigen);
+void au_dbg_verify_hf(struct au_finfo *finfo);
+void au_dbg_verify_kthread(void);
+
+int __init au_debug_init(void);
+void au_debug_sbinfo_init(struct au_sbinfo *sbinfo);
+#define AuDbgWhlist(w) do { \
+	AuDbg(#w "\n"); \
+	au_dpri_whlist(w); \
+} while (0)
+
+#define AuDbgVdir(v) do { \
+	AuDbg(#v "\n"); \
+	au_dpri_vdir(v); \
+} while (0)
+
+#define AuDbgInode(i) do { \
+	AuDbg(#i "\n"); \
+	au_dpri_inode(i); \
+} while (0)
+
+#define AuDbgDentry(d) do { \
+	AuDbg(#d "\n"); \
+	au_dpri_dentry(d); \
+} while (0)
+
+#define AuDbgFile(f) do { \
+	AuDbg(#f "\n"); \
+	au_dpri_file(f); \
+} while (0)
+
+#define AuDbgSb(sb) do { \
+	AuDbg(#sb "\n"); \
+	au_dpri_sb(sb); \
+} while (0)
+
+#define AuDbgSleep(sec) do { \
+	AuDbg("sleep %d sec\n", sec); \
+	ssleep(sec); \
+} while (0)
+
+#define AuDbgSleepJiffy(jiffy) do { \
+	AuDbg("sleep %d jiffies\n", jiffy); \
+	au_dbg_sleep_jiffy(jiffy); \
+} while (0)
+
+#define AuDbgIAttr(ia) do { \
+	AuDbg("ia_valid 0x%x\n", (ia)->ia_valid); \
+	au_dbg_iattr(ia); \
+} while (0)
+#else
+static inline void au_dbg_verify_dir_parent(struct dentry *dentry,
+					    unsigned int sigen)
+{
+	/* empty */
+}
+static inline void au_dbg_verify_nondir_parent(struct dentry *dentry,
+					       unsigned int sigen)
+{
+	/* empty */
+}
+static inline void au_dbg_verify_gen(struct dentry *parent, unsigned int sigen)
+{
+	/* empty */
+}
+static inline void au_dbg_verify_hf(struct au_finfo *finfo)
+{
+	/* empty */
+}
+static inline void au_dbg_verify_kthread(void)
+{
+	/* empty */
+}
+
+static inline int au_debug_init(void)
+{
+	return 0;
+}
+static inline void au_debug_sbinfo_init(struct au_sbinfo *sbinfo)
+{
+	/* empty */
+}
+#define AuDbgWhlist(w)		do {} while (0)
+#define AuDbgVdir(v)		do {} while (0)
+#define AuDbgInode(i)		do {} while (0)
+#define AuDbgDentry(d)		do {} while (0)
+#define AuDbgFile(f)		do {} while (0)
+#define AuDbgSb(sb)		do {} while (0)
+#define AuDbgSleep(sec)		do {} while (0)
+#define AuDbgSleepJiffy(jiffy)	do {} while (0)
+#define AuDbgIAttr(ia)		do {} while (0)
+#endif /* CONFIG_AUFS_DEBUG */
+
+/* ---------------------------------------------------------------------- */
+
+#ifdef CONFIG_AUFS_MAGIC_SYSRQ
+int __init au_sysrq_init(void);
+void au_sysrq_fin(void);
+
+#ifdef CONFIG_HW_CONSOLE
+#define au_dbg_blocked() do { \
+	WARN_ON(1); \
+	handle_sysrq('w', vc_cons[fg_console].d->vc_tty); \
+} while (0)
+#else
+#define au_dbg_blocked()	do {} while (0)
+#endif
+
+#else
+static inline int au_sysrq_init(void)
+{
+	return 0;
+}
+#define au_sysrq_fin()		do {} while (0)
+#define au_dbg_blocked()	do {} while (0)
+#endif /* CONFIG_AUFS_MAGIC_SYSRQ */
+
+#endif /* __KERNEL__ */
+#endif /* __AUFS_DEBUG_H__ */
--- linux-rt-2.6.31.orig/ubuntu/aufs/i_op.c
+++ linux-rt-2.6.31/ubuntu/aufs/i_op.c
@@ -0,0 +1,872 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * inode operations (except add/del/rename)
+ */
+
+#include <linux/device_cgroup.h>
+#include <linux/fs_stack.h>
+#include <linux/mm.h>
+#include <linux/namei.h>
+#include <linux/security.h>
+#include <linux/uaccess.h>
+#include "aufs.h"
+
+static int h_permission(struct inode *h_inode, int mask,
+			struct vfsmount *h_mnt, int brperm)
+{
+	int err;
+	const unsigned char write_mask = !!(mask & (MAY_WRITE | MAY_APPEND));
+
+	err = -EACCES;
+	if ((write_mask && IS_IMMUTABLE(h_inode))
+	    || ((mask & MAY_EXEC)
+		&& S_ISREG(h_inode->i_mode)
+		&& ((h_mnt->mnt_flags & MNT_NOEXEC)
+		    || !(h_inode->i_mode & S_IXUGO))))
+		goto out;
+
+	/*
+	 * - skip the lower fs test in the case of write to ro branch.
+	 * - nfs dir permission write check is optimized, but a policy for
+	 *   link/rename requires a real check.
+	 */
+	if ((write_mask && !au_br_writable(brperm))
+	    || (au_test_nfs(h_inode->i_sb) && S_ISDIR(h_inode->i_mode)
+		&& write_mask && !(mask & MAY_READ))
+	    || !h_inode->i_op->permission) {
+		/* AuLabel(generic_permission); */
+		err = generic_permission(h_inode, mask, NULL);
+	} else {
+		/* AuLabel(h_inode->permission); */
+		err = h_inode->i_op->permission(h_inode, mask);
+		AuTraceErr(err);
+	}
+
+	if (!err)
+		err = devcgroup_inode_permission(h_inode, mask);
+	if (!err)
+		err = security_inode_permission
+			(h_inode, mask & (MAY_READ | MAY_WRITE | MAY_EXEC
+					  | MAY_APPEND));
+
+ out:
+	return err;
+}
+
+static int aufs_permission(struct inode *inode, int mask)
+{
+	int err;
+	aufs_bindex_t bindex, bend;
+	const unsigned char isdir = !!S_ISDIR(inode->i_mode);
+	const unsigned char write_mask = !!(mask & (MAY_WRITE | MAY_APPEND));
+	struct inode *h_inode;
+	struct super_block *sb;
+	struct au_branch *br;
+
+	sb = inode->i_sb;
+	si_read_lock(sb, AuLock_FLUSH);
+	ii_read_lock_child(inode);
+
+	if (!isdir || write_mask) {
+		h_inode = au_h_iptr(inode, au_ibstart(inode));
+		AuDebugOn(!h_inode
+			  || ((h_inode->i_mode & S_IFMT)
+			      != (inode->i_mode & S_IFMT)));
+		err = 0;
+		bindex = au_ibstart(inode);
+		br = au_sbr(sb, bindex);
+		err = h_permission(h_inode, mask, br->br_mnt, br->br_perm);
+
+		if (write_mask && !err) {
+			/* test whether the upper writable branch exists */
+			err = -EROFS;
+			for (; bindex >= 0; bindex--)
+				if (!au_br_rdonly(au_sbr(sb, bindex))) {
+					err = 0;
+					break;
+				}
+		}
+		goto out;
+	}
+
+	/* non-write to dir */
+	err = 0;
+	bend = au_ibend(inode);
+	for (bindex = au_ibstart(inode); !err && bindex <= bend; bindex++) {
+		h_inode = au_h_iptr(inode, bindex);
+		if (h_inode) {
+			AuDebugOn(!S_ISDIR(h_inode->i_mode));
+			br = au_sbr(sb, bindex);
+			err = h_permission(h_inode, mask, br->br_mnt,
+					   br->br_perm);
+		}
+	}
+
+ out:
+	ii_read_unlock(inode);
+	si_read_unlock(sb);
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+static struct dentry *aufs_lookup(struct inode *dir, struct dentry *dentry,
+				  struct nameidata *nd)
+{
+	struct dentry *ret, *parent;
+	struct inode *inode, *h_inode;
+	struct mutex *mtx;
+	struct super_block *sb;
+	int err, npositive;
+	aufs_bindex_t bstart;
+
+	/* temporary workaround for a bug in NFSD readdir */
+	if (!au_test_nfsd(current))
+		IMustLock(dir);
+	else
+		WARN_ONCE(!mutex_is_locked(&dir->i_mutex),
+			  "a known problem of NFSD readdir since 2.6.28\n");
+
+	sb = dir->i_sb;
+	si_read_lock(sb, AuLock_FLUSH);
+	err = au_alloc_dinfo(dentry);
+	ret = ERR_PTR(err);
+	if (unlikely(err))
+		goto out;
+
+	parent = dentry->d_parent; /* dir inode is locked */
+	di_read_lock_parent(parent, AuLock_IR);
+	npositive = au_lkup_dentry(dentry, au_dbstart(parent), /*type*/0, nd);
+	di_read_unlock(parent, AuLock_IR);
+	err = npositive;
+	ret = ERR_PTR(err);
+	if (unlikely(err < 0))
+		goto out_unlock;
+
+	inode = NULL;
+	if (npositive) {
+		bstart = au_dbstart(dentry);
+		h_inode = au_h_dptr(dentry, bstart)->d_inode;
+		if (!S_ISDIR(h_inode->i_mode)) {
+			/*
+			 * stop 'race'-ing between hardlinks under different
+			 * parents.
+			 */
+			mtx = &au_sbr(sb, bstart)->br_xino.xi_nondir_mtx;
+			mutex_lock(mtx);
+			inode = au_new_inode(dentry, /*must_new*/0);
+			mutex_unlock(mtx);
+		} else
+			inode = au_new_inode(dentry, /*must_new*/0);
+		ret = (void *)inode;
+	}
+	if (IS_ERR(inode))
+		goto out_unlock;
+
+	ret = d_splice_alias(inode, dentry);
+	if (unlikely(IS_ERR(ret) && inode))
+		ii_write_unlock(inode);
+	au_store_oflag(nd, inode);
+
+ out_unlock:
+	di_write_unlock(dentry);
+ out:
+	si_read_unlock(sb);
+	return ret;
+}
+
+/* ---------------------------------------------------------------------- */
+
+static int au_wr_dir_cpup(struct dentry *dentry, struct dentry *parent,
+			  const unsigned char add_entry, aufs_bindex_t bcpup,
+			  aufs_bindex_t bstart)
+{
+	int err;
+	struct dentry *h_parent;
+	struct inode *h_dir;
+
+	if (add_entry) {
+		au_update_dbstart(dentry);
+		IMustLock(parent->d_inode);
+	} else
+		di_write_lock_parent(parent);
+
+	err = 0;
+	if (!au_h_dptr(parent, bcpup)) {
+		if (bstart < bcpup)
+			err = au_cpdown_dirs(dentry, bcpup);
+		else
+			err = au_cpup_dirs(dentry, bcpup);
+	}
+	if (!err && add_entry) {
+		h_parent = au_h_dptr(parent, bcpup);
+		h_dir = h_parent->d_inode;
+		mutex_lock_nested(&h_dir->i_mutex, AuLsc_I_PARENT);
+		err = au_lkup_neg(dentry, bcpup);
+		/* todo: no unlock here */
+		mutex_unlock(&h_dir->i_mutex);
+		if (bstart < bcpup && au_dbstart(dentry) < 0) {
+			au_set_dbstart(dentry, 0);
+			au_update_dbrange(dentry, /*do_put_zero*/0);
+		}
+	}
+
+	if (!add_entry)
+		di_write_unlock(parent);
+	if (!err)
+		err = bcpup; /* success */
+
+	return err;
+}
+
+/*
+ * decide the branch and the parent dir where we will create a new entry.
+ * returns new bindex or an error.
+ * copyup the parent dir if needed.
+ */
+int au_wr_dir(struct dentry *dentry, struct dentry *src_dentry,
+	      struct au_wr_dir_args *args)
+{
+	int err;
+	aufs_bindex_t bcpup, bstart, src_bstart;
+	const unsigned char add_entry = !!au_ftest_wrdir(args->flags,
+							 ADD_ENTRY);
+	struct super_block *sb;
+	struct dentry *parent;
+	struct au_sbinfo *sbinfo;
+
+	sb = dentry->d_sb;
+	sbinfo = au_sbi(sb);
+	parent = dget_parent(dentry);
+	bstart = au_dbstart(dentry);
+	bcpup = bstart;
+	if (args->force_btgt < 0) {
+		if (src_dentry) {
+			src_bstart = au_dbstart(src_dentry);
+			if (src_bstart < bstart)
+				bcpup = src_bstart;
+		} else if (add_entry) {
+			err = AuWbrCreate(sbinfo, dentry,
+					  au_ftest_wrdir(args->flags, ISDIR));
+			bcpup = err;
+		}
+
+		if (bcpup < 0 || au_test_ro(sb, bcpup, dentry->d_inode)) {
+			if (add_entry)
+				err = AuWbrCopyup(sbinfo, dentry);
+			else {
+				if (!IS_ROOT(dentry)) {
+					di_read_lock_parent(parent, !AuLock_IR);
+					err = AuWbrCopyup(sbinfo, dentry);
+					di_read_unlock(parent, !AuLock_IR);
+				} else
+					err = AuWbrCopyup(sbinfo, dentry);
+			}
+			bcpup = err;
+			if (unlikely(err < 0))
+				goto out;
+		}
+	} else {
+		bcpup = args->force_btgt;
+		AuDebugOn(au_test_ro(sb, bcpup, dentry->d_inode));
+	}
+	AuDbg("bstart %d, bcpup %d\n", bstart, bcpup);
+	if (bstart < bcpup)
+		au_update_dbrange(dentry, /*do_put_zero*/1);
+
+	err = bcpup;
+	if (bcpup == bstart)
+		goto out; /* success */
+
+	/* copyup the new parent into the branch we process */
+	err = au_wr_dir_cpup(dentry, parent, add_entry, bcpup, bstart);
+
+ out:
+	dput(parent);
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+struct dentry *au_pinned_h_parent(struct au_pin *pin)
+{
+	if (pin && pin->parent)
+		return au_h_dptr(pin->parent, pin->bindex);
+	return NULL;
+}
+
+void au_unpin(struct au_pin *p)
+{
+	if (au_ftest_pin(p->flags, MNT_WRITE))
+		mnt_drop_write(p->h_mnt);
+	if (!p->hdir)
+		return;
+
+	au_hin_imtx_unlock(p->hdir);
+	if (!au_ftest_pin(p->flags, DI_LOCKED))
+		di_read_unlock(p->parent, AuLock_IR);
+	iput(p->hdir->hi_inode);
+	dput(p->parent);
+	p->parent = NULL;
+	p->hdir = NULL;
+	p->h_mnt = NULL;
+}
+
+int au_do_pin(struct au_pin *p)
+{
+	int err;
+	struct super_block *sb;
+	struct dentry *h_dentry, *h_parent;
+	struct au_branch *br;
+	struct inode *h_dir;
+
+	err = 0;
+	sb = p->dentry->d_sb;
+	br = au_sbr(sb, p->bindex);
+	if (IS_ROOT(p->dentry)) {
+		if (au_ftest_pin(p->flags, MNT_WRITE)) {
+			p->h_mnt = br->br_mnt;
+			err = mnt_want_write(p->h_mnt);
+			if (unlikely(err)) {
+				au_fclr_pin(p->flags, MNT_WRITE);
+				goto out_err;
+			}
+		}
+		goto out;
+	}
+
+	h_dentry = NULL;
+	if (p->bindex <= au_dbend(p->dentry))
+		h_dentry = au_h_dptr(p->dentry, p->bindex);
+
+	p->parent = dget_parent(p->dentry);
+	if (!au_ftest_pin(p->flags, DI_LOCKED))
+		di_read_lock(p->parent, AuLock_IR, p->lsc_di);
+
+	h_dir = NULL;
+	h_parent = au_h_dptr(p->parent, p->bindex);
+	p->hdir = au_hi(p->parent->d_inode, p->bindex);
+	if (p->hdir)
+		h_dir = p->hdir->hi_inode;
+
+	/* udba case */
+	if (unlikely(!p->hdir || !h_dir)) {
+		if (!au_ftest_pin(p->flags, DI_LOCKED))
+			di_read_unlock(p->parent, AuLock_IR);
+		dput(p->parent);
+		p->parent = NULL;
+		goto out_err;
+	}
+
+	au_igrab(h_dir);
+	au_hin_imtx_lock_nested(p->hdir, p->lsc_hi);
+
+	if (unlikely(p->hdir->hi_inode != h_parent->d_inode)) {
+		err = -EBUSY;
+		goto out_unpin;
+	}
+	if (h_dentry) {
+		err = au_h_verify(h_dentry, p->udba, h_dir, h_parent, br);
+		if (unlikely(err)) {
+			au_fclr_pin(p->flags, MNT_WRITE);
+			goto out_unpin;
+		}
+	}
+
+	if (au_ftest_pin(p->flags, MNT_WRITE)) {
+		p->h_mnt = br->br_mnt;
+		err = mnt_want_write(p->h_mnt);
+		if (unlikely(err)) {
+			au_fclr_pin(p->flags, MNT_WRITE);
+			goto out_unpin;
+		}
+	}
+	goto out; /* success */
+
+ out_unpin:
+	au_unpin(p);
+ out_err:
+	AuErr("err %d\n", err);
+	err = au_busy_or_stale();
+ out:
+	return err;
+}
+
+void au_pin_init(struct au_pin *p, struct dentry *dentry,
+		 aufs_bindex_t bindex, int lsc_di, int lsc_hi,
+		 unsigned int udba, unsigned char flags)
+{
+	p->dentry = dentry;
+	p->udba = udba;
+	p->lsc_di = lsc_di;
+	p->lsc_hi = lsc_hi;
+	p->flags = flags;
+	p->bindex = bindex;
+
+	p->parent = NULL;
+	p->hdir = NULL;
+	p->h_mnt = NULL;
+}
+
+int au_pin(struct au_pin *pin, struct dentry *dentry, aufs_bindex_t bindex,
+	   unsigned int udba, unsigned char flags)
+{
+	au_pin_init(pin, dentry, bindex, AuLsc_DI_PARENT, AuLsc_I_PARENT2,
+		    udba, flags);
+	return au_do_pin(pin);
+}
+
+/* ---------------------------------------------------------------------- */
+
+#define AuIcpup_DID_CPUP	1
+#define au_ftest_icpup(flags, name)	((flags) & AuIcpup_##name)
+#define au_fset_icpup(flags, name)	{ (flags) |= AuIcpup_##name; }
+#define au_fclr_icpup(flags, name)	{ (flags) &= ~AuIcpup_##name; }
+
+struct au_icpup_args {
+	unsigned char flags;
+	unsigned char pin_flags;
+	aufs_bindex_t btgt;
+	struct au_pin pin;
+	struct path h_path;
+	struct inode *h_inode;
+};
+
+static int au_lock_and_icpup(struct dentry *dentry, struct iattr *ia,
+			     struct au_icpup_args *a)
+{
+	int err;
+	unsigned int udba;
+	loff_t sz;
+	aufs_bindex_t bstart;
+	struct dentry *hi_wh, *parent;
+	struct inode *inode;
+	struct au_wr_dir_args wr_dir_args = {
+		.force_btgt	= -1,
+		.flags		= 0
+	};
+
+	di_write_lock_child(dentry);
+	bstart = au_dbstart(dentry);
+	inode = dentry->d_inode;
+	if (S_ISDIR(inode->i_mode))
+		au_fset_wrdir(wr_dir_args.flags, ISDIR);
+	/* plink or hi_wh() case */
+	if (bstart != au_ibstart(inode))
+		wr_dir_args.force_btgt = au_ibstart(inode);
+	err = au_wr_dir(dentry, /*src_dentry*/NULL, &wr_dir_args);
+	if (unlikely(err < 0))
+		goto out_dentry;
+	a->btgt = err;
+	if (err != bstart)
+		au_fset_icpup(a->flags, DID_CPUP);
+
+	err = 0;
+	a->pin_flags = AuPin_MNT_WRITE;
+	parent = NULL;
+	if (!IS_ROOT(dentry)) {
+		au_fset_pin(a->pin_flags, DI_LOCKED);
+		parent = dget_parent(dentry);
+		di_write_lock_parent(parent);
+	}
+
+	udba = au_opt_udba(dentry->d_sb);
+	if (d_unhashed(dentry) || (ia->ia_valid & ATTR_FILE))
+		udba = AuOpt_UDBA_NONE;
+	err = au_pin(&a->pin, dentry, a->btgt, udba, a->pin_flags);
+	if (unlikely(err)) {
+		if (parent) {
+			di_write_unlock(parent);
+			dput(parent);
+		}
+		goto out_dentry;
+	}
+	a->h_path.dentry = au_h_dptr(dentry, bstart);
+	a->h_inode = a->h_path.dentry->d_inode;
+	mutex_lock_nested(&a->h_inode->i_mutex, AuLsc_I_CHILD);
+	sz = -1;
+	if ((ia->ia_valid & ATTR_SIZE) && ia->ia_size < i_size_read(a->h_inode))
+		sz = ia->ia_size;
+
+	hi_wh = NULL;
+	if (au_ftest_icpup(a->flags, DID_CPUP) && d_unhashed(dentry)) {
+		hi_wh = au_hi_wh(inode, a->btgt);
+		if (!hi_wh) {
+			err = au_sio_cpup_wh(dentry, a->btgt, sz, /*file*/NULL);
+			if (unlikely(err))
+				goto out_unlock;
+			hi_wh = au_hi_wh(inode, a->btgt);
+			/* todo: revalidate hi_wh? */
+		}
+	}
+
+	if (parent) {
+		au_pin_set_parent_lflag(&a->pin, /*lflag*/0);
+		di_downgrade_lock(parent, AuLock_IR);
+		dput(parent);
+	}
+	if (!au_ftest_icpup(a->flags, DID_CPUP))
+		goto out; /* success */
+
+	if (!d_unhashed(dentry)) {
+		err = au_sio_cpup_simple(dentry, a->btgt, sz, AuCpup_DTIME);
+		if (!err)
+			a->h_path.dentry = au_h_dptr(dentry, a->btgt);
+	} else if (!hi_wh)
+		a->h_path.dentry = au_h_dptr(dentry, a->btgt);
+	else
+		a->h_path.dentry = hi_wh; /* do not dget here */
+
+ out_unlock:
+	mutex_unlock(&a->h_inode->i_mutex);
+	a->h_inode = a->h_path.dentry->d_inode;
+	if (!err) {
+		mutex_lock_nested(&a->h_inode->i_mutex, AuLsc_I_CHILD);
+		goto out; /* success */
+	}
+
+	au_unpin(&a->pin);
+
+ out_dentry:
+	di_write_unlock(dentry);
+ out:
+	return err;
+}
+
+static int aufs_setattr(struct dentry *dentry, struct iattr *ia)
+{
+	int err;
+	struct inode *inode;
+	struct super_block *sb;
+	struct file *file;
+	struct au_icpup_args *a;
+
+	err = -ENOMEM;
+	a = kzalloc(sizeof(*a), GFP_NOFS);
+	if (unlikely(!a))
+		goto out;
+
+	inode = dentry->d_inode;
+	IMustLock(inode);
+	sb = dentry->d_sb;
+	si_read_lock(sb, AuLock_FLUSH);
+
+	file = NULL;
+	if (ia->ia_valid & ATTR_FILE) {
+		/* currently ftruncate(2) only */
+		file = ia->ia_file;
+		fi_write_lock(file);
+		ia->ia_file = au_h_fptr(file, au_fbstart(file));
+	}
+
+	if (ia->ia_valid & (ATTR_KILL_SUID | ATTR_KILL_SGID))
+		ia->ia_valid &= ~ATTR_MODE;
+
+	err = au_lock_and_icpup(dentry, ia, a);
+	if (unlikely(err < 0))
+		goto out_si;
+	if (au_ftest_icpup(a->flags, DID_CPUP)) {
+		ia->ia_file = NULL;
+		ia->ia_valid &= ~ATTR_FILE;
+	}
+
+	a->h_path.mnt = au_sbr_mnt(sb, a->btgt);
+	if (ia->ia_valid & ATTR_SIZE) {
+		struct file *f;
+
+		if (ia->ia_size < i_size_read(inode)) {
+			/* unmap only */
+			err = vmtruncate(inode, ia->ia_size);
+			if (unlikely(err))
+				goto out_unlock;
+		}
+
+		f = NULL;
+		if (ia->ia_valid & ATTR_FILE)
+			f = ia->ia_file;
+		mutex_unlock(&a->h_inode->i_mutex);
+		err = vfsub_trunc(&a->h_path, ia->ia_size, ia->ia_valid, f);
+		mutex_lock_nested(&a->h_inode->i_mutex, AuLsc_I_CHILD);
+	} else
+		err = vfsub_notify_change(&a->h_path, ia);
+	if (!err)
+		au_cpup_attr_changeable(inode);
+
+ out_unlock:
+	mutex_unlock(&a->h_inode->i_mutex);
+	au_unpin(&a->pin);
+	di_write_unlock(dentry);
+ out_si:
+	if (file) {
+		fi_write_unlock(file);
+		ia->ia_file = file;
+		ia->ia_valid |= ATTR_FILE;
+	}
+	si_read_unlock(sb);
+	kfree(a);
+ out:
+	return err;
+}
+
+static int au_getattr_lock_reval(struct dentry *dentry, unsigned int sigen)
+{
+	int err;
+	struct inode *inode;
+	struct dentry *parent;
+
+	err = 0;
+	inode = dentry->d_inode;
+	di_write_lock_child(dentry);
+	if (au_digen(dentry) != sigen || au_iigen(inode) != sigen) {
+		parent = dget_parent(dentry);
+		di_read_lock_parent(parent, AuLock_IR);
+		/* returns a number of positive dentries */
+		err = au_refresh_hdentry(dentry, inode->i_mode & S_IFMT);
+		if (err > 0)
+			err = au_refresh_hinode(inode, dentry);
+		di_read_unlock(parent, AuLock_IR);
+		dput(parent);
+		if (unlikely(!err))
+			err = -EIO;
+	}
+	di_downgrade_lock(dentry, AuLock_IR);
+	if (unlikely(err))
+		di_read_unlock(dentry, AuLock_IR);
+
+	return err;
+}
+
+static void au_refresh_iattr(struct inode *inode, struct kstat *st,
+			     unsigned int nlink)
+{
+	inode->i_mode = st->mode;
+	inode->i_uid = st->uid;
+	inode->i_gid = st->gid;
+	inode->i_atime = st->atime;
+	inode->i_mtime = st->mtime;
+	inode->i_ctime = st->ctime;
+
+	au_cpup_attr_nlink(inode, /*force*/0);
+	if (S_ISDIR(inode->i_mode)) {
+		inode->i_nlink -= nlink;
+		inode->i_nlink += st->nlink;
+	}
+
+	spin_lock(&inode->i_lock);
+	inode->i_blocks = st->blocks;
+	i_size_write(inode, st->size);
+	spin_unlock(&inode->i_lock);
+}
+
+static int aufs_getattr(struct vfsmount *mnt __maybe_unused,
+			struct dentry *dentry, struct kstat *st)
+{
+	int err;
+	unsigned int mnt_flags;
+	aufs_bindex_t bindex;
+	unsigned char udba_none, positive;
+	struct super_block *sb, *h_sb;
+	struct inode *inode;
+	struct vfsmount *h_mnt;
+	struct dentry *h_dentry;
+
+	err = 0;
+	sb = dentry->d_sb;
+	inode = dentry->d_inode;
+	si_read_lock(sb, AuLock_FLUSH);
+	mnt_flags = au_mntflags(sb);
+	udba_none = !!au_opt_test(mnt_flags, UDBA_NONE);
+
+	/* support fstat(2) */
+	if (!d_unhashed(dentry) && !udba_none) {
+		unsigned int sigen = au_sigen(sb);
+		if (au_digen(dentry) == sigen && au_iigen(inode) == sigen)
+			di_read_lock_child(dentry, AuLock_IR);
+		else {
+			AuDebugOn(!IS_ROOT(dentry));
+			err = au_getattr_lock_reval(dentry, sigen);
+			if (unlikely(err))
+				goto out;
+		}
+	} else
+		di_read_lock_child(dentry, AuLock_IR);
+
+	bindex = au_ibstart(inode);
+	h_mnt = au_sbr_mnt(sb, bindex);
+	h_sb = h_mnt->mnt_sb;
+	if (!au_test_fs_bad_iattr(h_sb) && udba_none)
+		goto out_fill; /* success */
+
+	h_dentry = NULL;
+	if (au_dbstart(dentry) == bindex)
+		h_dentry = dget(au_h_dptr(dentry, bindex));
+	else if (au_opt_test(mnt_flags, PLINK) && au_plink_test(inode)) {
+		h_dentry = au_plink_lkup(inode, bindex);
+		if (IS_ERR(h_dentry))
+			goto out_fill; /* pretending success */
+	}
+	/* illegally overlapped or something */
+	if (unlikely(!h_dentry))
+		goto out_fill; /* pretending success */
+
+	positive = !!h_dentry->d_inode;
+	if (positive)
+		err = vfs_getattr(h_mnt, h_dentry, st);
+	dput(h_dentry);
+	if (!err) {
+		if (positive)
+			au_refresh_iattr(inode, st, h_dentry->d_inode->i_nlink);
+		goto out_fill; /* success */
+	}
+	goto out_unlock;
+
+ out_fill:
+	generic_fillattr(inode, st);
+ out_unlock:
+	di_read_unlock(dentry, AuLock_IR);
+ out:
+	si_read_unlock(sb);
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+static int h_readlink(struct dentry *dentry, int bindex, char __user *buf,
+		      int bufsiz)
+{
+	int err;
+	struct super_block *sb;
+	struct dentry *h_dentry;
+
+	err = -EINVAL;
+	h_dentry = au_h_dptr(dentry, bindex);
+	if (unlikely(/* !h_dentry
+		     || !h_dentry->d_inode
+		     || !h_dentry->d_inode->i_op
+		     || */ !h_dentry->d_inode->i_op->readlink))
+		goto out;
+
+	err = security_inode_readlink(h_dentry);
+	if (unlikely(err))
+		goto out;
+
+	sb = dentry->d_sb;
+	if (!au_test_ro(sb, bindex, dentry->d_inode)) {
+		vfsub_touch_atime(au_sbr_mnt(sb, bindex), h_dentry);
+		fsstack_copy_attr_atime(dentry->d_inode, h_dentry->d_inode);
+	}
+	err = h_dentry->d_inode->i_op->readlink(h_dentry, buf, bufsiz);
+
+ out:
+	return err;
+}
+
+static int aufs_readlink(struct dentry *dentry, char __user *buf, int bufsiz)
+{
+	int err;
+
+	aufs_read_lock(dentry, AuLock_IR);
+	err = h_readlink(dentry, au_dbstart(dentry), buf, bufsiz);
+	aufs_read_unlock(dentry, AuLock_IR);
+
+	return err;
+}
+
+static void *aufs_follow_link(struct dentry *dentry, struct nameidata *nd)
+{
+	int err;
+	char *buf;
+	mm_segment_t old_fs;
+
+	err = -ENOMEM;
+	buf = __getname();
+	if (unlikely(!buf))
+		goto out;
+
+	aufs_read_lock(dentry, AuLock_IR);
+	old_fs = get_fs();
+	set_fs(KERNEL_DS);
+	err = h_readlink(dentry, au_dbstart(dentry), (char __user *)buf,
+			 PATH_MAX);
+	set_fs(old_fs);
+	aufs_read_unlock(dentry, AuLock_IR);
+
+	if (err >= 0) {
+		buf[err] = 0;
+		/* will be freed by put_link */
+		nd_set_link(nd, buf);
+		return NULL; /* success */
+	}
+	__putname(buf);
+
+ out:
+	path_put(&nd->path);
+	AuTraceErr(err);
+	return ERR_PTR(err);
+}
+
+static void aufs_put_link(struct dentry *dentry __maybe_unused,
+			  struct nameidata *nd, void *cookie __maybe_unused)
+{
+	__putname(nd_get_link(nd));
+}
+
+/* ---------------------------------------------------------------------- */
+
+static void aufs_truncate_range(struct inode *inode __maybe_unused,
+				loff_t start __maybe_unused,
+				loff_t end __maybe_unused)
+{
+	AuUnsupport();
+}
+
+/* ---------------------------------------------------------------------- */
+
+struct inode_operations aufs_symlink_iop = {
+	.permission	= aufs_permission,
+	.setattr	= aufs_setattr,
+	.getattr	= aufs_getattr,
+	.readlink	= aufs_readlink,
+	.follow_link	= aufs_follow_link,
+	.put_link	= aufs_put_link
+};
+
+struct inode_operations aufs_dir_iop = {
+	.create		= aufs_create,
+	.lookup		= aufs_lookup,
+	.link		= aufs_link,
+	.unlink		= aufs_unlink,
+	.symlink	= aufs_symlink,
+	.mkdir		= aufs_mkdir,
+	.rmdir		= aufs_rmdir,
+	.mknod		= aufs_mknod,
+	.rename		= aufs_rename,
+
+	.permission	= aufs_permission,
+	.setattr	= aufs_setattr,
+	.getattr	= aufs_getattr
+};
+
+struct inode_operations aufs_iop = {
+	.permission	= aufs_permission,
+	.setattr	= aufs_setattr,
+	.getattr	= aufs_getattr,
+	.truncate_range	= aufs_truncate_range
+};
--- linux-rt-2.6.31.orig/ubuntu/aufs/aufs.h
+++ linux-rt-2.6.31/ubuntu/aufs/aufs.h
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * all header files
+ */
+
+#ifndef __AUFS_H__
+#define __AUFS_H__
+
+#ifdef __KERNEL__
+
+#include "debug.h"
+
+#include "branch.h"
+#include "cpup.h"
+#include "dcsub.h"
+#include "dbgaufs.h"
+#include "dentry.h"
+#include "dir.h"
+#include "file.h"
+#include "fstype.h"
+#include "inode.h"
+#include "loop.h"
+#include "module.h"
+#include "opts.h"
+#include "rwsem.h"
+#include "spl.h"
+#include "super.h"
+#include "sysaufs.h"
+#include "vfsub.h"
+#include "whout.h"
+#include "wkq.h"
+
+#endif /* __KERNEL__ */
+#endif /* __AUFS_H__ */
--- linux-rt-2.6.31.orig/ubuntu/aufs/cpup.h
+++ linux-rt-2.6.31/ubuntu/aufs/cpup.h
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * copy-up/down functions
+ */
+
+#ifndef __AUFS_CPUP_H__
+#define __AUFS_CPUP_H__
+
+#ifdef __KERNEL__
+
+#include <linux/path.h>
+#include <linux/time.h>
+#include <linux/aufs_type.h>
+
+struct inode;
+struct file;
+
+void au_cpup_attr_flags(struct inode *dst, struct inode *src);
+void au_cpup_attr_timesizes(struct inode *inode);
+void au_cpup_attr_nlink(struct inode *inode, int force);
+void au_cpup_attr_changeable(struct inode *inode);
+void au_cpup_igen(struct inode *inode, struct inode *h_inode);
+void au_cpup_attr_all(struct inode *inode, int force);
+
+/* ---------------------------------------------------------------------- */
+
+/* cpup flags */
+#define AuCpup_DTIME	1		/* do dtime_store/revert */
+#define AuCpup_KEEPLINO	(1 << 1)	/* do not clear the lower xino,
+					   for link(2) */
+#define au_ftest_cpup(flags, name)	((flags) & AuCpup_##name)
+#define au_fset_cpup(flags, name)	{ (flags) |= AuCpup_##name; }
+#define au_fclr_cpup(flags, name)	{ (flags) &= ~AuCpup_##name; }
+
+int au_copy_file(struct file *dst, struct file *src, loff_t len);
+int au_sio_cpup_single(struct dentry *dentry, aufs_bindex_t bdst,
+		       aufs_bindex_t bsrc, loff_t len, unsigned int flags,
+		       struct dentry *dst_parent);
+int au_sio_cpup_simple(struct dentry *dentry, aufs_bindex_t bdst, loff_t len,
+		       unsigned int flags);
+int au_sio_cpup_wh(struct dentry *dentry, aufs_bindex_t bdst, loff_t len,
+		   struct file *file);
+
+int au_cp_dirs(struct dentry *dentry, aufs_bindex_t bdst,
+	       int (*cp)(struct dentry *dentry, aufs_bindex_t bdst,
+			 struct dentry *h_parent, void *arg),
+	       void *arg);
+int au_cpup_dirs(struct dentry *dentry, aufs_bindex_t bdst);
+int au_test_and_cpup_dirs(struct dentry *dentry, aufs_bindex_t bdst);
+
+/* ---------------------------------------------------------------------- */
+
+/* keep timestamps when copyup */
+struct au_dtime {
+	struct dentry *dt_dentry;
+	struct path dt_h_path;
+	struct timespec dt_atime, dt_mtime;
+};
+void au_dtime_store(struct au_dtime *dt, struct dentry *dentry,
+		    struct path *h_path);
+void au_dtime_revert(struct au_dtime *dt);
+
+#endif /* __KERNEL__ */
+#endif /* __AUFS_CPUP_H__ */
--- linux-rt-2.6.31.orig/ubuntu/aufs/opts.h
+++ linux-rt-2.6.31/ubuntu/aufs/opts.h
@@ -0,0 +1,196 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * mount options/flags
+ */
+
+#ifndef __AUFS_OPTS_H__
+#define __AUFS_OPTS_H__
+
+#ifdef __KERNEL__
+
+#include <linux/path.h>
+#include <linux/aufs_type.h>
+
+struct file;
+struct super_block;
+
+/* ---------------------------------------------------------------------- */
+
+/* mount flags */
+#define AuOpt_XINO		1		/* external inode number bitmap
+						   and translation table */
+#define AuOpt_TRUNC_XINO	(1 << 1)	/* truncate xino files */
+#define AuOpt_UDBA_NONE		(1 << 2)	/* users direct branch access */
+#define AuOpt_UDBA_REVAL	(1 << 3)
+#define AuOpt_UDBA_HINOTIFY	(1 << 4)
+#define AuOpt_SHWH		(1 << 5)	/* show whiteout */
+#define AuOpt_PLINK		(1 << 6)	/* pseudo-link */
+#define AuOpt_DIRPERM1		(1 << 7)	/* unimplemented */
+#define AuOpt_REFROF		(1 << 8)	/* unimplemented */
+#define AuOpt_ALWAYS_DIROPQ	(1 << 9)	/* policy to creating diropq */
+#define AuOpt_SUM		(1 << 10)	/* summation for statfs(2) */
+#define AuOpt_SUM_W		(1 << 11)	/* unimplemented */
+#define AuOpt_WARN_PERM		(1 << 12)	/* warn when add-branch */
+#define AuOpt_VERBOSE		(1 << 13)	/* busy inode when del-branch */
+
+#ifndef CONFIG_AUFS_HINOTIFY
+#undef AuOpt_UDBA_HINOTIFY
+#define AuOpt_UDBA_HINOTIFY	0
+#endif
+#ifndef CONFIG_AUFS_SHWH
+#undef AuOpt_SHWH
+#define AuOpt_SHWH		0
+#endif
+
+#define AuOpt_Def	(AuOpt_XINO \
+			 | AuOpt_UDBA_REVAL \
+			 | AuOpt_PLINK \
+			 /* | AuOpt_DIRPERM1 */ \
+			 | AuOpt_WARN_PERM)
+#define AuOptMask_UDBA	(AuOpt_UDBA_NONE \
+			 | AuOpt_UDBA_REVAL \
+			 | AuOpt_UDBA_HINOTIFY)
+
+#define au_opt_test(flags, name)	(flags & AuOpt_##name)
+#define au_opt_set(flags, name) do { \
+	BUILD_BUG_ON(AuOpt_##name & AuOptMask_UDBA); \
+	((flags) |= AuOpt_##name); \
+} while (0)
+#define au_opt_set_udba(flags, name) do { \
+	(flags) &= ~AuOptMask_UDBA; \
+	((flags) |= AuOpt_##name); \
+} while (0)
+#define au_opt_clr(flags, name)		{ ((flags) &= ~AuOpt_##name); }
+
+/* ---------------------------------------------------------------------- */
+
+/* policies to select one among multiple writable branches */
+enum {
+	AuWbrCreate_TDP,	/* top down parent */
+	AuWbrCreate_RR,		/* round robin */
+	AuWbrCreate_MFS,	/* most free space */
+	AuWbrCreate_MFSV,	/* mfs with seconds */
+	AuWbrCreate_MFSRR,	/* mfs then rr */
+	AuWbrCreate_MFSRRV,	/* mfs then rr with seconds */
+	AuWbrCreate_PMFS,	/* parent and mfs */
+	AuWbrCreate_PMFSV,	/* parent and mfs with seconds */
+
+	AuWbrCreate_Def = AuWbrCreate_TDP
+};
+
+enum {
+	AuWbrCopyup_TDP,	/* top down parent */
+	AuWbrCopyup_BUP,	/* bottom up parent */
+	AuWbrCopyup_BU,		/* bottom up */
+
+	AuWbrCopyup_Def = AuWbrCopyup_TDP
+};
+
+/* ---------------------------------------------------------------------- */
+
+struct au_opt_add {
+	aufs_bindex_t	bindex;
+	char		*pathname;
+	int		perm;
+	struct path	path;
+};
+
+struct au_opt_del {
+	char		*pathname;
+	struct path	h_path;
+};
+
+struct au_opt_mod {
+	char		*path;
+	int		perm;
+	struct dentry	*h_root;
+};
+
+struct au_opt_xino {
+	char		*path;
+	struct file	*file;
+};
+
+struct au_opt_xino_itrunc {
+	aufs_bindex_t	bindex;
+};
+
+struct au_opt_wbr_create {
+	int			wbr_create;
+	int			mfs_second;
+	unsigned long long	mfsrr_watermark;
+};
+
+struct au_opt {
+	int type;
+	union {
+		struct au_opt_xino	xino;
+		struct au_opt_xino_itrunc xino_itrunc;
+		struct au_opt_add	add;
+		struct au_opt_del	del;
+		struct au_opt_mod	mod;
+		int			dirwh;
+		int			rdcache;
+		unsigned int		rdblk;
+		unsigned int		rdhash;
+		int			udba;
+		struct au_opt_wbr_create wbr_create;
+		int			wbr_copyup;
+	};
+};
+
+/* opts flags */
+#define AuOpts_REMOUNT		1
+#define AuOpts_REFRESH_DIR	(1 << 1)
+#define AuOpts_REFRESH_NONDIR	(1 << 2)
+#define AuOpts_TRUNC_XIB	(1 << 3)
+#define au_ftest_opts(flags, name)	((flags) & AuOpts_##name)
+#define au_fset_opts(flags, name)	{ (flags) |= AuOpts_##name; }
+#define au_fclr_opts(flags, name)	{ (flags) &= ~AuOpts_##name; }
+
+struct au_opts {
+	struct au_opt	*opt;
+	int		max_opt;
+
+	unsigned int	given_udba;
+	unsigned int	flags;
+	unsigned long	sb_flags;
+};
+
+/* ---------------------------------------------------------------------- */
+
+const char *au_optstr_br_perm(int brperm);
+const char *au_optstr_udba(int udba);
+const char *au_optstr_wbr_copyup(int wbr_copyup);
+const char *au_optstr_wbr_create(int wbr_create);
+
+void au_opts_free(struct au_opts *opts);
+int au_opts_parse(struct super_block *sb, char *str, struct au_opts *opts);
+int au_opts_verify(struct super_block *sb, unsigned long sb_flags,
+		   unsigned int pending);
+int au_opts_mount(struct super_block *sb, struct au_opts *opts);
+int au_opts_remount(struct super_block *sb, struct au_opts *opts);
+
+unsigned int au_opt_udba(struct super_block *sb);
+
+/* ---------------------------------------------------------------------- */
+
+#endif /* __KERNEL__ */
+#endif /* __AUFS_OPTS_H__ */
--- linux-rt-2.6.31.orig/ubuntu/aufs/dcsub.c
+++ linux-rt-2.6.31/ubuntu/aufs/dcsub.c
@@ -0,0 +1,223 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * sub-routines for dentry cache
+ */
+
+#include "aufs.h"
+
+static void au_dpage_free(struct au_dpage *dpage)
+{
+	int i;
+	struct dentry **p;
+
+	p = dpage->dentries;
+	for (i = 0; i < dpage->ndentry; i++)
+		dput(*p++);
+	free_page((unsigned long)dpage->dentries);
+}
+
+int au_dpages_init(struct au_dcsub_pages *dpages, gfp_t gfp)
+{
+	int err;
+	void *p;
+
+	err = -ENOMEM;
+	dpages->dpages = kmalloc(sizeof(*dpages->dpages), gfp);
+	if (unlikely(!dpages->dpages))
+		goto out;
+
+	p = (void *)__get_free_page(gfp);
+	if (unlikely(!p))
+		goto out_dpages;
+
+	dpages->dpages[0].ndentry = 0;
+	dpages->dpages[0].dentries = p;
+	dpages->ndpage = 1;
+	return 0; /* success */
+
+ out_dpages:
+	kfree(dpages->dpages);
+ out:
+	return err;
+}
+
+void au_dpages_free(struct au_dcsub_pages *dpages)
+{
+	int i;
+	struct au_dpage *p;
+
+	p = dpages->dpages;
+	for (i = 0; i < dpages->ndpage; i++)
+		au_dpage_free(p++);
+	kfree(dpages->dpages);
+}
+
+static int au_dpages_append(struct au_dcsub_pages *dpages,
+			    struct dentry *dentry, gfp_t gfp)
+{
+	int err, sz;
+	struct au_dpage *dpage;
+	void *p;
+
+	dpage = dpages->dpages + dpages->ndpage - 1;
+	sz = PAGE_SIZE / sizeof(dentry);
+	if (unlikely(dpage->ndentry >= sz)) {
+		AuLabel(new dpage);
+		err = -ENOMEM;
+		sz = dpages->ndpage * sizeof(*dpages->dpages);
+		p = au_kzrealloc(dpages->dpages, sz,
+				 sz + sizeof(*dpages->dpages), gfp);
+		if (unlikely(!p))
+			goto out;
+
+		dpages->dpages = p;
+		dpage = dpages->dpages + dpages->ndpage;
+		p = (void *)__get_free_page(gfp);
+		if (unlikely(!p))
+			goto out;
+
+		dpage->ndentry = 0;
+		dpage->dentries = p;
+		dpages->ndpage++;
+	}
+
+	dpage->dentries[dpage->ndentry++] = dget(dentry);
+	return 0; /* success */
+
+ out:
+	return err;
+}
+
+int au_dcsub_pages(struct au_dcsub_pages *dpages, struct dentry *root,
+		   au_dpages_test test, void *arg)
+{
+	int err;
+	struct dentry *this_parent = root;
+	struct list_head *next;
+	struct super_block *sb = root->d_sb;
+
+	err = 0;
+	spin_lock(&dcache_lock);
+ repeat:
+	next = this_parent->d_subdirs.next;
+ resume:
+	if (this_parent->d_sb == sb
+	    && !IS_ROOT(this_parent)
+	    && atomic_read(&this_parent->d_count)
+	    && this_parent->d_inode
+	    && (!test || test(this_parent, arg))) {
+		err = au_dpages_append(dpages, this_parent, GFP_ATOMIC);
+		if (unlikely(err))
+			goto out;
+	}
+
+	while (next != &this_parent->d_subdirs) {
+		struct list_head *tmp = next;
+		struct dentry *dentry = list_entry(tmp, struct dentry,
+						   d_u.d_child);
+		next = tmp->next;
+		if (/*d_unhashed(dentry) || */!dentry->d_inode)
+			continue;
+		if (!list_empty(&dentry->d_subdirs)) {
+			this_parent = dentry;
+			goto repeat;
+		}
+		if (dentry->d_sb == sb
+		    && atomic_read(&dentry->d_count)
+		    && (!test || test(dentry, arg))) {
+			err = au_dpages_append(dpages, dentry, GFP_ATOMIC);
+			if (unlikely(err))
+				goto out;
+		}
+	}
+
+	if (this_parent != root) {
+		next = this_parent->d_u.d_child.next;
+		this_parent = this_parent->d_parent; /* dcache_lock is locked */
+		goto resume;
+	}
+ out:
+	spin_unlock(&dcache_lock);
+	return err;
+}
+
+int au_dcsub_pages_rev(struct au_dcsub_pages *dpages, struct dentry *dentry,
+		       int do_include, au_dpages_test test, void *arg)
+{
+	int err;
+
+	err = 0;
+	spin_lock(&dcache_lock);
+	if (do_include && (!test || test(dentry, arg))) {
+		err = au_dpages_append(dpages, dentry, GFP_ATOMIC);
+		if (unlikely(err))
+			goto out;
+	}
+	while (!IS_ROOT(dentry)) {
+		dentry = dentry->d_parent; /* dcache_lock is locked */
+		if (!test || test(dentry, arg)) {
+			err = au_dpages_append(dpages, dentry, GFP_ATOMIC);
+			if (unlikely(err))
+				break;
+		}
+	}
+
+ out:
+	spin_unlock(&dcache_lock);
+
+	return err;
+}
+
+struct dentry *au_test_subdir(struct dentry *d1, struct dentry *d2)
+{
+	struct dentry *trap, **dentries;
+	int err, i, j;
+	struct au_dcsub_pages dpages;
+	struct au_dpage *dpage;
+
+	trap = ERR_PTR(-ENOMEM);
+	err = au_dpages_init(&dpages, GFP_NOFS);
+	if (unlikely(err))
+		goto out;
+	err = au_dcsub_pages_rev(&dpages, d1, /*do_include*/1, NULL, NULL);
+	if (unlikely(err))
+		goto out_dpages;
+
+	trap = d1;
+	for (i = 0; !err && i < dpages.ndpage; i++) {
+		dpage = dpages.dpages + i;
+		dentries = dpage->dentries;
+		for (j = 0; !err && j < dpage->ndentry; j++) {
+			struct dentry *d;
+
+			d = dentries[j];
+			err = (d == d2);
+			if (!err)
+				trap = d;
+		}
+	}
+	if (!err)
+		trap = NULL;
+
+ out_dpages:
+	au_dpages_free(&dpages);
+ out:
+	return trap;
+}
--- linux-rt-2.6.31.orig/ubuntu/aufs/wkq.c
+++ linux-rt-2.6.31/ubuntu/aufs/wkq.c
@@ -0,0 +1,259 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * workqueue for asynchronous/super-io operations
+ * todo: try new dredential scheme
+ */
+
+#include <linux/module.h>
+#include "aufs.h"
+
+/* internal workqueue named AUFS_WKQ_NAME */
+static struct au_wkq {
+	struct workqueue_struct	*q;
+
+	/* balancing */
+	atomic_t		busy;
+} *au_wkq;
+
+struct au_wkinfo {
+	struct work_struct wk;
+	struct super_block *sb;
+
+	unsigned int flags; /* see wkq.h */
+
+	au_wkq_func_t func;
+	void *args;
+
+	atomic_t *busyp;
+	struct completion *comp;
+};
+
+/* ---------------------------------------------------------------------- */
+
+static int enqueue(struct au_wkq *wkq, struct au_wkinfo *wkinfo)
+{
+	wkinfo->busyp = &wkq->busy;
+	if (au_ftest_wkq(wkinfo->flags, WAIT))
+		return !queue_work(wkq->q, &wkinfo->wk);
+	else
+		return !schedule_work(&wkinfo->wk);
+}
+
+static void do_wkq(struct au_wkinfo *wkinfo)
+{
+	unsigned int idle, n;
+	int i, idle_idx;
+
+	while (1) {
+		if (au_ftest_wkq(wkinfo->flags, WAIT)) {
+			idle_idx = 0;
+			idle = UINT_MAX;
+			for (i = 0; i < aufs_nwkq; i++) {
+				n = atomic_inc_return(&au_wkq[i].busy);
+				if (n == 1 && !enqueue(au_wkq + i, wkinfo))
+					return; /* success */
+
+				if (n < idle) {
+					idle_idx = i;
+					idle = n;
+				}
+				atomic_dec(&au_wkq[i].busy);
+			}
+		} else
+			idle_idx = aufs_nwkq;
+
+		atomic_inc(&au_wkq[idle_idx].busy);
+		if (!enqueue(au_wkq + idle_idx, wkinfo))
+			return; /* success */
+
+		/* impossible? */
+		AuWarn1("failed to queue_work()\n");
+		yield();
+	}
+}
+
+static void wkq_func(struct work_struct *wk)
+{
+	struct au_wkinfo *wkinfo = container_of(wk, struct au_wkinfo, wk);
+
+	wkinfo->func(wkinfo->args);
+	atomic_dec_return(wkinfo->busyp);
+	if (au_ftest_wkq(wkinfo->flags, WAIT))
+		complete(wkinfo->comp);
+	else {
+		kobject_put(&au_sbi(wkinfo->sb)->si_kobj);
+		module_put(THIS_MODULE);
+		kfree(wkinfo);
+	}
+}
+
+/*
+ * Since struct completion is large, try allocating it dynamically.
+ */
+#if defined(CONFIG_4KSTACKS) || defined(AuTest4KSTACKS)
+#define AuWkqCompDeclare(name)	struct completion *comp = NULL
+
+static int au_wkq_comp_alloc(struct au_wkinfo *wkinfo, struct completion **comp)
+{
+	*comp = kmalloc(sizeof(**comp), GFP_NOFS);
+	if (*comp) {
+		init_completion(*comp);
+		wkinfo->comp = *comp;
+		return 0;
+	}
+	return -ENOMEM;
+}
+
+static void au_wkq_comp_free(struct completion *comp)
+{
+	kfree(comp);
+}
+
+#else
+
+/* no braces */
+#define AuWkqCompDeclare(name) \
+	DECLARE_COMPLETION_ONSTACK(_ ## name); \
+	struct completion *comp = &_ ## name
+
+static int au_wkq_comp_alloc(struct au_wkinfo *wkinfo, struct completion **comp)
+{
+	wkinfo->comp = *comp;
+	return 0;
+}
+
+static void au_wkq_comp_free(struct completion *comp __maybe_unused)
+{
+	/* empty */
+}
+#endif /* 4KSTACKS */
+
+static void au_wkq_run(struct au_wkinfo *wkinfo)
+{
+	au_dbg_verify_kthread();
+	INIT_WORK(&wkinfo->wk, wkq_func);
+	do_wkq(wkinfo);
+}
+
+int au_wkq_wait(au_wkq_func_t func, void *args)
+{
+	int err;
+	AuWkqCompDeclare(comp);
+	struct au_wkinfo wkinfo = {
+		.flags	= AuWkq_WAIT,
+		.func	= func,
+		.args	= args
+	};
+
+	err = au_wkq_comp_alloc(&wkinfo, &comp);
+	if (!err) {
+		au_wkq_run(&wkinfo);
+		/* no timeout, no interrupt */
+		wait_for_completion(wkinfo.comp);
+		au_wkq_comp_free(comp);
+	}
+
+	return err;
+
+}
+
+int au_wkq_nowait(au_wkq_func_t func, void *args, struct super_block *sb)
+{
+	int err;
+	struct au_wkinfo *wkinfo;
+
+	atomic_inc(&au_sbi(sb)->si_nowait.nw_len);
+
+	/*
+	 * wkq_func() must free this wkinfo.
+	 * it highly depends upon the implementation of workqueue.
+	 */
+	err = 0;
+	wkinfo = kmalloc(sizeof(*wkinfo), GFP_NOFS);
+	if (wkinfo) {
+		wkinfo->sb = sb;
+		wkinfo->flags = !AuWkq_WAIT;
+		wkinfo->func = func;
+		wkinfo->args = args;
+		wkinfo->comp = NULL;
+		kobject_get(&au_sbi(sb)->si_kobj);
+		__module_get(THIS_MODULE);
+
+		au_wkq_run(wkinfo);
+	} else {
+		err = -ENOMEM;
+		atomic_dec(&au_sbi(sb)->si_nowait.nw_len);
+	}
+
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+void au_nwt_init(struct au_nowait_tasks *nwt)
+{
+	atomic_set(&nwt->nw_len, 0);
+	/* smp_mb();*/ /* atomic_set */
+	init_waitqueue_head(&nwt->nw_wq);
+}
+
+void au_wkq_fin(void)
+{
+	int i;
+
+	for (i = 0; i < aufs_nwkq; i++)
+		if (au_wkq[i].q && !IS_ERR(au_wkq[i].q))
+			destroy_workqueue(au_wkq[i].q);
+	kfree(au_wkq);
+}
+
+int __init au_wkq_init(void)
+{
+	int err, i;
+	struct au_wkq *nowaitq;
+
+	/* '+1' is for accounting of nowait queue */
+	err = -ENOMEM;
+	au_wkq = kcalloc(aufs_nwkq + 1, sizeof(*au_wkq), GFP_NOFS);
+	if (unlikely(!au_wkq))
+		goto out;
+
+	err = 0;
+	for (i = 0; i < aufs_nwkq; i++) {
+		au_wkq[i].q = create_singlethread_workqueue(AUFS_WKQ_NAME);
+		if (au_wkq[i].q && !IS_ERR(au_wkq[i].q)) {
+			atomic_set(&au_wkq[i].busy, 0);
+			continue;
+		}
+
+		err = PTR_ERR(au_wkq[i].q);
+		au_wkq_fin();
+		goto out;
+	}
+
+	/* nowait accounting */
+	nowaitq = au_wkq + aufs_nwkq;
+	atomic_set(&nowaitq->busy, 0);
+	nowaitq->q = NULL;
+	/* smp_mb(); */ /* atomic_set */
+
+ out:
+	return err;
+}
--- linux-rt-2.6.31.orig/ubuntu/aufs/opts.c
+++ linux-rt-2.6.31/ubuntu/aufs/opts.c
@@ -0,0 +1,1543 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * mount options/flags
+ */
+
+#include <linux/file.h>
+#include <linux/namei.h>
+#include <linux/types.h> /* a distribution requires */
+#include <linux/parser.h>
+#include "aufs.h"
+
+/* ---------------------------------------------------------------------- */
+
+enum {
+	Opt_br,
+	Opt_add, Opt_del, Opt_mod, Opt_reorder, Opt_append, Opt_prepend,
+	Opt_idel, Opt_imod, Opt_ireorder,
+	Opt_dirwh, Opt_rdcache, Opt_rdblk, Opt_rdhash, Opt_rendir,
+	Opt_rdblk_def, Opt_rdhash_def,
+	Opt_xino, Opt_zxino, Opt_noxino,
+	Opt_trunc_xino, Opt_trunc_xino_v, Opt_notrunc_xino,
+	Opt_trunc_xino_path, Opt_itrunc_xino,
+	Opt_trunc_xib, Opt_notrunc_xib,
+	Opt_shwh, Opt_noshwh,
+	Opt_plink, Opt_noplink, Opt_list_plink,
+	Opt_udba,
+	/* Opt_lock, Opt_unlock, */
+	Opt_cmd, Opt_cmd_args,
+	Opt_diropq_a, Opt_diropq_w,
+	Opt_warn_perm, Opt_nowarn_perm,
+	Opt_wbr_copyup, Opt_wbr_create,
+	Opt_refrof, Opt_norefrof,
+	Opt_verbose, Opt_noverbose,
+	Opt_sum, Opt_nosum, Opt_wsum,
+	Opt_tail, Opt_ignore, Opt_ignore_silent, Opt_err
+};
+
+static match_table_t options = {
+	{Opt_br, "br=%s"},
+	{Opt_br, "br:%s"},
+
+	{Opt_add, "add=%d:%s"},
+	{Opt_add, "add:%d:%s"},
+	{Opt_add, "ins=%d:%s"},
+	{Opt_add, "ins:%d:%s"},
+	{Opt_append, "append=%s"},
+	{Opt_append, "append:%s"},
+	{Opt_prepend, "prepend=%s"},
+	{Opt_prepend, "prepend:%s"},
+
+	{Opt_del, "del=%s"},
+	{Opt_del, "del:%s"},
+	/* {Opt_idel, "idel:%d"}, */
+	{Opt_mod, "mod=%s"},
+	{Opt_mod, "mod:%s"},
+	/* {Opt_imod, "imod:%d:%s"}, */
+
+	{Opt_dirwh, "dirwh=%d"},
+
+	{Opt_xino, "xino=%s"},
+	{Opt_noxino, "noxino"},
+	{Opt_trunc_xino, "trunc_xino"},
+	{Opt_trunc_xino_v, "trunc_xino_v=%d:%d"},
+	{Opt_notrunc_xino, "notrunc_xino"},
+	{Opt_trunc_xino_path, "trunc_xino=%s"},
+	{Opt_itrunc_xino, "itrunc_xino=%d"},
+	/* {Opt_zxino, "zxino=%s"}, */
+	{Opt_trunc_xib, "trunc_xib"},
+	{Opt_notrunc_xib, "notrunc_xib"},
+
+	{Opt_plink, "plink"},
+	{Opt_noplink, "noplink"},
+#ifdef CONFIG_AUFS_DEBUG
+	{Opt_list_plink, "list_plink"},
+#endif
+
+	{Opt_udba, "udba=%s"},
+
+	{Opt_diropq_a, "diropq=always"},
+	{Opt_diropq_a, "diropq=a"},
+	{Opt_diropq_w, "diropq=whiteouted"},
+	{Opt_diropq_w, "diropq=w"},
+
+	{Opt_warn_perm, "warn_perm"},
+	{Opt_nowarn_perm, "nowarn_perm"},
+
+	/* keep them temporary */
+	{Opt_ignore_silent, "coo=%s"},
+	{Opt_ignore_silent, "nodlgt"},
+	{Opt_ignore_silent, "nodirperm1"},
+	{Opt_ignore_silent, "clean_plink"},
+
+#ifdef CONFIG_AUFS_SHWH
+	{Opt_shwh, "shwh"},
+#endif
+	{Opt_noshwh, "noshwh"},
+
+	{Opt_rendir, "rendir=%d"},
+
+	{Opt_refrof, "refrof"},
+	{Opt_norefrof, "norefrof"},
+
+	{Opt_verbose, "verbose"},
+	{Opt_verbose, "v"},
+	{Opt_noverbose, "noverbose"},
+	{Opt_noverbose, "quiet"},
+	{Opt_noverbose, "q"},
+	{Opt_noverbose, "silent"},
+
+	{Opt_sum, "sum"},
+	{Opt_nosum, "nosum"},
+	{Opt_wsum, "wsum"},
+
+	{Opt_rdcache, "rdcache=%d"},
+	{Opt_rdblk, "rdblk=%d"},
+	{Opt_rdblk_def, "rdblk=def"},
+	{Opt_rdhash, "rdhash=%d"},
+	{Opt_rdhash_def, "rdhash=def"},
+
+	{Opt_wbr_create, "create=%s"},
+	{Opt_wbr_create, "create_policy=%s"},
+	{Opt_wbr_copyup, "cpup=%s"},
+	{Opt_wbr_copyup, "copyup=%s"},
+	{Opt_wbr_copyup, "copyup_policy=%s"},
+
+	/* internal use for the scripts */
+	{Opt_ignore_silent, "si=%s"},
+
+	{Opt_br, "dirs=%s"},
+	{Opt_ignore, "debug=%d"},
+	{Opt_ignore, "delete=whiteout"},
+	{Opt_ignore, "delete=all"},
+	{Opt_ignore, "imap=%s"},
+
+	{Opt_err, NULL}
+};
+
+/* ---------------------------------------------------------------------- */
+
+static const char *au_parser_pattern(int val, struct match_token *token)
+{
+	while (token->pattern) {
+		if (token->token == val)
+			return token->pattern;
+		token++;
+	}
+	BUG();
+	return "??";
+}
+
+/* ---------------------------------------------------------------------- */
+
+static match_table_t brperms = {
+	{AuBrPerm_RO, AUFS_BRPERM_RO},
+	{AuBrPerm_RR, AUFS_BRPERM_RR},
+	{AuBrPerm_RW, AUFS_BRPERM_RW},
+
+	{AuBrPerm_ROWH, AUFS_BRPERM_ROWH},
+	{AuBrPerm_RRWH, AUFS_BRPERM_RRWH},
+	{AuBrPerm_RWNoLinkWH, AUFS_BRPERM_RWNLWH},
+
+	{AuBrPerm_ROWH, "nfsro"},
+	{AuBrPerm_RO, NULL}
+};
+
+static int br_perm_val(char *perm)
+{
+	int val;
+	substring_t args[MAX_OPT_ARGS];
+
+	val = match_token(perm, brperms, args);
+	return val;
+}
+
+const char *au_optstr_br_perm(int brperm)
+{
+	return au_parser_pattern(brperm, (void *)brperms);
+}
+
+/* ---------------------------------------------------------------------- */
+
+static match_table_t udbalevel = {
+	{AuOpt_UDBA_REVAL, "reval"},
+	{AuOpt_UDBA_NONE, "none"},
+#ifdef CONFIG_AUFS_HINOTIFY
+	{AuOpt_UDBA_HINOTIFY, "inotify"},
+#endif
+	{-1, NULL}
+};
+
+static int udba_val(char *str)
+{
+	substring_t args[MAX_OPT_ARGS];
+
+	return match_token(str, udbalevel, args);
+}
+
+const char *au_optstr_udba(int udba)
+{
+	return au_parser_pattern(udba, (void *)udbalevel);
+}
+
+/* ---------------------------------------------------------------------- */
+
+static match_table_t au_wbr_create_policy = {
+	{AuWbrCreate_TDP, "tdp"},
+	{AuWbrCreate_TDP, "top-down-parent"},
+	{AuWbrCreate_RR, "rr"},
+	{AuWbrCreate_RR, "round-robin"},
+	{AuWbrCreate_MFS, "mfs"},
+	{AuWbrCreate_MFS, "most-free-space"},
+	{AuWbrCreate_MFSV, "mfs:%d"},
+	{AuWbrCreate_MFSV, "most-free-space:%d"},
+
+	{AuWbrCreate_MFSRR, "mfsrr:%d"},
+	{AuWbrCreate_MFSRRV, "mfsrr:%d:%d"},
+	{AuWbrCreate_PMFS, "pmfs"},
+	{AuWbrCreate_PMFSV, "pmfs:%d"},
+
+	{-1, NULL}
+};
+
+/*
+ * cf. linux/lib/parser.c and cmdline.c
+ * gave up calling memparse() since it uses simple_strtoull() instead of
+ * strict_...().
+ */
+static int au_match_ull(substring_t *s, unsigned long long *result)
+{
+	int err;
+	unsigned int len;
+	char a[32];
+
+	err = -ERANGE;
+	len = s->to - s->from;
+	if (len + 1 <= sizeof(a)) {
+		memcpy(a, s->from, len);
+		a[len] = '\0';
+		err = strict_strtoull(a, 0, result);
+	}
+	return err;
+}
+
+static int au_wbr_mfs_wmark(substring_t *arg, char *str,
+			    struct au_opt_wbr_create *create)
+{
+	int err;
+	unsigned long long ull;
+
+	err = 0;
+	if (!au_match_ull(arg, &ull))
+		create->mfsrr_watermark = ull;
+	else {
+		AuErr("bad integer in %s\n", str);
+		err = -EINVAL;
+	}
+
+	return err;
+}
+
+static int au_wbr_mfs_sec(substring_t *arg, char *str,
+			  struct au_opt_wbr_create *create)
+{
+	int n, err;
+
+	err = 0;
+	if (!match_int(arg, &n) && 0 <= n)
+		create->mfs_second = n;
+	else {
+		AuErr("bad integer in %s\n", str);
+		err = -EINVAL;
+	}
+
+	return err;
+}
+
+static int au_wbr_create_val(char *str, struct au_opt_wbr_create *create)
+{
+	int err, e;
+	substring_t args[MAX_OPT_ARGS];
+
+	err = match_token(str, au_wbr_create_policy, args);
+	create->wbr_create = err;
+	switch (err) {
+	case AuWbrCreate_MFSRRV:
+		e = au_wbr_mfs_wmark(&args[0], str, create);
+		if (!e)
+			e = au_wbr_mfs_sec(&args[1], str, create);
+		if (unlikely(e))
+			err = e;
+		break;
+	case AuWbrCreate_MFSRR:
+		e = au_wbr_mfs_wmark(&args[0], str, create);
+		if (unlikely(e)) {
+			err = e;
+			break;
+		}
+		/*FALLTHROUGH*/
+	case AuWbrCreate_MFS:
+	case AuWbrCreate_PMFS:
+		create->mfs_second = AUFS_MFS_SECOND_DEF;
+		break;
+	case AuWbrCreate_MFSV:
+	case AuWbrCreate_PMFSV:
+		e = au_wbr_mfs_sec(&args[0], str, create);
+		if (unlikely(e))
+			err = e;
+		break;
+	}
+
+	return err;
+}
+
+const char *au_optstr_wbr_create(int wbr_create)
+{
+	return au_parser_pattern(wbr_create, (void *)au_wbr_create_policy);
+}
+
+static match_table_t au_wbr_copyup_policy = {
+	{AuWbrCopyup_TDP, "tdp"},
+	{AuWbrCopyup_TDP, "top-down-parent"},
+	{AuWbrCopyup_BUP, "bup"},
+	{AuWbrCopyup_BUP, "bottom-up-parent"},
+	{AuWbrCopyup_BU, "bu"},
+	{AuWbrCopyup_BU, "bottom-up"},
+	{-1, NULL}
+};
+
+static int au_wbr_copyup_val(char *str)
+{
+	substring_t args[MAX_OPT_ARGS];
+
+	return match_token(str, au_wbr_copyup_policy, args);
+}
+
+const char *au_optstr_wbr_copyup(int wbr_copyup)
+{
+	return au_parser_pattern(wbr_copyup, (void *)au_wbr_copyup_policy);
+}
+
+/* ---------------------------------------------------------------------- */
+
+static const int lkup_dirflags = LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
+
+static void dump_opts(struct au_opts *opts)
+{
+#ifdef CONFIG_AUFS_DEBUG
+	/* reduce stack space */
+	union {
+		struct au_opt_add *add;
+		struct au_opt_del *del;
+		struct au_opt_mod *mod;
+		struct au_opt_xino *xino;
+		struct au_opt_xino_itrunc *xino_itrunc;
+		struct au_opt_wbr_create *create;
+	} u;
+	struct au_opt *opt;
+
+	opt = opts->opt;
+	while (opt->type != Opt_tail) {
+		switch (opt->type) {
+		case Opt_add:
+			u.add = &opt->add;
+			AuDbg("add {b%d, %s, 0x%x, %p}\n",
+				  u.add->bindex, u.add->pathname, u.add->perm,
+				  u.add->path.dentry);
+			break;
+		case Opt_del:
+		case Opt_idel:
+			u.del = &opt->del;
+			AuDbg("del {%s, %p}\n",
+			      u.del->pathname, u.del->h_path.dentry);
+			break;
+		case Opt_mod:
+		case Opt_imod:
+			u.mod = &opt->mod;
+			AuDbg("mod {%s, 0x%x, %p}\n",
+				  u.mod->path, u.mod->perm, u.mod->h_root);
+			break;
+		case Opt_append:
+			u.add = &opt->add;
+			AuDbg("append {b%d, %s, 0x%x, %p}\n",
+				  u.add->bindex, u.add->pathname, u.add->perm,
+				  u.add->path.dentry);
+			break;
+		case Opt_prepend:
+			u.add = &opt->add;
+			AuDbg("prepend {b%d, %s, 0x%x, %p}\n",
+				  u.add->bindex, u.add->pathname, u.add->perm,
+				  u.add->path.dentry);
+			break;
+		case Opt_dirwh:
+			AuDbg("dirwh %d\n", opt->dirwh);
+			break;
+		case Opt_rdcache:
+			AuDbg("rdcache %d\n", opt->rdcache);
+			break;
+		case Opt_rdblk:
+			AuDbg("rdblk %u\n", opt->rdblk);
+			break;
+		case Opt_rdblk_def:
+			AuDbg("rdblk_def\n");
+			break;
+		case Opt_rdhash:
+			AuDbg("rdhash %u\n", opt->rdhash);
+			break;
+		case Opt_rdhash_def:
+			AuDbg("rdhash_def\n");
+			break;
+		case Opt_xino:
+			u.xino = &opt->xino;
+			AuDbg("xino {%s %.*s}\n",
+				  u.xino->path,
+				  AuDLNPair(u.xino->file->f_dentry));
+			break;
+		case Opt_trunc_xino:
+			AuLabel(trunc_xino);
+			break;
+		case Opt_notrunc_xino:
+			AuLabel(notrunc_xino);
+			break;
+		case Opt_trunc_xino_path:
+		case Opt_itrunc_xino:
+			u.xino_itrunc = &opt->xino_itrunc;
+			AuDbg("trunc_xino %d\n", u.xino_itrunc->bindex);
+			break;
+
+		case Opt_noxino:
+			AuLabel(noxino);
+			break;
+		case Opt_trunc_xib:
+			AuLabel(trunc_xib);
+			break;
+		case Opt_notrunc_xib:
+			AuLabel(notrunc_xib);
+			break;
+		case Opt_shwh:
+			AuLabel(shwh);
+			break;
+		case Opt_noshwh:
+			AuLabel(noshwh);
+			break;
+		case Opt_plink:
+			AuLabel(plink);
+			break;
+		case Opt_noplink:
+			AuLabel(noplink);
+			break;
+		case Opt_list_plink:
+			AuLabel(list_plink);
+			break;
+		case Opt_udba:
+			AuDbg("udba %d, %s\n",
+				  opt->udba, au_optstr_udba(opt->udba));
+			break;
+		case Opt_diropq_a:
+			AuLabel(diropq_a);
+			break;
+		case Opt_diropq_w:
+			AuLabel(diropq_w);
+			break;
+		case Opt_warn_perm:
+			AuLabel(warn_perm);
+			break;
+		case Opt_nowarn_perm:
+			AuLabel(nowarn_perm);
+			break;
+		case Opt_refrof:
+			AuLabel(refrof);
+			break;
+		case Opt_norefrof:
+			AuLabel(norefrof);
+			break;
+		case Opt_verbose:
+			AuLabel(verbose);
+			break;
+		case Opt_noverbose:
+			AuLabel(noverbose);
+			break;
+		case Opt_sum:
+			AuLabel(sum);
+			break;
+		case Opt_nosum:
+			AuLabel(nosum);
+			break;
+		case Opt_wsum:
+			AuLabel(wsum);
+			break;
+		case Opt_wbr_create:
+			u.create = &opt->wbr_create;
+			AuDbg("create %d, %s\n", u.create->wbr_create,
+				  au_optstr_wbr_create(u.create->wbr_create));
+			switch (u.create->wbr_create) {
+			case AuWbrCreate_MFSV:
+			case AuWbrCreate_PMFSV:
+				AuDbg("%d sec\n", u.create->mfs_second);
+				break;
+			case AuWbrCreate_MFSRR:
+				AuDbg("%llu watermark\n",
+					  u.create->mfsrr_watermark);
+				break;
+			case AuWbrCreate_MFSRRV:
+				AuDbg("%llu watermark, %d sec\n",
+					  u.create->mfsrr_watermark,
+					  u.create->mfs_second);
+				break;
+			}
+			break;
+		case Opt_wbr_copyup:
+			AuDbg("copyup %d, %s\n", opt->wbr_copyup,
+				  au_optstr_wbr_copyup(opt->wbr_copyup));
+			break;
+		default:
+			BUG();
+		}
+		opt++;
+	}
+#endif
+}
+
+void au_opts_free(struct au_opts *opts)
+{
+	struct au_opt *opt;
+
+	opt = opts->opt;
+	while (opt->type != Opt_tail) {
+		switch (opt->type) {
+		case Opt_add:
+		case Opt_append:
+		case Opt_prepend:
+			path_put(&opt->add.path);
+			break;
+		case Opt_del:
+		case Opt_idel:
+			path_put(&opt->del.h_path);
+			break;
+		case Opt_mod:
+		case Opt_imod:
+			dput(opt->mod.h_root);
+			break;
+		case Opt_xino:
+			fput(opt->xino.file);
+			break;
+		}
+		opt++;
+	}
+}
+
+static int opt_add(struct au_opt *opt, char *opt_str, unsigned long sb_flags,
+		   aufs_bindex_t bindex)
+{
+	int err;
+	struct au_opt_add *add = &opt->add;
+	char *p;
+
+	add->bindex = bindex;
+	add->perm = AuBrPerm_Last;
+	add->pathname = opt_str;
+	p = strchr(opt_str, '=');
+	if (p) {
+		*p++ = 0;
+		if (*p)
+			add->perm = br_perm_val(p);
+	}
+
+	err = vfsub_kern_path(add->pathname, lkup_dirflags, &add->path);
+	if (!err) {
+		if (!p) {
+			add->perm = AuBrPerm_RO;
+			if (au_test_fs_rr(add->path.dentry->d_sb))
+				add->perm = AuBrPerm_RR;
+			else if (!bindex && !(sb_flags & MS_RDONLY))
+				add->perm = AuBrPerm_RW;
+		}
+		opt->type = Opt_add;
+		goto out;
+	}
+	AuErr("lookup failed %s (%d)\n", add->pathname, err);
+	err = -EINVAL;
+
+ out:
+	return err;
+}
+
+static int au_opts_parse_del(struct au_opt_del *del, substring_t args[])
+{
+	int err;
+
+	del->pathname = args[0].from;
+	AuDbg("del path %s\n", del->pathname);
+
+	err = vfsub_kern_path(del->pathname, lkup_dirflags, &del->h_path);
+	if (unlikely(err))
+		AuErr("lookup failed %s (%d)\n", del->pathname, err);
+
+	return err;
+}
+
+#if 0 /* reserved for future use */
+static int au_opts_parse_idel(struct super_block *sb, aufs_bindex_t bindex,
+			      struct au_opt_del *del, substring_t args[])
+{
+	int err;
+	struct dentry *root;
+
+	err = -EINVAL;
+	root = sb->s_root;
+	aufs_read_lock(root, AuLock_FLUSH);
+	if (bindex < 0 || au_sbend(sb) < bindex) {
+		AuErr("out of bounds, %d\n", bindex);
+		goto out;
+	}
+
+	err = 0;
+	del->h_path.dentry = dget(au_h_dptr(root, bindex));
+	del->h_path.mnt = mntget(au_sbr_mnt(sb, bindex));
+
+ out:
+	aufs_read_unlock(root, !AuLock_IR);
+	return err;
+}
+#endif
+
+static int au_opts_parse_mod(struct au_opt_mod *mod, substring_t args[])
+{
+	int err;
+	struct path path;
+	char *p;
+
+	err = -EINVAL;
+	mod->path = args[0].from;
+	p = strchr(mod->path, '=');
+	if (unlikely(!p)) {
+		AuErr("no permssion %s\n", args[0].from);
+		goto out;
+	}
+
+	*p++ = 0;
+	err = vfsub_kern_path(mod->path, lkup_dirflags, &path);
+	if (unlikely(err)) {
+		AuErr("lookup failed %s (%d)\n", mod->path, err);
+		goto out;
+	}
+
+	mod->perm = br_perm_val(p);
+	AuDbg("mod path %s, perm 0x%x, %s\n", mod->path, mod->perm, p);
+	mod->h_root = dget(path.dentry);
+	path_put(&path);
+
+ out:
+	return err;
+}
+
+#if 0 /* reserved for future use */
+static int au_opts_parse_imod(struct super_block *sb, aufs_bindex_t bindex,
+			      struct au_opt_mod *mod, substring_t args[])
+{
+	int err;
+	struct dentry *root;
+
+	err = -EINVAL;
+	root = sb->s_root;
+	aufs_read_lock(root, AuLock_FLUSH);
+	if (bindex < 0 || au_sbend(sb) < bindex) {
+		AuErr("out of bounds, %d\n", bindex);
+		goto out;
+	}
+
+	err = 0;
+	mod->perm = br_perm_val(args[1].from);
+	AuDbg("mod path %s, perm 0x%x, %s\n",
+	      mod->path, mod->perm, args[1].from);
+	mod->h_root = dget(au_h_dptr(root, bindex));
+
+ out:
+	aufs_read_unlock(root, !AuLock_IR);
+	return err;
+}
+#endif
+
+static int au_opts_parse_xino(struct super_block *sb, struct au_opt_xino *xino,
+			      substring_t args[])
+{
+	int err;
+	struct file *file;
+
+	file = au_xino_create(sb, args[0].from, /*silent*/0);
+	err = PTR_ERR(file);
+	if (IS_ERR(file))
+		goto out;
+
+	err = -EINVAL;
+	if (unlikely(file->f_dentry->d_sb == sb)) {
+		fput(file);
+		AuErr("%s must be outside\n", args[0].from);
+		goto out;
+	}
+
+	err = 0;
+	xino->file = file;
+	xino->path = args[0].from;
+
+ out:
+	return err;
+}
+
+static
+int au_opts_parse_xino_itrunc_path(struct super_block *sb,
+				   struct au_opt_xino_itrunc *xino_itrunc,
+				   substring_t args[])
+{
+	int err;
+	aufs_bindex_t bend, bindex;
+	struct path path;
+	struct dentry *root;
+
+	err = vfsub_kern_path(args[0].from, lkup_dirflags, &path);
+	if (unlikely(err)) {
+		AuErr("lookup failed %s (%d)\n", args[0].from, err);
+		goto out;
+	}
+
+	xino_itrunc->bindex = -1;
+	root = sb->s_root;
+	aufs_read_lock(root, AuLock_FLUSH);
+	bend = au_sbend(sb);
+	for (bindex = 0; bindex <= bend; bindex++) {
+		if (au_h_dptr(root, bindex) == path.dentry) {
+			xino_itrunc->bindex = bindex;
+			break;
+		}
+	}
+	aufs_read_unlock(root, !AuLock_IR);
+	path_put(&path);
+
+	if (unlikely(xino_itrunc->bindex < 0)) {
+		AuErr("no such branch %s\n", args[0].from);
+		err = -EINVAL;
+	}
+
+ out:
+	return err;
+}
+
+/* called without aufs lock */
+int au_opts_parse(struct super_block *sb, char *str, struct au_opts *opts)
+{
+	int err, n, token;
+	aufs_bindex_t bindex;
+	unsigned char skipped;
+	struct dentry *root;
+	struct au_opt *opt, *opt_tail;
+	char *opt_str;
+	/* reduce the stack space */
+	union {
+		struct au_opt_xino_itrunc *xino_itrunc;
+		struct au_opt_wbr_create *create;
+	} u;
+	struct {
+		substring_t args[MAX_OPT_ARGS];
+	} *a;
+
+	err = -ENOMEM;
+	a = kmalloc(sizeof(*a), GFP_NOFS);
+	if (unlikely(!a))
+		goto out;
+
+	root = sb->s_root;
+	err = 0;
+	bindex = 0;
+	opt = opts->opt;
+	opt_tail = opt + opts->max_opt - 1;
+	opt->type = Opt_tail;
+	while (!err && (opt_str = strsep(&str, ",")) && *opt_str) {
+		err = -EINVAL;
+		skipped = 0;
+		token = match_token(opt_str, options, a->args);
+		switch (token) {
+		case Opt_br:
+			err = 0;
+			while (!err && (opt_str = strsep(&a->args[0].from, ":"))
+			       && *opt_str) {
+				err = opt_add(opt, opt_str, opts->sb_flags,
+					      bindex++);
+				if (unlikely(!err && ++opt > opt_tail)) {
+					err = -E2BIG;
+					break;
+				}
+				opt->type = Opt_tail;
+				skipped = 1;
+			}
+			break;
+		case Opt_add:
+			if (unlikely(match_int(&a->args[0], &n))) {
+				AuErr("bad integer in %s\n", opt_str);
+				break;
+			}
+			bindex = n;
+			err = opt_add(opt, a->args[1].from, opts->sb_flags,
+				      bindex);
+			if (!err)
+				opt->type = token;
+			break;
+		case Opt_append:
+			err = opt_add(opt, a->args[0].from, opts->sb_flags,
+				      /*dummy bindex*/1);
+			if (!err)
+				opt->type = token;
+			break;
+		case Opt_prepend:
+			err = opt_add(opt, a->args[0].from, opts->sb_flags,
+				      /*bindex*/0);
+			if (!err)
+				opt->type = token;
+			break;
+		case Opt_del:
+			err = au_opts_parse_del(&opt->del, a->args);
+			if (!err)
+				opt->type = token;
+			break;
+#if 0 /* reserved for future use */
+		case Opt_idel:
+			del->pathname = "(indexed)";
+			if (unlikely(match_int(&args[0], &n))) {
+				AuErr("bad integer in %s\n", opt_str);
+				break;
+			}
+			err = au_opts_parse_idel(sb, n, &opt->del, a->args);
+			if (!err)
+				opt->type = token;
+			break;
+#endif
+		case Opt_mod:
+			err = au_opts_parse_mod(&opt->mod, a->args);
+			if (!err)
+				opt->type = token;
+			break;
+#ifdef IMOD /* reserved for future use */
+		case Opt_imod:
+			u.mod->path = "(indexed)";
+			if (unlikely(match_int(&a->args[0], &n))) {
+				AuErr("bad integer in %s\n", opt_str);
+				break;
+			}
+			err = au_opts_parse_imod(sb, n, &opt->mod, a->args);
+			if (!err)
+				opt->type = token;
+			break;
+#endif
+		case Opt_xino:
+			err = au_opts_parse_xino(sb, &opt->xino, a->args);
+			if (!err)
+				opt->type = token;
+			break;
+
+		case Opt_trunc_xino_path:
+			err = au_opts_parse_xino_itrunc_path
+				(sb, &opt->xino_itrunc, a->args);
+			if (!err)
+				opt->type = token;
+			break;
+
+		case Opt_itrunc_xino:
+			u.xino_itrunc = &opt->xino_itrunc;
+			if (unlikely(match_int(&a->args[0], &n))) {
+				AuErr("bad integer in %s\n", opt_str);
+				break;
+			}
+			u.xino_itrunc->bindex = n;
+			aufs_read_lock(root, AuLock_FLUSH);
+			if (n < 0 || au_sbend(sb) < n) {
+				AuErr("out of bounds, %d\n", n);
+				aufs_read_unlock(root, !AuLock_IR);
+				break;
+			}
+			aufs_read_unlock(root, !AuLock_IR);
+			err = 0;
+			opt->type = token;
+			break;
+
+		case Opt_dirwh:
+			if (unlikely(match_int(&a->args[0], &opt->dirwh)))
+				break;
+			err = 0;
+			opt->type = token;
+			break;
+
+		case Opt_rdcache:
+			if (unlikely(match_int(&a->args[0], &opt->rdcache)))
+				break;
+			err = 0;
+			opt->type = token;
+			break;
+		case Opt_rdblk:
+			if (unlikely(match_int(&a->args[0], &n)
+				     || n <= 0
+				     || n > KMALLOC_MAX_SIZE)) {
+				AuErr("bad integer in %s\n", opt_str);
+				break;
+			}
+			if (unlikely(n < NAME_MAX)) {
+				AuErr("rdblk must be larger than %d\n",
+				      NAME_MAX);
+				break;
+			}
+			opt->rdblk = n;
+			err = 0;
+			opt->type = token;
+			break;
+		case Opt_rdhash:
+			if (unlikely(match_int(&a->args[0], &n)
+				     || n <= 0
+				     || n * sizeof(struct hlist_head)
+				     > KMALLOC_MAX_SIZE)) {
+				AuErr("bad integer in %s\n", opt_str);
+				break;
+			}
+			opt->rdhash = n;
+			err = 0;
+			opt->type = token;
+			break;
+
+		case Opt_trunc_xino:
+		case Opt_notrunc_xino:
+		case Opt_noxino:
+		case Opt_trunc_xib:
+		case Opt_notrunc_xib:
+		case Opt_shwh:
+		case Opt_noshwh:
+		case Opt_plink:
+		case Opt_noplink:
+		case Opt_list_plink:
+		case Opt_diropq_a:
+		case Opt_diropq_w:
+		case Opt_warn_perm:
+		case Opt_nowarn_perm:
+		case Opt_refrof:
+		case Opt_norefrof:
+		case Opt_verbose:
+		case Opt_noverbose:
+		case Opt_sum:
+		case Opt_nosum:
+		case Opt_wsum:
+		case Opt_rdblk_def:
+		case Opt_rdhash_def:
+			err = 0;
+			opt->type = token;
+			break;
+
+		case Opt_udba:
+			opt->udba = udba_val(a->args[0].from);
+			if (opt->udba >= 0) {
+				err = 0;
+				opt->type = token;
+			} else
+				AuErr("wrong value, %s\n", opt_str);
+			break;
+
+		case Opt_wbr_create:
+			u.create = &opt->wbr_create;
+			u.create->wbr_create
+				= au_wbr_create_val(a->args[0].from, u.create);
+			if (u.create->wbr_create >= 0) {
+				err = 0;
+				opt->type = token;
+			} else
+				AuErr("wrong value, %s\n", opt_str);
+			break;
+		case Opt_wbr_copyup:
+			opt->wbr_copyup = au_wbr_copyup_val(a->args[0].from);
+			if (opt->wbr_copyup >= 0) {
+				err = 0;
+				opt->type = token;
+			} else
+				AuErr("wrong value, %s\n", opt_str);
+			break;
+
+		case Opt_ignore:
+			AuWarn("ignored %s\n", opt_str);
+			/*FALLTHROUGH*/
+		case Opt_ignore_silent:
+			skipped = 1;
+			err = 0;
+			break;
+		case Opt_err:
+			AuErr("unknown option %s\n", opt_str);
+			break;
+		}
+
+		if (!err && !skipped) {
+			if (unlikely(++opt > opt_tail)) {
+				err = -E2BIG;
+				opt--;
+				opt->type = Opt_tail;
+				break;
+			}
+			opt->type = Opt_tail;
+		}
+	}
+
+	kfree(a);
+	dump_opts(opts);
+	if (unlikely(err))
+		au_opts_free(opts);
+
+ out:
+	return err;
+}
+
+static int au_opt_wbr_create(struct super_block *sb,
+			     struct au_opt_wbr_create *create)
+{
+	int err;
+	struct au_sbinfo *sbinfo;
+
+	SiMustWriteLock(sb);
+
+	err = 1; /* handled */
+	sbinfo = au_sbi(sb);
+	if (sbinfo->si_wbr_create_ops->fin) {
+		err = sbinfo->si_wbr_create_ops->fin(sb);
+		if (!err)
+			err = 1;
+	}
+
+	sbinfo->si_wbr_create = create->wbr_create;
+	sbinfo->si_wbr_create_ops = au_wbr_create_ops + create->wbr_create;
+	switch (create->wbr_create) {
+	case AuWbrCreate_MFSRRV:
+	case AuWbrCreate_MFSRR:
+		sbinfo->si_wbr_mfs.mfsrr_watermark = create->mfsrr_watermark;
+		/*FALLTHROUGH*/
+	case AuWbrCreate_MFS:
+	case AuWbrCreate_MFSV:
+	case AuWbrCreate_PMFS:
+	case AuWbrCreate_PMFSV:
+		sbinfo->si_wbr_mfs.mfs_expire = create->mfs_second * HZ;
+		break;
+	}
+
+	if (sbinfo->si_wbr_create_ops->init)
+		sbinfo->si_wbr_create_ops->init(sb); /* ignore */
+
+	return err;
+}
+
+/*
+ * returns,
+ * plus: processed without an error
+ * zero: unprocessed
+ */
+static int au_opt_simple(struct super_block *sb, struct au_opt *opt,
+			 struct au_opts *opts)
+{
+	int err;
+	struct au_sbinfo *sbinfo;
+
+	SiMustWriteLock(sb);
+
+	err = 1; /* handled */
+	sbinfo = au_sbi(sb);
+	switch (opt->type) {
+	case Opt_udba:
+		sbinfo->si_mntflags &= ~AuOptMask_UDBA;
+		sbinfo->si_mntflags |= opt->udba;
+		opts->given_udba |= opt->udba;
+		break;
+
+	case Opt_plink:
+		au_opt_set(sbinfo->si_mntflags, PLINK);
+		break;
+	case Opt_noplink:
+		if (au_opt_test(sbinfo->si_mntflags, PLINK))
+			au_plink_put(sb);
+		au_opt_clr(sbinfo->si_mntflags, PLINK);
+		break;
+	case Opt_list_plink:
+		if (au_opt_test(sbinfo->si_mntflags, PLINK))
+			au_plink_list(sb);
+		break;
+
+	case Opt_diropq_a:
+		au_opt_set(sbinfo->si_mntflags, ALWAYS_DIROPQ);
+		break;
+	case Opt_diropq_w:
+		au_opt_clr(sbinfo->si_mntflags, ALWAYS_DIROPQ);
+		break;
+
+	case Opt_warn_perm:
+		au_opt_set(sbinfo->si_mntflags, WARN_PERM);
+		break;
+	case Opt_nowarn_perm:
+		au_opt_clr(sbinfo->si_mntflags, WARN_PERM);
+		break;
+
+	case Opt_refrof:
+		au_opt_set(sbinfo->si_mntflags, REFROF);
+		break;
+	case Opt_norefrof:
+		au_opt_clr(sbinfo->si_mntflags, REFROF);
+		break;
+
+	case Opt_verbose:
+		au_opt_set(sbinfo->si_mntflags, VERBOSE);
+		break;
+	case Opt_noverbose:
+		au_opt_clr(sbinfo->si_mntflags, VERBOSE);
+		break;
+
+	case Opt_sum:
+		au_opt_set(sbinfo->si_mntflags, SUM);
+		break;
+	case Opt_wsum:
+		au_opt_clr(sbinfo->si_mntflags, SUM);
+		au_opt_set(sbinfo->si_mntflags, SUM_W);
+	case Opt_nosum:
+		au_opt_clr(sbinfo->si_mntflags, SUM);
+		au_opt_clr(sbinfo->si_mntflags, SUM_W);
+		break;
+
+	case Opt_wbr_create:
+		err = au_opt_wbr_create(sb, &opt->wbr_create);
+		break;
+	case Opt_wbr_copyup:
+		sbinfo->si_wbr_copyup = opt->wbr_copyup;
+		sbinfo->si_wbr_copyup_ops = au_wbr_copyup_ops + opt->wbr_copyup;
+		break;
+
+	case Opt_dirwh:
+		sbinfo->si_dirwh = opt->dirwh;
+		break;
+
+	case Opt_rdcache:
+		sbinfo->si_rdcache = opt->rdcache * HZ;
+		break;
+	case Opt_rdblk:
+		sbinfo->si_rdblk = opt->rdblk;
+		break;
+	case Opt_rdblk_def:
+		sbinfo->si_rdblk = AUFS_RDBLK_DEF;
+		break;
+	case Opt_rdhash:
+		sbinfo->si_rdhash = opt->rdhash;
+		break;
+	case Opt_rdhash_def:
+		sbinfo->si_rdhash = AUFS_RDHASH_DEF;
+		break;
+
+	case Opt_shwh:
+		au_opt_set(sbinfo->si_mntflags, SHWH);
+		break;
+	case Opt_noshwh:
+		au_opt_clr(sbinfo->si_mntflags, SHWH);
+		break;
+
+	case Opt_trunc_xino:
+		au_opt_set(sbinfo->si_mntflags, TRUNC_XINO);
+		break;
+	case Opt_notrunc_xino:
+		au_opt_clr(sbinfo->si_mntflags, TRUNC_XINO);
+		break;
+
+	case Opt_trunc_xino_path:
+	case Opt_itrunc_xino:
+		err = au_xino_trunc(sb, opt->xino_itrunc.bindex);
+		if (!err)
+			err = 1;
+		break;
+
+	case Opt_trunc_xib:
+		au_fset_opts(opts->flags, TRUNC_XIB);
+		break;
+	case Opt_notrunc_xib:
+		au_fclr_opts(opts->flags, TRUNC_XIB);
+		break;
+
+	default:
+		err = 0;
+		break;
+	}
+
+	return err;
+}
+
+/*
+ * returns tri-state.
+ * plus: processed without an error
+ * zero: unprocessed
+ * minus: error
+ */
+static int au_opt_br(struct super_block *sb, struct au_opt *opt,
+		     struct au_opts *opts)
+{
+	int err, do_refresh;
+
+	err = 0;
+	switch (opt->type) {
+	case Opt_append:
+		opt->add.bindex = au_sbend(sb) + 1;
+		if (opt->add.bindex < 0)
+			opt->add.bindex = 0;
+		goto add;
+	case Opt_prepend:
+		opt->add.bindex = 0;
+	add:
+	case Opt_add:
+		err = au_br_add(sb, &opt->add,
+				au_ftest_opts(opts->flags, REMOUNT));
+		if (!err) {
+			err = 1;
+			au_fset_opts(opts->flags, REFRESH_DIR);
+			if (au_br_whable(opt->add.perm))
+				au_fset_opts(opts->flags, REFRESH_NONDIR);
+		}
+		break;
+
+	case Opt_del:
+	case Opt_idel:
+		err = au_br_del(sb, &opt->del,
+				au_ftest_opts(opts->flags, REMOUNT));
+		if (!err) {
+			err = 1;
+			au_fset_opts(opts->flags, TRUNC_XIB);
+			au_fset_opts(opts->flags, REFRESH_DIR);
+			au_fset_opts(opts->flags, REFRESH_NONDIR);
+		}
+		break;
+
+	case Opt_mod:
+	case Opt_imod:
+		err = au_br_mod(sb, &opt->mod,
+				au_ftest_opts(opts->flags, REMOUNT),
+				&do_refresh);
+		if (!err) {
+			err = 1;
+			if (do_refresh) {
+				au_fset_opts(opts->flags, REFRESH_DIR);
+				au_fset_opts(opts->flags, REFRESH_NONDIR);
+			}
+		}
+		break;
+	}
+
+	return err;
+}
+
+static int au_opt_xino(struct super_block *sb, struct au_opt *opt,
+		       struct au_opt_xino **opt_xino,
+		       struct au_opts *opts)
+{
+	int err;
+	aufs_bindex_t bend, bindex;
+	struct dentry *root, *parent, *h_root;
+
+	err = 0;
+	switch (opt->type) {
+	case Opt_xino:
+		err = au_xino_set(sb, &opt->xino,
+				  !!au_ftest_opts(opts->flags, REMOUNT));
+		if (unlikely(err))
+			break;
+
+		*opt_xino = &opt->xino;
+		au_xino_brid_set(sb, -1);
+
+		/* safe d_parent access */
+		parent = opt->xino.file->f_dentry->d_parent;
+		root = sb->s_root;
+		bend = au_sbend(sb);
+		for (bindex = 0; bindex <= bend; bindex++) {
+			h_root = au_h_dptr(root, bindex);
+			if (h_root == parent) {
+				au_xino_brid_set(sb, au_sbr_id(sb, bindex));
+				break;
+			}
+		}
+		break;
+
+	case Opt_noxino:
+		au_xino_clr(sb);
+		au_xino_brid_set(sb, -1);
+		*opt_xino = (void *)-1;
+		break;
+	}
+
+	return err;
+}
+
+int au_opts_verify(struct super_block *sb, unsigned long sb_flags,
+		   unsigned int pending)
+{
+	int err;
+	aufs_bindex_t bindex, bend;
+	unsigned char do_plink, skip, do_free;
+	struct au_branch *br;
+	struct au_wbr *wbr;
+	struct dentry *root;
+	struct inode *dir, *h_dir;
+	struct au_sbinfo *sbinfo;
+	struct au_hinode *hdir;
+
+	SiMustAnyLock(sb);
+
+	sbinfo = au_sbi(sb);
+	AuDebugOn(!(sbinfo->si_mntflags & AuOptMask_UDBA));
+
+	if (!(sb_flags & MS_RDONLY)) {
+		if (unlikely(!au_br_writable(au_sbr_perm(sb, 0))))
+			AuWarn("first branch should be rw\n");
+		if (unlikely(au_opt_test(sbinfo->si_mntflags, SHWH)))
+			AuWarn("shwh should be used with ro\n");
+	}
+
+	if (au_opt_test((sbinfo->si_mntflags | pending), UDBA_HINOTIFY)
+	    && !au_opt_test(sbinfo->si_mntflags, XINO))
+		AuWarn("udba=inotify requires xino\n");
+
+	err = 0;
+	root = sb->s_root;
+	dir = sb->s_root->d_inode;
+	do_plink = !!au_opt_test(sbinfo->si_mntflags, PLINK);
+	bend = au_sbend(sb);
+	for (bindex = 0; !err && bindex <= bend; bindex++) {
+		skip = 0;
+		h_dir = au_h_iptr(dir, bindex);
+		br = au_sbr(sb, bindex);
+		do_free = 0;
+
+		wbr = br->br_wbr;
+		if (wbr)
+			wbr_wh_read_lock(wbr);
+
+		switch (br->br_perm) {
+		case AuBrPerm_RO:
+		case AuBrPerm_ROWH:
+		case AuBrPerm_RR:
+		case AuBrPerm_RRWH:
+			do_free = !!wbr;
+			skip = (!wbr
+				|| (!wbr->wbr_whbase
+				    && !wbr->wbr_plink
+				    && !wbr->wbr_orph));
+			break;
+
+		case AuBrPerm_RWNoLinkWH:
+			/* skip = (!br->br_whbase && !br->br_orph); */
+			skip = (!wbr || !wbr->wbr_whbase);
+			if (skip && wbr) {
+				if (do_plink)
+					skip = !!wbr->wbr_plink;
+				else
+					skip = !wbr->wbr_plink;
+			}
+			break;
+
+		case AuBrPerm_RW:
+			/* skip = (br->br_whbase && br->br_ohph); */
+			skip = (wbr && wbr->wbr_whbase);
+			if (skip) {
+				if (do_plink)
+					skip = !!wbr->wbr_plink;
+				else
+					skip = !wbr->wbr_plink;
+			}
+			break;
+
+		default:
+			BUG();
+		}
+		if (wbr)
+			wbr_wh_read_unlock(wbr);
+
+		if (skip)
+			continue;
+
+		hdir = au_hi(dir, bindex);
+		au_hin_imtx_lock_nested(hdir, AuLsc_I_PARENT);
+		if (wbr)
+			wbr_wh_write_lock(wbr);
+		err = au_wh_init(au_h_dptr(root, bindex), br, sb);
+		if (wbr)
+			wbr_wh_write_unlock(wbr);
+		au_hin_imtx_unlock(hdir);
+
+		if (!err && do_free) {
+			kfree(wbr);
+			br->br_wbr = NULL;
+		}
+	}
+
+	return err;
+}
+
+int au_opts_mount(struct super_block *sb, struct au_opts *opts)
+{
+	int err;
+	unsigned int tmp;
+	aufs_bindex_t bend;
+	struct au_opt *opt;
+	struct au_opt_xino *opt_xino, xino;
+	struct au_sbinfo *sbinfo;
+
+	SiMustWriteLock(sb);
+
+	err = 0;
+	opt_xino = NULL;
+	opt = opts->opt;
+	while (err >= 0 && opt->type != Opt_tail)
+		err = au_opt_simple(sb, opt++, opts);
+	if (err > 0)
+		err = 0;
+	else if (unlikely(err < 0))
+		goto out;
+
+	/* disable xino and udba temporary */
+	sbinfo = au_sbi(sb);
+	tmp = sbinfo->si_mntflags;
+	au_opt_clr(sbinfo->si_mntflags, XINO);
+	au_opt_set_udba(sbinfo->si_mntflags, UDBA_REVAL);
+
+	opt = opts->opt;
+	while (err >= 0 && opt->type != Opt_tail)
+		err = au_opt_br(sb, opt++, opts);
+	if (err > 0)
+		err = 0;
+	else if (unlikely(err < 0))
+		goto out;
+
+	bend = au_sbend(sb);
+	if (unlikely(bend < 0)) {
+		err = -EINVAL;
+		AuErr("no branches\n");
+		goto out;
+	}
+
+	if (au_opt_test(tmp, XINO))
+		au_opt_set(sbinfo->si_mntflags, XINO);
+	opt = opts->opt;
+	while (!err && opt->type != Opt_tail)
+		err = au_opt_xino(sb, opt++, &opt_xino, opts);
+	if (unlikely(err))
+		goto out;
+
+	err = au_opts_verify(sb, sb->s_flags, tmp);
+	if (unlikely(err))
+		goto out;
+
+	/* restore xino */
+	if (au_opt_test(tmp, XINO) && !opt_xino) {
+		xino.file = au_xino_def(sb);
+		err = PTR_ERR(xino.file);
+		if (IS_ERR(xino.file))
+			goto out;
+
+		err = au_xino_set(sb, &xino, /*remount*/0);
+		fput(xino.file);
+		if (unlikely(err))
+			goto out;
+	}
+
+	/* restore udba */
+	sbinfo->si_mntflags &= ~AuOptMask_UDBA;
+	sbinfo->si_mntflags |= (tmp & AuOptMask_UDBA);
+	if (au_opt_test(tmp, UDBA_HINOTIFY)) {
+		struct inode *dir = sb->s_root->d_inode;
+		au_reset_hinotify(dir,
+				  au_hi_flags(dir, /*isdir*/1) & ~AuHi_XINO);
+	}
+
+ out:
+	return err;
+}
+
+int au_opts_remount(struct super_block *sb, struct au_opts *opts)
+{
+	int err, rerr;
+	struct inode *dir;
+	struct au_opt_xino *opt_xino;
+	struct au_opt *opt;
+	struct au_sbinfo *sbinfo;
+
+	SiMustWriteLock(sb);
+
+	dir = sb->s_root->d_inode;
+	sbinfo = au_sbi(sb);
+	err = 0;
+	opt_xino = NULL;
+	opt = opts->opt;
+	while (err >= 0 && opt->type != Opt_tail) {
+		err = au_opt_simple(sb, opt, opts);
+		if (!err)
+			err = au_opt_br(sb, opt, opts);
+		if (!err)
+			err = au_opt_xino(sb, opt, &opt_xino, opts);
+		opt++;
+	}
+	if (err > 0)
+		err = 0;
+	AuTraceErr(err);
+	/* go on even err */
+
+	rerr = au_opts_verify(sb, opts->sb_flags, /*pending*/0);
+	if (unlikely(rerr && !err))
+		err = rerr;
+
+	if (au_ftest_opts(opts->flags, TRUNC_XIB)) {
+		rerr = au_xib_trunc(sb);
+		if (unlikely(rerr && !err))
+			err = rerr;
+	}
+
+	/* will be handled by the caller */
+	if (!au_ftest_opts(opts->flags, REFRESH_DIR)
+	    && (opts->given_udba || au_opt_test(sbinfo->si_mntflags, XINO)))
+		au_fset_opts(opts->flags, REFRESH_DIR);
+
+	AuDbg("status 0x%x\n", opts->flags);
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+unsigned int au_opt_udba(struct super_block *sb)
+{
+	return au_mntflags(sb) & AuOptMask_UDBA;
+}
--- linux-rt-2.6.31.orig/ubuntu/aufs/BOM
+++ linux-rt-2.6.31/ubuntu/aufs/BOM
@@ -0,0 +1,11 @@
+Git Tree:	http://git.c3sl.ufpr.br/pub/scm/aufs/aufs2-standalone.git
+Git Branch:	aufs2-30 (b599d87c0ad475e309f81d9b85ba56527371db81)
+
+This standalone snapshot was built from the commit below in the main
+aufs2-2.6.git tree (http://git.c3sl.ufpr.br/pub/scm/aufs/aufs2-2.6.git):
+
+    commit 049de2b1a34c3145ea82a2fe92c286393c4f6310
+    Author: J. R. Okajima <hooanon05@yahoo.co.jp>
+    Date:   Fri Jul 24 12:51:40 2009 +0900
+
+	aufs: possible bugfix, verify the lower parent dentry
--- linux-rt-2.6.31.orig/ubuntu/aufs/dbgaufs.c
+++ linux-rt-2.6.31/ubuntu/aufs/dbgaufs.c
@@ -0,0 +1,331 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * debugfs interface
+ */
+
+#include <linux/debugfs.h>
+#include "aufs.h"
+
+#ifndef CONFIG_SYSFS
+#error DEBUG_FS depends upon SYSFS
+#endif
+
+static struct dentry *dbgaufs;
+static const mode_t dbgaufs_mode = S_IRUSR | S_IRGRP | S_IROTH;
+
+/* 20 is max digits length of ulong 64 */
+struct dbgaufs_arg {
+	int n;
+	char a[20 * 4];
+};
+
+/*
+ * common function for all XINO files
+ */
+static int dbgaufs_xi_release(struct inode *inode __maybe_unused,
+			      struct file *file)
+{
+	kfree(file->private_data);
+	return 0;
+}
+
+static int dbgaufs_xi_open(struct file *xf, struct file *file, int do_fcnt)
+{
+	int err;
+	struct kstat st;
+	struct dbgaufs_arg *p;
+
+	err = -ENOMEM;
+	p = kmalloc(sizeof(*p), GFP_NOFS);
+	if (unlikely(!p))
+		goto out;
+
+	err = 0;
+	p->n = 0;
+	file->private_data = p;
+	if (!xf)
+		goto out;
+
+	err = vfs_getattr(xf->f_vfsmnt, xf->f_dentry, &st);
+	if (!err) {
+		if (do_fcnt)
+			p->n = snprintf
+				(p->a, sizeof(p->a), "%ld, %llux%lu %lld\n",
+				 (long)file_count(xf), st.blocks, st.blksize,
+				 (long long)st.size);
+		else
+			p->n = snprintf(p->a, sizeof(p->a), "%llux%lu %lld\n",
+					st.blocks, st.blksize,
+					(long long)st.size);
+		AuDebugOn(p->n >= sizeof(p->a));
+	} else {
+		p->n = snprintf(p->a, sizeof(p->a), "err %d\n", err);
+		err = 0;
+	}
+
+ out:
+	return err;
+
+}
+
+static ssize_t dbgaufs_xi_read(struct file *file, char __user *buf,
+			       size_t count, loff_t *ppos)
+{
+	struct dbgaufs_arg *p;
+
+	p = file->private_data;
+	return simple_read_from_buffer(buf, count, ppos, p->a, p->n);
+}
+
+/* ---------------------------------------------------------------------- */
+
+static int dbgaufs_xib_open(struct inode *inode, struct file *file)
+{
+	int err;
+	struct au_sbinfo *sbinfo;
+	struct super_block *sb;
+
+	sbinfo = inode->i_private;
+	sb = sbinfo->si_sb;
+	si_noflush_read_lock(sb);
+	err = dbgaufs_xi_open(sbinfo->si_xib, file, /*do_fcnt*/0);
+	si_read_unlock(sb);
+	return err;
+}
+
+static const struct file_operations dbgaufs_xib_fop = {
+	.open		= dbgaufs_xib_open,
+	.release	= dbgaufs_xi_release,
+	.read		= dbgaufs_xi_read
+};
+
+/* ---------------------------------------------------------------------- */
+
+#define DbgaufsXi_PREFIX "xi"
+
+static int dbgaufs_xino_open(struct inode *inode, struct file *file)
+{
+	int err;
+	long l;
+	struct au_sbinfo *sbinfo;
+	struct super_block *sb;
+	struct file *xf;
+	struct qstr *name;
+
+	err = -ENOENT;
+	xf = NULL;
+	name = &file->f_dentry->d_name;
+	if (unlikely(name->len < sizeof(DbgaufsXi_PREFIX)
+		     || memcmp(name->name, DbgaufsXi_PREFIX,
+			       sizeof(DbgaufsXi_PREFIX) - 1)))
+		goto out;
+	err = strict_strtol(name->name + sizeof(DbgaufsXi_PREFIX) - 1, 10, &l);
+	if (unlikely(err))
+		goto out;
+
+	sbinfo = inode->i_private;
+	sb = sbinfo->si_sb;
+	si_noflush_read_lock(sb);
+	if (l <= au_sbend(sb)) {
+		xf = au_sbr(sb, (aufs_bindex_t)l)->br_xino.xi_file;
+		err = dbgaufs_xi_open(xf, file, /*do_fcnt*/1);
+	} else
+		err = -ENOENT;
+	si_read_unlock(sb);
+
+ out:
+	return err;
+}
+
+static const struct file_operations dbgaufs_xino_fop = {
+	.open		= dbgaufs_xino_open,
+	.release	= dbgaufs_xi_release,
+	.read		= dbgaufs_xi_read
+};
+
+void dbgaufs_brs_del(struct super_block *sb, aufs_bindex_t bindex)
+{
+	aufs_bindex_t bend;
+	struct au_branch *br;
+	struct au_xino_file *xi;
+
+	if (!au_sbi(sb)->si_dbgaufs)
+		return;
+
+	bend = au_sbend(sb);
+	for (; bindex <= bend; bindex++) {
+		br = au_sbr(sb, bindex);
+		xi = &br->br_xino;
+		if (xi->xi_dbgaufs) {
+			debugfs_remove(xi->xi_dbgaufs);
+			xi->xi_dbgaufs = NULL;
+		}
+	}
+}
+
+void dbgaufs_brs_add(struct super_block *sb, aufs_bindex_t bindex)
+{
+	struct au_sbinfo *sbinfo;
+	struct dentry *parent;
+	struct au_branch *br;
+	struct au_xino_file *xi;
+	aufs_bindex_t bend;
+	char name[sizeof(DbgaufsXi_PREFIX) + 5]; /* "xi" bindex NULL */
+
+	sbinfo = au_sbi(sb);
+	parent = sbinfo->si_dbgaufs;
+	if (!parent)
+		return;
+
+	bend = au_sbend(sb);
+	for (; bindex <= bend; bindex++) {
+		snprintf(name, sizeof(name), DbgaufsXi_PREFIX "%d", bindex);
+		br = au_sbr(sb, bindex);
+		xi = &br->br_xino;
+		AuDebugOn(xi->xi_dbgaufs);
+		xi->xi_dbgaufs = debugfs_create_file(name, dbgaufs_mode, parent,
+						     sbinfo, &dbgaufs_xino_fop);
+		/* ignore an error */
+		if (unlikely(!xi->xi_dbgaufs))
+			AuWarn1("failed %s under debugfs\n", name);
+	}
+}
+
+/* ---------------------------------------------------------------------- */
+
+#ifdef CONFIG_AUFS_EXPORT
+static int dbgaufs_xigen_open(struct inode *inode, struct file *file)
+{
+	int err;
+	struct au_sbinfo *sbinfo;
+	struct super_block *sb;
+
+	sbinfo = inode->i_private;
+	sb = sbinfo->si_sb;
+	si_noflush_read_lock(sb);
+	err = dbgaufs_xi_open(sbinfo->si_xigen, file, /*do_fcnt*/0);
+	si_read_unlock(sb);
+	return err;
+}
+
+static const struct file_operations dbgaufs_xigen_fop = {
+	.open		= dbgaufs_xigen_open,
+	.release	= dbgaufs_xi_release,
+	.read		= dbgaufs_xi_read
+};
+
+static int dbgaufs_xigen_init(struct au_sbinfo *sbinfo)
+{
+	int err;
+
+	/*
+	 * This function is a dynamic '__init' fucntion actually,
+	 * so the tiny check for si_rwsem is unnecessary.
+	 */
+	/* AuRwMustWriteLock(&sbinfo->si_rwsem); */
+
+	err = -EIO;
+	sbinfo->si_dbgaufs_xigen = debugfs_create_file
+		("xigen", dbgaufs_mode, sbinfo->si_dbgaufs, sbinfo,
+		 &dbgaufs_xigen_fop);
+	if (sbinfo->si_dbgaufs_xigen)
+		err = 0;
+
+	return err;
+}
+#else
+static int dbgaufs_xigen_init(struct au_sbinfo *sbinfo)
+{
+	return 0;
+}
+#endif /* CONFIG_AUFS_EXPORT */
+
+/* ---------------------------------------------------------------------- */
+
+void dbgaufs_si_fin(struct au_sbinfo *sbinfo)
+{
+	/*
+	 * This function is a dynamic '__init' fucntion actually,
+	 * so the tiny check for si_rwsem is unnecessary.
+	 */
+	/* AuRwMustWriteLock(&sbinfo->si_rwsem); */
+
+	debugfs_remove_recursive(sbinfo->si_dbgaufs);
+	sbinfo->si_dbgaufs = NULL;
+	kobject_put(&sbinfo->si_kobj);
+}
+
+int dbgaufs_si_init(struct au_sbinfo *sbinfo)
+{
+	int err;
+	char name[SysaufsSiNameLen];
+
+	/*
+	 * This function is a dynamic '__init' fucntion actually,
+	 * so the tiny check for si_rwsem is unnecessary.
+	 */
+	/* AuRwMustWriteLock(&sbinfo->si_rwsem); */
+
+	err = -ENOENT;
+	if (!dbgaufs) {
+		AuErr1("/debug/aufs is uninitialized\n");
+		goto out;
+	}
+
+	err = -EIO;
+	sysaufs_name(sbinfo, name);
+	sbinfo->si_dbgaufs = debugfs_create_dir(name, dbgaufs);
+	if (unlikely(!sbinfo->si_dbgaufs))
+		goto out;
+	kobject_get(&sbinfo->si_kobj);
+
+	sbinfo->si_dbgaufs_xib = debugfs_create_file
+		("xib", dbgaufs_mode, sbinfo->si_dbgaufs, sbinfo,
+		 &dbgaufs_xib_fop);
+	if (unlikely(!sbinfo->si_dbgaufs_xib))
+		goto out_dir;
+
+	err = dbgaufs_xigen_init(sbinfo);
+	if (!err)
+		goto out; /* success */
+
+ out_dir:
+	dbgaufs_si_fin(sbinfo);
+ out:
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+void dbgaufs_fin(void)
+{
+	debugfs_remove(dbgaufs);
+}
+
+int __init dbgaufs_init(void)
+{
+	int err;
+
+	err = -EIO;
+	dbgaufs = debugfs_create_dir(AUFS_NAME, NULL);
+	if (dbgaufs)
+		err = 0;
+	return err;
+}
--- linux-rt-2.6.31.orig/ubuntu/aufs/Makefile
+++ linux-rt-2.6.31/ubuntu/aufs/Makefile
@@ -0,0 +1,23 @@
+
+include ${src}/magic.mk
+-include ${src}/priv_def.mk
+
+obj-$(CONFIG_AUFS_FS) += aufs.o
+aufs-y := module.o sbinfo.o super.o branch.o xino.o sysaufs.o opts.o \
+	wkq.o vfsub.o dcsub.o \
+	cpup.o whout.o plink.o wbr_policy.o \
+	dinfo.o dentry.o \
+	finfo.o file.o f_op.o \
+	dir.o vdir.o \
+	iinfo.o inode.o i_op.o i_op_add.o i_op_del.o i_op_ren.o \
+	ioctl.o
+
+# all are boolean
+aufs-$(CONFIG_SYSFS) += sysfs.o
+aufs-$(CONFIG_DEBUG_FS) += dbgaufs.o
+aufs-$(CONFIG_AUFS_BDEV_LOOP) += loop.o
+aufs-$(CONFIG_AUFS_HINOTIFY) += hinotify.o
+aufs-$(CONFIG_AUFS_EXPORT) += export.o
+aufs-$(CONFIG_AUFS_POLL) += poll.o
+aufs-$(CONFIG_AUFS_DEBUG) += debug.o
+aufs-$(CONFIG_AUFS_MAGIC_SYSRQ) += sysrq.o
--- linux-rt-2.6.31.orig/ubuntu/aufs/vfsub.c
+++ linux-rt-2.6.31/ubuntu/aufs/vfsub.c
@@ -0,0 +1,736 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * sub-routines for VFS
+ */
+
+#include <linux/namei.h>
+#include <linux/security.h>
+#include <linux/splice.h>
+#include <linux/uaccess.h>
+#include "aufs.h"
+
+int vfsub_update_h_iattr(struct path *h_path, int *did)
+{
+	int err;
+	struct kstat st;
+	struct super_block *h_sb;
+
+	/* for remote fs, leave work for its getattr or d_revalidate */
+	/* for bad i_attr fs, handle them in aufs_getattr() */
+	/* still some fs may acquire i_mutex. we need to skip them */
+	err = 0;
+	if (!did)
+		did = &err;
+	h_sb = h_path->dentry->d_sb;
+	*did = (!au_test_fs_remote(h_sb) && au_test_fs_refresh_iattr(h_sb));
+	if (*did)
+		err = vfs_getattr(h_path->mnt, h_path->dentry, &st);
+
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+struct file *vfsub_filp_open(const char *path, int oflags, int mode)
+{
+	struct file *file;
+
+	lockdep_off();
+	file = filp_open(path, oflags, mode);
+	lockdep_on();
+	if (IS_ERR(file))
+		goto out;
+	vfsub_update_h_iattr(&file->f_path, /*did*/NULL); /*ignore*/
+
+ out:
+	return file;
+}
+
+int vfsub_kern_path(const char *name, unsigned int flags, struct path *path)
+{
+	int err;
+
+	/* lockdep_off(); */
+	err = kern_path(name, flags, path);
+	/* lockdep_on(); */
+	if (!err && path->dentry->d_inode)
+		vfsub_update_h_iattr(path, /*did*/NULL); /*ignore*/
+	return err;
+}
+
+struct dentry *vfsub_lookup_one_len(const char *name, struct dentry *parent,
+				    int len)
+{
+	struct path path = {
+		.mnt = NULL
+	};
+
+	IMustLock(parent->d_inode);
+
+	path.dentry = lookup_one_len(name, parent, len);
+	if (IS_ERR(path.dentry))
+		goto out;
+	if (path.dentry->d_inode)
+		vfsub_update_h_iattr(&path, /*did*/NULL); /*ignore*/
+
+ out:
+	return path.dentry;
+}
+
+struct dentry *vfsub_lookup_hash(struct nameidata *nd)
+{
+	struct path path = {
+		.mnt = nd->path.mnt
+	};
+
+	IMustLock(nd->path.dentry->d_inode);
+
+	path.dentry = lookup_hash(nd);
+	if (!IS_ERR(path.dentry) && path.dentry->d_inode)
+		vfsub_update_h_iattr(&path, /*did*/NULL); /*ignore*/
+
+	return path.dentry;
+}
+
+/* ---------------------------------------------------------------------- */
+
+struct dentry *vfsub_lock_rename(struct dentry *d1, struct au_hinode *hdir1,
+				 struct dentry *d2, struct au_hinode *hdir2)
+{
+	struct dentry *d;
+
+	lockdep_off();
+	d = lock_rename(d1, d2);
+	lockdep_on();
+	au_hin_suspend(hdir1);
+	if (hdir1 != hdir2)
+		au_hin_suspend(hdir2);
+
+	return d;
+}
+
+void vfsub_unlock_rename(struct dentry *d1, struct au_hinode *hdir1,
+			 struct dentry *d2, struct au_hinode *hdir2)
+{
+	au_hin_resume(hdir1);
+	if (hdir1 != hdir2)
+		au_hin_resume(hdir2);
+	lockdep_off();
+	unlock_rename(d1, d2);
+	lockdep_on();
+}
+
+/* ---------------------------------------------------------------------- */
+
+int vfsub_create(struct inode *dir, struct path *path, int mode)
+{
+	int err;
+	struct dentry *d;
+
+	IMustLock(dir);
+
+	d = path->dentry;
+	path->dentry = d->d_parent;
+	err = security_path_mknod(path, path->dentry, mode, 0);
+	path->dentry = d;
+	if (unlikely(err))
+		goto out;
+
+	if (au_test_fs_null_nd(dir->i_sb))
+		err = vfs_create(dir, path->dentry, mode, NULL);
+	else {
+		struct nameidata h_nd;
+
+		memset(&h_nd, 0, sizeof(h_nd));
+		h_nd.flags = LOOKUP_CREATE;
+		h_nd.intent.open.flags = O_CREAT
+			| vfsub_fmode_to_uint(FMODE_READ);
+		h_nd.intent.open.create_mode = mode;
+		h_nd.path.dentry = path->dentry->d_parent;
+		h_nd.path.mnt = path->mnt;
+		path_get(&h_nd.path);
+		err = vfs_create(dir, path->dentry, mode, &h_nd);
+		path_put(&h_nd.path);
+	}
+
+	if (!err) {
+		struct path tmp = *path;
+		int did;
+
+		vfsub_update_h_iattr(&tmp, &did);
+		if (did) {
+			tmp.dentry = path->dentry->d_parent;
+			vfsub_update_h_iattr(&tmp, /*did*/NULL);
+		}
+		/*ignore*/
+	}
+
+ out:
+	return err;
+}
+
+int vfsub_symlink(struct inode *dir, struct path *path, const char *symname)
+{
+	int err;
+	struct dentry *d;
+
+	IMustLock(dir);
+
+	d = path->dentry;
+	path->dentry = d->d_parent;
+	err = security_path_symlink(path, path->dentry, symname);
+	path->dentry = d;
+	if (unlikely(err))
+		goto out;
+
+	err = vfs_symlink(dir, path->dentry, symname);
+	if (!err) {
+		struct path tmp = *path;
+		int did;
+
+		vfsub_update_h_iattr(&tmp, &did);
+		if (did) {
+			tmp.dentry = path->dentry->d_parent;
+			vfsub_update_h_iattr(&tmp, /*did*/NULL);
+		}
+		/*ignore*/
+	}
+
+ out:
+	return err;
+}
+
+int vfsub_mknod(struct inode *dir, struct path *path, int mode, dev_t dev)
+{
+	int err;
+	struct dentry *d;
+
+	IMustLock(dir);
+
+	d = path->dentry;
+	path->dentry = d->d_parent;
+	err = security_path_mknod(path, path->dentry, mode, dev);
+	path->dentry = d;
+	if (unlikely(err))
+		goto out;
+
+	err = vfs_mknod(dir, path->dentry, mode, dev);
+	if (!err) {
+		struct path tmp = *path;
+		int did;
+
+		vfsub_update_h_iattr(&tmp, &did);
+		if (did) {
+			tmp.dentry = path->dentry->d_parent;
+			vfsub_update_h_iattr(&tmp, /*did*/NULL);
+		}
+		/*ignore*/
+	}
+
+ out:
+	return err;
+}
+
+static int au_test_nlink(struct inode *inode)
+{
+	const unsigned int link_max = UINT_MAX >> 1; /* rough margin */
+
+	if (!au_test_fs_no_limit_nlink(inode->i_sb)
+	    || inode->i_nlink < link_max)
+		return 0;
+	return -EMLINK;
+}
+
+int vfsub_link(struct dentry *src_dentry, struct inode *dir, struct path *path)
+{
+	int err;
+	struct dentry *d;
+
+	IMustLock(dir);
+
+	err = au_test_nlink(src_dentry->d_inode);
+	if (unlikely(err))
+		return err;
+
+	d = path->dentry;
+	path->dentry = d->d_parent;
+	err = security_path_link(src_dentry, path, path->dentry);
+	path->dentry = d;
+	if (unlikely(err))
+		goto out;
+
+	lockdep_off();
+	err = vfs_link(src_dentry, dir, path->dentry);
+	lockdep_on();
+	if (!err) {
+		struct path tmp = *path;
+		int did;
+
+		/* fuse has different memory inode for the same inumber */
+		vfsub_update_h_iattr(&tmp, &did);
+		if (did) {
+			tmp.dentry = path->dentry->d_parent;
+			vfsub_update_h_iattr(&tmp, /*did*/NULL);
+			tmp.dentry = src_dentry;
+			vfsub_update_h_iattr(&tmp, /*did*/NULL);
+		}
+		/*ignore*/
+	}
+
+ out:
+	return err;
+}
+
+int vfsub_rename(struct inode *src_dir, struct dentry *src_dentry,
+		 struct inode *dir, struct path *path)
+{
+	int err;
+	struct path tmp = {
+		.mnt	= path->mnt
+	};
+	struct dentry *d;
+
+	IMustLock(dir);
+	IMustLock(src_dir);
+
+	d = path->dentry;
+	path->dentry = d->d_parent;
+	tmp.dentry = src_dentry->d_parent;
+	err = security_path_rename(&tmp, src_dentry, path, path->dentry);
+	path->dentry = d;
+	if (unlikely(err))
+		goto out;
+
+	lockdep_off();
+	err = vfs_rename(src_dir, src_dentry, dir, path->dentry);
+	lockdep_on();
+	if (!err) {
+		int did;
+
+		tmp.dentry = d->d_parent;
+		vfsub_update_h_iattr(&tmp, &did);
+		if (did) {
+			tmp.dentry = src_dentry;
+			vfsub_update_h_iattr(&tmp, /*did*/NULL);
+			tmp.dentry = src_dentry->d_parent;
+			vfsub_update_h_iattr(&tmp, /*did*/NULL);
+		}
+		/*ignore*/
+	}
+
+ out:
+	return err;
+}
+
+int vfsub_mkdir(struct inode *dir, struct path *path, int mode)
+{
+	int err;
+	struct dentry *d;
+
+	IMustLock(dir);
+
+	d = path->dentry;
+	path->dentry = d->d_parent;
+	err = security_path_mkdir(path, path->dentry, mode);
+	path->dentry = d;
+	if (unlikely(err))
+		goto out;
+
+	err = vfs_mkdir(dir, path->dentry, mode);
+	if (!err) {
+		struct path tmp = *path;
+		int did;
+
+		vfsub_update_h_iattr(&tmp, &did);
+		if (did) {
+			tmp.dentry = path->dentry->d_parent;
+			vfsub_update_h_iattr(&tmp, /*did*/NULL);
+		}
+		/*ignore*/
+	}
+
+ out:
+	return err;
+}
+
+int vfsub_rmdir(struct inode *dir, struct path *path)
+{
+	int err;
+	struct dentry *d;
+
+	IMustLock(dir);
+
+	d = path->dentry;
+	path->dentry = d->d_parent;
+	err = security_path_rmdir(path, path->dentry);
+	path->dentry = d;
+	if (unlikely(err))
+		goto out;
+
+	lockdep_off();
+	err = vfs_rmdir(dir, path->dentry);
+	lockdep_on();
+	if (!err) {
+		struct path tmp = {
+			.dentry	= path->dentry->d_parent,
+			.mnt	= path->mnt
+		};
+
+		vfsub_update_h_iattr(&tmp, /*did*/NULL); /*ignore*/
+	}
+
+ out:
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+ssize_t vfsub_read_u(struct file *file, char __user *ubuf, size_t count,
+		     loff_t *ppos)
+{
+	ssize_t err;
+
+	err = vfs_read(file, ubuf, count, ppos);
+	if (err >= 0)
+		vfsub_update_h_iattr(&file->f_path, /*did*/NULL); /*ignore*/
+	return err;
+}
+
+/* todo: kernel_read()? */
+ssize_t vfsub_read_k(struct file *file, void *kbuf, size_t count,
+		     loff_t *ppos)
+{
+	ssize_t err;
+	mm_segment_t oldfs;
+
+	oldfs = get_fs();
+	set_fs(KERNEL_DS);
+	err = vfsub_read_u(file, (char __user *)kbuf, count, ppos);
+	set_fs(oldfs);
+	return err;
+}
+
+ssize_t vfsub_write_u(struct file *file, const char __user *ubuf, size_t count,
+		      loff_t *ppos)
+{
+	ssize_t err;
+
+	lockdep_off();
+	err = vfs_write(file, ubuf, count, ppos);
+	lockdep_on();
+	if (err >= 0)
+		vfsub_update_h_iattr(&file->f_path, /*did*/NULL); /*ignore*/
+	return err;
+}
+
+ssize_t vfsub_write_k(struct file *file, void *kbuf, size_t count, loff_t *ppos)
+{
+	ssize_t err;
+	mm_segment_t oldfs;
+
+	oldfs = get_fs();
+	set_fs(KERNEL_DS);
+	err = vfsub_write_u(file, (const char __user *)kbuf, count, ppos);
+	set_fs(oldfs);
+	return err;
+}
+
+int vfsub_readdir(struct file *file, filldir_t filldir, void *arg)
+{
+	int err;
+
+	lockdep_off();
+	err = vfs_readdir(file, filldir, arg);
+	lockdep_on();
+	if (err >= 0)
+		vfsub_update_h_iattr(&file->f_path, /*did*/NULL); /*ignore*/
+	return err;
+}
+
+long vfsub_splice_to(struct file *in, loff_t *ppos,
+		     struct pipe_inode_info *pipe, size_t len,
+		     unsigned int flags)
+{
+	long err;
+
+	lockdep_off();
+	err = do_splice_to(in, ppos, pipe, len, flags);
+	lockdep_on();
+	if (err >= 0)
+		vfsub_update_h_iattr(&in->f_path, /*did*/NULL); /*ignore*/
+	return err;
+}
+
+long vfsub_splice_from(struct pipe_inode_info *pipe, struct file *out,
+		       loff_t *ppos, size_t len, unsigned int flags)
+{
+	long err;
+
+	lockdep_off();
+	err = do_splice_from(pipe, out, ppos, len, flags);
+	lockdep_on();
+	if (err >= 0)
+		vfsub_update_h_iattr(&out->f_path, /*did*/NULL); /*ignore*/
+	return err;
+}
+
+/* cf. open.c:do_sys_truncate() and do_sys_ftruncate() */
+int vfsub_trunc(struct path *h_path, loff_t length, unsigned int attr,
+		struct file *h_file)
+{
+	int err;
+	struct inode *h_inode;
+
+	h_inode = h_path->dentry->d_inode;
+	if (!h_file) {
+		err = mnt_want_write(h_path->mnt);
+		if (err)
+			goto out;
+		err = inode_permission(h_inode, MAY_WRITE);
+		if (err)
+			goto out_mnt;
+		err = get_write_access(h_inode);
+		if (err)
+			goto out_mnt;
+		err = break_lease(h_inode, vfsub_fmode_to_uint(FMODE_WRITE));
+		if (err)
+			goto out_inode;
+	}
+
+	err = locks_verify_truncate(h_inode, h_file, length);
+	if (!err)
+		err = security_path_truncate(h_path, length, attr);
+	if (!err) {
+		lockdep_off();
+		err = do_truncate(h_path->dentry, length, attr, h_file);
+		lockdep_on();
+	}
+
+ out_inode:
+	if (!h_file)
+		put_write_access(h_inode);
+ out_mnt:
+	if (!h_file)
+		mnt_drop_write(h_path->mnt);
+ out:
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+struct au_vfsub_mkdir_args {
+	int *errp;
+	struct inode *dir;
+	struct path *path;
+	int mode;
+};
+
+static void au_call_vfsub_mkdir(void *args)
+{
+	struct au_vfsub_mkdir_args *a = args;
+	*a->errp = vfsub_mkdir(a->dir, a->path, a->mode);
+}
+
+int vfsub_sio_mkdir(struct inode *dir, struct path *path, int mode)
+{
+	int err, do_sio, wkq_err;
+
+	do_sio = au_test_h_perm_sio(dir, MAY_EXEC | MAY_WRITE);
+	if (!do_sio)
+		err = vfsub_mkdir(dir, path, mode);
+	else {
+		struct au_vfsub_mkdir_args args = {
+			.errp	= &err,
+			.dir	= dir,
+			.path	= path,
+			.mode	= mode
+		};
+		wkq_err = au_wkq_wait(au_call_vfsub_mkdir, &args);
+		if (unlikely(wkq_err))
+			err = wkq_err;
+	}
+
+	return err;
+}
+
+struct au_vfsub_rmdir_args {
+	int *errp;
+	struct inode *dir;
+	struct path *path;
+};
+
+static void au_call_vfsub_rmdir(void *args)
+{
+	struct au_vfsub_rmdir_args *a = args;
+	*a->errp = vfsub_rmdir(a->dir, a->path);
+}
+
+int vfsub_sio_rmdir(struct inode *dir, struct path *path)
+{
+	int err, do_sio, wkq_err;
+
+	do_sio = au_test_h_perm_sio(dir, MAY_EXEC | MAY_WRITE);
+	if (!do_sio)
+		err = vfsub_rmdir(dir, path);
+	else {
+		struct au_vfsub_rmdir_args args = {
+			.errp	= &err,
+			.dir	= dir,
+			.path	= path
+		};
+		wkq_err = au_wkq_wait(au_call_vfsub_rmdir, &args);
+		if (unlikely(wkq_err))
+			err = wkq_err;
+	}
+
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+struct notify_change_args {
+	int *errp;
+	struct path *path;
+	struct iattr *ia;
+};
+
+static void call_notify_change(void *args)
+{
+	struct notify_change_args *a = args;
+	struct inode *h_inode;
+
+	h_inode = a->path->dentry->d_inode;
+	IMustLock(h_inode);
+
+	*a->errp = -EPERM;
+	if (!IS_IMMUTABLE(h_inode) && !IS_APPEND(h_inode)) {
+		lockdep_off();
+		*a->errp = notify_change(a->path->dentry, a->ia);
+		lockdep_on();
+		if (!*a->errp)
+			vfsub_update_h_iattr(a->path, /*did*/NULL); /*ignore*/
+	}
+	AuTraceErr(*a->errp);
+}
+
+int vfsub_notify_change(struct path *path, struct iattr *ia)
+{
+	int err;
+	struct notify_change_args args = {
+		.errp	= &err,
+		.path	= path,
+		.ia	= ia
+	};
+
+	call_notify_change(&args);
+
+	return err;
+}
+
+int vfsub_sio_notify_change(struct path *path, struct iattr *ia)
+{
+	int err, wkq_err;
+	struct notify_change_args args = {
+		.errp	= &err,
+		.path	= path,
+		.ia	= ia
+	};
+
+	wkq_err = au_wkq_wait(call_notify_change, &args);
+	if (unlikely(wkq_err))
+		err = wkq_err;
+
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+struct unlink_args {
+	int *errp;
+	struct inode *dir;
+	struct path *path;
+};
+
+static void call_unlink(void *args)
+{
+	struct unlink_args *a = args;
+	struct dentry *d = a->path->dentry;
+	struct inode *h_inode;
+	const int stop_sillyrename = (au_test_nfs(d->d_sb)
+				      && atomic_read(&d->d_count) == 1);
+
+	IMustLock(a->dir);
+
+	a->path->dentry = d->d_parent;
+	*a->errp = security_path_unlink(a->path, d);
+	a->path->dentry = d;
+	if (unlikely(*a->errp))
+		return;
+
+	if (!stop_sillyrename)
+		dget(d);
+	h_inode = d->d_inode;
+	if (h_inode)
+		atomic_inc(&h_inode->i_count);
+
+	lockdep_off();
+	*a->errp = vfs_unlink(a->dir, d);
+	lockdep_on();
+	if (!*a->errp) {
+		struct path tmp = {
+			.dentry = d->d_parent,
+			.mnt	= a->path->mnt
+		};
+		vfsub_update_h_iattr(&tmp, /*did*/NULL); /*ignore*/
+	}
+
+	if (!stop_sillyrename)
+		dput(d);
+	if (h_inode)
+		iput(h_inode);
+
+	AuTraceErr(*a->errp);
+}
+
+/*
+ * @dir: must be locked.
+ * @dentry: target dentry.
+ */
+int vfsub_unlink(struct inode *dir, struct path *path, int force)
+{
+	int err;
+	struct unlink_args args = {
+		.errp	= &err,
+		.dir	= dir,
+		.path	= path
+	};
+
+	if (!force)
+		call_unlink(&args);
+	else {
+		int wkq_err;
+
+		wkq_err = au_wkq_wait(call_unlink, &args);
+		if (unlikely(wkq_err))
+			err = wkq_err;
+	}
+
+	return err;
+}
--- linux-rt-2.6.31.orig/ubuntu/aufs/dentry.c
+++ linux-rt-2.6.31/ubuntu/aufs/dentry.c
@@ -0,0 +1,880 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * lookup and dentry operations
+ */
+
+#include <linux/namei.h>
+#include "aufs.h"
+
+static void au_h_nd(struct nameidata *h_nd, struct nameidata *nd)
+{
+	if (nd) {
+		*h_nd = *nd;
+
+		/*
+		 * gave up supporting LOOKUP_CREATE/OPEN for lower fs,
+		 * due to whiteout and branch permission.
+		 */
+		h_nd->flags &= ~(/*LOOKUP_PARENT |*/ LOOKUP_OPEN | LOOKUP_CREATE
+				 | LOOKUP_FOLLOW);
+		/* unnecessary? */
+		h_nd->intent.open.file = NULL;
+	} else
+		memset(h_nd, 0, sizeof(*h_nd));
+}
+
+struct au_lkup_one_args {
+	struct dentry **errp;
+	struct qstr *name;
+	struct dentry *h_parent;
+	struct au_branch *br;
+	struct nameidata *nd;
+};
+
+struct dentry *au_lkup_one(struct qstr *name, struct dentry *h_parent,
+			   struct au_branch *br, struct nameidata *nd)
+{
+	struct dentry *h_dentry;
+	int err;
+	struct nameidata h_nd;
+
+	if (au_test_fs_null_nd(h_parent->d_sb))
+		return vfsub_lookup_one_len(name->name, h_parent, name->len);
+
+	au_h_nd(&h_nd, nd);
+	h_nd.path.dentry = h_parent;
+	h_nd.path.mnt = br->br_mnt;
+
+	err = __lookup_one_len(name->name, &h_nd.last, NULL, name->len);
+	h_dentry = ERR_PTR(err);
+	if (!err) {
+		path_get(&h_nd.path);
+		h_dentry = vfsub_lookup_hash(&h_nd);
+		path_put(&h_nd.path);
+	}
+
+	return h_dentry;
+}
+
+static void au_call_lkup_one(void *args)
+{
+	struct au_lkup_one_args *a = args;
+	*a->errp = au_lkup_one(a->name, a->h_parent, a->br, a->nd);
+}
+
+#define AuLkup_ALLOW_NEG	1
+#define au_ftest_lkup(flags, name)	((flags) & AuLkup_##name)
+#define au_fset_lkup(flags, name)	{ (flags) |= AuLkup_##name; }
+#define au_fclr_lkup(flags, name)	{ (flags) &= ~AuLkup_##name; }
+
+struct au_do_lookup_args {
+	unsigned int		flags;
+	mode_t			type;
+	struct nameidata	*nd;
+};
+
+/*
+ * returns positive/negative dentry, NULL or an error.
+ * NULL means whiteout-ed or not-found.
+ */
+static struct dentry*
+au_do_lookup(struct dentry *h_parent, struct dentry *dentry,
+	     aufs_bindex_t bindex, struct qstr *wh_name,
+	     struct au_do_lookup_args *args)
+{
+	struct dentry *h_dentry;
+	struct inode *h_inode, *inode;
+	struct qstr *name;
+	struct au_branch *br;
+	int wh_found, opq;
+	unsigned char wh_able;
+	const unsigned char allow_neg = !!au_ftest_lkup(args->flags, ALLOW_NEG);
+
+	name = &dentry->d_name;
+	wh_found = 0;
+	br = au_sbr(dentry->d_sb, bindex);
+	wh_able = !!au_br_whable(br->br_perm);
+	if (wh_able)
+		wh_found = au_wh_test(h_parent, wh_name, br, /*try_sio*/0);
+	h_dentry = ERR_PTR(wh_found);
+	if (!wh_found)
+		goto real_lookup;
+	if (unlikely(wh_found < 0))
+		goto out;
+
+	/* We found a whiteout */
+	/* au_set_dbend(dentry, bindex); */
+	au_set_dbwh(dentry, bindex);
+	if (!allow_neg)
+		return NULL; /* success */
+
+ real_lookup:
+	h_dentry = au_lkup_one(name, h_parent, br, args->nd);
+	if (IS_ERR(h_dentry))
+		goto out;
+
+	h_inode = h_dentry->d_inode;
+	if (!h_inode) {
+		if (!allow_neg)
+			goto out_neg;
+	} else if (wh_found
+		   || (args->type && args->type != (h_inode->i_mode & S_IFMT)))
+		goto out_neg;
+
+	if (au_dbend(dentry) <= bindex)
+		au_set_dbend(dentry, bindex);
+	if (au_dbstart(dentry) < 0 || bindex < au_dbstart(dentry))
+		au_set_dbstart(dentry, bindex);
+	au_set_h_dptr(dentry, bindex, h_dentry);
+
+	inode = dentry->d_inode;
+	if (!h_inode || !S_ISDIR(h_inode->i_mode) || !wh_able
+	    || (inode && !S_ISDIR(inode->i_mode)))
+		goto out; /* success */
+
+	mutex_lock_nested(&h_inode->i_mutex, AuLsc_I_CHILD);
+	opq = au_diropq_test(h_dentry, br);
+	mutex_unlock(&h_inode->i_mutex);
+	if (opq > 0)
+		au_set_dbdiropq(dentry, bindex);
+	else if (unlikely(opq < 0)) {
+		au_set_h_dptr(dentry, bindex, NULL);
+		h_dentry = ERR_PTR(opq);
+	}
+	goto out;
+
+ out_neg:
+	dput(h_dentry);
+	h_dentry = NULL;
+ out:
+	return h_dentry;
+}
+
+static int au_test_shwh(struct super_block *sb, const struct qstr *name)
+{
+	if (unlikely(!au_opt_test(au_mntflags(sb), SHWH)
+		     && !strncmp(name->name, AUFS_WH_PFX, AUFS_WH_PFX_LEN)))
+		return -EPERM;
+	return 0;
+}
+
+/*
+ * returns the number of lower positive dentries,
+ * otherwise an error.
+ * can be called at unlinking with @type is zero.
+ */
+int au_lkup_dentry(struct dentry *dentry, aufs_bindex_t bstart, mode_t type,
+		   struct nameidata *nd)
+{
+	int npositive, err;
+	aufs_bindex_t bindex, btail, bdiropq;
+	unsigned char isdir;
+	struct qstr whname;
+	struct au_do_lookup_args args = {
+		.flags	= 0,
+		.type	= type,
+		.nd	= nd
+	};
+	const struct qstr *name = &dentry->d_name;
+	struct dentry *parent;
+	struct inode *inode;
+
+	parent = dget_parent(dentry);
+	err = au_test_shwh(dentry->d_sb, name);
+	if (unlikely(err))
+		goto out;
+
+	err = au_wh_name_alloc(&whname, name);
+	if (unlikely(err))
+		goto out;
+
+	inode = dentry->d_inode;
+	isdir = !!(inode && S_ISDIR(inode->i_mode));
+	if (!type)
+		au_fset_lkup(args.flags, ALLOW_NEG);
+
+	npositive = 0;
+	btail = au_dbtaildir(parent);
+	for (bindex = bstart; bindex <= btail; bindex++) {
+		struct dentry *h_parent, *h_dentry;
+		struct inode *h_inode, *h_dir;
+
+		h_dentry = au_h_dptr(dentry, bindex);
+		if (h_dentry) {
+			if (h_dentry->d_inode)
+				npositive++;
+			if (type != S_IFDIR)
+				break;
+			continue;
+		}
+		h_parent = au_h_dptr(parent, bindex);
+		if (!h_parent)
+			continue;
+		h_dir = h_parent->d_inode;
+		if (!h_dir || !S_ISDIR(h_dir->i_mode))
+			continue;
+
+		mutex_lock_nested(&h_dir->i_mutex, AuLsc_I_PARENT);
+		h_dentry = au_do_lookup(h_parent, dentry, bindex, &whname,
+					&args);
+		mutex_unlock(&h_dir->i_mutex);
+		err = PTR_ERR(h_dentry);
+		if (IS_ERR(h_dentry))
+			goto out_wh;
+		au_fclr_lkup(args.flags, ALLOW_NEG);
+
+		if (au_dbwh(dentry) >= 0)
+			break;
+		if (!h_dentry)
+			continue;
+		h_inode = h_dentry->d_inode;
+		if (!h_inode)
+			continue;
+		npositive++;
+		if (!args.type)
+			args.type = h_inode->i_mode & S_IFMT;
+		if (args.type != S_IFDIR)
+			break;
+		else if (isdir) {
+			/* the type of lower may be different */
+			bdiropq = au_dbdiropq(dentry);
+			if (bdiropq >= 0 && bdiropq <= bindex)
+				break;
+		}
+	}
+
+	if (npositive) {
+		AuLabel(positive);
+		au_update_dbstart(dentry);
+	}
+	err = npositive;
+	if (unlikely(!au_opt_test(au_mntflags(dentry->d_sb), UDBA_NONE)
+		     && au_dbstart(dentry) < 0))
+		/* both of real entry and whiteout found */
+		err = -EIO;
+
+ out_wh:
+	kfree(whname.name);
+ out:
+	dput(parent);
+	return err;
+}
+
+struct dentry *au_sio_lkup_one(struct qstr *name, struct dentry *parent,
+			       struct au_branch *br)
+{
+	struct dentry *dentry;
+	int wkq_err;
+
+	if (!au_test_h_perm_sio(parent->d_inode, MAY_EXEC))
+		dentry = au_lkup_one(name, parent, br, /*nd*/NULL);
+	else {
+		struct au_lkup_one_args args = {
+			.errp		= &dentry,
+			.name		= name,
+			.h_parent	= parent,
+			.br		= br,
+			.nd		= NULL
+		};
+
+		wkq_err = au_wkq_wait(au_call_lkup_one, &args);
+		if (unlikely(wkq_err))
+			dentry = ERR_PTR(wkq_err);
+	}
+
+	return dentry;
+}
+
+/*
+ * lookup @dentry on @bindex which should be negative.
+ */
+int au_lkup_neg(struct dentry *dentry, aufs_bindex_t bindex)
+{
+	int err;
+	struct dentry *parent, *h_parent, *h_dentry;
+	struct qstr *name;
+
+	name = &dentry->d_name;
+	parent = dget_parent(dentry);
+	h_parent = au_h_dptr(parent, bindex);
+	h_dentry = au_sio_lkup_one(name, h_parent,
+				   au_sbr(dentry->d_sb, bindex));
+	err = PTR_ERR(h_dentry);
+	if (IS_ERR(h_dentry))
+		goto out;
+	if (unlikely(h_dentry->d_inode)) {
+		err = -EIO;
+		AuIOErr("b%d %.*s should be negative.\n",
+			bindex, AuDLNPair(h_dentry));
+		dput(h_dentry);
+		goto out;
+	}
+
+	if (bindex < au_dbstart(dentry))
+		au_set_dbstart(dentry, bindex);
+	if (au_dbend(dentry) < bindex)
+		au_set_dbend(dentry, bindex);
+	au_set_h_dptr(dentry, bindex, h_dentry);
+	err = 0;
+
+ out:
+	dput(parent);
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+/* subset of struct inode */
+struct au_iattr {
+	unsigned long		i_ino;
+	/* unsigned int		i_nlink; */
+	uid_t			i_uid;
+	gid_t			i_gid;
+	u64			i_version;
+/*
+	loff_t			i_size;
+	blkcnt_t		i_blocks;
+*/
+	umode_t			i_mode;
+};
+
+static void au_iattr_save(struct au_iattr *ia, struct inode *h_inode)
+{
+	ia->i_ino = h_inode->i_ino;
+	/* ia->i_nlink = h_inode->i_nlink; */
+	ia->i_uid = h_inode->i_uid;
+	ia->i_gid = h_inode->i_gid;
+	ia->i_version = h_inode->i_version;
+/*
+	ia->i_size = h_inode->i_size;
+	ia->i_blocks = h_inode->i_blocks;
+*/
+	ia->i_mode = (h_inode->i_mode & S_IFMT);
+}
+
+static int au_iattr_test(struct au_iattr *ia, struct inode *h_inode)
+{
+	return ia->i_ino != h_inode->i_ino
+		/* || ia->i_nlink != h_inode->i_nlink */
+		|| ia->i_uid != h_inode->i_uid
+		|| ia->i_gid != h_inode->i_gid
+		|| ia->i_version != h_inode->i_version
+/*
+		|| ia->i_size != h_inode->i_size
+		|| ia->i_blocks != h_inode->i_blocks
+*/
+		|| ia->i_mode != (h_inode->i_mode & S_IFMT);
+}
+
+static int au_h_verify_dentry(struct dentry *h_dentry, struct dentry *h_parent,
+			      struct au_branch *br)
+{
+	int err;
+	struct au_iattr ia;
+	struct inode *h_inode;
+	struct dentry *h_d;
+	struct super_block *h_sb;
+
+	err = 0;
+	memset(&ia, -1, sizeof(ia));
+	h_sb = h_dentry->d_sb;
+	h_inode = h_dentry->d_inode;
+	if (h_inode)
+		au_iattr_save(&ia, h_inode);
+	else if (au_test_nfs(h_sb) || au_test_fuse(h_sb))
+		/* nfs d_revalidate may return 0 for negative dentry */
+		/* fuse d_revalidate always return 0 for negative dentry */
+		goto out;
+
+	/* main purpose is namei.c:cached_lookup() and d_revalidate */
+	h_d = au_lkup_one(&h_dentry->d_name, h_parent, br, /*nd*/NULL);
+	err = PTR_ERR(h_d);
+	if (IS_ERR(h_d))
+		goto out;
+
+	err = 0;
+	if (unlikely(h_d != h_dentry
+		     || h_d->d_inode != h_inode
+		     || (h_inode && au_iattr_test(&ia, h_inode))))
+		err = au_busy_or_stale();
+	dput(h_d);
+
+ out:
+	AuTraceErr(err);
+	return err;
+}
+
+int au_h_verify(struct dentry *h_dentry, unsigned int udba, struct inode *h_dir,
+		struct dentry *h_parent, struct au_branch *br)
+{
+	int err;
+
+	err = 0;
+	if (udba == AuOpt_UDBA_REVAL) {
+		IMustLock(h_dir);
+		err = (h_dentry->d_parent->d_inode != h_dir);
+	} else if (udba == AuOpt_UDBA_HINOTIFY)
+		err = au_h_verify_dentry(h_dentry, h_parent, br);
+
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+static void au_do_refresh_hdentry(struct au_hdentry *p, struct au_dinfo *dinfo,
+				  struct dentry *parent)
+{
+	struct dentry *h_d, *h_dp;
+	struct au_hdentry tmp, *q;
+	struct super_block *sb;
+	aufs_bindex_t new_bindex, bindex, bend, bwh, bdiropq;
+
+	AuRwMustWriteLock(&dinfo->di_rwsem);
+
+	bend = dinfo->di_bend;
+	bwh = dinfo->di_bwh;
+	bdiropq = dinfo->di_bdiropq;
+	for (bindex = dinfo->di_bstart; bindex <= bend; bindex++, p++) {
+		h_d = p->hd_dentry;
+		if (!h_d)
+			continue;
+
+		h_dp = dget_parent(h_d);
+		if (h_dp == au_h_dptr(parent, bindex)) {
+			dput(h_dp);
+			continue;
+		}
+
+		new_bindex = au_find_dbindex(parent, h_dp);
+		dput(h_dp);
+		if (dinfo->di_bwh == bindex)
+			bwh = new_bindex;
+		if (dinfo->di_bdiropq == bindex)
+			bdiropq = new_bindex;
+		if (new_bindex < 0) {
+			au_hdput(p);
+			p->hd_dentry = NULL;
+			continue;
+		}
+
+		/* swap two lower dentries, and loop again */
+		q = dinfo->di_hdentry + new_bindex;
+		tmp = *q;
+		*q = *p;
+		*p = tmp;
+		if (tmp.hd_dentry) {
+			bindex--;
+			p--;
+		}
+	}
+
+	sb = parent->d_sb;
+	dinfo->di_bwh = -1;
+	if (bwh >= 0 && bwh <= au_sbend(sb) && au_sbr_whable(sb, bwh))
+		dinfo->di_bwh = bwh;
+
+	dinfo->di_bdiropq = -1;
+	if (bdiropq >= 0
+	    && bdiropq <= au_sbend(sb)
+	    && au_sbr_whable(sb, bdiropq))
+		dinfo->di_bdiropq = bdiropq;
+
+	bend = au_dbend(parent);
+	p = dinfo->di_hdentry;
+	for (bindex = 0; bindex <= bend; bindex++, p++)
+		if (p->hd_dentry) {
+			dinfo->di_bstart = bindex;
+			break;
+		}
+
+	p = dinfo->di_hdentry + bend;
+	for (bindex = bend; bindex >= 0; bindex--, p--)
+		if (p->hd_dentry) {
+			dinfo->di_bend = bindex;
+			break;
+		}
+}
+
+/*
+ * returns the number of found lower positive dentries,
+ * otherwise an error.
+ */
+int au_refresh_hdentry(struct dentry *dentry, mode_t type)
+{
+	int npositive, err;
+	unsigned int sigen;
+	aufs_bindex_t bstart;
+	struct au_dinfo *dinfo;
+	struct super_block *sb;
+	struct dentry *parent;
+
+	DiMustWriteLock(dentry);
+
+	sb = dentry->d_sb;
+	AuDebugOn(IS_ROOT(dentry));
+	sigen = au_sigen(sb);
+	parent = dget_parent(dentry);
+	AuDebugOn(au_digen(parent) != sigen
+		  || au_iigen(parent->d_inode) != sigen);
+
+	dinfo = au_di(dentry);
+	err = au_di_realloc(dinfo, au_sbend(sb) + 1);
+	npositive = err;
+	if (unlikely(err))
+		goto out;
+	au_do_refresh_hdentry(dinfo->di_hdentry + dinfo->di_bstart, dinfo,
+			      parent);
+
+	npositive = 0;
+	bstart = au_dbstart(parent);
+	if (type != S_IFDIR && dinfo->di_bstart == bstart)
+		goto out_dgen; /* success */
+
+	npositive = au_lkup_dentry(dentry, bstart, type, /*nd*/NULL);
+	if (npositive < 0)
+		goto out;
+	if (dinfo->di_bwh >= 0 && dinfo->di_bwh <= dinfo->di_bstart)
+		d_drop(dentry);
+
+ out_dgen:
+	au_update_digen(dentry);
+ out:
+	dput(parent);
+	AuTraceErr(npositive);
+	return npositive;
+}
+
+static noinline_for_stack
+int au_do_h_d_reval(struct dentry *h_dentry, struct nameidata *nd,
+		    struct dentry *dentry, aufs_bindex_t bindex)
+{
+	int err, valid;
+	int (*reval)(struct dentry *, struct nameidata *);
+
+	err = 0;
+	reval = NULL;
+	if (h_dentry->d_op)
+		reval = h_dentry->d_op->d_revalidate;
+	if (!reval)
+		goto out;
+
+	AuDbg("b%d\n", bindex);
+	if (au_test_fs_null_nd(h_dentry->d_sb))
+		/* it may return tri-state */
+		valid = reval(h_dentry, NULL);
+	else {
+		struct nameidata h_nd;
+		int locked;
+		struct dentry *parent;
+
+		au_h_nd(&h_nd, nd);
+		parent = nd->path.dentry;
+		locked = (nd && nd->path.dentry != dentry);
+		if (locked)
+			di_read_lock_parent(parent, AuLock_IR);
+		BUG_ON(bindex > au_dbend(parent));
+		h_nd.path.dentry = au_h_dptr(parent, bindex);
+		BUG_ON(!h_nd.path.dentry);
+		h_nd.path.mnt = au_sbr(parent->d_sb, bindex)->br_mnt;
+		path_get(&h_nd.path);
+		valid = reval(h_dentry, &h_nd);
+		path_put(&h_nd.path);
+		if (locked)
+			di_read_unlock(parent, AuLock_IR);
+	}
+
+	if (unlikely(valid < 0))
+		err = valid;
+	else if (!valid)
+		err = -EINVAL;
+
+ out:
+	AuTraceErr(err);
+	return err;
+}
+
+/* todo: remove this */
+static int h_d_revalidate(struct dentry *dentry, struct inode *inode,
+			  struct nameidata *nd, int do_udba)
+{
+	int err;
+	umode_t mode, h_mode;
+	aufs_bindex_t bindex, btail, bstart, ibs, ibe;
+	unsigned char plus, unhashed, is_root, h_plus;
+	struct inode *first, *h_inode, *h_cached_inode;
+	struct dentry *h_dentry;
+	struct qstr *name, *h_name;
+
+	err = 0;
+	plus = 0;
+	mode = 0;
+	first = NULL;
+	ibs = -1;
+	ibe = -1;
+	unhashed = !!d_unhashed(dentry);
+	is_root = !!IS_ROOT(dentry);
+	name = &dentry->d_name;
+
+	/*
+	 * Theoretically, REVAL test should be unnecessary in case of INOTIFY.
+	 * But inotify doesn't fire some necessary events,
+	 *	IN_ATTRIB for atime/nlink/pageio
+	 *	IN_DELETE for NFS dentry
+	 * Let's do REVAL test too.
+	 */
+	if (do_udba && inode) {
+		mode = (inode->i_mode & S_IFMT);
+		plus = (inode->i_nlink > 0);
+		first = au_h_iptr(inode, au_ibstart(inode));
+		ibs = au_ibstart(inode);
+		ibe = au_ibend(inode);
+	}
+
+	bstart = au_dbstart(dentry);
+	btail = bstart;
+	if (inode && S_ISDIR(inode->i_mode))
+		btail = au_dbtaildir(dentry);
+	for (bindex = bstart; bindex <= btail; bindex++) {
+		h_dentry = au_h_dptr(dentry, bindex);
+		if (!h_dentry)
+			continue;
+
+		AuDbg("b%d, %.*s\n", bindex, AuDLNPair(h_dentry));
+		h_name = &h_dentry->d_name;
+		if (unlikely(do_udba
+			     && !is_root
+			     && (unhashed != !!d_unhashed(h_dentry)
+				 || name->len != h_name->len
+				 || memcmp(name->name, h_name->name, name->len))
+			    )) {
+			AuDbg("unhash 0x%x 0x%x, %.*s %.*s\n",
+				  unhashed, d_unhashed(h_dentry),
+				  AuDLNPair(dentry), AuDLNPair(h_dentry));
+			goto err;
+		}
+
+		err = au_do_h_d_reval(h_dentry, nd, dentry, bindex);
+		if (unlikely(err))
+			/* do not goto err, to keep the errno */
+			break;
+
+		/* todo: plink too? */
+		if (!do_udba)
+			continue;
+
+		/* UDBA tests */
+		h_inode = h_dentry->d_inode;
+		if (unlikely(!!inode != !!h_inode))
+			goto err;
+
+		h_plus = plus;
+		h_mode = mode;
+		h_cached_inode = h_inode;
+		if (h_inode) {
+			h_mode = (h_inode->i_mode & S_IFMT);
+			h_plus = (h_inode->i_nlink > 0);
+		}
+		if (inode && ibs <= bindex && bindex <= ibe)
+			h_cached_inode = au_h_iptr(inode, bindex);
+
+		if (unlikely(plus != h_plus
+			     || mode != h_mode
+			     || h_cached_inode != h_inode))
+			goto err;
+		continue;
+
+	err:
+		err = -EINVAL;
+		break;
+	}
+
+	return err;
+}
+
+static int simple_reval_dpath(struct dentry *dentry, unsigned int sigen)
+{
+	int err;
+	struct dentry *parent;
+	struct inode *inode;
+
+	inode = dentry->d_inode;
+	if (au_digen(dentry) == sigen && au_iigen(inode) == sigen)
+		return 0;
+
+	parent = dget_parent(dentry);
+	di_read_lock_parent(parent, AuLock_IR);
+	AuDebugOn(au_digen(parent) != sigen
+		  || au_iigen(parent->d_inode) != sigen);
+	au_dbg_verify_gen(parent, sigen);
+
+	/* returns a number of positive dentries */
+	err = au_refresh_hdentry(dentry, inode->i_mode & S_IFMT);
+	if (err >= 0)
+		err = au_refresh_hinode(inode, dentry);
+
+	di_read_unlock(parent, AuLock_IR);
+	dput(parent);
+	return err;
+}
+
+int au_reval_dpath(struct dentry *dentry, unsigned int sigen)
+{
+	int err;
+	struct dentry *d, *parent;
+	struct inode *inode;
+
+	if (!au_ftest_si(au_sbi(dentry->d_sb), FAILED_REFRESH_DIRS))
+		return simple_reval_dpath(dentry, sigen);
+
+	/* slow loop, keep it simple and stupid */
+	/* cf: au_cpup_dirs() */
+	err = 0;
+	parent = NULL;
+	while (au_digen(dentry) != sigen
+	       || au_iigen(dentry->d_inode) != sigen) {
+		d = dentry;
+		while (1) {
+			dput(parent);
+			parent = dget_parent(d);
+			if (au_digen(parent) == sigen
+			    && au_iigen(parent->d_inode) == sigen)
+				break;
+			d = parent;
+		}
+
+		inode = d->d_inode;
+		if (d != dentry)
+			di_write_lock_child(d);
+
+		/* someone might update our dentry while we were sleeping */
+		if (au_digen(d) != sigen || au_iigen(d->d_inode) != sigen) {
+			di_read_lock_parent(parent, AuLock_IR);
+			/* returns a number of positive dentries */
+			err = au_refresh_hdentry(d, inode->i_mode & S_IFMT);
+			if (err >= 0)
+				err = au_refresh_hinode(inode, d);
+			di_read_unlock(parent, AuLock_IR);
+		}
+
+		if (d != dentry)
+			di_write_unlock(d);
+		dput(parent);
+		if (unlikely(err))
+			break;
+	}
+
+	return err;
+}
+
+/*
+ * if valid returns 1, otherwise 0.
+ */
+static int aufs_d_revalidate(struct dentry *dentry, struct nameidata *nd)
+{
+	int valid, err;
+	unsigned int sigen;
+	unsigned char do_udba;
+	struct super_block *sb;
+	struct inode *inode;
+
+	err = -EINVAL;
+	sb = dentry->d_sb;
+	inode = dentry->d_inode;
+	aufs_read_lock(dentry, AuLock_FLUSH | AuLock_DW);
+	sigen = au_sigen(sb);
+	if (au_digen(dentry) != sigen) {
+		AuDebugOn(IS_ROOT(dentry));
+		if (inode)
+			err = au_reval_dpath(dentry, sigen);
+		if (unlikely(err))
+			goto out_dgrade;
+		AuDebugOn(au_digen(dentry) != sigen);
+	}
+	if (inode && au_iigen(inode) != sigen) {
+		AuDebugOn(IS_ROOT(dentry));
+		err = au_refresh_hinode(inode, dentry);
+		if (unlikely(err))
+			goto out_dgrade;
+		AuDebugOn(au_iigen(inode) != sigen);
+	}
+	di_downgrade_lock(dentry, AuLock_IR);
+
+	AuDebugOn(au_digen(dentry) != sigen);
+	AuDebugOn(inode && au_iigen(inode) != sigen);
+	err = -EINVAL;
+	do_udba = !au_opt_test(au_mntflags(sb), UDBA_NONE);
+	if (do_udba && inode) {
+		aufs_bindex_t bstart = au_ibstart(inode);
+
+		if (bstart >= 0
+		    && au_test_higen(inode, au_h_iptr(inode, bstart)))
+			goto out;
+	}
+
+	err = h_d_revalidate(dentry, inode, nd, do_udba);
+	if (unlikely(!err && do_udba && au_dbstart(dentry) < 0))
+		/* both of real entry and whiteout found */
+		err = -EIO;
+	goto out;
+
+ out_dgrade:
+	di_downgrade_lock(dentry, AuLock_IR);
+ out:
+	au_store_oflag(nd, inode);
+	aufs_read_unlock(dentry, AuLock_IR);
+	AuTraceErr(err);
+	valid = !err;
+	if (!valid)
+		AuDbg("%.*s invalid\n", AuDLNPair(dentry));
+	return valid;
+}
+
+static void aufs_d_release(struct dentry *dentry)
+{
+	struct au_dinfo *dinfo;
+	aufs_bindex_t bend, bindex;
+
+	dinfo = dentry->d_fsdata;
+	if (!dinfo)
+		return;
+
+	/* dentry may not be revalidated */
+	bindex = dinfo->di_bstart;
+	if (bindex >= 0) {
+		struct au_hdentry *p;
+
+		bend = dinfo->di_bend;
+		p = dinfo->di_hdentry + bindex;
+		while (bindex++ <= bend) {
+			if (p->hd_dentry)
+				au_hdput(p);
+			p++;
+		}
+	}
+	kfree(dinfo->di_hdentry);
+	AuRwDestroy(&dinfo->di_rwsem);
+	au_cache_free_dinfo(dinfo);
+	au_hin_di_reinit(dentry);
+}
+
+struct dentry_operations aufs_dop = {
+	.d_revalidate	= aufs_d_revalidate,
+	.d_release	= aufs_d_release
+};
--- linux-rt-2.6.31.orig/ubuntu/aufs/dir.c
+++ linux-rt-2.6.31/ubuntu/aufs/dir.c
@@ -0,0 +1,538 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * directory operations
+ */
+
+#include <linux/file.h>
+#include <linux/fs_stack.h>
+#include "aufs.h"
+
+void au_add_nlink(struct inode *dir, struct inode *h_dir)
+{
+	AuDebugOn(!S_ISDIR(dir->i_mode) || !S_ISDIR(h_dir->i_mode));
+
+	dir->i_nlink += h_dir->i_nlink - 2;
+	if (h_dir->i_nlink < 2)
+		dir->i_nlink += 2;
+}
+
+void au_sub_nlink(struct inode *dir, struct inode *h_dir)
+{
+	AuDebugOn(!S_ISDIR(dir->i_mode) || !S_ISDIR(h_dir->i_mode));
+
+	dir->i_nlink -= h_dir->i_nlink - 2;
+	if (h_dir->i_nlink < 2)
+		dir->i_nlink -= 2;
+}
+
+/* ---------------------------------------------------------------------- */
+
+static int reopen_dir(struct file *file)
+{
+	int err;
+	unsigned int flags;
+	aufs_bindex_t bindex, btail, bstart;
+	struct dentry *dentry, *h_dentry;
+	struct file *h_file;
+
+	/* open all lower dirs */
+	dentry = file->f_dentry;
+	bstart = au_dbstart(dentry);
+	for (bindex = au_fbstart(file); bindex < bstart; bindex++)
+		au_set_h_fptr(file, bindex, NULL);
+	au_set_fbstart(file, bstart);
+
+	btail = au_dbtaildir(dentry);
+	for (bindex = au_fbend(file); btail < bindex; bindex--)
+		au_set_h_fptr(file, bindex, NULL);
+	au_set_fbend(file, btail);
+
+	flags = file->f_flags;
+	for (bindex = bstart; bindex <= btail; bindex++) {
+		h_dentry = au_h_dptr(dentry, bindex);
+		if (!h_dentry)
+			continue;
+		h_file = au_h_fptr(file, bindex);
+		if (h_file)
+			continue;
+
+		h_file = au_h_open(dentry, bindex, flags, file);
+		err = PTR_ERR(h_file);
+		if (IS_ERR(h_file))
+			goto out; /* close all? */
+		au_set_h_fptr(file, bindex, h_file);
+	}
+	au_update_figen(file);
+	/* todo: necessary? */
+	/* file->f_ra = h_file->f_ra; */
+	err = 0;
+
+ out:
+	return err;
+}
+
+static int do_open_dir(struct file *file, int flags)
+{
+	int err;
+	aufs_bindex_t bindex, btail;
+	struct dentry *dentry, *h_dentry;
+	struct file *h_file;
+
+	FiMustWriteLock(file);
+
+	err = 0;
+	dentry = file->f_dentry;
+	au_set_fvdir_cache(file, NULL);
+	au_fi(file)->fi_maintain_plink = 0;
+	file->f_version = dentry->d_inode->i_version;
+	bindex = au_dbstart(dentry);
+	au_set_fbstart(file, bindex);
+	btail = au_dbtaildir(dentry);
+	au_set_fbend(file, btail);
+	for (; !err && bindex <= btail; bindex++) {
+		h_dentry = au_h_dptr(dentry, bindex);
+		if (!h_dentry)
+			continue;
+
+		h_file = au_h_open(dentry, bindex, flags, file);
+		if (IS_ERR(h_file)) {
+			err = PTR_ERR(h_file);
+			break;
+		}
+		au_set_h_fptr(file, bindex, h_file);
+	}
+	au_update_figen(file);
+	/* todo: necessary? */
+	/* file->f_ra = h_file->f_ra; */
+	if (!err)
+		return 0; /* success */
+
+	/* close all */
+	for (bindex = au_fbstart(file); bindex <= btail; bindex++)
+		au_set_h_fptr(file, bindex, NULL);
+	au_set_fbstart(file, -1);
+	au_set_fbend(file, -1);
+	return err;
+}
+
+static int aufs_open_dir(struct inode *inode __maybe_unused,
+			 struct file *file)
+{
+	return au_do_open(file, do_open_dir);
+}
+
+static int aufs_release_dir(struct inode *inode __maybe_unused,
+			    struct file *file)
+{
+	struct au_vdir *vdir_cache;
+	struct super_block *sb;
+	struct au_sbinfo *sbinfo;
+
+	sb = file->f_dentry->d_sb;
+	si_noflush_read_lock(sb);
+	fi_write_lock(file);
+	vdir_cache = au_fvdir_cache(file);
+	if (vdir_cache)
+		au_vdir_free(vdir_cache);
+	if (au_fi(file)->fi_maintain_plink) {
+		sbinfo = au_sbi(sb);
+		/* clear the flag without write-lock */
+		sbinfo->au_si_status &= ~AuSi_MAINTAIN_PLINK;
+		smp_mb();
+		wake_up_all(&sbinfo->si_plink_wq);
+	}
+	fi_write_unlock(file);
+	au_finfo_fin(file);
+	si_read_unlock(sb);
+	return 0;
+}
+
+/* ---------------------------------------------------------------------- */
+
+static int au_do_fsync_dir_no_file(struct dentry *dentry, int datasync)
+{
+	int err;
+	aufs_bindex_t bend, bindex;
+	struct inode *inode;
+	struct super_block *sb;
+
+	err = 0;
+	sb = dentry->d_sb;
+	inode = dentry->d_inode;
+	IMustLock(inode);
+	bend = au_dbend(dentry);
+	for (bindex = au_dbstart(dentry); !err && bindex <= bend; bindex++) {
+		struct path h_path;
+		struct inode *h_inode;
+
+		if (au_test_ro(sb, bindex, inode))
+			continue;
+		h_path.dentry = au_h_dptr(dentry, bindex);
+		if (!h_path.dentry)
+			continue;
+		h_inode = h_path.dentry->d_inode;
+		if (!h_inode)
+			continue;
+
+		/* no mnt_want_write() */
+		/* cf. fs/nsfd/vfs.c and fs/nfsd/nfs4recover.c */
+		/* todo: inotiry fired? */
+		h_path.mnt = au_sbr_mnt(sb, bindex);
+		mutex_lock(&h_inode->i_mutex);
+		err = filemap_fdatawrite(h_inode->i_mapping);
+		AuDebugOn(!h_inode->i_fop);
+		if (!err && h_inode->i_fop->fsync)
+			err = h_inode->i_fop->fsync(NULL, h_path.dentry,
+						    datasync);
+		if (!err)
+			err = filemap_fdatawrite(h_inode->i_mapping);
+		if (!err)
+			vfsub_update_h_iattr(&h_path, /*did*/NULL); /*ignore*/
+		mutex_unlock(&h_inode->i_mutex);
+	}
+
+	return err;
+}
+
+static int au_do_fsync_dir(struct file *file, int datasync)
+{
+	int err;
+	aufs_bindex_t bend, bindex;
+	struct file *h_file;
+	struct super_block *sb;
+	struct inode *inode;
+	struct mutex *h_mtx;
+
+	err = au_reval_and_lock_fdi(file, reopen_dir, /*wlock*/1);
+	if (unlikely(err))
+		goto out;
+
+	sb = file->f_dentry->d_sb;
+	inode = file->f_dentry->d_inode;
+	bend = au_fbend(file);
+	for (bindex = au_fbstart(file); !err && bindex <= bend; bindex++) {
+		h_file = au_h_fptr(file, bindex);
+		if (!h_file || au_test_ro(sb, bindex, inode))
+			continue;
+
+		err = vfs_fsync(h_file, h_file->f_dentry, datasync);
+		if (!err) {
+			h_mtx = &h_file->f_dentry->d_inode->i_mutex;
+			mutex_lock(h_mtx);
+			vfsub_update_h_iattr(&h_file->f_path, /*did*/NULL);
+			/*ignore*/
+			mutex_unlock(h_mtx);
+		}
+	}
+
+ out:
+	return err;
+}
+
+/*
+ * @file may be NULL
+ */
+static int aufs_fsync_dir(struct file *file, struct dentry *dentry,
+			  int datasync)
+{
+	int err;
+	struct super_block *sb;
+
+	IMustLock(dentry->d_inode);
+
+	err = 0;
+	sb = dentry->d_sb;
+	si_noflush_read_lock(sb);
+	if (file)
+		err = au_do_fsync_dir(file, datasync);
+	else {
+		di_write_lock_child(dentry);
+		err = au_do_fsync_dir_no_file(dentry, datasync);
+	}
+	au_cpup_attr_timesizes(dentry->d_inode);
+	di_write_unlock(dentry);
+	if (file)
+		fi_write_unlock(file);
+
+	si_read_unlock(sb);
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+static int aufs_readdir(struct file *file, void *dirent, filldir_t filldir)
+{
+	int err;
+	struct dentry *dentry;
+	struct inode *inode;
+	struct super_block *sb;
+
+	dentry = file->f_dentry;
+	inode = dentry->d_inode;
+	IMustLock(inode);
+
+	sb = dentry->d_sb;
+	si_read_lock(sb, AuLock_FLUSH);
+	err = au_reval_and_lock_fdi(file, reopen_dir, /*wlock*/1);
+	if (unlikely(err))
+		goto out;
+	err = au_vdir_init(file);
+	di_downgrade_lock(dentry, AuLock_IR);
+	if (unlikely(err))
+		goto out_unlock;
+
+	if (!au_test_nfsd(current)) {
+		err = au_vdir_fill_de(file, dirent, filldir);
+		fsstack_copy_attr_atime(inode,
+					au_h_iptr(inode, au_ibstart(inode)));
+	} else {
+		/*
+		 * nfsd filldir may call lookup_one_len(), vfs_getattr(),
+		 * encode_fh() and others.
+		 */
+		struct inode *h_inode = au_h_iptr(inode, au_ibstart(inode));
+
+		di_read_unlock(dentry, AuLock_IR);
+		si_read_unlock(sb);
+		lockdep_off();
+		err = au_vdir_fill_de(file, dirent, filldir);
+		lockdep_on();
+		fsstack_copy_attr_atime(inode, h_inode);
+		fi_write_unlock(file);
+
+		AuTraceErr(err);
+		return err;
+	}
+
+ out_unlock:
+	di_read_unlock(dentry, AuLock_IR);
+	fi_write_unlock(file);
+ out:
+	si_read_unlock(sb);
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+#define AuTestEmpty_WHONLY	1
+#define AuTestEmpty_CALLED	(1 << 1)
+#define AuTestEmpty_SHWH	(1 << 2)
+#define au_ftest_testempty(flags, name)	((flags) & AuTestEmpty_##name)
+#define au_fset_testempty(flags, name)	{ (flags) |= AuTestEmpty_##name; }
+#define au_fclr_testempty(flags, name)	{ (flags) &= ~AuTestEmpty_##name; }
+
+#ifndef CONFIG_AUFS_SHWH
+#undef AuTestEmpty_SHWH
+#define AuTestEmpty_SHWH	0
+#endif
+
+struct test_empty_arg {
+	struct au_nhash whlist;
+	unsigned int flags;
+	int err;
+	aufs_bindex_t bindex;
+};
+
+static int test_empty_cb(void *__arg, const char *__name, int namelen,
+			 loff_t offset __maybe_unused, u64 ino,
+			 unsigned int d_type)
+{
+	struct test_empty_arg *arg = __arg;
+	char *name = (void *)__name;
+
+	arg->err = 0;
+	au_fset_testempty(arg->flags, CALLED);
+	/* smp_mb(); */
+	if (name[0] == '.'
+	    && (namelen == 1 || (name[1] == '.' && namelen == 2)))
+		goto out; /* success */
+
+	if (namelen <= AUFS_WH_PFX_LEN
+	    || memcmp(name, AUFS_WH_PFX, AUFS_WH_PFX_LEN)) {
+		if (au_ftest_testempty(arg->flags, WHONLY)
+		    && !au_nhash_test_known_wh(&arg->whlist, name, namelen))
+			arg->err = -ENOTEMPTY;
+		goto out;
+	}
+
+	name += AUFS_WH_PFX_LEN;
+	namelen -= AUFS_WH_PFX_LEN;
+	if (!au_nhash_test_known_wh(&arg->whlist, name, namelen))
+		arg->err = au_nhash_append_wh
+			(&arg->whlist, name, namelen, ino, d_type, arg->bindex,
+			 au_ftest_testempty(arg->flags, SHWH));
+
+ out:
+	/* smp_mb(); */
+	AuTraceErr(arg->err);
+	return arg->err;
+}
+
+static int do_test_empty(struct dentry *dentry, struct test_empty_arg *arg)
+{
+	int err;
+	struct file *h_file;
+
+	h_file = au_h_open(dentry, arg->bindex,
+			   O_RDONLY | O_NONBLOCK | O_DIRECTORY | O_LARGEFILE,
+			   /*file*/NULL);
+	err = PTR_ERR(h_file);
+	if (IS_ERR(h_file))
+		goto out;
+
+	err = 0;
+	if (!au_opt_test(au_mntflags(dentry->d_sb), UDBA_NONE)
+	    && !h_file->f_dentry->d_inode->i_nlink)
+		goto out_put;
+
+	do {
+		arg->err = 0;
+		au_fclr_testempty(arg->flags, CALLED);
+		/* smp_mb(); */
+		err = vfsub_readdir(h_file, test_empty_cb, arg);
+		if (err >= 0)
+			err = arg->err;
+	} while (!err && au_ftest_testempty(arg->flags, CALLED));
+
+ out_put:
+	fput(h_file);
+	au_sbr_put(dentry->d_sb, arg->bindex);
+ out:
+	return err;
+}
+
+struct do_test_empty_args {
+	int *errp;
+	struct dentry *dentry;
+	struct test_empty_arg *arg;
+};
+
+static void call_do_test_empty(void *args)
+{
+	struct do_test_empty_args *a = args;
+	*a->errp = do_test_empty(a->dentry, a->arg);
+}
+
+static int sio_test_empty(struct dentry *dentry, struct test_empty_arg *arg)
+{
+	int err, wkq_err;
+	struct dentry *h_dentry;
+	struct inode *h_inode;
+
+	h_dentry = au_h_dptr(dentry, arg->bindex);
+	h_inode = h_dentry->d_inode;
+	mutex_lock_nested(&h_inode->i_mutex, AuLsc_I_CHILD);
+	err = au_test_h_perm_sio(h_inode, MAY_EXEC | MAY_READ);
+	mutex_unlock(&h_inode->i_mutex);
+	if (!err)
+		err = do_test_empty(dentry, arg);
+	else {
+		struct do_test_empty_args args = {
+			.errp	= &err,
+			.dentry	= dentry,
+			.arg	= arg
+		};
+		unsigned int flags = arg->flags;
+
+		wkq_err = au_wkq_wait(call_do_test_empty, &args);
+		if (unlikely(wkq_err))
+			err = wkq_err;
+		arg->flags = flags;
+	}
+
+	return err;
+}
+
+int au_test_empty_lower(struct dentry *dentry)
+{
+	int err;
+	aufs_bindex_t bindex, bstart, btail;
+	struct test_empty_arg arg;
+
+	SiMustAnyLock(dentry->d_sb);
+
+	err = au_nhash_alloc(&arg.whlist, au_sbi(dentry->d_sb)->si_rdhash,
+			     GFP_NOFS);
+	if (unlikely(err))
+		goto out;
+
+	bstart = au_dbstart(dentry);
+	arg.flags = 0;
+	if (au_opt_test(au_mntflags(dentry->d_sb), SHWH))
+		au_fset_testempty(arg.flags, SHWH);
+	arg.bindex = bstart;
+	err = do_test_empty(dentry, &arg);
+	if (unlikely(err))
+		goto out_whlist;
+
+	au_fset_testempty(arg.flags, WHONLY);
+	btail = au_dbtaildir(dentry);
+	for (bindex = bstart + 1; !err && bindex <= btail; bindex++) {
+		struct dentry *h_dentry;
+
+		h_dentry = au_h_dptr(dentry, bindex);
+		if (h_dentry && h_dentry->d_inode) {
+			arg.bindex = bindex;
+			err = do_test_empty(dentry, &arg);
+		}
+	}
+
+ out_whlist:
+	au_nhash_wh_free(&arg.whlist);
+ out:
+	return err;
+}
+
+int au_test_empty(struct dentry *dentry, struct au_nhash *whlist)
+{
+	int err;
+	struct test_empty_arg arg;
+	aufs_bindex_t bindex, btail;
+
+	err = 0;
+	arg.whlist = *whlist;
+	arg.flags = AuTestEmpty_WHONLY;
+	if (au_opt_test(au_mntflags(dentry->d_sb), SHWH))
+		au_fset_testempty(arg.flags, SHWH);
+	btail = au_dbtaildir(dentry);
+	for (bindex = au_dbstart(dentry); !err && bindex <= btail; bindex++) {
+		struct dentry *h_dentry;
+
+		h_dentry = au_h_dptr(dentry, bindex);
+		if (h_dentry && h_dentry->d_inode) {
+			arg.bindex = bindex;
+			err = sio_test_empty(dentry, &arg);
+		}
+	}
+
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+const struct file_operations aufs_dir_fop = {
+	.read		= generic_read_dir,
+	.readdir	= aufs_readdir,
+	.unlocked_ioctl	= aufs_ioctl_dir,
+	.open		= aufs_open_dir,
+	.release	= aufs_release_dir,
+	.flush		= aufs_flush,
+	.fsync		= aufs_fsync_dir
+};
--- linux-rt-2.6.31.orig/ubuntu/aufs/i_op_del.c
+++ linux-rt-2.6.31/ubuntu/aufs/i_op_del.c
@@ -0,0 +1,468 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * inode operations (del entry)
+ */
+
+#include "aufs.h"
+
+/*
+ * decide if a new whiteout for @dentry is necessary or not.
+ * when it is necessary, prepare the parent dir for the upper branch whose
+ * branch index is @bcpup for creation. the actual creation of the whiteout will
+ * be done by caller.
+ * return value:
+ * 0: wh is unnecessary
+ * plus: wh is necessary
+ * minus: error
+ */
+int au_wr_dir_need_wh(struct dentry *dentry, int isdir, aufs_bindex_t *bcpup)
+{
+	int need_wh, err;
+	aufs_bindex_t bstart;
+	struct super_block *sb;
+
+	sb = dentry->d_sb;
+	bstart = au_dbstart(dentry);
+	if (*bcpup < 0) {
+		*bcpup = bstart;
+		if (au_test_ro(sb, bstart, dentry->d_inode)) {
+			err = AuWbrCopyup(au_sbi(sb), dentry);
+			*bcpup = err;
+			if (unlikely(err < 0))
+				goto out;
+		}
+	} else
+		AuDebugOn(bstart < *bcpup
+			  || au_test_ro(sb, *bcpup, dentry->d_inode));
+	AuDbg("bcpup %d, bstart %d\n", *bcpup, bstart);
+
+	if (*bcpup != bstart) {
+		err = au_cpup_dirs(dentry, *bcpup);
+		if (unlikely(err))
+			goto out;
+		need_wh = 1;
+	} else {
+		aufs_bindex_t old_bend, new_bend, bdiropq = -1;
+
+		old_bend = au_dbend(dentry);
+		if (isdir) {
+			bdiropq = au_dbdiropq(dentry);
+			au_set_dbdiropq(dentry, -1);
+		}
+		need_wh = au_lkup_dentry(dentry, bstart + 1, /*type*/0,
+					 /*nd*/NULL);
+		err = need_wh;
+		if (isdir)
+			au_set_dbdiropq(dentry, bdiropq);
+		if (unlikely(err < 0))
+			goto out;
+		new_bend = au_dbend(dentry);
+		if (!need_wh && old_bend != new_bend) {
+			au_set_h_dptr(dentry, new_bend, NULL);
+			au_set_dbend(dentry, old_bend);
+		}
+	}
+	AuDbg("need_wh %d\n", need_wh);
+	err = need_wh;
+
+ out:
+	return err;
+}
+
+/*
+ * simple tests for the del-entry operations.
+ * following the checks in vfs, plus the parent-child relationship.
+ */
+int au_may_del(struct dentry *dentry, aufs_bindex_t bindex,
+	       struct dentry *h_parent, int isdir)
+{
+	int err;
+	umode_t h_mode;
+	struct dentry *h_dentry, *h_latest;
+	struct inode *h_inode;
+
+	h_dentry = au_h_dptr(dentry, bindex);
+	h_inode = h_dentry->d_inode;
+	if (dentry->d_inode) {
+		err = -ENOENT;
+		if (unlikely(!h_inode || !h_inode->i_nlink))
+			goto out;
+
+		h_mode = h_inode->i_mode;
+		if (!isdir) {
+			err = -EISDIR;
+			if (unlikely(S_ISDIR(h_mode)))
+				goto out;
+		} else if (unlikely(!S_ISDIR(h_mode))) {
+			err = -ENOTDIR;
+			goto out;
+		}
+	} else {
+		/* rename(2) case */
+		err = -EIO;
+		if (unlikely(h_inode))
+			goto out;
+	}
+
+	err = -ENOENT;
+	/* expected parent dir is locked */
+	if (unlikely(h_parent != h_dentry->d_parent))
+		goto out;
+	err = 0;
+
+	/*
+	 * rmdir a dir may break the consistency on some filesystem.
+	 * let's try heavy test.
+	 */
+	err = -EACCES;
+	if (unlikely(au_test_h_perm(h_parent->d_inode, MAY_EXEC | MAY_WRITE)))
+		goto out;
+
+	h_latest = au_sio_lkup_one(&dentry->d_name, h_parent,
+				   au_sbr(dentry->d_sb, bindex));
+	err = -EIO;
+	if (IS_ERR(h_latest))
+		goto out;
+	if (h_latest == h_dentry)
+		err = 0;
+	dput(h_latest);
+
+ out:
+	return err;
+}
+
+/*
+ * decide the branch where we operate for @dentry. the branch index will be set
+ * @rbcpup. after diciding it, 'pin' it and store the timestamps of the parent
+ * dir for reverting.
+ * when a new whiteout is necessary, create it.
+ */
+static struct dentry*
+lock_hdir_create_wh(struct dentry *dentry, int isdir, aufs_bindex_t *rbcpup,
+		    struct au_dtime *dt, struct au_pin *pin)
+{
+	struct dentry *wh_dentry;
+	struct super_block *sb;
+	struct path h_path;
+	int err, need_wh;
+	unsigned int udba;
+	aufs_bindex_t bcpup;
+
+	need_wh = au_wr_dir_need_wh(dentry, isdir, rbcpup);
+	wh_dentry = ERR_PTR(need_wh);
+	if (unlikely(need_wh < 0))
+		goto out;
+
+	sb = dentry->d_sb;
+	udba = au_opt_udba(sb);
+	bcpup = *rbcpup;
+	err = au_pin(pin, dentry, bcpup, udba,
+		     AuPin_DI_LOCKED | AuPin_MNT_WRITE);
+	wh_dentry = ERR_PTR(err);
+	if (unlikely(err))
+		goto out;
+
+	h_path.dentry = au_pinned_h_parent(pin);
+	if (udba != AuOpt_UDBA_NONE
+	    && au_dbstart(dentry) == bcpup) {
+		err = au_may_del(dentry, bcpup, h_path.dentry, isdir);
+		wh_dentry = ERR_PTR(err);
+		if (unlikely(err))
+			goto out_unpin;
+	}
+
+	h_path.mnt = au_sbr_mnt(sb, bcpup);
+	au_dtime_store(dt, au_pinned_parent(pin), &h_path);
+	wh_dentry = NULL;
+	if (!need_wh)
+		goto out; /* success, no need to create whiteout */
+
+	wh_dentry = au_wh_create(dentry, bcpup, h_path.dentry);
+	if (!IS_ERR(wh_dentry))
+		goto out; /* success */
+	/* returns with the parent is locked and wh_dentry is dget-ed */
+
+ out_unpin:
+	au_unpin(pin);
+ out:
+	return wh_dentry;
+}
+
+/*
+ * when removing a dir, rename it to a unique temporary whiteout-ed name first
+ * in order to be revertible and save time for removing many child whiteouts
+ * under the dir.
+ * returns 1 when there are too many child whiteout and caller should remove
+ * them asynchronously. returns 0 when the number of children is enough small to
+ * remove now or the branch fs is a remote fs.
+ * otherwise return an error.
+ */
+static int renwh_and_rmdir(struct dentry *dentry, aufs_bindex_t bindex,
+			   struct au_nhash *whlist, struct inode *dir)
+{
+	int rmdir_later, err, dirwh;
+	struct dentry *h_dentry;
+	struct super_block *sb;
+
+	sb = dentry->d_sb;
+	SiMustAnyLock(sb);
+	h_dentry = au_h_dptr(dentry, bindex);
+	err = au_whtmp_ren(h_dentry, au_sbr(sb, bindex));
+	if (unlikely(err))
+		goto out;
+
+	/* stop monitoring */
+	au_hin_free(au_hi(dentry->d_inode, bindex));
+
+	if (!au_test_fs_remote(h_dentry->d_sb)) {
+		dirwh = au_sbi(sb)->si_dirwh;
+		rmdir_later = (dirwh <= 1);
+		if (!rmdir_later)
+			rmdir_later = au_nhash_test_longer_wh(whlist, bindex,
+							      dirwh);
+		if (rmdir_later)
+			return rmdir_later;
+	}
+
+	err = au_whtmp_rmdir(dir, bindex, h_dentry, whlist);
+	if (unlikely(err)) {
+		AuIOErr("rmdir %.*s, b%d failed, %d. ignored\n",
+			AuDLNPair(h_dentry), bindex, err);
+		err = 0;
+	}
+
+ out:
+	return err;
+}
+
+/*
+ * final procedure for deleting a entry.
+ * maintain dentry and iattr.
+ */
+static void epilog(struct inode *dir, struct dentry *dentry,
+		   aufs_bindex_t bindex)
+{
+	struct inode *inode;
+
+	inode = dentry->d_inode;
+	d_drop(dentry);
+	inode->i_ctime = dir->i_ctime;
+
+	if (atomic_read(&dentry->d_count) == 1) {
+		au_set_h_dptr(dentry, au_dbstart(dentry), NULL);
+		au_update_dbstart(dentry);
+	}
+	if (au_ibstart(dir) == bindex)
+		au_cpup_attr_timesizes(dir);
+	dir->i_version++;
+}
+
+/*
+ * when an error happened, remove the created whiteout and revert everything.
+ */
+static int do_revert(int err, struct inode *dir, aufs_bindex_t bwh,
+		     struct dentry *wh_dentry, struct dentry *dentry,
+		     struct au_dtime *dt)
+{
+	int rerr;
+	struct path h_path = {
+		.dentry	= wh_dentry,
+		.mnt	= au_sbr_mnt(dir->i_sb, bwh)
+	};
+
+	rerr = au_wh_unlink_dentry(au_h_iptr(dir, bwh), &h_path, dentry);
+	if (!rerr) {
+		au_set_dbwh(dentry, bwh);
+		au_dtime_revert(dt);
+		return 0;
+	}
+
+	AuIOErr("%.*s reverting whiteout failed(%d, %d)\n",
+		AuDLNPair(dentry), err, rerr);
+	return -EIO;
+}
+
+/* ---------------------------------------------------------------------- */
+
+int aufs_unlink(struct inode *dir, struct dentry *dentry)
+{
+	int err;
+	aufs_bindex_t bwh, bindex, bstart;
+	struct au_dtime dt;
+	struct au_pin pin;
+	struct path h_path;
+	struct inode *inode, *h_dir;
+	struct dentry *parent, *wh_dentry;
+
+	IMustLock(dir);
+	inode = dentry->d_inode;
+	if (unlikely(!inode))
+		return -ENOENT; /* possible? */
+	IMustLock(inode);
+
+	aufs_read_lock(dentry, AuLock_DW);
+	parent = dentry->d_parent; /* dir inode is locked */
+	di_write_lock_parent(parent);
+
+	bstart = au_dbstart(dentry);
+	bwh = au_dbwh(dentry);
+	bindex = -1;
+	wh_dentry = lock_hdir_create_wh(dentry, /*isdir*/0, &bindex, &dt, &pin);
+	err = PTR_ERR(wh_dentry);
+	if (IS_ERR(wh_dentry))
+		goto out;
+
+	h_path.mnt = au_sbr_mnt(dentry->d_sb, bstart);
+	h_path.dentry = au_h_dptr(dentry, bstart);
+	dget(h_path.dentry);
+	if (bindex == bstart) {
+		h_dir = au_pinned_h_dir(&pin);
+		err = vfsub_unlink(h_dir, &h_path, /*force*/0);
+	} else {
+		/* dir inode is locked */
+		h_dir = wh_dentry->d_parent->d_inode;
+		IMustLock(h_dir);
+		err = 0;
+	}
+
+	if (!err) {
+		drop_nlink(inode);
+		epilog(dir, dentry, bindex);
+
+		/* update target timestamps */
+		if (bindex == bstart) {
+			vfsub_update_h_iattr(&h_path, /*did*/NULL); /*ignore*/
+			inode->i_ctime = h_path.dentry->d_inode->i_ctime;
+		} else
+			/* todo: this timestamp may be reverted later */
+			inode->i_ctime = h_dir->i_ctime;
+		goto out_unlock; /* success */
+	}
+
+	/* revert */
+	if (wh_dentry) {
+		int rerr;
+
+		rerr = do_revert(err, dir, bwh, wh_dentry, dentry, &dt);
+		if (rerr)
+			err = rerr;
+	}
+
+ out_unlock:
+	au_unpin(&pin);
+	dput(wh_dentry);
+	dput(h_path.dentry);
+ out:
+	di_write_unlock(parent);
+	aufs_read_unlock(dentry, AuLock_DW);
+	return err;
+}
+
+int aufs_rmdir(struct inode *dir, struct dentry *dentry)
+{
+	int err, rmdir_later;
+	aufs_bindex_t bwh, bindex, bstart;
+	struct au_dtime dt;
+	struct au_pin pin;
+	struct inode *inode;
+	struct dentry *parent, *wh_dentry, *h_dentry;
+	struct au_whtmp_rmdir *args;
+
+	IMustLock(dir);
+	inode = dentry->d_inode;
+	err = -ENOENT; /* possible? */
+	if (unlikely(!inode))
+		goto out;
+	IMustLock(inode);
+
+	aufs_read_lock(dentry, AuLock_DW | AuLock_FLUSH);
+	err = -ENOMEM;
+	args = au_whtmp_rmdir_alloc(dir->i_sb, GFP_NOFS);
+	if (unlikely(!args))
+		goto out_unlock;
+
+	parent = dentry->d_parent; /* dir inode is locked */
+	di_write_lock_parent(parent);
+	err = au_test_empty(dentry, &args->whlist);
+	if (unlikely(err))
+		goto out_args;
+
+	bstart = au_dbstart(dentry);
+	bwh = au_dbwh(dentry);
+	bindex = -1;
+	wh_dentry = lock_hdir_create_wh(dentry, /*isdir*/1, &bindex, &dt, &pin);
+	err = PTR_ERR(wh_dentry);
+	if (IS_ERR(wh_dentry))
+		goto out_args;
+
+	h_dentry = au_h_dptr(dentry, bstart);
+	dget(h_dentry);
+	rmdir_later = 0;
+	if (bindex == bstart) {
+		err = renwh_and_rmdir(dentry, bstart, &args->whlist, dir);
+		if (err > 0) {
+			rmdir_later = err;
+			err = 0;
+		}
+	} else {
+		/* stop monitoring */
+		au_hin_free(au_hi(inode, bstart));
+
+		/* dir inode is locked */
+		IMustLock(wh_dentry->d_parent->d_inode);
+		err = 0;
+	}
+
+	if (!err) {
+		clear_nlink(inode);
+		au_set_dbdiropq(dentry, -1);
+		epilog(dir, dentry, bindex);
+
+		if (rmdir_later) {
+			au_whtmp_kick_rmdir(dir, bstart, h_dentry, args);
+			args = NULL;
+		}
+
+		goto out_unpin; /* success */
+	}
+
+	/* revert */
+	AuLabel(revert);
+	if (wh_dentry) {
+		int rerr;
+
+		rerr = do_revert(err, dir, bwh, wh_dentry, dentry, &dt);
+		if (rerr)
+			err = rerr;
+	}
+
+ out_unpin:
+	au_unpin(&pin);
+	dput(wh_dentry);
+	dput(h_dentry);
+ out_args:
+	di_write_unlock(parent);
+	if (args)
+		au_whtmp_rmdir_free(args);
+ out_unlock:
+	aufs_read_unlock(dentry, AuLock_DW);
+ out:
+	return err;
+}
--- linux-rt-2.6.31.orig/ubuntu/aufs/cpup.c
+++ linux-rt-2.6.31/ubuntu/aufs/cpup.c
@@ -0,0 +1,1043 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * copy-up functions, see wbr_policy.c for copy-down
+ */
+
+#include <linux/file.h>
+#include <linux/fs_stack.h>
+#include <linux/mm.h>
+#include <linux/uaccess.h>
+#include "aufs.h"
+
+void au_cpup_attr_flags(struct inode *dst, struct inode *src)
+{
+	const unsigned int mask = S_DEAD | S_SWAPFILE | S_PRIVATE
+		| S_NOATIME | S_NOCMTIME;
+
+	dst->i_flags |= src->i_flags & ~mask;
+	if (au_test_fs_notime(dst->i_sb))
+		dst->i_flags |= S_NOATIME | S_NOCMTIME;
+}
+
+void au_cpup_attr_timesizes(struct inode *inode)
+{
+	struct inode *h_inode;
+
+	h_inode = au_h_iptr(inode, au_ibstart(inode));
+	fsstack_copy_attr_times(inode, h_inode);
+	vfsub_copy_inode_size(inode, h_inode);
+}
+
+void au_cpup_attr_nlink(struct inode *inode, int force)
+{
+	struct inode *h_inode;
+	struct super_block *sb;
+	aufs_bindex_t bindex, bend;
+
+	sb = inode->i_sb;
+	bindex = au_ibstart(inode);
+	h_inode = au_h_iptr(inode, bindex);
+	if (!force
+	    && !S_ISDIR(h_inode->i_mode)
+	    && au_opt_test(au_mntflags(sb), PLINK)
+	    && au_plink_test(inode))
+		return;
+
+	inode->i_nlink = h_inode->i_nlink;
+
+	/*
+	 * fewer nlink makes find(1) noisy, but larger nlink doesn't.
+	 * it may includes whplink directory.
+	 */
+	if (S_ISDIR(h_inode->i_mode)) {
+		bend = au_ibend(inode);
+		for (bindex++; bindex <= bend; bindex++) {
+			h_inode = au_h_iptr(inode, bindex);
+			if (h_inode)
+				au_add_nlink(inode, h_inode);
+		}
+	}
+}
+
+void au_cpup_attr_changeable(struct inode *inode)
+{
+	struct inode *h_inode;
+
+	h_inode = au_h_iptr(inode, au_ibstart(inode));
+	inode->i_mode = h_inode->i_mode;
+	inode->i_uid = h_inode->i_uid;
+	inode->i_gid = h_inode->i_gid;
+	au_cpup_attr_timesizes(inode);
+	au_cpup_attr_flags(inode, h_inode);
+}
+
+void au_cpup_igen(struct inode *inode, struct inode *h_inode)
+{
+	struct au_iinfo *iinfo = au_ii(inode);
+
+	IiMustWriteLock(inode);
+
+	iinfo->ii_higen = h_inode->i_generation;
+	iinfo->ii_hsb1 = h_inode->i_sb;
+}
+
+void au_cpup_attr_all(struct inode *inode, int force)
+{
+	struct inode *h_inode;
+
+	h_inode = au_h_iptr(inode, au_ibstart(inode));
+	au_cpup_attr_changeable(inode);
+	if (inode->i_nlink > 0)
+		au_cpup_attr_nlink(inode, force);
+	inode->i_rdev = h_inode->i_rdev;
+	inode->i_blkbits = h_inode->i_blkbits;
+	au_cpup_igen(inode, h_inode);
+}
+
+/* ---------------------------------------------------------------------- */
+
+/* Note: dt_dentry and dt_h_dentry are not dget/dput-ed */
+
+/* keep the timestamps of the parent dir when cpup */
+void au_dtime_store(struct au_dtime *dt, struct dentry *dentry,
+		    struct path *h_path)
+{
+	struct inode *h_inode;
+
+	dt->dt_dentry = dentry;
+	dt->dt_h_path = *h_path;
+	h_inode = h_path->dentry->d_inode;
+	dt->dt_atime = h_inode->i_atime;
+	dt->dt_mtime = h_inode->i_mtime;
+	/* smp_mb(); */
+}
+
+void au_dtime_revert(struct au_dtime *dt)
+{
+	struct iattr attr;
+	int err;
+
+	attr.ia_atime = dt->dt_atime;
+	attr.ia_mtime = dt->dt_mtime;
+	attr.ia_valid = ATTR_FORCE | ATTR_MTIME | ATTR_MTIME_SET
+		| ATTR_ATIME | ATTR_ATIME_SET;
+
+	err = vfsub_notify_change(&dt->dt_h_path, &attr);
+	if (unlikely(err))
+		AuWarn("restoring timestamps failed(%d). ignored\n", err);
+}
+
+/* ---------------------------------------------------------------------- */
+
+static noinline_for_stack
+int cpup_iattr(struct dentry *dst, aufs_bindex_t bindex, struct dentry *h_src)
+{
+	int err, sbits;
+	struct iattr ia;
+	struct path h_path;
+	struct inode *h_isrc;
+
+	h_path.dentry = au_h_dptr(dst, bindex);
+	h_path.mnt = au_sbr_mnt(dst->d_sb, bindex);
+	h_isrc = h_src->d_inode;
+	ia.ia_valid = ATTR_FORCE | ATTR_MODE | ATTR_UID | ATTR_GID
+		| ATTR_ATIME | ATTR_MTIME
+		| ATTR_ATIME_SET | ATTR_MTIME_SET;
+	ia.ia_mode = h_isrc->i_mode;
+	ia.ia_uid = h_isrc->i_uid;
+	ia.ia_gid = h_isrc->i_gid;
+	ia.ia_atime = h_isrc->i_atime;
+	ia.ia_mtime = h_isrc->i_mtime;
+	sbits = !!(ia.ia_mode & (S_ISUID | S_ISGID));
+	au_cpup_attr_flags(h_path.dentry->d_inode, h_isrc);
+	err = vfsub_notify_change(&h_path, &ia);
+
+	/* is this nfs only? */
+	if (!err && sbits && au_test_nfs(h_path.dentry->d_sb)) {
+		ia.ia_valid = ATTR_FORCE | ATTR_MODE;
+		ia.ia_mode = h_isrc->i_mode;
+		err = vfsub_notify_change(&h_path, &ia);
+	}
+
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+static int au_do_copy_file(struct file *dst, struct file *src, loff_t len,
+			   char *buf, unsigned long blksize)
+{
+	int err;
+	size_t sz, rbytes, wbytes;
+	unsigned char all_zero;
+	char *p, *zp;
+	struct mutex *h_mtx;
+	/* reduce stack usage */
+	struct iattr *ia;
+
+	zp = page_address(ZERO_PAGE(0));
+	if (unlikely(!zp))
+		return -ENOMEM; /* possible? */
+
+	err = 0;
+	all_zero = 0;
+	while (len) {
+		AuDbg("len %lld\n", len);
+		sz = blksize;
+		if (len < blksize)
+			sz = len;
+
+		rbytes = 0;
+		/* todo: signal_pending? */
+		while (!rbytes || err == -EAGAIN || err == -EINTR) {
+			rbytes = vfsub_read_k(src, buf, sz, &src->f_pos);
+			err = rbytes;
+		}
+		if (unlikely(err < 0))
+			break;
+
+		all_zero = 0;
+		if (len >= rbytes && rbytes == blksize)
+			all_zero = !memcmp(buf, zp, rbytes);
+		if (!all_zero) {
+			wbytes = rbytes;
+			p = buf;
+			while (wbytes) {
+				size_t b;
+
+				b = vfsub_write_k(dst, p, wbytes, &dst->f_pos);
+				err = b;
+				/* todo: signal_pending? */
+				if (unlikely(err == -EAGAIN || err == -EINTR))
+					continue;
+				if (unlikely(err < 0))
+					break;
+				wbytes -= b;
+				p += b;
+			}
+		} else {
+			loff_t res;
+
+			AuLabel(hole);
+			res = vfsub_llseek(dst, rbytes, SEEK_CUR);
+			err = res;
+			if (unlikely(res < 0))
+				break;
+		}
+		len -= rbytes;
+		err = 0;
+	}
+
+	/* the last block may be a hole */
+	if (!err && all_zero) {
+		AuLabel(last hole);
+
+		err = 1;
+		if (au_test_nfs(dst->f_dentry->d_sb)) {
+			/* nfs requires this step to make last hole */
+			/* is this only nfs? */
+			do {
+				/* todo: signal_pending? */
+				err = vfsub_write_k(dst, "\0", 1, &dst->f_pos);
+			} while (err == -EAGAIN || err == -EINTR);
+			if (err == 1)
+				dst->f_pos--;
+		}
+
+		if (err == 1) {
+			ia = (void *)buf;
+			ia->ia_size = dst->f_pos;
+			ia->ia_valid = ATTR_SIZE | ATTR_FILE;
+			ia->ia_file = dst;
+			h_mtx = &dst->f_dentry->d_inode->i_mutex;
+			mutex_lock_nested(h_mtx, AuLsc_I_CHILD2);
+			err = vfsub_notify_change(&dst->f_path, ia);
+			mutex_unlock(h_mtx);
+		}
+	}
+
+	return err;
+}
+
+int au_copy_file(struct file *dst, struct file *src, loff_t len)
+{
+	int err;
+	unsigned long blksize;
+	unsigned char do_kfree;
+	char *buf;
+
+	err = -ENOMEM;
+	blksize = dst->f_dentry->d_sb->s_blocksize;
+	if (!blksize || PAGE_SIZE < blksize)
+		blksize = PAGE_SIZE;
+	AuDbg("blksize %lu\n", blksize);
+	do_kfree = (blksize != PAGE_SIZE && blksize >= sizeof(struct iattr *));
+	if (do_kfree)
+		buf = kmalloc(blksize, GFP_NOFS);
+	else
+		buf = (void *)__get_free_page(GFP_NOFS);
+	if (unlikely(!buf))
+		goto out;
+
+	if (len > (1 << 22))
+		AuDbg("copying a large file %lld\n", (long long)len);
+
+	src->f_pos = 0;
+	dst->f_pos = 0;
+	err = au_do_copy_file(dst, src, len, buf, blksize);
+	if (do_kfree)
+		kfree(buf);
+	else
+		free_page((unsigned long)buf);
+
+ out:
+	return err;
+}
+
+/*
+ * to support a sparse file which is opened with O_APPEND,
+ * we need to close the file.
+ */
+static int au_cp_regular(struct dentry *dentry, aufs_bindex_t bdst,
+			aufs_bindex_t bsrc, loff_t len)
+{
+	int err, i;
+	enum { SRC, DST };
+	struct {
+		aufs_bindex_t bindex;
+		unsigned int flags;
+		struct dentry *dentry;
+		struct file *file;
+		void *label, *label_file;
+	} *f, file[] = {
+		{
+			.bindex = bsrc,
+			.flags = O_RDONLY | O_NOATIME | O_LARGEFILE,
+			.file = NULL,
+			.label = &&out,
+			.label_file = &&out_src
+		},
+		{
+			.bindex = bdst,
+			.flags = O_WRONLY | O_NOATIME | O_LARGEFILE,
+			.file = NULL,
+			.label = &&out_src,
+			.label_file = &&out_dst
+		}
+	};
+	struct super_block *sb;
+
+	/* bsrc branch can be ro/rw. */
+	sb = dentry->d_sb;
+	f = file;
+	for (i = 0; i < 2; i++, f++) {
+		f->dentry = au_h_dptr(dentry, f->bindex);
+		f->file = au_h_open(dentry, f->bindex, f->flags, /*file*/NULL);
+		err = PTR_ERR(f->file);
+		if (IS_ERR(f->file))
+			goto *f->label;
+		err = -EINVAL;
+		if (unlikely(!f->file->f_op))
+			goto *f->label_file;
+	}
+
+	/* try stopping to update while we copyup */
+	IMustLock(file[SRC].dentry->d_inode);
+	err = au_copy_file(file[DST].file, file[SRC].file, len);
+
+ out_dst:
+	fput(file[DST].file);
+	au_sbr_put(sb, file[DST].bindex);
+ out_src:
+	fput(file[SRC].file);
+	au_sbr_put(sb, file[SRC].bindex);
+ out:
+	return err;
+}
+
+static int au_do_cpup_regular(struct dentry *dentry, aufs_bindex_t bdst,
+			      aufs_bindex_t bsrc, loff_t len,
+			      struct inode *h_dir, struct path *h_path)
+{
+	int err, rerr;
+	loff_t l;
+
+	err = 0;
+	l = i_size_read(au_h_iptr(dentry->d_inode, bsrc));
+	if (len == -1 || l < len)
+		len = l;
+	if (len)
+		err = au_cp_regular(dentry, bdst, bsrc, len);
+	if (!err)
+		goto out; /* success */
+
+	rerr = vfsub_unlink(h_dir, h_path, /*force*/0);
+	if (rerr) {
+		AuIOErr("failed unlinking cpup-ed %.*s(%d, %d)\n",
+			AuDLNPair(h_path->dentry), err, rerr);
+		err = -EIO;
+	}
+
+ out:
+	return err;
+}
+
+static int au_do_cpup_symlink(struct path *h_path, struct dentry *h_src,
+			      struct inode *h_dir)
+{
+	int err, symlen;
+	mm_segment_t old_fs;
+	char *sym;
+
+	err = -ENOSYS;
+	if (unlikely(!h_src->d_inode->i_op->readlink))
+		goto out;
+
+	err = -ENOMEM;
+	sym = __getname();
+	if (unlikely(!sym))
+		goto out;
+
+	old_fs = get_fs();
+	set_fs(KERNEL_DS);
+	symlen = h_src->d_inode->i_op->readlink(h_src, (char __user *)sym,
+						PATH_MAX);
+	err = symlen;
+	set_fs(old_fs);
+
+	if (symlen > 0) {
+		sym[symlen] = 0;
+		err = vfsub_symlink(h_dir, h_path, sym);
+	}
+	__putname(sym);
+
+ out:
+	return err;
+}
+
+/* return with the lower dst inode is locked */
+static noinline_for_stack
+int cpup_entry(struct dentry *dentry, aufs_bindex_t bdst,
+	       aufs_bindex_t bsrc, loff_t len, unsigned int flags,
+	       struct dentry *dst_parent)
+{
+	int err;
+	umode_t mode;
+	unsigned int mnt_flags;
+	unsigned char isdir;
+	const unsigned char do_dt = !!au_ftest_cpup(flags, DTIME);
+	struct au_dtime dt;
+	struct path h_path;
+	struct dentry *h_src, *h_dst, *h_parent;
+	struct inode *h_inode, *h_dir;
+	struct super_block *sb;
+
+	/* bsrc branch can be ro/rw. */
+	h_src = au_h_dptr(dentry, bsrc);
+	h_inode = h_src->d_inode;
+	AuDebugOn(h_inode != au_h_iptr(dentry->d_inode, bsrc));
+
+	/* try stopping to be referenced while we are creating */
+	h_dst = au_h_dptr(dentry, bdst);
+	h_parent = h_dst->d_parent; /* dir inode is locked */
+	h_dir = h_parent->d_inode;
+	IMustLock(h_dir);
+	AuDebugOn(h_parent != h_dst->d_parent);
+
+	sb = dentry->d_sb;
+	h_path.mnt = au_sbr_mnt(sb, bdst);
+	if (do_dt) {
+		h_path.dentry = h_parent;
+		au_dtime_store(&dt, dst_parent, &h_path);
+	}
+	h_path.dentry = h_dst;
+
+	isdir = 0;
+	mode = h_inode->i_mode;
+	switch (mode & S_IFMT) {
+	case S_IFREG:
+		/* try stopping to update while we are referencing */
+		IMustLock(h_inode);
+		err = vfsub_create(h_dir, &h_path, mode | S_IWUSR);
+		if (!err)
+			err = au_do_cpup_regular
+				(dentry, bdst, bsrc, len,
+				 au_h_iptr(dst_parent->d_inode, bdst), &h_path);
+		break;
+	case S_IFDIR:
+		isdir = 1;
+		err = vfsub_mkdir(h_dir, &h_path, mode);
+		if (!err) {
+			/*
+			 * strange behaviour from the users view,
+			 * particularry setattr case
+			 */
+			if (au_ibstart(dst_parent->d_inode) == bdst)
+				au_cpup_attr_nlink(dst_parent->d_inode,
+						   /*force*/1);
+			au_cpup_attr_nlink(dentry->d_inode, /*force*/1);
+		}
+		break;
+	case S_IFLNK:
+		err = au_do_cpup_symlink(&h_path, h_src, h_dir);
+		break;
+	case S_IFCHR:
+	case S_IFBLK:
+		AuDebugOn(!capable(CAP_MKNOD));
+		/*FALLTHROUGH*/
+	case S_IFIFO:
+	case S_IFSOCK:
+		err = vfsub_mknod(h_dir, &h_path, mode, h_inode->i_rdev);
+		break;
+	default:
+		AuIOErr("Unknown inode type 0%o\n", mode);
+		err = -EIO;
+	}
+
+	mnt_flags = au_mntflags(sb);
+	if (!au_opt_test(mnt_flags, UDBA_NONE)
+	    && !isdir
+	    && au_opt_test(mnt_flags, XINO)
+	    && h_inode->i_nlink == 1
+	    /* todo: unnecessary? */
+	    /* && dentry->d_inode->i_nlink == 1 */
+	    && bdst < bsrc
+	    && !au_ftest_cpup(flags, KEEPLINO))
+		au_xino_write(sb, bsrc, h_inode->i_ino, /*ino*/0);
+		/* ignore this error */
+
+	if (do_dt)
+		au_dtime_revert(&dt);
+	return err;
+}
+
+/*
+ * copyup the @dentry from @bsrc to @bdst.
+ * the caller must set the both of lower dentries.
+ * @len is for truncating when it is -1 copyup the entire file.
+ * in link/rename cases, @dst_parent may be different from the real one.
+ */
+static int au_cpup_single(struct dentry *dentry, aufs_bindex_t bdst,
+			  aufs_bindex_t bsrc, loff_t len, unsigned int flags,
+			  struct dentry *dst_parent)
+{
+	int err, rerr;
+	aufs_bindex_t old_ibstart;
+	unsigned char isdir, plink;
+	struct au_dtime dt;
+	struct path h_path;
+	struct dentry *h_src, *h_dst, *h_parent;
+	struct inode *dst_inode, *h_dir, *inode;
+	struct super_block *sb;
+
+	AuDebugOn(bsrc <= bdst);
+
+	sb = dentry->d_sb;
+	h_path.mnt = au_sbr_mnt(sb, bdst);
+	h_dst = au_h_dptr(dentry, bdst);
+	h_parent = h_dst->d_parent; /* dir inode is locked */
+	h_dir = h_parent->d_inode;
+	IMustLock(h_dir);
+
+	h_src = au_h_dptr(dentry, bsrc);
+	inode = dentry->d_inode;
+
+	if (!dst_parent)
+		dst_parent = dget_parent(dentry);
+	else
+		dget(dst_parent);
+
+	plink = !!au_opt_test(au_mntflags(sb), PLINK);
+	dst_inode = au_h_iptr(inode, bdst);
+	if (dst_inode) {
+		if (unlikely(!plink)) {
+			err = -EIO;
+			AuIOErr("i%lu exists on a upper branch "
+				"but plink is disabled\n", inode->i_ino);
+			goto out;
+		}
+
+		if (dst_inode->i_nlink) {
+			const int do_dt = au_ftest_cpup(flags, DTIME);
+
+			h_src = au_plink_lkup(inode, bdst);
+			err = PTR_ERR(h_src);
+			if (IS_ERR(h_src))
+				goto out;
+			if (unlikely(!h_src->d_inode)) {
+				err = -EIO;
+				AuIOErr("i%lu exists on a upper branch "
+					"but plink is broken\n", inode->i_ino);
+				dput(h_src);
+				goto out;
+			}
+
+			if (do_dt) {
+				h_path.dentry = h_parent;
+				au_dtime_store(&dt, dst_parent, &h_path);
+			}
+			h_path.dentry = h_dst;
+			err = vfsub_link(h_src, h_dir, &h_path);
+			if (do_dt)
+				au_dtime_revert(&dt);
+			dput(h_src);
+			goto out;
+		} else
+			/* todo: cpup_wh_file? */
+			/* udba work */
+			au_update_brange(inode, 1);
+	}
+
+	old_ibstart = au_ibstart(inode);
+	err = cpup_entry(dentry, bdst, bsrc, len, flags, dst_parent);
+	if (unlikely(err))
+		goto out;
+	dst_inode = h_dst->d_inode;
+	mutex_lock_nested(&dst_inode->i_mutex, AuLsc_I_CHILD2);
+
+	err = cpup_iattr(dentry, bdst, h_src);
+	isdir = S_ISDIR(dst_inode->i_mode);
+	if (!err) {
+		if (bdst < old_ibstart)
+			au_set_ibstart(inode, bdst);
+		au_set_h_iptr(inode, bdst, au_igrab(dst_inode),
+			      au_hi_flags(inode, isdir));
+		mutex_unlock(&dst_inode->i_mutex);
+		if (!isdir
+		    && h_src->d_inode->i_nlink > 1
+		    && plink)
+			au_plink_append(inode, bdst, h_dst);
+		goto out; /* success */
+	}
+
+	/* revert */
+	h_path.dentry = h_parent;
+	mutex_unlock(&dst_inode->i_mutex);
+	au_dtime_store(&dt, dst_parent, &h_path);
+	h_path.dentry = h_dst;
+	if (!isdir)
+		rerr = vfsub_unlink(h_dir, &h_path, /*force*/0);
+	else
+		rerr = vfsub_rmdir(h_dir, &h_path);
+	au_dtime_revert(&dt);
+	if (rerr) {
+		AuIOErr("failed removing broken entry(%d, %d)\n", err, rerr);
+		err = -EIO;
+	}
+
+ out:
+	dput(dst_parent);
+	return err;
+}
+
+struct au_cpup_single_args {
+	int *errp;
+	struct dentry *dentry;
+	aufs_bindex_t bdst, bsrc;
+	loff_t len;
+	unsigned int flags;
+	struct dentry *dst_parent;
+};
+
+static void au_call_cpup_single(void *args)
+{
+	struct au_cpup_single_args *a = args;
+	*a->errp = au_cpup_single(a->dentry, a->bdst, a->bsrc, a->len,
+				  a->flags, a->dst_parent);
+}
+
+int au_sio_cpup_single(struct dentry *dentry, aufs_bindex_t bdst,
+		       aufs_bindex_t bsrc, loff_t len, unsigned int flags,
+		       struct dentry *dst_parent)
+{
+	int err, wkq_err;
+	umode_t mode;
+	struct dentry *h_dentry;
+
+	h_dentry = au_h_dptr(dentry, bsrc);
+	mode = h_dentry->d_inode->i_mode & S_IFMT;
+	if ((mode != S_IFCHR && mode != S_IFBLK)
+	    || capable(CAP_MKNOD))
+		err = au_cpup_single(dentry, bdst, bsrc, len, flags,
+				     dst_parent);
+	else {
+		struct au_cpup_single_args args = {
+			.errp		= &err,
+			.dentry		= dentry,
+			.bdst		= bdst,
+			.bsrc		= bsrc,
+			.len		= len,
+			.flags		= flags,
+			.dst_parent	= dst_parent
+		};
+		wkq_err = au_wkq_wait(au_call_cpup_single, &args);
+		if (unlikely(wkq_err))
+			err = wkq_err;
+	}
+
+	return err;
+}
+
+/*
+ * copyup the @dentry from the first active lower branch to @bdst,
+ * using au_cpup_single().
+ */
+static int au_cpup_simple(struct dentry *dentry, aufs_bindex_t bdst, loff_t len,
+			  unsigned int flags)
+{
+	int err;
+	aufs_bindex_t bsrc, bend;
+
+	bend = au_dbend(dentry);
+	for (bsrc = bdst + 1; bsrc <= bend; bsrc++)
+		if (au_h_dptr(dentry, bsrc))
+			break;
+
+	err = au_lkup_neg(dentry, bdst);
+	if (!err) {
+		err = au_cpup_single(dentry, bdst, bsrc, len, flags, NULL);
+		if (!err)
+			return 0; /* success */
+
+		/* revert */
+		au_set_h_dptr(dentry, bdst, NULL);
+		au_set_dbstart(dentry, bsrc);
+	}
+
+	return err;
+}
+
+struct au_cpup_simple_args {
+	int *errp;
+	struct dentry *dentry;
+	aufs_bindex_t bdst;
+	loff_t len;
+	unsigned int flags;
+};
+
+static void au_call_cpup_simple(void *args)
+{
+	struct au_cpup_simple_args *a = args;
+	*a->errp = au_cpup_simple(a->dentry, a->bdst, a->len, a->flags);
+}
+
+int au_sio_cpup_simple(struct dentry *dentry, aufs_bindex_t bdst, loff_t len,
+		       unsigned int flags)
+{
+	int err, wkq_err;
+	unsigned char do_sio;
+	struct dentry *parent;
+	struct inode *h_dir;
+
+	parent = dget_parent(dentry);
+	h_dir = au_h_iptr(parent->d_inode, bdst);
+	do_sio = !!au_test_h_perm_sio(h_dir, MAY_EXEC | MAY_WRITE);
+	if (!do_sio) {
+		/*
+		 * testing CAP_MKNOD is for generic fs,
+		 * but CAP_FSETID is for xfs only, currently.
+		 */
+		umode_t mode = dentry->d_inode->i_mode;
+		do_sio = (((mode & (S_IFCHR | S_IFBLK))
+			   && !capable(CAP_MKNOD))
+			  || ((mode & (S_ISUID | S_ISGID))
+			      && !capable(CAP_FSETID)));
+	}
+	if (!do_sio)
+		err = au_cpup_simple(dentry, bdst, len, flags);
+	else {
+		struct au_cpup_simple_args args = {
+			.errp		= &err,
+			.dentry		= dentry,
+			.bdst		= bdst,
+			.len		= len,
+			.flags		= flags
+		};
+		wkq_err = au_wkq_wait(au_call_cpup_simple, &args);
+		if (unlikely(wkq_err))
+			err = wkq_err;
+	}
+
+	dput(parent);
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+/*
+ * copyup the deleted file for writing.
+ */
+static int au_do_cpup_wh(struct dentry *dentry, aufs_bindex_t bdst,
+			 struct dentry *wh_dentry, struct file *file,
+			 loff_t len)
+{
+	int err;
+	aufs_bindex_t bstart;
+	struct au_dinfo *dinfo;
+	struct dentry *h_d_dst, *h_d_start;
+
+	dinfo = au_di(dentry);
+	AuRwMustWriteLock(&dinfo->di_rwsem);
+
+	bstart = dinfo->di_bstart;
+	h_d_dst = dinfo->di_hdentry[0 + bdst].hd_dentry;
+	dinfo->di_bstart = bdst;
+	dinfo->di_hdentry[0 + bdst].hd_dentry = wh_dentry;
+	h_d_start = dinfo->di_hdentry[0 + bstart].hd_dentry;
+	if (file)
+		dinfo->di_hdentry[0 + bstart].hd_dentry
+			= au_h_fptr(file, au_fbstart(file))->f_dentry;
+	err = au_cpup_single(dentry, bdst, bstart, len, !AuCpup_DTIME,
+			     /*h_parent*/NULL);
+	if (!err && file) {
+		err = au_reopen_nondir(file);
+		dinfo->di_hdentry[0 + bstart].hd_dentry = h_d_start;
+	}
+	dinfo->di_hdentry[0 + bdst].hd_dentry = h_d_dst;
+	dinfo->di_bstart = bstart;
+
+	return err;
+}
+
+static int au_cpup_wh(struct dentry *dentry, aufs_bindex_t bdst, loff_t len,
+		      struct file *file)
+{
+	int err;
+	struct au_dtime dt;
+	struct dentry *parent, *h_parent, *wh_dentry;
+	struct au_branch *br;
+	struct path h_path;
+
+	br = au_sbr(dentry->d_sb, bdst);
+	parent = dget_parent(dentry);
+	h_parent = au_h_dptr(parent, bdst);
+	wh_dentry = au_whtmp_lkup(h_parent, br, &dentry->d_name);
+	err = PTR_ERR(wh_dentry);
+	if (IS_ERR(wh_dentry))
+		goto out;
+
+	h_path.dentry = h_parent;
+	h_path.mnt = br->br_mnt;
+	au_dtime_store(&dt, parent, &h_path);
+	err = au_do_cpup_wh(dentry, bdst, wh_dentry, file, len);
+	if (unlikely(err))
+		goto out_wh;
+
+	dget(wh_dentry);
+	h_path.dentry = wh_dentry;
+	err = vfsub_unlink(h_parent->d_inode, &h_path, /*force*/0);
+	if (unlikely(err)) {
+		AuIOErr("failed remove copied-up tmp file %.*s(%d)\n",
+			AuDLNPair(wh_dentry), err);
+		err = -EIO;
+	}
+	au_dtime_revert(&dt);
+	au_set_hi_wh(dentry->d_inode, bdst, wh_dentry);
+
+ out_wh:
+	dput(wh_dentry);
+ out:
+	dput(parent);
+	return err;
+}
+
+struct au_cpup_wh_args {
+	int *errp;
+	struct dentry *dentry;
+	aufs_bindex_t bdst;
+	loff_t len;
+	struct file *file;
+};
+
+static void au_call_cpup_wh(void *args)
+{
+	struct au_cpup_wh_args *a = args;
+	*a->errp = au_cpup_wh(a->dentry, a->bdst, a->len, a->file);
+}
+
+int au_sio_cpup_wh(struct dentry *dentry, aufs_bindex_t bdst, loff_t len,
+		   struct file *file)
+{
+	int err, wkq_err;
+	struct dentry *parent, *h_orph, *h_parent, *h_dentry;
+	struct inode *dir, *h_dir, *h_tmpdir, *h_inode;
+	struct au_wbr *wbr;
+
+	parent = dget_parent(dentry);
+	dir = parent->d_inode;
+	h_orph = NULL;
+	h_parent = NULL;
+	h_dir = au_igrab(au_h_iptr(dir, bdst));
+	h_tmpdir = h_dir;
+	if (!h_dir->i_nlink) {
+		wbr = au_sbr(dentry->d_sb, bdst)->br_wbr;
+		h_orph = wbr->wbr_orph;
+
+		h_parent = dget(au_h_dptr(parent, bdst));
+		au_set_h_dptr(parent, bdst, NULL);
+		au_set_h_dptr(parent, bdst, dget(h_orph));
+		h_tmpdir = h_orph->d_inode;
+		au_set_h_iptr(dir, bdst, NULL, 0);
+		au_set_h_iptr(dir, bdst, au_igrab(h_tmpdir), /*flags*/0);
+
+		/* this temporary unlock is safe */
+		if (file)
+			h_dentry = au_h_fptr(file, au_fbstart(file))->f_dentry;
+		else
+			h_dentry = au_h_dptr(dentry, au_dbstart(dentry));
+		h_inode = h_dentry->d_inode;
+		IMustLock(h_inode);
+		mutex_unlock(&h_inode->i_mutex);
+		mutex_lock_nested(&h_tmpdir->i_mutex, AuLsc_I_PARENT3);
+		mutex_lock_nested(&h_inode->i_mutex, AuLsc_I_CHILD);
+	}
+
+	if (!au_test_h_perm_sio(h_tmpdir, MAY_EXEC | MAY_WRITE))
+		err = au_cpup_wh(dentry, bdst, len, file);
+	else {
+		struct au_cpup_wh_args args = {
+			.errp	= &err,
+			.dentry	= dentry,
+			.bdst	= bdst,
+			.len	= len,
+			.file	= file
+		};
+		wkq_err = au_wkq_wait(au_call_cpup_wh, &args);
+		if (unlikely(wkq_err))
+			err = wkq_err;
+	}
+
+	if (h_orph) {
+		mutex_unlock(&h_tmpdir->i_mutex);
+		au_set_h_iptr(dir, bdst, NULL, 0);
+		au_set_h_iptr(dir, bdst, au_igrab(h_dir), /*flags*/0);
+		au_set_h_dptr(parent, bdst, NULL);
+		au_set_h_dptr(parent, bdst, h_parent);
+	}
+	iput(h_dir);
+	dput(parent);
+
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+/*
+ * generic routine for both of copy-up and copy-down.
+ */
+/* cf. revalidate function in file.c */
+int au_cp_dirs(struct dentry *dentry, aufs_bindex_t bdst,
+	       int (*cp)(struct dentry *dentry, aufs_bindex_t bdst,
+			 struct dentry *h_parent, void *arg),
+	       void *arg)
+{
+	int err;
+	struct au_pin pin;
+	struct dentry *d, *parent, *h_parent, *real_parent;
+
+	err = 0;
+	parent = dget_parent(dentry);
+	if (IS_ROOT(parent))
+		goto out;
+
+	au_pin_init(&pin, dentry, bdst, AuLsc_DI_PARENT2, AuLsc_I_PARENT2,
+		    au_opt_udba(dentry->d_sb), AuPin_MNT_WRITE);
+
+	/* do not use au_dpage */
+	real_parent = parent;
+	while (1) {
+		dput(parent);
+		parent = dget_parent(dentry);
+		h_parent = au_h_dptr(parent, bdst);
+		if (h_parent)
+			goto out; /* success */
+
+		/* find top dir which is necessary to cpup */
+		do {
+			d = parent;
+			dput(parent);
+			parent = dget_parent(d);
+			di_read_lock_parent3(parent, !AuLock_IR);
+			h_parent = au_h_dptr(parent, bdst);
+			di_read_unlock(parent, !AuLock_IR);
+		} while (!h_parent);
+
+		if (d != real_parent)
+			di_write_lock_child3(d);
+
+		/* somebody else might create while we were sleeping */
+		if (!au_h_dptr(d, bdst) || !au_h_dptr(d, bdst)->d_inode) {
+			if (au_h_dptr(d, bdst))
+				au_update_dbstart(d);
+
+			au_pin_set_dentry(&pin, d);
+			err = au_do_pin(&pin);
+			if (!err) {
+				err = cp(d, bdst, h_parent, arg);
+				au_unpin(&pin);
+			}
+		}
+
+		if (d != real_parent)
+			di_write_unlock(d);
+		if (unlikely(err))
+			break;
+	}
+
+ out:
+	dput(parent);
+	return err;
+}
+
+static int au_cpup_dir(struct dentry *dentry, aufs_bindex_t bdst,
+		       struct dentry *h_parent __maybe_unused ,
+		       void *arg __maybe_unused)
+{
+	return au_sio_cpup_simple(dentry, bdst, -1, AuCpup_DTIME);
+}
+
+int au_cpup_dirs(struct dentry *dentry, aufs_bindex_t bdst)
+{
+	return au_cp_dirs(dentry, bdst, au_cpup_dir, NULL);
+}
+
+int au_test_and_cpup_dirs(struct dentry *dentry, aufs_bindex_t bdst)
+{
+	int err;
+	struct dentry *parent;
+	struct inode *dir;
+
+	parent = dget_parent(dentry);
+	dir = parent->d_inode;
+	err = 0;
+	if (au_h_iptr(dir, bdst))
+		goto out;
+
+	di_read_unlock(parent, AuLock_IR);
+	di_write_lock_parent(parent);
+	/* someone else might change our inode while we were sleeping */
+	if (!au_h_iptr(dir, bdst))
+		err = au_cpup_dirs(dentry, bdst);
+	di_downgrade_lock(parent, AuLock_IR);
+
+ out:
+	dput(parent);
+	return err;
+}
--- linux-rt-2.6.31.orig/ubuntu/aufs/ioctl.c
+++ linux-rt-2.6.31/ubuntu/aufs/ioctl.c
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * ioctl
+ * currently plink-management only.
+ */
+
+#include <linux/uaccess.h>
+#include "aufs.h"
+
+long aufs_ioctl_dir(struct file *file, unsigned int cmd,
+		    unsigned long arg __maybe_unused)
+{
+	long err;
+	struct super_block *sb;
+	struct au_sbinfo *sbinfo;
+
+	err = -EACCES;
+	if (!capable(CAP_SYS_ADMIN))
+		goto out;
+
+	err = 0;
+	sb = file->f_dentry->d_sb;
+	sbinfo = au_sbi(sb);
+	switch (cmd) {
+	case AUFS_CTL_PLINK_MAINT:
+		/*
+		 * pseudo-link maintenance mode,
+		 * cleared by aufs_release_dir()
+		 */
+		si_write_lock(sb);
+		if (!au_ftest_si(sbinfo, MAINTAIN_PLINK)) {
+			au_fset_si(sbinfo, MAINTAIN_PLINK);
+			au_fi(file)->fi_maintain_plink = 1;
+		} else
+			err = -EBUSY;
+		si_write_unlock(sb);
+		break;
+	case AUFS_CTL_PLINK_CLEAN:
+		aufs_write_lock(sb->s_root);
+		if (au_opt_test(sbinfo->si_mntflags, PLINK))
+			au_plink_put(sb);
+		aufs_write_unlock(sb->s_root);
+		break;
+	default:
+		err = -EINVAL;
+	}
+
+ out:
+	return err;
+}
--- linux-rt-2.6.31.orig/ubuntu/aufs/poll.c
+++ linux-rt-2.6.31/ubuntu/aufs/poll.c
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * poll operation
+ * There is only one filesystem which implements ->poll operation, currently.
+ */
+
+#include "aufs.h"
+
+unsigned int aufs_poll(struct file *file, poll_table *wait)
+{
+	unsigned int mask;
+	int err;
+	struct file *h_file;
+	struct dentry *dentry;
+	struct super_block *sb;
+
+	/* We should pretend an error happened. */
+	mask = POLLERR /* | POLLIN | POLLOUT */;
+	dentry = file->f_dentry;
+	sb = dentry->d_sb;
+	si_read_lock(sb, AuLock_FLUSH);
+	err = au_reval_and_lock_fdi(file, au_reopen_nondir, /*wlock*/0);
+	if (unlikely(err))
+		goto out;
+
+	/* it is not an error if h_file has no operation */
+	mask = DEFAULT_POLLMASK;
+	h_file = au_h_fptr(file, au_fbstart(file));
+	if (h_file->f_op && h_file->f_op->poll)
+		mask = h_file->f_op->poll(h_file, wait);
+
+	di_read_unlock(dentry, AuLock_IR);
+	fi_read_unlock(file);
+
+ out:
+	si_read_unlock(sb);
+	AuTraceErr((int)mask);
+	return mask;
+}
--- linux-rt-2.6.31.orig/ubuntu/aufs/Kconfig
+++ linux-rt-2.6.31/ubuntu/aufs/Kconfig
@@ -0,0 +1,132 @@
+config AUFS_FS
+	tristate "Aufs (Advanced multi layered unification filesystem) support"
+	depends on EXPERIMENTAL
+	help
+	Aufs is a stackable unification filesystem such as Unionfs,
+	which unifies several directories and provides a merged single
+	directory.
+	In the early days, aufs was entirely re-designed and
+	re-implemented Unionfs Version 1.x series. Introducing many
+	original ideas, approaches and improvements, it becomes totally
+	different from Unionfs while keeping the basic features.
+
+if AUFS_FS
+choice
+	prompt "Maximum number of branches"
+	default AUFS_BRANCH_MAX_127
+	help
+	Specifies the maximum number of branches (or member directories)
+	in a single aufs. The larger value consumes more system
+	resources and has a minor impact to performance.
+config AUFS_BRANCH_MAX_127
+	bool "127"
+	help
+	Specifies the maximum number of branches (or member directories)
+	in a single aufs. The larger value consumes more system
+	resources and has a minor impact to performance.
+config AUFS_BRANCH_MAX_511
+	bool "511"
+	help
+	Specifies the maximum number of branches (or member directories)
+	in a single aufs. The larger value consumes more system
+	resources and has a minor impact to performance.
+config AUFS_BRANCH_MAX_1023
+	bool "1023"
+	help
+	Specifies the maximum number of branches (or member directories)
+	in a single aufs. The larger value consumes more system
+	resources and has a minor impact to performance.
+config AUFS_BRANCH_MAX_32767
+	bool "32767"
+	help
+	Specifies the maximum number of branches (or member directories)
+	in a single aufs. The larger value consumes more system
+	resources and has a minor impact to performance.
+endchoice
+
+config AUFS_HINOTIFY
+	bool "Use inotify to detect actions on a branch"
+	depends on INOTIFY
+	help
+	If you want to modify files on branches directly, eg. bypassing aufs,
+	and want aufs to detect the changes of them fully, then enable this
+	option and use 'udba=inotify' mount option.
+	It will have a negative impact to the performance.
+	See detail in aufs.5.
+
+config AUFS_EXPORT
+	bool "NFS-exportable aufs"
+	depends on (AUFS_FS = y && EXPORTFS = y) || (AUFS_FS = m && EXPORTFS)
+	help
+	If you want to export your mounted aufs via NFS, then enable this
+	option. There are several requirements for this configuration.
+	See detail in aufs.5.
+
+config AUFS_SHWH
+	bool "Show whiteouts"
+	help
+	If you want to make the whiteouts in aufs visible, then enable
+	this option and specify 'shwh' mount option. Although it may
+	sounds like philosophy or something, but in technically it
+	simply shows the name of whiteout with keeping its behaviour.
+
+config AUFS_BR_RAMFS
+	bool "Ramfs (initramfs/rootfs) as an aufs branch"
+	help
+	If you want to use ramfs as an aufs branch fs, then enable this
+	option. Generally tmpfs is recommended.
+	Aufs prohibited them to be a branch fs by default, because
+	initramfs becomes unusable after switch_root or something
+	generally. If you sets initramfs as an aufs branch and boot your
+	system by switch_root, you will meet a problem easily since the
+	files in initramfs may be inaccessible.
+	Unless you are going to use ramfs as an aufs branch fs without
+	switch_root or something, leave it N.
+
+config AUFS_BR_FUSE
+	bool "Fuse fs as an aufs branch"
+	depends on FUSE_FS
+	select AUFS_POLL
+	help
+	If you want to use fuse-based userspace filesystem as an aufs
+	branch fs, then enable this option.
+	It implements the internal poll(2) operation which is
+	implemented by fuse only (curretnly).
+
+config AUFS_DEBUG
+	bool "Debug aufs"
+	help
+	Enable this to compile aufs internal debug code.
+	It will have a negative impact to the performance.
+
+config AUFS_MAGIC_SYSRQ
+	bool
+	depends on AUFS_DEBUG && MAGIC_SYSRQ
+	default y
+	help
+	Automatic configuration for internal use.
+	When aufs supports Magic SysRq, enabled automatically.
+
+config AUFS_BDEV_LOOP
+	bool
+	depends on BLK_DEV_LOOP
+	default y
+	help
+	Automatic configuration for internal use.
+	Convert =[ym] into =y.
+
+config AUFS_INO_T_64
+	bool
+	depends on AUFS_EXPORT
+	depends on 64BIT && !(ALPHA || S390)
+	default y
+	help
+	Automatic configuration for internal use.
+	/* typedef unsigned long/int __kernel_ino_t */
+	/* alpha and s390x are int */
+
+config AUFS_POLL
+	bool
+	help
+	Automatic configuration for internal use.
+endif
--- linux-rt-2.6.31.orig/ubuntu/aufs/whout.h
+++ linux-rt-2.6.31/ubuntu/aufs/whout.h
@@ -0,0 +1,87 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * whiteout for logical deletion and opaque directory
+ */
+
+#ifndef __AUFS_WHOUT_H__
+#define __AUFS_WHOUT_H__
+
+#ifdef __KERNEL__
+
+#include <linux/aufs_type.h>
+#include "dir.h"
+
+/* whout.c */
+int au_wh_name_alloc(struct qstr *wh, const struct qstr *name);
+struct au_branch;
+int au_wh_test(struct dentry *h_parent, struct qstr *wh_name,
+	       struct au_branch *br, int try_sio);
+int au_diropq_test(struct dentry *h_dentry, struct au_branch *br);
+struct dentry *au_whtmp_lkup(struct dentry *h_parent, struct au_branch *br,
+			     struct qstr *prefix);
+int au_whtmp_ren(struct dentry *h_dentry, struct au_branch *br);
+int au_wh_unlink_dentry(struct inode *h_dir, struct path *h_path,
+			struct dentry *dentry);
+int au_wh_init(struct dentry *h_parent, struct au_branch *br,
+	       struct super_block *sb);
+
+/* diropq flags */
+#define AuDiropq_CREATE	1
+#define au_ftest_diropq(flags, name)	((flags) & AuDiropq_##name)
+#define au_fset_diropq(flags, name)	{ (flags) |= AuDiropq_##name; }
+#define au_fclr_diropq(flags, name)	{ (flags) &= ~AuDiropq_##name; }
+
+struct dentry *au_diropq_sio(struct dentry *dentry, aufs_bindex_t bindex,
+			     unsigned int flags);
+struct dentry *au_wh_lkup(struct dentry *h_parent, struct qstr *base_name,
+			  struct au_branch *br);
+struct dentry *au_wh_create(struct dentry *dentry, aufs_bindex_t bindex,
+			    struct dentry *h_parent);
+
+/* real rmdir for the whiteout-ed dir */
+struct au_whtmp_rmdir {
+	struct inode *dir;
+	aufs_bindex_t bindex;
+	struct dentry *wh_dentry;
+	struct au_nhash whlist;
+};
+
+struct au_whtmp_rmdir *au_whtmp_rmdir_alloc(struct super_block *sb, gfp_t gfp);
+void au_whtmp_rmdir_free(struct au_whtmp_rmdir *whtmp);
+int au_whtmp_rmdir(struct inode *dir, aufs_bindex_t bindex,
+		   struct dentry *wh_dentry, struct au_nhash *whlist);
+void au_whtmp_kick_rmdir(struct inode *dir, aufs_bindex_t bindex,
+			 struct dentry *wh_dentry, struct au_whtmp_rmdir *args);
+
+/* ---------------------------------------------------------------------- */
+
+static inline struct dentry *au_diropq_create(struct dentry *dentry,
+					      aufs_bindex_t bindex)
+{
+	return au_diropq_sio(dentry, bindex, AuDiropq_CREATE);
+}
+
+static inline int au_diropq_remove(struct dentry *dentry, aufs_bindex_t bindex)
+{
+	return PTR_ERR(au_diropq_sio(dentry, bindex, !AuDiropq_CREATE));
+}
+
+#endif /* __KERNEL__ */
+#endif /* __AUFS_WHOUT_H__ */
--- linux-rt-2.6.31.orig/ubuntu/aufs/dir.h
+++ linux-rt-2.6.31/ubuntu/aufs/dir.h
@@ -0,0 +1,114 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * directory operations
+ */
+
+#ifndef __AUFS_DIR_H__
+#define __AUFS_DIR_H__
+
+#ifdef __KERNEL__
+
+#include <linux/fs.h>
+#include <linux/aufs_type.h>
+
+/* ---------------------------------------------------------------------- */
+
+/* need to be faster and smaller */
+
+struct au_nhash {
+	unsigned int		nh_num;
+	struct hlist_head	*nh_head;
+};
+
+struct au_vdir_destr {
+	unsigned char	len;
+	unsigned char	name[0];
+} __packed;
+
+struct au_vdir_dehstr {
+	struct hlist_node	hash;
+	struct au_vdir_destr	*str;
+};
+
+struct au_vdir_de {
+	ino_t			de_ino;
+	unsigned char		de_type;
+	/* caution: packed */
+	struct au_vdir_destr	de_str;
+} __packed;
+
+struct au_vdir_wh {
+	struct hlist_node	wh_hash;
+#ifdef CONFIG_AUFS_SHWH
+	ino_t			wh_ino;
+	aufs_bindex_t		wh_bindex;
+	unsigned char		wh_type;
+#else
+	aufs_bindex_t		wh_bindex;
+#endif
+	/* caution: packed */
+	struct au_vdir_destr	wh_str;
+} __packed;
+
+union au_vdir_deblk_p {
+	unsigned char		*deblk;
+	struct au_vdir_de	*de;
+};
+
+struct au_vdir {
+	unsigned char	**vd_deblk;
+	unsigned long	vd_nblk;
+	struct {
+		unsigned long		ul;
+		union au_vdir_deblk_p	p;
+	} vd_last;
+
+	unsigned long	vd_version;
+	unsigned int	vd_deblk_sz;
+	unsigned long	vd_jiffy;
+};
+
+/* ---------------------------------------------------------------------- */
+
+/* dir.c */
+extern const struct file_operations aufs_dir_fop;
+void au_add_nlink(struct inode *dir, struct inode *h_dir);
+void au_sub_nlink(struct inode *dir, struct inode *h_dir);
+int au_test_empty_lower(struct dentry *dentry);
+int au_test_empty(struct dentry *dentry, struct au_nhash *whlist);
+
+/* vdir.c */
+int au_nhash_alloc(struct au_nhash *nhash, unsigned int num_hash, gfp_t gfp);
+void au_nhash_wh_free(struct au_nhash *whlist);
+int au_nhash_test_longer_wh(struct au_nhash *whlist, aufs_bindex_t btgt,
+			    int limit);
+int au_nhash_test_known_wh(struct au_nhash *whlist, char *name, int nlen);
+int au_nhash_append_wh(struct au_nhash *whlist, char *name, int nlen, ino_t ino,
+		       unsigned int d_type, aufs_bindex_t bindex,
+		       unsigned char shwh);
+void au_vdir_free(struct au_vdir *vdir);
+int au_vdir_init(struct file *file);
+int au_vdir_fill_de(struct file *file, void *dirent, filldir_t filldir);
+
+/* ioctl.c */
+long aufs_ioctl_dir(struct file *file, unsigned int cmd, unsigned long arg);
+
+#endif /* __KERNEL__ */
+#endif /* __AUFS_DIR_H__ */
--- linux-rt-2.6.31.orig/ubuntu/aufs/super.h
+++ linux-rt-2.6.31/ubuntu/aufs/super.h
@@ -0,0 +1,384 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * super_block operations
+ */
+
+#ifndef __AUFS_SUPER_H__
+#define __AUFS_SUPER_H__
+
+#ifdef __KERNEL__
+
+#include <linux/fs.h>
+#include <linux/aufs_type.h>
+#include "rwsem.h"
+#include "spl.h"
+#include "wkq.h"
+
+typedef ssize_t (*au_readf_t)(struct file *, char __user *, size_t, loff_t *);
+typedef ssize_t (*au_writef_t)(struct file *, const char __user *, size_t,
+			       loff_t *);
+
+/* policies to select one among multiple writable branches */
+struct au_wbr_copyup_operations {
+	int (*copyup)(struct dentry *dentry);
+};
+
+struct au_wbr_create_operations {
+	int (*create)(struct dentry *dentry, int isdir);
+	int (*init)(struct super_block *sb);
+	int (*fin)(struct super_block *sb);
+};
+
+struct au_wbr_mfs {
+	struct mutex	mfs_lock; /* protect this structure */
+	unsigned long	mfs_jiffy;
+	unsigned long	mfs_expire;
+	aufs_bindex_t	mfs_bindex;
+
+	unsigned long long	mfsrr_bytes;
+	unsigned long long	mfsrr_watermark;
+};
+
+struct au_branch;
+struct au_sbinfo {
+	/* nowait tasks in the system-wide workqueue */
+	struct au_nowait_tasks	si_nowait;
+
+	struct au_rwsem		si_rwsem;
+
+	/* branch management */
+	unsigned int		si_generation;
+
+	/* see above flags */
+	unsigned char		au_si_status;
+
+	aufs_bindex_t		si_bend;
+	aufs_bindex_t		si_last_br_id;
+	struct au_branch	**si_branch;
+
+	/* policy to select a writable branch */
+	unsigned char		si_wbr_copyup;
+	unsigned char		si_wbr_create;
+	struct au_wbr_copyup_operations *si_wbr_copyup_ops;
+	struct au_wbr_create_operations *si_wbr_create_ops;
+
+	/* round robin */
+	atomic_t		si_wbr_rr_next;
+
+	/* most free space */
+	struct au_wbr_mfs	si_wbr_mfs;
+
+	/* mount flags */
+	/* include/asm-ia64/siginfo.h defines a macro named si_flags */
+	unsigned int		si_mntflags;
+
+	/* external inode number (bitmap and translation table) */
+	au_readf_t		si_xread;
+	au_writef_t		si_xwrite;
+	struct file		*si_xib;
+	struct mutex		si_xib_mtx; /* protect xib members */
+	unsigned long		*si_xib_buf;
+	unsigned long		si_xib_last_pindex;
+	int			si_xib_next_bit;
+	aufs_bindex_t		si_xino_brid;
+	/* reserved for future use */
+	/* unsigned long long	si_xib_limit; */	/* Max xib file size */
+
+#ifdef CONFIG_AUFS_EXPORT
+	/* i_generation */
+	struct file		*si_xigen;
+	atomic_t		si_xigen_next;
+#endif
+
+	/* vdir parameters */
+	unsigned long		si_rdcache;	/* max cache time in HZ */
+	unsigned int		si_rdblk;	/* deblk size */
+	unsigned int		si_rdhash;	/* hash size */
+
+	/*
+	 * If the number of whiteouts are larger than si_dirwh, leave all of
+	 * them after au_whtmp_ren to reduce the cost of rmdir(2).
+	 * future fsck.aufs or kernel thread will remove them later.
+	 * Otherwise, remove all whiteouts and the dir in rmdir(2).
+	 */
+	unsigned int		si_dirwh;
+
+	/*
+	 * rename(2) a directory with all children.
+	 */
+	/* reserved for future use */
+	/* int			si_rendir; */
+
+	/* pseudo_link list */
+	struct au_splhead	si_plink;
+	wait_queue_head_t	si_plink_wq;
+
+	/*
+	 * sysfs and lifetime management.
+	 * this is not a small structure and it may be a waste of memory in case
+	 * of sysfs is disabled, particulary when many aufs-es are mounted.
+	 * but using sysfs is majority.
+	 */
+	struct kobject		si_kobj;
+#ifdef CONFIG_DEBUG_FS
+	struct dentry		 *si_dbgaufs, *si_dbgaufs_xib;
+#ifdef CONFIG_AUFS_EXPORT
+	struct dentry		 *si_dbgaufs_xigen;
+#endif
+#endif
+
+	/* dirty, necessary for unmounting, sysfs and sysrq */
+	struct super_block	*si_sb;
+};
+
+/* sbinfo status flags */
+/*
+ * set true when refresh_dirs() failed at remount time.
+ * then try refreshing dirs at access time again.
+ * if it is false, refreshing dirs at access time is unnecesary
+ */
+#define AuSi_FAILED_REFRESH_DIRS	1
+#define AuSi_MAINTAIN_PLINK		(1 << 1)	/* ioctl */
+static inline unsigned char au_do_ftest_si(struct au_sbinfo *sbi,
+					   unsigned int flag)
+{
+	AuRwMustAnyLock(&sbi->si_rwsem);
+	return sbi->au_si_status & flag;
+}
+#define au_ftest_si(sbinfo, name)	au_do_ftest_si(sbinfo, AuSi_##name)
+#define au_fset_si(sbinfo, name) do { \
+	AuRwMustWriteLock(&(sbinfo)->si_rwsem); \
+	(sbinfo)->au_si_status |= AuSi_##name; \
+} while (0)
+#define au_fclr_si(sbinfo, name) do { \
+	AuRwMustWriteLock(&(sbinfo)->si_rwsem); \
+	(sbinfo)->au_si_status &= ~AuSi_##name; \
+} while (0)
+
+/* ---------------------------------------------------------------------- */
+
+/* policy to select one among writable branches */
+#define AuWbrCopyup(sbinfo, args...) \
+	((sbinfo)->si_wbr_copyup_ops->copyup(args))
+#define AuWbrCreate(sbinfo, args...) \
+	((sbinfo)->si_wbr_create_ops->create(args))
+
+/* flags for si_read_lock()/aufs_read_lock()/di_read_lock() */
+#define AuLock_DW		1		/* write-lock dentry */
+#define AuLock_IR		(1 << 1)	/* read-lock inode */
+#define AuLock_IW		(1 << 2)	/* write-lock inode */
+#define AuLock_FLUSH		(1 << 3)	/* wait for 'nowait' tasks */
+#define AuLock_DIR		(1 << 4)	/* target is a dir */
+#define au_ftest_lock(flags, name)	((flags) & AuLock_##name)
+#define au_fset_lock(flags, name)	{ (flags) |= AuLock_##name; }
+#define au_fclr_lock(flags, name)	{ (flags) &= ~AuLock_##name; }
+
+/* ---------------------------------------------------------------------- */
+
+/* super.c */
+extern struct file_system_type aufs_fs_type;
+struct inode *au_iget_locked(struct super_block *sb, ino_t ino);
+
+/* sbinfo.c */
+void au_si_free(struct kobject *kobj);
+int au_si_alloc(struct super_block *sb);
+int au_sbr_realloc(struct au_sbinfo *sbinfo, int nbr);
+
+unsigned int au_sigen_inc(struct super_block *sb);
+aufs_bindex_t au_new_br_id(struct super_block *sb);
+
+void aufs_read_lock(struct dentry *dentry, int flags);
+void aufs_read_unlock(struct dentry *dentry, int flags);
+void aufs_write_lock(struct dentry *dentry);
+void aufs_write_unlock(struct dentry *dentry);
+void aufs_read_and_write_lock2(struct dentry *d1, struct dentry *d2, int isdir);
+void aufs_read_and_write_unlock2(struct dentry *d1, struct dentry *d2);
+
+/* wbr_policy.c */
+extern struct au_wbr_copyup_operations au_wbr_copyup_ops[];
+extern struct au_wbr_create_operations au_wbr_create_ops[];
+int au_cpdown_dirs(struct dentry *dentry, aufs_bindex_t bdst);
+
+/* ---------------------------------------------------------------------- */
+
+static inline struct au_sbinfo *au_sbi(struct super_block *sb)
+{
+	return sb->s_fs_info;
+}
+
+/* ---------------------------------------------------------------------- */
+
+#ifdef CONFIG_AUFS_EXPORT
+void au_export_init(struct super_block *sb);
+
+static inline int au_test_nfsd(struct task_struct *tsk)
+{
+	return !tsk->mm && !strcmp(tsk->comm, "nfsd");
+}
+
+int au_xigen_inc(struct inode *inode);
+int au_xigen_new(struct inode *inode);
+int au_xigen_set(struct super_block *sb, struct file *base);
+void au_xigen_clr(struct super_block *sb);
+
+static inline int au_busy_or_stale(void)
+{
+	if (!au_test_nfsd(current))
+		return -EBUSY;
+	return -ESTALE;
+}
+#else
+static inline void au_export_init(struct super_block *sb)
+{
+	/* nothing */
+}
+
+static inline int au_test_nfsd(struct task_struct *tsk)
+{
+	return 0;
+}
+
+static inline int au_xigen_inc(struct inode *inode)
+{
+	return 0;
+}
+
+static inline int au_xigen_new(struct inode *inode)
+{
+	return 0;
+}
+
+static inline int au_xigen_set(struct super_block *sb, struct file *base)
+{
+	return 0;
+}
+
+static inline void au_xigen_clr(struct super_block *sb)
+{
+	/* empty */
+}
+
+static inline int au_busy_or_stale(void)
+{
+	return -EBUSY;
+}
+#endif /* CONFIG_AUFS_EXPORT */
+
+/* ---------------------------------------------------------------------- */
+
+static inline void dbgaufs_si_null(struct au_sbinfo *sbinfo)
+{
+	/*
+	 * This function is a dynamic '__init' fucntion actually,
+	 * so the tiny check for si_rwsem is unnecessary.
+	 */
+	/* AuRwMustWriteLock(&sbinfo->si_rwsem); */
+#ifdef CONFIG_DEBUG_FS
+	sbinfo->si_dbgaufs = NULL;
+	sbinfo->si_dbgaufs_xib = NULL;
+#ifdef CONFIG_AUFS_EXPORT
+	sbinfo->si_dbgaufs_xigen = NULL;
+#endif
+#endif
+}
+
+/* ---------------------------------------------------------------------- */
+
+/* lock superblock. mainly for entry point functions */
+/*
+ * si_noflush_read_lock, si_noflush_write_lock,
+ * si_read_unlock, si_write_unlock, si_downgrade_lock
+ */
+AuSimpleLockRwsemFuncs(si_noflush, struct super_block *sb,
+		       &au_sbi(sb)->si_rwsem);
+AuSimpleUnlockRwsemFuncs(si, struct super_block *sb, &au_sbi(sb)->si_rwsem);
+
+#define SiMustNoWaiters(sb)	AuRwMustNoWaiters(&au_sbi(sb)->si_rwsem)
+#define SiMustAnyLock(sb)	AuRwMustAnyLock(&au_sbi(sb)->si_rwsem)
+#define SiMustWriteLock(sb)	AuRwMustWriteLock(&au_sbi(sb)->si_rwsem)
+
+static inline void si_read_lock(struct super_block *sb, int flags)
+{
+	if (au_ftest_lock(flags, FLUSH))
+		au_nwt_flush(&au_sbi(sb)->si_nowait);
+	si_noflush_read_lock(sb);
+}
+
+static inline void si_write_lock(struct super_block *sb)
+{
+	au_nwt_flush(&au_sbi(sb)->si_nowait);
+	si_noflush_write_lock(sb);
+}
+
+static inline int si_read_trylock(struct super_block *sb, int flags)
+{
+	if (au_ftest_lock(flags, FLUSH))
+		au_nwt_flush(&au_sbi(sb)->si_nowait);
+	return si_noflush_read_trylock(sb);
+}
+
+static inline int si_write_trylock(struct super_block *sb, int flags)
+{
+	if (au_ftest_lock(flags, FLUSH))
+		au_nwt_flush(&au_sbi(sb)->si_nowait);
+	return si_noflush_write_trylock(sb);
+}
+
+/* ---------------------------------------------------------------------- */
+
+static inline aufs_bindex_t au_sbend(struct super_block *sb)
+{
+	SiMustAnyLock(sb);
+	return au_sbi(sb)->si_bend;
+}
+
+static inline unsigned int au_mntflags(struct super_block *sb)
+{
+	SiMustAnyLock(sb);
+	return au_sbi(sb)->si_mntflags;
+}
+
+static inline unsigned int au_sigen(struct super_block *sb)
+{
+	SiMustAnyLock(sb);
+	return au_sbi(sb)->si_generation;
+}
+
+static inline struct au_branch *au_sbr(struct super_block *sb,
+				       aufs_bindex_t bindex)
+{
+	SiMustAnyLock(sb);
+	return au_sbi(sb)->si_branch[0 + bindex];
+}
+
+static inline void au_xino_brid_set(struct super_block *sb, aufs_bindex_t brid)
+{
+	SiMustWriteLock(sb);
+	au_sbi(sb)->si_xino_brid = brid;
+}
+
+static inline aufs_bindex_t au_xino_brid(struct super_block *sb)
+{
+	SiMustAnyLock(sb);
+	return au_sbi(sb)->si_xino_brid;
+}
+
+#endif /* __KERNEL__ */
+#endif /* __AUFS_SUPER_H__ */
--- linux-rt-2.6.31.orig/ubuntu/aufs/export.c
+++ linux-rt-2.6.31/ubuntu/aufs/export.c
@@ -0,0 +1,745 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * export via nfs
+ */
+
+#include <linux/exportfs.h>
+#include <linux/file.h>
+#include <linux/mnt_namespace.h>
+#include <linux/namei.h>
+#include <linux/random.h>
+#include "aufs.h"
+
+union conv {
+#ifdef CONFIG_AUFS_INO_T_64
+	__u32 a[2];
+#else
+	__u32 a[1];
+#endif
+	ino_t ino;
+};
+
+static ino_t decode_ino(__u32 *a)
+{
+	union conv u;
+
+	BUILD_BUG_ON(sizeof(u.ino) != sizeof(u.a));
+	u.a[0] = a[0];
+#ifdef CONFIG_AUFS_INO_T_64
+	u.a[1] = a[1];
+#endif
+	return u.ino;
+}
+
+static void encode_ino(__u32 *a, ino_t ino)
+{
+	union conv u;
+
+	u.ino = ino;
+	a[0] = u.a[0];
+#ifdef CONFIG_AUFS_INO_T_64
+	a[1] = u.a[1];
+#endif
+}
+
+/* NFS file handle */
+enum {
+	Fh_br_id,
+	Fh_sigen,
+#ifdef CONFIG_AUFS_INO_T_64
+	/* support 64bit inode number */
+	Fh_ino1,
+	Fh_ino2,
+	Fh_dir_ino1,
+	Fh_dir_ino2,
+#else
+	Fh_ino1,
+	Fh_dir_ino1,
+#endif
+	Fh_igen,
+	Fh_h_type,
+	Fh_tail,
+
+	Fh_ino = Fh_ino1,
+	Fh_dir_ino = Fh_dir_ino1
+};
+
+static int au_test_anon(struct dentry *dentry)
+{
+	return !!(dentry->d_flags & DCACHE_DISCONNECTED);
+}
+
+/* ---------------------------------------------------------------------- */
+/* inode generation external table */
+
+int au_xigen_inc(struct inode *inode)
+{
+	int err;
+	loff_t pos;
+	ssize_t sz;
+	__u32 igen;
+	struct super_block *sb;
+	struct au_sbinfo *sbinfo;
+
+	err = 0;
+	sb = inode->i_sb;
+	sbinfo = au_sbi(sb);
+	/*
+	 * temporary workaround for escaping from SiMustAnyLock() in
+	 * au_mntflags(), since this function is called from au_iinfo_fin().
+	 */
+	if (unlikely(!au_opt_test(sbinfo->si_mntflags, XINO)))
+		goto out;
+
+	pos = inode->i_ino;
+	pos *= sizeof(igen);
+	igen = inode->i_generation + 1;
+	sz = xino_fwrite(sbinfo->si_xwrite, sbinfo->si_xigen, &igen,
+			 sizeof(igen), &pos);
+	if (sz == sizeof(igen))
+		goto out; /* success */
+
+	err = sz;
+	if (unlikely(sz >= 0)) {
+		err = -EIO;
+		AuIOErr("xigen error (%zd)\n", sz);
+	}
+
+ out:
+	return err;
+}
+
+int au_xigen_new(struct inode *inode)
+{
+	int err;
+	loff_t pos;
+	ssize_t sz;
+	struct super_block *sb;
+	struct au_sbinfo *sbinfo;
+	struct file *file;
+
+	err = 0;
+	/* todo: dirty, at mount time */
+	if (inode->i_ino == AUFS_ROOT_INO)
+		goto out;
+	sb = inode->i_sb;
+	SiMustAnyLock(sb);
+	if (unlikely(!au_opt_test(au_mntflags(sb), XINO)))
+		goto out;
+
+	err = -EFBIG;
+	pos = inode->i_ino;
+	if (unlikely(au_loff_max / sizeof(inode->i_generation) - 1 < pos)) {
+		AuIOErr1("too large i%lld\n", pos);
+		goto out;
+	}
+	pos *= sizeof(inode->i_generation);
+
+	err = 0;
+	sbinfo = au_sbi(sb);
+	file = sbinfo->si_xigen;
+	BUG_ON(!file);
+
+	if (i_size_read(file->f_dentry->d_inode)
+	    < pos + sizeof(inode->i_generation)) {
+		inode->i_generation = atomic_inc_return(&sbinfo->si_xigen_next);
+		sz = xino_fwrite(sbinfo->si_xwrite, file, &inode->i_generation,
+				 sizeof(inode->i_generation), &pos);
+	} else
+		sz = xino_fread(sbinfo->si_xread, file, &inode->i_generation,
+				sizeof(inode->i_generation), &pos);
+	if (sz == sizeof(inode->i_generation))
+		goto out; /* success */
+
+	err = sz;
+	if (unlikely(sz >= 0)) {
+		err = -EIO;
+		AuIOErr("xigen error (%zd)\n", sz);
+	}
+
+ out:
+	return err;
+}
+
+int au_xigen_set(struct super_block *sb, struct file *base)
+{
+	int err;
+	struct au_sbinfo *sbinfo;
+	struct file *file;
+
+	SiMustWriteLock(sb);
+
+	sbinfo = au_sbi(sb);
+	file = au_xino_create2(base, sbinfo->si_xigen);
+	err = PTR_ERR(file);
+	if (IS_ERR(file))
+		goto out;
+	err = 0;
+	if (sbinfo->si_xigen)
+		fput(sbinfo->si_xigen);
+	sbinfo->si_xigen = file;
+
+ out:
+	return err;
+}
+
+void au_xigen_clr(struct super_block *sb)
+{
+	struct au_sbinfo *sbinfo;
+
+	SiMustWriteLock(sb);
+
+	sbinfo = au_sbi(sb);
+	if (sbinfo->si_xigen) {
+		fput(sbinfo->si_xigen);
+		sbinfo->si_xigen = NULL;
+	}
+}
+
+/* ---------------------------------------------------------------------- */
+
+static struct dentry *decode_by_ino(struct super_block *sb, ino_t ino,
+				    ino_t dir_ino)
+{
+	struct dentry *dentry, *d;
+	struct inode *inode;
+	unsigned int sigen;
+
+	dentry = NULL;
+	inode = ilookup(sb, ino);
+	if (!inode)
+		goto out;
+
+	dentry = ERR_PTR(-ESTALE);
+	sigen = au_sigen(sb);
+	if (unlikely(is_bad_inode(inode)
+		     || IS_DEADDIR(inode)
+		     || sigen != au_iigen(inode)))
+		goto out_iput;
+
+	dentry = NULL;
+	if (!dir_ino || S_ISDIR(inode->i_mode))
+		dentry = d_find_alias(inode);
+	else {
+		spin_lock(&dcache_lock);
+		list_for_each_entry(d, &inode->i_dentry, d_alias)
+			if (!au_test_anon(d)
+			    && d->d_parent->d_inode->i_ino == dir_ino) {
+				dentry = dget_locked(d);
+				break;
+			}
+		spin_unlock(&dcache_lock);
+	}
+	if (unlikely(dentry && sigen != au_digen(dentry))) {
+		dput(dentry);
+		dentry = ERR_PTR(-ESTALE);
+	}
+
+ out_iput:
+	iput(inode);
+ out:
+	return dentry;
+}
+
+/* ---------------------------------------------------------------------- */
+
+/* todo: dirty? */
+/* if exportfs_decode_fh() passed vfsmount*, we could be happy */
+static struct vfsmount *au_mnt_get(struct super_block *sb)
+{
+	struct mnt_namespace *ns;
+	struct vfsmount *pos, *mnt;
+
+	spin_lock(&vfsmount_lock);
+	/* no get/put ?? */
+	AuDebugOn(!current->nsproxy);
+	ns = current->nsproxy->mnt_ns;
+	AuDebugOn(!ns);
+	mnt = NULL;
+	/* the order (reverse) will not be a problem */
+	list_for_each_entry(pos, &ns->list, mnt_list)
+		if (pos->mnt_sb == sb) {
+			mnt = mntget(pos);
+			break;
+		}
+	spin_unlock(&vfsmount_lock);
+	AuDebugOn(!mnt);
+
+	return mnt;
+}
+
+struct au_nfsd_si_lock {
+	const unsigned int sigen;
+	const aufs_bindex_t br_id;
+	unsigned char force_lock;
+};
+
+static aufs_bindex_t si_nfsd_read_lock(struct super_block *sb,
+				       struct au_nfsd_si_lock *nsi_lock)
+{
+	aufs_bindex_t bindex;
+
+	si_read_lock(sb, AuLock_FLUSH);
+
+	/* branch id may be wrapped around */
+	bindex = au_br_index(sb, nsi_lock->br_id);
+	if (bindex >= 0 && nsi_lock->sigen + AUFS_BRANCH_MAX > au_sigen(sb))
+		goto out; /* success */
+
+	if (!nsi_lock->force_lock)
+		si_read_unlock(sb);
+	bindex = -1;
+
+ out:
+	return bindex;
+}
+
+struct find_name_by_ino {
+	int called, found;
+	ino_t ino;
+	char *name;
+	int namelen;
+};
+
+static int
+find_name_by_ino(void *arg, const char *name, int namelen, loff_t offset,
+		 u64 ino, unsigned int d_type)
+{
+	struct find_name_by_ino *a = arg;
+
+	a->called++;
+	if (a->ino != ino)
+		return 0;
+
+	memcpy(a->name, name, namelen);
+	a->namelen = namelen;
+	a->found = 1;
+	return 1;
+}
+
+static struct dentry *au_lkup_by_ino(struct path *path, ino_t ino,
+				     struct au_nfsd_si_lock *nsi_lock)
+{
+	struct dentry *dentry, *parent;
+	struct file *file;
+	struct inode *dir;
+	struct find_name_by_ino arg;
+	int err;
+
+	parent = path->dentry;
+	if (nsi_lock)
+		si_read_unlock(parent->d_sb);
+	path_get(path);
+	file = dentry_open(parent, path->mnt, au_dir_roflags, current_cred());
+	dentry = (void *)file;
+	if (IS_ERR(file))
+		goto out;
+
+	dentry = ERR_PTR(-ENOMEM);
+	arg.name = __getname();
+	if (unlikely(!arg.name))
+		goto out_file;
+	arg.ino = ino;
+	arg.found = 0;
+	do {
+		arg.called = 0;
+		/* smp_mb(); */
+		err = vfsub_readdir(file, find_name_by_ino, &arg);
+	} while (!err && !arg.found && arg.called);
+	dentry = ERR_PTR(err);
+	if (unlikely(err))
+		goto out_name;
+	dentry = ERR_PTR(-ENOENT);
+	if (!arg.found)
+		goto out_name;
+
+	/* do not call au_lkup_one() */
+	dir = parent->d_inode;
+	mutex_lock(&dir->i_mutex);
+	dentry = vfsub_lookup_one_len(arg.name, parent, arg.namelen);
+	mutex_unlock(&dir->i_mutex);
+	AuTraceErrPtr(dentry);
+	if (IS_ERR(dentry))
+		goto out_name;
+	AuDebugOn(au_test_anon(dentry));
+	if (unlikely(!dentry->d_inode)) {
+		dput(dentry);
+		dentry = ERR_PTR(-ENOENT);
+	}
+
+ out_name:
+	__putname(arg.name);
+ out_file:
+	fput(file);
+ out:
+	if (unlikely(nsi_lock
+		     && si_nfsd_read_lock(parent->d_sb, nsi_lock) < 0))
+		if (!IS_ERR(dentry)) {
+			dput(dentry);
+			dentry = ERR_PTR(-ESTALE);
+		}
+	AuTraceErrPtr(dentry);
+	return dentry;
+}
+
+static struct dentry *decode_by_dir_ino(struct super_block *sb, ino_t ino,
+					ino_t dir_ino,
+					struct au_nfsd_si_lock *nsi_lock)
+{
+	struct dentry *dentry;
+	struct path path;
+
+	if (dir_ino != AUFS_ROOT_INO) {
+		path.dentry = decode_by_ino(sb, dir_ino, 0);
+		dentry = path.dentry;
+		if (!path.dentry || IS_ERR(path.dentry))
+			goto out;
+		AuDebugOn(au_test_anon(path.dentry));
+	} else
+		path.dentry = dget(sb->s_root);
+
+	path.mnt = au_mnt_get(sb);
+	dentry = au_lkup_by_ino(&path, ino, nsi_lock);
+	path_put(&path);
+
+ out:
+	AuTraceErrPtr(dentry);
+	return dentry;
+}
+
+/* ---------------------------------------------------------------------- */
+
+static int h_acceptable(void *expv, struct dentry *dentry)
+{
+	return 1;
+}
+
+static char *au_build_path(struct dentry *h_parent, struct path *h_rootpath,
+			   char *buf, int len, struct super_block *sb)
+{
+	char *p;
+	int n;
+	struct path path;
+
+	p = d_path(h_rootpath, buf, len);
+	if (IS_ERR(p))
+		goto out;
+	n = strlen(p);
+
+	path.mnt = h_rootpath->mnt;
+	path.dentry = h_parent;
+	p = d_path(&path, buf, len);
+	if (IS_ERR(p))
+		goto out;
+	if (n != 1)
+		p += n;
+
+	path.mnt = au_mnt_get(sb);
+	path.dentry = sb->s_root;
+	p = d_path(&path, buf, len - strlen(p));
+	mntput(path.mnt);
+	if (IS_ERR(p))
+		goto out;
+	if (n != 1)
+		p[strlen(p)] = '/';
+
+ out:
+	AuTraceErrPtr(p);
+	return p;
+}
+
+static
+struct dentry *decode_by_path(struct super_block *sb, aufs_bindex_t bindex,
+			      ino_t ino, __u32 *fh, int fh_len,
+			      struct au_nfsd_si_lock *nsi_lock)
+{
+	struct dentry *dentry, *h_parent, *root;
+	struct super_block *h_sb;
+	char *pathname, *p;
+	struct vfsmount *h_mnt;
+	struct au_branch *br;
+	int err;
+	struct path path;
+
+	br = au_sbr(sb, bindex);
+	/* au_br_get(br); */
+	h_mnt = br->br_mnt;
+	h_sb = h_mnt->mnt_sb;
+	/* todo: call lower fh_to_dentry()? fh_to_parent()? */
+	h_parent = exportfs_decode_fh(h_mnt, (void *)(fh + Fh_tail),
+				      fh_len - Fh_tail, fh[Fh_h_type],
+				      h_acceptable, /*context*/NULL);
+	dentry = h_parent;
+	if (unlikely(!h_parent || IS_ERR(h_parent))) {
+		AuWarn1("%s decode_fh failed, %ld\n",
+			au_sbtype(h_sb), PTR_ERR(h_parent));
+		goto out;
+	}
+	dentry = NULL;
+	if (unlikely(au_test_anon(h_parent))) {
+		AuWarn1("%s decode_fh returned a disconnected dentry\n",
+			au_sbtype(h_sb));
+		goto out_h_parent;
+	}
+
+	dentry = ERR_PTR(-ENOMEM);
+	pathname = (void *)__get_free_page(GFP_NOFS);
+	if (unlikely(!pathname))
+		goto out_h_parent;
+
+	root = sb->s_root;
+	path.mnt = h_mnt;
+	di_read_lock_parent(root, !AuLock_IR);
+	path.dentry = au_h_dptr(root, bindex);
+	di_read_unlock(root, !AuLock_IR);
+	p = au_build_path(h_parent, &path, pathname, PAGE_SIZE, sb);
+	dentry = (void *)p;
+	if (IS_ERR(p))
+		goto out_pathname;
+
+	si_read_unlock(sb);
+	err = vfsub_kern_path(p, LOOKUP_FOLLOW | LOOKUP_DIRECTORY, &path);
+	dentry = ERR_PTR(err);
+	if (unlikely(err))
+		goto out_relock;
+
+	dentry = ERR_PTR(-ENOENT);
+	AuDebugOn(au_test_anon(path.dentry));
+	if (unlikely(!path.dentry->d_inode))
+		goto out_path;
+
+	if (ino != path.dentry->d_inode->i_ino)
+		dentry = au_lkup_by_ino(&path, ino, /*nsi_lock*/NULL);
+	else
+		dentry = dget(path.dentry);
+
+ out_path:
+	path_put(&path);
+ out_relock:
+	if (unlikely(si_nfsd_read_lock(sb, nsi_lock) < 0))
+		if (!IS_ERR(dentry)) {
+			dput(dentry);
+			dentry = ERR_PTR(-ESTALE);
+		}
+ out_pathname:
+	free_page((unsigned long)pathname);
+ out_h_parent:
+	dput(h_parent);
+ out:
+	/* au_br_put(br); */
+	AuTraceErrPtr(dentry);
+	return dentry;
+}
+
+/* ---------------------------------------------------------------------- */
+
+static struct dentry *
+aufs_fh_to_dentry(struct super_block *sb, struct fid *fid, int fh_len,
+		  int fh_type)
+{
+	struct dentry *dentry;
+	__u32 *fh = fid->raw;
+	ino_t ino, dir_ino;
+	aufs_bindex_t bindex;
+	struct au_nfsd_si_lock nsi_lock = {
+		.sigen		= fh[Fh_sigen],
+		.br_id		= fh[Fh_br_id],
+		.force_lock	= 0
+	};
+
+	AuDebugOn(fh_len < Fh_tail);
+
+	dentry = ERR_PTR(-ESTALE);
+	/* branch id may be wrapped around */
+	bindex = si_nfsd_read_lock(sb, &nsi_lock);
+	if (unlikely(bindex < 0))
+		goto out;
+	nsi_lock.force_lock = 1;
+
+	/* is this inode still cached? */
+	ino = decode_ino(fh + Fh_ino);
+	AuDebugOn(ino == AUFS_ROOT_INO);
+	dir_ino = decode_ino(fh + Fh_dir_ino);
+	dentry = decode_by_ino(sb, ino, dir_ino);
+	if (IS_ERR(dentry))
+		goto out_unlock;
+	if (dentry)
+		goto accept;
+
+	/* is the parent dir cached? */
+	dentry = decode_by_dir_ino(sb, ino, dir_ino, &nsi_lock);
+	if (IS_ERR(dentry))
+		goto out_unlock;
+	if (dentry)
+		goto accept;
+
+	/* lookup path */
+	dentry = decode_by_path(sb, bindex, ino, fh, fh_len, &nsi_lock);
+	if (IS_ERR(dentry))
+		goto out_unlock;
+	if (unlikely(!dentry))
+		/* todo?: make it ESTALE */
+		goto out_unlock;
+
+ accept:
+	if (dentry->d_inode->i_generation == fh[Fh_igen])
+		goto out_unlock; /* success */
+
+	dput(dentry);
+	dentry = ERR_PTR(-ESTALE);
+ out_unlock:
+	si_read_unlock(sb);
+ out:
+	AuTraceErrPtr(dentry);
+	return dentry;
+}
+
+#if 0 /* reserved for future use */
+/* support subtreecheck option */
+static struct dentry *aufs_fh_to_parent(struct super_block *sb, struct fid *fid,
+					int fh_len, int fh_type)
+{
+	struct dentry *parent;
+	__u32 *fh = fid->raw;
+	ino_t dir_ino;
+
+	dir_ino = decode_ino(fh + Fh_dir_ino);
+	parent = decode_by_ino(sb, dir_ino, 0);
+	if (IS_ERR(parent))
+		goto out;
+	if (!parent)
+		parent = decode_by_path(sb, au_br_index(sb, fh[Fh_br_id]),
+					dir_ino, fh, fh_len);
+
+ out:
+	AuTraceErrPtr(parent);
+	return parent;
+}
+#endif
+
+/* ---------------------------------------------------------------------- */
+
+static int aufs_encode_fh(struct dentry *dentry, __u32 *fh, int *max_len,
+			  int connectable)
+{
+	int err;
+	aufs_bindex_t bindex, bend;
+	struct super_block *sb, *h_sb;
+	struct inode *inode;
+	struct dentry *parent, *h_parent;
+	struct au_branch *br;
+
+	AuDebugOn(au_test_anon(dentry));
+
+	parent = NULL;
+	err = -ENOSPC;
+	if (unlikely(*max_len <= Fh_tail)) {
+		AuWarn1("NFSv2 client (max_len %d)?\n", *max_len);
+		goto out;
+	}
+
+	err = FILEID_ROOT;
+	if (IS_ROOT(dentry)) {
+		AuDebugOn(dentry->d_inode->i_ino != AUFS_ROOT_INO);
+		goto out;
+	}
+
+	err = -EIO;
+	h_parent = NULL;
+	sb = dentry->d_sb;
+	aufs_read_lock(dentry, AuLock_FLUSH | AuLock_IR);
+	parent = dget_parent(dentry);
+	di_read_lock_parent(parent, !AuLock_IR);
+	inode = dentry->d_inode;
+	AuDebugOn(!inode);
+#ifdef CONFIG_AUFS_DEBUG
+	if (unlikely(!au_opt_test(au_mntflags(sb), XINO)))
+		AuWarn1("NFS-exporting requires xino\n");
+#endif
+
+	bend = au_dbtaildir(parent);
+	for (bindex = au_dbstart(parent); bindex <= bend; bindex++) {
+		h_parent = au_h_dptr(parent, bindex);
+		if (h_parent) {
+			dget(h_parent);
+			break;
+		}
+	}
+	if (unlikely(!h_parent))
+		goto out_unlock;
+
+	err = -EPERM;
+	br = au_sbr(sb, bindex);
+	h_sb = br->br_mnt->mnt_sb;
+	if (unlikely(!h_sb->s_export_op)) {
+		AuErr1("%s branch is not exportable\n", au_sbtype(h_sb));
+		goto out_dput;
+	}
+
+	fh[Fh_br_id] = br->br_id;
+	fh[Fh_sigen] = au_sigen(sb);
+	encode_ino(fh + Fh_ino, inode->i_ino);
+	encode_ino(fh + Fh_dir_ino, parent->d_inode->i_ino);
+	fh[Fh_igen] = inode->i_generation;
+
+	*max_len -= Fh_tail;
+	fh[Fh_h_type] = exportfs_encode_fh(h_parent, (void *)(fh + Fh_tail),
+					   max_len,
+					   /*connectable or subtreecheck*/0);
+	err = fh[Fh_h_type];
+	*max_len += Fh_tail;
+	/* todo: macros? */
+	if (err != 255)
+		err = 99;
+	else
+		AuWarn1("%s encode_fh failed\n", au_sbtype(h_sb));
+
+ out_dput:
+	dput(h_parent);
+ out_unlock:
+	di_read_unlock(parent, !AuLock_IR);
+	dput(parent);
+	aufs_read_unlock(dentry, AuLock_IR);
+ out:
+	if (unlikely(err < 0))
+		err = 255;
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+static struct export_operations aufs_export_op = {
+	.fh_to_dentry	= aufs_fh_to_dentry,
+	/* .fh_to_parent	= aufs_fh_to_parent, */
+	.encode_fh	= aufs_encode_fh
+};
+
+void au_export_init(struct super_block *sb)
+{
+	struct au_sbinfo *sbinfo;
+	__u32 u;
+
+	sb->s_export_op = &aufs_export_op;
+	sbinfo = au_sbi(sb);
+	sbinfo->si_xigen = NULL;
+	get_random_bytes(&u, sizeof(u));
+	BUILD_BUG_ON(sizeof(u) != sizeof(int));
+	atomic_set(&sbinfo->si_xigen_next, u);
+}
--- linux-rt-2.6.31.orig/ubuntu/aufs/module.c
+++ linux-rt-2.6.31/ubuntu/aufs/module.c
@@ -0,0 +1,173 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * module global variables and operations
+ */
+
+#include <linux/module.h>
+#include <linux/seq_file.h>
+#include "aufs.h"
+
+void *au_kzrealloc(void *p, unsigned int nused, unsigned int new_sz, gfp_t gfp)
+{
+	if (new_sz <= nused)
+		return p;
+
+	p = krealloc(p, new_sz, gfp);
+	if (p)
+		memset(p + nused, 0, new_sz - nused);
+	return p;
+}
+
+/* ---------------------------------------------------------------------- */
+
+/*
+ * aufs caches
+ */
+struct kmem_cache *au_cachep[AuCache_Last];
+static int __init au_cache_init(void)
+{
+	au_cachep[AuCache_DINFO] = AuCache(au_dinfo);
+	if (au_cachep[AuCache_DINFO])
+		au_cachep[AuCache_ICNTNR] = AuCache(au_icntnr);
+	if (au_cachep[AuCache_ICNTNR])
+		au_cachep[AuCache_FINFO] = AuCache(au_finfo);
+	if (au_cachep[AuCache_FINFO])
+		au_cachep[AuCache_VDIR] = AuCache(au_vdir);
+	if (au_cachep[AuCache_VDIR])
+		au_cachep[AuCache_DEHSTR] = AuCache(au_vdir_dehstr);
+	if (au_cachep[AuCache_DEHSTR])
+		return 0;
+
+	return -ENOMEM;
+}
+
+static void au_cache_fin(void)
+{
+	int i;
+	for (i = 0; i < AuCache_Last; i++)
+		if (au_cachep[i]) {
+			kmem_cache_destroy(au_cachep[i]);
+			au_cachep[i] = NULL;
+		}
+}
+
+/* ---------------------------------------------------------------------- */
+
+int au_dir_roflags;
+
+/*
+ * functions for module interface.
+ */
+MODULE_LICENSE("GPL");
+/* MODULE_LICENSE("GPL v2"); */
+MODULE_AUTHOR("Junjiro R. Okajima <aufs-users@lists.sourceforge.net>");
+MODULE_DESCRIPTION(AUFS_NAME
+	" -- Advanced multi layered unification filesystem");
+MODULE_VERSION(AUFS_VERSION);
+
+/* it should be 'byte', but param_set_byte() prints it by "%c" */
+short aufs_nwkq = AUFS_NWKQ_DEF;
+MODULE_PARM_DESC(nwkq, "the number of workqueue thread, " AUFS_WKQ_NAME);
+module_param_named(nwkq, aufs_nwkq, short, S_IRUGO);
+
+/* this module parameter has no meaning when SYSFS is disabled */
+int sysaufs_brs = 1;
+MODULE_PARM_DESC(brs, "use <sysfs>/fs/aufs/si_*/brN");
+module_param_named(brs, sysaufs_brs, int, S_IRUGO);
+
+/* ---------------------------------------------------------------------- */
+
+static char au_esc_chars[0x20 + 3]; /* 0x01-0x20, backslash, del, and NULL */
+
+int au_seq_path(struct seq_file *seq, struct path *path)
+{
+	return seq_path(seq, path, au_esc_chars);
+}
+
+/* ---------------------------------------------------------------------- */
+
+static int __init aufs_init(void)
+{
+	int err, i;
+	char *p;
+
+	p = au_esc_chars;
+	for (i = 1; i <= ' '; i++)
+		*p++ = i;
+	*p++ = '\\';
+	*p++ = '\x7f';
+	*p = 0;
+
+	au_dir_roflags = au_file_roflags(O_DIRECTORY | O_LARGEFILE);
+
+	sysaufs_brs_init();
+	au_debug_init();
+
+	err = -EINVAL;
+	if (unlikely(aufs_nwkq <= 0))
+		goto out;
+
+	err = sysaufs_init();
+	if (unlikely(err))
+		goto out;
+	err = au_wkq_init();
+	if (unlikely(err))
+		goto out_sysaufs;
+	err = au_hinotify_init();
+	if (unlikely(err))
+		goto out_wkq;
+	err = au_sysrq_init();
+	if (unlikely(err))
+		goto out_hin;
+	err = au_cache_init();
+	if (unlikely(err))
+		goto out_sysrq;
+	err = register_filesystem(&aufs_fs_type);
+	if (unlikely(err))
+		goto out_cache;
+	pr_info(AUFS_NAME " " AUFS_VERSION "\n");
+	goto out; /* success */
+
+ out_cache:
+	au_cache_fin();
+ out_sysrq:
+	au_sysrq_fin();
+ out_hin:
+	au_hinotify_fin();
+ out_wkq:
+	au_wkq_fin();
+ out_sysaufs:
+	sysaufs_fin();
+ out:
+	return err;
+}
+
+static void __exit aufs_exit(void)
+{
+	unregister_filesystem(&aufs_fs_type);
+	au_cache_fin();
+	au_sysrq_fin();
+	au_hinotify_fin();
+	au_wkq_fin();
+	sysaufs_fin();
+}
+
+module_init(aufs_init);
+module_exit(aufs_exit);
--- linux-rt-2.6.31.orig/ubuntu/aufs/i_op_add.c
+++ linux-rt-2.6.31/ubuntu/aufs/i_op_add.c
@@ -0,0 +1,644 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * inode operations (add entry)
+ */
+
+#include "aufs.h"
+
+/*
+ * final procedure of adding a new entry, except link(2).
+ * remove whiteout, instantiate, copyup the parent dir's times and size
+ * and update version.
+ * if it failed, re-create the removed whiteout.
+ */
+static int epilog(struct inode *dir, aufs_bindex_t bindex,
+		  struct dentry *wh_dentry, struct dentry *dentry)
+{
+	int err, rerr;
+	aufs_bindex_t bwh;
+	struct path h_path;
+	struct inode *inode, *h_dir;
+	struct dentry *wh;
+
+	bwh = -1;
+	if (wh_dentry) {
+		h_dir = wh_dentry->d_parent->d_inode; /* dir inode is locked */
+		IMustLock(h_dir);
+		AuDebugOn(au_h_iptr(dir, bindex) != h_dir);
+		bwh = au_dbwh(dentry);
+		h_path.dentry = wh_dentry;
+		h_path.mnt = au_sbr_mnt(dir->i_sb, bindex);
+		err = au_wh_unlink_dentry(au_h_iptr(dir, bindex), &h_path,
+					  dentry);
+		if (unlikely(err))
+			goto out;
+	}
+
+	inode = au_new_inode(dentry, /*must_new*/1);
+	if (!IS_ERR(inode)) {
+		d_instantiate(dentry, inode);
+		dir = dentry->d_parent->d_inode; /* dir inode is locked */
+		IMustLock(dir);
+		if (au_ibstart(dir) == au_dbstart(dentry))
+			au_cpup_attr_timesizes(dir);
+		dir->i_version++;
+		return 0; /* success */
+	}
+
+	err = PTR_ERR(inode);
+	if (!wh_dentry)
+		goto out;
+
+	/* revert */
+	/* dir inode is locked */
+	wh = au_wh_create(dentry, bwh, wh_dentry->d_parent);
+	rerr = PTR_ERR(wh);
+	if (IS_ERR(wh)) {
+		AuIOErr("%.*s reverting whiteout failed(%d, %d)\n",
+			AuDLNPair(dentry), err, rerr);
+		err = -EIO;
+	} else
+		dput(wh);
+
+ out:
+	return err;
+}
+
+/*
+ * simple tests for the adding inode operations.
+ * following the checks in vfs, plus the parent-child relationship.
+ */
+int au_may_add(struct dentry *dentry, aufs_bindex_t bindex,
+	       struct dentry *h_parent, int isdir)
+{
+	int err;
+	umode_t h_mode;
+	struct dentry *h_dentry;
+	struct inode *h_inode;
+
+	h_dentry = au_h_dptr(dentry, bindex);
+	h_inode = h_dentry->d_inode;
+	if (!dentry->d_inode) {
+		err = -EEXIST;
+		if (unlikely(h_inode))
+			goto out;
+	} else {
+		/* rename(2) case */
+		err = -EIO;
+		if (unlikely(!h_inode || !h_inode->i_nlink))
+			goto out;
+
+		h_mode = h_inode->i_mode;
+		if (!isdir) {
+			err = -EISDIR;
+			if (unlikely(S_ISDIR(h_mode)))
+				goto out;
+		} else if (unlikely(!S_ISDIR(h_mode))) {
+			err = -ENOTDIR;
+			goto out;
+		}
+	}
+
+	err = -EIO;
+	/* expected parent dir is locked */
+	if (unlikely(h_parent != h_dentry->d_parent))
+		goto out;
+	err = 0;
+
+ out:
+	return err;
+}
+
+/*
+ * initial procedure of adding a new entry.
+ * prepare writable branch and the parent dir, lock it,
+ * and lookup whiteout for the new entry.
+ */
+static struct dentry*
+lock_hdir_lkup_wh(struct dentry *dentry, struct au_dtime *dt,
+		  struct dentry *src_dentry, struct au_pin *pin,
+		  struct au_wr_dir_args *wr_dir_args)
+{
+	struct dentry *wh_dentry, *h_parent;
+	struct super_block *sb;
+	struct au_branch *br;
+	int err;
+	unsigned int udba;
+	aufs_bindex_t bcpup;
+
+	err = au_wr_dir(dentry, src_dentry, wr_dir_args);
+	bcpup = err;
+	wh_dentry = ERR_PTR(err);
+	if (unlikely(err < 0))
+		goto out;
+
+	sb = dentry->d_sb;
+	udba = au_opt_udba(sb);
+	err = au_pin(pin, dentry, bcpup, udba,
+		     AuPin_DI_LOCKED | AuPin_MNT_WRITE);
+	wh_dentry = ERR_PTR(err);
+	if (unlikely(err))
+		goto out;
+
+	h_parent = au_pinned_h_parent(pin);
+	if (udba != AuOpt_UDBA_NONE
+	    && au_dbstart(dentry) == bcpup) {
+		err = au_may_add(dentry, bcpup, h_parent,
+				 au_ftest_wrdir(wr_dir_args->flags, ISDIR));
+		wh_dentry = ERR_PTR(err);
+		if (unlikely(err))
+			goto out_unpin;
+	}
+
+	br = au_sbr(sb, bcpup);
+	if (dt) {
+		struct path tmp = {
+			.dentry	= h_parent,
+			.mnt	= br->br_mnt
+		};
+		au_dtime_store(dt, au_pinned_parent(pin), &tmp);
+	}
+
+	wh_dentry = NULL;
+	if (bcpup != au_dbwh(dentry))
+		goto out; /* success */
+
+	wh_dentry = au_wh_lkup(h_parent, &dentry->d_name, br);
+
+ out_unpin:
+	if (IS_ERR(wh_dentry))
+		au_unpin(pin);
+ out:
+	return wh_dentry;
+}
+
+/* ---------------------------------------------------------------------- */
+
+enum { Mknod, Symlink, Creat };
+struct simple_arg {
+	int type;
+	union {
+		struct {
+			int mode;
+			struct nameidata *nd;
+		} c;
+		struct {
+			const char *symname;
+		} s;
+		struct {
+			int mode;
+			dev_t dev;
+		} m;
+	} u;
+};
+
+static int add_simple(struct inode *dir, struct dentry *dentry,
+		      struct simple_arg *arg)
+{
+	int err;
+	aufs_bindex_t bstart;
+	unsigned char created;
+	struct au_dtime dt;
+	struct au_pin pin;
+	struct path h_path;
+	struct dentry *wh_dentry, *parent;
+	struct inode *h_dir;
+	struct au_wr_dir_args wr_dir_args = {
+		.force_btgt	= -1,
+		.flags		= AuWrDir_ADD_ENTRY
+	};
+
+	IMustLock(dir);
+
+	parent = dentry->d_parent; /* dir inode is locked */
+	aufs_read_lock(dentry, AuLock_DW);
+	di_write_lock_parent(parent);
+	wh_dentry = lock_hdir_lkup_wh(dentry, &dt, /*src_dentry*/NULL, &pin,
+				      &wr_dir_args);
+	err = PTR_ERR(wh_dentry);
+	if (IS_ERR(wh_dentry))
+		goto out;
+
+	bstart = au_dbstart(dentry);
+	h_path.dentry = au_h_dptr(dentry, bstart);
+	h_path.mnt = au_sbr_mnt(dentry->d_sb, bstart);
+	h_dir = au_pinned_h_dir(&pin);
+	switch (arg->type) {
+	case Creat:
+		err = vfsub_create(h_dir, &h_path, arg->u.c.mode);
+		break;
+	case Symlink:
+		err = vfsub_symlink(h_dir, &h_path, arg->u.s.symname);
+		break;
+	case Mknod:
+		err = vfsub_mknod(h_dir, &h_path, arg->u.m.mode, arg->u.m.dev);
+		break;
+	default:
+		BUG();
+	}
+	created = !err;
+	if (!err)
+		err = epilog(dir, bstart, wh_dentry, dentry);
+
+	/* revert */
+	if (unlikely(created && err && h_path.dentry->d_inode)) {
+		int rerr;
+		rerr = vfsub_unlink(h_dir, &h_path, /*force*/0);
+		if (rerr) {
+			AuIOErr("%.*s revert failure(%d, %d)\n",
+				AuDLNPair(dentry), err, rerr);
+			err = -EIO;
+		}
+		au_dtime_revert(&dt);
+		d_drop(dentry);
+	}
+
+	au_unpin(&pin);
+	dput(wh_dentry);
+
+ out:
+	if (unlikely(err)) {
+		au_update_dbstart(dentry);
+		d_drop(dentry);
+	}
+	di_write_unlock(parent);
+	aufs_read_unlock(dentry, AuLock_DW);
+	return err;
+}
+
+int aufs_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
+{
+	struct simple_arg arg = {
+		.type = Mknod,
+		.u.m = {
+			.mode	= mode,
+			.dev	= dev
+		}
+	};
+	return add_simple(dir, dentry, &arg);
+}
+
+int aufs_symlink(struct inode *dir, struct dentry *dentry, const char *symname)
+{
+	struct simple_arg arg = {
+		.type = Symlink,
+		.u.s.symname = symname
+	};
+	return add_simple(dir, dentry, &arg);
+}
+
+int aufs_create(struct inode *dir, struct dentry *dentry, int mode,
+		struct nameidata *nd)
+{
+	struct simple_arg arg = {
+		.type = Creat,
+		.u.c = {
+			.mode	= mode,
+			.nd	= nd
+		}
+	};
+	return add_simple(dir, dentry, &arg);
+}
+
+/* ---------------------------------------------------------------------- */
+
+struct au_link_args {
+	aufs_bindex_t bdst, bsrc;
+	struct au_pin pin;
+	struct path h_path;
+	struct dentry *src_parent, *parent;
+};
+
+static int au_cpup_before_link(struct dentry *src_dentry,
+			       struct au_link_args *a)
+{
+	int err;
+	struct dentry *h_src_dentry;
+	struct mutex *h_mtx;
+
+	di_read_lock_parent(a->src_parent, AuLock_IR);
+	err = au_test_and_cpup_dirs(src_dentry, a->bdst);
+	if (unlikely(err))
+		goto out;
+
+	h_src_dentry = au_h_dptr(src_dentry, a->bsrc);
+	h_mtx = &h_src_dentry->d_inode->i_mutex;
+	err = au_pin(&a->pin, src_dentry, a->bdst,
+		     au_opt_udba(src_dentry->d_sb),
+		     AuPin_DI_LOCKED | AuPin_MNT_WRITE);
+	if (unlikely(err))
+		goto out;
+	mutex_lock_nested(h_mtx, AuLsc_I_CHILD);
+	err = au_sio_cpup_simple(src_dentry, a->bdst, -1,
+				 AuCpup_DTIME /* | AuCpup_KEEPLINO */);
+	mutex_unlock(h_mtx);
+	au_unpin(&a->pin);
+
+ out:
+	di_read_unlock(a->src_parent, AuLock_IR);
+	return err;
+}
+
+static int au_cpup_or_link(struct dentry *src_dentry, struct au_link_args *a)
+{
+	int err;
+	unsigned char plink;
+	struct inode *h_inode, *inode;
+	struct dentry *h_src_dentry;
+	struct super_block *sb;
+
+	plink = 0;
+	h_inode = NULL;
+	sb = src_dentry->d_sb;
+	inode = src_dentry->d_inode;
+	if (au_ibstart(inode) <= a->bdst)
+		h_inode = au_h_iptr(inode, a->bdst);
+	if (!h_inode || !h_inode->i_nlink) {
+		/* copyup src_dentry as the name of dentry. */
+		au_set_dbstart(src_dentry, a->bdst);
+		au_set_h_dptr(src_dentry, a->bdst, dget(a->h_path.dentry));
+		h_inode = au_h_dptr(src_dentry, a->bsrc)->d_inode;
+		mutex_lock_nested(&h_inode->i_mutex, AuLsc_I_CHILD);
+		err = au_sio_cpup_single(src_dentry, a->bdst, a->bsrc, -1,
+					 AuCpup_KEEPLINO, a->parent);
+		mutex_unlock(&h_inode->i_mutex);
+		au_set_h_dptr(src_dentry, a->bdst, NULL);
+		au_set_dbstart(src_dentry, a->bsrc);
+	} else {
+		/* the inode of src_dentry already exists on a.bdst branch */
+		h_src_dentry = d_find_alias(h_inode);
+		if (!h_src_dentry && au_plink_test(inode)) {
+			plink = 1;
+			h_src_dentry = au_plink_lkup(inode, a->bdst);
+			err = PTR_ERR(h_src_dentry);
+			if (IS_ERR(h_src_dentry))
+				goto out;
+
+			if (unlikely(!h_src_dentry->d_inode)) {
+				dput(h_src_dentry);
+				h_src_dentry = NULL;
+			}
+
+		}
+		if (h_src_dentry) {
+			err = vfsub_link(h_src_dentry, au_pinned_h_dir(&a->pin),
+					 &a->h_path);
+			dput(h_src_dentry);
+		} else {
+			AuIOErr("no dentry found for hi%lu on b%d\n",
+				h_inode->i_ino, a->bdst);
+			err = -EIO;
+		}
+	}
+
+	if (!err && !plink)
+		au_plink_append(inode, a->bdst, a->h_path.dentry);
+
+out:
+	return err;
+}
+
+int aufs_link(struct dentry *src_dentry, struct inode *dir,
+	      struct dentry *dentry)
+{
+	int err, rerr;
+	struct au_dtime dt;
+	struct au_link_args *a;
+	struct dentry *wh_dentry, *h_src_dentry;
+	struct inode *inode;
+	struct super_block *sb;
+	struct au_wr_dir_args wr_dir_args = {
+		/* .force_btgt	= -1, */
+		.flags		= AuWrDir_ADD_ENTRY
+	};
+
+	IMustLock(dir);
+	inode = src_dentry->d_inode;
+	IMustLock(inode);
+
+	err = -ENOENT;
+	if (unlikely(!inode->i_nlink))
+		goto out;
+
+	err = -ENOMEM;
+	a = kzalloc(sizeof(*a), GFP_NOFS);
+	if (unlikely(!a))
+		goto out;
+
+	a->parent = dentry->d_parent; /* dir inode is locked */
+	aufs_read_and_write_lock2(dentry, src_dentry, /*AuLock_FLUSH*/0);
+	a->src_parent = dget_parent(src_dentry);
+	wr_dir_args.force_btgt = au_dbstart(src_dentry);
+
+	di_write_lock_parent(a->parent);
+	wr_dir_args.force_btgt = au_wbr(dentry, wr_dir_args.force_btgt);
+	wh_dentry = lock_hdir_lkup_wh(dentry, &dt, src_dentry, &a->pin,
+				      &wr_dir_args);
+	err = PTR_ERR(wh_dentry);
+	if (IS_ERR(wh_dentry))
+		goto out_unlock;
+
+	err = 0;
+	sb = dentry->d_sb;
+	a->bdst = au_dbstart(dentry);
+	a->h_path.dentry = au_h_dptr(dentry, a->bdst);
+	a->h_path.mnt = au_sbr_mnt(sb, a->bdst);
+	a->bsrc = au_dbstart(src_dentry);
+	if (au_opt_test(au_mntflags(sb), PLINK)) {
+		if (a->bdst < a->bsrc
+		    /* && h_src_dentry->d_sb != a->h_path.dentry->d_sb */)
+			err = au_cpup_or_link(src_dentry, a);
+		else {
+			h_src_dentry = au_h_dptr(src_dentry, a->bdst);
+			err = vfsub_link(h_src_dentry, au_pinned_h_dir(&a->pin),
+					 &a->h_path);
+		}
+	} else {
+		/*
+		 * copyup src_dentry to the branch we process,
+		 * and then link(2) to it.
+		 */
+		if (a->bdst < a->bsrc
+		    /* && h_src_dentry->d_sb != a->h_path.dentry->d_sb */) {
+			au_unpin(&a->pin);
+			di_write_unlock(a->parent);
+			err = au_cpup_before_link(src_dentry, a);
+			di_write_lock_parent(a->parent);
+			if (!err)
+				err = au_pin(&a->pin, dentry, a->bdst,
+					     au_opt_udba(sb),
+					     AuPin_DI_LOCKED | AuPin_MNT_WRITE);
+			if (unlikely(err))
+				goto out_wh;
+		}
+		if (!err) {
+			h_src_dentry = au_h_dptr(src_dentry, a->bdst);
+			err = -ENOENT;
+			if (h_src_dentry && h_src_dentry->d_inode)
+				err = vfsub_link(h_src_dentry,
+						 au_pinned_h_dir(&a->pin),
+						 &a->h_path);
+		}
+	}
+	if (unlikely(err))
+		goto out_unpin;
+
+	if (wh_dentry) {
+		a->h_path.dentry = wh_dentry;
+		err = au_wh_unlink_dentry(au_pinned_h_dir(&a->pin), &a->h_path,
+					  dentry);
+		if (unlikely(err))
+			goto out_revert;
+	}
+
+	dir->i_version++;
+	if (au_ibstart(dir) == au_dbstart(dentry))
+		au_cpup_attr_timesizes(dir);
+	inc_nlink(inode);
+	inode->i_ctime = dir->i_ctime;
+	if (!d_unhashed(a->h_path.dentry))
+		d_instantiate(dentry, au_igrab(inode));
+	else
+		/* some filesystem calls d_drop() */
+		d_drop(dentry);
+	goto out_unpin; /* success */
+
+ out_revert:
+	rerr = vfsub_unlink(au_pinned_h_dir(&a->pin), &a->h_path, /*force*/0);
+	if (!rerr)
+		goto out_dt;
+	AuIOErr("%.*s reverting failed(%d, %d)\n",
+		AuDLNPair(dentry), err, rerr);
+	err = -EIO;
+ out_dt:
+	d_drop(dentry);
+	au_dtime_revert(&dt);
+ out_unpin:
+	au_unpin(&a->pin);
+ out_wh:
+	dput(wh_dentry);
+ out_unlock:
+	if (unlikely(err)) {
+		au_update_dbstart(dentry);
+		d_drop(dentry);
+	}
+	di_write_unlock(a->parent);
+	dput(a->src_parent);
+	aufs_read_and_write_unlock2(dentry, src_dentry);
+	kfree(a);
+ out:
+	return err;
+}
+
+int aufs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
+{
+	int err, rerr;
+	aufs_bindex_t bindex;
+	unsigned char diropq;
+	struct path h_path;
+	struct dentry *wh_dentry, *parent, *opq_dentry;
+	struct mutex *h_mtx;
+	struct super_block *sb;
+	struct {
+		struct au_pin pin;
+		struct au_dtime dt;
+	} *a; /* reduce the stack usage */
+	struct au_wr_dir_args wr_dir_args = {
+		.force_btgt	= -1,
+		.flags		= AuWrDir_ADD_ENTRY | AuWrDir_ISDIR
+	};
+
+	IMustLock(dir);
+
+	a = kmalloc(sizeof(*a), GFP_NOFS);
+
+	aufs_read_lock(dentry, AuLock_DW);
+	parent = dentry->d_parent; /* dir inode is locked */
+	di_write_lock_parent(parent);
+	wh_dentry = lock_hdir_lkup_wh(dentry, &a->dt, /*src_dentry*/NULL,
+				      &a->pin, &wr_dir_args);
+	err = PTR_ERR(wh_dentry);
+	if (IS_ERR(wh_dentry))
+		goto out;
+
+	sb = dentry->d_sb;
+	bindex = au_dbstart(dentry);
+	h_path.dentry = au_h_dptr(dentry, bindex);
+	h_path.mnt = au_sbr_mnt(sb, bindex);
+	err = vfsub_mkdir(au_pinned_h_dir(&a->pin), &h_path, mode);
+	if (unlikely(err))
+		goto out_unlock;
+
+	/* make the dir opaque */
+	diropq = 0;
+	h_mtx = &h_path.dentry->d_inode->i_mutex;
+	if (wh_dentry
+	    || au_opt_test(au_mntflags(sb), ALWAYS_DIROPQ)) {
+		mutex_lock_nested(h_mtx, AuLsc_I_CHILD);
+		opq_dentry = au_diropq_create(dentry, bindex);
+		mutex_unlock(h_mtx);
+		err = PTR_ERR(opq_dentry);
+		if (IS_ERR(opq_dentry))
+			goto out_dir;
+		dput(opq_dentry);
+		diropq = 1;
+	}
+
+	err = epilog(dir, bindex, wh_dentry, dentry);
+	if (!err) {
+		inc_nlink(dir);
+		goto out_unlock; /* success */
+	}
+
+	/* revert */
+	if (diropq) {
+		AuLabel(revert opq);
+		mutex_lock_nested(h_mtx, AuLsc_I_CHILD);
+		rerr = au_diropq_remove(dentry, bindex);
+		mutex_unlock(h_mtx);
+		if (rerr) {
+			AuIOErr("%.*s reverting diropq failed(%d, %d)\n",
+				AuDLNPair(dentry), err, rerr);
+			err = -EIO;
+		}
+	}
+
+ out_dir:
+	AuLabel(revert dir);
+	rerr = vfsub_rmdir(au_pinned_h_dir(&a->pin), &h_path);
+	if (rerr) {
+		AuIOErr("%.*s reverting dir failed(%d, %d)\n",
+			AuDLNPair(dentry), err, rerr);
+		err = -EIO;
+	}
+	d_drop(dentry);
+	au_dtime_revert(&a->dt);
+ out_unlock:
+	au_unpin(&a->pin);
+	dput(wh_dentry);
+ out:
+	if (unlikely(err)) {
+		au_update_dbstart(dentry);
+		d_drop(dentry);
+	}
+	di_write_unlock(parent);
+	aufs_read_unlock(dentry, AuLock_DW);
+	return err;
+}
--- linux-rt-2.6.31.orig/ubuntu/aufs/spl.h
+++ linux-rt-2.6.31/ubuntu/aufs/spl.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * simple list protected by a spinlock
+ */
+
+#ifndef __AUFS_SPL_H__
+#define __AUFS_SPL_H__
+
+#ifdef __KERNEL__
+
+#include <linux/spinlock.h>
+#include <linux/list.h>
+
+struct au_splhead {
+	spinlock_t		spin;
+	struct list_head	head;
+};
+
+static inline void au_spl_init(struct au_splhead *spl)
+{
+	spin_lock_init(&spl->spin);
+	INIT_LIST_HEAD(&spl->head);
+}
+
+static inline void au_spl_add(struct list_head *list, struct au_splhead *spl)
+{
+	spin_lock(&spl->spin);
+	list_add(list, &spl->head);
+	spin_unlock(&spl->spin);
+}
+
+static inline void au_spl_del(struct list_head *list, struct au_splhead *spl)
+{
+	spin_lock(&spl->spin);
+	list_del(list);
+	spin_unlock(&spl->spin);
+}
+
+#endif /* __KERNEL__ */
+#endif /* __AUFS_SPL_H__ */
--- linux-rt-2.6.31.orig/ubuntu/aufs/i_op_ren.c
+++ linux-rt-2.6.31/ubuntu/aufs/i_op_ren.c
@@ -0,0 +1,948 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * inode operation (rename entry)
+ * todo: this is crazy monster
+ */
+
+#include "aufs.h"
+
+enum { AuSRC, AuDST, AuSrcDst };
+enum { AuPARENT, AuCHILD, AuParentChild };
+
+#define AuRen_ISDIR	1
+#define AuRen_ISSAMEDIR	(1 << 1)
+#define AuRen_WHSRC	(1 << 2)
+#define AuRen_WHDST	(1 << 3)
+#define AuRen_MNT_WRITE	(1 << 4)
+#define AuRen_DT_DSTDIR	(1 << 5)
+#define AuRen_DIROPQ	(1 << 6)
+#define AuRen_CPUP	(1 << 7)
+#define au_ftest_ren(flags, name)	((flags) & AuRen_##name)
+#define au_fset_ren(flags, name)	{ (flags) |= AuRen_##name; }
+#define au_fclr_ren(flags, name)	{ (flags) &= ~AuRen_##name; }
+
+struct au_ren_args {
+	struct {
+		struct dentry *dentry, *h_dentry, *parent, *h_parent,
+			*wh_dentry;
+		struct inode *dir, *inode;
+		struct au_hinode *hdir;
+		struct au_dtime dt[AuParentChild];
+		aufs_bindex_t bstart;
+	} sd[AuSrcDst];
+
+#define src_dentry	sd[AuSRC].dentry
+#define src_dir		sd[AuSRC].dir
+#define src_inode	sd[AuSRC].inode
+#define src_h_dentry	sd[AuSRC].h_dentry
+#define src_parent	sd[AuSRC].parent
+#define src_h_parent	sd[AuSRC].h_parent
+#define src_wh_dentry	sd[AuSRC].wh_dentry
+#define src_hdir	sd[AuSRC].hdir
+#define src_h_dir	sd[AuSRC].hdir->hi_inode
+#define src_dt		sd[AuSRC].dt
+#define src_bstart	sd[AuSRC].bstart
+
+#define dst_dentry	sd[AuDST].dentry
+#define dst_dir		sd[AuDST].dir
+#define dst_inode	sd[AuDST].inode
+#define dst_h_dentry	sd[AuDST].h_dentry
+#define dst_parent	sd[AuDST].parent
+#define dst_h_parent	sd[AuDST].h_parent
+#define dst_wh_dentry	sd[AuDST].wh_dentry
+#define dst_hdir	sd[AuDST].hdir
+#define dst_h_dir	sd[AuDST].hdir->hi_inode
+#define dst_dt		sd[AuDST].dt
+#define dst_bstart	sd[AuDST].bstart
+
+	struct dentry *h_trap;
+	struct au_branch *br;
+	struct au_hinode *src_hinode;
+	struct path h_path;
+	struct au_nhash whlist;
+	aufs_bindex_t btgt;
+
+	unsigned int flags;
+
+	struct au_whtmp_rmdir *thargs;
+	struct dentry *h_dst;
+};
+
+/* ---------------------------------------------------------------------- */
+
+/*
+ * functions for reverting.
+ * when an error happened in a single rename systemcall, we should revert
+ * everything as if nothing happend.
+ * we don't need to revert the copied-up/down the parent dir since they are
+ * harmless.
+ */
+
+#define RevertFailure(fmt, args...) do { \
+	AuIOErr("revert failure: " fmt " (%d, %d)\n", \
+		##args, err, rerr); \
+	err = -EIO; \
+} while (0)
+
+static void au_ren_rev_diropq(int err, struct au_ren_args *a)
+{
+	int rerr;
+
+	au_hin_imtx_lock_nested(a->src_hinode, AuLsc_I_CHILD);
+	rerr = au_diropq_remove(a->src_dentry, a->btgt);
+	au_hin_imtx_unlock(a->src_hinode);
+	if (rerr)
+		RevertFailure("remove diropq %.*s", AuDLNPair(a->src_dentry));
+}
+
+
+static void au_ren_rev_rename(int err, struct au_ren_args *a)
+{
+	int rerr;
+
+	a->h_path.dentry = au_lkup_one(&a->src_dentry->d_name, a->src_h_parent,
+				       a->br, /*nd*/NULL);
+	rerr = PTR_ERR(a->h_path.dentry);
+	if (IS_ERR(a->h_path.dentry)) {
+		RevertFailure("au_lkup_one %.*s", AuDLNPair(a->src_dentry));
+		return;
+	}
+
+	rerr = vfsub_rename(a->dst_h_dir,
+			    au_h_dptr(a->src_dentry, a->btgt),
+			    a->src_h_dir, &a->h_path);
+	d_drop(a->h_path.dentry);
+	dput(a->h_path.dentry);
+	/* au_set_h_dptr(a->src_dentry, a->btgt, NULL); */
+	if (rerr)
+		RevertFailure("rename %.*s", AuDLNPair(a->src_dentry));
+}
+
+static void au_ren_rev_cpup(int err, struct au_ren_args *a)
+{
+	int rerr;
+
+	a->h_path.dentry = a->dst_h_dentry;
+	rerr = vfsub_unlink(a->dst_h_dir, &a->h_path, /*force*/0);
+	au_set_h_dptr(a->src_dentry, a->btgt, NULL);
+	au_set_dbstart(a->src_dentry, a->src_bstart);
+	if (rerr)
+		RevertFailure("unlink %.*s", AuDLNPair(a->dst_h_dentry));
+}
+
+
+static void au_ren_rev_whtmp(int err, struct au_ren_args *a)
+{
+	int rerr;
+
+	a->h_path.dentry = au_lkup_one(&a->dst_dentry->d_name, a->dst_h_parent,
+				       a->br, /*nd*/NULL);
+	rerr = PTR_ERR(a->h_path.dentry);
+	if (IS_ERR(a->h_path.dentry)) {
+		RevertFailure("lookup %.*s", AuDLNPair(a->dst_dentry));
+		return;
+	}
+	if (a->h_path.dentry->d_inode) {
+		d_drop(a->h_path.dentry);
+		dput(a->h_path.dentry);
+		return;
+	}
+
+	rerr = vfsub_rename(a->dst_h_dir, a->h_dst, a->dst_h_dir, &a->h_path);
+	d_drop(a->h_path.dentry);
+	dput(a->h_path.dentry);
+	if (!rerr) {
+		au_set_h_dptr(a->dst_dentry, a->btgt, NULL);
+		au_set_h_dptr(a->dst_dentry, a->btgt, dget(a->h_dst));
+	} else
+		RevertFailure("rename %.*s", AuDLNPair(a->h_dst));
+}
+
+static void au_ren_rev_whsrc(int err, struct au_ren_args *a)
+{
+	int rerr;
+
+	a->h_path.dentry = a->src_wh_dentry;
+	rerr = au_wh_unlink_dentry(a->src_h_dir, &a->h_path, a->src_dentry);
+	if (rerr)
+		RevertFailure("unlink %.*s", AuDLNPair(a->src_wh_dentry));
+}
+
+static void au_ren_rev_drop(struct au_ren_args *a)
+{
+	struct dentry *d, *h_d;
+	int i;
+	aufs_bindex_t bend, bindex;
+
+	for (i = 0; i < AuSrcDst; i++) {
+		d = a->sd[i].dentry;
+		d_drop(d);
+		bend = au_dbend(d);
+		for (bindex = au_dbstart(d); bindex <= bend; bindex++) {
+			h_d = au_h_dptr(d, bindex);
+			if (h_d)
+				d_drop(h_d);
+		}
+	}
+
+	au_update_dbstart(a->dst_dentry);
+	if (a->thargs)
+		d_drop(a->h_dst);
+}
+#undef RevertFailure
+
+/* ---------------------------------------------------------------------- */
+
+/*
+ * when we have to copyup the renaming entry, do it with the rename-target name
+ * in order to minimize the cost (the later actual rename is unnecessary).
+ * otherwise rename it on the target branch.
+ */
+static int au_ren_or_cpup(struct au_ren_args *a)
+{
+	int err;
+	struct dentry *d;
+
+	d = a->src_dentry;
+	if (au_dbstart(d) == a->btgt) {
+		a->h_path.dentry = a->dst_h_dentry;
+		if (au_ftest_ren(a->flags, DIROPQ)
+		    && au_dbdiropq(d) == a->btgt)
+			au_fclr_ren(a->flags, DIROPQ);
+		AuDebugOn(au_dbstart(d) != a->btgt);
+		err = vfsub_rename(a->src_h_dir, au_h_dptr(d, a->btgt),
+				   a->dst_h_dir, &a->h_path);
+	} else {
+		struct mutex *h_mtx = &a->src_h_dentry->d_inode->i_mutex;
+
+		au_fset_ren(a->flags, CPUP);
+		mutex_lock_nested(h_mtx, AuLsc_I_CHILD);
+		au_set_dbstart(d, a->btgt);
+		au_set_h_dptr(d, a->btgt, dget(a->dst_h_dentry));
+		err = au_sio_cpup_single(d, a->btgt, a->src_bstart, -1,
+					 !AuCpup_DTIME, a->dst_parent);
+		if (unlikely(err)) {
+			au_set_h_dptr(d, a->btgt, NULL);
+			au_set_dbstart(d, a->src_bstart);
+		}
+		mutex_unlock(h_mtx);
+	}
+
+	return err;
+}
+
+/* cf. aufs_rmdir() */
+static int au_ren_del_whtmp(struct au_ren_args *a)
+{
+	int err;
+	struct inode *dir;
+
+	dir = a->dst_dir;
+	SiMustAnyLock(dir->i_sb);
+	if (!au_nhash_test_longer_wh(&a->whlist, a->btgt,
+				     au_sbi(dir->i_sb)->si_dirwh)
+	    || au_test_fs_remote(a->h_dst->d_sb)) {
+		err = au_whtmp_rmdir(dir, a->btgt, a->h_dst, &a->whlist);
+		if (unlikely(err))
+			AuWarn("failed removing whtmp dir %.*s (%d), "
+			       "ignored.\n", AuDLNPair(a->h_dst), err);
+	} else {
+		au_nhash_wh_free(&a->thargs->whlist);
+		a->thargs->whlist = a->whlist;
+		a->whlist.nh_num = 0;
+		au_whtmp_kick_rmdir(dir, a->btgt, a->h_dst, a->thargs);
+		dput(a->h_dst);
+		a->thargs = NULL;
+	}
+
+	return 0;
+}
+
+/* make it 'opaque' dir. */
+static int au_ren_diropq(struct au_ren_args *a)
+{
+	int err;
+	struct dentry *diropq;
+
+	err = 0;
+	a->src_hinode = au_hi(a->src_inode, a->btgt);
+	au_hin_imtx_lock_nested(a->src_hinode, AuLsc_I_CHILD);
+	diropq = au_diropq_create(a->src_dentry, a->btgt);
+	au_hin_imtx_unlock(a->src_hinode);
+	if (IS_ERR(diropq))
+		err = PTR_ERR(diropq);
+	dput(diropq);
+
+	return err;
+}
+
+static int do_rename(struct au_ren_args *a)
+{
+	int err;
+	struct dentry *d, *h_d;
+
+	/* prepare workqueue args for asynchronous rmdir */
+	h_d = a->dst_h_dentry;
+	if (au_ftest_ren(a->flags, ISDIR) && h_d->d_inode) {
+		err = -ENOMEM;
+		a->thargs = au_whtmp_rmdir_alloc(a->src_dentry->d_sb, GFP_NOFS);
+		if (unlikely(!a->thargs))
+			goto out;
+		a->h_dst = dget(h_d);
+	}
+
+	/* create whiteout for src_dentry */
+	if (au_ftest_ren(a->flags, WHSRC)) {
+		a->src_wh_dentry
+			= au_wh_create(a->src_dentry, a->btgt, a->src_h_parent);
+		err = PTR_ERR(a->src_wh_dentry);
+		if (IS_ERR(a->src_wh_dentry))
+			goto out_thargs;
+	}
+
+	/* lookup whiteout for dentry */
+	if (au_ftest_ren(a->flags, WHDST)) {
+		h_d = au_wh_lkup(a->dst_h_parent, &a->dst_dentry->d_name,
+				 a->br);
+		err = PTR_ERR(h_d);
+		if (IS_ERR(h_d))
+			goto out_whsrc;
+		if (!h_d->d_inode)
+			dput(h_d);
+		else
+			a->dst_wh_dentry = h_d;
+	}
+
+	/* rename dentry to tmpwh */
+	if (a->thargs) {
+		err = au_whtmp_ren(a->dst_h_dentry, a->br);
+		if (unlikely(err))
+			goto out_whdst;
+
+		d = a->dst_dentry;
+		au_set_h_dptr(d, a->btgt, NULL);
+		err = au_lkup_neg(d, a->btgt);
+		if (unlikely(err))
+			goto out_whtmp;
+		a->dst_h_dentry = au_h_dptr(d, a->btgt);
+	}
+
+	/* cpup src */
+	if (a->dst_h_dentry->d_inode && a->src_bstart != a->btgt) {
+		struct mutex *h_mtx = &a->src_h_dentry->d_inode->i_mutex;
+
+		mutex_lock_nested(h_mtx, AuLsc_I_CHILD);
+		err = au_sio_cpup_simple(a->src_dentry, a->btgt, -1,
+					 !AuCpup_DTIME);
+		mutex_unlock(h_mtx);
+		if (unlikely(err))
+			goto out_whtmp;
+	}
+
+	/* rename by vfs_rename or cpup */
+	d = a->dst_dentry;
+	if (au_ftest_ren(a->flags, ISDIR)
+	    && (a->dst_wh_dentry
+		|| au_dbdiropq(d) == a->btgt
+		/* hide the lower to keep xino */
+		|| a->btgt < au_dbend(d)
+		|| au_opt_test(au_mntflags(d->d_sb), ALWAYS_DIROPQ)))
+		au_fset_ren(a->flags, DIROPQ);
+	err = au_ren_or_cpup(a);
+	if (unlikely(err))
+		/* leave the copied-up one */
+		goto out_whtmp;
+
+	/* make dir opaque */
+	if (au_ftest_ren(a->flags, DIROPQ)) {
+		err = au_ren_diropq(a);
+		if (unlikely(err))
+			goto out_rename;
+	}
+
+	/* update target timestamps */
+	AuDebugOn(au_dbstart(a->src_dentry) != a->btgt);
+	a->h_path.dentry = au_h_dptr(a->src_dentry, a->btgt);
+	vfsub_update_h_iattr(&a->h_path, /*did*/NULL); /*ignore*/
+	a->src_inode->i_ctime = a->h_path.dentry->d_inode->i_ctime;
+
+	/* remove whiteout for dentry */
+	if (a->dst_wh_dentry) {
+		a->h_path.dentry = a->dst_wh_dentry;
+		err = au_wh_unlink_dentry(a->dst_h_dir, &a->h_path,
+					  a->dst_dentry);
+		if (unlikely(err))
+			goto out_diropq;
+	}
+
+	/* remove whtmp */
+	if (a->thargs)
+		au_ren_del_whtmp(a); /* ignore this error */
+
+	err = 0;
+	goto out_success;
+
+ out_diropq:
+	if (au_ftest_ren(a->flags, DIROPQ))
+		au_ren_rev_diropq(err, a);
+ out_rename:
+	if (!au_ftest_ren(a->flags, CPUP))
+		au_ren_rev_rename(err, a);
+	else
+		au_ren_rev_cpup(err, a);
+ out_whtmp:
+	if (a->thargs)
+		au_ren_rev_whtmp(err, a);
+ out_whdst:
+	dput(a->dst_wh_dentry);
+	a->dst_wh_dentry = NULL;
+ out_whsrc:
+	if (a->src_wh_dentry)
+		au_ren_rev_whsrc(err, a);
+	au_ren_rev_drop(a);
+ out_success:
+	dput(a->src_wh_dentry);
+	dput(a->dst_wh_dentry);
+ out_thargs:
+	if (a->thargs) {
+		dput(a->h_dst);
+		au_whtmp_rmdir_free(a->thargs);
+		a->thargs = NULL;
+	}
+ out:
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+/*
+ * test if @dentry dir can be rename destination or not.
+ * success means, it is a logically empty dir.
+ */
+static int may_rename_dstdir(struct dentry *dentry, struct au_nhash *whlist)
+{
+	return au_test_empty(dentry, whlist);
+}
+
+/*
+ * test if @dentry dir can be rename source or not.
+ * if it can, return 0 and @children is filled.
+ * success means,
+ * - it is a logically empty dir.
+ * - or, it exists on writable branch and has no children including whiteouts
+ *       on the lower branch.
+ */
+static int may_rename_srcdir(struct dentry *dentry, aufs_bindex_t btgt)
+{
+	int err;
+	aufs_bindex_t bstart;
+
+	bstart = au_dbstart(dentry);
+	if (bstart != btgt) {
+		struct au_nhash whlist;
+
+		SiMustAnyLock(dentry->d_sb);
+		err = au_nhash_alloc(&whlist, au_sbi(dentry->d_sb)->si_rdhash,
+				     GFP_NOFS);
+		if (unlikely(err))
+			goto out;
+		err = au_test_empty(dentry, &whlist);
+		au_nhash_wh_free(&whlist);
+		goto out;
+	}
+
+	if (bstart == au_dbtaildir(dentry))
+		return 0; /* success */
+
+	err = au_test_empty_lower(dentry);
+
+ out:
+	if (err == -ENOTEMPTY) {
+		AuWarn1("renaming dir who has child(ren) on multiple branches,"
+			" is not supported\n");
+		err = -EXDEV;
+	}
+	return err;
+}
+
+/* side effect: sets whlist and h_dentry */
+static int au_ren_may_dir(struct au_ren_args *a)
+{
+	int err;
+	struct dentry *d;
+
+	d = a->dst_dentry;
+	SiMustAnyLock(d->d_sb);
+	err = au_nhash_alloc(&a->whlist, au_sbi(d->d_sb)->si_rdhash, GFP_NOFS);
+	if (unlikely(err))
+		goto out;
+
+	err = 0;
+	if (au_ftest_ren(a->flags, ISDIR) && a->dst_inode) {
+		au_set_dbstart(d, a->dst_bstart);
+		err = may_rename_dstdir(d, &a->whlist);
+		au_set_dbstart(d, a->btgt);
+	}
+	a->dst_h_dentry = au_h_dptr(d, au_dbstart(d));
+	if (unlikely(err))
+		goto out;
+
+	d = a->src_dentry;
+	a->src_h_dentry = au_h_dptr(d, au_dbstart(d));
+	if (au_ftest_ren(a->flags, ISDIR)) {
+		err = may_rename_srcdir(d, a->btgt);
+		if (unlikely(err)) {
+			au_nhash_wh_free(&a->whlist);
+			a->whlist.nh_num = 0;
+		}
+	}
+ out:
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+/*
+ * simple tests for rename.
+ * following the checks in vfs, plus the parent-child relationship.
+ */
+static int au_may_ren(struct au_ren_args *a)
+{
+	int err, isdir;
+	struct inode *h_inode;
+
+	if (a->src_bstart == a->btgt) {
+		err = au_may_del(a->src_dentry, a->btgt, a->src_h_parent,
+				 au_ftest_ren(a->flags, ISDIR));
+		if (unlikely(err))
+			goto out;
+		err = -EINVAL;
+		if (unlikely(a->src_h_dentry == a->h_trap))
+			goto out;
+	}
+
+	err = 0;
+	if (a->dst_bstart != a->btgt)
+		goto out;
+
+	err = -EIO;
+	h_inode = a->dst_h_dentry->d_inode;
+	isdir = !!au_ftest_ren(a->flags, ISDIR);
+	if (!a->dst_dentry->d_inode) {
+		if (unlikely(h_inode))
+			goto out;
+		err = au_may_add(a->dst_dentry, a->btgt, a->dst_h_parent,
+				 isdir);
+	} else {
+		if (unlikely(!h_inode || !h_inode->i_nlink))
+			goto out;
+		err = au_may_del(a->dst_dentry, a->btgt, a->dst_h_parent,
+				 isdir);
+		if (unlikely(err))
+			goto out;
+		err = -ENOTEMPTY;
+		if (unlikely(a->dst_h_dentry == a->h_trap))
+			goto out;
+		err = 0;
+	}
+
+ out:
+	if (unlikely(err == -ENOENT || err == -EEXIST))
+		err = -EIO;
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+/*
+ * locking order
+ * (VFS)
+ * - src_dir and dir by lock_rename()
+ * - inode if exitsts
+ * (aufs)
+ * - lock all
+ *   + src_dentry and dentry by aufs_read_and_write_lock2() which calls,
+ *     + si_read_lock
+ *     + di_write_lock2_child()
+ *       + di_write_lock_child()
+ *	   + ii_write_lock_child()
+ *       + di_write_lock_child2()
+ *	   + ii_write_lock_child2()
+ *     + src_parent and parent
+ *       + di_write_lock_parent()
+ *	   + ii_write_lock_parent()
+ *       + di_write_lock_parent2()
+ *	   + ii_write_lock_parent2()
+ *   + lower src_dir and dir by vfsub_lock_rename()
+ *   + verify the every relationships between child and parent. if any
+ *     of them failed, unlock all and return -EBUSY.
+ */
+static void au_ren_unlock(struct au_ren_args *a)
+{
+	struct super_block *sb;
+
+	sb = a->dst_dentry->d_sb;
+	if (au_ftest_ren(a->flags, MNT_WRITE))
+		mnt_drop_write(a->br->br_mnt);
+	vfsub_unlock_rename(a->src_h_parent, a->src_hdir,
+			    a->dst_h_parent, a->dst_hdir);
+}
+
+static int au_ren_lock(struct au_ren_args *a)
+{
+	int err;
+	unsigned int udba;
+
+	err = 0;
+	a->src_h_parent = au_h_dptr(a->src_parent, a->btgt);
+	a->src_hdir = au_hi(a->src_dir, a->btgt);
+	a->dst_h_parent = au_h_dptr(a->dst_parent, a->btgt);
+	a->dst_hdir = au_hi(a->dst_dir, a->btgt);
+	a->h_trap = vfsub_lock_rename(a->src_h_parent, a->src_hdir,
+				      a->dst_h_parent, a->dst_hdir);
+	udba = au_opt_udba(a->src_dentry->d_sb);
+	if (unlikely(a->src_hdir->hi_inode != a->src_h_parent->d_inode
+		     || a->dst_hdir->hi_inode != a->dst_h_parent->d_inode))
+		err = au_busy_or_stale();
+	if (!err && au_dbstart(a->src_dentry) == a->btgt)
+		err = au_h_verify(a->src_h_dentry, udba,
+				  a->src_h_parent->d_inode, a->src_h_parent,
+				  a->br);
+	if (!err && au_dbstart(a->dst_dentry) == a->btgt)
+		err = au_h_verify(a->dst_h_dentry, udba,
+				  a->dst_h_parent->d_inode, a->dst_h_parent,
+				  a->br);
+	if (!err) {
+		err = mnt_want_write(a->br->br_mnt);
+		if (unlikely(err))
+			goto out_unlock;
+		au_fset_ren(a->flags, MNT_WRITE);
+		goto out; /* success */
+	}
+
+	err = au_busy_or_stale();
+
+ out_unlock:
+	au_ren_unlock(a);
+ out:
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+static void au_ren_refresh_dir(struct au_ren_args *a)
+{
+	struct inode *dir;
+
+	dir = a->dst_dir;
+	dir->i_version++;
+	if (au_ftest_ren(a->flags, ISDIR)) {
+		/* is this updating defined in POSIX? */
+		au_cpup_attr_timesizes(a->src_inode);
+		au_cpup_attr_nlink(dir, /*force*/1);
+		if (a->dst_inode) {
+			clear_nlink(a->dst_inode);
+			au_cpup_attr_timesizes(a->dst_inode);
+		}
+	}
+	if (au_ibstart(dir) == a->btgt)
+		au_cpup_attr_timesizes(dir);
+
+	if (au_ftest_ren(a->flags, ISSAMEDIR))
+		return;
+
+	dir = a->src_dir;
+	dir->i_version++;
+	if (au_ftest_ren(a->flags, ISDIR))
+		au_cpup_attr_nlink(dir, /*force*/1);
+	if (au_ibstart(dir) == a->btgt)
+		au_cpup_attr_timesizes(dir);
+}
+
+static void au_ren_refresh(struct au_ren_args *a)
+{
+	aufs_bindex_t bend, bindex;
+	struct dentry *d, *h_d;
+	struct inode *i, *h_i;
+	struct super_block *sb;
+
+	d = a->src_dentry;
+	au_set_dbwh(d, -1);
+	bend = au_dbend(d);
+	for (bindex = a->btgt + 1; bindex <= bend; bindex++) {
+		h_d = au_h_dptr(d, bindex);
+		if (h_d)
+			au_set_h_dptr(d, bindex, NULL);
+	}
+	au_set_dbend(d, a->btgt);
+
+	sb = d->d_sb;
+	i = a->src_inode;
+	if (au_opt_test(au_mntflags(sb), PLINK) && au_plink_test(i))
+		return; /* success */
+
+	bend = au_ibend(i);
+	for (bindex = a->btgt + 1; bindex <= bend; bindex++) {
+		h_i = au_h_iptr(i, bindex);
+		if (h_i) {
+			au_xino_write(sb, bindex, h_i->i_ino, /*ino*/0);
+			/* ignore this error */
+			au_set_h_iptr(i, bindex, NULL, 0);
+		}
+	}
+	au_set_ibend(i, a->btgt);
+}
+
+/* ---------------------------------------------------------------------- */
+
+/* mainly for link(2) and rename(2) */
+int au_wbr(struct dentry *dentry, aufs_bindex_t btgt)
+{
+	aufs_bindex_t bdiropq, bwh;
+	struct dentry *parent;
+	struct au_branch *br;
+
+	parent = dentry->d_parent;
+	IMustLock(parent->d_inode); /* dir is locked */
+
+	bdiropq = au_dbdiropq(parent);
+	bwh = au_dbwh(dentry);
+	br = au_sbr(dentry->d_sb, btgt);
+	if (au_br_rdonly(br)
+	    || (0 <= bdiropq && bdiropq < btgt)
+	    || (0 <= bwh && bwh < btgt))
+		btgt = -1;
+
+	AuDbg("btgt %d\n", btgt);
+	return btgt;
+}
+
+/* sets src_bstart, dst_bstart and btgt */
+static int au_ren_wbr(struct au_ren_args *a)
+{
+	int err;
+	struct au_wr_dir_args wr_dir_args = {
+		/* .force_btgt	= -1, */
+		.flags		= AuWrDir_ADD_ENTRY
+	};
+
+	a->src_bstart = au_dbstart(a->src_dentry);
+	a->dst_bstart = au_dbstart(a->dst_dentry);
+	if (au_ftest_ren(a->flags, ISDIR))
+		au_fset_wrdir(wr_dir_args.flags, ISDIR);
+	wr_dir_args.force_btgt = a->src_bstart;
+	if (a->dst_inode && a->dst_bstart < a->src_bstart)
+		wr_dir_args.force_btgt = a->dst_bstart;
+	wr_dir_args.force_btgt = au_wbr(a->dst_dentry, wr_dir_args.force_btgt);
+	err = au_wr_dir(a->dst_dentry, a->src_dentry, &wr_dir_args);
+	a->btgt = err;
+
+	return err;
+}
+
+static void au_ren_dt(struct au_ren_args *a)
+{
+	a->h_path.dentry = a->src_h_parent;
+	au_dtime_store(a->src_dt + AuPARENT, a->src_parent, &a->h_path);
+	if (!au_ftest_ren(a->flags, ISSAMEDIR)) {
+		a->h_path.dentry = a->dst_h_parent;
+		au_dtime_store(a->dst_dt + AuPARENT, a->dst_parent, &a->h_path);
+	}
+
+	au_fclr_ren(a->flags, DT_DSTDIR);
+	if (!au_ftest_ren(a->flags, ISDIR))
+		return;
+
+	a->h_path.dentry = a->src_h_dentry;
+	au_dtime_store(a->src_dt + AuCHILD, a->src_dentry, &a->h_path);
+	if (a->dst_h_dentry->d_inode) {
+		au_fset_ren(a->flags, DT_DSTDIR);
+		a->h_path.dentry = a->dst_h_dentry;
+		au_dtime_store(a->dst_dt + AuCHILD, a->dst_dentry, &a->h_path);
+	}
+}
+
+static void au_ren_rev_dt(int err, struct au_ren_args *a)
+{
+	struct dentry *h_d;
+	struct mutex *h_mtx;
+
+	au_dtime_revert(a->src_dt + AuPARENT);
+	if (!au_ftest_ren(a->flags, ISSAMEDIR))
+		au_dtime_revert(a->dst_dt + AuPARENT);
+
+	if (au_ftest_ren(a->flags, ISDIR) && err != -EIO) {
+		h_d = a->src_dt[AuCHILD].dt_h_path.dentry;
+		h_mtx = &h_d->d_inode->i_mutex;
+		mutex_lock_nested(h_mtx, AuLsc_I_CHILD);
+		au_dtime_revert(a->src_dt + AuCHILD);
+		mutex_unlock(h_mtx);
+
+		if (au_ftest_ren(a->flags, DT_DSTDIR)) {
+			h_d = a->dst_dt[AuCHILD].dt_h_path.dentry;
+			h_mtx = &h_d->d_inode->i_mutex;
+			mutex_lock_nested(h_mtx, AuLsc_I_CHILD);
+			au_dtime_revert(a->dst_dt + AuCHILD);
+			mutex_unlock(h_mtx);
+		}
+	}
+}
+
+/* ---------------------------------------------------------------------- */
+
+int aufs_rename(struct inode *_src_dir, struct dentry *_src_dentry,
+		struct inode *_dst_dir, struct dentry *_dst_dentry)
+{
+	int err;
+	/* reduce stack space */
+	struct au_ren_args *a;
+
+	IMustLock(_src_dir);
+	IMustLock(_dst_dir);
+
+	err = -ENOMEM;
+	BUILD_BUG_ON(sizeof(*a) > PAGE_SIZE);
+	a = kzalloc(sizeof(*a), GFP_NOFS);
+	if (unlikely(!a))
+		goto out;
+
+	a->src_dir = _src_dir;
+	a->src_dentry = _src_dentry;
+	a->src_inode = a->src_dentry->d_inode;
+	a->src_parent = a->src_dentry->d_parent; /* dir inode is locked */
+	a->dst_dir = _dst_dir;
+	a->dst_dentry = _dst_dentry;
+	a->dst_inode = a->dst_dentry->d_inode;
+	a->dst_parent = a->dst_dentry->d_parent; /* dir inode is locked */
+	if (a->dst_inode) {
+		IMustLock(a->dst_inode);
+		au_igrab(a->dst_inode);
+	}
+
+	err = -ENOTDIR;
+	if (S_ISDIR(a->src_inode->i_mode)) {
+		au_fset_ren(a->flags, ISDIR);
+		if (unlikely(a->dst_inode && !S_ISDIR(a->dst_inode->i_mode)))
+			goto out_free;
+		aufs_read_and_write_lock2(a->dst_dentry, a->src_dentry,
+					  AuLock_DIR | AuLock_FLUSH);
+	} else
+		aufs_read_and_write_lock2(a->dst_dentry, a->src_dentry,
+					  AuLock_FLUSH);
+
+	au_fset_ren(a->flags, ISSAMEDIR); /* temporary */
+	di_write_lock_parent(a->dst_parent);
+
+	/* which branch we process */
+	err = au_ren_wbr(a);
+	if (unlikely(err < 0))
+		goto out_unlock;
+	a->br = au_sbr(a->dst_dentry->d_sb, a->btgt);
+	a->h_path.mnt = a->br->br_mnt;
+
+	/* are they available to be renamed */
+	err = au_ren_may_dir(a);
+	if (unlikely(err))
+		goto out_unlock;
+
+	/* prepare the writable parent dir on the same branch */
+	if (a->dst_bstart == a->btgt) {
+		au_fset_ren(a->flags, WHDST);
+	} else {
+		err = au_cpup_dirs(a->dst_dentry, a->btgt);
+		if (unlikely(err))
+			goto out_children;
+	}
+
+	if (a->src_dir != a->dst_dir) {
+		/*
+		 * this temporary unlock is safe,
+		 * because both dir->i_mutex are locked.
+		 */
+		di_write_unlock(a->dst_parent);
+		di_write_lock_parent(a->src_parent);
+		err = au_wr_dir_need_wh(a->src_dentry,
+					au_ftest_ren(a->flags, ISDIR),
+					&a->btgt);
+		di_write_unlock(a->src_parent);
+		di_write_lock2_parent(a->src_parent, a->dst_parent, /*isdir*/1);
+		au_fclr_ren(a->flags, ISSAMEDIR);
+	} else
+		err = au_wr_dir_need_wh(a->src_dentry,
+					au_ftest_ren(a->flags, ISDIR),
+					&a->btgt);
+	if (unlikely(err < 0))
+		goto out_children;
+	if (err)
+		au_fset_ren(a->flags, WHSRC);
+
+	/* lock them all */
+	err = au_ren_lock(a);
+	if (unlikely(err))
+		goto out_children;
+
+	if (!au_opt_test(au_mntflags(a->dst_dir->i_sb), UDBA_NONE)) {
+		err = au_may_ren(a);
+		if (unlikely(err))
+			goto out_hdir;
+	}
+
+	/* store timestamps to be revertible */
+	au_ren_dt(a);
+
+	/* here we go */
+	err = do_rename(a);
+	if (unlikely(err))
+		goto out_dt;
+
+	/* update dir attributes */
+	au_ren_refresh_dir(a);
+
+	/* dput/iput all lower dentries */
+	au_ren_refresh(a);
+
+	goto out_hdir; /* success */
+
+ out_dt:
+	au_ren_rev_dt(err, a);
+ out_hdir:
+	au_ren_unlock(a);
+ out_children:
+	au_nhash_wh_free(&a->whlist);
+ out_unlock:
+	if (unlikely(err && au_ftest_ren(a->flags, ISDIR))) {
+		au_update_dbstart(a->dst_dentry);
+		d_drop(a->dst_dentry);
+	}
+	if (!err)
+		d_move(a->src_dentry, a->dst_dentry);
+	if (au_ftest_ren(a->flags, ISSAMEDIR))
+		di_write_unlock(a->dst_parent);
+	else
+		di_write_unlock2(a->src_parent, a->dst_parent);
+	aufs_read_and_write_unlock2(a->dst_dentry, a->src_dentry);
+ out_free:
+	iput(a->dst_inode);
+	if (a->thargs)
+		au_whtmp_rmdir_free(a->thargs);
+	kfree(a);
+ out:
+	return err;
+}
--- linux-rt-2.6.31.orig/ubuntu/aufs/wkq.h
+++ linux-rt-2.6.31/ubuntu/aufs/wkq.h
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * workqueue for asynchronous/super-io operations
+ * todo: try new credentials management scheme
+ */
+
+#ifndef __AUFS_WKQ_H__
+#define __AUFS_WKQ_H__
+
+#ifdef __KERNEL__
+
+#include <linux/sched.h>
+#include <linux/wait.h>
+#include <linux/aufs_type.h>
+
+struct super_block;
+
+/* ---------------------------------------------------------------------- */
+
+/*
+ * in the next operation, wait for the 'nowait' tasks in system-wide workqueue
+ */
+struct au_nowait_tasks {
+	atomic_t		nw_len;
+	wait_queue_head_t	nw_wq;
+};
+
+/* ---------------------------------------------------------------------- */
+
+typedef void (*au_wkq_func_t)(void *args);
+
+/* wkq flags */
+#define AuWkq_WAIT	1
+#define au_ftest_wkq(flags, name)	((flags) & AuWkq_##name)
+#define au_fset_wkq(flags, name)	{ (flags) |= AuWkq_##name; }
+#define au_fclr_wkq(flags, name)	{ (flags) &= ~AuWkq_##name; }
+
+/* wkq.c */
+int au_wkq_wait(au_wkq_func_t func, void *args);
+int au_wkq_nowait(au_wkq_func_t func, void *args, struct super_block *sb);
+void au_nwt_init(struct au_nowait_tasks *nwt);
+int __init au_wkq_init(void);
+void au_wkq_fin(void);
+
+/* ---------------------------------------------------------------------- */
+
+static inline int au_test_wkq(struct task_struct *tsk)
+{
+	return !tsk->mm && !strcmp(tsk->comm, AUFS_WKQ_NAME);
+}
+
+static inline void au_nwt_done(struct au_nowait_tasks *nwt)
+{
+	if (!atomic_dec_return(&nwt->nw_len))
+		wake_up_all(&nwt->nw_wq);
+}
+
+static inline int au_nwt_flush(struct au_nowait_tasks *nwt)
+{
+	wait_event(nwt->nw_wq, !atomic_read(&nwt->nw_len));
+	return 0;
+}
+
+#endif /* __KERNEL__ */
+#endif /* __AUFS_WKQ_H__ */
--- linux-rt-2.6.31.orig/ubuntu/aufs/branch.h
+++ linux-rt-2.6.31/ubuntu/aufs/branch.h
@@ -0,0 +1,219 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * branch filesystems and xino for them
+ */
+
+#ifndef __AUFS_BRANCH_H__
+#define __AUFS_BRANCH_H__
+
+#ifdef __KERNEL__
+
+#include <linux/fs.h>
+#include <linux/mount.h>
+#include <linux/aufs_type.h>
+#include "rwsem.h"
+#include "super.h"
+
+/* ---------------------------------------------------------------------- */
+
+/* a xino file */
+struct au_xino_file {
+	struct file		*xi_file;
+	struct mutex		xi_nondir_mtx;
+
+	/* todo: make xino files an array to support huge inode number */
+
+#ifdef CONFIG_DEBUG_FS
+	struct dentry		 *xi_dbgaufs;
+#endif
+};
+
+/* members for writable branch only */
+enum {AuBrWh_BASE, AuBrWh_PLINK, AuBrWh_ORPH, AuBrWh_Last};
+struct au_wbr {
+	struct au_rwsem		wbr_wh_rwsem;
+	struct dentry		*wbr_wh[AuBrWh_Last];
+	atomic_t 		wbr_wh_running;
+#define wbr_whbase		wbr_wh[AuBrWh_BASE]	/* whiteout base */
+#define wbr_plink		wbr_wh[AuBrWh_PLINK]	/* pseudo-link dir */
+#define wbr_orph		wbr_wh[AuBrWh_ORPH]	/* dir for orphans */
+
+	/* mfs mode */
+	unsigned long long	wbr_bytes;
+};
+
+/* protected by superblock rwsem */
+struct au_branch {
+	struct au_xino_file	br_xino;
+
+	aufs_bindex_t		br_id;
+
+	int			br_perm;
+	struct vfsmount		*br_mnt;
+	atomic_t		br_count;
+
+	struct au_wbr		*br_wbr;
+
+	/* xino truncation */
+	blkcnt_t		br_xino_upper;	/* watermark in blocks */
+	atomic_t		br_xino_running;
+
+#ifdef CONFIG_SYSFS
+	/* an entry under sysfs per mount-point */
+	char			br_name[8];
+	struct attribute	br_attr;
+#endif
+};
+
+/* ---------------------------------------------------------------------- */
+
+/* branch permission and attribute */
+enum {
+	AuBrPerm_RW,		/* writable, linkable wh */
+	AuBrPerm_RO,		/* readonly, no wh */
+	AuBrPerm_RR,		/* natively readonly, no wh */
+
+	AuBrPerm_RWNoLinkWH,	/* un-linkable whiteouts */
+
+	AuBrPerm_ROWH,		/* whiteout-able */
+	AuBrPerm_RRWH,		/* whiteout-able */
+
+	AuBrPerm_Last
+};
+
+static inline int au_br_writable(int brperm)
+{
+	return brperm == AuBrPerm_RW || brperm == AuBrPerm_RWNoLinkWH;
+}
+
+static inline int au_br_whable(int brperm)
+{
+	return brperm == AuBrPerm_RW
+		|| brperm == AuBrPerm_ROWH
+		|| brperm == AuBrPerm_RRWH;
+}
+
+static inline int au_br_rdonly(struct au_branch *br)
+{
+	return ((br->br_mnt->mnt_sb->s_flags & MS_RDONLY)
+		|| !au_br_writable(br->br_perm))
+		? -EROFS : 0;
+}
+
+static inline int au_br_hinotifyable(int brperm __maybe_unused)
+{
+#ifdef CONFIG_AUFS_HINOTIFY
+	return brperm != AuBrPerm_RR && brperm != AuBrPerm_RRWH;
+#else
+	return 0;
+#endif
+}
+
+/* ---------------------------------------------------------------------- */
+
+/* branch.c */
+struct au_sbinfo;
+void au_br_free(struct au_sbinfo *sinfo);
+int au_br_index(struct super_block *sb, aufs_bindex_t br_id);
+struct au_opt_add;
+int au_br_add(struct super_block *sb, struct au_opt_add *add, int remount);
+struct au_opt_del;
+int au_br_del(struct super_block *sb, struct au_opt_del *del, int remount);
+struct au_opt_mod;
+int au_br_mod(struct super_block *sb, struct au_opt_mod *mod, int remount,
+	      int *do_update);
+
+/* xino.c */
+static const loff_t au_loff_max = LLONG_MAX;
+
+int au_xib_trunc(struct super_block *sb);
+ssize_t xino_fread(au_readf_t func, struct file *file, void *buf, size_t size,
+		   loff_t *pos);
+ssize_t xino_fwrite(au_writef_t func, struct file *file, void *buf, size_t size,
+		    loff_t *pos);
+struct file *au_xino_create2(struct file *base_file, struct file *copy_src);
+struct file *au_xino_create(struct super_block *sb, char *fname, int silent);
+ino_t au_xino_new_ino(struct super_block *sb);
+int au_xino_write0(struct super_block *sb, aufs_bindex_t bindex, ino_t h_ino,
+		   ino_t ino);
+int au_xino_write(struct super_block *sb, aufs_bindex_t bindex, ino_t h_ino,
+		  ino_t ino);
+int au_xino_read(struct super_block *sb, aufs_bindex_t bindex, ino_t h_ino,
+		 ino_t *ino);
+int au_xino_br(struct super_block *sb, struct au_branch *br, ino_t hino,
+	       struct file *base_file, int do_test);
+int au_xino_trunc(struct super_block *sb, aufs_bindex_t bindex);
+
+struct au_opt_xino;
+int au_xino_set(struct super_block *sb, struct au_opt_xino *xino, int remount);
+void au_xino_clr(struct super_block *sb);
+struct file *au_xino_def(struct super_block *sb);
+int au_xino_path(struct seq_file *seq, struct file *file);
+
+/* ---------------------------------------------------------------------- */
+
+/* Superblock to branch */
+static inline
+aufs_bindex_t au_sbr_id(struct super_block *sb, aufs_bindex_t bindex)
+{
+	return au_sbr(sb, bindex)->br_id;
+}
+
+static inline
+struct vfsmount *au_sbr_mnt(struct super_block *sb, aufs_bindex_t bindex)
+{
+	return au_sbr(sb, bindex)->br_mnt;
+}
+
+static inline
+struct super_block *au_sbr_sb(struct super_block *sb, aufs_bindex_t bindex)
+{
+	return au_sbr_mnt(sb, bindex)->mnt_sb;
+}
+
+static inline void au_sbr_put(struct super_block *sb, aufs_bindex_t bindex)
+{
+	atomic_dec_return(&au_sbr(sb, bindex)->br_count);
+}
+
+static inline int au_sbr_perm(struct super_block *sb, aufs_bindex_t bindex)
+{
+	return au_sbr(sb, bindex)->br_perm;
+}
+
+static inline int au_sbr_whable(struct super_block *sb, aufs_bindex_t bindex)
+{
+	return au_br_whable(au_sbr_perm(sb, bindex));
+}
+
+/* ---------------------------------------------------------------------- */
+
+/*
+ * wbr_wh_read_lock, wbr_wh_write_lock
+ * wbr_wh_read_unlock, wbr_wh_write_unlock, wbr_wh_downgrade_lock
+ */
+AuSimpleRwsemFuncs(wbr_wh, struct au_wbr *wbr, &wbr->wbr_wh_rwsem);
+
+#define WbrWhMustNoWaiters(wbr)	AuRwMustNoWaiters(&wbr->wbr_wh_rwsem)
+#define WbrWhMustAnyLock(wbr)	AuRwMustAnyLock(&wbr->wbr_wh_rwsem)
+#define WbrWhMustWriteLock(wbr)	AuRwMustWriteLock(&wbr->wbr_wh_rwsem)
+
+#endif /* __KERNEL__ */
+#endif /* __AUFS_BRANCH_H__ */
--- linux-rt-2.6.31.orig/ubuntu/aufs/sbinfo.c
+++ linux-rt-2.6.31/ubuntu/aufs/sbinfo.c
@@ -0,0 +1,208 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * superblock private data
+ */
+
+#include "aufs.h"
+
+/*
+ * they are necessary regardless sysfs is disabled.
+ */
+void au_si_free(struct kobject *kobj)
+{
+	struct au_sbinfo *sbinfo;
+	struct super_block *sb;
+
+	sbinfo = container_of(kobj, struct au_sbinfo, si_kobj);
+	AuDebugOn(!list_empty(&sbinfo->si_plink.head));
+
+	sb = sbinfo->si_sb;
+	si_write_lock(sb);
+	au_xino_clr(sb);
+	au_br_free(sbinfo);
+	kfree(sbinfo->si_branch);
+	mutex_destroy(&sbinfo->si_xib_mtx);
+	si_write_unlock(sb);
+	AuRwDestroy(&sbinfo->si_rwsem);
+
+	kfree(sbinfo);
+}
+
+int au_si_alloc(struct super_block *sb)
+{
+	int err;
+	struct au_sbinfo *sbinfo;
+
+	err = -ENOMEM;
+	sbinfo = kmalloc(sizeof(*sbinfo), GFP_NOFS);
+	if (unlikely(!sbinfo))
+		goto out;
+
+	/* will be reallocated separately */
+	sbinfo->si_branch = kzalloc(sizeof(*sbinfo->si_branch), GFP_NOFS);
+	if (unlikely(!sbinfo->si_branch))
+		goto out_sbinfo;
+
+	memset(&sbinfo->si_kobj, 0, sizeof(sbinfo->si_kobj));
+	err = sysaufs_si_init(sbinfo);
+	if (unlikely(err))
+		goto out_br;
+
+	au_nwt_init(&sbinfo->si_nowait);
+	au_rw_init_wlock(&sbinfo->si_rwsem);
+	sbinfo->si_generation = 0;
+	sbinfo->au_si_status = 0;
+	sbinfo->si_bend = -1;
+	sbinfo->si_last_br_id = 0;
+
+	sbinfo->si_wbr_copyup = AuWbrCopyup_Def;
+	sbinfo->si_wbr_create = AuWbrCreate_Def;
+	sbinfo->si_wbr_copyup_ops = au_wbr_copyup_ops + AuWbrCopyup_Def;
+	sbinfo->si_wbr_create_ops = au_wbr_create_ops + AuWbrCreate_Def;
+
+	sbinfo->si_mntflags = AuOpt_Def;
+
+	sbinfo->si_xread = NULL;
+	sbinfo->si_xwrite = NULL;
+	sbinfo->si_xib = NULL;
+	mutex_init(&sbinfo->si_xib_mtx);
+	sbinfo->si_xib_buf = NULL;
+	sbinfo->si_xino_brid = -1;
+	/* leave si_xib_last_pindex and si_xib_next_bit */
+
+	sbinfo->si_rdcache = AUFS_RDCACHE_DEF * HZ;
+	sbinfo->si_rdblk = AUFS_RDBLK_DEF;
+	sbinfo->si_rdhash = AUFS_RDHASH_DEF;
+	sbinfo->si_dirwh = AUFS_DIRWH_DEF;
+
+	au_spl_init(&sbinfo->si_plink);
+	init_waitqueue_head(&sbinfo->si_plink_wq);
+
+	/* leave other members for sysaufs and si_mnt. */
+	sbinfo->si_sb = sb;
+	sb->s_fs_info = sbinfo;
+	au_debug_sbinfo_init(sbinfo);
+	return 0; /* success */
+
+ out_br:
+	kfree(sbinfo->si_branch);
+ out_sbinfo:
+	kfree(sbinfo);
+ out:
+	return err;
+}
+
+int au_sbr_realloc(struct au_sbinfo *sbinfo, int nbr)
+{
+	int err, sz;
+	struct au_branch **brp;
+
+	AuRwMustWriteLock(&sbinfo->si_rwsem);
+
+	err = -ENOMEM;
+	sz = sizeof(*brp) * (sbinfo->si_bend + 1);
+	if (unlikely(!sz))
+		sz = sizeof(*brp);
+	brp = au_kzrealloc(sbinfo->si_branch, sz, sizeof(*brp) * nbr, GFP_NOFS);
+	if (brp) {
+		sbinfo->si_branch = brp;
+		err = 0;
+	}
+
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+unsigned int au_sigen_inc(struct super_block *sb)
+{
+	unsigned int gen;
+
+	SiMustWriteLock(sb);
+
+	gen = ++au_sbi(sb)->si_generation;
+	au_update_digen(sb->s_root);
+	au_update_iigen(sb->s_root->d_inode);
+	sb->s_root->d_inode->i_version++;
+	return gen;
+}
+
+aufs_bindex_t au_new_br_id(struct super_block *sb)
+{
+	aufs_bindex_t br_id;
+	int i;
+	struct au_sbinfo *sbinfo;
+
+	SiMustWriteLock(sb);
+
+	sbinfo = au_sbi(sb);
+	for (i = 0; i <= AUFS_BRANCH_MAX; i++) {
+		br_id = ++sbinfo->si_last_br_id;
+		if (br_id && au_br_index(sb, br_id) < 0)
+			return br_id;
+	}
+
+	return -1;
+}
+
+/* ---------------------------------------------------------------------- */
+
+/* dentry and super_block lock. call at entry point */
+void aufs_read_lock(struct dentry *dentry, int flags)
+{
+	si_read_lock(dentry->d_sb, flags);
+	if (au_ftest_lock(flags, DW))
+		di_write_lock_child(dentry);
+	else
+		di_read_lock_child(dentry, flags);
+}
+
+void aufs_read_unlock(struct dentry *dentry, int flags)
+{
+	if (au_ftest_lock(flags, DW))
+		di_write_unlock(dentry);
+	else
+		di_read_unlock(dentry, flags);
+	si_read_unlock(dentry->d_sb);
+}
+
+void aufs_write_lock(struct dentry *dentry)
+{
+	si_write_lock(dentry->d_sb);
+	di_write_lock_child(dentry);
+}
+
+void aufs_write_unlock(struct dentry *dentry)
+{
+	di_write_unlock(dentry);
+	si_write_unlock(dentry->d_sb);
+}
+
+void aufs_read_and_write_lock2(struct dentry *d1, struct dentry *d2, int flags)
+{
+	si_read_lock(d1->d_sb, flags);
+	di_write_lock2_child(d1, d2, au_ftest_lock(flags, DIR));
+}
+
+void aufs_read_and_write_unlock2(struct dentry *d1, struct dentry *d2)
+{
+	di_write_unlock2(d1, d2);
+	si_read_unlock(d1->d_sb);
+}
--- linux-rt-2.6.31.orig/ubuntu/aufs/sysrq.c
+++ linux-rt-2.6.31/ubuntu/aufs/sysrq.c
@@ -0,0 +1,115 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * magic sysrq hanlder
+ */
+
+#include <linux/fs.h>
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+/* #include <linux/sysrq.h> */
+#include "aufs.h"
+
+/* ---------------------------------------------------------------------- */
+
+static void sysrq_sb(struct super_block *sb)
+{
+	char *plevel;
+	struct au_sbinfo *sbinfo;
+	struct file *file;
+
+	plevel = au_plevel;
+	au_plevel = KERN_WARNING;
+	au_debug(1);
+
+	sbinfo = au_sbi(sb);
+	pr_warning("si=%lx\n", sysaufs_si_id(sbinfo));
+	pr_warning(AUFS_NAME ": superblock\n");
+	au_dpri_sb(sb);
+	pr_warning(AUFS_NAME ": root dentry\n");
+	au_dpri_dentry(sb->s_root);
+	pr_warning(AUFS_NAME ": root inode\n");
+	au_dpri_inode(sb->s_root->d_inode);
+#if 0
+	struct inode *i;
+	pr_warning(AUFS_NAME ": isolated inode\n");
+	list_for_each_entry(i, &sb->s_inodes, i_sb_list)
+		if (list_empty(&i->i_dentry))
+			au_dpri_inode(i);
+#endif
+	pr_warning(AUFS_NAME ": files\n");
+	list_for_each_entry(file, &sb->s_files, f_u.fu_list)
+		if (!special_file(file->f_dentry->d_inode->i_mode))
+			au_dpri_file(file);
+
+	au_plevel = plevel;
+	au_debug(0);
+}
+
+/* ---------------------------------------------------------------------- */
+
+/* module parameter */
+static char *aufs_sysrq_key = "a";
+module_param_named(sysrq, aufs_sysrq_key, charp, S_IRUGO);
+MODULE_PARM_DESC(sysrq, "MagicSysRq key for " AUFS_NAME);
+
+static void au_sysrq(int key __maybe_unused,
+		     struct tty_struct *tty __maybe_unused)
+{
+	struct kobject *kobj;
+	struct au_sbinfo *sbinfo;
+
+	/* spin_lock(&sysaufs_ket->list_lock); */
+	list_for_each_entry(kobj, &sysaufs_ket->list, entry) {
+		sbinfo = container_of(kobj, struct au_sbinfo, si_kobj);
+		sysrq_sb(sbinfo->si_sb);
+	}
+	/* spin_unlock(&sysaufs_ket->list_lock); */
+}
+
+static struct sysrq_key_op au_sysrq_op = {
+	.handler	= au_sysrq,
+	.help_msg	= "Aufs",
+	.action_msg	= "Aufs",
+	.enable_mask	= SYSRQ_ENABLE_DUMP
+};
+
+/* ---------------------------------------------------------------------- */
+
+int __init au_sysrq_init(void)
+{
+	int err;
+	char key;
+
+	err = -1;
+	key = *aufs_sysrq_key;
+	if ('a' <= key && key <= 'z')
+		err = register_sysrq_key(key, &au_sysrq_op);
+	if (unlikely(err))
+		AuErr("err %d, sysrq=%c\n", err, key);
+	return err;
+}
+
+void au_sysrq_fin(void)
+{
+	int err;
+	err = unregister_sysrq_key(*aufs_sysrq_key, &au_sysrq_op);
+	if (unlikely(err))
+		AuErr("err %d (ignored)\n", err);
+}
--- linux-rt-2.6.31.orig/ubuntu/aufs/f_op.c
+++ linux-rt-2.6.31/ubuntu/aufs/f_op.c
@@ -0,0 +1,802 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * file and vm operations
+ */
+
+#include <linux/file.h>
+#include <linux/fs_stack.h>
+#include <linux/mm.h>
+#include <linux/security.h>
+#include "aufs.h"
+
+/* common function to regular file and dir */
+int aufs_flush(struct file *file, fl_owner_t id)
+{
+	int err;
+	aufs_bindex_t bindex, bend;
+	struct dentry *dentry;
+	struct file *h_file;
+
+	dentry = file->f_dentry;
+	si_noflush_read_lock(dentry->d_sb);
+	fi_read_lock(file);
+	di_read_lock_child(dentry, AuLock_IW);
+
+	err = 0;
+	bend = au_fbend(file);
+	for (bindex = au_fbstart(file); !err && bindex <= bend; bindex++) {
+		h_file = au_h_fptr(file, bindex);
+		if (!h_file || !h_file->f_op || !h_file->f_op->flush)
+			continue;
+
+		err = h_file->f_op->flush(h_file, id);
+		if (!err)
+			vfsub_update_h_iattr(&h_file->f_path, /*did*/NULL);
+		/*ignore*/
+	}
+	au_cpup_attr_timesizes(dentry->d_inode);
+
+	di_read_unlock(dentry, AuLock_IW);
+	fi_read_unlock(file);
+	si_read_unlock(dentry->d_sb);
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+static int do_open_nondir(struct file *file, int flags)
+{
+	int err;
+	aufs_bindex_t bindex;
+	struct file *h_file;
+	struct dentry *dentry;
+	struct au_finfo *finfo;
+
+	FiMustWriteLock(file);
+
+	err = 0;
+	dentry = file->f_dentry;
+	finfo = au_fi(file);
+	finfo->fi_h_vm_ops = NULL;
+	finfo->fi_vm_ops = NULL;
+	bindex = au_dbstart(dentry);
+	/* O_TRUNC is processed already */
+	BUG_ON(au_test_ro(dentry->d_sb, bindex, dentry->d_inode)
+	       && (flags & O_TRUNC));
+
+	h_file = au_h_open(dentry, bindex, flags, file);
+	if (IS_ERR(h_file))
+		err = PTR_ERR(h_file);
+	else {
+		au_set_fbstart(file, bindex);
+		au_set_fbend(file, bindex);
+		au_set_h_fptr(file, bindex, h_file);
+		au_update_figen(file);
+		/* todo: necessary? */
+		/* file->f_ra = h_file->f_ra; */
+	}
+	return err;
+}
+
+static int aufs_open_nondir(struct inode *inode __maybe_unused,
+			    struct file *file)
+{
+	return au_do_open(file, do_open_nondir);
+}
+
+static int aufs_release_nondir(struct inode *inode __maybe_unused,
+			       struct file *file)
+{
+	struct super_block *sb = file->f_dentry->d_sb;
+
+	si_noflush_read_lock(sb);
+	kfree(au_fi(file)->fi_vm_ops);
+	au_finfo_fin(file);
+	si_read_unlock(sb);
+	return 0;
+}
+
+/* ---------------------------------------------------------------------- */
+
+static ssize_t aufs_read(struct file *file, char __user *buf, size_t count,
+			 loff_t *ppos)
+{
+	ssize_t err;
+	struct dentry *dentry;
+	struct file *h_file;
+	struct super_block *sb;
+
+	dentry = file->f_dentry;
+	sb = dentry->d_sb;
+	si_read_lock(sb, AuLock_FLUSH);
+	err = au_reval_and_lock_fdi(file, au_reopen_nondir, /*wlock*/0);
+	if (unlikely(err))
+		goto out;
+
+	h_file = au_h_fptr(file, au_fbstart(file));
+	err = vfsub_read_u(h_file, buf, count, ppos);
+	/* todo: necessary? */
+	/* file->f_ra = h_file->f_ra; */
+	fsstack_copy_attr_atime(dentry->d_inode, h_file->f_dentry->d_inode);
+
+	di_read_unlock(dentry, AuLock_IR);
+	fi_read_unlock(file);
+ out:
+	si_read_unlock(sb);
+	return err;
+}
+
+static ssize_t aufs_write(struct file *file, const char __user *ubuf,
+			  size_t count, loff_t *ppos)
+{
+	ssize_t err;
+	aufs_bindex_t bstart;
+	struct au_pin pin;
+	struct dentry *dentry;
+	struct inode *inode;
+	struct super_block *sb;
+	struct file *h_file;
+	char __user *buf = (char __user *)ubuf;
+
+	dentry = file->f_dentry;
+	sb = dentry->d_sb;
+	inode = dentry->d_inode;
+	mutex_lock(&inode->i_mutex);
+	si_read_lock(sb, AuLock_FLUSH);
+
+	err = au_reval_and_lock_fdi(file, au_reopen_nondir, /*wlock*/1);
+	if (unlikely(err))
+		goto out;
+
+	err = au_ready_to_write(file, -1, &pin);
+	di_downgrade_lock(dentry, AuLock_IR);
+	if (unlikely(err))
+		goto out_unlock;
+
+	bstart = au_fbstart(file);
+	h_file = au_h_fptr(file, bstart);
+	au_unpin(&pin);
+	err = vfsub_write_u(h_file, buf, count, ppos);
+	au_cpup_attr_timesizes(inode);
+	inode->i_mode = h_file->f_dentry->d_inode->i_mode;
+
+ out_unlock:
+	di_read_unlock(dentry, AuLock_IR);
+	fi_write_unlock(file);
+ out:
+	si_read_unlock(sb);
+	mutex_unlock(&inode->i_mutex);
+	return err;
+}
+
+static ssize_t aufs_aio_read(struct kiocb *kio, const struct iovec *iov,
+			     unsigned long nv, loff_t pos)
+{
+	ssize_t err;
+	struct file *file, *h_file;
+	struct dentry *dentry;
+	struct super_block *sb;
+
+	file = kio->ki_filp;
+	dentry = file->f_dentry;
+	sb = dentry->d_sb;
+	si_read_lock(sb, AuLock_FLUSH);
+	err = au_reval_and_lock_fdi(file, au_reopen_nondir, /*wlock*/0);
+	if (unlikely(err))
+		goto out;
+
+	err = -ENOSYS;
+	h_file = au_h_fptr(file, au_fbstart(file));
+	if (h_file->f_op && h_file->f_op->aio_read) {
+		err = security_file_permission(h_file, MAY_READ);
+		if (unlikely(err))
+			goto out_unlock;
+		if (!is_sync_kiocb(kio)) {
+			get_file(h_file);
+			fput(file);
+		}
+		kio->ki_filp = h_file;
+		err = h_file->f_op->aio_read(kio, iov, nv, pos);
+		/* todo: necessary? */
+		/* file->f_ra = h_file->f_ra; */
+		fsstack_copy_attr_atime(dentry->d_inode,
+					h_file->f_dentry->d_inode);
+	} else
+		/* currently there is no such fs */
+		WARN_ON_ONCE(h_file->f_op && h_file->f_op->read);
+
+ out_unlock:
+	di_read_unlock(dentry, AuLock_IR);
+	fi_read_unlock(file);
+ out:
+	si_read_unlock(sb);
+	return err;
+}
+
+static ssize_t aufs_aio_write(struct kiocb *kio, const struct iovec *iov,
+			      unsigned long nv, loff_t pos)
+{
+	ssize_t err;
+	aufs_bindex_t bstart;
+	struct au_pin pin;
+	struct dentry *dentry;
+	struct inode *inode;
+	struct super_block *sb;
+	struct file *file, *h_file;
+
+	file = kio->ki_filp;
+	dentry = file->f_dentry;
+	sb = dentry->d_sb;
+	inode = dentry->d_inode;
+	mutex_lock(&inode->i_mutex);
+	si_read_lock(sb, AuLock_FLUSH);
+
+	err = au_reval_and_lock_fdi(file, au_reopen_nondir, /*wlock*/1);
+	if (unlikely(err))
+		goto out;
+
+	err = au_ready_to_write(file, -1, &pin);
+	di_downgrade_lock(dentry, AuLock_IR);
+	if (unlikely(err))
+		goto out_unlock;
+
+	err = -ENOSYS;
+	bstart = au_fbstart(file);
+	h_file = au_h_fptr(file, bstart);
+	au_unpin(&pin);
+	if (h_file->f_op && h_file->f_op->aio_write) {
+		err = security_file_permission(h_file, MAY_WRITE);
+		if (unlikely(err))
+			goto out_unlock;
+		if (!is_sync_kiocb(kio)) {
+			get_file(h_file);
+			fput(file);
+		}
+		kio->ki_filp = h_file;
+		err = h_file->f_op->aio_write(kio, iov, nv, pos);
+		au_cpup_attr_timesizes(inode);
+		inode->i_mode = h_file->f_dentry->d_inode->i_mode;
+	} else
+		/* currently there is no such fs */
+		WARN_ON_ONCE(h_file->f_op && h_file->f_op->write);
+
+ out_unlock:
+	di_read_unlock(dentry, AuLock_IR);
+	fi_write_unlock(file);
+ out:
+	si_read_unlock(sb);
+	mutex_unlock(&inode->i_mutex);
+	return err;
+}
+
+static ssize_t aufs_splice_read(struct file *file, loff_t *ppos,
+				struct pipe_inode_info *pipe, size_t len,
+				unsigned int flags)
+{
+	ssize_t err;
+	struct file *h_file;
+	struct dentry *dentry;
+	struct super_block *sb;
+
+	dentry = file->f_dentry;
+	sb = dentry->d_sb;
+	si_read_lock(sb, AuLock_FLUSH);
+	err = au_reval_and_lock_fdi(file, au_reopen_nondir, /*wlock*/0);
+	if (unlikely(err))
+		goto out;
+
+	err = -EINVAL;
+	h_file = au_h_fptr(file, au_fbstart(file));
+	if (au_test_loopback_kthread()) {
+		file->f_mapping = h_file->f_mapping;
+		smp_mb(); /* unnecessary? */
+	}
+	err = vfsub_splice_to(h_file, ppos, pipe, len, flags);
+	/* todo: necessasry? */
+	/* file->f_ra = h_file->f_ra; */
+	fsstack_copy_attr_atime(dentry->d_inode, h_file->f_dentry->d_inode);
+
+	di_read_unlock(dentry, AuLock_IR);
+	fi_read_unlock(file);
+
+ out:
+	si_read_unlock(sb);
+	return err;
+}
+
+static ssize_t
+aufs_splice_write(struct pipe_inode_info *pipe, struct file *file, loff_t *ppos,
+		  size_t len, unsigned int flags)
+{
+	ssize_t err;
+	struct au_pin pin;
+	struct dentry *dentry;
+	struct inode *inode;
+	struct super_block *sb;
+	struct file *h_file;
+
+	dentry = file->f_dentry;
+	inode = dentry->d_inode;
+	mutex_lock(&inode->i_mutex);
+	sb = dentry->d_sb;
+	si_read_lock(sb, AuLock_FLUSH);
+
+	err = au_reval_and_lock_fdi(file, au_reopen_nondir, /*wlock*/1);
+	if (unlikely(err))
+		goto out;
+
+	err = au_ready_to_write(file, -1, &pin);
+	di_downgrade_lock(dentry, AuLock_IR);
+	if (unlikely(err))
+		goto out_unlock;
+
+	h_file = au_h_fptr(file, au_fbstart(file));
+	au_unpin(&pin);
+	err = vfsub_splice_from(pipe, h_file, ppos, len, flags);
+	au_cpup_attr_timesizes(inode);
+	inode->i_mode = h_file->f_dentry->d_inode->i_mode;
+
+ out_unlock:
+	di_read_unlock(dentry, AuLock_IR);
+	fi_write_unlock(file);
+ out:
+	si_read_unlock(sb);
+	mutex_unlock(&inode->i_mutex);
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+static struct file *au_safe_file(struct vm_area_struct *vma)
+{
+	struct file *file;
+
+	file = vma->vm_file;
+	if (file->private_data && au_test_aufs(file->f_dentry->d_sb))
+		return file;
+	return NULL;
+}
+
+static void au_reset_file(struct vm_area_struct *vma, struct file *file)
+{
+	vma->vm_file = file;
+	/* smp_mb(); */ /* flush vm_file */
+}
+
+static int aufs_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
+{
+	int err;
+	static DECLARE_WAIT_QUEUE_HEAD(wq);
+	struct file *file, *h_file;
+	struct au_finfo *finfo;
+
+	/* todo: non-robr mode, user vm_file as it is? */
+	wait_event(wq, (file = au_safe_file(vma)));
+
+	/* do not revalidate, no si lock */
+	finfo = au_fi(file);
+	h_file = finfo->fi_hfile[0 + finfo->fi_bstart].hf_file;
+	AuDebugOn(!h_file || !finfo->fi_h_vm_ops);
+
+	fi_write_lock(file);
+	vma->vm_file = h_file;
+	err = finfo->fi_h_vm_ops->fault(vma, vmf);
+	/* todo: necessary? */
+	/* file->f_ra = h_file->f_ra; */
+	au_reset_file(vma, file);
+	fi_write_unlock(file);
+#if 0 /* def CONFIG_SMP */
+	/* wake_up_nr(&wq, online_cpu - 1); */
+	wake_up_all(&wq);
+#else
+	wake_up(&wq);
+#endif
+
+	return err;
+}
+
+static int aufs_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf)
+{
+	int err;
+	static DECLARE_WAIT_QUEUE_HEAD(wq);
+	struct file *file, *h_file;
+	struct au_finfo *finfo;
+
+	wait_event(wq, (file = au_safe_file(vma)));
+
+	finfo = au_fi(file);
+	h_file = finfo->fi_hfile[0 + finfo->fi_bstart].hf_file;
+	AuDebugOn(!h_file || !finfo->fi_h_vm_ops);
+
+	fi_write_lock(file);
+	vma->vm_file = h_file;
+	err = finfo->fi_h_vm_ops->page_mkwrite(vma, vmf);
+	au_reset_file(vma, file);
+	fi_write_unlock(file);
+	wake_up(&wq);
+
+	return err;
+}
+
+static void aufs_vm_close(struct vm_area_struct *vma)
+{
+	static DECLARE_WAIT_QUEUE_HEAD(wq);
+	struct file *file, *h_file;
+	struct au_finfo *finfo;
+
+	wait_event(wq, (file = au_safe_file(vma)));
+
+	finfo = au_fi(file);
+	h_file = finfo->fi_hfile[0 + finfo->fi_bstart].hf_file;
+	AuDebugOn(!h_file || !finfo->fi_h_vm_ops);
+
+	fi_write_lock(file);
+	vma->vm_file = h_file;
+	finfo->fi_h_vm_ops->close(vma);
+	au_reset_file(vma, file);
+	fi_write_unlock(file);
+	wake_up(&wq);
+}
+
+static struct vm_operations_struct aufs_vm_ops = {
+	/* .close and .page_mkwrite are not set by default */
+	.fault		= aufs_fault,
+};
+
+/* ---------------------------------------------------------------------- */
+
+static struct vm_operations_struct *au_vm_ops(struct file *h_file,
+					      struct vm_area_struct *vma)
+{
+	struct vm_operations_struct *vm_ops;
+	int err;
+
+	vm_ops = ERR_PTR(-ENODEV);
+	if (!h_file->f_op || !h_file->f_op->mmap)
+		goto out;
+
+	err = h_file->f_op->mmap(h_file, vma);
+	vm_ops = ERR_PTR(err);
+	if (unlikely(err))
+		goto out;
+
+	vm_ops = vma->vm_ops;
+	err = do_munmap(current->mm, vma->vm_start,
+			vma->vm_end - vma->vm_start);
+	if (unlikely(err)) {
+		AuIOErr("failed internal unmapping %.*s, %d\n",
+			AuDLNPair(h_file->f_dentry), err);
+		vm_ops = ERR_PTR(-EIO);
+	}
+
+ out:
+	return vm_ops;
+}
+
+static int au_custom_vm_ops(struct au_finfo *finfo, struct vm_area_struct *vma)
+{
+	int err;
+	struct vm_operations_struct *h_ops;
+
+	AuRwMustAnyLock(&finfo->fi_rwsem);
+
+	err = 0;
+	h_ops = finfo->fi_h_vm_ops;
+	AuDebugOn(!h_ops);
+	if ((!h_ops->page_mkwrite && !h_ops->close)
+	    || finfo->fi_vm_ops)
+		goto out;
+
+	err = -ENOMEM;
+	finfo->fi_vm_ops = kmemdup(&aufs_vm_ops, sizeof(aufs_vm_ops), GFP_NOFS);
+	if (unlikely(!finfo->fi_vm_ops))
+		goto out;
+
+	err = 0;
+	if (h_ops->page_mkwrite)
+		finfo->fi_vm_ops->page_mkwrite = aufs_page_mkwrite;
+	if (h_ops->close)
+		finfo->fi_vm_ops->close = aufs_vm_close;
+
+	vma->vm_ops = finfo->fi_vm_ops;
+
+ out:
+	return err;
+}
+
+static int aufs_mmap(struct file *file, struct vm_area_struct *vma)
+{
+	int err;
+	unsigned char wlock, mmapped;
+	struct dentry *dentry;
+	struct super_block *sb;
+	struct file *h_file;
+	struct vm_operations_struct *vm_ops;
+
+	dentry = file->f_dentry;
+	wlock = !!(file->f_mode & FMODE_WRITE) && (vma->vm_flags & VM_SHARED);
+	sb = dentry->d_sb;
+	si_read_lock(sb, AuLock_FLUSH);
+	err = au_reval_and_lock_fdi(file, au_reopen_nondir, /*wlock*/1);
+	if (unlikely(err))
+		goto out;
+
+	mmapped = !!au_test_mmapped(file);
+	if (wlock) {
+		struct au_pin pin;
+
+		err = au_ready_to_write(file, -1, &pin);
+		di_downgrade_lock(dentry, AuLock_IR);
+		if (unlikely(err))
+			goto out_unlock;
+		au_unpin(&pin);
+	} else
+		di_downgrade_lock(dentry, AuLock_IR);
+
+	h_file = au_h_fptr(file, au_fbstart(file));
+	if (!mmapped && au_test_fs_bad_mapping(h_file->f_dentry->d_sb)) {
+		/*
+		 * by this assignment, f_mapping will differs from aufs inode
+		 * i_mapping.
+		 * if someone else mixes the use of f_dentry->d_inode and
+		 * f_mapping->host, then a problem may arise.
+		 */
+		file->f_mapping = h_file->f_mapping;
+	}
+
+	vm_ops = NULL;
+	if (!mmapped) {
+		vm_ops = au_vm_ops(h_file, vma);
+		err = PTR_ERR(vm_ops);
+		if (IS_ERR(vm_ops))
+			goto out_unlock;
+	}
+
+	/*
+	 * unnecessary to handle MAP_DENYWRITE and deny_write_access()?
+	 * currently MAP_DENYWRITE from userspace is ignored, but elf loader
+	 * sets it. when FMODE_EXEC is set (by open_exec() or sys_uselib()),
+	 * both of the aufs file and the lower file is deny_write_access()-ed.
+	 * finally I hope we can skip handlling MAP_DENYWRITE here.
+	 */
+	err = generic_file_mmap(file, vma);
+	if (unlikely(err))
+		goto out_unlock;
+
+	vma->vm_ops = &aufs_vm_ops;
+	/* test again */
+	if (!au_test_mmapped(file))
+		au_fi(file)->fi_h_vm_ops = vm_ops;
+
+	err = au_custom_vm_ops(au_fi(file), vma);
+	if (unlikely(err))
+		goto out_unlock;
+
+	vfsub_file_accessed(h_file);
+	fsstack_copy_attr_atime(dentry->d_inode, h_file->f_dentry->d_inode);
+
+ out_unlock:
+	di_read_unlock(dentry, AuLock_IR);
+	fi_write_unlock(file);
+ out:
+	si_read_unlock(sb);
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+static int aufs_fsync_nondir(struct file *file, struct dentry *dentry,
+			     int datasync)
+{
+	int err;
+	struct au_pin pin;
+	struct inode *inode;
+	struct file *h_file;
+	struct super_block *sb;
+
+	inode = dentry->d_inode;
+	IMustLock(file->f_mapping->host);
+	if (inode != file->f_mapping->host) {
+		mutex_unlock(&file->f_mapping->host->i_mutex);
+		mutex_lock(&inode->i_mutex);
+	}
+	IMustLock(inode);
+
+	sb = dentry->d_sb;
+	si_read_lock(sb, AuLock_FLUSH);
+
+	err = 0; /* -EBADF; */ /* posix? */
+	if (unlikely(!(file->f_mode & FMODE_WRITE)))
+		goto out;
+	err = au_reval_and_lock_fdi(file, au_reopen_nondir, /*wlock*/1);
+	if (unlikely(err))
+		goto out;
+
+	err = au_ready_to_write(file, -1, &pin);
+	di_downgrade_lock(dentry, AuLock_IR);
+	if (unlikely(err))
+		goto out_unlock;
+	au_unpin(&pin);
+
+	err = -EINVAL;
+	h_file = au_h_fptr(file, au_fbstart(file));
+	if (h_file->f_op && h_file->f_op->fsync) {
+		struct dentry *h_d;
+		struct mutex *h_mtx;
+
+		/*
+		 * no filemap_fdatawrite() since aufs file has no its own
+		 * mapping, but dir.
+		 */
+		h_d = h_file->f_dentry;
+		h_mtx = &h_d->d_inode->i_mutex;
+		mutex_lock_nested(h_mtx, AuLsc_I_CHILD);
+		err = h_file->f_op->fsync(h_file, h_d, datasync);
+		if (!err)
+			vfsub_update_h_iattr(&h_file->f_path, /*did*/NULL);
+		/*ignore*/
+		au_cpup_attr_timesizes(inode);
+		mutex_unlock(h_mtx);
+	}
+
+ out_unlock:
+	di_read_unlock(dentry, AuLock_IR);
+	fi_write_unlock(file);
+ out:
+	si_read_unlock(sb);
+	if (inode != file->f_mapping->host) {
+		mutex_unlock(&inode->i_mutex);
+		mutex_lock(&file->f_mapping->host->i_mutex);
+	}
+	return err;
+}
+
+/* no one supports this operation, currently */
+#if 0
+static int aufs_aio_fsync_nondir(struct kiocb *kio, int datasync)
+{
+	int err;
+	struct au_pin pin;
+	struct dentry *dentry;
+	struct inode *inode;
+	struct file *file, *h_file;
+	struct super_block *sb;
+
+	file = kio->ki_filp;
+	dentry = file->f_dentry;
+	inode = dentry->d_inode;
+	mutex_lock(&inode->i_mutex);
+
+	sb = dentry->d_sb;
+	si_read_lock(sb, AuLock_FLUSH);
+
+	err = 0; /* -EBADF; */ /* posix? */
+	if (unlikely(!(file->f_mode & FMODE_WRITE)))
+		goto out;
+	err = au_reval_and_lock_fdi(file, au_reopen_nondir, /*wlock*/1);
+	if (unlikely(err))
+		goto out;
+
+	err = au_ready_to_write(file, -1, &pin);
+	di_downgrade_lock(dentry, AuLock_IR);
+	if (unlikely(err))
+		goto out_unlock;
+	au_unpin(&pin);
+
+	err = -ENOSYS;
+	h_file = au_h_fptr(file, au_fbstart(file));
+	if (h_file->f_op && h_file->f_op->aio_fsync) {
+		struct dentry *h_d;
+		struct mutex *h_mtx;
+
+		h_d = h_file->f_dentry;
+		h_mtx = &h_d->d_inode->i_mutex;
+		if (!is_sync_kiocb(kio)) {
+			get_file(h_file);
+			fput(file);
+		}
+		kio->ki_filp = h_file;
+		err = h_file->f_op->aio_fsync(kio, datasync);
+		mutex_lock_nested(h_mtx, AuLsc_I_CHILD);
+		if (!err)
+			vfsub_update_h_iattr(&h_file->f_path, /*did*/NULL);
+		/*ignore*/
+		au_cpup_attr_timesizes(inode);
+		mutex_unlock(h_mtx);
+	}
+
+ out_unlock:
+	di_read_unlock(dentry, AuLock_IR);
+	fi_write_unlock(file);
+ out:
+	si_read_unlock(sb);
+	mutex_unlock(&inode->i_mutex);
+	return err;
+}
+#endif
+
+static int aufs_fasync(int fd, struct file *file, int flag)
+{
+	int err;
+	struct file *h_file;
+	struct dentry *dentry;
+	struct super_block *sb;
+
+	dentry = file->f_dentry;
+	sb = dentry->d_sb;
+	si_read_lock(sb, AuLock_FLUSH);
+	err = au_reval_and_lock_fdi(file, au_reopen_nondir, /*wlock*/0);
+	if (unlikely(err))
+		goto out;
+
+	h_file = au_h_fptr(file, au_fbstart(file));
+	if (h_file->f_op && h_file->f_op->fasync)
+		err = h_file->f_op->fasync(fd, h_file, flag);
+
+	di_read_unlock(dentry, AuLock_IR);
+	fi_read_unlock(file);
+
+ out:
+	si_read_unlock(sb);
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+/* no one supports this operation, currently */
+#if 0
+static ssize_t aufs_sendpage(struct file *file, struct page *page, int offset,
+			     size_t len, loff_t *pos , int more)
+{
+}
+#endif
+
+/* ---------------------------------------------------------------------- */
+
+const struct file_operations aufs_file_fop = {
+	/*
+	 * while generic_file_llseek/_unlocked() don't use BKL,
+	 * don't use it since it operates file->f_mapping->host.
+	 * in aufs, it may be a real file and may confuse users by UDBA.
+	 */
+	/* .llseek		= generic_file_llseek, */
+
+	.read		= aufs_read,
+	.write		= aufs_write,
+	.aio_read	= aufs_aio_read,
+	.aio_write	= aufs_aio_write,
+#ifdef CONFIG_AUFS_POLL
+	.poll		= aufs_poll,
+#endif
+	.mmap		= aufs_mmap,
+	.open		= aufs_open_nondir,
+	.flush		= aufs_flush,
+	.release	= aufs_release_nondir,
+	.fsync		= aufs_fsync_nondir,
+	/* .aio_fsync	= aufs_aio_fsync_nondir, */
+	.fasync		= aufs_fasync,
+	/* .sendpage	= aufs_sendpage, */
+	.splice_write	= aufs_splice_write,
+	.splice_read	= aufs_splice_read,
+#if 0
+	.aio_splice_write = aufs_aio_splice_write,
+	.aio_splice_read  = aufs_aio_splice_read
+#endif
+};
--- linux-rt-2.6.31.orig/ubuntu/aufs/plink.c
+++ linux-rt-2.6.31/ubuntu/aufs/plink.c
@@ -0,0 +1,354 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * pseudo-link
+ */
+
+#include "aufs.h"
+
+/*
+ * during a user process maintains the pseudo-links,
+ * prohibit adding a new plink and branch manipulation.
+ */
+void au_plink_block_maintain(struct super_block *sb)
+{
+	struct au_sbinfo *sbi = au_sbi(sb);
+
+	SiMustAnyLock(sb);
+
+	/* gave up wake_up_bit() */
+	wait_event(sbi->si_plink_wq, !au_ftest_si(sbi, MAINTAIN_PLINK));
+}
+
+/* ---------------------------------------------------------------------- */
+
+struct pseudo_link {
+	struct list_head list;
+	struct inode *inode;
+};
+
+#ifdef CONFIG_AUFS_DEBUG
+void au_plink_list(struct super_block *sb)
+{
+	struct au_sbinfo *sbinfo;
+	struct list_head *plink_list;
+	struct pseudo_link *plink;
+
+	SiMustAnyLock(sb);
+
+	sbinfo = au_sbi(sb);
+	AuDebugOn(!au_opt_test(au_mntflags(sb), PLINK));
+
+	plink_list = &sbinfo->si_plink.head;
+	spin_lock(&sbinfo->si_plink.spin);
+	list_for_each_entry(plink, plink_list, list)
+		AuDbg("%lu\n", plink->inode->i_ino);
+	spin_unlock(&sbinfo->si_plink.spin);
+}
+#endif
+
+/* is the inode pseudo-linked? */
+int au_plink_test(struct inode *inode)
+{
+	int found;
+	struct au_sbinfo *sbinfo;
+	struct list_head *plink_list;
+	struct pseudo_link *plink;
+
+	sbinfo = au_sbi(inode->i_sb);
+	AuRwMustAnyLock(&sbinfo->si_rwsem);
+	AuDebugOn(!au_opt_test(au_mntflags(inode->i_sb), PLINK));
+
+	found = 0;
+	plink_list = &sbinfo->si_plink.head;
+	spin_lock(&sbinfo->si_plink.spin);
+	list_for_each_entry(plink, plink_list, list)
+		if (plink->inode == inode) {
+			found = 1;
+			break;
+		}
+	spin_unlock(&sbinfo->si_plink.spin);
+	return found;
+}
+
+/* ---------------------------------------------------------------------- */
+
+/*
+ * generate a name for plink.
+ * the file will be stored under AUFS_WH_PLINKDIR.
+ */
+/* 20 is max digits length of ulong 64 */
+#define PLINK_NAME_LEN	((20 + 1) * 2)
+
+static int plink_name(char *name, int len, struct inode *inode,
+		      aufs_bindex_t bindex)
+{
+	int rlen;
+	struct inode *h_inode;
+
+	h_inode = au_h_iptr(inode, bindex);
+	rlen = snprintf(name, len, "%lu.%lu", inode->i_ino, h_inode->i_ino);
+	return rlen;
+}
+
+/* lookup the plink-ed @inode under the branch at @bindex */
+struct dentry *au_plink_lkup(struct inode *inode, aufs_bindex_t bindex)
+{
+	struct dentry *h_dentry, *h_parent;
+	struct au_branch *br;
+	struct inode *h_dir;
+	char a[PLINK_NAME_LEN];
+	struct qstr tgtname = {
+		.name	= a
+	};
+
+	br = au_sbr(inode->i_sb, bindex);
+	h_parent = br->br_wbr->wbr_plink;
+	h_dir = h_parent->d_inode;
+	tgtname.len = plink_name(a, sizeof(a), inode, bindex);
+
+	/* always superio. */
+	mutex_lock_nested(&h_dir->i_mutex, AuLsc_I_CHILD2);
+	h_dentry = au_sio_lkup_one(&tgtname, h_parent, br);
+	mutex_unlock(&h_dir->i_mutex);
+	return h_dentry;
+}
+
+/* create a pseudo-link */
+static int do_whplink(struct qstr *tgt, struct dentry *h_parent,
+		      struct dentry *h_dentry, struct au_branch *br)
+{
+	int err;
+	struct path h_path = {
+		.mnt = br->br_mnt
+	};
+	struct inode *h_dir;
+
+	h_dir = h_parent->d_inode;
+ again:
+	h_path.dentry = au_lkup_one(tgt, h_parent, br, /*nd*/NULL);
+	err = PTR_ERR(h_path.dentry);
+	if (IS_ERR(h_path.dentry))
+		goto out;
+
+	err = 0;
+	/* wh.plink dir is not monitored */
+	if (h_path.dentry->d_inode
+	    && h_path.dentry->d_inode != h_dentry->d_inode) {
+		err = vfsub_unlink(h_dir, &h_path, /*force*/0);
+		dput(h_path.dentry);
+		h_path.dentry = NULL;
+		if (!err)
+			goto again;
+	}
+	if (!err && !h_path.dentry->d_inode)
+		err = vfsub_link(h_dentry, h_dir, &h_path);
+	dput(h_path.dentry);
+
+ out:
+	return err;
+}
+
+struct do_whplink_args {
+	int *errp;
+	struct qstr *tgt;
+	struct dentry *h_parent;
+	struct dentry *h_dentry;
+	struct au_branch *br;
+};
+
+static void call_do_whplink(void *args)
+{
+	struct do_whplink_args *a = args;
+	*a->errp = do_whplink(a->tgt, a->h_parent, a->h_dentry, a->br);
+}
+
+static int whplink(struct dentry *h_dentry, struct inode *inode,
+		   aufs_bindex_t bindex, struct au_branch *br)
+{
+	int err, wkq_err;
+	struct au_wbr *wbr;
+	struct dentry *h_parent;
+	struct inode *h_dir;
+	char a[PLINK_NAME_LEN];
+	struct qstr tgtname = {
+		.name = a
+	};
+
+	wbr = au_sbr(inode->i_sb, bindex)->br_wbr;
+	h_parent = wbr->wbr_plink;
+	h_dir = h_parent->d_inode;
+	tgtname.len = plink_name(a, sizeof(a), inode, bindex);
+
+	/* always superio. */
+	mutex_lock_nested(&h_dir->i_mutex, AuLsc_I_CHILD2);
+	if (!au_test_wkq(current)) {
+		struct do_whplink_args args = {
+			.errp		= &err,
+			.tgt		= &tgtname,
+			.h_parent	= h_parent,
+			.h_dentry	= h_dentry,
+			.br		= br
+		};
+		wkq_err = au_wkq_wait(call_do_whplink, &args);
+		if (unlikely(wkq_err))
+			err = wkq_err;
+	} else
+		err = do_whplink(&tgtname, h_parent, h_dentry, br);
+	mutex_unlock(&h_dir->i_mutex);
+
+	return err;
+}
+
+/* free a single plink */
+static void do_put_plink(struct pseudo_link *plink, int do_del)
+{
+	iput(plink->inode);
+	if (do_del)
+		list_del(&plink->list);
+	kfree(plink);
+}
+
+/*
+ * create a new pseudo-link for @h_dentry on @bindex.
+ * the linked inode is held in aufs @inode.
+ */
+void au_plink_append(struct inode *inode, aufs_bindex_t bindex,
+		     struct dentry *h_dentry)
+{
+	struct super_block *sb;
+	struct au_sbinfo *sbinfo;
+	struct list_head *plink_list;
+	struct pseudo_link *plink;
+	int found, err, cnt;
+
+	sb = inode->i_sb;
+	sbinfo = au_sbi(sb);
+	AuDebugOn(!au_opt_test(au_mntflags(sb), PLINK));
+
+	err = 0;
+	cnt = 0;
+	found = 0;
+	plink_list = &sbinfo->si_plink.head;
+	spin_lock(&sbinfo->si_plink.spin);
+	list_for_each_entry(plink, plink_list, list) {
+		cnt++;
+		if (plink->inode == inode) {
+			found = 1;
+			break;
+		}
+	}
+	if (found) {
+		spin_unlock(&sbinfo->si_plink.spin);
+		return;
+	}
+
+	plink = NULL;
+	if (!found) {
+		plink = kmalloc(sizeof(*plink), GFP_ATOMIC);
+		if (plink) {
+			plink->inode = au_igrab(inode);
+			list_add(&plink->list, plink_list);
+			cnt++;
+		} else
+			err = -ENOMEM;
+	}
+	spin_unlock(&sbinfo->si_plink.spin);
+
+	if (!err) {
+		au_plink_block_maintain(sb);
+		err = whplink(h_dentry, inode, bindex, au_sbr(sb, bindex));
+	}
+
+	if (unlikely(cnt > AUFS_PLINK_WARN))
+		AuWarn1("unexpectedly many pseudo links, %d\n", cnt);
+	if (unlikely(err)) {
+		AuWarn("err %d, damaged pseudo link.\n", err);
+		if (!found && plink)
+			do_put_plink(plink, /*do_del*/1);
+	}
+}
+
+/* free all plinks */
+void au_plink_put(struct super_block *sb)
+{
+	struct au_sbinfo *sbinfo;
+	struct list_head *plink_list;
+	struct pseudo_link *plink, *tmp;
+
+	SiMustWriteLock(sb);
+
+	sbinfo = au_sbi(sb);
+	AuDebugOn(!au_opt_test(au_mntflags(sb), PLINK));
+
+	plink_list = &sbinfo->si_plink.head;
+	/* no spin_lock since sbinfo is write-locked */
+	list_for_each_entry_safe(plink, tmp, plink_list, list)
+		do_put_plink(plink, 0);
+	INIT_LIST_HEAD(plink_list);
+}
+
+/* free the plinks on a branch specified by @br_id */
+void au_plink_half_refresh(struct super_block *sb, aufs_bindex_t br_id)
+{
+	struct au_sbinfo *sbinfo;
+	struct list_head *plink_list;
+	struct pseudo_link *plink, *tmp;
+	struct inode *inode;
+	aufs_bindex_t bstart, bend, bindex;
+	unsigned char do_put;
+
+	SiMustWriteLock(sb);
+
+	sbinfo = au_sbi(sb);
+	AuDebugOn(!au_opt_test(au_mntflags(sb), PLINK));
+
+	plink_list = &sbinfo->si_plink.head;
+	/* no spin_lock since sbinfo is write-locked */
+	list_for_each_entry_safe(plink, tmp, plink_list, list) {
+		do_put = 0;
+		inode = au_igrab(plink->inode);
+		ii_write_lock_child(inode);
+		bstart = au_ibstart(inode);
+		bend = au_ibend(inode);
+		if (bstart >= 0) {
+			for (bindex = bstart; bindex <= bend; bindex++) {
+				if (!au_h_iptr(inode, bindex)
+				    || au_ii_br_id(inode, bindex) != br_id)
+					continue;
+				au_set_h_iptr(inode, bindex, NULL, 0);
+				do_put = 1;
+				break;
+			}
+		} else
+			do_put_plink(plink, 1);
+
+		if (do_put) {
+			for (bindex = bstart; bindex <= bend; bindex++)
+				if (au_h_iptr(inode, bindex)) {
+					do_put = 0;
+					break;
+				}
+			if (do_put)
+				do_put_plink(plink, 1);
+		}
+		ii_write_unlock(inode);
+		iput(inode);
+	}
+}
--- linux-rt-2.6.31.orig/ubuntu/aufs/sysfs.c
+++ linux-rt-2.6.31/ubuntu/aufs/sysfs.c
@@ -0,0 +1,210 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * sysfs interface
+ */
+
+#include <linux/fs.h>
+#include <linux/module.h>
+#include <linux/seq_file.h>
+#include <linux/sysfs.h>
+#include "aufs.h"
+
+static struct attribute *au_attr[] = {
+	NULL,	/* need to NULL terminate the list of attributes */
+};
+
+static struct attribute_group sysaufs_attr_group_body = {
+	.attrs = au_attr
+};
+
+struct attribute_group *sysaufs_attr_group = &sysaufs_attr_group_body;
+
+/* ---------------------------------------------------------------------- */
+
+int sysaufs_si_xi_path(struct seq_file *seq, struct super_block *sb)
+{
+	int err;
+
+	SiMustAnyLock(sb);
+
+	err = 0;
+	if (au_opt_test(au_mntflags(sb), XINO)) {
+		err = au_xino_path(seq, au_sbi(sb)->si_xib);
+		seq_putc(seq, '\n');
+	}
+	return err;
+}
+
+/*
+ * the lifetime of branch is independent from the entry under sysfs.
+ * sysfs handles the lifetime of the entry, and never call ->show() after it is
+ * unlinked.
+ */
+static int sysaufs_si_br(struct seq_file *seq, struct super_block *sb,
+			 aufs_bindex_t bindex)
+{
+	struct path path;
+	struct dentry *root;
+	struct au_branch *br;
+
+	AuDbg("b%d\n", bindex);
+
+	root = sb->s_root;
+	di_read_lock_parent(root, !AuLock_IR);
+	br = au_sbr(sb, bindex);
+	path.mnt = br->br_mnt;
+	path.dentry = au_h_dptr(root, bindex);
+	au_seq_path(seq, &path);
+	di_read_unlock(root, !AuLock_IR);
+	seq_printf(seq, "=%s\n", au_optstr_br_perm(br->br_perm));
+	return 0;
+}
+
+/* ---------------------------------------------------------------------- */
+
+static struct seq_file *au_seq(char *p, ssize_t len)
+{
+	struct seq_file *seq;
+
+	seq = kzalloc(sizeof(*seq), GFP_NOFS);
+	if (seq) {
+		/* mutex_init(&seq.lock); */
+		seq->buf = p;
+		seq->size = len;
+		return seq; /* success */
+	}
+
+	seq = ERR_PTR(-ENOMEM);
+	return seq;
+}
+
+#define SysaufsBr_PREFIX "br"
+
+/* todo: file size may exceed PAGE_SIZE */
+ssize_t sysaufs_si_show(struct kobject *kobj, struct attribute *attr,
+			 char *buf)
+{
+	ssize_t err;
+	long l;
+	aufs_bindex_t bend;
+	struct au_sbinfo *sbinfo;
+	struct super_block *sb;
+	struct seq_file *seq;
+	char *name;
+	struct attribute **cattr;
+
+	sbinfo = container_of(kobj, struct au_sbinfo, si_kobj);
+	sb = sbinfo->si_sb;
+	si_noflush_read_lock(sb);
+
+	seq = au_seq(buf, PAGE_SIZE);
+	err = PTR_ERR(seq);
+	if (IS_ERR(seq))
+		goto out;
+
+	name = (void *)attr->name;
+	cattr = sysaufs_si_attrs;
+	while (*cattr) {
+		if (!strcmp(name, (*cattr)->name)) {
+			err = container_of(*cattr, struct sysaufs_si_attr, attr)
+				->show(seq, sb);
+			goto out_seq;
+		}
+		cattr++;
+	}
+
+	bend = au_sbend(sb);
+	if (!strncmp(name, SysaufsBr_PREFIX, sizeof(SysaufsBr_PREFIX) - 1)) {
+		name += sizeof(SysaufsBr_PREFIX) - 1;
+		err = strict_strtol(name, 10, &l);
+		if (!err) {
+			if (l <= bend)
+				err = sysaufs_si_br(seq, sb, (aufs_bindex_t)l);
+			else
+				err = -ENOENT;
+		}
+		goto out_seq;
+	}
+	BUG();
+
+ out_seq:
+	if (!err) {
+		err = seq->count;
+		/* sysfs limit */
+		if (unlikely(err == PAGE_SIZE))
+			err = -EFBIG;
+	}
+	kfree(seq);
+ out:
+	si_read_unlock(sb);
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+void sysaufs_br_init(struct au_branch *br)
+{
+	br->br_attr.name = br->br_name;
+	br->br_attr.mode = S_IRUGO;
+	br->br_attr.owner = THIS_MODULE;
+}
+
+void sysaufs_brs_del(struct super_block *sb, aufs_bindex_t bindex)
+{
+	struct au_branch *br;
+	struct kobject *kobj;
+	aufs_bindex_t bend;
+
+	dbgaufs_brs_del(sb, bindex);
+
+	if (!sysaufs_brs)
+		return;
+
+	kobj = &au_sbi(sb)->si_kobj;
+	bend = au_sbend(sb);
+	for (; bindex <= bend; bindex++) {
+		br = au_sbr(sb, bindex);
+		sysfs_remove_file(kobj, &br->br_attr);
+	}
+}
+
+void sysaufs_brs_add(struct super_block *sb, aufs_bindex_t bindex)
+{
+	int err;
+	aufs_bindex_t bend;
+	struct kobject *kobj;
+	struct au_branch *br;
+
+	dbgaufs_brs_add(sb, bindex);
+
+	if (!sysaufs_brs)
+		return;
+
+	kobj = &au_sbi(sb)->si_kobj;
+	bend = au_sbend(sb);
+	for (; bindex <= bend; bindex++) {
+		br = au_sbr(sb, bindex);
+		snprintf(br->br_name, sizeof(br->br_name), SysaufsBr_PREFIX
+			 "%d", bindex);
+		err = sysfs_create_file(kobj, &br->br_attr);
+		if (unlikely(err))
+			AuWarn("failed %s under sysfs(%d)\n", br->br_name, err);
+	}
+}
--- linux-rt-2.6.31.orig/ubuntu/aufs/dinfo.c
+++ linux-rt-2.6.31/ubuntu/aufs/dinfo.c
@@ -0,0 +1,367 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * dentry private data
+ */
+
+#include "aufs.h"
+
+int au_alloc_dinfo(struct dentry *dentry)
+{
+	struct au_dinfo *dinfo;
+	struct super_block *sb;
+	int nbr;
+
+	dinfo = au_cache_alloc_dinfo();
+	if (unlikely(!dinfo))
+		goto out;
+
+	sb = dentry->d_sb;
+	nbr = au_sbend(sb) + 1;
+	if (nbr <= 0)
+		nbr = 1;
+	dinfo->di_hdentry = kcalloc(nbr, sizeof(*dinfo->di_hdentry), GFP_NOFS);
+	if (unlikely(!dinfo->di_hdentry))
+		goto out_dinfo;
+
+	atomic_set(&dinfo->di_generation, au_sigen(sb));
+	/* smp_mb(); */ /* atomic_set */
+	au_rw_init_wlock_nested(&dinfo->di_rwsem, AuLsc_DI_CHILD);
+	dinfo->di_bstart = -1;
+	dinfo->di_bend = -1;
+	dinfo->di_bwh = -1;
+	dinfo->di_bdiropq = -1;
+
+	dentry->d_fsdata = dinfo;
+	dentry->d_op = &aufs_dop;
+	return 0; /* success */
+
+ out_dinfo:
+	au_cache_free_dinfo(dinfo);
+ out:
+	return -ENOMEM;
+}
+
+int au_di_realloc(struct au_dinfo *dinfo, int nbr)
+{
+	int err, sz;
+	struct au_hdentry *hdp;
+
+	AuRwMustWriteLock(&dinfo->di_rwsem);
+
+	err = -ENOMEM;
+	sz = sizeof(*hdp) * (dinfo->di_bend + 1);
+	if (!sz)
+		sz = sizeof(*hdp);
+	hdp = au_kzrealloc(dinfo->di_hdentry, sz, sizeof(*hdp) * nbr, GFP_NOFS);
+	if (hdp) {
+		dinfo->di_hdentry = hdp;
+		err = 0;
+	}
+
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+static void do_ii_write_lock(struct inode *inode, unsigned int lsc)
+{
+	switch (lsc) {
+	case AuLsc_DI_CHILD:
+		ii_write_lock_child(inode);
+		break;
+	case AuLsc_DI_CHILD2:
+		ii_write_lock_child2(inode);
+		break;
+	case AuLsc_DI_CHILD3:
+		ii_write_lock_child3(inode);
+		break;
+	case AuLsc_DI_PARENT:
+		ii_write_lock_parent(inode);
+		break;
+	case AuLsc_DI_PARENT2:
+		ii_write_lock_parent2(inode);
+		break;
+	case AuLsc_DI_PARENT3:
+		ii_write_lock_parent3(inode);
+		break;
+	default:
+		BUG();
+	}
+}
+
+static void do_ii_read_lock(struct inode *inode, unsigned int lsc)
+{
+	switch (lsc) {
+	case AuLsc_DI_CHILD:
+		ii_read_lock_child(inode);
+		break;
+	case AuLsc_DI_CHILD2:
+		ii_read_lock_child2(inode);
+		break;
+	case AuLsc_DI_CHILD3:
+		ii_read_lock_child3(inode);
+		break;
+	case AuLsc_DI_PARENT:
+		ii_read_lock_parent(inode);
+		break;
+	case AuLsc_DI_PARENT2:
+		ii_read_lock_parent2(inode);
+		break;
+	case AuLsc_DI_PARENT3:
+		ii_read_lock_parent3(inode);
+		break;
+	default:
+		BUG();
+	}
+}
+
+void di_read_lock(struct dentry *d, int flags, unsigned int lsc)
+{
+	au_rw_read_lock_nested(&au_di(d)->di_rwsem, lsc);
+	if (d->d_inode) {
+		if (au_ftest_lock(flags, IW))
+			do_ii_write_lock(d->d_inode, lsc);
+		else if (au_ftest_lock(flags, IR))
+			do_ii_read_lock(d->d_inode, lsc);
+	}
+}
+
+void di_read_unlock(struct dentry *d, int flags)
+{
+	if (d->d_inode) {
+		if (au_ftest_lock(flags, IW))
+			ii_write_unlock(d->d_inode);
+		else if (au_ftest_lock(flags, IR))
+			ii_read_unlock(d->d_inode);
+	}
+	au_rw_read_unlock(&au_di(d)->di_rwsem);
+}
+
+void di_downgrade_lock(struct dentry *d, int flags)
+{
+	if (d->d_inode && au_ftest_lock(flags, IR))
+		ii_downgrade_lock(d->d_inode);
+	au_rw_dgrade_lock(&au_di(d)->di_rwsem);
+}
+
+void di_write_lock(struct dentry *d, unsigned int lsc)
+{
+	au_rw_write_lock_nested(&au_di(d)->di_rwsem, lsc);
+	if (d->d_inode)
+		do_ii_write_lock(d->d_inode, lsc);
+}
+
+void di_write_unlock(struct dentry *d)
+{
+	if (d->d_inode)
+		ii_write_unlock(d->d_inode);
+	au_rw_write_unlock(&au_di(d)->di_rwsem);
+}
+
+void di_write_lock2_child(struct dentry *d1, struct dentry *d2, int isdir)
+{
+	AuDebugOn(d1 == d2
+		  || d1->d_inode == d2->d_inode
+		  || d1->d_sb != d2->d_sb);
+
+	if (isdir && au_test_subdir(d1, d2)) {
+		di_write_lock_child(d1);
+		di_write_lock_child2(d2);
+	} else {
+		/* there should be no races */
+		di_write_lock_child(d2);
+		di_write_lock_child2(d1);
+	}
+}
+
+void di_write_lock2_parent(struct dentry *d1, struct dentry *d2, int isdir)
+{
+	AuDebugOn(d1 == d2
+		  || d1->d_inode == d2->d_inode
+		  || d1->d_sb != d2->d_sb);
+
+	if (isdir && au_test_subdir(d1, d2)) {
+		di_write_lock_parent(d1);
+		di_write_lock_parent2(d2);
+	} else {
+		/* there should be no races */
+		di_write_lock_parent(d2);
+		di_write_lock_parent2(d1);
+	}
+}
+
+void di_write_unlock2(struct dentry *d1, struct dentry *d2)
+{
+	di_write_unlock(d1);
+	if (d1->d_inode == d2->d_inode)
+		au_rw_write_unlock(&au_di(d2)->di_rwsem);
+	else
+		di_write_unlock(d2);
+}
+
+/* ---------------------------------------------------------------------- */
+
+struct dentry *au_h_dptr(struct dentry *dentry, aufs_bindex_t bindex)
+{
+	struct dentry *d;
+
+	DiMustAnyLock(dentry);
+
+	if (au_dbstart(dentry) < 0 || bindex < au_dbstart(dentry))
+		return NULL;
+	AuDebugOn(bindex < 0);
+	d = au_di(dentry)->di_hdentry[0 + bindex].hd_dentry;
+	AuDebugOn(d && (atomic_read(&d->d_count) <= 0));
+	return d;
+}
+
+aufs_bindex_t au_dbtail(struct dentry *dentry)
+{
+	aufs_bindex_t bend, bwh;
+
+	bend = au_dbend(dentry);
+	if (0 <= bend) {
+		bwh = au_dbwh(dentry);
+		if (!bwh)
+			return bwh;
+		if (0 < bwh && bwh < bend)
+			return bwh - 1;
+	}
+	return bend;
+}
+
+aufs_bindex_t au_dbtaildir(struct dentry *dentry)
+{
+	aufs_bindex_t bend, bopq;
+
+	bend = au_dbtail(dentry);
+	if (0 <= bend) {
+		bopq = au_dbdiropq(dentry);
+		if (0 <= bopq && bopq < bend)
+			bend = bopq;
+	}
+	return bend;
+}
+
+/* ---------------------------------------------------------------------- */
+
+void au_set_h_dptr(struct dentry *dentry, aufs_bindex_t bindex,
+		   struct dentry *h_dentry)
+{
+	struct au_hdentry *hd = au_di(dentry)->di_hdentry + bindex;
+
+	DiMustWriteLock(dentry);
+
+	if (hd->hd_dentry)
+		au_hdput(hd);
+	hd->hd_dentry = h_dentry;
+}
+
+void au_update_digen(struct dentry *dentry)
+{
+	atomic_set(&au_di(dentry)->di_generation, au_sigen(dentry->d_sb));
+	/* smp_mb(); */ /* atomic_set */
+}
+
+void au_update_dbrange(struct dentry *dentry, int do_put_zero)
+{
+	struct au_dinfo *dinfo;
+	struct dentry *h_d;
+
+	DiMustWriteLock(dentry);
+
+	dinfo = au_di(dentry);
+	if (!dinfo || dinfo->di_bstart < 0)
+		return;
+
+	if (do_put_zero) {
+		aufs_bindex_t bindex, bend;
+
+		bend = dinfo->di_bend;
+		for (bindex = dinfo->di_bstart; bindex <= bend; bindex++) {
+			h_d = dinfo->di_hdentry[0 + bindex].hd_dentry;
+			if (h_d && !h_d->d_inode)
+				au_set_h_dptr(dentry, bindex, NULL);
+		}
+	}
+
+	dinfo->di_bstart = -1;
+	while (++dinfo->di_bstart <= dinfo->di_bend)
+		if (dinfo->di_hdentry[0 + dinfo->di_bstart].hd_dentry)
+			break;
+	if (dinfo->di_bstart > dinfo->di_bend) {
+		dinfo->di_bstart = -1;
+		dinfo->di_bend = -1;
+		return;
+	}
+
+	dinfo->di_bend++;
+	while (0 <= --dinfo->di_bend)
+		if (dinfo->di_hdentry[0 + dinfo->di_bend].hd_dentry)
+			break;
+	AuDebugOn(dinfo->di_bstart > dinfo->di_bend || dinfo->di_bend < 0);
+}
+
+void au_update_dbstart(struct dentry *dentry)
+{
+	aufs_bindex_t bindex, bend;
+	struct dentry *h_dentry;
+
+	bend = au_dbend(dentry);
+	for (bindex = au_dbstart(dentry); bindex <= bend; bindex++) {
+		h_dentry = au_h_dptr(dentry, bindex);
+		if (!h_dentry)
+			continue;
+		if (h_dentry->d_inode) {
+			au_set_dbstart(dentry, bindex);
+			return;
+		}
+		au_set_h_dptr(dentry, bindex, NULL);
+	}
+}
+
+void au_update_dbend(struct dentry *dentry)
+{
+	aufs_bindex_t bindex, bstart;
+	struct dentry *h_dentry;
+
+	bstart = au_dbstart(dentry);
+	for (bindex = au_dbend(dentry); bindex <= bstart; bindex--) {
+		h_dentry = au_h_dptr(dentry, bindex);
+		if (!h_dentry)
+			continue;
+		if (h_dentry->d_inode) {
+			au_set_dbend(dentry, bindex);
+			return;
+		}
+		au_set_h_dptr(dentry, bindex, NULL);
+	}
+}
+
+int au_find_dbindex(struct dentry *dentry, struct dentry *h_dentry)
+{
+	aufs_bindex_t bindex, bend;
+
+	bend = au_dbend(dentry);
+	for (bindex = au_dbstart(dentry); bindex <= bend; bindex++)
+		if (au_h_dptr(dentry, bindex) == h_dentry)
+			return bindex;
+	return -1;
+}
--- linux-rt-2.6.31.orig/ubuntu/aufs/iinfo.c
+++ linux-rt-2.6.31/ubuntu/aufs/iinfo.c
@@ -0,0 +1,283 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * inode private data
+ */
+
+#include "aufs.h"
+
+struct inode *au_h_iptr(struct inode *inode, aufs_bindex_t bindex)
+{
+	struct inode *h_inode;
+
+	IiMustAnyLock(inode);
+
+	h_inode = au_ii(inode)->ii_hinode[0 + bindex].hi_inode;
+	AuDebugOn(h_inode && atomic_read(&h_inode->i_count) <= 0);
+	return h_inode;
+}
+
+/* todo: hard/soft set? */
+void au_set_ibstart(struct inode *inode, aufs_bindex_t bindex)
+{
+	struct au_iinfo *iinfo = au_ii(inode);
+	struct inode *h_inode;
+
+	IiMustWriteLock(inode);
+
+	iinfo->ii_bstart = bindex;
+	h_inode = iinfo->ii_hinode[bindex + 0].hi_inode;
+	if (h_inode)
+		au_cpup_igen(inode, h_inode);
+}
+
+void au_hiput(struct au_hinode *hinode)
+{
+	au_hin_free(hinode);
+	dput(hinode->hi_whdentry);
+	iput(hinode->hi_inode);
+}
+
+unsigned int au_hi_flags(struct inode *inode, int isdir)
+{
+	unsigned int flags;
+	const unsigned int mnt_flags = au_mntflags(inode->i_sb);
+
+	flags = 0;
+	if (au_opt_test(mnt_flags, XINO))
+		au_fset_hi(flags, XINO);
+	if (isdir && au_opt_test(mnt_flags, UDBA_HINOTIFY))
+		au_fset_hi(flags, HINOTIFY);
+	return flags;
+}
+
+void au_set_h_iptr(struct inode *inode, aufs_bindex_t bindex,
+		   struct inode *h_inode, unsigned int flags)
+{
+	struct au_hinode *hinode;
+	struct inode *hi;
+	struct au_iinfo *iinfo = au_ii(inode);
+
+	IiMustWriteLock(inode);
+
+	hinode = iinfo->ii_hinode + bindex;
+	hi = hinode->hi_inode;
+	AuDebugOn(h_inode && atomic_read(&h_inode->i_count) <= 0);
+	AuDebugOn(h_inode && hi);
+
+	if (hi)
+		au_hiput(hinode);
+	hinode->hi_inode = h_inode;
+	if (h_inode) {
+		int err;
+		struct super_block *sb = inode->i_sb;
+		struct au_branch *br;
+
+		if (bindex == iinfo->ii_bstart)
+			au_cpup_igen(inode, h_inode);
+		br = au_sbr(sb, bindex);
+		hinode->hi_id = br->br_id;
+		if (au_ftest_hi(flags, XINO)) {
+			err = au_xino_write(sb, bindex, h_inode->i_ino,
+					    inode->i_ino);
+			if (unlikely(err))
+				AuIOErr1("failed au_xino_write() %d\n", err);
+		}
+
+		if (au_ftest_hi(flags, HINOTIFY)
+		    && au_br_hinotifyable(br->br_perm)) {
+			err = au_hin_alloc(hinode, inode, h_inode);
+			if (unlikely(err))
+				AuIOErr1("au_hin_alloc() %d\n", err);
+		}
+	}
+}
+
+void au_set_hi_wh(struct inode *inode, aufs_bindex_t bindex,
+		  struct dentry *h_wh)
+{
+	struct au_hinode *hinode;
+
+	IiMustWriteLock(inode);
+
+	hinode = au_ii(inode)->ii_hinode + bindex;
+	AuDebugOn(hinode->hi_whdentry);
+	hinode->hi_whdentry = h_wh;
+}
+
+void au_update_iigen(struct inode *inode)
+{
+	atomic_set(&au_ii(inode)->ii_generation, au_sigen(inode->i_sb));
+	/* smp_mb(); */ /* atomic_set */
+}
+
+/* it may be called at remount time, too */
+void au_update_brange(struct inode *inode, int do_put_zero)
+{
+	struct au_iinfo *iinfo;
+
+	iinfo = au_ii(inode);
+	if (!iinfo || iinfo->ii_bstart < 0)
+		return;
+
+	IiMustWriteLock(inode);
+
+	if (do_put_zero) {
+		aufs_bindex_t bindex;
+
+		for (bindex = iinfo->ii_bstart; bindex <= iinfo->ii_bend;
+		     bindex++) {
+			struct inode *h_i;
+
+			h_i = iinfo->ii_hinode[0 + bindex].hi_inode;
+			if (h_i && !h_i->i_nlink)
+				au_set_h_iptr(inode, bindex, NULL, 0);
+		}
+	}
+
+	iinfo->ii_bstart = -1;
+	while (++iinfo->ii_bstart <= iinfo->ii_bend)
+		if (iinfo->ii_hinode[0 + iinfo->ii_bstart].hi_inode)
+			break;
+	if (iinfo->ii_bstart > iinfo->ii_bend) {
+		iinfo->ii_bstart = -1;
+		iinfo->ii_bend = -1;
+		return;
+	}
+
+	iinfo->ii_bend++;
+	while (0 <= --iinfo->ii_bend)
+		if (iinfo->ii_hinode[0 + iinfo->ii_bend].hi_inode)
+			break;
+	AuDebugOn(iinfo->ii_bstart > iinfo->ii_bend || iinfo->ii_bend < 0);
+}
+
+/* ---------------------------------------------------------------------- */
+
+int au_iinfo_init(struct inode *inode)
+{
+	struct au_iinfo *iinfo;
+	struct super_block *sb;
+	int nbr, i;
+
+	sb = inode->i_sb;
+	iinfo = &(container_of(inode, struct au_icntnr, vfs_inode)->iinfo);
+	nbr = au_sbend(sb) + 1;
+	if (unlikely(nbr <= 0))
+		nbr = 1;
+	iinfo->ii_hinode = kcalloc(nbr, sizeof(*iinfo->ii_hinode), GFP_NOFS);
+	if (iinfo->ii_hinode) {
+		for (i = 0; i < nbr; i++)
+			iinfo->ii_hinode[i].hi_id = -1;
+
+		atomic_set(&iinfo->ii_generation, au_sigen(sb));
+		/* smp_mb(); */ /* atomic_set */
+		au_rw_init(&iinfo->ii_rwsem);
+		iinfo->ii_bstart = -1;
+		iinfo->ii_bend = -1;
+		iinfo->ii_vdir = NULL;
+		return 0;
+	}
+	return -ENOMEM;
+}
+
+int au_ii_realloc(struct au_iinfo *iinfo, int nbr)
+{
+	int err, sz;
+	struct au_hinode *hip;
+
+	AuRwMustWriteLock(&iinfo->ii_rwsem);
+
+	err = -ENOMEM;
+	sz = sizeof(*hip) * (iinfo->ii_bend + 1);
+	if (!sz)
+		sz = sizeof(*hip);
+	hip = au_kzrealloc(iinfo->ii_hinode, sz, sizeof(*hip) * nbr, GFP_NOFS);
+	if (hip) {
+		iinfo->ii_hinode = hip;
+		err = 0;
+	}
+
+	return err;
+}
+
+static int au_iinfo_write0(struct super_block *sb, struct au_hinode *hinode,
+			   ino_t ino)
+{
+	int err;
+	aufs_bindex_t bindex;
+	unsigned char locked;
+
+	err = 0;
+	locked = !!si_noflush_read_trylock(sb);
+	bindex = au_br_index(sb, hinode->hi_id);
+	if (bindex >= 0)
+		err = au_xino_write0(sb, bindex, hinode->hi_inode->i_ino, ino);
+	/* error action? */
+	if (locked)
+		si_read_unlock(sb);
+	return err;
+}
+
+void au_iinfo_fin(struct inode *inode)
+{
+	ino_t ino;
+	aufs_bindex_t bend;
+	unsigned char unlinked = !inode->i_nlink;
+	struct au_iinfo *iinfo;
+	struct au_hinode *hi;
+	struct super_block *sb;
+
+	if (unlinked) {
+		int err = au_xigen_inc(inode);
+		if (unlikely(err))
+			AuWarn1("failed resetting i_generation, %d\n", err);
+	}
+
+	iinfo = au_ii(inode);
+	/* bad_inode case */
+	if (!iinfo)
+		return;
+
+	if (iinfo->ii_vdir)
+		au_vdir_free(iinfo->ii_vdir);
+
+	if (iinfo->ii_bstart >= 0) {
+		sb = inode->i_sb;
+		ino = 0;
+		if (unlinked)
+			ino = inode->i_ino;
+		hi = iinfo->ii_hinode + iinfo->ii_bstart;
+		bend = iinfo->ii_bend;
+		while (iinfo->ii_bstart++ <= bend) {
+			if (hi->hi_inode) {
+				if (unlinked || !hi->hi_inode->i_nlink) {
+					au_iinfo_write0(sb, hi, ino);
+					/* ignore this error */
+					ino = 0;
+				}
+				au_hiput(hi);
+			}
+			hi++;
+		}
+	}
+
+	kfree(iinfo->ii_hinode);
+	AuRwDestroy(&iinfo->ii_rwsem);
+}
--- linux-rt-2.6.31.orig/ubuntu/aufs/loop.c
+++ linux-rt-2.6.31/ubuntu/aufs/loop.c
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * support for loopback block device as a branch
+ */
+
+#include <linux/loop.h>
+#include "aufs.h"
+
+/*
+ * test if two lower dentries have overlapping branches.
+ */
+int au_test_loopback_overlap(struct super_block *sb, struct dentry *h_d1,
+			     struct dentry *h_d2)
+{
+	struct inode *h_inode;
+	struct loop_device *l;
+
+	h_inode = h_d1->d_inode;
+	if (MAJOR(h_inode->i_sb->s_dev) != LOOP_MAJOR)
+		return 0;
+
+	l = h_inode->i_sb->s_bdev->bd_disk->private_data;
+	h_d1 = l->lo_backing_file->f_dentry;
+	/* h_d1 can be local NFS. in this case aufs cannot detect the loop */
+	if (unlikely(h_d1->d_sb == sb))
+		return 1;
+	return !!au_test_subdir(h_d1, h_d2);
+}
+
+/* true if a kernel thread named 'loop[0-9].*' accesses a file */
+int au_test_loopback_kthread(void)
+{
+	const char c = current->comm[4];
+
+	return current->mm == NULL
+	       && '0' <= c && c <= '9'
+	       && strncmp(current->comm, "loop", 4) == 0;
+}
--- linux-rt-2.6.31.orig/ubuntu/aufs/dcsub.h
+++ linux-rt-2.6.31/ubuntu/aufs/dcsub.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * sub-routines for dentry cache
+ */
+
+#ifndef __AUFS_DCSUB_H__
+#define __AUFS_DCSUB_H__
+
+#ifdef __KERNEL__
+
+#include <linux/types.h>
+
+struct dentry;
+
+struct au_dpage {
+	int ndentry;
+	struct dentry **dentries;
+};
+
+struct au_dcsub_pages {
+	int ndpage;
+	struct au_dpage *dpages;
+};
+
+/* ---------------------------------------------------------------------- */
+
+int au_dpages_init(struct au_dcsub_pages *dpages, gfp_t gfp);
+void au_dpages_free(struct au_dcsub_pages *dpages);
+typedef int (*au_dpages_test)(struct dentry *dentry, void *arg);
+int au_dcsub_pages(struct au_dcsub_pages *dpages, struct dentry *root,
+		   au_dpages_test test, void *arg);
+int au_dcsub_pages_rev(struct au_dcsub_pages *dpages, struct dentry *dentry,
+		       int do_include, au_dpages_test test, void *arg);
+struct dentry *au_test_subdir(struct dentry *d1, struct dentry *d2);
+
+#endif /* __KERNEL__ */
+#endif /* __AUFS_DCSUB_H__ */
--- linux-rt-2.6.31.orig/ubuntu/aufs/loop.h
+++ linux-rt-2.6.31/ubuntu/aufs/loop.h
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * support for loopback mount as a branch
+ */
+
+#ifndef __AUFS_LOOP_H__
+#define __AUFS_LOOP_H__
+
+#ifdef __KERNEL__
+
+struct dentry;
+struct super_block;
+
+#ifdef CONFIG_AUFS_BDEV_LOOP
+/* loop.c */
+int au_test_loopback_overlap(struct super_block *sb, struct dentry *h_d1,
+			     struct dentry *h_d2);
+int au_test_loopback_kthread(void);
+#else
+static inline
+int au_test_loopback_overlap(struct super_block *sb, struct dentry *h_d1,
+			     struct dentry *h_d2)
+{
+	return 0;
+}
+
+static inline int au_test_loopback_kthread(void)
+{
+	return 0;
+}
+#endif /* BLK_DEV_LOOP */
+
+#endif /* __KERNEL__ */
+#endif /* __AUFS_LOOP_H__ */
--- linux-rt-2.6.31.orig/ubuntu/aufs/xino.c
+++ linux-rt-2.6.31/ubuntu/aufs/xino.c
@@ -0,0 +1,1200 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * external inode number translation table and bitmap
+ */
+
+#include <linux/file.h>
+#include <linux/seq_file.h>
+#include <linux/uaccess.h>
+#include "aufs.h"
+
+ssize_t xino_fread(au_readf_t func, struct file *file, void *buf, size_t size,
+		   loff_t *pos)
+{
+	ssize_t err;
+	mm_segment_t oldfs;
+
+	oldfs = get_fs();
+	set_fs(KERNEL_DS);
+	do {
+		/* todo: signal_pending? */
+		err = func(file, (char __user *)buf, size, pos);
+	} while (err == -EAGAIN || err == -EINTR);
+	set_fs(oldfs);
+
+#if 0 /* reserved for future use */
+	if (err > 0)
+		fsnotify_access(file->f_dentry);
+#endif
+
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+static ssize_t do_xino_fwrite(au_writef_t func, struct file *file, void *buf,
+			      size_t size, loff_t *pos)
+{
+	ssize_t err;
+	mm_segment_t oldfs;
+
+	oldfs = get_fs();
+	set_fs(KERNEL_DS);
+	lockdep_off();
+	do {
+		/* todo: signal_pending? */
+		err = func(file, (const char __user *)buf, size, pos);
+	} while (err == -EAGAIN || err == -EINTR);
+	lockdep_on();
+	set_fs(oldfs);
+
+#if 0 /* reserved for future use */
+	if (err > 0)
+		fsnotify_modify(file->f_dentry);
+#endif
+
+	return err;
+}
+
+struct do_xino_fwrite_args {
+	ssize_t *errp;
+	au_writef_t func;
+	struct file *file;
+	void *buf;
+	size_t size;
+	loff_t *pos;
+};
+
+static void call_do_xino_fwrite(void *args)
+{
+	struct do_xino_fwrite_args *a = args;
+	*a->errp = do_xino_fwrite(a->func, a->file, a->buf, a->size, a->pos);
+}
+
+ssize_t xino_fwrite(au_writef_t func, struct file *file, void *buf, size_t size,
+		    loff_t *pos)
+{
+	ssize_t err;
+
+	/* todo: signal block and no wkq? */
+	/* todo: new credential scheme */
+	/*
+	 * it breaks RLIMIT_FSIZE and normal user's limit,
+	 * users should care about quota and real 'filesystem full.'
+	 */
+	if (!au_test_wkq(current)) {
+		int wkq_err;
+		struct do_xino_fwrite_args args = {
+			.errp	= &err,
+			.func	= func,
+			.file	= file,
+			.buf	= buf,
+			.size	= size,
+			.pos	= pos
+		};
+
+		wkq_err = au_wkq_wait(call_do_xino_fwrite, &args);
+		if (unlikely(wkq_err))
+			err = wkq_err;
+	} else
+		err = do_xino_fwrite(func, file, buf, size, pos);
+
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+/*
+ * create a new xinofile at the same place/path as @base_file.
+ */
+struct file *au_xino_create2(struct file *base_file, struct file *copy_src)
+{
+	struct file *file;
+	struct dentry *base, *dentry, *parent;
+	struct inode *dir;
+	struct qstr *name;
+	int err;
+
+	base = base_file->f_dentry;
+	parent = base->d_parent; /* dir inode is locked */
+	dir = parent->d_inode;
+	IMustLock(dir);
+
+	file = ERR_PTR(-EINVAL);
+	name = &base->d_name;
+	dentry = vfsub_lookup_one_len(name->name, parent, name->len);
+	if (IS_ERR(dentry)) {
+		file = (void *)dentry;
+		AuErr("%.*s lookup err %ld\n", AuLNPair(name), PTR_ERR(dentry));
+		goto out;
+	}
+
+	/* no need to mnt_want_write() since we call dentry_open() later */
+	err = vfs_create(dir, dentry, S_IRUGO | S_IWUGO, NULL);
+	if (unlikely(err)) {
+		file = ERR_PTR(err);
+		AuErr("%.*s create err %d\n", AuLNPair(name), err);
+		goto out_dput;
+	}
+
+	file = dentry_open(dget(dentry), mntget(base_file->f_vfsmnt),
+			   O_RDWR | O_CREAT | O_EXCL | O_LARGEFILE,
+			   current_cred());
+	if (IS_ERR(file)) {
+		AuErr("%.*s open err %ld\n", AuLNPair(name), PTR_ERR(file));
+		goto out_dput;
+	}
+
+	err = vfsub_unlink(dir, &file->f_path, /*force*/0);
+	if (unlikely(err)) {
+		AuErr("%.*s unlink err %d\n", AuLNPair(name), err);
+		goto out_fput;
+	}
+
+	if (copy_src) {
+		/* no one can touch copy_src xino */
+		err = au_copy_file(file, copy_src,
+				   i_size_read(copy_src->f_dentry->d_inode));
+		if (unlikely(err)) {
+			AuErr("%.*s copy err %d\n", AuLNPair(name), err);
+			goto out_fput;
+		}
+	}
+	goto out_dput; /* success */
+
+ out_fput:
+	fput(file);
+	file = ERR_PTR(err);
+ out_dput:
+	dput(dentry);
+ out:
+	return file;
+}
+
+struct au_xino_lock_dir {
+	struct au_hinode *hdir;
+	struct dentry *parent;
+	struct mutex *mtx;
+};
+
+static void au_xino_lock_dir(struct super_block *sb, struct file *xino,
+			     struct au_xino_lock_dir *ldir)
+{
+	aufs_bindex_t brid, bindex;
+
+	ldir->hdir = NULL;
+	bindex = -1;
+	brid = au_xino_brid(sb);
+	if (brid >= 0)
+		bindex = au_br_index(sb, brid);
+	if (bindex >= 0) {
+		ldir->hdir = au_hi(sb->s_root->d_inode, bindex);
+		au_hin_imtx_lock_nested(ldir->hdir, AuLsc_I_PARENT);
+	} else {
+		ldir->parent = dget_parent(xino->f_dentry);
+		ldir->mtx = &ldir->parent->d_inode->i_mutex;
+		mutex_lock_nested(ldir->mtx, AuLsc_I_PARENT);
+	}
+}
+
+static void au_xino_unlock_dir(struct au_xino_lock_dir *ldir)
+{
+	if (ldir->hdir)
+		au_hin_imtx_unlock(ldir->hdir);
+	else {
+		mutex_unlock(ldir->mtx);
+		dput(ldir->parent);
+	}
+}
+
+/* ---------------------------------------------------------------------- */
+
+/* trucate xino files asynchronously */
+
+int au_xino_trunc(struct super_block *sb, aufs_bindex_t bindex)
+{
+	int err;
+	aufs_bindex_t bi, bend;
+	struct au_branch *br;
+	struct file *new_xino, *file;
+	struct super_block *h_sb;
+	struct au_xino_lock_dir ldir;
+
+	err = -EINVAL;
+	bend = au_sbend(sb);
+	if (unlikely(bindex < 0 || bend < bindex))
+		goto out;
+	br = au_sbr(sb, bindex);
+	file = br->br_xino.xi_file;
+	if (!file)
+		goto out;
+
+	au_xino_lock_dir(sb, file, &ldir);
+	/* mnt_want_write() is unnecessary here */
+	new_xino = au_xino_create2(file, file);
+	au_xino_unlock_dir(&ldir);
+	err = PTR_ERR(new_xino);
+	if (IS_ERR(new_xino))
+		goto out;
+	err = 0;
+	fput(file);
+	br->br_xino.xi_file = new_xino;
+
+	h_sb = br->br_mnt->mnt_sb;
+	for (bi = 0; bi <= bend; bi++) {
+		if (unlikely(bi == bindex))
+			continue;
+		br = au_sbr(sb, bi);
+		if (br->br_mnt->mnt_sb != h_sb)
+			continue;
+
+		fput(br->br_xino.xi_file);
+		br->br_xino.xi_file = new_xino;
+		get_file(new_xino);
+	}
+
+ out:
+	return err;
+}
+
+struct xino_do_trunc_args {
+	struct super_block *sb;
+	struct au_branch *br;
+};
+
+static void xino_do_trunc(void *_args)
+{
+	struct xino_do_trunc_args *args = _args;
+	struct super_block *sb;
+	struct au_branch *br;
+	struct inode *dir;
+	int err;
+	aufs_bindex_t bindex;
+
+	err = 0;
+	sb = args->sb;
+	dir = sb->s_root->d_inode;
+	br = args->br;
+
+	si_noflush_write_lock(sb);
+	ii_read_lock_parent(dir);
+	bindex = au_br_index(sb, br->br_id);
+	err = au_xino_trunc(sb, bindex);
+	if (!err
+	    && br->br_xino.xi_file->f_dentry->d_inode->i_blocks
+	    >= br->br_xino_upper)
+		br->br_xino_upper += AUFS_XINO_TRUNC_STEP;
+
+	ii_read_unlock(dir);
+	if (unlikely(err))
+		AuWarn("err b%d, (%d)\n", bindex, err);
+	atomic_dec(&br->br_xino_running);
+	atomic_dec(&br->br_count);
+	au_nwt_done(&au_sbi(sb)->si_nowait);
+	si_write_unlock(sb);
+	kfree(args);
+}
+
+static void xino_try_trunc(struct super_block *sb, struct au_branch *br)
+{
+	struct xino_do_trunc_args *args;
+	int wkq_err;
+
+	if (br->br_xino.xi_file->f_dentry->d_inode->i_blocks
+	    < br->br_xino_upper)
+		return;
+
+	if (atomic_inc_return(&br->br_xino_running) > 1)
+		goto out;
+
+	/* lock and kfree() will be called in trunc_xino() */
+	args = kmalloc(sizeof(*args), GFP_NOFS);
+	if (unlikely(!args)) {
+		AuErr1("no memory\n");
+		goto out_args;
+	}
+
+	atomic_inc_return(&br->br_count);
+	args->sb = sb;
+	args->br = br;
+	wkq_err = au_wkq_nowait(xino_do_trunc, args, sb);
+	if (!wkq_err)
+		return; /* success */
+
+	AuErr("wkq %d\n", wkq_err);
+	atomic_dec_return(&br->br_count);
+
+ out_args:
+	kfree(args);
+ out:
+	atomic_dec_return(&br->br_xino_running);
+}
+
+/* ---------------------------------------------------------------------- */
+
+static int au_xino_do_write(au_writef_t write, struct file *file,
+			    ino_t h_ino, ino_t ino)
+{
+	loff_t pos;
+	ssize_t sz;
+
+	pos = h_ino;
+	if (unlikely(au_loff_max / sizeof(ino) - 1 < pos)) {
+		AuIOErr1("too large hi%lu\n", (unsigned long)h_ino);
+		return -EFBIG;
+	}
+	pos *= sizeof(ino);
+	sz = xino_fwrite(write, file, &ino, sizeof(ino), &pos);
+	if (sz == sizeof(ino))
+		return 0; /* success */
+
+	AuIOErr("write failed (%zd)\n", sz);
+	return -EIO;
+}
+
+/*
+ * write @ino to the xinofile for the specified branch{@sb, @bindex}
+ * at the position of @h_ino.
+ * even if @ino is zero, it is written to the xinofile and means no entry.
+ * if the size of the xino file on a specific filesystem exceeds the watermark,
+ * try truncating it.
+ */
+int au_xino_write(struct super_block *sb, aufs_bindex_t bindex, ino_t h_ino,
+		  ino_t ino)
+{
+	int err;
+	unsigned int mnt_flags;
+	struct au_branch *br;
+
+	BUILD_BUG_ON(sizeof(long long) != sizeof(au_loff_max)
+		     || ((loff_t)-1) > 0);
+	SiMustAnyLock(sb);
+
+	mnt_flags = au_mntflags(sb);
+	if (!au_opt_test(mnt_flags, XINO))
+		return 0;
+
+	br = au_sbr(sb, bindex);
+	err = au_xino_do_write(au_sbi(sb)->si_xwrite, br->br_xino.xi_file,
+			       h_ino, ino);
+	if (!err) {
+		if (au_opt_test(mnt_flags, TRUNC_XINO)
+		    && au_test_fs_trunc_xino(br->br_mnt->mnt_sb))
+			xino_try_trunc(sb, br);
+		return 0; /* success */
+	}
+
+	AuIOErr("write failed (%d)\n", err);
+	return -EIO;
+}
+
+/* ---------------------------------------------------------------------- */
+
+/* aufs inode number bitmap */
+
+static const int page_bits = (int)PAGE_SIZE * BITS_PER_BYTE;
+static ino_t xib_calc_ino(unsigned long pindex, int bit)
+{
+	ino_t ino;
+
+	AuDebugOn(bit < 0 || page_bits <= bit);
+	ino = AUFS_FIRST_INO + pindex * page_bits + bit;
+	return ino;
+}
+
+static void xib_calc_bit(ino_t ino, unsigned long *pindex, int *bit)
+{
+	AuDebugOn(ino < AUFS_FIRST_INO);
+	ino -= AUFS_FIRST_INO;
+	*pindex = ino / page_bits;
+	*bit = ino % page_bits;
+}
+
+static int xib_pindex(struct super_block *sb, unsigned long pindex)
+{
+	int err;
+	loff_t pos;
+	ssize_t sz;
+	struct au_sbinfo *sbinfo;
+	struct file *xib;
+	unsigned long *p;
+
+	sbinfo = au_sbi(sb);
+	MtxMustLock(&sbinfo->si_xib_mtx);
+	AuDebugOn(pindex > ULONG_MAX / PAGE_SIZE
+		  || !au_opt_test(sbinfo->si_mntflags, XINO));
+
+	if (pindex == sbinfo->si_xib_last_pindex)
+		return 0;
+
+	xib = sbinfo->si_xib;
+	p = sbinfo->si_xib_buf;
+	pos = sbinfo->si_xib_last_pindex;
+	pos *= PAGE_SIZE;
+	sz = xino_fwrite(sbinfo->si_xwrite, xib, p, PAGE_SIZE, &pos);
+	if (unlikely(sz != PAGE_SIZE))
+		goto out;
+
+	pos = pindex;
+	pos *= PAGE_SIZE;
+	if (i_size_read(xib->f_dentry->d_inode) >= pos + PAGE_SIZE)
+		sz = xino_fread(sbinfo->si_xread, xib, p, PAGE_SIZE, &pos);
+	else {
+		memset(p, 0, PAGE_SIZE);
+		sz = xino_fwrite(sbinfo->si_xwrite, xib, p, PAGE_SIZE, &pos);
+	}
+	if (sz == PAGE_SIZE) {
+		sbinfo->si_xib_last_pindex = pindex;
+		return 0; /* success */
+	}
+
+ out:
+	AuIOErr1("write failed (%zd)\n", sz);
+	err = sz;
+	if (sz >= 0)
+		err = -EIO;
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+int au_xino_write0(struct super_block *sb, aufs_bindex_t bindex, ino_t h_ino,
+		   ino_t ino)
+{
+	int err, bit;
+	unsigned long pindex;
+	struct au_sbinfo *sbinfo;
+
+	if (!au_opt_test(au_mntflags(sb), XINO))
+		return 0;
+
+	err = 0;
+	if (ino) {
+		sbinfo = au_sbi(sb);
+		xib_calc_bit(ino, &pindex, &bit);
+		AuDebugOn(page_bits <= bit);
+		mutex_lock(&sbinfo->si_xib_mtx);
+		err = xib_pindex(sb, pindex);
+		if (!err) {
+			clear_bit(bit, sbinfo->si_xib_buf);
+			sbinfo->si_xib_next_bit = bit;
+		}
+		mutex_unlock(&sbinfo->si_xib_mtx);
+	}
+
+	if (!err)
+		err = au_xino_write(sb, bindex, h_ino, 0);
+	return err;
+}
+
+/* get an unused inode number from bitmap */
+ino_t au_xino_new_ino(struct super_block *sb)
+{
+	ino_t ino;
+	unsigned long *p, pindex, ul, pend;
+	struct au_sbinfo *sbinfo;
+	struct file *file;
+	int free_bit, err;
+
+	if (!au_opt_test(au_mntflags(sb), XINO))
+		return iunique(sb, AUFS_FIRST_INO);
+
+	sbinfo = au_sbi(sb);
+	mutex_lock(&sbinfo->si_xib_mtx);
+	p = sbinfo->si_xib_buf;
+	free_bit = sbinfo->si_xib_next_bit;
+	if (free_bit < page_bits && !test_bit(free_bit, p))
+		goto out; /* success */
+	free_bit = find_first_zero_bit(p, page_bits);
+	if (free_bit < page_bits)
+		goto out; /* success */
+
+	pindex = sbinfo->si_xib_last_pindex;
+	for (ul = pindex - 1; ul < ULONG_MAX; ul--) {
+		err = xib_pindex(sb, ul);
+		if (unlikely(err))
+			goto out_err;
+		free_bit = find_first_zero_bit(p, page_bits);
+		if (free_bit < page_bits)
+			goto out; /* success */
+	}
+
+	file = sbinfo->si_xib;
+	pend = i_size_read(file->f_dentry->d_inode) / PAGE_SIZE;
+	for (ul = pindex + 1; ul <= pend; ul++) {
+		err = xib_pindex(sb, ul);
+		if (unlikely(err))
+			goto out_err;
+		free_bit = find_first_zero_bit(p, page_bits);
+		if (free_bit < page_bits)
+			goto out; /* success */
+	}
+	BUG();
+
+ out:
+	set_bit(free_bit, p);
+	sbinfo->si_xib_next_bit++;
+	pindex = sbinfo->si_xib_last_pindex;
+	mutex_unlock(&sbinfo->si_xib_mtx);
+	ino = xib_calc_ino(pindex, free_bit);
+	AuDbg("i%lu\n", (unsigned long)ino);
+	return ino;
+ out_err:
+	mutex_unlock(&sbinfo->si_xib_mtx);
+	AuDbg("i0\n");
+	return 0;
+}
+
+/*
+ * read @ino from xinofile for the specified branch{@sb, @bindex}
+ * at the position of @h_ino.
+ * if @ino does not exist and @do_new is true, get new one.
+ */
+int au_xino_read(struct super_block *sb, aufs_bindex_t bindex, ino_t h_ino,
+		 ino_t *ino)
+{
+	int err;
+	ssize_t sz;
+	loff_t pos;
+	struct file *file;
+	struct au_sbinfo *sbinfo;
+
+	*ino = 0;
+	if (!au_opt_test(au_mntflags(sb), XINO))
+		return 0; /* no xino */
+
+	err = 0;
+	sbinfo = au_sbi(sb);
+	pos = h_ino;
+	if (unlikely(au_loff_max / sizeof(*ino) - 1 < pos)) {
+		AuIOErr1("too large hi%lu\n", (unsigned long)h_ino);
+		return -EFBIG;
+	}
+	pos *= sizeof(*ino);
+
+	file = au_sbr(sb, bindex)->br_xino.xi_file;
+	if (i_size_read(file->f_dentry->d_inode) < pos + sizeof(*ino))
+		return 0; /* no ino */
+
+	sz = xino_fread(sbinfo->si_xread, file, ino, sizeof(*ino), &pos);
+	if (sz == sizeof(*ino))
+		return 0; /* success */
+
+	err = sz;
+	if (unlikely(sz >= 0)) {
+		err = -EIO;
+		AuIOErr("xino read error (%zd)\n", sz);
+	}
+
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+/* create and set a new xino file */
+
+struct file *au_xino_create(struct super_block *sb, char *fname, int silent)
+{
+	struct file *file;
+	struct dentry *h_parent, *d;
+	struct inode *h_dir;
+	int err;
+
+	/*
+	 * at mount-time, and the xino file is the default path,
+	 * hinotify is disabled so we have no inotify events to ignore.
+	 * when a user specified the xino, we cannot get au_hdir to be ignored.
+	 */
+	file = vfsub_filp_open(fname, O_RDWR | O_CREAT | O_EXCL | O_LARGEFILE,
+			       S_IRUGO | S_IWUGO);
+	if (IS_ERR(file)) {
+		if (!silent)
+			AuErr("open %s(%ld)\n", fname, PTR_ERR(file));
+		return file;
+	}
+
+	/* keep file count */
+	h_parent = dget_parent(file->f_dentry);
+	h_dir = h_parent->d_inode;
+	mutex_lock_nested(&h_dir->i_mutex, AuLsc_I_PARENT);
+	/* mnt_want_write() is unnecessary here */
+	err = vfsub_unlink(h_dir, &file->f_path, /*force*/0);
+	mutex_unlock(&h_dir->i_mutex);
+	dput(h_parent);
+	if (unlikely(err)) {
+		if (!silent)
+			AuErr("unlink %s(%d)\n", fname, err);
+		goto out;
+	}
+
+	err = -EINVAL;
+	d = file->f_dentry;
+	if (unlikely(sb == d->d_sb)) {
+		if (!silent)
+			AuErr("%s must be outside\n", fname);
+		goto out;
+	}
+	if (unlikely(au_test_fs_bad_xino(d->d_sb))) {
+		if (!silent)
+			AuErr("xino doesn't support %s(%s)\n",
+			      fname, au_sbtype(d->d_sb));
+		goto out;
+	}
+	return file; /* success */
+
+ out:
+	fput(file);
+	file = ERR_PTR(err);
+	return file;
+}
+
+/*
+ * find another branch who is on the same filesystem of the specified
+ * branch{@btgt}. search until @bend.
+ */
+static int is_sb_shared(struct super_block *sb, aufs_bindex_t btgt,
+			aufs_bindex_t bend)
+{
+	aufs_bindex_t bindex;
+	struct super_block *tgt_sb = au_sbr_sb(sb, btgt);
+
+	for (bindex = 0; bindex < btgt; bindex++)
+		if (unlikely(tgt_sb == au_sbr_sb(sb, bindex)))
+			return bindex;
+	for (bindex++; bindex <= bend; bindex++)
+		if (unlikely(tgt_sb == au_sbr_sb(sb, bindex)))
+			return bindex;
+	return -1;
+}
+
+/* ---------------------------------------------------------------------- */
+
+/*
+ * initialize the xinofile for the specified branch @br
+ * at the place/path where @base_file indicates.
+ * test whether another branch is on the same filesystem or not,
+ * if @do_test is true.
+ */
+int au_xino_br(struct super_block *sb, struct au_branch *br, ino_t h_ino,
+	       struct file *base_file, int do_test)
+{
+	int err;
+	ino_t ino;
+	aufs_bindex_t bend, bindex;
+	struct au_branch *shared_br, *b;
+	struct file *file;
+	struct super_block *tgt_sb;
+
+	shared_br = NULL;
+	bend = au_sbend(sb);
+	if (do_test) {
+		tgt_sb = br->br_mnt->mnt_sb;
+		for (bindex = 0; bindex <= bend; bindex++) {
+			b = au_sbr(sb, bindex);
+			if (tgt_sb == b->br_mnt->mnt_sb) {
+				shared_br = b;
+				break;
+			}
+		}
+	}
+
+	if (!shared_br || !shared_br->br_xino.xi_file) {
+		struct au_xino_lock_dir ldir;
+
+		au_xino_lock_dir(sb, base_file, &ldir);
+		/* mnt_want_write() is unnecessary here */
+		file = au_xino_create2(base_file, NULL);
+		au_xino_unlock_dir(&ldir);
+		err = PTR_ERR(file);
+		if (IS_ERR(file))
+			goto out;
+		br->br_xino.xi_file = file;
+	} else {
+		br->br_xino.xi_file = shared_br->br_xino.xi_file;
+		get_file(br->br_xino.xi_file);
+	}
+
+	ino = AUFS_ROOT_INO;
+	err = au_xino_do_write(au_sbi(sb)->si_xwrite, br->br_xino.xi_file,
+			       h_ino, ino);
+	if (!err)
+		return 0; /* success */
+
+
+ out:
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+/* trucate a xino bitmap file */
+
+/* todo: slow */
+static int do_xib_restore(struct super_block *sb, struct file *file, void *page)
+{
+	int err, bit;
+	ssize_t sz;
+	unsigned long pindex;
+	loff_t pos, pend;
+	struct au_sbinfo *sbinfo;
+	au_readf_t func;
+	ino_t *ino;
+	unsigned long *p;
+
+	err = 0;
+	sbinfo = au_sbi(sb);
+	MtxMustLock(&sbinfo->si_xib_mtx);
+	p = sbinfo->si_xib_buf;
+	func = sbinfo->si_xread;
+	pend = i_size_read(file->f_dentry->d_inode);
+	pos = 0;
+	while (pos < pend) {
+		sz = xino_fread(func, file, page, PAGE_SIZE, &pos);
+		err = sz;
+		if (unlikely(sz <= 0))
+			goto out;
+
+		err = 0;
+		for (ino = page; sz > 0; ino++, sz -= sizeof(ino)) {
+			if (unlikely(*ino < AUFS_FIRST_INO))
+				continue;
+
+			xib_calc_bit(*ino, &pindex, &bit);
+			AuDebugOn(page_bits <= bit);
+			err = xib_pindex(sb, pindex);
+			if (!err)
+				set_bit(bit, p);
+			else
+				goto out;
+		}
+	}
+
+ out:
+	return err;
+}
+
+static int xib_restore(struct super_block *sb)
+{
+	int err;
+	aufs_bindex_t bindex, bend;
+	void *page;
+
+	err = -ENOMEM;
+	page = (void *)__get_free_page(GFP_NOFS);
+	if (unlikely(!page))
+		goto out;
+
+	err = 0;
+	bend = au_sbend(sb);
+	for (bindex = 0; !err && bindex <= bend; bindex++)
+		if (!bindex || is_sb_shared(sb, bindex, bindex - 1) < 0)
+			err = do_xib_restore
+				(sb, au_sbr(sb, bindex)->br_xino.xi_file, page);
+		else
+			AuDbg("b%d\n", bindex);
+	free_page((unsigned long)page);
+
+ out:
+	return err;
+}
+
+int au_xib_trunc(struct super_block *sb)
+{
+	int err;
+	ssize_t sz;
+	loff_t pos;
+	struct au_xino_lock_dir ldir;
+	struct au_sbinfo *sbinfo;
+	unsigned long *p;
+	struct file *file;
+
+	SiMustWriteLock(sb);
+
+	err = 0;
+	sbinfo = au_sbi(sb);
+	if (!au_opt_test(sbinfo->si_mntflags, XINO))
+		goto out;
+
+	file = sbinfo->si_xib;
+	if (i_size_read(file->f_dentry->d_inode) <= PAGE_SIZE)
+		goto out;
+
+	au_xino_lock_dir(sb, file, &ldir);
+	/* mnt_want_write() is unnecessary here */
+	file = au_xino_create2(sbinfo->si_xib, NULL);
+	au_xino_unlock_dir(&ldir);
+	err = PTR_ERR(file);
+	if (IS_ERR(file))
+		goto out;
+	fput(sbinfo->si_xib);
+	sbinfo->si_xib = file;
+
+	p = sbinfo->si_xib_buf;
+	memset(p, 0, PAGE_SIZE);
+	pos = 0;
+	sz = xino_fwrite(sbinfo->si_xwrite, sbinfo->si_xib, p, PAGE_SIZE, &pos);
+	if (unlikely(sz != PAGE_SIZE)) {
+		err = sz;
+		AuIOErr("err %d\n", err);
+		if (sz >= 0)
+			err = -EIO;
+		goto out;
+	}
+
+	mutex_lock(&sbinfo->si_xib_mtx);
+	/* mnt_want_write() is unnecessary here */
+	err = xib_restore(sb);
+	mutex_unlock(&sbinfo->si_xib_mtx);
+
+out:
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+/*
+ * xino mount option handlers
+ */
+static au_readf_t find_readf(struct file *h_file)
+{
+	const struct file_operations *fop = h_file->f_op;
+
+	if (fop) {
+		if (fop->read)
+			return fop->read;
+		if (fop->aio_read)
+			return do_sync_read;
+	}
+	return ERR_PTR(-ENOSYS);
+}
+
+static au_writef_t find_writef(struct file *h_file)
+{
+	const struct file_operations *fop = h_file->f_op;
+
+	if (fop) {
+		if (fop->write)
+			return fop->write;
+		if (fop->aio_write)
+			return do_sync_write;
+	}
+	return ERR_PTR(-ENOSYS);
+}
+
+/* xino bitmap */
+static void xino_clear_xib(struct super_block *sb)
+{
+	struct au_sbinfo *sbinfo;
+
+	SiMustWriteLock(sb);
+
+	sbinfo = au_sbi(sb);
+	sbinfo->si_xread = NULL;
+	sbinfo->si_xwrite = NULL;
+	if (sbinfo->si_xib)
+		fput(sbinfo->si_xib);
+	sbinfo->si_xib = NULL;
+	free_page((unsigned long)sbinfo->si_xib_buf);
+	sbinfo->si_xib_buf = NULL;
+}
+
+static int au_xino_set_xib(struct super_block *sb, struct file *base)
+{
+	int err;
+	loff_t pos;
+	struct au_sbinfo *sbinfo;
+	struct file *file;
+
+	SiMustWriteLock(sb);
+
+	sbinfo = au_sbi(sb);
+	file = au_xino_create2(base, sbinfo->si_xib);
+	err = PTR_ERR(file);
+	if (IS_ERR(file))
+		goto out;
+	if (sbinfo->si_xib)
+		fput(sbinfo->si_xib);
+	sbinfo->si_xib = file;
+	sbinfo->si_xread = find_readf(file);
+	sbinfo->si_xwrite = find_writef(file);
+
+	err = -ENOMEM;
+	if (!sbinfo->si_xib_buf)
+		sbinfo->si_xib_buf = (void *)get_zeroed_page(GFP_NOFS);
+	if (unlikely(!sbinfo->si_xib_buf))
+		goto out_unset;
+
+	sbinfo->si_xib_last_pindex = 0;
+	sbinfo->si_xib_next_bit = 0;
+	if (i_size_read(file->f_dentry->d_inode) < PAGE_SIZE) {
+		pos = 0;
+		err = xino_fwrite(sbinfo->si_xwrite, file, sbinfo->si_xib_buf,
+				  PAGE_SIZE, &pos);
+		if (unlikely(err != PAGE_SIZE))
+			goto out_free;
+	}
+	err = 0;
+	goto out; /* success */
+
+ out_free:
+	free_page((unsigned long)sbinfo->si_xib_buf);
+	sbinfo->si_xib_buf = NULL;
+	if (err >= 0)
+		err = -EIO;
+ out_unset:
+	fput(sbinfo->si_xib);
+	sbinfo->si_xib = NULL;
+	sbinfo->si_xread = NULL;
+	sbinfo->si_xwrite = NULL;
+ out:
+	return err;
+}
+
+/* xino for each branch */
+static void xino_clear_br(struct super_block *sb)
+{
+	aufs_bindex_t bindex, bend;
+	struct au_branch *br;
+
+	bend = au_sbend(sb);
+	for (bindex = 0; bindex <= bend; bindex++) {
+		br = au_sbr(sb, bindex);
+		if (!br || !br->br_xino.xi_file)
+			continue;
+
+		fput(br->br_xino.xi_file);
+		br->br_xino.xi_file = NULL;
+	}
+}
+
+static int au_xino_set_br(struct super_block *sb, struct file *base)
+{
+	int err;
+	ino_t ino;
+	aufs_bindex_t bindex, bend, bshared;
+	struct {
+		struct file *old, *new;
+	} *fpair, *p;
+	struct au_branch *br;
+	struct inode *inode;
+	au_writef_t writef;
+
+	SiMustWriteLock(sb);
+
+	err = -ENOMEM;
+	bend = au_sbend(sb);
+	fpair = kcalloc(bend + 1, sizeof(*fpair), GFP_NOFS);
+	if (unlikely(!fpair))
+		goto out;
+
+	inode = sb->s_root->d_inode;
+	ino = AUFS_ROOT_INO;
+	writef = au_sbi(sb)->si_xwrite;
+	for (bindex = 0, p = fpair; bindex <= bend; bindex++, p++) {
+		br = au_sbr(sb, bindex);
+		bshared = is_sb_shared(sb, bindex, bindex - 1);
+		if (bshared >= 0) {
+			/* shared xino */
+			*p = fpair[bshared];
+			get_file(p->new);
+		}
+
+		if (!p->new) {
+			/* new xino */
+			p->old = br->br_xino.xi_file;
+			p->new = au_xino_create2(base, br->br_xino.xi_file);
+			err = PTR_ERR(p->new);
+			if (IS_ERR(p->new)) {
+				p->new = NULL;
+				goto out_pair;
+			}
+		}
+
+		err = au_xino_do_write(writef, p->new,
+				       au_h_iptr(inode, bindex)->i_ino, ino);
+		if (unlikely(err))
+			goto out_pair;
+	}
+
+	for (bindex = 0, p = fpair; bindex <= bend; bindex++, p++) {
+		br = au_sbr(sb, bindex);
+		if (br->br_xino.xi_file)
+			fput(br->br_xino.xi_file);
+		get_file(p->new);
+		br->br_xino.xi_file = p->new;
+	}
+
+ out_pair:
+	for (bindex = 0, p = fpair; bindex <= bend; bindex++, p++)
+		if (p->new)
+			fput(p->new);
+		else
+			break;
+	kfree(fpair);
+ out:
+	return err;
+}
+
+void au_xino_clr(struct super_block *sb)
+{
+	struct au_sbinfo *sbinfo;
+
+	au_xigen_clr(sb);
+	xino_clear_xib(sb);
+	xino_clear_br(sb);
+	sbinfo = au_sbi(sb);
+	/* lvalue, do not call au_mntflags() */
+	au_opt_clr(sbinfo->si_mntflags, XINO);
+}
+
+int au_xino_set(struct super_block *sb, struct au_opt_xino *xino, int remount)
+{
+	int err, skip;
+	struct dentry *parent, *cur_parent;
+	struct qstr *dname, *cur_name;
+	struct file *cur_xino;
+	struct inode *dir;
+	struct au_sbinfo *sbinfo;
+
+	SiMustWriteLock(sb);
+
+	err = 0;
+	sbinfo = au_sbi(sb);
+	parent = dget_parent(xino->file->f_dentry);
+	if (remount) {
+		skip = 0;
+		dname = &xino->file->f_dentry->d_name;
+		cur_xino = sbinfo->si_xib;
+		if (cur_xino) {
+			cur_parent = dget_parent(cur_xino->f_dentry);
+			cur_name = &cur_xino->f_dentry->d_name;
+			skip = (cur_parent == parent
+				&& dname->len == cur_name->len
+				&& !memcmp(dname->name, cur_name->name,
+					   dname->len));
+			dput(cur_parent);
+		}
+		if (skip)
+			goto out;
+	}
+
+	au_opt_set(sbinfo->si_mntflags, XINO);
+	dir = parent->d_inode;
+	mutex_lock_nested(&dir->i_mutex, AuLsc_I_PARENT);
+	/* mnt_want_write() is unnecessary here */
+	err = au_xino_set_xib(sb, xino->file);
+	if (!err)
+		err = au_xigen_set(sb, xino->file);
+	if (!err)
+		err = au_xino_set_br(sb, xino->file);
+	mutex_unlock(&dir->i_mutex);
+	if (!err)
+		goto out; /* success */
+
+	/* reset all */
+	AuIOErr("failed creating xino(%d).\n", err);
+
+ out:
+	dput(parent);
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+/*
+ * create a xinofile at the default place/path.
+ */
+struct file *au_xino_def(struct super_block *sb)
+{
+	struct file *file;
+	char *page, *p;
+	struct au_branch *br;
+	struct super_block *h_sb;
+	struct path path;
+	aufs_bindex_t bend, bindex, bwr;
+
+	br = NULL;
+	bend = au_sbend(sb);
+	bwr = -1;
+	for (bindex = 0; bindex <= bend; bindex++) {
+		br = au_sbr(sb, bindex);
+		if (au_br_writable(br->br_perm)
+		    && !au_test_fs_bad_xino(br->br_mnt->mnt_sb)) {
+			bwr = bindex;
+			break;
+		}
+	}
+
+	if (bwr >= 0) {
+		file = ERR_PTR(-ENOMEM);
+		page = __getname();
+		if (unlikely(!page))
+			goto out;
+		path.mnt = br->br_mnt;
+		path.dentry = au_h_dptr(sb->s_root, bwr);
+		p = d_path(&path, page, PATH_MAX - sizeof(AUFS_XINO_FNAME));
+		file = (void *)p;
+		if (!IS_ERR(p)) {
+			strcat(p, "/" AUFS_XINO_FNAME);
+			AuDbg("%s\n", p);
+			file = au_xino_create(sb, p, /*silent*/0);
+			if (!IS_ERR(file))
+				au_xino_brid_set(sb, br->br_id);
+		}
+		__putname(page);
+	} else {
+		file = au_xino_create(sb, AUFS_XINO_DEFPATH, /*silent*/0);
+		if (IS_ERR(file))
+			goto out;
+		h_sb = file->f_dentry->d_sb;
+		if (unlikely(au_test_fs_bad_xino(h_sb))) {
+			AuErr("xino doesn't support %s(%s)\n",
+			      AUFS_XINO_DEFPATH, au_sbtype(h_sb));
+			fput(file);
+			file = ERR_PTR(-EINVAL);
+		}
+		if (!IS_ERR(file))
+			au_xino_brid_set(sb, -1);
+	}
+
+ out:
+	return file;
+}
+
+/* ---------------------------------------------------------------------- */
+
+int au_xino_path(struct seq_file *seq, struct file *file)
+{
+	int err;
+
+	err = au_seq_path(seq, &file->f_path);
+	if (unlikely(err < 0))
+		goto out;
+
+	err = 0;
+#define Deleted "\\040(deleted)"
+	seq->count -= sizeof(Deleted) - 1;
+	AuDebugOn(memcmp(seq->buf + seq->count, Deleted,
+			 sizeof(Deleted) - 1));
+#undef Deleted
+
+ out:
+	return err;
+}
--- linux-rt-2.6.31.orig/ubuntu/aufs/wbr_policy.c
+++ linux-rt-2.6.31/ubuntu/aufs/wbr_policy.c
@@ -0,0 +1,641 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * policies for selecting one among multiple writable branches
+ */
+
+#include <linux/statfs.h>
+#include "aufs.h"
+
+/* subset of cpup_attr() */
+static noinline_for_stack
+int au_cpdown_attr(struct path *h_path, struct dentry *h_src)
+{
+	int err, sbits;
+	struct iattr ia;
+	struct inode *h_isrc;
+
+	h_isrc = h_src->d_inode;
+	ia.ia_valid = ATTR_FORCE | ATTR_MODE | ATTR_UID | ATTR_GID;
+	ia.ia_mode = h_isrc->i_mode;
+	ia.ia_uid = h_isrc->i_uid;
+	ia.ia_gid = h_isrc->i_gid;
+	sbits = !!(ia.ia_mode & (S_ISUID | S_ISGID));
+	au_cpup_attr_flags(h_path->dentry->d_inode, h_isrc);
+	err = vfsub_sio_notify_change(h_path, &ia);
+
+	/* is this nfs only? */
+	if (!err && sbits && au_test_nfs(h_path->dentry->d_sb)) {
+		ia.ia_valid = ATTR_FORCE | ATTR_MODE;
+		ia.ia_mode = h_isrc->i_mode;
+		err = vfsub_sio_notify_change(h_path, &ia);
+	}
+
+	return err;
+}
+
+#define AuCpdown_PARENT_OPQ	1
+#define AuCpdown_WHED		(1 << 1)
+#define AuCpdown_MADE_DIR	(1 << 2)
+#define AuCpdown_DIROPQ		(1 << 3)
+#define au_ftest_cpdown(flags, name)	((flags) & AuCpdown_##name)
+#define au_fset_cpdown(flags, name)	{ (flags) |= AuCpdown_##name; }
+#define au_fclr_cpdown(flags, name)	{ (flags) &= ~AuCpdown_##name; }
+
+struct au_cpdown_dir_args {
+	struct dentry *parent;
+	unsigned int flags;
+};
+
+static int au_cpdown_dir_opq(struct dentry *dentry, aufs_bindex_t bdst,
+			     struct au_cpdown_dir_args *a)
+{
+	int err;
+	struct dentry *opq_dentry;
+
+	opq_dentry = au_diropq_create(dentry, bdst);
+	err = PTR_ERR(opq_dentry);
+	if (IS_ERR(opq_dentry))
+		goto out;
+	dput(opq_dentry);
+	au_fset_cpdown(a->flags, DIROPQ);
+
+ out:
+	return err;
+}
+
+static int au_cpdown_dir_wh(struct dentry *dentry, struct dentry *h_parent,
+			    struct inode *dir, aufs_bindex_t bdst)
+{
+	int err;
+	struct path h_path;
+	struct au_branch *br;
+
+	br = au_sbr(dentry->d_sb, bdst);
+	h_path.dentry = au_wh_lkup(h_parent, &dentry->d_name, br);
+	err = PTR_ERR(h_path.dentry);
+	if (IS_ERR(h_path.dentry))
+		goto out;
+
+	err = 0;
+	if (h_path.dentry->d_inode) {
+		h_path.mnt = br->br_mnt;
+		err = au_wh_unlink_dentry(au_h_iptr(dir, bdst), &h_path,
+					  dentry);
+	}
+	dput(h_path.dentry);
+
+ out:
+	return err;
+}
+
+static int au_cpdown_dir(struct dentry *dentry, aufs_bindex_t bdst,
+			 struct dentry *h_parent, void *arg)
+{
+	int err, rerr;
+	aufs_bindex_t bend, bopq, bstart;
+	unsigned char parent_opq;
+	struct path h_path;
+	struct dentry *parent;
+	struct inode *h_dir, *h_inode, *inode, *dir;
+	struct au_cpdown_dir_args *args = arg;
+
+	bstart = au_dbstart(dentry);
+	/* dentry is di-locked */
+	parent = dget_parent(dentry);
+	dir = parent->d_inode;
+	h_dir = h_parent->d_inode;
+	AuDebugOn(h_dir != au_h_iptr(dir, bdst));
+	IMustLock(h_dir);
+
+	err = au_lkup_neg(dentry, bdst);
+	if (unlikely(err < 0))
+		goto out;
+	h_path.dentry = au_h_dptr(dentry, bdst);
+	h_path.mnt = au_sbr_mnt(dentry->d_sb, bdst);
+	err = vfsub_sio_mkdir(au_h_iptr(dir, bdst), &h_path,
+			      S_IRWXU | S_IRUGO | S_IXUGO);
+	if (unlikely(err))
+		goto out_put;
+	au_fset_cpdown(args->flags, MADE_DIR);
+
+	bend = au_dbend(dentry);
+	bopq = au_dbdiropq(dentry);
+	au_fclr_cpdown(args->flags, WHED);
+	au_fclr_cpdown(args->flags, DIROPQ);
+	if (au_dbwh(dentry) == bdst)
+		au_fset_cpdown(args->flags, WHED);
+	if (!au_ftest_cpdown(args->flags, PARENT_OPQ) && bopq <= bdst)
+		au_fset_cpdown(args->flags, PARENT_OPQ);
+	parent_opq = (au_ftest_cpdown(args->flags, PARENT_OPQ)
+		      && args->parent == dentry);
+	h_inode = h_path.dentry->d_inode;
+	mutex_lock_nested(&h_inode->i_mutex, AuLsc_I_CHILD);
+	if (au_ftest_cpdown(args->flags, WHED)) {
+		err = au_cpdown_dir_opq(dentry, bdst, args);
+		if (unlikely(err)) {
+			mutex_unlock(&h_inode->i_mutex);
+			goto out_dir;
+		}
+	}
+
+	err = au_cpdown_attr(&h_path, au_h_dptr(dentry, bstart));
+	mutex_unlock(&h_inode->i_mutex);
+	if (unlikely(err))
+		goto out_opq;
+
+	if (au_ftest_cpdown(args->flags, WHED)) {
+		err = au_cpdown_dir_wh(dentry, h_parent, dir, bdst);
+		if (unlikely(err))
+			goto out_opq;
+	}
+
+	inode = dentry->d_inode;
+	if (au_ibend(inode) < bdst)
+		au_set_ibend(inode, bdst);
+	au_set_h_iptr(inode, bdst, au_igrab(h_inode),
+		      au_hi_flags(inode, /*isdir*/1));
+	goto out; /* success */
+
+	/* revert */
+ out_opq:
+	if (au_ftest_cpdown(args->flags, DIROPQ)) {
+		mutex_lock_nested(&h_inode->i_mutex, AuLsc_I_CHILD);
+		rerr = au_diropq_remove(dentry, bdst);
+		mutex_unlock(&h_inode->i_mutex);
+		if (unlikely(rerr)) {
+			AuIOErr("failed removing diropq for %.*s b%d (%d)\n",
+				AuDLNPair(dentry), bdst, rerr);
+			err = -EIO;
+			goto out;
+		}
+	}
+ out_dir:
+	if (au_ftest_cpdown(args->flags, MADE_DIR)) {
+		rerr = vfsub_sio_rmdir(au_h_iptr(dir, bdst), &h_path);
+		if (unlikely(rerr)) {
+			AuIOErr("failed removing %.*s b%d (%d)\n",
+				AuDLNPair(dentry), bdst, rerr);
+			err = -EIO;
+		}
+	}
+ out_put:
+	au_set_h_dptr(dentry, bdst, NULL);
+	if (au_dbend(dentry) == bdst)
+		au_update_dbend(dentry);
+ out:
+	dput(parent);
+	return err;
+}
+
+int au_cpdown_dirs(struct dentry *dentry, aufs_bindex_t bdst)
+{
+	int err;
+	struct au_cpdown_dir_args args = {
+		.parent	= dget_parent(dentry),
+		.flags	= 0
+	};
+
+	err = au_cp_dirs(dentry, bdst, au_cpdown_dir, &args);
+	dput(args.parent);
+
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+/* policies for create */
+
+static int au_wbr_bu(struct super_block *sb, aufs_bindex_t bindex)
+{
+	for (; bindex >= 0; bindex--)
+		if (!au_br_rdonly(au_sbr(sb, bindex)))
+			return bindex;
+	return -EROFS;
+}
+
+/* top down parent */
+static int au_wbr_create_tdp(struct dentry *dentry, int isdir __maybe_unused)
+{
+	int err;
+	aufs_bindex_t bstart, bindex;
+	struct super_block *sb;
+	struct dentry *parent, *h_parent;
+
+	sb = dentry->d_sb;
+	bstart = au_dbstart(dentry);
+	err = bstart;
+	if (!au_br_rdonly(au_sbr(sb, bstart)))
+		goto out;
+
+	err = -EROFS;
+	parent = dget_parent(dentry);
+	for (bindex = au_dbstart(parent); bindex < bstart; bindex++) {
+		h_parent = au_h_dptr(parent, bindex);
+		if (!h_parent || !h_parent->d_inode)
+			continue;
+
+		if (!au_br_rdonly(au_sbr(sb, bindex))) {
+			err = bindex;
+			break;
+		}
+	}
+	dput(parent);
+
+	/* bottom up here */
+	if (unlikely(err < 0))
+		err = au_wbr_bu(sb, bstart - 1);
+
+ out:
+	AuDbg("b%d\n", err);
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+/* an exception for the policy other than tdp */
+static int au_wbr_create_exp(struct dentry *dentry)
+{
+	int err;
+	aufs_bindex_t bwh, bdiropq;
+	struct dentry *parent;
+
+	err = -1;
+	bwh = au_dbwh(dentry);
+	parent = dget_parent(dentry);
+	bdiropq = au_dbdiropq(parent);
+	if (bwh >= 0) {
+		if (bdiropq >= 0)
+			err = min(bdiropq, bwh);
+		else
+			err = bwh;
+		AuDbg("%d\n", err);
+	} else if (bdiropq >= 0) {
+		err = bdiropq;
+		AuDbg("%d\n", err);
+	}
+	dput(parent);
+
+	if (err >= 0 && au_br_rdonly(au_sbr(dentry->d_sb, err)))
+		err = -1;
+
+	AuDbg("%d\n", err);
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+/* round robin */
+static int au_wbr_create_init_rr(struct super_block *sb)
+{
+	int err;
+
+	err = au_wbr_bu(sb, au_sbend(sb));
+	atomic_set(&au_sbi(sb)->si_wbr_rr_next, -err); /* less important */
+	/* smp_mb(); */
+
+	AuDbg("b%d\n", err);
+	return err;
+}
+
+static int au_wbr_create_rr(struct dentry *dentry, int isdir)
+{
+	int err, nbr;
+	unsigned int u;
+	aufs_bindex_t bindex, bend;
+	struct super_block *sb;
+	atomic_t *next;
+
+	err = au_wbr_create_exp(dentry);
+	if (err >= 0)
+		goto out;
+
+	sb = dentry->d_sb;
+	next = &au_sbi(sb)->si_wbr_rr_next;
+	bend = au_sbend(sb);
+	nbr = bend + 1;
+	for (bindex = 0; bindex <= bend; bindex++) {
+		if (!isdir) {
+			err = atomic_dec_return(next) + 1;
+			/* modulo for 0 is meaningless */
+			if (unlikely(!err))
+				err = atomic_dec_return(next) + 1;
+		} else
+			err = atomic_read(next);
+		AuDbg("%d\n", err);
+		u = err;
+		err = u % nbr;
+		AuDbg("%d\n", err);
+		if (!au_br_rdonly(au_sbr(sb, err)))
+			break;
+		err = -EROFS;
+	}
+
+ out:
+	AuDbg("%d\n", err);
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+/* most free space */
+static void au_mfs(struct dentry *dentry)
+{
+	struct super_block *sb;
+	struct au_branch *br;
+	struct au_wbr_mfs *mfs;
+	aufs_bindex_t bindex, bend;
+	int err;
+	unsigned long long b, bavail;
+	/* reduce the stack usage */
+	struct kstatfs *st;
+
+	st = kmalloc(sizeof(*st), GFP_NOFS);
+	if (unlikely(!st)) {
+		AuWarn1("failed updating mfs(%d), ignored\n", -ENOMEM);
+		return;
+	}
+
+	bavail = 0;
+	sb = dentry->d_sb;
+	mfs = &au_sbi(sb)->si_wbr_mfs;
+	MtxMustLock(&mfs->mfs_lock);
+	mfs->mfs_bindex = -EROFS;
+	mfs->mfsrr_bytes = 0;
+	bend = au_sbend(sb);
+	for (bindex = 0; bindex <= bend; bindex++) {
+		br = au_sbr(sb, bindex);
+		if (au_br_rdonly(br))
+			continue;
+
+		/* sb->s_root for NFS is unreliable */
+		err = vfs_statfs(br->br_mnt->mnt_root, st);
+		if (unlikely(err)) {
+			AuWarn1("failed statfs, b%d, %d\n", bindex, err);
+			continue;
+		}
+
+		/* when the available size is equal, select the lower one */
+		BUILD_BUG_ON(sizeof(b) < sizeof(st->f_bavail)
+			     || sizeof(b) < sizeof(st->f_bsize));
+		b = st->f_bavail * st->f_bsize;
+		br->br_wbr->wbr_bytes = b;
+		if (b >= bavail) {
+			bavail = b;
+			mfs->mfs_bindex = bindex;
+			mfs->mfs_jiffy = jiffies;
+		}
+	}
+
+	mfs->mfsrr_bytes = bavail;
+	AuDbg("b%d\n", mfs->mfs_bindex);
+	kfree(st);
+}
+
+static int au_wbr_create_mfs(struct dentry *dentry, int isdir __maybe_unused)
+{
+	int err;
+	struct super_block *sb;
+	struct au_wbr_mfs *mfs;
+
+	err = au_wbr_create_exp(dentry);
+	if (err >= 0)
+		goto out;
+
+	sb = dentry->d_sb;
+	mfs = &au_sbi(sb)->si_wbr_mfs;
+	mutex_lock(&mfs->mfs_lock);
+	if (time_after(jiffies, mfs->mfs_jiffy + mfs->mfs_expire)
+	    || mfs->mfs_bindex < 0
+	    || au_br_rdonly(au_sbr(sb, mfs->mfs_bindex)))
+		au_mfs(dentry);
+	mutex_unlock(&mfs->mfs_lock);
+	err = mfs->mfs_bindex;
+
+ out:
+	AuDbg("b%d\n", err);
+	return err;
+}
+
+static int au_wbr_create_init_mfs(struct super_block *sb)
+{
+	struct au_wbr_mfs *mfs;
+
+	mfs = &au_sbi(sb)->si_wbr_mfs;
+	mutex_init(&mfs->mfs_lock);
+	mfs->mfs_jiffy = 0;
+	mfs->mfs_bindex = -EROFS;
+
+	return 0;
+}
+
+static int au_wbr_create_fin_mfs(struct super_block *sb __maybe_unused)
+{
+	mutex_destroy(&au_sbi(sb)->si_wbr_mfs.mfs_lock);
+	return 0;
+}
+
+/* ---------------------------------------------------------------------- */
+
+/* most free space and then round robin */
+static int au_wbr_create_mfsrr(struct dentry *dentry, int isdir)
+{
+	int err;
+	struct au_wbr_mfs *mfs;
+
+	err = au_wbr_create_mfs(dentry, isdir);
+	if (err >= 0) {
+		mfs = &au_sbi(dentry->d_sb)->si_wbr_mfs;
+		mutex_lock(&mfs->mfs_lock);
+		if (mfs->mfsrr_bytes < mfs->mfsrr_watermark)
+			err = au_wbr_create_rr(dentry, isdir);
+		mutex_unlock(&mfs->mfs_lock);
+	}
+
+	AuDbg("b%d\n", err);
+	return err;
+}
+
+static int au_wbr_create_init_mfsrr(struct super_block *sb)
+{
+	int err;
+
+	au_wbr_create_init_mfs(sb); /* ignore */
+	err = au_wbr_create_init_rr(sb);
+
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+/* top down parent and most free space */
+static int au_wbr_create_pmfs(struct dentry *dentry, int isdir)
+{
+	int err, e2;
+	unsigned long long b;
+	aufs_bindex_t bindex, bstart, bend;
+	struct super_block *sb;
+	struct dentry *parent, *h_parent;
+	struct au_branch *br;
+
+	err = au_wbr_create_tdp(dentry, isdir);
+	if (unlikely(err < 0))
+		goto out;
+	parent = dget_parent(dentry);
+	bstart = au_dbstart(parent);
+	bend = au_dbtaildir(parent);
+	if (bstart == bend)
+		goto out_parent; /* success */
+
+	e2 = au_wbr_create_mfs(dentry, isdir);
+	if (e2 < 0)
+		goto out_parent; /* success */
+
+	/* when the available size is equal, select upper one */
+	sb = dentry->d_sb;
+	br = au_sbr(sb, err);
+	b = br->br_wbr->wbr_bytes;
+	AuDbg("b%d, %llu\n", err, b);
+
+	for (bindex = bstart; bindex <= bend; bindex++) {
+		h_parent = au_h_dptr(parent, bindex);
+		if (!h_parent || !h_parent->d_inode)
+			continue;
+
+		br = au_sbr(sb, bindex);
+		if (!au_br_rdonly(br) && br->br_wbr->wbr_bytes > b) {
+			b = br->br_wbr->wbr_bytes;
+			err = bindex;
+			AuDbg("b%d, %llu\n", err, b);
+		}
+	}
+
+ out_parent:
+	dput(parent);
+ out:
+	AuDbg("b%d\n", err);
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+/* policies for copyup */
+
+/* top down parent */
+static int au_wbr_copyup_tdp(struct dentry *dentry)
+{
+	return au_wbr_create_tdp(dentry, /*isdir, anything is ok*/0);
+}
+
+/* bottom up parent */
+static int au_wbr_copyup_bup(struct dentry *dentry)
+{
+	int err;
+	aufs_bindex_t bindex, bstart;
+	struct dentry *parent, *h_parent;
+	struct super_block *sb;
+
+	err = -EROFS;
+	sb = dentry->d_sb;
+	parent = dget_parent(dentry);
+	bstart = au_dbstart(parent);
+	for (bindex = au_dbstart(dentry); bindex >= bstart; bindex--) {
+		h_parent = au_h_dptr(parent, bindex);
+		if (!h_parent || !h_parent->d_inode)
+			continue;
+
+		if (!au_br_rdonly(au_sbr(sb, bindex))) {
+			err = bindex;
+			break;
+		}
+	}
+	dput(parent);
+
+	/* bottom up here */
+	if (unlikely(err < 0))
+		err = au_wbr_bu(sb, bstart - 1);
+
+	AuDbg("b%d\n", err);
+	return err;
+}
+
+/* bottom up */
+static int au_wbr_copyup_bu(struct dentry *dentry)
+{
+	int err;
+
+	err = au_wbr_bu(dentry->d_sb, au_dbstart(dentry));
+
+	AuDbg("b%d\n", err);
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+struct au_wbr_copyup_operations au_wbr_copyup_ops[] = {
+	[AuWbrCopyup_TDP] = {
+		.copyup	= au_wbr_copyup_tdp
+	},
+	[AuWbrCopyup_BUP] = {
+		.copyup	= au_wbr_copyup_bup
+	},
+	[AuWbrCopyup_BU] = {
+		.copyup	= au_wbr_copyup_bu
+	}
+};
+
+struct au_wbr_create_operations au_wbr_create_ops[] = {
+	[AuWbrCreate_TDP] = {
+		.create	= au_wbr_create_tdp
+	},
+	[AuWbrCreate_RR] = {
+		.create	= au_wbr_create_rr,
+		.init	= au_wbr_create_init_rr
+	},
+	[AuWbrCreate_MFS] = {
+		.create	= au_wbr_create_mfs,
+		.init	= au_wbr_create_init_mfs,
+		.fin	= au_wbr_create_fin_mfs
+	},
+	[AuWbrCreate_MFSV] = {
+		.create	= au_wbr_create_mfs,
+		.init	= au_wbr_create_init_mfs,
+		.fin	= au_wbr_create_fin_mfs
+	},
+	[AuWbrCreate_MFSRR] = {
+		.create	= au_wbr_create_mfsrr,
+		.init	= au_wbr_create_init_mfsrr,
+		.fin	= au_wbr_create_fin_mfs
+	},
+	[AuWbrCreate_MFSRRV] = {
+		.create	= au_wbr_create_mfsrr,
+		.init	= au_wbr_create_init_mfsrr,
+		.fin	= au_wbr_create_fin_mfs
+	},
+	[AuWbrCreate_PMFS] = {
+		.create	= au_wbr_create_pmfs,
+		.init	= au_wbr_create_init_mfs,
+		.fin	= au_wbr_create_fin_mfs
+	},
+	[AuWbrCreate_PMFSV] = {
+		.create	= au_wbr_create_pmfs,
+		.init	= au_wbr_create_init_mfs,
+		.fin	= au_wbr_create_fin_mfs
+	}
+};
--- linux-rt-2.6.31.orig/ubuntu/aufs/hinotify.c
+++ linux-rt-2.6.31/ubuntu/aufs/hinotify.c
@@ -0,0 +1,755 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * inotify for the lower directories
+ */
+
+#include "aufs.h"
+
+static const __u32 AuHinMask = (IN_MOVE | IN_DELETE | IN_CREATE);
+static struct inotify_handle *au_hin_handle;
+
+AuCacheFuncs(hinotify, HINOTIFY);
+
+int au_hin_alloc(struct au_hinode *hinode, struct inode *inode,
+		 struct inode *h_inode)
+{
+	int err;
+	struct au_hinotify *hin;
+	s32 wd;
+
+	err = -ENOMEM;
+	hin = au_cache_alloc_hinotify();
+	if (hin) {
+		AuDebugOn(hinode->hi_notify);
+		hinode->hi_notify = hin;
+		hin->hin_aufs_inode = inode;
+
+		inotify_init_watch(&hin->hin_watch);
+		wd = inotify_add_watch(au_hin_handle, &hin->hin_watch, h_inode,
+				       AuHinMask);
+		if (wd >= 0)
+			return 0; /* success */
+
+		err = wd;
+		put_inotify_watch(&hin->hin_watch);
+		au_cache_free_hinotify(hin);
+		hinode->hi_notify = NULL;
+	}
+
+	return err;
+}
+
+void au_hin_free(struct au_hinode *hinode)
+{
+	int err;
+	struct au_hinotify *hin;
+
+	hin = hinode->hi_notify;
+	if (hin) {
+		err = 0;
+		if (atomic_read(&hin->hin_watch.count))
+			err = inotify_rm_watch(au_hin_handle, &hin->hin_watch);
+		if (unlikely(err))
+			/* it means the watch is already removed */
+			AuWarn("failed inotify_rm_watch() %d\n", err);
+		au_cache_free_hinotify(hin);
+		hinode->hi_notify = NULL;
+	}
+}
+
+/* ---------------------------------------------------------------------- */
+
+void au_hin_ctl(struct au_hinode *hinode, int do_set)
+{
+	struct inode *h_inode;
+	struct inotify_watch *watch;
+
+	if (!hinode->hi_notify)
+		return;
+
+	h_inode = hinode->hi_inode;
+	IMustLock(h_inode);
+
+	/* todo: try inotify_find_update_watch()? */
+	watch = &hinode->hi_notify->hin_watch;
+	mutex_lock(&h_inode->inotify_mutex);
+	/* mutex_lock(&watch->ih->mutex); */
+	if (do_set) {
+		AuDebugOn(watch->mask & AuHinMask);
+		watch->mask |= AuHinMask;
+	} else {
+		AuDebugOn(!(watch->mask & AuHinMask));
+		watch->mask &= ~AuHinMask;
+	}
+	/* mutex_unlock(&watch->ih->mutex); */
+	mutex_unlock(&h_inode->inotify_mutex);
+}
+
+void au_reset_hinotify(struct inode *inode, unsigned int flags)
+{
+	aufs_bindex_t bindex, bend;
+	struct inode *hi;
+	struct dentry *iwhdentry;
+
+	bend = au_ibend(inode);
+	for (bindex = au_ibstart(inode); bindex <= bend; bindex++) {
+		hi = au_h_iptr(inode, bindex);
+		if (!hi)
+			continue;
+
+		/* mutex_lock_nested(&hi->i_mutex, AuLsc_I_CHILD); */
+		iwhdentry = au_hi_wh(inode, bindex);
+		if (iwhdentry)
+			dget(iwhdentry);
+		au_igrab(hi);
+		au_set_h_iptr(inode, bindex, NULL, 0);
+		au_set_h_iptr(inode, bindex, au_igrab(hi),
+			      flags & ~AuHi_XINO);
+		iput(hi);
+		dput(iwhdentry);
+		/* mutex_unlock(&hi->i_mutex); */
+	}
+}
+
+/* ---------------------------------------------------------------------- */
+
+static int hin_xino(struct inode *inode, struct inode *h_inode)
+{
+	int err;
+	aufs_bindex_t bindex, bend, bfound, bstart;
+	struct inode *h_i;
+
+	err = 0;
+	if (unlikely(inode->i_ino == AUFS_ROOT_INO)) {
+		AuWarn("branch root dir was changed\n");
+		goto out;
+	}
+
+	bfound = -1;
+	bend = au_ibend(inode);
+	bstart = au_ibstart(inode);
+#if 0 /* reserved for future use */
+	if (bindex == bend) {
+		/* keep this ino in rename case */
+		goto out;
+	}
+#endif
+	for (bindex = bstart; bindex <= bend; bindex++) {
+		if (au_h_iptr(inode, bindex) == h_inode) {
+			bfound = bindex;
+			break;
+		}
+	}
+	if (bfound < 0)
+		goto out;
+
+	for (bindex = bstart; bindex <= bend; bindex++) {
+		h_i = au_h_iptr(inode, bindex);
+		if (!h_i)
+			continue;
+
+		err = au_xino_write(inode->i_sb, bindex, h_i->i_ino, /*ino*/0);
+		/* ignore this error */
+		/* bad action? */
+	}
+
+	/* children inode number will be broken */
+
+ out:
+	AuTraceErr(err);
+	return err;
+}
+
+static int hin_gen_tree(struct dentry *dentry)
+{
+	int err, i, j, ndentry;
+	struct au_dcsub_pages dpages;
+	struct au_dpage *dpage;
+	struct dentry **dentries;
+
+	err = au_dpages_init(&dpages, GFP_NOFS);
+	if (unlikely(err))
+		goto out;
+	err = au_dcsub_pages(&dpages, dentry, NULL, NULL);
+	if (unlikely(err))
+		goto out_dpages;
+
+	for (i = 0; i < dpages.ndpage; i++) {
+		dpage = dpages.dpages + i;
+		dentries = dpage->dentries;
+		ndentry = dpage->ndentry;
+		for (j = 0; j < ndentry; j++) {
+			struct dentry *d;
+
+			d = dentries[j];
+			if (IS_ROOT(d))
+				continue;
+
+			d_drop(d);
+			au_digen_dec(d);
+			if (d->d_inode)
+				/* todo: reset children xino?
+				   cached children only? */
+				au_iigen_dec(d->d_inode);
+		}
+	}
+
+ out_dpages:
+	au_dpages_free(&dpages);
+
+	/* discard children */
+	dentry_unhash(dentry);
+	dput(dentry);
+ out:
+	return err;
+}
+
+/*
+ * return 0 if processed.
+ */
+static int hin_gen_by_inode(char *name, unsigned int nlen, struct inode *inode,
+			    const unsigned int isdir)
+{
+	int err;
+	struct dentry *d;
+	struct qstr *dname;
+
+	err = 1;
+	if (unlikely(inode->i_ino == AUFS_ROOT_INO)) {
+		AuWarn("branch root dir was changed\n");
+		err = 0;
+		goto out;
+	}
+
+	if (!isdir) {
+		AuDebugOn(!name);
+		au_iigen_dec(inode);
+		spin_lock(&dcache_lock);
+		list_for_each_entry(d, &inode->i_dentry, d_alias) {
+			dname = &d->d_name;
+			if (dname->len != nlen
+			    && memcmp(dname->name, name, nlen))
+				continue;
+			err = 0;
+			spin_lock(&d->d_lock);
+			__d_drop(d);
+			au_digen_dec(d);
+			spin_unlock(&d->d_lock);
+			break;
+		}
+		spin_unlock(&dcache_lock);
+	} else {
+		au_fset_si(au_sbi(inode->i_sb), FAILED_REFRESH_DIRS);
+		d = d_find_alias(inode);
+		if (!d) {
+			au_iigen_dec(inode);
+			goto out;
+		}
+
+		dname = &d->d_name;
+		if (dname->len == nlen && !memcmp(dname->name, name, nlen))
+			err = hin_gen_tree(d);
+		dput(d);
+	}
+
+ out:
+	AuTraceErr(err);
+	return err;
+}
+
+static int hin_gen_by_name(struct dentry *dentry, const unsigned int isdir)
+{
+	int err;
+	struct inode *inode;
+
+	inode = dentry->d_inode;
+	if (IS_ROOT(dentry)
+	    /* || (inode && inode->i_ino == AUFS_ROOT_INO) */
+		) {
+		AuWarn("branch root dir was changed\n");
+		return 0;
+	}
+
+	err = 0;
+	if (!isdir) {
+		d_drop(dentry);
+		au_digen_dec(dentry);
+		if (inode)
+			au_iigen_dec(inode);
+	} else {
+		au_fset_si(au_sbi(dentry->d_sb), FAILED_REFRESH_DIRS);
+		if (inode)
+			err = hin_gen_tree(dentry);
+	}
+
+	AuTraceErr(err);
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+/* hinotify job flags */
+#define AuHinJob_XINO0		1
+#define AuHinJob_GEN		(1 << 1)
+#define AuHinJob_DIRENT		(1 << 2)
+#define AuHinJob_ISDIR		(1 << 3)
+#define AuHinJob_TRYXINO0	(1 << 4)
+#define AuHinJob_MNTPNT		(1 << 5)
+#define au_ftest_hinjob(flags, name)	((flags) & AuHinJob_##name)
+#define au_fset_hinjob(flags, name)	{ (flags) |= AuHinJob_##name; }
+#define au_fclr_hinjob(flags, name)	{ (flags) &= ~AuHinJob_##name; }
+
+struct hin_job_args {
+	unsigned int flags;
+	struct inode *inode, *h_inode, *dir, *h_dir;
+	struct dentry *dentry;
+	char *h_name;
+	int h_nlen;
+};
+
+static int hin_job(struct hin_job_args *a)
+{
+	const unsigned int isdir = au_ftest_hinjob(a->flags, ISDIR);
+
+	/* reset xino */
+	if (au_ftest_hinjob(a->flags, XINO0) && a->inode)
+		hin_xino(a->inode, a->h_inode); /* ignore this error */
+
+	if (au_ftest_hinjob(a->flags, TRYXINO0)
+	    && a->inode
+	    && a->h_inode) {
+		mutex_lock_nested(&a->h_inode->i_mutex, AuLsc_I_CHILD);
+		if (!a->h_inode->i_nlink)
+			hin_xino(a->inode, a->h_inode); /* ignore this error */
+		mutex_unlock(&a->h_inode->i_mutex);
+	}
+
+	/* make the generation obsolete */
+	if (au_ftest_hinjob(a->flags, GEN)) {
+		int err = -1;
+		if (a->inode)
+			err = hin_gen_by_inode(a->h_name, a->h_nlen, a->inode,
+					       isdir);
+		if (err && a->dentry)
+			hin_gen_by_name(a->dentry, isdir);
+		/* ignore this error */
+	}
+
+	/* make dir entries obsolete */
+	if (au_ftest_hinjob(a->flags, DIRENT) && a->inode) {
+		struct au_vdir *vdir;
+
+		vdir = au_ivdir(a->inode);
+		if (vdir)
+			vdir->vd_jiffy = 0;
+		/* IMustLock(a->inode); */
+		/* a->inode->i_version++; */
+	}
+
+	/* can do nothing but warn */
+	if (au_ftest_hinjob(a->flags, MNTPNT)
+	    && a->dentry
+	    && d_mountpoint(a->dentry))
+		AuWarn("mount-point %.*s is removed or renamed\n",
+		       AuDLNPair(a->dentry));
+
+	return 0;
+}
+
+/* ---------------------------------------------------------------------- */
+
+static char *in_name(u32 mask)
+{
+#ifdef CONFIG_AUFS_DEBUG
+#define test_ret(flag)	if (mask & flag) \
+				return #flag;
+	test_ret(IN_ACCESS);
+	test_ret(IN_MODIFY);
+	test_ret(IN_ATTRIB);
+	test_ret(IN_CLOSE_WRITE);
+	test_ret(IN_CLOSE_NOWRITE);
+	test_ret(IN_OPEN);
+	test_ret(IN_MOVED_FROM);
+	test_ret(IN_MOVED_TO);
+	test_ret(IN_CREATE);
+	test_ret(IN_DELETE);
+	test_ret(IN_DELETE_SELF);
+	test_ret(IN_MOVE_SELF);
+	test_ret(IN_UNMOUNT);
+	test_ret(IN_Q_OVERFLOW);
+	test_ret(IN_IGNORED);
+	return "";
+#undef test_ret
+#else
+	return "??";
+#endif
+}
+
+static struct dentry *lookup_wlock_by_name(char *name, unsigned int nlen,
+					   struct inode *dir)
+{
+	struct dentry *dentry, *d, *parent;
+	struct qstr *dname;
+
+	parent = d_find_alias(dir);
+	if (!parent)
+		return NULL;
+
+	dentry = NULL;
+	spin_lock(&dcache_lock);
+	list_for_each_entry(d, &parent->d_subdirs, d_u.d_child) {
+		/* AuDbg("%.*s\n", AuDLNPair(d)); */
+		dname = &d->d_name;
+		if (dname->len != nlen || memcmp(dname->name, name, nlen))
+			continue;
+		if (!atomic_read(&d->d_count) || !d->d_fsdata) {
+			spin_lock(&d->d_lock);
+			__d_drop(d);
+			spin_unlock(&d->d_lock);
+			continue;
+		}
+
+		dentry = dget(d);
+		break;
+	}
+	spin_unlock(&dcache_lock);
+	dput(parent);
+
+	if (dentry)
+		di_write_lock_child(dentry);
+
+	return dentry;
+}
+
+static struct inode *lookup_wlock_by_ino(struct super_block *sb,
+					 aufs_bindex_t bindex, ino_t h_ino)
+{
+	struct inode *inode;
+	ino_t ino;
+	int err;
+
+	inode = NULL;
+	err = au_xino_read(sb, bindex, h_ino, &ino);
+	if (!err && ino)
+		inode = ilookup(sb, ino);
+	if (!inode)
+		goto out;
+
+	if (unlikely(inode->i_ino == AUFS_ROOT_INO)) {
+		AuWarn("wrong root branch\n");
+		iput(inode);
+		inode = NULL;
+		goto out;
+	}
+
+	ii_write_lock_child(inode);
+
+ out:
+	return inode;
+}
+
+enum { CHILD, PARENT };
+struct postproc_args {
+	struct inode *h_dir, *dir, *h_child_inode;
+	u32 mask;
+	unsigned int flags[2];
+	unsigned int h_child_nlen;
+	char h_child_name[];
+};
+
+static void postproc(void *_args)
+{
+	struct postproc_args *a = _args;
+	struct super_block *sb;
+	aufs_bindex_t bindex, bend, bfound;
+	unsigned char xino, try_iput;
+	int err;
+	struct inode *inode;
+	ino_t h_ino;
+	struct hin_job_args args;
+	struct dentry *dentry;
+	struct au_sbinfo *sbinfo;
+
+	AuDebugOn(!_args);
+	AuDebugOn(!a->h_dir);
+	AuDebugOn(!a->dir);
+	AuDebugOn(!a->mask);
+	AuDbg("mask 0x%x %s, i%lu, hi%lu, hci%lu\n",
+	      a->mask, in_name(a->mask), a->dir->i_ino, a->h_dir->i_ino,
+	      a->h_child_inode ? a->h_child_inode->i_ino : 0);
+
+	inode = NULL;
+	dentry = NULL;
+	/*
+	 * do not lock a->dir->i_mutex here
+	 * because of d_revalidate() may cause a deadlock.
+	 */
+	sb = a->dir->i_sb;
+	AuDebugOn(!sb);
+	sbinfo = au_sbi(sb);
+	AuDebugOn(!sbinfo);
+	/* big aufs lock */
+	si_noflush_write_lock(sb);
+
+	ii_read_lock_parent(a->dir);
+	bfound = -1;
+	bend = au_ibend(a->dir);
+	for (bindex = au_ibstart(a->dir); bindex <= bend; bindex++)
+		if (au_h_iptr(a->dir, bindex) == a->h_dir) {
+			bfound = bindex;
+			break;
+		}
+	ii_read_unlock(a->dir);
+	if (unlikely(bfound < 0))
+		goto out;
+
+	xino = !!au_opt_test(au_mntflags(sb), XINO);
+	h_ino = 0;
+	if (a->h_child_inode)
+		h_ino = a->h_child_inode->i_ino;
+
+	if (a->h_child_nlen
+	    && (au_ftest_hinjob(a->flags[CHILD], GEN)
+		|| au_ftest_hinjob(a->flags[CHILD], MNTPNT)))
+		dentry = lookup_wlock_by_name(a->h_child_name, a->h_child_nlen,
+					      a->dir);
+	try_iput = 0;
+	if (dentry)
+		inode = dentry->d_inode;
+	if (xino && !inode && h_ino
+	    && (au_ftest_hinjob(a->flags[CHILD], XINO0)
+		|| au_ftest_hinjob(a->flags[CHILD], TRYXINO0)
+		|| au_ftest_hinjob(a->flags[CHILD], GEN))) {
+		inode = lookup_wlock_by_ino(sb, bfound, h_ino);
+		try_iput = 1;
+	    }
+
+	args.flags = a->flags[CHILD];
+	args.dentry = dentry;
+	args.inode = inode;
+	args.h_inode = a->h_child_inode;
+	args.dir = a->dir;
+	args.h_dir = a->h_dir;
+	args.h_name = a->h_child_name;
+	args.h_nlen = a->h_child_nlen;
+	err = hin_job(&args);
+	if (dentry) {
+		if (dentry->d_fsdata)
+			di_write_unlock(dentry);
+		dput(dentry);
+	}
+	if (inode && try_iput) {
+		ii_write_unlock(inode);
+		iput(inode);
+	}
+
+	ii_write_lock_parent(a->dir);
+	args.flags = a->flags[PARENT];
+	args.dentry = NULL;
+	args.inode = a->dir;
+	args.h_inode = a->h_dir;
+	args.dir = NULL;
+	args.h_dir = NULL;
+	args.h_name = NULL;
+	args.h_nlen = 0;
+	err = hin_job(&args);
+	ii_write_unlock(a->dir);
+
+ out:
+	au_nwt_done(&sbinfo->si_nowait);
+	si_write_unlock(sb);
+
+	iput(a->h_child_inode);
+	iput(a->h_dir);
+	iput(a->dir);
+	kfree(a);
+}
+
+/* ---------------------------------------------------------------------- */
+
+static void aufs_inotify(struct inotify_watch *watch, u32 wd __maybe_unused,
+			 u32 mask, u32 cookie __maybe_unused,
+			 const char *h_child_name, struct inode *h_child_inode)
+{
+	struct au_hinotify *hinotify;
+	struct postproc_args *args;
+	int len, wkq_err;
+	unsigned char isdir, isroot, wh;
+	char *p;
+	struct inode *dir;
+	unsigned int flags[2];
+
+	/* if IN_UNMOUNT happens, there must be another bug */
+	AuDebugOn(mask & IN_UNMOUNT);
+	if (mask & (IN_IGNORED | IN_UNMOUNT)) {
+		put_inotify_watch(watch);
+		return;
+	}
+#ifdef AuDbgHinotify
+	au_debug(1);
+	if (1 || !h_child_name || strcmp(h_child_name, AUFS_XINO_FNAME)) {
+		AuDbg("i%lu, wd %d, mask 0x%x %s, cookie 0x%x, hcname %s,"
+		      " hi%lu\n",
+		      watch->inode->i_ino, wd, mask, in_name(mask), cookie,
+		      h_child_name ? h_child_name : "",
+		      h_child_inode ? h_child_inode->i_ino : 0);
+		WARN_ON(1);
+	}
+	au_debug(0);
+#endif
+
+	hinotify = container_of(watch, struct au_hinotify, hin_watch);
+	AuDebugOn(!hinotify || !hinotify->hin_aufs_inode);
+	dir = igrab(hinotify->hin_aufs_inode);
+	if (!dir)
+		return;
+
+	isroot = (dir->i_ino == AUFS_ROOT_INO);
+	len = 0;
+	wh = 0;
+	if (h_child_name) {
+		len = strlen(h_child_name);
+		if (!memcmp(h_child_name, AUFS_WH_PFX, AUFS_WH_PFX_LEN)) {
+			h_child_name += AUFS_WH_PFX_LEN;
+			len -= AUFS_WH_PFX_LEN;
+			wh = 1;
+		}
+	}
+
+	isdir = 0;
+	if (h_child_inode)
+		isdir = !!S_ISDIR(h_child_inode->i_mode);
+	flags[PARENT] = AuHinJob_ISDIR;
+	flags[CHILD] = 0;
+	if (isdir)
+		flags[CHILD] = AuHinJob_ISDIR;
+	switch (mask & IN_ALL_EVENTS) {
+	case IN_MOVED_FROM:
+	case IN_MOVED_TO:
+		AuDebugOn(!h_child_name || !h_child_inode);
+		au_fset_hinjob(flags[CHILD], GEN);
+		au_fset_hinjob(flags[CHILD], XINO0);
+		au_fset_hinjob(flags[CHILD], MNTPNT);
+		au_fset_hinjob(flags[PARENT], DIRENT);
+		break;
+
+	case IN_CREATE:
+		AuDebugOn(!h_child_name || !h_child_inode);
+		au_fset_hinjob(flags[PARENT], DIRENT);
+		au_fset_hinjob(flags[CHILD], GEN);
+		break;
+
+	case IN_DELETE:
+		/*
+		 * aufs never be able to get this child inode.
+		 * revalidation should be in d_revalidate()
+		 * by checking i_nlink, i_generation or d_unhashed().
+		 */
+		AuDebugOn(!h_child_name);
+		au_fset_hinjob(flags[PARENT], DIRENT);
+		au_fset_hinjob(flags[CHILD], GEN);
+		au_fset_hinjob(flags[CHILD], TRYXINO0);
+		au_fset_hinjob(flags[CHILD], MNTPNT);
+		break;
+
+	default:
+		AuDebugOn(1);
+	}
+
+	if (wh)
+		h_child_inode = NULL;
+
+	/* iput() and kfree() will be called in postproc() */
+	/*
+	 * inotify_mutex is already acquired and kmalloc/prune_icache may lock
+	 * iprune_mutex. strange.
+	 */
+	lockdep_off();
+	args = kmalloc(sizeof(*args) + len + 1, GFP_NOFS);
+	lockdep_on();
+	if (unlikely(!args)) {
+		AuErr1("no memory\n");
+		iput(dir);
+		return;
+	}
+	args->flags[PARENT] = flags[PARENT];
+	args->flags[CHILD] = flags[CHILD];
+	args->mask = mask;
+	args->dir = dir;
+	args->h_dir = igrab(watch->inode);
+	if (h_child_inode)
+		h_child_inode = igrab(h_child_inode); /* can be NULL */
+	args->h_child_inode = h_child_inode;
+	args->h_child_nlen = len;
+	if (len) {
+		p = (void *)args;
+		p += sizeof(*args);
+		memcpy(p, h_child_name, len + 1);
+	}
+
+	lockdep_off();
+	wkq_err = au_wkq_nowait(postproc, args, dir->i_sb);
+	lockdep_on();
+	if (unlikely(wkq_err))
+		AuErr("wkq %d\n", wkq_err);
+}
+
+static void aufs_inotify_destroy(struct inotify_watch *watch __maybe_unused)
+{
+	return;
+}
+
+static struct inotify_operations aufs_inotify_ops = {
+	.handle_event	= aufs_inotify,
+	.destroy_watch	= aufs_inotify_destroy
+};
+
+/* ---------------------------------------------------------------------- */
+
+static void au_hin_destroy_cache(void)
+{
+	kmem_cache_destroy(au_cachep[AuCache_HINOTIFY]);
+	au_cachep[AuCache_HINOTIFY] = NULL;
+}
+
+int __init au_hinotify_init(void)
+{
+	int err;
+
+	err = -ENOMEM;
+	au_cachep[AuCache_HINOTIFY] = AuCache(au_hinotify);
+	if (au_cachep[AuCache_HINOTIFY]) {
+		err = 0;
+		au_hin_handle = inotify_init(&aufs_inotify_ops);
+		if (IS_ERR(au_hin_handle)) {
+			err = PTR_ERR(au_hin_handle);
+			au_hin_destroy_cache();
+		}
+	}
+	AuTraceErr(err);
+	return err;
+}
+
+void au_hinotify_fin(void)
+{
+	inotify_destroy(au_hin_handle);
+	if (au_cachep[AuCache_HINOTIFY])
+		au_hin_destroy_cache();
+}
--- linux-rt-2.6.31.orig/ubuntu/aufs/inode.c
+++ linux-rt-2.6.31/ubuntu/aufs/inode.c
@@ -0,0 +1,380 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * inode functions
+ */
+
+#include "aufs.h"
+
+struct inode *au_igrab(struct inode *inode)
+{
+	if (inode) {
+		AuDebugOn(!atomic_read(&inode->i_count));
+		atomic_inc_return(&inode->i_count);
+	}
+	return inode;
+}
+
+static void au_refresh_hinode_attr(struct inode *inode, int do_version)
+{
+	au_cpup_attr_all(inode, /*force*/0);
+	au_update_iigen(inode);
+	if (do_version)
+		inode->i_version++;
+}
+
+int au_refresh_hinode_self(struct inode *inode, int do_attr)
+{
+	int err;
+	aufs_bindex_t bindex, new_bindex;
+	unsigned char update;
+	struct inode *first;
+	struct au_hinode *p, *q, tmp;
+	struct super_block *sb;
+	struct au_iinfo *iinfo;
+
+	IiMustWriteLock(inode);
+
+	update = 0;
+	sb = inode->i_sb;
+	iinfo = au_ii(inode);
+	err = au_ii_realloc(iinfo, au_sbend(sb) + 1);
+	if (unlikely(err))
+		goto out;
+
+	p = iinfo->ii_hinode + iinfo->ii_bstart;
+	first = p->hi_inode;
+	err = 0;
+	for (bindex = iinfo->ii_bstart; bindex <= iinfo->ii_bend;
+	     bindex++, p++) {
+		if (!p->hi_inode)
+			continue;
+
+		new_bindex = au_br_index(sb, p->hi_id);
+		if (new_bindex == bindex)
+			continue;
+
+		if (new_bindex < 0) {
+			update++;
+			au_hiput(p);
+			p->hi_inode = NULL;
+			continue;
+		}
+
+		if (new_bindex < iinfo->ii_bstart)
+			iinfo->ii_bstart = new_bindex;
+		if (iinfo->ii_bend < new_bindex)
+			iinfo->ii_bend = new_bindex;
+		/* swap two lower inode, and loop again */
+		q = iinfo->ii_hinode + new_bindex;
+		tmp = *q;
+		*q = *p;
+		*p = tmp;
+		if (tmp.hi_inode) {
+			bindex--;
+			p--;
+		}
+	}
+	au_update_brange(inode, /*do_put_zero*/0);
+	if (do_attr)
+		au_refresh_hinode_attr(inode, update && S_ISDIR(inode->i_mode));
+
+ out:
+	return err;
+}
+
+int au_refresh_hinode(struct inode *inode, struct dentry *dentry)
+{
+	int err, update;
+	unsigned int flags;
+	aufs_bindex_t bindex, bend;
+	unsigned char isdir;
+	struct inode *first;
+	struct au_hinode *p;
+	struct au_iinfo *iinfo;
+
+	err = au_refresh_hinode_self(inode, /*do_attr*/0);
+	if (unlikely(err))
+		goto out;
+
+	update = 0;
+	iinfo = au_ii(inode);
+	p = iinfo->ii_hinode + iinfo->ii_bstart;
+	first = p->hi_inode;
+	isdir = S_ISDIR(inode->i_mode);
+	flags = au_hi_flags(inode, isdir);
+	bend = au_dbend(dentry);
+	for (bindex = au_dbstart(dentry); bindex <= bend; bindex++) {
+		struct inode *h_i;
+		struct dentry *h_d;
+
+		h_d = au_h_dptr(dentry, bindex);
+		if (!h_d || !h_d->d_inode)
+			continue;
+
+		if (iinfo->ii_bstart <= bindex && bindex <= iinfo->ii_bend) {
+			h_i = au_h_iptr(inode, bindex);
+			if (h_i) {
+				if (h_i == h_d->d_inode)
+					continue;
+				err = -EIO;
+				break;
+			}
+		}
+		if (bindex < iinfo->ii_bstart)
+			iinfo->ii_bstart = bindex;
+		if (iinfo->ii_bend < bindex)
+			iinfo->ii_bend = bindex;
+		au_set_h_iptr(inode, bindex, au_igrab(h_d->d_inode), flags);
+		update = 1;
+	}
+	au_update_brange(inode, /*do_put_zero*/0);
+
+	if (unlikely(err))
+		goto out;
+
+	au_refresh_hinode_attr(inode, update && isdir);
+
+ out:
+	return err;
+}
+
+static int set_inode(struct inode *inode, struct dentry *dentry)
+{
+	int err;
+	unsigned int flags;
+	umode_t mode;
+	aufs_bindex_t bindex, bstart, btail;
+	unsigned char isdir;
+	struct dentry *h_dentry;
+	struct inode *h_inode;
+	struct au_iinfo *iinfo;
+
+	IiMustWriteLock(inode);
+
+	err = 0;
+	isdir = 0;
+	bstart = au_dbstart(dentry);
+	h_inode = au_h_dptr(dentry, bstart)->d_inode;
+	mode = h_inode->i_mode;
+	switch (mode & S_IFMT) {
+	case S_IFREG:
+		btail = au_dbtail(dentry);
+		inode->i_op = &aufs_iop;
+		inode->i_fop = &aufs_file_fop;
+		inode->i_mapping->a_ops = &aufs_aop;
+		break;
+	case S_IFDIR:
+		isdir = 1;
+		btail = au_dbtaildir(dentry);
+		inode->i_op = &aufs_dir_iop;
+		inode->i_fop = &aufs_dir_fop;
+		break;
+	case S_IFLNK:
+		btail = au_dbtail(dentry);
+		inode->i_op = &aufs_symlink_iop;
+		break;
+	case S_IFBLK:
+	case S_IFCHR:
+	case S_IFIFO:
+	case S_IFSOCK:
+		btail = au_dbtail(dentry);
+		inode->i_op = &aufs_iop;
+		init_special_inode(inode, mode, h_inode->i_rdev);
+		break;
+	default:
+		AuIOErr("Unknown file type 0%o\n", mode);
+		err = -EIO;
+		goto out;
+	}
+
+	/* do not set inotify for whiteouted dirs (SHWH mode) */
+	flags = au_hi_flags(inode, isdir);
+	if (au_opt_test(au_mntflags(dentry->d_sb), SHWH)
+	    && au_ftest_hi(flags, HINOTIFY)
+	    && dentry->d_name.len > AUFS_WH_PFX_LEN
+	    && !memcmp(dentry->d_name.name, AUFS_WH_PFX, AUFS_WH_PFX_LEN))
+		au_fclr_hi(flags, HINOTIFY);
+	iinfo = au_ii(inode);
+	iinfo->ii_bstart = bstart;
+	iinfo->ii_bend = btail;
+	for (bindex = bstart; bindex <= btail; bindex++) {
+		h_dentry = au_h_dptr(dentry, bindex);
+		if (h_dentry)
+			au_set_h_iptr(inode, bindex,
+				      au_igrab(h_dentry->d_inode), flags);
+	}
+	au_cpup_attr_all(inode, /*force*/1);
+
+ out:
+	return err;
+}
+
+/* successful returns with iinfo write_locked */
+static int reval_inode(struct inode *inode, struct dentry *dentry, int *matched)
+{
+	int err;
+	aufs_bindex_t bindex, bend;
+	struct inode *h_inode, *h_dinode;
+
+	*matched = 0;
+
+	/*
+	 * before this function, if aufs got any iinfo lock, it must be only
+	 * one, the parent dir.
+	 * it can happen by UDBA and the obsoleted inode number.
+	 */
+	err = -EIO;
+	if (unlikely(inode->i_ino == parent_ino(dentry)))
+		goto out;
+
+	err = 0;
+	ii_write_lock_new_child(inode);
+	h_dinode = au_h_dptr(dentry, au_dbstart(dentry))->d_inode;
+	bend = au_ibend(inode);
+	for (bindex = au_ibstart(inode); bindex <= bend; bindex++) {
+		h_inode = au_h_iptr(inode, bindex);
+		if (h_inode && h_inode == h_dinode) {
+			*matched = 1;
+			err = 0;
+			if (au_iigen(inode) != au_digen(dentry))
+				err = au_refresh_hinode(inode, dentry);
+			break;
+		}
+	}
+
+	if (unlikely(err))
+		ii_write_unlock(inode);
+ out:
+	return err;
+}
+
+/* successful returns with iinfo write_locked */
+/* todo: return with unlocked? */
+struct inode *au_new_inode(struct dentry *dentry, int must_new)
+{
+	struct inode *inode;
+	struct dentry *h_dentry;
+	struct super_block *sb;
+	ino_t h_ino, ino;
+	int err, match;
+	aufs_bindex_t bstart;
+
+	sb = dentry->d_sb;
+	bstart = au_dbstart(dentry);
+	h_dentry = au_h_dptr(dentry, bstart);
+	h_ino = h_dentry->d_inode->i_ino;
+	err = au_xino_read(sb, bstart, h_ino, &ino);
+	inode = ERR_PTR(err);
+	if (unlikely(err))
+		goto out;
+ new_ino:
+	if (!ino) {
+		ino = au_xino_new_ino(sb);
+		if (unlikely(!ino)) {
+			inode = ERR_PTR(-EIO);
+			goto out;
+		}
+	}
+
+	AuDbg("i%lu\n", (unsigned long)ino);
+	inode = au_iget_locked(sb, ino);
+	err = PTR_ERR(inode);
+	if (IS_ERR(inode))
+		goto out;
+
+	AuDbg("%lx, new %d\n", inode->i_state, !!(inode->i_state & I_NEW));
+	if (inode->i_state & I_NEW) {
+		ii_write_lock_new_child(inode);
+		err = set_inode(inode, dentry);
+		unlock_new_inode(inode);
+		if (!err)
+			goto out; /* success */
+
+		iget_failed(inode);
+		ii_write_unlock(inode);
+		goto out_iput;
+	} else if (!must_new) {
+		err = reval_inode(inode, dentry, &match);
+		if (!err)
+			goto out; /* success */
+		else if (match)
+			goto out_iput;
+	}
+
+	if (unlikely(au_test_fs_unique_ino(h_dentry->d_inode)))
+		AuWarn1("Warning: Un-notified UDBA or repeatedly renamed dir,"
+			" b%d, %s, %.*s, hi%lu, i%lu.\n",
+			bstart, au_sbtype(h_dentry->d_sb), AuDLNPair(dentry),
+			(unsigned long)h_ino, (unsigned long)ino);
+	ino = 0;
+	err = au_xino_write(sb, bstart, h_ino, /*ino*/0);
+	if (!err) {
+		iput(inode);
+		goto new_ino;
+	}
+
+ out_iput:
+	iput(inode);
+	inode = ERR_PTR(err);
+ out:
+	return inode;
+}
+
+/* ---------------------------------------------------------------------- */
+
+int au_test_ro(struct super_block *sb, aufs_bindex_t bindex,
+	       struct inode *inode)
+{
+	int err;
+
+	err = au_br_rdonly(au_sbr(sb, bindex));
+
+	/* pseudo-link after flushed may happen out of bounds */
+	if (!err
+	    && inode
+	    && au_ibstart(inode) <= bindex
+	    && bindex <= au_ibend(inode)) {
+		/*
+		 * permission check is unnecessary since vfsub routine
+		 * will be called later
+		 */
+		struct inode *hi = au_h_iptr(inode, bindex);
+		if (hi)
+			err = IS_IMMUTABLE(hi) ? -EROFS : 0;
+	}
+
+	return err;
+}
+
+int au_test_h_perm(struct inode *h_inode, int mask)
+{
+	if (!current_fsuid())
+		return 0;
+	return inode_permission(h_inode, mask);
+}
+
+int au_test_h_perm_sio(struct inode *h_inode, int mask)
+{
+	if (au_test_nfs(h_inode->i_sb)
+	    && (mask & MAY_WRITE)
+	    && S_ISDIR(h_inode->i_mode))
+		mask |= MAY_READ; /* force permission check */
+	return au_test_h_perm(h_inode, mask);
+}
--- linux-rt-2.6.31.orig/ubuntu/aufs/debug.c
+++ linux-rt-2.6.31/ubuntu/aufs/debug.c
@@ -0,0 +1,427 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * debug print functions
+ */
+
+#include <linux/module.h>
+#include <linux/vt_kern.h>
+#include "aufs.h"
+
+int aufs_debug;
+MODULE_PARM_DESC(debug, "debug print");
+module_param_named(debug, aufs_debug, int, S_IRUGO | S_IWUSR | S_IWGRP);
+
+char *au_plevel = KERN_DEBUG;
+#define dpri(fmt, arg...) do { \
+	if (au_debug_test()) \
+		printk("%s" fmt, au_plevel, ##arg); \
+} while (0)
+
+/* ---------------------------------------------------------------------- */
+
+void au_dpri_whlist(struct au_nhash *whlist)
+{
+	unsigned long ul, n;
+	struct hlist_head *head;
+	struct au_vdir_wh *tpos;
+	struct hlist_node *pos;
+
+	n = whlist->nh_num;
+	head = whlist->nh_head;
+	for (ul = 0; ul < n; ul++) {
+		hlist_for_each_entry(tpos, pos, head, wh_hash)
+			dpri("b%d, %.*s, %d\n",
+			     tpos->wh_bindex,
+			     tpos->wh_str.len, tpos->wh_str.name,
+			     tpos->wh_str.len);
+		head++;
+	}
+}
+
+void au_dpri_vdir(struct au_vdir *vdir)
+{
+	unsigned long ul;
+	union au_vdir_deblk_p p;
+	unsigned char *o;
+
+	if (!vdir || IS_ERR(vdir)) {
+		dpri("err %ld\n", PTR_ERR(vdir));
+		return;
+	}
+
+	dpri("deblk %u, nblk %lu, deblk %p, last{%lu, %p}, ver %lu\n",
+	     vdir->vd_deblk_sz, vdir->vd_nblk, vdir->vd_deblk,
+	     vdir->vd_last.ul, vdir->vd_last.p.deblk, vdir->vd_version);
+	for (ul = 0; ul < vdir->vd_nblk; ul++) {
+		p.deblk = vdir->vd_deblk[ul];
+		o = p.deblk;
+		dpri("[%lu]: %p\n", ul, o);
+	}
+}
+
+static int do_pri_inode(aufs_bindex_t bindex, struct inode *inode,
+			struct dentry *wh)
+{
+	char *n = NULL;
+	int l = 0;
+
+	if (!inode || IS_ERR(inode)) {
+		dpri("i%d: err %ld\n", bindex, PTR_ERR(inode));
+		return -1;
+	}
+
+	/* the type of i_blocks depends upon CONFIG_LSF */
+	BUILD_BUG_ON(sizeof(inode->i_blocks) != sizeof(unsigned long)
+		     && sizeof(inode->i_blocks) != sizeof(u64));
+	if (wh) {
+		n = (void *)wh->d_name.name;
+		l = wh->d_name.len;
+	}
+
+	dpri("i%d: i%lu, %s, cnt %d, nl %u, 0%o, sz %llu, blk %llu,"
+	     " ct %lld, np %lu, st 0x%lx, f 0x%x, g %x%s%.*s\n",
+	     bindex,
+	     inode->i_ino, inode->i_sb ? au_sbtype(inode->i_sb) : "??",
+	     atomic_read(&inode->i_count), inode->i_nlink, inode->i_mode,
+	     i_size_read(inode), (unsigned long long)inode->i_blocks,
+	     (long long)timespec_to_ns(&inode->i_ctime) & 0x0ffff,
+	     inode->i_mapping ? inode->i_mapping->nrpages : 0,
+	     inode->i_state, inode->i_flags, inode->i_generation,
+	     l ? ", wh " : "", l, n);
+	return 0;
+}
+
+void au_dpri_inode(struct inode *inode)
+{
+	struct au_iinfo *iinfo;
+	aufs_bindex_t bindex;
+	int err;
+
+	err = do_pri_inode(-1, inode, NULL);
+	if (err || !au_test_aufs(inode->i_sb))
+		return;
+
+	iinfo = au_ii(inode);
+	if (!iinfo)
+		return;
+	dpri("i-1: bstart %d, bend %d, gen %d\n",
+	     iinfo->ii_bstart, iinfo->ii_bend, au_iigen(inode));
+	if (iinfo->ii_bstart < 0)
+		return;
+	for (bindex = iinfo->ii_bstart; bindex <= iinfo->ii_bend; bindex++)
+		do_pri_inode(bindex, iinfo->ii_hinode[0 + bindex].hi_inode,
+			     iinfo->ii_hinode[0 + bindex].hi_whdentry);
+}
+
+static int do_pri_dentry(aufs_bindex_t bindex, struct dentry *dentry)
+{
+	struct dentry *wh = NULL;
+
+	if (!dentry || IS_ERR(dentry)) {
+		dpri("d%d: err %ld\n", bindex, PTR_ERR(dentry));
+		return -1;
+	}
+	/* do not call dget_parent() here */
+	dpri("d%d: %.*s?/%.*s, %s, cnt %d, flags 0x%x\n",
+	     bindex,
+	     AuDLNPair(dentry->d_parent), AuDLNPair(dentry),
+	     dentry->d_sb ? au_sbtype(dentry->d_sb) : "??",
+	     atomic_read(&dentry->d_count), dentry->d_flags);
+	if (bindex >= 0 && dentry->d_inode && au_test_aufs(dentry->d_sb)) {
+		struct au_iinfo *iinfo = au_ii(dentry->d_inode);
+		if (iinfo)
+			wh = iinfo->ii_hinode[0 + bindex].hi_whdentry;
+	}
+	do_pri_inode(bindex, dentry->d_inode, wh);
+	return 0;
+}
+
+void au_dpri_dentry(struct dentry *dentry)
+{
+	struct au_dinfo *dinfo;
+	aufs_bindex_t bindex;
+	int err;
+
+	err = do_pri_dentry(-1, dentry);
+	if (err || !au_test_aufs(dentry->d_sb))
+		return;
+
+	dinfo = au_di(dentry);
+	if (!dinfo)
+		return;
+	dpri("d-1: bstart %d, bend %d, bwh %d, bdiropq %d, gen %d\n",
+	     dinfo->di_bstart, dinfo->di_bend,
+	     dinfo->di_bwh, dinfo->di_bdiropq, au_digen(dentry));
+	if (dinfo->di_bstart < 0)
+		return;
+	for (bindex = dinfo->di_bstart; bindex <= dinfo->di_bend; bindex++)
+		do_pri_dentry(bindex, dinfo->di_hdentry[0 + bindex].hd_dentry);
+}
+
+static int do_pri_file(aufs_bindex_t bindex, struct file *file)
+{
+	char a[32];
+
+	if (!file || IS_ERR(file)) {
+		dpri("f%d: err %ld\n", bindex, PTR_ERR(file));
+		return -1;
+	}
+	a[0] = 0;
+	if (bindex < 0
+	    && file->f_dentry
+	    && au_test_aufs(file->f_dentry->d_sb)
+	    && au_fi(file))
+		snprintf(a, sizeof(a), ", mmapped %d", au_test_mmapped(file));
+	dpri("f%d: mode 0x%x, flags 0%o, cnt %ld, pos %llu%s\n",
+	     bindex, file->f_mode, file->f_flags, (long)file_count(file),
+	     file->f_pos, a);
+	if (file->f_dentry)
+		do_pri_dentry(bindex, file->f_dentry);
+	return 0;
+}
+
+void au_dpri_file(struct file *file)
+{
+	struct au_finfo *finfo;
+	aufs_bindex_t bindex;
+	int err;
+
+	err = do_pri_file(-1, file);
+	if (err || !file->f_dentry || !au_test_aufs(file->f_dentry->d_sb))
+		return;
+
+	finfo = au_fi(file);
+	if (!finfo)
+		return;
+	if (finfo->fi_bstart < 0)
+		return;
+	for (bindex = finfo->fi_bstart; bindex <= finfo->fi_bend; bindex++) {
+		struct au_hfile *hf;
+
+		hf = finfo->fi_hfile + bindex;
+		do_pri_file(bindex, hf ? hf->hf_file : NULL);
+	}
+}
+
+static int do_pri_br(aufs_bindex_t bindex, struct au_branch *br)
+{
+	struct vfsmount *mnt;
+	struct super_block *sb;
+
+	if (!br || IS_ERR(br))
+		goto out;
+	mnt = br->br_mnt;
+	if (!mnt || IS_ERR(mnt))
+		goto out;
+	sb = mnt->mnt_sb;
+	if (!sb || IS_ERR(sb))
+		goto out;
+
+	dpri("s%d: {perm 0x%x, cnt %d, wbr %p}, "
+	     "%s, dev 0x%02x%02x, flags 0x%lx, cnt(BIAS) %d, active %d, "
+	     "xino %d\n",
+	     bindex, br->br_perm, atomic_read(&br->br_count), br->br_wbr,
+	     au_sbtype(sb), MAJOR(sb->s_dev), MINOR(sb->s_dev),
+	     sb->s_flags, sb->s_count - S_BIAS,
+	     atomic_read(&sb->s_active), !!br->br_xino.xi_file);
+	return 0;
+
+ out:
+	dpri("s%d: err %ld\n", bindex, PTR_ERR(br));
+	return -1;
+}
+
+void au_dpri_sb(struct super_block *sb)
+{
+	struct au_sbinfo *sbinfo;
+	aufs_bindex_t bindex;
+	int err;
+	/* to reuduce stack size */
+	struct {
+		struct vfsmount mnt;
+		struct au_branch fake;
+	} *a;
+
+	/* this function can be called from magic sysrq */
+	a = kzalloc(sizeof(*a), GFP_ATOMIC);
+	if (unlikely(!a)) {
+		dpri("no memory\n");
+		return;
+	}
+
+	a->mnt.mnt_sb = sb;
+	a->fake.br_perm = 0;
+	a->fake.br_mnt = &a->mnt;
+	a->fake.br_xino.xi_file = NULL;
+	atomic_set(&a->fake.br_count, 0);
+	smp_mb(); /* atomic_set */
+	err = do_pri_br(-1, &a->fake);
+	kfree(a);
+	dpri("dev 0x%x\n", sb->s_dev);
+	if (err || !au_test_aufs(sb))
+		return;
+
+	sbinfo = au_sbi(sb);
+	if (!sbinfo)
+		return;
+	dpri("nw %d, gen %u, kobj %d\n",
+	     atomic_read(&sbinfo->si_nowait.nw_len), sbinfo->si_generation,
+	     atomic_read(&sbinfo->si_kobj.kref.refcount));
+	for (bindex = 0; bindex <= sbinfo->si_bend; bindex++)
+		do_pri_br(bindex, sbinfo->si_branch[0 + bindex]);
+}
+
+/* ---------------------------------------------------------------------- */
+
+void au_dbg_sleep_jiffy(int jiffy)
+{
+	while (jiffy)
+		jiffy = schedule_timeout_uninterruptible(jiffy);
+}
+
+void au_dbg_iattr(struct iattr *ia)
+{
+#define AuBit(name)	if (ia->ia_valid & ATTR_ ## name) \
+				dpri(#name "\n")
+	AuBit(MODE);
+	AuBit(UID);
+	AuBit(GID);
+	AuBit(SIZE);
+	AuBit(ATIME);
+	AuBit(MTIME);
+	AuBit(CTIME);
+	AuBit(ATIME_SET);
+	AuBit(MTIME_SET);
+	AuBit(FORCE);
+	AuBit(ATTR_FLAG);
+	AuBit(KILL_SUID);
+	AuBit(KILL_SGID);
+	AuBit(FILE);
+	AuBit(KILL_PRIV);
+	AuBit(OPEN);
+	AuBit(TIMES_SET);
+#undef	AuBit
+	dpri("ia_file %p\n", ia->ia_file);
+}
+
+/* ---------------------------------------------------------------------- */
+
+void au_dbg_verify_dir_parent(struct dentry *dentry, unsigned int sigen)
+{
+	struct dentry *parent;
+
+	parent = dget_parent(dentry);
+	AuDebugOn(!S_ISDIR(dentry->d_inode->i_mode)
+		  || IS_ROOT(dentry)
+		  || au_digen(parent) != sigen);
+	dput(parent);
+}
+
+void au_dbg_verify_nondir_parent(struct dentry *dentry, unsigned int sigen)
+{
+	struct dentry *parent;
+
+	parent = dget_parent(dentry);
+	AuDebugOn(S_ISDIR(dentry->d_inode->i_mode)
+		  || au_digen(parent) != sigen);
+	dput(parent);
+}
+
+void au_dbg_verify_gen(struct dentry *parent, unsigned int sigen)
+{
+	int err, i, j;
+	struct au_dcsub_pages dpages;
+	struct au_dpage *dpage;
+	struct dentry **dentries;
+
+	err = au_dpages_init(&dpages, GFP_NOFS);
+	AuDebugOn(err);
+	err = au_dcsub_pages_rev(&dpages, parent, /*do_include*/1, NULL, NULL);
+	AuDebugOn(err);
+	for (i = dpages.ndpage - 1; !err && i >= 0; i--) {
+		dpage = dpages.dpages + i;
+		dentries = dpage->dentries;
+		for (j = dpage->ndentry - 1; !err && j >= 0; j--)
+			AuDebugOn(au_digen(dentries[j]) != sigen);
+	}
+	au_dpages_free(&dpages);
+}
+
+void au_dbg_verify_hf(struct au_finfo *finfo)
+{
+	struct au_hfile *hf;
+	aufs_bindex_t bend, bindex;
+
+	if (finfo->fi_bstart >= 0) {
+		bend = finfo->fi_bend;
+		for (bindex = finfo->fi_bstart; bindex <= bend; bindex++) {
+			hf = finfo->fi_hfile + bindex;
+			AuDebugOn(hf->hf_file || hf->hf_br);
+		}
+	}
+}
+
+void au_dbg_verify_kthread(void)
+{
+	if (au_test_wkq(current)) {
+		au_dbg_blocked();
+		BUG();
+	}
+}
+
+/* ---------------------------------------------------------------------- */
+
+void au_debug_sbinfo_init(struct au_sbinfo *sbinfo __maybe_unused)
+{
+#ifdef AuForceNoPlink
+	au_opt_clr(sbinfo->si_mntflags, PLINK);
+#endif
+#ifdef AuForceNoXino
+	au_opt_clr(sbinfo->si_mntflags, XINO);
+#endif
+#ifdef AuForceNoRefrof
+	au_opt_clr(sbinfo->si_mntflags, REFROF);
+#endif
+#ifdef AuForceHinotify
+	au_opt_set_udba(sbinfo->si_mntflags, UDBA_HINOTIFY);
+#endif
+}
+
+int __init au_debug_init(void)
+{
+	aufs_bindex_t bindex;
+	struct au_vdir_destr destr;
+
+	bindex = -1;
+	AuDebugOn(bindex >= 0);
+
+	destr.len = -1;
+	AuDebugOn(destr.len < NAME_MAX);
+
+#ifdef CONFIG_4KSTACKS
+	AuWarn("CONFIG_4KSTACKS is defined.\n");
+#endif
+
+#ifdef AuForceNoBrs
+	sysaufs_brs = 0;
+#endif
+
+	return 0;
+}
--- linux-rt-2.6.31.orig/ubuntu/aufs/sysaufs.h
+++ linux-rt-2.6.31/ubuntu/aufs/sysaufs.h
@@ -0,0 +1,120 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * sysfs interface and mount lifetime management
+ */
+
+#ifndef __SYSAUFS_H__
+#define __SYSAUFS_H__
+
+#ifdef __KERNEL__
+
+#include <linux/sysfs.h>
+#include <linux/aufs_type.h>
+#include "module.h"
+
+struct super_block;
+struct au_sbinfo;
+
+struct sysaufs_si_attr {
+	struct attribute attr;
+	int (*show)(struct seq_file *seq, struct super_block *sb);
+};
+
+/* ---------------------------------------------------------------------- */
+
+/* sysaufs.c */
+extern unsigned long sysaufs_si_mask;
+extern struct kset *sysaufs_ket;
+extern struct attribute *sysaufs_si_attrs[];
+int sysaufs_si_init(struct au_sbinfo *sbinfo);
+int __init sysaufs_init(void);
+void sysaufs_fin(void);
+
+/* ---------------------------------------------------------------------- */
+
+/* some people doesn't like to show a pointer in kernel */
+static inline unsigned long sysaufs_si_id(struct au_sbinfo *sbinfo)
+{
+	return sysaufs_si_mask ^ (unsigned long)sbinfo;
+}
+
+#define SysaufsSiNamePrefix	"si_"
+#define SysaufsSiNameLen	(sizeof(SysaufsSiNamePrefix) + 16)
+static inline void sysaufs_name(struct au_sbinfo *sbinfo, char *name)
+{
+	snprintf(name, SysaufsSiNameLen, SysaufsSiNamePrefix "%lx",
+		 sysaufs_si_id(sbinfo));
+}
+
+struct au_branch;
+#ifdef CONFIG_SYSFS
+/* sysfs.c */
+extern struct attribute_group *sysaufs_attr_group;
+
+int sysaufs_si_xi_path(struct seq_file *seq, struct super_block *sb);
+ssize_t sysaufs_si_show(struct kobject *kobj, struct attribute *attr,
+			 char *buf);
+
+void sysaufs_br_init(struct au_branch *br);
+void sysaufs_brs_add(struct super_block *sb, aufs_bindex_t bindex);
+void sysaufs_brs_del(struct super_block *sb, aufs_bindex_t bindex);
+
+#define sysaufs_brs_init()	do {} while (0)
+
+#else
+#define sysaufs_attr_group	NULL
+
+static inline
+int sysaufs_si_xi_path(struct seq_file *seq, struct super_block *sb)
+{
+	return 0;
+}
+
+static inline
+ssize_t sysaufs_si_show(struct kobject *kobj, struct attribute *attr,
+			 char *buf)
+{
+	return 0;
+}
+
+static inline void sysaufs_br_init(struct au_branch *br)
+{
+	/* empty */
+}
+
+static inline void sysaufs_brs_add(struct super_block *sb, aufs_bindex_t bindex)
+{
+	/* nothing */
+}
+
+static inline void sysaufs_brs_del(struct super_block *sb, aufs_bindex_t bindex)
+{
+	/* nothing */
+}
+
+static inline void sysaufs_brs_init(void)
+{
+	sysaufs_brs = 0;
+}
+
+#endif /* CONFIG_SYSFS */
+
+#endif /* __KERNEL__ */
+#endif /* __SYSAUFS_H__ */
--- linux-rt-2.6.31.orig/ubuntu/aufs/super.c
+++ linux-rt-2.6.31/ubuntu/aufs/super.c
@@ -0,0 +1,874 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * mount and super_block operations
+ */
+
+#include <linux/buffer_head.h>
+#include <linux/module.h>
+#include <linux/seq_file.h>
+#include <linux/statfs.h>
+#include "aufs.h"
+
+/*
+ * super_operations
+ */
+static struct inode *aufs_alloc_inode(struct super_block *sb __maybe_unused)
+{
+	struct au_icntnr *c;
+
+	c = au_cache_alloc_icntnr();
+	if (c) {
+		inode_init_once(&c->vfs_inode);
+		c->vfs_inode.i_version = 1; /* sigen(sb); */
+		c->iinfo.ii_hinode = NULL;
+		return &c->vfs_inode;
+	}
+	return NULL;
+}
+
+static void aufs_destroy_inode(struct inode *inode)
+{
+	au_iinfo_fin(inode);
+	au_cache_free_icntnr(container_of(inode, struct au_icntnr, vfs_inode));
+}
+
+struct inode *au_iget_locked(struct super_block *sb, ino_t ino)
+{
+	struct inode *inode;
+	int err;
+
+	inode = iget_locked(sb, ino);
+	if (unlikely(!inode)) {
+		inode = ERR_PTR(-ENOMEM);
+		goto out;
+	}
+	if (!(inode->i_state & I_NEW))
+		goto out;
+
+	err = au_xigen_new(inode);
+	if (!err)
+		err = au_iinfo_init(inode);
+	if (!err)
+		inode->i_version++;
+	else {
+		iget_failed(inode);
+		inode = ERR_PTR(err);
+	}
+
+ out:
+	/* never return NULL */
+	AuDebugOn(!inode);
+	AuTraceErrPtr(inode);
+	return inode;
+}
+
+/* lock free root dinfo */
+static int au_show_brs(struct seq_file *seq, struct super_block *sb)
+{
+	int err;
+	aufs_bindex_t bindex, bend;
+	struct path path;
+	struct au_hdentry *hd;
+	struct au_branch *br;
+
+	err = 0;
+	bend = au_sbend(sb);
+	hd = au_di(sb->s_root)->di_hdentry;
+	for (bindex = 0; !err && bindex <= bend; bindex++) {
+		br = au_sbr(sb, bindex);
+		path.mnt = br->br_mnt;
+		path.dentry = hd[bindex].hd_dentry;
+		err = au_seq_path(seq, &path);
+		if (err > 0)
+			err = seq_printf(seq, "=%s",
+					 au_optstr_br_perm(br->br_perm));
+		if (!err && bindex != bend)
+			err = seq_putc(seq, ':');
+	}
+
+	return err;
+}
+
+static void au_show_wbr_create(struct seq_file *m, int v,
+			       struct au_sbinfo *sbinfo)
+{
+	const char *pat;
+
+	AuRwMustAnyLock(&sbinfo->si_rwsem);
+
+	seq_printf(m, ",create=");
+	pat = au_optstr_wbr_create(v);
+	switch (v) {
+	case AuWbrCreate_TDP:
+	case AuWbrCreate_RR:
+	case AuWbrCreate_MFS:
+	case AuWbrCreate_PMFS:
+		seq_printf(m, pat);
+		break;
+	case AuWbrCreate_MFSV:
+		seq_printf(m, /*pat*/"mfs:%lu",
+			   sbinfo->si_wbr_mfs.mfs_expire / HZ);
+		break;
+	case AuWbrCreate_PMFSV:
+		seq_printf(m, /*pat*/"pmfs:%lu",
+			   sbinfo->si_wbr_mfs.mfs_expire / HZ);
+		break;
+	case AuWbrCreate_MFSRR:
+		seq_printf(m, /*pat*/"mfsrr:%llu",
+			   sbinfo->si_wbr_mfs.mfsrr_watermark);
+		break;
+	case AuWbrCreate_MFSRRV:
+		seq_printf(m, /*pat*/"mfsrr:%llu:%lu",
+			   sbinfo->si_wbr_mfs.mfsrr_watermark,
+			   sbinfo->si_wbr_mfs.mfs_expire / HZ);
+		break;
+	}
+}
+
+static int au_show_xino(struct seq_file *seq, struct vfsmount *mnt)
+{
+#ifdef CONFIG_SYSFS
+	return 0;
+#else
+	int err;
+	const int len = sizeof(AUFS_XINO_FNAME) - 1;
+	aufs_bindex_t bindex, brid;
+	struct super_block *sb;
+	struct qstr *name;
+	struct file *f;
+	struct dentry *d, *h_root;
+
+	AuRwMustAnyLock(&sbinfo->si_rwsem);
+
+	err = 0;
+	sb = mnt->mnt_sb;
+	f = au_sbi(sb)->si_xib;
+	if (!f)
+		goto out;
+
+	/* stop printing the default xino path on the first writable branch */
+	h_root = NULL;
+	brid = au_xino_brid(sb);
+	if (brid >= 0) {
+		bindex = au_br_index(sb, brid);
+		h_root = au_di(sb->s_root)->di_hdentry[0 + bindex].hd_dentry;
+	}
+	d = f->f_dentry;
+	name = &d->d_name;
+	/* safe ->d_parent because the file is unlinked */
+	if (d->d_parent == h_root
+	    && name->len == len
+	    && !memcmp(name->name, AUFS_XINO_FNAME, len))
+		goto out;
+
+	seq_puts(seq, ",xino=");
+	err = au_xino_path(seq, f);
+
+ out:
+	return err;
+#endif
+}
+
+/* seq_file will re-call me in case of too long string */
+static int aufs_show_options(struct seq_file *m, struct vfsmount *mnt)
+{
+	int err, n;
+	unsigned int mnt_flags, v;
+	struct super_block *sb;
+	struct au_sbinfo *sbinfo;
+
+#define AuBool(name, str) do { \
+	v = au_opt_test(mnt_flags, name); \
+	if (v != au_opt_test(AuOpt_Def, name)) \
+		seq_printf(m, ",%s" #str, v ? "" : "no"); \
+} while (0)
+
+#define AuStr(name, str) do { \
+	v = mnt_flags & AuOptMask_##name; \
+	if (v != (AuOpt_Def & AuOptMask_##name)) \
+		seq_printf(m, "," #str "=%s", au_optstr_##str(v)); \
+} while (0)
+
+#define AuUInt(name, str, val) do { \
+	if (val != AUFS_##name##_DEF) \
+		seq_printf(m, "," #str "=%u", val); \
+} while (0)
+
+	/* lock free root dinfo */
+	sb = mnt->mnt_sb;
+	si_noflush_read_lock(sb);
+	sbinfo = au_sbi(sb);
+	seq_printf(m, ",si=%lx", sysaufs_si_id(sbinfo));
+
+	mnt_flags = au_mntflags(sb);
+	if (au_opt_test(mnt_flags, XINO)) {
+		err = au_show_xino(m, mnt);
+		if (unlikely(err))
+			goto out;
+	} else
+		seq_puts(m, ",noxino");
+
+	AuBool(TRUNC_XINO, trunc_xino);
+	AuStr(UDBA, udba);
+	AuBool(SHWH, shwh);
+	AuBool(PLINK, plink);
+	/* AuBool(DIRPERM1, dirperm1); */
+	/* AuBool(REFROF, refrof); */
+
+	v = sbinfo->si_wbr_create;
+	if (v != AuWbrCreate_Def)
+		au_show_wbr_create(m, v, sbinfo);
+
+	v = sbinfo->si_wbr_copyup;
+	if (v != AuWbrCopyup_Def)
+		seq_printf(m, ",cpup=%s", au_optstr_wbr_copyup(v));
+
+	v = au_opt_test(mnt_flags, ALWAYS_DIROPQ);
+	if (v != au_opt_test(AuOpt_Def, ALWAYS_DIROPQ))
+		seq_printf(m, ",diropq=%c", v ? 'a' : 'w');
+
+	AuUInt(DIRWH, dirwh, sbinfo->si_dirwh);
+
+	n = sbinfo->si_rdcache / HZ;
+	AuUInt(RDCACHE, rdcache, n);
+
+	AuUInt(RDBLK, rdblk, sbinfo->si_rdblk);
+	AuUInt(RDHASH, rdhash, sbinfo->si_rdhash);
+
+	AuBool(SUM, sum);
+	/* AuBool(SUM_W, wsum); */
+	AuBool(WARN_PERM, warn_perm);
+	AuBool(VERBOSE, verbose);
+
+ out:
+	/* be sure to print "br:" last */
+	if (!sysaufs_brs) {
+		seq_puts(m, ",br:");
+		au_show_brs(m, sb);
+	}
+	si_read_unlock(sb);
+	return 0;
+
+#undef Deleted
+#undef AuBool
+#undef AuStr
+}
+
+/* ---------------------------------------------------------------------- */
+
+/* sum mode which returns the summation for statfs(2) */
+
+static u64 au_add_till_max(u64 a, u64 b)
+{
+	u64 old;
+
+	old = a;
+	a += b;
+	if (old < a)
+		return a;
+	return ULLONG_MAX;
+}
+
+static int au_statfs_sum(struct super_block *sb, struct kstatfs *buf)
+{
+	int err;
+	u64 blocks, bfree, bavail, files, ffree;
+	aufs_bindex_t bend, bindex, i;
+	unsigned char shared;
+	struct vfsmount *h_mnt;
+	struct super_block *h_sb;
+
+	blocks = 0;
+	bfree = 0;
+	bavail = 0;
+	files = 0;
+	ffree = 0;
+
+	err = 0;
+	bend = au_sbend(sb);
+	for (bindex = bend; bindex >= 0; bindex--) {
+		h_mnt = au_sbr_mnt(sb, bindex);
+		h_sb = h_mnt->mnt_sb;
+		shared = 0;
+		for (i = bindex + 1; !shared && i <= bend; i++)
+			shared = (au_sbr_sb(sb, i) == h_sb);
+		if (shared)
+			continue;
+
+		/* sb->s_root for NFS is unreliable */
+		err = vfs_statfs(h_mnt->mnt_root, buf);
+		if (unlikely(err))
+			goto out;
+
+		blocks = au_add_till_max(blocks, buf->f_blocks);
+		bfree = au_add_till_max(bfree, buf->f_bfree);
+		bavail = au_add_till_max(bavail, buf->f_bavail);
+		files = au_add_till_max(files, buf->f_files);
+		ffree = au_add_till_max(ffree, buf->f_ffree);
+	}
+
+	buf->f_blocks = blocks;
+	buf->f_bfree = bfree;
+	buf->f_bavail = bavail;
+	buf->f_files = files;
+	buf->f_ffree = ffree;
+
+ out:
+	return err;
+}
+
+static int aufs_statfs(struct dentry *dentry, struct kstatfs *buf)
+{
+	int err;
+	struct super_block *sb;
+
+	/* lock free root dinfo */
+	sb = dentry->d_sb;
+	si_noflush_read_lock(sb);
+	if (!au_opt_test(au_mntflags(sb), SUM))
+		/* sb->s_root for NFS is unreliable */
+		err = vfs_statfs(au_sbr_mnt(sb, 0)->mnt_root, buf);
+	else
+		err = au_statfs_sum(sb, buf);
+	si_read_unlock(sb);
+
+	if (!err) {
+		buf->f_type = AUFS_SUPER_MAGIC;
+		buf->f_namelen -= AUFS_WH_PFX_LEN;
+		memset(&buf->f_fsid, 0, sizeof(buf->f_fsid));
+	}
+	/* buf->f_bsize = buf->f_blocks = buf->f_bfree = buf->f_bavail = -1; */
+
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+/* try flushing the lower fs at aufs remount/unmount time */
+
+static void au_fsync_br(struct super_block *sb)
+{
+	aufs_bindex_t bend, bindex;
+	int brperm;
+	struct au_branch *br;
+	struct super_block *h_sb;
+
+	bend = au_sbend(sb);
+	for (bindex = 0; bindex < bend; bindex++) {
+		br = au_sbr(sb, bindex);
+		brperm = br->br_perm;
+		if (brperm == AuBrPerm_RR || brperm == AuBrPerm_RRWH)
+			continue;
+		h_sb = br->br_mnt->mnt_sb;
+		if (bdev_read_only(h_sb->s_bdev))
+			continue;
+
+		lockdep_off();
+		down_write(&h_sb->s_umount);
+		shrink_dcache_sb(h_sb);
+		sync_filesystem(h_sb);
+		up_write(&h_sb->s_umount);
+		lockdep_on();
+	}
+}
+
+/*
+ * this IS NOT for super_operations.
+ * I guess it will be reverted someday.
+ */
+static void aufs_umount_begin(struct super_block *sb)
+{
+	struct au_sbinfo *sbinfo;
+
+	sbinfo = au_sbi(sb);
+	if (!sbinfo)
+		return;
+
+	si_write_lock(sb);
+	au_fsync_br(sb);
+	if (au_opt_test(au_mntflags(sb), PLINK))
+		au_plink_put(sb);
+	if (sbinfo->si_wbr_create_ops->fin)
+		sbinfo->si_wbr_create_ops->fin(sb);
+	si_write_unlock(sb);
+}
+
+/* final actions when unmounting a file system */
+static void aufs_put_super(struct super_block *sb)
+{
+	struct au_sbinfo *sbinfo;
+
+	sbinfo = au_sbi(sb);
+	if (!sbinfo)
+		return;
+
+	aufs_umount_begin(sb);
+	dbgaufs_si_fin(sbinfo);
+	kobject_put(&sbinfo->si_kobj);
+}
+
+/* ---------------------------------------------------------------------- */
+
+/*
+ * refresh dentry and inode at remount time.
+ */
+static int do_refresh(struct dentry *dentry, mode_t type,
+		      unsigned int dir_flags)
+{
+	int err;
+	struct dentry *parent;
+
+	di_write_lock_child(dentry);
+	parent = dget_parent(dentry);
+	di_read_lock_parent(parent, AuLock_IR);
+
+	/* returns the number of positive dentries */
+	err = au_refresh_hdentry(dentry, type);
+	if (err >= 0) {
+		struct inode *inode = dentry->d_inode;
+		err = au_refresh_hinode(inode, dentry);
+		if (!err && type == S_IFDIR)
+			au_reset_hinotify(inode, dir_flags);
+	}
+	if (unlikely(err))
+		AuErr("unrecoverable error %d, %.*s\n", err, AuDLNPair(dentry));
+
+	di_read_unlock(parent, AuLock_IR);
+	dput(parent);
+	di_write_unlock(dentry);
+
+	return err;
+}
+
+static int test_dir(struct dentry *dentry, void *arg __maybe_unused)
+{
+	return S_ISDIR(dentry->d_inode->i_mode);
+}
+
+/* gave up consolidating with refresh_nondir() */
+static int refresh_dir(struct dentry *root, unsigned int sigen)
+{
+	int err, i, j, ndentry, e;
+	struct au_dcsub_pages dpages;
+	struct au_dpage *dpage;
+	struct dentry **dentries;
+	struct inode *inode;
+	const unsigned int flags = au_hi_flags(root->d_inode, /*isdir*/1);
+
+	err = 0;
+	list_for_each_entry(inode, &root->d_sb->s_inodes, i_sb_list)
+		if (S_ISDIR(inode->i_mode) && au_iigen(inode) != sigen) {
+			ii_write_lock_child(inode);
+			e = au_refresh_hinode_self(inode, /*do_attr*/1);
+			ii_write_unlock(inode);
+			if (unlikely(e)) {
+				AuDbg("e %d, i%lu\n", e, inode->i_ino);
+				if (!err)
+					err = e;
+				/* go on even if err */
+			}
+		}
+
+	e = au_dpages_init(&dpages, GFP_NOFS);
+	if (unlikely(e)) {
+		if (!err)
+			err = e;
+		goto out;
+	}
+	e = au_dcsub_pages(&dpages, root, test_dir, NULL);
+	if (unlikely(e)) {
+		if (!err)
+			err = e;
+		goto out_dpages;
+	}
+
+	for (i = 0; !e && i < dpages.ndpage; i++) {
+		dpage = dpages.dpages + i;
+		dentries = dpage->dentries;
+		ndentry = dpage->ndentry;
+		for (j = 0; !e && j < ndentry; j++) {
+			struct dentry *d;
+
+			d = dentries[j];
+			au_dbg_verify_dir_parent(d, sigen);
+			if (au_digen(d) != sigen) {
+				e = do_refresh(d, S_IFDIR, flags);
+				if (unlikely(e && !err))
+					err = e;
+				/* break on err */
+			}
+		}
+	}
+
+ out_dpages:
+	au_dpages_free(&dpages);
+ out:
+	return err;
+}
+
+static int test_nondir(struct dentry *dentry, void *arg __maybe_unused)
+{
+	return !S_ISDIR(dentry->d_inode->i_mode);
+}
+
+static int refresh_nondir(struct dentry *root, unsigned int sigen,
+			  int do_dentry)
+{
+	int err, i, j, ndentry, e;
+	struct au_dcsub_pages dpages;
+	struct au_dpage *dpage;
+	struct dentry **dentries;
+	struct inode *inode;
+
+	err = 0;
+	list_for_each_entry(inode, &root->d_sb->s_inodes, i_sb_list)
+		if (!S_ISDIR(inode->i_mode) && au_iigen(inode) != sigen) {
+			ii_write_lock_child(inode);
+			e = au_refresh_hinode_self(inode, /*do_attr*/1);
+			ii_write_unlock(inode);
+			if (unlikely(e)) {
+				AuDbg("e %d, i%lu\n", e, inode->i_ino);
+				if (!err)
+					err = e;
+				/* go on even if err */
+			}
+		}
+
+	if (!do_dentry)
+		goto out;
+
+	e = au_dpages_init(&dpages, GFP_NOFS);
+	if (unlikely(e)) {
+		if (!err)
+			err = e;
+		goto out;
+	}
+	e = au_dcsub_pages(&dpages, root, test_nondir, NULL);
+	if (unlikely(e)) {
+		if (!err)
+			err = e;
+		goto out_dpages;
+	}
+
+	for (i = 0; i < dpages.ndpage; i++) {
+		dpage = dpages.dpages + i;
+		dentries = dpage->dentries;
+		ndentry = dpage->ndentry;
+		for (j = 0; j < ndentry; j++) {
+			struct dentry *d;
+
+			d = dentries[j];
+			au_dbg_verify_nondir_parent(d, sigen);
+			inode = d->d_inode;
+			if (inode && au_digen(d) != sigen) {
+				e = do_refresh(d, inode->i_mode & S_IFMT,
+					       /*dir_flags*/0);
+				if (unlikely(e && !err))
+					err = e;
+				/* go on even err */
+			}
+		}
+	}
+
+ out_dpages:
+	au_dpages_free(&dpages);
+ out:
+	return err;
+}
+
+static void au_remount_refresh(struct super_block *sb, unsigned int flags)
+{
+	int err;
+	unsigned int sigen;
+	struct au_sbinfo *sbinfo;
+	struct dentry *root;
+	struct inode *inode;
+
+	au_sigen_inc(sb);
+	sigen = au_sigen(sb);
+	sbinfo = au_sbi(sb);
+	au_fclr_si(sbinfo, FAILED_REFRESH_DIRS);
+
+	root = sb->s_root;
+	DiMustNoWaiters(root);
+	inode = root->d_inode;
+	IiMustNoWaiters(inode);
+	au_reset_hinotify(inode, au_hi_flags(inode, /*isdir*/1));
+	di_write_unlock(root);
+
+	err = refresh_dir(root, sigen);
+	if (unlikely(err)) {
+		au_fset_si(sbinfo, FAILED_REFRESH_DIRS);
+		AuWarn("Refreshing directories failed, ignored (%d)\n", err);
+	}
+
+	if (au_ftest_opts(flags, REFRESH_NONDIR)) {
+		err = refresh_nondir(root, sigen, !err);
+		if (unlikely(err))
+			AuWarn("Refreshing non-directories failed, ignored"
+			       "(%d)\n", err);
+	}
+
+	/* aufs_write_lock() calls ..._child() */
+	di_write_lock_child(root);
+	au_cpup_attr_all(root->d_inode, /*force*/1);
+}
+
+/* stop extra interpretation of errno in mount(8), and strange error messages */
+static int cvt_err(int err)
+{
+	AuTraceErr(err);
+
+	switch (err) {
+	case -ENOENT:
+	case -ENOTDIR:
+	case -EEXIST:
+	case -EIO:
+		err = -EINVAL;
+	}
+	return err;
+}
+
+static int aufs_remount_fs(struct super_block *sb, int *flags, char *data)
+{
+	int err;
+	struct au_opts opts;
+	struct dentry *root;
+	struct inode *inode;
+	struct au_sbinfo *sbinfo;
+
+	err = 0;
+	root = sb->s_root;
+	if (!data || !*data) {
+		aufs_write_lock(root);
+		err = au_opts_verify(sb, *flags, /*pending*/0);
+		if (!err)
+			au_fsync_br(sb);
+		aufs_write_unlock(root);
+		goto out;
+	}
+
+	err = -ENOMEM;
+	memset(&opts, 0, sizeof(opts));
+	opts.opt = (void *)__get_free_page(GFP_NOFS);
+	if (unlikely(!opts.opt))
+		goto out;
+	opts.max_opt = PAGE_SIZE / sizeof(*opts.opt);
+	opts.flags = AuOpts_REMOUNT;
+	opts.sb_flags = *flags;
+
+	/* parse it before aufs lock */
+	err = au_opts_parse(sb, data, &opts);
+	if (unlikely(err))
+		goto out_opts;
+
+	sbinfo = au_sbi(sb);
+	inode = root->d_inode;
+	mutex_lock(&inode->i_mutex);
+	aufs_write_lock(root);
+	au_fsync_br(sb);
+
+	/* au_opts_remount() may return an error */
+	err = au_opts_remount(sb, &opts);
+	au_opts_free(&opts);
+
+	if (au_ftest_opts(opts.flags, REFRESH_DIR)
+	    || au_ftest_opts(opts.flags, REFRESH_NONDIR))
+		au_remount_refresh(sb, opts.flags);
+
+	aufs_write_unlock(root);
+	mutex_unlock(&inode->i_mutex);
+
+ out_opts:
+	free_page((unsigned long)opts.opt);
+ out:
+	err = cvt_err(err);
+	AuTraceErr(err);
+	return err;
+}
+
+static struct super_operations aufs_sop = {
+	.alloc_inode	= aufs_alloc_inode,
+	.destroy_inode	= aufs_destroy_inode,
+	.drop_inode	= generic_delete_inode,
+	.show_options	= aufs_show_options,
+	.statfs		= aufs_statfs,
+	.put_super	= aufs_put_super,
+	.remount_fs	= aufs_remount_fs
+};
+
+/* ---------------------------------------------------------------------- */
+
+static int alloc_root(struct super_block *sb)
+{
+	int err;
+	struct inode *inode;
+	struct dentry *root;
+
+	err = -ENOMEM;
+	inode = au_iget_locked(sb, AUFS_ROOT_INO);
+	err = PTR_ERR(inode);
+	if (IS_ERR(inode))
+		goto out;
+
+	inode->i_op = &aufs_dir_iop;
+	inode->i_fop = &aufs_dir_fop;
+	inode->i_mode = S_IFDIR;
+	inode->i_nlink = 2;
+	unlock_new_inode(inode);
+
+	root = d_alloc_root(inode);
+	if (unlikely(!root))
+		goto out_iput;
+	err = PTR_ERR(root);
+	if (IS_ERR(root))
+		goto out_iput;
+
+	err = au_alloc_dinfo(root);
+	if (!err) {
+		sb->s_root = root;
+		return 0; /* success */
+	}
+	dput(root);
+	goto out; /* do not iput */
+
+ out_iput:
+	iget_failed(inode);
+	iput(inode);
+ out:
+	return err;
+
+}
+
+static int aufs_fill_super(struct super_block *sb, void *raw_data,
+			   int silent __maybe_unused)
+{
+	int err;
+	struct au_opts opts;
+	struct dentry *root;
+	struct inode *inode;
+	char *arg = raw_data;
+
+	if (unlikely(!arg || !*arg)) {
+		err = -EINVAL;
+		AuErr("no arg\n");
+		goto out;
+	}
+
+	err = -ENOMEM;
+	memset(&opts, 0, sizeof(opts));
+	opts.opt = (void *)__get_free_page(GFP_NOFS);
+	if (unlikely(!opts.opt))
+		goto out;
+	opts.max_opt = PAGE_SIZE / sizeof(*opts.opt);
+	opts.sb_flags = sb->s_flags;
+
+	err = au_si_alloc(sb);
+	if (unlikely(err))
+		goto out_opts;
+
+	/* all timestamps always follow the ones on the branch */
+	sb->s_flags |= MS_NOATIME | MS_NODIRATIME;
+	sb->s_op = &aufs_sop;
+	sb->s_magic = AUFS_SUPER_MAGIC;
+	sb->s_maxbytes = 0;
+	au_export_init(sb);
+
+	err = alloc_root(sb);
+	if (unlikely(err)) {
+		si_write_unlock(sb);
+		goto out_info;
+	}
+	root = sb->s_root;
+	inode = root->d_inode;
+
+	/*
+	 * actually we can parse options regardless aufs lock here.
+	 * but at remount time, parsing must be done before aufs lock.
+	 * so we follow the same rule.
+	 */
+	ii_write_lock_parent(inode);
+	aufs_write_unlock(root);
+	err = au_opts_parse(sb, arg, &opts);
+	if (unlikely(err))
+		goto out_root;
+
+	/* lock vfs_inode first, then aufs. */
+	mutex_lock(&inode->i_mutex);
+	inode->i_op = &aufs_dir_iop;
+	inode->i_fop = &aufs_dir_fop;
+	aufs_write_lock(root);
+	err = au_opts_mount(sb, &opts);
+	au_opts_free(&opts);
+	if (unlikely(err))
+		goto out_unlock;
+	aufs_write_unlock(root);
+	mutex_unlock(&inode->i_mutex);
+	goto out_opts; /* success */
+
+ out_unlock:
+	aufs_write_unlock(root);
+	mutex_unlock(&inode->i_mutex);
+ out_root:
+	dput(root);
+	sb->s_root = NULL;
+ out_info:
+	kobject_put(&au_sbi(sb)->si_kobj);
+	sb->s_fs_info = NULL;
+ out_opts:
+	free_page((unsigned long)opts.opt);
+ out:
+	AuTraceErr(err);
+	err = cvt_err(err);
+	AuTraceErr(err);
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+static int aufs_get_sb(struct file_system_type *fs_type, int flags,
+		       const char *dev_name __maybe_unused, void *raw_data,
+		       struct vfsmount *mnt)
+{
+	int err;
+	struct super_block *sb;
+
+	/* all timestamps always follow the ones on the branch */
+	/* mnt->mnt_flags |= MNT_NOATIME | MNT_NODIRATIME; */
+	err = get_sb_nodev(fs_type, flags, raw_data, aufs_fill_super, mnt);
+	if (!err) {
+		sb = mnt->mnt_sb;
+		si_write_lock(sb);
+		sysaufs_brs_add(sb, 0);
+		si_write_unlock(sb);
+	}
+	return err;
+}
+
+struct file_system_type aufs_fs_type = {
+	.name		= AUFS_FSTYPE,
+	.fs_flags	=
+		FS_RENAME_DOES_D_MOVE	/* a race between rename and others */
+		| FS_REVAL_DOT,		/* for NFS branch and udba */
+	.get_sb		= aufs_get_sb,
+	.kill_sb	= generic_shutdown_super,
+	/* no need to __module_get() and module_put(). */
+	.owner		= THIS_MODULE,
+};
--- linux-rt-2.6.31.orig/ubuntu/aufs/whout.c
+++ linux-rt-2.6.31/ubuntu/aufs/whout.c
@@ -0,0 +1,1048 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * whiteout for logical deletion and opaque directory
+ */
+
+#include <linux/fs.h>
+#include "aufs.h"
+
+#define WH_MASK			S_IRUGO
+
+/*
+ * If a directory contains this file, then it is opaque.  We start with the
+ * .wh. flag so that it is blocked by lookup.
+ */
+static struct qstr diropq_name = {
+	.name = AUFS_WH_DIROPQ,
+	.len = sizeof(AUFS_WH_DIROPQ) - 1
+};
+
+/*
+ * generate whiteout name, which is NOT terminated by NULL.
+ * @name: original d_name.name
+ * @len: original d_name.len
+ * @wh: whiteout qstr
+ * returns zero when succeeds, otherwise error.
+ * succeeded value as wh->name should be freed by kfree().
+ */
+int au_wh_name_alloc(struct qstr *wh, const struct qstr *name)
+{
+	char *p;
+
+	if (unlikely(name->len > PATH_MAX - AUFS_WH_PFX_LEN))
+		return -ENAMETOOLONG;
+
+	wh->len = name->len + AUFS_WH_PFX_LEN;
+	p = kmalloc(wh->len, GFP_NOFS);
+	wh->name = p;
+	if (p) {
+		memcpy(p, AUFS_WH_PFX, AUFS_WH_PFX_LEN);
+		memcpy(p + AUFS_WH_PFX_LEN, name->name, name->len);
+		/* smp_mb(); */
+		return 0;
+	}
+	return -ENOMEM;
+}
+
+/* ---------------------------------------------------------------------- */
+
+/*
+ * test if the @wh_name exists under @h_parent.
+ * @try_sio specifies the necessary of super-io.
+ */
+int au_wh_test(struct dentry *h_parent, struct qstr *wh_name,
+	       struct au_branch *br, int try_sio)
+{
+	int err;
+	struct dentry *wh_dentry;
+	struct inode *h_dir;
+
+	h_dir = h_parent->d_inode;
+	if (!try_sio)
+		wh_dentry = au_lkup_one(wh_name, h_parent, br, /*nd*/NULL);
+	else
+		wh_dentry = au_sio_lkup_one(wh_name, h_parent, br);
+	err = PTR_ERR(wh_dentry);
+	if (IS_ERR(wh_dentry))
+		goto out;
+
+	err = 0;
+	if (!wh_dentry->d_inode)
+		goto out_wh; /* success */
+
+	err = 1;
+	if (S_ISREG(wh_dentry->d_inode->i_mode))
+		goto out_wh; /* success */
+
+	err = -EIO;
+	AuIOErr("%.*s Invalid whiteout entry type 0%o.\n",
+		AuDLNPair(wh_dentry), wh_dentry->d_inode->i_mode);
+
+ out_wh:
+	dput(wh_dentry);
+ out:
+	return err;
+}
+
+/*
+ * test if the @h_dentry sets opaque or not.
+ */
+int au_diropq_test(struct dentry *h_dentry, struct au_branch *br)
+{
+	int err;
+	struct inode *h_dir;
+
+	h_dir = h_dentry->d_inode;
+	err = au_wh_test(h_dentry, &diropq_name, br,
+			 au_test_h_perm_sio(h_dir, MAY_EXEC));
+	return err;
+}
+
+/*
+ * returns a negative dentry whose name is unique and temporary.
+ */
+struct dentry *au_whtmp_lkup(struct dentry *h_parent, struct au_branch *br,
+			     struct qstr *prefix)
+{
+#define HEX_LEN	4
+	struct dentry *dentry;
+	int i;
+	char defname[AUFS_WH_PFX_LEN * 2 + DNAME_INLINE_LEN_MIN + 1
+		     + HEX_LEN + 1], *name, *p;
+	static unsigned short cnt;
+	struct qstr qs;
+
+	name = defname;
+	qs.len = sizeof(defname) - DNAME_INLINE_LEN_MIN + prefix->len - 1;
+	if (unlikely(prefix->len > DNAME_INLINE_LEN_MIN)) {
+		dentry = ERR_PTR(-ENAMETOOLONG);
+		if (unlikely(qs.len >= PATH_MAX))
+			goto out;
+		dentry = ERR_PTR(-ENOMEM);
+		name = kmalloc(qs.len + 1, GFP_NOFS);
+		if (unlikely(!name))
+			goto out;
+	}
+
+	/* doubly whiteout-ed */
+	memcpy(name, AUFS_WH_PFX AUFS_WH_PFX, AUFS_WH_PFX_LEN * 2);
+	p = name + AUFS_WH_PFX_LEN * 2;
+	memcpy(p, prefix->name, prefix->len);
+	p += prefix->len;
+	*p++ = '.';
+	AuDebugOn(name + qs.len + 1 - p <= HEX_LEN);
+
+	qs.name = name;
+	for (i = 0; i < 3; i++) {
+		sprintf(p, "%.*d", HEX_LEN, cnt++);
+		dentry = au_sio_lkup_one(&qs, h_parent, br);
+		if (IS_ERR(dentry) || !dentry->d_inode)
+			goto out_name;
+		dput(dentry);
+	}
+	/* AuWarn("could not get random name\n"); */
+	dentry = ERR_PTR(-EEXIST);
+	AuDbg("%.*s\n", AuLNPair(&qs));
+	BUG();
+
+ out_name:
+	if (name != defname)
+		kfree(name);
+ out:
+	return dentry;
+#undef HEX_LEN
+}
+
+/*
+ * rename the @h_dentry on @br to the whiteouted temporary name.
+ */
+int au_whtmp_ren(struct dentry *h_dentry, struct au_branch *br)
+{
+	int err;
+	struct path h_path = {
+		.mnt = br->br_mnt
+	};
+	struct inode *h_dir;
+	struct dentry *h_parent;
+
+	h_parent = h_dentry->d_parent; /* dir inode is locked */
+	h_dir = h_parent->d_inode;
+	IMustLock(h_dir);
+
+	h_path.dentry = au_whtmp_lkup(h_parent, br, &h_dentry->d_name);
+	err = PTR_ERR(h_path.dentry);
+	if (IS_ERR(h_path.dentry))
+		goto out;
+
+	/* under the same dir, no need to lock_rename() */
+	err = vfsub_rename(h_dir, h_dentry, h_dir, &h_path);
+	AuTraceErr(err);
+	dput(h_path.dentry);
+
+ out:
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+/*
+ * functions for removing a whiteout
+ */
+
+static int do_unlink_wh(struct inode *h_dir, struct path *h_path)
+{
+	int force;
+
+	/*
+	 * forces superio when the dir has a sticky bit.
+	 * this may be a violation of unix fs semantics.
+	 */
+	force = (h_dir->i_mode & S_ISVTX)
+		&& h_path->dentry->d_inode->i_uid != current_fsuid();
+	return vfsub_unlink(h_dir, h_path, force);
+}
+
+int au_wh_unlink_dentry(struct inode *h_dir, struct path *h_path,
+			struct dentry *dentry)
+{
+	int err;
+
+	err = do_unlink_wh(h_dir, h_path);
+	if (!err && dentry)
+		au_set_dbwh(dentry, -1);
+
+	return err;
+}
+
+static int unlink_wh_name(struct dentry *h_parent, struct qstr *wh,
+			  struct au_branch *br)
+{
+	int err;
+	struct path h_path = {
+		.mnt = br->br_mnt
+	};
+
+	err = 0;
+	h_path.dentry = au_lkup_one(wh, h_parent, br, /*nd*/NULL);
+	if (IS_ERR(h_path.dentry))
+		err = PTR_ERR(h_path.dentry);
+	else {
+		if (h_path.dentry->d_inode
+		    && S_ISREG(h_path.dentry->d_inode->i_mode))
+			err = do_unlink_wh(h_parent->d_inode, &h_path);
+		dput(h_path.dentry);
+	}
+
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+/*
+ * initialize/clean whiteout for a branch
+ */
+
+static void au_wh_clean(struct inode *h_dir, struct path *whpath,
+			const int isdir)
+{
+	int err;
+
+	if (!whpath->dentry->d_inode)
+		return;
+
+	err = mnt_want_write(whpath->mnt);
+	if (!err) {
+		if (isdir)
+			err = vfsub_rmdir(h_dir, whpath);
+		else
+			err = vfsub_unlink(h_dir, whpath, /*force*/0);
+		mnt_drop_write(whpath->mnt);
+	}
+	if (unlikely(err))
+		AuWarn("failed removing %.*s (%d), ignored.\n",
+		       AuDLNPair(whpath->dentry), err);
+}
+
+static int test_linkable(struct dentry *h_root)
+{
+	struct inode *h_dir = h_root->d_inode;
+
+	if (h_dir->i_op->link)
+		return 0;
+
+	AuErr("%.*s (%s) doesn't support link(2), use noplink and rw+nolwh\n",
+	      AuDLNPair(h_root), au_sbtype(h_root->d_sb));
+	return -ENOSYS;
+}
+
+/* todo: should this mkdir be done in /sbin/mount.aufs helper? */
+static int au_whdir(struct inode *h_dir, struct path *path)
+{
+	int err;
+
+	err = -EEXIST;
+	if (!path->dentry->d_inode) {
+		int mode = S_IRWXU;
+
+		if (au_test_nfs(path->dentry->d_sb))
+			mode |= S_IXUGO;
+		err = mnt_want_write(path->mnt);
+		if (!err) {
+			err = vfsub_mkdir(h_dir, path, mode);
+			mnt_drop_write(path->mnt);
+		}
+	} else if (S_ISDIR(path->dentry->d_inode->i_mode))
+		err = 0;
+	else
+		AuErr("unknown %.*s exists\n", AuDLNPair(path->dentry));
+
+	return err;
+}
+
+struct au_wh_base {
+	const struct qstr *name;
+	struct dentry *dentry;
+};
+
+static void au_wh_init_ro(struct inode *h_dir, struct au_wh_base base[],
+			  struct path *h_path)
+{
+	h_path->dentry = base[AuBrWh_BASE].dentry;
+	au_wh_clean(h_dir, h_path, /*isdir*/0);
+	h_path->dentry = base[AuBrWh_PLINK].dentry;
+	au_wh_clean(h_dir, h_path, /*isdir*/1);
+	h_path->dentry = base[AuBrWh_ORPH].dentry;
+	au_wh_clean(h_dir, h_path, /*isdir*/1);
+}
+
+/*
+ * returns tri-state,
+ * minus: error, caller should print the mesage
+ * zero: succuess
+ * plus: error, caller should NOT print the mesage
+ */
+static int au_wh_init_rw_nolink(struct dentry *h_root, struct au_wbr *wbr,
+				int do_plink, struct au_wh_base base[],
+				struct path *h_path)
+{
+	int err;
+	struct inode *h_dir;
+
+	h_dir = h_root->d_inode;
+	h_path->dentry = base[AuBrWh_BASE].dentry;
+	au_wh_clean(h_dir, h_path, /*isdir*/0);
+	h_path->dentry = base[AuBrWh_PLINK].dentry;
+	if (do_plink) {
+		err = test_linkable(h_root);
+		if (unlikely(err)) {
+			err = 1;
+			goto out;
+		}
+
+		err = au_whdir(h_dir, h_path);
+		if (unlikely(err))
+			goto out;
+		wbr->wbr_plink = dget(base[AuBrWh_PLINK].dentry);
+	} else
+		au_wh_clean(h_dir, h_path, /*isdir*/1);
+	h_path->dentry = base[AuBrWh_ORPH].dentry;
+	err = au_whdir(h_dir, h_path);
+	if (unlikely(err))
+		goto out;
+	wbr->wbr_orph = dget(base[AuBrWh_ORPH].dentry);
+
+ out:
+	return err;
+}
+
+/*
+ * for the moment, aufs supports the branch filesystem which does not support
+ * link(2). testing on FAT which does not support i_op->setattr() fully either,
+ * copyup failed. finally, such filesystem will not be used as the writable
+ * branch.
+ *
+ * returns tri-state, see above.
+ */
+static int au_wh_init_rw(struct dentry *h_root, struct au_wbr *wbr,
+			 int do_plink, struct au_wh_base base[],
+			 struct path *h_path)
+{
+	int err;
+	struct inode *h_dir;
+
+	WbrWhMustWriteLock(wbr);
+
+	err = test_linkable(h_root);
+	if (unlikely(err)) {
+		err = 1;
+		goto out;
+	}
+
+	/*
+	 * todo: should this create be done in /sbin/mount.aufs helper?
+	 */
+	err = -EEXIST;
+	h_dir = h_root->d_inode;
+	if (!base[AuBrWh_BASE].dentry->d_inode) {
+		err = mnt_want_write(h_path->mnt);
+		if (!err) {
+			h_path->dentry = base[AuBrWh_BASE].dentry;
+			err = vfsub_create(h_dir, h_path, WH_MASK);
+			mnt_drop_write(h_path->mnt);
+		}
+	} else if (S_ISREG(base[AuBrWh_BASE].dentry->d_inode->i_mode))
+		err = 0;
+	else
+		AuErr("unknown %.*s/%.*s exists\n",
+		      AuDLNPair(h_root), AuDLNPair(base[AuBrWh_BASE].dentry));
+	if (unlikely(err))
+		goto out;
+
+	h_path->dentry = base[AuBrWh_PLINK].dentry;
+	if (do_plink) {
+		err = au_whdir(h_dir, h_path);
+		if (unlikely(err))
+			goto out;
+		wbr->wbr_plink = dget(base[AuBrWh_PLINK].dentry);
+	} else
+		au_wh_clean(h_dir, h_path, /*isdir*/1);
+	wbr->wbr_whbase = dget(base[AuBrWh_BASE].dentry);
+
+	h_path->dentry = base[AuBrWh_ORPH].dentry;
+	err = au_whdir(h_dir, h_path);
+	if (unlikely(err))
+		goto out;
+	wbr->wbr_orph = dget(base[AuBrWh_ORPH].dentry);
+
+ out:
+	return err;
+}
+
+/*
+ * initialize the whiteout base file/dir for @br.
+ */
+int au_wh_init(struct dentry *h_root, struct au_branch *br,
+	       struct super_block *sb)
+{
+	int err, i;
+	const unsigned char do_plink
+		= !!au_opt_test(au_mntflags(sb), PLINK);
+	struct path path = {
+		.mnt = br->br_mnt
+	};
+	struct inode *h_dir;
+	struct au_wbr *wbr = br->br_wbr;
+	static const struct qstr base_name[] = {
+		[AuBrWh_BASE] = {
+			.name	= AUFS_BASE_NAME,
+			.len	= sizeof(AUFS_BASE_NAME) - 1
+		},
+		[AuBrWh_PLINK] = {
+			.name	= AUFS_PLINKDIR_NAME,
+			.len	= sizeof(AUFS_PLINKDIR_NAME) - 1
+		},
+		[AuBrWh_ORPH] = {
+			.name	= AUFS_ORPHDIR_NAME,
+			.len	= sizeof(AUFS_ORPHDIR_NAME) - 1
+		}
+	};
+	struct au_wh_base base[] = {
+		[AuBrWh_BASE] = {
+			.name	= base_name + AuBrWh_BASE,
+			.dentry	= NULL
+		},
+		[AuBrWh_PLINK] = {
+			.name	= base_name + AuBrWh_PLINK,
+			.dentry	= NULL
+		},
+		[AuBrWh_ORPH] = {
+			.name	= base_name + AuBrWh_ORPH,
+			.dentry	= NULL
+		}
+	};
+
+	if (wbr)
+		WbrWhMustWriteLock(wbr);
+
+	h_dir = h_root->d_inode;
+	for (i = 0; i < AuBrWh_Last; i++) {
+		/* doubly whiteouted */
+		struct dentry *d;
+
+		d = au_wh_lkup(h_root, (void *)base[i].name, br);
+		err = PTR_ERR(d);
+		if (IS_ERR(d))
+			goto out;
+
+		base[i].dentry = d;
+		AuDebugOn(wbr
+			  && wbr->wbr_wh[i]
+			  && wbr->wbr_wh[i] != base[i].dentry);
+	}
+
+	if (wbr)
+		for (i = 0; i < AuBrWh_Last; i++) {
+			dput(wbr->wbr_wh[i]);
+			wbr->wbr_wh[i] = NULL;
+		}
+
+	err = 0;
+
+	switch (br->br_perm) {
+	case AuBrPerm_RO:
+	case AuBrPerm_ROWH:
+	case AuBrPerm_RR:
+	case AuBrPerm_RRWH:
+		au_wh_init_ro(h_dir, base, &path);
+		break;
+
+	case AuBrPerm_RWNoLinkWH:
+		err = au_wh_init_rw_nolink(h_root, wbr, do_plink, base, &path);
+		if (err > 0)
+			goto out;
+		else if (err)
+			goto out_err;
+		break;
+
+	case AuBrPerm_RW:
+		err = au_wh_init_rw(h_root, wbr, do_plink, base, &path);
+		if (err > 0)
+			goto out;
+		else if (err)
+			goto out_err;
+		break;
+
+	default:
+		BUG();
+	}
+	goto out; /* success */
+
+ out_err:
+	AuErr("an error(%d) on the writable branch %.*s(%s)\n",
+	      err, AuDLNPair(h_root), au_sbtype(h_root->d_sb));
+ out:
+	for (i = 0; i < AuBrWh_Last; i++)
+		dput(base[i].dentry);
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+/*
+ * whiteouts are all hard-linked usually.
+ * when its link count reaches a ceiling, we create a new whiteout base
+ * asynchronously.
+ */
+
+struct reinit_br_wh {
+	struct super_block *sb;
+	struct au_branch *br;
+};
+
+static void reinit_br_wh(void *arg)
+{
+	int err;
+	aufs_bindex_t bindex;
+	struct path h_path;
+	struct reinit_br_wh *a = arg;
+	struct au_wbr *wbr;
+	struct inode *dir;
+	struct dentry *h_root;
+	struct au_hinode *hdir;
+
+	err = 0;
+	wbr = a->br->br_wbr;
+	/* big aufs lock */
+	si_noflush_write_lock(a->sb);
+	if (!au_br_writable(a->br->br_perm))
+		goto out;
+	bindex = au_br_index(a->sb, a->br->br_id);
+	if (unlikely(bindex < 0))
+		goto out;
+
+	di_read_lock_parent(a->sb->s_root, AuLock_IR);
+	dir = a->sb->s_root->d_inode;
+	hdir = au_hi(dir, bindex);
+	h_root = au_h_dptr(a->sb->s_root, bindex);
+
+	au_hin_imtx_lock_nested(hdir, AuLsc_I_PARENT);
+	wbr_wh_write_lock(wbr);
+	err = au_h_verify(wbr->wbr_whbase, au_opt_udba(a->sb), hdir->hi_inode,
+			  h_root, a->br);
+	if (!err) {
+		err = mnt_want_write(a->br->br_mnt);
+		if (!err) {
+			h_path.dentry = wbr->wbr_whbase;
+			h_path.mnt = a->br->br_mnt;
+			err = vfsub_unlink(hdir->hi_inode, &h_path, /*force*/0);
+			mnt_drop_write(a->br->br_mnt);
+		}
+	} else {
+		AuWarn("%.*s is moved, ignored\n", AuDLNPair(wbr->wbr_whbase));
+		err = 0;
+	}
+	dput(wbr->wbr_whbase);
+	wbr->wbr_whbase = NULL;
+	if (!err)
+		err = au_wh_init(h_root, a->br, a->sb);
+	wbr_wh_write_unlock(wbr);
+	au_hin_imtx_unlock(hdir);
+	di_read_unlock(a->sb->s_root, AuLock_IR);
+
+ out:
+	if (wbr)
+		atomic_dec(&wbr->wbr_wh_running);
+	atomic_dec(&a->br->br_count);
+	au_nwt_done(&au_sbi(a->sb)->si_nowait);
+	si_write_unlock(a->sb);
+	kfree(arg);
+	if (unlikely(err))
+		AuIOErr("err %d\n", err);
+}
+
+static void kick_reinit_br_wh(struct super_block *sb, struct au_branch *br)
+{
+	int do_dec, wkq_err;
+	struct reinit_br_wh *arg;
+
+	do_dec = 1;
+	if (atomic_inc_return(&br->br_wbr->wbr_wh_running) != 1)
+		goto out;
+
+	/* ignore ENOMEM */
+	arg = kmalloc(sizeof(*arg), GFP_NOFS);
+	if (arg) {
+		/*
+		 * dec(wh_running), kfree(arg) and dec(br_count)
+		 * in reinit function
+		 */
+		arg->sb = sb;
+		arg->br = br;
+		atomic_inc(&br->br_count);
+		wkq_err = au_wkq_nowait(reinit_br_wh, arg, sb);
+		if (unlikely(wkq_err)) {
+			atomic_dec(&br->br_wbr->wbr_wh_running);
+			atomic_dec(&br->br_count);
+			kfree(arg);
+		}
+		do_dec = 0;
+	}
+
+ out:
+	if (do_dec)
+		atomic_dec(&br->br_wbr->wbr_wh_running);
+}
+
+/* ---------------------------------------------------------------------- */
+
+/*
+ * create the whiteout @wh.
+ */
+static int link_or_create_wh(struct super_block *sb, aufs_bindex_t bindex,
+			     struct dentry *wh)
+{
+	int err;
+	struct path h_path = {
+		.dentry = wh
+	};
+	struct au_branch *br;
+	struct au_wbr *wbr;
+	struct dentry *h_parent;
+	struct inode *h_dir;
+
+	h_parent = wh->d_parent; /* dir inode is locked */
+	h_dir = h_parent->d_inode;
+	IMustLock(h_dir);
+
+	br = au_sbr(sb, bindex);
+	h_path.mnt = br->br_mnt;
+	wbr = br->br_wbr;
+	wbr_wh_read_lock(wbr);
+	if (wbr->wbr_whbase) {
+		err = vfsub_link(wbr->wbr_whbase, h_dir, &h_path);
+		if (!err || err != -EMLINK)
+			goto out;
+
+		/* link count full. re-initialize br_whbase. */
+		kick_reinit_br_wh(sb, br);
+	}
+
+	/* return this error in this context */
+	err = vfsub_create(h_dir, &h_path, WH_MASK);
+
+ out:
+	wbr_wh_read_unlock(wbr);
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+/*
+ * create or remove the diropq.
+ */
+static struct dentry *do_diropq(struct dentry *dentry, aufs_bindex_t bindex,
+				unsigned int flags)
+{
+	struct dentry *opq_dentry, *h_dentry;
+	struct super_block *sb;
+	struct au_branch *br;
+	int err;
+
+	sb = dentry->d_sb;
+	br = au_sbr(sb, bindex);
+	h_dentry = au_h_dptr(dentry, bindex);
+	opq_dentry = au_lkup_one(&diropq_name, h_dentry, br, /*nd*/NULL);
+	if (IS_ERR(opq_dentry))
+		goto out;
+
+	if (au_ftest_diropq(flags, CREATE)) {
+		err = link_or_create_wh(sb, bindex, opq_dentry);
+		if (!err) {
+			au_set_dbdiropq(dentry, bindex);
+			goto out; /* success */
+		}
+	} else {
+		struct path tmp = {
+			.dentry = opq_dentry,
+			.mnt	= br->br_mnt
+		};
+		err = do_unlink_wh(au_h_iptr(dentry->d_inode, bindex), &tmp);
+		if (!err)
+			au_set_dbdiropq(dentry, -1);
+	}
+	dput(opq_dentry);
+	opq_dentry = ERR_PTR(err);
+
+ out:
+	return opq_dentry;
+}
+
+struct do_diropq_args {
+	struct dentry **errp;
+	struct dentry *dentry;
+	aufs_bindex_t bindex;
+	unsigned int flags;
+};
+
+static void call_do_diropq(void *args)
+{
+	struct do_diropq_args *a = args;
+	*a->errp = do_diropq(a->dentry, a->bindex, a->flags);
+}
+
+struct dentry *au_diropq_sio(struct dentry *dentry, aufs_bindex_t bindex,
+			     unsigned int flags)
+{
+	struct dentry *diropq, *h_dentry;
+
+	h_dentry = au_h_dptr(dentry, bindex);
+	if (!au_test_h_perm_sio(h_dentry->d_inode, MAY_EXEC | MAY_WRITE))
+		diropq = do_diropq(dentry, bindex, flags);
+	else {
+		int wkq_err;
+		struct do_diropq_args args = {
+			.errp		= &diropq,
+			.dentry		= dentry,
+			.bindex		= bindex,
+			.flags		= flags
+		};
+
+		wkq_err = au_wkq_wait(call_do_diropq, &args);
+		if (unlikely(wkq_err))
+			diropq = ERR_PTR(wkq_err);
+	}
+
+	return diropq;
+}
+
+/* ---------------------------------------------------------------------- */
+
+/*
+ * lookup whiteout dentry.
+ * @h_parent: lower parent dentry which must exist and be locked
+ * @base_name: name of dentry which will be whiteouted
+ * returns dentry for whiteout.
+ */
+struct dentry *au_wh_lkup(struct dentry *h_parent, struct qstr *base_name,
+			  struct au_branch *br)
+{
+	int err;
+	struct qstr wh_name;
+	struct dentry *wh_dentry;
+
+	err = au_wh_name_alloc(&wh_name, base_name);
+	wh_dentry = ERR_PTR(err);
+	if (!err) {
+		wh_dentry = au_lkup_one(&wh_name, h_parent, br, /*nd*/NULL);
+		kfree(wh_name.name);
+	}
+	return wh_dentry;
+}
+
+/*
+ * link/create a whiteout for @dentry on @bindex.
+ */
+struct dentry *au_wh_create(struct dentry *dentry, aufs_bindex_t bindex,
+			    struct dentry *h_parent)
+{
+	struct dentry *wh_dentry;
+	struct super_block *sb;
+	int err;
+
+	sb = dentry->d_sb;
+	wh_dentry = au_wh_lkup(h_parent, &dentry->d_name, au_sbr(sb, bindex));
+	if (!IS_ERR(wh_dentry) && !wh_dentry->d_inode) {
+		err = link_or_create_wh(sb, bindex, wh_dentry);
+		if (!err)
+			au_set_dbwh(dentry, bindex);
+		else {
+			dput(wh_dentry);
+			wh_dentry = ERR_PTR(err);
+		}
+	}
+
+	return wh_dentry;
+}
+
+/* ---------------------------------------------------------------------- */
+
+/* Delete all whiteouts in this directory on branch bindex. */
+static int del_wh_children(struct dentry *h_dentry, struct au_nhash *whlist,
+			   aufs_bindex_t bindex, struct au_branch *br)
+{
+	int err;
+	unsigned long ul, n;
+	struct qstr wh_name;
+	char *p;
+	struct hlist_head *head;
+	struct au_vdir_wh *tpos;
+	struct hlist_node *pos;
+	struct au_vdir_destr *str;
+
+	err = -ENOMEM;
+	p = __getname();
+	wh_name.name = p;
+	if (unlikely(!wh_name.name))
+		goto out;
+
+	err = 0;
+	memcpy(p, AUFS_WH_PFX, AUFS_WH_PFX_LEN);
+	p += AUFS_WH_PFX_LEN;
+	n = whlist->nh_num;
+	head = whlist->nh_head;
+	for (ul = 0; !err && ul < n; ul++, head++) {
+		hlist_for_each_entry(tpos, pos, head, wh_hash) {
+			if (tpos->wh_bindex != bindex)
+				continue;
+
+			str = &tpos->wh_str;
+			if (str->len + AUFS_WH_PFX_LEN <= PATH_MAX) {
+				memcpy(p, str->name, str->len);
+				wh_name.len = AUFS_WH_PFX_LEN + str->len;
+				err = unlink_wh_name(h_dentry, &wh_name, br);
+				if (!err)
+					continue;
+				break;
+			}
+			AuIOErr("whiteout name too long %.*s\n",
+				str->len, str->name);
+			err = -EIO;
+			break;
+		}
+	}
+	__putname(wh_name.name);
+
+ out:
+	return err;
+}
+
+struct del_wh_children_args {
+	int *errp;
+	struct dentry *h_dentry;
+	struct au_nhash whlist;
+	aufs_bindex_t bindex;
+	struct au_branch *br;
+};
+
+static void call_del_wh_children(void *args)
+{
+	struct del_wh_children_args *a = args;
+	*a->errp = del_wh_children(a->h_dentry, &a->whlist, a->bindex, a->br);
+}
+
+/* ---------------------------------------------------------------------- */
+
+struct au_whtmp_rmdir *au_whtmp_rmdir_alloc(struct super_block *sb, gfp_t gfp)
+{
+	struct au_whtmp_rmdir *whtmp;
+	int err;
+
+	SiMustAnyLock(sb);
+
+	whtmp = kmalloc(sizeof(*whtmp), gfp);
+	if (unlikely(!whtmp)) {
+		whtmp = ERR_PTR(-ENOMEM);
+		goto out;
+	}
+
+	whtmp->dir = NULL;
+	whtmp->wh_dentry = NULL;
+	err = au_nhash_alloc(&whtmp->whlist, au_sbi(sb)->si_rdhash, gfp);
+	if (!err)
+		return whtmp; /* success */
+
+	kfree(whtmp);
+	whtmp = ERR_PTR(err);
+
+ out:
+	return whtmp;
+}
+
+void au_whtmp_rmdir_free(struct au_whtmp_rmdir *whtmp)
+{
+	dput(whtmp->wh_dentry);
+	iput(whtmp->dir);
+	au_nhash_wh_free(&whtmp->whlist);
+	kfree(whtmp);
+}
+
+/*
+ * rmdir the whiteouted temporary named dir @h_dentry.
+ * @whlist: whiteouted children.
+ */
+int au_whtmp_rmdir(struct inode *dir, aufs_bindex_t bindex,
+		   struct dentry *wh_dentry, struct au_nhash *whlist)
+{
+	int err;
+	struct path h_tmp;
+	struct inode *wh_inode, *h_dir;
+	struct au_branch *br;
+
+	h_dir = wh_dentry->d_parent->d_inode; /* dir inode is locked */
+	IMustLock(h_dir);
+
+	br = au_sbr(dir->i_sb, bindex);
+	wh_inode = wh_dentry->d_inode;
+	mutex_lock_nested(&wh_inode->i_mutex, AuLsc_I_CHILD);
+
+	/*
+	 * someone else might change some whiteouts while we were sleeping.
+	 * it means this whlist may have an obsoleted entry.
+	 */
+	if (!au_test_h_perm_sio(wh_inode, MAY_EXEC | MAY_WRITE))
+		err = del_wh_children(wh_dentry, whlist, bindex, br);
+	else {
+		int wkq_err;
+		struct del_wh_children_args args = {
+			.errp		= &err,
+			.h_dentry	= wh_dentry,
+			.whlist		= *whlist,
+			.bindex		= bindex,
+			.br		= br
+		};
+
+		wkq_err = au_wkq_wait(call_del_wh_children, &args);
+		if (unlikely(wkq_err))
+			err = wkq_err;
+	}
+	mutex_unlock(&wh_inode->i_mutex);
+
+	if (!err) {
+		h_tmp.dentry = wh_dentry;
+		h_tmp.mnt = br->br_mnt;
+		err = vfsub_rmdir(h_dir, &h_tmp);
+		/* d_drop(h_dentry); */
+	}
+
+	if (!err) {
+		if (au_ibstart(dir) == bindex) {
+			au_cpup_attr_timesizes(dir);
+			drop_nlink(dir);
+		}
+		return 0; /* success */
+	}
+
+	AuWarn("failed removing %.*s(%d), ignored\n",
+	       AuDLNPair(wh_dentry), err);
+	return err;
+}
+
+static void call_rmdir_whtmp(void *args)
+{
+	int err;
+	struct au_whtmp_rmdir *a = args;
+	struct super_block *sb;
+	struct dentry *h_parent;
+	struct inode *h_dir;
+	struct au_branch *br;
+	struct au_hinode *hdir;
+
+	/* rmdir by nfsd may cause deadlock with this i_mutex */
+	/* mutex_lock(&a->dir->i_mutex); */
+	sb = a->dir->i_sb;
+	si_noflush_read_lock(sb);
+	err = au_test_ro(sb, a->bindex, NULL);
+	if (unlikely(err))
+		goto out;
+
+	err = -EIO;
+	br = au_sbr(sb, a->bindex);
+	ii_write_lock_parent(a->dir);
+	h_parent = dget_parent(a->wh_dentry);
+	h_dir = h_parent->d_inode;
+	hdir = au_hi(a->dir, a->bindex);
+	au_hin_imtx_lock_nested(hdir, AuLsc_I_PARENT);
+	err = au_h_verify(a->wh_dentry, au_opt_udba(sb), h_dir, h_parent, br);
+	if (!err) {
+		err = mnt_want_write(br->br_mnt);
+		if (!err) {
+			err = au_whtmp_rmdir(a->dir, a->bindex, a->wh_dentry,
+					     &a->whlist);
+			mnt_drop_write(br->br_mnt);
+		}
+	}
+	au_hin_imtx_unlock(hdir);
+	dput(h_parent);
+	ii_write_unlock(a->dir);
+
+ out:
+	/* mutex_unlock(&a->dir->i_mutex); */
+	au_nwt_done(&au_sbi(sb)->si_nowait);
+	si_read_unlock(sb);
+	au_whtmp_rmdir_free(a);
+	if (unlikely(err))
+		AuIOErr("err %d\n", err);
+}
+
+void au_whtmp_kick_rmdir(struct inode *dir, aufs_bindex_t bindex,
+			 struct dentry *wh_dentry, struct au_whtmp_rmdir *args)
+{
+	int wkq_err;
+
+	IMustLock(dir);
+
+	/* all post-process will be done in do_rmdir_whtmp(). */
+	args->dir = au_igrab(dir);
+	args->bindex = bindex;
+	args->wh_dentry = dget(wh_dentry);
+	wkq_err = au_wkq_nowait(call_rmdir_whtmp, args, dir->i_sb);
+	if (unlikely(wkq_err)) {
+		AuWarn("rmdir error %.*s (%d), ignored\n",
+		       AuDLNPair(wh_dentry), wkq_err);
+		au_whtmp_rmdir_free(args);
+	}
+}
--- linux-rt-2.6.31.orig/ubuntu/aufs/dentry.h
+++ linux-rt-2.6.31/ubuntu/aufs/dentry.h
@@ -0,0 +1,231 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * lookup and dentry operations
+ */
+
+#ifndef __AUFS_DENTRY_H__
+#define __AUFS_DENTRY_H__
+
+#ifdef __KERNEL__
+
+#include <linux/dcache.h>
+#include <linux/aufs_type.h>
+#include "rwsem.h"
+
+/* make a single member structure for future use */
+/* todo: remove this structure */
+struct au_hdentry {
+	struct dentry		*hd_dentry;
+};
+
+struct au_dinfo {
+	atomic_t		di_generation;
+
+	struct au_rwsem		di_rwsem;
+	aufs_bindex_t		di_bstart, di_bend, di_bwh, di_bdiropq;
+	struct au_hdentry	*di_hdentry;
+};
+
+/* ---------------------------------------------------------------------- */
+
+/* dentry.c */
+extern struct dentry_operations aufs_dop;
+struct au_branch;
+struct dentry *au_lkup_one(struct qstr *name, struct dentry *h_parent,
+			   struct au_branch *br, struct nameidata *nd);
+struct dentry *au_sio_lkup_one(struct qstr *name, struct dentry *parent,
+			       struct au_branch *br);
+int au_h_verify(struct dentry *h_dentry, unsigned int udba, struct inode *h_dir,
+		struct dentry *h_parent, struct au_branch *br);
+
+int au_lkup_dentry(struct dentry *dentry, aufs_bindex_t bstart, mode_t type,
+		   struct nameidata *nd);
+int au_lkup_neg(struct dentry *dentry, aufs_bindex_t bindex);
+int au_refresh_hdentry(struct dentry *dentry, mode_t type);
+int au_reval_dpath(struct dentry *dentry, unsigned int sigen);
+
+/* dinfo.c */
+int au_alloc_dinfo(struct dentry *dentry);
+int au_di_realloc(struct au_dinfo *dinfo, int nbr);
+
+void di_read_lock(struct dentry *d, int flags, unsigned int lsc);
+void di_read_unlock(struct dentry *d, int flags);
+void di_downgrade_lock(struct dentry *d, int flags);
+void di_write_lock(struct dentry *d, unsigned int lsc);
+void di_write_unlock(struct dentry *d);
+void di_write_lock2_child(struct dentry *d1, struct dentry *d2, int isdir);
+void di_write_lock2_parent(struct dentry *d1, struct dentry *d2, int isdir);
+void di_write_unlock2(struct dentry *d1, struct dentry *d2);
+
+struct dentry *au_h_dptr(struct dentry *dentry, aufs_bindex_t bindex);
+aufs_bindex_t au_dbtail(struct dentry *dentry);
+aufs_bindex_t au_dbtaildir(struct dentry *dentry);
+
+void au_set_h_dptr(struct dentry *dentry, aufs_bindex_t bindex,
+		   struct dentry *h_dentry);
+void au_update_digen(struct dentry *dentry);
+void au_update_dbrange(struct dentry *dentry, int do_put_zero);
+void au_update_dbstart(struct dentry *dentry);
+void au_update_dbend(struct dentry *dentry);
+int au_find_dbindex(struct dentry *dentry, struct dentry *h_dentry);
+
+/* ---------------------------------------------------------------------- */
+
+static inline struct au_dinfo *au_di(struct dentry *dentry)
+{
+	return dentry->d_fsdata;
+}
+
+/* ---------------------------------------------------------------------- */
+
+/* lock subclass for dinfo */
+enum {
+	AuLsc_DI_CHILD,		/* child first */
+	AuLsc_DI_CHILD2,	/* rename(2), link(2), and cpup at hinotify */
+	AuLsc_DI_CHILD3,	/* copyup dirs */
+	AuLsc_DI_PARENT,
+	AuLsc_DI_PARENT2,
+	AuLsc_DI_PARENT3
+};
+
+/*
+ * di_read_lock_child, di_write_lock_child,
+ * di_read_lock_child2, di_write_lock_child2,
+ * di_read_lock_child3, di_write_lock_child3,
+ * di_read_lock_parent, di_write_lock_parent,
+ * di_read_lock_parent2, di_write_lock_parent2,
+ * di_read_lock_parent3, di_write_lock_parent3,
+ */
+#define AuReadLockFunc(name, lsc) \
+static inline void di_read_lock_##name(struct dentry *d, int flags) \
+{ di_read_lock(d, flags, AuLsc_DI_##lsc); }
+
+#define AuWriteLockFunc(name, lsc) \
+static inline void di_write_lock_##name(struct dentry *d) \
+{ di_write_lock(d, AuLsc_DI_##lsc); }
+
+#define AuRWLockFuncs(name, lsc) \
+	AuReadLockFunc(name, lsc) \
+	AuWriteLockFunc(name, lsc)
+
+AuRWLockFuncs(child, CHILD);
+AuRWLockFuncs(child2, CHILD2);
+AuRWLockFuncs(child3, CHILD3);
+AuRWLockFuncs(parent, PARENT);
+AuRWLockFuncs(parent2, PARENT2);
+AuRWLockFuncs(parent3, PARENT3);
+
+#undef AuReadLockFunc
+#undef AuWriteLockFunc
+#undef AuRWLockFuncs
+
+#define DiMustNoWaiters(d)	AuRwMustNoWaiters(&au_di(d)->di_rwsem)
+#define DiMustAnyLock(d)	AuRwMustAnyLock(&au_di(d)->di_rwsem)
+#define DiMustWriteLock(d)	AuRwMustWriteLock(&au_di(d)->di_rwsem)
+
+/* ---------------------------------------------------------------------- */
+
+/* todo: memory barrier? */
+static inline unsigned int au_digen(struct dentry *d)
+{
+	return atomic_read(&au_di(d)->di_generation);
+}
+
+static inline void au_h_dentry_init(struct au_hdentry *hdentry)
+{
+	hdentry->hd_dentry = NULL;
+}
+
+static inline void au_hdput(struct au_hdentry *hd)
+{
+	dput(hd->hd_dentry);
+}
+
+static inline aufs_bindex_t au_dbstart(struct dentry *dentry)
+{
+	DiMustAnyLock(dentry);
+	return au_di(dentry)->di_bstart;
+}
+
+static inline aufs_bindex_t au_dbend(struct dentry *dentry)
+{
+	DiMustAnyLock(dentry);
+	return au_di(dentry)->di_bend;
+}
+
+static inline aufs_bindex_t au_dbwh(struct dentry *dentry)
+{
+	DiMustAnyLock(dentry);
+	return au_di(dentry)->di_bwh;
+}
+
+static inline aufs_bindex_t au_dbdiropq(struct dentry *dentry)
+{
+	DiMustAnyLock(dentry);
+	return au_di(dentry)->di_bdiropq;
+}
+
+/* todo: hard/soft set? */
+static inline void au_set_dbstart(struct dentry *dentry, aufs_bindex_t bindex)
+{
+	DiMustWriteLock(dentry);
+	au_di(dentry)->di_bstart = bindex;
+}
+
+static inline void au_set_dbend(struct dentry *dentry, aufs_bindex_t bindex)
+{
+	DiMustWriteLock(dentry);
+	au_di(dentry)->di_bend = bindex;
+}
+
+static inline void au_set_dbwh(struct dentry *dentry, aufs_bindex_t bindex)
+{
+	DiMustWriteLock(dentry);
+	/* dbwh can be outside of bstart - bend range */
+	au_di(dentry)->di_bwh = bindex;
+}
+
+static inline void au_set_dbdiropq(struct dentry *dentry, aufs_bindex_t bindex)
+{
+	DiMustWriteLock(dentry);
+	au_di(dentry)->di_bdiropq = bindex;
+}
+
+/* ---------------------------------------------------------------------- */
+
+#ifdef CONFIG_AUFS_HINOTIFY
+static inline void au_digen_dec(struct dentry *d)
+{
+	atomic_dec_return(&au_di(d)->di_generation);
+}
+
+static inline void au_hin_di_reinit(struct dentry *dentry)
+{
+	dentry->d_fsdata = NULL;
+}
+#else
+static inline void au_hin_di_reinit(struct dentry *dentry __maybe_unused)
+{
+	/* empty */
+}
+#endif /* CONFIG_AUFS_HINOTIFY */
+
+#endif /* __KERNEL__ */
+#endif /* __AUFS_DENTRY_H__ */
--- linux-rt-2.6.31.orig/ubuntu/aufs/file.h
+++ linux-rt-2.6.31/ubuntu/aufs/file.h
@@ -0,0 +1,175 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * file operations
+ */
+
+#ifndef __AUFS_FILE_H__
+#define __AUFS_FILE_H__
+
+#ifdef __KERNEL__
+
+#include <linux/fs.h>
+#include <linux/poll.h>
+#include <linux/aufs_type.h>
+#include "rwsem.h"
+
+struct au_branch;
+struct au_hfile {
+	struct file		*hf_file;
+	struct au_branch	*hf_br;
+};
+
+struct au_vdir;
+struct au_finfo {
+	atomic_t		fi_generation;
+
+	struct au_rwsem		fi_rwsem;
+	struct au_hfile		*fi_hfile;
+	aufs_bindex_t		fi_bstart, fi_bend;
+
+	union {
+		/* non-dir only */
+		struct {
+			struct vm_operations_struct	*fi_h_vm_ops;
+			struct vm_operations_struct	*fi_vm_ops;
+		};
+
+		/* dir only */
+		struct {
+			struct au_vdir		*fi_vdir_cache;
+			int			fi_maintain_plink;
+		};
+	};
+};
+
+/* ---------------------------------------------------------------------- */
+
+/* file.c */
+extern struct address_space_operations aufs_aop;
+void au_store_oflag(struct nameidata *nd, struct inode *inode);
+unsigned int au_file_roflags(unsigned int flags);
+struct file *au_h_open(struct dentry *dentry, aufs_bindex_t bindex, int flags,
+		       struct file *file);
+int au_do_open(struct file *file, int (*open)(struct file *file, int flags));
+int au_reopen_nondir(struct file *file);
+struct au_pin;
+int au_ready_to_write(struct file *file, loff_t len, struct au_pin *pin);
+int au_reval_and_lock_fdi(struct file *file, int (*reopen)(struct file *file),
+			  int wlock);
+
+/* poll.c */
+#ifdef CONFIG_AUFS_POLL
+unsigned int aufs_poll(struct file *file, poll_table *wait);
+#endif
+
+/* f_op.c */
+extern const struct file_operations aufs_file_fop;
+int aufs_flush(struct file *file, fl_owner_t id);
+
+/* finfo.c */
+void au_hfput(struct au_hfile *hf, struct file *file);
+void au_set_h_fptr(struct file *file, aufs_bindex_t bindex,
+		   struct file *h_file);
+
+void au_update_figen(struct file *file);
+
+void au_finfo_fin(struct file *file);
+int au_finfo_init(struct file *file);
+int au_fi_realloc(struct au_finfo *finfo, int nbr);
+
+/* ---------------------------------------------------------------------- */
+
+static inline struct au_finfo *au_fi(struct file *file)
+{
+	return file->private_data;
+}
+
+/* ---------------------------------------------------------------------- */
+
+/*
+ * fi_read_lock, fi_write_lock,
+ * fi_read_unlock, fi_write_unlock, fi_downgrade_lock
+ */
+AuSimpleRwsemFuncs(fi, struct file *f, &au_fi(f)->fi_rwsem);
+
+#define FiMustNoWaiters(f)	AuRwMustNoWaiters(&au_fi(f)->fi_rwsem)
+#define FiMustAnyLock(f)	AuRwMustAnyLock(&au_fi(f)->fi_rwsem)
+#define FiMustWriteLock(f)	AuRwMustWriteLock(&au_fi(f)->fi_rwsem)
+
+/* ---------------------------------------------------------------------- */
+
+/* todo: hard/soft set? */
+static inline aufs_bindex_t au_fbstart(struct file *file)
+{
+	FiMustAnyLock(file);
+	return au_fi(file)->fi_bstart;
+}
+
+static inline aufs_bindex_t au_fbend(struct file *file)
+{
+	FiMustAnyLock(file);
+	return au_fi(file)->fi_bend;
+}
+
+static inline struct au_vdir *au_fvdir_cache(struct file *file)
+{
+	FiMustAnyLock(file);
+	return au_fi(file)->fi_vdir_cache;
+}
+
+static inline void au_set_fbstart(struct file *file, aufs_bindex_t bindex)
+{
+	FiMustWriteLock(file);
+	au_fi(file)->fi_bstart = bindex;
+}
+
+static inline void au_set_fbend(struct file *file, aufs_bindex_t bindex)
+{
+	FiMustWriteLock(file);
+	au_fi(file)->fi_bend = bindex;
+}
+
+static inline void au_set_fvdir_cache(struct file *file,
+				      struct au_vdir *vdir_cache)
+{
+	FiMustWriteLock(file);
+	au_fi(file)->fi_vdir_cache = vdir_cache;
+}
+
+static inline struct file *au_h_fptr(struct file *file, aufs_bindex_t bindex)
+{
+	FiMustAnyLock(file);
+	return au_fi(file)->fi_hfile[0 + bindex].hf_file;
+}
+
+/* todo: memory barrier? */
+static inline unsigned int au_figen(struct file *f)
+{
+	return atomic_read(&au_fi(f)->fi_generation);
+}
+
+static inline int au_test_mmapped(struct file *f)
+{
+	FiMustAnyLock(f);
+	return !!(au_fi(f)->fi_h_vm_ops);
+}
+
+#endif /* __KERNEL__ */
+#endif /* __AUFS_FILE_H__ */
--- linux-rt-2.6.31.orig/ubuntu/aufs/finfo.c
+++ linux-rt-2.6.31/ubuntu/aufs/finfo.c
@@ -0,0 +1,133 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * file private data
+ */
+
+#include <linux/file.h>
+#include "aufs.h"
+
+void au_hfput(struct au_hfile *hf, struct file *file)
+{
+	if (file->f_mode & FMODE_EXEC)
+		allow_write_access(hf->hf_file);
+	fput(hf->hf_file);
+	hf->hf_file = NULL;
+	atomic_dec_return(&hf->hf_br->br_count);
+	hf->hf_br = NULL;
+}
+
+void au_set_h_fptr(struct file *file, aufs_bindex_t bindex, struct file *val)
+{
+	struct au_finfo *finfo = au_fi(file);
+	struct au_hfile *hf;
+
+	hf = finfo->fi_hfile + bindex;
+	if (hf->hf_file)
+		au_hfput(hf, file);
+	if (val) {
+		hf->hf_file = val;
+		hf->hf_br = au_sbr(file->f_dentry->d_sb, bindex);
+	}
+}
+
+void au_update_figen(struct file *file)
+{
+	atomic_set(&au_fi(file)->fi_generation, au_digen(file->f_dentry));
+	/* smp_mb(); */ /* atomic_set */
+}
+
+/* ---------------------------------------------------------------------- */
+
+void au_finfo_fin(struct file *file)
+{
+	struct au_finfo *finfo;
+	aufs_bindex_t bindex, bend;
+
+	fi_write_lock(file);
+	bend = au_fbend(file);
+	bindex = au_fbstart(file);
+	if (bindex >= 0)
+		/*
+		 * calls fput() instead of filp_close(),
+		 * since no dnotify or lock for the lower file.
+		 */
+		for (; bindex <= bend; bindex++)
+			au_set_h_fptr(file, bindex, NULL);
+
+	finfo = au_fi(file);
+	au_dbg_verify_hf(finfo);
+	kfree(finfo->fi_hfile);
+	fi_write_unlock(file);
+	AuRwDestroy(&finfo->fi_rwsem);
+	au_cache_free_finfo(finfo);
+}
+
+int au_finfo_init(struct file *file)
+{
+	struct au_finfo *finfo;
+	struct dentry *dentry;
+	unsigned long ul;
+
+	dentry = file->f_dentry;
+	finfo = au_cache_alloc_finfo();
+	if (unlikely(!finfo))
+		goto out;
+
+	finfo->fi_hfile = kcalloc(au_sbend(dentry->d_sb) + 1,
+				  sizeof(*finfo->fi_hfile), GFP_NOFS);
+	if (unlikely(!finfo->fi_hfile))
+		goto out_finfo;
+
+	au_rw_init_wlock(&finfo->fi_rwsem);
+	finfo->fi_bstart = -1;
+	finfo->fi_bend = -1;
+	atomic_set(&finfo->fi_generation, au_digen(dentry));
+	/* smp_mb(); */ /* atomic_set */
+
+	/* cf. au_store_oflag() */
+	/* suppress a warning in lp64 */
+	ul = (unsigned long)file->private_data;
+	file->f_mode |= (vfsub_uint_to_fmode(ul) & FMODE_EXEC);
+	file->private_data = finfo;
+	return 0; /* success */
+
+ out_finfo:
+	au_cache_free_finfo(finfo);
+ out:
+	return -ENOMEM;
+}
+
+int au_fi_realloc(struct au_finfo *finfo, int nbr)
+{
+	int err, sz;
+	struct au_hfile *hfp;
+
+	err = -ENOMEM;
+	sz = sizeof(*hfp) * (finfo->fi_bend + 1);
+	if (!sz)
+		sz = sizeof(*hfp);
+	hfp = au_kzrealloc(finfo->fi_hfile, sz, sizeof(*hfp) * nbr, GFP_NOFS);
+	if (hfp) {
+		finfo->fi_hfile = hfp;
+		err = 0;
+	}
+
+	return err;
+}
--- linux-rt-2.6.31.orig/ubuntu/aufs/vdir.c
+++ linux-rt-2.6.31/ubuntu/aufs/vdir.c
@@ -0,0 +1,882 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * virtual or vertical directory
+ */
+
+#include <linux/hash.h>
+#include "aufs.h"
+
+static unsigned int calc_size(int nlen)
+{
+	BUILD_BUG_ON(sizeof(ino_t) != sizeof(long));
+	return ALIGN(sizeof(struct au_vdir_de) + nlen, sizeof(ino_t));
+}
+
+static int set_deblk_end(union au_vdir_deblk_p *p,
+			 union au_vdir_deblk_p *deblk_end)
+{
+	if (calc_size(0) <= deblk_end->deblk - p->deblk) {
+		p->de->de_str.len = 0;
+		/* smp_mb(); */
+		return 0;
+	}
+	return -1; /* error */
+}
+
+/* returns true or false */
+static int is_deblk_end(union au_vdir_deblk_p *p,
+			union au_vdir_deblk_p *deblk_end)
+{
+	if (calc_size(0) <= deblk_end->deblk - p->deblk)
+		return !p->de->de_str.len;
+	return 1;
+}
+
+static unsigned char *last_deblk(struct au_vdir *vdir)
+{
+	return vdir->vd_deblk[vdir->vd_nblk - 1];
+}
+
+/* ---------------------------------------------------------------------- */
+
+/*
+ * the allocated memory has to be freed by
+ * au_nhash_wh_free() or au_nhash_de_free().
+ */
+int au_nhash_alloc(struct au_nhash *nhash, unsigned int num_hash, gfp_t gfp)
+{
+	struct hlist_head *head;
+	unsigned int u;
+
+	head = kmalloc(sizeof(*nhash->nh_head) * num_hash, gfp);
+	if (head) {
+		nhash->nh_num = num_hash;
+		nhash->nh_head = head;
+		for (u = 0; u < num_hash; u++)
+			INIT_HLIST_HEAD(head++);
+		return 0; /* success */
+	}
+
+	return -ENOMEM;
+}
+
+static void nhash_count(struct hlist_head *head)
+{
+#if 0
+	unsigned long n;
+	struct hlist_node *pos;
+
+	n = 0;
+	hlist_for_each(pos, head)
+		n++;
+	AuInfo("%lu\n", n);
+#endif
+}
+
+static void au_nhash_wh_do_free(struct hlist_head *head)
+{
+	struct au_vdir_wh *tpos;
+	struct hlist_node *pos, *node;
+
+	hlist_for_each_entry_safe(tpos, pos, node, head, wh_hash) {
+		/* hlist_del(pos); */
+		kfree(tpos);
+	}
+}
+
+static void au_nhash_de_do_free(struct hlist_head *head)
+{
+	struct au_vdir_dehstr *tpos;
+	struct hlist_node *pos, *node;
+
+	hlist_for_each_entry_safe(tpos, pos, node, head, hash) {
+		/* hlist_del(pos); */
+		au_cache_free_dehstr(tpos);
+	}
+}
+
+static void au_nhash_do_free(struct au_nhash *nhash,
+			     void (*free)(struct hlist_head *head))
+{
+	unsigned int u, n;
+	struct hlist_head *head;
+
+	n = nhash->nh_num;
+	head = nhash->nh_head;
+	for (u = 0; u < n; u++) {
+		nhash_count(head);
+		free(head++);
+	}
+	kfree(nhash->nh_head);
+}
+
+void au_nhash_wh_free(struct au_nhash *whlist)
+{
+	au_nhash_do_free(whlist, au_nhash_wh_do_free);
+}
+
+static void au_nhash_de_free(struct au_nhash *delist)
+{
+	au_nhash_do_free(delist, au_nhash_de_do_free);
+}
+
+/* ---------------------------------------------------------------------- */
+
+int au_nhash_test_longer_wh(struct au_nhash *whlist, aufs_bindex_t btgt,
+			    int limit)
+{
+	int num;
+	unsigned int u, n;
+	struct hlist_head *head;
+	struct au_vdir_wh *tpos;
+	struct hlist_node *pos;
+
+	num = 0;
+	n = whlist->nh_num;
+	head = whlist->nh_head;
+	for (u = 0; u < n; u++) {
+		hlist_for_each_entry(tpos, pos, head, wh_hash)
+			if (tpos->wh_bindex == btgt && ++num > limit)
+				return 1;
+		head++;
+	}
+	return 0;
+}
+
+static struct hlist_head *au_name_hash(struct au_nhash *nhash,
+				       unsigned char *name,
+				       unsigned int len)
+{
+	unsigned int v;
+	/* const unsigned int magic_bit = 12; */
+
+	v = 0;
+	while (len--)
+		v += *name++;
+	/* v = hash_long(v, magic_bit); */
+	v %= nhash->nh_num;
+	return nhash->nh_head + v;
+}
+
+static int au_nhash_test_name(struct au_vdir_destr *str, const char *name,
+			      int nlen)
+{
+	return str->len == nlen && !memcmp(str->name, name, nlen);
+}
+
+/* returns found or not */
+int au_nhash_test_known_wh(struct au_nhash *whlist, char *name, int nlen)
+{
+	struct hlist_head *head;
+	struct au_vdir_wh *tpos;
+	struct hlist_node *pos;
+	struct au_vdir_destr *str;
+
+	head = au_name_hash(whlist, name, nlen);
+	hlist_for_each_entry(tpos, pos, head, wh_hash) {
+		str = &tpos->wh_str;
+		AuDbg("%.*s\n", str->len, str->name);
+		if (au_nhash_test_name(str, name, nlen))
+			return 1;
+	}
+	return 0;
+}
+
+/* returns found(true) or not */
+static int test_known(struct au_nhash *delist, char *name, int nlen)
+{
+	struct hlist_head *head;
+	struct au_vdir_dehstr *tpos;
+	struct hlist_node *pos;
+	struct au_vdir_destr *str;
+
+	head = au_name_hash(delist, name, nlen);
+	hlist_for_each_entry(tpos, pos, head, hash) {
+		str = tpos->str;
+		AuDbg("%.*s\n", str->len, str->name);
+		if (au_nhash_test_name(str, name, nlen))
+			return 1;
+	}
+	return 0;
+}
+
+static void au_shwh_init_wh(struct au_vdir_wh *wh, ino_t ino,
+			    unsigned char d_type)
+{
+#ifdef CONFIG_AUFS_SHWH
+	wh->wh_ino = ino;
+	wh->wh_type = d_type;
+#endif
+}
+
+/* ---------------------------------------------------------------------- */
+
+int au_nhash_append_wh(struct au_nhash *whlist, char *name, int nlen, ino_t ino,
+		       unsigned int d_type, aufs_bindex_t bindex,
+		       unsigned char shwh)
+{
+	int err;
+	struct au_vdir_destr *str;
+	struct au_vdir_wh *wh;
+
+	AuDbg("%.*s\n", nlen, name);
+	err = -ENOMEM;
+	wh = kmalloc(sizeof(*wh) + nlen, GFP_NOFS);
+	if (unlikely(!wh))
+		goto out;
+
+	err = 0;
+	wh->wh_bindex = bindex;
+	if (shwh)
+		au_shwh_init_wh(wh, ino, d_type);
+	str = &wh->wh_str;
+	str->len = nlen;
+	memcpy(str->name, name, nlen);
+	hlist_add_head(&wh->wh_hash, au_name_hash(whlist, name, nlen));
+	/* smp_mb(); */
+
+ out:
+	return err;
+}
+
+static int append_deblk(struct au_vdir *vdir)
+{
+	int err;
+	unsigned long ul;
+	const unsigned int deblk_sz = vdir->vd_deblk_sz;
+	union au_vdir_deblk_p p, deblk_end;
+	unsigned char **o;
+
+	err = -ENOMEM;
+	o = krealloc(vdir->vd_deblk, sizeof(*o) * (vdir->vd_nblk + 1),
+		     GFP_NOFS);
+	if (unlikely(!o))
+		goto out;
+
+	vdir->vd_deblk = o;
+	p.deblk = kmalloc(deblk_sz, GFP_NOFS);
+	if (p.deblk) {
+		ul = vdir->vd_nblk++;
+		vdir->vd_deblk[ul] = p.deblk;
+		vdir->vd_last.ul = ul;
+		vdir->vd_last.p.deblk = p.deblk;
+		deblk_end.deblk = p.deblk + deblk_sz;
+		err = set_deblk_end(&p, &deblk_end);
+	}
+
+ out:
+	return err;
+}
+
+static int append_de(struct au_vdir *vdir, char *name, int nlen, ino_t ino,
+		     unsigned int d_type, struct au_nhash *delist)
+{
+	int err;
+	unsigned int sz;
+	const unsigned int deblk_sz = vdir->vd_deblk_sz;
+	union au_vdir_deblk_p p, *room, deblk_end;
+	struct au_vdir_dehstr *dehstr;
+
+	p.deblk = last_deblk(vdir);
+	deblk_end.deblk = p.deblk + deblk_sz;
+	room = &vdir->vd_last.p;
+	AuDebugOn(room->deblk < p.deblk || deblk_end.deblk <= room->deblk
+		  || !is_deblk_end(room, &deblk_end));
+
+	sz = calc_size(nlen);
+	if (unlikely(sz > deblk_end.deblk - room->deblk)) {
+		err = append_deblk(vdir);
+		if (unlikely(err))
+			goto out;
+
+		p.deblk = last_deblk(vdir);
+		deblk_end.deblk = p.deblk + deblk_sz;
+		/* smp_mb(); */
+		AuDebugOn(room->deblk != p.deblk);
+	}
+
+	err = -ENOMEM;
+	dehstr = au_cache_alloc_dehstr();
+	if (unlikely(!dehstr))
+		goto out;
+
+	dehstr->str = &room->de->de_str;
+	hlist_add_head(&dehstr->hash, au_name_hash(delist, name, nlen));
+	room->de->de_ino = ino;
+	room->de->de_type = d_type;
+	room->de->de_str.len = nlen;
+	memcpy(room->de->de_str.name, name, nlen);
+
+	err = 0;
+	room->deblk += sz;
+	if (unlikely(set_deblk_end(room, &deblk_end)))
+		err = append_deblk(vdir);
+	/* smp_mb(); */
+
+ out:
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+void au_vdir_free(struct au_vdir *vdir)
+{
+	unsigned char **deblk;
+
+	deblk = vdir->vd_deblk;
+	while (vdir->vd_nblk--)
+		kfree(*deblk++);
+	kfree(vdir->vd_deblk);
+	au_cache_free_vdir(vdir);
+}
+
+static struct au_vdir *alloc_vdir(struct super_block *sb)
+{
+	struct au_vdir *vdir;
+	int err;
+
+	SiMustAnyLock(sb);
+
+	err = -ENOMEM;
+	vdir = au_cache_alloc_vdir();
+	if (unlikely(!vdir))
+		goto out;
+
+	vdir->vd_deblk = kzalloc(sizeof(*vdir->vd_deblk), GFP_NOFS);
+	if (unlikely(!vdir->vd_deblk))
+		goto out_free;
+
+	vdir->vd_deblk_sz = au_sbi(sb)->si_rdblk;
+	vdir->vd_nblk = 0;
+	vdir->vd_version = 0;
+	vdir->vd_jiffy = 0;
+	err = append_deblk(vdir);
+	if (!err)
+		return vdir; /* success */
+
+	kfree(vdir->vd_deblk);
+
+ out_free:
+	au_cache_free_vdir(vdir);
+ out:
+	vdir = ERR_PTR(err);
+	return vdir;
+}
+
+static int reinit_vdir(struct au_vdir *vdir)
+{
+	int err;
+	union au_vdir_deblk_p p, deblk_end;
+
+	while (vdir->vd_nblk > 1) {
+		kfree(vdir->vd_deblk[vdir->vd_nblk - 1]);
+		/* vdir->vd_deblk[vdir->vd_nblk - 1] = NULL; */
+		vdir->vd_nblk--;
+	}
+	p.deblk = vdir->vd_deblk[0];
+	deblk_end.deblk = p.deblk + vdir->vd_deblk_sz;
+	err = set_deblk_end(&p, &deblk_end);
+	/* keep vd_dblk_sz */
+	vdir->vd_last.ul = 0;
+	vdir->vd_last.p.deblk = vdir->vd_deblk[0];
+	vdir->vd_version = 0;
+	vdir->vd_jiffy = 0;
+	/* smp_mb(); */
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+static int au_ino(struct super_block *sb, aufs_bindex_t bindex, ino_t h_ino,
+		  unsigned int d_type, ino_t *ino)
+{
+	int err;
+	struct mutex *mtx;
+	const int isdir = (d_type == DT_DIR);
+
+	/* prevent hardlinks from race condition */
+	mtx = NULL;
+	if (!isdir) {
+		mtx = &au_sbr(sb, bindex)->br_xino.xi_nondir_mtx;
+		mutex_lock(mtx);
+	}
+	err = au_xino_read(sb, bindex, h_ino, ino);
+	if (unlikely(err))
+		goto out;
+
+	if (!*ino) {
+		err = -EIO;
+		*ino = au_xino_new_ino(sb);
+		if (unlikely(!*ino))
+			goto out;
+		err = au_xino_write(sb, bindex, h_ino, *ino);
+		if (unlikely(err))
+			goto out;
+	}
+
+ out:
+	if (!isdir)
+		mutex_unlock(mtx);
+	return err;
+}
+
+static int au_wh_ino(struct super_block *sb, aufs_bindex_t bindex, ino_t h_ino,
+		     unsigned int d_type, ino_t *ino)
+{
+#ifdef CONFIG_AUFS_SHWH
+	return au_ino(sb, bindex, h_ino, d_type, ino);
+#else
+	return 0;
+#endif
+}
+
+#define AuFillVdir_CALLED	1
+#define AuFillVdir_WHABLE	(1 << 1)
+#define AuFillVdir_SHWH		(1 << 2)
+#define au_ftest_fillvdir(flags, name)	((flags) & AuFillVdir_##name)
+#define au_fset_fillvdir(flags, name)	{ (flags) |= AuFillVdir_##name; }
+#define au_fclr_fillvdir(flags, name)	{ (flags) &= ~AuFillVdir_##name; }
+
+#ifndef CONFIG_AUFS_SHWH
+#undef AuFillVdir_SHWH
+#define AuFillVdir_SHWH		0
+#endif
+
+struct fillvdir_arg {
+	struct file		*file;
+	struct au_vdir		*vdir;
+	struct au_nhash		delist;
+	struct au_nhash		whlist;
+	aufs_bindex_t		bindex;
+	unsigned int		flags;
+	int			err;
+};
+
+static int fillvdir(void *__arg, const char *__name, int nlen,
+		    loff_t offset __maybe_unused, u64 h_ino,
+		    unsigned int d_type)
+{
+	struct fillvdir_arg *arg = __arg;
+	char *name = (void *)__name;
+	struct super_block *sb;
+	ino_t ino;
+	const unsigned char shwh = !!au_ftest_fillvdir(arg->flags, SHWH);
+
+	arg->err = 0;
+	sb = arg->file->f_dentry->d_sb;
+	au_fset_fillvdir(arg->flags, CALLED);
+	/* smp_mb(); */
+	if (nlen <= AUFS_WH_PFX_LEN
+	    || memcmp(name, AUFS_WH_PFX, AUFS_WH_PFX_LEN)) {
+		if (test_known(&arg->delist, name, nlen)
+		    || au_nhash_test_known_wh(&arg->whlist, name, nlen))
+			goto out; /* already exists or whiteouted */
+
+		sb = arg->file->f_dentry->d_sb;
+		arg->err = au_ino(sb, arg->bindex, h_ino, d_type, &ino);
+		if (!arg->err)
+			arg->err = append_de(arg->vdir, name, nlen, ino,
+					     d_type, &arg->delist);
+	} else if (au_ftest_fillvdir(arg->flags, WHABLE)) {
+		name += AUFS_WH_PFX_LEN;
+		nlen -= AUFS_WH_PFX_LEN;
+		if (au_nhash_test_known_wh(&arg->whlist, name, nlen))
+			goto out; /* already whiteouted */
+
+		if (shwh)
+			arg->err = au_wh_ino(sb, arg->bindex, h_ino, d_type,
+					     &ino);
+		if (!arg->err)
+			arg->err = au_nhash_append_wh
+				(&arg->whlist, name, nlen, ino, d_type,
+				 arg->bindex, shwh);
+	}
+
+ out:
+	if (!arg->err)
+		arg->vdir->vd_jiffy = jiffies;
+	/* smp_mb(); */
+	AuTraceErr(arg->err);
+	return arg->err;
+}
+
+static int au_handle_shwh(struct super_block *sb, struct au_vdir *vdir,
+			  struct au_nhash *whlist, struct au_nhash *delist)
+{
+#ifdef CONFIG_AUFS_SHWH
+	int err;
+	unsigned int nh, u;
+	struct hlist_head *head;
+	struct au_vdir_wh *tpos;
+	struct hlist_node *pos, *n;
+	char *p, *o;
+	struct au_vdir_destr *destr;
+
+	AuDebugOn(!au_opt_test(au_mntflags(sb), SHWH));
+
+	err = -ENOMEM;
+	o = p = __getname();
+	if (unlikely(!p))
+		goto out;
+
+	err = 0;
+	nh = whlist->nh_num;
+	memcpy(p, AUFS_WH_PFX, AUFS_WH_PFX_LEN);
+	p += AUFS_WH_PFX_LEN;
+	for (u = 0; u < nh; u++) {
+		head = whlist->nh_head + u;
+		hlist_for_each_entry_safe(tpos, pos, n, head, wh_hash) {
+			destr = &tpos->wh_str;
+			memcpy(p, destr->name, destr->len);
+			err = append_de(vdir, o, destr->len + AUFS_WH_PFX_LEN,
+					tpos->wh_ino, tpos->wh_type, delist);
+			if (unlikely(err))
+				break;
+		}
+	}
+
+	__putname(o);
+
+ out:
+	AuTraceErr(err);
+	return err;
+#else
+	return 0;
+#endif
+}
+
+static int au_do_read_vdir(struct fillvdir_arg *arg)
+{
+	int err;
+	unsigned int rdhash;
+	loff_t offset;
+	aufs_bindex_t bend, bindex, bstart;
+	unsigned char shwh;
+	struct file *hf, *file;
+	struct super_block *sb;
+
+	file = arg->file;
+	sb = file->f_dentry->d_sb;
+	SiMustAnyLock(sb);
+
+	rdhash = au_sbi(sb)->si_rdhash;
+	err = au_nhash_alloc(&arg->delist, rdhash, GFP_NOFS);
+	if (unlikely(err))
+		goto out;
+	err = au_nhash_alloc(&arg->whlist, rdhash, GFP_NOFS);
+	if (unlikely(err))
+		goto out_delist;
+
+	err = 0;
+	arg->flags = 0;
+	shwh = 0;
+	if (au_opt_test(au_mntflags(sb), SHWH)) {
+		shwh = 1;
+		au_fset_fillvdir(arg->flags, SHWH);
+	}
+	bstart = au_fbstart(file);
+	bend = au_fbend(file);
+	for (bindex = bstart; !err && bindex <= bend; bindex++) {
+		hf = au_h_fptr(file, bindex);
+		if (!hf)
+			continue;
+
+		offset = vfsub_llseek(hf, 0, SEEK_SET);
+		err = offset;
+		if (unlikely(offset))
+			break;
+
+		arg->bindex = bindex;
+		au_fclr_fillvdir(arg->flags, WHABLE);
+		if (shwh
+		    || (bindex != bend
+			&& au_br_whable(au_sbr_perm(sb, bindex))))
+			au_fset_fillvdir(arg->flags, WHABLE);
+		do {
+			arg->err = 0;
+			au_fclr_fillvdir(arg->flags, CALLED);
+			/* smp_mb(); */
+			err = vfsub_readdir(hf, fillvdir, arg);
+			if (err >= 0)
+				err = arg->err;
+		} while (!err && au_ftest_fillvdir(arg->flags, CALLED));
+	}
+
+	if (!err && shwh)
+		err = au_handle_shwh(sb, arg->vdir, &arg->whlist, &arg->delist);
+
+	au_nhash_wh_free(&arg->whlist);
+
+ out_delist:
+	au_nhash_de_free(&arg->delist);
+ out:
+	return err;
+}
+
+static int read_vdir(struct file *file, int may_read)
+{
+	int err;
+	unsigned long expire;
+	unsigned char do_read;
+	struct fillvdir_arg arg;
+	struct inode *inode;
+	struct au_vdir *vdir, *allocated;
+
+	err = 0;
+	inode = file->f_dentry->d_inode;
+	IMustLock(inode);
+	SiMustAnyLock(inode->i_sb);
+
+	allocated = NULL;
+	do_read = 0;
+	expire = au_sbi(inode->i_sb)->si_rdcache;
+	vdir = au_ivdir(inode);
+	if (!vdir) {
+		do_read = 1;
+		vdir = alloc_vdir(inode->i_sb);
+		err = PTR_ERR(vdir);
+		if (IS_ERR(vdir))
+			goto out;
+		err = 0;
+		allocated = vdir;
+	} else if (may_read
+		   && (inode->i_version != vdir->vd_version
+		       || time_after(jiffies, vdir->vd_jiffy + expire))) {
+		do_read = 1;
+		err = reinit_vdir(vdir);
+		if (unlikely(err))
+			goto out;
+	}
+
+	if (!do_read)
+		return 0; /* success */
+
+	arg.file = file;
+	arg.vdir = vdir;
+	err = au_do_read_vdir(&arg);
+	if (!err) {
+		/* file->f_pos = 0; */
+		vdir->vd_version = inode->i_version;
+		vdir->vd_last.ul = 0;
+		vdir->vd_last.p.deblk = vdir->vd_deblk[0];
+		if (allocated)
+			au_set_ivdir(inode, allocated);
+	} else if (allocated)
+		au_vdir_free(allocated);
+
+ out:
+	return err;
+}
+
+static int copy_vdir(struct au_vdir *tgt, struct au_vdir *src)
+{
+	int err, rerr;
+	unsigned long ul, n;
+	const unsigned int deblk_sz = src->vd_deblk_sz;
+
+	AuDebugOn(tgt->vd_nblk != 1);
+
+	err = -ENOMEM;
+	if (tgt->vd_nblk < src->vd_nblk) {
+		unsigned char **p;
+
+		p = krealloc(tgt->vd_deblk, sizeof(*p) * src->vd_nblk,
+			     GFP_NOFS);
+		if (unlikely(!p))
+			goto out;
+		tgt->vd_deblk = p;
+	}
+
+	tgt->vd_nblk = src->vd_nblk;
+	tgt->vd_deblk_sz = deblk_sz;
+	memcpy(tgt->vd_deblk[0], src->vd_deblk[0], deblk_sz);
+	/* tgt->vd_last.i = 0; */
+	/* tgt->vd_last.p.deblk = tgt->vd_deblk[0]; */
+	tgt->vd_version = src->vd_version;
+	tgt->vd_jiffy = src->vd_jiffy;
+
+	n = src->vd_nblk;
+	for (ul = 1; ul < n; ul++) {
+		tgt->vd_deblk[ul] = kmemdup(src->vd_deblk[ul], deblk_sz,
+					    GFP_NOFS);
+		if (unlikely(!tgt->vd_deblk[ul]))
+			goto out;
+	}
+	/* smp_mb(); */
+	return 0; /* success */
+
+ out:
+	rerr = reinit_vdir(tgt);
+	BUG_ON(rerr);
+	return err;
+}
+
+int au_vdir_init(struct file *file)
+{
+	int err;
+	struct inode *inode;
+	struct au_vdir *vdir_cache, *allocated;
+
+	err = read_vdir(file, !file->f_pos);
+	if (unlikely(err))
+		goto out;
+
+	allocated = NULL;
+	vdir_cache = au_fvdir_cache(file);
+	if (!vdir_cache) {
+		vdir_cache = alloc_vdir(file->f_dentry->d_sb);
+		err = PTR_ERR(vdir_cache);
+		if (IS_ERR(vdir_cache))
+			goto out;
+		allocated = vdir_cache;
+	} else if (!file->f_pos && vdir_cache->vd_version != file->f_version) {
+		err = reinit_vdir(vdir_cache);
+		if (unlikely(err))
+			goto out;
+	} else
+		return 0; /* success */
+
+	inode = file->f_dentry->d_inode;
+	err = copy_vdir(vdir_cache, au_ivdir(inode));
+	if (!err) {
+		file->f_version = inode->i_version;
+		if (allocated)
+			au_set_fvdir_cache(file, allocated);
+	} else if (allocated)
+		au_vdir_free(allocated);
+
+ out:
+	return err;
+}
+
+static loff_t calc_offset(struct au_vdir *vdir)
+{
+	loff_t offset;
+	union au_vdir_deblk_p p;
+
+	p.deblk = vdir->vd_deblk[vdir->vd_last.ul];
+	offset = vdir->vd_last.p.deblk - p.deblk;
+	offset += vdir->vd_deblk_sz * vdir->vd_last.ul;
+	return offset;
+}
+
+/* returns true or false */
+static int seek_vdir(struct file *file)
+{
+	int valid;
+	unsigned int deblk_sz;
+	unsigned long ul, n;
+	loff_t offset;
+	union au_vdir_deblk_p p, deblk_end;
+	struct au_vdir *vdir_cache;
+
+	valid = 1;
+	vdir_cache = au_fvdir_cache(file);
+	offset = calc_offset(vdir_cache);
+	AuDbg("offset %lld\n", offset);
+	if (file->f_pos == offset)
+		goto out;
+
+	vdir_cache->vd_last.ul = 0;
+	vdir_cache->vd_last.p.deblk = vdir_cache->vd_deblk[0];
+	if (!file->f_pos)
+		goto out;
+
+	valid = 0;
+	deblk_sz = vdir_cache->vd_deblk_sz;
+	ul = div64_u64(file->f_pos, deblk_sz);
+	AuDbg("ul %lu\n", ul);
+	if (ul >= vdir_cache->vd_nblk)
+		goto out;
+
+	n = vdir_cache->vd_nblk;
+	for (; ul < n; ul++) {
+		p.deblk = vdir_cache->vd_deblk[ul];
+		deblk_end.deblk = p.deblk + deblk_sz;
+		offset = ul;
+		offset *= deblk_sz;
+		while (!is_deblk_end(&p, &deblk_end) && offset < file->f_pos) {
+			unsigned int l;
+
+			l = calc_size(p.de->de_str.len);
+			offset += l;
+			p.deblk += l;
+		}
+		if (!is_deblk_end(&p, &deblk_end)) {
+			valid = 1;
+			vdir_cache->vd_last.ul = ul;
+			vdir_cache->vd_last.p = p;
+			break;
+		}
+	}
+
+ out:
+	/* smp_mb(); */
+	AuTraceErr(!valid);
+	return valid;
+}
+
+int au_vdir_fill_de(struct file *file, void *dirent, filldir_t filldir)
+{
+	int err;
+	unsigned int l, deblk_sz;
+	union au_vdir_deblk_p deblk_end;
+	struct au_vdir *vdir_cache;
+	struct au_vdir_de *de;
+
+	vdir_cache = au_fvdir_cache(file);
+	if (!seek_vdir(file))
+		return 0;
+
+	deblk_sz = vdir_cache->vd_deblk_sz;
+	while (1) {
+		deblk_end.deblk = vdir_cache->vd_deblk[vdir_cache->vd_last.ul];
+		deblk_end.deblk += deblk_sz;
+		while (!is_deblk_end(&vdir_cache->vd_last.p, &deblk_end)) {
+			de = vdir_cache->vd_last.p.de;
+			AuDbg("%.*s, off%lld, i%lu, dt%d\n",
+			      de->de_str.len, de->de_str.name, file->f_pos,
+			      (unsigned long)de->de_ino, de->de_type);
+			err = filldir(dirent, de->de_str.name, de->de_str.len,
+				      file->f_pos, de->de_ino, de->de_type);
+			if (unlikely(err)) {
+				AuTraceErr(err);
+				/* todo: ignore the error caused by udba? */
+				/* return err; */
+				return 0;
+			}
+
+			l = calc_size(de->de_str.len);
+			vdir_cache->vd_last.p.deblk += l;
+			file->f_pos += l;
+		}
+		if (vdir_cache->vd_last.ul < vdir_cache->vd_nblk - 1) {
+			vdir_cache->vd_last.ul++;
+			vdir_cache->vd_last.p.deblk
+				= vdir_cache->vd_deblk[vdir_cache->vd_last.ul];
+			file->f_pos = deblk_sz * vdir_cache->vd_last.ul;
+			continue;
+		}
+		break;
+	}
+
+	/* smp_mb(); */
+	return 0;
+}
--- linux-rt-2.6.31.orig/ubuntu/aufs/dbgaufs.h
+++ linux-rt-2.6.31/ubuntu/aufs/dbgaufs.h
@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * debugfs interface
+ */
+
+#ifndef __DBGAUFS_H__
+#define __DBGAUFS_H__
+
+#ifdef __KERNEL__
+
+#include <linux/init.h>
+#include <linux/aufs_type.h>
+
+struct super_block;
+struct au_sbinfo;
+
+#ifdef CONFIG_DEBUG_FS
+/* dbgaufs.c */
+void dbgaufs_brs_del(struct super_block *sb, aufs_bindex_t bindex);
+void dbgaufs_brs_add(struct super_block *sb, aufs_bindex_t bindex);
+void dbgaufs_si_fin(struct au_sbinfo *sbinfo);
+int dbgaufs_si_init(struct au_sbinfo *sbinfo);
+void dbgaufs_fin(void);
+int __init dbgaufs_init(void);
+
+#else
+
+static inline
+void dbgaufs_brs_del(struct super_block *sb, aufs_bindex_t bindex)
+{
+	/* empty */
+}
+
+static inline
+void dbgaufs_brs_add(struct super_block *sb, aufs_bindex_t bindex)
+{
+	/* empty */
+}
+
+static inline
+void dbgaufs_si_fin(struct au_sbinfo *sbinfo)
+{
+	/* empty */
+}
+
+static inline
+int dbgaufs_si_init(struct au_sbinfo *sbinfo)
+{
+	return 0;
+}
+
+#define dbgaufs_fin()	do {} while (0)
+
+static inline
+int __init dbgaufs_init(void)
+{
+	return 0;
+}
+#endif /* CONFIG_DEBUG_FS */
+
+#endif /* __KERNEL__ */
+#endif /* __DBGAUFS_H__ */
--- linux-rt-2.6.31.orig/ubuntu/aufs/sysaufs.c
+++ linux-rt-2.6.31/ubuntu/aufs/sysaufs.c
@@ -0,0 +1,104 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * sysfs interface and lifetime management
+ * they are necessary regardless sysfs is disabled.
+ */
+
+#include <linux/fs.h>
+#include <linux/random.h>
+#include <linux/sysfs.h>
+#include "aufs.h"
+
+unsigned long sysaufs_si_mask;
+struct kset *sysaufs_ket;
+
+#define AuSiAttr(_name) { \
+	.attr   = { .name = __stringify(_name), .mode = 0444 },	\
+	.show   = sysaufs_si_##_name,				\
+}
+
+static struct sysaufs_si_attr sysaufs_si_attr_xi_path = AuSiAttr(xi_path);
+struct attribute *sysaufs_si_attrs[] = {
+	&sysaufs_si_attr_xi_path.attr,
+	NULL,
+};
+
+static struct sysfs_ops au_sbi_ops = {
+	.show   = sysaufs_si_show
+};
+
+static struct kobj_type au_sbi_ktype = {
+	.release	= au_si_free,
+	.sysfs_ops	= &au_sbi_ops,
+	.default_attrs	= sysaufs_si_attrs
+};
+
+/* ---------------------------------------------------------------------- */
+
+int sysaufs_si_init(struct au_sbinfo *sbinfo)
+{
+	int err;
+
+	sbinfo->si_kobj.kset = sysaufs_ket;
+	/* cf. sysaufs_name() */
+	err = kobject_init_and_add
+		(&sbinfo->si_kobj, &au_sbi_ktype, /*&sysaufs_ket->kobj*/NULL,
+		 SysaufsSiNamePrefix "%lx", sysaufs_si_id(sbinfo));
+
+	dbgaufs_si_null(sbinfo);
+	if (!err) {
+		err = dbgaufs_si_init(sbinfo);
+		if (unlikely(err))
+			kobject_put(&sbinfo->si_kobj);
+	}
+	return err;
+}
+
+void sysaufs_fin(void)
+{
+	dbgaufs_fin();
+	sysfs_remove_group(&sysaufs_ket->kobj, sysaufs_attr_group);
+	kset_unregister(sysaufs_ket);
+}
+
+int __init sysaufs_init(void)
+{
+	int err;
+
+	do {
+		get_random_bytes(&sysaufs_si_mask, sizeof(sysaufs_si_mask));
+	} while (!sysaufs_si_mask);
+
+	sysaufs_ket = kset_create_and_add(AUFS_NAME, NULL, fs_kobj);
+	err = PTR_ERR(sysaufs_ket);
+	if (IS_ERR(sysaufs_ket))
+		goto out;
+	err = sysfs_create_group(&sysaufs_ket->kobj, sysaufs_attr_group);
+	if (unlikely(err)) {
+		kset_unregister(sysaufs_ket);
+		goto out;
+	}
+
+	err = dbgaufs_init();
+	if (unlikely(err))
+		sysaufs_fin();
+ out:
+	return err;
+}
--- linux-rt-2.6.31.orig/ubuntu/aufs/inode.h
+++ linux-rt-2.6.31/ubuntu/aufs/inode.h
@@ -0,0 +1,484 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * inode operations
+ */
+
+#ifndef __AUFS_INODE_H__
+#define __AUFS_INODE_H__
+
+#ifdef __KERNEL__
+
+#include <linux/fs.h>
+#include <linux/inotify.h>
+#include <linux/aufs_type.h>
+#include "rwsem.h"
+
+struct vfsmount;
+
+struct au_hinotify {
+#ifdef CONFIG_AUFS_HINOTIFY
+	struct inotify_watch	hin_watch;
+	struct inode		*hin_aufs_inode;	/* no get/put */
+#endif
+};
+
+struct au_hinode {
+	struct inode		*hi_inode;
+	aufs_bindex_t		hi_id;
+#ifdef CONFIG_AUFS_HINOTIFY
+	struct au_hinotify	*hi_notify;
+#endif
+
+	/* reference to the copied-up whiteout with get/put */
+	struct dentry		*hi_whdentry;
+};
+
+struct au_vdir;
+struct au_iinfo {
+	atomic_t		ii_generation;
+	struct super_block	*ii_hsb1;	/* no get/put */
+
+	struct au_rwsem		ii_rwsem;
+	aufs_bindex_t		ii_bstart, ii_bend;
+	__u32			ii_higen;
+	struct au_hinode	*ii_hinode;
+	struct au_vdir		*ii_vdir;
+};
+
+struct au_icntnr {
+	struct au_iinfo iinfo;
+	struct inode vfs_inode;
+};
+
+/* au_pin flags */
+#define AuPin_DI_LOCKED		1
+#define AuPin_MNT_WRITE		(1 << 1)
+#define au_ftest_pin(flags, name)	((flags) & AuPin_##name)
+#define au_fset_pin(flags, name)	{ (flags) |= AuPin_##name; }
+#define au_fclr_pin(flags, name)	{ (flags) &= ~AuPin_##name; }
+
+struct au_pin {
+	/* input */
+	struct dentry *dentry;
+	unsigned int udba;
+	unsigned char lsc_di, lsc_hi, flags;
+	aufs_bindex_t bindex;
+
+	/* output */
+	struct dentry *parent;
+	struct au_hinode *hdir;
+	struct vfsmount *h_mnt;
+};
+
+/* ---------------------------------------------------------------------- */
+
+static inline struct au_iinfo *au_ii(struct inode *inode)
+{
+	struct au_iinfo *iinfo;
+
+	iinfo = &(container_of(inode, struct au_icntnr, vfs_inode)->iinfo);
+	if (iinfo->ii_hinode)
+		return iinfo;
+	return NULL; /* debugging bad_inode case */
+}
+
+/* ---------------------------------------------------------------------- */
+
+/* inode.c */
+struct inode *au_igrab(struct inode *inode);
+int au_refresh_hinode_self(struct inode *inode, int do_attr);
+int au_refresh_hinode(struct inode *inode, struct dentry *dentry);
+struct inode *au_new_inode(struct dentry *dentry, int must_new);
+int au_test_ro(struct super_block *sb, aufs_bindex_t bindex,
+	       struct inode *inode);
+int au_test_h_perm(struct inode *h_inode, int mask);
+int au_test_h_perm_sio(struct inode *h_inode, int mask);
+
+/* i_op.c */
+extern struct inode_operations aufs_iop, aufs_symlink_iop, aufs_dir_iop;
+
+/* au_wr_dir flags */
+#define AuWrDir_ADD_ENTRY	1
+#define AuWrDir_ISDIR		(1 << 1)
+#define au_ftest_wrdir(flags, name)	((flags) & AuWrDir_##name)
+#define au_fset_wrdir(flags, name)	{ (flags) |= AuWrDir_##name; }
+#define au_fclr_wrdir(flags, name)	{ (flags) &= ~AuWrDir_##name; }
+
+struct au_wr_dir_args {
+	aufs_bindex_t force_btgt;
+	unsigned char flags;
+};
+int au_wr_dir(struct dentry *dentry, struct dentry *src_dentry,
+	      struct au_wr_dir_args *args);
+
+struct dentry *au_pinned_h_parent(struct au_pin *pin);
+void au_pin_init(struct au_pin *pin, struct dentry *dentry,
+		 aufs_bindex_t bindex, int lsc_di, int lsc_hi,
+		 unsigned int udba, unsigned char flags);
+int au_pin(struct au_pin *pin, struct dentry *dentry, aufs_bindex_t bindex,
+	   unsigned int udba, unsigned char flags) __must_check;
+int au_do_pin(struct au_pin *pin) __must_check;
+void au_unpin(struct au_pin *pin);
+
+/* i_op_add.c */
+int au_may_add(struct dentry *dentry, aufs_bindex_t bindex,
+	       struct dentry *h_parent, int isdir);
+int aufs_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev);
+int aufs_symlink(struct inode *dir, struct dentry *dentry, const char *symname);
+int aufs_create(struct inode *dir, struct dentry *dentry, int mode,
+		struct nameidata *nd);
+int aufs_link(struct dentry *src_dentry, struct inode *dir,
+	      struct dentry *dentry);
+int aufs_mkdir(struct inode *dir, struct dentry *dentry, int mode);
+
+/* i_op_del.c */
+int au_wr_dir_need_wh(struct dentry *dentry, int isdir, aufs_bindex_t *bcpup);
+int au_may_del(struct dentry *dentry, aufs_bindex_t bindex,
+	       struct dentry *h_parent, int isdir);
+int aufs_unlink(struct inode *dir, struct dentry *dentry);
+int aufs_rmdir(struct inode *dir, struct dentry *dentry);
+
+/* i_op_ren.c */
+int au_wbr(struct dentry *dentry, aufs_bindex_t btgt);
+int aufs_rename(struct inode *src_dir, struct dentry *src_dentry,
+		struct inode *dir, struct dentry *dentry);
+
+/* iinfo.c */
+struct inode *au_h_iptr(struct inode *inode, aufs_bindex_t bindex);
+void au_hiput(struct au_hinode *hinode);
+void au_set_ibstart(struct inode *inode, aufs_bindex_t bindex);
+void au_set_hi_wh(struct inode *inode, aufs_bindex_t bindex,
+		  struct dentry *h_wh);
+unsigned int au_hi_flags(struct inode *inode, int isdir);
+
+/* hinode flags */
+#define AuHi_XINO	1
+#define AuHi_HINOTIFY	(1 << 1)
+#define au_ftest_hi(flags, name)	((flags) & AuHi_##name)
+#define au_fset_hi(flags, name)		{ (flags) |= AuHi_##name; }
+#define au_fclr_hi(flags, name)		{ (flags) &= ~AuHi_##name; }
+
+#ifndef CONFIG_AUFS_HINOTIFY
+#undef AuHi_HINOTIFY
+#define AuHi_HINOTIFY	0
+#endif
+
+void au_set_h_iptr(struct inode *inode, aufs_bindex_t bindex,
+		   struct inode *h_inode, unsigned int flags);
+
+void au_update_iigen(struct inode *inode);
+void au_update_brange(struct inode *inode, int do_put_zero);
+
+int au_iinfo_init(struct inode *inode);
+void au_iinfo_fin(struct inode *inode);
+int au_ii_realloc(struct au_iinfo *iinfo, int nbr);
+
+/* plink.c */
+void au_plink_block_maintain(struct super_block *sb);
+#ifdef CONFIG_AUFS_DEBUG
+void au_plink_list(struct super_block *sb);
+#else
+static inline void au_plink_list(struct super_block *sb)
+{
+	/* nothing */
+}
+#endif
+int au_plink_test(struct inode *inode);
+struct dentry *au_plink_lkup(struct inode *inode, aufs_bindex_t bindex);
+void au_plink_append(struct inode *inode, aufs_bindex_t bindex,
+		     struct dentry *h_dentry);
+void au_plink_put(struct super_block *sb);
+void au_plink_half_refresh(struct super_block *sb, aufs_bindex_t br_id);
+
+/* ---------------------------------------------------------------------- */
+
+/* lock subclass for iinfo */
+enum {
+	AuLsc_II_CHILD,		/* child first */
+	AuLsc_II_CHILD2,	/* rename(2), link(2), and cpup at hinotify */
+	AuLsc_II_CHILD3,	/* copyup dirs */
+	AuLsc_II_PARENT,	/* see AuLsc_I_PARENT in vfsub.h */
+	AuLsc_II_PARENT2,
+	AuLsc_II_PARENT3,	/* copyup dirs */
+	AuLsc_II_NEW_CHILD
+};
+
+/*
+ * ii_read_lock_child, ii_write_lock_child,
+ * ii_read_lock_child2, ii_write_lock_child2,
+ * ii_read_lock_child3, ii_write_lock_child3,
+ * ii_read_lock_parent, ii_write_lock_parent,
+ * ii_read_lock_parent2, ii_write_lock_parent2,
+ * ii_read_lock_parent3, ii_write_lock_parent3,
+ * ii_read_lock_new_child, ii_write_lock_new_child,
+ */
+#define AuReadLockFunc(name, lsc) \
+static inline void ii_read_lock_##name(struct inode *i) \
+{ \
+	au_rw_read_lock_nested(&au_ii(i)->ii_rwsem, AuLsc_II_##lsc); \
+}
+
+#define AuWriteLockFunc(name, lsc) \
+static inline void ii_write_lock_##name(struct inode *i) \
+{ \
+	au_rw_write_lock_nested(&au_ii(i)->ii_rwsem, AuLsc_II_##lsc); \
+}
+
+#define AuRWLockFuncs(name, lsc) \
+	AuReadLockFunc(name, lsc) \
+	AuWriteLockFunc(name, lsc)
+
+AuRWLockFuncs(child, CHILD);
+AuRWLockFuncs(child2, CHILD2);
+AuRWLockFuncs(child3, CHILD3);
+AuRWLockFuncs(parent, PARENT);
+AuRWLockFuncs(parent2, PARENT2);
+AuRWLockFuncs(parent3, PARENT3);
+AuRWLockFuncs(new_child, NEW_CHILD);
+
+#undef AuReadLockFunc
+#undef AuWriteLockFunc
+#undef AuRWLockFuncs
+
+/*
+ * ii_read_unlock, ii_write_unlock, ii_downgrade_lock
+ */
+AuSimpleUnlockRwsemFuncs(ii, struct inode *i, &au_ii(i)->ii_rwsem);
+
+#define IiMustNoWaiters(i)	AuRwMustNoWaiters(&au_ii(i)->ii_rwsem)
+#define IiMustAnyLock(i)	AuRwMustAnyLock(&au_ii(i)->ii_rwsem)
+#define IiMustWriteLock(i)	AuRwMustWriteLock(&au_ii(i)->ii_rwsem)
+
+/* ---------------------------------------------------------------------- */
+
+static inline unsigned int au_iigen(struct inode *inode)
+{
+	return atomic_read(&au_ii(inode)->ii_generation);
+}
+
+/* tiny test for inode number */
+/* tmpfs generation is too rough */
+static inline int au_test_higen(struct inode *inode, struct inode *h_inode)
+{
+	struct au_iinfo *iinfo;
+
+	iinfo = au_ii(inode);
+	AuRwMustAnyLock(&iinfo->ii_rwsem);
+	return !(iinfo->ii_hsb1 == h_inode->i_sb
+		 && iinfo->ii_higen == h_inode->i_generation);
+}
+
+/* ---------------------------------------------------------------------- */
+
+static inline aufs_bindex_t au_ii_br_id(struct inode *inode,
+					aufs_bindex_t bindex)
+{
+	IiMustAnyLock(inode);
+	return au_ii(inode)->ii_hinode[0 + bindex].hi_id;
+}
+
+static inline aufs_bindex_t au_ibstart(struct inode *inode)
+{
+	IiMustAnyLock(inode);
+	return au_ii(inode)->ii_bstart;
+}
+
+static inline aufs_bindex_t au_ibend(struct inode *inode)
+{
+	IiMustAnyLock(inode);
+	return au_ii(inode)->ii_bend;
+}
+
+static inline struct au_vdir *au_ivdir(struct inode *inode)
+{
+	IiMustAnyLock(inode);
+	return au_ii(inode)->ii_vdir;
+}
+
+static inline struct dentry *au_hi_wh(struct inode *inode, aufs_bindex_t bindex)
+{
+	IiMustAnyLock(inode);
+	return au_ii(inode)->ii_hinode[0 + bindex].hi_whdentry;
+}
+
+static inline void au_set_ibend(struct inode *inode, aufs_bindex_t bindex)
+{
+	IiMustWriteLock(inode);
+	au_ii(inode)->ii_bend = bindex;
+}
+
+static inline void au_set_ivdir(struct inode *inode, struct au_vdir *vdir)
+{
+	IiMustWriteLock(inode);
+	au_ii(inode)->ii_vdir = vdir;
+}
+
+static inline struct au_hinode *au_hi(struct inode *inode, aufs_bindex_t bindex)
+{
+	IiMustAnyLock(inode);
+	return au_ii(inode)->ii_hinode + bindex;
+}
+
+/* ---------------------------------------------------------------------- */
+
+static inline struct dentry *au_pinned_parent(struct au_pin *pin)
+{
+	if (pin)
+		return pin->parent;
+	return NULL;
+}
+
+static inline struct inode *au_pinned_h_dir(struct au_pin *pin)
+{
+	if (pin && pin->hdir)
+		return pin->hdir->hi_inode;
+	return NULL;
+}
+
+static inline struct au_hinode *au_pinned_hdir(struct au_pin *pin)
+{
+	if (pin)
+		return pin->hdir;
+	return NULL;
+}
+
+static inline void au_pin_set_dentry(struct au_pin *pin, struct dentry *dentry)
+{
+	if (pin)
+		pin->dentry = dentry;
+}
+
+static inline void au_pin_set_parent_lflag(struct au_pin *pin,
+					   unsigned char lflag)
+{
+	if (pin) {
+		/* dirty macros require brackets */
+		if (lflag) {
+			au_fset_pin(pin->flags, DI_LOCKED);
+		} else {
+			au_fclr_pin(pin->flags, DI_LOCKED);
+		}
+	}
+}
+
+static inline void au_pin_set_parent(struct au_pin *pin, struct dentry *parent)
+{
+	if (pin) {
+		dput(pin->parent);
+		pin->parent = dget(parent);
+	}
+}
+
+/* ---------------------------------------------------------------------- */
+
+#ifdef CONFIG_AUFS_HINOTIFY
+/* hinotify.c */
+int au_hin_alloc(struct au_hinode *hinode, struct inode *inode,
+		 struct inode *h_inode);
+void au_hin_free(struct au_hinode *hinode);
+void au_hin_ctl(struct au_hinode *hinode, int do_set);
+void au_reset_hinotify(struct inode *inode, unsigned int flags);
+
+int __init au_hinotify_init(void);
+void au_hinotify_fin(void);
+
+static inline
+void au_hin_init(struct au_hinode *hinode, struct au_hinotify *val)
+{
+	hinode->hi_notify = val;
+}
+
+static inline void au_iigen_dec(struct inode *inode)
+{
+	atomic_dec_return(&au_ii(inode)->ii_generation);
+}
+
+#else
+static inline
+int au_hin_alloc(struct au_hinode *hinode __maybe_unused,
+		 struct inode *inode __maybe_unused,
+		 struct inode *h_inode __maybe_unused)
+{
+	return -EOPNOTSUPP;
+}
+
+static inline void au_hin_free(struct au_hinode *hinode __maybe_unused)
+{
+	/* nothing */
+}
+
+static inline void au_hin_ctl(struct au_hinode *hinode __maybe_unused,
+			      int do_set __maybe_unused)
+{
+	/* nothing */
+}
+
+static inline void au_reset_hinotify(struct inode *inode __maybe_unused,
+				     unsigned int flags __maybe_unused)
+{
+	/* nothing */
+}
+
+static inline int au_hinotify_init(void)
+{
+	return 0;
+}
+
+#define au_hinotify_fin()	do {} while (0)
+
+static inline
+void au_hin_init(struct au_hinode *hinode __maybe_unused,
+		 struct au_hinotify *val __maybe_unused)
+{
+	/* empty */
+}
+#endif /* CONFIG_AUFS_HINOTIFY */
+
+static inline void au_hin_suspend(struct au_hinode *hdir)
+{
+	au_hin_ctl(hdir, /*do_set*/0);
+}
+
+static inline void au_hin_resume(struct au_hinode *hdir)
+{
+	au_hin_ctl(hdir, /*do_set*/1);
+}
+
+static inline void au_hin_imtx_lock(struct au_hinode *hdir)
+{
+	mutex_lock(&hdir->hi_inode->i_mutex);
+	au_hin_suspend(hdir);
+}
+
+static inline void au_hin_imtx_lock_nested(struct au_hinode *hdir,
+					   unsigned int sc __maybe_unused)
+{
+	mutex_lock_nested(&hdir->hi_inode->i_mutex, sc);
+	au_hin_suspend(hdir);
+}
+
+static inline void au_hin_imtx_unlock(struct au_hinode *hdir)
+{
+	au_hin_resume(hdir);
+	mutex_unlock(&hdir->hi_inode->i_mutex);
+}
+
+#endif /* __KERNEL__ */
+#endif /* __AUFS_INODE_H__ */
--- linux-rt-2.6.31.orig/ubuntu/aufs/branch.c
+++ linux-rt-2.6.31/ubuntu/aufs/branch.c
@@ -0,0 +1,983 @@
+/*
+ * Copyright (C) 2005-2009 Junjiro R. Okajima
+ *
+ * This program, aufs is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/*
+ * branch management
+ */
+
+#include <linux/file.h>
+#include "aufs.h"
+
+/*
+ * free a single branch
+ */
+static void au_br_do_free(struct au_branch *br)
+{
+	int i;
+	struct au_wbr *wbr;
+
+	if (br->br_xino.xi_file)
+		fput(br->br_xino.xi_file);
+	mutex_destroy(&br->br_xino.xi_nondir_mtx);
+
+	AuDebugOn(atomic_read(&br->br_count));
+
+	wbr = br->br_wbr;
+	if (wbr) {
+		for (i = 0; i < AuBrWh_Last; i++)
+			dput(wbr->wbr_wh[i]);
+		AuDebugOn(atomic_read(&wbr->wbr_wh_running));
+		AuRwDestroy(&wbr->wbr_wh_rwsem);
+	}
+
+	/* some filesystems acquire extra lock */
+	lockdep_off();
+	mntput(br->br_mnt);
+	lockdep_on();
+
+	kfree(wbr);
+	kfree(br);
+}
+
+/*
+ * frees all branches
+ */
+void au_br_free(struct au_sbinfo *sbinfo)
+{
+	aufs_bindex_t bmax;
+	struct au_branch **br;
+
+	AuRwMustWriteLock(&sbinfo->si_rwsem);
+
+	bmax = sbinfo->si_bend + 1;
+	br = sbinfo->si_branch;
+	while (bmax--)
+		au_br_do_free(*br++);
+}
+
+/*
+ * find the index of a branch which is specified by @br_id.
+ */
+int au_br_index(struct super_block *sb, aufs_bindex_t br_id)
+{
+	aufs_bindex_t bindex, bend;
+
+	bend = au_sbend(sb);
+	for (bindex = 0; bindex <= bend; bindex++)
+		if (au_sbr_id(sb, bindex) == br_id)
+			return bindex;
+	return -1;
+}
+
+/* ---------------------------------------------------------------------- */
+
+/*
+ * add a branch
+ */
+
+static int test_overlap(struct super_block *sb, struct dentry *h_d1,
+			struct dentry *h_d2)
+{
+	if (unlikely(h_d1 == h_d2))
+		return 1;
+	return !!au_test_subdir(h_d1, h_d2)
+		|| !!au_test_subdir(h_d2, h_d1)
+		|| au_test_loopback_overlap(sb, h_d1, h_d2)
+		|| au_test_loopback_overlap(sb, h_d2, h_d1);
+}
+
+/*
+ * returns a newly allocated branch. @new_nbranch is a number of branches
+ * after adding a branch.
+ */
+static struct au_branch *au_br_alloc(struct super_block *sb, int new_nbranch,
+				     int perm)
+{
+	struct au_branch *add_branch;
+	struct dentry *root;
+
+	root = sb->s_root;
+	add_branch = kmalloc(sizeof(*add_branch), GFP_NOFS);
+	if (unlikely(!add_branch))
+		goto out;
+
+	add_branch->br_wbr = NULL;
+	if (au_br_writable(perm)) {
+		/* may be freed separately at changing the branch permission */
+		add_branch->br_wbr = kmalloc(sizeof(*add_branch->br_wbr),
+					     GFP_NOFS);
+		if (unlikely(!add_branch->br_wbr))
+			goto out_br;
+	}
+
+	if (unlikely(au_sbr_realloc(au_sbi(sb), new_nbranch)
+		     || au_di_realloc(au_di(root), new_nbranch)
+		     || au_ii_realloc(au_ii(root->d_inode), new_nbranch)))
+		goto out_wbr;
+	return add_branch; /* success */
+
+ out_wbr:
+	kfree(add_branch->br_wbr);
+ out_br:
+	kfree(add_branch);
+ out:
+	return ERR_PTR(-ENOMEM);
+}
+
+/*
+ * test if the branch permission is legal or not.
+ */
+static int test_br(struct inode *inode, int brperm, char *path)
+{
+	int err;
+
+	err = 0;
+	if (unlikely(au_br_writable(brperm) && IS_RDONLY(inode))) {
+		AuErr("write permission for readonly mount or inode, %s\n",
+		      path);
+		err = -EINVAL;
+	}
+
+	return err;
+}
+
+/*
+ * returns:
+ * 0: success, the caller will add it
+ * plus: success, it is already unified, the caller should ignore it
+ * minus: error
+ */
+static int test_add(struct super_block *sb, struct au_opt_add *add, int remount)
+{
+	int err;
+	aufs_bindex_t bend, bindex;
+	struct dentry *root;
+	struct inode *inode, *h_inode;
+
+	root = sb->s_root;
+	bend = au_sbend(sb);
+	if (unlikely(bend >= 0
+		     && au_find_dbindex(root, add->path.dentry) >= 0)) {
+		err = 1;
+		if (!remount) {
+			err = -EINVAL;
+			AuErr("%s duplicated\n", add->pathname);
+		}
+		goto out;
+	}
+
+	err = -ENOSPC; /* -E2BIG; */
+	if (unlikely(AUFS_BRANCH_MAX <= add->bindex
+		     || AUFS_BRANCH_MAX - 1 <= bend)) {
+		AuErr("number of branches exceeded %s\n", add->pathname);
+		goto out;
+	}
+
+	err = -EDOM;
+	if (unlikely(add->bindex < 0 || bend + 1 < add->bindex)) {
+		AuErr("bad index %d\n", add->bindex);
+		goto out;
+	}
+
+	inode = add->path.dentry->d_inode;
+	err = -ENOENT;
+	if (unlikely(!inode->i_nlink)) {
+		AuErr("no existence %s\n", add->pathname);
+		goto out;
+	}
+
+	err = -EINVAL;
+	if (unlikely(inode->i_sb == sb)) {
+		AuErr("%s must be outside\n", add->pathname);
+		goto out;
+	}
+
+	if (unlikely(au_test_fs_unsuppoted(inode->i_sb))) {
+		AuErr("unsupported filesystem, %s (%s)\n",
+		      add->pathname, au_sbtype(inode->i_sb));
+		goto out;
+	}
+
+	err = test_br(add->path.dentry->d_inode, add->perm, add->pathname);
+	if (unlikely(err))
+		goto out;
+
+	if (bend < 0)
+		return 0; /* success */
+
+	err = -EINVAL;
+	for (bindex = 0; bindex <= bend; bindex++)
+		if (unlikely(test_overlap(sb, add->path.dentry,
+					  au_h_dptr(root, bindex)))) {
+			AuErr("%s is overlapped\n", add->pathname);
+			goto out;
+		}
+
+	err = 0;
+	if (au_opt_test(au_mntflags(sb), WARN_PERM)) {
+		h_inode = au_h_dptr(root, 0)->d_inode;
+		if ((h_inode->i_mode & S_IALLUGO) != (inode->i_mode & S_IALLUGO)
+		    || h_inode->i_uid != inode->i_uid
+		    || h_inode->i_gid != inode->i_gid)
+			AuWarn("uid/gid/perm %s %u/%u/0%o, %u/%u/0%o\n",
+			       add->pathname,
+			       inode->i_uid, inode->i_gid,
+			       (inode->i_mode & S_IALLUGO),
+			       h_inode->i_uid, h_inode->i_gid,
+			       (h_inode->i_mode & S_IALLUGO));
+	}
+
+ out:
+	return err;
+}
+
+/*
+ * initialize or clean the whiteouts for an adding branch
+ */
+static int au_br_init_wh(struct super_block *sb, struct au_branch *br,
+			 int new_perm, struct dentry *h_root)
+{
+	int err, old_perm;
+	aufs_bindex_t bindex;
+	struct mutex *h_mtx;
+	struct au_wbr *wbr;
+	struct au_hinode *hdir;
+
+	wbr = br->br_wbr;
+	old_perm = br->br_perm;
+	br->br_perm = new_perm;
+	hdir = NULL;
+	h_mtx = NULL;
+	bindex = au_br_index(sb, br->br_id);
+	if (0 <= bindex) {
+		hdir = au_hi(sb->s_root->d_inode, bindex);
+		au_hin_imtx_lock_nested(hdir, AuLsc_I_PARENT);
+	} else {
+		h_mtx = &h_root->d_inode->i_mutex;
+		mutex_lock_nested(h_mtx, AuLsc_I_PARENT);
+	}
+	if (!wbr)
+		err = au_wh_init(h_root, br, sb);
+	else {
+		wbr_wh_write_lock(wbr);
+		err = au_wh_init(h_root, br, sb);
+		wbr_wh_write_unlock(wbr);
+	}
+	if (hdir)
+		au_hin_imtx_unlock(hdir);
+	else
+		mutex_unlock(h_mtx);
+	br->br_perm = old_perm;
+
+	if (!err && wbr && !au_br_writable(new_perm)) {
+		kfree(wbr);
+		br->br_wbr = NULL;
+	}
+
+	return err;
+}
+
+static int au_wbr_init(struct au_branch *br, struct super_block *sb,
+		       int perm, struct path *path)
+{
+	int err;
+	struct au_wbr *wbr;
+
+	wbr = br->br_wbr;
+	au_rw_init(&wbr->wbr_wh_rwsem);
+	memset(wbr->wbr_wh, 0, sizeof(wbr->wbr_wh));
+	atomic_set(&wbr->wbr_wh_running, 0);
+	wbr->wbr_bytes = 0;
+
+	err = au_br_init_wh(sb, br, perm, path->dentry);
+
+	return err;
+}
+
+/* intialize a new branch */
+static int au_br_init(struct au_branch *br, struct super_block *sb,
+		      struct au_opt_add *add)
+{
+	int err;
+
+	err = 0;
+	memset(&br->br_xino, 0, sizeof(br->br_xino));
+	mutex_init(&br->br_xino.xi_nondir_mtx);
+	br->br_perm = add->perm;
+	br->br_mnt = add->path.mnt; /* set first, mntget() later */
+	atomic_set(&br->br_count, 0);
+	br->br_xino_upper = AUFS_XINO_TRUNC_INIT;
+	atomic_set(&br->br_xino_running, 0);
+	br->br_id = au_new_br_id(sb);
+
+	if (au_br_writable(add->perm)) {
+		err = au_wbr_init(br, sb, add->perm, &add->path);
+		if (unlikely(err))
+			goto out;
+	}
+
+	if (au_opt_test(au_mntflags(sb), XINO)) {
+		err = au_xino_br(sb, br, add->path.dentry->d_inode->i_ino,
+				 au_sbr(sb, 0)->br_xino.xi_file, /*do_test*/1);
+		if (unlikely(err)) {
+			AuDebugOn(br->br_xino.xi_file);
+			goto out;
+		}
+	}
+
+	sysaufs_br_init(br);
+	mntget(add->path.mnt);
+
+ out:
+	return err;
+}
+
+static void au_br_do_add_brp(struct au_sbinfo *sbinfo, aufs_bindex_t bindex,
+			     struct au_branch *br, aufs_bindex_t bend,
+			     aufs_bindex_t amount)
+{
+	struct au_branch **brp;
+
+	AuRwMustWriteLock(&sbinfo->si_rwsem);
+
+	brp = sbinfo->si_branch + bindex;
+	memmove(brp + 1, brp, sizeof(*brp) * amount);
+	*brp = br;
+	sbinfo->si_bend++;
+	if (unlikely(bend < 0))
+		sbinfo->si_bend = 0;
+}
+
+static void au_br_do_add_hdp(struct au_dinfo *dinfo, aufs_bindex_t bindex,
+			     aufs_bindex_t bend, aufs_bindex_t amount)
+{
+	struct au_hdentry *hdp;
+
+	AuRwMustWriteLock(&dinfo->di_rwsem);
+
+	hdp = dinfo->di_hdentry + bindex;
+	memmove(hdp + 1, hdp, sizeof(*hdp) * amount);
+	au_h_dentry_init(hdp);
+	dinfo->di_bend++;
+	if (unlikely(bend < 0))
+		dinfo->di_bstart = 0;
+}
+
+static void au_br_do_add_hip(struct au_iinfo *iinfo, aufs_bindex_t bindex,
+			     aufs_bindex_t bend, aufs_bindex_t amount)
+{
+	struct au_hinode *hip;
+
+	AuRwMustWriteLock(&iinfo->ii_rwsem);
+
+	hip = iinfo->ii_hinode + bindex;
+	memmove(hip + 1, hip, sizeof(*hip) * amount);
+	hip->hi_inode = NULL;
+	au_hin_init(hip, NULL);
+	iinfo->ii_bend++;
+	if (unlikely(bend < 0))
+		iinfo->ii_bstart = 0;
+}
+
+static void au_br_do_add(struct super_block *sb, struct dentry *h_dentry,
+			 struct au_branch *br, aufs_bindex_t bindex)
+{
+	struct dentry *root;
+	struct inode *root_inode;
+	aufs_bindex_t bend, amount;
+
+	root = sb->s_root;
+	root_inode = root->d_inode;
+	au_plink_block_maintain(sb);
+	bend = au_sbend(sb);
+	amount = bend + 1 - bindex;
+	au_br_do_add_brp(au_sbi(sb), bindex, br, bend, amount);
+	au_br_do_add_hdp(au_di(root), bindex, bend, amount);
+	au_br_do_add_hip(au_ii(root_inode), bindex, bend, amount);
+	au_set_h_dptr(root, bindex, dget(h_dentry));
+	au_set_h_iptr(root_inode, bindex, au_igrab(h_dentry->d_inode),
+		      /*flags*/0);
+}
+
+int au_br_add(struct super_block *sb, struct au_opt_add *add, int remount)
+{
+	int err;
+	unsigned long long maxb;
+	aufs_bindex_t bend, add_bindex;
+	struct dentry *root, *h_dentry;
+	struct inode *root_inode;
+	struct au_branch *add_branch;
+
+	root = sb->s_root;
+	root_inode = root->d_inode;
+	IMustLock(root_inode);
+	err = test_add(sb, add, remount);
+	if (unlikely(err < 0))
+		goto out;
+	if (err) {
+		err = 0;
+		goto out; /* success */
+	}
+
+	bend = au_sbend(sb);
+	add_branch = au_br_alloc(sb, bend + 2, add->perm);
+	err = PTR_ERR(add_branch);
+	if (IS_ERR(add_branch))
+		goto out;
+
+	err = au_br_init(add_branch, sb, add);
+	if (unlikely(err)) {
+		au_br_do_free(add_branch);
+		goto out;
+	}
+
+	add_bindex = add->bindex;
+	h_dentry = add->path.dentry;
+	if (!remount)
+		au_br_do_add(sb, h_dentry, add_branch, add_bindex);
+	else {
+		sysaufs_brs_del(sb, add_bindex);
+		au_br_do_add(sb, h_dentry, add_branch, add_bindex);
+		sysaufs_brs_add(sb, add_bindex);
+	}
+
+	if (!add_bindex)
+		au_cpup_attr_all(root_inode, /*force*/1);
+	else
+		au_add_nlink(root_inode, h_dentry->d_inode);
+	maxb = h_dentry->d_sb->s_maxbytes;
+	if (sb->s_maxbytes < maxb)
+		sb->s_maxbytes = maxb;
+
+	/*
+	 * this test/set prevents aufs from handling unnecesary inotify events
+	 * of xino files, in a case of re-adding a writable branch which was
+	 * once detached from aufs.
+	 */
+	if (au_xino_brid(sb) < 0
+	    && au_br_writable(add_branch->br_perm)
+	    && !au_test_fs_bad_xino(h_dentry->d_sb)
+	    && add_branch->br_xino.xi_file
+	    && add_branch->br_xino.xi_file->f_dentry->d_parent == h_dentry)
+		au_xino_brid_set(sb, add_branch->br_id);
+
+ out:
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+/*
+ * delete a branch
+ */
+
+/* to show the line number, do not make it inlined function */
+#define AuVerbose(do_info, fmt, args...) do { \
+	if (do_info) \
+		AuInfo(fmt, ##args); \
+} while (0)
+
+/*
+ * test if the branch is deletable or not.
+ */
+static int test_dentry_busy(struct dentry *root, aufs_bindex_t bindex,
+			    unsigned int sigen)
+{
+	int err, i, j, ndentry;
+	aufs_bindex_t bstart, bend;
+	unsigned char verbose;
+	struct au_dcsub_pages dpages;
+	struct au_dpage *dpage;
+	struct dentry *d;
+	struct inode *inode;
+
+	err = au_dpages_init(&dpages, GFP_NOFS);
+	if (unlikely(err))
+		goto out;
+	err = au_dcsub_pages(&dpages, root, NULL, NULL);
+	if (unlikely(err))
+		goto out_dpages;
+
+	verbose = !!au_opt_test(au_mntflags(root->d_sb), VERBOSE);
+	for (i = 0; !err && i < dpages.ndpage; i++) {
+		dpage = dpages.dpages + i;
+		ndentry = dpage->ndentry;
+		for (j = 0; !err && j < ndentry; j++) {
+			d = dpage->dentries[j];
+			AuDebugOn(!atomic_read(&d->d_count));
+			inode = d->d_inode;
+			if (au_digen(d) == sigen && au_iigen(inode) == sigen)
+				di_read_lock_child(d, AuLock_IR);
+			else {
+				di_write_lock_child(d);
+				err = au_reval_dpath(d, sigen);
+				if (!err)
+					di_downgrade_lock(d, AuLock_IR);
+				else {
+					di_write_unlock(d);
+					break;
+				}
+			}
+
+			bstart = au_dbstart(d);
+			bend = au_dbend(d);
+			if (bstart <= bindex
+			    && bindex <= bend
+			    && au_h_dptr(d, bindex)
+			    && (!S_ISDIR(inode->i_mode) || bstart == bend)) {
+				err = -EBUSY;
+				AuVerbose(verbose, "busy %.*s\n", AuDLNPair(d));
+			}
+			di_read_unlock(d, AuLock_IR);
+		}
+	}
+
+ out_dpages:
+	au_dpages_free(&dpages);
+ out:
+	return err;
+}
+
+static int test_inode_busy(struct super_block *sb, aufs_bindex_t bindex,
+			   unsigned int sigen)
+{
+	int err;
+	struct inode *i;
+	aufs_bindex_t bstart, bend;
+	unsigned char verbose;
+
+	err = 0;
+	verbose = !!au_opt_test(au_mntflags(sb), VERBOSE);
+	list_for_each_entry(i, &sb->s_inodes, i_sb_list) {
+		AuDebugOn(!atomic_read(&i->i_count));
+		if (!list_empty(&i->i_dentry))
+			continue;
+
+		if (au_iigen(i) == sigen)
+			ii_read_lock_child(i);
+		else {
+			ii_write_lock_child(i);
+			err = au_refresh_hinode_self(i, /*do_attr*/1);
+			if (!err)
+				ii_downgrade_lock(i);
+			else {
+				ii_write_unlock(i);
+				break;
+			}
+		}
+
+		bstart = au_ibstart(i);
+		bend = au_ibend(i);
+		if (bstart <= bindex
+		    && bindex <= bend
+		    && au_h_iptr(i, bindex)
+		    && (!S_ISDIR(i->i_mode) || bstart == bend)) {
+			err = -EBUSY;
+			AuVerbose(verbose, "busy i%lu\n", i->i_ino);
+			ii_read_unlock(i);
+			break;
+		}
+		ii_read_unlock(i);
+	}
+
+	return err;
+}
+
+static int test_children_busy(struct dentry *root, aufs_bindex_t bindex)
+{
+	int err;
+	unsigned int sigen;
+
+	sigen = au_sigen(root->d_sb);
+	DiMustNoWaiters(root);
+	IiMustNoWaiters(root->d_inode);
+	di_write_unlock(root);
+	err = test_dentry_busy(root, bindex, sigen);
+	if (!err)
+		err = test_inode_busy(root->d_sb, bindex, sigen);
+	di_write_lock_child(root); /* aufs_write_lock() calls ..._child() */
+
+	return err;
+}
+
+static void au_br_do_del_brp(struct au_sbinfo *sbinfo,
+			     const aufs_bindex_t bindex,
+			     const aufs_bindex_t bend)
+{
+	struct au_branch **brp, **p;
+
+	AuRwMustWriteLock(&sbinfo->si_rwsem);
+
+	brp = sbinfo->si_branch + bindex;
+	if (bindex < bend)
+		memmove(brp, brp + 1, sizeof(*brp) * (bend - bindex));
+	sbinfo->si_branch[0 + bend] = NULL;
+	sbinfo->si_bend--;
+
+	p = krealloc(sbinfo->si_branch, sizeof(*p) * bend, GFP_NOFS);
+	if (p)
+		sbinfo->si_branch = p;
+}
+
+static void au_br_do_del_hdp(struct au_dinfo *dinfo, const aufs_bindex_t bindex,
+			     const aufs_bindex_t bend)
+{
+	struct au_hdentry *hdp, *p;
+
+	AuRwMustWriteLock(&dinfo->di_rwsem);
+
+	hdp = dinfo->di_hdentry + bindex;
+	if (bindex < bend)
+		memmove(hdp, hdp + 1, sizeof(*hdp) * (bend - bindex));
+	dinfo->di_hdentry[0 + bend].hd_dentry = NULL;
+	dinfo->di_bend--;
+
+	p = krealloc(dinfo->di_hdentry, sizeof(*p) * bend, GFP_NOFS);
+	if (p)
+		dinfo->di_hdentry = p;
+}
+
+static void au_br_do_del_hip(struct au_iinfo *iinfo, const aufs_bindex_t bindex,
+			     const aufs_bindex_t bend)
+{
+	struct au_hinode *hip, *p;
+
+	AuRwMustWriteLock(&iinfo->ii_rwsem);
+
+	hip = iinfo->ii_hinode + bindex;
+	if (bindex < bend)
+		memmove(hip, hip + 1, sizeof(*hip) * (bend - bindex));
+	iinfo->ii_hinode[0 + bend].hi_inode = NULL;
+	au_hin_init(iinfo->ii_hinode + bend, NULL);
+	iinfo->ii_bend--;
+
+	p = krealloc(iinfo->ii_hinode, sizeof(*p) * bend, GFP_NOFS);
+	if (p)
+		iinfo->ii_hinode = p;
+}
+
+static void au_br_do_del(struct super_block *sb, aufs_bindex_t bindex,
+			 struct au_branch *br)
+{
+	aufs_bindex_t bend;
+	struct au_sbinfo *sbinfo;
+	struct dentry *root;
+	struct inode *inode;
+
+	SiMustWriteLock(sb);
+
+	root = sb->s_root;
+	inode = root->d_inode;
+	au_plink_block_maintain(sb);
+	sbinfo = au_sbi(sb);
+	bend = sbinfo->si_bend;
+
+	dput(au_h_dptr(root, bindex));
+	au_hiput(au_hi(inode, bindex));
+	au_br_do_free(br);
+
+	au_br_do_del_brp(sbinfo, bindex, bend);
+	au_br_do_del_hdp(au_di(root), bindex, bend);
+	au_br_do_del_hip(au_ii(inode), bindex, bend);
+}
+
+int au_br_del(struct super_block *sb, struct au_opt_del *del, int remount)
+{
+	int err, rerr, i;
+	unsigned int mnt_flags;
+	aufs_bindex_t bindex, bend, br_id;
+	unsigned char do_wh, verbose;
+	struct au_branch *br;
+	struct au_wbr *wbr;
+
+	err = 0;
+	bindex = au_find_dbindex(sb->s_root, del->h_path.dentry);
+	if (bindex < 0) {
+		if (remount)
+			goto out; /* success */
+		err = -ENOENT;
+		AuErr("%s no such branch\n", del->pathname);
+		goto out;
+	}
+	AuDbg("bindex b%d\n", bindex);
+
+	err = -EBUSY;
+	mnt_flags = au_mntflags(sb);
+	verbose = !!au_opt_test(mnt_flags, VERBOSE);
+	bend = au_sbend(sb);
+	if (unlikely(!bend)) {
+		AuVerbose(verbose, "no more branches left\n");
+		goto out;
+	}
+	br = au_sbr(sb, bindex);
+	i = atomic_read(&br->br_count);
+	if (unlikely(i)) {
+		AuVerbose(verbose, "%d file(s) opened\n", i);
+		goto out;
+	}
+
+	wbr = br->br_wbr;
+	do_wh = wbr && (wbr->wbr_whbase || wbr->wbr_plink || wbr->wbr_orph);
+	if (do_wh) {
+		/* instead of WbrWhMustWriteLock(wbr) */
+		SiMustWriteLock(sb);
+		for (i = 0; i < AuBrWh_Last; i++) {
+			dput(wbr->wbr_wh[i]);
+			wbr->wbr_wh[i] = NULL;
+		}
+	}
+
+	err = test_children_busy(sb->s_root, bindex);
+	if (unlikely(err)) {
+		if (do_wh)
+			goto out_wh;
+		goto out;
+	}
+
+	err = 0;
+	br_id = br->br_id;
+	if (!remount)
+		au_br_do_del(sb, bindex, br);
+	else {
+		sysaufs_brs_del(sb, bindex);
+		au_br_do_del(sb, bindex, br);
+		sysaufs_brs_add(sb, bindex);
+	}
+
+	if (!bindex)
+		au_cpup_attr_all(sb->s_root->d_inode, /*force*/1);
+	else
+		au_sub_nlink(sb->s_root->d_inode, del->h_path.dentry->d_inode);
+	if (au_opt_test(mnt_flags, PLINK))
+		au_plink_half_refresh(sb, br_id);
+
+	if (sb->s_maxbytes == del->h_path.dentry->d_sb->s_maxbytes) {
+		bend--;
+		sb->s_maxbytes = 0;
+		for (bindex = 0; bindex <= bend; bindex++) {
+			unsigned long long maxb;
+
+			maxb = au_sbr_sb(sb, bindex)->s_maxbytes;
+			if (sb->s_maxbytes < maxb)
+				sb->s_maxbytes = maxb;
+		}
+	}
+
+	if (au_xino_brid(sb) == br->br_id)
+		au_xino_brid_set(sb, -1);
+	goto out; /* success */
+
+ out_wh:
+	/* revert */
+	rerr = au_br_init_wh(sb, br, br->br_perm, del->h_path.dentry);
+	if (rerr)
+		AuWarn("failed re-creating base whiteout, %s. (%d)\n",
+		       del->pathname, rerr);
+ out:
+	return err;
+}
+
+/* ---------------------------------------------------------------------- */
+
+/*
+ * change a branch permission
+ */
+
+static void au_warn_ima(void)
+{
+#ifdef CONFIG_IMA
+	AuWarn("RW -> RO makes IMA to produce wrong message");
+#endif
+}
+
+static int do_need_sigen_inc(int a, int b)
+{
+	return au_br_whable(a) && !au_br_whable(b);
+}
+
+static int need_sigen_inc(int old, int new)
+{
+	return do_need_sigen_inc(old, new)
+		|| do_need_sigen_inc(new, old);
+}
+
+static int au_br_mod_files_ro(struct super_block *sb, aufs_bindex_t bindex)
+{
+	int err;
+	unsigned long n, ul, bytes, files;
+	aufs_bindex_t bstart;
+	struct file *file, *hf, **a;
+	const int step_bytes = 1024, /* memory allocation unit */
+		step_files = step_bytes / sizeof(*a);
+
+	err = -ENOMEM;
+	n = 0;
+	bytes = step_bytes;
+	files = step_files;
+	a = kmalloc(bytes, GFP_NOFS);
+	if (unlikely(!a))
+		goto out;
+
+	/* no need file_list_lock() since sbinfo is locked? defered? */
+	list_for_each_entry(file, &sb->s_files, f_u.fu_list) {
+		if (special_file(file->f_dentry->d_inode->i_mode))
+			continue;
+
+		AuDbg("%.*s\n", AuDLNPair(file->f_dentry));
+		fi_read_lock(file);
+		if (unlikely(au_test_mmapped(file))) {
+			err = -EBUSY;
+			FiMustNoWaiters(file);
+			fi_read_unlock(file);
+			goto out_free;
+		}
+
+		bstart = au_fbstart(file);
+		if (!S_ISREG(file->f_dentry->d_inode->i_mode)
+		    || !(file->f_mode & FMODE_WRITE)
+		    || bstart != bindex) {
+			FiMustNoWaiters(file);
+			fi_read_unlock(file);
+			continue;
+		}
+
+		hf = au_h_fptr(file, bstart);
+		FiMustNoWaiters(file);
+		fi_read_unlock(file);
+
+		if (n < files)
+			a[n++] = hf;
+		else {
+			void *p;
+
+			err = -ENOMEM;
+			bytes += step_bytes;
+			files += step_files;
+			p = krealloc(a, bytes, GFP_NOFS);
+			if (p) {
+				a = p;
+				a[n++] = hf;
+			} else
+				goto out_free;
+		}
+	}
+
+	err = 0;
+	if (n)
+		au_warn_ima();
+	for (ul = 0; ul < n; ul++) {
+		/* todo: already flushed? */
+		/* cf. fs/super.c:mark_files_ro() */
+		hf = a[ul];
+		hf->f_mode &= ~FMODE_WRITE;
+		if (!file_check_writeable(hf)) {
+			file_release_write(hf);
+			mnt_drop_write(hf->f_vfsmnt);
+		}
+	}
+
+ out_free:
+	kfree(a);
+ out:
+	return err;
+}
+
+int au_br_mod(struct super_block *sb, struct au_opt_mod *mod, int remount,
+	      int *do_update)
+{
+	int err, rerr;
+	aufs_bindex_t bindex;
+	struct dentry *root;
+	struct au_branch *br;
+
+	root = sb->s_root;
+	au_plink_block_maintain(sb);
+	bindex = au_find_dbindex(root, mod->h_root);
+	if (bindex < 0) {
+		if (remount)
+			return 0; /* success */
+		err = -ENOENT;
+		AuErr("%s no such branch\n", mod->path);
+		goto out;
+	}
+	AuDbg("bindex b%d\n", bindex);
+
+	err = test_br(mod->h_root->d_inode, mod->perm, mod->path);
+	if (unlikely(err))
+		goto out;
+
+	br = au_sbr(sb, bindex);
+	if (br->br_perm == mod->perm)
+		return 0; /* success */
+
+	if (au_br_writable(br->br_perm)) {
+		/* remove whiteout base */
+		err = au_br_init_wh(sb, br, mod->perm, mod->h_root);
+		if (unlikely(err))
+			goto out;
+
+		if (!au_br_writable(mod->perm)) {
+			/* rw --> ro, file might be mmapped */
+			DiMustNoWaiters(root);
+			IiMustNoWaiters(root->d_inode);
+			di_write_unlock(root);
+			err = au_br_mod_files_ro(sb, bindex);
+			/* aufs_write_lock() calls ..._child() */
+			di_write_lock_child(root);
+
+			if (unlikely(err)) {
+				rerr = -ENOMEM;
+				br->br_wbr = kmalloc(sizeof(*br->br_wbr),
+						     GFP_NOFS);
+				if (br->br_wbr)
+					rerr = au_br_init_wh
+						(sb, br, br->br_perm,
+						 mod->h_root);
+				if (unlikely(rerr)) {
+					AuIOErr("nested error %d (%d)\n",
+						rerr, err);
+					br->br_perm = mod->perm;
+				}
+			}
+		}
+	} else if (au_br_writable(mod->perm)) {
+		/* ro --> rw */
+		err = -ENOMEM;
+		br->br_wbr = kmalloc(sizeof(*br->br_wbr), GFP_NOFS);
+		if (br->br_wbr) {
+			struct path path = {
+				.mnt	= br->br_mnt,
+				.dentry	= mod->h_root
+			};
+
+			err = au_wbr_init(br, sb, mod->perm, &path);
+			if (unlikely(err)) {
+				kfree(br->br_wbr);
+				br->br_wbr = NULL;
+			}
+		}
+	}
+
+	if (!err) {
+		*do_update |= need_sigen_inc(br->br_perm, mod->perm);
+		br->br_perm = mod->perm;
+	}
+
+ out:
+	return err;
+}
--- linux-rt-2.6.31.orig/ubuntu/iscsitarget/iscsi.h
+++ linux-rt-2.6.31/ubuntu/iscsitarget/iscsi.h
@@ -0,0 +1,462 @@
+/*
+ * Copyright (C) 2002-2003 Ardis Technolgies <roman@ardistech.com>
+ *
+ * Released under the terms of the GNU GPL v2.0.
+ */
+
+#ifndef __ISCSI_H__
+#define __ISCSI_H__
+
+#include <linux/pagemap.h>
+#include <linux/seq_file.h>
+#include <linux/mm.h>
+#include <linux/crypto.h>
+#include <linux/scatterlist.h>
+#include <net/sock.h>
+
+#include "iscsi_hdr.h"
+#include "iet_u.h"
+
+struct iscsi_sess_param {
+	int initial_r2t;
+	int immediate_data;
+	int max_connections;
+	int max_recv_data_length;
+	int max_xmit_data_length;
+	int max_burst_length;
+	int first_burst_length;
+	int default_wait_time;
+	int default_retain_time;
+	int max_outstanding_r2t;
+	int data_pdu_inorder;
+	int data_sequence_inorder;
+	int error_recovery_level;
+	int header_digest;
+	int data_digest;
+	int ofmarker;
+	int ifmarker;
+	int ofmarkint;
+	int ifmarkint;
+};
+
+struct iscsi_trgt_param {
+	int wthreads;
+	int target_type;
+	int queued_cmnds;
+};
+
+struct tio {
+	u32 pg_cnt;
+
+	pgoff_t idx;
+	u32 offset;
+	u32 size;
+
+	struct page **pvec;
+
+	atomic_t count;
+};
+
+struct network_thread_info {
+	struct task_struct *task;
+	unsigned long flags;
+	struct list_head active_conns;
+
+	spinlock_t nthread_lock;
+
+	void (*old_state_change)(struct sock *);
+	void (*old_data_ready)(struct sock *, int);
+	void (*old_write_space)(struct sock *);
+};
+
+struct worker_thread_info;
+
+struct worker_thread {
+	struct task_struct *w_task;
+	struct list_head w_list;
+	struct worker_thread_info *w_info;
+};
+
+struct worker_thread_info {
+	spinlock_t wthread_lock;
+
+	u32 nr_running_wthreads;
+
+	struct list_head wthread_list;
+	struct list_head work_queue;
+
+	wait_queue_head_t wthread_sleep;
+};
+
+struct iscsi_cmnd;
+
+struct target_type {
+	int id;
+	int (*execute_cmnd) (struct iscsi_cmnd *);
+};
+
+enum iscsi_device_state {
+	IDEV_RUNNING,
+	IDEV_DEL,
+};
+
+struct iscsi_target {
+	struct list_head t_list;
+	u32 tid;
+
+	char name[ISCSI_NAME_LEN];
+
+	struct iscsi_sess_param sess_param;
+	struct iscsi_trgt_param trgt_param;
+
+	atomic_t nr_volumes;
+	struct list_head volumes;
+	struct list_head session_list;
+
+	struct network_thread_info nthread_info;
+	/* Points either to own list or global pool */
+	struct worker_thread_info * wthread_info;
+
+	struct semaphore target_sem;
+};
+
+struct iscsi_queue {
+	spinlock_t queue_lock;
+	struct iscsi_cmnd *ordered_cmnd;
+	struct list_head wait_list;
+	int active_cnt;
+};
+
+struct iet_volume {
+	u32 lun;
+
+	enum iscsi_device_state l_state;
+	atomic_t l_count;
+
+	struct iscsi_target *target;
+	struct list_head list;
+
+	struct iscsi_queue queue;
+
+	u8 scsi_id[SCSI_ID_LEN];
+	u8 scsi_sn[SCSI_SN_LEN];
+
+	u32 blk_shift;
+	u64 blk_cnt;
+
+	u64 reserve_sid;
+	spinlock_t reserve_lock;
+
+	unsigned long flags;
+
+	struct iotype *iotype;
+	void *private;
+};
+
+enum lu_flags {
+	LU_READONLY,
+	LU_WCACHE,
+	LU_RCACHE,
+};
+
+#define LUReadonly(lu) test_bit(LU_READONLY, &(lu)->flags)
+#define SetLUReadonly(lu) set_bit(LU_READONLY, &(lu)->flags)
+
+#define LUWCache(lu) test_bit(LU_WCACHE, &(lu)->flags)
+#define SetLUWCache(lu) set_bit(LU_WCACHE, &(lu)->flags)
+#define ClearLUWCache(lu) clear_bit(LU_WCACHE, &(lu)->flags)
+
+#define LURCache(lu) test_bit(LU_RCACHE, &(lu)->flags)
+#define SetLURCache(lu) set_bit(LU_RCACHE, &(lu)->flags)
+#define ClearLURCache(lu) clear_bit(LU_RCACHE, &(lu)->flags)
+
+#define IET_HASH_ORDER		8
+#define	cmnd_hashfn(itt)	hash_long((itt), IET_HASH_ORDER)
+
+struct iscsi_session {
+	struct list_head list;
+	struct iscsi_target *target;
+
+	char *initiator;
+	u64 sid;
+
+	u32 exp_cmd_sn;
+	u32 max_cmd_sn;
+
+	struct iscsi_sess_param param;
+	u32 max_queued_cmnds;
+
+	struct list_head conn_list;
+
+	struct list_head pending_list;
+
+	spinlock_t cmnd_hash_lock;
+	struct list_head cmnd_hash[1 << IET_HASH_ORDER];
+
+	u32 next_ttt;
+};
+
+enum connection_state_bit {
+	CONN_ACTIVE,
+	CONN_CLOSING,
+	CONN_WSPACE_WAIT,
+};
+
+#define ISCSI_CONN_IOV_MAX	(((256 << 10) >> PAGE_SHIFT) + 1)
+
+struct iscsi_conn {
+	struct list_head list;			/* list entry in session list */
+	struct iscsi_session *session;		/* owning session */
+
+	u16 cid;
+	unsigned long state;
+
+	u32 stat_sn;
+	u32 exp_stat_sn;
+
+	int hdigest_type;
+	int ddigest_type;
+
+	struct list_head poll_list;
+
+	struct file *file;
+	struct socket *sock;
+	spinlock_t list_lock;
+	atomic_t nr_cmnds;
+	atomic_t nr_busy_cmnds;
+	struct list_head pdu_list;		/* in/outcoming pdus */
+	struct list_head write_list;		/* list of data pdus to be sent */
+
+	struct iscsi_cmnd *read_cmnd;
+	struct msghdr read_msg;
+	struct iovec read_iov[ISCSI_CONN_IOV_MAX];
+	u32 read_size;
+	u32 read_overflow;
+	int read_state;
+
+	struct iscsi_cmnd *write_cmnd;
+	struct iovec write_iov[ISCSI_CONN_IOV_MAX];
+	struct iovec *write_iop;
+	struct tio *write_tcmnd;
+	u32 write_size;
+	u32 write_offset;
+	int write_state;
+
+	struct hash_desc rx_hash;
+	struct hash_desc tx_hash;
+	struct scatterlist hash_sg[ISCSI_CONN_IOV_MAX];
+};
+
+struct iscsi_pdu {
+	struct iscsi_hdr bhs;
+	void *ahs;
+	unsigned int ahssize;
+	unsigned int datasize;
+};
+
+typedef void (iet_show_info_t)(struct seq_file *seq, struct iscsi_target *target);
+
+struct iscsi_cmnd {
+	struct list_head list;
+	struct list_head conn_list;
+	unsigned long flags;
+	struct iscsi_conn *conn;
+	struct iet_volume *lun;
+
+	struct iscsi_pdu pdu;
+	struct list_head pdu_list;
+
+	struct list_head hash_list;
+
+	struct tio *tio;
+
+	u32 r2t_sn;
+	u32 r2t_length;
+	u32 is_unsolicited_data;
+	u32 target_task_tag;
+	u32 outstanding_r2t;
+
+	u32 hdigest;
+	u32 ddigest;
+
+	struct iscsi_cmnd *req;
+};
+
+#define ISCSI_OP_SCSI_REJECT	ISCSI_OP_VENDOR1_CMD
+#define ISCSI_OP_PDU_REJECT	ISCSI_OP_VENDOR2_CMD
+#define ISCSI_OP_DATA_REJECT	ISCSI_OP_VENDOR3_CMD
+#define ISCSI_OP_SCSI_ABORT	ISCSI_OP_VENDOR4_CMD
+
+/* iscsi.c */
+extern unsigned long worker_thread_pool_size;
+extern struct iscsi_cmnd *cmnd_alloc(struct iscsi_conn *, int);
+extern void cmnd_rx_start(struct iscsi_cmnd *);
+extern void cmnd_rx_end(struct iscsi_cmnd *);
+extern void cmnd_tx_start(struct iscsi_cmnd *);
+extern void cmnd_tx_end(struct iscsi_cmnd *);
+extern void cmnd_release(struct iscsi_cmnd *, int);
+extern void send_data_rsp(struct iscsi_cmnd *, int (*)(struct iscsi_cmnd *));
+extern void send_scsi_rsp(struct iscsi_cmnd *, int (*)(struct iscsi_cmnd *));
+
+/* conn.c */
+extern struct iscsi_conn *conn_lookup(struct iscsi_session *, u16);
+extern int conn_add(struct iscsi_session *, struct conn_info *);
+extern int conn_del(struct iscsi_session *, struct conn_info *);
+extern int conn_free(struct iscsi_conn *);
+extern void conn_close(struct iscsi_conn *);
+extern void conn_info_show(struct seq_file *, struct iscsi_session *);
+
+/* nthread.c */
+extern int nthread_init(struct iscsi_target *);
+extern int nthread_start(struct iscsi_target *);
+extern int nthread_stop(struct iscsi_target *);
+extern void __nthread_wakeup(struct network_thread_info *);
+extern void nthread_wakeup(struct iscsi_target *);
+
+/* wthread.c */
+extern int wthread_init(struct worker_thread_info *info);
+extern int wthread_start(struct worker_thread_info *info, int wthreads, u32 tid);
+extern int wthread_stop(struct worker_thread_info *info);
+extern void wthread_queue(struct iscsi_cmnd *);
+extern struct target_type *target_type_array[];
+extern int wthread_module_init(void);
+extern void wthread_module_exit(void);
+extern struct worker_thread_info *worker_thread_pool;
+
+/* target.c */
+extern int target_lock(struct iscsi_target *, int);
+extern void target_unlock(struct iscsi_target *);
+struct iscsi_target *target_lookup_by_id(u32);
+extern int target_add(struct target_info *);
+extern int target_del(u32 id);
+extern struct seq_operations iet_seq_op;
+
+/* config.c */
+extern int iet_procfs_init(void);
+extern void iet_procfs_exit(void);
+extern int iet_info_show(struct seq_file *, iet_show_info_t *);
+
+/* session.c */
+extern struct file_operations session_seq_fops;
+extern struct iscsi_session *session_lookup(struct iscsi_target *, u64);
+extern int session_add(struct iscsi_target *, struct session_info *);
+extern int session_del(struct iscsi_target *, u64);
+
+/* volume.c */
+extern struct file_operations volume_seq_fops;
+extern int volume_add(struct iscsi_target *, struct volume_info *);
+extern int iscsi_volume_del(struct iscsi_target *, struct volume_info *);
+extern void iscsi_volume_destroy(struct iet_volume *);
+extern struct iet_volume *volume_lookup(struct iscsi_target *, u32);
+extern struct iet_volume *volume_get(struct iscsi_target *, u32);
+extern void volume_put(struct iet_volume *);
+extern int volume_reserve(struct iet_volume *volume, u64 sid);
+extern int volume_release(struct iet_volume *volume, u64 sid, int force);
+extern int is_volume_reserved(struct iet_volume *volume, u64 sid);
+
+/* tio.c */
+extern int tio_init(void);
+extern void tio_exit(void);
+extern struct tio *tio_alloc(int);
+extern void tio_get(struct tio *);
+extern void tio_put(struct tio *);
+extern void tio_set(struct tio *, u32, loff_t);
+extern int tio_read(struct iet_volume *, struct tio *);
+extern int tio_write(struct iet_volume *, struct tio *);
+extern int tio_sync(struct iet_volume *, struct tio *);
+
+/* iotype.c */
+extern struct iotype *get_iotype(const char *name);
+extern void put_iotype(struct iotype *iot);
+
+/* params.c */
+extern int iscsi_param_set(struct iscsi_target *, struct iscsi_param_info *, int);
+
+/* target_disk.c */
+extern struct target_type disk_ops;
+
+/* event.c */
+extern int event_send(u32, u64, u32, u32, int);
+extern int event_init(void);
+extern void event_exit(void);
+
+#define get_pgcnt(size, offset)	((((size) + ((offset) & ~PAGE_CACHE_MASK)) + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT)
+
+static inline void iscsi_cmnd_get_length(struct iscsi_pdu *pdu)
+{
+#if defined(__BIG_ENDIAN)
+	pdu->ahssize = pdu->bhs.length.ahslength * 4;
+	pdu->datasize = pdu->bhs.length.datalength;
+#elif defined(__LITTLE_ENDIAN)
+	pdu->ahssize = (pdu->bhs.length & 0xff) * 4;
+	pdu->datasize = be32_to_cpu(pdu->bhs.length & ~0xff);
+#else
+#error
+#endif
+}
+
+static inline void iscsi_cmnd_set_length(struct iscsi_pdu *pdu)
+{
+#if defined(__BIG_ENDIAN)
+	pdu->bhs.length.ahslength = pdu->ahssize / 4;
+	pdu->bhs.length.datalength = pdu->datasize;
+#elif defined(__LITTLE_ENDIAN)
+	pdu->bhs.length = cpu_to_be32(pdu->datasize) | (pdu->ahssize / 4);
+#else
+#error
+#endif
+}
+
+#define cmnd_hdr(cmnd) ((struct iscsi_scsi_cmd_hdr *) (&((cmnd)->pdu.bhs)))
+#define cmnd_ttt(cmnd) cpu_to_be32((cmnd)->pdu.bhs.ttt)
+#define cmnd_itt(cmnd) cpu_to_be32((cmnd)->pdu.bhs.itt)
+#define cmnd_opcode(cmnd) ((cmnd)->pdu.bhs.opcode & ISCSI_OPCODE_MASK)
+#define cmnd_scsicode(cmnd) cmnd_hdr(cmnd)->scb[0]
+
+#define	SECTOR_SIZE_BITS	9
+
+enum cmnd_flags {
+	CMND_hashed,
+	CMND_queued,
+	CMND_final,
+	CMND_waitio,
+	CMND_close,
+	CMND_lunit,
+	CMND_pending,
+	CMND_tmfabort,
+	CMND_rxstart,
+};
+
+#define set_cmnd_hashed(cmnd)	set_bit(CMND_hashed, &(cmnd)->flags)
+#define cmnd_hashed(cmnd)	test_bit(CMND_hashed, &(cmnd)->flags)
+
+#define set_cmnd_queued(cmnd)	set_bit(CMND_queued, &(cmnd)->flags)
+#define cmnd_queued(cmnd)	test_bit(CMND_queued, &(cmnd)->flags)
+
+#define set_cmnd_final(cmnd)	set_bit(CMND_final, &(cmnd)->flags)
+#define cmnd_final(cmnd)	test_bit(CMND_final, &(cmnd)->flags)
+
+#define set_cmnd_waitio(cmnd)	set_bit(CMND_waitio, &(cmnd)->flags)
+#define cmnd_waitio(cmnd)	test_bit(CMND_waitio, &(cmnd)->flags)
+
+#define set_cmnd_close(cmnd)	set_bit(CMND_close, &(cmnd)->flags)
+#define cmnd_close(cmnd)	test_bit(CMND_close, &(cmnd)->flags)
+
+#define set_cmnd_lunit(cmnd)	set_bit(CMND_lunit, &(cmnd)->flags)
+#define cmnd_lunit(cmnd)	test_bit(CMND_lunit, &(cmnd)->flags)
+
+#define set_cmnd_pending(cmnd)	set_bit(CMND_pending, &(cmnd)->flags)
+#define clear_cmnd_pending(cmnd)	clear_bit(CMND_pending, &(cmnd)->flags)
+#define cmnd_pending(cmnd)	test_bit(CMND_pending, &(cmnd)->flags)
+
+#define set_cmnd_tmfabort(cmnd)	set_bit(CMND_tmfabort, &(cmnd)->flags)
+#define cmnd_tmfabort(cmnd)	test_bit(CMND_tmfabort, &(cmnd)->flags)
+
+#define set_cmnd_rxstart(cmnd)	set_bit(CMND_rxstart, &(cmnd)->flags)
+#define cmnd_rxstart(cmnd)	test_bit(CMND_rxstart, &(cmnd)->flags)
+
+#define VENDOR_ID	"IET"
+#define PRODUCT_ID	"VIRTUAL-DISK"
+#define PRODUCT_REV	"0"
+
+#endif	/* __ISCSI_H__ */
--- linux-rt-2.6.31.orig/ubuntu/iscsitarget/event.c
+++ linux-rt-2.6.31/ubuntu/iscsitarget/event.c
@@ -0,0 +1,96 @@
+/*
+ * Event notification code.
+ * (C) 2005 FUJITA Tomonori <tomof@acm.org>
+ * This code is licenced under the GPL.
+ *
+ * Some functions are based on audit code.
+ */
+
+#include <net/tcp.h>
+#include "iet_u.h"
+#include "iscsi_dbg.h"
+
+static struct sock *nl;
+static u32 ietd_pid;
+
+static int event_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
+{
+	u32 uid, pid, seq;
+	char *data;
+
+	pid  = NETLINK_CREDS(skb)->pid;
+	uid  = NETLINK_CREDS(skb)->uid;
+	seq  = nlh->nlmsg_seq;
+	data = NLMSG_DATA(nlh);
+
+	ietd_pid = pid;
+
+	return 0;
+}
+
+static void event_recv_skb(struct sk_buff *skb)
+{
+	int err;
+	struct nlmsghdr	*nlh;
+	u32 rlen;
+
+	while (skb->len >= NLMSG_SPACE(0)) {
+		nlh = (struct nlmsghdr *)skb->data;
+		if (nlh->nlmsg_len < sizeof(*nlh) || skb->len < nlh->nlmsg_len)
+			break;
+		rlen = NLMSG_ALIGN(nlh->nlmsg_len);
+		if (rlen > skb->len)
+			rlen = skb->len;
+		if ((err = event_recv_msg(skb, nlh))) {
+			netlink_ack(skb, nlh, -err);
+		} else if (nlh->nlmsg_flags & NLM_F_ACK)
+			netlink_ack(skb, nlh, 0);
+		skb_pull(skb, rlen);
+	}
+}
+
+static int notify(void *data, int len, int gfp_mask)
+{
+	struct sk_buff *skb;
+	struct nlmsghdr *nlh;
+	static u32 seq = 0;
+
+	if (!(skb = alloc_skb(NLMSG_SPACE(len), gfp_mask)))
+		return -ENOMEM;
+
+	nlh = __nlmsg_put(skb, ietd_pid, seq++, NLMSG_DONE, len - sizeof(*nlh), 0);
+
+	memcpy(NLMSG_DATA(nlh), data, len);
+
+	return netlink_unicast(nl, skb, ietd_pid, 0);
+}
+
+int event_send(u32 tid, u64 sid, u32 cid, u32 state, int atomic)
+{
+	int err;
+	struct iet_event event;
+
+	event.tid = tid;
+	event.sid = sid;
+	event.cid = cid;
+	event.state = state;
+
+	err = notify(&event, NLMSG_SPACE(sizeof(struct iet_event)), 0);
+
+	return err;
+}
+
+int event_init(void)
+{
+	nl = netlink_kernel_create(&init_net, NETLINK_IET, 1, event_recv_skb,
+				   NULL, THIS_MODULE);
+	if (!nl)
+		return -ENOMEM;
+	else
+		return 0;
+}
+
+void event_exit(void)
+{
+	netlink_kernel_release(nl);
+}
--- linux-rt-2.6.31.orig/ubuntu/iscsitarget/iotype.c
+++ linux-rt-2.6.31/ubuntu/iscsitarget/iotype.c
@@ -0,0 +1,110 @@
+/*
+ * Manager for various I/O types.
+ * (C) 2004 - 2005 FUJITA Tomonori <tomof@acm.org>
+ * This code is licenced under the GPL.
+ */
+
+#include "iscsi.h"
+#include "iotype.h"
+#include "iscsi_dbg.h"
+
+static LIST_HEAD(iotypes);
+static rwlock_t iotypes_lock = RW_LOCK_UNLOCKED;
+
+static struct iotype *find_iotype(const char *name)
+{
+	struct iotype *iot = NULL;
+
+	list_for_each_entry(iot, &iotypes, iot_list) {
+		if (strcmp(iot->name, name) == 0)
+			return iot;
+	}
+	return NULL;
+}
+
+struct iotype *get_iotype(const char *name)
+{
+	struct iotype *iot;
+
+	read_lock(&iotypes_lock);
+	iot = find_iotype(name);
+	read_unlock(&iotypes_lock);
+
+	return iot;
+}
+
+void put_iotype(struct iotype *iot)
+{
+	if (!iot)
+		return;
+	return;
+}
+
+static int register_iotype(struct iotype *iot)
+{
+	int err = 0;
+	struct iotype *p;
+
+	write_lock(&iotypes_lock);
+
+	p = find_iotype(iot->name);
+	if (p)
+		err = -EBUSY;
+	else
+		list_add_tail(&iot->iot_list, &iotypes);
+
+	write_unlock(&iotypes_lock);
+
+	return err;
+}
+
+static int unregister_iotype(struct iotype *iot)
+{
+	int err = 0;
+	struct iotype *p;
+
+	write_lock(&iotypes_lock);
+
+	p = find_iotype(iot->name);
+	if (p && p == iot)
+		list_del_init(&iot->iot_list);
+	else
+		err = -EINVAL;
+
+	write_unlock(&iotypes_lock);
+
+
+	return err;
+}
+
+struct iotype *iotype_array[] = {
+	&fileio,
+	&blockio,
+	&nullio,
+};
+
+int iotype_init(void)
+{
+	int i, err;
+
+	for (i = 0; i < ARRAY_SIZE(iotype_array); i++) {
+		if (!(err = register_iotype(iotype_array[i])))
+			iprintk("Registered io type %s\n",
+						iotype_array[i]->name);
+		else {
+			eprintk("Failed to register io type %s\n",
+						iotype_array[i]->name);
+			break;
+		}
+	}
+
+	return err;
+}
+
+void iotype_exit(void)
+{
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(iotype_array); i++)
+		unregister_iotype(iotype_array[i]);
+}
--- linux-rt-2.6.31.orig/ubuntu/iscsitarget/config.c
+++ linux-rt-2.6.31/ubuntu/iscsitarget/config.c
@@ -0,0 +1,314 @@
+/*
+ * (C) 2004 - 2005 FUJITA Tomonori <tomof@acm.org>
+ *
+ * This code is licenced under the GPL.
+ */
+
+#include <linux/proc_fs.h>
+
+#include "iscsi.h"
+#include "iscsi_dbg.h"
+
+struct proc_entries {
+	const char *name;
+	struct file_operations *fops;
+};
+
+static struct proc_entries iet_proc_entries[] =
+{
+	{"volume", &volume_seq_fops},
+	{"session", &session_seq_fops},
+};
+
+static struct proc_dir_entry *proc_iet_dir;
+
+void iet_procfs_exit(void)
+{
+	int i;
+
+	if (!proc_iet_dir)
+		return;
+
+	for (i = 0; i < ARRAY_SIZE(iet_proc_entries); i++)
+		remove_proc_entry(iet_proc_entries[i].name, proc_iet_dir);
+
+	remove_proc_entry(proc_iet_dir->name, proc_iet_dir->parent);
+}
+
+int iet_procfs_init(void)
+{
+	int i;
+	struct proc_dir_entry *ent;
+
+	if (!(proc_iet_dir = proc_mkdir("iet", init_net.proc_net)))
+		goto err;
+
+	for (i = 0; i < ARRAY_SIZE(iet_proc_entries); i++) {
+		ent = create_proc_entry(iet_proc_entries[i].name, 0, proc_iet_dir);
+		if (ent)
+			ent->proc_fops = iet_proc_entries[i].fops;
+		else
+			goto err;
+	}
+
+	return 0;
+
+err:
+	if (proc_iet_dir)
+		iet_procfs_exit();
+
+	return -ENOMEM;
+}
+
+static int get_conn_info(struct iscsi_target *target, unsigned long ptr)
+{
+	int err;
+	struct iscsi_session *session;
+	struct conn_info info;
+	struct iscsi_conn *conn;
+
+	if ((err = copy_from_user(&info, (void *) ptr, sizeof(info))) < 0)
+		return err;
+
+	session = session_lookup(target, info.sid);
+	if (!session)
+		return -ENOENT;
+	conn = conn_lookup(session, info.cid);
+
+	info.cid = conn->cid;
+	info.stat_sn = conn->stat_sn;
+	info.exp_stat_sn = conn->exp_stat_sn;
+
+	if (copy_to_user((void *) ptr, &info, sizeof(info)))
+		return -EFAULT;
+
+	return 0;
+}
+
+static int add_conn(struct iscsi_target *target, unsigned long ptr)
+{
+	int err;
+	struct iscsi_session *session;
+	struct conn_info info;
+
+	if ((err = copy_from_user(&info, (void *) ptr, sizeof(info))) < 0)
+		return err;
+
+	if (!(session = session_lookup(target, info.sid)))
+		return -ENOENT;
+
+	return conn_add(session, &info);
+}
+
+static int del_conn(struct iscsi_target *target, unsigned long ptr)
+{
+	int err;
+	struct iscsi_session *session;
+	struct conn_info info;
+
+	if ((err = copy_from_user(&info, (void *) ptr, sizeof(info))) < 0)
+		return err;
+
+	if (!(session = session_lookup(target, info.sid)))
+		return -ENOENT;
+
+	return conn_del(session, &info);
+}
+
+static int get_session_info(struct iscsi_target *target, unsigned long ptr)
+{
+	int err;
+	struct iscsi_session *session;
+	struct session_info info;
+
+	if ((err = copy_from_user(&info, (void *) ptr, sizeof(info))) < 0)
+		return err;
+
+	session = session_lookup(target, info.sid);
+
+	if (!session)
+		return -ENOENT;
+
+	info.exp_cmd_sn = session->exp_cmd_sn;
+	info.max_cmd_sn = session->max_cmd_sn;
+
+	if (copy_to_user((void *) ptr, &info, sizeof(info)))
+		return -EFAULT;
+
+	return 0;
+}
+
+static int add_session(struct iscsi_target *target, unsigned long ptr)
+{
+	int err;
+	struct session_info info;
+
+	if ((err = copy_from_user(&info, (void *) ptr, sizeof(info))) < 0)
+		return err;
+
+	return session_add(target, &info);
+}
+
+static int del_session(struct iscsi_target *target, unsigned long ptr)
+{
+	int err;
+	struct session_info info;
+
+	if ((err = copy_from_user(&info, (void *) ptr, sizeof(info))) < 0)
+		return err;
+
+	return session_del(target, info.sid);
+}
+
+static int add_volume(struct iscsi_target *target, unsigned long ptr)
+{
+	int err;
+	struct volume_info info;
+
+	if ((err = copy_from_user(&info, (void *) ptr, sizeof(info))) < 0)
+		return err;
+
+	return volume_add(target, &info);
+}
+
+static int del_volume(struct iscsi_target *target, unsigned long ptr)
+{
+	int err;
+	struct volume_info info;
+
+	if ((err = copy_from_user(&info, (void *) ptr, sizeof(info))) < 0)
+		return err;
+
+	return iscsi_volume_del(target, &info);
+}
+
+static int iscsi_param_config(struct iscsi_target *target, unsigned long ptr, int set)
+{
+	int err;
+	struct iscsi_param_info info;
+
+	if ((err = copy_from_user(&info, (void *) ptr, sizeof(info))) < 0)
+		goto out;
+
+	if ((err = iscsi_param_set(target, &info, set)) < 0)
+		goto out;
+
+	if (!set)
+		err = copy_to_user((void *) ptr, &info, sizeof(info));
+
+out:
+	return err;
+}
+
+static int add_target(unsigned long ptr)
+{
+	int err;
+	struct target_info info;
+
+	if ((err = copy_from_user(&info, (void *) ptr, sizeof(info))) < 0)
+		return err;
+
+	if (!(err = target_add(&info)))
+		err = copy_to_user((void *) ptr, &info, sizeof(info));
+
+	return err;
+}
+
+static long ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+{
+	struct iscsi_target *target = NULL;
+	long err;
+	u32 id;
+
+	if ((err = get_user(id, (u32 *) arg)) != 0)
+		goto done;
+
+	if (cmd == DEL_TARGET) {
+		err = target_del(id);
+		goto done;
+	}
+
+	target = target_lookup_by_id(id);
+
+	if (cmd == ADD_TARGET)
+		if (target) {
+			err = -EEXIST;
+			eprintk("Target %u already exist!\n", id);
+			goto done;
+		}
+
+	switch (cmd) {
+	case ADD_TARGET:
+		assert(!target);
+		err = add_target(arg);
+		goto done;
+	}
+
+	if (!target) {
+		eprintk("can't find the target %u\n", id);
+		err = -EINVAL;
+		goto done;
+	}
+
+	if ((err = target_lock(target, 1)) < 0) {
+		eprintk("interrupted %ld %d\n", err, cmd);
+		goto done;
+	}
+
+	switch (cmd) {
+	case ADD_VOLUME:
+		err = add_volume(target, arg);
+		break;
+
+	case DEL_VOLUME:
+		err = del_volume(target, arg);
+		break;
+
+	case ADD_SESSION:
+		err = add_session(target, arg);
+		break;
+
+	case DEL_SESSION:
+		err = del_session(target, arg);
+		break;
+
+	case GET_SESSION_INFO:
+		err = get_session_info(target, arg);
+		break;
+
+	case ISCSI_PARAM_SET:
+		err = iscsi_param_config(target, arg, 1);
+		break;
+
+	case ISCSI_PARAM_GET:
+		err = iscsi_param_config(target, arg, 0);
+		break;
+
+	case ADD_CONN:
+		err = add_conn(target, arg);
+		break;
+
+	case DEL_CONN:
+		err = del_conn(target, arg);
+		break;
+
+	case GET_CONN_INFO:
+		err = get_conn_info(target, arg);
+		break;
+	default:
+		eprintk("invalid ioctl cmd %x\n", cmd);
+		err = -EINVAL;
+	}
+
+	if (target)
+		target_unlock(target);
+
+done:
+	return err;
+}
+
+struct file_operations ctr_fops = {
+	.owner		= THIS_MODULE,
+	.unlocked_ioctl	= ioctl,
+	.compat_ioctl	= ioctl,
+};
--- linux-rt-2.6.31.orig/ubuntu/iscsitarget/digest.h
+++ linux-rt-2.6.31/ubuntu/iscsitarget/digest.h
@@ -0,0 +1,20 @@
+/*
+ * iSCSI digest handling.
+ * (C) 2004 Xiranet Communications GmbH <arne.redlich@xiranet.com>
+ * This code is licensed under the GPL.
+ */
+
+#ifndef __IET_DIGEST_H__
+#define __IET_DIGEST_H__
+
+extern void digest_alg_available(unsigned int *val);
+extern int digest_init(struct iscsi_conn *conn);
+extern void digest_cleanup(struct iscsi_conn *conn);
+
+extern int digest_rx_header(struct iscsi_cmnd *cmnd);
+extern int digest_rx_data(struct iscsi_cmnd *cmnd);
+
+extern void digest_tx_header(struct iscsi_cmnd *cmnd);
+extern void digest_tx_data(struct iscsi_cmnd *cmnd);
+
+#endif /* __IET_DIGEST_H__ */
--- linux-rt-2.6.31.orig/ubuntu/iscsitarget/param.c
+++ linux-rt-2.6.31/ubuntu/iscsitarget/param.c
@@ -0,0 +1,196 @@
+/*
+ * (C) 2005 FUJITA Tomonori <tomof@acm.org>
+ *
+ * This code is licenced under the GPL.
+ */
+
+#include "iscsi.h"
+#include "iscsi_dbg.h"
+#include "digest.h"
+
+struct target_type *target_type_array[] = {
+	&disk_ops,
+};
+
+#define	CHECK_PARAM(info, iparam, word, min, max)			\
+do {									\
+	if (!info->partial || (info->partial & 1 << key_##word))	\
+		if (iparam[key_##word] < min ||				\
+			iparam[key_##word] > max) {			\
+			eprintk("%s: %u is out of range (%u %u)\n",	\
+				#word, iparam[key_##word], min, max);	\
+			iparam[key_##word] = min;			\
+		}							\
+} while (0)
+
+#define	SET_PARAM(param, info, iparam, word)				\
+({									\
+	int changed = 0;						\
+	if (!info->partial || (info->partial & 1 << key_##word)) {	\
+		if (param->word != iparam[key_##word])			\
+			changed = 1;					\
+		param->word = iparam[key_##word];			\
+	}								\
+	changed;							\
+})
+
+#define	GET_PARAM(param, info, iparam, word)				\
+do {									\
+	iparam[key_##word] = param->word;				\
+} while (0)
+
+static void sess_param_check(struct iscsi_param_info *info)
+{
+	u32 *iparam = info->session_param;
+
+	CHECK_PARAM(info, iparam, max_connections, 1, 1);
+	CHECK_PARAM(info, iparam, max_recv_data_length, 512,
+		    (u32) ((ISCSI_CONN_IOV_MAX - 1) * PAGE_CACHE_SIZE));
+	CHECK_PARAM(info, iparam, max_xmit_data_length, 512,
+		    (u32) ((ISCSI_CONN_IOV_MAX - 1) * PAGE_CACHE_SIZE));
+	CHECK_PARAM(info, iparam, error_recovery_level, 0, 0);
+	CHECK_PARAM(info, iparam, data_pdu_inorder, 1, 1);
+	CHECK_PARAM(info, iparam, data_sequence_inorder, 1, 1);
+
+	digest_alg_available(&iparam[key_header_digest]);
+	digest_alg_available(&iparam[key_data_digest]);
+
+	CHECK_PARAM(info, iparam, ofmarker, 0, 0);
+	CHECK_PARAM(info, iparam, ifmarker, 0, 0);
+}
+
+static void sess_param_set(struct iscsi_sess_param *param, struct iscsi_param_info *info)
+{
+	u32 *iparam = info->session_param;
+
+	SET_PARAM(param, info, iparam, initial_r2t);
+	SET_PARAM(param, info, iparam, immediate_data);
+	SET_PARAM(param, info, iparam, max_connections);
+	SET_PARAM(param, info, iparam, max_recv_data_length);
+	SET_PARAM(param, info, iparam, max_xmit_data_length);
+	SET_PARAM(param, info, iparam, max_burst_length);
+	SET_PARAM(param, info, iparam, first_burst_length);
+	SET_PARAM(param, info, iparam, default_wait_time);
+	SET_PARAM(param, info, iparam, default_retain_time);
+	SET_PARAM(param, info, iparam, max_outstanding_r2t);
+	SET_PARAM(param, info, iparam, data_pdu_inorder);
+	SET_PARAM(param, info, iparam, data_sequence_inorder);
+	SET_PARAM(param, info, iparam, error_recovery_level);
+	SET_PARAM(param, info, iparam, header_digest);
+	SET_PARAM(param, info, iparam, data_digest);
+	SET_PARAM(param, info, iparam, ofmarker);
+	SET_PARAM(param, info, iparam, ifmarker);
+	SET_PARAM(param, info, iparam, ofmarkint);
+	SET_PARAM(param, info, iparam, ifmarkint);
+}
+
+static void sess_param_get(struct iscsi_sess_param *param, struct iscsi_param_info *info)
+{
+	u32 *iparam = info->session_param;
+
+	GET_PARAM(param, info, iparam, initial_r2t);
+	GET_PARAM(param, info, iparam, immediate_data);
+	GET_PARAM(param, info, iparam, max_connections);
+	GET_PARAM(param, info, iparam, max_recv_data_length);
+	GET_PARAM(param, info, iparam, max_xmit_data_length);
+	GET_PARAM(param, info, iparam, max_burst_length);
+	GET_PARAM(param, info, iparam, first_burst_length);
+	GET_PARAM(param, info, iparam, default_wait_time);
+	GET_PARAM(param, info, iparam, default_retain_time);
+	GET_PARAM(param, info, iparam, max_outstanding_r2t);
+	GET_PARAM(param, info, iparam, data_pdu_inorder);
+	GET_PARAM(param, info, iparam, data_sequence_inorder);
+	GET_PARAM(param, info, iparam, error_recovery_level);
+	GET_PARAM(param, info, iparam, header_digest);
+	GET_PARAM(param, info, iparam, data_digest);
+	GET_PARAM(param, info, iparam, ofmarker);
+	GET_PARAM(param, info, iparam, ifmarker);
+	GET_PARAM(param, info, iparam, ofmarkint);
+	GET_PARAM(param, info, iparam, ifmarkint);
+}
+
+static void trgt_param_check(struct iscsi_param_info *info)
+{
+	u32 *iparam = info->target_param;
+
+	CHECK_PARAM(info, iparam, wthreads, MIN_NR_WTHREADS, MAX_NR_WTHREADS);
+	CHECK_PARAM(info, iparam, target_type, 0,
+		    (unsigned int) ARRAY_SIZE(target_type_array) - 1);
+	CHECK_PARAM(info, iparam, queued_cmnds, MIN_NR_QUEUED_CMNDS, MAX_NR_QUEUED_CMNDS);
+}
+
+static void trgt_param_set(struct iscsi_target *target, struct iscsi_param_info *info)
+{
+	struct iscsi_trgt_param *param = &target->trgt_param;
+	u32 *iparam = info->target_param;
+
+	if (!worker_thread_pool &&
+	    SET_PARAM(param, info, iparam, wthreads))
+		wthread_start(target->wthread_info,
+			      target->trgt_param.wthreads, target->tid);
+	SET_PARAM(param, info, iparam, target_type);
+	SET_PARAM(param, info, iparam, queued_cmnds);
+}
+
+static void trgt_param_get(struct iscsi_trgt_param *param, struct iscsi_param_info *info)
+{
+	u32 *iparam = info->target_param;
+
+	GET_PARAM(param, info, iparam, wthreads);
+	GET_PARAM(param, info, iparam, target_type);
+	GET_PARAM(param, info, iparam, queued_cmnds);
+}
+
+static int trgt_param(struct iscsi_target *target, struct iscsi_param_info *info, int set)
+{
+
+	if (set) {
+		trgt_param_check(info);
+		trgt_param_set(target, info);
+	} else
+		trgt_param_get(&target->trgt_param, info);
+
+	return 0;
+}
+
+static int sess_param(struct iscsi_target *target, struct iscsi_param_info *info, int set)
+{
+	struct iscsi_session *session = NULL;
+	struct iscsi_sess_param *param;
+	int err = -ENOENT;
+
+	if (set)
+		sess_param_check(info);
+
+	if (info->sid) {
+		if (!(session = session_lookup(target, info->sid)))
+			goto out;
+		param = &session->param;
+	} else {
+		param = &target->sess_param;
+	}
+
+	if (set) {
+		sess_param_set(param, info);
+		show_param(param);
+	} else
+		sess_param_get(param, info);
+
+	err = 0;
+out:
+	return err;
+}
+
+int iscsi_param_set(struct iscsi_target *target, struct iscsi_param_info *info, int set)
+{
+	int err;
+
+	if (info->param_type == key_session)
+		err = sess_param(target, info, set);
+	else if (info->param_type == key_target)
+		err = trgt_param(target, info, set);
+	else
+		err = -EINVAL;
+
+	return err;
+}
--- linux-rt-2.6.31.orig/ubuntu/iscsitarget/iscsi.c
+++ linux-rt-2.6.31/ubuntu/iscsitarget/iscsi.c
@@ -0,0 +1,1800 @@
+/*
+ * Copyright (C) 2002-2003 Ardis Technolgies <roman@ardistech.com>
+ *
+ * Released under the terms of the GNU GPL v2.0.
+ */
+
+#include <linux/module.h>
+#include <linux/hash.h>
+#include <net/tcp.h>
+#include <scsi/scsi.h>
+
+#include "iscsi.h"
+#include "iscsi_dbg.h"
+#include "iotype.h"
+
+unsigned long debug_enable_flags;
+unsigned long worker_thread_pool_size;
+
+static struct kmem_cache *iscsi_cmnd_cache;
+static u8 dummy_data[PAGE_SIZE];
+
+static int ctr_major;
+static char ctr_name[] = "ietctl";
+extern struct file_operations ctr_fops;
+
+static u32 cmnd_write_size(struct iscsi_cmnd *cmnd)
+{
+	struct iscsi_scsi_cmd_hdr *hdr = cmnd_hdr(cmnd);
+
+	if (hdr->flags & ISCSI_CMD_WRITE)
+		return be32_to_cpu(hdr->data_length);
+	return 0;
+}
+
+static u32 cmnd_read_size(struct iscsi_cmnd *cmnd)
+{
+	struct iscsi_scsi_cmd_hdr *hdr = cmnd_hdr(cmnd);
+
+	if (hdr->flags & ISCSI_CMD_READ) {
+		struct iscsi_rlength_ahdr *ahdr =
+			(struct iscsi_rlength_ahdr *)cmnd->pdu.ahs;
+
+		if (!(hdr->flags & ISCSI_CMD_WRITE))
+			return be32_to_cpu(hdr->data_length);
+		if (ahdr && ahdr->ahstype == ISCSI_AHSTYPE_RLENGTH)
+			return be32_to_cpu(ahdr->read_length);
+	}
+	return 0;
+}
+
+static void iscsi_device_queue_cmnd(struct iscsi_cmnd *cmnd)
+{
+	set_cmnd_waitio(cmnd);
+	wthread_queue(cmnd);
+}
+
+static void iscsi_scsi_queuecmnd(struct iscsi_cmnd *cmnd)
+{
+	struct iscsi_queue *queue = &cmnd->lun->queue;
+
+	dprintk(D_GENERIC, "%p\n", cmnd);
+
+	if ((cmnd->pdu.bhs.flags & ISCSI_CMD_ATTR_MASK) != ISCSI_CMD_UNTAGGED &&
+	    (cmnd->pdu.bhs.flags & ISCSI_CMD_ATTR_MASK) != ISCSI_CMD_SIMPLE) {
+		cmnd->pdu.bhs.flags &= ~ISCSI_CMD_ATTR_MASK;
+		cmnd->pdu.bhs.flags |= ISCSI_CMD_UNTAGGED;
+	}
+
+	spin_lock(&queue->queue_lock);
+
+	set_cmnd_queued(cmnd);
+
+	switch (cmnd->pdu.bhs.flags & ISCSI_CMD_ATTR_MASK) {
+	case ISCSI_CMD_UNTAGGED:
+	case ISCSI_CMD_SIMPLE:
+		if (!list_empty(&queue->wait_list) || queue->ordered_cmnd)
+			goto pending;
+		queue->active_cnt++;
+		break;
+
+	default:
+		BUG();
+	}
+	spin_unlock(&queue->queue_lock);
+
+	iscsi_device_queue_cmnd(cmnd);
+	return;
+ pending:
+	assert(list_empty(&cmnd->list));
+
+	list_add_tail(&cmnd->list, &queue->wait_list);
+	spin_unlock(&queue->queue_lock);
+	return;
+}
+
+static void iscsi_scsi_dequeuecmnd(struct iscsi_cmnd *cmnd)
+{
+	struct iscsi_queue *queue;
+
+	if (!cmnd->lun)
+		return;
+	queue = &cmnd->lun->queue;
+	spin_lock(&queue->queue_lock);
+	switch (cmnd->pdu.bhs.flags & ISCSI_CMD_ATTR_MASK) {
+	case ISCSI_CMD_UNTAGGED:
+	case ISCSI_CMD_SIMPLE:
+		--queue->active_cnt;
+		break;
+	case ISCSI_CMD_ORDERED:
+	case ISCSI_CMD_HEAD_OF_QUEUE:
+	case ISCSI_CMD_ACA:
+		BUG();
+	default:
+		/* Should the iscsi_scsi_queuecmnd func reject this ? */
+		break;
+	}
+
+	while (!list_empty(&queue->wait_list)) {
+		cmnd = list_entry(queue->wait_list.next, struct iscsi_cmnd, list);
+		switch ((cmnd->pdu.bhs.flags & ISCSI_CMD_ATTR_MASK)) {
+		case ISCSI_CMD_UNTAGGED:
+		case ISCSI_CMD_SIMPLE:
+			list_del_init(&cmnd->list);
+			queue->active_cnt++;
+			iscsi_device_queue_cmnd(cmnd);
+			break;
+		case ISCSI_CMD_ORDERED:
+		case ISCSI_CMD_HEAD_OF_QUEUE:
+		case ISCSI_CMD_ACA:
+			BUG();
+		}
+	}
+
+	spin_unlock(&queue->queue_lock);
+
+	return;
+}
+
+/**
+ * create a new command.
+ *
+ * iscsi_cmnd_create - 
+ * @conn: ptr to connection (for i/o)
+ *
+ * @return    ptr to command or NULL
+ */
+
+struct iscsi_cmnd *cmnd_alloc(struct iscsi_conn *conn, int req)
+{
+	struct iscsi_cmnd *cmnd;
+
+	/* TODO: async interface is necessary ? */
+	cmnd = kmem_cache_alloc(iscsi_cmnd_cache, GFP_KERNEL|__GFP_NOFAIL);
+
+	memset(cmnd, 0, sizeof(*cmnd));
+	INIT_LIST_HEAD(&cmnd->list);
+	INIT_LIST_HEAD(&cmnd->pdu_list);
+	INIT_LIST_HEAD(&cmnd->conn_list);
+	INIT_LIST_HEAD(&cmnd->hash_list);
+	cmnd->conn = conn;
+	spin_lock(&conn->list_lock);
+	atomic_inc(&conn->nr_cmnds);
+	if (req)
+		list_add_tail(&cmnd->conn_list, &conn->pdu_list);
+	spin_unlock(&conn->list_lock);
+	cmnd->tio = NULL;
+
+	dprintk(D_GENERIC, "%p:%p\n", conn, cmnd);
+
+	return cmnd;
+}
+
+/**
+ * create a new command used as response.
+ *
+ * iscsi_cmnd_create_rsp_cmnd - 
+ * @cmnd: ptr to request command
+ *
+ * @return    ptr to response command or NULL
+ */
+
+static struct iscsi_cmnd *iscsi_cmnd_create_rsp_cmnd(struct iscsi_cmnd *cmnd, int final)
+{
+	struct iscsi_cmnd *rsp = cmnd_alloc(cmnd->conn, 0);
+
+	if (final)
+		set_cmnd_final(rsp);
+	list_add_tail(&rsp->pdu_list, &cmnd->pdu_list);
+	rsp->req = cmnd;
+	return rsp;
+}
+
+static struct iscsi_cmnd *get_rsp_cmnd(struct iscsi_cmnd *req)
+{
+	return list_entry(req->pdu_list.prev, struct iscsi_cmnd, pdu_list);
+}
+
+static void iscsi_cmnds_init_write(struct list_head *send)
+{
+	struct iscsi_cmnd *cmnd = list_entry(send->next, struct iscsi_cmnd, list);
+	struct iscsi_conn *conn = cmnd->conn;
+	struct list_head *pos, *next;
+
+	spin_lock(&conn->list_lock);
+
+	list_for_each_safe(pos, next, send) {
+		cmnd = list_entry(pos, struct iscsi_cmnd, list);
+
+		dprintk(D_GENERIC, "%p:%x\n", cmnd, cmnd_opcode(cmnd));
+
+		list_del_init(&cmnd->list);
+		assert(conn == cmnd->conn);
+		list_add_tail(&cmnd->list, &conn->write_list);
+	}
+
+	spin_unlock(&conn->list_lock);
+
+	nthread_wakeup(conn->session->target);
+}
+
+static void iscsi_cmnd_init_write(struct iscsi_cmnd *cmnd)
+{
+	LIST_HEAD(head);
+
+	if (!list_empty(&cmnd->list)) {
+		eprintk("%x %x %x %x %lx %u %u %u %u %u %u %u %d %d\n",
+			cmnd_itt(cmnd), cmnd_ttt(cmnd), cmnd_opcode(cmnd),
+			cmnd_scsicode(cmnd), cmnd->flags, cmnd->r2t_sn,
+			cmnd->r2t_length, cmnd->is_unsolicited_data,
+			cmnd->target_task_tag, cmnd->outstanding_r2t,
+			cmnd->hdigest, cmnd->ddigest,
+			list_empty(&cmnd->pdu_list), list_empty(&cmnd->hash_list));
+
+		assert(list_empty(&cmnd->list));
+	}
+	list_add(&cmnd->list, &head);
+	iscsi_cmnds_init_write(&head);
+}
+
+static void do_send_data_rsp(struct iscsi_cmnd *cmnd)
+{
+	struct iscsi_conn *conn = cmnd->conn;
+	struct iscsi_cmnd *data_cmnd;
+	struct tio *tio = cmnd->tio;
+	struct iscsi_scsi_cmd_hdr *req = cmnd_hdr(cmnd);
+	struct iscsi_data_in_hdr *rsp;
+	u32 pdusize, expsize, scsisize, size, offset, sn;
+	LIST_HEAD(send);
+
+	dprintk(D_GENERIC, "%p\n", cmnd);
+	pdusize = conn->session->param.max_xmit_data_length;
+	expsize = cmnd_read_size(cmnd);
+	size = min(expsize, tio->size);
+	offset = 0;
+	sn = 0;
+
+	while (1) {
+		data_cmnd = iscsi_cmnd_create_rsp_cmnd(cmnd, size <= pdusize);
+		tio_get(tio);
+		data_cmnd->tio = tio;
+		rsp = (struct iscsi_data_in_hdr *)&data_cmnd->pdu.bhs;
+
+		rsp->opcode = ISCSI_OP_SCSI_DATA_IN;
+		rsp->itt = req->itt;
+		rsp->ttt = cpu_to_be32(ISCSI_RESERVED_TAG);
+		rsp->buffer_offset = offset;
+		rsp->data_sn = cpu_to_be32(sn);
+
+		if (size <= pdusize) {
+			data_cmnd->pdu.datasize = size;
+			rsp->flags = ISCSI_FLG_FINAL | ISCSI_FLG_STATUS;
+
+			scsisize = tio->size;
+			if (scsisize < expsize) {
+				rsp->flags |= ISCSI_FLG_RESIDUAL_UNDERFLOW;
+				size = expsize - scsisize;
+			} else if (scsisize > expsize) {
+				rsp->flags |= ISCSI_FLG_RESIDUAL_OVERFLOW;
+				size = scsisize - expsize;
+			} else
+				size = 0;
+			rsp->residual_count = cpu_to_be32(size);
+			list_add_tail(&data_cmnd->list, &send);
+
+			break;
+		}
+
+		data_cmnd->pdu.datasize = pdusize;
+
+		size -= pdusize;
+		offset += pdusize;
+		sn++;
+
+		list_add_tail(&data_cmnd->list, &send);
+	}
+
+	iscsi_cmnds_init_write(&send);
+}
+
+static struct iscsi_cmnd *create_scsi_rsp(struct iscsi_cmnd *req)
+{
+	struct iscsi_cmnd *rsp;
+	struct iscsi_scsi_cmd_hdr *req_hdr = cmnd_hdr(req);
+	struct iscsi_scsi_rsp_hdr *rsp_hdr;
+
+	rsp = iscsi_cmnd_create_rsp_cmnd(req, 1);
+
+	rsp_hdr = (struct iscsi_scsi_rsp_hdr *)&rsp->pdu.bhs;
+	rsp_hdr->opcode = ISCSI_OP_SCSI_RSP;
+	rsp_hdr->flags = ISCSI_FLG_FINAL;
+	rsp_hdr->response = ISCSI_RESPONSE_COMMAND_COMPLETED;
+	rsp_hdr->cmd_status = SAM_STAT_GOOD;
+	rsp_hdr->itt = req_hdr->itt;
+
+	return rsp;
+}
+
+static struct iscsi_cmnd *create_sense_rsp(struct iscsi_cmnd *req,
+					   u8 sense_key, u8 asc, u8 ascq)
+{
+	struct iscsi_cmnd *rsp;
+	struct iscsi_scsi_rsp_hdr *rsp_hdr;
+	struct tio *tio;
+	struct iscsi_sense_data *sense;
+
+	rsp = iscsi_cmnd_create_rsp_cmnd(req, 1);
+
+	rsp_hdr = (struct iscsi_scsi_rsp_hdr *)&rsp->pdu.bhs;
+	rsp_hdr->opcode = ISCSI_OP_SCSI_RSP;
+	rsp_hdr->flags = ISCSI_FLG_FINAL;
+	rsp_hdr->response = ISCSI_RESPONSE_COMMAND_COMPLETED;
+	rsp_hdr->cmd_status = SAM_STAT_CHECK_CONDITION;
+	rsp_hdr->itt = cmnd_hdr(req)->itt;
+
+	tio = rsp->tio = tio_alloc(1);
+	sense = (struct iscsi_sense_data *) page_address(tio->pvec[0]);
+	assert(sense);
+	clear_page(sense);
+	sense->length = cpu_to_be16(14);
+	sense->data[0] = 0xf0;
+	sense->data[2] = sense_key;
+	sense->data[7] = 6;	// Additional sense length
+	sense->data[12] = asc;
+	sense->data[13] = ascq;
+
+	rsp->pdu.datasize = sizeof(struct iscsi_sense_data) + 14;
+	tio->size = (rsp->pdu.datasize + 3) & -4;
+	tio->offset = 0;
+
+	return rsp;
+}
+
+void send_scsi_rsp(struct iscsi_cmnd *req, int (*func)(struct iscsi_cmnd *))
+{
+	struct iscsi_cmnd *rsp;
+	struct iscsi_scsi_rsp_hdr *rsp_hdr;
+	u32 size;
+	int ret = func(req);
+
+	switch (ret) {
+	case 0:
+	case -EBUSY:
+		rsp = create_scsi_rsp(req);
+		rsp_hdr = (struct iscsi_scsi_rsp_hdr *) &rsp->pdu.bhs;
+		if ((size = cmnd_read_size(req)) != 0) {
+			rsp_hdr->flags |= ISCSI_FLG_RESIDUAL_UNDERFLOW;
+			rsp_hdr->residual_count = cpu_to_be32(size);
+		}
+		if (ret == -EBUSY)
+			rsp_hdr->cmd_status = SAM_STAT_RESERVATION_CONFLICT;
+		break;
+	case -EIO:
+		/* Medium Error/Write Fault */
+		rsp = create_sense_rsp(req, MEDIUM_ERROR, 0x03, 0x0);
+		break;
+	default:
+		rsp = create_sense_rsp(req, ILLEGAL_REQUEST, 0x24, 0x0);
+	}
+	iscsi_cmnd_init_write(rsp);
+}
+
+void send_data_rsp(struct iscsi_cmnd *req, int (*func)(struct iscsi_cmnd *))
+{
+	struct iscsi_cmnd *rsp;
+
+	switch (func(req)) {
+	case 0:
+		do_send_data_rsp(req);
+		return;
+	case -EIO:
+		/* Medium Error/Unrecovered Read Error */
+		rsp = create_sense_rsp(req, MEDIUM_ERROR, 0x11, 0x0);
+		break;
+	default:
+		rsp = create_sense_rsp(req, ILLEGAL_REQUEST, 0x24, 0x0);
+	}
+	iscsi_cmnd_init_write(rsp);
+}
+
+/**
+ * Free a command.
+ * Also frees the additional header.
+ *
+ * iscsi_cmnd_remove - 
+ * @cmnd: ptr to command
+ */
+
+static void iscsi_cmnd_remove(struct iscsi_cmnd *cmnd)
+{
+	struct iscsi_conn *conn;
+
+	if (!cmnd)
+		return;
+	dprintk(D_GENERIC, "%p\n", cmnd);
+	conn = cmnd->conn;
+	kfree(cmnd->pdu.ahs);
+
+	if (!list_empty(&cmnd->list)) {
+		struct iscsi_scsi_cmd_hdr *req = cmnd_hdr(cmnd);
+
+		eprintk("cmnd %p still on some list?, %x, %x, %x, %x, %x, %x, %x %lx\n",
+			cmnd, req->opcode, req->scb[0], req->flags, req->itt,
+			be32_to_cpu(req->data_length),
+			req->cmd_sn, be32_to_cpu(cmnd->pdu.datasize),
+			conn->state);
+
+		if (cmnd->req) {
+			struct iscsi_scsi_cmd_hdr *req = cmnd_hdr(cmnd->req);
+			eprintk("%p %x %u\n", req, req->opcode, req->scb[0]);
+		}
+		dump_stack();
+		BUG();
+	}
+	list_del(&cmnd->list);
+	spin_lock(&conn->list_lock);
+	atomic_dec(&conn->nr_cmnds);
+	list_del(&cmnd->conn_list);
+	spin_unlock(&conn->list_lock);
+
+	if (cmnd->tio)
+		tio_put(cmnd->tio);
+
+	kmem_cache_free(iscsi_cmnd_cache, cmnd);
+}
+
+static void cmnd_skip_pdu(struct iscsi_cmnd *cmnd)
+{
+	struct iscsi_conn *conn = cmnd->conn;
+	struct tio *tio = cmnd->tio;
+	char *addr;
+	u32 size;
+	int i;
+
+	eprintk("%x %x %x %u\n", cmnd_itt(cmnd), cmnd_opcode(cmnd),
+		cmnd_hdr(cmnd)->scb[0], cmnd->pdu.datasize);
+
+	if (!(size = cmnd->pdu.datasize))
+		return;
+
+	if (tio)
+		assert(tio->pg_cnt > 0);
+	else
+		tio = cmnd->tio = tio_alloc(1);
+
+	addr = page_address(tio->pvec[0]);
+	assert(addr);
+	size = (size + 3) & -4;
+	conn->read_size = size;
+	for (i = 0; size > PAGE_CACHE_SIZE; i++, size -= PAGE_CACHE_SIZE) {
+		assert(i < ISCSI_CONN_IOV_MAX);
+		conn->read_iov[i].iov_base = addr;
+		conn->read_iov[i].iov_len = PAGE_CACHE_SIZE;
+	}
+	conn->read_iov[i].iov_base = addr;
+	conn->read_iov[i].iov_len = size;
+	conn->read_msg.msg_iov = conn->read_iov;
+	conn->read_msg.msg_iovlen = ++i;
+}
+
+static void iscsi_cmnd_reject(struct iscsi_cmnd *req, int reason)
+{
+	struct iscsi_cmnd *rsp;
+	struct iscsi_reject_hdr *rsp_hdr;
+	struct tio *tio;
+	char *addr;
+
+	rsp = iscsi_cmnd_create_rsp_cmnd(req, 1);
+	rsp_hdr = (struct iscsi_reject_hdr *)&rsp->pdu.bhs;
+
+	rsp_hdr->opcode = ISCSI_OP_REJECT;
+	rsp_hdr->ffffffff = ISCSI_RESERVED_TAG;
+	rsp_hdr->reason = reason;
+
+	rsp->tio = tio = tio_alloc(1);
+	addr = page_address(tio->pvec[0]);
+	clear_page(addr);
+	memcpy(addr, &req->pdu.bhs, sizeof(struct iscsi_hdr));
+	tio->size = rsp->pdu.datasize = sizeof(struct iscsi_hdr);
+	cmnd_skip_pdu(req);
+
+	req->pdu.bhs.opcode = ISCSI_OP_PDU_REJECT;
+}
+
+static void cmnd_set_sn(struct iscsi_cmnd *cmnd, int set_stat_sn)
+{
+	struct iscsi_conn *conn = cmnd->conn;
+	struct iscsi_session *sess = conn->session;
+
+	if (set_stat_sn)
+		cmnd->pdu.bhs.sn = cpu_to_be32(conn->stat_sn++);
+	cmnd->pdu.bhs.exp_sn = cpu_to_be32(sess->exp_cmd_sn);
+	cmnd->pdu.bhs.max_sn = cpu_to_be32(sess->exp_cmd_sn + sess->max_queued_cmnds);
+}
+
+static void update_stat_sn(struct iscsi_cmnd *cmnd)
+{
+	struct iscsi_conn *conn = cmnd->conn;
+	u32 exp_stat_sn;
+
+	cmnd->pdu.bhs.exp_sn = exp_stat_sn = be32_to_cpu(cmnd->pdu.bhs.exp_sn);
+	dprintk(D_GENERIC, "%x,%x\n", cmnd_opcode(cmnd), exp_stat_sn);
+	if ((int)(exp_stat_sn - conn->exp_stat_sn) > 0 &&
+	    (int)(exp_stat_sn - conn->stat_sn) <= 0) {
+		// free pdu resources
+		cmnd->conn->exp_stat_sn = exp_stat_sn;
+	}
+}
+
+static int check_cmd_sn(struct iscsi_cmnd *cmnd)
+{
+	struct iscsi_session *session = cmnd->conn->session;
+	u32 cmd_sn;
+
+	cmnd->pdu.bhs.sn = cmd_sn = be32_to_cpu(cmnd->pdu.bhs.sn);
+	dprintk(D_GENERIC, "%d(%d)\n", cmd_sn, session->exp_cmd_sn);
+	if ((s32)(cmd_sn - session->exp_cmd_sn) >= 0)
+		return 0;
+	eprintk("sequence error (%x,%x)\n", cmd_sn, session->exp_cmd_sn);
+	return -ISCSI_REASON_PROTOCOL_ERROR;
+}
+
+static struct iscsi_cmnd *__cmnd_find_hash(struct iscsi_session *session, u32 itt, u32 ttt)
+{
+	struct list_head *head;
+	struct iscsi_cmnd *cmnd;
+
+	head = &session->cmnd_hash[cmnd_hashfn(itt)];
+
+	list_for_each_entry(cmnd, head, hash_list) {
+		if (cmnd->pdu.bhs.itt == itt) {
+			if ((ttt != ISCSI_RESERVED_TAG) && (ttt != cmnd->target_task_tag))
+				continue;
+			return cmnd;
+		}
+	}
+
+	return NULL;
+}
+
+static struct iscsi_cmnd *cmnd_find_hash(struct iscsi_session *session, u32 itt, u32 ttt)
+{
+	struct iscsi_cmnd *cmnd;
+
+	spin_lock(&session->cmnd_hash_lock);
+
+	cmnd = __cmnd_find_hash(session, itt, ttt);
+
+	spin_unlock(&session->cmnd_hash_lock);
+
+	return cmnd;
+}
+
+static int cmnd_insert_hash(struct iscsi_cmnd *cmnd)
+{
+	struct iscsi_session *session = cmnd->conn->session;
+	struct iscsi_cmnd *tmp;
+	struct list_head *head;
+	int err = 0;
+	u32 itt = cmnd->pdu.bhs.itt;
+
+	dprintk(D_GENERIC, "%p:%x\n", cmnd, itt);
+	if (itt == ISCSI_RESERVED_TAG) {
+		err = -ISCSI_REASON_PROTOCOL_ERROR;
+		goto out;
+	}
+
+	head = &session->cmnd_hash[cmnd_hashfn(cmnd->pdu.bhs.itt)];
+
+	spin_lock(&session->cmnd_hash_lock);
+
+	tmp = __cmnd_find_hash(session, itt, ISCSI_RESERVED_TAG);
+	if (!tmp) {
+		list_add_tail(&cmnd->hash_list, head);
+		set_cmnd_hashed(cmnd);
+	} else
+		err = -ISCSI_REASON_TASK_IN_PROGRESS;
+
+	spin_unlock(&session->cmnd_hash_lock);
+
+	if (!err) {
+		update_stat_sn(cmnd);
+		err = check_cmd_sn(cmnd);
+	}
+
+out:
+	return err;
+}
+
+static void __cmnd_remove_hash(struct iscsi_cmnd *cmnd)
+{
+	list_del(&cmnd->hash_list);
+}
+
+static void cmnd_remove_hash(struct iscsi_cmnd *cmnd)
+{
+	struct iscsi_session *session = cmnd->conn->session;
+	struct iscsi_cmnd *tmp;
+
+	spin_lock(&session->cmnd_hash_lock);
+
+	tmp = __cmnd_find_hash(session, cmnd->pdu.bhs.itt, ISCSI_RESERVED_TAG);
+
+	if (tmp && tmp == cmnd)
+		__cmnd_remove_hash(tmp);
+	else
+		eprintk("%p:%x not found\n", cmnd, cmnd_itt(cmnd));
+
+	spin_unlock(&session->cmnd_hash_lock);
+}
+
+static void cmnd_skip_data(struct iscsi_cmnd *req)
+{
+	struct iscsi_cmnd *rsp;
+	struct iscsi_scsi_rsp_hdr *rsp_hdr;
+	u32 size;
+
+	rsp = get_rsp_cmnd(req);
+	rsp_hdr = (struct iscsi_scsi_rsp_hdr *)&rsp->pdu.bhs;
+	if (cmnd_opcode(rsp) != ISCSI_OP_SCSI_RSP) {
+		eprintk("unexpected response command %u\n", cmnd_opcode(rsp));
+		return;
+	}
+
+	size = cmnd_write_size(req);
+	if (size) {
+		rsp_hdr->flags |= ISCSI_FLG_RESIDUAL_UNDERFLOW;
+		rsp_hdr->residual_count = cpu_to_be32(size);
+	}
+	size = cmnd_read_size(req);
+	if (size) {
+		if (cmnd_hdr(req)->flags & ISCSI_CMD_WRITE) {
+			rsp_hdr->flags |= ISCSI_FLG_BIRESIDUAL_UNDERFLOW;
+			rsp_hdr->bi_residual_count = cpu_to_be32(size);
+		} else {
+			rsp_hdr->flags |= ISCSI_FLG_RESIDUAL_UNDERFLOW;
+			rsp_hdr->residual_count = cpu_to_be32(size);
+		}
+	}
+	req->pdu.bhs.opcode =
+		(req->pdu.bhs.opcode & ~ISCSI_OPCODE_MASK) | ISCSI_OP_SCSI_REJECT;
+
+	cmnd_skip_pdu(req);
+}
+
+static int cmnd_recv_pdu(struct iscsi_conn *conn, struct tio *tio, u32 offset, u32 size)
+{
+	int idx, i;
+	char *addr;
+
+	dprintk(D_GENERIC, "%p %u,%u\n", tio, offset, size);
+	offset += tio->offset;
+
+	if (!(offset < tio->offset + tio->size) ||
+	    !(offset + size <= tio->offset + tio->size)) {
+		eprintk("%u %u %u %u", offset, size, tio->offset, tio->size);
+		return -EIO;
+	}
+	assert(offset < tio->offset + tio->size);
+	assert(offset + size <= tio->offset + tio->size);
+
+	idx = offset >> PAGE_CACHE_SHIFT;
+	offset &= ~PAGE_CACHE_MASK;
+
+	conn->read_msg.msg_iov = conn->read_iov;
+	conn->read_size = size = (size + 3) & -4;
+	conn->read_overflow = 0;
+
+	i = 0;
+	while (1) {
+		assert(tio->pvec[idx]);
+		addr = page_address(tio->pvec[idx]);
+		assert(addr);
+		conn->read_iov[i].iov_base =  addr + offset;
+		if (offset + size <= PAGE_CACHE_SIZE) {
+			conn->read_iov[i].iov_len = size;
+			conn->read_msg.msg_iovlen = ++i;
+			break;
+		}
+		conn->read_iov[i].iov_len = PAGE_CACHE_SIZE - offset;
+		size -= conn->read_iov[i].iov_len;
+		offset = 0;
+		if (++i >= ISCSI_CONN_IOV_MAX) {
+			conn->read_msg.msg_iovlen = i;
+			conn->read_overflow = size;
+			conn->read_size -= size;
+			break;
+		}
+
+		idx++;
+	}
+
+	return 0;
+}
+
+static void set_offset_and_length(struct iet_volume *lu, u8 *cmd, loff_t *off, u32 *len)
+{
+	assert(lu);
+
+	switch (cmd[0]) {
+	case READ_6:
+	case WRITE_6:
+		*off = ((cmd[1] & 0x1f) << 16) + (cmd[2] << 8) + cmd[3];
+		*len = cmd[4];
+		if (!*len)
+			*len = 256;
+		break;
+	case READ_10:
+	case WRITE_10:
+	case WRITE_VERIFY:
+		*off = (u32)cmd[2] << 24 | (u32)cmd[3] << 16 |
+			(u32)cmd[4] << 8 | (u32)cmd[5];
+		*len = (cmd[7] << 8) + cmd[8];
+		break;
+	case READ_16:
+	case WRITE_16:
+		*off = (u64)cmd[2] << 56 | (u64)cmd[3] << 48 |
+			(u64)cmd[4] << 40 | (u64)cmd[5] << 32 |
+			(u64)cmd[6] << 24 | (u64)cmd[7] << 16 |
+			(u64)cmd[8] << 8 | (u64)cmd[9];
+		*len = (u32)cmd[10] << 24 | (u32)cmd[11] << 16 |
+			(u32)cmd[12] << 8 | (u32)cmd[13];
+		break;
+	default:
+		BUG();
+	}
+
+	*off <<= lu->blk_shift;
+	*len <<= lu->blk_shift;
+}
+
+static u32 translate_lun(u16 * data)
+{
+	u8 *p = (u8 *) data;
+	u32 lun = ~0U;
+
+	switch (*p >> 6) {
+	case 0:
+		lun = p[1];
+		break;
+	case 1:
+		lun = (0x3f & p[0]) << 8 | p[1];
+		break;
+	case 2:
+	case 3:
+	default:
+		eprintk("%u %u %u %u\n", data[0], data[1], data[2], data[3]);
+		break;
+	}
+
+	return lun;
+}
+
+static void send_r2t(struct iscsi_cmnd *req)
+{
+	struct iscsi_cmnd *rsp;
+	struct iscsi_r2t_hdr *rsp_hdr;
+	u32 length, offset, burst;
+	LIST_HEAD(send);
+
+	length = req->r2t_length;
+	burst = req->conn->session->param.max_burst_length;
+	offset = be32_to_cpu(cmnd_hdr(req)->data_length) - length;
+
+	do {
+		rsp = iscsi_cmnd_create_rsp_cmnd(req, 0);
+		rsp->pdu.bhs.ttt = req->target_task_tag;
+
+		rsp_hdr = (struct iscsi_r2t_hdr *)&rsp->pdu.bhs;
+		rsp_hdr->opcode = ISCSI_OP_R2T;
+		rsp_hdr->flags = ISCSI_FLG_FINAL;
+		memcpy(rsp_hdr->lun, cmnd_hdr(req)->lun, 8);
+		rsp_hdr->itt = cmnd_hdr(req)->itt;
+		rsp_hdr->r2t_sn = cpu_to_be32(req->r2t_sn++);
+		rsp_hdr->buffer_offset = cpu_to_be32(offset);
+		if (length > burst) {
+			rsp_hdr->data_length = cpu_to_be32(burst);
+			length -= burst;
+			offset += burst;
+		} else {
+			rsp_hdr->data_length = cpu_to_be32(length);
+			length = 0;
+		}
+
+		dprintk(D_WRITE, "%x %u %u %u %u\n", cmnd_itt(req),
+			be32_to_cpu(rsp_hdr->data_length),
+			be32_to_cpu(rsp_hdr->buffer_offset),
+			be32_to_cpu(rsp_hdr->r2t_sn), req->outstanding_r2t);
+
+		list_add_tail(&rsp->list, &send);
+
+		if (++req->outstanding_r2t >= req->conn->session->param.max_outstanding_r2t)
+			break;
+
+	} while (length);
+
+	iscsi_cmnds_init_write(&send);
+}
+
+static void scsi_cmnd_exec(struct iscsi_cmnd *cmnd)
+{
+	if (cmnd->r2t_length) {
+		if (!cmnd->is_unsolicited_data)
+			send_r2t(cmnd);
+	} else {
+		if (cmnd->lun) {
+			iscsi_scsi_queuecmnd(cmnd);
+		} else {
+			iscsi_device_queue_cmnd(cmnd);
+		}
+	}
+}
+
+static int noop_out_start(struct iscsi_conn *conn, struct iscsi_cmnd *cmnd)
+{
+	u32 size, tmp;
+	int i, err = 0;
+
+	if (cmnd_ttt(cmnd) != cpu_to_be32(ISCSI_RESERVED_TAG)) {
+		/*
+		 * We don't request a NOP-Out by sending a NOP-In.
+		 * See 10.18.2 in the draft 20.
+		 */
+		eprintk("initiator bug %x\n", cmnd_itt(cmnd));
+		err = -ISCSI_REASON_PROTOCOL_ERROR;
+		goto out;
+	}
+
+	if (cmnd_itt(cmnd) == cpu_to_be32(ISCSI_RESERVED_TAG)) {
+		if (!(cmnd->pdu.bhs.opcode & ISCSI_OP_IMMEDIATE))
+			eprintk("%s\n","initiator bug!");
+		update_stat_sn(cmnd);
+		err = check_cmd_sn(cmnd);
+		if (err)
+			goto out;
+	} else if ((err = cmnd_insert_hash(cmnd)) < 0) {
+		eprintk("ignore this request %x\n", cmnd_itt(cmnd));
+		goto out;
+	}
+
+	if ((size = cmnd->pdu.datasize)) {
+		size = (size + 3) & -4;
+		conn->read_msg.msg_iov = conn->read_iov;
+		if (cmnd->pdu.bhs.itt != cpu_to_be32(ISCSI_RESERVED_TAG)) {
+			struct tio *tio;
+			int pg_cnt = get_pgcnt(size, 0);
+
+			assert(pg_cnt < ISCSI_CONN_IOV_MAX);
+			cmnd->tio = tio = tio_alloc(pg_cnt);
+			tio_set(tio, size, 0);
+
+			for (i = 0; i < pg_cnt; i++) {
+				conn->read_iov[i].iov_base
+					= page_address(tio->pvec[i]);
+				tmp = min_t(u32, size, PAGE_CACHE_SIZE);
+				conn->read_iov[i].iov_len = tmp;
+				conn->read_size += tmp;
+				size -= tmp;
+			}
+		} else {
+			for (i = 0; i < ISCSI_CONN_IOV_MAX; i++) {
+				conn->read_iov[i].iov_base = dummy_data;
+				tmp = min_t(u32, size, sizeof(dummy_data));
+				conn->read_iov[i].iov_len = tmp;
+				conn->read_size += tmp;
+				size -= tmp;
+			}
+		}
+		assert(!size);
+		conn->read_overflow = size;
+		conn->read_msg.msg_iovlen = i;
+	}
+
+out:
+	return err;
+}
+
+static u32 get_next_ttt(struct iscsi_session *session)
+{
+	u32 ttt;
+
+	if (session->next_ttt == ISCSI_RESERVED_TAG)
+		session->next_ttt++;
+	ttt = session->next_ttt++;
+
+	return cpu_to_be32(ttt);
+}
+
+static void scsi_cmnd_start(struct iscsi_conn *conn, struct iscsi_cmnd *req)
+{
+	struct iscsi_scsi_cmd_hdr *req_hdr = cmnd_hdr(req);
+
+	dprintk(D_GENERIC, "scsi command: %02x\n", req_hdr->scb[0]);
+
+	req->lun = volume_get(conn->session->target, translate_lun(req_hdr->lun));
+	if (!req->lun) {
+		switch (req_hdr->scb[0]) {
+		case INQUIRY:
+		case REPORT_LUNS:
+			break;
+		default:
+			eprintk("%x %x\n", cmnd_itt(req), req_hdr->scb[0]);
+			create_sense_rsp(req, ILLEGAL_REQUEST, 0x25, 0x0);
+			cmnd_skip_data(req);
+			goto out;
+		}
+	} else
+		set_cmnd_lunit(req);
+
+	switch (req_hdr->scb[0]) {
+	case SERVICE_ACTION_IN:
+		if ((req_hdr->scb[1] & 0x1f) != 0x10)
+			goto error;
+	case INQUIRY:
+	case REPORT_LUNS:
+	case TEST_UNIT_READY:
+	case SYNCHRONIZE_CACHE:
+	case VERIFY:
+	case VERIFY_16:
+	case START_STOP:
+	case READ_CAPACITY:
+	case MODE_SENSE:
+	case REQUEST_SENSE:
+	case RESERVE:
+	case RELEASE:
+	{
+		if (!(req_hdr->flags & ISCSI_CMD_FINAL) || req->pdu.datasize) {
+			/* unexpected unsolicited data */
+			eprintk("%x %x\n", cmnd_itt(req), req_hdr->scb[0]);
+			create_sense_rsp(req, ABORTED_COMMAND, 0xc, 0xc);
+			cmnd_skip_data(req);
+		}
+		break;
+	}
+	case READ_6:
+	case READ_10:
+	case READ_16:
+	{
+		loff_t offset;
+		u32 length;
+
+		if (!(req_hdr->flags & ISCSI_CMD_FINAL) || req->pdu.datasize) {
+			/* unexpected unsolicited data */
+			eprintk("%x %x\n", cmnd_itt(req), req_hdr->scb[0]);
+			create_sense_rsp(req, ABORTED_COMMAND, 0xc, 0xc);
+			cmnd_skip_data(req);
+			break;
+		}
+
+		set_offset_and_length(req->lun, req_hdr->scb, &offset, &length);
+		req->tio = tio_alloc(get_pgcnt(length, offset));
+		tio_set(req->tio, length, offset);
+		break;
+	}
+	case WRITE_6:
+	case WRITE_10:
+	case WRITE_16:
+	case WRITE_VERIFY:
+	{
+		struct iscsi_sess_param *param = &conn->session->param;
+		loff_t offset;
+		u32 length;
+
+		req->r2t_length = be32_to_cpu(req_hdr->data_length) - req->pdu.datasize;
+		req->is_unsolicited_data = !(req_hdr->flags & ISCSI_CMD_FINAL);
+		req->target_task_tag = get_next_ttt(conn->session);
+
+		if (LUReadonly(req->lun)) {
+			create_sense_rsp(req, DATA_PROTECT, 0x27, 0x0);
+			cmnd_skip_data(req);
+			break;
+		}
+
+		if (!param->immediate_data && req->pdu.datasize)
+			eprintk("%x %x\n", cmnd_itt(req), req_hdr->scb[0]);
+
+		if (param->initial_r2t && !(req_hdr->flags & ISCSI_CMD_FINAL))
+			eprintk("%x %x\n", cmnd_itt(req), req_hdr->scb[0]);
+
+		if (req_hdr->scb[0] == WRITE_VERIFY && req_hdr->scb[1] & 0x02)
+			eprintk("Verification is ignored %x\n", cmnd_itt(req));
+
+		set_offset_and_length(req->lun, req_hdr->scb, &offset, &length);
+		if (cmnd_write_size(req) != length)
+			eprintk("%x %u %u\n", cmnd_itt(req), cmnd_write_size(req), length);
+
+		req->tio = tio_alloc(get_pgcnt(length, offset));
+		tio_set(req->tio, length, offset);
+
+		if (req->pdu.datasize) {
+			if (cmnd_recv_pdu(conn, req->tio, 0, req->pdu.datasize) < 0)
+				assert(0);
+		}
+		break;
+	}
+	error:
+	default:
+		eprintk("Unsupported %x\n", req_hdr->scb[0]);
+		create_sense_rsp(req, ILLEGAL_REQUEST, 0x20, 0x0);
+		cmnd_skip_data(req);
+		break;
+	}
+
+out:
+	return;
+}
+
+static void data_out_start(struct iscsi_conn *conn, struct iscsi_cmnd *cmnd)
+{
+	struct iscsi_data_out_hdr *req = (struct iscsi_data_out_hdr *)&cmnd->pdu.bhs;
+	struct iscsi_cmnd *scsi_cmnd = NULL;
+	u32 offset = be32_to_cpu(req->buffer_offset);
+
+	update_stat_sn(cmnd);
+
+	cmnd->req = scsi_cmnd = cmnd_find_hash(conn->session, req->itt, req->ttt);
+	if (!scsi_cmnd) {
+		eprintk("unable to find scsi task %x %x\n",
+			cmnd_itt(cmnd), cmnd_ttt(cmnd));
+		goto skip_data;
+	}
+
+	if (scsi_cmnd->r2t_length < cmnd->pdu.datasize) {
+		eprintk("invalid data len %x %u %u\n",
+			cmnd_itt(scsi_cmnd), cmnd->pdu.datasize, scsi_cmnd->r2t_length);
+		goto skip_data;
+	}
+
+	if (scsi_cmnd->r2t_length + offset != cmnd_write_size(scsi_cmnd)) {
+		eprintk("%x %u %u %u\n", cmnd_itt(scsi_cmnd), scsi_cmnd->r2t_length,
+			offset,	cmnd_write_size(scsi_cmnd));
+		goto skip_data;
+	}
+
+	scsi_cmnd->r2t_length -= cmnd->pdu.datasize;
+
+	if (req->ttt == cpu_to_be32(ISCSI_RESERVED_TAG)) {
+		/* unsolicited burst data */
+		if (scsi_cmnd->pdu.bhs.flags & ISCSI_FLG_FINAL) {
+			eprintk("unexpected data from %x %x\n",
+				cmnd_itt(cmnd), cmnd_ttt(cmnd));
+			goto skip_data;
+		}
+	}
+
+	dprintk(D_WRITE, "%u %p %p %p %u %u\n", req->ttt, cmnd, scsi_cmnd,
+		scsi_cmnd->tio, offset, cmnd->pdu.datasize);
+
+	if (cmnd_recv_pdu(conn, scsi_cmnd->tio, offset, cmnd->pdu.datasize) < 0)
+		goto skip_data;
+	return;
+
+skip_data:
+	cmnd->pdu.bhs.opcode = ISCSI_OP_DATA_REJECT;
+	cmnd_skip_pdu(cmnd);
+	return;
+}
+
+static void data_out_end(struct iscsi_conn *conn, struct iscsi_cmnd *cmnd)
+{
+	struct iscsi_data_out_hdr *req = (struct iscsi_data_out_hdr *) &cmnd->pdu.bhs;
+	struct iscsi_cmnd *scsi_cmnd;
+	u32 offset;
+
+	assert(cmnd);
+	scsi_cmnd = cmnd->req;
+	assert(scsi_cmnd);
+
+	if (conn->read_overflow) {
+		eprintk("%x %u\n", cmnd_itt(cmnd), conn->read_overflow);
+		assert(scsi_cmnd->tio);
+		offset = be32_to_cpu(req->buffer_offset);
+		offset += cmnd->pdu.datasize - conn->read_overflow;
+		if (cmnd_recv_pdu(conn, scsi_cmnd->tio, offset, conn->read_overflow) < 0)
+			assert(0);
+		return;
+	}
+
+	if (req->ttt == cpu_to_be32(ISCSI_RESERVED_TAG)) {
+		if (req->flags & ISCSI_FLG_FINAL) {
+			scsi_cmnd->is_unsolicited_data = 0;
+			if (!cmnd_pending(scsi_cmnd))
+				scsi_cmnd_exec(scsi_cmnd);
+		}
+	} else {
+		/* TODO : proper error handling */
+		if (!(req->flags & ISCSI_FLG_FINAL) && scsi_cmnd->r2t_length == 0)
+			eprintk("initiator error %x\n", cmnd_itt(scsi_cmnd));
+
+		if (!(req->flags & ISCSI_FLG_FINAL))
+			goto out;
+
+		scsi_cmnd->outstanding_r2t--;
+
+		if (scsi_cmnd->r2t_length == 0)
+			assert(list_empty(&scsi_cmnd->pdu_list));
+
+		scsi_cmnd_exec(scsi_cmnd);
+	}
+
+out:
+	iscsi_cmnd_remove(cmnd);
+	return;
+}
+
+static int __cmnd_abort(struct iscsi_cmnd *cmnd)
+{
+	if (cmnd_waitio(cmnd))
+		return -ISCSI_RESPONSE_UNKNOWN_TASK;
+
+	if (cmnd->conn->read_cmnd != cmnd)
+		cmnd_release(cmnd, 1);
+	else if (cmnd_rxstart(cmnd))
+		set_cmnd_tmfabort(cmnd);
+	else
+		return -ISCSI_RESPONSE_UNKNOWN_TASK;
+
+	return 0;
+}
+
+static int cmnd_abort(struct iscsi_session *session, u32 itt)
+{
+	struct iscsi_cmnd *cmnd;
+	int err =  -ISCSI_RESPONSE_UNKNOWN_TASK;
+
+	if ((cmnd = cmnd_find_hash(session, itt, ISCSI_RESERVED_TAG))) {
+		eprintk("%x %x %x %u %u %u %u\n", cmnd_itt(cmnd), cmnd_opcode(cmnd),
+			cmnd->r2t_length, cmnd_scsicode(cmnd),
+			cmnd_write_size(cmnd), cmnd->is_unsolicited_data,
+			cmnd->outstanding_r2t);
+		err = __cmnd_abort(cmnd);
+	}
+
+	return err;
+}
+
+static int target_reset(struct iscsi_cmnd *req, u32 lun, int all)
+{
+	struct iscsi_target *target = req->conn->session->target;
+	struct iscsi_session *session;
+	struct iscsi_conn *conn;
+	struct iscsi_cmnd *cmnd, *tmp;
+	struct iet_volume *volumes;
+
+	list_for_each_entry(session, &target->session_list, list) {
+		list_for_each_entry(conn, &session->conn_list, list) {
+			list_for_each_entry_safe(cmnd, tmp, &conn->pdu_list, conn_list) {
+				if (cmnd == req)
+					continue;
+
+				if (all)
+					__cmnd_abort(cmnd);
+				else if (translate_lun(cmnd_hdr(cmnd)->lun) == lun)
+					__cmnd_abort(cmnd);
+			}
+		}
+	}
+
+	list_for_each_entry(volumes, &target->volumes, list)
+		if (all || volumes->lun == lun)
+			/* force release */
+			volume_release(volumes, 0, 1);
+
+	return 0;
+}
+
+static void task_set_abort(struct iscsi_cmnd *req)
+{
+	struct iscsi_session *session = req->conn->session;
+	struct iscsi_conn *conn;
+	struct iscsi_cmnd *cmnd, *tmp;
+
+	list_for_each_entry(conn, &session->conn_list, list) {
+		list_for_each_entry_safe(cmnd, tmp, &conn->pdu_list, conn_list) {
+			if (cmnd != req)
+				__cmnd_abort(cmnd);
+		}
+	}
+}
+
+static inline char *tmf_desc(int fun)
+{
+	static char *tmf_desc[] = {
+		"Unknown Function",
+		"Abort Task",
+		"Abort Task Set",
+		"Clear ACA",
+		"Clear Task Set",
+		"Logical Unit Reset",
+		"Target Warm Reset",
+		"Target Cold Reset",
+		"Task Reassign",
+        };
+
+	if ((fun < ISCSI_FUNCTION_ABORT_TASK) || 
+				(fun > ISCSI_FUNCTION_TASK_REASSIGN))
+		fun = 0;
+
+	return tmf_desc[fun];
+}
+
+static inline char *rsp_desc(int rsp)
+{
+	static char *rsp_desc[] = {
+		"Function Complete",
+		"Unknown Task",
+		"Unknown LUN",
+		"Task Allegiant",
+		"Failover Unsupported",
+		"Function Unsupported",
+		"No Authorization",
+		"Function Rejected",
+		"Unknown Response",
+	};
+
+	if (((rsp < ISCSI_RESPONSE_FUNCTION_COMPLETE) ||
+			(rsp > ISCSI_RESPONSE_NO_AUTHORIZATION)) &&
+			(rsp != ISCSI_RESPONSE_FUNCTION_REJECTED))
+		rsp = 8;
+	else if (rsp == ISCSI_RESPONSE_FUNCTION_REJECTED)
+		rsp = 7;
+
+	return rsp_desc[rsp];
+}
+
+static void execute_task_management(struct iscsi_cmnd *req)
+{
+	struct iscsi_conn *conn = req->conn;
+	struct iscsi_session *session = conn->session;
+	struct iscsi_target *target = session->target;
+	struct iscsi_cmnd *rsp;
+	struct iscsi_task_mgt_hdr *req_hdr = (struct iscsi_task_mgt_hdr *)&req->pdu.bhs;
+	struct iscsi_task_rsp_hdr *rsp_hdr;
+	u32 lun;
+	int err, function = req_hdr->function & ISCSI_FUNCTION_MASK;
+
+	rsp = iscsi_cmnd_create_rsp_cmnd(req, 1);
+	rsp_hdr = (struct iscsi_task_rsp_hdr *)&rsp->pdu.bhs;
+
+	rsp_hdr->opcode = ISCSI_OP_SCSI_TASK_MGT_RSP;
+	rsp_hdr->flags = ISCSI_FLG_FINAL;
+	rsp_hdr->itt = req_hdr->itt;
+	rsp_hdr->response = ISCSI_RESPONSE_FUNCTION_COMPLETE;
+
+	switch (function) {
+	case ISCSI_FUNCTION_ABORT_TASK:
+	case ISCSI_FUNCTION_ABORT_TASK_SET:
+	case ISCSI_FUNCTION_CLEAR_ACA:
+	case ISCSI_FUNCTION_CLEAR_TASK_SET:
+	case ISCSI_FUNCTION_LOGICAL_UNIT_RESET:
+		lun = translate_lun(req_hdr->lun);
+		if (!volume_lookup(target, lun)) {
+			rsp_hdr->response = ISCSI_RESPONSE_UNKNOWN_LUN;
+			goto out;
+		}
+	}
+
+	switch (function) {
+	case ISCSI_FUNCTION_ABORT_TASK:
+		if ((err = cmnd_abort(conn->session, req_hdr->rtt)) < 0)
+			rsp_hdr->response = -err;
+		break;
+	case ISCSI_FUNCTION_ABORT_TASK_SET:
+		task_set_abort(req);
+		break;
+	case ISCSI_FUNCTION_CLEAR_ACA:
+		rsp_hdr->response = ISCSI_RESPONSE_FUNCTION_UNSUPPORTED;
+		break;
+	case ISCSI_FUNCTION_CLEAR_TASK_SET:
+		rsp_hdr->response = ISCSI_RESPONSE_FUNCTION_UNSUPPORTED;
+		break;
+	case ISCSI_FUNCTION_LOGICAL_UNIT_RESET:
+		target_reset(req, translate_lun(req_hdr->lun), 0);
+		break;
+	case ISCSI_FUNCTION_TARGET_WARM_RESET:
+	case ISCSI_FUNCTION_TARGET_COLD_RESET:
+		target_reset(req, 0, 1);
+		if (function == ISCSI_FUNCTION_TARGET_COLD_RESET)
+			set_cmnd_close(rsp);
+		break;
+	case ISCSI_FUNCTION_TASK_REASSIGN:
+		rsp_hdr->response = ISCSI_RESPONSE_FUNCTION_UNSUPPORTED;
+		break;
+	default:
+		rsp_hdr->response = ISCSI_RESPONSE_FUNCTION_REJECTED;
+		break;
+	}
+out:
+	iprintk("%s (%02x) issued on tid:%d lun:%d by sid:%llu (%s)\n",
+				tmf_desc(function), function, target->tid,
+				translate_lun(req_hdr->lun), session->sid,
+				rsp_desc(rsp_hdr->response));
+
+	iscsi_cmnd_init_write(rsp);
+}
+
+static void noop_out_exec(struct iscsi_cmnd *req)
+{
+	struct iscsi_cmnd *rsp;
+	struct iscsi_nop_in_hdr *rsp_hdr;
+
+	if (cmnd_itt(req) != cpu_to_be32(ISCSI_RESERVED_TAG)) {
+		rsp = iscsi_cmnd_create_rsp_cmnd(req, 1);
+
+		rsp_hdr = (struct iscsi_nop_in_hdr *)&rsp->pdu.bhs;
+		rsp_hdr->opcode = ISCSI_OP_NOOP_IN;
+		rsp_hdr->flags = ISCSI_FLG_FINAL;
+		rsp_hdr->itt = req->pdu.bhs.itt;
+		rsp_hdr->ttt = cpu_to_be32(ISCSI_RESERVED_TAG);
+
+		if (req->pdu.datasize)
+			assert(req->tio);
+		else
+			assert(!req->tio);
+
+		if (req->tio) {
+			tio_get(req->tio);
+			rsp->tio = req->tio;
+		}
+
+		assert(get_pgcnt(req->pdu.datasize, 0) < ISCSI_CONN_IOV_MAX);
+		rsp->pdu.datasize = req->pdu.datasize;
+		iscsi_cmnd_init_write(rsp);
+	} else
+		iscsi_cmnd_remove(req);
+}
+
+static void logout_exec(struct iscsi_cmnd *req)
+{
+	struct iscsi_logout_req_hdr *req_hdr;
+	struct iscsi_cmnd *rsp;
+	struct iscsi_logout_rsp_hdr *rsp_hdr;
+
+	req_hdr = (struct iscsi_logout_req_hdr *)&req->pdu.bhs;
+	rsp = iscsi_cmnd_create_rsp_cmnd(req, 1);
+	rsp_hdr = (struct iscsi_logout_rsp_hdr *)&rsp->pdu.bhs;
+	rsp_hdr->opcode = ISCSI_OP_LOGOUT_RSP;
+	rsp_hdr->flags = ISCSI_FLG_FINAL;
+	rsp_hdr->itt = req_hdr->itt;
+	set_cmnd_close(rsp);
+	iscsi_cmnd_init_write(rsp);
+}
+
+static void iscsi_cmnd_exec(struct iscsi_cmnd *cmnd)
+{
+	dprintk(D_GENERIC, "%p,%x,%u\n", cmnd, cmnd_opcode(cmnd), cmnd->pdu.bhs.sn);
+
+	switch (cmnd_opcode(cmnd)) {
+	case ISCSI_OP_NOOP_OUT:
+		noop_out_exec(cmnd);
+		break;
+	case ISCSI_OP_SCSI_CMD:
+		scsi_cmnd_exec(cmnd);
+		break;
+	case ISCSI_OP_SCSI_TASK_MGT_MSG:
+		execute_task_management(cmnd);
+		break;
+	case ISCSI_OP_LOGOUT_CMD:
+		logout_exec(cmnd);
+		break;
+	case ISCSI_OP_SCSI_REJECT:
+		iscsi_cmnd_init_write(get_rsp_cmnd(cmnd));
+		break;
+	case ISCSI_OP_TEXT_CMD:
+	case ISCSI_OP_SNACK_CMD:
+		break;
+	default:
+		eprintk("unexpected cmnd op %x\n", cmnd_opcode(cmnd));
+		break;
+	}
+}
+
+static void __cmnd_send_pdu(struct iscsi_conn *conn, struct tio *tio, u32 offset, u32 size)
+{
+	dprintk(D_GENERIC, "%p %u,%u\n", tio, offset, size);
+	offset += tio->offset;
+
+	assert(offset <= tio->offset + tio->size);
+	assert(offset + size <= tio->offset + tio->size);
+
+	conn->write_tcmnd = tio;
+	conn->write_offset = offset;
+	conn->write_size += size;
+}
+
+static void cmnd_send_pdu(struct iscsi_conn *conn, struct iscsi_cmnd *cmnd)
+{
+	u32 size;
+	struct tio *tio;
+
+	if (!cmnd->pdu.datasize)
+		return;
+
+	size = (cmnd->pdu.datasize + 3) & -4;
+	tio = cmnd->tio;
+	assert(tio);
+	assert(tio->size == size);
+	__cmnd_send_pdu(conn, tio, 0, size);
+}
+
+static void set_cork(struct socket *sock, int on)
+{
+	int opt = on;
+	mm_segment_t oldfs;
+
+	oldfs = get_fs();
+	set_fs(get_ds());
+	sock->ops->setsockopt(sock, SOL_TCP, TCP_CORK, (void *)&opt, sizeof(opt));
+	set_fs(oldfs);
+}
+
+void cmnd_release(struct iscsi_cmnd *cmnd, int force)
+{
+	struct iscsi_cmnd *req, *rsp;
+	int is_last = 0;
+
+	if (!cmnd)
+		return;
+
+/* 	eprintk("%x %lx %d\n", cmnd_opcode(cmnd), cmnd->flags, force); */
+
+	req = cmnd->req;
+	is_last = cmnd_final(cmnd);
+
+	if (force) {
+		while (!list_empty(&cmnd->pdu_list)) {
+			rsp = list_entry(cmnd->pdu_list.next, struct iscsi_cmnd, pdu_list);
+			list_del_init(&rsp->list);
+			list_del(&rsp->pdu_list);
+			iscsi_cmnd_remove(rsp);
+		}
+		list_del_init(&cmnd->list);
+	} else
+		if (cmnd_queued(cmnd))
+			iscsi_scsi_dequeuecmnd(cmnd);
+
+	if (cmnd_hashed(cmnd))
+		cmnd_remove_hash(cmnd);
+
+	if (cmnd_lunit(cmnd)) {
+		assert(cmnd->lun);
+		volume_put(cmnd->lun);
+	}
+
+	list_del_init(&cmnd->pdu_list);
+	iscsi_cmnd_remove(cmnd);
+
+	if (is_last) {
+		assert(!force);
+		assert(req);
+		cmnd_release(req, 0);
+	}
+
+	return;
+}
+
+void cmnd_tx_start(struct iscsi_cmnd *cmnd)
+{
+	struct iscsi_conn *conn = cmnd->conn;
+	struct iovec *iop;
+
+	dprintk(D_GENERIC, "%p:%x\n", cmnd, cmnd_opcode(cmnd));
+	assert(cmnd);
+	iscsi_cmnd_set_length(&cmnd->pdu);
+
+	set_cork(conn->sock, 1);
+
+	conn->write_iop = iop = conn->write_iov;
+	iop->iov_base = &cmnd->pdu.bhs;
+	iop->iov_len = sizeof(cmnd->pdu.bhs);
+	iop++;
+	conn->write_size = sizeof(cmnd->pdu.bhs);
+
+	switch (cmnd_opcode(cmnd)) {
+	case ISCSI_OP_NOOP_IN:
+		cmnd_set_sn(cmnd, 1);
+		cmnd_send_pdu(conn, cmnd);
+		break;
+	case ISCSI_OP_SCSI_RSP:
+		cmnd_set_sn(cmnd, 1);
+		cmnd_send_pdu(conn, cmnd);
+		break;
+	case ISCSI_OP_SCSI_TASK_MGT_RSP:
+		cmnd_set_sn(cmnd, 1);
+		break;
+	case ISCSI_OP_TEXT_RSP:
+		cmnd_set_sn(cmnd, 1);
+		break;
+	case ISCSI_OP_SCSI_DATA_IN:
+	{
+		struct iscsi_data_in_hdr *rsp = (struct iscsi_data_in_hdr *)&cmnd->pdu.bhs;
+		u32 offset;
+
+		cmnd_set_sn(cmnd, (rsp->flags & ISCSI_FLG_FINAL) ? 1 : 0);
+		offset = rsp->buffer_offset;
+		rsp->buffer_offset = cpu_to_be32(offset);
+		__cmnd_send_pdu(conn, cmnd->tio, offset, cmnd->pdu.datasize);
+		break;
+	}
+	case ISCSI_OP_LOGOUT_RSP:
+		cmnd_set_sn(cmnd, 1);
+		break;
+	case ISCSI_OP_R2T:
+		cmnd_set_sn(cmnd, 0);
+		cmnd->pdu.bhs.sn = cpu_to_be32(conn->stat_sn);
+		break;
+	case ISCSI_OP_ASYNC_MSG:
+		cmnd_set_sn(cmnd, 1);
+		break;
+	case ISCSI_OP_REJECT:
+		cmnd_set_sn(cmnd, 1);
+		cmnd_send_pdu(conn, cmnd);
+		break;
+	default:
+		eprintk("unexpected cmnd op %x\n", cmnd_opcode(cmnd));
+		break;
+	}
+
+	iop->iov_len = 0;
+	// move this?
+	conn->write_size = (conn->write_size + 3) & -4;
+	iscsi_dump_pdu(&cmnd->pdu);
+}
+
+void cmnd_tx_end(struct iscsi_cmnd *cmnd)
+{
+	struct iscsi_conn *conn = cmnd->conn;
+
+	dprintk(D_GENERIC, "%p:%x\n", cmnd, cmnd_opcode(cmnd));
+	switch (cmnd_opcode(cmnd)) {
+	case ISCSI_OP_NOOP_IN:
+	case ISCSI_OP_SCSI_RSP:
+	case ISCSI_OP_SCSI_TASK_MGT_RSP:
+	case ISCSI_OP_TEXT_RSP:
+	case ISCSI_OP_R2T:
+	case ISCSI_OP_ASYNC_MSG:
+	case ISCSI_OP_REJECT:
+	case ISCSI_OP_SCSI_DATA_IN:
+	case ISCSI_OP_LOGOUT_RSP:
+		break;
+	default:
+		eprintk("unexpected cmnd op %x\n", cmnd_opcode(cmnd));
+		assert(0);
+		break;
+	}
+
+	if (cmnd_close(cmnd))
+		conn_close(conn);
+
+	list_del_init(&cmnd->list);
+	set_cork(cmnd->conn->sock, 0);
+}
+
+/**
+ * Push the command for execution.
+ * This functions reorders the commands.
+ * Called from the read thread.
+ *
+ * iscsi_session_push_cmnd - 
+ * @cmnd: ptr to command
+ */
+
+static void iscsi_session_push_cmnd(struct iscsi_cmnd *cmnd)
+{
+	struct iscsi_session *session = cmnd->conn->session;
+	struct list_head *entry;
+	u32 cmd_sn;
+
+	dprintk(D_GENERIC, "%p:%x %u,%u\n",
+		cmnd, cmnd_opcode(cmnd), cmnd->pdu.bhs.sn, session->exp_cmd_sn);
+
+	if (cmnd->pdu.bhs.opcode & ISCSI_OP_IMMEDIATE) {
+		iscsi_cmnd_exec(cmnd);
+		return;
+	}
+
+	cmd_sn = cmnd->pdu.bhs.sn;
+	if (cmd_sn == session->exp_cmd_sn) {
+		while (1) {
+			session->exp_cmd_sn = ++cmd_sn;
+			iscsi_cmnd_exec(cmnd);
+
+			if (list_empty(&session->pending_list))
+				break;
+			cmnd = list_entry(session->pending_list.next, struct iscsi_cmnd, list);
+			if (cmnd->pdu.bhs.sn != cmd_sn)
+				break;
+/* 			eprintk("find out-of-order %x %u %u\n", */
+/* 				cmnd_itt(cmnd), cmd_sn, cmnd->pdu.bhs.sn); */
+			list_del_init(&cmnd->list);
+			clear_cmnd_pending(cmnd);
+		}
+	} else {
+/* 		eprintk("out-of-order %x %u %u\n", */
+/* 			cmnd_itt(cmnd), cmd_sn, session->exp_cmd_sn); */
+
+		set_cmnd_pending(cmnd);
+		if (before(cmd_sn, session->exp_cmd_sn)) /* close the conn */
+			eprintk("unexpected cmd_sn (%u,%u)\n", cmd_sn, session->exp_cmd_sn);
+
+		if (after(cmd_sn, session->exp_cmd_sn + session->max_queued_cmnds))
+			eprintk("too large cmd_sn (%u,%u)\n", cmd_sn, session->exp_cmd_sn);
+
+		list_for_each(entry, &session->pending_list) {
+			struct iscsi_cmnd *tmp = list_entry(entry, struct iscsi_cmnd, list);
+			if (before(cmd_sn, tmp->pdu.bhs.sn))
+				break;
+		}
+
+		assert(list_empty(&cmnd->list));
+
+		list_add_tail(&cmnd->list, entry);
+	}
+}
+
+static int check_segment_length(struct iscsi_cmnd *cmnd)
+{
+	struct iscsi_conn *conn = cmnd->conn;
+	struct iscsi_sess_param *param = &conn->session->param;
+
+	if (cmnd->pdu.datasize > param->max_recv_data_length) {
+		eprintk("data too long %x %u %u\n", cmnd_itt(cmnd),
+			cmnd->pdu.datasize, param->max_recv_data_length);
+
+		if (get_pgcnt(cmnd->pdu.datasize, 0) > ISCSI_CONN_IOV_MAX) {
+			conn_close(conn);
+			return -EINVAL;
+		}
+	}
+
+	return 0;
+}
+
+void cmnd_rx_start(struct iscsi_cmnd *cmnd)
+{
+	struct iscsi_conn *conn = cmnd->conn;
+	int err = 0;
+
+	iscsi_dump_pdu(&cmnd->pdu);
+
+	set_cmnd_rxstart(cmnd);
+	if (check_segment_length(cmnd) < 0)
+		return;
+
+	switch (cmnd_opcode(cmnd)) {
+	case ISCSI_OP_NOOP_OUT:
+		err = noop_out_start(conn, cmnd);
+		break;
+	case ISCSI_OP_SCSI_CMD:
+		if (!(err = cmnd_insert_hash(cmnd)))
+			scsi_cmnd_start(conn, cmnd);
+		break;
+	case ISCSI_OP_SCSI_TASK_MGT_MSG:
+		err = cmnd_insert_hash(cmnd);
+		break;
+	case ISCSI_OP_SCSI_DATA_OUT:
+		data_out_start(conn, cmnd);
+		break;
+	case ISCSI_OP_LOGOUT_CMD:
+		err = cmnd_insert_hash(cmnd);
+		break;
+	case ISCSI_OP_TEXT_CMD:
+	case ISCSI_OP_SNACK_CMD:
+		err = -ISCSI_REASON_UNSUPPORTED_COMMAND;
+		break;
+	default:
+		err = -ISCSI_REASON_UNSUPPORTED_COMMAND;
+		break;
+	}
+
+	if (err < 0) {
+		eprintk("%x %x %d\n", cmnd_opcode(cmnd), cmnd_itt(cmnd), err);
+		iscsi_cmnd_reject(cmnd, -err);
+	}
+}
+
+void cmnd_rx_end(struct iscsi_cmnd *cmnd)
+{
+	struct iscsi_conn *conn = cmnd->conn;
+
+	if (cmnd_tmfabort(cmnd)) {
+		cmnd_release(cmnd, 1);
+		return;
+	}
+
+	dprintk(D_GENERIC, "%p:%x\n", cmnd, cmnd_opcode(cmnd));
+	switch (cmnd_opcode(cmnd)) {
+	case ISCSI_OP_SCSI_REJECT:
+	case ISCSI_OP_NOOP_OUT:
+	case ISCSI_OP_SCSI_CMD:
+	case ISCSI_OP_SCSI_TASK_MGT_MSG:
+	case ISCSI_OP_TEXT_CMD:
+	case ISCSI_OP_LOGOUT_CMD:
+		iscsi_session_push_cmnd(cmnd);
+		break;
+	case ISCSI_OP_SCSI_DATA_OUT:
+		data_out_end(conn, cmnd);
+		break;
+	case ISCSI_OP_SNACK_CMD:
+		break;
+	case ISCSI_OP_PDU_REJECT:
+		iscsi_cmnd_init_write(get_rsp_cmnd(cmnd));
+		break;
+	case ISCSI_OP_DATA_REJECT:
+		cmnd_release(cmnd, 0);
+		break;
+	default:
+		eprintk("unexpected cmnd op %x\n", cmnd_opcode(cmnd));
+		BUG();
+		break;
+	}
+}
+
+static void iscsi_exit(void)
+{
+	wthread_module_exit();
+
+	unregister_chrdev(ctr_major, ctr_name);
+
+	iet_procfs_exit();
+
+	event_exit();
+
+	tio_exit();
+
+	iotype_exit();
+
+	if (iscsi_cmnd_cache)
+		kmem_cache_destroy(iscsi_cmnd_cache);
+}
+
+static int iscsi_init(void)
+{
+	int err = -ENOMEM;
+
+	printk("iSCSI Enterprise Target Software - version %s\n", IET_VERSION_STRING);
+
+	if ((ctr_major = register_chrdev(0, ctr_name, &ctr_fops)) < 0) {
+		eprintk("failed to register the control device %d\n", ctr_major);
+		return ctr_major;
+	}
+
+	if ((err = iet_procfs_init()) < 0)
+		goto err;
+
+	if ((err = event_init()) < 0)
+		goto err;
+
+	iscsi_cmnd_cache = KMEM_CACHE(iscsi_cmnd, 0);
+	if (!iscsi_cmnd_cache)
+		goto err;
+
+	if ((err = tio_init()) < 0)
+		goto err;
+
+	if ((err = iotype_init()) < 0)
+		goto err;
+
+	if ((err = wthread_module_init()) < 0)
+		goto err;
+
+	return 0;
+
+err:
+	iscsi_exit();
+	return err;
+}
+
+module_param(worker_thread_pool_size, ulong, S_IRUGO);
+MODULE_PARM_DESC(worker_thread_pool_size,
+		 "Size of the worker thread pool "
+		 "(0 = dedicated threads per target (default))");
+
+module_param(debug_enable_flags, ulong, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(debug_enable_flags,
+		 "debug bitmask, low bits (0 ... 8) used, see iscsi_dbg.h");
+
+module_init(iscsi_init);
+module_exit(iscsi_exit);
+
+MODULE_LICENSE("GPL");
--- linux-rt-2.6.31.orig/ubuntu/iscsitarget/iscsi_dbg.h
+++ linux-rt-2.6.31/ubuntu/iscsitarget/iscsi_dbg.h
@@ -0,0 +1,130 @@
+#ifndef ISCSI_DBG_H
+#define ISCSI_DBG_H
+
+#define D_SETUP		(1UL << 0)
+#define D_EXIT		(1UL << 1)
+#define D_GENERIC	(1UL << 2)
+#define D_READ		(1UL << 3)
+#define D_WRITE 	(1UL << 4)
+#define D_IOD		(1UL << 5)
+#define D_THREAD	(1UL << 6)
+#define D_TASK_MGT	(1UL << 7)
+#define D_IOMODE	(1UL << 8)
+
+#define D_DATA		(D_READ | D_WRITE)
+
+extern unsigned long debug_enable_flags;
+
+#define PFX "iscsi_trgt: "
+
+#define dprintk(debug, fmt, args...) do {			\
+	if ((debug) & debug_enable_flags) {			\
+		printk(KERN_DEBUG PFX "%s(%d) " fmt, __FUNCTION__,\
+						__LINE__, args);\
+	}							\
+} while (0)
+
+#define eprintk(fmt, args...) do {				\
+	printk(KERN_ERR PFX "%s(%d) " fmt, __FUNCTION__,	\
+						__LINE__, args);\
+} while (0)
+
+#define iprintk(X...) printk(KERN_INFO PFX X)
+
+#define assert(p) do {						\
+	if (!(p)) {						\
+		printk(KERN_CRIT PFX "BUG at %s:%d assert(%s)\n",\
+		       __FILE__, __LINE__, #p);			\
+		dump_stack();					\
+		BUG();						\
+	}							\
+} while (0)
+
+#ifdef D_IOV
+static inline void iscsi_dump_iov(struct msghdr *msg)
+{
+	int i;
+	printk(PFX "%p, %d\n", msg->msg_iov, msg->msg_iovlen);
+	for (i = 0; i < min_t(size_t, msg->msg_iovlen, ISCSI_CONN_IOV_MAX); i++)
+		printk(PFX "%d: %p,%d\n", i, msg->msg_iov[i].iov_base,
+						msg->msg_iov[i].iov_len);
+}
+#else
+#define iscsi_dump_iov(x) do {} while (0)
+#endif
+
+#ifdef D_DUMP_PDU
+static void iscsi_dump_char(int ch)
+{
+	static unsigned char text[16];
+	static int i = 0;
+
+	if (ch < 0) {
+		while ((i % 16) != 0) {
+			printk("   ");
+			text[i] = ' ';
+			i++;
+			if ((i % 16) == 0)
+				printk(" | %.16s |\n", text);
+			else if ((i % 4) == 0)
+				printk(" |");
+		}
+		i = 0;
+		return;
+	}
+
+	text[i] = (ch < 0x20 || (ch >= 0x80 && ch <= 0xa0)) ? ' ' : ch;
+	printk(" %02x", ch);
+	i++;
+	if ((i % 16) == 0) {
+		printk(" | %.16s |\n", text);
+		i = 0;
+	} else if ((i % 4) == 0)
+		printk(" |");
+}
+
+static inline void iscsi_dump_pdu(struct iscsi_pdu *pdu)
+{
+	unsigned char *buf;
+	int i;
+
+	buf = (void *)&pdu->bhs;
+	printk(PFX "BHS: (%p,%d)\n", buf, sizeof(pdu->bhs));
+	for (i = 0; i < sizeof(pdu->bhs); i++)
+		iscsi_dump_char(*buf++);
+	iscsi_dump_char(-1);
+
+	buf = (void *)pdu->ahs;
+	printk(PFX "AHS: (%p,%d)\n", buf, pdu->ahssize);
+	for (i = 0; i < pdu->ahssize; i++)
+		iscsi_dump_char(*buf++);
+	iscsi_dump_char(-1);
+
+	printk(PFX "Data: (%d)\n", pdu->datasize);
+}
+
+#else
+#define iscsi_dump_pdu(x) do {} while (0)
+#endif
+
+#define show_param(param)\
+{\
+	dprintk(D_SETUP, "%d %d %d %d %d %d %d %d %d %d %d %d %d %d %d\n",\
+		(param)->initial_r2t,\
+		(param)->immediate_data,\
+		(param)->max_connections,\
+		(param)->max_recv_data_length,\
+		(param)->max_xmit_data_length,\
+		(param)->max_burst_length,\
+		(param)->first_burst_length,\
+		(param)->default_wait_time,\
+		(param)->default_retain_time,\
+		(param)->max_outstanding_r2t,\
+		(param)->data_pdu_inorder,\
+		(param)->data_sequence_inorder,\
+		(param)->error_recovery_level,\
+		(param)->header_digest,\
+		(param)->data_digest);\
+}
+
+#endif
--- linux-rt-2.6.31.orig/ubuntu/iscsitarget/session.c
+++ linux-rt-2.6.31/ubuntu/iscsitarget/session.c
@@ -0,0 +1,142 @@
+/*
+ * Copyright (C) 2002-2003 Ardis Technolgies <roman@ardistech.com>
+ *
+ * Released under the terms of the GNU GPL v2.0.
+ */
+
+#include "iscsi.h"
+#include "iscsi_dbg.h"
+
+struct iscsi_session *session_lookup(struct iscsi_target *target, u64 sid)
+{
+	struct iscsi_session *session;
+
+	list_for_each_entry(session, &target->session_list, list) {
+		if (session->sid == sid)
+			return session;
+	}
+	return NULL;
+}
+
+static struct iscsi_session *
+iet_session_alloc(struct iscsi_target *target, struct session_info *info)
+{
+	int i;
+	struct iscsi_session *session;
+
+	dprintk(D_SETUP, "%p %u %#Lx\n", target, target->tid,
+		(unsigned long long) info->sid);
+
+	session = kzalloc(sizeof(*session), GFP_KERNEL);
+	if (!session)
+		return NULL;
+
+	session->target = target;
+	session->sid = info->sid;
+	memcpy(&session->param, &target->sess_param, sizeof(session->param));
+	session->max_queued_cmnds = target->trgt_param.queued_cmnds;
+
+	session->exp_cmd_sn = info->exp_cmd_sn;
+	session->max_cmd_sn = info->max_cmd_sn;
+
+	session->initiator = kstrdup(info->initiator_name, GFP_KERNEL);
+	if (!session->initiator) {
+		kfree(session);
+		return NULL;
+	}
+
+	INIT_LIST_HEAD(&session->conn_list);
+	INIT_LIST_HEAD(&session->pending_list);
+
+	spin_lock_init(&session->cmnd_hash_lock);
+	for (i = 0; i < ARRAY_SIZE(session->cmnd_hash); i++)
+		INIT_LIST_HEAD(&session->cmnd_hash[i]);
+
+	session->next_ttt = 1;
+
+	list_add(&session->list, &target->session_list);
+
+	return session;
+}
+
+static int session_free(struct iscsi_session *session)
+{
+	int i;
+
+	dprintk(D_SETUP, "%#Lx\n", (unsigned long long) session->sid);
+
+	assert(list_empty(&session->conn_list));
+
+	for (i = 0; i < ARRAY_SIZE(session->cmnd_hash); i++) {
+		if (!list_empty(&session->cmnd_hash[i]))
+			BUG();
+	}
+
+	list_del(&session->list);
+
+	kfree(session->initiator);
+	kfree(session);
+
+	return 0;
+}
+
+int session_add(struct iscsi_target *target, struct session_info *info)
+{
+	struct iscsi_session *session;
+	int err = -EEXIST;
+
+	session = session_lookup(target, info->sid);
+	if (session)
+		return err;
+
+	session = iet_session_alloc(target, info);
+	if (!session)
+		err = -ENOMEM;
+
+	return err;
+}
+
+int session_del(struct iscsi_target *target, u64 sid)
+{
+	struct iscsi_session *session;
+
+	session = session_lookup(target, sid);
+	if (!session)
+		return -ENOENT;
+
+	if (!list_empty(&session->conn_list)) {
+		eprintk("%llu still have connections\n", (unsigned long long) session->sid);
+		return -EBUSY;
+	}
+
+	return session_free(session);
+}
+
+static void iet_session_info_show(struct seq_file *seq, struct iscsi_target *target)
+{
+	struct iscsi_session *session;
+
+	list_for_each_entry(session, &target->session_list, list) {
+		seq_printf(seq, "\tsid:%llu initiator:%s\n",
+			   (unsigned long long) session->sid, session->initiator);
+		conn_info_show(seq, session);
+	}
+}
+
+static int iet_session_seq_open(struct inode *inode, struct file *file)
+{
+	int res;
+	res = seq_open(file, &iet_seq_op);
+	if (!res)
+		((struct seq_file *)file->private_data)->private =
+			iet_session_info_show;
+	return res;
+}
+
+struct file_operations session_seq_fops = {
+	.owner		= THIS_MODULE,
+	.open		= iet_session_seq_open,
+	.read		= seq_read,
+	.llseek		= seq_lseek,
+	.release	= seq_release,
+};
--- linux-rt-2.6.31.orig/ubuntu/iscsitarget/BOM
+++ linux-rt-2.6.31/ubuntu/iscsitarget/BOM
@@ -0,0 +1,2 @@
+Downloaded from:	svn://svn.berlios.de/iscsitarget/trunk
+Current Version:	SVN revision r214 (0.4.17 base)
--- linux-rt-2.6.31.orig/ubuntu/iscsitarget/Makefile
+++ linux-rt-2.6.31/ubuntu/iscsitarget/Makefile
@@ -0,0 +1,17 @@
+#
+# Makefile for the Linux kernel device drivers.
+#
+# Note! Dependencies are done automagically by 'make dep', which also
+# removes any old dependencies. DON'T put your own dependencies here
+# unless it's something special (not a .c file).
+#
+# Note 2! The CFLAGS definitions are now in the main makefile.
+
+EXTRA_CFLAGS += -I$(src)/include 
+
+obj-m		+= iscsi_trgt.o
+iscsi_trgt-objs	:= tio.o iscsi.o nthread.o wthread.o config.o digest.o \
+			conn.o session.o target.o volume.o iotype.o \
+			file-io.o null-io.o target_disk.o event.o param.o \
+			block-io.o
+
--- linux-rt-2.6.31.orig/ubuntu/iscsitarget/iotype.h
+++ linux-rt-2.6.31/ubuntu/iscsitarget/iotype.h
@@ -0,0 +1,29 @@
+/*
+ * (C) 2004 - 2005 FUJITA Tomonori <tomof@acm.org>
+ * This code is licenced under the GPL.
+ */
+
+#include "iscsi.h"
+
+#ifndef __IOTYPE_H__
+#define __IOTYPE_H__
+
+struct iotype {
+	const char *name;
+	struct list_head iot_list;
+
+	int (*attach)(struct iet_volume *dev, char *args);
+	int (*make_request)(struct iet_volume *dev, struct tio *tio, int rw);
+	int (*sync)(struct iet_volume *dev, struct tio *tio);
+	void (*detach)(struct iet_volume *dev);
+	void (*show)(struct iet_volume *dev, struct seq_file *seq);
+};
+
+extern struct iotype fileio;
+extern struct iotype nullio;
+extern struct iotype blockio;
+
+extern int iotype_init(void);
+extern void iotype_exit(void);
+
+#endif
--- linux-rt-2.6.31.orig/ubuntu/iscsitarget/Kconfig
+++ linux-rt-2.6.31/ubuntu/iscsitarget/Kconfig
@@ -0,0 +1,3 @@
+config SCSI_ISCSITARGET
+	tristate "iSCSI Target Driver"
+	depends on SCSI
--- linux-rt-2.6.31.orig/ubuntu/iscsitarget/target.c
+++ linux-rt-2.6.31/ubuntu/iscsitarget/target.c
@@ -0,0 +1,330 @@
+/*
+ * Copyright (C) 2002-2003 Ardis Technolgies <roman@ardistech.com>
+ *
+ * Released under the terms of the GNU GPL v2.0.
+ */
+
+#include "iscsi.h"
+#include "digest.h"
+#include "iscsi_dbg.h"
+
+#define	MAX_NR_TARGETS	(1UL << 30)
+
+static LIST_HEAD(target_list);
+static DECLARE_MUTEX(target_list_sem);
+static u32 next_target_id;
+static u32 nr_targets;
+
+static struct iscsi_sess_param default_session_param = {
+	.initial_r2t = 1,
+	.immediate_data = 1,
+	.max_connections = 1,
+	.max_recv_data_length = 8192,
+	.max_xmit_data_length = 8192,
+	.max_burst_length = 262144,
+	.first_burst_length = 65536,
+	.default_wait_time = 2,
+	.default_retain_time = 20,
+	.max_outstanding_r2t = 1,
+	.data_pdu_inorder = 1,
+	.data_sequence_inorder = 1,
+	.error_recovery_level = 0,
+	.header_digest = DIGEST_NONE,
+	.data_digest = DIGEST_NONE,
+	.ofmarker = 0,
+	.ifmarker = 0,
+	.ofmarkint = 2048,
+	.ifmarkint = 2048,
+};
+
+static struct iscsi_trgt_param default_target_param = {
+	.wthreads = DEFAULT_NR_WTHREADS,
+	.target_type = 0,
+	.queued_cmnds = DEFAULT_NR_QUEUED_CMNDS,
+};
+
+inline int target_lock(struct iscsi_target *target, int interruptible)
+{
+	int err = 0;
+
+	if (interruptible)
+		err = down_interruptible(&target->target_sem);
+	else
+		down(&target->target_sem);
+
+	return err;
+}
+
+inline void target_unlock(struct iscsi_target *target)
+{
+	up(&target->target_sem);
+}
+
+static struct iscsi_target *__target_lookup_by_id(u32 id)
+{
+	struct iscsi_target *target;
+
+	list_for_each_entry(target, &target_list, t_list) {
+		if (target->tid == id)
+			return target;
+	}
+	return NULL;
+}
+
+static struct iscsi_target *__target_lookup_by_name(char *name)
+{
+	struct iscsi_target *target;
+
+	list_for_each_entry(target, &target_list, t_list) {
+		if (!strcmp(target->name, name))
+			return target;
+	}
+	return NULL;
+}
+
+struct iscsi_target *target_lookup_by_id(u32 id)
+{
+	struct iscsi_target *target;
+
+	down(&target_list_sem);
+	target = __target_lookup_by_id(id);
+	up(&target_list_sem);
+
+	return target;
+}
+
+static int target_thread_start(struct iscsi_target *target)
+{
+	int err;
+
+	if ((err = nthread_start(target)) < 0)
+		return err;
+
+	if (!worker_thread_pool) {
+		err = wthread_start(target->wthread_info,
+				    target->trgt_param.wthreads, target->tid);
+		if (err)
+			nthread_stop(target);
+	}
+
+	return err;
+}
+
+static void target_thread_stop(struct iscsi_target *target)
+{
+	if (!worker_thread_pool)
+		wthread_stop(target->wthread_info);
+
+	nthread_stop(target);
+}
+
+static int iscsi_target_create(struct target_info *info, u32 tid)
+{
+	int err = -EINVAL, len;
+	char *name = info->name;
+	struct iscsi_target *target;
+
+	dprintk(D_SETUP, "%u %s\n", tid, name);
+
+	if (!(len = strlen(name))) {
+		eprintk("The length of the target name is zero %u\n", tid);
+		return err;
+	}
+
+	if (!try_module_get(THIS_MODULE)) {
+		eprintk("Fail to get module %u\n", tid);
+		return err;
+	}
+
+	target = kzalloc(sizeof(*target), GFP_KERNEL);
+	if (!target) {
+		err = -ENOMEM;
+		goto out;
+	}
+
+	if (!worker_thread_pool) {
+		target->wthread_info = kmalloc(sizeof(struct worker_thread_info), GFP_KERNEL);
+		if (!target->wthread_info) {
+			err = -ENOMEM;
+			goto out;
+		}
+	}
+
+	target->tid = info->tid = tid;
+
+	memcpy(&target->sess_param, &default_session_param, sizeof(default_session_param));
+	memcpy(&target->trgt_param, &default_target_param, sizeof(default_target_param));
+
+	strncpy(target->name, name, sizeof(target->name) - 1);
+
+	init_MUTEX(&target->target_sem);
+
+	INIT_LIST_HEAD(&target->session_list);
+	INIT_LIST_HEAD(&target->volumes);
+
+	atomic_set(&target->nr_volumes, 0);
+
+	nthread_init(target);
+
+	if (!worker_thread_pool)
+		wthread_init(target->wthread_info);
+	else
+		target->wthread_info = worker_thread_pool;
+
+
+	if ((err = target_thread_start(target)) < 0) {
+		target_thread_stop(target);
+		goto out;
+	}
+
+	list_add(&target->t_list, &target_list);
+
+	return 0;
+out:
+	if (!worker_thread_pool)
+		kfree(target->wthread_info);
+	kfree(target);
+	module_put(THIS_MODULE);
+
+	return err;
+}
+
+int target_add(struct target_info *info)
+{
+	int err = -EEXIST;
+	u32 tid = info->tid;
+
+	down(&target_list_sem);
+
+	if (nr_targets > MAX_NR_TARGETS) {
+		err = -EBUSY;
+		goto out;
+	}
+
+	if (__target_lookup_by_name(info->name))
+		goto out;
+
+	if (tid && __target_lookup_by_id(tid))
+		goto out;
+
+	if (!tid) {
+		do {
+			if (!++next_target_id)
+				++next_target_id;
+		} while (__target_lookup_by_id(next_target_id));
+
+		tid = next_target_id;
+	}
+
+	if (!(err = iscsi_target_create(info, tid)))
+		nr_targets++;
+out:
+	up(&target_list_sem);
+
+	return err;
+}
+
+static void target_destroy(struct iscsi_target *target)
+{
+	dprintk(D_SETUP, "%u\n", target->tid);
+
+	target_thread_stop(target);
+
+	while (!list_empty(&target->volumes)) {
+		struct iet_volume *volume;
+		volume = list_entry(target->volumes.next, struct iet_volume, list);
+		volume->l_state = IDEV_DEL;
+		iscsi_volume_destroy(volume);
+	}
+
+	if (!worker_thread_pool)
+		kfree(target->wthread_info);
+	kfree(target);
+
+	module_put(THIS_MODULE);
+}
+
+int target_del(u32 id)
+{
+	struct iscsi_target *target;
+	int err;
+
+	if ((err = down_interruptible(&target_list_sem)) < 0)
+		return err;
+
+	if (!(target = __target_lookup_by_id(id))) {
+		err = -ENOENT;
+		goto out;
+	}
+
+	target_lock(target, 0);
+
+	if (!list_empty(&target->session_list)) {
+		err = -EBUSY;
+		target_unlock(target);
+		goto out;
+	}
+
+	list_del(&target->t_list);
+	nr_targets--;
+
+	target_unlock(target);
+	up(&target_list_sem);
+
+	target_destroy(target);
+	return 0;
+out:
+	up(&target_list_sem);
+	return err;
+}
+
+static void *iet_seq_start(struct seq_file *m, loff_t *pos)
+{
+	int err;
+
+	/* are you sure this is to be interruptible? */
+	err = down_interruptible(&target_list_sem);
+	if (err < 0)
+		return ERR_PTR(err);
+
+	return seq_list_start(&target_list, *pos);
+}
+
+static void *iet_seq_next(struct seq_file *m, void *v, loff_t *pos)
+{
+	return seq_list_next(v, &target_list, pos);
+}
+
+static void iet_seq_stop(struct seq_file *m, void *v)
+{
+	up(&target_list_sem);
+}
+
+static int iet_seq_show(struct seq_file *m, void *p)
+{
+	iet_show_info_t *func = (iet_show_info_t *)m->private;
+	struct iscsi_target *target =
+		list_entry(p, struct iscsi_target, t_list);
+	int err;
+
+	/* relly, interruptible?  I'd think target_lock(target, 0)
+	 * would be more appropriate. --lge */
+	err = target_lock(target, 1);
+	if (err < 0)
+		return err;
+
+	seq_printf(m, "tid:%u name:%s\n", target->tid, target->name);
+
+	func(m, target);
+
+	target_unlock(target);
+
+	return 0;
+}
+
+struct seq_operations iet_seq_op = {
+	.start = iet_seq_start,
+	.next = iet_seq_next,
+	.stop = iet_seq_stop,
+	.show = iet_seq_show,
+};
--- linux-rt-2.6.31.orig/ubuntu/iscsitarget/digest.c
+++ linux-rt-2.6.31/ubuntu/iscsitarget/digest.c
@@ -0,0 +1,279 @@
+/*
+ * iSCSI digest handling.
+ * (C) 2004 - 2006 Xiranet Communications GmbH <arne.redlich@xiranet.com>
+ * This code is licensed under the GPL.
+ */
+
+#include <linux/types.h>
+
+#include "iscsi.h"
+#include "digest.h"
+#include "iscsi_dbg.h"
+
+void digest_alg_available(unsigned int *val)
+{
+	if (*val & DIGEST_CRC32C &&
+	    !crypto_has_alg("crc32c", 0, CRYPTO_ALG_ASYNC)) {
+		printk("CRC32C digest algorithm not available in kernel\n");
+		*val |= ~DIGEST_CRC32C;
+	}
+}
+
+/**
+ * initialize support for digest calculation.
+ *
+ * digest_init -
+ * @conn: ptr to connection to make use of digests
+ *
+ * @return: 0 on success, < 0 on error
+ */
+int digest_init(struct iscsi_conn *conn)
+{
+	int err = 0;
+
+	if (!(conn->hdigest_type & DIGEST_ALL))
+		conn->hdigest_type = DIGEST_NONE;
+
+	if (!(conn->ddigest_type & DIGEST_ALL))
+		conn->ddigest_type = DIGEST_NONE;
+
+	if (conn->hdigest_type & DIGEST_CRC32C ||
+	    conn->ddigest_type & DIGEST_CRC32C) {
+		conn->rx_hash.tfm = crypto_alloc_hash("crc32c", 0,
+						      CRYPTO_ALG_ASYNC);
+		conn->rx_hash.flags = 0;
+		if (IS_ERR(conn->rx_hash.tfm)) {
+			conn->rx_hash.tfm = NULL;
+			err = -ENOMEM;
+			goto out;
+		}
+
+		conn->tx_hash.tfm = crypto_alloc_hash("crc32c", 0,
+						      CRYPTO_ALG_ASYNC);
+		conn->tx_hash.flags = 0;
+		if (IS_ERR(conn->tx_hash.tfm)) {
+			conn->tx_hash.tfm = NULL;
+			err = -ENOMEM;
+			goto out;
+		}
+	}
+
+out:
+	if (err)
+		digest_cleanup(conn);
+
+	return err;
+}
+
+/**
+ * free resources used for digest calculation.
+ *
+ * digest_cleanup -
+ * @conn: ptr to connection that made use of digests
+ */
+void digest_cleanup(struct iscsi_conn *conn)
+{
+	if (conn->tx_hash.tfm)
+		crypto_free_hash(conn->tx_hash.tfm);
+	if (conn->rx_hash.tfm)
+		crypto_free_hash(conn->rx_hash.tfm);
+}
+
+/**
+ * debug handling of header digest errors:
+ * simulates a digest error after n PDUs / every n-th PDU of type
+ * HDIGEST_ERR_CORRUPT_PDU_TYPE.
+ */
+static inline void __dbg_simulate_header_digest_error(struct iscsi_cmnd *cmnd)
+{
+#define HDIGEST_ERR_AFTER_N_CMNDS 1000
+#define HDIGEST_ERR_ONLY_ONCE     1
+#define HDIGEST_ERR_CORRUPT_PDU_TYPE ISCSI_OP_SCSI_CMD
+#define HDIGEST_ERR_CORRUPT_PDU_WITH_DATA_ONLY 0
+
+	static int num_cmnds = 0;
+	static int num_errs = 0;
+
+	if (cmnd_opcode(cmnd) == HDIGEST_ERR_CORRUPT_PDU_TYPE) {
+		if (HDIGEST_ERR_CORRUPT_PDU_WITH_DATA_ONLY) {
+			if (cmnd->pdu.datasize)
+				num_cmnds++;
+		} else
+			num_cmnds++;
+	}
+
+	if ((num_cmnds == HDIGEST_ERR_AFTER_N_CMNDS)
+	    && (!(HDIGEST_ERR_ONLY_ONCE && num_errs))) {
+		printk("*** Faking header digest error ***\n");
+		printk("\tcmnd: 0x%x, itt 0x%x, sn 0x%x\n",
+		       cmnd_opcode(cmnd),
+		       be32_to_cpu(cmnd->pdu.bhs.itt),
+		       be32_to_cpu(cmnd->pdu.bhs.sn));
+		cmnd->hdigest = ~cmnd->hdigest;
+		/* make things even worse by manipulating header fields */
+		cmnd->pdu.datasize += 8;
+		num_errs++;
+		num_cmnds = 0;
+	}
+	return;
+}
+
+/**
+ * debug handling of data digest errors:
+ * simulates a digest error after n PDUs / every n-th PDU of type
+ * DDIGEST_ERR_CORRUPT_PDU_TYPE.
+ */
+static inline void __dbg_simulate_data_digest_error(struct iscsi_cmnd *cmnd)
+{
+#define DDIGEST_ERR_AFTER_N_CMNDS 50
+#define DDIGEST_ERR_ONLY_ONCE     1
+#define DDIGEST_ERR_CORRUPT_PDU_TYPE   ISCSI_OP_SCSI_DATA_OUT
+#define DDIGEST_ERR_CORRUPT_UNSOL_DATA_ONLY 0
+
+	static int num_cmnds = 0;
+	static int num_errs = 0;
+
+	if ((cmnd->pdu.datasize)
+	    && (cmnd_opcode(cmnd) == DDIGEST_ERR_CORRUPT_PDU_TYPE)) {
+		switch (cmnd_opcode(cmnd)) {
+		case ISCSI_OP_SCSI_DATA_OUT:
+			if ((DDIGEST_ERR_CORRUPT_UNSOL_DATA_ONLY)
+			    && (cmnd->pdu.bhs.ttt != ISCSI_RESERVED_TAG))
+				break;
+		default:
+			num_cmnds++;
+		}
+	}
+
+	if ((num_cmnds == DDIGEST_ERR_AFTER_N_CMNDS)
+	    && (!(DDIGEST_ERR_ONLY_ONCE && num_errs))
+	    && (cmnd->pdu.datasize)
+	    && (!cmnd->conn->read_overflow)) {
+		printk("*** Faking data digest error: ***");
+		printk("\tcmnd 0x%x, itt 0x%x, sn 0x%x\n",
+		       cmnd_opcode(cmnd),
+		       be32_to_cpu(cmnd->pdu.bhs.itt),
+		       be32_to_cpu(cmnd->pdu.bhs.sn));
+		cmnd->ddigest = ~cmnd->ddigest;
+		num_errs++;
+		num_cmnds = 0;
+	}
+}
+
+static void digest_header(struct hash_desc *hash, struct iscsi_pdu *pdu,
+			  u8 *crc)
+{
+	struct scatterlist sg[2];
+	unsigned int nbytes = sizeof(struct iscsi_hdr);
+
+	sg_init_table(sg, pdu->ahssize ? 2 : 1);
+
+	sg_set_buf(&sg[0], &pdu->bhs, nbytes);
+	if (pdu->ahssize) {
+		sg_set_buf(&sg[1], pdu->ahs, pdu->ahssize);
+		nbytes += pdu->ahssize;
+	}
+
+	crypto_hash_init(hash);
+	crypto_hash_update(hash, sg, nbytes);
+	crypto_hash_final(hash, crc);
+}
+
+int digest_rx_header(struct iscsi_cmnd *cmnd)
+{
+	u32 crc;
+
+	digest_header(&cmnd->conn->rx_hash, &cmnd->pdu, (u8 *) &crc);
+	if (crc != cmnd->hdigest)
+		return -EIO;
+
+	return 0;
+}
+
+void digest_tx_header(struct iscsi_cmnd *cmnd)
+{
+	digest_header(&cmnd->conn->tx_hash, &cmnd->pdu, (u8 *) &cmnd->hdigest);
+}
+
+static void digest_data(struct hash_desc *hash, struct iscsi_cmnd *cmnd,
+			struct tio *tio, u32 offset, u8 *crc)
+{
+	struct scatterlist *sg = cmnd->conn->hash_sg;
+	u32 size, length;
+	int i, idx, count;
+	unsigned int nbytes;
+
+	size = cmnd->pdu.datasize;
+	nbytes = size = (size + 3) & ~3;
+
+	offset += tio->offset;
+	idx = offset >> PAGE_CACHE_SHIFT;
+	offset &= ~PAGE_CACHE_MASK;
+	count = get_pgcnt(size, offset);
+	assert(idx + count <= tio->pg_cnt);
+
+	assert(count <= ISCSI_CONN_IOV_MAX);
+
+	sg_init_table(sg, ARRAY_SIZE(cmnd->conn->hash_sg));
+	crypto_hash_init(hash);
+
+	for (i = 0; size; i++) {
+		if (offset + size > PAGE_CACHE_SIZE)
+			length = PAGE_CACHE_SIZE - offset;
+		else
+			length = size;
+
+		sg_set_page(&sg[i], tio->pvec[idx + i], length, offset);
+		size -= length;
+		offset = 0;
+	}
+
+	sg_mark_end(&sg[i - 1]);
+
+	crypto_hash_update(hash, sg, nbytes);
+	crypto_hash_final(hash, crc);
+}
+
+int digest_rx_data(struct iscsi_cmnd *cmnd)
+{
+	struct tio *tio;
+	struct iscsi_cmnd *scsi_cmnd;
+	struct iscsi_data_out_hdr *req;
+	u32 offset, crc;
+
+	switch (cmnd_opcode(cmnd)) {
+	case ISCSI_OP_SCSI_REJECT:
+	case ISCSI_OP_PDU_REJECT:
+	case ISCSI_OP_DATA_REJECT:
+		return 0;
+	case ISCSI_OP_SCSI_DATA_OUT:
+		scsi_cmnd = cmnd->req;
+		req = (struct iscsi_data_out_hdr *) &cmnd->pdu.bhs;
+		tio = scsi_cmnd->tio;
+		offset = be32_to_cpu(req->buffer_offset);
+		break;
+	default:
+		tio = cmnd->tio;
+		offset = 0;
+	}
+
+	digest_data(&cmnd->conn->rx_hash, cmnd, tio, offset, (u8 *) &crc);
+
+	if (!cmnd->conn->read_overflow &&
+	    (cmnd_opcode(cmnd) != ISCSI_OP_PDU_REJECT)) {
+		if (crc != cmnd->ddigest)
+			return -EIO;
+	}
+
+	return 0;
+}
+
+void digest_tx_data(struct iscsi_cmnd *cmnd)
+{
+	struct tio *tio = cmnd->tio;
+	struct iscsi_data_out_hdr *req = (struct iscsi_data_out_hdr *)&cmnd->pdu.bhs;
+
+	assert(tio);
+	digest_data(&cmnd->conn->tx_hash, cmnd, tio,
+		    be32_to_cpu(req->buffer_offset), (u8 *) &cmnd->ddigest);
+}
--- linux-rt-2.6.31.orig/ubuntu/iscsitarget/target_disk.c
+++ linux-rt-2.6.31/ubuntu/iscsitarget/target_disk.c
@@ -0,0 +1,495 @@
+/*
+ * (C) 2004 - 2005 FUJITA Tomonori <tomof@acm.org>
+ * This code is licenced under the GPL.
+ *
+ * heavily based on code from kernel/iscsi.c:
+ *   Copyright (C) 2002-2003 Ardis Technolgies <roman@ardistech.com>,
+ *   licensed under the terms of the GNU GPL v2.0,
+ */
+
+#include <linux/ctype.h>
+#include <scsi/scsi.h>
+
+#include "iscsi.h"
+#include "iscsi_dbg.h"
+
+static int insert_disconnect_pg(u8 *ptr)
+{
+	unsigned char disconnect_pg[] = {0x02, 0x0e, 0x80, 0x80, 0x00, 0x0a, 0x00, 0x00,
+                                         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
+
+	memcpy(ptr, disconnect_pg, sizeof(disconnect_pg));
+	return sizeof(disconnect_pg);
+}
+
+static int insert_caching_pg(u8 *ptr, int wcache, int rcache)
+{
+	unsigned char caching_pg[] = {0x08, 0x12, 0x10, 0x00, 0xff, 0xff, 0x00, 0x00,
+				      0xff, 0xff, 0xff, 0xff, 0x80, 0x14, 0x00, 0x00,
+				      0x00, 0x00, 0x00, 0x00};
+
+	memcpy(ptr, caching_pg, sizeof(caching_pg));
+	if (wcache)
+		ptr[2] |= 0x04;	/* set WCE bit if we're caching writes */
+	if (!rcache)
+		ptr[2] |= 0x01; /* Read Cache Disable */
+
+	return sizeof(caching_pg);
+}
+
+static int insert_ctrl_m_pg(u8 *ptr)
+{
+	unsigned char ctrl_m_pg[] = {0x0a, 0x0a, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00,
+				     0x00, 0x00, 0x02, 0x4b};
+
+	memcpy(ptr, ctrl_m_pg, sizeof(ctrl_m_pg));
+	return sizeof(ctrl_m_pg);
+}
+
+static int insert_iec_m_pg(u8 *ptr)
+{
+	unsigned char iec_m_pg[] = {0x1c, 0xa, 0x08, 0x00, 0x00, 0x00, 0x00,
+				    0x00, 0x00, 0x00, 0x00, 0x00};
+
+	memcpy(ptr, iec_m_pg, sizeof(iec_m_pg));
+	return sizeof(iec_m_pg);
+}
+
+static int insert_format_m_pg(u8 *ptr, u32 sector_size)
+{
+	unsigned char format_m_pg[] = {0x03, 0x16, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+				       0x00, 0x00, 0x01, 0x00, 0x02, 0x00, 0x00, 0x00,
+				       0x00, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00};
+
+	memcpy(ptr, format_m_pg, sizeof(format_m_pg));
+	ptr[12] = (sector_size >> 8) & 0xff;
+	ptr[13] = sector_size & 0xff;
+	return sizeof(format_m_pg);
+}
+
+static int insert_geo_m_pg(u8 *ptr, u64 sec)
+{
+	unsigned char geo_m_pg[] = {0x04, 0x16, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00,
+				    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+				    0x00, 0x00, 0x00, 0x00, 0x3a, 0x98, 0x00, 0x00};
+	u32 ncyl;
+	u32 n;
+
+	/* assume 0xff heads, 15krpm. */
+	memcpy(ptr, geo_m_pg, sizeof(geo_m_pg));
+	ncyl = sec >> 14; /* 256 * 64 */
+	memcpy(&n, ptr+1, sizeof(u32));
+	n = n | cpu_to_be32(ncyl);
+	memcpy(ptr+1, &n, sizeof(u32));
+	return sizeof(geo_m_pg);
+}
+
+static int build_mode_sense_response(struct iscsi_cmnd *cmnd)
+{
+	struct iscsi_scsi_cmd_hdr *req = cmnd_hdr(cmnd);
+	struct tio *tio = cmnd->tio;
+	u8 *data, *scb = req->scb;
+	int len = 4, err = 0;
+	u8 pcode;
+
+	/* changeable parameter mode pages are unsupported */
+	if ((scb[2] & 0xc0) >> 6 == 0x1)
+		return -1;
+
+	pcode = req->scb[2] & 0x3f;
+
+	assert(!tio);
+	tio = cmnd->tio = tio_alloc(1);
+	data = page_address(tio->pvec[0]);
+	assert(data);
+	clear_page(data);
+
+	if (LUReadonly(cmnd->lun))
+		data[2] = 0x80;
+
+	if ((scb[1] & 0x8))
+		data[3] = 0;
+	else {
+		data[3] = 8;
+		len += 8;
+		*(u32 *)(data + 4) = (cmnd->lun->blk_cnt >> 32) ?
+			cpu_to_be32(0xffffffff) : cpu_to_be32(cmnd->lun->blk_cnt);
+		*(u32 *)(data + 8) = cpu_to_be32(1 << cmnd->lun->blk_shift);
+	}
+
+	switch (pcode) {
+	case 0x0:
+		break;
+	case 0x2:
+		len += insert_disconnect_pg(data + len);
+		break;
+	case 0x3:
+		len += insert_format_m_pg(data + len, 1 << cmnd->lun->blk_shift);
+		break;
+	case 0x4:
+		len += insert_geo_m_pg(data + len, cmnd->lun->blk_cnt);
+		break;
+	case 0x8:
+		len += insert_caching_pg(data + len, LUWCache(cmnd->lun),
+					 LURCache(cmnd->lun));
+		break;
+	case 0xa:
+		len += insert_ctrl_m_pg(data + len);
+		break;
+	case 0x1c:
+		len += insert_iec_m_pg(data + len);
+		break;
+	case 0x3f:
+		len += insert_disconnect_pg(data + len);
+		len += insert_format_m_pg(data + len, 1 << cmnd->lun->blk_shift);
+		len += insert_geo_m_pg(data + len, cmnd->lun->blk_cnt);
+		len += insert_caching_pg(data + len, LUWCache(cmnd->lun),
+					 LURCache(cmnd->lun));
+		len += insert_ctrl_m_pg(data + len);
+		len += insert_iec_m_pg(data + len);
+		break;
+	default:
+		err = -1;
+	}
+
+	data[0] = len - 1;
+
+	tio_set(tio, len, 0);
+
+	return err;
+}
+
+static int build_inquiry_response(struct iscsi_cmnd *cmnd)
+{
+	struct iscsi_scsi_cmd_hdr *req = cmnd_hdr(cmnd);
+	struct tio *tio = cmnd->tio;
+	u8 *data;
+	u8 *scb = req->scb;
+	int err = -1;
+
+	/*
+	 * - CmdDt and EVPD both set or EVPD and Page Code set: illegal
+	 * - CmdDt set: not supported
+	 */
+	if ((scb[1] & 0x3) > 0x1 || (!(scb[1] & 0x3) && scb[2]))
+		return err;
+
+	assert(!tio);
+	tio = cmnd->tio = tio_alloc(1);
+	data = page_address(tio->pvec[0]);
+	assert(data);
+	clear_page(data);
+
+	if (!(scb[1] & 0x3)) {
+		data[2] = 4;
+		data[3] = 0x52;
+		data[4] = 59;
+		data[7] = 0x02;
+		memset(data + 8, 0x20, 28);
+		memcpy(data + 8,
+		       VENDOR_ID, min_t(size_t, strlen(VENDOR_ID), 8));
+		memcpy(data + 16,
+		       PRODUCT_ID, min_t(size_t, strlen(PRODUCT_ID), 16));
+		memcpy(data + 32,
+		       PRODUCT_REV, min_t(size_t, strlen(PRODUCT_REV), 4));
+		data[58] = 0x03;
+		data[59] = 0x20;
+		data[60] = 0x09;
+		data[61] = 0x60;
+		data[62] = 0x03;
+		data[63] = 0x00;
+		tio_set(tio, 64, 0);
+		err = 0;
+	} else if (scb[1] & 0x1) {
+		/* EVPD bit set */
+		if (scb[2] == 0x0) {
+			data[1] = 0x0;
+			data[3] = 3;
+			data[4] = 0x0;
+			data[5] = 0x80;
+			data[6] = 0x83;
+			tio_set(tio, 7, 0);
+			err = 0;
+		} else if (scb[2] == 0x80) {
+			int len = (cmnd->lun && strlen(cmnd->lun->scsi_sn)) ?
+				SCSI_SN_LEN : 4;
+
+			data[1] = 0x80;
+			data[3] = len;
+			memset(data + 4, 0x20, len);
+			tio_set(tio, len + 4, 0);
+			err = 0;
+
+			if (len == SCSI_SN_LEN) {
+				char *p, *q;
+
+				p = data + 4 + len - 1;
+				q = cmnd->lun->scsi_sn + len - 1;
+
+				for (; len > 0; len--, q--)
+					if (isascii(*q) && isprint(*q))
+						*(p--) = *q;
+			}
+		} else if (scb[2] == 0x83) {
+			u32 len = SCSI_ID_LEN * sizeof(u8);
+
+			data[1] = 0x83;
+			data[3] = len + 4;
+			data[4] = 0x1;
+			data[5] = 0x1;
+			data[7] = len;
+			if (cmnd->lun) /* We need this ? */
+				memcpy(data + 8, cmnd->lun->scsi_id, len);
+			tio_set(tio, len + 8, 0);
+			err = 0;
+		}
+	}
+
+	tio_set(tio, min_t(u8, tio->size, scb[4]), 0);
+	if (!cmnd->lun)
+		data[0] = TYPE_NO_LUN;
+
+	return err;
+}
+
+static int build_report_luns_response(struct iscsi_cmnd *cmnd)
+{
+	struct iscsi_scsi_cmd_hdr *req = cmnd_hdr(cmnd);
+	struct tio *tio = cmnd->tio;
+	u32 *data, size, len;
+	struct iet_volume *lun;
+	int rest, idx = 0;
+
+	size = (u32)req->scb[6] << 24 | (u32)req->scb[7] << 16 |
+		(u32)req->scb[8] << 8 | (u32)req->scb[9];
+	if (size < 16)
+		return -1;
+
+	len = atomic_read(&cmnd->conn->session->target->nr_volumes) * 8;
+	size = min(size & ~(8 - 1), len + 8);
+
+	assert(!tio);
+	tio = cmnd->tio = tio_alloc(get_pgcnt(size, 0));
+	tio_set(tio, size, 0);
+
+	data = page_address(tio->pvec[idx]);
+	assert(data);
+	*data++ = cpu_to_be32(len);
+	*data++ = 0;
+	size -= 8;
+	rest = PAGE_CACHE_SIZE - 8;
+	list_for_each_entry(lun, &cmnd->conn->session->target->volumes, list) {
+		if (lun->l_state != IDEV_RUNNING)
+			continue;
+
+		*data++ = cpu_to_be32((0x3ff & lun->lun) << 16 |
+				      ((lun->lun > 0xff) ? (0x1 << 30) : 0));
+		*data++ = 0;
+		if ((size -= 8) == 0)
+			break;
+		if ((rest -= 8) == 0) {
+			idx++;
+			data = page_address(tio->pvec[idx]);
+			rest = PAGE_CACHE_SIZE;
+		}
+	}
+
+	return 0;
+}
+
+static int build_read_capacity_response(struct iscsi_cmnd *cmnd)
+{
+	struct tio *tio = cmnd->tio;
+	u32 *data;
+
+	assert(!tio);
+	tio = cmnd->tio = tio_alloc(1);
+	data = page_address(tio->pvec[0]);
+	assert(data);
+	clear_page(data);
+
+	data[0] = (cmnd->lun->blk_cnt >> 32) ?
+		cpu_to_be32(0xffffffff) : cpu_to_be32(cmnd->lun->blk_cnt - 1);
+	data[1] = cpu_to_be32(1U << cmnd->lun->blk_shift);
+
+	tio_set(tio, 8, 0);
+	return 0;
+}
+
+static int build_request_sense_response(struct iscsi_cmnd *cmnd)
+{
+	struct tio *tio = cmnd->tio;
+	u8 *data;
+
+	assert(!tio);
+	tio = cmnd->tio = tio_alloc(1);
+	data = page_address(tio->pvec[0]);
+	assert(data);
+	memset(data, 0, 18);
+	data[0] = 0xf0;
+	data[1] = 0;
+	data[2] = NO_SENSE;
+	data[7] = 10;
+	tio_set(tio, 18, 0);
+
+	return 0;
+}
+
+static int build_service_action_in_response(struct iscsi_cmnd *cmnd)
+{
+	struct tio *tio = cmnd->tio;
+	u32 *data;
+	u64 *data64;
+
+	assert(!tio);
+
+	/* only READ_CAPACITY_16 service action is currently supported */
+	if ((cmnd_hdr(cmnd)->scb[1] & 0x1F) != 0x10)
+		return -1;
+
+	tio = cmnd->tio = tio_alloc(1);
+	data = page_address(tio->pvec[0]);
+	assert(data);
+	clear_page(data);
+	data64 = (u64*) data;
+	data64[0] = cpu_to_be64(cmnd->lun->blk_cnt - 1);
+	data[2] = cpu_to_be32(1UL << cmnd->lun->blk_shift);
+
+	tio_set(tio, 12, 0);
+	return 0;
+}
+
+static int build_read_response(struct iscsi_cmnd *cmnd)
+{
+	struct tio *tio = cmnd->tio;
+
+	assert(tio);
+	assert(cmnd->lun);
+
+	return tio_read(cmnd->lun, tio);
+}
+
+static int build_write_response(struct iscsi_cmnd *cmnd)
+{
+	int err;
+	struct tio *tio = cmnd->tio;
+
+	assert(tio);
+	assert(cmnd->lun);
+
+	list_del_init(&cmnd->list);
+	err = tio_write(cmnd->lun, tio);
+	if (!err && !LUWCache(cmnd->lun))
+		err = tio_sync(cmnd->lun, tio);
+
+	return err;
+}
+
+static int build_sync_cache_response(struct iscsi_cmnd *cmnd)
+{
+	assert(cmnd->lun);
+	return tio_sync(cmnd->lun, NULL);
+}
+
+static int build_generic_response(struct iscsi_cmnd *cmnd)
+{
+	return 0;
+}
+
+static int build_reserve_response(struct iscsi_cmnd *cmnd)
+{
+	return volume_reserve(cmnd->lun, cmnd->conn->session->sid);
+}
+
+static int build_release_response(struct iscsi_cmnd *cmnd)
+{
+	return volume_release(cmnd->lun,
+			      cmnd->conn->session->sid, 0);
+}
+
+static int build_reservation_conflict_response(struct iscsi_cmnd *cmnd)
+{
+	return -EBUSY;
+}
+
+static int disk_execute_cmnd(struct iscsi_cmnd *cmnd)
+{
+	struct iscsi_scsi_cmd_hdr *req = cmnd_hdr(cmnd);
+
+	req->opcode &= ISCSI_OPCODE_MASK;
+
+	if (is_volume_reserved(cmnd->lun,
+			       cmnd->conn->session->sid)) {
+		switch (req->scb[0]) {
+		case INQUIRY:
+		case RELEASE:
+		case REPORT_LUNS:
+		case REQUEST_SENSE:
+			/* allowed commands when reserved */
+			break;
+		default:
+			/* return reservation conflict for all others */
+			send_scsi_rsp(cmnd,
+				      build_reservation_conflict_response);
+			return 0;
+		}
+	}
+
+	switch (req->scb[0]) {
+	case INQUIRY:
+		send_data_rsp(cmnd, build_inquiry_response);
+		break;
+	case REPORT_LUNS:
+		send_data_rsp(cmnd, build_report_luns_response);
+		break;
+	case READ_CAPACITY:
+		send_data_rsp(cmnd, build_read_capacity_response);
+		break;
+	case MODE_SENSE:
+		send_data_rsp(cmnd, build_mode_sense_response);
+		break;
+	case REQUEST_SENSE:
+		send_data_rsp(cmnd, build_request_sense_response);
+		break;
+	case SERVICE_ACTION_IN:
+		send_data_rsp(cmnd, build_service_action_in_response);
+		break;
+	case READ_6:
+	case READ_10:
+	case READ_16:
+		send_data_rsp(cmnd, build_read_response);
+		break;
+	case WRITE_6:
+	case WRITE_10:
+	case WRITE_16:
+	case WRITE_VERIFY:
+		send_scsi_rsp(cmnd, build_write_response);
+		break;
+	case SYNCHRONIZE_CACHE:
+		send_scsi_rsp(cmnd, build_sync_cache_response);
+		break;
+	case RESERVE:
+		send_scsi_rsp(cmnd, build_reserve_response);
+		break;
+	case RELEASE:
+		send_scsi_rsp(cmnd, build_release_response);
+		break;
+	case START_STOP:
+	case TEST_UNIT_READY:
+	case VERIFY:
+	case VERIFY_16:
+		send_scsi_rsp(cmnd, build_generic_response);
+		break;
+	default:
+		eprintk("%s\n", "we should not come here!");
+		break;
+	}
+
+	return 0;
+}
+
+struct target_type disk_ops =
+{
+	.id = 0,
+	.execute_cmnd = disk_execute_cmnd,
+};
--- linux-rt-2.6.31.orig/ubuntu/iscsitarget/tio.c
+++ linux-rt-2.6.31/ubuntu/iscsitarget/tio.c
@@ -0,0 +1,121 @@
+/*
+ * Target I/O.
+ * (C) 2005 FUJITA Tomonori <tomof@acm.org>
+ * This code is licenced under the GPL.
+ */
+
+#include "iscsi.h"
+#include "iscsi_dbg.h"
+#include "iotype.h"
+
+static int tio_add_pages(struct tio *tio, int count)
+{
+	int i;
+	struct page *page;
+
+	dprintk(D_GENERIC, "%p %d (%d)\n", tio, count, tio->pg_cnt);
+
+	tio->pg_cnt = count;
+
+	count *= sizeof(struct page *);
+
+	do {
+		tio->pvec = kzalloc(count, GFP_KERNEL);
+		if (!tio->pvec)
+			yield();
+	} while (!tio->pvec);
+
+	for (i = 0; i < tio->pg_cnt; i++) {
+		do {
+			if (!(page = alloc_page(GFP_KERNEL)))
+				yield();
+		} while (!page);
+		tio->pvec[i] = page;
+	}
+	return 0;
+}
+
+static struct kmem_cache *tio_cache;
+
+struct tio *tio_alloc(int count)
+{
+	struct tio *tio;
+
+	tio = kmem_cache_alloc(tio_cache, GFP_KERNEL | __GFP_NOFAIL);
+
+	tio->pg_cnt = 0;
+	tio->idx = 0;
+	tio->offset = 0;
+	tio->size = 0;
+	tio->pvec = NULL;
+
+	atomic_set(&tio->count, 1);
+
+	if (count)
+		tio_add_pages(tio, count);
+
+	return tio;
+}
+
+static void tio_free(struct tio *tio)
+{
+	int i;
+	for (i = 0; i < tio->pg_cnt; i++) {
+		assert(tio->pvec[i]);
+		__free_page(tio->pvec[i]);
+	}
+	kfree(tio->pvec);
+	kmem_cache_free(tio_cache, tio);
+}
+
+void tio_put(struct tio *tio)
+{
+	assert(atomic_read(&tio->count));
+	if (atomic_dec_and_test(&tio->count))
+		tio_free(tio);
+}
+
+void tio_get(struct tio *tio)
+{
+	atomic_inc(&tio->count);
+}
+
+void tio_set(struct tio *tio, u32 size, loff_t offset)
+{
+	tio->idx = offset >> PAGE_CACHE_SHIFT;
+	tio->offset = offset & ~PAGE_CACHE_MASK;
+	tio->size = size;
+}
+
+int tio_read(struct iet_volume *lu, struct tio *tio)
+{
+	struct iotype *iot = lu->iotype;
+	assert(iot);
+	return iot->make_request ? iot->make_request(lu, tio, READ) : 0;
+}
+
+int tio_write(struct iet_volume *lu, struct tio *tio)
+{
+	struct iotype *iot = lu->iotype;
+	assert(iot);
+	return iot->make_request ? iot->make_request(lu, tio, WRITE) : 0;
+}
+
+int tio_sync(struct iet_volume *lu, struct tio *tio)
+{
+	struct iotype *iot = lu->iotype;
+	assert(iot);
+	return iot->sync ? iot->sync(lu, tio) : 0;
+}
+
+int tio_init(void)
+{
+	tio_cache = KMEM_CACHE(tio, 0);
+	return  tio_cache ? 0 : -ENOMEM;
+}
+
+void tio_exit(void)
+{
+	if (tio_cache)
+		kmem_cache_destroy(tio_cache);
+}
--- linux-rt-2.6.31.orig/ubuntu/iscsitarget/volume.c
+++ linux-rt-2.6.31/ubuntu/iscsitarget/volume.c
@@ -0,0 +1,264 @@
+/*
+ * Volume manager
+ * (C) 2004 - 2005 FUJITA Tomonori <tomof@acm.org>
+ * This code is licenced under the GPL.
+ */
+
+#include <linux/types.h>
+#include <linux/parser.h>
+
+#include "iscsi.h"
+#include "iscsi_dbg.h"
+#include "iotype.h"
+
+struct iet_volume *volume_lookup(struct iscsi_target *target, u32 lun)
+{
+	struct iet_volume *volume;
+
+	list_for_each_entry(volume, &target->volumes, list) {
+		if (volume->lun == lun)
+			return volume;
+	}
+	return NULL;
+}
+
+enum {
+	Opt_type,
+	Opt_iomode,
+	Opt_err,
+};
+
+static match_table_t tokens = {
+	{Opt_type, "Type=%s"},
+	{Opt_iomode, "IOMode=%s"},
+	{Opt_err, NULL},
+};
+
+static int set_iotype(struct iet_volume *volume, char *params)
+{
+	int err = 0;
+	substring_t args[MAX_OPT_ARGS];
+	char *p, *argp = NULL, *buf = (char *) get_zeroed_page(GFP_USER);
+
+	if (!buf)
+		return -ENOMEM;
+	strncpy(buf, params, PAGE_CACHE_SIZE);
+
+	while ((p = strsep(&buf, ",")) != NULL) {
+		int token;
+
+		if (!*p)
+			continue;
+		token = match_token(p, tokens, args);
+		switch (token) {
+		case Opt_type:
+			if (!(argp = match_strdup(&args[0])))
+				err = -ENOMEM;
+			if (argp && !(volume->iotype = get_iotype(argp)))
+				err = -ENOENT;
+			kfree(argp);
+			break;
+		case Opt_iomode:
+			if (!(argp = match_strdup(&args[0])))
+				err = -ENOMEM;
+			if (argp && !strcmp(argp, "ro"))
+				SetLUReadonly(volume);
+			else if (argp && !strcmp(argp, "wb"))
+				SetLUWCache(volume);
+			kfree(argp);
+			break;
+		default:
+			break;
+		}
+	}
+
+	if (!err && !volume->iotype && !(volume->iotype = get_iotype("fileio"))) {
+		eprintk("%s\n", "Cannot find fileio");
+		err = -EINVAL;
+	}
+
+	free_page((unsigned long) buf);
+
+	return err;
+}
+
+int volume_add(struct iscsi_target *target, struct volume_info *info)
+{
+	int ret;
+	struct iet_volume *volume;
+	char *args;
+
+	volume = volume_lookup(target, info->lun);
+	if (volume)
+		return -EEXIST;
+
+	if (info->lun > 0x3fff)
+		return -EINVAL;
+
+	volume = kzalloc(sizeof(*volume), GFP_KERNEL);
+	if (!volume)
+		return -ENOMEM;
+
+	volume->target = target;
+	volume->lun = info->lun;
+
+	args = kzalloc(info->args_len + 1, GFP_KERNEL);
+	if (!args) {
+		ret = -ENOMEM;
+		goto free_volume;
+	}
+
+	ret = copy_from_user(args, (void *)(unsigned long)info->args_ptr,
+			     info->args_len);
+	if (ret) {
+		ret = -EFAULT;
+		goto free_args;
+	}
+
+	ret = set_iotype(volume, args);
+	if (ret < 0)
+		goto free_args;
+
+	ret = volume->iotype->attach(volume, args);
+	if (ret < 0)
+		goto free_args;
+
+	INIT_LIST_HEAD(&volume->queue.wait_list);
+	spin_lock_init(&volume->queue.queue_lock);
+	spin_lock_init(&volume->reserve_lock);
+
+	volume->l_state = IDEV_RUNNING;
+	atomic_set(&volume->l_count, 0);
+
+	list_add_tail(&volume->list, &target->volumes);
+	atomic_inc(&target->nr_volumes);
+
+	kfree(args);
+
+	return 0;
+free_args:
+	kfree(args);
+free_volume:
+	put_iotype(volume->iotype);
+	kfree(volume);
+
+	return ret;
+}
+
+void iscsi_volume_destroy(struct iet_volume *volume)
+{
+	assert(volume->l_state == IDEV_DEL);
+	assert(!atomic_read(&volume->l_count));
+
+	volume->iotype->detach(volume);
+	put_iotype(volume->iotype);
+	list_del(&volume->list);
+	kfree(volume);
+}
+
+int iscsi_volume_del(struct iscsi_target *target, struct volume_info *info)
+{
+	struct iet_volume *volume;
+
+	eprintk("%x %x\n", target->tid, info->lun);
+	if (!(volume = volume_lookup(target, info->lun)))
+		return -ENOENT;
+
+	volume->l_state = IDEV_DEL;
+	atomic_dec(&target->nr_volumes);
+	if (!atomic_read(&volume->l_count))
+		iscsi_volume_destroy(volume);
+
+	return 0;
+}
+
+struct iet_volume *volume_get(struct iscsi_target *target, u32 lun)
+{
+	struct iet_volume *volume;
+
+	if ((volume = volume_lookup(target, lun))) {
+		if (volume->l_state == IDEV_RUNNING)
+			atomic_inc(&volume->l_count);
+		else
+			volume = NULL;
+	}
+	return volume;
+}
+
+void volume_put(struct iet_volume *volume)
+{
+	if (atomic_dec_and_test(&volume->l_count) && volume->l_state == IDEV_DEL)
+		iscsi_volume_destroy(volume);
+}
+
+int volume_reserve(struct iet_volume *volume, u64 sid)
+{
+	if (!volume)
+		return -ENOENT;
+
+	spin_lock(&volume->reserve_lock);
+	if (volume->reserve_sid && volume->reserve_sid != sid) {
+		spin_unlock(&volume->reserve_lock);
+		return -EBUSY;
+	}
+
+	volume->reserve_sid = sid;
+	spin_unlock(&volume->reserve_lock);
+
+	return 0;
+}
+
+int is_volume_reserved(struct iet_volume *volume, u64 sid)
+{
+	if (!volume || !volume->reserve_sid || volume->reserve_sid == sid)
+		return 0;
+
+	return -EBUSY;
+}
+
+int volume_release(struct iet_volume *volume, u64 sid, int force)
+{
+	if (force || volume->reserve_sid == sid)
+		volume->reserve_sid = 0;
+
+	return 0;
+}
+
+static void iet_volume_info_show(struct seq_file *seq, struct iscsi_target *target)
+{
+	struct iet_volume *volume;
+
+	list_for_each_entry(volume, &target->volumes, list) {
+		seq_printf(seq, "\tlun:%u state:%x iotype:%s",
+			   volume->lun, volume->l_state, volume->iotype->name);
+		if (LUReadonly(volume))
+			seq_printf(seq, " iomode:ro");
+		else if (LUWCache(volume))
+			seq_printf(seq, " iomode:wb");
+		else
+			seq_printf(seq, " iomode:wt");
+
+		if (volume->iotype->show)
+			volume->iotype->show(volume, seq);
+		else
+			seq_printf(seq, "\n");
+	}
+}
+
+static int iet_volume_seq_open(struct inode *inode, struct file *file)
+{
+	int res;
+	res = seq_open(file, &iet_seq_op);
+	if (!res)
+		((struct seq_file *)file->private_data)->private =
+			iet_volume_info_show;
+	return res;
+}
+
+struct file_operations volume_seq_fops = {
+	.owner		= THIS_MODULE,
+	.open		= iet_volume_seq_open,
+	.read		= seq_read,
+	.llseek		= seq_lseek,
+	.release	= seq_release,
+};
--- linux-rt-2.6.31.orig/ubuntu/iscsitarget/file-io.c
+++ linux-rt-2.6.31/ubuntu/iscsitarget/file-io.c
@@ -0,0 +1,324 @@
+/*
+ * Target device file I/O.
+ * (C) 2004 - 2005 FUJITA Tomonori <tomof@acm.org>
+ * This code is licenced under the GPL.
+ */
+
+#include <linux/types.h>
+#include <linux/blkdev.h>
+#include <linux/parser.h>
+#include <linux/writeback.h>
+
+#include "iscsi.h"
+#include "iscsi_dbg.h"
+#include "iotype.h"
+
+struct fileio_data {
+	char *path;
+	struct file *filp;
+};
+
+static int fileio_make_request(struct iet_volume *lu, struct tio *tio, int rw)
+{
+	struct fileio_data *p = lu->private;
+	struct file *filp;
+	mm_segment_t oldfs;
+	struct page *page;
+	u32 offset, size;
+	loff_t ppos, count;
+	char *buf;
+	int i, err = 0;
+	ssize_t ret;
+
+	assert(p);
+	filp = p->filp;
+	size = tio->size;
+	offset= tio->offset;
+
+	ppos = (loff_t) tio->idx << PAGE_CACHE_SHIFT;
+	ppos += offset;
+
+	for (i = 0; i < tio->pg_cnt; i++) {
+		page = tio->pvec[i];
+		assert(page);
+		buf = page_address(page);
+		buf += offset;
+
+		if (offset + size > PAGE_CACHE_SIZE)
+			count = PAGE_CACHE_SIZE - offset;
+		else
+			count = size;
+
+		oldfs = get_fs();
+		set_fs(get_ds());
+
+		if (rw == READ)
+			ret = do_sync_read(filp, buf, count, &ppos);
+		else
+			ret = do_sync_write(filp, buf, count, &ppos);
+
+		set_fs(oldfs);
+
+		if (ret != count) {
+			eprintk("I/O error %lld, %ld\n", count, (long) ret);
+			err = -EIO;
+		}
+
+		size -= count;
+		offset = 0;
+	}
+	assert(!size);
+
+	return err;
+}
+
+static int fileio_sync(struct iet_volume *lu, struct tio *tio)
+{
+	struct fileio_data *p = lu->private;
+	struct inode *inode = p->filp->f_dentry->d_inode;
+	struct address_space *mapping = inode->i_mapping;
+	loff_t ppos, count;
+	int res;
+
+	if (tio) {
+		ppos = (loff_t) tio->idx << PAGE_CACHE_SHIFT;
+		count = tio->size;
+	} else {
+		ppos = 0;
+		count = lu->blk_cnt << lu->blk_shift;
+	}
+
+	res = sync_page_range(inode, mapping, ppos, count);
+	if (res) {
+		eprintk("I/O error: syncing pages failed: %d\n", res);
+		return -EIO;
+	} else
+		return 0;
+}
+
+static int open_path(struct iet_volume *volume, const char *path)
+{
+	int err = 0;
+	struct fileio_data *info = volume->private;
+	struct file *filp;
+	mm_segment_t oldfs;
+	int flags;
+
+	info->path = kstrdup(path, GFP_KERNEL);
+	if (!info->path)
+		return -ENOMEM;
+
+	oldfs = get_fs();
+	set_fs(get_ds());
+	flags = (LUReadonly(volume) ? O_RDONLY : O_RDWR) | O_LARGEFILE;
+	filp = filp_open(path, flags, 0);
+	set_fs(oldfs);
+
+	if (IS_ERR(filp)) {
+		err = PTR_ERR(filp);
+		eprintk("Can't open %s %d\n", path, err);
+		info->filp = NULL;
+	} else
+		info->filp = filp;
+
+	return err;
+}
+
+static int set_scsiid(struct iet_volume *volume, const char *id)
+{
+	size_t len;
+
+	if ((len = strlen(id)) > SCSI_ID_LEN - VENDOR_ID_LEN) {
+		eprintk("SCSI ID too long, %zd provided, %u max\n", len,
+			SCSI_ID_LEN - VENDOR_ID_LEN);
+		return -EINVAL;
+	}
+
+	memcpy(volume->scsi_id + VENDOR_ID_LEN, id, len);
+
+	return 0;
+}
+
+static void gen_scsiid(struct iet_volume *volume, struct inode *inode)
+{
+	int i;
+	u32 *p;
+
+	strlcpy(volume->scsi_id, VENDOR_ID, VENDOR_ID_LEN);
+
+	for (i = VENDOR_ID_LEN; i < SCSI_ID_LEN; i++)
+		if (volume->scsi_id[i])
+			return;
+
+	p = (u32 *) (volume->scsi_id + VENDOR_ID_LEN);
+	*(p + 0) = volume->target->trgt_param.target_type;
+	*(p + 1) = volume->target->tid;
+	*(p + 2) = (unsigned int) inode->i_ino;
+	*(p + 3) = (unsigned int) inode->i_sb->s_dev;
+}
+
+static int set_scsisn(struct iet_volume *volume, const char *sn)
+{
+	size_t len;
+
+	if ((len = strlen(sn)) > SCSI_SN_LEN) {
+		eprintk("SCSI SN too long, %zd provided, %u max\n", len,
+			SCSI_SN_LEN);
+		return -EINVAL;
+	}
+	memcpy(volume->scsi_sn, sn, len);
+	return 0;
+}
+
+enum {
+	Opt_scsiid, Opt_scsisn, Opt_path, Opt_ignore, Opt_err,
+};
+
+static match_table_t tokens = {
+	{Opt_scsiid, "ScsiId=%s"},
+	{Opt_scsisn, "ScsiSN=%s"},
+	{Opt_path, "Path=%s"},
+	{Opt_ignore, "Type=%s"},
+	{Opt_ignore, "IOMode=%s"},
+	{Opt_err, NULL},
+};
+
+static int parse_fileio_params(struct iet_volume *volume, char *params)
+{
+	struct fileio_data *info = volume->private;
+	int err = 0;
+	char *p, *q;
+
+	while ((p = strsep(&params, ",")) != NULL) {
+		substring_t args[MAX_OPT_ARGS];
+		int token;
+		if (!*p)
+			continue;
+		token = match_token(p, tokens, args);
+		switch (token) {
+		case Opt_scsiid:
+			if (!(q = match_strdup(&args[0]))) {
+				err = -ENOMEM;
+				goto out;
+			}
+			err = set_scsiid(volume, q);
+			kfree(q);
+			if (err < 0)
+				goto out;
+			break;
+		case Opt_scsisn:
+			if (!(q = match_strdup(&args[0]))) {
+				err = -ENOMEM;
+				goto out;
+			}
+			err = set_scsisn(volume, q);
+			kfree(q);
+			if (err < 0)
+				goto out;
+			break;
+		case Opt_path:
+			if (info->path) {
+				iprintk("Target %s, LUN %u: "
+					"duplicate \"Path\" param\n",
+					volume->target->name, volume->lun);
+				err = -EINVAL;
+				goto out;
+			}
+			if (!(q = match_strdup(&args[0]))) {
+				err = -ENOMEM;
+				goto out;
+			}
+			err = open_path(volume, q);
+			kfree(q);
+			if (err < 0)
+				goto out;
+			break;
+		case Opt_ignore:
+			break;
+		default:
+			iprintk("Target %s, LUN %u: unknown param %s\n",
+				volume->target->name, volume->lun, p);
+			return -EINVAL;
+		}
+	}
+
+	if (!info->path) {
+		iprintk("Target %s, LUN %u: missing \"Path\" param\n",
+			volume->target->name, volume->lun);
+		err = -EINVAL;
+	}
+out:
+	return err;
+}
+
+static void fileio_detach(struct iet_volume *lu)
+{
+	struct fileio_data *p = lu->private;
+
+	kfree(p->path);
+	if (p->filp)
+		filp_close(p->filp, NULL);
+	kfree(p);
+	lu->private = NULL;
+}
+
+static int fileio_attach(struct iet_volume *lu, char *args)
+{
+	int err = 0;
+	struct fileio_data *p;
+	struct inode *inode;
+
+	if (lu->private) {
+		printk("already attached ? %d\n", lu->lun);
+		return -EBUSY;
+	}
+
+	p = kzalloc(sizeof(*p), GFP_KERNEL);
+	if (!p)
+		return -ENOMEM;
+
+	lu->private = p;
+
+	if ((err = parse_fileio_params(lu, args)) < 0) {
+		eprintk("%d\n", err);
+		goto out;
+	}
+	inode = p->filp->f_dentry->d_inode;
+
+	gen_scsiid(lu, inode);
+
+	if (S_ISREG(inode->i_mode))
+		;
+	else if (S_ISBLK(inode->i_mode))
+		inode = inode->i_bdev->bd_inode;
+	else {
+		err = -EINVAL;
+		goto out;
+	}
+
+	lu->blk_shift = SECTOR_SIZE_BITS;
+	lu->blk_cnt = inode->i_size >> lu->blk_shift;
+
+	/* we're using the page cache */
+	SetLURCache(lu);
+out:
+	if (err < 0)
+		fileio_detach(lu);
+	return err;
+}
+
+static void fileio_show(struct iet_volume *lu, struct seq_file *seq)
+{
+	struct fileio_data *p = lu->private;
+	seq_printf(seq, " path:%s\n", p->path);
+}
+
+struct iotype fileio =
+{
+	.name = "fileio",
+	.attach = fileio_attach,
+	.make_request = fileio_make_request,
+	.sync = fileio_sync,
+	.detach = fileio_detach,
+	.show = fileio_show,
+};
--- linux-rt-2.6.31.orig/ubuntu/iscsitarget/null-io.c
+++ linux-rt-2.6.31/ubuntu/iscsitarget/null-io.c
@@ -0,0 +1,114 @@
+/*
+ * Target device null I/O.
+ * (C) 2005 MING Zhang <mingz@ele.uri.edu>
+ * This code is licenced under the GPL.
+ *
+ * The nullio mode will not return any meaningful or previous written
+ * data. It is only for performance measurement purpose.
+ */
+
+#include <linux/types.h>
+#include <linux/blkdev.h>
+#include <linux/parser.h>
+#include <linux/writeback.h>
+
+#include "iscsi.h"
+#include "iscsi_dbg.h"
+#include "iotype.h"
+
+struct nullio_data {
+	u64 sectors;
+};
+
+enum {
+	Opt_sectors, Opt_ignore, Opt_err,
+};
+
+static match_table_t tokens = {
+	{Opt_sectors, "Sectors=%u"},
+	{Opt_ignore, "Type=%s"},
+	{Opt_err, NULL},
+};
+
+static int parse_nullio_params(struct iet_volume *volume, char *params)
+{
+	int err = 0;
+	char *p, *q;
+	struct nullio_data *data = volume->private;
+
+	while ((p = strsep(&params, ",")) != NULL) {
+		substring_t args[MAX_OPT_ARGS];
+		int token;
+		if (!*p)
+			continue;
+		token = match_token(p, tokens, args);
+		switch (token) {
+		case Opt_sectors:
+			q = match_strdup(&args[0]);
+			if (!q)
+				return -ENOMEM;
+			data->sectors = simple_strtoull(q, NULL, 10);
+			kfree(q);
+			break;
+		case Opt_ignore:
+			break;
+		default:
+			eprintk("Unknown %s\n", p);
+			return -EINVAL;
+			break;
+		}
+	}
+	return err;
+}
+
+static void nullio_detach(struct iet_volume *lu)
+{
+	struct nullio_data *p = lu->private;
+
+	kfree(p);
+	lu->private = NULL;
+}
+
+static int nullio_attach(struct iet_volume *lu, char *args)
+{
+	int err = 0;
+	struct nullio_data *p;
+
+	if (lu->private) {
+		printk("already attached ? %d\n", lu->lun);
+		return -EBUSY;
+	}
+
+	p = kzalloc(sizeof(*p), GFP_KERNEL);
+	if (!p)
+		return -ENOMEM;
+
+	lu->private = p;
+
+	if ((err = parse_nullio_params(lu, args)) < 0) {
+		eprintk("%d\n", err);
+		goto out;
+	}
+
+	lu->blk_shift = SECTOR_SIZE_BITS;
+	lu->blk_cnt = (p->sectors = p->sectors ? : 1 << 27); /* 64 GB */
+
+out:
+	if (err < 0)
+		nullio_detach(lu);
+	return err;
+}
+
+void nullio_show(struct iet_volume *lu, struct seq_file *seq)
+{
+	struct nullio_data *p = lu->private;
+	seq_printf(seq, " sectors:%llu\n", p->sectors);
+}
+
+struct iotype nullio =
+{
+	.name = "nullio",
+	.attach = nullio_attach,
+	.detach = nullio_detach,
+	.show = nullio_show,
+};
--- linux-rt-2.6.31.orig/ubuntu/iscsitarget/wthread.c
+++ linux-rt-2.6.31/ubuntu/iscsitarget/wthread.c
@@ -0,0 +1,222 @@
+/*
+ * Worker thread.
+ * (C) 2004 - 2005 FUJITA Tomonori <tomof@acm.org>
+ * This code is licenced under the GPL.
+ */
+
+#include <linux/kthread.h>
+
+#include "iscsi.h"
+#include "iscsi_dbg.h"
+
+struct worker_thread_info *worker_thread_pool;
+
+void wthread_queue(struct iscsi_cmnd *cmnd)
+{
+	struct worker_thread_info *info = cmnd->conn->session->target->wthread_info;
+
+	if (!list_empty(&cmnd->list)) {
+		struct iscsi_scsi_cmd_hdr *req = cmnd_hdr(cmnd);
+		eprintk("%x %p %x %x %x %x %lx %x\n",
+			cmnd_itt(cmnd), req, req->opcode, req->scb[0], cmnd->pdu.datasize,
+			be32_to_cpu(req->data_length), cmnd->flags, req->flags);
+
+		if (cmnd->lun)
+			eprintk("%u\n", cmnd->lun->lun);
+		assert(list_empty(&cmnd->list));
+	}
+
+	spin_lock(&info->wthread_lock);
+	list_add_tail(&cmnd->list, &info->work_queue);
+	spin_unlock(&info->wthread_lock);
+
+	atomic_inc(&cmnd->conn->nr_busy_cmnds);
+
+	wake_up(&info->wthread_sleep);
+}
+
+static struct iscsi_cmnd * get_ready_cmnd(struct worker_thread_info *info)
+{
+	struct iscsi_cmnd *cmnd = NULL;
+
+	spin_lock(&info->wthread_lock);
+	if (!list_empty(&info->work_queue)) {
+		cmnd = list_entry(info->work_queue.next, struct iscsi_cmnd, list);
+		list_del_init(&cmnd->list);
+
+		assert(cmnd->conn);
+	}
+	spin_unlock(&info->wthread_lock);
+
+	return cmnd;
+}
+
+static int cmnd_execute(struct iscsi_cmnd *cmnd)
+{
+	int type = cmnd->conn->session->target->trgt_param.target_type;
+
+	assert(target_type_array[type]->execute_cmnd);
+	return target_type_array[type]->execute_cmnd(cmnd);
+}
+
+static int worker_thread(void *arg)
+{
+	struct worker_thread *wt = (struct worker_thread *) arg;
+	struct worker_thread_info *info = wt->w_info;
+	struct iscsi_cmnd *cmnd;
+	struct iscsi_conn *conn;
+	DECLARE_WAITQUEUE(wait, current);
+
+	add_wait_queue(&info->wthread_sleep, &wait);
+
+	__set_current_state(TASK_RUNNING);
+	do {
+		while (!list_empty(&info->work_queue) &&
+		       (cmnd = get_ready_cmnd(info))) {
+			conn = cmnd->conn;
+			cmnd_execute(cmnd);
+			assert(conn);
+			atomic_dec(&conn->nr_busy_cmnds);
+		}
+
+		__set_current_state(TASK_INTERRUPTIBLE);
+		if (list_empty(&info->work_queue))
+			schedule();
+
+		__set_current_state(TASK_RUNNING);
+	} while (!kthread_should_stop());
+
+	remove_wait_queue(&info->wthread_sleep, &wait);
+
+	return 0;
+}
+
+static int start_one_worker_thread(struct worker_thread_info *info, u32 tid)
+{
+	struct worker_thread *wt;
+	struct task_struct *task;
+
+	if (!(wt = kmalloc(sizeof(struct worker_thread), GFP_KERNEL)))
+		return -ENOMEM;
+
+	wt->w_info = info;
+	task = kthread_create(worker_thread, wt, "istiod%d", tid);
+	if (IS_ERR(task)) {
+		kfree(wt);
+		return PTR_ERR(task);
+	}
+
+	wt->w_task = task;
+	list_add(&wt->w_list, &info->wthread_list);
+	info->nr_running_wthreads++;
+
+	wake_up_process(task);
+
+	return 0;
+}
+
+static int stop_one_worker_thread(struct worker_thread *wt)
+{
+	struct worker_thread_info *info = wt->w_info;
+	int err;
+
+	assert(wt->w_task);
+	err = kthread_stop(wt->w_task);
+
+	if (err < 0 && err != -EINTR)
+		return err;
+
+	list_del(&wt->w_list);
+	kfree(wt);
+	info->nr_running_wthreads--;
+
+	return 0;
+}
+
+int wthread_init(struct worker_thread_info *info)
+{
+	spin_lock_init(&info->wthread_lock);
+
+	info->nr_running_wthreads = 0;
+
+	INIT_LIST_HEAD(&info->work_queue);
+	INIT_LIST_HEAD(&info->wthread_list);
+
+	init_waitqueue_head(&info->wthread_sleep);
+
+	return 0;
+}
+
+int wthread_start(struct worker_thread_info *info, int wthreads, u32 tid)
+{
+	int err = 0;
+
+	while (info->nr_running_wthreads < wthreads) {
+		if ((err = start_one_worker_thread(info, tid)) < 0) {
+			eprintk("Fail to create a worker thread %d\n", err);
+			goto out;
+		}
+	}
+
+	while (info->nr_running_wthreads > wthreads) {
+		struct worker_thread *wt;
+		wt = list_entry(info->wthread_list.next, struct worker_thread, w_list);
+		if ((err = stop_one_worker_thread(wt)) < 0) {
+			eprintk("Fail to stop a worker thread %d\n", err);
+			break;
+		}
+	}
+out:
+	return err;
+}
+
+int wthread_stop(struct worker_thread_info *info)
+{
+	struct worker_thread *wt, *tmp;
+	int err = 0;
+
+	list_for_each_entry_safe(wt, tmp, &info->wthread_list, w_list) {
+		if ((err = stop_one_worker_thread(wt)) < 0) {
+			eprintk("Fail to stop a worker thread %d\n", err);
+			return err;
+		}
+	}
+
+	return err;
+}
+
+int wthread_module_init()
+{
+	int err;
+
+	if (!worker_thread_pool_size)
+		return 0;
+
+	worker_thread_pool = kmalloc(sizeof(struct worker_thread_info),
+				     GFP_KERNEL);
+	if (!worker_thread_pool)
+		return -ENOMEM;
+
+	wthread_init(worker_thread_pool);
+
+	err = wthread_start(worker_thread_pool, worker_thread_pool_size, 0);
+	if (err) {
+		kfree(worker_thread_pool);
+		worker_thread_pool = NULL;
+		return err;
+	}
+
+	iprintk("iscsi_trgt using worker thread pool; size = %ld\n",
+		worker_thread_pool_size);
+
+	return 0;
+}
+
+void wthread_module_exit()
+{
+	if (!worker_thread_pool_size)
+		return;
+
+	wthread_stop(worker_thread_pool);
+	kfree(worker_thread_pool);
+}
--- linux-rt-2.6.31.orig/ubuntu/iscsitarget/block-io.c
+++ linux-rt-2.6.31/ubuntu/iscsitarget/block-io.c
@@ -0,0 +1,391 @@
+/*
+ * Target device block I/O.
+ *
+ * Based on file I/O driver from FUJITA Tomonori
+ * (C) 2004 - 2005 FUJITA Tomonori <tomof@acm.org>
+ * (C) 2006 Andre Brinkmann <brinkman at hni dot upb dot de>
+ * (C) 2007 Ross Walker <rswwalker at hotmail dot com>
+ * (C) 2007 Ming Zhang <blackmagic02881 at gmail dot com>
+ * This code is licenced under the GPL.
+ */
+
+#include <linux/types.h>
+#include <linux/blkdev.h>
+#include <linux/parser.h>
+#include <linux/buffer_head.h>
+
+#include "iscsi.h"
+#include "iscsi_dbg.h"
+#include "iotype.h"
+
+struct blockio_data {
+	char *path;
+	struct block_device *bdev;
+};
+
+struct tio_work {
+	atomic_t error;
+	atomic_t bios_remaining;
+	struct completion tio_complete;
+};
+
+static void blockio_bio_endio(struct bio *bio, int error)
+{
+	struct tio_work *tio_work = bio->bi_private;
+
+	error = test_bit(BIO_UPTODATE, &bio->bi_flags) ? error : -EIO;
+
+	if (error)
+		atomic_set(&tio_work->error, error);
+
+	/* If last bio signal completion */
+	if (atomic_dec_and_test(&tio_work->bios_remaining))
+		complete(&tio_work->tio_complete);
+
+	bio_put(bio);
+}
+
+/*
+ * Blockio_make_request(): The function translates an iscsi-request into
+ * a number of requests to the corresponding block device.
+ */
+static int
+blockio_make_request(struct iet_volume *volume, struct tio *tio, int rw)
+{
+	struct blockio_data *bio_data = volume->private;
+	struct request_queue *bdev_q = bdev_get_queue(bio_data->bdev);
+	struct tio_work *tio_work;
+	struct bio *tio_bio = NULL, *bio = NULL, *biotail = NULL;
+
+	u32 offset = tio->offset;
+	u32 size = tio->size;
+	u32 tio_index = 0;
+
+	int max_pages = 1;
+	int err = 0;
+
+	loff_t ppos = ((loff_t) tio->idx << PAGE_SHIFT) + offset;
+
+	/* Calculate max_pages for bio_alloc (memory saver) */
+	if (bdev_q)
+		max_pages = bio_get_nr_vecs(bio_data->bdev);
+
+	tio_work = kzalloc(sizeof (*tio_work), GFP_KERNEL);
+	if (!tio_work)
+		return -ENOMEM;
+
+	atomic_set(&tio_work->error, 0);
+	atomic_set(&tio_work->bios_remaining, 0);
+	init_completion(&tio_work->tio_complete);
+
+	/* Main processing loop, allocate and fill all bios */
+	while (tio_index < tio->pg_cnt) {
+		bio = bio_alloc(GFP_KERNEL, min(max_pages, BIO_MAX_PAGES));
+		if (!bio) {
+			err = -ENOMEM;
+			goto out;
+		}
+
+		bio->bi_sector = ppos >> volume->blk_shift;
+		bio->bi_bdev = bio_data->bdev;
+		bio->bi_end_io = blockio_bio_endio;
+		bio->bi_private = tio_work;
+
+		if (tio_bio)
+			biotail = biotail->bi_next = bio;
+		else
+			tio_bio = biotail = bio;
+
+		atomic_inc(&tio_work->bios_remaining);
+
+		/* Loop for filling bio */
+		while (tio_index < tio->pg_cnt) {
+			unsigned int bytes = PAGE_SIZE - offset;
+
+			if (bytes > size)
+				bytes = size;
+
+			if (!bio_add_page(bio, tio->pvec[tio_index], bytes, offset))
+				break;
+
+			size -= bytes;
+			ppos += bytes;
+
+			offset = 0;
+
+			tio_index++;
+		}
+	}
+
+	/* Walk the list, submitting bios 1 by 1 */
+	while (tio_bio) {
+		bio = tio_bio;
+		tio_bio = tio_bio->bi_next;
+		bio->bi_next = NULL;
+
+		submit_bio(rw, bio);
+	}
+
+	if (bdev_q && bdev_q->unplug_fn)
+		bdev_q->unplug_fn(bdev_q);
+
+	wait_for_completion(&tio_work->tio_complete);
+
+	err = atomic_read(&tio_work->error);
+
+	kfree(tio_work);
+
+	return err;
+out:
+	while (tio_bio) {
+		bio = tio_bio;
+		tio_bio = tio_bio->bi_next;
+
+		bio_put(bio);
+	}
+
+	kfree(tio_work);
+
+	return err;
+}
+
+static int
+blockio_open_path(struct iet_volume *volume, const char *path)
+{
+	struct blockio_data *bio_data = volume->private;
+	struct block_device *bdev;
+	int flags = FMODE_READ | (LUReadonly(volume) ? 0 : FMODE_WRITE);
+	int err = 0;
+
+	bio_data->path = kstrdup(path, GFP_KERNEL);
+	if (!bio_data->path)
+		return -ENOMEM;
+
+	bdev = open_bdev_exclusive(path, flags, THIS_MODULE);
+	if (IS_ERR(bdev)) {
+		err = PTR_ERR(bdev);
+		eprintk("Can't open device %s, error %d\n", path, err);
+		bio_data->bdev = NULL;
+	} else {
+		bio_data->bdev = bdev;
+		fsync_bdev(bio_data->bdev);
+	}
+
+	return err;
+}
+
+static int
+set_scsiid(struct iet_volume *volume, const char *id)
+{
+	size_t len;
+
+	if ((len = strlen(id)) > SCSI_ID_LEN - VENDOR_ID_LEN) {
+		eprintk("SCSI ID too long, %zd provided, %u max\n", len,
+			SCSI_ID_LEN - VENDOR_ID_LEN);
+		return -EINVAL;
+	}
+
+	memcpy(volume->scsi_id + VENDOR_ID_LEN, id, len);
+
+	return 0;
+}
+
+static void
+gen_scsiid(struct iet_volume *volume, struct inode *inode)
+{
+	int i;
+	u32 *p;
+
+	strlcpy(volume->scsi_id, VENDOR_ID, VENDOR_ID_LEN);
+
+	for (i = VENDOR_ID_LEN; i < SCSI_ID_LEN; i++)
+		if (volume->scsi_id[i])
+			return;
+
+	/* If a scsi id doesn't exist generate a 16 byte one:
+	 * Bytes   1-4: target type
+	 * Bytes   5-8: target id
+	 * Bytes  9-12: inode number
+	 * Bytes 13-16: device type
+	 */
+	p = (u32 *) (volume->scsi_id + VENDOR_ID_LEN);
+	*(p + 0) = volume->target->trgt_param.target_type;
+	*(p + 1) = volume->target->tid;
+	*(p + 2) = volume->lun;
+	*(p + 3) = (unsigned int) inode->i_sb->s_dev;
+}
+
+static int
+set_scsisn(struct iet_volume *volume, const char *sn)
+{
+	size_t len;
+
+	if ((len = strlen(sn)) > SCSI_SN_LEN) {
+		eprintk("SCSI SN too long, %zd provided, %u max\n", len,
+			SCSI_SN_LEN);
+		return -EINVAL;
+	}
+
+	memcpy(volume->scsi_sn, sn, len);
+
+	return 0;
+}
+
+/* Create an enumeration of our accepted actions */
+enum
+{
+	Opt_scsiid, Opt_scsisn, Opt_path, Opt_ignore, Opt_err,
+};
+
+/* Create a match table using our action enums and their matching options */
+static match_table_t tokens = {
+	{Opt_scsiid, "ScsiId=%s"},
+	{Opt_scsisn, "ScsiSN=%s"},
+	{Opt_path, "Path=%s"},
+	{Opt_ignore, "Type=%s"},
+	{Opt_ignore, "IOMode=%s"},
+	{Opt_err, NULL},
+};
+
+static int
+parse_blockio_params(struct iet_volume *volume, char *params)
+{
+	struct blockio_data *info = volume->private;
+	int err = 0;
+	char *p, *q;
+
+	/* Loop through parameters separated by commas, look up our
+	 * parameter in match table, return enumeration and arguments
+	 * select case based on the returned enum and run the action */
+	while ((p = strsep(&params, ",")) != NULL) {
+		substring_t args[MAX_OPT_ARGS];
+		int token;
+		if (!*p)
+			continue;
+		token = match_token(p, tokens, args);
+		switch (token) {
+		case Opt_scsiid:
+			if (!(q = match_strdup(&args[0]))) {
+				err = -ENOMEM;
+				goto out;
+			}
+			err = set_scsiid(volume, q);
+			kfree(q);
+			if (err < 0)
+				goto out;
+			break;
+		case Opt_scsisn:
+			if (!(q = match_strdup(&args[0]))) {
+				err = -ENOMEM;
+				goto out;
+			}
+			err = set_scsisn(volume, q);
+			kfree(q);
+			if (err < 0)
+				goto out;
+			break;
+		case Opt_path:
+			if (info->path) {
+				iprintk("Target %s, LUN %u: "
+					"duplicate \"Path\" param\n",
+					volume->target->name, volume->lun);
+				err = -EINVAL;
+				goto out;
+			}
+			if (!(q = match_strdup(&args[0]))) {
+				err = -ENOMEM;
+				goto out;
+			}
+			err = blockio_open_path(volume, q);
+			kfree(q);
+			if (err < 0)
+				goto out;
+			break;
+		case Opt_ignore:
+			break;
+		default:
+			iprintk("Target %s, LUN %u: unknown param %s\n",
+				volume->target->name, volume->lun, p);
+			return -EINVAL;
+		}
+	}
+
+	if (!info->path) {
+		iprintk("Target %s, LUN %u: missing \"Path\" param\n",
+			volume->target->name, volume->lun);
+		err = -EINVAL;
+	}
+  out:
+	return err;
+}
+
+static void
+blockio_detach(struct iet_volume *volume)
+{
+	struct blockio_data *bio_data = volume->private;
+	int flags = FMODE_READ | (LUReadonly(volume) ? 0 : FMODE_WRITE);
+
+	if (bio_data->bdev)
+		close_bdev_exclusive(bio_data->bdev, flags);
+	kfree(bio_data->path);
+
+	kfree(volume->private);
+}
+
+static int
+blockio_attach(struct iet_volume *volume, char *args)
+{
+	struct blockio_data *bio_data;
+	int err = 0;
+
+	if (volume->private) {
+		eprintk("Lun %u already attached on Target %s \n",
+			volume->lun, volume->target->name);
+		return -EBUSY;
+	}
+
+	bio_data = kzalloc(sizeof (*bio_data), GFP_KERNEL);
+	if (!bio_data)
+		return -ENOMEM;
+
+	volume->private = bio_data;
+
+	if ((err = parse_blockio_params(volume, args)) < 0) {
+		eprintk("Error attaching Lun %u to Target %s \n",
+			volume->lun, volume->target->name);
+		goto out;
+	}
+
+	/* Assign a vendor id, generate scsi id if none exists */
+	gen_scsiid(volume, bio_data->bdev->bd_inode);
+
+	/* Offer neither write nor read caching */
+	ClearLURCache(volume);
+	ClearLUWCache(volume);
+
+	volume->blk_shift = SECTOR_SIZE_BITS;
+	volume->blk_cnt = bio_data->bdev->bd_inode->i_size >> volume->blk_shift;
+
+  out:
+	if (err < 0)
+		blockio_detach(volume);
+
+	return err;
+}
+
+static void
+blockio_show(struct iet_volume *volume, struct seq_file *seq)
+{
+	struct blockio_data *bio_data = volume->private;
+
+	/* Used to display blockio volume info in /proc/net/iet/volumes */
+	seq_printf(seq, " path:%s\n", bio_data->path);
+}
+
+struct iotype blockio = {
+	.name = "blockio",
+	.attach = blockio_attach,
+	.make_request = blockio_make_request,
+	.detach = blockio_detach,
+	.show = blockio_show,
+};
--- linux-rt-2.6.31.orig/ubuntu/iscsitarget/conn.c
+++ linux-rt-2.6.31/ubuntu/iscsitarget/conn.c
@@ -0,0 +1,242 @@
+/*
+ * Copyright (C) 2002-2003 Ardis Technolgies <roman@ardistech.com>
+ *
+ * Released under the terms of the GNU GPL v2.0.
+ */
+
+#include <linux/file.h>
+#include <linux/ip.h>
+#include <net/tcp.h>
+
+#include "iscsi.h"
+#include "iscsi_dbg.h"
+#include "digest.h"
+
+static void print_conn_state(char *p, size_t size, unsigned long state)
+{
+	if (test_bit(CONN_ACTIVE, &state))
+		snprintf(p, size, "%s", "active");
+	else if (test_bit(CONN_CLOSING, &state))
+		snprintf(p, size, "%s", "closing");
+	else
+		snprintf(p, size, "%s", "unknown");
+}
+
+static void print_digest_state(char *p, size_t size, unsigned long flags)
+{
+	if (DIGEST_NONE & flags)
+		snprintf(p, size, "%s", "none");
+	else if (DIGEST_CRC32C & flags)
+		snprintf(p, size, "%s", "crc32c");
+	else
+		snprintf(p, size, "%s", "unknown");
+}
+
+void conn_info_show(struct seq_file *seq, struct iscsi_session *session)
+{
+	struct iscsi_conn *conn;
+	struct sock *sk;
+	char buf[64];
+
+	list_for_each_entry(conn, &session->conn_list, list) {
+		sk = conn->sock->sk;
+		switch (sk->sk_family) {
+		case AF_INET:
+			snprintf(buf, sizeof(buf),
+				 "%u.%u.%u.%u", NIPQUAD(inet_sk(sk)->daddr));
+			break;
+		case AF_INET6:
+			snprintf(buf, sizeof(buf), "[%pI6]",
+				 &inet6_sk(sk)->daddr);
+			break;
+		default:
+			break;
+		}
+		seq_printf(seq, "\t\tcid:%u ip:%s ", conn->cid, buf);
+		print_conn_state(buf, sizeof(buf), conn->state);
+		seq_printf(seq, "state:%s ", buf);
+		print_digest_state(buf, sizeof(buf), conn->hdigest_type);
+		seq_printf(seq, "hd:%s ", buf);
+		print_digest_state(buf, sizeof(buf), conn->ddigest_type);
+		seq_printf(seq, "dd:%s\n", buf);
+	}
+}
+
+struct iscsi_conn *conn_lookup(struct iscsi_session *session, u16 cid)
+{
+	struct iscsi_conn *conn;
+
+	list_for_each_entry(conn, &session->conn_list, list) {
+		if (conn->cid == cid)
+			return conn;
+	}
+	return NULL;
+}
+
+static void iet_state_change(struct sock *sk)
+{
+	struct iscsi_conn *conn = sk->sk_user_data;
+	struct iscsi_target *target = conn->session->target;
+
+	if (sk->sk_state != TCP_ESTABLISHED)
+		conn_close(conn);
+	else
+		nthread_wakeup(target);
+
+	target->nthread_info.old_state_change(sk);
+}
+
+static void iet_data_ready(struct sock *sk, int len)
+{
+	struct iscsi_conn *conn = sk->sk_user_data;
+	struct iscsi_target *target = conn->session->target;
+
+	nthread_wakeup(target);
+	target->nthread_info.old_data_ready(sk, len);
+}
+
+/*
+ * @locking: grabs the target's nthread_lock to protect it from races with
+ * set_conn_wspace_wait()
+ */
+static void iet_write_space(struct sock *sk)
+{
+	struct iscsi_conn *conn = sk->sk_user_data;
+	struct network_thread_info *info = &conn->session->target->nthread_info;
+
+	spin_lock_bh(&info->nthread_lock);
+
+	if (sk_stream_wspace(sk) >= sk_stream_min_wspace(sk) &&
+	    test_bit(CONN_WSPACE_WAIT, &conn->state)) {
+		clear_bit(CONN_WSPACE_WAIT, &conn->state);
+		__nthread_wakeup(info);
+	}
+
+	spin_unlock_bh(&info->nthread_lock);
+
+	info->old_write_space(sk);
+}
+
+static void iet_socket_bind(struct iscsi_conn *conn)
+{
+	int opt = 1;
+	mm_segment_t oldfs;
+	struct iscsi_session *session = conn->session;
+	struct iscsi_target *target = session->target;
+
+	dprintk(D_GENERIC, "%llu\n", (unsigned long long) session->sid);
+
+	conn->sock = SOCKET_I(conn->file->f_dentry->d_inode);
+	conn->sock->sk->sk_user_data = conn;
+
+	write_lock_bh(&conn->sock->sk->sk_callback_lock);
+	target->nthread_info.old_state_change = conn->sock->sk->sk_state_change;
+	conn->sock->sk->sk_state_change = iet_state_change;
+
+	target->nthread_info.old_data_ready = conn->sock->sk->sk_data_ready;
+	conn->sock->sk->sk_data_ready = iet_data_ready;
+
+	target->nthread_info.old_write_space = conn->sock->sk->sk_write_space;
+	conn->sock->sk->sk_write_space = iet_write_space;
+	write_unlock_bh(&conn->sock->sk->sk_callback_lock);
+
+	oldfs = get_fs();
+	set_fs(get_ds());
+	conn->sock->ops->setsockopt(conn->sock, SOL_TCP, TCP_NODELAY, (void *)&opt, sizeof(opt));
+	set_fs(oldfs);
+}
+
+int conn_free(struct iscsi_conn *conn)
+{
+	dprintk(D_GENERIC, "%p %#Lx %u\n", conn->session,
+		(unsigned long long) conn->session->sid, conn->cid);
+
+	assert(atomic_read(&conn->nr_cmnds) == 0);
+	assert(list_empty(&conn->pdu_list));
+	assert(list_empty(&conn->write_list));
+
+	list_del(&conn->list);
+	list_del(&conn->poll_list);
+
+	digest_cleanup(conn);
+	kfree(conn);
+
+	return 0;
+}
+
+static int iet_conn_alloc(struct iscsi_session *session, struct conn_info *info)
+{
+	struct iscsi_conn *conn;
+
+	dprintk(D_SETUP, "%#Lx:%u\n", (unsigned long long) session->sid, info->cid);
+
+	conn = kzalloc(sizeof(*conn), GFP_KERNEL);
+	if (!conn)
+		return -ENOMEM;
+
+	conn->session = session;
+	conn->cid = info->cid;
+	conn->stat_sn = info->stat_sn;
+	conn->exp_stat_sn = info->exp_stat_sn;
+
+	conn->hdigest_type = info->header_digest;
+	conn->ddigest_type = info->data_digest;
+	if (digest_init(conn) < 0) {
+		kfree(conn);
+		return -ENOMEM;
+	}
+
+	spin_lock_init(&conn->list_lock);
+	atomic_set(&conn->nr_cmnds, 0);
+	atomic_set(&conn->nr_busy_cmnds, 0);
+	INIT_LIST_HEAD(&conn->pdu_list);
+	INIT_LIST_HEAD(&conn->write_list);
+	INIT_LIST_HEAD(&conn->poll_list);
+
+	list_add(&conn->list, &session->conn_list);
+
+	set_bit(CONN_ACTIVE, &conn->state);
+
+	conn->file = fget(info->fd);
+	iet_socket_bind(conn);
+
+	list_add(&conn->poll_list, &session->target->nthread_info.active_conns);
+
+	nthread_wakeup(conn->session->target);
+
+	return 0;
+}
+
+void conn_close(struct iscsi_conn *conn)
+{
+	if (test_and_clear_bit(CONN_ACTIVE, &conn->state))
+		set_bit(CONN_CLOSING, &conn->state);
+
+	nthread_wakeup(conn->session->target);
+}
+
+int conn_add(struct iscsi_session *session, struct conn_info *info)
+{
+	struct iscsi_conn *conn;
+	int err = -EEXIST;
+
+	conn = conn_lookup(session, info->cid);
+	if (conn)
+		return err;
+
+	return iet_conn_alloc(session, info);
+}
+
+int conn_del(struct iscsi_session *session, struct conn_info *info)
+{
+	struct iscsi_conn *conn;
+	int err = -EEXIST;
+
+	conn = conn_lookup(session, info->cid);
+	if (!conn)
+		return err;
+
+	conn_close(conn);
+
+	return 0;
+}
--- linux-rt-2.6.31.orig/ubuntu/iscsitarget/nthread.c
+++ linux-rt-2.6.31/ubuntu/iscsitarget/nthread.c
@@ -0,0 +1,733 @@
+/*
+ * Network thread.
+ * (C) 2004 - 2005 FUJITA Tomonori <tomof@acm.org>
+ * This code is licenced under the GPL.
+ */
+
+#include <linux/sched.h>
+#include <linux/file.h>
+#include <linux/kthread.h>
+#include <asm/ioctls.h>
+
+#include "iscsi.h"
+#include "iscsi_dbg.h"
+#include "digest.h"
+
+enum daemon_state_bit {
+	D_ACTIVE,
+	D_DATA_READY,
+};
+
+void __nthread_wakeup(struct network_thread_info *info)
+{
+	set_bit(D_DATA_READY, &info->flags);
+	wake_up_process(info->task);
+}
+
+void nthread_wakeup(struct iscsi_target *target)
+{
+	struct network_thread_info *info = &target->nthread_info;
+
+	spin_lock_bh(&info->nthread_lock);
+	__nthread_wakeup(info);
+	spin_unlock_bh(&info->nthread_lock);
+}
+
+static inline void iscsi_conn_init_read(struct iscsi_conn *conn, void *data, size_t len)
+{
+	len = (len + 3) & -4; // XXX ???
+	conn->read_iov[0].iov_base = data;
+	conn->read_iov[0].iov_len = len;
+	conn->read_msg.msg_iov = conn->read_iov;
+	conn->read_msg.msg_iovlen = 1;
+	conn->read_size = (len + 3) & -4;
+}
+
+static void iscsi_conn_read_ahs(struct iscsi_conn *conn, struct iscsi_cmnd *cmnd)
+{
+	cmnd->pdu.ahs = kmalloc(cmnd->pdu.ahssize, __GFP_NOFAIL|GFP_KERNEL);
+	assert(cmnd->pdu.ahs);
+	iscsi_conn_init_read(conn, cmnd->pdu.ahs, cmnd->pdu.ahssize);
+}
+
+static struct iscsi_cmnd * iscsi_get_send_cmnd(struct iscsi_conn *conn)
+{
+	struct iscsi_cmnd *cmnd = NULL;
+
+	spin_lock(&conn->list_lock);
+	if (!list_empty(&conn->write_list)) {
+		cmnd = list_entry(conn->write_list.next, struct iscsi_cmnd, list);
+		list_del_init(&cmnd->list);
+	}
+	spin_unlock(&conn->list_lock);
+
+	return cmnd;
+}
+
+static int is_data_available(struct iscsi_conn *conn)
+{
+	int avail, res;
+	mm_segment_t oldfs;
+	struct socket *sock = conn->sock;
+
+	oldfs = get_fs();
+	set_fs(get_ds());
+	res = sock->ops->ioctl(sock, SIOCINQ, (unsigned long) &avail);
+	set_fs(oldfs);
+	return (res >= 0) ? avail : res;
+}
+
+static void forward_iov(struct msghdr *msg, int len)
+{
+	while (msg->msg_iov->iov_len <= len) {
+		len -= msg->msg_iov->iov_len;
+		msg->msg_iov++;
+		msg->msg_iovlen--;
+	}
+
+	msg->msg_iov->iov_base = (char *) msg->msg_iov->iov_base + len;
+	msg->msg_iov->iov_len -= len;
+}
+
+static int do_recv(struct iscsi_conn *conn, int state)
+{
+	mm_segment_t oldfs;
+	struct msghdr msg;
+	struct iovec iov[ISCSI_CONN_IOV_MAX];
+	int i, len, res;
+
+	if (!test_bit(CONN_ACTIVE, &conn->state)) {
+		res = -EIO;
+		goto out;
+	}
+
+	if (is_data_available(conn) <= 0) {
+		res = -EAGAIN;
+		goto out;
+	}
+
+	msg.msg_iov = iov;
+	msg.msg_iovlen = min_t(size_t, conn->read_msg.msg_iovlen, ISCSI_CONN_IOV_MAX);
+	for (i = 0, len = 0; i < msg.msg_iovlen; i++) {
+		iov[i] = conn->read_msg.msg_iov[i];
+		len += iov[i].iov_len;
+	}
+
+	oldfs = get_fs();
+	set_fs(get_ds());
+	res = sock_recvmsg(conn->sock, &msg, len, MSG_DONTWAIT | MSG_NOSIGNAL);
+	set_fs(oldfs);
+
+	if (res <= 0) {
+		switch (res) {
+		case -EAGAIN:
+		case -ERESTARTSYS:
+			break;
+		default:
+			eprintk("%d\n", res);
+			conn_close(conn);
+			break;
+		}
+	} else {
+		conn->read_size -= res;
+		if (conn->read_size)
+			forward_iov(&conn->read_msg, res);
+		else
+			conn->read_state = state;
+	}
+
+out:
+	dprintk(D_IOD, "%d\n", res);
+
+	return res;
+}
+
+enum rx_state {
+	RX_INIT_BHS, /* Must be zero. */
+	RX_BHS,
+
+	RX_INIT_AHS,
+	RX_AHS,
+
+	RX_INIT_HDIGEST,
+	RX_HDIGEST,
+	RX_CHECK_HDIGEST,
+
+	RX_INIT_DATA,
+	RX_DATA,
+
+	RX_INIT_DDIGEST,
+	RX_DDIGEST,
+	RX_CHECK_DDIGEST,
+
+	RX_END,
+};
+
+static void rx_ddigest(struct iscsi_conn *conn, int state)
+{
+	struct iscsi_cmnd *cmnd = conn->read_cmnd;
+	int res = digest_rx_data(cmnd);
+
+	if (!res)
+		conn->read_state = state;
+	else
+		conn_close(conn);
+}
+
+static void rx_hdigest(struct iscsi_conn *conn, int state)
+{
+	struct iscsi_cmnd *cmnd = conn->read_cmnd;
+	int res = digest_rx_header(cmnd);
+
+	if (!res)
+		conn->read_state = state;
+	else
+		conn_close(conn);
+}
+
+static struct iscsi_cmnd *create_cmnd(struct iscsi_conn *conn)
+{
+	struct iscsi_cmnd *cmnd;
+
+	cmnd = cmnd_alloc(conn, 1);
+	iscsi_conn_init_read(cmnd->conn, &cmnd->pdu.bhs, sizeof(cmnd->pdu.bhs));
+	conn->read_state = RX_BHS;
+
+	return cmnd;
+}
+
+static int recv(struct iscsi_conn *conn)
+{
+	struct iscsi_cmnd *cmnd = conn->read_cmnd;
+	int hdigest, ddigest, res = 1;
+
+	if (!test_bit(CONN_ACTIVE, &conn->state))
+		return -EIO;
+
+	hdigest = conn->hdigest_type & DIGEST_NONE ? 0 : 1;
+	ddigest = conn->ddigest_type & DIGEST_NONE ? 0 : 1;
+
+	switch (conn->read_state) {
+	case RX_INIT_BHS:
+		assert(!cmnd);
+		cmnd = conn->read_cmnd = create_cmnd(conn);
+	case RX_BHS:
+		res = do_recv(conn, RX_INIT_AHS);
+		if (res <= 0 || conn->read_state != RX_INIT_AHS)
+			break;
+	case RX_INIT_AHS:
+		iscsi_cmnd_get_length(&cmnd->pdu);
+		if (cmnd->pdu.ahssize) {
+			iscsi_conn_read_ahs(conn, cmnd);
+			conn->read_state = RX_AHS;
+		} else
+			conn->read_state = hdigest ? RX_INIT_HDIGEST : RX_INIT_DATA;
+
+		if (conn->read_state != RX_AHS)
+			break;
+	case RX_AHS:
+		res = do_recv(conn, hdigest ? RX_INIT_HDIGEST : RX_INIT_DATA);
+		if (res <= 0 || conn->read_state != RX_INIT_HDIGEST)
+			break;
+	case RX_INIT_HDIGEST:
+		iscsi_conn_init_read(conn, &cmnd->hdigest, sizeof(u32));
+		conn->read_state = RX_HDIGEST;
+	case RX_HDIGEST:
+		res = do_recv(conn, RX_CHECK_HDIGEST);
+		if (res <= 0 || conn->read_state != RX_CHECK_HDIGEST)
+			break;
+	case RX_CHECK_HDIGEST:
+		rx_hdigest(conn, RX_INIT_DATA);
+		if (conn->read_state != RX_INIT_DATA)
+			break;
+	case RX_INIT_DATA:
+		cmnd_rx_start(cmnd);
+		conn->read_state = cmnd->pdu.datasize ? RX_DATA : RX_END;
+		if (conn->read_state != RX_DATA)
+			break;
+	case RX_DATA:
+		res = do_recv(conn, ddigest ? RX_INIT_DDIGEST : RX_END);
+		if (res <= 0 || conn->read_state != RX_INIT_DDIGEST)
+			break;
+	case RX_INIT_DDIGEST:
+		iscsi_conn_init_read(conn, &cmnd->ddigest, sizeof(u32));
+		conn->read_state = RX_DDIGEST;
+	case RX_DDIGEST:
+		res = do_recv(conn, RX_CHECK_DDIGEST);
+		if (res <= 0 || conn->read_state != RX_CHECK_DDIGEST)
+			break;
+	case RX_CHECK_DDIGEST:
+		rx_ddigest(conn, RX_END);
+		break;
+	default:
+		eprintk("%d %d %x\n", res, conn->read_state, cmnd_opcode(cmnd));
+		assert(0);
+	}
+
+	if (res <= 0)
+		return res;
+
+	if (conn->read_state != RX_END)
+		return res;
+
+	if (conn->read_size) {
+		eprintk("%d %x %d\n", res, cmnd_opcode(cmnd), conn->read_size);
+		assert(0);
+	}
+
+	cmnd_rx_end(cmnd);
+	if (conn->read_size) {
+		eprintk("%x %d\n", cmnd_opcode(cmnd), conn->read_size);
+		conn->read_state = RX_DATA;
+		return 1;
+	}
+
+	conn->read_cmnd = NULL;
+	conn->read_state = RX_INIT_BHS;
+
+	return 0;
+}
+
+/*
+ * @locking: grabs the target's nthread_lock to protect it from races with
+ * iet_write_space()
+ */
+static void set_conn_wspace_wait(struct iscsi_conn *conn)
+{
+	struct network_thread_info *info = &conn->session->target->nthread_info;
+	struct sock *sk = conn->sock->sk;
+
+	spin_lock_bh(&info->nthread_lock);
+
+	if (sk_stream_wspace(sk) < sk_stream_min_wspace(sk))
+		set_bit(CONN_WSPACE_WAIT, &conn->state);
+
+	spin_unlock_bh(&info->nthread_lock);
+}
+
+/* This is taken from the Ardis code. */
+static int write_data(struct iscsi_conn *conn)
+{
+	mm_segment_t oldfs;
+	struct file *file;
+	struct socket *sock;
+	ssize_t (*sendpage)(struct socket *, struct page *, int, size_t, int);
+	struct tio *tio;
+	struct iovec *iop;
+	int saved_size, size, sendsize;
+	int offset, idx;
+	int flags, res;
+
+	file = conn->file;
+	saved_size = size = conn->write_size;
+	iop = conn->write_iop;
+
+	if (iop) while (1) {
+		loff_t off = 0;
+		unsigned long count;
+		struct iovec *vec;
+		int rest;
+
+		vec = iop;
+		for (count = 0; vec->iov_len; count++, vec++)
+			;
+		oldfs = get_fs();
+		set_fs(KERNEL_DS);
+		res = vfs_writev(file, (struct iovec __user *) iop, count, &off);
+		set_fs(oldfs);
+		dprintk(D_DATA, "%#Lx:%u: %d(%ld)\n",
+			(unsigned long long) conn->session->sid, conn->cid,
+			res, (long) iop->iov_len);
+		if (unlikely(res <= 0)) {
+			if (res == -EAGAIN || res == -EINTR) {
+				conn->write_iop = iop;
+				goto out_iov;
+			}
+			goto err;
+		}
+
+		rest = res;
+		size -= res;
+		while (iop->iov_len <= rest && rest) {
+			rest -= iop->iov_len;
+			iop++;
+		}
+		iop->iov_base += rest;
+		iop->iov_len -= rest;
+
+		if (!iop->iov_len) {
+			conn->write_iop = NULL;
+			if (size)
+				break;
+			goto out_iov;
+		}
+	}
+
+	if (!(tio = conn->write_tcmnd)) {
+		eprintk("%s\n", "warning data missing!");
+		return 0;
+	}
+	offset = conn->write_offset;
+	idx = offset >> PAGE_CACHE_SHIFT;
+	offset &= ~PAGE_CACHE_MASK;
+
+	sock = conn->sock;
+	sendpage = sock->ops->sendpage ? : sock_no_sendpage;
+	flags = MSG_DONTWAIT;
+
+	while (1) {
+		sendsize = PAGE_CACHE_SIZE - offset;
+		if (size <= sendsize) {
+			res = sendpage(sock, tio->pvec[idx], offset, size, flags);
+			dprintk(D_DATA, "%s %#Lx:%u: %d(%lu,%u,%u)\n",
+				sock->ops->sendpage ? "sendpage" : "writepage",
+				(unsigned long long ) conn->session->sid, conn->cid,
+				res, tio->pvec[idx]->index, offset, size);
+			if (unlikely(res <= 0)) {
+				if (res == -EAGAIN || res == -EINTR) {
+					goto out;
+				}
+				goto err;
+			}
+			if (res == size) {
+				conn->write_tcmnd = NULL;
+				conn->write_size = 0;
+				return saved_size;
+			}
+			offset += res;
+			size -= res;
+			continue;
+		}
+
+		res = sendpage(sock, tio->pvec[idx], offset,sendsize, flags | MSG_MORE);
+		dprintk(D_DATA, "%s %#Lx:%u: %d(%lu,%u,%u)\n",
+			sock->ops->sendpage ? "sendpage" : "writepage",
+			(unsigned long long ) conn->session->sid, conn->cid,
+			res, tio->pvec[idx]->index, offset, sendsize);
+		if (unlikely(res <= 0)) {
+			if (res == -EAGAIN || res == -EINTR) {
+				goto out;
+			}
+			goto err;
+		}
+		if (res == sendsize) {
+			idx++;
+			offset = 0;
+		} else
+			offset += res;
+		size -= res;
+	}
+ out:
+	conn->write_offset = (idx << PAGE_CACHE_SHIFT) + offset;
+ out_iov:
+	conn->write_size = size;
+	if (res == -EAGAIN) {
+		set_conn_wspace_wait(conn);
+		if (saved_size == size)
+			return res;
+	}
+
+	return saved_size - size;
+
+ err:
+	eprintk("error %d at %#Lx:%u\n", res,
+		(unsigned long long) conn->session->sid, conn->cid);
+	return res;
+}
+
+static void exit_tx(struct iscsi_conn *conn, int res)
+{
+	if (res > 0)
+		return;
+
+	switch (res) {
+	case -EAGAIN:
+	case -ERESTARTSYS:
+		break;
+	default:
+		eprintk("%d %d %d\n", conn->write_size, conn->write_state, res);
+		conn_close(conn);
+		break;
+	}
+}
+
+static int tx_ddigest(struct iscsi_cmnd *cmnd, int state)
+{
+	int res, rest = cmnd->conn->write_size;
+	struct msghdr msg = {.msg_flags = MSG_NOSIGNAL | MSG_DONTWAIT};
+	struct kvec iov;
+
+	iov.iov_base = (char *) (&cmnd->ddigest) + (sizeof(u32) - rest);
+	iov.iov_len = rest;
+
+	res = kernel_sendmsg(cmnd->conn->sock, &msg, &iov, 1, rest);
+
+	if (res > 0) {
+		cmnd->conn->write_size -= res;
+		if (!cmnd->conn->write_size)
+			cmnd->conn->write_state = state;
+	} else
+		exit_tx(cmnd->conn, res);
+
+	return res;
+}
+
+static void init_tx_hdigest(struct iscsi_cmnd *cmnd)
+{
+	struct iscsi_conn *conn = cmnd->conn;
+	struct iovec *iop;
+
+	if (conn->hdigest_type & DIGEST_NONE)
+		return;
+
+	digest_tx_header(cmnd);
+
+	for (iop = conn->write_iop; iop->iov_len; iop++)
+		;
+	iop->iov_base = &(cmnd->hdigest);
+	iop->iov_len = sizeof(u32);
+	conn->write_size += sizeof(u32);
+	iop++;
+	iop->iov_len = 0;
+
+	return;
+}
+
+enum tx_state {
+	TX_INIT, /* Must be zero. */
+	TX_BHS_DATA,
+	TX_INIT_DDIGEST,
+	TX_DDIGEST,
+	TX_END,
+};
+
+static int do_send(struct iscsi_conn *conn, int state)
+{
+	int res;
+
+	res = write_data(conn);
+
+	if (res > 0) {
+		if (!conn->write_size)
+			conn->write_state = state;
+	} else
+		exit_tx(conn, res);
+
+	return res;
+}
+
+static int send(struct iscsi_conn *conn)
+{
+	struct iscsi_cmnd *cmnd = conn->write_cmnd;
+	int ddigest, res = 0;
+
+	ddigest = conn->ddigest_type != DIGEST_NONE ? 1 : 0;
+
+	switch (conn->write_state) {
+	case TX_INIT:
+		assert(!cmnd);
+		cmnd = conn->write_cmnd = iscsi_get_send_cmnd(conn);
+		if (!cmnd)
+			return 0;
+		cmnd_tx_start(cmnd);
+		init_tx_hdigest(cmnd);
+		conn->write_state = TX_BHS_DATA;
+	case TX_BHS_DATA:
+		res = do_send(conn, ddigest && cmnd->pdu.datasize ? TX_INIT_DDIGEST : TX_END);
+		if (res <= 0 || conn->write_state != TX_INIT_DDIGEST)
+			break;
+	case TX_INIT_DDIGEST:
+		digest_tx_data(cmnd);
+		assert(!cmnd->conn->write_size);
+		cmnd->conn->write_size += sizeof(u32);
+		conn->write_state = TX_DDIGEST;
+	case TX_DDIGEST:
+		res = tx_ddigest(cmnd, TX_END);
+		break;
+	default:
+		eprintk("%d %d %x\n", res, conn->write_state, cmnd_opcode(cmnd));
+		assert(0);
+	}
+
+	if (res <= 0)
+		return res;
+
+	if (conn->write_state != TX_END)
+		return res;
+
+	if (conn->write_size) {
+		eprintk("%d %x %u\n", res, cmnd_opcode(cmnd), conn->write_size);
+		assert(!conn->write_size);
+	}
+	cmnd_tx_end(cmnd);
+	cmnd_release(cmnd, 0);
+	conn->write_cmnd = NULL;
+	conn->write_state = TX_INIT;
+
+	return 0;
+}
+
+static void process_io(struct iscsi_conn *conn)
+{
+	struct iscsi_target *target = conn->session->target;
+	int res, wakeup = 0;
+
+	res = recv(conn);
+
+	if (is_data_available(conn) > 0 || res > 0)
+		wakeup = 1;
+
+	if (!test_bit(CONN_ACTIVE, &conn->state)) {
+		wakeup = 1;
+		goto out;
+	}
+
+	if (test_bit(CONN_WSPACE_WAIT, &conn->state))
+		goto out;
+
+	res = send(conn);
+
+	if (!list_empty(&conn->write_list) || conn->write_cmnd)
+		wakeup = 1;
+
+out:
+	if (wakeup)
+		nthread_wakeup(target);
+
+	return;
+}
+
+static void close_conn(struct iscsi_conn *conn)
+{
+	struct iscsi_session *session = conn->session;
+	struct iscsi_target *target = session->target;
+	struct iscsi_cmnd *cmnd;
+
+	assert(conn);
+
+	conn->sock->ops->shutdown(conn->sock, 2);
+
+	write_lock_bh(&conn->sock->sk->sk_callback_lock);
+	conn->sock->sk->sk_state_change = target->nthread_info.old_state_change;
+	conn->sock->sk->sk_data_ready = target->nthread_info.old_data_ready;
+	conn->sock->sk->sk_write_space = target->nthread_info.old_write_space;
+	write_unlock_bh(&conn->sock->sk->sk_callback_lock);
+
+	fput(conn->file);
+	conn->file = NULL;
+	conn->sock = NULL;
+
+	while (atomic_read(&conn->nr_busy_cmnds))
+		yield();
+
+	while (!list_empty(&conn->pdu_list)) {
+		cmnd = list_entry(conn->pdu_list.next, struct iscsi_cmnd, conn_list);
+
+		list_del_init(&cmnd->list);
+		cmnd_release(cmnd, 1);
+	}
+
+	if (atomic_read(&conn->nr_cmnds)) {
+		eprintk("%u\n", atomic_read(&conn->nr_cmnds));
+		list_for_each_entry(cmnd, &conn->pdu_list, conn_list)
+			eprintk("%x %x\n", cmnd_opcode(cmnd), cmnd_itt(cmnd));
+		assert(0);
+	}
+
+	event_send(target->tid, session->sid, conn->cid, E_CONN_CLOSE, 0);
+	conn_free(conn);
+
+	if (list_empty(&session->conn_list))
+		session_del(target, session->sid);
+}
+
+static int istd(void *arg)
+{
+	struct iscsi_target *target = arg;
+	struct network_thread_info *info = &target->nthread_info;
+	struct iscsi_conn *conn, *tmp;
+
+	__set_current_state(TASK_RUNNING);
+	do {
+		spin_lock_bh(&info->nthread_lock);
+		__set_current_state(TASK_INTERRUPTIBLE);
+
+		if (!test_bit(D_DATA_READY, &info->flags)) {
+			spin_unlock_bh(&info->nthread_lock);
+			schedule();
+			spin_lock_bh(&info->nthread_lock);
+		}
+		__set_current_state(TASK_RUNNING);
+		clear_bit(D_DATA_READY, &info->flags);
+		spin_unlock_bh(&info->nthread_lock);
+
+		target_lock(target, 0);
+		list_for_each_entry_safe(conn, tmp, &info->active_conns, poll_list) {
+			if (test_bit(CONN_ACTIVE, &conn->state))
+				process_io(conn);
+			else
+				close_conn(conn);
+		}
+		target_unlock(target);
+
+	} while (!kthread_should_stop());
+
+	return 0;
+}
+
+int nthread_init(struct iscsi_target *target)
+{
+	struct network_thread_info *info = &target->nthread_info;
+
+	info->flags = 0;
+	info->task = NULL;
+
+	info->old_state_change = NULL;
+	info->old_data_ready = NULL;
+	info->old_write_space = NULL;
+
+	INIT_LIST_HEAD(&info->active_conns);
+
+	spin_lock_init(&info->nthread_lock);
+
+	return 0;
+}
+
+int nthread_start(struct iscsi_target *target)
+{
+	int err = 0;
+	struct network_thread_info *info = &target->nthread_info;
+	struct task_struct *task;
+
+	if (info->task) {
+		eprintk("Target (%u) already runs\n", target->tid);
+		return -EALREADY;
+	}
+
+	task = kthread_run(istd, target, "istd%d", target->tid);
+
+	if (IS_ERR(task))
+		err = PTR_ERR(task);
+	else
+		info->task = task;
+
+	return err;
+}
+
+int nthread_stop(struct iscsi_target *target)
+{
+	int err;
+	struct network_thread_info *info = &target->nthread_info;
+
+	if (!info->task)
+		return -ESRCH;
+
+	err = kthread_stop(info->task);
+
+	if (err < 0 && err != -EINTR)
+		return err;
+
+	info->task = NULL;
+
+	return 0;
+}
--- linux-rt-2.6.31.orig/ubuntu/iscsitarget/iscsi_hdr.h
+++ linux-rt-2.6.31/ubuntu/iscsitarget/iscsi_hdr.h
@@ -0,0 +1,509 @@
+/*
+ * Copyright (C) 2002-2003 Ardis Technolgies <roman@ardistech.com>
+ *
+ * Released under the terms of the GNU GPL v2.0.
+ */
+
+#ifndef __ISCSI_HDR_H__
+#define __ISCSI_HDR_H__
+
+#include <linux/types.h>
+#include <asm/byteorder.h>
+
+#define ISCSI_VERSION			0
+
+#ifndef __packed
+#define __packed __attribute__ ((packed))
+#endif
+
+struct iscsi_hdr {
+	u8  opcode;			/* 0 */
+	u8  flags;
+	u8  spec1[2];
+#if defined(__BIG_ENDIAN_BITFIELD)
+	struct {			/* 4 */
+		unsigned ahslength : 8;
+		unsigned datalength : 24;
+	} length;
+#elif defined(__LITTLE_ENDIAN_BITFIELD)
+	u32 length;			/* 4 */
+#endif
+	u16 lun[4];			/* 8 */
+	u32 itt;			/* 16 */
+	u32 ttt;			/* 20 */
+	u32 sn;				/* 24 */
+	u32 exp_sn;			/* 28 */
+	u32 max_sn;			/* 32 */
+	u32 spec3[3];			/* 36 */
+} __packed;				/* 48 */
+
+/* Opcode encoding bits */
+#define ISCSI_OP_RETRY			0x80
+#define ISCSI_OP_IMMEDIATE		0x40
+#define ISCSI_OPCODE_MASK		0x3F
+
+/* Client to Server Message Opcode values */
+#define ISCSI_OP_NOOP_OUT		0x00
+#define ISCSI_OP_SCSI_CMD		0x01
+#define ISCSI_OP_SCSI_TASK_MGT_MSG	0x02
+#define ISCSI_OP_LOGIN_CMD		0x03
+#define ISCSI_OP_TEXT_CMD		0x04
+#define ISCSI_OP_SCSI_DATA_OUT		0x05
+#define ISCSI_OP_LOGOUT_CMD		0x06
+#define ISCSI_OP_SNACK_CMD		0x10
+
+#define ISCSI_OP_VENDOR1_CMD		0x1c
+#define ISCSI_OP_VENDOR2_CMD		0x1d
+#define ISCSI_OP_VENDOR3_CMD		0x1e
+#define ISCSI_OP_VENDOR4_CMD		0x1f
+
+/* Server to Client Message Opcode values */
+#define ISCSI_OP_NOOP_IN		0x20
+#define ISCSI_OP_SCSI_RSP		0x21
+#define ISCSI_OP_SCSI_TASK_MGT_RSP	0x22
+#define ISCSI_OP_LOGIN_RSP		0x23
+#define ISCSI_OP_TEXT_RSP		0x24
+#define ISCSI_OP_SCSI_DATA_IN		0x25
+#define ISCSI_OP_LOGOUT_RSP		0x26
+#define ISCSI_OP_R2T			0x31
+#define ISCSI_OP_ASYNC_MSG		0x32
+#define ISCSI_OP_REJECT			0x3f
+
+struct iscsi_ahs_hdr {
+	u16 ahslength;
+	u8 ahstype;
+} __packed;
+
+#define ISCSI_AHSTYPE_CDB		1
+#define ISCSI_AHSTYPE_RLENGTH		2
+
+union iscsi_sid {
+	struct {
+		u8 isid[6];		/* Initiator Session ID */
+		u16 tsih;		/* Target Session ID */
+	} id;
+	u64 id64;
+} __packed;
+
+struct iscsi_scsi_cmd_hdr {
+	u8  opcode;
+	u8  flags;
+	u16 rsvd1;
+	u8  ahslength;
+	u8  datalength[3];
+	u16 lun[4];
+	u32 itt;
+	u32 data_length;
+	u32 cmd_sn;
+	u32 exp_stat_sn;
+	u8  scb[16];
+} __packed;
+
+#define ISCSI_CMD_FINAL		0x80
+#define ISCSI_CMD_READ		0x40
+#define ISCSI_CMD_WRITE		0x20
+#define ISCSI_CMD_ATTR_MASK	0x07
+#define ISCSI_CMD_UNTAGGED	0x00
+#define ISCSI_CMD_SIMPLE	0x01
+#define ISCSI_CMD_ORDERED	0x02
+#define ISCSI_CMD_HEAD_OF_QUEUE	0x03
+#define ISCSI_CMD_ACA		0x04
+
+struct iscsi_cdb_ahdr {
+	u16 ahslength;
+	u8  ahstype;
+	u8  reserved;
+	u8  cdb[0];
+} __packed;
+
+struct iscsi_rlength_ahdr {
+	u16 ahslength;
+	u8  ahstype;
+	u8  reserved;
+	u32 read_length;
+} __packed;
+
+struct iscsi_scsi_rsp_hdr {
+	u8  opcode;
+	u8  flags;
+	u8  response;
+	u8  cmd_status;
+	u8  ahslength;
+	u8  datalength[3];
+	u32 rsvd1[2];
+	u32 itt;
+	u32 snack;
+	u32 stat_sn;
+	u32 exp_cmd_sn;
+	u32 max_cmd_sn;
+	u32 exp_data_sn;
+	u32 bi_residual_count;
+	u32 residual_count;
+} __packed;
+
+#define ISCSI_FLG_RESIDUAL_UNDERFLOW		0x02
+#define ISCSI_FLG_RESIDUAL_OVERFLOW		0x04
+#define ISCSI_FLG_BIRESIDUAL_UNDERFLOW		0x08
+#define ISCSI_FLG_BIRESIDUAL_OVERFLOW		0x10
+
+#define ISCSI_RESPONSE_COMMAND_COMPLETED	0x00
+#define ISCSI_RESPONSE_TARGET_FAILURE		0x01
+
+struct iscsi_sense_data {
+	u16 length;
+	u8  data[0];
+} __packed;
+
+struct iscsi_task_mgt_hdr {
+	u8  opcode;
+	u8  function;
+	u16 rsvd1;
+	u8  ahslength;
+	u8  datalength[3];
+	u16 lun[4];
+	u32 itt;
+	u32 rtt;
+	u32 cmd_sn;
+	u32 exp_stat_sn;
+	u32 ref_cmd_sn;
+	u32 exp_data_sn;
+	u32 rsvd2[2];
+} __packed;
+
+#define ISCSI_FUNCTION_MASK			0x7f
+
+#define ISCSI_FUNCTION_ABORT_TASK		1
+#define ISCSI_FUNCTION_ABORT_TASK_SET		2
+#define ISCSI_FUNCTION_CLEAR_ACA		3
+#define ISCSI_FUNCTION_CLEAR_TASK_SET		4
+#define ISCSI_FUNCTION_LOGICAL_UNIT_RESET	5
+#define ISCSI_FUNCTION_TARGET_WARM_RESET	6
+#define ISCSI_FUNCTION_TARGET_COLD_RESET	7
+#define ISCSI_FUNCTION_TASK_REASSIGN		8
+
+struct iscsi_task_rsp_hdr {
+	u8  opcode;
+	u8  flags;
+	u8  response;
+	u8  rsvd1;
+	u8  ahslength;
+	u8  datalength[3];
+	u32 rsvd2[2];
+	u32 itt;
+	u32 rsvd3;
+	u32 stat_sn;
+	u32 exp_cmd_sn;
+	u32 max_cmd_sn;
+	u32 rsvd4[3];
+} __packed;
+
+#define ISCSI_RESPONSE_FUNCTION_COMPLETE	0
+#define ISCSI_RESPONSE_UNKNOWN_TASK		1
+#define ISCSI_RESPONSE_UNKNOWN_LUN		2
+#define ISCSI_RESPONSE_TASK_ALLEGIANT		3
+#define ISCSI_RESPONSE_FAILOVER_UNSUPPORTED	4
+#define ISCSI_RESPONSE_FUNCTION_UNSUPPORTED	5
+#define ISCSI_RESPONSE_NO_AUTHORIZATION		6
+#define ISCSI_RESPONSE_FUNCTION_REJECTED	255
+
+struct iscsi_data_out_hdr {
+	u8  opcode;
+	u8  flags;
+	u16 rsvd1;
+	u8  ahslength;
+	u8  datalength[3];
+	u16 lun[4];
+	u32 itt;
+	u32 ttt;
+	u32 rsvd2;
+	u32 exp_stat_sn;
+	u32 rsvd3;
+	u32 data_sn;
+	u32 buffer_offset;
+	u32 rsvd4;
+} __packed;
+
+struct iscsi_data_in_hdr {
+	u8  opcode;
+	u8  flags;
+	u8  rsvd1;
+	u8  cmd_status;
+	u8  ahslength;
+	u8  datalength[3];
+	u32 rsvd2[2];
+	u32 itt;
+	u32 ttt;
+	u32 stat_sn;
+	u32 exp_cmd_sn;
+	u32 max_cmd_sn;
+	u32 data_sn;
+	u32 buffer_offset;
+	u32 residual_count;
+} __packed;
+
+#define ISCSI_FLG_STATUS		0x01
+
+struct iscsi_r2t_hdr {
+	u8  opcode;
+	u8  flags;
+	u16 rsvd1;
+	u8  ahslength;
+	u8  datalength[3];
+	u16 lun[4];
+	u32 itt;
+	u32 ttt;
+	u32 stat_sn;
+	u32 exp_cmd_sn;
+	u32 max_cmd_sn;
+	u32 r2t_sn;
+	u32 buffer_offset;
+	u32 data_length;
+} __packed;
+
+struct iscsi_async_msg_hdr {
+	u8  opcode;
+	u8  flags;
+	u16 rsvd1;
+	u8  ahslength;
+	u8  datalength[3];
+	u16 lun[4];
+	u32 ffffffff;
+	u32 rsvd2;
+	u32 stat_sn;
+	u32 exp_cmd_sn;
+	u32 max_cmd_sn;
+	u8  async_event;
+	u8  async_vcode;
+	u16 param1;
+	u16 param2;
+	u16 param3;
+	u32 rsvd3;
+} __packed;
+
+#define ISCSI_ASYNC_SCSI		0
+#define ISCSI_ASYNC_LOGOUT		1
+#define ISCSI_ASYNC_DROP_CONNECTION	2
+#define ISCSI_ASYNC_DROP_SESSION	3
+#define ISCSI_ASYNC_PARAM_REQUEST	4
+#define ISCSI_ASYNC_VENDOR		255
+
+struct iscsi_text_req_hdr {
+	u8  opcode;
+	u8  flags;
+	u16 rsvd1;
+	u8  ahslength;
+	u8  datalength[3];
+	u32 rsvd2[2];
+	u32 itt;
+	u32 ttt;
+	u32 cmd_sn;
+	u32 exp_stat_sn;
+	u32 rsvd3[4];
+} __packed;
+
+struct iscsi_text_rsp_hdr {
+	u8  opcode;
+	u8  flags;
+	u16 rsvd1;
+	u8  ahslength;
+	u8  datalength[3];
+	u32 rsvd2[2];
+	u32 itt;
+	u32 ttt;
+	u32 stat_sn;
+	u32 exp_cmd_sn;
+	u32 max_cmd_sn;
+	u32 rsvd3[3];
+} __packed;
+
+struct iscsi_login_req_hdr {
+	u8  opcode;
+	u8  flags;
+	u8  max_version;		/* Max. version supported */
+	u8  min_version;		/* Min. version supported */
+	u8  ahslength;
+	u8  datalength[3];
+	union iscsi_sid sid;
+	u32 itt;			/* Initiator Task Tag */
+	u16 cid;			/* Connection ID */
+	u16 rsvd1;
+	u32 cmd_sn;
+	u32 exp_stat_sn;
+	u32 rsvd2[4];
+} __packed;
+
+struct iscsi_login_rsp_hdr {
+	u8  opcode;
+	u8  flags;
+	u8  max_version;		/* Max. version supported */
+	u8  active_version;		/* Active version */
+	u8  ahslength;
+	u8  datalength[3];
+	union iscsi_sid sid;
+	u32 itt;			/* Initiator Task Tag */
+	u32 rsvd1;
+	u32 stat_sn;
+	u32 exp_cmd_sn;
+	u32 max_cmd_sn;
+	u8  status_class;		/* see Login RSP ststus classes below */
+	u8  status_detail;		/* see Login RSP Status details below */
+	u8  rsvd2[10];
+} __packed;
+
+#define ISCSI_FLG_FINAL			0x80
+#define ISCSI_FLG_TRANSIT		0x80
+#define ISCSI_FLG_CSG_SECURITY		0x00
+#define ISCSI_FLG_CSG_LOGIN		0x04
+#define ISCSI_FLG_CSG_FULL_FEATURE	0x0c
+#define ISCSI_FLG_CSG_MASK		0x0c
+#define ISCSI_FLG_NSG_SECURITY		0x00
+#define ISCSI_FLG_NSG_LOGIN		0x01
+#define ISCSI_FLG_NSG_FULL_FEATURE	0x03
+#define ISCSI_FLG_NSG_MASK		0x03
+
+/* Login Status response classes */
+#define ISCSI_STATUS_SUCCESS		0x00
+#define ISCSI_STATUS_REDIRECT		0x01
+#define ISCSI_STATUS_INITIATOR_ERR	0x02
+#define ISCSI_STATUS_TARGET_ERR		0x03
+
+/* Login Status response detail codes */
+/* Class-0 (Success) */
+#define ISCSI_STATUS_ACCEPT		0x00
+
+/* Class-1 (Redirection) */
+#define ISCSI_STATUS_TGT_MOVED_TEMP	0x01
+#define ISCSI_STATUS_TGT_MOVED_PERM	0x02
+
+/* Class-2 (Initiator Error) */
+#define ISCSI_STATUS_INIT_ERR		0x00
+#define ISCSI_STATUS_AUTH_FAILED	0x01
+#define ISCSI_STATUS_TGT_FORBIDDEN	0x02
+#define ISCSI_STATUS_TGT_NOT_FOUND	0x03
+#define ISCSI_STATUS_TGT_REMOVED	0x04
+#define ISCSI_STATUS_NO_VERSION		0x05
+#define ISCSI_STATUS_TOO_MANY_CONN	0x06
+#define ISCSI_STATUS_MISSING_FIELDS	0x07
+#define ISCSI_STATUS_CONN_ADD_FAILED	0x08
+#define ISCSI_STATUS_INV_SESSION_TYPE	0x09
+#define ISCSI_STATUS_SESSION_NOT_FOUND	0x0a
+#define ISCSI_STATUS_INV_REQ_TYPE	0x0b
+
+/* Class-3 (Target Error) */
+#define ISCSI_STATUS_TARGET_ERROR	0x00
+#define ISCSI_STATUS_SVC_UNAVAILABLE	0x01
+#define ISCSI_STATUS_NO_RESOURCES	0x02
+
+struct iscsi_logout_req_hdr {
+	u8  opcode;
+	u8  flags;
+	u16 rsvd1;
+	u8  ahslength;
+	u8  datalength[3];
+	u32 rsvd2[2];
+	u32 itt;
+	u16 cid;
+	u16 rsvd3;
+	u32 cmd_sn;
+	u32 exp_stat_sn;
+	u32 rsvd4[4];
+} __packed;
+
+struct iscsi_logout_rsp_hdr {
+	u8  opcode;
+	u8  flags;
+	u8  response;
+	u8  rsvd1;
+	u8  ahslength;
+	u8  datalength[3];
+	u32 rsvd2[2];
+	u32 itt;
+	u32 rsvd3;
+	u32 stat_sn;
+	u32 exp_cmd_sn;
+	u32 max_cmd_sn;
+	u32 rsvd4;
+	u16 time2wait;
+	u16 time2retain;
+	u32 rsvd5;
+} __packed;
+
+struct iscsi_snack_req_hdr {
+	u8  opcode;
+	u8  flags;
+	u16 rsvd1;
+	u8  ahslength;
+	u8  datalength[3];
+	u32 rsvd2[2];
+	u32 itt;
+	u32 ttt;
+	u32 rsvd3;
+	u32 exp_stat_sn;
+	u32 rsvd4[2];
+	u32 beg_run;
+	u32 run_length;
+} __packed;
+
+struct iscsi_reject_hdr {
+	u8  opcode;
+	u8  flags;
+	u8  reason;
+	u8  rsvd1;
+	u8  ahslength;
+	u8  datalength[3];
+	u32 rsvd2[2];
+	u32 ffffffff;
+	u32 rsvd3;
+	u32 stat_sn;
+	u32 exp_cmd_sn;
+	u32 max_cmd_sn;
+	u32 data_sn;
+	u32 rsvd4[2];
+} __packed;
+
+#define ISCSI_REASON_NO_FULL_FEATURE_PHASE	0x01
+#define ISCSI_REASON_DATA_DIGEST_ERROR		0x02
+#define ISCSI_REASON_DATA_SNACK_REJECT		0x03
+#define ISCSI_REASON_PROTOCOL_ERROR		0x04
+#define ISCSI_REASON_UNSUPPORTED_COMMAND	0x05
+#define ISCSI_REASON_IMMEDIATE_COMMAND_REJECT	0x06
+#define ISCSI_REASON_TASK_IN_PROGRESS		0x07
+#define ISCSI_REASON_INVALID_SNACK		0x08
+#define ISCSI_REASON_NO_BOOKMARK		0x09
+#define ISCSI_REASON_BOOKMARK_REJECT		0x0a
+#define ISCSI_REASON_NEGOTIATION_RESET		0x0b
+#define ISCSI_REASON_WAITING_LOGOUT		0x0c
+
+
+struct iscsi_nop_out_hdr {
+	u8  opcode;
+	u8  flags;
+	u16 rsvd1;
+	u8  ahslength;
+	u8  datalength[3];
+	u16 lun[4];
+	u32 itt;
+	u32 ttt;
+	u32 cmd_sn;
+	u32 exp_stat_sn;
+	u32 rsvd2[4];
+} __packed;
+
+struct iscsi_nop_in_hdr {
+	u8  opcode;
+	u8  flags;
+	u16 rsvd1;
+	u8  ahslength;
+	u8  datalength[3];
+	u16 lun[4];
+	u32 itt;
+	u32 ttt;
+	u32 stat_sn;
+	u32 exp_cmd_sn;
+	u32 max_cmd_sn;
+	u32 rsvd2[3];
+} __packed;
+
+#define ISCSI_RESERVED_TAG	(0xffffffffU)
+
+#endif	/* __ISCSI_HDR_H__ */
--- linux-rt-2.6.31.orig/ubuntu/iscsitarget/include/iet_u.h
+++ linux-rt-2.6.31/ubuntu/iscsitarget/include/iet_u.h
@@ -0,0 +1,139 @@
+#ifndef _IET_U_H
+#define _IET_U_H
+
+#define IET_VERSION_STRING	"0.4.17"
+
+/* The maximum length of 223 bytes in the RFC. */
+#define ISCSI_NAME_LEN	256
+#define ISCSI_ARGS_LEN	2048
+
+#define ISCSI_LISTEN_PORT	3260
+
+#define VENDOR_ID_LEN	8
+#define SCSI_ID_LEN	24
+#define SCSI_SN_LEN	16
+
+#ifndef aligned_u64
+#define aligned_u64 unsigned long long __attribute__((aligned(8)))
+#endif
+
+struct target_info {
+	u32 tid;
+	char name[ISCSI_NAME_LEN];
+};
+
+struct volume_info {
+	u32 tid;
+	u32 lun;
+	aligned_u64 args_ptr;
+	u32 args_len;
+};
+
+struct session_info {
+	u32 tid;
+
+	aligned_u64 sid;
+	char initiator_name[ISCSI_NAME_LEN];
+	u32 exp_cmd_sn;
+	u32 max_cmd_sn;
+};
+
+#define DIGEST_ALL	(DIGEST_NONE | DIGEST_CRC32C)
+#define DIGEST_NONE		(1 << 0)
+#define DIGEST_CRC32C           (1 << 1)
+
+struct conn_info {
+	u32 tid;
+	aligned_u64 sid;
+
+	u32 cid;
+	u32 stat_sn;
+	u32 exp_stat_sn;
+	int header_digest;
+	int data_digest;
+	int fd;
+};
+
+enum {
+	key_initial_r2t,
+	key_immediate_data,
+	key_max_connections,
+	key_max_recv_data_length,
+	key_max_xmit_data_length,
+	key_max_burst_length,
+	key_first_burst_length,
+	key_default_wait_time,
+	key_default_retain_time,
+	key_max_outstanding_r2t,
+	key_data_pdu_inorder,
+	key_data_sequence_inorder,
+	key_error_recovery_level,
+	key_header_digest,
+	key_data_digest,
+	key_ofmarker,
+	key_ifmarker,
+	key_ofmarkint,
+	key_ifmarkint,
+	session_key_last,
+};
+
+enum {
+	key_wthreads,
+	key_target_type,
+	key_queued_cmnds,
+	target_key_last,
+};
+
+enum {
+	key_session,
+	key_target,
+};
+
+struct iscsi_param_info {
+	u32 tid;
+	aligned_u64 sid;
+
+	u32 param_type;
+	u32 partial;
+
+	u32 session_param[session_key_last];
+	u32 target_param[target_key_last];
+};
+
+enum iet_event_state {
+	E_CONN_CLOSE,
+};
+
+struct iet_event {
+	u32 tid;
+	aligned_u64 sid;
+	u32 cid;
+	u32 state;
+};
+
+#define	DEFAULT_NR_WTHREADS	8
+#define	MIN_NR_WTHREADS		1
+#define	MAX_NR_WTHREADS		128
+
+#define	DEFAULT_NR_QUEUED_CMNDS	32
+#define	MIN_NR_QUEUED_CMNDS	1
+#define	MAX_NR_QUEUED_CMNDS	256
+
+#define NETLINK_IET	21
+
+#define ADD_TARGET _IOW('i', 0, struct target_info)
+#define DEL_TARGET _IOW('i', 1, struct target_info)
+#define START_TARGET _IO('i', 2)
+#define STOP_TARGET _IO('i', 3)
+#define ADD_VOLUME _IOW('i', 4, struct volume_info)
+#define DEL_VOLUME _IOW('i', 5, struct volume_info)
+#define ADD_SESSION _IOW('i', 6, struct session_info)
+#define DEL_SESSION _IOW('i', 7, struct session_info)
+#define GET_SESSION_INFO _IOWR('i', 8, struct session_info)
+#define ADD_CONN _IOW('i', 9, struct conn_info)
+#define DEL_CONN _IOW('i', 10, struct conn_info)
+#define GET_CONN_INFO _IOWR('i', 11, struct conn_info)
+#define ISCSI_PARAM_SET _IOW('i', 12, struct iscsi_param_info)
+#define ISCSI_PARAM_GET _IOWR('i', 13, struct iscsi_param_info)
+
+#endif
--- linux-rt-2.6.31.orig/ubuntu/ndiswrapper/rtl.c
+++ linux-rt-2.6.31/ubuntu/ndiswrapper/rtl.c
@@ -0,0 +1,716 @@
+/*
+ *  Copyright (C) 2003-2005 Pontus Fuchs, Giridhar Pemmasani
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ *  GNU General Public License for more details.
+ *
+ */
+
+#include "ntoskernel.h"
+#include "rtl_exports.h"
+
+wstdcall SIZE_T WIN_FUNC(RtlCompareMemory,3)
+	(const void *a, const void *b, SIZE_T len)
+{
+	size_t i;
+	char *x, *y;
+
+	x = (char *)a;
+	y = (char *)b;
+	/* MSDN says this should return number of bytes that compare as
+	 * equal. This can be interpretted as either all bytes that are
+	 * equal in 'len' bytes or that only until the bytes compare as
+	 * not equal. Initially we had it the former way, but Realtek driver
+	 * doesn't like it that way - it takes many attempts to associate
+	 * with WPA. ReactOS returns the number of bytes that are equal
+	 * upto when they compare as not equal.
+	 * According to lords at #reactos, that is the way it should be
+	 * and that msdn is wrong about it!
+	 */
+	for (i = 0; i < len && x[i] == y[i]; i++)
+		;
+	return i;
+}
+
+wstdcall void WIN_FUNC(RtlCopyMemory,3)
+	(void *dst, const void *src, SIZE_T length)
+{
+	memcpy(dst, src, length);
+}
+
+wstdcall void WIN_FUNC(RtlZeroMemory,2)
+	(void *dst, SIZE_T length)
+{
+	memset(dst, 0, length);
+}
+
+wstdcall void WIN_FUNC(RtlSecureZeroMemory,2)
+	(void *dst, SIZE_T length)
+{
+	memset(dst, 0, length);
+}
+
+wstdcall void WIN_FUNC(RtlFillMemory,3)
+	(void *dest, SIZE_T length, UCHAR fill)
+{
+	memset(dest, fill, length);
+}
+
+wstdcall void WIN_FUNC(RtlMoveMemory,3)
+	(void *dest, const void *src, SIZE_T length)
+{
+	memmove(dest, src, length);
+}
+
+wstdcall LONG WIN_FUNC(RtlCompareString,3)
+	(const struct ansi_string *s1, const struct ansi_string *s2,
+	 BOOLEAN case_insensitive)
+{
+	unsigned int len;
+	LONG ret = 0;
+	const char *p1, *p2;
+
+	ENTER2("");
+	len = min(s1->length, s2->length);
+	p1 = s1->buf;
+	p2 = s2->buf;
+	if (case_insensitive)
+		while (!ret && len--)
+			ret = toupper(*p1++) - toupper(*p2++);
+	else
+		while (!ret && len--)
+			ret = *p1++ - *p2++;
+	if (!ret)
+		ret = s1->length - s2->length;
+	EXIT2(return ret);
+}
+
+wstdcall LONG WIN_FUNC(RtlCompareUnicodeString,3)
+	(const struct unicode_string *s1, const struct unicode_string *s2,
+	 BOOLEAN case_insensitive)
+{
+	unsigned int len;
+	LONG ret = 0;
+	const wchar_t *p1, *p2;
+
+	ENTER2("");
+
+	len = min(s1->length, s2->length) / sizeof(wchar_t);
+	p1 = s1->buf;
+	p2 = s2->buf;
+	if (case_insensitive)
+		while (!ret && len--)
+			ret = toupper((u8)*p1++) - toupper((u8)*p2++);
+	else
+		while (!ret && len--)
+			ret = (u8)*p1++ - (u8)*p2++;
+	if (!ret)
+		ret = s1->length - s2->length;
+	TRACE2("len: %d, ret: %d", len, ret);
+	EXIT2(return ret);
+}
+
+wstdcall BOOLEAN WIN_FUNC(RtlEqualString,3)
+	(const struct ansi_string *s1, const struct ansi_string *s2,
+	 BOOLEAN case_insensitive)
+{
+	ENTER1("");
+	if (s1->length != s2->length)
+		return FALSE;
+	return !RtlCompareString(s1, s2, case_insensitive);
+}
+
+wstdcall BOOLEAN WIN_FUNC(RtlEqualUnicodeString,3)
+	(const struct unicode_string *s1, const struct unicode_string *s2,
+	 BOOLEAN case_insensitive)
+{
+	if (s1->length != s2->length)
+		return FALSE;
+	return !RtlCompareUnicodeString(s1, s2, case_insensitive);
+}
+
+wstdcall void WIN_FUNC(RtlCopyUnicodeString,2)
+	(struct unicode_string *dst, struct unicode_string *src)
+{
+	ENTER1("%p, %p", dst, src);
+	if (src && src->buf && dst->buf) {
+		dst->length = min(src->length, dst->max_length);
+		memcpy(dst->buf, src->buf, dst->length);
+		if (dst->length < dst->max_length)
+			dst->buf[dst->length / sizeof(dst->buf[0])] = 0;
+	} else
+		dst->length = 0;
+	EXIT1(return);
+}
+
+wstdcall void WIN_FUNC(RtlCopyString,2)
+	(struct ansi_string *dst, struct ansi_string *src)
+{
+	ENTER1("%p, %p", dst, src);
+	if (src && src->buf && dst->buf) {
+		dst->length = min(src->length, dst->max_length);
+		memcpy(dst->buf, src->buf, dst->length);
+		if (dst->length < dst->max_length)
+			dst->buf[dst->length] = 0;
+	} else
+		dst->length = 0;
+	EXIT1(return);
+}
+
+wstdcall NTSTATUS WIN_FUNC(RtlAppendUnicodeToString,2)
+	(struct unicode_string *dst, wchar_t *src)
+{
+	if (src) {
+		int len;
+		for (len = 0; src[len]; len++)
+			;
+		if (dst->length + (len * sizeof(dst->buf[0])) > dst->max_length)
+			return STATUS_BUFFER_TOO_SMALL;
+		memcpy(&dst->buf[dst->length], src, len * sizeof(dst->buf[0]));
+		dst->length += len * sizeof(dst->buf[0]);
+		if (dst->max_length > dst->length)
+			dst->buf[dst->length / sizeof(dst->buf[0])] = 0;
+	}
+	return STATUS_SUCCESS;
+}
+
+wstdcall NTSTATUS WIN_FUNC(RtlAppendUnicodeStringToString,2)
+	(struct unicode_string *dst, struct unicode_string *src)
+{
+	if (dst->max_length < src->length + dst->length)
+		return STATUS_BUFFER_TOO_SMALL;
+	if (src->length) {
+		memcpy(&dst->buf[dst->length], src->buf, src->length);
+		dst->length += src->length;
+		if (dst->max_length > dst->length)
+			dst->buf[dst->length / sizeof(dst->buf[0])] = 0;
+	}
+	EXIT2(return STATUS_SUCCESS);
+}
+
+wstdcall ULONG WIN_FUNC(RtlxAnsiStringToUnicodeSize,1)
+	(const struct ansi_string *string)
+{
+	int i;
+
+	for (i = 0; i < string->max_length && string->buf[i]; i++)
+		;
+	return i * sizeof(wchar_t);
+}
+
+wstdcall ULONG WIN_FUNC(RtlxUnicodeStringToAnsiSize,1)
+	(const struct unicode_string *string)
+{
+	int i;
+
+	for (i = 0; i < string->max_length && string->buf[i]; i++)
+		;
+	return i;
+}
+
+wstdcall NTSTATUS WIN_FUNC(RtlAnsiStringToUnicodeString,3)
+	(struct unicode_string *dst, const struct ansi_string *src,
+	 BOOLEAN alloc)
+{
+	int i, n;
+
+	n = RtlxAnsiStringToUnicodeSize(src);
+	TRACE2("%d, %d, %d, %d, %p", n, dst->max_length, src->length,
+	       src->max_length, src->buf);
+	if (alloc == TRUE) {
+#if 0
+		if (n == 0) {
+			dst->length = dst->max_length = 0;
+			dst->buf = NULL;
+			EXIT2(return STATUS_SUCCESS);
+		}
+#endif
+		dst->max_length = n + sizeof(dst->buf[0]);
+		dst->buf = ExAllocatePoolWithTag(NonPagedPool,
+						 dst->max_length, 0);
+		if (!dst->buf) {
+			dst->max_length = dst->length = 0;
+			EXIT2(return STATUS_NO_MEMORY);
+		}
+	} else if (dst->max_length < n)
+		EXIT2(return STATUS_BUFFER_TOO_SMALL);
+
+	dst->length = n;
+	n /= sizeof(dst->buf[0]);
+	for (i = 0; i < n; i++)
+		dst->buf[i] = src->buf[i];
+	if (i * sizeof(dst->buf[0]) < dst->max_length)
+		dst->buf[i] = 0;
+	TRACE2("dst: length: %d, max_length: %d, string: %p",
+	       dst->length, dst->max_length, src->buf);
+	EXIT2(return STATUS_SUCCESS);
+}
+
+wstdcall NTSTATUS WIN_FUNC(RtlUnicodeStringToAnsiString,3)
+	(struct ansi_string *dst, const struct unicode_string *src,
+	 BOOLEAN alloc)
+{
+	int i, n;
+
+	n = RtlxUnicodeStringToAnsiSize(src);
+	TRACE2("%d, %d, %d, %d, %p", n, dst->max_length, src->length,
+	       src->max_length, src->buf);
+	if (alloc == TRUE) {
+#if 0
+		if (n == 0) {
+			dst->length = dst->max_length = 0;
+			dst->buf = NULL;
+			EXIT2(return STATUS_SUCCESS);
+		}
+#endif
+		dst->max_length = n + sizeof(dst->buf[0]);
+		dst->buf = ExAllocatePoolWithTag(NonPagedPool,
+						 dst->max_length, 0);
+		if (!dst->buf) {
+			dst->max_length = dst->length = 0;
+			EXIT1(return STATUS_NO_MEMORY);
+		}
+	} else if (dst->max_length < n)
+		EXIT2(return STATUS_BUFFER_TOO_SMALL);
+
+	dst->length = n;
+	for (i = 0; i < n; i++)
+		dst->buf[i] = src->buf[i];
+	if (i < dst->max_length)
+		dst->buf[i] = 0;
+	TRACE2("string: %p, len: %d(%d)", dst->buf, dst->length,
+	       dst->max_length);
+	EXIT2(return STATUS_SUCCESS);
+}
+
+wstdcall NTSTATUS WIN_FUNC(RtlUnicodeStringToInteger,3)
+	(struct unicode_string *ustring, ULONG base, ULONG *value)
+{
+	int i, sign = 1;
+	ULONG res;
+	typeof(ustring->buf) string;
+
+	if (ustring->length == 0) {
+		*value = 0;
+		return STATUS_SUCCESS;
+	}
+
+	string = ustring->buf;
+	i = 0;
+	while (i < (ustring->length / sizeof(*string)) && string[i] == ' ')
+		i++;
+	if (string[i] == '+')
+		i++;
+	else if (string[i] == '-') {
+		i++;
+		sign = -1;
+	}
+	if (base == 0) {
+		base = 10;
+		if (i <= ((ustring->length / sizeof(*string)) - 2) &&
+		    string[i] == '0') {
+			i++;
+			if (string[i] == 'b') {
+				base = 2;
+				i++;
+			} else if (string[i] == 'o') {
+				base = 8;
+				i++;
+			} else if (string[i] == 'x') {
+				base = 16;
+				i++;
+			}
+		}
+	}
+	if (!(base == 2 || base == 8 || base == 10 || base == 16))
+		EXIT2(return STATUS_INVALID_PARAMETER);
+
+	for (res = 0; i < (ustring->length / sizeof(*string)); i++) {
+		int v;
+		if (isdigit((char)string[i]))
+			v = string[i] - '0';
+		else if (isxdigit((char)string[i]))
+			v = tolower((char)string[i]) - 'a' + 10;
+		else
+			v = base;
+		if (v >= base)
+			EXIT2(return STATUS_INVALID_PARAMETER);
+		res = res * base + v;
+	}
+	*value = sign * res;
+	EXIT3(return STATUS_SUCCESS);
+}
+
+wstdcall NTSTATUS WIN_FUNC(RtlCharToInteger,3)
+	(const char *string, ULONG base, ULONG *value)
+{
+	int sign = 1;
+	ULONG res;
+
+	if (!string || !value)
+		EXIT2(return STATUS_INVALID_PARAMETER);
+	while (*string == ' ')
+		string++;
+	if (*string == '+')
+		string++;
+	else if (*string == '-') {
+		string++;
+		sign = -1;
+	}
+	if (base == 0) {
+		base = 10;
+		if (*string == '0') {
+			string++;
+			if (*string == 'b') {
+				base = 2;
+				string++;
+			} else if (*string == 'o') {
+				base = 8;
+				string++;
+			} else if (*string == 'x') {
+				base = 16;
+				string++;
+			}
+		}
+	}
+	if (!(base == 2 || base == 8 || base == 10 || base == 16))
+		EXIT2(return STATUS_INVALID_PARAMETER);
+
+	for (res = 0; *string; string++) {
+		int v;
+		if (isdigit(*string))
+			v = *string - '0';
+		else if (isxdigit(*string))
+			v = tolower(*string) - 'a' + 10;
+		else
+			v = base;
+		if (v >= base)
+			EXIT2(return STATUS_INVALID_PARAMETER);
+		res = res * base + v;
+	}
+	*value = sign * res;
+	EXIT3(return STATUS_SUCCESS);
+}
+
+wstdcall NTSTATUS WIN_FUNC(RtlIntegerToUnicodeString,3)
+	(ULONG value, ULONG base, struct unicode_string *ustring)
+{
+	typeof(ustring->buf) buf = ustring->buf;
+	int i;
+
+	if (base == 0)
+		base = 10;
+	if (!(base == 2 || base == 8 || base == 10 || base == 16))
+		return STATUS_INVALID_PARAMETER;
+	for (i = 0; value && i < ustring->max_length / sizeof(*buf); i++) {
+		int r;
+		r = value % base;
+		value /= base;
+		if (r < 10)
+			buf[i] = r + '0';
+		else
+			buf[i] = r + 'a' - 10;
+	}
+	if (value)
+		return STATUS_BUFFER_OVERFLOW;
+	ustring->length = i * sizeof(*buf);
+	return STATUS_SUCCESS;
+}
+
+wstdcall LARGE_INTEGER WIN_FUNC(RtlConvertUlongToLargeInteger,1)
+	(ULONG ul)
+{
+	LARGE_INTEGER li = ul;
+	return li;
+}
+
+wfastcall USHORT WIN_FUNC(RtlUshortByteSwap,1)
+	(USHORT src)
+{
+	return __swab16(src);
+}
+
+wfastcall ULONG WIN_FUNC(RtlUlongByteSwap,1)
+	(ULONG src)
+{
+	/* ULONG is 32 bits for both 32-bit and 64-bit architectures */
+	return __swab32(src);
+}
+
+wstdcall NTSTATUS WIN_FUNC(RtlUpcaseUnicodeString,3)
+	(struct unicode_string *dst, struct unicode_string *src, BOOLEAN alloc)
+{
+	USHORT i, n;
+
+	if (alloc) {
+		dst->buf = ExAllocatePoolWithTag(NonPagedPool, src->length, 0);
+		if (dst->buf)
+			dst->max_length = src->length;
+		else
+			EXIT2(return STATUS_NO_MEMORY);
+	} else {
+		if (dst->max_length < src->length)
+			EXIT2(return STATUS_BUFFER_OVERFLOW);
+	}
+
+	n = src->length / sizeof(src->buf[0]);
+	for (i = 0; i < n; i++)
+		dst->buf[i] = toupper(src->buf[i]);
+
+	dst->length = src->length;
+	EXIT3(return STATUS_SUCCESS);
+}
+
+wstdcall void WIN_FUNC(RtlInitUnicodeString,2)
+	(struct unicode_string *dst, const wchar_t *src)
+{
+	ENTER2("%p", dst);
+	if (dst == NULL)
+		EXIT1(return);
+	if (src == NULL) {
+		dst->max_length = dst->length = 0;
+		dst->buf = NULL;
+	} else {
+		int i;
+		for (i = 0; (char)src[i]; i++)
+			;
+		dst->buf = (typeof(dst->buf))src;
+		dst->length = i * sizeof(dst->buf[0]);
+		dst->max_length = (i + 1) * sizeof(dst->buf[0]);
+	}
+	EXIT1(return);
+}
+
+wstdcall void WIN_FUNC(RtlInitAnsiString,2)
+	(struct ansi_string *dst, const char *src)
+{
+	ENTER2("%p", dst);
+	if (dst == NULL)
+		EXIT2(return);
+	if (src == NULL) {
+		dst->max_length = dst->length = 0;
+		dst->buf = NULL;
+	} else {
+		int i;
+		for (i = 0; src[i]; i++)
+			;
+		dst->buf = (typeof(dst->buf))src;
+		dst->length = i;
+		dst->max_length = i + 1;
+	}
+	TRACE2("%p", dst->buf);
+	EXIT2(return);
+}
+
+wstdcall void WIN_FUNC(RtlInitString,2)
+	(struct ansi_string *dst, const char *src)
+{
+	ENTER2("%p", dst);
+	RtlInitAnsiString(dst, src);
+	EXIT2(return);
+}
+
+wstdcall void WIN_FUNC(RtlFreeUnicodeString,1)
+	(struct unicode_string *string)
+{
+	ENTER2("%p", string);
+	if (string == NULL)
+		return;
+	if (string->buf)
+		ExFreePool(string->buf);
+	string->length = string->max_length = 0;
+	string->buf = NULL;
+	return;
+}
+
+wstdcall void WIN_FUNC(RtlFreeAnsiString,1)
+	(struct ansi_string *string)
+{
+	ENTER2("%p", string);
+	if (string == NULL)
+		return;
+	if (string->buf)
+		ExFreePool(string->buf);
+	string->length = string->max_length = 0;
+	string->buf = NULL;
+	return;
+}
+
+/* guid string is of the form: {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} */
+wstdcall NTSTATUS WIN_FUNC(RtlGUIDFromString,2)
+	(struct unicode_string *guid_string, struct guid *guid)
+{
+	struct ansi_string ansi;
+	NTSTATUS ret;
+	int i, j, k, l, m;
+
+	ret = RtlUnicodeStringToAnsiString(&ansi, guid_string, TRUE);
+	if (ret != STATUS_SUCCESS)
+		return ret;
+	if (ansi.length != 37 || ansi.buf[0] != '{' ||
+	    ansi.buf[36] != '}' || ansi.buf[9] != '-' ||
+	    ansi.buf[14] != '-' || ansi.buf[19] != '-' ||
+	    ansi.buf[24] != '-') {
+		RtlFreeAnsiString(&ansi);
+		EXIT2(return STATUS_INVALID_PARAMETER);
+	}
+	memcpy(&guid->data4, &ansi.buf[29], sizeof(guid->data3));
+	/* set end of data3 for scanf */
+	ansi.buf[29] = 0;
+	if (sscanf(&ansi.buf[1], "%x", &i) == 1 &&
+	    sscanf(&ansi.buf[10], "%x", &j) == 1 &&
+	    sscanf(&ansi.buf[15], "%x", &k) == 1 &&
+	    sscanf(&ansi.buf[20], "%x", &l) == 1 &&
+	    sscanf(&ansi.buf[25], "%x", &m) == 1) {
+		guid->data1 = (i << 16) | (j < 8) | k;
+		guid->data2 = l;
+		guid->data3 = m;
+		ret = STATUS_SUCCESS;
+	} else
+		ret = STATUS_INVALID_PARAMETER;
+	RtlFreeAnsiString(&ansi);
+	return ret;
+}
+
+wstdcall NTSTATUS WIN_FUNC(RtlQueryRegistryValues,5)
+	(ULONG relative, wchar_t *path, struct rtl_query_registry_table *tbl,
+	 void *context, void *env)
+{
+	struct ansi_string ansi;
+	struct unicode_string unicode;
+	NTSTATUS status, ret;
+	static int i = 0;
+
+	ENTER3("%x, %p", relative, tbl);
+//	TODO();
+
+	RtlInitUnicodeString(&unicode, path);
+	if (RtlUnicodeStringToAnsiString(&ansi, &unicode, TRUE) ==
+	    STATUS_SUCCESS) {
+		TRACE2("%s", ansi.buf);
+		RtlFreeAnsiString(&ansi);
+	}
+	ret = STATUS_SUCCESS;
+	for (; tbl->name; tbl++) {
+		RtlInitUnicodeString(&unicode, tbl->name);
+		if (RtlUnicodeStringToAnsiString(&ansi, &unicode, TRUE) ==
+		    STATUS_SUCCESS) {
+			TRACE2("name: %s", ansi.buf);
+			RtlFreeAnsiString(&ansi);
+		}
+		TRACE2("flags: %08X", tbl->flags);
+		if (tbl->flags == RTL_QUERY_REGISTRY_DIRECT) {
+			TRACE2("type: %08X", tbl->def_type);
+			if (tbl->def_type == REG_DWORD) {
+				/* Atheros USB driver needs this, but
+				 * don't know where and how to get its
+				 * value */
+				if (tbl->def_data) {
+					TRACE2("def_data: %x",
+					       *(int *)tbl->def_data);
+					*(DWORD *)tbl->context = 0x5f292a + i++;
+//						*(DWORD *)tbl->def_data;
+				} else
+					*(DWORD *)tbl->context = 0x2345dbe;
+			}
+		} else {
+			void *data;
+			ULONG type, length;
+
+			if (!tbl->query_func) {
+				ERROR("oops: no query_func");
+				ret = STATUS_INVALID_PARAMETER;
+				break;
+			}
+			if (tbl->flags & RTL_QUERY_REGISTRY_NOVALUE) {
+				data = NULL;
+				type = REG_NONE;
+				length = 0;
+			} else {
+				data = tbl->def_data;
+				type = tbl->def_type;
+				length = tbl->def_length;;
+			}
+			TRACE2("calling query_func: %p", tbl->query_func);
+			status = LIN2WIN6(tbl->query_func, tbl->name, type,
+					  data, length, context, env);
+			TRACE2("status: %08X", status);
+			if (status) {
+				if (status == STATUS_BUFFER_TOO_SMALL)
+					ret = STATUS_BUFFER_TOO_SMALL;
+				else
+					EXIT2(return STATUS_INVALID_PARAMETER);
+			}
+		}
+	}
+	EXIT3(return ret);
+}
+
+wstdcall NTSTATUS WIN_FUNC(RtlWriteRegistryValue,6)
+	(ULONG relative, wchar_t *path, wchar_t *name, ULONG type,
+	 void *data, ULONG length)
+{
+	struct ansi_string ansi;
+	struct unicode_string unicode;
+
+	ENTER3("%d", relative);
+	TODO();
+
+	RtlInitUnicodeString(&unicode, path);
+	if (RtlUnicodeStringToAnsiString(&ansi, &unicode, TRUE) ==
+	    STATUS_SUCCESS) {
+		TRACE2("%s", ansi.buf);
+		RtlFreeAnsiString(&ansi);
+	}
+	RtlInitUnicodeString(&unicode, name);
+	if (RtlUnicodeStringToAnsiString(&ansi, &unicode, TRUE) ==
+	    STATUS_SUCCESS) {
+		TRACE2("%s", ansi.buf);
+		RtlFreeAnsiString(&ansi);
+	}
+	EXIT5(return STATUS_SUCCESS);
+}
+
+wstdcall NTSTATUS WIN_FUNC(RtlDeleteRegistryValue,3)
+	(ULONG relative, wchar_t *path, wchar_t *name)
+{
+	return STATUS_SUCCESS;
+}
+
+wstdcall void WIN_FUNC(RtlAssert,4)
+	(char *failed_assertion, char *file_name, ULONG line_num, char *message)
+{
+	ERROR("assertion '%s' failed at %s line %d%s",
+	      failed_assertion, file_name, line_num, message ? message : "");
+	return;
+}
+
+wstdcall void WIN_FUNC(RtlUnwind,0)
+	(void)
+{
+	TODO();
+}
+
+wstdcall void WIN_FUNC(RtlRaiseException,1)
+	(void *exception_record)
+{
+	TODO();
+}
+
+int rtl_init(void)
+{
+	return 0;
+}
+
+/* called when module is being removed */
+void rtl_exit(void)
+{
+	EXIT4(return);
+}
--- linux-rt-2.6.31.orig/ubuntu/ndiswrapper/ntoskernel_io.c
+++ linux-rt-2.6.31/ubuntu/ndiswrapper/ntoskernel_io.c
@@ -0,0 +1,1106 @@
+/*
+ *  Copyright (C) 2003-2005 Pontus Fuchs, Giridhar Pemmasani
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ *  GNU General Public License for more details.
+ *
+ */
+
+#include "ntoskernel.h"
+#include "ndis.h"
+#include "wrapndis.h"
+#include "usb.h"
+#include "loader.h"
+#include "ntoskernel_io_exports.h"
+
+wstdcall void WIN_FUNC(IoAcquireCancelSpinLock,1)
+	(KIRQL *irql) __acquires(irql)
+{
+	spin_lock_bh(&irp_cancel_lock);
+	*irql = 0;
+}
+
+wstdcall void WIN_FUNC(IoReleaseCancelSpinLock,1)
+	(KIRQL irql) __releases(irql)
+{
+	spin_unlock_bh(&irp_cancel_lock);
+}
+
+wstdcall int WIN_FUNC(IoIsWdmVersionAvailable,2)
+	(UCHAR major, UCHAR minor)
+{
+	IOENTER("%d, %x", major, minor);
+	if (major == 1 &&
+	    (minor == 0x30 || // Windows 2003
+	     minor == 0x20 || // Windows XP
+	     minor == 0x10)) // Windows 2000
+		IOEXIT(return TRUE);
+	IOEXIT(return FALSE);
+}
+
+wstdcall BOOLEAN WIN_FUNC(IoIs32bitProcess,1)
+	(struct irp *irp)
+{
+#ifdef CONFIG_X86_64
+	return FALSE;
+#else
+	return TRUE;
+#endif
+}
+
+wstdcall void WIN_FUNC(IoInitializeIrp,3)
+	(struct irp *irp, USHORT size, CCHAR stack_count)
+{
+	IOENTER("irp: %p, %d, %d", irp, size, stack_count);
+
+	memset(irp, 0, size);
+	irp->size = size;
+	irp->stack_count = stack_count;
+	irp->current_location = stack_count;
+	IoGetCurrentIrpStackLocation(irp) = IRP_SL(irp, stack_count);
+	IOEXIT(return);
+}
+
+wstdcall void WIN_FUNC(IoReuseIrp,2)
+	(struct irp *irp, NTSTATUS status)
+{
+	IOENTER("%p, %d", irp, status);
+	if (irp) {
+		UCHAR alloc_flags;
+
+		alloc_flags = irp->alloc_flags;
+		IoInitializeIrp(irp, irp->size, irp->stack_count);
+		irp->alloc_flags = alloc_flags;
+		irp->io_status.status = status;
+	}
+	IOEXIT(return);
+}
+
+wstdcall struct irp *WIN_FUNC(IoAllocateIrp,2)
+	(char stack_count, BOOLEAN charge_quota)
+{
+	struct irp *irp;
+	int irp_size;
+
+	IOENTER("count: %d", stack_count);
+	stack_count++;
+	irp_size = IoSizeOfIrp(stack_count);
+	irp = kmalloc(irp_size, irql_gfp());
+	if (irp)
+		IoInitializeIrp(irp, irp_size, stack_count);
+	IOTRACE("irp %p", irp);
+	IOEXIT(return irp);
+}
+
+wstdcall BOOLEAN WIN_FUNC(IoCancelIrp,1)
+	(struct irp *irp)
+{
+	typeof(irp->cancel_routine) cancel_routine;
+
+	/* NB: this function may be called at DISPATCH_LEVEL */
+	IOTRACE("irp: %p", irp);
+	if (!irp)
+		return FALSE;
+	DUMP_IRP(irp);
+	IoAcquireCancelSpinLock(&irp->cancel_irql);
+	cancel_routine = xchg(&irp->cancel_routine, NULL);
+	IOTRACE("%p", cancel_routine);
+	irp->cancel = TRUE;
+	if (cancel_routine) {
+		struct io_stack_location *irp_sl;
+		irp_sl = IoGetCurrentIrpStackLocation(irp);
+		IOTRACE("%p, %p", irp_sl, irp_sl->dev_obj);
+		/* cancel_routine will release the spin lock */
+		__release(irp->cancel_irql);
+		LIN2WIN2(cancel_routine, irp_sl->dev_obj, irp);
+		/* in usb's cancel, irp->cancel is set to indicate
+		 * status of cancel */
+		IOEXIT(return xchg(&irp->cancel, TRUE));
+	} else {
+		IOTRACE("irp %p already canceled", irp);
+		IoReleaseCancelSpinLock(irp->cancel_irql);
+		IOEXIT(return FALSE);
+	}
+}
+
+wstdcall void IoQueueThreadIrp(struct irp *irp)
+{
+	struct nt_thread *thread;
+	KIRQL irql;
+
+	thread = get_current_nt_thread();
+	if (thread) {
+		IOTRACE("thread: %p, task: %p", thread, thread->task);
+		irp->flags |= IRP_SYNCHRONOUS_API;
+		irql = nt_spin_lock_irql(&thread->lock, DISPATCH_LEVEL);
+		InsertTailList(&thread->irps, &irp->thread_list);
+		IoIrpThread(irp) = thread;
+		nt_spin_unlock_irql(&thread->lock, irql);
+	} else
+		IoIrpThread(irp) = NULL;
+}
+
+wstdcall void IoDequeueThreadIrp(struct irp *irp)
+{
+	struct nt_thread *thread;
+	KIRQL irql;
+
+	thread = IoIrpThread(irp);
+	if (thread) {
+		irql = nt_spin_lock_irql(&thread->lock, DISPATCH_LEVEL);
+		RemoveEntryList(&irp->thread_list);
+		nt_spin_unlock_irql(&thread->lock, irql);
+	}
+}
+
+wstdcall void WIN_FUNC(IoFreeIrp,1)
+	(struct irp *irp)
+{
+	IOENTER("irp = %p", irp);
+	if (irp->flags & IRP_SYNCHRONOUS_API)
+		IoDequeueThreadIrp(irp);
+	kfree(irp);
+
+	IOEXIT(return);
+}
+
+wstdcall struct irp *WIN_FUNC(IoBuildAsynchronousFsdRequest,6)
+	(ULONG major_fn, struct device_object *dev_obj, void *buffer,
+	 ULONG length, LARGE_INTEGER *offset,
+	 struct io_status_block *user_status)
+{
+	struct irp *irp;
+	struct io_stack_location *irp_sl;
+
+	IOENTER("%p", dev_obj);
+	if (!dev_obj)
+		IOEXIT(return NULL);
+	irp = IoAllocateIrp(dev_obj->stack_count, FALSE);
+	if (irp == NULL) {
+		WARNING("couldn't allocate irp");
+		IOEXIT(return NULL);
+	}
+
+	irp_sl = IoGetNextIrpStackLocation(irp);
+	irp_sl->major_fn = major_fn;
+	IOTRACE("major_fn: %d", major_fn);
+	irp_sl->minor_fn = 0;
+	irp_sl->flags = 0;
+	irp_sl->control = 0;
+	irp_sl->dev_obj = dev_obj;
+	irp_sl->file_obj = NULL;
+	irp_sl->completion_routine = NULL;
+
+	if (dev_obj->flags & DO_DIRECT_IO) {
+		irp->mdl = IoAllocateMdl(buffer, length, FALSE, FALSE, irp);
+		if (irp->mdl == NULL) {
+			IoFreeIrp(irp);
+			return NULL;
+		}
+		MmProbeAndLockPages(irp->mdl, KernelMode,
+				    major_fn == IRP_MJ_WRITE ?
+				    IoReadAccess : IoWriteAccess);
+		IOTRACE("mdl: %p", irp->mdl);
+	} else if (dev_obj->flags & DO_BUFFERED_IO) {
+		irp->associated_irp.system_buffer = buffer;
+		irp->flags = IRP_BUFFERED_IO;
+		irp->mdl = NULL;
+		IOTRACE("buffer: %p", buffer);
+	}
+	if (major_fn == IRP_MJ_READ) {
+		irp_sl->params.read.length = length;
+		irp_sl->params.read.byte_offset = *offset;
+	} else if (major_fn == IRP_MJ_WRITE) {
+		irp_sl->params.write.length = length;
+		irp_sl->params.write.byte_offset = *offset;
+	}
+	irp->user_status = user_status;
+	IOTRACE("irp: %p", irp);
+	return irp;
+}
+
+wstdcall struct irp *WIN_FUNC(IoBuildSynchronousFsdRequest,7)
+	(ULONG major_fn, struct device_object *dev_obj, void *buf,
+	 ULONG length, LARGE_INTEGER *offset, struct nt_event *event,
+	 struct io_status_block *user_status)
+{
+	struct irp *irp;
+
+	irp = IoBuildAsynchronousFsdRequest(major_fn, dev_obj, buf, length,
+					    offset, user_status);
+	if (irp == NULL)
+		return NULL;
+	irp->user_event = event;
+	IoQueueThreadIrp(irp);
+	return irp;
+}
+
+wstdcall struct irp *WIN_FUNC(IoBuildDeviceIoControlRequest,9)
+	(ULONG ioctl, struct device_object *dev_obj,
+	 void *input_buf, ULONG input_buf_len, void *output_buf,
+	 ULONG output_buf_len, BOOLEAN internal_ioctl,
+	 struct nt_event *event, struct io_status_block *io_status)
+{
+	struct irp *irp;
+	struct io_stack_location *irp_sl;
+	ULONG buf_len;
+
+	IOENTER("%p, 0x%08x, %d", dev_obj, ioctl, internal_ioctl);
+	if (!dev_obj)
+		IOEXIT(return NULL);
+	irp = IoAllocateIrp(dev_obj->stack_count, FALSE);
+	if (irp == NULL) {
+		WARNING("couldn't allocate irp");
+		return NULL;
+	}
+	irp_sl = IoGetNextIrpStackLocation(irp);
+	irp_sl->params.dev_ioctl.code = ioctl;
+	irp_sl->params.dev_ioctl.input_buf_len = input_buf_len;
+	irp_sl->params.dev_ioctl.output_buf_len = output_buf_len;
+	irp_sl->major_fn = (internal_ioctl) ?
+		IRP_MJ_INTERNAL_DEVICE_CONTROL : IRP_MJ_DEVICE_CONTROL;
+	IOTRACE("%d", IO_METHOD_FROM_CTL_CODE(ioctl));
+
+	switch (IO_METHOD_FROM_CTL_CODE(ioctl)) {
+	case METHOD_BUFFERED:
+		buf_len = max(input_buf_len, output_buf_len);
+		if (buf_len) {
+			irp->associated_irp.system_buffer =
+				ExAllocatePoolWithTag(NonPagedPool, buf_len, 0);
+			if (!irp->associated_irp.system_buffer) {
+				IoFreeIrp(irp);
+				IOEXIT(return NULL);
+			}
+			irp->associated_irp.system_buffer = input_buf;
+			if (input_buf)
+				memcpy(irp->associated_irp.system_buffer,
+				       input_buf, input_buf_len);
+			irp->flags = IRP_BUFFERED_IO | IRP_DEALLOCATE_BUFFER;
+			if (output_buf)
+				irp->flags = IRP_INPUT_OPERATION;
+			irp->user_buf = output_buf;
+		} else
+			irp->user_buf = NULL;
+		break;
+	case METHOD_IN_DIRECT:
+	case METHOD_OUT_DIRECT:
+		if (input_buf) {
+			irp->associated_irp.system_buffer =
+				ExAllocatePoolWithTag(NonPagedPool,
+						      input_buf_len, 0);
+			if (!irp->associated_irp.system_buffer) {
+				IoFreeIrp(irp);
+				IOEXIT(return NULL);
+			}
+			memcpy(irp->associated_irp.system_buffer,
+			       input_buf, input_buf_len);
+			irp->flags = IRP_BUFFERED_IO | IRP_DEALLOCATE_BUFFER;
+		}
+		/* TODO: we are supposed to setup MDL, but USB layer
+		 * doesn't use MDLs. Moreover, USB layer mirrors
+		 * non-DMAable buffers, so no need to allocate
+		 * DMAable buffer here */
+		if (output_buf) {
+			irp->associated_irp.system_buffer =
+				ExAllocatePoolWithTag(NonPagedPool,
+						      output_buf_len, 0);
+			if (!irp->associated_irp.system_buffer) {
+				IoFreeIrp(irp);
+				IOEXIT(return NULL);
+			}
+			irp->flags = IRP_BUFFERED_IO | IRP_DEALLOCATE_BUFFER;
+		}
+		break;
+	case METHOD_NEITHER:
+		irp->user_buf = output_buf;
+		irp_sl->params.dev_ioctl.type3_input_buf = input_buf;
+		break;
+	}
+
+	irp->user_status = io_status;
+	irp->user_event = event;
+	IoQueueThreadIrp(irp);
+
+	IOTRACE("irp: %p", irp);
+	IOEXIT(return irp);
+}
+
+wfastcall NTSTATUS WIN_FUNC(IofCallDriver,2)
+	(struct device_object *dev_obj, struct irp *irp)
+{
+	struct io_stack_location *irp_sl;
+	NTSTATUS status;
+	driver_dispatch_t *major_func;
+	struct driver_object *drv_obj;
+
+	if (irp->current_location <= 0) {
+		ERROR("invalid irp: %p, %d", irp, irp->current_location);
+		return STATUS_INVALID_PARAMETER;
+	}
+	IOTRACE("%p, %p, %p, %d, %d, %p", dev_obj, irp, dev_obj->drv_obj,
+		irp->current_location, irp->stack_count,
+		IoGetCurrentIrpStackLocation(irp));
+	IoSetNextIrpStackLocation(irp);
+	DUMP_IRP(irp);
+	irp_sl = IoGetCurrentIrpStackLocation(irp);
+	drv_obj = dev_obj->drv_obj;
+	irp_sl->dev_obj = dev_obj;
+	major_func = drv_obj->major_func[irp_sl->major_fn];
+	IOTRACE("major_func: %p, dev_obj: %p", major_func, dev_obj);
+	if (major_func)
+		status = LIN2WIN2(major_func, dev_obj, irp);
+	else {
+		ERROR("major_function %d is not implemented",
+		      irp_sl->major_fn);
+		status = STATUS_NOT_SUPPORTED;
+	}
+	IOEXIT(return status);
+}
+
+wfastcall void WIN_FUNC(IofCompleteRequest,2)
+	(struct irp *irp, CHAR prio_boost)
+{
+	struct io_stack_location *irp_sl;
+
+#ifdef IO_DEBUG
+	DUMP_IRP(irp);
+	if (irp->io_status.status == STATUS_PENDING) {
+		ERROR("invalid irp: %p, STATUS_PENDING", irp);
+		return;
+	}
+	if (irp->current_location < 0 ||
+	    irp->current_location >= irp->stack_count) {
+		ERROR("invalid irp: %p, %d", irp, irp->current_location);
+		return;
+	}
+#endif
+	for (irp_sl = IoGetCurrentIrpStackLocation(irp);
+	     irp->current_location < irp->stack_count; irp_sl++) {
+		struct device_object *dev_obj;
+		NTSTATUS status;
+
+		DUMP_IRP(irp);
+		if (irp_sl->control & SL_PENDING_RETURNED)
+			irp->pending_returned = TRUE;
+
+		/* current_location and dev_obj must be same as when
+		 * driver called IoSetCompletionRoutine, which sets
+		 * completion routine at next (lower) location, which
+		 * is what we are going to call below; so we set
+		 * current_location and dev_obj for the previous
+		 * (higher) location */
+		IoSkipCurrentIrpStackLocation(irp);
+		if (irp->current_location < irp->stack_count)
+			dev_obj = IoGetCurrentIrpStackLocation(irp)->dev_obj;
+		else
+			dev_obj = NULL;
+
+		IOTRACE("%d, %d, %p", irp->current_location, irp->stack_count,
+			dev_obj);
+		if (irp_sl->completion_routine &&
+		    ((irp->io_status.status == STATUS_SUCCESS &&
+		      irp_sl->control & SL_INVOKE_ON_SUCCESS) ||
+		     (irp->io_status.status != STATUS_SUCCESS &&
+		      irp_sl->control & SL_INVOKE_ON_ERROR) ||
+		     (irp->cancel == TRUE &&
+		      irp_sl->control & SL_INVOKE_ON_CANCEL))) {
+			IOTRACE("calling completion_routine at: %p, %p",
+				irp_sl->completion_routine, irp_sl->context);
+			status = LIN2WIN3(irp_sl->completion_routine,
+					  dev_obj, irp, irp_sl->context);
+			IOTRACE("status: %08X", status);
+			if (status == STATUS_MORE_PROCESSING_REQUIRED)
+				IOEXIT(return);
+		} else {
+			/* propagate pending status to next irp_sl */
+			if (irp->pending_returned &&
+			    irp->current_location < irp->stack_count)
+				IoMarkIrpPending(irp);
+		}
+	}
+
+	if (irp->user_status) {
+		irp->user_status->status = irp->io_status.status;
+		irp->user_status->info = irp->io_status.info;
+	}
+
+	if (irp->user_event) {
+		IOTRACE("setting event %p", irp->user_event);
+		KeSetEvent(irp->user_event, prio_boost, FALSE);
+	}
+
+	if (irp->associated_irp.system_buffer &&
+	    (irp->flags & IRP_DEALLOCATE_BUFFER))
+		ExFreePool(irp->associated_irp.system_buffer);
+	else {
+		struct mdl *mdl;
+		while ((mdl = irp->mdl)) {
+			irp->mdl = mdl->next;
+			MmUnlockPages(mdl);
+			IoFreeMdl(mdl);
+		}
+	}
+	IOTRACE("freeing irp %p", irp);
+	IoFreeIrp(irp);
+	IOEXIT(return);
+}
+
+wstdcall NTSTATUS IoPassIrpDown(struct device_object *dev_obj, struct irp *irp)
+{
+	IoSkipCurrentIrpStackLocation(irp);
+	IOEXIT(return IoCallDriver(dev_obj, irp));
+}
+
+wstdcall NTSTATUS IoIrpSyncComplete(struct device_object *dev_obj,
+				    struct irp *irp, void *context)
+{
+	if (irp->pending_returned == TRUE)
+		KeSetEvent(context, IO_NO_INCREMENT, FALSE);
+	IOEXIT(return STATUS_MORE_PROCESSING_REQUIRED);
+}
+WIN_FUNC_DECL(IoIrpSyncComplete,3)
+
+wstdcall NTSTATUS IoSyncForwardIrp(struct device_object *dev_obj,
+				   struct irp *irp)
+{
+	struct nt_event event;
+	NTSTATUS status;
+
+	IoCopyCurrentIrpStackLocationToNext(irp);
+	KeInitializeEvent(&event, SynchronizationEvent, FALSE);
+	/* completion function is called as Windows function */
+	IoSetCompletionRoutine(irp, WIN_FUNC_PTR(IoIrpSyncComplete,3), &event,
+			       TRUE, TRUE, TRUE);
+	status = IoCallDriver(dev_obj, irp);
+	IOTRACE("%08X", status);
+	if (status == STATUS_PENDING) {
+		KeWaitForSingleObject(&event, Executive, KernelMode, FALSE,
+				      NULL);
+		status = irp->io_status.status;
+	}
+	IOTRACE("%08X", status);
+	IOEXIT(return status);
+}
+WIN_FUNC_DECL(IoSyncForwardIrp,2)
+
+wstdcall NTSTATUS IoAsyncForwardIrp(struct device_object *dev_obj,
+				    struct irp *irp)
+{
+	NTSTATUS status;
+
+	IoCopyCurrentIrpStackLocationToNext(irp);
+	status = IoCallDriver(dev_obj, irp);
+	IOEXIT(return status);
+}
+WIN_FUNC_DECL(IoAsyncForwardIrp,2)
+
+wstdcall NTSTATUS IoInvalidDeviceRequest(struct device_object *dev_obj,
+					 struct irp *irp)
+{
+	struct io_stack_location *irp_sl;
+	NTSTATUS status;
+
+	irp_sl = IoGetCurrentIrpStackLocation(irp);
+	WARNING("%d:%d not implemented", irp_sl->major_fn, irp_sl->minor_fn);
+	irp->io_status.status = STATUS_SUCCESS;
+	irp->io_status.info = 0;
+	status = irp->io_status.status;
+	IoCompleteRequest(irp, IO_NO_INCREMENT);
+	IOEXIT(return status);
+}
+WIN_FUNC_DECL(IoInvalidDeviceRequest,2)
+
+static irqreturn_t io_irq_isr(int irq, void *data ISR_PT_REGS_PARAM_DECL)
+{
+	struct kinterrupt *interrupt = data;
+	BOOLEAN ret;
+
+#ifdef CONFIG_DEBUG_SHIRQ
+	if (!interrupt->u.enabled)
+		EXIT1(return IRQ_NONE);
+#endif
+	TRACE6("%p", interrupt);
+	nt_spin_lock(interrupt->actual_lock);
+	ret = LIN2WIN2(interrupt->isr, interrupt, interrupt->isr_ctx);
+	nt_spin_unlock(interrupt->actual_lock);
+	if (ret == TRUE)
+		EXIT6(return IRQ_HANDLED);
+	else
+		EXIT6(return IRQ_NONE);
+}
+
+wstdcall NTSTATUS WIN_FUNC(IoConnectInterrupt,11)
+	(struct kinterrupt **kinterrupt, PKSERVICE_ROUTINE isr, void *isr_ctx,
+	 NT_SPIN_LOCK *lock, ULONG vector, KIRQL irql, KIRQL synch_irql,
+	 enum kinterrupt_mode mode, BOOLEAN shared, KAFFINITY cpu_mask,
+	 BOOLEAN save_fp)
+{
+	struct kinterrupt *interrupt;
+	IOENTER("");
+	interrupt = kzalloc(sizeof(*interrupt), GFP_KERNEL);
+	if (!interrupt)
+		IOEXIT(return STATUS_INSUFFICIENT_RESOURCES);
+	interrupt->vector = vector;
+	interrupt->cpu_mask = cpu_mask;
+	nt_spin_lock_init(&interrupt->lock);
+	if (lock)
+		interrupt->actual_lock = lock;
+	else
+		interrupt->actual_lock = &interrupt->lock;
+	interrupt->shared = shared;
+	interrupt->save_fp = save_fp;
+	interrupt->isr = isr;
+	interrupt->isr_ctx = isr_ctx;
+	InitializeListHead(&interrupt->list);
+	interrupt->irql = irql;
+	interrupt->synch_irql = synch_irql;
+	interrupt->mode = mode;
+	if (request_irq(vector, io_irq_isr, shared ? IRQF_SHARED : 0,
+			"ndiswrapper", interrupt)) {
+		WARNING("request for irq %d failed", vector);
+		kfree(interrupt);
+		IOEXIT(return STATUS_INSUFFICIENT_RESOURCES);
+	}
+	*kinterrupt = interrupt;
+#ifdef CONFIG_DEBUG_SHIRQ
+	interrupt->u.enabled = 1;
+#endif
+	IOEXIT(return STATUS_SUCCESS);
+}
+
+wstdcall void WIN_FUNC(IoDisconnectInterrupt,1)
+	(struct kinterrupt *interrupt)
+{
+#ifdef CONFIG_DEBUG_SHIRQ
+	interrupt->u.enabled = 0;
+#endif
+	free_irq(interrupt->vector, interrupt);
+	kfree(interrupt);
+}
+
+wstdcall struct mdl *WIN_FUNC(IoAllocateMdl,5)
+	(void *virt, ULONG length, BOOLEAN second_buf, BOOLEAN charge_quota,
+	 struct irp *irp)
+{
+	struct mdl *mdl;
+	mdl = allocate_init_mdl(virt, length);
+	if (!mdl)
+		return NULL;
+	if (irp) {
+		if (second_buf == TRUE) {
+			struct mdl *last;
+
+			last = irp->mdl;
+			while (last->next)
+				last = last->next;
+			last->next = mdl;
+		} else
+			irp->mdl = mdl;
+	}
+	IOTRACE("%p", mdl);
+	return mdl;
+}
+
+wstdcall void WIN_FUNC(IoFreeMdl,1)
+	(struct mdl *mdl)
+{
+	IOTRACE("%p", mdl);
+	free_mdl(mdl);
+}
+
+wstdcall struct io_workitem *WIN_FUNC(IoAllocateWorkItem,1)
+	(struct device_object *dev_obj)
+{
+	struct io_workitem *io_workitem;
+
+	IOENTER("%p", dev_obj);
+	io_workitem = kmalloc(sizeof(*io_workitem), irql_gfp());
+	if (!io_workitem)
+		IOEXIT(return NULL);
+	io_workitem->dev_obj = dev_obj;
+	IOEXIT(return io_workitem);
+}
+
+wstdcall void WIN_FUNC(IoFreeWorkItem,1)
+	(struct io_workitem *io_workitem)
+{
+	kfree(io_workitem);
+	IOEXIT(return);
+}
+
+wstdcall void WIN_FUNC(IoQueueWorkItem,4)
+	(struct io_workitem *io_workitem, void *func,
+	 enum work_queue_type queue_type, void *context)
+{
+	IOENTER("%p, %p", io_workitem, io_workitem->dev_obj);
+	io_workitem->worker_routine = func;
+	io_workitem->context = context;
+	schedule_ntos_work_item(func, io_workitem->dev_obj, context);
+	IOEXIT(return);
+}
+
+wstdcall void WIN_FUNC(ExQueueWorkItem,2)
+	(struct io_workitem *io_workitem, enum work_queue_type queue_type)
+{
+	IOENTER("%p", io_workitem);
+	schedule_ntos_work_item(io_workitem->worker_routine,
+				io_workitem->dev_obj, io_workitem->context);
+}
+
+wstdcall NTSTATUS WIN_FUNC(IoAllocateDriverObjectExtension,4)
+	(struct driver_object *drv_obj, void *client_id, ULONG extlen,
+	 void **ext)
+{
+	struct custom_ext *ce;
+
+	IOENTER("%p, %p", drv_obj, client_id);
+	ce = kmalloc(sizeof(*ce) + extlen, irql_gfp());
+	if (ce == NULL)
+		return STATUS_INSUFFICIENT_RESOURCES;
+
+	IOTRACE("custom_ext: %p", ce);
+	ce->client_id = client_id;
+	spin_lock_bh(&ntoskernel_lock);
+	InsertTailList(&drv_obj->drv_ext->custom_ext, &ce->list);
+	spin_unlock_bh(&ntoskernel_lock);
+
+	*ext = (void *)ce + sizeof(*ce);
+	IOTRACE("ext: %p", *ext);
+	IOEXIT(return STATUS_SUCCESS);
+}
+
+wstdcall void *WIN_FUNC(IoGetDriverObjectExtension,2)
+	(struct driver_object *drv_obj, void *client_id)
+{
+	struct custom_ext *ce;
+	void *ret;
+
+	IOENTER("drv_obj: %p, client_id: %p", drv_obj, client_id);
+	ret = NULL;
+	spin_lock_bh(&ntoskernel_lock);
+	nt_list_for_each_entry(ce, &drv_obj->drv_ext->custom_ext, list) {
+		if (ce->client_id == client_id) {
+			ret = (void *)ce + sizeof(*ce);
+			break;
+		}
+	}
+	spin_unlock_bh(&ntoskernel_lock);
+	IOTRACE("ret: %p", ret);
+	return ret;
+}
+
+void free_custom_extensions(struct driver_extension *drv_ext)
+{
+	struct nt_list *ent;
+
+	IOENTER("%p", drv_ext);
+	spin_lock_bh(&ntoskernel_lock);
+	while ((ent = RemoveHeadList(&drv_ext->custom_ext)))
+		kfree(ent);
+	spin_unlock_bh(&ntoskernel_lock);
+	IOEXIT(return);
+}
+
+wstdcall NTSTATUS WIN_FUNC(IoCreateDevice,7)
+	(struct driver_object *drv_obj, ULONG dev_ext_length,
+	 struct unicode_string *dev_name, DEVICE_TYPE dev_type,
+	 ULONG dev_chars, BOOLEAN exclusive, struct device_object **newdev)
+{
+	struct device_object *dev;
+	struct dev_obj_ext *dev_obj_ext;
+	int size;
+
+	IOENTER("%p, %u, %p", drv_obj, dev_ext_length, dev_name);
+
+	size = sizeof(*dev) + dev_ext_length + sizeof(*dev_obj_ext);
+	dev = allocate_object(size, OBJECT_TYPE_DEVICE, dev_name);
+	if (!dev)
+		IOEXIT(return STATUS_INSUFFICIENT_RESOURCES);
+	if (dev_ext_length)
+		dev->dev_ext = dev + 1;
+	else
+		dev->dev_ext = NULL;
+
+	dev_obj_ext = ((void *)(dev + 1)) + dev_ext_length;
+	dev_obj_ext->dev_obj = dev;
+	dev_obj_ext->size = 0;
+	dev_obj_ext->type = IO_TYPE_DEVICE;
+	dev->dev_obj_ext = dev_obj_ext;
+
+	dev->type = dev_type;
+	dev->flags = 0;
+	dev->size = sizeof(*dev) + dev_ext_length;
+	dev->ref_count = 1;
+	dev->attached = NULL;
+	dev->stack_count = 1;
+
+	dev->drv_obj = drv_obj;
+	dev->next = drv_obj->dev_obj;
+	drv_obj->dev_obj = dev;
+
+	dev->align_req = 1;
+	dev->characteristics = dev_chars;
+	dev->io_timer = NULL;
+	KeInitializeEvent(&dev->lock, SynchronizationEvent, TRUE);
+	dev->vpb = NULL;
+
+	IOTRACE("dev: %p, ext: %p", dev, dev->dev_ext);
+	*newdev = dev;
+	IOEXIT(return STATUS_SUCCESS);
+}
+
+wstdcall NTSTATUS WIN_FUNC(IoCreateUnprotectedSymbolicLink,2)
+	(struct unicode_string *link, struct unicode_string *dev_name)
+{
+	struct ansi_string ansi;
+
+	IOENTER("%p, %p", dev_name, link);
+	if (dev_name && (RtlUnicodeStringToAnsiString(&ansi, dev_name, TRUE) ==
+			 STATUS_SUCCESS)) {
+		IOTRACE("dev_name: %s", ansi.buf);
+		RtlFreeAnsiString(&ansi);
+	}
+	if (link && (RtlUnicodeStringToAnsiString(&ansi, link, TRUE) ==
+		     STATUS_SUCCESS)) {
+		IOTRACE("link: %s", ansi.buf);
+		RtlFreeAnsiString(&ansi);
+	}
+//	TODO();
+	IOEXIT(return STATUS_SUCCESS);
+}
+
+wstdcall NTSTATUS WIN_FUNC(IoCreateSymbolicLink,2)
+	(struct unicode_string *link, struct unicode_string *dev_name)
+{
+	IOEXIT(return IoCreateUnprotectedSymbolicLink(link, dev_name));
+}
+
+wstdcall NTSTATUS WIN_FUNC(IoDeleteSymbolicLink,1)
+	(struct unicode_string *link)
+{
+	struct ansi_string ansi;
+
+	IOENTER("%p", link);
+	if (link && (RtlUnicodeStringToAnsiString(&ansi, link, TRUE) ==
+		     STATUS_SUCCESS)) {
+		IOTRACE("dev_name: %s", ansi.buf);
+		RtlFreeAnsiString(&ansi);
+	}
+	IOEXIT(return STATUS_SUCCESS);
+}
+
+wstdcall void WIN_FUNC(IoDeleteDevice,1)
+	(struct device_object *dev)
+{
+	IOENTER("%p", dev);
+	if (dev == NULL)
+		IOEXIT(return);
+	IOTRACE("drv_obj: %p", dev->drv_obj);
+	if (dev->drv_obj) {
+		struct device_object *prev;
+
+		prev = dev->drv_obj->dev_obj;
+		IOTRACE("dev_obj: %p", prev);
+		if (prev == dev)
+			dev->drv_obj->dev_obj = dev->next;
+		else if (prev) {
+			while (prev->next != dev)
+				prev = prev->next;
+			prev->next = dev->next;
+		}
+	}
+	ObDereferenceObject(dev);
+	IOEXIT(return);
+}
+
+wstdcall void WIN_FUNC(IoDetachDevice,1)
+	(struct device_object *tgt)
+{
+	struct device_object *tail;
+
+	IOENTER("%p", tgt);
+	if (!tgt)
+		IOEXIT(return);
+	tail = tgt->attached;
+	if (!tail)
+		IOEXIT(return);
+	IOTRACE("tail: %p", tail);
+
+	spin_lock_bh(&ntoskernel_lock);
+	tgt->attached = tail->attached;
+	IOTRACE("attached:%p", tgt->attached);
+	for ( ; tail; tail = tail->attached) {
+		IOTRACE("tail:%p", tail);
+		tail->stack_count--;
+	}
+	spin_unlock_bh(&ntoskernel_lock);
+	IOEXIT(return);
+}
+
+wstdcall struct device_object *WIN_FUNC(IoGetAttachedDevice,1)
+	(struct device_object *dev)
+{
+	IOENTER("%p", dev);
+	if (!dev)
+		IOEXIT(return NULL);
+	spin_lock_bh(&ntoskernel_lock);
+	while (dev->attached)
+		dev = dev->attached;
+	spin_unlock_bh(&ntoskernel_lock);
+	IOEXIT(return dev);
+}
+
+wstdcall struct device_object *WIN_FUNC(IoGetAttachedDeviceReference,1)
+	(struct device_object *dev)
+{
+	IOENTER("%p", dev);
+	if (!dev)
+		IOEXIT(return NULL);
+	dev = IoGetAttachedDevice(dev);
+	ObReferenceObject(dev);
+	IOEXIT(return dev);
+}
+
+wstdcall struct device_object *WIN_FUNC(IoAttachDeviceToDeviceStack,2)
+	(struct device_object *src, struct device_object *tgt)
+{
+	struct device_object *attached;
+	struct dev_obj_ext *src_dev_ext;
+
+	IOENTER("%p, %p", src, tgt);
+	attached = IoGetAttachedDevice(tgt);
+	IOTRACE("%p", attached);
+	src_dev_ext = src->dev_obj_ext;
+	spin_lock_bh(&ntoskernel_lock);
+	if (attached)
+		attached->attached = src;
+	src->attached = NULL;
+	src->stack_count = attached->stack_count + 1;
+	src_dev_ext->attached_to = attached;
+	spin_unlock_bh(&ntoskernel_lock);
+	IOTRACE("stack_count: %d -> %d", attached->stack_count,
+		src->stack_count);
+	IOEXIT(return attached);
+}
+
+wstdcall NTSTATUS WIN_FUNC(IoGetDeviceProperty,5)
+	(struct device_object *pdo, enum device_registry_property dev_property,
+	 ULONG buffer_len, void *buffer, ULONG *result_len)
+{
+	struct ansi_string ansi;
+	struct unicode_string unicode;
+	struct wrap_device *wd;
+	ULONG need;
+
+	IOENTER("dev_obj = %p, dev_property = %d, buffer_len = %u, "
+		"buffer = %p, result_len = %p", pdo, dev_property,
+		buffer_len, buffer, result_len);
+
+	wd = pdo->reserved;
+	switch (dev_property) {
+	case DevicePropertyDeviceDescription:
+	case DevicePropertyFriendlyName:
+	case DevicePropertyDriverKeyName:
+		if (wrap_is_pci_bus(wd->dev_bus))
+			RtlInitAnsiString(&ansi, "PCI");
+		else // if (wrap_is_usb_bus(wd->dev_bus))
+			RtlInitAnsiString(&ansi, "USB");
+		need = sizeof(wchar_t) * (ansi.max_length + 1);
+		if (buffer_len < need) {
+			*result_len = need;
+			IOEXIT(return STATUS_BUFFER_TOO_SMALL);
+		}
+		unicode.max_length = buffer_len;
+		unicode.buf = buffer;
+		if (RtlAnsiStringToUnicodeString(&unicode, &ansi,
+						 FALSE) != STATUS_SUCCESS) {
+			*result_len = unicode.length;
+			IOEXIT(return STATUS_BUFFER_TOO_SMALL);
+		}
+		IOEXIT(return STATUS_SUCCESS);
+	default:
+		WARNING("%d not implemented", dev_property);
+		IOEXIT(return STATUS_INVALID_PARAMETER_2);
+	}
+}
+
+wstdcall NTSTATUS WIN_FUNC(IoGetDeviceObjectPointer,4)
+	(struct unicode_string *name, ACCESS_MASK desired_access,
+	 void *file_obj, struct device_object *dev_obj)
+{
+	struct common_object_header *coh;
+
+	dev_obj = NULL;
+	/* TODO: access is not checked and file_obj is set to NULL */
+	file_obj = NULL;
+	spin_lock_bh(&ntoskernel_lock);
+	nt_list_for_each_entry(coh, &object_list, list) {
+		TRACE5("header: %p, type: %d", coh, coh->type);
+		if (coh->type != OBJECT_TYPE_DEVICE)
+			continue;
+		if (!RtlCompareUnicodeString(&coh->name, name, TRUE)) {
+			dev_obj = HEADER_TO_OBJECT(coh);
+			TRACE5("dev_obj: %p", dev_obj);
+			break;
+		}
+	}
+	spin_unlock_bh(&ntoskernel_lock);
+	if (dev_obj)
+		IOEXIT(return STATUS_SUCCESS);
+	else
+		IOEXIT(return STATUS_OBJECT_NAME_INVALID);
+}
+
+/* NOTE: Make sure to compile with -freg-struct-return, so gcc will
+ * return union in register, like Windows */
+wstdcall union power_state WIN_FUNC(PoSetPowerState,3)
+	(struct device_object *dev_obj, enum power_state_type type,
+	 union power_state state)
+{
+	IOEXIT(return state);
+}
+
+wstdcall NTSTATUS WIN_FUNC(PoCallDriver,2)
+	(struct device_object *dev_obj, struct irp *irp)
+{
+	return IoCallDriver(dev_obj, irp);
+}
+
+wstdcall NTSTATUS WIN_FUNC(PoRequestPowerIrp,6)
+	(struct device_object *dev_obj, UCHAR minor_fn,
+	 union power_state power_state, void *completion_func,
+	 void *context, struct irp **pirp)
+{
+	struct irp *irp;
+	struct io_stack_location *irp_sl;
+
+	TRACE1("%p, %d, %p", dev_obj, dev_obj->stack_count, dev_obj->drv_obj);
+	irp = IoAllocateIrp(dev_obj->stack_count, FALSE);
+	if (!irp)
+		return STATUS_INSUFFICIENT_RESOURCES;
+	irp_sl = IoGetNextIrpStackLocation(irp);
+	irp_sl->major_fn = IRP_MJ_POWER;
+	irp_sl->minor_fn = minor_fn;
+	if (minor_fn == IRP_MN_WAIT_WAKE)
+		irp_sl->params.power.type = SystemPowerState;
+	else
+		irp_sl->params.power.type = DevicePowerState;
+	irp_sl->params.power.state = power_state;
+	irp_sl->completion_routine = completion_func;
+	irp->io_status.status = STATUS_NOT_SUPPORTED;
+	*pirp = irp;
+	return PoCallDriver(dev_obj, irp);
+}
+
+wstdcall void WIN_FUNC(PoStartNextPowerIrp,1)
+	(struct irp *irp)
+{
+	IOENTER("irp = %p", irp);
+	IOEXIT(return);
+}
+
+wstdcall void WIN_FUNC(IoInitializeRemoveLockEx,5)
+	(struct io_remove_lock *lock, ULONG alloc_tag, ULONG max_locked_min,
+	 ULONG high_mark, ULONG lock_size)
+{
+	TODO();
+}
+
+wstdcall void *WIN_FUNC(IoAllocateErrorLogEntry,2)
+	(void *io_object, UCHAR entry_size)
+{
+	/* not implemented fully */
+	void *ret = kmalloc(sizeof(struct io_error_log_packet) + entry_size,
+			    irql_gfp());
+	TRACE2("%p", ret);
+	if (ret)
+		return ret + sizeof(struct io_error_log_packet);
+	else
+		return NULL;
+}
+
+wstdcall void WIN_FUNC(IoWriteErrorLogEntry,1)
+	(void *entry)
+{
+	/* TODO: log error with codes and message */
+	ERROR("");
+}
+
+wstdcall void WIN_FUNC(IoFreeErrorLogEntry,1)
+	(void *entry)
+{
+	TRACE2("%p", entry);
+	kfree(entry - sizeof(struct io_error_log_packet));
+}
+
+wstdcall NTSTATUS WIN_FUNC(IoAcquireRemoveLockEx,5)
+	(struct io_remove_lock lock, void *tag, char *file, ULONG line,
+	 ULONG lock_size)
+{
+	TODO();
+	IOEXIT(return STATUS_SUCCESS);
+}
+
+wstdcall NTSTATUS WIN_FUNC(IoReleaseRemoveLockEx,3)
+	(struct io_remove_lock lock, void *tag, ULONG lock_size)
+{
+	TODO();
+	IOEXIT(return STATUS_SUCCESS);
+}
+
+wstdcall NTSTATUS WIN_FUNC(IoRegisterDeviceInterface,4)
+	(struct device_object *pdo, struct guid *guid_class,
+	 struct unicode_string *reference, struct unicode_string *link)
+{
+	struct ansi_string ansi;
+
+	/* TODO: check if pdo is valid */
+	RtlInitAnsiString(&ansi, "ndis");
+	ENTER1("pdo: %p, ref: %p, link: %p, %x, %x, %x", pdo, reference, link,
+	       guid_class->data1, guid_class->data2, guid_class->data3);
+	return RtlAnsiStringToUnicodeString(link, &ansi, TRUE);
+}
+
+wstdcall NTSTATUS WIN_FUNC(IoSetDeviceInterfaceState,2)
+	(struct unicode_string *link, BOOLEAN enable)
+{
+	ENTER1("link: %p, enable: %d", link, enable);
+	return STATUS_SUCCESS;
+}
+
+wstdcall NTSTATUS WIN_FUNC(IoOpenDeviceRegistryKey,4)
+	(struct device_object *dev_obj, ULONG type, ACCESS_MASK mask,
+	 void **handle)
+{
+	ENTER1("dev_obj: %p", dev_obj);
+	*handle = dev_obj;
+	return STATUS_SUCCESS;
+}
+
+wstdcall NTSTATUS WIN_FUNC(IoWMIRegistrationControl,2)
+	(struct device_object *dev_obj, ULONG action)
+{
+	ENTER2("%p, %d", dev_obj, action);
+	EXIT2(return STATUS_SUCCESS);
+}
+
+wstdcall void WIN_FUNC(IoInvalidateDeviceRelations,2)
+	(struct device_object *dev_obj, enum device_relation_type type)
+{
+	INFO("%p, %d", dev_obj, type);
+	TODO();
+}
+
+wstdcall void WIN_FUNC(IoInvalidateDeviceState,1)
+	(struct device_object *pdo)
+{
+	INFO("%p", pdo);
+	TODO();
+}
--- linux-rt-2.6.31.orig/ubuntu/ndiswrapper/ndiswrapper.h
+++ linux-rt-2.6.31/ubuntu/ndiswrapper/ndiswrapper.h
@@ -0,0 +1,219 @@
+/*
+ *  Copyright (C) 2003-2005 Pontus Fuchs, Giridhar Pemmasani
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ *  GNU General Public License for more details.
+ *
+ */
+
+#ifndef _NDISWRAPPER_H_
+#define _NDISWRAPPER_H_
+
+#define DRIVER_VERSION "1.55"
+#define UTILS_VERSION "1.9"
+
+#define DRIVER_NAME "ndiswrapper"
+#define DRIVER_CONFIG_DIR "/etc/ndiswrapper"
+
+#define SSID_MAX_WPA_IE_LEN 40
+#define NDIS_ESSID_MAX_SIZE 32
+#define NDIS_ENCODING_TOKEN_MAX 32
+#define MAX_ENCR_KEYS 4
+#define TX_RING_SIZE 16
+#define NDIS_MAX_RATES 8
+#define NDIS_MAX_RATES_EX 16
+#define WLAN_EID_GENERIC 221
+#define MAX_WPA_IE_LEN 64
+#define MAX_STR_LEN 512
+
+#define WRAP_PCI_BUS 5
+#define WRAP_PCMCIA_BUS 8
+/* some USB devices, e.g., DWL-G120 have BusType as 0 */
+#define WRAP_INTERNAL_BUS 0
+/* documentation at msdn says 15 is PNP bus, but inf files from all
+ * vendors say 15 is USB; which is correct? */
+#define WRAP_USB_BUS 15
+
+/* NDIS device must be 0, for compatability with old versions of
+ * ndiswrapper where device type for NDIS drivers is 0 */
+#define WRAP_NDIS_DEVICE 0
+#define WRAP_USB_DEVICE 1
+#define WRAP_BLUETOOTH_DEVICE1 2
+#define WRAP_BLUETOOTH_DEVICE2 3
+
+#define WRAP_DEVICE_BUS(dev, bus) ((dev) << 8 | (bus))
+#define WRAP_BUS(dev_bus) ((dev_bus) & 0x000FF)
+#define WRAP_DEVICE(dev_bus) ((dev_bus) >> 8)
+
+#define MAX_DRIVER_NAME_LEN 32
+#define MAX_VERSION_STRING_LEN 64
+#define MAX_SETTING_NAME_LEN 128
+#define MAX_SETTING_VALUE_LEN 256
+
+#define MAX_DRIVER_PE_IMAGES 4
+#define MAX_DRIVER_BIN_FILES 5
+#define MAX_DEVICE_SETTINGS 512
+
+#define MAX_ALLOCATED_URBS 15
+
+#define DEV_ANY_ID -1
+
+#define MAC2STR(a) (a)[0], (a)[1], (a)[2], (a)[3], (a)[4], (a)[5]
+#define MACSTRSEP "%02x:%02x:%02x:%02x:%02x:%02x"
+#define MACSTR "%02x%02x%02x%02x%02x%02x"
+#define MACINTADR(a) (int*)&((a)[0]), (int*)&((a)[1]), (int*)&((a)[2]), \
+		(int*)&((a)[3]), (int*)&((a)[4]), (int*)&((a)[5])
+
+#ifdef __KERNEL__
+/* DEBUG macros */
+
+#define MSG(level, fmt, ...)				\
+	printk(level "ndiswrapper (%s:%d): " fmt "\n",	\
+	       __func__, __LINE__ , ## __VA_ARGS__)
+
+#define WARNING(fmt, ...) MSG(KERN_WARNING, fmt, ## __VA_ARGS__)
+#define ERROR(fmt, ...) MSG(KERN_ERR, fmt , ## __VA_ARGS__)
+#define INFO(fmt, ...) MSG(KERN_INFO, fmt , ## __VA_ARGS__)
+#define TODO() WARNING("not fully implemented (yet)")
+
+#define TRACE(fmt, ...) do { } while (0)
+#define TRACE1(fmt, ...) do { } while (0)
+#define TRACE2(fmt, ...) do { } while (0)
+#define TRACE3(fmt, ...) do { }  while (0)
+#define TRACE4(fmt, ...) do { } while (0)
+#define TRACE5(fmt, ...) do { } while (0)
+#define TRACE6(fmt, ...) do { } while (0)
+
+/* for a block of code */
+#define DBG_BLOCK(level) while (0)
+
+extern int debug;
+
+#if defined DEBUG
+#undef TRACE
+#define TRACE(level, fmt, ...)				       \
+do {								       \
+	if (debug >= level)					       \
+		printk(KERN_INFO "%s (%s:%d): " fmt "\n", DRIVER_NAME, \
+		       __func__, __LINE__ , ## __VA_ARGS__);       \
+} while (0)
+#undef DBG_BLOCK
+#define DBG_BLOCK(level) if (debug >= level)
+#endif
+
+#if defined(DEBUG) && DEBUG >= 1
+#undef TRACE1
+#define TRACE1(fmt, ...) TRACE(1, fmt , ## __VA_ARGS__)
+#endif
+
+#if defined(DEBUG) && DEBUG >= 2
+#undef TRACE2
+#define TRACE2(fmt, ...) TRACE(2, fmt , ## __VA_ARGS__)
+#endif
+
+#if defined(DEBUG) && DEBUG >= 3
+#undef TRACE3
+#define TRACE3(fmt, ...) TRACE(3, fmt , ## __VA_ARGS__)
+#endif
+
+#if defined(DEBUG) && DEBUG >= 4
+#undef TRACE4
+#define TRACE4(fmt, ...) TRACE(4, fmt , ## __VA_ARGS__)
+#endif
+
+#if defined(DEBUG) && DEBUG >= 5
+#undef TRACE5
+#define TRACE5(fmt, ...) TRACE(5, fmt , ## __VA_ARGS__)
+#endif
+
+#if defined(DEBUG) && DEBUG >= 6
+#undef TRACE6
+#define TRACE6(fmt, ...) TRACE(6, fmt , ## __VA_ARGS__)
+#endif
+
+#define ENTER1(fmt, ...) TRACE1("Enter " fmt , ## __VA_ARGS__)
+#define ENTER2(fmt, ...) TRACE2("Enter " fmt , ## __VA_ARGS__)
+#define ENTER3(fmt, ...) TRACE3("Enter " fmt , ## __VA_ARGS__)
+#define ENTER4(fmt, ...) TRACE4("Enter " fmt , ## __VA_ARGS__)
+#define ENTER5(fmt, ...) TRACE5("Enter " fmt , ## __VA_ARGS__)
+#define ENTER6(fmt, ...) TRACE6("Enter " fmt , ## __VA_ARGS__)
+
+#define EXIT1(stmt) do { TRACE1("Exit"); stmt; } while(0)
+#define EXIT2(stmt) do { TRACE2("Exit"); stmt; } while(0)
+#define EXIT3(stmt) do { TRACE3("Exit"); stmt; } while(0)
+#define EXIT4(stmt) do { TRACE4("Exit"); stmt; } while(0)
+#define EXIT5(stmt) do { TRACE5("Exit"); stmt; } while(0)
+#define EXIT6(stmt) do { TRACE6("Exit"); stmt; } while(0)
+
+#if defined(USB_DEBUG)
+#define USBTRACE TRACE1
+#define USBENTER ENTER1
+#define USBEXIT EXIT1
+#else
+#define USBTRACE(fmt, ...)
+#define USBENTER(fmt, ...)
+#define USBEXIT(stmt) stmt
+#endif
+
+#if defined(EVENT_DEBUG)
+#define EVENTTRACE TRACE1
+#define EVENTENTER ENTER1
+#define EVENTEXIT EXIT1
+#else
+#define EVENTTRACE(fmt, ...)
+#define EVENTENTER(fmt, ...)
+#define EVENTEXIT(stmt) stmt
+#endif
+
+#if defined(TIMER_DEBUG)
+#define TIMERTRACE TRACE1
+#define TIMERENTER ENTER1
+#define TIMEREXIT EXIT1
+#else
+#define TIMERTRACE(fmt, ...)
+#define TIMERENTER(fmt, ...)
+#define TIMEREXIT(stmt) stmt
+#endif
+
+#if defined(IO_DEBUG)
+#define IOTRACE TRACE1
+#define IOENTER ENTER1
+#define IOEXIT EXIT1
+#else
+#define IOTRACE(fmt, ...)
+#define IOENTER(fmt, ...)
+#define IOEXIT(stmt) stmt
+#endif
+
+#if defined(WORK_DEBUG)
+#define WORKTRACE TRACE1
+#define WORKENTER ENTER1
+#define WORKEXIT EXIT1
+#else
+#define WORKTRACE(fmt, ...)
+#define WORKENTER(fmt, ...)
+#define WORKEXIT(stmt) stmt
+#endif
+
+#ifdef DEBUG
+#define assert(expr)							\
+do {									\
+	if (!(expr)) {							\
+		ERROR("assertion '%s' failed", #expr);			\
+		dump_stack();						\
+	}								\
+} while (0)
+#else
+#define assert(expr) do { } while (0)
+#endif
+
+#endif // __KERNEL__
+
+#endif // NDISWRAPPER_H
--- linux-rt-2.6.31.orig/ubuntu/ndiswrapper/hal.c
+++ linux-rt-2.6.31/ubuntu/ndiswrapper/hal.c
@@ -0,0 +1,157 @@
+/*
+ *  Copyright (C) 2003-2005 Pontus Fuchs, Giridhar Pemmasani
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ *  GNU General Public License for more details.
+ *
+ */
+
+#include "ntoskernel.h"
+#include "hal_exports.h"
+
+wstdcall void WIN_FUNC(WRITE_PORT_ULONG,2)
+	(ULONG_PTR port, ULONG value)
+{
+	outl(value, port);
+}
+
+wstdcall ULONG WIN_FUNC(READ_PORT_ULONG,1)
+	(ULONG_PTR port)
+{
+	return inl(port);
+}
+
+wstdcall void WIN_FUNC(WRITE_PORT_USHORT,2)
+	(ULONG_PTR port, USHORT value)
+{
+	outw(value, port);
+}
+
+wstdcall USHORT WIN_FUNC(READ_PORT_USHORT,1)
+	(ULONG_PTR port)
+{
+	return inw(port);
+}
+
+wstdcall void WIN_FUNC(WRITE_PORT_UCHAR,2)
+	(ULONG_PTR port, UCHAR value)
+{
+	outb(value, port);
+}
+
+wstdcall UCHAR WIN_FUNC(READ_PORT_UCHAR,1)
+	(ULONG_PTR port)
+{
+	return inb(port);
+}
+
+wstdcall void WIN_FUNC(WRITE_PORT_BUFFER_USHORT,3)
+	(ULONG_PTR port, USHORT *buf, ULONG count)
+{
+	outsw(port, buf, count);
+}
+
+wstdcall void WIN_FUNC(READ_PORT_BUFFER_USHORT,3)
+	(ULONG_PTR port, USHORT *buf, ULONG count)
+{
+	insw(port, buf, count);
+}
+
+wstdcall void WIN_FUNC(WRITE_PORT_BUFFER_ULONG,3)
+	(ULONG_PTR port, ULONG *buf, ULONG count)
+{
+	outsl(port, buf, count);
+}
+
+wstdcall void WIN_FUNC(READ_PORT_BUFFER_ULONG,3)
+	(ULONG_PTR port, ULONG *buf, ULONG count)
+{
+	insl(port, buf, count);
+}
+
+wstdcall USHORT WIN_FUNC(READ_REGISTER_USHORT,1)
+	(void __iomem *reg)
+{
+	return readw(reg);
+}
+
+wstdcall void WIN_FUNC(WRITE_REGISTER_ULONG,2)
+	(void __iomem *reg, UINT val)
+{
+	writel(val, reg);
+}
+
+wstdcall void WIN_FUNC(WRITE_REGISTER_USHORT,2)
+	(void __iomem *reg, USHORT val)
+{
+	writew(val, reg);
+}
+
+wstdcall void WIN_FUNC(WRITE_REGISTER_UCHAR,2)
+	(void __iomem *reg, UCHAR val)
+{
+	writeb(val, reg);
+}
+
+wstdcall void WIN_FUNC(KeStallExecutionProcessor,1)
+	(ULONG usecs)
+{
+	udelay(usecs);
+}
+
+wstdcall KIRQL WIN_FUNC(KeGetCurrentIrql,0)
+	(void)
+{
+	return current_irql();
+}
+
+wfastcall KIRQL WIN_FUNC(KfRaiseIrql,1)
+	(KIRQL newirql)
+{
+	return raise_irql(newirql);
+}
+
+wfastcall void WIN_FUNC(KfLowerIrql,1)
+	(KIRQL oldirql)
+{
+	lower_irql(oldirql);
+}
+
+wfastcall KIRQL WIN_FUNC(KfAcquireSpinLock,1)
+	(NT_SPIN_LOCK *lock)
+{
+	return nt_spin_lock_irql(lock, DISPATCH_LEVEL);
+}
+
+wfastcall void WIN_FUNC(KfReleaseSpinLock,2)
+	(NT_SPIN_LOCK *lock, KIRQL oldirql)
+{
+	nt_spin_unlock_irql(lock, oldirql);
+}
+
+wfastcall void WIN_FUNC(KefAcquireSpinLockAtDpcLevel,1)
+	(NT_SPIN_LOCK *lock)
+{
+#ifdef DEBUG_IRQL
+	if (current_irql() != DISPATCH_LEVEL)
+		ERROR("irql != DISPATCH_LEVEL");
+#endif
+	nt_spin_lock(lock);
+}
+
+wfastcall void WIN_FUNC(KefReleaseSpinLockFromDpcLevel,1)
+	(NT_SPIN_LOCK *lock)
+{
+#ifdef DEBUG_IRQL
+	if (current_irql() != DISPATCH_LEVEL)
+		ERROR("irql != DISPATCH_LEVEL");
+#endif
+	nt_spin_unlock(lock);
+}
--- linux-rt-2.6.31.orig/ubuntu/ndiswrapper/iw_ndis.h
+++ linux-rt-2.6.31/ubuntu/ndiswrapper/iw_ndis.h
@@ -0,0 +1,208 @@
+/*
+ *  Copyright (C) 2003-2005 Pontus Fuchs, Giridhar Pemmasani
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ *  GNU General Public License for more details.
+ *
+ */
+
+#ifndef _IW_NDIS_H_
+#define _IW_NDIS_H_
+
+#include "ndis.h"
+
+#define	WL_NOISE	-96	/* typical noise level in dBm */
+#define	WL_SIGMAX	-32	/* typical maximum signal level in dBm */
+
+struct ndis_encr_key {
+	ULONG struct_size;
+	ULONG index;
+	ULONG length;
+	UCHAR key[NDIS_ENCODING_TOKEN_MAX];
+};
+
+struct ndis_add_key {
+	ULONG struct_size;
+	ndis_key_index index;
+	ULONG length;
+	mac_address bssid;
+	UCHAR pad[6];
+	ndis_key_rsc rsc;
+	UCHAR key[NDIS_ENCODING_TOKEN_MAX];
+};
+
+struct ndis_remove_key {
+	ULONG struct_size;
+	ndis_key_index index;
+	mac_address bssid;
+};
+
+struct ndis_fixed_ies {
+	UCHAR time_stamp[8];
+	USHORT beacon_interval;
+	USHORT capa;
+};
+
+struct ndis_variable_ies {
+	ULONG elem_id;
+	UCHAR length;
+	UCHAR data[1];
+};
+
+enum ndis_reload_defaults { Ndis802_11ReloadWEPKeys };
+
+struct ndis_assoc_info {
+	ULONG length;
+	USHORT req_ies;
+	struct req_ie {
+		USHORT capa;
+		USHORT listen_interval;
+		mac_address cur_ap_address;
+	} req_ie;
+	ULONG req_ie_length;
+	ULONG offset_req_ies;
+	USHORT resp_ies;
+	struct resp_ie {
+		USHORT capa;
+		USHORT status_code;
+		USHORT assoc_id;
+	} resp_ie;
+	ULONG resp_ie_length;
+	ULONG offset_resp_ies;
+};
+
+struct ndis_configuration_fh {
+	ULONG length;
+	ULONG hop_pattern;
+	ULONG hop_set;
+	ULONG dwell_time;
+};
+
+struct ndis_configuration {
+	ULONG length;
+	ULONG beacon_period;
+	ULONG atim_window;
+	ULONG ds_config;
+	struct ndis_configuration_fh fh_config;
+};
+
+struct ndis_wlan_bssid {
+	ULONG length;
+	mac_address mac;
+	UCHAR reserved[2];
+	struct ndis_essid ssid;
+	ULONG privacy;
+	ndis_rssi rssi;
+	UINT net_type;
+	struct ndis_configuration config;
+	UINT mode;
+	ndis_rates rates;
+};
+
+struct ndis_wlan_bssid_ex {
+	ULONG length;
+	mac_address mac;
+	UCHAR reserved[2];
+	struct ndis_essid ssid;
+	ULONG privacy;
+	ndis_rssi rssi;
+	UINT net_type;
+	struct ndis_configuration config;
+	UINT mode;
+	ndis_rates_ex rates_ex;
+	ULONG ie_length;
+	UCHAR ies[1];
+};
+
+/* we use bssid_list as bssid_list_ex also */
+struct ndis_bssid_list {
+	ULONG num_items;
+	struct ndis_wlan_bssid bssid[1];
+};
+
+enum ndis_priv_filter {
+	Ndis802_11PrivFilterAcceptAll, Ndis802_11PrivFilter8021xWEP
+};
+
+enum network_type {
+	Ndis802_11FH, Ndis802_11DS, Ndis802_11OFDM5, Ndis802_11OFDM24,
+	/* MSDN site uses Ndis802_11Automode, which is not mentioned
+	 * in DDK, so add one and assign it to
+	 * Ndis802_11NetworkTypeMax */
+	Ndis802_11Automode, Ndis802_11NetworkTypeMax = Ndis802_11Automode
+};
+
+struct network_type_list {
+	ULONG num;
+	enum network_type types[1];
+};
+
+enum ndis_power {
+	NDIS_POWER_OFF = 0, NDIS_POWER_MAX, NDIS_POWER_MIN,
+};
+
+struct ndis_auth_req {
+	ULONG length;
+	mac_address bssid;
+	ULONG flags;
+};
+
+struct ndis_bssid_info {
+	mac_address bssid;
+	ndis_pmkid_vavlue pmkid;
+};
+
+struct ndis_pmkid {
+	ULONG length;
+	ULONG bssid_info_count;
+	struct ndis_bssid_info bssid_info[1];
+};
+
+int add_wep_key(struct ndis_device *wnd, char *key, int key_len,
+		int index);
+int set_essid(struct ndis_device *wnd, const char *ssid, int ssid_len);
+int set_infra_mode(struct ndis_device *wnd,
+		   enum ndis_infrastructure_mode mode);
+int get_ap_address(struct ndis_device *wnd, mac_address mac);
+int set_ndis_auth_mode(struct ndis_device *wnd, ULONG auth_mode);
+int set_iw_auth_mode(struct ndis_device *wnd, int wpa_version,
+		     int auth_80211_alg);
+int set_auth_mode(struct ndis_device *wnd);
+int set_ndis_encr_mode(struct ndis_device *wnd, int cipher_pairwise,
+		       int cipher_groupwise);
+int get_ndis_encr_mode(struct ndis_device *wnd);
+int set_encr_mode(struct ndis_device *wnd);
+int set_iw_encr_mode(struct ndis_device *wnd, int cipher_pairwise,
+		     int cipher_groupwise);
+int get_ndis_auth_mode(struct ndis_device *wnd);
+int set_priv_filter(struct ndis_device *wnd);
+int set_scan(struct ndis_device *wnd);
+NDIS_STATUS disassociate(struct ndis_device *wnd, int reset_ssid);
+void set_default_iw_params(struct ndis_device *wnd);
+extern const struct iw_handler_def ndis_handler_def;
+
+#define PRIV_RESET	 		SIOCIWFIRSTPRIV+16
+#define PRIV_POWER_PROFILE	 	SIOCIWFIRSTPRIV+17
+#define PRIV_NETWORK_TYPE	 	SIOCIWFIRSTPRIV+18
+#define PRIV_DEAUTHENTICATE 		SIOCIWFIRSTPRIV+19
+#define PRIV_MEDIA_STREAM_MODE 		SIOCIWFIRSTPRIV+20
+#define PRIV_RELOAD_DEFAULTS		SIOCIWFIRSTPRIV+23
+
+#define RSN_INFO_ELEM		0x30
+
+/* these have to match what is in wpa_supplicant */
+
+typedef enum { WPA_ALG_NONE, WPA_ALG_WEP, WPA_ALG_TKIP, WPA_ALG_CCMP } wpa_alg;
+typedef enum { CIPHER_NONE, CIPHER_WEP40, CIPHER_TKIP, CIPHER_CCMP,
+	       CIPHER_WEP104 } wpa_cipher;
+typedef enum { KEY_MGMT_802_1X, KEY_MGMT_PSK, KEY_MGMT_NONE,
+	       KEY_MGMT_802_1X_NO_WPA, KEY_MGMT_WPA_NONE } wpa_key_mgmt;
+
+#endif // IW_NDIS_H
--- linux-rt-2.6.31.orig/ubuntu/ndiswrapper/pe_linker.h
+++ linux-rt-2.6.31/ubuntu/ndiswrapper/pe_linker.h
@@ -0,0 +1,993 @@
+/*
+ * This file is an excerpt of winnt.h from WINE, which bears the
+ * following copyright:
+ *
+ * Win32 definitions for Windows NT
+ *
+ * Copyright 1996 Alexandre Julliard
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
+ */
+
+/*
+ * File formats definitions
+ */
+typedef struct _IMAGE_DOS_HEADER {
+    WORD  e_magic;      /* 00: MZ Header signature */
+    WORD  e_cblp;       /* 02: Bytes on last page of file */
+    WORD  e_cp;         /* 04: Pages in file */
+    WORD  e_crlc;       /* 06: Relocations */
+    WORD  e_cparhdr;    /* 08: Size of header in paragraphs */
+    WORD  e_minalloc;   /* 0a: Minimum extra paragraphs needed */
+    WORD  e_maxalloc;   /* 0c: Maximum extra paragraphs needed */
+    WORD  e_ss;         /* 0e: Initial (relative) SS value */
+    WORD  e_sp;         /* 10: Initial SP value */
+    WORD  e_csum;       /* 12: Checksum */
+    WORD  e_ip;         /* 14: Initial IP value */
+    WORD  e_cs;         /* 16: Initial (relative) CS value */
+    WORD  e_lfarlc;     /* 18: File address of relocation table */
+    WORD  e_ovno;       /* 1a: Overlay number */
+    WORD  e_res[4];     /* 1c: Reserved words */
+    WORD  e_oemid;      /* 24: OEM identifier (for e_oeminfo) */
+    WORD  e_oeminfo;    /* 26: OEM information; e_oemid specific */
+    WORD  e_res2[10];   /* 28: Reserved words */
+    DWORD e_lfanew;     /* 3c: Offset to extended header */
+} IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER;
+
+#define IMAGE_DOS_SIGNATURE    0x5A4D     /* MZ   */
+#define IMAGE_OS2_SIGNATURE    0x454E     /* NE   */
+#define IMAGE_OS2_SIGNATURE_LE 0x454C     /* LE   */
+#define IMAGE_OS2_SIGNATURE_LX 0x584C     /* LX */
+#define IMAGE_VXD_SIGNATURE    0x454C     /* LE   */
+#define IMAGE_NT_SIGNATURE     0x00004550 /* PE00 */
+
+/*
+ * This is the Windows executable (NE) header.
+ * the name IMAGE_OS2_HEADER is misleading, but in the SDK this way.
+ */
+typedef struct
+{
+    WORD  ne_magic;             /* 00 NE signature 'NE' */
+    BYTE  ne_ver;               /* 02 Linker version number */
+    BYTE  ne_rev;               /* 03 Linker revision number */
+    WORD  ne_enttab;            /* 04 Offset to entry table relative to NE */
+    WORD  ne_cbenttab;          /* 06 Length of entry table in bytes */
+    LONG  ne_crc;               /* 08 Checksum */
+    WORD  ne_flags;             /* 0c Flags about segments in this file */
+    WORD  ne_autodata;          /* 0e Automatic data segment number */
+    WORD  ne_heap;              /* 10 Initial size of local heap */
+    WORD  ne_stack;             /* 12 Initial size of stack */
+    DWORD ne_csip;              /* 14 Initial CS:IP */
+    DWORD ne_sssp;              /* 18 Initial SS:SP */
+    WORD  ne_cseg;              /* 1c # of entries in segment table */
+    WORD  ne_cmod;              /* 1e # of entries in module reference tab. */
+    WORD  ne_cbnrestab;         /* 20 Length of nonresident-name table */
+    WORD  ne_segtab;            /* 22 Offset to segment table */
+    WORD  ne_rsrctab;           /* 24 Offset to resource table */
+    WORD  ne_restab;            /* 26 Offset to resident-name table */
+    WORD  ne_modtab;            /* 28 Offset to module reference table */
+    WORD  ne_imptab;            /* 2a Offset to imported name table */
+    DWORD ne_nrestab;           /* 2c Offset to nonresident-name table */
+    WORD  ne_cmovent;           /* 30 # of movable entry points */
+    WORD  ne_align;             /* 32 Logical sector alignment shift count */
+    WORD  ne_cres;              /* 34 # of resource segments */
+    BYTE  ne_exetyp;            /* 36 Flags indicating target OS */
+    BYTE  ne_flagsothers;       /* 37 Additional information flags */
+    WORD  ne_pretthunks;        /* 38 Offset to return thunks */
+    WORD  ne_psegrefbytes;      /* 3a Offset to segment ref. bytes */
+    WORD  ne_swaparea;          /* 3c Reserved by Microsoft */
+    WORD  ne_expver;            /* 3e Expected Windows version number */
+} IMAGE_OS2_HEADER, *PIMAGE_OS2_HEADER;
+
+typedef struct _IMAGE_VXD_HEADER {
+  WORD  e32_magic;
+  BYTE  e32_border;
+  BYTE  e32_worder;
+  DWORD e32_level;
+  WORD  e32_cpu;
+  WORD  e32_os;
+  DWORD e32_ver;
+  DWORD e32_mflags;
+  DWORD e32_mpages;
+  DWORD e32_startobj;
+  DWORD e32_eip;
+  DWORD e32_stackobj;
+  DWORD e32_esp;
+  DWORD e32_pagesize;
+  DWORD e32_lastpagesize;
+  DWORD e32_fixupsize;
+  DWORD e32_fixupsum;
+  DWORD e32_ldrsize;
+  DWORD e32_ldrsum;
+  DWORD e32_objtab;
+  DWORD e32_objcnt;
+  DWORD e32_objmap;
+  DWORD e32_itermap;
+  DWORD e32_rsrctab;
+  DWORD e32_rsrccnt;
+  DWORD e32_restab;
+  DWORD e32_enttab;
+  DWORD e32_dirtab;
+  DWORD e32_dircnt;
+  DWORD e32_fpagetab;
+  DWORD e32_frectab;
+  DWORD e32_impmod;
+  DWORD e32_impmodcnt;
+  DWORD e32_impproc;
+  DWORD e32_pagesum;
+  DWORD e32_datapage;
+  DWORD e32_preload;
+  DWORD e32_nrestab;
+  DWORD e32_cbnrestab;
+  DWORD e32_nressum;
+  DWORD e32_autodata;
+  DWORD e32_debuginfo;
+  DWORD e32_debuglen;
+  DWORD e32_instpreload;
+  DWORD e32_instdemand;
+  DWORD e32_heapsize;
+  BYTE  e32_res3[12];
+  DWORD e32_winresoff;
+  DWORD e32_winreslen;
+  WORD  e32_devid;
+  WORD  e32_ddkver;
+} IMAGE_VXD_HEADER, *PIMAGE_VXD_HEADER;
+
+/* These defines describe the meanings of the bits in the
+   Characteristics field */
+
+#define IMAGE_FILE_RELOCS_STRIPPED	0x0001 /* No relocation info */
+#define IMAGE_FILE_EXECUTABLE_IMAGE	0x0002
+#define IMAGE_FILE_LINE_NUMS_STRIPPED   0x0004
+#define IMAGE_FILE_LOCAL_SYMS_STRIPPED  0x0008
+#define IMAGE_FILE_AGGRESIVE_WS_TRIM	0x0010
+#define IMAGE_FILE_LARGE_ADDRESS_AWARE	0x0020
+#define IMAGE_FILE_16BIT_MACHINE	0x0040
+#define IMAGE_FILE_BYTES_REVERSED_LO	0x0080
+#define IMAGE_FILE_32BIT_MACHINE	0x0100
+#define IMAGE_FILE_DEBUG_STRIPPED	0x0200
+#define IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP	0x0400
+#define IMAGE_FILE_NET_RUN_FROM_SWAP	0x0800
+#define IMAGE_FILE_SYSTEM		0x1000
+#define IMAGE_FILE_DLL			0x2000
+#define IMAGE_FILE_UP_SYSTEM_ONLY	0x4000
+#define IMAGE_FILE_BYTES_REVERSED_HI	0x8000
+
+/* These are the settings of the Machine field. */
+#define	IMAGE_FILE_MACHINE_UNKNOWN	0
+#define	IMAGE_FILE_MACHINE_I860		0x014d
+#define	IMAGE_FILE_MACHINE_I386		0x014c
+#define	IMAGE_FILE_MACHINE_R3000	0x0162
+#define	IMAGE_FILE_MACHINE_R4000	0x0166
+#define	IMAGE_FILE_MACHINE_R10000	0x0168
+#define	IMAGE_FILE_MACHINE_WCEMIPSV2	0x0169
+#define	IMAGE_FILE_MACHINE_ALPHA	0x0184
+#define	IMAGE_FILE_MACHINE_SH3		0x01a2
+#define	IMAGE_FILE_MACHINE_SH3DSP	0x01a3
+#define	IMAGE_FILE_MACHINE_SH3E		0x01a4
+#define	IMAGE_FILE_MACHINE_SH4		0x01a6
+#define	IMAGE_FILE_MACHINE_SH5		0x01a8
+#define	IMAGE_FILE_MACHINE_ARM		0x01c0
+#define	IMAGE_FILE_MACHINE_THUMB	0x01c2
+#define	IMAGE_FILE_MACHINE_AM33		0x01d3
+#define	IMAGE_FILE_MACHINE_POWERPC	0x01f0
+#define	IMAGE_FILE_MACHINE_POWERPCFP	0x01f1
+#define	IMAGE_FILE_MACHINE_IA64		0x0200
+#define	IMAGE_FILE_MACHINE_MIPS16	0x0266
+#define	IMAGE_FILE_MACHINE_ALPHA64	0x0284
+#define	IMAGE_FILE_MACHINE_MIPSFPU	0x0366
+#define	IMAGE_FILE_MACHINE_MIPSFPU16	0x0466
+#define	IMAGE_FILE_MACHINE_AXP64	IMAGE_FILE_MACHINE_ALPHA64
+#define	IMAGE_FILE_MACHINE_TRICORE	0x0520
+#define	IMAGE_FILE_MACHINE_CEF		0x0cef
+#define	IMAGE_FILE_MACHINE_EBC		0x0ebc
+#define	IMAGE_FILE_MACHINE_AMD64	0x8664
+#define	IMAGE_FILE_MACHINE_M32R		0x9041
+#define	IMAGE_FILE_MACHINE_CEE		0xc0ee
+
+#define	IMAGE_SIZEOF_FILE_HEADER		20
+#define IMAGE_SIZEOF_ROM_OPTIONAL_HEADER	56
+#define IMAGE_SIZEOF_STD_OPTIONAL_HEADER	28
+#define IMAGE_SIZEOF_NT_OPTIONAL_HEADER32 	224
+#define IMAGE_SIZEOF_NT_OPTIONAL_HEADER64 	240
+#define IMAGE_SIZEOF_SHORT_NAME 		8
+#define IMAGE_SIZEOF_SECTION_HEADER 		40
+#define IMAGE_SIZEOF_SYMBOL 			18
+#define IMAGE_SIZEOF_AUX_SYMBOL 		18
+#define IMAGE_SIZEOF_RELOCATION 		10
+#define IMAGE_SIZEOF_BASE_RELOCATION 		8
+#define IMAGE_SIZEOF_LINENUMBER 		6
+#define IMAGE_SIZEOF_ARCHIVE_MEMBER_HDR 	60
+
+/* Possible Magic values */
+#define IMAGE_NT_OPTIONAL_HDR32_MAGIC        0x010b
+#define IMAGE_NT_OPTIONAL_HDR64_MAGIC        0x020b
+#define IMAGE_ROM_OPTIONAL_HDR_MAGIC       0x0107
+
+#ifdef CONFIG_X86_64
+#define IMAGE_SIZEOF_NT_OPTIONAL_HEADER IMAGE_SIZEOF_NT_OPTIONAL_HEADER64
+#define IMAGE_NT_OPTIONAL_HDR_MAGIC IMAGE_NT_OPTIONAL_HDR64_MAGIC
+#else
+#define IMAGE_SIZEOF_NT_OPTIONAL_HEADER IMAGE_SIZEOF_NT_OPTIONAL_HEADER32
+#define IMAGE_NT_OPTIONAL_HDR_MAGIC IMAGE_NT_OPTIONAL_HDR32_MAGIC
+#endif
+
+/* These are indexes into the DataDirectory array */
+#define IMAGE_FILE_EXPORT_DIRECTORY		0
+#define IMAGE_FILE_IMPORT_DIRECTORY		1
+#define IMAGE_FILE_RESOURCE_DIRECTORY		2
+#define IMAGE_FILE_EXCEPTION_DIRECTORY		3
+#define IMAGE_FILE_SECURITY_DIRECTORY		4
+#define IMAGE_FILE_BASE_RELOCATION_TABLE	5
+#define IMAGE_FILE_DEBUG_DIRECTORY		6
+#define IMAGE_FILE_DESCRIPTION_STRING		7
+#define IMAGE_FILE_MACHINE_VALUE		8  /* Mips */
+#define IMAGE_FILE_THREAD_LOCAL_STORAGE		9
+#define IMAGE_FILE_CALLBACK_DIRECTORY		10
+
+/* Directory Entries, indices into the DataDirectory array */
+
+#define	IMAGE_DIRECTORY_ENTRY_EXPORT		0
+#define	IMAGE_DIRECTORY_ENTRY_IMPORT		1
+#define	IMAGE_DIRECTORY_ENTRY_RESOURCE		2
+#define	IMAGE_DIRECTORY_ENTRY_EXCEPTION		3
+#define	IMAGE_DIRECTORY_ENTRY_SECURITY		4
+#define	IMAGE_DIRECTORY_ENTRY_BASERELOC		5
+#define	IMAGE_DIRECTORY_ENTRY_DEBUG		6
+#define	IMAGE_DIRECTORY_ENTRY_COPYRIGHT		7
+#define	IMAGE_DIRECTORY_ENTRY_GLOBALPTR		8  /* (MIPS GP) */
+#define	IMAGE_DIRECTORY_ENTRY_TLS		9
+#define	IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	10
+#define	IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	11
+#define	IMAGE_DIRECTORY_ENTRY_IAT		12  /* Import Address Table */
+#define	IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	13
+#define	IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	14
+
+/* Subsystem Values */
+
+#define	IMAGE_SUBSYSTEM_UNKNOWN			0
+#define	IMAGE_SUBSYSTEM_NATIVE			1
+#define	IMAGE_SUBSYSTEM_WINDOWS_GUI		2  /* Windows GUI subsystem */
+#define	IMAGE_SUBSYSTEM_WINDOWS_CUI		3  /* Windows character subsystem */
+#define	IMAGE_SUBSYSTEM_OS2_CUI			5
+#define	IMAGE_SUBSYSTEM_POSIX_CUI		7
+#define	IMAGE_SUBSYSTEM_NATIVE_WINDOWS		8  /* native Win9x driver */
+#define	IMAGE_SUBSYSTEM_WINDOWS_CE_GUI		9  /* Windows CE subsystem */
+#define	IMAGE_SUBSYSTEM_EFI_APPLICATION		10
+#define	IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER	11
+#define	IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER	12
+#define	IMAGE_SUBSYSTEM_EFI_ROM			13
+#define	IMAGE_SUBSYSTEM_XBOX			14
+
+typedef struct _IMAGE_FILE_HEADER {
+  WORD  Machine;
+  WORD  NumberOfSections;
+  DWORD TimeDateStamp;
+  DWORD PointerToSymbolTable;
+  DWORD NumberOfSymbols;
+  WORD  SizeOfOptionalHeader;
+  WORD  Characteristics;
+} IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;
+
+typedef struct _IMAGE_DATA_DIRECTORY {
+  DWORD VirtualAddress;
+  DWORD Size;
+} IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY;
+
+#define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16
+
+typedef struct _IMAGE_OPTIONAL_HEADER32 {
+
+  /* Standard fields */
+
+  WORD  Magic;
+  BYTE  MajorLinkerVersion;
+  BYTE  MinorLinkerVersion;
+  DWORD SizeOfCode;
+  DWORD SizeOfInitializedData;
+  DWORD SizeOfUninitializedData;
+  DWORD AddressOfEntryPoint;
+  DWORD BaseOfCode;
+  DWORD BaseOfData;
+
+  /* NT additional fields */
+  DWORD ImageBase;
+  DWORD SectionAlignment;
+  DWORD FileAlignment;
+  WORD  MajorOperatingSystemVersion;
+  WORD  MinorOperatingSystemVersion;
+  WORD  MajorImageVersion;
+  WORD  MinorImageVersion;
+  WORD  MajorSubsystemVersion;
+  WORD  MinorSubsystemVersion;
+  DWORD Win32VersionValue;
+  DWORD SizeOfImage;
+  DWORD SizeOfHeaders;
+  DWORD CheckSum;
+  WORD  Subsystem;
+  WORD  DllCharacteristics;
+  DWORD SizeOfStackReserve;
+  DWORD SizeOfStackCommit;
+  DWORD SizeOfHeapReserve;
+  DWORD SizeOfHeapCommit;
+  DWORD LoaderFlags;
+  DWORD NumberOfRvaAndSizes;
+  IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
+} IMAGE_OPTIONAL_HEADER32, *PIMAGE_OPTIONAL_HEADER32;
+
+typedef struct _IMAGE_OPTIONAL_HEADER64 {
+
+  /* Standard fields */
+
+  WORD  Magic;
+  BYTE  MajorLinkerVersion;
+  BYTE  MinorLinkerVersion;
+  DWORD SizeOfCode;
+  DWORD SizeOfInitializedData;
+  DWORD SizeOfUninitializedData;
+  DWORD AddressOfEntryPoint;
+  DWORD BaseOfCode;
+
+  /* NT additional fields */
+  ULONGLONG ImageBase;
+  DWORD SectionAlignment;
+  DWORD FileAlignment;
+  WORD  MajorOperatingSystemVersion;
+  WORD  MinorOperatingSystemVersion;
+  WORD  MajorImageVersion;
+  WORD  MinorImageVersion;
+  WORD  MajorSubsystemVersion;
+  WORD  MinorSubsystemVersion;
+  DWORD Win32VersionValue;
+  DWORD SizeOfImage;
+  DWORD SizeOfHeaders;
+  DWORD CheckSum;
+  WORD  Subsystem;
+  WORD  DllCharacteristics;
+  ULONGLONG SizeOfStackReserve;
+  ULONGLONG SizeOfStackCommit;
+  ULONGLONG SizeOfHeapReserve;
+  ULONGLONG SizeOfHeapCommit;
+  DWORD LoaderFlags;
+  DWORD NumberOfRvaAndSizes;
+  IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
+} IMAGE_OPTIONAL_HEADER64, *PIMAGE_OPTIONAL_HEADER64;
+
+#ifdef CONFIG_X86_64
+typedef IMAGE_OPTIONAL_HEADER64 IMAGE_OPTIONAL_HEADER;
+typedef PIMAGE_OPTIONAL_HEADER64 PIMAGE_OPTIONAL_HEADER;
+#else
+typedef IMAGE_OPTIONAL_HEADER32 IMAGE_OPTIONAL_HEADER;
+typedef PIMAGE_OPTIONAL_HEADER32 PIMAGE_OPTIONAL_HEADER;
+#endif
+
+typedef struct _IMAGE_NT_HEADERS32 {
+  DWORD Signature; /* "PE"\0\0 */	/* 0x00 */
+  IMAGE_FILE_HEADER FileHeader;		/* 0x04 */
+  IMAGE_OPTIONAL_HEADER32 OptionalHeader;	/* 0x18 */
+} IMAGE_NT_HEADERS32, *PIMAGE_NT_HEADERS32;
+
+typedef struct _IMAGE_NT_HEADERS64 {
+  DWORD Signature; /* "PE"\0\0 */	/* 0x00 */
+  IMAGE_FILE_HEADER FileHeader;		/* 0x04 */
+  IMAGE_OPTIONAL_HEADER64 OptionalHeader;	/* 0x18 */
+} IMAGE_NT_HEADERS64, *PIMAGE_NT_HEADERS64;
+
+#ifdef CONFIG_X86_64
+typedef IMAGE_NT_HEADERS64 IMAGE_NT_HEADERS;
+typedef PIMAGE_NT_HEADERS64 PIMAGE_NT_HEADERS;
+#else
+typedef IMAGE_NT_HEADERS32 IMAGE_NT_HEADERS;
+typedef PIMAGE_NT_HEADERS32 PIMAGE_NT_HEADERS;
+#endif
+
+#define IMAGE_SIZEOF_SHORT_NAME 8
+
+typedef struct _IMAGE_SECTION_HEADER {
+  BYTE  Name[IMAGE_SIZEOF_SHORT_NAME];
+  union {
+    DWORD PhysicalAddress;
+    DWORD VirtualSize;
+  } Misc;
+  DWORD VirtualAddress;
+  DWORD SizeOfRawData;
+  DWORD PointerToRawData;
+  DWORD PointerToRelocations;
+  DWORD PointerToLinenumbers;
+  WORD  NumberOfRelocations;
+  WORD  NumberOfLinenumbers;
+  DWORD Characteristics;
+} IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER;
+
+#define	IMAGE_SIZEOF_SECTION_HEADER 40
+
+#define IMAGE_FIRST_SECTION(ntheader) \
+((PIMAGE_SECTION_HEADER)((LPBYTE)&((PIMAGE_NT_HEADERS)(ntheader))->OptionalHeader + \
+((PIMAGE_NT_HEADERS)(ntheader))->FileHeader.SizeOfOptionalHeader))
+
+/* These defines are for the Characteristics bitfield. */
+/* #define IMAGE_SCN_TYPE_REG			0x00000000 - Reserved */
+/* #define IMAGE_SCN_TYPE_DSECT			0x00000001 - Reserved */
+/* #define IMAGE_SCN_TYPE_NOLOAD		0x00000002 - Reserved */
+/* #define IMAGE_SCN_TYPE_GROUP			0x00000004 - Reserved */
+#define IMAGE_SCN_TYPE_NO_PAD			0x00000008 /* Reserved */
+/* #define IMAGE_SCN_TYPE_COPY			0x00000010 - Reserved */
+
+#define IMAGE_SCN_CNT_CODE			0x00000020
+#define IMAGE_SCN_CNT_INITIALIZED_DATA		0x00000040
+#define IMAGE_SCN_CNT_UNINITIALIZED_DATA	0x00000080
+
+#define	IMAGE_SCN_LNK_OTHER			0x00000100
+#define	IMAGE_SCN_LNK_INFO			0x00000200
+/* #define IMAGE_SCN_TYPE_OVER		0x00000400 - Reserved */
+#define	IMAGE_SCN_LNK_REMOVE			0x00000800
+#define	IMAGE_SCN_LNK_COMDAT			0x00001000
+
+/* 						0x00002000 - Reserved */
+/* #define IMAGE_SCN_MEM_PROTECTED 		0x00004000 - Obsolete */
+#define	IMAGE_SCN_MEM_FARDATA			0x00008000
+
+/* #define IMAGE_SCN_MEM_SYSHEAP		0x00010000 - Obsolete */
+#define	IMAGE_SCN_MEM_PURGEABLE			0x00020000
+#define	IMAGE_SCN_MEM_16BIT			0x00020000
+#define	IMAGE_SCN_MEM_LOCKED			0x00040000
+#define	IMAGE_SCN_MEM_PRELOAD			0x00080000
+
+#define	IMAGE_SCN_ALIGN_1BYTES			0x00100000
+#define	IMAGE_SCN_ALIGN_2BYTES			0x00200000
+#define	IMAGE_SCN_ALIGN_4BYTES			0x00300000
+#define	IMAGE_SCN_ALIGN_8BYTES			0x00400000
+#define	IMAGE_SCN_ALIGN_16BYTES			0x00500000  /* Default */
+#define	IMAGE_SCN_ALIGN_32BYTES			0x00600000
+#define	IMAGE_SCN_ALIGN_64BYTES			0x00700000
+#define	IMAGE_SCN_ALIGN_128BYTES		0x00800000
+#define	IMAGE_SCN_ALIGN_256BYTES		0x00900000
+#define	IMAGE_SCN_ALIGN_512BYTES		0x00A00000
+#define	IMAGE_SCN_ALIGN_1024BYTES		0x00B00000
+#define	IMAGE_SCN_ALIGN_2048BYTES		0x00C00000
+#define	IMAGE_SCN_ALIGN_4096BYTES		0x00D00000
+#define	IMAGE_SCN_ALIGN_8192BYTES		0x00E00000
+/* 						0x00F00000 - Unused */
+#define	IMAGE_SCN_ALIGN_MASK			0x00F00000
+
+#define IMAGE_SCN_LNK_NRELOC_OVFL		0x01000000
+
+
+#define IMAGE_SCN_MEM_DISCARDABLE		0x02000000
+#define IMAGE_SCN_MEM_NOT_CACHED		0x04000000
+#define IMAGE_SCN_MEM_NOT_PAGED			0x08000000
+#define IMAGE_SCN_MEM_SHARED			0x10000000
+#define IMAGE_SCN_MEM_EXECUTE			0x20000000
+#define IMAGE_SCN_MEM_READ			0x40000000
+#define IMAGE_SCN_MEM_WRITE			0x80000000
+
+typedef struct _IMAGE_SYMBOL {
+    union {
+        BYTE    ShortName[8];
+        struct {
+            DWORD   Short;
+            DWORD   Long;
+        } Name;
+        DWORD   LongName[2];
+    } N;
+    DWORD   Value;
+    SHORT   SectionNumber;
+    WORD    Type;
+    BYTE    StorageClass;
+    BYTE    NumberOfAuxSymbols;
+} IMAGE_SYMBOL;
+typedef IMAGE_SYMBOL *PIMAGE_SYMBOL;
+
+#define IMAGE_SIZEOF_SYMBOL 18
+
+typedef struct _IMAGE_LINENUMBER {
+    union {
+        DWORD   SymbolTableIndex;
+        DWORD   VirtualAddress;
+    } Type;
+    WORD    Linenumber;
+} IMAGE_LINENUMBER;
+typedef IMAGE_LINENUMBER *PIMAGE_LINENUMBER;
+
+#define IMAGE_SIZEOF_LINENUMBER  6
+
+typedef union _IMAGE_AUX_SYMBOL {
+    struct {
+        DWORD    TagIndex;
+        union {
+            struct {
+                WORD    Linenumber;
+                WORD    Size;
+            } LnSz;
+           DWORD    TotalSize;
+        } Misc;
+        union {
+            struct {
+                DWORD    PointerToLinenumber;
+                DWORD    PointerToNextFunction;
+            } Function;
+            struct {
+                WORD     Dimension[4];
+            } Array;
+        } FcnAry;
+        WORD    TvIndex;
+    } Sym;
+    struct {
+        BYTE    Name[IMAGE_SIZEOF_SYMBOL];
+    } File;
+    struct {
+        DWORD   Length;
+        WORD    NumberOfRelocations;
+        WORD    NumberOfLinenumbers;
+        DWORD   CheckSum;
+        SHORT   Number;
+        BYTE    Selection;
+    } Section;
+} IMAGE_AUX_SYMBOL;
+typedef IMAGE_AUX_SYMBOL *PIMAGE_AUX_SYMBOL;
+
+#define IMAGE_SIZEOF_AUX_SYMBOL 18
+
+#define IMAGE_SYM_UNDEFINED           (SHORT)0
+#define IMAGE_SYM_ABSOLUTE            (SHORT)-1
+#define IMAGE_SYM_DEBUG               (SHORT)-2
+
+#define IMAGE_SYM_TYPE_NULL                 0x0000
+#define IMAGE_SYM_TYPE_VOID                 0x0001
+#define IMAGE_SYM_TYPE_CHAR                 0x0002
+#define IMAGE_SYM_TYPE_SHORT                0x0003
+#define IMAGE_SYM_TYPE_INT                  0x0004
+#define IMAGE_SYM_TYPE_LONG                 0x0005
+#define IMAGE_SYM_TYPE_FLOAT                0x0006
+#define IMAGE_SYM_TYPE_DOUBLE               0x0007
+#define IMAGE_SYM_TYPE_STRUCT               0x0008
+#define IMAGE_SYM_TYPE_UNION                0x0009
+#define IMAGE_SYM_TYPE_ENUM                 0x000A
+#define IMAGE_SYM_TYPE_MOE                  0x000B
+#define IMAGE_SYM_TYPE_BYTE                 0x000C
+#define IMAGE_SYM_TYPE_WORD                 0x000D
+#define IMAGE_SYM_TYPE_UINT                 0x000E
+#define IMAGE_SYM_TYPE_DWORD                0x000F
+#define IMAGE_SYM_TYPE_PCODE                0x8000
+
+#define IMAGE_SYM_DTYPE_NULL                0
+#define IMAGE_SYM_DTYPE_POINTER             1
+#define IMAGE_SYM_DTYPE_FUNCTION            2
+#define IMAGE_SYM_DTYPE_ARRAY               3
+
+#define IMAGE_SYM_CLASS_END_OF_FUNCTION     (BYTE )-1
+#define IMAGE_SYM_CLASS_NULL                0x0000
+#define IMAGE_SYM_CLASS_AUTOMATIC           0x0001
+#define IMAGE_SYM_CLASS_EXTERNAL            0x0002
+#define IMAGE_SYM_CLASS_STATIC              0x0003
+#define IMAGE_SYM_CLASS_REGISTER            0x0004
+#define IMAGE_SYM_CLASS_EXTERNAL_DEF        0x0005
+#define IMAGE_SYM_CLASS_LABEL               0x0006
+#define IMAGE_SYM_CLASS_UNDEFINED_LABEL     0x0007
+#define IMAGE_SYM_CLASS_MEMBER_OF_STRUCT    0x0008
+#define IMAGE_SYM_CLASS_ARGUMENT            0x0009
+#define IMAGE_SYM_CLASS_STRUCT_TAG          0x000A
+#define IMAGE_SYM_CLASS_MEMBER_OF_UNION     0x000B
+#define IMAGE_SYM_CLASS_UNION_TAG           0x000C
+#define IMAGE_SYM_CLASS_TYPE_DEFINITION     0x000D
+#define IMAGE_SYM_CLASS_UNDEFINED_STATIC    0x000E
+#define IMAGE_SYM_CLASS_ENUM_TAG            0x000F
+#define IMAGE_SYM_CLASS_MEMBER_OF_ENUM      0x0010
+#define IMAGE_SYM_CLASS_REGISTER_PARAM      0x0011
+#define IMAGE_SYM_CLASS_BIT_FIELD           0x0012
+
+#define IMAGE_SYM_CLASS_FAR_EXTERNAL        0x0044
+#define IMAGE_SYM_CLASS_BLOCK               0x0064
+#define IMAGE_SYM_CLASS_FUNCTION            0x0065
+#define IMAGE_SYM_CLASS_END_OF_STRUCT       0x0066
+#define IMAGE_SYM_CLASS_FILE                0x0067
+#define IMAGE_SYM_CLASS_SECTION             0x0068
+#define IMAGE_SYM_CLASS_WEAK_EXTERNAL       0x0069
+
+#define N_BTMASK                            0x000F
+#define N_TMASK                             0x0030
+#define N_TMASK1                            0x00C0
+#define N_TMASK2                            0x00F0
+#define N_BTSHFT                            4
+#define N_TSHIFT                            2
+
+#define BTYPE(x) ((x) & N_BTMASK)
+
+#ifndef ISPTR
+#define ISPTR(x) (((x) & N_TMASK) == (IMAGE_SYM_DTYPE_POINTER << N_BTSHFT))
+#endif
+
+#ifndef ISFCN
+#define ISFCN(x) (((x) & N_TMASK) == (IMAGE_SYM_DTYPE_FUNCTION << N_BTSHFT))
+#endif
+
+#ifndef ISARY
+#define ISARY(x) (((x) & N_TMASK) == (IMAGE_SYM_DTYPE_ARRAY << N_BTSHFT))
+#endif
+
+#ifndef ISTAG
+#define ISTAG(x) ((x)==IMAGE_SYM_CLASS_STRUCT_TAG || (x)==IMAGE_SYM_CLASS_UNION_TAG || (x)==IMAGE_SYM_CLASS_ENUM_TAG)
+#endif
+
+#ifndef INCREF
+#define INCREF(x) ((((x)&~N_BTMASK)<<N_TSHIFT)|(IMAGE_SYM_DTYPE_POINTER<<N_BTSHFT)|((x)&N_BTMASK))
+#endif
+#ifndef DECREF
+#define DECREF(x) ((((x)>>N_TSHIFT)&~N_BTMASK)|((x)&N_BTMASK))
+#endif
+
+#define IMAGE_COMDAT_SELECT_NODUPLICATES    1
+#define IMAGE_COMDAT_SELECT_ANY             2
+#define IMAGE_COMDAT_SELECT_SAME_SIZE       3
+#define IMAGE_COMDAT_SELECT_EXACT_MATCH     4
+#define IMAGE_COMDAT_SELECT_ASSOCIATIVE     5
+#define IMAGE_COMDAT_SELECT_LARGEST         6
+#define IMAGE_COMDAT_SELECT_NEWEST          7
+
+#define IMAGE_WEAK_EXTERN_SEARCH_NOLIBRARY  1
+#define IMAGE_WEAK_EXTERN_SEARCH_LIBRARY    2
+#define IMAGE_WEAK_EXTERN_SEARCH_ALIAS      3
+
+/* Export module directory */
+
+typedef struct _IMAGE_EXPORT_DIRECTORY {
+	DWORD	Characteristics;
+	DWORD	TimeDateStamp;
+	WORD	MajorVersion;
+	WORD	MinorVersion;
+	DWORD	Name;
+	DWORD	Base;
+	DWORD	NumberOfFunctions;
+	DWORD	NumberOfNames;
+	DWORD	AddressOfFunctions;
+	DWORD	AddressOfNames;
+	DWORD	AddressOfNameOrdinals;
+} IMAGE_EXPORT_DIRECTORY,*PIMAGE_EXPORT_DIRECTORY;
+
+/* Import name entry */
+typedef struct _IMAGE_IMPORT_BY_NAME {
+	WORD	Hint;
+	BYTE	Name[1];
+} IMAGE_IMPORT_BY_NAME,*PIMAGE_IMPORT_BY_NAME;
+
+/* Import thunk */
+typedef struct _IMAGE_THUNK_DATA32 {
+	union {
+		DWORD    ForwarderString;
+		DWORD    Function;
+		DWORD    Ordinal;
+		DWORD	AddressOfData;
+	} u1;
+} IMAGE_THUNK_DATA32,*PIMAGE_THUNK_DATA32;
+
+typedef struct _IMAGE_THUNK_DATA64 {
+	union {
+		ULONGLONG    ForwarderString;
+		ULONGLONG    Function;
+		ULONGLONG    Ordinal;
+		ULONGLONG    AddressOfData;
+	} u1;
+} IMAGE_THUNK_DATA64,*PIMAGE_THUNK_DATA64;
+
+#ifdef CONFIG_X86_64
+typedef IMAGE_THUNK_DATA32 IMAGE_THUNK_DATA;
+typedef PIMAGE_THUNK_DATA32 PIMAGE_THUNK_DATA;
+#else
+typedef IMAGE_THUNK_DATA64 IMAGE_THUNK_DATA;
+typedef PIMAGE_THUNK_DATA64 PIMAGE_THUNK_DATA;
+#endif
+
+/* Import module directory */
+
+typedef struct packed _IMAGE_IMPORT_DESCRIPTOR {
+	union {
+		DWORD	Characteristics; /* 0 for terminating null
+					  * import descriptor */
+		DWORD   OriginalFirstThunk; /* RVA to original unbound
+					     * IAT */
+	} u;
+	DWORD	TimeDateStamp;	/* 0 if not bound,
+				 * -1 if bound, and real date\time stamp
+				 *    in IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT
+				 * (new BIND)
+				 * otherwise date/time stamp of DLL bound to
+				 * (Old BIND)
+				 */
+	DWORD	ForwarderChain;	/* -1 if no forwarders */
+	DWORD	Name;
+	/* RVA to IAT (if bound this IAT has actual addresses) */
+	DWORD   FirstThunk;
+} IMAGE_IMPORT_DESCRIPTOR,*PIMAGE_IMPORT_DESCRIPTOR;
+
+#define	IMAGE_ORDINAL_FLAG32		0x80000000
+#define	IMAGE_ORDINAL_FLAG64		0x8000000000000000UL
+#define	IMAGE_SNAP_BY_ORDINAL32(Ordinal) ((Ordinal & IMAGE_ORDINAL_FLAG32) != 0)
+#define	IMAGE_SNAP_BY_ORDINAL64(Ordinal) ((Ordinal & IMAGE_ORDINAL_FLAG64) != 0)
+#define	IMAGE_ORDINAL(Ordinal) (Ordinal & 0xffff)
+
+#ifdef CONFIG_X86_64
+#define IMAGE_ORDINAL_FLAG IMAGE_ORDINAL_FLAG64
+#define IMAGE_SNAP_BY_ORDINAL IMAGE_SNAP_BY_ORDINAL64
+#else
+#define IMAGE_ORDINAL_FLAG IMAGE_ORDINAL_FLAG32
+#define IMAGE_SNAP_BY_ORDINAL IMAGE_SNAP_BY_ORDINAL32
+#endif
+
+typedef struct _IMAGE_BOUND_IMPORT_DESCRIPTOR
+{
+    DWORD   TimeDateStamp;
+    WORD    OffsetModuleName;
+    WORD    NumberOfModuleForwarderRefs;
+/* Array of zero or more IMAGE_BOUND_FORWARDER_REF follows */
+} IMAGE_BOUND_IMPORT_DESCRIPTOR,  *PIMAGE_BOUND_IMPORT_DESCRIPTOR;
+
+typedef struct _IMAGE_BOUND_FORWARDER_REF
+{
+    DWORD   TimeDateStamp;
+    WORD    OffsetModuleName;
+    WORD    Reserved;
+} IMAGE_BOUND_FORWARDER_REF, *PIMAGE_BOUND_FORWARDER_REF;
+
+typedef struct _IMAGE_BASE_RELOCATION
+{
+	DWORD	VirtualAddress;
+	DWORD	SizeOfBlock;
+	WORD	TypeOffset[0];
+} IMAGE_BASE_RELOCATION,*PIMAGE_BASE_RELOCATION;
+
+typedef struct _IMAGE_RELOCATION
+{
+    union {
+        DWORD   VirtualAddress;
+        DWORD   RelocCount;
+    } DUMMYUNIONNAME;
+    DWORD   SymbolTableIndex;
+    WORD    Type;
+} IMAGE_RELOCATION, *PIMAGE_RELOCATION;
+
+#define IMAGE_SIZEOF_RELOCATION 10
+
+/* generic relocation types */
+#define IMAGE_REL_BASED_ABSOLUTE 		0
+#define IMAGE_REL_BASED_HIGH			1
+#define IMAGE_REL_BASED_LOW			2
+#define IMAGE_REL_BASED_HIGHLOW			3
+#define IMAGE_REL_BASED_HIGHADJ			4
+#define IMAGE_REL_BASED_MIPS_JMPADDR		5
+#define IMAGE_REL_BASED_SECTION			6
+#define	IMAGE_REL_BASED_REL			7
+#define IMAGE_REL_BASED_MIPS_JMPADDR16		9
+#define IMAGE_REL_BASED_IA64_IMM64		9 /* yes, 9 too */
+#define IMAGE_REL_BASED_DIR64			10
+#define IMAGE_REL_BASED_HIGH3ADJ		11
+
+/* I386 relocation types */
+#define	IMAGE_REL_I386_ABSOLUTE			0
+#define	IMAGE_REL_I386_DIR16			1
+#define	IMAGE_REL_I386_REL16			2
+#define	IMAGE_REL_I386_DIR32			6
+#define	IMAGE_REL_I386_DIR32NB			7
+#define	IMAGE_REL_I386_SEG12			9
+#define	IMAGE_REL_I386_SECTION			10
+#define	IMAGE_REL_I386_SECREL			11
+#define	IMAGE_REL_I386_REL32			20
+
+/* MIPS relocation types */
+#define IMAGE_REL_MIPS_ABSOLUTE		0x0000
+#define IMAGE_REL_MIPS_REFHALF		0x0001
+#define IMAGE_REL_MIPS_REFWORD		0x0002
+#define IMAGE_REL_MIPS_JMPADDR		0x0003
+#define IMAGE_REL_MIPS_REFHI		0x0004
+#define IMAGE_REL_MIPS_REFLO		0x0005
+#define IMAGE_REL_MIPS_GPREL		0x0006
+#define IMAGE_REL_MIPS_LITERAL		0x0007
+#define IMAGE_REL_MIPS_SECTION		0x000A
+#define IMAGE_REL_MIPS_SECREL		0x000B
+#define IMAGE_REL_MIPS_SECRELLO		0x000C
+#define IMAGE_REL_MIPS_SECRELHI		0x000D
+#define	IMAGE_REL_MIPS_JMPADDR16	0x0010
+#define IMAGE_REL_MIPS_REFWORDNB	0x0022
+#define IMAGE_REL_MIPS_PAIR		0x0025
+
+/* ALPHA relocation types */
+#define IMAGE_REL_ALPHA_ABSOLUTE	0x0000
+#define IMAGE_REL_ALPHA_REFLONG		0x0001
+#define IMAGE_REL_ALPHA_REFQUAD		0x0002
+#define IMAGE_REL_ALPHA_GPREL		0x0003
+#define IMAGE_REL_ALPHA_LITERAL		0x0004
+#define IMAGE_REL_ALPHA_LITUSE		0x0005
+#define IMAGE_REL_ALPHA_GPDISP		0x0006
+#define IMAGE_REL_ALPHA_BRADDR		0x0007
+#define IMAGE_REL_ALPHA_HINT		0x0008
+#define IMAGE_REL_ALPHA_INLINE_REFLONG	0x0009
+#define IMAGE_REL_ALPHA_REFHI		0x000A
+#define IMAGE_REL_ALPHA_REFLO		0x000B
+#define IMAGE_REL_ALPHA_PAIR		0x000C
+#define IMAGE_REL_ALPHA_MATCH		0x000D
+#define IMAGE_REL_ALPHA_SECTION		0x000E
+#define IMAGE_REL_ALPHA_SECREL		0x000F
+#define IMAGE_REL_ALPHA_REFLONGNB	0x0010
+#define IMAGE_REL_ALPHA_SECRELLO	0x0011
+#define IMAGE_REL_ALPHA_SECRELHI	0x0012
+#define IMAGE_REL_ALPHA_REFQ3		0x0013
+#define IMAGE_REL_ALPHA_REFQ2		0x0014
+#define IMAGE_REL_ALPHA_REFQ1		0x0015
+#define IMAGE_REL_ALPHA_GPRELLO		0x0016
+#define IMAGE_REL_ALPHA_GPRELHI		0x0017
+
+/* PowerPC relocation types */
+#define IMAGE_REL_PPC_ABSOLUTE          0x0000
+#define IMAGE_REL_PPC_ADDR64            0x0001
+#define IMAGE_REL_PPC_ADDR            0x0002
+#define IMAGE_REL_PPC_ADDR24            0x0003
+#define IMAGE_REL_PPC_ADDR16            0x0004
+#define IMAGE_REL_PPC_ADDR14            0x0005
+#define IMAGE_REL_PPC_REL24             0x0006
+#define IMAGE_REL_PPC_REL14             0x0007
+#define IMAGE_REL_PPC_TOCREL16          0x0008
+#define IMAGE_REL_PPC_TOCREL14          0x0009
+#define IMAGE_REL_PPC_ADDR32NB          0x000A
+#define IMAGE_REL_PPC_SECREL            0x000B
+#define IMAGE_REL_PPC_SECTION           0x000C
+#define IMAGE_REL_PPC_IFGLUE            0x000D
+#define IMAGE_REL_PPC_IMGLUE            0x000E
+#define IMAGE_REL_PPC_SECREL16          0x000F
+#define IMAGE_REL_PPC_REFHI             0x0010
+#define IMAGE_REL_PPC_REFLO             0x0011
+#define IMAGE_REL_PPC_PAIR              0x0012
+#define IMAGE_REL_PPC_SECRELLO          0x0013
+#define IMAGE_REL_PPC_SECRELHI          0x0014
+#define IMAGE_REL_PPC_GPREL		0x0015
+#define IMAGE_REL_PPC_TYPEMASK          0x00FF
+/* modifier bits */
+#define IMAGE_REL_PPC_NEG               0x0100
+#define IMAGE_REL_PPC_BRTAKEN           0x0200
+#define IMAGE_REL_PPC_BRNTAKEN          0x0400
+#define IMAGE_REL_PPC_TOCDEFN           0x0800
+
+/* SH3 ? relocation type */
+#define IMAGE_REL_SH3_ABSOLUTE          0x0000
+#define IMAGE_REL_SH3_DIRECT16          0x0001
+#define IMAGE_REL_SH3_DIRECT          0x0002
+#define IMAGE_REL_SH3_DIRECT8           0x0003
+#define IMAGE_REL_SH3_DIRECT8_WORD      0x0004
+#define IMAGE_REL_SH3_DIRECT8_LONG      0x0005
+#define IMAGE_REL_SH3_DIRECT4           0x0006
+#define IMAGE_REL_SH3_DIRECT4_WORD      0x0007
+#define IMAGE_REL_SH3_DIRECT4_LONG      0x0008
+#define IMAGE_REL_SH3_PCREL8_WORD       0x0009
+#define IMAGE_REL_SH3_PCREL8_LONG       0x000A
+#define IMAGE_REL_SH3_PCREL12_WORD      0x000B
+#define IMAGE_REL_SH3_STARTOF_SECTION   0x000C
+#define IMAGE_REL_SH3_SIZEOF_SECTION    0x000D
+#define IMAGE_REL_SH3_SECTION           0x000E
+#define IMAGE_REL_SH3_SECREL            0x000F
+#define IMAGE_REL_SH3_DIRECT32_NB       0x0010
+
+/* ARM (Archimedes?) relocation types */
+#define IMAGE_REL_ARM_ABSOLUTE		0x0000
+#define IMAGE_REL_ARM_ADDR		0x0001
+#define IMAGE_REL_ARM_ADDR32NB		0x0002
+#define IMAGE_REL_ARM_BRANCH24		0x0003
+#define IMAGE_REL_ARM_BRANCH11		0x0004
+#define IMAGE_REL_ARM_SECTION		0x000E
+#define IMAGE_REL_ARM_SECREL		0x000F
+
+/* IA64 relocation types */
+#define IMAGE_REL_IA64_ABSOLUTE		0x0000
+#define IMAGE_REL_IA64_IMM14		0x0001
+#define IMAGE_REL_IA64_IMM22		0x0002
+#define IMAGE_REL_IA64_IMM64		0x0003
+#define IMAGE_REL_IA64_DIR		0x0004
+#define IMAGE_REL_IA64_DIR64		0x0005
+#define IMAGE_REL_IA64_PCREL21B		0x0006
+#define IMAGE_REL_IA64_PCREL21M		0x0007
+#define IMAGE_REL_IA64_PCREL21F		0x0008
+#define IMAGE_REL_IA64_GPREL22		0x0009
+#define IMAGE_REL_IA64_LTOFF22		0x000A
+#define IMAGE_REL_IA64_SECTION		0x000B
+#define IMAGE_REL_IA64_SECREL22		0x000C
+#define IMAGE_REL_IA64_SECREL64I	0x000D
+#define IMAGE_REL_IA64_SECREL		0x000E
+#define IMAGE_REL_IA64_LTOFF64		0x000F
+#define IMAGE_REL_IA64_DIR32NB		0x0010
+#define IMAGE_REL_IA64_RESERVED_11	0x0011
+#define IMAGE_REL_IA64_RESERVED_12	0x0012
+#define IMAGE_REL_IA64_RESERVED_13	0x0013
+#define IMAGE_REL_IA64_RESERVED_14	0x0014
+#define IMAGE_REL_IA64_RESERVED_15	0x0015
+#define IMAGE_REL_IA64_RESERVED_16	0x0016
+#define IMAGE_REL_IA64_ADDEND		0x001F
+
+/* archive format */
+
+#define IMAGE_ARCHIVE_START_SIZE             8
+#define IMAGE_ARCHIVE_START                  "!<arch>\n"
+#define IMAGE_ARCHIVE_END                    "`\n"
+#define IMAGE_ARCHIVE_PAD                    "\n"
+#define IMAGE_ARCHIVE_LINKER_MEMBER          "/               "
+#define IMAGE_ARCHIVE_LONGNAMES_MEMBER       "//              "
+
+typedef struct _IMAGE_ARCHIVE_MEMBER_HEADER
+{
+    BYTE     Name[16];
+    BYTE     Date[12];
+    BYTE     UserID[6];
+    BYTE     GroupID[6];
+    BYTE     Mode[8];
+    BYTE     Size[10];
+    BYTE     EndHeader[2];
+} IMAGE_ARCHIVE_MEMBER_HEADER, *PIMAGE_ARCHIVE_MEMBER_HEADER;
+
+#define IMAGE_SIZEOF_ARCHIVE_MEMBER_HDR 60
+
+/*
+ * Resource directory stuff
+ */
+typedef struct _IMAGE_RESOURCE_DIRECTORY {
+	DWORD	Characteristics;
+	DWORD	TimeDateStamp;
+	WORD	MajorVersion;
+	WORD	MinorVersion;
+	WORD	NumberOfNamedEntries;
+	WORD	NumberOfIdEntries;
+	/*  IMAGE_RESOURCE_DIRECTORY_ENTRY DirectoryEntries[]; */
+} IMAGE_RESOURCE_DIRECTORY,*PIMAGE_RESOURCE_DIRECTORY;
+
+#define	IMAGE_RESOURCE_NAME_IS_STRING		0x80000000
+#define	IMAGE_RESOURCE_DATA_IS_DIRECTORY	0x80000000
+
+typedef struct _IMAGE_RESOURCE_DIRECTORY_ENTRY {
+	union {
+		struct {
+#ifdef BITFIELDS_BIGENDIAN
+			unsigned NameIsString:1;
+			unsigned NameOffset:31;
+#else
+			unsigned NameOffset:31;
+			unsigned NameIsString:1;
+#endif
+		} DUMMYSTRUCTNAME1;
+		DWORD   Name;
+                struct {
+#ifdef WORDS_BIGENDIAN
+			WORD    __pad;
+			WORD    Id;
+#else
+			WORD    Id;
+			WORD    __pad;
+#endif
+		} DUMMYSTRUCTNAME2;
+	} DUMMYUNIONNAME1;
+	union {
+		DWORD   OffsetToData;
+		struct {
+#ifdef BITFIELDS_BIGENDIAN
+			unsigned DataIsDirectory:1;
+			unsigned OffsetToDirectory:31;
+#else
+			unsigned OffsetToDirectory:31;
+			unsigned DataIsDirectory:1;
+#endif
+		} DUMMYSTRUCTNAME3;
+	} DUMMYUNIONNAME2;
+} IMAGE_RESOURCE_DIRECTORY_ENTRY,*PIMAGE_RESOURCE_DIRECTORY_ENTRY;
+
+
+typedef struct _IMAGE_RESOURCE_DIRECTORY_STRING {
+	WORD	Length;
+	CHAR	NameString[ 1 ];
+} IMAGE_RESOURCE_DIRECTORY_STRING,*PIMAGE_RESOURCE_DIRECTORY_STRING;
+
--- linux-rt-2.6.31.orig/ubuntu/ndiswrapper/mkstubs.sh
+++ linux-rt-2.6.31/ubuntu/ndiswrapper/mkstubs.sh
@@ -0,0 +1,12 @@
+#! /bin/sh
+
+for file in "$@"; do
+	echo
+	echo "# automatically generated from $file"
+	sed -n \
+		-e 's/.*WIN_FUNC(\([^\,]\+\) *\, *\([0-9]\+\)).*/\
+		   win2lin(\1, \2)/p'   \
+		-e 's/.*WIN_FUNC_PTR(\([^\,]\+\) *\, *\([0-9]\+\)).*/\
+		   win2lin(\1, \2)/p'   \
+	   $file | sed -e 's/[ \t	]\+//' | sort -u; \
+done
--- linux-rt-2.6.31.orig/ubuntu/ndiswrapper/iw_ndis.c
+++ linux-rt-2.6.31/ubuntu/ndiswrapper/iw_ndis.c
@@ -0,0 +1,1973 @@
+ /*
+ *  Copyright (C) 2003-2005 Pontus Fuchs, Giridhar Pemmasani
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ *  GNU General Public License for more details.
+ *
+ */
+
+#include <linux/version.h>
+#include <linux/wireless.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/ethtool.h>
+#include <linux/if_arp.h>
+#include <linux/usb.h>
+#include <linux/random.h>
+
+#include <net/iw_handler.h>
+#include <linux/rtnetlink.h>
+#include <asm/uaccess.h>
+
+#include "iw_ndis.h"
+#include "wrapndis.h"
+
+static int freq_chan[] = { 2412, 2417, 2422, 2427, 2432, 2437, 2442,
+			   2447, 2452, 2457, 2462, 2467, 2472, 2484 };
+
+static const char *network_names[] = {"IEEE 802.11FH", "IEEE 802.11b",
+				      "IEEE 802.11a", "IEEE 802.11g", "Auto"};
+
+int set_essid(struct ndis_device *wnd, const char *ssid, int ssid_len)
+{
+	NDIS_STATUS res;
+	struct ndis_essid req;
+
+	if (ssid_len > NDIS_ESSID_MAX_SIZE)
+		return -EINVAL;
+
+	memset(&req, 0, sizeof(req));
+	req.length = ssid_len;
+	if (ssid_len)
+		memcpy(&req.essid, ssid, ssid_len);
+
+	res = mp_set(wnd, OID_802_11_SSID, &req, sizeof(req));
+	if (res) {
+		WARNING("setting essid failed (%08X)", res);
+		EXIT2(return -EINVAL);
+	}
+	memcpy(&wnd->essid, &req, sizeof(req));
+	EXIT2(return 0);
+}
+
+static int set_assoc_params(struct ndis_device *wnd)
+{
+	TRACE2("wpa_version=0x%x auth_alg=0x%x key_mgmt=0x%x "
+	       "cipher_pairwise=0x%x cipher_group=0x%x",
+	       wnd->iw_auth_wpa_version, wnd->iw_auth_80211_alg,
+	       wnd->iw_auth_key_mgmt, wnd->iw_auth_cipher_pairwise,
+	       wnd->iw_auth_cipher_group);
+	set_auth_mode(wnd);
+	set_priv_filter(wnd);
+	set_encr_mode(wnd);
+	return 0;
+}
+
+static int iw_set_essid(struct net_device *dev, struct iw_request_info *info,
+			union iwreq_data *wrqu, char *extra)
+{
+	struct ndis_device *wnd = netdev_priv(dev);
+	char ssid[NDIS_ESSID_MAX_SIZE];
+	int length;
+
+	ENTER2("");
+	memset(ssid, 0, sizeof(ssid));
+	/* there is no way to turn off essid other than to set to
+	 * random bytes; instead, we use off to mean any */
+	if (wrqu->essid.flags) {
+		/* wireless-tools prior to version 20 add extra 1, and
+		 * later than 20 don't! Deal with that mess */
+		length = wrqu->essid.length - 1;
+		if (length > 0)
+			length--;
+		while (length < wrqu->essid.length && extra[length])
+			length++;
+		TRACE2("%d", length);
+		if (length <= 0 || length > NDIS_ESSID_MAX_SIZE)
+			EXIT2(return -EINVAL);
+	} else
+		length = 0;
+
+	set_assoc_params(wnd);
+
+	memcpy(ssid, extra, length);
+	if (set_essid(wnd, ssid, length))
+		EXIT2(return -EINVAL);
+
+	EXIT2(return 0);
+}
+
+static int iw_get_essid(struct net_device *dev, struct iw_request_info *info,
+			union iwreq_data *wrqu, char *extra)
+{
+	struct ndis_device *wnd = netdev_priv(dev);
+	NDIS_STATUS res;
+	struct ndis_essid req;
+
+	ENTER2("");
+	memset(&req, 0, sizeof(req));
+	res = mp_query(wnd, OID_802_11_SSID, &req, sizeof(req));
+	if (res) {
+		WARNING("getting essid failed (%08X)", res);
+		EXIT2(return -EOPNOTSUPP);
+	}
+	memcpy(extra, req.essid, req.length);
+	if (req.length > 0)
+		wrqu->essid.flags  = 1;
+	else
+		wrqu->essid.flags = 0;
+	wrqu->essid.length = req.length;
+	EXIT2(return 0);
+}
+
+int set_infra_mode(struct ndis_device *wnd,
+		   enum ndis_infrastructure_mode mode)
+{
+	NDIS_STATUS res;
+	unsigned int i;
+
+	ENTER2("%d", mode);
+	res = mp_query_int(wnd, OID_802_11_INFRASTRUCTURE_MODE,
+			   &wnd->infrastructure_mode);
+	if (res != NDIS_STATUS_SUCCESS) {
+		WARNING("getting operating mode to failed (%08X)", res);
+		EXIT2(return -EINVAL);
+	}
+	if (wnd->infrastructure_mode == mode)
+		EXIT2(return 0);
+	res = mp_set_int(wnd, OID_802_11_INFRASTRUCTURE_MODE, mode);
+	if (res) {
+		WARNING("setting operating mode to %d failed (%08X)",
+			mode, res);
+		EXIT2(return -EINVAL);
+	}
+	/* NDIS drivers clear keys when infrastructure mode is
+	 * changed. But Linux tools assume otherwise. So set the
+	 * keys */
+	if (wnd->iw_auth_key_mgmt == 0 ||
+	    wnd->iw_auth_key_mgmt == IW_AUTH_KEY_MGMT_802_1X) {
+		for (i = 0; i < MAX_ENCR_KEYS; i++) {
+			if (wnd->encr_info.keys[i].length > 0)
+				add_wep_key(wnd, wnd->encr_info.keys[i].key,
+					    wnd->encr_info.keys[i].length, i);
+		}
+	}
+	wnd->infrastructure_mode = mode;
+	EXIT2(return 0);
+}
+
+static int iw_set_infra_mode(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+	struct ndis_device *wnd = netdev_priv(dev);
+	enum ndis_infrastructure_mode ndis_mode;
+
+	ENTER2("%d", wrqu->mode);
+	switch (wrqu->mode) {
+	case IW_MODE_ADHOC:
+		ndis_mode = Ndis802_11IBSS;
+		break;
+	case IW_MODE_INFRA:
+		ndis_mode = Ndis802_11Infrastructure;
+		break;
+	case IW_MODE_AUTO:
+		ndis_mode = Ndis802_11AutoUnknown;
+		break;
+	default:
+		EXIT2(return -EINVAL);
+	}
+
+	if (set_infra_mode(wnd, ndis_mode))
+		EXIT2(return -EINVAL);
+
+	EXIT2(return 0);
+}
+
+static int iw_get_infra_mode(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+	struct ndis_device *wnd = netdev_priv(dev);
+	int ndis_mode, iw_mode;
+	NDIS_STATUS res;
+
+	ENTER2("");
+	res = mp_query_int(wnd, OID_802_11_INFRASTRUCTURE_MODE, &ndis_mode);
+	if (res) {
+		WARNING("getting operating mode failed (%08X)", res);
+		EXIT2(return -EOPNOTSUPP);
+	}
+
+	switch(ndis_mode) {
+	case Ndis802_11IBSS:
+		iw_mode = IW_MODE_ADHOC;
+		break;
+	case Ndis802_11Infrastructure:
+		iw_mode = IW_MODE_INFRA;
+		break;
+	case Ndis802_11AutoUnknown:
+		iw_mode = IW_MODE_AUTO;
+		break;
+	default:
+		ERROR("invalid operating mode (%u)", ndis_mode);
+		EXIT2(return -EINVAL);
+	}
+	wrqu->mode = iw_mode;
+	EXIT2(return 0);
+}
+
+static const char *network_type_to_name(int net_type)
+{
+	if (net_type >= 0 &&
+	    net_type < (sizeof(network_names)/sizeof(network_names[0])))
+		return network_names[net_type];
+	else
+		return network_names[sizeof(network_names) /
+				     sizeof(network_names[0]) - 1];
+}
+
+static int iw_get_network_type(struct net_device *dev,
+			       struct iw_request_info *info,
+			       union iwreq_data *wrqu, char *extra)
+{
+	struct ndis_device *wnd = netdev_priv(dev);
+	unsigned int network_type;
+	NDIS_STATUS res;
+
+	ENTER2("");
+	res = mp_query_int(wnd, OID_802_11_NETWORK_TYPE_IN_USE,
+			   &network_type);
+	if (res) {
+		WARNING("getting network type failed: %08X", res);
+		network_type = -1;
+	}
+	strncpy(wrqu->name, network_type_to_name(network_type),
+	        sizeof(wrqu->name) - 1);
+	wrqu->name[sizeof(wrqu->name)-1] = 0;
+	return 0;
+}
+
+static int iw_get_freq(struct net_device *dev, struct iw_request_info *info,
+		       union iwreq_data *wrqu, char *extra)
+{
+	struct ndis_device *wnd = netdev_priv(dev);
+	NDIS_STATUS res;
+	struct ndis_configuration req;
+
+	ENTER2("");
+	memset(&req, 0, sizeof(req));
+	res = mp_query(wnd, OID_802_11_CONFIGURATION, &req, sizeof(req));
+	if (res) {
+		WARNING("getting configuration failed (%08X)", res);
+		EXIT2(return -EOPNOTSUPP);
+	}
+
+	memset(&(wrqu->freq), 0, sizeof(struct iw_freq));
+
+	/* see comment in wireless.h above the "struct iw_freq"
+	   definition for an explanation of this if
+	   NOTE: 1000000 is due to the kHz
+	*/
+	if (req.ds_config > 1000000) {
+		wrqu->freq.m = req.ds_config / 10;
+		wrqu->freq.e = 1;
+	}
+	else
+		wrqu->freq.m = req.ds_config;
+
+	/* convert from kHz to Hz */
+	wrqu->freq.e += 3;
+
+	return 0;
+}
+
+static int iw_set_freq(struct net_device *dev, struct iw_request_info *info,
+		       union iwreq_data *wrqu, char *extra)
+{
+	struct ndis_device *wnd = netdev_priv(dev);
+	NDIS_STATUS res;
+	struct ndis_configuration req;
+
+	ENTER2("");
+	/* this OID is valid only when not associated */
+	if (netif_carrier_ok(wnd->net_dev))
+		EXIT2(return 0);
+	memset(&req, 0, sizeof(req));
+	res = mp_query(wnd, OID_802_11_CONFIGURATION, &req, sizeof(req));
+	if (res) {
+		WARNING("getting configuration failed (%08X)", res);
+		EXIT2(return 0);
+	}
+
+	if (wrqu->freq.m < 1000 && wrqu->freq.e == 0) {
+		if (wrqu->freq.m >= 1 &&
+		    wrqu->freq.m <= (sizeof(freq_chan) / sizeof(freq_chan[0])))
+			req.ds_config = freq_chan[wrqu->freq.m - 1] * 1000;
+		else
+			return -EINVAL;
+	} else {
+		int i;
+		req.ds_config = wrqu->freq.m;
+		for (i = wrqu->freq.e; i > 0; i--)
+			req.ds_config *= 10;
+		req.ds_config /= 1000;
+	}
+	res = mp_set(wnd, OID_802_11_CONFIGURATION, &req, sizeof(req));
+	if (res)
+		WARNING("setting configuration failed (%08X)", res);
+	return 0;
+}
+
+static int iw_get_tx_power(struct net_device *dev, struct iw_request_info *info,
+			   union iwreq_data *wrqu, char *extra)
+{
+	struct ndis_device *wnd = netdev_priv(dev);
+	ndis_tx_power_level ndis_power;
+	NDIS_STATUS res;
+
+	ENTER2("");
+	res = mp_query(wnd, OID_802_11_TX_POWER_LEVEL,
+		       &ndis_power, sizeof(ndis_power));
+	if (res)
+		return -EOPNOTSUPP;
+	wrqu->txpower.flags = IW_TXPOW_MWATT;
+	wrqu->txpower.disabled = 0;
+	wrqu->txpower.fixed = 0;
+	wrqu->txpower.value = ndis_power;
+	return 0;
+}
+
+static int iw_set_tx_power(struct net_device *dev, struct iw_request_info *info,
+			   union iwreq_data *wrqu, char *extra)
+{
+	struct ndis_device *wnd = netdev_priv(dev);
+	ndis_tx_power_level ndis_power;
+	NDIS_STATUS res;
+
+	ENTER2("");
+	if (wrqu->txpower.disabled)
+		ndis_power = 0;
+	else {
+		if (wrqu->txpower.flags == IW_TXPOW_MWATT)
+			ndis_power = wrqu->txpower.value;
+		else { // wrqu->txpower.flags == IW_TXPOW_DBM
+			if (wrqu->txpower.value > 20)
+				ndis_power = 128;
+			else if (wrqu->txpower.value < -43)
+				ndis_power = 127;
+			else {
+				signed char tmp;
+				tmp = wrqu->txpower.value;
+				tmp = -12 - tmp;
+				tmp <<= 2;
+				ndis_power = (unsigned char)tmp;
+			}
+		}
+	}
+	TRACE2("%d", ndis_power);
+	res = mp_set(wnd, OID_802_11_TX_POWER_LEVEL,
+		     &ndis_power, sizeof(ndis_power));
+	if (res)
+		EXIT2(return -EOPNOTSUPP);
+	if (ndis_power == 0)
+		res = disassociate(wnd, 0);
+	EXIT2(return 0);
+}
+
+static int iw_get_bitrate(struct net_device *dev, struct iw_request_info *info,
+			  union iwreq_data *wrqu, char *extra)
+{
+	struct ndis_device *wnd = netdev_priv(dev);
+	ULONG ndis_rate;
+	int res;
+
+	ENTER2("");
+	res = mp_query(wnd, OID_GEN_LINK_SPEED, &ndis_rate, sizeof(ndis_rate));
+	if (res) {
+		WARNING("getting bitrate failed (%08X)", res);
+		ndis_rate = 0;
+	}
+
+	wrqu->bitrate.value = ndis_rate * 100;
+	return 0;
+}
+
+static int iw_set_bitrate(struct net_device *dev, struct iw_request_info *info,
+			  union iwreq_data *wrqu, char *extra)
+{
+	struct ndis_device *wnd = netdev_priv(dev);
+	int i, n;
+	NDIS_STATUS res;
+	ndis_rates_ex rates;
+
+	ENTER2("");
+	if (wrqu->bitrate.fixed == 0)
+		EXIT2(return 0);
+
+	res = mp_query_info(wnd, OID_802_11_SUPPORTED_RATES, &rates,
+			    sizeof(rates), &n, NULL);
+	if (res) {
+		WARNING("getting bit rate failed (%08X)", res);
+		EXIT2(return 0);
+	}
+	for (i = 0; i < n; i++) {
+		if (rates[i] & 0x80)
+			continue;
+		if ((rates[i] & 0x7f) * 500000 > wrqu->bitrate.value) {
+			TRACE2("setting rate %d to 0",
+			       (rates[i] & 0x7f) * 500000);
+			rates[i] = 0;
+		}
+	}
+
+	res = mp_set(wnd, OID_802_11_DESIRED_RATES, &rates, n);
+	if (res) {
+		WARNING("setting bit rate failed (%08X)", res);
+		EXIT2(return 0);
+	}
+
+	return 0;
+}
+
+static int iw_set_dummy(struct net_device *dev, struct iw_request_info *info,
+			union iwreq_data *wrqu, char *extra)
+{
+	/* Do nothing. Used for ioctls that are not implemented. */
+	return 0;
+}
+
+static int iw_get_rts_threshold(struct net_device *dev,
+				struct iw_request_info *info,
+				union iwreq_data *wrqu, char *extra)
+{
+	struct ndis_device *wnd = netdev_priv(dev);
+	ndis_rts_threshold threshold;
+	NDIS_STATUS res;
+
+	ENTER2("");
+	res = mp_query(wnd, OID_802_11_RTS_THRESHOLD,
+		       &threshold, sizeof(threshold));
+	if (res)
+		return -EOPNOTSUPP;
+
+	wrqu->rts.value = threshold;
+	return 0;
+}
+
+static int iw_set_rts_threshold(struct net_device *dev,
+				struct iw_request_info *info,
+				union iwreq_data *wrqu, char *extra)
+{
+	struct ndis_device *wnd = netdev_priv(dev);
+	ndis_rts_threshold threshold;
+	NDIS_STATUS res;
+
+	ENTER2("");
+	threshold = wrqu->rts.value;
+	res = mp_set(wnd, OID_802_11_RTS_THRESHOLD,
+		     &threshold, sizeof(threshold));
+	if (res == NDIS_STATUS_INVALID_DATA)
+		return -EINVAL;
+	if (res)
+		return -EOPNOTSUPP;
+
+	return 0;
+}
+
+static int iw_get_frag_threshold(struct net_device *dev,
+				 struct iw_request_info *info,
+				 union iwreq_data *wrqu, char *extra)
+{
+	struct ndis_device *wnd = netdev_priv(dev);
+	ndis_fragmentation_threshold frag_threshold;
+	NDIS_STATUS res;
+
+	ENTER2("");
+	res = mp_query(wnd, OID_802_11_FRAGMENTATION_THRESHOLD,
+		       &frag_threshold, sizeof(frag_threshold));
+	if (res)
+		return -ENOTSUPP;
+
+	wrqu->frag.value = frag_threshold;
+	return 0;
+}
+
+static int iw_set_frag_threshold(struct net_device *dev,
+				 struct iw_request_info *info,
+				 union iwreq_data *wrqu, char *extra)
+{
+	struct ndis_device *wnd = netdev_priv(dev);
+	ndis_rts_threshold threshold;
+	NDIS_STATUS res;
+
+	ENTER2("");
+	threshold = wrqu->frag.value;
+	res = mp_set(wnd, OID_802_11_FRAGMENTATION_THRESHOLD,
+		     &threshold, sizeof(threshold));
+	if (res == NDIS_STATUS_INVALID_DATA)
+		return -EINVAL;
+	if (res)
+		return -EOPNOTSUPP;
+	return 0;
+}
+
+int get_ap_address(struct ndis_device *wnd, mac_address ap_addr)
+{
+	NDIS_STATUS res;
+
+	res = mp_query(wnd, OID_802_11_BSSID, ap_addr, ETH_ALEN);
+	TRACE2(MACSTRSEP, MAC2STR(ap_addr));
+	if (res) {
+		TRACE2("res: %08X", res);
+		memset(ap_addr, 0x0, ETH_ALEN);
+		EXIT2(return -EOPNOTSUPP);
+	}
+	EXIT2(return 0);
+}
+
+static int iw_get_ap_address(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+	struct ndis_device *wnd = netdev_priv(dev);
+	mac_address ap_addr;
+
+	ENTER2("");
+	get_ap_address(wnd, ap_addr);
+	memcpy(wrqu->ap_addr.sa_data, ap_addr, ETH_ALEN);
+	wrqu->ap_addr.sa_family = ARPHRD_ETHER;
+	EXIT2(return 0);
+}
+
+static int iw_set_ap_address(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+	struct ndis_device *wnd = netdev_priv(dev);
+	NDIS_STATUS res;
+	mac_address ap_addr;
+
+	ENTER2("");
+	memcpy(ap_addr, wrqu->ap_addr.sa_data, ETH_ALEN);
+	TRACE2(MACSTRSEP, MAC2STR(ap_addr));
+	res = mp_set(wnd, OID_802_11_BSSID, ap_addr, ETH_ALEN);
+	/* user apps may set ap's mac address, which is not required;
+	 * they may fail to work if this function fails, so return
+	 * success */
+	if (res)
+		WARNING("setting AP mac address failed (%08X)", res);
+
+	EXIT2(return 0);
+}
+
+int set_iw_auth_mode(struct ndis_device *wnd, int wpa_version,
+		     int auth_80211_alg)
+{
+	NDIS_STATUS res;
+	ULONG auth_mode;
+
+	ENTER2("%d, %d", wpa_version, auth_80211_alg);
+	if (wpa_version & IW_AUTH_WPA_VERSION_WPA2) {
+		if (wnd->iw_auth_key_mgmt & IW_AUTH_KEY_MGMT_802_1X)
+			auth_mode = Ndis802_11AuthModeWPA2;
+		else
+			auth_mode = Ndis802_11AuthModeWPA2PSK;
+	} else if (wpa_version & IW_AUTH_WPA_VERSION_WPA) {
+		if (wnd->iw_auth_key_mgmt & IW_AUTH_KEY_MGMT_802_1X)
+			auth_mode = Ndis802_11AuthModeWPA;
+		else if (wnd->iw_auth_key_mgmt & IW_AUTH_KEY_MGMT_PSK)
+			auth_mode = Ndis802_11AuthModeWPAPSK;
+		else
+			auth_mode = Ndis802_11AuthModeWPANone;
+	} else if (auth_80211_alg & IW_AUTH_ALG_SHARED_KEY) {
+		if (auth_80211_alg & IW_AUTH_ALG_OPEN_SYSTEM)
+			auth_mode = Ndis802_11AuthModeAutoSwitch;
+		else
+			auth_mode = Ndis802_11AuthModeShared;
+	} else
+		auth_mode = Ndis802_11AuthModeOpen;
+
+	res = mp_set_int(wnd, OID_802_11_AUTHENTICATION_MODE, auth_mode);
+	if (res) {
+		WARNING("setting auth mode to %u failed (%08X)",
+			auth_mode, res);
+		if (res == NDIS_STATUS_INVALID_DATA)
+			EXIT2(return -EINVAL);
+		return -EOPNOTSUPP;
+	}
+	wnd->iw_auth_wpa_version = wpa_version;
+	wnd->iw_auth_80211_alg = auth_80211_alg;
+	EXIT2(return 0);
+}
+
+int set_ndis_auth_mode(struct ndis_device *wnd, ULONG auth_mode)
+{
+	NDIS_STATUS res;
+
+	ENTER2("%d", auth_mode);
+	res = mp_set_int(wnd, OID_802_11_AUTHENTICATION_MODE, auth_mode);
+	if (res) {
+		WARNING("setting auth mode to %u failed (%08X)",
+			auth_mode, res);
+		if (res == NDIS_STATUS_INVALID_DATA)
+			EXIT2(return -EINVAL);
+		return -EOPNOTSUPP;
+	}
+	switch (auth_mode) {
+	case Ndis802_11AuthModeWPA:
+		wnd->iw_auth_wpa_version = IW_AUTH_WPA_VERSION_WPA;
+		wnd->iw_auth_key_mgmt = IW_AUTH_KEY_MGMT_802_1X;
+		break;
+	case Ndis802_11AuthModeWPAPSK:
+		wnd->iw_auth_wpa_version = IW_AUTH_WPA_VERSION_WPA;
+		wnd->iw_auth_key_mgmt = IW_AUTH_KEY_MGMT_PSK;
+	case Ndis802_11AuthModeWPANone:
+		wnd->iw_auth_wpa_version = IW_AUTH_WPA_VERSION_DISABLED;
+		wnd->iw_auth_key_mgmt = IW_AUTH_KEY_MGMT_PSK;
+		break;
+	case Ndis802_11AuthModeWPA2:
+		wnd->iw_auth_wpa_version = IW_AUTH_WPA_VERSION_WPA2;
+		wnd->iw_auth_key_mgmt = IW_AUTH_KEY_MGMT_802_1X;
+		break;
+	case Ndis802_11AuthModeWPA2PSK:
+		wnd->iw_auth_wpa_version = IW_AUTH_WPA_VERSION_WPA2;
+		wnd->iw_auth_key_mgmt = IW_AUTH_KEY_MGMT_PSK;
+		break;
+	case Ndis802_11AuthModeOpen:
+		wnd->iw_auth_wpa_version = IW_AUTH_WPA_VERSION_DISABLED;
+		wnd->iw_auth_80211_alg = IW_AUTH_ALG_OPEN_SYSTEM;
+		break;
+	case Ndis802_11AuthModeShared:
+		wnd->iw_auth_wpa_version = IW_AUTH_WPA_VERSION_DISABLED;
+		wnd->iw_auth_80211_alg = IW_AUTH_ALG_SHARED_KEY;
+		break;
+	case Ndis802_11AuthModeAutoSwitch:
+		wnd->iw_auth_wpa_version = IW_AUTH_WPA_VERSION_DISABLED;
+		wnd->iw_auth_80211_alg = IW_AUTH_ALG_SHARED_KEY;
+		wnd->iw_auth_80211_alg |= IW_AUTH_ALG_OPEN_SYSTEM;
+		break;
+	default:
+		WARNING("invalid authentication algorithm: %d", auth_mode);
+		break;
+	}
+	EXIT2(return 0);
+}
+
+int set_auth_mode(struct ndis_device *wnd)
+{
+	return set_iw_auth_mode(wnd, wnd->iw_auth_wpa_version,
+				wnd->iw_auth_80211_alg);
+}
+
+int get_ndis_auth_mode(struct ndis_device *wnd)
+{
+	ULONG mode;
+	NDIS_STATUS res;
+
+	res = mp_query_int(wnd, OID_802_11_AUTHENTICATION_MODE, &mode);
+	if (res) {
+		WARNING("getting authentication mode failed (%08X)", res);
+		EXIT2(return -EOPNOTSUPP);
+	}
+	TRACE2("%d", mode);
+	return mode;
+}
+
+int set_iw_encr_mode(struct ndis_device *wnd, int cipher_pairwise,
+		     int cipher_groupwise)
+{
+	NDIS_STATUS res;
+	ULONG ndis_mode;
+
+	ENTER2("%d, %d", cipher_pairwise, cipher_groupwise);
+	if (cipher_pairwise & IW_AUTH_CIPHER_CCMP)
+		ndis_mode = Ndis802_11Encryption3Enabled;
+	else if (cipher_pairwise & IW_AUTH_CIPHER_TKIP)
+		ndis_mode = Ndis802_11Encryption2Enabled;
+	else if (cipher_pairwise &
+		 (IW_AUTH_CIPHER_WEP40 | IW_AUTH_CIPHER_WEP104))
+		ndis_mode = Ndis802_11Encryption1Enabled;
+	else if (cipher_groupwise & IW_AUTH_CIPHER_CCMP)
+		ndis_mode = Ndis802_11Encryption3Enabled;
+	else if (cipher_groupwise & IW_AUTH_CIPHER_TKIP)
+		ndis_mode = Ndis802_11Encryption2Enabled;
+	else
+		ndis_mode = Ndis802_11EncryptionDisabled;
+
+	res = mp_set_int(wnd, OID_802_11_ENCRYPTION_STATUS, ndis_mode);
+	if (res) {
+		WARNING("setting encryption mode to %u failed (%08X)",
+			ndis_mode, res);
+		if (res == NDIS_STATUS_INVALID_DATA)
+			EXIT2(return -EINVAL);
+		return -EOPNOTSUPP;
+	}
+	wnd->iw_auth_cipher_pairwise = cipher_pairwise;
+	wnd->iw_auth_cipher_group = cipher_groupwise;
+	EXIT2(return 0);
+}
+
+int set_encr_mode(struct ndis_device *wnd)
+{
+	return set_iw_encr_mode(wnd, wnd->iw_auth_cipher_pairwise,
+				wnd->iw_auth_cipher_group);
+}
+
+int get_ndis_encr_mode(struct ndis_device *wnd)
+{
+	ULONG mode;
+	NDIS_STATUS res;
+
+	ENTER2("");
+	res = mp_query_int(wnd, OID_802_11_ENCRYPTION_STATUS, &mode);
+	if (res) {
+		WARNING("getting encryption status failed (%08X)", res);
+		EXIT2(return -EOPNOTSUPP);
+	} else
+		EXIT2(return mode);
+}
+
+static int iw_get_encr(struct net_device *dev, struct iw_request_info *info,
+		       union iwreq_data *wrqu, char *extra)
+{
+	struct ndis_device *wnd = netdev_priv(dev);
+	int index, mode;
+	struct encr_info *encr_info = &wnd->encr_info;
+
+	ENTER2("wnd = %p", wnd);
+	wrqu->data.length = 0;
+	extra[0] = 0;
+
+	index = (wrqu->encoding.flags & IW_ENCODE_INDEX);
+	TRACE2("index = %u", index);
+	if (index > 0)
+		index--;
+	else
+		index = encr_info->tx_key_index;
+
+	if (index < 0 || index >= MAX_ENCR_KEYS) {
+		WARNING("encryption index out of range (%u)", index);
+		EXIT2(return -EINVAL);
+	}
+
+	if (index != encr_info->tx_key_index) {
+		if (encr_info->keys[index].length > 0) {
+			wrqu->data.flags |= IW_ENCODE_ENABLED;
+			wrqu->data.length = encr_info->keys[index].length;
+			memcpy(extra, encr_info->keys[index].key,
+			       encr_info->keys[index].length);
+		}
+		else
+			wrqu->data.flags |= IW_ENCODE_DISABLED;
+
+		EXIT2(return 0);
+	}
+
+	/* transmit key */
+	mode = get_ndis_encr_mode(wnd);
+	if (mode < 0)
+		EXIT2(return -EOPNOTSUPP);
+
+	if (mode == Ndis802_11EncryptionDisabled ||
+	    mode == Ndis802_11EncryptionNotSupported)
+		wrqu->data.flags |= IW_ENCODE_DISABLED;
+	else {
+		if (mode == Ndis802_11Encryption1KeyAbsent ||
+		    mode == Ndis802_11Encryption2KeyAbsent ||
+		    mode == Ndis802_11Encryption3KeyAbsent)
+			wrqu->data.flags |= IW_ENCODE_NOKEY;
+		else {
+			wrqu->data.flags |= IW_ENCODE_ENABLED;
+			wrqu->encoding.flags |= index+1;
+			wrqu->data.length = encr_info->keys[index].length;
+			memcpy(extra, encr_info->keys[index].key,
+			       encr_info->keys[index].length);
+		}
+	}
+	mode = get_ndis_auth_mode(wnd);
+	if (mode < 0)
+		EXIT2(return -EOPNOTSUPP);
+
+	if (mode == Ndis802_11AuthModeOpen)
+		wrqu->data.flags |= IW_ENCODE_OPEN;
+	else if (mode == Ndis802_11AuthModeAutoSwitch)
+		wrqu->data.flags |= IW_ENCODE_RESTRICTED;
+	else // Ndis802_11AuthModeAutoSwitch, Ndis802_11AuthModeWPA etc.
+		wrqu->data.flags |= IW_ENCODE_RESTRICTED;
+
+	EXIT2(return 0);
+}
+
+/* index must be 0 - N, as per NDIS  */
+int add_wep_key(struct ndis_device *wnd, char *key, int key_len,
+		int index)
+{
+	struct ndis_encr_key ndis_key;
+	NDIS_STATUS res;
+
+	ENTER2("key index: %d, length: %d", index, key_len);
+	if (key_len <= 0 || key_len > NDIS_ENCODING_TOKEN_MAX) {
+		WARNING("invalid key length (%d)", key_len);
+		EXIT2(return -EINVAL);
+	}
+	if (index < 0 || index >= MAX_ENCR_KEYS) {
+		WARNING("invalid key index (%d)", index);
+		EXIT2(return -EINVAL);
+	}
+	ndis_key.struct_size = sizeof(ndis_key);
+	ndis_key.length = key_len;
+	memcpy(&ndis_key.key, key, key_len);
+	ndis_key.index = index;
+
+	if (index == wnd->encr_info.tx_key_index) {
+		ndis_key.index |= (1 << 31);
+		res = set_iw_encr_mode(wnd, IW_AUTH_CIPHER_WEP104,
+				       IW_AUTH_CIPHER_NONE);
+		if (res)
+			WARNING("encryption couldn't be enabled (%08X)", res);
+	}
+	TRACE2("key %d: " MACSTRSEP, index, MAC2STR(key));
+	res = mp_set(wnd, OID_802_11_ADD_WEP, &ndis_key, sizeof(ndis_key));
+	if (res) {
+		WARNING("adding encryption key %d failed (%08X)",
+			index+1, res);
+		EXIT2(return -EINVAL);
+	}
+
+	/* Atheros driver messes up ndis_key during ADD_WEP, so
+	 * don't rely on that; instead use info in key and key_len */
+	wnd->encr_info.keys[index].length = key_len;
+	memcpy(&wnd->encr_info.keys[index].key, key, key_len);
+
+	EXIT2(return 0);
+}
+
+/* remove_key is for both wep and wpa */
+static int remove_key(struct ndis_device *wnd, int index,
+		      mac_address bssid)
+{
+	NDIS_STATUS res;
+	if (wnd->encr_info.keys[index].length == 0)
+		EXIT2(return 0);
+	wnd->encr_info.keys[index].length = 0;
+	memset(&wnd->encr_info.keys[index].key, 0,
+	       sizeof(wnd->encr_info.keys[index].length));
+	if (wnd->iw_auth_cipher_pairwise == IW_AUTH_CIPHER_TKIP ||
+	    wnd->iw_auth_cipher_pairwise == IW_AUTH_CIPHER_CCMP ||
+	    wnd->iw_auth_cipher_group == IW_AUTH_CIPHER_TKIP ||
+	    wnd->iw_auth_cipher_group == IW_AUTH_CIPHER_CCMP) {
+		struct ndis_remove_key remove_key;
+		remove_key.struct_size = sizeof(remove_key);
+		remove_key.index = index;
+		if (bssid) {
+			/* pairwise key */
+			if (memcmp(bssid, "\xff\xff\xff\xff\xff\xff",
+				   ETH_ALEN) != 0)
+				remove_key.index |= (1 << 30);
+			memcpy(remove_key.bssid, bssid,
+			       sizeof(remove_key.bssid));
+		} else
+			memset(remove_key.bssid, 0xff,
+			       sizeof(remove_key.bssid));
+		if (mp_set(wnd, OID_802_11_REMOVE_KEY,
+			   &remove_key, sizeof(remove_key)))
+			EXIT2(return -EINVAL);
+	} else {
+		ndis_key_index keyindex = index;
+		res = mp_set_int(wnd, OID_802_11_REMOVE_WEP, keyindex);
+		if (res) {
+			WARNING("removing encryption key %d failed (%08X)",
+				keyindex, res);
+			EXIT2(return -EINVAL);
+		}
+	}
+	/* if it is transmit key, disable encryption */
+	if (index == wnd->encr_info.tx_key_index) {
+		res = set_iw_encr_mode(wnd, IW_AUTH_CIPHER_NONE,
+				       IW_AUTH_CIPHER_NONE);
+		if (res)
+			WARNING("changing encr status failed (%08X)", res);
+	}
+	TRACE2("key %d removed", index);
+	EXIT2(return 0);
+}
+
+static int iw_set_wep(struct net_device *dev, struct iw_request_info *info,
+		      union iwreq_data *wrqu, char *extra)
+{
+	struct ndis_device *wnd = netdev_priv(dev);
+	NDIS_STATUS res;
+	unsigned int index, key_len;
+	struct encr_info *encr_info = &wnd->encr_info;
+	unsigned char *key;
+
+	ENTER2("");
+	index = (wrqu->encoding.flags & IW_ENCODE_INDEX);
+	TRACE2("index = %u", index);
+
+	/* iwconfig gives index as 1 - N */
+	if (index > 0)
+		index--;
+	else
+		index = encr_info->tx_key_index;
+
+	if (index < 0 || index >= MAX_ENCR_KEYS) {
+		WARNING("encryption index out of range (%u)", index);
+		EXIT2(return -EINVAL);
+	}
+
+	/* remove key if disabled */
+	if (wrqu->data.flags & IW_ENCODE_DISABLED) {
+		if (remove_key(wnd, index, NULL))
+			EXIT2(return -EINVAL);
+		else
+			EXIT2(return 0);
+	}
+
+	/* global encryption state (for all keys) */
+	if (wrqu->data.flags & IW_ENCODE_OPEN)
+		res = set_ndis_auth_mode(wnd, Ndis802_11AuthModeOpen);
+	else // if (wrqu->data.flags & IW_ENCODE_RESTRICTED)
+		res = set_ndis_auth_mode(wnd, Ndis802_11AuthModeShared);
+	if (res) {
+		WARNING("setting authentication mode failed (%08X)", res);
+		EXIT2(return -EINVAL);
+	}
+
+	TRACE2("key length: %d", wrqu->data.length);
+
+	if (wrqu->data.length > 0) {
+		key_len = wrqu->data.length;
+		key = extra;
+	} else { // must be set as tx key
+		if (encr_info->keys[index].length == 0) {
+			WARNING("key %d is not set", index+1);
+			EXIT2(return -EINVAL);
+		}
+		key_len = encr_info->keys[index].length;
+		key = encr_info->keys[index].key;
+		encr_info->tx_key_index = index;
+	}
+
+	if (add_wep_key(wnd, key, key_len, index))
+		EXIT2(return -EINVAL);
+
+	if (index == encr_info->tx_key_index) {
+		/* if transmit key is at index other than 0, some
+		 * drivers, at least Atheros and TI, want another
+		 * (global) non-transmit key to be set; don't know why */
+		if (index != 0) {
+			int i;
+			for (i = 0; i < MAX_ENCR_KEYS; i++)
+				if (i != index &&
+				    encr_info->keys[i].length != 0)
+					break;
+			if (i == MAX_ENCR_KEYS) {
+				if (index == 0)
+					i = index + 1;
+				else
+					i = index - 1;
+				if (add_wep_key(wnd, key, key_len, i))
+					WARNING("couldn't add broadcast key"
+						" at %d", i);
+			}
+		}
+		/* ndis drivers want essid to be set after setting encr */
+		set_essid(wnd, wnd->essid.essid, wnd->essid.length);
+	}
+	EXIT2(return 0);
+}
+
+static int iw_set_nick(struct net_device *dev, struct iw_request_info *info,
+		       union iwreq_data *wrqu, char *extra)
+{
+	struct ndis_device *wnd = netdev_priv(dev);
+
+	if (wrqu->data.length >= IW_ESSID_MAX_SIZE || wrqu->data.length <= 0)
+		return -EINVAL;
+	memcpy(wnd->nick, extra, wrqu->data.length);
+	wnd->nick[wrqu->data.length] = 0;
+	return 0;
+}
+
+static int iw_get_nick(struct net_device *dev, struct iw_request_info *info,
+		       union iwreq_data *wrqu, char *extra)
+{
+	struct ndis_device *wnd = netdev_priv(dev);
+
+	wrqu->data.length = strlen(wnd->nick);
+	memcpy(extra, wnd->nick, wrqu->data.length);
+	return 0;
+}
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 27) && !defined(IW_REQUEST_FLAG_COMPAT)
+#define	iwe_stream_add_event(a, b, c, d, e)	iwe_stream_add_event(b, c, d, e)
+#define	iwe_stream_add_point(a, b, c, d, e)	iwe_stream_add_point(b, c, d, e)
+#define	iwe_stream_add_value(a, b, c, d, e, f)	\
+	iwe_stream_add_value(b, c, d, e, f)
+#define	iwe_stream_lcp_len(a)			IW_EV_LCP_LEN
+#endif
+
+static char *ndis_translate_scan(struct net_device *dev,
+				 struct iw_request_info *info, char *event,
+				 char *end_buf, void *item)
+{
+	struct iw_event iwe;
+	char *current_val;
+	int i, nrates;
+	unsigned char buf[MAX_WPA_IE_LEN * 2 + 30];
+	struct ndis_wlan_bssid *bssid;
+	struct ndis_wlan_bssid_ex *bssid_ex;
+
+	ENTER2("%p, %p", event, item);
+	bssid = item;
+	bssid_ex = item;
+	/* add mac address */
+	memset(&iwe, 0, sizeof(iwe));
+	iwe.cmd = SIOCGIWAP;
+	iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
+	iwe.len = IW_EV_ADDR_LEN;
+	memcpy(iwe.u.ap_addr.sa_data, bssid->mac, ETH_ALEN);
+	event = iwe_stream_add_event(info, event, end_buf, &iwe,
+				     IW_EV_ADDR_LEN);
+
+	/* add essid */
+	memset(&iwe, 0, sizeof(iwe));
+	iwe.cmd = SIOCGIWESSID;
+	iwe.u.data.length = bssid->ssid.length;
+	if (iwe.u.data.length > IW_ESSID_MAX_SIZE)
+		iwe.u.data.length = IW_ESSID_MAX_SIZE;
+	iwe.u.data.flags = 1;
+	iwe.len = IW_EV_POINT_LEN + iwe.u.data.length;
+	event = iwe_stream_add_point(info, event, end_buf, &iwe,
+				     bssid->ssid.essid);
+
+	/* add protocol name */
+	memset(&iwe, 0, sizeof(iwe));
+	iwe.cmd = SIOCGIWNAME;
+	strncpy(iwe.u.name, network_type_to_name(bssid->net_type), IFNAMSIZ);
+	event = iwe_stream_add_event(info, event, end_buf, &iwe,
+				     IW_EV_CHAR_LEN);
+
+	/* add mode */
+	memset(&iwe, 0, sizeof(iwe));
+	iwe.cmd = SIOCGIWMODE;
+	if (bssid->mode == Ndis802_11IBSS)
+		iwe.u.mode = IW_MODE_ADHOC;
+	else if (bssid->mode == Ndis802_11Infrastructure)
+		iwe.u.mode = IW_MODE_INFRA;
+	else // if (bssid->mode == Ndis802_11AutoUnknown)
+		iwe.u.mode = IW_MODE_AUTO;
+	event = iwe_stream_add_event(info, event, end_buf, &iwe,
+				     IW_EV_UINT_LEN);
+
+	/* add freq */
+	memset(&iwe, 0, sizeof(iwe));
+	iwe.cmd = SIOCGIWFREQ;
+	iwe.u.freq.m = bssid->config.ds_config;
+	if (bssid->config.ds_config > 1000000) {
+		iwe.u.freq.m = bssid->config.ds_config / 10;
+		iwe.u.freq.e = 1;
+	}
+	else
+		iwe.u.freq.m = bssid->config.ds_config;
+	/* convert from kHz to Hz */
+	iwe.u.freq.e += 3;
+	iwe.len = IW_EV_FREQ_LEN;
+	event = iwe_stream_add_event(info, event, end_buf, &iwe,
+				     IW_EV_FREQ_LEN);
+
+	/* add qual */
+	memset(&iwe, 0, sizeof(iwe));
+	iwe.cmd = IWEVQUAL;
+	i = 100 * (bssid->rssi - WL_NOISE) / (WL_SIGMAX - WL_NOISE);
+	if (i < 0)
+		i = 0;
+	else if (i > 100)
+		i = 100;
+	iwe.u.qual.level = bssid->rssi;
+	iwe.u.qual.noise = WL_NOISE;
+	iwe.u.qual.qual  = i;
+	iwe.len = IW_EV_QUAL_LEN;
+	event = iwe_stream_add_event(info, event, end_buf, &iwe,
+				     IW_EV_QUAL_LEN);
+
+	/* add key info */
+	memset(&iwe, 0, sizeof(iwe));
+	iwe.cmd = SIOCGIWENCODE;
+	if (bssid->privacy == Ndis802_11PrivFilterAcceptAll)
+		iwe.u.data.flags = IW_ENCODE_DISABLED;
+	else
+		iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
+	iwe.u.data.length = 0;
+	iwe.len = IW_EV_POINT_LEN;
+	event = iwe_stream_add_point(info, event, end_buf, &iwe,
+				     bssid->ssid.essid);
+
+	/* add rate */
+	memset(&iwe, 0, sizeof(iwe));
+	current_val = event + iwe_stream_lcp_len(info);
+	iwe.cmd = SIOCGIWRATE;
+	if (bssid->length > sizeof(*bssid))
+		nrates = NDIS_MAX_RATES_EX;
+	else
+		nrates = NDIS_MAX_RATES;
+	for (i = 0 ; i < nrates ; i++) {
+		if (bssid->rates[i] & 0x7f) {
+			iwe.u.bitrate.value = ((bssid->rates[i] & 0x7f) *
+					       500000);
+			current_val = iwe_stream_add_value(info, event,
+							   current_val,
+							   end_buf, &iwe,
+							   IW_EV_PARAM_LEN);
+		}
+	}
+
+	if ((current_val - event) > iwe_stream_lcp_len(info))
+		event = current_val;
+
+	memset(&iwe, 0, sizeof(iwe));
+	iwe.cmd = IWEVCUSTOM;
+	sprintf(buf, "bcn_int=%d", bssid->config.beacon_period);
+	iwe.u.data.length = strlen(buf);
+	event = iwe_stream_add_point(info, event, end_buf, &iwe, buf);
+
+	memset(&iwe, 0, sizeof(iwe));
+	iwe.cmd = IWEVCUSTOM;
+	sprintf(buf, "atim=%u", bssid->config.atim_window);
+	iwe.u.data.length = strlen(buf);
+	event = iwe_stream_add_point(info, event, end_buf, &iwe, buf);
+
+	TRACE2("%d, %u", bssid->length, (unsigned int)sizeof(*bssid));
+	if (bssid->length > sizeof(*bssid)) {
+		unsigned char *iep = (unsigned char *)bssid_ex->ies +
+			sizeof(struct ndis_fixed_ies);
+		no_warn_unused unsigned char *end = iep + bssid_ex->ie_length;
+
+		while (iep + 1 < end && iep + 2 + iep[1] <= end) {
+			unsigned char ielen = 2 + iep[1];
+
+			if (ielen > SSID_MAX_WPA_IE_LEN) {
+				iep += ielen;
+				continue;
+			}
+			if ((iep[0] == WLAN_EID_GENERIC && iep[1] >= 4 &&
+			     memcmp(iep + 2, "\x00\x50\xf2\x01", 4) == 0) ||
+			    iep[0] == RSN_INFO_ELEM) {
+				memset(&iwe, 0, sizeof(iwe));
+				iwe.cmd = IWEVGENIE;
+				iwe.u.data.length = ielen;
+				event = iwe_stream_add_point(info, event,
+							     end_buf, &iwe,
+							     iep);
+			}
+			iep += ielen;
+		}
+	}
+	TRACE2("event = %p, current_val = %p", event, current_val);
+	EXIT2(return event);
+}
+
+int set_scan(struct ndis_device *wnd)
+{
+	NDIS_STATUS res;
+
+	ENTER2("");
+	res = mp_set(wnd, OID_802_11_BSSID_LIST_SCAN, NULL, 0);
+	if (res) {
+		WARNING("scanning failed (%08X)", res);
+		EXIT2(return -EOPNOTSUPP);
+	}
+	wnd->scan_timestamp = jiffies;
+	EXIT2(return 0);
+}
+
+static int iw_set_scan(struct net_device *dev, struct iw_request_info *info,
+		       union iwreq_data *wrqu, char *extra)
+{
+	struct ndis_device *wnd = netdev_priv(dev);
+	return set_scan(wnd);
+}
+
+static int iw_get_scan(struct net_device *dev, struct iw_request_info *info,
+		       union iwreq_data *wrqu, char *extra)
+{
+	struct ndis_device *wnd = netdev_priv(dev);
+	unsigned int i, list_len, needed;
+	NDIS_STATUS res;
+	struct ndis_bssid_list *bssid_list = NULL;
+	char *event = extra;
+	struct ndis_wlan_bssid *cur_item ;
+
+	ENTER2("");
+	if (time_before(jiffies, wnd->scan_timestamp + 3 * HZ))
+		return -EAGAIN;
+	/* try with space for a few scan items */
+	list_len = sizeof(ULONG) + sizeof(struct ndis_wlan_bssid_ex) * 8;
+	bssid_list = kmalloc(list_len, GFP_KERNEL);
+	if (!bssid_list) {
+		ERROR("couldn't allocate memory");
+		return -ENOMEM;
+	}
+	/* some drivers don't set bssid_list->num_items to 0 if
+	   OID_802_11_BSSID_LIST returns no items (prism54 driver, e.g.,) */
+	memset(bssid_list, 0, list_len);
+
+	needed = 0;
+	res = mp_query_info(wnd, OID_802_11_BSSID_LIST,
+			    bssid_list, list_len, NULL, &needed);
+	if (res == NDIS_STATUS_INVALID_LENGTH ||
+	    res == NDIS_STATUS_BUFFER_TOO_SHORT) {
+		/* now try with required space */
+		kfree(bssid_list);
+		list_len = needed;
+		bssid_list = kmalloc(list_len, GFP_KERNEL);
+		if (!bssid_list) {
+			ERROR("couldn't allocate memory");
+			return -ENOMEM;
+		}
+		memset(bssid_list, 0, list_len);
+
+		res = mp_query(wnd, OID_802_11_BSSID_LIST,
+			       bssid_list, list_len);
+	}
+	if (res) {
+		WARNING("getting BSSID list failed (%08X)", res);
+		kfree(bssid_list);
+		EXIT2(return -EOPNOTSUPP);
+	}
+	TRACE2("%d", bssid_list->num_items);
+	cur_item = &bssid_list->bssid[0];
+	for (i = 0; i < bssid_list->num_items; i++) {
+		event = ndis_translate_scan(dev, info, event,
+					    extra + IW_SCAN_MAX_DATA, cur_item);
+		cur_item = (struct ndis_wlan_bssid *)((char *)cur_item +
+						      cur_item->length);
+	}
+	wrqu->data.length = event - extra;
+	wrqu->data.flags = 0;
+	kfree(bssid_list);
+	EXIT2(return 0);
+}
+
+static int iw_set_power_mode(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+	struct ndis_device *wnd = netdev_priv(dev);
+	NDIS_STATUS res;
+	ULONG power_mode;
+
+	if (wrqu->power.disabled == 1)
+		power_mode = NDIS_POWER_OFF;
+	else if (wrqu->power.flags & IW_POWER_MIN)
+		power_mode = NDIS_POWER_MIN;
+	else // if (wrqu->power.flags & IW_POWER_MAX)
+		power_mode = NDIS_POWER_MAX;
+
+	TRACE2("%d", power_mode);
+	res = mp_set(wnd, OID_802_11_POWER_MODE,
+		     &power_mode, sizeof(power_mode));
+	if (res)
+		WARNING("setting power mode failed (%08X)", res);
+	return 0;
+}
+
+static int iw_get_power_mode(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+	struct ndis_device *wnd = netdev_priv(dev);
+	NDIS_STATUS res;
+	ULONG power_mode;
+
+	ENTER2("");
+	res = mp_query(wnd, OID_802_11_POWER_MODE,
+		       &power_mode, sizeof(power_mode));
+	if (res)
+		return -ENOTSUPP;
+
+	if (power_mode == NDIS_POWER_OFF)
+		wrqu->power.disabled = 1;
+	else {
+		if (wrqu->power.flags != 0)
+			return 0;
+		wrqu->power.flags |= IW_POWER_ALL_R;
+		wrqu->power.flags |= IW_POWER_TIMEOUT;
+		wrqu->power.value = 0;
+		wrqu->power.disabled = 0;
+
+		if (power_mode == NDIS_POWER_MIN)
+			wrqu->power.flags |= IW_POWER_MIN;
+		else // if (power_mode == NDIS_POWER_MAX)
+			wrqu->power.flags |= IW_POWER_MAX;
+	}
+	return 0;
+}
+
+static int iw_get_sensitivity(struct net_device *dev,
+			      struct iw_request_info *info,
+			      union iwreq_data *wrqu, char *extra)
+{
+	struct ndis_device *wnd = netdev_priv(dev);
+	NDIS_STATUS res;
+	ndis_rssi rssi_trigger;
+
+	ENTER2("");
+	res = mp_query(wnd, OID_802_11_RSSI_TRIGGER,
+		       &rssi_trigger, sizeof(rssi_trigger));
+	if (res)
+		return -EOPNOTSUPP;
+	wrqu->param.value = rssi_trigger;
+	wrqu->param.disabled = (rssi_trigger == 0);
+	wrqu->param.fixed = 1;
+	return 0;
+}
+
+static int iw_set_sensitivity(struct net_device *dev,
+			      struct iw_request_info *info,
+			      union iwreq_data *wrqu, char *extra)
+{
+	struct ndis_device *wnd = netdev_priv(dev);
+	NDIS_STATUS res;
+	ndis_rssi rssi_trigger;
+
+	ENTER2("");
+	if (wrqu->param.disabled)
+		rssi_trigger = 0;
+	else
+		rssi_trigger = wrqu->param.value;
+	res = mp_set(wnd, OID_802_11_RSSI_TRIGGER,
+		     &rssi_trigger, sizeof(rssi_trigger));
+	if (res == NDIS_STATUS_INVALID_DATA)
+		return -EINVAL;
+	if (res)
+		return -EOPNOTSUPP;
+	return 0;
+}
+
+static int iw_get_ndis_stats(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+	struct ndis_device *wnd = netdev_priv(dev);
+	struct iw_statistics *stats = &wnd->iw_stats;
+	memcpy(&wrqu->qual, &stats->qual, sizeof(stats->qual));
+	return 0;
+}
+
+static int iw_get_range(struct net_device *dev, struct iw_request_info *info,
+			union iwreq_data *wrqu, char *extra)
+{
+	struct iw_range *range = (struct iw_range *)extra;
+	struct iw_point *data = &wrqu->data;
+	struct ndis_device *wnd = netdev_priv(dev);
+	unsigned int i, n;
+	NDIS_STATUS res;
+	ndis_rates_ex rates;
+	ndis_tx_power_level tx_power;
+
+	ENTER2("");
+	data->length = sizeof(struct iw_range);
+	memset(range, 0, sizeof(struct iw_range));
+
+	range->txpower_capa = IW_TXPOW_MWATT;
+	range->num_txpower = 0;
+
+	res = mp_query(wnd, OID_802_11_TX_POWER_LEVEL,
+		       &tx_power, sizeof(tx_power));
+	if (!res) {
+		range->num_txpower = 1;
+		range->txpower[0] = tx_power;
+	}
+
+	range->we_version_compiled = WIRELESS_EXT;
+	range->we_version_source = 18;
+
+	range->retry_capa = IW_RETRY_LIMIT;
+	range->retry_flags = IW_RETRY_LIMIT;
+	range->min_retry = 0;
+	range->max_retry = 255;
+
+	range->num_channels = 1;
+
+	range->max_qual.qual = 100;
+	range->max_qual.level = 154;
+	range->max_qual.noise = 154;
+	range->sensitivity = 3;
+
+	range->max_encoding_tokens = 4;
+	range->num_encoding_sizes = 2;
+	range->encoding_size[0] = 5;
+	range->encoding_size[1] = 13;
+
+	range->num_bitrates = 0;
+	memset(&rates, 0, sizeof(rates));
+	res = mp_query_info(wnd, OID_802_11_SUPPORTED_RATES,
+			    &rates, sizeof(rates), &n, NULL);
+	if (res)
+		WARNING("getting bit rates failed: %08X", res);
+	else {
+		for (i = 0; i < n && range->num_bitrates < IW_MAX_BITRATES; i++)
+			if (rates[i] & 0x80)
+				continue;
+			else if (rates[i] & 0x7f) {
+				range->bitrate[range->num_bitrates] =
+					(rates[i] & 0x7f) * 500000;
+				range->num_bitrates++;
+			}
+	}
+
+	range->num_channels = (sizeof(freq_chan)/sizeof(freq_chan[0]));
+
+	for (i = 0; i < (sizeof(freq_chan)/sizeof(freq_chan[0])) &&
+		    i < IW_MAX_FREQUENCIES; i++) {
+		range->freq[i].i = i + 1;
+		range->freq[i].m = freq_chan[i] * 100000;
+		range->freq[i].e = 1;
+	}
+	range->num_frequency = i;
+
+	range->min_rts = 0;
+	range->max_rts = 2347;
+	range->min_frag = 256;
+	range->max_frag = 2346;
+
+	/* Event capability (kernel + driver) */
+	range->event_capa[0] = (IW_EVENT_CAPA_K_0 |
+				IW_EVENT_CAPA_MASK(SIOCGIWTHRSPY) |
+				IW_EVENT_CAPA_MASK(SIOCGIWAP) |
+				IW_EVENT_CAPA_MASK(SIOCGIWSCAN));
+	range->event_capa[1] = IW_EVENT_CAPA_K_1;
+	range->event_capa[4] = (IW_EVENT_CAPA_MASK(IWEVTXDROP) |
+				IW_EVENT_CAPA_MASK(IWEVCUSTOM) |
+				IW_EVENT_CAPA_MASK(IWEVREGISTERED) |
+				IW_EVENT_CAPA_MASK(IWEVEXPIRED));
+
+	range->enc_capa = 0;
+
+	if (test_bit(Ndis802_11Encryption2Enabled, &wnd->capa.encr))
+		range->enc_capa |= IW_ENC_CAPA_CIPHER_TKIP;
+	if (test_bit(Ndis802_11Encryption3Enabled, &wnd->capa.encr))
+		range->enc_capa |= IW_ENC_CAPA_CIPHER_CCMP;
+
+	if (test_bit(Ndis802_11AuthModeWPA, &wnd->capa.auth) ||
+	    test_bit(Ndis802_11AuthModeWPAPSK, &wnd->capa.auth))
+		range->enc_capa |= IW_ENC_CAPA_WPA;
+	if (test_bit(Ndis802_11AuthModeWPA2, &wnd->capa.auth) ||
+	    test_bit(Ndis802_11AuthModeWPA2PSK, &wnd->capa.auth))
+		range->enc_capa |= IW_ENC_CAPA_WPA2;
+
+	return 0;
+}
+
+void set_default_iw_params(struct ndis_device *wnd)
+{
+	wnd->iw_auth_key_mgmt = 0;
+	wnd->iw_auth_wpa_version = 0;
+	set_infra_mode(wnd, Ndis802_11Infrastructure);
+	set_ndis_auth_mode(wnd, Ndis802_11AuthModeOpen);
+	set_priv_filter(wnd);
+	set_iw_encr_mode(wnd, IW_AUTH_CIPHER_NONE, IW_AUTH_CIPHER_NONE);
+}
+
+static int deauthenticate(struct ndis_device *wnd)
+{
+	int ret;
+
+	ENTER2("");
+	ret = disassociate(wnd, 1);
+	set_default_iw_params(wnd);
+	EXIT2(return ret);
+}
+
+NDIS_STATUS disassociate(struct ndis_device *wnd, int reset_ssid)
+{
+	NDIS_STATUS res;
+	u8 buf[NDIS_ESSID_MAX_SIZE];
+	int i;
+
+	TRACE2("");
+	res = mp_set(wnd, OID_802_11_DISASSOCIATE, NULL, 0);
+	/* disassociate causes radio to be turned off; if reset_ssid
+	 * is given, set ssid to random to enable radio */
+	if (reset_ssid) {
+		get_random_bytes(buf, sizeof(buf));
+		for (i = 0; i < sizeof(buf); i++)
+			buf[i] = 'a' + (buf[i] % 26);
+		set_essid(wnd, buf, sizeof(buf));
+	}
+	return res;
+}
+
+static ULONG ndis_priv_mode(struct ndis_device *wnd)
+{
+	if (wnd->iw_auth_wpa_version & IW_AUTH_WPA_VERSION_WPA2 ||
+	    wnd->iw_auth_wpa_version & IW_AUTH_WPA_VERSION_WPA)
+		return Ndis802_11PrivFilter8021xWEP;
+	else
+		return Ndis802_11PrivFilterAcceptAll;
+}
+
+int set_priv_filter(struct ndis_device *wnd)
+{
+	NDIS_STATUS res;
+	ULONG flags;
+
+	flags = ndis_priv_mode(wnd);
+	ENTER2("filter: %d", flags);
+	res = mp_set_int(wnd, OID_802_11_PRIVACY_FILTER, flags);
+	if (res)
+		TRACE2("setting privacy filter to %d failed (%08X)",
+		       flags, res);
+	EXIT2(return 0);
+}
+
+static int iw_set_mlme(struct net_device *dev, struct iw_request_info *info,
+		       union iwreq_data *wrqu, char *extra)
+{
+	struct ndis_device *wnd = netdev_priv(dev);
+	struct iw_mlme *mlme = (struct iw_mlme *)extra;
+
+	ENTER2("");
+	switch (mlme->cmd) {
+	case IW_MLME_DEAUTH:
+		return deauthenticate(wnd);
+	case IW_MLME_DISASSOC:
+		TRACE2("cmd=%d reason_code=%d", mlme->cmd, mlme->reason_code);
+		return disassociate(wnd, 1);
+	default:
+		return -EOPNOTSUPP;
+	}
+
+	return 0;
+}
+
+static int iw_set_genie(struct net_device *dev,
+			struct iw_request_info *info,
+			union iwreq_data *wrqu, char *extra)
+{
+	/*
+	 * NDIS drivers do not allow IEs to be configured; this is
+	 * done by the driver based on other configuration. Return 0
+	 * to avoid causing issues with user space programs that
+	 * expect this function to succeed.
+	 */
+	return 0;
+}
+
+static int iw_set_auth(struct net_device *dev,
+		       struct iw_request_info *info,
+		       union iwreq_data *wrqu, char *extra)
+{
+	struct ndis_device *wnd = netdev_priv(dev);
+	TRACE2("index=%d value=%d", wrqu->param.flags & IW_AUTH_INDEX,
+	       wrqu->param.value);
+	switch (wrqu->param.flags & IW_AUTH_INDEX) {
+	case IW_AUTH_WPA_VERSION:
+		wnd->iw_auth_wpa_version = wrqu->param.value;
+		break;
+	case IW_AUTH_CIPHER_PAIRWISE:
+		wnd->iw_auth_cipher_pairwise = wrqu->param.value;
+		break;
+	case IW_AUTH_CIPHER_GROUP:
+		wnd->iw_auth_cipher_group = wrqu->param.value;
+		break;
+	case IW_AUTH_KEY_MGMT:
+		wnd->iw_auth_key_mgmt = wrqu->param.value;
+		break;
+	case IW_AUTH_80211_AUTH_ALG:
+		wnd->iw_auth_80211_alg = wrqu->param.value;
+		break;
+	case IW_AUTH_WPA_ENABLED:
+		if (wrqu->param.value)
+			deauthenticate(wnd);
+		break;
+	case IW_AUTH_TKIP_COUNTERMEASURES:
+	case IW_AUTH_DROP_UNENCRYPTED:
+	case IW_AUTH_RX_UNENCRYPTED_EAPOL:
+	case IW_AUTH_PRIVACY_INVOKED:
+		TRACE2("%d not implemented: %d",
+		       wrqu->param.flags & IW_AUTH_INDEX, wrqu->param.value);
+		break;
+	default:
+		WARNING("invalid cmd %d", wrqu->param.flags & IW_AUTH_INDEX);
+		return -EOPNOTSUPP;
+	}
+	return 0;
+}
+
+static int iw_get_auth(struct net_device *dev,
+		       struct iw_request_info *info,
+		       union iwreq_data *wrqu, char *extra)
+{
+	struct ndis_device *wnd = netdev_priv(dev);
+
+	ENTER2("index=%d", wrqu->param.flags & IW_AUTH_INDEX);
+	switch (wrqu->param.flags & IW_AUTH_INDEX) {
+	case IW_AUTH_WPA_VERSION:
+		wrqu->param.value = wnd->iw_auth_wpa_version;
+		break;
+	case IW_AUTH_CIPHER_PAIRWISE:
+		wrqu->param.value = wnd->iw_auth_cipher_pairwise;
+		break;
+	case IW_AUTH_CIPHER_GROUP:
+		wrqu->param.value = wnd->iw_auth_cipher_group;
+		break;
+	case IW_AUTH_KEY_MGMT:
+		wrqu->param.value = wnd->iw_auth_key_mgmt;
+		break;
+	case IW_AUTH_80211_AUTH_ALG:
+		wrqu->param.value = wnd->iw_auth_80211_alg;
+		break;
+	default:
+		WARNING("invalid cmd %d", wrqu->param.flags & IW_AUTH_INDEX);
+		return -EOPNOTSUPP;
+	}
+	return 0;
+}
+
+static int iw_set_encodeext(struct net_device *dev,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu, char *extra)
+{
+	struct iw_encode_ext *ext = (struct iw_encode_ext *)extra;
+	struct ndis_device *wnd = netdev_priv(dev);
+	struct ndis_add_key ndis_key;
+	int i, keyidx;
+	NDIS_STATUS res;
+	u8 *addr;
+
+	keyidx = wrqu->encoding.flags & IW_ENCODE_INDEX;
+	ENTER2("%d", keyidx);
+	if (keyidx)
+		keyidx--;
+	else
+		keyidx = wnd->encr_info.tx_key_index;
+
+	if (keyidx < 0 || keyidx >= MAX_ENCR_KEYS)
+		return -EINVAL;
+
+	if (ext->alg == WPA_ALG_WEP) {
+		if (!test_bit(Ndis802_11Encryption1Enabled, &wnd->capa.encr))
+			EXIT2(return -1);
+		if (ext->ext_flags & IW_ENCODE_EXT_SET_TX_KEY)
+			wnd->encr_info.tx_key_index = keyidx;
+		if (add_wep_key(wnd, ext->key, ext->key_len, keyidx))
+			EXIT2(return -1);
+		else
+			EXIT2(return 0);
+	}
+	if ((wrqu->encoding.flags & IW_ENCODE_DISABLED) ||
+	    ext->alg == IW_ENCODE_ALG_NONE || ext->key_len == 0)
+		EXIT2(return remove_key(wnd, keyidx, ndis_key.bssid));
+
+	if (ext->key_len > sizeof(ndis_key.key)) {
+		TRACE2("incorrect key length (%u)", ext->key_len);
+		EXIT2(return -1);
+	}
+
+	memset(&ndis_key, 0, sizeof(ndis_key));
+
+	ndis_key.struct_size =
+		sizeof(ndis_key) - sizeof(ndis_key.key) + ext->key_len;
+	ndis_key.length = ext->key_len;
+	ndis_key.index = keyidx;
+
+	if (ext->ext_flags & IW_ENCODE_EXT_RX_SEQ_VALID) {
+		for (i = 0; i < 6 ; i++)
+			ndis_key.rsc |= (((u64)ext->rx_seq[i]) << (i * 8));
+		TRACE2("0x%Lx", ndis_key.rsc);
+		ndis_key.index |= 1 << 29;
+	}
+
+	addr = ext->addr.sa_data;
+	if (ext->ext_flags & IW_ENCODE_EXT_GROUP_KEY) {
+		/* group key */
+		if (wnd->infrastructure_mode == Ndis802_11IBSS)
+			memset(ndis_key.bssid, 0xff, ETH_ALEN);
+		else
+			get_ap_address(wnd, ndis_key.bssid);
+	} else {
+		/* pairwise key */
+		ndis_key.index |= (1 << 30);
+		memcpy(ndis_key.bssid, addr, ETH_ALEN);
+	}
+	TRACE2(MACSTRSEP, MAC2STR(ndis_key.bssid));
+
+	if (ext->ext_flags & IW_ENCODE_EXT_SET_TX_KEY)
+		ndis_key.index |= (1 << 31);
+
+	if (ext->alg == IW_ENCODE_ALG_TKIP && ext->key_len == 32) {
+		/* wpa_supplicant gives us the Michael MIC RX/TX keys in
+		 * different order than NDIS spec, so swap the order here. */
+		memcpy(ndis_key.key, ext->key, 16);
+		memcpy(ndis_key.key + 16, ext->key + 24, 8);
+		memcpy(ndis_key.key + 24, ext->key + 16, 8);
+	} else
+		memcpy(ndis_key.key, ext->key, ext->key_len);
+
+	res = mp_set(wnd, OID_802_11_ADD_KEY, &ndis_key, ndis_key.struct_size);
+	if (res) {
+		TRACE2("adding key failed (%08X), %u",
+		       res, ndis_key.struct_size);
+		EXIT2(return -1);
+	}
+	wnd->encr_info.keys[keyidx].length = ext->key_len;
+	memcpy(&wnd->encr_info.keys[keyidx].key, ndis_key.key, ext->key_len);
+	if (ext->ext_flags & IW_ENCODE_EXT_SET_TX_KEY)
+		wnd->encr_info.tx_key_index = keyidx;
+	TRACE2("key %d added", keyidx);
+
+	EXIT2(return 0);
+}
+
+static int iw_get_encodeext(struct net_device *dev,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu, char *extra)
+{
+	/* struct iw_encode_ext *ext = (struct iw_encode_ext *) extra; */
+	/* TODO */
+	ENTER2("");
+	return 0;
+}
+
+static int iw_set_pmksa(struct net_device *dev, struct iw_request_info *info,
+			union iwreq_data *wrqu, char *extra)
+{
+	struct iw_pmksa *pmksa = (struct iw_pmksa *)extra;
+	struct ndis_pmkid pmkid;
+	NDIS_STATUS res;
+	struct ndis_device *wnd = netdev_priv(dev);
+
+	/* TODO: must keep local list of PMKIDs since NDIS drivers
+	 * expect that all PMKID entries are included whenever a new
+	 * one is added. */
+
+	ENTER2("%d", pmksa->cmd);
+	if ((pmksa->cmd == IW_PMKSA_ADD || pmksa->cmd == IW_PMKSA_REMOVE) &&
+	    (!(wnd->iw_auth_wpa_version & IW_AUTH_WPA_VERSION_WPA2)))
+		EXIT2(return -EOPNOTSUPP);
+
+	memset(&pmkid, 0, sizeof(pmkid));
+	if (pmksa->cmd == IW_PMKSA_ADD) {
+		pmkid.bssid_info_count = 1;
+		memcpy(pmkid.bssid_info[0].bssid, pmksa->bssid.sa_data,
+		       ETH_ALEN);
+		memcpy(pmkid.bssid_info[0].pmkid, pmksa->pmkid, IW_PMKID_LEN);
+	}
+	pmkid.length = sizeof(pmkid);
+
+	res = mp_set(wnd, OID_802_11_PMKID, &pmkid, pmkid.length);
+	if (res == NDIS_STATUS_FAILURE)
+		EXIT2(return -EOPNOTSUPP);
+	TRACE2("OID_802_11_PMKID -> %d", res);
+	if (res)
+		return -EINVAL;
+
+	return 0;
+}
+
+#define WEXT(id) [id - SIOCIWFIRST]
+
+static const iw_handler	ndis_handler[] = {
+	WEXT(SIOCGIWNAME)	 = iw_get_network_type,
+	WEXT(SIOCSIWESSID)	 = iw_set_essid,
+	WEXT(SIOCGIWESSID)	 = iw_get_essid,
+	WEXT(SIOCSIWMODE)	 = iw_set_infra_mode,
+	WEXT(SIOCGIWMODE)	 = iw_get_infra_mode,
+	WEXT(SIOCGIWFREQ)	 = iw_get_freq,
+	WEXT(SIOCSIWFREQ)	 = iw_set_freq,
+	WEXT(SIOCGIWTXPOW)	 = iw_get_tx_power,
+	WEXT(SIOCSIWTXPOW)	 = iw_set_tx_power,
+	WEXT(SIOCGIWRATE)	 = iw_get_bitrate,
+	WEXT(SIOCSIWRATE)	 = iw_set_bitrate,
+	WEXT(SIOCGIWRTS)	 = iw_get_rts_threshold,
+	WEXT(SIOCSIWRTS)	 = iw_set_rts_threshold,
+	WEXT(SIOCGIWFRAG)	 = iw_get_frag_threshold,
+	WEXT(SIOCSIWFRAG)	 = iw_set_frag_threshold,
+	WEXT(SIOCGIWAP)		 = iw_get_ap_address,
+	WEXT(SIOCSIWAP)		 = iw_set_ap_address,
+	WEXT(SIOCSIWENCODE)	 = iw_set_wep,
+	WEXT(SIOCGIWENCODE)	 = iw_get_encr,
+	WEXT(SIOCSIWSCAN)	 = iw_set_scan,
+	WEXT(SIOCGIWSCAN)	 = iw_get_scan,
+	WEXT(SIOCGIWPOWER)	 = iw_get_power_mode,
+	WEXT(SIOCSIWPOWER)	 = iw_set_power_mode,
+	WEXT(SIOCGIWRANGE)	 = iw_get_range,
+	WEXT(SIOCGIWSTATS)	 = iw_get_ndis_stats,
+	WEXT(SIOCGIWSENS)	 = iw_get_sensitivity,
+	WEXT(SIOCSIWSENS)	 = iw_set_sensitivity,
+	WEXT(SIOCGIWNICKN)	 = iw_get_nick,
+	WEXT(SIOCSIWNICKN)	 = iw_set_nick,
+	WEXT(SIOCSIWCOMMIT)	 = iw_set_dummy,
+	WEXT(SIOCSIWMLME)	 = iw_set_mlme,
+	WEXT(SIOCSIWGENIE)	 = iw_set_genie,
+	WEXT(SIOCSIWAUTH)	 = iw_set_auth,
+	WEXT(SIOCGIWAUTH)	 = iw_get_auth,
+	WEXT(SIOCSIWENCODEEXT)	 = iw_set_encodeext,
+	WEXT(SIOCGIWENCODEEXT)	 = iw_get_encodeext,
+	WEXT(SIOCSIWPMKSA)	 = iw_set_pmksa,
+};
+
+/* private ioctl's */
+
+static int priv_reset(struct net_device *dev, struct iw_request_info *info,
+		      union iwreq_data *wrqu, char *extra)
+{
+	int res;
+	ENTER2("");
+	res = mp_reset(netdev_priv(dev));
+	if (res) {
+		WARNING("reset failed: %08X", res);
+		return -EOPNOTSUPP;
+	}
+	return 0;
+}
+
+static int priv_deauthenticate(struct net_device *dev,
+			       struct iw_request_info *info,
+			       union iwreq_data *wrqu, char *extra)
+{
+	int res;
+	ENTER2("");
+	res = deauthenticate(netdev_priv(dev));
+	return res;
+}
+
+static int priv_power_profile(struct net_device *dev,
+			      struct iw_request_info *info,
+			      union iwreq_data *wrqu, char *extra)
+{
+	struct ndis_device *wnd = netdev_priv(dev);
+	struct miniport *mp;
+	ULONG profile_inf;
+
+	ENTER2("");
+	mp = &wnd->wd->driver->ndis_driver->mp;
+	if (!mp->pnp_event_notify)
+		EXIT2(return -EOPNOTSUPP);
+
+	/* 1 for AC and 0 for Battery */
+	if (wrqu->param.value)
+		profile_inf = NdisPowerProfileAcOnLine;
+	else
+		profile_inf = NdisPowerProfileBattery;
+
+	LIN2WIN4(mp->pnp_event_notify, wnd->nmb->mp_ctx,
+		 NdisDevicePnPEventPowerProfileChanged,
+		 &profile_inf, sizeof(profile_inf));
+	EXIT2(return 0);
+}
+
+static int priv_network_type(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+	struct ndis_device *wnd = netdev_priv(dev);
+	enum network_type network_type;
+	NDIS_STATUS res;
+	char type;
+
+	ENTER2("");
+	type = wrqu->param.value;
+	if (type == 'f')
+		network_type = Ndis802_11FH;
+	else if (type == 'b')
+		network_type = Ndis802_11DS;
+	else if (type == 'a')
+		network_type = Ndis802_11OFDM5;
+	else if (type == 'g' || type == 'n')
+		network_type = Ndis802_11OFDM24;
+	else
+		network_type = Ndis802_11Automode;
+
+	res = mp_set_int(wnd, OID_802_11_NETWORK_TYPE_IN_USE, network_type);
+	if (res) {
+		WARNING("setting network type to %d failed (%08X)",
+			network_type, res);
+		EXIT2(return -EINVAL);
+	}
+
+	EXIT2(return 0);
+}
+
+static int priv_media_stream_mode(struct net_device *dev,
+				  struct iw_request_info *info,
+				  union iwreq_data *wrqu, char *extra)
+{
+	struct ndis_device *wnd = netdev_priv(dev);
+	NDIS_STATUS res;
+	int mode;
+
+	ENTER2("");
+	if (wrqu->param.value > 0)
+		mode = Ndis802_11MediaStreamOn;
+	else
+		mode = Ndis802_11MediaStreamOff;
+	res = mp_set_int(wnd, OID_802_11_MEDIA_STREAM_MODE, mode);
+	if (res) {
+		WARNING("oid failed (%08X)", res);
+		EXIT2(return -EINVAL);
+	}
+	EXIT2(return 0);
+}
+
+static int priv_reload_defaults(struct net_device *dev,
+				struct iw_request_info *info,
+				union iwreq_data *wrqu, char *extra)
+{
+	struct ndis_device *wnd = netdev_priv(dev);
+	int res;
+	ENTER2("");
+	res = mp_set_int(wnd, OID_802_11_RELOAD_DEFAULTS,
+			 Ndis802_11ReloadWEPKeys);
+	if (res) {
+		WARNING("reloading defaults failed: %08X", res);
+		return -EOPNOTSUPP;
+	}
+	return 0;
+}
+
+static const struct iw_priv_args priv_args[] = {
+	{PRIV_RESET, 0, 0, "ndis_reset"},
+	{PRIV_POWER_PROFILE, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0,
+	 "power_profile"},
+	{PRIV_DEAUTHENTICATE, 0, 0, "deauthenticate"},
+	{PRIV_NETWORK_TYPE, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | 1, 0,
+	 "network_type"},
+	{PRIV_MEDIA_STREAM_MODE, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0,
+	 "media_stream"},
+
+	{PRIV_RELOAD_DEFAULTS, 0, 0, "reload_defaults"},
+};
+
+#define WEPRIV(id) [id - SIOCIWFIRSTPRIV]
+
+static const iw_handler priv_handler[] = {
+	WEPRIV(PRIV_RESET)		 = priv_reset,
+	WEPRIV(PRIV_POWER_PROFILE)	 = priv_power_profile,
+	WEPRIV(PRIV_DEAUTHENTICATE)	 = priv_deauthenticate,
+	WEPRIV(PRIV_NETWORK_TYPE)	 = priv_network_type,
+	WEPRIV(PRIV_MEDIA_STREAM_MODE)	 = priv_media_stream_mode,
+	WEPRIV(PRIV_RELOAD_DEFAULTS)	 = priv_reload_defaults,
+};
+
+const struct iw_handler_def ndis_handler_def = {
+	.num_standard	= sizeof(ndis_handler) / sizeof(ndis_handler[0]),
+	.num_private	= sizeof(priv_handler) / sizeof(priv_handler[0]),
+	.num_private_args = sizeof(priv_args) / sizeof(priv_args[0]),
+
+	.standard	= (iw_handler *)ndis_handler,
+	.private	= (iw_handler *)priv_handler,
+	.private_args	= (struct iw_priv_args *)priv_args,
+	.get_wireless_stats = get_iw_stats,
+};
--- linux-rt-2.6.31.orig/ubuntu/ndiswrapper/crt.c
+++ linux-rt-2.6.31/ubuntu/ndiswrapper/crt.c
@@ -0,0 +1,578 @@
+/*
+ *  Copyright (C) 2003-2005 Pontus Fuchs, Giridhar Pemmasani
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ *  GNU General Public License for more details.
+ *
+ */
+
+#include "ntoskernel.h"
+#include "crt_exports.h"
+
+#ifdef CONFIG_X86_64
+/* Windows long is 32-bit, so strip single 'l' in integer formats */
+static void strip_l_modifier(char *str)
+{
+	char *ptr = str;
+	int in_format = 0;
+	char *lptr = NULL;
+	char last = 0;
+	char *end_ptr;
+	char *wptr;
+
+	/* Replace single 'l' inside integer formats with '\0' */
+	for (ptr = str; *ptr; ptr++) {
+		if (!in_format) {
+			if (*ptr == '%')
+				in_format = 1;
+			last = *ptr;
+			continue;
+		}
+		switch (*ptr) {
+		case 'd':
+		case 'i':
+		case 'o':
+		case 'u':
+		case 'x':
+		case 'X':
+		case 'p':
+		case 'n':
+		case 'm':
+			if (lptr) {
+				*lptr = '\0';
+				lptr = NULL;
+			}
+			in_format = 0;
+			break;
+		case 'c':
+		case 'C':
+		case 's':
+		case 'S':
+		case 'f':
+		case 'e':
+		case 'E':
+		case 'g':
+		case 'G':
+		case 'a':
+		case 'A':
+			lptr = NULL;
+			in_format = 0;
+			break;
+		case '%':
+			lptr = NULL;
+			if (last == '%')
+				in_format = 0;
+			else
+				in_format = 1;	/* ignore previous junk */
+			break;
+		case 'l':
+			if (last == 'l')
+				lptr = NULL;
+			else
+				lptr = ptr;
+			break;
+		default:
+			break;
+		}
+		last = *ptr;
+	}
+
+	/* Purge zeroes from the resulting string */
+	end_ptr = ptr;
+	wptr = str;
+	for (ptr = str; ptr < end_ptr; ptr++)
+		if (*ptr != 0)
+			*(wptr++) = *ptr;
+	*wptr = 0;
+}
+
+/*
+ * va_list on x86_64 Linux is designed to allow passing arguments in registers
+ * even to variadic functions.  va_list is a structure holding pointers to the
+ * register save area, which holds the arguments passed in registers, and to
+ * the stack, which may have the arguments that did not fit the registers.
+ * va_list also holds offsets in the register save area for the next general
+ * purpose and floating point registers that the next va_arg() would fetch.
+ *
+ * Unlike Linux, the Windows va_list is just a pointer to the stack.  No
+ * arguments are passed in the registers.  That's why we construct the Linux
+ * va_list so that the register save area is never used.  For that goal, we set
+ * the offsets to the maximal allowed values, meaning that the arguments passed
+ * in the registers have been exhausted.  The values are 48 for general purpose
+ * registers (6 registers, 8 bytes each) and 304 for floating point registers
+ * (16 registers, 16 bytes each, on top of general purpose register).
+ */
+
+struct x86_64_va_list {
+	int gp_offset;
+	int fp_offset;
+	void *overflow_arg_area;
+	void *reg_save_area;
+};
+
+#define VA_LIST_DECL(_args) \
+	va_list _args##new; \
+	struct x86_64_va_list *_args##x;
+#define VA_LIST_PREP(_args) \
+do { \
+	_args##x = (struct x86_64_va_list *)&_args##new; \
+	_args##x->gp_offset = 6 * 8;		/* GP registers exhausted */ \
+	_args##x->fp_offset = 6 * 8 + 16 * 16;	/* FP registers exhausted */ \
+	_args##x->overflow_arg_area = (void *)_args; \
+	_args##x->reg_save_area = NULL; \
+} while (0)
+#define VA_LIST_CONV(_args) (_args##new)
+#define VA_LIST_FREE(_args)
+#define FMT_DECL(_fmt) \
+	char *_fmt##copy; \
+	int _fmt##len;
+#define FMT_PREP(_fmt) \
+do { \
+	_fmt##len = strlen(format) + 1; \
+	_fmt##copy = kmalloc(_fmt##len, GFP_KERNEL); \
+	if (_fmt##copy) { \
+		memcpy(_fmt##copy, format, _fmt##len); \
+		strip_l_modifier(_fmt##copy); \
+	} \
+} while (0)
+#define FMT_CONV(_fmt) (_fmt##copy ? _fmt##copy : format)
+#define FMT_FREE(_fmt) kfree(_fmt##copy)
+
+#else /* !CONFIG_X86_64 */
+
+#define VA_LIST_DECL(_args)
+#define VA_LIST_PREP(_args)
+#define VA_LIST_CONV(_args) (_args)
+#define VA_LIST_FREE(_args)
+#define FMT_DECL(_fmt)
+#define FMT_PREP(_fmt)
+#define FMT_CONV(_fmt) (format)
+#define FMT_FREE(_fmt)
+
+#endif /* !CONFIG_X86_64 */
+
+noregparm INT WIN_FUNC(_win_sprintf,12)
+	(char *buf, const char *format, ...)
+{
+	va_list args;
+	int res;
+	FMT_DECL(format)
+
+	FMT_PREP(format);
+	va_start(args, format);
+	res = vsprintf(buf, FMT_CONV(format), args);
+	va_end(args);
+	FMT_FREE(format);
+
+	TRACE2("buf: %p: %s", buf, buf);
+	return res;
+}
+
+noregparm INT WIN_FUNC(swprintf,12)
+	(wchar_t *buf, const wchar_t *format, ...)
+{
+	TODO();
+	EXIT2(return 0);
+}
+
+noregparm INT WIN_FUNC(_win_vsprintf,3)
+	(char *str, const char *format, va_list ap)
+{
+	INT i;
+	VA_LIST_DECL(ap)
+	FMT_DECL(format)
+
+	VA_LIST_PREP(ap);
+	FMT_PREP(format);
+
+	i = vsprintf(str, FMT_CONV(format), VA_LIST_CONV(ap));
+	TRACE2("str: %p: %s", str, str);
+
+	FMT_FREE(format);
+	VA_LIST_FREE(ap);
+	EXIT2(return i);
+}
+
+noregparm INT WIN_FUNC(_win_snprintf,12)
+	(char *buf, SIZE_T count, const char *format, ...)
+{
+	va_list args;
+	int res;
+	FMT_DECL(format)
+
+	FMT_PREP(format);
+	va_start(args, format);
+	res = vsnprintf(buf, count, FMT_CONV(format), args);
+	va_end(args);
+	TRACE2("buf: %p: %s", buf, buf);
+
+	FMT_FREE(format);
+	return res;
+}
+
+noregparm INT WIN_FUNC(_win__snprintf,12)
+	(char *buf, SIZE_T count, const char *format, ...)
+{
+	va_list args;
+	int res;
+	FMT_DECL(format)
+
+	FMT_PREP(format);
+	va_start(args, format);
+	res = vsnprintf(buf, count, FMT_CONV(format), args);
+	va_end(args);
+	TRACE2("buf: %p: %s", buf, buf);
+
+	FMT_FREE(format);
+	return res;
+}
+
+noregparm INT WIN_FUNC(_win_vsnprintf,4)
+	(char *str, SIZE_T size, const char *format, va_list ap)
+{
+	INT i;
+	VA_LIST_DECL(ap)
+	FMT_DECL(format)
+
+	VA_LIST_PREP(ap);
+	FMT_PREP(format);
+
+	i = vsnprintf(str, size, FMT_CONV(format), VA_LIST_CONV(ap));
+	TRACE2("str: %p: %s", str, str);
+
+	FMT_FREE(format);
+	VA_LIST_FREE(ap);
+	EXIT2(return i);
+}
+
+noregparm INT WIN_FUNC(_win__vsnprintf,4)
+	(char *str, SIZE_T size, const char *format, va_list ap)
+{
+	INT i;
+	VA_LIST_DECL(ap)
+	FMT_DECL(format)
+
+	VA_LIST_PREP(ap);
+	FMT_PREP(format);
+
+	i = vsnprintf(str, size, FMT_CONV(format), VA_LIST_CONV(ap));
+	TRACE2("str: %p: %s", str, str);
+
+	FMT_FREE(format);
+	VA_LIST_FREE(ap);
+	EXIT2(return i);
+}
+
+noregparm char *WIN_FUNC(_win_strncpy,3)
+	(char *dst, char *src, SIZE_T n)
+{
+	return strncpy(dst, src, n);
+}
+
+noregparm SIZE_T WIN_FUNC(_win_strlen,1)
+	(const char *s)
+{
+	return strlen(s);
+}
+
+noregparm INT WIN_FUNC(_win_strncmp,3)
+	(const char *s1, const char *s2, SIZE_T n)
+{
+	return strncmp(s1, s2, n);
+}
+
+noregparm INT WIN_FUNC(_win_strcmp,2)
+	(const char *s1, const char *s2)
+{
+	return strcmp(s1, s2);
+}
+
+noregparm INT WIN_FUNC(_win_stricmp,2)
+	(const char *s1, const char *s2)
+{
+	return stricmp(s1, s2);
+}
+
+noregparm char *WIN_FUNC(_win_strncat,3)
+	(char *dest, const char *src, SIZE_T n)
+{
+	return strncat(dest, src, n);
+}
+
+noregparm INT WIN_FUNC(_win_wcscmp,2)
+	(const wchar_t *s1, const wchar_t *s2)
+{
+	while (*s1 && *s1 == *s2) {
+		s1++;
+		s2++;
+	}
+	return *s1 - *s2;
+}
+
+noregparm INT WIN_FUNC(_win_wcsicmp,2)
+	(const wchar_t *s1, const wchar_t *s2)
+{
+	while (*s1 && tolower((char)*s1) == tolower((char)*s2)) {
+		s1++;
+		s2++;
+	}
+	return tolower((char)*s1) - tolower((char)*s2);
+}
+
+noregparm SIZE_T WIN_FUNC(_win_wcslen,1)
+	(const wchar_t *s)
+{
+	const wchar_t *t = s;
+	while (*t)
+		t++;
+	return t - s;
+}
+
+noregparm wchar_t *WIN_FUNC(_win_wcsncpy,3)
+	(wchar_t *dest, const wchar_t *src, SIZE_T n)
+{
+	const wchar_t *s;
+	wchar_t *d;
+	s = src + n;
+	d = dest;
+	while (src < s && (*d++ = *src++))
+		;
+	if (s > src)
+		memset(d, 0, (s - src) * sizeof(wchar_t));
+	return dest;
+}
+
+noregparm wchar_t *WIN_FUNC(_win_wcscpy,2)
+	(wchar_t *dest, const wchar_t *src)
+{
+	wchar_t *d = dest;
+	while ((*d++ = *src++))
+	       ;
+	return dest;
+}
+
+noregparm wchar_t *WIN_FUNC(_win_wcscat,2)
+	(wchar_t *dest, const wchar_t *src)
+{
+	wchar_t *d;
+	d = dest;
+	while (*d)
+		d++;
+	while ((*d++ = *src++))
+		;
+	return dest;
+}
+
+noregparm INT WIN_FUNC(_win_towupper,1)
+	(wchar_t c)
+{
+	return toupper(c);
+}
+
+noregparm INT WIN_FUNC(_win_towlower,1)
+	(wchar_t c)
+{
+	return tolower(c);
+}
+
+noregparm INT WIN_FUNC(_win_tolower,1)
+	(INT c)
+{
+	return tolower(c);
+}
+
+noregparm INT WIN_FUNC(_win_toupper,1)
+	(INT c)
+{
+	return toupper(c);
+}
+
+noregparm void *WIN_FUNC(_win_strcpy,2)
+	(void *to, const void *from)
+{
+	return strcpy(to, from);
+}
+
+noregparm char *WIN_FUNC(_win_strstr,2)
+	(const char *s1, const char *s2)
+{
+	return strstr(s1, s2);
+}
+
+noregparm char *WIN_FUNC(_win_strchr,2)
+	(const char *s, int c)
+{
+	return strchr(s, c);
+}
+
+noregparm char *WIN_FUNC(_win_strrchr,2)
+	(const char *s, int c)
+{
+	return strrchr(s, c);
+}
+
+noregparm void *WIN_FUNC(_win_memmove,3)
+	(void *to, void *from, SIZE_T count)
+{
+	return memmove(to, from, count);
+}
+
+noregparm void *WIN_FUNC(_win_memchr,3)
+	(const void *s, INT c, SIZE_T n)
+{
+	return memchr(s, c, n);
+}
+
+noregparm void *WIN_FUNC(_win_memcpy,3)
+	(void *to, const void *from, SIZE_T n)
+{
+	return memcpy(to, from, n);
+}
+
+noregparm void *WIN_FUNC(_win_memset,3)
+	(void *s, char c, SIZE_T count)
+{
+	return memset(s, c, count);
+}
+
+noregparm int WIN_FUNC(_win_memcmp,3)
+	(void *s1, void *s2, SIZE_T n)
+{
+	return memcmp(s1, s2, n);
+}
+
+noregparm void WIN_FUNC(_win_srand,1)
+	(UINT seed)
+{
+	net_srandom(seed);
+}
+
+noregparm int WIN_FUNC(rand,0)
+	(void)
+{
+	char buf[6];
+	int i, n;
+
+	get_random_bytes(buf, sizeof(buf));
+	for (n = i = 0; i < sizeof(buf) ; i++)
+		n += buf[i];
+	return n;
+}
+
+noregparm int WIN_FUNC(_win_atoi,1)
+	(const char *ptr)
+{
+	int i = simple_strtol(ptr, NULL, 10);
+	return i;
+}
+
+noregparm int WIN_FUNC(_win_isprint,1)
+	(int c)
+{
+	return isprint(c);
+}
+
+wstdcall s64 WIN_FUNC(_alldiv,2)
+	(s64 a, s64 b)
+{
+	return a / b;
+}
+
+wstdcall u64 WIN_FUNC(_aulldiv,2)
+	(u64 a, u64 b)
+{
+	return a / b;
+}
+
+wstdcall s64 WIN_FUNC(_allmul,2)
+	(s64 a, s64 b)
+{
+	return a * b;
+}
+
+wstdcall u64 WIN_FUNC(_aullmul,2)
+	(u64 a, u64 b)
+{
+	return a * b;
+}
+
+wstdcall s64 WIN_FUNC(_allrem,2)
+	(s64 a, s64 b)
+{
+	return a % b;
+}
+
+wstdcall u64 WIN_FUNC(_aullrem,2)
+	(u64 a, u64 b)
+{
+	return a % b;
+}
+
+__attribute__((regparm(3))) s64 WIN_FUNC(_allshl,2)
+	(s64 a, u8 b)
+{
+	return a << b;
+}
+
+__attribute__((regparm(3))) u64 WIN_FUNC(_aullshl,2)
+	(u64 a, u8 b)
+{
+	return a << b;
+}
+
+__attribute__((regparm(3))) s64 WIN_FUNC(_allshr,2)
+	(s64 a, u8 b)
+{
+	return a >> b;
+}
+
+__attribute__((regparm(3))) u64 WIN_FUNC(_aullshr,2)
+	(u64 a, u8 b)
+{
+	return a >> b;
+}
+
+int stricmp(const char *s1, const char *s2)
+{
+	while (*s1 && tolower(*s1) == tolower(*s2)) {
+		s1++;
+		s2++;
+	}
+	return *s1 - *s2;
+}
+
+void dump_bytes(const char *ctx, const u8 *from, int len)
+{
+	int i, j;
+	u8 *buf;
+
+	buf = kmalloc(len * 3 + 1, irql_gfp());
+	if (!buf) {
+		ERROR("couldn't allocate memory");
+		return;
+	}
+	for (i = j = 0; i < len; i++, j += 3) {
+		sprintf(&buf[j], "%02x ", from[i]);
+	}
+	buf[j] = 0;
+	printk(KERN_DEBUG "%s: %p: %s\n", ctx, from, buf);
+	kfree(buf);
+}
+
+int crt_init(void)
+{
+	return 0;
+}
+
+/* called when module is being removed */
+void crt_exit(void)
+{
+	EXIT4(return);
+}
--- linux-rt-2.6.31.orig/ubuntu/ndiswrapper/usb.c
+++ linux-rt-2.6.31/ubuntu/ndiswrapper/usb.c
@@ -0,0 +1,1457 @@
+/*
+ *  Copyright (C) 2004 Jan Kiszka
+ *  Copyright (C) 2005 Giridhar Pemmasani
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ *  GNU General Public License for more details.
+ *
+ */
+
+#include "ndis.h"
+#include "usb.h"
+#include "usb_exports.h"
+
+#ifdef USB_DEBUG
+static unsigned int urb_id = 0;
+
+#define DUMP_WRAP_URB(wrap_urb, dir)					\
+	USBTRACE("urb %p (%d) %s: buf: %p, len: %d, pipe: 0x%x, %d",	\
+		 (wrap_urb)->urb, (wrap_urb)->id,			\
+		 (dir == USB_DIR_OUT) ? "going down" : "coming back",	\
+		 (wrap_urb)->urb->transfer_buffer,			\
+		 (wrap_urb)->urb->transfer_buffer_length,		\
+		 (wrap_urb)->urb->pipe, (wrap_urb)->urb->status)
+
+#define DUMP_URB_BUFFER(urb, dir)					\
+	while (debug >= 2) {						\
+		int i;							\
+		char msg[20], *t;					\
+		if (!urb->transfer_buffer)				\
+			break;						\
+		if (!((usb_pipein(urb->pipe) && dir == USB_DIR_IN) ||	\
+		      (usb_pipeout(urb->pipe) && dir == USB_DIR_OUT)))	\
+			break;						\
+		t = msg;						\
+		t += sprintf(t, "%d: ", (urb)->actual_length);		\
+		for (i = 0; i < urb->actual_length &&			\
+			     t < &msg[sizeof(msg) - 4]; i++)		\
+			t += sprintf(t, "%02X ",			\
+				     ((char *)urb->transfer_buffer)[i]); \
+		*t = 0;							\
+		USBTRACE("%s", msg);					\
+		break;							\
+	}
+
+#else
+
+#define DUMP_WRAP_URB(wrap_urb, dir) (void)0
+#define DUMP_URB_BUFFER(urb, dir) (void)0
+
+#endif
+
+#define CUR_ALT_SETTING(intf) (intf)->cur_altsetting
+
+#ifndef USB_CTRL_SET_TIMEOUT
+#define USB_CTRL_SET_TIMEOUT 5000
+#endif
+
+#ifndef USB_CTRL_GET_TIMEOUT
+#define USB_CTRL_GET_TIMEOUT 5000
+#endif
+
+#ifndef URB_NO_TRANSFER_DMA_MAP
+#define URB_NO_TRANSFER_DMA_MAP 0
+#endif
+
+/* wrap_urb->flags */
+/* transfer_buffer for urb is allocated; free it in wrap_free_urb */
+#define WRAP_URB_COPY_BUFFER 0x01
+
+static int inline wrap_cancel_urb(struct wrap_urb *wrap_urb)
+{
+	int ret;
+	USBTRACE("%p, %p, %d", wrap_urb, wrap_urb->urb, wrap_urb->state);
+	if (wrap_urb->state != URB_SUBMITTED)
+		USBEXIT(return -1);
+	ret = usb_unlink_urb(wrap_urb->urb);
+	USBTRACE("ret: %d", ret);
+	if (ret == -EINPROGRESS)
+		return 0;
+	else {
+		WARNING("unlink failed: %d", ret);
+		return ret;
+	}
+}
+
+#define URB_STATUS(wrap_urb) (wrap_urb->urb->status)
+
+static struct nt_list wrap_urb_complete_list;
+static spinlock_t wrap_urb_complete_list_lock;
+
+static work_struct_t wrap_urb_complete_work;
+static void wrap_urb_complete_worker(worker_param_t dummy);
+
+static void kill_all_urbs(struct wrap_device *wd, int complete)
+{
+	struct nt_list *ent;
+	struct wrap_urb *wrap_urb;
+	KIRQL irql;
+
+	USBTRACE("%d", wd->usb.num_alloc_urbs);
+	while (1) {
+		IoAcquireCancelSpinLock(&irql);
+		ent = RemoveHeadList(&wd->usb.wrap_urb_list);
+		IoReleaseCancelSpinLock(irql);
+		if (!ent)
+			break;
+		wrap_urb = container_of(ent, struct wrap_urb, list);
+		if (wrap_urb->state == URB_SUBMITTED) {
+			WARNING("Windows driver %s didn't free urb: %p",
+				wd->driver->name, wrap_urb->urb);
+			if (!complete)
+				wrap_urb->urb->complete = NULL;
+			usb_kill_urb(wrap_urb->urb);
+		}
+		USBTRACE("%p, %p", wrap_urb, wrap_urb->urb);
+		usb_free_urb(wrap_urb->urb);
+		kfree(wrap_urb);
+	}
+	wd->usb.num_alloc_urbs = 0;
+}
+
+/* for a given Linux urb status code, return corresponding NT urb status */
+static USBD_STATUS wrap_urb_status(int urb_status)
+{
+	switch (urb_status) {
+	case 0:
+		return USBD_STATUS_SUCCESS;
+	case -EPROTO:
+		return USBD_STATUS_TIMEOUT;
+	case -EILSEQ:
+		return USBD_STATUS_CRC;
+	case -EPIPE:
+		return USBD_STATUS_INVALID_PIPE_HANDLE;
+	case -ECOMM:
+		return USBD_STATUS_DATA_OVERRUN;
+	case -ENOSR:
+		return USBD_STATUS_DATA_UNDERRUN;
+	case -EOVERFLOW:
+		return USBD_STATUS_BABBLE_DETECTED;
+	case -EREMOTEIO:
+		return USBD_STATUS_ERROR_SHORT_TRANSFER;;
+	case -ENODEV:
+	case -ESHUTDOWN:
+	case -ENOENT:
+		return USBD_STATUS_DEVICE_GONE;
+	case -ENOMEM:
+		return USBD_STATUS_NO_MEMORY;
+	case -EINVAL:
+		return USBD_STATUS_REQUEST_FAILED;
+	default:
+		return USBD_STATUS_NOT_SUPPORTED;
+	}
+}
+
+/* for a given USBD_STATUS, return its corresponding NTSTATUS (for irp) */
+static NTSTATUS nt_urb_irp_status(USBD_STATUS nt_urb_status)
+{
+	switch (nt_urb_status) {
+	case USBD_STATUS_SUCCESS:
+		return STATUS_SUCCESS;
+	case USBD_STATUS_DEVICE_GONE:
+		return STATUS_DEVICE_REMOVED;
+	case USBD_STATUS_PENDING:
+		return STATUS_PENDING;
+	case USBD_STATUS_NOT_SUPPORTED:
+		return STATUS_NOT_IMPLEMENTED;
+	case USBD_STATUS_NO_MEMORY:
+		return STATUS_NO_MEMORY;
+	case USBD_STATUS_REQUEST_FAILED:
+		return STATUS_NOT_SUPPORTED;
+	default:
+		return STATUS_FAILURE;
+	}
+}
+
+static void wrap_free_urb(struct urb *urb)
+{
+	struct irp *irp;
+	struct wrap_urb *wrap_urb;
+
+	USBTRACE("freeing urb: %p", urb);
+	wrap_urb = urb->context;
+	irp = wrap_urb->irp;
+	if (wrap_urb->flags & WRAP_URB_COPY_BUFFER) {
+		USBTRACE("freeing DMA buffer for URB: %p %p",
+			 urb, urb->transfer_buffer);
+		usb_buffer_free(IRP_WRAP_DEVICE(irp)->usb.udev,
+				urb->transfer_buffer_length,
+				urb->transfer_buffer, urb->transfer_dma);
+	}
+	if (urb->setup_packet)
+		kfree(urb->setup_packet);
+	if (IRP_WRAP_DEVICE(irp)->usb.num_alloc_urbs > MAX_ALLOCATED_URBS) {
+		IoAcquireCancelSpinLock(&irp->cancel_irql);
+		RemoveEntryList(&wrap_urb->list);
+		IRP_WRAP_DEVICE(irp)->usb.num_alloc_urbs--;
+		IoReleaseCancelSpinLock(irp->cancel_irql);
+		usb_free_urb(urb);
+		kfree(wrap_urb);
+	} else {
+		wrap_urb->state = URB_FREE;
+		wrap_urb->flags = 0;
+		wrap_urb->irp = NULL;
+	}
+	return;
+}
+
+void wrap_suspend_urbs(struct wrap_device *wd)
+{
+	/* TODO: do we need to cancel urbs? */
+	USBTRACE("%p, %d", wd, wd->usb.num_alloc_urbs);
+}
+
+void wrap_resume_urbs(struct wrap_device *wd)
+{
+	/* TODO: do we need to resubmit urbs? */
+	USBTRACE("%p, %d", wd, wd->usb.num_alloc_urbs);
+}
+
+wstdcall void wrap_cancel_irp(struct device_object *dev_obj, struct irp *irp)
+{
+	struct urb *urb;
+
+	/* NB: this function is called holding Cancel spinlock */
+	USBENTER("irp: %p", irp);
+	urb = IRP_WRAP_URB(irp)->urb;
+	USBTRACE("canceling urb %p", urb);
+	if (wrap_cancel_urb(IRP_WRAP_URB(irp))) {
+		irp->cancel = FALSE;
+		ERROR("urb %p can't be canceld: %d", urb,
+		      IRP_WRAP_URB(irp)->state);
+	} else
+		USBTRACE("urb %p canceled", urb);
+	IoReleaseCancelSpinLock(irp->cancel_irql);
+	return;
+}
+WIN_FUNC_DECL(wrap_cancel_irp,2)
+
+static struct urb *wrap_alloc_urb(struct irp *irp, unsigned int pipe,
+				  void *buf, unsigned int buf_len)
+{
+	struct urb *urb;
+	gfp_t alloc_flags;
+	struct wrap_urb *wrap_urb;
+	struct wrap_device *wd;
+
+	USBENTER("irp: %p", irp);
+	wd = IRP_WRAP_DEVICE(irp);
+	alloc_flags = irql_gfp();
+	IoAcquireCancelSpinLock(&irp->cancel_irql);
+	urb = NULL;
+	nt_list_for_each_entry(wrap_urb, &wd->usb.wrap_urb_list, list) {
+		if (cmpxchg(&wrap_urb->state, URB_FREE,
+			    URB_ALLOCATED) == URB_FREE) {
+			urb = wrap_urb->urb;
+			usb_init_urb(urb);
+			break;
+		}
+	}
+	if (!urb) {
+		IoReleaseCancelSpinLock(irp->cancel_irql);
+		wrap_urb = kzalloc(sizeof(*wrap_urb), alloc_flags);
+		if (!wrap_urb) {
+			WARNING("couldn't allocate memory");
+			return NULL;
+		}
+		urb = usb_alloc_urb(0, alloc_flags);
+		if (!urb) {
+			WARNING("couldn't allocate urb");
+			kfree(wrap_urb);
+			return NULL;
+		}
+		IoAcquireCancelSpinLock(&irp->cancel_irql);
+		wrap_urb->urb = urb;
+		wrap_urb->state = URB_ALLOCATED;
+		InsertTailList(&wd->usb.wrap_urb_list, &wrap_urb->list);
+		wd->usb.num_alloc_urbs++;
+	}
+
+#ifdef URB_ASYNC_UNLINK
+	urb->transfer_flags |= URB_ASYNC_UNLINK;
+#elif defined(USB_ASYNC_UNLINK)
+	urb->transfer_flags |= USB_ASYNC_UNLINK;
+#endif
+	urb->context = wrap_urb;
+	wrap_urb->irp = irp;
+	IRP_WRAP_URB(irp) = wrap_urb;
+	/* called as Windows function */
+	irp->cancel_routine = WIN_FUNC_PTR(wrap_cancel_irp,2);
+	IoReleaseCancelSpinLock(irp->cancel_irql);
+	USBTRACE("urb: %p", urb);
+
+	urb->transfer_buffer_length = buf_len;
+	if (buf_len && buf && (!virt_addr_valid(buf)
+#if defined(CONFIG_HIGHMEM) || defined(CONFIG_HIGHMEM4G)
+			       || PageHighMem(virt_to_page(buf))
+#endif
+		    )) {
+		urb->transfer_buffer =
+			usb_buffer_alloc(wd->usb.udev, buf_len, alloc_flags,
+					 &urb->transfer_dma);
+		if (!urb->transfer_buffer) {
+			WARNING("couldn't allocate dma buf");
+			IoAcquireCancelSpinLock(&irp->cancel_irql);
+			wrap_urb->state = URB_FREE;
+			wrap_urb->irp = NULL;
+			IRP_WRAP_URB(irp) = NULL;
+			IoReleaseCancelSpinLock(irp->cancel_irql);
+			return NULL;
+		}
+		if (urb->transfer_dma)
+			urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+		wrap_urb->flags |= WRAP_URB_COPY_BUFFER;
+		if (usb_pipeout(pipe))
+			memcpy(urb->transfer_buffer, buf, buf_len);
+		USBTRACE("DMA buf for urb %p: %p", urb, urb->transfer_buffer);
+	} else
+		urb->transfer_buffer = buf;
+	return urb;
+}
+
+static USBD_STATUS wrap_submit_urb(struct irp *irp)
+{
+	int ret;
+	struct urb *urb;
+	union nt_urb *nt_urb;
+
+	urb = IRP_WRAP_URB(irp)->urb;
+	nt_urb = IRP_URB(irp);
+#ifdef USB_DEBUG
+	if (IRP_WRAP_URB(irp)->state != URB_ALLOCATED) {
+		ERROR("urb %p is in wrong state: %d",
+		      urb, IRP_WRAP_URB(irp)->state);
+		NT_URB_STATUS(nt_urb) = USBD_STATUS_REQUEST_FAILED;
+		return NT_URB_STATUS(nt_urb);
+	}
+	IRP_WRAP_URB(irp)->id = pre_atomic_add(urb_id, 1);
+#endif
+	DUMP_WRAP_URB(IRP_WRAP_URB(irp), USB_DIR_OUT);
+	irp->io_status.status = STATUS_PENDING;
+	irp->io_status.info = 0;
+	NT_URB_STATUS(nt_urb) = USBD_STATUS_PENDING;
+	IoMarkIrpPending(irp);
+	DUMP_URB_BUFFER(urb, USB_DIR_OUT);
+	USBTRACE("%p", urb);
+	IRP_WRAP_URB(irp)->state = URB_SUBMITTED;
+	ret = usb_submit_urb(urb, irql_gfp());
+	if (ret) {
+		USBTRACE("ret: %d", ret);
+		wrap_free_urb(urb);
+		/* we assume that IRP was not in pending state before */
+		IoUnmarkIrpPending(irp);
+		NT_URB_STATUS(nt_urb) = wrap_urb_status(ret);
+		USBEXIT(return NT_URB_STATUS(nt_urb));
+	} else
+		USBEXIT(return USBD_STATUS_PENDING);
+}
+
+static void wrap_urb_complete(struct urb *urb ISR_PT_REGS_PARAM_DECL)
+{
+	struct irp *irp;
+	struct wrap_urb *wrap_urb;
+
+	wrap_urb = urb->context;
+	USBTRACE("%p (%p) completed", wrap_urb, urb);
+	irp = wrap_urb->irp;
+	DUMP_WRAP_URB(wrap_urb, USB_DIR_IN);
+	irp->cancel_routine = NULL;
+#ifdef USB_DEBUG
+	if (wrap_urb->state != URB_SUBMITTED) {
+		WARNING("urb %p in wrong state: %d (%d)", urb, wrap_urb->state,
+			urb->status);
+		return;
+	}
+#endif
+	wrap_urb->state = URB_COMPLETED;
+	spin_lock(&wrap_urb_complete_list_lock);
+	InsertTailList(&wrap_urb_complete_list, &wrap_urb->complete_list);
+	spin_unlock(&wrap_urb_complete_list_lock);
+	schedule_ntos_work(&wrap_urb_complete_work);
+}
+
+/* one worker for all devices */
+static void wrap_urb_complete_worker(worker_param_t dummy)
+{
+	struct irp *irp;
+	struct urb *urb;
+	struct usbd_bulk_or_intr_transfer *bulk_int_tx;
+	struct usbd_vendor_or_class_request *vc_req;
+	union nt_urb *nt_urb;
+	struct wrap_urb *wrap_urb;
+	struct nt_list *ent;
+	unsigned long flags;
+
+	USBENTER("");
+	while (1) {
+		spin_lock_irqsave(&wrap_urb_complete_list_lock, flags);
+		ent = RemoveHeadList(&wrap_urb_complete_list);
+		spin_unlock_irqrestore(&wrap_urb_complete_list_lock, flags);
+		if (!ent)
+			break;
+		wrap_urb = container_of(ent, struct wrap_urb, complete_list);
+		urb = wrap_urb->urb;
+#ifdef USB_DEBUG
+		if (wrap_urb->state != URB_COMPLETED &&
+		    wrap_urb->state != URB_INT_UNLINKED)
+			WARNING("urb %p in wrong state: %d",
+				urb, wrap_urb->state);
+#endif
+		irp = wrap_urb->irp;
+		DUMP_IRP(irp);
+		nt_urb = IRP_URB(irp);
+		USBTRACE("urb: %p, nt_urb: %p, status: %d",
+			 urb, nt_urb, urb->status);
+		switch (urb->status) {
+		case 0:
+			/* succesfully transferred */
+			irp->io_status.info = urb->actual_length;
+			if (nt_urb->header.function ==
+			    URB_FUNCTION_BULK_OR_INTERRUPT_TRANSFER) {
+				bulk_int_tx = &nt_urb->bulk_int_transfer;
+				bulk_int_tx->transfer_buffer_length =
+					urb->actual_length;
+				DUMP_URB_BUFFER(urb, USB_DIR_IN);
+				if ((wrap_urb->flags & WRAP_URB_COPY_BUFFER) &&
+				    usb_pipein(urb->pipe))
+					memcpy(bulk_int_tx->transfer_buffer,
+					       urb->transfer_buffer,
+					       urb->actual_length);
+			} else { // vendor or class request
+				vc_req = &nt_urb->vendor_class_request;
+				vc_req->transfer_buffer_length =
+					urb->actual_length;
+				DUMP_URB_BUFFER(urb, USB_DIR_IN);
+				if ((wrap_urb->flags & WRAP_URB_COPY_BUFFER) &&
+				    usb_pipein(urb->pipe))
+					memcpy(vc_req->transfer_buffer,
+					       urb->transfer_buffer,
+					       urb->actual_length);
+			}
+			NT_URB_STATUS(nt_urb) = USBD_STATUS_SUCCESS;
+			irp->io_status.status = STATUS_SUCCESS;
+			break;
+		case -ENOENT:
+		case -ECONNRESET:
+			/* urb canceled */
+			irp->io_status.info = 0;
+			TRACE2("urb %p canceled", urb);
+			NT_URB_STATUS(nt_urb) = USBD_STATUS_SUCCESS;
+			irp->io_status.status = STATUS_CANCELLED;
+			break;
+		default:
+			TRACE2("irp: %p, urb: %p, status: %d/%d",
+				 irp, urb, urb->status, wrap_urb->state);
+			irp->io_status.info = 0;
+			NT_URB_STATUS(nt_urb) = wrap_urb_status(urb->status);
+			irp->io_status.status =
+				nt_urb_irp_status(NT_URB_STATUS(nt_urb));
+			break;
+		}
+		wrap_free_urb(urb);
+		IoCompleteRequest(irp, IO_NO_INCREMENT);
+	}
+	USBEXIT(return);
+}
+
+static USBD_STATUS wrap_bulk_or_intr_trans(struct irp *irp)
+{
+	usbd_pipe_handle pipe_handle;
+	struct urb *urb;
+	unsigned int pipe;
+	struct usbd_bulk_or_intr_transfer *bulk_int_tx;
+	USBD_STATUS status;
+	struct usb_device *udev;
+	union nt_urb *nt_urb;
+
+	nt_urb = IRP_URB(irp);
+	udev = IRP_WRAP_DEVICE(irp)->usb.udev;
+	bulk_int_tx = &nt_urb->bulk_int_transfer;
+	pipe_handle = bulk_int_tx->pipe_handle;
+	USBTRACE("flags: 0x%x, length: %u, buffer: %p, handle: %p",
+		 bulk_int_tx->transfer_flags,
+		 bulk_int_tx->transfer_buffer_length,
+		 bulk_int_tx->transfer_buffer, pipe_handle);
+
+	if (USBD_IS_BULK_PIPE(pipe_handle)) {
+		if (bulk_int_tx->transfer_flags & USBD_TRANSFER_DIRECTION_IN)
+			pipe = usb_rcvbulkpipe(udev,
+					       pipe_handle->bEndpointAddress);
+		else
+			pipe = usb_sndbulkpipe(udev,
+					       pipe_handle->bEndpointAddress);
+	} else {
+		if (bulk_int_tx->transfer_flags & USBD_TRANSFER_DIRECTION_IN)
+			pipe = usb_rcvintpipe(udev,
+					      pipe_handle->bEndpointAddress);
+		else
+			pipe = usb_sndintpipe(udev,
+					      pipe_handle->bEndpointAddress);
+	}
+
+	DUMP_IRP(irp);
+	urb = wrap_alloc_urb(irp, pipe, bulk_int_tx->transfer_buffer,
+			     bulk_int_tx->transfer_buffer_length);
+	if (!urb) {
+		ERROR("couldn't allocate urb");
+		return USBD_STATUS_NO_MEMORY;
+	}
+	if (usb_pipein(pipe) &&
+	    (!(bulk_int_tx->transfer_flags & USBD_SHORT_TRANSFER_OK))) {
+		USBTRACE("short not ok");
+		urb->transfer_flags |= URB_SHORT_NOT_OK;
+	}
+	if (usb_pipebulk(pipe)) {
+		usb_fill_bulk_urb(urb, udev, pipe, urb->transfer_buffer,
+				  bulk_int_tx->transfer_buffer_length,
+				  wrap_urb_complete, urb->context);
+		USBTRACE("submitting bulk urb %p on pipe 0x%x (ep 0x%x)",
+			 urb, urb->pipe, pipe_handle->bEndpointAddress);
+	} else {
+		usb_fill_int_urb(urb, udev, pipe, urb->transfer_buffer,
+				 bulk_int_tx->transfer_buffer_length,
+				 wrap_urb_complete, urb->context,
+				 pipe_handle->bInterval);
+		USBTRACE("submitting interrupt urb %p on pipe 0x%x (ep 0x%x), "
+			 "intvl: %d", urb, urb->pipe,
+			 pipe_handle->bEndpointAddress, pipe_handle->bInterval);
+	}
+	status = wrap_submit_urb(irp);
+	USBTRACE("status: %08X", status);
+	USBEXIT(return status);
+}
+
+static USBD_STATUS wrap_vendor_or_class_req(struct irp *irp)
+{
+	u8 req_type;
+	unsigned int pipe;
+	struct usbd_vendor_or_class_request *vc_req;
+	struct usb_device *udev;
+	union nt_urb *nt_urb;
+	USBD_STATUS status;
+	struct urb *urb;
+	struct usb_ctrlrequest *dr;
+
+	nt_urb = IRP_URB(irp);
+	udev = IRP_WRAP_DEVICE(irp)->usb.udev;
+	vc_req = &nt_urb->vendor_class_request;
+	USBTRACE("bits: %x, req: %x, val: %08x, index: %08x, flags: %x,"
+		 "buf: %p, len: %d", vc_req->reserved_bits, vc_req->request,
+		 vc_req->value, vc_req->index, vc_req->transfer_flags,
+		 vc_req->transfer_buffer, vc_req->transfer_buffer_length);
+
+	USBTRACE("%x", nt_urb->header.function);
+	switch (nt_urb->header.function) {
+	case URB_FUNCTION_VENDOR_DEVICE:
+		req_type = USB_TYPE_VENDOR | USB_RECIP_DEVICE;
+		break;
+	case URB_FUNCTION_VENDOR_INTERFACE:
+		req_type = USB_TYPE_VENDOR | USB_RECIP_INTERFACE;
+		break;
+	case URB_FUNCTION_VENDOR_ENDPOINT:
+		req_type = USB_TYPE_VENDOR | USB_RECIP_ENDPOINT;
+		break;
+	case URB_FUNCTION_VENDOR_OTHER:
+		req_type = USB_TYPE_VENDOR | USB_RECIP_OTHER;
+		break;
+	case URB_FUNCTION_CLASS_DEVICE:
+		req_type = USB_TYPE_CLASS | USB_RECIP_DEVICE;
+		break;
+	case URB_FUNCTION_CLASS_INTERFACE:
+		req_type = USB_TYPE_CLASS | USB_RECIP_INTERFACE;
+		break;
+	case URB_FUNCTION_CLASS_ENDPOINT:
+		req_type = USB_TYPE_CLASS | USB_RECIP_ENDPOINT;
+		break;
+	case URB_FUNCTION_CLASS_OTHER:
+		req_type = USB_TYPE_CLASS | USB_RECIP_OTHER;
+		break;
+	default:
+		ERROR("unknown request type: %x", nt_urb->header.function);
+		req_type = 0;
+		break;
+	}
+
+	req_type |= vc_req->reserved_bits;
+	USBTRACE("req type: %08x", req_type);
+
+	if (vc_req->transfer_flags & USBD_TRANSFER_DIRECTION_IN) {
+		pipe = usb_rcvctrlpipe(udev, 0);
+		req_type |= USB_DIR_IN;
+		USBTRACE("pipe: %x, dir in", pipe);
+	} else {
+		pipe = usb_sndctrlpipe(udev, 0);
+		req_type |= USB_DIR_OUT;
+		USBTRACE("pipe: %x, dir out", pipe);
+	}
+	urb = wrap_alloc_urb(irp, pipe, vc_req->transfer_buffer,
+			     vc_req->transfer_buffer_length);
+	if (!urb) {
+		ERROR("couldn't allocate urb");
+		return USBD_STATUS_NO_MEMORY;
+	}
+
+	if (usb_pipein(pipe) &&
+	    (!(vc_req->transfer_flags & USBD_SHORT_TRANSFER_OK))) {
+		USBTRACE("short not ok");
+		urb->transfer_flags |= URB_SHORT_NOT_OK;
+	}
+
+	dr = kzalloc(sizeof(*dr), GFP_ATOMIC);
+	if (!dr) {
+		ERROR("couldn't allocate memory");
+		wrap_free_urb(urb);
+		return USBD_STATUS_NO_MEMORY;
+	}
+	dr->bRequestType = req_type;
+	dr->bRequest = vc_req->request;
+	dr->wValue = cpu_to_le16(vc_req->value);
+	dr->wIndex = cpu_to_le16((u16)vc_req->index);
+	dr->wLength = cpu_to_le16((u16)urb->transfer_buffer_length);
+
+	usb_fill_control_urb(urb, udev, pipe, (unsigned char *)dr,
+			     urb->transfer_buffer, urb->transfer_buffer_length,
+			     wrap_urb_complete, urb->context);
+	status = wrap_submit_urb(irp);
+	USBTRACE("status: %08X", status);
+	USBEXIT(return status);
+}
+
+static USBD_STATUS wrap_reset_pipe(struct usb_device *udev, struct irp *irp)
+{
+	int ret;
+	union nt_urb *nt_urb;
+	usbd_pipe_handle pipe_handle;
+	unsigned int pipe1, pipe2;
+
+	nt_urb = IRP_URB(irp);
+	pipe_handle = nt_urb->pipe_req.pipe_handle;
+	/* TODO: not clear if both directions should be cleared? */
+	if (USBD_IS_BULK_PIPE(pipe_handle)) {
+		pipe1 = usb_rcvbulkpipe(udev, pipe_handle->bEndpointAddress);
+		pipe2 = usb_sndbulkpipe(udev, pipe_handle->bEndpointAddress);
+	} else if (USBD_IS_INT_PIPE(pipe_handle)) {
+		pipe1 = usb_rcvintpipe(udev, pipe_handle->bEndpointAddress);
+		pipe2 = pipe1;
+	} else {
+		WARNING("invalid pipe %d", pipe_handle->bEndpointAddress);
+		return USBD_STATUS_INVALID_PIPE_HANDLE;
+	}
+	USBTRACE("ep: %d, pipe: 0x%x", pipe_handle->bEndpointAddress, pipe1);
+	ret = usb_clear_halt(udev, pipe1);
+	if (ret)
+		USBTRACE("resetting pipe %d failed: %d", pipe1, ret);
+	if (pipe2 != pipe1) {
+		ret = usb_clear_halt(udev, pipe2);
+		if (ret)
+			USBTRACE("resetting pipe %d failed: %d", pipe2, ret);
+	}
+//	return wrap_urb_status(ret);
+	return USBD_STATUS_SUCCESS;
+}
+
+static USBD_STATUS wrap_abort_pipe(struct usb_device *udev, struct irp *irp)
+{
+	union nt_urb *nt_urb;
+	usbd_pipe_handle pipe_handle;
+	struct wrap_urb *wrap_urb;
+	struct wrap_device *wd;
+	KIRQL irql;
+
+	wd = IRP_WRAP_DEVICE(irp);
+	nt_urb = IRP_URB(irp);
+	pipe_handle = nt_urb->pipe_req.pipe_handle;
+	USBENTER("%p, %x", irp, pipe_handle->bEndpointAddress);
+	IoAcquireCancelSpinLock(&irql);
+	nt_list_for_each_entry(wrap_urb, &wd->usb.wrap_urb_list, list) {
+		USBTRACE("%p, %p, %d, %x, %x", wrap_urb, wrap_urb->urb,
+			 wrap_urb->state, wrap_urb->urb->pipe,
+			 usb_pipeendpoint(wrap_urb->urb->pipe));
+		/* for WG111T driver, urbs for endpoint 0 should also
+		 * be canceled */
+		if ((usb_pipeendpoint(wrap_urb->urb->pipe) ==
+		     pipe_handle->bEndpointAddress) ||
+		    (usb_pipeendpoint(wrap_urb->urb->pipe) == 0)) {
+			if (wrap_cancel_urb(wrap_urb) == 0)
+				USBTRACE("canceled wrap_urb: %p", wrap_urb);
+		}
+	}
+	IoReleaseCancelSpinLock(irql);
+	NT_URB_STATUS(nt_urb) = USBD_STATUS_CANCELED;
+	USBEXIT(return USBD_STATUS_SUCCESS);
+}
+
+static USBD_STATUS wrap_set_clear_feature(struct usb_device *udev,
+					  struct irp *irp)
+{
+	union nt_urb *nt_urb;
+	struct urb_control_feature_request *feat_req;
+	int ret = 0;
+	__u8 request, type;
+	__u16 feature;
+
+	nt_urb = IRP_URB(irp);
+	feat_req = &nt_urb->feat_req;
+	feature = feat_req->feature_selector;
+	switch (nt_urb->header.function) {
+	case URB_FUNCTION_SET_FEATURE_TO_DEVICE:
+		request = USB_REQ_SET_FEATURE;
+		type = USB_DT_DEVICE;
+		break;
+	case URB_FUNCTION_SET_FEATURE_TO_INTERFACE:
+		request = USB_REQ_SET_FEATURE;
+		type =  USB_DT_INTERFACE;
+		break;
+	case URB_FUNCTION_SET_FEATURE_TO_ENDPOINT:
+		request = USB_REQ_SET_FEATURE;
+		type =  USB_DT_ENDPOINT;
+		break;
+	case URB_FUNCTION_CLEAR_FEATURE_TO_DEVICE:
+		request = USB_REQ_CLEAR_FEATURE;
+		type =  USB_DT_DEVICE;
+		break;
+	case URB_FUNCTION_CLEAR_FEATURE_TO_INTERFACE:
+		request = USB_REQ_CLEAR_FEATURE;
+		type =  USB_DT_INTERFACE;
+		break;
+	case URB_FUNCTION_CLEAR_FEATURE_TO_ENDPOINT:
+		request = USB_REQ_CLEAR_FEATURE;
+		type =  USB_DT_ENDPOINT;
+		break;
+	default:
+		WARNING("invalid function: %x", nt_urb->header.function);
+		NT_URB_STATUS(nt_urb) = USBD_STATUS_NOT_SUPPORTED;
+		return NT_URB_STATUS(nt_urb);
+	}
+	ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), request, type,
+			      feature, feat_req->index, NULL, 0, 1000);
+	NT_URB_STATUS(nt_urb) = wrap_urb_status(ret);
+	USBEXIT(return NT_URB_STATUS(nt_urb));
+}
+
+static USBD_STATUS wrap_get_status_request(struct usb_device *udev,
+					   struct irp *irp)
+{
+	union nt_urb *nt_urb;
+	struct urb_control_get_status_request *status_req;
+	int ret = 0;
+	__u8 type;
+
+	nt_urb = IRP_URB(irp);
+	status_req = &nt_urb->status_req;
+	switch (nt_urb->header.function) {
+	case URB_FUNCTION_GET_STATUS_FROM_DEVICE:
+		type = USB_RECIP_DEVICE;
+		break;
+	case URB_FUNCTION_GET_STATUS_FROM_INTERFACE:
+		type = USB_RECIP_INTERFACE;
+		break;
+	case URB_FUNCTION_GET_STATUS_FROM_ENDPOINT:
+		type = USB_RECIP_ENDPOINT;
+		break;
+	default:
+		WARNING("invalid function: %x", nt_urb->header.function);
+		NT_URB_STATUS(nt_urb) = USBD_STATUS_NOT_SUPPORTED;
+		return NT_URB_STATUS(nt_urb);
+	}
+	assert(status_req->transfer_buffer_length == sizeof(u16));
+	ret = usb_get_status(udev, type, status_req->index,
+			     status_req->transfer_buffer);
+	if (ret >= 0) {
+		assert(ret <= status_req->transfer_buffer_length);
+		status_req->transfer_buffer_length = ret;
+		NT_URB_STATUS(nt_urb) = USBD_STATUS_SUCCESS;
+	} else
+		NT_URB_STATUS(nt_urb) = wrap_urb_status(ret);
+	USBEXIT(return NT_URB_STATUS(nt_urb));
+}
+
+static void set_intf_pipe_info(struct wrap_device *wd,
+			       struct usb_interface *usb_intf,
+			       struct usbd_interface_information *intf)
+{
+	int i;
+	struct usb_endpoint_descriptor *ep;
+	struct usbd_pipe_information *pipe;
+
+	for (i = 0; i < CUR_ALT_SETTING(usb_intf)->desc.bNumEndpoints; i++) {
+		ep = &(CUR_ALT_SETTING(usb_intf)->endpoint[i]).desc;
+		if (i >= intf->bNumEndpoints) {
+			ERROR("intf %p has only %d endpoints, "
+			      "ignoring endpoints above %d",
+			      intf, intf->bNumEndpoints, i);
+			break;
+		}
+		pipe = &intf->pipes[i];
+
+		if (pipe->flags & USBD_PF_CHANGE_MAX_PACKET)
+			USBTRACE("pkt_sz: %d: %d", pipe->wMaxPacketSize,
+				 pipe->max_tx_size);
+		USBTRACE("driver wants max_tx_size to %d",
+			 pipe->max_tx_size);
+
+		pipe->wMaxPacketSize = le16_to_cpu(ep->wMaxPacketSize);
+		pipe->bEndpointAddress = ep->bEndpointAddress;
+		pipe->type = ep->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK;
+		if (pipe->type == UsbdPipeTypeInterrupt) {
+			/* Windows and Linux differ in how the
+			 * bInterval is interpretted */
+			/* for low speed:
+			   interval (Windows) -> frames per ms (Linux)
+			   0 to 15    -> 8
+			   16 to 35   -> 16
+			   36 to 255  -> 32
+
+			   for full speed: interval -> frames per ms
+			   1          -> 1
+			   2 to 3     -> 2
+			   4 to 7     -> 4
+			   8 to 15    -> 8
+			   16 to 31   -> 16
+			   32 to 255  -> 32
+
+			   for high speed: interval -> microframes
+			   1          -> 1
+			   2          -> 2
+			   3          -> 4
+			   4          -> 8
+			   5          -> 16
+			   6          -> 32
+			   7 to 255   -> 32
+			*/
+			if (wd->usb.udev->speed == USB_SPEED_LOW)
+				pipe->bInterval = ep->bInterval + 5;
+			else if (wd->usb.udev->speed == USB_SPEED_FULL)
+				pipe->bInterval = ep->bInterval;
+			else {
+				int j, k;
+				for (j = k = 1; j < ep->bInterval; k++)
+					j *= 2;
+				pipe->bInterval = k;
+			}
+		}
+		pipe->handle = ep;
+		USBTRACE("%d: ep 0x%x, type %d, pkt_sz %d, intv %d (%d),"
+			 "type: %d, handle %p", i, ep->bEndpointAddress,
+			 ep->bmAttributes, pipe->wMaxPacketSize, ep->bInterval,
+			 pipe->bInterval, pipe->type, pipe->handle);
+	}
+}
+
+static USBD_STATUS wrap_select_configuration(struct wrap_device *wd,
+					     union nt_urb *nt_urb,
+					     struct irp *irp)
+{
+	int i, ret;
+	struct usbd_select_configuration *sel_conf;
+	struct usb_device *udev;
+	struct usbd_interface_information *intf;
+	struct usb_config_descriptor *config;
+	struct usb_interface *usb_intf;
+
+	udev = wd->usb.udev;
+	sel_conf = &nt_urb->select_conf;
+	config = sel_conf->config;
+	USBTRACE("%p", config);
+	if (config == NULL) {
+		kill_all_urbs(wd, 1);
+		ret = usb_reset_configuration(udev);
+		return wrap_urb_status(ret);
+	}
+
+	USBTRACE("conf: %d, type: %d, length: %d, numif: %d, attr: %08x",
+		 config->bConfigurationValue, config->bDescriptorType,
+		 config->wTotalLength, config->bNumInterfaces,
+		 config->bmAttributes);
+	ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
+			      USB_REQ_SET_CONFIGURATION, 0,
+			      config->bConfigurationValue, 0,
+			      NULL, 0, USB_CTRL_SET_TIMEOUT);
+	if (ret < 0) {
+		ERROR("ret: %d", ret);
+		return wrap_urb_status(ret);
+	}
+	sel_conf->handle = udev->actconfig;
+	intf = &sel_conf->intf;
+	for (i = 0; i < config->bNumInterfaces && intf->bLength > 0;
+	     i++, intf = (((void *)intf) + intf->bLength)) {
+
+		USBTRACE("intf: %d, alt setting: %d",
+			 intf->bInterfaceNumber, intf->bAlternateSetting);
+		ret = usb_set_interface(udev, intf->bInterfaceNumber,
+					intf->bAlternateSetting);
+		if (ret < 0) {
+			ERROR("failed with %d", ret);
+			return wrap_urb_status(ret);
+		}
+		usb_intf = usb_ifnum_to_if(udev, intf->bInterfaceNumber);
+		if (!usb_intf) {
+			ERROR("couldn't obtain ifnum");
+			return USBD_STATUS_REQUEST_FAILED;
+		}
+		USBTRACE("intf: %p, num ep: %d", intf, intf->bNumEndpoints);
+		set_intf_pipe_info(wd, usb_intf, intf);
+	}
+	return USBD_STATUS_SUCCESS;
+}
+
+static USBD_STATUS wrap_select_interface(struct wrap_device *wd,
+					 union nt_urb *nt_urb,
+					 struct irp *irp)
+{
+	int ret;
+	struct usbd_select_interface *sel_intf;
+	struct usb_device *udev;
+	struct usbd_interface_information *intf;
+	struct usb_interface *usb_intf;
+
+	udev = wd->usb.udev;
+	sel_intf = &nt_urb->select_intf;
+	intf = &sel_intf->intf;
+
+	ret = usb_set_interface(udev, intf->bInterfaceNumber,
+				intf->bAlternateSetting);
+	if (ret < 0) {
+		ERROR("failed with %d", ret);
+		return wrap_urb_status(ret);
+	}
+	usb_intf = usb_ifnum_to_if(udev, intf->bInterfaceNumber);
+	if (!usb_intf) {
+		ERROR("couldn't get interface information");
+		return USBD_STATUS_REQUEST_FAILED;
+	}
+	USBTRACE("intf: %p, num ep: %d", usb_intf, intf->bNumEndpoints);
+	set_intf_pipe_info(wd, usb_intf, intf);
+	return USBD_STATUS_SUCCESS;
+}
+
+static int wrap_usb_get_string(struct usb_device *udev, unsigned short langid,
+			       unsigned char index, void *buf, int size)
+{
+	int i, ret;
+	/* if langid is 0, return array of langauges supported in
+	 * buf */
+	for (i = 0; i < 3; i++) {
+		ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
+				      USB_REQ_GET_DESCRIPTOR, USB_DIR_IN,
+				      (USB_DT_STRING << 8) + index, langid,
+				      buf, size, USB_CTRL_GET_TIMEOUT);
+		if (ret > 0 || ret == -EPIPE)
+			break;
+	}
+	return ret;
+}
+
+static USBD_STATUS wrap_get_descriptor(struct wrap_device *wd,
+				       union nt_urb *nt_urb, struct irp *irp)
+{
+	struct usbd_control_descriptor_request *control_desc;
+	int ret = 0;
+	struct usb_device *udev;
+
+	udev = wd->usb.udev;
+	control_desc = &nt_urb->control_desc;
+	USBTRACE("desctype = %d, descindex = %d, transfer_buffer = %p,"
+		 "transfer_buffer_length = %d", control_desc->desc_type,
+		 control_desc->index, control_desc->transfer_buffer,
+		 control_desc->transfer_buffer_length);
+
+	if (control_desc->desc_type == USB_DT_STRING) {
+		USBTRACE("langid: %x", control_desc->language_id);
+		ret = wrap_usb_get_string(udev, control_desc->language_id,
+					  control_desc->index,
+					  control_desc->transfer_buffer,
+					  control_desc->transfer_buffer_length);
+	} else {
+		ret = usb_get_descriptor(udev, control_desc->desc_type,
+					 control_desc->index,
+					 control_desc->transfer_buffer,
+					 control_desc->transfer_buffer_length);
+	}
+	if (ret < 0) {
+		USBTRACE("request %d failed: %d", control_desc->desc_type, ret);
+		control_desc->transfer_buffer_length = 0;
+		return wrap_urb_status(ret);
+	} else {
+		USBTRACE("ret: %08x", ret);
+		control_desc->transfer_buffer_length = ret;
+		irp->io_status.info = ret;
+		return USBD_STATUS_SUCCESS;
+	}
+}
+
+static USBD_STATUS wrap_process_nt_urb(struct irp *irp)
+{
+	union nt_urb *nt_urb;
+	struct usb_device *udev;
+	USBD_STATUS status;
+	struct wrap_device *wd;
+
+	wd = IRP_WRAP_DEVICE(irp);
+	udev = wd->usb.udev;
+	nt_urb = IRP_URB(irp);
+	USBENTER("nt_urb = %p, irp = %p, length = %d, function = %x",
+		 nt_urb, irp, nt_urb->header.length, nt_urb->header.function);
+
+	DUMP_IRP(irp);
+	switch (nt_urb->header.function) {
+		/* bulk/int and vendor/class urbs are submitted to
+		 * Linux USB core; if the call is sucessful, urb's
+		 * completion worker will return IRP later */
+	case URB_FUNCTION_BULK_OR_INTERRUPT_TRANSFER:
+		USBTRACE("submitting bulk/int irp: %p", irp);
+		status = wrap_bulk_or_intr_trans(irp);
+		break;
+
+	case URB_FUNCTION_VENDOR_DEVICE:
+	case URB_FUNCTION_VENDOR_INTERFACE:
+	case URB_FUNCTION_VENDOR_ENDPOINT:
+	case URB_FUNCTION_VENDOR_OTHER:
+	case URB_FUNCTION_CLASS_DEVICE:
+	case URB_FUNCTION_CLASS_INTERFACE:
+	case URB_FUNCTION_CLASS_ENDPOINT:
+	case URB_FUNCTION_CLASS_OTHER:
+		USBTRACE("submitting vendor/class irp: %p", irp);
+		status = wrap_vendor_or_class_req(irp);
+		break;
+
+		/* rest are synchronous */
+	case URB_FUNCTION_SELECT_CONFIGURATION:
+		status = wrap_select_configuration(wd, nt_urb, irp);
+		NT_URB_STATUS(nt_urb) = status;
+		break;
+
+	case URB_FUNCTION_SELECT_INTERFACE:
+		status = wrap_select_interface(wd, nt_urb, irp);
+		NT_URB_STATUS(nt_urb) = status;
+		break;
+
+	case URB_FUNCTION_GET_DESCRIPTOR_FROM_DEVICE:
+		status = wrap_get_descriptor(wd, nt_urb, irp);
+		NT_URB_STATUS(nt_urb) = status;
+		break;
+
+	case URB_FUNCTION_SYNC_RESET_PIPE_AND_CLEAR_STALL:
+		status = wrap_reset_pipe(udev, irp);
+		NT_URB_STATUS(nt_urb) = status;
+		break;
+
+	case URB_FUNCTION_ABORT_PIPE:
+		status = wrap_abort_pipe(udev, irp);
+		break;
+
+	case URB_FUNCTION_SET_FEATURE_TO_DEVICE:
+	case URB_FUNCTION_SET_FEATURE_TO_INTERFACE:
+	case URB_FUNCTION_SET_FEATURE_TO_ENDPOINT:
+	case URB_FUNCTION_CLEAR_FEATURE_TO_DEVICE:
+	case URB_FUNCTION_CLEAR_FEATURE_TO_INTERFACE:
+	case URB_FUNCTION_CLEAR_FEATURE_TO_ENDPOINT:
+		status = wrap_set_clear_feature(udev, irp);
+		break;
+
+	case URB_FUNCTION_GET_STATUS_FROM_DEVICE:
+	case URB_FUNCTION_GET_STATUS_FROM_INTERFACE:
+	case URB_FUNCTION_GET_STATUS_FROM_ENDPOINT:
+		status = wrap_get_status_request(udev, irp);
+		break;
+
+	default:
+		ERROR("function %x not implemented", nt_urb->header.function);
+		status = NT_URB_STATUS(nt_urb) = USBD_STATUS_NOT_SUPPORTED;
+		break;
+	}
+	USBTRACE("status: %08X", status);
+	return status;
+}
+
+static USBD_STATUS wrap_reset_port(struct irp *irp)
+{
+	no_warn_unused int ret, lock = 0;
+	struct wrap_device *wd;
+
+	wd = IRP_WRAP_DEVICE(irp);
+	USBENTER("%p, %p", wd, wd->usb.udev);
+	lock = usb_lock_device_for_reset(wd->usb.udev, wd->usb.intf);
+	if (lock < 0) {
+		WARNING("locking failed: %d", lock);
+//		return wrap_urb_status(lock);
+		return USBD_STATUS_SUCCESS;
+	}
+	ret = usb_reset_device(wd->usb.udev);
+	if (ret < 0)
+		USBTRACE("reset failed: %d", ret);
+	/* TODO: should reconfigure? */
+	if (lock)
+		usb_unlock_device(wd->usb.udev);
+//	return wrap_urb_status(ret);
+	return USBD_STATUS_SUCCESS;
+}
+
+static USBD_STATUS wrap_get_port_status(struct irp *irp)
+{
+	struct wrap_device *wd;
+	ULONG *status;
+	enum usb_device_state state;
+
+	wd = IRP_WRAP_DEVICE(irp);
+	USBENTER("%p, %p", wd, wd->usb.udev);
+	status = IoGetCurrentIrpStackLocation(irp)->params.others.arg1;
+	state = wd->usb.udev->state;
+	if (state != USB_STATE_NOTATTACHED &&
+	    state != USB_STATE_SUSPENDED) {
+		*status |= USBD_PORT_CONNECTED;
+		if (state == USB_STATE_CONFIGURED)
+			*status |= USBD_PORT_ENABLED;
+	}
+	USBTRACE("state: %d, *status: %08X", state, *status);
+	return USBD_STATUS_SUCCESS;
+}
+
+NTSTATUS wrap_submit_irp(struct device_object *pdo, struct irp *irp)
+{
+	struct io_stack_location *irp_sl;
+	struct wrap_device *wd;
+	USBD_STATUS status;
+	struct usbd_idle_callback *idle_callback;
+
+	USBENTER("%p, %p", pdo, irp);
+	wd = pdo->reserved;
+	if (wd->usb.intf == NULL) {
+		USBTRACE("%p", irp);
+		irp->io_status.status = STATUS_DEVICE_REMOVED;
+		irp->io_status.info = 0;
+		USBEXIT(return STATUS_DEVICE_REMOVED);
+	}
+	IRP_WRAP_DEVICE(irp) = wd;
+	irp_sl = IoGetCurrentIrpStackLocation(irp);
+	switch (irp_sl->params.dev_ioctl.code) {
+	case IOCTL_INTERNAL_USB_SUBMIT_URB:
+		status = wrap_process_nt_urb(irp);
+		break;
+	case IOCTL_INTERNAL_USB_RESET_PORT:
+		status = wrap_reset_port(irp);
+		break;
+	case IOCTL_INTERNAL_USB_GET_PORT_STATUS:
+		status = wrap_get_port_status(irp);
+		break;
+	case IOCTL_INTERNAL_USB_SUBMIT_IDLE_NOTIFICATION:
+		idle_callback = irp_sl->params.dev_ioctl.type3_input_buf;
+		USBTRACE("suspend function: %p", idle_callback->callback);
+		status = USBD_STATUS_NOT_SUPPORTED;
+		break;
+	default:
+		ERROR("ioctl %08X NOT IMPLEMENTED",
+		      irp_sl->params.dev_ioctl.code);
+		status = USBD_STATUS_NOT_SUPPORTED;
+		break;
+	}
+
+	USBTRACE("status: %08X", status);
+	if (status == USBD_STATUS_PENDING) {
+		/* don't touch this IRP - it may have been already
+		 * completed/returned */
+		return STATUS_PENDING;
+	} else {
+		irp->io_status.status = nt_urb_irp_status(status);
+		if (status != USBD_STATUS_SUCCESS)
+			irp->io_status.info = 0;
+		USBEXIT(return irp->io_status.status);
+	}
+}
+
+/* TODO: The example on msdn in reference section suggests that second
+ * argument should be an array of usbd_interface_information, but
+ * description and examples elsewhere suggest that it should be
+ * usbd_interface_list_entry structre. Which is correct? */
+
+wstdcall union nt_urb *WIN_FUNC(USBD_CreateConfigurationRequestEx,2)
+	(struct usb_config_descriptor *config,
+	 struct usbd_interface_list_entry *intf_list)
+{
+	int size, i, n;
+	struct usbd_interface_information *intf;
+	struct usbd_pipe_information *pipe;
+	struct usb_interface_descriptor *intf_desc;
+	struct usbd_select_configuration *select_conf;
+
+	USBENTER("config = %p, intf_list = %p", config, intf_list);
+
+	/* calculate size required; select_conf already has space for
+	 * one intf structure */
+	size = sizeof(*select_conf) - sizeof(*intf);
+	for (n = 0; n < config->bNumInterfaces; n++) {
+		i = intf_list[n].intf_desc->bNumEndpoints;
+		/* intf already has space for one pipe */
+		size += sizeof(*intf) + (i - 1) * sizeof(*pipe);
+	}
+	/* don't use kmalloc - driver frees it with ExFreePool */
+	select_conf = ExAllocatePoolWithTag(NonPagedPool, size,
+					    POOL_TAG('L', 'U', 'S', 'B'));
+	if (!select_conf) {
+		WARNING("couldn't allocate memory");
+		return NULL;
+	}
+	memset(select_conf, 0, size);
+	intf = &select_conf->intf;
+	select_conf->handle = config;
+	for (n = 0; n < config->bNumInterfaces && intf_list[n].intf_desc; n++) {
+		/* initialize 'intf' fields in intf_list so they point
+		 * to appropriate entry; these may be read/written by
+		 * driver after this function returns */
+		intf_list[n].intf = intf;
+		intf_desc = intf_list[n].intf_desc;
+
+		i = intf_desc->bNumEndpoints;
+		intf->bLength = sizeof(*intf) + (i - 1) * sizeof(*pipe);
+
+		intf->bInterfaceNumber = intf_desc->bInterfaceNumber;
+		intf->bAlternateSetting = intf_desc->bAlternateSetting;
+		intf->bInterfaceClass = intf_desc->bInterfaceClass;
+		intf->bInterfaceSubClass = intf_desc->bInterfaceSubClass;
+		intf->bInterfaceProtocol = intf_desc->bInterfaceProtocol;
+		intf->bNumEndpoints = intf_desc->bNumEndpoints;
+
+		pipe = &intf->pipes[0];
+		for (i = 0; i < intf->bNumEndpoints; i++) {
+			memset(&pipe[i], 0, sizeof(*pipe));
+			pipe[i].max_tx_size =
+				USBD_DEFAULT_MAXIMUM_TRANSFER_SIZE;
+		}
+		intf->handle = intf_desc;
+		intf = (((void *)intf) + intf->bLength);
+	}
+	select_conf->header.function = URB_FUNCTION_SELECT_CONFIGURATION;
+	select_conf->header.length = size;
+	select_conf->config = config;
+	USBEXIT(return (union nt_urb *)select_conf);
+}
+
+WIN_SYMBOL_MAP("_USBD_CreateConfigurationRequestEx@8", USBD_CreateConfigurationRequestEx)
+
+wstdcall struct usb_interface_descriptor *
+WIN_FUNC(USBD_ParseConfigurationDescriptorEx,7)
+	(struct usb_config_descriptor *config, void *start,
+	 LONG bInterfaceNumber, LONG bAlternateSetting, LONG bInterfaceClass,
+	 LONG bInterfaceSubClass, LONG bInterfaceProtocol)
+{
+	void *pos;
+	struct usb_interface_descriptor *intf;
+
+	USBENTER("config = %p, start = %p, ifnum = %d, alt_setting = %d,"
+		 " class = %d, subclass = %d, proto = %d", config, start,
+		 bInterfaceNumber, bAlternateSetting, bInterfaceClass,
+		 bInterfaceSubClass, bInterfaceProtocol);
+
+	for (pos = start;
+	     pos < ((void *)config + le16_to_cpu(config->wTotalLength));
+	     pos += intf->bLength) {
+
+		intf = pos;
+
+		if ((intf->bDescriptorType == USB_DT_INTERFACE) &&
+		    ((bInterfaceNumber == -1) ||
+		     (intf->bInterfaceNumber == bInterfaceNumber)) &&
+		    ((bAlternateSetting == -1) ||
+		     (intf->bAlternateSetting == bAlternateSetting)) &&
+		    ((bInterfaceClass == -1) ||
+		     (intf->bInterfaceClass == bInterfaceClass)) &&
+		    ((bInterfaceSubClass == -1) ||
+		     (intf->bInterfaceSubClass == bInterfaceSubClass)) &&
+		    ((bInterfaceProtocol == -1) ||
+		     (intf->bInterfaceProtocol == bInterfaceProtocol))) {
+			USBTRACE("selected interface = %p", intf);
+			USBEXIT(return intf);
+		}
+	}
+	USBEXIT(return NULL);
+}
+
+WIN_SYMBOL_MAP("_USBD_ParseConfigurationDescriptorEx@28", USBD_ParseConfigurationDescriptorEx)
+
+wstdcall union nt_urb *WIN_FUNC(USBD_CreateConfigurationRequest,2)
+	(struct usb_config_descriptor *config, USHORT *size)
+{
+	union nt_urb *nt_urb;
+	struct usbd_interface_list_entry intf_list[2];
+	struct usb_interface_descriptor *intf_desc;
+
+	USBENTER("config = %p, urb_size = %p", config, size);
+
+	intf_desc = USBD_ParseConfigurationDescriptorEx(config, config, -1, -1,
+							-1, -1, -1);
+	intf_list[0].intf_desc = intf_desc;
+	intf_list[0].intf = NULL;
+	intf_list[1].intf_desc = NULL;
+	intf_list[1].intf = NULL;
+	nt_urb = USBD_CreateConfigurationRequestEx(config, intf_list);
+	if (!nt_urb)
+		return NULL;
+
+	*size = nt_urb->select_conf.header.length;
+	USBEXIT(return nt_urb);
+}
+
+wstdcall struct usb_interface_descriptor *
+WIN_FUNC(USBD_ParseConfigurationDescriptor,3)
+	(struct usb_config_descriptor *config, UCHAR bInterfaceNumber,
+	 UCHAR bAlternateSetting)
+{
+	return USBD_ParseConfigurationDescriptorEx(config, config,
+						   bInterfaceNumber,
+						   bAlternateSetting,
+						   -1, -1, -1);
+}
+
+wstdcall usb_common_descriptor_t *WIN_FUNC(USBD_ParseDescriptors,4)
+	(void *buf, ULONG length, void *start, LONG type)
+{
+	usb_common_descriptor_t *descr = start;
+
+	while ((void *)descr < buf + length) {
+		if (descr->bDescriptorType == type)
+			return descr;
+		if (descr->bLength == 0)
+			break;
+		descr = (void *)descr + descr->bLength;
+	}
+	USBEXIT(return NULL);
+}
+
+WIN_SYMBOL_MAP("_USBD_ParseDescriptors@16", USBD_ParseDescriptors)
+
+wstdcall void WIN_FUNC(USBD_GetUSBDIVersion,1)
+	(struct usbd_version_info *version_info)
+{
+	/* this function is obsolete in Windows XP */
+	if (version_info) {
+		version_info->usbdi_version = USBDI_VERSION_XP;
+		/* TODO: how do we get this correctly? */
+		version_info->supported_usb_version = 0x110;
+	}
+	USBEXIT(return);
+}
+
+wstdcall void
+USBD_InterfaceGetUSBDIVersion(void *context,
+			      struct usbd_version_info *version_info,
+			      ULONG *hcd_capa)
+{
+	struct wrap_device *wd = context;
+
+	if (version_info) {
+		version_info->usbdi_version = USBDI_VERSION_XP;
+		if (wd->usb.udev->speed == USB_SPEED_HIGH)
+			version_info->supported_usb_version = 0x200;
+		else
+			version_info->supported_usb_version = 0x110;
+	}
+	*hcd_capa = USB_HCD_CAPS_SUPPORTS_RT_THREADS;
+	USBEXIT(return);
+}
+
+wstdcall BOOLEAN USBD_InterfaceIsDeviceHighSpeed(void *context)
+{
+	struct wrap_device *wd = context;
+
+	USBTRACE("wd: %p", wd);
+	if (wd->usb.udev->speed == USB_SPEED_HIGH)
+		USBEXIT(return TRUE);
+	else
+		USBEXIT(return FALSE);
+}
+
+wstdcall void USBD_InterfaceReference(void *context)
+{
+	USBTRACE("%p", context);
+	TODO();
+}
+
+wstdcall void USBD_InterfaceDereference(void *context)
+{
+	USBTRACE("%p", context);
+	TODO();
+}
+
+wstdcall NTSTATUS USBD_InterfaceQueryBusTime(void *context, ULONG *frame)
+{
+	struct wrap_device *wd = context;
+
+	*frame = usb_get_current_frame_number(wd->usb.udev);
+	USBEXIT(return STATUS_SUCCESS);
+}
+
+wstdcall NTSTATUS USBD_InterfaceSubmitIsoOutUrb(void *context,
+					       union nt_urb *nt_urb)
+{
+	/* TODO: implement this */
+	TODO();
+	USBEXIT(return STATUS_NOT_IMPLEMENTED);
+}
+
+wstdcall NTSTATUS
+USBD_InterfaceQueryBusInformation(void *context, ULONG level, void *buf,
+				  ULONG *buf_length, ULONG *buf_actual_length)
+{
+	struct wrap_device *wd = context;
+	struct usb_bus_information_level *bus_info;
+	struct usb_bus *bus;
+
+	bus = wd->usb.udev->bus;
+	bus_info = buf;
+	TODO();
+	USBEXIT(return STATUS_NOT_IMPLEMENTED);
+}
+
+wstdcall NTSTATUS
+USBD_InterfaceLogEntry(void *context, ULONG driver_tag, ULONG enum_tag,
+		       ULONG p1, ULONG p2)
+{
+	ERROR("%p, %x, %x, %x, %x", context, driver_tag, enum_tag, p1, p2);
+	USBEXIT(return STATUS_SUCCESS);
+}
+
+int usb_init(void)
+{
+	InitializeListHead(&wrap_urb_complete_list);
+	spin_lock_init(&wrap_urb_complete_list_lock);
+	initialize_work(&wrap_urb_complete_work, wrap_urb_complete_worker, NULL);
+#ifdef USB_DEBUG
+	urb_id = 0;
+#endif
+	return 0;
+}
+
+void usb_exit(void)
+{
+	USBEXIT(return);
+}
+
+int usb_init_device(struct wrap_device *wd)
+{
+	InitializeListHead(&wd->usb.wrap_urb_list);
+	wd->usb.num_alloc_urbs = 0;
+	USBEXIT(return 0);
+}
+
+void usb_exit_device(struct wrap_device *wd)
+{
+	kill_all_urbs(wd, 0);
+	USBEXIT(return);
+}
--- linux-rt-2.6.31.orig/ubuntu/ndiswrapper/loader.h
+++ linux-rt-2.6.31/ubuntu/ndiswrapper/loader.h
@@ -0,0 +1,90 @@
+/*
+ *  Copyright (C) 2003-2005 Pontus Fuchs, Giridhar Pemmasani
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ *  GNU General Public License for more details.
+ *
+ */
+
+#ifndef _LOADER_H_
+#define _LOADER_H_
+
+#include "ndiswrapper.h"
+
+#ifndef __KERNEL__
+#define __user
+#endif
+
+struct load_driver_file {
+	char driver_name[MAX_DRIVER_NAME_LEN];
+	char name[MAX_DRIVER_NAME_LEN];
+	size_t size;
+	void __user *data;
+};
+
+struct load_device_setting {
+	char name[MAX_SETTING_NAME_LEN];
+	char value[MAX_SETTING_VALUE_LEN];
+};
+
+struct load_device {
+	int bus;
+	int vendor;
+	int device;
+	int subvendor;
+	int subdevice;
+	char conf_file_name[MAX_DRIVER_NAME_LEN];
+	char driver_name[MAX_DRIVER_NAME_LEN];
+};
+
+struct load_devices {
+	int count;
+	struct load_device *devices;
+};
+
+struct load_driver {
+	char name[MAX_DRIVER_NAME_LEN];
+	char conf_file_name[MAX_DRIVER_NAME_LEN];
+	unsigned int num_sys_files;
+	struct load_driver_file sys_files[MAX_DRIVER_PE_IMAGES];
+	unsigned int num_settings;
+	struct load_device_setting settings[MAX_DEVICE_SETTINGS];
+	unsigned int num_bin_files;
+	struct load_driver_file bin_files[MAX_DRIVER_BIN_FILES];
+};
+
+#define WRAP_IOCTL_LOAD_DEVICE _IOW(('N' + 'd' + 'i' + 'S'), 0,	\
+				    struct load_device *)
+#define WRAP_IOCTL_LOAD_DRIVER _IOW(('N' + 'd' + 'i' + 'S'), 1,	\
+				    struct load_driver *)
+#define WRAP_IOCTL_LOAD_BIN_FILE _IOW(('N' + 'd' + 'i' + 'S'), 2,	\
+				      struct load_driver_file *)
+
+#define WRAP_CMD_LOAD_DEVICE "load_device"
+#define WRAP_CMD_LOAD_DRIVER "load_driver"
+#define WRAP_CMD_LOAD_BIN_FILE "load_bin_file"
+
+int loader_init(void);
+void loader_exit(void);
+
+#ifdef __KERNEL__
+struct wrap_device *load_wrap_device(struct load_device *load_device);
+struct wrap_driver *load_wrap_driver(struct wrap_device *device);
+struct wrap_bin_file *get_bin_file(char *bin_file_name);
+void free_bin_file(struct wrap_bin_file *bin_file);
+void unload_wrap_driver(struct wrap_driver *driver);
+void unload_wrap_device(struct wrap_device *wd);
+struct wrap_device *get_wrap_device(void *dev, int bus_type);
+
+extern struct semaphore loader_mutex;
+#endif
+
+#endif /* LOADER_H */
+
--- linux-rt-2.6.31.orig/ubuntu/ndiswrapper/wrapndis.c
+++ linux-rt-2.6.31/ubuntu/ndiswrapper/wrapndis.c
@@ -0,0 +1,2133 @@
+/*
+ *  Copyright (C) 2003-2005 Pontus Fuchs, Giridhar Pemmasani
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ *  GNU General Public License for more details.
+ *
+ */
+
+#include "ndis.h"
+#include "iw_ndis.h"
+#include "pnp.h"
+#include "loader.h"
+#include "wrapndis.h"
+#include <linux/inetdevice.h>
+#include <linux/ip.h>
+#include <linux/tcp.h>
+#include <linux/udp.h>
+#include <linux/in.h>
+#include "wrapper.h"
+
+/* Functions callable from the NDIS driver */
+wstdcall NTSTATUS NdisDispatchDeviceControl(struct device_object *fdo,
+					    struct irp *irp);
+wstdcall NTSTATUS NdisDispatchPnp(struct device_object *fdo, struct irp *irp);
+wstdcall NTSTATUS NdisDispatchPower(struct device_object *fdo, struct irp *irp);
+
+workqueue_struct_t *wrapndis_wq;
+static struct nt_thread *wrapndis_worker_thread;
+
+static int set_packet_filter(struct ndis_device *wnd,
+			     ULONG packet_filter);
+static void add_iw_stats_timer(struct ndis_device *wnd);
+static void del_iw_stats_timer(struct ndis_device *wnd);
+static NDIS_STATUS ndis_start_device(struct ndis_device *wnd);
+static int ndis_remove_device(struct ndis_device *wnd);
+static void set_multicast_list(struct ndis_device *wnd);
+static int ndis_net_dev_open(struct net_device *net_dev);
+static int ndis_net_dev_close(struct net_device *net_dev);
+
+/* MiniportReset */
+NDIS_STATUS mp_reset(struct ndis_device *wnd)
+{
+	NDIS_STATUS res;
+	struct miniport *mp;
+	BOOLEAN reset_address;
+	KIRQL irql;
+
+	ENTER2("wnd: %p", wnd);
+	if (down_interruptible(&wnd->tx_ring_mutex))
+		EXIT3(return NDIS_STATUS_FAILURE);
+	if (down_interruptible(&wnd->ndis_req_mutex)) {
+		up(&wnd->tx_ring_mutex);
+		EXIT3(return NDIS_STATUS_FAILURE);
+	}
+	mp = &wnd->wd->driver->ndis_driver->mp;
+	prepare_wait_condition(wnd->ndis_req_task, wnd->ndis_req_done, 0);
+	WARNING("%s is being reset", wnd->net_dev->name);
+	irql = serialize_lock_irql(wnd);
+	assert_irql(_irql_ == DISPATCH_LEVEL);
+	res = LIN2WIN2(mp->reset, &reset_address, wnd->nmb->mp_ctx);
+	serialize_unlock_irql(wnd, irql);
+
+	TRACE2("%08X, %08X", res, reset_address);
+	if (res == NDIS_STATUS_PENDING) {
+		/* wait for NdisMResetComplete */
+		if (wait_condition((wnd->ndis_req_done > 0), 0,
+				   TASK_INTERRUPTIBLE) < 0)
+			res = NDIS_STATUS_FAILURE;
+		else {
+			res = wnd->ndis_req_status;
+			reset_address = wnd->ndis_req_done - 1;
+		}
+		TRACE2("%08X, %08X", res, reset_address);
+	}
+	up(&wnd->ndis_req_mutex);
+	if (res == NDIS_STATUS_SUCCESS && reset_address) {
+		set_packet_filter(wnd, wnd->packet_filter);
+		set_multicast_list(wnd);
+	}
+	up(&wnd->tx_ring_mutex);
+	EXIT3(return res);
+}
+
+/* MiniportRequest(Query/Set)Information */
+NDIS_STATUS mp_request(enum ndis_request_type request,
+		       struct ndis_device *wnd, ndis_oid oid,
+		       void *buf, ULONG buflen, ULONG *written, ULONG *needed)
+{
+	NDIS_STATUS res;
+	ULONG w, n;
+	struct miniport *mp;
+	KIRQL irql;
+
+	if (down_interruptible(&wnd->ndis_req_mutex))
+		EXIT3(return NDIS_STATUS_FAILURE);
+	if (!written)
+		written = &w;
+	if (!needed)
+		needed = &n;
+	mp = &wnd->wd->driver->ndis_driver->mp;
+	prepare_wait_condition(wnd->ndis_req_task, wnd->ndis_req_done, 0);
+	irql = serialize_lock_irql(wnd);
+	assert_irql(_irql_ == DISPATCH_LEVEL);
+	switch (request) {
+	case NdisRequestQueryInformation:
+		TRACE2("%p, %08X, %p", mp->queryinfo, oid, wnd->nmb->mp_ctx);
+		res = LIN2WIN6(mp->queryinfo, wnd->nmb->mp_ctx, oid, buf,
+			       buflen, written, needed);
+		break;
+	case NdisRequestSetInformation:
+		TRACE2("%p, %08X, %p", mp->setinfo, oid, wnd->nmb->mp_ctx);
+		res = LIN2WIN6(mp->setinfo, wnd->nmb->mp_ctx, oid, buf,
+			       buflen, written, needed);
+		break;
+	default:
+		WARNING("invalid request %d, %08X", request, oid);
+		res = NDIS_STATUS_NOT_SUPPORTED;
+		break;
+	}
+	serialize_unlock_irql(wnd, irql);
+	TRACE2("%08X, %08X", res, oid);
+	if (res == NDIS_STATUS_PENDING) {
+		/* wait for NdisMQueryInformationComplete */
+		if (wait_condition((wnd->ndis_req_done > 0), 0,
+				   TASK_INTERRUPTIBLE) < 0)
+			res = NDIS_STATUS_FAILURE;
+		else
+			res = wnd->ndis_req_status;
+		TRACE2("%08X, %08X", res, oid);
+	}
+	up(&wnd->ndis_req_mutex);
+	DBG_BLOCK(2) {
+		if (res || needed)
+			TRACE2("%08X, %d, %d, %d", res, buflen, *written,
+			       *needed);
+	}
+	EXIT3(return res);
+}
+
+/* MiniportPnPEventNotify */
+static NDIS_STATUS mp_pnp_event(struct ndis_device *wnd,
+				enum ndis_device_pnp_event event,
+				ULONG power_profile)
+{
+	struct miniport *mp;
+
+	ENTER1("%p, %d", wnd, event);
+	mp = &wnd->wd->driver->ndis_driver->mp;
+	if (!mp->pnp_event_notify) {
+		TRACE1("Windows driver %s doesn't support "
+		       "MiniportPnpEventNotify", wnd->wd->driver->name);
+		return NDIS_STATUS_FAILURE;
+	}
+	/* RNDIS driver doesn't like to be notified if device is
+	 * already halted */
+	if (!test_bit(HW_INITIALIZED, &wnd->wd->hw_status))
+		EXIT1(return NDIS_STATUS_SUCCESS);
+	switch (event) {
+	case NdisDevicePnPEventSurpriseRemoved:
+		TRACE1("%u, %p",
+		       (wnd->attributes & NDIS_ATTRIBUTE_SURPRISE_REMOVE_OK),
+		       mp->pnp_event_notify);
+		if ((wnd->attributes & NDIS_ATTRIBUTE_SURPRISE_REMOVE_OK) &&
+		    !test_bit(HW_PRESENT, &wnd->wd->hw_status) &&
+		    mp->pnp_event_notify) {
+			TRACE1("calling surprise_removed");
+			LIN2WIN4(mp->pnp_event_notify, wnd->nmb->mp_ctx,
+				 NdisDevicePnPEventSurpriseRemoved, NULL, 0);
+		} else
+			TRACE1("Windows driver %s doesn't support "
+			       "MiniportPnpEventNotify for safe unplugging",
+			       wnd->wd->driver->name);
+		return NDIS_STATUS_SUCCESS;
+	case NdisDevicePnPEventPowerProfileChanged:
+		if (power_profile)
+			power_profile = NdisPowerProfileAcOnLine;
+		LIN2WIN4(mp->pnp_event_notify, wnd->nmb->mp_ctx,
+			 NdisDevicePnPEventPowerProfileChanged,
+			 &power_profile, (ULONG)sizeof(power_profile));
+		return NDIS_STATUS_SUCCESS;
+	default:
+		WARNING("event %d not yet implemented", event);
+		return NDIS_STATUS_SUCCESS;
+	}
+}
+
+/* MiniportInitialize */
+static NDIS_STATUS mp_init(struct ndis_device *wnd)
+{
+	NDIS_STATUS error_status, status;
+	UINT medium_index;
+	enum ndis_medium medium_array[] = {NdisMedium802_3};
+	struct miniport *mp;
+
+	ENTER1("irql: %d", current_irql());
+	if (test_bit(HW_INITIALIZED, &wnd->wd->hw_status)) {
+		WARNING("device %p already initialized!", wnd);
+		return NDIS_STATUS_FAILURE;
+	}
+
+	if (!wnd->wd->driver->ndis_driver ||
+	    !wnd->wd->driver->ndis_driver->mp.init) {
+		WARNING("assuming WDM (non-NDIS) driver");
+		EXIT1(return NDIS_STATUS_NOT_RECOGNIZED);
+	}
+	mp = &wnd->wd->driver->ndis_driver->mp;
+	status = LIN2WIN6(mp->init, &error_status, &medium_index, medium_array,
+			  sizeof(medium_array) / sizeof(medium_array[0]),
+			  wnd->nmb, wnd->nmb);
+	TRACE1("init returns: %08X, irql: %d", status, current_irql());
+	if (status != NDIS_STATUS_SUCCESS) {
+		WARNING("couldn't initialize device: %08X", status);
+		EXIT1(return NDIS_STATUS_FAILURE);
+	}
+
+	/* Wait a little to let card power up otherwise ifup might
+	 * fail after boot */
+	sleep_hz(HZ / 5);
+	status = mp_pnp_event(wnd, NdisDevicePnPEventPowerProfileChanged,
+			      NdisPowerProfileAcOnLine);
+	if (status != NDIS_STATUS_SUCCESS)
+		TRACE1("setting power failed: %08X", status);
+	set_bit(HW_INITIALIZED, &wnd->wd->hw_status);
+	/* the description about NDIS_ATTRIBUTE_NO_HALT_ON_SUSPEND is
+	 * misleading/confusing */
+	status = mp_query(wnd, OID_PNP_CAPABILITIES,
+			  &wnd->pnp_capa, sizeof(wnd->pnp_capa));
+	if (status == NDIS_STATUS_SUCCESS) {
+		TRACE1("%d, %d", wnd->pnp_capa.wakeup.min_magic_packet_wakeup,
+		       wnd->pnp_capa.wakeup.min_pattern_wakeup);
+		wnd->attributes |= NDIS_ATTRIBUTE_NO_HALT_ON_SUSPEND;
+		status = mp_query_int(wnd, OID_PNP_ENABLE_WAKE_UP,
+				      &wnd->ndis_wolopts);
+		TRACE1("%08X, %x", status, wnd->ndis_wolopts);
+	} else if (status == NDIS_STATUS_NOT_SUPPORTED)
+		wnd->attributes &= ~NDIS_ATTRIBUTE_NO_HALT_ON_SUSPEND;
+	TRACE1("%d", wnd->pnp_capa.wakeup.min_magic_packet_wakeup);
+	/* although some NDIS drivers support suspend, Linux kernel
+	 * has issues with suspending USB devices */
+	if (wrap_is_usb_bus(wnd->wd->dev_bus)) {
+		wnd->attributes &= ~NDIS_ATTRIBUTE_NO_HALT_ON_SUSPEND;
+		wnd->ndis_wolopts = 0;
+	}
+	mp_set_int(wnd, OID_802_11_POWER_MODE, NDIS_POWER_OFF);
+	EXIT1(return NDIS_STATUS_SUCCESS);
+}
+
+/* MiniportHalt */
+static void mp_halt(struct ndis_device *wnd)
+{
+	struct miniport *mp;
+
+	ENTER1("%p", wnd);
+	if (!test_and_clear_bit(HW_INITIALIZED, &wnd->wd->hw_status)) {
+		WARNING("device %p is not initialized - not halting", wnd);
+		return;
+	}
+	hangcheck_del(wnd);
+	del_iw_stats_timer(wnd);
+	if (wnd->physical_medium == NdisPhysicalMediumWirelessLan &&
+	    wrap_is_pci_bus(wnd->wd->dev_bus)) {
+		up(&wnd->ndis_req_mutex);
+		disassociate(wnd, 0);
+		if (down_interruptible(&wnd->ndis_req_mutex))
+			WARNING("couldn't obtain ndis_req_mutex");
+	}
+	mp = &wnd->wd->driver->ndis_driver->mp;
+	TRACE1("halt: %p", mp->mp_halt);
+	LIN2WIN1(mp->mp_halt, wnd->nmb->mp_ctx);
+	/* if a driver doesn't call NdisMDeregisterInterrupt during
+	 * halt, deregister it now */
+	if (wnd->mp_interrupt)
+		NdisMDeregisterInterrupt(wnd->mp_interrupt);
+	/* cancel any timers left by bugyy windows driver; also free
+	 * the memory for timers */
+	while (1) {
+		struct nt_slist *slist;
+		struct wrap_timer *wrap_timer;
+
+		spin_lock_bh(&ntoskernel_lock);
+		if ((slist = wnd->wrap_timer_slist.next))
+			wnd->wrap_timer_slist.next = slist->next;
+		spin_unlock_bh(&ntoskernel_lock);
+		TIMERTRACE("%p", slist);
+		if (!slist)
+			break;
+		wrap_timer = container_of(slist, struct wrap_timer, slist);
+		wrap_timer->repeat = 0;
+		/* ktimer that this wrap_timer is associated to can't
+		 * be touched, as it may have been freed by the driver
+		 * already */
+		if (del_timer_sync(&wrap_timer->timer))
+			WARNING("Buggy Windows driver left timer %p "
+				"running", wrap_timer->nt_timer);
+		memset(wrap_timer, 0, sizeof(*wrap_timer));
+		kfree(wrap_timer);
+	}
+	EXIT1(return);
+}
+
+static NDIS_STATUS mp_set_power_state(struct ndis_device *wnd,
+				      enum ndis_power_state state)
+{
+	NDIS_STATUS status;
+
+	TRACE1("%d", state);
+	if (state == NdisDeviceStateD0) {
+		status = NDIS_STATUS_SUCCESS;
+		up(&wnd->ndis_req_mutex);
+		if (test_and_clear_bit(HW_HALTED, &wnd->wd->hw_status)) {
+			status = mp_init(wnd);
+			if (status == NDIS_STATUS_SUCCESS) {
+				set_packet_filter(wnd, wnd->packet_filter);
+				set_multicast_list(wnd);
+			}
+		} else if (test_and_clear_bit(HW_SUSPENDED,
+					      &wnd->wd->hw_status)) {
+			status = mp_set_int(wnd, OID_PNP_SET_POWER, state);
+			if (status != NDIS_STATUS_SUCCESS)
+				WARNING("%s: setting power to state %d failed? "
+					"%08X", wnd->net_dev->name, state,
+					status);
+		} else
+			return NDIS_STATUS_FAILURE;
+
+		if (wrap_is_pci_bus(wnd->wd->dev_bus)) {
+			pci_enable_wake(wnd->wd->pci.pdev, PCI_D3hot, 0);
+			pci_enable_wake(wnd->wd->pci.pdev, PCI_D3cold, 0);
+		}
+		if (status == NDIS_STATUS_SUCCESS) {
+			up(&wnd->tx_ring_mutex);
+			netif_device_attach(wnd->net_dev);
+			hangcheck_add(wnd);
+			add_iw_stats_timer(wnd);
+		} else
+			WARNING("%s: couldn't set power to state %d; device not"
+				" resumed", wnd->net_dev->name, state);
+		EXIT1(return status);
+	} else {
+		if (down_interruptible(&wnd->tx_ring_mutex))
+			EXIT1(return NDIS_STATUS_FAILURE);
+		netif_device_detach(wnd->net_dev);
+		hangcheck_del(wnd);
+		del_iw_stats_timer(wnd);
+		status = NDIS_STATUS_NOT_SUPPORTED;
+		if (wnd->attributes & NDIS_ATTRIBUTE_NO_HALT_ON_SUSPEND) {
+			status = mp_set_int(wnd, OID_PNP_ENABLE_WAKE_UP,
+					    wnd->ndis_wolopts);
+			TRACE2("0x%x, 0x%x", status, wnd->ndis_wolopts);
+			if (status == NDIS_STATUS_SUCCESS) {
+				if (wnd->ndis_wolopts)
+					wnd->wd->pci.wake_state =
+						PowerDeviceD3;
+				else
+					wnd->wd->pci.wake_state =
+						PowerDeviceUnspecified;
+			} else
+				WARNING("couldn't set wake-on-lan options: "
+					"0x%x, %08X", wnd->ndis_wolopts, status);
+			status = mp_set_int(wnd, OID_PNP_SET_POWER, state);
+			if (status == NDIS_STATUS_SUCCESS)
+				set_bit(HW_SUSPENDED, &wnd->wd->hw_status);
+			else
+				WARNING("suspend failed: %08X", status);
+		}
+		if (status != NDIS_STATUS_SUCCESS) {
+			WARNING("%s does not support power management; "
+				"halting the device", wnd->net_dev->name);
+			mp_halt(wnd);
+			set_bit(HW_HALTED, &wnd->wd->hw_status);
+			status = STATUS_SUCCESS;
+		}
+		if (down_interruptible(&wnd->ndis_req_mutex))
+			WARNING("couldn't lock ndis_req_mutex");
+		EXIT1(return status);
+	}
+}
+
+static int ndis_set_mac_address(struct net_device *dev, void *p)
+{
+	struct ndis_device *wnd = netdev_priv(dev);
+	struct sockaddr *addr = p;
+	struct ndis_configuration_parameter param;
+	struct unicode_string key;
+	struct ansi_string ansi;
+	NDIS_STATUS res;
+	unsigned char mac_string[2 * ETH_ALEN + 1];
+	mac_address mac;
+
+	memcpy(mac, addr->sa_data, sizeof(mac));
+	memset(mac_string, 0, sizeof(mac_string));
+	res = snprintf(mac_string, sizeof(mac_string), MACSTR, MAC2STR(mac));
+	if (res != (sizeof(mac_string) - 1))
+		EXIT1(return -EINVAL);
+	TRACE1("new mac: %s", mac_string);
+
+	RtlInitAnsiString(&ansi, mac_string);
+	if (RtlAnsiStringToUnicodeString(&param.data.string, &ansi,
+					 TRUE) != STATUS_SUCCESS)
+		EXIT1(return -EINVAL);
+
+	param.type = NdisParameterString;
+	RtlInitAnsiString(&ansi, "NetworkAddress");
+	if (RtlAnsiStringToUnicodeString(&key, &ansi, TRUE) != STATUS_SUCCESS) {
+		RtlFreeUnicodeString(&param.data.string);
+		EXIT1(return -EINVAL);
+	}
+	NdisWriteConfiguration(&res, wnd->nmb, &key, &param);
+	RtlFreeUnicodeString(&key);
+	RtlFreeUnicodeString(&param.data.string);
+
+	if (res != NDIS_STATUS_SUCCESS)
+		EXIT1(return -EFAULT);
+	if (ndis_reinit(wnd) == NDIS_STATUS_SUCCESS) {
+		res = mp_query(wnd, OID_802_3_CURRENT_ADDRESS,
+			       mac, sizeof(mac));
+		if (res == NDIS_STATUS_SUCCESS) {
+			TRACE1("mac:" MACSTRSEP, MAC2STR(mac));
+			memcpy(dev->dev_addr, mac, sizeof(mac));
+		} else
+			ERROR("couldn't get mac address: %08X", res);
+	}
+	EXIT1(return 0);
+}
+
+static int setup_tx_sg_list(struct ndis_device *wnd, struct sk_buff *skb,
+			    struct ndis_packet_oob_data *oob_data)
+{
+	struct ndis_sg_element *sg_element;
+	struct ndis_sg_list *sg_list;
+	int i;
+
+	ENTER3("%p, %d", skb, skb_shinfo(skb)->nr_frags);
+	if (skb_shinfo(skb)->nr_frags <= 1) {
+		sg_element = &oob_data->wrap_tx_sg_list.elements[0];
+		sg_element->address =
+			PCI_DMA_MAP_SINGLE(wnd->wd->pci.pdev, skb->data,
+					   skb->len, PCI_DMA_TODEVICE);
+		sg_element->length = skb->len;
+		oob_data->wrap_tx_sg_list.nent = 1;
+		oob_data->ext.info[ScatterGatherListPacketInfo] =
+			&oob_data->wrap_tx_sg_list;
+		TRACE3("%Lx, %u", sg_element->address, sg_element->length);
+		return 0;
+	}
+	sg_list = kmalloc(sizeof(*sg_list) +
+			  (skb_shinfo(skb)->nr_frags + 1) * sizeof(*sg_element),
+			  GFP_ATOMIC);
+	if (!sg_list)
+		return -ENOMEM;
+	sg_list->nent = skb_shinfo(skb)->nr_frags + 1;
+	TRACE3("%p, %d", sg_list, sg_list->nent);
+	sg_element = sg_list->elements;
+	sg_element->length = skb_headlen(skb);
+	sg_element->address =
+		PCI_DMA_MAP_SINGLE(wnd->wd->pci.pdev, skb->data,
+				   skb_headlen(skb), PCI_DMA_TODEVICE);
+	for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
+		skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
+		sg_element++;
+		sg_element->length = frag->size;
+		sg_element->address =
+			pci_map_page(wnd->wd->pci.pdev, frag->page,
+				     frag->page_offset, frag->size,
+				     PCI_DMA_TODEVICE);
+		TRACE3("%Lx, %u", sg_element->address, sg_element->length);
+	}
+	oob_data->ext.info[ScatterGatherListPacketInfo] = sg_list;
+	return 0;
+}
+
+static void free_tx_sg_list(struct ndis_device *wnd,
+			    struct ndis_packet_oob_data *oob_data)
+{
+	int i;
+	struct ndis_sg_element *sg_element;
+	struct ndis_sg_list *sg_list =
+		oob_data->ext.info[ScatterGatherListPacketInfo];
+	sg_element = sg_list->elements;
+	TRACE3("%p, %d", sg_list, sg_list->nent);
+	PCI_DMA_UNMAP_SINGLE(wnd->wd->pci.pdev, sg_element->address,
+			     sg_element->length, PCI_DMA_TODEVICE);
+	if (sg_list->nent == 1)
+		EXIT3(return);
+	for (i = 1; i < sg_list->nent; i++, sg_element++) {
+		TRACE3("%Lx, %u", sg_element->address, sg_element->length);
+		pci_unmap_page(wnd->wd->pci.pdev, sg_element->address,
+			       sg_element->length, PCI_DMA_TODEVICE);
+	}
+	TRACE3("%p", sg_list);
+	kfree(sg_list);
+}
+
+static struct ndis_packet *alloc_tx_packet(struct ndis_device *wnd,
+					   struct sk_buff *skb)
+{
+	struct ndis_packet *packet;
+	ndis_buffer *buffer;
+	struct ndis_packet_oob_data *oob_data;
+	NDIS_STATUS status;
+
+	NdisAllocatePacket(&status, &packet, wnd->tx_packet_pool);
+	if (status != NDIS_STATUS_SUCCESS)
+		return NULL;
+	NdisAllocateBuffer(&status, &buffer, wnd->tx_buffer_pool,
+			   skb->data, skb->len);
+	if (status != NDIS_STATUS_SUCCESS) {
+		NdisFreePacket(packet);
+		return NULL;
+	}
+	packet->private.buffer_head = buffer;
+	packet->private.buffer_tail = buffer;
+
+	oob_data = NDIS_PACKET_OOB_DATA(packet);
+	oob_data->tx_skb = skb;
+	if (wnd->sg_dma_size) {
+		if (setup_tx_sg_list(wnd, skb, oob_data)) {
+			NdisFreeBuffer(buffer);
+			NdisFreePacket(packet);
+			return NULL;
+		}
+	}
+	if (skb->ip_summed == CHECKSUM_PARTIAL) {
+		struct ndis_tcp_ip_checksum_packet_info csum;
+		int protocol;
+#if LINUX_VERSION_CODE > KERNEL_VERSION(2,6,21)
+		protocol = ntohs(skb->protocol);
+#else
+		protocol = skb->nh.iph->protocol;
+#endif
+		csum.value = 0;
+		csum.tx.v4 = 1;
+		if (protocol == IPPROTO_TCP)
+			csum.tx.tcp = 1;
+		else if (protocol == IPPROTO_UDP)
+			csum.tx.udp = 1;
+//		csum->tx.ip = 1;
+		packet->private.flags |= NDIS_PROTOCOL_ID_TCP_IP;
+		oob_data->ext.info[TcpIpChecksumPacketInfo] =
+			(void *)(ULONG_PTR)csum.value;
+	}
+	DBG_BLOCK(4) {
+		dump_bytes(__func__, skb->data, skb->len);
+	}
+	TRACE4("%p, %p, %p", packet, buffer, skb);
+	return packet;
+}
+
+void free_tx_packet(struct ndis_device *wnd, struct ndis_packet *packet,
+		    NDIS_STATUS status)
+{
+	ndis_buffer *buffer;
+	struct ndis_packet_oob_data *oob_data;
+	struct sk_buff *skb;
+	struct ndis_packet_pool *pool;
+
+	assert_irql(_irql_ <= DISPATCH_LEVEL);
+	assert(packet->private.packet_flags);
+	oob_data = NDIS_PACKET_OOB_DATA(packet);
+	skb = oob_data->tx_skb;
+	buffer = packet->private.buffer_head;
+	TRACE4("%p, %p, %p, %08X", packet, buffer, skb, status);
+	if (status == NDIS_STATUS_SUCCESS) {
+		pre_atomic_add(wnd->net_stats.tx_bytes, packet->private.len);
+		atomic_inc_var(wnd->net_stats.tx_packets);
+	} else {
+		TRACE1("packet dropped: %08X", status);
+		atomic_inc_var(wnd->net_stats.tx_dropped);
+	}
+	if (wnd->sg_dma_size)
+		free_tx_sg_list(wnd, oob_data);
+	NdisFreeBuffer(buffer);
+	dev_kfree_skb_any(skb);
+	pool = packet->private.pool;
+	NdisFreePacket(packet);
+	if (netif_queue_stopped(wnd->net_dev) &&
+	    ((pool->max_descr - pool->num_used_descr) >=
+	     (wnd->max_tx_packets / 4))) {
+		set_bit(NETIF_WAKEQ, &wnd->ndis_pending_work);
+		schedule_wrapndis_work(&wnd->ndis_work);
+	}
+	EXIT4(return);
+}
+
+/* MiniportSend and MiniportSendPackets */
+/* this function is called holding tx_ring_mutex. start and n are such
+ * that start + n < TX_RING_SIZE; i.e., packets don't wrap around
+ * ring */
+static u8 mp_tx_packets(struct ndis_device *wnd, u8 start, u8 n)
+{
+	NDIS_STATUS res;
+	struct miniport *mp;
+	struct ndis_packet *packet;
+	u8 sent;
+	KIRQL irql;
+
+	ENTER3("%d, %d", start, n);
+	mp = &wnd->wd->driver->ndis_driver->mp;
+	if (mp->send_packets) {
+		if (deserialized_driver(wnd)) {
+			LIN2WIN3(mp->send_packets, wnd->nmb->mp_ctx,
+				 &wnd->tx_ring[start], n);
+			sent = n;
+		} else {
+			irql = serialize_lock_irql(wnd);
+			LIN2WIN3(mp->send_packets, wnd->nmb->mp_ctx,
+				 &wnd->tx_ring[start], n);
+			serialize_unlock_irql(wnd, irql);
+			for (sent = 0; sent < n && wnd->tx_ok; sent++) {
+				struct ndis_packet_oob_data *oob_data;
+				packet = wnd->tx_ring[start + sent];
+				oob_data = NDIS_PACKET_OOB_DATA(packet);
+				switch ((res =
+					 xchg(&oob_data->status,
+					      NDIS_STATUS_NOT_RECOGNIZED))) {
+				case NDIS_STATUS_SUCCESS:
+					free_tx_packet(wnd, packet,
+						       NDIS_STATUS_SUCCESS);
+					break;
+				case NDIS_STATUS_PENDING:
+					break;
+				case NDIS_STATUS_RESOURCES:
+					wnd->tx_ok = 0;
+					/* resubmit this packet and
+					 * the rest when resources
+					 * become available */
+					sent--;
+					break;
+				case NDIS_STATUS_FAILURE:
+					free_tx_packet(wnd, packet,
+						       NDIS_STATUS_FAILURE);
+					break;
+				default:
+					ERROR("%p: invalid status: %08X",
+					      packet, res);
+					free_tx_packet(wnd, packet,
+						       oob_data->status);
+					break;
+				}
+				TRACE3("%p, %d", packet, res);
+			}
+		}
+		TRACE3("sent: %d(%d)", sent, n);
+	} else {
+		for (sent = 0; sent < n && wnd->tx_ok; sent++) {
+			struct ndis_packet_oob_data *oob_data;
+			packet = wnd->tx_ring[start + sent];
+			oob_data = NDIS_PACKET_OOB_DATA(packet);
+			oob_data->status = NDIS_STATUS_NOT_RECOGNIZED;
+			irql = serialize_lock_irql(wnd);
+			res = LIN2WIN3(mp->send, wnd->nmb->mp_ctx,
+				       packet, packet->private.flags);
+			serialize_unlock_irql(wnd, irql);
+			switch (res) {
+			case NDIS_STATUS_SUCCESS:
+				free_tx_packet(wnd, packet, res);
+				break;
+			case NDIS_STATUS_PENDING:
+				break;
+			case NDIS_STATUS_RESOURCES:
+				wnd->tx_ok = 0;
+				/* resend this packet when resources
+				 * become available */
+				sent--;
+				break;
+			case NDIS_STATUS_FAILURE:
+				free_tx_packet(wnd, packet, res);
+				break;
+			default:
+				ERROR("packet %p: invalid status: %08X",
+				      packet, res);
+				break;
+			}
+		}
+	}
+	EXIT3(return sent);
+}
+
+static void tx_worker(worker_param_t param)
+{
+	struct ndis_device *wnd;
+	s8 n;
+
+	wnd = worker_param_data(param, struct ndis_device, tx_work);
+	ENTER3("tx_ok %d", wnd->tx_ok);
+	while (wnd->tx_ok) {
+		if (down_interruptible(&wnd->tx_ring_mutex))
+			break;
+		spin_lock_bh(&wnd->tx_ring_lock);
+		n = wnd->tx_ring_end - wnd->tx_ring_start;
+		TRACE3("%d, %d, %d", wnd->tx_ring_start, wnd->tx_ring_end, n);
+		/* end == start if either ring is empty or full; in
+		 * the latter case is_tx_ring_full is set */
+		if (n == 0) {
+			if (wnd->is_tx_ring_full)
+				n = TX_RING_SIZE - wnd->tx_ring_start;
+			else {
+				spin_unlock_bh(&wnd->tx_ring_lock);
+				up(&wnd->tx_ring_mutex);
+				break;
+			}
+		} else if (n < 0)
+			n = TX_RING_SIZE - wnd->tx_ring_start;
+		spin_unlock_bh(&wnd->tx_ring_lock);
+		if (unlikely(n > wnd->max_tx_packets))
+			n = wnd->max_tx_packets;
+		n = mp_tx_packets(wnd, wnd->tx_ring_start, n);
+		if (n) {
+			wnd->net_dev->trans_start = jiffies;
+			wnd->tx_ring_start =
+				(wnd->tx_ring_start + n) % TX_RING_SIZE;
+			wnd->is_tx_ring_full = 0;
+		}
+		up(&wnd->tx_ring_mutex);
+		TRACE3("%d, %d, %d", wnd->tx_ring_start, wnd->tx_ring_end, n);
+	}
+	EXIT3(return);
+}
+
+static int tx_skbuff(struct sk_buff *skb, struct net_device *dev)
+{
+	struct ndis_device *wnd = netdev_priv(dev);
+	struct ndis_packet *packet;
+
+	packet = alloc_tx_packet(wnd, skb);
+	if (!packet) {
+		TRACE2("couldn't allocate packet");
+		netif_tx_lock(dev);
+		netif_stop_queue(dev);
+		netif_tx_unlock(dev);
+		return NETDEV_TX_BUSY;
+	}
+	spin_lock(&wnd->tx_ring_lock);
+	wnd->tx_ring[wnd->tx_ring_end++] = packet;
+	if (wnd->tx_ring_end == TX_RING_SIZE)
+		wnd->tx_ring_end = 0;
+	if (wnd->tx_ring_end == wnd->tx_ring_start) {
+		netif_tx_lock(dev);
+		wnd->is_tx_ring_full = 1;
+		netif_stop_queue(dev);
+		netif_tx_unlock(dev);
+	}
+	spin_unlock(&wnd->tx_ring_lock);
+	TRACE4("ring: %d, %d", wnd->tx_ring_start, wnd->tx_ring_end);
+	schedule_wrapndis_work(&wnd->tx_work);
+	return NETDEV_TX_OK;
+}
+
+static int set_packet_filter(struct ndis_device *wnd, ULONG packet_filter)
+{
+	NDIS_STATUS res;
+
+	while (1) {
+		res = mp_set_int(wnd, OID_GEN_CURRENT_PACKET_FILTER,
+				 packet_filter);
+		if (res == NDIS_STATUS_SUCCESS)
+			break;
+		TRACE2("couldn't set filter 0x%08x", packet_filter);
+		/* NDIS_PACKET_TYPE_PROMISCUOUS may not work with 802.11 */
+		if (packet_filter & NDIS_PACKET_TYPE_PROMISCUOUS) {
+			packet_filter &= ~NDIS_PACKET_TYPE_PROMISCUOUS;
+			continue;
+		}
+		if (packet_filter & NDIS_PACKET_TYPE_ALL_LOCAL) {
+			packet_filter &= ~NDIS_PACKET_TYPE_ALL_LOCAL;
+			continue;
+		}
+		if (packet_filter & NDIS_PACKET_TYPE_ALL_FUNCTIONAL) {
+			packet_filter &= ~NDIS_PACKET_TYPE_ALL_FUNCTIONAL;
+			continue;
+		}
+		if (packet_filter & NDIS_PACKET_TYPE_MULTICAST) {
+			packet_filter &= ~NDIS_PACKET_TYPE_MULTICAST;
+			packet_filter |= NDIS_PACKET_TYPE_ALL_MULTICAST;
+			continue;
+		}
+		if (packet_filter & NDIS_PACKET_TYPE_ALL_MULTICAST) {
+			packet_filter &= ~NDIS_PACKET_TYPE_ALL_MULTICAST;
+			continue;
+		}
+		break;
+	}
+
+	wnd->packet_filter = packet_filter;
+	res = mp_query_int(wnd, OID_GEN_CURRENT_PACKET_FILTER, &packet_filter);
+	if (packet_filter != wnd->packet_filter) {
+		WARNING("filter not set: 0x%08x, 0x%08x",
+			packet_filter, wnd->packet_filter);
+		wnd->packet_filter = packet_filter;
+	}
+	if (wnd->packet_filter)
+		EXIT3(return 0);
+	else
+		EXIT3(return -1);
+}
+
+void set_media_state(struct ndis_device *wnd, enum ndis_media_state state)
+{
+	ENTER2("state: 0x%x", state);
+	if (state == NdisMediaStateConnected) {
+		netif_carrier_on(wnd->net_dev);
+		wnd->tx_ok = 1;
+		if (netif_queue_stopped(wnd->net_dev))
+			netif_wake_queue(wnd->net_dev);
+		if (wnd->physical_medium == NdisPhysicalMediumWirelessLan) {
+			set_bit(LINK_STATUS_ON, &wnd->ndis_pending_work);
+			schedule_wrapndis_work(&wnd->ndis_work);
+		}
+	} else if (state == NdisMediaStateDisconnected) {
+		netif_carrier_off(wnd->net_dev);
+		netif_stop_queue(wnd->net_dev);
+		wnd->tx_ok = 0;
+		if (wnd->physical_medium == NdisPhysicalMediumWirelessLan) {
+			memset(&wnd->essid, 0, sizeof(wnd->essid));
+			set_bit(LINK_STATUS_OFF, &wnd->ndis_pending_work);
+			schedule_wrapndis_work(&wnd->ndis_work);
+		}
+	} else {
+		WARNING("invalid media state: 0x%x", state);
+	}
+}
+
+static int ndis_net_dev_open(struct net_device *net_dev)
+{
+	ENTER1("%p", netdev_priv(net_dev));
+	netif_start_queue(net_dev);
+	netif_poll_enable(net_dev);
+	EXIT1(return 0);
+}
+
+static int ndis_net_dev_close(struct net_device *net_dev)
+{
+	ENTER1("%p", netdev_priv(net_dev));
+	netif_poll_disable(net_dev);
+	netif_tx_disable(net_dev);
+	EXIT1(return 0);
+}
+
+static int ndis_change_mtu(struct net_device *net_dev, int mtu)
+{
+	struct ndis_device *wnd = netdev_priv(net_dev);
+	int max;
+
+	if (mtu < ETH_ZLEN)
+		return -EINVAL;
+	if (mp_query_int(wnd, OID_GEN_MAXIMUM_TOTAL_SIZE, &max) !=
+	    NDIS_STATUS_SUCCESS)
+		return -EOPNOTSUPP;
+	TRACE1("%d", max);
+	max -= ETH_HLEN;
+	if (max <= ETH_ZLEN)
+		return -EINVAL;
+	if (mtu + ETH_HLEN > max)
+		return -EINVAL;
+	net_dev->mtu = mtu;
+	return 0;
+}
+
+#ifdef CONFIG_NET_POLL_CONTROLLER
+static void ndis_poll_controller(struct net_device *dev)
+{
+	struct ndis_device *wnd = netdev_priv(dev);
+
+	disable_irq(dev->irq);
+	ndis_isr(wnd->mp_interrupt->kinterrupt, wnd->mp_interrupt);
+	enable_irq(dev->irq);
+}
+#endif
+
+/* called from BH context */
+static struct net_device_stats *ndis_get_stats(struct net_device *dev)
+{
+	struct ndis_device *wnd = netdev_priv(dev);
+	return &wnd->net_stats;
+}
+
+/* called from BH context */
+static void ndis_set_multicast_list(struct net_device *dev)
+{
+	struct ndis_device *wnd = netdev_priv(dev);
+	set_bit(SET_MULTICAST_LIST, &wnd->ndis_pending_work);
+	schedule_wrapndis_work(&wnd->ndis_work);
+}
+
+/* called from BH context */
+struct iw_statistics *get_iw_stats(struct net_device *dev)
+{
+	struct ndis_device *wnd = netdev_priv(dev);
+	return &wnd->iw_stats;
+}
+
+static void update_iw_stats(struct ndis_device *wnd)
+{
+	struct iw_statistics *iw_stats = &wnd->iw_stats;
+	struct ndis_wireless_stats ndis_stats;
+	NDIS_STATUS res;
+	ndis_rssi rssi;
+	int qual;
+
+	ENTER2("%p", wnd);
+	if (wnd->iw_stats_enabled == FALSE || !netif_carrier_ok(wnd->net_dev)) {
+		memset(iw_stats, 0, sizeof(*iw_stats));
+		EXIT2(return);
+	}
+	res = mp_query(wnd, OID_802_11_RSSI, &rssi, sizeof(rssi));
+	if (res == NDIS_STATUS_SUCCESS)
+		iw_stats->qual.level = rssi;
+
+	qual = 100 * (rssi - WL_NOISE) / (WL_SIGMAX - WL_NOISE);
+	if (qual < 0)
+		qual = 0;
+	else if (qual > 100)
+		qual = 100;
+
+	iw_stats->qual.noise = WL_NOISE;
+	iw_stats->qual.qual  = qual;
+
+	res = mp_query(wnd, OID_802_11_STATISTICS,
+		       &ndis_stats, sizeof(ndis_stats));
+	if (res != NDIS_STATUS_SUCCESS)
+		EXIT2(return);
+	iw_stats->discard.retries = (unsigned long)ndis_stats.retry +
+		(unsigned long)ndis_stats.multi_retry;
+	iw_stats->discard.misc = (unsigned long)ndis_stats.fcs_err +
+		(unsigned long)ndis_stats.rtss_fail +
+		(unsigned long)ndis_stats.ack_fail +
+		(unsigned long)ndis_stats.frame_dup;
+
+	EXIT2(return);
+}
+
+static void set_multicast_list(struct ndis_device *wnd)
+{
+	struct net_device *net_dev;
+	ULONG packet_filter;
+	NDIS_STATUS res;
+
+	net_dev = wnd->net_dev;
+	packet_filter = wnd->packet_filter;
+
+	TRACE2("0x%08x", packet_filter);
+	if (net_dev->flags & IFF_PROMISC) {
+		packet_filter |= NDIS_PACKET_TYPE_PROMISCUOUS |
+			NDIS_PACKET_TYPE_ALL_LOCAL;
+	} else if (net_dev->flags & IFF_ALLMULTI ||
+		   net_dev->mc_count > wnd->multicast_size) {
+		packet_filter |= NDIS_PACKET_TYPE_ALL_MULTICAST;
+		TRACE2("0x%08x", packet_filter);
+	} else if (net_dev->mc_count > 0) {
+		int i, size;
+		char *buf;
+		struct dev_mc_list *mclist;
+		size = min(wnd->multicast_size, net_dev->mc_count);
+		TRACE2("%d, %d", wnd->multicast_size, net_dev->mc_count);
+		buf = kmalloc(size * ETH_ALEN, GFP_KERNEL);
+		if (!buf) {
+			WARNING("couldn't allocate memory");
+			EXIT2(return);
+		}
+		mclist = net_dev->mc_list;
+		for (i = 0; i < size && mclist; mclist = mclist->next) {
+			if (mclist->dmi_addrlen != ETH_ALEN)
+				continue;
+			memcpy(buf + i * ETH_ALEN, mclist->dmi_addr, ETH_ALEN);
+			TRACE2(MACSTRSEP, MAC2STR(mclist->dmi_addr));
+			i++;
+		}
+		res = mp_set(wnd, OID_802_3_MULTICAST_LIST, buf, i * ETH_ALEN);
+		if (res == NDIS_STATUS_SUCCESS && i > 0)
+			packet_filter |= NDIS_PACKET_TYPE_MULTICAST;
+		else
+			packet_filter |= NDIS_PACKET_TYPE_ALL_MULTICAST;
+		kfree(buf);
+	}
+	TRACE2("0x%08x", packet_filter);
+	res = set_packet_filter(wnd, packet_filter);
+	if (res)
+		TRACE1("couldn't set packet filter (%08X)", res);
+	EXIT2(return);
+}
+
+static void link_status_off(struct ndis_device *wnd)
+{
+#ifdef CONFIG_WIRELESS_EXT
+	union iwreq_data wrqu;
+
+	memset(&wrqu, 0, sizeof(wrqu));
+	wrqu.ap_addr.sa_family = ARPHRD_ETHER;
+	wireless_send_event(wnd->net_dev, SIOCGIWAP, &wrqu, NULL);
+#endif
+	EXIT2(return);
+}
+
+static void link_status_on(struct ndis_device *wnd)
+{
+#ifdef CONFIG_WIRELESS_EXT
+	struct ndis_assoc_info *ndis_assoc_info;
+	union iwreq_data wrqu;
+	NDIS_STATUS res;
+	const int assoc_size = sizeof(*ndis_assoc_info) + IW_CUSTOM_MAX + 32;
+#endif
+
+	ENTER2("");
+#ifdef CONFIG_WIRELESS_EXT
+	memset(&wrqu, 0, sizeof(wrqu));
+	ndis_assoc_info = kzalloc(assoc_size, GFP_KERNEL);
+	if (!ndis_assoc_info) {
+		ERROR("couldn't allocate memory");
+		goto send_assoc_event;
+	}
+	res = mp_query(wnd, OID_802_11_ASSOCIATION_INFORMATION,
+		       ndis_assoc_info, assoc_size);
+	if (res) {
+		TRACE2("query assoc_info failed (%08X)", res);
+		kfree(ndis_assoc_info);
+		goto send_assoc_event;
+	}
+	TRACE2("%u, 0x%x, %u, 0x%x, %u", ndis_assoc_info->length,
+	       ndis_assoc_info->req_ies, ndis_assoc_info->req_ie_length,
+	       ndis_assoc_info->resp_ies, ndis_assoc_info->resp_ie_length);
+	if (ndis_assoc_info->req_ie_length > 0) {
+		wrqu.data.length = ndis_assoc_info->req_ie_length;
+		wireless_send_event(wnd->net_dev, IWEVASSOCREQIE, &wrqu,
+				    ((char *)ndis_assoc_info) +
+				    ndis_assoc_info->offset_req_ies);
+	}
+	if (ndis_assoc_info->resp_ie_length > 0) {
+		wrqu.data.length = ndis_assoc_info->resp_ie_length;
+		wireless_send_event(wnd->net_dev, IWEVASSOCRESPIE, &wrqu,
+				    ((char *)ndis_assoc_info) +
+				    ndis_assoc_info->offset_resp_ies);
+	}
+	kfree(ndis_assoc_info);
+
+send_assoc_event:
+	get_ap_address(wnd, wrqu.ap_addr.sa_data);
+	wrqu.ap_addr.sa_family = ARPHRD_ETHER;
+	TRACE2(MACSTRSEP, MAC2STR(wrqu.ap_addr.sa_data));
+	wireless_send_event(wnd->net_dev, SIOCGIWAP, &wrqu, NULL);
+#endif
+	EXIT2(return);
+}
+
+static void iw_stats_timer_proc(unsigned long data)
+{
+	struct ndis_device *wnd = (struct ndis_device *)data;
+
+	ENTER2("%d", wnd->iw_stats_interval);
+	if (wnd->iw_stats_interval > 0) {
+		set_bit(COLLECT_IW_STATS, &wnd->ndis_pending_work);
+		schedule_wrapndis_work(&wnd->ndis_work);
+	}
+	mod_timer(&wnd->iw_stats_timer, jiffies + wnd->iw_stats_interval);
+}
+
+static void add_iw_stats_timer(struct ndis_device *wnd)
+{
+	if (wnd->physical_medium != NdisPhysicalMediumWirelessLan)
+		return;
+	if (wnd->iw_stats_interval < 0)
+		wnd->iw_stats_interval *= -1;
+	wnd->iw_stats_timer.data = (unsigned long)wnd;
+	wnd->iw_stats_timer.function = iw_stats_timer_proc;
+	mod_timer(&wnd->iw_stats_timer, jiffies + wnd->iw_stats_interval);
+}
+
+static void del_iw_stats_timer(struct ndis_device *wnd)
+{
+	ENTER2("%d", wnd->iw_stats_interval);
+	wnd->iw_stats_interval *= -1;
+	del_timer_sync(&wnd->iw_stats_timer);
+	EXIT2(return);
+}
+
+static void hangcheck_proc(unsigned long data)
+{
+	struct ndis_device *wnd = (struct ndis_device *)data;
+
+	ENTER3("%d", wnd->hangcheck_interval);
+	if (wnd->hangcheck_interval > 0) {
+		set_bit(HANGCHECK, &wnd->ndis_pending_work);
+		schedule_wrapndis_work(&wnd->ndis_work);
+	}
+	mod_timer(&wnd->hangcheck_timer, jiffies + wnd->hangcheck_interval);
+	EXIT3(return);
+}
+
+void hangcheck_add(struct ndis_device *wnd)
+{
+	if (!wnd->wd->driver->ndis_driver->mp.hangcheck ||
+	    hangcheck_interval < 0)
+		EXIT2(return);
+
+	if (hangcheck_interval > 0)
+		wnd->hangcheck_interval = hangcheck_interval * HZ;
+	if (wnd->hangcheck_interval < 0)
+		wnd->hangcheck_interval *= -1;
+	wnd->hangcheck_timer.data = (unsigned long)wnd;
+	wnd->hangcheck_timer.function = hangcheck_proc;
+	mod_timer(&wnd->hangcheck_timer, jiffies + wnd->hangcheck_interval);
+	EXIT2(return);
+}
+
+void hangcheck_del(struct ndis_device *wnd)
+{
+	ENTER2("%d", wnd->hangcheck_interval);
+	if (wnd->hangcheck_interval > 0)
+		wnd->hangcheck_interval *= -1;
+	del_timer_sync(&wnd->hangcheck_timer);
+	EXIT2(return);
+}
+
+/* worker procedure to take care of setting/checking various states */
+static void ndis_worker(worker_param_t param)
+{
+	struct ndis_device *wnd;
+
+	wnd = worker_param_data(param, struct ndis_device, ndis_work);
+	WORKTRACE("0x%lx", wnd->ndis_pending_work);
+
+	if (test_and_clear_bit(NETIF_WAKEQ, &wnd->ndis_pending_work)) {
+		netif_tx_lock_bh(wnd->net_dev);
+		netif_wake_queue(wnd->net_dev);
+		netif_tx_unlock_bh(wnd->net_dev);
+	}
+
+	if (test_and_clear_bit(LINK_STATUS_OFF, &wnd->ndis_pending_work))
+		link_status_off(wnd);
+
+	if (test_and_clear_bit(LINK_STATUS_ON, &wnd->ndis_pending_work))
+		link_status_on(wnd);
+
+	if (test_and_clear_bit(COLLECT_IW_STATS, &wnd->ndis_pending_work))
+		update_iw_stats(wnd);
+
+	if (test_and_clear_bit(SET_MULTICAST_LIST,
+			       &wnd->ndis_pending_work))
+		set_multicast_list(wnd);
+
+	if (test_and_clear_bit(HANGCHECK, &wnd->ndis_pending_work)) {
+		struct miniport *mp;
+		BOOLEAN reset;
+		KIRQL irql;
+
+		mp = &wnd->wd->driver->ndis_driver->mp;
+		irql = serialize_lock_irql(wnd);
+		reset = LIN2WIN1(mp->hangcheck, wnd->nmb->mp_ctx);
+		serialize_unlock_irql(wnd, irql);
+		if (reset) {
+			TRACE2("%s needs reset", wnd->net_dev->name);
+			mp_reset(wnd);
+		}
+	}
+	WORKEXIT(return);
+}
+
+NDIS_STATUS ndis_reinit(struct ndis_device *wnd)
+{
+	NDIS_STATUS status;
+
+	wnd->attributes &= ~NDIS_ATTRIBUTE_NO_HALT_ON_SUSPEND;
+	status = mp_set_power_state(wnd, NdisDeviceStateD3);
+	if (status != NDIS_STATUS_SUCCESS) {
+		ERROR("halting device %s failed: %08X", wnd->net_dev->name,
+		      status);
+		return status;
+	}
+	status = mp_set_power_state(wnd, NdisDeviceStateD0);
+	if (status != NDIS_STATUS_SUCCESS)
+		ERROR("starting device %s failed: %08X", wnd->net_dev->name,
+		      status);
+	return status;
+}
+
+static void get_encryption_capa(struct ndis_device *wnd, char *buf,
+				const int buf_len)
+{
+	int i, mode;
+	NDIS_STATUS res;
+	struct ndis_assoc_info ndis_assoc_info;
+	struct ndis_add_key ndis_key;
+	struct ndis_capability *c;
+
+	ENTER1("%p", wnd);
+	/* set network type to g, b, or a, in that order */
+	res = mp_query(wnd, OID_802_11_NETWORK_TYPES_SUPPORTED, buf, buf_len);
+	if (res == NDIS_STATUS_SUCCESS) {
+		struct network_type_list *net_types;
+		unsigned long types = 0;
+		net_types = (typeof(net_types))buf;
+		for (i = 0; i < net_types->num; i++) {
+			TRACE2("%d", net_types->types[i]);
+			set_bit(net_types->types[i], &types);
+		}
+		if (types & Ndis802_11OFDM24)
+			mode = Ndis802_11OFDM24;
+		else if (types & Ndis802_11DS)
+			mode = Ndis802_11DS;
+		else if (types & Ndis802_11OFDM5)
+			mode = Ndis802_11OFDM5;
+		else
+			mode = Ndis802_11DS;
+		mp_set_int(wnd, OID_802_11_NETWORK_TYPE_IN_USE, mode);
+	}
+	/* check if WEP is supported */
+	if (set_iw_encr_mode(wnd, IW_AUTH_CIPHER_WEP104,
+			     IW_AUTH_CIPHER_NONE) == 0 &&
+	    get_ndis_encr_mode(wnd) == Ndis802_11Encryption1KeyAbsent)
+		set_bit(Ndis802_11Encryption1Enabled, &wnd->capa.encr);
+
+	/* check if WPA is supported */
+	if (set_ndis_auth_mode(wnd, Ndis802_11AuthModeWPA) == 0 &&
+	    get_ndis_auth_mode(wnd) == Ndis802_11AuthModeWPA)
+		set_bit(Ndis802_11AuthModeWPA, &wnd->capa.encr);
+	else
+		EXIT1(return);
+
+	if (set_ndis_auth_mode(wnd, Ndis802_11AuthModeWPAPSK) == 0 &&
+	    get_ndis_auth_mode(wnd) == Ndis802_11AuthModeWPAPSK)
+		set_bit(Ndis802_11AuthModeWPAPSK, &wnd->capa.encr);
+
+	/* check for highest encryption */
+	mode = 0;
+	if (set_iw_encr_mode(wnd, IW_AUTH_CIPHER_CCMP,
+			     IW_AUTH_CIPHER_NONE) == 0 &&
+	    (i = get_ndis_encr_mode(wnd)) > 0 &&
+	    (i == Ndis802_11Encryption3KeyAbsent ||
+	     i == Ndis802_11Encryption3Enabled))
+		mode = Ndis802_11Encryption3Enabled;
+	else if (set_iw_encr_mode(wnd, IW_AUTH_CIPHER_TKIP,
+				  IW_AUTH_CIPHER_NONE) == 0 &&
+		 (i = get_ndis_encr_mode(wnd)) > 0 &&
+		 (i == Ndis802_11Encryption2KeyAbsent ||
+		  i == Ndis802_11Encryption2Enabled))
+		mode = Ndis802_11Encryption2Enabled;
+	else if (set_iw_encr_mode(wnd, IW_AUTH_CIPHER_WEP104,
+				  IW_AUTH_CIPHER_NONE) == 0 &&
+		 (i = get_ndis_encr_mode(wnd)) > 0 &&
+		 (i == Ndis802_11Encryption1KeyAbsent ||
+		  i == Ndis802_11Encryption1Enabled))
+		mode = Ndis802_11Encryption1Enabled;
+
+	TRACE1("mode: %d", mode);
+	if (mode == 0)
+		EXIT1(return);
+	set_bit(Ndis802_11Encryption1Enabled, &wnd->capa.encr);
+	if (mode == Ndis802_11Encryption1Enabled)
+		EXIT1(return);
+
+	ndis_key.length = 32;
+	ndis_key.index = 0xC0000001;
+	ndis_key.struct_size = sizeof(ndis_key);
+	res = mp_set(wnd, OID_802_11_ADD_KEY, &ndis_key, ndis_key.struct_size);
+	TRACE2("%08X, %lu", res, (unsigned long)sizeof(ndis_key));
+	if (res && res != NDIS_STATUS_INVALID_DATA)
+		EXIT1(return);
+	res = mp_query(wnd, OID_802_11_ASSOCIATION_INFORMATION,
+		       &ndis_assoc_info, sizeof(ndis_assoc_info));
+	TRACE1("%08X", res);
+	if (res == NDIS_STATUS_NOT_SUPPORTED)
+		EXIT1(return);
+
+	set_bit(Ndis802_11Encryption2Enabled, &wnd->capa.encr);
+	if (mode == Ndis802_11Encryption3Enabled)
+		set_bit(Ndis802_11Encryption3Enabled, &wnd->capa.encr);
+	/* not all drivers support OID_802_11_CAPABILITY, so we don't
+	 * know for sure if driver support WPA or WPAPSK; assume
+	 * WPAPSK */
+	set_bit(Ndis802_11AuthModeWPAPSK, &wnd->capa.auth);
+	wnd->max_pmkids = 1;
+
+	memset(buf, 0, buf_len);
+	c = (struct ndis_capability *)buf;
+	res = mp_query(wnd, OID_802_11_CAPABILITY, buf, buf_len);
+	if (!(res == NDIS_STATUS_SUCCESS && c->version == 2))
+		EXIT1(return);
+	wnd->max_pmkids = c->num_PMKIDs;
+
+	for (i = 0; i < c->num_auth_encr_pair; i++) {
+		struct ndis_auth_encr_pair *ae;
+
+		ae = &c->auth_encr_pair[i];
+		if ((char *)(ae + 1) > buf + buf_len)
+			break;
+		switch (ae->auth_mode) {
+		case Ndis802_11AuthModeOpen:
+		case Ndis802_11AuthModeShared:
+		case Ndis802_11AuthModeWPA:
+		case Ndis802_11AuthModeWPAPSK:
+		case Ndis802_11AuthModeWPANone:
+		case Ndis802_11AuthModeWPA2:
+		case Ndis802_11AuthModeWPA2PSK:
+			set_bit(ae->auth_mode, &wnd->capa.auth);
+			break;
+		default:
+			WARNING("unknown auth_mode: %d", ae->auth_mode);
+			break;
+		}
+		switch (ae->encr_mode) {
+		case Ndis802_11EncryptionDisabled:
+		case Ndis802_11Encryption1Enabled:
+		case Ndis802_11Encryption2Enabled:
+		case Ndis802_11Encryption3Enabled:
+			set_bit(ae->encr_mode, &wnd->capa.encr);
+			break;
+		default:
+			WARNING("unknown encr_mode: %d", ae->encr_mode);
+			break;
+		}
+	}
+	EXIT1(return);
+}
+
+wstdcall NTSTATUS NdisDispatchDeviceControl(struct device_object *fdo,
+					    struct irp *irp)
+{
+	struct ndis_device *wnd;
+
+	TRACE3("fdo: %p", fdo);
+	/* for now, we don't have anything intresting here, so pass it
+	 * down to bus driver */
+	wnd = fdo->reserved;
+	return IoPassIrpDown(wnd->nmb->pdo, irp);
+}
+WIN_FUNC_DECL(NdisDispatchDeviceControl,2)
+
+wstdcall NTSTATUS NdisDispatchPower(struct device_object *fdo, struct irp *irp)
+{
+	struct io_stack_location *irp_sl;
+	struct ndis_device *wnd;
+	enum ndis_power_state state;
+	NTSTATUS status;
+	NDIS_STATUS ndis_status;
+
+	irp_sl = IoGetCurrentIrpStackLocation(irp);
+	wnd = fdo->reserved;
+	IOTRACE("fdo: %p, fn: %d:%d, wnd: %p", fdo, irp_sl->major_fn,
+		irp_sl->minor_fn, wnd);
+	if ((irp_sl->params.power.type == SystemPowerState &&
+	     irp_sl->params.power.state.system_state > PowerSystemWorking) ||
+	    (irp_sl->params.power.type == DevicePowerState &&
+	     irp_sl->params.power.state.device_state > PowerDeviceD0))
+		state = NdisDeviceStateD3;
+	else
+		state = NdisDeviceStateD0;
+	switch (irp_sl->minor_fn) {
+	case IRP_MN_SET_POWER:
+		if (state == NdisDeviceStateD0) {
+			status = IoSyncForwardIrp(wnd->nmb->pdo, irp);
+			if (status != STATUS_SUCCESS)
+				break;
+			ndis_status = mp_set_power_state(wnd, state);
+			if (ndis_status != NDIS_STATUS_SUCCESS)
+				WARNING("couldn't set power to %d: %08X",
+					state, ndis_status);
+			TRACE2("%s: device resumed", wnd->net_dev->name);
+			irp->io_status.status = status = STATUS_SUCCESS;
+			IoCompleteRequest(irp, IO_NO_INCREMENT);
+			break;
+		} else {
+			ndis_status = mp_set_power_state(wnd, state);
+			/* TODO: handle error case */
+			if (ndis_status != NDIS_STATUS_SUCCESS)
+				WARNING("setting power to %d failed: %08X",
+					state, ndis_status);
+			status = IoAsyncForwardIrp(wnd->nmb->pdo, irp);
+		}
+		break;
+	case IRP_MN_QUERY_POWER:
+		if (wnd->attributes & NDIS_ATTRIBUTE_NO_HALT_ON_SUSPEND) {
+			ndis_status = mp_query(wnd, OID_PNP_QUERY_POWER,
+					       &state, sizeof(state));
+			TRACE2("%d, %08X", state, ndis_status);
+			/* this OID must always succeed */
+			if (ndis_status != NDIS_STATUS_SUCCESS)
+				TRACE1("query power returns %08X", ndis_status);
+			irp->io_status.status = STATUS_SUCCESS;
+		} else
+			irp->io_status.status = STATUS_SUCCESS;
+		status = IoPassIrpDown(wnd->nmb->pdo, irp);
+		break;
+	case IRP_MN_WAIT_WAKE:
+	case IRP_MN_POWER_SEQUENCE:
+		/* TODO: implement WAIT_WAKE */
+		status = IoPassIrpDown(wnd->nmb->pdo, irp);
+		break;
+	default:
+		status = IoPassIrpDown(wnd->nmb->pdo, irp);
+		break;
+	}
+	IOEXIT(return status);
+}
+WIN_FUNC_DECL(NdisDispatchPower,2)
+
+wstdcall NTSTATUS NdisDispatchPnp(struct device_object *fdo, struct irp *irp)
+{
+	struct io_stack_location *irp_sl;
+	struct ndis_device *wnd;
+	struct device_object *pdo;
+	NTSTATUS status;
+
+	IOTRACE("fdo: %p, irp: %p", fdo, irp);
+	irp_sl = IoGetCurrentIrpStackLocation(irp);
+	wnd = fdo->reserved;
+	pdo = wnd->nmb->pdo;
+	switch (irp_sl->minor_fn) {
+	case IRP_MN_START_DEVICE:
+		status = IoSyncForwardIrp(pdo, irp);
+		if (status != STATUS_SUCCESS)
+			break;
+		if (ndis_start_device(wnd) == NDIS_STATUS_SUCCESS)
+			status = STATUS_SUCCESS;
+		else
+			status = STATUS_FAILURE;
+		irp->io_status.status = status;
+		IoCompleteRequest(irp, IO_NO_INCREMENT);
+		break;
+	case IRP_MN_QUERY_STOP_DEVICE:
+		/* TODO: implement in NDIS */
+		status = IoPassIrpDown(wnd->nmb->pdo, irp);
+		break;
+	case IRP_MN_STOP_DEVICE:
+		mp_halt(wnd);
+		irp->io_status.status = STATUS_SUCCESS;
+		status = IoAsyncForwardIrp(pdo, irp);
+		break;
+	case IRP_MN_REMOVE_DEVICE:
+		TRACE1("%s", wnd->net_dev->name);
+		mp_pnp_event(wnd, NdisDevicePnPEventSurpriseRemoved, 0);
+		if (ndis_remove_device(wnd)) {
+			status = STATUS_FAILURE;
+			break;
+		}
+		/* wnd is already freed */
+		status = IoAsyncForwardIrp(pdo, irp);
+		IoDetachDevice(fdo);
+		IoDeleteDevice(fdo);
+		break;
+	default:
+		status = IoAsyncForwardIrp(pdo, irp);
+		break;
+	}
+	IOTRACE("status: %08X", status);
+	IOEXIT(return status);
+}
+WIN_FUNC_DECL(NdisDispatchPnp,2)
+
+static void set_task_offload(struct ndis_device *wnd, void *buf,
+			     const int buf_size)
+{
+	struct ndis_task_offload_header *task_offload_header;
+	struct ndis_task_offload *task_offload;
+	struct ndis_task_tcp_ip_checksum *csum = NULL;
+	struct ndis_task_tcp_large_send *tso = NULL;
+	NDIS_STATUS status;
+
+	memset(buf, 0, buf_size);
+	task_offload_header = buf;
+	task_offload_header->version = NDIS_TASK_OFFLOAD_VERSION;
+	task_offload_header->size = sizeof(*task_offload_header);
+	task_offload_header->encap_format.flags.fixed_header_size = 1;
+	task_offload_header->encap_format.header_size = sizeof(struct ethhdr);
+	task_offload_header->encap_format.encap = IEEE_802_3_Encapsulation;
+	status = mp_query(wnd, OID_TCP_TASK_OFFLOAD, buf, buf_size);
+	TRACE1("%08X", status);
+	if (status != NDIS_STATUS_SUCCESS)
+		EXIT1(return);
+	if (task_offload_header->offset_first_task == 0)
+		EXIT1(return);
+	task_offload = ((void *)task_offload_header +
+			task_offload_header->offset_first_task);
+	while (1) {
+		TRACE1("%d, %d", task_offload->version, task_offload->task);
+		switch(task_offload->task) {
+		case TcpIpChecksumNdisTask:
+			csum = (void *)task_offload->task_buf;
+			break;
+		case TcpLargeSendNdisTask:
+			tso = (void *)task_offload->task_buf;
+			break;
+		default:
+			TRACE1("%d", task_offload->task);
+			break;
+		}
+		if (task_offload->offset_next_task == 0)
+			break;
+		task_offload = (void *)task_offload +
+			task_offload->offset_next_task;
+	}
+	if (tso)
+		TRACE1("%u, %u, %d, %d", tso->max_size, tso->min_seg_count,
+		       tso->tcp_opts, tso->ip_opts);
+	if (!csum)
+		EXIT1(return);
+	TRACE1("%08x, %08x", csum->v4_tx.value, csum->v4_rx.value);
+	task_offload_header->encap_format.flags.fixed_header_size = 1;
+	task_offload_header->encap_format.header_size = sizeof(struct ethhdr);
+	task_offload_header->offset_first_task = sizeof(*task_offload_header);
+	task_offload = ((void *)task_offload_header +
+			task_offload_header->offset_first_task);
+	task_offload->offset_next_task = 0;
+	task_offload->size = sizeof(*task_offload);
+	task_offload->task = TcpIpChecksumNdisTask;
+	memcpy(task_offload->task_buf, csum, sizeof(*csum));
+	task_offload->task_buf_length = sizeof(*csum);
+	status = mp_set(wnd, OID_TCP_TASK_OFFLOAD, task_offload_header,
+			sizeof(*task_offload_header) +
+			sizeof(*task_offload) + sizeof(*csum));
+	TRACE1("%08X", status);
+	if (status != NDIS_STATUS_SUCCESS)
+		EXIT2(return);
+	wnd->tx_csum = csum->v4_tx;
+	if (csum->v4_tx.tcp_csum && csum->v4_tx.udp_csum) {
+		if (csum->v4_tx.ip_csum) {
+			wnd->net_dev->features |= NETIF_F_HW_CSUM;
+			TRACE1("hw checksum enabled");
+		} else {
+			wnd->net_dev->features |= NETIF_F_IP_CSUM;
+			TRACE1("IP checksum enabled");
+		}
+		if (wnd->sg_dma_size)
+			wnd->net_dev->features |= NETIF_F_SG;
+	}
+	wnd->rx_csum = csum->v4_rx;
+	EXIT1(return);
+}
+
+static void get_supported_oids(struct ndis_device *wnd)
+{
+	NDIS_STATUS res;
+	int i, n, needed;
+	ndis_oid *oids;
+
+	res = mp_query_info(wnd, OID_GEN_SUPPORTED_LIST, NULL, 0, NULL,
+			    &needed);
+	if (!(res == NDIS_STATUS_BUFFER_TOO_SHORT ||
+	      res == NDIS_STATUS_INVALID_LENGTH))
+		EXIT1(return);
+	oids = kmalloc(needed, GFP_KERNEL);
+	if (!oids) {
+		TRACE1("couldn't allocate memory");
+		EXIT1(return);
+	}
+	res = mp_query(wnd, OID_GEN_SUPPORTED_LIST, oids, needed);
+	if (res) {
+		TRACE1("failed: %08X", res);
+		kfree(oids);
+		EXIT1(return);
+	}
+	for (i = 0, n = needed / sizeof(*oids); i < n; i++) {
+		TRACE1("oid: %08X", oids[i]);
+		/* if a wireless device didn't say so for
+		 * OID_GEN_PHYSICAL_MEDIUM (they should, but in case) */
+		if (wnd->physical_medium != NdisPhysicalMediumWirelessLan &&
+		    oids[i] == OID_802_11_SSID)
+			wnd->physical_medium = NdisPhysicalMediumWirelessLan;
+	}
+	kfree(oids);
+	EXIT1(return);
+}
+
+static void ndis_get_drvinfo(struct net_device *dev,
+			     struct ethtool_drvinfo *info)
+{
+	struct ndis_device *wnd = netdev_priv(dev);
+	strncpy(info->driver, DRIVER_NAME, sizeof(info->driver) - 2);
+	strcat(info->driver, "+");
+	strncat(info->driver, wnd->wd->driver->name,
+		sizeof(info->driver) - strlen(DRIVER_NAME) - 1);
+	strncpy(info->version, DRIVER_VERSION, sizeof(info->version) - 2);
+	strcat(info->version, "+");
+	strncat(info->version, wnd->wd->driver->version,
+		sizeof(info->version) - strlen(DRIVER_VERSION) - 1);
+	if (wrap_is_pci_bus(wnd->wd->dev_bus))
+		strncpy(info->bus_info, pci_name(wnd->wd->pci.pdev),
+			sizeof(info->bus_info) - 1);
+#ifdef ENABLE_USB
+	else
+		usb_make_path(wnd->wd->usb.udev, info->bus_info,
+			      sizeof(info->bus_info) - 1);
+#endif
+	return;
+}
+
+static u32 ndis_get_link(struct net_device *dev)
+{
+	struct ndis_device *wnd = netdev_priv(dev);
+	return netif_carrier_ok(wnd->net_dev);
+}
+
+static void ndis_get_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
+{
+	struct ndis_device *wnd = netdev_priv(dev);
+
+	wol->supported = 0;
+	wol->wolopts = 0;
+	if (!(wnd->attributes & NDIS_ATTRIBUTE_NO_HALT_ON_SUSPEND))
+		EXIT2(return);
+	if (!wrap_is_pci_bus(wnd->wd->dev_bus))
+		EXIT2(return);
+	/* we always suspend to D3 */
+	if (wnd->pnp_capa.wakeup.min_magic_packet_wakeup < NdisDeviceStateD3)
+		return;
+	wol->supported |= WAKE_MAGIC;
+	if (wnd->ndis_wolopts & NDIS_PNP_WAKE_UP_MAGIC_PACKET)
+		wol->wolopts |= WAKE_MAGIC;
+	return;
+}
+
+static int ndis_set_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
+{
+	struct ndis_device *wnd = netdev_priv(dev);
+
+	if (!(wnd->attributes & NDIS_ATTRIBUTE_NO_HALT_ON_SUSPEND))
+		return -EOPNOTSUPP;
+	if (wnd->pnp_capa.wakeup.min_magic_packet_wakeup < NdisDeviceStateD3)
+		EXIT2(return -EOPNOTSUPP);
+	TRACE2("0x%x", wol->wolopts);
+	if (wol->wolopts & WAKE_MAGIC) {
+		wnd->ndis_wolopts |= NDIS_PNP_WAKE_UP_MAGIC_PACKET;
+		if (wol->wolopts != WAKE_MAGIC)
+			WARNING("ignored wake-on-lan options: 0x%x",
+				wol->wolopts & ~WAKE_MAGIC);
+	} else if (!wol->wolopts)
+		wnd->ndis_wolopts = 0;
+	else
+		return -EOPNOTSUPP;
+	TRACE2("0x%x", wnd->ndis_wolopts);
+	return 0;
+}
+
+static u32 ndis_get_tx_csum(struct net_device *dev)
+{
+	struct ndis_device *wnd = netdev_priv(dev);
+	if (wnd->tx_csum.tcp_csum && wnd->tx_csum.udp_csum)
+		return 1;
+	else
+		return 0;
+}
+
+static u32 ndis_get_rx_csum(struct net_device *dev)
+{
+	struct ndis_device *wnd = netdev_priv(dev);
+	if (wnd->rx_csum.value)
+		return 1;
+	else
+		return 0;
+}
+
+static int ndis_set_tx_csum(struct net_device *dev, u32 data)
+{
+	struct ndis_device *wnd = netdev_priv(dev);
+
+	if (data && (wnd->tx_csum.value == 0))
+		return -EOPNOTSUPP;
+
+	if (wnd->tx_csum.ip_csum)
+		ethtool_op_set_tx_hw_csum(dev, data);
+	else
+		ethtool_op_set_tx_csum(dev, data);
+	return 0;
+}
+
+static int ndis_set_rx_csum(struct net_device *dev, u32 data)
+{
+	struct ndis_device *wnd = netdev_priv(dev);
+
+	if (data && (wnd->tx_csum.value == 0))
+		return -EOPNOTSUPP;
+
+	/* TODO: enable/disable rx csum through NDIS */
+	return 0;
+}
+
+static u32 ndis_get_sg(struct net_device *dev)
+{
+	struct ndis_device *wnd = netdev_priv(dev);
+	if (wnd->sg_dma_size)
+		return ethtool_op_get_sg(dev);
+	else
+		return 0;
+}
+
+static int ndis_set_sg(struct net_device *dev, u32 data)
+{
+	struct ndis_device *wnd = netdev_priv(dev);
+	if (wnd->sg_dma_size)
+		return ethtool_op_set_sg(dev, data);
+	else
+		return -EOPNOTSUPP;
+}
+
+static struct ethtool_ops ndis_ethtool_ops = {
+	.get_drvinfo	= ndis_get_drvinfo,
+	.get_link	= ndis_get_link,
+	.get_wol	= ndis_get_wol,
+	.set_wol	= ndis_set_wol,
+	.get_tx_csum	= ndis_get_tx_csum,
+	.get_rx_csum	= ndis_get_rx_csum,
+	.set_tx_csum	= ndis_set_tx_csum,
+	.set_rx_csum	= ndis_set_rx_csum,
+	.get_sg		= ndis_get_sg,
+	.set_sg		= ndis_set_sg,
+};
+
+static int notifier_event(struct notifier_block *notifier, unsigned long event,
+			  void *ptr)
+{
+	struct net_device *net_dev = ptr;
+
+	ENTER2("0x%lx", event);
+	if (net_dev->ethtool_ops == &ndis_ethtool_ops
+	    && event == NETDEV_CHANGENAME) {
+		struct ndis_device *wnd = netdev_priv(net_dev);
+		/* called with rtnl lock held, so no need to lock */
+		wrap_procfs_remove_ndis_device(wnd);
+		printk(KERN_INFO "%s: changing interface name from '%s' to "
+		       "'%s'\n", DRIVER_NAME, wnd->netdev_name, net_dev->name);
+		memcpy(wnd->netdev_name, net_dev->name,
+		       sizeof(wnd->netdev_name));
+		wrap_procfs_add_ndis_device(wnd);
+	}
+	return NOTIFY_DONE;
+}
+
+static struct notifier_block netdev_notifier = {
+	.notifier_call = notifier_event,
+};
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 29)
+static const struct net_device_ops ndis_netdev_ops = {
+	.ndo_open = ndis_net_dev_open,
+	.ndo_stop = ndis_net_dev_close,
+	.ndo_start_xmit = tx_skbuff,
+	.ndo_change_mtu = ndis_change_mtu,
+	.ndo_set_multicast_list = ndis_set_multicast_list,
+	.ndo_set_mac_address = ndis_set_mac_address,
+	.ndo_get_stats = ndis_get_stats,
+#ifdef CONFIG_NET_POLL_CONTROLLER
+	.ndo_poll_controller = ndis_poll_controller,
+#endif
+};
+#endif
+
+static NDIS_STATUS ndis_start_device(struct ndis_device *wnd)
+{
+	struct wrap_device *wd;
+	struct net_device *net_dev;
+	NDIS_STATUS status;
+	char *buf;
+	const int buf_len = 256;
+	mac_address mac;
+	struct transport_header_offset *tx_header_offset;
+	int n;
+
+	ENTER2("%d", in_atomic());
+	status = mp_init(wnd);
+	if (status == NDIS_STATUS_NOT_RECOGNIZED)
+		EXIT1(return NDIS_STATUS_SUCCESS);
+	if (status != NDIS_STATUS_SUCCESS)
+		EXIT1(return status);
+	wd = wnd->wd;
+	net_dev = wnd->net_dev;
+
+	get_supported_oids(wnd);
+	memset(mac, 0, sizeof(mac));
+	status = mp_query(wnd, OID_802_3_CURRENT_ADDRESS, mac, sizeof(mac));
+	if (memcmp(mac, "\x00\x00\x00\x00\x00\x00", sizeof(mac)) == 0) {
+		status = mp_query(wnd, OID_802_3_PERMANENT_ADDRESS, mac,
+				  sizeof(mac));
+		if (status != NDIS_STATUS_SUCCESS) {
+			ERROR("couldn't get mac address: %08X", status);
+			goto err_start;
+		}
+	}
+	TRACE1("mac:" MACSTRSEP, MAC2STR(mac));
+	memcpy(net_dev->dev_addr, mac, ETH_ALEN);
+
+	strncpy(net_dev->name, if_name, IFNAMSIZ - 1);
+	net_dev->name[IFNAMSIZ - 1] = 0;
+
+	wnd->packet_filter = NDIS_PACKET_TYPE_DIRECTED |
+		NDIS_PACKET_TYPE_BROADCAST | NDIS_PACKET_TYPE_MULTICAST;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 29)
+	net_dev->netdev_ops = &ndis_netdev_ops;
+#else
+	net_dev->open = ndis_net_dev_open;
+	net_dev->hard_start_xmit = tx_skbuff;
+	net_dev->stop = ndis_net_dev_close;
+	net_dev->get_stats = ndis_get_stats;
+	net_dev->change_mtu = ndis_change_mtu;
+	net_dev->set_multicast_list = ndis_set_multicast_list;
+	net_dev->set_mac_address = ndis_set_mac_address;
+#ifdef CONFIG_NET_POLL_CONTROLLER
+	net_dev->poll_controller = ndis_poll_controller;
+#endif
+#endif
+	if (wnd->physical_medium == NdisPhysicalMediumWirelessLan) {
+		net_dev->wireless_handlers = &ndis_handler_def;
+	}
+	net_dev->ethtool_ops = &ndis_ethtool_ops;
+	if (wnd->mp_interrupt)
+		net_dev->irq = wnd->mp_interrupt->irq;
+	net_dev->mem_start = wnd->mem_start;
+	net_dev->mem_end = wnd->mem_end;
+	status = mp_query_int(wnd, OID_802_3_MAXIMUM_LIST_SIZE,
+			      &wnd->multicast_size);
+	if (status != NDIS_STATUS_SUCCESS || wnd->multicast_size < 0)
+		wnd->multicast_size = 0;
+	if (wnd->multicast_size > 0)
+		net_dev->flags |= IFF_MULTICAST;
+	else
+		net_dev->flags &= ~IFF_MULTICAST;
+
+	buf = kmalloc(buf_len, GFP_KERNEL);
+	if (!buf) {
+		WARNING("couldn't allocate memory");
+		goto err_start;
+	}
+
+	set_task_offload(wnd, buf, buf_len);
+#ifdef NETIF_F_LLTX
+	net_dev->features |= NETIF_F_LLTX;
+#endif
+
+	if (register_netdev(net_dev)) {
+		ERROR("cannot register net device %s", net_dev->name);
+		goto err_register;
+	}
+	memcpy(wnd->netdev_name, net_dev->name, sizeof(wnd->netdev_name));
+	memset(buf, 0, buf_len);
+	status = mp_query(wnd, OID_GEN_VENDOR_DESCRIPTION, buf, buf_len);
+	if (status != NDIS_STATUS_SUCCESS) {
+		WARNING("couldn't get vendor information: 0x%x", status);
+		buf[0] = 0;
+	}
+	wnd->drv_ndis_version = n = 0;
+	mp_query_int(wnd, OID_GEN_DRIVER_VERSION, &wnd->drv_ndis_version);
+	mp_query_int(wnd, OID_GEN_VENDOR_DRIVER_VERSION, &n);
+
+	printk(KERN_INFO "%s: ethernet device " MACSTRSEP " using %sNDIS "
+	       "driver: %s, version: 0x%x, NDIS version: 0x%x, vendor: '%s', "
+	       "%s\n", net_dev->name, MAC2STR(net_dev->dev_addr),
+	       deserialized_driver(wnd) ? "" : "serialized ",
+	       wnd->wd->driver->name, n, wnd->drv_ndis_version, buf,
+	       wnd->wd->conf_file_name);
+
+	if (deserialized_driver(wnd)) {
+		/* deserialized drivers don't have a limit, but we
+		 * keep max at TX_RING_SIZE */
+		wnd->max_tx_packets = TX_RING_SIZE;
+	} else {
+		status = mp_query_int(wnd, OID_GEN_MAXIMUM_SEND_PACKETS,
+				      &wnd->max_tx_packets);
+		if (status != NDIS_STATUS_SUCCESS)
+			wnd->max_tx_packets = 1;
+		if (wnd->max_tx_packets > TX_RING_SIZE)
+			wnd->max_tx_packets = TX_RING_SIZE;
+	}
+	TRACE2("maximum send packets: %d", wnd->max_tx_packets);
+	NdisAllocatePacketPoolEx(&status, &wnd->tx_packet_pool,
+				 wnd->max_tx_packets, 0,
+				 PROTOCOL_RESERVED_SIZE_IN_PACKET);
+	if (status != NDIS_STATUS_SUCCESS) {
+		ERROR("couldn't allocate packet pool");
+		goto packet_pool_err;
+	}
+	NdisAllocateBufferPool(&status, &wnd->tx_buffer_pool,
+			       wnd->max_tx_packets + 4);
+	if (status != NDIS_STATUS_SUCCESS) {
+		ERROR("couldn't allocate buffer pool");
+		goto buffer_pool_err;
+	}
+	TRACE1("pool: %p", wnd->tx_buffer_pool);
+
+	if (mp_query_int(wnd, OID_GEN_MAXIMUM_TOTAL_SIZE, &n) ==
+	    NDIS_STATUS_SUCCESS && n > ETH_HLEN)
+		ndis_change_mtu(wnd->net_dev, n - ETH_HLEN);
+
+	if (mp_query_int(wnd, OID_GEN_MAC_OPTIONS, &n) == NDIS_STATUS_SUCCESS)
+		TRACE2("mac options supported: 0x%x", n);
+
+	tx_header_offset = (typeof(tx_header_offset))buf;
+	tx_header_offset->protocol_type = NDIS_PROTOCOL_ID_TCP_IP;
+	tx_header_offset->header_offset = sizeof(ETH_HLEN);
+	status = mp_set(wnd, OID_GEN_TRANSPORT_HEADER_OFFSET,
+			tx_header_offset, sizeof(*tx_header_offset));
+	TRACE2("%08X", status);
+
+	status = mp_query_int(wnd, OID_GEN_PHYSICAL_MEDIUM,
+			      &wnd->physical_medium);
+	if (status != NDIS_STATUS_SUCCESS)
+		wnd->physical_medium = NdisPhysicalMediumUnspecified;
+
+	if (wnd->physical_medium == NdisPhysicalMediumWirelessLan) {
+		mp_set_int(wnd, OID_802_11_POWER_MODE, NDIS_POWER_OFF);
+		get_encryption_capa(wnd, buf, buf_len);
+		TRACE1("capbilities = %ld", wnd->capa.encr);
+		printk(KERN_INFO "%s: encryption modes supported: "
+		       "%s%s%s%s%s%s%s\n", net_dev->name,
+		       test_bit(Ndis802_11Encryption1Enabled, &wnd->capa.encr) ?
+		       "WEP" : "none",
+
+		       test_bit(Ndis802_11Encryption2Enabled, &wnd->capa.encr) ?
+		       "; TKIP with WPA" : "",
+		       test_bit(Ndis802_11AuthModeWPA2, &wnd->capa.auth) ?
+		       ", WPA2" : "",
+		       test_bit(Ndis802_11AuthModeWPA2PSK, &wnd->capa.auth) ?
+		       ", WPA2PSK" : "",
+
+		       test_bit(Ndis802_11Encryption3Enabled, &wnd->capa.encr) ?
+		       "; AES/CCMP with WPA" : "",
+		       test_bit(Ndis802_11AuthModeWPA2, &wnd->capa.auth) ?
+		       ", WPA2" : "",
+		       test_bit(Ndis802_11AuthModeWPA2PSK, &wnd->capa.auth) ?
+		       ", WPA2PSK" : "");
+
+		set_default_iw_params(wnd);
+	}
+	status = mp_query_int(wnd, OID_GEN_MEDIA_CONNECT_STATUS, (int *)buf);
+	if (status == NDIS_STATUS_SUCCESS)
+		set_media_state(wnd, *((int *)buf));
+	kfree(buf);
+	wrap_procfs_add_ndis_device(wnd);
+	hangcheck_add(wnd);
+	add_iw_stats_timer(wnd);
+	EXIT1(return NDIS_STATUS_SUCCESS);
+
+buffer_pool_err:
+	wnd->tx_buffer_pool = NULL;
+	if (wnd->tx_packet_pool) {
+		NdisFreePacketPool(wnd->tx_packet_pool);
+		wnd->tx_packet_pool = NULL;
+	}
+packet_pool_err:
+err_register:
+	kfree(buf);
+err_start:
+	ndis_remove_device(wnd);
+	EXIT1(return NDIS_STATUS_FAILURE);
+}
+
+static int ndis_remove_device(struct ndis_device *wnd)
+{
+	s8 tx_pending;
+
+	/* prevent setting essid during disassociation */
+	memset(&wnd->essid, 0, sizeof(wnd->essid));
+	wnd->tx_ok = 0;
+	if (wnd->max_tx_packets)
+		unregister_netdev(wnd->net_dev);
+	netif_carrier_off(wnd->net_dev);
+	/* if device is suspended, but resume failed, tx_ring_mutex
+	 * may already be locked */
+	if (down_trylock(&wnd->tx_ring_mutex))
+		WARNING("couldn't obtain tx_ring_mutex");
+	spin_lock_bh(&wnd->tx_ring_lock);
+	tx_pending = wnd->tx_ring_end - wnd->tx_ring_start;
+	if (tx_pending < 0)
+		tx_pending += TX_RING_SIZE;
+	else if (tx_pending == 0 && wnd->is_tx_ring_full)
+		tx_pending = TX_RING_SIZE - 1;
+	wnd->is_tx_ring_full = 0;
+	/* throw away pending packets */
+	while (tx_pending-- > 0) {
+		struct ndis_packet *packet;
+
+		packet = wnd->tx_ring[wnd->tx_ring_start];
+		free_tx_packet(wnd, packet, NDIS_STATUS_CLOSING);
+		wnd->tx_ring_start = (wnd->tx_ring_start + 1) % TX_RING_SIZE;
+	}
+	spin_unlock_bh(&wnd->tx_ring_lock);
+	up(&wnd->tx_ring_mutex);
+	wrap_procfs_remove_ndis_device(wnd);
+	mp_halt(wnd);
+	ndis_exit_device(wnd);
+
+	if (wnd->tx_packet_pool) {
+		NdisFreePacketPool(wnd->tx_packet_pool);
+		wnd->tx_packet_pool = NULL;
+	}
+	if (wnd->tx_buffer_pool) {
+		NdisFreeBufferPool(wnd->tx_buffer_pool);
+		wnd->tx_buffer_pool = NULL;
+	}
+	if (wnd->pmkids)
+		kfree(wnd->pmkids);
+	printk(KERN_INFO "%s: device %s removed\n", DRIVER_NAME,
+	       wnd->net_dev->name);
+	kfree(wnd->nmb);
+	free_netdev(wnd->net_dev);
+	EXIT2(return 0);
+}
+
+static wstdcall NTSTATUS NdisAddDevice(struct driver_object *drv_obj,
+				       struct device_object *pdo)
+{
+	struct device_object *fdo;
+	struct ndis_mp_block *nmb;
+	NTSTATUS status;
+	struct ndis_device *wnd;
+	struct net_device *net_dev;
+	struct wrap_device *wd;
+	unsigned long i;
+
+	ENTER2("%p, %p", drv_obj, pdo);
+	if (strlen(if_name) >= IFNAMSIZ) {
+		ERROR("interface name '%s' is too long", if_name);
+		return STATUS_INVALID_PARAMETER;
+	}
+	net_dev = alloc_etherdev(sizeof(*wnd));
+	if (!net_dev) {
+		ERROR("couldn't allocate device");
+		return STATUS_RESOURCES;
+	}
+	wd = pdo->reserved;
+	if (wrap_is_pci_bus(wd->dev_bus))
+		SET_NETDEV_DEV(net_dev, &wd->pci.pdev->dev);
+	if (wrap_is_usb_bus(wd->dev_bus))
+		SET_NETDEV_DEV(net_dev, &wd->usb.intf->dev);
+	status = IoCreateDevice(drv_obj, 0, NULL, FILE_DEVICE_UNKNOWN, 0,
+				FALSE, &fdo);
+	if (status != STATUS_SUCCESS) {
+		free_netdev(net_dev);
+		EXIT2(return status);
+	}
+	wnd = netdev_priv(net_dev);
+	TRACE1("wnd: %p", wnd);
+
+	nmb = kmalloc(sizeof(*nmb), GFP_KERNEL);
+	if (!nmb) {
+		WARNING("couldn't allocate memory");
+		IoDeleteDevice(fdo);
+		free_netdev(net_dev);
+		return STATUS_RESOURCES;
+	}
+#if defined(DEBUG) && DEBUG >= 6
+	/* poison nmb so if a driver accesses uninitialized pointers, we
+	 * know what it is */
+	for (i = 0; i < sizeof(*nmb) / sizeof(unsigned long); i++)
+		((unsigned long *)nmb)[i] = i + 0x8a3fc1;
+#endif
+
+	wnd->nmb = nmb;
+	nmb->wnd = wnd;
+	nmb->pdo = pdo;
+	wd->wnd = wnd;
+	wnd->wd = wd;
+	wnd->net_dev = net_dev;
+	fdo->reserved = wnd;
+	nmb->fdo = fdo;
+	if (ndis_init_device(wnd)) {
+		IoDeleteDevice(fdo);
+		kfree(nmb);
+		free_netdev(net_dev);
+		EXIT1(return STATUS_RESOURCES);
+	}
+	nmb->next_device = IoAttachDeviceToDeviceStack(fdo, pdo);
+	spin_lock_init(&wnd->tx_ring_lock);
+	init_MUTEX(&wnd->tx_ring_mutex);
+	init_MUTEX(&wnd->ndis_req_mutex);
+	wnd->ndis_req_done = 0;
+	initialize_work(&wnd->tx_work, tx_worker, wnd);
+	wnd->tx_ring_start = 0;
+	wnd->tx_ring_end = 0;
+	wnd->is_tx_ring_full = 0;
+	wnd->capa.encr = 0;
+	wnd->capa.auth = 0;
+	wnd->attributes = 0;
+	wnd->dma_map_count = 0;
+	wnd->dma_map_addr = NULL;
+	wnd->nick[0] = 0;
+	init_timer(&wnd->hangcheck_timer);
+	wnd->scan_timestamp = 0;
+	init_timer(&wnd->iw_stats_timer);
+	wnd->iw_stats_interval = 10 * HZ;
+	wnd->ndis_pending_work = 0;
+	memset(&wnd->essid, 0, sizeof(wnd->essid));
+	memset(&wnd->encr_info, 0, sizeof(wnd->encr_info));
+	wnd->infrastructure_mode = Ndis802_11Infrastructure;
+	initialize_work(&wnd->ndis_work, ndis_worker, wnd);
+	wnd->iw_stats_enabled = TRUE;
+
+	TRACE1("nmb: %p, pdo: %p, fdo: %p, attached: %p, next: %p",
+	       nmb, pdo, fdo, fdo->attached, nmb->next_device);
+
+	/* dispatch routines are called as Windows functions */
+	for (i = 0; i <= IRP_MJ_MAXIMUM_FUNCTION; i++)
+		drv_obj->major_func[i] = WIN_FUNC_PTR(IoPassIrpDown,2);
+
+	drv_obj->major_func[IRP_MJ_PNP] = WIN_FUNC_PTR(NdisDispatchPnp,2);
+	drv_obj->major_func[IRP_MJ_POWER] = WIN_FUNC_PTR(NdisDispatchPower,2);
+	drv_obj->major_func[IRP_MJ_INTERNAL_DEVICE_CONTROL] =
+		WIN_FUNC_PTR(NdisDispatchDeviceControl,2);
+//	drv_obj->major_func[IRP_MJ_DEVICE_CONTROL] =
+//		WIN_FUNC_PTR(NdisDispatchDeviceControl,2);
+	EXIT2(return STATUS_SUCCESS);
+}
+
+int init_ndis_driver(struct driver_object *drv_obj)
+{
+	ENTER1("%p", drv_obj);
+	drv_obj->drv_ext->add_device = NdisAddDevice;
+	return 0;
+}
+
+int wrapndis_init(void)
+{
+	wrapndis_wq = create_singlethread_workqueue("wrapndis_wq");
+	if (!wrapndis_wq)
+		EXIT1(return -ENOMEM);
+	wrapndis_worker_thread = wrap_worker_init(wrapndis_wq);
+	TRACE1("%p", wrapndis_worker_thread);
+	register_netdevice_notifier(&netdev_notifier);
+	return 0;
+}
+
+void wrapndis_exit(void)
+{
+	unregister_netdevice_notifier(&netdev_notifier);
+	if (wrapndis_wq)
+		destroy_workqueue(wrapndis_wq);
+	TRACE1("%p", wrapndis_worker_thread);
+	if (wrapndis_worker_thread)
+		ObDereferenceObject(wrapndis_worker_thread);
+}
--- linux-rt-2.6.31.orig/ubuntu/ndiswrapper/ndis.c
+++ linux-rt-2.6.31/ubuntu/ndiswrapper/ndis.c
@@ -0,0 +1,2974 @@
+/*
+ *  Copyright (C) 2003-2005 Pontus Fuchs, Giridhar Pemmasani
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ *  GNU General Public License for more details.
+ *
+ */
+
+#include "ndis.h"
+#include "iw_ndis.h"
+#include "wrapndis.h"
+#include "pnp.h"
+#include "loader.h"
+#include <linux/kernel_stat.h>
+#include <asm/dma.h>
+#include "ndis_exports.h"
+
+#define MAX_ALLOCATED_NDIS_PACKETS TX_RING_SIZE
+#define MAX_ALLOCATED_NDIS_BUFFERS TX_RING_SIZE
+
+static void ndis_worker(worker_param_t dummy);
+static work_struct_t ndis_work;
+static struct nt_list ndis_work_list;
+static spinlock_t ndis_work_list_lock;
+
+workqueue_struct_t *ndis_wq;
+static struct nt_thread *ndis_worker_thread;
+
+static void *ndis_get_routine_address(char *name);
+
+wstdcall void WIN_FUNC(NdisInitializeWrapper,4)
+	(void **driver_handle, struct driver_object *driver,
+	 struct unicode_string *reg_path, void *unused)
+{
+	ENTER1("handle: %p, driver: %p", driver_handle, driver);
+	*driver_handle = driver;
+	EXIT1(return);
+}
+
+wstdcall void WIN_FUNC(NdisTerminateWrapper,2)
+	(struct device_object *dev_obj, void *system_specific)
+{
+	EXIT1(return);
+}
+
+wstdcall NDIS_STATUS WIN_FUNC(NdisMRegisterMiniport,3)
+	(struct driver_object *drv_obj, struct miniport *mp, UINT length)
+{
+	int min_length;
+	struct wrap_driver *wrap_driver;
+	struct ndis_driver *ndis_driver;
+
+	min_length = ((char *)&mp->co_create_vc) - ((char *)mp);
+
+	ENTER1("%p %p %d", drv_obj, mp, length);
+
+	if (mp->major_version < 4) {
+		ERROR("Driver is using ndis version %d which is too old.",
+		      mp->major_version);
+		EXIT1(return NDIS_STATUS_BAD_VERSION);
+	}
+
+	if (length < min_length) {
+		ERROR("Characteristics length %d is too small", length);
+		EXIT1(return NDIS_STATUS_BAD_CHARACTERISTICS);
+	}
+
+	TRACE1("%d.%d, %d, %u", mp->major_version, mp->minor_version, length,
+	       (u32)sizeof(struct miniport));
+	wrap_driver = IoGetDriverObjectExtension(drv_obj,
+						 (void *)WRAP_DRIVER_CLIENT_ID);
+	if (!wrap_driver) {
+		ERROR("couldn't get wrap_driver");
+		EXIT1(return NDIS_STATUS_RESOURCES);
+	}
+	if (IoAllocateDriverObjectExtension(
+		    drv_obj, (void *)NDIS_DRIVER_CLIENT_ID,
+		    sizeof(*ndis_driver), (void **)&ndis_driver) !=
+	    STATUS_SUCCESS)
+		EXIT1(return NDIS_STATUS_RESOURCES);
+	wrap_driver->ndis_driver = ndis_driver;
+	TRACE1("driver: %p", ndis_driver);
+	memcpy(&ndis_driver->mp, mp, min_t(int, sizeof(*mp), length));
+
+	DBG_BLOCK(2) {
+		int i;
+		void **func;
+		char *mp_funcs[] = {
+			"queryinfo", "reconfig", "reset", "send", "setinfo",
+			"tx_data", "return_packet", "send_packets",
+			"alloc_complete", "co_create_vc", "co_delete_vc",
+			"co_activate_vc", "co_deactivate_vc",
+			"co_send_packets", "co_request", "cancel_send_packets",
+			"pnp_event_notify", "shutdown",
+		};
+		func = (void **)&ndis_driver->mp.queryinfo;
+		for (i = 0; i < (sizeof(mp_funcs) / sizeof(mp_funcs[0])); i++)
+			TRACE2("function '%s' is at %p", mp_funcs[i], func[i]);
+	}
+	EXIT1(return NDIS_STATUS_SUCCESS);
+}
+
+wstdcall NDIS_STATUS WIN_FUNC(NdisMRegisterDevice,6)
+	(struct driver_object *drv_obj, struct unicode_string *dev_name,
+	 struct unicode_string *link, void **funcs,
+	 struct device_object **dev_obj, void **dev_obj_handle)
+{
+	NTSTATUS status;
+	struct device_object *tmp;
+	int i;
+
+	ENTER1("%p, %p, %p", drv_obj, dev_name, link);
+	status = IoCreateDevice(drv_obj, 0, dev_name, FILE_DEVICE_NETWORK, 0,
+				FALSE, &tmp);
+
+	if (status != STATUS_SUCCESS)
+		EXIT1(return NDIS_STATUS_RESOURCES);
+	if (link)
+		status = IoCreateSymbolicLink(link, dev_name);
+	if (status != STATUS_SUCCESS) {
+		IoDeleteDevice(tmp);
+		EXIT1(return NDIS_STATUS_RESOURCES);
+	}
+
+	*dev_obj = tmp;
+	*dev_obj_handle = *dev_obj;
+	for (i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; i++)
+		if (funcs[i] && i != IRP_MJ_PNP && i != IRP_MJ_POWER) {
+			drv_obj->major_func[i] = funcs[i];
+			TRACE1("mj_fn for 0x%x is at %p", i, funcs[i]);
+		}
+	EXIT1(return NDIS_STATUS_SUCCESS);
+}
+
+wstdcall NDIS_STATUS WIN_FUNC(NdisMDeregisterDevice,1)
+	(struct device_object *dev_obj)
+{
+	ENTER2("%p", dev_obj);
+	IoDeleteDevice(dev_obj);
+	return NDIS_STATUS_SUCCESS;
+}
+
+wstdcall NDIS_STATUS WIN_FUNC(NdisAllocateMemoryWithTag,3)
+	(void **dest, UINT length, ULONG tag)
+{
+	void *addr;
+
+	assert_irql(_irql_ <= DISPATCH_LEVEL);
+	addr = ExAllocatePoolWithTag(NonPagedPool, length, tag);
+	TRACE4("%p", addr);
+	if (addr) {
+		*dest = addr;
+		EXIT4(return NDIS_STATUS_SUCCESS);
+	} else
+		EXIT4(return NDIS_STATUS_FAILURE);
+}
+
+wstdcall NDIS_STATUS WIN_FUNC(NdisAllocateMemory,4)
+	(void **dest, UINT length, UINT flags, NDIS_PHY_ADDRESS highest_address)
+{
+	return NdisAllocateMemoryWithTag(dest, length, 0);
+}
+
+/* length_tag is either length or tag, depending on if
+ * NdisAllocateMemory or NdisAllocateMemoryTag is used to allocate
+ * memory */
+wstdcall void WIN_FUNC(NdisFreeMemory,3)
+	(void *addr, UINT length_tag, UINT flags)
+{
+	TRACE4("%p", addr);
+	ExFreePool(addr);
+}
+
+noregparm void WIN_FUNC(NdisWriteErrorLogEntry,12)
+	(struct driver_object *drv_obj, ULONG error, ULONG count, ...)
+{
+	va_list args;
+	int i;
+	ULONG code;
+
+	va_start(args, count);
+	ERROR("log: %08X, count: %d, return_address: %p",
+	      error, count, __builtin_return_address(0));
+	for (i = 0; i < count; i++) {
+		code = va_arg(args, ULONG);
+		ERROR("code: 0x%x", code);
+	}
+	va_end(args);
+	EXIT2(return);
+}
+
+wstdcall void WIN_FUNC(NdisOpenConfiguration,3)
+	(NDIS_STATUS *status, struct ndis_mp_block **conf_handle,
+	 struct ndis_mp_block *handle)
+{
+	ENTER2("%p", conf_handle);
+	*conf_handle = handle;
+	*status = NDIS_STATUS_SUCCESS;
+	EXIT2(return);
+}
+
+wstdcall void WIN_FUNC(NdisOpenProtocolConfiguration,3)
+	(NDIS_STATUS *status, void **confhandle,
+	 struct unicode_string *section)
+{
+	ENTER2("%p", confhandle);
+	*status = NDIS_STATUS_SUCCESS;
+	EXIT2(return);
+}
+
+wstdcall void WIN_FUNC(NdisOpenConfigurationKeyByName,4)
+	(NDIS_STATUS *status, void *handle,
+	 struct unicode_string *key, void **subkeyhandle)
+{
+	struct ansi_string ansi;
+	ENTER2("");
+	if (RtlUnicodeStringToAnsiString(&ansi, key, TRUE) == STATUS_SUCCESS) {
+		TRACE2("%s", ansi.buf);
+		RtlFreeAnsiString(&ansi);
+	}
+	*subkeyhandle = handle;
+	*status = NDIS_STATUS_SUCCESS;
+	EXIT2(return);
+}
+
+wstdcall void WIN_FUNC(NdisOpenConfigurationKeyByIndex,5)
+	(NDIS_STATUS *status, void *handle, ULONG index,
+	 struct unicode_string *key, void **subkeyhandle)
+{
+	ENTER2("%u", index);
+//	*subkeyhandle = handle;
+	*status = NDIS_STATUS_FAILURE;
+	EXIT2(return);
+}
+
+wstdcall void WIN_FUNC(NdisCloseConfiguration,1)
+	(void *handle)
+{
+	/* instead of freeing all configuration parameters as we are
+	 * supposed to do here, we free them when the device is
+	 * removed */
+	ENTER2("%p", handle);
+	return;
+}
+
+wstdcall void WIN_FUNC(NdisOpenFile,5)
+	(NDIS_STATUS *status, struct wrap_bin_file **file,
+	 UINT *filelength, struct unicode_string *filename,
+	 NDIS_PHY_ADDRESS highest_address)
+{
+	struct ansi_string ansi;
+	struct wrap_bin_file *bin_file;
+
+	ENTER2("%p, %d, %llx, %p", status, *filelength, highest_address, *file);
+	if (RtlUnicodeStringToAnsiString(&ansi, filename, TRUE) !=
+	    STATUS_SUCCESS) {
+		*status = NDIS_STATUS_RESOURCES;
+		EXIT2(return);
+	}
+	TRACE2("%s", ansi.buf);
+	bin_file = get_bin_file(ansi.buf);
+	if (bin_file) {
+		*file = bin_file;
+		*filelength = bin_file->size;
+		*status = NDIS_STATUS_SUCCESS;
+	} else
+		*status = NDIS_STATUS_FILE_NOT_FOUND;
+
+	RtlFreeAnsiString(&ansi);
+	EXIT2(return);
+}
+
+wstdcall void WIN_FUNC(NdisMapFile,3)
+	(NDIS_STATUS *status, void **mappedbuffer, struct wrap_bin_file *file)
+{
+	ENTER2("%p", file);
+
+	if (!file) {
+		*status = NDIS_STATUS_ALREADY_MAPPED;
+		EXIT2(return);
+	}
+
+	*status = NDIS_STATUS_SUCCESS;
+	*mappedbuffer = file->data;
+	EXIT2(return);
+}
+
+wstdcall void WIN_FUNC(NdisUnmapFile,1)
+	(struct wrap_bin_file *file)
+{
+	ENTER2("%p", file);
+	EXIT2(return);
+}
+
+wstdcall void WIN_FUNC(NdisCloseFile,1)
+	(struct wrap_bin_file *file)
+{
+	ENTER2("%p", file);
+	free_bin_file(file);
+	EXIT2(return);
+}
+
+wstdcall void WIN_FUNC(NdisGetSystemUpTime,1)
+	(ULONG *ms)
+{
+	*ms = 1000 * jiffies / HZ;
+	EXIT5(return);
+}
+
+wstdcall ULONG WIN_FUNC(NDIS_BUFFER_TO_SPAN_PAGES,1)
+	(ndis_buffer *buffer)
+{
+	ULONG n, length;
+
+	if (buffer == NULL)
+		EXIT2(return 0);
+	if (MmGetMdlByteCount(buffer) == 0)
+		EXIT2(return 1);
+
+	length = MmGetMdlByteCount(buffer);
+	n = SPAN_PAGES(MmGetMdlVirtualAddress(buffer), length);
+	TRACE4("%p, %p, %d, %d", buffer->startva, buffer->mappedsystemva,
+	       length, n);
+	EXIT3(return n);
+}
+
+wstdcall void WIN_FUNC(NdisGetBufferPhysicalArraySize,2)
+	(ndis_buffer *buffer, UINT *arraysize)
+{
+	ENTER3("%p", buffer);
+	*arraysize = NDIS_BUFFER_TO_SPAN_PAGES(buffer);
+	EXIT3(return);
+}
+
+static struct ndis_configuration_parameter *
+ndis_encode_setting(struct wrap_device_setting *setting,
+		    enum ndis_parameter_type type)
+{
+	struct ansi_string ansi;
+	struct ndis_configuration_parameter *param;
+
+	param = setting->encoded;
+	if (param) {
+		if (param->type == type)
+			EXIT2(return param);
+		if (param->type == NdisParameterString)
+			RtlFreeUnicodeString(&param->data.string);
+		setting->encoded = NULL;
+	} else
+		param = ExAllocatePoolWithTag(NonPagedPool, sizeof(*param), 0);
+	if (!param) {
+		ERROR("couldn't allocate memory");
+		return NULL;
+	}
+	switch(type) {
+	case NdisParameterInteger:
+		param->data.integer = simple_strtol(setting->value, NULL, 0);
+		TRACE2("0x%x", (ULONG)param->data.integer);
+		break;
+	case NdisParameterHexInteger:
+		param->data.integer = simple_strtol(setting->value, NULL, 16);
+		TRACE2("0x%x", (ULONG)param->data.integer);
+		break;
+	case NdisParameterString:
+		RtlInitAnsiString(&ansi, setting->value);
+		TRACE2("'%s'", ansi.buf);
+		if (RtlAnsiStringToUnicodeString(&param->data.string,
+						 &ansi, TRUE)) {
+			ExFreePool(param);
+			EXIT2(return NULL);
+		}
+		break;
+	case NdisParameterBinary:
+		param->data.integer = simple_strtol(setting->value, NULL, 2);
+		TRACE2("0x%x", (ULONG)param->data.integer);
+		break;
+	default:
+		ERROR("unknown type: %d", type);
+		ExFreePool(param);
+		return NULL;
+	}
+	param->type = type;
+	setting->encoded = param;
+	EXIT2(return param);
+}
+
+static int ndis_decode_setting(struct wrap_device_setting *setting,
+			       struct ndis_configuration_parameter *param)
+{
+	struct ansi_string ansi;
+	struct ndis_configuration_parameter *prev;
+
+	ENTER2("%p, %p", setting, param);
+	prev = setting->encoded;
+	if (prev && prev->type == NdisParameterString) {
+		RtlFreeUnicodeString(&prev->data.string);
+		setting->encoded = NULL;
+	}
+	switch(param->type) {
+	case NdisParameterInteger:
+		snprintf(setting->value, sizeof(u32), "%u",
+			 param->data.integer);
+		setting->value[sizeof(ULONG)] = 0;
+		break;
+	case NdisParameterHexInteger:
+		snprintf(setting->value, sizeof(u32), "%x",
+			 param->data.integer);
+		setting->value[sizeof(ULONG)] = 0;
+		break;
+	case NdisParameterString:
+		ansi.buf = setting->value;
+		ansi.max_length = MAX_SETTING_VALUE_LEN;
+		if ((RtlUnicodeStringToAnsiString(&ansi, &param->data.string,
+						  FALSE) != STATUS_SUCCESS)
+		    || ansi.length >= MAX_SETTING_VALUE_LEN) {
+			EXIT1(return -1);
+		}
+		if (ansi.length == ansi.max_length)
+			ansi.length--;
+		setting->value[ansi.length] = 0;
+		break;
+	case NdisParameterBinary:
+		snprintf(setting->value, sizeof(u32), "%u",
+			 param->data.integer);
+		setting->value[sizeof(ULONG)] = 0;
+		break;
+	default:
+		TRACE2("unknown setting type: %d", param->type);
+		return -1;
+	}
+	TRACE2("setting changed %s='%s', %d", setting->name, setting->value,
+	       ansi.length);
+	return 0;
+}
+
+static int read_setting(struct nt_list *setting_list, char *keyname, int length,
+			struct ndis_configuration_parameter **param,
+			enum ndis_parameter_type type)
+{
+	struct wrap_device_setting *setting;
+	if (down_interruptible(&loader_mutex))
+		WARNING("couldn't obtain loader_mutex");
+	nt_list_for_each_entry(setting, setting_list, list) {
+		if (strnicmp(keyname, setting->name, length) == 0) {
+			TRACE2("setting %s='%s'", keyname, setting->value);
+			up(&loader_mutex);
+			*param = ndis_encode_setting(setting, type);
+			if (*param)
+				EXIT2(return 0);
+			else
+				EXIT2(return -1);
+		}
+	}
+	up(&loader_mutex);
+	EXIT2(return -1);
+}
+
+wstdcall void WIN_FUNC(NdisReadConfiguration,5)
+	(NDIS_STATUS *status, struct ndis_configuration_parameter **param,
+	 struct ndis_mp_block *nmb, struct unicode_string *key,
+	 enum ndis_parameter_type type)
+{
+	struct ansi_string ansi;
+	int ret;
+
+	ENTER2("nmb: %p", nmb);
+	ret = RtlUnicodeStringToAnsiString(&ansi, key, TRUE);
+	if (ret != STATUS_SUCCESS || ansi.buf == NULL) {
+		*param = NULL;
+		*status = NDIS_STATUS_FAILURE;
+		RtlFreeAnsiString(&ansi);
+		EXIT2(return);
+	}
+	TRACE2("%d, %s", type, ansi.buf);
+
+	if (read_setting(&nmb->wnd->wd->settings, ansi.buf,
+			 ansi.length, param, type) == 0 ||
+	    read_setting(&nmb->wnd->wd->driver->settings, ansi.buf,
+			 ansi.length, param, type) == 0)
+		*status = NDIS_STATUS_SUCCESS;
+	else {
+		TRACE2("setting %s not found (type:%d)", ansi.buf, type);
+		*status = NDIS_STATUS_FAILURE;
+	}
+	RtlFreeAnsiString(&ansi);
+	EXIT2(return);
+
+}
+
+wstdcall void WIN_FUNC(NdisWriteConfiguration,4)
+	(NDIS_STATUS *status, struct ndis_mp_block *nmb,
+	 struct unicode_string *key, struct ndis_configuration_parameter *param)
+{
+	struct ansi_string ansi;
+	char *keyname;
+	struct wrap_device_setting *setting;
+
+	ENTER2("nmb: %p", nmb);
+	if (RtlUnicodeStringToAnsiString(&ansi, key, TRUE)) {
+		*status = NDIS_STATUS_FAILURE;
+		EXIT2(return);
+	}
+	keyname = ansi.buf;
+	TRACE2("%s", keyname);
+
+	if (down_interruptible(&loader_mutex))
+		WARNING("couldn't obtain loader_mutex");
+	nt_list_for_each_entry(setting, &nmb->wnd->wd->settings, list) {
+		if (strnicmp(keyname, setting->name, ansi.length) == 0) {
+			up(&loader_mutex);
+			if (ndis_decode_setting(setting, param))
+				*status = NDIS_STATUS_FAILURE;
+			else
+				*status = NDIS_STATUS_SUCCESS;
+			RtlFreeAnsiString(&ansi);
+			EXIT2(return);
+		}
+	}
+	up(&loader_mutex);
+	setting = kzalloc(sizeof(*setting), GFP_KERNEL);
+	if (setting) {
+		if (ansi.length == ansi.max_length)
+			ansi.length--;
+		memcpy(setting->name, keyname, ansi.length);
+		setting->name[ansi.length] = 0;
+		if (ndis_decode_setting(setting, param))
+			*status = NDIS_STATUS_FAILURE;
+		else {
+			*status = NDIS_STATUS_SUCCESS;
+			if (down_interruptible(&loader_mutex))
+				WARNING("couldn't obtain loader_mutex");
+			InsertTailList(&nmb->wnd->wd->settings, &setting->list);
+			up(&loader_mutex);
+		}
+	} else
+		*status = NDIS_STATUS_RESOURCES;
+
+	RtlFreeAnsiString(&ansi);
+	EXIT2(return);
+}
+
+wstdcall void WIN_FUNC(NdisReadNetworkAddress,4)
+	(NDIS_STATUS *status, void **addr, UINT *len,
+	 struct ndis_mp_block *nmb)
+{
+	struct ndis_device *wnd = nmb->wnd;
+	struct ndis_configuration_parameter *param;
+	struct unicode_string key;
+	struct ansi_string ansi;
+	typeof(wnd->mac) mac;
+	int i, ret;
+
+	ENTER2("%p", nmb);
+	RtlInitAnsiString(&ansi, "NetworkAddress");
+	*status = NDIS_STATUS_FAILURE;
+	if (RtlAnsiStringToUnicodeString(&key, &ansi, TRUE) != STATUS_SUCCESS)
+		EXIT1(return);
+
+	NdisReadConfiguration(&ret, &param, nmb, &key, NdisParameterString);
+	RtlFreeUnicodeString(&key);
+	if (ret != NDIS_STATUS_SUCCESS)
+		EXIT1(return);
+	ret = RtlUnicodeStringToAnsiString(&ansi, &param->data.string, TRUE);
+	if (ret != STATUS_SUCCESS)
+		EXIT1(return);
+
+	i = 0;
+	if (ansi.length >= 2 * sizeof(mac)) {
+		for (i = 0; i < sizeof(mac); i++) {
+			char c[3];
+			int x;
+			c[0] = ansi.buf[i*2];
+			c[1] = ansi.buf[i*2+1];
+			c[2] = 0;
+			ret = sscanf(c, "%x", &x);
+			if (ret != 1)
+				break;
+			mac[i] = x;
+		}
+	}
+	TRACE2("%s, %d, " MACSTR, ansi.buf, i, MAC2STR(mac));
+	RtlFreeAnsiString(&ansi);
+	if (i == sizeof(mac)) {
+		memcpy(wnd->mac, mac, sizeof(wnd->mac));
+		*len = sizeof(mac);
+		*addr = wnd->mac;
+		*status = NDIS_STATUS_SUCCESS;
+	}
+	EXIT1(return);
+}
+
+wstdcall void WIN_FUNC(NdisInitializeString,2)
+	(struct unicode_string *dest, UCHAR *src)
+{
+	struct ansi_string ansi;
+
+	ENTER2("");
+	if (src == NULL) {
+		dest->length = dest->max_length = 0;
+		dest->buf = NULL;
+	} else {
+		RtlInitAnsiString(&ansi, src);
+		/* the string is freed with NdisFreeMemory */
+		RtlAnsiStringToUnicodeString(dest, &ansi, TRUE);
+	}
+	EXIT2(return);
+}
+
+wstdcall void WIN_FUNC(NdisInitAnsiString,2)
+	(struct ansi_string *dst, CHAR *src)
+{
+	RtlInitAnsiString(dst, src);
+	EXIT2(return);
+}
+
+wstdcall void WIN_FUNC(NdisInitUnicodeString,2)
+	(struct unicode_string *dest, const wchar_t *src)
+{
+	RtlInitUnicodeString(dest, src);
+	return;
+}
+
+wstdcall NDIS_STATUS WIN_FUNC(NdisAnsiStringToUnicodeString,2)
+	(struct unicode_string *dst, struct ansi_string *src)
+{
+	ENTER2("");
+	if (dst == NULL || src == NULL)
+		EXIT2(return NDIS_STATUS_FAILURE);
+	if (RtlAnsiStringToUnicodeString(dst, src, FALSE) == STATUS_SUCCESS)
+		return NDIS_STATUS_SUCCESS;
+	else
+		return NDIS_STATUS_FAILURE;
+}
+
+wstdcall NDIS_STATUS WIN_FUNC(NdisUnicodeStringToAnsiString,2)
+	(struct ansi_string *dst, struct unicode_string *src)
+{
+	ENTER2("");
+	if (dst == NULL || src == NULL)
+		EXIT2(return NDIS_STATUS_FAILURE);
+	if (RtlUnicodeStringToAnsiString(dst, src, FALSE) == STATUS_SUCCESS)
+		return NDIS_STATUS_SUCCESS;
+	else
+		return NDIS_STATUS_FAILURE;
+}
+
+wstdcall NTSTATUS WIN_FUNC(NdisUpcaseUnicodeString,2)
+	(struct unicode_string *dst, struct unicode_string *src)
+{
+	EXIT2(return RtlUpcaseUnicodeString(dst, src, FALSE));
+}
+
+wstdcall void WIN_FUNC(NdisMSetAttributesEx,5)
+	(struct ndis_mp_block *nmb, void *mp_ctx,
+	 UINT hangcheck_interval, UINT attributes, ULONG adaptertype)
+{
+	struct ndis_device *wnd;
+
+	ENTER1("%p, %p, %d, %08x, %d", nmb, mp_ctx, hangcheck_interval,
+	       attributes, adaptertype);
+	wnd = nmb->wnd;
+	nmb->mp_ctx = mp_ctx;
+	wnd->attributes = attributes;
+
+	if ((attributes & NDIS_ATTRIBUTE_BUS_MASTER) &&
+	    wrap_is_pci_bus(wnd->wd->dev_bus))
+		pci_set_master(wnd->wd->pci.pdev);
+
+	if (hangcheck_interval > 0)
+		wnd->hangcheck_interval = 2 * hangcheck_interval * HZ;
+	else
+		wnd->hangcheck_interval = 2 * HZ;
+
+	EXIT1(return);
+}
+
+wstdcall ULONG WIN_FUNC(NdisReadPciSlotInformation,5)
+	(struct ndis_mp_block *nmb, ULONG slot,
+	 ULONG offset, char *buf, ULONG len)
+{
+	struct wrap_device *wd = nmb->wnd->wd;
+	ULONG i;
+	for (i = 0; i < len; i++)
+		if (pci_read_config_byte(wd->pci.pdev, offset + i, &buf[i]) !=
+		    PCIBIOS_SUCCESSFUL)
+			break;
+	DBG_BLOCK(2) {
+		if (i != len)
+			WARNING("%u, %u", i, len);
+	}
+	return i;
+}
+
+wstdcall ULONG WIN_FUNC(NdisImmediateReadPciSlotInformation,5)
+	(struct ndis_mp_block *nmb, ULONG slot,
+	 ULONG offset, char *buf, ULONG len)
+{
+	return NdisReadPciSlotInformation(nmb, slot, offset, buf, len);
+}
+
+wstdcall ULONG WIN_FUNC(NdisWritePciSlotInformation,5)
+	(struct ndis_mp_block *nmb, ULONG slot,
+	 ULONG offset, char *buf, ULONG len)
+{
+	struct wrap_device *wd = nmb->wnd->wd;
+	ULONG i;
+	for (i = 0; i < len; i++)
+		if (pci_write_config_byte(wd->pci.pdev, offset + i, buf[i]) !=
+		    PCIBIOS_SUCCESSFUL)
+			break;
+	DBG_BLOCK(2) {
+		if (i != len)
+			WARNING("%u, %u", i, len);
+	}
+	return i;
+}
+
+wstdcall NDIS_STATUS WIN_FUNC(NdisMRegisterIoPortRange,4)
+	(void **virt, struct ndis_mp_block *nmb, UINT start, UINT len)
+{
+	ENTER3("%08x %08x", start, len);
+	*virt = (void *)(ULONG_PTR)start;
+	return NDIS_STATUS_SUCCESS;
+}
+
+wstdcall void WIN_FUNC(NdisMDeregisterIoPortRange,4)
+	(struct ndis_mp_block *nmb, UINT start, UINT len, void* virt)
+{
+	ENTER1("%08x %08x", start, len);
+}
+
+wstdcall void WIN_FUNC(NdisReadPortUchar,3)
+	(struct ndis_mp_block *nmb, ULONG port, char *data)
+{
+	*data = inb(port);
+}
+
+wstdcall void WIN_FUNC(NdisImmediateReadPortUchar,3)
+	(struct ndis_mp_block *nmb, ULONG port, char *data)
+{
+	*data = inb(port);
+}
+
+wstdcall void WIN_FUNC(NdisWritePortUchar,3)
+	(struct ndis_mp_block *nmb, ULONG port, char data)
+{
+	outb(data, port);
+}
+
+wstdcall void WIN_FUNC(NdisImmediateWritePortUchar,3)
+	(struct ndis_mp_block *nmb, ULONG port, char data)
+{
+	outb(data, port);
+}
+
+wstdcall void WIN_FUNC(NdisMQueryAdapterResources,4)
+	(NDIS_STATUS *status, struct ndis_mp_block *nmb,
+	 NDIS_RESOURCE_LIST *resource_list, UINT *size)
+{
+	struct ndis_device *wnd = nmb->wnd;
+	NDIS_RESOURCE_LIST *list;
+	UINT resource_length;
+
+	list = &wnd->wd->resource_list->list->partial_resource_list;
+	resource_length = sizeof(struct cm_partial_resource_list) +
+		sizeof(struct cm_partial_resource_descriptor) *
+		(list->count - 1);
+	TRACE2("%p, %p,%d (%d), %p %d %d", wnd, resource_list, *size,
+	       resource_length, &list->partial_descriptors[list->count-1],
+	       list->partial_descriptors[list->count-1].u.interrupt.level,
+	       list->partial_descriptors[list->count-1].u.interrupt.vector);
+	if (*size < sizeof(*list)) {
+		*size = resource_length;
+		*status = NDIS_STATUS_BUFFER_TOO_SHORT;
+	} else {
+		ULONG count;
+		if (*size >= resource_length) {
+			*size = resource_length;
+			count = list->count;
+		} else {
+			UINT n = sizeof(*list);
+			count = 1;
+			while (count++ < list->count && n < *size)
+				n += sizeof(list->partial_descriptors);
+			*size = n;
+		}
+		memcpy(resource_list, list, *size);
+		resource_list->count = count;
+		*status = NDIS_STATUS_SUCCESS;
+	}
+	EXIT2(return);
+}
+
+wstdcall NDIS_STATUS WIN_FUNC(NdisMPciAssignResources,3)
+	(struct ndis_mp_block *nmb, ULONG slot_number,
+	 NDIS_RESOURCE_LIST **resources)
+{
+	struct ndis_device *wnd = nmb->wnd;
+
+	ENTER2("%p, %p", wnd, wnd->wd->resource_list);
+	*resources = &wnd->wd->resource_list->list->partial_resource_list;
+	EXIT2(return NDIS_STATUS_SUCCESS);
+}
+
+wstdcall NDIS_STATUS WIN_FUNC(NdisMMapIoSpace,4)
+	(void __iomem **virt, struct ndis_mp_block *nmb,
+	 NDIS_PHY_ADDRESS phy_addr, UINT len)
+{
+	struct ndis_device *wnd = nmb->wnd;
+
+	ENTER2("%Lx, %d", phy_addr, len);
+	*virt = MmMapIoSpace(phy_addr, len, MmCached);
+	if (*virt == NULL) {
+		ERROR("ioremap failed");
+		EXIT2(return NDIS_STATUS_FAILURE);
+	}
+	wnd->mem_start = phy_addr;
+	wnd->mem_end = phy_addr + len;
+	TRACE2("%p", *virt);
+	EXIT2(return NDIS_STATUS_SUCCESS);
+}
+
+wstdcall void WIN_FUNC(NdisMUnmapIoSpace,3)
+	(struct ndis_mp_block *nmb, void __iomem *virt, UINT len)
+{
+	ENTER2("%p, %d", virt, len);
+	MmUnmapIoSpace(virt, len);
+	EXIT2(return);
+}
+
+wstdcall void WIN_FUNC(NdisAllocateSpinLock,1)
+	(struct ndis_spinlock *lock)
+{
+	TRACE4("lock %p, %p", lock, &lock->klock);
+	KeInitializeSpinLock(&lock->klock);
+	lock->irql = PASSIVE_LEVEL;
+	return;
+}
+
+wstdcall void WIN_FUNC(NdisFreeSpinLock,1)
+	(struct ndis_spinlock *lock)
+{
+	TRACE4("lock %p, %p", lock, &lock->klock);
+	return;
+}
+
+wstdcall void WIN_FUNC(NdisAcquireSpinLock,1)
+	(struct ndis_spinlock *lock)
+{
+	ENTER6("lock %p, %p", lock, &lock->klock);
+//	assert_irql(_irql_ <= DISPATCH_LEVEL);
+	lock->irql = nt_spin_lock_irql(&lock->klock, DISPATCH_LEVEL);
+	return;
+}
+
+wstdcall void WIN_FUNC(NdisReleaseSpinLock,1)
+	(struct ndis_spinlock *lock)
+{
+	ENTER6("lock %p, %p", lock, &lock->klock);
+//	assert_irql(_irql_ == DISPATCH_LEVEL);
+	nt_spin_unlock_irql(&lock->klock, lock->irql);
+	return;
+}
+
+wstdcall void WIN_FUNC(NdisDprAcquireSpinLock,1)
+	(struct ndis_spinlock *lock)
+{
+	ENTER6("lock %p", &lock->klock);
+//	assert_irql(_irql_ == DISPATCH_LEVEL);
+	nt_spin_lock(&lock->klock);
+	return;
+}
+
+wstdcall void WIN_FUNC(NdisDprReleaseSpinLock,1)
+	(struct ndis_spinlock *lock)
+{
+	ENTER6("lock %p", &lock->klock);
+//	assert_irql(_irql_ == DISPATCH_LEVEL);
+	nt_spin_unlock(&lock->klock);
+	return;
+}
+
+wstdcall void WIN_FUNC(NdisInitializeReadWriteLock,1)
+	(struct ndis_rw_lock *rw_lock)
+{
+	ENTER3("%p", rw_lock);
+	memset(rw_lock, 0, sizeof(*rw_lock));
+	KeInitializeSpinLock(&rw_lock->klock);
+	return;
+}
+
+/* read/write locks are implemented in a rather simplisitic way - we
+ * should probably use Linux's rw_lock implementation */
+
+wstdcall void WIN_FUNC(NdisAcquireReadWriteLock,3)
+	(struct ndis_rw_lock *rw_lock, BOOLEAN write,
+	 struct lock_state *lock_state)
+{
+	if (write) {
+		while (1) {
+			if (cmpxchg(&rw_lock->count, 0, -1) == 0)
+				return;
+			while (rw_lock->count)
+				cpu_relax();
+		}
+		return;
+	}
+	while (1) {
+		typeof(rw_lock->count) count;
+		while ((count = rw_lock->count) < 0)
+			cpu_relax();
+		if (cmpxchg(&rw_lock->count, count, count + 1) == count)
+			return;
+	}
+}
+
+wstdcall void WIN_FUNC(NdisReleaseReadWriteLock,2)
+	(struct ndis_rw_lock *rw_lock, struct lock_state *lock_state)
+{
+	if (rw_lock->count > 0)
+		pre_atomic_add(rw_lock->count, -1);
+	else if (rw_lock->count == -1)
+		rw_lock->count = 0;
+	else
+		WARNING("invalid state: %d", rw_lock->count);
+}
+
+wstdcall NDIS_STATUS WIN_FUNC(NdisMAllocateMapRegisters,5)
+	(struct ndis_mp_block *nmb, UINT dmachan,
+	 NDIS_DMA_SIZE dmasize, ULONG basemap, ULONG max_buf_size)
+{
+	struct ndis_device *wnd = nmb->wnd;
+
+	ENTER2("%p, %d %d %d %d", wnd, dmachan, dmasize, basemap, max_buf_size);
+	if (wnd->dma_map_count > 0) {
+		WARNING("%s: map registers already allocated: %u",
+			wnd->net_dev->name, wnd->dma_map_count);
+		EXIT2(return NDIS_STATUS_RESOURCES);
+	}
+	if (dmasize == NDIS_DMA_24BITS) {
+		if (pci_set_dma_mask(wnd->wd->pci.pdev, DMA_BIT_MASK(24)) ||
+		    pci_set_consistent_dma_mask(wnd->wd->pci.pdev,
+						DMA_BIT_MASK(24)))
+			WARNING("setting dma mask failed");
+	} else if (dmasize == NDIS_DMA_32BITS) {
+		/* consistent dma is in low 32-bits by default */
+		if (pci_set_dma_mask(wnd->wd->pci.pdev, DMA_BIT_MASK(32)))
+			WARNING("setting dma mask failed");
+#ifdef CONFIG_X86_64
+	} else if (dmasize == NDIS_DMA_64BITS) {
+		if (pci_set_dma_mask(wnd->wd->pci.pdev, DMA_BIT_MASK(64)) ||
+		    pci_set_consistent_dma_mask(wnd->wd->pci.pdev,
+						DMA_BIT_MASK(64)))
+			WARNING("setting dma mask failed");
+		else
+			wnd->net_dev->features |= NETIF_F_HIGHDMA;
+#endif
+	}
+	/* since memory for buffer is allocated with kmalloc, buffer
+	 * is physically contiguous, so entire map will fit in one
+	 * register */
+	if (basemap > 64) {
+		WARNING("Windows driver %s requesting too many (%u) "
+			"map registers", wnd->wd->driver->name, basemap);
+		/* As per NDIS, NDIS_STATUS_RESOURCES should be
+		 * returned, but with that Atheros PCI driver fails -
+		 * for now tolerate it */
+//		EXIT2(return NDIS_STATUS_RESOURCES);
+	}
+
+	wnd->dma_map_addr = kmalloc(basemap * sizeof(*(wnd->dma_map_addr)),
+				    GFP_KERNEL);
+	if (!wnd->dma_map_addr)
+		EXIT2(return NDIS_STATUS_RESOURCES);
+	memset(wnd->dma_map_addr, 0, basemap * sizeof(*(wnd->dma_map_addr)));
+	wnd->dma_map_count = basemap;
+	TRACE2("%u", wnd->dma_map_count);
+	EXIT2(return NDIS_STATUS_SUCCESS);
+}
+
+wstdcall void WIN_FUNC(NdisMFreeMapRegisters,1)
+	(struct ndis_mp_block *nmb)
+{
+	struct ndis_device *wnd = nmb->wnd;
+	int i;
+
+	ENTER2("wnd: %p", wnd);
+	if (wnd->dma_map_addr) {
+		for (i = 0; i < wnd->dma_map_count; i++) {
+			if (wnd->dma_map_addr[i])
+				WARNING("%s: dma addr %p not freed by "
+					"Windows driver", wnd->net_dev->name,
+					(void *)wnd->dma_map_addr[i]);
+		}
+		kfree(wnd->dma_map_addr);
+		wnd->dma_map_addr = NULL;
+	} else
+		WARNING("map registers already freed?");
+	wnd->dma_map_count = 0;
+	EXIT2(return);
+}
+
+wstdcall void WIN_FUNC(NdisMStartBufferPhysicalMapping,6)
+	(struct ndis_mp_block *nmb, ndis_buffer *buf,
+	 ULONG index, BOOLEAN write_to_dev,
+	 struct ndis_phy_addr_unit *phy_addr_array, UINT *array_size)
+{
+	struct ndis_device *wnd = nmb->wnd;
+
+	ENTER3("%p, %p, %u, %u", wnd, buf, index, wnd->dma_map_count);
+	if (unlikely(wnd->sg_dma_size || !write_to_dev ||
+		     index >= wnd->dma_map_count)) {
+		WARNING("invalid request: %d, %d, %d, %d", wnd->sg_dma_size,
+			write_to_dev, index, wnd->dma_map_count);
+		phy_addr_array[0].phy_addr = 0;
+		phy_addr_array[0].length = 0;
+		*array_size = 0;
+		return;
+	}
+	if (wnd->dma_map_addr[index]) {
+		TRACE2("buffer %p at %d is already mapped: %lx", buf, index,
+		       (unsigned long)wnd->dma_map_addr[index]);
+//		*array_size = 1;
+		return;
+	}
+	TRACE3("%p, %p, %u", buf, MmGetSystemAddressForMdl(buf),
+	       MmGetMdlByteCount(buf));
+	DBG_BLOCK(4) {
+		dump_bytes(__func__, MmGetSystemAddressForMdl(buf),
+			   MmGetMdlByteCount(buf));
+	}
+	wnd->dma_map_addr[index] =
+		PCI_DMA_MAP_SINGLE(wnd->wd->pci.pdev,
+				   MmGetSystemAddressForMdl(buf),
+				   MmGetMdlByteCount(buf), PCI_DMA_TODEVICE);
+	phy_addr_array[0].phy_addr = wnd->dma_map_addr[index];
+	phy_addr_array[0].length = MmGetMdlByteCount(buf);
+	TRACE4("%Lx, %d, %d", phy_addr_array[0].phy_addr,
+	       phy_addr_array[0].length, index);
+	*array_size = 1;
+}
+
+wstdcall void WIN_FUNC(NdisMCompleteBufferPhysicalMapping,3)
+	(struct ndis_mp_block *nmb, ndis_buffer *buf, ULONG index)
+{
+	struct ndis_device *wnd = nmb->wnd;
+
+	ENTER3("%p, %p %u (%u)", wnd, buf, index, wnd->dma_map_count);
+
+	if (unlikely(wnd->sg_dma_size))
+		WARNING("buffer %p may have been unmapped already", buf);
+	if (index >= wnd->dma_map_count) {
+		ERROR("invalid map register (%u >= %u)",
+		      index, wnd->dma_map_count);
+		return;
+	}
+	TRACE4("%lx", (unsigned long)wnd->dma_map_addr[index]);
+	if (wnd->dma_map_addr[index]) {
+		PCI_DMA_UNMAP_SINGLE(wnd->wd->pci.pdev, wnd->dma_map_addr[index],
+				     MmGetMdlByteCount(buf), PCI_DMA_TODEVICE);
+		wnd->dma_map_addr[index] = 0;
+	} else
+		WARNING("map registers at %u not used", index);
+}
+
+wstdcall void WIN_FUNC(NdisMAllocateSharedMemory,5)
+	(struct ndis_mp_block *nmb, ULONG size,
+	 BOOLEAN cached, void **virt, NDIS_PHY_ADDRESS *phys)
+{
+	dma_addr_t dma_addr;
+	struct wrap_device *wd = nmb->wnd->wd;
+
+	ENTER3("size: %u, cached: %d", size, cached);
+	*virt = PCI_DMA_ALLOC_COHERENT(wd->pci.pdev, size, &dma_addr);
+	if (*virt)
+		*phys = dma_addr;
+	else
+		WARNING("couldn't allocate %d bytes of %scached DMA memory",
+			size, cached ? "" : "un-");
+	EXIT3(return);
+}
+
+wstdcall void WIN_FUNC(NdisMFreeSharedMemory,5)
+	(struct ndis_mp_block *nmb, ULONG size, BOOLEAN cached,
+	 void *virt, NDIS_PHY_ADDRESS addr)
+{
+	struct wrap_device *wd = nmb->wnd->wd;
+	ENTER3("%p, %Lx, %u", virt, addr, size);
+	PCI_DMA_FREE_COHERENT(wd->pci.pdev, size, virt, addr);
+	EXIT3(return);
+}
+
+wstdcall void alloc_shared_memory_async(void *arg1, void *arg2)
+{
+	struct ndis_device *wnd;
+	struct alloc_shared_mem *alloc_shared_mem;
+	struct miniport *mp;
+	void *virt;
+	NDIS_PHY_ADDRESS phys;
+	KIRQL irql;
+
+	wnd = arg1;
+	alloc_shared_mem = arg2;
+	mp = &wnd->wd->driver->ndis_driver->mp;
+	NdisMAllocateSharedMemory(wnd->nmb, alloc_shared_mem->size,
+				  alloc_shared_mem->cached, &virt, &phys);
+	irql = serialize_lock_irql(wnd);
+	assert_irql(_irql_ == DISPATCH_LEVEL);
+	LIN2WIN5(mp->alloc_complete, wnd->nmb, virt,
+		 &phys, alloc_shared_mem->size, alloc_shared_mem->ctx);
+	serialize_unlock_irql(wnd, irql);
+	kfree(alloc_shared_mem);
+}
+WIN_FUNC_DECL(alloc_shared_memory_async,2)
+
+wstdcall NDIS_STATUS WIN_FUNC(NdisMAllocateSharedMemoryAsync,4)
+	(struct ndis_mp_block *nmb, ULONG size, BOOLEAN cached, void *ctx)
+{
+	struct ndis_device *wnd = nmb->wnd;
+	struct alloc_shared_mem *alloc_shared_mem;
+
+	ENTER3("wnd: %p", wnd);
+	alloc_shared_mem = kmalloc(sizeof(*alloc_shared_mem), irql_gfp());
+	if (!alloc_shared_mem) {
+		WARNING("couldn't allocate memory");
+		return NDIS_STATUS_FAILURE;
+	}
+
+	alloc_shared_mem->size = size;
+	alloc_shared_mem->cached = cached;
+	alloc_shared_mem->ctx = ctx;
+	if (schedule_ntos_work_item(WIN_FUNC_PTR(alloc_shared_memory_async,2),
+				    wnd, alloc_shared_mem))
+		EXIT3(return NDIS_STATUS_FAILURE);
+	EXIT3(return NDIS_STATUS_PENDING);
+}
+
+/* Some drivers allocate NDIS_BUFFER (aka MDL) very often; instead of
+ * allocating and freeing with kernel functions, we chain them into
+ * ndis_buffer_pool. When an MDL is freed, it is added to the list of
+ * free MDLs. When allocated, we first check if there is one in free
+ * list and if so just return it; otherwise, we allocate a new one and
+ * return that. This reduces memory fragmentation. Windows DDK says
+ * that the driver itself shouldn't check what is returned in
+ * pool_handle, presumably because buffer pools are not used in
+ * XP. However, as long as driver follows rest of the semantics - that
+ * it should indicate maximum number of MDLs used with num_descr and
+ * pass the same pool_handle in other buffer functions, this should
+ * work. Sadly, though, NdisFreeBuffer doesn't pass the pool_handle,
+ * so we use 'process' field of MDL to store pool_handle. */
+
+wstdcall void WIN_FUNC(NdisAllocateBufferPool,3)
+	(NDIS_STATUS *status, struct ndis_buffer_pool **pool_handle,
+	 UINT num_descr)
+{
+	struct ndis_buffer_pool *pool;
+
+	ENTER1("buffers: %d", num_descr);
+	pool = kmalloc(sizeof(*pool), irql_gfp());
+	if (!pool) {
+		*status = NDIS_STATUS_RESOURCES;
+		EXIT3(return);
+	}
+	spin_lock_init(&pool->lock);
+	pool->max_descr = num_descr;
+	pool->num_allocated_descr = 0;
+	pool->free_descr = NULL;
+	*pool_handle = pool;
+	*status = NDIS_STATUS_SUCCESS;
+	TRACE1("pool: %p, num_descr: %d", pool, num_descr);
+	EXIT1(return);
+}
+
+wstdcall void WIN_FUNC(NdisAllocateBuffer,5)
+	(NDIS_STATUS *status, ndis_buffer **buffer,
+	 struct ndis_buffer_pool *pool, void *virt, UINT length)
+{
+	ndis_buffer *descr;
+
+	ENTER4("pool: %p (%d)", pool, pool->num_allocated_descr);
+	/* NDIS drivers should call this at DISPATCH_LEVEL, but
+	 * alloc_tx_packet calls at SOFT_IRQL */
+	assert_irql(_irql_ <= SOFT_LEVEL);
+	if (!pool) {
+		*status = NDIS_STATUS_FAILURE;
+		*buffer = NULL;
+		EXIT4(return);
+	}
+	spin_lock_bh(&pool->lock);
+	if ((descr = pool->free_descr))
+		pool->free_descr = descr->next;
+	spin_unlock_bh(&pool->lock);
+	if (descr) {
+		typeof(descr->flags) flags;
+		flags = descr->flags;
+		memset(descr, 0, sizeof(*descr));
+		MmInitializeMdl(descr, virt, length);
+		if (flags & MDL_CACHE_ALLOCATED)
+			descr->flags |= MDL_CACHE_ALLOCATED;
+	} else {
+		if (pool->num_allocated_descr > pool->max_descr) {
+			TRACE2("pool %p is full: %d(%d)", pool,
+			       pool->num_allocated_descr, pool->max_descr);
+#ifndef ALLOW_POOL_OVERFLOW
+			*status = NDIS_STATUS_FAILURE;
+			*buffer = NULL;
+			return;
+#endif
+		}
+		descr = allocate_init_mdl(virt, length);
+		if (!descr) {
+			WARNING("couldn't allocate buffer");
+			*status = NDIS_STATUS_FAILURE;
+			*buffer = NULL;
+			EXIT4(return);
+		}
+		TRACE4("buffer %p for %p, %d", descr, virt, length);
+		atomic_inc_var(pool->num_allocated_descr);
+	}
+	/* TODO: make sure this mdl can map given buffer */
+	MmBuildMdlForNonPagedPool(descr);
+//	descr->flags |= MDL_ALLOCATED_FIXED_SIZE |
+//		MDL_MAPPED_TO_SYSTEM_VA | MDL_PAGES_LOCKED;
+	descr->pool = pool;
+	*buffer = descr;
+	*status = NDIS_STATUS_SUCCESS;
+	TRACE4("buffer: %p", descr);
+	EXIT4(return);
+}
+
+wstdcall void WIN_FUNC(NdisFreeBuffer,1)
+	(ndis_buffer *buffer)
+{
+	struct ndis_buffer_pool *pool;
+
+	ENTER4("%p", buffer);
+	if (!buffer || !buffer->pool) {
+		ERROR("invalid buffer");
+		EXIT4(return);
+	}
+	pool = buffer->pool;
+	if (pool->num_allocated_descr > MAX_ALLOCATED_NDIS_BUFFERS) {
+		/* NB NB NB: set mdl's 'pool' field to NULL before
+		 * calling free_mdl; otherwise free_mdl calls
+		 * NdisFreeBuffer back */
+		atomic_dec_var(pool->num_allocated_descr);
+		buffer->pool = NULL;
+		free_mdl(buffer);
+	} else {
+		spin_lock_bh(&pool->lock);
+		buffer->next = pool->free_descr;
+		pool->free_descr = buffer;
+		spin_unlock_bh(&pool->lock);
+	}
+	EXIT4(return);
+}
+
+wstdcall void WIN_FUNC(NdisFreeBufferPool,1)
+	(struct ndis_buffer_pool *pool)
+{
+	ndis_buffer *cur, *next;
+
+	TRACE3("pool: %p", pool);
+	if (!pool) {
+		WARNING("invalid pool");
+		EXIT3(return);
+	}
+	spin_lock_bh(&pool->lock);
+	cur = pool->free_descr;
+	while (cur) {
+		next = cur->next;
+		cur->pool = NULL;
+		free_mdl(cur);
+		cur = next;
+	}
+	spin_unlock_bh(&pool->lock);
+	kfree(pool);
+	pool = NULL;
+	EXIT3(return);
+}
+
+wstdcall void WIN_FUNC(NdisAdjustBufferLength,2)
+	(ndis_buffer *buffer, UINT length)
+{
+	ENTER4("%p, %d", buffer, length);
+	buffer->bytecount = length;
+}
+
+wstdcall void WIN_FUNC(NdisQueryBuffer,3)
+	(ndis_buffer *buffer, void **virt, UINT *length)
+{
+	ENTER4("buffer: %p", buffer);
+	if (virt)
+		*virt = MmGetSystemAddressForMdl(buffer);
+	*length = MmGetMdlByteCount(buffer);
+	TRACE4("%p, %u", virt? *virt : NULL, *length);
+	return;
+}
+
+wstdcall void WIN_FUNC(NdisQueryBufferSafe,4)
+	(ndis_buffer *buffer, void **virt, UINT *length,
+	 enum mm_page_priority priority)
+{
+	ENTER4("%p, %p, %p, %d", buffer, virt, length, priority);
+	if (virt)
+		*virt = MmGetSystemAddressForMdlSafe(buffer, priority);
+	*length = MmGetMdlByteCount(buffer);
+	TRACE4("%p, %u", virt? *virt : NULL, *length);
+}
+
+wstdcall void *WIN_FUNC(NdisBufferVirtualAddress,1)
+	(ndis_buffer *buffer)
+{
+	ENTER3("%p", buffer);
+	return MmGetSystemAddressForMdl(buffer);
+}
+
+wstdcall ULONG WIN_FUNC(NdisBufferLength,1)
+	(ndis_buffer *buffer)
+{
+	ENTER3("%p", buffer);
+	return MmGetMdlByteCount(buffer);
+}
+
+wstdcall void WIN_FUNC(NdisQueryBufferOffset,3)
+	(ndis_buffer *buffer, UINT *offset, UINT *length)
+{
+	ENTER3("%p", buffer);
+	*offset = MmGetMdlByteOffset(buffer);
+	*length = MmGetMdlByteCount(buffer);
+	TRACE3("%d, %d", *offset, *length);
+}
+
+wstdcall void WIN_FUNC(NdisUnchainBufferAtBack,2)
+	(struct ndis_packet *packet, ndis_buffer **buffer)
+{
+	ndis_buffer *b, *btail;
+
+	ENTER3("%p", packet);
+	b = packet->private.buffer_head;
+	if (!b) {
+		/* no buffer in packet */
+		*buffer = NULL;
+		EXIT3(return);
+	}
+	btail = packet->private.buffer_tail;
+	*buffer = btail;
+	if (b == btail) {
+		/* one buffer in packet */
+		packet->private.buffer_head = NULL;
+		packet->private.buffer_tail = NULL;
+	} else {
+		while (b->next != btail)
+			b = b->next;
+		packet->private.buffer_tail = b;
+		b->next = NULL;
+	}
+	packet->private.valid_counts = FALSE;
+	EXIT3(return);
+}
+
+wstdcall void WIN_FUNC(NdisUnchainBufferAtFront,2)
+	(struct ndis_packet *packet, ndis_buffer **buffer)
+{
+	ENTER3("%p", packet);
+	if (packet->private.buffer_head == NULL) {
+		/* no buffer in packet */
+		*buffer = NULL;
+		EXIT3(return);
+	}
+
+	*buffer = packet->private.buffer_head;
+	if (packet->private.buffer_head == packet->private.buffer_tail) {
+		/* one buffer in packet */
+		packet->private.buffer_head = NULL;
+		packet->private.buffer_tail = NULL;
+	} else
+		packet->private.buffer_head = (*buffer)->next;
+
+	packet->private.valid_counts = FALSE;
+	EXIT3(return);
+}
+
+wstdcall void WIN_FUNC(NdisGetFirstBufferFromPacketSafe,6)
+	(struct ndis_packet *packet, ndis_buffer **first_buffer,
+	 void **first_buffer_va, UINT *first_buffer_length,
+	 UINT *total_buffer_length, enum mm_page_priority priority)
+{
+	ndis_buffer *b = packet->private.buffer_head;
+
+	ENTER3("%p(%p)", packet, b);
+	*first_buffer = b;
+	if (b) {
+		*first_buffer_va = MmGetSystemAddressForMdlSafe(b, priority);
+		*first_buffer_length = *total_buffer_length =
+			MmGetMdlByteCount(b);
+		for (b = b->next; b; b = b->next)
+			*total_buffer_length += MmGetMdlByteCount(b);
+	} else {
+		*first_buffer_va = NULL;
+		*first_buffer_length = 0;
+		*total_buffer_length = 0;
+	}
+	TRACE3("%p, %d, %d", *first_buffer_va, *first_buffer_length,
+	       *total_buffer_length);
+	EXIT3(return);
+}
+
+wstdcall void WIN_FUNC(NdisGetFirstBufferFromPacket,6)
+	(struct ndis_packet *packet, ndis_buffer **first_buffer,
+	 void **first_buffer_va, UINT *first_buffer_length,
+	 UINT *total_buffer_length, enum mm_page_priority priority)
+{
+	NdisGetFirstBufferFromPacketSafe(packet, first_buffer,
+					 first_buffer_va, first_buffer_length,
+					 total_buffer_length,
+					 NormalPagePriority);
+}
+
+wstdcall void WIN_FUNC(NdisAllocatePacketPoolEx,5)
+	(NDIS_STATUS *status, struct ndis_packet_pool **pool_handle,
+	 UINT num_descr, UINT overflowsize, UINT proto_rsvd_length)
+{
+	struct ndis_packet_pool *pool;
+
+	ENTER3("buffers: %d, length: %d", num_descr, proto_rsvd_length);
+	pool = kzalloc(sizeof(*pool), irql_gfp());
+	if (!pool) {
+		*status = NDIS_STATUS_RESOURCES;
+		EXIT3(return);
+	}
+	spin_lock_init(&pool->lock);
+	pool->max_descr = num_descr;
+	pool->num_allocated_descr = 0;
+	pool->num_used_descr = 0;
+	pool->free_descr = NULL;
+	pool->proto_rsvd_length = proto_rsvd_length;
+	*pool_handle = pool;
+	*status = NDIS_STATUS_SUCCESS;
+	TRACE3("pool: %p", pool);
+	EXIT3(return);
+}
+
+wstdcall void WIN_FUNC(NdisAllocatePacketPool,4)
+	(NDIS_STATUS *status, struct ndis_packet_pool **pool_handle,
+	 UINT num_descr, UINT proto_rsvd_length)
+{
+	NdisAllocatePacketPoolEx(status, pool_handle, num_descr, 0,
+				 proto_rsvd_length);
+	EXIT3(return);
+}
+
+wstdcall void WIN_FUNC(NdisFreePacketPool,1)
+	(struct ndis_packet_pool *pool)
+{
+	struct ndis_packet *packet, *next;
+
+	ENTER3("pool: %p", pool);
+	if (!pool) {
+		WARNING("invalid pool");
+		EXIT3(return);
+	}
+	spin_lock_bh(&pool->lock);
+	packet = pool->free_descr;
+	while (packet) {
+		next = (struct ndis_packet *)packet->reserved[0];
+		kfree(packet);
+		packet = next;
+	}
+	pool->num_allocated_descr = 0;
+	pool->num_used_descr = 0;
+	pool->free_descr = NULL;
+	spin_unlock_bh(&pool->lock);
+	kfree(pool);
+	EXIT3(return);
+}
+
+wstdcall UINT WIN_FUNC(NdisPacketPoolUsage,1)
+	(struct ndis_packet_pool *pool)
+{
+	EXIT4(return pool->num_used_descr);
+}
+
+wstdcall void WIN_FUNC(NdisAllocatePacket,3)
+	(NDIS_STATUS *status, struct ndis_packet **ndis_packet,
+	 struct ndis_packet_pool *pool)
+{
+	struct ndis_packet *packet;
+	int packet_length;
+
+	ENTER4("pool: %p", pool);
+	if (!pool) {
+		*status = NDIS_STATUS_RESOURCES;
+		*ndis_packet = NULL;
+		EXIT4(return);
+	}
+	assert_irql(_irql_ <= SOFT_LEVEL);
+	if (pool->num_used_descr > pool->max_descr) {
+		TRACE3("pool %p is full: %d(%d)", pool,
+		       pool->num_used_descr, pool->max_descr);
+#ifndef ALLOW_POOL_OVERFLOW
+		*status = NDIS_STATUS_RESOURCES;
+		*ndis_packet = NULL;
+		return;
+#endif
+	}
+	/* packet has space for 1 byte in protocol_reserved field */
+	packet_length = sizeof(*packet) - 1 + pool->proto_rsvd_length +
+		sizeof(struct ndis_packet_oob_data);
+	spin_lock_bh(&pool->lock);
+	if ((packet = pool->free_descr))
+		pool->free_descr = (void *)packet->reserved[0];
+	spin_unlock_bh(&pool->lock);
+	if (!packet) {
+		packet = kmalloc(packet_length, irql_gfp());
+		if (!packet) {
+			WARNING("couldn't allocate packet");
+			*status = NDIS_STATUS_RESOURCES;
+			*ndis_packet = NULL;
+			return;
+		}
+		atomic_inc_var(pool->num_allocated_descr);
+	}
+	TRACE4("%p, %p", pool, packet);
+	atomic_inc_var(pool->num_used_descr);
+	memset(packet, 0, packet_length);
+	packet->private.oob_offset =
+		packet_length - sizeof(struct ndis_packet_oob_data);
+	packet->private.packet_flags = fPACKET_ALLOCATED_BY_NDIS;
+	packet->private.pool = pool;
+	*ndis_packet = packet;
+	*status = NDIS_STATUS_SUCCESS;
+	EXIT4(return);
+}
+
+wstdcall void WIN_FUNC(NdisDprAllocatePacket,3)
+	(NDIS_STATUS *status, struct ndis_packet **packet,
+	 struct ndis_packet_pool *pool)
+{
+	NdisAllocatePacket(status, packet, pool);
+}
+
+wstdcall void WIN_FUNC(NdisFreePacket,1)
+	(struct ndis_packet *packet)
+{
+	struct ndis_packet_pool *pool;
+
+	ENTER4("%p, %p", packet, packet->private.pool);
+	pool = packet->private.pool;
+	if (!pool) {
+		ERROR("invalid pool %p", packet);
+		EXIT4(return);
+	}
+	assert((int)pool->num_used_descr > 0);
+	atomic_dec_var(pool->num_used_descr);
+	if (packet->reserved[1]) {
+		TRACE3("%p, %p", packet, (void *)packet->reserved[1]);
+		kfree((void *)packet->reserved[1]);
+		packet->reserved[1] = 0;
+	}
+	if (pool->num_allocated_descr > MAX_ALLOCATED_NDIS_PACKETS) {
+		TRACE3("%p", pool);
+		atomic_dec_var(pool->num_allocated_descr);
+		kfree(packet);
+	} else {
+		TRACE4("%p, %p, %p", pool, packet, pool->free_descr);
+		spin_lock_bh(&pool->lock);
+		packet->reserved[0] =
+			(typeof(packet->reserved[0]))pool->free_descr;
+		pool->free_descr = packet;
+		spin_unlock_bh(&pool->lock);
+	}
+	EXIT4(return);
+}
+
+wstdcall struct ndis_packet_stack *WIN_FUNC(NdisIMGetCurrentPacketStack,2)
+	(struct ndis_packet *packet, BOOLEAN *stacks_remain)
+{
+	struct ndis_packet_stack *stack;
+
+	if (!packet->reserved[1]) {
+		stack = kzalloc(2 * sizeof(*stack), irql_gfp());
+		TRACE3("%p, %p", packet, stack);
+		packet->reserved[1] = (typeof(packet->reserved[1]))stack;
+	} else {
+		stack = (void *)packet->reserved[1];;
+		if (xchg(&stack->ndis_reserved[0], 1)) {
+			stack++;
+			if (xchg(&stack->ndis_reserved[0], 1))
+				stack = NULL;
+		}
+		TRACE3("%p", stack);
+	}
+	if (stack)
+		*stacks_remain = TRUE;
+	else
+		*stacks_remain = FALSE;
+
+	EXIT3(return stack);
+}
+
+wstdcall void WIN_FUNC(NdisCopyFromPacketToPacketSafe,7)
+	(struct ndis_packet *dst, UINT dst_offset, UINT num_to_copy,
+	 struct ndis_packet *src, UINT src_offset, UINT *num_copied,
+	 enum mm_page_priority priority)
+{
+	UINT dst_n, src_n, n, left;
+	ndis_buffer *dst_buf;
+	ndis_buffer *src_buf;
+
+	ENTER4("");
+	if (!dst || !src) {
+		*num_copied = 0;
+		EXIT4(return);
+	}
+
+	dst_buf = dst->private.buffer_head;
+	src_buf = src->private.buffer_head;
+
+	if (!dst_buf || !src_buf) {
+		*num_copied = 0;
+		EXIT4(return);
+	}
+	dst_n = MmGetMdlByteCount(dst_buf) - dst_offset;
+	src_n = MmGetMdlByteCount(src_buf) - src_offset;
+
+	n = min(src_n, dst_n);
+	n = min(n, num_to_copy);
+	memcpy(MmGetSystemAddressForMdl(dst_buf) + dst_offset,
+	       MmGetSystemAddressForMdl(src_buf) + src_offset, n);
+
+	left = num_to_copy - n;
+	while (left > 0) {
+		src_offset += n;
+		dst_offset += n;
+		dst_n -= n;
+		src_n -= n;
+		if (dst_n == 0) {
+			dst_buf = dst_buf->next;
+			if (!dst_buf)
+				break;
+			dst_n = MmGetMdlByteCount(dst_buf);
+			dst_offset = 0;
+		}
+		if (src_n == 0) {
+			src_buf = src_buf->next;
+			if (!src_buf)
+				break;
+			src_n = MmGetMdlByteCount(src_buf);
+			src_offset = 0;
+		}
+
+		n = min(src_n, dst_n);
+		n = min(n, left);
+		memcpy(MmGetSystemAddressForMdl(dst_buf) + dst_offset,
+		       MmGetSystemAddressForMdl(src_buf) + src_offset, n);
+		left -= n;
+	}
+	*num_copied = num_to_copy - left;
+	EXIT4(return);
+}
+
+wstdcall void WIN_FUNC(NdisCopyFromPacketToPacket,6)
+	(struct ndis_packet *dst, UINT dst_offset, UINT num_to_copy,
+	 struct ndis_packet *src, UINT src_offset, UINT *num_copied)
+{
+	NdisCopyFromPacketToPacketSafe(dst, dst_offset, num_to_copy,
+				       src, src_offset, num_copied,
+				       NormalPagePriority);
+	return;
+}
+
+wstdcall void WIN_FUNC(NdisIMCopySendPerPacketInfo,2)
+	(struct ndis_packet *dst, struct ndis_packet *src)
+{
+	struct ndis_packet_oob_data *dst_oob, *src_oob;
+	dst_oob = NDIS_PACKET_OOB_DATA(dst);
+	src_oob = NDIS_PACKET_OOB_DATA(src);
+	memcpy(&dst_oob->ext, &src_oob->ext, sizeof(dst_oob->ext));
+	return;
+}
+
+wstdcall void WIN_FUNC(NdisSend,3)
+	(NDIS_STATUS *status, struct ndis_mp_block *nmb,
+	 struct ndis_packet *packet)
+{
+	struct ndis_device *wnd = nmb->wnd;
+	struct miniport *mp;
+	KIRQL irql;
+
+	mp = &wnd->wd->driver->ndis_driver->mp;
+	if (mp->send_packets) {
+		irql = serialize_lock_irql(wnd);
+		assert_irql(_irql_ == DISPATCH_LEVEL);
+		LIN2WIN3(mp->send_packets, wnd->nmb->mp_ctx, &packet, 1);
+		serialize_unlock_irql(wnd, irql);
+		if (deserialized_driver(wnd))
+			*status = NDIS_STATUS_PENDING;
+		else {
+			struct ndis_packet_oob_data *oob_data;
+			oob_data = NDIS_PACKET_OOB_DATA(packet);
+			*status = oob_data->status;
+			switch (*status) {
+			case NDIS_STATUS_SUCCESS:
+				free_tx_packet(wnd, packet, *status);
+				break;
+			case NDIS_STATUS_PENDING:
+				break;
+			case NDIS_STATUS_RESOURCES:
+				wnd->tx_ok = 0;
+				break;
+			case NDIS_STATUS_FAILURE:
+			default:
+				free_tx_packet(wnd, packet, *status);
+				break;
+			}
+		}
+	} else {
+		irql = serialize_lock_irql(wnd);
+		assert_irql(_irql_ == DISPATCH_LEVEL);
+		*status = LIN2WIN3(mp->send, wnd->nmb->mp_ctx, packet, 0);
+		serialize_unlock_irql(wnd, irql);
+		switch (*status) {
+		case NDIS_STATUS_SUCCESS:
+			free_tx_packet(wnd, packet, *status);
+			break;
+		case NDIS_STATUS_PENDING:
+			break;
+		case NDIS_STATUS_RESOURCES:
+			wnd->tx_ok = 0;
+			break;
+		case NDIS_STATUS_FAILURE:
+		default:
+			free_tx_packet(wnd, packet, *status);
+			break;
+		}
+	}
+	EXIT3(return);
+}
+
+/* called for serialized drivers only */
+wstdcall void mp_timer_dpc(struct kdpc *kdpc, void *ctx, void *arg1, void *arg2)
+{
+	struct ndis_mp_timer *timer;
+	struct ndis_mp_block *nmb;
+
+	timer = ctx;
+	TIMERENTER("%p, %p, %p, %p", timer, timer->func, timer->ctx, timer->nmb);
+	assert_irql(_irql_ == DISPATCH_LEVEL);
+	nmb = timer->nmb;
+	serialize_lock(nmb->wnd);
+	LIN2WIN4(timer->func, NULL, timer->ctx, NULL, NULL);
+	serialize_unlock(nmb->wnd);
+	TIMEREXIT(return);
+}
+WIN_FUNC_DECL(mp_timer_dpc,4)
+
+wstdcall void WIN_FUNC(NdisMInitializeTimer,4)
+	(struct ndis_mp_timer *timer, struct ndis_mp_block *nmb,
+	 DPC func, void *ctx)
+{
+	TIMERENTER("%p, %p, %p, %p", timer, func, ctx, nmb);
+	assert_irql(_irql_ == PASSIVE_LEVEL);
+	timer->func = func;
+	timer->ctx = ctx;
+	timer->nmb = nmb;
+	if (deserialized_driver(nmb->wnd))
+		KeInitializeDpc(&timer->kdpc, func, ctx);
+	else
+		KeInitializeDpc(&timer->kdpc, WIN_FUNC_PTR(mp_timer_dpc,4),
+				timer);
+	wrap_init_timer(&timer->nt_timer, NotificationTimer, nmb);
+	TIMEREXIT(return);
+}
+
+wstdcall void WIN_FUNC(NdisMSetPeriodicTimer,2)
+	(struct ndis_mp_timer *timer, UINT period_ms)
+{
+	unsigned long expires = MSEC_TO_HZ(period_ms);
+
+	TIMERENTER("%p, %u, %ld", timer, period_ms, expires);
+	assert_irql(_irql_ <= DISPATCH_LEVEL);
+	wrap_set_timer(&timer->nt_timer, expires, expires, &timer->kdpc);
+	TIMEREXIT(return);
+}
+
+wstdcall void WIN_FUNC(NdisMCancelTimer,2)
+	(struct ndis_mp_timer *timer, BOOLEAN *canceled)
+{
+	TIMERENTER("%p", timer);
+	assert_irql(_irql_ <= DISPATCH_LEVEL);
+	*canceled = KeCancelTimer(&timer->nt_timer);
+	TIMERTRACE("%d", *canceled);
+	return;
+}
+
+wstdcall void WIN_FUNC(NdisInitializeTimer,3)
+	(struct ndis_timer *timer, void *func, void *ctx)
+{
+	TIMERENTER("%p, %p, %p", timer, func, ctx);
+	assert_irql(_irql_ == PASSIVE_LEVEL);
+	KeInitializeDpc(&timer->kdpc, func, ctx);
+	wrap_init_timer(&timer->nt_timer, NotificationTimer, NULL);
+	TIMEREXIT(return);
+}
+
+/* NdisMSetTimer is a macro that calls NdisSetTimer with
+ * ndis_mp_timer typecast to ndis_timer */
+
+wstdcall void WIN_FUNC(NdisSetTimer,2)
+	(struct ndis_timer *timer, UINT duetime_ms)
+{
+	unsigned long expires = MSEC_TO_HZ(duetime_ms);
+
+	TIMERENTER("%p, %p, %u, %ld", timer, timer->nt_timer.wrap_timer,
+		   duetime_ms, expires);
+	assert_irql(_irql_ <= DISPATCH_LEVEL);
+	wrap_set_timer(&timer->nt_timer, expires, 0, &timer->kdpc);
+	TIMEREXIT(return);
+}
+
+wstdcall void WIN_FUNC(NdisCancelTimer,2)
+	(struct ndis_timer *timer, BOOLEAN *canceled)
+{
+	TIMERENTER("%p", timer);
+	assert_irql(_irql_ <= DISPATCH_LEVEL);
+	*canceled = KeCancelTimer(&timer->nt_timer);
+	TIMEREXIT(return);
+}
+
+wstdcall void WIN_FUNC(NdisMRegisterAdapterShutdownHandler,3)
+	(struct ndis_mp_block *nmb, void *ctx, void *func)
+{
+	struct ndis_device *wnd = nmb->wnd;
+	ENTER1("%p", func);
+	wnd->wd->driver->ndis_driver->mp.shutdown = func;
+	wnd->shutdown_ctx = ctx;
+}
+
+wstdcall void WIN_FUNC(NdisMDeregisterAdapterShutdownHandler,1)
+	(struct ndis_mp_block *nmb)
+{
+	struct ndis_device *wnd = nmb->wnd;
+	wnd->wd->driver->ndis_driver->mp.shutdown = NULL;
+	wnd->shutdown_ctx = NULL;
+}
+
+/* TODO: rt61 (serialized) driver doesn't want MiniportEnableInterrupt
+ * to be called in irq handler, but mrv800c (deserialized) driver
+ * wants. NDIS is confusing about when to call MiniportEnableInterrupt
+ * For now, handle these cases with two separate irq handlers based on
+ * observation of these two drivers. However, it is likely not
+ * correct. */
+wstdcall void deserialized_irq_handler(struct kdpc *kdpc, void *ctx,
+				       void *arg1, void *arg2)
+{
+	struct ndis_device *wnd = ctx;
+	ndis_interrupt_handler irq_handler = arg1;
+	struct miniport *mp = arg2;
+
+	TRACE6("%p", irq_handler);
+	assert_irql(_irql_ == DISPATCH_LEVEL);
+	LIN2WIN1(irq_handler, wnd->nmb->mp_ctx);
+	if (mp->enable_interrupt)
+		LIN2WIN1(mp->enable_interrupt, wnd->nmb->mp_ctx);
+	EXIT6(return);
+}
+WIN_FUNC_DECL(deserialized_irq_handler,4)
+
+wstdcall void serialized_irq_handler(struct kdpc *kdpc, void *ctx,
+				     void *arg1, void *arg2)
+{
+	struct ndis_device *wnd = ctx;
+	ndis_interrupt_handler irq_handler = arg1;
+
+	TRACE6("%p, %p, %p", wnd, irq_handler, arg2);
+	assert_irql(_irql_ == DISPATCH_LEVEL);
+	serialize_lock(wnd);
+	LIN2WIN1(irq_handler, arg2);
+	serialize_unlock(wnd);
+	EXIT6(return);
+}
+WIN_FUNC_DECL(serialized_irq_handler,4)
+
+wstdcall BOOLEAN ndis_isr(struct kinterrupt *kinterrupt, void *ctx)
+{
+	struct ndis_mp_interrupt *mp_interrupt = ctx;
+	struct ndis_device *wnd = mp_interrupt->nmb->wnd;
+	BOOLEAN recognized = TRUE, queue_handler = TRUE;
+
+	TRACE6("%p", wnd);
+	/* kernel may call ISR when registering interrupt, in
+	 * the same context if DEBUG_SHIRQ is enabled */
+	assert_irql(_irql_ == DIRQL || _irql_ == PASSIVE_LEVEL);
+	if (mp_interrupt->shared)
+		LIN2WIN3(mp_interrupt->isr, &recognized, &queue_handler,
+			 wnd->nmb->mp_ctx);
+	else {
+		struct miniport *mp;
+		mp = &wnd->wd->driver->ndis_driver->mp;
+		LIN2WIN1(mp->disable_interrupt, wnd->nmb->mp_ctx);
+		/* it is not shared interrupt, so handler must be called */
+		recognized = queue_handler = TRUE;
+	}
+	if (recognized) {
+		if (queue_handler) {
+			TRACE5("%p", &wnd->irq_kdpc);
+			queue_kdpc(&wnd->irq_kdpc);
+		}
+		EXIT6(return TRUE);
+	}
+	EXIT6(return FALSE);
+}
+WIN_FUNC_DECL(ndis_isr,2)
+
+wstdcall NDIS_STATUS WIN_FUNC(NdisMRegisterInterrupt,7)
+	(struct ndis_mp_interrupt *mp_interrupt,
+	 struct ndis_mp_block *nmb, UINT vector, UINT level,
+	 BOOLEAN req_isr, BOOLEAN shared, enum kinterrupt_mode mode)
+{
+	struct ndis_device *wnd = nmb->wnd;
+	struct miniport *mp;
+
+	ENTER1("%p, vector:%d, level:%d, req_isr:%d, shared:%d, mode:%d",
+	       mp_interrupt, vector, level, req_isr, shared, mode);
+
+	mp = &wnd->wd->driver->ndis_driver->mp;
+	nt_spin_lock_init(&mp_interrupt->lock);
+	mp_interrupt->irq = vector;
+	mp_interrupt->isr = mp->isr;
+	mp_interrupt->mp_dpc = mp->handle_interrupt;
+	mp_interrupt->nmb = nmb;
+	mp_interrupt->req_isr = req_isr;
+	if (shared && !req_isr)
+		WARNING("shared but dynamic interrupt!");
+	mp_interrupt->shared = shared;
+	wnd->mp_interrupt = mp_interrupt;
+	if (mp->enable_interrupt)
+		mp_interrupt->enable = TRUE;
+	else
+		mp_interrupt->enable = FALSE;
+
+	if (deserialized_driver(wnd)) {
+		KeInitializeDpc(&wnd->irq_kdpc,
+				WIN_FUNC_PTR(deserialized_irq_handler,4),
+				nmb->wnd);
+		wnd->irq_kdpc.arg1 = mp->handle_interrupt;
+		wnd->irq_kdpc.arg2 = mp;
+		TRACE2("%p, %p, %p, %p", wnd->irq_kdpc.arg1, wnd->irq_kdpc.arg2,
+		       nmb->wnd, nmb->mp_ctx);
+	} else {
+		KeInitializeDpc(&wnd->irq_kdpc,
+				WIN_FUNC_PTR(serialized_irq_handler,4),
+				nmb->wnd);
+		wnd->irq_kdpc.arg1 = mp->handle_interrupt;
+		wnd->irq_kdpc.arg2 = nmb->mp_ctx;
+		TRACE2("%p, %p, %p", wnd->irq_kdpc.arg1, wnd->irq_kdpc.arg2,
+		       nmb->wnd);
+	}
+
+	if (IoConnectInterrupt(&mp_interrupt->kinterrupt,
+			       WIN_FUNC_PTR(ndis_isr,2), mp_interrupt, NULL,
+			       vector, DIRQL, DIRQL, mode, shared, 0, FALSE) !=
+	    STATUS_SUCCESS) {
+		printk(KERN_WARNING "%s: request for IRQ %d failed\n",
+		       DRIVER_NAME, vector);
+		return NDIS_STATUS_RESOURCES;
+	}
+	printk(KERN_INFO "%s: using IRQ %d\n", DRIVER_NAME, vector);
+	EXIT1(return NDIS_STATUS_SUCCESS);
+}
+
+wstdcall void WIN_FUNC(NdisMDeregisterInterrupt,1)
+	(struct ndis_mp_interrupt *mp_interrupt)
+{
+	struct ndis_mp_block *nmb;
+
+	ENTER1("%p", mp_interrupt);
+	nmb = xchg(&mp_interrupt->nmb, NULL);
+	TRACE1("%p", nmb);
+	if (!nmb) {
+		WARNING("interrupt already freed?");
+		return;
+	}
+	nmb->wnd->mp_interrupt = NULL;
+	if (dequeue_kdpc(&nmb->wnd->irq_kdpc))
+		TRACE2("interrupt kdpc was pending");
+	flush_workqueue(wrapndis_wq);
+	IoDisconnectInterrupt(mp_interrupt->kinterrupt);
+	EXIT1(return);
+}
+
+wstdcall BOOLEAN WIN_FUNC(NdisMSynchronizeWithInterrupt,3)
+	(struct ndis_mp_interrupt *mp_interrupt,
+	 PKSYNCHRONIZE_ROUTINE sync_func, void *ctx)
+{
+	return KeSynchronizeExecution(mp_interrupt->kinterrupt, sync_func, ctx);
+}
+
+/* called via function pointer; but 64-bit RNDIS driver calls directly */
+wstdcall void WIN_FUNC(NdisMIndicateStatus,4)
+	(struct ndis_mp_block *nmb, NDIS_STATUS status, void *buf, UINT len)
+{
+	struct ndis_device *wnd = nmb->wnd;
+	struct ndis_status_indication *si;
+
+	ENTER2("status=0x%x len=%d", status, len);
+	switch (status) {
+	case NDIS_STATUS_MEDIA_CONNECT:
+		set_media_state(wnd, NdisMediaStateConnected);
+		break;
+	case NDIS_STATUS_MEDIA_DISCONNECT:
+		set_media_state(wnd, NdisMediaStateDisconnected);
+		break;
+	case NDIS_STATUS_MEDIA_SPECIFIC_INDICATION:
+		if (!buf)
+			break;
+		si = buf;
+		TRACE2("status_type=%d", si->status_type);
+		switch (si->status_type) {
+		case Ndis802_11StatusType_MediaStreamMode:
+			break;
+#ifdef CONFIG_WIRELESS_EXT
+		case Ndis802_11StatusType_Authentication:
+			buf = (char *)buf + sizeof(*si);
+			len -= sizeof(*si);
+			while (len > 0) {
+				int pairwise_error = 0, group_error = 0;
+				struct ndis_auth_req *auth_req =
+					(struct ndis_auth_req *)buf;
+				TRACE1(MACSTRSEP, MAC2STR(auth_req->bssid));
+				if (auth_req->flags & 0x01)
+					TRACE2("reauth request");
+				if (auth_req->flags & 0x02)
+					TRACE2("key update request");
+				if (auth_req->flags & 0x06) {
+					pairwise_error = 1;
+					TRACE2("pairwise_error");
+				}
+				if (auth_req->flags & 0x0E) {
+					group_error = 1;
+					TRACE2("group_error");
+				}
+				if (pairwise_error || group_error) {
+					union iwreq_data wrqu;
+					struct iw_michaelmicfailure micfailure;
+
+					memset(&micfailure, 0, sizeof(micfailure));
+					if (pairwise_error)
+						micfailure.flags |=
+							IW_MICFAILURE_PAIRWISE;
+					if (group_error)
+						micfailure.flags |=
+							IW_MICFAILURE_GROUP;
+					memcpy(micfailure.src_addr.sa_data,
+					       auth_req->bssid, ETH_ALEN);
+					memset(&wrqu, 0, sizeof(wrqu));
+					wrqu.data.length = sizeof(micfailure);
+					wireless_send_event(wnd->net_dev,
+							    IWEVMICHAELMICFAILURE,
+							    &wrqu, (u8 *)&micfailure);
+				}
+				len -= auth_req->length;
+				buf = (char *)buf + auth_req->length;
+			}
+			break;
+		case Ndis802_11StatusType_PMKID_CandidateList:
+		{
+			u8 *end;
+			unsigned long i;
+			struct ndis_pmkid_candidate_list *cand;
+
+			cand = buf + sizeof(struct ndis_status_indication);
+			if (len < sizeof(struct ndis_status_indication) +
+			    sizeof(struct ndis_pmkid_candidate_list) ||
+				cand->version != 1) {
+				WARNING("unrecognized PMKID ignored");
+				EXIT1(return);
+			}
+
+			end = (u8 *)buf + len;
+			TRACE2("PMKID ver %d num_cand %d",
+			       cand->version, cand->num_candidates);
+			for (i = 0; i < cand->num_candidates; i++) {
+				struct iw_pmkid_cand pcand;
+				union iwreq_data wrqu;
+				struct ndis_pmkid_candidate *c =
+					&cand->candidates[i];
+				if ((u8 *)(c + 1) > end) {
+					TRACE2("truncated PMKID");
+					break;
+				}
+				TRACE2("%ld: " MACSTRSEP " 0x%x",
+				       i, MAC2STR(c->bssid), c->flags);
+				memset(&pcand, 0, sizeof(pcand));
+				if (c->flags & 0x01)
+					pcand.flags |= IW_PMKID_CAND_PREAUTH;
+				pcand.index = i;
+				memcpy(pcand.bssid.sa_data, c->bssid, ETH_ALEN);
+
+				memset(&wrqu, 0, sizeof(wrqu));
+				wrqu.data.length = sizeof(pcand);
+				wireless_send_event(wnd->net_dev, IWEVPMKIDCAND,
+						    &wrqu, (u8 *)&pcand);
+			}
+			break;
+		}
+		case Ndis802_11StatusType_RadioState:
+		{
+			struct ndis_radio_status_indication *radio_status = buf;
+			if (radio_status->radio_state ==
+			    Ndis802_11RadioStatusOn)
+				INFO("radio is turned on");
+			else if (radio_status->radio_state ==
+				 Ndis802_11RadioStatusHardwareOff)
+				INFO("radio is turned off by hardware");
+			else if (radio_status->radio_state ==
+				 Ndis802_11RadioStatusSoftwareOff)
+				INFO("radio is turned off by software");
+			break;
+		}
+#endif
+		default:
+			/* is this RSSI indication? */
+			TRACE2("unknown indication: %x", si->status_type);
+			break;
+		}
+		break;
+	default:
+		TRACE2("unknown status: %08X", status);
+		break;
+	}
+
+	EXIT2(return);
+}
+
+/* called via function pointer; but 64-bit RNDIS driver calls directly */
+wstdcall void WIN_FUNC(NdisMIndicateStatusComplete,1)
+	(struct ndis_mp_block *nmb)
+{
+	struct ndis_device *wnd = nmb->wnd;
+	ENTER2("%p", wnd);
+	if (wnd->tx_ok)
+		schedule_wrapndis_work(&wnd->tx_work);
+}
+
+/* called via function pointer */
+wstdcall void NdisMSendComplete(struct ndis_mp_block *nmb,
+				struct ndis_packet *packet, NDIS_STATUS status)
+{
+	struct ndis_device *wnd = nmb->wnd;
+	ENTER4("%p, %08X", packet, status);
+	assert_irql(_irql_ <= DISPATCH_LEVEL);
+	if (deserialized_driver(wnd))
+		free_tx_packet(wnd, packet, status);
+	else {
+		struct ndis_packet_oob_data *oob_data;
+		NDIS_STATUS pkt_status;
+		TRACE3("%p, %08x", packet, status);
+		oob_data = NDIS_PACKET_OOB_DATA(packet);
+		switch ((pkt_status = xchg(&oob_data->status, status))) {
+		case NDIS_STATUS_NOT_RECOGNIZED:
+			free_tx_packet(wnd, packet, status);
+			break;
+		case NDIS_STATUS_PENDING:
+		case 0:
+			break;
+		default:
+			WARNING("%p: invalid status: %08X", packet, pkt_status);
+			break;
+		}
+		/* In case a serialized driver has earlier requested a
+		 * pause by returning NDIS_STATUS_RESOURCES during
+		 * MiniportSend(Packets), wakeup tx worker now.
+		 */
+		if (xchg(&wnd->tx_ok, 1) == 0) {
+			TRACE3("%d, %d", wnd->tx_ring_start, wnd->tx_ring_end);
+			schedule_wrapndis_work(&wnd->tx_work);
+		}
+	}
+	EXIT3(return);
+}
+
+/* called via function pointer */
+wstdcall void NdisMSendResourcesAvailable(struct ndis_mp_block *nmb)
+{
+	struct ndis_device *wnd = nmb->wnd;
+	ENTER3("%d, %d", wnd->tx_ring_start, wnd->tx_ring_end);
+	wnd->tx_ok = 1;
+	schedule_wrapndis_work(&wnd->tx_work);
+	EXIT3(return);
+}
+
+wstdcall void return_packet(void *arg1, void *arg2)
+{
+	struct ndis_device *wnd;
+	struct ndis_packet *packet;
+	struct miniport *mp;
+	KIRQL irql;
+
+	wnd = arg1;
+	packet = arg2;
+	ENTER4("%p, %p", wnd, packet);
+	mp = &wnd->wd->driver->ndis_driver->mp;
+	irql = serialize_lock_irql(wnd);
+	assert_irql(_irql_ == DISPATCH_LEVEL);
+	LIN2WIN2(mp->return_packet, wnd->nmb->mp_ctx, packet);
+	serialize_unlock_irql(wnd, irql);
+	EXIT4(return);
+}
+WIN_FUNC_DECL(return_packet,2)
+
+/* called via function pointer */
+wstdcall void NdisMIndicateReceivePacket(struct ndis_mp_block *nmb,
+					 struct ndis_packet **packets,
+					 UINT nr_packets)
+{
+	struct ndis_device *wnd;
+	ndis_buffer *buffer;
+	struct ndis_packet *packet;
+	struct sk_buff *skb;
+	ULONG i, length, total_length;
+	struct ndis_packet_oob_data *oob_data;
+	void *virt;
+	struct ndis_tcp_ip_checksum_packet_info csum;
+
+	ENTER3("%p, %d", nmb, nr_packets);
+	assert_irql(_irql_ <= DISPATCH_LEVEL);
+	wnd = nmb->wnd;
+	for (i = 0; i < nr_packets; i++) {
+		packet = packets[i];
+		if (!packet) {
+			WARNING("empty packet ignored");
+			continue;
+		}
+		wnd->net_dev->last_rx = jiffies;
+		/* get total number of bytes in packet */
+		NdisGetFirstBufferFromPacketSafe(packet, &buffer, &virt,
+						 &length, &total_length,
+						 NormalPagePriority);
+		TRACE3("%d, %d", length, total_length);
+		oob_data = NDIS_PACKET_OOB_DATA(packet);
+		TRACE3("0x%x, 0x%x, %Lu", packet->private.flags,
+		       packet->private.packet_flags, oob_data->time_rxed);
+		skb = dev_alloc_skb(total_length);
+		if (skb) {
+			while (buffer) {
+				memcpy_skb(skb, MmGetSystemAddressForMdl(buffer),
+					   MmGetMdlByteCount(buffer));
+				buffer = buffer->next;
+			}
+			skb->dev = wnd->net_dev;
+			skb->protocol = eth_type_trans(skb, wnd->net_dev);
+			pre_atomic_add(wnd->net_stats.rx_bytes, total_length);
+			atomic_inc_var(wnd->net_stats.rx_packets);
+			csum.value = (typeof(csum.value))(ULONG_PTR)
+				oob_data->ext.info[TcpIpChecksumPacketInfo];
+			TRACE3("0x%05x", csum.value);
+			if (wnd->rx_csum.value &&
+			    (csum.rx.tcp_succeeded || csum.rx.udp_succeeded ||
+			     csum.rx.ip_succeeded))
+				skb->ip_summed = CHECKSUM_UNNECESSARY;
+			else
+				skb->ip_summed = CHECKSUM_NONE;
+
+			if (in_interrupt())
+				netif_rx(skb);
+			else
+				netif_rx_ni(skb);
+		} else {
+			WARNING("couldn't allocate skb; packet dropped");
+			atomic_inc_var(wnd->net_stats.rx_dropped);
+		}
+
+		/* serialized drivers check the status upon return
+		 * from this function */
+		if (!deserialized_driver(wnd)) {
+			oob_data->status = NDIS_STATUS_SUCCESS;
+			continue;
+		}
+
+		/* if a deserialized driver sets
+		 * NDIS_STATUS_RESOURCES, then it reclaims the packet
+		 * upon return from this function */
+		if (oob_data->status == NDIS_STATUS_RESOURCES)
+			continue;
+
+		assert(oob_data->status == NDIS_STATUS_SUCCESS);
+		/* deserialized driver doesn't check the status upon
+		 * return from this function; we need to call
+		 * MiniportReturnPacket later for this packet. Calling
+		 * MiniportReturnPacket from here is not correct - the
+		 * driver doesn't expect it (at least Centrino driver
+		 * crashes) */
+		schedule_ntos_work_item(WIN_FUNC_PTR(return_packet,2),
+					wnd, packet);
+	}
+	EXIT3(return);
+}
+
+/* called via function pointer (by NdisMEthIndicateReceive macro); the
+ * first argument is nmb->eth_db */
+wstdcall void EthRxIndicateHandler(struct ndis_mp_block *nmb, void *rx_ctx,
+				   char *header1, char *header, UINT header_size,
+				   void *look_ahead, UINT look_ahead_size,
+				   UINT packet_size)
+{
+	struct sk_buff *skb = NULL;
+	struct ndis_device *wnd;
+	unsigned int skb_size = 0;
+	KIRQL irql;
+	struct ndis_packet_oob_data *oob_data;
+
+	ENTER3("nmb = %p, rx_ctx = %p, buf = %p, size = %d, buf = %p, "
+	       "size = %d, packet = %d", nmb, rx_ctx, header, header_size,
+	       look_ahead, look_ahead_size, packet_size);
+
+	wnd = nmb->wnd;
+	TRACE3("wnd = %p", wnd);
+	if (!wnd) {
+		ERROR("nmb is NULL");
+		EXIT3(return);
+	}
+	wnd->net_dev->last_rx = jiffies;
+
+	if (look_ahead_size < packet_size) {
+		struct ndis_packet *packet;
+		struct miniport *mp;
+		unsigned int bytes_txed;
+		NDIS_STATUS res;
+
+		NdisAllocatePacket(&res, &packet, wnd->tx_packet_pool);
+		if (res != NDIS_STATUS_SUCCESS) {
+			atomic_inc_var(wnd->net_stats.rx_dropped);
+			EXIT3(return);
+		}
+		oob_data = NDIS_PACKET_OOB_DATA(packet);
+		mp = &wnd->wd->driver->ndis_driver->mp;
+		irql = serialize_lock_irql(wnd);
+		assert_irql(_irql_ == DISPATCH_LEVEL);
+		res = LIN2WIN6(mp->tx_data, packet, &bytes_txed, nmb,
+			       rx_ctx, look_ahead_size, packet_size);
+		serialize_unlock_irql(wnd, irql);
+		TRACE3("%d, %d, %d", header_size, look_ahead_size, bytes_txed);
+		if (res == NDIS_STATUS_SUCCESS) {
+			ndis_buffer *buffer;
+			struct ndis_tcp_ip_checksum_packet_info csum;
+			skb = dev_alloc_skb(header_size + look_ahead_size +
+					    bytes_txed);
+			if (!skb) {
+				ERROR("couldn't allocate skb; packet dropped");
+				atomic_inc_var(wnd->net_stats.rx_dropped);
+				NdisFreePacket(packet);
+				return;
+			}
+			memcpy_skb(skb, header, header_size);
+			memcpy_skb(skb, look_ahead, look_ahead_size);
+			buffer = packet->private.buffer_head;
+			while (buffer) {
+				memcpy_skb(skb,
+					   MmGetSystemAddressForMdl(buffer),
+					   MmGetMdlByteCount(buffer));
+				buffer = buffer->next;
+			}
+			skb_size = header_size + look_ahead_size + bytes_txed;
+			csum.value = (typeof(csum.value))(ULONG_PTR)
+				oob_data->ext.info[TcpIpChecksumPacketInfo];
+			TRACE3("0x%05x", csum.value);
+			if (wnd->rx_csum.value &&
+			    (csum.rx.tcp_succeeded || csum.rx.udp_succeeded))
+				skb->ip_summed = CHECKSUM_UNNECESSARY;
+			else
+				skb->ip_summed = CHECKSUM_NONE;
+			NdisFreePacket(packet);
+		} else if (res == NDIS_STATUS_PENDING) {
+			/* driver will call td_complete */
+			oob_data->look_ahead = kmalloc(look_ahead_size,
+						       GFP_ATOMIC);
+			if (!oob_data->look_ahead) {
+				NdisFreePacket(packet);
+				ERROR("packet dropped");
+				atomic_inc_var(wnd->net_stats.rx_dropped);
+				EXIT3(return);
+			}
+			assert(sizeof(oob_data->header) == header_size);
+			memcpy(oob_data->header, header,
+			       sizeof(oob_data->header));
+			memcpy(oob_data->look_ahead, look_ahead,
+			       look_ahead_size);
+			oob_data->look_ahead_size = look_ahead_size;
+			EXIT3(return);
+		} else {
+			WARNING("packet dropped: %08X", res);
+			atomic_inc_var(wnd->net_stats.rx_dropped);
+			NdisFreePacket(packet);
+			EXIT3(return);
+		}
+	} else {
+		skb_size = header_size + packet_size;
+		skb = dev_alloc_skb(skb_size);
+		if (skb) {
+			memcpy_skb(skb, header, header_size);
+			memcpy_skb(skb, look_ahead, packet_size);
+		}
+	}
+
+	if (skb) {
+		skb->dev = wnd->net_dev;
+		skb->protocol = eth_type_trans(skb, wnd->net_dev);
+		pre_atomic_add(wnd->net_stats.rx_bytes, skb_size);
+		atomic_inc_var(wnd->net_stats.rx_packets);
+		if (in_interrupt())
+			netif_rx(skb);
+		else
+			netif_rx_ni(skb);
+	}
+
+	EXIT3(return);
+}
+
+/* called via function pointer */
+wstdcall void NdisMTransferDataComplete(struct ndis_mp_block *nmb,
+					struct ndis_packet *packet,
+					NDIS_STATUS status, UINT bytes_txed)
+{
+	struct ndis_device *wnd = nmb->wnd;
+	struct sk_buff *skb;
+	unsigned int skb_size;
+	struct ndis_packet_oob_data *oob_data;
+	ndis_buffer *buffer;
+	struct ndis_tcp_ip_checksum_packet_info csum;
+
+	ENTER3("wnd = %p, packet = %p, bytes_txed = %d",
+	       wnd, packet, bytes_txed);
+	if (!packet) {
+		WARNING("illegal packet");
+		EXIT3(return);
+	}
+	wnd->net_dev->last_rx = jiffies;
+	oob_data = NDIS_PACKET_OOB_DATA(packet);
+	skb_size = sizeof(oob_data->header) + oob_data->look_ahead_size +
+		bytes_txed;
+	skb = dev_alloc_skb(skb_size);
+	if (!skb) {
+		kfree(oob_data->look_ahead);
+		NdisFreePacket(packet);
+		ERROR("couldn't allocate skb; packet dropped");
+		atomic_inc_var(wnd->net_stats.rx_dropped);
+		EXIT3(return);
+	}
+	memcpy_skb(skb, oob_data->header, sizeof(oob_data->header));
+	memcpy_skb(skb, oob_data->look_ahead, oob_data->look_ahead_size);
+	buffer = packet->private.buffer_head;
+	while (buffer) {
+		memcpy_skb(skb, MmGetSystemAddressForMdl(buffer),
+			   MmGetMdlByteCount(buffer));
+		buffer = buffer->next;
+	}
+	kfree(oob_data->look_ahead);
+	NdisFreePacket(packet);
+	skb->dev = wnd->net_dev;
+	skb->protocol = eth_type_trans(skb, wnd->net_dev);
+	pre_atomic_add(wnd->net_stats.rx_bytes, skb_size);
+	atomic_inc_var(wnd->net_stats.rx_packets);
+
+	csum.value = (typeof(csum.value))(ULONG_PTR)
+		oob_data->ext.info[TcpIpChecksumPacketInfo];
+	TRACE3("0x%05x", csum.value);
+	if (wnd->rx_csum.value &&
+	    (csum.rx.tcp_succeeded || csum.rx.udp_succeeded))
+		skb->ip_summed = CHECKSUM_UNNECESSARY;
+	else
+		skb->ip_summed = CHECKSUM_NONE;
+
+	if (in_interrupt())
+		netif_rx(skb);
+	else
+		netif_rx_ni(skb);
+}
+
+/* called via function pointer */
+wstdcall void EthRxComplete(struct ndis_mp_block *nmb)
+{
+	TRACE3("");
+}
+
+/* called via function pointer */
+wstdcall void NdisMQueryInformationComplete(struct ndis_mp_block *nmb,
+					    NDIS_STATUS status)
+{
+	struct ndis_device *wnd = nmb->wnd;
+	typeof(wnd->ndis_req_task) task;
+
+	ENTER2("nmb: %p, wnd: %p, %08X", nmb, wnd, status);
+	wnd->ndis_req_status = status;
+	wnd->ndis_req_done = 1;
+	if ((task = xchg(&wnd->ndis_req_task, NULL)))
+		wake_up_process(task);
+	else
+		WARNING("invalid task");
+	EXIT2(return);
+}
+
+/* called via function pointer */
+wstdcall void NdisMSetInformationComplete(struct ndis_mp_block *nmb,
+					  NDIS_STATUS status)
+{
+	struct ndis_device *wnd = nmb->wnd;
+	typeof(wnd->ndis_req_task) task;
+
+	ENTER2("status = %08X", status);
+	wnd->ndis_req_status = status;
+	wnd->ndis_req_done = 1;
+	if ((task = xchg(&wnd->ndis_req_task, NULL)))
+		wake_up_process(task);
+	else
+		WARNING("invalid task");
+	EXIT2(return);
+}
+
+/* called via function pointer */
+wstdcall void NdisMResetComplete(struct ndis_mp_block *nmb,
+				 NDIS_STATUS status, BOOLEAN address_reset)
+{
+	struct ndis_device *wnd = nmb->wnd;
+	typeof(wnd->ndis_req_task) task;
+
+	ENTER2("status: %08X, %u", status, address_reset);
+	wnd->ndis_req_status = status;
+	wnd->ndis_req_done = address_reset + 1;
+	if ((task = xchg(&wnd->ndis_req_task, NULL)))
+		wake_up_process(task);
+	else
+		WARNING("invalid task");
+	EXIT2(return);
+}
+
+wstdcall void WIN_FUNC(NdisMSleep,1)
+	(ULONG us)
+{
+	unsigned long delay;
+
+	ENTER4("%p: us: %u", current, us);
+	delay = USEC_TO_HZ(us);
+	sleep_hz(delay);
+	TRACE4("%p: done", current);
+}
+
+wstdcall void WIN_FUNC(NdisGetCurrentSystemTime,1)
+	(LARGE_INTEGER *time)
+{
+	*time = ticks_1601();
+	TRACE5("%Lu, %lu", *time, jiffies);
+}
+
+wstdcall LONG WIN_FUNC(NdisInterlockedDecrement,1)
+	(LONG *val)
+{
+	return InterlockedDecrement(val);
+}
+
+wstdcall LONG WIN_FUNC(NdisInterlockedIncrement,1)
+	(LONG *val)
+{
+	return InterlockedIncrement(val);
+}
+
+wstdcall struct nt_list *WIN_FUNC(NdisInterlockedInsertHeadList,3)
+	(struct nt_list *head, struct nt_list *entry,
+	 struct ndis_spinlock *lock)
+{
+	return ExInterlockedInsertHeadList(head, entry, &lock->klock);
+}
+
+wstdcall struct nt_list *WIN_FUNC(NdisInterlockedInsertTailList,3)
+	(struct nt_list *head, struct nt_list *entry,
+	 struct ndis_spinlock *lock)
+{
+	return ExInterlockedInsertTailList(head, entry, &lock->klock);
+}
+
+wstdcall struct nt_list *WIN_FUNC(NdisInterlockedRemoveHeadList,2)
+	(struct nt_list *head, struct ndis_spinlock *lock)
+{
+	return ExInterlockedRemoveHeadList(head, &lock->klock);
+}
+
+wstdcall NDIS_STATUS WIN_FUNC(NdisMInitializeScatterGatherDma,3)
+	(struct ndis_mp_block *nmb, BOOLEAN dma_size, ULONG max_phy_map)
+{
+	struct ndis_device *wnd = nmb->wnd;
+	ENTER2("dma_size=%d, maxtransfer=%u", dma_size, max_phy_map);
+#ifdef CONFIG_X86_64
+	if (dma_size != NDIS_DMA_64BITS) {
+		TRACE1("DMA size is not 64-bits");
+		if (pci_set_dma_mask(wnd->wd->pci.pdev, DMA_BIT_MASK(32)) ||
+		    pci_set_consistent_dma_mask(wnd->wd->pci.pdev,
+						DMA_BIT_MASK(32)))
+			WARNING("setting dma mask failed");
+	}
+#endif
+	if ((wnd->attributes & NDIS_ATTRIBUTE_BUS_MASTER) &&
+	    wrap_is_pci_bus(wnd->wd->dev_bus)) {
+		wnd->sg_dma_size = max_phy_map;
+		return NDIS_STATUS_SUCCESS;
+	} else
+		EXIT1(return NDIS_STATUS_NOT_SUPPORTED);
+}
+
+wstdcall ULONG WIN_FUNC(NdisMGetDmaAlignment,1)
+	(struct ndis_mp_block *nmb)
+{
+	ENTER3("");
+	return dma_get_cache_alignment();
+}
+
+wstdcall CHAR WIN_FUNC(NdisSystemProcessorCount,0)
+	(void)
+{
+	return (CHAR)NR_CPUS;
+}
+
+wstdcall void WIN_FUNC(NdisGetCurrentProcessorCounts,3)
+	(ULONG *idle, ULONG *kernel_user, ULONG *index)
+{
+	int cpu = smp_processor_id();
+	*idle = kstat_cpu(cpu).cpustat.idle;
+	*kernel_user = kstat_cpu(cpu).cpustat.system +
+		kstat_cpu(cpu).cpustat.user;
+	*index = cpu;
+}
+
+wstdcall void WIN_FUNC(NdisInitializeEvent,1)
+	(struct ndis_event *ndis_event)
+{
+	EVENTENTER("%p", ndis_event);
+	KeInitializeEvent(&ndis_event->nt_event, NotificationEvent, 0);
+}
+
+wstdcall BOOLEAN WIN_FUNC(NdisWaitEvent,2)
+	(struct ndis_event *ndis_event, UINT ms)
+{
+	LARGE_INTEGER ticks;
+	NTSTATUS res;
+
+	EVENTENTER("%p %u", ndis_event, ms);
+	ticks = -((LARGE_INTEGER)ms * TICKSPERMSEC);
+	res = KeWaitForSingleObject(&ndis_event->nt_event, 0, 0, TRUE,
+				    ms == 0 ? NULL : &ticks);
+	if (res == STATUS_SUCCESS)
+		EXIT3(return TRUE);
+	else
+		EXIT3(return FALSE);
+}
+
+wstdcall void WIN_FUNC(NdisSetEvent,1)
+	(struct ndis_event *ndis_event)
+{
+	EVENTENTER("%p", ndis_event);
+	KeSetEvent(&ndis_event->nt_event, 0, 0);
+}
+
+wstdcall void WIN_FUNC(NdisResetEvent,1)
+	(struct ndis_event *ndis_event)
+{
+	EVENTENTER("%p", ndis_event);
+	KeResetEvent(&ndis_event->nt_event);
+}
+
+static void ndis_worker(worker_param_t dummy)
+{
+	struct nt_list *ent;
+	struct ndis_work_item *ndis_work_item;
+
+	WORKENTER("");
+	while (1) {
+		spin_lock_bh(&ndis_work_list_lock);
+		ent = RemoveHeadList(&ndis_work_list);
+		spin_unlock_bh(&ndis_work_list_lock);
+		if (!ent)
+			break;
+		ndis_work_item = container_of(ent, struct ndis_work_item, list);
+		WORKTRACE("%p: %p, %p", ndis_work_item,
+			  ndis_work_item->func, ndis_work_item->ctx);
+		LIN2WIN2(ndis_work_item->func, ndis_work_item,
+			 ndis_work_item->ctx);
+		WORKTRACE("%p done", ndis_work_item);
+	}
+	WORKEXIT(return);
+}
+
+wstdcall NDIS_STATUS WIN_FUNC(NdisScheduleWorkItem,1)
+	(struct ndis_work_item *ndis_work_item)
+{
+	ENTER3("%p", ndis_work_item);
+	spin_lock_bh(&ndis_work_list_lock);
+	InsertTailList(&ndis_work_list, &ndis_work_item->list);
+	spin_unlock_bh(&ndis_work_list_lock);
+	WORKTRACE("scheduling %p", ndis_work_item);
+	schedule_ndis_work(&ndis_work);
+	EXIT3(return NDIS_STATUS_SUCCESS);
+}
+
+wstdcall void WIN_FUNC(NdisMGetDeviceProperty,6)
+	(struct ndis_mp_block *nmb, void **phy_dev, void **func_dev,
+	 void **next_dev, void **alloc_res, void**trans_res)
+{
+	ENTER2("nmb: %p, phy_dev = %p, func_dev = %p, next_dev = %p, "
+	       "alloc_res = %p, trans_res = %p", nmb, phy_dev, func_dev,
+	       next_dev, alloc_res, trans_res);
+	if (phy_dev)
+		*phy_dev = nmb->pdo;
+	if (func_dev)
+		*func_dev = nmb->fdo;
+	if (next_dev)
+		*next_dev = nmb->next_device;
+}
+
+wstdcall void WIN_FUNC(NdisMRegisterUnloadHandler,2)
+	(struct driver_object *drv_obj, void *unload)
+{
+	if (drv_obj)
+		drv_obj->unload = unload;
+	return;
+}
+
+wstdcall UINT WIN_FUNC(NdisGetVersion,0)
+	(void)
+{
+	return 0x00050001;
+}
+
+wstdcall NDIS_STATUS WIN_FUNC(NdisMQueryAdapterInstanceName,2)
+	(struct unicode_string *name, struct ndis_mp_block *nmb)
+{
+	struct ndis_device *wnd = nmb->wnd;
+	struct ansi_string ansi;
+
+	if (wrap_is_pci_bus(wnd->wd->dev_bus))
+		RtlInitAnsiString(&ansi, "PCI Ethernet Adapter");
+	else
+		RtlInitAnsiString(&ansi, "USB Ethernet Adapter");
+
+	if (RtlAnsiStringToUnicodeString(name, &ansi, TRUE))
+		EXIT2(return NDIS_STATUS_RESOURCES);
+	else
+		EXIT2(return NDIS_STATUS_SUCCESS);
+}
+
+wstdcall NDIS_STATUS WIN_FUNC(NdisWriteEventLogEntry,7)
+	(void *handle, NDIS_STATUS code, ULONG value, USHORT n,
+	 void *strings, ULONG datasize, void *data)
+{
+	TRACE1("0x%x, 0x%x, %u, %u", code, value, n, datasize);
+	return NDIS_STATUS_SUCCESS;
+}
+
+wstdcall void *WIN_FUNC(NdisGetRoutineAddress,1)
+	(struct unicode_string *unicode_string)
+{
+	struct ansi_string ansi_string;
+	void *address;
+
+	if (RtlUnicodeStringToAnsiString(&ansi_string, unicode_string, TRUE) !=
+	    STATUS_SUCCESS)
+		EXIT1(return NULL);
+	INFO("%s", ansi_string.buf);
+	address = ndis_get_routine_address(ansi_string.buf);
+	RtlFreeAnsiString(&ansi_string);
+	return address;
+}
+
+wstdcall ULONG WIN_FUNC(NdisReadPcmciaAttributeMemory,4)
+	(struct ndis_mp_block *nmb, ULONG offset, void *buffer,
+	 ULONG length)
+{
+	TODO();
+	return 0;
+}
+
+wstdcall ULONG WIN_FUNC(NdisWritePcmciaAttributeMemory,4)
+	(struct ndis_mp_block *nmb, ULONG offset, void *buffer,
+	 ULONG length)
+{
+	TODO();
+	return 0;
+}
+
+wstdcall void WIN_FUNC(NdisMCoIndicateReceivePacket,3)
+	(struct ndis_mp_block *nmb, struct ndis_packet **packets,
+	 UINT nr_packets)
+{
+	ENTER3("nmb = %p", nmb);
+	NdisMIndicateReceivePacket(nmb, packets, nr_packets);
+	EXIT3(return);
+}
+
+wstdcall void WIN_FUNC(NdisMCoSendComplete,3)
+	(NDIS_STATUS status, struct ndis_mp_block *nmb,
+	 struct ndis_packet *packet)
+{
+	ENTER3("%08x", status);
+	NdisMSendComplete(nmb, packet, status);
+	EXIT3(return);
+}
+
+wstdcall void WIN_FUNC(NdisMCoRequestComplete,3)
+	(NDIS_STATUS status, struct ndis_mp_block *nmb,
+	 struct ndis_request *ndis_request)
+{
+	struct ndis_device *wnd = nmb->wnd;
+	typeof(wnd->ndis_req_task) task;
+
+	ENTER3("%08X", status);
+	wnd->ndis_req_status = status;
+	wnd->ndis_req_done = 1;
+	if ((task = xchg(&wnd->ndis_req_task, NULL)))
+		wake_up_process(task);
+	else
+		WARNING("invalid task");
+	EXIT3(return);
+}
+
+wstdcall NDIS_STATUS WIN_FUNC(NdisIMNotifiyPnPEvent,2)
+	(struct ndis_mp_block *nmb, struct net_pnp_event *event)
+{
+	ENTER2("%p, %d", nmb, event->code);
+	/* NdisWrapper never calls protocol's pnp event notifier, so
+	 * nothing to do here */
+	EXIT2(return NDIS_STATUS_SUCCESS);
+}
+
+wstdcall void WIN_FUNC(NdisCompletePnPEvent,2)
+	(NDIS_STATUS status, void *handle, struct net_pnp_event *event)
+{
+	ENTER2("%d, %p, %d", status, handle, event->code);
+	/* NdisWrapper never calls protocol's pnp event notifier, so
+	 * nothing to do here */
+	EXIT2(return);
+}
+
+wstdcall NDIS_STATUS WIN_FUNC(NdisMSetMiniportSecondary,2)
+	(struct ndis_mp_block *nmb2, struct ndis_mp_block *nmb1)
+{
+	ENTER3("%p, %p", nmb1, nmb2);
+	TODO();
+	EXIT3(return NDIS_STATUS_SUCCESS);
+}
+
+wstdcall NDIS_STATUS WIN_FUNC(NdisMPromoteMiniport,1)
+	(struct ndis_mp_block *nmb)
+{
+	ENTER3("%p", nmb);
+	TODO();
+	EXIT3(return NDIS_STATUS_SUCCESS);
+}
+
+wstdcall void WIN_FUNC(NdisMCoActivateVcComplete,3)
+	(NDIS_STATUS status, void *handle, void *params)
+{
+	TODO();
+}
+
+wstdcall void WIN_FUNC(NdisMCoDeactivateVcComplete,2)
+	(NDIS_STATUS status, void *handle)
+{
+	TODO();
+}
+
+wstdcall void WIN_FUNC(NdisMRemoveMiniport,1)
+	(void *handle)
+{
+	TODO();
+}
+
+static void *ndis_get_routine_address(char *name)
+{
+	int i;
+	ENTER2("%p", name);
+	for (i = 0; i < sizeof(ndis_exports) / sizeof(ndis_exports[0]); i++) {
+		if (strcmp(name, ndis_exports[i].name) == 0) {
+			TRACE2("%p", ndis_exports[i].func);
+			return ndis_exports[i].func;
+		}
+	}
+	EXIT2(return NULL);
+}
+
+/* ndis_init_device is called for each device */
+int ndis_init_device(struct ndis_device *wnd)
+{
+	struct ndis_mp_block *nmb = wnd->nmb;
+
+	KeInitializeSpinLock(&nmb->lock);
+	wnd->mp_interrupt = NULL;
+	wnd->wrap_timer_slist.next = NULL;
+	if (wnd->wd->driver->ndis_driver)
+		wnd->wd->driver->ndis_driver->mp.shutdown = NULL;
+
+	nmb->filterdbs.eth_db = nmb;
+	nmb->filterdbs.tr_db = nmb;
+	nmb->filterdbs.fddi_db = nmb;
+	nmb->filterdbs.arc_db = nmb;
+
+	nmb->rx_packet = WIN_FUNC_PTR(NdisMIndicateReceivePacket,3);
+	nmb->send_complete = WIN_FUNC_PTR(NdisMSendComplete,3);
+	nmb->send_resource_avail = WIN_FUNC_PTR(NdisMSendResourcesAvailable,1);
+	nmb->status = WIN_FUNC_PTR(NdisMIndicateStatus,4);
+	nmb->status_complete = WIN_FUNC_PTR(NdisMIndicateStatusComplete,1);
+	nmb->queryinfo_complete = WIN_FUNC_PTR(NdisMQueryInformationComplete,2);
+	nmb->setinfo_complete = WIN_FUNC_PTR(NdisMSetInformationComplete,2);
+	nmb->reset_complete = WIN_FUNC_PTR(NdisMResetComplete,3);
+	nmb->eth_rx_indicate = WIN_FUNC_PTR(EthRxIndicateHandler,8);
+	nmb->eth_rx_complete = WIN_FUNC_PTR(EthRxComplete,1);
+	nmb->td_complete = WIN_FUNC_PTR(NdisMTransferDataComplete,4);
+	return 0;
+}
+
+/* ndis_exit_device is called for each device */
+void ndis_exit_device(struct ndis_device *wnd)
+{
+	struct wrap_device_setting *setting;
+	ENTER2("%p", wnd);
+	if (down_interruptible(&loader_mutex))
+		WARNING("couldn't obtain loader_mutex");
+	nt_list_for_each_entry(setting, &wnd->wd->settings, list) {
+		struct ndis_configuration_parameter *param;
+		param = setting->encoded;
+		if (param) {
+			if (param->type == NdisParameterString)
+				RtlFreeUnicodeString(&param->data.string);
+			ExFreePool(param);
+			setting->encoded = NULL;
+		}
+	}
+	up(&loader_mutex);
+}
+
+/* ndis_init is called once when module is loaded */
+int ndis_init(void)
+{
+	InitializeListHead(&ndis_work_list);
+	spin_lock_init(&ndis_work_list_lock);
+	initialize_work(&ndis_work, ndis_worker, NULL);
+
+	ndis_wq = create_singlethread_workqueue("ndis_wq");
+	if (!ndis_wq) {
+		WARNING("couldn't create worker thread");
+		EXIT1(return -ENOMEM);
+	}
+
+	ndis_worker_thread = wrap_worker_init(ndis_wq);
+	TRACE1("%p", ndis_worker_thread);
+	return 0;
+}
+
+/* ndis_exit is called once when module is removed */
+void ndis_exit(void)
+{
+	ENTER1("");
+	if (ndis_wq)
+		destroy_workqueue(ndis_wq);
+	TRACE1("%p", ndis_worker_thread);
+	if (ndis_worker_thread)
+		ObDereferenceObject(ndis_worker_thread);
+	EXIT1(return);
+}
--- linux-rt-2.6.31.orig/ubuntu/ndiswrapper/pnp.c
+++ linux-rt-2.6.31/ubuntu/ndiswrapper/pnp.c
@@ -0,0 +1,742 @@
+/*
+ *  Copyright (C) 2005 Giridhar Pemmasani
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ *  GNU General Public License for more details.
+ *
+ */
+
+#include "usb.h"
+#include "pnp.h"
+#include "wrapndis.h"
+#include "loader.h"
+
+/* Functions callable from the NDIS driver */
+wstdcall NTSTATUS pdoDispatchDeviceControl(struct device_object *pdo,
+					   struct irp *irp);
+wstdcall NTSTATUS pdoDispatchPnp(struct device_object *pdo, struct irp *irp);
+wstdcall NTSTATUS pdoDispatchPower(struct device_object *pdo, struct irp *irp);
+
+static NTSTATUS start_pdo(struct device_object *pdo)
+{
+	int i, ret, count, resources_size;
+	struct wrap_device *wd;
+	struct pci_dev *pdev;
+	struct cm_partial_resource_descriptor *entry;
+	struct cm_partial_resource_list *partial_resource_list;
+
+	ENTER1("%p, %p", pdo, pdo->reserved);
+	wd = pdo->reserved;
+	if (ntoskernel_init_device(wd))
+		EXIT1(return STATUS_FAILURE);
+	if (wrap_is_usb_bus(wd->dev_bus)) {
+#ifdef ENABLE_USB
+		if (usb_init_device(wd)) {
+			ntoskernel_exit_device(wd);
+			EXIT1(return STATUS_FAILURE);
+		}
+#endif
+		EXIT1(return STATUS_SUCCESS);
+	}
+	if (!wrap_is_pci_bus(wd->dev_bus))
+		EXIT1(return STATUS_SUCCESS);
+	pdev = wd->pci.pdev;
+	ret = pci_enable_device(pdev);
+	if (ret) {
+		ERROR("couldn't enable PCI device: %x", ret);
+		return STATUS_FAILURE;
+	}
+	ret = pci_request_regions(pdev, DRIVER_NAME);
+	if (ret) {
+		ERROR("couldn't request PCI regions: %x", ret);
+		goto err_enable;
+	}
+	pci_set_power_state(pdev, PCI_D0);
+#ifdef CONFIG_X86_64
+	/* 64-bit broadcom driver doesn't work if DMA is allocated
+	 * from over 1GB */
+	if (wd->vendor == 0x14e4) {
+		if (pci_set_dma_mask(pdev, DMA_BIT_MASK(30)) ||
+		    pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(30)))
+			WARNING("couldn't set DMA mask; this driver "
+				"may not work with more than 1GB RAM");
+	}
+#endif
+	/* IRQ resource entry is filled in from pdev, instead of
+	 * pci_resource macros */
+	for (i = count = 0; pci_resource_start(pdev, i); i++)
+		if ((pci_resource_flags(pdev, i) & IORESOURCE_MEM) ||
+		    (pci_resource_flags(pdev, i) & IORESOURCE_IO))
+			count++;
+	/* space for entry for IRQ is already in
+	 * cm_partial_resource_list */
+	resources_size = sizeof(struct cm_resource_list) +
+		sizeof(struct cm_partial_resource_descriptor) * count;
+	TRACE2("resources: %d, %d", count, resources_size);
+	wd->resource_list = kzalloc(resources_size, GFP_KERNEL);
+	if (!wd->resource_list) {
+		WARNING("couldn't allocate memory");
+		goto err_regions;
+	}
+	wd->resource_list->count = 1;
+	wd->resource_list->list[0].interface_type = PCIBus;
+	/* bus_number is not used by WDM drivers */
+	wd->resource_list->list[0].bus_number = pdev->bus->number;
+
+	partial_resource_list =
+		&wd->resource_list->list->partial_resource_list;
+	partial_resource_list->version = 1;
+	partial_resource_list->revision = 1;
+	partial_resource_list->count = count + 1;
+
+	for (i = count = 0; pci_resource_start(pdev, i); i++) {
+		entry = &partial_resource_list->partial_descriptors[count];
+		TRACE2("%d", count);
+		if (pci_resource_flags(pdev, i) & IORESOURCE_MEM) {
+			entry->type = CmResourceTypeMemory;
+			entry->flags = CM_RESOURCE_MEMORY_READ_WRITE;
+			entry->share = CmResourceShareDeviceExclusive;
+		} else if (pci_resource_flags(pdev, i) & IORESOURCE_IO) {
+			entry->type = CmResourceTypePort;
+			entry->flags = CM_RESOURCE_PORT_IO;
+			entry->share = CmResourceShareDeviceExclusive;
+#if 0
+		} else if (pci_resource_flags(pdev, i) & IORESOURCE_DMA) {
+			/* it looks like no driver uses this resource */
+			typeof(pci_resource_flags(pdev, 0)) flags;
+			entry->type = CmResourceTypeDma;
+			flags = pci_resource_flags(pdev, i);
+			if (flags & IORESOURCE_DMA_TYPEA)
+				entry->flags |= CM_RESOURCE_DMA_TYPE_A;
+			else if (flags & IORESOURCE_DMA_TYPEB)
+				entry->flags |= CM_RESOURCE_DMA_TYPE_B;
+			else if (flags & IORESOURCE_DMA_TYPEF)
+				entry->flags |= CM_RESOURCE_DMA_TYPE_F;
+			if (flags & IORESOURCE_DMA_8BIT)
+				entry->flags |= CM_RESOURCE_DMA_8;
+			else if (flags & IORESOURCE_DMA_16BIT)
+				entry->flags |= CM_RESOURCE_DMA_16;
+			/* what about 32bit DMA? */
+			else if (flags & IORESOURCE_DMA_8AND16BIT)
+				entry->flags |= CM_RESOURCE_DMA_8_AND_16;
+			if (flags & IORESOURCE_DMA_MASTER)
+				entry->flags |= CM_RESOURCE_DMA_BUS_MASTER;
+			entry->u.dma.channel = pci_resource_start(pdev, i);
+			/* what should this be? */
+			entry->u.dma.port = 1;
+#endif
+		} else
+			continue;
+		/* TODO: Add other resource types? */
+		entry->u.generic.start =
+			(ULONG_PTR)pci_resource_start(pdev, i);
+		entry->u.generic.length = pci_resource_len(pdev, i);
+		count++;
+	}
+
+	/* put IRQ resource at the end */
+	entry = &partial_resource_list->partial_descriptors[count++];
+	entry->type = CmResourceTypeInterrupt;
+	entry->flags = CM_RESOURCE_INTERRUPT_LEVEL_SENSITIVE;
+	/* we assume all devices use shared IRQ */
+	entry->share = CmResourceShareShared;
+	/* as per documentation, interrupt level should be DIRQL, but
+	 * examples from DDK as well some drivers, such as AR5211,
+	 * RT8180L use interrupt level as interrupt vector also in
+	 * NdisMRegisterInterrupt */
+	entry->u.interrupt.level = pdev->irq;
+	entry->u.interrupt.vector = pdev->irq;
+	entry->u.interrupt.affinity = -1;
+
+	TRACE2("resource list count %d, irq: %d",
+	       partial_resource_list->count, pdev->irq);
+	pci_set_drvdata(pdev, wd);
+	EXIT1(return STATUS_SUCCESS);
+err_regions:
+	pci_release_regions(pdev);
+err_enable:
+	pci_disable_device(pdev);
+	wd->pci.pdev = NULL;
+	wd->pdo = NULL;
+	EXIT1(return STATUS_FAILURE);
+}
+
+static void remove_pdo(struct device_object *pdo)
+{
+	struct wrap_device *wd = pdo->reserved;
+
+	ntoskernel_exit_device(wd);
+	if (wrap_is_pci_bus(wd->dev_bus)) {
+		struct pci_dev *pdev = wd->pci.pdev;
+		pci_release_regions(pdev);
+		pci_disable_device(pdev);
+		wd->pci.pdev = NULL;
+		pci_set_drvdata(pdev, NULL);
+	} else if (wrap_is_usb_bus(wd->dev_bus)) {
+#ifdef ENABLE_USB
+		usb_exit_device(wd);
+#endif
+	}
+	if (wd->resource_list)
+		kfree(wd->resource_list);
+	wd->resource_list = NULL;
+	return;
+}
+
+static NTSTATUS IoSendIrpTopDev(struct device_object *dev_obj, ULONG major_fn,
+				ULONG minor_fn, struct io_stack_location *sl)
+{
+	NTSTATUS status;
+	struct nt_event event;
+	struct irp *irp;
+	struct io_stack_location *irp_sl;
+	struct device_object *top_dev = IoGetAttachedDeviceReference(dev_obj);
+
+	KeInitializeEvent(&event, NotificationEvent, FALSE);
+	irp = IoBuildSynchronousFsdRequest(IRP_MJ_PNP, top_dev, NULL, 0, NULL,
+					   &event, NULL);
+	irp->io_status.status = STATUS_NOT_IMPLEMENTED;
+	irp->io_status.info = 0;
+	irp_sl = IoGetNextIrpStackLocation(irp);
+	if (sl)
+		memcpy(irp_sl, sl, sizeof(*irp_sl));
+	irp_sl->major_fn = major_fn;
+	irp_sl->minor_fn = minor_fn;
+	status = IoCallDriver(top_dev, irp);
+	if (status == STATUS_PENDING) {
+		KeWaitForSingleObject(&event, Executive, KernelMode,
+				      FALSE, NULL);
+		status = irp->io_status.status;
+	}
+	ObDereferenceObject(top_dev);
+	return status;
+}
+
+wstdcall NTSTATUS pdoDispatchDeviceControl(struct device_object *pdo,
+					   struct  irp *irp)
+{
+	struct io_stack_location *irp_sl;
+	NTSTATUS status;
+
+	DUMP_IRP(irp);
+	irp_sl = IoGetCurrentIrpStackLocation(irp);
+#ifdef ENABLE_USB
+	status = wrap_submit_irp(pdo, irp);
+	IOTRACE("status: %08X", status);
+	if (status != STATUS_PENDING)
+		IoCompleteRequest(irp, IO_NO_INCREMENT);
+#else
+	status = irp->io_status.status = STATUS_NOT_IMPLEMENTED;
+	IoCompleteRequest(irp, IO_NO_INCREMENT);
+#endif
+	IOEXIT(return status);
+}
+WIN_FUNC_DECL(pdoDispatchDeviceControl,2)
+
+wstdcall NTSTATUS pdoDispatchPnp(struct device_object *pdo, struct irp *irp)
+{
+	struct io_stack_location *irp_sl;
+	struct wrap_device *wd;
+	NTSTATUS status;
+#ifdef ENABLE_USB
+	struct usbd_bus_interface_usbdi *usb_intf;
+#endif
+
+	irp_sl = IoGetCurrentIrpStackLocation(irp);
+	TRACE2("%p %d:%d", pdo, irp_sl->major_fn, irp_sl->minor_fn);
+	wd = pdo->reserved;
+	switch (irp_sl->minor_fn) {
+	case IRP_MN_START_DEVICE:
+		status = start_pdo(pdo);
+		break;
+	case IRP_MN_QUERY_STOP_DEVICE:
+	case IRP_MN_STOP_DEVICE:
+	case IRP_MN_QUERY_REMOVE_DEVICE:
+		status = STATUS_SUCCESS;
+		break;
+	case IRP_MN_REMOVE_DEVICE:
+		remove_pdo(pdo);
+		status = STATUS_SUCCESS;
+		break;
+	case IRP_MN_QUERY_INTERFACE:
+#ifdef ENABLE_USB
+		if (!wrap_is_usb_bus(wd->dev_bus)) {
+			status = STATUS_NOT_IMPLEMENTED;
+			break;
+		}
+		TRACE2("type: %x, size: %d, version: %d",
+		       irp_sl->params.query_intf.type->data1,
+		       irp_sl->params.query_intf.size,
+		       irp_sl->params.query_intf.version);
+		usb_intf = (struct usbd_bus_interface_usbdi *)
+			irp_sl->params.query_intf.intf;
+		usb_intf->Context = wd;
+		usb_intf->InterfaceReference = USBD_InterfaceReference;
+		usb_intf->InterfaceDereference = USBD_InterfaceDereference;
+		usb_intf->GetUSBDIVersion = USBD_InterfaceGetUSBDIVersion;
+		usb_intf->QueryBusTime = USBD_InterfaceQueryBusTime;
+		usb_intf->SubmitIsoOutUrb = USBD_InterfaceSubmitIsoOutUrb;
+		usb_intf->QueryBusInformation =
+			USBD_InterfaceQueryBusInformation;
+		if (irp_sl->params.query_intf.version >=
+		    USB_BUSIF_USBDI_VERSION_1)
+			usb_intf->IsDeviceHighSpeed =
+				USBD_InterfaceIsDeviceHighSpeed;
+		if (irp_sl->params.query_intf.version >=
+		    USB_BUSIF_USBDI_VERSION_2)
+			usb_intf->LogEntry = USBD_InterfaceLogEntry;
+		status = STATUS_SUCCESS;
+#else
+		status = STATUS_NOT_IMPLEMENTED;
+#endif
+		break;
+	default:
+		TRACE2("fn %d not implemented", irp_sl->minor_fn);
+		status = STATUS_SUCCESS;
+		break;
+	}
+	irp->io_status.status = status;
+	TRACE2("status: %08X", status);
+	IoCompleteRequest(irp, IO_NO_INCREMENT);
+	IOEXIT(return status);
+}
+WIN_FUNC_DECL(pdoDispatchPnp,2)
+
+wstdcall NTSTATUS pdoDispatchPower(struct device_object *pdo, struct irp *irp)
+{
+	struct io_stack_location *irp_sl;
+	struct wrap_device *wd;
+	union power_state power_state;
+	struct pci_dev *pdev;
+	NTSTATUS status;
+
+	irp_sl = IoGetCurrentIrpStackLocation(irp);
+	wd = pdo->reserved;
+	TRACE2("pdo: %p, fn: %d:%d, wd: %p",
+	       pdo, irp_sl->major_fn, irp_sl->minor_fn, wd);
+	switch (irp_sl->minor_fn) {
+	case IRP_MN_WAIT_WAKE:
+		/* TODO: this is not complete/correct */
+		TRACE2("state: %d, completion: %p",
+			  irp_sl->params.power.state.system_state,
+			  irp_sl->completion_routine);
+		IoMarkIrpPending(irp);
+		status = STATUS_PENDING;
+		break;
+	case IRP_MN_SET_POWER:
+		power_state = irp_sl->params.power.state;
+		if (power_state.device_state == PowerDeviceD0) {
+			TRACE2("resuming %p", wd);
+			if (wrap_is_pci_bus(wd->dev_bus)) {
+				pdev = wd->pci.pdev;
+				pci_restore_state(pdev);
+				if (wd->pci.wake_state == PowerDeviceD3) {
+					pci_enable_wake(wd->pci.pdev,
+							PCI_D3hot, 0);
+					pci_enable_wake(wd->pci.pdev,
+							PCI_D3cold, 0);
+				}
+				pci_set_power_state(pdev, PCI_D0);
+			} else { // usb device
+#ifdef ENABLE_USB
+				wrap_resume_urbs(wd);
+#endif
+			}
+		} else {
+			TRACE2("suspending device %p", wd);
+			if (wrap_is_pci_bus(wd->dev_bus)) {
+				pdev = wd->pci.pdev;
+				pci_save_state(pdev);
+				TRACE2("%d", wd->pci.wake_state);
+				if (wd->pci.wake_state == PowerDeviceD3) {
+					pci_enable_wake(wd->pci.pdev,
+							PCI_D3hot, 1);
+					pci_enable_wake(wd->pci.pdev,
+							PCI_D3cold, 1);
+				}
+				pci_set_power_state(pdev, PCI_D3hot);
+			} else { // usb device
+#ifdef ENABLE_USB
+				wrap_suspend_urbs(wd);
+#endif
+			}
+		}
+		status = STATUS_SUCCESS;
+		break;
+	case IRP_MN_QUERY_POWER:
+		status = STATUS_SUCCESS;
+		break;
+	default:
+		TRACE2("fn %d not implemented", irp_sl->minor_fn);
+		status = STATUS_SUCCESS;
+		break;
+	}
+	irp->io_status.status = status;
+	IoCompleteRequest(irp, IO_NO_INCREMENT);
+	return status;
+}
+WIN_FUNC_DECL(pdoDispatchPower,2)
+
+static NTSTATUS pnp_set_device_power_state(struct wrap_device *wd,
+					   enum device_power_state state)
+{
+	NTSTATUS status;
+	struct device_object *pdo;
+	struct io_stack_location irp_sl;
+
+	pdo = wd->pdo;
+	IOTRACE("%p, %p", pdo, IoGetAttachedDevice(pdo));
+	memset(&irp_sl, 0, sizeof(irp_sl));
+	irp_sl.params.power.state.device_state = state;
+	irp_sl.params.power.type = DevicePowerState;
+	if (state > PowerDeviceD0) {
+		status = IoSendIrpTopDev(pdo, IRP_MJ_POWER, IRP_MN_QUERY_POWER,
+					 &irp_sl);
+		if (status != STATUS_SUCCESS) {
+			TRACE1("query of power to %d returns %08X",
+			       state, status);
+			EXIT1(return status);
+		}
+	}
+	status = IoSendIrpTopDev(pdo, IRP_MJ_POWER, IRP_MN_SET_POWER, &irp_sl);
+	if (status != STATUS_SUCCESS)
+		WARNING("setting power to %d failed: %08X", state, status);
+	EXIT1(return status);
+}
+
+NTSTATUS pnp_start_device(struct wrap_device *wd)
+{
+	struct device_object *fdo;
+	struct device_object *pdo;
+	struct io_stack_location irp_sl;
+	NTSTATUS status;
+
+	pdo = wd->pdo;
+	/* TODO: for now we use same resources for both translated
+	 * resources and raw resources */
+	memset(&irp_sl, 0, sizeof(irp_sl));
+	irp_sl.params.start_device.allocated_resources =
+		wd->resource_list;
+	irp_sl.params.start_device.allocated_resources_translated =
+		wd->resource_list;
+	status = IoSendIrpTopDev(pdo, IRP_MJ_PNP, IRP_MN_START_DEVICE, &irp_sl);
+	fdo = IoGetAttachedDevice(pdo);
+	if (status == STATUS_SUCCESS)
+		fdo->drv_obj->drv_ext->count++;
+	else
+		WARNING("Windows driver couldn't initialize the device (%08X)",
+			status);
+	EXIT1(return status);
+}
+
+NTSTATUS pnp_stop_device(struct wrap_device *wd)
+{
+	struct device_object *pdo;
+	NTSTATUS status;
+
+	pdo = wd->pdo;
+	status = IoSendIrpTopDev(pdo, IRP_MJ_PNP, IRP_MN_QUERY_STOP_DEVICE,
+				 NULL);
+	if (status != STATUS_SUCCESS)
+		WARNING("status: %08X", status);
+	/* for now we ignore query status */
+	status = IoSendIrpTopDev(pdo, IRP_MJ_PNP, IRP_MN_STOP_DEVICE, NULL);
+	if (status != STATUS_SUCCESS)
+		WARNING("status: %08X", status);
+	if (status != STATUS_SUCCESS)
+		WARNING("status: %08X", status);
+	EXIT2(return status);
+}
+
+NTSTATUS pnp_remove_device(struct wrap_device *wd)
+{
+	struct device_object *pdo, *fdo;
+	struct driver_object *fdo_drv_obj;
+	NTSTATUS status;
+
+	pdo = wd->pdo;
+	fdo = IoGetAttachedDevice(pdo);
+	fdo_drv_obj = fdo->drv_obj;
+	TRACE2("%p, %p, %p", pdo, fdo, fdo_drv_obj);
+	status = IoSendIrpTopDev(pdo, IRP_MJ_PNP, IRP_MN_QUERY_REMOVE_DEVICE,
+				 NULL);
+	if (status != STATUS_SUCCESS)
+		WARNING("status: %08X", status);
+
+	status = IoSendIrpTopDev(pdo, IRP_MJ_PNP, IRP_MN_REMOVE_DEVICE, NULL);
+	if (status != STATUS_SUCCESS)
+		WARNING("status: %08X", status);
+	/* TODO: should we use count in drv_ext or driver's Object
+	 * header reference count to keep count of devices associated
+	 * with a driver? */
+	if (status == STATUS_SUCCESS)
+		fdo_drv_obj->drv_ext->count--;
+	TRACE1("count: %d", fdo_drv_obj->drv_ext->count);
+	if (fdo_drv_obj->drv_ext->count < 0)
+		WARNING("wrong count: %d", fdo_drv_obj->drv_ext->count);
+	if (fdo_drv_obj->drv_ext->count == 0) {
+		struct wrap_driver *wrap_driver;
+		TRACE1("unloading driver: %p", fdo_drv_obj);
+		wrap_driver =
+			IoGetDriverObjectExtension(fdo_drv_obj,
+					   (void *)WRAP_DRIVER_CLIENT_ID);
+		if (fdo_drv_obj->unload)
+			LIN2WIN1(fdo_drv_obj->unload, fdo_drv_obj);
+		if (wrap_driver) {
+			if (down_interruptible(&loader_mutex))
+				WARNING("couldn't obtain loader_mutex");
+			unload_wrap_driver(wrap_driver);
+			up(&loader_mutex);
+		} else
+			ERROR("couldn't get wrap_driver");
+		ObDereferenceObject(fdo_drv_obj);
+	}
+	IoDeleteDevice(pdo);
+	unload_wrap_device(wd);
+	EXIT1(return status);
+}
+
+WIN_FUNC_DECL(IoInvalidDeviceRequest,2)
+
+static struct device_object *alloc_pdo(struct driver_object *drv_obj)
+{
+	struct device_object *pdo;
+	NTSTATUS status ;
+	int i;
+	struct ansi_string ansi_name;
+	struct unicode_string unicode_name;
+
+	RtlInitAnsiString(&ansi_name, "NDISpdo");
+	if (RtlAnsiStringToUnicodeString(&unicode_name, &ansi_name, TRUE) ==
+	    STATUS_SUCCESS) {
+		status = IoCreateDevice(drv_obj, 0, &unicode_name,
+					FILE_DEVICE_UNKNOWN,
+					FILE_AUTOGENERATED_DEVICE_NAME,
+					FALSE, &pdo);
+		RtlFreeUnicodeString(&unicode_name);
+	} else {
+		status = IoCreateDevice(drv_obj, 0, NULL,
+					FILE_DEVICE_UNKNOWN,
+					FILE_AUTOGENERATED_DEVICE_NAME,
+					FALSE, &pdo);
+	}
+	TRACE1("%p, %d, %p", drv_obj, status, pdo);
+	if (status != STATUS_SUCCESS)
+		return NULL;
+	/* dispatch routines are called as Windows functions */
+	for (i = 0; i <= IRP_MJ_MAXIMUM_FUNCTION; i++)
+		drv_obj->major_func[i] = WIN_FUNC_PTR(IoInvalidDeviceRequest,2);
+	drv_obj->major_func[IRP_MJ_INTERNAL_DEVICE_CONTROL] =
+		WIN_FUNC_PTR(pdoDispatchDeviceControl,2);
+	drv_obj->major_func[IRP_MJ_DEVICE_CONTROL] =
+		WIN_FUNC_PTR(pdoDispatchDeviceControl,2);
+	drv_obj->major_func[IRP_MJ_POWER] = WIN_FUNC_PTR(pdoDispatchPower,2);
+	drv_obj->major_func[IRP_MJ_PNP] = WIN_FUNC_PTR(pdoDispatchPnp,2);
+	return pdo;
+}
+
+static int wrap_pnp_start_device(struct wrap_device *wd)
+{
+	struct wrap_driver *driver;
+	struct device_object *pdo;
+	struct driver_object *pdo_drv_obj;
+
+	ENTER1("wd: %p", wd);
+
+	if (!((wrap_is_pci_bus(wd->dev_bus)) ||
+	      (wrap_is_usb_bus(wd->dev_bus)))) {
+		ERROR("bus type %d (%d) not supported",
+		      WRAP_BUS(wd->dev_bus), wd->dev_bus);
+		EXIT1(return -EINVAL);
+	}
+	driver = load_wrap_driver(wd);
+	if (!driver)
+		return -ENODEV;
+
+	wd->driver = driver;
+	wd->dev_bus = WRAP_DEVICE_BUS(driver->dev_type, WRAP_BUS(wd->dev_bus));
+	TRACE1("dev type: %d, bus type: %d, %d", WRAP_DEVICE(wd->dev_bus),
+	       WRAP_BUS(wd->dev_bus), wd->dev_bus);
+	TRACE1("%d, %d", driver->dev_type, wrap_is_usb_bus(wd->dev_bus));
+	/* first create pdo */
+	if (wrap_is_pci_bus(wd->dev_bus))
+		pdo_drv_obj = find_bus_driver("PCI");
+	else // if (wrap_is_usb_bus(wd->dev_bus))
+		pdo_drv_obj = find_bus_driver("USB");
+	if (!pdo_drv_obj)
+		return -EINVAL;
+	pdo = alloc_pdo(pdo_drv_obj);
+	if (!pdo)
+		return -ENOMEM;
+	wd->pdo = pdo;
+	pdo->reserved = wd;
+	if (WRAP_DEVICE(wd->dev_bus) == WRAP_NDIS_DEVICE) {
+		if (init_ndis_driver(driver->drv_obj)) {
+			IoDeleteDevice(pdo);
+			return -EINVAL;
+		}
+	}
+	TRACE1("%p", driver->drv_obj->drv_ext->add_device);
+	if (driver->drv_obj->drv_ext->add_device(driver->drv_obj, pdo) !=
+	    STATUS_SUCCESS) {
+		IoDeleteDevice(pdo);
+		return -ENOMEM;
+	}
+	if (pnp_start_device(wd) != STATUS_SUCCESS) {
+		/* TODO: we need proper cleanup, to deallocate memory,
+		 * for example */
+		pnp_remove_device(wd);
+		return -EINVAL;
+	}
+	return 0;
+}
+
+/*
+ * This function should not be marked __devinit because PCI IDs are
+ * added dynamically.
+ */
+int wrap_pnp_start_pci_device(struct pci_dev *pdev,
+			      const struct pci_device_id *ent)
+{
+	struct load_device load_device;
+	struct wrap_device *wd;
+
+	ENTER1("called for %04x:%04x:%04x:%04x", pdev->vendor, pdev->device,
+	       pdev->subsystem_vendor, pdev->subsystem_device);
+
+	load_device.bus = WRAP_PCI_BUS;
+	load_device.vendor = pdev->vendor;
+	load_device.device = pdev->device;
+	load_device.subvendor = pdev->subsystem_vendor;
+	load_device.subdevice = pdev->subsystem_device;
+	wd = load_wrap_device(&load_device);
+	if (!wd)
+		EXIT1(return -ENODEV);
+	wd->pci.pdev = pdev;
+	return wrap_pnp_start_device(wd);
+}
+
+void wrap_pnp_remove_pci_device(struct pci_dev *pdev)
+{
+	struct wrap_device *wd;
+
+	wd = (struct wrap_device *)pci_get_drvdata(pdev);
+	ENTER1("%p, %p", pdev, wd);
+	if (!wd)
+		EXIT1(return);
+	pnp_remove_device(wd);
+}
+
+int wrap_pnp_suspend_pci_device(struct pci_dev *pdev, pm_message_t state)
+{
+	struct wrap_device *wd;
+
+	wd = (struct wrap_device *)pci_get_drvdata(pdev);
+	return pnp_set_device_power_state(wd, PowerDeviceD3);
+}
+
+int wrap_pnp_resume_pci_device(struct pci_dev *pdev)
+{
+	struct wrap_device *wd;
+
+	wd = (struct wrap_device *)pci_get_drvdata(pdev);
+	return pnp_set_device_power_state(wd, PowerDeviceD0);
+}
+
+#ifdef ENABLE_USB
+int wrap_pnp_start_usb_device(struct usb_interface *intf,
+			      const struct usb_device_id *usb_id)
+{
+	struct wrap_device *wd;
+	int ret;
+	struct usb_device *udev = interface_to_usbdev(intf);
+	ENTER1("%04x, %04x, %04x", udev->descriptor.idVendor,
+	       udev->descriptor.idProduct, udev->descriptor.bDeviceClass);
+
+	/* USB device (e.g., RNDIS) may have multiple interfaces;
+	  initialize one interface only (is there a way to know which
+	  of these interfaces is for network?) */
+
+	if ((wd = get_wrap_device(udev, WRAP_USB_BUS))) {
+		TRACE1("device already initialized: %p", wd);
+		usb_set_intfdata(intf, NULL);
+		ret = 0;
+	} else {
+		struct load_device load_device;
+
+		load_device.bus = WRAP_USB_BUS;
+		load_device.vendor = le16_to_cpu(udev->descriptor.idVendor);
+		load_device.device = le16_to_cpu(udev->descriptor.idProduct);
+		load_device.subvendor = 0;
+		load_device.subdevice = 0;
+		wd = load_wrap_device(&load_device);
+		TRACE2("%p", wd);
+		if (wd) {
+			/* some devices (e.g., TI 4150, RNDIS) need
+			 * full reset */
+			ret = usb_reset_device(udev);
+			if (ret)
+				WARNING("reset failed: %d", ret);
+			usb_set_intfdata(intf, wd);
+			wd->usb.intf = intf;
+			wd->usb.udev = udev;
+			ret = wrap_pnp_start_device(wd);
+		} else
+			ret = -ENODEV;
+	}
+
+	TRACE2("ret: %d", ret);
+	if (ret)
+		EXIT1(return ret);
+	else
+		return 0;
+}
+
+void __devexit wrap_pnp_remove_usb_device(struct usb_interface *intf)
+{
+	struct wrap_device *wd;
+
+	wd = (struct wrap_device *)usb_get_intfdata(intf);
+	TRACE1("%p, %p", intf, wd);
+	if (wd == NULL)
+		EXIT1(return);
+	usb_set_intfdata(intf, NULL);
+	wd->usb.intf = NULL;
+	pnp_remove_device(wd);
+}
+
+int wrap_pnp_suspend_usb_device(struct usb_interface *intf, pm_message_t state)
+{
+	struct wrap_device *wd;
+	struct device_object *pdo;
+
+	wd = usb_get_intfdata(intf);
+	ENTER1("%p, %p", intf, wd);
+	if (!wd)
+		EXIT1(return 0);
+	pdo = wd->pdo;
+	if (pnp_set_device_power_state(wd, PowerDeviceD3))
+		return -1;
+	return 0;
+}
+
+int wrap_pnp_resume_usb_device(struct usb_interface *intf)
+{
+	struct wrap_device *wd;
+	wd = usb_get_intfdata(intf);
+	ENTER1("%p, %p", intf, wd);
+	if (!wd)
+		EXIT1(return 0);
+	if (pnp_set_device_power_state(wd, PowerDeviceD0))
+		return -1;
+	return 0;
+}
+
+#endif // USB
--- linux-rt-2.6.31.orig/ubuntu/ndiswrapper/BOM
+++ linux-rt-2.6.31/ubuntu/ndiswrapper/BOM
@@ -0,0 +1,2 @@
+Downloaded from:	http://sourceforge.net/project/showfiles.php?group_id=93482
+Current Version:	1.55
--- linux-rt-2.6.31.orig/ubuntu/ndiswrapper/Makefile
+++ linux-rt-2.6.31/ubuntu/ndiswrapper/Makefile
@@ -0,0 +1,38 @@
+ndiswrapper-objs := crt.o hal.o iw_ndis.o loader.o ndis.o ntoskernel.o ntoskernel_io.o \
+	pe_linker.o pnp.o proc.o rtl.o wrapmem.o wrapndis.o wrapper.o usb.o
+
+EXPORTS = crt_exports.h hal_exports.h ndis_exports.h ntoskernel_exports.h \
+	ntoskernel_io_exports.h rtl_exports.h usb_exports.h
+
+STUB_SRCS = crt.c hal.c ndis.c ntoskernel.c ntoskernel_io.c \
+	pnp.c rtl.c wrapndis.c usb.c
+
+
+EXTRA_CFLAGS += -DENABLE_USB -I$(obj)
+EXTRA_AFLAGS += -I$(obj)
+
+# generate exports symbol table from C files
+quiet_cmd_mkexport = MKEXPORT $@
+cmd_mkexport = $(SHELL) $(srctree)/$(src)/mkexport.sh $< $@
+
+%_exports.h: %.c $(srctree)/$(src)/mkexport.sh FORCE
+	$(call if_changed,mkexport)
+
+$(addprefix $(obj)/,$(EXPORTS:_exports.h=.o)): %.o: %_exports.h
+extra-y += $(EXPORTS)
+
+ifeq ($(CONFIG_X86_64),y)
+quiet_cmd_mkstubs = MKSTUBS $@
+cmd_mkstubs = $(SHELL) $(srctree)/$(src)/mkstubs.sh $(addprefix $(srctree)/$(src)/,$(STUB_SRCS)) >$@
+
+$(obj)/win2lin_stubs.h: $(addprefix $(srctree)/$(src)/,$(STUB_SRCS)) FORCE
+	$(call if_changed,mkstubs)
+
+$(obj)/win2lin_stubs.o: $(obj)/win2lin_stubs.h
+extra-y += win2lin_stubs.h
+ndiswrapper-objs += win2lin_stubs.o
+else
+ndiswrapper-objs += divdi3.o
+endif
+
+obj-$(CONFIG_NDISWRAPPER) := ndiswrapper.o
--- linux-rt-2.6.31.orig/ubuntu/ndiswrapper/wrapmem.c
+++ linux-rt-2.6.31/ubuntu/ndiswrapper/wrapmem.c
@@ -0,0 +1,360 @@
+/*
+ *  Copyright (C) 2006 Giridhar Pemmasani
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ *  GNU General Public License for more details.
+ *
+ */
+
+#define _WRAPMEM_C_
+
+#include "ntoskernel.h"
+
+struct slack_alloc_info {
+	struct nt_list list;
+	size_t size;
+};
+
+static struct nt_list allocs;
+static struct nt_list slack_allocs;
+static spinlock_t alloc_lock;
+
+struct vmem_block {
+	struct nt_list list;
+	int size;
+};
+
+static struct nt_list vmem_list;
+
+#if defined(ALLOC_DEBUG)
+struct alloc_info {
+	enum alloc_type type;
+	size_t size;
+#if ALLOC_DEBUG > 1
+	struct nt_list list;
+	const char *file;
+	int line;
+	ULONG tag;
+#endif
+};
+
+static atomic_t alloc_sizes[ALLOC_TYPE_MAX];
+#endif
+
+void wrapmem_info(void)
+{
+#ifdef ALLOC_DEBUG
+	enum alloc_type type;
+	for (type = 0; type < ALLOC_TYPE_MAX; type++)
+		INFO("total size of allocations in %d: %d",
+		       type, atomic_read(&alloc_sizes[type]));
+#endif
+}
+
+/* allocate memory and add it to list of allocated pointers; if a
+ * driver doesn't free this memory for any reason (buggy driver or we
+ * allocate space behind driver's back since we need more space than
+ * corresponding Windows structure provides etc.), this gets freed
+ * automatically when module is unloaded
+ */
+void *slack_kmalloc(size_t size)
+{
+	struct slack_alloc_info *info;
+	gfp_t flags;
+
+	ENTER4("size = %lu", (unsigned long)size);
+
+	if (irql_gfp() & GFP_ATOMIC)
+		flags = GFP_ATOMIC;
+	else
+		flags = GFP_KERNEL;
+	info = kmalloc(size + sizeof(*info), flags);
+	if (!info)
+		return NULL;
+	info->size = size;
+	spin_lock_bh(&alloc_lock);
+	InsertTailList(&slack_allocs, &info->list);
+	spin_unlock_bh(&alloc_lock);
+#ifdef ALLOC_DEBUG
+	atomic_add(size, &alloc_sizes[ALLOC_TYPE_SLACK]);
+#endif
+	TRACE4("%p, %p", info, info + 1);
+	EXIT4(return info + 1);
+}
+
+/* free pointer and remove from list of allocated pointers */
+void slack_kfree(void *ptr)
+{
+	struct slack_alloc_info *info;
+
+	ENTER4("%p", ptr);
+	info = ptr - sizeof(*info);
+	spin_lock_bh(&alloc_lock);
+	RemoveEntryList(&info->list);
+	spin_unlock_bh(&alloc_lock);
+#ifdef ALLOC_DEBUG
+	atomic_sub(info->size, &alloc_sizes[ALLOC_TYPE_SLACK]);
+#endif
+	kfree(info);
+	EXIT4(return);
+}
+
+#if defined(ALLOC_DEBUG)
+void *wrap_kmalloc(size_t size, gfp_t flags, const char *file, int line)
+{
+	struct alloc_info *info;
+
+	info = kmalloc(size + sizeof(*info), flags);
+	if (!info)
+		return NULL;
+	if (flags & GFP_ATOMIC)
+		info->type = ALLOC_TYPE_KMALLOC_ATOMIC;
+	else
+		info->type = ALLOC_TYPE_KMALLOC_NON_ATOMIC;
+	info->size = size;
+	atomic_add(size, &alloc_sizes[info->type]);
+#if ALLOC_DEBUG > 1
+	info->file = file;
+	info->line = line;
+	info->tag = 0;
+	spin_lock_bh(&alloc_lock);
+	InsertTailList(&allocs, &info->list);
+	spin_unlock_bh(&alloc_lock);
+#endif
+	TRACE4("%p", info + 1);
+	return info + 1;
+}
+
+void *wrap_kzalloc(size_t size, gfp_t flags, const char *file, int line)
+{
+	void *ptr = wrap_kmalloc(size, flags, file, line);
+	if (ptr)
+		memset(ptr, 0, size);
+	return ptr;
+}
+
+void wrap_kfree(void *ptr)
+{
+	struct alloc_info *info;
+
+	TRACE4("%p", ptr);
+	if (!ptr)
+		return;
+	info = ptr - sizeof(*info);
+	atomic_sub(info->size, &alloc_sizes[info->type]);
+#if ALLOC_DEBUG > 1
+	spin_lock_bh(&alloc_lock);
+	RemoveEntryList(&info->list);
+	spin_unlock_bh(&alloc_lock);
+	if (!(info->type == ALLOC_TYPE_KMALLOC_ATOMIC ||
+	      info->type == ALLOC_TYPE_KMALLOC_NON_ATOMIC))
+		WARNING("invliad type: %d", info->type);
+#endif
+	kfree(info);
+}
+
+void *wrap_vmalloc(unsigned long size, const char *file, int line)
+{
+	struct alloc_info *info;
+
+	info = vmalloc(size + sizeof(*info));
+	if (!info)
+		return NULL;
+	info->type = ALLOC_TYPE_VMALLOC_NON_ATOMIC;
+	info->size = size;
+	atomic_add(size, &alloc_sizes[info->type]);
+#if ALLOC_DEBUG > 1
+	info->file = file;
+	info->line = line;
+	info->tag = 0;
+	spin_lock_bh(&alloc_lock);
+	InsertTailList(&allocs, &info->list);
+	spin_unlock_bh(&alloc_lock);
+#endif
+	return info + 1;
+}
+
+void *wrap__vmalloc(unsigned long size, gfp_t gfp_mask, pgprot_t prot,
+		    const char *file, int line)
+{
+	struct alloc_info *info;
+
+	info = __vmalloc(size + sizeof(*info), gfp_mask, prot);
+	if (!info)
+		return NULL;
+	if (gfp_mask & GFP_ATOMIC)
+		info->type = ALLOC_TYPE_VMALLOC_ATOMIC;
+	else
+		info->type = ALLOC_TYPE_VMALLOC_NON_ATOMIC;
+	info->size = size;
+	atomic_add(size, &alloc_sizes[info->type]);
+#if ALLOC_DEBUG > 1
+	info->file = file;
+	info->line = line;
+	info->tag = 0;
+	spin_lock_bh(&alloc_lock);
+	InsertTailList(&allocs, &info->list);
+	spin_unlock_bh(&alloc_lock);
+#endif
+	return info + 1;
+}
+
+void wrap_vfree(void *ptr)
+{
+	struct alloc_info *info;
+
+	info = ptr - sizeof(*info);
+	atomic_sub(info->size, &alloc_sizes[info->type]);
+#if ALLOC_DEBUG > 1
+	spin_lock_bh(&alloc_lock);
+	RemoveEntryList(&info->list);
+	spin_unlock_bh(&alloc_lock);
+	if (!(info->type == ALLOC_TYPE_VMALLOC_ATOMIC ||
+	      info->type == ALLOC_TYPE_VMALLOC_NON_ATOMIC))
+		WARNING("invliad type: %d", info->type);
+#endif
+	vfree(info);
+}
+
+void *wrap_alloc_pages(gfp_t flags, unsigned int size,
+		       const char *file, int line)
+{
+	struct alloc_info *info;
+
+	size += sizeof(*info);
+	info = (struct alloc_info *)__get_free_pages(flags, get_order(size));
+	if (!info)
+		return NULL;
+	info->type = ALLOC_TYPE_PAGES;
+	info->size = size;
+	atomic_add(size, &alloc_sizes[info->type]);
+#if ALLOC_DEBUG > 1
+	info->file = file;
+	info->line = line;
+	info->tag = 0;
+	spin_lock_bh(&alloc_lock);
+	InsertTailList(&allocs, &info->list);
+	spin_unlock_bh(&alloc_lock);
+#endif
+	return info + 1;
+}
+
+void wrap_free_pages(unsigned long ptr, int order)
+{
+	struct alloc_info *info;
+
+	info = (void *)ptr - sizeof(*info);
+	atomic_sub(info->size, &alloc_sizes[info->type]);
+#if ALLOC_DEBUG > 1
+	spin_lock_bh(&alloc_lock);
+	RemoveEntryList(&info->list);
+	spin_unlock_bh(&alloc_lock);
+	if (info->type != ALLOC_TYPE_PAGES)
+		WARNING("invliad type: %d", info->type);
+#endif
+	free_pages((unsigned long)info, get_order(info->size));
+}
+
+#if ALLOC_DEBUG > 1
+#undef ExAllocatePoolWithTag
+void *wrap_ExAllocatePoolWithTag(enum pool_type pool_type, SIZE_T size,
+				 ULONG tag, const char *file, int line)
+{
+	void *addr;
+	struct alloc_info *info;
+
+	ENTER4("pool_type: %d, size: %lu, tag: %u", pool_type, size, tag);
+	addr = ExAllocatePoolWithTag(pool_type, size, tag);
+	if (!addr)
+		return NULL;
+	info = addr - sizeof(*info);
+	info->file = file;
+	info->line = line;
+	info->tag = tag;
+	EXIT4(return addr);
+}
+#endif
+
+int alloc_size(enum alloc_type type)
+{
+	if (type >= 0 && type < ALLOC_TYPE_MAX)
+		return atomic_read(&alloc_sizes[type]);
+	else
+		return -EINVAL;
+}
+
+#endif // ALLOC_DEBUG
+
+int wrapmem_init(void)
+{
+	InitializeListHead(&allocs);
+	InitializeListHead(&slack_allocs);
+	InitializeListHead(&vmem_list);
+	spin_lock_init(&alloc_lock);
+	return 0;
+}
+
+void wrapmem_exit(void)
+{
+	enum alloc_type type;
+	struct nt_list *ent;
+
+	/* free all pointers on the slack list */
+	while (1) {
+		struct slack_alloc_info *info;
+		spin_lock_bh(&alloc_lock);
+		ent = RemoveHeadList(&slack_allocs);
+		spin_unlock_bh(&alloc_lock);
+		if (!ent)
+			break;
+		info = container_of(ent, struct slack_alloc_info, list);
+#ifdef ALLOC_DEBUG
+		atomic_sub(info->size, &alloc_sizes[ALLOC_TYPE_SLACK]);
+#endif
+		kfree(info);
+	}
+	type = 0;
+#ifdef ALLOC_DEBUG
+	for (type = 0; type < ALLOC_TYPE_MAX; type++) {
+		int n = atomic_read(&alloc_sizes[type]);
+		if (n)
+			WARNING("%d bytes of memory in %d leaking", n, type);
+	}
+
+#if ALLOC_DEBUG > 1
+	while (1) {
+		struct alloc_info *info;
+
+		spin_lock_bh(&alloc_lock);
+		ent = RemoveHeadList(&allocs);
+		spin_unlock_bh(&alloc_lock);
+		if (!ent)
+			break;
+		info = container_of(ent, struct alloc_info, list);
+		atomic_sub(info->size, &alloc_sizes[ALLOC_TYPE_SLACK]);
+		WARNING("%p in %d of size %zu allocated at %s(%d) "
+			"with tag 0x%08X leaking; freeing it now",
+			info + 1, info->type, info->size, info->file,
+			info->line, info->tag);
+		if (info->type == ALLOC_TYPE_KMALLOC_ATOMIC ||
+		    info->type == ALLOC_TYPE_KMALLOC_NON_ATOMIC)
+			kfree(info);
+		else if (info->type == ALLOC_TYPE_VMALLOC_ATOMIC ||
+			 info->type == ALLOC_TYPE_VMALLOC_NON_ATOMIC)
+			vfree(info);
+		else if (info->type == ALLOC_TYPE_PAGES)
+			free_pages((unsigned long)info, get_order(info->size));
+		else
+			WARNING("invalid type: %d; not freed", info->type);
+	}
+#endif
+#endif
+	return;
+}
--- linux-rt-2.6.31.orig/ubuntu/ndiswrapper/ndis.h
+++ linux-rt-2.6.31/ubuntu/ndiswrapper/ndis.h
@@ -0,0 +1,1314 @@
+/*
+ *  Copyright (C) 2003-2005 Pontus Fuchs, Giridhar Pemmasani
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ *  GNU General Public License for more details.
+ *
+ */
+
+#ifndef _NDIS_H_
+#define _NDIS_H_
+
+#include "ntoskernel.h"
+
+//#define ALLOW_POOL_OVERFLOW 1
+
+#define NDIS_DMA_24BITS 0
+#define NDIS_DMA_32BITS 1
+#define NDIS_DMA_64BITS 2
+
+#ifdef CONFIG_X86_64
+#define MAXIMUM_PROCESSORS  64
+#else
+#define MAXIMUM_PROCESSORS  32
+#endif
+
+typedef UINT NDIS_STATUS;
+typedef UCHAR NDIS_DMA_SIZE;
+typedef LONG ndis_rssi;
+typedef ULONG ndis_key_index;
+typedef ULONG ndis_tx_power_level;
+typedef ULONGULONG ndis_key_rsc;
+typedef UCHAR ndis_rates[NDIS_MAX_RATES];
+typedef UCHAR ndis_rates_ex[NDIS_MAX_RATES_EX];
+typedef UCHAR mac_address[ETH_ALEN];
+typedef ULONG ndis_fragmentation_threshold;
+typedef ULONG ndis_rts_threshold;
+typedef ULONG ndis_antenna;
+typedef ULONG ndis_oid;
+
+typedef UCHAR ndis_pmkid_vavlue[16];
+
+typedef uint64_t NDIS_PHY_ADDRESS;
+
+struct ndis_sg_element {
+	PHYSICAL_ADDRESS address;
+	ULONG length;
+	ULONG_PTR reserved;
+};
+
+struct ndis_sg_list {
+	ULONG nent;
+	ULONG_PTR reserved;
+	struct ndis_sg_element elements[];
+};
+
+/* when sending packets, ndiswrapper associates exactly one sg element
+ * in sg list */
+struct wrap_tx_sg_list {
+	ULONG nent;
+	ULONG_PTR reserved;
+	struct ndis_sg_element elements[1];
+};
+
+struct ndis_phy_addr_unit {
+	NDIS_PHY_ADDRESS phy_addr;
+	UINT length;
+};
+
+typedef struct mdl ndis_buffer;
+
+struct ndis_buffer_pool {
+	ndis_buffer *free_descr;
+//	NT_SPIN_LOCK lock;
+	spinlock_t lock;
+	UINT max_descr;
+	UINT num_allocated_descr;
+};
+
+#define NDIS_PROTOCOL_ID_DEFAULT	0x00
+#define NDIS_PROTOCOL_ID_TCP_IP		0x02
+#define NDIS_PROTOCOL_ID_IPX		0x06
+#define NDIS_PROTOCOL_ID_NBF		0x07
+#define NDIS_PROTOCOL_ID_MAX		0x0F
+#define NDIS_PROTOCOL_ID_MASK		0x0F
+
+#define fPACKET_WRAPPER_RESERVED		0x3F
+#define fPACKET_CONTAINS_MEDIA_SPECIFIC_INFO	0x40
+#define fPACKET_ALLOCATED_BY_NDIS		0x80
+
+#define PROTOCOL_RESERVED_SIZE_IN_PACKET (4 * sizeof(void *))
+
+struct transport_header_offset {
+	USHORT protocol_type;
+	USHORT header_offset;
+};
+
+struct ndis_network_address {
+	USHORT length;
+	USHORT type;
+	UCHAR address[1];
+};
+
+struct ndis_network_address_list {
+	LONG count;
+	USHORT type;
+	struct ndis_network_address address[1];
+};
+
+struct ndis_tcp_ip_checksum_packet_info {
+	union {
+		struct {
+			ULONG v4:1;
+			ULONG v6:1;
+			ULONG tcp:1;
+			ULONG udp:1;
+			ULONG ip:1;
+		} tx;
+		struct {
+			ULONG tcp_failed:1;
+			ULONG udp_failed:1;
+			ULONG ip_failed:1;
+			ULONG tcp_succeeded:1;
+			ULONG udp_succeeded:1;
+			ULONG ip_succeeded:1;
+			ULONG loopback:1;
+		} rx;
+		ULONG value;
+	};
+};
+
+enum ndis_task {
+	TcpIpChecksumNdisTask, IpSecNdisTask, TcpLargeSendNdisTask, MaxNdisTask
+};
+
+enum ndis_encapsulation {
+	UNSPECIFIED_Encapsulation, NULL_Encapsulation,
+	IEEE_802_3_Encapsulation, IEEE_802_5_Encapsulation,
+	LLC_SNAP_ROUTED_Encapsulation, LLC_SNAP_BRIDGED_Encapsulation
+};
+
+#define NDIS_TASK_OFFLOAD_VERSION 1
+
+struct ndis_encapsulation_format {
+	enum ndis_encapsulation encap;
+	struct {
+		ULONG fixed_header_size:1;
+		ULONG reserved:31;
+	} flags;
+	ULONG header_size;
+};
+
+struct ndis_task_offload_header {
+	ULONG version;
+	ULONG size;
+	ULONG reserved;
+	ULONG offset_first_task;
+	struct ndis_encapsulation_format encap_format;
+};
+
+struct ndis_task_offload {
+	ULONG version;
+	ULONG size;
+	enum ndis_task task;
+	ULONG offset_next_task;
+	ULONG task_buf_length;
+	UCHAR task_buf[1];
+};
+
+struct v4_checksum {
+	union {
+		struct {
+			ULONG ip_opts:1;
+			ULONG tcp_opts:1;
+			ULONG tcp_csum:1;
+			ULONG udp_csum:1;
+			ULONG ip_csum:1;
+		};
+		ULONG value;
+	};
+};
+
+struct v6_checksum {
+	ULONG ip_supported:1;
+	ULONG tcp_supported:1;
+	ULONG tcp_csum:1;
+	ULONG udp_csum:1;
+};
+
+struct ndis_task_tcp_ip_checksum {
+	struct v4_checksum v4_tx;
+	struct v4_checksum v4_rx;
+	struct v6_checksum v6_tx;
+	struct v6_checksum v6_rx;
+};
+
+struct ndis_task_tcp_large_send {
+	ULONG version;
+	ULONG max_size;
+	ULONG min_seg_count;
+	BOOLEAN tcp_opts;
+	BOOLEAN ip_opts;
+};
+
+struct ndis_packet;
+
+struct ndis_packet_pool {
+	struct ndis_packet *free_descr;
+//	NT_SPIN_LOCK lock;
+	spinlock_t lock;
+	UINT max_descr;
+	UINT num_allocated_descr;
+	UINT num_used_descr;
+	UINT proto_rsvd_length;
+};
+
+struct ndis_packet_stack {
+	ULONG_PTR IM_reserved[2];
+	ULONG_PTR ndis_reserved[4];
+};
+
+enum ndis_per_packet_info {
+	TcpIpChecksumPacketInfo, IpSecPacketInfo, TcpLargeSendPacketInfo,
+	ClassificationHandlePacketInfo, NdisReserved,
+	ScatterGatherListPacketInfo, Ieee8021QInfo, OriginalPacketInfo,
+	PacketCancelId, MaxPerPacketInfo
+};
+
+struct ndis_packet_extension {
+	void *info[MaxPerPacketInfo];
+};
+
+struct ndis_packet_private {
+	UINT nr_pages;
+	UINT len;
+	ndis_buffer *buffer_head;
+	ndis_buffer *buffer_tail;
+	struct ndis_packet_pool *pool;
+	UINT count;
+	ULONG flags;
+	BOOLEAN valid_counts;
+	UCHAR packet_flags;
+	USHORT oob_offset;
+};
+
+struct ndis_packet {
+	struct ndis_packet_private private;
+	/* for use by miniport */
+	union {
+		/* for connectionless mininports */
+		struct {
+			UCHAR miniport_reserved[2 * sizeof(void *)];
+			UCHAR wrapper_reserved[2 * sizeof(void *)];
+		} cl_reserved;
+		/* for deserialized miniports */
+		struct {
+			UCHAR miniport_reserved_ex[3 * sizeof(void *)];
+			UCHAR wrapper_reserved_ex[sizeof(void *)];
+		} deserailized_reserved;
+		struct {
+			UCHAR mac_reserved[4 * sizeof(void *)];
+		} mac_reserved;
+	};
+	ULONG_PTR reserved[2];
+	UCHAR protocol_reserved[1];
+};
+
+/* OOB data */
+struct ndis_packet_oob_data {
+	union {
+		ULONGLONG time_to_tx;
+		ULONGLONG time_txed;
+	};
+	ULONGLONG time_rxed;
+	UINT header_size;
+	UINT media_size;
+	void *media;
+	NDIS_STATUS status;
+
+	/* ndiswrapper specific info; extension should be right after
+	 * ndis's oob_data */
+	struct ndis_packet_extension ext;
+	union {
+		/* used for tx only */
+		struct {
+			struct sk_buff *tx_skb;
+			union {
+				struct wrap_tx_sg_list wrap_tx_sg_list;
+				struct ndis_sg_list *tx_sg_list;
+			};
+		};
+		/* used for rx only */
+		struct {
+			unsigned char header[ETH_HLEN];
+			unsigned char *look_ahead;
+			UINT look_ahead_size;
+		};
+	};
+};
+
+#define NDIS_PACKET_OOB_DATA(packet)					\
+	(struct ndis_packet_oob_data *)(((void *)(packet)) +		\
+					(packet)->private.oob_offset)
+
+enum ndis_device_pnp_event {
+	NdisDevicePnPEventQueryRemoved, NdisDevicePnPEventRemoved,
+	NdisDevicePnPEventSurpriseRemoved, NdisDevicePnPEventQueryStopped,
+	NdisDevicePnPEventStopped, NdisDevicePnPEventPowerProfileChanged,
+	NdisDevicePnPEventMaximum
+};
+
+enum ndis_request_type {
+	NdisRequestQueryInformation, NdisRequestSetInformation,
+	NdisRequestQueryStatistics, NdisRequestOpen, NdisRequestClose,
+	NdisRequestSend, NdisRequestTransferData, NdisRequestReset,
+	NdisRequestGeneric1, NdisRequestGeneric2, NdisRequestGeneric3,
+	NdisRequestGeneric4
+};
+
+struct ndis_request {
+	mac_address mac;
+	enum ndis_request_type request_type;
+	union data {
+		struct query_info {
+			UINT oid;
+			void *buf;
+			UINT buf_len;
+			UINT written;
+			UINT needed;
+		} query_info;
+		struct set_info {
+			UINT oid;
+			void *buf;
+			UINT buf_len;
+			UINT written;
+			UINT needed;
+		} set_info;
+	} data;
+};
+
+enum ndis_medium {
+	NdisMedium802_3, NdisMedium802_5, NdisMediumFddi, NdisMediumWan,
+	NdisMediumLocalTalk, NdisMediumDix, NdisMediumArcnetRaw,
+	NdisMediumArcnet878_2, NdisMediumAtm, NdisMediumWirelessWan,
+	NdisMediumIrda, NdisMediumBpc, NdisMediumCoWan,
+	NdisMedium1394, NdisMediumMax
+};
+
+enum ndis_physical_medium {
+	NdisPhysicalMediumUnspecified, NdisPhysicalMediumWirelessLan,
+	NdisPhysicalMediumCableModem, NdisPhysicalMediumPhoneLine,
+	NdisPhysicalMediumPowerLine, NdisPhysicalMediumDSL,
+	NdisPhysicalMediumFibreChannel, NdisPhysicalMedium1394,
+	NdisPhysicalMediumWirelessWan, NdisPhysicalMediumMax
+};
+
+enum ndis_power_state {
+	NdisDeviceStateUnspecified = 0,
+	NdisDeviceStateD0, NdisDeviceStateD1, NdisDeviceStateD2,
+	NdisDeviceStateD3, NdisDeviceStateMaximum
+};
+
+enum ndis_power_profile {
+	NdisPowerProfileBattery, NdisPowerProfileAcOnLine
+};
+
+struct ndis_pm_wakeup_capabilities {
+	enum ndis_power_state min_magic_packet_wakeup;
+	enum ndis_power_state min_pattern_wakeup;
+	enum ndis_power_state min_link_change_wakeup;
+};
+
+#define NDIS_PNP_WAKE_UP_MAGIC_PACKET			0x00000001
+#define NDIS_PNP_WAKE_UP_PATTERN_MATCH			0x00000002
+#define NDIS_PNP_WAKE_UP_LINK_CHANGE			0x00000004
+
+enum net_pnp_event_code {
+	NetEventSetPower, NetEventQueryPower, NetEventQueryRemoveDevice,
+	NetEventCancelRemoveDevice, NetEventReconfigure, NetEventBindList,
+	NetEventBindsComplete, NetEventPnPCapabilities, NetEventMaximum
+};
+
+struct net_pnp_event {
+	enum net_pnp_event_code code;
+	void *buf;
+	ULONG buf_length;
+	ULONG_PTR ndis_reserved[4];
+	ULONG_PTR transport_reserved[4];
+	ULONG_PTR tdi_reserved[4];
+	ULONG_PTR tdi_client_reserved[4];
+};
+
+struct ndis_pnp_capabilities {
+	ULONG flags;
+	struct ndis_pm_wakeup_capabilities wakeup;
+};
+
+typedef void (*ndis_isr_handler)(BOOLEAN *recognized, BOOLEAN *queue_handler,
+				 void *handle) wstdcall;
+typedef void (*ndis_interrupt_handler)(void *ctx) wstdcall;
+
+struct miniport {
+	/* NDIS 3.0 */
+	UCHAR major_version;
+	UCHAR minor_version;
+	USHORT filler;
+	UINT reserved;
+	BOOLEAN (*hangcheck)(void *ctx) wstdcall;
+	void (*disable_interrupt)(void *ctx) wstdcall;
+	void (*enable_interrupt)(void *ctx) wstdcall;
+	void (*mp_halt)(void *ctx) wstdcall;
+	ndis_interrupt_handler handle_interrupt;
+	NDIS_STATUS (*init)(NDIS_STATUS *error_status, UINT *medium_index,
+			    enum ndis_medium medium[], UINT medium_array_size,
+			    void *handle, void *conf_handle) wstdcall;
+	ndis_isr_handler isr;
+	NDIS_STATUS (*queryinfo)(void *ctx, ndis_oid oid, void *buffer,
+			     ULONG buflen, ULONG *written,
+			     ULONG *needed) wstdcall;
+	void *reconfig;
+	NDIS_STATUS (*reset)(BOOLEAN *reset_address, void *ctx) wstdcall;
+	NDIS_STATUS (*send)(void *ctx, struct ndis_packet *packet,
+			    UINT flags) wstdcall;
+	NDIS_STATUS (*setinfo)(void *ctx, ndis_oid oid, void *buffer,
+			       ULONG buflen, ULONG *written,
+			       ULONG *needed) wstdcall;
+	NDIS_STATUS (*tx_data)(struct ndis_packet *ndis_packet,
+			       UINT *bytes_txed, void *mp_ctx, void *rx_ctx,
+			       UINT offset, UINT bytes_to_tx) wstdcall;
+	/* NDIS 4.0 extensions */
+	void (*return_packet)(void *ctx, void *packet) wstdcall;
+	void (*send_packets)(void *ctx, struct ndis_packet **packets,
+			     INT nr_of_packets) wstdcall;
+	void (*alloc_complete)(void *handle, void *virt,
+			       NDIS_PHY_ADDRESS *phys,
+			       ULONG size, void *ctx) wstdcall;
+	/* NDIS 5.0 extensions */
+	NDIS_STATUS (*co_create_vc)(void *ctx, void *vc_handle,
+				    void *vc_ctx) wstdcall;
+	NDIS_STATUS (*co_delete_vc)(void *vc_ctx) wstdcall;
+	NDIS_STATUS (*co_activate_vc)(void *vc_ctx, void *call_params) wstdcall;
+	NDIS_STATUS (*co_deactivate_vc)(void *vc_ctx) wstdcall;
+	NDIS_STATUS (*co_send_packets)(void *vc_ctx, void **packets,
+				       UINT nr_of_packets) wstdcall;
+	NDIS_STATUS (*co_request)(void *ctx, void *vc_ctx, UINT *req) wstdcall;
+	/* NDIS 5.1 extensions */
+	void (*cancel_send_packets)(void *ctx, void *id) wstdcall;
+	void (*pnp_event_notify)(void *ctx, enum ndis_device_pnp_event event,
+				 void *inf_buf, ULONG inf_buf_len) wstdcall;
+	void (*shutdown)(void *ctx) wstdcall;
+	void *reserved1;
+	void *reserved2;
+	void *reserved3;
+	void *reserved4;
+};
+
+struct ndis_spinlock {
+	NT_SPIN_LOCK klock;
+	KIRQL irql;
+};
+
+union ndis_rw_lock_refcount {
+	UCHAR cache_line[16];
+};
+
+struct ndis_rw_lock {
+	union {
+		struct {
+			NT_SPIN_LOCK klock;
+			void *context;
+		};
+		UCHAR reserved[16];
+	};
+	union {
+		union ndis_rw_lock_refcount ref_count[MAXIMUM_PROCESSORS];
+		/* ndiswrapper specific */
+		volatile int count;
+	};
+};
+
+struct lock_state {
+	USHORT state;
+	KIRQL irql;
+};
+
+struct ndis_work_item;
+typedef void (*NDIS_PROC)(struct ndis_work_item *, void *) wstdcall;
+
+struct ndis_work_item {
+	void *ctx;
+	NDIS_PROC func;
+	union {
+		UCHAR reserved[8 * sizeof(void *)];
+		/* ndiswrapper specific */
+		struct nt_list list;
+	};
+};
+
+struct alloc_shared_mem {
+	void *ctx;
+	ULONG size;
+	BOOLEAN cached;
+};
+
+struct ndis_mp_block;
+
+/* this is opaque to drivers, so we can use it as we please */
+struct ndis_mp_interrupt {
+	struct kinterrupt *kinterrupt;
+	NT_SPIN_LOCK lock;
+	union {
+		void *reserved;
+		unsigned int irq;
+	};
+	ndis_isr_handler isr;
+	ndis_interrupt_handler mp_dpc;
+	struct kdpc intr_dpc;
+	struct ndis_mp_block *nmb;
+	UCHAR dpc_count;
+	BOOLEAN enable;
+	struct nt_event dpc_completed_event;
+	BOOLEAN shared;
+	BOOLEAN req_isr;
+};
+
+struct ndis_binary_data {
+	USHORT len;
+	void *buf;
+};
+
+enum ndis_parameter_type {
+	NdisParameterInteger, NdisParameterHexInteger,
+	NdisParameterString, NdisParameterMultiString, NdisParameterBinary,
+};
+
+typedef struct unicode_string NDIS_STRING;
+
+struct ndis_configuration_parameter {
+	enum ndis_parameter_type type;
+	union {
+		ULONG integer;
+		NDIS_STRING string;
+	} data;
+};
+
+struct ndis_driver {
+	struct miniport mp;
+};
+
+/* IDs used to store extensions in driver_object's custom extension */
+#define NDIS_DRIVER_CLIENT_ID 10
+
+struct ndis_wireless_stats {
+	ULONG length;
+	LARGE_INTEGER tx_frag;
+	LARGE_INTEGER tx_multi_frag;
+	LARGE_INTEGER failed;
+	LARGE_INTEGER retry;
+	LARGE_INTEGER multi_retry;
+	LARGE_INTEGER rtss_succ;
+	LARGE_INTEGER rtss_fail;
+	LARGE_INTEGER ack_fail;
+	LARGE_INTEGER frame_dup;
+	LARGE_INTEGER rx_frag;
+	LARGE_INTEGER rx_multi_frag;
+	LARGE_INTEGER fcs_err;
+	LARGE_INTEGER tkip_local_mic_failures;
+	LARGE_INTEGER tkip_icv_errors;
+	LARGE_INTEGER tkip_counter_measures_invoked;
+	LARGE_INTEGER tkip_replays;
+	LARGE_INTEGER ccmp_format_errors;
+	LARGE_INTEGER ccmp_replays;
+	LARGE_INTEGER ccmp_decrypt_errors;
+	LARGE_INTEGER fourway_handshake_failures;
+	LARGE_INTEGER wep_undecryptable_count;
+	LARGE_INTEGER wep_icv_errorcount;
+	LARGE_INTEGER decrypt_success_count;
+	LARGE_INTEGER decrypt_failure_count;
+};
+
+enum ndis_status_type {
+	Ndis802_11StatusType_Authentication,
+	Ndis802_11StatusType_MediaStreamMode,
+	Ndis802_11StatusType_PMKID_CandidateList,
+	Ndis802_11StatusType_RadioState,
+};
+
+struct ndis_status_indication {
+	enum ndis_status_type status_type;
+};
+
+enum ndis_radio_status {
+	Ndis802_11RadioStatusOn, Ndis802_11RadioStatusHardwareOff,
+	Ndis802_11RadioStatusSoftwareOff,
+};
+
+struct ndis_radio_status_indication
+{
+	enum ndis_status_type status_type;
+	enum ndis_radio_status radio_state;
+};
+
+enum ndis_media_state {
+	NdisMediaStateConnected,
+	NdisMediaStateDisconnected,
+};
+
+enum ndis_media_stream_mode {
+	Ndis802_11MediaStreamOff, Ndis802_11MediaStreamOn
+};
+
+enum wrapper_work {
+	LINK_STATUS_OFF, LINK_STATUS_ON, SET_MULTICAST_LIST, COLLECT_IW_STATS,
+	HANGCHECK, NETIF_WAKEQ,
+};
+
+struct encr_info {
+	struct encr_key {
+		ULONG length;
+		UCHAR key[NDIS_ENCODING_TOKEN_MAX];
+	} keys[MAX_ENCR_KEYS];
+	unsigned short tx_key_index;
+};
+
+struct ndis_essid {
+	ULONG length;
+	UCHAR essid[NDIS_ESSID_MAX_SIZE];
+};
+
+enum ndis_infrastructure_mode {
+	Ndis802_11IBSS, Ndis802_11Infrastructure, Ndis802_11AutoUnknown,
+	Ndis802_11InfrastructureMax
+};
+
+enum authentication_mode {
+	Ndis802_11AuthModeOpen, Ndis802_11AuthModeShared,
+	Ndis802_11AuthModeAutoSwitch, Ndis802_11AuthModeWPA,
+	Ndis802_11AuthModeWPAPSK, Ndis802_11AuthModeWPANone,
+	Ndis802_11AuthModeWPA2, Ndis802_11AuthModeWPA2PSK,
+	Ndis802_11AuthModeMax
+};
+
+enum encryption_status {
+	Ndis802_11WEPEnabled,
+	Ndis802_11Encryption1Enabled = Ndis802_11WEPEnabled,
+	Ndis802_11WEPDisabled,
+	Ndis802_11EncryptionDisabled = Ndis802_11WEPDisabled,
+	Ndis802_11WEPKeyAbsent,
+	Ndis802_11Encryption1KeyAbsent = Ndis802_11WEPKeyAbsent,
+	Ndis802_11WEPNotSupported,
+	Ndis802_11EncryptionNotSupported = Ndis802_11WEPNotSupported,
+	Ndis802_11Encryption2Enabled, Ndis802_11Encryption2KeyAbsent,
+	Ndis802_11Encryption3Enabled, Ndis802_11Encryption3KeyAbsent
+};
+
+struct ndis_auth_encr_pair {
+	enum authentication_mode auth_mode;
+	enum encryption_status encr_mode;
+};
+
+struct ndis_capability {
+	ULONG length;
+	ULONG version;
+	ULONG num_PMKIDs;
+	ULONG num_auth_encr_pair;
+	struct ndis_auth_encr_pair auth_encr_pair[1];
+};
+
+struct ndis_guid {
+	struct guid guid;
+	union {
+		ndis_oid oid;
+		NDIS_STATUS status;
+	};
+	ULONG size;
+	ULONG flags;
+};
+
+struct ndis_timer {
+	struct nt_timer nt_timer;
+	struct kdpc kdpc;
+};
+
+struct ndis_mp_timer {
+	struct nt_timer nt_timer;
+	struct kdpc kdpc;
+	DPC func;
+	void *ctx;
+	struct ndis_mp_block *nmb;
+	struct ndis_mp_timer *next;
+};
+
+typedef struct cm_partial_resource_list NDIS_RESOURCE_LIST;
+
+struct ndis_event {
+	struct nt_event nt_event;
+};
+
+struct ndis_bind_paths {
+	UINT number;
+	struct unicode_string paths[1];
+};
+
+struct ndis_reference {
+	NT_SPIN_LOCK lock;
+	USHORT ref_count;
+	BOOLEAN closing;
+};
+
+struct ndis_filterdbs {
+	union {
+		void *eth_db;
+		void *null_db;
+	};
+	void *tr_db;
+	void *fddi_db;
+	void *arc_db;
+};
+
+enum ndis_interface_type {
+	NdisInterfaceInternal, NdisInterfaceIsa, NdisInterfaceEisa,
+	NdisInterfaceMca, NdisInterfaceTurboChannel, NdisInterfacePci,
+	NdisInterfacePcMcia,
+};
+
+struct auth_encr_capa {
+	unsigned long auth;
+	unsigned long encr;
+};
+
+struct ndis_pmkid_candidate {
+	mac_address bssid;
+	DWORD flags;
+};
+
+struct ndis_pmkid_candidate_list {
+	ULONG version;
+	ULONG num_candidates;
+	struct ndis_pmkid_candidate candidates[1];
+};
+
+/*
+ * This struct contains function pointers that the drivers references
+ * directly via macros, so it's important that they are at the correct
+ * position.
+ */
+struct ndis_mp_block {
+	void *signature;
+	struct ndis_mp_block *next;
+	struct driver_object *drv_obj;
+	void *mp_ctx;
+	struct unicode_string name;
+	struct ndis_bind_paths *bindpaths;
+	void *openqueue;
+	struct ndis_reference reference;
+	void *device_ctx;
+	UCHAR padding;
+	UCHAR lock_acquired;
+	UCHAR pmode_opens;
+	UCHAR assigned_cpu;
+	NT_SPIN_LOCK lock;
+	enum ndis_request_type *mediarequest;
+	struct ndis_mp_interrupt *interrupt;
+	ULONG flags;
+	ULONG pnp_flags;
+	struct nt_list packet_list;
+	struct ndis_packet *first_pending_tx_packet;
+	struct ndis_packet *return_packet_queue;
+	ULONG request_buffer;
+	void *set_mcast_buffer;
+	struct ndis_mp_block *primary_mp;
+	void *wrapper_ctx;
+	void *bus_data_ctx;
+	ULONG pnp_capa;
+	void *resources;
+	struct ndis_timer wakeup_dpc_timer;
+	struct unicode_string basename;
+	struct unicode_string symlink_name;
+	ULONG ndis_hangcheck_interval;
+	USHORT hanghcheck_ticks;
+	USHORT hangcheck_tick;
+	NDIS_STATUS ndis_reset_status;
+	void *resetopen;
+	struct ndis_filterdbs filterdbs;
+	void *rx_packet;
+	void *send_complete;
+	void *send_resource_avail;
+	void *reset_complete;
+
+	enum ndis_medium media_type;
+	ULONG bus_number;
+	enum ndis_interface_type bus_type;
+	enum ndis_interface_type adapter_type;
+	struct device_object *fdo;
+	struct device_object *pdo;
+	struct device_object *next_device;
+	void *mapreg;
+	void *call_mgraflist;
+	void *mp_thread;
+	void *setinfobuf;
+	USHORT setinfo_buf_len;
+	USHORT max_send_pkts;
+	NDIS_STATUS fake_status;
+	void *lock_handler;
+	struct unicode_string *adapter_instance_name;
+	void *timer_queue;
+	UINT mac_options;
+	void *pending_req;
+	UINT max_long_addrs;
+	UINT max_short_addrs;
+	UINT cur_lookahead;
+	UINT max_lookahead;
+
+	ndis_interrupt_handler irq_bh;
+	void *disable_intr;
+	void *enable_intr;
+	void *send_pkts;
+	void *deferred_send;
+	void *eth_rx_indicate;
+	void *tr_rx_indicate;
+	void *fddi_rx_indicate;
+	void *eth_rx_complete;
+	void *tr_rx_complete;
+	void *fddi_rx_complete;
+
+	void *status;
+	void *status_complete;
+	void *td_complete;
+
+	void *queryinfo_complete;
+	void *setinfo_complete;
+	void *wan_tx_complete;
+	void *wan_rx;
+	void *wan_rx_complete;
+	/* ndiswrapper specific */
+	struct ndis_device *wnd;
+};
+
+struct ndis_device {
+	struct ndis_mp_block *nmb;
+	struct wrap_device *wd;
+	struct net_device *net_dev;
+	void *shutdown_ctx;
+	struct ndis_mp_interrupt *mp_interrupt;
+	struct kdpc irq_kdpc;
+	unsigned long mem_start;
+	unsigned long mem_end;
+
+	struct net_device_stats net_stats;
+	struct iw_statistics iw_stats;
+	BOOLEAN iw_stats_enabled;
+	struct ndis_wireless_stats ndis_stats;
+
+	work_struct_t tx_work;
+	struct ndis_packet *tx_ring[TX_RING_SIZE];
+	u8 tx_ring_start;
+	u8 tx_ring_end;
+	u8 is_tx_ring_full;
+	u8 tx_ok;
+	spinlock_t tx_ring_lock;
+	struct semaphore tx_ring_mutex;
+	unsigned int max_tx_packets;
+	struct semaphore ndis_req_mutex;
+	struct task_struct *ndis_req_task;
+	int ndis_req_done;
+	NDIS_STATUS ndis_req_status;
+	ULONG packet_filter;
+
+	ULONG sg_dma_size;
+	ULONG dma_map_count;
+	dma_addr_t *dma_map_addr;
+
+	int hangcheck_interval;
+	struct timer_list hangcheck_timer;
+	int iw_stats_interval;
+	struct timer_list iw_stats_timer;
+	unsigned long scan_timestamp;
+	struct encr_info encr_info;
+	char nick[IW_ESSID_MAX_SIZE + 1];
+	struct ndis_essid essid;
+	struct auth_encr_capa capa;
+	enum ndis_infrastructure_mode infrastructure_mode;
+	int max_pmkids;
+	int num_pmkids;
+	struct ndis_pmkid *pmkids;
+	mac_address mac;
+	struct proc_dir_entry *procfs_iface;
+
+	work_struct_t ndis_work;
+	unsigned long ndis_pending_work;
+	UINT attributes;
+	int iw_auth_wpa_version;
+	int iw_auth_cipher_pairwise;
+	int iw_auth_cipher_group;
+	int iw_auth_key_mgmt;
+	int iw_auth_80211_alg;
+	struct ndis_packet_pool *tx_packet_pool;
+	struct ndis_buffer_pool *tx_buffer_pool;
+	int multicast_size;
+	struct v4_checksum rx_csum;
+	struct v4_checksum tx_csum;
+	enum ndis_physical_medium physical_medium;
+	ULONG ndis_wolopts;
+	struct nt_slist wrap_timer_slist;
+	int drv_ndis_version;
+	struct ndis_pnp_capabilities pnp_capa;
+	char netdev_name[IFNAMSIZ];
+};
+
+BOOLEAN ndis_isr(struct kinterrupt *kinterrupt, void *ctx) wstdcall;
+
+int ndis_init(void);
+void ndis_exit(void);
+int ndis_init_device(struct ndis_device *wnd);
+void ndis_exit_device(struct ndis_device *wnd);
+
+int wrap_procfs_add_ndis_device(struct ndis_device *wnd);
+void wrap_procfs_remove_ndis_device(struct ndis_device *wnd);
+
+void NdisAllocatePacketPoolEx(NDIS_STATUS *status,
+			      struct ndis_packet_pool **pool_handle,
+			      UINT num_descr, UINT overflowsize,
+			      UINT proto_rsvd_length) wstdcall;
+void NdisFreePacketPool(struct ndis_packet_pool *pool) wstdcall;
+void NdisAllocatePacket(NDIS_STATUS *status, struct ndis_packet **packet,
+			struct ndis_packet_pool *pool) wstdcall;
+void NdisFreePacket(struct ndis_packet *descr) wstdcall;
+void NdisAllocateBufferPool(NDIS_STATUS *status,
+			    struct ndis_buffer_pool **pool_handle,
+			    UINT num_descr) wstdcall;
+void NdisFreeBufferPool(struct ndis_buffer_pool *pool) wstdcall;
+void NdisAllocateBuffer(NDIS_STATUS *status, ndis_buffer **buffer,
+			struct ndis_buffer_pool *pool, void *virt,
+			UINT length) wstdcall;
+void NdisFreeBuffer(ndis_buffer *descr) wstdcall;
+void NdisMIndicateReceivePacket(struct ndis_mp_block *nmb,
+				struct ndis_packet **packets,
+				UINT nr_packets) wstdcall;
+void NdisMSendComplete(struct ndis_mp_block *nmb, struct ndis_packet *packet,
+		       NDIS_STATUS status) wstdcall;
+void NdisMSendResourcesAvailable(struct ndis_mp_block *nmb) wstdcall;
+void NdisMIndicateStatus(struct ndis_mp_block *nmb,
+			 NDIS_STATUS status, void *buf, UINT len) wstdcall;
+void NdisMIndicateStatusComplete(struct ndis_mp_block *nmb) wstdcall;
+void NdisMQueryInformationComplete(struct ndis_mp_block *nmb,
+				   NDIS_STATUS status) wstdcall;
+void NdisMSetInformationComplete(struct ndis_mp_block *nmb,
+				 NDIS_STATUS status) wstdcall;
+void NdisMResetComplete(struct ndis_mp_block *nmb, NDIS_STATUS status,
+			BOOLEAN address_reset) wstdcall;
+ULONG NDIS_BUFFER_TO_SPAN_PAGES(ndis_buffer *buffer) wstdcall;
+BOOLEAN NdisWaitEvent(struct ndis_event *event, UINT timeout) wstdcall;
+void NdisSetEvent(struct ndis_event *event) wstdcall;
+void NdisMDeregisterInterrupt(struct ndis_mp_interrupt *mp_interrupt) wstdcall;
+void EthRxIndicateHandler(struct ndis_mp_block *nmb, void *rx_ctx,
+			  char *header1, char *header, UINT header_size,
+			  void *look_ahead, UINT look_ahead_size,
+			  UINT packet_size) wstdcall;
+void EthRxComplete(struct ndis_mp_block *nmb) wstdcall;
+void NdisMTransferDataComplete(struct ndis_mp_block *nmb,
+			       struct ndis_packet *packet, NDIS_STATUS status,
+			       UINT bytes_txed) wstdcall;
+void NdisWriteConfiguration(NDIS_STATUS *status, struct ndis_mp_block *nmb,
+			    struct unicode_string *key,
+			    struct ndis_configuration_parameter *param) wstdcall;
+void NdisReadConfiguration(NDIS_STATUS *status,
+			   struct ndis_configuration_parameter **param,
+			   struct ndis_mp_block *nmb,
+			   struct unicode_string *key,
+			   enum ndis_parameter_type type) wstdcall;
+
+/* Required OIDs */
+#define OID_GEN_SUPPORTED_LIST			0x00010101
+#define OID_GEN_HARDWARE_STATUS			0x00010102
+#define OID_GEN_MEDIA_SUPPORTED			0x00010103
+#define OID_GEN_MEDIA_IN_USE			0x00010104
+#define OID_GEN_MAXIMUM_LOOKAHEAD		0x00010105
+#define OID_GEN_MAXIMUM_FRAME_SIZE		0x00010106
+#define OID_GEN_LINK_SPEED			0x00010107
+#define OID_GEN_TRANSMIT_BUFFER_SPACE		0x00010108
+#define OID_GEN_RECEIVE_BUFFER_SPACE		0x00010109
+#define OID_GEN_TRANSMIT_BLOCK_SIZE		0x0001010A
+#define OID_GEN_RECEIVE_BLOCK_SIZE		0x0001010B
+#define OID_GEN_VENDOR_ID			0x0001010C
+#define OID_GEN_VENDOR_DESCRIPTION		0x0001010D
+#define OID_GEN_CURRENT_PACKET_FILTER		0x0001010E
+#define OID_GEN_CURRENT_LOOKAHEAD		0x0001010F
+#define OID_GEN_DRIVER_VERSION			0x00010110
+#define OID_GEN_MAXIMUM_TOTAL_SIZE		0x00010111
+#define OID_GEN_PROTOCOL_OPTIONS		0x00010112
+#define OID_GEN_MAC_OPTIONS			0x00010113
+#define OID_GEN_MEDIA_CONNECT_STATUS		0x00010114
+#define OID_GEN_MAXIMUM_SEND_PACKETS		0x00010115
+#define OID_GEN_VENDOR_DRIVER_VERSION		0x00010116
+#define OID_GEN_SUPPORTED_GUIDS			0x00010117
+#define OID_GEN_NETWORK_LAYER_ADDRESSES		0x00010118	/* Set only */
+#define OID_GEN_TRANSPORT_HEADER_OFFSET		0x00010119	/* Set only */
+#define OID_GEN_MACHINE_NAME			0x0001021A
+#define OID_GEN_RNDIS_CONFIG_PARAMETER		0x0001021B	/* Set only */
+#define OID_GEN_VLAN_ID				0x0001021C
+
+/* Optional OIDs. */
+#define OID_GEN_MEDIA_CAPABILITIES		0x00010201
+#define OID_GEN_PHYSICAL_MEDIUM			0x00010202
+
+/* Required statistics OIDs. */
+#define OID_GEN_XMIT_OK				0x00020101
+#define OID_GEN_RCV_OK				0x00020102
+#define OID_GEN_XMIT_ERROR			0x00020103
+#define OID_GEN_RCV_ERROR			0x00020104
+#define OID_GEN_RCV_NO_BUFFER			0x00020105
+
+/* Optional OID statistics */
+#define OID_GEN_DIRECTED_BYTES_XMIT		0x00020201
+#define OID_GEN_DIRECTED_FRAMES_XMIT		0x00020202
+#define OID_GEN_MULTICAST_BYTES_XMIT		0x00020203
+#define OID_GEN_MULTICAST_FRAMES_XMIT		0x00020204
+#define OID_GEN_BROADCAST_BYTES_XMIT		0x00020205
+#define OID_GEN_BROADCAST_FRAMES_XMIT		0x00020206
+#define OID_GEN_DIRECTED_BYTES_RCV		0x00020207
+#define OID_GEN_DIRECTED_FRAMES_RCV		0x00020208
+#define OID_GEN_MULTICAST_BYTES_RCV		0x00020209
+#define OID_GEN_MULTICAST_FRAMES_RCV		0x0002020A
+#define OID_GEN_BROADCAST_BYTES_RCV		0x0002020B
+#define OID_GEN_BROADCAST_FRAMES_RCV		0x0002020C
+#define OID_GEN_RCV_CRC_ERROR			0x0002020D
+#define OID_GEN_TRANSMIT_QUEUE_LENGTH		0x0002020E
+#define OID_GEN_GET_TIME_CAPS			0x0002020F
+#define OID_GEN_GET_NETCARD_TIME		0x00020210
+#define OID_GEN_NETCARD_LOAD			0x00020211
+#define OID_GEN_DEVICE_PROFILE			0x00020212
+
+/* 802.3 (ethernet) OIDs */
+#define OID_802_3_PERMANENT_ADDRESS		0x01010101
+#define OID_802_3_CURRENT_ADDRESS		0x01010102
+#define OID_802_3_MULTICAST_LIST		0x01010103
+#define OID_802_3_MAXIMUM_LIST_SIZE		0x01010104
+#define OID_802_3_MAC_OPTIONS			0x01010105
+#define NDIS_802_3_MAC_OPTION_PRIORITY		0x00000001
+#define OID_802_3_RCV_ERROR_ALIGNMENT		0x01020101
+#define OID_802_3_XMIT_ONE_COLLISION		0x01020102
+#define OID_802_3_XMIT_MORE_COLLISIONS		0x01020103
+#define OID_802_3_XMIT_DEFERRED			0x01020201
+#define OID_802_3_XMIT_MAX_COLLISIONS		0x01020202
+#define OID_802_3_RCV_OVERRUN			0x01020203
+#define OID_802_3_XMIT_UNDERRUN			0x01020204
+#define OID_802_3_XMIT_HEARTBEAT_FAILURE	0x01020205
+#define OID_802_3_XMIT_TIMES_CRS_LOST		0x01020206
+#define OID_802_3_XMIT_LATE_COLLISIONS		0x01020207
+
+/* PnP and power management OIDs */
+#define OID_PNP_CAPABILITIES			0xFD010100
+#define OID_PNP_SET_POWER			0xFD010101
+#define OID_PNP_QUERY_POWER			0xFD010102
+#define OID_PNP_ADD_WAKE_UP_PATTERN		0xFD010103
+#define OID_PNP_REMOVE_WAKE_UP_PATTERN		0xFD010104
+#define OID_PNP_WAKE_UP_PATTERN_LIST		0xFD010105
+#define OID_PNP_ENABLE_WAKE_UP			0xFD010106
+
+/* PnP/PM Statistics (Optional). */
+#define OID_PNP_WAKE_UP_OK			0xFD020200
+#define OID_PNP_WAKE_UP_ERROR			0xFD020201
+
+/* The following bits are defined for OID_PNP_ENABLE_WAKE_UP */
+#define NDIS_PNP_WAKE_UP_MAGIC_PACKET		0x00000001
+#define NDIS_PNP_WAKE_UP_PATTERN_MATCH		0x00000002
+#define NDIS_PNP_WAKE_UP_LINK_CHANGE		0x00000004
+
+/* 802.11 OIDs */
+#define OID_802_11_BSSID			0x0D010101
+#define OID_802_11_SSID				0x0D010102
+#define OID_802_11_NETWORK_TYPES_SUPPORTED	0x0D010203
+#define OID_802_11_NETWORK_TYPE_IN_USE		0x0D010204
+#define OID_802_11_TX_POWER_LEVEL		0x0D010205
+#define OID_802_11_RSSI				0x0D010206
+#define OID_802_11_RSSI_TRIGGER			0x0D010207
+#define OID_802_11_INFRASTRUCTURE_MODE		0x0D010108
+#define OID_802_11_FRAGMENTATION_THRESHOLD	0x0D010209
+#define OID_802_11_RTS_THRESHOLD		0x0D01020A
+#define OID_802_11_NUMBER_OF_ANTENNAS		0x0D01020B
+#define OID_802_11_RX_ANTENNA_SELECTED		0x0D01020C
+#define OID_802_11_TX_ANTENNA_SELECTED		0x0D01020D
+#define OID_802_11_SUPPORTED_RATES		0x0D01020E
+#define OID_802_11_DESIRED_RATES		0x0D010210
+#define OID_802_11_CONFIGURATION		0x0D010211
+#define OID_802_11_STATISTICS			0x0D020212
+#define OID_802_11_ADD_WEP			0x0D010113
+#define OID_802_11_REMOVE_WEP			0x0D010114
+#define OID_802_11_DISASSOCIATE			0x0D010115
+#define OID_802_11_POWER_MODE			0x0D010216
+#define OID_802_11_BSSID_LIST			0x0D010217
+#define OID_802_11_AUTHENTICATION_MODE		0x0D010118
+#define OID_802_11_PRIVACY_FILTER		0x0D010119
+#define OID_802_11_BSSID_LIST_SCAN		0x0D01011A
+#define OID_802_11_WEP_STATUS			0x0D01011B
+#define OID_802_11_ENCRYPTION_STATUS		OID_802_11_WEP_STATUS
+#define OID_802_11_RELOAD_DEFAULTS		0x0D01011C
+#define OID_802_11_ADD_KEY			0x0D01011D
+#define OID_802_11_REMOVE_KEY			0x0D01011E
+#define OID_802_11_ASSOCIATION_INFORMATION	0x0D01011F
+#define OID_802_11_TEST				0x0D010120
+#define OID_802_11_MEDIA_STREAM_MODE		0x0D010121
+#define OID_802_11_CAPABILITY			0x0D010122
+#define OID_802_11_PMKID			0x0D010123
+
+#define NDIS_STATUS_SUCCESS		0
+#define NDIS_STATUS_PENDING		0x00000103
+#define NDIS_STATUS_NOT_RECOGNIZED	0x00010001
+#define NDIS_STATUS_NOT_COPIED		0x00010002
+#define NDIS_STATUS_NOT_ACCEPTED	0x00010003
+#define NDIS_STATUS_CALL_ACTIVE		0x00010007
+#define NDIS_STATUS_ONLINE		0x40010003
+#define NDIS_STATUS_RESET_START		0x40010004
+#define NDIS_STATUS_RESET_END		0x40010005
+#define NDIS_STATUS_RING_STATUS		0x40010006
+#define NDIS_STATUS_CLOSED		0x40010007
+#define NDIS_STATUS_WAN_LINE_UP		0x40010008
+#define NDIS_STATUS_WAN_LINE_DOWN	0x40010009
+#define NDIS_STATUS_WAN_FRAGMENT	0x4001000A
+#define NDIS_STATUS_MEDIA_CONNECT	0x4001000B
+#define NDIS_STATUS_MEDIA_DISCONNECT	0x4001000C
+#define NDIS_STATUS_HARDWARE_LINE_UP	0x4001000D
+#define NDIS_STATUS_HARDWARE_LINE_DOWN	0x4001000E
+#define NDIS_STATUS_INTERFACE_UP	0x4001000F
+#define NDIS_STATUS_INTERFACE_DOWN	0x40010010
+#define NDIS_STATUS_MEDIA_BUSY		0x40010011
+#define NDIS_STATUS_MEDIA_SPECIFIC_INDICATION	0x40010012
+#define NDIS_STATUS_WW_INDICATION NDIS_STATUS_MEDIA_SPECIFIC_INDICATION
+#define NDIS_STATUS_LINK_SPEED_CHANGE	0x40010013
+#define NDIS_STATUS_WAN_GET_STATS	0x40010014
+#define NDIS_STATUS_WAN_CO_FRAGMENT	0x40010015
+#define NDIS_STATUS_WAN_CO_LINKPARAMS	0x40010016
+#define NDIS_STATUS_NOT_RESETTABLE	0x80010001
+#define NDIS_STATUS_SOFT_ERRORS		0x80010003
+#define NDIS_STATUS_HARD_ERRORS		0x80010004
+#define NDIS_STATUS_BUFFER_OVERFLOW	0x80000005
+#define NDIS_STATUS_FAILURE		0xC0000001
+#define NDIS_STATUS_INVALID_PARAMETER 0xC000000D
+#define NDIS_STATUS_RESOURCES		0xC000009A
+#define NDIS_STATUS_CLOSING		0xC0010002
+#define NDIS_STATUS_BAD_VERSION		0xC0010004
+#define NDIS_STATUS_BAD_CHARACTERISTICS	0xC0010005
+#define NDIS_STATUS_ADAPTER_NOT_FOUND	0xC0010006
+#define NDIS_STATUS_OPEN_FAILED		0xC0010007
+#define NDIS_STATUS_DEVICE_FAILED	0xC0010008
+#define NDIS_STATUS_MULTICAST_FULL	0xC0010009
+#define NDIS_STATUS_MULTICAST_EXISTS	0xC001000A
+#define NDIS_STATUS_MULTICAST_NOT_FOUND	0xC001000B
+#define NDIS_STATUS_REQUEST_ABORTED	0xC001000C
+#define NDIS_STATUS_RESET_IN_PROGRESS	0xC001000D
+#define NDIS_STATUS_CLOSING_INDICATING	0xC001000E
+#define NDIS_STATUS_BAD_VERSION		0xC0010004
+#define NDIS_STATUS_NOT_SUPPORTED	0xC00000BB
+#define NDIS_STATUS_INVALID_PACKET	0xC001000F
+#define NDIS_STATUS_OPEN_LIST_FULL	0xC0010010
+#define NDIS_STATUS_ADAPTER_NOT_READY	0xC0010011
+#define NDIS_STATUS_ADAPTER_NOT_OPEN	0xC0010012
+#define NDIS_STATUS_NOT_INDICATING	0xC0010013
+#define NDIS_STATUS_INVALID_LENGTH	0xC0010014
+#define NDIS_STATUS_INVALID_DATA	0xC0010015
+#define NDIS_STATUS_BUFFER_TOO_SHORT	0xC0010016
+#define NDIS_STATUS_INVALID_OID		0xC0010017
+#define NDIS_STATUS_ADAPTER_REMOVED	0xC0010018
+#define NDIS_STATUS_UNSUPPORTED_MEDIA	0xC0010019
+#define NDIS_STATUS_GROUP_ADDRESS_IN_USE	0xC001001A
+#define NDIS_STATUS_FILE_NOT_FOUND	0xC001001B
+#define NDIS_STATUS_ERROR_READING_FILE	0xC001001C
+#define NDIS_STATUS_ALREADY_MAPPED	0xC001001D
+#define NDIS_STATUS_RESOURCE_CONFLICT	0xC001001E
+#define NDIS_STATUS_NO_CABLE		0xC001001F
+#define NDIS_STATUS_INVALID_SAP		0xC0010020
+#define NDIS_STATUS_SAP_IN_USE		0xC0010021
+#define NDIS_STATUS_INVALID_ADDRESS	0xC0010022
+#define NDIS_STATUS_VC_NOT_ACTIVATED	0xC0010023
+#define NDIS_STATUS_DEST_OUT_OF_ORDER	0xC0010024
+#define NDIS_STATUS_VC_NOT_AVAILABLE	0xC0010025
+#define NDIS_STATUS_CELLRATE_NOT_AVAILABLE	0xC0010026
+#define NDIS_STATUS_INCOMPATABLE_QOS	0xC0010027
+#define NDIS_STATUS_AAL_PARAMS_UNSUPPORTED	0xC0010028
+#define NDIS_STATUS_NO_ROUTE_TO_DESTINATION	0xC0010029
+#define NDIS_STATUS_TOKEN_RING_OPEN_ERROR	0xC0011000
+#define NDIS_STATUS_INVALID_DEVICE_REQUEST	0xC0000010
+#define NDIS_STATUS_NETWORK_UNREACHABLE         0xC000023C
+
+/* Event codes */
+
+#define EVENT_NDIS_RESOURCE_CONFLICT	0xC0001388
+#define EVENT_NDIS_OUT_OF_RESOURCE	0xC0001389
+#define EVENT_NDIS_HARDWARE_FAILURE	0xC000138A
+#define EVENT_NDIS_ADAPTER_NOT_FOUND	0xC000138B
+#define EVENT_NDIS_INTERRUPT_CONNECT	0xC000138C
+#define EVENT_NDIS_DRIVER_FAILURE	0xC000138D
+#define EVENT_NDIS_BAD_VERSION		0xC000138E
+#define EVENT_NDIS_TIMEOUT		0x8000138F
+#define EVENT_NDIS_NETWORK_ADDRESS	0xC0001390
+#define EVENT_NDIS_UNSUPPORTED_CONFIGURATION	0xC0001391
+#define EVENT_NDIS_INVALID_VALUE_FROM_ADAPTER	0xC0001392
+#define EVENT_NDIS_MISSING_CONFIGURATION_PARAMETER	0xC0001393
+#define EVENT_NDIS_BAD_IO_BASE_ADDRESS	0xC0001394
+#define EVENT_NDIS_RECEIVE_SPACE_SMALL	0x40001395
+#define EVENT_NDIS_ADAPTER_DISABLED	0x80001396
+#define EVENT_NDIS_IO_PORT_CONFLICT	0x80001397
+#define EVENT_NDIS_PORT_OR_DMA_CONFLICT	0x80001398
+#define EVENT_NDIS_MEMORY_CONFLICT	0x80001399
+#define EVENT_NDIS_INTERRUPT_CONFLICT	0x8000139A
+#define EVENT_NDIS_DMA_CONFLICT		0x8000139B
+#define EVENT_NDIS_INVALID_DOWNLOAD_FILE_ERROR	0xC000139C
+#define EVENT_NDIS_MAXRECEIVES_ERROR	0x8000139D
+#define EVENT_NDIS_MAXTRANSMITS_ERROR	0x8000139E
+#define EVENT_NDIS_MAXFRAMESIZE_ERROR	0x8000139F
+#define EVENT_NDIS_MAXINTERNALBUFS_ERROR	0x800013A0
+#define EVENT_NDIS_MAXMULTICAST_ERROR	0x800013A1
+#define EVENT_NDIS_PRODUCTID_ERROR	0x800013A2
+#define EVENT_NDIS_LOBE_FAILUE_ERROR	0x800013A3
+#define EVENT_NDIS_SIGNAL_LOSS_ERROR	0x800013A4
+#define EVENT_NDIS_REMOVE_RECEIVED_ERROR	0x800013A5
+#define EVENT_NDIS_TOKEN_RING_CORRECTION	0x400013A6
+#define EVENT_NDIS_ADAPTER_CHECK_ERROR	0xC00013A7
+#define EVENT_NDIS_RESET_FAILURE_ERROR	0x800013A8
+#define EVENT_NDIS_CABLE_DISCONNECTED_ERROR	0x800013A9
+#define EVENT_NDIS_RESET_FAILURE_CORRECTION	0x800013AA
+
+/* packet filter bits used by NDIS_OID_PACKET_FILTER */
+#define NDIS_PACKET_TYPE_DIRECTED               0x00000001
+#define NDIS_PACKET_TYPE_MULTICAST              0x00000002
+#define NDIS_PACKET_TYPE_ALL_MULTICAST          0x00000004
+#define NDIS_PACKET_TYPE_BROADCAST              0x00000008
+#define NDIS_PACKET_TYPE_SOURCE_ROUTING         0x00000010
+#define NDIS_PACKET_TYPE_PROMISCUOUS            0x00000020
+#define NDIS_PACKET_TYPE_SMT                    0x00000040
+#define NDIS_PACKET_TYPE_ALL_LOCAL              0x00000080
+#define NDIS_PACKET_TYPE_GROUP                  0x00001000
+#define NDIS_PACKET_TYPE_ALL_FUNCTIONAL         0x00002000
+#define NDIS_PACKET_TYPE_FUNCTIONAL             0x00004000
+#define NDIS_PACKET_TYPE_MAC_FRAME              0x00008000
+
+/* memory allocation flags */
+#define NDIS_MEMORY_CONTIGUOUS			0x00000001
+#define NDIS_MEMORY_NONCACHED			0x00000002
+
+/* Atrribute flags to NdisMSetAtrributesEx */
+#define NDIS_ATTRIBUTE_IGNORE_PACKET_TIMEOUT    0x00000001
+#define NDIS_ATTRIBUTE_IGNORE_REQUEST_TIMEOUT   0x00000002
+#define NDIS_ATTRIBUTE_IGNORE_TOKEN_RING_ERRORS 0x00000004
+#define NDIS_ATTRIBUTE_BUS_MASTER               0x00000008
+#define NDIS_ATTRIBUTE_INTERMEDIATE_DRIVER      0x00000010
+#define NDIS_ATTRIBUTE_DESERIALIZE              0x00000020
+#define NDIS_ATTRIBUTE_NO_HALT_ON_SUSPEND       0x00000040
+#define NDIS_ATTRIBUTE_SURPRISE_REMOVE_OK       0x00000080
+#define NDIS_ATTRIBUTE_NOT_CO_NDIS              0x00000100
+#define NDIS_ATTRIBUTE_USES_SAFE_BUFFER_APIS    0x00000200
+
+#define OID_TCP_TASK_OFFLOAD			0xFC010201
+
+#define NDIS_MAC_OPTION_COPY_LOOKAHEAD_DATA	0x00000001
+#define NDIS_MAC_OPTION_RECEIVE_SERIALIZED	0x00000002
+#define NDIS_MAC_OPTION_TRANSFERS_NOT_PEND	0x00000004
+#define NDIS_MAC_OPTION_NO_LOOPBACK		0x00000008
+#define NDIS_MAC_OPTION_FULL_DUPLEX		0x00000010
+#define NDIS_MAC_OPTION_EOTX_INDICATION		0x00000020
+#define NDIS_MAC_OPTION_8021P_PRIORITY		0x00000040
+#define NDIS_MAC_OPTION_SUPPORTS_MAC_ADDRESS_OVERWRITE	0x00000080
+#define NDIS_MAC_OPTION_RECEIVE_AT_DPC		0x00000100
+#define NDIS_MAC_OPTION_8021Q_VLAN		0x00000200
+#define NDIS_MAC_OPTION_RESERVED		0x80000000
+
+#define deserialized_driver(wnd) (wnd->attributes & NDIS_ATTRIBUTE_DESERIALIZE)
+
+static inline void serialize_lock(struct ndis_device *wnd)
+{
+	nt_spin_lock(&wnd->nmb->lock);
+}
+
+static inline void serialize_unlock(struct ndis_device *wnd)
+{
+	nt_spin_unlock(&wnd->nmb->lock);
+}
+
+static inline KIRQL serialize_lock_irql(struct ndis_device *wnd)
+{
+	if (deserialized_driver(wnd))
+		return raise_irql(DISPATCH_LEVEL);
+	else
+		return nt_spin_lock_irql(&wnd->nmb->lock, DISPATCH_LEVEL);
+}
+
+static inline void serialize_unlock_irql(struct ndis_device *wnd,
+					 KIRQL irql)
+{
+	if (deserialized_driver(wnd))
+		lower_irql(irql);
+	else
+		nt_spin_unlock_irql(&wnd->nmb->lock, irql);
+}
+
+static inline void if_serialize_lock(struct ndis_device *wnd)
+{
+	if (!deserialized_driver(wnd))
+		nt_spin_lock(&wnd->nmb->lock);
+}
+
+static inline void if_serialize_unlock(struct ndis_device *wnd)
+{
+	if (!deserialized_driver(wnd))
+		nt_spin_unlock(&wnd->nmb->lock);
+}
+
+#endif /* NDIS_H */
--- linux-rt-2.6.31.orig/ubuntu/ndiswrapper/Kconfig
+++ linux-rt-2.6.31/ubuntu/ndiswrapper/Kconfig
@@ -0,0 +1,4 @@
+config NDISWRAPPER
+	tristate "Wrapper for Windows NDIS network drivers"
+	depends on NET
+	default m
--- linux-rt-2.6.31.orig/ubuntu/ndiswrapper/mkexport.sh
+++ linux-rt-2.6.31/ubuntu/ndiswrapper/mkexport.sh
@@ -0,0 +1,42 @@
+#! /bin/sh
+
+# Generate exports symbol table from C files
+
+input="$1"
+output="$2"
+exports=$(basename "$output" .h)
+exec >"$output"
+
+echo "/* automatically generated from src */";
+
+sed -n -e '/^\(wstdcall\|wfastcall\|noregparm\|__attribute__\)/{
+:more
+N
+s/\([^{]\)$/\1/
+t more
+s/\n{$/;/
+p
+}' $input
+
+echo "#ifdef CONFIG_X86_64";
+
+sed -n \
+	-e 's/.*WIN_FUNC(\([^\,]\+\) *\, *\([0-9]\+\)).*/'\
+'WIN_FUNC_DECL(\1, \2)/p' \
+	-e 's/.*WIN_FUNC_PTR(\([^\,]\+\) *\, *\([0-9]\+\)).*/'\
+'WIN_FUNC_DECL(\1, \2)/p' $input | sort -u
+
+echo "#endif"
+echo "extern struct wrap_export $exports[];"
+echo "struct wrap_export $exports[] = {"
+
+sed -n \
+	-e 's/.*WIN_FUNC(_win_\([^\,]\+\) *\, *\([0-9]\+\)).*/'\
+'	WIN_WIN_SYMBOL(\1, \2),/p' \
+	-e 's/.*WIN_FUNC(\([^\,]\+\) *\, *\([0-9]\+\)).*/'\
+'	WIN_SYMBOL(\1, \2),/p' \
+	-e 's/.*WIN_SYMBOL_MAP(\("[^"]\+"\)[ ,\n]\+\([^)]\+\)).*/'\
+'	{\1, (generic_func)\2},/p' $input | sort -u
+
+echo "	{NULL, NULL}"
+echo "};"
--- linux-rt-2.6.31.orig/ubuntu/ndiswrapper/win2lin_stubs.S
+++ linux-rt-2.6.31/ubuntu/ndiswrapper/win2lin_stubs.S
@@ -0,0 +1,288 @@
+/*
+ *  Copyright (C) 2005 Karl Vogel, Giridhar Pemmasani
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ *  GNU General Public License for more details.
+ *
+ */
+
+#include <linux/linkage.h>
+
+#ifdef CONFIG_X86_64
+
+/*
+# Windows <---> Linux register usage conversion when calling functions
+# V = Volatile
+# NV = Non Volatile (needs to be saved)
+#
+#         Win                     Lin
+# ---------------------------------------
+# Rax    Return           V       Return          V
+# Rbx                     NV                      NV
+# Rcx     Arg1            V       Arg4            V
+# Rdx     Arg2            V       Arg3            V
+# Rsi                     NV      Arg2            V
+# Rdi                     NV      Arg1            V
+# Rsp                     NV                      NV
+# Rbp                     NV                      NV
+# R8      Arg3            V       Arg5            V
+# R9      Arg4            V       Arg6            V
+# R10                     V                       V
+# R11                     V                       V
+# R12                     NV                      NV
+# R13                     NV                      NV
+# R14                     NV                      NV
+# R15                     NV                      NV
+#
+# In addition, Linux uses %rax to indicate number of SSE registers used
+# when variadic functions are called. Since there is no way to obtain this
+# from Windows, for now, we just assume this is 0 (hence %rax is cleared).
+#
+# Windows pushes arguments 5 and higher onto stack in case of integer
+# variables and 4 and higher in case of floating point variabes (passed
+# in SSE registers).
+
+In a windows function, the stackframe/registers look like this:
+
+# 0x0048 ....
+# 0x0040 arg8
+# 0x0038 arg7
+# 0x0030 arg6
+# 0x0028 arg5
+# 0x0020 shadow/spill space for arg4
+# 0x0018 shadow/spill space for arg3
+# 0x0010 shadow/spill space for arg2
+# 0x0008 shadow/spill space for arg1
+# 0x0000 ret
+
+# register spill space is same irrespective of number of arguments - even
+# if Windows function takes less than 4 arguments, 32 bytes above return
+# address is reserved for the function
+
+In Linux it should look like:
+
+# 0x0018 ....
+# 0x0010 arg8
+# 0x0008 arg7
+# 0x0000 ret
+
+*/
+
+#
+# setup for Windows to Linux function call
+#
+
+	.text
+
+.macro win2lin_prolog
+	push	%rsi
+	push	%rdi
+.endm
+
+.macro win2lin_epilog
+	pop	%rdi
+	pop	%rsi
+.endm
+
+# when Windows function calls Linux function, the function address is in %r10
+
+.macro call_lin_func
+	xor	%rax, %rax	# rax indicates number of SSE regs
+	call	*%r10
+.endm
+
+# before prolog, 0(%rsp) is return address, 8(%rsp) would be arg1
+# (but it is in register) and so on, so n'th arg would be at n*8(%rsp)
+# for n > 4. But in prolog, we push 2 registers that are non-volaile in
+# Windows, but volatile in Linux. So after prolog, args are at (n+2)*8(%rsp)
+
+#define win2lin_win_arg(n) (n+2)*8(%rsp)
+
+#define win2lin_arg1 mov %rcx, %rdi
+#define win2lin_arg2 mov %rdx, %rsi
+#define win2lin_arg3 mov %r8, %rdx
+#define win2lin_arg4 mov %r9, %rcx
+#define win2lin_arg5 mov win2lin_win_arg(5), %r8
+#define win2lin_arg6 mov win2lin_win_arg(6), %r9
+
+	.type	win2lin0, @function
+win2lin0:
+	win2lin_prolog
+	call_lin_func
+	win2lin_epilog
+	ret
+	.size	win2lin0, .-win2lin0
+
+	.type	win2lin1, @function
+win2lin1:
+	win2lin_prolog
+	win2lin_arg1
+	call_lin_func
+	win2lin_epilog
+	ret
+	.size	win2lin1, .-win2lin1
+
+	.type	win2lin2, @function
+win2lin2:
+	win2lin_prolog
+	win2lin_arg1
+	win2lin_arg2
+	call_lin_func
+	win2lin_epilog
+	ret
+	.size	win2lin2, .-win2lin2
+
+	.type	win2lin3, @function
+win2lin3:
+	win2lin_prolog
+	win2lin_arg1
+	win2lin_arg2
+	win2lin_arg3
+	call_lin_func
+	win2lin_epilog
+	ret
+	.size	win2lin3, .-win2lin3
+
+	.type	win2lin4, @function
+win2lin4:
+	win2lin_prolog
+	win2lin_arg1
+	win2lin_arg2
+	win2lin_arg3
+	win2lin_arg4
+	call_lin_func
+	win2lin_epilog
+	ret
+	.size	win2lin4, .-win2lin4
+
+	.type	win2lin5, @function
+win2lin5:
+	win2lin_prolog
+	win2lin_arg1
+	win2lin_arg2
+	win2lin_arg3
+	win2lin_arg4
+	win2lin_arg5
+	call_lin_func
+	win2lin_epilog
+	ret
+	.size	win2lin5, .-win2lin5
+
+	.type	win2lin6, @function
+win2lin6:
+	win2lin_prolog
+	win2lin_arg1
+	win2lin_arg2
+	win2lin_arg3
+	win2lin_arg4
+	win2lin_arg5
+	win2lin_arg6
+	call_lin_func
+	win2lin_epilog
+	ret
+	.size	win2lin6, .-win2lin6
+
+# Allocate stack frame for Linux arguments before calling function.
+# First 6 args are passed through registers, so we need space for 7 and above.
+# The arguments should have been copied onto stack already.
+
+.macro call_lin_func_args n
+	sub $(\n-6)*8, %rsp
+	call_lin_func
+	add $(\n-6)*8, %rsp
+	.endm
+
+# m is index of Linux arg required, n is total number of args to function
+# After stack frame is allocated, Linux arg 7 should be at 0(%rsp),
+# arg 8 should be at 1*8(%rsp) and so on. So Linux arg m should be at (m-7)*8
+# Stack frame starts at -(n-6)*8(%rsp), so before stack frame is allocated
+# Linux arg m should be at (6-n+m-7)*8(%rsp)
+
+#define win2lin_lin_arg(m,n) (m-1-n)*8(%rsp)
+
+	.type	win2lin7, @function
+win2lin7:
+	win2lin_prolog
+
+	win2lin_arg1
+	win2lin_arg2
+	win2lin_arg3
+	win2lin_arg4
+	win2lin_arg5
+	win2lin_arg6
+
+	# copy windows argument 7 onto stack for Linux function
+	mov	win2lin_win_arg(7), %r11
+	mov	%r11, win2lin_lin_arg(7,7)
+
+	call_lin_func_args(7)
+	win2lin_epilog
+	ret
+	.size	win2lin7, .-win2lin7
+
+	.type	win2lin8, @function
+win2lin8:
+	win2lin_prolog
+
+	win2lin_arg1
+	win2lin_arg2
+	win2lin_arg3
+	win2lin_arg4
+	win2lin_arg5
+	win2lin_arg6
+
+	# copy windows arguments 7 and 8 onto stack for Linux function
+	mov	win2lin_win_arg(7), %r11
+	mov	%r11, win2lin_lin_arg(7,8)
+	mov	win2lin_win_arg(8), %r11
+	mov	%r11, win2lin_lin_arg(8,8)
+
+	call_lin_func_args(8)
+	win2lin_epilog
+	ret
+	.size	win2lin8, .-win2lin8
+
+	.type	win2lin9, @function
+win2lin9:
+win2lin10:
+win2lin11:
+win2lin12:
+	win2lin_prolog
+
+	# since we destroy rsi and rdi here, first copy windows
+	# arguments 7 through 12 onto stack for Linux function
+	mov	%rcx, %r11		# save rcx
+	lea	win2lin_win_arg(7), %rsi	# source (windows arg 7 and up)
+	lea	win2lin_lin_arg(7,12), %rdi	# = destination
+	mov	$6, %rcx			# 6 arguments
+	rep
+	movsq
+	mov	%r11, %rcx		# restore rcx
+
+	win2lin_arg1
+	win2lin_arg2
+	win2lin_arg3
+	win2lin_arg4
+	win2lin_arg5
+	win2lin_arg6
+
+	call_lin_func_args(12)
+	win2lin_epilog
+	ret
+	.size	win2lin9, .-win2lin9
+
+#define win2lin(name, argc)			\
+ENTRY(win2lin_ ## name ## _ ## argc)		\
+	lea	name(%rip), %r10 ; 		\
+	jmp	win2lin ## argc
+
+#include "win2lin_stubs.h"
+
+#endif // CONFIG_X86_64
--- linux-rt-2.6.31.orig/ubuntu/ndiswrapper/divdi3.c
+++ linux-rt-2.6.31/ubuntu/ndiswrapper/divdi3.c
@@ -0,0 +1,329 @@
+/* 64-bit multiplication and division
+   Copyright (C) 1989, 1992-1999, 2000, 2001, 2002, 2003
+   Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, write to the Free
+   Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
+   02111-1307 USA.  */
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+
+#if BITS_PER_LONG != 32
+#error This is for 32-bit targets only
+#endif
+
+typedef unsigned int UQItype	__attribute__ ((mode (QI)));
+typedef          int SItype	__attribute__ ((mode (SI)));
+typedef unsigned int USItype	__attribute__ ((mode (SI)));
+typedef          int DItype	__attribute__ ((mode (DI)));
+typedef unsigned int UDItype	__attribute__ ((mode (DI)));
+#define Wtype SItype
+#define HWtype SItype
+#define DWtype DItype
+#define UWtype USItype
+#define UHWtype USItype
+#define UDWtype UDItype
+#define W_TYPE_SIZE 32
+
+#include "longlong.h"
+
+#if defined(__BIG_ENDIAN)
+struct DWstruct { Wtype high, low;};
+#elif defined(__LITTLE_ENDIAN)
+struct DWstruct { Wtype low, high;};
+#else
+#error Unhandled endianity
+#endif
+typedef union { struct DWstruct s; DWtype ll; } DWunion;
+
+/* Prototypes of exported functions.  */
+extern DWtype __divdi3 (DWtype u, DWtype v);
+extern DWtype __moddi3 (DWtype u, DWtype v);
+extern UDWtype __udivdi3 (UDWtype u, UDWtype v);
+extern UDWtype __umoddi3 (UDWtype u, UDWtype v);
+
+static UDWtype
+__udivmoddi4 (UDWtype n, UDWtype d, UDWtype *rp)
+{
+  DWunion ww;
+  DWunion nn, dd;
+  DWunion rr;
+  UWtype d0, d1, n0, n1, n2;
+  UWtype q0, q1;
+  UWtype b, bm;
+
+  nn.ll = n;
+  dd.ll = d;
+
+  d0 = dd.s.low;
+  d1 = dd.s.high;
+  n0 = nn.s.low;
+  n1 = nn.s.high;
+
+#if !UDIV_NEEDS_NORMALIZATION
+  if (d1 == 0)
+    {
+      if (d0 > n1)
+	{
+	  /* 0q = nn / 0D */
+
+	  udiv_qrnnd (q0, n0, n1, n0, d0);
+	  q1 = 0;
+
+	  /* Remainder in n0.  */
+	}
+      else
+	{
+	  /* qq = NN / 0d */
+
+	  if (d0 == 0)
+	    d0 = 1 / d0;	/* Divide intentionally by zero.  */
+
+	  udiv_qrnnd (q1, n1, 0, n1, d0);
+	  udiv_qrnnd (q0, n0, n1, n0, d0);
+
+	  /* Remainder in n0.  */
+	}
+
+      if (rp != 0)
+	{
+	  rr.s.low = n0;
+	  rr.s.high = 0;
+	  *rp = rr.ll;
+	}
+    }
+
+#else /* UDIV_NEEDS_NORMALIZATION */
+
+  if (d1 == 0)
+    {
+      if (d0 > n1)
+	{
+	  /* 0q = nn / 0D */
+
+	  count_leading_zeros (bm, d0);
+
+	  if (bm != 0)
+	    {
+	      /* Normalize, i.e. make the most significant bit of the
+		 denominator set.  */
+
+	      d0 = d0 << bm;
+	      n1 = (n1 << bm) | (n0 >> (W_TYPE_SIZE - bm));
+	      n0 = n0 << bm;
+	    }
+
+	  udiv_qrnnd (q0, n0, n1, n0, d0);
+	  q1 = 0;
+
+	  /* Remainder in n0 >> bm.  */
+	}
+      else
+	{
+	  /* qq = NN / 0d */
+
+	  if (d0 == 0)
+	    d0 = 1 / d0;	/* Divide intentionally by zero.  */
+
+	  count_leading_zeros (bm, d0);
+
+	  if (bm == 0)
+	    {
+	      /* From (n1 >= d0) /\ (the most significant bit of d0 is set),
+		 conclude (the most significant bit of n1 is set) /\ (the
+		 leading quotient digit q1 = 1).
+
+		 This special case is necessary, not an optimization.
+		 (Shifts counts of W_TYPE_SIZE are undefined.)  */
+
+	      n1 -= d0;
+	      q1 = 1;
+	    }
+	  else
+	    {
+	      /* Normalize.  */
+
+	      b = W_TYPE_SIZE - bm;
+
+	      d0 = d0 << bm;
+	      n2 = n1 >> b;
+	      n1 = (n1 << bm) | (n0 >> b);
+	      n0 = n0 << bm;
+
+	      udiv_qrnnd (q1, n1, n2, n1, d0);
+	    }
+
+	  /* n1 != d0...  */
+
+	  udiv_qrnnd (q0, n0, n1, n0, d0);
+
+	  /* Remainder in n0 >> bm.  */
+	}
+
+      if (rp != 0)
+	{
+	  rr.s.low = n0 >> bm;
+	  rr.s.high = 0;
+	  *rp = rr.ll;
+	}
+    }
+#endif /* UDIV_NEEDS_NORMALIZATION */
+
+  else
+    {
+      if (d1 > n1)
+	{
+	  /* 00 = nn / DD */
+
+	  q0 = 0;
+	  q1 = 0;
+
+	  /* Remainder in n1n0.  */
+	  if (rp != 0)
+	    {
+	      rr.s.low = n0;
+	      rr.s.high = n1;
+	      *rp = rr.ll;
+	    }
+	}
+      else
+	{
+	  /* 0q = NN / dd */
+
+	  count_leading_zeros (bm, d1);
+	  if (bm == 0)
+	    {
+	      /* From (n1 >= d1) /\ (the most significant bit of d1 is set),
+		 conclude (the most significant bit of n1 is set) /\ (the
+		 quotient digit q0 = 0 or 1).
+
+		 This special case is necessary, not an optimization.  */
+
+	      /* The condition on the next line takes advantage of that
+		 n1 >= d1 (true due to program flow).  */
+	      if (n1 > d1 || n0 >= d0)
+		{
+		  q0 = 1;
+		  sub_ddmmss (n1, n0, n1, n0, d1, d0);
+		}
+	      else
+		q0 = 0;
+
+	      q1 = 0;
+
+	      if (rp != 0)
+		{
+		  rr.s.low = n0;
+		  rr.s.high = n1;
+		  *rp = rr.ll;
+		}
+	    }
+	  else
+	    {
+	      UWtype m1, m0;
+	      /* Normalize.  */
+
+	      b = W_TYPE_SIZE - bm;
+
+	      d1 = (d1 << bm) | (d0 >> b);
+	      d0 = d0 << bm;
+	      n2 = n1 >> b;
+	      n1 = (n1 << bm) | (n0 >> b);
+	      n0 = n0 << bm;
+
+	      udiv_qrnnd (q0, n1, n2, n1, d1);
+	      umul_ppmm (m1, m0, q0, d0);
+
+	      if (m1 > n1 || (m1 == n1 && m0 > n0))
+		{
+		  q0--;
+		  sub_ddmmss (m1, m0, m1, m0, d1, d0);
+		}
+
+	      q1 = 0;
+
+	      /* Remainder in (n1n0 - m1m0) >> bm.  */
+	      if (rp != 0)
+		{
+		  sub_ddmmss (n1, n0, n1, n0, m1, m0);
+		  rr.s.low = (n1 << b) | (n0 >> bm);
+		  rr.s.high = n1 >> bm;
+		  *rp = rr.ll;
+		}
+	    }
+	}
+    }
+
+  ww.s.low = q0;
+  ww.s.high = q1;
+  return ww.ll;
+}
+
+DWtype
+__divdi3 (DWtype u, DWtype v)
+{
+  Wtype c = 0;
+  DWtype w;
+
+  if (u < 0)
+    {
+      c = ~c;
+      u = -u;
+    }
+  if (v < 0)
+    {
+      c = ~c;
+      v = -v;
+    }
+  w = __udivmoddi4 (u, v, NULL);
+  if (c)
+    w = -w;
+  return w;
+}
+
+DWtype
+__moddi3 (DWtype u, DWtype v)
+{
+  Wtype c = 0;
+  DWtype w;
+
+  if (u < 0)
+    {
+      c = ~c;
+      u = -u;
+    }
+  if (v < 0)
+    v = -v;
+  __udivmoddi4 (u, v, &w);
+  if (c)
+    w = -w;
+  return w;
+}
+
+UDWtype
+__udivdi3 (UDWtype u, UDWtype v)
+{
+  return __udivmoddi4 (u, v, NULL);
+}
+
+UDWtype
+__umoddi3 (UDWtype u, UDWtype v)
+{
+  UDWtype w;
+
+  __udivmoddi4 (u, v, &w);
+  return w;
+}
--- linux-rt-2.6.31.orig/ubuntu/ndiswrapper/wrapndis.h
+++ linux-rt-2.6.31/ubuntu/ndiswrapper/wrapndis.h
@@ -0,0 +1,90 @@
+/*
+ *  Copyright (C) 2003-2005 Pontus Fuchs, Giridhar Pemmasani
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ *  GNU General Public License for more details.
+ *
+ */
+
+#ifndef _WRAPNDIS_H_
+#define _WRAPNDIS_H_
+
+#include "ndis.h"
+#include "pnp.h"
+
+int wrapndis_init(void);
+void wrapndis_exit(void);
+
+NDIS_STATUS mp_reset(struct ndis_device *wnd);
+
+NDIS_STATUS mp_request(enum ndis_request_type request,
+		       struct ndis_device *wnd, ndis_oid oid,
+		       void *buf, ULONG buflen, ULONG *written, ULONG *needed);
+
+static inline NDIS_STATUS mp_query_info(struct ndis_device *wnd,
+					ndis_oid oid, void *buf, ULONG buflen,
+					ULONG *written, ULONG *needed)
+{
+	return mp_request(NdisRequestQueryInformation, wnd, oid,
+			  buf, buflen, written, needed);
+}
+
+static inline NDIS_STATUS mp_set_info(struct ndis_device *wnd,
+				      ndis_oid oid, void *buf, ULONG buflen,
+				      ULONG *written, ULONG *needed)
+{
+	return mp_request(NdisRequestSetInformation, wnd, oid,
+			  buf, buflen, written, needed);
+}
+
+static inline NDIS_STATUS mp_query(struct ndis_device *wnd, ndis_oid oid,
+				   void *buf, ULONG buflen)
+{
+	return mp_request(NdisRequestQueryInformation, wnd, oid,
+			  buf, buflen, NULL, NULL);
+}
+
+static inline NDIS_STATUS mp_query_int(struct ndis_device *wnd,
+				       ndis_oid oid, ULONG *data)
+{
+	return mp_request(NdisRequestQueryInformation, wnd, oid,
+			  data, sizeof(ULONG), NULL, NULL);
+}
+
+static inline NDIS_STATUS mp_set(struct ndis_device *wnd, ndis_oid oid,
+				 void *buf, ULONG buflen)
+{
+	return mp_request(NdisRequestSetInformation, wnd, oid,
+			  buf, buflen, NULL, NULL);
+}
+
+static inline NDIS_STATUS mp_set_int(struct ndis_device *wnd,
+				     ndis_oid oid, ULONG data)
+{
+	return mp_request(NdisRequestSetInformation, wnd, oid,
+			  &data, sizeof(ULONG), NULL, NULL);
+}
+
+void free_tx_packet(struct ndis_device *wnd, struct ndis_packet *packet,
+		    NDIS_STATUS status);
+int init_ndis_driver(struct driver_object *drv_obj);
+NDIS_STATUS ndis_reinit(struct ndis_device *wnd);
+void set_media_state(struct ndis_device *wnd, enum ndis_media_state state);
+
+void hangcheck_add(struct ndis_device *wnd);
+void hangcheck_del(struct ndis_device *wnd);
+
+driver_dispatch_t winNdisDispatchPnp;
+driver_dispatch_t winNdisDispatchPower;
+driver_dispatch_t winNdisDispatchDeviceControl;
+
+struct iw_statistics *get_iw_stats(struct net_device *dev);
+
+#endif
--- linux-rt-2.6.31.orig/ubuntu/ndiswrapper/loader.c
+++ linux-rt-2.6.31/ubuntu/ndiswrapper/loader.c
@@ -0,0 +1,877 @@
+/*
+ *  Copyright (C) 2003-2005 Pontus Fuchs, Giridhar Pemmasani
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ *  GNU General Public License for more details.
+ *
+ */
+
+#include "ndis.h"
+#include "loader.h"
+#include "wrapndis.h"
+#include "pnp.h"
+
+#include <linux/module.h>
+#include <linux/kmod.h>
+#include <linux/miscdevice.h>
+#include <asm/uaccess.h>
+
+/*
+  Network adapter: ClassGuid = {4d36e972-e325-11ce-bfc1-08002be10318}
+  Network client: ClassGuid = {4d36e973-e325-11ce-bfc1-08002be10318}
+  PCMCIA adapter: ClassGuid = {4d36e977-e325-11ce-bfc1-08002be10318}
+  USB: ClassGuid = {36fc9e60-c465-11cf-8056-444553540000}
+*/
+
+/* the indices used here must match macros WRAP_NDIS_DEVICE etc. */
+static struct guid class_guids[] = {
+	/* Network */
+	{0x4d36e972, 0xe325, 0x11ce, },
+	/* USB WDM */
+	{0x36fc9e60, 0xc465, 0x11cf, },
+	/* Bluetooth */
+	{0xe0cbf06c, 0xcd8b, 0x4647, },
+	/* ivtcorporatino.com's bluetooth device claims this is
+	 * bluetooth guid */
+	{0xf12d3cf8, 0xb11d, 0x457e, },
+};
+
+struct semaphore loader_mutex;
+static struct completion loader_complete;
+
+static struct nt_list wrap_devices;
+static struct nt_list wrap_drivers;
+
+static int wrap_device_type(int data1)
+{
+	int i;
+	for (i = 0; i < sizeof(class_guids) / sizeof(class_guids[0]); i++)
+		if (data1 == class_guids[i].data1)
+			return i;
+	ERROR("unknown device: 0x%x\n", data1);
+	return -1;
+}
+
+/* load driver for given device, if not already loaded */
+struct wrap_driver *load_wrap_driver(struct wrap_device *wd)
+{
+	int ret;
+	struct nt_list *cur;
+	struct wrap_driver *wrap_driver;
+
+	ENTER1("device: %04X:%04X:%04X:%04X", wd->vendor, wd->device,
+	       wd->subvendor, wd->subdevice);
+	if (down_interruptible(&loader_mutex)) {
+		WARNING("couldn't obtain loader_mutex");
+		EXIT1(return NULL);
+	}
+	wrap_driver = NULL;
+	nt_list_for_each(cur, &wrap_drivers) {
+		wrap_driver = container_of(cur, struct wrap_driver, list);
+		if (!stricmp(wrap_driver->name, wd->driver_name)) {
+			TRACE1("driver %s already loaded", wrap_driver->name);
+			break;
+		} else
+			wrap_driver = NULL;
+	}
+	up(&loader_mutex);
+
+	if (!wrap_driver) {
+		char *argv[] = {"loadndisdriver", WRAP_CMD_LOAD_DRIVER,
+#if defined(DEBUG) && DEBUG >= 1
+				"1",
+#else
+				"0",
+#endif
+				UTILS_VERSION, wd->driver_name,
+				wd->conf_file_name, NULL};
+		char *env[] = {NULL};
+
+		TRACE1("loading driver %s", wd->driver_name);
+		if (down_interruptible(&loader_mutex)) {
+			WARNING("couldn't obtain loader_mutex");
+			EXIT1(return NULL);
+		}
+		INIT_COMPLETION(loader_complete);
+		ret = call_usermodehelper("/sbin/loadndisdriver", argv, env, 1);
+		if (ret) {
+			up(&loader_mutex);
+			ERROR("couldn't load driver %s; check system log "
+			      "for messages from 'loadndisdriver'",
+			      wd->driver_name);
+			EXIT1(return NULL);
+		}
+		wait_for_completion(&loader_complete);
+		TRACE1("%s", wd->driver_name);
+		wrap_driver = NULL;
+		nt_list_for_each(cur, &wrap_drivers) {
+			wrap_driver = container_of(cur, struct wrap_driver,
+						   list);
+			if (!stricmp(wrap_driver->name, wd->driver_name)) {
+				wd->driver = wrap_driver;
+				break;
+			} else
+				wrap_driver = NULL;
+		}
+		up(&loader_mutex);
+		if (wrap_driver)
+			TRACE1("driver %s is loaded", wrap_driver->name);
+		else
+			ERROR("couldn't load driver '%s'", wd->driver_name);
+	}
+	EXIT1(return wrap_driver);
+}
+
+/* load the driver files from userspace. */
+static int load_sys_files(struct wrap_driver *driver,
+			  struct load_driver *load_driver)
+{
+	int i, err;
+
+	TRACE1("num_pe_images = %d", load_driver->num_sys_files);
+	TRACE1("loading driver: %s", load_driver->name);
+	strncpy(driver->name, load_driver->name, sizeof(driver->name));
+	driver->name[sizeof(driver->name)-1] = 0;
+	TRACE1("driver: %s", driver->name);
+	err = 0;
+	driver->num_pe_images = 0;
+	for (i = 0; i < load_driver->num_sys_files; i++) {
+		struct pe_image *pe_image;
+		pe_image = &driver->pe_images[driver->num_pe_images];
+
+		strncpy(pe_image->name, load_driver->sys_files[i].name,
+			sizeof(pe_image->name));
+		pe_image->name[sizeof(pe_image->name)-1] = 0;
+		TRACE1("image size: %lu bytes",
+		       (unsigned long)load_driver->sys_files[i].size);
+
+#ifdef CONFIG_X86_64
+#ifdef PAGE_KERNEL_EXECUTABLE
+		pe_image->image =
+			__vmalloc(load_driver->sys_files[i].size,
+				  GFP_KERNEL | __GFP_HIGHMEM,
+				  PAGE_KERNEL_EXECUTABLE);
+#elif defined PAGE_KERNEL_EXEC
+		pe_image->image =
+			__vmalloc(load_driver->sys_files[i].size,
+				  GFP_KERNEL | __GFP_HIGHMEM,
+				  PAGE_KERNEL_EXEC);
+#else
+#error x86_64 should have either PAGE_KERNEL_EXECUTABLE or PAGE_KERNEL_EXEC
+#endif
+#else
+		/* hate to play with kernel macros, but PAGE_KERNEL_EXEC is
+		 * not available to modules! */
+#ifdef cpu_has_nx
+		if (cpu_has_nx)
+			pe_image->image =
+				__vmalloc(load_driver->sys_files[i].size,
+					  GFP_KERNEL | __GFP_HIGHMEM,
+					  __pgprot(__PAGE_KERNEL & ~_PAGE_NX));
+		else
+			pe_image->image =
+				vmalloc(load_driver->sys_files[i].size);
+#else
+			pe_image->image =
+				vmalloc(load_driver->sys_files[i].size);
+#endif
+#endif
+		if (!pe_image->image) {
+			ERROR("couldn't allocate memory");
+			err = -ENOMEM;
+			break;
+		}
+		TRACE1("image is at %p", pe_image->image);
+
+		if (copy_from_user(pe_image->image,
+				   load_driver->sys_files[i].data,
+				   load_driver->sys_files[i].size)) {
+			ERROR("couldn't load file %s",
+			      load_driver->sys_files[i].name);
+			err = -EFAULT;
+			break;
+		}
+		pe_image->size = load_driver->sys_files[i].size;
+		driver->num_pe_images++;
+	}
+
+	if (!err && link_pe_images(driver->pe_images, driver->num_pe_images)) {
+		ERROR("couldn't prepare driver '%s'", load_driver->name);
+		err = -EINVAL;
+	}
+
+	if (driver->num_pe_images < load_driver->num_sys_files || err) {
+		for (i = 0; i < driver->num_pe_images; i++)
+			if (driver->pe_images[i].image)
+				vfree(driver->pe_images[i].image);
+		driver->num_pe_images = 0;
+		EXIT1(return err);
+	} else
+		EXIT1(return 0);
+}
+
+struct wrap_bin_file *get_bin_file(char *bin_file_name)
+{
+	int i = 0;
+	struct wrap_driver *driver, *cur;
+
+	ENTER1("%s", bin_file_name);
+	if (down_interruptible(&loader_mutex)) {
+		WARNING("couldn't obtain loader_mutex");
+		EXIT1(return NULL);
+	}
+	driver = NULL;
+	nt_list_for_each_entry(cur, &wrap_drivers, list) {
+		for (i = 0; i < cur->num_bin_files; i++)
+			if (!stricmp(cur->bin_files[i].name, bin_file_name)) {
+				driver = cur;
+				break;
+			}
+		if (driver)
+			break;
+	}
+	up(&loader_mutex);
+	if (!driver) {
+		TRACE1("coudln't find bin file '%s'", bin_file_name);
+		return NULL;
+	}
+
+	if (!driver->bin_files[i].data) {
+		char *argv[] = {"loadndisdriver", WRAP_CMD_LOAD_BIN_FILE,
+#if defined(DEBUG) && DEBUG >= 1
+				"1",
+#else
+				"0",
+#endif
+				UTILS_VERSION, driver->name,
+				driver->bin_files[i].name, NULL};
+		char *env[] = {NULL};
+		int ret;
+
+		TRACE1("loading bin file %s/%s", driver->name,
+		       driver->bin_files[i].name);
+		if (down_interruptible(&loader_mutex)) {
+			WARNING("couldn't obtain loader_mutex");
+			EXIT1(return NULL);
+		}
+		INIT_COMPLETION(loader_complete);
+		ret = call_usermodehelper("/sbin/loadndisdriver", argv, env, 1);
+		if (ret) {
+			up(&loader_mutex);
+			ERROR("couldn't load file %s/%s; check system log "
+			      "for messages from 'loadndisdriver' (%d)",
+			      driver->name, driver->bin_files[i].name, ret);
+			EXIT1(return NULL);
+		}
+		wait_for_completion(&loader_complete);
+		up(&loader_mutex);
+		if (!driver->bin_files[i].data) {
+			WARNING("couldn't load binary file %s",
+				driver->bin_files[i].name);
+			EXIT1(return NULL);
+		}
+	}
+	EXIT2(return &(driver->bin_files[i]));
+}
+
+/* called with loader_mutex down */
+static int add_bin_file(struct load_driver_file *driver_file)
+{
+	struct wrap_driver *driver, *cur;
+	struct wrap_bin_file *bin_file;
+	int i = 0;
+
+	driver = NULL;
+	nt_list_for_each_entry(cur, &wrap_drivers, list) {
+		for (i = 0; i < cur->num_bin_files; i++)
+			if (!stricmp(cur->bin_files[i].name,
+				     driver_file->name)) {
+				driver = cur;
+				break;
+			}
+		if (driver)
+			break;
+	}
+	if (!driver) {
+		ERROR("couldn't find %s", driver_file->name);
+		return -EINVAL;
+	}
+	bin_file = &driver->bin_files[i];
+	strncpy(bin_file->name, driver_file->name, sizeof(bin_file->name));
+	bin_file->name[sizeof(bin_file->name)-1] = 0;
+	bin_file->data = vmalloc(driver_file->size);
+	if (!bin_file->data) {
+		ERROR("couldn't allocate memory");
+		return -ENOMEM;
+	}
+	bin_file->size = driver_file->size;
+	if (copy_from_user(bin_file->data, driver_file->data, bin_file->size)) {
+		ERROR("couldn't copy data");
+		free_bin_file(bin_file);
+		return -EFAULT;
+	}
+	return 0;
+}
+
+void free_bin_file(struct wrap_bin_file *bin_file)
+{
+	TRACE2("unloading %s", bin_file->name);
+	if (bin_file->data)
+		vfree(bin_file->data);
+	bin_file->data = NULL;
+	bin_file->size = 0;
+	EXIT2(return);
+}
+
+/* load firmware files from userspace */
+static int load_bin_files_info(struct wrap_driver *driver,
+			       struct load_driver *load_driver)
+{
+	struct wrap_bin_file *bin_files;
+	int i;
+
+	ENTER1("%s, %d", load_driver->name, load_driver->num_bin_files);
+	driver->num_bin_files = 0;
+	driver->bin_files = NULL;
+	if (load_driver->num_bin_files == 0)
+		EXIT1(return 0);
+	bin_files = kzalloc(load_driver->num_bin_files * sizeof(*bin_files),
+			    GFP_KERNEL);
+	if (!bin_files) {
+		ERROR("couldn't allocate memory");
+		EXIT1(return -ENOMEM);
+	}
+
+	for (i = 0; i < load_driver->num_bin_files; i++) {
+		strncpy(bin_files[i].name, load_driver->bin_files[i].name,
+			sizeof(bin_files[i].name));
+		bin_files[i].name[sizeof(bin_files[i].name)-1] = 0;
+		TRACE2("loaded bin file %s", bin_files[i].name);
+	}
+	driver->num_bin_files = load_driver->num_bin_files;
+	driver->bin_files = bin_files;
+	EXIT1(return 0);
+}
+
+/* load settnigs for a device. called with loader_mutex down */
+static int load_settings(struct wrap_driver *wrap_driver,
+			 struct load_driver *load_driver)
+{
+	int i, num_settings;
+
+	ENTER1("%p, %p", wrap_driver, load_driver);
+
+	num_settings = 0;
+	for (i = 0; i < load_driver->num_settings; i++) {
+		struct load_device_setting *load_setting =
+			&load_driver->settings[i];
+		struct wrap_device_setting *setting;
+		ULONG data1;
+
+		setting = kzalloc(sizeof(*setting), GFP_KERNEL);
+		if (!setting) {
+			ERROR("couldn't allocate memory");
+			break;
+		}
+		strncpy(setting->name, load_setting->name,
+			sizeof(setting->name));
+		setting->name[sizeof(setting->name)-1] = 0;
+		strncpy(setting->value, load_setting->value,
+		       sizeof(setting->value));
+		setting->value[sizeof(setting->value)-1] = 0;
+		TRACE2("%p: %s=%s", setting, setting->name, setting->value);
+
+		if (strcmp(setting->name, "driver_version") == 0) {
+			strncpy(wrap_driver->version, setting->value,
+				sizeof(wrap_driver->version));
+			wrap_driver->version[sizeof(wrap_driver->version)-1] = 0;
+		} else if (strcmp(setting->name, "class_guid") == 0 &&
+			   sscanf(setting->value, "%x", &data1) == 1) {
+			wrap_driver->dev_type = wrap_device_type(data1);
+			if (wrap_driver->dev_type < 0) {
+				WARNING("unknown guid: %x", data1);
+				wrap_driver->dev_type = 0;
+			}
+		}
+		InsertTailList(&wrap_driver->settings, &setting->list);
+		num_settings++;
+	}
+	/* it is not a fatal error if some settings couldn't be loaded */
+	if (num_settings > 0)
+		EXIT1(return 0);
+	else
+		EXIT1(return -EINVAL);
+}
+
+void unload_wrap_device(struct wrap_device *wd)
+{
+	struct nt_list *cur;
+	ENTER1("unloading device %p (%04X:%04X:%04X:%04X), driver %s", wd,
+	       wd->vendor, wd->device, wd->subvendor, wd->subdevice,
+	       wd->driver_name);
+	if (down_interruptible(&loader_mutex))
+		WARNING("couldn't obtain loader_mutex");
+	while ((cur = RemoveHeadList(&wd->settings))) {
+		struct wrap_device_setting *setting;
+		setting = container_of(cur, struct wrap_device_setting, list);
+		kfree(setting);
+	}
+	RemoveEntryList(&wd->list);
+	up(&loader_mutex);
+	kfree(wd);
+	EXIT1(return);
+}
+
+/* should be called with loader_mutex down */
+void unload_wrap_driver(struct wrap_driver *driver)
+{
+	int i;
+	struct driver_object *drv_obj;
+	struct nt_list *cur, *next;
+
+	ENTER1("unloading driver: %s (%p)", driver->name, driver);
+	TRACE1("freeing %d images", driver->num_pe_images);
+	drv_obj = driver->drv_obj;
+	for (i = 0; i < driver->num_pe_images; i++)
+		if (driver->pe_images[i].image) {
+			TRACE1("freeing image at %p",
+			       driver->pe_images[i].image);
+			vfree(driver->pe_images[i].image);
+		}
+
+	TRACE1("freeing %d bin files", driver->num_bin_files);
+	for (i = 0; i < driver->num_bin_files; i++) {
+		TRACE1("freeing image at %p", driver->bin_files[i].data);
+		if (driver->bin_files[i].data)
+			vfree(driver->bin_files[i].data);
+	}
+	if (driver->bin_files)
+		kfree(driver->bin_files);
+	RtlFreeUnicodeString(&drv_obj->name);
+	RemoveEntryList(&driver->list);
+	nt_list_for_each_safe(cur, next, &driver->settings) {
+		struct wrap_device_setting *setting;
+		struct ndis_configuration_parameter *param;
+
+		setting = container_of(cur, struct wrap_device_setting, list);
+		TRACE2("%p", setting);
+		param = setting->encoded;
+		if (param) {
+			TRACE2("%p", param);
+			if (param->type == NdisParameterString)
+				RtlFreeUnicodeString(&param->data.string);
+			ExFreePool(param);
+		}
+		kfree(setting);
+	}
+	/* this frees driver */
+	free_custom_extensions(drv_obj->drv_ext);
+	kfree(drv_obj->drv_ext);
+	TRACE1("drv_obj: %p", drv_obj);
+
+	EXIT1(return);
+}
+
+/* call the entry point of the driver */
+static int start_wrap_driver(struct wrap_driver *driver)
+{
+	int i;
+	NTSTATUS ret, res;
+	struct driver_object *drv_obj;
+	typeof(driver->pe_images[0].entry) entry;
+
+	ENTER1("%s", driver->name);
+	drv_obj = driver->drv_obj;
+	for (ret = res = 0, i = 0; i < driver->num_pe_images; i++)
+		/* dlls are already started by loader */
+		if (driver->pe_images[i].type == IMAGE_FILE_EXECUTABLE_IMAGE) {
+			entry = driver->pe_images[i].entry;
+			drv_obj->start = driver->pe_images[i].entry;
+			drv_obj->driver_size = driver->pe_images[i].size;
+			TRACE1("entry: %p, %p, drv_obj: %p",
+			       entry, *entry, drv_obj);
+			res = LIN2WIN2(entry, drv_obj, &drv_obj->name);
+			ret |= res;
+			TRACE1("entry returns %08X", res);
+			break;
+		}
+	if (ret) {
+		ERROR("driver initialization failed: %08X", ret);
+		RtlFreeUnicodeString(&drv_obj->name);
+		/* this frees ndis_driver */
+		free_custom_extensions(drv_obj->drv_ext);
+		kfree(drv_obj->drv_ext);
+		TRACE1("drv_obj: %p", drv_obj);
+		ObDereferenceObject(drv_obj);
+		EXIT1(return -EINVAL);
+	}
+	EXIT1(return 0);
+}
+
+/*
+ * add driver to list of loaded driver but make sure this driver is
+ * not loaded before. called with loader_mutex down
+ */
+static int add_wrap_driver(struct wrap_driver *driver)
+{
+	struct wrap_driver *tmp;
+
+	ENTER1("name: %s", driver->name);
+	nt_list_for_each_entry(tmp, &wrap_drivers, list) {
+		if (stricmp(tmp->name, driver->name) == 0) {
+			ERROR("cannot add duplicate driver");
+			EXIT1(return -EBUSY);
+		}
+	}
+	InsertHeadList(&wrap_drivers, &driver->list);
+	EXIT1(return 0);
+}
+
+/* load a driver from userspace and initialize it. called with
+ * loader_mutex down */
+static int load_user_space_driver(struct load_driver *load_driver)
+{
+	struct driver_object *drv_obj;
+	struct ansi_string ansi_reg;
+	struct wrap_driver *wrap_driver = NULL;
+
+	ENTER1("%p", load_driver);
+	drv_obj = allocate_object(sizeof(*drv_obj), OBJECT_TYPE_DRIVER, NULL);
+	if (!drv_obj) {
+		ERROR("couldn't allocate memory");
+		EXIT1(return -ENOMEM);
+	}
+	TRACE1("drv_obj: %p", drv_obj);
+	drv_obj->drv_ext = kzalloc(sizeof(*(drv_obj->drv_ext)), GFP_KERNEL);
+	if (!drv_obj->drv_ext) {
+		ERROR("couldn't allocate memory");
+		ObDereferenceObject(drv_obj);
+		EXIT1(return -ENOMEM);
+	}
+	InitializeListHead(&drv_obj->drv_ext->custom_ext);
+	if (IoAllocateDriverObjectExtension(drv_obj,
+					    (void *)WRAP_DRIVER_CLIENT_ID,
+					    sizeof(*wrap_driver),
+					    (void **)&wrap_driver) !=
+	    STATUS_SUCCESS)
+		EXIT1(return -ENOMEM);
+	TRACE1("driver: %p", wrap_driver);
+	memset(wrap_driver, 0, sizeof(*wrap_driver));
+	InitializeListHead(&wrap_driver->list);
+	InitializeListHead(&wrap_driver->settings);
+	InitializeListHead(&wrap_driver->wrap_devices);
+	wrap_driver->drv_obj = drv_obj;
+	RtlInitAnsiString(&ansi_reg, "/tmp");
+	if (RtlAnsiStringToUnicodeString(&drv_obj->name, &ansi_reg, TRUE) !=
+	    STATUS_SUCCESS) {
+		ERROR("couldn't initialize registry path");
+		free_custom_extensions(drv_obj->drv_ext);
+		kfree(drv_obj->drv_ext);
+		TRACE1("drv_obj: %p", drv_obj);
+		ObDereferenceObject(drv_obj);
+		EXIT1(return -EINVAL);
+	}
+	strncpy(wrap_driver->name, load_driver->name, sizeof(wrap_driver->name));
+	wrap_driver->name[sizeof(wrap_driver->name)-1] = 0;
+	if (load_sys_files(wrap_driver, load_driver) ||
+	    load_bin_files_info(wrap_driver, load_driver) ||
+	    load_settings(wrap_driver, load_driver) ||
+	    start_wrap_driver(wrap_driver) ||
+	    add_wrap_driver(wrap_driver)) {
+		unload_wrap_driver(wrap_driver);
+		EXIT1(return -EINVAL);
+	} else {
+		printk(KERN_INFO "%s: driver %s (%s) loaded\n",
+		       DRIVER_NAME, wrap_driver->name, wrap_driver->version);
+		add_taint(TAINT_PROPRIETARY_MODULE);
+		EXIT1(return 0);
+	}
+}
+
+static struct pci_device_id wrap_pci_id_table[] = {
+	{PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID},
+};
+
+static struct pci_driver wrap_pci_driver = {
+	.name		= DRIVER_NAME,
+	.id_table	= wrap_pci_id_table,
+	.probe		= wrap_pnp_start_pci_device,
+	.remove		= __devexit_p(wrap_pnp_remove_pci_device),
+	.suspend	= wrap_pnp_suspend_pci_device,
+	.resume		= wrap_pnp_resume_pci_device,
+};
+
+#ifdef ENABLE_USB
+static struct usb_device_id wrap_usb_id_table[] = {
+	{
+		.driver_info = 1
+	},
+};
+
+static struct usb_driver wrap_usb_driver = {
+	.name = DRIVER_NAME,
+	.id_table = wrap_usb_id_table,
+	.probe = wrap_pnp_start_usb_device,
+	.disconnect = __devexit_p(wrap_pnp_remove_usb_device),
+	.suspend = wrap_pnp_suspend_usb_device,
+	.resume = wrap_pnp_resume_usb_device,
+};
+#endif
+
+/* register drivers for pci and usb */
+static void register_devices(void)
+{
+	int res;
+
+	res = pci_register_driver(&wrap_pci_driver);
+	if (res < 0) {
+		ERROR("couldn't register pci driver: %d", res);
+		wrap_pci_driver.name = NULL;
+	}
+
+#ifdef ENABLE_USB
+	res = usb_register(&wrap_usb_driver);
+	if (res < 0) {
+		ERROR("couldn't register usb driver: %d", res);
+		wrap_usb_driver.name = NULL;
+	}
+#endif
+	EXIT1(return);
+}
+
+static void unregister_devices(void)
+{
+	struct nt_list *cur, *next;
+
+	if (down_interruptible(&loader_mutex))
+		WARNING("couldn't obtain loader_mutex");
+	nt_list_for_each_safe(cur, next, &wrap_devices) {
+		struct wrap_device *wd;
+		wd = container_of(cur, struct wrap_device, list);
+		set_bit(HW_PRESENT, &wd->hw_status);
+	}
+	up(&loader_mutex);
+
+	if (wrap_pci_driver.name)
+		pci_unregister_driver(&wrap_pci_driver);
+#ifdef ENABLE_USB
+	if (wrap_usb_driver.name)
+		usb_deregister(&wrap_usb_driver);
+#endif
+}
+
+struct wrap_device *load_wrap_device(struct load_device *load_device)
+{
+	int ret;
+	struct nt_list *cur;
+	struct wrap_device *wd = NULL;
+	char vendor[5], device[5], subvendor[5], subdevice[5], bus[5];
+
+	ENTER1("%04x, %04x, %04x, %04x", load_device->vendor,
+	       load_device->device, load_device->subvendor,
+	       load_device->subdevice);
+	if (sprintf(vendor, "%04x", load_device->vendor) == 4 &&
+	    sprintf(device, "%04x", load_device->device) == 4 &&
+	    sprintf(subvendor, "%04x", load_device->subvendor) == 4 &&
+	    sprintf(subdevice, "%04x", load_device->subdevice) == 4 &&
+	    sprintf(bus, "%04x", load_device->bus) == 4) {
+		char *argv[] = {"loadndisdriver", WRAP_CMD_LOAD_DEVICE,
+#if defined(DEBUG) && DEBUG >= 1
+				"1",
+#else
+				"0",
+#endif
+				UTILS_VERSION, vendor, device,
+				subvendor, subdevice, bus, NULL};
+		char *env[] = {NULL};
+		TRACE2("%s, %s, %s, %s, %s", vendor, device,
+		       subvendor, subdevice, bus);
+		if (down_interruptible(&loader_mutex)) {
+			WARNING("couldn't obtain loader_mutex");
+			EXIT1(return NULL);
+		}
+		INIT_COMPLETION(loader_complete);
+		ret = call_usermodehelper("/sbin/loadndisdriver", argv, env, 1);
+		if (ret) {
+			up(&loader_mutex);
+			TRACE1("couldn't load device %04x:%04x; check system "
+			       "log for messages from 'loadndisdriver'",
+			       load_device->vendor, load_device->device);
+			EXIT1(return NULL);
+		}
+		wait_for_completion(&loader_complete);
+		wd = NULL;
+		nt_list_for_each(cur, &wrap_devices) {
+			wd = container_of(cur, struct wrap_device, list);
+			TRACE2("%p, %04x, %04x, %04x, %04x", wd, wd->vendor,
+			       wd->device, wd->subvendor, wd->subdevice);
+			if (wd->vendor == load_device->vendor &&
+			    wd->device == load_device->device)
+				break;
+			else
+				wd = NULL;
+		}
+		up(&loader_mutex);
+	} else
+		wd = NULL;
+	EXIT1(return wd);
+}
+
+struct wrap_device *get_wrap_device(void *dev, int bus)
+{
+	struct nt_list *cur;
+	struct wrap_device *wd;
+
+	if (down_interruptible(&loader_mutex)) {
+		WARNING("couldn't obtain loader_mutex");
+		return NULL;
+	}
+	wd = NULL;
+	nt_list_for_each(cur, &wrap_devices) {
+		wd = container_of(cur, struct wrap_device, list);
+		if (bus == WRAP_PCI_BUS &&
+		    wrap_is_pci_bus(wd->dev_bus) && wd->pci.pdev == dev)
+			break;
+		else if (bus == WRAP_USB_BUS &&
+			 wrap_is_usb_bus(wd->dev_bus) && wd->usb.udev == dev)
+			break;
+		else
+			wd = NULL;
+	}
+	up(&loader_mutex);
+	return wd;
+}
+
+/* called with loader_mutex is down */
+static int wrapper_ioctl(struct inode *inode, struct file *file,
+			 unsigned int cmd, unsigned long arg)
+{
+	struct load_driver *load_driver;
+	struct load_device load_device;
+	struct load_driver_file load_bin_file;
+	int ret;
+	void __user *addr = (void __user *)arg;
+
+	ENTER1("cmd: %u", cmd);
+
+	ret = 0;
+	switch (cmd) {
+	case WRAP_IOCTL_LOAD_DEVICE:
+		if (copy_from_user(&load_device, addr, sizeof(load_device))) {
+			ret = -EFAULT;
+			break;
+		}
+		TRACE2("%04x, %04x, %04x, %04x", load_device.vendor,
+		       load_device.device, load_device.subvendor,
+		       load_device.subdevice);
+		if (load_device.vendor) {
+			struct wrap_device *wd;
+			wd = kzalloc(sizeof(*wd), GFP_KERNEL);
+			if (!wd) {
+				ret = -ENOMEM;
+				break;
+			}
+			InitializeListHead(&wd->settings);
+			wd->dev_bus = WRAP_BUS(load_device.bus);
+			wd->vendor = load_device.vendor;
+			wd->device = load_device.device;
+			wd->subvendor = load_device.subvendor;
+			wd->subdevice = load_device.subdevice;
+			strncpy(wd->conf_file_name, load_device.conf_file_name,
+				sizeof(wd->conf_file_name));
+			wd->conf_file_name[sizeof(wd->conf_file_name)-1] = 0;
+			strncpy(wd->driver_name, load_device.driver_name,
+			       sizeof(wd->driver_name));
+			wd->driver_name[sizeof(wd->driver_name)-1] = 0;
+			InsertHeadList(&wrap_devices, &wd->list);
+			ret = 0;
+		} else
+			ret = -EINVAL;
+		break;
+	case WRAP_IOCTL_LOAD_DRIVER:
+		TRACE1("loading driver at %p", addr);
+		load_driver = vmalloc(sizeof(*load_driver));
+		if (!load_driver) {
+			ret = -ENOMEM;
+			break;
+		}
+		if (copy_from_user(load_driver, addr, sizeof(*load_driver)))
+			ret = -EFAULT;
+		else
+			ret = load_user_space_driver(load_driver);
+		vfree(load_driver);
+		break;
+	case WRAP_IOCTL_LOAD_BIN_FILE:
+		if (copy_from_user(&load_bin_file, addr, sizeof(load_bin_file)))
+			ret = -EFAULT;
+		else
+			ret = add_bin_file(&load_bin_file);
+		break;
+	default:
+		ERROR("unknown ioctl %u", cmd);
+		ret = -EINVAL;
+		break;
+	}
+	complete(&loader_complete);
+	EXIT1(return ret);
+}
+
+static int wrapper_ioctl_release(struct inode *inode, struct file *file)
+{
+	ENTER1("");
+	return 0;
+}
+
+static struct file_operations wrapper_fops = {
+	.owner          = THIS_MODULE,
+	.ioctl		= wrapper_ioctl,
+	.release	= wrapper_ioctl_release,
+};
+
+static struct miscdevice wrapper_misc = {
+	.name   = DRIVER_NAME,
+	.minor	= MISC_DYNAMIC_MINOR,
+	.fops   = &wrapper_fops
+};
+
+int loader_init(void)
+{
+	int err;
+
+	InitializeListHead(&wrap_drivers);
+	InitializeListHead(&wrap_devices);
+	init_MUTEX(&loader_mutex);
+	init_completion(&loader_complete);
+	if ((err = misc_register(&wrapper_misc)) < 0 ) {
+		ERROR("couldn't register module (%d)", err);
+		unregister_devices();
+		EXIT1(return err);
+	}
+	register_devices();
+	EXIT1(return 0);
+}
+
+void loader_exit(void)
+{
+	struct nt_list *cur, *next;
+
+	ENTER1("");
+	misc_deregister(&wrapper_misc);
+	unregister_devices();
+	if (down_interruptible(&loader_mutex))
+		WARNING("couldn't obtain loader_mutex");
+	nt_list_for_each_safe(cur, next, &wrap_drivers) {
+		struct wrap_driver *driver;
+		driver = container_of(cur, struct wrap_driver, list);
+		unload_wrap_driver(driver);
+	}
+	up(&loader_mutex);
+	EXIT1(return);
+}
--- linux-rt-2.6.31.orig/ubuntu/ndiswrapper/proc.c
+++ linux-rt-2.6.31/ubuntu/ndiswrapper/proc.c
@@ -0,0 +1,565 @@
+/*
+ *  Copyright (C) 2003-2005 Pontus Fuchs, Giridhar Pemmasani
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ *  GNU General Public License for more details.
+ *
+ */
+#include <linux/proc_fs.h>
+#include <linux/module.h>
+#include <asm/uaccess.h>
+
+#include "ndis.h"
+#include "iw_ndis.h"
+#include "wrapndis.h"
+#include "pnp.h"
+#include "wrapper.h"
+
+#define MAX_PROC_STR_LEN 32
+
+static struct proc_dir_entry *wrap_procfs_entry;
+
+static int procfs_read_ndis_stats(char *page, char **start, off_t off,
+				  int count, int *eof, void *data)
+{
+	char *p = page;
+	struct ndis_device *wnd = (struct ndis_device *)data;
+	struct ndis_wireless_stats stats;
+	NDIS_STATUS res;
+	ndis_rssi rssi;
+
+	if (off != 0) {
+		*eof = 1;
+		return 0;
+	}
+
+	res = mp_query(wnd, OID_802_11_RSSI, &rssi, sizeof(rssi));
+	if (!res)
+		p += sprintf(p, "signal_level=%d dBm\n", (s32)rssi);
+
+	res = mp_query(wnd, OID_802_11_STATISTICS, &stats, sizeof(stats));
+	if (!res) {
+
+		p += sprintf(p, "tx_frames=%Lu\n", stats.tx_frag);
+		p += sprintf(p, "tx_multicast_frames=%Lu\n",
+			     stats.tx_multi_frag);
+		p += sprintf(p, "tx_failed=%Lu\n", stats.failed);
+		p += sprintf(p, "tx_retry=%Lu\n", stats.retry);
+		p += sprintf(p, "tx_multi_rerty=%Lu\n", stats.multi_retry);
+		p += sprintf(p, "tx_rtss_success=%Lu\n", stats.rtss_succ);
+		p += sprintf(p, "tx_rtss_fail=%Lu\n", stats.rtss_fail);
+		p += sprintf(p, "ack_fail=%Lu\n", stats.ack_fail);
+		p += sprintf(p, "frame_duplicates=%Lu\n", stats.frame_dup);
+		p += sprintf(p, "rx_frames=%Lu\n", stats.rx_frag);
+		p += sprintf(p, "rx_multicast_frames=%Lu\n",
+			     stats.rx_multi_frag);
+		p += sprintf(p, "fcs_errors=%Lu\n", stats.fcs_err);
+	}
+
+	if (p - page > count) {
+		ERROR("wrote %lu bytes (limit is %u)\n",
+		      (unsigned long)(p - page), count);
+		*eof = 1;
+	}
+
+	return p - page;
+}
+
+static int procfs_read_ndis_encr(char *page, char **start, off_t off,
+				 int count, int *eof, void *data)
+{
+	char *p = page;
+	struct ndis_device *wnd = (struct ndis_device *)data;
+	int i, encr_status, auth_mode, infra_mode;
+	NDIS_STATUS res;
+	struct ndis_essid essid;
+	mac_address ap_address;
+
+	if (off != 0) {
+		*eof = 1;
+		return 0;
+	}
+
+	res = mp_query(wnd, OID_802_11_BSSID,
+		       &ap_address, sizeof(ap_address));
+	if (res)
+		memset(ap_address, 0, ETH_ALEN);
+	p += sprintf(p, "ap_address=%2.2X", ap_address[0]);
+	for (i = 1 ; i < ETH_ALEN ; i++)
+		p += sprintf(p, ":%2.2X", ap_address[i]);
+	p += sprintf(p, "\n");
+
+	res = mp_query(wnd, OID_802_11_SSID, &essid, sizeof(essid));
+	if (!res)
+		p += sprintf(p, "essid=%.*s\n", essid.length, essid.essid);
+
+	res = mp_query_int(wnd, OID_802_11_ENCRYPTION_STATUS, &encr_status);
+	if (!res) {
+		typeof(&wnd->encr_info.keys[0]) tx_key;
+		p += sprintf(p, "tx_key=%u\n", wnd->encr_info.tx_key_index);
+		p += sprintf(p, "key=");
+		tx_key = &wnd->encr_info.keys[wnd->encr_info.tx_key_index];
+		if (tx_key->length > 0)
+			for (i = 0; i < tx_key->length; i++)
+				p += sprintf(p, "%2.2X", tx_key->key[i]);
+		else
+			p += sprintf(p, "off");
+		p += sprintf(p, "\n");
+		p += sprintf(p, "encr_mode=%d\n", encr_status);
+	}
+	res = mp_query_int(wnd, OID_802_11_AUTHENTICATION_MODE, &auth_mode);
+	if (!res)
+		p += sprintf(p, "auth_mode=%d\n", auth_mode);
+	res = mp_query_int(wnd, OID_802_11_INFRASTRUCTURE_MODE, &infra_mode);
+	p += sprintf(p, "mode=%s\n", (infra_mode == Ndis802_11IBSS) ?
+		     "adhoc" : (infra_mode == Ndis802_11Infrastructure) ?
+		     "managed" : "auto");
+	if (p - page > count) {
+		WARNING("wrote %lu bytes (limit is %u)",
+			(unsigned long)(p - page), count);
+		*eof = 1;
+	}
+
+	return p - page;
+}
+
+static int procfs_read_ndis_hw(char *page, char **start, off_t off,
+			       int count, int *eof, void *data)
+{
+	char *p = page;
+	struct ndis_device *wnd = (struct ndis_device *)data;
+	struct ndis_configuration config;
+	unsigned int power_mode;
+	NDIS_STATUS res;
+	ndis_tx_power_level tx_power;
+	ULONG bit_rate;
+	ndis_rts_threshold rts_threshold;
+	ndis_fragmentation_threshold frag_threshold;
+	ndis_antenna antenna;
+	ULONG packet_filter;
+	int n;
+	mac_address mac;
+	char *hw_status[] = {"ready", "initializing", "resetting", "closing",
+			     "not ready"};
+
+	if (off != 0) {
+		*eof = 1;
+		return 0;
+	}
+
+	res = mp_query_int(wnd, OID_GEN_HARDWARE_STATUS, &n);
+	if (res == NDIS_STATUS_SUCCESS &&
+	    n >= 0 && n < sizeof(hw_status) / sizeof(hw_status[0]))
+		p += sprintf(p, "status=%s\n", hw_status[n]);
+
+	res = mp_query(wnd, OID_802_3_CURRENT_ADDRESS, mac, sizeof(mac));
+	if (!res)
+		p += sprintf(p, "mac: " MACSTRSEP "\n", MAC2STR(mac));
+	res = mp_query(wnd, OID_802_11_CONFIGURATION, &config, sizeof(config));
+	if (!res) {
+		p += sprintf(p, "beacon_period=%u msec\n",
+			     config.beacon_period);
+		p += sprintf(p, "atim_window=%u msec\n", config.atim_window);
+		p += sprintf(p, "frequency=%u kHZ\n", config.ds_config);
+		p += sprintf(p, "hop_pattern=%u\n",
+			     config.fh_config.hop_pattern);
+		p += sprintf(p, "hop_set=%u\n",
+			     config.fh_config.hop_set);
+		p += sprintf(p, "dwell_time=%u msec\n",
+			     config.fh_config.dwell_time);
+	}
+
+	res = mp_query(wnd, OID_802_11_TX_POWER_LEVEL,
+		       &tx_power, sizeof(tx_power));
+	if (!res)
+		p += sprintf(p, "tx_power=%u mW\n", tx_power);
+
+	res = mp_query(wnd, OID_GEN_LINK_SPEED, &bit_rate, sizeof(bit_rate));
+	if (!res)
+		p += sprintf(p, "bit_rate=%u kBps\n", (u32)bit_rate / 10);
+
+	res = mp_query(wnd, OID_802_11_RTS_THRESHOLD,
+		       &rts_threshold, sizeof(rts_threshold));
+	if (!res)
+		p += sprintf(p, "rts_threshold=%u bytes\n", rts_threshold);
+
+	res = mp_query(wnd, OID_802_11_FRAGMENTATION_THRESHOLD,
+		       &frag_threshold, sizeof(frag_threshold));
+	if (!res)
+		p += sprintf(p, "frag_threshold=%u bytes\n", frag_threshold);
+
+	res = mp_query_int(wnd, OID_802_11_POWER_MODE, &power_mode);
+	if (!res)
+		p += sprintf(p, "power_mode=%s\n",
+			     (power_mode == NDIS_POWER_OFF) ? "always_on" :
+			     (power_mode == NDIS_POWER_MAX) ?
+			     "max_savings" : "min_savings");
+
+	res = mp_query(wnd, OID_802_11_NUMBER_OF_ANTENNAS,
+		       &antenna, sizeof(antenna));
+	if (!res)
+		p += sprintf(p, "num_antennas=%u\n", antenna);
+
+	res = mp_query(wnd, OID_802_11_TX_ANTENNA_SELECTED,
+		       &antenna, sizeof(antenna));
+	if (!res)
+		p += sprintf(p, "tx_antenna=%u\n", antenna);
+
+	res = mp_query(wnd, OID_802_11_RX_ANTENNA_SELECTED,
+		       &antenna, sizeof(antenna));
+	if (!res)
+		p += sprintf(p, "rx_antenna=%u\n", antenna);
+
+	p += sprintf(p, "encryption_modes=%s%s%s%s%s%s%s\n",
+		     test_bit(Ndis802_11Encryption1Enabled, &wnd->capa.encr) ?
+		     "WEP" : "none",
+
+		     test_bit(Ndis802_11Encryption2Enabled, &wnd->capa.encr) ?
+		     "; TKIP with WPA" : "",
+		     test_bit(Ndis802_11AuthModeWPA2, &wnd->capa.auth) ?
+		     ", WPA2" : "",
+		     test_bit(Ndis802_11AuthModeWPA2PSK, &wnd->capa.auth) ?
+		     ", WPA2PSK" : "",
+
+		     test_bit(Ndis802_11Encryption3Enabled, &wnd->capa.encr) ?
+		     "; AES/CCMP with WPA" : "",
+		     test_bit(Ndis802_11AuthModeWPA2, &wnd->capa.auth) ?
+		     ", WPA2" : "",
+		     test_bit(Ndis802_11AuthModeWPA2PSK, &wnd->capa.auth) ?
+		     ", WPA2PSK" : "");
+
+	res = mp_query_int(wnd, OID_GEN_CURRENT_PACKET_FILTER, &packet_filter);
+	if (!res) {
+		if (packet_filter != wnd->packet_filter)
+			WARNING("wrong packet_filter? 0x%08x, 0x%08x\n",
+				packet_filter, wnd->packet_filter);
+		p += sprintf(p, "packet_filter: 0x%08x\n", packet_filter);
+	}
+	if (p - page > count) {
+		WARNING("wrote %lu bytes (limit is %u)",
+			(unsigned long)(p - page), count);
+		*eof = 1;
+	}
+
+	return p - page;
+}
+
+static int procfs_read_ndis_settings(char *page, char **start, off_t off,
+				     int count, int *eof, void *data)
+{
+	char *p = page;
+	struct ndis_device *wnd = (struct ndis_device *)data;
+	struct wrap_device_setting *setting;
+
+	if (off != 0) {
+		*eof = 1;
+		return 0;
+	}
+
+	p += sprintf(p, "hangcheck_interval=%d\n",
+		     hangcheck_interval == 0 ?
+		     (int)(wnd->hangcheck_interval / HZ) : -1);
+
+	list_for_each_entry(setting, &wnd->wd->settings, list) {
+		p += sprintf(p, "%s=%s\n", setting->name, setting->value);
+	}
+
+	list_for_each_entry(setting, &wnd->wd->driver->settings, list) {
+		p += sprintf(p, "%s=%s\n", setting->name, setting->value);
+	}
+
+	return p - page;
+}
+
+static int procfs_write_ndis_settings(struct file *file, const char __user *buf,
+				      unsigned long count, void *data)
+{
+	struct ndis_device *wnd = (struct ndis_device *)data;
+	char setting[MAX_PROC_STR_LEN], *p;
+	unsigned int i;
+	NDIS_STATUS res;
+
+	if (count > MAX_PROC_STR_LEN)
+		return -EINVAL;
+
+	memset(setting, 0, sizeof(setting));
+	if (copy_from_user(setting, buf, count))
+		return -EFAULT;
+
+	if ((p = strchr(setting, '\n')))
+		*p = 0;
+
+	if ((p = strchr(setting, '=')))
+		*p = 0;
+
+	if (!strcmp(setting, "hangcheck_interval")) {
+		if (!p)
+			return -EINVAL;
+		p++;
+		i = simple_strtol(p, NULL, 10);
+		hangcheck_del(wnd);
+		if (i > 0) {
+			wnd->hangcheck_interval = i * HZ;
+			hangcheck_add(wnd);
+		}
+	} else if (!strcmp(setting, "suspend")) {
+		if (!p)
+			return -EINVAL;
+		p++;
+		i = simple_strtol(p, NULL, 10);
+		if (i <= 0 || i > 3)
+			return -EINVAL;
+		if (wrap_is_pci_bus(wnd->wd->dev_bus))
+			i = wrap_pnp_suspend_pci_device(wnd->wd->pci.pdev,
+							PMSG_SUSPEND);
+		else
+#ifdef ENABLE_USB
+			i = wrap_pnp_suspend_usb_device(wnd->wd->usb.intf,
+							PMSG_SUSPEND);
+#else
+		i = -1;
+#endif
+		if (i)
+			return -EINVAL;
+	} else if (!strcmp(setting, "resume")) {
+		if (wrap_is_pci_bus(wnd->wd->dev_bus))
+			i = wrap_pnp_resume_pci_device(wnd->wd->pci.pdev);
+		else
+#ifdef ENABLE_USB
+			i = wrap_pnp_resume_usb_device(wnd->wd->usb.intf);
+#else
+		i = -1;
+#endif
+		if (i)
+			return -EINVAL;
+	} else if (!strcmp(setting, "stats_enabled")) {
+		if (!p)
+			return -EINVAL;
+		p++;
+		i = simple_strtol(p, NULL, 10);
+		if (i > 0)
+			wnd->iw_stats_enabled = TRUE;
+		else
+			wnd->iw_stats_enabled = FALSE;
+	} else if (!strcmp(setting, "packet_filter")) {
+		if (!p)
+			return -EINVAL;
+		p++;
+		i = simple_strtol(p, NULL, 10);
+		res = mp_set_int(wnd, OID_GEN_CURRENT_PACKET_FILTER, i);
+		if (res)
+			WARNING("setting packet_filter failed: %08X", res);
+	} else if (!strcmp(setting, "reinit")) {
+		if (ndis_reinit(wnd) != NDIS_STATUS_SUCCESS)
+			return -EFAULT;
+	} else {
+		struct ndis_configuration_parameter param;
+		struct unicode_string key;
+		struct ansi_string ansi;
+
+		if (!p)
+			return -EINVAL;
+		p++;
+		RtlInitAnsiString(&ansi, p);
+		if (RtlAnsiStringToUnicodeString(&param.data.string, &ansi,
+						 TRUE) != STATUS_SUCCESS)
+			EXIT1(return -EFAULT);
+		param.type = NdisParameterString;
+		RtlInitAnsiString(&ansi, setting);
+		if (RtlAnsiStringToUnicodeString(&key, &ansi,
+						 TRUE) != STATUS_SUCCESS) {
+			RtlFreeUnicodeString(&param.data.string);
+			EXIT1(return -EINVAL);
+		}
+		NdisWriteConfiguration(&res, wnd->nmb, &key, &param);
+		RtlFreeUnicodeString(&key);
+		RtlFreeUnicodeString(&param.data.string);
+		if (res != NDIS_STATUS_SUCCESS)
+			return -EFAULT;
+	}
+	return count;
+}
+
+int wrap_procfs_add_ndis_device(struct ndis_device *wnd)
+{
+	struct proc_dir_entry *procfs_entry;
+
+	if (wrap_procfs_entry == NULL)
+		return -ENOMEM;
+
+	if (wnd->procfs_iface) {
+		ERROR("%s already registered?", wnd->netdev_name);
+		return -EINVAL;
+	}
+	wnd->procfs_iface = proc_mkdir(wnd->netdev_name, wrap_procfs_entry);
+	if (wnd->procfs_iface == NULL) {
+		ERROR("couldn't create proc directory");
+		return -ENOMEM;
+	}
+	wnd->procfs_iface->uid = proc_uid;
+	wnd->procfs_iface->gid = proc_gid;
+
+	procfs_entry = create_proc_entry("hw", S_IFREG | S_IRUSR | S_IRGRP,
+					 wnd->procfs_iface);
+	if (procfs_entry == NULL) {
+		ERROR("couldn't create proc entry for 'hw'");
+		goto err_hw;
+	} else {
+		procfs_entry->uid = proc_uid;
+		procfs_entry->gid = proc_gid;
+		procfs_entry->data = wnd;
+		procfs_entry->read_proc = procfs_read_ndis_hw;
+	}
+
+	procfs_entry = create_proc_entry("stats", S_IFREG | S_IRUSR | S_IRGRP,
+					 wnd->procfs_iface);
+	if (procfs_entry == NULL) {
+		ERROR("couldn't create proc entry for 'stats'");
+		goto err_stats;
+	} else {
+		procfs_entry->uid = proc_uid;
+		procfs_entry->gid = proc_gid;
+		procfs_entry->data = wnd;
+		procfs_entry->read_proc = procfs_read_ndis_stats;
+	}
+
+	procfs_entry = create_proc_entry("encr", S_IFREG | S_IRUSR | S_IRGRP,
+					 wnd->procfs_iface);
+	if (procfs_entry == NULL) {
+		ERROR("couldn't create proc entry for 'encr'");
+		goto err_encr;
+	} else {
+		procfs_entry->uid = proc_uid;
+		procfs_entry->gid = proc_gid;
+		procfs_entry->data = wnd;
+		procfs_entry->read_proc = procfs_read_ndis_encr;
+	}
+
+	procfs_entry = create_proc_entry("settings", S_IFREG |
+					 S_IRUSR | S_IRGRP |
+					 S_IWUSR | S_IWGRP, wnd->procfs_iface);
+	if (procfs_entry == NULL) {
+		ERROR("couldn't create proc entry for 'settings'");
+		goto err_settings;
+	} else {
+		procfs_entry->uid = proc_uid;
+		procfs_entry->gid = proc_gid;
+		procfs_entry->data = wnd;
+		procfs_entry->read_proc = procfs_read_ndis_settings;
+		procfs_entry->write_proc = procfs_write_ndis_settings;
+	}
+	return 0;
+
+err_settings:
+	remove_proc_entry("encr", wnd->procfs_iface);
+err_encr:
+	remove_proc_entry("stats", wnd->procfs_iface);
+err_stats:
+	remove_proc_entry("hw", wnd->procfs_iface);
+err_hw:
+	remove_proc_entry(wnd->netdev_name, wrap_procfs_entry);
+	wnd->procfs_iface = NULL;
+	return -ENOMEM;
+}
+
+void wrap_procfs_remove_ndis_device(struct ndis_device *wnd)
+{
+	struct proc_dir_entry *procfs_iface = xchg(&wnd->procfs_iface, NULL);
+
+	if (procfs_iface == NULL)
+		return;
+	remove_proc_entry("hw", procfs_iface);
+	remove_proc_entry("stats", procfs_iface);
+	remove_proc_entry("encr", procfs_iface);
+	remove_proc_entry("settings", procfs_iface);
+	if (wrap_procfs_entry)
+		remove_proc_entry(wnd->netdev_name, wrap_procfs_entry);
+}
+
+static int procfs_read_debug(char *page, char **start, off_t off,
+			     int count, int *eof, void *data)
+{
+	char *p = page;
+	enum alloc_type type;
+
+	if (off != 0) {
+		*eof = 1;
+		return 0;
+	}
+	p += sprintf(p, "%d\n", debug);
+	type = 0;
+#ifdef ALLOC_DEBUG
+	for (type = 0; type < ALLOC_TYPE_MAX; type++)
+		p += sprintf(p, "total size of allocations in %d: %d\n",
+			     type, alloc_size(type));
+#endif
+	return p - page;
+}
+
+static int procfs_write_debug(struct file *file, const char __user *buf,
+			      unsigned long count, void *data)
+{
+	int i;
+	char setting[MAX_PROC_STR_LEN], *p;
+
+	if (count > MAX_PROC_STR_LEN)
+		return -EINVAL;
+
+	memset(setting, 0, sizeof(setting));
+	if (copy_from_user(setting, buf, count))
+		return -EFAULT;
+
+	if ((p = strchr(setting, '\n')))
+		*p = 0;
+
+	if ((p = strchr(setting, '=')))
+		*p = 0;
+
+	i = simple_strtol(setting, NULL, 10);
+	if (i >= 0 && i < 10)
+		debug = i;
+	else
+		return -EINVAL;
+	return count;
+}
+
+int wrap_procfs_init(void)
+{
+	struct proc_dir_entry *procfs_entry;
+
+	wrap_procfs_entry = proc_mkdir(DRIVER_NAME, proc_net_root);
+	if (wrap_procfs_entry == NULL) {
+		ERROR("couldn't create procfs directory");
+		return -ENOMEM;
+	}
+	wrap_procfs_entry->uid = proc_uid;
+	wrap_procfs_entry->gid = proc_gid;
+
+	procfs_entry = create_proc_entry("debug", S_IFREG | S_IRUSR | S_IRGRP,
+					 wrap_procfs_entry);
+	if (procfs_entry == NULL) {
+		ERROR("couldn't create proc entry for 'debug'");
+		return -ENOMEM;
+	} else {
+		procfs_entry->uid = proc_uid;
+		procfs_entry->gid = proc_gid;
+		procfs_entry->read_proc  = procfs_read_debug;
+		procfs_entry->write_proc = procfs_write_debug;
+	}
+	return 0;
+}
+
+void wrap_procfs_remove(void)
+{
+	if (wrap_procfs_entry == NULL)
+		return;
+	remove_proc_entry("debug", wrap_procfs_entry);
+	remove_proc_entry(DRIVER_NAME, proc_net_root);
+}
--- linux-rt-2.6.31.orig/ubuntu/ndiswrapper/wrapper.c
+++ linux-rt-2.6.31/ubuntu/ndiswrapper/wrapper.c
@@ -0,0 +1,121 @@
+/*
+ *  Copyright (C) 2003-2005 Pontus Fuchs, Giridhar Pemmasani
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ *  GNU General Public License for more details.
+ *
+ */
+
+#include "ndis.h"
+#include "iw_ndis.h"
+#include "loader.h"
+#include "pnp.h"
+#include "wrapper.h"
+
+char *if_name = "wlan%d";
+int proc_uid, proc_gid;
+int hangcheck_interval;
+static char *utils_version = UTILS_VERSION;
+
+#if defined(DEBUG) && (DEBUG > 0)
+int debug = DEBUG;
+#else
+int debug = 0;
+#endif
+
+WRAP_MODULE_PARM_STRING(if_name, 0400);
+MODULE_PARM_DESC(if_name, "Network interface name or template "
+		 "(default: wlan%d)");
+WRAP_MODULE_PARM_INT(proc_uid, 0600);
+MODULE_PARM_DESC(proc_uid, "The uid of the files created in /proc "
+		 "(default: 0).");
+WRAP_MODULE_PARM_INT(proc_gid, 0600);
+MODULE_PARM_DESC(proc_gid, "The gid of the files created in /proc "
+		 "(default: 0).");
+WRAP_MODULE_PARM_INT(debug, 0600);
+MODULE_PARM_DESC(debug, "debug level");
+
+/* 0 - default value provided by NDIS driver,
+ * positive value - force hangcheck interval to that many seconds
+ * negative value - disable hangcheck
+ */
+WRAP_MODULE_PARM_INT(hangcheck_interval, 0600);
+MODULE_PARM_DESC(hangcheck_interval, "The interval, in seconds, for checking"
+		 " if driver is hung. (default: 0)");
+
+WRAP_MODULE_PARM_STRING(utils_version, 0400);
+MODULE_PARM_DESC(utils_version, "Compatible version of utils "
+		 "(read only: " UTILS_VERSION ")");
+
+MODULE_AUTHOR("ndiswrapper team <ndiswrapper-general@lists.sourceforge.net>");
+#ifdef MODULE_DESCRIPTION
+MODULE_DESCRIPTION("NDIS wrapper driver");
+#endif
+#ifdef MODULE_VERSION
+MODULE_VERSION(DRIVER_VERSION);
+#endif
+MODULE_LICENSE("GPL");
+
+static void module_cleanup(void)
+{
+	loader_exit();
+#ifdef ENABLE_USB
+	usb_exit();
+#endif
+
+	wrap_procfs_remove();
+	wrapndis_exit();
+	ndis_exit();
+	rtl_exit();
+	crt_exit();
+	ntoskernel_exit();
+	wrapmem_exit();
+}
+
+static int __init wrapper_init(void)
+{
+	printk(KERN_INFO "%s version %s loaded (smp=%s, preempt=%s)\n",
+	       DRIVER_NAME, DRIVER_VERSION,
+#ifdef CONFIG_SMP
+	       "yes"
+#else
+	       "no"
+#endif
+		,
+#ifdef CONFIG_PREEMPT_RT
+		"rt"
+#elif defined(CONFIG_PREEMPT)
+		"yes"
+#else
+		"no"
+#endif
+		);
+
+	if (wrapmem_init() || ntoskernel_init() || crt_init() ||
+	    rtl_init() || ndis_init() || wrapndis_init() ||
+#ifdef ENABLE_USB
+	    usb_init() ||
+#endif
+	    wrap_procfs_init() || loader_init()) {
+		module_cleanup();
+		ERROR("%s: initialization failed", DRIVER_NAME);
+		return -EINVAL;
+	}
+	EXIT1(return 0);
+}
+
+static void __exit wrapper_exit(void)
+{
+	ENTER1("");
+	module_cleanup();
+}
+
+module_init(wrapper_init);
+module_exit(wrapper_exit);
--- linux-rt-2.6.31.orig/ubuntu/ndiswrapper/ntoskernel.c
+++ linux-rt-2.6.31/ubuntu/ndiswrapper/ntoskernel.c
@@ -0,0 +1,2683 @@
+/*
+ *  Copyright (C) 2003-2005 Pontus Fuchs, Giridhar Pemmasani
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ *  GNU General Public License for more details.
+ *
+ */
+
+#include "ntoskernel.h"
+#include "ndis.h"
+#include "usb.h"
+#include "pnp.h"
+#include "loader.h"
+#include "ntoskernel_exports.h"
+
+/* MDLs describe a range of virtual address with an array of physical
+ * pages right after the header. For different ranges of virtual
+ * addresses, the number of entries of physical pages may be different
+ * (depending on number of entries required). If we want to allocate
+ * MDLs from a pool, the size has to be constant. So we assume that
+ * maximum range used by a driver is MDL_CACHE_PAGES; if a driver
+ * requests an MDL for a bigger region, we allocate it with kmalloc;
+ * otherwise, we allocate from the pool */
+
+#define MDL_CACHE_PAGES 3
+#define MDL_CACHE_SIZE (sizeof(struct mdl) + \
+			(sizeof(PFN_NUMBER) * MDL_CACHE_PAGES))
+struct wrap_mdl {
+	struct nt_list list;
+	struct mdl mdl[0];
+};
+
+/* everything here is for all drivers/devices - not per driver/device */
+static spinlock_t dispatcher_lock;
+spinlock_t ntoskernel_lock;
+static void *mdl_cache;
+static struct nt_list wrap_mdl_list;
+
+static work_struct_t kdpc_work;
+static void kdpc_worker(worker_param_t dummy);
+
+static struct nt_list kdpc_list;
+static spinlock_t kdpc_list_lock;
+
+static struct nt_list callback_objects;
+
+struct nt_list object_list;
+
+struct bus_driver {
+	struct nt_list list;
+	char name[MAX_DRIVER_NAME_LEN];
+	struct driver_object drv_obj;
+};
+
+static struct nt_list bus_driver_list;
+
+static work_struct_t ntos_work;
+static struct nt_list ntos_work_list;
+static spinlock_t ntos_work_lock;
+static void ntos_work_worker(worker_param_t dummy);
+static struct nt_thread *ntos_worker_thread;
+spinlock_t irp_cancel_lock;
+static NT_SPIN_LOCK nt_list_lock;
+static struct nt_slist wrap_timer_slist;
+
+/* compute ticks (100ns) since 1601 until when system booted into
+ * wrap_ticks_to_boot */
+u64 wrap_ticks_to_boot;
+
+#if defined(CONFIG_X86_64)
+static struct timer_list shared_data_timer;
+struct kuser_shared_data kuser_shared_data;
+static void update_user_shared_data_proc(unsigned long data);
+#endif
+
+WIN_SYMBOL_MAP("KeTickCount", &jiffies)
+
+WIN_SYMBOL_MAP("NlsMbCodePageTag", FALSE)
+
+workqueue_struct_t *ntos_wq;
+
+#ifdef WRAP_PREEMPT
+DEFINE_PER_CPU(irql_info_t, irql_info);
+#endif
+
+#if defined(CONFIG_X86_64)
+static void update_user_shared_data_proc(unsigned long data)
+{
+	/* timer is supposed to be scheduled every 10ms, but bigger
+	 * intervals seem to work (tried upto 50ms) */
+	*((ULONG64 *)&kuser_shared_data.system_time) = ticks_1601();
+	*((ULONG64 *)&kuser_shared_data.interrupt_time) =
+		jiffies * TICKSPERSEC / HZ;
+	*((ULONG64 *)&kuser_shared_data.tick) = jiffies;
+
+	mod_timer(&shared_data_timer, jiffies + MSEC_TO_HZ(30));
+}
+#endif
+
+void *allocate_object(ULONG size, enum common_object_type type,
+		      struct unicode_string *name)
+{
+	struct common_object_header *hdr;
+	void *body;
+
+	/* we pad header as prefix to body */
+	hdr = ExAllocatePoolWithTag(NonPagedPool, OBJECT_SIZE(size), 0);
+	if (!hdr) {
+		WARNING("couldn't allocate memory");
+		return NULL;
+	}
+	memset(hdr, 0, OBJECT_SIZE(size));
+	if (name) {
+		hdr->name.buf = ExAllocatePoolWithTag(NonPagedPool,
+						      name->max_length, 0);
+		if (!hdr->name.buf) {
+			ExFreePool(hdr);
+			return NULL;
+		}
+		memcpy(hdr->name.buf, name->buf, name->max_length);
+		hdr->name.length = name->length;
+		hdr->name.max_length = name->max_length;
+	}
+	hdr->type = type;
+	hdr->ref_count = 1;
+	spin_lock_bh(&ntoskernel_lock);
+	/* threads are looked up often (in KeWaitForXXX), so optimize
+	 * for fast lookups of threads */
+	if (type == OBJECT_TYPE_NT_THREAD)
+		InsertHeadList(&object_list, &hdr->list);
+	else
+		InsertTailList(&object_list, &hdr->list);
+	spin_unlock_bh(&ntoskernel_lock);
+	body = HEADER_TO_OBJECT(hdr);
+	TRACE3("allocated hdr: %p, body: %p", hdr, body);
+	return body;
+}
+
+void free_object(void *object)
+{
+	struct common_object_header *hdr;
+
+	hdr = OBJECT_TO_HEADER(object);
+	spin_lock_bh(&ntoskernel_lock);
+	RemoveEntryList(&hdr->list);
+	spin_unlock_bh(&ntoskernel_lock);
+	TRACE3("freed hdr: %p, body: %p", hdr, object);
+	if (hdr->name.buf)
+		ExFreePool(hdr->name.buf);
+	ExFreePool(hdr);
+}
+
+static int add_bus_driver(const char *name)
+{
+	struct bus_driver *bus_driver;
+
+	bus_driver = kzalloc(sizeof(*bus_driver), GFP_KERNEL);
+	if (!bus_driver) {
+		ERROR("couldn't allocate memory");
+		return -ENOMEM;
+	}
+	strncpy(bus_driver->name, name, sizeof(bus_driver->name));
+	bus_driver->name[sizeof(bus_driver->name)-1] = 0;
+	spin_lock_bh(&ntoskernel_lock);
+	InsertTailList(&bus_driver_list, &bus_driver->list);
+	spin_unlock_bh(&ntoskernel_lock);
+	TRACE1("bus driver %s is at %p", name, &bus_driver->drv_obj);
+	return STATUS_SUCCESS;
+}
+
+struct driver_object *find_bus_driver(const char *name)
+{
+	struct bus_driver *bus_driver;
+	struct driver_object *drv_obj;
+
+	spin_lock_bh(&ntoskernel_lock);
+	drv_obj = NULL;
+	nt_list_for_each_entry(bus_driver, &bus_driver_list, list) {
+		if (strcmp(bus_driver->name, name) == 0) {
+			drv_obj = &bus_driver->drv_obj;
+			break;
+		}
+	}
+	spin_unlock_bh(&ntoskernel_lock);
+	return drv_obj;
+}
+
+wfastcall struct nt_list *WIN_FUNC(ExfInterlockedInsertHeadList,3)
+	(struct nt_list *head, struct nt_list *entry, NT_SPIN_LOCK *lock)
+{
+	struct nt_list *first;
+	unsigned long flags;
+
+	ENTER5("head = %p, entry = %p", head, entry);
+	nt_spin_lock_irqsave(lock, flags);
+	first = InsertHeadList(head, entry);
+	nt_spin_unlock_irqrestore(lock, flags);
+	TRACE5("head = %p, old = %p", head, first);
+	return first;
+}
+
+wfastcall struct nt_list *WIN_FUNC(ExInterlockedInsertHeadList,3)
+	(struct nt_list *head, struct nt_list *entry, NT_SPIN_LOCK *lock)
+{
+	ENTER5("%p", head);
+	return ExfInterlockedInsertHeadList(head, entry, lock);
+}
+
+wfastcall struct nt_list *WIN_FUNC(ExfInterlockedInsertTailList,3)
+	(struct nt_list *head, struct nt_list *entry, NT_SPIN_LOCK *lock)
+{
+	struct nt_list *last;
+	unsigned long flags;
+
+	ENTER5("head = %p, entry = %p", head, entry);
+	nt_spin_lock_irqsave(lock, flags);
+	last = InsertTailList(head, entry);
+	nt_spin_unlock_irqrestore(lock, flags);
+	TRACE5("head = %p, old = %p", head, last);
+	return last;
+}
+
+wfastcall struct nt_list *WIN_FUNC(ExInterlockedInsertTailList,3)
+	(struct nt_list *head, struct nt_list *entry, NT_SPIN_LOCK *lock)
+{
+	ENTER5("%p", head);
+	return ExfInterlockedInsertTailList(head, entry, lock);
+}
+
+wfastcall struct nt_list *WIN_FUNC(ExfInterlockedRemoveHeadList,2)
+	(struct nt_list *head, NT_SPIN_LOCK *lock)
+{
+	struct nt_list *ret;
+	unsigned long flags;
+
+	ENTER5("head = %p", head);
+	nt_spin_lock_irqsave(lock, flags);
+	ret = RemoveHeadList(head);
+	nt_spin_unlock_irqrestore(lock, flags);
+	TRACE5("head = %p, ret = %p", head, ret);
+	return ret;
+}
+
+wfastcall struct nt_list *WIN_FUNC(ExInterlockedRemoveHeadList,2)
+	(struct nt_list *head, NT_SPIN_LOCK *lock)
+{
+	ENTER5("%p", head);
+	return ExfInterlockedRemoveHeadList(head, lock);
+}
+
+wfastcall struct nt_list *WIN_FUNC(ExfInterlockedRemoveTailList,2)
+	(struct nt_list *head, NT_SPIN_LOCK *lock)
+{
+	struct nt_list *ret;
+	unsigned long flags;
+
+	ENTER5("head = %p", head);
+	nt_spin_lock_irqsave(lock, flags);
+	ret = RemoveTailList(head);
+	nt_spin_unlock_irqrestore(lock, flags);
+	TRACE5("head = %p, ret = %p", head, ret);
+	return ret;
+}
+
+wfastcall struct nt_list *WIN_FUNC(ExInterlockedRemoveTailList,2)
+	(struct nt_list *head, NT_SPIN_LOCK *lock)
+{
+	ENTER5("%p", head);
+	return ExfInterlockedRemoveTailList(head, lock);
+}
+
+wfastcall void WIN_FUNC(InitializeSListHead,1)
+	(nt_slist_header *head)
+{
+	memset(head, 0, sizeof(*head));
+}
+
+wfastcall struct nt_slist *WIN_FUNC(ExInterlockedPushEntrySList,3)
+	(nt_slist_header *head, struct nt_slist *entry, NT_SPIN_LOCK *lock)
+{
+	struct nt_slist *ret;
+
+	ret = PushEntrySList(head, entry, lock);
+	return ret;
+}
+
+wstdcall struct nt_slist *WIN_FUNC(ExpInterlockedPushEntrySList,2)
+	(nt_slist_header *head, struct nt_slist *entry)
+{
+	struct nt_slist *ret;
+
+	ret = PushEntrySList(head, entry, &nt_list_lock);
+	return ret;
+}
+
+wfastcall struct nt_slist *WIN_FUNC(InterlockedPushEntrySList,2)
+	(nt_slist_header *head, struct nt_slist *entry)
+{
+	struct nt_slist *ret;
+
+	ret = PushEntrySList(head, entry, &nt_list_lock);
+	return ret;
+}
+
+wfastcall struct nt_slist *WIN_FUNC(ExInterlockedPopEntrySList,2)
+	(nt_slist_header *head, NT_SPIN_LOCK *lock)
+{
+	struct nt_slist *ret;
+
+	ret = PopEntrySList(head, lock);
+	return ret;
+}
+
+wstdcall struct nt_slist *WIN_FUNC(ExpInterlockedPopEntrySList,1)
+	(nt_slist_header *head)
+{
+	struct nt_slist *ret;
+
+	ret = PopEntrySList(head, &nt_list_lock);
+	return ret;
+}
+
+wfastcall struct nt_slist *WIN_FUNC(InterlockedPopEntrySList,1)
+	(nt_slist_header *head)
+{
+	struct nt_slist *ret;
+
+	ret = PopEntrySList(head, &nt_list_lock);
+	return ret;
+}
+
+wstdcall USHORT WIN_FUNC(ExQueryDepthSList,1)
+	(nt_slist_header *head)
+{
+	USHORT depth;
+	ENTER5("%p", head);
+	depth = head->depth;
+	TRACE5("%d, %p", depth, head->next);
+	return depth;
+}
+
+wfastcall LONG WIN_FUNC(InterlockedIncrement,1)
+	(LONG volatile *val)
+{
+	return post_atomic_add(*val, 1);
+}
+
+wfastcall LONG WIN_FUNC(InterlockedDecrement,1)
+	(LONG volatile *val)
+{
+	return post_atomic_add(*val, -1);
+}
+
+wfastcall LONG WIN_FUNC(InterlockedExchange,2)
+	(LONG volatile *target, LONG val)
+{
+	return xchg(target, val);
+}
+
+wfastcall LONG WIN_FUNC(InterlockedCompareExchange,3)
+	(LONG volatile *dest, LONG new, LONG old)
+{
+	return cmpxchg(dest, old, new);
+}
+
+wfastcall void WIN_FUNC(ExInterlockedAddLargeStatistic,2)
+	(LARGE_INTEGER volatile *plint, ULONG n)
+{
+	unsigned long flags;
+
+	local_irq_save(flags);
+#ifdef CONFIG_X86_64
+	__asm__ __volatile__(
+		"\n"
+		LOCK_PREFIX "add %1, %0\n\t"
+		: "+m" (*plint)
+		: "r" (n));
+#else
+	__asm__ __volatile__(
+		"1:\t"
+		"   movl %1, %%ebx\n\t"
+		"   movl %%edx, %%ecx\n\t"
+		"   addl %%eax, %%ebx\n\t"
+		"   adcl $0, %%ecx\n\t"
+		    LOCK_PREFIX "cmpxchg8b %0\n\t"
+		"   jnz 1b\n\t"
+		: "+m" (*plint)
+		: "m" (n), "A" (*plint)
+		: "ebx", "ecx");
+#endif
+	local_irq_restore(flags);
+}
+
+static void initialize_object(struct dispatcher_header *dh, enum dh_type type,
+			      int state)
+{
+	memset(dh, 0, sizeof(*dh));
+	set_object_type(dh, type);
+	dh->signal_state = state;
+	InitializeListHead(&dh->wait_blocks);
+}
+
+static void timer_proc(unsigned long data)
+{
+	struct wrap_timer *wrap_timer = (struct wrap_timer *)data;
+	struct nt_timer *nt_timer;
+	struct kdpc *kdpc;
+
+	nt_timer = wrap_timer->nt_timer;
+	TIMERENTER("%p(%p), %lu", wrap_timer, nt_timer, jiffies);
+#ifdef TIMER_DEBUG
+	BUG_ON(wrap_timer->wrap_timer_magic != WRAP_TIMER_MAGIC);
+	BUG_ON(nt_timer->wrap_timer_magic != WRAP_TIMER_MAGIC);
+#endif
+	KeSetEvent((struct nt_event *)nt_timer, 0, FALSE);
+	if (wrap_timer->repeat)
+		mod_timer(&wrap_timer->timer, jiffies + wrap_timer->repeat);
+	kdpc = nt_timer->kdpc;
+	if (kdpc)
+		queue_kdpc(kdpc);
+	TIMEREXIT(return);
+}
+
+void wrap_init_timer(struct nt_timer *nt_timer, enum timer_type type,
+		     struct ndis_mp_block *nmb)
+{
+	struct wrap_timer *wrap_timer;
+
+	/* TODO: if a timer is initialized more than once, we allocate
+	 * memory for wrap_timer more than once for the same nt_timer,
+	 * wasting memory. We can check if nt_timer->wrap_timer_magic is
+	 * set and not allocate, but it is not guaranteed always to be
+	 * safe */
+	TIMERENTER("%p", nt_timer);
+	/* we allocate memory for wrap_timer behind driver's back and
+	 * there is no NDIS/DDK function where this memory can be
+	 * freed, so we use slack_kmalloc so it gets freed when driver
+	 * is unloaded */
+	if (nmb)
+		wrap_timer = kmalloc(sizeof(*wrap_timer), irql_gfp());
+	else
+		wrap_timer = slack_kmalloc(sizeof(*wrap_timer));
+	if (!wrap_timer) {
+		ERROR("couldn't allocate memory for timer");
+		return;
+	}
+
+	memset(wrap_timer, 0, sizeof(*wrap_timer));
+	init_timer(&wrap_timer->timer);
+	wrap_timer->timer.data = (unsigned long)wrap_timer;
+	wrap_timer->timer.function = timer_proc;
+	wrap_timer->nt_timer = nt_timer;
+#ifdef TIMER_DEBUG
+	wrap_timer->wrap_timer_magic = WRAP_TIMER_MAGIC;
+#endif
+	nt_timer->wrap_timer = wrap_timer;
+	nt_timer->kdpc = NULL;
+	initialize_object(&nt_timer->dh, type, 0);
+	nt_timer->wrap_timer_magic = WRAP_TIMER_MAGIC;
+	TIMERTRACE("timer %p (%p)", wrap_timer, nt_timer);
+	spin_lock_bh(&ntoskernel_lock);
+	if (nmb) {
+		wrap_timer->slist.next = nmb->wnd->wrap_timer_slist.next;
+		nmb->wnd->wrap_timer_slist.next = &wrap_timer->slist;
+	} else {
+		wrap_timer->slist.next = wrap_timer_slist.next;
+		wrap_timer_slist.next = &wrap_timer->slist;
+	}
+	spin_unlock_bh(&ntoskernel_lock);
+	TIMEREXIT(return);
+}
+
+wstdcall void WIN_FUNC(KeInitializeTimerEx,2)
+	(struct nt_timer *nt_timer, enum timer_type type)
+{
+	TIMERENTER("%p", nt_timer);
+	wrap_init_timer(nt_timer, type, NULL);
+}
+
+wstdcall void WIN_FUNC(KeInitializeTimer,1)
+	(struct nt_timer *nt_timer)
+{
+	TIMERENTER("%p", nt_timer);
+	wrap_init_timer(nt_timer, NotificationTimer, NULL);
+}
+
+/* expires and repeat are in HZ */
+BOOLEAN wrap_set_timer(struct nt_timer *nt_timer, unsigned long expires_hz,
+		       unsigned long repeat_hz, struct kdpc *kdpc)
+{
+	struct wrap_timer *wrap_timer;
+
+	TIMERENTER("%p, %lu, %lu, %p, %lu",
+		   nt_timer, expires_hz, repeat_hz, kdpc, jiffies);
+
+	wrap_timer = nt_timer->wrap_timer;
+	TIMERTRACE("%p", wrap_timer);
+#ifdef TIMER_DEBUG
+	if (wrap_timer->nt_timer != nt_timer)
+		WARNING("bad timers: %p, %p, %p", wrap_timer, nt_timer,
+			wrap_timer->nt_timer);
+	if (nt_timer->wrap_timer_magic != WRAP_TIMER_MAGIC) {
+		WARNING("buggy Windows timer didn't initialize timer %p",
+			nt_timer);
+		return FALSE;
+	}
+	if (wrap_timer->wrap_timer_magic != WRAP_TIMER_MAGIC) {
+		WARNING("timer %p is not initialized (%lx)?",
+			wrap_timer, wrap_timer->wrap_timer_magic);
+		wrap_timer->wrap_timer_magic = WRAP_TIMER_MAGIC;
+	}
+#endif
+	KeClearEvent((struct nt_event *)nt_timer);
+	nt_timer->kdpc = kdpc;
+	wrap_timer->repeat = repeat_hz;
+	if (mod_timer(&wrap_timer->timer, jiffies + expires_hz))
+		TIMEREXIT(return TRUE);
+	else
+		TIMEREXIT(return FALSE);
+}
+
+wstdcall BOOLEAN WIN_FUNC(KeSetTimerEx,4)
+	(struct nt_timer *nt_timer, LARGE_INTEGER duetime_ticks,
+	 LONG period_ms, struct kdpc *kdpc)
+{
+	unsigned long expires_hz, repeat_hz;
+
+	TIMERENTER("%p, %Ld, %d", nt_timer, duetime_ticks, period_ms);
+	expires_hz = SYSTEM_TIME_TO_HZ(duetime_ticks);
+	repeat_hz = MSEC_TO_HZ(period_ms);
+	return wrap_set_timer(nt_timer, expires_hz, repeat_hz, kdpc);
+}
+
+wstdcall BOOLEAN WIN_FUNC(KeSetTimer,3)
+	(struct nt_timer *nt_timer, LARGE_INTEGER duetime_ticks,
+	 struct kdpc *kdpc)
+{
+	TIMERENTER("%p, %Ld, %p", nt_timer, duetime_ticks, kdpc);
+	return KeSetTimerEx(nt_timer, duetime_ticks, 0, kdpc);
+}
+
+wstdcall BOOLEAN WIN_FUNC(KeCancelTimer,1)
+	(struct nt_timer *nt_timer)
+{
+	struct wrap_timer *wrap_timer;
+	int ret;
+
+	TIMERENTER("%p", nt_timer);
+	wrap_timer = nt_timer->wrap_timer;
+	if (!wrap_timer) {
+		ERROR("invalid wrap_timer");
+		return TRUE;
+	}
+#ifdef TIMER_DEBUG
+	BUG_ON(wrap_timer->wrap_timer_magic != WRAP_TIMER_MAGIC);
+#endif
+	/* disable timer before deleting so if it is periodic timer, it
+	 * won't be re-armed after deleting */
+	wrap_timer->repeat = 0;
+	ret = del_timer_sync(&wrap_timer->timer);
+	/* the documentation for KeCancelTimer suggests the DPC is
+	 * deqeued, but actually DPC is left to run */
+	if (ret)
+		TIMEREXIT(return TRUE);
+	else
+		TIMEREXIT(return FALSE);
+}
+
+wstdcall BOOLEAN WIN_FUNC(KeReadStateTimer,1)
+	(struct nt_timer *nt_timer)
+{
+	if (nt_timer->dh.signal_state)
+		return TRUE;
+	else
+		return FALSE;
+}
+
+wstdcall void WIN_FUNC(KeInitializeDpc,3)
+	(struct kdpc *kdpc, void *func, void *ctx)
+{
+	ENTER3("%p, %p, %p", kdpc, func, ctx);
+	memset(kdpc, 0, sizeof(*kdpc));
+	kdpc->func = func;
+	kdpc->ctx  = ctx;
+	InitializeListHead(&kdpc->list);
+}
+
+static void kdpc_worker(worker_param_t dummy)
+{
+	struct nt_list *entry;
+	struct kdpc *kdpc;
+	unsigned long flags;
+	KIRQL irql;
+
+	WORKENTER("");
+	irql = raise_irql(DISPATCH_LEVEL);
+	while (1) {
+		spin_lock_irqsave(&kdpc_list_lock, flags);
+		entry = RemoveHeadList(&kdpc_list);
+		if (entry) {
+			kdpc = container_of(entry, struct kdpc, list);
+			assert(kdpc->queued);
+			kdpc->queued = 0;
+		} else
+			kdpc = NULL;
+		spin_unlock_irqrestore(&kdpc_list_lock, flags);
+		if (!kdpc)
+			break;
+		WORKTRACE("%p, %p, %p, %p, %p", kdpc, kdpc->func, kdpc->ctx,
+			  kdpc->arg1, kdpc->arg2);
+		assert_irql(_irql_ == DISPATCH_LEVEL);
+		LIN2WIN4(kdpc->func, kdpc, kdpc->ctx, kdpc->arg1, kdpc->arg2);
+		assert_irql(_irql_ == DISPATCH_LEVEL);
+	}
+	lower_irql(irql);
+	WORKEXIT(return);
+}
+
+wstdcall void WIN_FUNC(KeFlushQueuedDpcs,0)
+	(void)
+{
+	kdpc_worker(NULL);
+}
+
+BOOLEAN queue_kdpc(struct kdpc *kdpc)
+{
+	BOOLEAN ret;
+	unsigned long flags;
+
+	WORKENTER("%p", kdpc);
+	spin_lock_irqsave(&kdpc_list_lock, flags);
+	if (kdpc->queued)
+		ret = FALSE;
+	else {
+		if (unlikely(kdpc->importance == HighImportance))
+			InsertHeadList(&kdpc_list, &kdpc->list);
+		else
+			InsertTailList(&kdpc_list, &kdpc->list);
+		kdpc->queued = 1;
+		ret = TRUE;
+	}
+	spin_unlock_irqrestore(&kdpc_list_lock, flags);
+	if (ret == TRUE)
+		schedule_ntos_work(&kdpc_work);
+	WORKTRACE("%d", ret);
+	return ret;
+}
+
+BOOLEAN dequeue_kdpc(struct kdpc *kdpc)
+{
+	BOOLEAN ret;
+	unsigned long flags;
+
+	WORKENTER("%p", kdpc);
+	spin_lock_irqsave(&kdpc_list_lock, flags);
+	if (kdpc->queued) {
+		RemoveEntryList(&kdpc->list);
+		kdpc->queued = 0;
+		ret = TRUE;
+	} else
+		ret = FALSE;
+	spin_unlock_irqrestore(&kdpc_list_lock, flags);
+	WORKTRACE("%d", ret);
+	return ret;
+}
+
+wstdcall BOOLEAN WIN_FUNC(KeInsertQueueDpc,3)
+	(struct kdpc *kdpc, void *arg1, void *arg2)
+{
+	WORKENTER("%p, %p, %p", kdpc, arg1, arg2);
+	kdpc->arg1 = arg1;
+	kdpc->arg2 = arg2;
+	return queue_kdpc(kdpc);
+}
+
+wstdcall BOOLEAN WIN_FUNC(KeRemoveQueueDpc,1)
+	(struct kdpc *kdpc)
+{
+	return dequeue_kdpc(kdpc);
+}
+
+wstdcall void WIN_FUNC(KeSetImportanceDpc,2)
+	(struct kdpc *kdpc, enum kdpc_importance importance)
+{
+	kdpc->importance = importance;
+}
+
+static void ntos_work_worker(worker_param_t dummy)
+{
+	struct ntos_work_item *ntos_work_item;
+	struct nt_list *cur;
+
+	while (1) {
+		spin_lock_bh(&ntos_work_lock);
+		cur = RemoveHeadList(&ntos_work_list);
+		spin_unlock_bh(&ntos_work_lock);
+		if (!cur)
+			break;
+		ntos_work_item = container_of(cur, struct ntos_work_item, list);
+		WORKTRACE("%p: executing %p, %p, %p", current,
+			  ntos_work_item->func, ntos_work_item->arg1,
+			  ntos_work_item->arg2);
+		LIN2WIN2(ntos_work_item->func, ntos_work_item->arg1,
+			 ntos_work_item->arg2);
+		kfree(ntos_work_item);
+	}
+	WORKEXIT(return);
+}
+
+int schedule_ntos_work_item(NTOS_WORK_FUNC func, void *arg1, void *arg2)
+{
+	struct ntos_work_item *ntos_work_item;
+
+	WORKENTER("adding work: %p, %p, %p", func, arg1, arg2);
+	ntos_work_item = kmalloc(sizeof(*ntos_work_item), irql_gfp());
+	if (!ntos_work_item) {
+		ERROR("couldn't allocate memory");
+		return -ENOMEM;
+	}
+	ntos_work_item->func = func;
+	ntos_work_item->arg1 = arg1;
+	ntos_work_item->arg2 = arg2;
+	spin_lock_bh(&ntos_work_lock);
+	InsertTailList(&ntos_work_list, &ntos_work_item->list);
+	spin_unlock_bh(&ntos_work_lock);
+	schedule_ntos_work(&ntos_work);
+	WORKEXIT(return 0);
+}
+
+wstdcall void WIN_FUNC(KeInitializeSpinLock,1)
+	(NT_SPIN_LOCK *lock)
+{
+	ENTER6("%p", lock);
+	nt_spin_lock_init(lock);
+}
+
+wstdcall void WIN_FUNC(KeAcquireSpinLock,2)
+	(NT_SPIN_LOCK *lock, KIRQL *irql)
+{
+	ENTER6("%p", lock);
+	*irql = nt_spin_lock_irql(lock, DISPATCH_LEVEL);
+}
+
+wstdcall void WIN_FUNC(KeReleaseSpinLock,2)
+	(NT_SPIN_LOCK *lock, KIRQL oldirql)
+{
+	ENTER6("%p", lock);
+	nt_spin_unlock_irql(lock, oldirql);
+}
+
+wstdcall void WIN_FUNC(KeAcquireSpinLockAtDpcLevel,1)
+	(NT_SPIN_LOCK *lock)
+{
+	ENTER6("%p", lock);
+	nt_spin_lock(lock);
+}
+
+wstdcall void WIN_FUNC(KeReleaseSpinLockFromDpcLevel,1)
+	(NT_SPIN_LOCK *lock)
+{
+	ENTER6("%p", lock);
+	nt_spin_unlock(lock);
+}
+
+wstdcall void WIN_FUNC(KeRaiseIrql,2)
+	(KIRQL newirql, KIRQL *oldirql)
+{
+	ENTER6("%d", newirql);
+	*oldirql = raise_irql(newirql);
+}
+
+wstdcall KIRQL WIN_FUNC(KeRaiseIrqlToDpcLevel,0)
+	(void)
+{
+	return raise_irql(DISPATCH_LEVEL);
+}
+
+wstdcall void WIN_FUNC(KeLowerIrql,1)
+	(KIRQL irql)
+{
+	ENTER6("%d", irql);
+	lower_irql(irql);
+}
+
+wstdcall KIRQL WIN_FUNC(KeAcquireSpinLockRaiseToDpc,1)
+	(NT_SPIN_LOCK *lock)
+{
+	ENTER6("%p", lock);
+	return nt_spin_lock_irql(lock, DISPATCH_LEVEL);
+}
+
+#undef ExAllocatePoolWithTag
+
+wstdcall void *WIN_FUNC(ExAllocatePoolWithTag,3)
+	(enum pool_type pool_type, SIZE_T size, ULONG tag)
+{
+	void *addr;
+
+	ENTER4("pool_type: %d, size: %lu, tag: 0x%x", pool_type, size, tag);
+	assert_irql(_irql_ <= DISPATCH_LEVEL);
+	if (size < PAGE_SIZE)
+		addr = kmalloc(size, irql_gfp());
+	else {
+		if (irql_gfp() & GFP_ATOMIC) {
+			addr = __vmalloc(size, GFP_ATOMIC | __GFP_HIGHMEM,
+					 PAGE_KERNEL);
+			TRACE1("%p, %lu", addr, size);
+		} else {
+			addr = vmalloc(size);
+			TRACE1("%p, %lu", addr, size);
+		}
+	}
+	DBG_BLOCK(1) {
+		if (addr)
+			TRACE4("addr: %p, %lu", addr, size);
+		else
+			TRACE1("failed: %lu", size);
+	}
+	return addr;
+}
+WIN_FUNC_DECL(ExAllocatePoolWithTag,3)
+
+wstdcall void WIN_FUNC(ExFreePoolWithTag,2)
+	(void *addr, ULONG tag)
+{
+	TRACE4("%p", addr);
+	if ((unsigned long)addr < VMALLOC_START ||
+	    (unsigned long)addr >= VMALLOC_END)
+		kfree(addr);
+	else
+		vfree(addr);
+
+	EXIT4(return);
+}
+
+wstdcall void WIN_FUNC(ExFreePool,1)
+	(void *addr)
+{
+	ExFreePoolWithTag(addr, 0);
+}
+WIN_FUNC_DECL(ExFreePool,1)
+
+wstdcall void WIN_FUNC(ExInitializeNPagedLookasideList,7)
+	(struct npaged_lookaside_list *lookaside,
+	 LOOKASIDE_ALLOC_FUNC *alloc_func, LOOKASIDE_FREE_FUNC *free_func,
+	 ULONG flags, SIZE_T size, ULONG tag, USHORT depth)
+{
+	ENTER3("lookaside: %p, size: %lu, flags: %u, head: %p, "
+	       "alloc: %p, free: %p", lookaside, size, flags,
+	       lookaside, alloc_func, free_func);
+
+	memset(lookaside, 0, sizeof(*lookaside));
+
+	lookaside->size = size;
+	lookaside->tag = tag;
+	lookaside->depth = 4;
+	lookaside->maxdepth = 256;
+	lookaside->pool_type = NonPagedPool;
+
+	if (alloc_func)
+		lookaside->alloc_func = alloc_func;
+	else
+		lookaside->alloc_func = WIN_FUNC_PTR(ExAllocatePoolWithTag,3);
+	if (free_func)
+		lookaside->free_func = free_func;
+	else
+		lookaside->free_func = WIN_FUNC_PTR(ExFreePool,1);
+
+#ifndef CONFIG_X86_64
+	nt_spin_lock_init(&lookaside->obsolete);
+#endif
+	EXIT3(return);
+}
+
+wstdcall void WIN_FUNC(ExDeleteNPagedLookasideList,1)
+	(struct npaged_lookaside_list *lookaside)
+{
+	struct nt_slist *entry;
+
+	ENTER3("lookaside = %p", lookaside);
+	while ((entry = ExpInterlockedPopEntrySList(&lookaside->head)))
+		LIN2WIN1(lookaside->free_func, entry);
+	EXIT3(return);
+}
+
+#if defined(ALLOC_DEBUG) && ALLOC_DEBUG > 1
+#define ExAllocatePoolWithTag(pool_type, size, tag)			\
+	wrap_ExAllocatePoolWithTag(pool_type, size, tag, __FILE__, __LINE__)
+#endif
+
+wstdcall NTSTATUS WIN_FUNC(ExCreateCallback,4)
+	(struct callback_object **object, struct object_attributes *attributes,
+	 BOOLEAN create, BOOLEAN allow_multiple_callbacks)
+{
+	struct callback_object *obj;
+
+	ENTER2("");
+	spin_lock_bh(&ntoskernel_lock);
+	nt_list_for_each_entry(obj, &callback_objects, callback_funcs) {
+		if (obj->attributes == attributes) {
+			spin_unlock_bh(&ntoskernel_lock);
+			*object = obj;
+			return STATUS_SUCCESS;
+		}
+	}
+	spin_unlock_bh(&ntoskernel_lock);
+	obj = allocate_object(sizeof(struct callback_object),
+			      OBJECT_TYPE_CALLBACK, NULL);
+	if (!obj)
+		EXIT2(return STATUS_INSUFFICIENT_RESOURCES);
+	InitializeListHead(&obj->callback_funcs);
+	nt_spin_lock_init(&obj->lock);
+	obj->allow_multiple_callbacks = allow_multiple_callbacks;
+	obj->attributes = attributes;
+	*object = obj;
+	EXIT2(return STATUS_SUCCESS);
+}
+
+wstdcall void *WIN_FUNC(ExRegisterCallback,3)
+	(struct callback_object *object, PCALLBACK_FUNCTION func, void *context)
+{
+	struct callback_func *callback;
+	KIRQL irql;
+
+	ENTER2("");
+	irql = nt_spin_lock_irql(&object->lock, DISPATCH_LEVEL);
+	if (object->allow_multiple_callbacks == FALSE &&
+	    !IsListEmpty(&object->callback_funcs)) {
+		nt_spin_unlock_irql(&object->lock, irql);
+		EXIT2(return NULL);
+	}
+	nt_spin_unlock_irql(&object->lock, irql);
+	callback = kmalloc(sizeof(*callback), GFP_KERNEL);
+	if (!callback) {
+		ERROR("couldn't allocate memory");
+		return NULL;
+	}
+	callback->func = func;
+	callback->context = context;
+	callback->object = object;
+	irql = nt_spin_lock_irql(&object->lock, DISPATCH_LEVEL);
+	InsertTailList(&object->callback_funcs, &callback->list);
+	nt_spin_unlock_irql(&object->lock, irql);
+	EXIT2(return callback);
+}
+
+wstdcall void WIN_FUNC(ExUnregisterCallback,1)
+	(struct callback_func *callback)
+{
+	struct callback_object *object;
+	KIRQL irql;
+
+	ENTER3("%p", callback);
+	if (!callback)
+		return;
+	object = callback->object;
+	irql = nt_spin_lock_irql(&object->lock, DISPATCH_LEVEL);
+	RemoveEntryList(&callback->list);
+	nt_spin_unlock_irql(&object->lock, irql);
+	kfree(callback);
+	return;
+}
+
+wstdcall void WIN_FUNC(ExNotifyCallback,3)
+	(struct callback_object *object, void *arg1, void *arg2)
+{
+	struct callback_func *callback;
+	KIRQL irql;
+
+	ENTER3("%p", object);
+	irql = nt_spin_lock_irql(&object->lock, DISPATCH_LEVEL);
+	nt_list_for_each_entry(callback, &object->callback_funcs, list) {
+		LIN2WIN3(callback->func, callback->context, arg1, arg2);
+	}
+	nt_spin_unlock_irql(&object->lock, irql);
+	return;
+}
+
+/* check and set signaled state; should be called with dispatcher_lock held */
+/* @grab indicates if the event should be grabbed or checked
+ * - note that a semaphore may stay in signaled state for multiple
+ * 'grabs' if the count is > 1 */
+static int grab_object(struct dispatcher_header *dh,
+		       struct task_struct *thread, int grab)
+{
+	EVENTTRACE("%p, %p, %d, %d", dh, thread, grab, dh->signal_state);
+	if (unlikely(is_mutex_object(dh))) {
+		struct nt_mutex *nt_mutex;
+		nt_mutex = container_of(dh, struct nt_mutex, dh);
+		EVENTTRACE("%p, %p, %d, %p, %d", nt_mutex,
+			   nt_mutex->owner_thread, dh->signal_state,
+			   thread, grab);
+		/* either no thread owns the mutex or this thread owns
+		 * it */
+		assert(dh->signal_state == 1 && nt_mutex->owner_thread == NULL);
+		assert(dh->signal_state < 1 && nt_mutex->owner_thread != NULL);
+		if ((dh->signal_state == 1 && nt_mutex->owner_thread == NULL) ||
+		    nt_mutex->owner_thread == thread) {
+			if (grab) {
+				dh->signal_state--;
+				nt_mutex->owner_thread = thread;
+			}
+			EVENTEXIT(return 1);
+		}
+	} else if (dh->signal_state > 0) {
+		/* to grab, decrement signal_state for synchronization
+		 * or semaphore objects */
+		if (grab && (is_synch_object(dh) || is_semaphore_object(dh)))
+			dh->signal_state--;
+		EVENTEXIT(return 1);
+	}
+	EVENTEXIT(return 0);
+}
+
+/* this function should be called holding dispatcher_lock */
+static void object_signalled(struct dispatcher_header *dh)
+{
+	struct nt_list *cur, *next;
+	struct wait_block *wb;
+
+	EVENTENTER("%p", dh);
+	nt_list_for_each_safe(cur, next, &dh->wait_blocks) {
+		wb = container_of(cur, struct wait_block, list);
+		assert(wb->thread != NULL);
+		assert(wb->object == NULL);
+		if (!grab_object(dh, wb->thread, 1))
+			continue;
+		EVENTTRACE("%p (%p): waking %p", dh, wb, wb->thread);
+		RemoveEntryList(cur);
+		wb->object = dh;
+		*(wb->wait_done) = 1;
+		wake_up_process(wb->thread);
+	}
+	EVENTEXIT(return);
+}
+
+wstdcall NTSTATUS WIN_FUNC(KeWaitForMultipleObjects,8)
+	(ULONG count, void *object[], enum wait_type wait_type,
+	 KWAIT_REASON wait_reason, KPROCESSOR_MODE wait_mode,
+	 BOOLEAN alertable, LARGE_INTEGER *timeout,
+	 struct wait_block *wait_block_array)
+{
+	int i, res = 0, wait_count, wait_done;
+	typeof(jiffies) wait_hz = 0;
+	struct wait_block *wb, wb_array[THREAD_WAIT_OBJECTS];
+	struct dispatcher_header *dh;
+
+	EVENTENTER("%p, %d, %u, %p", current, count, wait_type, timeout);
+
+	if (count > MAX_WAIT_OBJECTS ||
+	    (count > THREAD_WAIT_OBJECTS && wait_block_array == NULL))
+		EVENTEXIT(return STATUS_INVALID_PARAMETER);
+
+	if (wait_block_array == NULL)
+		wb = wb_array;
+	else
+		wb = wait_block_array;
+
+	/* If *timeout == 0: In the case of WaitAny, if an object can
+	 * be grabbed (object is in signaled state), grab and
+	 * return. In the case of WaitAll, we have to first make sure
+	 * all objects can be grabbed. If any/some of them can't be
+	 * grabbed, either we return STATUS_TIMEOUT or wait for them,
+	 * depending on how to satisfy wait. If all of them can be
+	 * grabbed, we will grab them in the next loop below */
+
+	spin_lock_bh(&dispatcher_lock);
+	for (i = wait_count = 0; i < count; i++) {
+		dh = object[i];
+		EVENTTRACE("%p: event %p (%d)", current, dh, dh->signal_state);
+		/* wait_type == 1 for WaitAny, 0 for WaitAll */
+		if (grab_object(dh, current, wait_type)) {
+			if (wait_type == WaitAny) {
+				spin_unlock_bh(&dispatcher_lock);
+				EVENTEXIT(return STATUS_WAIT_0 + i);
+			}
+		} else {
+			EVENTTRACE("%p: wait for %p", current, dh);
+			wait_count++;
+		}
+	}
+
+	if (timeout && *timeout == 0 && wait_count) {
+		spin_unlock_bh(&dispatcher_lock);
+		EVENTEXIT(return STATUS_TIMEOUT);
+	}
+
+	/* get the list of objects the thread needs to wait on and add
+	 * the thread on the wait list for each such object */
+	/* if *timeout == 0, this step will grab all the objects */
+	wait_done = 0;
+	for (i = 0; i < count; i++) {
+		dh = object[i];
+		EVENTTRACE("%p: event %p (%d)", current, dh, dh->signal_state);
+		wb[i].object = NULL;
+		if (grab_object(dh, current, 1)) {
+			EVENTTRACE("%p: no wait for %p (%d)",
+				   current, dh, dh->signal_state);
+			/* mark that we are not waiting on this object */
+			wb[i].thread = NULL;
+		} else {
+			wb[i].wait_done = &wait_done;
+			wb[i].thread = current;
+			EVENTTRACE("%p: wait for %p", current, dh);
+			InsertTailList(&dh->wait_blocks, &wb[i].list);
+		}
+	}
+	spin_unlock_bh(&dispatcher_lock);
+	if (wait_count == 0)
+		EVENTEXIT(return STATUS_SUCCESS);
+
+	assert(timeout == NULL || *timeout != 0);
+	if (timeout == NULL)
+		wait_hz = 0;
+	else
+		wait_hz = SYSTEM_TIME_TO_HZ(*timeout);
+
+	DBG_BLOCK(2) {
+		KIRQL irql = current_irql();
+		if (irql >= DISPATCH_LEVEL) {
+			TRACE2("wait in atomic context: %lu, %d, %ld",
+			       wait_hz, in_atomic(), in_interrupt());
+		}
+	}
+	assert_irql(_irql_ < DISPATCH_LEVEL);
+	EVENTTRACE("%p: sleep for %ld on %p", current, wait_hz, &wait_done);
+	/* we don't honor 'alertable' - according to decription for
+	 * this, even if waiting in non-alertable state, thread may be
+	 * alerted in some circumstances */
+	while (wait_count) {
+		res = wait_condition(wait_done, wait_hz, TASK_INTERRUPTIBLE);
+		spin_lock_bh(&dispatcher_lock);
+		EVENTTRACE("%p woke up: %d, %d", current, res, wait_done);
+		/* the event may have been set by the time
+		 * wrap_wait_event returned and spinlock obtained, so
+		 * don't rely on value of 'res' - check event status */
+		if (!wait_done) {
+			assert(res <= 0);
+			/* timed out or interrupted; remove from wait list */
+			for (i = 0; i < count; i++) {
+				if (!wb[i].thread)
+					continue;
+				EVENTTRACE("%p: timedout, dequeue %p (%p)",
+					   current, object[i], wb[i].object);
+				assert(wb[i].object == NULL);
+				RemoveEntryList(&wb[i].list);
+			}
+			spin_unlock_bh(&dispatcher_lock);
+			if (res < 0)
+				EVENTEXIT(return STATUS_ALERTED);
+			else
+				EVENTEXIT(return STATUS_TIMEOUT);
+		}
+		assert(res > 0);
+		/* woken because object(s) signalled */
+		for (i = 0; wait_count && i < count; i++) {
+			if (!wb[i].thread || !wb[i].object)
+				continue;
+			DBG_BLOCK(1) {
+				if (wb[i].object != object[i]) {
+					EVENTTRACE("oops %p != %p",
+						   wb[i].object, object[i]);
+					continue;
+				}
+			}
+			wait_count--;
+			if (wait_type == WaitAny) {
+				int j;
+				/* done; remove from rest of wait list */
+				for (j = i + 1; j < count; j++) {
+					if (wb[j].thread && !wb[j].object)
+						RemoveEntryList(&wb[j].list);
+				}
+				spin_unlock_bh(&dispatcher_lock);
+				EVENTEXIT(return STATUS_WAIT_0 + i);
+			}
+		}
+		wait_done = 0;
+		spin_unlock_bh(&dispatcher_lock);
+		if (wait_count == 0)
+			EVENTEXIT(return STATUS_SUCCESS);
+
+		/* this thread is still waiting for more objects, so
+		 * let it wait for remaining time and those objects */
+		if (timeout)
+			wait_hz = res;
+		else
+			wait_hz = 0;
+	}
+	/* should never reach here, but compiler wants return value */
+	ERROR("%p: wait_hz: %ld", current, wait_hz);
+	EVENTEXIT(return STATUS_SUCCESS);
+}
+
+wstdcall NTSTATUS WIN_FUNC(KeWaitForSingleObject,5)
+	(void *object, KWAIT_REASON wait_reason, KPROCESSOR_MODE wait_mode,
+	 BOOLEAN alertable, LARGE_INTEGER *timeout)
+{
+	return KeWaitForMultipleObjects(1, &object, WaitAny, wait_reason,
+					wait_mode, alertable, timeout, NULL);
+}
+
+wstdcall void WIN_FUNC(KeInitializeEvent,3)
+	(struct nt_event *nt_event, enum event_type type, BOOLEAN state)
+{
+	EVENTENTER("event = %p, type = %d, state = %d", nt_event, type, state);
+	initialize_object(&nt_event->dh, type, state);
+	EVENTEXIT(return);
+}
+
+wstdcall LONG WIN_FUNC(KeSetEvent,3)
+	(struct nt_event *nt_event, KPRIORITY incr, BOOLEAN wait)
+{
+	LONG old_state;
+
+	EVENTENTER("%p, %d", nt_event, nt_event->dh.type);
+	if (wait == TRUE)
+		WARNING("wait = %d, not yet implemented", wait);
+	spin_lock_bh(&dispatcher_lock);
+	old_state = nt_event->dh.signal_state;
+	nt_event->dh.signal_state = 1;
+	if (old_state == 0)
+		object_signalled(&nt_event->dh);
+	spin_unlock_bh(&dispatcher_lock);
+	EVENTEXIT(return old_state);
+}
+
+wstdcall void WIN_FUNC(KeClearEvent,1)
+	(struct nt_event *nt_event)
+{
+	EVENTENTER("%p", nt_event);
+	nt_event->dh.signal_state = 0;
+	EVENTEXIT(return);
+}
+
+wstdcall LONG WIN_FUNC(KeResetEvent,1)
+	(struct nt_event *nt_event)
+{
+	LONG old_state;
+
+	EVENTENTER("%p", nt_event);
+	old_state = xchg(&nt_event->dh.signal_state, 0);
+	EVENTEXIT(return old_state);
+}
+
+wstdcall LONG WIN_FUNC(KeReadStateEvent,1)
+	(struct nt_event *nt_event)
+{
+	LONG state;
+
+	state = nt_event->dh.signal_state;
+	EVENTTRACE("%d", state);
+	return state;
+}
+
+wstdcall void WIN_FUNC(KeInitializeMutex,2)
+	(struct nt_mutex *mutex, ULONG level)
+{
+	EVENTENTER("%p", mutex);
+	initialize_object(&mutex->dh, MutexObject, 1);
+	mutex->dh.size = sizeof(*mutex);
+	InitializeListHead(&mutex->list);
+	mutex->abandoned = FALSE;
+	mutex->apc_disable = 1;
+	mutex->owner_thread = NULL;
+	EVENTEXIT(return);
+}
+
+wstdcall LONG WIN_FUNC(KeReleaseMutex,2)
+	(struct nt_mutex *mutex, BOOLEAN wait)
+{
+	LONG ret;
+	struct task_struct *thread;
+
+	EVENTENTER("%p, %d, %p", mutex, wait, current);
+	if (wait == TRUE)
+		WARNING("wait: %d", wait);
+	thread = current;
+	spin_lock_bh(&dispatcher_lock);
+	EVENTTRACE("%p, %p, %p, %d", mutex, thread, mutex->owner_thread,
+		   mutex->dh.signal_state);
+	if ((mutex->owner_thread == thread) && (mutex->dh.signal_state <= 0)) {
+		ret = mutex->dh.signal_state++;
+		if (ret == 0) {
+			mutex->owner_thread = NULL;
+			object_signalled(&mutex->dh);
+		}
+	} else {
+		ret = STATUS_MUTANT_NOT_OWNED;
+		WARNING("invalid mutex: %p, %p, %p", mutex, mutex->owner_thread,
+			thread);
+	}
+	EVENTTRACE("%p, %p, %p, %d", mutex, thread, mutex->owner_thread,
+		   mutex->dh.signal_state);
+	spin_unlock_bh(&dispatcher_lock);
+	EVENTEXIT(return ret);
+}
+
+wstdcall void WIN_FUNC(KeInitializeSemaphore,3)
+	(struct nt_semaphore *semaphore, LONG count, LONG limit)
+{
+	EVENTENTER("%p: %d", semaphore, count);
+	/* if limit > 1, we need to satisfy as many waits (until count
+	 * becomes 0); so we keep decrementing count everytime a wait
+	 * is satisified */
+	initialize_object(&semaphore->dh, SemaphoreObject, count);
+	semaphore->dh.size = sizeof(*semaphore);
+	semaphore->limit = limit;
+	EVENTEXIT(return);
+}
+
+wstdcall LONG WIN_FUNC(KeReleaseSemaphore,4)
+	(struct nt_semaphore *semaphore, KPRIORITY incr, LONG adjustment,
+	 BOOLEAN wait)
+{
+	LONG ret;
+
+	EVENTENTER("%p", semaphore);
+	spin_lock_bh(&dispatcher_lock);
+	ret = semaphore->dh.signal_state;
+	assert(ret >= 0);
+	if (semaphore->dh.signal_state + adjustment <= semaphore->limit)
+		semaphore->dh.signal_state += adjustment;
+	else {
+		WARNING("releasing %d over limit %d", adjustment,
+			semaphore->limit);
+		semaphore->dh.signal_state = semaphore->limit;
+	}
+	if (semaphore->dh.signal_state > 0)
+		object_signalled(&semaphore->dh);
+	spin_unlock_bh(&dispatcher_lock);
+	EVENTEXIT(return ret);
+}
+
+wstdcall NTSTATUS WIN_FUNC(KeDelayExecutionThread,3)
+	(KPROCESSOR_MODE wait_mode, BOOLEAN alertable, LARGE_INTEGER *interval)
+{
+	int res;
+	long timeout;
+
+	if (wait_mode != 0)
+		ERROR("invalid wait_mode %d", wait_mode);
+
+	timeout = SYSTEM_TIME_TO_HZ(*interval);
+	EVENTTRACE("%p, %Ld, %ld", current, *interval, timeout);
+	if (timeout <= 0)
+		EVENTEXIT(return STATUS_SUCCESS);
+
+	if (alertable)
+		set_current_state(TASK_INTERRUPTIBLE);
+	else
+		set_current_state(TASK_UNINTERRUPTIBLE);
+
+	res = schedule_timeout(timeout);
+	EVENTTRACE("%p, %d", current, res);
+	if (res == 0)
+		EVENTEXIT(return STATUS_SUCCESS);
+	else
+		EVENTEXIT(return STATUS_ALERTED);
+}
+
+wstdcall ULONGLONG WIN_FUNC(KeQueryInterruptTime,0)
+	(void)
+{
+	EXIT5(return jiffies * TICKSPERJIFFY);
+}
+
+wstdcall ULONG WIN_FUNC(KeQueryTimeIncrement,0)
+	(void)
+{
+	EXIT5(return TICKSPERSEC / HZ);
+}
+
+wstdcall void WIN_FUNC(KeQuerySystemTime,1)
+	(LARGE_INTEGER *time)
+{
+	*time = ticks_1601();
+	TRACE5("%Lu, %lu", *time, jiffies);
+}
+
+wstdcall void WIN_FUNC(KeQueryTickCount,1)
+	(LARGE_INTEGER *count)
+{
+	*count = jiffies;
+}
+
+wstdcall LARGE_INTEGER WIN_FUNC(KeQueryPerformanceCounter,1)
+	(LARGE_INTEGER *counter)
+{
+	if (counter)
+		*counter = HZ;
+	return jiffies;
+}
+
+wstdcall KAFFINITY WIN_FUNC(KeQueryActiveProcessors,0)
+	(void)
+{
+	int i, n;
+	KAFFINITY bits = 0;
+#ifdef num_online_cpus
+	n = num_online_cpus();
+#else
+	n = NR_CPUS;
+#endif
+	for (i = 0; i < n; i++)
+		bits = (bits << 1) | 1;
+	return bits;
+}
+
+struct nt_thread *get_current_nt_thread(void)
+{
+	struct task_struct *task = current;
+	struct nt_thread *thread;
+	struct common_object_header *header;
+
+	TRACE6("task: %p", task);
+	thread = NULL;
+	spin_lock_bh(&ntoskernel_lock);
+	nt_list_for_each_entry(header, &object_list, list) {
+		TRACE6("%p, %d", header, header->type);
+		if (header->type != OBJECT_TYPE_NT_THREAD)
+			break;
+		thread = HEADER_TO_OBJECT(header);
+		TRACE6("%p, %p", thread, thread->task);
+		if (thread->task == task)
+			break;
+		else
+			thread = NULL;
+	}
+	spin_unlock_bh(&ntoskernel_lock);
+	if (thread == NULL)
+		TRACE4("couldn't find thread for task %p, %d", task, task->pid);
+	TRACE6("%p", thread);
+	return thread;
+}
+
+static struct task_struct *get_nt_thread_task(struct nt_thread *thread)
+{
+	struct task_struct *task;
+	struct common_object_header *header;
+
+	TRACE6("%p", thread);
+	task = NULL;
+	spin_lock_bh(&ntoskernel_lock);
+	nt_list_for_each_entry(header, &object_list, list) {
+		TRACE6("%p, %d", header, header->type);
+		if (header->type != OBJECT_TYPE_NT_THREAD)
+			break;
+		if (thread == HEADER_TO_OBJECT(header)) {
+			task = thread->task;
+			break;
+		}
+	}
+	spin_unlock_bh(&ntoskernel_lock);
+	if (task == NULL)
+		TRACE2("%p: couldn't find task for %p", current, thread);
+	return task;
+}
+
+static struct nt_thread *create_nt_thread(struct task_struct *task)
+{
+	struct nt_thread *thread;
+	thread = allocate_object(sizeof(*thread), OBJECT_TYPE_NT_THREAD, NULL);
+	if (!thread) {
+		ERROR("couldn't allocate thread object");
+		EXIT2(return NULL);
+	}
+	thread->task = task;
+	if (task)
+		thread->pid = task->pid;
+	else
+		thread->pid = 0;
+	nt_spin_lock_init(&thread->lock);
+	InitializeListHead(&thread->irps);
+	initialize_object(&thread->dh, ThreadObject, 0);
+	thread->dh.size = sizeof(*thread);
+	thread->prio = LOW_PRIORITY;
+	return thread;
+}
+
+wstdcall struct nt_thread *WIN_FUNC(KeGetCurrentThread,0)
+	(void)
+{
+	struct nt_thread *thread = get_current_nt_thread();
+	TRACE2("%p, %p", thread, current);
+	return thread;
+}
+
+wstdcall KPRIORITY WIN_FUNC(KeQueryPriorityThread,1)
+	(struct nt_thread *thread)
+{
+	KPRIORITY prio;
+	struct task_struct *task;
+
+	TRACE2("%p", thread);
+#ifdef CONFIG_X86_64
+	/* sis163u driver for amd64 passes 0x1f from thread created by
+	 * PsCreateSystemThread - no idea what is 0x1f */
+	if (thread == (void *)0x1f)
+		thread = get_current_nt_thread();
+#endif
+	if (!thread) {
+		TRACE2("invalid thread");
+		EXIT2(return LOW_REALTIME_PRIORITY);
+	}
+	task = get_nt_thread_task(thread);
+	if (!task) {
+		TRACE2("couldn't find task for thread: %p", thread);
+		EXIT2(return LOW_REALTIME_PRIORITY);
+	}
+
+	prio = thread->prio;
+
+	TRACE2("%d", prio);
+	return prio;
+}
+
+wstdcall KPRIORITY WIN_FUNC(KeSetPriorityThread,2)
+	(struct nt_thread *thread, KPRIORITY prio)
+{
+	KPRIORITY old_prio;
+	struct task_struct *task;
+
+	TRACE2("thread: %p, priority = %u", thread, prio);
+#ifdef CONFIG_X86_64
+	if (thread == (void *)0x1f)
+		thread = get_current_nt_thread();
+#endif
+	if (!thread) {
+		TRACE2("invalid thread");
+		EXIT2(return LOW_REALTIME_PRIORITY);
+	}
+	task = get_nt_thread_task(thread);
+	if (!task) {
+		TRACE2("couldn't find task for thread: %p", thread);
+		EXIT2(return LOW_REALTIME_PRIORITY);
+	}
+
+	old_prio = thread->prio;
+	thread->prio = prio;
+
+	TRACE2("%d, %d", old_prio, thread->prio);
+	return old_prio;
+}
+
+struct thread_trampoline {
+	void (*func)(void *) wstdcall;
+	void *ctx;
+	struct nt_thread *thread;
+	struct completion started;
+};
+
+static int ntdriver_thread(void *data)
+{
+	struct thread_trampoline *thread_tramp = data;
+	/* yes, a tramp! */
+	typeof(thread_tramp->func) func = thread_tramp->func;
+	typeof(thread_tramp->ctx) ctx = thread_tramp->ctx;
+
+	thread_tramp->thread->task = current;
+	thread_tramp->thread->pid = current->pid;
+	TRACE2("thread: %p, task: %p (%d)", thread_tramp->thread,
+	       current, current->pid);
+	complete(&thread_tramp->started);
+
+#ifdef PF_NOFREEZE
+	current->flags |= PF_NOFREEZE;
+#endif
+	strncpy(current->comm, "ntdriver", sizeof(current->comm));
+	current->comm[sizeof(current->comm)-1] = 0;
+	LIN2WIN1(func, ctx);
+	ERROR("task: %p", current);
+	return 0;
+}
+
+wstdcall NTSTATUS WIN_FUNC(PsCreateSystemThread,7)
+	(void **handle, ULONG access, void *obj_attr, void *process,
+	 void *client_id, void (*func)(void *) wstdcall, void *ctx)
+{
+	struct thread_trampoline thread_tramp;
+
+	ENTER2("handle = %p, access = %u, obj_attr = %p, process = %p, "
+	       "client_id = %p, func = %p, context = %p", handle, access,
+	       obj_attr, process, client_id, func, ctx);
+
+	thread_tramp.thread = create_nt_thread(NULL);
+	if (!thread_tramp.thread) {
+		ERROR("couldn't allocate thread object");
+		EXIT2(return STATUS_RESOURCES);
+	}
+	TRACE2("thread: %p", thread_tramp.thread);
+	thread_tramp.func = func;
+	thread_tramp.ctx = ctx;
+	init_completion(&thread_tramp.started);
+
+	thread_tramp.thread->task = kthread_run(ntdriver_thread,
+						&thread_tramp, "ntdriver");
+	if (IS_ERR(thread_tramp.thread->task)) {
+		free_object(thread_tramp.thread);
+		EXIT2(return STATUS_FAILURE);
+	}
+	TRACE2("created task: %p", thread_tramp.thread->task);
+
+	wait_for_completion(&thread_tramp.started);
+	*handle = OBJECT_TO_HEADER(thread_tramp.thread);
+	TRACE2("created thread: %p, %p", thread_tramp.thread, *handle);
+	EXIT2(return STATUS_SUCCESS);
+}
+
+wstdcall NTSTATUS WIN_FUNC(PsTerminateSystemThread,1)
+	(NTSTATUS status)
+{
+	struct nt_thread *thread;
+
+	TRACE2("%p, %08X", current, status);
+	thread = get_current_nt_thread();
+	TRACE2("%p", thread);
+	if (thread) {
+		KeSetEvent((struct nt_event *)&thread->dh, 0, FALSE);
+		while (1) {
+			struct nt_list *ent;
+			struct irp *irp;
+			KIRQL irql;
+			irql = nt_spin_lock_irql(&thread->lock, DISPATCH_LEVEL);
+			ent = RemoveHeadList(&thread->irps);
+			nt_spin_unlock_irql(&thread->lock, irql);
+			if (!ent)
+				break;
+			irp = container_of(ent, struct irp, thread_list);
+			IOTRACE("%p", irp);
+			IoCancelIrp(irp);
+		}
+		/* the driver may later query this status with
+		 * ZwQueryInformationThread */
+		thread->status = status;
+	} else
+		ERROR("couldn't find thread for task: %p", current);
+
+	complete_and_exit(NULL, status);
+	ERROR("oops: %p, %d", thread->task, thread->pid);
+	return STATUS_FAILURE;
+}
+
+wstdcall BOOLEAN WIN_FUNC(KeRemoveEntryDeviceQueue,2)
+	(struct kdevice_queue *dev_queue, struct kdevice_queue_entry *entry)
+{
+	struct kdevice_queue_entry *e;
+	KIRQL irql;
+
+	irql = nt_spin_lock_irql(&dev_queue->lock, DISPATCH_LEVEL);
+	nt_list_for_each_entry(e, &dev_queue->list, list) {
+		if (e == entry) {
+			RemoveEntryList(&e->list);
+			nt_spin_unlock_irql(&dev_queue->lock, irql);
+			return TRUE;
+		}
+	}
+	nt_spin_unlock_irql(&dev_queue->lock, irql);
+	return FALSE;
+}
+
+wstdcall BOOLEAN WIN_FUNC(KeSynchronizeExecution,3)
+	(struct kinterrupt *interrupt, PKSYNCHRONIZE_ROUTINE synch_routine,
+	 void *ctx)
+{
+	BOOLEAN ret;
+	unsigned long flags;
+
+	nt_spin_lock_irqsave(interrupt->actual_lock, flags);
+	ret = LIN2WIN1(synch_routine, ctx);
+	nt_spin_unlock_irqrestore(interrupt->actual_lock, flags);
+	TRACE6("%d", ret);
+	return ret;
+}
+
+wstdcall void *WIN_FUNC(MmAllocateContiguousMemorySpecifyCache,5)
+	(SIZE_T size, PHYSICAL_ADDRESS lowest, PHYSICAL_ADDRESS highest,
+	 PHYSICAL_ADDRESS boundary, enum memory_caching_type cache_type)
+{
+	void *addr;
+	gfp_t flags;
+
+	ENTER2("%lu, 0x%lx, 0x%lx, 0x%lx, %d", size, (long)lowest,
+	       (long)highest, (long)boundary, cache_type);
+	flags = irql_gfp();
+	addr = wrap_get_free_pages(flags, size);
+	TRACE2("%p, %lu, 0x%x", addr, size, flags);
+	if (addr && ((virt_to_phys(addr) + size) <= highest))
+		EXIT2(return addr);
+#ifdef CONFIG_X86_64
+	/* GFP_DMA is really only 16MB even on x86-64, but there is no
+	 * other zone available */
+	if (highest <= DMA_BIT_MASK(31))
+		flags |= __GFP_DMA;
+	else if (highest <= DMA_BIT_MASK(32))
+		flags |= __GFP_DMA32;
+#else
+	if (highest <= DMA_BIT_MASK(24))
+		flags |= __GFP_DMA;
+	else if (highest > DMA_BIT_MASK(30))
+		flags |= __GFP_HIGHMEM;
+#endif
+	addr = wrap_get_free_pages(flags, size);
+	TRACE2("%p, %lu, 0x%x", addr, size, flags);
+	return addr;
+}
+
+wstdcall void WIN_FUNC(MmFreeContiguousMemorySpecifyCache,3)
+	(void *base, SIZE_T size, enum memory_caching_type cache_type)
+{
+	TRACE2("%p, %lu", base, size);
+	free_pages((unsigned long)base, get_order(size));
+}
+
+wstdcall PHYSICAL_ADDRESS WIN_FUNC(MmGetPhysicalAddress,1)
+	(void *base)
+{
+	unsigned long phy = virt_to_phys(base);
+	TRACE2("%p, %p", base, (void *)phy);
+	return phy;
+}
+
+/* Atheros card with pciid 168C:0014 calls this function with 0xf0000
+ * and 0xf6ef0 address, and then check for things that seem to be
+ * related to ACPI: "_SM_" and "_DMI_". This may be the hack they do
+ * to check if this card is installed in IBM thinkpads; we can
+ * probably get this device to work if we create a buffer with the
+ * strings as required by the driver and return virtual address for
+ * that address instead */
+wstdcall void __iomem *WIN_FUNC(MmMapIoSpace,3)
+	(PHYSICAL_ADDRESS phys_addr, SIZE_T size,
+	 enum memory_caching_type cache)
+{
+	void __iomem *virt;
+	ENTER1("cache type: %d", cache);
+	if (cache == MmCached)
+		virt = ioremap(phys_addr, size);
+	else
+		virt = ioremap_nocache(phys_addr, size);
+	TRACE1("%Lx, %lu, %p", phys_addr, size, virt);
+	return virt;
+}
+
+wstdcall void WIN_FUNC(MmUnmapIoSpace,2)
+	(void __iomem *addr, SIZE_T size)
+{
+	ENTER1("%p, %lu", addr, size);
+	iounmap(addr);
+	return;
+}
+
+wstdcall ULONG WIN_FUNC(MmSizeOfMdl,2)
+	(void *base, ULONG length)
+{
+	return sizeof(struct mdl) +
+	       (sizeof(PFN_NUMBER) * SPAN_PAGES(base, length));
+}
+
+struct mdl *allocate_init_mdl(void *virt, ULONG length)
+{
+	struct wrap_mdl *wrap_mdl;
+	struct mdl *mdl;
+	int mdl_size = MmSizeOfMdl(virt, length);
+
+	if (mdl_size <= MDL_CACHE_SIZE) {
+		wrap_mdl = kmem_cache_alloc(mdl_cache, irql_gfp());
+		if (!wrap_mdl)
+			return NULL;
+		spin_lock_bh(&dispatcher_lock);
+		InsertHeadList(&wrap_mdl_list, &wrap_mdl->list);
+		spin_unlock_bh(&dispatcher_lock);
+		mdl = wrap_mdl->mdl;
+		TRACE3("allocated mdl from cache: %p(%p), %p(%d)",
+		       wrap_mdl, mdl, virt, length);
+		memset(mdl, 0, MDL_CACHE_SIZE);
+		MmInitializeMdl(mdl, virt, length);
+		/* mark the MDL as allocated from cache pool so when
+		 * it is freed, we free it back to the pool */
+		mdl->flags = MDL_ALLOCATED_FIXED_SIZE | MDL_CACHE_ALLOCATED;
+	} else {
+		wrap_mdl =
+			kmalloc(sizeof(*wrap_mdl) + mdl_size, irql_gfp());
+		if (!wrap_mdl)
+			return NULL;
+		mdl = wrap_mdl->mdl;
+		TRACE3("allocated mdl from memory: %p(%p), %p(%d)",
+		       wrap_mdl, mdl, virt, length);
+		spin_lock_bh(&dispatcher_lock);
+		InsertHeadList(&wrap_mdl_list, &wrap_mdl->list);
+		spin_unlock_bh(&dispatcher_lock);
+		memset(mdl, 0, mdl_size);
+		MmInitializeMdl(mdl, virt, length);
+		mdl->flags = MDL_ALLOCATED_FIXED_SIZE;
+	}
+	return mdl;
+}
+
+void free_mdl(struct mdl *mdl)
+{
+	/* A driver may allocate Mdl with NdisAllocateBuffer and free
+	 * with IoFreeMdl (e.g., 64-bit Broadcom). Since we need to
+	 * treat buffers allocated with Ndis calls differently, we
+	 * must call NdisFreeBuffer if it is allocated with Ndis
+	 * function. We set 'pool' field in Ndis functions. */
+	if (!mdl)
+		return;
+	if (mdl->pool)
+		NdisFreeBuffer(mdl);
+	else {
+		struct wrap_mdl *wrap_mdl = (struct wrap_mdl *)
+			((char *)mdl - offsetof(struct wrap_mdl, mdl));
+		spin_lock_bh(&dispatcher_lock);
+		RemoveEntryList(&wrap_mdl->list);
+		spin_unlock_bh(&dispatcher_lock);
+
+		if (mdl->flags & MDL_CACHE_ALLOCATED) {
+			TRACE3("freeing mdl cache: %p, %p, %p",
+			       wrap_mdl, mdl, mdl->mappedsystemva);
+			kmem_cache_free(mdl_cache, wrap_mdl);
+		} else {
+			TRACE3("freeing mdl: %p, %p, %p",
+			       wrap_mdl, mdl, mdl->mappedsystemva);
+			kfree(wrap_mdl);
+		}
+	}
+	return;
+}
+
+wstdcall void WIN_FUNC(IoBuildPartialMdl,4)
+	(struct mdl *source, struct mdl *target, void *virt, ULONG length)
+{
+	MmInitializeMdl(target, virt, length);
+	target->flags |= MDL_PARTIAL;
+}
+
+wstdcall void WIN_FUNC(MmBuildMdlForNonPagedPool,1)
+	(struct mdl *mdl)
+{
+	PFN_NUMBER *mdl_pages;
+	int i, n;
+
+	ENTER4("%p", mdl);
+	/* already mapped */
+//	mdl->mappedsystemva = MmGetMdlVirtualAddress(mdl);
+	mdl->flags |= MDL_SOURCE_IS_NONPAGED_POOL;
+	TRACE4("%p, %p, %p, %d, %d", mdl, mdl->mappedsystemva, mdl->startva,
+	       mdl->byteoffset, mdl->bytecount);
+	n = SPAN_PAGES(MmGetSystemAddressForMdl(mdl), MmGetMdlByteCount(mdl));
+	if (n > MDL_CACHE_PAGES)
+		WARNING("%p, %d, %d", MmGetSystemAddressForMdl(mdl),
+			MmGetMdlByteCount(mdl), n);
+	mdl_pages = MmGetMdlPfnArray(mdl);
+	for (i = 0; i < n; i++)
+		mdl_pages[i] = (ULONG_PTR)mdl->startva + (i * PAGE_SIZE);
+	EXIT4(return);
+}
+
+wstdcall void *WIN_FUNC(MmMapLockedPages,2)
+	(struct mdl *mdl, KPROCESSOR_MODE access_mode)
+{
+	/* already mapped */
+//	mdl->mappedsystemva = MmGetMdlVirtualAddress(mdl);
+	mdl->flags |= MDL_MAPPED_TO_SYSTEM_VA;
+	/* what is the need for MDL_PARTIAL_HAS_BEEN_MAPPED? */
+	if (mdl->flags & MDL_PARTIAL)
+		mdl->flags |= MDL_PARTIAL_HAS_BEEN_MAPPED;
+	return mdl->mappedsystemva;
+}
+
+wstdcall void *WIN_FUNC(MmMapLockedPagesSpecifyCache,6)
+	(struct mdl *mdl, KPROCESSOR_MODE access_mode,
+	 enum memory_caching_type cache_type, void *base_address,
+	 ULONG bug_check, enum mm_page_priority priority)
+{
+	return MmMapLockedPages(mdl, access_mode);
+}
+
+wstdcall void WIN_FUNC(MmUnmapLockedPages,2)
+	(void *base, struct mdl *mdl)
+{
+	mdl->flags &= ~MDL_MAPPED_TO_SYSTEM_VA;
+	return;
+}
+
+wstdcall void WIN_FUNC(MmProbeAndLockPages,3)
+	(struct mdl *mdl, KPROCESSOR_MODE access_mode,
+	 enum lock_operation operation)
+{
+	/* already locked */
+	mdl->flags |= MDL_PAGES_LOCKED;
+	return;
+}
+
+wstdcall void WIN_FUNC(MmUnlockPages,1)
+	(struct mdl *mdl)
+{
+	mdl->flags &= ~MDL_PAGES_LOCKED;
+	return;
+}
+
+wstdcall BOOLEAN WIN_FUNC(MmIsAddressValid,1)
+	(void *virt_addr)
+{
+	if (virt_addr_valid(virt_addr))
+		return TRUE;
+	else
+		return FALSE;
+}
+
+wstdcall void *WIN_FUNC(MmLockPagableDataSection,1)
+	(void *address)
+{
+	return address;
+}
+
+wstdcall void WIN_FUNC(MmUnlockPagableImageSection,1)
+	(void *handle)
+{
+	return;
+}
+
+wstdcall NTSTATUS WIN_FUNC(ObReferenceObjectByHandle,6)
+	(void *handle, ACCESS_MASK desired_access, void *obj_type,
+	 KPROCESSOR_MODE access_mode, void **object, void *handle_info)
+{
+	struct common_object_header *hdr;
+
+	TRACE2("%p", handle);
+	hdr = HANDLE_TO_HEADER(handle);
+	atomic_inc_var(hdr->ref_count);
+	*object = HEADER_TO_OBJECT(hdr);
+	TRACE2("%p, %p, %d, %p", hdr, object, hdr->ref_count, *object);
+	return STATUS_SUCCESS;
+}
+
+/* DDK doesn't say if return value should be before incrementing or
+ * after incrementing reference count, but according to #reactos
+ * devels, it should be return value after incrementing */
+wfastcall LONG WIN_FUNC(ObfReferenceObject,1)
+	(void *object)
+{
+	struct common_object_header *hdr;
+	LONG ret;
+
+	hdr = OBJECT_TO_HEADER(object);
+	ret = post_atomic_add(hdr->ref_count, 1);
+	TRACE2("%p, %d, %p", hdr, hdr->ref_count, object);
+	return ret;
+}
+
+static int dereference_object(void *object)
+{
+	struct common_object_header *hdr;
+	int ref_count;
+
+	ENTER2("object: %p", object);
+	hdr = OBJECT_TO_HEADER(object);
+	TRACE2("hdr: %p", hdr);
+	ref_count = post_atomic_add(hdr->ref_count, -1);
+	TRACE2("object: %p, %d", object, ref_count);
+	if (ref_count < 0)
+		ERROR("invalid object: %p (%d)", object, ref_count);
+	if (ref_count <= 0) {
+		free_object(object);
+		return 1;
+	} else
+		return 0;
+}
+
+wfastcall void WIN_FUNC(ObfDereferenceObject,1)
+	(void *object)
+{
+	TRACE2("%p", object);
+	dereference_object(object);
+}
+
+wstdcall NTSTATUS WIN_FUNC(ZwCreateFile,11)
+	(void **handle, ACCESS_MASK access_mask,
+	 struct object_attributes *obj_attr, struct io_status_block *iosb,
+	 LARGE_INTEGER *size, ULONG file_attr, ULONG share_access,
+	 ULONG create_disposition, ULONG create_options, void *ea_buffer,
+	 ULONG ea_length)
+{
+	struct common_object_header *coh;
+	struct file_object *fo;
+	struct ansi_string ansi;
+	struct wrap_bin_file *bin_file;
+	char *file_basename;
+	NTSTATUS status;
+
+	spin_lock_bh(&ntoskernel_lock);
+	nt_list_for_each_entry(coh, &object_list, list) {
+		if (coh->type != OBJECT_TYPE_FILE)
+			continue;
+		/* TODO: check if file is opened in shared mode */
+		if (!RtlCompareUnicodeString(&coh->name, obj_attr->name, TRUE)) {
+			fo = HEADER_TO_OBJECT(coh);
+			bin_file = fo->wrap_bin_file;
+			*handle = coh;
+			spin_unlock_bh(&ntoskernel_lock);
+			ObReferenceObject(fo);
+			iosb->status = FILE_OPENED;
+			iosb->info = bin_file->size;
+			EXIT2(return STATUS_SUCCESS);
+		}
+	}
+	spin_unlock_bh(&ntoskernel_lock);
+
+	if (RtlUnicodeStringToAnsiString(&ansi, obj_attr->name, TRUE) !=
+	    STATUS_SUCCESS)
+		EXIT2(return STATUS_INSUFFICIENT_RESOURCES);
+
+	file_basename = strrchr(ansi.buf, '\\');
+	if (file_basename)
+		file_basename++;
+	else
+		file_basename = ansi.buf;
+	TRACE2("file: '%s', '%s'", ansi.buf, file_basename);
+
+	fo = allocate_object(sizeof(struct file_object), OBJECT_TYPE_FILE,
+			     obj_attr->name);
+	if (!fo) {
+		RtlFreeAnsiString(&ansi);
+		iosb->status = STATUS_INSUFFICIENT_RESOURCES;
+		iosb->info = 0;
+		EXIT2(return STATUS_FAILURE);
+	}
+	coh = OBJECT_TO_HEADER(fo);
+	bin_file = get_bin_file(file_basename);
+	if (bin_file) {
+		TRACE2("%s, %s", bin_file->name, file_basename);
+		fo->flags = FILE_OPENED;
+	} else if (access_mask & FILE_WRITE_DATA) {
+		bin_file = kzalloc(sizeof(*bin_file), GFP_KERNEL);
+		if (bin_file) {
+			strncpy(bin_file->name, file_basename,
+				sizeof(bin_file->name));
+			bin_file->name[sizeof(bin_file->name)-1] = 0;
+			bin_file->data = vmalloc(*size);
+			if (bin_file->data) {
+				memset(bin_file->data, 0, *size);
+				bin_file->size = *size;
+				fo->flags = FILE_CREATED;
+			} else {
+				kfree(bin_file);
+				bin_file = NULL;
+			}
+		}
+	} else
+		bin_file = NULL;
+
+	RtlFreeAnsiString(&ansi);
+	if (!bin_file) {
+		iosb->status = FILE_DOES_NOT_EXIST;
+		iosb->info = 0;
+		free_object(fo);
+		EXIT2(return STATUS_FAILURE);
+	}
+
+	fo->wrap_bin_file = bin_file;
+	fo->current_byte_offset = 0;
+	if (access_mask & FILE_READ_DATA)
+		fo->read_access = TRUE;
+	if (access_mask & FILE_WRITE_DATA)
+		fo->write_access = TRUE;
+	iosb->status = FILE_OPENED;
+	iosb->info = bin_file->size;
+	*handle = coh;
+	TRACE2("handle: %p", *handle);
+	status = STATUS_SUCCESS;
+	EXIT2(return status);
+}
+
+wstdcall NTSTATUS WIN_FUNC(ZwOpenFile,6)
+	(void **handle, ACCESS_MASK access_mask,
+	 struct object_attributes *obj_attr, struct io_status_block *iosb,
+	 ULONG share_access, ULONG open_options)
+{
+	LARGE_INTEGER size;
+	return ZwCreateFile(handle, access_mask, obj_attr, iosb, &size, 0,
+			    share_access, 0, open_options, NULL, 0);
+}
+
+wstdcall NTSTATUS WIN_FUNC(ZwReadFile,9)
+	(void *handle, struct nt_event *event, void *apc_routine,
+	 void *apc_context, struct io_status_block *iosb, void *buffer,
+	 ULONG length, LARGE_INTEGER *byte_offset, ULONG *key)
+{
+	struct file_object *fo;
+	struct common_object_header *coh;
+	ULONG count;
+	size_t offset;
+	struct wrap_bin_file *file;
+
+	TRACE2("%p", handle);
+	coh = handle;
+	if (coh->type != OBJECT_TYPE_FILE) {
+		ERROR("handle %p is invalid: %d", handle, coh->type);
+		EXIT2(return STATUS_FAILURE);
+	}
+	fo = HANDLE_TO_OBJECT(coh);
+	file = fo->wrap_bin_file;
+	TRACE2("file: %s (%zu)", file->name, file->size);
+	spin_lock_bh(&ntoskernel_lock);
+	if (byte_offset)
+		offset = *byte_offset;
+	else
+		offset = fo->current_byte_offset;
+	count = min((size_t)length, file->size - offset);
+	TRACE2("count: %u, offset: %zu, length: %u", count, offset, length);
+	memcpy(buffer, ((void *)file->data) + offset, count);
+	fo->current_byte_offset = offset + count;
+	spin_unlock_bh(&ntoskernel_lock);
+	iosb->status = STATUS_SUCCESS;
+	iosb->info = count;
+	EXIT2(return STATUS_SUCCESS);
+}
+
+wstdcall NTSTATUS WIN_FUNC(ZwWriteFile,9)
+	(void *handle, struct nt_event *event, void *apc_routine,
+	 void *apc_context, struct io_status_block *iosb, void *buffer,
+	 ULONG length, LARGE_INTEGER *byte_offset, ULONG *key)
+{
+	struct file_object *fo;
+	struct common_object_header *coh;
+	struct wrap_bin_file *file;
+	unsigned long offset;
+
+	TRACE2("%p", handle);
+	coh = handle;
+	if (coh->type != OBJECT_TYPE_FILE) {
+		ERROR("handle %p is invalid: %d", handle, coh->type);
+		EXIT2(return STATUS_FAILURE);
+	}
+	fo = HANDLE_TO_OBJECT(coh);
+	file = fo->wrap_bin_file;
+	TRACE2("file: %zu, %u", file->size, length);
+	spin_lock_bh(&ntoskernel_lock);
+	if (byte_offset)
+		offset = *byte_offset;
+	else
+		offset = fo->current_byte_offset;
+	if (length + offset > file->size) {
+		WARNING("%lu, %u", length + offset, (unsigned int)file->size);
+		/* TODO: implement writing past end of current size */
+		iosb->status = STATUS_FAILURE;
+		iosb->info = 0;
+	} else {
+		memcpy(file->data + offset, buffer, length);
+		iosb->status = STATUS_SUCCESS;
+		iosb->info = length;
+		fo->current_byte_offset = offset + length;
+	}
+	spin_unlock_bh(&ntoskernel_lock);
+	EXIT2(return iosb->status);
+}
+
+wstdcall NTSTATUS WIN_FUNC(ZwClose,1)
+	(void *handle)
+{
+	struct common_object_header *coh;
+
+	TRACE2("%p", handle);
+	if (handle == NULL) {
+		TRACE1("");
+		EXIT2(return STATUS_SUCCESS);
+	}
+	coh = handle;
+	if (coh->type == OBJECT_TYPE_FILE) {
+		struct file_object *fo;
+		struct wrap_bin_file *bin_file;
+		typeof(fo->flags) flags;
+
+		fo = HANDLE_TO_OBJECT(handle);
+		flags = fo->flags;
+		bin_file = fo->wrap_bin_file;
+		if (dereference_object(fo)) {
+			if (flags == FILE_CREATED) {
+				vfree(bin_file->data);
+				kfree(bin_file);
+			} else
+				free_bin_file(bin_file);
+		}
+	} else if (coh->type == OBJECT_TYPE_NT_THREAD) {
+		struct nt_thread *thread = HANDLE_TO_OBJECT(handle);
+		TRACE2("thread: %p (%p)", thread, handle);
+		ObDereferenceObject(thread);
+	} else {
+		/* TODO: can we just dereference object here? */
+		WARNING("closing handle 0x%x not implemented", coh->type);
+	}
+	EXIT2(return STATUS_SUCCESS);
+}
+
+wstdcall NTSTATUS WIN_FUNC(ZwQueryInformationFile,5)
+	(void *handle, struct io_status_block *iosb, void *info,
+	 ULONG length, enum file_info_class class)
+{
+	struct file_object *fo;
+	struct file_name_info *fni;
+	struct file_std_info *fsi;
+	struct wrap_bin_file *file;
+	struct common_object_header *coh;
+
+	ENTER2("%p", handle);
+	coh = handle;
+	if (coh->type != OBJECT_TYPE_FILE) {
+		ERROR("handle %p is invalid: %d", coh, coh->type);
+		EXIT2(return STATUS_FAILURE);
+	}
+	fo = HANDLE_TO_OBJECT(handle);
+	TRACE2("fo: %p, %d", fo, class);
+	switch (class) {
+	case FileNameInformation:
+		fni = info;
+		fni->length = min(length, (typeof(length))coh->name.length);
+		memcpy(fni->name, coh->name.buf, fni->length);
+		iosb->status = STATUS_SUCCESS;
+		iosb->info = fni->length;
+		break;
+	case FileStandardInformation:
+		fsi = info;
+		file = fo->wrap_bin_file;
+		fsi->alloc_size = file->size;
+		fsi->eof = file->size;
+		fsi->num_links = 1;
+		fsi->delete_pending = FALSE;
+		fsi->dir = FALSE;
+		iosb->status = STATUS_SUCCESS;
+		iosb->info = 0;
+		break;
+	default:
+		WARNING("type %d not implemented yet", class);
+		iosb->status = STATUS_FAILURE;
+		iosb->info = 0;
+		break;
+	}
+	EXIT2(return iosb->status);
+}
+
+wstdcall NTSTATUS WIN_FUNC(ZwOpenSection,3)
+	(void **handle, ACCESS_MASK access, struct object_attributes *obj_attrs)
+{
+	INFO("%p, 0x%x, %d", obj_attrs, obj_attrs->attributes, access);
+	TODO();
+	*handle = obj_attrs;
+	return STATUS_SUCCESS;
+}
+
+wstdcall NTSTATUS WIN_FUNC(ZwMapViewOfSection,10)
+	(void *secn_handle, void *process_handle, void **base_address,
+	 ULONG zero_bits, LARGE_INTEGER *secn_offset, SIZE_T *view_size,
+	 enum section_inherit inherit, ULONG alloc_type, ULONG protect)
+{
+	INFO("%p, %p, %p", secn_handle, process_handle, base_address);
+	TODO();
+	*base_address = (void *)0xdeadbeef;
+	return STATUS_SUCCESS;
+}
+
+wstdcall NTSTATUS WIN_FUNC(ZwUnmapViewOfSection,2)
+	(void *process_handle, void *base_address)
+{
+	INFO("%p, %p", process_handle, base_address);
+	TODO();
+	return STATUS_SUCCESS;
+}
+
+wstdcall NTSTATUS WIN_FUNC(ZwCreateKey,7)
+	(void **handle, ACCESS_MASK desired_access,
+	 struct object_attributes *attr, ULONG title_index,
+	 struct unicode_string *class, ULONG create_options,
+	 ULONG *disposition)
+{
+	struct ansi_string ansi;
+	if (RtlUnicodeStringToAnsiString(&ansi, attr->name, TRUE) ==
+	    STATUS_SUCCESS) {
+		TRACE1("key: %s", ansi.buf);
+		RtlFreeAnsiString(&ansi);
+	}
+	*handle = NULL;
+	return STATUS_SUCCESS;
+}
+
+wstdcall NTSTATUS WIN_FUNC(ZwOpenKey,3)
+	(void **handle, ACCESS_MASK desired_access,
+	 struct object_attributes *attr)
+{
+	struct ansi_string ansi;
+	if (RtlUnicodeStringToAnsiString(&ansi, attr->name, TRUE) ==
+	    STATUS_SUCCESS) {
+		TRACE1("key: %s", ansi.buf);
+		RtlFreeAnsiString(&ansi);
+	}
+	*handle = NULL;
+	return STATUS_SUCCESS;
+}
+
+wstdcall NTSTATUS WIN_FUNC(ZwSetValueKey,6)
+	(void *handle, struct unicode_string *name, ULONG title_index,
+	 ULONG type, void *data, ULONG data_size)
+{
+	struct ansi_string ansi;
+	if (RtlUnicodeStringToAnsiString(&ansi, name, TRUE) ==
+	    STATUS_SUCCESS) {
+		TRACE1("key: %s", ansi.buf);
+		RtlFreeAnsiString(&ansi);
+	}
+	return STATUS_SUCCESS;
+}
+
+wstdcall NTSTATUS WIN_FUNC(ZwQueryValueKey,6)
+	(void *handle, struct unicode_string *name,
+	 enum key_value_information_class class, void *info,
+	 ULONG length, ULONG *res_length)
+{
+	struct ansi_string ansi;
+	if (RtlUnicodeStringToAnsiString(&ansi, name, TRUE) == STATUS_SUCCESS) {
+		TRACE1("key: %s", ansi.buf);
+		RtlFreeAnsiString(&ansi);
+	}
+	TODO();
+	return STATUS_INVALID_PARAMETER;
+}
+
+wstdcall NTSTATUS WIN_FUNC(ZwDeleteKey,1)
+	(void *handle)
+{
+	ENTER2("%p", handle);
+	return STATUS_SUCCESS;
+}
+
+wstdcall NTSTATUS WIN_FUNC(ZwPowerInformation,4)
+	(INT info_level, void *in_buf, ULONG in_buf_len, void *out_buf,
+	 ULONG out_buf_len)
+{
+	INFO("%d, %u, %u", info_level, in_buf_len, out_buf_len);
+	TODO();
+	return STATUS_ACCESS_DENIED;
+}
+
+wstdcall NTSTATUS WIN_FUNC(WmiSystemControl,4)
+	(struct wmilib_context *info, struct device_object *dev_obj,
+	 struct irp *irp, void *irp_disposition)
+{
+	TODO();
+	return STATUS_SUCCESS;
+}
+
+wstdcall NTSTATUS WIN_FUNC(WmiCompleteRequest,5)
+	(struct device_object *dev_obj, struct irp *irp, NTSTATUS status,
+	 ULONG buffer_used, CCHAR priority_boost)
+{
+	TODO();
+	return STATUS_SUCCESS;
+}
+
+noregparm NTSTATUS WIN_FUNC(WmiTraceMessage,12)
+	(void *tracehandle, ULONG message_flags,
+	 void *message_guid, USHORT message_no, ...)
+{
+	TODO();
+	EXIT2(return STATUS_SUCCESS);
+}
+
+wstdcall NTSTATUS WIN_FUNC(WmiQueryTraceInformation,4)
+	(enum trace_information_class trace_info_class, void *trace_info,
+	 ULONG *req_length, void *buf)
+{
+	TODO();
+	EXIT2(return STATUS_SUCCESS);
+}
+
+/* this function can't be wstdcall as it takes variable number of args */
+noregparm ULONG WIN_FUNC(DbgPrint,12)
+	(char *format, ...)
+{
+#ifdef DEBUG
+	va_list args;
+	static char buf[100];
+
+	va_start(args, format);
+	vsnprintf(buf, sizeof(buf), format, args);
+	printk(KERN_DEBUG "%s (%s): %s", DRIVER_NAME, __func__, buf);
+	va_end(args);
+#endif
+	return STATUS_SUCCESS;
+}
+
+wstdcall void WIN_FUNC(KeBugCheck,1)
+	(ULONG code)
+{
+	TODO();
+	return;
+}
+
+wstdcall void WIN_FUNC(KeBugCheckEx,5)
+	(ULONG code, ULONG_PTR param1, ULONG_PTR param2,
+	 ULONG_PTR param3, ULONG_PTR param4)
+{
+	TODO();
+	return;
+}
+
+wstdcall void WIN_FUNC(ExSystemTimeToLocalTime,2)
+	(LARGE_INTEGER *system_time, LARGE_INTEGER *local_time)
+{
+	*local_time = *system_time;
+}
+
+wstdcall ULONG WIN_FUNC(ExSetTimerResolution,2)
+	(ULONG time, BOOLEAN set)
+{
+	/* why a driver should change system wide timer resolution is
+	 * beyond me */
+	return time;
+}
+
+wstdcall void WIN_FUNC(DbgBreakPoint,0)
+	(void)
+{
+	TODO();
+}
+
+wstdcall void WIN_FUNC(_except_handler3,0)
+	(void)
+{
+	TODO();
+}
+
+wstdcall void WIN_FUNC(__C_specific_handler,0)
+	(void)
+{
+	TODO();
+}
+
+wstdcall void WIN_FUNC(_purecall,0)
+	(void)
+{
+	TODO();
+}
+
+wstdcall void WIN_FUNC(__chkstk,0)
+	(void)
+{
+	TODO();
+}
+
+struct worker_init_struct {
+	work_struct_t work;
+	struct completion completion;
+	struct nt_thread *nt_thread;
+};
+
+static void wrap_worker_init_func(worker_param_t param)
+{
+	struct worker_init_struct *worker_init_struct;
+
+	worker_init_struct =
+		worker_param_data(param, struct worker_init_struct, work);
+	TRACE1("%p", worker_init_struct);
+	worker_init_struct->nt_thread = create_nt_thread(current);
+	if (!worker_init_struct->nt_thread)
+		WARNING("couldn't create worker thread");
+	complete(&worker_init_struct->completion);
+}
+
+struct nt_thread *wrap_worker_init(workqueue_struct_t *wq)
+{
+	struct worker_init_struct worker_init_struct;
+
+	TRACE1("%p", &worker_init_struct);
+	init_completion(&worker_init_struct.completion);
+	initialize_work(&worker_init_struct.work, wrap_worker_init_func,
+			&worker_init_struct);
+	worker_init_struct.nt_thread = NULL;
+	if (wq)
+		queue_work(wq, &worker_init_struct.work);
+	else
+		schedule_work(&worker_init_struct.work);
+	wait_for_completion(&worker_init_struct.completion);
+	TRACE1("%p", worker_init_struct.nt_thread);
+	return worker_init_struct.nt_thread;
+}
+
+int ntoskernel_init(void)
+{
+	struct timeval now;
+
+	spin_lock_init(&dispatcher_lock);
+	spin_lock_init(&ntoskernel_lock);
+	spin_lock_init(&ntos_work_lock);
+	spin_lock_init(&kdpc_list_lock);
+	spin_lock_init(&irp_cancel_lock);
+	InitializeListHead(&wrap_mdl_list);
+	InitializeListHead(&kdpc_list);
+	InitializeListHead(&callback_objects);
+	InitializeListHead(&bus_driver_list);
+	InitializeListHead(&object_list);
+	InitializeListHead(&ntos_work_list);
+
+	nt_spin_lock_init(&nt_list_lock);
+
+	initialize_work(&kdpc_work, kdpc_worker, NULL);
+	initialize_work(&ntos_work, ntos_work_worker, NULL);
+	wrap_timer_slist.next = NULL;
+
+	do_gettimeofday(&now);
+	wrap_ticks_to_boot = TICKS_1601_TO_1970;
+	wrap_ticks_to_boot += (u64)now.tv_sec * TICKSPERSEC;
+	wrap_ticks_to_boot += now.tv_usec * 10;
+	wrap_ticks_to_boot -= jiffies * TICKSPERJIFFY;
+	TRACE2("%Lu", wrap_ticks_to_boot);
+
+#ifdef WRAP_PREEMPT
+	do {
+		int cpu;
+		for_each_possible_cpu(cpu) {
+			irql_info_t *info;
+			info = &per_cpu(irql_info, cpu);
+			mutex_init(&(info->lock));
+			info->task = NULL;
+			info->count = 0;
+		}
+	} while (0);
+#endif
+
+	ntos_wq = create_singlethread_workqueue("ntos_wq");
+	if (!ntos_wq) {
+		WARNING("couldn't create ntos_wq thread");
+		return -ENOMEM;
+	}
+	ntos_worker_thread = wrap_worker_init(ntos_wq);
+	TRACE1("%p", ntos_worker_thread);
+
+	if (add_bus_driver("PCI")
+#ifdef ENABLE_USB
+	    || add_bus_driver("USB")
+#endif
+		) {
+		ntoskernel_exit();
+		return -ENOMEM;
+	}
+	mdl_cache =
+		wrap_kmem_cache_create("wrap_mdl",
+				       sizeof(struct wrap_mdl) + MDL_CACHE_SIZE,
+				       0, 0);
+	TRACE2("%p", mdl_cache);
+	if (!mdl_cache) {
+		ERROR("couldn't allocate MDL cache");
+		ntoskernel_exit();
+		return -ENOMEM;
+	}
+
+#if defined(CONFIG_X86_64)
+	memset(&kuser_shared_data, 0, sizeof(kuser_shared_data));
+	*((ULONG64 *)&kuser_shared_data.system_time) = ticks_1601();
+	init_timer(&shared_data_timer);
+	shared_data_timer.function = update_user_shared_data_proc;
+	shared_data_timer.data = (unsigned long)0;
+#endif
+	return 0;
+}
+
+int ntoskernel_init_device(struct wrap_device *wd)
+{
+#if defined(CONFIG_X86_64)
+	if (kuser_shared_data.reserved1)
+		mod_timer(&shared_data_timer, jiffies + MSEC_TO_HZ(30));
+#endif
+	return 0;
+}
+
+void ntoskernel_exit_device(struct wrap_device *wd)
+{
+	ENTER2("");
+
+	KeFlushQueuedDpcs();
+	EXIT2(return);
+}
+
+void ntoskernel_exit(void)
+{
+	struct nt_list *cur;
+
+	ENTER2("");
+
+	/* free kernel (Ke) timers */
+	TRACE2("freeing timers");
+	while (1) {
+		struct wrap_timer *wrap_timer;
+		struct nt_slist *slist;
+
+		spin_lock_bh(&ntoskernel_lock);
+		if ((slist = wrap_timer_slist.next))
+			wrap_timer_slist.next = slist->next;
+		spin_unlock_bh(&ntoskernel_lock);
+		TIMERTRACE("%p", slist);
+		if (!slist)
+			break;
+		wrap_timer = container_of(slist, struct wrap_timer, slist);
+		if (del_timer_sync(&wrap_timer->timer))
+			WARNING("Buggy Windows driver left timer %p running",
+				wrap_timer->nt_timer);
+		memset(wrap_timer, 0, sizeof(*wrap_timer));
+		slack_kfree(wrap_timer);
+	}
+
+	TRACE2("freeing MDLs");
+	if (mdl_cache) {
+		spin_lock_bh(&ntoskernel_lock);
+		if (!IsListEmpty(&wrap_mdl_list))
+			ERROR("Windows driver didn't free all MDLs; "
+			      "freeing them now");
+		while ((cur = RemoveHeadList(&wrap_mdl_list))) {
+			struct wrap_mdl *wrap_mdl;
+			wrap_mdl = container_of(cur, struct wrap_mdl, list);
+			if (wrap_mdl->mdl->flags & MDL_CACHE_ALLOCATED)
+				kmem_cache_free(mdl_cache, wrap_mdl);
+			else
+				kfree(wrap_mdl);
+		}
+		spin_unlock_bh(&ntoskernel_lock);
+		kmem_cache_destroy(mdl_cache);
+		mdl_cache = NULL;
+	}
+
+	TRACE2("freeing callbacks");
+	spin_lock_bh(&ntoskernel_lock);
+	while ((cur = RemoveHeadList(&callback_objects))) {
+		struct callback_object *object;
+		struct nt_list *ent;
+		object = container_of(cur, struct callback_object, list);
+		while ((ent = RemoveHeadList(&object->callback_funcs))) {
+			struct callback_func *f;
+			f = container_of(ent, struct callback_func, list);
+			kfree(f);
+		}
+		kfree(object);
+	}
+	spin_unlock_bh(&ntoskernel_lock);
+
+	spin_lock_bh(&ntoskernel_lock);
+	while ((cur = RemoveHeadList(&bus_driver_list))) {
+		struct bus_driver *bus_driver;
+		bus_driver = container_of(cur, struct bus_driver, list);
+		/* TODO: make sure all all drivers are shutdown/removed */
+		kfree(bus_driver);
+	}
+	spin_unlock_bh(&ntoskernel_lock);
+
+#if defined(CONFIG_X86_64)
+	del_timer_sync(&shared_data_timer);
+#endif
+	if (ntos_wq)
+		destroy_workqueue(ntos_wq);
+	TRACE1("%p", ntos_worker_thread);
+	if (ntos_worker_thread)
+		ObDereferenceObject(ntos_worker_thread);
+	ENTER2("freeing objects");
+	spin_lock_bh(&ntoskernel_lock);
+	while ((cur = RemoveHeadList(&object_list))) {
+		struct common_object_header *hdr;
+		hdr = container_of(cur, struct common_object_header, list);
+		if (hdr->type == OBJECT_TYPE_NT_THREAD)
+			TRACE1("object %p(%d) was not freed, freeing it now",
+			       HEADER_TO_OBJECT(hdr), hdr->type);
+		else
+			WARNING("object %p(%d) was not freed, freeing it now",
+				HEADER_TO_OBJECT(hdr), hdr->type);
+		ExFreePool(hdr);
+	}
+	spin_unlock_bh(&ntoskernel_lock);
+
+	EXIT2(return);
+}
--- linux-rt-2.6.31.orig/ubuntu/ndiswrapper/wrapper.h
+++ linux-rt-2.6.31/ubuntu/ndiswrapper/wrapper.h
@@ -0,0 +1,24 @@
+/*
+ *  Copyright (C) 2003-2005 Pontus Fuchs, Giridhar Pemmasani
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ *  GNU General Public License for more details.
+ *
+ */
+
+#ifndef WRAPPER_H
+#define WRAPPER_H
+
+extern char *if_name;
+extern int proc_uid;
+extern int proc_gid;
+extern int hangcheck_interval;
+
+#endif /* WRAPPER_H */
--- linux-rt-2.6.31.orig/ubuntu/ndiswrapper/ntoskernel.h
+++ linux-rt-2.6.31/ubuntu/ndiswrapper/ntoskernel.h
@@ -0,0 +1,1157 @@
+/*
+ *  Copyright (C) 2003-2005 Pontus Fuchs, Giridhar Pemmasani
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ *  GNU General Public License for more details.
+ *
+ */
+
+#ifndef _NTOSKERNEL_H_
+#define _NTOSKERNEL_H_
+
+#include <linux/types.h>
+#include <linux/timer.h>
+#include <linux/time.h>
+#include <linux/module.h>
+#include <linux/kmod.h>
+
+#include <linux/netdevice.h>
+#include <linux/wireless.h>
+#include <linux/pci.h>
+#include <linux/wait.h>
+#include <linux/pm.h>
+#include <linux/delay.h>
+#include <linux/mm.h>
+#include <linux/random.h>
+#include <linux/ctype.h>
+#include <linux/list.h>
+#include <linux/sched.h>
+#include <linux/usb.h>
+#include <linux/spinlock.h>
+#include <asm/mman.h>
+#include <linux/version.h>
+#include <linux/etherdevice.h>
+#include <net/iw_handler.h>
+#include <linux/ethtool.h>
+#include <linux/if_arp.h>
+#include <linux/rtnetlink.h>
+#include <linux/highmem.h>
+#include <linux/percpu.h>
+#include <linux/kthread.h>
+#include <linux/workqueue.h>
+
+#if !defined(CONFIG_X86) && !defined(CONFIG_X86_64)
+#error "this module is for x86 or x86_64 architectures only"
+#endif
+
+/* Interrupt backwards compatibility stuff */
+#include <linux/interrupt.h>
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,29)
+#ifndef IRQ_HANDLED
+#define IRQ_HANDLED
+#define IRQ_NONE
+#define irqreturn_t void
+#endif
+#endif /* Linux < 2.6.29 */
+
+/* pci functions in 2.6 kernels have problems allocating dma buffers,
+ * but seem to work fine with dma functions
+ */
+#include <asm/dma-mapping.h>
+
+#define PCI_DMA_ALLOC_COHERENT(pci_dev,size,dma_handle)			\
+	dma_alloc_coherent(&pci_dev->dev,size,dma_handle,		\
+			   GFP_KERNEL | __GFP_REPEAT)
+#define PCI_DMA_FREE_COHERENT(pci_dev,size,cpu_addr,dma_handle)		\
+	dma_free_coherent(&pci_dev->dev,size,cpu_addr,dma_handle)
+#define PCI_DMA_MAP_SINGLE(pci_dev,addr,size,direction)		\
+	dma_map_single(&pci_dev->dev,addr,size,direction)
+#define PCI_DMA_UNMAP_SINGLE(pci_dev,dma_handle,size,direction)		\
+	dma_unmap_single(&pci_dev->dev,dma_handle,size,direction)
+#define MAP_SG(pci_dev, sglist, nents, direction)		\
+	dma_map_sg(&pci_dev->dev, sglist, nents, direction)
+#define UNMAP_SG(pci_dev, sglist, nents, direction)		\
+	dma_unmap_sg(&pci_dev->dev, sglist, nents, direction)
+#define PCI_DMA_MAP_ERROR(dma_addr) dma_mapping_error(dma_addr)
+
+
+#if defined(CONFIG_NET_RADIO) && !defined(CONFIG_WIRELESS_EXT)
+#define CONFIG_WIRELESS_EXT
+#endif
+
+#define prepare_wait_condition(task, var, value)	\
+do {							\
+	var = value;					\
+	task = current;					\
+	barrier();					\
+} while (0)
+
+/* Wait in wait_state (e.g., TASK_INTERRUPTIBLE) for condition to
+ * become true; timeout is either jiffies (> 0) to wait or 0 to wait
+ * forever.
+ * When timeout == 0, return value is
+ *    > 0 if condition becomes true, or
+ *    < 0 if signal is pending on the thread.
+ * When timeout > 0, return value is
+ *    > 0 if condition becomes true before timeout,
+ *    < 0 if signal is pending on the thread before timeout, or
+ *    0 if timedout (condition may have become true at the same time)
+ */
+
+#define wait_condition(condition, timeout, wait_state)		\
+({								\
+	long ret = timeout ? timeout : 1;			\
+	while (1) {						\
+		if (signal_pending(current)) {			\
+			ret = -ERESTARTSYS;			\
+			break;					\
+		}						\
+		set_current_state(wait_state);			\
+		if (condition) {				\
+			__set_current_state(TASK_RUNNING);	\
+			break;					\
+		}						\
+		if (timeout) {					\
+			ret = schedule_timeout(ret);		\
+			if (!ret)				\
+				break;				\
+		} else						\
+			schedule();				\
+	}							\
+	ret;							\
+})
+
+#ifdef WRAP_WQ
+
+struct workqueue_struct;
+
+struct workqueue_thread {
+	spinlock_t lock;
+	struct task_struct *task;
+	struct completion *completion;
+	char name[16];
+	int pid;
+	/* whether any work_structs pending? <0 implies quit */
+	s8 pending;
+	/* list of work_structs pending */
+	struct list_head work_list;
+};
+
+typedef struct workqueue_struct {
+	u8 singlethread;
+	u8 qon;
+	int num_cpus;
+	struct workqueue_thread threads[0];
+} workqueue_struct_t;
+
+typedef struct {
+	struct list_head list;
+	void (*func)(void *data);
+	void *data;
+	/* whether/on which thread scheduled */
+	struct workqueue_thread *thread;
+} work_struct_t;
+
+#define initialize_work(work, pfunc, pdata)			\
+	do {							\
+		(work)->func = (pfunc);				\
+		(work)->data = (pdata);				\
+		(work)->thread = NULL;				\
+	} while (0)
+
+#undef create_singlethread_workqueue
+#define create_singlethread_workqueue(name) wrap_create_wq(name, 1, 0)
+#undef create_workqueue
+#define create_workqueue(name) wrap_create_wq(name, 0, 0)
+#undef destroy_workqueue
+#define destroy_workqueue wrap_destroy_wq
+#undef queue_work
+#define queue_work wrap_queue_work
+#undef flush_workqueue
+#define flush_workqueue wrap_flush_wq
+
+workqueue_struct_t *wrap_create_wq(const char *name, u8 singlethread, u8 freeze);
+void wrap_destroy_wq_on(workqueue_struct_t *workq, int cpu);
+void wrap_destroy_wq(workqueue_struct_t *workq);
+int wrap_queue_work_on(workqueue_struct_t *workq, work_struct_t *work,
+		       int cpu);
+int wrap_queue_work(workqueue_struct_t *workq, work_struct_t *work);
+void wrap_cancel_work(work_struct_t *work);
+void wrap_flush_wq_on(workqueue_struct_t *workq, int cpu);
+void wrap_flush_wq(workqueue_struct_t *workq);
+typedef void *worker_param_t;
+#define worker_param_data(param, type, member) param
+
+#else // WRAP_WQ
+
+typedef struct workqueue_struct workqueue_struct_t;
+typedef struct work_struct work_struct_t;
+
+#if defined(INIT_WORK_NAR) || defined(INIT_DELAYED_WORK_DEFERRABLE)
+#define initialize_work(work, func, data) INIT_WORK(work, func)
+typedef struct work_struct *worker_param_t;
+#define worker_param_data(param, type, member)	\
+	container_of(param, type, member)
+#else
+#define initialize_work(work, func, data) INIT_WORK(work, func, data)
+typedef void *worker_param_t;
+#define worker_param_data(param, type, member) param
+#endif // INIT_WORK_NAR
+
+#endif // WRAP_WQ
+
+struct nt_thread *wrap_worker_init(workqueue_struct_t *wq);
+
+#ifdef module_param
+#define WRAP_MODULE_PARM_INT(name, perm) module_param(name, int, perm)
+#define WRAP_MODULE_PARM_STRING(name, perm) module_param(name, charp, perm)
+#else
+#define WRAP_MODULE_PARM_INT(name, perm) MODULE_PARM(name, "i")
+#define WRAP_MODULE_PARM_STRING(name, perm) MODULE_PARM(name, "s")
+#endif
+
+#ifndef LOCK_PREFIX
+#ifdef LOCK
+#define LOCK_PREFIX LOCK
+#else
+#ifdef CONFIG_SMP
+#define LOCK_PREFIX "lock ; "
+#else
+#define LOCK_PREFIX ""
+#endif
+#endif
+#endif
+
+#ifndef NETDEV_TX_OK
+#define NETDEV_TX_OK 0
+#endif
+
+#ifndef NETDEV_TX_BUSY
+#define NETDEV_TX_BUSY 1
+#endif
+
+#ifndef CHECKSUM_HW
+#define CHECKSUM_HW CHECKSUM_PARTIAL
+#endif
+
+#ifndef offset_in_page
+#define offset_in_page(p) ((unsigned long)(p) & ~PAGE_MASK)
+#endif
+
+#ifndef PMSG_SUSPEND
+#ifdef PM_SUSPEND
+/* this is not correct - the value of PM_SUSPEND is different from
+ * PMSG_SUSPEND, but ndiswrapper doesn't care about the value when
+ * suspending */
+#define PMSG_SUSPEND PM_SUSPEND
+#define PSMG_ON PM_ON
+#else
+typedef u32 pm_message_t;
+#define PMSG_SUSPEND 2
+#define PMSG_ON 0
+#endif
+#endif
+
+#ifndef PCI_D0
+#define PCI_D0 0
+#endif
+
+#ifndef PCI_D3hot
+#define PCI_D3hot 3
+#endif
+
+#ifndef PCI_D3cold
+#define PCI_D3cold 3
+#endif
+
+#ifndef PM_EVENT_SUSPEND
+#define PM_EVENT_SUSPEND 2
+#endif
+
+#if !defined(HAVE_NETDEV_PRIV)
+#define netdev_priv(dev)  ((dev)->priv)
+#endif
+
+#if LINUX_VERSION_CODE > KERNEL_VERSION(2,6,18)
+#define ISR_PT_REGS_PARAM_DECL
+#define ISR_PT_REGS_ARG
+#else
+#define ISR_PT_REGS_PARAM_DECL , struct pt_regs *regs
+#define ISR_PT_REGS_ARG , NULL
+#endif
+
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,16)
+#define for_each_possible_cpu(_cpu) for_each_cpu(_cpu)
+#endif
+
+#ifndef flush_icache_range
+#define flush_icache_range(start, end) do { } while (0)
+#endif
+
+#ifndef CHECKSUM_PARTIAL
+#define CHECKSUM_PARTIAL CHECKSUM_HW
+#endif
+
+#ifndef IRQF_SHARED
+#define IRQF_SHARED SA_SHIRQ
+#endif
+
+#define memcpy_skb(skb, from, length)			\
+	memcpy(skb_put(skb, length), from, length)
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,24)
+#ifndef DMA_BIT_MASK
+#define DMA_BIT_MASK(n)	(((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))
+#endif
+#endif
+
+#ifndef __GFP_DMA32
+#define __GFP_DMA32 GFP_DMA
+#endif
+
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,22)
+#define wrap_kmem_cache_create(name, size, align, flags)	\
+	kmem_cache_create(name, size, align, flags, NULL, NULL)
+#else
+#define wrap_kmem_cache_create(name, size, align, flags)	\
+	kmem_cache_create(name, size, align, flags, NULL)
+#endif
+
+#include "winnt_types.h"
+#include "ndiswrapper.h"
+#include "pe_linker.h"
+#include "wrapmem.h"
+#include "lin2win.h"
+#include "loader.h"
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,18)
+static inline void netif_tx_lock(struct net_device *dev)
+{
+	spin_lock(&dev->xmit_lock);
+}
+static inline void netif_tx_unlock(struct net_device *dev)
+{
+	spin_unlock(&dev->xmit_lock);
+}
+static inline void netif_tx_lock_bh(struct net_device *dev)
+{
+	spin_lock_bh(&dev->xmit_lock);
+}
+static inline void netif_tx_unlock_bh(struct net_device *dev)
+{
+	spin_unlock_bh(&dev->xmit_lock);
+}
+#endif
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,24)
+static inline void netif_poll_enable(struct net_device *dev)
+{
+}
+static inline void netif_poll_disable(struct net_device *dev)
+{
+}
+#endif
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,24)
+#define proc_net_root init_net.proc_net
+#else
+#define proc_net_root proc_net
+#endif
+
+/* TICK is 100ns */
+#define TICKSPERSEC		10000000
+#define TICKSPERMSEC		10000
+#define SECSPERDAY		86400
+#define TICKSPERJIFFY		((TICKSPERSEC + HZ - 1) / HZ)
+
+#define int_div_round(x, y) (((x) + (y - 1)) / (y))
+
+/* 1601 to 1970 is 369 years plus 89 leap days */
+#define SECS_1601_TO_1970	((369 * 365 + 89) * (u64)SECSPERDAY)
+#define TICKS_1601_TO_1970	(SECS_1601_TO_1970 * TICKSPERSEC)
+
+/* 100ns units to HZ; if sys_time is negative, relative to current
+ * clock, otherwise from year 1601 */
+#define SYSTEM_TIME_TO_HZ(sys_time)					\
+	(((sys_time) <= 0) ? \
+	 int_div_round(((u64)HZ * (-(sys_time))), TICKSPERSEC) :	\
+	 int_div_round(((s64)HZ * ((sys_time) - ticks_1601())), TICKSPERSEC))
+
+#define MSEC_TO_HZ(ms) int_div_round((ms * HZ), 1000)
+#define USEC_TO_HZ(us) int_div_round((us * HZ), 1000000)
+
+extern u64 wrap_ticks_to_boot;
+
+static inline u64 ticks_1601(void)
+{
+	return wrap_ticks_to_boot + (u64)jiffies * TICKSPERJIFFY;
+}
+
+typedef void (*generic_func)(void);
+
+struct wrap_export {
+	const char *name;
+	generic_func func;
+};
+
+#ifdef CONFIG_X86_64
+
+#define WIN_SYMBOL(name, argc)					\
+	{#name, (generic_func) win2lin_ ## name ## _ ## argc}
+#define WIN_WIN_SYMBOL(name, argc)					\
+	{#name, (generic_func) win2lin__win_ ## name ## _ ## argc}
+#define WIN_FUNC_DECL(name, argc)			\
+	extern typeof(name) win2lin_ ## name ## _ ## argc;
+#define WIN_FUNC_PTR(name, argc) win2lin_ ## name ## _ ## argc
+
+#else
+
+#define WIN_SYMBOL(name, argc) {#name, (generic_func)name}
+#define WIN_WIN_SYMBOL(name, argc) {#name, (generic_func)_win_ ## name}
+#define WIN_FUNC_DECL(name, argc)
+#define WIN_FUNC_PTR(name, argc) name
+
+#endif
+
+#define WIN_FUNC(name, argc) name
+/* map name s to f - if f is different from s */
+#define WIN_SYMBOL_MAP(s, f)
+
+#define POOL_TAG(A, B, C, D)					\
+	((ULONG)((A) + ((B) << 8) + ((C) << 16) + ((D) << 24)))
+
+struct pe_image {
+	char name[MAX_DRIVER_NAME_LEN];
+	UINT (*entry)(struct driver_object *, struct unicode_string *) wstdcall;
+	void *image;
+	int size;
+	int type;
+
+	IMAGE_NT_HEADERS *nt_hdr;
+	IMAGE_OPTIONAL_HEADER *opt_hdr;
+};
+
+struct ndis_mp_block;
+
+struct wrap_timer {
+	struct nt_slist slist;
+	struct timer_list timer;
+	struct nt_timer *nt_timer;
+	long repeat;
+#ifdef TIMER_DEBUG
+	unsigned long wrap_timer_magic;
+#endif
+};
+
+struct ntos_work_item {
+	struct nt_list list;
+	void *arg1;
+	void *arg2;
+	NTOS_WORK_FUNC func;
+};
+
+struct wrap_device_setting {
+	struct nt_list list;
+	char name[MAX_SETTING_NAME_LEN];
+	char value[MAX_SETTING_VALUE_LEN];
+	void *encoded;
+};
+
+struct wrap_bin_file {
+	char name[MAX_DRIVER_NAME_LEN];
+	size_t size;
+	void *data;
+};
+
+#define WRAP_DRIVER_CLIENT_ID 1
+
+struct wrap_driver {
+	struct nt_list list;
+	struct driver_object *drv_obj;
+	char name[MAX_DRIVER_NAME_LEN];
+	char version[MAX_SETTING_VALUE_LEN];
+	unsigned short num_pe_images;
+	struct pe_image pe_images[MAX_DRIVER_PE_IMAGES];
+	unsigned short num_bin_files;
+	struct wrap_bin_file *bin_files;
+	struct nt_list wrap_devices;
+	struct nt_list settings;
+	int dev_type;
+	struct ndis_driver *ndis_driver;
+};
+
+enum hw_status {
+	HW_INITIALIZED = 1, HW_SUSPENDED, HW_HALTED, HW_PRESENT,
+};
+
+struct wrap_device {
+	/* first part is (de)initialized once by loader */
+	struct nt_list list;
+	int dev_bus;
+	int vendor;
+	int device;
+	int subvendor;
+	int subdevice;
+	char conf_file_name[MAX_DRIVER_NAME_LEN];
+	char driver_name[MAX_DRIVER_NAME_LEN];
+	struct wrap_driver *driver;
+	struct nt_list settings;
+
+	/* rest should be (de)initialized when a device is
+	 * (un)plugged */
+	struct cm_resource_list *resource_list;
+	unsigned long hw_status;
+	struct device_object *pdo;
+	union {
+		struct {
+			struct pci_dev *pdev;
+			enum device_power_state wake_state;
+		} pci;
+		struct {
+			struct usb_device *udev;
+			struct usb_interface *intf;
+			int num_alloc_urbs;
+			struct nt_list wrap_urb_list;
+		} usb;
+	};
+	union {
+		struct ndis_device *wnd;
+	};
+};
+
+#define wrap_is_pci_bus(dev_bus)			\
+	(WRAP_BUS(dev_bus) == WRAP_PCI_BUS ||		\
+	 WRAP_BUS(dev_bus) == WRAP_PCMCIA_BUS)
+#ifdef ENABLE_USB
+/* earlier versions of ndiswrapper used 0 as USB_BUS */
+#define wrap_is_usb_bus(dev_bus)			\
+	(WRAP_BUS(dev_bus) == WRAP_USB_BUS ||		\
+	 WRAP_BUS(dev_bus) == WRAP_INTERNAL_BUS)
+#else
+#define wrap_is_usb_bus(dev_bus) 0
+#endif
+#define wrap_is_bluetooth_device(dev_bus)			\
+	(WRAP_DEVICE(dev_bus) == WRAP_BLUETOOTH_DEVICE1 ||	\
+	 WRAP_DEVICE(dev_bus) == WRAP_BLUETOOTH_DEVICE2)
+
+extern workqueue_struct_t *ntos_wq;
+#define schedule_ntos_work(work_struct) queue_work(ntos_wq, work_struct)
+#define schedule_work(work_struct) queue_work(ntos_wq, work_struct)
+
+extern workqueue_struct_t *ndis_wq;
+#define schedule_ndis_work(work_struct) queue_work(ndis_wq, work_struct)
+
+extern workqueue_struct_t *wrapndis_wq;
+#define schedule_wrapndis_work(work_struct) queue_work(wrapndis_wq, work_struct)
+
+#define atomic_unary_op(var, size, oper)				\
+do {									\
+	if (size == 1)							\
+		__asm__ __volatile__(					\
+			LOCK_PREFIX oper "b %b0\n\t" : "+m" (var));	\
+	else if (size == 2)						\
+		__asm__ __volatile__(					\
+			LOCK_PREFIX oper "w %w0\n\t" : "+m" (var));	\
+	else if (size == 4)						\
+		__asm__ __volatile__(					\
+			LOCK_PREFIX oper "l %0\n\t" : "+m" (var));	\
+	else if (size == 8)						\
+		__asm__ __volatile__(					\
+			LOCK_PREFIX oper "q %q0\n\t" : "+m" (var));	\
+	else {								\
+		extern void _invalid_op_size_(void);			\
+		_invalid_op_size_();					\
+	}								\
+} while (0)
+
+#define atomic_inc_var_size(var, size) atomic_unary_op(var, size, "inc")
+
+#define atomic_inc_var(var) atomic_inc_var_size(var, sizeof(var))
+
+#define atomic_dec_var_size(var, size) atomic_unary_op(var, size, "dec")
+
+#define atomic_dec_var(var) atomic_dec_var_size(var, sizeof(var))
+
+#define pre_atomic_add(var, i)					\
+({								\
+	typeof(var) pre;					\
+	__asm__ __volatile__(					\
+		LOCK_PREFIX "xadd %0, %1\n\t"			\
+		: "=r"(pre), "+m"(var)				\
+		: "0"(i));					\
+	pre;							\
+})
+
+#define post_atomic_add(var, i) (pre_atomic_add(var, i) + i)
+
+#ifndef in_atomic
+#define in_atomic() in_interrupt()
+#endif
+
+#ifndef preempt_enable_no_resched
+#define preempt_enable_no_resched() preempt_enable()
+#endif
+
+//#define DEBUG_IRQL 1
+
+#ifdef DEBUG_IRQL
+#define assert_irql(cond)						\
+do {									\
+	KIRQL _irql_ = current_irql();					\
+	if (!(cond)) {							\
+		WARNING("assertion '%s' failed: %d", #cond, _irql_);	\
+		DBG_BLOCK(4) {						\
+			dump_stack();					\
+		}							\
+	}								\
+} while (0)
+#else
+#define assert_irql(cond) do { } while (0)
+#endif
+
+/* When preempt is enabled, we should preempt_disable to raise IRQL to
+ * DISPATCH_LEVEL, to be consistent with the semantics. However, using
+ * a mutex instead, so that only ndiswrapper threads run one at a time
+ * on a processor when at DISPATCH_LEVEL seems to be enough. So that
+ * is what we will use until we learn otherwise. If
+ * preempt_(en|dis)able is required for some reason, comment out
+ * following #define. */
+
+#define WRAP_PREEMPT 1
+
+#if !defined(CONFIG_PREEMPT) || defined(CONFIG_PREEMPT_RT)
+#ifndef WRAP_PREEMPT
+#define WRAP_PREEMPT 1
+#endif
+#endif
+
+//#undef WRAP_PREEMPT
+
+#ifdef WRAP_PREEMPT
+
+typedef struct {
+	int count;
+	struct mutex lock;
+#ifdef CONFIG_SMP
+	typeof(current->cpus_allowed) cpus_allowed;
+#endif
+	struct task_struct *task;
+} irql_info_t;
+
+DECLARE_PER_CPU(irql_info_t, irql_info);
+
+static inline KIRQL raise_irql(KIRQL newirql)
+{
+	irql_info_t *info;
+
+	assert(newirql == DISPATCH_LEVEL);
+	info = &get_cpu_var(irql_info);
+	if (info->task == current) {
+		assert(info->count > 0);
+		assert(mutex_is_locked(&info->lock));
+#if defined(CONFIG_SMP) && defined(DEBUG)
+		do {
+			cpumask_t cpumask;
+			cpumask = cpumask_of_cpu(smp_processor_id());
+			cpus_xor(cpumask, cpumask, current->cpus_allowed);
+			assert(cpus_empty(cpumask));
+		} while (0);
+#endif
+		info->count++;
+		put_cpu_var(irql_info);
+		return DISPATCH_LEVEL;
+	}
+	/* TODO: is this enough to pin down to current cpu? */
+#ifdef CONFIG_SMP
+	assert(task_cpu(current) == smp_processor_id());
+	info->cpus_allowed = current->cpus_allowed;
+	current->cpus_allowed = cpumask_of_cpu(smp_processor_id());
+#endif
+	put_cpu_var(irql_info);
+	mutex_lock(&info->lock);
+	assert(info->count == 0);
+	assert(info->task == NULL);
+	info->count = 1;
+	info->task = current;
+	return PASSIVE_LEVEL;
+}
+
+static inline void lower_irql(KIRQL oldirql)
+{
+	irql_info_t *info;
+
+	assert(oldirql <= DISPATCH_LEVEL);
+	info = &get_cpu_var(irql_info);
+	assert(info->task == current);
+	assert(mutex_is_locked(&info->lock));
+	assert(info->count > 0);
+	if (--info->count == 0) {
+		info->task = NULL;
+#ifdef CONFIG_SMP
+		current->cpus_allowed = info->cpus_allowed;
+#endif
+		mutex_unlock(&info->lock);
+	}
+	put_cpu_var(irql_info);
+}
+
+static inline KIRQL current_irql(void)
+{
+	int count;
+	if (in_irq() || irqs_disabled())
+		EXIT4(return DIRQL);
+	if (in_atomic() || in_interrupt())
+		EXIT4(return SOFT_IRQL);
+	count = get_cpu_var(irql_info).count;
+	put_cpu_var(irql_info);
+	if (count)
+		EXIT6(return DISPATCH_LEVEL);
+	else
+		EXIT6(return PASSIVE_LEVEL);
+}
+
+#else
+
+static inline KIRQL current_irql(void)
+{
+	if (in_irq() || irqs_disabled())
+		EXIT4(return DIRQL);
+	if (in_interrupt())
+		EXIT4(return SOFT_IRQL);
+	if (in_atomic())
+		EXIT6(return DISPATCH_LEVEL);
+	else
+		EXIT6(return PASSIVE_LEVEL);
+}
+
+static inline KIRQL raise_irql(KIRQL newirql)
+{
+	KIRQL ret = in_atomic() ? DISPATCH_LEVEL : PASSIVE_LEVEL;
+	assert(newirql == DISPATCH_LEVEL);
+	assert(current_irql() <= DISPATCH_LEVEL);
+	preempt_disable();
+	return ret;
+}
+
+static inline void lower_irql(KIRQL oldirql)
+{
+	assert(current_irql() == DISPATCH_LEVEL);
+	preempt_enable();
+}
+
+#endif
+
+#define irql_gfp() (in_atomic() ? GFP_ATOMIC : GFP_KERNEL)
+
+/* Windows spinlocks are of type ULONG_PTR which is not big enough to
+ * store Linux spinlocks; so we implement Windows spinlocks using
+ * ULONG_PTR space with our own functions/macros */
+
+/* Windows seems to use 0 for unlocked state of spinlock - if Linux
+ * convention of 1 for unlocked state is used, at least prism54 driver
+ * crashes */
+
+#define NT_SPIN_LOCK_UNLOCKED 0
+#define NT_SPIN_LOCK_LOCKED 1
+
+static inline void  nt_spin_lock_init(NT_SPIN_LOCK *lock)
+{
+	*lock = NT_SPIN_LOCK_UNLOCKED;
+}
+
+#ifdef CONFIG_SMP
+
+static inline void nt_spin_lock(NT_SPIN_LOCK *lock)
+{
+	__asm__ __volatile__(
+		"1:\t"
+		"  xchgl %1, %0\n\t"
+		"  testl %1, %1\n\t"
+		"  jz 3f\n"
+		"2:\t"
+		"  rep; nop\n\t"
+		"  cmpl %2, %0\n\t"
+		"  je 1b\n\t"
+		"  jmp 2b\n"
+		"3:\n\t"
+		: "+m" (*lock)
+		: "r" (NT_SPIN_LOCK_LOCKED), "i" (NT_SPIN_LOCK_UNLOCKED));
+}
+
+static inline void nt_spin_unlock(NT_SPIN_LOCK *lock)
+{
+	*lock = NT_SPIN_LOCK_UNLOCKED;
+}
+
+#else // CONFIG_SMP
+
+#define nt_spin_lock(lock) do { } while (0)
+
+#define nt_spin_unlock(lock)  do { } while (0)
+
+#endif // CONFIG_SMP
+
+/* When kernel would've disabled preempt (e.g., in interrupt
+ * handlers), we need to fake preempt so driver thinks it is running
+ * at right IRQL */
+
+/* raise IRQL to given (higher) IRQL if necessary before locking */
+static inline KIRQL nt_spin_lock_irql(NT_SPIN_LOCK *lock, KIRQL newirql)
+{
+	KIRQL oldirql = raise_irql(newirql);
+	nt_spin_lock(lock);
+	return oldirql;
+}
+
+/* lower IRQL to given (lower) IRQL if necessary after unlocking */
+static inline void nt_spin_unlock_irql(NT_SPIN_LOCK *lock, KIRQL oldirql)
+{
+	nt_spin_unlock(lock);
+	lower_irql(oldirql);
+}
+
+#define nt_spin_lock_irqsave(lock, flags)				\
+do {									\
+	local_irq_save(flags);						\
+	preempt_disable();						\
+	nt_spin_lock(lock);						\
+} while (0)
+
+#define nt_spin_unlock_irqrestore(lock, flags)				\
+do {									\
+	nt_spin_unlock(lock);						\
+	preempt_enable_no_resched();					\
+	local_irq_restore(flags);					\
+	preempt_check_resched();					\
+} while (0)
+
+static inline ULONG SPAN_PAGES(void *ptr, SIZE_T length)
+{
+	return PAGE_ALIGN(((unsigned long)ptr & (PAGE_SIZE - 1)) + length)
+		>> PAGE_SHIFT;
+}
+
+#ifdef CONFIG_X86_64
+
+/* TODO: can these be implemented without using spinlock? */
+
+static inline struct nt_slist *PushEntrySList(nt_slist_header *head,
+					      struct nt_slist *entry,
+					      NT_SPIN_LOCK *lock)
+{
+	KIRQL irql = nt_spin_lock_irql(lock, DISPATCH_LEVEL);
+	entry->next = head->next;
+	head->next = entry;
+	head->depth++;
+	nt_spin_unlock_irql(lock, irql);
+	TRACE4("%p, %p, %p", head, entry, entry->next);
+	return entry->next;
+}
+
+static inline struct nt_slist *PopEntrySList(nt_slist_header *head,
+					     NT_SPIN_LOCK *lock)
+{
+	struct nt_slist *entry;
+	KIRQL irql = nt_spin_lock_irql(lock, DISPATCH_LEVEL);
+	entry = head->next;
+	if (entry) {
+		head->next = entry->next;
+		head->depth--;
+	}
+	nt_spin_unlock_irql(lock, irql);
+	TRACE4("%p, %p", head, entry);
+	return entry;
+}
+
+#else
+
+#define u64_low_32(x) ((u32)x)
+#define u64_high_32(x) ((u32)(x >> 32))
+
+static inline u64 cmpxchg8b(volatile u64 *ptr, u64 old, u64 new)
+{
+	u64 prev;
+
+	__asm__ __volatile__(
+		"\n"
+		LOCK_PREFIX "cmpxchg8b %0\n"
+		: "+m" (*ptr), "=A" (prev)
+		: "A" (old), "b" (u64_low_32(new)), "c" (u64_high_32(new)));
+	return prev;
+}
+
+/* slist routines below update slist atomically - no need for
+ * spinlocks */
+
+static inline struct nt_slist *PushEntrySList(nt_slist_header *head,
+					      struct nt_slist *entry,
+					      NT_SPIN_LOCK *lock)
+{
+	nt_slist_header old, new;
+	do {
+		old.align = head->align;
+		entry->next = old.next;
+		new.next = entry;
+		new.depth = old.depth + 1;
+	} while (cmpxchg8b(&head->align, old.align, new.align) != old.align);
+	TRACE4("%p, %p, %p", head, entry, old.next);
+	return old.next;
+}
+
+static inline struct nt_slist *PopEntrySList(nt_slist_header *head,
+					     NT_SPIN_LOCK *lock)
+{
+	struct nt_slist *entry;
+	nt_slist_header old, new;
+	do {
+		old.align = head->align;
+		entry = old.next;
+		if (!entry)
+			break;
+		new.next = entry->next;
+		new.depth = old.depth - 1;
+	} while (cmpxchg8b(&head->align, old.align, new.align) != old.align);
+	TRACE4("%p, %p", head, entry);
+	return entry;
+}
+
+#endif
+
+#define sleep_hz(n)					\
+do {							\
+	set_current_state(TASK_INTERRUPTIBLE);		\
+	schedule_timeout(n);				\
+} while (0)
+
+int ntoskernel_init(void);
+void ntoskernel_exit(void);
+int ntoskernel_init_device(struct wrap_device *wd);
+void ntoskernel_exit_device(struct wrap_device *wd);
+void *allocate_object(ULONG size, enum common_object_type type,
+		      struct unicode_string *name);
+void free_object(void *object);
+
+int usb_init(void);
+void usb_exit(void);
+int usb_init_device(struct wrap_device *wd);
+void usb_exit_device(struct wrap_device *wd);
+void usb_cancel_pending_urbs(void);
+
+int crt_init(void);
+void crt_exit(void);
+int rtl_init(void);
+void rtl_exit(void);
+int wrap_procfs_init(void);
+void wrap_procfs_remove(void);
+
+int link_pe_images(struct pe_image *pe_image, unsigned short n);
+
+int stricmp(const char *s1, const char *s2);
+void dump_bytes(const char *name, const u8 *from, int len);
+struct mdl *allocate_init_mdl(void *virt, ULONG length);
+void free_mdl(struct mdl *mdl);
+struct driver_object *find_bus_driver(const char *name);
+void free_custom_extensions(struct driver_extension *drv_obj_ext);
+struct nt_thread *get_current_nt_thread(void);
+u64 ticks_1601(void);
+int schedule_ntos_work_item(NTOS_WORK_FUNC func, void *arg1, void *arg2);
+void wrap_init_timer(struct nt_timer *nt_timer, enum timer_type type,
+		     struct ndis_mp_block *nmb);
+BOOLEAN wrap_set_timer(struct nt_timer *nt_timer, unsigned long expires_hz,
+		       unsigned long repeat_hz, struct kdpc *kdpc);
+
+LONG InterlockedDecrement(LONG volatile *val) wfastcall;
+LONG InterlockedIncrement(LONG volatile *val) wfastcall;
+struct nt_list *ExInterlockedInsertHeadList
+	(struct nt_list *head, struct nt_list *entry,
+	 NT_SPIN_LOCK *lock) wfastcall;
+struct nt_list *ExInterlockedInsertTailList
+	(struct nt_list *head, struct nt_list *entry,
+	 NT_SPIN_LOCK *lock) wfastcall;
+struct nt_list *ExInterlockedRemoveHeadList
+	(struct nt_list *head, NT_SPIN_LOCK *lock) wfastcall;
+NTSTATUS IofCallDriver(struct device_object *dev_obj, struct irp *irp) wfastcall;
+KIRQL KfRaiseIrql(KIRQL newirql) wfastcall;
+void KfLowerIrql(KIRQL oldirql) wfastcall;
+KIRQL KfAcquireSpinLock(NT_SPIN_LOCK *lock) wfastcall;
+void KfReleaseSpinLock(NT_SPIN_LOCK *lock, KIRQL oldirql) wfastcall;
+void IofCompleteRequest(struct irp *irp, CHAR prio_boost) wfastcall;
+void KefReleaseSpinLockFromDpcLevel(NT_SPIN_LOCK *lock) wfastcall;
+
+LONG ObfReferenceObject(void *object) wfastcall;
+void ObfDereferenceObject(void *object) wfastcall;
+
+#define ObReferenceObject(object) ObfReferenceObject(object)
+#define ObDereferenceObject(object) ObfDereferenceObject(object)
+
+void WRITE_PORT_UCHAR(ULONG_PTR port, UCHAR value) wstdcall;
+UCHAR READ_PORT_UCHAR(ULONG_PTR port) wstdcall;
+
+#undef ExAllocatePoolWithTag
+void *ExAllocatePoolWithTag(enum pool_type pool_type, SIZE_T size,
+			    ULONG tag) wstdcall;
+#if defined(ALLOC_DEBUG) && ALLOC_DEBUG > 1
+#define ExAllocatePoolWithTag(pool_type, size, tag)			\
+	wrap_ExAllocatePoolWithTag(pool_type, size, tag, __FILE__, __LINE__)
+#endif
+
+void ExFreePool(void *p) wstdcall;
+ULONG MmSizeOfMdl(void *base, ULONG length) wstdcall;
+void __iomem *MmMapIoSpace(PHYSICAL_ADDRESS phys_addr, SIZE_T size,
+		   enum memory_caching_type cache) wstdcall;
+void MmUnmapIoSpace(void __iomem *addr, SIZE_T size) wstdcall;
+void MmProbeAndLockPages(struct mdl *mdl, KPROCESSOR_MODE access_mode,
+			 enum lock_operation operation) wstdcall;
+void MmUnlockPages(struct mdl *mdl) wstdcall;
+void KeInitializeEvent(struct nt_event *nt_event,
+		       enum event_type type, BOOLEAN state) wstdcall;
+LONG KeSetEvent(struct nt_event *nt_event, KPRIORITY incr,
+		BOOLEAN wait) wstdcall;
+LONG KeResetEvent(struct nt_event *nt_event) wstdcall;
+void KeClearEvent(struct nt_event *nt_event) wstdcall;
+void KeInitializeDpc(struct kdpc *kdpc, void *func, void *ctx) wstdcall;
+BOOLEAN queue_kdpc(struct kdpc *kdpc);
+BOOLEAN dequeue_kdpc(struct kdpc *kdpc);
+
+void KeFlushQueuedDpcs(void) wstdcall;
+NTSTATUS IoConnectInterrupt(struct kinterrupt **kinterrupt,
+			    PKSERVICE_ROUTINE service_routine,
+			    void *service_context, NT_SPIN_LOCK *lock,
+			    ULONG vector, KIRQL irql, KIRQL synch_irql,
+			    enum kinterrupt_mode interrupt_mode,
+			    BOOLEAN shareable, KAFFINITY processor_enable_mask,
+			    BOOLEAN floating_save) wstdcall;
+void IoDisconnectInterrupt(struct kinterrupt *interrupt) wstdcall;
+BOOLEAN KeSynchronizeExecution(struct kinterrupt *interrupt,
+			       PKSYNCHRONIZE_ROUTINE synch_routine,
+			       void *ctx) wstdcall;
+
+NTSTATUS KeWaitForSingleObject(void *object, KWAIT_REASON reason,
+			       KPROCESSOR_MODE waitmode, BOOLEAN alertable,
+			       LARGE_INTEGER *timeout) wstdcall;
+struct mdl *IoAllocateMdl(void *virt, ULONG length, BOOLEAN second_buf,
+			  BOOLEAN charge_quota, struct irp *irp) wstdcall;
+void MmBuildMdlForNonPagedPool(struct mdl *mdl) wstdcall;
+void IoFreeMdl(struct mdl *mdl) wstdcall;
+NTSTATUS IoCreateDevice(struct driver_object *driver, ULONG dev_ext_length,
+			struct unicode_string *dev_name, DEVICE_TYPE dev_type,
+			ULONG dev_chars, BOOLEAN exclusive,
+			struct device_object **dev_obj) wstdcall;
+NTSTATUS IoCreateSymbolicLink(struct unicode_string *link,
+			      struct unicode_string *dev_name) wstdcall;
+void IoDeleteDevice(struct device_object *dev) wstdcall;
+void IoDetachDevice(struct device_object *topdev) wstdcall;
+struct device_object *IoGetAttachedDevice(struct device_object *dev) wstdcall;
+struct device_object *IoGetAttachedDeviceReference
+	(struct device_object *dev) wstdcall;
+NTSTATUS IoAllocateDriverObjectExtension
+	(struct driver_object *drv_obj, void *client_id, ULONG extlen,
+	 void **ext) wstdcall;
+void *IoGetDriverObjectExtension(struct driver_object *drv,
+				 void *client_id) wstdcall;
+struct device_object *IoAttachDeviceToDeviceStack
+	(struct device_object *src, struct device_object *dst) wstdcall;
+void KeInitializeEvent(struct nt_event *nt_event, enum event_type type,
+		       BOOLEAN state) wstdcall;
+struct irp *IoAllocateIrp(char stack_count, BOOLEAN charge_quota) wstdcall;
+void IoFreeIrp(struct irp *irp) wstdcall;
+BOOLEAN IoCancelIrp(struct irp *irp) wstdcall;
+struct irp *IoBuildSynchronousFsdRequest
+	(ULONG major_func, struct device_object *dev_obj, void *buf,
+	 ULONG length, LARGE_INTEGER *offset, struct nt_event *event,
+	 struct io_status_block *status) wstdcall;
+struct irp *IoBuildAsynchronousFsdRequest
+	(ULONG major_func, struct device_object *dev_obj, void *buf,
+	 ULONG length, LARGE_INTEGER *offset,
+	 struct io_status_block *status) wstdcall;
+NTSTATUS PoCallDriver(struct device_object *dev_obj, struct irp *irp) wstdcall;
+
+NTSTATUS IoPassIrpDown(struct device_object *dev_obj, struct irp *irp) wstdcall;
+WIN_FUNC_DECL(IoPassIrpDown,2);
+NTSTATUS IoSyncForwardIrp(struct device_object *dev_obj,
+			  struct irp *irp) wstdcall;
+NTSTATUS IoAsyncForwardIrp(struct device_object *dev_obj,
+			   struct irp *irp) wstdcall;
+NTSTATUS IoInvalidDeviceRequest(struct device_object *dev_obj,
+				struct irp *irp) wstdcall;
+
+KIRQL KeGetCurrentIrql(void) wstdcall;
+void KeInitializeSpinLock(NT_SPIN_LOCK *lock) wstdcall;
+void KeAcquireSpinLock(NT_SPIN_LOCK *lock, KIRQL *irql) wstdcall;
+void KeReleaseSpinLock(NT_SPIN_LOCK *lock, KIRQL oldirql) wstdcall;
+KIRQL KeAcquireSpinLockRaiseToDpc(NT_SPIN_LOCK *lock) wstdcall;
+
+void IoAcquireCancelSpinLock(KIRQL *irql) wstdcall;
+void IoReleaseCancelSpinLock(KIRQL irql) wstdcall;
+
+void RtlCopyMemory(void *dst, const void *src, SIZE_T length) wstdcall;
+NTSTATUS RtlUnicodeStringToAnsiString
+	(struct ansi_string *dst, const struct unicode_string *src,
+	 BOOLEAN dup) wstdcall;
+NTSTATUS RtlAnsiStringToUnicodeString
+	(struct unicode_string *dst, const struct ansi_string *src,
+	 BOOLEAN dup) wstdcall;
+void RtlInitAnsiString(struct ansi_string *dst, const char *src) wstdcall;
+void RtlInitString(struct ansi_string *dst, const char *src) wstdcall;
+void RtlInitUnicodeString(struct unicode_string *dest,
+			  const wchar_t *src) wstdcall;
+void RtlFreeUnicodeString(struct unicode_string *string) wstdcall;
+void RtlFreeAnsiString(struct ansi_string *string) wstdcall;
+LONG RtlCompareUnicodeString(const struct unicode_string *s1,
+			     const struct unicode_string *s2,
+			     BOOLEAN case_insensitive) wstdcall;
+void RtlCopyUnicodeString(struct unicode_string *dst,
+			  struct unicode_string *src) wstdcall;
+NTSTATUS RtlUpcaseUnicodeString(struct unicode_string *dst,
+				struct unicode_string *src,
+				BOOLEAN alloc) wstdcall;
+void KeInitializeTimer(struct nt_timer *nt_timer) wstdcall;
+void KeInitializeTimerEx(struct nt_timer *nt_timer,
+			 enum timer_type type) wstdcall;
+BOOLEAN KeSetTimerEx(struct nt_timer *nt_timer, LARGE_INTEGER duetime_ticks,
+		     LONG period_ms, struct kdpc *kdpc) wstdcall;
+BOOLEAN KeSetTimer(struct nt_timer *nt_timer, LARGE_INTEGER duetime_ticks,
+		   struct kdpc *kdpc) wstdcall;
+BOOLEAN KeCancelTimer(struct nt_timer *nt_timer) wstdcall;
+void KeInitializeDpc(struct kdpc *kdpc, void *func, void *ctx) wstdcall;
+struct nt_thread *KeGetCurrentThread(void) wstdcall;
+NTSTATUS ObReferenceObjectByHandle(void *handle, ACCESS_MASK desired_access,
+				   void *obj_type, KPROCESSOR_MODE access_mode,
+				   void **object, void *handle_info) wstdcall;
+
+void adjust_user_shared_data_addr(char *driver, unsigned long length);
+
+extern spinlock_t ntoskernel_lock;
+extern spinlock_t irp_cancel_lock;
+extern struct nt_list object_list;
+#ifdef CONFIG_X86_64
+extern struct kuser_shared_data kuser_shared_data;
+#endif
+
+#define IoCompleteRequest(irp, prio) IofCompleteRequest(irp, prio)
+#define IoCallDriver(dev, irp) IofCallDriver(dev, irp)
+
+#if defined(IO_DEBUG)
+#define DUMP_IRP(_irp)							\
+do {									\
+	struct io_stack_location *_irp_sl;				\
+	_irp_sl = IoGetCurrentIrpStackLocation(_irp);			\
+	IOTRACE("irp: %p, stack size: %d, cl: %d, sl: %p, dev_obj: %p, " \
+		"mj_fn: %d, minor_fn: %d, nt_urb: %p, event: %p",	\
+		_irp, _irp->stack_count, (_irp)->current_location,	\
+		_irp_sl, _irp_sl->dev_obj, _irp_sl->major_fn,		\
+		_irp_sl->minor_fn, IRP_URB(_irp),			\
+		(_irp)->user_event);					\
+} while (0)
+#else
+#define DUMP_IRP(_irp) do { } while (0)
+#endif
+
+#endif // _NTOSKERNEL_H_
--- linux-rt-2.6.31.orig/ubuntu/ndiswrapper/lin2win.h
+++ linux-rt-2.6.31/ubuntu/ndiswrapper/lin2win.h
@@ -0,0 +1,202 @@
+/*
+ *  Copyright (C) 2006 Giridhar Pemmasani
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ *  GNU General Public License for more details.
+ *
+ */
+
+#ifdef CONFIG_X86_64
+
+/* Windows functions must have 32 bytes of shadow space for arguments
+ * above return address, irrespective of number of args. So argc >= 4
+ */
+
+#define alloc_win_stack_frame(argc)		\
+	"sub $(" #argc "+1)*8, %%rsp\n\t"
+#define free_win_stack_frame(argc)		\
+	"add $(" #argc "+1)*8, %%rsp\n\t"
+
+/* m is index of Windows arg required; Windows arg 1 should be at
+ * 0(%rsp), arg 2 at 8(%rsp) and so on after the frame is allocated.
+*/
+
+#define lin2win_win_arg(m) "(" #m "-1)*8(%%rsp)"
+
+/* args for Windows function must be in clobber / output list */
+
+#define outputs()							\
+	"=a" (_ret), "=c" (_dummy), "=d" (_dummy),			\
+		"=r" (r8), "=r" (r9), "=r" (r10), "=r" (r11)
+
+#define clobbers() "cc"
+
+#define LIN2WIN0(func)							\
+({									\
+	u64 _ret, _dummy;						\
+	register u64 r8 __asm__("r8");					\
+	register u64 r9 __asm__("r9");					\
+	register u64 r10 __asm__("r10");				\
+	register u64 r11 __asm__("r11");				\
+	__asm__ __volatile__(						\
+		alloc_win_stack_frame(4)				\
+		"callq *%[fptr]\n\t"					\
+		free_win_stack_frame(4)					\
+		: outputs()						\
+		: [fptr] "r" (func)					\
+		: clobbers());						\
+	_ret;								\
+})
+
+#define LIN2WIN1(func, arg1)						\
+({									\
+	u64 _ret, _dummy;						\
+	register u64 r8 __asm__("r8");					\
+	register u64 r9 __asm__("r9");					\
+	register u64 r10 __asm__("r10");				\
+	register u64 r11 __asm__("r11");				\
+	__asm__ __volatile__(						\
+		alloc_win_stack_frame(4)				\
+		"callq *%[fptr]\n\t"					\
+		free_win_stack_frame(4)					\
+		: outputs()						\
+		: "c" (arg1), [fptr] "r" (func)				\
+		: clobbers());						\
+	_ret;								\
+})
+
+#define LIN2WIN2(func, arg1, arg2)					\
+({									\
+	u64 _ret, _dummy;						\
+	register u64 r8 __asm__("r8");					\
+	register u64 r9 __asm__("r9");					\
+	register u64 r10 __asm__("r10");				\
+	register u64 r11 __asm__("r11");				\
+	__asm__ __volatile__(						\
+		alloc_win_stack_frame(4)				\
+		"callq *%[fptr]\n\t"					\
+		free_win_stack_frame(4)					\
+		: outputs()						\
+		: "c" (arg1), "d" (arg2), [fptr] "r" (func)		\
+		: clobbers());						\
+	_ret;								\
+})
+
+#define LIN2WIN3(func, arg1, arg2, arg3)				\
+({									\
+	u64 _ret, _dummy;						\
+	register u64 r8 __asm__("r8") = (u64)arg3;			\
+	register u64 r9 __asm__("r9");					\
+	register u64 r10 __asm__("r10");				\
+	register u64 r11 __asm__("r11");				\
+	__asm__ __volatile__(						\
+		alloc_win_stack_frame(4)				\
+		"callq *%[fptr]\n\t"					\
+		free_win_stack_frame(4)					\
+		: outputs()						\
+		: "c" (arg1), "d" (arg2), "r" (r8),			\
+		  [fptr] "r" (func)					\
+		: clobbers());						\
+	_ret;								\
+})
+
+#define LIN2WIN4(func, arg1, arg2, arg3, arg4)				\
+({									\
+	u64 _ret, _dummy;						\
+	register u64 r8 __asm__("r8") = (u64)arg3;			\
+	register u64 r9 __asm__("r9") = (u64)arg4;			\
+	register u64 r10 __asm__("r10");				\
+	register u64 r11 __asm__("r11");				\
+	__asm__ __volatile__(						\
+		alloc_win_stack_frame(4)				\
+		"callq *%[fptr]\n\t"					\
+		free_win_stack_frame(4)					\
+		: outputs()						\
+		: "c" (arg1), "d" (arg2), "r" (r8), "r" (r9),		\
+		  [fptr] "r" (func)					\
+		: clobbers());						\
+	_ret;								\
+})
+
+#define LIN2WIN5(func, arg1, arg2, arg3, arg4, arg5)			\
+({									\
+	u64 _ret, _dummy;						\
+	register u64 r8 __asm__("r8") = (u64)arg3;			\
+	register u64 r9 __asm__("r9") = (u64)arg4;			\
+	register u64 r10 __asm__("r10");				\
+	register u64 r11 __asm__("r11");				\
+	__asm__ __volatile__(						\
+		alloc_win_stack_frame(5)				\
+		"movq %[rarg5], " lin2win_win_arg(5) "\n\t"		\
+		"callq *%[fptr]\n\t"					\
+		free_win_stack_frame(5)					\
+		: outputs()						\
+		: "c" (arg1), "d" (arg2), "r" (r8), "r" (r9),		\
+		  [rarg5] "ri" ((u64)arg5),				\
+		  [fptr] "r" (func)					\
+		: clobbers());						\
+	_ret;								\
+})
+
+#define LIN2WIN6(func, arg1, arg2, arg3, arg4, arg5, arg6)		\
+({									\
+	u64 _ret, _dummy;						\
+	register u64 r8 __asm__("r8") = (u64)arg3;			\
+	register u64 r9 __asm__("r9") = (u64)arg4;			\
+	register u64 r10 __asm__("r10");				\
+	register u64 r11 __asm__("r11");				\
+	__asm__ __volatile__(						\
+		alloc_win_stack_frame(6)				\
+		"movq %[rarg5], " lin2win_win_arg(5) "\n\t"		\
+		"movq %[rarg6], " lin2win_win_arg(6) "\n\t"		\
+		"callq *%[fptr]\n\t"					\
+		free_win_stack_frame(6)					\
+		: outputs()						\
+		: "c" (arg1), "d" (arg2), "r" (r8), "r" (r9),		\
+		  [rarg5] "ri" ((u64)arg5), [rarg6] "ri" ((u64)arg6),	\
+		  [fptr] "r" (func)					\
+		: clobbers());						\
+	_ret;								\
+})
+
+#else // CONFIG_X86_64
+
+#define LIN2WIN1(func, arg1)						\
+({									\
+	TRACE6("calling %p", func);					\
+	func(arg1);							\
+})
+#define LIN2WIN2(func, arg1, arg2)					\
+({									\
+	TRACE6("calling %p", func);					\
+	func(arg1, arg2);						\
+})
+#define LIN2WIN3(func, arg1, arg2, arg3)				\
+({									\
+	TRACE6("calling %p", func);					\
+	func(arg1, arg2, arg3);						\
+})
+#define LIN2WIN4(func, arg1, arg2, arg3, arg4)				\
+({									\
+	TRACE6("calling %p", func);					\
+	func(arg1, arg2, arg3, arg4);					\
+})
+#define LIN2WIN5(func, arg1, arg2, arg3, arg4, arg5)			\
+({									\
+	TRACE6("calling %p", func);					\
+	func(arg1, arg2, arg3, arg4, arg5);				\
+})
+#define LIN2WIN6(func, arg1, arg2, arg3, arg4, arg5, arg6)		\
+({									\
+	TRACE6("calling %p", func);					\
+	func(arg1, arg2, arg3, arg4, arg5, arg6);			\
+})
+
+#endif // CONFIG_X86_64
--- linux-rt-2.6.31.orig/ubuntu/ndiswrapper/winnt_types.h
+++ linux-rt-2.6.31/ubuntu/ndiswrapper/winnt_types.h
@@ -0,0 +1,1702 @@
+/*
+ *  Copyright (C) 2003-2005 Pontus Fuchs, Giridhar Pemmasani
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ *  GNU General Public License for more details.
+ *
+ */
+
+#ifndef _WINNT_TYPES_H_
+#define _WINNT_TYPES_H_
+
+#define TRUE				1
+#define FALSE				0
+
+#define PASSIVE_LEVEL			0
+#define APC_LEVEL			1
+#define DISPATCH_LEVEL			2
+#define DEVICE_LEVEL_BASE		4
+
+/* soft interrupts / bottom-half's are disabled at SOFT_IRQL */
+#define SOFT_IRQL			(DEVICE_LEVEL_BASE + 1)
+#define DIRQL				(DEVICE_LEVEL_BASE + 2)
+
+#define STATUS_WAIT_0			0
+#define STATUS_SUCCESS                  0
+#define STATUS_ALERTED                  0x00000101
+#define STATUS_TIMEOUT                  0x00000102
+#define STATUS_PENDING                  0x00000103
+#define STATUS_FAILURE                  0xC0000001
+#define STATUS_NOT_IMPLEMENTED		0xC0000002
+#define STATUS_INVALID_PARAMETER        0xC000000D
+#define STATUS_INVALID_DEVICE_REQUEST	0xC0000010
+#define STATUS_MORE_PROCESSING_REQUIRED 0xC0000016
+#define STATUS_ACCESS_DENIED            0xC0000022
+#define STATUS_BUFFER_TOO_SMALL         0xC0000023
+#define STATUS_OBJECT_NAME_INVALID      0xC0000023
+#define STATUS_MUTANT_NOT_OWNED		0xC0000046
+#define STATUS_RESOURCES                0xC000009A
+#define STATUS_DELETE_PENDING		0xC0000056
+#define STATUS_INSUFFICIENT_RESOURCES	0xC000009A
+#define STATUS_NOT_SUPPORTED            0xC00000BB
+#define STATUS_INVALID_PARAMETER_2      0xC00000F0
+#define STATUS_NO_MEMORY		0xC0000017
+#define STATUS_CANCELLED                0xC0000120
+#define STATUS_DEVICE_REMOVED		0xC00002B6
+#define STATUS_DEVICE_NOT_CONNECTED	0xC000009D
+
+#define STATUS_BUFFER_OVERFLOW		0x80000005
+
+#define SL_PENDING_RETURNED		0x01
+#define SL_INVOKE_ON_CANCEL		0x20
+#define SL_INVOKE_ON_SUCCESS		0x40
+#define SL_INVOKE_ON_ERROR		0x80
+
+#define IRP_MJ_CREATE			0x00
+#define IRP_MJ_CREATE_NAMED_PIPE	0x01
+#define IRP_MJ_CLOSE			0x02
+#define IRP_MJ_READ			0x03
+#define IRP_MJ_WRITE			0x04
+
+#define IRP_MJ_DEVICE_CONTROL		0x0E
+#define IRP_MJ_INTERNAL_DEVICE_CONTROL	0x0F
+#define IRP_MJ_POWER			0x16
+#define IRP_MJ_SYSTEM_CONTROL		0x0E
+#define IRP_MJ_PNP			0x1b
+#define IRP_MJ_MAXIMUM_FUNCTION		0x1b
+
+#define IRP_MN_WAIT_WAKE		0x00
+#define IRP_MN_POWER_SEQUENCE		0x01
+#define IRP_MN_SET_POWER		0x02
+#define IRP_MN_QUERY_POWER		0x03
+
+#define IRP_MN_REGINFO			0x08
+#define IRP_MN_REGINFO_EX		0x0b
+
+#define IRP_MN_START_DEVICE		0x00
+#define IRP_MN_QUERY_REMOVE_DEVICE	0x01
+#define IRP_MN_REMOVE_DEVICE		0x02
+#define IRP_MN_CANCEL_REMOVE_DEVICE	0x03
+#define IRP_MN_STOP_DEVICE		0x04
+#define IRP_MN_QUERY_STOP_DEVICE	0x05
+#define IRP_MN_CANCEL_STOP_DEVICE	0x06
+#define IRP_MN_QUERY_DEVICE_RELATIONS	0x07
+#define IRP_MN_QUERY_INTERFACE		0x08
+
+#define IRP_BUFFERED_IO			0x00000010
+#define IRP_DEALLOCATE_BUFFER		0x00000020
+#define IRP_INPUT_OPERATION		0x00000040
+
+#define IRP_DEFFER_IO_COMPLETION	0x00000800
+
+#define THREAD_WAIT_OBJECTS		3
+#define MAX_WAIT_OBJECTS		64
+
+#define LOW_PRIORITY			0
+#define LOW_REALTIME_PRIORITY		16
+#define HIGH_PRIORITY			31
+#define MAXIMUM_PRIORITY		32
+
+#define PROCESSOR_FEATURE_MAX		64
+
+#define IO_NO_INCREMENT			0
+
+#define WMIREG_ACTION_REGISTER		1
+#define WMIREG_ACTION_DEREGISTER	2
+#define WMIREG_ACTION_REREGISTER	3
+#define WMIREG_ACTION_UPDATE_GUIDS	4
+
+#define WMIREGISTER			0
+#define WMIUPDATE			1
+
+#ifdef CONFIG_X86_64
+#define wstdcall
+#define wfastcall
+#define noregparm
+
+#define KI_USER_SHARED_DATA 0xfffff78000000000UL
+
+#else
+
+#define noregparm __attribute__((regparm(0)))
+#define wstdcall __attribute__((__stdcall__, regparm(0)))
+#if defined(__GNUC__) && ((__GNUC__ == 3 && __GNUC_MINOR__ > 3) || __GNUC__ > 3)
+#undef fastcall
+#define wfastcall __attribute__((fastcall))
+#else
+#error "gcc 3.4 or newer should be used for compiling this module"
+#endif
+
+#define KI_USER_SHARED_DATA 0xffdf0000
+
+#endif
+
+#define packed __attribute__((packed))
+#define no_warn_unused __attribute__((unused))
+
+typedef u8	BOOLEAN;
+typedef u8	BYTE;
+typedef u8	*LPBYTE;
+typedef s8	CHAR;
+typedef u8	UCHAR;
+typedef s16	SHORT;
+typedef u16	USHORT;
+typedef u16	WORD;
+typedef s32	INT;
+typedef u32	UINT;
+typedef u32	DWORD;
+typedef s32	LONG;
+typedef u32	ULONG;
+typedef s64	LONGLONG;
+typedef u64	ULONGLONG;
+typedef u64	ULONGULONG;
+typedef u64	ULONG64;
+
+typedef CHAR CCHAR;
+typedef USHORT wchar_t;
+typedef SHORT CSHORT;
+typedef LONGLONG LARGE_INTEGER;
+
+typedef LONG NTSTATUS;
+
+typedef LONG KPRIORITY;
+typedef LARGE_INTEGER PHYSICAL_ADDRESS;
+typedef UCHAR KIRQL;
+typedef CHAR KPROCESSOR_MODE;
+
+/* ULONG_PTR is 32 bits on 32-bit platforms and 64 bits on 64-bit
+ * platform, which is same as 'unsigned long' in Linux */
+typedef unsigned long ULONG_PTR;
+
+typedef ULONG_PTR SIZE_T;
+typedef ULONG_PTR KAFFINITY;
+typedef ULONG ACCESS_MASK;
+
+typedef ULONG_PTR PFN_NUMBER;
+typedef ULONG SECURITY_INFORMATION;
+
+/* non-negative numbers indicate success */
+#define NT_SUCCESS(status)  ((NTSTATUS)(status) >= 0)
+
+struct ansi_string {
+	USHORT length;
+	USHORT max_length;
+	char *buf;
+};
+
+struct unicode_string {
+	USHORT length;
+	USHORT max_length;
+	wchar_t *buf;
+};
+
+struct nt_slist {
+	struct nt_slist *next;
+};
+
+#ifdef CONFIG_X86_64
+/* it is not clear how nt_slist_head is used to store pointer to
+ * slists and depth; here we assume 'align' field is used to store
+ * depth and 'region' field is used to store slist pointers */
+struct nt_slist_head {
+	union {
+		USHORT depth;
+		ULONGLONG align;
+	};
+	union {
+		ULONGLONG region;
+		struct nt_slist *next;
+	};
+} __attribute__((aligned(16)));
+typedef struct nt_slist_head nt_slist_header;
+#else
+union nt_slist_head {
+	ULONGLONG align;
+	struct {
+		struct nt_slist *next;
+		USHORT depth;
+		USHORT sequence;
+	};
+};
+typedef union nt_slist_head nt_slist_header;
+#endif
+
+struct nt_list {
+	struct nt_list *next;
+	struct nt_list *prev;
+};
+
+typedef ULONG_PTR NT_SPIN_LOCK;
+
+enum kdpc_importance {LowImportance, MediumImportance, HighImportance};
+
+struct kdpc;
+typedef void (*DPC)(struct kdpc *kdpc, void *ctx, void *arg1,
+		    void *arg2) wstdcall;
+struct kdpc {
+	SHORT type;
+	UCHAR nr_cpu;
+	UCHAR importance;
+	struct nt_list list;
+	DPC func;
+	void *ctx;
+	void *arg1;
+	void *arg2;
+	union {
+		NT_SPIN_LOCK *lock;
+		/* 'lock' is not used; 'queued' represents whether
+		 * kdpc is queued or not */
+		int queued;
+	};
+};
+
+enum pool_type {
+	NonPagedPool, PagedPool, NonPagedPoolMustSucceed, DontUseThisType,
+	NonPagedPoolCacheAligned, PagedPoolCacheAligned,
+	NonPagedPoolCacheAlignedMustS, MaxPoolType,
+	NonPagedPoolSession = 32,
+	PagedPoolSession = NonPagedPoolSession + 1,
+	NonPagedPoolMustSucceedSession = PagedPoolSession + 1,
+	DontUseThisTypeSession = NonPagedPoolMustSucceedSession + 1,
+	NonPagedPoolCacheAlignedSession = DontUseThisTypeSession + 1,
+	PagedPoolCacheAlignedSession = NonPagedPoolCacheAlignedSession + 1,
+	NonPagedPoolCacheAlignedMustSSession = PagedPoolCacheAlignedSession + 1
+};
+
+enum memory_caching_type_orig {
+	MmFrameBufferCached = 2
+};
+
+enum memory_caching_type {
+	MmNonCached = FALSE, MmCached = TRUE,
+	MmWriteCombined = MmFrameBufferCached, MmHardwareCoherentCached,
+	MmNonCachedUnordered, MmUSWCCached, MmMaximumCacheType
+};
+
+enum lock_operation {
+	IoReadAccess, IoWriteAccess, IoModifyAccess
+};
+
+enum mode {
+	KernelMode, UserMode, MaximumMode
+};
+
+struct mdl {
+	struct mdl *next;
+	CSHORT size;
+	CSHORT flags;
+	/* NdisFreeBuffer doesn't pass pool, so we store pool in
+	 * unused field 'process' */
+	union {
+		void *process;
+		void *pool;
+	};
+	void *mappedsystemva;
+	void *startva;
+	ULONG bytecount;
+	ULONG byteoffset;
+};
+
+#define MDL_MAPPED_TO_SYSTEM_VA		0x0001
+#define MDL_PAGES_LOCKED		0x0002
+#define MDL_SOURCE_IS_NONPAGED_POOL	0x0004
+#define MDL_ALLOCATED_FIXED_SIZE	0x0008
+#define MDL_PARTIAL			0x0010
+#define MDL_PARTIAL_HAS_BEEN_MAPPED	0x0020
+#define MDL_IO_PAGE_READ		0x0040
+#define MDL_WRITE_OPERATION		0x0080
+#define MDL_PARENT_MAPPED_SYSTEM_VA	0x0100
+#define MDL_FREE_EXTRA_PTES		0x0200
+#define MDL_IO_SPACE			0x0800
+#define MDL_NETWORK_HEADER		0x1000
+#define MDL_MAPPING_CAN_FAIL		0x2000
+#define MDL_ALLOCATED_MUST_SUCCEED	0x4000
+
+#define MDL_POOL_ALLOCATED		0x0400
+#define MDL_CACHE_ALLOCATED		0x8000
+
+#define PAGE_START(ptr) ((void *)((ULONG_PTR)(ptr) & ~(PAGE_SIZE - 1)))
+#define BYTE_OFFSET(ptr) ((ULONG)((ULONG_PTR)(ptr) & (PAGE_SIZE - 1)))
+
+#define MmGetMdlByteCount(mdl) ((mdl)->bytecount)
+#define MmGetMdlVirtualAddress(mdl) ((mdl)->startva + (mdl)->byteoffset)
+#define MmGetMdlByteOffset(mdl) ((mdl)->byteoffset)
+#define MmGetSystemAddressForMdl(mdl) ((mdl)->mappedsystemva)
+#define MmGetSystemAddressForMdlSafe(mdl, priority) ((mdl)->mappedsystemva)
+#define MmGetMdlPfnArray(mdl) ((PFN_NUMBER *)(mdl + 1))
+#define MmInitializeMdl(mdl, baseva, length)				\
+do {									\
+	(mdl)->next = NULL;						\
+	(mdl)->size = MmSizeOfMdl(baseva, length);			\
+	(mdl)->flags = 0;						\
+	(mdl)->startva = PAGE_START(baseva);				\
+	(mdl)->byteoffset = BYTE_OFFSET(baseva);			\
+	(mdl)->bytecount = length;					\
+	(mdl)->mappedsystemva = baseva;					\
+	TRACE4("%p %p %p %d %d", (mdl), baseva, (mdl)->startva,	\
+		  (mdl)->byteoffset, length);				\
+} while (0)
+
+struct kdevice_queue_entry {
+	struct nt_list list;
+	ULONG sort_key;
+	BOOLEAN inserted;
+};
+
+struct kdevice_queue {
+	USHORT type;
+	USHORT size;
+	struct nt_list list;
+	NT_SPIN_LOCK lock;
+	BOOLEAN busy;
+};
+
+struct wait_context_block {
+	struct kdevice_queue_entry wait_queue_entry;
+	void *device_routine;
+	void *device_context;
+	ULONG num_regs;
+	void *device_object;
+	void *current_irp;
+	void *buffer_chaining_dpc;
+};
+
+struct wait_block {
+	struct nt_list list;
+	struct task_struct *thread;
+	void *object;
+	int *wait_done;
+	USHORT wait_key;
+	USHORT wait_type;
+};
+
+struct dispatcher_header {
+	UCHAR type;
+	UCHAR absolute;
+	UCHAR size;
+	UCHAR inserted;
+	LONG signal_state;
+	struct nt_list wait_blocks;
+};
+
+enum event_type {
+	NotificationEvent,
+	SynchronizationEvent,
+};
+
+enum timer_type {
+	NotificationTimer = NotificationEvent,
+	SynchronizationTimer = SynchronizationEvent,
+};
+
+enum dh_type {
+	NotificationObject = NotificationEvent,
+	SynchronizationObject = SynchronizationEvent,
+	MutexObject,
+	SemaphoreObject,
+	ThreadObject,
+};
+
+enum wait_type {
+	WaitAll, WaitAny
+};
+
+/* objects that use dispatcher_header have it as the first field, so
+ * whenever we need to initialize dispatcher_header, we can convert
+ * that object into a nt_event and access dispatcher_header */
+struct nt_event {
+	struct dispatcher_header dh;
+};
+
+struct wrap_timer;
+
+#define WRAP_TIMER_MAGIC 47697249
+
+struct nt_timer {
+	struct dispatcher_header dh;
+	/* We can't fit Linux timer in this structure. Instead of
+	 * padding the nt_timer structure, we replace due_time field
+	 * with *wrap_timer and allocate memory for it when nt_timer is
+	 * initialized */
+	union {
+		ULONGLONG due_time;
+		struct wrap_timer *wrap_timer;
+	};
+	struct nt_list nt_timer_list;
+	struct kdpc *kdpc;
+	union {
+		LONG period;
+		LONG wrap_timer_magic;
+	};
+};
+
+struct nt_mutex {
+	struct dispatcher_header dh;
+	struct nt_list list;
+	struct task_struct *owner_thread;
+	BOOLEAN abandoned;
+	BOOLEAN apc_disable;
+};
+
+struct nt_semaphore {
+	struct dispatcher_header dh;
+	LONG limit;
+};
+
+struct nt_thread {
+	struct dispatcher_header dh;
+	/* the rest in Windows is a long structure; since this
+	 * structure is opaque to drivers, we just define what we
+	 * need */
+	int pid;
+	NTSTATUS status;
+	struct task_struct *task;
+	struct nt_list irps;
+	NT_SPIN_LOCK lock;
+	KPRIORITY prio;
+};
+
+#define set_object_type(dh, type)	((dh)->type = (type))
+#define is_notify_object(dh)		((dh)->type == NotificationObject)
+#define is_synch_object(dh)		((dh)->type == SynchronizationObject)
+#define is_mutex_object(dh)		((dh)->type == MutexObject)
+#define is_semaphore_object(dh)		((dh)->type == SemaphoreObject)
+#define is_nt_thread_object(dh)		((dh)->type == ThreadObject)
+
+#define IO_TYPE_ADAPTER				1
+#define IO_TYPE_CONTROLLER			2
+#define IO_TYPE_DEVICE				3
+#define IO_TYPE_DRIVER				4
+#define IO_TYPE_FILE				5
+#define IO_TYPE_IRP				6
+#define IO_TYPE_DEVICE_OBJECT_EXTENSION		13
+
+struct irp;
+struct dev_obj_ext;
+struct driver_object;
+
+struct device_object {
+	CSHORT type;
+	USHORT size;
+	LONG ref_count;
+	struct driver_object *drv_obj;
+	struct device_object *next;
+	struct device_object *attached;
+	struct irp *current_irp;
+	void *io_timer;
+	ULONG flags;
+	ULONG characteristics;
+	void *vpb;
+	void *dev_ext;
+	CCHAR stack_count;
+	union {
+		struct nt_list queue_list;
+		struct wait_context_block wcb;
+	} queue;
+	ULONG align_req;
+	struct kdevice_queue dev_queue;
+	struct kdpc dpc;
+	ULONG active_threads;
+	void *security_desc;
+	struct nt_event lock;
+	USHORT sector_size;
+	USHORT spare1;
+	struct dev_obj_ext *dev_obj_ext;
+	void *reserved;
+};
+
+struct dev_obj_ext {
+	CSHORT type;
+	CSHORT size;
+	struct device_object *dev_obj;
+	struct device_object *attached_to;
+};
+
+struct io_status_block {
+	union {
+		NTSTATUS status;
+		void *pointer;
+	};
+	ULONG_PTR info;
+};
+
+#ifdef CONFIG_X86_64
+struct io_status_block32 {
+	NTSTATUS status;
+	ULONG info;
+};
+#endif
+
+#define DEVICE_TYPE ULONG
+
+struct driver_extension;
+
+typedef NTSTATUS driver_dispatch_t(struct device_object *dev_obj,
+				   struct irp *irp) wstdcall;
+
+struct driver_object {
+	CSHORT type;
+	CSHORT size;
+	struct device_object *dev_obj;
+	ULONG flags;
+	void *start;
+	ULONG driver_size;
+	void *section;
+	struct driver_extension *drv_ext;
+	struct unicode_string name;
+	struct unicode_string *hardware_database;
+	void *fast_io_dispatch;
+	void *init;
+	void *start_io;
+	void (*unload)(struct driver_object *driver) wstdcall;
+	driver_dispatch_t *major_func[IRP_MJ_MAXIMUM_FUNCTION + 1];
+};
+
+struct driver_extension {
+	struct driver_object *drv_obj;
+	NTSTATUS (*add_device)(struct driver_object *drv_obj,
+			       struct device_object *dev_obj) wstdcall;
+	ULONG count;
+	struct unicode_string service_key_name;
+	struct nt_list custom_ext;
+};
+
+struct custom_ext {
+	struct nt_list list;
+	void *client_id;
+};
+
+struct wrap_bin_file;
+
+struct file_object {
+	CSHORT type;
+	CSHORT size;
+	struct device_object *dev_obj;
+	void *volume_parameter_block;
+	void *fs_context;
+	void *fs_context2;
+	void *section_object_pointer;
+	void *private_cache_map;
+	NTSTATUS final_status;
+	union {
+		struct file_object *related_file_object;
+		struct wrap_bin_file *wrap_bin_file;
+	};
+	BOOLEAN lock_operation;
+	BOOLEAN delete_pending;
+	BOOLEAN read_access;
+	BOOLEAN write_access;
+	BOOLEAN delete_access;
+	BOOLEAN shared_read;
+	BOOLEAN shared_write;
+	BOOLEAN shared_delete;
+	ULONG flags;
+	struct unicode_string _name_;
+	LARGE_INTEGER current_byte_offset;
+	ULONG waiters;
+	ULONG busy;
+	void *last_lock;
+	struct nt_event lock;
+	struct nt_event event;
+	void *completion_context;
+};
+
+#ifdef CONFIG_X86_64
+#define POINTER_ALIGN __attribute__((aligned(8)))
+#else
+#define POINTER_ALIGN
+#endif
+
+#define CACHE_ALIGN __attribute__((aligned(128)))
+
+enum system_power_state {
+	PowerSystemUnspecified = 0,
+	PowerSystemWorking, PowerSystemSleeping1, PowerSystemSleeping2,
+	PowerSystemSleeping3, PowerSystemHibernate, PowerSystemShutdown,
+	PowerSystemMaximum,
+};
+
+enum device_power_state {
+	PowerDeviceUnspecified = 0,
+	PowerDeviceD0, PowerDeviceD1, PowerDeviceD2, PowerDeviceD3,
+	PowerDeviceMaximum,
+};
+
+union power_state {
+	enum system_power_state system_state;
+	enum device_power_state device_state;
+};
+
+enum power_state_type {
+	SystemPowerState = 0, DevicePowerState,
+};
+
+enum power_action {
+	PowerActionNone = 0,
+	PowerActionReserved, PowerActionSleep, PowerActionHibernate,
+	PowerActionShutdown, PowerActionShutdownReset, PowerActionShutdownOff,
+	PowerActionWarmEject,
+};
+
+struct guid {
+	ULONG data1;
+	USHORT data2;
+	USHORT data3;
+	UCHAR data4[8];
+};
+
+struct nt_interface {
+	USHORT size;
+	USHORT version;
+	void *context;
+	void (*reference)(void *context) wstdcall;
+	void (*dereference)(void *context) wstdcall;
+};
+
+enum interface_type {
+	InterfaceTypeUndefined = -1, Internal, Isa, Eisa, MicroChannel,
+	TurboChannel, PCIBus, VMEBus, NuBus, PCMCIABus, CBus, MPIBus,
+	MPSABus, ProcessorInternal, InternalPowerBus, PNPISABus,
+	PNPBus, MaximumInterfaceType,
+};
+
+#define CmResourceTypeNull		0
+#define CmResourceTypePort		1
+#define CmResourceTypeInterrupt		2
+#define CmResourceTypeMemory		3
+#define CmResourceTypeDma		4
+#define CmResourceTypeDeviceSpecific	5
+#define CmResourceTypeBusNumber		6
+#define CmResourceTypeMaximum		7
+
+#define CmResourceTypeNonArbitrated	128
+#define CmResourceTypeConfigData	128
+#define CmResourceTypeDevicePrivate	129
+#define CmResourceTypePcCardConfig	130
+#define CmResourceTypeMfCardConfig	131
+
+enum cm_share_disposition {
+	CmResourceShareUndetermined = 0, CmResourceShareDeviceExclusive,
+	CmResourceShareDriverExclusive, CmResourceShareShared
+};
+
+#define CM_RESOURCE_INTERRUPT_LEVEL_SENSITIVE	0
+#define CM_RESOURCE_INTERRUPT_LATCHED		1
+#define CM_RESOURCE_MEMORY_READ_WRITE		0x0000
+#define CM_RESOURCE_MEMORY_READ_ONLY		0x0001
+#define CM_RESOURCE_MEMORY_WRITE_ONLY		0x0002
+#define CM_RESOURCE_MEMORY_PREFETCHABLE		0x0004
+
+#define CM_RESOURCE_MEMORY_COMBINEDWRITE	0x0008
+#define CM_RESOURCE_MEMORY_24			0x0010
+#define CM_RESOURCE_MEMORY_CACHEABLE		0x0020
+
+#define CM_RESOURCE_PORT_MEMORY			0x0000
+#define CM_RESOURCE_PORT_IO			0x0001
+#define CM_RESOURCE_PORT_10_BIT_DECODE		0x0004
+#define CM_RESOURCE_PORT_12_BIT_DECODE		0x0008
+#define CM_RESOURCE_PORT_16_BIT_DECODE		0x0010
+#define CM_RESOURCE_PORT_POSITIVE_DECODE	0x0020
+#define CM_RESOURCE_PORT_PASSIVE_DECODE		0x0040
+#define CM_RESOURCE_PORT_WINDOW_DECODE		0x0080
+
+#define CM_RESOURCE_DMA_8			0x0000
+#define CM_RESOURCE_DMA_16			0x0001
+#define CM_RESOURCE_DMA_32			0x0002
+#define CM_RESOURCE_DMA_8_AND_16		0x0004
+#define CM_RESOURCE_DMA_BUS_MASTER		0x0008
+#define CM_RESOURCE_DMA_TYPE_A			0x0010
+#define CM_RESOURCE_DMA_TYPE_B			0x0020
+#define CM_RESOURCE_DMA_TYPE_F			0x0040
+
+#define MAX_RESOURCES 20
+
+#pragma pack(push,4)
+struct cm_partial_resource_descriptor {
+	UCHAR type;
+	UCHAR share;
+	USHORT flags;
+	union {
+		struct {
+			PHYSICAL_ADDRESS start;
+			ULONG length;
+		} generic;
+		struct {
+			PHYSICAL_ADDRESS start;
+			ULONG length;
+		} port;
+		struct {
+			ULONG level;
+			ULONG vector;
+			KAFFINITY affinity;
+		} interrupt;
+		struct {
+			PHYSICAL_ADDRESS start;
+			ULONG length;
+		} memory;
+		struct {
+			ULONG channel;
+			ULONG port;
+			ULONG reserved1;
+		} dma;
+		struct {
+			ULONG data[3];
+		} device_private;
+		struct {
+			ULONG start;
+			ULONG length;
+			ULONG reserved;
+		} bus_number;
+		struct {
+			ULONG data_size;
+			ULONG reserved1;
+			ULONG reserved2;
+		} device_specific_data;
+	} u;
+};
+#pragma pack(pop)
+
+struct cm_partial_resource_list {
+	USHORT version;
+	USHORT revision;
+	ULONG count;
+	struct cm_partial_resource_descriptor partial_descriptors[1];
+};
+
+struct cm_full_resource_descriptor {
+	enum interface_type interface_type;
+	ULONG bus_number;
+	struct cm_partial_resource_list partial_resource_list;
+};
+
+struct cm_resource_list {
+	ULONG count;
+	struct cm_full_resource_descriptor list[1];
+};
+
+enum file_info_class {
+	FileDirectoryInformation = 1,
+	FileBasicInformation = 4,
+	FileStandardInformation = 5,
+	FileNameInformation = 9,
+	FilePositionInformation = 14,
+	FileAlignmentInformation = 17,
+	FileNetworkOpenInformation = 34,
+	FileAttributeTagInformation = 35,
+	FileMaximumInformation = 41,
+};
+
+enum fs_info_class {
+	FileFsVolumeInformation = 1,
+	/* ... */
+	FileFsMaximumInformation = 9,
+};
+
+enum device_relation_type {
+	BusRelations, EjectionRelations, PowerRelations, RemovalRelations,
+	TargetDeviceRelation, SingleBusRelations,
+};
+
+enum bus_query_id_type {
+	BusQueryDeviceID = 0, BusQueryHardwareIDs = 1,
+	BusQueryCompatibleIDs = 2, BusQueryInstanceID = 3,
+	BusQueryDeviceSerialNumber = 4,
+};
+
+enum device_text_type {
+	DeviceTextDescription = 0, DeviceTextLocationInformation = 1,
+};
+
+enum device_usage_notification_type {
+	DeviceUsageTypeUndefined, DeviceUsageTypePaging,
+	DeviceUsageTypeHibernation, DevbiceUsageTypeDumpFile,
+};
+
+#define METHOD_BUFFERED		0
+#define METHOD_IN_DIRECT	1
+#define METHOD_OUT_DIRECT	2
+#define METHOD_NEITHER		3
+
+#define CTL_CODE(dev_type, func, method, access)			\
+	(((dev_type) << 16) | ((access) << 14) | ((func) << 2) | (method))
+
+#define IO_METHOD_FROM_CTL_CODE(code) (code & 0x3)
+
+#ifndef CONFIG_X86_64
+#pragma pack(push,4)
+#endif
+struct io_stack_location {
+	UCHAR major_fn;
+	UCHAR minor_fn;
+	UCHAR flags;
+	UCHAR control;
+	union {
+		struct {
+			void *security_context;
+			ULONG options;
+			USHORT POINTER_ALIGN file_attributes;
+			USHORT share_access;
+			ULONG POINTER_ALIGN ea_length;
+		} create;
+		struct {
+			ULONG length;
+			ULONG POINTER_ALIGN key;
+			LARGE_INTEGER byte_offset;
+		} read;
+		struct {
+			ULONG length;
+			ULONG POINTER_ALIGN key;
+			LARGE_INTEGER byte_offset;
+		} write;
+		struct {
+			ULONG length;
+			enum file_info_class POINTER_ALIGN file_info_class;
+		} query_file;
+		struct {
+			ULONG length;
+			enum file_info_class POINTER_ALIGN file_info_class;
+			struct file_object *file_object;
+			union {
+				struct {
+					BOOLEAN replace_if_exists;
+					BOOLEAN advance_only;
+				};
+				ULONG cluster_count;
+				void *delete_handle;
+			};
+		} set_file;
+		struct {
+			ULONG length;
+			enum fs_info_class POINTER_ALIGN fs_info_class;
+		} query_volume;
+		struct {
+			ULONG output_buf_len;
+			ULONG POINTER_ALIGN input_buf_len;
+			ULONG POINTER_ALIGN code;
+			void *type3_input_buf;
+		} dev_ioctl;
+		struct {
+			SECURITY_INFORMATION security_info;
+			ULONG POINTER_ALIGN length;
+		} query_security;
+		struct {
+			SECURITY_INFORMATION security_info;
+			void *security_descriptor;
+		} set_security;
+		struct {
+			void *vpb;
+			struct device_object *device_object;
+		} mount_volume;
+		struct {
+			void *vpb;
+			struct device_object *device_object;
+		} verify_volume;
+		struct {
+			void *srb;
+		} scsi;
+		struct {
+			enum device_relation_type type;
+		} query_device_relations;
+		struct {
+			const struct guid *type;
+			USHORT size;
+			USHORT version;
+			struct nt_interface *intf;
+			void *intf_data;
+		} query_intf;
+		struct {
+			void *capabilities;
+		} device_capabilities;
+		struct {
+			void *io_resource_requirement_list;
+		} filter_resource_requirements;
+		struct {
+			ULONG which_space;
+			void *buffer;
+			ULONG offset;
+			ULONG POINTER_ALIGN length;
+		} read_write_config;
+		struct {
+			BOOLEAN lock;
+		} set_lock;
+		struct {
+			enum bus_query_id_type id_type;
+		} query_id;
+		struct {
+			enum device_text_type device_text_type;
+			ULONG POINTER_ALIGN locale_id;
+		} query_device_text;
+		struct {
+			BOOLEAN in_path;
+			BOOLEAN reserved[3];
+			enum device_usage_notification_type POINTER_ALIGN type;
+		} usage_notification;
+		struct {
+			enum system_power_state power_state;
+		} wait_wake;
+		struct {
+			void *power_sequence;
+		} power_sequence;
+		struct {
+			ULONG sys_context;
+			enum power_state_type POINTER_ALIGN type;
+			union power_state POINTER_ALIGN state;
+			enum power_action POINTER_ALIGN shutdown_type;
+		} power;
+		struct {
+			struct cm_resource_list *allocated_resources;
+			struct cm_resource_list *allocated_resources_translated;
+		} start_device;
+		struct {
+			ULONG_PTR provider_id;
+			void *data_path;
+			ULONG buf_len;
+			void *buf;
+		} wmi;
+		struct {
+			void *arg1;
+			void *arg2;
+			void *arg3;
+			void *arg4;
+		} others;
+	} params;
+	struct device_object *dev_obj;
+	struct file_object *file_obj;
+	NTSTATUS (*completion_routine)(struct device_object *,
+				       struct irp *, void *) wstdcall;
+	void *context;
+};
+#ifndef CONFIG_X86_64
+#pragma pack(pop)
+#endif
+
+struct kapc {
+	CSHORT type;
+	CSHORT size;
+	ULONG spare0;
+	struct nt_thread *thread;
+	struct nt_list list;
+	void *kernele_routine;
+	void *rundown_routine;
+	void *normal_routine;
+	void *normal_context;
+	void *sys_arg1;
+	void *sys_arg2;
+	CCHAR apc_state_index;
+	KPROCESSOR_MODE apc_mode;
+	BOOLEAN inserted;
+};
+
+#define IRP_NOCACHE			0x00000001
+#define IRP_SYNCHRONOUS_API		0x00000004
+#define IRP_ASSOCIATED_IRP		0x00000008
+
+enum urb_state {
+	URB_INVALID = 1, URB_ALLOCATED, URB_SUBMITTED,
+	URB_COMPLETED, URB_FREE, URB_SUSPEND, URB_INT_UNLINKED };
+
+struct wrap_urb {
+	struct nt_list list;
+	enum urb_state state;
+	struct nt_list complete_list;
+	unsigned int flags;
+	struct urb *urb;
+	struct irp *irp;
+#ifdef USB_DEBUG
+	unsigned int id;
+#endif
+};
+
+struct irp {
+	SHORT type;
+	USHORT size;
+	struct mdl *mdl;
+	ULONG flags;
+	union {
+		struct irp *master_irp;
+		LONG irp_count;
+		void *system_buffer;
+	} associated_irp;
+	struct nt_list thread_list;
+	struct io_status_block io_status;
+	KPROCESSOR_MODE requestor_mode;
+	BOOLEAN pending_returned;
+	CHAR stack_count;
+	CHAR current_location;
+	BOOLEAN cancel;
+	KIRQL cancel_irql;
+	CCHAR apc_env;
+	UCHAR alloc_flags;
+	struct io_status_block *user_status;
+	struct nt_event *user_event;
+	union {
+		struct {
+			void *user_apc_routine;
+			void *user_apc_context;
+		} async_params;
+		LARGE_INTEGER alloc_size;
+	} overlay;
+	void (*cancel_routine)(struct device_object *, struct irp *) wstdcall;
+	void *user_buf;
+	union {
+		struct {
+			union {
+				struct kdevice_queue_entry dev_q_entry;
+				struct {
+					void *driver_context[4];
+				};
+			};
+			void *thread;
+			char *aux_buf;
+			struct {
+				struct nt_list list;
+				union {
+					struct io_stack_location *csl;
+					ULONG packet_type;
+				};
+			};
+			struct file_object *file_object;
+		} overlay;
+		union {
+			struct kapc apc;
+			/* space for apc is used for ndiswrapper
+			 * specific fields */
+			struct {
+				struct wrap_urb *wrap_urb;
+				struct wrap_device *wrap_device;
+			};
+		};
+		void *completion_key;
+	} tail;
+};
+
+#define IoSizeOfIrp(stack_count)					\
+	((USHORT)(sizeof(struct irp) +					\
+		  ((stack_count) * sizeof(struct io_stack_location))))
+#define IoGetCurrentIrpStackLocation(irp)	\
+	(irp)->tail.overlay.csl
+#define IoGetNextIrpStackLocation(irp)		\
+	(IoGetCurrentIrpStackLocation(irp) - 1)
+#define IoGetPreviousIrpStackLocation(irp)	\
+	(IoGetCurrentIrpStackLocation(irp) + 1)
+
+#define IoSetNextIrpStackLocation(irp)				\
+do {								\
+	KIRQL _irql_;						\
+	IoAcquireCancelSpinLock(&_irql_);			\
+	(irp)->current_location--;				\
+	IoGetCurrentIrpStackLocation(irp)--;			\
+	IoReleaseCancelSpinLock(_irql_);			\
+} while (0)
+
+#define IoSkipCurrentIrpStackLocation(irp) 			\
+do {								\
+	KIRQL _irql_;						\
+	IoAcquireCancelSpinLock(&_irql_);			\
+	(irp)->current_location++;				\
+	IoGetCurrentIrpStackLocation(irp)++;			\
+	IoReleaseCancelSpinLock(_irql_);			\
+} while (0)
+
+static inline void
+IoCopyCurrentIrpStackLocationToNext(struct irp *irp)
+{
+	struct io_stack_location *next;
+	next = IoGetNextIrpStackLocation(irp);
+	memcpy(next, IoGetCurrentIrpStackLocation(irp),
+	       offsetof(struct io_stack_location, completion_routine));
+	next->control = 0;
+}
+
+static inline void
+IoSetCompletionRoutine(struct irp *irp, void *routine, void *context,
+		       BOOLEAN success, BOOLEAN error, BOOLEAN cancel)
+{
+	struct io_stack_location *irp_sl = IoGetNextIrpStackLocation(irp);
+	irp_sl->completion_routine = routine;
+	irp_sl->context = context;
+	irp_sl->control = 0;
+	if (success)
+		irp_sl->control |= SL_INVOKE_ON_SUCCESS;
+	if (error)
+		irp_sl->control |= SL_INVOKE_ON_ERROR;
+	if (cancel)
+		irp_sl->control |= SL_INVOKE_ON_CANCEL;
+}
+
+#define IoMarkIrpPending(irp)						\
+	(IoGetCurrentIrpStackLocation((irp))->control |= SL_PENDING_RETURNED)
+#define IoUnmarkIrpPending(irp)						\
+	(IoGetCurrentIrpStackLocation((irp))->control &= ~SL_PENDING_RETURNED)
+
+#define IRP_SL(irp, n) (((struct io_stack_location *)((irp) + 1)) + (n))
+#define IRP_DRIVER_CONTEXT(irp) (irp)->tail.overlay.driver_context
+#define IoIrpThread(irp) ((irp)->tail.overlay.thread)
+
+#define IRP_URB(irp)							\
+	(union nt_urb *)(IoGetCurrentIrpStackLocation(irp)->params.others.arg1)
+
+#define IRP_WRAP_DEVICE(irp) (irp)->tail.wrap_device
+#define IRP_WRAP_URB(irp) (irp)->tail.wrap_urb
+
+struct wmi_guid_reg_info {
+	struct guid *guid;
+	ULONG instance_count;
+	ULONG flags;
+};
+
+struct wmilib_context {
+	ULONG guid_count;
+	struct wmi_guid_reg_info *guid_list;
+	void *query_wmi_reg_info;
+	void *query_wmi_data_block;
+	void *set_wmi_data_block;
+	void *set_wmi_data_item;
+	void *execute_wmi_method;
+	void *wmi_function_control;
+};
+
+enum key_value_information_class {
+	KeyValueBasicInformation, KeyValueFullInformation,
+	KeyValuePartialInformation, KeyValueFullInformationAlign64,
+	KeyValuePartialInformationAlign64
+};
+
+struct file_name_info {
+	ULONG length;
+	wchar_t *name;
+};
+
+struct file_std_info {
+	LARGE_INTEGER alloc_size;
+	LARGE_INTEGER eof;
+	ULONG num_links;
+	BOOLEAN delete_pending;
+	BOOLEAN dir;
+};
+
+enum nt_obj_type {
+	NT_OBJ_EVENT = 10, NT_OBJ_MUTEX, NT_OBJ_THREAD, NT_OBJ_TIMER,
+	NT_OBJ_SEMAPHORE,
+};
+
+enum common_object_type {
+	OBJECT_TYPE_NONE, OBJECT_TYPE_DEVICE, OBJECT_TYPE_DRIVER,
+	OBJECT_TYPE_NT_THREAD, OBJECT_TYPE_FILE, OBJECT_TYPE_CALLBACK,
+};
+
+struct common_object_header {
+	struct nt_list list;
+	enum common_object_type type;
+	UINT size;
+	UINT ref_count;
+	BOOLEAN close_in_process;
+	BOOLEAN permanent;
+	struct unicode_string name;
+};
+
+#define OBJECT_TO_HEADER(object)					\
+	(struct common_object_header *)((void *)(object) -		\
+					sizeof(struct common_object_header))
+#define OBJECT_SIZE(size)				\
+	((size) + sizeof(struct common_object_header))
+#define HEADER_TO_OBJECT(hdr)					\
+	((void *)(hdr) + sizeof(struct common_object_header))
+#define HANDLE_TO_OBJECT(handle) HEADER_TO_OBJECT(handle)
+#define HANDLE_TO_HEADER(handle) (handle)
+
+enum work_queue_type {
+	CriticalWorkQueue, DelayedWorkQueue, HyperCriticalWorkQueue,
+	MaximumWorkQueue
+};
+
+typedef void (*NTOS_WORK_FUNC)(void *arg1, void *arg2) wstdcall;
+
+struct io_workitem {
+	enum work_queue_type type;
+	struct device_object *dev_obj;
+	NTOS_WORK_FUNC worker_routine;
+	void *context;
+};
+
+struct io_workitem_entry {
+	struct nt_list list;
+	struct io_workitem *io_workitem;
+};
+
+enum mm_page_priority {
+	LowPagePriority, NormalPagePriority = 16, HighPagePriority = 32
+};
+
+enum kinterrupt_mode {
+	LevelSensitive, Latched
+};
+
+enum ntos_wait_reason {
+	Executive, FreePage, PageIn, PoolAllocation, DelayExecution,
+	Suspended, UserRequest, WrExecutive, WrFreePage, WrPageIn,
+	WrPoolAllocation, WrDelayExecution, WrSuspended, WrUserRequest,
+	WrEventPair, WrQueue, WrLpcReceive, WrLpcReply, WrVirtualMemory,
+	WrPageOut, WrRendezvous, Spare2, Spare3, Spare4, Spare5, Spare6,
+	WrKernel, MaximumWaitReason
+};
+
+typedef enum ntos_wait_reason KWAIT_REASON;
+
+typedef void *LOOKASIDE_ALLOC_FUNC(enum pool_type pool_type,
+				   SIZE_T size, ULONG tag) wstdcall;
+typedef void LOOKASIDE_FREE_FUNC(void *) wstdcall;
+
+struct npaged_lookaside_list {
+	nt_slist_header head;
+	USHORT depth;
+	USHORT maxdepth;
+	ULONG totalallocs;
+	union {
+		ULONG allocmisses;
+		ULONG allochits;
+	} u1;
+	ULONG totalfrees;
+	union {
+		ULONG freemisses;
+		ULONG freehits;
+	} u2;
+	enum pool_type pool_type;
+	ULONG tag;
+	ULONG size;
+	LOOKASIDE_ALLOC_FUNC *alloc_func;
+	LOOKASIDE_FREE_FUNC *free_func;
+	struct nt_list list;
+	ULONG lasttotallocs;
+	union {
+		ULONG lastallocmisses;
+		ULONG lastallochits;
+	} u3;
+	ULONG pad[2];
+#ifndef CONFIG_X86_64
+	NT_SPIN_LOCK obsolete;
+#endif
+}
+#ifdef CONFIG_X86_64
+CACHE_ALIGN
+#endif
+;
+
+enum device_registry_property {
+	DevicePropertyDeviceDescription, DevicePropertyHardwareID,
+	DevicePropertyCompatibleIDs, DevicePropertyBootConfiguration,
+	DevicePropertyBootConfigurationTranslated,
+	DevicePropertyClassName, DevicePropertyClassGuid,
+	DevicePropertyDriverKeyName, DevicePropertyManufacturer,
+	DevicePropertyFriendlyName, DevicePropertyLocationInformation,
+	DevicePropertyPhysicalDeviceObjectName, DevicePropertyBusTypeGuid,
+	DevicePropertyLegacyBusType, DevicePropertyBusNumber,
+	DevicePropertyEnumeratorName, DevicePropertyAddress,
+	DevicePropertyUINumber, DevicePropertyInstallState,
+	DevicePropertyRemovalPolicy
+};
+
+enum trace_information_class {
+	TraceIdClass, TraceHandleClass, TraceEnableFlagsClass,
+	TraceEnableLevelClass, GlobalLoggerHandleClass, EventLoggerHandleClass,
+	AllLoggerHandlesClass, TraceHandleByNameClass
+};
+
+struct kinterrupt;
+typedef BOOLEAN (*PKSERVICE_ROUTINE)(struct kinterrupt *interrupt,
+				     void *context) wstdcall;
+typedef BOOLEAN (*PKSYNCHRONIZE_ROUTINE)(void *context) wstdcall;
+
+struct kinterrupt {
+	ULONG vector;
+	KAFFINITY cpu_mask;
+	NT_SPIN_LOCK lock;
+	NT_SPIN_LOCK *actual_lock;
+	BOOLEAN shared;
+	BOOLEAN save_fp;
+	union {
+		CHAR processor_number;
+#ifdef CONFIG_DEBUG_SHIRQ
+		CHAR enabled;
+#endif
+	} u;
+	PKSERVICE_ROUTINE isr;
+	void *isr_ctx;
+	struct nt_list list;
+	KIRQL irql;
+	KIRQL synch_irql;
+	enum kinterrupt_mode mode;
+};
+
+struct time_fields {
+	CSHORT year;
+	CSHORT month;
+	CSHORT day;
+	CSHORT hour;
+	CSHORT minute;
+	CSHORT second;
+	CSHORT milliseconds;
+	CSHORT weekday;
+};
+
+struct object_attributes {
+	ULONG length;
+	void *root_dir;
+	struct unicode_string *name;
+	ULONG attributes;
+	void *security_descr;
+	void *security_qos;
+};
+
+typedef void (*PCALLBACK_FUNCTION)(void *context, void *arg1,
+				   void *arg2) wstdcall;
+
+struct callback_object;
+struct callback_func {
+	PCALLBACK_FUNCTION func;
+	void *context;
+	struct nt_list list;
+	struct callback_object *object;
+};
+
+struct callback_object {
+	NT_SPIN_LOCK lock;
+	struct nt_list list;
+	struct nt_list callback_funcs;
+	BOOLEAN allow_multiple_callbacks;
+	struct object_attributes *attributes;
+};
+
+enum section_inherit {
+	ViewShare = 1, ViewUnmap = 2
+};
+
+struct ksystem_time {
+	ULONG low_part;
+	LONG high1_time;
+	LONG high2_time;
+};
+
+enum nt_product_type {
+	nt_product_win_nt = 1, nt_product_lan_man_nt, nt_product_server
+};
+
+enum alt_arch_type {
+	arch_type_standard, arch_type_nex98x86, end_alternatives
+};
+
+struct kuser_shared_data {
+	ULONG tick_count;
+	ULONG tick_count_multiplier;
+	volatile struct ksystem_time interrupt_time;
+	volatile struct ksystem_time system_time;
+	volatile struct ksystem_time time_zone_bias;
+	USHORT image_number_low;
+	USHORT image_number_high;
+	wchar_t nt_system_root[260];
+	ULONG max_stack_trace_depth;
+	ULONG crypto_exponent;
+	ULONG time_zone_id;
+	ULONG large_page_min;
+	ULONG reserved2[7];
+	enum nt_product_type nt_product_type;
+	BOOLEAN product_type_is_valid;
+	ULONG nt_major_version;
+	ULONG nt_minor_version;
+	BOOLEAN processor_features[PROCESSOR_FEATURE_MAX];
+	ULONG reserved1;
+	ULONG reserved3;
+	volatile LONG time_slip;
+	enum alt_arch_type alt_arch_type;
+	LARGE_INTEGER system_expiration_date;
+	ULONG suite_mask;
+	BOOLEAN kdbg_enabled;
+	volatile ULONG active_console;
+	volatile ULONG dismount_count;
+	ULONG com_plus_package;
+	ULONG last_system_rite_event_tick_count;
+	ULONG num_phys_pages;
+	BOOLEAN safe_boot_mode;
+	ULONG trace_log;
+	ULONGLONG fill0;
+	ULONGLONG sys_call[4];
+	union {
+		volatile struct ksystem_time tick_count;
+		volatile ULONG64 tick_count_quad;
+	} tick;
+};
+
+#define REG_NONE			(0)
+#define REG_SZ				(1)
+#define REG_EXPAND_SZ			(2)
+#define REG_BINARY			(3)
+#define REG_DWORD			(4)
+
+#define RTL_REGISTRY_ABSOLUTE		0
+#define RTL_REGISTRY_SERVICES		1
+#define RTL_REGISTRY_CONTROL		2
+#define RTL_REGISTRY_WINDOWS_NT		3
+#define RTL_REGISTRY_DEVICEMAP		4
+#define RTL_REGISTRY_USER		5
+#define RTL_REGISTRY_MAXIMUM		6
+#define RTL_REGISTRY_HANDLE		0x40000000
+#define RTL_REGISTRY_OPTIONAL		0x80000000
+
+#define RTL_QUERY_REGISTRY_SUBKEY	0x00000001
+#define RTL_QUERY_REGISTRY_TOPKEY	0x00000002
+#define RTL_QUERY_REGISTRY_REQUIRED	0x00000004
+#define RTL_QUERY_REGISTRY_NOVALUE	0x00000008
+#define RTL_QUERY_REGISTRY_NOEXPAND	0x00000010
+#define RTL_QUERY_REGISTRY_DIRECT	0x00000020
+#define RTL_QUERY_REGISTRY_DELETE	0x00000040
+
+typedef NTSTATUS (*PRTL_QUERY_REGISTRY_ROUTINE)(wchar_t *name, ULONG type,
+						void *data, ULONG length,
+						void *context,
+						void *entry) wstdcall;
+
+struct rtl_query_registry_table {
+	PRTL_QUERY_REGISTRY_ROUTINE query_func;
+	ULONG flags;
+	wchar_t *name;
+	void *context;
+	ULONG def_type;
+	void *def_data;
+	ULONG def_length;
+};
+
+struct io_remove_lock {
+	BOOLEAN removed;
+	BOOLEAN reserved[3];
+	LONG io_count;
+	struct nt_event remove_event;
+};
+
+struct io_error_log_packet {
+	UCHAR major_fn_code;
+	UCHAR retry_count;
+	USHORT dump_data_size;
+	USHORT nr_of_strings;
+	USHORT string_offset;
+	USHORT event_category;
+	NTSTATUS error_code;
+	ULONG unique_error_value;
+	NTSTATUS final_status;
+	ULONG sequence_number;
+	ULONG io_control_code;
+	LARGE_INTEGER device_offset;
+	ULONG dump_data[1];
+};
+
+/* some of the functions below are slightly different from DDK's
+ * implementation; e.g., Insert functions return appropriate
+ * pointer */
+
+/* instead of using Linux's lists, we implement list manipulation
+ * functions because nt_list is used by drivers and we don't want to
+ * worry about Linux's list being different from nt_list (right now
+ * they are same, but in future they could be different) */
+
+static inline void InitializeListHead(struct nt_list *head)
+{
+	head->next = head->prev = head;
+}
+
+static inline BOOLEAN IsListEmpty(struct nt_list *head)
+{
+	if (head == head->next)
+		return TRUE;
+	else
+		return FALSE;
+}
+
+static inline void RemoveEntryList(struct nt_list *entry)
+{
+	entry->prev->next = entry->next;
+	entry->next->prev = entry->prev;
+}
+
+static inline struct nt_list *RemoveHeadList(struct nt_list *head)
+{
+	struct nt_list *entry;
+
+	entry = head->next;
+	if (entry == head)
+		return NULL;
+	else {
+		RemoveEntryList(entry);
+		return entry;
+	}
+}
+
+static inline struct nt_list *RemoveTailList(struct nt_list *head)
+{
+	struct nt_list *entry;
+
+	entry = head->prev;
+	if (entry == head)
+		return NULL;
+	else {
+		RemoveEntryList(entry);
+		return entry;
+	}
+}
+
+static inline void InsertListEntry(struct nt_list *entry, struct nt_list *prev,
+				   struct nt_list *next)
+{
+	next->prev = entry;
+	entry->next = next;
+	entry->prev = prev;
+	prev->next = entry;
+}
+
+static inline struct nt_list *InsertHeadList(struct nt_list *head,
+					     struct nt_list *entry)
+{
+	struct nt_list *ret;
+
+	if (IsListEmpty(head))
+		ret = NULL;
+	else
+		ret = head->next;
+
+	InsertListEntry(entry, head, head->next);
+	return ret;
+}
+
+static inline struct nt_list *InsertTailList(struct nt_list *head,
+					     struct nt_list *entry)
+{
+	struct nt_list *ret;
+
+	if (IsListEmpty(head))
+		ret = NULL;
+	else
+		ret = head->prev;
+
+	InsertListEntry(entry, head->prev, head);
+	return ret;
+}
+
+#define nt_list_for_each(pos, head)					\
+	for (pos = (head)->next; pos != (head); pos = pos->next)
+
+#define nt_list_for_each_entry(pos, head, member)			\
+	for (pos = container_of((head)->next, typeof(*pos), member);	\
+	     &pos->member != (head);					\
+	     pos = container_of(pos->member.next, typeof(*pos), member))
+
+#define nt_list_for_each_safe(pos, n, head)		       \
+	for (pos = (head)->next, n = pos->next; pos != (head); \
+	     pos = n, n = pos->next)
+
+/* device object flags */
+#define DO_VERIFY_VOLUME		0x00000002
+#define DO_BUFFERED_IO			0x00000004
+#define DO_EXCLUSIVE			0x00000008
+#define DO_DIRECT_IO			0x00000010
+#define DO_MAP_IO_BUFFER		0x00000020
+#define DO_DEVICE_HAS_NAME		0x00000040
+#define DO_DEVICE_INITIALIZING		0x00000080
+#define DO_SYSTEM_BOOT_PARTITION	0x00000100
+#define DO_LONG_TERM_REQUESTS		0x00000200
+#define DO_NEVER_LAST_DEVICE		0x00000400
+#define DO_SHUTDOWN_REGISTERED		0x00000800
+#define DO_BUS_ENUMERATED_DEVICE	0x00001000
+#define DO_POWER_PAGABLE		0x00002000
+#define DO_POWER_INRUSH			0x00004000
+#define DO_LOW_PRIORITY_FILESYSTEM	0x00010000
+
+/* Various supported device types (used with IoCreateDevice()) */
+
+#define FILE_DEVICE_BEEP		0x00000001
+#define FILE_DEVICE_CD_ROM		0x00000002
+#define FILE_DEVICE_CD_ROM_FILE_SYSTEM	0x00000003
+#define FILE_DEVICE_CONTROLLER		0x00000004
+#define FILE_DEVICE_DATALINK		0x00000005
+#define FILE_DEVICE_DFS			0x00000006
+#define FILE_DEVICE_DISK		0x00000007
+#define FILE_DEVICE_DISK_FILE_SYSTEM	0x00000008
+#define FILE_DEVICE_FILE_SYSTEM		0x00000009
+#define FILE_DEVICE_INPORT_PORT		0x0000000A
+#define FILE_DEVICE_KEYBOARD		0x0000000B
+#define FILE_DEVICE_MAILSLOT		0x0000000C
+#define FILE_DEVICE_MIDI_IN		0x0000000D
+#define FILE_DEVICE_MIDI_OUT		0x0000000E
+#define FILE_DEVICE_MOUSE		0x0000000F
+#define FILE_DEVICE_MULTI_UNC_PROVIDER	0x00000010
+#define FILE_DEVICE_NAMED_PIPE		0x00000011
+#define FILE_DEVICE_NETWORK		0x00000012
+#define FILE_DEVICE_NETWORK_BROWSER	0x00000013
+#define FILE_DEVICE_NETWORK_FILE_SYSTEM	0x00000014
+#define FILE_DEVICE_NULL		0x00000015
+#define FILE_DEVICE_PARALLEL_PORT	0x00000016
+#define FILE_DEVICE_PHYSICAL_NETCARD	0x00000017
+#define FILE_DEVICE_PRINTER		0x00000018
+#define FILE_DEVICE_SCANNER		0x00000019
+#define FILE_DEVICE_SERIAL_MOUSE_PORT	0x0000001A
+#define FILE_DEVICE_SERIAL_PORT		0x0000001B
+#define FILE_DEVICE_SCREEN		0x0000001C
+#define FILE_DEVICE_SOUND		0x0000001D
+#define FILE_DEVICE_STREAMS		0x0000001E
+#define FILE_DEVICE_TAPE		0x0000001F
+#define FILE_DEVICE_TAPE_FILE_SYSTEM	0x00000020
+#define FILE_DEVICE_TRANSPORT		0x00000021
+#define FILE_DEVICE_UNKNOWN		0x00000022
+#define FILE_DEVICE_VIDEO		0x00000023
+#define FILE_DEVICE_VIRTUAL_DISK	0x00000024
+#define FILE_DEVICE_WAVE_IN		0x00000025
+#define FILE_DEVICE_WAVE_OUT		0x00000026
+#define FILE_DEVICE_8042_PORT		0x00000027
+#define FILE_DEVICE_NETWORK_REDIRECTOR	0x00000028
+#define FILE_DEVICE_BATTERY		0x00000029
+#define FILE_DEVICE_BUS_EXTENDER	0x0000002A
+#define FILE_DEVICE_MODEM		0x0000002B
+#define FILE_DEVICE_VDM			0x0000002C
+#define FILE_DEVICE_MASS_STORAGE	0x0000002D
+#define FILE_DEVICE_SMB			0x0000002E
+#define FILE_DEVICE_KS			0x0000002F
+#define FILE_DEVICE_CHANGER		0x00000030
+#define FILE_DEVICE_SMARTCARD		0x00000031
+#define FILE_DEVICE_ACPI		0x00000032
+#define FILE_DEVICE_DVD			0x00000033
+#define FILE_DEVICE_FULLSCREEN_VIDEO	0x00000034
+#define FILE_DEVICE_DFS_FILE_SYSTEM	0x00000035
+#define FILE_DEVICE_DFS_VOLUME		0x00000036
+#define FILE_DEVICE_SERENUM		0x00000037
+#define FILE_DEVICE_TERMSRV		0x00000038
+#define FILE_DEVICE_KSEC		0x00000039
+#define FILE_DEVICE_FIPS		0x0000003A
+
+/* Device characteristics */
+
+#define FILE_REMOVABLE_MEDIA		0x00000001
+#define FILE_READ_ONLY_DEVICE		0x00000002
+#define FILE_FLOPPY_DISKETTE		0x00000004
+#define FILE_WRITE_ONCE_MEDIA		0x00000008
+#define FILE_REMOTE_DEVICE		0x00000010
+#define FILE_DEVICE_IS_MOUNTED		0x00000020
+#define FILE_VIRTUAL_VOLUME		0x00000040
+#define FILE_AUTOGENERATED_DEVICE_NAME	0x00000080
+#define FILE_DEVICE_SECURE_OPEN		0x00000100
+
+#define FILE_READ_DATA			0x0001
+#define FILE_WRITE_DATA			0x0002
+
+#define FILE_SUPERSEDED			0x00000000
+#define FILE_OPENED			0x00000001
+#define FILE_CREATED			0x00000002
+#define FILE_OVERWRITTEN		0x00000003
+#define FILE_EXISTS			0x00000004
+#define FILE_DOES_NOT_EXIST		0x00000005
+
+
+#endif /* WINNT_TYPES_H */
--- linux-rt-2.6.31.orig/ubuntu/ndiswrapper/wrapmem.h
+++ linux-rt-2.6.31/ubuntu/ndiswrapper/wrapmem.h
@@ -0,0 +1,94 @@
+/*
+ *  Copyright (C) 2006 Giridhar Pemmasani
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ *  GNU General Public License for more details.
+ *
+ */
+
+#ifndef _WRAPMEM_H_
+
+/* set ALLOC_DEBUG to 1 to get information about memory used by both
+ * ndiswrapper and Windows driver by reading
+ * /proc/net/ndiswrapper/debug; this will also show memory leaks
+ * (memory allocated but not freed) when ndiswrapper module is
+ * unloaded.
+
+ * ALLOC_DEBUG=2: details about individual allocations leaking is printed
+ * ALLOC_DEBUG=3: tags in ExAllocatePoolWithTag leaking printed
+*/
+
+//#ifndef ALLOC_DEBUG
+//#define ALLOC_DEBUG 1
+//#endif
+
+enum alloc_type { ALLOC_TYPE_KMALLOC_ATOMIC, ALLOC_TYPE_KMALLOC_NON_ATOMIC,
+		  ALLOC_TYPE_VMALLOC_ATOMIC, ALLOC_TYPE_VMALLOC_NON_ATOMIC,
+		  ALLOC_TYPE_SLACK, ALLOC_TYPE_PAGES, ALLOC_TYPE_MAX };
+
+int wrapmem_init(void);
+void wrapmem_exit(void);
+void *slack_kmalloc(size_t size);
+void slack_kfree(void *ptr);
+void wrapmem_info(void);
+
+#ifdef ALLOC_DEBUG
+void *wrap_kmalloc(size_t size, gfp_t flags, const char *file, int line);
+void *wrap_kzalloc(size_t size, gfp_t flags, const char *file, int line);
+void wrap_kfree(void *ptr);
+void *wrap_vmalloc(unsigned long size, const char *file, int line);
+void *wrap__vmalloc(unsigned long size, gfp_t flags, pgprot_t prot,
+		    const char *file, int line);
+void wrap_vfree(void *ptr);
+void *wrap_alloc_pages(gfp_t flags, unsigned int size,
+		       const char *file, int line);
+void wrap_free_pages(unsigned long ptr, int order);
+int alloc_size(enum alloc_type type);
+
+#ifndef _WRAPMEM_C_
+#undef kmalloc
+#undef kzalloc
+#undef kfree
+#undef vmalloc
+#undef __vmalloc
+#undef vfree
+#define kmalloc(size, flags)				\
+	wrap_kmalloc(size, flags, __FILE__, __LINE__)
+#define kzalloc(size, flags)				\
+	wrap_kzalloc(size, flags, __FILE__, __LINE__)
+#define vmalloc(size)				\
+	wrap_vmalloc(size, __FILE__, __LINE__)
+#define __vmalloc(size, flags, prot)				\
+	wrap__vmalloc(size, flags, prot, __FILE__, __LINE__)
+#define kfree(ptr) wrap_kfree(ptr)
+#define vfree(ptr) wrap_vfree(ptr)
+
+#define wrap_get_free_pages(flags, size)			\
+	wrap_alloc_pages(flags, size, __FILE__, __LINE__)
+#undef free_pages
+#define free_pages(ptr, order) wrap_free_pages(ptr, order)
+
+#if ALLOC_DEBUG > 1
+void *wrap_ExAllocatePoolWithTag(enum pool_type pool_type, SIZE_T size,
+				 ULONG tag, const char *file, int line);
+#define ExAllocatePoolWithTag(pool_type, size, tag)			\
+	wrap_ExAllocatePoolWithTag(pool_type, size, tag, __FILE__, __LINE__)
+#endif
+
+#endif // _WRAPMEM_C_
+
+#else
+
+#define wrap_get_free_pages(flags, size)			\
+	(void *)__get_free_pages(flags, get_order(size))
+
+#endif // ALLOC_DEBUG
+
+#endif
--- linux-rt-2.6.31.orig/ubuntu/ndiswrapper/usb.h
+++ linux-rt-2.6.31/ubuntu/ndiswrapper/usb.h
@@ -0,0 +1,376 @@
+/*
+ *  Copyright (C) 2004 Jan Kiszka
+ *  Copyright (C) 2005 Giridhar Pemmasani
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ *  GNU General Public License for more details.
+ *
+ */
+
+#ifndef _USB_H_
+#define _USB_H_
+
+#include "ntoskernel.h"
+
+#define IOCTL_INTERNAL_USB_SUBMIT_URB			0x00220003
+#define IOCTL_INTERNAL_USB_RESET_PORT			0x00220007
+#define IOCTL_INTERNAL_USB_GET_PORT_STATUS		0x00220013
+#define IOCTL_INTERNAL_USB_CYCLE_PORT			0x0022001F
+#define IOCTL_INTERNAL_USB_SUBMIT_IDLE_NOTIFICATION	0x00220027
+
+#define URB_FUNCTION_SELECT_CONFIGURATION            0x0000
+#define URB_FUNCTION_SELECT_INTERFACE                0x0001
+#define URB_FUNCTION_ABORT_PIPE                      0x0002
+#define URB_FUNCTION_TAKE_FRAME_LENGTH_CONTROL       0x0003
+#define URB_FUNCTION_RELEASE_FRAME_LENGTH_CONTROL    0x0004
+#define URB_FUNCTION_GET_FRAME_LENGTH                0x0005
+#define URB_FUNCTION_SET_FRAME_LENGTH                0x0006
+#define URB_FUNCTION_GET_CURRENT_FRAME_NUMBER        0x0007
+#define URB_FUNCTION_CONTROL_TRANSFER                0x0008
+#define URB_FUNCTION_BULK_OR_INTERRUPT_TRANSFER      0x0009
+#define URB_FUNCTION_ISOCH_TRANSFER                  0x000A
+#define URB_FUNCTION_GET_DESCRIPTOR_FROM_DEVICE      0x000B
+#define URB_FUNCTION_SET_DESCRIPTOR_TO_DEVICE        0x000C
+#define URB_FUNCTION_SET_FEATURE_TO_DEVICE           0x000D
+#define URB_FUNCTION_SET_FEATURE_TO_INTERFACE        0x000E
+#define URB_FUNCTION_SET_FEATURE_TO_ENDPOINT         0x000F
+#define URB_FUNCTION_CLEAR_FEATURE_TO_DEVICE         0x0010
+#define URB_FUNCTION_CLEAR_FEATURE_TO_INTERFACE      0x0011
+#define URB_FUNCTION_CLEAR_FEATURE_TO_ENDPOINT       0x0012
+#define URB_FUNCTION_GET_STATUS_FROM_DEVICE          0x0013
+#define URB_FUNCTION_GET_STATUS_FROM_INTERFACE       0x0014
+#define URB_FUNCTION_GET_STATUS_FROM_ENDPOINT        0x0015
+#define URB_FUNCTION_RESERVED_0X0016                 0x0016
+#define URB_FUNCTION_VENDOR_DEVICE                   0x0017
+#define URB_FUNCTION_VENDOR_INTERFACE                0x0018
+#define URB_FUNCTION_VENDOR_ENDPOINT                 0x0019
+#define URB_FUNCTION_CLASS_DEVICE                    0x001A
+#define URB_FUNCTION_CLASS_INTERFACE                 0x001B
+#define URB_FUNCTION_CLASS_ENDPOINT                  0x001C
+#define URB_FUNCTION_RESERVE_0X001D                  0x001D
+#define URB_FUNCTION_SYNC_RESET_PIPE_AND_CLEAR_STALL 0x001E
+#define URB_FUNCTION_CLASS_OTHER                     0x001F
+#define URB_FUNCTION_VENDOR_OTHER                    0x0020
+#define URB_FUNCTION_GET_STATUS_FROM_OTHER           0x0021
+#define URB_FUNCTION_CLEAR_FEATURE_TO_OTHER          0x0022
+#define URB_FUNCTION_SET_FEATURE_TO_OTHER            0x0023
+#define URB_FUNCTION_GET_DESCRIPTOR_FROM_ENDPOINT    0x0024
+#define URB_FUNCTION_SET_DESCRIPTOR_TO_ENDPOINT      0x0025
+#define URB_FUNCTION_GET_CONFIGURATION               0x0026
+#define URB_FUNCTION_GET_INTERFACE                   0x0027
+#define URB_FUNCTION_GET_DESCRIPTOR_FROM_INTERFACE   0x0028
+#define URB_FUNCTION_SET_DESCRIPTOR_TO_INTERFACE     0x0029
+#define URB_FUNCTION_GET_MS_FEATURE_DESCRIPTOR       0x002A
+#define URB_FUNCTION_RESERVE_0X002B                  0x002B
+#define URB_FUNCTION_RESERVE_0X002C                  0x002C
+#define URB_FUNCTION_RESERVE_0X002D                  0x002D
+#define URB_FUNCTION_RESERVE_0X002E                  0x002E
+#define URB_FUNCTION_RESERVE_0X002F                  0x002F
+// USB 2.0 calls start at 0x0030
+#define URB_FUNCTION_SYNC_RESET_PIPE                 0x0030
+#define URB_FUNCTION_SYNC_CLEAR_STALL                0x0031
+#define URB_FUNCTION_CONTROL_TRANSFER_EX             0x0032
+
+#define USBD_PF_CHANGE_MAX_PACKET		0x00000001
+
+#define USBD_TRANSFER_DIRECTION_OUT		0
+#define USBD_TRANSFER_DIRECTION_IN		1
+
+#define USBD_SHORT_TRANSFER_OK			0x00000002
+#define USBD_START_ISO_TRANSFER_ASAP		0x00000004
+#define USBD_DEFAULT_PIPE_TRANSFER		0x00000008
+
+#define USBD_TRANSFER_DIRECTION(flags)		\
+	((flags) & USBD_TRANSFER_DIRECTION_IN)
+
+enum pipe_type {UsbdPipeTypeControl = USB_ENDPOINT_XFER_CONTROL,
+		UsbdPipeTypeIsochronous = USB_ENDPOINT_XFER_ISOC,
+		UsbdPipeTypeBulk = USB_ENDPOINT_XFER_BULK,
+		UsbdPipeTypeInterrupt = USB_ENDPOINT_XFER_INT};
+
+#define USBD_IS_BULK_PIPE(pipe_handle)					\
+	(((pipe_handle)->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK)	\
+	 == USB_ENDPOINT_XFER_BULK)
+
+#define USBD_IS_INT_PIPE(pipe_handle)					\
+	(((pipe_handle)->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK)	\
+	 == USB_ENDPOINT_XFER_INT)
+
+#define USBD_PORT_ENABLED			0x00000001
+#define USBD_PORT_CONNECTED			0x00000002
+
+typedef LONG USBD_STATUS;
+
+#define USBD_STATUS_SUCCESS			0x0
+#define USBD_STATUS_PENDING			0x40000000
+#define USBD_STATUS_CANCELED			0x00010000
+
+#define USBD_STATUS_CRC				0xC0000001
+#define USBD_STATUS_BTSTUFF			0xC0000002
+#define USBD_STATUS_DATA_TOGGLE_MISMATCH	0xC0000003
+#define USBD_STATUS_STALL_PID			0xC0000004
+#define USBD_STATUS_DEV_NOT_RESPONDING		0xC0000005
+#define USBD_STATUS_PID_CHECK_FAILURE		0xC0000006
+#define USBD_STATUS_UNEXPECTED_PID	     	0xC0000007
+#define USBD_STATUS_DATA_OVERRUN		0xC0000008
+#define USBD_STATUS_DATA_UNDERRUN		0xC0000009
+#define USBD_STATUS_RESERVED1			0xC000000A
+#define USBD_STATUS_RESERVED2			0xC000000B
+#define USBD_STATUS_BUFFER_OVERRUN		0xC000000C
+#define USBD_STATUS_BUFFER_UNDERRUN		0xC000000D
+#define USBD_STATUS_NOT_ACCESSED		0xC000000F
+#define USBD_STATUS_FIFO			0xC0000010
+#define USBD_STATUS_XACT_ERROR			0xC0000011
+#define USBD_STATUS_BABBLE_DETECTED		0xC0000012
+#define USBD_STATUS_DATA_BUFFER_ERROR		0xC0000013
+
+#define USBD_STATUS_NOT_SUPPORTED		0xC0000E00
+#define USBD_STATUS_BUFFER_TOO_SMALL		0xC0003000
+#define USBD_STATUS_TIMEOUT			0xC0006000
+#define USBD_STATUS_DEVICE_GONE			0xC0007000
+
+#define USBD_STATUS_NO_MEMORY			0x80000100
+#define USBD_STATUS_INVALID_URB_FUNCTION	0x80000200
+#define USBD_STATUS_INVALID_PARAMETER		0x80000300
+#define USBD_STATUS_REQUEST_FAILED		0x80000500
+#define USBD_STATUS_INVALID_PIPE_HANDLE		0x80000600
+#define USBD_STATUS_ERROR_SHORT_TRANSFER	0x80000900
+
+#define USBD_DEFAULT_MAXIMUM_TRANSFER_SIZE	PAGE_SIZE
+
+struct urb_hcd_area {
+	void *reserved8[8];
+};
+
+typedef struct usb_endpoint_descriptor *usbd_pipe_handle;
+typedef struct usb_descriptor_header usb_common_descriptor_t;
+
+struct usbd_pipe_information {
+	USHORT wMaxPacketSize;
+	UCHAR bEndpointAddress;
+	UCHAR bInterval;
+	enum pipe_type type;
+	usbd_pipe_handle handle;
+	ULONG max_tx_size;
+	ULONG flags;
+};
+
+struct usbd_interface_information {
+	USHORT bLength;
+	UCHAR bInterfaceNumber;
+	UCHAR bAlternateSetting;
+	UCHAR bInterfaceClass;
+	UCHAR bInterfaceSubClass;
+	UCHAR bInterfaceProtocol;
+	UCHAR reserved;
+	void *handle;
+	ULONG bNumEndpoints;
+	struct usbd_pipe_information pipes[1];
+};
+
+struct usbd_interface_list_entry {
+	struct usb_interface_descriptor *intf_desc;
+	struct usbd_interface_information *intf;
+};
+
+struct nt_urb_header {
+	USHORT length;
+	USHORT function;
+	USBD_STATUS status;
+	void *usbd_dev_handle;
+	ULONG usbd_flags;
+};
+
+struct usbd_select_interface {
+	struct nt_urb_header header;
+	void *handle;
+	struct usbd_interface_information intf;
+};
+
+struct usbd_select_configuration {
+	struct nt_urb_header header;
+	struct usb_config_descriptor *config;
+	void *handle;
+	struct usbd_interface_information intf;
+};
+
+struct usbd_control_descriptor_request {
+	struct nt_urb_header header;
+	void *reserved;
+	ULONG reserved0;
+	ULONG transfer_buffer_length;
+	void *transfer_buffer;
+	struct mdl *mdl;
+	union nt_urb *urb_link;
+	struct urb_hcd_area hca;
+	USHORT reserved1;
+	UCHAR index;
+	UCHAR desc_type;
+	USHORT language_id;
+	USHORT reserved2;
+};
+
+struct usbd_bulk_or_intr_transfer {
+	struct nt_urb_header header;
+	usbd_pipe_handle pipe_handle;
+	ULONG transfer_flags;
+	ULONG transfer_buffer_length;
+	void *transfer_buffer;
+	struct mdl *mdl;
+	union nt_urb *urb_link;
+	struct urb_hcd_area hca;
+};
+
+struct usbd_pipe_request {
+	struct nt_urb_header header;
+	usbd_pipe_handle pipe_handle;
+};
+
+struct usbd_vendor_or_class_request {
+	struct nt_urb_header header;
+	void *reserved;
+	ULONG transfer_flags;
+	ULONG transfer_buffer_length;
+	void *transfer_buffer;
+	struct mdl *mdl;
+	union nt_urb *link;
+	struct urb_hcd_area hca;
+	UCHAR reserved_bits;
+	UCHAR request;
+	USHORT value;
+	USHORT index;
+	USHORT reserved1;
+};
+
+struct urb_control_feature_request {
+	struct nt_urb_header header;
+	void *reserved;
+	ULONG reserved2;
+	ULONG reserved3;
+	void *reserved4;
+	struct mdl *reserved5;
+	union nt_urb *link;
+	struct urb_hcd_area hca;
+	USHORT reserved0;
+	USHORT feature_selector;
+	USHORT index;
+	USHORT reserved1;
+};
+
+struct urb_control_get_status_request {
+	struct nt_urb_header header;
+	void *reserved;
+	ULONG reserved0;
+	ULONG transfer_buffer_length;
+	void *transfer_buffer;
+	struct mdl *mdl;
+	union nt_urb *link;
+	struct urb_hcd_area hca;
+	UCHAR reserved1[4];
+	USHORT index;
+	USHORT reserved2;
+};
+
+struct usbd_iso_packet_desc {
+	ULONG offset;
+	ULONG length;
+	USBD_STATUS status;
+};
+
+struct usbd_isochronous_transfer {
+	struct nt_urb_header header;
+	usbd_pipe_handle pipe_handle;
+	ULONG transfer_flags;
+	ULONG transfer_buffer_length;
+	void *transfer_buffer;
+	struct mdl *mdl;
+	union nt_urb *urb_link;
+	struct urb_hcd_area hca;
+	ULONG start_frame;
+	ULONG number_of_packets;
+	ULONG error_count;
+	struct usbd_iso_packet_desc iso_packet[1];
+};
+
+union nt_urb {
+	struct nt_urb_header header;
+	struct usbd_select_interface select_intf;
+	struct usbd_select_configuration select_conf;
+	struct usbd_bulk_or_intr_transfer bulk_int_transfer;
+	struct usbd_control_descriptor_request control_desc;
+	struct usbd_vendor_or_class_request vendor_class_request;
+	struct usbd_isochronous_transfer isochronous;
+	struct usbd_pipe_request pipe_req;
+	struct urb_control_feature_request feat_req;
+	struct urb_control_get_status_request status_req;
+};
+
+struct usbd_bus_interface_usbdi {
+	USHORT Size;
+	USHORT Version;
+	void *Context;
+	void *InterfaceReference;
+	void *InterfaceDereference;
+	void *GetUSBDIVersion;
+	void *QueryBusTime;
+	void *SubmitIsoOutUrb;
+	void *QueryBusInformation;
+	/* version 1 and above have following field */
+	void *IsDeviceHighSpeed;
+	/* version 2 (and above) have following field */
+	void *LogEntry;
+};
+
+struct usbd_bus_information_level {
+	ULONG TotalBandwidth;
+	ULONG ConsumedBandwidth;
+	/* level 1 and above have following fields */
+	ULONG ControllerNameLength;
+	wchar_t ControllerName[1];
+};
+
+#define USBDI_VERSION_XP			0x00000500 // Windows XP
+#define USB_HCD_CAPS_SUPPORTS_RT_THREADS	0x00000001
+#define USB_BUSIF_USBDI_VERSION_0		0x0000
+#define USB_BUSIF_USBDI_VERSION_1		0x0001
+#define USB_BUSIF_USBDI_VERSION_2		0x0002
+
+struct usbd_version_info {
+	ULONG usbdi_version;
+	ULONG supported_usb_version;
+};
+
+struct usbd_idle_callback {
+	void *callback;
+	void *context;
+};
+
+#define NT_URB_STATUS(nt_urb) ((nt_urb)->header.status)
+
+NTSTATUS wrap_submit_irp(struct device_object *pdo, struct irp *irp);
+void wrap_suspend_urbs(struct wrap_device *wd);
+void wrap_resume_urbs(struct wrap_device *wd);
+
+void USBD_InterfaceGetUSBDIVersion(void *context,
+				   struct usbd_version_info *version_info,
+				   ULONG *hcd_capa) wstdcall;
+BOOLEAN USBD_InterfaceIsDeviceHighSpeed(void *context) wstdcall;
+void USBD_InterfaceReference(void *context) wstdcall;
+void USBD_InterfaceDereference(void *context) wstdcall;
+NTSTATUS USBD_InterfaceQueryBusTime(void *context, ULONG *frame) wstdcall;
+NTSTATUS USBD_InterfaceSubmitIsoOutUrb(void *context,
+				       union nt_urb *nt_urb) wstdcall;
+NTSTATUS USBD_InterfaceQueryBusInformation(void *context, ULONG level, void *buf,
+					   ULONG *buf_length,
+					   ULONG *buf_actual_length) wstdcall;
+NTSTATUS USBD_InterfaceLogEntry(void *context, ULONG driver_tag, ULONG enum_tag,
+				ULONG p1, ULONG p2) wstdcall;
+
+#endif /* USB_H */
--- linux-rt-2.6.31.orig/ubuntu/ndiswrapper/pe_linker.c
+++ linux-rt-2.6.31/ubuntu/ndiswrapper/pe_linker.c
@@ -0,0 +1,609 @@
+/*
+ *  Copyright (C) 2003-2005 Pontus Fuchs, Giridhar Pemmasani
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ *  GNU General Public License for more details.
+ *
+ */
+
+#ifdef TEST_LOADER
+
+#include "usr_linker.h"
+
+#else
+
+#include <linux/types.h>
+#include <asm/errno.h>
+
+//#define DEBUGLINKER 2
+
+#include "ntoskernel.h"
+
+#endif
+
+struct pe_exports {
+	char *dll;
+	char *name;
+	generic_func addr;
+};
+
+static struct pe_exports pe_exports[40];
+static int num_pe_exports;
+
+#define RVA2VA(image, rva, type) (type)(ULONG_PTR)((void *)image + rva)
+#define CHECK_SZ(a,b) { if (sizeof(a) != b) {				\
+			ERROR("%s is bad, got %zd, expected %d",	\
+			      #a , sizeof(a), (b)); return -EINVAL; } }
+
+#if defined(DEBUGLINKER) && DEBUGLINKER > 0
+#define DBGLINKER(fmt, ...) printk(KERN_INFO "%s (%s:%d): " fmt "\n",	\
+				   DRIVER_NAME, __func__,		\
+				   __LINE__ , ## __VA_ARGS__);
+static const char *image_directory_name[] = {
+	"EXPORT",
+	"IMPORT",
+	"RESOURCE",
+	"EXCEPTION",
+	"SECURITY",
+	"BASERELOC",
+	"DEBUG",
+	"COPYRIGHT",
+	"GLOBALPTR",
+	"TLS",
+	"LOAD_CONFIG",
+	"BOUND_IMPORT",
+	"IAT",
+	"DELAY_IMPORT",
+	"COM_DESCRIPTOR" };
+#else
+#define DBGLINKER(fmt, ...) do { } while (0)
+#endif
+
+#ifndef TEST_LOADER
+extern struct wrap_export ntoskernel_exports[], ntoskernel_io_exports[],
+	ndis_exports[], crt_exports[], hal_exports[], rtl_exports[];
+#ifdef ENABLE_USB
+extern struct wrap_export usb_exports[];
+#endif
+
+static char *get_export(char *name)
+{
+	int i;
+
+	for (i = 0 ; ntoskernel_exports[i].name != NULL; i++)
+		if (strcmp(ntoskernel_exports[i].name, name) == 0)
+			return (char *)ntoskernel_exports[i].func;
+
+	for (i = 0 ; ntoskernel_io_exports[i].name != NULL; i++)
+		if (strcmp(ntoskernel_io_exports[i].name, name) == 0)
+			return (char *)ntoskernel_io_exports[i].func;
+
+	for (i = 0 ; ndis_exports[i].name != NULL; i++)
+		if (strcmp(ndis_exports[i].name, name) == 0)
+			return (char *)ndis_exports[i].func;
+
+	for (i = 0 ; crt_exports[i].name != NULL; i++)
+		if (strcmp(crt_exports[i].name, name) == 0)
+			return (char *)crt_exports[i].func;
+
+	for (i = 0 ; hal_exports[i].name != NULL; i++)
+		if (strcmp(hal_exports[i].name, name) == 0)
+			return (char *)hal_exports[i].func;
+
+	for (i = 0 ; rtl_exports[i].name != NULL; i++)
+		if (strcmp(rtl_exports[i].name, name) == 0)
+			return (char *)rtl_exports[i].func;
+
+#ifdef ENABLE_USB
+	for (i = 0 ; usb_exports[i].name != NULL; i++)
+		if (strcmp(usb_exports[i].name, name) == 0)
+			return (char *)usb_exports[i].func;
+#endif
+
+	for (i = 0; i < num_pe_exports; i++)
+		if (strcmp(pe_exports[i].name, name) == 0)
+			return (char *)pe_exports[i].addr;
+
+	return NULL;
+}
+#endif // TEST_LOADER
+
+static void *get_dll_init(char *name)
+{
+	int i;
+	for (i = 0; i < num_pe_exports; i++)
+		if ((strcmp(pe_exports[i].dll, name) == 0) &&
+		    (strcmp(pe_exports[i].name, "DllInitialize") == 0))
+			return (void *)pe_exports[i].addr;
+	return NULL;
+}
+
+/*
+ * Find and validate the coff header
+ *
+ */
+static int check_nt_hdr(IMAGE_NT_HEADERS *nt_hdr)
+{
+	int i;
+	WORD attr;
+	PIMAGE_OPTIONAL_HEADER opt_hdr;
+
+	/* Validate the "PE\0\0" signature */
+	if (nt_hdr->Signature != IMAGE_NT_SIGNATURE) {
+		ERROR("is this driver file? bad signature %08x",
+		      nt_hdr->Signature);
+		return -EINVAL;
+	}
+
+	opt_hdr = &nt_hdr->OptionalHeader;
+	/* Make sure Image is PE32 or PE32+ */
+#ifdef CONFIG_X86_64
+	if (opt_hdr->Magic != IMAGE_NT_OPTIONAL_HDR64_MAGIC) {
+		ERROR("kernel is 64-bit, but Windows driver is not 64-bit;"
+		      "bad magic: %04X", opt_hdr->Magic);
+		return -EINVAL;
+	}
+#else
+	if (opt_hdr->Magic != IMAGE_NT_OPTIONAL_HDR32_MAGIC) {
+		ERROR("kernel is 32-bit, but Windows driver is not 32-bit;"
+		      "bad magic: %04X", opt_hdr->Magic);
+		return -EINVAL;
+	}
+#endif
+
+	/* Validate the image for the current architecture. */
+#ifdef CONFIG_X86_64
+	if (nt_hdr->FileHeader.Machine != IMAGE_FILE_MACHINE_AMD64) {
+		ERROR("kernel is 64-bit, but Windows driver is not 64-bit;"
+		      " (PE signature is %04X)", nt_hdr->FileHeader.Machine);
+		return -EINVAL;
+	}
+#else
+	if (nt_hdr->FileHeader.Machine != IMAGE_FILE_MACHINE_I386) {
+		ERROR("kernel is 32-bit, but Windows driver is not 32-bit;"
+		      " (PE signature is %04X)", nt_hdr->FileHeader.Machine);
+		return -EINVAL;
+	}
+#endif
+
+	/* Must have attributes */
+#ifdef CONFIG_X86_64
+	attr = IMAGE_FILE_EXECUTABLE_IMAGE | IMAGE_FILE_LARGE_ADDRESS_AWARE;
+#else
+	attr = IMAGE_FILE_EXECUTABLE_IMAGE | IMAGE_FILE_32BIT_MACHINE;
+#endif
+	if ((nt_hdr->FileHeader.Characteristics & attr) != attr)
+		return -EINVAL;
+
+	/* Must be relocatable */
+	attr = IMAGE_FILE_RELOCS_STRIPPED;
+	if ((nt_hdr->FileHeader.Characteristics & attr))
+		return -EINVAL;
+
+	/* Make sure we have at least one section */
+	if (nt_hdr->FileHeader.NumberOfSections == 0)
+		return -EINVAL;
+
+	if (opt_hdr->SectionAlignment < opt_hdr->FileAlignment) {
+		ERROR("alignment mismatch: secion: 0x%x, file: 0x%x",
+		      opt_hdr->SectionAlignment, opt_hdr->FileAlignment);
+		return -EINVAL;
+	}
+
+	DBGLINKER("number of datadictionary entries %d",
+		  opt_hdr->NumberOfRvaAndSizes);
+	for (i = 0; i < opt_hdr->NumberOfRvaAndSizes; i++) {
+		DBGLINKER("datadirectory %s RVA:%X Size:%d",
+			  (i<=IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR)?
+			  image_directory_name[i] : "unknown",
+			  opt_hdr->DataDirectory[i].VirtualAddress,
+			  opt_hdr->DataDirectory[i].Size);
+	}
+
+	if ((nt_hdr->FileHeader.Characteristics & IMAGE_FILE_EXECUTABLE_IMAGE))
+		return IMAGE_FILE_EXECUTABLE_IMAGE;
+	if ((nt_hdr->FileHeader.Characteristics & IMAGE_FILE_DLL))
+		return IMAGE_FILE_DLL;
+	return -EINVAL;
+}
+
+static int import(void *image, IMAGE_IMPORT_DESCRIPTOR *dirent, char *dll)
+{
+	ULONG_PTR *lookup_tbl, *address_tbl;
+	char *symname = NULL;
+	int i;
+	int ret = 0;
+	void *adr;
+
+	lookup_tbl  = RVA2VA(image, dirent->u.OriginalFirstThunk, ULONG_PTR *);
+	address_tbl = RVA2VA(image, dirent->FirstThunk, ULONG_PTR *);
+
+	for (i = 0; lookup_tbl[i]; i++) {
+		if (IMAGE_SNAP_BY_ORDINAL(lookup_tbl[i])) {
+			ERROR("ordinal import not supported: %Lu",
+			      (uint64_t)lookup_tbl[i]);
+			return -1;
+		}
+		else {
+			symname = RVA2VA(image,
+					 ((lookup_tbl[i] &
+					   ~IMAGE_ORDINAL_FLAG) + 2), char *);
+		}
+
+		adr = get_export(symname);
+		if (adr == NULL) {
+			ERROR("unknown symbol: %s:'%s'", dll, symname);
+			ret = -1;
+		} else {
+			DBGLINKER("found symbol: %s:%s: addr: %p, rva = %Lu",
+				  dll, symname, adr, (uint64_t)address_tbl[i]);
+			address_tbl[i] = (ULONG_PTR)adr;
+		}
+	}
+	return ret;
+}
+
+static int read_exports(struct pe_image *pe)
+{
+	IMAGE_EXPORT_DIRECTORY *export_dir_table;
+	uint32_t *export_addr_table;
+	int i;
+	uint32_t *name_table;
+	PIMAGE_OPTIONAL_HEADER opt_hdr;
+	IMAGE_DATA_DIRECTORY *export_data_dir;
+
+	opt_hdr = &pe->nt_hdr->OptionalHeader;
+	export_data_dir =
+		&opt_hdr->DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];
+
+	if (export_data_dir->Size == 0) {
+		DBGLINKER("no exports");
+		return 0;
+	}
+
+	export_dir_table =
+		RVA2VA(pe->image, export_data_dir->VirtualAddress,
+		       IMAGE_EXPORT_DIRECTORY *);
+
+	name_table = (unsigned int *)(pe->image +
+				      export_dir_table->AddressOfNames);
+	export_addr_table = (uint32_t *)
+		(pe->image + export_dir_table->AddressOfFunctions);
+
+	for (i = 0; i < export_dir_table->NumberOfNames; i++) {
+
+		if (export_data_dir->VirtualAddress <= *export_addr_table ||
+		    *export_addr_table >= (export_data_dir->VirtualAddress +
+					   export_data_dir->Size))
+			DBGLINKER("forwarder rva");
+
+		DBGLINKER("export symbol: %s, at %p",
+			  (char *)(pe->image + *name_table),
+			  pe->image + *export_addr_table);
+
+		pe_exports[num_pe_exports].dll = pe->name;
+		pe_exports[num_pe_exports].name = pe->image + *name_table;
+		pe_exports[num_pe_exports].addr =
+			pe->image + *export_addr_table;
+
+		num_pe_exports++;
+		name_table++;
+		export_addr_table++;
+	}
+	return 0;
+}
+
+static int fixup_imports(void *image, IMAGE_NT_HEADERS *nt_hdr)
+{
+	int i;
+	char *name;
+	int ret = 0;
+	IMAGE_IMPORT_DESCRIPTOR *dirent;
+	IMAGE_DATA_DIRECTORY *import_data_dir;
+	PIMAGE_OPTIONAL_HEADER opt_hdr;
+
+	opt_hdr = &nt_hdr->OptionalHeader;
+	import_data_dir =
+		&opt_hdr->DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT];
+	dirent = RVA2VA(image, import_data_dir->VirtualAddress,
+			IMAGE_IMPORT_DESCRIPTOR *);
+
+	for (i = 0; dirent[i].Name; i++) {
+		name = RVA2VA(image, dirent[i].Name, char*);
+
+		DBGLINKER("imports from dll: %s", name);
+		ret += import(image, &dirent[i], name);
+	}
+	return ret;
+}
+
+static int fixup_reloc(void *image, IMAGE_NT_HEADERS *nt_hdr)
+{
+	ULONG_PTR base;
+	ULONG_PTR size;
+	IMAGE_BASE_RELOCATION *fixup_block;
+	IMAGE_DATA_DIRECTORY *base_reloc_data_dir;
+	PIMAGE_OPTIONAL_HEADER opt_hdr;
+
+	opt_hdr = &nt_hdr->OptionalHeader;
+	base = opt_hdr->ImageBase;
+	base_reloc_data_dir =
+		&opt_hdr->DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC];
+	if (base_reloc_data_dir->Size == 0)
+		return 0;
+
+	fixup_block = RVA2VA(image, base_reloc_data_dir->VirtualAddress,
+			     IMAGE_BASE_RELOCATION *);
+	DBGLINKER("fixup_block=%p, image=%p", fixup_block, image);
+	DBGLINKER("fixup_block info: %x %d",
+		  fixup_block->VirtualAddress, fixup_block->SizeOfBlock);
+
+	while (fixup_block->SizeOfBlock) {
+		int i;
+		WORD fixup, offset;
+
+		size = (fixup_block->SizeOfBlock -
+			sizeof(IMAGE_BASE_RELOCATION)) / sizeof(WORD);
+		DBGLINKER("found %Lu relocations in this block",
+			  (uint64_t)size);
+
+		for (i = 0; i < size; i++) {
+			fixup = fixup_block->TypeOffset[i];
+			offset = fixup & 0xfff;
+			switch ((fixup >> 12) & 0x0f) {
+			case IMAGE_REL_BASED_ABSOLUTE:
+				break;
+
+			case IMAGE_REL_BASED_HIGHLOW: {
+				uint32_t addr;
+				uint32_t *loc =
+					RVA2VA(image,
+					       fixup_block->VirtualAddress +
+					       offset, uint32_t *);
+				addr = RVA2VA(image, (*loc - base), uint32_t);
+				DBGLINKER("relocation: *%p (Val:%X)= %X",
+					  loc, *loc, addr);
+				*loc = addr;
+			}
+				break;
+
+			case IMAGE_REL_BASED_DIR64: {
+				uint64_t addr;
+				uint64_t *loc =
+					RVA2VA(image,
+					       fixup_block->VirtualAddress +
+					       offset, uint64_t *);
+				addr = RVA2VA(image, (*loc - base), uint64_t);
+				DBGLINKER("relocation: *%p (Val:%llX)= %llx",
+					  loc, *loc, addr);
+				*loc = addr;
+			}
+				break;
+
+			default:
+				ERROR("unknown fixup: %08X",
+				      (fixup >> 12) & 0x0f);
+				return -EOPNOTSUPP;
+				break;
+			}
+		}
+		DBGLINKER("finished relocating block");
+
+		fixup_block = (IMAGE_BASE_RELOCATION *)
+			((void *)fixup_block + fixup_block->SizeOfBlock);
+	};
+	DBGLINKER("done relocating all");
+
+	return 0;
+}
+
+/* Expand the image in memroy if necessary. The image on disk does not
+ * necessarily maps the image of the driver in memory, so we have to
+ * re-write it in order to fullfill the sections alignements. The
+ * advantage to do that is that rva_to_va becomes a simple
+ * addition. */
+static int fix_pe_image(struct pe_image *pe)
+{
+	void *image;
+	IMAGE_SECTION_HEADER *sect_hdr;
+	int i, sections;
+	int image_size;
+
+	if (pe->size == pe->opt_hdr->SizeOfImage) {
+		/* Nothing to do */
+		return 0;
+	}
+
+	image_size = pe->opt_hdr->SizeOfImage;
+#ifdef CONFIG_X86_64
+#ifdef PAGE_KERNEL_EXECUTABLE
+	image = __vmalloc(image_size, GFP_KERNEL | __GFP_HIGHMEM,
+			  PAGE_KERNEL_EXECUTABLE);
+#elif defined PAGE_KERNEL_EXEC
+	image = __vmalloc(image_size, GFP_KERNEL | __GFP_HIGHMEM,
+			  PAGE_KERNEL_EXEC);
+#else
+#error x86_64 should have either PAGE_KERNEL_EXECUTABLE or PAGE_KERNEL_EXEC
+#endif
+#else
+#ifdef cpu_has_nx
+	/* hate to play with kernel macros, but PAGE_KERNEL_EXEC is
+	 * not available to modules! */
+	if (cpu_has_nx)
+		image = __vmalloc(image_size, GFP_KERNEL | __GFP_HIGHMEM,
+				  __pgprot(__PAGE_KERNEL & ~_PAGE_NX));
+	else
+		image = vmalloc(image_size);
+#else
+		image = vmalloc(image_size);
+#endif
+#endif
+	if (image == NULL) {
+		ERROR("failed to allocate enough space for new image:"
+		      " %d bytes", image_size);
+		return -ENOMEM;
+	}
+
+	/* Copy all the headers, ie everything before the first section. */
+
+	sections = pe->nt_hdr->FileHeader.NumberOfSections;
+	sect_hdr = IMAGE_FIRST_SECTION(pe->nt_hdr);
+
+	DBGLINKER("copying headers: %u bytes", sect_hdr->PointerToRawData);
+
+	memcpy(image, pe->image, sect_hdr->PointerToRawData);
+
+	/* Copy all the sections */
+	for (i = 0; i < sections; i++) {
+		DBGLINKER("Copy section %s from %x to %x",
+			  sect_hdr->Name, sect_hdr->PointerToRawData,
+			  sect_hdr->VirtualAddress);
+		if (sect_hdr->VirtualAddress+sect_hdr->SizeOfRawData >
+		    image_size) {
+			ERROR("Invalid section %s in driver", sect_hdr->Name);
+			vfree(image);
+			return -EINVAL;
+		}
+
+		memcpy(image+sect_hdr->VirtualAddress,
+		       pe->image + sect_hdr->PointerToRawData,
+		       sect_hdr->SizeOfRawData);
+		sect_hdr++;
+	}
+
+	vfree(pe->image);
+	pe->image = image;
+	pe->size = image_size;
+
+	/* Update our internal pointers */
+	pe->nt_hdr = (IMAGE_NT_HEADERS *)
+		(pe->image + ((IMAGE_DOS_HEADER *)pe->image)->e_lfanew);
+	pe->opt_hdr = &pe->nt_hdr->OptionalHeader;
+
+	DBGLINKER("set nt headers: nt_hdr=%p, opt_hdr=%p, image=%p",
+		  pe->nt_hdr, pe->opt_hdr, pe->image);
+
+	return 0;
+}
+
+#if defined(CONFIG_X86_64)
+static void fix_user_shared_data_addr(char *driver, unsigned long length)
+{
+	unsigned long i, n, max_addr, *addr;
+
+	n = length - sizeof(unsigned long);
+	max_addr = KI_USER_SHARED_DATA + sizeof(kuser_shared_data);
+	for (i = 0; i < n; i++) {
+		addr = (unsigned long *)(driver + i);
+		if (*addr >= KI_USER_SHARED_DATA && *addr < max_addr) {
+			*addr -= KI_USER_SHARED_DATA;
+			*addr += (unsigned long)&kuser_shared_data;
+			kuser_shared_data.reserved1 = 1;
+		}
+	}
+}
+#endif
+
+int link_pe_images(struct pe_image *pe_image, unsigned short n)
+{
+	int i;
+	struct pe_image *pe;
+
+#ifdef DEBUG
+	/* Sanity checkings */
+	CHECK_SZ(IMAGE_SECTION_HEADER, IMAGE_SIZEOF_SECTION_HEADER);
+	CHECK_SZ(IMAGE_FILE_HEADER, IMAGE_SIZEOF_FILE_HEADER);
+	CHECK_SZ(IMAGE_OPTIONAL_HEADER, IMAGE_SIZEOF_NT_OPTIONAL_HEADER);
+	CHECK_SZ(IMAGE_NT_HEADERS, 4 + IMAGE_SIZEOF_FILE_HEADER +
+		 IMAGE_SIZEOF_NT_OPTIONAL_HEADER);
+	CHECK_SZ(IMAGE_DOS_HEADER, 0x40);
+	CHECK_SZ(IMAGE_EXPORT_DIRECTORY, 40);
+	CHECK_SZ(IMAGE_BASE_RELOCATION, 8);
+	CHECK_SZ(IMAGE_IMPORT_DESCRIPTOR, 20);
+#endif
+
+	for (i = 0; i < n; i++) {
+		IMAGE_DOS_HEADER *dos_hdr;
+		pe = &pe_image[i];
+		dos_hdr = pe->image;
+
+		if (pe->size < sizeof(IMAGE_DOS_HEADER)) {
+			TRACE1("image too small: %d", pe->size);
+			return -EINVAL;
+		}
+
+		pe->nt_hdr =
+			(IMAGE_NT_HEADERS *)(pe->image + dos_hdr->e_lfanew);
+		pe->opt_hdr = &pe->nt_hdr->OptionalHeader;
+
+		pe->type = check_nt_hdr(pe->nt_hdr);
+		if (pe->type <= 0) {
+			TRACE1("type <= 0");
+			return -EINVAL;
+		}
+
+		if (fix_pe_image(pe)) {
+			TRACE1("bad PE image");
+			return -EINVAL;
+		}
+
+		if (read_exports(pe)) {
+			TRACE1("read exports failed");
+			return -EINVAL;
+		}
+	}
+
+	for (i = 0; i < n; i++) {
+	        pe = &pe_image[i];
+
+		if (fixup_reloc(pe->image, pe->nt_hdr)) {
+			TRACE1("fixup reloc failed");
+			return -EINVAL;
+		}
+		if (fixup_imports(pe->image, pe->nt_hdr)) {
+			TRACE1("fixup imports failed");
+			return -EINVAL;
+		}
+#if defined(CONFIG_X86_64)
+		INFO("fixing KI_USER_SHARED_DATA address in the driver");
+		fix_user_shared_data_addr(pe_image[i].image, pe_image[i].size);
+#endif
+		flush_icache_range(pe->image, pe->size);
+
+		pe->entry =
+			RVA2VA(pe->image,
+			       pe->opt_hdr->AddressOfEntryPoint, void *);
+		TRACE1("entry is at %p, rva at %08X", pe->entry,
+		       pe->opt_hdr->AddressOfEntryPoint);
+	}
+
+	for (i = 0; i < n; i++) {
+	        pe = &pe_image[i];
+
+		if (pe->type == IMAGE_FILE_DLL) {
+			struct unicode_string ustring;
+			char *buf = "0/0t0m0p00";
+			int (*dll_entry)(struct unicode_string *ustring)
+				wstdcall;
+
+			memset(&ustring, 0, sizeof(ustring));
+			ustring.buf = (wchar_t *)buf;
+			dll_entry = (void *)get_dll_init(pe->name);
+
+			TRACE1("calling dll_init at %p", dll_entry);
+			if (!dll_entry || dll_entry(&ustring))
+				ERROR("DLL initialize failed for %s",
+				      pe->name);
+		}
+		else if (pe->type != IMAGE_FILE_EXECUTABLE_IMAGE)
+			ERROR("illegal image type: %d", pe->type);
+	}
+	return 0;
+}
--- linux-rt-2.6.31.orig/ubuntu/ndiswrapper/longlong.h
+++ linux-rt-2.6.31/ubuntu/ndiswrapper/longlong.h
@@ -0,0 +1,1333 @@
+/* longlong.h -- definitions for mixed size 32/64 bit arithmetic.
+   Copyright (C) 1991, 1992, 1994, 1995, 1996, 1997, 1998, 1999, 2000
+   Free Software Foundation, Inc.
+
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, write to the Free
+   Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
+   02111-1307 USA.  */
+
+/* You have to define the following before including this file:
+
+   UWtype -- An unsigned type, default type for operations (typically a "word")
+   UHWtype -- An unsigned type, at least half the size of UWtype.
+   UDWtype -- An unsigned type, at least twice as large a UWtype
+   W_TYPE_SIZE -- size in bits of UWtype
+
+   UQItype -- Unsigned 8 bit type.
+   SItype, USItype -- Signed and unsigned 32 bit types.
+   DItype, UDItype -- Signed and unsigned 64 bit types.
+
+   On a 32 bit machine UWtype should typically be USItype;
+   on a 64 bit machine, UWtype should typically be UDItype.
+*/
+
+#define __BITS4 (W_TYPE_SIZE / 4)
+#define __ll_B ((UWtype) 1 << (W_TYPE_SIZE / 2))
+#define __ll_lowpart(t) ((UWtype) (t) & (__ll_B - 1))
+#define __ll_highpart(t) ((UWtype) (t) >> (W_TYPE_SIZE / 2))
+
+#ifndef W_TYPE_SIZE
+#define W_TYPE_SIZE	32
+#define UWtype		USItype
+#define UHWtype		USItype
+#define UDWtype		UDItype
+#endif
+
+/* Define auxiliary asm macros.
+
+   1) umul_ppmm(high_prod, low_prod, multipler, multiplicand) multiplies two
+   UWtype integers MULTIPLER and MULTIPLICAND, and generates a two UWtype
+   word product in HIGH_PROD and LOW_PROD.
+
+   2) __umulsidi3(a,b) multiplies two UWtype integers A and B, and returns a
+   UDWtype product.  This is just a variant of umul_ppmm.
+
+   3) udiv_qrnnd(quotient, remainder, high_numerator, low_numerator,
+   denominator) divides a UDWtype, composed by the UWtype integers
+   HIGH_NUMERATOR and LOW_NUMERATOR, by DENOMINATOR and places the quotient
+   in QUOTIENT and the remainder in REMAINDER.  HIGH_NUMERATOR must be less
+   than DENOMINATOR for correct operation.  If, in addition, the most
+   significant bit of DENOMINATOR must be 1, then the pre-processor symbol
+   UDIV_NEEDS_NORMALIZATION is defined to 1.
+
+   4) sdiv_qrnnd(quotient, remainder, high_numerator, low_numerator,
+   denominator).  Like udiv_qrnnd but the numbers are signed.  The quotient
+   is rounded towards 0.
+
+   5) count_leading_zeros(count, x) counts the number of zero-bits from the
+   msb to the first nonzero bit in the UWtype X.  This is the number of
+   steps X needs to be shifted left to set the msb.  Undefined for X == 0,
+   unless the symbol COUNT_LEADING_ZEROS_0 is defined to some value.
+
+   6) count_trailing_zeros(count, x) like count_leading_zeros, but counts
+   from the least significant end.
+
+   7) add_ssaaaa(high_sum, low_sum, high_addend_1, low_addend_1,
+   high_addend_2, low_addend_2) adds two UWtype integers, composed by
+   HIGH_ADDEND_1 and LOW_ADDEND_1, and HIGH_ADDEND_2 and LOW_ADDEND_2
+   respectively.  The result is placed in HIGH_SUM and LOW_SUM.  Overflow
+   (i.e. carry out) is not stored anywhere, and is lost.
+
+   8) sub_ddmmss(high_difference, low_difference, high_minuend, low_minuend,
+   high_subtrahend, low_subtrahend) subtracts two two-word UWtype integers,
+   composed by HIGH_MINUEND_1 and LOW_MINUEND_1, and HIGH_SUBTRAHEND_2 and
+   LOW_SUBTRAHEND_2 respectively.  The result is placed in HIGH_DIFFERENCE
+   and LOW_DIFFERENCE.  Overflow (i.e. carry out) is not stored anywhere,
+   and is lost.
+
+   If any of these macros are left undefined for a particular CPU,
+   C macros are used.  */
+
+/* The CPUs come in alphabetical order below.
+
+   Please add support for more CPUs here, or improve the current support
+   for the CPUs below!
+   (E.g. WE32100, IBM360.)  */
+
+#if defined (__GNUC__) && !defined (NO_ASM)
+
+/* We sometimes need to clobber "cc" with gcc2, but that would not be
+   understood by gcc1.  Use cpp to avoid major code duplication.  */
+#if __GNUC__ < 2
+#define __CLOBBER_CC
+#define __AND_CLOBBER_CC
+#else /* __GNUC__ >= 2 */
+#define __CLOBBER_CC : "cc"
+#define __AND_CLOBBER_CC , "cc"
+#endif /* __GNUC__ < 2 */
+
+#if defined (__alpha) && W_TYPE_SIZE == 64
+#define umul_ppmm(ph, pl, m0, m1) \
+  do {									\
+    UDItype __m0 = (m0), __m1 = (m1);					\
+    __asm__ ("umulh %r1,%2,%0"						\
+	     : "=r" ((UDItype) ph)					\
+	     : "%rJ" (__m0),						\
+	       "rI" (__m1));						\
+    (pl) = __m0 * __m1;							\
+  } while (0)
+#define UMUL_TIME 46
+#ifndef LONGLONG_STANDALONE
+#define udiv_qrnnd(q, r, n1, n0, d) \
+  do { UDItype __r;							\
+    (q) = __udiv_qrnnd (&__r, (n1), (n0), (d));				\
+    (r) = __r;								\
+  } while (0)
+extern UDItype __udiv_qrnnd (UDItype *, UDItype, UDItype, UDItype);
+#define UDIV_TIME 220
+#endif /* LONGLONG_STANDALONE */
+#ifdef __alpha_cix__
+#define count_leading_zeros(COUNT,X) \
+  __asm__("ctlz %1,%0" : "=r"(COUNT) : "r"(X))
+#define count_trailing_zeros(COUNT,X) \
+  __asm__("cttz %1,%0" : "=r"(COUNT) : "r"(X))
+#define COUNT_LEADING_ZEROS_0 64
+#else
+extern const UQItype __clz_tab[];
+#define count_leading_zeros(COUNT,X) \
+  do {									\
+    UDItype __xr = (X), __t, __a;					\
+    __asm__("cmpbge $31,%1,%0" : "=r"(__t) : "r"(__xr));		\
+    __a = __clz_tab[__t ^ 0xff] - 1;					\
+    __asm__("extbl %1,%2,%0" : "=r"(__t) : "r"(__xr), "r"(__a));	\
+    (COUNT) = 64 - (__clz_tab[__t] + __a*8);				\
+  } while (0)
+#define count_trailing_zeros(COUNT,X) \
+  do {									\
+    UDItype __xr = (X), __t, __a;					\
+    __asm__("cmpbge $31,%1,%0" : "=r"(__t) : "r"(__xr));		\
+    __t = ~__t & -~__t;							\
+    __a = ((__t & 0xCC) != 0) * 2;					\
+    __a += ((__t & 0xF0) != 0) * 4;					\
+    __a += ((__t & 0xAA) != 0);						\
+    __asm__("extbl %1,%2,%0" : "=r"(__t) : "r"(__xr), "r"(__a));	\
+    __a <<= 3;								\
+    __t &= -__t;							\
+    __a += ((__t & 0xCC) != 0) * 2;					\
+    __a += ((__t & 0xF0) != 0) * 4;					\
+    __a += ((__t & 0xAA) != 0);						\
+    (COUNT) = __a;							\
+  } while (0)
+#endif /* __alpha_cix__ */
+#endif /* __alpha */
+
+#if defined (__arc__) && W_TYPE_SIZE == 32
+#define add_ssaaaa(sh, sl, ah, al, bh, bl) \
+  __asm__ ("add.f	%1, %4, %5\n\tadc	%0, %2, %3"		\
+	   : "=r" ((USItype) (sh)),					\
+	     "=&r" ((USItype) (sl))					\
+	   : "%r" ((USItype) (ah)),					\
+	     "rIJ" ((USItype) (bh)),					\
+	     "%r" ((USItype) (al)),					\
+	     "rIJ" ((USItype) (bl)))
+#define sub_ddmmss(sh, sl, ah, al, bh, bl) \
+  __asm__ ("sub.f	%1, %4, %5\n\tsbc	%0, %2, %3"		\
+	   : "=r" ((USItype) (sh)),					\
+	     "=&r" ((USItype) (sl))					\
+	   : "r" ((USItype) (ah)),					\
+	     "rIJ" ((USItype) (bh)),					\
+	     "r" ((USItype) (al)),					\
+	     "rIJ" ((USItype) (bl)))
+/* Call libgcc routine.  */
+#define umul_ppmm(w1, w0, u, v) \
+do {									\
+  DWunion __w;								\
+  __w.ll = __umulsidi3 (u, v);						\
+  w1 = __w.s.high;							\
+  w0 = __w.s.low;							\
+} while (0)
+#define __umulsidi3 __umulsidi3
+UDItype __umulsidi3 (USItype, USItype);
+#endif
+
+#if defined (__arm__) && W_TYPE_SIZE == 32
+#define add_ssaaaa(sh, sl, ah, al, bh, bl) \
+  __asm__ ("adds	%1, %4, %5\n\tadc	%0, %2, %3"		\
+	   : "=r" ((USItype) (sh)),					\
+	     "=&r" ((USItype) (sl))					\
+	   : "%r" ((USItype) (ah)),					\
+	     "rI" ((USItype) (bh)),					\
+	     "%r" ((USItype) (al)),					\
+	     "rI" ((USItype) (bl)))
+#define sub_ddmmss(sh, sl, ah, al, bh, bl) \
+  __asm__ ("subs	%1, %4, %5\n\tsbc	%0, %2, %3"		\
+	   : "=r" ((USItype) (sh)),					\
+	     "=&r" ((USItype) (sl))					\
+	   : "r" ((USItype) (ah)),					\
+	     "rI" ((USItype) (bh)),					\
+	     "r" ((USItype) (al)),					\
+	     "rI" ((USItype) (bl)))
+#define umul_ppmm(xh, xl, a, b) \
+{register USItype __t0, __t1, __t2;					\
+  __asm__ ("%@ Inlined umul_ppmm\n"					\
+	   "	mov	%2, %5, lsr #16\n"				\
+	   "	mov	%0, %6, lsr #16\n"				\
+	   "	bic	%3, %5, %2, lsl #16\n"				\
+	   "	bic	%4, %6, %0, lsl #16\n"				\
+	   "	mul	%1, %3, %4\n"					\
+	   "	mul	%4, %2, %4\n"					\
+	   "	mul	%3, %0, %3\n"					\
+	   "	mul	%0, %2, %0\n"					\
+	   "	adds	%3, %4, %3\n"					\
+	   "	addcs	%0, %0, #65536\n"				\
+	   "	adds	%1, %1, %3, lsl #16\n"				\
+	   "	adc	%0, %0, %3, lsr #16"				\
+	   : "=&r" ((USItype) (xh)),					\
+	     "=r" ((USItype) (xl)),					\
+	     "=&r" (__t0), "=&r" (__t1), "=r" (__t2)			\
+	   : "r" ((USItype) (a)),					\
+	     "r" ((USItype) (b)));}
+#define UMUL_TIME 20
+#define UDIV_TIME 100
+#endif /* __arm__ */
+
+#if defined (__hppa) && W_TYPE_SIZE == 32
+#define add_ssaaaa(sh, sl, ah, al, bh, bl) \
+  __asm__ ("add %4,%5,%1\n\taddc %2,%3,%0"				\
+	   : "=r" ((USItype) (sh)),					\
+	     "=&r" ((USItype) (sl))					\
+	   : "%rM" ((USItype) (ah)),					\
+	     "rM" ((USItype) (bh)),					\
+	     "%rM" ((USItype) (al)),					\
+	     "rM" ((USItype) (bl)))
+#define sub_ddmmss(sh, sl, ah, al, bh, bl) \
+  __asm__ ("sub %4,%5,%1\n\tsubb %2,%3,%0"				\
+	   : "=r" ((USItype) (sh)),					\
+	     "=&r" ((USItype) (sl))					\
+	   : "rM" ((USItype) (ah)),					\
+	     "rM" ((USItype) (bh)),					\
+	     "rM" ((USItype) (al)),					\
+	     "rM" ((USItype) (bl)))
+#if defined (_PA_RISC1_1)
+#define umul_ppmm(w1, w0, u, v) \
+  do {									\
+    union								\
+      {									\
+	UDItype __f;							\
+	struct {USItype __w1, __w0;} __w1w0;				\
+      } __t;								\
+    __asm__ ("xmpyu %1,%2,%0"						\
+	     : "=x" (__t.__f)						\
+	     : "x" ((USItype) (u)),					\
+	       "x" ((USItype) (v)));					\
+    (w1) = __t.__w1w0.__w1;						\
+    (w0) = __t.__w1w0.__w0;						\
+     } while (0)
+#define UMUL_TIME 8
+#else
+#define UMUL_TIME 30
+#endif
+#define UDIV_TIME 40
+#define count_leading_zeros(count, x) \
+  do {									\
+    USItype __tmp;							\
+    __asm__ (								\
+       "ldi		1,%0\n"						\
+"	extru,=		%1,15,16,%%r0		; Bits 31..16 zero?\n"	\
+"	extru,tr	%1,15,16,%1		; No.  Shift down, skip add.\n"\
+"	ldo		16(%0),%0		; Yes.  Perform add.\n"	\
+"	extru,=		%1,23,8,%%r0		; Bits 15..8 zero?\n"	\
+"	extru,tr	%1,23,8,%1		; No.  Shift down, skip add.\n"\
+"	ldo		8(%0),%0		; Yes.  Perform add.\n"	\
+"	extru,=		%1,27,4,%%r0		; Bits 7..4 zero?\n"	\
+"	extru,tr	%1,27,4,%1		; No.  Shift down, skip add.\n"\
+"	ldo		4(%0),%0		; Yes.  Perform add.\n"	\
+"	extru,=		%1,29,2,%%r0		; Bits 3..2 zero?\n"	\
+"	extru,tr	%1,29,2,%1		; No.  Shift down, skip add.\n"\
+"	ldo		2(%0),%0		; Yes.  Perform add.\n"	\
+"	extru		%1,30,1,%1		; Extract bit 1.\n"	\
+"	sub		%0,%1,%0		; Subtract it.\n"	\
+	: "=r" (count), "=r" (__tmp) : "1" (x));			\
+  } while (0)
+#endif
+
+#if (defined (__i370__) || defined (__mvs__)) && W_TYPE_SIZE == 32
+#define umul_ppmm(xh, xl, m0, m1) \
+  do {									\
+    union {UDItype __ll;						\
+	   struct {USItype __h, __l;} __i;				\
+	  } __xx;							\
+    USItype __m0 = (m0), __m1 = (m1);					\
+    __asm__ ("mr %0,%3"							\
+	     : "=r" (__xx.__i.__h),					\
+	       "=r" (__xx.__i.__l)					\
+	     : "%1" (__m0),						\
+	       "r" (__m1));						\
+    (xh) = __xx.__i.__h; (xl) = __xx.__i.__l;				\
+    (xh) += ((((SItype) __m0 >> 31) & __m1)				\
+	     + (((SItype) __m1 >> 31) & __m0));				\
+  } while (0)
+#define smul_ppmm(xh, xl, m0, m1) \
+  do {									\
+    union {DItype __ll;							\
+	   struct {USItype __h, __l;} __i;				\
+	  } __xx;							\
+    __asm__ ("mr %0,%3"							\
+	     : "=r" (__xx.__i.__h),					\
+	       "=r" (__xx.__i.__l)					\
+	     : "%1" (m0),						\
+	       "r" (m1));						\
+    (xh) = __xx.__i.__h; (xl) = __xx.__i.__l;				\
+  } while (0)
+#define sdiv_qrnnd(q, r, n1, n0, d) \
+  do {									\
+    union {DItype __ll;							\
+	   struct {USItype __h, __l;} __i;				\
+	  } __xx;							\
+    __xx.__i.__h = n1; __xx.__i.__l = n0;				\
+    __asm__ ("dr %0,%2"							\
+	     : "=r" (__xx.__ll)						\
+	     : "0" (__xx.__ll), "r" (d));				\
+    (q) = __xx.__i.__l; (r) = __xx.__i.__h;				\
+  } while (0)
+#endif
+
+#if (defined (__i386__) || defined (__i486__)) && W_TYPE_SIZE == 32
+#define add_ssaaaa(sh, sl, ah, al, bh, bl) \
+  __asm__ ("addl %5,%1\n\tadcl %3,%0"					\
+	   : "=r" ((USItype) (sh)),					\
+	     "=&r" ((USItype) (sl))					\
+	   : "%0" ((USItype) (ah)),					\
+	     "g" ((USItype) (bh)),					\
+	     "%1" ((USItype) (al)),					\
+	     "g" ((USItype) (bl)))
+#define sub_ddmmss(sh, sl, ah, al, bh, bl) \
+  __asm__ ("subl %5,%1\n\tsbbl %3,%0"					\
+	   : "=r" ((USItype) (sh)),					\
+	     "=&r" ((USItype) (sl))					\
+	   : "0" ((USItype) (ah)),					\
+	     "g" ((USItype) (bh)),					\
+	     "1" ((USItype) (al)),					\
+	     "g" ((USItype) (bl)))
+#define umul_ppmm(w1, w0, u, v) \
+  __asm__ ("mull %3"							\
+	   : "=a" ((USItype) (w0)),					\
+	     "=d" ((USItype) (w1))					\
+	   : "%0" ((USItype) (u)),					\
+	     "rm" ((USItype) (v)))
+#define udiv_qrnnd(q, r, n1, n0, dv) \
+  __asm__ ("divl %4"							\
+	   : "=a" ((USItype) (q)),					\
+	     "=d" ((USItype) (r))					\
+	   : "0" ((USItype) (n0)),					\
+	     "1" ((USItype) (n1)),					\
+	     "rm" ((USItype) (dv)))
+#define count_leading_zeros(count, x) \
+  do {									\
+    USItype __cbtmp;							\
+    __asm__ ("bsrl %1,%0"						\
+	     : "=r" (__cbtmp) : "rm" ((USItype) (x)));			\
+    (count) = __cbtmp ^ 31;						\
+  } while (0)
+#define count_trailing_zeros(count, x) \
+  __asm__ ("bsfl %1,%0" : "=r" (count) : "rm" ((USItype)(x)))
+#define UMUL_TIME 40
+#define UDIV_TIME 40
+#endif /* 80x86 */
+
+#if defined (__i960__) && W_TYPE_SIZE == 32
+#define umul_ppmm(w1, w0, u, v) \
+  ({union {UDItype __ll;						\
+	   struct {USItype __l, __h;} __i;				\
+	  } __xx;							\
+  __asm__ ("emul	%2,%1,%0"					\
+	   : "=d" (__xx.__ll)						\
+	   : "%dI" ((USItype) (u)),					\
+	     "dI" ((USItype) (v)));					\
+  (w1) = __xx.__i.__h; (w0) = __xx.__i.__l;})
+#define __umulsidi3(u, v) \
+  ({UDItype __w;							\
+    __asm__ ("emul	%2,%1,%0"					\
+	     : "=d" (__w)						\
+	     : "%dI" ((USItype) (u)),					\
+	       "dI" ((USItype) (v)));					\
+    __w; })
+#endif /* __i960__ */
+
+#if defined (__M32R__) && W_TYPE_SIZE == 32
+#define add_ssaaaa(sh, sl, ah, al, bh, bl) \
+  /* The cmp clears the condition bit.  */ \
+  __asm__ ("cmp %0,%0\n\taddx %%5,%1\n\taddx %%3,%0"			\
+	   : "=r" ((USItype) (sh)),					\
+	     "=&r" ((USItype) (sl))					\
+	   : "%0" ((USItype) (ah)),					\
+	     "r" ((USItype) (bh)),					\
+	     "%1" ((USItype) (al)),					\
+	     "r" ((USItype) (bl))					\
+	   : "cbit")
+#define sub_ddmmss(sh, sl, ah, al, bh, bl) \
+  /* The cmp clears the condition bit.  */ \
+  __asm__ ("cmp %0,%0\n\tsubx %5,%1\n\tsubx %3,%0"			\
+	   : "=r" ((USItype) (sh)),					\
+	     "=&r" ((USItype) (sl))					\
+	   : "0" ((USItype) (ah)),					\
+	     "r" ((USItype) (bh)),					\
+	     "1" ((USItype) (al)),					\
+	     "r" ((USItype) (bl))					\
+	   : "cbit")
+#endif /* __M32R__ */
+
+#if defined (__mc68000__) && W_TYPE_SIZE == 32
+#define add_ssaaaa(sh, sl, ah, al, bh, bl) \
+  __asm__ ("add%.l %5,%1\n\taddx%.l %3,%0"				\
+	   : "=d" ((USItype) (sh)),					\
+	     "=&d" ((USItype) (sl))					\
+	   : "%0" ((USItype) (ah)),					\
+	     "d" ((USItype) (bh)),					\
+	     "%1" ((USItype) (al)),					\
+	     "g" ((USItype) (bl)))
+#define sub_ddmmss(sh, sl, ah, al, bh, bl) \
+  __asm__ ("sub%.l %5,%1\n\tsubx%.l %3,%0"				\
+	   : "=d" ((USItype) (sh)),					\
+	     "=&d" ((USItype) (sl))					\
+	   : "0" ((USItype) (ah)),					\
+	     "d" ((USItype) (bh)),					\
+	     "1" ((USItype) (al)),					\
+	     "g" ((USItype) (bl)))
+
+/* The '020, '030, '040 and CPU32 have 32x32->64 and 64/32->32q-32r.  */
+#if defined (__mc68020__) || defined(mc68020) \
+	|| defined(__mc68030__) || defined(mc68030) \
+	|| defined(__mc68040__) || defined(mc68040) \
+	|| defined(__mcpu32__) || defined(mcpu32)
+#define umul_ppmm(w1, w0, u, v) \
+  __asm__ ("mulu%.l %3,%1:%0"						\
+	   : "=d" ((USItype) (w0)),					\
+	     "=d" ((USItype) (w1))					\
+	   : "%0" ((USItype) (u)),					\
+	     "dmi" ((USItype) (v)))
+#define UMUL_TIME 45
+#define udiv_qrnnd(q, r, n1, n0, d) \
+  __asm__ ("divu%.l %4,%1:%0"						\
+	   : "=d" ((USItype) (q)),					\
+	     "=d" ((USItype) (r))					\
+	   : "0" ((USItype) (n0)),					\
+	     "1" ((USItype) (n1)),					\
+	     "dmi" ((USItype) (d)))
+#define UDIV_TIME 90
+#define sdiv_qrnnd(q, r, n1, n0, d) \
+  __asm__ ("divs%.l %4,%1:%0"						\
+	   : "=d" ((USItype) (q)),					\
+	     "=d" ((USItype) (r))					\
+	   : "0" ((USItype) (n0)),					\
+	     "1" ((USItype) (n1)),					\
+	     "dmi" ((USItype) (d)))
+
+#else /* not mc68020 */
+#if !defined(__mcf5200__)
+/* %/ inserts REGISTER_PREFIX, %# inserts IMMEDIATE_PREFIX.  */
+#define umul_ppmm(xh, xl, a, b) \
+  __asm__ ("| Inlined umul_ppmm\n"					\
+	   "	move%.l	%2,%/d0\n"					\
+	   "	move%.l	%3,%/d1\n"					\
+	   "	move%.l	%/d0,%/d2\n"					\
+	   "	swap	%/d0\n"						\
+	   "	move%.l	%/d1,%/d3\n"					\
+	   "	swap	%/d1\n"						\
+	   "	move%.w	%/d2,%/d4\n"					\
+	   "	mulu	%/d3,%/d4\n"					\
+	   "	mulu	%/d1,%/d2\n"					\
+	   "	mulu	%/d0,%/d3\n"					\
+	   "	mulu	%/d0,%/d1\n"					\
+	   "	move%.l	%/d4,%/d0\n"					\
+	   "	eor%.w	%/d0,%/d0\n"					\
+	   "	swap	%/d0\n"						\
+	   "	add%.l	%/d0,%/d2\n"					\
+	   "	add%.l	%/d3,%/d2\n"					\
+	   "	jcc	1f\n"						\
+	   "	add%.l	%#65536,%/d1\n"					\
+	   "1:	swap	%/d2\n"						\
+	   "	moveq	%#0,%/d0\n"					\
+	   "	move%.w	%/d2,%/d0\n"					\
+	   "	move%.w	%/d4,%/d2\n"					\
+	   "	move%.l	%/d2,%1\n"					\
+	   "	add%.l	%/d1,%/d0\n"					\
+	   "	move%.l	%/d0,%0"					\
+	   : "=g" ((USItype) (xh)),					\
+	     "=g" ((USItype) (xl))					\
+	   : "g" ((USItype) (a)),					\
+	     "g" ((USItype) (b))					\
+	   : "d0", "d1", "d2", "d3", "d4")
+#define UMUL_TIME 100
+#define UDIV_TIME 400
+#endif /* not mcf5200 */
+#endif /* not mc68020 */
+
+/* The '020, '030, '040 and '060 have bitfield insns.  */
+#if defined (__mc68020__) || defined(mc68020) \
+	|| defined(__mc68030__) || defined(mc68030) \
+	|| defined(__mc68040__) || defined(mc68040) \
+	|| defined(__mc68060__) || defined(mc68060)
+#define count_leading_zeros(count, x) \
+  __asm__ ("bfffo %1{%b2:%b2},%0"					\
+	   : "=d" ((USItype) (count))					\
+	   : "od" ((USItype) (x)), "n" (0))
+#endif
+#endif /* mc68000 */
+
+#if defined (__m88000__) && W_TYPE_SIZE == 32
+#define add_ssaaaa(sh, sl, ah, al, bh, bl) \
+  __asm__ ("addu.co %1,%r4,%r5\n\taddu.ci %0,%r2,%r3"			\
+	   : "=r" ((USItype) (sh)),					\
+	     "=&r" ((USItype) (sl))					\
+	   : "%rJ" ((USItype) (ah)),					\
+	     "rJ" ((USItype) (bh)),					\
+	     "%rJ" ((USItype) (al)),					\
+	     "rJ" ((USItype) (bl)))
+#define sub_ddmmss(sh, sl, ah, al, bh, bl) \
+  __asm__ ("subu.co %1,%r4,%r5\n\tsubu.ci %0,%r2,%r3"			\
+	   : "=r" ((USItype) (sh)),					\
+	     "=&r" ((USItype) (sl))					\
+	   : "rJ" ((USItype) (ah)),					\
+	     "rJ" ((USItype) (bh)),					\
+	     "rJ" ((USItype) (al)),					\
+	     "rJ" ((USItype) (bl)))
+#define count_leading_zeros(count, x) \
+  do {									\
+    USItype __cbtmp;							\
+    __asm__ ("ff1 %0,%1"						\
+	     : "=r" (__cbtmp)						\
+	     : "r" ((USItype) (x)));					\
+    (count) = __cbtmp ^ 31;						\
+  } while (0)
+#define COUNT_LEADING_ZEROS_0 63 /* sic */
+#if defined (__mc88110__)
+#define umul_ppmm(wh, wl, u, v) \
+  do {									\
+    union {UDItype __ll;						\
+	   struct {USItype __h, __l;} __i;				\
+	  } __xx;							\
+    __asm__ ("mulu.d	%0,%1,%2"					\
+	     : "=r" (__xx.__ll)						\
+	     : "r" ((USItype) (u)),					\
+	       "r" ((USItype) (v)));					\
+    (wh) = __xx.__i.__h;						\
+    (wl) = __xx.__i.__l;						\
+  } while (0)
+#define udiv_qrnnd(q, r, n1, n0, d) \
+  ({union {UDItype __ll;						\
+	   struct {USItype __h, __l;} __i;				\
+	  } __xx;							\
+  USItype __q;								\
+  __xx.__i.__h = (n1); __xx.__i.__l = (n0);				\
+  __asm__ ("divu.d %0,%1,%2"						\
+	   : "=r" (__q)							\
+	   : "r" (__xx.__ll),						\
+	     "r" ((USItype) (d)));					\
+  (r) = (n0) - __q * (d); (q) = __q; })
+#define UMUL_TIME 5
+#define UDIV_TIME 25
+#else
+#define UMUL_TIME 17
+#define UDIV_TIME 150
+#endif /* __mc88110__ */
+#endif /* __m88000__ */
+
+#if defined (__mips__) && W_TYPE_SIZE == 32
+#define umul_ppmm(w1, w0, u, v) \
+  __asm__ ("multu %2,%3"						\
+	   : "=l" ((USItype) (w0)),					\
+	     "=h" ((USItype) (w1))					\
+	   : "d" ((USItype) (u)),					\
+	     "d" ((USItype) (v)))
+#define UMUL_TIME 10
+#define UDIV_TIME 100
+#endif /* __mips__ */
+
+#if defined (__ns32000__) && W_TYPE_SIZE == 32
+#define umul_ppmm(w1, w0, u, v) \
+  ({union {UDItype __ll;						\
+	   struct {USItype __l, __h;} __i;				\
+	  } __xx;							\
+  __asm__ ("meid %2,%0"							\
+	   : "=g" (__xx.__ll)						\
+	   : "%0" ((USItype) (u)),					\
+	     "g" ((USItype) (v)));					\
+  (w1) = __xx.__i.__h; (w0) = __xx.__i.__l;})
+#define __umulsidi3(u, v) \
+  ({UDItype __w;							\
+    __asm__ ("meid %2,%0"						\
+	     : "=g" (__w)						\
+	     : "%0" ((USItype) (u)),					\
+	       "g" ((USItype) (v)));					\
+    __w; })
+#define udiv_qrnnd(q, r, n1, n0, d) \
+  ({union {UDItype __ll;						\
+	   struct {USItype __l, __h;} __i;				\
+	  } __xx;							\
+  __xx.__i.__h = (n1); __xx.__i.__l = (n0);				\
+  __asm__ ("deid %2,%0"							\
+	   : "=g" (__xx.__ll)						\
+	   : "0" (__xx.__ll),						\
+	     "g" ((USItype) (d)));					\
+  (r) = __xx.__i.__l; (q) = __xx.__i.__h; })
+#define count_trailing_zeros(count,x) \
+  do {									\
+    __asm__ ("ffsd     %2,%0"						\
+            : "=r" ((USItype) (count))					\
+            : "0" ((USItype) 0),					\
+              "r" ((USItype) (x)));					\
+  } while (0)
+#endif /* __ns32000__ */
+
+/* FIXME: We should test _IBMR2 here when we add assembly support for the
+   system vendor compilers.
+   FIXME: What's needed for gcc PowerPC VxWorks?  __vxworks__ is not good
+   enough, since that hits ARM and m68k too.  */
+#if (defined (_ARCH_PPC)	/* AIX */				\
+     || defined (_ARCH_PWR)	/* AIX */				\
+     || defined (_ARCH_COM)	/* AIX */				\
+     || defined (__powerpc__)	/* gcc */				\
+     || defined (__POWERPC__)	/* BEOS */				\
+     || defined (__ppc__)	/* Darwin */				\
+     || defined (PPC)		/* GNU/Linux, SysV */			\
+     ) && W_TYPE_SIZE == 32
+#define add_ssaaaa(sh, sl, ah, al, bh, bl) \
+  do {									\
+    if (__builtin_constant_p (bh) && (bh) == 0)				\
+      __asm__ ("{a%I4|add%I4c} %1,%3,%4\n\t{aze|addze} %0,%2"		\
+	     : "=r" (sh), "=&r" (sl) : "r" (ah), "%r" (al), "rI" (bl));\
+    else if (__builtin_constant_p (bh) && (bh) == ~(USItype) 0)		\
+      __asm__ ("{a%I4|add%I4c} %1,%3,%4\n\t{ame|addme} %0,%2"		\
+	     : "=r" (sh), "=&r" (sl) : "r" (ah), "%r" (al), "rI" (bl));\
+    else								\
+      __asm__ ("{a%I5|add%I5c} %1,%4,%5\n\t{ae|adde} %0,%2,%3"		\
+	     : "=r" (sh), "=&r" (sl)					\
+	     : "%r" (ah), "r" (bh), "%r" (al), "rI" (bl));		\
+  } while (0)
+#define sub_ddmmss(sh, sl, ah, al, bh, bl) \
+  do {									\
+    if (__builtin_constant_p (ah) && (ah) == 0)				\
+      __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{sfze|subfze} %0,%2"	\
+	       : "=r" (sh), "=&r" (sl) : "r" (bh), "rI" (al), "r" (bl));\
+    else if (__builtin_constant_p (ah) && (ah) == ~(USItype) 0)		\
+      __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{sfme|subfme} %0,%2"	\
+	       : "=r" (sh), "=&r" (sl) : "r" (bh), "rI" (al), "r" (bl));\
+    else if (__builtin_constant_p (bh) && (bh) == 0)			\
+      __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{ame|addme} %0,%2"		\
+	       : "=r" (sh), "=&r" (sl) : "r" (ah), "rI" (al), "r" (bl));\
+    else if (__builtin_constant_p (bh) && (bh) == ~(USItype) 0)		\
+      __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{aze|addze} %0,%2"		\
+	       : "=r" (sh), "=&r" (sl) : "r" (ah), "rI" (al), "r" (bl));\
+    else								\
+      __asm__ ("{sf%I4|subf%I4c} %1,%5,%4\n\t{sfe|subfe} %0,%3,%2"	\
+	       : "=r" (sh), "=&r" (sl)					\
+	       : "r" (ah), "r" (bh), "rI" (al), "r" (bl));		\
+  } while (0)
+#define count_leading_zeros(count, x) \
+  __asm__ ("{cntlz|cntlzw} %0,%1" : "=r" (count) : "r" (x))
+#define COUNT_LEADING_ZEROS_0 32
+#if defined (_ARCH_PPC) || defined (__powerpc__) || defined (__POWERPC__) \
+  || defined (__ppc__) || defined (PPC) || defined (__vxworks__)
+#define umul_ppmm(ph, pl, m0, m1) \
+  do {									\
+    USItype __m0 = (m0), __m1 = (m1);					\
+    __asm__ ("mulhwu %0,%1,%2" : "=r" (ph) : "%r" (m0), "r" (m1));	\
+    (pl) = __m0 * __m1;							\
+  } while (0)
+#define UMUL_TIME 15
+#define smul_ppmm(ph, pl, m0, m1) \
+  do {									\
+    SItype __m0 = (m0), __m1 = (m1);					\
+    __asm__ ("mulhw %0,%1,%2" : "=r" (ph) : "%r" (m0), "r" (m1));	\
+    (pl) = __m0 * __m1;							\
+  } while (0)
+#define SMUL_TIME 14
+#define UDIV_TIME 120
+#elif defined (_ARCH_PWR)
+#define UMUL_TIME 8
+#define smul_ppmm(xh, xl, m0, m1) \
+  __asm__ ("mul %0,%2,%3" : "=r" (xh), "=q" (xl) : "r" (m0), "r" (m1))
+#define SMUL_TIME 4
+#define sdiv_qrnnd(q, r, nh, nl, d) \
+  __asm__ ("div %0,%2,%4" : "=r" (q), "=q" (r) : "r" (nh), "1" (nl), "r" (d))
+#define UDIV_TIME 100
+#endif
+#endif /* 32-bit POWER architecture variants.  */
+
+/* We should test _IBMR2 here when we add assembly support for the system
+   vendor compilers.  */
+#if (defined (_ARCH_PPC64) || defined (__powerpc64__)) && W_TYPE_SIZE == 64
+#define add_ssaaaa(sh, sl, ah, al, bh, bl) \
+  do {									\
+    if (__builtin_constant_p (bh) && (bh) == 0)				\
+      __asm__ ("{a%I4|add%I4c} %1,%3,%4\n\t{aze|addze} %0,%2"		\
+	     : "=r" (sh), "=&r" (sl) : "r" (ah), "%r" (al), "rI" (bl));\
+    else if (__builtin_constant_p (bh) && (bh) == ~(UDItype) 0)		\
+      __asm__ ("{a%I4|add%I4c} %1,%3,%4\n\t{ame|addme} %0,%2"		\
+	     : "=r" (sh), "=&r" (sl) : "r" (ah), "%r" (al), "rI" (bl));\
+    else								\
+      __asm__ ("{a%I5|add%I5c} %1,%4,%5\n\t{ae|adde} %0,%2,%3"		\
+	     : "=r" (sh), "=&r" (sl)					\
+	     : "%r" (ah), "r" (bh), "%r" (al), "rI" (bl));		\
+  } while (0)
+#define sub_ddmmss(sh, sl, ah, al, bh, bl) \
+  do {									\
+    if (__builtin_constant_p (ah) && (ah) == 0)				\
+      __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{sfze|subfze} %0,%2"	\
+	       : "=r" (sh), "=&r" (sl) : "r" (bh), "rI" (al), "r" (bl));\
+    else if (__builtin_constant_p (ah) && (ah) == ~(UDItype) 0)		\
+      __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{sfme|subfme} %0,%2"	\
+	       : "=r" (sh), "=&r" (sl) : "r" (bh), "rI" (al), "r" (bl));\
+    else if (__builtin_constant_p (bh) && (bh) == 0)			\
+      __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{ame|addme} %0,%2"		\
+	       : "=r" (sh), "=&r" (sl) : "r" (ah), "rI" (al), "r" (bl));\
+    else if (__builtin_constant_p (bh) && (bh) == ~(UDItype) 0)		\
+      __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{aze|addze} %0,%2"		\
+	       : "=r" (sh), "=&r" (sl) : "r" (ah), "rI" (al), "r" (bl));\
+    else								\
+      __asm__ ("{sf%I4|subf%I4c} %1,%5,%4\n\t{sfe|subfe} %0,%3,%2"	\
+	       : "=r" (sh), "=&r" (sl)					\
+	       : "r" (ah), "r" (bh), "rI" (al), "r" (bl));		\
+  } while (0)
+#define count_leading_zeros(count, x) \
+  __asm__ ("cntlzd %0,%1" : "=r" (count) : "r" (x))
+#define COUNT_LEADING_ZEROS_0 64
+#define umul_ppmm(ph, pl, m0, m1) \
+  do {									\
+    UDItype __m0 = (m0), __m1 = (m1);					\
+    __asm__ ("mulhdu %0,%1,%2" : "=r" (ph) : "%r" (m0), "r" (m1));	\
+    (pl) = __m0 * __m1;							\
+  } while (0)
+#define UMUL_TIME 15
+#define smul_ppmm(ph, pl, m0, m1) \
+  do {									\
+    DItype __m0 = (m0), __m1 = (m1);					\
+    __asm__ ("mulhd %0,%1,%2" : "=r" (ph) : "%r" (m0), "r" (m1));	\
+    (pl) = __m0 * __m1;							\
+  } while (0)
+#define SMUL_TIME 14  /* ??? */
+#define UDIV_TIME 120 /* ??? */
+#endif /* 64-bit PowerPC.  */
+
+#if defined (__ibm032__) /* RT/ROMP */ && W_TYPE_SIZE == 32
+#define add_ssaaaa(sh, sl, ah, al, bh, bl) \
+  __asm__ ("a %1,%5\n\tae %0,%3"					\
+	   : "=r" ((USItype) (sh)),					\
+	     "=&r" ((USItype) (sl))					\
+	   : "%0" ((USItype) (ah)),					\
+	     "r" ((USItype) (bh)),					\
+	     "%1" ((USItype) (al)),					\
+	     "r" ((USItype) (bl)))
+#define sub_ddmmss(sh, sl, ah, al, bh, bl) \
+  __asm__ ("s %1,%5\n\tse %0,%3"					\
+	   : "=r" ((USItype) (sh)),					\
+	     "=&r" ((USItype) (sl))					\
+	   : "0" ((USItype) (ah)),					\
+	     "r" ((USItype) (bh)),					\
+	     "1" ((USItype) (al)),					\
+	     "r" ((USItype) (bl)))
+#define umul_ppmm(ph, pl, m0, m1) \
+  do {									\
+    USItype __m0 = (m0), __m1 = (m1);					\
+    __asm__ (								\
+       "s	r2,r2\n"						\
+"	mts	r10,%2\n"						\
+"	m	r2,%3\n"						\
+"	m	r2,%3\n"						\
+"	m	r2,%3\n"						\
+"	m	r2,%3\n"						\
+"	m	r2,%3\n"						\
+"	m	r2,%3\n"						\
+"	m	r2,%3\n"						\
+"	m	r2,%3\n"						\
+"	m	r2,%3\n"						\
+"	m	r2,%3\n"						\
+"	m	r2,%3\n"						\
+"	m	r2,%3\n"						\
+"	m	r2,%3\n"						\
+"	m	r2,%3\n"						\
+"	m	r2,%3\n"						\
+"	m	r2,%3\n"						\
+"	cas	%0,r2,r0\n"						\
+"	mfs	r10,%1"							\
+	     : "=r" ((USItype) (ph)),					\
+	       "=r" ((USItype) (pl))					\
+	     : "%r" (__m0),						\
+		"r" (__m1)						\
+	     : "r2");							\
+    (ph) += ((((SItype) __m0 >> 31) & __m1)				\
+	     + (((SItype) __m1 >> 31) & __m0));				\
+  } while (0)
+#define UMUL_TIME 20
+#define UDIV_TIME 200
+#define count_leading_zeros(count, x) \
+  do {									\
+    if ((x) >= 0x10000)							\
+      __asm__ ("clz	%0,%1"						\
+	       : "=r" ((USItype) (count))				\
+	       : "r" ((USItype) (x) >> 16));				\
+    else								\
+      {									\
+	__asm__ ("clz	%0,%1"						\
+		 : "=r" ((USItype) (count))				\
+		 : "r" ((USItype) (x)));					\
+	(count) += 16;							\
+      }									\
+  } while (0)
+#endif
+
+#if defined (__sh2__) && W_TYPE_SIZE == 32
+#define umul_ppmm(w1, w0, u, v) \
+  __asm__ (								\
+       "dmulu.l	%2,%3\n\tsts	macl,%1\n\tsts	mach,%0"		\
+	   : "=r" ((USItype)(w1)),					\
+	     "=r" ((USItype)(w0))					\
+	   : "r" ((USItype)(u)),					\
+	     "r" ((USItype)(v))						\
+	   : "macl", "mach")
+#define UMUL_TIME 5
+#endif
+
+#if defined (__SH5__) && __SHMEDIA__ && W_TYPE_SIZE == 32
+#define __umulsidi3(u,v) ((UDItype)(USItype)u*(USItype)v)
+#define count_leading_zeros(count, x) \
+  do									\
+    {									\
+      UDItype x_ = (USItype)(x);					\
+      SItype c_;							\
+									\
+      __asm__ ("nsb %1, %0" : "=r" (c_) : "r" (x_));			\
+      (count) = c_ - 31;						\
+    }									\
+  while (0)
+#define COUNT_LEADING_ZEROS_0 32
+#endif
+
+#if defined (__sparc__) && !defined (__arch64__) && !defined (__sparcv9) \
+    && W_TYPE_SIZE == 32
+#define add_ssaaaa(sh, sl, ah, al, bh, bl) \
+  __asm__ ("addcc %r4,%5,%1\n\taddx %r2,%3,%0"				\
+	   : "=r" ((USItype) (sh)),					\
+	     "=&r" ((USItype) (sl))					\
+	   : "%rJ" ((USItype) (ah)),					\
+	     "rI" ((USItype) (bh)),					\
+	     "%rJ" ((USItype) (al)),					\
+	     "rI" ((USItype) (bl))					\
+	   __CLOBBER_CC)
+#define sub_ddmmss(sh, sl, ah, al, bh, bl) \
+  __asm__ ("subcc %r4,%5,%1\n\tsubx %r2,%3,%0"				\
+	   : "=r" ((USItype) (sh)),					\
+	     "=&r" ((USItype) (sl))					\
+	   : "rJ" ((USItype) (ah)),					\
+	     "rI" ((USItype) (bh)),					\
+	     "rJ" ((USItype) (al)),					\
+	     "rI" ((USItype) (bl))					\
+	   __CLOBBER_CC)
+#if defined (__sparc_v8__)
+#define umul_ppmm(w1, w0, u, v) \
+  __asm__ ("umul %2,%3,%1;rd %%y,%0"					\
+	   : "=r" ((USItype) (w1)),					\
+	     "=r" ((USItype) (w0))					\
+	   : "r" ((USItype) (u)),					\
+	     "r" ((USItype) (v)))
+#define udiv_qrnnd(__q, __r, __n1, __n0, __d) \
+  __asm__ ("mov %2,%%y;nop;nop;nop;udiv %3,%4,%0;umul %0,%4,%1;sub %3,%1,%1"\
+	   : "=&r" ((USItype) (__q)),					\
+	     "=&r" ((USItype) (__r))					\
+	   : "r" ((USItype) (__n1)),					\
+	     "r" ((USItype) (__n0)),					\
+	     "r" ((USItype) (__d)))
+#else
+#if defined (__sparclite__)
+/* This has hardware multiply but not divide.  It also has two additional
+   instructions scan (ffs from high bit) and divscc.  */
+#define umul_ppmm(w1, w0, u, v) \
+  __asm__ ("umul %2,%3,%1;rd %%y,%0"					\
+	   : "=r" ((USItype) (w1)),					\
+	     "=r" ((USItype) (w0))					\
+	   : "r" ((USItype) (u)),					\
+	     "r" ((USItype) (v)))
+#define udiv_qrnnd(q, r, n1, n0, d) \
+  __asm__ ("! Inlined udiv_qrnnd\n"					\
+"	wr	%%g0,%2,%%y	! Not a delayed write for sparclite\n"	\
+"	tst	%%g0\n"							\
+"	divscc	%3,%4,%%g1\n"						\
+"	divscc	%%g1,%4,%%g1\n"						\
+"	divscc	%%g1,%4,%%g1\n"						\
+"	divscc	%%g1,%4,%%g1\n"						\
+"	divscc	%%g1,%4,%%g1\n"						\
+"	divscc	%%g1,%4,%%g1\n"						\
+"	divscc	%%g1,%4,%%g1\n"						\
+"	divscc	%%g1,%4,%%g1\n"						\
+"	divscc	%%g1,%4,%%g1\n"						\
+"	divscc	%%g1,%4,%%g1\n"						\
+"	divscc	%%g1,%4,%%g1\n"						\
+"	divscc	%%g1,%4,%%g1\n"						\
+"	divscc	%%g1,%4,%%g1\n"						\
+"	divscc	%%g1,%4,%%g1\n"						\
+"	divscc	%%g1,%4,%%g1\n"						\
+"	divscc	%%g1,%4,%%g1\n"						\
+"	divscc	%%g1,%4,%%g1\n"						\
+"	divscc	%%g1,%4,%%g1\n"						\
+"	divscc	%%g1,%4,%%g1\n"						\
+"	divscc	%%g1,%4,%%g1\n"						\
+"	divscc	%%g1,%4,%%g1\n"						\
+"	divscc	%%g1,%4,%%g1\n"						\
+"	divscc	%%g1,%4,%%g1\n"						\
+"	divscc	%%g1,%4,%%g1\n"						\
+"	divscc	%%g1,%4,%%g1\n"						\
+"	divscc	%%g1,%4,%%g1\n"						\
+"	divscc	%%g1,%4,%%g1\n"						\
+"	divscc	%%g1,%4,%%g1\n"						\
+"	divscc	%%g1,%4,%%g1\n"						\
+"	divscc	%%g1,%4,%%g1\n"						\
+"	divscc	%%g1,%4,%%g1\n"						\
+"	divscc	%%g1,%4,%0\n"						\
+"	rd	%%y,%1\n"						\
+"	bl,a 1f\n"							\
+"	add	%1,%4,%1\n"						\
+"1:	! End of inline udiv_qrnnd"					\
+	   : "=r" ((USItype) (q)),					\
+	     "=r" ((USItype) (r))					\
+	   : "r" ((USItype) (n1)),					\
+	     "r" ((USItype) (n0)),					\
+	     "rI" ((USItype) (d))					\
+	   : "g1" __AND_CLOBBER_CC)
+#define UDIV_TIME 37
+#define count_leading_zeros(count, x) \
+  do {                                                                  \
+  __asm__ ("scan %1,1,%0"                                               \
+           : "=r" ((USItype) (count))                                   \
+           : "r" ((USItype) (x)));					\
+  } while (0)
+/* Early sparclites return 63 for an argument of 0, but they warn that future
+   implementations might change this.  Therefore, leave COUNT_LEADING_ZEROS_0
+   undefined.  */
+#else
+/* SPARC without integer multiplication and divide instructions.
+   (i.e. at least Sun4/20,40,60,65,75,110,260,280,330,360,380,470,490) */
+#define umul_ppmm(w1, w0, u, v) \
+  __asm__ ("! Inlined umul_ppmm\n"					\
+"	wr	%%g0,%2,%%y	! SPARC has 0-3 delay insn after a wr\n"\
+"	sra	%3,31,%%o5	! Don't move this insn\n"		\
+"	and	%2,%%o5,%%o5	! Don't move this insn\n"		\
+"	andcc	%%g0,0,%%g1	! Don't move this insn\n"		\
+"	mulscc	%%g1,%3,%%g1\n"						\
+"	mulscc	%%g1,%3,%%g1\n"						\
+"	mulscc	%%g1,%3,%%g1\n"						\
+"	mulscc	%%g1,%3,%%g1\n"						\
+"	mulscc	%%g1,%3,%%g1\n"						\
+"	mulscc	%%g1,%3,%%g1\n"						\
+"	mulscc	%%g1,%3,%%g1\n"						\
+"	mulscc	%%g1,%3,%%g1\n"						\
+"	mulscc	%%g1,%3,%%g1\n"						\
+"	mulscc	%%g1,%3,%%g1\n"						\
+"	mulscc	%%g1,%3,%%g1\n"						\
+"	mulscc	%%g1,%3,%%g1\n"						\
+"	mulscc	%%g1,%3,%%g1\n"						\
+"	mulscc	%%g1,%3,%%g1\n"						\
+"	mulscc	%%g1,%3,%%g1\n"						\
+"	mulscc	%%g1,%3,%%g1\n"						\
+"	mulscc	%%g1,%3,%%g1\n"						\
+"	mulscc	%%g1,%3,%%g1\n"						\
+"	mulscc	%%g1,%3,%%g1\n"						\
+"	mulscc	%%g1,%3,%%g1\n"						\
+"	mulscc	%%g1,%3,%%g1\n"						\
+"	mulscc	%%g1,%3,%%g1\n"						\
+"	mulscc	%%g1,%3,%%g1\n"						\
+"	mulscc	%%g1,%3,%%g1\n"						\
+"	mulscc	%%g1,%3,%%g1\n"						\
+"	mulscc	%%g1,%3,%%g1\n"						\
+"	mulscc	%%g1,%3,%%g1\n"						\
+"	mulscc	%%g1,%3,%%g1\n"						\
+"	mulscc	%%g1,%3,%%g1\n"						\
+"	mulscc	%%g1,%3,%%g1\n"						\
+"	mulscc	%%g1,%3,%%g1\n"						\
+"	mulscc	%%g1,%3,%%g1\n"						\
+"	mulscc	%%g1,0,%%g1\n"						\
+"	add	%%g1,%%o5,%0\n"						\
+"	rd	%%y,%1"							\
+	   : "=r" ((USItype) (w1)),					\
+	     "=r" ((USItype) (w0))					\
+	   : "%rI" ((USItype) (u)),					\
+	     "r" ((USItype) (v))						\
+	   : "g1", "o5" __AND_CLOBBER_CC)
+#define UMUL_TIME 39		/* 39 instructions */
+/* It's quite necessary to add this much assembler for the sparc.
+   The default udiv_qrnnd (in C) is more than 10 times slower!  */
+#define udiv_qrnnd(__q, __r, __n1, __n0, __d) \
+  __asm__ ("! Inlined udiv_qrnnd\n"					\
+"	mov	32,%%g1\n"						\
+"	subcc	%1,%2,%%g0\n"						\
+"1:	bcs	5f\n"							\
+"	 addxcc %0,%0,%0	! shift n1n0 and a q-bit in lsb\n"	\
+"	sub	%1,%2,%1	! this kills msb of n\n"		\
+"	addx	%1,%1,%1	! so this can't give carry\n"		\
+"	subcc	%%g1,1,%%g1\n"						\
+"2:	bne	1b\n"							\
+"	 subcc	%1,%2,%%g0\n"						\
+"	bcs	3f\n"							\
+"	 addxcc %0,%0,%0	! shift n1n0 and a q-bit in lsb\n"	\
+"	b	3f\n"							\
+"	 sub	%1,%2,%1	! this kills msb of n\n"		\
+"4:	sub	%1,%2,%1\n"						\
+"5:	addxcc	%1,%1,%1\n"						\
+"	bcc	2b\n"							\
+"	 subcc	%%g1,1,%%g1\n"						\
+"! Got carry from n.  Subtract next step to cancel this carry.\n"	\
+"	bne	4b\n"							\
+"	 addcc	%0,%0,%0	! shift n1n0 and a 0-bit in lsb\n"	\
+"	sub	%1,%2,%1\n"						\
+"3:	xnor	%0,0,%0\n"						\
+"	! End of inline udiv_qrnnd"					\
+	   : "=&r" ((USItype) (__q)),					\
+	     "=&r" ((USItype) (__r))					\
+	   : "r" ((USItype) (__d)),					\
+	     "1" ((USItype) (__n1)),					\
+	     "0" ((USItype) (__n0)) : "g1" __AND_CLOBBER_CC)
+#define UDIV_TIME (3+7*32)	/* 7 instructions/iteration. 32 iterations.  */
+#endif /* __sparclite__ */
+#endif /* __sparc_v8__ */
+#endif /* sparc32 */
+
+#if ((defined (__sparc__) && defined (__arch64__)) || defined (__sparcv9)) \
+    && W_TYPE_SIZE == 64
+#define add_ssaaaa(sh, sl, ah, al, bh, bl)				\
+  __asm__ ("addcc %r4,%5,%1\n\t"					\
+   	   "add %r2,%3,%0\n\t"						\
+   	   "bcs,a,pn %%xcc, 1f\n\t"					\
+   	   "add %0, 1, %0\n"						\
+	   "1:"								\
+	   : "=r" ((UDItype)(sh)),				      	\
+	     "=&r" ((UDItype)(sl))				      	\
+	   : "%rJ" ((UDItype)(ah)),				     	\
+	     "rI" ((UDItype)(bh)),				      	\
+	     "%rJ" ((UDItype)(al)),				     	\
+	     "rI" ((UDItype)(bl))				       	\
+	   __CLOBBER_CC)
+
+#define sub_ddmmss(sh, sl, ah, al, bh, bl) 				\
+  __asm__ ("subcc %r4,%5,%1\n\t"					\
+   	   "sub %r2,%3,%0\n\t"						\
+   	   "bcs,a,pn %%xcc, 1f\n\t"					\
+   	   "sub %0, 1, %0\n\t"						\
+	   "1:"								\
+	   : "=r" ((UDItype)(sh)),				      	\
+	     "=&r" ((UDItype)(sl))				      	\
+	   : "rJ" ((UDItype)(ah)),				     	\
+	     "rI" ((UDItype)(bh)),				      	\
+	     "rJ" ((UDItype)(al)),				     	\
+	     "rI" ((UDItype)(bl))				       	\
+	   __CLOBBER_CC)
+
+#define umul_ppmm(wh, wl, u, v)						\
+  do {									\
+	  UDItype tmp1, tmp2, tmp3, tmp4;				\
+	  __asm__ __volatile__ (					\
+		   "srl %7,0,%3\n\t"					\
+		   "mulx %3,%6,%1\n\t"					\
+		   "srlx %6,32,%2\n\t"					\
+		   "mulx %2,%3,%4\n\t"					\
+		   "sllx %4,32,%5\n\t"					\
+		   "srl %6,0,%3\n\t"					\
+		   "sub %1,%5,%5\n\t"					\
+		   "srlx %5,32,%5\n\t"					\
+		   "addcc %4,%5,%4\n\t"					\
+		   "srlx %7,32,%5\n\t"					\
+		   "mulx %3,%5,%3\n\t"					\
+		   "mulx %2,%5,%5\n\t"					\
+		   "sethi %%hi(0x80000000),%2\n\t"			\
+		   "addcc %4,%3,%4\n\t"					\
+		   "srlx %4,32,%4\n\t"					\
+		   "add %2,%2,%2\n\t"					\
+		   "movcc %%xcc,%%g0,%2\n\t"				\
+		   "addcc %5,%4,%5\n\t"					\
+		   "sllx %3,32,%3\n\t"					\
+		   "add %1,%3,%1\n\t"					\
+		   "add %5,%2,%0"					\
+	   : "=r" ((UDItype)(wh)),					\
+	     "=&r" ((UDItype)(wl)),					\
+	     "=&r" (tmp1), "=&r" (tmp2), "=&r" (tmp3), "=&r" (tmp4)	\
+	   : "r" ((UDItype)(u)),					\
+	     "r" ((UDItype)(v))						\
+	   __CLOBBER_CC);						\
+  } while (0)
+#define UMUL_TIME 96
+#define UDIV_TIME 230
+#endif /* sparc64 */
+
+#if defined (__vax__) && W_TYPE_SIZE == 32
+#define add_ssaaaa(sh, sl, ah, al, bh, bl) \
+  __asm__ ("addl2 %5,%1\n\tadwc %3,%0"					\
+	   : "=g" ((USItype) (sh)),					\
+	     "=&g" ((USItype) (sl))					\
+	   : "%0" ((USItype) (ah)),					\
+	     "g" ((USItype) (bh)),					\
+	     "%1" ((USItype) (al)),					\
+	     "g" ((USItype) (bl)))
+#define sub_ddmmss(sh, sl, ah, al, bh, bl) \
+  __asm__ ("subl2 %5,%1\n\tsbwc %3,%0"					\
+	   : "=g" ((USItype) (sh)),					\
+	     "=&g" ((USItype) (sl))					\
+	   : "0" ((USItype) (ah)),					\
+	     "g" ((USItype) (bh)),					\
+	     "1" ((USItype) (al)),					\
+	     "g" ((USItype) (bl)))
+#define umul_ppmm(xh, xl, m0, m1) \
+  do {									\
+    union {								\
+	UDItype __ll;							\
+	struct {USItype __l, __h;} __i;					\
+      } __xx;								\
+    USItype __m0 = (m0), __m1 = (m1);					\
+    __asm__ ("emul %1,%2,$0,%0"						\
+	     : "=r" (__xx.__ll)						\
+	     : "g" (__m0),						\
+	       "g" (__m1));						\
+    (xh) = __xx.__i.__h;						\
+    (xl) = __xx.__i.__l;						\
+    (xh) += ((((SItype) __m0 >> 31) & __m1)				\
+	     + (((SItype) __m1 >> 31) & __m0));				\
+  } while (0)
+#define sdiv_qrnnd(q, r, n1, n0, d) \
+  do {									\
+    union {DItype __ll;							\
+	   struct {SItype __l, __h;} __i;				\
+	  } __xx;							\
+    __xx.__i.__h = n1; __xx.__i.__l = n0;				\
+    __asm__ ("ediv %3,%2,%0,%1"						\
+	     : "=g" (q), "=g" (r)					\
+	     : "g" (__xx.__ll), "g" (d));				\
+  } while (0)
+#endif /* __vax__ */
+
+#if defined (__z8000__) && W_TYPE_SIZE == 16
+#define add_ssaaaa(sh, sl, ah, al, bh, bl) \
+  __asm__ ("add	%H1,%H5\n\tadc	%H0,%H3"				\
+	   : "=r" ((unsigned int)(sh)),					\
+	     "=&r" ((unsigned int)(sl))					\
+	   : "%0" ((unsigned int)(ah)),					\
+	     "r" ((unsigned int)(bh)),					\
+	     "%1" ((unsigned int)(al)),					\
+	     "rQR" ((unsigned int)(bl)))
+#define sub_ddmmss(sh, sl, ah, al, bh, bl) \
+  __asm__ ("sub	%H1,%H5\n\tsbc	%H0,%H3"				\
+	   : "=r" ((unsigned int)(sh)),					\
+	     "=&r" ((unsigned int)(sl))					\
+	   : "0" ((unsigned int)(ah)),					\
+	     "r" ((unsigned int)(bh)),					\
+	     "1" ((unsigned int)(al)),					\
+	     "rQR" ((unsigned int)(bl)))
+#define umul_ppmm(xh, xl, m0, m1) \
+  do {									\
+    union {long int __ll;						\
+	   struct {unsigned int __h, __l;} __i;				\
+	  } __xx;							\
+    unsigned int __m0 = (m0), __m1 = (m1);				\
+    __asm__ ("mult	%S0,%H3"					\
+	     : "=r" (__xx.__i.__h),					\
+	       "=r" (__xx.__i.__l)					\
+	     : "%1" (__m0),						\
+	       "rQR" (__m1));						\
+    (xh) = __xx.__i.__h; (xl) = __xx.__i.__l;				\
+    (xh) += ((((signed int) __m0 >> 15) & __m1)				\
+	     + (((signed int) __m1 >> 15) & __m0));			\
+  } while (0)
+#endif /* __z8000__ */
+
+#endif /* __GNUC__ */
+
+/* If this machine has no inline assembler, use C macros.  */
+
+#if !defined (add_ssaaaa)
+#define add_ssaaaa(sh, sl, ah, al, bh, bl) \
+  do {									\
+    UWtype __x;								\
+    __x = (al) + (bl);							\
+    (sh) = (ah) + (bh) + (__x < (al));					\
+    (sl) = __x;								\
+  } while (0)
+#endif
+
+#if !defined (sub_ddmmss)
+#define sub_ddmmss(sh, sl, ah, al, bh, bl) \
+  do {									\
+    UWtype __x;								\
+    __x = (al) - (bl);							\
+    (sh) = (ah) - (bh) - (__x > (al));					\
+    (sl) = __x;								\
+  } while (0)
+#endif
+
+#if !defined (umul_ppmm)
+#define umul_ppmm(w1, w0, u, v)						\
+  do {									\
+    UWtype __x0, __x1, __x2, __x3;					\
+    UHWtype __ul, __vl, __uh, __vh;					\
+									\
+    __ul = __ll_lowpart (u);						\
+    __uh = __ll_highpart (u);						\
+    __vl = __ll_lowpart (v);						\
+    __vh = __ll_highpart (v);						\
+									\
+    __x0 = (UWtype) __ul * __vl;					\
+    __x1 = (UWtype) __ul * __vh;					\
+    __x2 = (UWtype) __uh * __vl;					\
+    __x3 = (UWtype) __uh * __vh;					\
+									\
+    __x1 += __ll_highpart (__x0);/* this can't give carry */		\
+    __x1 += __x2;		/* but this indeed can */		\
+    if (__x1 < __x2)		/* did we get it? */			\
+      __x3 += __ll_B;		/* yes, add it in the proper pos.  */	\
+									\
+    (w1) = __x3 + __ll_highpart (__x1);					\
+    (w0) = __ll_lowpart (__x1) * __ll_B + __ll_lowpart (__x0);		\
+  } while (0)
+#endif
+
+#if !defined (__umulsidi3)
+#define __umulsidi3(u, v) \
+  ({DWunion __w;							\
+    umul_ppmm (__w.s.high, __w.s.low, u, v);				\
+    __w.ll; })
+#endif
+
+/* Define this unconditionally, so it can be used for debugging.  */
+#define __udiv_qrnnd_c(q, r, n1, n0, d) \
+  do {									\
+    UWtype __d1, __d0, __q1, __q0;					\
+    UWtype __r1, __r0, __m;						\
+    __d1 = __ll_highpart (d);						\
+    __d0 = __ll_lowpart (d);						\
+									\
+    __r1 = (n1) % __d1;							\
+    __q1 = (n1) / __d1;							\
+    __m = (UWtype) __q1 * __d0;						\
+    __r1 = __r1 * __ll_B | __ll_highpart (n0);				\
+    if (__r1 < __m)							\
+      {									\
+	__q1--, __r1 += (d);						\
+	if (__r1 >= (d)) /* i.e. we didn't get carry when adding to __r1 */\
+	  if (__r1 < __m)						\
+	    __q1--, __r1 += (d);					\
+      }									\
+    __r1 -= __m;							\
+									\
+    __r0 = __r1 % __d1;							\
+    __q0 = __r1 / __d1;							\
+    __m = (UWtype) __q0 * __d0;						\
+    __r0 = __r0 * __ll_B | __ll_lowpart (n0);				\
+    if (__r0 < __m)							\
+      {									\
+	__q0--, __r0 += (d);						\
+	if (__r0 >= (d))						\
+	  if (__r0 < __m)						\
+	    __q0--, __r0 += (d);					\
+      }									\
+    __r0 -= __m;							\
+									\
+    (q) = (UWtype) __q1 * __ll_B | __q0;				\
+    (r) = __r0;								\
+  } while (0)
+
+/* If the processor has no udiv_qrnnd but sdiv_qrnnd, go through
+   __udiv_w_sdiv (defined in libgcc or elsewhere).  */
+#if !defined (udiv_qrnnd) && defined (sdiv_qrnnd)
+#define udiv_qrnnd(q, r, nh, nl, d) \
+  do {									\
+    USItype __r;							\
+    (q) = __udiv_w_sdiv (&__r, nh, nl, d);				\
+    (r) = __r;								\
+  } while (0)
+#endif
+
+/* If udiv_qrnnd was not defined for this processor, use __udiv_qrnnd_c.  */
+#if !defined (udiv_qrnnd)
+#define UDIV_NEEDS_NORMALIZATION 1
+#define udiv_qrnnd __udiv_qrnnd_c
+#endif
+
+#if !defined (count_leading_zeros)
+extern const UQItype __clz_tab[];
+#define count_leading_zeros(count, x) \
+  do {									\
+    UWtype __xr = (x);							\
+    UWtype __a;								\
+									\
+    if (W_TYPE_SIZE <= 32)						\
+      {									\
+	__a = __xr < ((UWtype)1<<2*__BITS4)				\
+	  ? (__xr < ((UWtype)1<<__BITS4) ? 0 : __BITS4)			\
+	  : (__xr < ((UWtype)1<<3*__BITS4) ?  2*__BITS4 : 3*__BITS4);	\
+      }									\
+    else								\
+      {									\
+	for (__a = W_TYPE_SIZE - 8; __a > 0; __a -= 8)			\
+	  if (((__xr >> __a) & 0xff) != 0)				\
+	    break;							\
+      }									\
+									\
+    (count) = W_TYPE_SIZE - (__clz_tab[__xr >> __a] + __a);		\
+  } while (0)
+#define COUNT_LEADING_ZEROS_0 W_TYPE_SIZE
+#endif
+
+#if !defined (count_trailing_zeros)
+/* Define count_trailing_zeros using count_leading_zeros.  The latter might be
+   defined in asm, but if it is not, the C version above is good enough.  */
+#define count_trailing_zeros(count, x) \
+  do {									\
+    UWtype __ctz_x = (x);						\
+    UWtype __ctz_c;							\
+    count_leading_zeros (__ctz_c, __ctz_x & -__ctz_x);			\
+    (count) = W_TYPE_SIZE - 1 - __ctz_c;				\
+  } while (0)
+#endif
+
+#ifndef UDIV_NEEDS_NORMALIZATION
+#define UDIV_NEEDS_NORMALIZATION 0
+#endif
--- linux-rt-2.6.31.orig/ubuntu/ndiswrapper/pnp.h
+++ linux-rt-2.6.31/ubuntu/ndiswrapper/pnp.h
@@ -0,0 +1,42 @@
+/*
+ *  Copyright (C) 2005 Giridhar Pemmasani
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ *  GNU General Public License for more details.
+ *
+ */
+
+#ifndef _PNP_H_
+#define _PNP_H_
+
+#include "ntoskernel.h"
+#include "ndis.h"
+#include "wrapndis.h"
+
+NTSTATUS pnp_start_device(struct wrap_device *wd);
+NTSTATUS pnp_stop_device(struct wrap_device *wd);
+NTSTATUS pnp_remove_device(struct wrap_device *wd);
+
+int wrap_pnp_start_pci_device(struct pci_dev *pdev,
+			      const struct pci_device_id *ent);
+void __devexit wrap_pnp_remove_pci_device(struct pci_dev *pdev);
+int wrap_pnp_suspend_pci_device(struct pci_dev *pdev, pm_message_t state);
+int wrap_pnp_resume_pci_device(struct pci_dev *pdev);
+
+#ifdef ENABLE_USB
+int wrap_pnp_start_usb_device(struct usb_interface *intf,
+			      const struct usb_device_id *usb_id);
+void wrap_pnp_remove_usb_device(struct usb_interface *intf);
+int wrap_pnp_suspend_usb_device(struct usb_interface *intf,
+				pm_message_t state);
+int wrap_pnp_resume_usb_device(struct usb_interface *intf);
+#endif
+
+#endif
--- linux-rt-2.6.31.orig/ubuntu/misc/fsam7400.c
+++ linux-rt-2.6.31/ubuntu/misc/fsam7400.c
@@ -0,0 +1,373 @@
+/*******************************************************************************
+  
+  This program is free software; you can redistribute it and/or modify it 
+  under the terms of the GNU General Public License as published by the Free 
+  Software Foundation; either version 2 of the License, or (at your option) 
+  any later version.
+  
+  This program is distributed in the hope that it will be useful, but WITHOUT 
+  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 
+  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for 
+  more details.
+  
+  You should have received a copy of the GNU General Public License along with
+  this program; if not, write to the Free Software Foundation, Inc., 59 
+  Temple Place - Suite 330, Boston, MA  02111-1307, USA.
+  
+  The full GNU General Public License is included in this distribution in the
+  file called LICENSE.
+  
+  Author:
+  Marcel Naziri <fsam7400@zwobbl.de>
+    
+  Based on:
+  pbe5.c by Pedro Ramalhais <pmr09313@students.fct.unl.pt>
+
+  Many thanks to:
+  Pedro Ramalhais for spending several nights with me on IRC disassembling 
+  the structure of the windows driver files... :)
+  
+*******************************************************************************/
+
+#include <linux/compiler.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/types.h>
+#include <linux/netdevice.h>
+#include <linux/proc_fs.h>
+#include <linux/ctype.h>
+#include <linux/string.h>
+#include <linux/kmod.h>
+#include <linux/io.h>
+
+#define DRV_NAME         "fsam7400"
+#define DRV_VERSION      "0.4.0"
+#define DRV_DESCRIPTION  "SW RF kill switch for Fujitsu Siemens Amilo M 7400"
+#define DRV_COPYRIGHT    "Copyright(c) 2004 zwobbl ;)"
+#define DRV_AUTHOR       "Marcel Naziri"
+#define DRV_LICENSE      "GPL"
+
+MODULE_DESCRIPTION(DRV_DESCRIPTION);
+MODULE_AUTHOR(DRV_AUTHOR);
+MODULE_LICENSE(DRV_LICENSE);
+
+#define RADIO_NONE     0xFFFFFFFF
+#define RADIO_OFF      0x00000000
+#define RADIO_ON       0x00000010
+
+static int radio = RADIO_NONE;
+module_param(radio, uint, 0400);
+MODULE_PARM_DESC(radio, "desired radio state when loading module");
+
+static int autooff = 1;
+module_param(autooff, uint, 0400);
+MODULE_PARM_DESC(autooff, "turns radio off when unloading module "
+                          "(default)");
+
+static int uid = 0;
+module_param(uid, uint, 0400);
+MODULE_PARM_DESC(uid, "user ID for proc entry");                          
+                           
+static int gid = 0;
+module_param(gid, uint, 0400);
+MODULE_PARM_DESC(gid, "group ID for proc entry");                          
+                                             
+/* some more or less useful macros */                        
+#ifdef CONFIG_IPW2100_DEBUG
+#define DEBUG_OUT0(a) printk(KERN_INFO DRV_NAME ": " a) 
+#define DEBUG_OUT1(a,b) printk(KERN_INFO DRV_NAME ": " a,b) 
+#define DEBUG_OUT2(a,b,c) printk(KERN_INFO DRV_NAME ": " a,b,c) 
+#define DEBUG_OUT3(a,b,c,d) printk(KERN_INFO DRV_NAME ": " a,b,c,d) 
+#else
+#define DEBUG_OUT0(a)  
+#define DEBUG_OUT1(a,b)  
+#define DEBUG_OUT2(a,b,c)  
+#define DEBUG_OUT3(a,b,c,d) 
+#endif
+
+#define ONOFF(x) (x) ? "ON" : "OFF"
+#define RADIO_ONOFF(x) (x) == RADIO_ON ? "ON" : "OFF"
+#define TOUL(x) (unsigned long) (x)
+                       
+/*
+ * NOTE: These values were obtained from disassembling the wbutton.sys driver
+ * installed in the Fujitsu Siemens Amilo M 7400 laptop. The names were guessed,
+ * so don't rely on them.
+ */
+
+/*** hardware dependant stuff ***/
+
+#define BIOS_CODE_ADDR       0x000F0000
+#define BIOS_CODE_ALT_MASK   0xFFFFC000 
+
+#define BIOS_CODE_MAPSIZE      0x010000
+#define BIOS_CODE_ALT_MAPSIZE  0x004000
+
+#define BIOS_MAGIC_COMMAND    0x9610 
+#define BIOS_MAGIC_OFF        0x0035
+#define BIOS_MAGIC_ON         0x0135
+#define BIOS_MAGIC_CHECK      0x0235
+
+#define PTR_POSITION  5
+#define ALLIGNED_STEP 0x10
+
+#define BIOS_SIGN_SIZE 4
+static const char bios_sign[] = {
+   0x42, 0x21, 0x55, 0x30
+};
+
+#define WLAN_DISABLED_IN_BIOS  0x01
+#define WLAN_ENABLED_IN_BIOS   0x03
+
+static unsigned long bios_code = 0;
+
+static int fsam_bios_routine(int eax, int ebx)
+{
+   __asm__ __volatile__(
+      "call *%3 \t\n"
+      : "=a"(eax)
+      : "a"(eax), "b"(ebx), "c"(bios_code)           
+      ); 
+   return (eax & 0xFF);
+}
+
+static int fsam_call_bios(int value)
+{
+   if (bios_code) {
+      int command = BIOS_MAGIC_COMMAND;
+      
+      DEBUG_OUT2("bios routine gets parameter eax=%X and ebx=%X\n",
+                  command, value);
+                  
+      value = fsam_bios_routine(command, value);                    
+         
+      DEBUG_OUT1("bios routine results %X\n", value);
+      return value;   
+   }
+   return ~0;
+}
+
+/* pointer to mapped memory*/
+static void *mem_code = NULL;
+
+static inline void fsam_unmap_memory(void)
+{
+   bios_code = 0;   
+   if (mem_code) {
+      iounmap(mem_code);
+   }      
+}
+
+static inline int fsam_map_memory(void)
+{   
+   const unsigned long max_offset = BIOS_CODE_MAPSIZE - BIOS_SIGN_SIZE - PTR_POSITION;
+   unsigned long offset;   
+   unsigned int addr;
+   
+   mem_code = ioremap(BIOS_CODE_ADDR, BIOS_CODE_MAPSIZE);
+   if (!mem_code)
+      goto fail;
+
+   DEBUG_OUT3("physical memory %x-%x mapped to virtual address %p\n",
+              BIOS_CODE_ADDR, BIOS_CODE_ADDR+BIOS_CODE_MAPSIZE, mem_code); 
+   
+   for ( offset = 0; offset < max_offset; offset += ALLIGNED_STEP ) 
+      if (check_signature(mem_code + offset, bios_sign, BIOS_SIGN_SIZE))
+         break;
+   
+   if (offset >= max_offset) 
+     goto fail; 
+   
+   DEBUG_OUT1("bios signature found at offset %lx\n", offset);   
+   
+   addr = readl(mem_code + offset + PTR_POSITION);  
+            
+   if (addr < BIOS_CODE_ADDR)
+   {      
+      DEBUG_OUT0("bios routine out of memory range, "
+                 "doing some new memory mapping...\n");
+      iounmap(mem_code);
+      mem_code = NULL;
+      
+      addr &= BIOS_CODE_ALT_MASK;
+           
+      mem_code = ioremap(addr, BIOS_CODE_ALT_MAPSIZE);
+      if (!mem_code)
+         goto fail;
+      
+      DEBUG_OUT3("physical memory %x-%x mapped to virtual address %p\n",
+                 addr, addr+BIOS_CODE_ALT_MAPSIZE, mem_code);
+            
+      addr &= 0x3FFF;           
+   } 
+   else 
+     addr &= 0xFFFF;
+      
+   bios_code = addr + TOUL(mem_code);
+   DEBUG_OUT1("supposed address of bios routine is %lx\n", bios_code);
+
+   return 1;        
+ 
+ fail:
+   fsam_unmap_memory();
+   return 0;
+}
+
+/*** interface stuff ***/
+
+static void rfkill_set_radio(int value) 
+{
+   radio = value == RADIO_ON ? fsam_call_bios(BIOS_MAGIC_ON) :
+                               fsam_call_bios(BIOS_MAGIC_OFF);
+}
+
+static inline int rfkill_get_radio(void)
+{
+   return radio;
+}
+
+static inline int rfkill_supported(void)
+{
+   return bios_code != 0;
+}
+
+static inline void rfkill_initialize(void) {
+   fsam_map_memory();
+   
+   if (rfkill_supported()) {
+      radio = radio != RADIO_NONE 
+              ? ( radio ? RADIO_ON : RADIO_OFF ) /*module parameter*/ 
+              : ( fsam_call_bios(BIOS_MAGIC_CHECK) == WLAN_ENABLED_IN_BIOS 
+                  ? RADIO_ON : RADIO_OFF );  
+   }
+}
+
+static inline void rfkill_uninitialize(void) {
+   fsam_unmap_memory();
+}
+
+/*** proc stuff ***/
+
+static inline int common_proc_set_radio(struct file *file, const char *buffer, 
+                                        unsigned long count, void *data)
+{
+   unsigned long len = 4;
+   char newstate[len];
+   
+   len = count < len ? count : len;
+
+   if ( copy_from_user(newstate, buffer, len) != 0 )
+     return -EFAULT;
+       
+   if ( (*newstate == '1' || *newstate == '0') &&
+        (count == 1 || isspace(newstate[1])) )
+     rfkill_set_radio(*newstate == '1' ? RADIO_ON : RADIO_OFF);
+   else 
+   if ( !strncmp(newstate, "on", 2)  &&
+        (count == 2 || isspace(newstate[2])) )
+     rfkill_set_radio(RADIO_ON);
+   else 
+   if ( !strncmp(newstate, "off", 3) &&
+        (count == 3 || isspace(newstate[3])) ) 
+     rfkill_set_radio(RADIO_OFF);  
+   
+   return count;
+}
+
+static inline int common_proc_get_radio(char *page, char **start, off_t offset,
+                                        int count, int *eof, void *data)
+{
+   int len = snprintf(page, count, DRV_DESCRIPTION ", v" DRV_VERSION "\n"
+                                   "  auto-off is %s\n", 
+                                   ONOFF(autooff));
+   len += snprintf(page+len, count-len, "  radio state is %s\n",
+                                        RADIO_ONOFF(rfkill_get_radio()));   
+   *eof = 1;
+   
+   return len;
+}
+
+#define PROC_DIR    "driver/wireless"
+#define PROC_RADIO  "radio"
+
+static struct proc_dir_entry *dir_base = NULL;
+
+static inline void common_proc_cleanup(void)
+{
+   if (dir_base) {
+      remove_proc_entry(PROC_RADIO, dir_base);
+      remove_proc_entry(PROC_DIR, NULL);
+      dir_base = NULL;
+   }
+}
+
+static inline int common_proc_init(void)
+{
+   struct proc_dir_entry *ent;
+   int err = 0;
+
+   dir_base = proc_mkdir(PROC_DIR, NULL);
+   if (dir_base == NULL) {
+      printk(KERN_ERR DRV_NAME ": Unable to initialize /proc/" PROC_DIR "\n");
+      err = -ENOMEM;
+      goto fail;
+   }
+
+   ent = create_proc_entry(PROC_RADIO, 
+                           S_IFREG | S_IRUGO | S_IWUSR | S_IWGRP, 
+                           dir_base);
+   ent->uid = uid;
+   ent->gid = gid;
+   if (ent) {
+      ent->read_proc = common_proc_get_radio; 
+      ent->write_proc = common_proc_set_radio; 
+   } else {
+      printk(KERN_ERR DRV_NAME ": Unable to initialize /proc/" 
+                      PROC_DIR "/" PROC_RADIO "\n");
+      err = -ENOMEM;
+      goto fail;
+   }
+   return 0;
+ 
+ fail:
+   common_proc_cleanup();
+   return err;
+}
+
+/*** module stuff ***/
+
+static int __init common_init(void)
+{ 
+   printk(KERN_INFO DRV_NAME ": " DRV_DESCRIPTION ", v" DRV_VERSION "\n");
+   printk(KERN_INFO DRV_NAME ": " DRV_COPYRIGHT "\n");
+   
+   rfkill_initialize();
+   
+   if (rfkill_supported()) {
+      common_proc_init();   
+      if (radio != RADIO_NONE) 
+         rfkill_set_radio(radio);
+   } else
+      printk(KERN_INFO DRV_NAME ": no supported wireless hardware found\n");   
+   
+   return 0;
+}
+
+static void __exit common_exit(void)
+{
+   if (rfkill_supported() && autooff) 
+      rfkill_set_radio(RADIO_OFF);
+   
+   common_proc_cleanup();
+   rfkill_uninitialize();   
+   
+   printk(KERN_INFO DRV_NAME ": module removed successfully\n");
+}
+
+module_init(common_init);
+module_exit(common_exit);
+
+/*
+         1         2         3         4         5         6         7
+12345678901234567890123456789012345678901234567890123456789012345678901234567890
+*/
--- linux-rt-2.6.31.orig/ubuntu/misc/Makefile
+++ linux-rt-2.6.31/ubuntu/misc/Makefile
@@ -0,0 +1,6 @@
+#
+# Makefile for Ubuntu additional drivers
+#
+
+obj-$(CONFIG_FSAM7400)		+= fsam7400.o
+
--- linux-rt-2.6.31.orig/ubuntu/misc/Kconfig
+++ linux-rt-2.6.31/ubuntu/misc/Kconfig
@@ -0,0 +1,4 @@
+config FSAM7400
+	tristate "SW RF kill switch for Fujitsu Siemens Amilo M 7400"
+	default m
+	select CHECK_SIGNATURE
--- linux-rt-2.6.31.orig/ubuntu/lirc/Makefile
+++ linux-rt-2.6.31/ubuntu/lirc/Makefile
@@ -0,0 +1,23 @@
+#include $(src)/../../.config
+
+EXTRA_CFLAGS =-DIRCTL_DEV_MAJOR=61 -DLIRC_SERIAL_TRANSMITTER -DLIRC_SERIAL_SOFTCARRIER -I$(src)
+
+obj-$(CONFIG_LIRC_DEV)		+= lirc_dev/
+obj-$(CONFIG_LIRC_ATIUSB)	+= lirc_atiusb/
+obj-$(CONFIG_LIRC_BT829)	+= lirc_bt829/
+obj-$(CONFIG_LIRC_ENE0100)	+= lirc_ene0100/
+obj-$(CONFIG_LIRC_I2C)		+= lirc_i2c/
+obj-$(CONFIG_LIRC_IGORPLUGUSB)	+= lirc_igorplugusb/
+obj-$(CONFIG_LIRC_IMON)		+= lirc_imon/
+obj-$(CONFIG_LIRC_IT87)		+= lirc_it87/
+obj-$(CONFIG_LIRC_ITE8709)	+= lirc_ite8709/
+obj-$(CONFIG_LIRC_MCEUSB)	+= lirc_mceusb/
+obj-$(CONFIG_LIRC_PARALLEL)	+= lirc_parallel/
+obj-$(CONFIG_LIRC_SASEM)	+= lirc_sasem/
+obj-$(CONFIG_LIRC_SERIAL)	+= lirc_serial/
+obj-$(CONFIG_LIRC_SIR)		+= lirc_sir/
+obj-$(CONFIG_LIRC_STREAMZAP)	+= lirc_streamzap/
+obj-$(CONFIG_LIRC_TTUSBIR)	+= lirc_ttusbir/
+obj-$(CONFIG_LIRC_GPIO)		+= lirc_gpio/
+obj-$(CONFIG_LIRC_TTUSBIR)	+= lirc_ttusbir/
+obj-$(CONFIG_LIRC_WPC8769L)	+= lirc_wpc8769l/
--- linux-rt-2.6.31.orig/ubuntu/lirc/Kconfig
+++ linux-rt-2.6.31/ubuntu/lirc/Kconfig
@@ -0,0 +1,88 @@
+config LIRC_DEV
+	tristate "LIRC Device support"
+	default m
+
+config LIRC_ATIUSB
+	tristate "LIRC ATI RF Remote"
+	default m
+	depends on LIRC_DEV
+
+config LIRC_BT829
+	tristate "LIRC BT829"
+	default m
+	depends on LIRC_DEV
+
+config LIRC_ENE0100
+	tristate "LIRC ENE0100"
+	default m
+	depends on LIRC_DEV
+
+config LIRC_I2C
+	tristate "LIRC I2C interface remote"
+	default m
+	depends on LIRC_DEV
+
+config LIRC_IGORPLUGUSB
+	tristate "LIRC IGOR custom remote"
+	default m
+	depends on LIRC_DEV
+
+config LIRC_IMON
+	tristate "LIRC Imon remote or pad"
+	default m
+	depends on LIRC_DEV
+
+config LIRC_IT87
+	tristate "LIRC IT87"
+	default m
+	depends on LIRC_DEV
+
+config LIRC_ITE8709
+	tristate "LIRC ITE8709"
+	default m
+	depends on LIRC_DEV
+
+config LIRC_MCEUSB
+	tristate "LIRC Microsoft Media Center Remote"
+	default m
+	depends on LIRC_DEV
+
+config LIRC_PARALLEL
+	tristate "LIRC Parallel port custom remote"
+	default n
+	depends on LIRC_DEV
+
+config LIRC_SASEM
+	tristate "LIRC Sasem"
+	default m
+	depends on LIRC_DEV
+
+config LIRC_SERIAL
+	tristate "LIRC Serial port remote"
+	default m
+	depends on LIRC_DEV
+
+config LIRC_SIR
+	tristate "LIRC Laptop port IR (SIR))"
+	default m
+	depends on LIRC_DEV
+
+config LIRC_STREAMZAP
+	tristate "LIRC Streamzap remote"
+	default m
+	depends on LIRC_DEV
+
+config LIRC_TTUSBIR
+	tristate "LIRC TT USB IR device"
+	default m
+	depends on LIRC_DEV
+
+config LIRC_CONFIG_LIRC_WPC8769L
+	tristate "LIRC WPC8769L device"
+	default m
+	depends on LIRC_DEV
+
+config LIRC_GPIO
+	tristate "LIRC TV Card GPIO remote"
+	default n
+	depends on LIRC_DEV
--- linux-rt-2.6.31.orig/ubuntu/lirc/lirc.h
+++ linux-rt-2.6.31/ubuntu/lirc/lirc.h
@@ -0,0 +1,105 @@
+/*      $Id: lirc.h,v 5.19 2009/08/29 07:52:41 lirc Exp $      */
+
+#ifndef _LINUX_LIRC_H
+#define _LINUX_LIRC_H
+
+#if defined(__linux__)
+#include <linux/ioctl.h>
+#elif defined(_NetBSD_)
+#include <sys/ioctl.h> 
+#elif defined(_CYGWIN_)
+#define __USE_LINUX_IOCTL_DEFS
+#include <sys/ioctl.h>
+#endif
+
+#define PULSE_BIT  0x01000000
+#define PULSE_MASK 0x00FFFFFF
+
+typedef int lirc_t;
+
+/*** lirc compatible hardware features ***/
+
+#define LIRC_MODE2SEND(x) (x)
+#define LIRC_SEND2MODE(x) (x)
+#define LIRC_MODE2REC(x) ((x) << 16)
+#define LIRC_REC2MODE(x) ((x) >> 16)
+
+#define LIRC_MODE_RAW                  0x00000001
+#define LIRC_MODE_PULSE                0x00000002
+#define LIRC_MODE_MODE2                0x00000004
+#define LIRC_MODE_CODE                 0x00000008
+#define LIRC_MODE_LIRCCODE             0x00000010
+#define LIRC_MODE_STRING               0x00000020
+
+
+#define LIRC_CAN_SEND_RAW              LIRC_MODE2SEND(LIRC_MODE_RAW)
+#define LIRC_CAN_SEND_PULSE            LIRC_MODE2SEND(LIRC_MODE_PULSE)
+#define LIRC_CAN_SEND_MODE2            LIRC_MODE2SEND(LIRC_MODE_MODE2)
+#define LIRC_CAN_SEND_CODE             LIRC_MODE2SEND(LIRC_MODE_CODE)
+#define LIRC_CAN_SEND_LIRCCODE         LIRC_MODE2SEND(LIRC_MODE_LIRCCODE)
+#define LIRC_CAN_SEND_STRING           LIRC_MODE2SEND(LIRC_MODE_STRING)
+
+#define LIRC_CAN_SEND_MASK             0x0000003f
+
+#define LIRC_CAN_SET_SEND_CARRIER      0x00000100
+#define LIRC_CAN_SET_SEND_DUTY_CYCLE   0x00000200
+#define LIRC_CAN_SET_TRANSMITTER_MASK  0x00000400
+
+#define LIRC_CAN_REC_RAW               LIRC_MODE2REC(LIRC_MODE_RAW)
+#define LIRC_CAN_REC_PULSE             LIRC_MODE2REC(LIRC_MODE_PULSE)
+#define LIRC_CAN_REC_MODE2             LIRC_MODE2REC(LIRC_MODE_MODE2)
+#define LIRC_CAN_REC_CODE              LIRC_MODE2REC(LIRC_MODE_CODE)
+#define LIRC_CAN_REC_LIRCCODE          LIRC_MODE2REC(LIRC_MODE_LIRCCODE)
+#define LIRC_CAN_REC_STRING            LIRC_MODE2REC(LIRC_MODE_STRING)
+
+#define LIRC_CAN_REC_MASK              LIRC_MODE2REC(LIRC_CAN_SEND_MASK)
+
+#define LIRC_CAN_SET_REC_CARRIER       (LIRC_CAN_SET_SEND_CARRIER << 16)
+#define LIRC_CAN_SET_REC_DUTY_CYCLE    (LIRC_CAN_SET_SEND_DUTY_CYCLE << 16)
+
+#define LIRC_CAN_SET_REC_DUTY_CYCLE_RANGE 0x40000000
+#define LIRC_CAN_SET_REC_CARRIER_RANGE    0x80000000
+#define LIRC_CAN_GET_REC_RESOLUTION       0x20000000
+
+#define LIRC_CAN_SEND(x) ((x)&LIRC_CAN_SEND_MASK)
+#define LIRC_CAN_REC(x) ((x)&LIRC_CAN_REC_MASK)
+
+#define LIRC_CAN_NOTIFY_DECODE            0x01000000
+
+/*** IOCTL commands for lirc driver ***/
+
+#define LIRC_GET_FEATURES              _IOR('i', 0x00000000, unsigned long)
+
+#define LIRC_GET_SEND_MODE             _IOR('i', 0x00000001, unsigned long)
+#define LIRC_GET_REC_MODE              _IOR('i', 0x00000002, unsigned long)
+#define LIRC_GET_SEND_CARRIER          _IOR('i', 0x00000003, unsigned int)
+#define LIRC_GET_REC_CARRIER           _IOR('i', 0x00000004, unsigned int)
+#define LIRC_GET_SEND_DUTY_CYCLE       _IOR('i', 0x00000005, unsigned int)
+#define LIRC_GET_REC_DUTY_CYCLE        _IOR('i', 0x00000006, unsigned int)
+#define LIRC_GET_REC_RESOLUTION        _IOR('i', 0x00000007, unsigned int)
+
+/* code length in bits, currently only for LIRC_MODE_LIRCCODE */
+#define LIRC_GET_LENGTH                _IOR('i', 0x0000000f, unsigned long)
+
+#define LIRC_SET_SEND_MODE             _IOW('i', 0x00000011, unsigned long)
+#define LIRC_SET_REC_MODE              _IOW('i', 0x00000012, unsigned long)
+/* Note: these can reset the according pulse_width */
+#define LIRC_SET_SEND_CARRIER          _IOW('i', 0x00000013, unsigned int)
+#define LIRC_SET_REC_CARRIER           _IOW('i', 0x00000014, unsigned int)
+#define LIRC_SET_SEND_DUTY_CYCLE       _IOW('i', 0x00000015, unsigned int)
+#define LIRC_SET_REC_DUTY_CYCLE        _IOW('i', 0x00000016, unsigned int)
+#define LIRC_SET_TRANSMITTER_MASK      _IOW('i', 0x00000017, unsigned int)
+
+/*
+ * to set a range use
+ * LIRC_SET_REC_DUTY_CYCLE_RANGE/LIRC_SET_REC_CARRIER_RANGE with the
+ * lower bound first and later
+ * LIRC_SET_REC_DUTY_CYCLE/LIRC_SET_REC_CARRIER with the upper bound
+ */
+
+#define LIRC_SET_REC_DUTY_CYCLE_RANGE  _IOW('i', 0x0000001e, unsigned int)
+#define LIRC_SET_REC_CARRIER_RANGE     _IOW('i', 0x0000001f, unsigned int)
+
+#define LIRC_NOTIFY_DECODE             _IO('i', 0x00000020)
+
+#endif
--- linux-rt-2.6.31.orig/ubuntu/lirc/kcompat.h
+++ linux-rt-2.6.31/ubuntu/lirc/kcompat.h
@@ -0,0 +1,402 @@
+/*      $Id: kcompat.h,v 5.44 2009/03/22 08:45:47 lirc Exp $      */
+
+#ifndef _KCOMPAT_H
+#define _KCOMPAT_H
+
+#include <linux/version.h>
+
+#ifndef __func__
+#define __func__ __FUNCTION__
+#endif
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 16)
+#define LIRC_THIS_MODULE(x) x,
+#else /* >= 2.6.16 */
+#define LIRC_THIS_MODULE(x)
+#endif
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0)
+
+#include <linux/device.h>
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 18)
+#define LIRC_HAVE_DEVFS
+#define LIRC_HAVE_DEVFS_26
+#endif
+
+#define LIRC_HAVE_SYSFS
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 13)
+
+typedef struct class_simple lirc_class_t;
+
+static inline lirc_class_t *class_create(struct module *owner, char *name)
+{
+	return class_simple_create(owner, name);
+}
+
+static inline void class_destroy(lirc_class_t *cls)
+{
+	class_simple_destroy(cls);
+}
+
+#define lirc_device_create(cs, parent, dev, drvdata, fmt, args...) \
+	class_simple_device_add(cs, dev, parent, fmt, ## args)
+
+static inline void lirc_device_destroy(lirc_class_t *cls, dev_t devt)
+{
+	class_simple_device_remove(devt);
+}
+
+#else /* >= 2.6.13 */
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 15)
+
+#define lirc_device_create(cs, parent, dev, drvdata, fmt, args...) \
+	class_device_create(cs, dev, parent, fmt, ## args)
+
+#else /* >= 2.6.15 */
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 26)
+
+#define lirc_device_create(cs, parent, dev, drvdata, fmt, args...) \
+	class_device_create(cs, NULL, dev, parent, fmt, ## args)
+
+#else /* >= 2.6.26 */
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 27)
+
+#define lirc_device_create(cs, parent, dev, drvdata, fmt, args...) \
+	device_create(cs, parent, dev, fmt, ## args)
+
+#else /* >= 2.6.27 */
+
+#define lirc_device_create device_create
+
+#endif /* >= 2.6.27 */
+
+#endif /* >= 2.6.26 */
+
+#define LIRC_DEVFS_PREFIX
+
+#endif /* >= 2.6.15 */
+
+typedef struct class lirc_class_t;
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 26)
+
+#define lirc_device_destroy class_device_destroy
+
+#else
+
+#define lirc_device_destroy device_destroy
+
+#endif
+
+#endif /* >= 2.6.13 */
+
+#elif LINUX_VERSION_CODE >= KERNEL_VERSION(2, 4, 0)
+#define LIRC_HAVE_DEVFS
+#define LIRC_HAVE_DEVFS_24
+#endif
+
+#ifndef LIRC_DEVFS_PREFIX
+#define LIRC_DEVFS_PREFIX "usb/"
+#endif
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 3, 0)
+#include <linux/timer.h>
+#include <linux/interrupt.h>
+static inline void del_timer_sync(struct timer_list *timerlist)
+{
+	start_bh_atomic();
+	del_timer(timerlist);
+	end_bh_atomic();
+}
+#endif
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 0)
+#ifdef daemonize
+#undef daemonize
+#endif
+#define daemonize(name) do {		\
+					\
+	lock_kernel();			\
+					\
+	exit_mm(current);		\
+	exit_files(current);		\
+	exit_fs(current);		\
+	current->session = 1;		\
+	current->pgrp = 1;		\
+	current->euid = 0;		\
+	current->tty = NULL;		\
+	sigfillset(&current->blocked);	\
+					\
+	strcpy(current->comm, name);	\
+					\
+	unlock_kernel();		\
+					\
+} while (0)
+
+/* Not sure when this was introduced, sometime during 2.5.X */
+#define MODULE_PARM_int(x) MODULE_PARM(x, "i")
+#define MODULE_PARM_bool(x) MODULE_PARM(x, "i")
+#define MODULE_PARM_long(x) MODULE_PARM(x, "l")
+#define module_param(x, y, z) MODULE_PARM_##y(x)
+#else
+#include <linux/moduleparam.h>
+#endif /* Linux < 2.6.0 */
+
+/* DevFS header */
+#if defined(LIRC_HAVE_DEVFS)
+#include <linux/devfs_fs_kernel.h>
+#endif
+
+#ifdef LIRC_HAVE_DEVFS_24
+#ifdef register_chrdev
+#undef register_chrdev
+#endif
+#define register_chrdev devfs_register_chrdev
+#ifdef unregister_chrdev
+#undef unregister_chrdev
+#endif
+#define unregister_chrdev devfs_unregister_chrdev
+#endif /* DEVFS 2.4 */
+
+#ifndef LIRC_HAVE_SYSFS
+#define class_destroy(x) do { } while (0)
+#define class_create(x, y) NULL
+#define lirc_device_destroy(x, y) do { } while (0)
+#define lirc_device_create(x, y, z, xx, yy, zz) 0
+#define IS_ERR(x) 0
+typedef struct class_simple
+{
+	int notused;
+} lirc_class_t;
+#endif /* No SYSFS */
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 5, 0)
+#define KERNEL_2_5
+
+/*
+ * We still are using MOD_INC_USE_COUNT/MOD_DEC_USE_COUNT in the set_use_inc
+ * function of all modules for 2.4 kernel compatibility.
+ *
+ * For 2.6 kernels reference counting is done in lirc_dev by
+ * try_module_get()/module_put() because the old approach is racy.
+ *
+ */
+#ifdef MOD_INC_USE_COUNT
+#undef MOD_INC_USE_COUNT
+#endif
+#define MOD_INC_USE_COUNT
+
+#ifdef MOD_DEC_USE_COUNT
+#undef MOD_DEC_USE_COUNT
+#endif
+#define MOD_DEC_USE_COUNT
+
+#ifdef EXPORT_NO_SYMBOLS
+#undef EXPORT_NO_SYMBOLS
+#endif
+#define EXPORT_NO_SYMBOLS
+
+#else  /* Kernel < 2.5.0 */
+
+static inline int try_module_get(struct module *module)
+{
+	return 1;
+}
+
+static inline void module_put(struct module *module)
+{
+}
+
+#endif /* Kernel >= 2.5.0 */
+
+#ifndef MODULE_LICENSE
+#define MODULE_LICENSE(x)
+#endif
+
+#ifndef MODULE_PARM_DESC
+#define MODULE_PARM_DESC(x, y)
+#endif
+
+#ifndef MODULE_ALIAS_CHARDEV_MAJOR
+#define MODULE_ALIAS_CHARDEV_MAJOR(x)
+#endif
+
+#ifndef MODULE_DEVICE_TABLE
+#define MODULE_DEVICE_TABLE(x, y)
+#endif
+
+#include <linux/interrupt.h>
+#ifndef IRQ_RETVAL
+typedef void irqreturn_t;
+#define IRQ_NONE
+#define IRQ_HANDLED
+#define IRQ_RETVAL(x)
+#endif
+
+#ifndef MOD_IN_USE
+#ifdef CONFIG_MODULE_UNLOAD
+#define MOD_IN_USE module_refcount(THIS_MODULE)
+#else
+#error "LIRC modules currently require"
+#error "  'Loadable module support  --->  Module unloading'"
+#error "to be enabled in the kernel"
+#endif
+#endif
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 18)
+#if !defined(local_irq_save)
+#define local_irq_save(flags) do { save_flags(flags); cli(); } while (0)
+#endif
+#if !defined(local_irq_restore)
+#define local_irq_restore(flags) do { restore_flags(flags); } while (0)
+#endif
+#endif
+
+#if KERNEL_VERSION(2, 4, 0) <= LINUX_VERSION_CODE
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 4, 22)
+#include <linux/pci.h>
+static inline char *pci_name(struct pci_dev *pdev)
+{
+	return pdev->slot_name;
+}
+#endif /* kernel < 2.4.22 */
+#endif /* kernel >= 2.4.0 */
+
+/*************************** I2C specific *****************************/
+#include <linux/i2c.h>
+
+#ifndef I2C_CLIENT_END
+#error "********************************************************"
+#error " Sorry, this driver needs the new I2C stack.            "
+#error " You can get it at http://www2.lm-sensors.nu/~lm78/.    "
+#error "********************************************************"
+#endif
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 5, 0)
+
+#undef i2c_get_clientdata
+#define i2c_get_clientdata(client) ((client)->data)
+
+
+#undef i2c_set_clientdata
+#define i2c_set_clientdata(client_ptr, new_data) do { \
+	(client_ptr)->data = new_data; \
+} while (0)
+
+
+#endif
+
+/* removed in 2.6.14 */
+#ifndef I2C_ALGO_BIT
+#   define I2C_ALGO_BIT 0
+#endif
+
+/* removed in 2.6.16 */
+#ifndef I2C_DRIVERID_EXP3
+#  define I2C_DRIVERID_EXP3 0xf003
+#endif
+
+/*************************** USB specific *****************************/
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 4, 0)
+#include <linux/usb.h>
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 8)
+static inline int usb_kill_urb(struct urb *urb)
+{
+	return usb_unlink_urb(urb);
+}
+#endif
+
+/* removed in 2.6.14 */
+#ifndef URB_ASYNC_UNLINK
+#define URB_ASYNC_UNLINK 0
+#endif
+#endif
+
+/*************************** bttv specific ****************************/
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 15) /* BTTV_* -> BTTV_BOARD_* */
+#define BTTV_BOARD_UNKNOWN         BTTV_UNKNOWN
+#define BTTV_BOARD_PXELVWPLTVPAK   BTTV_PXELVWPLTVPAK
+#define BTTV_BOARD_PXELVWPLTVPRO   BTTV_PXELVWPLTVPRO
+#define BTTV_BOARD_PV_BT878P_9B    BTTV_PV_BT878P_9B
+#define BTTV_BOARD_PV_BT878P_PLUS  BTTV_PV_BT878P_PLUS
+#define BTTV_BOARD_AVERMEDIA       BTTV_AVERMEDIA
+#define BTTV_BOARD_AVPHONE98       BTTV_AVPHONE98
+#define BTTV_BOARD_AVERMEDIA98     BTTV_AVERMEDIA98
+#define BTTV_BOARD_CHRONOS_VS2     BTTV_CHRONOS_VS2
+#define BTTV_BOARD_MIRO            BTTV_MIRO
+#define BTTV_BOARD_DYNALINK        BTTV_DYNALINK
+#define BTTV_BOARD_WINVIEW_601     BTTV_WINVIEW_601
+#ifdef BTTV_KWORLD
+#define BTTV_BOARD_KWORLD          BTTV_KWORLD
+#endif
+#define BTTV_BOARD_MAGICTVIEW061   BTTV_MAGICTVIEW061
+#define BTTV_BOARD_MAGICTVIEW063   BTTV_MAGICTVIEW063
+#define BTTV_BOARD_PHOEBE_TVMAS    BTTV_PHOEBE_TVMAS
+#ifdef BTTV_BESTBUY_EASYTV2
+#define BTTV_BOARD_BESTBUY_EASYTV  BTTV_BESTBUY_EASYTV
+#define BTTV_BOARD_BESTBUY_EASYTV2 BTTV_BESTBUY_EASYTV2
+#endif
+#define BTTV_BOARD_FLYVIDEO        BTTV_FLYVIDEO
+#define BTTV_BOARD_FLYVIDEO_98     BTTV_FLYVIDEO_98
+#define BTTV_BOARD_TYPHOON_TVIEW   BTTV_TYPHOON_TVIEW
+#ifdef BTTV_FLYVIDEO_98FM
+#define BTTV_BOARD_FLYVIDEO_98FM   BTTV_FLYVIDEO_98FM
+#endif
+#define BTTV_BOARD_WINFAST2000     BTTV_WINFAST2000
+#ifdef BTTV_GVBCTV5PCI
+#define BTTV_BOARD_GVBCTV5PCI      BTTV_GVBCTV5PCI
+#endif
+#endif  /* end BTTV_* -> BTTV_BOARD_* */
+
+
+/******************************* pm.h *********************************/
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0)
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 11)
+typedef u32 pm_message_t;
+#endif /* kernel < 2.6.11 */
+#endif /* kernel >= 2.6.0 */
+
+/*************************** interrupt.h ******************************/
+/* added in 2.6.18, old defines removed in 2.6.24 */
+#ifndef IRQF_DISABLED
+#define IRQF_DISABLED SA_INTERRUPT
+#endif
+#ifndef IRQF_SHARED
+#define IRQF_SHARED SA_SHIRQ
+#endif
+
+/*************************** spinlock.h *******************************/
+/* added in 2.6.11 */
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 11)
+#define DEFINE_SPINLOCK(x) spinlock_t x = SPIN_LOCK_UNLOCKED
+#endif
+
+/***************************** slab.h *********************************/
+/* added in 2.6.14 */
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 14)
+static inline void *kzalloc(size_t size, gfp_t flags)
+{
+        void *ret = kmalloc(size, flags);
+        if (ret)
+                memset(ret, 0, size);
+        return ret;
+}
+#endif
+
+/****************************** fs.h **********************************/
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 0)
+static inline unsigned iminor(struct inode *inode)
+{
+	return MINOR(inode->i_rdev);
+}
+#endif
+
+#endif /* _KCOMPAT_H */
--- linux-rt-2.6.31.orig/ubuntu/lirc/lirc_ttusbir/lirc_ttusbir.c
+++ linux-rt-2.6.31/ubuntu/lirc/lirc_ttusbir/lirc_ttusbir.c
@@ -0,0 +1,410 @@
+/*
+ * lirc_ttusbir.c
+ *
+ * lirc_ttusbir - LIRC device driver for the TechnoTrend USB IR Receiver
+ *
+ * Copyright (C) 2007 Stefan Macher <st_maker-lirc@yahoo.de>
+ *
+ * This LIRC driver provides access to the TechnoTrend USB IR Receiver.
+ * The receiver delivers the IR signal as raw sampled true/false data in
+ * isochronous USB packets each of size 128 byte.
+ * Currently the driver reduces the sampling rate by factor of 8 as this
+ * is still more than enough to decode RC-5 - others should be analyzed.
+ * But the driver does not rely on RC-5 it should be able to decode every
+ * IR signal that is not too fast.
+ */
+
+/*
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+#include <linux/version.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/errno.h>
+#include <linux/slab.h>
+#include <linux/usb.h>
+
+#include "../lirc.h"
+#include "../kcompat.h"
+#include "../lirc_dev/lirc_dev.h"
+
+MODULE_DESCRIPTION("TechnoTrend USB IR device driver for LIRC");
+MODULE_AUTHOR("Stefan Macher (st_maker-lirc@yahoo.de)");
+MODULE_LICENSE("GPL");
+
+/* #define DEBUG */
+#ifdef DEBUG
+#define DPRINTK printk
+#else
+#define DPRINTK(_x_, a...)
+#endif
+
+/* function declarations */
+static int probe(struct usb_interface *intf, const struct usb_device_id *id);
+static void disconnect(struct usb_interface *intf);
+#if defined(KERNEL_2_5) && LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 19)
+static void urb_complete(struct urb *urb, struct pt_regs *pt_regs);
+#else
+static void urb_complete(struct urb *urb);
+#endif
+static int set_use_inc(void *data);
+static void set_use_dec(void *data);
+
+static int num_urbs = 2;
+module_param(num_urbs, int, S_IRUGO);
+MODULE_PARM_DESC(num_urbs,
+		 "Number of URBs in queue. Try to increase to 4 in case "
+		 "of problems (default: 2; minimum: 2)");
+
+/* table of devices that work with this driver */
+static struct usb_device_id device_id_table[] = {
+	/* TechnoTrend USB IR Receiver */
+	{ USB_DEVICE(0x0B48, 0x2003) },
+	/* Terminating entry */
+	{ }
+};
+MODULE_DEVICE_TABLE(usb, device_id_table);
+
+/* USB driver definition */
+static struct usb_driver usb_driver = {
+	.name = "TTUSBIR",
+	.id_table = &(device_id_table[0]),
+	.probe = probe,
+	.disconnect = disconnect,
+};
+
+/* USB device definition */
+struct ttusbir_device {
+	struct usb_driver *usb_driver;
+	struct usb_device *udev;
+	struct usb_interface *interf;
+	struct usb_class_driver class_driver;
+	unsigned int ifnum; /* Interface number to use */
+	unsigned int alt_setting; /* alternate setting to use */
+	unsigned int endpoint; /* Endpoint to use */
+	struct urb **urb; /* num_urb URB pointers*/
+	char **buffer; /* 128 byte buffer for each URB */
+	struct lirc_buffer rbuf; /* Buffer towards LIRC */
+	struct lirc_driver driver;
+	int minor;
+	int last_pulse; /* remembers if last received byte was pulse or space */
+	int last_num; /* remembers how many last bytes appeared */
+	int opened;
+};
+
+/*** LIRC specific functions ***/
+static int set_use_inc(void *data)
+{
+	int i, retval;
+	struct ttusbir_device *ttusbir = data;
+
+	DPRINTK("Sending first URBs\n");
+	/* @TODO Do I need to check if I am already opened */
+	ttusbir->opened = 1;
+
+	for (i = 0; i < num_urbs; i++) {
+		retval = usb_submit_urb(ttusbir->urb[i], GFP_KERNEL);
+		if (retval) {
+			err("%s: usb_submit_urb failed on urb %d",
+			    __func__, i);
+			return retval;
+		}
+	}
+	return 0;
+}
+
+static void set_use_dec(void *data)
+{
+	struct ttusbir_device *ttusbir = data;
+
+	DPRINTK("Device closed\n");
+
+	ttusbir->opened = 0;
+}
+
+/*** USB specific functions ***/
+
+/*
+ * This mapping table is used to do a very simple filtering of the
+ * input signal.
+ * For a value with at least 4 bits set it returns 0xFF otherwise
+ * 0x00.  For faster IR signals this can not be used. But for RC-5 we
+ * still have about 14 samples per pulse/space, i.e. we sample with 14
+ * times higher frequency than the signal frequency
+ */
+const unsigned char map_table[] =
+{
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF,
+	0x00, 0x00, 0x00, 0xFF, 0x00, 0xFF, 0xFF, 0xFF,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF,
+	0x00, 0x00, 0x00, 0xFF, 0x00, 0xFF, 0xFF, 0xFF,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF,
+	0x00, 0x00, 0x00, 0xFF, 0x00, 0xFF, 0xFF, 0xFF,
+	0x00, 0x00, 0x00, 0xFF, 0x00, 0xFF, 0xFF, 0xFF,
+	0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF,
+	0x00, 0x00, 0x00, 0xFF, 0x00, 0xFF, 0xFF, 0xFF,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF,
+	0x00, 0x00, 0x00, 0xFF, 0x00, 0xFF, 0xFF, 0xFF,
+	0x00, 0x00, 0x00, 0xFF, 0x00, 0xFF, 0xFF, 0xFF,
+	0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF,
+	0x00, 0x00, 0x00, 0xFF, 0x00, 0xFF, 0xFF, 0xFF,
+	0x00, 0x00, 0x00, 0xFF, 0x00, 0xFF, 0xFF, 0xFF,
+	0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	0x00, 0x00, 0x00, 0xFF, 0x00, 0xFF, 0xFF, 0xFF,
+	0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
+};
+
+#if defined(KERNEL_2_5) && LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 19)
+static void urb_complete(struct urb *urb, struct pt_regs *pt_regs)
+#else
+static void urb_complete(struct urb *urb)
+#endif
+{
+	struct ttusbir_device *ttusbir;
+	unsigned char *buf;
+	int i;
+	lirc_t l;
+
+	ttusbir = urb->context;
+
+	if (!ttusbir->opened)
+		return;
+
+	buf = (unsigned char *)urb->transfer_buffer;
+
+	for (i = 0; i < 128; i++) {
+		/* Here we do the filtering and some kind of down sampling */
+		buf[i] = ~map_table[buf[i]];
+		if (ttusbir->last_pulse == buf[i]) {
+			if (ttusbir->last_num < PULSE_MASK/63)
+				ttusbir->last_num++;
+		/*
+		 * else we are in a idle period and do not need to
+		 * increment any longer
+		 */
+		} else {
+			l = ttusbir->last_num * 62; /* about 62 = us/byte */
+			if (ttusbir->last_pulse) /* pulse or space? */
+				l |= PULSE_BIT;
+			if (!lirc_buffer_full(&ttusbir->rbuf)) {
+				lirc_buffer_write(&ttusbir->rbuf, (void *)&l);
+				wake_up_interruptible(&ttusbir->rbuf.wait_poll);
+			}
+			ttusbir->last_num = 0;
+			ttusbir->last_pulse = buf[i];
+		}
+	}
+	usb_submit_urb(urb, GFP_ATOMIC); /* keep data rolling :-) */
+}
+
+/*
+ * Called whenever the USB subsystem thinks we could be the right driver
+ * to handle this device
+ */
+static int probe(struct usb_interface *intf, const struct usb_device_id *id)
+{
+	int alt_set, endp;
+	int found = 0;
+	int i, j;
+	int struct_size;
+	struct usb_host_interface *host_interf;
+	struct usb_interface_descriptor *interf_desc;
+	struct usb_host_endpoint *host_endpoint;
+	struct ttusbir_device *ttusbir;
+
+	DPRINTK("Module ttusbir probe\n");
+
+	/* To reduce memory fragmentation we use only one allocation */
+	struct_size =  sizeof(struct ttusbir_device) +
+		(sizeof(struct urb *) * num_urbs) +
+		(sizeof(char *) * num_urbs) +
+		(num_urbs * 128);
+	ttusbir = kzalloc(struct_size, GFP_KERNEL);
+	if (!ttusbir)
+		return -ENOMEM;
+
+	ttusbir->urb = (struct urb **)((char *)ttusbir +
+				      sizeof(struct ttusbir_device));
+	ttusbir->buffer = (char **)((char *)ttusbir->urb +
+				   (sizeof(struct urb *) * num_urbs));
+	for (i = 0; i < num_urbs; i++)
+		ttusbir->buffer[i] = (char *)ttusbir->buffer +
+			(sizeof(char *)*num_urbs) + (i * 128);
+
+	ttusbir->usb_driver = &usb_driver;
+	ttusbir->alt_setting = -1;
+	/* @TODO check if error can be returned */
+	ttusbir->udev = usb_get_dev(interface_to_usbdev(intf));
+	ttusbir->interf = intf;
+	ttusbir->last_pulse = 0x00;
+	ttusbir->last_num = 0;
+
+	/*
+	 * Now look for interface setting we can handle
+	 * We are searching for the alt setting where end point
+	 * 0x82 has max packet size 16
+	 */
+	for (alt_set = 0; alt_set < intf->num_altsetting && !found; alt_set++) {
+		host_interf = &intf->altsetting[alt_set];
+		interf_desc = &host_interf->desc;
+		for (endp = 0; endp < interf_desc->bNumEndpoints; endp++) {
+			host_endpoint = &host_interf->endpoint[endp];
+			if ((host_endpoint->desc.bEndpointAddress == 0x82) &&
+			    (host_endpoint->desc.wMaxPacketSize == 0x10)) {
+				ttusbir->alt_setting = alt_set;
+				ttusbir->endpoint = endp;
+				found = 1;
+				break;
+			}
+		}
+	}
+	if (ttusbir->alt_setting != -1)
+		DPRINTK("alt setting: %d\n", ttusbir->alt_setting);
+	else {
+		err("Could not find alternate setting\n");
+		kfree(ttusbir);
+		return -EINVAL;
+	}
+
+	/* OK lets setup this interface setting */
+	usb_set_interface(ttusbir->udev, 0, ttusbir->alt_setting);
+
+	/* Store device info in interface structure */
+	usb_set_intfdata(intf, ttusbir);
+
+	/* Register as a LIRC driver */
+	if (lirc_buffer_init(&ttusbir->rbuf, sizeof(lirc_t), 256) < 0) {
+		err("Could not get memory for LIRC data buffer\n");
+		usb_set_intfdata(intf, NULL);
+		kfree(ttusbir);
+		return -ENOMEM;
+	}
+	strcpy(ttusbir->driver.name, "TTUSBIR");
+	ttusbir->driver.minor = -1;
+	ttusbir->driver.code_length = 1;
+	ttusbir->driver.sample_rate = 0;
+	ttusbir->driver.data = ttusbir;
+	ttusbir->driver.add_to_buf = NULL;
+#ifndef LIRC_REMOVE_DURING_EXPORT
+	ttusbir->driver.get_queue = NULL;
+#endif
+	ttusbir->driver.rbuf = &ttusbir->rbuf;
+	ttusbir->driver.set_use_inc = set_use_inc;
+	ttusbir->driver.set_use_dec = set_use_dec;
+	ttusbir->driver.fops = NULL;
+	ttusbir->driver.dev = &intf->dev;
+	ttusbir->driver.owner = THIS_MODULE;
+	ttusbir->driver.features = LIRC_CAN_REC_MODE2;
+	ttusbir->minor = lirc_register_driver(&ttusbir->driver);
+	if (ttusbir->minor < 0) {
+		err("Error registering as LIRC driver\n");
+		usb_set_intfdata(intf, NULL);
+		lirc_buffer_free(&ttusbir->rbuf);
+		kfree(ttusbir);
+		return -EIO;
+	}
+
+	/* Allocate and setup the URB that we will use to talk to the device */
+	for (i = 0; i < num_urbs; i++) {
+		ttusbir->urb[i] = usb_alloc_urb(8, GFP_KERNEL);
+		if (!ttusbir->urb[i]) {
+			err("Could not allocate memory for the URB\n");
+			for (j = i - 1; j >= 0; j--)
+				kfree(ttusbir->urb[j]);
+			lirc_buffer_free(&ttusbir->rbuf);
+			lirc_unregister_driver(ttusbir->minor);
+			kfree(ttusbir);
+			usb_set_intfdata(intf, NULL);
+			return -ENOMEM;
+		}
+		ttusbir->urb[i]->dev = ttusbir->udev;
+		ttusbir->urb[i]->context = ttusbir;
+		ttusbir->urb[i]->pipe = usb_rcvisocpipe(ttusbir->udev,
+							ttusbir->endpoint);
+		ttusbir->urb[i]->interval = 1;
+		ttusbir->urb[i]->transfer_flags = URB_ISO_ASAP;
+		ttusbir->urb[i]->transfer_buffer = &ttusbir->buffer[i][0];
+		ttusbir->urb[i]->complete = urb_complete;
+		ttusbir->urb[i]->number_of_packets = 8;
+		ttusbir->urb[i]->transfer_buffer_length = 128;
+		for (j = 0; j < 8; j++) {
+			ttusbir->urb[i]->iso_frame_desc[j].offset = j*16;
+			ttusbir->urb[i]->iso_frame_desc[j].length = 16;
+		}
+	}
+	return 0;
+}
+
+/**
+ * Called when the driver is unloaded or the device is unplugged
+ */
+static void disconnect(struct usb_interface *intf)
+{
+	int i;
+	struct ttusbir_device *ttusbir;
+
+	DPRINTK("Module ttusbir disconnect\n");
+
+	ttusbir = (struct ttusbir_device *) usb_get_intfdata(intf);
+	usb_set_intfdata(intf, NULL);
+	lirc_unregister_driver(ttusbir->minor);
+	DPRINTK("unregistered\n");
+
+	for (i = 0; i < num_urbs; i++) {
+		usb_kill_urb(ttusbir->urb[i]);
+		usb_free_urb(ttusbir->urb[i]);
+	}
+	DPRINTK("URBs killed\n");
+	lirc_buffer_free(&ttusbir->rbuf);
+	kfree(ttusbir);
+}
+
+static int ttusbir_init_module(void)
+{
+	int result;
+
+	DPRINTK(KERN_DEBUG "Module ttusbir init\n");
+
+	/* register this driver with the USB subsystem */
+	result = usb_register(&usb_driver);
+	if (result)
+		err("usb_register failed. Error number %d", result);
+	return result;
+}
+
+static void ttusbir_exit_module(void)
+{
+	printk(KERN_DEBUG "Module ttusbir exit\n");
+	usb_deregister(&usb_driver);
+}
+
+module_init(ttusbir_init_module);
+module_exit(ttusbir_exit_module);
--- linux-rt-2.6.31.orig/ubuntu/lirc/lirc_ttusbir/Makefile
+++ linux-rt-2.6.31/ubuntu/lirc/lirc_ttusbir/Makefile
@@ -0,0 +1,3 @@
+EXTRA_CFLAGS =-DIRCTL_DEV_MAJOR=61 -DLIRC_SERIAL_TRANSMITTER -DLIRC_SERIAL_SOFTCARRIER -I$(src)/..
+
+obj-$(CONFIG_LIRC_TTUSBIR)	+= lirc_ttusbir.o
--- linux-rt-2.6.31.orig/ubuntu/lirc/lirc_igorplugusb/lirc_igorplugusb.c
+++ linux-rt-2.6.31/ubuntu/lirc/lirc_igorplugusb/lirc_igorplugusb.c
@@ -0,0 +1,637 @@
+/*
+ * lirc_igorplugusb - USB remote support for LIRC
+ *
+ * Supports the standard homebrew IgorPlugUSB receiver with Igor's firmware.
+ * See http://www.cesko.host.sk/IgorPlugUSB/IgorPlug-USB%20(AVR)_eng.htm
+ *
+ * The device can only record bursts of up to 36 pulses/spaces.
+ * Works fine with RC5. Longer commands lead to device buffer overrun.
+ * (Maybe a better firmware or a microcontroller with more ram can help?)
+ *
+ * Version 0.1  [beta status]
+ *
+ * Copyright (C) 2004 Jan M. Hochstein
+ *	<hochstein@algo.informatik.tu-darmstadt.de>
+ *
+ * This driver was derived from:
+ *   Paul Miller <pmiller9@users.sourceforge.net>
+ *      "lirc_atiusb" module
+ *   Vladimir Dergachev <volodya@minspring.com>'s 2002
+ *      "USB ATI Remote support" (input device)
+ *   Adrian Dewhurst <sailor-lk@sailorfrag.net>'s 2002
+ *      "USB StreamZap remote driver" (LIRC)
+ *   Artur Lipowski <alipowski@kki.net.pl>'s 2002
+ *      "lirc_dev" and "lirc_gpio" LIRC modules
+ */
+
+/*
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+
+#include <linux/version.h>
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 4, 0)
+#error "*******************************************************"
+#error "Sorry, this driver needs kernel version 2.4.0 or higher"
+#error "*******************************************************"
+#endif
+
+#include <linux/autoconf.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/kmod.h>
+#include <linux/sched.h>
+#include <linux/errno.h>
+#include <linux/ioctl.h>
+#include <linux/fs.h>
+#include <linux/usb.h>
+#include <linux/poll.h>
+#include <linux/smp_lock.h>
+#include <linux/time.h>
+
+#include "../kcompat.h"
+#include "../lirc.h"
+#include "../lirc_dev/lirc_dev.h"
+
+#if !defined(KERNEL_2_5)
+#define USB_CTRL_GET_TIMEOUT    5
+#endif
+
+/* module identification */
+#define DRIVER_VERSION		"0.2"
+#define DRIVER_AUTHOR		\
+	"Jan M. Hochstein <hochstein@algo.informatik.tu-darmstadt.de>"
+#define DRIVER_DESC		"USB remote driver for LIRC"
+#define DRIVER_NAME		"lirc_igorplugusb"
+
+/* debugging support */
+#ifdef CONFIG_USB_DEBUG
+static int debug = 1;
+#else
+static int debug;
+#endif
+
+#define dprintk(fmt, args...)					\
+	do {							\
+		if (debug)					\
+			printk(KERN_DEBUG DRIVER_NAME fmt, ## args);	\
+	} while (0)
+
+/* One mode2 pulse/space has 4 bytes. */
+#define CODE_LENGTH	     sizeof(lirc_t)
+
+/* Igor's firmware cannot record bursts longer than 36. */
+#define DEVICE_BUFLEN	   36
+
+/*
+ * Header at the beginning of the device's buffer:
+ *	unsigned char data_length
+ *	unsigned char data_start    (!=0 means ring-buffer overrun)
+ *	unsigned char counter       (incremented by each burst)
+ */
+#define DEVICE_HEADERLEN	3
+
+/* This is for the gap */
+#define ADDITIONAL_LIRC_BYTES   2
+
+/* times to poll per second */
+#define SAMPLE_RATE	     100
+static int sample_rate = SAMPLE_RATE;
+
+
+/**** Igor's USB Request Codes */
+
+#define SET_INFRABUFFER_EMPTY   1
+/**
+ * Params: none
+ * Answer: empty
+ */
+
+#define GET_INFRACODE	   2
+/**
+ * Params:
+ *   wValue: offset to begin reading infra buffer
+ *
+ * Answer: infra data
+ */
+
+#define SET_DATAPORT_DIRECTION  3
+/**
+ * Params:
+ *   wValue: (byte) 1 bit for each data port pin (0=in, 1=out)
+ *
+ * Answer: empty
+ */
+
+#define GET_DATAPORT_DIRECTION  4
+/**
+ * Params: none
+ *
+ * Answer: (byte) 1 bit for each data port pin (0=in, 1=out)
+ */
+
+#define SET_OUT_DATAPORT	5
+/**
+ * Params:
+ *   wValue: byte to write to output data port
+ *
+ * Answer: empty
+ */
+
+#define GET_OUT_DATAPORT	6
+/**
+ * Params: none
+ *
+ * Answer: least significant 3 bits read from output data port
+ */
+
+#define GET_IN_DATAPORT	 7
+/**
+ * Params: none
+ *
+ * Answer: least significant 3 bits read from input data port
+ */
+
+#define READ_EEPROM	     8
+/**
+ * Params:
+ *   wValue: offset to begin reading EEPROM
+ *
+ * Answer: EEPROM bytes
+ */
+
+#define WRITE_EEPROM	    9
+/**
+ * Params:
+ *   wValue: offset to EEPROM byte
+ *   wIndex: byte to write
+ *
+ * Answer: empty
+ */
+
+#define SEND_RS232	      10
+/**
+ * Params:
+ *   wValue: byte to send
+ *
+ * Answer: empty
+ */
+
+#define RECV_RS232	      11
+/**
+ * Params: none
+ *
+ * Answer: byte received
+ */
+
+#define SET_RS232_BAUD	  12
+/**
+ * Params:
+ *   wValue: byte to write to UART bit rate register (UBRR)
+ *
+ * Answer: empty
+ */
+
+#define GET_RS232_BAUD	  13
+/**
+ * Params: none
+ *
+ * Answer: byte read from UART bit rate register (UBRR)
+ */
+
+
+/* data structure for each usb remote */
+struct igorplug {
+
+	/* usb */
+	struct usb_device *usbdev;
+	struct urb *urb_in;
+	int devnum;
+
+	unsigned char *buf_in;
+	unsigned int len_in;
+	int in_space;
+	struct timeval last_time;
+
+#if defined(KERNEL_2_5)
+	dma_addr_t dma_in;
+#endif
+
+	/* lirc */
+	struct lirc_driver *d;
+
+	/* handle sending (init strings) */
+	int send_flags;
+};
+
+static int set_use_inc(void *data)
+{
+	struct igorplug *ir = data;
+
+	if (!ir) {
+		printk(KERN_ERR DRIVER_NAME
+		       "[?]: set_use_inc called with no context\n");
+		return -EIO;
+	}
+	dprintk("[%d]: set use inc\n", ir->devnum);
+
+	MOD_INC_USE_COUNT;
+
+	if (!ir->usbdev)
+		return -ENODEV;
+
+	return 0;
+}
+
+static void set_use_dec(void *data)
+{
+	struct igorplug *ir = data;
+
+	if (!ir) {
+		printk(KERN_ERR DRIVER_NAME
+		       "[?]: set_use_dec called with no context\n");
+		return;
+	}
+	dprintk("[%d]: set use dec\n", ir->devnum);
+
+	MOD_DEC_USE_COUNT;
+}
+
+static void send_fragment(struct igorplug *ir, struct lirc_buffer *buf,
+			   int i, int max)
+{
+	/* MODE2: pulse/space (PULSE_BIT) in 1us units */
+	while (i < max) {
+		/* 1 Igor-tick = 85.333333 us */
+		lirc_t code = (unsigned int)ir->buf_in[i] * 85 +
+			(unsigned int)ir->buf_in[i] / 3;
+		ir->last_time.tv_usec += code;
+		if (ir->in_space)
+			code |= PULSE_BIT;
+		lirc_buffer_write_n(buf, (unsigned char *)&code, 1);
+		/* 1 chunk = CODE_LENGTH bytes */
+		ir->in_space ^= 1;
+		++i;
+	}
+}
+
+/**
+ * Called in user context.
+ * return 0 if data was added to the buffer and
+ * -ENODATA if none was available. This should add some number of bits
+ * evenly divisible by code_length to the buffer
+ */
+static int usb_remote_poll(void *data, struct lirc_buffer *buf)
+{
+	int ret;
+	struct igorplug *ir = (struct igorplug *)data;
+
+	if (!ir->usbdev)  /* Has the device been removed? */
+		return -ENODEV;
+
+	memset(ir->buf_in, 0, ir->len_in);
+
+	ret = usb_control_msg(
+	      ir->usbdev, usb_rcvctrlpipe(ir->usbdev, 0),
+	      GET_INFRACODE, USB_TYPE_VENDOR|USB_DIR_IN,
+	      0/* offset */, /*unused*/0,
+	      ir->buf_in, ir->len_in,
+	      /*timeout*/HZ * USB_CTRL_GET_TIMEOUT);
+	if (ret > 0) {
+		lirc_t code, timediff;
+		struct timeval now;
+
+		/* ACK packet has 1 byte --> ignore */
+		if (ret < DEVICE_HEADERLEN)
+			return -ENODATA;
+
+		dprintk(": Got %d bytes. Header: %02x %02x %02x\n",
+			ret, ir->buf_in[0], ir->buf_in[1], ir->buf_in[2]);
+
+		do_gettimeofday(&now);
+		timediff = now.tv_sec - ir->last_time.tv_sec;
+		if (timediff + 1 > PULSE_MASK / 1000000)
+			timediff = PULSE_MASK;
+		else {
+			timediff *= 1000000;
+			timediff += now.tv_usec - ir->last_time.tv_usec;
+		}
+		ir->last_time.tv_sec = now.tv_sec;
+		ir->last_time.tv_usec = now.tv_usec;
+
+		/* create leading gap  */
+		code = timediff;
+		lirc_buffer_write(buf, (unsigned char *)&code);
+		ir->in_space = 1;   /* next comes a pulse */
+
+		if (ir->buf_in[2] == 0)
+			send_fragment(ir, buf, DEVICE_HEADERLEN, ret);
+		else {
+			printk(KERN_WARNING DRIVER_NAME
+			       "[%d]: Device buffer overrun.\n", ir->devnum);
+			/* HHHNNNNNNNNNNNOOOOOOOO H = header
+			      <---[2]--->         N = newer
+			   <---------ret--------> O = older */
+			ir->buf_in[2] %= ret - DEVICE_HEADERLEN; /* sanitize */
+			/* keep even-ness to not desync pulse/pause */
+			send_fragment(ir, buf, DEVICE_HEADERLEN +
+				      ir->buf_in[2] - (ir->buf_in[2] & 1),
+				      ret);
+			send_fragment(ir, buf, DEVICE_HEADERLEN,
+				      DEVICE_HEADERLEN + ir->buf_in[2]);
+		}
+
+		ret = usb_control_msg(
+		      ir->usbdev, usb_rcvctrlpipe(ir->usbdev, 0),
+		      SET_INFRABUFFER_EMPTY, USB_TYPE_VENDOR|USB_DIR_IN,
+		      /*unused*/0, /*unused*/0,
+		      /*dummy*/ir->buf_in, /*dummy*/ir->len_in,
+		      /*timeout*/HZ * USB_CTRL_GET_TIMEOUT);
+		if (ret < 0)
+			printk(KERN_WARNING DRIVER_NAME
+			       "[%d]: SET_INFRABUFFER_EMPTY: error %d\n",
+			       ir->devnum, ret);
+		return 0;
+	} else
+		printk(KERN_WARNING DRIVER_NAME
+		       "[%d]: GET_INFRACODE: error %d\n",
+			ir->devnum, ret);
+
+	return -ENODATA;
+}
+
+
+
+#if defined(KERNEL_2_5)
+static int usb_remote_probe(struct usb_interface *intf,
+				const struct usb_device_id *id)
+{
+	struct usb_device *dev = NULL;
+	struct usb_host_interface *idesc = NULL;
+	struct usb_host_endpoint *ep_ctl2;
+#else
+static void *usb_remote_probe(struct usb_device *dev, unsigned int ifnum,
+				const struct usb_device_id *id)
+{
+	struct usb_interface *intf;
+	struct usb_interface_descriptor *idesc;
+	struct usb_endpoint_descriptor *ep_ctl2;
+#endif
+	struct igorplug *ir = NULL;
+	struct lirc_driver *driver = NULL;
+	int devnum, pipe, maxp;
+	int minor = 0;
+	char buf[63], name[128] = "";
+	int mem_failure = 0;
+	int ret;
+
+	dprintk(": usb probe called.\n");
+
+#if defined(KERNEL_2_5)
+	dev = interface_to_usbdev(intf);
+
+#  if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 5)
+	idesc = &intf->altsetting[intf->act_altsetting];  /* in 2.6.4 */
+#  else
+	idesc = intf->cur_altsetting;  /* in 2.6.6 */
+#  endif
+
+	if (idesc->desc.bNumEndpoints != 1)
+		return -ENODEV;
+	ep_ctl2 = idesc->endpoint;
+	if (((ep_ctl2->desc.bEndpointAddress & USB_ENDPOINT_DIR_MASK)
+	    != USB_DIR_IN)
+	    || (ep_ctl2->desc.bmAttributes & USB_ENDPOINT_XFERTYPE_MASK)
+	    != USB_ENDPOINT_XFER_CONTROL)
+		return -ENODEV;
+	pipe = usb_rcvctrlpipe(dev, ep_ctl2->desc.bEndpointAddress);
+#else
+	intf = &dev->actconfig->interface[ifnum];
+	idesc = &intf->altsetting[intf->act_altsetting];
+	if (idesc->bNumEndpoints != 1)
+		return NULL;
+	ep_ctl2 = idesc->endpoint;
+	if (((ep_ctl2->bEndpointAddress & USB_ENDPOINT_DIR_MASK)
+	    != USB_DIR_IN)
+	    || (ep_ctl2->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK)
+	    != USB_ENDPOINT_XFER_CONTROL)
+		return NULL;
+	pipe = usb_rcvctrlpipe(dev, ep_ctl2->bEndpointAddress);
+#endif
+	devnum = dev->devnum;
+	maxp = usb_maxpacket(dev, pipe, usb_pipeout(pipe));
+
+	dprintk(DRIVER_NAME "[%d]: bytes_in_key=%d maxp=%d\n",
+		devnum, CODE_LENGTH, maxp);
+
+
+	mem_failure = 0;
+	ir = kzalloc(sizeof(struct igorplug), GFP_KERNEL);
+	if (!ir) {
+		mem_failure = 1;
+		goto mem_failure_switch;
+	}
+
+	driver = kzalloc(sizeof(struct lirc_driver), GFP_KERNEL);
+	if (!driver) {
+		mem_failure = 2;
+		goto mem_failure_switch;
+	}
+
+#if defined(KERNEL_2_5)
+	ir->buf_in = usb_buffer_alloc(dev,
+			      DEVICE_BUFLEN+DEVICE_HEADERLEN,
+			      GFP_ATOMIC, &ir->dma_in);
+#else
+	ir->buf_in = kmalloc(DEVICE_BUFLEN+DEVICE_HEADERLEN,
+			     GFP_KERNEL);
+#endif
+	if (!ir->buf_in) {
+		mem_failure = 3;
+		goto mem_failure_switch;
+	}
+
+	strcpy(driver->name, DRIVER_NAME " ");
+	driver->minor = -1;
+	driver->code_length = CODE_LENGTH * 8; /* in bits */
+	driver->features = LIRC_CAN_REC_MODE2;
+	driver->data = ir;
+	driver->buffer_size = DEVICE_BUFLEN + ADDITIONAL_LIRC_BYTES;
+	driver->set_use_inc = &set_use_inc;
+	driver->set_use_dec = &set_use_dec;
+	driver->sample_rate = sample_rate;    /* per second */
+	driver->add_to_buf = &usb_remote_poll;
+#ifdef LIRC_HAVE_SYSFS
+	driver->dev = &intf->dev;
+#endif
+	driver->owner = THIS_MODULE;
+
+	minor = lirc_register_driver(driver);
+	if (minor < 0)
+		mem_failure = 9;
+
+mem_failure_switch:
+
+	switch (mem_failure) {
+	case 9:
+#if defined(KERNEL_2_5)
+		usb_buffer_free(dev, DEVICE_BUFLEN+DEVICE_HEADERLEN,
+			ir->buf_in, ir->dma_in);
+#else
+		kfree(ir->buf_in);
+#endif
+	case 3:
+		kfree(driver);
+	case 2:
+		kfree(ir);
+	case 1:
+		printk(KERN_ERR DRIVER_NAME "[%d]: out of memory (code=%d)\n",
+			devnum, mem_failure);
+#if defined(KERNEL_2_5)
+		return -ENOMEM;
+#else
+		return NULL;
+#endif
+	}
+
+	driver->minor = minor;
+	ir->d = driver;
+	ir->devnum = devnum;
+	ir->usbdev = dev;
+	ir->len_in = DEVICE_BUFLEN+DEVICE_HEADERLEN;
+	ir->in_space = 1; /* First mode2 event is a space. */
+	do_gettimeofday(&ir->last_time);
+
+	if (dev->descriptor.iManufacturer
+	    && usb_string(dev, dev->descriptor.iManufacturer,
+			  buf, sizeof(buf)) > 0)
+		strlcpy(name, buf, sizeof(name));
+	if (dev->descriptor.iProduct
+	    && usb_string(dev, dev->descriptor.iProduct, buf, sizeof(buf)) > 0)
+		snprintf(name + strlen(name), sizeof(name) - strlen(name),
+			 " %s", buf);
+	printk(KERN_INFO DRIVER_NAME "[%d]: %s on usb%d:%d\n", devnum, name,
+	       dev->bus->busnum, devnum);
+
+	/* clear device buffer */
+	ret = usb_control_msg(ir->usbdev, usb_rcvctrlpipe(ir->usbdev, 0),
+		SET_INFRABUFFER_EMPTY, USB_TYPE_VENDOR|USB_DIR_IN,
+		/*unused*/0, /*unused*/0,
+		/*dummy*/ir->buf_in, /*dummy*/ir->len_in,
+		/*timeout*/HZ * USB_CTRL_GET_TIMEOUT);
+	if (ret < 0)
+		printk(KERN_WARNING DRIVER_NAME
+		       "[%d]: SET_INFRABUFFER_EMPTY: error %d\n",
+			devnum, ret);
+
+#if defined(KERNEL_2_5)
+	usb_set_intfdata(intf, ir);
+	return 0;
+#else
+	return ir;
+#endif
+}
+
+
+#if defined(KERNEL_2_5)
+static void usb_remote_disconnect(struct usb_interface *intf)
+{
+	struct usb_device *dev = interface_to_usbdev(intf);
+	struct igorplug *ir = usb_get_intfdata(intf);
+#else
+static void usb_remote_disconnect(struct usb_device *dev, void *ptr)
+{
+	struct igorplug *ir = ptr;
+#endif
+
+	if (!ir || !ir->d)
+		return;
+
+	printk(KERN_INFO DRIVER_NAME
+	       "[%d]: usb remote disconnected\n", ir->devnum);
+
+	lirc_unregister_driver(ir->d->minor);
+
+	lirc_buffer_free(ir->d->rbuf);
+	kfree(ir->d->rbuf);
+	kfree(ir->d);
+
+
+#if defined(KERNEL_2_5)
+	usb_buffer_free(dev, ir->len_in, ir->buf_in, ir->dma_in);
+#else
+	kfree(ir->buf_in);
+#endif
+
+	kfree(ir);
+}
+
+static struct usb_device_id usb_remote_id_table [] = {
+	/* Igor Plug USB (Atmel's Manufact. ID) */
+	{ USB_DEVICE(0x03eb, 0x0002) },
+	/* Fit PC2 Infrared Adapter */
+	{ USB_DEVICE(0x03eb, 0x21fe) },
+
+	/* Terminating entry */
+	{ }
+};
+
+static struct usb_driver usb_remote_driver = {
+	LIRC_THIS_MODULE(.owner = THIS_MODULE)
+	.name =		DRIVER_NAME,
+	.probe =	usb_remote_probe,
+	.disconnect =	usb_remote_disconnect,
+	.id_table =	usb_remote_id_table
+};
+
+static int __init usb_remote_init(void)
+{
+	int i;
+
+	printk(KERN_INFO DRIVER_NAME ": " DRIVER_DESC " v" DRIVER_VERSION "\n");
+	printk(KERN_INFO DRIVER_NAME ": " DRIVER_AUTHOR "\n");
+	dprintk(": debug mode enabled\n");
+
+	i = usb_register(&usb_remote_driver);
+	if (i < 0) {
+		printk(KERN_ERR DRIVER_NAME
+		       ": usb register failed, result = %d\n", i);
+		return -ENODEV;
+	}
+
+	return 0;
+}
+
+static void __exit usb_remote_exit(void)
+{
+	usb_deregister(&usb_remote_driver);
+}
+
+module_init(usb_remote_init);
+module_exit(usb_remote_exit);
+
+#if defined(KERNEL_2_5)
+#include <linux/vermagic.h>
+MODULE_INFO(vermagic, VERMAGIC_STRING);
+#endif
+
+MODULE_DESCRIPTION(DRIVER_DESC);
+MODULE_AUTHOR(DRIVER_AUTHOR);
+MODULE_LICENSE("GPL");
+MODULE_DEVICE_TABLE(usb, usb_remote_id_table);
+
+module_param(sample_rate, int, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(sample_rate, "Sampling rate in Hz (default: 100)");
+
+EXPORT_NO_SYMBOLS;
--- linux-rt-2.6.31.orig/ubuntu/lirc/lirc_igorplugusb/Makefile
+++ linux-rt-2.6.31/ubuntu/lirc/lirc_igorplugusb/Makefile
@@ -0,0 +1,3 @@
+EXTRA_CFLAGS =-DIRCTL_DEV_MAJOR=61 -DLIRC_SERIAL_TRANSMITTER -DLIRC_SERIAL_SOFTCARRIER -I$(src)/..
+
+obj-$(CONFIG_LIRC_IGORPLUGUSB)	+= lirc_igorplugusb.o
--- linux-rt-2.6.31.orig/ubuntu/lirc/lirc_dev/lirc_dev.c
+++ linux-rt-2.6.31/ubuntu/lirc/lirc_dev/lirc_dev.c
@@ -0,0 +1,1025 @@
+/*
+ * LIRC base driver
+ *
+ * (L) by Artur Lipowski <alipowski@interia.pl>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *
+ * $Id: lirc_dev.c,v 1.96 2009/08/31 16:57:55 lirc Exp $
+ *
+ */
+
+#ifdef HAVE_CONFIG_H
+# include <config.h>
+#endif
+
+#include <linux/version.h>
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 2, 18)
+#error "**********************************************************"
+#error " Sorry, this driver needs kernel version 2.2.18 or higher "
+#error "**********************************************************"
+#endif
+
+#include <linux/autoconf.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/errno.h>
+#include <linux/ioctl.h>
+#include <linux/fs.h>
+#include <linux/poll.h>
+#include <linux/smp_lock.h>
+#include <linux/completion.h>
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 18)
+#include <asm/uaccess.h>
+#include <asm/errno.h>
+#else
+#include <linux/uaccess.h>
+#include <linux/errno.h>
+#endif
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 0)
+#include <linux/wrapper.h>
+#endif
+#define __KERNEL_SYSCALLS__
+#include <linux/unistd.h>
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 23)
+#include <linux/kthread.h>
+#endif
+#ifdef CONFIG_COMPAT
+#include <linux/compat.h>
+#endif
+
+#include "../kcompat.h"
+
+/* SysFS header */
+#if defined(LIRC_HAVE_SYSFS)
+#include <linux/device.h>
+#endif
+
+#include "../lirc.h"
+#include "lirc_dev.h"
+
+static int debug;
+#define dprintk(fmt, args...)					\
+	do {							\
+		if (debug)					\
+			printk(KERN_DEBUG fmt, ## args);	\
+	} while (0)
+
+#define IRCTL_DEV_NAME    "BaseRemoteCtl"
+#define NOPLUG            -1
+#define LOGHEAD           "lirc_dev (%s[%d]): "
+
+struct irctl {
+	struct lirc_driver d;
+	int attached;
+	int open;
+
+	struct mutex buffer_lock;
+	struct lirc_buffer *buf;
+	unsigned int chunk_size;
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 23)
+	int tpid;
+	struct completion *t_notify;
+	struct completion *t_notify2;
+	int shutdown;
+#else
+	struct task_struct *task;
+#endif
+	long jiffies_to_wait;
+
+#ifdef LIRC_HAVE_DEVFS_24
+	devfs_handle_t devfs_handle;
+#endif
+};
+
+static DEFINE_MUTEX(lirc_dev_lock);
+
+static struct irctl *irctls[MAX_IRCTL_DEVICES];
+static struct file_operations fops;
+
+/* Only used for sysfs but defined to void otherwise */
+static lirc_class_t *lirc_class;
+
+/*  helper function
+ *  initializes the irctl structure
+ */
+static void init_irctl(struct irctl *ir)
+{
+	mutex_init(&ir->buffer_lock);
+	ir->d.minor = NOPLUG;
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 23)
+	ir->tpid = -1;
+#endif
+}
+
+static void cleanup(struct irctl *ir)
+{
+	dprintk(LOGHEAD "cleaning up\n", ir->d.name, ir->d.minor);
+
+	if (ir->buf != ir->d.rbuf) {
+		lirc_buffer_free(ir->buf);
+		kfree(ir->buf);
+	}
+	ir->buf = NULL;
+}
+
+/*  helper function
+ *  reads key codes from driver and puts them into buffer
+ *  returns 0 on success
+ */
+static int add_to_buf(struct irctl *ir)
+{
+	if (ir->d.add_to_buf) {
+		int res = -ENODATA;
+		int got_data = 0;
+
+		/*
+		 * service the device as long as it is returning
+		 * data and we have space
+		 */
+		while ((res = ir->d.add_to_buf(ir->d.data, ir->buf)) == 0) {
+			got_data++;
+		}
+
+		if (res == -ENODEV)
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 23)
+			ir->shutdown = 1;
+#else
+			kthread_stop(ir->task);
+#endif
+
+		return got_data ? 0 : res;
+	}
+
+	return 0;
+}
+
+/* main function of the polling thread */
+static int lirc_thread(void *irctl)
+{
+	struct irctl *ir = irctl;
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 23)
+	/*
+	 * This thread doesn't need any user-level access, so get rid
+	 * of all our resources
+	 */
+	daemonize("lirc_dev");
+
+	if (ir->t_notify != NULL)
+		complete(ir->t_notify);
+	
+#endif
+	dprintk(LOGHEAD "poll thread started\n", ir->d.name, ir->d.minor);
+
+	do {
+		if (ir->open) {
+			if (ir->jiffies_to_wait) {
+				set_current_state(TASK_INTERRUPTIBLE);
+				schedule_timeout(ir->jiffies_to_wait);
+#ifndef LIRC_REMOVE_DURING_EXPORT
+			} else {
+				interruptible_sleep_on(
+					ir->d.get_queue(ir->d.data));
+#endif
+			}
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 23)
+			if (ir->shutdown)
+#else
+			if (kthread_should_stop())
+#endif
+				break;
+			if (!add_to_buf(ir))
+				wake_up_interruptible(&ir->buf->wait_poll);
+		} else {
+			set_current_state(TASK_INTERRUPTIBLE);
+			schedule();
+		}
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 23)
+	} while (!ir->shutdown);
+
+	if (ir->t_notify2 != NULL)
+		wait_for_completion(ir->t_notify2);
+
+	ir->tpid = -1;
+	if (ir->t_notify != NULL)
+		complete(ir->t_notify);
+#else
+	} while (!kthread_should_stop());
+#endif
+
+	dprintk(LOGHEAD "poll thread ended\n", ir->d.name, ir->d.minor);
+
+	return 0;
+}
+
+int lirc_register_driver(struct lirc_driver *d)
+{
+	struct irctl *ir;
+	int minor;
+	int bytes_in_key;
+	unsigned int buffer_size;
+	int err;
+#ifdef LIRC_HAVE_DEVFS_24
+	char name[16];
+#endif
+	DECLARE_COMPLETION(tn);
+
+	if (!d) {
+		printk(KERN_ERR "lirc_dev: lirc_register_driver: "
+		       "driver pointer must be not NULL!\n");
+		err = -EBADRQC;
+		goto out;
+	}
+
+	if (MAX_IRCTL_DEVICES <= d->minor) {
+		printk(KERN_ERR "lirc_dev: lirc_register_driver: "
+		       "\"minor\" must be between 0 and %d (%d)!\n",
+		       MAX_IRCTL_DEVICES-1, d->minor);
+		err = -EBADRQC;
+		goto out;
+	}
+
+	if (1 > d->code_length || (BUFLEN * 8) < d->code_length) {
+		printk(KERN_ERR "lirc_dev: lirc_register_driver: "
+		       "code length in bits for minor (%d) "
+		       "must be less than %d!\n",
+		       d->minor, BUFLEN * 8);
+		err = -EBADRQC;
+		goto out;
+	}
+
+	printk(KERN_INFO "lirc_dev: lirc_register_driver: sample_rate: %d\n",
+		d->sample_rate);
+	if (d->sample_rate) {
+		if (2 > d->sample_rate || HZ < d->sample_rate) {
+			printk(KERN_ERR "lirc_dev: lirc_register_driver: "
+			       "sample_rate must be between 2 and %d!\n", HZ);
+			err = -EBADRQC;
+			goto out;
+		}
+		if (!d->add_to_buf) {
+			printk(KERN_ERR "lirc_dev: lirc_register_driver: "
+			       "add_to_buf cannot be NULL when "
+			       "sample_rate is set\n");
+			err = -EBADRQC;
+			goto out;
+		}
+#ifndef LIRC_REMOVE_DURING_EXPORT
+	} else if (!(d->fops && d->fops->read) && !d->get_queue && !d->rbuf) {
+#else
+	} else if (!(d->fops && d->fops->read) && !d->rbuf) {
+#endif
+		printk(KERN_ERR "lirc_dev: lirc_register_driver: "
+#ifndef LIRC_REMOVE_DURING_EXPORT
+		       "fops->read, get_queue and rbuf "
+#else
+		       "fops->read and rbuf "
+#endif
+		       "cannot all be NULL!\n");
+		err = -EBADRQC;
+		goto out;
+#ifndef LIRC_REMOVE_DURING_EXPORT
+	} else if (!d->get_queue && !d->rbuf) {
+#else
+	} else if (!d->rbuf) {
+#endif
+		if (!(d->fops && d->fops->read && d->fops->poll &&
+		      d->fops->ioctl)) {
+			printk(KERN_ERR "lirc_dev: lirc_register_driver: "
+			       "neither read, poll nor ioctl can be NULL!\n");
+			err = -EBADRQC;
+			goto out;
+		}
+	}
+
+	mutex_lock(&lirc_dev_lock);
+
+	minor = d->minor;
+
+	if (minor < 0) {
+		/* find first free slot for driver */
+		for (minor = 0; minor < MAX_IRCTL_DEVICES; minor++)
+			if (!irctls[minor])
+				break;
+		if (MAX_IRCTL_DEVICES == minor) {
+			printk(KERN_ERR "lirc_dev: lirc_register_driver: "
+			       "no free slots for drivers!\n");
+			err = -ENOMEM;
+			goto out_lock;
+		}
+	} else if (irctls[minor]) {
+		printk(KERN_ERR "lirc_dev: lirc_register_driver: "
+		       "minor (%d) just registered!\n", minor);
+		err = -EBUSY;
+		goto out_lock;
+	}
+
+	ir = kzalloc(sizeof(struct irctl), GFP_KERNEL);
+	if (!ir) {
+		err = -ENOMEM;
+		goto out_lock;
+	}
+	init_irctl(ir);
+	irctls[minor] = ir;
+
+	if (d->sample_rate) {
+		ir->jiffies_to_wait = HZ / d->sample_rate;
+	} else {
+		/* it means - wait for external event in task queue */
+		ir->jiffies_to_wait = 0;
+	}
+
+	/* some safety check 8-) */
+	d->name[sizeof(d->name)-1] = '\0';
+
+	bytes_in_key = d->code_length/8 + (d->code_length%8 ? 1 : 0);
+	buffer_size = d->buffer_size ? d->buffer_size : BUFLEN / bytes_in_key;
+
+	if (d->rbuf) {
+		ir->buf = d->rbuf;
+	} else {
+		ir->buf = kmalloc(sizeof(struct lirc_buffer), GFP_KERNEL);
+		if (!ir->buf) {
+			err = -ENOMEM;
+			goto out_lock;
+		}
+		err = lirc_buffer_init(ir->buf, bytes_in_key, buffer_size);
+		if (err) {
+			kfree(ir->buf);
+			goto out_lock;
+		}
+	}
+	ir->chunk_size = ir->buf->chunk_size;
+
+	if (d->features == 0)
+		d->features = (d->code_length > 8) ?
+			LIRC_CAN_REC_LIRCCODE : LIRC_CAN_REC_CODE;
+
+	ir->d = *d;
+	ir->d.minor = minor;
+
+#if defined(LIRC_HAVE_DEVFS_24)
+	sprintf(name, DEV_LIRC "/%d", ir->d.minor);
+	ir->devfs_handle = devfs_register(NULL, name, DEVFS_FL_DEFAULT,
+					  IRCTL_DEV_MAJOR, ir->d.minor,
+					  S_IFCHR | S_IRUSR | S_IWUSR,
+					  &fops, NULL);
+#elif defined(LIRC_HAVE_DEVFS_26)
+	devfs_mk_cdev(MKDEV(IRCTL_DEV_MAJOR, ir->d.minor),
+			S_IFCHR|S_IRUSR|S_IWUSR,
+			DEV_LIRC "/%u", ir->d.minor);
+#endif
+	(void) lirc_device_create(lirc_class, ir->d.dev,
+				  MKDEV(IRCTL_DEV_MAJOR, ir->d.minor), NULL,
+				  "lirc%u", ir->d.minor);
+
+#ifndef LIRC_REMOVE_DURING_EXPORT
+	if (d->sample_rate || d->get_queue) {
+#else
+	if (d->sample_rate) {
+#endif
+		/* try to fire up polling thread */
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 23)
+		ir->t_notify = &tn;
+		ir->tpid = kernel_thread(lirc_thread, (void *)ir, 0);
+		if (ir->tpid < 0) {
+#else
+		ir->task = kthread_run(lirc_thread, (void *)ir, "lirc_dev");
+		if (IS_ERR(ir->task)) {
+#endif
+			printk(KERN_ERR "lirc_dev: lirc_register_driver: "
+			       "cannot run poll thread for minor = %d\n",
+			       d->minor);
+			err = -ECHILD;
+			goto out_sysfs;
+		}
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 23)
+		wait_for_completion(&tn);
+		ir->t_notify = NULL;
+#endif
+	}
+	ir->attached = 1;
+	mutex_unlock(&lirc_dev_lock);
+
+/*
+ * Recent kernels should handle this autmatically by increasing/decreasing
+ * use count when a dependant module is loaded/unloaded.
+ */
+#ifndef KERNEL_2_5
+	MOD_INC_USE_COUNT;
+#endif
+	dprintk("lirc_dev: driver %s registered at minor number = %d\n",
+		ir->d.name, ir->d.minor);
+	d->minor = minor;
+	return minor;
+
+out_sysfs:
+	lirc_device_destroy(lirc_class,
+			    MKDEV(IRCTL_DEV_MAJOR, ir->d.minor));
+#ifdef LIRC_HAVE_DEVFS_24
+	devfs_unregister(ir->devfs_handle);
+#endif
+#ifdef LIRC_HAVE_DEVFS_26
+	devfs_remove(DEV_LIRC "/%i", ir->d.minor);
+#endif
+out_lock:
+	mutex_unlock(&lirc_dev_lock);
+out:
+	return err;
+}
+EXPORT_SYMBOL(lirc_register_driver);
+
+int lirc_unregister_driver(int minor)
+{
+	struct irctl *ir;
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 23)
+	DECLARE_COMPLETION(tn);
+	DECLARE_COMPLETION(tn2);
+#endif
+
+	if (minor < 0 || minor >= MAX_IRCTL_DEVICES) {
+		printk(KERN_ERR "lirc_dev: lirc_unregister_driver: "
+		       "\"minor\" must be between 0 and %d!\n",
+		       MAX_IRCTL_DEVICES-1);
+		return -EBADRQC;
+	}
+
+	ir = irctls[minor];
+
+	mutex_lock(&lirc_dev_lock);
+
+	if (ir->d.minor != minor) {
+		printk(KERN_ERR "lirc_dev: lirc_unregister_driver: "
+		       "minor (%d) device not registered!", minor);
+		mutex_unlock(&lirc_dev_lock);
+		return -ENOENT;
+	}
+
+	/* end up polling thread */
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 23)
+	if (ir->tpid >= 0) {
+		ir->t_notify = &tn;
+		ir->t_notify2 = &tn2;
+		ir->shutdown = 1;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 4, 0)
+		{
+			struct task_struct *p;
+
+			p = find_task_by_pid(ir->tpid);
+			wake_up_process(p);
+		}
+#else
+		/* 2.2.x does not export wake_up_process() */
+		wake_up_interruptible(ir->d.get_queue(ir->d.data));
+#endif
+		complete(&tn2);
+		wait_for_completion(&tn);
+		ir->t_notify = NULL;
+		ir->t_notify2 = NULL;
+	}
+#else /* kernel >= 2.6.23 */
+	if (ir->task)
+		kthread_stop(ir->task);
+#endif
+
+	dprintk("lirc_dev: driver %s unregistered from minor number = %d\n",
+		ir->d.name, ir->d.minor);
+
+	ir->attached = 0;
+	if (ir->open) {
+		dprintk(LOGHEAD "releasing opened driver\n",
+			ir->d.name, ir->d.minor);
+		wake_up_interruptible(&ir->buf->wait_poll);
+		mutex_lock(&ir->buffer_lock);
+		ir->d.set_use_dec(ir->d.data);
+		module_put(ir->d.owner);
+		mutex_unlock(&ir->buffer_lock);
+	} else {
+		cleanup(ir);
+		irctls[minor] = NULL;
+		kfree(ir);
+	}
+
+#ifdef LIRC_HAVE_DEVFS_24
+	devfs_unregister(ir->devfs_handle);
+#endif
+#ifdef LIRC_HAVE_DEVFS_26
+	devfs_remove(DEV_LIRC "/%u", ir->d.minor);
+#endif
+	lirc_device_destroy(lirc_class,
+			    MKDEV(IRCTL_DEV_MAJOR, ir->d.minor));
+
+	mutex_unlock(&lirc_dev_lock);
+
+/*
+ * Recent kernels should handle this autmatically by increasing/decreasing
+ * use count when a dependant module is loaded/unloaded.
+ */
+#ifndef KERNEL_2_5
+	MOD_DEC_USE_COUNT;
+#endif
+
+	return 0;
+}
+EXPORT_SYMBOL(lirc_unregister_driver);
+
+static int irctl_open(struct inode *inode, struct file *file)
+{
+	struct irctl *ir;
+	int retval;
+
+	if (iminor(inode) >= MAX_IRCTL_DEVICES || !irctls[iminor(inode)]) {
+		dprintk("lirc_dev [%d]: open result = -ENODEV\n",
+			iminor(inode));
+		return -ENODEV;
+	}
+
+	ir = irctls[iminor(inode)];
+
+	dprintk(LOGHEAD "open called\n", ir->d.name, ir->d.minor);
+
+	/* if the driver has an open function use it instead */
+	if (ir->d.fops && ir->d.fops->open)
+		return ir->d.fops->open(inode, file);
+
+	if (mutex_lock_interruptible(&lirc_dev_lock))
+		return -ERESTARTSYS;
+
+	if (ir->d.minor == NOPLUG) {
+		retval = -ENODEV;
+		goto error;
+	}
+
+	if (ir->open) {
+		retval = -EBUSY;
+		goto error;
+	}
+
+	if (try_module_get(ir->d.owner)) {
+		++ir->open;
+		retval = ir->d.set_use_inc(ir->d.data);
+
+		if (retval) {
+			module_put(ir->d.owner);
+			--ir->open;
+		} else {
+			lirc_buffer_clear(ir->buf);
+		}
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 23)
+		if (ir->tpid >= 0) {
+			struct task_struct *p;
+
+			p = find_task_by_pid(ir->tpid);
+			wake_up_process(p);
+		}
+#else
+		if (ir->task)
+			wake_up_process(ir->task);
+#endif
+	}
+ error:
+	if (ir)
+		dprintk(LOGHEAD "open result = %d\n", ir->d.name, ir->d.minor,
+			retval);
+
+	mutex_unlock(&lirc_dev_lock);
+
+	return retval;
+}
+
+static int irctl_close(struct inode *inode, struct file *file)
+{
+	struct irctl *ir = irctls[iminor(inode)];
+
+	dprintk(LOGHEAD "close called\n", ir->d.name, ir->d.minor);
+
+	/* if the driver has a close function use it instead */
+	if (ir->d.fops && ir->d.fops->release)
+		return ir->d.fops->release(inode, file);
+
+	if (mutex_lock_interruptible(&lirc_dev_lock))
+		return -ERESTARTSYS;
+
+	--ir->open;
+	if (ir->attached) {
+		ir->d.set_use_dec(ir->d.data);
+		module_put(ir->d.owner);
+	} else {
+		cleanup(ir);
+		irctls[ir->d.minor] = NULL;
+		kfree(ir);
+	}
+
+	mutex_unlock(&lirc_dev_lock);
+
+	return 0;
+}
+
+static unsigned int irctl_poll(struct file *file, poll_table *wait)
+{
+	struct irctl *ir = irctls[iminor(file->f_dentry->d_inode)];
+	unsigned int ret;
+
+	dprintk(LOGHEAD "poll called\n", ir->d.name, ir->d.minor);
+
+	/* if the driver has a poll function use it instead */
+	if (ir->d.fops && ir->d.fops->poll)
+		return ir->d.fops->poll(file, wait);
+
+	mutex_lock(&ir->buffer_lock);
+	if (!ir->attached) {
+		mutex_unlock(&ir->buffer_lock);
+		return POLLERR;
+	}
+
+	poll_wait(file, &ir->buf->wait_poll, wait);
+
+	dprintk(LOGHEAD "poll result = %s\n",
+		ir->d.name, ir->d.minor,
+		lirc_buffer_empty(ir->buf) ? "0" : "POLLIN|POLLRDNORM");
+
+	ret = lirc_buffer_empty(ir->buf) ? 0 : (POLLIN|POLLRDNORM);
+
+	mutex_unlock(&ir->buffer_lock);
+	return ret;
+}
+
+/*
+ *
+ */
+static int irctl_ioctl(struct inode *inode, struct file *file,
+		       unsigned int cmd, unsigned long arg)
+{
+	unsigned long mode;
+	int result;
+	struct irctl *ir = irctls[iminor(inode)];
+
+	dprintk(LOGHEAD "ioctl called (0x%x)\n",
+		ir->d.name, ir->d.minor, cmd);
+
+	/* if the driver has a ioctl function use it instead */
+	if (ir->d.fops && ir->d.fops->ioctl) {
+		result = ir->d.fops->ioctl(inode, file, cmd, arg);
+		if (result != -ENOIOCTLCMD)
+			return result;
+	}
+
+	if (ir->d.minor == NOPLUG || !ir->attached) {
+		dprintk(LOGHEAD "ioctl result = -ENODEV\n",
+			ir->d.name, ir->d.minor);
+		return -ENODEV;
+	}
+
+	/* The driver can't handle cmd */
+	result = 0;
+
+	switch (cmd) {
+	case LIRC_GET_FEATURES:
+		result = put_user(ir->d.features, (unsigned long *)arg);
+		break;
+	case LIRC_GET_REC_MODE:
+		if (!(ir->d.features & LIRC_CAN_REC_MASK))
+			return -ENOSYS;
+
+		result = put_user(LIRC_REC2MODE
+				  (ir->d.features & LIRC_CAN_REC_MASK),
+				  (unsigned long *)arg);
+		break;
+	case LIRC_SET_REC_MODE:
+		if (!(ir->d.features & LIRC_CAN_REC_MASK))
+			return -ENOSYS;
+
+		result = get_user(mode, (unsigned long *)arg);
+		if (!result && !(LIRC_MODE2REC(mode) & ir->d.features))
+			result = -EINVAL;
+		/*
+		 * FIXME: We should actually set the mode somehow but
+		 * for now, lirc_serial doesn't support mode changing either
+		 */
+		break;
+	case LIRC_GET_LENGTH:
+		result = put_user(ir->d.code_length, (unsigned long *) arg);
+		break;
+	default:
+		result = -EINVAL;
+	}
+
+	dprintk(LOGHEAD "ioctl result = %d\n",
+		ir->d.name, ir->d.minor, result);
+
+	return result;
+}
+
+#ifdef CONFIG_COMPAT
+#define LIRC_GET_FEATURES_COMPAT32     _IOR('i', 0x00000000, __u32)
+
+#define LIRC_GET_SEND_MODE_COMPAT32    _IOR('i', 0x00000001, __u32)
+#define LIRC_GET_REC_MODE_COMPAT32     _IOR('i', 0x00000002, __u32)
+
+#define LIRC_GET_LENGTH_COMPAT32       _IOR('i', 0x0000000f, __u32)
+
+#define LIRC_SET_SEND_MODE_COMPAT32    _IOW('i', 0x00000011, __u32)
+#define LIRC_SET_REC_MODE_COMPAT32     _IOW('i', 0x00000012, __u32)
+
+static long irctl_compat_ioctl(struct file *file,
+			       unsigned int cmd32,
+			       unsigned long arg)
+{
+	mm_segment_t old_fs;
+	int ret;
+	unsigned long val;
+	unsigned int cmd;
+
+	switch (cmd32) {
+	case LIRC_GET_FEATURES_COMPAT32:
+	case LIRC_GET_SEND_MODE_COMPAT32:
+	case LIRC_GET_REC_MODE_COMPAT32:
+	case LIRC_GET_LENGTH_COMPAT32:
+	case LIRC_SET_SEND_MODE_COMPAT32:
+	case LIRC_SET_REC_MODE_COMPAT32:
+		/*
+		 * These commands expect (unsigned long *) arg
+		 * but the 32-bit app supplied (__u32 *).
+		 * Conversion is required.
+		 */
+		if (get_user(val, (__u32 *)compat_ptr(arg)))
+			return -EFAULT;
+		lock_kernel();
+		/*
+		 * tell irctl_ioctl that it's safe to use the pointer
+		 * to val which is in kernel address space and not in
+		 * user address space
+		 */
+		old_fs = get_fs();
+		set_fs(KERNEL_DS);
+
+		cmd = _IOC(_IOC_DIR(cmd32), _IOC_TYPE(cmd32), _IOC_NR(cmd32),
+			   (_IOC_TYPECHECK(unsigned long)));
+		ret = irctl_ioctl(file->f_dentry->d_inode, file,
+				  cmd, (unsigned long)(&val));
+
+		set_fs(old_fs);
+		unlock_kernel();
+		switch (cmd) {
+		case LIRC_GET_FEATURES:
+		case LIRC_GET_SEND_MODE:
+		case LIRC_GET_REC_MODE:
+		case LIRC_GET_LENGTH:
+			if (!ret && put_user(val, (__u32 *)compat_ptr(arg)))
+				return -EFAULT;
+			break;
+		}
+		return ret;
+
+	case LIRC_GET_SEND_CARRIER:
+	case LIRC_GET_REC_CARRIER:
+	case LIRC_GET_SEND_DUTY_CYCLE:
+	case LIRC_GET_REC_DUTY_CYCLE:
+	case LIRC_GET_REC_RESOLUTION:
+	case LIRC_SET_SEND_CARRIER:
+	case LIRC_SET_REC_CARRIER:
+	case LIRC_SET_SEND_DUTY_CYCLE:
+	case LIRC_SET_REC_DUTY_CYCLE:
+	case LIRC_SET_TRANSMITTER_MASK:
+	case LIRC_SET_REC_DUTY_CYCLE_RANGE:
+	case LIRC_SET_REC_CARRIER_RANGE:
+		/*
+		 * These commands expect (unsigned int *)arg
+		 * so no problems here. Just handle the locking.
+		 */
+		lock_kernel();
+		cmd = cmd32;
+		ret = irctl_ioctl(file->f_dentry->d_inode,
+				  file, cmd, arg);
+		unlock_kernel();
+		return ret;
+	default:
+		/* unknown */
+		printk(KERN_ERR "lirc_dev: %s(%s:%d): Unknown cmd %08x\n",
+		       __func__, current->comm, current->pid, cmd32);
+		return -ENOIOCTLCMD;
+	}
+}
+#endif
+
+static ssize_t irctl_read(struct file *file,
+			  char *buffer,
+			  size_t length,
+			  loff_t *ppos)
+{
+	struct irctl *ir = irctls[iminor(file->f_dentry->d_inode)];
+	unsigned char buf[ir->chunk_size];
+	int ret = 0, written = 0;
+	int unlock = 1;
+	DECLARE_WAITQUEUE(wait, current);
+
+	dprintk(LOGHEAD "read called\n", ir->d.name, ir->d.minor);
+
+	/* if the driver has a specific read function use it instead */
+	if (ir->d.fops && ir->d.fops->read)
+		return ir->d.fops->read(file, buffer, length, ppos);
+
+	if (mutex_lock_interruptible(&ir->buffer_lock))
+		return -ERESTARTSYS;
+	if (!ir->attached) {
+		mutex_unlock(&ir->buffer_lock);
+		return -ENODEV;
+	}
+
+	if (length % ir->buf->chunk_size) {
+		dprintk(LOGHEAD "read result = -EINVAL\n",
+			ir->d.name, ir->d.minor);
+		mutex_unlock(&ir->buffer_lock);
+		return -EINVAL;
+	}
+
+	/*
+	 * we add ourselves to the task queue before buffer check
+	 * to avoid losing scan code (in case when queue is awaken somewhere
+	 * between while condition checking and scheduling)
+	 */
+	add_wait_queue(&ir->buf->wait_poll, &wait);
+	set_current_state(TASK_INTERRUPTIBLE);
+
+	/*
+	 * while we didn't provide 'length' bytes, device is opened in blocking
+	 * mode and 'copy_to_user' is happy, wait for data.
+	 */
+	while (written < length && ret == 0) {
+		if (lirc_buffer_empty(ir->buf)) {
+			/* According to the read(2) man page, 'written' can be
+			 * returned as less than 'length', instead of blocking
+			 * again, returning -EWOULDBLOCK, or returning
+			 * -ERESTARTSYS */
+			if (written)
+				break;
+			if (file->f_flags & O_NONBLOCK) {
+				ret = -EWOULDBLOCK;
+				break;
+			}
+			if (signal_pending(current)) {
+				ret = -ERESTARTSYS;
+				break;
+			}
+
+			mutex_unlock(&ir->buffer_lock);
+			schedule();
+			set_current_state(TASK_INTERRUPTIBLE);
+
+			if (mutex_lock_interruptible(&ir->buffer_lock)) {
+				unlock = 0;
+				ret = -ERESTARTSYS;
+				break;
+			}
+
+			if (!ir->attached) {
+				ret = -ENODEV;
+				break;
+			}
+		} else {
+			lirc_buffer_read(ir->buf, buf);
+			ret = copy_to_user((void *)buffer+written, buf,
+					   ir->buf->chunk_size);
+			written += ir->buf->chunk_size;
+		}
+	}
+
+	remove_wait_queue(&ir->buf->wait_poll, &wait);
+	set_current_state(TASK_RUNNING);
+	if(unlock) mutex_unlock(&ir->buffer_lock);
+
+	dprintk(LOGHEAD "read result = %s (%d)\n",
+		ir->d.name, ir->d.minor, ret ? "-EFAULT" : "OK", ret);
+
+	return ret ? ret : written;
+}
+
+
+void *lirc_get_pdata(struct file *file)
+{
+	void *data = NULL;
+
+	if (file && file->f_dentry && file->f_dentry->d_inode &&
+	    file->f_dentry->d_inode->i_rdev) {
+		struct irctl *ir;
+		ir = irctls[iminor(file->f_dentry->d_inode)];
+		data = ir->d.data;
+	}
+
+	return data;
+}
+EXPORT_SYMBOL(lirc_get_pdata);
+
+
+static ssize_t irctl_write(struct file *file, const char *buffer,
+			   size_t length, loff_t *ppos)
+{
+	struct irctl *ir = irctls[iminor(file->f_dentry->d_inode)];
+
+	dprintk(LOGHEAD "write called\n", ir->d.name, ir->d.minor);
+
+	/* if the driver has a specific read function use it instead */
+	if (ir->d.fops && ir->d.fops->write)
+		return ir->d.fops->write(file, buffer, length, ppos);
+
+	if (!ir->attached)
+		return -ENODEV;
+
+	return -EINVAL;
+}
+
+
+static struct file_operations fops = {
+	.owner		= THIS_MODULE,
+	.read		= irctl_read,
+	.write		= irctl_write,
+	.poll		= irctl_poll,
+	.ioctl		= irctl_ioctl,
+#ifdef CONFIG_COMPAT
+	.compat_ioctl	= irctl_compat_ioctl,
+#endif
+	.open		= irctl_open,
+	.release	= irctl_close
+};
+
+/* For now don't try to use it as a static version !  */
+#ifdef MODULE
+
+static int __init lirc_dev_init(void)
+{
+	if (register_chrdev(IRCTL_DEV_MAJOR, IRCTL_DEV_NAME, &fops)) {
+		printk(KERN_ERR "lirc_dev: register_chrdev failed\n");
+		goto out;
+	}
+
+	lirc_class = class_create(THIS_MODULE, "lirc");
+	if (IS_ERR(lirc_class)) {
+		printk(KERN_ERR "lirc_dev: class_create failed\n");
+		goto out_unregister;
+	}
+
+	printk(KERN_INFO "lirc_dev: IR Remote Control driver registered, "
+	       "major %d \n", IRCTL_DEV_MAJOR);
+
+	return 0;
+
+out_unregister:
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 23)
+	if (unregister_chrdev(IRCTL_DEV_MAJOR, IRCTL_DEV_NAME))
+		printk(KERN_ERR "lirc_dev: unregister_chrdev failed!\n");
+#else
+	/* unregister_chrdev returns void now */
+	unregister_chrdev(IRCTL_DEV_MAJOR, IRCTL_DEV_NAME);
+#endif
+out:
+	return -1;
+}
+
+static void __exit lirc_dev_exit(void)
+{
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 23)
+	int ret;
+
+	ret = unregister_chrdev(IRCTL_DEV_MAJOR, IRCTL_DEV_NAME);
+	class_destroy(lirc_class);
+
+	if (ret)
+		printk(KERN_ERR "lirc_dev: error in "
+		       "module_unregister_chrdev: %d\n", ret);
+	else
+		dprintk("lirc_dev: module successfully unloaded\n");
+#else
+	/* unregister_chrdev returns void now */
+	unregister_chrdev(IRCTL_DEV_MAJOR, IRCTL_DEV_NAME);
+	class_destroy(lirc_class);
+	dprintk("lirc_dev: module unloaded\n");
+#endif
+}
+
+module_init(lirc_dev_init);
+module_exit(lirc_dev_exit);
+
+MODULE_DESCRIPTION("LIRC base driver module");
+MODULE_AUTHOR("Artur Lipowski");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS_CHARDEV_MAJOR(IRCTL_DEV_MAJOR);
+
+module_param(debug, bool, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(debug, "Enable debugging messages");
+
+#endif /* MODULE */
--- linux-rt-2.6.31.orig/ubuntu/lirc/lirc_dev/lirc_dev.h
+++ linux-rt-2.6.31/ubuntu/lirc/lirc_dev/lirc_dev.h
@@ -0,0 +1,342 @@
+/*
+ * LIRC base driver
+ *
+ * (L) by Artur Lipowski <alipowski@interia.pl>
+ *        This code is licensed under GNU GPL
+ *
+ * $Id: lirc_dev.h,v 1.37 2009/03/15 09:34:00 lirc Exp $
+ *
+ */
+
+#ifndef _LINUX_LIRC_DEV_H
+#define _LINUX_LIRC_DEV_H
+
+#ifndef LIRC_REMOVE_DURING_EXPORT
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 11)
+/* when was it really introduced? */
+#define LIRC_HAVE_KFIFO
+#endif
+#endif
+#define MAX_IRCTL_DEVICES 4
+#define BUFLEN            16
+
+#define mod(n, div) ((n) % (div))
+
+#include <linux/slab.h>
+#include <linux/fs.h>
+#ifdef LIRC_HAVE_KFIFO
+#include <linux/kfifo.h>
+#endif
+
+struct lirc_buffer {
+	wait_queue_head_t wait_poll;
+	spinlock_t lock;
+	unsigned int chunk_size;
+	unsigned int size; /* in chunks */
+	/* Using chunks instead of bytes pretends to simplify boundary checking
+	 * And should allow for some performance fine tunning later */
+#ifdef LIRC_HAVE_KFIFO
+	struct kfifo *fifo;
+#else
+	unsigned int fill; /* in chunks */
+	int head, tail;    /* in chunks */
+	unsigned char *data;
+#endif
+};
+#ifndef LIRC_HAVE_KFIFO
+static inline void lirc_buffer_lock(struct lirc_buffer *buf,
+				    unsigned long *flags)
+{
+	spin_lock_irqsave(&buf->lock, *flags);
+}
+static inline void lirc_buffer_unlock(struct lirc_buffer *buf,
+				      unsigned long *flags)
+{
+	spin_unlock_irqrestore(&buf->lock, *flags);
+}
+static inline void _lirc_buffer_clear(struct lirc_buffer *buf)
+{
+	buf->head = 0;
+	buf->tail = 0;
+	buf->fill = 0;
+}
+#endif
+static inline void lirc_buffer_clear(struct lirc_buffer *buf)
+{
+#ifdef LIRC_HAVE_KFIFO
+	if (buf->fifo)
+		kfifo_reset(buf->fifo);
+#else
+	unsigned long flags;
+	lirc_buffer_lock(buf, &flags);
+	_lirc_buffer_clear(buf);
+	lirc_buffer_unlock(buf, &flags);
+#endif
+}
+static inline int lirc_buffer_init(struct lirc_buffer *buf,
+				    unsigned int chunk_size,
+				    unsigned int size)
+{
+	init_waitqueue_head(&buf->wait_poll);
+	spin_lock_init(&buf->lock);
+#ifndef LIRC_HAVE_KFIFO
+	_lirc_buffer_clear(buf);
+#endif
+	buf->chunk_size = chunk_size;
+	buf->size = size;
+#ifdef LIRC_HAVE_KFIFO
+	buf->fifo = kfifo_alloc(size*chunk_size, GFP_KERNEL, &buf->lock);
+	if (!buf->fifo)
+		return -ENOMEM;
+#else
+	buf->data = kmalloc(size*chunk_size, GFP_KERNEL);
+	if (buf->data == NULL)
+		return -ENOMEM;
+	memset(buf->data, 0, size*chunk_size);
+#endif
+	return 0;
+}
+static inline void lirc_buffer_free(struct lirc_buffer *buf)
+{
+#ifdef LIRC_HAVE_KFIFO
+	if (buf->fifo)
+		kfifo_free(buf->fifo);
+#else
+	kfree(buf->data);
+	buf->data = NULL;
+	buf->head = 0;
+	buf->tail = 0;
+	buf->fill = 0;
+	buf->chunk_size = 0;
+	buf->size = 0;
+#endif
+}
+#ifndef LIRC_HAVE_KFIFO
+static inline int  _lirc_buffer_full(struct lirc_buffer *buf)
+{
+	return (buf->fill >= buf->size);
+}
+#endif
+static inline int  lirc_buffer_full(struct lirc_buffer *buf)
+{
+#ifdef LIRC_HAVE_KFIFO
+	return kfifo_len(buf->fifo) == buf->size * buf->chunk_size;
+#else
+	unsigned long flags;
+	int ret;
+	lirc_buffer_lock(buf, &flags);
+	ret = _lirc_buffer_full(buf);
+	lirc_buffer_unlock(buf, &flags);
+	return ret;
+#endif
+}
+#ifndef LIRC_HAVE_KFIFO
+static inline int  _lirc_buffer_empty(struct lirc_buffer *buf)
+{
+	return !(buf->fill);
+}
+#endif
+static inline int  lirc_buffer_empty(struct lirc_buffer *buf)
+{
+#ifdef LIRC_HAVE_KFIFO
+	return !kfifo_len(buf->fifo);
+#else
+	unsigned long flags;
+	int ret;
+	lirc_buffer_lock(buf, &flags);
+	ret = _lirc_buffer_empty(buf);
+	lirc_buffer_unlock(buf, &flags);
+	return ret;
+#endif
+}
+#ifndef LIRC_HAVE_KFIFO
+static inline int  _lirc_buffer_available(struct lirc_buffer *buf)
+{
+	return (buf->size - buf->fill);
+}
+#endif
+static inline int  lirc_buffer_available(struct lirc_buffer *buf)
+{
+#ifdef LIRC_HAVE_KFIFO
+	return buf->size - (kfifo_len(buf->fifo) / buf->chunk_size);
+#else
+	unsigned long flags;
+	int ret;
+	lirc_buffer_lock(buf, &flags);
+	ret = _lirc_buffer_available(buf);
+	lirc_buffer_unlock(buf, &flags);
+	return ret;
+#endif
+}
+#ifndef LIRC_HAVE_KFIFO
+static inline void _lirc_buffer_read_1(struct lirc_buffer *buf,
+				       unsigned char *dest)
+{
+	memcpy(dest, &buf->data[buf->head*buf->chunk_size], buf->chunk_size);
+	buf->head = mod(buf->head+1, buf->size);
+	buf->fill -= 1;
+}
+#endif
+static inline void lirc_buffer_read(struct lirc_buffer *buf,
+				    unsigned char *dest)
+{
+#ifdef LIRC_HAVE_KFIFO
+	if (kfifo_len(buf->fifo) >= buf->chunk_size)
+		kfifo_get(buf->fifo, dest, buf->chunk_size);
+#else
+	unsigned long flags;
+	lirc_buffer_lock(buf, &flags);
+	_lirc_buffer_read_1(buf, dest);
+	lirc_buffer_unlock(buf, &flags);
+#endif
+}
+#ifndef LIRC_HAVE_KFIFO
+static inline void _lirc_buffer_write_1(struct lirc_buffer *buf,
+				      unsigned char *orig)
+{
+	memcpy(&buf->data[buf->tail*buf->chunk_size], orig, buf->chunk_size);
+	buf->tail = mod(buf->tail+1, buf->size);
+	buf->fill++;
+}
+#endif
+static inline void lirc_buffer_write(struct lirc_buffer *buf,
+				     unsigned char *orig)
+{
+#ifdef LIRC_HAVE_KFIFO
+	kfifo_put(buf->fifo, orig, buf->chunk_size);
+#else
+	unsigned long flags;
+	lirc_buffer_lock(buf, &flags);
+	_lirc_buffer_write_1(buf, orig);
+	lirc_buffer_unlock(buf, &flags);
+#endif
+}
+#ifndef LIRC_HAVE_KFIFO
+static inline void _lirc_buffer_write_n(struct lirc_buffer *buf,
+					unsigned char *orig, int count)
+{
+	int space1;
+	if (buf->head > buf->tail)
+		space1 = buf->head - buf->tail;
+	else
+		space1 = buf->size - buf->tail;
+
+	if (count > space1) {
+		memcpy(&buf->data[buf->tail * buf->chunk_size], orig,
+		       space1 * buf->chunk_size);
+		memcpy(&buf->data[0], orig + (space1 * buf->chunk_size),
+		       (count - space1) * buf->chunk_size);
+	} else {
+		memcpy(&buf->data[buf->tail * buf->chunk_size], orig,
+		       count * buf->chunk_size);
+	}
+	buf->tail = mod(buf->tail + count, buf->size);
+	buf->fill += count;
+}
+#endif
+static inline void lirc_buffer_write_n(struct lirc_buffer *buf,
+				       unsigned char *orig, int count)
+{
+#ifdef LIRC_HAVE_KFIFO
+	kfifo_put(buf->fifo, orig, count * buf->chunk_size);
+#else
+	unsigned long flags;
+	lirc_buffer_lock(buf, &flags);
+	_lirc_buffer_write_n(buf, orig, count);
+	lirc_buffer_unlock(buf, &flags);
+#endif
+}
+
+struct lirc_driver {
+	char name[40];
+	int minor;
+	unsigned long code_length;
+	unsigned int buffer_size; /* in chunks holding one code each */
+	int sample_rate;
+	unsigned long features;
+	void *data;
+	int (*add_to_buf) (void *data, struct lirc_buffer *buf);
+#ifndef LIRC_REMOVE_DURING_EXPORT
+	wait_queue_head_t* (*get_queue) (void *data);
+#endif
+	struct lirc_buffer *rbuf;
+	int (*set_use_inc) (void *data);
+	void (*set_use_dec) (void *data);
+	struct file_operations *fops;
+	struct device *dev;
+	struct module *owner;
+};
+/* name:
+ * this string will be used for logs
+ *
+ * minor:
+ * indicates minor device (/dev/lirc) number for registered driver
+ * if caller fills it with negative value, then the first free minor
+ * number will be used (if available)
+ *
+ * code_length:
+ * length of the remote control key code expressed in bits
+ *
+ * sample_rate:
+ * sample_rate equal to 0 means that no polling will be performed and
+ * add_to_buf will be triggered by external events (through task queue
+ * returned by get_queue)
+ *
+ * data:
+ * it may point to any driver data and this pointer will be passed to
+ * all callback functions
+ *
+ * add_to_buf:
+ * add_to_buf will be called after specified period of the time or
+ * triggered by the external event, this behavior depends on value of
+ * the sample_rate this function will be called in user context. This
+ * routine should return 0 if data was added to the buffer and
+ * -ENODATA if none was available. This should add some number of bits
+ * evenly divisible by code_length to the buffer
+ *
+ * get_queue:
+ * this callback should return a pointer to the task queue which will
+ * be used for external event waiting
+ *
+ * rbuf:
+ * if not NULL, it will be used as a read buffer, you will have to
+ * write to the buffer by other means, like irq's (see also
+ * lirc_serial.c).
+ *
+ * set_use_inc:
+ * set_use_inc will be called after device is opened
+ *
+ * set_use_dec:
+ * set_use_dec will be called after device is closed
+ *
+ * fops:
+ * file_operations for drivers which don't fit the current driver model.
+ *
+ * Some ioctl's can be directly handled by lirc_dev if the driver's
+ * ioctl function is NULL or if it returns -ENOIOCTLCMD (see also
+ * lirc_serial.c).
+ *
+ * owner:
+ * the module owning this struct
+ *
+ */
+
+
+/* following functions can be called ONLY from user context
+ *
+ * returns negative value on error or minor number
+ * of the registered device if success
+ * contents of the structure pointed by d is copied
+ */
+extern int lirc_register_driver(struct lirc_driver *d);
+
+/* returns negative value on error or 0 if success
+*/
+extern int lirc_unregister_driver(int minor);
+
+/* Returns the private data stored in the lirc_driver
+ * associated with the given device file pointer.
+ */
+void *lirc_get_pdata(struct file *file);
+
+#endif
--- linux-rt-2.6.31.orig/ubuntu/lirc/lirc_dev/Makefile
+++ linux-rt-2.6.31/ubuntu/lirc/lirc_dev/Makefile
@@ -0,0 +1,3 @@
+EXTRA_CFLAGS =-DIRCTL_DEV_MAJOR=61 -DLIRC_SERIAL_TRANSMITTER -DLIRC_SERIAL_SOFTCARRIER -I$(src)/..
+
+obj-$(CONFIG_LIRC_DEV)		+= lirc_dev.o
--- linux-rt-2.6.31.orig/ubuntu/lirc/lirc_ite8709/Makefile
+++ linux-rt-2.6.31/ubuntu/lirc/lirc_ite8709/Makefile
@@ -0,0 +1,3 @@
+EXTRA_CFLAGS =-DIRCTL_DEV_MAJOR=61 -DLIRC_SERIAL_TRANSMITTER -DLIRC_SERIAL_SOFTCARRIER -I$(src)/..
+
+obj-$(CONFIG_LIRC_ITE8709)	+= lirc_ite8709.o
--- linux-rt-2.6.31.orig/ubuntu/lirc/lirc_ite8709/lirc_ite8709.c
+++ linux-rt-2.6.31/ubuntu/lirc/lirc_ite8709/lirc_ite8709.c
@@ -0,0 +1,552 @@
+/*
+ * LIRC driver for ITE8709 CIR port
+ *
+ * Copyright (C) 2008 Grégory Lardière <spmf2004-lirc@yahoo.fr>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
+ * USA
+ */
+
+#include <linux/version.h>
+#include <linux/module.h>
+#include <linux/pnp.h>
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 19)
+#include <asm/io.h>
+#else
+#include <linux/io.h>
+#endif
+
+#include "../lirc.h"
+#include "../lirc_dev/lirc_dev.h"
+#include "../kcompat.h"
+
+#define LIRC_DRIVER_NAME "lirc_ite8709"
+
+#define BUF_CHUNK_SIZE	sizeof(lirc_t)
+#define BUF_SIZE	(128*BUF_CHUNK_SIZE)
+
+/*
+ * The ITE8709 device seems to be the combination of IT8512 superIO chip and
+ * a specific firmware running on the IT8512's embedded micro-controller.
+ * In addition of the embedded micro-controller, the IT8512 chip contains a
+ * CIR module and several other modules. A few modules are directly accessible
+ * by the host CPU, but most of them are only accessible by the
+ * micro-controller. The CIR module is only accessible by the micro-controller.
+ * The battery-backed SRAM module is accessible by the host CPU and the
+ * micro-controller. So one of the MC's firmware role is to act as a bridge
+ * between the host CPU and the CIR module. The firmware implements a kind of
+ * communication protocol using the SRAM module as a shared memory. The IT8512
+ * specification is publicly available on ITE's web site, but the communication
+ * protocol is not, so it was reverse-engineered.
+ */
+
+/* ITE8709 Registers addresses and values (reverse-engineered) */
+#define ITE8709_MODE		0x1a
+#define ITE8709_REG_ADR		0x1b
+#define ITE8709_REG_VAL		0x1c
+#define ITE8709_IIR		0x1e  /* Interrupt identification register */
+#define ITE8709_RFSR		0x1f  /* Receiver FIFO status register */
+#define ITE8709_FIFO_START	0x20
+
+#define ITE8709_MODE_READY	0X00
+#define ITE8709_MODE_WRITE	0X01
+#define ITE8709_MODE_READ	0X02
+#define ITE8709_IIR_RDAI	0x02  /* Receiver data available interrupt */
+#define ITE8709_IIR_RFOI	0x04  /* Receiver FIFO overrun interrupt */
+#define ITE8709_RFSR_MASK	0x3f  /* FIFO byte count mask */
+
+/*
+ * IT8512 CIR-module registers addresses and values
+ * (from IT8512 E/F specification v0.4.1)
+ */
+#define IT8512_REG_MSTCR	0x01  /* Master control register */
+#define IT8512_REG_IER		0x02  /* Interrupt enable register */
+#define IT8512_REG_CFR		0x04  /* Carrier frequency register */
+#define IT8512_REG_RCR		0x05  /* Receive control register */
+#define IT8512_REG_BDLR		0x08  /* Baud rate divisor low byte register */
+#define IT8512_REG_BDHR		0x09  /* Baud rate divisor high byte register */
+
+#define IT8512_MSTCR_RESET	0x01  /* Reset registers to default value */
+#define IT8512_MSTCR_FIFOCLR	0x02  /* Clear FIFO */
+#define IT8512_MSTCR_FIFOTL_7	0x04  /* FIFO threshold level : 7 */
+#define IT8512_MSTCR_FIFOTL_25	0x0c  /* FIFO threshold level : 25 */
+#define IT8512_IER_RDAIE	0x02  /* Enable data interrupt request */
+#define IT8512_IER_RFOIE	0x04  /* Enable FIFO overrun interrupt req */
+#define IT8512_IER_IEC		0x80  /* Enable interrupt request */
+#define IT8512_CFR_CF_36KHZ	0x09  /* Carrier freq : low speed, 36kHz */
+#define IT8512_RCR_RXDCR_1	0x01  /* Demodulation carrier range : 1 */
+#define IT8512_RCR_RXACT	0x08  /* Receiver active */
+#define IT8512_RCR_RXEN		0x80  /* Receiver enable */
+#define IT8512_BDR_6		6     /* Baud rate divisor : 6 */
+
+/* Actual values used by this driver */
+#define CFG_FIFOTL	IT8512_MSTCR_FIFOTL_25
+#define CFG_CR_FREQ	IT8512_CFR_CF_36KHZ
+#define CFG_DCR		IT8512_RCR_RXDCR_1
+#define CFG_BDR		IT8512_BDR_6
+#define CFG_TIMEOUT	100000 /* Rearm interrupt when a space is > 100 ms */
+
+static int debug;
+
+struct ite8709_device {
+	int use_count;
+	int io;
+	int irq;
+	spinlock_t hardware_lock;
+	unsigned long long acc_pulse;
+	unsigned long long acc_space;
+	char lastbit;
+	struct timeval last_tv;
+	struct lirc_driver driver;
+	struct lirc_buffer buffer;
+	struct tasklet_struct tasklet;
+	char force_rearm;
+	char rearmed;
+	char device_busy;
+};
+
+#define dprintk(fmt, args...)					\
+	do {							\
+		if (debug)					\
+			printk(KERN_DEBUG LIRC_DRIVER_NAME ": "	\
+				fmt, ## args);			\
+	} while (0)
+
+
+static unsigned char ite8709_read(struct ite8709_device *dev,
+					unsigned char port)
+{
+	outb(port, dev->io);
+	return inb(dev->io+1);
+}
+
+static void ite8709_write(struct ite8709_device *dev, unsigned char port,
+				unsigned char data)
+{
+	outb(port, dev->io);
+	outb(data, dev->io+1);
+}
+
+static void ite8709_wait_device(struct ite8709_device *dev)
+{
+	int i = 0;
+	/*
+	 * loop until device tells it's ready to continue
+	 * iterations count is usually ~750 but can sometimes achieve 13000
+	 */
+	for (i = 0; i < 15000; i++) {
+		udelay(2);
+		if (ite8709_read(dev, ITE8709_MODE) == ITE8709_MODE_READY)
+			break;
+	}
+}
+
+static void ite8709_write_register(struct ite8709_device *dev,
+				unsigned char reg_adr, unsigned char reg_value)
+{
+	ite8709_wait_device(dev);
+
+	ite8709_write(dev, ITE8709_REG_VAL, reg_value);
+	ite8709_write(dev, ITE8709_REG_ADR, reg_adr);
+	ite8709_write(dev, ITE8709_MODE, ITE8709_MODE_WRITE);
+}
+
+static void ite8709_init_hardware(struct ite8709_device *dev)
+{
+	spin_lock_irq(&dev->hardware_lock);
+	dev->device_busy = 1;
+	spin_unlock_irq(&dev->hardware_lock);
+
+	ite8709_write_register(dev, IT8512_REG_BDHR, (CFG_BDR >> 8) & 0xff);
+	ite8709_write_register(dev, IT8512_REG_BDLR, CFG_BDR & 0xff);
+	ite8709_write_register(dev, IT8512_REG_CFR, CFG_CR_FREQ);
+	ite8709_write_register(dev, IT8512_REG_IER,
+			IT8512_IER_IEC | IT8512_IER_RFOIE | IT8512_IER_RDAIE);
+	ite8709_write_register(dev, IT8512_REG_RCR, CFG_DCR);
+	ite8709_write_register(dev, IT8512_REG_MSTCR,
+					CFG_FIFOTL | IT8512_MSTCR_FIFOCLR);
+	ite8709_write_register(dev, IT8512_REG_RCR,
+				IT8512_RCR_RXEN | IT8512_RCR_RXACT | CFG_DCR);
+
+	spin_lock_irq(&dev->hardware_lock);
+	dev->device_busy = 0;
+	spin_unlock_irq(&dev->hardware_lock);
+
+	tasklet_enable(&dev->tasklet);
+}
+
+static void ite8709_drop_hardware(struct ite8709_device *dev)
+{
+	tasklet_disable(&dev->tasklet);
+
+	spin_lock_irq(&dev->hardware_lock);
+	dev->device_busy = 1;
+	spin_unlock_irq(&dev->hardware_lock);
+
+	ite8709_write_register(dev, IT8512_REG_RCR, 0);
+	ite8709_write_register(dev, IT8512_REG_MSTCR,
+				IT8512_MSTCR_RESET | IT8512_MSTCR_FIFOCLR);
+
+	spin_lock_irq(&dev->hardware_lock);
+	dev->device_busy = 0;
+	spin_unlock_irq(&dev->hardware_lock);
+}
+
+static int ite8709_set_use_inc(void *data)
+{
+	struct ite8709_device *dev;
+	MOD_INC_USE_COUNT;
+	dev = data;
+	if (dev->use_count == 0)
+		ite8709_init_hardware(dev);
+	dev->use_count++;
+	return 0;
+}
+
+static void ite8709_set_use_dec(void *data)
+{
+	struct ite8709_device *dev;
+	MOD_DEC_USE_COUNT;
+	dev = data;
+	dev->use_count--;
+	if (dev->use_count == 0)
+		ite8709_drop_hardware(dev);
+}
+
+static void ite8709_add_read_queue(struct ite8709_device *dev, int flag,
+					unsigned long long val)
+{
+	lirc_t value;
+
+	dprintk("add a %llu usec %s\n", val, flag ? "pulse" : "space");
+
+	value = (val > PULSE_MASK) ? PULSE_MASK : val;
+	if (flag)
+		value |= PULSE_BIT;
+
+	if (!lirc_buffer_full(&dev->buffer)) {
+		lirc_buffer_write(&dev->buffer, (void *) &value);
+		wake_up(&dev->buffer.wait_poll);
+	}
+}
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 19)
+static irqreturn_t ite8709_interrupt(int irq, void *dev_id,
+					struct pt_regs *regs)
+#else
+static irqreturn_t ite8709_interrupt(int irq, void *dev_id)
+#endif
+{
+	unsigned char data;
+	int iir, rfsr, i;
+	int fifo = 0;
+	char bit;
+	struct timeval curr_tv;
+
+	/* Bit duration in microseconds */
+	const unsigned long bit_duration = 1000000ul / (115200 / CFG_BDR);
+
+	struct ite8709_device *dev;
+	dev = dev_id;
+
+	/*
+	 * If device is busy, we simply discard data because we are in one of
+	 * these two cases : shutting down or rearming the device, so this
+	 * doesn't really matter and this avoids waiting too long in IRQ ctx
+	 */
+	spin_lock(&dev->hardware_lock);
+	if (dev->device_busy) {
+		spin_unlock(&dev->hardware_lock);
+		return IRQ_RETVAL(IRQ_HANDLED);
+	}
+
+	iir = ite8709_read(dev, ITE8709_IIR);
+
+	switch (iir) {
+	case ITE8709_IIR_RFOI:
+		dprintk("fifo overrun, scheduling forced rearm just in case\n");
+		dev->force_rearm = 1;
+		tasklet_schedule(&dev->tasklet);
+		spin_unlock(&dev->hardware_lock);
+		return IRQ_RETVAL(IRQ_HANDLED);
+
+	case ITE8709_IIR_RDAI:
+		rfsr = ite8709_read(dev, ITE8709_RFSR);
+		fifo = rfsr & ITE8709_RFSR_MASK;
+		if (fifo > 32)
+			fifo = 32;
+		dprintk("iir: 0x%x rfsr: 0x%x fifo: %d\n", iir, rfsr, fifo);
+
+		if (dev->rearmed) {
+			do_gettimeofday(&curr_tv);
+			dev->acc_space += 1000000ull
+				* (curr_tv.tv_sec - dev->last_tv.tv_sec)
+				+ (curr_tv.tv_usec - dev->last_tv.tv_usec);
+			dev->rearmed = 0;
+		}
+		for (i = 0; i < fifo; i++) {
+			data = ite8709_read(dev, i+ITE8709_FIFO_START);
+			data = ~data;
+			/* Loop through */
+			for (bit = 0; bit < 8; ++bit) {
+				if ((data >> bit) & 1) {
+					dev->acc_pulse += bit_duration;
+					if (dev->lastbit == 0) {
+						ite8709_add_read_queue(dev, 0,
+							dev->acc_space);
+						dev->acc_space = 0;
+					}
+				} else {
+					dev->acc_space += bit_duration;
+					if (dev->lastbit == 1) {
+						ite8709_add_read_queue(dev, 1,
+							dev->acc_pulse);
+						dev->acc_pulse = 0;
+					}
+				}
+				dev->lastbit = (data >> bit) & 1;
+			}
+		}
+		ite8709_write(dev, ITE8709_RFSR, 0);
+
+		if (dev->acc_space > CFG_TIMEOUT) {
+			dprintk("scheduling rearm IRQ\n");
+			do_gettimeofday(&dev->last_tv);
+			dev->force_rearm = 0;
+			tasklet_schedule(&dev->tasklet);
+		}
+
+		spin_unlock(&dev->hardware_lock);
+		return IRQ_RETVAL(IRQ_HANDLED);
+
+	default:
+		/* not our irq */
+		dprintk("unknown IRQ (shouldn't happen) !!\n");
+		spin_unlock(&dev->hardware_lock);
+		return IRQ_RETVAL(IRQ_NONE);
+	}
+}
+
+static void ite8709_rearm_irq(unsigned long data)
+{
+	struct ite8709_device *dev;
+	unsigned long flags;
+	dev = (struct ite8709_device *) data;
+
+	spin_lock_irqsave(&dev->hardware_lock, flags);
+	dev->device_busy = 1;
+	spin_unlock_irqrestore(&dev->hardware_lock, flags);
+
+	if (dev->force_rearm || dev->acc_space > CFG_TIMEOUT) {
+		dprintk("rearming IRQ\n");
+		ite8709_write_register(dev, IT8512_REG_RCR,
+						IT8512_RCR_RXACT | CFG_DCR);
+		ite8709_write_register(dev, IT8512_REG_MSTCR,
+					CFG_FIFOTL | IT8512_MSTCR_FIFOCLR);
+		ite8709_write_register(dev, IT8512_REG_RCR,
+				IT8512_RCR_RXEN | IT8512_RCR_RXACT | CFG_DCR);
+		if (!dev->force_rearm)
+			dev->rearmed = 1;
+		dev->force_rearm = 0;
+	}
+
+	spin_lock_irqsave(&dev->hardware_lock, flags);
+	dev->device_busy = 0;
+	spin_unlock_irqrestore(&dev->hardware_lock, flags);
+}
+
+static int ite8709_cleanup(struct ite8709_device *dev, int stage, int errno,
+				char *msg)
+{
+	if (msg != NULL)
+		printk(KERN_ERR LIRC_DRIVER_NAME ": %s\n", msg);
+
+	switch (stage) {
+	case 6:
+		if (dev->use_count > 0)
+			ite8709_drop_hardware(dev);
+	case 5:
+		free_irq(dev->irq, dev);
+	case 4:
+		release_region(dev->io, 2);
+	case 3:
+		lirc_unregister_driver(dev->driver.minor);
+	case 2:
+		lirc_buffer_free(dev->driver.rbuf);
+	case 1:
+		kfree(dev);
+	case 0:
+		;
+	}
+
+	return errno;
+}
+
+static int __devinit ite8709_pnp_probe(struct pnp_dev *dev,
+					const struct pnp_device_id *dev_id)
+{
+	struct lirc_driver *driver;
+	struct ite8709_device *ite8709_dev;
+	int ret;
+
+	/* Check resources validity */
+	if (!pnp_irq_valid(dev, 0))
+		return ite8709_cleanup(NULL, 0, -ENODEV, "invalid IRQ");
+	if (!pnp_port_valid(dev, 2))
+		return ite8709_cleanup(NULL, 0, -ENODEV, "invalid IO port");
+
+	/* Allocate memory for device struct */
+	ite8709_dev = kzalloc(sizeof(struct ite8709_device), GFP_KERNEL);
+	if (ite8709_dev == NULL)
+		return ite8709_cleanup(NULL, 0, -ENOMEM, "kzalloc failed");
+	pnp_set_drvdata(dev, ite8709_dev);
+
+	/* Initialize device struct */
+	ite8709_dev->use_count = 0;
+	ite8709_dev->irq = pnp_irq(dev, 0);
+	ite8709_dev->io = pnp_port_start(dev, 2);
+	ite8709_dev->hardware_lock = __SPIN_LOCK_UNLOCKED(
+					ite8709_dev->hardware_lock);
+	ite8709_dev->acc_pulse = 0;
+	ite8709_dev->acc_space = 0;
+	ite8709_dev->lastbit = 0;
+	do_gettimeofday(&ite8709_dev->last_tv);
+	tasklet_init(&ite8709_dev->tasklet, ite8709_rearm_irq,
+							(long) ite8709_dev);
+	ite8709_dev->force_rearm = 0;
+	ite8709_dev->rearmed = 0;
+	ite8709_dev->device_busy = 0;
+
+	/* Initialize driver struct */
+	driver = &ite8709_dev->driver;
+	strcpy(driver->name, LIRC_DRIVER_NAME);
+	driver->minor = -1;
+	driver->code_length = sizeof(lirc_t) * 8;
+	driver->sample_rate = 0;
+	driver->features = LIRC_CAN_REC_MODE2;
+	driver->data = ite8709_dev;
+	driver->add_to_buf = NULL;
+#ifndef LIRC_REMOVE_DURING_EXPORT
+	driver->get_queue = NULL;
+#endif
+	driver->rbuf = &ite8709_dev->buffer;
+	driver->set_use_inc = ite8709_set_use_inc;
+	driver->set_use_dec = ite8709_set_use_dec;
+	driver->fops = NULL;
+	driver->dev = &dev->dev;
+	driver->owner = THIS_MODULE;
+
+	/* Initialize LIRC buffer */
+	if (lirc_buffer_init(driver->rbuf, BUF_CHUNK_SIZE, BUF_SIZE))
+		return ite8709_cleanup(ite8709_dev, 1, -ENOMEM,
+				       "lirc_buffer_init() failed");
+
+	/* Register LIRC driver */
+	ret = lirc_register_driver(driver);
+	if (ret < 0)
+		return ite8709_cleanup(ite8709_dev, 2, ret,
+					"lirc_register_driver() failed");
+
+	/* Reserve I/O port access */
+	if (!request_region(ite8709_dev->io, 2, LIRC_DRIVER_NAME))
+		return ite8709_cleanup(ite8709_dev, 3, -EBUSY,
+						"i/o port already in use");
+
+	/* Reserve IRQ line */
+	ret = request_irq(ite8709_dev->irq, ite8709_interrupt, 0,
+					LIRC_DRIVER_NAME, ite8709_dev);
+	if (ret < 0)
+		return ite8709_cleanup(ite8709_dev, 4, ret,
+						"IRQ already in use");
+
+	/* Initialize hardware */
+	ite8709_drop_hardware(ite8709_dev); /* Shutdown hw until first use */
+
+	printk(KERN_INFO LIRC_DRIVER_NAME ": device found : irq=%d io=0x%x\n",
+					ite8709_dev->irq, ite8709_dev->io);
+
+	return 0;
+}
+
+static void __devexit ite8709_pnp_remove(struct pnp_dev *dev)
+{
+	struct ite8709_device *ite8709_dev;
+	ite8709_dev = pnp_get_drvdata(dev);
+
+	ite8709_cleanup(ite8709_dev, 6, 0, NULL);
+
+	printk(KERN_INFO LIRC_DRIVER_NAME ": device removed\n");
+}
+
+#ifdef CONFIG_PM
+static int ite8709_pnp_suspend(struct pnp_dev *dev, pm_message_t state)
+{
+	struct ite8709_device *ite8709_dev;
+	ite8709_dev = pnp_get_drvdata(dev);
+
+	if (ite8709_dev->use_count > 0)
+		ite8709_drop_hardware(ite8709_dev);
+
+	return 0;
+}
+
+static int ite8709_pnp_resume(struct pnp_dev *dev)
+{
+	struct ite8709_device *ite8709_dev;
+	ite8709_dev = pnp_get_drvdata(dev);
+
+	if (ite8709_dev->use_count > 0)
+		ite8709_init_hardware(ite8709_dev);
+
+	return 0;
+}
+#else
+#define ite8709_pnp_suspend NULL
+#define ite8709_pnp_resume NULL
+#endif
+
+static const struct pnp_device_id pnp_dev_table[] = {
+	{"ITE8709", 0},
+	{}
+};
+
+MODULE_DEVICE_TABLE(pnp, pnp_dev_table);
+
+static struct pnp_driver ite8709_pnp_driver = {
+	.name           = LIRC_DRIVER_NAME,
+	.probe          = ite8709_pnp_probe,
+	.remove         = __devexit_p(ite8709_pnp_remove),
+	.suspend        = ite8709_pnp_suspend,
+	.resume         = ite8709_pnp_resume,
+	.id_table       = pnp_dev_table,
+};
+
+int init_module(void)
+{
+	return pnp_register_driver(&ite8709_pnp_driver);
+}
+
+void cleanup_module(void)
+{
+	pnp_unregister_driver(&ite8709_pnp_driver);
+}
+
+MODULE_DESCRIPTION("LIRC driver for ITE8709 CIR port");
+MODULE_AUTHOR("Grégory Lardière");
+MODULE_LICENSE("GPL");
+
+module_param(debug, bool, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(debug, "Enable debugging messages");
+EXPORT_NO_SYMBOLS;
--- linux-rt-2.6.31.orig/ubuntu/lirc/lirc_atiusb/Makefile
+++ linux-rt-2.6.31/ubuntu/lirc/lirc_atiusb/Makefile
@@ -0,0 +1,3 @@
+EXTRA_CFLAGS =-DIRCTL_DEV_MAJOR=61 -DLIRC_SERIAL_TRANSMITTER -DLIRC_SERIAL_SOFTCARRIER -I$(src)/..
+
+obj-$(CONFIG_LIRC_ATIUSB)	+= lirc_atiusb.o
--- linux-rt-2.6.31.orig/ubuntu/lirc/lirc_atiusb/lirc_atiusb.c
+++ linux-rt-2.6.31/ubuntu/lirc/lirc_atiusb/lirc_atiusb.c
@@ -0,0 +1,1452 @@
+/*
+ * lirc_atiusb - USB remote support for LIRC
+ * (currently only supports X10 USB remotes)
+ * (supports ATI Remote Wonder and ATI Remote Wonder II, too)
+ *
+ * Copyright (C) 2003-2004 Paul Miller <pmiller9@users.sourceforge.net>
+ *
+ * This driver was derived from:
+ *   Vladimir Dergachev <volodya@minspring.com>'s 2002
+ *      "USB ATI Remote support" (input device)
+ *   Adrian Dewhurst <sailor-lk@sailorfrag.net>'s 2002
+ *      "USB StreamZap remote driver" (LIRC)
+ *   Artur Lipowski <alipowski@kki.net.pl>'s 2002
+ *      "lirc_dev" and "lirc_gpio" LIRC modules
+ *   Michael Wojciechowski
+ *      initial xbox support
+ *   Vassilis Virvilis <vasvir@iit.demokritos.gr> 2006
+ *      reworked the patch for lirc submission
+ *
+ * $Id: lirc_atiusb.c,v 1.85 2009/03/11 00:21:46 jarodwilson Exp $
+ */
+
+/*
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+
+#include <linux/version.h>
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 4, 0)
+#error "*******************************************************"
+#error "Sorry, this driver needs kernel version 2.4.0 or higher"
+#error "*******************************************************"
+#endif
+
+#include <linux/autoconf.h>
+
+#include <linux/kernel.h>
+#include <linux/errno.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/kmod.h>
+#include <linux/smp_lock.h>
+#include <linux/completion.h>
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 18)
+#include <asm/uaccess.h>
+#else
+#include <linux/uaccess.h>
+#endif
+#include <linux/usb.h>
+#include <linux/poll.h>
+#include <linux/wait.h>
+#include <linux/list.h>
+
+#include "../lirc.h"
+#include "../kcompat.h"
+#include "../lirc_dev/lirc_dev.h"
+
+#define DRIVER_VERSION		"$Revision: 1.85 $"
+#define DRIVER_AUTHOR		"Paul Miller <pmiller9@users.sourceforge.net>"
+#define DRIVER_DESC		"USB remote driver for LIRC"
+#define DRIVER_NAME		"lirc_atiusb"
+
+#define CODE_LENGTH		(code_length[ir->remote_type])
+#define CODE_MIN_LENGTH		(code_min_length[ir->remote_type])
+#define DECODE_LENGTH		(decode_length[ir->remote_type])
+
+#define RW2_MODENAV_KEYCODE	0x3F
+#define RW2_NULL_MODE		0xFF
+/* Fake (virtual) keycode indicating compass mouse usage */
+#define RW2_MOUSE_KEYCODE	0xFF
+#define RW2_PRESSRELEASE_KEYCODE	0xFE
+
+#define RW2_PRESS_CODE		1
+#define RW2_HOLD_CODE		2
+#define RW2_RELEASE_CODE	0
+
+/* module parameters */
+#ifdef CONFIG_USB_DEBUG
+static int debug = 1;
+#else
+static int debug;
+#endif
+#define dprintk(fmt, args...)					\
+	do {							\
+		if (debug)					\
+			printk(KERN_DEBUG fmt, ## args);	\
+	} while (0)
+
+/* ATI, ATI2, XBOX */
+static const int code_length[] = {5, 3, 6};
+static const int code_min_length[] = {3, 3, 6};
+static const int decode_length[] = {5, 3, 1};
+/*
+ * USB_BUFF_LEN must be the maximum value of the code_length array.
+ * It is used for static arrays.
+ */
+#define USB_BUFF_LEN 6
+
+static int mask = 0xFFFF;	/* channel acceptance bit mask */
+static int unique;		/* enable channel-specific codes */
+static int repeat = 10;		/* repeat time in 1/100 sec */
+static int emit_updown;		/* send separate press/release codes (rw2) */
+static int emit_modekeys;	/* send keycodes for aux1-4, pc, mouse (rw2) */
+static unsigned long repeat_jiffies; /* repeat timeout */
+static int mdeadzone;		/* mouse sensitivity >= 0 */
+static int mgradient = 375;	/* 1000*gradient from cardinal direction */
+
+/* get hi and low bytes of a 16-bits int */
+#define HI(a)			((unsigned char)((a) >> 8))
+#define LO(a)			((unsigned char)((a) & 0xff))
+
+/* general constants */
+#define SEND_FLAG_IN_PROGRESS	1
+#define SEND_FLAG_COMPLETE	2
+#define FREE_ALL		0xFF
+
+/* endpoints */
+#define EP_KEYS			0
+#define EP_MOUSE		1
+#define EP_MOUSE_ADDR		0x81
+#define EP_KEYS_ADDR		0x82
+
+#define VENDOR_ATI1		0x0bc7
+#define VENDOR_ATI2		0x0471
+#define VENDOR_MS1		0x040b
+#define VENDOR_MS2		0x045e
+#define VENDOR_MS3		0xFFFF
+
+static struct usb_device_id usb_remote_table[] = {
+	/* X10 USB Firecracker Interface */
+	{ USB_DEVICE(VENDOR_ATI1, 0x0002) },
+
+	/* X10 VGA Video Sender */
+	{ USB_DEVICE(VENDOR_ATI1, 0x0003) },
+
+	/* ATI Wireless Remote Receiver */
+	{ USB_DEVICE(VENDOR_ATI1, 0x0004) },
+
+	/* NVIDIA Wireless Remote Receiver */
+	{ USB_DEVICE(VENDOR_ATI1, 0x0005) },
+
+	/* ATI Wireless Remote Receiver */
+	{ USB_DEVICE(VENDOR_ATI1, 0x0006) },
+
+	/* X10 USB Wireless Transceivers */
+	{ USB_DEVICE(VENDOR_ATI1, 0x0007) },
+	{ USB_DEVICE(VENDOR_ATI1, 0x0008) },
+	{ USB_DEVICE(VENDOR_ATI1, 0x0009) },
+	{ USB_DEVICE(VENDOR_ATI1, 0x000A) },
+	{ USB_DEVICE(VENDOR_ATI1, 0x000B) },
+	{ USB_DEVICE(VENDOR_ATI1, 0x000C) },
+	{ USB_DEVICE(VENDOR_ATI1, 0x000D) },
+	{ USB_DEVICE(VENDOR_ATI1, 0x000E) },
+	{ USB_DEVICE(VENDOR_ATI1, 0x000F) },
+
+	/* ATI Remote Wonder 2: Input Device */
+	{ USB_DEVICE(VENDOR_ATI2, 0x0602) },
+
+	/* ATI Remote Wonder 2: Controller (???) */
+	{ USB_DEVICE(VENDOR_ATI2, 0x0603) },
+
+	/* Gamester Xbox DVD Movie Playback Kit IR */
+	{ USB_DEVICE(VENDOR_MS1, 0x6521) },
+
+	/* Microsoft Xbox DVD Movie Playback Kit IR */
+	{ USB_DEVICE(VENDOR_MS2, 0x0284) },
+
+	/*
+	 * Some Chinese manufacturer -- conflicts with the joystick from the
+	 * same manufacturer
+	 */
+	{ USB_DEVICE(VENDOR_MS3, 0xFFFF) },
+
+	/* Terminating entry */
+	{ }
+};
+
+
+/* init strings */
+#define USB_OUTLEN		7
+
+static char init1[] = {0x01, 0x00, 0x20, 0x14};
+static char init2[] = {0x01, 0x00, 0x20, 0x14, 0x20, 0x20, 0x20};
+
+struct in_endpt {
+	/* inner link in list of endpoints for the remote specified by ir */
+	struct list_head iep_list_link;
+	struct atirf_dev *ir;
+	struct urb *urb;
+	struct usb_endpoint_descriptor *ep;
+	int type;
+
+	/* buffers and dma */
+	unsigned char *buf;
+	unsigned int len;
+#ifdef KERNEL_2_5
+	dma_addr_t dma;
+#endif
+
+	/* handle repeats */
+	unsigned char old[USB_BUFF_LEN];
+	unsigned long old_jiffies;
+};
+
+struct out_endpt {
+	struct atirf_dev *ir;
+	struct urb *urb;
+	struct usb_endpoint_descriptor *ep;
+
+	/* buffers and dma */
+	unsigned char *buf;
+#ifdef KERNEL_2_5
+	dma_addr_t dma;
+#endif
+
+	/* handle sending (init strings) */
+	int send_flags;
+	wait_queue_head_t wait;
+};
+
+
+/* data structure for each usb remote */
+struct atirf_dev {
+	/* inner link in list of all remotes managed by this module */
+	struct list_head remote_list_link;
+	/* Number of usb interfaces associated with this device */
+	int dev_refcount;
+
+	/* usb */
+	struct usb_device *usbdev;
+	/* Head link to list of all inbound endpoints in this remote */
+	struct list_head iep_listhead;
+	struct out_endpt *out_init;
+	int devnum;
+
+	/* remote type based on usb_device_id tables */
+	enum {
+		ATI1_COMPATIBLE,
+		ATI2_COMPATIBLE,
+		XBOX_COMPATIBLE
+	} remote_type;
+
+	/* rw2 current mode (mirrors the state of the remote) */
+	int mode;
+
+	/* lirc */
+	struct lirc_driver *d;
+	int connected;
+
+	/* locking */
+	struct mutex lock;
+};
+
+/* list of all registered devices via the remote_list_link in atirf_dev */
+static struct list_head remote_list;
+
+/*
+ * Convenience macros to retrieve a pointer to the surrounding struct from
+ * the given list_head reference within, pointed at by link.
+ */
+#define get_iep_from_link(link) \
+		list_entry((link), struct in_endpt, iep_list_link);
+#define get_irctl_from_link(link) \
+		list_entry((link), struct atirf_dev, remote_list_link);
+
+/* send packet - used to initialize remote */
+static void send_packet(struct out_endpt *oep, u16 cmd, unsigned char *data)
+{
+	struct atirf_dev *ir = oep->ir;
+	DECLARE_WAITQUEUE(wait, current);
+	int timeout = HZ; /* 1 second */
+	unsigned char buf[USB_OUTLEN];
+
+	dprintk(DRIVER_NAME "[%d]: send called (%#x)\n", ir->devnum, cmd);
+
+	mutex_lock(&ir->lock);
+	oep->urb->transfer_buffer_length = LO(cmd) + 1;
+	oep->urb->dev = oep->ir->usbdev;
+	oep->send_flags = SEND_FLAG_IN_PROGRESS;
+
+	memcpy(buf+1, data, LO(cmd));
+	buf[0] = HI(cmd);
+	memcpy(oep->buf, buf, LO(cmd)+1);
+
+	set_current_state(TASK_INTERRUPTIBLE);
+	add_wait_queue(&oep->wait, &wait);
+
+#ifdef KERNEL_2_5
+	if (usb_submit_urb(oep->urb, GFP_ATOMIC)) {
+#else
+	if (usb_submit_urb(oep->urb)) {
+#endif
+		set_current_state(TASK_RUNNING);
+		remove_wait_queue(&oep->wait, &wait);
+		mutex_unlock(&ir->lock);
+		return;
+	}
+	mutex_unlock(&ir->lock);
+
+	while (timeout && (oep->urb->status == -EINPROGRESS)
+	       && !(oep->send_flags & SEND_FLAG_COMPLETE)) {
+		timeout = schedule_timeout(timeout);
+		rmb();
+	}
+
+	dprintk(DRIVER_NAME "[%d]: send complete (%#x)\n", ir->devnum, cmd);
+
+	set_current_state(TASK_RUNNING);
+	remove_wait_queue(&oep->wait, &wait);
+#ifdef KERNEL_2_5
+	oep->urb->transfer_flags |= URB_ASYNC_UNLINK;
+#endif
+	usb_unlink_urb(oep->urb);
+}
+
+static int unregister_from_lirc(struct atirf_dev *ir)
+{
+	struct lirc_driver *d = ir->d;
+	int devnum;
+
+	devnum = ir->devnum;
+	dprintk(DRIVER_NAME "[%d]: unregister from lirc called\n", devnum);
+
+	lirc_unregister_driver(d->minor);
+
+	printk(DRIVER_NAME "[%d]: usb remote disconnected\n", devnum);
+	return 0;
+}
+
+
+static int set_use_inc(void *data)
+{
+	struct atirf_dev *ir = data;
+	struct list_head *pos, *n;
+	struct in_endpt *iep;
+	int rtn;
+
+	if (!ir) {
+		printk(DRIVER_NAME "[?]: set_use_inc called with no context\n");
+		return -EIO;
+	}
+	dprintk(DRIVER_NAME "[%d]: set use inc\n", ir->devnum);
+
+	MOD_INC_USE_COUNT;
+
+	mutex_lock(&ir->lock);
+	if (!ir->connected) {
+		if (!ir->usbdev) {
+			mutex_unlock(&ir->lock);
+			dprintk(DRIVER_NAME "[%d]: !ir->usbdev\n", ir->devnum);
+			return -ENOENT;
+		}
+
+		/* Iterate through the inbound endpoints */
+		list_for_each_safe(pos, n, &ir->iep_listhead) {
+			/* extract the current in_endpt */
+			iep = get_iep_from_link(pos);
+			iep->urb->dev = ir->usbdev;
+			dprintk(DRIVER_NAME "[%d]: linking iep 0x%02x (%p)\n",
+				ir->devnum, iep->ep->bEndpointAddress, iep);
+#ifdef KERNEL_2_5
+			rtn = usb_submit_urb(iep->urb, GFP_ATOMIC);
+#else
+			rtn = usb_submit_urb(iep->urb);
+#endif
+			if (rtn) {
+				printk(DRIVER_NAME "[%d]: open result = %d "
+				       "error submitting urb\n",
+				       ir->devnum, rtn);
+				mutex_unlock(&ir->lock);
+				MOD_DEC_USE_COUNT;
+				return -EIO;
+			}
+		}
+		ir->connected = 1;
+	}
+	mutex_unlock(&ir->lock);
+
+	return 0;
+}
+
+static void set_use_dec(void *data)
+{
+	struct atirf_dev *ir = data;
+	struct list_head *pos, *n;
+	struct in_endpt *iep;
+
+	if (!ir) {
+		printk(DRIVER_NAME "[?]: set_use_dec called with no context\n");
+		return;
+	}
+	dprintk(DRIVER_NAME "[%d]: set use dec\n", ir->devnum);
+
+	mutex_lock(&ir->lock);
+	if (ir->connected) {
+		/* Free inbound usb urbs */
+		list_for_each_safe(pos, n, &ir->iep_listhead) {
+			iep = get_iep_from_link(pos);
+			dprintk(DRIVER_NAME "[%d]: unlinking iep 0x%02x (%p)\n",
+				ir->devnum, iep->ep->bEndpointAddress, iep);
+			usb_kill_urb(iep->urb);
+		}
+		ir->connected = 0;
+	}
+	mutex_unlock(&ir->lock);
+	MOD_DEC_USE_COUNT;
+}
+
+static void print_data(struct in_endpt *iep, char *buf, int len)
+{
+	const int clen = code_length[iep->ir->remote_type];
+	char codes[clen * 3 + 1];
+	int i;
+
+	if (len <= 0)
+		return;
+
+	for (i = 0; i < len && i < clen; i++)
+		snprintf(codes+i*3, 4, "%02x ", buf[i] & 0xFF);
+	printk(DRIVER_NAME "[%d]: data received %s (ep=0x%x length=%d)\n",
+		iep->ir->devnum, codes, iep->ep->bEndpointAddress, len);
+}
+
+static int code_check_ati1(struct in_endpt *iep, int len)
+{
+	struct atirf_dev *ir = iep->ir;
+	int i, chan;
+
+	/* ATI RW1: some remotes emit both 4 and 5 byte length codes. */
+	/* ATI RW2: emit 3 byte codes */
+	if (len < CODE_MIN_LENGTH || len > CODE_LENGTH)
+		return -1;
+
+	/* *** channel not tested with 4/5-byte Dutch remotes *** */
+	chan = ((iep->buf[len-1]>>4) & 0x0F);
+
+	/* strip channel code */
+	if (!unique) {
+		iep->buf[len-1] &= 0x0F;
+		iep->buf[len-3] -= (chan<<4);
+	}
+
+	if (!((1U<<chan) & mask)) {
+		dprintk(DRIVER_NAME "[%d]: ignore channel %d\n",
+			ir->devnum, chan+1);
+		return -1;
+	}
+	dprintk(DRIVER_NAME "[%d]: accept channel %d\n", ir->devnum, chan+1);
+
+	if (ir->remote_type == ATI1_COMPATIBLE) {
+		for (i = len; i < CODE_LENGTH; i++)
+			iep->buf[i] = 0;
+		/* check for repeats */
+		if (memcmp(iep->old, iep->buf, len) == 0) {
+			if (iep->old_jiffies + repeat_jiffies > jiffies)
+				return -1;
+		} else
+			memcpy(iep->old, iep->buf, CODE_LENGTH);
+		iep->old_jiffies = jiffies;
+	}
+
+	return 0;
+}
+
+/*
+ * Since the ATI Remote Wonder II has quite a different structure from the
+ * prior version, this function was separated out to clarify the sanitization
+ * process.
+ *
+ * Here is a summary of the main differences:
+ *
+ * a. The rw2 has no sense of a transmission channel.  But, it does have an
+ *    auxiliary mode state, which is set by the mode buttons Aux1 through
+ *    Aux4 and "PC".  These map respectively to 0-4 in the first byte of the
+ *    recv buffer.  Any subsequent button press sends this mode number as its
+ *    "channel code."  Annoyingly enough, the mode setting buttons all send
+ *    the same key code (0x3f), and can only be distinguished via their mode
+ *    byte.
+ *
+ *    Because of this, old-style "unique"-parameter-enabled channel squashing
+ *    kills the functionality of the aux1-aux4 and PC buttons.  However, to
+ *    not do so would cause each remote key to send a different code depending
+ *    on the active aux.  Further complicating matters, using the mouse norb
+ *    also sends an identical code as would pushing the active aux button.  To
+ *    handle this we need a separate parameter, like rw2modes, with the
+ *    following values and meanings:
+ *
+ *	0: Don't squash any channel info
+ *	1: Only squash channel data for non-mode setting keys
+ *	2: Ignore aux keypresses, but don't squash channel
+ *	3: Ignore aux keypresses and squash channel data
+ *
+ *    Option 1 may seem useless since the mouse sends the same code, but one
+ *    need only ignore in userspace any press of a mode-setting code that only
+ *    reaffirms the current mode.  The 3rd party lirccd should be able to
+ *    handle this easily enough, but lircd doesn't keep the state necessary
+ *    for this.  TODO We could work around this in the driver by emitting a
+ *    single 02 (press) code for a mode key only if that mode is not currently
+ *    active.
+ *
+ *    Option 2 would be useful for those wanting super configurability,
+ *    offering the ability to program 5 times the number actions based on the
+ *    current mode.
+ *
+ * b. The rw2 has its own built in repeat handling; the keys endpoint
+ *    encodes this in the second byte as 1 for press, 2 for hold, and 0 for
+ *    release.  This is generally much more responsive than lirc's built-in
+ *    timeout handling.
+ *
+ *    The problem is that the remote can send the release-receive pair
+ *    (0,1) while one is still holding down the same button if the
+ *    transmission is momentarily interrupted.  (It seems that the receiver
+ *    manages this count instead of the remote.)  By default, this information
+ *    is squashed to 2.
+ *
+ *    In order to expose the built-in repeat code, set the emit_updown
+ *    parameter as described below.
+ *
+ * c. The mouse norb is much more sensitive than on the rw1.  It emulates
+ *    a joystick-like controller with the second byte representing the x-axis
+ *    and the third, the y-axis.  Treated as signed integers, these axes range
+ *    approximately as follows:
+ *
+ *	x: (left) -46 ... 46 (right) (0xd2..0x2e)
+ *	y: (up)   -46 ... 46 (down)  (0xd2..0x2e)
+ *
+ *    NB these values do not correspond to the pressure with which the mouse
+ *    norb is pushed in a given direction, but rather seems to indicate the
+ *    duration for which a given direction is held.
+ *
+ *    These are normalized to 8 cardinal directions for easy configuration via
+ *    lircd.conf.  The normalization can be fined tuned with the mdeadzone and
+ *    mgradient parameters as described below.
+ *
+ * d. The interrupt rate of the mouse vs. the normal keys is different.
+ *
+ *	mouse: ~27Hz (37ms between interrupts)
+ *	keys:  ~10Hz (100ms between interrupts)
+ *
+ *    This means that the normal gap mechanism for lircd won't work as
+ *    expected; is emit_updown>0 if you can get away with it.
+ */
+static int code_check_ati2(struct in_endpt *iep, int len)
+{
+	struct atirf_dev *ir = iep->ir;
+	int mode, i;
+	char *buf = iep->buf;
+
+	if (len != CODE_LENGTH) {
+		dprintk(DRIVER_NAME
+			"[%d]: Huh?  Abnormal length (%d) buffer received.\n",
+			ir->devnum, len);
+		return -1;
+	}
+	for (i = len; i < CODE_LENGTH; i++)
+		iep->buf[i] = 0;
+
+	mode = buf[0];
+
+	/* Squash the mode indicator if unique wasn't set non-zero */
+	if (!unique)
+		buf[0] = 0;
+
+	if (iep->ep->bEndpointAddress == EP_KEYS_ADDR) {
+		/* ignore mouse nav indicator key and mode-set (aux) keys */
+		if (buf[2] == RW2_MODENAV_KEYCODE) {
+			if (emit_modekeys >= 2) /* emit raw */
+				buf[0] = mode;
+			else if (emit_modekeys == 1) {
+				/* translate */
+				buf[0] = mode;
+				if (ir->mode != mode) {
+					buf[1] = 0x03;
+					ir->mode = mode;
+					return 0;
+				}
+			} else {
+				dprintk(DRIVER_NAME
+					"[%d]: ignore dummy code 0x%x "
+					"(ep=0x%x)\n", ir->devnum,
+					buf[2], iep->ep->bEndpointAddress);
+				return -1;
+			}
+		}
+
+		if (buf[1] != 2) {
+			/* handle press/release codes */
+			if (emit_updown == 0) /* ignore */
+				return -1;
+			else if (emit_updown == 1) /* normalize keycode */
+				 buf[2] = RW2_PRESSRELEASE_KEYCODE;
+			/* else emit raw */
+		}
+
+	} else {
+		int x = (signed char)buf[1];
+		int y = (signed char)buf[2];
+		int code = 0x00;
+		int dir_ew, dir_ns;
+
+		buf[2] = RW2_MOUSE_KEYCODE;
+
+		/* sensitivity threshold (use L2norm^2) */
+		if (mdeadzone > (x*x+y*y)) {
+			buf[1] = 0x00;
+			return 0;
+		}
+
+/* Nybble encoding: xy, 2 is -1 (S or W); 1 (N or E) */
+#define MOUSE_N		0x01
+#define MOUSE_NE	0x11
+#define MOUSE_E		0x10
+#define MOUSE_SE	0x12
+#define MOUSE_S		0x02
+#define MOUSE_SW	0x22
+#define MOUSE_W		0x20
+#define MOUSE_NW	0x21
+
+		/* cardinal leanings: positive x -> E, positive y -> S */
+		dir_ew = (x > 0) ? MOUSE_E : MOUSE_W;
+		dir_ns = (y > 0) ? MOUSE_S : MOUSE_N;
+
+		/* convert coordinates(angle) into compass direction */
+		if (x == 0)
+			code = dir_ns;
+		else if (y == 0)
+			code = dir_ew;
+		else {
+			if (abs(1000*y/x) > mgradient)
+				code = dir_ns;
+			if (abs(1000*x/y) > mgradient)
+				code |= dir_ew;
+		}
+
+		buf[1] = code;
+		dprintk(DRIVER_NAME "[%d]: mouse compass=0x%x %s%s (%d,%d)\n",
+			ir->devnum, code,
+			(code & MOUSE_S ? "S" : (code & MOUSE_N ? "N" : "")),
+			(code & MOUSE_E ? "E" : (code & MOUSE_W ? "W" : "")),
+			x, y);
+	}
+
+	return 0;
+}
+
+static int code_check_xbox(struct in_endpt *iep, int len)
+{
+	struct atirf_dev *ir = iep->ir;
+	const int clen = CODE_LENGTH;
+
+	if (len != clen) {
+		dprintk(DRIVER_NAME ": We got %d instead of %d bytes from xbox "
+			"ir.. ?\n", len, clen);
+		return -1;
+	}
+
+	/* check for repeats */
+	if (memcmp(iep->old, iep->buf, len) == 0) {
+		if (iep->old_jiffies + repeat_jiffies > jiffies)
+			return -1;
+	} else {
+		/*
+		 * the third byte of xbox ir packet seems to contain key info
+		 * the last two bytes are.. some kind of clock?
+		 */
+		iep->buf[0] = iep->buf[2];
+		memset(iep->buf + 1, 0, len - 1);
+		memcpy(iep->old, iep->buf, len);
+	}
+	iep->old_jiffies = jiffies;
+
+	return 0;
+}
+
+#if defined(KERNEL_2_5) && LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 19)
+static void usb_remote_recv(struct urb *urb, struct pt_regs *regs)
+#else
+static void usb_remote_recv(struct urb *urb)
+#endif
+{
+	struct in_endpt *iep;
+	int len, result = -1;
+
+	if (!urb)
+		return;
+	iep = urb->context;
+	if (!iep) {
+#ifdef KERNEL_2_5
+		urb->transfer_flags |= URB_ASYNC_UNLINK;
+#endif
+		usb_unlink_urb(urb);
+		return;
+	}
+	if (!iep->ir->usbdev)
+		return;
+
+	len = urb->actual_length;
+	if (debug)
+		print_data(iep, urb->transfer_buffer, len);
+
+	switch (urb->status) {
+
+	case 0:
+		switch (iep->ir->remote_type) {
+		case XBOX_COMPATIBLE:
+			result = code_check_xbox(iep, len);
+			break;
+		case ATI2_COMPATIBLE:
+			result = code_check_ati2(iep, len);
+			break;
+		case ATI1_COMPATIBLE:
+		default:
+			result = code_check_ati1(iep, len);
+		}
+		if (result < 0)
+			break;
+		lirc_buffer_write(iep->ir->d->rbuf, iep->buf);
+		wake_up(&iep->ir->d->rbuf->wait_poll);
+		break;
+
+	case -ECONNRESET:
+	case -ENOENT:
+	case -ESHUTDOWN:
+#ifdef KERNEL_2_5
+		urb->transfer_flags |= URB_ASYNC_UNLINK;
+#endif
+		usb_unlink_urb(urb);
+		return;
+
+	case -EPIPE:
+	default:
+		break;
+	}
+
+#ifdef KERNEL_2_5
+	usb_submit_urb(urb, GFP_ATOMIC);
+#endif
+}
+
+#if defined(KERNEL_2_5) && LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 19)
+static void usb_remote_send(struct urb *urb, struct pt_regs *regs)
+#else
+static void usb_remote_send(struct urb *urb)
+#endif
+{
+	struct out_endpt *oep;
+
+	if (!urb)
+		return;
+	oep = urb->context;
+	if (!oep) {
+#ifdef KERNEL_2_5
+		urb->transfer_flags |= URB_ASYNC_UNLINK;
+#endif
+		usb_unlink_urb(urb);
+		return;
+	}
+	if (!oep->ir->usbdev)
+		return;
+
+	dprintk(DRIVER_NAME "[%d]: usb out called\n", oep->ir->devnum);
+
+	if (urb->status)
+		return;
+
+	oep->send_flags |= SEND_FLAG_COMPLETE;
+	wmb();
+	if (waitqueue_active(&oep->wait))
+		wake_up(&oep->wait);
+}
+
+
+/*
+ * Initialization and removal
+ */
+
+/*
+ * Free iep according to mem_failure which specifies a checkpoint into the
+ * initialization sequence for rollback recovery.
+ */
+static void free_in_endpt(struct in_endpt *iep, int mem_failure)
+{
+	struct atirf_dev *ir;
+	dprintk(DRIVER_NAME ": free_in_endpt(%p, %d)\n", iep, mem_failure);
+	if (!iep)
+		return;
+
+	ir = iep->ir;
+	if (!ir) {
+		dprintk(DRIVER_NAME ": free_in_endpt: WARNING! null ir\n");
+		return;
+	}
+	mutex_lock(&ir->lock);
+	switch (mem_failure) {
+	case FREE_ALL:
+	case 5:
+		list_del(&iep->iep_list_link);
+		dprintk(DRIVER_NAME "[%d]: free_in_endpt removing ep=0x%0x "
+			"from list\n", ir->devnum, iep->ep->bEndpointAddress);
+	case 4:
+		if (iep->urb) {
+#ifdef KERNEL_2_5
+			iep->urb->transfer_flags |= URB_ASYNC_UNLINK;
+#endif
+			usb_unlink_urb(iep->urb);
+			usb_free_urb(iep->urb);
+			iep->urb = 0;
+		} else
+			dprintk(DRIVER_NAME "[%d]: free_in_endpt null urb!\n",
+				ir->devnum);
+	case 3:
+#ifdef KERNEL_2_5
+		usb_buffer_free(iep->ir->usbdev, iep->len, iep->buf, iep->dma);
+#else
+		kfree(iep->buf);
+#endif
+		iep->buf = 0;
+	case 2:
+		kfree(iep);
+	}
+	mutex_unlock(&ir->lock);
+}
+
+/*
+ * Construct a new inbound endpoint for this remote, and add it to the list of
+ * in_epts in ir.
+ */
+static struct in_endpt *new_in_endpt(struct atirf_dev *ir,
+				     struct usb_endpoint_descriptor *ep)
+{
+	struct usb_device *dev = ir->usbdev;
+	struct in_endpt *iep;
+	int pipe, maxp, len, addr;
+	int mem_failure;
+
+	addr = ep->bEndpointAddress;
+	pipe = usb_rcvintpipe(dev, addr);
+	maxp = usb_maxpacket(dev, pipe, usb_pipeout(pipe));
+
+/*	len = (maxp > USB_BUFLEN) ? USB_BUFLEN : maxp;
+ *	len -= (len % CODE_LENGTH); */
+	len = CODE_LENGTH;
+
+	dprintk(DRIVER_NAME "[%d]: acceptable inbound endpoint (0x%x) found "
+		"(maxp=%d len=%d)\n", ir->devnum, addr, maxp, len);
+
+	mem_failure = 0;
+	iep = kzalloc(sizeof(*iep), GFP_KERNEL);
+	if (!iep) {
+		mem_failure = 1;
+		goto new_in_endpt_failure_check;
+	}
+	iep->ir = ir;
+	iep->ep = ep;
+	iep->len = len;
+
+#ifdef KERNEL_2_5
+	iep->buf = usb_buffer_alloc(dev, len, GFP_ATOMIC, &iep->dma);
+#else
+	iep->buf = kmalloc(len, GFP_KERNEL);
+#endif
+	if (!iep->buf) {
+		mem_failure = 2;
+		goto new_in_endpt_failure_check;
+	}
+
+#ifdef KERNEL_2_5
+	iep->urb = usb_alloc_urb(0, GFP_KERNEL);
+#else
+	iep->urb = usb_alloc_urb(0);
+#endif
+	if (!iep->urb)
+		mem_failure = 3;
+
+new_in_endpt_failure_check:
+
+	if (mem_failure) {
+		free_in_endpt(iep, mem_failure);
+		printk(DRIVER_NAME "[%d]: ep=0x%x out of memory (code=%d)\n",
+		       ir->devnum, addr, mem_failure);
+		return NULL;
+	}
+	list_add_tail(&iep->iep_list_link, &ir->iep_listhead);
+	dprintk(DRIVER_NAME "[%d]: adding ep=0x%0x to list\n",
+		ir->devnum, iep->ep->bEndpointAddress);
+	return iep;
+}
+
+static void free_out_endpt(struct out_endpt *oep, int mem_failure)
+{
+	struct atirf_dev *ir;
+	dprintk(DRIVER_NAME ": free_out_endpt(%p, %d)\n", oep, mem_failure);
+	if (!oep)
+		return;
+
+	wake_up_all(&oep->wait);
+
+	ir = oep->ir;
+	if (!ir) {
+		dprintk(DRIVER_NAME ": free_out_endpt: WARNING! null ir\n");
+		return;
+	}
+	mutex_lock(&ir->lock);
+	switch (mem_failure) {
+	case FREE_ALL:
+	case 4:
+		if (oep->urb) {
+#ifdef KERNEL_2_5
+			oep->urb->transfer_flags |= URB_ASYNC_UNLINK;
+#endif
+			usb_unlink_urb(oep->urb);
+			usb_free_urb(oep->urb);
+			oep->urb = 0;
+		} else {
+			dprintk(DRIVER_NAME "[%d]: free_out_endpt: null urb!\n",
+				ir->devnum);
+		}
+	case 3:
+#ifdef KERNEL_2_5
+		usb_buffer_free(oep->ir->usbdev, USB_OUTLEN,
+				oep->buf, oep->dma);
+#else
+		kfree(oep->buf);
+#endif
+		oep->buf = 0;
+	case 2:
+		kfree(oep);
+	}
+	mutex_unlock(&ir->lock);
+}
+
+static struct out_endpt *new_out_endpt(struct atirf_dev *ir,
+				       struct usb_endpoint_descriptor *ep)
+{
+#ifdef KERNEL_2_5
+	struct usb_device *dev = ir->usbdev;
+#endif
+	struct out_endpt *oep;
+	int mem_failure;
+
+	dprintk(DRIVER_NAME "[%d]: acceptable outbound endpoint (0x%x) found\n",
+		ir->devnum, ep->bEndpointAddress);
+
+	mem_failure = 0;
+	oep = kzalloc(sizeof(*oep), GFP_KERNEL);
+	if (!oep)
+		mem_failure = 1;
+	else {
+		oep->ir = ir;
+		oep->ep = ep;
+		init_waitqueue_head(&oep->wait);
+
+#ifdef KERNEL_2_5
+		oep->buf = usb_buffer_alloc(dev, USB_OUTLEN,
+					    GFP_ATOMIC, &oep->dma);
+#else
+		oep->buf = kmalloc(USB_OUTLEN, GFP_KERNEL);
+#endif
+		if (!oep->buf)
+			mem_failure = 2;
+		else {
+#ifdef KERNEL_2_5
+			oep->urb = usb_alloc_urb(0, GFP_KERNEL);
+#else
+			oep->urb = usb_alloc_urb(0);
+#endif
+			if (!oep->urb)
+				mem_failure = 3;
+		}
+	}
+	if (mem_failure) {
+		free_out_endpt(oep, mem_failure);
+		printk(DRIVER_NAME "[%d]: ep=0x%x out of memory (code=%d)\n",
+		       ir->devnum, ep->bEndpointAddress, mem_failure);
+		return NULL;
+	}
+	return oep;
+}
+
+static void free_irctl(struct atirf_dev *ir, int mem_failure)
+{
+	struct list_head *pos, *n;
+	struct in_endpt *in;
+	dprintk(DRIVER_NAME ": free_irctl(%p, %d)\n", ir, mem_failure);
+
+	if (!ir)
+		return;
+
+	list_for_each_safe(pos, n, &ir->iep_listhead) {
+		in = get_iep_from_link(pos);
+		free_in_endpt(in, FREE_ALL);
+	}
+	if (ir->out_init) {
+		free_out_endpt(ir->out_init, FREE_ALL);
+		ir->out_init = NULL;
+	}
+
+	mutex_lock(&ir->lock);
+	switch (mem_failure) {
+	case FREE_ALL:
+	case 6:
+		if (!--ir->dev_refcount) {
+			list_del(&ir->remote_list_link);
+			dprintk(DRIVER_NAME "[%d]: free_irctl: removing "
+				"remote from list\n", ir->devnum);
+		} else {
+			dprintk(DRIVER_NAME "[%d]: free_irctl: refcount at %d,"
+				"aborting free_irctl\n",
+				ir->devnum, ir->dev_refcount);
+			mutex_unlock(&ir->lock);
+			return;
+		}
+	case 5:
+	case 4:
+	case 3:
+		if (ir->d) {
+			switch (mem_failure) {
+			case 5:
+				lirc_buffer_free(ir->d->rbuf);
+			case 4:
+				kfree(ir->d->rbuf);
+			case 3:
+				kfree(ir->d);
+			}
+		} else
+			printk(DRIVER_NAME "[%d]: ir->d is a null pointer!\n",
+			       ir->devnum);
+	case 2:
+		mutex_unlock(&ir->lock);
+		kfree(ir);
+		return;
+	}
+	mutex_unlock(&ir->lock);
+}
+
+static struct atirf_dev *new_irctl(struct usb_interface *intf)
+{
+	struct usb_device *dev = interface_to_usbdev(intf);
+	struct atirf_dev *ir;
+	struct lirc_driver *driver;
+	int type, devnum, dclen;
+	int mem_failure;
+
+	devnum = dev->devnum;
+
+	switch (cpu_to_le16(dev->descriptor.idVendor)) {
+	case VENDOR_ATI1:
+		type = ATI1_COMPATIBLE;
+		break;
+	case VENDOR_ATI2:
+		type = ATI2_COMPATIBLE;
+		break;
+	case VENDOR_MS1:
+	case VENDOR_MS2:
+	case VENDOR_MS3:
+		type = XBOX_COMPATIBLE;
+		break;
+	default:
+		dprintk(DRIVER_NAME "[%d]: unknown type\n", devnum);
+		return NULL;
+	}
+	dprintk(DRIVER_NAME "[%d]: remote type = %d\n", devnum, type);
+
+	mem_failure = 0;
+	ir = kzalloc(sizeof(*ir), GFP_KERNEL);
+	if (!ir) {
+		mem_failure = 1;
+		goto new_irctl_failure_check;
+	}
+
+	/*
+	 * at this stage we cannot use the macro [DE]CODE_LENGTH: ir
+	 * is not yet setup
+	 */
+	dclen = decode_length[type];
+	/*
+	 * add this infrared remote struct to remote_list, keeping track
+	 * of the number of drivers registered.
+	 */
+	dprintk(DRIVER_NAME "[%d]: adding remote to list\n", devnum);
+	list_add_tail(&ir->remote_list_link, &remote_list);
+	ir->dev_refcount = 1;
+
+	driver = kzalloc(sizeof(*driver), GFP_KERNEL);
+	if (!driver) {
+		mem_failure = 2;
+		goto new_irctl_failure_check;
+	}
+
+	ir->d = driver;
+	driver->rbuf = kmalloc(sizeof(*(driver->rbuf)), GFP_KERNEL);
+	if (!driver->rbuf) {
+		mem_failure = 3;
+		goto new_irctl_failure_check;
+	}
+
+	if (lirc_buffer_init(driver->rbuf, dclen, 1)) {
+		mem_failure = 4;
+		goto new_irctl_failure_check;
+	}
+
+	strcpy(driver->name, DRIVER_NAME " ");
+	driver->minor = -1;
+	driver->code_length = dclen * 8;
+	driver->features = LIRC_CAN_REC_LIRCCODE;
+	driver->data = ir;
+	driver->set_use_inc = &set_use_inc;
+	driver->set_use_dec = &set_use_dec;
+#ifdef LIRC_HAVE_SYSFS
+	driver->dev = &intf->dev;
+#endif
+	driver->owner = THIS_MODULE;
+	ir->usbdev = dev;
+	ir->remote_type = type;
+	ir->devnum = devnum;
+	ir->mode = RW2_NULL_MODE;
+
+	mutex_init(&ir->lock);
+	INIT_LIST_HEAD(&ir->iep_listhead);
+
+new_irctl_failure_check:
+
+	if (mem_failure) {
+		free_irctl(ir, mem_failure);
+		printk(DRIVER_NAME "[%d]: out of memory (code=%d)\n",
+		       devnum, mem_failure);
+		return NULL;
+	}
+	return ir;
+}
+
+
+/*
+ * Scan the global list of remotes to see if the device listed is one of them.
+ * If it is, the corresponding atirf_dev is returned, with its dev_refcount
+ * incremented.  Otherwise, returns null.
+ */
+static struct atirf_dev *get_prior_reg_ir(struct usb_device *dev)
+{
+	struct list_head *pos;
+	struct atirf_dev *ir = NULL;
+
+	dprintk(DRIVER_NAME "[%d]: scanning remote_list...\n", dev->devnum);
+	list_for_each(pos, &remote_list) {
+		ir = get_irctl_from_link(pos);
+		if (ir->usbdev != dev) {
+			dprintk(DRIVER_NAME "[%d]: device %d isn't it...",
+				dev->devnum, ir->devnum);
+		    ir = NULL;
+		} else {
+			dprintk(DRIVER_NAME "[%d]: prior instance found.\n",
+				dev->devnum);
+			ir->dev_refcount++;
+			break;
+		}
+	}
+	return ir;
+}
+
+/*
+ * If the USB interface has an out endpoint for control (eg, the first Remote
+ * Wonder) send the appropriate initialization packets.
+ */
+static void send_outbound_init(struct atirf_dev *ir)
+{
+	if (ir->out_init) {
+		struct out_endpt *oep = ir->out_init;
+		dprintk(DRIVER_NAME "[%d]: usb_remote_probe: initializing "
+			"outbound ep\n", ir->devnum);
+		usb_fill_int_urb(oep->urb, ir->usbdev,
+			usb_sndintpipe(ir->usbdev, oep->ep->bEndpointAddress),
+			oep->buf, USB_OUTLEN, usb_remote_send,
+			oep, oep->ep->bInterval);
+#ifdef KERNEL_2_5
+		oep->urb->transfer_dma = oep->dma;
+		oep->urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+#endif
+
+		send_packet(oep, 0x8004, init1);
+		send_packet(oep, 0x8007, init2);
+	}
+}
+
+/* Log driver and usb info */
+static void log_usb_dev_info(struct usb_device *dev)
+{
+	char buf[63], name[128] = "";
+
+	if (dev->descriptor.iManufacturer
+	    && usb_string(dev, dev->descriptor.iManufacturer,
+			  buf, sizeof(buf)) > 0)
+		strlcpy(name, buf, sizeof(name));
+	if (dev->descriptor.iProduct
+	    && usb_string(dev, dev->descriptor.iProduct, buf, sizeof(buf)) > 0)
+		snprintf(name + strlen(name), sizeof(name) - strlen(name),
+			 " %s", buf);
+	printk(DRIVER_NAME "[%d]: %s on usb%d:%d\n", dev->devnum, name,
+	       dev->bus->busnum, dev->devnum);
+}
+
+
+#ifdef KERNEL_2_5
+static int usb_remote_probe(struct usb_interface *intf,
+				const struct usb_device_id *id)
+{
+	struct usb_device *dev = interface_to_usbdev(intf);
+	struct usb_host_interface *idesc;
+#else
+static void *usb_remote_probe(struct usb_device *dev, unsigned int ifnum,
+				const struct usb_device_id *id)
+{
+	struct usb_interface *intf = &dev->actconfig->interface[ifnum];
+	struct usb_interface_descriptor *idesc;
+#endif
+	struct usb_endpoint_descriptor *ep;
+	struct in_endpt *iep;
+	struct atirf_dev *ir;
+	int i, type;
+
+	dprintk(DRIVER_NAME "[%d]: usb_remote_probe: dev:%p, intf:%p, id:%p)\n",
+		dev->devnum, dev, intf, id);
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 5)
+	idesc = &intf->altsetting[intf->act_altsetting];
+#else
+	idesc = intf->cur_altsetting;
+#endif
+
+	/* Check if a usb remote has already been registered for this device */
+	ir = get_prior_reg_ir(dev);
+
+	if (!ir) {
+		ir = new_irctl(intf);
+		if (!ir)
+#ifdef KERNEL_2_5
+			return -ENOMEM;
+#else
+			return NULL;
+#endif
+	}
+	type = ir->remote_type;
+
+	/*
+	 * step through the endpoints to find first in and first out endpoint
+	 * of type interrupt transfer
+	 */
+#ifdef KERNEL_2_5
+	for (i = 0; i < idesc->desc.bNumEndpoints; ++i) {
+		ep = &idesc->endpoint[i].desc;
+#else
+	for (i = 0; i < idesc->bNumEndpoints; ++i) {
+		ep = &idesc->endpoint[i];
+#endif
+		dprintk(DRIVER_NAME "[%d]: processing endpoint %d\n",
+			dev->devnum, i);
+		if (((ep->bEndpointAddress & USB_ENDPOINT_DIR_MASK) ==
+		     USB_DIR_IN) &&
+		     ((ep->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) ==
+		      USB_ENDPOINT_XFER_INT)) {
+
+			iep = new_in_endpt(ir, ep);
+			if (iep)
+			{
+				usb_fill_int_urb(iep->urb, dev,
+					usb_rcvintpipe(dev,
+						iep->ep->bEndpointAddress),
+					iep->buf, iep->len, usb_remote_recv,
+					iep, iep->ep->bInterval);
+#ifdef KERNEL_2_5
+				iep->urb->transfer_dma = iep->dma;
+				iep->urb->transfer_flags |=
+					URB_NO_TRANSFER_DMA_MAP;
+#endif
+			}
+		}
+
+		if (((ep->bEndpointAddress & USB_ENDPOINT_DIR_MASK) ==
+		     USB_DIR_OUT) &&
+		     ((ep->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) ==
+		      USB_ENDPOINT_XFER_INT) &&
+		      (ir->out_init == NULL))
+			ir->out_init = new_out_endpt(ir, ep);
+	}
+	if (list_empty(&ir->iep_listhead)) {
+		printk(DRIVER_NAME "[%d]: inbound endpoint not found\n",
+		       ir->devnum);
+		free_irctl(ir, FREE_ALL);
+#ifdef KERNEL_2_5
+		return -ENODEV;
+#else
+		return NULL;
+#endif
+	}
+	if (ir->dev_refcount == 1) {
+		ir->d->minor = lirc_register_driver(ir->d);
+		if (ir->d->minor < 0) {
+			free_irctl(ir, FREE_ALL);
+#ifdef KERNEL_2_5
+			return -ENODEV;
+#else
+			return NULL;
+#endif
+		}
+
+		/* Note new driver registration in kernel logs */
+		log_usb_dev_info(dev);
+
+		/* outbound data (initialization) */
+		send_outbound_init(ir);
+	}
+
+#ifdef KERNEL_2_5
+	usb_set_intfdata(intf, ir);
+	return 0;
+#else
+	return ir;
+#endif
+}
+
+#ifdef KERNEL_2_5
+static void usb_remote_disconnect(struct usb_interface *intf)
+{
+	/* struct usb_device *dev = interface_to_usbdev(intf); */
+	struct atirf_dev *ir = usb_get_intfdata(intf);
+	usb_set_intfdata(intf, NULL);
+#else
+static void usb_remote_disconnect(struct usb_device *dev, void *ptr)
+{
+	struct atirf_dev *ir = ptr;
+#endif
+
+	dprintk(DRIVER_NAME ": disconnecting remote %d:\n",
+		(ir ? ir->devnum : -1));
+	if (!ir || !ir->d)
+		return;
+
+	if (ir->usbdev) {
+		/* Only unregister once */
+		ir->usbdev = NULL;
+		unregister_from_lirc(ir);
+	}
+
+	/* This also removes the current remote from remote_list */
+	free_irctl(ir, FREE_ALL);
+}
+
+static struct usb_driver usb_remote_driver = {
+	LIRC_THIS_MODULE(.owner = THIS_MODULE)
+	.name		= DRIVER_NAME,
+	.probe		= usb_remote_probe,
+	.disconnect	= usb_remote_disconnect,
+	.id_table	= usb_remote_table
+};
+
+static int __init usb_remote_init(void)
+{
+	int i;
+
+	INIT_LIST_HEAD(&remote_list);
+
+	printk(KERN_INFO "\n" DRIVER_NAME ": " DRIVER_DESC " "
+	       DRIVER_VERSION "\n");
+	printk(DRIVER_NAME ": " DRIVER_AUTHOR "\n");
+	dprintk(DRIVER_NAME ": debug mode enabled: "
+		"$Id: lirc_atiusb.c,v 1.85 2009/03/11 00:21:46 jarodwilson Exp $\n");
+
+	repeat_jiffies = repeat*HZ/100;
+
+	i = usb_register(&usb_remote_driver);
+	if (i) {
+		printk(DRIVER_NAME ": usb register failed, result = %d\n", i);
+		return -ENODEV;
+	}
+
+	return 0;
+}
+
+static void __exit usb_remote_exit(void)
+{
+	usb_deregister(&usb_remote_driver);
+}
+
+module_init(usb_remote_init);
+module_exit(usb_remote_exit);
+
+MODULE_DESCRIPTION(DRIVER_DESC);
+MODULE_AUTHOR(DRIVER_AUTHOR);
+MODULE_LICENSE("GPL");
+MODULE_DEVICE_TABLE(usb, usb_remote_table);
+
+module_param(debug, bool, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(debug, "Debug enabled or not (default: 0)");
+
+module_param(mask, int, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(mask, "Set channel acceptance bit mask (default: 0xFFFF)");
+
+module_param(unique, bool, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(unique, "Enable channel-specific codes (default: 0)");
+
+module_param(repeat, int, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(repeat, "Repeat timeout (1/100 sec) (default: 10)");
+
+module_param(mdeadzone, int, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(mdeadzone, "rw2 mouse sensitivity threshold (default: 0)");
+
+/*
+ * Enabling this will cause the built-in Remote Wonder II repeat coding to
+ * not be squashed.  The second byte of the keys output will then be:
+ *
+ *	1 initial press (button down)
+ *	2 holding (button remains pressed)
+ *	0 release (button up)
+ *
+ * By default, the driver emits 2 for both 1 and 2, and emits nothing for 0.
+ * This is good for people having trouble getting their rw2 to send a good
+ * consistent signal to the receiver.
+ *
+ * However, if you have no troubles with the driver outputting up-down pairs
+ * at random points while you're still holding a button, then you can enable
+ * this parameter to get finer grain repeat control out of your remote:
+ *
+ *	1 Emit a single (per-channel) virtual code for all up/down events
+ *	2 Emit the actual rw2 output
+ *
+ * 1 is easier to write lircd configs for; 2 allows full control.
+ */
+module_param(emit_updown, int, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(emit_updown, "emit press/release codes (rw2): 0:don't "
+		 "(default), 1:emit 2 codes only, 2:code for each button");
+
+module_param(emit_modekeys, int, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(emit_modekeys, "emit keycodes for aux1-aux4, pc, and mouse "
+		 "(rw2): 0:don't (default), 1:emit translated codes: one for "
+		 "mode switch, one for same mode, 2:raw codes");
+
+module_param(mgradient, int, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(mgradient, "rw2 mouse: 1000*gradient from E to NE (default: "
+		 "500 => .5 => ~27 degrees)");
+
+EXPORT_NO_SYMBOLS;
--- linux-rt-2.6.31.orig/ubuntu/lirc/lirc_sasem/lirc_sasem.c
+++ linux-rt-2.6.31/ubuntu/lirc/lirc_sasem/lirc_sasem.c
@@ -0,0 +1,1108 @@
+/*      $Id: lirc_sasem.c,v 1.40 2009/02/28 10:27:10 lirc Exp $      */
+/*
+ * lirc_sasem.c - USB remote support for LIRC
+ * Version 0.5
+ *
+ * Copyright (C) 2004-2005 Oliver Stabel <oliver.stabel@gmx.de>
+ *			 Tim Davies <tim@opensystems.net.au>
+ *
+ * This driver was derived from:
+ *   Venky Raju <dev@venky.ws>
+ *      "lirc_imon - "LIRC/VFD driver for Ahanix/Soundgraph IMON IR/VFD"
+ *   Paul Miller <pmiller9@users.sourceforge.net>'s 2003-2004
+ *      "lirc_atiusb - USB remote support for LIRC"
+ *   Culver Consulting Services <henry@culcon.com>'s 2003
+ *      "Sasem OnAir VFD/IR USB driver"
+ *
+ *
+ * NOTE - The LCDproc iMon driver should work with this module.  More info at
+ *	http://www.frogstorm.info/sasem
+ */
+
+/*
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+#include <linux/version.h>
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 4, 22)
+#error "*** Sorry, this driver requires kernel version 2.4.22 or higher"
+#endif
+
+#include <linux/autoconf.h>
+
+#include <linux/errno.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/slab.h>
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 18)
+#include <asm/uaccess.h>
+#else
+#include <linux/uaccess.h>
+#endif
+#include <linux/usb.h>
+
+#include "../kcompat.h"
+#include "../lirc.h"
+#include "../lirc_dev/lirc_dev.h"
+
+
+#define MOD_AUTHOR	"Oliver Stabel <oliver.stabel@gmx.de>, " \
+			"Tim Davies <tim@opensystems.net.au>"
+#define MOD_DESC	"USB Driver for Sasem Remote Controller V1.1"
+#define MOD_NAME	"lirc_sasem"
+#define MOD_VERSION	"0.5"
+
+#define VFD_MINOR_BASE	144	/* Same as LCD */
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 15)
+#define DEVFS_MODE S_IFCHR | S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP | S_IROTH
+#endif
+#define DEVFS_NAME	LIRC_DEVFS_PREFIX "lcd%d"
+
+#define BUF_CHUNK_SIZE	8
+#define BUF_SIZE	128
+
+#define IOCTL_LCD_CONTRAST 1
+
+/*** P R O T O T Y P E S ***/
+
+/* USB Callback prototypes */
+#ifdef KERNEL_2_5
+static int sasem_probe(struct usb_interface *interface,
+			const struct usb_device_id *id);
+static void sasem_disconnect(struct usb_interface *interface);
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 19)
+static void usb_rx_callback(struct urb *urb, struct pt_regs *regs);
+static void usb_tx_callback(struct urb *urb, struct pt_regs *regs);
+#else
+static void usb_rx_callback(struct urb *urb);
+static void usb_tx_callback(struct urb *urb);
+#endif
+#else
+static void *sasem_probe(struct usb_device *dev, unsigned int intf,
+				const struct usb_device_id *id);
+static void sasem_disconnect(struct usb_device *dev, void *data);
+static void usb_rx_callback(struct urb *urb);
+static void usb_tx_callback(struct urb *urb);
+#endif
+
+/* VFD file_operations function prototypes */
+static int vfd_open(struct inode *inode, struct file *file);
+static int vfd_ioctl(struct inode *inode, struct file *file,
+				unsigned cmd, unsigned long arg);
+static int vfd_close(struct inode *inode, struct file *file);
+static ssize_t vfd_write(struct file *file, const char *buf,
+				size_t n_bytes, loff_t *pos);
+
+/* LIRC driver function prototypes */
+static int ir_open(void *data);
+static void ir_close(void *data);
+
+/* Driver init/exit prototypes */
+static int __init sasem_init(void);
+static void __exit sasem_exit(void);
+
+/*** G L O B A L S ***/
+
+struct sasem_context {
+
+	struct usb_device *dev;
+	int vfd_isopen;			/* VFD port has been opened       */
+	unsigned int vfd_contrast;	/* VFD contrast		   */
+#if !defined(KERNEL_2_5)
+	int subminor;			/* index into minor_table	 */
+	devfs_handle_t devfs;
+#endif
+	int ir_isopen;			/* IR port has been opened	*/
+	int dev_present;		/* USB device presence	    */
+	struct mutex lock;		/* to lock this object	    */
+	wait_queue_head_t remove_ok;	/* For unexpected USB disconnects */
+
+	struct lirc_driver *driver;
+	struct usb_endpoint_descriptor *rx_endpoint;
+	struct usb_endpoint_descriptor *tx_endpoint;
+	struct urb *rx_urb;
+	struct urb *tx_urb;
+	unsigned char usb_rx_buf[8];
+	unsigned char usb_tx_buf[8];
+
+	struct tx_t {
+		unsigned char data_buf[32];  /* user data buffer	  */
+		struct completion finished;  /* wait for write to finish  */
+		atomic_t busy;		     /* write in progress	 */
+		int status;		     /* status of tx completion   */
+	} tx;
+
+	/* for dealing with repeat codes (wish there was a toggle bit!) */
+	struct timeval presstime;
+	char lastcode[8];
+	int codesaved;
+};
+
+/* VFD file operations */
+static struct file_operations vfd_fops = {
+
+	.owner		= THIS_MODULE,
+	.open		= &vfd_open,
+	.write		= &vfd_write,
+	.ioctl		= &vfd_ioctl,
+	.release	= &vfd_close
+};
+
+/* USB Device ID for Sasem USB Control Board */
+static struct usb_device_id sasem_usb_id_table [] = {
+	/* Sasem USB Control Board */
+	{ USB_DEVICE(0x11ba, 0x0101) },
+	/* Terminating entry */
+	{}
+};
+
+/* USB Device data */
+static struct usb_driver sasem_driver = {
+	LIRC_THIS_MODULE(.owner = THIS_MODULE)
+	.name		= MOD_NAME,
+	.probe		= sasem_probe,
+	.disconnect	= sasem_disconnect,
+	.id_table	= sasem_usb_id_table,
+#if !defined(KERNEL_2_5)
+	.fops		= &vfd_fops,
+	.minor		= VFD_MINOR_BASE,
+#endif
+};
+
+#ifdef KERNEL_2_5
+static struct usb_class_driver sasem_class = {
+	.name		= DEVFS_NAME,
+	.fops		= &vfd_fops,
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 15)
+	.mode		= DEVFS_MODE,
+#endif
+	.minor_base	= VFD_MINOR_BASE,
+};
+#endif
+
+/* to prevent races between open() and disconnect() */
+static DEFINE_MUTEX(disconnect_lock);
+
+static int debug;
+
+#if !defined(KERNEL_2_5)
+
+#define MAX_DEVICES	4	/* In case there's more than one Sasem device */
+static struct sasem_context *minor_table [MAX_DEVICES];
+
+/* the global usb devfs handle */
+extern devfs_handle_t usb_devfs_handle;
+
+#endif
+
+/*** M O D U L E   C O D E ***/
+
+MODULE_AUTHOR(MOD_AUTHOR);
+MODULE_DESCRIPTION(MOD_DESC);
+MODULE_LICENSE("GPL");
+module_param(debug, int, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(debug, "Debug messages: 0=no, 1=yes (default: no)");
+
+static void delete_context(struct sasem_context *context)
+{
+	usb_free_urb(context->tx_urb);  /* VFD */
+	usb_free_urb(context->rx_urb);  /* IR */
+	lirc_buffer_free(context->driver->rbuf);
+	kfree(context->driver->rbuf);
+	kfree(context->driver);
+	kfree(context);
+
+	if (debug)
+		printk(KERN_INFO "%s: context deleted\n", __func__);
+}
+
+static void deregister_from_lirc(struct sasem_context *context)
+{
+	int retval;
+	int minor = context->driver->minor;
+
+	retval = lirc_unregister_driver(minor);
+	if (retval)
+		err("%s: unable to deregister from lirc (%d)",
+			__func__, retval);
+	else
+		printk(KERN_INFO "Deregistered Sasem driver (minor:%d)\n",
+		       minor);
+
+}
+
+/**
+ * Called when the VFD device (e.g. /dev/usb/lcd)
+ * is opened by the application.
+ */
+static int vfd_open(struct inode *inode, struct file *file)
+{
+#ifdef KERNEL_2_5
+	struct usb_interface *interface;
+#endif
+	struct sasem_context *context = NULL;
+	int subminor;
+	int retval = 0;
+
+	/* prevent races with disconnect */
+	mutex_lock(&disconnect_lock);
+
+#ifdef KERNEL_2_5
+	subminor = iminor(inode);
+	interface = usb_find_interface(&sasem_driver, subminor);
+	if (!interface) {
+		err("%s: could not find interface for minor %d",
+		    __func__, subminor);
+		retval = -ENODEV;
+		goto exit;
+	}
+	context = usb_get_intfdata(interface);
+#else
+	subminor = MINOR(inode->i_rdev) - VFD_MINOR_BASE;
+	if (subminor < 0 || subminor >= MAX_DEVICES) {
+		err("%s: no record of minor %d", __func__, subminor);
+		retval = -ENODEV;
+		goto exit;
+	}
+	context = minor_table [subminor];
+#endif
+
+	if (!context) {
+		err("%s: no context found for minor %d",
+					__func__, subminor);
+		retval = -ENODEV;
+		goto exit;
+	}
+
+	mutex_lock(&context->lock);
+
+	if (context->vfd_isopen) {
+		err("%s: VFD port is already open", __func__);
+		retval = -EBUSY;
+	} else {
+		MOD_INC_USE_COUNT;
+		context->vfd_isopen = 1;
+		file->private_data = context;
+		printk(KERN_INFO "VFD port opened\n");
+	}
+
+	mutex_unlock(&context->lock);
+
+exit:
+	mutex_unlock(&disconnect_lock);
+	return retval;
+}
+
+/**
+ * Called when the VFD device (e.g. /dev/usb/lcd)
+ * is closed by the application.
+ */
+static int vfd_ioctl(struct inode *inode, struct file *file,
+		     unsigned cmd, unsigned long arg)
+{
+	struct sasem_context *context = NULL;
+
+	context = (struct sasem_context *) file->private_data;
+
+	if (!context) {
+		err("%s: no context for device", __func__);
+		return -ENODEV;
+	}
+
+	mutex_lock(&context->lock);
+
+	switch (cmd) {
+	case IOCTL_LCD_CONTRAST:
+		if (arg > 1000)
+			arg = 1000;
+		context->vfd_contrast = (unsigned int)arg;
+		break;
+	default:
+		printk(KERN_INFO "Unknown IOCTL command\n");
+		mutex_unlock(&context->lock);
+		return -ENOIOCTLCMD;  /* not supported */
+	}
+
+	mutex_unlock(&context->lock);
+	return 0;
+}
+
+/**
+ * Called when the VFD device (e.g. /dev/usb/lcd)
+ * is closed by the application.
+ */
+static int vfd_close(struct inode *inode, struct file *file)
+{
+	struct sasem_context *context = NULL;
+	int retval = 0;
+
+	context = (struct sasem_context *) file->private_data;
+
+	if (!context) {
+		err("%s: no context for device", __func__);
+		return -ENODEV;
+	}
+
+	mutex_lock(&context->lock);
+
+	if (!context->vfd_isopen) {
+		err("%s: VFD is not open", __func__);
+		retval = -EIO;
+	} else {
+		context->vfd_isopen = 0;
+		MOD_DEC_USE_COUNT;
+		printk(KERN_INFO "VFD port closed\n");
+		if (!context->dev_present && !context->ir_isopen) {
+
+			/* Device disconnected before close and IR port is
+			 * not open. If IR port is open, context will be
+			 * deleted by ir_close. */
+			mutex_unlock(&context->lock);
+			delete_context(context);
+			return retval;
+		}
+	}
+
+	mutex_unlock(&context->lock);
+	return retval;
+}
+
+/**
+ * Sends a packet to the VFD.
+ */
+static int send_packet(struct sasem_context *context)
+{
+	unsigned int pipe;
+	int interval = 0;
+	int retval = 0;
+
+	pipe = usb_sndintpipe(context->dev,
+			context->tx_endpoint->bEndpointAddress);
+#ifdef KERNEL_2_5
+	interval = context->tx_endpoint->bInterval;
+#endif	/* Use 0 for 2.4 kernels */
+
+	usb_fill_int_urb(context->tx_urb, context->dev, pipe,
+		context->usb_tx_buf, sizeof(context->usb_tx_buf),
+		usb_tx_callback, context, interval);
+
+	context->tx_urb->actual_length = 0;
+
+	init_completion(&context->tx.finished);
+	atomic_set(&(context->tx.busy), 1);
+
+#ifdef KERNEL_2_5
+	retval =  usb_submit_urb(context->tx_urb, GFP_KERNEL);
+#else
+	retval =  usb_submit_urb(context->tx_urb);
+#endif
+	if (retval) {
+		atomic_set(&(context->tx.busy), 0);
+		err("%s: error submitting urb (%d)", __func__, retval);
+	} else {
+		/* Wait for transmission to complete (or abort) */
+		mutex_unlock(&context->lock);
+		wait_for_completion(&context->tx.finished);
+		mutex_lock(&context->lock);
+
+		retval = context->tx.status;
+		if (retval)
+			err("%s: packet tx failed (%d)", __func__, retval);
+	}
+
+	return retval;
+}
+
+/**
+ * Writes data to the VFD.  The Sasem VFD is 2x16 characters
+ * and requires data in 9 consecutive USB interrupt packets,
+ * each packet carrying 8 bytes.
+ */
+static ssize_t vfd_write(struct file *file, const char *buf,
+				size_t n_bytes, loff_t *pos)
+{
+	int i;
+	int retval = 0;
+	struct sasem_context *context;
+
+	context = (struct sasem_context *) file->private_data;
+	if (!context) {
+		err("%s: no context for device", __func__);
+		return -ENODEV;
+	}
+
+	mutex_lock(&context->lock);
+
+	if (!context->dev_present) {
+		err("%s: no Sasem device present", __func__);
+		retval = -ENODEV;
+		goto exit;
+	}
+
+	if (n_bytes <= 0 || n_bytes > 32) {
+		err("%s: invalid payload size", __func__);
+		retval = -EINVAL;
+		goto exit;
+	}
+
+	retval = copy_from_user(context->tx.data_buf, buf, n_bytes);
+	if (retval < 0)
+		goto exit;
+
+	/* Pad with spaces */
+	for (i = n_bytes; i < 32; ++i)
+		context->tx.data_buf[i] = ' ';
+
+	/* Nine 8 byte packets to be sent */
+	/* NOTE: "\x07\x01\0\0\0\0\0\0" or "\x0c\0\0\0\0\0\0\0"
+	 *       will clear the VFD */
+	for (i = 0; i < 9; i++) {
+		switch (i) {
+		case 0:
+			memcpy(context->usb_tx_buf, "\x07\0\0\0\0\0\0\0", 8);
+			context->usb_tx_buf[1] = (context->vfd_contrast) ?
+				(0x2B - (context->vfd_contrast - 1) / 250)
+				: 0x2B;
+			break;
+		case 1:
+			memcpy(context->usb_tx_buf, "\x09\x01\0\0\0\0\0\0", 8);
+			break;
+		case 2:
+			memcpy(context->usb_tx_buf, "\x0b\x01\0\0\0\0\0\0", 8);
+			break;
+		case 3:
+			memcpy(context->usb_tx_buf, context->tx.data_buf, 8);
+			break;
+		case 4:
+			memcpy(context->usb_tx_buf,
+			       context->tx.data_buf + 8, 8);
+			break;
+		case 5:
+			memcpy(context->usb_tx_buf, "\x09\x01\0\0\0\0\0\0", 8);
+			break;
+		case 6:
+			memcpy(context->usb_tx_buf, "\x0b\x02\0\0\0\0\0\0", 8);
+			break;
+		case 7:
+			memcpy(context->usb_tx_buf,
+			       context->tx.data_buf + 16, 8);
+			break;
+		case 8:
+			memcpy(context->usb_tx_buf,
+			       context->tx.data_buf + 24, 8);
+			break;
+		}
+		retval = send_packet(context);
+		if (retval) {
+
+			err("%s: send packet failed for packet #%d",
+					__func__, i);
+			goto exit;
+		}
+	}
+exit:
+
+	mutex_unlock(&context->lock);
+
+	return (!retval) ? n_bytes : retval;
+}
+
+/**
+ * Callback function for USB core API: transmit data
+ */
+#if defined(KERNEL_2_5) && LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 19)
+static void usb_tx_callback(struct urb *urb, struct pt_regs *regs)
+#else
+static void usb_tx_callback(struct urb *urb)
+#endif
+{
+	struct sasem_context *context;
+
+	if (!urb)
+		return;
+	context = (struct sasem_context *) urb->context;
+	if (!context)
+		return;
+
+	context->tx.status = urb->status;
+
+	/* notify waiters that write has finished */
+	atomic_set(&context->tx.busy, 0);
+	complete(&context->tx.finished);
+
+	return;
+}
+
+/**
+ * Called by lirc_dev when the application opens /dev/lirc
+ */
+static int ir_open(void *data)
+{
+	int retval = 0;
+	struct sasem_context *context;
+
+	/* prevent races with disconnect */
+	mutex_lock(&disconnect_lock);
+
+	context = (struct sasem_context *) data;
+
+	mutex_lock(&context->lock);
+
+	if (context->ir_isopen) {
+		err("%s: IR port is already open", __func__);
+		retval = -EBUSY;
+		goto exit;
+	}
+
+	usb_fill_int_urb(context->rx_urb, context->dev,
+		usb_rcvintpipe(context->dev,
+				context->rx_endpoint->bEndpointAddress),
+		context->usb_rx_buf, sizeof(context->usb_rx_buf),
+		usb_rx_callback, context, context->rx_endpoint->bInterval);
+
+#ifdef KERNEL_2_5
+	retval = usb_submit_urb(context->rx_urb, GFP_KERNEL);
+#else
+	retval = usb_submit_urb(context->rx_urb);
+#endif
+
+	if (retval)
+		err("%s: usb_submit_urb failed for ir_open (%d)",
+		    __func__, retval);
+	else {
+		MOD_INC_USE_COUNT;
+		context->ir_isopen = 1;
+		printk(KERN_INFO "IR port opened\n");
+	}
+
+exit:
+	mutex_unlock(&context->lock);
+
+	mutex_unlock(&disconnect_lock);
+	return 0;
+}
+
+/**
+ * Called by lirc_dev when the application closes /dev/lirc
+ */
+static void ir_close(void *data)
+{
+	struct sasem_context *context;
+
+	context = (struct sasem_context *)data;
+	if (!context) {
+		err("%s: no context for device", __func__);
+		return;
+	}
+
+	mutex_lock(&context->lock);
+
+	usb_kill_urb(context->rx_urb);
+	context->ir_isopen = 0;
+	MOD_DEC_USE_COUNT;
+	printk(KERN_INFO "IR port closed\n");
+
+	if (!context->dev_present) {
+
+		/*
+		 * Device disconnected while IR port was
+		 * still open. Driver was not deregistered
+		 * at disconnect time, so do it now.
+		 */
+		deregister_from_lirc(context);
+
+		if (!context->vfd_isopen) {
+
+			mutex_unlock(&context->lock);
+			delete_context(context);
+			return;
+		}
+		/* If VFD port is open, context will be deleted by vfd_close */
+	}
+
+	mutex_unlock(&context->lock);
+	return;
+}
+
+/**
+ * Process the incoming packet
+ */
+static void incoming_packet(struct sasem_context *context,
+				   struct urb *urb)
+{
+	int len = urb->actual_length;
+	unsigned char *buf = urb->transfer_buffer;
+	long ms;
+	struct timeval tv;
+
+	if (len != 8) {
+		printk(KERN_WARNING "%s: invalid incoming packet size (%d)\n",
+		     __func__, len);
+		return;
+	}
+
+#ifdef DEBUG
+	int i;
+	for (i = 0; i < 8; ++i)
+		printk(KERN_INFO "%02x ", buf [i]);
+	printk(KERN_INFO "\n");
+#endif
+
+	/*
+	 * Lirc could deal with the repeat code, but we really need to block it
+	 * if it arrives too late.  Otherwise we could repeat the wrong code.
+	 */
+
+	/* get the time since the last button press */
+	do_gettimeofday(&tv);
+	ms = (tv.tv_sec - context->presstime.tv_sec) * 1000 +
+	     (tv.tv_usec - context->presstime.tv_usec) / 1000;
+
+	if (memcmp(buf, "\x08\0\0\0\0\0\0\0", 8) == 0) {
+		/*
+		 * the repeat code is being sent, so we copy
+		 * the old code to LIRC
+		 */
+
+		/*
+		 * NOTE: Only if the last code was less than 250ms ago
+		 * - no one should be able to push another (undetected) button
+		 *   in that time and then get a false repeat of the previous
+		 *   press but it is long enough for a genuine repeat
+		 */
+		if ((ms < 250) && (context->codesaved != 0)) {
+			memcpy(buf, &context->lastcode, 8);
+			context->presstime.tv_sec = tv.tv_sec;
+			context->presstime.tv_usec = tv.tv_usec;
+		}
+	} else {
+		/* save the current valid code for repeats */
+		memcpy(&context->lastcode, buf, 8);
+		/*
+		 * set flag to signal a valid code was save;
+		 * just for safety reasons
+		 */
+		context->codesaved = 1;
+		context->presstime.tv_sec = tv.tv_sec;
+		context->presstime.tv_usec = tv.tv_usec;
+	}
+
+	lirc_buffer_write(context->driver->rbuf, buf);
+	wake_up(&context->driver->rbuf->wait_poll);
+}
+
+/**
+ * Callback function for USB core API: receive data
+ */
+#if defined(KERNEL_2_5) && LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 19)
+static void usb_rx_callback(struct urb *urb, struct pt_regs *regs)
+#else
+static void usb_rx_callback(struct urb *urb)
+#endif
+{
+	struct sasem_context *context;
+
+	if (!urb)
+		return;
+	context = (struct sasem_context *) urb->context;
+	if (!context)
+		return;
+
+	switch (urb->status) {
+
+	case -ENOENT: 		/* usbcore unlink successful! */
+		return;
+
+	case 0:
+		if (context->ir_isopen)
+			incoming_packet(context, urb);
+		break;
+
+	default:
+		printk(KERN_WARNING "%s: status (%d): ignored\n",
+		       __func__, urb->status);
+		break;
+	}
+
+#ifdef KERNEL_2_5
+	usb_submit_urb(context->rx_urb, GFP_ATOMIC);
+#endif
+	return;
+}
+
+
+
+/**
+ * Callback function for USB core API: Probe
+ */
+#ifdef KERNEL_2_5
+static int sasem_probe(struct usb_interface *interface,
+			const struct usb_device_id *id)
+#else
+static void *sasem_probe(struct usb_device *dev, unsigned int intf,
+			const struct usb_device_id *id)
+#endif
+{
+#ifdef KERNEL_2_5
+	struct usb_device *dev = NULL;
+	struct usb_host_interface *iface_desc = NULL;
+#else
+	struct usb_interface *interface = NULL;
+	struct usb_interface_descriptor *iface_desc = NULL;
+	char name [10];
+	int subminor = 0;
+#endif
+	struct usb_endpoint_descriptor *rx_endpoint = NULL;
+	struct usb_endpoint_descriptor *tx_endpoint = NULL;
+	struct urb *rx_urb = NULL;
+	struct urb *tx_urb = NULL;
+	struct lirc_driver *driver = NULL;
+	struct lirc_buffer *rbuf = NULL;
+	int lirc_minor = 0;
+	int num_endpoints;
+	int retval = 0;
+	int vfd_ep_found;
+	int ir_ep_found;
+	int alloc_status;
+	struct sasem_context *context = NULL;
+	int i;
+
+	printk(KERN_INFO "%s: found Sasem device\n", __func__);
+
+#if !defined(KERNEL_2_5)
+	for (subminor = 0; subminor < MAX_DEVICES; ++subminor) {
+		if (minor_table [subminor] == NULL)
+			break;
+	}
+	if (subminor == MAX_DEVICES) {
+		err("%s: allowed number of devices already present",
+		    __func__);
+		retval = -ENOMEM;
+		goto exit;
+	}
+#endif
+
+#ifdef KERNEL_2_5
+	dev = usb_get_dev(interface_to_usbdev(interface));
+	iface_desc = interface->cur_altsetting;
+	num_endpoints = iface_desc->desc.bNumEndpoints;
+#else
+	interface = &dev->actconfig->interface [intf];
+	iface_desc = &interface->altsetting [interface->act_altsetting];
+	num_endpoints = iface_desc->bNumEndpoints;
+#endif
+
+	/*
+	 * Scan the endpoint list and set:
+	 *	first input endpoint = IR endpoint
+	 *	first output endpoint = VFD endpoint
+	 */
+
+	ir_ep_found = 0;
+	vfd_ep_found = 0;
+
+	for (i = 0; i < num_endpoints && !(ir_ep_found && vfd_ep_found); ++i) {
+
+		struct usb_endpoint_descriptor *ep;
+		int ep_dir;
+		int ep_type;
+#ifdef KERNEL_2_5
+		ep = &iface_desc->endpoint [i].desc;
+#else
+		ep = &iface_desc->endpoint [i];
+#endif
+		ep_dir = ep->bEndpointAddress & USB_ENDPOINT_DIR_MASK;
+		ep_type = ep->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK;
+
+		if (!ir_ep_found &&
+			ep_dir == USB_DIR_IN &&
+			ep_type == USB_ENDPOINT_XFER_INT) {
+
+			rx_endpoint = ep;
+			ir_ep_found = 1;
+			if (debug)
+				printk(KERN_INFO "%s: found IR endpoint\n",
+				       __func__);
+
+		} else if (!vfd_ep_found &&
+			ep_dir == USB_DIR_OUT &&
+			ep_type == USB_ENDPOINT_XFER_INT) {
+
+			tx_endpoint = ep;
+			vfd_ep_found = 1;
+			if (debug)
+				printk(KERN_INFO "%s: found VFD endpoint\n",
+				       __func__);
+		}
+	}
+
+	/* Input endpoint is mandatory */
+	if (!ir_ep_found) {
+
+		err("%s: no valid input (IR) endpoint found.", __func__);
+		retval = -ENODEV;
+		goto exit;
+	}
+
+	if (!vfd_ep_found)
+		printk(KERN_INFO "%s: no valid output (VFD) endpoint found.\n",
+		       __func__);
+
+
+	/* Allocate memory */
+	alloc_status = 0;
+
+	context = kzalloc(sizeof(struct sasem_context), GFP_KERNEL);
+	if (!context) {
+		err("%s: kzalloc failed for context", __func__);
+		alloc_status = 1;
+		goto alloc_status_switch;
+	}
+	driver = kzalloc(sizeof(struct lirc_driver), GFP_KERNEL);
+	if (!driver) {
+		err("%s: kzalloc failed for lirc_driver", __func__);
+		alloc_status = 2;
+		goto alloc_status_switch;
+	}
+	rbuf = kmalloc(sizeof(struct lirc_buffer), GFP_KERNEL);
+	if (!rbuf) {
+		err("%s: kmalloc failed for lirc_buffer", __func__);
+		alloc_status = 3;
+		goto alloc_status_switch;
+	}
+	if (lirc_buffer_init(rbuf, BUF_CHUNK_SIZE, BUF_SIZE)) {
+		err("%s: lirc_buffer_init failed", __func__);
+		alloc_status = 4;
+		goto alloc_status_switch;
+	}
+#ifdef KERNEL_2_5
+	rx_urb = usb_alloc_urb(0, GFP_KERNEL);
+#else
+	rx_urb = usb_alloc_urb(0);
+#endif
+	if (!rx_urb) {
+		err("%s: usb_alloc_urb failed for IR urb", __func__);
+		alloc_status = 5;
+		goto alloc_status_switch;
+	}
+	if (vfd_ep_found) {
+#ifdef KERNEL_2_5
+		tx_urb = usb_alloc_urb(0, GFP_KERNEL);
+#else
+		tx_urb = usb_alloc_urb(0);
+#endif
+		if (!tx_urb) {
+			err("%s: usb_alloc_urb failed for VFD urb", __func__);
+			alloc_status = 6;
+			goto alloc_status_switch;
+		}
+	}
+
+	mutex_init(&context->lock);
+
+	strcpy(driver->name, MOD_NAME);
+	driver->minor = -1;
+	driver->code_length = 64;
+	driver->sample_rate = 0;
+	driver->features = LIRC_CAN_REC_LIRCCODE;
+	driver->data = context;
+	driver->rbuf = rbuf;
+	driver->set_use_inc = ir_open;
+	driver->set_use_dec = ir_close;
+#ifdef LIRC_HAVE_SYSFS
+	driver->dev   = &interface->dev;
+#endif
+	driver->owner = THIS_MODULE;
+
+	mutex_lock(&context->lock);
+
+	lirc_minor = lirc_register_driver(driver);
+	if (lirc_minor < 0) {
+		err("%s: lirc_register_driver failed", __func__);
+		alloc_status = 7;
+		mutex_unlock(&context->lock);
+	} else
+		printk(KERN_INFO "%s: Registered Sasem driver (minor:%d)\n",
+			__func__, lirc_minor);
+
+alloc_status_switch:
+
+	switch (alloc_status) {
+
+	case 7:
+		if (vfd_ep_found)
+			usb_free_urb(tx_urb);
+	case 6:
+		usb_free_urb(rx_urb);
+	case 5:
+		lirc_buffer_free(rbuf);
+	case 4:
+		kfree(rbuf);
+	case 3:
+		kfree(driver);
+	case 2:
+		kfree(context);
+		context = NULL;
+	case 1:
+		retval = -ENOMEM;
+		goto exit;
+	}
+
+	/* Needed while unregistering! */
+	driver->minor = lirc_minor;
+
+	context->dev = dev;
+	context->dev_present = 1;
+	context->rx_endpoint = rx_endpoint;
+	context->rx_urb = rx_urb;
+	if (vfd_ep_found) {
+		context->tx_endpoint = tx_endpoint;
+		context->tx_urb = tx_urb;
+		context->vfd_contrast = 1000;   /* range 0 - 1000 */
+	}
+	context->driver = driver;
+
+#ifdef KERNEL_2_5
+	usb_set_intfdata(interface, context);
+#else
+	minor_table [subminor] = context;
+	context->subminor = subminor;
+#endif
+
+	if (vfd_ep_found) {
+
+#ifdef KERNEL_2_5
+		if (debug)
+			printk(KERN_INFO "Registering VFD with sysfs\n");
+		if (usb_register_dev(interface, &sasem_class))
+			/* Not a fatal error, so ignore */
+			printk(KERN_INFO "%s: could not get a minor number "
+			       "for VFD\n", __func__);
+#else
+		if (debug)
+			printk(KERN_INFO "Registering VFD with devfs\n");
+		sprintf(name, DEVFS_NAME, subminor);
+		context->devfs = devfs_register(usb_devfs_handle, name,
+				 DEVFS_FL_DEFAULT,
+				 USB_MAJOR, VFD_MINOR_BASE + subminor,
+				 DEVFS_MODE, &vfd_fops, NULL);
+		if (!context->devfs)
+			/* not a fatal error so ignore */
+			printk(KERN_INFO "%s: devfs register failed for VFD\n",
+					__func__);
+#endif
+	}
+
+	printk(KERN_INFO "%s: Sasem device on usb<%d:%d> initialized\n",
+			__func__, dev->bus->busnum, dev->devnum);
+
+	mutex_unlock(&context->lock);
+exit:
+#ifdef KERNEL_2_5
+	return retval;
+#else
+	return (!retval) ? context : NULL;
+#endif
+}
+
+/**
+ * Callback function for USB core API: disonnect
+ */
+#ifdef KERNEL_2_5
+static void sasem_disconnect(struct usb_interface *interface)
+#else
+static void sasem_disconnect(struct usb_device *dev, void *data)
+#endif
+{
+	struct sasem_context *context;
+
+	/* prevent races with ir_open()/vfd_open() */
+	mutex_lock(&disconnect_lock);
+
+#ifdef KERNEL_2_5
+	context = usb_get_intfdata(interface);
+#else
+	context = (struct sasem_context *)data;
+#endif
+	mutex_lock(&context->lock);
+
+	printk(KERN_INFO "%s: Sasem device disconnected\n", __func__);
+
+#ifdef KERNEL_2_5
+	usb_set_intfdata(interface, NULL);
+#else
+	minor_table [context->subminor] = NULL;
+#endif
+	context->dev_present = 0;
+
+	/* Stop reception */
+	usb_kill_urb(context->rx_urb);
+
+	/* Abort ongoing write */
+	if (atomic_read(&context->tx.busy)) {
+
+		usb_kill_urb(context->tx_urb);
+		wait_for_completion(&context->tx.finished);
+	}
+
+	/* De-register from lirc_dev if IR port is not open */
+	if (!context->ir_isopen)
+		deregister_from_lirc(context);
+
+#ifdef KERNEL_2_5
+	usb_deregister_dev(interface, &sasem_class);
+#else
+	if (context->devfs)
+		devfs_unregister(context->devfs);
+#endif
+
+	mutex_unlock(&context->lock);
+
+	if (!context->ir_isopen && !context->vfd_isopen)
+		delete_context(context);
+
+	mutex_unlock(&disconnect_lock);
+}
+
+static int __init sasem_init(void)
+{
+	int rc;
+
+	printk(KERN_INFO MOD_DESC ", v" MOD_VERSION "\n");
+	printk(KERN_INFO MOD_AUTHOR "\n");
+
+	rc = usb_register(&sasem_driver);
+	if (rc < 0) {
+		err("%s: usb register failed (%d)", __func__, rc);
+		return -ENODEV;
+	}
+	return 0;
+}
+
+static void __exit sasem_exit(void)
+{
+	usb_deregister(&sasem_driver);
+	printk(KERN_INFO "module removed. Goodbye!\n");
+}
+
+
+module_init(sasem_init);
+module_exit(sasem_exit);
+
+#if !defined(KERNEL_2_5)
+EXPORT_NO_SYMBOLS;
+#endif
--- linux-rt-2.6.31.orig/ubuntu/lirc/lirc_sasem/Makefile
+++ linux-rt-2.6.31/ubuntu/lirc/lirc_sasem/Makefile
@@ -0,0 +1,2 @@
+EXTRA_CFLAGS =-DIRCTL_DEV_MAJOR=61 -DLIRC_SERIAL_TRANSMITTER -DLIRC_SERIAL_SOFTCARRIER -I$(src)/..
+obj-$(CONFIG_LIRC_SASEM)	+= lirc_sasem.o
--- linux-rt-2.6.31.orig/ubuntu/lirc/lirc_it87/TODO
+++ linux-rt-2.6.31/ubuntu/lirc/lirc_it87/TODO
@@ -0,0 +1,5 @@
+This is my todo-list for lirc_it87:
+
+1. enabling/using shared IRQ
+2. init/drop IRQ-usage in lirc_open/lirc_close
+
--- linux-rt-2.6.31.orig/ubuntu/lirc/lirc_it87/lirc_it87.c
+++ linux-rt-2.6.31/ubuntu/lirc/lirc_it87/lirc_it87.c
@@ -0,0 +1,1012 @@
+/*
+ * LIRC driver for ITE IT8712/IT8705/IT8720 CIR port
+ *
+ * Copyright (C) 2001 Hans-Günter Lütke Uphues <hg_lu@web.de>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
+ * USA
+ *
+ * ITE IT8705, IT8712(not tested) and IT8720 CIR-port support for lirc based
+ * via cut and paste from lirc_sir.c (C) 2000 Milan Pikula
+ *
+ * Attention: Sendmode only tested with debugging logs
+ *
+ * 2001/02/27 Christoph Bartelmus <lirc@bartelmus.de> :
+ *   reimplemented read function
+ * 2005/06/05 Andrew Calkin implemented support for Asus Digimatrix,
+ *   based on work of the following member of the Outertrack Digimatrix
+ *   Forum: Art103 <r_tay@hotmail.com>
+ */
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#include <linux/version.h>
+#include <linux/module.h>
+#include <linux/autoconf.h>
+#include <linux/sched.h>
+#include <linux/errno.h>
+#include <linux/signal.h>
+#include <linux/fs.h>
+#include <linux/interrupt.h>
+#include <linux/ioport.h>
+#include <linux/kernel.h>
+#include <linux/serial_reg.h>
+#include <linux/time.h>
+#include <linux/string.h>
+#include <linux/types.h>
+#include <linux/wait.h>
+#include <linux/mm.h>
+#include <linux/delay.h>
+#include <linux/poll.h>
+#include <asm/system.h>
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 19)
+#include <asm/io.h>
+#include <asm/irq.h>
+#include <asm/fcntl.h>
+#else
+#include <linux/io.h>
+#include <linux/irq.h>
+#include <linux/fcntl.h>
+#endif
+
+#include <linux/timer.h>
+
+#include "../lirc.h"
+#include "../lirc_dev/lirc_dev.h"
+#include "../kcompat.h"
+
+#include "lirc_it87.h"
+
+#ifdef LIRC_IT87_DIGIMATRIX
+static int digimatrix = 1;
+static int it87_freq = 36; /* kHz */
+static int irq = 9;
+#else
+static int digimatrix;
+static int it87_freq = 38; /* kHz */
+static int irq = IT87_CIR_DEFAULT_IRQ;
+#endif
+
+static unsigned long it87_bits_in_byte_out;
+static unsigned long it87_send_counter;
+static unsigned char it87_RXEN_mask = IT87_CIR_RCR_RXEN;
+
+#define RBUF_LEN 1024
+#define WBUF_LEN 1024
+
+#define LIRC_DRIVER_NAME "lirc_it87"
+
+/* timeout for sequences in jiffies (=5/100s) */
+/* must be longer than TIME_CONST */
+#define IT87_TIMEOUT	(HZ*5/100)
+
+/* module parameters */
+static int debug;
+#define dprintk(fmt, args...)					\
+	do {							\
+		if (debug)					\
+			printk(KERN_DEBUG LIRC_DRIVER_NAME ": "	\
+			       fmt, ## args);			\
+	} while (0)
+
+static int io = IT87_CIR_DEFAULT_IOBASE;
+/* receiver demodulator default: off */
+static int it87_enable_demodulator;
+
+static int timer_enabled;
+static DEFINE_SPINLOCK(timer_lock);
+static struct timer_list timerlist;
+/* time of last signal change detected */
+static struct timeval last_tv = {0, 0};
+/* time of last UART data ready interrupt */
+static struct timeval last_intr_tv = {0, 0};
+static int last_value;
+
+static DECLARE_WAIT_QUEUE_HEAD(lirc_read_queue);
+
+static DEFINE_SPINLOCK(hardware_lock);
+static DEFINE_SPINLOCK(dev_lock);
+
+static lirc_t rx_buf[RBUF_LEN];
+unsigned int rx_tail, rx_head;
+static lirc_t tx_buf[WBUF_LEN];
+
+/* SECTION: Prototypes */
+
+/* Communication with user-space */
+static int lirc_open(struct inode *inode, struct file *file);
+static int lirc_close(struct inode *inode, struct file *file);
+static unsigned int lirc_poll(struct file *file, poll_table *wait);
+static ssize_t lirc_read(struct file *file, char *buf,
+			 size_t count, loff_t *ppos);
+static ssize_t lirc_write(struct file *file, const char *buf,
+			  size_t n, loff_t *pos);
+static int lirc_ioctl(struct inode *node, struct file *filep,
+		      unsigned int cmd, unsigned long arg);
+static void add_read_queue(int flag, unsigned long val);
+static int init_chrdev(void);
+static void drop_chrdev(void);
+	/* Hardware */
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 19)
+static irqreturn_t it87_interrupt(int irq, void *dev_id,
+				  struct pt_regs *regs);
+#else
+static irqreturn_t it87_interrupt(int irq, void *dev_id);
+#endif
+static void send_space(unsigned long len);
+static void send_pulse(unsigned long len);
+static void init_send(void);
+static void terminate_send(unsigned long len);
+static int init_hardware(void);
+static void drop_hardware(void);
+/* Initialisation */
+static int init_port(void);
+static void drop_port(void);
+
+
+/* SECTION: Communication with user-space */
+
+static int lirc_open(struct inode *inode, struct file *file)
+{
+	spin_lock(&dev_lock);
+	if (MOD_IN_USE) {
+		spin_unlock(&dev_lock);
+		return -EBUSY;
+	}
+	MOD_INC_USE_COUNT;
+	spin_unlock(&dev_lock);
+	return 0;
+}
+
+
+static int lirc_close(struct inode *inode, struct file *file)
+{
+	MOD_DEC_USE_COUNT;
+	return 0;
+}
+
+
+static unsigned int lirc_poll(struct file *file, poll_table *wait)
+{
+	poll_wait(file, &lirc_read_queue, wait);
+	if (rx_head != rx_tail)
+		return POLLIN | POLLRDNORM;
+	return 0;
+}
+
+
+static ssize_t lirc_read(struct file *file, char *buf,
+			 size_t count, loff_t *ppos)
+{
+	int n = 0;
+	int retval = 0;
+
+	while (n < count) {
+		if (file->f_flags & O_NONBLOCK && rx_head == rx_tail) {
+			retval = -EAGAIN;
+			break;
+		}
+		retval = wait_event_interruptible(lirc_read_queue,
+						  rx_head != rx_tail);
+		if (retval)
+			break;
+
+		if (copy_to_user((void *) buf + n, (void *) (rx_buf + rx_head),
+				 sizeof(lirc_t))) {
+			retval = -EFAULT;
+			break;
+		}
+		rx_head = (rx_head + 1) & (RBUF_LEN - 1);
+		n += sizeof(lirc_t);
+	}
+	if (n)
+		return n;
+	return retval;
+}
+
+
+static ssize_t lirc_write(struct file *file, const char *buf,
+			  size_t n, loff_t *pos)
+{
+	int i = 0;
+
+	if (n % sizeof(lirc_t) || (n / sizeof(lirc_t)) > WBUF_LEN)
+		return -EINVAL;
+	if (copy_from_user(tx_buf, buf, n))
+		return -EFAULT;
+	n /= sizeof(lirc_t);
+	init_send();
+	while (1) {
+		if (i >= n)
+			break;
+		if (tx_buf[i])
+			send_pulse(tx_buf[i]);
+		i++;
+		if (i >= n)
+			break;
+		if (tx_buf[i])
+			send_space(tx_buf[i]);
+		i++;
+	}
+	terminate_send(tx_buf[i - 1]);
+	return n;
+}
+
+
+static int lirc_ioctl(struct inode *node, struct file *filep,
+		      unsigned int cmd, unsigned long arg)
+{
+	int retval = 0;
+	unsigned long value = 0;
+	unsigned int ivalue;
+	unsigned long hw_flags;
+
+	if (cmd == LIRC_GET_FEATURES)
+		value = LIRC_CAN_SEND_PULSE |
+			LIRC_CAN_SET_SEND_CARRIER |
+			LIRC_CAN_REC_MODE2;
+	else if (cmd == LIRC_GET_SEND_MODE)
+		value = LIRC_MODE_PULSE;
+	else if (cmd == LIRC_GET_REC_MODE)
+		value = LIRC_MODE_MODE2;
+
+	switch (cmd) {
+	case LIRC_GET_FEATURES:
+	case LIRC_GET_SEND_MODE:
+	case LIRC_GET_REC_MODE:
+		retval = put_user(value, (unsigned long *) arg);
+		break;
+
+	case LIRC_SET_SEND_MODE:
+	case LIRC_SET_REC_MODE:
+		retval = get_user(value, (unsigned long *) arg);
+		break;
+
+	case LIRC_SET_SEND_CARRIER:
+		retval = get_user(ivalue, (unsigned int *) arg);
+		if (retval)
+			return retval;
+		ivalue /= 1000;
+		if (ivalue > IT87_CIR_FREQ_MAX ||
+		    ivalue < IT87_CIR_FREQ_MIN)
+			return -EINVAL;
+
+		it87_freq = ivalue;
+
+		spin_lock_irqsave(&hardware_lock, hw_flags);
+		outb(((inb(io + IT87_CIR_TCR2) & IT87_CIR_TCR2_TXMPW) |
+		      (it87_freq - IT87_CIR_FREQ_MIN) << 3),
+		      io + IT87_CIR_TCR2);
+		spin_unlock_irqrestore(&hardware_lock, hw_flags);
+		dprintk("demodulation frequency: %d kHz\n", it87_freq);
+
+		break;
+
+	default:
+		retval = -EINVAL;
+	}
+
+	if (retval)
+		return retval;
+
+	if (cmd == LIRC_SET_REC_MODE) {
+		if (value != LIRC_MODE_MODE2)
+			retval = -ENOSYS;
+	} else if (cmd == LIRC_SET_SEND_MODE) {
+		if (value != LIRC_MODE_PULSE)
+			retval = -ENOSYS;
+	}
+	return retval;
+}
+
+static void add_read_queue(int flag, unsigned long val)
+{
+	unsigned int new_rx_tail;
+	lirc_t newval;
+
+	dprintk("add flag %d with val %lu\n", flag, val);
+
+	newval = val & PULSE_MASK;
+
+	/*
+	 * statistically, pulses are ~TIME_CONST/2 too long. we could
+	 * maybe make this more exact, but this is good enough
+	 */
+	if (flag) {
+		/* pulse */
+		if (newval > TIME_CONST / 2)
+			newval -= TIME_CONST / 2;
+		else /* should not ever happen */
+			newval = 1;
+		newval |= PULSE_BIT;
+	} else
+		newval += TIME_CONST / 2;
+	new_rx_tail = (rx_tail + 1) & (RBUF_LEN - 1);
+	if (new_rx_tail == rx_head) {
+		dprintk("Buffer overrun.\n");
+		return;
+	}
+	rx_buf[rx_tail] = newval;
+	rx_tail = new_rx_tail;
+	wake_up_interruptible(&lirc_read_queue);
+}
+
+
+static struct file_operations lirc_fops = {
+	.owner		= THIS_MODULE,
+	.read		= lirc_read,
+	.write		= lirc_write,
+	.poll		= lirc_poll,
+	.ioctl		= lirc_ioctl,
+	.open		= lirc_open,
+	.release	= lirc_close,
+};
+
+static int set_use_inc(void *data)
+{
+       return 0;
+}
+
+static void set_use_dec(void *data)
+{
+}
+
+static struct lirc_driver driver = {
+       .name		= LIRC_DRIVER_NAME,
+       .minor		= -1,
+       .code_length	= 1,
+       .sample_rate	= 0,
+       .data		= NULL,
+       .add_to_buf	= NULL,
+#ifndef LIRC_REMOVE_DURING_EXPORT
+       .get_queue	= NULL,
+#endif
+       .set_use_inc	= set_use_inc,
+       .set_use_dec	= set_use_dec,
+       .fops		= &lirc_fops,
+       .dev		= NULL,
+       .owner		= THIS_MODULE,
+};
+
+
+static int init_chrdev(void)
+{
+	driver.minor = lirc_register_driver(&driver);
+
+	if (driver.minor < 0) {
+		printk(KERN_ERR LIRC_DRIVER_NAME ": init_chrdev() failed.\n");
+		return -EIO;
+	}
+	return 0;
+}
+
+
+static void drop_chrdev(void)
+{
+	lirc_unregister_driver(driver.minor);
+}
+
+
+/* SECTION: Hardware */
+static long delta(struct timeval *tv1, struct timeval *tv2)
+{
+	unsigned long deltv;
+
+	deltv = tv2->tv_sec - tv1->tv_sec;
+	if (deltv > 15)
+		deltv = 0xFFFFFF;
+	else
+		deltv = deltv*1000000 + tv2->tv_usec - tv1->tv_usec;
+	return deltv;
+}
+
+static void it87_timeout(unsigned long data)
+{
+	unsigned long flags;
+
+	/* avoid interference with interrupt */
+	spin_lock_irqsave(&timer_lock, flags);
+
+	if (digimatrix) {
+		/* We have timed out. Disable the RX mechanism. */
+
+		outb((inb(io + IT87_CIR_RCR) & ~IT87_CIR_RCR_RXEN) |
+		     IT87_CIR_RCR_RXACT, io + IT87_CIR_RCR);
+		if (it87_RXEN_mask)
+			outb(inb(io + IT87_CIR_RCR) | IT87_CIR_RCR_RXEN,
+			     io + IT87_CIR_RCR);
+		dprintk(" TIMEOUT\n");
+		timer_enabled = 0;
+
+		/* fifo clear */
+		outb(inb(io + IT87_CIR_TCR1) | IT87_CIR_TCR1_FIFOCLR,
+		     io+IT87_CIR_TCR1);
+
+	} else {
+		/*
+		 * if last received signal was a pulse, but receiving stopped
+		 * within the 9 bit frame, we need to finish this pulse and
+		 * simulate a signal change to from pulse to space. Otherwise
+		 * upper layers will receive two sequences next time.
+		 */
+
+		if (last_value) {
+			unsigned long pulse_end;
+
+			/* determine 'virtual' pulse end: */
+			pulse_end = delta(&last_tv, &last_intr_tv);
+			dprintk("timeout add %d for %lu usec\n",
+				last_value, pulse_end);
+			add_read_queue(last_value, pulse_end);
+			last_value = 0;
+			last_tv = last_intr_tv;
+		}
+	}
+	spin_unlock_irqrestore(&timer_lock, flags);
+}
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 19)
+static irqreturn_t it87_interrupt(int irq, void *dev_id, struct pt_regs *regs)
+#else
+static irqreturn_t it87_interrupt(int irq, void *dev_id)
+#endif
+{
+	unsigned char data;
+	struct timeval curr_tv;
+	static unsigned long deltv;
+	unsigned long deltintrtv;
+	unsigned long flags, hw_flags;
+	int iir, lsr;
+	int fifo = 0;
+	static char lastbit;
+	char bit;
+
+	/* Bit duration in microseconds */
+	const unsigned long bit_duration = 1000000ul /
+		(115200 / IT87_CIR_BAUDRATE_DIVISOR);
+
+
+	iir = inb(io + IT87_CIR_IIR);
+
+	switch (iir & IT87_CIR_IIR_IID) {
+	case 0x4:
+	case 0x6:
+		lsr = inb(io + IT87_CIR_RSR) & (IT87_CIR_RSR_RXFTO |
+						IT87_CIR_RSR_RXFBC);
+		fifo = lsr & IT87_CIR_RSR_RXFBC;
+		dprintk("iir: 0x%x fifo: 0x%x\n", iir, lsr);
+
+		/* avoid interference with timer */
+		spin_lock_irqsave(&timer_lock, flags);
+		spin_lock_irqsave(&hardware_lock, hw_flags);
+		if (digimatrix) {
+			static unsigned long acc_pulse;
+			static unsigned long acc_space;
+
+			do {
+				data = inb(io + IT87_CIR_DR);
+				data = ~data;
+				fifo--;
+				if (data != 0x00) {
+					if (timer_enabled)
+						del_timer(&timerlist);
+					/*
+					 * start timer for end of
+					 * sequence detection
+					 */
+					timerlist.expires = jiffies +
+							    IT87_TIMEOUT;
+					add_timer(&timerlist);
+					timer_enabled = 1;
+				}
+				/* Loop through */
+				for (bit = 0; bit < 8; ++bit) {
+					if ((data >> bit) & 1) {
+						++acc_pulse;
+						if (lastbit == 0) {
+							add_read_queue(0,
+								acc_space *
+								 bit_duration);
+							acc_space = 0;
+						}
+					} else {
+						++acc_space;
+						if (lastbit == 1) {
+							add_read_queue(1,
+								acc_pulse *
+								 bit_duration);
+							acc_pulse = 0;
+						}
+					}
+					lastbit = (data >> bit) & 1;
+				}
+
+			} while (fifo != 0);
+		} else { /* Normal Operation */
+			do {
+				del_timer(&timerlist);
+				data = inb(io + IT87_CIR_DR);
+
+				dprintk("data=%.2x\n", data);
+				do_gettimeofday(&curr_tv);
+				deltv = delta(&last_tv, &curr_tv);
+				deltintrtv = delta(&last_intr_tv, &curr_tv);
+
+				dprintk("t %lu , d %d\n",
+					deltintrtv, (int)data);
+
+				/*
+				 * if nothing came in last 2 cycles,
+				 * it was gap
+				 */
+				if (deltintrtv > TIME_CONST * 2) {
+					if (last_value) {
+						dprintk("GAP\n");
+
+						/* simulate signal change */
+						add_read_queue(last_value,
+							       deltv -
+							       deltintrtv);
+						last_value = 0;
+						last_tv.tv_sec =
+							last_intr_tv.tv_sec;
+						last_tv.tv_usec =
+							last_intr_tv.tv_usec;
+						deltv = deltintrtv;
+					}
+				}
+				data = 1;
+				if (data ^ last_value) {
+					/*
+					 * deltintrtv > 2*TIME_CONST,
+					 * remember ? the other case is
+					 * timeout
+					 */
+					add_read_queue(last_value,
+						       deltv-TIME_CONST);
+					last_value = data;
+					last_tv = curr_tv;
+					if (last_tv.tv_usec >= TIME_CONST)
+						last_tv.tv_usec -= TIME_CONST;
+					else {
+						last_tv.tv_sec--;
+						last_tv.tv_usec += 1000000 -
+							TIME_CONST;
+					}
+				}
+				last_intr_tv = curr_tv;
+				if (data) {
+					/*
+					 * start timer for end of
+					 * sequence detection
+					 */
+					timerlist.expires =
+						jiffies + IT87_TIMEOUT;
+					add_timer(&timerlist);
+				}
+				outb((inb(io + IT87_CIR_RCR) &
+				     ~IT87_CIR_RCR_RXEN) |
+				     IT87_CIR_RCR_RXACT,
+				     io + IT87_CIR_RCR);
+				if (it87_RXEN_mask)
+					outb(inb(io + IT87_CIR_RCR) |
+					     IT87_CIR_RCR_RXEN,
+					     io + IT87_CIR_RCR);
+				fifo--;
+			} while (fifo != 0);
+		}
+		spin_unlock_irqrestore(&hardware_lock, hw_flags);
+		spin_unlock_irqrestore(&timer_lock, flags);
+
+		return IRQ_RETVAL(IRQ_HANDLED);
+
+	default:
+		/* not our irq */
+		dprintk("unknown IRQ (shouldn't happen) !!\n");
+		return IRQ_RETVAL(IRQ_NONE);
+	}
+}
+
+
+static void send_it87(unsigned long len, unsigned long stime,
+		      unsigned char send_byte, unsigned int count_bits)
+{
+	long count = len / stime;
+	long time_left = 0;
+	static unsigned char byte_out;
+	unsigned long hw_flags;
+
+	dprintk("%s: len=%ld, sb=%d\n", __func__, len, send_byte);
+
+	time_left = (long)len - (long)count * (long)stime;
+	count += ((2 * time_left) / stime);
+	while (count) {
+		long i = 0;
+		for (i = 0; i < count_bits; i++) {
+			byte_out = (byte_out << 1) | (send_byte & 1);
+			it87_bits_in_byte_out++;
+		}
+		if (it87_bits_in_byte_out == 8) {
+			dprintk("out=0x%x, tsr_txfbc: 0x%x\n",
+				byte_out,
+				inb(io + IT87_CIR_TSR) &
+				IT87_CIR_TSR_TXFBC);
+
+			while ((inb(io + IT87_CIR_TSR) &
+				IT87_CIR_TSR_TXFBC) >= IT87_CIR_FIFO_SIZE)
+				;
+
+			spin_lock_irqsave(&hardware_lock, hw_flags);
+			outb(byte_out, io + IT87_CIR_DR);
+			spin_unlock_irqrestore(&hardware_lock, hw_flags);
+
+			it87_bits_in_byte_out = 0;
+			it87_send_counter++;
+			byte_out = 0;
+		}
+		count--;
+	}
+}
+
+
+/*TODO: maybe exchange space and pulse because it8705 only modulates 0-bits */
+
+static void send_space(unsigned long len)
+{
+	send_it87(len, TIME_CONST, IT87_CIR_SPACE, IT87_CIR_BAUDRATE_DIVISOR);
+}
+
+static void send_pulse(unsigned long len)
+{
+	send_it87(len, TIME_CONST, IT87_CIR_PULSE, IT87_CIR_BAUDRATE_DIVISOR);
+}
+
+
+static void init_send()
+{
+	unsigned long flags;
+
+	spin_lock_irqsave(&hardware_lock, flags);
+	/* RXEN=0: receiver disable */
+	it87_RXEN_mask = 0;
+	outb(inb(io + IT87_CIR_RCR) & ~IT87_CIR_RCR_RXEN,
+	     io + IT87_CIR_RCR);
+	spin_unlock_irqrestore(&hardware_lock, flags);
+	it87_bits_in_byte_out = 0;
+	it87_send_counter = 0;
+}
+
+
+static void terminate_send(unsigned long len)
+{
+	unsigned long flags;
+	unsigned long last = 0;
+
+	last = it87_send_counter;
+	/* make sure all necessary data has been sent */
+	while (last == it87_send_counter)
+		send_space(len);
+	/* wait until all data sent */
+	while ((inb(io + IT87_CIR_TSR) & IT87_CIR_TSR_TXFBC) != 0)
+		;
+	/* then re-enable receiver */
+	spin_lock_irqsave(&hardware_lock, flags);
+	it87_RXEN_mask = IT87_CIR_RCR_RXEN;
+	outb(inb(io + IT87_CIR_RCR) | IT87_CIR_RCR_RXEN,
+	     io + IT87_CIR_RCR);
+	spin_unlock_irqrestore(&hardware_lock, flags);
+}
+
+
+static int init_hardware(void)
+{
+	unsigned long flags;
+	unsigned char it87_rcr = 0;
+
+	spin_lock_irqsave(&hardware_lock, flags);
+	/* init cir-port */
+	/* enable r/w-access to Baudrate-Register */
+	outb(IT87_CIR_IER_BR, io + IT87_CIR_IER);
+	outb(IT87_CIR_BAUDRATE_DIVISOR % 0x100, io+IT87_CIR_BDLR);
+	outb(IT87_CIR_BAUDRATE_DIVISOR / 0x100, io+IT87_CIR_BDHR);
+	/* Baudrate Register off, define IRQs: Input only */
+	if (digimatrix) {
+		outb(IT87_CIR_IER_IEC | IT87_CIR_IER_RFOIE, io + IT87_CIR_IER);
+		/* RX: HCFS=0, RXDCR = 001b (33,75..38,25 kHz), RXEN=1 */
+	} else {
+		outb(IT87_CIR_IER_IEC | IT87_CIR_IER_RDAIE, io + IT87_CIR_IER);
+		/* RX: HCFS=0, RXDCR = 001b (35,6..40,3 kHz), RXEN=1 */
+	}
+	it87_rcr = (IT87_CIR_RCR_RXEN & it87_RXEN_mask) | 0x1;
+	if (it87_enable_demodulator)
+		it87_rcr |= IT87_CIR_RCR_RXEND;
+	outb(it87_rcr, io + IT87_CIR_RCR);
+	if (digimatrix) {
+		/* Set FIFO depth to 1 byte, and disable TX */
+		outb(inb(io + IT87_CIR_TCR1) |  0x00,
+		     io + IT87_CIR_TCR1);
+
+		/*
+		 * TX: it87_freq (36kHz), 'reserved' sensitivity
+		 * setting (0x00)
+		 */
+		outb(((it87_freq - IT87_CIR_FREQ_MIN) << 3) | 0x00,
+		     io + IT87_CIR_TCR2);
+	} else {
+		/* TX: 38kHz, 13,3us (pulse-width) */
+		outb(((it87_freq - IT87_CIR_FREQ_MIN) << 3) | 0x06,
+		     io + IT87_CIR_TCR2);
+	}
+	spin_unlock_irqrestore(&hardware_lock, flags);
+	return 0;
+}
+
+
+static void drop_hardware(void)
+{
+	unsigned long flags;
+
+	spin_lock_irqsave(&hardware_lock, flags);
+	disable_irq(irq);
+	/* receiver disable */
+	it87_RXEN_mask = 0;
+	outb(0x1, io + IT87_CIR_RCR);
+	/* turn off irqs */
+	outb(0, io + IT87_CIR_IER);
+	/* fifo clear */
+	outb(IT87_CIR_TCR1_FIFOCLR, io+IT87_CIR_TCR1);
+	/* reset */
+	outb(IT87_CIR_IER_RESET, io+IT87_CIR_IER);
+	enable_irq(irq);
+	spin_unlock_irqrestore(&hardware_lock, flags);
+}
+
+
+static unsigned char it87_read(unsigned char port)
+{
+	outb(port, IT87_ADRPORT);
+	return inb(IT87_DATAPORT);
+}
+
+
+static void it87_write(unsigned char port, unsigned char data)
+{
+	outb(port, IT87_ADRPORT);
+	outb(data, IT87_DATAPORT);
+}
+
+
+/* SECTION: Initialisation */
+
+static int init_port(void)
+{
+	unsigned long hw_flags;
+	int retval = 0;
+
+	unsigned char init_bytes[4] = IT87_INIT;
+	unsigned char it87_chipid = 0;
+	unsigned char ldn = 0;
+	unsigned int  it87_io = 0;
+	unsigned int  it87_irq = 0;
+
+	/* Enter MB PnP Mode */
+	outb(init_bytes[0], IT87_ADRPORT);
+	outb(init_bytes[1], IT87_ADRPORT);
+	outb(init_bytes[2], IT87_ADRPORT);
+	outb(init_bytes[3], IT87_ADRPORT);
+
+	/* 8712 or 8705 ? */
+	it87_chipid = it87_read(IT87_CHIP_ID1);
+	if (it87_chipid != 0x87) {
+		retval = -ENXIO;
+		return retval;
+	}
+	it87_chipid = it87_read(IT87_CHIP_ID2);
+	if ((it87_chipid != 0x12) &&
+		(it87_chipid != 0x05) &&
+		(it87_chipid != 0x20)) {
+		printk(KERN_INFO LIRC_DRIVER_NAME
+		       ": no IT8705/12/20 found, exiting..\n");
+		retval = -ENXIO;
+		return retval;
+	}
+	printk(KERN_INFO LIRC_DRIVER_NAME
+	       ": found IT87%.2x.\n",
+	       it87_chipid);
+
+	/* get I/O-Port and IRQ */
+	if (it87_chipid == 0x12)
+		ldn = IT8712_CIR_LDN;
+	else
+		ldn = IT8705_CIR_LDN;
+	it87_write(IT87_LDN, ldn);
+
+	it87_io = it87_read(IT87_CIR_BASE_MSB) * 256 +
+		  it87_read(IT87_CIR_BASE_LSB);
+	if (it87_io == 0) {
+		if (io == 0)
+			io = IT87_CIR_DEFAULT_IOBASE;
+		printk(KERN_INFO LIRC_DRIVER_NAME
+		       ": set default io 0x%x\n",
+		       io);
+		it87_write(IT87_CIR_BASE_MSB, io / 0x100);
+		it87_write(IT87_CIR_BASE_LSB, io % 0x100);
+	} else
+		io = it87_io;
+
+	it87_irq = it87_read(IT87_CIR_IRQ);
+	if (digimatrix || it87_irq == 0) {
+		if (irq == 0)
+			irq = IT87_CIR_DEFAULT_IRQ;
+		printk(KERN_INFO LIRC_DRIVER_NAME
+		       ": set default irq 0x%x\n",
+		       irq);
+		it87_write(IT87_CIR_IRQ, irq);
+	} else
+		irq = it87_irq;
+
+	spin_lock_irqsave(&hardware_lock, hw_flags);
+	/* reset */
+	outb(IT87_CIR_IER_RESET, io+IT87_CIR_IER);
+	/* fifo clear */
+	outb(IT87_CIR_TCR1_FIFOCLR |
+	     /*	     IT87_CIR_TCR1_ILE | */
+	     IT87_CIR_TCR1_TXRLE |
+	     IT87_CIR_TCR1_TXENDF, io+IT87_CIR_TCR1);
+	spin_unlock_irqrestore(&hardware_lock, hw_flags);
+
+	/* get I/O port access and IRQ line */
+	if (request_region(io, 8, LIRC_DRIVER_NAME) == NULL) {
+		printk(KERN_ERR LIRC_DRIVER_NAME
+		       ": i/o port 0x%.4x already in use.\n", io);
+		/* Leaving MB PnP Mode */
+		it87_write(IT87_CFGCTRL, 0x2);
+		return -EBUSY;
+	}
+
+	/* activate CIR-Device */
+	it87_write(IT87_CIR_ACT, 0x1);
+
+	/* Leaving MB PnP Mode */
+	it87_write(IT87_CFGCTRL, 0x2);
+
+	retval = request_irq(irq, it87_interrupt, 0 /*IRQF_DISABLED*/,
+			     LIRC_DRIVER_NAME, NULL);
+	if (retval < 0) {
+		printk(KERN_ERR LIRC_DRIVER_NAME
+		       ": IRQ %d already in use.\n",
+		       irq);
+		release_region(io, 8);
+		return retval;
+	}
+
+	printk(KERN_INFO LIRC_DRIVER_NAME
+	       ": I/O port 0x%.4x, IRQ %d.\n", io, irq);
+
+	init_timer(&timerlist);
+	timerlist.function = it87_timeout;
+	timerlist.data = 0xabadcafe;
+
+	return 0;
+}
+
+
+static void drop_port(void)
+{
+#if 0
+	unsigned char init_bytes[4] = IT87_INIT;
+
+	/* Enter MB PnP Mode */
+	outb(init_bytes[0], IT87_ADRPORT);
+	outb(init_bytes[1], IT87_ADRPORT);
+	outb(init_bytes[2], IT87_ADRPORT);
+	outb(init_bytes[3], IT87_ADRPORT);
+
+	/* deactivate CIR-Device */
+	it87_write(IT87_CIR_ACT, 0x0);
+
+	/* Leaving MB PnP Mode */
+	it87_write(IT87_CFGCTRL, 0x2);
+#endif
+
+	del_timer_sync(&timerlist);
+	free_irq(irq, NULL);
+	release_region(io, 8);
+}
+
+
+static int init_lirc_it87(void)
+{
+	int retval;
+
+	init_waitqueue_head(&lirc_read_queue);
+	retval = init_port();
+	if (retval < 0)
+		return retval;
+	init_hardware();
+	printk(KERN_INFO LIRC_DRIVER_NAME ": Installed.\n");
+	return 0;
+}
+
+
+static int __init lirc_it87_init(void)
+{
+	int retval;
+
+	retval = init_chrdev();
+	if (retval < 0)
+		return retval;
+	retval = init_lirc_it87();
+	if (retval) {
+		drop_chrdev();
+		return retval;
+	}
+	return 0;
+}
+
+
+static void __exit lirc_it87_exit(void)
+{
+	drop_hardware();
+	drop_chrdev();
+	drop_port();
+	printk(KERN_INFO LIRC_DRIVER_NAME ": Uninstalled.\n");
+}
+
+module_init(lirc_it87_init);
+module_exit(lirc_it87_exit);
+
+MODULE_DESCRIPTION("LIRC driver for ITE IT8712/IT8705 CIR port");
+MODULE_AUTHOR("Hans-Günter Lütke Uphues");
+MODULE_LICENSE("GPL");
+
+module_param(io, int, S_IRUGO);
+MODULE_PARM_DESC(io, "I/O base address (default: 0x310)");
+
+module_param(irq, int, S_IRUGO);
+#ifdef LIRC_IT87_DIGIMATRIX
+MODULE_PARM_DESC(irq, "Interrupt (1,3-12) (default: 9)");
+#else
+MODULE_PARM_DESC(irq, "Interrupt (1,3-12) (default: 7)");
+#endif
+
+module_param(it87_enable_demodulator, bool, S_IRUGO);
+MODULE_PARM_DESC(it87_enable_demodulator,
+		 "Receiver demodulator enable/disable (1/0), default: 0");
+
+module_param(debug, bool, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(debug, "Enable debugging messages");
+
+module_param(digimatrix, bool, S_IRUGO | S_IWUSR);
+#ifdef LIRC_IT87_DIGIMATRIX
+MODULE_PARM_DESC(digimatrix,
+	"Asus Digimatrix it87 compat. enable/disable (1/0), default: 1");
+#else
+MODULE_PARM_DESC(digimatrix,
+	"Asus Digimatrix it87 compat. enable/disable (1/0), default: 0");
+#endif
+
+
+module_param(it87_freq, int, S_IRUGO);
+#ifdef LIRC_IT87_DIGIMATRIX
+MODULE_PARM_DESC(it87_freq,
+    "Carrier demodulator frequency (kHz), (default: 36)");
+#else
+MODULE_PARM_DESC(it87_freq,
+    "Carrier demodulator frequency (kHz), (default: 38)");
+#endif
+EXPORT_NO_SYMBOLS;
--- linux-rt-2.6.31.orig/ubuntu/lirc/lirc_it87/Makefile
+++ linux-rt-2.6.31/ubuntu/lirc/lirc_it87/Makefile
@@ -0,0 +1,3 @@
+EXTRA_CFLAGS =-DIRCTL_DEV_MAJOR=61 -DLIRC_SERIAL_TRANSMITTER -DLIRC_SERIAL_SOFTCARRIER -I$(src)/..
+
+obj-$(CONFIG_LIRC_IT87)		+= lirc_it87.o
--- linux-rt-2.6.31.orig/ubuntu/lirc/lirc_it87/README
+++ linux-rt-2.6.31/ubuntu/lirc/lirc_it87/README
@@ -0,0 +1,46 @@
+This is the README using the ITE IT8705 and IT8712 CIR port for LIRC.
+
+The IT8705 for example can be found on the ECS K7S5A.
+
+The driver supports receiving (MODE2) and sending (PULSE). It seems
+sending 'LIRC_CAN_SEND_PULSE' isn't optimal for this type of hardware.
+But because I don't know how to implement 'LIRC_CAN_SEND_CODE', I did
+it this way.
+
+Attention:
+Because of missing hardware, the following hasn't been tested:
+a) receiving with demodulator enabled,
+b) sending (debugging output looks good) and
+c) using IT8712
+
+Any help and/or additions etc. is welcome.
+
+lirc_it87 knows about the following module-parameters:
+MODULE_DESCRIPTION("LIRC driver for ITE IT8712/IT8705 CIR port");
+MODULE_PARM(io, "i");
+MODULE_PARM_DESC(io, "I/O base address (default: 0x310)");
+MODULE_PARM(irq, "i");
+MODULE_PARM_DESC(irq, "Interrupt (1,3-12) (default: 7)");
+MODULE_PARM(it87_enable_demodulator, "i");
+MODULE_PARM_DESC(it87_enable_demodulator, "Receiver demodulator
+	enable/disable (1/0), default: 0");
+
+
+Usage:
+
+a) io and irq:
+
+If the driver finds the IT8705/12-CIR port initialized, io and irq of
+the preinitialized hardware is used by the driver. If both values are
+read 0x0 from the hardware, the default or given value is used.
+Note: I experienced using irq=3. The driver initialized without any
+problems, but no irqs are recognized by the system. I had to switch
+back to default, irq 7.
+      
+b) it87_enable_demodulator:
+
+The demodulator for the receiver can be switched off (default within
+the driver). If you need the demodulator simple enable it by the
+following way: it87_enable_demodulator=1.
+
+Hans-Günter Lütke Uphues
--- linux-rt-2.6.31.orig/ubuntu/lirc/lirc_it87/lirc_it87.h
+++ linux-rt-2.6.31/ubuntu/lirc/lirc_it87/lirc_it87.h
@@ -0,0 +1,116 @@
+/* lirc_it87.h */
+/* SECTION: Definitions */
+
+/********************************* ITE IT87xx ************************/
+
+/* based on the following documentation from ITE:
+   a) IT8712F Preliminary CIR Programming Guide V0.1
+   b) IT8705F Simple LPC I/O Preliminary Specification V0.3
+   c) IT8712F EC-LPC I/O Preliminary Specification V0.5
+*/
+
+/* IT8712/05 Ports: */
+#define IT87_ADRPORT      0x2e
+#define IT87_DATAPORT     0x2f
+#define IT87_INIT         {0x87, 0x01, 0x55, 0x55}
+
+/* alternate Ports: */
+/*
+#define IT87_ADRPORT      0x4e
+#define IT87_DATAPORT     0x4f
+#define IT87_INIT         {0x87, 0x01, 0x55, 0xaa}
+ */
+
+/* IT8712/05 Registers */
+#define IT87_CFGCTRL      0x2
+#define IT87_LDN          0x7
+#define IT87_CHIP_ID1     0x20
+#define IT87_CHIP_ID2     0x21
+#define IT87_CFG_VERSION  0x22
+#define IT87_SWSUSPEND    0x23
+
+#define IT8712_CIR_LDN    0xa
+#define IT8705_CIR_LDN    0x7
+
+/* CIR Configuration Registers: */
+#define IT87_CIR_ACT      0x30
+#define IT87_CIR_BASE_MSB 0x60
+#define IT87_CIR_BASE_LSB 0x61
+#define IT87_CIR_IRQ      0x70
+#define IT87_CIR_CONFIG   0xf0
+
+/* List of IT87_CIR registers: offset to BaseAddr */
+#define IT87_CIR_DR   0
+#define IT87_CIR_IER  1
+#define IT87_CIR_RCR  2
+#define IT87_CIR_TCR1 3
+#define IT87_CIR_TCR2 4
+#define IT87_CIR_TSR  5
+#define IT87_CIR_RSR  6
+#define IT87_CIR_BDLR 5
+#define IT87_CIR_BDHR 6
+#define IT87_CIR_IIR  7
+
+/* Bit Definition */
+/* IER: */
+#define IT87_CIR_IER_TM_EN   0x80
+#define IT87_CIR_IER_RESEVED 0x40
+#define IT87_CIR_IER_RESET   0x20
+#define IT87_CIR_IER_BR      0x10
+#define IT87_CIR_IER_IEC     0x8
+#define IT87_CIR_IER_RFOIE   0x4
+#define IT87_CIR_IER_RDAIE   0x2
+#define IT87_CIR_IER_TLDLIE  0x1
+
+/* RCR: */
+#define IT87_CIR_RCR_RDWOS  0x80
+#define IT87_CIR_RCR_HCFS   0x40
+#define IT87_CIR_RCR_RXEN   0x20
+#define IT87_CIR_RCR_RXEND  0x10
+#define IT87_CIR_RCR_RXACT  0x8
+#define IT87_CIR_RCR_RXDCR  0x7
+
+/* TCR1: */
+#define IT87_CIR_TCR1_FIFOCLR 0x80
+#define IT87_CIR_TCR1_ILE     0x40
+#define IT87_CIR_TCR1_FIFOTL  0x30
+#define IT87_CIR_TCR1_TXRLE   0x8
+#define IT87_CIR_TCR1_TXENDF  0x4
+#define IT87_CIR_TCR1_TXMPM   0x3
+
+/* TCR2: */
+#define IT87_CIR_TCR2_CFQ   0xf8
+#define IT87_CIR_TCR2_TXMPW 0x7
+
+/* TSR: */
+#define IT87_CIR_TSR_RESERVED 0xc0
+#define IT87_CIR_TSR_TXFBC    0x3f
+
+/* RSR: */
+#define IT87_CIR_RSR_RXFTO    0x80
+#define IT87_CIR_RSR_RESERVED 0x40
+#define IT87_CIR_RSR_RXFBC    0x3f
+
+/* IIR: */
+#define IT87_CIR_IIR_RESERVED 0xf8
+#define IT87_CIR_IIR_IID      0x6
+#define IT87_CIR_IIR_IIP      0x1
+
+/* TM: */
+#define IT87_CIR_TM_IL_SEL    0x80
+#define IT87_CIR_TM_RESERVED  0x40
+#define IT87_CIR_TM_TM_REG    0x3f
+
+#define IT87_CIR_FIFO_SIZE 32
+
+/* Baudratedivisor for IT87: power of 2: only 1,2,4 or 8) */
+#define IT87_CIR_BAUDRATE_DIVISOR 0x1
+#define IT87_CIR_DEFAULT_IOBASE 0x310
+#define IT87_CIR_DEFAULT_IRQ    0x7
+#define IT87_CIR_SPACE 0x00
+#define IT87_CIR_PULSE 0xff
+#define IT87_CIR_FREQ_MIN 27
+#define IT87_CIR_FREQ_MAX 58
+#define TIME_CONST (IT87_CIR_BAUDRATE_DIVISOR * 8000000ul / 115200ul)
+
+/********************************* ITE IT87xx ************************/
--- linux-rt-2.6.31.orig/ubuntu/lirc/lirc_mceusb/Makefile
+++ linux-rt-2.6.31/ubuntu/lirc/lirc_mceusb/Makefile
@@ -0,0 +1,3 @@
+EXTRA_CFLAGS =-DIRCTL_DEV_MAJOR=61 -DLIRC_SERIAL_TRANSMITTER -DLIRC_SERIAL_SOFTCARRIER -I$(src)/..
+
+obj-$(CONFIG_LIRC_MCEUSB)	+= lirc_mceusb.o
--- linux-rt-2.6.31.orig/ubuntu/lirc/lirc_mceusb/lirc_mceusb.c
+++ linux-rt-2.6.31/ubuntu/lirc/lirc_mceusb/lirc_mceusb.c
@@ -0,0 +1,1289 @@
+/*
+ * LIRC driver for Windows Media Center Edition USB Infrared Transceivers
+ *
+ * (C) by Martin A. Blatter <martin_a_blatter@yahoo.com>
+ *
+ * Transmitter support and reception code cleanup.
+ * (C) by Daniel Melander <lirc@rajidae.se>
+ *
+ * Original lirc_mceusb driver for 1st-gen device:
+ * Copyright (c) 2003-2004 Dan Conti <dconti@acm.wwu.edu>
+ *
+ * Original lirc_mceusb driver deprecated in favor of this driver, which
+ * supports the 1st-gen device now too. Transmitting on the 1st-gen device
+ * only functions on port #2 at the moment.
+ *
+ * Support for 1st-gen device added June 2009,
+ * by Jarod Wilson <jarod@wilsonet.com>
+ *
+ * Initial transmission support for 1st-gen device added August 2009,
+ * by Patrick Calhoun <phineas@ou.edu>
+ *
+ * Derived from ATI USB driver by Paul Miller and the original
+ * MCE USB driver by Dan Conti ((and now including chunks of the latter
+ * relevant to the 1st-gen device initialization)
+ *
+ * This driver will only work reliably with kernel version 2.6.10
+ * or higher, probably because of differences in USB device enumeration
+ * in the kernel code. Device initialization fails most of the time
+ * with earlier kernel versions.
+ *
+ **********************************************************************
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ *
+ */
+
+#include <linux/version.h>
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 5)
+#error "*******************************************************"
+#error "Sorry, this driver needs kernel version 2.6.5 or higher"
+#error "*******************************************************"
+#endif
+#include <linux/autoconf.h>
+#include <linux/kernel.h>
+#include <linux/errno.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/kmod.h>
+#include <linux/smp_lock.h>
+#include <linux/completion.h>
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 18)
+#include <asm/uaccess.h>
+#else
+#include <linux/uaccess.h>
+#endif
+#include <linux/usb.h>
+#include <linux/wait.h>
+#include <linux/time.h>
+
+#include "../lirc.h"
+#include "../kcompat.h"
+#include "../lirc_dev/lirc_dev.h"
+
+#define DRIVER_VERSION	"1.90"
+#define DRIVER_AUTHOR	"Daniel Melander <lirc@rajidae.se>, " \
+			"Martin Blatter <martin_a_blatter@yahoo.com>, " \
+			"Dan Conti <dconti@acm.wwu.edu>"
+#define DRIVER_DESC	"Windows Media Center Edition USB IR Transceiver " \
+			"driver for LIRC"
+#define DRIVER_NAME	"lirc_mceusb"
+
+#define USB_BUFLEN	32	/* USB reception buffer length */
+#define LIRCBUF_SIZE	256	/* LIRC work buffer length */
+
+/* MCE constants */
+#define MCE_CMDBUF_SIZE	384 /* MCE Command buffer length */
+#define MCE_TIME_UNIT	50 /* Approx 50us resolution */
+#define MCE_CODE_LENGTH	5 /* Normal length of packet (with header) */
+#define MCE_PACKET_SIZE	4 /* Normal length of packet (without header) */
+#define MCE_PACKET_HEADER 0x84 /* Actual header format is 0x80 + num_bytes */
+#define MCE_CONTROL_HEADER 0x9F /* MCE status header */
+#define MCE_TX_HEADER_LENGTH 3 /* # of bytes in the initializing tx header */
+#define MCE_MAX_CHANNELS 2 /* Two transmitters, hardware dependent? */
+#define MCE_DEFAULT_TX_MASK 0x03 /* Val opts: TX1=0x01, TX2=0x02, ALL=0x03 */
+#define MCE_PULSE_BIT	0x80 /* Pulse bit, MSB set == PULSE else SPACE */
+#define MCE_PULSE_MASK	0x7F /* Pulse mask */
+#define MCE_MAX_PULSE_LENGTH 0x7F /* Longest transmittable pulse symbol */
+#define MCE_PACKET_LENGTH_MASK  0x7F /* Pulse mask */
+
+
+/* module parameters */
+#ifdef CONFIG_USB_DEBUG
+static int debug = 1;
+#else
+static int debug;
+#endif
+#define dprintk(fmt, args...)					\
+	do {							\
+		if (debug)					\
+			printk(KERN_DEBUG fmt, ## args);	\
+	} while (0)
+
+/* general constants */
+#define SEND_FLAG_IN_PROGRESS	1
+#define SEND_FLAG_COMPLETE	2
+#define RECV_FLAG_IN_PROGRESS	3
+#define RECV_FLAG_COMPLETE	4
+
+#define MCEUSB_INBOUND		1
+#define MCEUSB_OUTBOUND		2
+
+#define VENDOR_PHILIPS		0x0471
+#define VENDOR_SMK		0x0609
+#define VENDOR_TATUNG		0x1460
+#define VENDOR_GATEWAY		0x107b
+#define VENDOR_SHUTTLE		0x1308
+#define VENDOR_SHUTTLE2		0x051c
+#define VENDOR_MITSUMI		0x03ee
+#define VENDOR_TOPSEED		0x1784
+#define VENDOR_RICAVISION	0x179d
+#define VENDOR_ITRON		0x195d
+#define VENDOR_FIC		0x1509
+#define VENDOR_LG		0x043e
+#define VENDOR_MICROSOFT	0x045e
+#define VENDOR_FORMOSA		0x147a
+#define VENDOR_FINTEK		0x1934
+#define VENDOR_PINNACLE		0x2304
+#define VENDOR_ECS		0x1019
+#define VENDOR_WISTRON		0x0fb8
+#define VENDOR_COMPRO		0x185b
+#define VENDOR_NORTHSTAR	0x04eb
+
+static struct usb_device_id mceusb_dev_table[] = {
+	/* Original Microsoft MCE IR Transceiver (often HP-branded) */
+	{ USB_DEVICE(VENDOR_MICROSOFT, 0x006d) },
+	/* Philips Infrared Transceiver - Sahara branded */
+	{ USB_DEVICE(VENDOR_PHILIPS, 0x0608) },
+	/* Philips Infrared Transceiver - HP branded */
+	{ USB_DEVICE(VENDOR_PHILIPS, 0x060c) },
+	/* Philips SRM5100 */
+	{ USB_DEVICE(VENDOR_PHILIPS, 0x060d) },
+	/* Philips Infrared Transceiver - Omaura */
+	{ USB_DEVICE(VENDOR_PHILIPS, 0x060f) },
+	/* Philips Infrared Transceiver - Spinel plus */
+	{ USB_DEVICE(VENDOR_PHILIPS, 0x0613) },
+	/* Philips eHome Infrared Transceiver */
+	{ USB_DEVICE(VENDOR_PHILIPS, 0x0815) },
+	/* SMK/Toshiba G83C0004D410 */
+	{ USB_DEVICE(VENDOR_SMK, 0x031d) },
+	/* SMK eHome Infrared Transceiver (Sony VAIO) */
+	{ USB_DEVICE(VENDOR_SMK, 0x0322) },
+	/* bundled with Hauppauge PVR-150 */
+	{ USB_DEVICE(VENDOR_SMK, 0x0334) },
+	/* Tatung eHome Infrared Transceiver */
+	{ USB_DEVICE(VENDOR_TATUNG, 0x9150) },
+	/* Shuttle eHome Infrared Transceiver */
+	{ USB_DEVICE(VENDOR_SHUTTLE, 0xc001) },
+	/* Shuttle eHome Infrared Transceiver */
+	{ USB_DEVICE(VENDOR_SHUTTLE2, 0xc001) },
+	/* Gateway eHome Infrared Transceiver */
+	{ USB_DEVICE(VENDOR_GATEWAY, 0x3009) },
+	/* Mitsumi */
+	{ USB_DEVICE(VENDOR_MITSUMI, 0x2501) },
+	/* Topseed eHome Infrared Transceiver */
+	{ USB_DEVICE(VENDOR_TOPSEED, 0x0001) },
+	/* Topseed HP eHome Infrared Transceiver */
+	{ USB_DEVICE(VENDOR_TOPSEED, 0x0006) },
+	/* Topseed eHome Infrared Transceiver */
+	{ USB_DEVICE(VENDOR_TOPSEED, 0x0007) },
+	/* Topseed eHome Infrared Transceiver */
+	{ USB_DEVICE(VENDOR_TOPSEED, 0x0008) },
+	/* Topseed eHome Infrared Transceiver */
+	{ USB_DEVICE(VENDOR_TOPSEED, 0x000a) },
+	/* Ricavision internal Infrared Transceiver */
+	{ USB_DEVICE(VENDOR_RICAVISION, 0x0010) },
+	/* Itron ione Libra Q-11 */
+	{ USB_DEVICE(VENDOR_ITRON, 0x7002) },
+	/* FIC eHome Infrared Transceiver */
+	{ USB_DEVICE(VENDOR_FIC, 0x9242) },
+	/* LG eHome Infrared Transceiver */
+	{ USB_DEVICE(VENDOR_LG, 0x9803) },
+	/* Microsoft MCE Infrared Transceiver */
+	{ USB_DEVICE(VENDOR_MICROSOFT, 0x00a0) },
+	/* Formosa eHome Infrared Transceiver */
+	{ USB_DEVICE(VENDOR_FORMOSA, 0xe015) },
+	/* Formosa21 / eHome Infrared Receiver */
+	{ USB_DEVICE(VENDOR_FORMOSA, 0xe016) },
+	/* Formosa aim / Trust MCE Infrared Receiver */
+	{ USB_DEVICE(VENDOR_FORMOSA, 0xe017) },
+	/* Formosa Industrial Computing / Beanbag Emulation Device */
+	{ USB_DEVICE(VENDOR_FORMOSA, 0xe018) },
+	/* Formosa21 / eHome Infrared Receiver */
+	{ USB_DEVICE(VENDOR_FORMOSA, 0xe03a) },
+	/* Formosa Industrial Computing AIM IR605/A */
+	{ USB_DEVICE(VENDOR_FORMOSA, 0xe03c) },
+	/* Fintek eHome Infrared Transceiver */
+	{ USB_DEVICE(VENDOR_FINTEK, 0x0602) },
+	/* Fintek eHome Infrared Transceiver (in the AOpen MP45) */
+	{ USB_DEVICE(VENDOR_FINTEK, 0x0702) },
+	/* Pinnacle Remote Kit */
+	{ USB_DEVICE(VENDOR_PINNACLE, 0x0225) },
+	/* Elitegroup Computer Systems IR */
+	{ USB_DEVICE(VENDOR_ECS, 0x0f38) },
+	/* Wistron Corp. eHome Infrared Receiver */
+	{ USB_DEVICE(VENDOR_WISTRON, 0x0002) },
+	/* Compro K100 */
+	{ USB_DEVICE(VENDOR_COMPRO, 0x3020) },
+	/* Compro K100 v2 */
+	{ USB_DEVICE(VENDOR_COMPRO, 0x3082) },
+	/* Northstar Systems eHome Infrared Transceiver */
+	{ USB_DEVICE(VENDOR_NORTHSTAR, 0xe004) },
+	/* Terminating entry */
+	{ }
+};
+
+static struct usb_device_id pinnacle_list[] = {
+	{ USB_DEVICE(VENDOR_PINNACLE, 0x0225) },
+	{}
+};
+
+static struct usb_device_id microsoft_gen1_list[] = {
+	{ USB_DEVICE(VENDOR_MICROSOFT, 0x006d) },
+	{}
+};
+
+static struct usb_device_id transmitter_mask_list[] = {
+	{ USB_DEVICE(VENDOR_SMK, 0x031d) },
+	{ USB_DEVICE(VENDOR_SMK, 0x0322) },
+	{ USB_DEVICE(VENDOR_SMK, 0x0334) },
+	{ USB_DEVICE(VENDOR_TOPSEED, 0x0001) },
+	{ USB_DEVICE(VENDOR_TOPSEED, 0x0006) },
+	{ USB_DEVICE(VENDOR_TOPSEED, 0x0007) },
+	{ USB_DEVICE(VENDOR_TOPSEED, 0x0008) },
+	{ USB_DEVICE(VENDOR_TOPSEED, 0x000a) },
+	{ USB_DEVICE(VENDOR_PINNACLE, 0x0225) },
+	{}
+};
+
+/* data structure for each usb transceiver */
+struct mceusb_dev {
+
+	/* usb */
+	struct usb_device *usbdev;
+	struct urb *urb_in;
+	int devnum;
+	struct usb_endpoint_descriptor *usb_ep_in;
+	struct usb_endpoint_descriptor *usb_ep_out;
+
+	/* buffers and dma */
+	unsigned char *buf_in;
+	unsigned int len_in;
+	dma_addr_t dma_in;
+	dma_addr_t dma_out;
+	unsigned int overflow_len;
+
+	/* lirc */
+	struct lirc_driver *d;
+	lirc_t lircdata;
+	unsigned char is_pulse;
+	struct {
+		u32 connected:1;
+		u32 pinnacle:1;
+		u32 transmitter_mask_inverted:1;
+		u32 microsoft_gen1:1;
+		u32 reserved:28;
+	} flags;
+
+	unsigned char transmitter_mask;
+	unsigned int carrier_freq;
+
+	/* handle sending (init strings) */
+	int send_flags;
+	wait_queue_head_t wait_out;
+
+	struct mutex lock;
+};
+
+/* init strings */
+static char init1[] = {0x00, 0xff, 0xaa, 0xff, 0x0b};
+static char init2[] = {0xff, 0x18};
+
+static char pin_init1[] = { 0x9f, 0x07};
+static char pin_init2[] = { 0x9f, 0x13};
+static char pin_init3[] = { 0x9f, 0x0d};
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 11)
+static unsigned long usecs_to_jiffies(const unsigned int u)
+{
+	if (u > jiffies_to_usecs(MAX_JIFFY_OFFSET))
+		return MAX_JIFFY_OFFSET;
+#if HZ <= USEC_PER_SEC && !(USEC_PER_SEC % HZ)
+	return (u + (USEC_PER_SEC / HZ) - 1) / (USEC_PER_SEC / HZ);
+#elif HZ > USEC_PER_SEC && !(HZ % USEC_PER_SEC)
+	return u * (HZ / USEC_PER_SEC);
+#else
+	return (u * HZ + USEC_PER_SEC - 1) / USEC_PER_SEC;
+#endif
+}
+#endif
+static void mceusb_dev_printdata(struct mceusb_dev *ir, char *buf, int len)
+{
+	char codes[USB_BUFLEN * 3 + 1];
+	int i;
+
+	if (len <= 0)
+		return;
+
+	if (ir->flags.microsoft_gen1 && len <= 2)
+		return;
+
+	for (i = 0; i < len && i < USB_BUFLEN; i++)
+		snprintf(codes + i * 3, 4, "%02x ", buf[i] & 0xFF);
+
+	printk(KERN_INFO "" DRIVER_NAME "[%d]: data received %s (length=%d)\n",
+		ir->devnum, codes, len);
+}
+
+static void usb_async_callback(struct urb *urb, struct pt_regs *regs)
+{
+	struct mceusb_dev *ir;
+	int len;
+
+	if (!urb)
+		return;
+
+	ir = urb->context;
+	if (ir) {
+		len = urb->actual_length;
+
+		dprintk(DRIVER_NAME
+			"[%d]: callback called (status=%d len=%d)\n",
+			ir->devnum, urb->status, len);
+
+		if (debug)
+			mceusb_dev_printdata(ir, urb->transfer_buffer, len);
+	}
+
+}
+
+/* request incoming or send outgoing usb packet - used to initialize remote */
+static void request_packet_async(struct mceusb_dev *ir,
+				 struct usb_endpoint_descriptor *ep,
+				 unsigned char *data, int size, int urb_type)
+{
+	int res;
+	struct urb *async_urb;
+	unsigned char *async_buf;
+
+	if (urb_type) {
+		async_urb = usb_alloc_urb(0, GFP_KERNEL);
+		if (unlikely(!async_urb))
+			return;
+
+		async_buf = kmalloc(size, GFP_KERNEL);
+		if (!async_buf) {
+			usb_free_urb(async_urb);
+			return;
+		}
+
+		if (urb_type == MCEUSB_OUTBOUND) {
+			/* outbound data */
+			usb_fill_int_urb(async_urb, ir->usbdev,
+				usb_sndintpipe(ir->usbdev,
+					ep->bEndpointAddress),
+				async_buf, size,
+				(usb_complete_t) usb_async_callback,
+				ir, ep->bInterval);
+			memcpy(async_buf, data, size);
+		} else {
+			/* inbound data */
+			usb_fill_int_urb(async_urb, ir->usbdev,
+				usb_rcvintpipe(ir->usbdev,
+					ep->bEndpointAddress),
+				async_buf, size,
+				(usb_complete_t) usb_async_callback,
+				ir, ep->bInterval);
+		}
+		async_urb->transfer_flags = URB_ASYNC_UNLINK;
+	} else {
+		/* standard request */
+		async_urb = ir->urb_in;
+		ir->send_flags = RECV_FLAG_IN_PROGRESS;
+	}
+
+	dprintk(DRIVER_NAME "[%d]: receive request called (size=%#x)\n",
+		ir->devnum, size);
+
+	async_urb->transfer_buffer_length = size;
+	async_urb->dev = ir->usbdev;
+
+	res = usb_submit_urb(async_urb, GFP_ATOMIC);
+	if (res) {
+		dprintk(DRIVER_NAME "[%d]: receive request FAILED! (res=%d)\n",
+			ir->devnum, res);
+		return;
+	}
+	dprintk(DRIVER_NAME "[%d]: receive request complete (res=%d)\n",
+		ir->devnum, res);
+}
+
+static int unregister_from_lirc(struct mceusb_dev *ir)
+{
+	struct lirc_driver *d = ir->d;
+	int devnum;
+	int rtn;
+
+	devnum = ir->devnum;
+	dprintk(DRIVER_NAME "[%d]: unregister from lirc called\n", devnum);
+
+	rtn = lirc_unregister_driver(d->minor);
+	if (rtn > 0) {
+		printk(DRIVER_NAME "[%d]: error in lirc_unregister minor: %d\n"
+			"Trying again...\n", devnum, d->minor);
+		if (rtn == -EBUSY) {
+			printk(DRIVER_NAME
+				"[%d]: device is opened, will unregister"
+				" on close\n", devnum);
+			return -EAGAIN;
+		}
+		set_current_state(TASK_INTERRUPTIBLE);
+		schedule_timeout(HZ);
+
+		rtn = lirc_unregister_driver(d->minor);
+		if (rtn > 0)
+			printk(DRIVER_NAME "[%d]: lirc_unregister failed\n",
+			devnum);
+	}
+
+	if (rtn) {
+		printk(DRIVER_NAME "[%d]: didn't free resources\n", devnum);
+		return -EAGAIN;
+	}
+
+	printk(DRIVER_NAME "[%d]: usb remote disconnected\n", devnum);
+
+	lirc_buffer_free(d->rbuf);
+	kfree(d->rbuf);
+	kfree(d);
+	kfree(ir);
+	return 0;
+}
+
+static int mceusb_ir_open(void *data)
+{
+	struct mceusb_dev *ir = data;
+
+	if (!ir) {
+		printk(DRIVER_NAME "[?]: %s called with no context\n",
+		       __func__);
+		return -EIO;
+	}
+	dprintk(DRIVER_NAME "[%d]: mceusb IR device opened\n", ir->devnum);
+
+	MOD_INC_USE_COUNT;
+	if (!ir->flags.connected) {
+		if (!ir->usbdev)
+			return -ENOENT;
+		ir->flags.connected = 1;
+	}
+
+	return 0;
+}
+
+static void mceusb_ir_close(void *data)
+{
+	struct mceusb_dev *ir = data;
+
+	if (!ir) {
+		printk(DRIVER_NAME "[?]: %s called with no context\n",
+		       __func__);
+		return;
+	}
+	dprintk(DRIVER_NAME "[%d]: mceusb IR device closed\n", ir->devnum);
+
+	if (ir->flags.connected) {
+		mutex_lock(&ir->lock);
+		ir->flags.connected = 0;
+		mutex_unlock(&ir->lock);
+	}
+	MOD_DEC_USE_COUNT;
+}
+
+static void send_packet_to_lirc(struct mceusb_dev *ir)
+{
+	if (ir->lircdata) {
+		lirc_buffer_write(ir->d->rbuf,
+				  (unsigned char *) &ir->lircdata);
+		wake_up(&ir->d->rbuf->wait_poll);
+		ir->lircdata = 0;
+	}
+}
+
+static void mceusb_process_ir_data(struct mceusb_dev *ir, int buf_len)
+{
+	int i, j;
+	int packet_len = 0;
+	int start_index = 0;
+
+	/* skip meaningless 0xb1 0x60 header bytes on orig receiver */
+	if (ir->flags.microsoft_gen1)
+		start_index = 2;
+
+	/* this should only trigger w/the 1st-gen mce receiver */
+	for (i = start_index; i < (start_index + ir->overflow_len) &&
+	     i < buf_len; i++) {
+		/* rising/falling flank */
+		if (ir->is_pulse != (ir->buf_in[i] & MCE_PULSE_BIT)) {
+			send_packet_to_lirc(ir);
+			ir->is_pulse = ir->buf_in[i] & MCE_PULSE_BIT;
+		}
+
+		/* accumulate mce pulse/space values */
+		ir->lircdata += (ir->buf_in[i] & MCE_PULSE_MASK) *
+				MCE_TIME_UNIT;
+		ir->lircdata |= (ir->is_pulse ? PULSE_BIT : 0);
+	}
+	start_index += ir->overflow_len;
+	ir->overflow_len = 0;
+
+	for (i = start_index; i < buf_len; i++) {
+		/* decode mce packets of the form (84),AA,BB,CC,DD */
+		if (ir->buf_in[i] >= 0x80 && ir->buf_in[i] <= 0x9e) {
+			/* data headers */
+			/* decode packet data */
+			packet_len = ir->buf_in[i] & MCE_PACKET_LENGTH_MASK;
+			ir->overflow_len = i + 1 + packet_len - buf_len;
+			for (j = 1; j <= packet_len && (i + j < buf_len); j++) {
+				/* rising/falling flank */
+				if (ir->is_pulse !=
+				    (ir->buf_in[i + j] & MCE_PULSE_BIT)) {
+					send_packet_to_lirc(ir);
+					ir->is_pulse =
+						ir->buf_in[i + j] &
+							MCE_PULSE_BIT;
+				}
+
+				/* accumulate mce pulse/space values */
+				ir->lircdata +=
+					(ir->buf_in[i + j] & MCE_PULSE_MASK) *
+						MCE_TIME_UNIT;
+				ir->lircdata |= (ir->is_pulse ? PULSE_BIT : 0);
+			}
+
+			i += packet_len;
+		} else if (ir->buf_in[i] == MCE_CONTROL_HEADER) {
+			/* status header (0x9F) */
+			/*
+			 * A transmission containing one or more consecutive ir
+			 * commands always ends with a GAP of 100ms followed by
+			 * the sequence 0x9F 0x01 0x01 0x9F 0x15 0x00 0x00 0x80
+			 */
+
+#if 0
+	Uncomment this if the last 100ms "infinity"-space should be transmitted
+	to lirc directly instead of at the beginning of the next transmission.
+	Changes pulse/space order.
+
+			if (++i < buf_len && ir->buf_in[i]==0x01)
+				send_packet_to_lirc(ir);
+
+#endif
+
+			/* end decode loop */
+			dprintk(DRIVER_NAME "[%d] %s: found control header\n",
+				ir->devnum, __func__);
+			ir->overflow_len = 0;
+			break;
+		} else {
+			dprintk(DRIVER_NAME "[%d] %s: stray packet?\n",
+				ir->devnum, __func__);
+			ir->overflow_len = 0;
+		}
+	}
+
+	return;
+}
+
+static void mceusb_dev_recv(struct urb *urb, struct pt_regs *regs)
+{
+	struct mceusb_dev *ir;
+	int buf_len;
+
+	if (!urb)
+		return;
+
+	ir = urb->context;
+	if (!ir) {
+		urb->transfer_flags |= URB_ASYNC_UNLINK;
+		usb_unlink_urb(urb);
+		return;
+	}
+
+	buf_len = urb->actual_length;
+
+	if (debug)
+		mceusb_dev_printdata(ir, urb->transfer_buffer, buf_len);
+
+	if (ir->send_flags == RECV_FLAG_IN_PROGRESS) {
+		ir->send_flags = SEND_FLAG_COMPLETE;
+		dprintk(DRIVER_NAME "[%d]: setup answer received %d bytes\n",
+			ir->devnum, buf_len);
+	}
+
+	switch (urb->status) {
+	/* success */
+	case 0:
+		mceusb_process_ir_data(ir, buf_len);
+		break;
+
+	case -ECONNRESET:
+	case -ENOENT:
+	case -ESHUTDOWN:
+		urb->transfer_flags |= URB_ASYNC_UNLINK;
+		usb_unlink_urb(urb);
+		return;
+
+	case -EPIPE:
+	default:
+		break;
+	}
+
+	usb_submit_urb(urb, GFP_ATOMIC);
+}
+
+
+static ssize_t mceusb_transmit_ir(struct file *file, const char *buf,
+				  size_t n, loff_t *ppos)
+{
+	int i, count = 0, cmdcount = 0;
+	struct mceusb_dev *ir = NULL;
+	lirc_t wbuf[LIRCBUF_SIZE]; /* Workbuffer with values from lirc */
+	unsigned char cmdbuf[MCE_CMDBUF_SIZE]; /* MCE command buffer */
+	unsigned long signal_duration = 0; /* Singnal length in us */
+	struct timeval start_time, end_time;
+
+	do_gettimeofday(&start_time);
+
+	/* Retrieve lirc_driver data for the device */
+	ir = lirc_get_pdata(file);
+	if (!ir || !ir->usb_ep_out)
+		return -EFAULT;
+
+	if (n % sizeof(lirc_t))
+		return -EINVAL;
+	count = n / sizeof(lirc_t);
+
+	/* Check if command is within limits */
+	if (count > LIRCBUF_SIZE || count%2 == 0)
+		return -EINVAL;
+	if (copy_from_user(wbuf, buf, n))
+		return -EFAULT;
+
+	/* MCE tx init header */
+	cmdbuf[cmdcount++] = MCE_CONTROL_HEADER;
+	cmdbuf[cmdcount++] = 0x08;
+	cmdbuf[cmdcount++] = ir->transmitter_mask;
+
+	/* Generate mce packet data */
+	for (i = 0; (i < count) && (cmdcount < MCE_CMDBUF_SIZE); i++) {
+		signal_duration += wbuf[i];
+		wbuf[i] = wbuf[i] / MCE_TIME_UNIT;
+
+		do { /* loop to support long pulses/spaces > 127*50us=6.35ms */
+
+			/* Insert mce packet header every 4th entry */
+			if ((cmdcount < MCE_CMDBUF_SIZE) &&
+			    (cmdcount - MCE_TX_HEADER_LENGTH) %
+			     MCE_CODE_LENGTH == 0)
+				cmdbuf[cmdcount++] = MCE_PACKET_HEADER;
+
+			/* Insert mce packet data */
+			if (cmdcount < MCE_CMDBUF_SIZE)
+				cmdbuf[cmdcount++] =
+					(wbuf[i] < MCE_PULSE_BIT ?
+					 wbuf[i] : MCE_MAX_PULSE_LENGTH) |
+					 (i & 1 ? 0x00 : MCE_PULSE_BIT);
+			else
+				return -EINVAL;
+		} while ((wbuf[i] > MCE_MAX_PULSE_LENGTH) &&
+			 (wbuf[i] -= MCE_MAX_PULSE_LENGTH));
+	}
+
+	/* Fix packet length in last header */
+	cmdbuf[cmdcount - (cmdcount - MCE_TX_HEADER_LENGTH) % MCE_CODE_LENGTH] =
+		0x80 + (cmdcount - MCE_TX_HEADER_LENGTH) % MCE_CODE_LENGTH - 1;
+
+	/* Check if we have room for the empty packet at the end */
+	if (cmdcount >= MCE_CMDBUF_SIZE)
+		return -EINVAL;
+
+	/* All mce commands end with an empty packet (0x80) */
+	cmdbuf[cmdcount++] = 0x80;
+
+	/* Transmit the command to the mce device */
+	request_packet_async(ir, ir->usb_ep_out, cmdbuf,
+			     cmdcount, MCEUSB_OUTBOUND);
+
+	/*
+	 * The lircd gap calculation expects the write function to
+	 * wait the time it takes for the ircommand to be sent before
+	 * it returns.
+	 */
+	do_gettimeofday(&end_time);
+	signal_duration -= (end_time.tv_usec - start_time.tv_usec) +
+			   (end_time.tv_sec - start_time.tv_sec) * 1000000;
+
+	/* delay with the closest number of ticks */
+	set_current_state(TASK_INTERRUPTIBLE);
+	schedule_timeout(usecs_to_jiffies(signal_duration));
+
+	return n;
+}
+
+static void set_transmitter_mask(struct mceusb_dev *ir, unsigned int mask)
+{
+	if (ir->flags.transmitter_mask_inverted)
+		/*
+		 * The mask begins at 0x02 and has an inverted
+		 * numbering scheme
+		 */
+		ir->transmitter_mask =
+			(mask != 0x03 ? mask ^ 0x03 : mask) << 1;
+	else
+		ir->transmitter_mask = mask;
+}
+
+
+/* Sets the send carrier frequency */
+static int set_send_carrier(struct mceusb_dev *ir, int carrier)
+{
+	int clk = 10000000;
+	int prescaler = 0, divisor = 0;
+	unsigned char cmdbuf[] = { 0x9F, 0x06, 0x01, 0x80 };
+
+	/* Carrier is changed */
+	if (ir->carrier_freq != carrier) {
+
+		if (carrier <= 0) {
+			ir->carrier_freq = carrier;
+			dprintk(DRIVER_NAME "[%d]: SET_CARRIER disabling "
+				"carrier modulation\n", ir->devnum);
+			request_packet_async(ir, ir->usb_ep_out,
+					     cmdbuf, sizeof(cmdbuf),
+					     MCEUSB_OUTBOUND);
+			return carrier;
+		}
+
+		for (prescaler = 0; prescaler < 4; ++prescaler) {
+			divisor = (clk >> (2 * prescaler)) / carrier;
+			if (divisor <= 0xFF) {
+				ir->carrier_freq = carrier;
+				cmdbuf[2] = prescaler;
+				cmdbuf[3] = divisor;
+				dprintk(DRIVER_NAME "[%d]: SET_CARRIER "
+					"requesting %d Hz\n",
+					ir->devnum, carrier);
+
+				/* Transmit new carrier to mce device */
+				request_packet_async(ir, ir->usb_ep_out,
+						     cmdbuf, sizeof(cmdbuf),
+						     MCEUSB_OUTBOUND);
+				return carrier;
+			}
+		}
+
+		return -EINVAL;
+
+	}
+
+	return carrier;
+}
+
+
+static int mceusb_lirc_ioctl(struct inode *node, struct file *filep,
+			     unsigned int cmd, unsigned long arg)
+{
+	int result;
+	unsigned int ivalue;
+	unsigned long lvalue;
+	struct mceusb_dev *ir = NULL;
+
+	/* Retrieve lirc_driver data for the device */
+	ir = lirc_get_pdata(filep);
+	if (!ir || !ir->usb_ep_out)
+		return -EFAULT;
+
+
+	switch (cmd) {
+	case LIRC_SET_TRANSMITTER_MASK:
+
+		result = get_user(ivalue, (unsigned int *) arg);
+		if (result)
+			return result;
+		switch (ivalue) {
+		case 0x01: /* Transmitter 1     => 0x04 */
+		case 0x02: /* Transmitter 2     => 0x02 */
+		case 0x03: /* Transmitter 1 & 2 => 0x06 */
+			set_transmitter_mask(ir, ivalue);
+			break;
+
+		default: /* Unsupported transmitter mask */
+			return MCE_MAX_CHANNELS;
+		}
+
+		dprintk(DRIVER_NAME ": SET_TRANSMITTERS mask=%d\n", ivalue);
+		break;
+
+	case LIRC_GET_SEND_MODE:
+
+		result = put_user(LIRC_SEND2MODE(LIRC_CAN_SEND_PULSE &
+						 LIRC_CAN_SEND_MASK),
+				  (unsigned long *) arg);
+
+		if (result)
+			return result;
+		break;
+
+	case LIRC_SET_SEND_MODE:
+
+		result = get_user(lvalue, (unsigned long *) arg);
+
+		if (result)
+			return result;
+		if (lvalue != (LIRC_MODE_PULSE&LIRC_CAN_SEND_MASK))
+			return -EINVAL;
+		break;
+
+	case LIRC_SET_SEND_CARRIER:
+
+		result = get_user(ivalue, (unsigned int *) arg);
+		if (result)
+			return result;
+
+		set_send_carrier(ir, ivalue);
+		break;
+
+	default:
+		return -ENOIOCTLCMD;
+	}
+
+	return 0;
+}
+
+static struct file_operations lirc_fops = {
+	.owner	= THIS_MODULE,
+	.write	= mceusb_transmit_ir,
+	.ioctl	= mceusb_lirc_ioctl,
+};
+
+static int mceusb_gen1_init(struct mceusb_dev *ir)
+{
+	int i, ret;
+	char junk[64], data[8];
+	int partial = 0;
+
+	/*
+	 * Clear off the first few messages. These look like calibration
+	 * or test data, I can't really tell. This also flushes in case
+	 * we have random ir data queued up.
+	 */
+	for (i = 0; i < 40; i++)
+		usb_bulk_msg(ir->usbdev,
+			usb_rcvbulkpipe(ir->usbdev,
+				ir->usb_ep_in->bEndpointAddress),
+			junk, 64, &partial, HZ * 10);
+
+	ir->is_pulse = 1;
+
+	memset(data, 0, 8);
+
+	/* Get Status */
+	ret = usb_control_msg(ir->usbdev, usb_rcvctrlpipe(ir->usbdev, 0),
+			      USB_REQ_GET_STATUS, USB_DIR_IN,
+			      0, 0, data, 2, HZ * 3);
+
+	/*    ret = usb_get_status( ir->usbdev, 0, 0, data ); */
+	dprintk("%s - ret = %d status = 0x%x 0x%x\n", __func__,
+		ret, data[0], data[1]);
+
+	/*
+	 * This is a strange one. They issue a set address to the device
+	 * on the receive control pipe and expect a certain value pair back
+	 */
+	memset(data, 0, 8);
+
+	ret = usb_control_msg(ir->usbdev, usb_rcvctrlpipe(ir->usbdev, 0),
+			      USB_REQ_SET_ADDRESS, USB_TYPE_VENDOR, 0, 0,
+			      data, 2, HZ * 3);
+	dprintk("%s - ret = %d, devnum = %d\n",
+		__func__, ret, ir->usbdev->devnum);
+	dprintk("%s - data[0] = %d, data[1] = %d\n",
+		__func__, data[0], data[1]);
+
+	/* set feature */
+	ret = usb_control_msg(ir->usbdev, usb_sndctrlpipe(ir->usbdev, 0),
+			      USB_REQ_SET_FEATURE, USB_TYPE_VENDOR,
+			      0xc04e, 0x0000, NULL, 0, HZ * 3);
+
+	dprintk("%s - ret = %d\n", __func__, ret);
+
+	/* strange: bRequest == 4 */
+	ret = usb_control_msg(ir->usbdev, usb_sndctrlpipe(ir->usbdev, 0),
+			      4, USB_TYPE_VENDOR,
+			      0x0808, 0x0000, NULL, 0, HZ * 3);
+	dprintk("%s - retB = %d\n", __func__, ret);
+
+	/* strange: bRequest == 2 */
+	ret = usb_control_msg(ir->usbdev, usb_sndctrlpipe(ir->usbdev, 0),
+			      2, USB_TYPE_VENDOR,
+			      0x0000, 0x0100, NULL, 0, HZ * 3);
+	dprintk("%s - retC = %d\n", __func__, ret);
+
+	return ret;
+
+};
+
+static int mceusb_dev_probe(struct usb_interface *intf,
+				const struct usb_device_id *id)
+{
+	struct usb_device *dev = interface_to_usbdev(intf);
+	struct usb_host_interface *idesc;
+	struct usb_endpoint_descriptor *ep = NULL;
+	struct usb_endpoint_descriptor *ep_in = NULL;
+	struct usb_endpoint_descriptor *ep_out = NULL;
+	struct usb_host_config *config;
+	struct mceusb_dev *ir = NULL;
+	struct lirc_driver *driver = NULL;
+	struct lirc_buffer *rbuf = NULL;
+	int devnum, pipe, maxp;
+	int minor = 0;
+	int i;
+	char buf[63], name[128] = "";
+	int mem_failure = 0;
+	int is_pinnacle;
+	int is_microsoft_gen1;
+
+	dprintk(DRIVER_NAME ": %s called\n", __func__);
+
+	usb_reset_device(dev);
+
+	config = dev->actconfig;
+
+	idesc = intf->cur_altsetting;
+
+	is_pinnacle = usb_match_id(intf, pinnacle_list) ? 1 : 0;
+
+	is_microsoft_gen1 = usb_match_id(intf, microsoft_gen1_list) ? 1 : 0;
+
+	/* step through the endpoints to find first bulk in and out endpoint */
+	for (i = 0; i < idesc->desc.bNumEndpoints; ++i) {
+		ep = &idesc->endpoint[i].desc;
+
+		if ((ep_in == NULL)
+			&& ((ep->bEndpointAddress & USB_ENDPOINT_DIR_MASK)
+			    == USB_DIR_IN)
+			&& (((ep->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK)
+			    == USB_ENDPOINT_XFER_BULK)
+			|| ((ep->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK)
+			    == USB_ENDPOINT_XFER_INT))) {
+
+			dprintk(DRIVER_NAME ": acceptable inbound endpoint "
+				"found\n");
+			ep_in = ep;
+			ep_in->bmAttributes = USB_ENDPOINT_XFER_INT;
+			if (is_pinnacle)
+				/*
+				 * setting seems to 1 seem to cause issues with
+				 * Pinnacle timing out on transfer.
+				 */
+				ep_in->bInterval = ep->bInterval;
+			else
+				ep_in->bInterval = 1;
+		}
+
+		if ((ep_out == NULL)
+			&& ((ep->bEndpointAddress & USB_ENDPOINT_DIR_MASK)
+			    == USB_DIR_OUT)
+			&& (((ep->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK)
+			    == USB_ENDPOINT_XFER_BULK)
+			|| ((ep->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK)
+			    == USB_ENDPOINT_XFER_INT))) {
+
+			dprintk(DRIVER_NAME ": acceptable outbound endpoint "
+				"found\n");
+			ep_out = ep;
+			ep_out->bmAttributes = USB_ENDPOINT_XFER_INT;
+			if (is_pinnacle)
+				/*
+				 * setting seems to 1 seem to cause issues with
+				 * Pinnacle timing out on transfer.
+				 */
+				ep_out->bInterval = ep->bInterval;
+			else
+				ep_out->bInterval = 1;
+		}
+	}
+	if (ep_in == NULL || ep_out == NULL) {
+		dprintk(DRIVER_NAME ": inbound and/or "
+			"outbound endpoint not found\n");
+		return -ENODEV;
+	}
+
+	devnum = dev->devnum;
+	pipe = usb_rcvintpipe(dev, ep_in->bEndpointAddress);
+	maxp = usb_maxpacket(dev, pipe, usb_pipeout(pipe));
+
+	mem_failure = 0;
+	ir = kzalloc(sizeof(struct mceusb_dev), GFP_KERNEL);
+	if (!ir) {
+		mem_failure = 1;
+		goto mem_failure_switch;
+	}
+
+	driver = kzalloc(sizeof(struct lirc_driver), GFP_KERNEL);
+	if (!driver) {
+		mem_failure = 2;
+		goto mem_failure_switch;
+	}
+
+	rbuf = kmalloc(sizeof(struct lirc_buffer), GFP_KERNEL);
+	if (!rbuf) {
+		mem_failure = 3;
+		goto mem_failure_switch;
+	}
+
+	if (lirc_buffer_init(rbuf, sizeof(lirc_t), LIRCBUF_SIZE)) {
+		mem_failure = 4;
+		goto mem_failure_switch;
+	}
+
+	ir->buf_in = usb_buffer_alloc(dev, maxp, GFP_ATOMIC, &ir->dma_in);
+	if (!ir->buf_in) {
+		mem_failure = 5;
+		goto mem_failure_switch;
+	}
+
+	ir->urb_in = usb_alloc_urb(0, GFP_KERNEL);
+	if (!ir->urb_in) {
+		mem_failure = 7;
+		goto mem_failure_switch;
+	}
+
+	strcpy(driver->name, DRIVER_NAME " ");
+	driver->minor = -1;
+	driver->features = LIRC_CAN_SEND_PULSE |
+		LIRC_CAN_SET_TRANSMITTER_MASK |
+		LIRC_CAN_REC_MODE2 |
+		LIRC_CAN_SET_SEND_CARRIER;
+	driver->data = ir;
+	driver->rbuf = rbuf;
+	driver->set_use_inc = &mceusb_ir_open;
+	driver->set_use_dec = &mceusb_ir_close;
+	driver->code_length = sizeof(lirc_t) * 8;
+	driver->fops  = &lirc_fops;
+	driver->dev   = &intf->dev;
+	driver->owner = THIS_MODULE;
+
+	mutex_init(&ir->lock);
+	init_waitqueue_head(&ir->wait_out);
+
+	minor = lirc_register_driver(driver);
+	if (minor < 0)
+		mem_failure = 9;
+
+mem_failure_switch:
+
+	switch (mem_failure) {
+	case 9:
+		usb_free_urb(ir->urb_in);
+	case 7:
+		usb_buffer_free(dev, maxp, ir->buf_in, ir->dma_in);
+	case 5:
+		lirc_buffer_free(rbuf);
+	case 4:
+		kfree(rbuf);
+	case 3:
+		kfree(driver);
+	case 2:
+		kfree(ir);
+	case 1:
+		printk(DRIVER_NAME "[%d]: out of memory (code=%d)\n",
+			devnum, mem_failure);
+		return -ENOMEM;
+	}
+
+	driver->minor = minor;
+	ir->d = driver;
+	ir->devnum = devnum;
+	ir->usbdev = dev;
+	ir->len_in = maxp;
+	ir->overflow_len = 0;
+	ir->flags.connected = 0;
+	ir->flags.pinnacle = is_pinnacle;
+	ir->flags.microsoft_gen1 = is_microsoft_gen1;
+	ir->flags.transmitter_mask_inverted =
+		usb_match_id(intf, transmitter_mask_list) ? 0 : 1;
+
+	ir->lircdata = PULSE_MASK;
+	ir->is_pulse = 0;
+
+	/* ir->flags.transmitter_mask_inverted must be set */
+	set_transmitter_mask(ir, MCE_DEFAULT_TX_MASK);
+	/* Saving usb interface data for use by the transmitter routine */
+	ir->usb_ep_in = ep_in;
+	ir->usb_ep_out = ep_out;
+
+	if (dev->descriptor.iManufacturer
+	    && usb_string(dev, dev->descriptor.iManufacturer,
+			  buf, sizeof(buf)) > 0)
+		strlcpy(name, buf, sizeof(name));
+	if (dev->descriptor.iProduct
+	    && usb_string(dev, dev->descriptor.iProduct,
+			  buf, sizeof(buf)) > 0)
+		snprintf(name + strlen(name), sizeof(name) - strlen(name),
+			 " %s", buf);
+	printk(DRIVER_NAME "[%d]: %s on usb%d:%d\n", devnum, name,
+	       dev->bus->busnum, devnum);
+
+	/* inbound data */
+	usb_fill_int_urb(ir->urb_in, dev, pipe, ir->buf_in,
+		maxp, (usb_complete_t) mceusb_dev_recv, ir, ep_in->bInterval);
+	ir->urb_in->transfer_dma = ir->dma_in;
+	ir->urb_in->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+
+	/* initialize device */
+	if (ir->flags.pinnacle) {
+		int usbret;
+
+		/*
+		 * I have no idea why but this reset seems to be crucial to
+		 * getting the device to do outbound IO correctly - without
+		 * this the device seems to hang, ignoring all input - although
+		 * IR signals are correctly sent from the device, no input is
+		 * interpreted by the device and the host never does the
+		 * completion routine
+		 */
+
+		usbret = usb_reset_configuration(dev);
+		printk(DRIVER_NAME "[%d]: usb reset config ret %x\n",
+		       devnum, usbret);
+
+		/*
+		 * its possible we really should wait for a return
+		 * for each of these...
+		 */
+		request_packet_async(ir, ep_in, NULL, maxp, MCEUSB_INBOUND);
+		request_packet_async(ir, ep_out, pin_init1, sizeof(pin_init1),
+				     MCEUSB_OUTBOUND);
+		request_packet_async(ir, ep_in, NULL, maxp, MCEUSB_INBOUND);
+		request_packet_async(ir, ep_out, pin_init2, sizeof(pin_init2),
+				     MCEUSB_OUTBOUND);
+		request_packet_async(ir, ep_in, NULL, maxp, MCEUSB_INBOUND);
+		request_packet_async(ir, ep_out, pin_init3, sizeof(pin_init3),
+				     MCEUSB_OUTBOUND);
+	} else if (ir->flags.microsoft_gen1) {
+		/* original ms mce device requires some additional setup */
+		mceusb_gen1_init(ir);
+	} else {
+
+		request_packet_async(ir, ep_in, NULL, maxp, MCEUSB_INBOUND);
+		request_packet_async(ir, ep_in, NULL, maxp, MCEUSB_INBOUND);
+		request_packet_async(ir, ep_out, init1,
+				     sizeof(init1), MCEUSB_OUTBOUND);
+		request_packet_async(ir, ep_in, NULL, maxp, MCEUSB_INBOUND);
+		request_packet_async(ir, ep_out, init2,
+				     sizeof(init2), MCEUSB_OUTBOUND);
+	}
+
+	/*
+	 * if we don't issue the correct number of receives (MCEUSB_INBOUND)
+	 * for each outbound, then the first few ir pulses will be interpreted
+	 * by the usb_async_callback routine - we should ensure we have the
+	 * right amount OR less - as the meusb_dev_recv routine will handle
+	 * the control packets OK - they start with 0x9f - but the async
+	 * callback doesn't handle ir pulse packets
+	 */
+	request_packet_async(ir, ep_in, NULL, maxp, 0);
+
+	usb_set_intfdata(intf, ir);
+
+	return 0;
+}
+
+
+static void mceusb_dev_disconnect(struct usb_interface *intf)
+{
+	struct usb_device *dev = interface_to_usbdev(intf);
+	struct mceusb_dev *ir = usb_get_intfdata(intf);
+
+	usb_set_intfdata(intf, NULL);
+
+	if (!ir || !ir->d)
+		return;
+
+	ir->usbdev = NULL;
+	wake_up_all(&ir->wait_out);
+
+	mutex_lock(&ir->lock);
+	usb_kill_urb(ir->urb_in);
+	usb_free_urb(ir->urb_in);
+	usb_buffer_free(dev, ir->len_in, ir->buf_in, ir->dma_in);
+	mutex_unlock(&ir->lock);
+
+	unregister_from_lirc(ir);
+}
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0)
+static int mceusb_dev_suspend(struct usb_interface *intf, pm_message_t message)
+{
+	struct mceusb_dev *ir = usb_get_intfdata(intf);
+	printk(DRIVER_NAME "[%d]: suspend\n", ir->devnum);
+	usb_kill_urb(ir->urb_in);
+	return 0;
+}
+
+static int mceusb_dev_resume(struct usb_interface *intf)
+{
+	struct mceusb_dev *ir = usb_get_intfdata(intf);
+	printk(DRIVER_NAME "[%d]: resume\n", ir->devnum);
+	if (usb_submit_urb(ir->urb_in, GFP_ATOMIC))
+		return -EIO;
+	return 0;
+}
+#endif
+
+static struct usb_driver mceusb_dev_driver = {
+	LIRC_THIS_MODULE(.owner = THIS_MODULE)
+	.name =		DRIVER_NAME,
+	.probe =	mceusb_dev_probe,
+	.disconnect =	mceusb_dev_disconnect,
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0)
+	.suspend =	mceusb_dev_suspend,
+	.resume =	mceusb_dev_resume,
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 23)
+	.reset_resume =	mceusb_dev_resume,
+#endif
+#endif
+	.id_table =	mceusb_dev_table
+};
+
+static int __init mceusb_dev_init(void)
+{
+	int i;
+
+	printk(KERN_INFO DRIVER_NAME ": " DRIVER_DESC " " DRIVER_VERSION "\n");
+	printk(KERN_INFO DRIVER_NAME ": " DRIVER_AUTHOR "\n");
+	dprintk(DRIVER_NAME ": debug mode enabled\n");
+
+	i = usb_register(&mceusb_dev_driver);
+	if (i < 0) {
+		printk(DRIVER_NAME ": usb register failed, result = %d\n", i);
+		return -ENODEV;
+	}
+
+	return 0;
+}
+
+static void __exit mceusb_dev_exit(void)
+{
+	usb_deregister(&mceusb_dev_driver);
+}
+
+module_init(mceusb_dev_init);
+module_exit(mceusb_dev_exit);
+
+MODULE_DESCRIPTION(DRIVER_DESC);
+MODULE_AUTHOR(DRIVER_AUTHOR);
+MODULE_LICENSE("GPL");
+MODULE_DEVICE_TABLE(usb, mceusb_dev_table);
+/* this was originally lirc_mceusb2, lirc_mceusb and lirc_mceusb2 merged now */
+MODULE_ALIAS("lirc_mceusb2");
+
+module_param(debug, bool, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(debug, "Debug enabled or not");
+
+EXPORT_NO_SYMBOLS;
--- linux-rt-2.6.31.orig/ubuntu/lirc/lirc_ene0100/Makefile
+++ linux-rt-2.6.31/ubuntu/lirc/lirc_ene0100/Makefile
@@ -0,0 +1,3 @@
+EXTRA_CFLAGS =-DIRCTL_DEV_MAJOR=61 -DLIRC_SERIAL_TRANSMITTER -DLIRC_SERIAL_SOFTCARRIER -I$(src)/..
+
+obj-$(CONFIG_LIRC_ENE0100)		+= lirc_ene0100.o
--- linux-rt-2.6.31.orig/ubuntu/lirc/lirc_ene0100/lirc_ene0100.c
+++ linux-rt-2.6.31/ubuntu/lirc/lirc_ene0100/lirc_ene0100.c
@@ -0,0 +1,653 @@
+/*
+ * driver for ENE KB3926 B/C/D CIR (also known as ENE0100)
+ *
+ * Copyright (C) 2009 Maxim Levitsky <maximlevitsky@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
+ * USA
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/pnp.h>
+#include <linux/io.h>
+#include <linux/interrupt.h>
+#include "lirc_ene0100.h"
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 16)
+#error "Sorry, this driver needs kernel version 2.6.16 or higher"
+#else
+
+static int sample_period = 75;
+static int enable_idle = 1;
+static int enable_learning;
+
+static void ene_set_idle(struct ene_device *dev, int idle);
+static void ene_set_inputs(struct ene_device *dev, int enable);
+
+/* read a hardware register */
+static u8 ene_hw_read_reg(struct ene_device *dev, u16 reg)
+{
+	outb(reg >> 8, dev->hw_io + ENE_ADDR_HI);
+	outb(reg & 0xFF, dev->hw_io + ENE_ADDR_LO);
+	return inb(dev->hw_io + ENE_IO);
+}
+
+/* write a hardware register */
+static void ene_hw_write_reg(struct ene_device *dev, u16 reg, u8 value)
+{
+	outb(reg >> 8, dev->hw_io + ENE_ADDR_HI);
+	outb(reg & 0xFF, dev->hw_io + ENE_ADDR_LO);
+	outb(value, dev->hw_io + ENE_IO);
+}
+
+/* change specific bits in hardware register */
+static void ene_hw_write_reg_mask(struct ene_device *dev,
+				  u16 reg, u8 value, u8 mask)
+{
+	u8 regvalue;
+
+	outb(reg >> 8, dev->hw_io + ENE_ADDR_HI);
+	outb(reg & 0xFF, dev->hw_io + ENE_ADDR_LO);
+
+	regvalue = inb(dev->hw_io + ENE_IO) & ~mask;
+	regvalue |= (value & mask);
+	outb(regvalue, dev->hw_io + ENE_IO);
+}
+
+/* read irq status and ack it */
+static int ene_hw_irq_status(struct ene_device *dev, int *buffer_pointer)
+{
+	u8 irq_status;
+	u8 fw_flags1, fw_flags2;
+
+	fw_flags2 = ene_hw_read_reg(dev, ENE_FW2);
+
+	if (buffer_pointer)
+		*buffer_pointer = 4 * (fw_flags2 & ENE_FW2_BUF_HIGH);
+
+	if (dev->hw_revision < ENE_HW_C) {
+		irq_status = ene_hw_read_reg(dev, ENEB_IRQ_STATUS);
+
+		if (!irq_status & ENEB_IRQ_STATUS_IR)
+			return 0;
+		ene_hw_write_reg(dev, ENEB_IRQ_STATUS,
+				 irq_status & ~ENEB_IRQ_STATUS_IR);
+
+		/* rev B support only recieving */
+		return ENE_IRQ_RX;
+	}
+
+	irq_status = ene_hw_read_reg(dev, ENEC_IRQ);
+
+	if (!irq_status && ENEC_IRQ_STATUS)
+		return 0;
+
+	/* original driver does that twice - a workaround ? */
+	ene_hw_write_reg(dev, ENEC_IRQ, irq_status & ~ENEC_IRQ_STATUS);
+	ene_hw_write_reg(dev, ENEC_IRQ, irq_status & ~ENEC_IRQ_STATUS);
+
+	/* clear unknown flag in F8F9 */
+	if (fw_flags2 & ENE_FW2_IRQ_CLR)
+		ene_hw_write_reg(dev, ENE_FW2, fw_flags2 & ~ENE_FW2_IRQ_CLR);
+
+	/* check if this is a TX interrupt */
+	fw_flags1 = ene_hw_read_reg(dev, ENE_FW1);
+
+	if (fw_flags1 & ENE_FW1_TXIRQ) {
+		ene_hw_write_reg(dev, ENE_FW1, fw_flags1 & ~ENE_FW1_TXIRQ);
+		return ENE_IRQ_TX;
+	} else
+		return ENE_IRQ_RX;
+}
+
+static int ene_hw_detect(struct ene_device *dev)
+{
+	u8 chip_major, chip_minor;
+	u8 hw_revision, old_ver;
+	u8 tmp;
+	u8 fw_capabilities;
+
+	tmp = ene_hw_read_reg(dev, ENE_HW_UNK);
+	ene_hw_write_reg(dev, ENE_HW_UNK, tmp & ~ENE_HW_UNK_CLR);
+
+	chip_major = ene_hw_read_reg(dev, ENE_HW_VER_MAJOR);
+	chip_minor = ene_hw_read_reg(dev, ENE_HW_VER_MINOR);
+
+	ene_hw_write_reg(dev, ENE_HW_UNK, tmp);
+	hw_revision = ene_hw_read_reg(dev, ENE_HW_VERSION);
+	old_ver = ene_hw_read_reg(dev, ENE_HW_VER_OLD);
+
+	if (hw_revision == 0xFF) {
+
+		ene_printk(KERN_WARNING, "device seems to be disabled\n");
+		ene_printk(KERN_WARNING,
+			"send a mail to lirc-list@lists.sourceforge.net\n");
+		ene_printk(KERN_WARNING, "please attach output of acpidump\n");
+
+		return -ENODEV;
+	}
+
+	if (chip_major == 0x33) {
+		ene_printk(KERN_WARNING, "chips 0x33xx aren't supported yet\n");
+		return -ENODEV;
+	}
+
+	if (chip_major == 0x39 && chip_minor == 0x26 && hw_revision == 0xC0) {
+		dev->hw_revision = ENE_HW_C;
+		ene_printk(KERN_WARNING,
+		       "KB3926C detected, driver support is not complete!\n");
+
+	} else if (old_ver == 0x24 && hw_revision == 0xC0) {
+		dev->hw_revision = ENE_HW_B;
+		ene_printk(KERN_NOTICE, "KB3926B detected\n");
+	} else {
+		dev->hw_revision = ENE_HW_D;
+		ene_printk(KERN_WARNING,
+			"unknown ENE chip detected, assuming KB3926D\n");
+		ene_printk(KERN_WARNING, "driver support incomplete");
+
+	}
+
+	ene_printk(KERN_DEBUG, "chip is 0x%02x%02x - 0x%02x, 0x%02x\n",
+		chip_major, chip_minor, old_ver, hw_revision);
+
+
+	/* detect features hardware supports */
+
+	if (dev->hw_revision < ENE_HW_C)
+		return 0;
+
+	fw_capabilities = ene_hw_read_reg(dev, ENE_FW2);
+
+	dev->hw_gpio40_learning = fw_capabilities & ENE_FW2_GP40_AS_LEARN;
+	dev->hw_learning_and_tx_capable = fw_capabilities & ENE_FW2_LEARNING;
+
+	dev->hw_fan_as_normal_input = dev->hw_learning_and_tx_capable &&
+	    fw_capabilities & ENE_FW2_FAN_AS_NRML_IN;
+
+	ene_printk(KERN_NOTICE, "hardware features:\n");
+	ene_printk(KERN_NOTICE,
+		"learning and tx %s, gpio40_learn %s, fan_in %s\n",
+	       dev->hw_learning_and_tx_capable ? "on" : "off",
+	       dev->hw_gpio40_learning ? "on" : "off",
+	       dev->hw_fan_as_normal_input ? "on" : "off");
+
+	if (!dev->hw_learning_and_tx_capable && enable_learning)
+		enable_learning = 0;
+
+	if (dev->hw_learning_and_tx_capable) {
+		ene_printk(KERN_WARNING,
+		"Device supports transmitting, but the driver doesn't\n");
+		ene_printk(KERN_WARNING,
+		"due to lack of hardware to test against.\n");
+		ene_printk(KERN_WARNING,
+		"Send a mail to: lirc-list@lists.sourceforge.net\n");
+	}
+	return 0;
+}
+
+/* hardware initialization */
+static int ene_hw_init(void *data)
+{
+	u8 reg_value;
+	struct ene_device *dev = (struct ene_device *)data;
+	dev->in_use = 1;
+
+	if (dev->hw_revision < ENE_HW_C) {
+		ene_hw_write_reg(dev, ENEB_IRQ, dev->irq << 1);
+		ene_hw_write_reg(dev, ENEB_IRQ_UNK1, 0x01);
+	} else {
+		reg_value = ene_hw_read_reg(dev, ENEC_IRQ) & 0xF0;
+		reg_value |= ENEC_IRQ_UNK_EN;
+		reg_value &= ~ENEC_IRQ_STATUS;
+		reg_value |= (dev->irq & ENEC_IRQ_MASK);
+		ene_hw_write_reg(dev, ENEC_IRQ, reg_value);
+		ene_hw_write_reg(dev, ENE_TX_UNK1, 0x63);
+	}
+
+	ene_hw_write_reg(dev, ENE_CIR_CONF2, 0x00);
+	ene_set_inputs(dev, enable_learning);
+
+	/* set sampling period */
+	ene_hw_write_reg(dev, ENE_CIR_SAMPLE_PERIOD, sample_period);
+
+	/* ack any pending irqs - just in case */
+	ene_hw_irq_status(dev, NULL);
+
+	/* enter idle mode */
+	ene_set_idle(dev, 1);
+
+	/* enable firmware bits */
+	ene_hw_write_reg_mask(dev, ENE_FW1,
+			      ENE_FW1_ENABLE | ENE_FW1_IRQ,
+			      ENE_FW1_ENABLE | ENE_FW1_IRQ);
+	/* clear stats */
+	dev->sample = 0;
+	return 0;
+}
+
+/* this enables gpio40 signal, used if connected to wide band input*/
+static void ene_enable_gpio40(struct ene_device *dev, int enable)
+{
+	ene_hw_write_reg_mask(dev, ENE_CIR_CONF1, enable ?
+			      0 : ENE_CIR_CONF2_GPIO40DIS,
+			      ENE_CIR_CONF2_GPIO40DIS);
+}
+
+/* this enables the classic sampler */
+static void ene_enable_normal_recieve(struct ene_device *dev, int enable)
+{
+	ene_hw_write_reg(dev, ENE_CIR_CONF1, enable ? ENE_CIR_CONF1_ADC_ON : 0);
+}
+
+/* this enables recieve via fan input */
+static void ene_enable_fan_recieve(struct ene_device *dev, int enable)
+{
+	if (!enable)
+		ene_hw_write_reg(dev, ENE_FAN_AS_IN1, 0);
+	else {
+		ene_hw_write_reg(dev, ENE_FAN_AS_IN1, ENE_FAN_AS_IN1_EN);
+		ene_hw_write_reg(dev, ENE_FAN_AS_IN2, ENE_FAN_AS_IN2_EN);
+	}
+	dev->fan_input_inuse = enable;
+}
+
+/* determine which input to use*/
+static void ene_set_inputs(struct ene_device *dev, int learning_enable)
+{
+	ene_enable_normal_recieve(dev, 1);
+
+	/* old hardware doesn't support learning mode for sure */
+	if (dev->hw_revision <= ENE_HW_B)
+		return;
+
+	/* reciever not learning capable, still set gpio40 correctly */
+	if (!dev->hw_learning_and_tx_capable) {
+		ene_enable_gpio40(dev, !dev->hw_gpio40_learning);
+		return;
+	}
+
+	/* enable learning mode */
+	if (learning_enable) {
+		ene_enable_gpio40(dev, dev->hw_gpio40_learning);
+
+		/* fan input is not used for learning */
+		if (dev->hw_fan_as_normal_input)
+			ene_enable_fan_recieve(dev, 0);
+
+	/* disable learning mode */
+	} else {
+		if (dev->hw_fan_as_normal_input) {
+			ene_enable_fan_recieve(dev, 1);
+			ene_enable_normal_recieve(dev, 0);
+		} else
+			ene_enable_gpio40(dev, !dev->hw_gpio40_learning);
+	}
+
+	/* set few additional settings for this mode */
+	ene_hw_write_reg_mask(dev, ENE_CIR_CONF1, learning_enable ?
+			      ENE_CIR_CONF1_LEARN1 : 0, ENE_CIR_CONF1_LEARN1);
+
+	ene_hw_write_reg_mask(dev, ENE_CIR_CONF2, learning_enable ?
+			      ENE_CIR_CONF2_LEARN2 : 0, ENE_CIR_CONF2_LEARN2);
+}
+
+/* deinitialization */
+static void ene_hw_deinit(void *data)
+{
+	struct ene_device *dev = (struct ene_device *)data;
+
+	/* disable samplers */
+	ene_enable_normal_recieve(dev, 0);
+
+	if (dev->hw_fan_as_normal_input)
+		ene_enable_fan_recieve(dev, 0);
+
+	/* disable hardware IRQ and firmware flag */
+	ene_hw_write_reg_mask(dev, ENE_FW1, 0, ENE_FW1_ENABLE | ENE_FW1_IRQ);
+
+	ene_set_idle(dev, 1);
+	dev->in_use = 0;
+}
+
+/*  sends current sample to userspace */
+static void send_sample(struct ene_device *dev)
+{
+	int value = abs(dev->sample) & PULSE_MASK;
+
+	if (dev->sample > 0)
+		value |= PULSE_BIT;
+
+	if (!lirc_buffer_full(dev->lirc_driver->rbuf)) {
+		lirc_buffer_write(dev->lirc_driver->rbuf, (void *)&value);
+		wake_up(&dev->lirc_driver->rbuf->wait_poll);
+	}
+	dev->sample = 0;
+}
+
+/*  this updates current sample */
+static void update_sample(struct ene_device *dev, int sample)
+{
+	if (!dev->sample)
+		dev->sample = sample;
+	else if (same_sign(dev->sample, sample))
+		dev->sample += sample;
+	else {
+		send_sample(dev);
+		dev->sample = sample;
+	}
+}
+
+/* enable or disable idle mode */
+static void ene_set_idle(struct ene_device *dev, int idle)
+{
+	struct timeval now;
+	int disable = idle && enable_idle && (dev->hw_revision < ENE_HW_C);
+
+	ene_hw_write_reg_mask(dev, ENE_CIR_SAMPLE_PERIOD,
+			      disable ? 0 : ENE_CIR_SAMPLE_OVERFLOW,
+			      ENE_CIR_SAMPLE_OVERFLOW);
+	dev->idle = idle;
+
+	/* remember when we have entered the idle mode */
+	if (idle) {
+		do_gettimeofday(&dev->gap_start);
+		return;
+	}
+
+	/* send the gap between keypresses now */
+	do_gettimeofday(&now);
+
+	if (now.tv_sec - dev->gap_start.tv_sec > 16)
+		dev->sample = space(PULSE_MASK);
+	else
+		dev->sample = dev->sample +
+		    space(1000000ull * (now.tv_sec - dev->gap_start.tv_sec))
+		    + space(now.tv_usec - dev->gap_start.tv_usec);
+
+	if (abs(dev->sample) > PULSE_MASK)
+		dev->sample = space(PULSE_MASK);
+	send_sample(dev);
+}
+
+/* interrupt handler */
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 19)
+static irqreturn_t ene_hw_irq(int irq, void *data)
+#else
+static irqreturn_t ene_hw_irq(int irq, void *data, struct pt_regs *regs)
+#endif
+{
+	u16 hw_value;
+	int i, hw_sample;
+	int space;
+	int buffer_pointer;
+	int irq_status;
+
+	struct ene_device *dev = (struct ene_device *)data;
+	irq_status = ene_hw_irq_status(dev, &buffer_pointer);
+
+	if (!irq_status)
+		return IRQ_NONE;
+
+	/* TODO: only RX for now */
+	if (irq_status == ENE_IRQ_TX)
+		return IRQ_HANDLED;
+
+	for (i = 0; i < ENE_SAMPLES_SIZE; i++) {
+
+		hw_value = ene_hw_read_reg(dev,
+				ENE_SAMPLE_BUFFER + buffer_pointer + i);
+
+		if (dev->fan_input_inuse) {
+			/* read high part of the sample */
+			hw_value |= ene_hw_read_reg(dev,
+			    ENE_SAMPLE_BUFFER_FAN + buffer_pointer + i) << 8;
+
+			/* test for _space_ bit */
+			space = !(hw_value & ENE_FAN_SMPL_PULS_MSK);
+
+			/* clear space bit, and other unused bits */
+			hw_value &= ENE_FAN_VALUE_MASK;
+			hw_sample = hw_value * ENE_SAMPLE_PERIOD_FAN;
+
+		} else {
+			space = hw_value & ENE_SAMPLE_SPC_MASK;
+			hw_value &= ENE_SAMPLE_VALUE_MASK;
+			hw_sample = hw_value * sample_period;
+		}
+
+		/* no more data */
+		if (!(hw_value))
+			break;
+
+		if (space)
+			hw_sample *= -1;
+
+		/* overflow sample recieved, handle it */
+
+		if (!dev->fan_input_inuse && hw_value == ENE_SAMPLE_OVERFLOW) {
+
+			if (dev->idle)
+				continue;
+
+			if (dev->sample > 0 || abs(dev->sample) <= ENE_MAXGAP)
+				update_sample(dev, hw_sample);
+			else
+				ene_set_idle(dev, 1);
+
+			continue;
+		}
+
+		/* normal first sample recieved */
+		if (!dev->fan_input_inuse && dev->idle) {
+			ene_set_idle(dev, 0);
+
+			/* discard first recieved value, its random
+			   since its the time signal was off before
+			   first pulse if idle mode is enabled, HW
+			   does that for us */
+
+			if (!enable_idle)
+				continue;
+		}
+		update_sample(dev, hw_sample);
+		send_sample(dev);
+	}
+	return IRQ_HANDLED;
+}
+
+static int ene_probe(struct pnp_dev *pnp_dev,
+		     const struct pnp_device_id *dev_id)
+{
+	struct ene_device *dev;
+	struct lirc_driver *lirc_driver;
+	int error = -ENOMEM;
+
+	dev = kzalloc(sizeof(struct ene_device), GFP_KERNEL);
+
+	if (!dev)
+		goto err1;
+
+	dev->pnp_dev = pnp_dev;
+	pnp_set_drvdata(pnp_dev, dev);
+
+
+	/* prepare lirc interface */
+	error = -ENOMEM;
+	lirc_driver = kzalloc(sizeof(struct lirc_driver), GFP_KERNEL);
+
+	if (!lirc_driver)
+		goto err2;
+
+	dev->lirc_driver = lirc_driver;
+
+	strcpy(lirc_driver->name, ENE_DRIVER_NAME);
+	lirc_driver->minor = -1;
+	lirc_driver->code_length = sizeof(int) * 8;
+	lirc_driver->features = LIRC_CAN_REC_MODE2;
+	lirc_driver->data = dev;
+	lirc_driver->set_use_inc = ene_hw_init;
+	lirc_driver->set_use_dec = ene_hw_deinit;
+	lirc_driver->dev = &pnp_dev->dev;
+	lirc_driver->owner = THIS_MODULE;
+
+	lirc_driver->rbuf = kzalloc(sizeof(struct lirc_buffer), GFP_KERNEL);
+
+	if (!lirc_driver->rbuf)
+		goto err3;
+
+	if (lirc_buffer_init(lirc_driver->rbuf, sizeof(int), sizeof(int) * 256))
+		goto err4;
+
+	error = -ENODEV;
+	if (lirc_register_driver(lirc_driver))
+		goto err5;
+
+	/* validate resources */
+	if (!pnp_port_valid(pnp_dev, 0) || pnp_port_len(pnp_dev, 0) < ENE_MAX_IO)
+		goto err6;
+
+	if (!pnp_irq_valid(pnp_dev, 0))
+		goto err6;
+
+	dev->hw_io = pnp_port_start(pnp_dev, 0);
+	dev->irq = pnp_irq(pnp_dev, 0);
+
+	/* claim the resources */
+	error = -EBUSY;
+	if (!request_region(dev->hw_io, ENE_MAX_IO, ENE_DRIVER_NAME))
+		goto err6;
+
+	if (request_irq(dev->irq, ene_hw_irq,
+			IRQF_SHARED, ENE_DRIVER_NAME, (void *)dev))
+		goto err7;
+
+	/* detect hardware version and features */
+	error = ene_hw_detect(dev);
+	if (error)
+		goto err8;
+
+	ene_printk(KERN_NOTICE, "driver has been succesfully loaded\n");
+	return 0;
+
+err8:
+	free_irq(dev->irq, dev);
+err7:
+	release_region(dev->hw_io, ENE_MAX_IO);
+err6:
+	lirc_unregister_driver(lirc_driver->minor);
+err5:
+	lirc_buffer_free(lirc_driver->rbuf);
+err4:
+	kfree(lirc_driver->rbuf);
+err3:
+	kfree(lirc_driver);
+err2:
+	kfree(dev);
+err1:
+	return error;
+}
+
+static void ene_remove(struct pnp_dev *pnp_dev)
+{
+	struct ene_device *dev = pnp_get_drvdata(pnp_dev);
+	ene_hw_deinit(dev);
+	free_irq(dev->irq, dev);
+	release_region(dev->hw_io, ENE_MAX_IO);
+	lirc_unregister_driver(dev->lirc_driver->minor);
+	lirc_buffer_free(dev->lirc_driver->rbuf);
+	kfree(dev->lirc_driver);
+	kfree(dev);
+}
+
+#ifdef CONFIG_PM
+
+/* TODO: make 'wake on IR' configurable and add .shutdown */
+/* currently impossible due to lack of kernel support */
+
+static int ene_suspend(struct pnp_dev *pnp_dev, pm_message_t state)
+{
+	struct ene_device *dev = pnp_get_drvdata(pnp_dev);
+	ene_hw_write_reg_mask(dev, ENE_FW1, ENE_FW1_WAKE, ENE_FW1_WAKE);
+	return 0;
+}
+
+static int ene_resume(struct pnp_dev *pnp_dev)
+{
+	struct ene_device *dev = pnp_get_drvdata(pnp_dev);
+	if (dev->in_use)
+		ene_hw_init(dev);
+
+	ene_hw_write_reg_mask(dev, ENE_FW1, 0, ENE_FW1_WAKE);
+	return 0;
+}
+
+#endif
+
+static const struct pnp_device_id ene_ids[] = {
+	{.id = "ENE0100",},
+	{},
+};
+
+static struct pnp_driver ene_driver = {
+	.name = ENE_DRIVER_NAME,
+	.id_table = ene_ids,
+	.flags = PNP_DRIVER_RES_DO_NOT_CHANGE,
+
+	.probe = ene_probe,
+	.remove = __devexit_p(ene_remove),
+
+#ifdef CONFIG_PM
+	.suspend = ene_suspend,
+	.resume = ene_resume,
+#endif
+};
+
+static int __init ene_init(void)
+{
+	if (sample_period < 5) {
+		ene_printk(KERN_ERR, "sample period must be at\n");
+		ene_printk(KERN_ERR, "least 5 us, (at least 30 recommended)\n");
+		return -EINVAL;
+	}
+	return pnp_register_driver(&ene_driver);
+}
+
+static void ene_exit(void)
+{
+	pnp_unregister_driver(&ene_driver);
+}
+
+module_param(sample_period, int, S_IRUGO);
+MODULE_PARM_DESC(sample_period, "Hardware sample period (75 us default)");
+
+module_param(enable_idle, bool, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(enable_idle,
+	"Enables turning off signal sampling after long inactivity time; "
+	"if disabled might help detecting input signal (default: enabled)");
+
+module_param(enable_learning, bool, S_IRUGO);
+MODULE_PARM_DESC(enable_learning, "Use wide band (learning) reciever");
+
+MODULE_DEVICE_TABLE(pnp, ene_ids);
+MODULE_DESCRIPTION
+    ("LIRC driver for KB3926B/KB3926C/KB3926D (aka ENE0100) CIR port");
+MODULE_AUTHOR("Maxim Levitsky");
+MODULE_LICENSE("GPL");
+
+module_init(ene_init);
+module_exit(ene_exit);
+#endif
--- linux-rt-2.6.31.orig/ubuntu/lirc/lirc_ene0100/lirc_ene0100.h
+++ linux-rt-2.6.31/ubuntu/lirc/lirc_ene0100/lirc_ene0100.h
@@ -0,0 +1,170 @@
+/*
+ * driver for ENE KB3926 B/C/D CIR (also known as ENE0100)
+ *
+ * Copyright (C) 2009 Maxim Levitsky <maximlevitsky@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
+ * USA
+ */
+
+#include "../kcompat.h"
+#include "../lirc.h"
+#include "../lirc_dev/lirc_dev.h"
+
+/* hardware address */
+#define ENE_STATUS		0	 /* hardware status - unused */
+#define ENE_ADDR_HI 		1	 /* hi byte of register address */
+#define ENE_ADDR_LO 		2	 /* low byte of register address */
+#define ENE_IO 			3	 /* read/write window */
+#define ENE_MAX_IO		4
+
+/* 8 bytes of samples, divided in 2 halfs*/
+#define ENE_SAMPLE_BUFFER 	0xF8F0	 /* regular sample buffer */
+#define ENE_SAMPLE_SPC_MASK 	(1 << 7) /* sample is space */
+#define ENE_SAMPLE_VALUE_MASK	0x7F
+#define ENE_SAMPLE_OVERFLOW	0x7F
+#define ENE_SAMPLES_SIZE	4
+
+/* fan input sample buffer */
+#define ENE_SAMPLE_BUFFER_FAN	0xF8FB	 /* this buffer holds high byte of */
+					 /* each sample of normal buffer */
+
+#define ENE_FAN_SMPL_PULS_MSK	0x8000	 /* this bit of combined sample */
+					 /* if set, says that sample is pulse */
+#define ENE_FAN_VALUE_MASK	0x0FFF   /* mask for valid bits of the value */
+
+/* first firmware register */
+#define ENE_FW1			0xF8F8
+#define	ENE_FW1_ENABLE		(1 << 0) /* enable fw processing */
+#define ENE_FW1_TXIRQ		(1 << 1) /* TX interrupt pending */
+#define ENE_FW1_WAKE		(1 << 6) /* enable wake from S3 */
+#define ENE_FW1_IRQ		(1 << 7) /* enable interrupt */
+
+/* second firmware register */
+#define ENE_FW2			0xF8F9
+#define ENE_FW2_BUF_HIGH	(1 << 0) /* which half of the buffer to read */
+#define ENE_FW2_IRQ_CLR		(1 << 2) /* clear this on IRQ */
+#define ENE_FW2_GP40_AS_LEARN	(1 << 4) /* normal input is used as */
+					 /* learning input */
+#define ENE_FW2_FAN_AS_NRML_IN	(1 << 6) /* fan is used as normal input */
+#define ENE_FW2_LEARNING	(1 << 7) /* hardware supports learning and TX */
+
+/* fan as input settings - only if learning capable */
+#define ENE_FAN_AS_IN1		0xFE30   /* fan init reg 1 */
+#define ENE_FAN_AS_IN1_EN	0xCD
+#define ENE_FAN_AS_IN2		0xFE31   /* fan init reg 2 */
+#define ENE_FAN_AS_IN2_EN	0x03
+#define ENE_SAMPLE_PERIOD_FAN   61	 /* fan input has fixed sample period */
+
+/* IRQ registers block (for revision B) */
+#define ENEB_IRQ		0xFD09	 /* IRQ number */
+#define ENEB_IRQ_UNK1		0xFD17	 /* unknown setting = 1 */
+#define ENEB_IRQ_STATUS		0xFD80	 /* irq status */
+#define ENEB_IRQ_STATUS_IR	(1 << 5) /* IR irq */
+
+/* IRQ registers block (for revision C,D) */
+#define ENEC_IRQ		0xFE9B	 /* new irq settings register */
+#define ENEC_IRQ_MASK		0x0F	 /* irq number mask */
+#define ENEC_IRQ_UNK_EN		(1 << 4) /* always enabled */
+#define ENEC_IRQ_STATUS		(1 << 5) /* irq status and ACK */
+
+/* CIR block settings */
+#define ENE_CIR_CONF1		0xFEC0
+#define ENE_CIR_CONF1_ADC_ON	0x7	 /* reciever on gpio40 enabled */
+#define ENE_CIR_CONF1_LEARN1	(1 << 3) /* enabled on learning mode */
+#define ENE_CIR_CONF1_TX_ON	0x30	 /* enabled on transmit */
+#define ENE_CIR_CONF1_TX_CARR	(1 << 7) /* send TX carrier or not */
+
+#define ENE_CIR_CONF2		0xFEC1	 /* unknown setting = 0 */
+#define ENE_CIR_CONF2_LEARN2	(1 << 4) /* set on enable learning */
+#define ENE_CIR_CONF2_GPIO40DIS	(1 << 5) /* disable normal input via gpio40 */
+
+#define ENE_CIR_SAMPLE_PERIOD	0xFEC8	 /* sample period in us */
+#define ENE_CIR_SAMPLE_OVERFLOW	(1 << 7) /* interrupt on overflows if set */
+
+
+/* transmitter - not implemented yet */
+/* KB3926C and higher */
+/* transmission is very similiar to recieving, a byte is written to */
+/* ENE_TX_INPUT, in same manner as it is read from sample buffer */
+/* sample period is fixed*/
+
+
+/* transmitter ports */
+#define ENE_TX_PORT1		0xFC01	 /* this enables one or both */
+#define ENE_TX_PORT1_EN		(1 << 5) /* TX ports */
+#define ENE_TX_PORT2		0xFC08
+#define ENE_TX_PORT2_EN		(1 << 1)
+
+#define ENE_TX_INPUT		0xFEC9	 /* next byte to transmit */
+#define ENE_TX_SPC_MASK 	(1 << 7) /* Transmitted sample is space */
+#define ENE_TX_UNK1		0xFECB	 /* set to 0x63 */
+#define ENE_TX_SMPL_PERIOD	50	 /* transmit sample period */
+
+
+#define ENE_TX_CARRIER		0xFECE	 /* TX carrier * 2 (khz) */
+#define ENE_TX_CARRIER_UNKBIT	0x80	 /* This bit set on transmit */
+#define ENE_TX_CARRIER_LOW	0xFECF	 /* TX carrier / 2 */
+
+/* Hardware versions */
+#define ENE_HW_VERSION		0xFF00	 /* hardware revision */
+#define ENE_HW_UNK 		0xFF1D
+#define ENE_HW_UNK_CLR		(1 << 2)
+#define ENE_HW_VER_MAJOR	0xFF1E	 /* chip version */
+#define ENE_HW_VER_MINOR	0xFF1F
+#define ENE_HW_VER_OLD		0xFD00
+
+#define same_sign(a, b) ((((a) > 0) && (b) > 0) || ((a) < 0 && (b) < 0))
+
+#define ENE_DRIVER_NAME 	"enecir"
+#define ENE_MAXGAP 		250000	 /* this is amount of time we wait
+					 before turning the sampler, chosen
+					 arbitry */
+
+#define space(len) 	       (-(len))	 /* add a space */
+
+/* software defines */
+#define ENE_IRQ_RX		1
+#define ENE_IRQ_TX		2
+
+#define  ENE_HW_B		1	/* 3926B */
+#define  ENE_HW_C		2	/* 3926C */
+#define  ENE_HW_D		3	/* 3926D */
+
+#define ene_printk(level, text, ...) \
+	printk(level ENE_DRIVER_NAME ": " text, ## __VA_ARGS__)
+
+struct ene_device {
+	struct pnp_dev *pnp_dev;
+	struct lirc_driver *lirc_driver;
+
+	/* hw settings */
+	unsigned long hw_io;
+	int irq;
+
+	int hw_revision;			/* hardware revision */
+	int hw_learning_and_tx_capable;		/* learning capable */
+	int hw_gpio40_learning;			/* gpio40 is learning */
+	int hw_fan_as_normal_input;	/* fan input is used as regular input */
+
+	/* device data */
+	int idle;
+	int fan_input_inuse;
+
+	int sample;
+	int in_use;
+
+	struct timeval gap_start;
+};
--- linux-rt-2.6.31.orig/ubuntu/lirc/lirc_i2c/Makefile
+++ linux-rt-2.6.31/ubuntu/lirc/lirc_i2c/Makefile
@@ -0,0 +1,3 @@
+EXTRA_CFLAGS =-DIRCTL_DEV_MAJOR=61 -DLIRC_SERIAL_TRANSMITTER -DLIRC_SERIAL_SOFTCARRIER -I$(src)/..
+
+obj-$(CONFIG_LIRC_I2C)		+= lirc_i2c.o
--- linux-rt-2.6.31.orig/ubuntu/lirc/lirc_i2c/lirc_i2c.c
+++ linux-rt-2.6.31/ubuntu/lirc/lirc_i2c/lirc_i2c.c
@@ -0,0 +1,779 @@
+/*      $Id: lirc_i2c.c,v 1.70 2009/08/30 16:59:53 jarodwilson Exp $      */
+
+/*
+ * lirc_i2c.c
+ *
+ * i2c IR driver for the onboard IR port on many TV tuner cards, including:
+ *  -Flavors of the Hauppauge PVR-150/250/350
+ *  -Hauppauge HVR-1300
+ *  -PixelView (BT878P+W/FM)
+ *  -KNC ONE TV Station/Anubis Typhoon TView Tuner
+ *  -Asus TV-Box and Creative/VisionTek BreakOut-Box
+ *  -Leadtek Winfast PVR2000
+ *
+ * Copyright (c) 2000 Gerd Knorr <kraxel@goldbach.in-berlin.de>
+ * modified for PixelView (BT878P+W/FM) by
+ *      Michal Kochanowicz <mkochano@pld.org.pl>
+ *      Christoph Bartelmus <lirc@bartelmus.de>
+ * modified for KNC ONE TV Station/Anubis Typhoon TView Tuner by
+ *      Ulrich Mueller <ulrich.mueller42@web.de>
+ * modified for Asus TV-Box and Creative/VisionTek BreakOut-Box by
+ *      Stefan Jahn <stefan@lkcc.org>
+ * modified for inclusion into kernel sources by
+ *      Jerome Brock <jbrock@users.sourceforge.net>
+ * modified for Leadtek Winfast PVR2000 by
+ *      Thomas Reitmayr (treitmayr@yahoo.com)
+ * modified for Hauppauge HVR-1300 by
+ *      Jan Frey (jfrey@gmx.de)
+ *
+ * parts are cut&pasted from the old lirc_haup.c driver
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#include <linux/version.h>
+#include <linux/module.h>
+#include <linux/kmod.h>
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/string.h>
+#include <linux/timer.h>
+#include <linux/delay.h>
+#include <linux/errno.h>
+#include <linux/slab.h>
+#include <linux/i2c.h>
+#include <linux/i2c-algo-bit.h>
+
+#include "../kcompat.h"
+#include "../lirc_dev/lirc_dev.h"
+
+struct IR {
+	struct lirc_driver l;
+	struct i2c_client  c;
+	int nextkey;
+	unsigned char b[3];
+	unsigned char bits;
+	unsigned char flag;
+};
+
+#define DEVICE_NAME "lirc_i2c"
+
+/* module parameters */
+static int debug;	/* debug output */
+static int minor = -1;	/* minor number */
+
+#define dprintk(fmt, args...)						\
+	do {								\
+		if (debug)						\
+			printk(KERN_DEBUG DEVICE_NAME ": " fmt,		\
+			       ## args);				\
+	} while (0)
+
+static int reverse(int data, int bits)
+{
+	int i;
+	int c;
+
+	for (c = 0, i = 0; i < bits; i++)
+		c |= ((data & (1<<i)) ? 1 : 0) << (bits-1-i);
+
+	return c;
+}
+
+static int add_to_buf_adap(void *data, struct lirc_buffer *buf)
+{
+	struct IR *ir = data;
+	unsigned char keybuf[4];
+
+	keybuf[0] = 0x00;
+	i2c_master_send(&ir->c, keybuf, 1);
+	/* poll IR chip */
+	if (i2c_master_recv(&ir->c, keybuf, sizeof(keybuf)) != sizeof(keybuf)) {
+		dprintk("read error\n");
+		return -EIO;
+	}
+
+	dprintk("key (0x%02x%02x%02x%02x)\n",
+		keybuf[0], keybuf[1], keybuf[2], keybuf[3]);
+
+	/* key pressed ? */
+	if (keybuf[2] == 0xff)
+		return -ENODATA;
+
+	/* remove repeat bit */
+	keybuf[2] &= 0x7f;
+	keybuf[3] |= 0x80;
+
+	lirc_buffer_write(buf, keybuf);
+	return 0;
+}
+
+static int add_to_buf_pcf8574(void *data, struct lirc_buffer *buf)
+{
+	struct IR *ir = data;
+	int rc;
+	unsigned char all, mask;
+	unsigned char key;
+
+	/* compute all valid bits (key code + pressed/release flag) */
+	all = ir->bits | ir->flag;
+
+	/* save IR writable mask bits */
+	mask = i2c_smbus_read_byte(&ir->c) & ~all;
+
+	/* send bit mask */
+	rc = i2c_smbus_write_byte(&ir->c, (0xff & all) | mask);
+
+	/* receive scan code */
+	rc = i2c_smbus_read_byte(&ir->c);
+
+	if (rc == -1) {
+		dprintk("%s read error\n", ir->c.name);
+		return -EIO;
+	}
+
+	/* drop duplicate polls */
+	if (ir->b[0] == (rc & all))
+		return -ENODATA;
+
+	ir->b[0] = rc & all;
+
+	dprintk("%s key 0x%02X %s\n", ir->c.name, rc & ir->bits,
+		(rc & ir->flag) ? "released" : "pressed");
+
+	/* ignore released buttons */
+	if (rc & ir->flag)
+		return -ENODATA;
+
+	/* set valid key code */
+	key  = rc & ir->bits;
+	lirc_buffer_write(buf, &key);
+	return 0;
+}
+
+/* common for Hauppauge IR receivers */
+static int add_to_buf_haup_common(void *data, struct lirc_buffer *buf,
+		unsigned char *keybuf, int size, int offset)
+{
+	struct IR *ir = data;
+	__u16 code;
+	unsigned char codes[2];
+	int ret;
+
+	/* poll IR chip */
+	ret = i2c_master_recv(&ir->c, keybuf, size);
+	if (ret == size) {
+		ir->b[0] = keybuf[offset];
+		ir->b[1] = keybuf[offset+1];
+		ir->b[2] = keybuf[offset+2];
+		if (ir->b[0] != 0x00 && ir->b[1] != 0x00)
+			dprintk("key (0x%02x/0x%02x)\n", ir->b[0], ir->b[1]);
+	} else {
+		dprintk("read error (ret=%d)\n", ret);
+		/* keep last successful read buffer */
+	}
+
+	/* key pressed ? */
+	if ((ir->b[0] & 0x80) == 0)
+		return -ENODATA;
+
+	/* look what we have */
+	code = (((__u16)ir->b[0]&0x7f)<<6) | (ir->b[1]>>2);
+
+	codes[0] = (code >> 8) & 0xff;
+	codes[1] = code & 0xff;
+
+	/* return it */
+	dprintk("sending code 0x%02x%02x to lirc\n", codes[0], codes[1]);
+	lirc_buffer_write(buf, codes);
+	return 0;
+}
+
+/* specific for the Hauppauge PVR150 IR receiver */
+static int add_to_buf_haup_pvr150(void *data, struct lirc_buffer *buf)
+{
+	unsigned char keybuf[6];
+	/* fetch 6 bytes, first relevant is at offset 3 */
+	return add_to_buf_haup_common(data, buf, keybuf, 6, 3);
+}
+
+/* used for all Hauppauge IR receivers but the PVR150 */
+static int add_to_buf_haup(void *data, struct lirc_buffer *buf)
+{
+	unsigned char keybuf[3];
+	/* fetch 3 bytes, first relevant is at offset 0 */
+	return add_to_buf_haup_common(data, buf, keybuf, 3, 0);
+}
+
+
+static int add_to_buf_pvr2000(void *data, struct lirc_buffer *buf)
+{
+	struct IR *ir = data;
+	unsigned char key;
+	s32 flags;
+	s32 code;
+
+	/* poll IR chip */
+	flags = i2c_smbus_read_byte_data(&ir->c, 0x10);
+	if (-1 == flags) {
+		dprintk("read error\n");
+		return -ENODATA;
+	}
+	/* key pressed ? */
+	if (0 == (flags & 0x80))
+		return -ENODATA;
+
+	/* read actual key code */
+	code = i2c_smbus_read_byte_data(&ir->c, 0x00);
+	if (-1 == code) {
+		dprintk("read error\n");
+		return -ENODATA;
+	}
+
+	key = code & 0xFF;
+
+	dprintk("IR Key/Flags: (0x%02x/0x%02x)\n", key, flags & 0xFF);
+
+	/* return it */
+	lirc_buffer_write(buf, &key);
+	return 0;
+}
+
+static int add_to_buf_pixelview(void *data, struct lirc_buffer *buf)
+{
+	struct IR *ir = data;
+	unsigned char key;
+
+	/* poll IR chip */
+	if (1 != i2c_master_recv(&ir->c, &key, 1)) {
+		dprintk("read error\n");
+		return -1;
+	}
+	dprintk("key %02x\n", key);
+
+	/* return it */
+	lirc_buffer_write(buf, &key);
+	return 0;
+}
+
+static int add_to_buf_pv951(void *data, struct lirc_buffer *buf)
+{
+	struct IR *ir = data;
+	unsigned char key;
+	unsigned char codes[4];
+
+	/* poll IR chip */
+	if (1 != i2c_master_recv(&ir->c, &key, 1)) {
+		dprintk("read error\n");
+		return -ENODATA;
+	}
+	/* ignore 0xaa */
+	if (key == 0xaa)
+		return -ENODATA;
+	dprintk("key %02x\n", key);
+
+	codes[0] = 0x61;
+	codes[1] = 0xD6;
+	codes[2] = reverse(key, 8);
+	codes[3] = (~codes[2])&0xff;
+
+	lirc_buffer_write(buf, codes);
+	return 0;
+}
+
+static int add_to_buf_knc1(void *data, struct lirc_buffer *buf)
+{
+	static unsigned char last_key = 0xFF;
+	struct IR *ir = data;
+	unsigned char key;
+
+	/* poll IR chip */
+	if (1 != i2c_master_recv(&ir->c, &key, 1)) {
+		dprintk("read error\n");
+		return -ENODATA;
+	}
+
+	/*
+	 * it seems that 0xFE indicates that a button is still held
+	 * down, while 0xFF indicates that no button is held
+	 * down. 0xFE sequences are sometimes interrupted by 0xFF
+	 */
+
+	dprintk("key %02x\n", key);
+
+	if (key == 0xFF)
+		return -ENODATA;
+
+	if (key == 0xFE)
+		key = last_key;
+
+	last_key = key;
+	lirc_buffer_write(buf, &key);
+
+	return 0;
+}
+
+static int set_use_inc(void *data)
+{
+	struct IR *ir = data;
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 25)
+	int ret;
+#endif
+
+	dprintk("%s called\n", __func__);
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25)
+	i2c_use_client(&ir->c);
+#else
+	/* lock bttv in memory while /dev/lirc is in use  */
+	ret = i2c_use_client(&ir->c);
+	if (ret != 0)
+		return ret;
+#endif
+
+	MOD_INC_USE_COUNT;
+	return 0;
+}
+
+static void set_use_dec(void *data)
+{
+	struct IR *ir = data;
+
+	dprintk("%s called\n", __func__);
+
+	i2c_release_client(&ir->c);
+	MOD_DEC_USE_COUNT;
+}
+
+static struct lirc_driver lirc_template = {
+	.name		= "lirc_i2c",
+	.set_use_inc	= set_use_inc,
+	.set_use_dec	= set_use_dec,
+	.dev		= NULL,
+	.owner		= THIS_MODULE,
+};
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 31)
+static int ir_attach(struct i2c_adapter *adap, int addr,
+		      unsigned short flags, int kind);
+static int ir_probe(struct i2c_adapter *adap);
+# else
+static int ir_probe(struct i2c_client *client, const struct i2c_device_id *id);
+#endif
+static int ir_remove(struct i2c_client *client);
+static int ir_command(struct i2c_client *client, unsigned int cmd, void *arg);
+
+#if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 30)
+static const struct i2c_device_id ir_receiver_id[] = {
+	/* Generic entry for any IR receiver */
+	{ "ir_video", 0 },
+	/* IR device specific entries could be added here */
+	{ }
+};
+#endif
+
+static struct i2c_driver driver = {
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 16)
+	.name		= "i2c ir driver",
+	.flags		= I2C_DF_NOTIFY,
+#else
+	.driver = {
+		.owner	= THIS_MODULE,
+		.name	= "i2c ir driver",
+	},
+#endif
+	.id		= I2C_DRIVERID_EXP3, /* FIXME */
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 31)
+	.attach_adapter	= ir_probe,
+	.detach_client	= ir_remove,
+#else
+	.probe		= ir_probe,
+	.remove		= ir_remove,
+	.id_table	= ir_receiver_id,
+#endif
+	.command	= ir_command,
+};
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 31)
+static struct i2c_client client_template = {
+	.name		= "unset",
+	.driver		= &driver
+};
+#endif
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 31)
+static int ir_attach(struct i2c_adapter *adap, int addr,
+		     unsigned short flags, int kind)
+#else
+static void pcf_probe(struct i2c_client *client, struct IR *ir)
+{
+	int ret1, ret2, ret3, ret4;
+
+	ret1 = i2c_smbus_write_byte(client, 0xff);
+	ret2 = i2c_smbus_read_byte(client);
+	ret3 = i2c_smbus_write_byte(client, 0x00);
+	ret4 = i2c_smbus_read_byte(client);
+
+	/* in the Asus TV-Box: bit 1-0 */
+	if (((ret2 & 0x03) == 0x03) && ((ret4 & 0x03) == 0x00)) {
+		ir->bits = (unsigned char) ~0x07;
+		ir->flag = 0x04;
+	/* in the Creative/VisionTek BreakOut-Box: bit 7-6 */
+	} else if (((ret2 & 0xc0) == 0xc0) && ((ret4 & 0xc0) == 0x00)) {
+		ir->bits = (unsigned char) ~0xe0;
+		ir->flag = 0x20;
+	}
+
+	return;
+}
+
+static int ir_probe(struct i2c_client *client, const struct i2c_device_id *id)
+#endif
+{
+	struct IR *ir;
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 31)
+	int err, retval;
+
+	client_template.adapter = adap;
+	client_template.addr = addr;
+#else
+	struct i2c_adapter *adap = client->adapter;
+	unsigned short addr = client->addr;
+	int retval;
+#endif
+
+	ir = kmalloc(sizeof(struct IR), GFP_KERNEL);
+	if (!ir)
+		return -ENOMEM;
+	memcpy(&ir->l, &lirc_template, sizeof(struct lirc_driver));
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 31)
+	memcpy(&ir->c, &client_template, sizeof(struct i2c_client));
+
+	ir->c.adapter = adap;
+	ir->c.addr    = addr;
+	i2c_set_clientdata(&ir->c, ir);
+#else
+	memcpy(&ir->c, client, sizeof(struct i2c_client));
+
+	i2c_set_clientdata(client, ir);
+#endif
+	ir->l.data    = ir;
+	ir->l.minor   = minor;
+	ir->l.sample_rate = 10;
+	ir->l.dev     = &ir->c.dev;
+	ir->nextkey   = -1;
+
+	switch (addr) {
+	case 0x64:
+		strlcpy(ir->c.name, "Pixelview IR", I2C_NAME_SIZE);
+		ir->l.code_length = 8;
+		ir->l.add_to_buf = add_to_buf_pixelview;
+		break;
+	case 0x4b:
+		strlcpy(ir->c.name, "PV951 IR", I2C_NAME_SIZE);
+		ir->l.code_length = 32;
+		ir->l.add_to_buf = add_to_buf_pv951;
+		break;
+	case 0x71:
+#ifdef I2C_HW_B_CX2341X
+		if (adap->id == (I2C_ALGO_BIT | I2C_HW_B_BT848) ||
+		    adap->id == (I2C_ALGO_BIT | I2C_HW_B_CX2341X)) {
+#else
+		if (adap->id == (I2C_ALGO_BIT | I2C_HW_B_BT848)) {
+#endif
+			/*
+			 * The PVR150 IR receiver uses the same protocol as
+			 * other Hauppauge cards, but the data flow is
+			 * different, so we need to deal with it by its own.
+			 */
+			strlcpy(ir->c.name, "Hauppauge PVR150", I2C_NAME_SIZE);
+		} else /* I2C_HW_B_CX2388x */
+			strlcpy(ir->c.name, "Hauppauge HVR1300", I2C_NAME_SIZE);
+		ir->l.code_length = 13;
+		ir->l.add_to_buf = add_to_buf_haup_pvr150;
+		break;
+	case 0x6b:
+		strlcpy(ir->c.name, "Adaptec IR", I2C_NAME_SIZE);
+		ir->l.code_length = 32;
+		ir->l.add_to_buf = add_to_buf_adap;
+		break;
+	case 0x18:
+	case 0x1a:
+#ifdef I2C_HW_B_CX2341X
+		if (adap->id == (I2C_ALGO_BIT | I2C_HW_B_BT848) ||
+		    adap->id == (I2C_ALGO_BIT | I2C_HW_B_CX2341X)) {
+#else
+		if (adap->id == (I2C_ALGO_BIT | I2C_HW_B_BT848)) {
+#endif
+			strlcpy(ir->c.name, "Hauppauge IR", I2C_NAME_SIZE);
+			ir->l.code_length = 13;
+			ir->l.add_to_buf = add_to_buf_haup;
+		} else { /* I2C_HW_B_CX2388x */
+			strlcpy(ir->c.name, "Leadtek IR", I2C_NAME_SIZE);
+			ir->l.code_length = 8;
+			ir->l.add_to_buf = add_to_buf_pvr2000;
+		}
+		break;
+	case 0x30:
+		strlcpy(ir->c.name, "KNC ONE IR", I2C_NAME_SIZE);
+		ir->l.code_length = 8;
+		ir->l.add_to_buf = add_to_buf_knc1;
+		break;
+	case 0x21:
+	case 0x23:
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 31)
+		ir->bits = flags & 0xff;
+		ir->flag = (flags >> 8) & 0xff;
+#else
+		pcf_probe(client, ir);
+#endif
+		strlcpy(ir->c.name, "TV-Box IR", I2C_NAME_SIZE);
+		ir->l.code_length = 8;
+		ir->l.add_to_buf = add_to_buf_pcf8574;
+		break;
+	default:
+		/* shouldn't happen */
+		printk("lirc_i2c: Huh? unknown i2c address (0x%02x)?\n", addr);
+		kfree(ir);
+		return -EINVAL;
+	}
+	printk(KERN_INFO "lirc_i2c: chip 0x%x found @ 0x%02x (%s)\n",
+	       adap->id, addr, ir->c.name);
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 31)
+	/* register device */
+	err = i2c_attach_client(&ir->c);
+	if (err) {
+		kfree(ir);
+		return err;
+	}
+#endif
+
+	retval = lirc_register_driver(&ir->l);
+
+	if (retval < 0) {
+		printk(KERN_ERR "lirc_i2c: failed to register driver!\n");
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 31)
+		i2c_detach_client(&ir->c);
+#endif
+		kfree(ir);
+		return retval;
+	}
+
+	ir->l.minor = retval;
+
+	return 0;
+}
+
+static int ir_remove(struct i2c_client *client)
+{
+	struct IR *ir = i2c_get_clientdata(client);
+
+	/* unregister device */
+	lirc_unregister_driver(ir->l.minor);
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 31)
+	i2c_detach_client(&ir->c);
+#endif
+
+	/* free memory */
+	kfree(ir);
+	return 0;
+}
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 31)
+static int ir_probe(struct i2c_adapter *adap)
+{
+	/*
+	 * The external IR receiver is at i2c address 0x34 (0x35 for
+	 * reads).  Future Hauppauge cards will have an internal
+	 * receiver at 0x30 (0x31 for reads).  In theory, both can be
+	 * fitted, and Hauppauge suggest an external overrides an
+	 * internal.
+	 *
+	 * That's why we probe 0x1a (~0x34) first. CB
+	 *
+	 * The i2c address for the Hauppauge PVR-150 card is 0xe2,
+	 * so we need to probe 0x71 as well.
+	 */
+
+	static const int probe[] = {
+		0x1a, /* Hauppauge IR external */
+		0x18, /* Hauppauge IR internal */
+		0x71, /* Hauppauge IR (PVR150) */
+		0x4b, /* PV951 IR */
+		0x64, /* Pixelview IR */
+		0x30, /* KNC ONE IR */
+		0x6b, /* Adaptec IR */
+		-1};
+
+#ifdef I2C_HW_B_CX2388x
+	static const int probe_cx88[] = {
+		0x18, /* Leadtek Winfast PVR2000 */
+		0x71, /* Hauppauge HVR-IR */
+		-1};
+#endif
+
+	struct i2c_client c;
+	char buf;
+	int i, rc;
+
+	memset(&c, 0, sizeof(c));
+#ifdef I2C_HW_B_CX2341X
+	if (adap->id == (I2C_ALGO_BIT | I2C_HW_B_BT848) ||
+	    adap->id == (I2C_ALGO_BIT | I2C_HW_B_CX2341X)) {
+#else
+	if (adap->id == (I2C_ALGO_BIT | I2C_HW_B_BT848)) {
+#endif
+		c.adapter = adap;
+		for (i = 0; -1 != probe[i]; i++) {
+			c.addr = probe[i];
+			rc = i2c_master_recv(&c, &buf, 1);
+			dprintk("probe 0x%02x @ %s: %s\n",
+				probe[i], adap->name,
+				(1 == rc) ? "yes" : "no");
+			if (1 == rc) {
+				rc = ir_attach(adap, probe[i], 0, 0);
+				if (rc < 0)
+					goto attach_fail;
+			}
+		}
+	}
+
+#ifdef I2C_HW_B_CX2388x
+	/* Leadtek Winfast PVR2000 or Hauppauge HVR-1300 */
+	else if (adap->id == (I2C_ALGO_BIT | I2C_HW_B_CX2388x)) {
+		c.adapter = adap;
+		for (i = 0; -1 != probe_cx88[i]; i++) {
+			c.addr = probe_cx88[i];
+			rc = i2c_master_recv(&c, &buf, 1);
+			dprintk("probe 0x%02x @ %s: %s\n",
+				c.addr, adap->name,
+				(1 == rc) ? "yes" : "no");
+			if (1 == rc) {
+				rc = ir_attach(adap, c.addr, 0, 0);
+				if (rc < 0)
+					goto attach_fail;
+			}
+		}
+	}
+#endif
+
+	/* Asus TV-Box and Creative/VisionTek BreakOut-Box (PCF8574) */
+	else if (adap->id == (I2C_ALGO_BIT | I2C_HW_B_RIVA)) {
+		/*
+		 * addresses to probe;
+		 * leave 0x24 and 0x25 because SAA7113H possibly uses it
+		 * 0x21 and 0x22 possibly used by SAA7108E
+		 * Asus:      0x21 is a correct address (channel 1 of PCF8574)
+		 * Creative:  0x23 is a correct address (channel 3 of PCF8574)
+		 * VisionTek: 0x23 is a correct address (channel 3 of PCF8574)
+		 */
+		static const int pcf_probe[] = { 0x20, 0x21, 0x22, 0x23,
+						 0x24, 0x25, 0x26, 0x27, -1 };
+		int ret1, ret2, ret3, ret4;
+		unsigned char bits = 0, flag = 0;
+
+		c.adapter = adap;
+		for (i = 0; -1 != pcf_probe[i]; i++) {
+			c.addr = pcf_probe[i];
+			ret1 = i2c_smbus_write_byte(&c, 0xff);
+			ret2 = i2c_smbus_read_byte(&c);
+			ret3 = i2c_smbus_write_byte(&c, 0x00);
+			ret4 = i2c_smbus_read_byte(&c);
+
+			/* ensure that the writable bitmask works correctly */
+			rc = 0;
+			if (ret1 != -1 && ret2 != -1 &&
+			    ret3 != -1 && ret4 != -1) {
+				/* in the Asus TV-Box: bit 1-0 */
+				if (((ret2 & 0x03) == 0x03) &&
+				    ((ret4 & 0x03) == 0x00)) {
+					bits = (unsigned char) ~0x07;
+					flag = 0x04;
+					rc = 1;
+				}
+			/* in the Creative/VisionTek BreakOut-Box: bit 7-6 */
+				if (((ret2 & 0xc0) == 0xc0) &&
+				    ((ret4 & 0xc0) == 0x00)) {
+					bits = (unsigned char) ~0xe0;
+					flag = 0x20;
+					rc = 1;
+				}
+			}
+			dprintk("probe 0x%02x @ %s: %s\n",
+				c.addr, adap->name, rc ? "yes" : "no");
+			if (rc) {
+				rc = ir_attach(adap, pcf_probe[i],
+					       bits | (flag << 8), 0);
+				if (rc < 0)
+					goto attach_fail;
+			}
+		}
+	}
+
+	return 0;
+
+attach_fail:
+	printk(KERN_ERR "lirc_i2c: %s: ir_attach failed!\n", __func__);
+	return rc;
+
+}
+#endif
+
+static int ir_command(struct i2c_client *client, unsigned int cmd, void *arg)
+{
+	/* nothing */
+	return 0;
+}
+
+#ifdef MODULE
+
+static int __init lirc_i2c_init(void)
+{
+	request_module("bttv");
+	request_module("rivatv");
+	request_module("ivtv");
+	request_module("cx8800");
+	i2c_add_driver(&driver);
+	return 0;
+}
+
+static void __exit lirc_i2c_exit(void)
+{
+	i2c_del_driver(&driver);
+}
+
+MODULE_DESCRIPTION("Infrared receiver driver for Hauppauge and "
+		   "Pixelview cards (i2c stack)");
+MODULE_AUTHOR("Gerd Knorr, Michal Kochanowicz, Christoph Bartelmus, "
+	      "Ulrich Mueller, Stefan Jahn, Jerome Brock");
+MODULE_LICENSE("GPL");
+
+module_param(minor, int, S_IRUGO);
+MODULE_PARM_DESC(minor, "Preferred minor device number");
+
+module_param(debug, bool, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(debug, "Enable debugging messages");
+
+module_init(lirc_i2c_init);
+module_exit(lirc_i2c_exit);
+EXPORT_NO_SYMBOLS;
+
+#endif /* MODULE */
--- linux-rt-2.6.31.orig/ubuntu/lirc/lirc_wpc8769l/lirc_wpc8769l.h
+++ linux-rt-2.6.31/ubuntu/lirc/lirc_wpc8769l/lirc_wpc8769l.h
@@ -0,0 +1,186 @@
+/*      $Id: lirc_wpc8769l.h,v 1.5 2009/06/15 15:11:39 jarodwilson Exp $      */
+
+/****************************************************************************
+ ** lirc_wpc8769l.h ****************************************************
+ ****************************************************************************
+ *
+ * lirc_wpc8769l - Device driver for the integrated CIR receiver found in
+ *                 Acer Aspire 6530G (and probably other models), based on
+ *                 the Winbond 8769L embedded controller.
+ *                 (Written using the lirc_serial driver as a guide).
+ *
+ * Copyright (C) 2008, 2009 Juan J. Garcia de Soria <skandalfo@gmail.com>
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *
+ */
+
+#include <linux/types.h>
+
+/* Name of the ACPI resource used to autodetect the receiver. */
+#define WPC8769L_ACPI_HID "WEC1020"
+
+/* Number of microseconds for a whole byte of samples. */
+/* This is assuming 20 kHz bit sampling frequency.     */
+#define WPC8769L_USECS_PER_BYTE 400
+
+/* Number of microseconds for a bit sample. */
+#define WPC8769L_USECS_PER_BIT (WPC8769L_USECS_PER_BYTE >> 3)
+
+/* Number of bytes in each data burst. */
+#define WPC8769L_BYTES_PER_BURST 14
+
+/* Number of 0xff bytes before reset. */
+#define WPC8769L_FF_BYTES_BEFORE_RESET 250
+
+/* Microseconds timeout for last part of code. */
+#define WPC8769L_LAST_TIMEOUT_JIFFIES (HZ / 20)
+
+/* Microseconds timeout for last part of code. */
+#define WPC8769L_LAST_TIMEOUT_JIFFIES (HZ / 20)
+
+/* Size of I/O region 1. */
+#define WPC8769L_IO_REGION_1_SIZE 0x08
+
+/* Size of I/O region 2. */
+#define WPC8769L_IO_REGION_2_SIZE 0x20
+
+/* Size of a byte array for a complete burst, rounded
+ * up to an integral number of unsigned longs. */
+#define WPC8769L_BYTE_BUFFER_SIZE \
+	(((WPC8769L_BYTES_PER_BURST + 1 + BITS_PER_LONG / 8 - 1) \
+	/ (BITS_PER_LONG / 8)) * (BITS_PER_LONG / 8))
+
+
+
+/* WPC8769L register set definitions. Note that these are all wild guesses.*/
+
+/* Registers for I/O range 1. */
+#define WPC8769L_SELECT_REG			0x03
+
+/*------------*/
+#define WPC8769L_BANK_00			0x00
+
+#define WPC8769L_DATA_REG			0x00
+
+#define WPC8769L_INTERRUPT_REG			0x01
+#define WPC8769L_INTERRUPT_1_MASK		0x01
+#define WPC8769L_INTERRUPT_2_MASK		0x01
+
+#define WPC8769L_DATA_STATUS_REG		0x02
+#define WPC8769L_DATA_READY_MASK		0x01
+#define WPC8769L_DATA_STATUS_MASK_1		0x02
+#define WPC8769L_DATA_STATUS_MASK_2		0xd0
+
+#define WPC8769L_CONFIG_REG			0x04
+#define WPC8769L_CONFIG_OFF_MASK		0xe0
+#define WPC8769L_CONFIG_ON_MASK			0xc0
+
+#define WPC8769L_DATA_ACK_REG			0x05
+#define WPC8769L_DATA_ACK_MASK			0x01
+
+#define WPC8769L_TIMEOUT_RESET_REG		0x07
+#define WPC8769L_TIMEOUT_RESET_MASK		0x20
+
+/*------------*/
+#define WPC8769L_BANK_E0			0xe0
+
+#define WPC8769L_CONFIG6_REG			0x00
+#define WPC8769L_CONFIG6_MASK			0x4b
+
+#define WPC8769L_CONFIG7_REG			0x01
+
+#define WPC8769L_HARDWARE_ENABLE1_REG		0x02
+#define WPC8769L_HARDWARE_ENABLE1_MASK		0x01
+
+#define WPC8769L_CONFIG5_REG			0x04
+#define WPC8769L_CONFIG5_ON_MASK		0x30
+
+#define WPC8769L_REMAINING_RX_DATA_REG		0x07
+
+/*------------*/
+#define WPC8769L_BANK_E4			0xe4
+
+#define WPC8769L_READ_ON_STARTUP_REG		0x00
+
+/*------------*/
+#define WPC8769L_BANK_EC			0xec
+
+#define WPC8769L_CONFIG3_REG			0x04
+#define WPC8769L_CONFIG3_ON_MASK		0x01
+#define WPC8769L_CONFIG3_MASK_1			0x10
+
+/*------------*/
+#define WPC8769L_BANK_F0			0xf0
+
+#define WPC8769L_WAKEUP_STATUS_LEG_REG		0x02
+#define WPC8769L_WAKEUP_STATUS_LEG_MASK		0x04
+#define WPC8769L_WAKEUP_STATUS_LEG_MASK_A	0x02
+#define WPC8769L_WAKEUP_STATUS_LEG_MASK_B	0x08
+
+/*------------*/
+#define WPC8769L_BANK_F4			0xf4
+
+#define WPC8769L_CONFIG9_REG			0x01
+
+#define WPC8769L_CONFIG4_REG			0x02
+#define WPC8769L_CONFIG4_AND_MASK		0x0f
+#define WPC8769L_CONFIG4_ON_MASK		0x50
+
+#define WPC8769L_CONFIG8_REG			0x04
+
+#define WPC8769L_CONFIG2_REG			0x07
+#define WPC8769L_CONFIG2_OFF_MASK		0x20
+#define WPC8769L_CONFIG2_MASK_1			0x10
+
+
+/* Registers for I/O range 2. */
+#define WPC8769L_WAKEUP_ACK_REG			0x00
+#define WPC8769L_WAKEUP_ACK_MASK		0x10
+
+#define WPC8769L_WAKEUP_ENABLE_REG		0x02
+#define WPC8769L_WAKEUP_ENABLE_MASK		0x10
+
+#define WPC8769L_BANK2_CLOCK_REG		0x04
+#define WPC8769L_CLOCK_OFF_MASK			0x02
+#define WPC8769L_CLOCK_ON_MASK			0x01
+
+#define WPC8769L_WAKEUP_CONFIG_REG		0x1a
+#define WPC8769L_WAKEUP_CONFIG_PRE_MASK		0x80
+#define WPC8769L_MAX_INFO_BITS_BIAS		0x0e
+#define WPC8769L_MAX_INFO_BITS_SHIFT		0x01
+
+#define WPC8769L_WAKEUP_CONFIG3_REG		0x13
+#define WPC8769L_WAKEUP_CONFIG3_OFF_MASK	0x10
+#define WPC8769L_WAKEUP_CONFIG3_ON_MASK		0x21
+#define WPC8769L_WAKEUP_CONFIG3_A_SHIFT		0x01
+#define WPC8769L_WAKEUP_CONFIG3_A_MASK		0x03
+#define WPC8769L_WAKEUP_CONFIG3_B_SHIFT		0x03
+#define WPC8769L_WAKEUP_CONFIG3_B_MASK		0x01
+
+#define WPC8769L_WAKEUP_STATUS_REG		0x14
+#define WPC8769L_WAKEUP_WOKE_UP_MASK		0x01
+#define WPC8769L_WAKEUP_CONFIGURING_MASK	0x17
+
+#define WPC8769L_WAKEUP_CONFIG2_REG		0x15
+#define WPC8769L_WAKEUP_CONFIG2_AND_MASK	0xf9
+#define WPC8769L_WAKEUP_CONFIG2_OR_MASK		0x01
+
+#define WPC8769L_WAKEUP_DATA_PTR_REG		0x18
+#define WPC8769L_WAKEUP_DATA_BITS		0x20
+#define WPC8769L_WAKEUP_DATA_BASE		0x10
+#define WPC8769L_WAKEUP_MASK_BASE		0x20
+
+#define WPC8769L_WAKEUP_DATA_REG		0x19
+
--- linux-rt-2.6.31.orig/ubuntu/lirc/lirc_wpc8769l/Makefile
+++ linux-rt-2.6.31/ubuntu/lirc/lirc_wpc8769l/Makefile
@@ -0,0 +1,3 @@
+EXTRA_CFLAGS =-DIRCTL_DEV_MAJOR=61 -DLIRC_SERIAL_TRANSMITTER -DLIRC_SERIAL_SOFTCARRIER -I$(src)/..
+
+obj-$(CONFIG_LIRC_WPC8769l)	+= lirc_wpc8769l.o
--- linux-rt-2.6.31.orig/ubuntu/lirc/lirc_wpc8769l/lirc_wpc8769l.c
+++ linux-rt-2.6.31/ubuntu/lirc/lirc_wpc8769l/lirc_wpc8769l.c
@@ -0,0 +1,1179 @@
+/*      $Id: lirc_wpc8769l.c,v 1.8 2009/03/15 09:34:01 lirc Exp $      */
+
+/****************************************************************************
+ ** lirc_wpc8769l.c ****************************************************
+ ****************************************************************************
+ *
+ * lirc_wpc8769l - Device driver for the integrated CIR receiver found in
+ *                 Acer Aspire 6530G (and probably other models), based on
+ *                 the Winbond 8769L embedded controller.
+ *                 (Written using the lirc_serial driver as a guide).
+ *
+ * Copyright (C) 2008, 2009 Juan J. Garcia de Soria <skandalfo@gmail.com>
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *
+ */
+
+#ifdef HAVE_CONFIG_H
+# include <config.h>
+#endif
+
+#include <linux/version.h>
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 2, 18)
+#error "**********************************************************"
+#error " Sorry, this driver needs kernel version 2.2.18 or higher "
+#error "**********************************************************"
+#endif
+
+#include <linux/autoconf.h>
+
+#include <linux/module.h>
+#include <linux/errno.h>
+#include <linux/fs.h>
+#include <linux/interrupt.h>
+#include <linux/ioport.h>
+#include <linux/time.h>
+#include <linux/timer.h>
+#include <linux/types.h>
+#include <linux/poll.h>
+
+#include <linux/bitops.h>
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 16)
+#include <asm/io.h>
+#else
+#include <linux/io.h>
+#endif
+#include <linux/irq.h>
+
+#include <linux/acpi.h>
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 18)
+#include <linux/platform_device.h>
+#endif
+
+#include "../lirc.h"
+#include "../kcompat.h"
+#include "../lirc_dev/lirc_dev.h"
+
+#include "lirc_wpc8769l.h"
+
+/* Name of the lirc device. */
+#define LIRC_DRIVER_NAME "lirc_wpc8769l"
+
+#define dprintk(fmt, args...)					\
+	do {							\
+		if (debug)					\
+			printk(KERN_DEBUG LIRC_DRIVER_NAME ": "	\
+			       fmt, ## args);			\
+	} while (0)
+
+#define wprintk(fmt, args...)					\
+	do {							\
+			printk(KERN_WARN LIRC_DRIVER_NAME ": "	\
+			       fmt, ## args);			\
+	} while (0)
+
+#define eprintk(fmt, args...)					\
+	do {							\
+			printk(KERN_ERR LIRC_DRIVER_NAME ": "	\
+			       fmt, ## args);			\
+	} while (0)
+
+#define iprintk(fmt, args...)					\
+	do {							\
+			printk(KERN_INFO LIRC_DRIVER_NAME ": "	\
+			       fmt, ## args);			\
+	} while (0)
+
+/* Number of driver->lirc-dev buffer elements. */
+#define RBUF_LEN 256
+
+/* Number of 0xff bytes received in a row. */
+static unsigned int wpc8769l_ff_bytes_in_a_row;
+
+/* Hardware resource parameters. */
+static unsigned int baseport1;
+static unsigned int baseport2;
+static unsigned int irq;
+
+/* Debugging flag. */
+static int debug;
+
+/* If true, we skip ACPI autodetection and use the parameter-supplied I/O and
+ * IRQ. */
+static int skip_probe;
+
+/* Whether the device is open or not. */
+static int lirc_wpc8769l_is_open;
+
+/* Code disabled since it didn't seem to work with the test hardware. */
+/*#define LIRC_WPC8769L_WAKEUP*/
+#ifdef LIRC_WPC8769L_WAKEUP
+/* These parameters are taken from the driver for MS Windows Vista.
+ * The specific values used for your hardware may be found at this registry
+ * key:
+ *
+ * HKEY_LOCAL_MACHINE/CurrentControlSet/Services/Winbond CIR/PowerKey
+ */
+static int protocol_select = 2;
+static int max_info_bits = 24;
+static unsigned int rc_wakeup_code = 0x7ffffbf3;
+static unsigned int rc_wakeup_mask = 0xff000fff;
+#endif
+
+/* Resource allocation pointers. */
+static struct resource *wpc8769l_portblock1_resource;
+static struct resource *wpc8769l_portblock2_resource;
+
+/* Hardware related spinlock. */
+static DEFINE_SPINLOCK(wpc8769l_hw_spinlock);
+
+/* The buffer for ISR to bottom half data transfer. */
+static struct lirc_buffer rbuf;
+
+/* Bit-to-MODE2 coalescing helper variables. */
+static int last_was_pulse;
+static lirc_t last_counter;
+
+/* Microseconds after a timeout-triggered pulse. */
+static s64 lastus;
+
+/* Microseconds when the timer was started. */
+static s64 timerstartus;
+
+/* Put another pulse/space to the queue, checking for overruns. */
+static void put_item(lirc_t data)
+{
+	if (lirc_buffer_full(&rbuf)) {
+		if (printk_ratelimit())
+			eprintk("RX buffer overrun.\n");
+		return;
+	}
+	lirc_buffer_write(&rbuf, (void *) &data);
+}
+
+/* Put any accumulated pulse/space to userspace. */
+static void put_span(void)
+{
+	lirc_t data;
+	if (last_counter) {
+		/* Take the usecs length. */
+		data = last_counter;
+
+		/* Mark pulse or space. */
+		if (last_was_pulse)
+			data |= PULSE_BIT;
+
+		/* Put the span to the buffer. */
+		put_item(data);
+
+		/* Reset counter, in order to avoid emitting duplicate data. */
+		last_counter = 0;
+	}
+}
+
+/* Aggregate pulse time. */
+static void put_pulse_bit(lirc_t n)
+{
+	if (last_was_pulse) {
+		last_counter += n;
+		if (last_counter > PULSE_MASK)
+			last_counter = PULSE_MASK;
+	} else {
+		put_span();
+		last_was_pulse = 1;
+		last_counter = n;
+		if (last_counter > PULSE_MASK)
+			last_counter = PULSE_MASK;
+	}
+}
+
+/* Aggregate space time. */
+static void put_space_bit(lirc_t n)
+{
+	if (!last_was_pulse) {
+		last_counter += n;
+		if (last_counter > PULSE_MASK)
+			last_counter = PULSE_MASK;
+	} else {
+		put_span();
+		last_was_pulse = 0;
+		last_counter = n;
+		if (last_counter > PULSE_MASK)
+			last_counter = PULSE_MASK;
+	}
+}
+
+/* Timeout function for last pulse part. */
+static void wpc8769l_last_timeout(unsigned long l)
+{
+	struct timeval currenttv;
+
+	unsigned long flags;
+	spin_lock_irqsave(&wpc8769l_hw_spinlock, flags);
+
+	/* Mark the time at which we inserted the timeout span. */
+	do_gettimeofday(&currenttv);
+	lastus = ((s64) currenttv.tv_sec) * 1000000ll + currenttv.tv_usec;
+
+	/* Emit the timeout as a space. */
+	put_space_bit(lastus - timerstartus);
+
+	/* Signal the bottom half wait queue
+	 * that there's data available. */
+	wake_up_interruptible(&rbuf.wait_poll);
+
+	spin_unlock_irqrestore(&wpc8769l_hw_spinlock, flags);
+}
+
+/* Timer for end-of-code pulse timeout. */
+static struct timer_list last_span_timer =
+	TIMER_INITIALIZER(wpc8769l_last_timeout, 0, 0);
+
+/* Interrupt handler, doing the bit sample to mode2 conversion.
+ * Perhaps this work should be taken outside of the ISR... */
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 19)
+static irqreturn_t irq_handler(int irqno, void *blah)
+#else
+static irqreturn_t irq_handler(int irqno, void *blah, struct pt_regs *regs)
+#endif
+{
+	unsigned int data;
+	int handled = 0;
+	int count, more;
+	struct timeval currenttv;
+	s64 currentus, span;
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25)
+	unsigned char data_buf[WPC8769L_BYTE_BUFFER_SIZE];
+	unsigned char *data_ptr;
+	unsigned long *ldata;
+	unsigned int next_one, next_zero, size;
+#else
+	unsigned int mask;
+#endif
+
+	unsigned long flags;
+	spin_lock_irqsave(&wpc8769l_hw_spinlock, flags);
+
+	/* Check whether there's any data available. */
+	outb(WPC8769L_BANK_00, baseport1 + WPC8769L_SELECT_REG);
+	data = inb(baseport1 + WPC8769L_DATA_STATUS_REG);
+
+	if (data & WPC8769L_DATA_READY_MASK) {
+		/* Get current timestamp. */
+		do_gettimeofday(&currenttv);
+		currentus = ((s64) currenttv.tv_sec) * 1000000ll +
+			currenttv.tv_usec;
+
+		/* If we had a timeout before we might need to fill
+		 * in additional space time. */
+		if (lastus) {
+			/* Calculate the difference, compensating
+			 * the time for the data successfully
+			 * received (estimated to be
+			 * WPC8769L_BYTES_PER_BURST bytes). */
+			span = currentus - lastus
+					- WPC8769L_BYTES_PER_BURST
+					* WPC8769L_USECS_PER_BYTE;
+
+			/* Only insert positive spans. */
+			if (span > 0) {
+				/* Emit the extended gap as a space. */
+				put_space_bit(span);
+			}
+
+			/* Mark that we had the last timeout into account. */
+			lastus = 0;
+		}
+
+		count = 0;
+		more = 1;
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25)
+		data_ptr = data_buf;
+#endif
+		do {
+			/* Read the next byte of data. */
+			outb(WPC8769L_BANK_00, baseport1 + WPC8769L_SELECT_REG);
+			data = inb(baseport1 + WPC8769L_DATA_REG);
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25)
+			*data_ptr++ = data;
+#else
+			for (mask = 0x01 ; mask < 0x100; mask <<= 1) {
+				if (data & mask)
+					put_space_bit(WPC8769L_USECS_PER_BIT);
+				else
+					put_pulse_bit(WPC8769L_USECS_PER_BIT);
+			}
+#endif
+
+			/* Check for 0xff in a row. */
+			if (data == 0xff)
+				wpc8769l_ff_bytes_in_a_row++;
+			else
+				wpc8769l_ff_bytes_in_a_row = 0;
+
+			outb(WPC8769L_BANK_00, baseport1 + WPC8769L_SELECT_REG);
+			data = inb(baseport1 + WPC8769L_DATA_ACK_REG);
+			if (data & WPC8769L_DATA_ACK_REG) {
+				outb(WPC8769L_BANK_E0,
+					baseport1 + WPC8769L_SELECT_REG);
+				data = inb(baseport1 +
+					WPC8769L_REMAINING_RX_DATA_REG);
+				if (!data)
+					more = 0;
+			} else
+				more = 0;
+
+			count++;
+		} while (more && count < WPC8769L_BYTES_PER_BURST);
+
+		if (wpc8769l_ff_bytes_in_a_row
+			>= WPC8769L_FF_BYTES_BEFORE_RESET) {
+
+			/* Put in another 0xff byte. */
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25)
+			*data_ptr++ = 0xff;
+			count++;
+#else
+			put_space_bit(8 * WPC8769L_USECS_PER_BIT);
+#endif
+
+			/* Reset the hardware in the case of too many
+			 * 0xff bytes in a row. */
+			outb(WPC8769L_BANK_00, baseport1 + WPC8769L_SELECT_REG);
+			outb(WPC8769L_TIMEOUT_RESET_MASK,
+				baseport1 + WPC8769L_TIMEOUT_RESET_REG);
+		}
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25)
+		/* Emit the data. */
+		size = count << 3;
+
+		ldata = (unsigned long *) data_buf;
+		next_one = generic_find_next_le_bit(ldata, size, 0);
+
+		if (next_one > 0)
+			put_pulse_bit(next_one
+				* WPC8769L_USECS_PER_BIT);
+
+		while (next_one < size) {
+			next_zero = generic_find_next_zero_le_bit(ldata,
+				size, next_one + 1);
+
+			put_space_bit(
+				(next_zero - next_one)
+				* WPC8769L_USECS_PER_BIT);
+
+			if (next_zero < size) {
+				next_one = generic_find_next_le_bit(ldata,
+					size, next_zero + 1);
+
+				put_pulse_bit(
+					(next_one - next_zero)
+					* WPC8769L_USECS_PER_BIT);
+			} else {
+				next_one = size;
+			}
+		}
+#endif
+
+		/* Mark the IRQ as handled. */
+		handled = 1;
+
+		/* Signal the bottom half wait queue
+		 * that there's data available. */
+		wake_up_interruptible(&rbuf.wait_poll);
+
+		/* Set up timeout handling. */
+		mod_timer(&last_span_timer,
+			jiffies + WPC8769L_LAST_TIMEOUT_JIFFIES);
+
+		/* Set up last timer us mark. */
+		timerstartus = currentus;
+	}
+
+	spin_unlock_irqrestore(&wpc8769l_hw_spinlock, flags);
+	return IRQ_RETVAL(handled);
+}
+
+/* Prepare the hardware on module load. */
+static void wpc8769l_prepare_hardware(void)
+{
+	unsigned long flags;
+	spin_lock_irqsave(&wpc8769l_hw_spinlock, flags);
+
+	/* I don't know why this needs reading. */
+	outb(WPC8769L_BANK_E4, baseport1 + WPC8769L_SELECT_REG);
+	inb(baseport1 + WPC8769L_READ_ON_STARTUP_REG);
+
+	spin_unlock_irqrestore(&wpc8769l_hw_spinlock, flags);
+}
+
+
+/* Wake up device from power down and check whether it was the
+ * device that woke us up.
+ */
+static int wpc8769l_power_up_and_check_if_we_woke_us_up(void)
+{
+	unsigned int data;
+	int res;
+
+	unsigned long flags;
+	spin_lock_irqsave(&wpc8769l_hw_spinlock, flags);
+
+	if (baseport2) {
+		data = inb(baseport2 + WPC8769L_BANK2_CLOCK_REG);
+		data &= ~WPC8769L_CLOCK_OFF_MASK;
+		data |= WPC8769L_CLOCK_ON_MASK;
+		outb(data, baseport2 + WPC8769L_BANK2_CLOCK_REG);
+
+		res = inb(baseport2 + WPC8769L_WAKEUP_STATUS_REG)
+			& WPC8769L_WAKEUP_WOKE_UP_MASK;
+
+		data = inb(baseport2 + WPC8769L_BANK2_CLOCK_REG);
+		data &= ~WPC8769L_CLOCK_OFF_MASK;
+		data |= WPC8769L_CLOCK_ON_MASK;
+		outb(data, baseport2 + WPC8769L_BANK2_CLOCK_REG);
+
+		outb(WPC8769L_WAKEUP_WOKE_UP_MASK,
+			baseport2 + WPC8769L_WAKEUP_STATUS_REG);
+
+		outb(WPC8769L_WAKEUP_ACK_MASK,
+			baseport2 + WPC8769L_WAKEUP_ACK_REG);
+	} else {
+		outb(WPC8769L_BANK_F0, baseport1 + WPC8769L_SELECT_REG);
+		res = (inb(baseport1 + WPC8769L_WAKEUP_STATUS_LEG_REG)
+			& WPC8769L_WAKEUP_STATUS_LEG_MASK) ? 1 : 0;
+	}
+
+	spin_unlock_irqrestore(&wpc8769l_hw_spinlock, flags);
+
+	return res;
+}
+
+/* Disable interrupts from device. */
+static void wpc8769l_disable_interrupts(void)
+{
+	unsigned long flags;
+	spin_lock_irqsave(&wpc8769l_hw_spinlock, flags);
+
+	outb(WPC8769L_BANK_00, baseport1 + WPC8769L_SELECT_REG);
+	outb(WPC8769L_BANK_00, baseport1 + WPC8769L_SELECT_REG);
+	outb(inb(baseport1 + WPC8769L_INTERRUPT_REG)
+		& ~WPC8769L_INTERRUPT_1_MASK,
+		baseport1 + WPC8769L_INTERRUPT_REG);
+	outb(WPC8769L_BANK_00, baseport1 + WPC8769L_SELECT_REG);
+	outb(WPC8769L_BANK_00, baseport1 + WPC8769L_SELECT_REG);
+	outb(inb(baseport1 + WPC8769L_INTERRUPT_REG)
+		& ~WPC8769L_INTERRUPT_1_MASK,
+		baseport1 + WPC8769L_INTERRUPT_REG);
+
+	spin_unlock_irqrestore(&wpc8769l_hw_spinlock, flags);
+}
+
+#ifdef LIRC_WPC8769L_WAKEUP
+/* Expand value nibble for configuration of wake up parameters.
+ * This seems to manchester-encode a nibble into a byte. */
+static unsigned int wpc8769l_expand_value_nibble(unsigned int nibble)
+{
+	int i;
+	unsigned int tmp, tmp2, res;
+
+	res = 0;
+
+	for (i = 0; i < 4; i += 2) {
+		tmp = (nibble >> i) & 0x3;
+		switch (tmp) {
+		case 3:
+			tmp2 = 5;
+			break;
+		case 2:
+			tmp2 = 6;
+			break;
+		case 1:
+			tmp2 = 9;
+			break;
+		case 0:
+			tmp2 = 0x0a;
+			break;
+		default:
+			return 0;
+			break;
+		}
+		res |= ((tmp2 << i) << i);
+	}
+
+	return res;
+}
+
+/* Expand mask nibble for configuration of wake up parameters. */
+static unsigned int wpc8769l_expand_mask_nibble(unsigned int nibble)
+{
+	int i;
+	unsigned int tmp, tmp2, res;
+
+	res = 0;
+
+	for (i = 0; i < 4; i += 2) {
+		tmp = (nibble >> i) & 0x3;
+		switch (tmp) {
+		case 0:
+			tmp2 = 0;
+			break;
+		case 1:
+			tmp2 = 3;
+			break;
+		case 2:
+			tmp2 = 0x0c;
+			break;
+		case 3:
+			tmp2 = 0x0f;
+			break;
+		default:
+			return 0;
+			break;
+		}
+		res |= ((tmp2 << i) << i);
+	}
+
+	return res;
+}
+
+/* Configure wake up triggers for the hardware that supports it.
+ * THE CALLER MUST HAVE ACQUIRED wpc8769l_hw_spinlock BEFORE CALLING.
+ */
+static void wpc8769l_configure_wakeup_triggers(void)
+{
+	unsigned int x;
+	unsigned int data, data2;
+
+	int i, j;
+
+	x = inb(baseport2 + WPC8769L_WAKEUP_ENABLE_REG)
+		& WPC8769L_WAKEUP_ENABLE_MASK;
+	outb(inb(baseport2 + WPC8769L_WAKEUP_ENABLE_REG)
+		& ~WPC8769L_WAKEUP_ENABLE_MASK,
+		baseport2 + WPC8769L_WAKEUP_ENABLE_REG);
+
+	data = inb(baseport2 + WPC8769L_BANK2_CLOCK_REG);
+	data &= ~WPC8769L_CLOCK_OFF_MASK;
+	data |= WPC8769L_CLOCK_ON_MASK;
+	outb(data, baseport2 + WPC8769L_BANK2_CLOCK_REG);
+
+	outb(WPC8769L_WAKEUP_CONFIGURING_MASK,
+		baseport2 + WPC8769L_WAKEUP_STATUS_REG);
+	outb(WPC8769L_WAKEUP_ACK_MASK,
+		baseport2 + WPC8769L_WAKEUP_ACK_REG);
+
+	data = inb(baseport2 + WPC8769L_BANK2_CLOCK_REG);
+	data &= ~WPC8769L_CLOCK_OFF_MASK;
+	data |= WPC8769L_CLOCK_ON_MASK;
+	outb(data, baseport2 + WPC8769L_BANK2_CLOCK_REG);
+
+	data = inb(baseport2 + WPC8769L_BANK2_CLOCK_REG);
+	data &= ~WPC8769L_CLOCK_OFF_MASK;
+	data |= WPC8769L_CLOCK_ON_MASK;
+	outb(data, baseport2 + WPC8769L_BANK2_CLOCK_REG);
+
+	data = inb(baseport2 + WPC8769L_WAKEUP_CONFIG_REG);
+	data &= WPC8769L_WAKEUP_CONFIG_PRE_MASK;
+	data |= (max_info_bits + WPC8769L_MAX_INFO_BITS_BIAS)
+		<< WPC8769L_MAX_INFO_BITS_SHIFT;
+	outb(data, baseport2 + WPC8769L_WAKEUP_CONFIG_REG);
+
+	i = j = 0;
+
+	/* Program values. */
+	while (j < WPC8769L_WAKEUP_DATA_BITS) {
+		data = inb(baseport2 + WPC8769L_BANK2_CLOCK_REG);
+		data &= ~WPC8769L_CLOCK_OFF_MASK;
+		data |= WPC8769L_CLOCK_ON_MASK;
+		outb(data, baseport2 + WPC8769L_BANK2_CLOCK_REG);
+
+		outb(i + WPC8769L_WAKEUP_DATA_BASE,
+			baseport2 + WPC8769L_WAKEUP_DATA_PTR_REG);
+
+		data = inb(baseport2 + WPC8769L_BANK2_CLOCK_REG);
+		data &= ~WPC8769L_CLOCK_OFF_MASK;
+		data |= WPC8769L_CLOCK_ON_MASK;
+		outb(data, baseport2 + WPC8769L_BANK2_CLOCK_REG);
+
+		data = (rc_wakeup_code >> j) & 0x0f;
+		data = wpc8769l_expand_value_nibble(data);
+		outb(data, baseport2 + WPC8769L_WAKEUP_DATA_REG);
+
+		i++;
+		j += 4;
+	}
+
+	/* Program masks. */
+	while (j < WPC8769L_WAKEUP_DATA_BITS) {
+		data = inb(baseport2 + WPC8769L_BANK2_CLOCK_REG);
+		data &= ~WPC8769L_CLOCK_OFF_MASK;
+		data |= WPC8769L_CLOCK_ON_MASK;
+		outb(data, baseport2 + WPC8769L_BANK2_CLOCK_REG);
+
+		outb(i + WPC8769L_WAKEUP_MASK_BASE,
+			baseport2 + WPC8769L_WAKEUP_DATA_PTR_REG);
+
+		data = inb(baseport2 + WPC8769L_BANK2_CLOCK_REG);
+		data &= ~WPC8769L_CLOCK_OFF_MASK;
+		data |= WPC8769L_CLOCK_ON_MASK;
+		outb(data, baseport2 + WPC8769L_BANK2_CLOCK_REG);
+
+		data = (rc_wakeup_mask >> j) & 0x0f;
+		data = wpc8769l_expand_mask_nibble(data);
+		outb(data, baseport2 + WPC8769L_WAKEUP_DATA_REG);
+
+		i++;
+		j += 4;
+	}
+
+	data = inb(baseport2 + WPC8769L_BANK2_CLOCK_REG);
+	data &= ~WPC8769L_CLOCK_OFF_MASK;
+	data |= WPC8769L_CLOCK_ON_MASK;
+	outb(data, baseport2 + WPC8769L_BANK2_CLOCK_REG);
+
+	data2 = inb(baseport2 + WPC8769L_WAKEUP_CONFIG2_REG);
+	data2 &= WPC8769L_WAKEUP_CONFIG2_AND_MASK;
+	data2 |= WPC8769L_WAKEUP_CONFIG2_OR_MASK;
+
+	data = inb(baseport2 + WPC8769L_BANK2_CLOCK_REG);
+	data &= ~WPC8769L_CLOCK_OFF_MASK;
+	data |= WPC8769L_CLOCK_ON_MASK;
+	outb(data, baseport2 + WPC8769L_BANK2_CLOCK_REG);
+
+	outb(data2, baseport2 + WPC8769L_WAKEUP_CONFIG2_REG);
+
+	if (x != WPC8769L_WAKEUP_ENABLE_MASK)
+		outb(inb(baseport2 + WPC8769L_WAKEUP_ENABLE_REG)
+		| WPC8769L_WAKEUP_ENABLE_MASK,
+		baseport2 + WPC8769L_WAKEUP_ENABLE_REG);
+}
+#endif
+
+/* Enable interrupts from device. */
+static void wpc8769l_enable_interrupts(void)
+{
+	unsigned int data, data2, data_save;
+
+	unsigned int a, b;
+
+	unsigned long flags;
+	spin_lock_irqsave(&wpc8769l_hw_spinlock, flags);
+
+	outb(WPC8769L_BANK_F0, baseport1 + WPC8769L_SELECT_REG);
+	data_save = inb(baseport1 + WPC8769L_WAKEUP_STATUS_LEG_REG);
+
+	outb(WPC8769L_BANK_E0, baseport1 + WPC8769L_SELECT_REG);
+	outb(0, baseport1 + WPC8769L_HARDWARE_ENABLE1_REG);
+
+	outb(WPC8769L_BANK_E0, baseport1 + WPC8769L_SELECT_REG);
+	outb(WPC8769L_BANK_E0, baseport1 + WPC8769L_SELECT_REG);
+	outb(inb(baseport1 + WPC8769L_HARDWARE_ENABLE1_REG)
+		| WPC8769L_HARDWARE_ENABLE1_MASK,
+		baseport1 + WPC8769L_HARDWARE_ENABLE1_REG);
+
+	outb(WPC8769L_BANK_00, baseport1 + WPC8769L_SELECT_REG);
+	outb(0, baseport1 + WPC8769L_CONFIG_REG);
+
+	outb(WPC8769L_BANK_00, baseport1 + WPC8769L_SELECT_REG);
+	outb(WPC8769L_BANK_00, baseport1 + WPC8769L_SELECT_REG);
+	data = inb(baseport1 + WPC8769L_CONFIG_REG);
+	data &= ~WPC8769L_CONFIG_OFF_MASK;
+	data |= WPC8769L_CONFIG_ON_MASK;
+	outb(data, baseport1 + WPC8769L_CONFIG_REG);
+
+	outb(WPC8769L_BANK_00, baseport1 + WPC8769L_SELECT_REG);
+	outb(WPC8769L_DATA_STATUS_MASK_1, baseport1 + WPC8769L_DATA_STATUS_REG);
+
+	outb(WPC8769L_BANK_00, baseport1 + WPC8769L_SELECT_REG);
+	outb(WPC8769L_DATA_STATUS_MASK_2, baseport1 + WPC8769L_DATA_STATUS_REG);
+
+	outb(WPC8769L_BANK_F4, baseport1 + WPC8769L_SELECT_REG);
+	outb(WPC8769L_BANK_F4, baseport1 + WPC8769L_SELECT_REG);
+	outb(inb(baseport1 + WPC8769L_CONFIG2_REG)
+		& ~WPC8769L_CONFIG2_OFF_MASK,
+		baseport1 + WPC8769L_CONFIG2_REG);
+
+	outb(WPC8769L_BANK_EC, baseport1 + WPC8769L_SELECT_REG);
+	outb(WPC8769L_BANK_EC, baseport1 + WPC8769L_SELECT_REG);
+	outb(inb(baseport1 + WPC8769L_CONFIG3_REG)
+		| WPC8769L_CONFIG3_ON_MASK,
+		baseport1 + WPC8769L_CONFIG3_REG);
+
+	outb(WPC8769L_BANK_F4, baseport1 + WPC8769L_SELECT_REG);
+	data = inb(baseport1 + WPC8769L_CONFIG4_REG);
+	data &= WPC8769L_CONFIG4_AND_MASK;
+	data |= WPC8769L_CONFIG4_ON_MASK;
+
+	outb(WPC8769L_BANK_F4, baseport1 + WPC8769L_SELECT_REG);
+	outb(data, baseport1 + WPC8769L_CONFIG4_REG);
+
+	outb(WPC8769L_BANK_E0, baseport1 + WPC8769L_SELECT_REG);
+	outb(WPC8769L_BANK_E0, baseport1 + WPC8769L_SELECT_REG);
+	outb(inb(baseport1 + WPC8769L_CONFIG5_REG)
+		| WPC8769L_CONFIG5_ON_MASK,
+		baseport1 + WPC8769L_CONFIG5_REG);
+
+	outb(WPC8769L_BANK_E0, baseport1 + WPC8769L_SELECT_REG);
+	outb(WPC8769L_CONFIG6_MASK, baseport1 + WPC8769L_CONFIG6_REG);
+
+	outb(WPC8769L_BANK_E0, baseport1 + WPC8769L_SELECT_REG);
+	outb(0, baseport1 + WPC8769L_CONFIG7_REG);
+
+	if (baseport2) {
+		/*
+		 * This has to do with wake-up support, which is
+		 * disabled when the second I/O range doesn't
+		 * exist.
+		 */
+		/* -- internal subroutine -- */
+		data = inb(baseport2 + WPC8769L_BANK2_CLOCK_REG);
+		data &= ~WPC8769L_CLOCK_OFF_MASK;
+		data |= WPC8769L_CLOCK_ON_MASK;
+		outb(data, baseport2 + WPC8769L_BANK2_CLOCK_REG);
+
+		data2 = inb(baseport2 + WPC8769L_WAKEUP_CONFIG3_REG);
+		a = (data2 >> WPC8769L_WAKEUP_CONFIG3_A_SHIFT)
+			& WPC8769L_WAKEUP_CONFIG3_A_MASK;
+		b = (data2 >> WPC8769L_WAKEUP_CONFIG3_B_SHIFT)
+			& WPC8769L_WAKEUP_CONFIG3_B_MASK;
+
+		data = inb(baseport2 + WPC8769L_BANK2_CLOCK_REG);
+		data &= ~WPC8769L_CLOCK_OFF_MASK;
+		data |= WPC8769L_CLOCK_ON_MASK;
+		outb(data, baseport2 + WPC8769L_BANK2_CLOCK_REG);
+
+		data2 &= ~WPC8769L_WAKEUP_CONFIG3_OFF_MASK;
+		data2 |= WPC8769L_WAKEUP_CONFIG3_ON_MASK;
+		outb(data2, baseport2 + WPC8769L_WAKEUP_CONFIG3_REG);
+		/* -- end internal subroutine -- */
+
+#ifdef LIRC_WPC8769L_WAKEUP
+		/* Call for setting wake up filters */
+		wpc8769l_configure_wakeup_triggers();
+#endif
+	} else {
+		/* No second port range. Take these defaults. */
+		a = (data_save & WPC8769L_WAKEUP_STATUS_LEG_MASK_A)
+			? 0 : 1;
+		b = (data_save & WPC8769L_WAKEUP_STATUS_LEG_MASK_B)
+			? 1 : 0;
+	}
+
+	outb(WPC8769L_BANK_EC, baseport1 + WPC8769L_SELECT_REG);
+	outb(WPC8769L_BANK_EC, baseport1 + WPC8769L_SELECT_REG);
+
+	data = inb(baseport1 + WPC8769L_CONFIG3_REG);
+	data = (a == 1)
+		? (data & ~WPC8769L_CONFIG3_MASK_1)
+		: (data | WPC8769L_CONFIG3_MASK_1);
+	outb(data, baseport1 + WPC8769L_CONFIG3_REG);
+
+	outb(WPC8769L_BANK_F4, baseport1 + WPC8769L_SELECT_REG);
+	outb(WPC8769L_BANK_F4, baseport1 + WPC8769L_SELECT_REG);
+
+	data = inb(baseport1 + WPC8769L_CONFIG2_REG);
+	data = (b == 0)
+		? (data & ~WPC8769L_CONFIG2_MASK_1)
+		: (data | WPC8769L_CONFIG2_MASK_1);
+	outb(data, baseport1 + WPC8769L_CONFIG2_REG);
+
+	outb(0, baseport1 + WPC8769L_CONFIG8_REG);
+
+	outb(0, baseport1 + WPC8769L_CONFIG9_REG);
+
+	outb(WPC8769L_BANK_00, baseport1 + WPC8769L_SELECT_REG);
+	outb(WPC8769L_BANK_00, baseport1 + WPC8769L_SELECT_REG);
+	outb(inb(baseport1 + WPC8769L_INTERRUPT_REG)
+		| WPC8769L_INTERRUPT_1_MASK,
+		baseport1 + WPC8769L_INTERRUPT_REG);
+
+	spin_unlock_irqrestore(&wpc8769l_hw_spinlock, flags);
+}
+
+/* Called when the device is opened. */
+static int set_use_inc(void *data)
+{
+	int result;
+
+	/* Reset pulse values. */
+	last_was_pulse = 0;
+	last_counter = 0;
+
+	/* Reset last timeout value. */
+	lastus = 0;
+
+	/* Init the read buffer. */
+	if (lirc_buffer_init(&rbuf, sizeof(lirc_t), RBUF_LEN) < 0)
+		return -ENOMEM;
+
+	/* Acquire the IRQ. */
+	result = request_irq(irq, irq_handler,
+			   IRQF_DISABLED | IRQF_SHARED,
+			   LIRC_DRIVER_NAME, THIS_MODULE);
+
+	switch (result) {
+	case -EBUSY:
+		eprintk("IRQ %d busy\n", irq);
+		lirc_buffer_free(&rbuf);
+		return -EBUSY;
+	case -EINVAL:
+		eprintk("Bad irq number or handler\n");
+		lirc_buffer_free(&rbuf);
+		return -EINVAL;
+	default:
+		dprintk("IRQ %d obtained.\n", irq);
+		break;
+	};
+
+	/* Mark the device as open. */
+	lirc_wpc8769l_is_open = 1;
+
+	/* Enable hardware interrupts. */
+	wpc8769l_enable_interrupts();
+
+	MOD_INC_USE_COUNT;
+	return 0;
+}
+
+/* Called when the device is released. */
+static void set_use_dec(void *data)
+{
+	/* Mark the device as closed. */
+	lirc_wpc8769l_is_open = 0;
+
+	/* Cancel the timeout if pending. */
+	del_timer_sync(&last_span_timer);
+
+	/* Disable the hardware interrupts. */
+	wpc8769l_disable_interrupts();
+
+	/* Free the IRQ. */
+	free_irq(irq, THIS_MODULE);
+	dprintk("Freed IRQ %d\n", irq);
+
+	/* Free the RX buffer. */
+	lirc_buffer_free(&rbuf);
+
+	MOD_DEC_USE_COUNT;
+}
+
+static struct lirc_driver driver = {
+	.name		= LIRC_DRIVER_NAME,
+	.minor		= -1,
+	.code_length	= 1,
+	.sample_rate	= 0,
+	.data		= NULL,
+	.add_to_buf	= NULL,
+	.get_queue	= NULL,
+	.rbuf		= &rbuf,
+	.set_use_inc	= set_use_inc,
+	.set_use_dec	= set_use_dec,
+	.fops		= NULL,
+	.dev		= NULL,
+	.owner		= THIS_MODULE,
+};
+
+static acpi_status wec_parse_resources(struct acpi_resource *resource,
+	void *context)
+{
+	if (resource->type == ACPI_RESOURCE_TYPE_IO) {
+		/* Read the two I/O ranges. */
+		if (!baseport1)
+			baseport1 = resource->data.io.minimum;
+		else if (!baseport2)
+			baseport2 = resource->data.io.minimum;
+	} else if (resource->type == ACPI_RESOURCE_TYPE_IRQ) {
+		/* Read the rx IRQ number. */
+		if (!irq)
+			irq = resource->data.irq.interrupts[0];
+	}
+	return AE_OK;
+}
+
+static acpi_status wec_parse_device(acpi_handle handle, u32 level,
+	void *context, void **return_value)
+{
+	acpi_status status;
+	iprintk("Found %s device via ACPI.\n", WPC8769L_ACPI_HID);
+
+	status = acpi_walk_resources(handle, METHOD_NAME__CRS,
+		wec_parse_resources, NULL);
+	if (ACPI_FAILURE(status))
+		return status;
+
+	return AE_OK;
+}
+
+/* Find the device I/O ranges and IRQ number by searching for the
+ * CIR ACPI entry. */
+static int wpc8769l_acpi_detect(void)
+{
+	acpi_status status;
+	status = acpi_get_devices(WPC8769L_ACPI_HID, wec_parse_device, NULL,
+		NULL);
+	if (ACPI_FAILURE(status))
+		return -ENOENT;
+	else
+		return 0;
+}
+
+#ifdef MODULE
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 18)
+static struct platform_device *lirc_wpc8769l_platform_dev;
+
+static int __devinit lirc_wpc8769l_probe(struct platform_device *dev)
+{
+	return 0;
+}
+
+static int __devexit lirc_wpc8769l_remove(struct platform_device *dev)
+{
+	return 0;
+}
+
+static int lirc_wpc8769l_suspend(struct platform_device *dev,
+			       pm_message_t state)
+{
+	if (lirc_wpc8769l_is_open)
+		/* Disable all interrupts. */
+		wpc8769l_disable_interrupts();
+	return 0;
+}
+
+static int lirc_wpc8769l_resume(struct platform_device *dev)
+{
+	if (lirc_wpc8769l_is_open) {
+		/* Check if we caused resuming; we still do nothing about it. */
+		wpc8769l_power_up_and_check_if_we_woke_us_up();
+
+		/* Enable interrupts again. */
+		wpc8769l_enable_interrupts();
+	}
+	return 0;
+}
+
+static struct platform_driver lirc_wpc8769l_platform_driver = {
+	.probe		= lirc_wpc8769l_probe,
+	.remove		= __devexit_p(lirc_wpc8769l_remove),
+	.suspend	= lirc_wpc8769l_suspend,
+	.resume		= lirc_wpc8769l_resume,
+	.driver		= {
+		.name	= LIRC_DRIVER_NAME,
+		.owner	= THIS_MODULE,
+	},
+};
+
+static int __init lirc_wpc8769l_platform_init(void)
+{
+	int result;
+
+	result = platform_driver_register(&lirc_wpc8769l_platform_driver);
+	if (result) {
+		eprintk("Platform driver register returned %d.\n", result);
+		return result;
+	}
+
+	lirc_wpc8769l_platform_dev = platform_device_alloc(LIRC_DRIVER_NAME, 0);
+	if (!lirc_wpc8769l_platform_dev) {
+		result = -ENOMEM;
+		goto exit_driver_unregister;
+	}
+
+	result = platform_device_add(lirc_wpc8769l_platform_dev);
+	if (result)
+		goto exit_device_put;
+
+	return 0;
+
+exit_device_put:
+	platform_device_put(lirc_wpc8769l_platform_dev);
+
+exit_driver_unregister:
+	platform_driver_unregister(&lirc_wpc8769l_platform_driver);
+	return result;
+}
+
+static void __exit lirc_wpc8769l_platform_exit(void)
+{
+	platform_device_unregister(lirc_wpc8769l_platform_dev);
+	platform_driver_unregister(&lirc_wpc8769l_platform_driver);
+}
+#endif
+
+static int __init lirc_wpc8769l_module_init(void)
+{
+	int rc;
+
+	/* If needed, read the resource information for the ACPI device
+	 * description. */
+	if (!skip_probe) {
+		rc = wpc8769l_acpi_detect();
+		if (rc) {
+			eprintk("Error when looking for %s ACPI device.\n",
+				WPC8769L_ACPI_HID);
+			return rc;
+		}
+	}
+
+	/* Check that we got some resource info to work with. */
+	if (!baseport1 || !irq) {
+		rc = -ENODEV;
+		eprintk("Not all required resources found for %s device.\n",
+			LIRC_DRIVER_NAME);
+		return rc;
+	}
+
+	dprintk("%s device found to use 0x%04x, 0x%04x I/O bases, IRQ #%d.\n",
+		LIRC_DRIVER_NAME, baseport1, baseport2, irq);
+
+	/* Request the two I/O regions. */
+	wpc8769l_portblock1_resource = request_region(baseport1,
+		WPC8769L_IO_REGION_1_SIZE, LIRC_DRIVER_NAME);
+	if (!wpc8769l_portblock1_resource) {
+		rc = -EBUSY;
+		eprintk("Could not allocate I/O range at 0x%04x", baseport1);
+		return rc;
+	}
+	if (baseport2) {
+		wpc8769l_portblock2_resource = request_region(baseport2,
+			WPC8769L_IO_REGION_2_SIZE, LIRC_DRIVER_NAME);
+		if (!wpc8769l_portblock2_resource) {
+			rc = -EBUSY;
+			printk(KERN_ERR "Could not allocate I/O range "
+			       "at 0x%04x",
+				baseport2);
+			goto exit_release_region_1;
+		}
+	}
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 18)
+	/* Register the platform driver and device. */
+	rc = lirc_wpc8769l_platform_init();
+	if (rc)
+		goto exit_release_region_2;
+#endif
+
+	/* Prepare the hardware. */
+	wpc8769l_prepare_hardware();
+
+	/* Do load-time checks. */
+	wpc8769l_power_up_and_check_if_we_woke_us_up();
+
+	/* Configure the driver hooks. */
+	driver.features = LIRC_CAN_REC_MODE2;
+	driver.minor = lirc_register_driver(&driver);
+	if (driver.minor < 0) {
+		eprintk("lirc_register_driver failed!\n");
+		rc = -EIO;
+		goto exit_platform_exit;
+	}
+
+	iprintk("Driver loaded.\n");
+
+	return 0; /* Everything OK. */
+
+exit_platform_exit:
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 18)
+	lirc_wpc8769l_platform_exit();
+
+exit_release_region_2:
+#endif
+	if (baseport2)
+		release_region(baseport2, WPC8769L_IO_REGION_2_SIZE);
+
+exit_release_region_1:
+	release_region(baseport1, WPC8769L_IO_REGION_1_SIZE);
+
+	return rc;
+}
+
+module_init(lirc_wpc8769l_module_init);
+
+static void __exit lirc_wpc8769l_module_exit(void)
+{
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 18)
+	/* Unregister the platform driver and device. */
+	lirc_wpc8769l_platform_exit();
+#endif
+
+	/* Unregister the LIRC driver. */
+	lirc_unregister_driver(driver.minor);
+
+	/* Release the second range. */
+	if (baseport2)
+		release_region(baseport2, WPC8769L_IO_REGION_2_SIZE);
+
+	/* Release the first range. */
+	release_region(baseport1, WPC8769L_IO_REGION_1_SIZE);
+
+	iprintk("Driver unloaded.\n");
+}
+
+module_exit(lirc_wpc8769l_module_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Juan J. Garcia de Soria");
+MODULE_DESCRIPTION("Driver for the integrated Winbond WPC8769L-based IR\
+ receiver found in Acer laptops.");
+MODULE_VERSION("0.0");
+
+module_param(debug, bool, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(debug, "Enable debugging messages");
+
+module_param(baseport1, uint, S_IRUGO);
+MODULE_PARM_DESC(baseport1,
+	"First I/O range base address (default: ACPI autodetect).");
+
+module_param(baseport2, uint, S_IRUGO);
+MODULE_PARM_DESC(baseport2,
+	"Second I/O range base address (default: ACPI autodetect).");
+
+module_param(irq, uint, S_IRUGO);
+MODULE_PARM_DESC(irq, "IRQ number (default: ACPI autodetect).");
+
+module_param(skip_probe, bool, S_IRUGO);
+MODULE_PARM_DESC(skip_probe,
+	"Skip ACPI-based device detection \
+(default: false for ACPI autodetect).");
+
+#ifdef LIRC_WPC8769L_WAKEUP
+module_param(protocol_select, int, S_IRUGO);
+MODULE_PARM_DESC(protocol_select,
+	"Define the protocol for wake up functions (default: 2).");
+
+module_param(max_info_bits, int, S_IRUGO);
+MODULE_PARM_DESC(max_info_bits,
+	"Define the maximum info bits for wake up functions (default: 24).");
+
+module_param(rc_wakeup_code, uint, S_IRUGO);
+MODULE_PARM_DESC(rc_wakeup_code,
+	"Define the RC code value for wake up functions\
+ (default: 0x7ffffbf3).");
+
+module_param(rc_wakeup_mask, uint, S_IRUGO);
+MODULE_PARM_DESC(rc_wakeup_mask,
+	"Define the RC code mask for wake up functions (default: 0xff000fff).");
+#endif
+
+EXPORT_NO_SYMBOLS;
+
+#endif /* MODULE */
+
--- linux-rt-2.6.31.orig/ubuntu/lirc/lirc_gpio/Makefile
+++ linux-rt-2.6.31/ubuntu/lirc/lirc_gpio/Makefile
@@ -0,0 +1,3 @@
+EXTRA_CFLAGS =-DIRCTL_DEV_MAJOR=61 -DLIRC_SERIAL_TRANSMITTER -DLIRC_SERIAL_SOFTCARRIER -I$(src)/..
+
+obj-$(CONFIG_LIRC_GPIO)		+= lirc_gpio.o
--- linux-rt-2.6.31.orig/ubuntu/lirc/lirc_gpio/lirc_gpio.c
+++ linux-rt-2.6.31/ubuntu/lirc/lirc_gpio/lirc_gpio.c
@@ -0,0 +1,613 @@
+/*
+ * Remote control driver for the TV-card
+ * key codes are obtained from GPIO port
+ *
+ * (L) by Artur Lipowski <alipowski@interia.pl>
+ *     patch for the AverMedia by Santiago Garcia Mantinan <manty@i.am>
+ *			    and Christoph Bartelmus <lirc@bartelmus.de>
+ *     patch for the BestBuy by Miguel Angel Alvarez <maacruz@navegalia.com>
+ *     patch for the Winfast TV2000 by Juan Toledo
+ *     <toledo@users.sourceforge.net>
+ *     patch for the I-O Data GV-BCTV5/PCI by Jens C. Rasmussen
+ *     <jens.rasmussen@ieee.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *
+ * $Id: lirc_gpio.c,v 1.57 2009/02/14 19:35:52 lirc Exp $
+ *
+ */
+
+#include <linux/version.h>
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 2, 4)
+#error "*******************************************************"
+#error "Sorry, this driver needs kernel version 2.2.4 or higher"
+#error "*******************************************************"
+#endif
+
+#include <linux/version.h>
+#include <linux/module.h>
+#include <linux/kmod.h>
+#include <linux/sched.h>
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 0)
+#include <linux/wrapper.h>
+#endif
+#include <linux/errno.h>
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 4, 0)
+#include "../drivers/char/bttv.h"
+#include "../drivers/char/bttvp.h"
+#elif LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 17)
+#include "../drivers/media/video/bttv.h"
+#include "../drivers/media/video/bttvp.h"
+#else
+#include "../drivers/media/video/bt8xx/bttv.h"
+#include "../drivers/media/video/bt8xx/bttvp.h"
+#endif
+
+#if BTTV_VERSION_CODE < KERNEL_VERSION(0, 7, 45)
+#error "*******************************************************"
+#error " Sorry, this driver needs bttv version 0.7.45 or       "
+#error " higher. If you are using the bttv package, copy it to "
+#error " the kernel					    "
+#error "*******************************************************"
+#endif
+
+#include "../kcompat.h"
+#include "../lirc_dev/lirc_dev.h"
+
+/* insmod parameters */
+static int debug;
+static int card;
+static int minor = -1;
+static int bttv_id = BTTV_BOARD_UNKNOWN;
+static unsigned long gpio_mask;
+static unsigned long gpio_enable;
+static unsigned long gpio_lock_mask;
+static unsigned long gpio_xor_mask;
+static int soft_gap;
+static int sample_rate = 10;
+
+#define dprintk(fmt, args...)					\
+	do {							\
+		if (debug)					\
+			printk(KERN_DEBUG fmt, ## args);	\
+	} while (0)
+
+struct rcv_info {
+	int bttv_id;
+	int card_id;
+	unsigned long gpio_mask;
+	unsigned long gpio_enable;
+	unsigned long gpio_lock_mask;
+	unsigned long gpio_xor_mask;
+	int soft_gap;
+	int sample_rate;
+	unsigned char code_length;
+};
+
+static struct rcv_info rcv_infos[] = {
+	{BTTV_BOARD_UNKNOWN,
+		0, 0, 0, 0, 0, 0, 1, 0},
+	{BTTV_BOARD_PXELVWPLTVPAK,
+		0, 0x00003e00, 0, 0x0010000, 0, 0, 15, 32},
+	{BTTV_BOARD_PXELVWPLTVPRO,
+		0, 0x00001f00, 0, 0x0008000, 0, 500, 12, 32},
+	{BTTV_BOARD_PV_BT878P_9B,
+		0, 0x00001f00, 0, 0x0008000, 0, 500, 12, 32},
+	{BTTV_BOARD_PV_BT878P_PLUS,
+		0, 0x00001f00, 0, 0x0008000, 0, 500, 12, 32},
+#ifdef BTTV_BOARD_PV_M4900
+	{BTTV_BOARD_PV_M4900,
+		0, 0x00001f00, 0, 0x0008000, 0, 500, 12, 32},
+#endif
+	{BTTV_BOARD_AVERMEDIA,
+		0, 0x00f88000, 0, 0x0010000, 0x00010000, 0, 10, 32},
+
+	/* mapped to Capture98 */
+	{BTTV_BOARD_AVPHONE98,
+		0x00011461, 0x003b8000, 0x00004000,
+		0x0800000, 0x00800000, 0, 10, 0},
+	{BTTV_BOARD_AVERMEDIA98,
+		0x00021461, 0x003b8000, 0x00004000,
+		0x0800000, 0x00800000, 0, 10, 0},
+
+	/* mapped to Phone98 */
+	{BTTV_BOARD_AVPHONE98,
+		0x00031461, 0x00f88000, 0, 0x0010000, 0x00010000, 0, 10, 32},
+	/* is this one correct? */
+	{BTTV_BOARD_AVERMEDIA98,
+		0x00041461, 0x00f88000, 0, 0x0010000, 0x00010000, 0, 10, 32},
+	/* work-around for VDOMATE */
+	{BTTV_BOARD_AVERMEDIA98,
+		0x03001461, 0x00f88000, 0, 0x0010000, 0x00010000, 0, 10, 32},
+	/* reported by Danijel Korzinek, AVerTV GOw/FM */
+	{BTTV_BOARD_AVERMEDIA98,
+		0x00000000, 0x00f88000, 0, 0x0010000, 0x00010000, 0, 10, 32},
+
+	{BTTV_BOARD_CHRONOS_VS2,
+		0, 0x000000f8,	0, 0x0000100, 0, 0, 20, 0},
+	/* CPH031 and CPH033 cards (?) */
+	/* MIRO was just a work-around */
+	{BTTV_BOARD_MIRO,
+		0, 0x00001f00, 0, 0x0004000, 0, 0, 10, 32},
+	{BTTV_BOARD_DYNALINK,
+		0, 0x00001f00, 0, 0x0004000, 0, 0, 10, 32},
+#ifdef BTTV_BOARD_ASKEY_CPH03X
+	{BTTV_BOARD_ASKEY_CPH03X,
+		0, 0x00001f00, 0, 0x0004000, 0, 0, 10, 32},
+#endif
+	{BTTV_BOARD_WINVIEW_601,
+		0, 0x00001f00, 0, 0x0004000, 0, 0, 0, 32},
+#ifdef BTTV_BOARD_KWORLD
+	{BTTV_BOARD_KWORLD,
+		0, 0x00007f00, 0, 0x0004000, 0, 0, 12, 32},
+#endif
+	/* just a guess */
+	{BTTV_BOARD_MAGICTVIEW061,
+		0, 0x0028e000, 0, 0x0020000, 0, 0, 20, 32},
+	{BTTV_BOARD_MAGICTVIEW063,
+		0, 0x0028e000, 0, 0x0020000, 0, 0, 20, 32},
+	{BTTV_BOARD_PHOEBE_TVMAS,
+		0, 0x0028e000, 0, 0x0020000, 0, 0, 20, 32},
+#ifdef BTTV_BOARD_BESTBUY_EASYTV2
+	{BTTV_BOARD_BESTBUY_EASYTV,
+		0, 0x00007F00, 0, 0x0004000, 0, 0, 10, 8},
+	{BTTV_BOARD_BESTBUY_EASYTV2,
+		0, 0x00007F00, 0, 0x0008000, 0, 0, 10, 8},
+#endif
+	/* lock_mask probably also 0x100, or maybe it is 0x0 for all others? */
+	{BTTV_BOARD_FLYVIDEO,
+		0, 0x000000f8, 0, 0, 0, 0, 0, 42},
+	{BTTV_BOARD_FLYVIDEO_98,
+		0, 0x000000f8,	0, 0x0000100, 0, 0, 0, 42},
+	{BTTV_BOARD_TYPHOON_TVIEW,
+		0, 0x000000f8, 0, 0x0000100, 0, 0, 0, 42},
+#ifdef BTTV_BOARD_FLYVIDEO_98FM
+	/* smorar@alfonzo.smuts.uct.ac.za */
+	{BTTV_BOARD_FLYVIDEO_98FM,
+		0, 0x000000f8, 0, 0x0000100, 0, 0, 0, 42},
+#endif
+	/* The Leadtek WinFast TV 2000 XP card (id 0x6606107d) uses an
+	 * extra gpio bit compared to the original TV 2000 card (id
+	 * 0x217d6606); as the bttv-0.7.100 driver does not
+	 * distinguish between the two cards, we enable the extra bit
+	 * based on the card id: */
+	{BTTV_BOARD_WINFAST2000,
+		0x6606107d, 0x000008f8, 0, 0x0000100, 0, 0, 0, 32},
+	{BTTV_BOARD_WINFAST2000,
+		0x6609107d, 0x000008f8, 0, 0x0000100, 0, 0, 0, 32},
+	{BTTV_BOARD_WINFAST2000,
+		0xff06107d, 0x000008f8, 0, 0x0000100, 0, 0, 0, 32},
+	/* default: */
+	{BTTV_BOARD_WINFAST2000,
+		0, 0x000000f8,	0, 0x0000100, 0, 0, 0, 32},
+#ifdef BTTV_BOARD_GVBCTV5PCI
+	{BTTV_BOARD_GVBCTV5PCI,
+		0, 0x00f0b000, 0, 0, 0, 0, 20, 8},
+#endif
+};
+
+static unsigned char code_length;
+static unsigned char code_bytes = 1;
+
+#define MAX_BYTES 8
+
+#define LOGHEAD "lirc_gpio (%d): "
+
+/* how many bits GPIO value can be shifted right before processing
+ * it is computed from the value of gpio_mask_parameter
+ */
+static unsigned char gpio_pre_shift;
+
+static int reverse(int data, int bits)
+{
+	int i;
+	int c;
+
+	for (c = 0, i = 0; i < bits; i++)
+		c |= (((data & (1<<i)) ? 1:0)) << (bits-1-i);
+
+	return c;
+}
+
+static int build_key(unsigned long gpio_val, unsigned char codes[MAX_BYTES])
+{
+	unsigned long mask = gpio_mask;
+	unsigned char shift = 0;
+
+	dprintk(LOGHEAD "gpio_val is %lx\n", card, (unsigned long) gpio_val);
+
+	gpio_val ^= gpio_xor_mask;
+
+	if (gpio_lock_mask && (gpio_val & gpio_lock_mask))
+		return -EBUSY;
+
+	switch (bttv_id) {
+	case BTTV_BOARD_AVERMEDIA98:
+		if (bttv_write_gpio(card, gpio_enable, gpio_enable)) {
+			dprintk(LOGHEAD "cannot write to GPIO\n", card);
+			return -EIO;
+		}
+		if (bttv_read_gpio(card, &gpio_val)) {
+			dprintk(LOGHEAD "cannot read GPIO\n", card);
+			return -EIO;
+		}
+		if (bttv_write_gpio(card, gpio_enable, 0)) {
+			dprintk(LOGHEAD "cannot write to GPIO\n", card);
+			return -EIO;
+		}
+		break;
+	default:
+		break;
+	}
+
+	/* extract bits from "raw" GPIO value using gpio_mask */
+	codes[0] = 0;
+	gpio_val >>= gpio_pre_shift;
+	while (mask) {
+		if (mask & 1u)
+			codes[0] |= (gpio_val & 1u) << shift++;
+		mask >>= 1;
+		gpio_val >>= 1;
+	}
+
+	dprintk(LOGHEAD "code is %lx\n", card, (unsigned long) codes[0]);
+	switch (bttv_id) {
+	case BTTV_BOARD_AVERMEDIA:
+		codes[2] = (codes[0]<<2)&0xff;
+		codes[3] = (~codes[2])&0xff;
+		codes[0] = 0x02;
+		codes[1] = 0xFD;
+		break;
+	case BTTV_BOARD_AVPHONE98:
+		codes[2] = ((codes[0]&(~0x1))<<2)&0xff;
+		codes[3] = (~codes[2])&0xff;
+		if (codes[0]&0x1) {
+			codes[0] = 0xc0;
+			codes[1] = 0x3f;
+		} else {
+			codes[0] = 0x40;
+			codes[1] = 0xbf;
+		}
+		break;
+	case BTTV_BOARD_AVERMEDIA98:
+		break;
+	case BTTV_BOARD_FLYVIDEO:
+	case BTTV_BOARD_FLYVIDEO_98:
+	case BTTV_BOARD_TYPHOON_TVIEW:
+#ifdef BTTV_BOARD_FLYVIDEO_98FM
+	case BTTV_BOARD_FLYVIDEO_98FM:
+#endif
+		codes[4] = codes[0]<<3;
+		codes[5] = ((~codes[4])&0xff);
+
+		codes[0] = 0x00;
+		codes[1] = 0x1A;
+		codes[2] = 0x1F;
+		codes[3] = 0x2F;
+		break;
+	case BTTV_BOARD_MAGICTVIEW061:
+	case BTTV_BOARD_MAGICTVIEW063:
+	case BTTV_BOARD_PHOEBE_TVMAS:
+		codes[0] = (codes[0]&0x01)
+			| ((codes[0]&0x02)<<1)
+			| ((codes[0]&0x04)<<2)
+			| ((codes[0]&0x08)>>2)
+			| ((codes[0]&0x10)>>1);
+		/* FALLTHROUGH */
+	case BTTV_BOARD_MIRO:
+	case BTTV_BOARD_DYNALINK:
+#ifdef BTTV_BOARD_ASKEY_CPH03X
+	case BTTV_BOARD_ASKEY_CPH03X:
+#endif
+	case BTTV_BOARD_PXELVWPLTVPAK:
+	case BTTV_BOARD_PXELVWPLTVPRO:
+	case BTTV_BOARD_PV_BT878P_9B:
+	case BTTV_BOARD_PV_BT878P_PLUS:
+#ifdef BTTV_BOARD_PV_M4900
+	case BTTV_BOARD_PV_M4900:
+#endif
+#ifdef BTTV_BOARD_KWORLD
+	case BTTV_BOARD_KWORLD:
+#endif
+		codes[2] = reverse(codes[0], 8);
+		codes[3] = (~codes[2])&0xff;
+		codes[0] = 0x61;
+		codes[1] = 0xD6;
+		break;
+#if 0
+		/* derived from e-tech config file */
+		/* 26 + 16 bits */
+		/* won't apply it until it's confirmed with a fly98 */
+	case BTTV_BOARD_FLYVIDEO_98:
+	case BTTV_BOARD_FLYVIDEO_98FM:
+		codes[4] = codes[0]<<3;
+		codes[5] = (~codes[4])&0xff;
+
+		codes[0] = 0x00;
+		codes[1] = 0x1A;
+		codes[2] = 0x1F;
+		codes[3] = 0x2F;
+		break;
+#endif
+	case BTTV_BOARD_WINFAST2000:
+		/* shift extra bit */
+		codes[0] = (codes[0]&0x1f) | ((codes[0]&0x20) << 1);
+	case BTTV_BOARD_WINVIEW_601:
+		codes[2] = reverse(codes[0], 8);
+		codes[3] = (~codes[2])&0xff;
+		codes[0] = 0xC0;
+		codes[1] = 0x3F;
+		break;
+	default:
+		break;
+	}
+
+	return 0;
+}
+
+/* add_to_buf - copy a code to the buffer */
+static int add_to_buf(void *data, struct lirc_buffer *buf)
+{
+	static unsigned long next_time;
+	static unsigned char prev_codes[MAX_BYTES];
+	unsigned long code = 0;
+	unsigned char cur_codes[MAX_BYTES];
+
+	if (bttv_read_gpio(card, &code)) {
+		dprintk(LOGHEAD "cannot read GPIO\n", card);
+		return -EIO;
+	}
+
+	if (build_key(code, cur_codes))
+		return -EFAULT;
+
+	if (soft_gap) {
+		if (!memcmp(prev_codes, cur_codes, code_bytes) &&
+			jiffies < next_time)
+			return -EAGAIN;
+
+		next_time = jiffies + soft_gap;
+	}
+	memcpy(prev_codes, cur_codes, code_bytes);
+
+	lirc_buffer_write(buf, cur_codes);
+
+	return 0;
+}
+
+static int set_use_inc(void *data)
+{
+	MOD_INC_USE_COUNT;
+	return 0;
+}
+
+static void set_use_dec(void *data)
+{
+	MOD_DEC_USE_COUNT;
+}
+
+static wait_queue_head_t *get_queue(void *data)
+{
+	return bttv_get_gpio_queue(card);
+}
+
+static struct lirc_driver driver = {
+	.name		= "lirc_gpio  ",
+	.add_to_buf	= add_to_buf,
+	.get_queue	= get_queue,
+	.set_use_inc	= set_use_inc,
+	.set_use_dec	= set_use_dec,
+	.dev		= NULL,
+	.owner		= THIS_MODULE,
+};
+
+/*
+ *
+ */
+static int gpio_remote_init(void)
+{
+	int ret;
+	unsigned int mask;
+
+	/* "normalize" gpio_mask
+	 * this means shift it right until first bit is set
+	 */
+	while (!(gpio_mask & 1u)) {
+		gpio_pre_shift++;
+		gpio_mask >>= 1;
+	}
+
+	if (code_length)
+		driver.code_length = code_length;
+	else {
+		/* calculate scan code length in bits if needed */
+		driver.code_length = 1;
+		mask = gpio_mask >> 1;
+		while (mask) {
+			if (mask & 1u)
+				driver.code_length++;
+			mask >>= 1;
+		}
+	}
+
+	code_bytes = (driver.code_length/8) + (driver.code_length % 8 ? 1 : 0);
+	if (MAX_BYTES < code_bytes) {
+		printk(LOGHEAD "scan code too long (%d bytes)\n",
+			minor, code_bytes);
+		return -EBADRQC;
+	}
+
+	if (gpio_enable) {
+		if (bttv_gpio_enable(card, gpio_enable, gpio_enable)) {
+			printk(LOGHEAD "gpio_enable failure\n", minor);
+			return -EIO;
+		}
+	}
+
+
+	/* translate ms to jiffies */
+	soft_gap = (soft_gap*HZ) / 1000;
+
+	driver.minor = minor;
+	driver.sample_rate = sample_rate;
+
+	ret = lirc_register_driver(&driver);
+
+	if (0 > ret) {
+		printk(LOGHEAD "device registration failed with %d\n",
+			minor, ret);
+		return ret;
+	}
+
+	minor = ret;
+	printk(LOGHEAD "driver registered\n", minor);
+
+	return 0;
+}
+
+#ifdef MODULE
+/*
+ *
+ */
+int init_module(void)
+{
+	int type, cardid, card_type;
+
+	if (MAX_IRCTL_DEVICES < minor) {
+		printk(KERN_INFO "lirc_gpio: parameter minor (%d) "
+		       "must be less than %d!\n",
+		       minor, MAX_IRCTL_DEVICES - 1);
+		return -EBADRQC;
+	}
+
+	/* if gpio_mask not zero then use module parameters
+	 * instead of autodetecting TV card
+	 */
+	if (gpio_mask) {
+		if (sample_rate != 0 &&
+		    (2 > sample_rate || HZ < sample_rate)) {
+			printk(LOGHEAD "parameter sample_rate "
+			       "must be between 2 and %d!\n", minor, HZ);
+			return -EBADRQC;
+		}
+
+		if (sample_rate != 0 && soft_gap &&
+		    ((2000/sample_rate) > soft_gap || 1000 < soft_gap)) {
+			printk(LOGHEAD "parameter soft_gap "
+			       "must be between %d and 1000!\n",
+			       minor, 2000/sample_rate);
+			return -EBADRQC;
+		}
+	} else {
+		if (bttv_get_cardinfo(card, &type, &cardid) == -1) {
+			printk(LOGHEAD "could not get card type\n", minor);
+			return -EBADRQC;
+		}
+		printk(LOGHEAD "card type 0x%x, id 0x%x\n", minor,
+		       type, cardid);
+
+		if (type == BTTV_BOARD_UNKNOWN) {
+			printk(LOGHEAD "cannot detect TV card nr %d!\n",
+			       minor, card);
+			return -EBADRQC;
+		}
+		for (card_type = 1;
+		     card_type < sizeof(rcv_infos)/sizeof(struct rcv_info);
+		     card_type++) {
+			if (rcv_infos[card_type].bttv_id == type &&
+			    (rcv_infos[card_type].card_id == 0 ||
+			     rcv_infos[card_type].card_id == cardid)) {
+				bttv_id = rcv_infos[card_type].bttv_id;
+				gpio_mask = rcv_infos[card_type].gpio_mask;
+				gpio_enable = rcv_infos[card_type].gpio_enable;
+				gpio_lock_mask =
+					rcv_infos[card_type].gpio_lock_mask;
+				gpio_xor_mask =
+					rcv_infos[card_type].gpio_xor_mask;
+				soft_gap = rcv_infos[card_type].soft_gap;
+				sample_rate = rcv_infos[card_type].sample_rate;
+				code_length = rcv_infos[card_type].code_length;
+				break;
+			}
+		}
+		if (type == BTTV_BOARD_AVPHONE98 && cardid == 0x00011461)
+			bttv_id = BTTV_BOARD_AVERMEDIA98;
+
+		if (type == BTTV_BOARD_AVERMEDIA98 && cardid == 0x00041461)
+			bttv_id = BTTV_BOARD_AVPHONE98;
+
+		if (type == BTTV_BOARD_AVERMEDIA98 && cardid == 0x03001461)
+			bttv_id = BTTV_BOARD_AVPHONE98;
+
+		if (type == BTTV_BOARD_AVERMEDIA98 && cardid == 0x00000000)
+			bttv_id = BTTV_BOARD_AVPHONE98;
+
+		if (card_type == sizeof(rcv_infos)/sizeof(struct rcv_info)) {
+			printk(LOGHEAD "TV card type 0x%x not supported!\n",
+			       minor, type);
+			return -EBADRQC;
+		}
+	}
+
+	return gpio_remote_init();
+}
+
+/*
+ *
+ */
+void cleanup_module(void)
+{
+	lirc_unregister_driver(minor);
+
+	dprintk(LOGHEAD "module successfully unloaded\n", minor);
+}
+
+/* Dont try to use it as a static version !  */
+MODULE_DESCRIPTION("Driver module for remote control (data "
+		   "from bt848 GPIO port)");
+MODULE_AUTHOR("Artur Lipowski");
+MODULE_LICENSE("GPL");
+
+module_param(minor, int, S_IRUGO);
+MODULE_PARM_DESC(minor, "Preferred minor device number");
+
+module_param(card, int, S_IRUGO);
+MODULE_PARM_DESC(card, "TV card number to attach to");
+
+module_param(gpio_mask, long, S_IRUGO);
+MODULE_PARM_DESC(gpio_mask, "gpio_mask");
+
+module_param(gpio_lock_mask, long, S_IRUGO);
+MODULE_PARM_DESC(gpio_lock_mask, "gpio_lock_mask");
+
+module_param(gpio_xor_mask, long, S_IRUGO);
+MODULE_PARM_DESC(gpio_xor_mask, "gpio_xor_mask");
+
+module_param(soft_gap, int, S_IRUGO);
+MODULE_PARM_DESC(soft_gap, "Time between keypresses (in ms)");
+
+module_param(sample_rate, int, S_IRUGO);
+MODULE_PARM_DESC(sample_rate, "Sample rate (between 2 and HZ)");
+
+module_param(bttv_id, int, S_IRUGO);
+MODULE_PARM_DESC(bttv_id, "BTTV card type");
+
+module_param(debug, bool, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(debug, "Enable debugging messages");
+
+EXPORT_NO_SYMBOLS;
+
+#endif /* MODULE */
--- linux-rt-2.6.31.orig/ubuntu/lirc/lirc_sir/lirc_sir.c
+++ linux-rt-2.6.31/ubuntu/lirc/lirc_sir/lirc_sir.c
@@ -0,0 +1,1347 @@
+/*
+ * LIRC SIR driver, (C) 2000 Milan Pikula <www@fornax.sk>
+ *
+ * lirc_sir - Device driver for use with SIR (serial infra red)
+ * mode of IrDA on many notebooks.
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *
+ *
+ * 2000/09/16 Frank Przybylski <mail@frankprzybylski.de> :
+ *  added timeout and relaxed pulse detection, removed gap bug
+ *
+ * 2000/12/15 Christoph Bartelmus <lirc@bartelmus.de> :
+ *   added support for Tekram Irmate 210 (sending does not work yet,
+ *   kind of disappointing that nobody was able to implement that
+ *   before),
+ *   major clean-up
+ *
+ * 2001/02/27 Christoph Bartelmus <lirc@bartelmus.de> :
+ *   added support for StrongARM SA1100 embedded microprocessor
+ *   parts cut'n'pasted from sa1100_ir.c (C) 2000 Russell King
+ */
+
+#include <linux/version.h>
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 2, 18)
+#error "**********************************************************"
+#error " Sorry, this driver needs kernel version 2.2.18 or higher "
+#error "**********************************************************"
+#endif
+#include <linux/module.h>
+
+#ifdef HAVE_CONFIG_H
+# include <config.h>
+#endif
+
+#include <linux/autoconf.h>
+
+#include <linux/sched.h>
+#include <linux/errno.h>
+#include <linux/signal.h>
+#include <linux/fs.h>
+#include <linux/interrupt.h>
+#include <linux/ioport.h>
+#include <linux/kernel.h>
+#include <linux/serial_reg.h>
+#include <linux/time.h>
+#include <linux/string.h>
+#include <linux/types.h>
+#include <linux/wait.h>
+#include <linux/mm.h>
+#include <linux/delay.h>
+#include <linux/poll.h>
+#include <asm/system.h>
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 18)
+#include <asm/uaccess.h>
+#endif
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 16)
+#include <asm/io.h>
+#else
+#include <linux/io.h>
+#endif
+#include <asm/irq.h>
+#include <linux/fcntl.h>
+#ifdef LIRC_ON_SA1100
+#include <asm/hardware.h>
+#ifdef CONFIG_SA1100_COLLIE
+#include <asm/arch/tc35143.h>
+#include <asm/ucb1200.h>
+#endif
+#endif
+
+#include <linux/timer.h>
+
+#include "../lirc.h"
+#include "../lirc_dev/lirc_dev.h"
+#include "../kcompat.h"
+
+/* SECTION: Definitions */
+
+/*** Tekram dongle ***/
+#ifdef LIRC_SIR_TEKRAM
+/* stolen from kernel source */
+/* definitions for Tekram dongle */
+#define TEKRAM_115200 0x00
+#define TEKRAM_57600  0x01
+#define TEKRAM_38400  0x02
+#define TEKRAM_19200  0x03
+#define TEKRAM_9600   0x04
+#define TEKRAM_2400   0x08
+
+#define TEKRAM_PW 0x10 /* Pulse select bit */
+
+/* 10bit * 1s/115200bit in milliseconds = 87ms*/
+#define TIME_CONST (10000000ul/115200ul)
+
+#endif
+
+#ifdef LIRC_SIR_ACTISYS_ACT200L
+static void init_act200(void);
+#elif defined(LIRC_SIR_ACTISYS_ACT220L)
+static void init_act220(void);
+#endif
+
+/*** SA1100 ***/
+#ifdef LIRC_ON_SA1100
+struct sa1100_ser2_registers {
+	/* HSSP control register */
+	unsigned char hscr0;
+	/* UART registers */
+	unsigned char utcr0;
+	unsigned char utcr1;
+	unsigned char utcr2;
+	unsigned char utcr3;
+	unsigned char utcr4;
+	unsigned char utdr;
+	unsigned char utsr0;
+	unsigned char utsr1;
+} sr;
+
+static int irq = IRQ_Ser2ICP;
+
+#define LIRC_ON_SA1100_TRANSMITTER_LATENCY 0
+
+/* pulse/space ratio of 50/50 */
+static unsigned long pulse_width = (13-LIRC_ON_SA1100_TRANSMITTER_LATENCY);
+/* 1000000/freq-pulse_width */
+static unsigned long space_width = (13-LIRC_ON_SA1100_TRANSMITTER_LATENCY);
+static unsigned int freq = 38000;      /* modulation frequency */
+static unsigned int duty_cycle = 50;   /* duty cycle of 50% */
+
+#endif
+
+#define RBUF_LEN 1024
+#define WBUF_LEN 1024
+
+#define LIRC_DRIVER_NAME "lirc_sir"
+
+#define PULSE '['
+
+#ifndef LIRC_SIR_TEKRAM
+/* 9bit * 1s/115200bit in milli seconds = 78.125ms*/
+#define TIME_CONST (9000000ul/115200ul)
+#endif
+
+
+/* timeout for sequences in jiffies (=5/100s), must be longer than TIME_CONST */
+#define SIR_TIMEOUT	(HZ*5/100)
+
+#ifndef LIRC_ON_SA1100
+#ifndef LIRC_IRQ
+#define LIRC_IRQ 4
+#endif
+#ifndef LIRC_PORT
+/* for external dongles, default to com1 */
+#if defined(LIRC_SIR_ACTISYS_ACT200L) || \
+    defined(LIRC_SIR_ACTISYS_ACT220L) || \
+    defined(LIRC_SIR_TEKRAM)
+#define LIRC_PORT 0x3f8
+#else
+/* onboard sir ports are typically com3 */
+#define LIRC_PORT 0x3e8
+#endif
+#endif
+
+static int io = LIRC_PORT;
+static int irq = LIRC_IRQ;
+static int threshold = 3;
+#endif
+
+static DEFINE_SPINLOCK(timer_lock);
+static struct timer_list timerlist;
+/* time of last signal change detected */
+static struct timeval last_tv = {0, 0};
+/* time of last UART data ready interrupt */
+static struct timeval last_intr_tv = {0, 0};
+static int last_value;
+
+static DECLARE_WAIT_QUEUE_HEAD(lirc_read_queue);
+
+static DEFINE_SPINLOCK(hardware_lock);
+static DEFINE_SPINLOCK(dev_lock);
+
+static lirc_t rx_buf[RBUF_LEN];
+static unsigned int rx_tail, rx_head;
+static lirc_t tx_buf[WBUF_LEN];
+
+static int debug;
+#define dprintk(fmt, args...)						\
+	do {								\
+		if (debug)						\
+			printk(KERN_DEBUG LIRC_DRIVER_NAME ": "		\
+				fmt, ## args);				\
+	} while (0)
+
+/* SECTION: Prototypes */
+
+/* Communication with user-space */
+static int lirc_open(struct inode *inode, struct file *file);
+static int lirc_close(struct inode *inode, struct file *file);
+static unsigned int lirc_poll(struct file *file, poll_table *wait);
+static ssize_t lirc_read(struct file *file, char *buf, size_t count,
+		loff_t *ppos);
+static ssize_t lirc_write(struct file *file, const char *buf, size_t n,
+		loff_t *pos);
+static int lirc_ioctl(struct inode *node, struct file *filep, unsigned int cmd,
+		unsigned long arg);
+static void add_read_queue(int flag, unsigned long val);
+#ifdef MODULE
+static int init_chrdev(void);
+static void drop_chrdev(void);
+#endif
+/* Hardware */
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 19)
+static irqreturn_t sir_interrupt(int irq, void *dev_id,
+				 struct pt_regs *regs);
+#else
+static irqreturn_t sir_interrupt(int irq, void *dev_id);
+#endif
+static void send_space(unsigned long len);
+static void send_pulse(unsigned long len);
+static int init_hardware(void);
+static void drop_hardware(void);
+/* Initialisation */
+static int init_port(void);
+static void drop_port(void);
+
+#ifdef LIRC_ON_SA1100
+static void on(void)
+{
+	PPSR |= PPC_TXD2;
+}
+
+static void off(void)
+{
+	PPSR &= ~PPC_TXD2;
+}
+#else
+static unsigned int sinp(int offset)
+{
+	return inb(io + offset);
+}
+
+static void soutp(int offset, int value)
+{
+	outb(value, io + offset);
+}
+#endif
+
+#ifndef MAX_UDELAY_MS
+#define MAX_UDELAY_US 5000
+#else
+#define MAX_UDELAY_US (MAX_UDELAY_MS*1000)
+#endif
+
+static void safe_udelay(unsigned long usecs)
+{
+	while (usecs > MAX_UDELAY_US) {
+		udelay(MAX_UDELAY_US);
+		usecs -= MAX_UDELAY_US;
+	}
+	udelay(usecs);
+}
+
+/* SECTION: Communication with user-space */
+
+static int lirc_open(struct inode *inode, struct file *file)
+{
+	spin_lock(&dev_lock);
+	if (MOD_IN_USE) {
+		spin_unlock(&dev_lock);
+		return -EBUSY;
+	}
+	MOD_INC_USE_COUNT;
+	spin_unlock(&dev_lock);
+	return 0;
+}
+
+static int lirc_close(struct inode *inode, struct file *file)
+{
+	MOD_DEC_USE_COUNT;
+	return 0;
+}
+
+static unsigned int lirc_poll(struct file *file, poll_table *wait)
+{
+	poll_wait(file, &lirc_read_queue, wait);
+	if (rx_head != rx_tail)
+		return POLLIN | POLLRDNORM;
+	return 0;
+}
+
+static ssize_t lirc_read(struct file *file, char *buf, size_t count,
+		loff_t *ppos)
+{
+	int n = 0;
+	int retval = 0;
+	DECLARE_WAITQUEUE(wait, current);
+
+	if (count % sizeof(lirc_t))
+		return -EINVAL;
+
+	add_wait_queue(&lirc_read_queue, &wait);
+	set_current_state(TASK_INTERRUPTIBLE);
+	while (n < count) {
+		if (rx_head != rx_tail) {
+			if (copy_to_user((void *) buf + n,
+					(void *) (rx_buf + rx_head),
+					sizeof(lirc_t))) {
+				retval = -EFAULT;
+				break;
+			}
+			rx_head = (rx_head + 1) & (RBUF_LEN - 1);
+			n += sizeof(lirc_t);
+		} else {
+			if (file->f_flags & O_NONBLOCK) {
+				retval = -EAGAIN;
+				break;
+			}
+			if (signal_pending(current)) {
+				retval = -ERESTARTSYS;
+				break;
+			}
+			schedule();
+			set_current_state(TASK_INTERRUPTIBLE);
+		}
+	}
+	remove_wait_queue(&lirc_read_queue, &wait);
+	set_current_state(TASK_RUNNING);
+	return n ? n : retval;
+}
+static ssize_t lirc_write(struct file *file, const char *buf, size_t n,
+				loff_t *pos)
+{
+	unsigned long flags;
+	int i;
+
+	if (n % sizeof(lirc_t) || (n / sizeof(lirc_t)) > WBUF_LEN)
+		return -EINVAL;
+	if (copy_from_user(tx_buf, buf, n))
+		return -EFAULT;
+	i = 0;
+	n /= sizeof(lirc_t);
+#ifdef LIRC_ON_SA1100
+	/* disable receiver */
+	Ser2UTCR3 = 0;
+#endif
+	local_irq_save(flags);
+	while (1) {
+		if (i >= n)
+			break;
+		if (tx_buf[i])
+			send_pulse(tx_buf[i]);
+		i++;
+		if (i >= n)
+			break;
+		if (tx_buf[i])
+			send_space(tx_buf[i]);
+		i++;
+	}
+	local_irq_restore(flags);
+#ifdef LIRC_ON_SA1100
+	off();
+	udelay(1000); /* wait 1ms for IR diode to recover */
+	Ser2UTCR3 = 0;
+	/* clear status register to prevent unwanted interrupts */
+	Ser2UTSR0 &= (UTSR0_RID | UTSR0_RBB | UTSR0_REB);
+	/* enable receiver */
+	Ser2UTCR3 = UTCR3_RXE|UTCR3_RIE;
+#endif
+	return n;
+}
+
+static int lirc_ioctl(struct inode *node, struct file *filep, unsigned int cmd,
+		unsigned long arg)
+{
+	int retval = 0;
+	unsigned long value = 0;
+#ifdef LIRC_ON_SA1100
+	unsigned int ivalue;
+
+	if (cmd == LIRC_GET_FEATURES)
+		value = LIRC_CAN_SEND_PULSE |
+			LIRC_CAN_SET_SEND_DUTY_CYCLE |
+			LIRC_CAN_SET_SEND_CARRIER |
+			LIRC_CAN_REC_MODE2;
+	else if (cmd == LIRC_GET_SEND_MODE)
+		value = LIRC_MODE_PULSE;
+	else if (cmd == LIRC_GET_REC_MODE)
+		value = LIRC_MODE_MODE2;
+#else
+	if (cmd == LIRC_GET_FEATURES)
+		value = LIRC_CAN_SEND_PULSE | LIRC_CAN_REC_MODE2;
+	else if (cmd == LIRC_GET_SEND_MODE)
+		value = LIRC_MODE_PULSE;
+	else if (cmd == LIRC_GET_REC_MODE)
+		value = LIRC_MODE_MODE2;
+#endif
+
+	switch (cmd) {
+	case LIRC_GET_FEATURES:
+	case LIRC_GET_SEND_MODE:
+	case LIRC_GET_REC_MODE:
+		retval = put_user(value, (unsigned long *) arg);
+		break;
+
+	case LIRC_SET_SEND_MODE:
+	case LIRC_SET_REC_MODE:
+		retval = get_user(value, (unsigned long *) arg);
+		break;
+#ifdef LIRC_ON_SA1100
+	case LIRC_SET_SEND_DUTY_CYCLE:
+		retval = get_user(ivalue, (unsigned int *) arg);
+		if (retval)
+			return reetval;
+		if (ivalue <= 0 || ivalue > 100)
+			return -EINVAL;
+		/* (ivalue/100)*(1000000/freq) */
+		duty_cycle = ivalue;
+		pulse_width = (unsigned long) duty_cycle*10000/freq;
+		space_width = (unsigned long) 1000000L/freq-pulse_width;
+		if (pulse_width >= LIRC_ON_SA1100_TRANSMITTER_LATENCY)
+			pulse_width -= LIRC_ON_SA1100_TRANSMITTER_LATENCY;
+		if (space_width >= LIRC_ON_SA1100_TRANSMITTER_LATENCY)
+			space_width -= LIRC_ON_SA1100_TRANSMITTER_LATENCY;
+		break;
+	case LIRC_SET_SEND_CARRIER:
+		retval = get_user(ivalue, (unsigned int *) arg);
+		if (retval)
+			return retval;
+		if (ivalue > 500000 || ivalue < 20000)
+			return -EINVAL;
+		freq = ivalue;
+		pulse_width = (unsigned long) duty_cycle*10000/freq;
+		space_width = (unsigned long) 1000000L/freq-pulse_width;
+		if (pulse_width >= LIRC_ON_SA1100_TRANSMITTER_LATENCY)
+			pulse_width -= LIRC_ON_SA1100_TRANSMITTER_LATENCY;
+		if (space_width >= LIRC_ON_SA1100_TRANSMITTER_LATENCY)
+			space_width -= LIRC_ON_SA1100_TRANSMITTER_LATENCY;
+		break;
+#endif
+	default:
+		retval = -ENOIOCTLCMD;
+
+	}
+
+	if (retval)
+		return retval;
+	if (cmd == LIRC_SET_REC_MODE) {
+		if (value != LIRC_MODE_MODE2)
+			retval = -ENOSYS;
+	} else if (cmd == LIRC_SET_SEND_MODE) {
+		if (value != LIRC_MODE_PULSE)
+			retval = -ENOSYS;
+	}
+
+	return retval;
+}
+
+static void add_read_queue(int flag, unsigned long val)
+{
+	unsigned int new_rx_tail;
+	lirc_t newval;
+
+	dprintk("add flag %d with val %lu\n", flag, val);
+
+	newval = val & PULSE_MASK;
+
+	/*
+	 * statistically, pulses are ~TIME_CONST/2 too long. we could
+	 * maybe make this more exact, but this is good enough
+	 */
+	if (flag) {
+		/* pulse */
+		if (newval > TIME_CONST/2)
+			newval -= TIME_CONST/2;
+		else /* should not ever happen */
+			newval = 1;
+		newval |= PULSE_BIT;
+	} else {
+		newval += TIME_CONST/2;
+	}
+	new_rx_tail = (rx_tail + 1) & (RBUF_LEN - 1);
+	if (new_rx_tail == rx_head) {
+		dprintk("Buffer overrun.\n");
+		return;
+	}
+	rx_buf[rx_tail] = newval;
+	rx_tail = new_rx_tail;
+	wake_up_interruptible(&lirc_read_queue);
+}
+
+static struct file_operations lirc_fops = {
+	.owner		= THIS_MODULE,
+	.read		= lirc_read,
+	.write		= lirc_write,
+	.poll		= lirc_poll,
+	.ioctl		= lirc_ioctl,
+	.open		= lirc_open,
+	.release	= lirc_close,
+};
+
+static int set_use_inc(void *data)
+{
+       return 0;
+}
+
+static void set_use_dec(void *data)
+{
+}
+
+static struct lirc_driver driver = {
+       .name		= LIRC_DRIVER_NAME,
+       .minor		= -1,
+       .code_length	= 1,
+       .sample_rate	= 0,
+       .data		= NULL,
+       .add_to_buf	= NULL,
+#ifndef LIRC_REMOVE_DURING_EXPORT
+       .get_queue	= NULL,
+#endif
+       .set_use_inc	= set_use_inc,
+       .set_use_dec	= set_use_dec,
+       .fops		= &lirc_fops,
+       .dev		= NULL,
+       .owner		= THIS_MODULE,
+};
+
+
+#ifdef MODULE
+static int init_chrdev(void)
+{
+	driver.minor = lirc_register_driver(&driver);
+	if (driver.minor < 0) {
+		printk(KERN_ERR LIRC_DRIVER_NAME ": init_chrdev() failed.\n");
+		return -EIO;
+	}
+	return 0;
+}
+
+static void drop_chrdev(void)
+{
+	lirc_unregister_driver(driver.minor);
+}
+#endif
+
+/* SECTION: Hardware */
+static long delta(struct timeval *tv1, struct timeval *tv2)
+{
+	unsigned long deltv;
+
+	deltv = tv2->tv_sec - tv1->tv_sec;
+	if (deltv > 15)
+		deltv = 0xFFFFFF;
+	else
+		deltv = deltv*1000000 +
+			tv2->tv_usec -
+			tv1->tv_usec;
+	return deltv;
+}
+
+static void sir_timeout(unsigned long data)
+{
+	/*
+	 * if last received signal was a pulse, but receiving stopped
+	 * within the 9 bit frame, we need to finish this pulse and
+	 * simulate a signal change to from pulse to space. Otherwise
+	 * upper layers will receive two sequences next time.
+	 */
+
+	unsigned long flags;
+	unsigned long pulse_end;
+
+	/* avoid interference with interrupt */
+	spin_lock_irqsave(&timer_lock, flags);
+	if (last_value) {
+#ifndef LIRC_ON_SA1100
+		/* clear unread bits in UART and restart */
+		outb(UART_FCR_CLEAR_RCVR, io + UART_FCR);
+#endif
+		/* determine 'virtual' pulse end: */
+		pulse_end = delta(&last_tv, &last_intr_tv);
+		dprintk("timeout add %d for %lu usec\n", last_value, pulse_end);
+		add_read_queue(last_value, pulse_end);
+		last_value = 0;
+		last_tv = last_intr_tv;
+	}
+	spin_unlock_irqrestore(&timer_lock, flags);
+}
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 19)
+static irqreturn_t sir_interrupt(int irq, void *dev_id,
+				 struct pt_regs *regs)
+#else
+static irqreturn_t sir_interrupt(int irq, void *dev_id)
+#endif
+{
+	unsigned char data;
+	struct timeval curr_tv;
+	static unsigned long deltv;
+#ifdef LIRC_ON_SA1100
+	int status;
+	static int n;
+
+	status = Ser2UTSR0;
+	/*
+	 * Deal with any receive errors first.  The bytes in error may be
+	 * the only bytes in the receive FIFO, so we do this first.
+	 */
+	while (status & UTSR0_EIF) {
+		int bstat;
+
+		if (debug) {
+			dprintk("EIF\n");
+			bstat = Ser2UTSR1;
+
+			if (bstat & UTSR1_FRE)
+				dprintk("frame error\n");
+			if (bstat & UTSR1_ROR)
+				dprintk("receive fifo overrun\n");
+			if (bstat & UTSR1_PRE)
+				dprintk("parity error\n");
+		}
+
+		bstat = Ser2UTDR;
+		n++;
+		status = Ser2UTSR0;
+	}
+
+	if (status & (UTSR0_RFS | UTSR0_RID)) {
+		do_gettimeofday(&curr_tv);
+		deltv = delta(&last_tv, &curr_tv);
+		do {
+			data = Ser2UTDR;
+			dprintk("%d data: %u\n", n, (unsigned int) data);
+			n++;
+		} while (status & UTSR0_RID && /* do not empty fifo in order to
+						* get UTSR0_RID in any case */
+		      Ser2UTSR1 & UTSR1_RNE); /* data ready */
+
+		if (status&UTSR0_RID) {
+			add_read_queue(0 , deltv - n * TIME_CONST); /*space*/
+			add_read_queue(1, n * TIME_CONST); /*pulse*/
+			n = 0;
+			last_tv = curr_tv;
+		}
+	}
+
+	if (status & UTSR0_TFS)
+		printk(KERN_ERR "transmit fifo not full, shouldn't happen\n");
+
+	/* We must clear certain bits. */
+	status &= (UTSR0_RID | UTSR0_RBB | UTSR0_REB);
+	if (status)
+		Ser2UTSR0 = status;
+#else
+	unsigned long deltintrtv;
+	unsigned long flags;
+	int iir, lsr;
+
+	while ((iir = inb(io + UART_IIR) & UART_IIR_ID)) {
+		switch (iir&UART_IIR_ID) { /* FIXME toto treba preriedit */
+		case UART_IIR_MSI:
+			(void) inb(io + UART_MSR);
+			break;
+		case UART_IIR_RLSI:
+			(void) inb(io + UART_LSR);
+			break;
+		case UART_IIR_THRI:
+#if 0
+			if (lsr & UART_LSR_THRE) /* FIFO is empty */
+				outb(data, io + UART_TX)
+#endif
+			break;
+		case UART_IIR_RDI:
+			/* avoid interference with timer */
+			spin_lock_irqsave(&timer_lock, flags);
+			do {
+				del_timer(&timerlist);
+				data = inb(io + UART_RX);
+				do_gettimeofday(&curr_tv);
+				deltv = delta(&last_tv, &curr_tv);
+				deltintrtv = delta(&last_intr_tv, &curr_tv);
+				dprintk("t %lu, d %d\n", deltintrtv, (int)data);
+				/*
+				 * if nothing came in last X cycles,
+				 * it was gap
+				 */
+				if (deltintrtv > TIME_CONST * threshold) {
+					if (last_value) {
+						dprintk("GAP\n");
+						/* simulate signal change */
+						add_read_queue(last_value,
+							       deltv -
+							       deltintrtv);
+						last_value = 0;
+						last_tv.tv_sec =
+							last_intr_tv.tv_sec;
+						last_tv.tv_usec =
+							last_intr_tv.tv_usec;
+						deltv = deltintrtv;
+					}
+				}
+				data = 1;
+				if (data ^ last_value) {
+					/*
+					 * deltintrtv > 2*TIME_CONST, remember?
+					 * the other case is timeout
+					 */
+					add_read_queue(last_value,
+						       deltv-TIME_CONST);
+					last_value = data;
+					last_tv = curr_tv;
+					if (last_tv.tv_usec >= TIME_CONST) {
+						last_tv.tv_usec -= TIME_CONST;
+					} else {
+						last_tv.tv_sec--;
+						last_tv.tv_usec += 1000000 -
+							TIME_CONST;
+					}
+				}
+				last_intr_tv = curr_tv;
+				if (data) {
+					/*
+					 * start timer for end of
+					 * sequence detection
+					 */
+					timerlist.expires = jiffies +
+								SIR_TIMEOUT;
+					add_timer(&timerlist);
+				}
+
+				lsr = inb(io + UART_LSR);
+			} while (lsr & UART_LSR_DR); /* data ready */
+			spin_unlock_irqrestore(&timer_lock, flags);
+			break;
+		default:
+			break;
+		}
+	}
+#endif
+	return IRQ_RETVAL(IRQ_HANDLED);
+}
+
+#ifdef LIRC_ON_SA1100
+static void send_pulse(unsigned long length)
+{
+	unsigned long k, delay;
+	int flag;
+
+	if (length == 0)
+		return;
+	/*
+	 * this won't give us the carrier frequency we really want
+	 * due to integer arithmetic, but we can accept this inaccuracy
+	 */
+
+	for (k = flag = 0; k < length; k += delay, flag = !flag) {
+		if (flag) {
+			off();
+			delay = space_width;
+		} else {
+			on();
+			delay = pulse_width;
+		}
+		safe_udelay(delay);
+	}
+	off();
+}
+
+static void send_space(unsigned long length)
+{
+	if (length == 0)
+		return;
+	off();
+	safe_udelay(length);
+}
+#else
+static void send_space(unsigned long len)
+{
+	safe_udelay(len);
+}
+
+static void send_pulse(unsigned long len)
+{
+	long bytes_out = len / TIME_CONST;
+	long time_left;
+
+	time_left = (long)len - (long)bytes_out * (long)TIME_CONST;
+	if (bytes_out == 0) {
+		bytes_out++;
+		time_left = 0;
+	}
+	while (bytes_out--) {
+		outb(PULSE, io + UART_TX);
+		/* FIXME treba seriozne cakanie z drivers/char/serial.c */
+		while (!(inb(io + UART_LSR) & UART_LSR_THRE))
+			;
+	}
+#if 0
+	if (time_left > 0)
+		safe_udelay(time_left);
+#endif
+}
+#endif
+
+#ifdef CONFIG_SA1100_COLLIE
+static int sa1100_irda_set_power_collie(int state)
+{
+	if (state) {
+		/*
+		 *  0 - off
+		 *  1 - short range, lowest power
+		 *  2 - medium range, medium power
+		 *  3 - maximum range, high power
+		 */
+		ucb1200_set_io_direction(TC35143_GPIO_IR_ON,
+					 TC35143_IODIR_OUTPUT);
+		ucb1200_set_io(TC35143_GPIO_IR_ON, TC35143_IODAT_LOW);
+		udelay(100);
+	} else {
+		/* OFF */
+		ucb1200_set_io_direction(TC35143_GPIO_IR_ON,
+					 TC35143_IODIR_OUTPUT);
+		ucb1200_set_io(TC35143_GPIO_IR_ON, TC35143_IODAT_HIGH);
+	}
+	return 0;
+}
+#endif
+
+static int init_hardware(void)
+{
+	unsigned long flags;
+
+	spin_lock_irqsave(&hardware_lock, flags);
+	/* reset UART */
+#ifdef LIRC_ON_SA1100
+#ifdef CONFIG_SA1100_BITSY
+	if (machine_is_bitsy()) {
+		printk(KERN_INFO "Power on IR module\n");
+		set_bitsy_egpio(EGPIO_BITSY_IR_ON);
+	}
+#endif
+#ifdef CONFIG_SA1100_COLLIE
+	sa1100_irda_set_power_collie(3);	/* power on */
+#endif
+	sr.hscr0 = Ser2HSCR0;
+
+	sr.utcr0 = Ser2UTCR0;
+	sr.utcr1 = Ser2UTCR1;
+	sr.utcr2 = Ser2UTCR2;
+	sr.utcr3 = Ser2UTCR3;
+	sr.utcr4 = Ser2UTCR4;
+
+	sr.utdr = Ser2UTDR;
+	sr.utsr0 = Ser2UTSR0;
+	sr.utsr1 = Ser2UTSR1;
+
+	/* configure GPIO */
+	/* output */
+	PPDR |= PPC_TXD2;
+	PSDR |= PPC_TXD2;
+	/* set output to 0 */
+	off();
+
+	/* Enable HP-SIR modulation, and ensure that the port is disabled. */
+	Ser2UTCR3 = 0;
+	Ser2HSCR0 = sr.hscr0 & (~HSCR0_HSSP);
+
+	/* clear status register to prevent unwanted interrupts */
+	Ser2UTSR0 &= (UTSR0_RID | UTSR0_RBB | UTSR0_REB);
+
+	/* 7N1 */
+	Ser2UTCR0 = UTCR0_1StpBit|UTCR0_7BitData;
+	/* 115200 */
+	Ser2UTCR1 = 0;
+	Ser2UTCR2 = 1;
+	/* use HPSIR, 1.6 usec pulses */
+	Ser2UTCR4 = UTCR4_HPSIR|UTCR4_Z1_6us;
+
+	/* enable receiver, receive fifo interrupt */
+	Ser2UTCR3 = UTCR3_RXE|UTCR3_RIE;
+
+	/* clear status register to prevent unwanted interrupts */
+	Ser2UTSR0 &= (UTSR0_RID | UTSR0_RBB | UTSR0_REB);
+
+#elif defined(LIRC_SIR_TEKRAM)
+	/* disable FIFO */
+	soutp(UART_FCR,
+	      UART_FCR_CLEAR_RCVR|
+	      UART_FCR_CLEAR_XMIT|
+	      UART_FCR_TRIGGER_1);
+
+	/* Set DLAB 0. */
+	soutp(UART_LCR, sinp(UART_LCR) & (~UART_LCR_DLAB));
+
+	/* First of all, disable all interrupts */
+	soutp(UART_IER, sinp(UART_IER) &
+	      (~(UART_IER_MSI|UART_IER_RLSI|UART_IER_THRI|UART_IER_RDI)));
+
+	/* Set DLAB 1. */
+	soutp(UART_LCR, sinp(UART_LCR) | UART_LCR_DLAB);
+
+	/* Set divisor to 12 => 9600 Baud */
+	soutp(UART_DLM, 0);
+	soutp(UART_DLL, 12);
+
+	/* Set DLAB 0. */
+	soutp(UART_LCR, sinp(UART_LCR) & (~UART_LCR_DLAB));
+
+	/* power supply */
+	soutp(UART_MCR, UART_MCR_RTS|UART_MCR_DTR|UART_MCR_OUT2);
+	safe_udelay(50*1000);
+
+	/* -DTR low -> reset PIC */
+	soutp(UART_MCR, UART_MCR_RTS|UART_MCR_OUT2);
+	udelay(1*1000);
+
+	soutp(UART_MCR, UART_MCR_RTS|UART_MCR_DTR|UART_MCR_OUT2);
+	udelay(100);
+
+
+	/* -RTS low -> send control byte */
+	soutp(UART_MCR, UART_MCR_DTR|UART_MCR_OUT2);
+	udelay(7);
+	soutp(UART_TX, TEKRAM_115200|TEKRAM_PW);
+
+	/* one byte takes ~1042 usec to transmit at 9600,8N1 */
+	udelay(1500);
+
+	/* back to normal operation */
+	soutp(UART_MCR, UART_MCR_RTS|UART_MCR_DTR|UART_MCR_OUT2);
+	udelay(50);
+
+	udelay(1500);
+
+	/* read previous control byte */
+	printk(KERN_INFO LIRC_DRIVER_NAME
+	       ": 0x%02x\n", sinp(UART_RX));
+
+	/* Set DLAB 1. */
+	soutp(UART_LCR, sinp(UART_LCR) | UART_LCR_DLAB);
+
+	/* Set divisor to 1 => 115200 Baud */
+	soutp(UART_DLM, 0);
+	soutp(UART_DLL, 1);
+
+	/* Set DLAB 0, 8 Bit */
+	soutp(UART_LCR, UART_LCR_WLEN8);
+	/* enable interrupts */
+	soutp(UART_IER, sinp(UART_IER)|UART_IER_RDI);
+#else
+	outb(0, io + UART_MCR);
+	outb(0, io + UART_IER);
+	/* init UART */
+	/* set DLAB, speed = 115200 */
+	outb(UART_LCR_DLAB | UART_LCR_WLEN7, io + UART_LCR);
+	outb(1, io + UART_DLL); outb(0, io + UART_DLM);
+	/* 7N1+start = 9 bits at 115200 ~ 3 bits at 44000 */
+	outb(UART_LCR_WLEN7, io + UART_LCR);
+	/* FIFO operation */
+	outb(UART_FCR_ENABLE_FIFO, io + UART_FCR);
+	/* interrupts */
+	/* outb(UART_IER_RLSI|UART_IER_RDI|UART_IER_THRI, io + UART_IER); */
+	outb(UART_IER_RDI, io + UART_IER);
+	/* turn on UART */
+	outb(UART_MCR_DTR|UART_MCR_RTS|UART_MCR_OUT2, io + UART_MCR);
+#ifdef LIRC_SIR_ACTISYS_ACT200L
+	init_act200();
+#elif defined(LIRC_SIR_ACTISYS_ACT220L)
+	init_act220();
+#endif
+#endif
+	spin_unlock_irqrestore(&hardware_lock, flags);
+	return 0;
+}
+
+static void drop_hardware(void)
+{
+	unsigned long flags;
+
+	spin_lock_irqsave(&hardware_lock, flags);
+
+#ifdef LIRC_ON_SA1100
+	Ser2UTCR3 = 0;
+
+	Ser2UTCR0 = sr.utcr0;
+	Ser2UTCR1 = sr.utcr1;
+	Ser2UTCR2 = sr.utcr2;
+	Ser2UTCR4 = sr.utcr4;
+	Ser2UTCR3 = sr.utcr3;
+
+	Ser2HSCR0 = sr.hscr0;
+#ifdef CONFIG_SA1100_BITSY
+	if (machine_is_bitsy())
+		clr_bitsy_egpio(EGPIO_BITSY_IR_ON);
+#endif
+#ifdef CONFIG_SA1100_COLLIE
+	sa1100_irda_set_power_collie(0);	/* power off */
+#endif
+#else
+	/* turn off interrupts */
+	outb(0, io + UART_IER);
+#endif
+	spin_unlock_irqrestore(&hardware_lock, flags);
+}
+
+/* SECTION: Initialisation */
+
+static int init_port(void)
+{
+	int retval;
+
+	/* get I/O port access and IRQ line */
+#ifndef LIRC_ON_SA1100
+	if (request_region(io, 8, LIRC_DRIVER_NAME) == NULL) {
+		printk(KERN_ERR LIRC_DRIVER_NAME
+		       ": i/o port 0x%.4x already in use.\n", io);
+		return -EBUSY;
+	}
+#endif
+	retval = request_irq(irq, sir_interrupt, IRQF_DISABLED,
+			     LIRC_DRIVER_NAME, NULL);
+	if (retval < 0) {
+#               ifndef LIRC_ON_SA1100
+		release_region(io, 8);
+#               endif
+		printk(KERN_ERR LIRC_DRIVER_NAME
+			": IRQ %d already in use.\n",
+			irq);
+		return retval;
+	}
+#ifndef LIRC_ON_SA1100
+	printk(KERN_INFO LIRC_DRIVER_NAME
+		": I/O port 0x%.4x, IRQ %d.\n",
+		io, irq);
+#endif
+
+	init_timer(&timerlist);
+	timerlist.function = sir_timeout;
+	timerlist.data = 0xabadcafe;
+
+	return 0;
+}
+
+static void drop_port(void)
+{
+	free_irq(irq, NULL);
+	del_timer_sync(&timerlist);
+#ifndef LIRC_ON_SA1100
+	release_region(io, 8);
+#endif
+}
+
+#ifdef LIRC_SIR_ACTISYS_ACT200L
+/* Crystal/Cirrus CS8130 IR transceiver, used in Actisys Act200L dongle */
+/* some code borrowed from Linux IRDA driver */
+
+/* Register 0: Control register #1 */
+#define ACT200L_REG0    0x00
+#define ACT200L_TXEN    0x01 /* Enable transmitter */
+#define ACT200L_RXEN    0x02 /* Enable receiver */
+#define ACT200L_ECHO    0x08 /* Echo control chars */
+
+/* Register 1: Control register #2 */
+#define ACT200L_REG1    0x10
+#define ACT200L_LODB    0x01 /* Load new baud rate count value */
+#define ACT200L_WIDE    0x04 /* Expand the maximum allowable pulse */
+
+/* Register 3: Transmit mode register #2 */
+#define ACT200L_REG3    0x30
+#define ACT200L_B0      0x01 /* DataBits, 0=6, 1=7, 2=8, 3=9(8P)  */
+#define ACT200L_B1      0x02 /* DataBits, 0=6, 1=7, 2=8, 3=9(8P)  */
+#define ACT200L_CHSY    0x04 /* StartBit Synced 0=bittime, 1=startbit */
+
+/* Register 4: Output Power register */
+#define ACT200L_REG4    0x40
+#define ACT200L_OP0     0x01 /* Enable LED1C output */
+#define ACT200L_OP1     0x02 /* Enable LED2C output */
+#define ACT200L_BLKR    0x04
+
+/* Register 5: Receive Mode register */
+#define ACT200L_REG5    0x50
+#define ACT200L_RWIDL   0x01 /* fixed 1.6us pulse mode */
+    /*.. other various IRDA bit modes, and TV remote modes..*/
+
+/* Register 6: Receive Sensitivity register #1 */
+#define ACT200L_REG6    0x60
+#define ACT200L_RS0     0x01 /* receive threshold bit 0 */
+#define ACT200L_RS1     0x02 /* receive threshold bit 1 */
+
+/* Register 7: Receive Sensitivity register #2 */
+#define ACT200L_REG7    0x70
+#define ACT200L_ENPOS   0x04 /* Ignore the falling edge */
+
+/* Register 8,9: Baud Rate Divider register #1,#2 */
+#define ACT200L_REG8    0x80
+#define ACT200L_REG9    0x90
+
+#define ACT200L_2400    0x5f
+#define ACT200L_9600    0x17
+#define ACT200L_19200   0x0b
+#define ACT200L_38400   0x05
+#define ACT200L_57600   0x03
+#define ACT200L_115200  0x01
+
+/* Register 13: Control register #3 */
+#define ACT200L_REG13   0xd0
+#define ACT200L_SHDW    0x01 /* Enable access to shadow registers */
+
+/* Register 15: Status register */
+#define ACT200L_REG15   0xf0
+
+/* Register 21: Control register #4 */
+#define ACT200L_REG21   0x50
+#define ACT200L_EXCK    0x02 /* Disable clock output driver */
+#define ACT200L_OSCL    0x04 /* oscillator in low power, medium accuracy mode */
+
+static void init_act200(void)
+{
+	int i;
+	__u8 control[] = {
+		ACT200L_REG15,
+		ACT200L_REG13 | ACT200L_SHDW,
+		ACT200L_REG21 | ACT200L_EXCK | ACT200L_OSCL,
+		ACT200L_REG13,
+		ACT200L_REG7  | ACT200L_ENPOS,
+		ACT200L_REG6  | ACT200L_RS0  | ACT200L_RS1,
+		ACT200L_REG5  | ACT200L_RWIDL,
+		ACT200L_REG4  | ACT200L_OP0  | ACT200L_OP1 | ACT200L_BLKR,
+		ACT200L_REG3  | ACT200L_B0,
+		ACT200L_REG0  | ACT200L_TXEN | ACT200L_RXEN,
+		ACT200L_REG8 |  (ACT200L_115200       & 0x0f),
+		ACT200L_REG9 | ((ACT200L_115200 >> 4) & 0x0f),
+		ACT200L_REG1 | ACT200L_LODB | ACT200L_WIDE
+	};
+
+	/* Set DLAB 1. */
+	soutp(UART_LCR, UART_LCR_DLAB | UART_LCR_WLEN8);
+
+	/* Set divisor to 12 => 9600 Baud */
+	soutp(UART_DLM, 0);
+	soutp(UART_DLL, 12);
+
+	/* Set DLAB 0. */
+	soutp(UART_LCR, UART_LCR_WLEN8);
+	/* Set divisor to 12 => 9600 Baud */
+
+	/* power supply */
+	soutp(UART_MCR, UART_MCR_RTS|UART_MCR_DTR|UART_MCR_OUT2);
+	for (i = 0; i < 50; i++)
+		safe_udelay(1000);
+
+		/* Reset the dongle : set RTS low for 25 ms */
+	soutp(UART_MCR, UART_MCR_DTR|UART_MCR_OUT2);
+	for (i = 0; i < 25; i++)
+		udelay(1000);
+
+	soutp(UART_MCR, UART_MCR_RTS|UART_MCR_DTR|UART_MCR_OUT2);
+	udelay(100);
+
+	/* Clear DTR and set RTS to enter command mode */
+	soutp(UART_MCR, UART_MCR_RTS|UART_MCR_OUT2);
+	udelay(7);
+
+	/* send out the control register settings for 115K 7N1 SIR operation */
+	for (i = 0; i < sizeof(control); i++) {
+		soutp(UART_TX, control[i]);
+		/* one byte takes ~1042 usec to transmit at 9600,8N1 */
+		udelay(1500);
+	}
+
+	/* back to normal operation */
+	soutp(UART_MCR, UART_MCR_RTS|UART_MCR_DTR|UART_MCR_OUT2);
+	udelay(50);
+
+	udelay(1500);
+	soutp(UART_LCR, sinp(UART_LCR) | UART_LCR_DLAB);
+
+	/* Set DLAB 1. */
+	soutp(UART_LCR, UART_LCR_DLAB | UART_LCR_WLEN7);
+
+	/* Set divisor to 1 => 115200 Baud */
+	soutp(UART_DLM, 0);
+	soutp(UART_DLL, 1);
+
+	/* Set DLAB 0. */
+	soutp(UART_LCR, sinp(UART_LCR) & (~UART_LCR_DLAB));
+
+	/* Set DLAB 0, 7 Bit */
+	soutp(UART_LCR, UART_LCR_WLEN7);
+
+	/* enable interrupts */
+	soutp(UART_IER, sinp(UART_IER)|UART_IER_RDI);
+}
+#endif
+
+#ifdef LIRC_SIR_ACTISYS_ACT220L
+/*
+ * Derived from linux IrDA driver (net/irda/actisys.c)
+ * Drop me a mail for any kind of comment: maxx@spaceboyz.net
+ */
+
+void init_act220(void)
+{
+	int i;
+
+	/* DLAB 1 */
+	soutp(UART_LCR, UART_LCR_DLAB|UART_LCR_WLEN7);
+
+	/* 9600 baud */
+	soutp(UART_DLM, 0);
+	soutp(UART_DLL, 12);
+
+	/* DLAB 0 */
+	soutp(UART_LCR, UART_LCR_WLEN7);
+
+	/* reset the dongle, set DTR low for 10us */
+	soutp(UART_MCR, UART_MCR_RTS|UART_MCR_OUT2);
+	udelay(10);
+
+	/* back to normal (still 9600) */
+	soutp(UART_MCR, UART_MCR_DTR|UART_MCR_RTS|UART_MCR_OUT2);
+
+	/*
+	 * send RTS pulses until we reach 115200
+	 * i hope this is really the same for act220l/act220l+
+	 */
+	for (i = 0; i < 3; i++) {
+		udelay(10);
+		/* set RTS low for 10 us */
+		soutp(UART_MCR, UART_MCR_DTR|UART_MCR_OUT2);
+		udelay(10);
+		/* set RTS high for 10 us */
+		soutp(UART_MCR, UART_MCR_RTS|UART_MCR_DTR|UART_MCR_OUT2);
+	}
+
+	/* back to normal operation */
+	udelay(1500); /* better safe than sorry ;) */
+
+	/* Set DLAB 1. */
+	soutp(UART_LCR, UART_LCR_DLAB | UART_LCR_WLEN7);
+
+	/* Set divisor to 1 => 115200 Baud */
+	soutp(UART_DLM, 0);
+	soutp(UART_DLL, 1);
+
+	/* Set DLAB 0, 7 Bit */
+	/* The dongle doesn't seem to have any problems with operation at 7N1 */
+	soutp(UART_LCR, UART_LCR_WLEN7);
+
+	/* enable interrupts */
+	soutp(UART_IER, UART_IER_RDI);
+}
+#endif
+
+static int init_lirc_sir(void)
+{
+	int retval;
+
+	init_waitqueue_head(&lirc_read_queue);
+	retval = init_port();
+	if (retval < 0)
+		return retval;
+	init_hardware();
+	printk(KERN_INFO LIRC_DRIVER_NAME
+		": Installed.\n");
+	return 0;
+}
+
+#ifdef MODULE
+
+static int __init lirc_sir_init(void)
+{
+	int retval;
+
+	retval = init_chrdev();
+	if (retval < 0)
+		return retval;
+	retval = init_lirc_sir();
+	if (retval) {
+		drop_chrdev();
+		return retval;
+	}
+	return 0;
+}
+
+static void __exit lirc_sir_exit(void)
+{
+	drop_hardware();
+	drop_chrdev();
+	drop_port();
+	printk(KERN_INFO LIRC_DRIVER_NAME ": Uninstalled.\n");
+}
+
+module_init(lirc_sir_init);
+module_exit(lirc_sir_exit);
+
+#ifdef LIRC_SIR_TEKRAM
+MODULE_DESCRIPTION("Infrared receiver driver for Tekram Irmate 210");
+MODULE_AUTHOR("Christoph Bartelmus");
+#elif defined(LIRC_ON_SA1100)
+MODULE_DESCRIPTION("LIRC driver for StrongARM SA1100 embedded microprocessor");
+MODULE_AUTHOR("Christoph Bartelmus");
+#elif defined(LIRC_SIR_ACTISYS_ACT200L)
+MODULE_DESCRIPTION("LIRC driver for Actisys Act200L");
+MODULE_AUTHOR("Karl Bongers");
+#elif defined(LIRC_SIR_ACTISYS_ACT220L)
+MODULE_DESCRIPTION("LIRC driver for Actisys Act220L(+)");
+MODULE_AUTHOR("Jan Roemisch");
+#else
+MODULE_DESCRIPTION("Infrared receiver driver for SIR type serial ports");
+MODULE_AUTHOR("Milan Pikula");
+#endif
+MODULE_LICENSE("GPL");
+
+#ifdef LIRC_ON_SA1100
+module_param(irq, int, S_IRUGO);
+MODULE_PARM_DESC(irq, "Interrupt (16)");
+#else
+module_param(io, int, S_IRUGO);
+MODULE_PARM_DESC(io, "I/O address base (0x3f8 or 0x2f8)");
+
+module_param(irq, int, S_IRUGO);
+MODULE_PARM_DESC(irq, "Interrupt (4 or 3)");
+
+module_param(threshold, int, S_IRUGO);
+MODULE_PARM_DESC(threshold, "space detection threshold (3)");
+#endif
+
+module_param(debug, bool, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(debug, "Enable debugging messages");
+
+EXPORT_NO_SYMBOLS;
+
+#endif /* MODULE */
--- linux-rt-2.6.31.orig/ubuntu/lirc/lirc_sir/Makefile
+++ linux-rt-2.6.31/ubuntu/lirc/lirc_sir/Makefile
@@ -0,0 +1,3 @@
+EXTRA_CFLAGS =-DIRCTL_DEV_MAJOR=61 -DLIRC_SERIAL_TRANSMITTER -DLIRC_SERIAL_SOFTCARRIER -I$(src)/..
+
+obj-$(CONFIG_LIRC_SIR)		+= lirc_sir.o
--- linux-rt-2.6.31.orig/ubuntu/lirc/lirc_imon/lirc_imon.c
+++ linux-rt-2.6.31/ubuntu/lirc/lirc_imon/lirc_imon.c
@@ -0,0 +1,2370 @@
+/*
+ *   lirc_imon.c:  LIRC/VFD/LCD driver for SoundGraph iMON IR/VFD/LCD
+ *		   including the iMON PAD model
+ *
+ *   $Id: lirc_imon.c,v 1.111 2009/09/11 04:56:18 jarodwilson Exp $
+ *
+ *   Copyright(C) 2004  Venky Raju(dev@venky.ws)
+ *
+ *   lirc_imon is free software; you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License as published by
+ *   the Free Software Foundation; either version 2 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This program is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *   GNU General Public License for more details.
+ *
+ *   You should have received a copy of the GNU General Public License
+ *   along with this program; if not, write to the Free Software
+ *   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+#include <linux/version.h>
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 0)
+#error "*** Sorry, this driver requires a 2.6 kernel"
+#endif
+
+#include <linux/autoconf.h>
+
+#include <linux/errno.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/slab.h>
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 18)
+#include <asm/uaccess.h>
+#else
+#include <linux/uaccess.h>
+#endif
+#include <linux/usb.h>
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 18)
+#include <linux/usb/input.h>
+#else
+#include <linux/input.h>
+#endif
+#include <linux/time.h>
+#include <linux/timer.h>
+
+#include "../kcompat.h"
+#include "../lirc.h"
+#include "../lirc_dev/lirc_dev.h"
+
+
+#define MOD_AUTHOR	"Venky Raju <dev@venky.ws>"
+#define MOD_DESC	"Driver for SoundGraph iMON MultiMedia IR/Display"
+#define MOD_NAME	"lirc_imon"
+#define MOD_VERSION	"0.6"
+
+#define DISPLAY_MINOR_BASE	144
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 15)
+#define DEVFS_MODE	(S_IFCHR | S_IRUSR | S_IWUSR | \
+			 S_IRGRP | S_IWGRP | S_IROTH)
+#endif
+#define DEVICE_NAME	LIRC_DEVFS_PREFIX "lcd%d"
+
+#define BUF_CHUNK_SIZE	4
+#define BUF_SIZE	128
+
+#define BIT_DURATION	250	/* each bit received is 250us */
+
+#define IMON_CLOCK_ENABLE_PACKETS	2
+
+#define dprintk(fmt, args...)						\
+	do {								\
+		if (debug)						\
+			printk(KERN_INFO MOD_NAME ": " fmt, ## args);	\
+	} while (0)
+
+/*** P R O T O T Y P E S ***/
+
+/* USB Callback prototypes */
+static int imon_probe(struct usb_interface *interface,
+		      const struct usb_device_id *id);
+static void imon_disconnect(struct usb_interface *interface);
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 19)
+static void usb_rx_callback_intf0(struct urb *urb, struct pt_regs *regs);
+static void usb_rx_callback_intf1(struct urb *urb, struct pt_regs *regs);
+static void usb_tx_callback(struct urb *urb, struct pt_regs *regs);
+#else
+static void usb_rx_callback_intf0(struct urb *urb);
+static void usb_rx_callback_intf1(struct urb *urb);
+static void usb_tx_callback(struct urb *urb);
+#endif
+
+/* suspend/resume support */
+static int imon_resume(struct usb_interface *intf);
+static int imon_suspend(struct usb_interface *intf, pm_message_t message);
+
+/* Display file_operations function prototypes */
+static int display_open(struct inode *inode, struct file *file);
+static int display_close(struct inode *inode, struct file *file);
+
+/* VFD write operation */
+static ssize_t vfd_write(struct file *file, const char *buf,
+			 size_t n_bytes, loff_t *pos);
+
+/* LCD file_operations override function prototypes */
+static ssize_t lcd_write(struct file *file, const char *buf,
+			 size_t n_bytes, loff_t *pos);
+
+/* LIRC driver function prototypes */
+static int ir_open(void *data);
+static void ir_close(void *data);
+
+/* Driver init/exit prototypes */
+static int __init imon_init(void);
+static void __exit imon_exit(void);
+
+/*** G L O B A L S ***/
+
+struct imon_context {
+	struct usb_device *usbdev_intf0;
+	/* Newer devices have two interfaces */
+	struct usb_device *usbdev_intf1;
+	int display_supported;		/* not all controllers do */
+	int display_isopen;		/* display port has been opened */
+	int ir_isopen;			/* IR port open	*/
+	int ir_isassociating;		/* IR port open for association */
+	int dev_present_intf0;		/* USB device presence, interface 0 */
+	int dev_present_intf1;		/* USB device presence, interface 1 */
+	struct mutex lock;		/* to lock this object */
+	wait_queue_head_t remove_ok;	/* For unexpected USB disconnects */
+
+	int vfd_proto_6p;		/* some VFD require a 6th packet */
+	int ir_onboard_decode;		/* IR signals decoded onboard */
+
+	struct lirc_driver *driver;
+	struct usb_endpoint_descriptor *rx_endpoint_intf0;
+	struct usb_endpoint_descriptor *rx_endpoint_intf1;
+	struct usb_endpoint_descriptor *tx_endpoint;
+	struct urb *rx_urb_intf0;
+	struct urb *rx_urb_intf1;
+	struct urb *tx_urb;
+	int tx_control;
+	unsigned char usb_rx_buf[8];
+	unsigned char usb_tx_buf[8];
+
+	struct rx_data {
+		int count;		/* length of 0 or 1 sequence */
+		int prev_bit;		/* logic level of sequence */
+		int initial_space;	/* initial space flag */
+	} rx;
+
+	struct tx_t {
+		unsigned char data_buf[35];	/* user data buffer */
+		struct completion finished;	/* wait for write to finish */
+		atomic_t busy;			/* write in progress */
+		int status;			/* status of tx completion */
+	} tx;
+
+	int ffdc_dev;			/* is this the overused ffdc ID? */
+	int ir_protocol;		/* iMON or MCE (RC6) IR protocol? */
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 18)
+	struct input_dev *mouse;	/* input device for iMON PAD remote */
+	struct input_dev *touch;	/* input device for touchscreen */
+#endif
+	int display_type;		/* store the display type */
+	int pad_mouse;			/* toggle kbd(0)/mouse(1) mode */
+	int touch_x;			/* x coordinate on touchscreen */
+	int touch_y;			/* y coordinate on touchscreen */
+	char name_mouse[128];
+	char phys_mouse[64];
+	char name_touch[128];
+	char phys_touch[64];
+	struct timer_list timer;
+};
+
+#define TOUCH_TIMEOUT	(HZ/30)
+
+/* display file operations. Nb: lcd_write will be subbed in as needed later */
+static struct file_operations display_fops = {
+	.owner		= THIS_MODULE,
+	.open		= &display_open,
+	.write		= &vfd_write,
+	.release	= &display_close
+};
+
+enum {
+	IMON_DISPLAY_TYPE_AUTO = 0,
+	IMON_DISPLAY_TYPE_VFD  = 1,
+	IMON_DISPLAY_TYPE_LCD  = 2,
+	IMON_DISPLAY_TYPE_VGA  = 3,
+	IMON_DISPLAY_TYPE_NONE = 4,
+};
+
+enum {
+	IMON_IR_PROTOCOL_IMON       = 0,
+	IMON_IR_PROTOCOL_MCE        = 1,
+	IMON_IR_PROTOCOL_IMON_NOPAD = 2,
+};
+/*
+ * USB Device ID for iMON USB Control Boards
+ *
+ * The Windows drivers contain 6 different inf files, more or less one for
+ * each new device until the 0x0034-0x0046 devices, which all use the same
+ * driver. Some of the devices in the 34-46 range haven't been definitively
+ * identified yet. Early devices have either a TriGem Computer, Inc. or a
+ * Samsung vendor ID (0x0aa8 and 0x04e8 respectively), while all later
+ * devices use the SoundGraph vendor ID (0x15c2).
+ */
+static struct usb_device_id imon_usb_id_table[] = {
+	/* TriGem iMON (IR only) -- TG_iMON.inf */
+	{ USB_DEVICE(0x0aa8, 0x8001) },
+
+	/* SoundGraph iMON (IR only) -- sg_imon.inf */
+	{ USB_DEVICE(0x04e8, 0xff30) },
+
+	/* SoundGraph iMON VFD (IR & VFD) -- iMON_VFD.inf */
+	{ USB_DEVICE(0x0aa8, 0xffda) },
+
+	/* SoundGraph iMON SS (IR & VFD) -- iMON_SS.inf */
+	{ USB_DEVICE(0x15c2, 0xffda) },
+
+	/*
+	 * Several devices with this same device ID, all use iMON_PAD.inf
+	 * SoundGraph iMON PAD (IR & VFD)
+	 * SoundGraph iMON PAD (IR & LCD)
+	 * SoundGraph iMON Knob (IR only)
+	 */
+	/* SoundGraph iMON PAD (IR & VFD/LCD), iMON Knob */
+	{ USB_DEVICE(0x15c2, 0xffdc) },
+
+	/*
+	 * Newer devices, all driven by the latest iMON Windows driver, full
+	 * list of device IDs extracted via 'strings Setup/data1.hdr |grep 15c2'
+	 * Need user input to fill in details on unknown devices.
+	 */
+	/* SoundGraph iMON OEM Touch LCD (IR & 7" VGA LCD) */
+	{ USB_DEVICE(0x15c2, 0x0034) },
+	/* SoundGraph iMON OEM Touch LCD (IR & 4.3" VGA LCD) */
+	{ USB_DEVICE(0x15c2, 0x0035) },
+	/* SoundGraph iMON OEM VFD (IR & VFD) */
+	{ USB_DEVICE(0x15c2, 0x0036) },
+	/* device specifics unknown */
+	{ USB_DEVICE(0x15c2, 0x0037) },
+	/* SoundGraph iMON OEM LCD (IR & LCD) */
+	{ USB_DEVICE(0x15c2, 0x0038) },
+	/* device specifics unknown */
+	{ USB_DEVICE(0x15c2, 0x0039) },
+	/* device specifics unknown */
+	{ USB_DEVICE(0x15c2, 0x003a) },
+	/* device specifics unknown */
+	{ USB_DEVICE(0x15c2, 0x003b) },
+	/* SoundGraph iMON OEM Inside (IR only) */
+	{ USB_DEVICE(0x15c2, 0x003c) },
+	/* device specifics unknown */
+	{ USB_DEVICE(0x15c2, 0x003d) },
+	/* device specifics unknown */
+	{ USB_DEVICE(0x15c2, 0x003e) },
+	/* device specifics unknown */
+	{ USB_DEVICE(0x15c2, 0x003f) },
+	/* device specifics unknown */
+	{ USB_DEVICE(0x15c2, 0x0040) },
+	/* SoundGraph iMON MINI (IR only) */
+	{ USB_DEVICE(0x15c2, 0x0041) },
+	/* Antec Veris Multimedia Station EZ External (IR only) */
+	{ USB_DEVICE(0x15c2, 0x0042) },
+	/* Antec Veris Multimedia Station Basic Internal (IR only) */
+	{ USB_DEVICE(0x15c2, 0x0043) },
+	/* Antec Veris Multimedia Station Elite (IR & VFD) */
+	{ USB_DEVICE(0x15c2, 0x0044) },
+	/* Antec Veris Multimedia Station Premiere (IR & LCD) */
+	{ USB_DEVICE(0x15c2, 0x0045) },
+	/* device specifics unknown */
+	{ USB_DEVICE(0x15c2, 0x0046) },
+	{}
+};
+
+/* Some iMON VFD models requires a 6th packet for VFD writes */
+static struct usb_device_id vfd_proto_6p_list[] = {
+	{ USB_DEVICE(0x15c2, 0xffda) },
+	{ USB_DEVICE(0x15c2, 0xffdc) },
+	{ USB_DEVICE(0x15c2, 0x0036) },
+	{ USB_DEVICE(0x15c2, 0x0044) },
+	{}
+};
+
+/* newer iMON models use control endpoints */
+static struct usb_device_id ctl_ep_device_list[] = {
+	{ USB_DEVICE(0x15c2, 0x0034) },
+	{ USB_DEVICE(0x15c2, 0x0035) },
+	{ USB_DEVICE(0x15c2, 0x0036) },
+	{ USB_DEVICE(0x15c2, 0x0037) },
+	{ USB_DEVICE(0x15c2, 0x0038) },
+	{ USB_DEVICE(0x15c2, 0x0039) },
+	{ USB_DEVICE(0x15c2, 0x003a) },
+	{ USB_DEVICE(0x15c2, 0x003b) },
+	{ USB_DEVICE(0x15c2, 0x003c) },
+	{ USB_DEVICE(0x15c2, 0x003d) },
+	{ USB_DEVICE(0x15c2, 0x003e) },
+	{ USB_DEVICE(0x15c2, 0x003f) },
+	{ USB_DEVICE(0x15c2, 0x0040) },
+	{ USB_DEVICE(0x15c2, 0x0041) },
+	{ USB_DEVICE(0x15c2, 0x0042) },
+	{ USB_DEVICE(0x15c2, 0x0043) },
+	{ USB_DEVICE(0x15c2, 0x0044) },
+	{ USB_DEVICE(0x15c2, 0x0045) },
+	{ USB_DEVICE(0x15c2, 0x0046) },
+	{}
+};
+
+/* iMON LCD models use a different write op */
+static struct usb_device_id lcd_device_list[] = {
+	{ USB_DEVICE(0x15c2, 0xffdc) },
+	{ USB_DEVICE(0x15c2, 0x0038) },
+	{ USB_DEVICE(0x15c2, 0x0045) },
+	{}
+};
+
+/* iMON devices with front panel buttons or touchscreen need a larger buffer */
+static struct usb_device_id large_buffer_list[] = {
+	{ USB_DEVICE(0x15c2, 0x0034) },
+	{ USB_DEVICE(0x15c2, 0x0035) },
+	{ USB_DEVICE(0x15c2, 0x0038) },
+	{ USB_DEVICE(0x15c2, 0x0045) },
+};
+
+/* Newer iMON models decode the signal onboard */
+static struct usb_device_id ir_onboard_decode_list[] = {
+	{ USB_DEVICE(0x15c2, 0xffdc) },
+	{ USB_DEVICE(0x15c2, 0x0034) },
+	{ USB_DEVICE(0x15c2, 0x0035) },
+	{ USB_DEVICE(0x15c2, 0x0036) },
+	{ USB_DEVICE(0x15c2, 0x0037) },
+	{ USB_DEVICE(0x15c2, 0x0038) },
+	{ USB_DEVICE(0x15c2, 0x0039) },
+	{ USB_DEVICE(0x15c2, 0x003a) },
+	{ USB_DEVICE(0x15c2, 0x003b) },
+	{ USB_DEVICE(0x15c2, 0x003c) },
+	{ USB_DEVICE(0x15c2, 0x003d) },
+	{ USB_DEVICE(0x15c2, 0x003e) },
+	{ USB_DEVICE(0x15c2, 0x003f) },
+	{ USB_DEVICE(0x15c2, 0x0040) },
+	{ USB_DEVICE(0x15c2, 0x0041) },
+	{ USB_DEVICE(0x15c2, 0x0042) },
+	{ USB_DEVICE(0x15c2, 0x0043) },
+	{ USB_DEVICE(0x15c2, 0x0044) },
+	{ USB_DEVICE(0x15c2, 0x0045) },
+	{ USB_DEVICE(0x15c2, 0x0046) },
+	{}
+};
+
+/* Some iMON devices have no lcd/vfd, don't set one up */
+static struct usb_device_id ir_only_list[] = {
+	{ USB_DEVICE(0x0aa8, 0x8001) },
+	{ USB_DEVICE(0x04e8, 0xff30) },
+	/* the first imon lcd and the knob share this device id. :\ */
+	/*{ USB_DEVICE(0x15c2, 0xffdc) },*/
+	{ USB_DEVICE(0x15c2, 0x003c) },
+	{ USB_DEVICE(0x15c2, 0x0041) },
+	{ USB_DEVICE(0x15c2, 0x0042) },
+	{ USB_DEVICE(0x15c2, 0x0043) },
+	{}
+};
+
+/* iMON devices with VGA touchscreens */
+static struct usb_device_id imon_touchscreen_list[] = {
+	{ USB_DEVICE(0x15c2, 0x0034) },
+	{ USB_DEVICE(0x15c2, 0x0035) },
+	{}
+};
+
+/* USB Device data */
+static struct usb_driver imon_driver = {
+	LIRC_THIS_MODULE(.owner = THIS_MODULE)
+	.name		= MOD_NAME,
+	.probe		= imon_probe,
+	.disconnect	= imon_disconnect,
+	.suspend	= imon_suspend,
+	.resume		= imon_resume,
+	.id_table	= imon_usb_id_table,
+};
+
+static struct usb_class_driver imon_class = {
+	.name		= DEVICE_NAME,
+	.fops		= &display_fops,
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 15)
+	.mode		= DEVFS_MODE,
+#endif
+	.minor_base	= DISPLAY_MINOR_BASE,
+};
+
+/* to prevent races between open() and disconnect(), probing, etc */
+static DEFINE_MUTEX(driver_lock);
+
+static int debug;
+
+/* lcd, vfd, vga or none? should be auto-detected, but can be overridden... */
+static int display_type;
+
+/* IR protocol: native iMON, Windows MCE (RC-6), or iMON w/o PAD stabilize */
+static int ir_protocol;
+
+/*
+ * In certain use cases, mouse mode isn't really helpful, and could actually
+ * cause confusion, so allow disabling it when the IR device is open.
+ */
+static int nomouse;
+
+/* threshold at which a pad push registers as an arrow key in kbd mode */
+static int pad_thresh;
+
+
+/***  M O D U L E   C O D E ***/
+
+MODULE_AUTHOR(MOD_AUTHOR);
+MODULE_DESCRIPTION(MOD_DESC);
+MODULE_VERSION(MOD_VERSION);
+MODULE_LICENSE("GPL");
+MODULE_DEVICE_TABLE(usb, imon_usb_id_table);
+module_param(debug, int, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(debug, "Debug messages: 0=no, 1=yes(default: no)");
+module_param(display_type, int, S_IRUGO);
+MODULE_PARM_DESC(display_type, "Type of attached display. 0=autodetect, "
+		 "1=vfd, 2=lcd, 3=vga, 4=none (default: autodetect)");
+module_param(ir_protocol, int, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(ir_protocol, "Which IR protocol to use. 0=native iMON, "
+		 "1=Windows Media Center Ed. (RC-6), 2=iMON w/o PAD stabilize "
+		 "(default: native iMON)");
+module_param(nomouse, int, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(nomouse, "Disable mouse input device mode when IR device is "
+		 "open. 0=don't disable, 1=disable. (default: don't disable)");
+module_param(pad_thresh, int, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(pad_thresh, "Threshold at which a pad push registers as an "
+		 "arrow key in kbd mode (default: 28)");
+
+static void free_imon_context(struct imon_context *context)
+{
+	usb_free_urb(context->tx_urb);
+	usb_free_urb(context->rx_urb_intf0);
+	usb_free_urb(context->rx_urb_intf1);
+	lirc_buffer_free(context->driver->rbuf);
+	kfree(context->driver->rbuf);
+	kfree(context->driver);
+	kfree(context);
+
+	dprintk("%s: iMON context freed\n", __func__);
+}
+
+static void deregister_from_lirc(struct imon_context *context)
+{
+	int retval;
+	int minor = context->driver->minor;
+
+	retval = lirc_unregister_driver(minor);
+	if (retval)
+		err("%s: unable to deregister from lirc(%d)",
+			__func__, retval);
+	else
+		printk(KERN_INFO MOD_NAME ": Deregistered iMON driver "
+		       "(minor:%d)\n", minor);
+
+}
+
+/**
+ * Called when the Display device (e.g. /dev/lcd0)
+ * is opened by the application.
+ */
+static int display_open(struct inode *inode, struct file *file)
+{
+	struct usb_interface *interface;
+	struct imon_context *context = NULL;
+	int subminor;
+	int retval = 0;
+
+	/* prevent races with disconnect */
+	mutex_lock(&driver_lock);
+
+	subminor = iminor(inode);
+	interface = usb_find_interface(&imon_driver, subminor);
+	if (!interface) {
+		err("%s: could not find interface for minor %d",
+		    __func__, subminor);
+		retval = -ENODEV;
+		goto exit;
+	}
+	context = usb_get_intfdata(interface);
+
+	if (!context) {
+		err("%s: no context found for minor %d",
+					__func__, subminor);
+		retval = -ENODEV;
+		goto exit;
+	}
+
+	mutex_lock(&context->lock);
+
+	if (!context->display_supported) {
+		err("%s: display not supported by device", __func__);
+		retval = -ENODEV;
+	} else if (context->display_isopen) {
+		err("%s: display port is already open", __func__);
+		retval = -EBUSY;
+	} else {
+		MOD_INC_USE_COUNT;
+		context->display_isopen = 1;
+		file->private_data = context;
+		printk(KERN_INFO "display port opened\n");
+	}
+
+	mutex_unlock(&context->lock);
+
+exit:
+	mutex_unlock(&driver_lock);
+	return retval;
+}
+
+/**
+ * Called when the display device (e.g. /dev/lcd0)
+ * is closed by the application.
+ */
+static int display_close(struct inode *inode, struct file *file)
+{
+	struct imon_context *context = NULL;
+	int retval = 0;
+
+	context = (struct imon_context *)file->private_data;
+
+	if (!context) {
+		err("%s: no context for device", __func__);
+		return -ENODEV;
+	}
+
+	mutex_lock(&context->lock);
+
+	if (!context->display_supported) {
+		err("%s: display not supported by device", __func__);
+		retval = -ENODEV;
+	} else if (!context->display_isopen) {
+		err("%s: display is not open", __func__);
+		retval = -EIO;
+	} else {
+		context->display_isopen = 0;
+		MOD_DEC_USE_COUNT;
+		printk(KERN_INFO "display port closed\n");
+		if (!context->dev_present_intf0 && !context->ir_isopen) {
+			/*
+			 * Device disconnected before close and IR port is not
+			 * open. If IR port is open, context will be deleted by
+			 * ir_close.
+			 */
+			mutex_unlock(&context->lock);
+			free_imon_context(context);
+			return retval;
+		}
+	}
+
+	mutex_unlock(&context->lock);
+	return retval;
+}
+
+/**
+ * Sends a packet to the device
+ */
+static int send_packet(struct imon_context *context)
+{
+	unsigned int pipe;
+	int interval = 0;
+	int retval = 0;
+	struct usb_ctrlrequest *control_req = NULL;
+
+	/* Check if we need to use control or interrupt urb */
+	if (!context->tx_control) {
+		pipe = usb_sndintpipe(context->usbdev_intf0,
+				      context->tx_endpoint->bEndpointAddress);
+		interval = context->tx_endpoint->bInterval;
+
+		usb_fill_int_urb(context->tx_urb, context->usbdev_intf0, pipe,
+				 context->usb_tx_buf,
+				 sizeof(context->usb_tx_buf),
+				 usb_tx_callback, context, interval);
+
+		context->tx_urb->actual_length = 0;
+	} else {
+		/* fill request into kmalloc'ed space: */
+		control_req = kmalloc(sizeof(struct usb_ctrlrequest),
+				      GFP_KERNEL);
+		if (control_req == NULL)
+			return -ENOMEM;
+
+		/* setup packet is '21 09 0200 0001 0008' */
+		control_req->bRequestType = 0x21;
+		control_req->bRequest = 0x09;
+		control_req->wValue = cpu_to_le16(0x0200);
+		control_req->wIndex = cpu_to_le16(0x0001);
+		control_req->wLength = cpu_to_le16(0x0008);
+
+		/* control pipe is endpoint 0x00 */
+		pipe = usb_sndctrlpipe(context->usbdev_intf0, 0);
+
+		/* build the control urb */
+		usb_fill_control_urb(context->tx_urb, context->usbdev_intf0, pipe,
+				     (unsigned char *)control_req,
+				     context->usb_tx_buf,
+				     sizeof(context->usb_tx_buf),
+				     usb_tx_callback, context);
+		context->tx_urb->actual_length = 0;
+	}
+
+	init_completion(&context->tx.finished);
+	atomic_set(&(context->tx.busy), 1);
+
+	retval = usb_submit_urb(context->tx_urb, GFP_KERNEL);
+	if (retval) {
+		atomic_set(&(context->tx.busy), 0);
+		err("%s: error submitting urb(%d)", __func__, retval);
+	} else {
+		/* Wait for transmission to complete (or abort) */
+		mutex_unlock(&context->lock);
+		retval = wait_for_completion_interruptible(
+				&context->tx.finished);
+		if (retval)
+			err("%s: task interrupted", __func__);
+		mutex_lock(&context->lock);
+
+		retval = context->tx.status;
+		if (retval)
+			err("%s: packet tx failed (%d)", __func__, retval);
+	}
+
+	kfree(control_req);
+
+	return retval;
+}
+
+/**
+ * Sends an associate packet to the iMON 2.4G.
+ *
+ * This might not be such a good idea, since it has an id collision with
+ * some versions of the "IR & VFD" combo. The only way to determine if it
+ * is an RF version is to look at the product description string. (Which
+ * we currently do not fetch).
+ */
+static int send_associate_24g(struct imon_context *context)
+{
+	int retval;
+	const unsigned char packet[8] = { 0x01, 0x00, 0x00, 0x00,
+					  0x00, 0x00, 0x00, 0x20 };
+
+	if (!context) {
+		err("%s: no context for device", __func__);
+		return -ENODEV;
+	}
+
+	if (!context->dev_present_intf0) {
+		err("%s: no iMON device present", __func__);
+		return -ENODEV;
+	}
+
+	memcpy(context->usb_tx_buf, packet, sizeof(packet));
+	retval = send_packet(context);
+
+	return retval;
+}
+
+/**
+ * Sends packets to setup and show clock on iMON display
+ *
+ * Arguments: year - last 2 digits of year, month - 1..12,
+ * day - 1..31, dow - day of the week (0-Sun...6-Sat),
+ * hour - 0..23, minute - 0..59, second - 0..59
+ */
+static int send_set_imon_clock(struct imon_context *context,
+			       unsigned int year, unsigned int month,
+			       unsigned int day, unsigned int dow,
+			       unsigned int hour, unsigned int minute,
+			       unsigned int second)
+{
+	unsigned char clock_enable_pkt[IMON_CLOCK_ENABLE_PACKETS][8];
+	int retval = 0;
+	int i;
+
+	if (!context) {
+		err("%s: no context for device", __func__);
+		return -ENODEV;
+	}
+
+	switch(context->display_type) {
+	case IMON_DISPLAY_TYPE_LCD:
+		clock_enable_pkt[0][0] = 0x80;
+		clock_enable_pkt[0][1] = year;
+		clock_enable_pkt[0][2] = month-1;
+		clock_enable_pkt[0][3] = day;
+		clock_enable_pkt[0][4] = hour;
+		clock_enable_pkt[0][5] = minute;
+		clock_enable_pkt[0][6] = second;
+
+		clock_enable_pkt[1][0] = 0x80;
+		clock_enable_pkt[1][1] = 0;
+		clock_enable_pkt[1][2] = 0;
+		clock_enable_pkt[1][3] = 0;
+		clock_enable_pkt[1][4] = 0;
+		clock_enable_pkt[1][5] = 0;
+		clock_enable_pkt[1][6] = 0;
+
+		if (context->ffdc_dev) {
+			clock_enable_pkt[0][7] = 0x50;
+			clock_enable_pkt[1][7] = 0x51;
+		} else {
+			clock_enable_pkt[0][7] = 0x88;
+			clock_enable_pkt[1][7] = 0x8a;
+		}
+
+		break;
+
+	case IMON_DISPLAY_TYPE_VFD:
+		clock_enable_pkt[0][0] = year;
+		clock_enable_pkt[0][1] = month-1;
+		clock_enable_pkt[0][2] = day;
+		clock_enable_pkt[0][3] = dow;
+		clock_enable_pkt[0][4] = hour;
+		clock_enable_pkt[0][5] = minute;
+		clock_enable_pkt[0][6] = second;
+		clock_enable_pkt[0][7] = 0x40;
+
+		clock_enable_pkt[1][0] = 0;
+		clock_enable_pkt[1][1] = 0;
+		clock_enable_pkt[1][2] = 1;
+		clock_enable_pkt[1][3] = 0;
+		clock_enable_pkt[1][4] = 0;
+		clock_enable_pkt[1][5] = 0;
+		clock_enable_pkt[1][6] = 0;
+		clock_enable_pkt[1][7] = 0x42;
+
+		break;
+
+	default:
+		return -ENODEV;
+	}
+
+
+	for (i = 0; i < IMON_CLOCK_ENABLE_PACKETS; i++) {
+		memcpy(context->usb_tx_buf, clock_enable_pkt[i], 8);
+		retval = send_packet(context);
+		if (retval) {
+			err("%s: send_packet failed for packet %d",
+			    __func__, i);
+			break;
+		}
+	}
+
+	return retval;
+
+}
+
+/**
+ * These are the sysfs functions to handle the association on the iMON 2.4G LT.
+ */
+static ssize_t show_associate_remote(struct device *d,
+				     struct device_attribute *attr,
+				     char *buf)
+{
+	struct imon_context *context = dev_get_drvdata(d);
+
+	if (!context)
+		return -ENODEV;
+
+	mutex_lock(&context->lock);
+	if (context->ir_isassociating) {
+		strcpy(buf, "associating\n");
+	} else if (context->ir_isopen) {
+		strcpy(buf, "open\n");
+	} else {
+		strcpy(buf, "closed\n");
+	}
+	printk(KERN_INFO "Visit http://www.lirc.org/html/imon-24g.html for "
+	       "instructions on how to associate your iMON 2.4G DT/LT "
+	       "remote\n");
+	mutex_unlock(&context->lock);
+	return strlen(buf);
+}
+
+static ssize_t store_associate_remote(struct device *d,
+				      struct device_attribute *attr,
+				      const char *buf, size_t count)
+{
+	struct imon_context *context;
+
+	context = dev_get_drvdata(d);
+
+	if (!context)
+		return -ENODEV;
+
+	mutex_lock(&context->lock);
+	if (!context->ir_isopen) {
+		mutex_unlock(&context->lock);
+		return -EINVAL;
+	}
+
+	if (context->ir_isopen) {
+		context->ir_isassociating = 1;
+		send_associate_24g(context);
+	}
+	mutex_unlock(&context->lock);
+
+	return count;
+}
+
+/**
+ * sysfs functions to control internal imon clock
+ */
+static ssize_t show_imon_clock(struct device *d,
+			       struct device_attribute *attr, char *buf)
+{
+	struct imon_context *context = dev_get_drvdata(d);
+	size_t len;
+
+	if (!context)
+		return -ENODEV;
+
+	mutex_lock(&context->lock);
+
+	if (!context->display_supported) {
+		len = snprintf(buf, PAGE_SIZE, "Not supported.");
+	} else {
+		len = snprintf(buf, PAGE_SIZE,
+			"To set the clock on your iMON display:\n"
+			"# date \"+%%y %%m %%d %%w %%H %%M %%S\" > imon_clock\n"
+			"%s", context->display_isopen ?
+			"\nNOTE: imon device must be closed\n" : "");
+	}
+
+	mutex_unlock(&context->lock);
+
+	return len;
+}
+
+static ssize_t store_imon_clock(struct device *d,
+				struct device_attribute *attr,
+				const char *buf, size_t count)
+{
+	struct imon_context *context = dev_get_drvdata(d);
+	ssize_t retval;
+	unsigned int year, month, day, dow, hour, minute, second;
+
+	if (!context)
+		return -ENODEV;
+
+	mutex_lock(&context->lock);
+
+	if (!context->display_supported) {
+		retval = -ENODEV;
+		goto exit;
+	} else if (context->display_isopen) {
+		retval = -EBUSY;
+		goto exit;
+	}
+
+	if (sscanf(buf, "%u %u %u %u %u %u %u",	&year, &month, &day, &dow,
+		   &hour, &minute, &second) != 7) {
+		retval = -EINVAL;
+		goto exit;
+	}
+
+	if ((month < 1 || month > 12) ||
+	    (day < 1 || day > 31) || (dow > 6) ||
+	    (hour > 23) || (minute > 59) || (second > 59)) {
+		retval = -EINVAL;
+		goto exit;
+	}
+
+	retval = send_set_imon_clock(context, year, month, day, dow,
+				     hour, minute, second);
+	if (retval)
+		goto exit;
+
+	retval = count;
+exit:
+	mutex_unlock(&context->lock);
+
+	return retval;
+}
+
+
+static DEVICE_ATTR(imon_clock, S_IWUSR | S_IRUGO, show_imon_clock,
+		   store_imon_clock);
+
+static DEVICE_ATTR(associate_remote, S_IWUSR | S_IRUGO, show_associate_remote,
+		   store_associate_remote);
+
+static struct attribute *imon_display_sysfs_entries[] = {
+	&dev_attr_imon_clock.attr,
+	NULL
+};
+
+static struct attribute_group imon_display_attribute_group = {
+	.attrs = imon_display_sysfs_entries
+};
+
+static struct attribute *imon_rf_sysfs_entries[] = {
+	&dev_attr_associate_remote.attr,
+	NULL
+};
+
+static struct attribute_group imon_rf_attribute_group = {
+	.attrs = imon_rf_sysfs_entries
+};
+
+/**
+ * Writes data to the VFD.  The iMON VFD is 2x16 characters
+ * and requires data in 5 consecutive USB interrupt packets,
+ * each packet but the last carrying 7 bytes.
+ *
+ * I don't know if the VFD board supports features such as
+ * scrolling, clearing rows, blanking, etc. so at
+ * the caller must provide a full screen of data.  If fewer
+ * than 32 bytes are provided spaces will be appended to
+ * generate a full screen.
+ */
+static ssize_t vfd_write(struct file *file, const char *buf,
+			 size_t n_bytes, loff_t *pos)
+{
+	int i;
+	int offset;
+	int seq;
+	int retval = 0;
+	struct imon_context *context;
+	const unsigned char vfd_packet6[] = {
+		0x01, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF };
+
+	context = (struct imon_context *)file->private_data;
+	if (!context) {
+		err("%s: no context for device", __func__);
+		return -ENODEV;
+	}
+
+	mutex_lock(&context->lock);
+
+	if (!context->dev_present_intf0) {
+		err("%s: no iMON device present", __func__);
+		retval = -ENODEV;
+		goto exit;
+	}
+
+	if (n_bytes <= 0 || n_bytes > 32) {
+		err("%s: invalid payload size", __func__);
+		retval = -EINVAL;
+		goto exit;
+	}
+
+	if (copy_from_user(context->tx.data_buf, buf, n_bytes)) {
+		retval = -EFAULT;
+		goto exit;
+	}
+
+	/* Pad with spaces */
+	for (i = n_bytes; i < 32; ++i)
+		context->tx.data_buf[i] = ' ';
+
+	for (i = 32; i < 35; ++i)
+		context->tx.data_buf[i] = 0xFF;
+
+	offset = 0;
+	seq = 0;
+
+	do {
+		memcpy(context->usb_tx_buf, context->tx.data_buf + offset, 7);
+		context->usb_tx_buf[7] = (unsigned char) seq;
+
+		retval = send_packet(context);
+		if (retval) {
+			err("%s: send packet failed for packet #%d",
+					__func__, seq/2);
+			goto exit;
+		} else {
+			seq += 2;
+			offset += 7;
+		}
+
+	} while (offset < 35);
+
+	if (context->vfd_proto_6p) {
+		/* Send packet #6 */
+		memcpy(context->usb_tx_buf, &vfd_packet6, sizeof(vfd_packet6));
+		context->usb_tx_buf[7] = (unsigned char) seq;
+		retval = send_packet(context);
+		if (retval)
+			err("%s: send packet failed for packet #%d",
+					__func__, seq/2);
+	}
+
+exit:
+	mutex_unlock(&context->lock);
+
+	return (!retval) ? n_bytes : retval;
+}
+
+/**
+ * Writes data to the LCD.  The iMON OEM LCD screen excepts 8-byte
+ * packets. We accept data as 16 hexadecimal digits, followed by a
+ * newline (to make it easy to drive the device from a command-line
+ * -- even though the actual binary data is a bit complicated).
+ *
+ * The device itself is not a "traditional" text-mode display. It's
+ * actually a 16x96 pixel bitmap display. That means if you want to
+ * display text, you've got to have your own "font" and translate the
+ * text into bitmaps for display. This is really flexible (you can
+ * display whatever diacritics you need, and so on), but it's also
+ * a lot more complicated than most LCDs...
+ */
+static ssize_t lcd_write(struct file *file, const char *buf,
+			 size_t n_bytes, loff_t *pos)
+{
+	int retval = 0;
+	struct imon_context *context;
+
+	context = (struct imon_context *)file->private_data;
+	if (!context) {
+		err("%s: no context for device", __func__);
+		return -ENODEV;
+	}
+
+	mutex_lock(&context->lock);
+
+	if (!context->display_supported) {
+		err("%s: no iMON display present", __func__);
+		retval = -ENODEV;
+		goto exit;
+	}
+
+	if (n_bytes != 8) {
+		err("%s: invalid payload size: %d (expecting 8)",
+		    __func__, (int) n_bytes);
+		retval = -EINVAL;
+		goto exit;
+	}
+
+	if (copy_from_user(context->usb_tx_buf, buf, 8)) {
+		retval = -EFAULT;
+		goto exit;
+	}
+
+	retval = send_packet(context);
+	if (retval) {
+		err("%s: send packet failed!", __func__);
+		goto exit;
+	} else {
+		dprintk("%s: write %d bytes to LCD\n", __func__, (int) n_bytes);
+	}
+exit:
+	mutex_unlock(&context->lock);
+	return (!retval) ? n_bytes : retval;
+}
+
+/**
+ * Callback function for USB core API: transmit data
+ */
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 19)
+static void usb_tx_callback(struct urb *urb, struct pt_regs *regs)
+#else
+static void usb_tx_callback(struct urb *urb)
+#endif
+{
+	struct imon_context *context;
+
+	if (!urb)
+		return;
+	context = (struct imon_context *)urb->context;
+	if (!context)
+		return;
+
+	context->tx.status = urb->status;
+
+	/* notify waiters that write has finished */
+	atomic_set(&context->tx.busy, 0);
+	complete(&context->tx.finished);
+
+	return;
+}
+
+/**
+ * iMON IR receivers support two different signal sets -- those used by
+ * the iMON remotes, and those used by the Windows MCE remotes (which is
+ * really just RC-6), but only one or the other at a time, as the signals
+ * are decoded onboard the receiver.
+ */
+static void imon_set_ir_protocol(struct imon_context *context)
+{
+	int retval;
+	unsigned char ir_proto_packet[] =
+		{ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x86 };
+
+	switch (ir_protocol) {
+	case IMON_IR_PROTOCOL_MCE:
+		/* MCE proto not supported on devices without tx control */
+		if (!context->tx_control) {
+			printk(KERN_INFO "%s: MCE IR protocol not supported on "
+			       "this device, using iMON protocol\n", __func__);
+			context->ir_protocol = IMON_IR_PROTOCOL_IMON;
+			return;
+		}
+		dprintk("Configuring IR receiver for MCE protocol\n");
+		ir_proto_packet[0] = 0x01;
+		context->ir_protocol = IMON_IR_PROTOCOL_MCE;
+		break;
+	case IMON_IR_PROTOCOL_IMON:
+		dprintk("Configuring IR receiver for iMON protocol\n");
+		/* ir_proto_packet[0] = 0x00; // already the default */
+		context->ir_protocol = IMON_IR_PROTOCOL_IMON;
+		break;
+	case IMON_IR_PROTOCOL_IMON_NOPAD:
+		dprintk("Configuring IR receiver for iMON protocol without "
+			"PAD stabilize function enabled\n");
+		/* ir_proto_packet[0] = 0x00; // already the default */
+		context->ir_protocol = IMON_IR_PROTOCOL_IMON_NOPAD;
+		break;
+	default:
+		printk(KERN_INFO "%s: unknown IR protocol specified, will "
+		       "just default to iMON protocol\n", __func__);
+		context->ir_protocol = IMON_IR_PROTOCOL_IMON;
+		break;
+	}
+	memcpy(context->usb_tx_buf, &ir_proto_packet,
+	       sizeof(ir_proto_packet));
+	retval = send_packet(context);
+	if (retval)
+		printk(KERN_INFO "%s: failed to set remote type\n", __func__);
+}
+
+
+/**
+ * Called by lirc_dev when the application opens /dev/lirc
+ */
+static int ir_open(void *data)
+{
+	int retval = 0;
+	struct imon_context *context;
+
+	/* prevent races with disconnect */
+	mutex_lock(&driver_lock);
+
+	context = (struct imon_context *)data;
+
+	/* initial IR protocol decode variables */
+	context->rx.count = 0;
+	context->rx.initial_space = 1;
+	context->rx.prev_bit = 0;
+
+	/* set new IR protocol if it has changed since init or last open */
+	if (ir_protocol != context->ir_protocol)
+		imon_set_ir_protocol(context);
+
+	context->ir_isopen = 1;
+	printk(KERN_INFO MOD_NAME ": IR port opened\n");
+
+	mutex_unlock(&driver_lock);
+	return retval;
+}
+
+/**
+ * Called by lirc_dev when the application closes /dev/lirc
+ */
+static void ir_close(void *data)
+{
+	struct imon_context *context;
+
+	context = (struct imon_context *)data;
+	if (!context) {
+		err("%s: no context for device", __func__);
+		return;
+	}
+
+	mutex_lock(&context->lock);
+
+	context->ir_isopen = 0;
+	context->ir_isassociating = 0;
+	MOD_DEC_USE_COUNT;
+	printk(KERN_INFO MOD_NAME ": IR port closed\n");
+
+	if (!context->dev_present_intf0) {
+		/*
+		 * Device disconnected while IR port was still open. Driver
+		 * was not deregistered at disconnect time, so do it now.
+		 */
+		deregister_from_lirc(context);
+
+		if (!context->display_isopen) {
+			mutex_unlock(&context->lock);
+			free_imon_context(context);
+			return;
+		}
+		/*
+		 * If display port is open, context will be deleted by
+		 * display_close
+		 */
+	}
+
+	mutex_unlock(&context->lock);
+	return;
+}
+
+/**
+ * Convert bit count to time duration (in us) and submit
+ * the value to lirc_dev.
+ */
+static void submit_data(struct imon_context *context)
+{
+	unsigned char buf[4];
+	int value = context->rx.count;
+	int i;
+
+	dprintk("submitting data to LIRC\n");
+
+	value *= BIT_DURATION;
+	value &= PULSE_MASK;
+	if (context->rx.prev_bit)
+		value |= PULSE_BIT;
+
+	for (i = 0; i < 4; ++i)
+		buf[i] = value>>(i*8);
+
+	lirc_buffer_write(context->driver->rbuf, buf);
+	wake_up(&context->driver->rbuf->wait_poll);
+	return;
+}
+
+static inline int tv2int(const struct timeval *a, const struct timeval *b)
+{
+	int usecs = 0;
+	int sec   = 0;
+
+	if (b->tv_usec > a->tv_usec) {
+		usecs = 1000000;
+		sec--;
+	}
+
+	usecs += a->tv_usec - b->tv_usec;
+
+	sec += a->tv_sec - b->tv_sec;
+	sec *= 1000;
+	usecs /= 1000;
+	sec += usecs;
+
+	if (sec < 0)
+		sec = 1000;
+
+	return sec;
+}
+
+/**
+ * The directional pad behaves a bit differently, depending on whether this is
+ * one of the older ffdc devices or a newer device. Newer devices appear to
+ * have a higher resolution matrix for more precise mouse movement, but it
+ * makes things overly sensitive in keyboard mode, so we do some interesting
+ * contortions to make it less touchy. Older devices run through the same
+ * routine with shorter timeout and a smaller threshold.
+ */
+static int stabilize(int a, int b, u16 timeout, u16 threshold)
+{
+	struct timeval ct;
+	static struct timeval prev_time = {0, 0};
+	static struct timeval hit_time  = {0, 0};
+	static int x, y, prev_result, hits;
+	int result = 0;
+	int msec, msec_hit;
+
+	do_gettimeofday(&ct);
+	msec = tv2int(&ct, &prev_time);
+	msec_hit = tv2int(&ct, &hit_time);
+
+	if (msec > 100) {
+		x = 0;
+		y = 0;
+		hits = 0;
+	}
+
+	x += a;
+	y += b;
+
+	prev_time = ct;
+
+	if (abs(x) > threshold || abs(y) > threshold) {
+		if (abs(y) > abs(x))
+			result = (y > 0) ? 0x7F : 0x80;
+		else
+			result = (x > 0) ? 0x7F00 : 0x8000;
+
+		x = 0;
+		y = 0;
+
+		if (result == prev_result) {
+			hits++;
+
+			if (hits > 3) {
+				switch (result) {
+				case 0x7F:
+					y = 17 * threshold / 30;
+					break;
+				case 0x80:
+					y -= 17 * threshold / 30;
+					break;
+				case 0x7F00:
+					x = 17 * threshold / 30;
+					break;
+				case 0x8000:
+					x -= 17 * threshold / 30;
+					break;
+				}
+			}
+
+			if (hits == 2 && msec_hit < timeout) {
+				result = 0;
+				hits = 1;
+			}
+		} else {
+			prev_result = result;
+			hits = 1;
+			hit_time = ct;
+		}
+	}
+
+	return result;
+}
+
+/**
+ * Process the incoming packet
+ */
+static void imon_incoming_packet(struct imon_context *context,
+				 struct urb *urb, int intf)
+{
+	int len = urb->actual_length;
+	unsigned char *buf = urb->transfer_buffer;
+	char rel_x = 0x00, rel_y = 0x00;
+	int octet, bit;
+	unsigned char mask;
+	int i, chunk_num;
+	int ts_input = 0;
+	int dir = 0;
+	u16 timeout, threshold;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 18)
+	int mouse_input;
+	int right_shift = 1;
+	struct input_dev *mouse = NULL;
+	struct input_dev *touch = NULL;
+	const unsigned char toggle_button1[] = { 0x29, 0x91, 0x15, 0xb7 };
+	const unsigned char toggle_button2[] = { 0x29, 0x91, 0x35, 0xb7 };
+	const unsigned char ch_up[]   = { 0x28, 0x93, 0x95, 0xb7 };
+	const unsigned char ch_down[] = { 0x28, 0x87, 0x95, 0xb7 };
+#endif
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 18)
+	mouse = context->mouse;
+	if (context->display_type == IMON_DISPLAY_TYPE_VGA)
+		touch = context->touch;
+
+	/* keyboard/mouse mode toggle button */
+	if (memcmp(buf, toggle_button1, 4) == 0 ||
+	    memcmp(buf, toggle_button2, 4) == 0) {
+		if (!nomouse) {
+			context->pad_mouse = ~(context->pad_mouse) & 0x1;
+			dprintk("toggling to %s mode\n",
+				context->pad_mouse ? "mouse" : "keyboard");
+		} else {
+			context->pad_mouse = 0;
+			dprintk("mouse mode was disabled by modparam\n");
+		}
+		return;
+	}
+
+	/* send touchscreen events through input subsystem if touchpad data */
+	if (context->display_type == IMON_DISPLAY_TYPE_VGA && len == 8 &&
+	    buf[7] == 0x86) {
+		if (touch == NULL) {
+			printk(KERN_WARNING "%s: touchscreen input device is "
+			       "NULL!\n", __func__);
+			return;
+		}
+		mod_timer(&context->timer, jiffies + TOUCH_TIMEOUT);
+		context->touch_x = (buf[0] << 4) | (buf[1] >> 4);
+		context->touch_y = 0xfff - ((buf[2] << 4) | (buf[1] & 0xf));
+		input_report_abs(touch, ABS_X, context->touch_x);
+		input_report_abs(touch, ABS_Y, context->touch_y);
+		input_report_key(touch, BTN_TOUCH, 0x01);
+		input_sync(touch);
+		ts_input = 1;
+
+	/* send mouse events through input subsystem in mouse mode */
+	} else if (context->pad_mouse || !context->ir_isopen) {
+		/* newer iMON device PAD or mouse button */
+		if (!context->ffdc_dev && (buf[0] & 0x01) && len == 5) {
+			mouse_input = 1;
+			rel_x = buf[2];
+			rel_y = buf[3];
+			right_shift = 1;
+		/* 0xffdc iMON PAD or mouse button input */
+		} else if (context->ffdc_dev && (buf[0] & 0x40) &&
+			   !((buf[1] & 0x01) || ((buf[1] >> 2) & 0x01))) {
+			mouse_input = 1;
+			rel_x = (buf[1] & 0x08) | (buf[1] & 0x10) >> 2 |
+				(buf[1] & 0x20) >> 4 | (buf[1] & 0x40) >> 6;
+			if (buf[0] & 0x02)
+				rel_x |= ~0x0f;
+			rel_x = rel_x + rel_x / 2;
+			rel_y = (buf[2] & 0x08) | (buf[2] & 0x10) >> 2 |
+				(buf[2] & 0x20) >> 4 | (buf[2] & 0x40) >> 6;
+			if (buf[0] & 0x01)
+				rel_y |= ~0x0f;
+			rel_y = rel_y + rel_y / 2;
+			right_shift = 2;
+		/* some ffdc devices decode mouse buttons differently... */
+		} else if (context->ffdc_dev && (buf[0] == 0x68)) {
+			mouse_input = 1;
+			right_shift = 2;
+		/* ch+/- buttons, which we use for an emulated scroll wheel */
+		} else if (!memcmp(buf, ch_up, 4)) {
+			mouse_input = 1;
+			dir = 1;
+		} else if (!memcmp(buf, ch_down, 4)) {
+			mouse_input = 1;
+			dir = -1;
+		} else
+			mouse_input = 0;
+
+		if (mouse_input) {
+			if (mouse == NULL) {
+				printk(KERN_WARNING "%s: mouse input device "
+				       "is NULL!\n", __func__);
+				return;
+			}
+			dprintk("sending mouse data via input subsystem\n");
+
+			if (dir) {
+				input_report_rel(mouse, REL_WHEEL, dir);
+			} else if (rel_x || rel_y) {
+				input_report_rel(mouse, REL_X, rel_x);
+				input_report_rel(mouse, REL_Y, rel_y);
+			} else {
+				input_report_key(mouse, BTN_LEFT, buf[1] & 0x1);
+				input_report_key(mouse, BTN_RIGHT,
+						 buf[1] >> right_shift & 0x1);
+			}
+			input_sync(mouse);
+			return;
+		}
+	}
+#endif
+
+	/*
+	 * at this point, mouse and touchscreen input has been handled, so
+	 * anything else goes to lirc -- bail out if no listening IR client
+	 */
+	if (!context->ir_isopen)
+		return;
+
+	/*
+	 * we need to add some special handling for
+	 * the imon's IR mouse events
+	 */
+	if ((len == 5) && (buf[0] == 0x01) && (buf[4] == 0x00)) {
+		/* first, pad to 8 bytes so it conforms with everything else */
+		buf[5] = buf[6] = buf[7] = 0;
+		len = 8;
+		timeout = 500;	/* in msecs */
+		/* (2*threshold) x (2*threshold) square */
+		threshold = pad_thresh ? pad_thresh : 28;
+		rel_x = buf[2];
+		rel_y = buf[3];
+
+		/*
+		 * the imon directional pad functions more like a touchpad.
+		 * Bytes 3 & 4 contain a position coordinate (x,y), with each
+		 * component ranging from -14 to 14. Since this doesn't
+		 * cooperate well with the way lirc works (it would appear to
+		 * lirc as more than 100 different buttons) we need to map it
+		 * to 4 discrete values. Also, when you get too close to
+		 * diagonals, it has a tendancy to jump back and forth, so lets
+		 * try to ignore when they get too close
+		 */
+		if (context->ir_protocol == IMON_IR_PROTOCOL_IMON) {
+			if ((buf[1] == 0) && ((rel_x != 0) || (rel_y != 0))) {
+				dir = stabilize((int)rel_x, (int)rel_y,
+						timeout, threshold);
+				if (!dir)
+					return;
+				buf[2] = dir & 0xFF;
+				buf[3] = (dir >> 8) & 0xFF;
+			}
+		} else {
+			if (abs(rel_y) > abs(rel_x)) {
+				buf[2] = (rel_y > 0) ? 0x7F : 0x80;
+				buf[3] = 0;
+			} else {
+				buf[2] = 0;
+				buf[3] = (rel_x > 0) ? 0x7F : 0x80;
+			}
+		}
+
+	} else if ((len == 8) && (buf[0] & 0x40) &&
+		   !(buf[1] & 0x01 || buf[1] >> 2 & 0x01)) {
+		/*
+		 * Handle on-board decoded pad events for e.g. older
+		 * VFD/iMON-Pad (15c2:ffdc). The remote generates various codes
+		 * from 0x68nnnnB7 to 0x6AnnnnB7, the left mouse button
+		 * generates 0x688301b7 and the right one 0x688481b7. All other
+		 * keys generate 0x2nnnnnnn. Length has been padded to 8
+		 * already, position coordinate is encoded in buf[1] and buf[2]
+		 * with reversed endianess. Extract direction from buffer,
+		 * rotate endianess, adjust sign and feed the values into
+		 * stabilize(). The resulting codes will be 0x01008000,
+		 * 0x01007F00, ..., so one can use the normal imon-pad config
+		 * from the remotes dir.
+		 */
+		timeout = 10;	/* in msecs */
+		/* (2*threshold) x (2*threshold) square */
+		threshold = pad_thresh ? pad_thresh : 15;
+
+		/* buf[1] is x */
+		rel_x = (buf[1] & 0x08) | (buf[1] & 0x10) >> 2 |
+			(buf[1] & 0x20) >> 4 | (buf[1] & 0x40) >> 6;
+		if(buf[0] & 0x02)
+			rel_x |= ~0x10+1;
+		/* buf[2] is y */
+		rel_y = (buf[2] & 0x08) | (buf[2] & 0x10) >> 2 |
+			(buf[2] & 0x20) >> 4 | (buf[2] & 0x40) >> 6;
+		if(buf[0] & 0x01)
+			rel_y |= ~0x10+1;
+
+		buf[0] = 0x01;
+		buf[1] = buf[4] = buf[5] = buf[6] = buf[7] = 0;
+
+		if (context->ir_protocol == IMON_IR_PROTOCOL_IMON) {
+			dir = stabilize((int)rel_x, (int)rel_y,
+					timeout, threshold);
+			if (!dir)
+				return;
+			buf[2] = dir & 0xFF;
+			buf[3] = (dir >> 8) & 0xFF;
+		} else {
+			if (abs(rel_y) > abs(rel_x)) {
+				buf[2] = (rel_y > 0) ? 0x7F : 0x80;
+				buf[3] = 0;
+			} else {
+				buf[2] = 0;
+				buf[3] = (rel_x > 0) ? 0x7F : 0x80;
+			}
+		}
+
+	} else if (ts_input) {
+		/*
+		 * this is touchscreen input, which we need to down-sample
+		 * to a 64 button matrix at the moment...
+		 */
+		buf[0] = buf[0] >> 5;
+		buf[1] = 0x00;
+		buf[2] = buf[2] >> 5;
+		buf[3] = 0x00;
+		buf[4] = 0x00;
+		buf[5] = 0x00;
+		buf[6] = 0x14;
+		buf[7] = 0xff;
+	}
+
+	if (len != 8) {
+		printk(KERN_WARNING "imon %s: invalid incoming packet "
+		       "size (len = %d, intf%d)\n", __func__, len, intf);
+		return;
+	}
+
+	/* iMON 2.4G associate frame */
+	if (buf[0] == 0x00 &&
+	    buf[2] == 0xFF &&				/* REFID */
+	    buf[3] == 0xFF &&
+	    buf[4] == 0xFF &&
+	    buf[5] == 0xFF &&				/* iMON 2.4G */
+	   ((buf[6] == 0x4E && buf[7] == 0xDF) ||	/* LT */
+	    (buf[6] == 0x5E && buf[7] == 0xDF))) {	/* DT */
+		printk(KERN_WARNING "%s: remote associated refid=%02X\n",
+		       __func__, buf[1]);
+		context->ir_isassociating = 0;
+	}
+
+	chunk_num = buf[7];
+
+	if (chunk_num == 0xFF && !ts_input)
+		return;		/* filler frame, no data here */
+
+	if (buf[0] == 0xFF &&
+	    buf[1] == 0xFF &&
+	    buf[2] == 0xFF &&
+	    buf[3] == 0xFF &&
+	    buf[4] == 0xFF &&
+	    buf[5] == 0xFF &&				/* iMON 2.4G */
+	    ((buf[6] == 0x4E && buf[7] == 0xAF) ||	/* LT */
+	     (buf[6] == 0x5E && buf[7] == 0xAF)))	/* DT */
+		return;		/* filler frame, no data here */
+
+	if (debug) {
+		if (context->ir_onboard_decode)
+			printk("intf%d decoded packet: ", intf);
+		else
+			printk("raw packet: ");
+		for (i = 0; i < len; ++i)
+			printk("%02x ", buf[i]);
+		printk("\n");
+	}
+
+	if (context->ir_onboard_decode) {
+		/* The signals have been decoded onboard the iMON controller */
+		lirc_buffer_write(context->driver->rbuf, buf);
+		wake_up(&context->driver->rbuf->wait_poll);
+		return;
+	}
+
+	/*
+	 * Translate received data to pulse and space lengths.
+	 * Received data is active low, i.e. pulses are 0 and
+	 * spaces are 1.
+	 *
+	 * My original algorithm was essentially similar to
+	 * Changwoo Ryu's with the exception that he switched
+	 * the incoming bits to active high and also fed an
+	 * initial space to LIRC at the start of a new sequence
+	 * if the previous bit was a pulse.
+	 *
+	 * I've decided to adopt his algorithm.
+	 */
+
+	if (chunk_num == 1 && context->rx.initial_space) {
+		/* LIRC requires a leading space */
+		context->rx.prev_bit = 0;
+		context->rx.count = 4;
+		submit_data(context);
+		context->rx.count = 0;
+	}
+
+	for (octet = 0; octet < 5; ++octet) {
+		mask = 0x80;
+		for (bit = 0; bit < 8; ++bit) {
+			int curr_bit = !(buf[octet] & mask);
+			if (curr_bit != context->rx.prev_bit) {
+				if (context->rx.count) {
+					submit_data(context);
+					context->rx.count = 0;
+				}
+				context->rx.prev_bit = curr_bit;
+			}
+			++context->rx.count;
+			mask >>= 1;
+		}
+	}
+
+	if (chunk_num == 10) {
+		if (context->rx.count) {
+			submit_data(context);
+			context->rx.count = 0;
+		}
+		context->rx.initial_space = context->rx.prev_bit;
+	}
+}
+
+/**
+ * report touchscreen input
+ */
+static void imon_touch_display_timeout(unsigned long data)
+{
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 18)
+	struct imon_context *context = (struct imon_context *)data;
+	struct input_dev *touch;
+
+	if (!context->display_type == IMON_DISPLAY_TYPE_VGA)
+		return;
+
+	touch = context->touch;
+	input_report_abs(touch, ABS_X, context->touch_x);
+	input_report_abs(touch, ABS_Y, context->touch_y);
+	input_report_key(touch, BTN_TOUCH, 0x00);
+	input_sync(touch);
+#endif
+
+	return;
+}
+
+/**
+ * Callback function for USB core API: receive data
+ */
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 19)
+static void usb_rx_callback_intf0(struct urb *urb, struct pt_regs *regs)
+#else
+static void usb_rx_callback_intf0(struct urb *urb)
+#endif
+{
+	struct imon_context *context;
+	unsigned char *buf;
+	int len;
+	int intfnum = 0;
+
+	if (!urb)
+		return;
+
+	context = (struct imon_context *)urb->context;
+	if (!context)
+		return;
+
+	buf = urb->transfer_buffer;
+	len = urb->actual_length;
+
+	switch (urb->status) {
+	case -ENOENT:		/* usbcore unlink successful! */
+		return;
+
+	case 0:
+		imon_incoming_packet(context, urb, intfnum);
+		break;
+
+	default:
+		printk(KERN_WARNING "imon %s: status(%d): ignored\n",
+		       __func__, urb->status);
+		break;
+	}
+
+	usb_submit_urb(context->rx_urb_intf0, GFP_ATOMIC);
+
+	return;
+}
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 19)
+static void usb_rx_callback_intf1(struct urb *urb, struct pt_regs *regs)
+#else
+static void usb_rx_callback_intf1(struct urb *urb)
+#endif
+{
+	struct imon_context *context;
+	unsigned char *buf;
+	int len;
+	int intfnum = 1;
+
+	if (!urb)
+		return;
+
+	context = (struct imon_context *)urb->context;
+	if (!context)
+		return;
+
+	buf = urb->transfer_buffer;
+	len = urb->actual_length;
+
+	switch (urb->status) {
+	case -ENOENT:		/* usbcore unlink successful! */
+		return;
+
+	case 0:
+		imon_incoming_packet(context, urb, intfnum);
+		break;
+
+	default:
+		printk(KERN_WARNING "imon %s: status(%d): ignored\n",
+		       __func__, urb->status);
+		break;
+	}
+
+	usb_submit_urb(context->rx_urb_intf1, GFP_ATOMIC);
+
+	return;
+}
+
+/**
+ * Callback function for USB core API: Probe
+ */
+static int imon_probe(struct usb_interface *interface,
+		      const struct usb_device_id *id)
+{
+	struct usb_device *usbdev = NULL;
+	struct usb_host_interface *iface_desc = NULL;
+	struct usb_endpoint_descriptor *rx_endpoint = NULL;
+	struct usb_endpoint_descriptor *tx_endpoint = NULL;
+	struct urb *rx_urb = NULL;
+	struct urb *tx_urb = NULL;
+	struct lirc_driver *driver = NULL;
+	struct lirc_buffer *rbuf = NULL;
+	struct usb_interface *first_if;
+	int ifnum;
+	int lirc_minor = 0;
+	int num_endpts;
+	int retval = 0;
+	int display_ep_found = 0;
+	int ir_ep_found = 0;
+	int alloc_status = 0;
+	int vfd_proto_6p = 0;
+	int ir_onboard_decode = 0;
+	int buf_chunk_size = BUF_CHUNK_SIZE;
+	int code_length;
+	int tx_control = 0;
+	struct imon_context *context = NULL;
+	struct imon_context *first_if_context = NULL;
+	int i, sysfs_err;
+	int configured_display_type = IMON_DISPLAY_TYPE_VFD;
+	u16 vendor, product;
+	const unsigned char fp_packet[] = { 0x40, 0x00, 0x00, 0x00,
+					    0x00, 0x00, 0x00, 0x88 };
+
+	/*
+	 * Try to auto-detect the type of display if the user hasn't set
+	 * it by hand via the display_type modparam. Default is VFD.
+	 */
+	if (display_type == IMON_DISPLAY_TYPE_AUTO) {
+		if (usb_match_id(interface, lcd_device_list))
+			configured_display_type = IMON_DISPLAY_TYPE_LCD;
+		else if (usb_match_id(interface, imon_touchscreen_list))
+			configured_display_type = IMON_DISPLAY_TYPE_VGA;
+		else if (usb_match_id(interface, ir_only_list))
+			configured_display_type = IMON_DISPLAY_TYPE_NONE;
+		else
+			configured_display_type = IMON_DISPLAY_TYPE_VFD;
+	} else {
+		configured_display_type = display_type;
+		dprintk("%s: overriding display type to %d via modparam\n",
+			__func__, display_type);
+	}
+
+	/*
+	 * If it's the LCD, as opposed to the VFD, we just need to replace
+	 * the "write" file op.
+	 */
+	if (configured_display_type == IMON_DISPLAY_TYPE_LCD)
+		display_fops.write = &lcd_write;
+
+	/*
+	 * To get front panel buttons working properly for newer LCD devices,
+	 * we really do need a larger buffer.
+	 */
+	if (usb_match_id(interface, large_buffer_list))
+		buf_chunk_size = 2 * BUF_CHUNK_SIZE;
+
+	code_length = buf_chunk_size * 8;
+
+	usbdev     = usb_get_dev(interface_to_usbdev(interface));
+	iface_desc = interface->cur_altsetting;
+	num_endpts = iface_desc->desc.bNumEndpoints;
+	ifnum      = iface_desc->desc.bInterfaceNumber;
+	vendor     = le16_to_cpu(usbdev->descriptor.idVendor);
+	product    = le16_to_cpu(usbdev->descriptor.idProduct);
+
+	dprintk("%s: found iMON device (%04x:%04x, intf%d)\n",
+		__func__, vendor, product, ifnum);
+
+	/* prevent races probing devices w/multiple interfaces */
+	mutex_lock(&driver_lock);
+
+	first_if = usb_ifnum_to_if(usbdev, 0);
+	first_if_context = (struct imon_context *)usb_get_intfdata(first_if);
+
+	/*
+	 * Scan the endpoint list and set:
+	 *	first input endpoint = IR endpoint
+	 *	first output endpoint = display endpoint
+	 */
+	for (i = 0; i < num_endpts && !(ir_ep_found && display_ep_found); ++i) {
+		struct usb_endpoint_descriptor *ep;
+		int ep_dir;
+		int ep_type;
+		ep = &iface_desc->endpoint[i].desc;
+		ep_dir = ep->bEndpointAddress & USB_ENDPOINT_DIR_MASK;
+		ep_type = ep->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK;
+
+		if (!ir_ep_found &&
+			ep_dir == USB_DIR_IN &&
+			ep_type == USB_ENDPOINT_XFER_INT) {
+
+			rx_endpoint = ep;
+			ir_ep_found = 1;
+			dprintk("%s: found IR endpoint\n", __func__);
+
+		} else if (!display_ep_found &&
+			   ep_dir == USB_DIR_OUT &&
+			   ep_type == USB_ENDPOINT_XFER_INT) {
+			tx_endpoint = ep;
+			display_ep_found = 1;
+			dprintk("%s: found display endpoint\n", __func__);
+		}
+	}
+
+	/*
+	 * If we didn't find a display endpoint, this is probably one of the
+	 * newer iMON devices that use control urb instead of interrupt
+	 */
+	if (!display_ep_found) {
+		if (usb_match_id(interface, ctl_ep_device_list)) {
+			tx_control = 1;
+			display_ep_found = 1;
+			dprintk("%s: device uses control endpoint, not "
+				"interface OUT endpoint\n", __func__);
+		}
+	}
+
+	/*
+	 * Some iMON receivers have no display. Unfortunately, it seems
+	 * that SoundGraph recycles device IDs between devices both with
+	 * and without... :\
+	 */
+	if (configured_display_type == IMON_DISPLAY_TYPE_NONE) {
+		display_ep_found = 0;
+		dprintk("%s: device has no display\n", __func__);
+	}
+
+	/*
+	 * iMON Touch devices have a VGA touchscreen, but no "display", as
+	 * that refers to e.g. /dev/lcd0 (a character device LCD or VFD).
+	 */
+	if (configured_display_type == IMON_DISPLAY_TYPE_VGA) {
+		display_ep_found = 0;
+		dprintk("%s: iMON Touch device found\n", __func__);
+	}
+
+	/* Input endpoint is mandatory */
+	if (!ir_ep_found) {
+		err("%s: no valid input (IR) endpoint found.", __func__);
+		retval = -ENODEV;
+		goto exit;
+	} else {
+		/* Determine if the IR signals are decoded onboard */
+		if (usb_match_id(interface, ir_onboard_decode_list))
+			ir_onboard_decode = 1;
+
+		dprintk("%s: ir_onboard_decode: %d\n",
+			__func__, ir_onboard_decode);
+	}
+
+	/* Determine if display requires 6 packets */
+	if (display_ep_found) {
+		if (usb_match_id(interface, vfd_proto_6p_list))
+			vfd_proto_6p = 1;
+
+		dprintk("%s: vfd_proto_6p: %d\n",
+			__func__, vfd_proto_6p);
+	}
+
+	if (ifnum == 0) {
+		context = kzalloc(sizeof(struct imon_context), GFP_KERNEL);
+		if (!context) {
+			err("%s: kzalloc failed for context", __func__);
+			alloc_status = 1;
+			goto alloc_status_switch;
+		}
+		driver = kzalloc(sizeof(struct lirc_driver), GFP_KERNEL);
+		if (!driver) {
+			err("%s: kzalloc failed for lirc_driver", __func__);
+			alloc_status = 2;
+			goto alloc_status_switch;
+		}
+		rbuf = kmalloc(sizeof(struct lirc_buffer), GFP_KERNEL);
+		if (!rbuf) {
+			err("%s: kmalloc failed for lirc_buffer", __func__);
+			alloc_status = 3;
+			goto alloc_status_switch;
+		}
+		if (lirc_buffer_init(rbuf, buf_chunk_size, BUF_SIZE)) {
+			err("%s: lirc_buffer_init failed", __func__);
+			alloc_status = 4;
+			goto alloc_status_switch;
+		}
+		rx_urb = usb_alloc_urb(0, GFP_KERNEL);
+		if (!rx_urb) {
+			err("%s: usb_alloc_urb failed for IR urb", __func__);
+			alloc_status = 5;
+			goto alloc_status_switch;
+		}
+		tx_urb = usb_alloc_urb(0, GFP_KERNEL);
+		if (!tx_urb) {
+			err("%s: usb_alloc_urb failed for display urb",
+			    __func__);
+			alloc_status = 6;
+			goto alloc_status_switch;
+		}
+
+		mutex_init(&context->lock);
+		context->vfd_proto_6p = vfd_proto_6p;
+		context->ir_onboard_decode = ir_onboard_decode;
+
+		strcpy(driver->name, MOD_NAME);
+		driver->minor = -1;
+		driver->code_length = ir_onboard_decode ?
+			code_length : sizeof(int) * 8;
+		driver->sample_rate = 0;
+		driver->features = (ir_onboard_decode) ?
+			LIRC_CAN_REC_LIRCCODE : LIRC_CAN_REC_MODE2;
+		driver->data = context;
+		driver->rbuf = rbuf;
+		driver->set_use_inc = ir_open;
+		driver->set_use_dec = ir_close;
+#ifdef LIRC_HAVE_SYSFS
+		driver->dev = &interface->dev;
+#endif
+		driver->owner = THIS_MODULE;
+
+		mutex_lock(&context->lock);
+
+		context->driver = driver;
+		/* start out in keyboard mode */
+		context->pad_mouse = 0;
+
+		init_timer(&context->timer);
+		context->timer.data = (unsigned long)context;
+		context->timer.function = imon_touch_display_timeout;
+
+		lirc_minor = lirc_register_driver(driver);
+		if (lirc_minor < 0) {
+			err("%s: lirc_register_driver failed", __func__);
+			alloc_status = 7;
+			goto alloc_status_switch;
+		} else
+			printk(KERN_INFO MOD_NAME ": Registered iMON driver "
+			       "(lirc minor: %d)\n", lirc_minor);
+
+		/* Needed while unregistering! */
+		driver->minor = lirc_minor;
+
+	} else {
+	/* this is the secondary interface on the device */
+		if (first_if_context->driver) {
+			rx_urb = usb_alloc_urb(0, GFP_KERNEL);
+			if (!rx_urb) {
+				err("%s: usb_alloc_urb failed for IR urb",
+				    __func__);
+				alloc_status = 5;
+				goto alloc_status_switch;
+			}
+
+			context = first_if_context;
+		}
+		mutex_lock(&context->lock);
+	}
+
+	if (ifnum == 0) {
+		context->usbdev_intf0 = usbdev;
+		context->dev_present_intf0 = 1;
+		context->rx_endpoint_intf0 = rx_endpoint;
+		context->rx_urb_intf0 = rx_urb;
+
+		/*
+		 * tx is used to send characters to lcd/vfd, associate RF
+		 * remotes, set IR protocol, and maybe more...
+		 */
+		context->tx_endpoint = tx_endpoint;
+		context->tx_urb = tx_urb;
+		context->tx_control = tx_control;
+
+		if (display_ep_found)
+			context->display_supported = 1;
+
+		if (product == 0xffdc)
+			context->ffdc_dev = 1;
+
+		context->display_type = configured_display_type;
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 18)
+		context->mouse = input_allocate_device();
+
+		snprintf(context->name_mouse, sizeof(context->name_mouse),
+			 "iMON PAD IR Mouse (%04x:%04x)",
+			 vendor, product);
+		context->mouse->name = context->name_mouse;
+
+		usb_make_path(usbdev, context->phys_mouse, sizeof(context->phys_mouse));
+		strlcat(context->phys_mouse, "/input0", sizeof(context->phys_mouse));
+		context->mouse->phys = context->phys_mouse;
+
+		context->mouse->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_REL);
+		context->mouse->keybit[BIT_WORD(BTN_MOUSE)] =
+			BIT_MASK(BTN_LEFT) | BIT_MASK(BTN_RIGHT) |
+			BIT_MASK(BTN_MIDDLE) | BIT_MASK(BTN_SIDE) |
+			BIT_MASK(BTN_EXTRA);
+		context->mouse->relbit[0] = BIT_MASK(REL_X) | BIT_MASK(REL_Y) |
+			BIT_MASK(REL_WHEEL);
+
+		input_set_drvdata(context->mouse, context);
+
+		usb_to_input_id(usbdev, &context->mouse->id);
+		context->mouse->dev.parent = &interface->dev;
+		retval = input_register_device(context->mouse);
+		if (retval)
+			printk(KERN_INFO "%s: pad mouse input device setup failed\n",
+			       __func__);
+#endif
+
+		usb_fill_int_urb(context->rx_urb_intf0, context->usbdev_intf0,
+			usb_rcvintpipe(context->usbdev_intf0,
+					context->rx_endpoint_intf0->bEndpointAddress),
+			context->usb_rx_buf, sizeof(context->usb_rx_buf),
+			usb_rx_callback_intf0, context,
+			context->rx_endpoint_intf0->bInterval);
+
+		retval = usb_submit_urb(context->rx_urb_intf0, GFP_KERNEL);
+
+		if (retval) {
+			err("%s: usb_submit_urb failed for intf0 (%d)",
+			    __func__, retval);
+			mutex_unlock(&context->lock);
+			goto exit;
+		}
+
+	} else {
+		context->usbdev_intf1 = usbdev;
+		context->dev_present_intf1 = 1;
+		context->rx_endpoint_intf1 = rx_endpoint;
+		context->rx_urb_intf1 = rx_urb;
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 18)
+		if (context->display_type == IMON_DISPLAY_TYPE_VGA) {
+			context->touch = input_allocate_device();
+
+			snprintf(context->name_touch, sizeof(context->name_touch),
+				 "iMON USB Touchscreen (%04x:%04x)",
+				 vendor, product);
+			context->touch->name = context->name_touch;
+
+			usb_make_path(usbdev, context->phys_touch,
+				      sizeof(context->phys_touch));
+			strlcat(context->phys_touch, "/input1",
+				sizeof(context->phys_touch));
+			context->touch->phys = context->phys_touch;
+
+			context->touch->evbit[0] =
+				BIT_MASK(EV_KEY) | BIT_MASK(EV_ABS);
+			context->touch->keybit[BIT_WORD(BTN_TOUCH)] =
+				BIT_MASK(BTN_TOUCH);
+			input_set_abs_params(context->touch, ABS_X,
+					     0x00, 0xfff, 0, 0);
+			input_set_abs_params(context->touch, ABS_Y,
+					     0x00, 0xfff, 0, 0);
+
+			input_set_drvdata(context->touch, context);
+
+			usb_to_input_id(usbdev, &context->touch->id);
+			context->touch->dev.parent = &interface->dev;
+			retval = input_register_device(context->touch);
+			if (retval)
+				printk(KERN_INFO "%s: touchscreen input device setup failed\n",
+				       __func__);
+		} else
+			context->touch = NULL;
+#endif
+
+		usb_fill_int_urb(context->rx_urb_intf1, context->usbdev_intf1,
+			usb_rcvintpipe(context->usbdev_intf1,
+				context->rx_endpoint_intf1->bEndpointAddress),
+			context->usb_rx_buf, sizeof(context->usb_rx_buf),
+			usb_rx_callback_intf1, context,
+			context->rx_endpoint_intf1->bInterval);
+
+		retval = usb_submit_urb(context->rx_urb_intf1, GFP_KERNEL);
+
+		if (retval) {
+			err("%s: usb_submit_urb failed for intf1 (%d)",
+			    __func__, retval);
+			mutex_unlock(&context->lock);
+			goto exit;
+		}
+	}
+
+	usb_set_intfdata(interface, context);
+
+	/* RF products *also* use 0xffdc... sigh... */
+	if (context->ffdc_dev) {
+		sysfs_err = sysfs_create_group(&interface->dev.kobj,
+					       &imon_rf_attribute_group);
+		if (sysfs_err)
+			err("%s: Could not create RF sysfs entries(%d)",
+			    __func__, sysfs_err);
+	}
+
+	if (context->display_supported && ifnum == 0) {
+		dprintk("%s: Registering iMON display with sysfs\n", __func__);
+
+		/* set up sysfs entry for built-in clock */
+		sysfs_err = sysfs_create_group(&interface->dev.kobj,
+					       &imon_display_attribute_group);
+		if (sysfs_err)
+			err("%s: Could not create display sysfs entries(%d)",
+			    __func__, sysfs_err);
+
+		if (usb_register_dev(interface, &imon_class)) {
+			/* Not a fatal error, so ignore */
+			printk(KERN_INFO "%s: could not get a minor number for "
+			       "display\n", __func__);
+		}
+
+		/* Enable front-panel buttons and/or knobs */
+		memcpy(context->usb_tx_buf, &fp_packet, sizeof(fp_packet));
+		retval = send_packet(context);
+		/* Not fatal, but warn about it */
+		if (retval)
+			printk(KERN_INFO "%s: failed to enable front-panel "
+			       "buttons and/or knobs\n", __func__);
+	}
+
+	/* set IR protocol/remote type */
+	imon_set_ir_protocol(context);
+
+	printk(KERN_INFO MOD_NAME ": iMON device (%04x:%04x, intf%d) on "
+	       "usb<%d:%d> initialized\n", vendor, product, ifnum,
+	       usbdev->bus->busnum, usbdev->devnum);
+
+alloc_status_switch:
+	mutex_unlock(&context->lock);
+
+	switch (alloc_status) {
+	case 7:
+		usb_free_urb(tx_urb);
+	case 6:
+		usb_free_urb(rx_urb);
+	case 5:
+		if (rbuf)
+			lirc_buffer_free(rbuf);
+	case 4:
+		kfree(rbuf);
+	case 3:
+		kfree(driver);
+	case 2:
+		kfree(context);
+		context = NULL;
+	case 1:
+		retval = -ENOMEM;
+		break;
+	case 0:
+		retval = 0;
+	}
+
+exit:
+	mutex_unlock(&driver_lock);
+
+	return retval;
+}
+
+/**
+ * Callback function for USB core API: disconnect
+ */
+static void imon_disconnect(struct usb_interface *interface)
+{
+	struct imon_context *context;
+	int ifnum;
+
+	/* prevent races with ir_open()/display_open() */
+	mutex_lock(&driver_lock);
+
+	context = usb_get_intfdata(interface);
+	ifnum = interface->cur_altsetting->desc.bInterfaceNumber;
+
+	mutex_lock(&context->lock);
+
+	/*
+	 * sysfs_remove_group is safe to call even if sysfs_create_group
+	 * hasn't been called
+	 */
+	sysfs_remove_group(&interface->dev.kobj,
+			   &imon_display_attribute_group);
+	sysfs_remove_group(&interface->dev.kobj,
+			   &imon_rf_attribute_group);
+
+	usb_set_intfdata(interface, NULL);
+
+	/* Abort ongoing write */
+	if (atomic_read(&context->tx.busy)) {
+		usb_kill_urb(context->tx_urb);
+		complete_all(&context->tx.finished);
+	}
+
+	if (ifnum == 0) {
+		context->dev_present_intf0 = 0;
+		usb_kill_urb(context->rx_urb_intf0);
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 18)
+		input_unregister_device(context->mouse);
+#endif
+		if (context->display_supported)
+			usb_deregister_dev(interface, &imon_class);
+	} else {
+		context->dev_present_intf1 = 0;
+		usb_kill_urb(context->rx_urb_intf1);
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 18)
+		if (context->display_type == IMON_DISPLAY_TYPE_VGA)
+			input_unregister_device(context->touch);
+#endif
+	}
+
+	if (!context->ir_isopen && !context->dev_present_intf0 &&
+	    !context->dev_present_intf1) {
+		del_timer_sync(&context->timer);
+		deregister_from_lirc(context);
+		mutex_unlock(&context->lock);
+		if (!context->display_isopen)
+			free_imon_context(context);
+	} else
+		mutex_unlock(&context->lock);
+
+	mutex_unlock(&driver_lock);
+
+	printk(KERN_INFO "%s: iMON device (intf%d) disconnected\n",
+	       __func__, ifnum);
+}
+
+static int imon_suspend(struct usb_interface *intf, pm_message_t message)
+{
+	struct imon_context *context = usb_get_intfdata(intf);
+	int ifnum = intf->cur_altsetting->desc.bInterfaceNumber;
+
+	if (ifnum == 0)
+		usb_kill_urb(context->rx_urb_intf0);
+	else
+		usb_kill_urb(context->rx_urb_intf1);
+
+	return 0;
+}
+
+static int imon_resume(struct usb_interface *intf)
+{
+	int rc = 0;
+	struct imon_context *context = usb_get_intfdata(intf);
+	int ifnum = intf->cur_altsetting->desc.bInterfaceNumber;
+
+	if (ifnum == 0) {
+		usb_fill_int_urb(context->rx_urb_intf0, context->usbdev_intf0,
+			usb_rcvintpipe(context->usbdev_intf0,
+					context->rx_endpoint_intf0->bEndpointAddress),
+			context->usb_rx_buf, sizeof(context->usb_rx_buf),
+			usb_rx_callback_intf0, context,
+			context->rx_endpoint_intf0->bInterval);
+
+		rc = usb_submit_urb(context->rx_urb_intf0, GFP_ATOMIC);
+
+	} else {
+		usb_fill_int_urb(context->rx_urb_intf1, context->usbdev_intf1,
+			usb_rcvintpipe(context->usbdev_intf1,
+				context->rx_endpoint_intf1->bEndpointAddress),
+			context->usb_rx_buf, sizeof(context->usb_rx_buf),
+			usb_rx_callback_intf1, context,
+			context->rx_endpoint_intf1->bInterval);
+
+		rc = usb_submit_urb(context->rx_urb_intf1, GFP_ATOMIC);
+	}
+
+	return rc;
+}
+
+static int __init imon_init(void)
+{
+	int rc;
+
+	printk(KERN_INFO MOD_NAME ": " MOD_DESC ", v" MOD_VERSION "\n");
+
+	rc = usb_register(&imon_driver);
+	if (rc) {
+		err("%s: usb register failed(%d)", __func__, rc);
+		return -ENODEV;
+	}
+
+	return 0;
+}
+
+static void __exit imon_exit(void)
+{
+	usb_deregister(&imon_driver);
+	printk(KERN_INFO MOD_NAME ": module removed. Goodbye!\n");
+}
+
+module_init(imon_init);
+module_exit(imon_exit);
--- linux-rt-2.6.31.orig/ubuntu/lirc/lirc_imon/Makefile
+++ linux-rt-2.6.31/ubuntu/lirc/lirc_imon/Makefile
@@ -0,0 +1,3 @@
+EXTRA_CFLAGS =-DIRCTL_DEV_MAJOR=61 -DLIRC_SERIAL_TRANSMITTER -DLIRC_SERIAL_SOFTCARRIER -I$(src)/..
+
+obj-$(CONFIG_LIRC_IMON)		+= lirc_imon.o
--- linux-rt-2.6.31.orig/ubuntu/lirc/lirc_bt829/Makefile
+++ linux-rt-2.6.31/ubuntu/lirc/lirc_bt829/Makefile
@@ -0,0 +1,3 @@
+EXTRA_CFLAGS =-DIRCTL_DEV_MAJOR=61 -DLIRC_SERIAL_TRANSMITTER -DLIRC_SERIAL_SOFTCARRIER -I$(src)/..
+
+obj-$(CONFIG_LIRC_ATIUSB)	+= lirc_bt829.o
--- linux-rt-2.6.31.orig/ubuntu/lirc/lirc_bt829/lirc_bt829.c
+++ linux-rt-2.6.31/ubuntu/lirc/lirc_bt829/lirc_bt829.c
@@ -0,0 +1,399 @@
+/*
+ * Remote control driver for the TV-card based on bt829
+ *
+ *  by Leonid Froenchenko <lfroen@galileo.co.il>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+*/
+
+#include <linux/version.h>
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 4, 0)
+#error "This driver needs kernel version 2.4.0 or higher"
+#endif
+#include <linux/autoconf.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/threads.h>
+#include <linux/sched.h>
+#include <linux/ioport.h>
+#include <linux/pci.h>
+#include <linux/delay.h>
+
+#include "../kcompat.h"
+#include "../lirc_dev/lirc_dev.h"
+
+static int poll_main(void);
+static int atir_init_start(void);
+
+static void write_index(unsigned char index, unsigned int value);
+static unsigned int read_index(unsigned char index);
+
+static void do_i2c_start(void);
+static void do_i2c_stop(void);
+
+static void seems_wr_byte(unsigned char al);
+static unsigned char seems_rd_byte(void);
+
+static unsigned int read_index(unsigned char al);
+static void write_index(unsigned char ah, unsigned int edx);
+
+static void cycle_delay(int cycle);
+
+static void do_set_bits(unsigned char bl);
+static unsigned char do_get_bits(void);
+
+#define DATA_PCI_OFF 0x7FFC00
+#define WAIT_CYCLE   20
+
+#define DRIVER_NAME "lirc_bt829"
+
+static int debug;
+#define dprintk(fmt, args...)					\
+	do {							\
+		if (debug)					\
+			printk(KERN_DEBUG DRIVER_NAME ": " fmt, ## args); \
+	} while (0)
+
+static int atir_minor;
+static unsigned long pci_addr_phys;
+static unsigned char *pci_addr_lin;
+
+static struct lirc_driver atir_driver;
+
+static struct pci_dev *do_pci_probe(void)
+{
+	struct pci_dev *my_dev;
+#ifndef KERNEL_2_5
+	/* unnecessary with recent kernels */
+	if (!pci_present())
+		printk(KERN_ERR DRIVER_NAME ": no pci in this kernel\n");
+#endif
+	my_dev = pci_get_device(PCI_VENDOR_ID_ATI,
+				PCI_DEVICE_ID_ATI_264VT, NULL);
+	if (my_dev) {
+		printk(KERN_ERR DRIVER_NAME ": Using device: %s\n",
+		       pci_name(my_dev));
+		pci_addr_phys = 0;
+		if (my_dev->resource[0].flags & IORESOURCE_MEM) {
+			pci_addr_phys = my_dev->resource[0].start;
+			printk(KERN_INFO DRIVER_NAME ": memory at 0x%08X\n",
+			       (unsigned int)pci_addr_phys);
+		}
+		if (pci_addr_phys == 0) {
+			printk(KERN_ERR DRIVER_NAME ": no memory resource ?\n");
+			return NULL;
+		}
+	} else {
+		printk(KERN_ERR DRIVER_NAME ": pci_probe failed\n");
+		return NULL;
+	}
+	return my_dev;
+}
+
+static int atir_add_to_buf(void *data, struct lirc_buffer *buf)
+{
+	unsigned char key;
+	int status;
+	status = poll_main();
+	key = (status >> 8) & 0xFF;
+	if (status & 0xFF) {
+		dprintk("reading key %02X\n", key);
+		lirc_buffer_write(buf, &key);
+		return 0;
+	}
+	return -ENODATA;
+}
+
+static int atir_set_use_inc(void *data)
+{
+	MOD_INC_USE_COUNT;
+	dprintk("driver is opened\n");
+	return 0;
+}
+
+static void atir_set_use_dec(void *data)
+{
+	MOD_DEC_USE_COUNT;
+	dprintk("driver is closed\n");
+}
+
+int init_module(void)
+{
+	struct pci_dev *pdev;
+
+	pdev = do_pci_probe();
+	if (pdev == NULL)
+		return 1;
+
+	if (!atir_init_start())
+		return 1;
+
+	strcpy(atir_driver.name, "ATIR");
+	atir_driver.minor       = -1;
+	atir_driver.code_length = 8;
+	atir_driver.sample_rate = 10;
+	atir_driver.data        = 0;
+	atir_driver.add_to_buf  = atir_add_to_buf;
+	atir_driver.set_use_inc = atir_set_use_inc;
+	atir_driver.set_use_dec = atir_set_use_dec;
+#ifdef LIRC_HAVE_SYSFS
+	atir_driver.dev         = &pdev->dev;
+#endif
+	atir_driver.owner       = THIS_MODULE;
+
+	atir_minor = lirc_register_driver(&atir_driver);
+	if (atir_minor < 0) {
+		printk(KERN_ERR DRIVER_NAME ": failed to register driver!\n");
+		return atir_minor;
+	}
+	dprintk("driver is registered on minor %d\n", atir_minor);
+
+	return 0;
+}
+
+
+void cleanup_module(void)
+{
+	lirc_unregister_driver(atir_minor);
+}
+
+
+static int atir_init_start(void)
+{
+	pci_addr_lin = ioremap(pci_addr_phys + DATA_PCI_OFF, 0x400);
+	if (pci_addr_lin == 0) {
+		printk(KERN_INFO DRIVER_NAME ": pci mem must be mapped\n");
+		return 0;
+	}
+	return 1;
+}
+
+static void cycle_delay(int cycle)
+{
+	udelay(WAIT_CYCLE*cycle);
+}
+
+
+static int poll_main()
+{
+	unsigned char status_high, status_low;
+
+	do_i2c_start();
+
+	seems_wr_byte(0xAA);
+	seems_wr_byte(0x01);
+
+	do_i2c_start();
+
+	seems_wr_byte(0xAB);
+
+	status_low = seems_rd_byte();
+	status_high = seems_rd_byte();
+
+	do_i2c_stop();
+
+	return (status_high << 8) | status_low;
+}
+
+static void do_i2c_start(void)
+{
+	do_set_bits(3);
+	cycle_delay(4);
+
+	do_set_bits(1);
+	cycle_delay(7);
+
+	do_set_bits(0);
+	cycle_delay(2);
+}
+
+static void do_i2c_stop(void)
+{
+	unsigned char bits;
+	bits =  do_get_bits() & 0xFD;
+	do_set_bits(bits);
+	cycle_delay(1);
+
+	bits |= 1;
+	do_set_bits(bits);
+	cycle_delay(2);
+
+	bits |= 2;
+	do_set_bits(bits);
+	bits = 3;
+	do_set_bits(bits);
+	cycle_delay(2);
+}
+
+static void seems_wr_byte(unsigned char value)
+{
+	int i;
+	unsigned char reg;
+
+	reg = do_get_bits();
+	for (i = 0; i < 8; i++) {
+		if (value & 0x80)
+			reg |= 0x02;
+		else
+			reg &= 0xFD;
+
+		do_set_bits(reg);
+		cycle_delay(1);
+
+		reg |= 1;
+		do_set_bits(reg);
+		cycle_delay(1);
+
+		reg &= 0xFE;
+		do_set_bits(reg);
+		cycle_delay(1);
+		value <<= 1;
+	}
+	cycle_delay(2);
+
+	reg |= 2;
+	do_set_bits(reg);
+
+	reg |= 1;
+	do_set_bits(reg);
+
+	cycle_delay(1);
+	do_get_bits();
+
+	reg &= 0xFE;
+	do_set_bits(reg);
+	cycle_delay(3);
+}
+
+static unsigned char seems_rd_byte(void)
+{
+	int i;
+	int rd_byte;
+	unsigned char bits_2, bits_1;
+
+	bits_1 = do_get_bits() | 2;
+	do_set_bits(bits_1);
+
+	rd_byte = 0;
+	for (i = 0; i < 8; i++) {
+		bits_1 &= 0xFE;
+		do_set_bits(bits_1);
+		cycle_delay(2);
+
+		bits_1 |= 1;
+		do_set_bits(bits_1);
+		cycle_delay(1);
+
+		bits_2 = do_get_bits();
+		if (bits_2 & 2)
+			rd_byte |= 1;
+
+		rd_byte <<= 1;
+	}
+
+	bits_1 = 0;
+	if (bits_2 == 0)
+		bits_1 |= 2;
+
+	do_set_bits(bits_1);
+	cycle_delay(2);
+
+	bits_1 |= 1;
+	do_set_bits(bits_1);
+	cycle_delay(3);
+
+	bits_1 &= 0xFE;
+	do_set_bits(bits_1);
+	cycle_delay(2);
+
+	rd_byte >>= 1;
+	rd_byte &= 0xFF;
+	return rd_byte;
+}
+
+static void do_set_bits(unsigned char new_bits)
+{
+	int reg_val;
+	reg_val = read_index(0x34);
+	if (new_bits & 2) {
+		reg_val &= 0xFFFFFFDF;
+		reg_val |= 1;
+	} else {
+		reg_val &= 0xFFFFFFFE;
+		reg_val |= 0x20;
+	}
+	reg_val |= 0x10;
+	write_index(0x34, reg_val);
+
+	reg_val = read_index(0x31);
+	if (new_bits & 1)
+		reg_val |= 0x1000000;
+	else
+		reg_val &= 0xFEFFFFFF;
+
+	reg_val |= 0x8000000;
+	write_index(0x31, reg_val);
+}
+
+static unsigned char do_get_bits(void)
+{
+	unsigned char bits;
+	int reg_val;
+
+	reg_val = read_index(0x34);
+	reg_val |= 0x10;
+	reg_val &= 0xFFFFFFDF;
+	write_index(0x34, reg_val);
+
+	reg_val = read_index(0x34);
+	bits = 0;
+	if (reg_val & 8)
+		bits |= 2;
+	else
+		bits &= 0xFD;
+
+	reg_val = read_index(0x31);
+	if (reg_val & 0x1000000)
+		bits |= 1;
+	else
+		bits &= 0xFE;
+
+	return bits;
+}
+
+static unsigned int read_index(unsigned char index)
+{
+	unsigned char *addr;
+	unsigned int value;
+	/*  addr = pci_addr_lin + DATA_PCI_OFF + ((index & 0xFF) << 2); */
+	addr = pci_addr_lin + ((index & 0xFF) << 2);
+	value = readl(addr);
+	return value;
+}
+
+static void write_index(unsigned char index, unsigned int reg_val)
+{
+	unsigned char *addr;
+	addr = pci_addr_lin + ((index & 0xFF) << 2);
+	writel(reg_val, addr);
+}
+
+MODULE_AUTHOR("Froenchenko Leonid");
+MODULE_DESCRIPTION("IR remote driver for bt829 based TV cards");
+MODULE_LICENSE("GPL");
+
+module_param(debug, bool, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(debug, "Debug enabled or not");
+EXPORT_NO_SYMBOLS;
--- linux-rt-2.6.31.orig/ubuntu/lirc/lirc_parallel/Makefile
+++ linux-rt-2.6.31/ubuntu/lirc/lirc_parallel/Makefile
@@ -0,0 +1,3 @@
+EXTRA_CFLAGS =-DIRCTL_DEV_MAJOR=61 -DLIRC_SERIAL_TRANSMITTER -DLIRC_SERIAL_SOFTCARRIER -I$(src)/..
+
+obj-$(CONFIG_LIRC_PARALLEL)	+= lirc_parallel.o
--- linux-rt-2.6.31.orig/ubuntu/lirc/lirc_parallel/lirc_parallel.h
+++ linux-rt-2.6.31/ubuntu/lirc/lirc_parallel/lirc_parallel.h
@@ -0,0 +1,26 @@
+/*      $Id: lirc_parallel.h,v 5.2 2007/01/25 04:32:05 lirc Exp $      */
+
+#ifndef _LIRC_PARALLEL_H
+#define _LIRC_PARALLEL_H
+
+#include <linux/lp.h>
+
+#define LIRC_PORT_LEN 3
+
+#define LIRC_LP_BASE    0
+#define LIRC_LP_STATUS  1
+#define LIRC_LP_CONTROL 2
+
+#define LIRC_PORT_DATA           LIRC_LP_BASE    /* base */
+#define LIRC_PORT_TIMER        LIRC_LP_STATUS    /* status port */
+#define LIRC_PORT_TIMER_BIT          LP_PBUSY    /* busy signal */
+#define LIRC_PORT_SIGNAL       LIRC_LP_STATUS    /* status port */
+#define LIRC_PORT_SIGNAL_BIT          LP_PACK    /* ack signal */
+#define LIRC_PORT_IRQ         LIRC_LP_CONTROL    /* control port */
+
+#define LIRC_SFH506_DELAY 0             /* delay t_phl in usecs */
+
+#define LIRC_PARALLEL_MAX_TRANSMITTERS 8
+#define LIRC_PARALLEL_TRANSMITTER_MASK ((1<<LIRC_PARALLEL_MAX_TRANSMITTERS) - 1)
+
+#endif
--- linux-rt-2.6.31.orig/ubuntu/lirc/lirc_parallel/lirc_parallel.c
+++ linux-rt-2.6.31/ubuntu/lirc/lirc_parallel/lirc_parallel.c
@@ -0,0 +1,764 @@
+/*      $Id: lirc_parallel.c,v 5.53 2009/03/08 19:22:28 lirc Exp $      */
+/*
+ * lirc_parallel.c
+ *
+ * lirc_parallel - device driver for infra-red signal receiving and
+ *                 transmitting unit built by the author
+ *
+ * Copyright (C) 1998 Christoph Bartelmus <lirc@bartelmus.de>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *
+ */
+
+/*** Includes ***/
+#ifdef HAVE_CONFIG_H
+# include <config.h>
+#endif
+#include <linux/version.h>
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 2, 18)
+#error "**********************************************************"
+#error " Sorry, this driver needs kernel version 2.2.18 or higher "
+#error "**********************************************************"
+#endif
+
+#include <linux/autoconf.h>
+#ifdef CONFIG_SMP
+#error "--- Sorry, this driver is not SMP safe. ---"
+#endif
+
+#include <linux/module.h>
+#include <linux/sched.h>
+#include <linux/errno.h>
+#include <linux/signal.h>
+#include <linux/autoconf.h>
+#include <linux/fs.h>
+#include <linux/kernel.h>
+#include <linux/ioport.h>
+#include <linux/time.h>
+#include <linux/mm.h>
+#include <linux/delay.h>
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 18)
+#include <asm/io.h>
+#include <asm/signal.h>
+#include <asm/irq.h>
+#include <asm/uaccess.h>
+#else
+#include <linux/io.h>
+#include <linux/signal.h>
+#include <linux/irq.h>
+#include <linux/uaccess.h>
+#endif
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 4, 0)
+#include <asm/div64.h>
+#endif
+
+#include <linux/poll.h>
+#include <linux/parport.h>
+
+#include "../lirc.h"
+#include "../kcompat.h"
+#include "../lirc_dev/lirc_dev.h"
+
+#include "lirc_parallel.h"
+
+#define LIRC_DRIVER_NAME "lirc_parallel"
+
+#ifndef LIRC_IRQ
+#define LIRC_IRQ 7
+#endif
+#ifndef LIRC_PORT
+#define LIRC_PORT 0x378
+#endif
+#ifndef LIRC_TIMER
+#define LIRC_TIMER 65536
+#endif
+
+/*** Global Variables ***/
+
+static int debug;
+static int check_pselecd;
+
+unsigned int irq = LIRC_IRQ;
+unsigned int io = LIRC_PORT;
+#ifdef LIRC_TIMER
+unsigned int timer;
+unsigned int default_timer = LIRC_TIMER;
+#endif
+
+#define WBUF_SIZE (256)
+#define RBUF_SIZE (256) /* this must be a power of 2 larger than 1 */
+
+static lirc_t wbuf[WBUF_SIZE];
+static lirc_t rbuf[RBUF_SIZE];
+
+DECLARE_WAIT_QUEUE_HEAD(lirc_wait);
+
+unsigned int rptr;
+unsigned int wptr;
+unsigned int lost_irqs;
+int is_open;
+
+struct parport *pport;
+struct pardevice *ppdevice;
+int is_claimed;
+
+unsigned int tx_mask = 1;
+
+/*** Internal Functions ***/
+
+static unsigned int in(int offset)
+{
+	switch (offset) {
+	case LIRC_LP_BASE:
+		return parport_read_data(pport);
+	case LIRC_LP_STATUS:
+		return parport_read_status(pport);
+	case LIRC_LP_CONTROL:
+		return parport_read_control(pport);
+	}
+	return 0; /* make compiler happy */
+}
+
+static void out(int offset, int value)
+{
+	switch (offset) {
+	case LIRC_LP_BASE:
+		parport_write_data(pport, value);
+		break;
+	case LIRC_LP_CONTROL:
+		parport_write_control(pport, value);
+		break;
+	case LIRC_LP_STATUS:
+		printk(KERN_INFO "%s: attempt to write to status register\n",
+		       LIRC_DRIVER_NAME);
+		break;
+	}
+}
+
+static unsigned int lirc_get_timer(void)
+{
+	return in(LIRC_PORT_TIMER) & LIRC_PORT_TIMER_BIT;
+}
+
+static unsigned int lirc_get_signal(void)
+{
+	return in(LIRC_PORT_SIGNAL) & LIRC_PORT_SIGNAL_BIT;
+}
+
+static void lirc_on(void)
+{
+	out(LIRC_PORT_DATA, tx_mask);
+}
+
+static void lirc_off(void)
+{
+	out(LIRC_PORT_DATA, 0);
+}
+
+static unsigned int init_lirc_timer(void)
+{
+	struct timeval tv, now;
+	unsigned int level, newlevel, timeelapsed, newtimer;
+	int count = 0;
+
+	do_gettimeofday(&tv);
+	tv.tv_sec++;                     /* wait max. 1 sec. */
+	level = lirc_get_timer();
+	do {
+		newlevel = lirc_get_timer();
+		if (level == 0 && newlevel != 0)
+			count++;
+		level = newlevel;
+		do_gettimeofday(&now);
+	} while (count < 1000 && (now.tv_sec < tv.tv_sec
+			     || (now.tv_sec == tv.tv_sec
+				 && now.tv_usec < tv.tv_usec)));
+
+	timeelapsed = ((now.tv_sec + 1 - tv.tv_sec)*1000000
+		     + (now.tv_usec - tv.tv_usec));
+	if (count >= 1000 && timeelapsed > 0) {
+		if (default_timer == 0) {
+			/* autodetect timer */
+			newtimer = (1000000*count)/timeelapsed;
+			printk(KERN_INFO "%s: %u Hz timer detected\n",
+			       LIRC_DRIVER_NAME, newtimer);
+			return newtimer;
+		}  else {
+			newtimer = (1000000*count)/timeelapsed;
+			if (abs(newtimer - default_timer) > default_timer/10) {
+				/* bad timer */
+				printk(KERN_NOTICE "%s: bad timer: %u Hz\n",
+				       LIRC_DRIVER_NAME, newtimer);
+				printk(KERN_NOTICE "%s: using default timer: "
+				       "%u Hz\n",
+				       LIRC_DRIVER_NAME, default_timer);
+				return default_timer;
+			} else {
+				printk(KERN_INFO "%s: %u Hz timer detected\n",
+				       LIRC_DRIVER_NAME, newtimer);
+				return newtimer; /* use detected value */
+			}
+		}
+	} else {
+		printk(KERN_NOTICE "%s: no timer detected\n", LIRC_DRIVER_NAME);
+		return 0;
+	}
+}
+
+static int lirc_claim(void)
+{
+	if (parport_claim(ppdevice) != 0) {
+		printk(KERN_WARNING "%s: could not claim port\n",
+		       LIRC_DRIVER_NAME);
+		printk(KERN_WARNING "%s: waiting for port becoming available"
+		       "\n", LIRC_DRIVER_NAME);
+		if (parport_claim_or_block(ppdevice) < 0) {
+			printk(KERN_NOTICE "%s: could not claim port, giving"
+			       " up\n", LIRC_DRIVER_NAME);
+			return 0;
+		}
+	}
+	out(LIRC_LP_CONTROL, LP_PSELECP|LP_PINITP);
+	is_claimed = 1;
+	return 1;
+}
+
+/*** interrupt handler ***/
+
+static void rbuf_write(lirc_t signal)
+{
+	unsigned int nwptr;
+
+	nwptr = (wptr + 1) & (RBUF_SIZE - 1);
+	if (nwptr == rptr) {
+		/* no new signals will be accepted */
+		lost_irqs++;
+		printk(KERN_NOTICE "%s: buffer overrun\n", LIRC_DRIVER_NAME);
+		return;
+	}
+	rbuf[wptr] = signal;
+	wptr = nwptr;
+}
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 19)
+static void irq_handler(int i, void *blah, struct pt_regs *regs)
+#elif LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 24)
+static void irq_handler(int i, void *blah)
+#else
+static void irq_handler(void *blah)
+#endif
+{
+	struct timeval tv;
+	static struct timeval lasttv;
+	static int init;
+	long signal;
+	lirc_t data;
+	unsigned int level, newlevel;
+	unsigned int timeout;
+
+	if (!MOD_IN_USE)
+		return;
+
+	if (!is_claimed)
+		return;
+
+#if 0
+	/* disable interrupt */
+	disable_irq(irq);
+	out(LIRC_PORT_IRQ, in(LIRC_PORT_IRQ) & (~LP_PINTEN));
+#endif
+	if (check_pselecd && (in(1) & LP_PSELECD))
+		return;
+
+#ifdef LIRC_TIMER
+	if (init) {
+		do_gettimeofday(&tv);
+
+		signal = tv.tv_sec - lasttv.tv_sec;
+		if (signal > 15)
+			/* really long time */
+			data = PULSE_MASK;
+		else
+			data = (lirc_t) (signal*1000000 +
+					 tv.tv_usec - lasttv.tv_usec +
+					 LIRC_SFH506_DELAY);
+
+		rbuf_write(data); /* space */
+	} else {
+		if (timer == 0) {
+			/*
+			 * wake up; we'll lose this signal, but it will be
+			 * garbage if the device is turned on anyway
+			 */
+			timer = init_lirc_timer();
+			/* enable_irq(irq); */
+			return;
+		}
+		init = 1;
+	}
+
+	timeout = timer/10;	/* timeout after 1/10 sec. */
+	signal = 1;
+	level = lirc_get_timer();
+	do {
+		newlevel = lirc_get_timer();
+		if (level == 0 && newlevel != 0)
+			signal++;
+		level = newlevel;
+
+		/* giving up */
+		if (signal > timeout
+		    || (check_pselecd && (in(1) & LP_PSELECD))) {
+			signal = 0;
+			printk(KERN_NOTICE "%s: timeout\n", LIRC_DRIVER_NAME);
+			break;
+		}
+	} while (lirc_get_signal());
+
+	if (signal != 0) {
+		/* adjust value to usecs */
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 4, 0)
+		unsigned long long helper;
+
+		helper = ((unsigned long long) signal)*1000000;
+		do_div(helper, timer);
+		signal = (long) helper;
+#else
+		signal = (long) ((((double) signal)*1000000)/timer);
+#endif
+
+		if (signal > LIRC_SFH506_DELAY)
+			data = signal - LIRC_SFH506_DELAY;
+		else
+			data = 1;
+		rbuf_write(PULSE_BIT|data); /* pulse */
+	}
+	do_gettimeofday(&lasttv);
+#else
+	/* add your code here */
+#endif
+
+	wake_up_interruptible(&lirc_wait);
+
+	/* enable interrupt */
+	/*
+	  enable_irq(irq);
+	  out(LIRC_PORT_IRQ, in(LIRC_PORT_IRQ)|LP_PINTEN);
+	*/
+}
+
+/*** file operations ***/
+
+static loff_t lirc_lseek(struct file *filep, loff_t offset, int orig)
+{
+	return -ESPIPE;
+}
+
+static ssize_t lirc_read(struct file *filep, char *buf, size_t n, loff_t *ppos)
+{
+	int result = 0;
+	int count = 0;
+	DECLARE_WAITQUEUE(wait, current);
+
+	if (n % sizeof(lirc_t))
+		return -EINVAL;
+
+	add_wait_queue(&lirc_wait, &wait);
+	set_current_state(TASK_INTERRUPTIBLE);
+	while (count < n) {
+		if (rptr != wptr) {
+			if (copy_to_user(buf+count, (char *) &rbuf[rptr],
+					 sizeof(lirc_t))) {
+				result = -EFAULT;
+				break;
+			}
+			rptr = (rptr + 1) & (RBUF_SIZE - 1);
+			count += sizeof(lirc_t);
+		} else {
+			if (filep->f_flags & O_NONBLOCK) {
+				result = -EAGAIN;
+				break;
+			}
+			if (signal_pending(current)) {
+				result = -ERESTARTSYS;
+				break;
+			}
+			schedule();
+			set_current_state(TASK_INTERRUPTIBLE);
+		}
+	}
+	remove_wait_queue(&lirc_wait, &wait);
+	set_current_state(TASK_RUNNING);
+	return count ? count : result;
+}
+
+static ssize_t lirc_write(struct file *filep, const char *buf, size_t n,
+			  loff_t *ppos)
+{
+	int count;
+	unsigned int i;
+	unsigned int level, newlevel;
+	unsigned long flags;
+	lirc_t counttimer;
+
+	if (!is_claimed)
+		return -EBUSY;
+
+	if (n % sizeof(lirc_t))
+		return -EINVAL;
+
+	count = n / sizeof(lirc_t);
+
+	if (count > WBUF_SIZE || count % 2 == 0)
+		return -EINVAL;
+
+	if (copy_from_user(wbuf, buf, n))
+		return -EFAULT;
+
+#ifdef LIRC_TIMER
+	if (timer == 0) {
+		/* try again if device is ready */
+		timer = init_lirc_timer();
+		if (timer == 0)
+			return -EIO;
+	}
+
+	/* adjust values from usecs */
+	for (i = 0; i < count; i++) {
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 4, 0)
+		unsigned long long helper;
+
+		helper = ((unsigned long long) wbuf[i])*timer;
+		do_div(helper, 1000000);
+		wbuf[i] = (lirc_t) helper;
+#else
+		wbuf[i] = (lirc_t) (((double) wbuf[i])*timer/1000000);
+#endif
+	}
+
+	local_irq_save(flags);
+	i = 0;
+	while (i < count) {
+		level = lirc_get_timer();
+		counttimer = 0;
+		lirc_on();
+		do {
+			newlevel = lirc_get_timer();
+			if (level == 0 && newlevel != 0)
+				counttimer++;
+			level = newlevel;
+			if (check_pselecd && (in(1) & LP_PSELECD)) {
+				lirc_off();
+				local_irq_restore(flags);
+				return -EIO;
+			}
+		} while (counttimer < wbuf[i]);
+		i++;
+
+		lirc_off();
+		if (i == count)
+			break;
+		counttimer = 0;
+		do {
+			newlevel = lirc_get_timer();
+			if (level == 0 && newlevel != 0)
+				counttimer++;
+			level = newlevel;
+			if (check_pselecd && (in(1) & LP_PSELECD)) {
+				local_irq_restore(flags);
+				return -EIO;
+			}
+		} while (counttimer < wbuf[i]);
+		i++;
+	}
+	local_irq_restore(flags);
+#else
+	/* place code that handles write without external timer here */
+#endif
+	return n;
+}
+
+static unsigned int lirc_poll(struct file *file, poll_table *wait)
+{
+	poll_wait(file, &lirc_wait, wait);
+	if (rptr != wptr)
+		return POLLIN | POLLRDNORM;
+	return 0;
+}
+
+static int lirc_ioctl(struct inode *node, struct file *filep, unsigned int cmd,
+		      unsigned long arg)
+{
+	int result;
+	unsigned long features = LIRC_CAN_SET_TRANSMITTER_MASK |
+				 LIRC_CAN_SEND_PULSE | LIRC_CAN_REC_MODE2;
+	unsigned long mode;
+	unsigned int ivalue;
+
+	switch (cmd) {
+	case LIRC_GET_FEATURES:
+		result = put_user(features, (unsigned long *) arg);
+		if (result)
+			return result;
+		break;
+	case LIRC_GET_SEND_MODE:
+		result = put_user(LIRC_MODE_PULSE, (unsigned long *) arg);
+		if (result)
+			return result;
+		break;
+	case LIRC_GET_REC_MODE:
+		result = put_user(LIRC_MODE_MODE2, (unsigned long *) arg);
+		if (result)
+			return result;
+		break;
+	case LIRC_SET_SEND_MODE:
+		result = get_user(mode, (unsigned long *) arg);
+		if (result)
+			return result;
+		if (mode != LIRC_MODE_PULSE)
+			return -EINVAL;
+		break;
+	case LIRC_SET_REC_MODE:
+		result = get_user(mode, (unsigned long *) arg);
+		if (result)
+			return result;
+		if (mode != LIRC_MODE_MODE2)
+			return -ENOSYS;
+		break;
+	case LIRC_SET_TRANSMITTER_MASK:
+		result = get_user(ivalue, (unsigned int *) arg);
+		if (result)
+			return result;
+		if ((ivalue & LIRC_PARALLEL_TRANSMITTER_MASK) != ivalue)
+			return LIRC_PARALLEL_MAX_TRANSMITTERS;
+		tx_mask = ivalue;
+		break;
+	default:
+		return -ENOIOCTLCMD;
+	}
+	return 0;
+}
+
+static int lirc_open(struct inode *node, struct file *filep)
+{
+	if (MOD_IN_USE || !lirc_claim())
+		return -EBUSY;
+
+	parport_enable_irq(pport);
+
+	/* init read ptr */
+	rptr = 0;
+	wptr = 0;
+	lost_irqs = 0;
+
+	MOD_INC_USE_COUNT;
+	is_open = 1;
+	return 0;
+}
+
+static int lirc_close(struct inode *node, struct file *filep)
+{
+	if (is_claimed) {
+		is_claimed = 0;
+		parport_release(ppdevice);
+	}
+	is_open = 0;
+	MOD_DEC_USE_COUNT;
+	return 0;
+}
+
+static struct file_operations lirc_fops = {
+	.owner		= THIS_MODULE,
+	.llseek		= lirc_lseek,
+	.read		= lirc_read,
+	.write		= lirc_write,
+	.poll		= lirc_poll,
+	.ioctl		= lirc_ioctl,
+	.open		= lirc_open,
+	.release	= lirc_close
+};
+
+static int set_use_inc(void *data)
+{
+	return 0;
+}
+
+static void set_use_dec(void *data)
+{
+}
+
+static struct lirc_driver driver = {
+       .name		= LIRC_DRIVER_NAME,
+       .minor		= -1,
+       .code_length	= 1,
+       .sample_rate	= 0,
+       .data		= NULL,
+       .add_to_buf	= NULL,
+#ifndef LIRC_REMOVE_DURING_EXPORT
+       .get_queue	= NULL,
+#endif
+       .set_use_inc	= set_use_inc,
+       .set_use_dec	= set_use_dec,
+       .fops		= &lirc_fops,
+       .dev		= NULL,
+       .owner		= THIS_MODULE,
+};
+
+#ifdef MODULE
+static int pf(void *handle);
+static void kf(void *handle);
+
+static struct timer_list poll_timer;
+static void poll_state(unsigned long ignored);
+
+static void poll_state(unsigned long ignored)
+{
+	printk(KERN_NOTICE "%s: time\n",
+	       LIRC_DRIVER_NAME);
+	del_timer(&poll_timer);
+	if (is_claimed)
+		return;
+	kf(NULL);
+	if (!is_claimed) {
+		printk(KERN_NOTICE "%s: could not claim port, giving up\n",
+		       LIRC_DRIVER_NAME);
+		init_timer(&poll_timer);
+		poll_timer.expires = jiffies + HZ;
+		poll_timer.data = (unsigned long)current;
+		poll_timer.function = poll_state;
+		add_timer(&poll_timer);
+	}
+}
+
+static int pf(void *handle)
+{
+	parport_disable_irq(pport);
+	is_claimed = 0;
+	return 0;
+}
+
+static void kf(void *handle)
+{
+	if (!is_open)
+		return;
+	if (!lirc_claim())
+		return;
+	parport_enable_irq(pport);
+	lirc_off();
+	/* this is a bit annoying when you actually print...*/
+	/*
+	printk(KERN_INFO "%s: reclaimed port\n", LIRC_DRIVER_NAME);
+	*/
+}
+
+/*** module initialization and cleanup ***/
+
+static int __init lirc_parallel_init(void)
+{
+#if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 3)
+	pport = parport_find_base(io);
+#else
+	pport = parport_enumerate();
+	while (pport != NULL) {
+		if (pport->base == io)
+			break;
+		pport = pport->next;
+	}
+#endif
+	if (pport == NULL) {
+		printk(KERN_NOTICE "%s: no port at %x found\n",
+		       LIRC_DRIVER_NAME, io);
+		return -ENXIO;
+	}
+	ppdevice = parport_register_device(pport, LIRC_DRIVER_NAME,
+					   pf, kf, irq_handler, 0, NULL);
+#if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 3)
+	parport_put_port(pport);
+#endif
+	if (ppdevice == NULL) {
+		printk(KERN_NOTICE "%s: parport_register_device() failed\n",
+		       LIRC_DRIVER_NAME);
+		return -ENXIO;
+	}
+	if (parport_claim(ppdevice) != 0)
+		goto skip_init;
+	is_claimed = 1;
+	out(LIRC_LP_CONTROL, LP_PSELECP|LP_PINITP);
+
+#ifdef LIRC_TIMER
+	if (debug)
+		out(LIRC_PORT_DATA, tx_mask);
+
+	timer = init_lirc_timer();
+
+#if 0	/* continue even if device is offline */
+	if (timer == 0) {
+		is_claimed = 0;
+		parport_release(pport);
+		parport_unregister_device(ppdevice);
+		return -EIO;
+	}
+
+#endif
+	if (debug)
+		out(LIRC_PORT_DATA, 0);
+#endif
+
+	is_claimed = 0;
+	parport_release(ppdevice);
+ skip_init:
+	driver.minor = lirc_register_driver(&driver);
+	if (driver.minor < 0) {
+		printk(KERN_NOTICE "%s: register_chrdev() failed\n",
+		       LIRC_DRIVER_NAME);
+		parport_unregister_device(ppdevice);
+		return -EIO;
+	}
+	printk(KERN_INFO "%s: installed using port 0x%04x irq %d\n",
+	       LIRC_DRIVER_NAME, io, irq);
+	return 0;
+}
+
+static void __exit lirc_parallel_exit(void)
+{
+	parport_unregister_device(ppdevice);
+	lirc_unregister_driver(driver.minor);
+}
+
+module_init(lirc_parallel_init);
+module_exit(lirc_parallel_exit);
+
+MODULE_DESCRIPTION("Infrared receiver driver for parallel ports.");
+MODULE_AUTHOR("Christoph Bartelmus");
+MODULE_LICENSE("GPL");
+
+module_param(io, int, S_IRUGO);
+MODULE_PARM_DESC(io, "I/O address base (0x3bc, 0x378 or 0x278)");
+
+module_param(irq, int, S_IRUGO);
+MODULE_PARM_DESC(irq, "Interrupt (7 or 5)");
+
+module_param(tx_mask, int, S_IRUGO);
+MODULE_PARM_DESC(tx_maxk, "Transmitter mask (default: 0x01)");
+
+module_param(debug, bool, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(debug, "Enable debugging messages");
+
+module_param(check_pselecd, bool, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(debug, "Check for printer (default: 0)");
+EXPORT_NO_SYMBOLS;
+#endif /* MODULE */
--- linux-rt-2.6.31.orig/ubuntu/lirc/lirc_serial/Makefile
+++ linux-rt-2.6.31/ubuntu/lirc/lirc_serial/Makefile
@@ -0,0 +1,3 @@
+EXTRA_CFLAGS =-DIRCTL_DEV_MAJOR=61 -DLIRC_SERIAL_TRANSMITTER -DLIRC_SERIAL_SOFTCARRIER -I$(src)/..
+
+obj-$(CONFIG_LIRC_SERIAL)	+= lirc_serial.o
--- linux-rt-2.6.31.orig/ubuntu/lirc/lirc_serial/lirc_serial.c
+++ linux-rt-2.6.31/ubuntu/lirc/lirc_serial/lirc_serial.c
@@ -0,0 +1,1422 @@
+/*      $Id: lirc_serial.c,v 5.104 2009/03/15 09:34:00 lirc Exp $      */
+/*
+ * lirc_serial.c
+ *
+ * lirc_serial - Device driver that records pulse- and pause-lengths
+ *	       (space-lengths) between DDCD event on a serial port.
+ *
+ * Copyright (C) 1996,97 Ralph Metzler <rjkm@thp.uni-koeln.de>
+ * Copyright (C) 1998 Trent Piepho <xyzzy@u.washington.edu>
+ * Copyright (C) 1998 Ben Pfaff <blp@gnu.org>
+ * Copyright (C) 1999 Christoph Bartelmus <lirc@bartelmus.de>
+ * Copyright (C) 2007 Andrei Tanas <andrei@tanas.ca> (suspend/resume support)
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *
+ */
+
+/*
+ * Steve's changes to improve transmission fidelity:
+ *   - for systems with the rdtsc instruction and the clock counter, a
+ *     send_pule that times the pulses directly using the counter.
+ *     This means that the LIRC_SERIAL_TRANSMITTER_LATENCY fudge is
+ *     not needed. Measurement shows very stable waveform, even where
+ *     PCI activity slows the access to the UART, which trips up other
+ *     versions.
+ *   - For other system, non-integer-microsecond pulse/space lengths,
+ *     done using fixed point binary. So, much more accurate carrier
+ *     frequency.
+ *   - fine tuned transmitter latency, taking advantage of fractional
+ *     microseconds in previous change
+ *   - Fixed bug in the way transmitter latency was accounted for by
+ *     tuning the pulse lengths down - the send_pulse routine ignored
+ *     this overhead as it timed the overall pulse length - so the
+ *     pulse frequency was right but overall pulse length was too
+ *     long. Fixed by accounting for latency on each pulse/space
+ *     iteration.
+ *
+ * Steve Davies <steve@daviesfam.org>  July 2001
+ */
+
+#ifdef HAVE_CONFIG_H
+# include <config.h>
+#endif
+
+#include <linux/version.h>
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 2, 18)
+#error "**********************************************************"
+#error " Sorry, this driver needs kernel version 2.2.18 or higher "
+#error "**********************************************************"
+#endif
+
+#include <linux/autoconf.h>
+
+#include <linux/module.h>
+#include <linux/errno.h>
+#include <linux/signal.h>
+#include <linux/sched.h>
+#include <linux/fs.h>
+#include <linux/interrupt.h>
+#include <linux/ioport.h>
+#include <linux/kernel.h>
+#include <linux/major.h>
+#include <linux/serial_reg.h>
+#include <linux/time.h>
+#include <linux/string.h>
+#include <linux/types.h>
+#include <linux/wait.h>
+#include <linux/mm.h>
+#include <linux/delay.h>
+#include <linux/poll.h>
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 18)
+#include <linux/platform_device.h>
+#endif
+
+#include <asm/system.h>
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 18)
+#include <asm/uaccess.h>
+#else
+#include <linux/uaccess.h>
+#endif
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 16)
+#include <asm/io.h>
+#else
+#include <linux/io.h>
+#endif
+#include <linux/irq.h>
+#include <linux/fcntl.h>
+
+#if defined(LIRC_SERIAL_NSLU2)
+#include <asm/hardware.h>
+/* From Intel IXP42X Developer's Manual (#252480-005): */
+/* ftp://download.intel.com/design/network/manuals/25248005.pdf */
+#define UART_IE_IXP42X_UUE   0x40 /* IXP42X UART Unit enable */
+#define UART_IE_IXP42X_RTOIE 0x10 /* IXP42X Receiver Data Timeout int.enable */
+#ifndef NSLU2_LED_GRN_GPIO
+/* added in 2.6.22 */
+#define NSLU2_LED_GRN_GPIO NSLU2_LED_GRN
+#endif
+#endif
+
+#include "../lirc.h"
+#include "../kcompat.h"
+#include "../lirc_dev/lirc_dev.h"
+
+#if defined(LIRC_SERIAL_SOFTCARRIER) && !defined(LIRC_SERIAL_TRANSMITTER)
+#warning "Software carrier only affects transmitting"
+#endif
+
+#if defined(rdtscl)
+
+#define USE_RDTSC
+#warning "Note: using rdtsc instruction"
+#endif
+
+#ifdef LIRC_SERIAL_ANIMAX
+#ifdef LIRC_SERIAL_TRANSMITTER
+#warning "******************************************"
+#warning " This receiver does not have a	    "
+#warning " transmitter diode			"
+#warning "******************************************"
+#endif
+#endif
+
+#define LIRC_DRIVER_VERSION "$Revision: 5.104 $"
+#define LIRC_DRIVER_NAME "lirc_serial"
+
+struct lirc_serial {
+	int signal_pin;
+	int signal_pin_change;
+	int on;
+	int off;
+	long (*send_pulse)(unsigned long length);
+	void (*send_space)(long length);
+	int features;
+};
+
+#define LIRC_HOMEBREW		0
+#define LIRC_IRDEO		1
+#define LIRC_IRDEO_REMOTE	2
+#define LIRC_ANIMAX		3
+#define LIRC_IGOR		4
+#define LIRC_NSLU2		5
+
+#ifdef LIRC_SERIAL_IRDEO
+static int type = LIRC_IRDEO;
+#elif defined(LIRC_SERIAL_IRDEO_REMOTE)
+static int type = LIRC_IRDEO_REMOTE;
+#elif defined(LIRC_SERIAL_ANIMAX)
+static int type = LIRC_ANIMAX;
+#elif defined(LIRC_SERIAL_IGOR)
+static int type = LIRC_IGOR;
+#elif defined(LIRC_SERIAL_NSLU2)
+static int type = LIRC_NSLU2;
+#else
+static int type = LIRC_HOMEBREW;
+#endif
+
+/* Set defaults for NSLU2 */
+#if defined(LIRC_SERIAL_NSLU2)
+#ifndef LIRC_IRQ
+#define LIRC_IRQ IRQ_IXP4XX_UART2
+#endif
+#ifndef LIRC_PORT
+#define LIRC_PORT (IXP4XX_UART2_BASE_VIRT + REG_OFFSET)
+#endif
+#ifndef LIRC_IOMMAP
+#define LIRC_IOMMAP IXP4XX_UART2_BASE_PHYS
+#endif
+#ifndef LIRC_IOSHIFT
+#define LIRC_IOSHIFT 2
+#endif
+#ifndef LIRC_ALLOW_MMAPPED_IO
+#define LIRC_ALLOW_MMAPPED_IO
+#endif
+#endif
+
+#if defined(LIRC_ALLOW_MMAPPED_IO)
+#ifndef LIRC_IOMMAP
+#define LIRC_IOMMAP 0
+#endif
+#ifndef LIRC_IOSHIFT
+#define LIRC_IOSHIFT 0
+#endif
+static int iommap = LIRC_IOMMAP;
+static int ioshift = LIRC_IOSHIFT;
+#endif
+
+#ifdef LIRC_SERIAL_SOFTCARRIER
+static int softcarrier = 1;
+#else
+static int softcarrier;
+#endif
+
+static int share_irq;
+static int debug;
+
+#define dprintk(fmt, args...)					\
+	do {							\
+		if (debug)					\
+			printk(KERN_DEBUG LIRC_DRIVER_NAME ": "	\
+			       fmt, ## args);			\
+	} while (0)
+
+/* forward declarations */
+static long send_pulse_irdeo(unsigned long length);
+static long send_pulse_homebrew(unsigned long length);
+static void send_space_irdeo(long length);
+static void send_space_homebrew(long length);
+
+static struct lirc_serial hardware[] = {
+	[LIRC_HOMEBREW] = {
+		.signal_pin        = UART_MSR_DCD,
+		.signal_pin_change = UART_MSR_DDCD,
+		.on  = (UART_MCR_RTS | UART_MCR_OUT2 | UART_MCR_DTR),
+		.off = (UART_MCR_RTS | UART_MCR_OUT2),
+		.send_pulse = send_pulse_homebrew,
+		.send_space = send_space_homebrew,
+#ifdef LIRC_SERIAL_TRANSMITTER
+		.features    = (LIRC_CAN_SET_SEND_DUTY_CYCLE |
+				LIRC_CAN_SET_SEND_CARRIER |
+				LIRC_CAN_SEND_PULSE | LIRC_CAN_REC_MODE2)
+#else
+		.features    = LIRC_CAN_REC_MODE2
+#endif
+	},
+
+	[LIRC_IRDEO] = {
+		.signal_pin        = UART_MSR_DSR,
+		.signal_pin_change = UART_MSR_DDSR,
+		.on  = UART_MCR_OUT2,
+		.off = (UART_MCR_RTS | UART_MCR_DTR | UART_MCR_OUT2),
+		.send_pulse  = send_pulse_irdeo,
+		.send_space  = send_space_irdeo,
+		.features    = (LIRC_CAN_SET_SEND_DUTY_CYCLE |
+				LIRC_CAN_SEND_PULSE | LIRC_CAN_REC_MODE2)
+	},
+
+	[LIRC_IRDEO_REMOTE] = {
+		.signal_pin        = UART_MSR_DSR,
+		.signal_pin_change = UART_MSR_DDSR,
+		.on  = (UART_MCR_RTS | UART_MCR_DTR | UART_MCR_OUT2),
+		.off = (UART_MCR_RTS | UART_MCR_DTR | UART_MCR_OUT2),
+		.send_pulse  = send_pulse_irdeo,
+		.send_space  = send_space_irdeo,
+		.features    = (LIRC_CAN_SET_SEND_DUTY_CYCLE |
+				LIRC_CAN_SEND_PULSE | LIRC_CAN_REC_MODE2)
+	},
+
+	[LIRC_ANIMAX] = {
+		.signal_pin        = UART_MSR_DCD,
+		.signal_pin_change = UART_MSR_DDCD,
+		.on  = 0,
+		.off = (UART_MCR_RTS | UART_MCR_DTR | UART_MCR_OUT2),
+		.send_pulse = NULL,
+		.send_space = NULL,
+		.features   = LIRC_CAN_REC_MODE2
+	},
+
+	[LIRC_IGOR] = {
+		.signal_pin        = UART_MSR_DSR,
+		.signal_pin_change = UART_MSR_DDSR,
+		.on  = (UART_MCR_RTS | UART_MCR_OUT2 | UART_MCR_DTR),
+		.off = (UART_MCR_RTS | UART_MCR_OUT2),
+		.send_pulse = send_pulse_homebrew,
+		.send_space = send_space_homebrew,
+#ifdef LIRC_SERIAL_TRANSMITTER
+		.features    = (LIRC_CAN_SET_SEND_DUTY_CYCLE |
+				LIRC_CAN_SET_SEND_CARRIER |
+				LIRC_CAN_SEND_PULSE | LIRC_CAN_REC_MODE2)
+#else
+		.features    = LIRC_CAN_REC_MODE2
+#endif
+	},
+
+#if defined(LIRC_SERIAL_NSLU2)
+	/*
+	 * Modified Linksys Network Storage Link USB 2.0 (NSLU2):
+	 * We receive on CTS of the 2nd serial port (R142,LHS), we
+	 * transmit with a IR diode between GPIO[1] (green status LED),
+	 * and ground (Matthias Goebl <matthias.goebl@goebl.net>).
+	 * See also http://www.nslu2-linux.org for this device
+	 */
+	[LIRC_NSLU2] = {
+		.signal_pin        = UART_MSR_CTS,
+		.signal_pin_change = UART_MSR_DCTS,
+		.on  = (UART_MCR_RTS | UART_MCR_OUT2 | UART_MCR_DTR),
+		.off = (UART_MCR_RTS | UART_MCR_OUT2),
+		.send_pulse = send_pulse_homebrew,
+		.send_space = send_space_homebrew,
+#ifdef LIRC_SERIAL_TRANSMITTER
+		.features    = (LIRC_CAN_SET_SEND_DUTY_CYCLE |
+				LIRC_CAN_SET_SEND_CARRIER |
+				LIRC_CAN_SEND_PULSE | LIRC_CAN_REC_MODE2)
+#else
+		.features    = LIRC_CAN_REC_MODE2
+#endif
+	},
+#endif
+
+};
+
+#define RS_ISR_PASS_LIMIT 256
+
+/*
+ * A long pulse code from a remote might take up to 300 bytes.  The
+ * daemon should read the bytes as soon as they are generated, so take
+ * the number of keys you think you can push before the daemon runs
+ * and multiply by 300.  The driver will warn you if you overrun this
+ * buffer.  If you have a slow computer or non-busmastering IDE disks,
+ * maybe you will need to increase this.
+ */
+
+/* This MUST be a power of two!  It has to be larger than 1 as well. */
+
+#define RBUF_LEN 256
+#define WBUF_LEN 256
+
+static int sense = -1;	/* -1 = auto, 0 = active high, 1 = active low */
+static int txsense;     /* 0 = active high, 1 = active low */
+
+#ifndef LIRC_IRQ
+#define LIRC_IRQ 4
+#endif
+#ifndef LIRC_PORT
+#define LIRC_PORT 0x3f8
+#endif
+
+static int io = LIRC_PORT;
+static int irq = LIRC_IRQ;
+
+static struct timeval lasttv = {0, 0};
+
+static struct lirc_buffer rbuf;
+
+static lirc_t wbuf[WBUF_LEN];
+
+static unsigned int freq = 38000;
+static unsigned int duty_cycle = 50;
+
+/* Initialized in init_timing_params() */
+static unsigned long period;
+static unsigned long pulse_width;
+static unsigned long space_width;
+
+#if defined(__i386__)
+/*
+ * From:
+ * Linux I/O port programming mini-HOWTO
+ * Author: Riku Saikkonen <Riku.Saikkonen@hut.fi>
+ * v, 28 December 1997
+ *
+ * [...]
+ * Actually, a port I/O instruction on most ports in the 0-0x3ff range
+ * takes almost exactly 1 microsecond, so if you're, for example, using
+ * the parallel port directly, just do additional inb()s from that port
+ * to delay.
+ * [...]
+ */
+/* transmitter latency 1.5625us 0x1.90 - this figure arrived at from
+ * comment above plus trimming to match actual measured frequency.
+ * This will be sensitive to cpu speed, though hopefully most of the 1.5us
+ * is spent in the uart access.  Still - for reference test machine was a
+ * 1.13GHz Athlon system - Steve
+ */
+
+/*
+ * changed from 400 to 450 as this works better on slower machines;
+ * faster machines will use the rdtsc code anyway
+ */
+#define LIRC_SERIAL_TRANSMITTER_LATENCY 450
+
+#else
+
+/* does anybody have information on other platforms ? */
+/* 256 = 1<<8 */
+#define LIRC_SERIAL_TRANSMITTER_LATENCY 256
+
+#endif  /* __i386__ */
+
+static unsigned int sinp(int offset)
+{
+#if defined(LIRC_ALLOW_MMAPPED_IO)
+	if (iommap != 0) {
+		/* the register is memory-mapped */
+		offset <<= ioshift;
+		return readb(io + offset);
+	}
+#endif
+	return inb(io + offset);
+}
+
+static void soutp(int offset, int value)
+{
+#if defined(LIRC_ALLOW_MMAPPED_IO)
+	if (iommap != 0) {
+		/* the register is memory-mapped */
+		offset <<= ioshift;
+		writeb(value, io + offset);
+	}
+#endif
+	outb(value, io + offset);
+}
+
+static void on(void)
+{
+#if defined(LIRC_SERIAL_NSLU2)
+	/*
+	 * On NSLU2, we put the transmit diode between the output of the green
+	 * status LED and ground
+	 */
+	if (type == LIRC_NSLU2) {
+		gpio_line_set(NSLU2_LED_GRN_GPIO, IXP4XX_GPIO_LOW);
+		return;
+	}
+#endif
+	if (txsense)
+		soutp(UART_MCR, hardware[type].off);
+	else
+		soutp(UART_MCR, hardware[type].on);
+}
+
+static void off(void)
+{
+#if defined(LIRC_SERIAL_NSLU2)
+	if (type == LIRC_NSLU2) {
+		gpio_line_set(NSLU2_LED_GRN_GPIO, IXP4XX_GPIO_HIGH);
+		return;
+	}
+#endif
+	if (txsense)
+		soutp(UART_MCR, hardware[type].on);
+	else
+		soutp(UART_MCR, hardware[type].off);
+}
+
+#ifndef MAX_UDELAY_MS
+#define MAX_UDELAY_US 5000
+#else
+#define MAX_UDELAY_US (MAX_UDELAY_MS*1000)
+#endif
+
+static void safe_udelay(unsigned long usecs)
+{
+	while (usecs > MAX_UDELAY_US) {
+		udelay(MAX_UDELAY_US);
+		usecs -= MAX_UDELAY_US;
+	}
+	udelay(usecs);
+}
+
+#ifdef USE_RDTSC
+/*
+ * This is an overflow/precision juggle, complicated in that we can't
+ * do long long divide in the kernel
+ */
+
+/*
+ * When we use the rdtsc instruction to measure clocks, we keep the
+ * pulse and space widths as clock cycles.  As this is CPU speed
+ * dependent, the widths must be calculated in init_port and ioctl
+ * time
+ */
+
+/* So send_pulse can quickly convert microseconds to clocks */
+static unsigned long conv_us_to_clocks;
+
+static int init_timing_params(unsigned int new_duty_cycle,
+		unsigned int new_freq)
+{
+	unsigned long long loops_per_sec, work;
+
+	duty_cycle = new_duty_cycle;
+	freq = new_freq;
+
+	loops_per_sec = current_cpu_data.loops_per_jiffy;
+	loops_per_sec *= HZ;
+
+	/* How many clocks in a microsecond?, avoiding long long divide */
+	work = loops_per_sec;
+	work *= 4295;  /* 4295 = 2^32 / 1e6 */
+	conv_us_to_clocks = (work >> 32);
+
+	/*
+	 * Carrier period in clocks, approach good up to 32GHz clock,
+	 * gets carrier frequency within 8Hz
+	 */
+	period = loops_per_sec >> 3;
+	period /= (freq >> 3);
+
+	/* Derive pulse and space from the period */
+	pulse_width = period * duty_cycle / 100;
+	space_width = period - pulse_width;
+	dprintk("in init_timing_params, freq=%d, duty_cycle=%d, "
+		"clk/jiffy=%ld, pulse=%ld, space=%ld, "
+		"conv_us_to_clocks=%ld\n",
+		freq, duty_cycle, current_cpu_data.loops_per_jiffy,
+		pulse_width, space_width, conv_us_to_clocks);
+	return 0;
+}
+#else /* ! USE_RDTSC */
+static int init_timing_params(unsigned int new_duty_cycle,
+		unsigned int new_freq)
+{
+/*
+ * period, pulse/space width are kept with 8 binary places -
+ * IE multiplied by 256.
+ */
+	if (256 * 1000000L / new_freq * new_duty_cycle / 100 <=
+	    LIRC_SERIAL_TRANSMITTER_LATENCY)
+		return -EINVAL;
+	if (256 * 1000000L / new_freq * (100 - new_duty_cycle) / 100 <=
+	    LIRC_SERIAL_TRANSMITTER_LATENCY)
+		return -EINVAL;
+	duty_cycle = new_duty_cycle;
+	freq = new_freq;
+	period = 256 * 1000000L / freq;
+	pulse_width = period * duty_cycle / 100;
+	space_width = period - pulse_width;
+	dprintk("in init_timing_params, freq=%d pulse=%ld, "
+		"space=%ld\n", freq, pulse_width, space_width);
+	return 0;
+}
+#endif /* USE_RDTSC */
+
+
+/* return value: space length delta */
+
+static long send_pulse_irdeo(unsigned long length)
+{
+	long rawbits, ret;
+	int i;
+	unsigned char output;
+	unsigned char chunk, shifted;
+
+	/* how many bits have to be sent ? */
+	rawbits = length * 1152 / 10000;
+	if (duty_cycle > 50)
+		chunk = 3;
+	else
+		chunk = 1;
+	for (i = 0, output = 0x7f; rawbits > 0; rawbits -= 3) {
+		shifted = chunk << (i * 3);
+		shifted >>= 1;
+		output &= (~shifted);
+		i++;
+		if (i == 3) {
+			soutp(UART_TX, output);
+			while (!(sinp(UART_LSR) & UART_LSR_THRE))
+				;
+			output = 0x7f;
+			i = 0;
+		}
+	}
+	if (i != 0) {
+		soutp(UART_TX, output);
+		while (!(sinp(UART_LSR) & UART_LSR_TEMT))
+			;
+	}
+
+	if (i == 0)
+		ret = (-rawbits) * 10000 / 1152;
+	else
+		ret = (3 - i) * 3 *10000 / 1152 + (-rawbits) * 10000 / 1152;
+
+	return ret;
+}
+
+#ifdef USE_RDTSC
+/* Version that uses Pentium rdtsc instruction to measure clocks */
+
+/*
+ * This version does sub-microsecond timing using rdtsc instruction,
+ * and does away with the fudged LIRC_SERIAL_TRANSMITTER_LATENCY
+ * Implicitly i586 architecture...  - Steve
+ */
+
+static long send_pulse_homebrew_softcarrier(unsigned long length)
+{
+	int flag;
+	unsigned long target, start, now;
+
+	/* Get going quick as we can */
+	rdtscl(start);
+	on();
+	/* Convert length from microseconds to clocks */
+	length *= conv_us_to_clocks;
+	/* And loop till time is up - flipping at right intervals */
+	now = start;
+	target = pulse_width;
+	flag = 1;
+	while ((now - start) < length) {
+		/* Delay till flip time */
+		do {
+			rdtscl(now);
+		} while ((now - start) < target);
+
+		/* flip */
+		if (flag) {
+			rdtscl(now);
+			off();
+			target += space_width;
+		} else {
+			rdtscl(now); on();
+			target += pulse_width;
+		}
+		flag = !flag;
+	}
+	rdtscl(now);
+	return ((now - start) - length) / conv_us_to_clocks;
+}
+#else /* ! USE_RDTSC */
+/* Version using udelay() */
+
+/*
+ * here we use fixed point arithmetic, with 8
+ * fractional bits.  that gets us within 0.1% or so of the right average
+ * frequency, albeit with some jitter in pulse length - Steve
+ */
+
+/* To match 8 fractional bits used for pulse/space length */
+
+static long send_pulse_homebrew_softcarrier(unsigned long length)
+{
+	int flag;
+	unsigned long actual, target, d;
+	length <<= 8;
+
+	actual = 0; target = 0; flag = 0;
+	while (actual < length) {
+		if (flag) {
+			off();
+			target += space_width;
+		} else {
+			on();
+			target += pulse_width;
+		}
+		d = (target - actual -
+		     LIRC_SERIAL_TRANSMITTER_LATENCY + 128) >> 8;
+		/*
+		 * Note - we've checked in ioctl that the pulse/space
+		 * widths are big enough so that d is > 0
+		 */
+		udelay(d);
+		actual += (d << 8) + LIRC_SERIAL_TRANSMITTER_LATENCY;
+		flag = !flag;
+	}
+	return (actual-length) >> 8;
+}
+#endif /* USE_RDTSC */
+
+static long send_pulse_homebrew(unsigned long length)
+{
+	if (length <= 0)
+		return 0;
+
+	if (softcarrier)
+		return send_pulse_homebrew_softcarrier(length);
+	else {
+		on();
+		safe_udelay(length);
+		return 0;
+	}
+}
+
+static void send_space_irdeo(long length)
+{
+	if (length <= 0)
+		return;
+
+	safe_udelay(length);
+}
+
+static void send_space_homebrew(long length)
+{
+	off();
+	if (length <= 0)
+		return;
+	safe_udelay(length);
+}
+
+static void rbwrite(lirc_t l)
+{
+	if (lirc_buffer_full(&rbuf)) {
+		/* no new signals will be accepted */
+		dprintk("Buffer overrun\n");
+		return;
+	}
+	lirc_buffer_write(&rbuf, (void *)&l);
+}
+
+static void frbwrite(lirc_t l)
+{
+	/* simple noise filter */
+	static lirc_t pulse = 0L, space = 0L;
+	static unsigned int ptr;
+
+	if (ptr > 0 && (l & PULSE_BIT)) {
+		pulse += l & PULSE_MASK;
+		if (pulse > 250) {
+			rbwrite(space);
+			rbwrite(pulse | PULSE_BIT);
+			ptr = 0;
+			pulse = 0;
+		}
+		return;
+	}
+	if (!(l & PULSE_BIT)) {
+		if (ptr == 0) {
+			if (l > 20000) {
+				space = l;
+				ptr++;
+				return;
+			}
+		} else {
+			if (l > 20000) {
+				space += pulse;
+				if (space > PULSE_MASK)
+					space = PULSE_MASK;
+				space += l;
+				if (space > PULSE_MASK)
+					space = PULSE_MASK;
+				pulse = 0;
+				return;
+			}
+			rbwrite(space);
+			rbwrite(pulse | PULSE_BIT);
+			ptr = 0;
+			pulse = 0;
+		}
+	}
+	rbwrite(l);
+}
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 19)
+static irqreturn_t irq_handler(int i, void *blah)
+#else
+static irqreturn_t irq_handler(int i, void *blah, struct pt_regs *regs)
+#endif
+{
+	struct timeval tv;
+	int status, counter, dcd;
+	long deltv;
+	lirc_t data;
+	static int last_dcd = -1;
+
+	if ((sinp(UART_IIR) & UART_IIR_NO_INT)) {
+		/* not our interrupt */
+		return IRQ_RETVAL(IRQ_NONE);
+	}
+
+	counter = 0;
+	do {
+		counter++;
+		status = sinp(UART_MSR);
+		if (counter > RS_ISR_PASS_LIMIT) {
+			printk(KERN_WARNING LIRC_DRIVER_NAME ": AIEEEE: "
+			       "We're caught!\n");
+			break;
+		}
+		if ((status & hardware[type].signal_pin_change)
+		    && sense != -1) {
+			/* get current time */
+			do_gettimeofday(&tv);
+
+			/* New mode, written by Trent Piepho
+			   <xyzzy@u.washington.edu>. */
+
+			/*
+			 * The old format was not very portable.
+			 * We now use an int to pass pulses
+			 * and spaces to user space.
+			 *
+			 * If PULSE_BIT is set a pulse has been
+			 * received, otherwise a space has been
+			 * received.  The driver needs to know if your
+			 * receiver is active high or active low, or
+			 * the space/pulse sense could be
+			 * inverted. The bits denoted by PULSE_MASK are
+			 * the length in microseconds. Lengths greater
+			 * than or equal to 16 seconds are clamped to
+			 * PULSE_MASK.  All other bits are unused.
+			 * This is a much simpler interface for user
+			 * programs, as well as eliminating "out of
+			 * phase" errors with space/pulse
+			 * autodetection.
+			 */
+
+			/* calc time since last interrupt in microseconds */
+			dcd = (status & hardware[type].signal_pin) ? 1 : 0;
+
+			if (dcd == last_dcd) {
+				printk(KERN_WARNING LIRC_DRIVER_NAME
+				": ignoring spike: %d %d %lx %lx %lx %lx\n",
+				dcd, sense,
+				tv.tv_sec, lasttv.tv_sec,
+				tv.tv_usec, lasttv.tv_usec);
+				continue;
+			}
+
+			deltv = tv.tv_sec-lasttv.tv_sec;
+			if (tv.tv_sec < lasttv.tv_sec ||
+			    (tv.tv_sec == lasttv.tv_sec &&
+			     tv.tv_usec < lasttv.tv_usec)) {
+				printk(KERN_WARNING LIRC_DRIVER_NAME
+				       ": AIEEEE: your clock just jumped "
+				       "backwards\n");
+				printk(KERN_WARNING LIRC_DRIVER_NAME
+				       ": %d %d %lx %lx %lx %lx\n",
+				       dcd, sense,
+				       tv.tv_sec, lasttv.tv_sec,
+				       tv.tv_usec, lasttv.tv_usec);
+				data = PULSE_MASK;
+			} else if (deltv > 15) {
+				data = PULSE_MASK; /* really long time */
+				if (!(dcd^sense)) {
+					/* sanity check */
+					printk(KERN_WARNING LIRC_DRIVER_NAME
+					       ": AIEEEE: "
+					       "%d %d %lx %lx %lx %lx\n",
+					       dcd, sense,
+					       tv.tv_sec, lasttv.tv_sec,
+					       tv.tv_usec, lasttv.tv_usec);
+					/*
+					 * detecting pulse while this
+					 * MUST be a space!
+					 */
+					sense = sense ? 0 : 1;
+				}
+			} else
+				data = (lirc_t) (deltv*1000000 +
+					       tv.tv_usec -
+					       lasttv.tv_usec);
+			frbwrite(dcd^sense ? data : (data|PULSE_BIT));
+			lasttv = tv;
+			last_dcd = dcd;
+			wake_up_interruptible(&rbuf.wait_poll);
+		}
+	} while (!(sinp(UART_IIR) & UART_IIR_NO_INT)); /* still pending ? */
+	return IRQ_RETVAL(IRQ_HANDLED);
+}
+
+static void hardware_init_port(void)
+{
+	unsigned long flags;
+	local_irq_save(flags);
+
+	/* Set DLAB 0. */
+	soutp(UART_LCR, sinp(UART_LCR) & (~UART_LCR_DLAB));
+
+	/* First of all, disable all interrupts */
+	soutp(UART_IER, sinp(UART_IER) &
+	      (~(UART_IER_MSI|UART_IER_RLSI|UART_IER_THRI|UART_IER_RDI)));
+
+	/* Clear registers. */
+	sinp(UART_LSR);
+	sinp(UART_RX);
+	sinp(UART_IIR);
+	sinp(UART_MSR);
+
+#if defined(LIRC_SERIAL_NSLU2)
+	if (type == LIRC_NSLU2) {
+		/* Setup NSLU2 UART */
+
+		/* Enable UART */
+		soutp(UART_IER, sinp(UART_IER) | UART_IE_IXP42X_UUE);
+		/* Disable Receiver data Time out interrupt */
+		soutp(UART_IER, sinp(UART_IER) & ~UART_IE_IXP42X_RTOIE);
+		/* set out2 = interrupt unmask; off() doesn't set MCR
+		   on NSLU2 */
+		soutp(UART_MCR, UART_MCR_RTS|UART_MCR_OUT2);
+	}
+#endif
+
+	/* Set line for power source */
+	off();
+
+	/* Clear registers again to be sure. */
+	sinp(UART_LSR);
+	sinp(UART_RX);
+	sinp(UART_IIR);
+	sinp(UART_MSR);
+
+	switch (type) {
+	case LIRC_IRDEO:
+	case LIRC_IRDEO_REMOTE:
+		/* setup port to 7N1 @ 115200 Baud */
+		/* 7N1+start = 9 bits at 115200 ~ 3 bits at 38kHz */
+
+		/* Set DLAB 1. */
+		soutp(UART_LCR, sinp(UART_LCR) | UART_LCR_DLAB);
+		/* Set divisor to 1 => 115200 Baud */
+		soutp(UART_DLM, 0);
+		soutp(UART_DLL, 1);
+		/* Set DLAB 0 +  7N1 */
+		soutp(UART_LCR, UART_LCR_WLEN7);
+		/* THR interrupt already disabled at this point */
+		break;
+	default:
+		break;
+	}
+
+	local_irq_restore(flags);
+}
+
+static int init_port(void)
+{
+	int i, nlow, nhigh;
+
+	/* Reserve io region. */
+#if defined(LIRC_ALLOW_MMAPPED_IO)
+	/*
+	 * Future MMAP-Developers: Attention!
+	 * For memory mapped I/O you *might* need to use ioremap() first,
+	 * for the NSLU2 it's done in boot code.
+	 */
+	if (((iommap != 0)
+	     && (request_mem_region(iommap, 8 << ioshift,
+				    LIRC_DRIVER_NAME) == NULL))
+	   || ((iommap == 0)
+	       && (request_region(io, 8, LIRC_DRIVER_NAME) == NULL))) {
+#else
+	if (request_region(io, 8, LIRC_DRIVER_NAME) == NULL) {
+#endif
+		printk(KERN_ERR  LIRC_DRIVER_NAME
+		       ": port %04x already in use\n", io);
+		printk(KERN_WARNING LIRC_DRIVER_NAME
+		       ": use 'setserial /dev/ttySX uart none'\n");
+		printk(KERN_WARNING LIRC_DRIVER_NAME
+		       ": or compile the serial port driver as module and\n");
+		printk(KERN_WARNING LIRC_DRIVER_NAME
+		       ": make sure this module is loaded first\n");
+		return -EBUSY;
+	}
+
+	hardware_init_port();
+
+	/* Initialize pulse/space widths */
+	init_timing_params(duty_cycle, freq);
+
+	/* If pin is high, then this must be an active low receiver. */
+	if (sense == -1) {
+		/* wait 1/2 sec for the power supply */
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 11)
+		msleep(500);
+#else
+		set_current_state(TASK_INTERRUPTIBLE);
+		schedule_timeout(HZ/2);
+#endif
+
+		/*
+		 * probe 9 times every 0.04s, collect "votes" for
+		 * active high/low
+		 */
+		nlow = 0;
+		nhigh = 0;
+		for (i = 0; i < 9; i++) {
+			if (sinp(UART_MSR) & hardware[type].signal_pin)
+				nlow++;
+			else
+				nhigh++;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 11)
+			msleep(40);
+#else
+			schedule_timeout(HZ/25);
+#endif
+		}
+		sense = (nlow >= nhigh ? 1 : 0);
+		printk(KERN_INFO  LIRC_DRIVER_NAME  ": auto-detected active "
+		       "%s receiver\n", sense ? "low" : "high");
+	} else
+		printk(KERN_INFO  LIRC_DRIVER_NAME  ": Manually using active "
+		       "%s receiver\n", sense ? "low" : "high");
+
+	return 0;
+}
+
+static int set_use_inc(void *data)
+{
+	int result;
+	unsigned long flags;
+
+	/* Init read buffer. */
+	if (lirc_buffer_init(&rbuf, sizeof(lirc_t), RBUF_LEN) < 0)
+		return -ENOMEM;
+
+	/* initialize timestamp */
+	do_gettimeofday(&lasttv);
+
+	result = request_irq(irq, irq_handler,
+			     IRQF_DISABLED | (share_irq ? IRQF_SHARED : 0),
+			     LIRC_DRIVER_NAME, (void *)&hardware);
+
+	switch (result) {
+	case -EBUSY:
+		printk(KERN_ERR LIRC_DRIVER_NAME ": IRQ %d busy\n", irq);
+		lirc_buffer_free(&rbuf);
+		return -EBUSY;
+	case -EINVAL:
+		printk(KERN_ERR LIRC_DRIVER_NAME
+		       ": Bad irq number or handler\n");
+		lirc_buffer_free(&rbuf);
+		return -EINVAL;
+	default:
+		dprintk("Interrupt %d, port %04x obtained\n", irq, io);
+		break;
+	};
+
+	local_irq_save(flags);
+
+	/* Set DLAB 0. */
+	soutp(UART_LCR, sinp(UART_LCR) & (~UART_LCR_DLAB));
+
+	soutp(UART_IER, sinp(UART_IER)|UART_IER_MSI);
+
+	local_irq_restore(flags);
+
+	MOD_INC_USE_COUNT;
+	return 0;
+}
+
+static void set_use_dec(void *data)
+{	unsigned long flags;
+
+	local_irq_save(flags);
+
+	/* Set DLAB 0. */
+	soutp(UART_LCR, sinp(UART_LCR) & (~UART_LCR_DLAB));
+
+	/* First of all, disable all interrupts */
+	soutp(UART_IER, sinp(UART_IER) &
+	      (~(UART_IER_MSI|UART_IER_RLSI|UART_IER_THRI|UART_IER_RDI)));
+	local_irq_restore(flags);
+
+	free_irq(irq, (void *)&hardware);
+
+	dprintk("freed IRQ %d\n", irq);
+	lirc_buffer_free(&rbuf);
+
+	MOD_DEC_USE_COUNT;
+}
+
+static ssize_t lirc_write(struct file *file, const char *buf,
+			 size_t n, loff_t *ppos)
+{
+	int i, count;
+	unsigned long flags;
+	long delta = 0;
+
+	if (!(hardware[type].features&LIRC_CAN_SEND_PULSE))
+		return -EBADF;
+
+	if (n % sizeof(lirc_t))
+		return -EINVAL;
+	count = n / sizeof(lirc_t);
+	if (count > WBUF_LEN || count % 2 == 0)
+		return -EINVAL;
+	if (copy_from_user(wbuf, buf, n))
+		return -EFAULT;
+	local_irq_save(flags);
+	if (type == LIRC_IRDEO) {
+		/* DTR, RTS down */
+		on();
+	}
+	for (i = 0; i < count; i++) {
+		if (i%2)
+			hardware[type].send_space(wbuf[i]-delta);
+		else
+			delta = hardware[type].send_pulse(wbuf[i]);
+	}
+	off();
+	local_irq_restore(flags);
+	return n;
+}
+
+static int lirc_ioctl(struct inode *node, struct file *filep, unsigned int cmd,
+		      unsigned long arg)
+{
+	int result;
+	unsigned long value;
+	unsigned int ivalue;
+
+	switch (cmd) {
+	case LIRC_GET_SEND_MODE:
+		if (!(hardware[type].features&LIRC_CAN_SEND_MASK))
+			return -ENOIOCTLCMD;
+
+		result = put_user(LIRC_SEND2MODE
+				  (hardware[type].features&LIRC_CAN_SEND_MASK),
+				  (unsigned long *) arg);
+		if (result)
+			return result;
+		break;
+
+	case LIRC_SET_SEND_MODE:
+		if (!(hardware[type].features&LIRC_CAN_SEND_MASK))
+			return -ENOIOCTLCMD;
+
+		result = get_user(value, (unsigned long *) arg);
+		if (result)
+			return result;
+		/* only LIRC_MODE_PULSE supported */
+		if (value != LIRC_MODE_PULSE)
+			return -ENOSYS;
+		break;
+
+	case LIRC_GET_LENGTH:
+		return -ENOSYS;
+		break;
+
+	case LIRC_SET_SEND_DUTY_CYCLE:
+		dprintk("SET_SEND_DUTY_CYCLE\n");
+		if (!(hardware[type].features&LIRC_CAN_SET_SEND_DUTY_CYCLE))
+			return -ENOIOCTLCMD;
+
+		result = get_user(ivalue, (unsigned int *) arg);
+		if (result)
+			return result;
+		if (ivalue <= 0 || ivalue > 100)
+			return -EINVAL;
+		return init_timing_params(ivalue, freq);
+		break;
+
+	case LIRC_SET_SEND_CARRIER:
+		dprintk("SET_SEND_CARRIER\n");
+		if (!(hardware[type].features&LIRC_CAN_SET_SEND_CARRIER))
+			return -ENOIOCTLCMD;
+
+		result = get_user(ivalue, (unsigned int *) arg);
+		if (result)
+			return result;
+		if (ivalue > 500000 || ivalue < 20000)
+			return -EINVAL;
+		return init_timing_params(duty_cycle, ivalue);
+		break;
+
+	default:
+		return -ENOIOCTLCMD;
+	}
+	return 0;
+}
+
+static struct file_operations lirc_fops = {
+	.owner	= THIS_MODULE,
+	.write	= lirc_write,
+	.ioctl	= lirc_ioctl,
+};
+
+static struct lirc_driver driver = {
+	.name		= LIRC_DRIVER_NAME,
+	.minor		= -1,
+	.code_length	= 1,
+	.sample_rate	= 0,
+	.data		= NULL,
+	.add_to_buf	= NULL,
+#ifndef LIRC_REMOVE_DURING_EXPORT
+	.get_queue	= NULL,
+#endif
+	.rbuf		= &rbuf,
+	.set_use_inc	= set_use_inc,
+	.set_use_dec	= set_use_dec,
+	.fops		= &lirc_fops,
+	.dev		= NULL,
+	.owner		= THIS_MODULE,
+};
+
+#ifdef MODULE
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 18)
+static struct platform_device *lirc_serial_dev;
+
+static int __devinit lirc_serial_probe(struct platform_device *dev)
+{
+	return 0;
+}
+
+static int __devexit lirc_serial_remove(struct platform_device *dev)
+{
+	return 0;
+}
+
+static int lirc_serial_suspend(struct platform_device *dev,
+			       pm_message_t state)
+{
+	/* Set DLAB 0. */
+	soutp(UART_LCR, sinp(UART_LCR) & (~UART_LCR_DLAB));
+
+	/* Disable all interrupts */
+	soutp(UART_IER, sinp(UART_IER) &
+	      (~(UART_IER_MSI|UART_IER_RLSI|UART_IER_THRI|UART_IER_RDI)));
+
+	/* Clear registers. */
+	sinp(UART_LSR);
+	sinp(UART_RX);
+	sinp(UART_IIR);
+	sinp(UART_MSR);
+
+	return 0;
+}
+
+static int lirc_serial_resume(struct platform_device *dev)
+{
+	unsigned long flags;
+
+	hardware_init_port();
+
+	local_irq_save(flags);
+	/* Enable Interrupt */
+	do_gettimeofday(&lasttv);
+	soutp(UART_IER, sinp(UART_IER)|UART_IER_MSI);
+	off();
+
+	lirc_buffer_clear(&rbuf);
+
+	local_irq_restore(flags);
+
+	return 0;
+}
+
+static struct platform_driver lirc_serial_driver = {
+	.probe		= lirc_serial_probe,
+	.remove		= __devexit_p(lirc_serial_remove),
+	.suspend	= lirc_serial_suspend,
+	.resume		= lirc_serial_resume,
+	.driver		= {
+		.name	= "lirc_serial",
+		.owner	= THIS_MODULE,
+	},
+};
+
+static int __init lirc_serial_init(void)
+{
+	int result;
+
+	result = platform_driver_register(&lirc_serial_driver);
+	if (result) {
+		printk("lirc register returned %d\n", result);
+		return result;
+	}
+
+	lirc_serial_dev = platform_device_alloc("lirc_serial", 0);
+	if (!lirc_serial_dev) {
+		result = -ENOMEM;
+		goto exit_driver_unregister;
+	}
+
+	result = platform_device_add(lirc_serial_dev);
+	if (result)
+		goto exit_device_put;
+
+	return 0;
+
+exit_device_put:
+	platform_device_put(lirc_serial_dev);
+exit_driver_unregister:
+	platform_driver_unregister(&lirc_serial_driver);
+	return result;
+}
+
+static void __exit lirc_serial_exit(void)
+{
+	platform_device_unregister(lirc_serial_dev);
+	platform_driver_unregister(&lirc_serial_driver);
+}
+#endif
+
+static int __init lirc_serial_init_module(void)
+{
+	int result;
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 18)
+	result = lirc_serial_init();
+	if (result)
+		return result;
+#endif
+	switch (type) {
+	case LIRC_HOMEBREW:
+	case LIRC_IRDEO:
+	case LIRC_IRDEO_REMOTE:
+	case LIRC_ANIMAX:
+	case LIRC_IGOR:
+#if defined(LIRC_SERIAL_NSLU2)
+	case LIRC_NSLU2:
+#endif
+		break;
+	default:
+		result = -EINVAL;
+		goto exit_serial_exit;
+	}
+	if (!softcarrier) {
+		switch (type) {
+		case LIRC_HOMEBREW:
+		case LIRC_IGOR:
+		case LIRC_NSLU2:
+			hardware[type].features &=
+				~(LIRC_CAN_SET_SEND_DUTY_CYCLE|
+				  LIRC_CAN_SET_SEND_CARRIER);
+			break;
+		}
+	}
+
+	result = init_port();
+	if (result < 0)
+		goto exit_serial_exit;
+	driver.features = hardware[type].features;
+	driver.minor = lirc_register_driver(&driver);
+	if (driver.minor < 0) {
+		printk(KERN_ERR  LIRC_DRIVER_NAME
+		       ": register_chrdev failed!\n");
+		result = -EIO;
+		goto exit_release;
+	}
+
+	printk(KERN_INFO
+	       LIRC_DRIVER_NAME " " LIRC_DRIVER_VERSION " registered\n");
+	dprintk("type = %d\n", type);
+	dprintk("IRQ = %d, port = %04x\n", irq, io);
+	dprintk("share_irq = %d\n", share_irq);
+#ifdef LIRC_SERIAL_TRANSMITTER
+	dprintk("txsense = %d\n", txsense);
+#endif
+	dprintk("softcarrier = %d\n", softcarrier);
+
+	return 0;
+exit_release:
+	release_region(io, 8);
+exit_serial_exit:
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 18)
+	lirc_serial_exit();
+#endif
+	return result;
+}
+
+static void __exit lirc_serial_exit_module(void)
+{
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 18)
+	lirc_serial_exit();
+#endif
+#if defined(LIRC_ALLOW_MMAPPED_IO)
+	if (iommap != 0)
+		release_mem_region(iommap, 8 << ioshift);
+	else
+		release_region(io, 8);
+#else
+	release_region(io, 8);
+#endif
+	lirc_unregister_driver(driver.minor);
+	dprintk("cleaned up module\n");
+}
+
+
+module_init(lirc_serial_init_module);
+module_exit(lirc_serial_exit_module);
+
+MODULE_DESCRIPTION("Infra-red receiver driver for serial ports.");
+MODULE_AUTHOR("Ralph Metzler, Trent Piepho, Ben Pfaff, "
+	      "Christoph Bartelmus, Andrei Tanas");
+MODULE_LICENSE("GPL");
+
+module_param(type, int, S_IRUGO);
+#if defined(LIRC_SERIAL_NSLU2)
+MODULE_PARM_DESC(type, "Hardware type (0 = home-brew, 1 = IRdeo,"
+		 " 2 = IRdeo Remote, 3 = AnimaX, 4 = IgorPlug,"
+		 " 5 = NSLU2 RX:CTS2/TX:GreenLED)");
+#else
+MODULE_PARM_DESC(type, "Hardware type (0 = home-brew, 1 = IRdeo,"
+		 " 2 = IRdeo Remote, 3 = AnimaX, 4 = IgorPlug)");
+#endif
+
+module_param(io, int, S_IRUGO);
+MODULE_PARM_DESC(io, "I/O address base (0x3f8 or 0x2f8)");
+
+#if defined(LIRC_ALLOW_MMAPPED_IO)
+/* some architectures (e.g. intel xscale) have memory mapped registers */
+module_param(iommap, bool, S_IRUGO);
+MODULE_PARM_DESC(iommap, "physical base for memory mapped I/O"
+		" (0 = no memory mapped io)");
+
+/*
+ * some architectures (e.g. intel xscale) align the 8bit serial registers
+ * on 32bit word boundaries.
+ * See linux-kernel/serial/8250.c serial_in()/out()
+ */
+module_param(ioshift, int, S_IRUGO);
+MODULE_PARM_DESC(ioshift, "shift I/O register offset (0 = no shift)");
+#endif
+
+module_param(irq, int, S_IRUGO);
+MODULE_PARM_DESC(irq, "Interrupt (4 or 3)");
+
+module_param(share_irq, bool, S_IRUGO);
+MODULE_PARM_DESC(share_irq, "Share interrupts (0 = off, 1 = on)");
+
+module_param(sense, bool, S_IRUGO);
+MODULE_PARM_DESC(sense, "Override autodetection of IR receiver circuit"
+		 " (0 = active high, 1 = active low )");
+
+#ifdef LIRC_SERIAL_TRANSMITTER
+module_param(txsense, bool, S_IRUGO);
+MODULE_PARM_DESC(txsense, "Sense of transmitter circuit"
+		 " (0 = active high, 1 = active low )");
+#endif
+
+module_param(softcarrier, bool, S_IRUGO);
+MODULE_PARM_DESC(softcarrier, "Software carrier (0 = off, 1 = on)");
+
+module_param(debug, bool, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(debug, "Enable debugging messages");
+
+EXPORT_NO_SYMBOLS;
+
+#endif /* MODULE */
--- linux-rt-2.6.31.orig/ubuntu/lirc/lirc_streamzap/lirc_streamzap.c
+++ linux-rt-2.6.31/ubuntu/lirc/lirc_streamzap/lirc_streamzap.c
@@ -0,0 +1,889 @@
+/*      $Id: lirc_streamzap.c,v 1.48 2009/03/15 09:34:00 lirc Exp $      */
+/*
+ * Streamzap Remote Control driver
+ *
+ * Copyright (c) 2005 Christoph Bartelmus <lirc@bartelmus.de>
+ *
+ * This driver was based on the work of Greg Wickham and Adrian
+ * Dewhurst. It was substantially rewritten to support correct signal
+ * gaps and now maintains a delay buffer, which is used to present
+ * consistent timing behaviour to user space applications. Without the
+ * delay buffer an ugly hack would be required in lircd, which can
+ * cause sluggish signal decoding in certain situations.
+ *
+ * This driver is based on the USB skeleton driver packaged with the
+ * kernel; copyright (C) 2001-2003 Greg Kroah-Hartman (greg@kroah.com)
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+#include <linux/version.h>
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 4, 0)
+#error "*******************************************************"
+#error "Sorry, this driver needs kernel version 2.4.0 or higher"
+#error "*******************************************************"
+#endif
+#include <linux/autoconf.h>
+#include <linux/kernel.h>
+#include <linux/errno.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/smp_lock.h>
+#include <linux/completion.h>
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 18)
+#include <asm/uaccess.h>
+#else
+#include <linux/uaccess.h>
+#endif
+#include <linux/usb.h>
+
+#include "../lirc.h"
+#include "../kcompat.h"
+#include "../lirc_dev/lirc_dev.h"
+
+#define DRIVER_VERSION	"$Revision: 1.48 $"
+#define DRIVER_NAME	"lirc_streamzap"
+#define DRIVER_DESC	"Streamzap Remote Control driver"
+
+static int debug;
+
+#define USB_STREAMZAP_VENDOR_ID		0x0e9c
+#define USB_STREAMZAP_PRODUCT_ID	0x0000
+
+/* Use our own dbg macro */
+#define dprintk(fmt, args...)					\
+	do {							\
+		if (debug)					\
+			printk(KERN_DEBUG DRIVER_NAME "[%d]: "	\
+			       fmt "\n", ## args);		\
+	} while (0)
+
+/* table of devices that work with this driver */
+static struct usb_device_id streamzap_table[] = {
+	/* Streamzap Remote Control */
+	{ USB_DEVICE(USB_STREAMZAP_VENDOR_ID, USB_STREAMZAP_PRODUCT_ID) },
+	/* Terminating entry */
+	{ }
+};
+
+MODULE_DEVICE_TABLE(usb, streamzap_table);
+
+#define STREAMZAP_PULSE_MASK 0xf0
+#define STREAMZAP_SPACE_MASK 0x0f
+#define STREAMZAP_RESOLUTION 256
+
+/* number of samples buffered */
+#define STREAMZAP_BUFFER_SIZE 128
+
+enum StreamzapDecoderState {
+	PulseSpace,
+	FullPulse,
+	FullSpace,
+	IgnorePulse
+};
+
+/* Structure to hold all of our device specific stuff
+ *
+ * some remarks regarding locking:
+ * theoretically this struct can be accessed from three threads:
+ *
+ * - from lirc_dev through set_use_inc/set_use_dec
+ *
+ * - from the USB layer throuh probe/disconnect/irq
+ *
+ *   Careful placement of lirc_register_driver/lirc_unregister_driver
+ *   calls will prevent conflicts. lirc_dev makes sure that
+ *   set_use_inc/set_use_dec are not being executed and will not be
+ *   called after lirc_unregister_driver returns.
+ *
+ * - by the timer callback
+ *
+ *   The timer is only running when the device is connected and the
+ *   LIRC device is open. Making sure the timer is deleted by
+ *   set_use_dec will make conflicts impossible.
+ */
+struct usb_streamzap {
+
+	/* usb */
+	/* save off the usb device pointer */
+	struct usb_device	*udev;
+	/* the interface for this device */
+	struct usb_interface	*interface;
+
+	/* buffer & dma */
+	unsigned char		*buf_in;
+	dma_addr_t		dma_in;
+	unsigned int		buf_in_len;
+
+	struct usb_endpoint_descriptor *endpoint;
+
+	/* IRQ */
+	struct urb		*urb_in;
+
+	/* lirc */
+	struct lirc_driver	driver;
+	struct lirc_buffer	delay_buf;
+	struct lirc_buffer	lirc_buf;
+
+	/* timer used to support delay buffering */
+	struct timer_list	delay_timer;
+	int			timer_running;
+	spinlock_t		timer_lock;
+
+	/* tracks whether we are currently receiving some signal */
+	int			idle;
+	/* sum of signal lengths received since signal start */
+	unsigned long		sum;
+	/* start time of signal; necessary for gap tracking */
+	struct timeval		signal_last;
+	struct timeval		signal_start;
+	enum StreamzapDecoderState decoder_state;
+	struct timer_list	flush_timer;
+	int			flush;
+	int			in_use;
+};
+
+
+/* local function prototypes */
+#ifdef KERNEL_2_5
+static int streamzap_probe(struct usb_interface *interface,
+			   const struct usb_device_id *id);
+static void streamzap_disconnect(struct usb_interface *interface);
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 19)
+static void usb_streamzap_irq(struct urb *urb, struct pt_regs *regs);
+#else
+static void usb_streamzap_irq(struct urb *urb);
+#endif
+#else
+static void *streamzap_probe(struct usb_device *udev, unsigned int ifnum,
+			     const struct usb_device_id *id);
+static void streamzap_disconnect(struct usb_device *dev, void *ptr);
+static void usb_streamzap_irq(struct urb *urb);
+#endif
+static int streamzap_use_inc(void *data);
+static void streamzap_use_dec(void *data);
+static int streamzap_ioctl(struct inode *node, struct file *filep,
+			   unsigned int cmd, unsigned long arg);
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0)
+static int streamzap_suspend(struct usb_interface *intf, pm_message_t message);
+static int streamzap_resume(struct usb_interface *intf);
+#endif
+
+/* usb specific object needed to register this driver with the usb subsystem */
+
+static struct usb_driver streamzap_driver = {
+	LIRC_THIS_MODULE(.owner = THIS_MODULE)
+	.name =		DRIVER_NAME,
+	.probe =	streamzap_probe,
+	.disconnect =	streamzap_disconnect,
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0)
+	.suspend =	streamzap_suspend,
+	.resume =	streamzap_resume,
+#endif
+	.id_table =	streamzap_table,
+};
+
+static void stop_timer(struct usb_streamzap *sz)
+{
+	unsigned long flags;
+
+	spin_lock_irqsave(&sz->timer_lock, flags);
+	if (sz->timer_running) {
+		sz->timer_running = 0;
+		spin_unlock_irqrestore(&sz->timer_lock, flags);
+		del_timer_sync(&sz->delay_timer);
+	} else {
+		spin_unlock_irqrestore(&sz->timer_lock, flags);
+	}
+}
+
+static void flush_timeout(unsigned long arg)
+{
+	struct usb_streamzap *sz = (struct usb_streamzap *) arg;
+
+	/* finally start accepting data */
+	sz->flush = 0;
+}
+static void delay_timeout(unsigned long arg)
+{
+	unsigned long flags;
+	/* deliver data every 10 ms */
+	static unsigned long timer_inc =
+		(10000/(1000000/HZ)) == 0 ? 1 : (10000/(1000000/HZ));
+	struct usb_streamzap *sz = (struct usb_streamzap *) arg;
+	lirc_t data;
+
+	spin_lock_irqsave(&sz->timer_lock, flags);
+
+	if (!lirc_buffer_empty(&sz->delay_buf) &&
+	    !lirc_buffer_full(&sz->lirc_buf)) {
+		lirc_buffer_read(&sz->delay_buf, (unsigned char *) &data);
+		lirc_buffer_write(&sz->lirc_buf, (unsigned char *) &data);
+	}
+	if (!lirc_buffer_empty(&sz->delay_buf)) {
+		while (lirc_buffer_available(&sz->delay_buf) <
+		      STREAMZAP_BUFFER_SIZE/2 &&
+		      !lirc_buffer_full(&sz->lirc_buf)) {
+			lirc_buffer_read(&sz->delay_buf,
+					 (unsigned char *) &data);
+			lirc_buffer_write(&sz->lirc_buf,
+					  (unsigned char *) &data);
+		}
+		if (sz->timer_running) {
+			sz->delay_timer.expires = jiffies + timer_inc;
+			add_timer(&sz->delay_timer);
+		}
+	} else {
+		sz->timer_running = 0;
+	}
+
+	if (!lirc_buffer_empty(&sz->lirc_buf))
+		wake_up(&sz->lirc_buf.wait_poll);
+
+	spin_unlock_irqrestore(&sz->timer_lock, flags);
+}
+
+static void flush_delay_buffer(struct usb_streamzap *sz)
+{
+	lirc_t data;
+	int empty = 1;
+
+	while (!lirc_buffer_empty(&sz->delay_buf)) {
+		empty = 0;
+		lirc_buffer_read(&sz->delay_buf, (unsigned char *) &data);
+		if (!lirc_buffer_full(&sz->lirc_buf)) {
+			lirc_buffer_write(&sz->lirc_buf,
+					    (unsigned char *) &data);
+		} else {
+			dprintk("buffer overflow", sz->driver.minor);
+		}
+	}
+	if (!empty)
+		wake_up(&sz->lirc_buf.wait_poll);
+}
+
+static void push(struct usb_streamzap *sz, unsigned char *data)
+{
+	unsigned long flags;
+
+	spin_lock_irqsave(&sz->timer_lock, flags);
+	if (lirc_buffer_full(&sz->delay_buf)) {
+		lirc_t data;
+
+		lirc_buffer_read(&sz->delay_buf, (unsigned char *) &data);
+		if (!lirc_buffer_full(&sz->lirc_buf)) {
+			lirc_buffer_write(&sz->lirc_buf,
+					  (unsigned char *) &data);
+		} else {
+			dprintk("buffer overflow", sz->driver.minor);
+		}
+	}
+
+	lirc_buffer_write(&sz->delay_buf, data);
+
+	if (!sz->timer_running) {
+		sz->delay_timer.expires = jiffies + HZ/10;
+		add_timer(&sz->delay_timer);
+		sz->timer_running = 1;
+	}
+
+	spin_unlock_irqrestore(&sz->timer_lock, flags);
+}
+
+static void push_full_pulse(struct usb_streamzap *sz,
+				   unsigned char value)
+{
+	lirc_t pulse;
+
+	if (sz->idle) {
+		long deltv;
+		lirc_t tmp;
+
+		sz->signal_last = sz->signal_start;
+		do_gettimeofday(&sz->signal_start);
+
+		deltv = sz->signal_start.tv_sec-sz->signal_last.tv_sec;
+		if (deltv > 15) {
+			tmp = PULSE_MASK; /* really long time */
+		} else {
+			tmp = (lirc_t) (deltv*1000000+
+					sz->signal_start.tv_usec -
+					sz->signal_last.tv_usec);
+			tmp -= sz->sum;
+		}
+		dprintk("ls %u", sz->driver.minor, tmp);
+		push(sz, (char *)&tmp);
+
+		sz->idle = 0;
+		sz->sum = 0;
+	}
+
+	pulse = ((lirc_t) value)*STREAMZAP_RESOLUTION;
+	pulse += STREAMZAP_RESOLUTION/2;
+	sz->sum += pulse;
+	pulse |= PULSE_BIT;
+
+	dprintk("p %u", sz->driver.minor, pulse&PULSE_MASK);
+	push(sz, (char *)&pulse);
+}
+
+static void push_half_pulse(struct usb_streamzap *sz,
+				   unsigned char value)
+{
+	push_full_pulse(sz, (value & STREAMZAP_PULSE_MASK)>>4);
+}
+
+static void push_full_space(struct usb_streamzap *sz,
+				   unsigned char value)
+{
+	lirc_t space;
+
+	space = ((lirc_t) value)*STREAMZAP_RESOLUTION;
+	space += STREAMZAP_RESOLUTION/2;
+	sz->sum += space;
+	dprintk("s %u", sz->driver.minor, space);
+	push(sz, (char *)&space);
+}
+
+static void push_half_space(struct usb_streamzap *sz,
+				   unsigned char value)
+{
+	push_full_space(sz, value & STREAMZAP_SPACE_MASK);
+}
+
+/**
+ * usb_streamzap_irq - IRQ handler
+ *
+ * This procedure is invoked on reception of data from
+ * the usb remote.
+ */
+#if defined(KERNEL_2_5) && LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 19)
+static void usb_streamzap_irq(struct urb *urb, struct pt_regs *regs)
+#else
+static void usb_streamzap_irq(struct urb *urb)
+#endif
+{
+	struct usb_streamzap *sz;
+	int		len;
+	unsigned int	i = 0;
+
+	if (!urb)
+		return;
+
+	sz = urb->context;
+	len = urb->actual_length;
+
+	switch (urb->status) {
+	case -ECONNRESET:
+	case -ENOENT:
+	case -ESHUTDOWN:
+		/*
+		 * this urb is terminated, clean up.
+		 * sz might already be invalid at this point
+		 */
+		dprintk("urb status: %d", -1, urb->status);
+		return;
+	default:
+		break;
+	}
+
+	dprintk("received %d", sz->driver.minor, urb->actual_length);
+	if (!sz->flush) {
+		for (i = 0; i < urb->actual_length; i++) {
+			dprintk("%d: %x", sz->driver.minor,
+				i, (unsigned char) sz->buf_in[i]);
+			switch (sz->decoder_state) {
+			case PulseSpace:
+				if ((sz->buf_in[i]&STREAMZAP_PULSE_MASK) ==
+				    STREAMZAP_PULSE_MASK) {
+					sz->decoder_state = FullPulse;
+					continue;
+				} else if ((sz->buf_in[i]&STREAMZAP_SPACE_MASK)
+					   == STREAMZAP_SPACE_MASK) {
+					push_half_pulse(sz, sz->buf_in[i]);
+					sz->decoder_state = FullSpace;
+					continue;
+				} else {
+					push_half_pulse(sz, sz->buf_in[i]);
+					push_half_space(sz, sz->buf_in[i]);
+				}
+				break;
+			case FullPulse:
+				push_full_pulse(sz, sz->buf_in[i]);
+				sz->decoder_state = IgnorePulse;
+				break;
+			case FullSpace:
+				if (sz->buf_in[i] == 0xff) {
+					sz->idle = 1;
+					stop_timer(sz);
+					flush_delay_buffer(sz);
+				} else
+					push_full_space(sz, sz->buf_in[i]);
+				sz->decoder_state = PulseSpace;
+				break;
+			case IgnorePulse:
+				if ((sz->buf_in[i]&STREAMZAP_SPACE_MASK) ==
+				    STREAMZAP_SPACE_MASK) {
+					sz->decoder_state = FullSpace;
+					continue;
+				}
+				push_half_space(sz, sz->buf_in[i]);
+				sz->decoder_state = PulseSpace;
+				break;
+			}
+		}
+	}
+
+#ifdef KERNEL_2_5
+	usb_submit_urb(urb, GFP_ATOMIC);
+#endif
+
+	return;
+}
+
+static struct file_operations streamzap_fops = {
+	.owner		= THIS_MODULE,
+	.ioctl		= streamzap_ioctl,
+};
+
+
+/**
+ *	streamzap_probe
+ *
+ *	Called by usb-core to associated with a candidate device
+ *	On any failure the return value is the ERROR
+ *	On success return 0
+ */
+#ifdef KERNEL_2_5
+static int streamzap_probe(struct usb_interface *interface,
+			   const struct usb_device_id *id)
+{
+	struct usb_device *udev = interface_to_usbdev(interface);
+	struct usb_host_interface *iface_host;
+#else
+static void *streamzap_probe(struct usb_device *udev, unsigned int ifnum,
+			     const struct usb_device_id *id)
+{
+	struct usb_interface *interface = &udev->actconfig->interface[ifnum];
+	struct usb_interface_descriptor *iface_host;
+#endif
+	int retval = -ENOMEM;
+	struct usb_streamzap *sz = NULL;
+	char buf[63], name[128] = "";
+
+	/* Allocate space for device driver specific data */
+	sz = kzalloc(sizeof(struct usb_streamzap), GFP_KERNEL);
+	if (sz == NULL)
+		goto error;
+
+	sz->udev = udev;
+	sz->interface = interface;
+
+	/* Check to ensure endpoint information matches requirements */
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 5)
+	iface_host = &interface->altsetting[interface->act_altsetting];
+#else
+	iface_host = interface->cur_altsetting;
+#endif
+
+#ifdef KERNEL_2_5
+	if (iface_host->desc.bNumEndpoints != 1) {
+#else
+	if (iface_host->bNumEndpoints != 1) {
+#endif
+#ifdef KERNEL_2_5
+		err("%s: Unexpected desc.bNumEndpoints (%d)", __func__,
+		    iface_host->desc.bNumEndpoints);
+#else
+		err("%s: Unexpected desc.bNumEndpoints (%d)", __func__,
+		    iface_host->bNumEndpoints);
+#endif
+		retval = -ENODEV;
+		goto error;
+	}
+
+#ifdef KERNEL_2_5
+	sz->endpoint = &(iface_host->endpoint[0].desc);
+#else
+	sz->endpoint = &(iface_host->endpoint[0]);
+#endif
+	if ((sz->endpoint->bEndpointAddress & USB_ENDPOINT_DIR_MASK)
+	    != USB_DIR_IN) {
+		err("%s: endpoint doesn't match input device 02%02x",
+		    __func__, sz->endpoint->bEndpointAddress);
+		retval = -ENODEV;
+		goto error;
+	}
+
+	if ((sz->endpoint->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK)
+	    != USB_ENDPOINT_XFER_INT) {
+		err("%s: endpoint attributes don't match xfer 02%02x",
+		    __func__, sz->endpoint->bmAttributes);
+		retval = -ENODEV;
+		goto error;
+	}
+
+	if (sz->endpoint->wMaxPacketSize == 0) {
+		err("%s: endpoint message size==0? ", __func__);
+		retval = -ENODEV;
+		goto error;
+	}
+
+	/* Allocate the USB buffer and IRQ URB */
+
+	sz->buf_in_len = sz->endpoint->wMaxPacketSize;
+#ifdef KERNEL_2_5
+	sz->buf_in = usb_buffer_alloc(sz->udev, sz->buf_in_len,
+				      GFP_ATOMIC, &sz->dma_in);
+#else
+	sz->buf_in = kmalloc(sz->buf_in_len, GFP_KERNEL);
+#endif
+	if (sz->buf_in == NULL)
+		goto error;
+
+#ifdef KERNEL_2_5
+	sz->urb_in = usb_alloc_urb(0, GFP_KERNEL);
+#else
+
+	sz->urb_in = usb_alloc_urb(0);
+#endif
+	if (sz->urb_in == NULL)
+		goto error;
+
+	/* Connect this device to the LIRC sub-system */
+
+	if (lirc_buffer_init(&sz->lirc_buf, sizeof(lirc_t),
+			     STREAMZAP_BUFFER_SIZE))
+		goto error;
+
+	if (lirc_buffer_init(&sz->delay_buf, sizeof(lirc_t),
+			     STREAMZAP_BUFFER_SIZE)) {
+		lirc_buffer_free(&sz->lirc_buf);
+		goto error;
+	}
+
+	strcpy(sz->driver.name, DRIVER_NAME);
+	sz->driver.minor = -1;
+	sz->driver.sample_rate = 0;
+	sz->driver.code_length = sizeof(lirc_t) * 8;
+	sz->driver.features = LIRC_CAN_REC_MODE2 | LIRC_CAN_GET_REC_RESOLUTION;
+	sz->driver.data = sz;
+	sz->driver.rbuf = &sz->lirc_buf;
+	sz->driver.set_use_inc = &streamzap_use_inc;
+	sz->driver.set_use_dec = &streamzap_use_dec;
+	sz->driver.fops = &streamzap_fops;
+#ifdef LIRC_HAVE_SYSFS
+	sz->driver.dev = &interface->dev;
+#endif
+	sz->driver.owner = THIS_MODULE;
+
+	sz->idle = 1;
+	sz->decoder_state = PulseSpace;
+	init_timer(&sz->delay_timer);
+	sz->delay_timer.function = delay_timeout;
+	sz->delay_timer.data = (unsigned long) sz;
+	sz->timer_running = 0;
+	spin_lock_init(&sz->timer_lock);
+
+	init_timer(&sz->flush_timer);
+	sz->flush_timer.function = flush_timeout;
+	sz->flush_timer.data = (unsigned long) sz;
+	/* Complete final initialisations */
+
+	usb_fill_int_urb(sz->urb_in, udev,
+		usb_rcvintpipe(udev, sz->endpoint->bEndpointAddress),
+		sz->buf_in, sz->buf_in_len, usb_streamzap_irq, sz,
+		sz->endpoint->bInterval);
+#ifdef KERNEL_2_5
+	sz->urb_in->transfer_dma = sz->dma_in;
+	sz->urb_in->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+#endif
+
+	if (udev->descriptor.iManufacturer
+	    && usb_string(udev, udev->descriptor.iManufacturer,
+			  buf, sizeof(buf)) > 0)
+		strlcpy(name, buf, sizeof(name));
+
+	if (udev->descriptor.iProduct
+	    && usb_string(udev,  udev->descriptor.iProduct,
+			  buf, sizeof(buf)) > 0)
+		snprintf(name + strlen(name), sizeof(name) - strlen(name),
+			 " %s", buf);
+
+	printk(KERN_INFO DRIVER_NAME "[%d]: %s on usb%d:%d attached\n",
+	       sz->driver.minor, name,
+	       udev->bus->busnum, sz->udev->devnum);
+
+#ifdef KERNEL_2_5
+	usb_set_intfdata(interface, sz);
+#endif
+
+	if (lirc_register_driver(&sz->driver) < 0) {
+		lirc_buffer_free(&sz->delay_buf);
+		lirc_buffer_free(&sz->lirc_buf);
+		goto error;
+	}
+
+#ifdef KERNEL_2_5
+	return 0;
+#else
+	return sz;
+#endif
+
+error:
+
+	/*
+	 * Premise is that a 'goto error' can be invoked from inside the
+	 * probe function and all necessary cleanup actions will be taken
+	 * including freeing any necessary memory blocks
+	 */
+
+	if (retval == -ENOMEM)
+		err("Out of memory");
+
+	if (sz) {
+		usb_free_urb(sz->urb_in);
+#ifdef KERNEL_2_5
+		usb_buffer_free(udev, sz->buf_in_len, sz->buf_in, sz->dma_in);
+#else
+		if (sz->buf_in) {
+			kfree(sz->buf_in);
+		}
+#endif
+		kfree(sz);
+	}
+
+#ifdef KERNEL_2_5
+	return retval;
+#else
+	return NULL;
+#endif
+}
+
+static int streamzap_use_inc(void *data)
+{
+	struct usb_streamzap *sz = data;
+
+	if (!sz) {
+		dprintk("%s called with no context", -1, __func__);
+		return -EINVAL;
+	}
+	dprintk("set use inc", sz->driver.minor);
+	MOD_INC_USE_COUNT;
+
+	lirc_buffer_clear(&sz->lirc_buf);
+	lirc_buffer_clear(&sz->delay_buf);
+
+	sz->flush_timer.expires = jiffies + HZ;
+	sz->flush = 1;
+	add_timer(&sz->flush_timer);
+
+	sz->urb_in->dev = sz->udev;
+#ifdef KERNEL_2_5
+	if (usb_submit_urb(sz->urb_in, GFP_ATOMIC)) {
+#else
+	if (usb_submit_urb(sz->urb_in)) {
+#endif
+		dprintk("open result = -EIO error submitting urb",
+			sz->driver.minor);
+		MOD_DEC_USE_COUNT;
+		return -EIO;
+	}
+	sz->in_use++;
+
+	return 0;
+}
+
+static void streamzap_use_dec(void *data)
+{
+	struct usb_streamzap *sz = data;
+
+	if (!sz) {
+		dprintk("%s called with no context", -1, __func__);
+		return;
+	}
+	dprintk("set use dec", sz->driver.minor);
+
+	if (sz->flush) {
+		sz->flush = 0;
+		del_timer_sync(&sz->flush_timer);
+	}
+
+	usb_kill_urb(sz->urb_in);
+
+	stop_timer(sz);
+
+	MOD_DEC_USE_COUNT;
+	sz->in_use--;
+}
+
+static int streamzap_ioctl(struct inode *node, struct file *filep,
+			   unsigned int cmd, unsigned long arg)
+{
+	int result;
+
+	switch (cmd) {
+	case LIRC_GET_REC_RESOLUTION:
+		result = put_user(STREAMZAP_RESOLUTION, (unsigned int *) arg);
+		if (result)
+			return result;
+		break;
+	default:
+		return -ENOIOCTLCMD;
+	}
+	return 0;
+}
+
+/**
+ * streamzap_disconnect
+ *
+ * Called by the usb core when the device is removed from the system.
+ *
+ * This routine guarantees that the driver will not submit any more urbs
+ * by clearing dev->udev.  It is also supposed to terminate any currently
+ * active urbs.  Unfortunately, usb_bulk_msg(), used in streamzap_read(),
+ * does not provide any way to do this.
+ */
+#ifdef KERNEL_2_5
+static void streamzap_disconnect(struct usb_interface *interface)
+#else
+static void streamzap_disconnect(struct usb_device *dev, void *ptr)
+#endif
+{
+	struct usb_streamzap *sz;
+	int errnum;
+	int minor;
+
+#ifdef KERNEL_2_5
+	sz = usb_get_intfdata(interface);
+#else
+	sz = ptr;
+#endif
+
+	/* unregister from the LIRC sub-system */
+
+	errnum = lirc_unregister_driver(sz->driver.minor);
+	if (errnum != 0)
+		dprintk("error in lirc_unregister: (returned %d)",
+			sz->driver.minor, errnum);
+
+	lirc_buffer_free(&sz->delay_buf);
+	lirc_buffer_free(&sz->lirc_buf);
+
+	/* unregister from the USB sub-system */
+
+	usb_free_urb(sz->urb_in);
+
+#ifdef KERNEL_2_5
+	usb_buffer_free(sz->udev, sz->buf_in_len, sz->buf_in, sz->dma_in);
+#else
+	kfree(sz->buf_in);
+#endif
+
+	minor = sz->driver.minor;
+	kfree(sz);
+
+	printk(KERN_INFO DRIVER_NAME "[%d]: disconnected\n", minor);
+}
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0)
+static int streamzap_suspend(struct usb_interface *intf, pm_message_t message)
+{
+	struct usb_streamzap *sz = usb_get_intfdata(intf);
+
+	printk(KERN_INFO DRIVER_NAME "[%d]: suspend\n", sz->driver.minor);
+	if (sz->in_use) {
+		if (sz->flush) {
+			sz->flush = 0;
+			del_timer_sync(&sz->flush_timer);
+		}
+
+		stop_timer(sz);
+
+		usb_kill_urb(sz->urb_in);
+	}
+	return 0;
+}
+
+static int streamzap_resume(struct usb_interface *intf)
+{
+	struct usb_streamzap *sz = usb_get_intfdata(intf);
+
+	lirc_buffer_clear(&sz->lirc_buf);
+	lirc_buffer_clear(&sz->delay_buf);
+
+	if (sz->in_use) {
+		sz->flush_timer.expires = jiffies + HZ;
+		sz->flush = 1;
+		add_timer(&sz->flush_timer);
+
+		sz->urb_in->dev = sz->udev;
+#ifdef KERNEL_2_5
+		if (usb_submit_urb(sz->urb_in, GFP_ATOMIC)) {
+#else
+		if (usb_submit_urb(sz->urb_in)) {
+#endif
+			dprintk("open result = -EIO error submitting urb",
+				sz->driver.minor);
+			MOD_DEC_USE_COUNT;
+			return -EIO;
+		}
+	}
+	return 0;
+}
+#endif
+
+#ifdef MODULE
+/**
+ *	usb_streamzap_init
+ */
+static int __init usb_streamzap_init(void)
+{
+	int result;
+
+	/* register this driver with the USB subsystem */
+	result = usb_register(&streamzap_driver);
+
+	if (result) {
+		err("usb_register failed. Error number %d",
+		    result);
+		return result;
+	}
+
+	printk(KERN_INFO DRIVER_NAME " " DRIVER_VERSION " registered\n");
+	return 0;
+}
+
+/**
+ *	usb_streamzap_exit
+ */
+static void __exit usb_streamzap_exit(void)
+{
+	usb_deregister(&streamzap_driver);
+}
+
+
+module_init(usb_streamzap_init);
+module_exit(usb_streamzap_exit);
+
+MODULE_AUTHOR("Christoph Bartelmus, Greg Wickham, Adrian Dewhurst");
+MODULE_DESCRIPTION(DRIVER_DESC);
+MODULE_LICENSE("GPL");
+
+module_param(debug, bool, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(debug, "Enable debugging messages");
+EXPORT_NO_SYMBOLS;
+#endif /* MODULE */
--- linux-rt-2.6.31.orig/ubuntu/lirc/lirc_streamzap/Makefile
+++ linux-rt-2.6.31/ubuntu/lirc/lirc_streamzap/Makefile
@@ -0,0 +1,2 @@
+EXTRA_CFLAGS =-DIRCTL_DEV_MAJOR=61 -DLIRC_SERIAL_TRANSMITTER -DLIRC_SERIAL_SOFTCARRIER -I$(src)/..
+obj-$(CONFIG_LIRC_STREAMZAP)	+= lirc_streamzap.o
--- linux-rt-2.6.31.orig/ubuntu/apparmor/lsm.c
+++ linux-rt-2.6.31/ubuntu/apparmor/lsm.c
@@ -0,0 +1,1063 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor LSM hooks.
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#include <linux/security.h>
+#include <linux/moduleparam.h>
+#include <linux/mm.h>
+#include <linux/mman.h>
+#include <linux/mount.h>
+#include <linux/namei.h>
+#include <linux/ptrace.h>
+#include <linux/ctype.h>
+#include <linux/sysctl.h>
+#include <linux/audit.h>
+#include <net/sock.h>
+
+#include "include/apparmor.h"
+#include "include/apparmorfs.h"
+#include "include/audit.h"
+#include "include/capability.h"
+#include "include/context.h"
+#include "include/file.h"
+#include "include/ipc.h"
+#include "include/net.h"
+#include "include/path.h"
+#include "include/policy.h"
+#include "include/procattr.h"
+
+/* Flag indicating whether initialization completed */
+int apparmor_initialized;
+
+
+/*
+ * LSM hook functions
+ */
+
+/*
+ * prepare new aa_task_context for modification by prepare_cred block
+ */
+static int apparmor_cred_prepare(struct cred *new, const struct cred *old,
+				 gfp_t gfp)
+{
+	struct aa_task_context *cxt = aa_dup_task_context(old->security, gfp);
+	if (!cxt)
+		return -ENOMEM;
+	new->security = cxt;
+	return 0;
+}
+
+/*
+ * free the associated aa_task_context and put its profiles
+ */
+static void apparmor_cred_free(struct cred *cred)
+{
+	struct aa_task_context *cxt = cred->security;
+	cred->security = NULL;
+	aa_free_task_context(cxt);
+}
+
+
+static int apparmor_ptrace_may_access(struct task_struct *child,
+				      unsigned int mode)
+{
+	return aa_ptrace(current, child, mode);
+}
+
+
+static int apparmor_ptrace_traceme(struct task_struct *parent)
+{
+	return aa_ptrace(parent, current, PTRACE_MODE_ATTACH);
+}
+
+/* Derived from security/commoncap.c:cap_capget */
+static int apparmor_capget(struct task_struct *target, kernel_cap_t *effective,
+			   kernel_cap_t *inheritable, kernel_cap_t *permitted)
+{
+	struct aa_profile *profile;
+	const struct cred *cred;
+
+	rcu_read_lock();
+	cred = __task_cred(target);
+	aa_cred_policy(cred, &profile);
+
+	*effective   = cred->cap_effective;
+	*inheritable = cred->cap_inheritable;
+	*permitted   = cred->cap_permitted;
+
+	if (profile) {
+		*effective = cap_combine(*effective, profile->caps.set);
+		*effective = cap_intersect(*effective, profile->caps.allowed);
+	}
+	rcu_read_unlock();
+
+	return 0;
+}
+
+static int apparmor_capable(struct task_struct *task, const struct cred *cred,
+			    int cap, int audit)
+{
+	struct aa_profile *profile;
+	/* cap_capable returns 0 on success, else -EPERM */
+	int error = cap_capable(task, cred, cap, audit);
+
+	aa_cred_policy(cred, &profile);
+	if (profile && (!error || cap_raised(profile->caps.set, cap)))
+		error = aa_capable(task, profile, cap, audit);
+
+	return error;
+}
+
+static int apparmor_sysctl(struct ctl_table *table, int op)
+{
+	int error = 0;
+	struct aa_profile *profile = aa_current_profile_wupd();
+
+	if (profile) {
+		char *buffer, *name;
+		int mask;
+
+		mask = 0;
+ 		if (op & 4)
+			mask |= MAY_READ;
+		if (op & 2)
+			mask |= MAY_WRITE;
+
+		error = -ENOMEM;
+		buffer = (char *)__get_free_page(GFP_KERNEL);
+		if (!buffer)
+			goto out;
+
+		/* 
+		 * TODO: convert this over to using a global or per
+		 * namespace control instead of a hard coded /proc
+		 */
+		name = sysctl_pathname(table, buffer, PAGE_SIZE);
+		if (name && name - buffer >= 5) {
+			struct path_cond cond = { 0, S_IFREG };
+			name -= 5;
+			memcpy(name, "/proc", 5);
+			error = aa_pathstr_perm(profile, "sysctl", name, mask,
+						&cond);
+		}
+		free_page((unsigned long)buffer);
+	}
+
+out:
+	return error;
+}
+
+static int common_perm(const char *op, struct path *path, u16 mask,
+		       struct path_cond *cond)
+{
+	struct aa_profile *profile;
+	int error = 0;
+
+	profile = aa_current_profile();
+	if (profile)
+		error = aa_path_perm(profile, op, path, mask, cond);
+
+	return error;
+}
+
+static int common_perm_dentry(const char *op, struct path *dir,
+			      struct dentry *dentry, u16 mask, 
+			      struct path_cond *cond)
+{
+	struct path path = { dir->mnt, dentry };
+
+	return common_perm(op, &path, mask, cond);
+}
+
+static int common_perm_rm(const char *op, struct path *dir,
+			  struct dentry *dentry, u16 mask)
+{
+	struct inode *inode = dentry->d_inode;
+	struct path_cond cond = {};
+
+	if (!dir->mnt || !inode || !mediated_filesystem(inode))
+		return 0;
+
+	cond.uid = inode->i_uid;
+	cond.mode = inode->i_mode;
+
+	return common_perm_dentry(op, dir, dentry, mask, &cond);
+}
+
+static int common_perm_create(const char *op, struct path *dir,
+			      struct dentry *dentry, u16 mask, umode_t mode)
+{
+	struct path_cond cond = { current_fsuid(), mode };
+
+	if (!dir->mnt || !mediated_filesystem(dir->dentry->d_inode))
+		return 0;
+
+	return common_perm_dentry(op, dir, dentry, mask, &cond);
+}
+
+static int apparmor_path_unlink(struct path *dir, struct dentry *dentry)
+{
+	return common_perm_rm("unlink", dir, dentry, MAY_WRITE);
+}
+
+static int apparmor_path_mkdir(struct path *dir, struct dentry *dentry,
+			       int mode)
+{
+	return common_perm_create("mkdir", dir, dentry, AA_MAY_CREATE, S_IFDIR);
+}
+
+static int apparmor_path_rmdir(struct path *dir, struct dentry *dentry)
+{
+	return common_perm_rm("rmdir", dir, dentry, MAY_WRITE);
+}
+
+static int apparmor_path_mknod(struct path *dir, struct dentry *dentry,
+			       int mode, unsigned int dev)
+{
+	return common_perm_create("mknod", dir, dentry, AA_MAY_CREATE, mode);
+}
+
+static int apparmor_path_truncate(struct path *path, loff_t length,
+				  unsigned int time_attrs)
+{
+	struct path_cond cond = { path->dentry->d_inode->i_uid,
+				  path->dentry->d_inode->i_mode };
+
+	if (!path->mnt || !mediated_filesystem(path->dentry->d_inode))
+		return 0;
+	return common_perm("truncate", path, MAY_WRITE, &cond);
+}
+
+static int apparmor_path_symlink(struct path *dir, struct dentry *dentry,
+			  const char *old_name)
+{
+	return common_perm_create("symlink_create", dir, dentry, AA_MAY_CREATE,
+				  S_IFLNK);
+}
+
+static int apparmor_path_link(struct dentry *old_dentry, struct path *new_dir,
+			      struct dentry *new_dentry)
+{
+	struct aa_profile *profile;
+	int error = 0;
+
+	if (!mediated_filesystem(old_dentry->d_inode))
+		return 0;
+
+	profile = aa_current_profile_wupd();
+	if (profile)
+		error = aa_path_link(profile, old_dentry, new_dir, new_dentry);
+	return error;
+}
+
+static int apparmor_path_rename(struct path *old_dir, struct dentry *old_dentry,
+			 struct path *new_dir, struct dentry *new_dentry)
+{
+	struct aa_profile *profile;
+	int error = 0;
+
+	if (!mediated_filesystem(old_dentry->d_inode))
+		return 0;
+
+	profile = aa_current_profile_wupd();
+	if (profile) {
+		struct path old_path = { old_dir->mnt, old_dentry };
+		struct path new_path = { new_dir->mnt, new_dentry };
+		struct path_cond cond = { old_dentry->d_inode->i_uid,
+					  old_dentry->d_inode->i_mode };
+
+		error = aa_path_perm(profile, "rename_src", &old_path,
+				     MAY_READ | MAY_WRITE, &cond);
+		if (!error)
+			error = aa_path_perm(profile, "rename_dest", &new_path,
+					     AA_MAY_CREATE | MAY_WRITE, &cond);
+					     
+	}
+	return error;
+}
+
+static int apparmor_dentry_open(struct file *file, const struct cred *cred)
+{
+	struct aa_profile *profile;
+	int error = 0;
+	  
+	/* If in exec permission is handled by bprm hooks */
+	if (current->in_execve ||
+	    !mediated_filesystem(file->f_path.dentry->d_inode))
+		return 0;
+
+	aa_cred_policy(cred, &profile);
+	if (profile) {
+		struct aa_file_cxt *fcxt = file->f_security;
+		struct inode *inode = file->f_path.dentry->d_inode; 
+		struct path_cond cond = { inode->i_uid, inode->i_mode };
+
+		error = aa_path_perm(profile, "open", &file->f_path,
+				     aa_map_file_to_perms(file), &cond);
+		fcxt->profile = aa_get_profile(profile);
+		/* todo cache actual allowed permissions */
+		fcxt->allowed = 0;
+	}
+
+	return error;
+}
+
+static int apparmor_file_alloc_security(struct file *file)
+{
+	file->f_security = aa_alloc_file_context(GFP_KERNEL);
+	if (!file->f_security)
+		return -ENOMEM;
+	return 0;
+
+}
+
+static void apparmor_file_free_security(struct file *file)
+{
+	struct aa_file_cxt *cxt = file->f_security;
+
+	aa_free_file_context(cxt);
+}
+
+static int apparmor_file_permission(struct file *file, int mask)
+{
+	/*
+	 * Most basic (rw) file access is revalidated at exec.
+	 * The revalidation done here is for parent/child hat
+	 * file accesses.
+	 *
+	 * Currently profile replacement does not cause revalidation
+	 * or file revocation.
+	 *
+	 * TODO: cache profiles that have revalidated?
+	 */
+	struct aa_file_cxt *fcxt = file->f_security;
+	struct aa_profile *profile, *fprofile = fcxt->profile;
+	int error = 0;
+
+	if (!fprofile || !file->f_path.mnt ||
+	    !mediated_filesystem(file->f_path.dentry->d_inode))
+		return 0;
+
+	profile = aa_current_profile();
+	/* TODO: Enable at exec time revalidation of files
+	if (profile && (fprofile != profile) &&
+	    ((PROFILE_IS_HAT(profile) && (profile->parent == fprofile)) ||
+	     (PROFILE_IS_HAT(fprofile) && (fprofile->parent == profile))))
+		error = aa_file_perm(profile, "file_perm", file, mask);
+	*/
+	if (profile && ((fprofile != profile) || (mask & ~fcxt->allowed)))
+		error = aa_file_perm(profile, "file_perm", file, mask);
+
+	return error;
+}
+
+static int common_file_perm(const char *op, struct file *file, u16 mask)
+{
+	const struct aa_file_cxt *fcxt = file->f_security;
+	struct aa_profile *profile, *fprofile = fcxt->profile;
+	int error = 0;
+
+	if (!fprofile || !file->f_path.mnt ||
+	    !mediated_filesystem(file->f_path.dentry->d_inode))
+ 		return 0;
+
+	profile = aa_current_profile_wupd();
+	if (profile && ((fprofile != profile) || (mask & ~fcxt->allowed)))
+		error = aa_file_perm(profile, op, file, mask);
+
+	return error;
+}
+
+static int apparmor_file_lock(struct file *file, unsigned int cmd)
+{
+	u16 mask = AA_MAY_LOCK;
+
+	if (cmd == F_WRLCK)
+		mask |= MAY_WRITE;
+
+	return common_file_perm("file_lock", file, mask);
+}
+
+
+/*
+ * AppArmor doesn't current use the fcntl hook.
+ * 
+ * FIXME - these are not implemented yet - REMOVE file_fcntl hook
+ * NOTE: some of the file control commands are further mediated
+ *       by other hooks
+ * F_SETOWN - security_file_set_fowner
+ * F_SETLK - security_file_lock
+ * F_SETLKW - security_file_lock
+ * O_APPEND - AppArmor mediates append as a subset of full write
+ *            so changing from full write to appending write is
+ *            dropping priviledge and not restricted.
+
+
+static int apparmor_file_fcntl(struct file *file, unsigned int cmd,
+			     unsigned long arg)
+{
+	return 0;
+}
+*/
+
+static int common_mmap(struct file *file, const char *operation,
+		   unsigned long prot, unsigned long flags)
+{
+	struct dentry *dentry;
+	int mask = 0;
+
+	if (!file || !file->f_security)
+		return 0;
+
+	if (prot & PROT_READ)
+		mask |= MAY_READ;
+	/* Private mappings don't require write perms since they don't
+	 * write back to the files */
+	if ((prot & PROT_WRITE) && !(flags & MAP_PRIVATE))
+		mask |= MAY_WRITE;
+	if (prot & PROT_EXEC)
+		mask |= AA_EXEC_MMAP;
+
+	dentry = file->f_path.dentry;
+	return common_file_perm(operation, file, mask);
+}
+
+static int apparmor_file_mmap(struct file *file, unsigned long reqprot,
+			      unsigned long prot, unsigned long flags,
+			      unsigned long addr, unsigned long addr_only)
+{
+	if ((addr < mmap_min_addr) && !capable(CAP_SYS_RAWIO)) {
+		struct aa_profile *profile = aa_current_profile_wupd();
+		if (profile)
+			/* future control check here */
+			return -EACCES;
+		else
+			return -EACCES;
+	}
+
+	return common_mmap(file, "file_mmap", prot, flags);
+}
+
+static int apparmor_file_mprotect(struct vm_area_struct *vma,
+				  unsigned long reqprot, unsigned long prot)
+{
+	return common_mmap(vma->vm_file, "file_mprotect", prot,
+		       !(vma->vm_flags & VM_SHARED) ? MAP_PRIVATE : 0);
+}
+
+static int apparmor_getprocattr(struct task_struct *task, char *name,
+				char **value)
+{
+	int error = -ENOENT;
+	struct aa_namespace *ns;
+	struct aa_profile *profile, *onexec, *prev;
+	const struct cred *cred = aa_get_task_policy(task, &profile);
+	struct aa_task_context *cxt = cred->security;
+	ns = cxt->sys.profile->ns;
+	onexec = cxt->sys.onexec;
+	prev = cxt->sys.previous;
+
+	/* task must be either querying itself, unconfined or can ptrace */
+	if (current != task && profile && !capable(CAP_SYS_PTRACE)) {
+		error = -EPERM;
+	} else {
+		if (strcmp(name, "current") == 0) {
+			error = aa_getprocattr(ns, profile, value);
+		} else if (strcmp(name, "prev") == 0) {
+			if (prev)
+				error = aa_getprocattr(ns, prev, value);
+		} else if (strcmp(name, "exec") == 0) {
+			if (onexec)
+				error = aa_getprocattr(ns, onexec, value);
+		} else {
+			error = -EINVAL;
+		}
+	}
+
+	put_cred(cred);
+
+	return error;
+}
+
+static int apparmor_setprocattr(struct task_struct *task, char *name,
+				void *value, size_t size)
+{
+	char *command, *args;
+	int error;
+
+	if (size == 0 || size >= PAGE_SIZE)
+		return -EINVAL;
+
+	/* task can only write its own attributes */
+	if (current != task)
+		return -EACCES;
+
+	args = value;
+	args[size] = '\0';
+	args = strstrip(args);
+	command = strsep(&args, " ");
+	if (!args)
+		return -EINVAL;
+	while (isspace(*args))
+		args++;
+	if (!*args)
+		return -EINVAL;
+
+	if (strcmp(name, "current") == 0) {
+		if (strcmp(command, "changehat") == 0) {
+			error = aa_setprocattr_changehat(args, !AA_DO_TEST);
+		} else if (strcmp(command, "permhat") == 0) {
+			error = aa_setprocattr_changehat(args, AA_DO_TEST);
+		} else if (strcmp(command, "changeprofile") == 0) {
+			error = aa_setprocattr_changeprofile(args, 0,
+							     !AA_DO_TEST);
+		} else if (strcmp(command, "permprofile") == 0) {
+			error = aa_setprocattr_changeprofile(args, 0,
+							     AA_DO_TEST);
+		} else if (strcmp(command, "permipc") == 0) {
+			error = aa_setprocattr_permipc(args);
+		} else {
+			struct aa_audit sa;
+			memset(&sa, 0, sizeof(sa));
+			sa.operation = "setprocattr";
+			sa.gfp_mask = GFP_KERNEL;
+			sa.info = name;
+			sa.error = -EINVAL;
+			return aa_audit(AUDIT_APPARMOR_DENIED, NULL, &sa, NULL);
+		}
+	} else if (strcmp(name, "exec") == 0) {
+		error = aa_setprocattr_changeprofile(strstrip(args), 1,
+						     !AA_DO_TEST);
+	} else {
+		/* only support the "current" and "exec" process attributes */
+		return -EINVAL;
+	}
+	if (!error)
+		error = size;
+	return error;
+}
+
+static int apparmor_task_setrlimit(unsigned int resource,
+				   struct rlimit *new_rlim)
+{
+	struct aa_profile *profile = aa_current_profile_wupd();
+	int error = 0;
+
+	if (profile) {
+		error = aa_task_setrlimit(profile, resource, new_rlim);
+	}
+
+	return error;
+}
+
+#ifdef CONFIG_SECURITY_APPARMOR_NETWORK
+static int apparmor_socket_create(int family, int type, int protocol, int kern){
+	struct aa_profile *profile;
+	int error = 0;
+
+	if (kern)
+		return 0;
+
+	profile = aa_current_profile();
+	if (profile)
+		error = aa_net_perm(profile, "socket_create", family,
+							type, protocol);
+	return error;
+}
+
+static int apparmor_socket_post_create(struct socket *sock, int family,
+					int type, int protocol, int kern)
+{
+	struct sock *sk = sock->sk;
+
+	if (kern)
+		return 0;
+
+	return aa_revalidate_sk(sk, "socket_post_create");
+}
+
+static int apparmor_socket_bind(struct socket *sock,
+				struct sockaddr *address, int addrlen)
+{
+	struct sock *sk = sock->sk;
+
+	return aa_revalidate_sk(sk, "socket_bind");
+}
+
+static int apparmor_socket_connect(struct socket *sock,
+					struct sockaddr *address, int addrlen)
+{
+	struct sock *sk = sock->sk;
+
+	return aa_revalidate_sk(sk, "socket_connect");
+}
+
+static int apparmor_socket_listen(struct socket *sock, int backlog)
+{
+	struct sock *sk = sock->sk;
+
+	return aa_revalidate_sk(sk, "socket_listen");
+}
+
+static int apparmor_socket_accept(struct socket *sock, struct socket *newsock)
+{
+	struct sock *sk = sock->sk;
+
+	return aa_revalidate_sk(sk, "socket_accept");
+}
+
+static int apparmor_socket_sendmsg(struct socket *sock,
+					struct msghdr *msg, int size)
+{
+	struct sock *sk = sock->sk;
+
+	return aa_revalidate_sk(sk, "socket_sendmsg");
+}
+
+static int apparmor_socket_recvmsg(struct socket *sock,
+				   struct msghdr *msg, int size, int flags)
+{
+	struct sock *sk = sock->sk;
+
+	return aa_revalidate_sk(sk, "socket_recvmsg");
+}
+
+static int apparmor_socket_getsockname(struct socket *sock)
+{
+	struct sock *sk = sock->sk;
+
+	return aa_revalidate_sk(sk, "socket_getsockname");
+}
+
+static int apparmor_socket_getpeername(struct socket *sock)
+{
+	struct sock *sk = sock->sk;
+
+	return aa_revalidate_sk(sk, "socket_getpeername");
+}
+
+static int apparmor_socket_getsockopt(struct socket *sock, int level,
+					int optname)
+{
+	struct sock *sk = sock->sk;
+
+	return aa_revalidate_sk(sk, "socket_getsockopt");
+}
+
+static int apparmor_socket_setsockopt(struct socket *sock, int level,
+					int optname)
+{
+	struct sock *sk = sock->sk;
+
+	return aa_revalidate_sk(sk, "socket_setsockopt");
+}
+
+static int apparmor_socket_shutdown(struct socket *sock, int how)
+{
+	struct sock *sk = sock->sk;
+
+	return aa_revalidate_sk(sk, "socket_shutdown");
+}
+#endif
+
+static struct security_operations apparmor_ops = {
+	.name =				"apparmor",
+
+	.ptrace_may_access =		apparmor_ptrace_may_access,
+	.ptrace_traceme =		apparmor_ptrace_traceme,
+	.capget =			apparmor_capget,
+	.sysctl =			apparmor_sysctl,
+	.capable =			apparmor_capable,
+/*
+	.inode_create =			apparmor_inode_create,
+	.inode_setattr =		apparmor_inode_setattr,
+	.inode_setxattr =		apparmor_inode_setxattr,
+	.inode_getxattr =		apparmor_inode_getxattr,
+	.inode_listxattr =		apparmor_inode_listxattr,
+	.inode_removexattr =		apparmor_inode_removexattr,
+	.inode_permission = ??? use to mediate owner access to non-mediated fs
+*/
+
+	.path_link =			apparmor_path_link,
+	.path_unlink =			apparmor_path_unlink,
+	.path_symlink =			apparmor_path_symlink,
+	.path_mkdir =			apparmor_path_mkdir,
+	.path_rmdir =			apparmor_path_rmdir,
+	.path_mknod =			apparmor_path_mknod,
+	.path_rename =			apparmor_path_rename,
+	.path_truncate =		apparmor_path_truncate,
+	.dentry_open =			apparmor_dentry_open,
+
+	.file_permission =		apparmor_file_permission,
+	.file_alloc_security =		apparmor_file_alloc_security,
+	.file_free_security =		apparmor_file_free_security,
+	.file_mmap =			apparmor_file_mmap,
+	.file_mprotect =		apparmor_file_mprotect,
+	.file_lock =			apparmor_file_lock,
+
+/*	.file_fcntl =			apparmor_file_fcntl, */
+
+	.getprocattr =			apparmor_getprocattr,
+	.setprocattr =			apparmor_setprocattr,
+
+#ifdef CONFIG_SECURITY_APPARMOR_NETWORK
+	.socket_create =		apparmor_socket_create,
+	.socket_post_create =		apparmor_socket_post_create,
+	.socket_bind =			apparmor_socket_bind,
+	.socket_connect =		apparmor_socket_connect,
+	.socket_listen =		apparmor_socket_listen,
+	.socket_accept =		apparmor_socket_accept,
+	.socket_sendmsg =		apparmor_socket_sendmsg,
+	.socket_recvmsg =		apparmor_socket_recvmsg,
+	.socket_getsockname =		apparmor_socket_getsockname,
+	.socket_getpeername =		apparmor_socket_getpeername,
+	.socket_getsockopt =		apparmor_socket_getsockopt,
+	.socket_setsockopt =		apparmor_socket_setsockopt,
+	.socket_shutdown =		apparmor_socket_shutdown,
+#endif
+
+	.cred_free =			apparmor_cred_free,
+	.cred_prepare =			apparmor_cred_prepare,
+
+	.bprm_set_creds =		apparmor_bprm_set_creds,
+	//	.bprm_committing_creds =	apparmor_bprm_committing_creds,
+	.bprm_committed_creds =		apparmor_bprm_committed_creds,
+	.bprm_secureexec =		apparmor_bprm_secureexec,
+
+	.task_setrlimit =		apparmor_task_setrlimit,
+};
+
+
+/*
+ * AppArmor sysfs module parameters
+ */
+
+static int param_set_aabool(const char *val, struct kernel_param *kp);
+static int param_get_aabool(char *buffer, struct kernel_param *kp);
+#define param_check_aabool(name, p) __param_check(name, p, int)
+
+static int param_set_aauint(const char *val, struct kernel_param *kp);
+static int param_get_aauint(char *buffer, struct kernel_param *kp);
+#define param_check_aauint(name, p) __param_check(name, p, int)
+
+static int param_set_aalockpolicy(const char *val, struct kernel_param *kp);
+static int param_get_aalockpolicy(char *buffer, struct kernel_param *kp);
+#define param_check_aalockpolicy(name, p) __param_check(name, p, int)
+
+static int param_set_audit(const char *val, struct kernel_param *kp);
+static int param_get_audit(char *buffer, struct kernel_param *kp);
+#define param_check_audit(name, p) __param_check(name, p, int)
+
+static int param_set_mode(const char *val, struct kernel_param *kp);
+static int param_get_mode(char *buffer, struct kernel_param *kp);
+#define param_check_mode(name, p) __param_check(name, p, int)
+
+/* Flag values, also controllable via /sys/module/apparmor/parameters
+ * We define special types as we want to do additional mediation.
+ */
+
+/* AppArmor global enforcement switch - complain, enforce, kill */
+enum profile_mode g_profile_mode = APPARMOR_ENFORCE;
+module_param_call(mode, param_set_mode, param_get_mode,
+		  &g_profile_mode, S_IRUSR | S_IWUSR);
+
+/* Debug mode */
+int g_apparmor_debug;
+module_param_named(debug, g_apparmor_debug, aabool, S_IRUSR | S_IWUSR);
+
+/* Audit mode */
+enum audit_mode g_apparmor_audit;
+module_param_call(audit, param_set_audit, param_get_audit,
+		  &g_apparmor_audit, S_IRUSR | S_IWUSR);
+
+/* Determines if audit header is included in audited messages.  This
+ * provides more context if the audit daemon is not running
+ */
+int g_apparmor_audit_header;
+module_param_named(audit_header, g_apparmor_audit_header, aabool,
+		   S_IRUSR | S_IWUSR);
+
+/* lock out loading/removal of policy
+ * TODO: add in at boot loading of policy, which is the only way to
+ *       load policy, if lock_policy is set
+ */
+int g_apparmor_lock_policy;
+module_param_named(lock_policy, g_apparmor_lock_policy, aalockpolicy,
+		   S_IRUSR | S_IWUSR);
+
+/* Syscall logging mode */
+int g_apparmor_logsyscall;
+module_param_named(logsyscall, g_apparmor_logsyscall, aabool,
+		   S_IRUSR | S_IWUSR);
+
+/* Maximum pathname length before accesses will start getting rejected */
+unsigned int g_apparmor_path_max = 2 * PATH_MAX;
+module_param_named(path_max, g_apparmor_path_max, aauint, S_IRUSR | S_IWUSR);
+
+/* Boot time disable flag */
+#ifdef CONFIG_SECURITY_APPARMOR_DISABLE
+#define AA_ENABLED_PERMS 0600
+#else
+#define AA_ENABLED_PERMS 0400
+#endif
+static int param_set_aa_enabled(const char *val, struct kernel_param *kp);
+static unsigned int apparmor_enabled = CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE;
+module_param_call(enabled, param_set_aa_enabled, param_get_aauint,
+		  &apparmor_enabled, AA_ENABLED_PERMS);
+
+static int __init apparmor_enabled_setup(char *str)
+{
+	apparmor_enabled = simple_strtol(str, NULL, 0);
+	return 1;
+}
+__setup("apparmor=", apparmor_enabled_setup);
+
+static int param_set_aalockpolicy(const char *val, struct kernel_param *kp)
+{
+	if (__aa_task_is_confined(current))
+		return -EPERM;
+	if (g_apparmor_lock_policy)
+		return -EACCES;
+	return param_set_bool(val, kp);
+}
+
+static int param_get_aalockpolicy(char *buffer, struct kernel_param *kp)
+{
+	if (__aa_task_is_confined(current))
+		return -EPERM;
+	return param_get_bool(buffer, kp);
+}
+
+static int param_set_aabool(const char *val, struct kernel_param *kp)
+{
+	if (__aa_task_is_confined(current))
+		return -EPERM;
+	return param_set_bool(val, kp);
+}
+
+static int param_get_aabool(char *buffer, struct kernel_param *kp)
+{
+	if (__aa_task_is_confined(current))
+		return -EPERM;
+	return param_get_bool(buffer, kp);
+}
+
+static int param_set_aauint(const char *val, struct kernel_param *kp)
+{
+	if (__aa_task_is_confined(current))
+		return -EPERM;
+	return param_set_uint(val, kp);
+}
+
+static int param_get_aauint(char *buffer, struct kernel_param *kp)
+{
+	if (__aa_task_is_confined(current))
+		return -EPERM;
+	return param_get_uint(buffer, kp);
+}
+
+/* allow run time disabling of apparmor */
+static int param_set_aa_enabled(const char *val, struct kernel_param *kp)
+{
+	unsigned long l;
+
+	if (!apparmor_initialized) {
+		apparmor_enabled = 0;
+		return 0;
+	}
+
+	if (__aa_task_is_confined(current))
+		return -EPERM;
+
+	if (!apparmor_enabled)
+		return -EINVAL;
+
+	if (!val)
+		return -EINVAL;
+
+	if (strict_strtoul(val, 0, &l) || l != 0)
+		return -EINVAL;
+
+	apparmor_enabled = 0;
+	apparmor_disable();
+	return 0;
+}
+
+static int param_get_audit(char *buffer, struct kernel_param *kp)
+{
+	if (__aa_task_is_confined(current))
+		return -EPERM;
+
+	if (!apparmor_enabled)
+		return -EINVAL;
+
+	return sprintf(buffer, "%s", audit_mode_names[g_apparmor_audit]);
+}
+
+static int param_set_audit(const char *val, struct kernel_param *kp)
+{
+	int i;
+	if (__aa_task_is_confined(current))
+		return -EPERM;
+
+	if (!apparmor_enabled)
+		return -EINVAL;
+
+	if (!val)
+		return -EINVAL;
+
+	for (i = 0; i < AUDIT_MAX_INDEX; i++) {
+		if (strcmp(val, audit_mode_names[i]) == 0) {
+			g_apparmor_audit = i;
+			return 0;
+		}
+	}
+
+	return -EINVAL;
+}
+
+static int param_get_mode(char *buffer, struct kernel_param *kp)
+{
+	if (__aa_task_is_confined(current))
+		return -EPERM;
+
+	if (!apparmor_enabled)
+		return -EINVAL;
+
+	return sprintf(buffer, "%s", profile_mode_names[g_profile_mode]);
+}
+
+static int param_set_mode(const char *val, struct kernel_param *kp)
+{
+	int i;
+	if (__aa_task_is_confined(current))
+		return -EPERM;
+
+	if (!apparmor_enabled)
+		return -EINVAL;
+
+	if (!val)
+		return -EINVAL;
+
+	for (i = 0; i < APPARMOR_NAMES_MAX_INDEX; i++) {
+		if (strcmp(val, profile_mode_names[i]) == 0) {
+			g_profile_mode = i;
+			return 0;
+		}
+	}
+
+	return -EINVAL;
+}
+
+
+/*
+ * AppArmor init functions
+ */
+
+static int set_init_cxt(void)
+{
+	struct cred *cred = (struct cred *) current->real_cred;
+	struct aa_task_context *cxt;
+
+	cxt = aa_alloc_task_context(GFP_KERNEL);
+	if (!cxt)
+		return -ENOMEM;
+
+	cxt->sys.profile = aa_get_profile(default_namespace->unconfined);
+	cred->security = cxt;
+
+	return 0;
+}
+
+static int __init apparmor_init(void)
+{
+	int error;
+
+	if (!apparmor_enabled || !security_module_enable(&apparmor_ops)) {
+		info_message("AppArmor disabled by boot time parameter\n");
+		apparmor_enabled = 0;
+		return 0;
+	}
+
+	/*
+	 * Activated with fs_initcall
+	error = create_apparmorfs();
+	if (error) {
+		AA_ERROR("Unable to activate AppArmor filesystem\n");
+		goto createfs_out;
+	}
+	*/
+
+	error = alloc_default_namespace();
+	if (error) {
+		AA_ERROR("Unable to allocate default profile namespace\n");
+		goto alloc_out;
+	}
+
+	error = set_init_cxt();
+	if (error) {
+		AA_ERROR("Failed to set context on init task\n");
+		goto alloc_out;
+	}
+
+	error = register_security(&apparmor_ops);
+	if (error) {
+		AA_ERROR("Unable to register AppArmor\n");
+		goto register_security_out;
+	}
+
+	/* Report that AppArmor successfully initialized */
+	apparmor_initialized = 1;
+	if (g_profile_mode == APPARMOR_COMPLAIN)
+		info_message("AppArmor initialized: complain mode enabled");
+	else if (g_profile_mode == APPARMOR_KILL)
+		info_message("AppArmor initialized: kill mode enabled");
+	else
+		info_message("AppArmor initialized");
+
+	return error;
+
+register_security_out:
+	free_default_namespace();
+
+alloc_out:
+	destroy_apparmorfs();
+
+/*createfs_out:*/
+	apparmor_enabled = 0;
+	return error;
+
+}
+
+security_initcall(apparmor_init);
+
+void apparmor_disable(void)
+{
+	/* Remove and release all the profiles on the profile list. */
+	aa_profile_ns_list_release();
+
+	/* FIXME: cleanup profiles references on files */
+	free_default_namespace();
+
+	/*
+	 * Delay for an rcu cycle to make sure that all active task
+	 * context readers have finished, and all profiles have been
+	 * freed by their rcu callbacks.
+	 */
+	synchronize_rcu();
+	destroy_apparmorfs();
+	apparmor_initialized = 0;
+
+	info_message("AppArmor protection disabled");
+}
+
--- linux-rt-2.6.31.orig/ubuntu/apparmor/policy_interface.c
+++ linux-rt-2.6.31/ubuntu/apparmor/policy_interface.c
@@ -0,0 +1,852 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor functions for unpacking policy loaded from
+ * userspace.
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ *
+ * AppArmor uses a serialized binary format for loading policy.
+ * The policy format is documented in Documentation/???
+ * All policy is validated all before it is used.
+ */
+
+#include <asm/unaligned.h>
+#include <linux/errno.h>
+
+#include "include/apparmor.h"
+#include "include/audit.h"
+#include "include/context.h"
+#include "include/match.h"
+#include "include/policy.h"
+#include "include/policy_interface.h"
+#include "include/sid.h"
+
+/* FIXME: convert profiles to internal hieracy, accounting
+ * FIXME: have replacement routines set replaced_by profile instead of error
+ * FIXME: name mapping to hierarchy
+ */
+
+/*
+ * The AppArmor interface treats data as a type byte followed by the
+ * actual data.  The interface has the notion of a a named entry
+ * which has a name (AA_NAME typecode followed by name string) followed by
+ * the entries typecode and data.  Named types allow for optional
+ * elements and extensions to be added and tested for without breaking
+ * backwards compatability.
+ */
+
+enum aa_code {
+	AA_U8,
+	AA_U16,
+	AA_U32,
+	AA_U64,
+	AA_NAME,	/* same as string except it is items name */
+	AA_STRING,
+	AA_BLOB,
+	AA_STRUCT,
+	AA_STRUCTEND,
+	AA_LIST,
+	AA_LISTEND,
+	AA_ARRAY,
+	AA_ARRAYEND,
+};
+
+/*
+ * aa_ext is the read of the buffer containing the serialized profile.  The
+ * data is copied into a kernel buffer in apparmorfs and then handed off to
+ * the unpack routines.
+ */
+struct aa_ext {
+	void *start;
+	void *end;
+	void *pos;	/* pointer to current position in the buffer */
+	u32 version;
+	char *ns_name;
+};
+
+
+struct aa_audit_iface {
+	struct aa_audit base;
+
+	const char *name;
+	const char *name2;
+	const struct aa_ext *e;
+};
+
+static void aa_audit_init(struct aa_audit_iface *sa, const char *operation,
+			  struct aa_ext *e)
+{
+	memset(sa, 0, sizeof(*sa));
+	sa->base.operation = operation;
+	sa->base.gfp_mask = GFP_KERNEL;
+	sa->e = e;
+}
+
+static void audit_cb(struct audit_buffer *ab, void *va)
+{
+	struct aa_audit_iface *sa = va;
+
+	if (sa->name)
+		audit_log_format(ab, " name=%s", sa->name);
+	if (sa->name2)
+		audit_log_format(ab, " namespace=%s", sa->name2);
+	if (sa->base.error && sa->e) {
+		long len = sa->e->pos - sa->e->start;
+		audit_log_format(ab, " offset=%ld", len);
+	}
+}
+
+static int aa_audit_iface(struct aa_audit_iface *sa)
+{
+	struct aa_profile *profile;
+	struct cred *cred = aa_get_task_policy(current, &profile);
+	int error = aa_audit(AUDIT_APPARMOR_STATUS, profile, &sa->base,
+			     audit_cb);
+	put_cred(cred);
+	return error;
+}
+
+static int aa_inbounds(struct aa_ext *e, size_t size)
+{
+	return (size <= e->end - e->pos);
+}
+
+/**
+ * aa_u16_chunck - test and do bounds checking for a u16 size based chunk
+ * @e: serialized data read head
+ * @chunk: start address for chunk of data
+ *
+ * return the size of chunk found with the read head at the end of
+ * the chunk.
+ */
+static size_t aa_is_u16_chunk(struct aa_ext *e, char **chunk)
+{
+	void *pos = e->pos;
+	size_t size = 0;
+
+	if (!aa_inbounds(e, sizeof(u16)))
+		goto fail;
+	size = le16_to_cpu(get_unaligned((u16 *)e->pos));
+	e->pos += sizeof(u16);
+	if (!aa_inbounds(e, size))
+		goto fail;
+	*chunk = e->pos;
+	e->pos += size;
+	return size;
+
+fail:
+	e->pos = pos;
+	return 0;
+}
+
+static int aa_is_X(struct aa_ext *e, enum aa_code code)
+{
+	if (!aa_inbounds(e, 1))
+		return 0;
+	if (*(u8 *) e->pos != code)
+		return 0;
+	e->pos++;
+	return 1;
+}
+
+/**
+ * aa_is_nameX - check is the next element is of type X with a name of @name
+ * @e: serialized data extent information
+ * @code: type code
+ * @name: name to match to the serialized element.
+ *
+ * check that the next serialized data element is of type X and has a tag
+ * name @name.  If @name is specified then there must be a matching
+ * name element in the stream.  If @name is NULL any name element will be
+ * skipped and only the typecode will be tested.
+ * returns 1 on success (both type code and name tests match) and the read
+ * head is advanced past the headers
+ * returns %0 if either match failes, the read head does not move
+ */
+static int aa_is_nameX(struct aa_ext *e, enum aa_code code, const char *name)
+{
+	void *pos = e->pos;
+	/*
+	 * Check for presence of a tagname, and if present name size
+	 * AA_NAME tag value is a u16.
+	 */
+	if (aa_is_X(e, AA_NAME)) {
+		char *tag = NULL;
+		size_t size = aa_is_u16_chunk(e, &tag);
+		/* if a name is specified it must match. otherwise skip tag */
+		if (name && (!size || strcmp(name, tag)))
+			goto fail;
+	} else if (name) {
+		/* if a name is specified and there is no name tag fail */
+		goto fail;
+	}
+
+	/* now check if type code matches */
+	if (aa_is_X(e, code))
+		return 1;
+
+fail:
+	e->pos = pos;
+	return 0;
+}
+
+static int aa_is_u16(struct aa_ext *e, u16 *data, const char *name)
+{
+	void *pos = e->pos;
+	if (aa_is_nameX(e, AA_U16, name)) {
+		if (!aa_inbounds(e, sizeof(u16)))
+			goto fail;
+		if (data)
+			*data = le16_to_cpu(get_unaligned((u16 *)e->pos));
+		e->pos += sizeof(u16);
+		return 1;
+	}
+fail:
+	e->pos = pos;
+	return 0;
+}
+
+static int aa_is_u32(struct aa_ext *e, u32 *data, const char *name)
+{
+	void *pos = e->pos;
+	if (aa_is_nameX(e, AA_U32, name)) {
+		if (!aa_inbounds(e, sizeof(u32)))
+			goto fail;
+		if (data)
+			*data = le32_to_cpu(get_unaligned((u32 *)e->pos));
+		e->pos += sizeof(u32);
+		return 1;
+	}
+fail:
+	e->pos = pos;
+	return 0;
+}
+
+static int aa_is_u64(struct aa_ext *e, u64 *data, const char *name)
+{
+	void *pos = e->pos;
+	if (aa_is_nameX(e, AA_U64, name)) {
+		if (!aa_inbounds(e, sizeof(u64)))
+			goto fail;
+		if (data)
+			*data = le64_to_cpu(get_unaligned((u64 *)e->pos));
+		e->pos += sizeof(u64);
+		return 1;
+	}
+fail:
+	e->pos = pos;
+	return 0;
+}
+
+static size_t aa_is_array(struct aa_ext *e, const char *name)
+{
+	void *pos = e->pos;
+	if (aa_is_nameX(e, AA_ARRAY, name)) {
+		int size;
+		if (!aa_inbounds(e, sizeof(u16)))
+			goto fail;
+		size = (int) le16_to_cpu(get_unaligned((u16 *)e->pos));
+		e->pos += sizeof(u16);
+		return size;
+	}
+fail:
+	e->pos = pos;
+	return 0;
+}
+
+static size_t aa_is_blob(struct aa_ext *e, char **blob, const char *name)
+{
+	void *pos = e->pos;
+	if (aa_is_nameX(e, AA_BLOB, name)) {
+		u32 size;
+		if (!aa_inbounds(e, sizeof(u32)))
+			goto fail;
+		size = le32_to_cpu(get_unaligned((u32 *)e->pos));
+		e->pos += sizeof(u32);
+		if (aa_inbounds(e, (size_t) size)) {
+			*blob = e->pos;
+			e->pos += size;
+			return size;
+		}
+	}
+fail:
+	e->pos = pos;
+	return 0;
+}
+
+static int aa_is_string(struct aa_ext *e, char **string, const char *name)
+{
+	char *src_str;
+	size_t size = 0;
+	void *pos = e->pos;
+	*string = NULL;
+	if (aa_is_nameX(e, AA_STRING, name) &&
+	    (size = aa_is_u16_chunk(e, &src_str))) {
+		/* strings are null terminated, length is size - 1 */
+		if (src_str[size - 1] != 0)
+			goto fail;
+		*string = src_str;
+	}
+
+	return size;
+
+fail:
+	e->pos = pos;
+	return 0;
+}
+
+static int aa_is_dynstring(struct aa_ext *e, char **string, const char *name)
+{
+	char *tmp;
+	void *pos = e->pos;
+	int res = aa_is_string(e, &tmp, name);
+	*string = NULL;
+
+	if (!res)
+		return res;
+
+	*string = kstrdup(tmp, GFP_KERNEL);
+	if (!*string) {
+		e->pos = pos;
+		return 0;
+	}
+
+	return res;
+}
+
+/**
+ * aa_unpack_dfa - unpack a file rule dfa
+ * @e: serialized data extent information
+ *
+ * returns dfa or ERR_PTR
+ */
+static struct aa_dfa *aa_unpack_dfa(struct aa_ext *e)
+{
+	char *blob = NULL;
+	size_t size, error = 0;
+	struct aa_dfa *dfa = NULL;
+
+	size = aa_is_blob(e, &blob, "aadfa");
+	if (size) {
+		dfa = aa_match_alloc();
+		if (dfa) {
+			/*
+			 * The dfa is aligned with in the blob to 8 bytes
+			 * from the beginning of the stream.
+			 */
+			size_t sz = blob - (char *) e->start;
+			size_t pad = ALIGN(sz, 8) - sz;
+			error = unpack_dfa(dfa, blob + pad, size - pad);
+			if (!error)
+				error = verify_dfa(dfa);
+		} else {
+			error = -ENOMEM;
+		}
+
+		if (error) {
+			aa_match_free(dfa);
+			dfa = ERR_PTR(error);
+		}
+	}
+
+	return dfa;
+}
+
+static int aa_unpack_trans_table(struct aa_ext *e, struct aa_profile *profile)
+{
+	void *pos = e->pos;
+
+	/* exec table is optional */
+	if (aa_is_nameX(e, AA_STRUCT, "xtable")) {
+		int i, size;
+
+		size = aa_is_array(e, NULL);
+		/* currently 4 exec bits and entries 0-3 are reserved iupcx */
+		if (size > 16 - 4)
+			goto fail;
+		profile->file.trans.table = kzalloc(sizeof(char *) * size,
+							  GFP_KERNEL);
+		if (!profile->file.trans.table)
+			goto fail;
+
+		for (i = 0; i < size; i++) {
+		    char *tmp;
+			if (!aa_is_dynstring(e, &tmp, NULL))
+				goto fail;
+			/* note: strings beginning with a : have an embedded
+			   \0 seperating the profile ns name from the profile
+			   name */
+			profile->file.trans.table[i] = tmp;
+		}
+		if (!aa_is_nameX(e, AA_ARRAYEND, NULL))
+			goto fail;
+		if (!aa_is_nameX(e, AA_STRUCTEND, NULL))
+			goto fail;
+		profile->file.trans.size = size;
+	}
+	return 1;
+
+fail:
+	e->pos = pos;
+	return 0;
+}
+
+int aa_unpack_rlimits(struct aa_ext *e, struct aa_profile *profile)
+{
+	void *pos = e->pos;
+
+	/* rlimits are optional */
+	if (aa_is_nameX(e, AA_STRUCT, "rlimits")) {
+		int i, size;
+		u32 tmp = 0;
+		if (!aa_is_u32(e, &tmp, NULL))
+			goto fail;
+		profile->rlimits.mask = tmp;
+
+		size = aa_is_array(e, NULL);
+		if (size > RLIM_NLIMITS)
+			goto fail;
+		for (i = 0; i < size; i++) {
+			u64 tmp = 0;
+			if (!aa_is_u64(e, &tmp, NULL))
+				goto fail;
+			profile->rlimits.limits[i].rlim_max = tmp;
+		}
+		if (!aa_is_nameX(e, AA_ARRAYEND, NULL))
+			goto fail;
+		if (!aa_is_nameX(e, AA_STRUCTEND, NULL))
+			goto fail;
+	}
+	return 1;
+
+fail:
+	e->pos = pos;
+	return 0;
+}
+
+/**
+ * aa_unpack_profile - unpack a serialized profile
+ * @e: serialized data extent information
+ * @sa: audit struct for the operation
+ */
+static struct aa_profile *aa_unpack_profile(struct aa_ext *e,
+					    struct aa_audit_iface *sa)
+{
+	struct aa_profile *profile = NULL;
+	char *name;
+	size_t size = 0;
+	int i, error = -EPROTO;
+	u32 tmp;
+
+	/* check that we have the right struct being passed */
+	if (!aa_is_nameX(e, AA_STRUCT, "profile"))
+		goto fail;
+	if (!aa_is_string(e, &name, NULL))
+		goto fail;
+
+	profile = alloc_aa_profile(name);
+	if (!profile)
+		return ERR_PTR(-ENOMEM);
+
+	/* xmatch is optional and may be NULL */
+	profile->xmatch = aa_unpack_dfa(e);
+	if (IS_ERR(profile->xmatch)) {
+		error = PTR_ERR(profile->xmatch);
+		profile->xmatch = NULL;
+		goto fail;
+	}
+	/* xmatch_len is not optional is xmatch is set */
+	if (profile->xmatch && !aa_is_u32(e, &tmp, NULL))
+		goto fail;
+	profile->xmatch_len = tmp;
+
+	/* per profile debug flags (complain, audit) */
+	if (!aa_is_nameX(e, AA_STRUCT, "flags"))
+		goto fail;
+	if (!aa_is_u32(e, &tmp, NULL))
+		goto fail;
+	if (tmp)
+		profile->flags |= PFLAG_HAT;
+	if (!aa_is_u32(e, &tmp, NULL))
+		goto fail;
+	if (tmp)
+		profile->mode = APPARMOR_COMPLAIN;
+	if (!aa_is_u32(e, &tmp, NULL))
+		goto fail;
+	if (tmp)
+		profile->audit = AUDIT_ALL;
+
+	if (!aa_is_nameX(e, AA_STRUCTEND, NULL))
+		goto fail;
+
+	if (!aa_is_u32(e, &(profile->caps.allowed.cap[0]), NULL))
+		goto fail;
+	if (!aa_is_u32(e, &(profile->caps.audit.cap[0]), NULL))
+		goto fail;
+	if (!aa_is_u32(e, &(profile->caps.quiet.cap[0]), NULL))
+		goto fail;
+	if (!aa_is_u32(e, &(profile->caps.set.cap[0]), NULL))
+		goto fail;
+
+	if (aa_is_nameX(e, AA_STRUCT, "caps64")) {
+		/* optional upper half of 64 bit caps */
+		if (!aa_is_u32(e, &(profile->caps.allowed.cap[1]), NULL))
+			goto fail;
+		if (!aa_is_u32(e, &(profile->caps.audit.cap[1]), NULL))
+			goto fail;
+		if (!aa_is_u32(e, &(profile->caps.quiet.cap[1]), NULL))
+			goto fail;
+		if (!aa_is_u32(e, &(profile->caps.set.cap[1]), NULL))
+			goto fail;
+		if (!aa_is_nameX(e, AA_STRUCTEND, NULL))
+			goto fail;
+	}
+
+	if (!aa_unpack_rlimits(e, profile))
+		goto fail;
+
+	size = aa_is_array(e, "net_allowed_af");
+	if (size) {
+		if (size > AF_MAX)
+			goto fail;
+
+		for (i = 0; i < size; i++) {
+			if (!aa_is_u16(e, &profile->net.allowed[i], NULL))
+				goto fail;
+			if (!aa_is_u16(e, &profile->net.audit[i], NULL))
+				goto fail;
+			if (!aa_is_u16(e, &profile->net.quiet[i], NULL))
+				goto fail;
+		}
+		if (!aa_is_nameX(e, AA_ARRAYEND, NULL))
+			goto fail;
+		/* allow unix domain and netlink sockets they are handled
+		 * by IPC
+		 */
+	}
+	profile->net.allowed[AF_UNIX] = 0xffff;
+	profile->net.allowed[AF_NETLINK] = 0xffff;
+
+	/* get file rules */
+	profile->file.dfa = aa_unpack_dfa(e);
+	if (IS_ERR(profile->file.dfa)) {
+		error = PTR_ERR(profile->file.dfa);
+		profile->file.dfa = NULL;
+		goto fail;
+	}
+
+	if (!aa_unpack_trans_table(e, profile))
+		goto fail;
+
+	if (!aa_is_nameX(e, AA_STRUCTEND, NULL))
+		goto fail;
+
+	return profile;
+
+fail:
+	sa->name = profile && profile->base.name ? profile->base.name :
+						   "unknown";
+	if (!sa->base.info)
+		sa->base.info = "failed to unpack profile";
+	aa_audit_iface(sa);
+
+	free_aa_profile(profile);
+
+	return ERR_PTR(error);
+}
+
+/**
+ * aa_verify_head - unpack serialized stream header
+ * @e: serialized data read head
+ * @operation: operation header is being verified for
+ *
+ * returns error or 0 if header is good
+ */
+static int aa_verify_header(struct aa_ext *e, struct aa_audit_iface *sa)
+{
+	/* get the interface version */
+	if (!aa_is_u32(e, &e->version, "version")) {
+		sa->base.info = "invalid profile format";
+		aa_audit_iface(sa);
+		return -EPROTONOSUPPORT;
+	}
+
+	/* check that the interface version is currently supported */
+	if (e->version != 5) {
+		sa->base.info = "unsupported interface version";
+		aa_audit_iface(sa);
+		return -EPROTONOSUPPORT;
+	}
+
+	/* read the namespace if present */
+	if (!aa_is_string(e, &e->ns_name, "namespace"))
+		e->ns_name = NULL;
+
+	return 0;
+}
+
+
+
+/**
+ * aa_interface_add_profiles - Unpack and add new profile(s) to the profile list
+ * @data: serialized data stream
+ * @size: size of the serialized data stream
+ */
+ssize_t aa_interface_add_profiles(void *data, size_t size)
+{
+	struct aa_profile *profile;
+	struct aa_namespace *ns = NULL;
+	struct aa_policy_common *common;
+	struct aa_ext e = {
+		.start = data,
+		.end = data + size,
+		.pos = data,
+		.ns_name = NULL
+	};
+	ssize_t error;
+	struct aa_audit_iface sa;
+	aa_audit_init(&sa, "profile_load", &e);
+
+	error = aa_verify_header(&e, &sa);
+	if (error)
+		return error;
+
+	profile = aa_unpack_profile(&e, &sa);
+	if (IS_ERR(profile))
+		return PTR_ERR(profile);
+
+	sa.name2 = e.ns_name;
+	ns = aa_prepare_namespace(e.ns_name);
+	if (IS_ERR(ns)) {
+		sa.base.info = "failed to prepare namespace";
+		sa.base.error = PTR_ERR(ns);
+		goto fail;
+	}
+	/* profiles are currently loaded flat with fqnames */
+	sa.name = profile->fqname;
+
+	write_lock(&ns->base.lock);
+
+	common = __aa_find_parent_by_fqname(ns, sa.name);
+	if (!common) {
+		sa.base.info = "parent does not exist";
+		sa.base.error = -ENOENT;
+		goto fail2;
+	}
+
+	if (common != &ns->base)
+		profile->parent = aa_get_profile((struct aa_profile *) common);
+
+	if (__aa_find_profile(&common->profiles, profile->base.name)) {
+		/* A profile with this name exists already. */
+		sa.base.info = "profile already exists";
+		sa.base.error = -EEXIST;
+		goto fail2;
+	}
+	profile->sid = aa_alloc_sid(AA_ALLOC_SYS_SID);
+	profile->ns = aa_get_namespace(ns);
+
+	__aa_add_profile(common, profile);
+	write_unlock(&ns->base.lock);
+
+	aa_audit_iface(&sa);
+	aa_put_namespace(ns);
+	kfree(e.ns_name);
+	return size;
+
+fail2:
+	write_unlock(&ns->base.lock);
+
+fail:
+	error = aa_audit_iface(&sa);
+	aa_put_namespace(ns);
+	aa_put_profile(profile);
+	kfree(e.ns_name);
+	return error;
+}
+
+/**
+ * aa_interface_replace_profiles - replace profile(s) on the profile list
+ * @udata: serialized data stream
+ * @size: size of the serialized data stream
+ *
+ * unpack and replace a profile on the profile list and uses of that profile
+ * by any aa_task_context.  If the profile does not exist on the profile list
+ * it is added.  Return %0 or error.
+ */
+ssize_t aa_interface_replace_profiles(void *udata, size_t size)
+{
+	struct aa_policy_common *common;
+	struct aa_profile *old_profile = NULL, *new_profile;
+	struct aa_namespace *ns;
+	struct aa_ext e = {
+		.start = udata,
+		.end = udata + size,
+		.pos = udata,
+		.ns_name = NULL
+	};
+	ssize_t error;
+	struct aa_audit_iface sa;
+	aa_audit_init(&sa, "profile_replace", &e);
+
+	if (g_apparmor_lock_policy)
+		return -EACCES;
+
+	error = aa_verify_header(&e, &sa);
+	if (error)
+		return error;
+
+	new_profile = aa_unpack_profile(&e, &sa);
+	if (IS_ERR(new_profile))
+		return PTR_ERR(new_profile);
+
+	sa.name2 = e.ns_name;
+	ns = aa_prepare_namespace(e.ns_name);
+	if (!ns) {
+		sa.base.info = "failed to prepare namespace";
+		sa.base.error = -ENOMEM;
+		goto fail;
+	}		
+
+	sa.name = new_profile->fqname;
+
+	write_lock(&ns->base.lock);
+	common = __aa_find_parent_by_fqname(ns, sa.name);
+
+	if (!common) {
+		sa.base.info = "parent does not exist";
+		sa.base.error = -ENOENT;
+		goto fail2;
+	}
+
+	if (common != &ns->base)
+		new_profile->parent = aa_get_profile((struct aa_profile *)
+						     common);
+
+	old_profile = __aa_find_profile(&common->profiles,
+					new_profile->base.name);
+	aa_get_profile(old_profile);
+	if (old_profile && old_profile->flags & PFLAG_IMMUTABLE) {
+		sa.base.info = "cannot replace immutible profile";
+		sa.base.error = -EPERM;
+		goto fail2;
+	} else  if (old_profile) {
+	  //		__aa_profile_list_release(&old_profile->base.profiles);
+		/* TODO: remove for new interface
+		 * move children profiles over to the new profile so
+		 * that replacement behaves correctly
+		 */
+	  //		list_replace_init(&old_profile->base.profiles,
+	  //				  &new_profile->base.profiles);
+	  struct aa_profile *profile, *tmp;
+	  list_for_each_entry_safe(profile, tmp, &old_profile->base.profiles,
+				    base.list) {
+			aa_put_profile(profile->parent);
+			list_del(&profile->base.list);
+			profile->parent = aa_get_profile(new_profile);
+			list_add(&profile->base.list,
+				 &new_profile->base.profiles);
+		}
+		__aa_replace_profile(old_profile, new_profile);
+		new_profile->sid = old_profile->sid;
+	} else {
+		__aa_add_profile(common, new_profile);
+		new_profile->sid = aa_alloc_sid(AA_ALLOC_SYS_SID);
+	}
+
+	new_profile->ns = aa_get_namespace(ns);
+
+	write_unlock(&ns->base.lock);
+
+	if (!old_profile)
+		sa.base.operation = "profile_load";
+
+	aa_audit_iface(&sa);
+	aa_put_namespace(ns);
+	aa_put_profile(old_profile);
+	kfree(e.ns_name);
+	return size;
+
+fail2:
+	write_unlock(&ns->base.lock);
+fail:
+	error = aa_audit_iface(&sa);
+	aa_put_namespace(ns);
+	aa_put_profile(old_profile);
+	aa_put_profile(new_profile);
+	kfree(e.ns_name);
+	return error;
+}
+
+/**
+ * aa_interface_remove_profiles - remove profile(s) from the system
+ * @name: name of the profile to remove
+ * @size: size of the name
+ *
+ * remove a profile from the profile list and all aa_task_context references
+ * to said profile.
+ * NOTE: removing confinement does not restore rlimits to preconfinemnet values
+ */
+ssize_t aa_interface_remove_profiles(char *name, size_t size)
+{
+	struct aa_namespace *ns;
+	struct aa_profile *profile;
+	struct aa_audit_iface sa;
+	aa_audit_init(&sa, "profile_remove", NULL);
+
+	if (g_apparmor_lock_policy)
+		return -EACCES;
+
+	write_lock(&ns_list_lock);
+	if (name[0] == ':') {
+		char *ns_name;
+		name = aa_split_name_from_ns(name, &ns_name);
+		ns = __aa_find_namespace(&ns_list, ns_name);
+	} else {
+		ns = aa_get_namespace(default_namespace);
+	}
+
+	if (!ns) {
+		sa.base.info = "failed: namespace does not exist";
+		goto fail_ns_list_lock;
+	}
+
+	sa.name2 = ns->base.name;
+	write_lock(&ns->base.lock);
+	if (!name) {
+		/* remove namespace */
+	  //		__aa_remove_namespace(ns);
+	} else {
+		/* remove profile */
+		profile = __aa_find_profile_by_fqname(ns, name);
+		if (!profile) {
+			sa.name = name;
+			sa.base.info = "failed: profile does not exist";
+			goto fail_ns_lock;
+		}
+		sa.name = profile->fqname;
+		__aa_profile_list_release(&profile->base.profiles);
+		__aa_remove_profile(profile, profile->ns->unconfined);
+	}
+	write_unlock(&ns->base.lock);
+	write_unlock(&ns_list_lock);
+
+	aa_audit_iface(&sa);
+	aa_put_namespace(ns);
+	return size;
+
+fail_ns_lock:
+	write_unlock(&ns->base.lock);
+
+fail_ns_list_lock:
+	write_unlock(&ns_list_lock);
+	aa_audit_iface(&sa);
+	return -ENOENT;
+}
--- linux-rt-2.6.31.orig/ubuntu/apparmor/lib.c
+++ linux-rt-2.6.31/ubuntu/apparmor/lib.c
@@ -0,0 +1,100 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains basic common functions used in AppArmor
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#include <linux/slab.h>
+#include <linux/string.h>
+
+#include "include/audit.h"
+
+void info_message(const char *str)
+{
+	struct aa_audit sa;
+	memset(&sa, 0, sizeof(sa));
+	sa.gfp_mask = GFP_KERNEL;
+	sa.info = str;
+	printk(KERN_INFO "AppArmor: %s\n", str);
+	if (audit_enabled)
+		aa_audit(AUDIT_APPARMOR_STATUS, NULL, &sa, NULL);
+}
+
+char *strchrnul(const char *s, int c)
+{
+	for (; *s != (char)c && *s != '\0'; ++s)
+		;
+	return (char *)s;
+}
+
+char *aa_split_name_from_ns(char *args, char **ns_name)
+{
+	char *name = strstrip(args);
+
+	*ns_name  = NULL;
+	if (args[0] == ':') {
+		char *split = strstrip(strchr(&args[1], ':'));
+
+		if (!split)
+			return NULL;
+
+		*split = 0;
+		*ns_name = &args[1];
+		name = strstrip(split + 1);
+	}
+	if (*name == 0)
+		name = NULL;
+
+	return name;
+}
+
+char *new_compound_name(const char *n1, const char *n2)
+{
+	char *name = kmalloc(strlen(n1) + strlen(n2) + 3, GFP_KERNEL);
+	if (name)
+		sprintf(name, "%s//%s", n1, n2);
+	return name;
+}
+
+/**
+ * aa_strneq - compare null terminated @str to a non null terminated substring
+ * @str: a null terminated string
+ * @sub: a substring, not necessarily null terminated
+ * @len: length of @sub to compare
+ *
+ * The @str string must be full consumed for this to be considered a match
+ */
+int aa_strneq(const char *str, const char *sub, int len)
+{
+	int res = strncmp(str, sub, len);
+	if (res)
+		return 0;
+	if (str[len] == 0)
+		return 1;
+	return 0;
+}
+
+const char *fqname_subname(const char *name)
+{
+	char *split;
+	/* check for namespace which begins with a : and ends with : or \0 */
+	name = strstrip((char *) name);
+	if (*name == ':') {
+		split = strchrnul(name + 1, ':');
+		if (*split == '\0')
+			return NULL;
+		name = strstrip(split + 1);
+	}
+	for (split = strstr(name, "//"); split; split = strstr(name, "//")) {
+		name = split + 2;
+	}
+	return name;
+}
--- linux-rt-2.6.31.orig/ubuntu/apparmor/capability.c
+++ linux-rt-2.6.31/ubuntu/apparmor/capability.c
@@ -0,0 +1,123 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor capability mediation functions
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#include <linux/capability.h>
+#include <linux/errno.h>
+#include <linux/gfp.h>
+
+#include "include/apparmor.h"
+#include "include/capability.h"
+#include "include/context.h"
+#include "include/policy.h"
+#include "include/audit.h"
+
+/*
+ * Table of capability names: we generate it from capabilities.h.
+ */
+#include "capability_names.h"
+
+struct audit_cache {
+	struct task_struct *task;
+	kernel_cap_t caps;
+};
+
+static DEFINE_PER_CPU(struct audit_cache, audit_cache);
+
+struct aa_audit_caps {
+	struct aa_audit base;
+
+	int cap;
+};
+
+static void audit_cb(struct audit_buffer *ab, void *va)
+{
+	struct aa_audit_caps *sa = va;
+
+	audit_log_format(ab, " name=");
+	audit_log_untrustedstring(ab, capability_names[sa->cap]);
+}
+
+static int aa_audit_caps(struct aa_profile *profile, struct aa_audit_caps *sa)
+{
+	struct audit_cache *ent;
+	int type = AUDIT_APPARMOR_AUTO;
+
+	if (likely(!sa->base.error)) {
+		/* test if auditing is being forced */
+		if (likely((PROFILE_AUDIT_MODE(profile) != AUDIT_ALL) &&
+			   !cap_raised(profile->caps.audit, sa->cap)))
+			return 0;
+		type = AUDIT_APPARMOR_AUDIT;
+	} else if (PROFILE_KILL(profile) ||
+		   cap_raised(profile->caps.kill, sa->cap)) {
+		type = AUDIT_APPARMOR_KILL;
+	} else if (cap_raised(profile->caps.quiet, sa->cap) &&
+		   PROFILE_AUDIT_MODE(profile) != AUDIT_NOQUIET &&
+		   PROFILE_AUDIT_MODE(profile) != AUDIT_ALL) {
+		/* quiet auditing */
+		return sa->base.error;
+	}
+
+	/* Do simple duplicate message elimination */
+	ent = &get_cpu_var(audit_cache);
+	if (sa->base.task == ent->task && cap_raised(ent->caps, sa->cap)) {
+		put_cpu_var(audit_cache);
+		if (PROFILE_COMPLAIN(profile))
+			return 0;
+		return sa->base.error;
+	} else {
+		ent->task = sa->base.task;
+		cap_raise(ent->caps, sa->cap);
+	}
+	put_cpu_var(audit_cache);
+
+	return aa_audit(type, profile, &sa->base, audit_cb);
+}
+
+int aa_profile_capable(struct aa_profile *profile, int cap)
+{
+	return cap_raised(profile->caps.allowed, cap) ? 0 : -EPERM;
+}
+
+/**
+ * aa_capable - test permission to use capability
+ * @task: task doing capability test against
+ * @profile: profile confining @task
+ * @cap: capability to be tested
+ * @audit: whether an audit record should be generated
+ *
+ * Look up capability in profile capability set.
+ * Returns 0 on success, or else an error code.
+ */
+int aa_capable(struct task_struct *task, struct aa_profile *profile, int cap,
+	       int audit)
+{
+	int error = aa_profile_capable(profile, cap);
+	struct aa_audit_caps sa;
+
+	if (!audit) {
+		if (PROFILE_COMPLAIN(profile))
+			return 0;
+		return error;
+	}
+
+	memset(&sa, 0, sizeof(sa));
+	sa.base.operation = "capable";
+	sa.base.task = task;
+	sa.base.gfp_mask = GFP_ATOMIC;
+	sa.base.error = error;
+	sa.cap = cap;
+
+	return aa_audit_caps(profile, &sa);
+}
--- linux-rt-2.6.31.orig/ubuntu/apparmor/file.c
+++ linux-rt-2.6.31/ubuntu/apparmor/file.c
@@ -0,0 +1,426 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor mediation of files
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#include "include/apparmor.h"
+#include "include/audit.h"
+#include "include/file.h"
+#include "include/match.h"
+#include "include/path.h"
+#include "include/policy.h"
+
+struct file_perms nullperms;
+
+static void aa_audit_file_sub_mask(struct audit_buffer *ab, char *buffer,
+				   u16 mask, u16 xindex)
+{
+
+  /*	const char xchar[] = "PpCc";*/
+
+	char *m = buffer;
+
+	if (mask & AA_EXEC_MMAP)
+		*m++ = 'm';
+	if (mask & MAY_READ)
+		*m++ = 'r';
+	if (mask & (MAY_WRITE | AA_MAY_CREATE))
+		*m++ = 'w';
+	else if (mask & MAY_APPEND)
+		*m++ = 'a';
+	if (mask & AA_MAY_LINK)
+		*m++ = 'l';
+	if (mask & AA_MAY_LOCK)
+		*m++ = 'k';
+	if (mask & MAY_EXEC) {
+		*m++ = 'x';
+
+/* FIXME: only want more advanced auditing of x if in audit/hint mode
+		u16 index = xindex & AA_X_INDEX_MASK;
+		u16 xtype = xindex & AA_X_TYPE_MASK;
+		if (xtype > AA_X_NONE)
+			*m++ = xchar[(xindex >> 12) & 0x3];
+		if (xindex & AA_X_INHERIT) {
+			*m++ = 'i';
+		} else if (xindex & AA_X_UNCONFINED) {
+			if (xindex & AA_X_UNSAFE)
+				*m++ = 'u';
+			else
+				*m++ = 'U';
+		}
+		*m++ = 'x';
+		/ * at most 7 character including trailing \0 * /
+		if (xtype == AA_X_VARIABLE) {
+			m += sprintf(m, "->v%x", index);
+		} else if (xtype == AA_X_TABLE) {
+			m += sprintf(m, "->n%x", index);
+		}
+*/
+	}
+	*m++ = '\0';
+}
+
+static void aa_audit_file_mask(struct audit_buffer *ab, const char *name,
+			       u16 mask, int xindex, int owner)
+{
+/*	char str[18]; */
+	char str[10];
+
+	aa_audit_file_sub_mask(ab, str, mask, xindex);
+	if (owner)
+		audit_log_format(ab, " %s=\"%s::\"", name, str);
+	else
+		audit_log_format(ab, " %s=\"::%s\"", name, str);
+}
+
+void file_audit_cb(struct audit_buffer *ab, void *va)
+{
+	struct aa_audit_file *sa = va;
+	u16 denied = sa->request & ~sa->perms.allowed;
+	uid_t fsuid;
+
+	if (sa->base.task)
+		fsuid = task_uid(sa->base.task);
+	else
+		fsuid = current_fsuid();
+
+	if (sa->request & AA_AUDIT_FILE_MASK)
+		aa_audit_file_mask(ab, "requested_mask", sa->request,
+				   AA_X_NONE, fsuid == sa->cond->uid);
+
+	if (denied & AA_AUDIT_FILE_MASK)
+		aa_audit_file_mask(ab, "denied_mask", denied, sa->perms.xindex,
+			fsuid == sa->cond->uid);
+
+	if (sa->request & AA_AUDIT_FILE_MASK) {
+		audit_log_format(ab, " fsuid=%d", fsuid);
+		audit_log_format(ab, " ouid=%d", sa->cond->uid);
+	}
+
+	if (sa->name) {
+		audit_log_format(ab, " name=");
+		audit_log_untrustedstring(ab, sa->name);
+	}
+
+	if (sa->name2) {
+		audit_log_format(ab, " name2=");
+		audit_log_untrustedstring(ab, sa->name2);
+	}
+
+	if (sa->name3) {
+		audit_log_format(ab, " name3=");
+		audit_log_untrustedstring(ab, sa->name3);
+	}
+}
+
+int aa_audit_file(struct aa_profile *profile, struct aa_audit_file *sa)
+{
+	int type = AUDIT_APPARMOR_AUTO;
+
+	if (likely(!sa->base.error)) {
+		u16 mask = sa->perms.audit;
+
+		if (unlikely(PROFILE_AUDIT_MODE(profile) == AUDIT_ALL))
+			mask = 0xffff;
+
+		/* mask off perms that are not being force audited */
+		sa->request &= mask;
+
+		if (likely(!sa->request))
+			return 0;
+		type = AUDIT_APPARMOR_AUDIT;
+	} else {
+		/* quiet auditing of specific known rejects */
+		u16 mask = sa->perms.quiet;
+		u16 denied = sa->request & ~sa->perms.allowed;
+
+		if (denied & sa->perms.kill)
+			type = AUDIT_APPARMOR_KILL;
+
+		/* assumes quiet and kill do not overlap */
+		if ((denied & mask) &&
+		    PROFILE_AUDIT_MODE(profile) != AUDIT_NOQUIET &&
+		    PROFILE_AUDIT_MODE(profile) != AUDIT_ALL)
+			denied &= ~mask;
+
+		if (!denied)
+			return PROFILE_COMPLAIN(profile) ? 0 : sa->base.error;
+	}
+	return aa_audit(type, profile, (struct aa_audit *)sa, file_audit_cb);
+}
+
+/* FIXME: convert from dfa + state to permission entry */
+struct file_perms aa_compute_perms(struct aa_dfa *dfa, unsigned int state,
+				   struct path_cond *cond)
+{
+	struct file_perms perms;
+
+	/* FIXME: change over to new dfa format */
+	/* currently file perms are encoded in the dfa */
+	perms.kill = 0;
+	perms.dindex = 0;
+
+	if (current_fsuid() == cond->uid) {
+		perms.allowed = dfa_user_allow(dfa, state);
+		perms.audit = dfa_user_audit(dfa, state);
+		perms.quiet = dfa_user_quiet(dfa, state);
+		perms.xindex = dfa_user_xindex(dfa, state);
+	} else {
+		perms.allowed = dfa_other_allow(dfa, state);
+		perms.audit = dfa_other_audit(dfa, state);
+		perms.quiet = dfa_other_quiet(dfa, state);
+		perms.xindex = dfa_other_xindex(dfa, state);
+	}
+	/* in the old mapping MAY_WRITE implies AA_MAY_CREATE */
+	perms.allowed |= (perms.allowed & MAY_WRITE) << 6;
+	perms.audit |= (perms.audit & MAY_WRITE) << 6;
+	perms.quiet |= (perms.quiet & MAY_WRITE) << 6;
+
+	/* in the old mapping AA_MAY_LOCK and link subset are overlayed
+	 * and only determined by which part of a pair they are  in
+	 */
+	if (perms.allowed & AA_MAY_LOCK)
+		perms.allowed |= AA_LINK_SUBSET;
+
+	/* change_profile wasn't determined by ownership in old mapping */
+	if (ACCEPT_TABLE(dfa)[state] & 0x80000000)
+		perms.allowed |= AA_MAY_CHANGE_PROFILE;
+
+	return perms;
+}
+
+struct file_perms aa_str_perms(struct aa_dfa *dfa, unsigned int start,
+			       const char *name, struct path_cond *cond,
+			       unsigned int *rstate)
+{
+	unsigned int state;
+	if (!dfa)
+		return nullperms;
+
+	state = aa_dfa_match(dfa, start, name);
+
+	if (rstate)
+		*rstate = state;
+
+	/* TODO: convert to new dfa format */
+
+	return aa_compute_perms(dfa, state, cond);
+}
+
+int aa_pathstr_perm(struct aa_profile *profile, const char *op,
+		    const char *name, u16 request, struct path_cond *cond)
+{
+	struct aa_audit_file sa;
+
+	memset(&sa, 0, sizeof(sa));
+	sa.base.operation = op;
+	sa.base.gfp_mask = GFP_KERNEL;
+	sa.request = request;
+	sa.name = name;
+	sa.cond = cond;
+
+	sa.perms = aa_str_perms(profile->file.dfa, DFA_START, sa.name, cond,
+				NULL);
+	if (request & ~sa.perms.allowed)
+		sa.base.error = -EACCES;
+	return aa_audit_file(profile, &sa);
+}
+
+int aa_path_perm(struct aa_profile *profile, const char *operation,
+		 struct path *path, u16 request, struct path_cond *cond)
+{
+	struct aa_audit_file sa;
+	char *buffer, *name;
+
+	memset(&sa, 0, sizeof(sa));
+	sa.base.operation = operation;
+	sa.base.gfp_mask = GFP_KERNEL;
+	sa.request = request;
+	sa.cond = cond;
+
+	sa.base.error = aa_get_name(path, S_ISDIR(cond->mode), &buffer,
+				    &name);
+	sa.name = name;
+	if (sa.base.error) {
+		sa.perms = nullperms;
+		if (sa.base.error == -ENOENT)
+			sa.base.info = "Failed name lookup - deleted entry";
+		else if (sa.base.error == -ESTALE)
+			sa.base.info = "Failed name lookup - disconnected path";
+		else if (sa.base.error == -ENAMETOOLONG)
+			sa.base.info = "Failed name lookup - name too long";
+		else
+			sa.base.info = "Failed name lookup";
+	} else {
+		sa.perms = aa_str_perms(profile->file.dfa, DFA_START, sa.name,
+					cond, NULL);
+		if (request & ~sa.perms.allowed)
+			sa.base.error = -EACCES;
+	}
+	sa.base.error = aa_audit_file(profile, &sa);
+	kfree(buffer);
+
+	return sa.base.error;
+}
+
+int aa_path_link(struct aa_profile *profile, struct dentry *old_dentry,
+		 struct path *new_dir, struct dentry *new_dentry)
+{
+	struct path link = { new_dir->mnt, new_dentry };
+	struct path target = { new_dir->mnt, old_dentry };
+	struct path_cond cond = { old_dentry->d_inode->i_uid,
+				  old_dentry->d_inode->i_mode };
+	char *buffer = NULL, *buffer2 = NULL;
+	char *lname, *tname;
+	struct file_perms perms;
+	unsigned int state;
+
+	struct aa_audit_file sa;
+	memset(&sa, 0, sizeof(sa));
+	sa.base.operation = "link";
+	sa.base.gfp_mask = GFP_KERNEL;
+	sa.request = AA_MAY_LINK;
+	sa.cond = &cond;
+	sa.perms = nullperms;
+
+	sa.base.error = aa_get_name(&link, 0, &buffer, &lname);
+	sa.name = lname;
+	if (sa.base.error)
+		goto audit;
+
+	sa.base.error = aa_get_name(&target, 0, &buffer2, &tname);
+	sa.name2 = tname;
+	if (sa.base.error)
+		goto audit;
+
+
+	sa.perms = aa_str_perms(profile->file.dfa, DFA_START, sa.name, &cond,
+			     &state);
+	sa.perms.audit &= AA_MAY_LINK;
+	sa.perms.quiet &= AA_MAY_LINK;
+	sa.perms.kill &= AA_MAY_LINK;
+
+	if (!(sa.perms.allowed & AA_MAY_LINK)) {
+		sa.base.error = -EACCES;
+		goto audit;
+	}
+
+	/* test to see if target can be paired with link */
+	state = aa_dfa_null_transition(profile->file.dfa, state);
+	perms = aa_str_perms(profile->file.dfa, state, sa.name2, &cond, NULL);
+	if (!(perms.allowed & AA_MAY_LINK)) {
+		sa.base.error = -EACCES;
+		sa.base.info = "target restricted";
+		goto audit;
+	}
+
+	/* done if link subset test is not required */
+	if (!(perms.allowed & AA_LINK_SUBSET))
+		goto audit;
+
+	/* Do link perm subset test requiring allowed permission on link are a
+	 * subset of the allowed permissions on target.
+	 */
+	perms = aa_str_perms(profile->file.dfa, DFA_START, sa.name2, &cond,
+			     NULL);
+
+	/* AA_MAY_LINK is not considered in the subset test */
+	sa.request = sa.perms.allowed & ~AA_MAY_LINK;
+	sa.perms.allowed &= perms.allowed | AA_MAY_LINK;
+
+	sa.request |= AA_AUDIT_FILE_MASK & (sa.perms.allowed & ~perms.allowed);
+	if (sa.request & ~sa.perms.allowed)
+		sa.base.error = -EACCES;
+	else if (sa.perms.allowed & MAY_EXEC) {
+		if (((sa.perms.xindex & ~AA_X_UNSAFE) !=
+		     (perms.xindex &~AA_X_UNSAFE)) ||
+		    ((sa.perms.xindex & AA_X_UNSAFE) &&
+		     !(perms.xindex & AA_X_UNSAFE))) {
+			sa.perms.allowed &= ~MAY_EXEC;
+			sa.request |= MAY_EXEC;
+			sa.base.error = -EACCES;
+			sa.base.info = "link not subset of target";
+		}
+	}
+
+audit:
+	sa.base.error = aa_audit_file(profile, &sa);
+	kfree(buffer);
+	kfree(buffer2);
+
+	return sa.base.error;
+}
+
+
+static inline int aa_is_deleted_file(struct dentry *dentry)
+{
+	if (d_unhashed(dentry))
+		return 1;
+	return 0;
+}
+
+int aa_file_common_perm(struct aa_profile *profile, const char *operation,
+			struct file *file, u16 request, const char *name,
+			int error)
+{
+	struct path_cond cond = { .uid = file->f_path.dentry->d_inode->i_uid,
+				 .mode = file->f_path.dentry->d_inode->i_mode };
+	struct aa_audit_file sa;
+
+	memset(&sa, 0, sizeof(sa));
+	sa.base.operation = operation;
+	sa.base.gfp_mask = GFP_KERNEL;
+	sa.request = request;
+	sa.base.error = error;
+	sa.name = name;
+	sa.cond = &cond;
+
+	if (sa.base.error) {
+		sa.perms = nullperms;
+		if (sa.base.error == -ENOENT &&
+		    aa_is_deleted_file(file->f_path.dentry)) {
+			/* Access to open files that are deleted are
+			 * give a pass (implicit delegation
+			 */
+			sa.base.error = 0;
+			sa.perms.allowed = sa.request;
+		} else if (sa.base.error == -ENOENT)
+			sa.base.info = "Failed name lookup - deleted entry";
+		else if (sa.base.error == -ESTALE)
+			sa.base.info = "Failed name lookup - disconnected path";
+		else if (sa.base.error == -ENAMETOOLONG)
+			sa.base.info = "Failed name lookup - name too long";
+		else
+			sa.base.info = "Failed name lookup";
+	} else {
+		sa.perms = aa_str_perms(profile->file.dfa, DFA_START, sa.name,
+					&cond, NULL);
+		if (request & ~sa.perms.allowed)
+			sa.base.error = -EACCES;
+	}
+	sa.base.error = aa_audit_file(profile, &sa);
+
+	return sa.base.error;
+}
+
+int aa_file_perm(struct aa_profile *profile, const char *operation,
+		 struct file *file, u16 request)
+{
+	char *buffer, *name;
+	umode_t mode = file->f_path.dentry->d_inode->i_mode;
+	int error = aa_get_name(&file->f_path, S_ISDIR(mode), &buffer, &name);
+
+	error = aa_file_common_perm(profile, operation, file, request, name,
+				    error);
+	kfree(buffer);
+	return error;
+}
--- linux-rt-2.6.31.orig/ubuntu/apparmor/Makefile
+++ linux-rt-2.6.31/ubuntu/apparmor/Makefile
@@ -0,0 +1,24 @@
+# Makefile for AppArmor Linux Security Module
+#
+obj-$(CONFIG_SECURITY_APPARMOR) += apparmor.o
+
+apparmor-y := apparmorfs.o audit.o capability.o context.o ipc.o lib.o match.o \
+              path.o domain.o policy.o policy_interface.o procattr.o lsm.o \
+              resource.o sid.o file.o
+
+apparmor-$(CONFIG_SECURITY_APPARMOR_NETWORK) += net.o
+
+clean-files: capability_names.h af_names.h
+
+quiet_cmd_make-caps = GEN     $@
+cmd_make-caps = echo "static const char *capability_names[] = {" > $@ ; sed -n -e "/CAP_FS_MASK/d" -e "s/^\#define[ \\t]\\+CAP_\\([A-Z0-9_]\\+\\)[ \\t]\\+\\([0-9]\\+\\)\$$/[\\2]  = \"\\1\",/p" $< | tr A-Z a-z >> $@ ; echo "};" >> $@
+
+quiet_cmd_make-af = GEN     $@
+cmd_make-af = echo "static const char *address_family_names[] = {" > $@ ; sed -n -e "/AF_MAX/d" -e "/AF_LOCAL/d" -e "s/^\#define[ \\t]\\+AF_\\([A-Z0-9_]\\+\\)[ \\t]\\+\\([0-9]\\+\\)\\(.*\\)\$$/[\\2]  = \"\\1\",/p" $< | tr A-Z a-z >> $@ ; echo "};" >> $@
+
+$(obj)/capability.o : $(obj)/capability_names.h
+$(obj)/net.o : $(obj)/af_names.h
+$(obj)/capability_names.h : $(srctree)/include/linux/capability.h
+	$(call cmd,make-caps)
+$(obj)/af_names.h : $(srctree)/include/linux/socket.h
+	$(call cmd,make-af)
--- linux-rt-2.6.31.orig/ubuntu/apparmor/apparmorfs.c
+++ linux-rt-2.6.31/ubuntu/apparmor/apparmorfs.c
@@ -0,0 +1,391 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor /proc/<pid>/attr interface functions
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#include <linux/security.h>
+#include <linux/vmalloc.h>
+#include <linux/module.h>
+#include <linux/seq_file.h>
+#include <linux/uaccess.h>
+#include <linux/namei.h>
+
+#include "include/apparmor.h"
+#include "include/audit.h"
+#include "include/context.h"
+#include "include/policy.h"
+#include "include/policy_interface.h"
+
+static char *aa_simple_write_to_buffer(const char __user *userbuf,
+				       size_t alloc_size, size_t copy_size,
+				       loff_t *pos, const char *operation)
+{
+	const struct cred *cred;
+	struct aa_profile *profile;
+	char *data;
+
+	if (*pos != 0) {
+		/* only writes from pos 0, that is complete writes */
+		data = ERR_PTR(-ESPIPE);
+		goto out;
+	}
+
+	/*
+	 * Don't allow confined processes to load/replace/remove profiles.
+	 * No sane person would add rules allowing this to a profile
+	 * but we enforce the restriction anyways.
+	 */
+	cred = aa_current_policy(&profile);
+	if (profile) {
+		struct aa_audit sa;
+		memset(&sa, 0, sizeof(sa));
+		sa.operation = operation;
+		sa.gfp_mask = GFP_KERNEL;
+		sa.error = -EACCES;
+		data = ERR_PTR(aa_audit(AUDIT_APPARMOR_DENIED, profile, &sa,
+					NULL));
+		goto out;
+	}
+
+	data = vmalloc(alloc_size);
+	if (data == NULL) {
+		data = ERR_PTR(-ENOMEM);
+		goto out;
+	}
+
+	if (copy_from_user(data, userbuf, copy_size)) {
+		vfree(data);
+		data = ERR_PTR(-EFAULT);
+		goto out;
+	}
+
+out:
+	return data;
+}
+
+static struct aa_profile *next_profile(struct aa_profile *profile)
+{
+	struct aa_profile *parent;
+	struct aa_namespace *ns = profile->ns;
+
+	if (!list_empty(&profile->base.profiles))
+		return list_first_entry(&profile->base.profiles,
+					struct aa_profile, base.list);
+
+	parent = profile->parent;
+	while (parent) {
+		list_for_each_entry_continue(profile, &parent->base.profiles,
+					     base.list)
+			return profile;
+		profile = parent;
+		parent = parent->parent;
+	}
+
+	list_for_each_entry_continue(profile, &ns->base.profiles, base.list)
+		return profile;
+
+	read_unlock(&ns->base.lock);
+	list_for_each_entry_continue(ns, &ns_list, base.list) {
+		read_lock(&ns->base.lock);
+		return list_first_entry(&ns->base.profiles, struct aa_profile,
+					base.list);
+		read_unlock(&ns->base.lock);
+	}
+	return NULL;
+}
+
+static void *p_start(struct seq_file *f, loff_t *pos)
+	__acquires(ns_list_lock)
+{
+	struct aa_namespace *ns;
+	loff_t l = *pos;
+
+	read_lock(&ns_list_lock);
+	if (!list_empty(&ns_list)) {
+		struct aa_profile *profile = NULL;
+		ns = list_first_entry(&ns_list, typeof(*ns), base.list);
+		read_lock(&ns->base.lock);
+		if (!list_empty(&ns->base.profiles)) {
+			profile = list_first_entry(&ns->base.profiles,
+						   typeof(*profile), base.list);
+			for ( ; profile && l > 0; l--)
+				profile = next_profile(profile);
+			return profile;
+		} else
+			read_unlock(&ns->base.lock);
+	}
+	return NULL;
+}
+
+static void *p_next(struct seq_file *f, void *p, loff_t *pos)
+{
+	struct aa_profile *profile = (struct aa_profile *) p;
+
+	(*pos)++;
+	profile = next_profile(profile);
+
+	return profile;
+}
+
+static void p_stop(struct seq_file *f, void *p)
+	__releases(ns_list_lock)
+{
+	struct aa_profile *profile = (struct aa_profile *) p;
+
+	if (profile)
+		read_unlock(&profile->ns->base.lock);
+	read_unlock(&ns_list_lock);
+}
+
+static void print_name(struct seq_file *f, struct aa_profile *profile)
+{
+	if (profile->parent) {
+		print_name(f, profile->parent);
+		seq_printf(f, "//");
+	}
+	seq_printf(f, "%s", profile->base.name);
+}
+
+static int seq_show_profile(struct seq_file *f, void *p)
+{
+	struct aa_profile *profile = (struct aa_profile *)p;
+
+	if (profile->ns != default_namespace)
+		seq_printf(f, ":%s:", profile->ns->base.name);
+	print_name(f, profile);
+	seq_printf(f, " (%s)\n",
+		   PROFILE_COMPLAIN(profile) ? "complain" : "enforce");
+
+	return 0;
+}
+
+/* Used in apparmorfs.c */
+static struct seq_operations apparmorfs_profiles_op = {
+	.start =	p_start,
+	.next =		p_next,
+	.stop =		p_stop,
+	.show =		seq_show_profile,
+};
+
+static int aa_profiles_open(struct inode *inode, struct file *file)
+{
+	return seq_open(file, &apparmorfs_profiles_op);
+}
+
+
+static int aa_profiles_release(struct inode *inode, struct file *file)
+{
+	return seq_release(inode, file);
+}
+
+static struct file_operations apparmorfs_profiles_fops = {
+	.open =		aa_profiles_open,
+	.read =		seq_read,
+	.llseek =	seq_lseek,
+	.release =	aa_profiles_release,
+};
+
+/* apparmor/matching */
+static ssize_t aa_matching_read(struct file *file, char __user *buf,
+			       size_t size, loff_t *ppos)
+{
+	const char *matching = "pattern=aadfa audit perms=crwxamlk/ user::other";
+
+	return simple_read_from_buffer(buf, size, ppos, matching,
+				       strlen(matching));
+}
+
+static struct file_operations apparmorfs_matching_fops = {
+	.read = 	aa_matching_read,
+};
+
+/* apparmor/features */
+static ssize_t aa_features_read(struct file *file, char __user *buf,
+				size_t size, loff_t *ppos)
+{
+	const char *features = "file=3.1 capability=2.0 network=1.0 "
+			       "change_hat=1.5 change_profile=1.1 "
+			       "aanamespaces=1.1 rlimit=1.1";
+
+	return simple_read_from_buffer(buf, size, ppos, features,
+				       strlen(features));
+}
+
+static struct file_operations apparmorfs_features_fops = {
+	.read = 	aa_features_read,
+};
+
+/* apparmor/.load */
+static ssize_t aa_profile_load(struct file *f, const char __user *buf,
+			       size_t size, loff_t *pos)
+{
+	char *data;
+	ssize_t error;
+
+	data = aa_simple_write_to_buffer(buf, size, size, pos, "profile_load");
+
+	error = PTR_ERR(data);
+	if (!IS_ERR(data)) {
+		error = aa_interface_add_profiles(data, size);
+		vfree(data);
+	}
+
+	return error;
+}
+
+
+static struct file_operations apparmorfs_profile_load = {
+	.write = aa_profile_load
+};
+
+/* apparmor/.replace */
+static ssize_t aa_profile_replace(struct file *f, const char __user *buf,
+				  size_t size, loff_t *pos)
+{
+	char *data;
+	ssize_t error;
+
+	data = aa_simple_write_to_buffer(buf, size, size, pos,
+					 "profile_replace");
+	error = PTR_ERR(data);
+	if (!IS_ERR(data)) {
+		error = aa_interface_replace_profiles(data, size);
+		vfree(data);
+	}
+
+	return error;
+}
+
+
+static struct file_operations apparmorfs_profile_replace = {
+	.write = aa_profile_replace
+};
+
+/* apparmor/.remove */
+static ssize_t aa_profile_remove(struct file *f, const char __user *buf,
+				  size_t size, loff_t *pos)
+{
+	char *data;
+	ssize_t error;
+
+	/*
+	 * aa_remove_profile needs a null terminated string so 1 extra
+	 * byte is allocated and the copied data is null terminated.
+	 */
+	data = aa_simple_write_to_buffer(buf, size + 1, size, pos,
+					 "profile_remove");
+
+	error = PTR_ERR(data);
+	if (!IS_ERR(data)) {
+		data[size] = 0;
+		error = aa_interface_remove_profiles(data, size);
+		vfree(data);
+	}
+
+	return error;
+}
+
+static struct file_operations apparmorfs_profile_remove = {
+	.write = aa_profile_remove
+};
+
+static struct dentry *apparmorfs_dentry;
+struct dentry *apparmorfs_null;
+struct vfsmount *apparmorfs_mnt;
+
+static void aafs_remove(const char *name)
+{
+	struct dentry *dentry;
+
+	dentry = lookup_one_len(name, apparmorfs_dentry, strlen(name));
+	if (!IS_ERR(dentry)) {
+		securityfs_remove(dentry);
+		dput(dentry);
+	}
+}
+
+static int aafs_create(const char *name, int mask, struct file_operations *fops)
+{
+	struct dentry *dentry;
+
+	dentry = securityfs_create_file(name, S_IFREG | mask, apparmorfs_dentry,
+					NULL, fops);
+
+	return IS_ERR(dentry) ? PTR_ERR(dentry) : 0;
+}
+
+void destroy_apparmorfs(void)
+{
+	if (apparmorfs_dentry) {
+		aafs_remove(".remove");
+		aafs_remove(".replace");
+		aafs_remove(".load");
+		aafs_remove("matching");
+		aafs_remove("features");
+		aafs_remove("profiles");
+		securityfs_remove(apparmorfs_dentry);
+		apparmorfs_dentry = NULL;
+	}
+}
+
+int create_apparmorfs(void)
+{
+	int error;
+
+	if (!apparmor_initialized)
+		return 0;
+
+	if (apparmorfs_dentry) {
+		AA_ERROR("%s: AppArmor securityfs already exists\n", __func__);
+		return -EEXIST;
+	}
+
+	apparmorfs_dentry = securityfs_create_dir("apparmor", NULL);
+	if (IS_ERR(apparmorfs_dentry)) {
+		error = PTR_ERR(apparmorfs_dentry);
+		apparmorfs_dentry = NULL;
+		goto error;
+	}
+	error = aafs_create("profiles", 0440, &apparmorfs_profiles_fops);
+	if (error)
+		goto error;
+	error = aafs_create("matching", 0444, &apparmorfs_matching_fops);
+	if (error)
+		goto error;
+	error = aafs_create("features", 0444, &apparmorfs_features_fops);
+	if (error)
+		goto error;
+	error = aafs_create(".load", 0640, &apparmorfs_profile_load);
+	if (error)
+		goto error;
+	error = aafs_create(".replace", 0640, &apparmorfs_profile_replace);
+	if (error)
+		goto error;
+	error = aafs_create(".remove", 0640, &apparmorfs_profile_remove);
+	if (error)
+		goto error;
+
+	/* TODO: add support for apparmorfs_null and apparmorfs_mnt */
+
+	/* Report that AppArmor fs is enabled */
+	info_message("AppArmor Filesystem Enabled");
+	return 0;
+
+error:
+	destroy_apparmorfs();
+	AA_ERROR("Error creating AppArmor securityfs\n");
+	apparmor_disable();
+	return error;
+}
+
+fs_initcall(create_apparmorfs);
+
--- linux-rt-2.6.31.orig/ubuntu/apparmor/match.c
+++ linux-rt-2.6.31/ubuntu/apparmor/match.c
@@ -0,0 +1,305 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor dfa based regular expression matching engine
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/errno.h>
+#include <linux/mm.h>
+#include <linux/vmalloc.h>
+
+/* TODO: remove !!!! */
+// #include <linux/fs.h>
+
+#include "include/apparmor.h"
+#include "include/match.h"
+#include "include/file.h"
+
+static void free_table(struct table_header *table)
+{
+	if (is_vmalloc_addr(table))
+		vfree(table);
+	else
+		kfree(table);
+}
+
+static struct table_header *unpack_table(void *blob, size_t bsize)
+{
+	struct table_header *table = NULL;
+	struct table_header th;
+	size_t tsize;
+
+	if (bsize < sizeof(struct table_header))
+		goto out;
+
+	th.td_id = be16_to_cpu(*(u16 *) (blob));
+	th.td_flags = be16_to_cpu(*(u16 *) (blob + 2));
+	th.td_lolen = be32_to_cpu(*(u32 *) (blob + 8));
+	blob += sizeof(struct table_header);
+
+	if (!(th.td_flags == YYTD_DATA16 || th.td_flags == YYTD_DATA32 ||
+		th.td_flags == YYTD_DATA8))
+		goto out;
+
+	tsize = table_size(th.td_lolen, th.td_flags);
+	if (bsize < tsize)
+		goto out;
+
+	table = kmalloc(tsize, GFP_KERNEL);
+	if (!table)
+		table = vmalloc(tsize);
+	if (table) {
+		*table = th;
+		if (th.td_flags == YYTD_DATA8)
+			UNPACK_ARRAY(table->td_data, blob, th.td_lolen,
+				     u8, byte_to_byte);
+		else if (th.td_flags == YYTD_DATA16)
+			UNPACK_ARRAY(table->td_data, blob, th.td_lolen,
+				     u16, be16_to_cpu);
+		else
+			UNPACK_ARRAY(table->td_data, blob, th.td_lolen,
+				     u32, be32_to_cpu);
+	}
+
+out:
+	return table;
+}
+
+int unpack_dfa(struct aa_dfa *dfa, void *blob, size_t size)
+{
+	int hsize, i;
+	int error = -ENOMEM;
+
+	/* get dfa table set header */
+	if (size < sizeof(struct table_set_header))
+		goto fail;
+
+	if (ntohl(*(u32 *)blob) != YYTH_MAGIC)
+		goto fail;
+
+	hsize = ntohl(*(u32 *)(blob + 4));
+	if (size < hsize)
+		goto fail;
+
+	blob += hsize;
+	size -= hsize;
+
+	error = -EPROTO;
+	while (size > 0) {
+		struct table_header *table;
+		table = unpack_table(blob, size);
+		if (!table)
+			goto fail;
+
+		switch (table->td_id) {
+		case YYTD_ID_ACCEPT:
+		case YYTD_ID_ACCEPT2:
+		case YYTD_ID_BASE:
+			dfa->tables[table->td_id - 1] = table;
+			if (table->td_flags != YYTD_DATA32)
+				goto fail;
+			break;
+		case YYTD_ID_DEF:
+		case YYTD_ID_NXT:
+		case YYTD_ID_CHK:
+			dfa->tables[table->td_id - 1] = table;
+			if (table->td_flags != YYTD_DATA16)
+				goto fail;
+			break;
+		case YYTD_ID_EC:
+			dfa->tables[table->td_id - 1] = table;
+			if (table->td_flags != YYTD_DATA8)
+				goto fail;
+			break;
+		default:
+			free_table(table);
+			goto fail;
+		}
+
+		blob += table_size(table->td_lolen, table->td_flags);
+		size -= table_size(table->td_lolen, table->td_flags);
+	}
+
+	return 0;
+
+fail:
+	for (i = 0; i < ARRAY_SIZE(dfa->tables); i++) {
+		free_table(dfa->tables[i]);
+		dfa->tables[i] = NULL;
+	}
+	return error;
+}
+
+/**
+ * verify_dfa - verify that all the transitions and states in the dfa tables
+ *              are in bounds.
+ * @dfa: dfa to test
+ *
+ * assumes dfa has gone through the verification done by unpacking
+ */
+int verify_dfa(struct aa_dfa *dfa)
+{
+	size_t i, state_count, trans_count;
+	int error = -EPROTO;
+
+	/* check that required tables exist */
+	if (!(dfa->tables[YYTD_ID_ACCEPT - 1] &&
+	      dfa->tables[YYTD_ID_ACCEPT2 - 1] &&
+	      dfa->tables[YYTD_ID_DEF - 1] &&
+	      dfa->tables[YYTD_ID_BASE - 1] &&
+	      dfa->tables[YYTD_ID_NXT - 1] &&
+	      dfa->tables[YYTD_ID_CHK - 1]))
+		goto out;
+
+	/* accept.size == default.size == base.size */
+	state_count = dfa->tables[YYTD_ID_BASE - 1]->td_lolen;
+	if (!(state_count == dfa->tables[YYTD_ID_DEF - 1]->td_lolen &&
+	      state_count == dfa->tables[YYTD_ID_ACCEPT - 1]->td_lolen &&
+	      state_count == dfa->tables[YYTD_ID_ACCEPT2 - 1]->td_lolen))
+		goto out;
+
+	/* next.size == chk.size */
+	trans_count = dfa->tables[YYTD_ID_NXT - 1]->td_lolen;
+	if (trans_count != dfa->tables[YYTD_ID_CHK - 1]->td_lolen)
+		goto out;
+
+	/* if equivalence classes then its table size must be 256 */
+	if (dfa->tables[YYTD_ID_EC - 1] &&
+	    dfa->tables[YYTD_ID_EC - 1]->td_lolen != 256)
+		goto out;
+
+	for (i = 0; i < state_count; i++) {
+		if (DEFAULT_TABLE(dfa)[i] >= state_count)
+			goto out;
+		if (BASE_TABLE(dfa)[i] >= trans_count + 256)
+			goto out;
+	}
+
+	for (i = 0; i < trans_count ; i++) {
+		if (NEXT_TABLE(dfa)[i] >= state_count)
+			goto out;
+		if (CHECK_TABLE(dfa)[i] >= state_count)
+			goto out;
+	}
+
+	/* verify accept permissions */
+	for (i = 0; i < state_count; i++) {
+		int mode = ACCEPT_TABLE(dfa)[i];
+
+		if (mode & ~DFA_VALID_PERM_MASK)
+			goto out;
+		if (ACCEPT_TABLE2(dfa)[i] & ~DFA_VALID_PERM2_MASK)
+			goto out;
+
+	}
+
+	error = 0;
+out:
+	return error;
+}
+
+struct aa_dfa *aa_match_alloc(void)
+{
+	return kzalloc(sizeof(struct aa_dfa), GFP_KERNEL);
+}
+
+void aa_match_free(struct aa_dfa *dfa)
+{
+	if (dfa) {
+		int i;
+
+		for (i = 0; i < ARRAY_SIZE(dfa->tables); i++)
+			free_table(dfa->tables[i]);
+	}
+	kfree(dfa);
+}
+
+/**
+ * aa_dfa_match_len - traverse @dfa to find state @str stops at
+ * @dfa: the dfa to match @str against
+ * @start: the state of the dfa to start matching in
+ * @str: the string of bytes to match against the dfa
+ * @len: length of the string of bytes to match
+ *
+ * aa_dfa_match_len will match @str against the dfa and return the state it
+ * finished matching in. The final state can be used to look up the accepting
+ * label, or as the start state of a continuing match.
+ *
+ * This function will happily match again the 0 byte and only finishes
+ * when @len input is consumed.
+ */
+unsigned int aa_dfa_match_len(struct aa_dfa *dfa, unsigned int start,
+			      const char *str, int len)
+{
+	u16 *def = DEFAULT_TABLE(dfa);
+	u32 *base = BASE_TABLE(dfa);
+	u16 *next = NEXT_TABLE(dfa);
+	u16 *check = CHECK_TABLE(dfa);
+	unsigned int state = start, pos;
+
+	if (state == 0)
+		return 0;
+
+	/* current state is <state>, matching character *str */
+	if (dfa->tables[YYTD_ID_EC - 1]) {
+		u8 *equiv = EQUIV_TABLE(dfa);
+		for (; len; len--) {
+			pos = base[state] + equiv[(u8)*str++];
+			if (check[pos] == state)
+				state = next[pos];
+			else
+				state = def[state];
+		}
+	} else {
+		for (; len; len--) {
+			pos = base[state] + (u8)*str++;
+			if (check[pos] == state)
+				state = next[pos];
+			else
+				state = def[state];
+		}
+	}
+	return state;
+}
+
+
+/**
+ * aa_dfa_next_state - traverse @dfa to find state @str stops at
+ * @dfa: the dfa to match @str against
+ * @start: the state of the dfa to start matching in
+ * @str: the null terminated string of bytes to match against the dfa
+ *
+ * aa_dfa_next_state will match @str against the dfa and return the state it
+ * finished matching in. The final state can be used to look up the accepting
+ * label, or as the start state of a continuing match.
+ */
+unsigned int aa_dfa_match(struct aa_dfa *dfa, unsigned int start,
+			  const char *str)
+{
+	return aa_dfa_match_len(dfa, start, str, strlen(str));
+}
+
+/**
+ * aa_dfa_null_transition - step to next state after null character
+ * @dfa: the dfa to match against
+ * @start: the state of the dfa to start matching in
+ *
+ * aa_dfa_null_transition transitions to the next state after a null
+ * character which is not used in standard matching and is only
+ * used to seperate pairs.
+ */
+unsigned int aa_dfa_null_transition(struct aa_dfa *dfa, unsigned int start)
+{
+	return aa_dfa_match_len(dfa, start, "", 1);
+}
+
--- linux-rt-2.6.31.orig/ubuntu/apparmor/Kconfig
+++ linux-rt-2.6.31/ubuntu/apparmor/Kconfig
@@ -0,0 +1,53 @@
+config SECURITY_APPARMOR
+	bool "AppArmor support"
+	depends on SECURITY && SECURITY_NETWORK && NET && INET
+	select AUDIT
+	select SECURITY_PATH
+	select SECURITYFS
+	default n
+	help
+	  This enables the AppArmor security module.
+	  Required userspace tools (if they are not included in your
+	  distribution) and further information may be found at
+	  <http://forge.novell.com/modules/xfmod/project/?apparmor>
+
+	  If you are unsure how to answer this question, answer N.
+
+config SECURITY_APPARMOR_NETWORK
+       bool "AppArmor network support"
+       depends on SECURITY_APPARMOR
+       default n
+       help
+	 This enables AppArmor to mediate applications network use.
+	 This will enable the SECURITY_NETWORK hooks.
+
+config SECURITY_APPARMOR_BOOTPARAM_VALUE
+	int "AppArmor boot parameter default value"
+	depends on SECURITY_APPARMOR
+	range 0 1
+	default 1
+	help
+	  This option sets the default value for the kernel parameter
+	  'apparmor', which allows AppArmor to be enabled or disabled
+          at boot.  If this option is set to 0 (zero), the AppArmor
+	  kernel parameter will default to 0, disabling AppArmor at
+	  bootup.  If this option is set to 1 (one), the AppArmor
+	  kernel parameter will default to 1, enabling AppArmor at
+	  bootup.
+
+	  If you are unsure how to answer this question, answer 1.
+
+config SECURITY_APPARMOR_DISABLE
+	bool "AppArmor runtime disable"
+	depends on SECURITY_APPARMOR
+	default n
+	help
+	  This option enables writing to a apparmorfs node 'disable', which
+	  allows AppArmor to be disabled at runtime prior to the policy load.
+	  AppArmor will then remain disabled until the next boot.
+	  This option is similar to the apparmor.enabled=0 boot parameter,
+	  but is to support runtime disabling of AppArmor, e.g. from
+	  /sbin/init, for portability across platforms where boot
+	  parameters are difficult to employ.
+
+	  If you are unsure how to answer this question, answer N.
--- linux-rt-2.6.31.orig/ubuntu/apparmor/audit.c
+++ linux-rt-2.6.31/ubuntu/apparmor/audit.c
@@ -0,0 +1,153 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor auditing functions
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#include <linux/audit.h>
+#include <linux/socket.h>
+
+#include "include/apparmor.h"
+#include "include/audit.h"
+#include "include/policy.h"
+
+const char *audit_mode_names[] = {
+	"normal",
+	"quiet_denied",
+	"quiet"
+	"noquiet",
+	"all"
+};
+
+static char* aa_audit_type[] = {
+	"APPARMOR_AUDIT",
+	"APPARMOR_ALLOWED",
+	"APPARMOR_DENIED",
+	"APPARMOR_HINT",
+	"APPARMOR_STATUS",
+	"APPARMOR_ERROR",
+	"APPARMOR_KILLED"
+};
+
+/*
+ * TODO:
+ * user auditing - netlink interface
+ * system control of whether user audit messages go to system log
+ */
+static int aa_audit_base(int type, struct aa_profile *profile,
+			 struct aa_audit *sa, struct audit_context *audit_cxt,
+			 void(*cb)(struct audit_buffer *, void *))
+{
+	struct audit_buffer *ab = NULL;
+
+	if (profile && PROFILE_KILL(profile) && type == AUDIT_APPARMOR_DENIED)
+		type = AUDIT_APPARMOR_KILL;
+
+	ab = audit_log_start(audit_cxt, sa->gfp_mask, type);
+
+	if (!ab) {
+		AA_ERROR("(%d) Unable to log event of type (%d)\n",
+			 -ENOMEM, type);
+		 /* don't fail operations in complain mode even if logging
+		  * fails */
+		return type == AUDIT_APPARMOR_ALLOWED ? 0 : -ENOMEM;
+	}
+
+	if (g_apparmor_audit_header)
+		audit_log_format(ab, "type=%s ",
+				 aa_audit_type[type - AUDIT_APPARMOR_AUDIT]);
+
+	if (sa->operation)
+		audit_log_format(ab, "operation=\"%s\"", sa->operation);
+
+	if (sa->info) {
+		audit_log_format(ab, " info=\"%s\"", sa->info);
+		if (sa->error)
+			audit_log_format(ab, " error=%d", sa->error);
+	}
+
+	audit_log_format(ab, " pid=%d", sa->task ?sa->task->pid : current->pid);
+
+	if (profile) {
+		pid_t pid = sa->task ? sa->task->real_parent->pid :
+				       current->real_parent->pid;
+		audit_log_format(ab, " parent=%d", pid);
+		audit_log_format(ab, " profile=");
+		audit_log_untrustedstring(ab, profile->fqname);
+
+		if (profile->ns != default_namespace) {
+			audit_log_format(ab, " namespace=");
+			audit_log_untrustedstring(ab, profile->ns->base.name);
+		}
+	}
+
+	if (cb)
+		cb(ab, sa);
+
+	audit_log_end(ab);
+
+	if (type == AUDIT_APPARMOR_KILL)
+		(void)send_sig_info(SIGKILL, NULL,
+				    sa->task ? sa->task : current);
+
+	return type == AUDIT_APPARMOR_ALLOWED ? 0 : sa->error;
+}
+
+/**
+ * aa_audit - Log an audit event to the audit subsystem
+ * @type: audit type for the message
+ * @profile: profile to check against
+ * @sa: audit event
+ */
+int aa_audit(int type, struct aa_profile *profile, struct aa_audit *sa,
+	     void(*cb)(struct audit_buffer *, void *))
+{
+	struct audit_context *audit_cxt;
+	audit_cxt = g_apparmor_logsyscall ? current->audit_context : NULL;
+
+	if (type == AUDIT_APPARMOR_AUTO) {
+		if (likely(!sa->error)) {
+			if (PROFILE_AUDIT_MODE(profile) != AUDIT_ALL)
+				return 0;
+			type = AUDIT_APPARMOR_AUDIT;
+		} else if (PROFILE_COMPLAIN(profile))
+			type = AUDIT_APPARMOR_ALLOWED;
+		else
+			type = AUDIT_APPARMOR_DENIED;
+	}
+	if (PROFILE_AUDIT_MODE(profile) == AUDIT_QUIET ||
+	    (type == AUDIT_APPARMOR_DENIED &&
+	     PROFILE_AUDIT_MODE(profile) == AUDIT_QUIET))
+		return sa->error;
+
+	return aa_audit_base(type, profile, sa, audit_cxt, cb);
+}
+
+/**
+ * aa_audit_syscallreject - Log a syscall rejection to the audit subsystem
+ * @profile: profile to check against
+ * @gfp: memory allocation flags
+ * @msg: string describing syscall being rejected
+ */
+int aa_audit_syscallreject(struct aa_profile *profile, gfp_t gfp,
+			   const char *msg,
+			   void(*cb)(struct audit_buffer *, void *))
+{
+	struct aa_audit sa;
+	memset(&sa, 0, sizeof(sa));
+	sa.operation = "syscall";
+	sa.info = msg;
+	sa.gfp_mask = gfp;
+	sa.error = -EACCES;
+
+	return aa_audit_base(AUDIT_APPARMOR_DENIED, profile, &sa,
+			     current->audit_context, NULL);
+}
--- linux-rt-2.6.31.orig/ubuntu/apparmor/policy.c
+++ linux-rt-2.6.31/ubuntu/apparmor/policy.c
@@ -0,0 +1,729 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor policy manipulation functions
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ *
+ *
+ * AppArmor policy is based around profiles, which contain the rules a
+ * task is confined by.  Every task in the sytem has a profile attached
+ * to it determined either by matching "unconfined" tasks against the
+ * visible set of profiles or by following a profiles attachment rules.
+ *
+ * Each profile exists in an AppArmor profile namespace which is a
+ * container of related profiles.  Each namespace contains a special
+ * "unconfined" profile, which doesn't efforce any confinement on
+ * a task beyond DAC.
+ *
+ * Namespace and profile names can be written together in either
+ * of two syntaxes.
+ *	:namespace:profile - used by kernel interfaces for easy detection
+ *	namespace://profile - used by policy
+ *
+ * Profile names name not start with : or @ and may not contain \0
+ * a // in a profile name indicates a compound name with the name before
+ * the // being the parent profile and the name after the child
+ *
+ * Reserved profile names
+ *	unconfined - special automatically generated unconfined profile
+ *	inherit - special name to indicate profile inheritance
+ *	null-XXXX-YYYY - special automically generated learning profiles
+ *
+ * Namespace names may not start with / or @ and may not contain \0 or //
+ * it is recommend that they do not contain any '/' characters
+ * Reserved namespace namespace
+ *	default - the default namespace setup by AppArmor
+ *	user-XXXX - user defined profiles
+ */
+
+#include <linux/slab.h>
+#include <linux/spinlock.h>
+#include <linux/string.h>
+
+#include "include/apparmor.h"
+#include "include/capability.h"
+#include "include/file.h"
+#include "include/ipc.h"
+#include "include/match.h"
+#include "include/policy.h"
+#include "include/resource.h"
+#include "include/sid.h"
+
+/* list of profile namespaces and lock */
+LIST_HEAD(ns_list);
+DEFINE_RWLOCK(ns_list_lock);
+
+struct aa_namespace *default_namespace;
+
+const char *profile_mode_names[] = {
+	"enforce",
+	"complain",
+	"kill",
+};
+
+#define AA_SYS_SID 0
+#define AA_USR_SID 1
+
+
+static int common_init(struct aa_policy_common *common, const char *name)
+{
+	common->name = kstrdup(name, GFP_KERNEL);
+	if (!common->name)
+		return 0;
+	INIT_LIST_HEAD(&common->list);
+	INIT_LIST_HEAD(&common->profiles);
+	kref_init(&common->count);
+	rwlock_init(&common->lock);
+
+	return 1;
+}
+
+static void common_free(struct aa_policy_common *common)
+{
+	/* still contains profiles -- invalid */
+	if (!list_empty(&common->profiles)) {
+		AA_ERROR("%s: internal error, "
+			 "policy '%s' still contains profiles\n",
+			 __func__, common->name);
+		BUG();
+	}
+	if (!list_empty(&common->list)) {
+		AA_ERROR("%s: internal error, policy '%s' still on list\n",
+			 __func__, common->name);
+		BUG();
+	}
+
+	kfree(common->name);
+}
+
+static struct aa_policy_common *__common_find(struct list_head *head,
+					      const char *name)
+					      
+{
+	struct aa_policy_common *common;
+
+	list_for_each_entry(common, head, list) {
+		if (!strcmp(common->name, name))
+			return common;
+	}
+	return NULL;
+}
+
+static struct aa_policy_common *__common_find_strn(struct list_head *head,
+						   const char *str, int len)
+{
+	struct aa_policy_common *common;
+
+	list_for_each_entry(common, head, list) {
+		if (aa_strneq(common->name, str, len))
+			return common;
+	}
+
+	return NULL;
+}
+
+/*
+ * Routines for AppArmor namespaces
+ */
+
+int alloc_default_namespace(void)
+{
+	struct aa_namespace *ns;
+	ns = alloc_aa_namespace("default");
+	if (!ns)
+		return -ENOMEM;
+
+	default_namespace = aa_get_namespace(ns);
+	write_lock(&ns_list_lock);
+	list_add(&ns->base.list, &ns_list);
+	write_unlock(&ns_list_lock);
+
+	return 0;
+}
+
+void free_default_namespace(void)
+{
+	write_lock(&ns_list_lock);
+	list_del_init(&default_namespace->base.list);
+	aa_put_namespace(default_namespace);
+	write_unlock(&ns_list_lock);
+	aa_put_namespace(default_namespace);
+	default_namespace = NULL;
+}
+
+/**
+ * alloc_aa_namespace - allocate, initialize and return a new namespace
+ * @name: a preallocated name
+ * Returns NULL on failure.
+ */
+struct aa_namespace *alloc_aa_namespace(const char *name)
+{
+	struct aa_namespace *ns;
+
+	ns = kzalloc(sizeof(*ns), GFP_KERNEL);
+	AA_DEBUG("%s(%p)\n", __func__, ns);
+	if (!ns)
+		return NULL;
+
+	if (!common_init(&ns->base, name))
+		goto fail_ns;
+
+	/* null profile is not added to the profile list */
+	ns->unconfined = alloc_aa_profile("unconfined");
+	if (!ns->unconfined)
+		goto fail_unconfined;
+
+	ns->unconfined->sid = aa_alloc_sid(AA_ALLOC_SYS_SID);
+	ns->unconfined->flags = PFLAG_UNCONFINED | PFLAG_IX_ON_NAME_ERROR |
+		PFLAG_IMMUTABLE;
+	ns->unconfined->ns = aa_get_namespace(ns);
+
+	return ns;
+
+fail_unconfined:
+	if (ns->base.name)
+		kfree(ns->base.name);
+fail_ns:
+	kfree(ns);
+	return NULL;
+}
+
+/**
+ * free_aa_namespace_kref - free aa_namespace by kref (see aa_put_namespace)
+ * @kr: kref callback for freeing of a namespace
+ */
+void free_aa_namespace_kref(struct kref *kref)
+{
+	free_aa_namespace(container_of(kref, struct aa_namespace, base.count));
+}
+
+/**
+ * free_aa_namespace - free a profile namespace
+ * @namespace: the namespace to free
+ *
+ * Free a namespace.  All references to the namespace must have been put.
+ * If the namespace was referenced by a profile confining a task,
+ */
+void free_aa_namespace(struct aa_namespace *ns)
+{
+	if (!ns)
+		return;
+
+	common_free(&ns->base);
+
+	if (ns->unconfined && ns->unconfined->ns == ns)
+		ns->unconfined->ns = NULL;
+
+	aa_put_profile(ns->unconfined);
+	memset(ns, 0, sizeof(*ns));
+	kfree(ns);
+}
+
+struct aa_namespace *__aa_find_namespace(struct list_head *head,
+					 const char *name)
+					 
+{
+	return (struct aa_namespace *) __common_find(head, name);
+}
+
+/**
+ * aa_find_namespace  -  look up a profile namespace on the namespace list
+ * @name: name of namespace to find
+ *
+ * Returns a pointer to the namespace on the list, or NULL if no namespace
+ * called @name exists.
+ */
+struct aa_namespace *aa_find_namespace(const char *name)
+{
+	struct aa_namespace *ns = NULL;
+
+	read_lock(&ns_list_lock);
+	ns = aa_get_namespace(__aa_find_namespace(&ns_list, name));
+	read_unlock(&ns_list_lock);
+
+	return ns;
+}
+
+static struct aa_namespace *__aa_find_namespace_by_strn(struct list_head *head,
+							const char *name,
+							int len)
+{
+	return (struct aa_namespace *) __common_find_strn(head, name, len);
+}
+
+struct aa_namespace *aa_find_namespace_by_strn(const char *name, int len)
+{
+	struct aa_namespace *ns = NULL;
+
+	read_lock(&ns_list_lock);
+	ns = aa_get_namespace(__aa_find_namespace_by_strn(&ns_list, name, len));
+	read_unlock(&ns_list_lock);
+
+	return ns;
+}
+
+/**
+ * aa_prepare_namespace - find an existing or create a new namespace of @name
+ * @name: the namespace to find or add
+ */
+struct aa_namespace *aa_prepare_namespace(const char *name)
+{
+	struct aa_namespace *ns;
+ 
+	write_lock(&ns_list_lock);
+	if (name)
+		ns = aa_get_namespace(__aa_find_namespace(&ns_list, name));
+	else
+		ns = aa_get_namespace(default_namespace);
+	if (!ns) {
+		struct aa_namespace *new_ns;
+		write_unlock(&ns_list_lock);
+		new_ns = alloc_aa_namespace(name);
+		if (!new_ns)
+			return NULL;
+		write_lock(&ns_list_lock);
+		ns = __aa_find_namespace(&ns_list, name);
+		if (!ns) {
+			list_add(&new_ns->base.list, &ns_list);
+			ns = new_ns;
+		} else {
+			/* raced so free the new one */
+			free_aa_namespace(new_ns);
+			aa_get_namespace(ns);
+		}
+	}
+	write_unlock(&ns_list_lock);
+
+	return ns;
+}
+
+/*
+ * requires profile->ns set first, takes profiles refcount
+ * TODO: add accounting
+ */
+void __aa_add_profile(struct aa_policy_common *common,
+		      struct aa_profile *profile)
+{
+	list_add(&profile->base.list, &common->profiles);
+	if (!(profile->flags & PFLAG_NO_LIST_REF))
+		aa_get_profile(profile);
+}
+
+void __aa_remove_profile(struct aa_profile *profile,
+			 struct aa_profile *replacement)
+{
+	if (replacement)
+		profile->replacedby = aa_get_profile(replacement);
+	else
+		profile->replacedby = aa_get_profile(profile->ns->unconfined);
+	list_del_init(&profile->base.list);
+	if (!(profile->flags & PFLAG_NO_LIST_REF))
+		aa_put_profile(profile);
+}
+
+/* TODO: add accounting */
+void __aa_replace_profile(struct aa_profile *profile,
+			  struct aa_profile *replacement)
+{
+	if (replacement) {
+		struct aa_policy_common *common;
+
+		if (profile->parent)
+			common = &profile->parent->base;
+		else
+			common = &profile->ns->base;
+
+		__aa_remove_profile(profile, replacement);
+		__aa_add_profile(common, replacement);
+	} else
+		__aa_remove_profile(profile, NULL);
+}
+
+/**
+ * __aa_profile_list_release - remove all profiles on the list and put refs
+ * @head: list of profiles
+ */
+void __aa_profile_list_release(struct list_head *head)
+{
+	struct aa_profile *profile, *tmp;
+	list_for_each_entry_safe(profile, tmp, head, base.list) {
+		__aa_profile_list_release(&profile->base.profiles);
+		__aa_remove_profile(profile, NULL);
+	}
+}
+
+void __aa_remove_namespace(struct aa_namespace *ns)
+{
+	struct aa_profile *unconfined = ns->unconfined;
+	list_del_init(&ns->base.list);
+
+	/*
+	 * break the ns, unconfined profile cyclic reference and forward
+	 * all new unconfined profiles requests to the default namespace
+	 */
+	ns->unconfined = aa_get_profile(default_namespace->unconfined);
+	__aa_profile_list_release(&ns->base.profiles);
+	aa_put_profile(unconfined);
+	aa_put_namespace(ns);
+}
+
+/**
+ * aa_remove_namespace = Remove namespace from the list
+ * @ns: namespace to remove
+ */
+void aa_remove_namespace(struct aa_namespace *ns)
+{
+	write_lock(&ns_list_lock);
+	write_lock(&ns->base.lock);
+	__aa_remove_namespace(ns);
+	write_unlock(&ns->base.lock);
+	write_unlock(&ns_list_lock);
+}
+
+/**
+ * aa_profilelist_release - remove all namespaces and all associated profiles
+ */
+void aa_profile_ns_list_release(void)
+{
+	struct aa_namespace *ns, *tmp;
+
+	/* Remove and release all the profiles on namespace profile lists. */
+	write_lock(&ns_list_lock);
+	list_for_each_entry_safe(ns, tmp, &ns_list, base.list) {
+		write_lock(&ns->base.lock);
+		__aa_remove_namespace(ns);
+		write_unlock(&ns->base.lock);
+	}
+	write_unlock(&ns_list_lock);
+}
+
+/**
+ * alloc_aa_profile - allocate, initialize and return a new profile
+ * @fqname: name of the profile
+ *
+ * Returns NULL on failure.
+ */
+struct aa_profile *alloc_aa_profile(const char *fqname)
+{
+	struct aa_profile *profile;
+
+	profile = kzalloc(sizeof(*profile), GFP_KERNEL);
+	if (!profile)
+		return NULL;
+ 
+	if (!common_init(&profile->base, fqname)) {
+		kfree(profile);
+		return NULL;
+	}
+	
+	profile->fqname = profile->base.name;
+	profile->base.name = (char *) fqname_subname((const char *) profile->fqname);
+	return profile;
+}
+
+/**
+ * aa_new_null_profile - create a new null-X learning profile
+ * @parent: profile that caused this profile to be created
+ * @hat: true if the null- learning profile is a hat
+ *
+ * Create a null- complain mode profile used in learning mode.  The name of
+ * the profile is unique and follows the format of parent//null-sid.
+ *
+ * null profiles are added to the profile list but the list does not
+ * hold a count on them so that they are automatically released when
+ * not in use.
+ */
+struct aa_profile *aa_alloc_null_profile(struct aa_profile *parent, int hat)
+{
+	struct aa_profile *profile = NULL;
+	char *name;
+	u32 sid = aa_alloc_sid(AA_ALLOC_SYS_SID);
+
+	name = kmalloc(strlen(parent->fqname) + 2 + 7 + 8, GFP_KERNEL);
+	if (!name)
+		goto fail;
+	sprintf(name, "%s//null-%x", parent->fqname, sid);
+
+	profile = alloc_aa_profile(name);
+	kfree(name);
+	if (!profile)
+		goto fail;
+
+	profile->sid = aa_alloc_sid(AA_ALLOC_SYS_SID);
+	profile->mode = APPARMOR_COMPLAIN;
+	profile->flags = PFLAG_NULL | PFLAG_NO_LIST_REF;
+	if (hat)
+	  profile->flags |= PFLAG_HAT;
+
+	profile->parent = aa_get_profile(parent);
+	profile->ns = aa_get_namespace(parent->ns);
+
+	write_lock(&profile->ns->base.lock);
+	__aa_add_profile(&parent->base, profile);
+	write_unlock(&profile->ns->base.lock);
+
+	return profile;
+
+fail:
+	aa_free_sid(sid);
+	return NULL;
+}
+
+/**
+ * free_aa_profile_kref - free aa_profile by kref (called by aa_put_profile)
+ * @kr: kref callback for freeing of a profile
+ */
+void free_aa_profile_kref(struct kref *kref)
+{
+	struct aa_profile *p = container_of(kref, struct aa_profile,
+					    base.count);
+
+	free_aa_profile(p);
+}
+
+/**
+ * free_aa_profile - free a profile
+ * @profile: the profile to free
+ *
+ * Free a profile, its hats and null_profile. All references to the profile,
+ * its hats and null_profile must have been put.
+ *
+ * If the profile was referenced from a task context, free_aa_profile() will
+ * be called from an rcu callback routine, so we must not sleep here.
+ */
+void free_aa_profile(struct aa_profile *profile)
+{
+	AA_DEBUG("%s(%p)\n", __func__, profile);
+
+	if (!profile)
+		return;
+
+	/*
+	 * profile can still be on the list if the list doesn't hold a
+	 * reference.  There is no race as NULL profiles can't be attached
+	 */
+	if (!list_empty(&profile->base.list)) {
+		if ((profile->flags & PFLAG_NULL) && profile->ns) {
+			write_lock(&profile->ns->base.lock);
+			list_del_init(&profile->base.list);
+			write_unlock(&profile->ns->base.lock);
+		} else {
+			AA_ERROR("%s: internal error, "
+				 "profile '%s' still on ns list\n",
+				 __func__, profile->base.name);
+			BUG();
+		}
+	}
+
+	/* profile->name is a substring of fqname */
+	profile->base.name = NULL;
+	common_free(&profile->base);
+
+	BUG_ON(!list_empty(&profile->base.profiles));
+
+	kfree(profile->fqname);
+
+	aa_put_namespace(profile->ns);
+	aa_put_profile(profile->parent);
+
+	aa_free_file_rules(&profile->file);
+	aa_free_cap_rules(&profile->caps);
+	aa_free_net_rules(&profile->net);
+	aa_free_rlimit_rules(&profile->rlimits);
+
+	aa_free_sid(profile->sid);
+	aa_match_free(profile->xmatch);
+
+	if (profile->replacedby && !PTR_ERR(profile->replacedby))
+		aa_put_profile(profile->replacedby);
+
+	memset(profile, 0, sizeof(profile));
+	kfree(profile);
+}
+
+
+/* TODO: profile count accounting - setup in remove */
+
+
+struct aa_profile *__aa_find_profile(struct list_head *head, const char *name)
+{
+	return (struct aa_profile *) __common_find(head, name);
+}
+
+struct aa_profile *__aa_find_profile_by_strn(struct list_head *head,
+					     const char *name, int len)
+{
+	return (struct aa_profile *) __common_find_strn(head, name, len);
+}
+
+
+/**
+ * aa_find_child - find a profile by @name in @parent
+ * @parent: profile to search
+ * @name: profile name to search for
+ *
+ * Returns a ref counted profile or NULL if not found
+ */
+struct aa_profile *aa_find_child(struct aa_profile *parent, const char *name)
+{
+	struct aa_profile *profile;
+
+	read_lock(&parent->ns->base.lock);
+	profile = aa_get_profile(__aa_find_profile(&parent->base.profiles,
+						   name));
+	read_unlock(&parent->ns->base.lock);
+
+	return profile;
+}
+
+
+struct aa_policy_common *__aa_find_parent_by_fqname(struct aa_namespace *ns,
+						    const char *fqname)
+{
+	struct aa_policy_common *common;
+	struct aa_profile *profile = NULL;
+	char *split;
+
+	common = &ns->base;
+
+	
+	for (split = strstr(fqname, "//"); split; ) {
+		profile = __aa_find_profile_by_strn(&common->profiles, fqname,
+						    split - fqname);
+		if (!profile)
+			return NULL;
+		common = &profile->base;
+		fqname = split + 2;
+		split = strstr(fqname, "//");
+	}
+	if (!profile)
+		return &ns->base;
+	return &profile->base;
+}
+
+struct aa_profile *__aa_find_profile_by_fqname(struct aa_namespace *ns,
+					       const char *fqname)
+{
+	struct aa_policy_common *common;
+	struct aa_profile *profile = NULL;
+	char *split;
+
+	common = &ns->base;
+	for (split = strstr(fqname, "//"); split; ) {
+		profile = __aa_find_profile_by_strn(&common->profiles, fqname,
+						    split - fqname);
+		if (!profile)
+			return NULL;
+
+		common = &profile->base;
+		fqname = split + 2;
+		split = strstr(fqname, "//");
+	}
+
+	profile = __aa_find_profile(&common->profiles, fqname);
+
+	return profile;
+}
+
+/**
+ * aa_find_profile_by_name - find a profile by its full or partial name
+ * @ns: the namespace to start from
+ * @fqname: name to do lookup on.  Does not contain namespace prefix
+ */
+struct aa_profile *aa_find_profile_by_fqname(struct aa_namespace *ns,
+					     const char *fqname)
+{
+	struct aa_profile *profile;
+
+	read_lock(&ns->base.lock);
+	profile = aa_get_profile(__aa_find_profile_by_fqname(ns, fqname));
+	read_unlock(&ns->base.lock);
+	return profile;
+}
+
+
+/* __aa_attach_match_ - find an attachment match
+ * @name - to match against
+ * @head - profile list to walk
+ *
+ * Do a linear search on the profiles in the list.  There is a matching
+ * preference where an exact match is prefered over a name which uses
+ * expressions to match, and matching expressions with the greatest
+ * xmatch_len are prefered.
+ */
+static struct aa_profile *__aa_attach_match(const char *name,
+					    struct list_head *head)
+{
+	int len = 0;
+	struct aa_profile *profile, *candidate = NULL;
+
+	list_for_each_entry(profile, head, base.list) {
+		if (profile->flags & PFLAG_NULL)
+			continue;
+		if (profile->xmatch && profile->xmatch_len > len) {
+			unsigned int state = aa_dfa_match(profile->xmatch,
+							  DFA_START, name);
+			u16 perm = dfa_user_allow(profile->xmatch, state);
+			/* any accepting state means a valid match. */
+			if (perm & MAY_EXEC) {
+				candidate = profile;
+				len = profile->xmatch_len;
+			}
+		} else if (!strcmp(profile->base.name, name))
+			/* exact non-re match, no more searching required */
+			return profile;
+	}
+
+	return candidate;
+}
+
+/**
+ * aa_sys_find_attach - do attachment search for sys unconfined processes
+ * @base: the base to search
+ * name: the executable name to match against
+ */
+struct aa_profile *aa_sys_find_attach(struct aa_policy_common *base,
+				      const char *name)
+{
+	struct aa_profile *profile;
+
+	read_lock(&base->lock);
+	profile = aa_get_profile(__aa_attach_match(name, &base->profiles));
+	read_unlock(&base->lock);
+
+	return profile;
+}
+
+/**
+ * aa_profile_newest - find the newest version of @profile
+ * @profile: the profile to check for newer versions of
+ *
+ * Find the newest version of @profile, if @profile is the newest version
+ * return @profile.  If @profile has been removed return NULL.
+ *
+ * NOTE: the profile returned is not refcounted, The refcount on @profile
+ * must be held until the caller decides what to do with the returned newest
+ * version.
+ */
+struct aa_profile *aa_profile_newest(struct aa_profile *profile)
+{
+	if (unlikely(profile && profile->replacedby)) {
+		for (;profile->replacedby; profile = profile->replacedby) {
+			if (IS_ERR(profile->replacedby)) {
+				/* profile has been removed */
+				profile = NULL;
+				break;
+			}
+		} 
+	}
+
+	return profile;
+}
+
--- linux-rt-2.6.31.orig/ubuntu/apparmor/procattr.c
+++ linux-rt-2.6.31/ubuntu/apparmor/procattr.c
@@ -0,0 +1,117 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor /proc/<pid>/attr/ interface functions
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#include "include/apparmor.h"
+#include "include/policy.h"
+#include "include/domain.h"
+
+/* FIXME show profile multiplexing */
+int aa_getprocattr(struct aa_namespace *ns, struct aa_profile *profile,
+		   char **string)
+{
+	char *str;
+	int len = 0;
+
+	if (profile) {
+		int mode_len, name_len, ns_len = 0;
+		const char *mode_str = profile_mode_names[profile->mode];
+		char *s;
+
+		mode_len = strlen(mode_str) + 3;  /* _(mode_str)\n */
+		name_len = strlen(profile->fqname);
+		if (ns != default_namespace)
+			ns_len = strlen(ns->base.name) + 3;
+		len = mode_len + ns_len + name_len + 1;
+		s = str = kmalloc(len + 1, GFP_ATOMIC);
+		if (!str)
+			return -ENOMEM;
+
+		if (ns_len) {
+			sprintf(s, "%s://", ns->base.name);
+			s += ns_len;
+		}
+		memcpy(s, profile->fqname, name_len);
+		s += name_len;
+		sprintf(s, " (%s)\n", mode_str);
+	} else {
+		const char *unconfined_str = "unconfined\n";
+
+		len = strlen(unconfined_str);
+		if (ns != default_namespace)
+			len += strlen(ns->base.name) + 3;	/* :// */
+
+		str = kmalloc(len + 1, GFP_ATOMIC);
+		if (!str)
+			return -ENOMEM;
+
+		if (ns != default_namespace)
+			sprintf(str, "%s://%s", ns->base.name, unconfined_str);
+		else
+			memcpy(str, unconfined_str, len);
+	}
+	*string = str;
+
+	return len;
+}
+
+static char *split_token_from_name(const char *op, char *args, u64 *token)
+{
+	char *name;
+
+	*token = simple_strtoull(args, &name, 16);
+	if ((name == args) || *name != '^') {
+		AA_ERROR("%s: Invalid input '%s'", op, args);
+		return ERR_PTR(-EINVAL);
+	}
+
+	name++;  /* skip ^ */
+	if (!*name)
+		name = NULL;
+	return name;
+}
+
+int aa_setprocattr_changehat(char *args, int test)
+{
+	char *hat;
+	u64 token;
+
+	hat = split_token_from_name("change_hat", args, &token);
+	if (IS_ERR(hat))
+		return PTR_ERR(hat);
+
+	if (!hat && !token) {
+		AA_ERROR("change_hat: Invalid input, NULL hat and NULL magic");
+		return -EINVAL;
+	}
+
+	AA_DEBUG("%s: Magic 0x%llx Hat '%s'\n",
+		 __func__, token, hat ? hat : NULL);
+
+	return aa_change_hat(hat, token, test);
+}
+
+int aa_setprocattr_changeprofile(char *args, int onexec, int test)
+{
+	char *name, *ns_name;
+
+	name = aa_split_name_from_ns(args, &ns_name);
+	return aa_change_profile(ns_name, name, onexec, test);
+}
+
+
+int aa_setprocattr_permipc(char *args)
+{
+	/* TODO: add ipc permission querying */
+	return -ENOTSUPP;
+}
--- linux-rt-2.6.31.orig/ubuntu/apparmor/domain.c
+++ linux-rt-2.6.31/ubuntu/apparmor/domain.c
@@ -0,0 +1,724 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor policy attachment and domain transitions
+ *
+ * Copyright (C) 2002-2008 Novell/SUSE
+ * Copyright 2009 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#include <linux/errno.h>
+#include <linux/fdtable.h>
+#include <linux/file.h>
+#include <linux/mount.h>
+#include <linux/syscalls.h>
+#include <linux/tracehook.h>
+#include <linux/personality.h>
+
+#include "include/audit.h"
+#include "include/apparmorfs.h"
+#include "include/context.h"
+#include "include/domain.h"
+#include "include/file.h"
+#include "include/ipc.h"
+#include "include/match.h"
+#include "include/path.h"
+#include "include/policy.h"
+
+/**
+ * aa_free_domain_entries - free entries in a domain table
+ * @domain: the domain table to free
+ */
+void aa_free_domain_entries(struct aa_domain *domain)
+{
+	int i;
+
+	if (!domain->table)
+		return;
+
+	for (i = 0; i < domain->size; i++)
+		kfree(domain->table[i]);
+	kfree(domain->table);
+}
+
+/*
+ * check if the task is ptraced and if so if the tracing task is allowed
+ * to trace the new domain
+ */
+static int aa_may_change_ptraced_domain(struct task_struct *task,
+					struct aa_profile *to_profile)
+{
+	struct task_struct *tracer;
+	struct cred *cred = NULL;
+	struct aa_profile *tracerp = NULL;
+	int error = 0;
+
+	rcu_read_lock();
+	tracer = tracehook_tracer_task(task);
+	if (tracer)
+		cred = aa_get_task_policy(tracer, &tracerp);
+	rcu_read_unlock();
+
+	/* not ptraced */
+	if (!tracer)
+		return 0;
+
+	if (!tracerp)
+		goto out;
+
+	error = aa_may_ptrace(tracer, tracerp, to_profile, PTRACE_MODE_ATTACH);
+out:
+	put_cred(cred);
+
+	return error;
+}
+
+/**
+ * change_profile_perms
+ */
+static struct file_perms change_profile_perms(struct aa_profile *profile,
+					      struct aa_namespace *ns,
+					      const char *name,
+					      unsigned int *rstate)
+{
+	struct file_perms perms;
+	struct path_cond cond = { 0, 0 };
+	unsigned int state;
+
+	if (!profile) {
+		/* unconfined */
+		perms.allowed = AA_MAY_CHANGE_PROFILE;
+		perms.xindex = perms.dindex = 0;
+		perms.audit = perms.quiet = perms.kill = 0;
+		if (rstate)
+			*rstate = 0;
+		return perms;
+	} else if (!profile->file.dfa) {
+		return nullperms;
+	} else if ((ns == profile->ns)) {
+		/* try matching against rules with out namespace prependend */
+		perms = aa_str_perms(profile->file.dfa, DFA_START, name, &cond,
+				     rstate);
+		if (COMBINED_PERM_MASK(perms) & AA_MAY_CHANGE_PROFILE)
+			return perms;
+	}
+
+	/* try matching with namespace name and then profile */
+	state = aa_dfa_match(profile->file.dfa, DFA_START, ns->base.name);
+	state = aa_dfa_null_transition(profile->file.dfa, state);
+	return aa_str_perms(profile->file.dfa, state, name, &cond, rstate);
+}
+
+/*
+ * TODO: fix parser to detect unconfined, inherit,
+ * check for next name in list of names that is double null terminated
+ * The names list is a set of strings that \0 seperated with a double
+ * \0 terminating the list
+ * names that belong to namespaces begin with a :
+ * and are followed by a name a \0 seperated name.  If the name is
+ * unspecified it is 0 length.  This double \0\0 does not count as
+ * the end of the list
+ *
+ * profile\0\0			# single profile
+ * profile\0profile\0\0		# 2 profiles in list
+ * :namespace\0profile\0\0	# profile & namespace
+ * :namespace\0\0\0		# namespace without profile
+ * :namespace\0\0profile\0\0	# namespace without profile followed by profile
+*/
+static const char *next_name(int xtype, const char *name)
+{
+/* TODO: fix parser and enable
+	if (xtype == AA_X_TABLE) {
+		name = name + strlen(name) + 1;
+		if (*name != 0)
+			return name;
+	}
+*/
+	return NULL;
+}
+
+/*
+ * get target profile for xindex
+ */
+static struct aa_profile *x_to_profile(struct aa_namespace *ns,
+				       struct aa_profile *profile,
+				       const char *name, u16 xindex)
+
+{
+	struct aa_profile *new_profile = NULL;
+	u16 xtype = xindex & AA_X_TYPE_MASK;
+	int index = xindex & AA_X_INDEX_MASK;
+
+	if (!profile)
+		profile = ns->unconfined;
+
+	switch(xtype) {
+	case AA_X_NONE:
+		/* fail exec unless ix || ux fallback - handled by caller */
+		return ERR_PTR(-EACCES);
+	case AA_X_NAME:
+		if (xindex & AA_X_CHILD)
+			new_profile = aa_sys_find_attach(&profile->base, name);
+		else
+			new_profile = aa_sys_find_attach(&ns->base, name);
+
+		goto out;
+	case AA_X_TABLE:
+		if (index > profile->file.trans.size) {
+			AA_ERROR("Invalid named transition\n");
+			return ERR_PTR(-EACCES);
+		}
+		name = profile->file.trans.table[index];
+		break;
+	}
+
+	for (; !new_profile && name; name = next_name(xtype, name)) {
+		struct aa_namespace *new_ns;
+		const char *xname = NULL;
+
+		new_ns = NULL;
+		if (xindex & AA_X_CHILD) {
+			new_profile = aa_find_child(profile, name);
+			if (new_profile)
+				return new_profile;
+			continue;
+		} else if (*name == ':') {
+			/* switching namespace */
+			const char *ns_name = name + 1;
+			name = xname = ns_name + strlen(ns_name) + 1;
+			if (!*xname)
+				/* no name so use profile name */
+				xname = profile->fqname;
+			if (*ns_name == '@') {
+				/* TODO: variable support */
+				;
+			}
+			new_ns = aa_find_namespace(ns_name);
+			if (!new_ns)
+				continue;
+		} else if (*name == '@') {
+			/* TODO: variable support */
+
+		} else {
+			xname = name;
+		}
+
+		new_profile = aa_find_profile_by_fqname(new_ns ? new_ns : ns,
+							xname);
+		aa_put_namespace(new_ns);
+	}
+
+out:
+	if (!new_profile)
+		return ERR_PTR(-ENOENT);
+
+	return new_profile;
+}
+
+int apparmor_bprm_set_creds(struct linux_binprm *bprm)
+{
+	struct aa_task_context *cxt;
+	struct aa_profile *profile, *new_profile = NULL;
+	struct aa_namespace *ns;
+	char *buffer = NULL;
+	unsigned int state = DFA_START;
+	struct aa_audit_file sa;
+	struct path_cond cond = { bprm->file->f_path.dentry->d_inode->i_uid,
+				  bprm->file->f_path.dentry->d_inode->i_mode }; 
+
+	sa.base.error = cap_bprm_set_creds(bprm);
+	if (sa.base.error)
+		return sa.base.error;
+
+	if (bprm->cred_prepared)
+		return 0;
+
+	memset(&sa, 0, sizeof(sa));
+	sa.base.operation = "exec";
+	sa.base.gfp_mask = GFP_KERNEL;
+	sa.request = MAY_EXEC;
+	sa.cond = &cond;
+
+	cxt = bprm->cred->security;
+	BUG_ON(!cxt);
+
+	profile = aa_filtered_profile(aa_profile_newest(cxt->sys.profile));
+	ns = cxt->sys.profile->ns;
+
+	sa.base.error = aa_get_name(&bprm->file->f_path, 0, &buffer,
+				    (char **) &sa.name);
+	if (sa.base.error) {
+		if (!profile || profile->flags & PFLAG_IX_ON_NAME_ERROR)
+			sa.base.error = 0;
+		sa.base.info = "Exec failed name resolution";
+		sa.name = bprm->filename;
+		goto audit;
+	}
+
+	if (!profile) {
+		/* unconfined task - attach profile if one matches */
+		new_profile = aa_sys_find_attach(&ns->base, sa.name);
+		if (!new_profile)
+			goto cleanup;
+		goto apply;
+	} else if (cxt->sys.onexec) {
+		/*
+		 * onexec permissions are stored in a pair, rewalk the
+		 * dfa to get start of the exec path match.
+		 */
+		sa.perms = change_profile_perms(profile, cxt->sys.onexec->ns,
+						sa.name, &state);
+		state = aa_dfa_null_transition(profile->file.dfa, state);
+	}
+	sa.perms = aa_str_perms(profile->file.dfa, state, sa.name, &cond,
+				NULL);
+	if (cxt->sys.onexec && sa.perms.allowed & AA_MAY_ONEXEC) {
+		new_profile = cxt->sys.onexec;
+		cxt->sys.onexec = NULL;
+		sa.base.info = "change_profile onexec";
+	} else if (sa.perms.allowed & MAY_EXEC) {
+		new_profile = x_to_profile(ns, profile, sa.name,
+					   sa.perms.xindex);
+		if (IS_ERR(new_profile)) {
+			if (sa.perms.xindex & AA_X_INHERIT) {
+				/* (p|c|n)ix - don't change profile */
+				sa.base.info = "ix fallback";
+				goto x_clear;
+			} else if (sa.perms.xindex & AA_X_UNCONFINED) {
+				new_profile = aa_get_profile(ns->unconfined);
+				sa.base.info = "ux fallback";
+			} else {
+				sa.base.error = PTR_ERR(new_profile);
+				if (sa.base.error == -ENOENT)
+					sa.base.info = "profile not found";
+				new_profile = NULL;
+			}
+		}
+	} else if (PROFILE_COMPLAIN(profile)) {
+		new_profile = aa_alloc_null_profile(profile, 0);
+		sa.base.error = -EACCES;
+		if (!new_profile)
+			sa.base.error = -ENOMEM;
+		sa.name2 = new_profile->fqname;
+		sa.perms.xindex |= AA_X_UNSAFE;
+	} else {
+		sa.base.error = -EACCES;
+	}
+
+	if (!new_profile)
+		goto audit;
+
+	if (profile == new_profile) {
+		aa_put_profile(new_profile);
+		goto audit;
+	}
+
+	if (bprm->unsafe & LSM_UNSAFE_SHARE) {
+		/* FIXME: currently don't mediate shared state */
+		;
+	}
+
+	if (bprm->unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
+		sa.base.error = aa_may_change_ptraced_domain(current,
+							     new_profile);
+		if (sa.base.error)
+			goto audit;
+	}
+
+	/* Determine if secure exec is needed.
+	 * Can be at this point for the following reasons:
+	 * 1. unconfined switching to confined
+	 * 2. confined switching to different confinement
+	 * 3. confined switching to unconfined
+	 *
+	 * Cases 2 and 3 are marked as requiring secure exec
+	 * (unless policy specified "unsafe exec")
+	 *
+	 * bprm->unsafe is used to cache the AA_X_UNSAFE permission
+	 * to avoid having to recompute in secureexec
+	 */
+	if (!(sa.perms.xindex & AA_X_UNSAFE))
+		bprm->unsafe |= AA_SECURE_X_NEEDED;
+
+apply:
+	sa.name2 = new_profile->fqname;
+	/* When switching namespace ensure its part of audit message */
+	if (new_profile->ns != ns)
+		sa.name3 = new_profile->ns->base.name;
+
+	/* when transitioning profiles clear unsafe personality bits */
+	bprm->per_clear |= PER_CLEAR_ON_SETID;
+
+	aa_put_profile(cxt->sys.profile);
+	cxt->sys.profile = new_profile;
+
+x_clear:
+	aa_put_profile(cxt->sys.previous);
+	aa_put_profile(cxt->sys.onexec);
+	cxt->sys.previous = NULL;
+	cxt->sys.onexec = NULL;
+	cxt->sys.token = 0;
+
+audit:
+	sa.base.error = aa_audit_file(profile, &sa);
+
+cleanup:
+	kfree(buffer);
+
+	return sa.base.error;
+}
+
+int apparmor_bprm_secureexec(struct linux_binprm *bprm)
+{
+	int ret = cap_bprm_secureexec(bprm);
+
+	/* the decision to use secure exec is computed in set_creds
+	 * and stored in bprm->unsafe.  The AppArmor X_UNSAFE flag is
+	 * indicates don't 
+	 */
+	if (!ret && (bprm->unsafe & AA_SECURE_X_NEEDED))
+		ret = 1;
+
+	return ret;
+}
+
+
+static int aa_revalidate_perm(struct aa_profile *profile, struct file *file,
+			      char *buffer, int size)
+{
+	umode_t mode = file->f_path.dentry->d_inode->i_mode;
+	char *name;
+	int error;
+
+	error = aa_get_name_to_buffer(&file->f_path, S_ISDIR(mode), buffer,
+				      size, &name);
+	return aa_file_common_perm(profile, "file_inherit", file,
+				   aa_map_file_to_perms(file), name,
+				   error);
+}
+
+static void revalidate_file(struct aa_profile *profile, struct file *file,
+			    unsigned long i, char *buffer, int size,
+			    struct cred *cred)
+{
+	if (aa_revalidate_perm(profile, file, buffer, size)) {
+		struct file *devnull = NULL;
+		int fd = get_unused_fd();
+		sys_close(i);
+		if (fd != i) {
+			if (fd >= 0)
+				put_unused_fd(fd);
+			return;
+		}
+		if (devnull) {
+			get_file(devnull);
+		} else if (apparmorfs_null) {
+			devnull = dentry_open(dget(apparmorfs_null),
+					      mntget(apparmorfs_mnt),
+					      O_RDWR, cred);
+			if (IS_ERR(devnull)) {
+				devnull = NULL;
+				put_unused_fd(fd);
+				return;
+			}
+		} else {
+			/* apparmorfs_null not setup */
+			put_unused_fd(fd);
+			return;
+		}
+		fd_install(fd, devnull);
+	}
+}
+
+/* 
+ * derived from security/selinux/hooks.c: flush_unauthorized_files &&
+ * fs/exec.c:flush_old_files
+ */
+static int revalidate_files(struct aa_profile *profile,
+			    struct files_struct *files, gfp_t gfp,
+			    struct cred *cred)
+{
+	struct file *file;
+	struct fdtable *fdt;
+	long j = -1;
+	char *buffer = kmalloc(g_apparmor_path_max, gfp);
+	if (!buffer)
+		return -ENOMEM;
+
+	spin_lock(&files->file_lock);
+	for (;;) {
+		unsigned long set, i;
+
+		j++;
+		i = j * __NFDBITS;
+		fdt = files_fdtable(files);
+		if (i >= fdt->max_fds)
+			break;
+		set = fdt->open_fds->fds_bits[j];
+		if (!set)
+			continue;
+		spin_unlock(&files->file_lock);
+		for ( ; set ; i++,set >>= 1) {
+			if (set & 1) {
+				file = fget(i);
+				if (!file)
+					continue;
+				revalidate_file(profile, file, i, buffer,
+						g_apparmor_path_max, cred);
+				fput(file);
+			}
+		}
+		spin_lock(&files->file_lock);
+	}
+	spin_unlock(&files->file_lock);	
+	kfree(buffer);
+	return 0;
+}
+
+int apparmor_bprm_committing_creds(struct linux_binprm *bprm)
+{
+	struct aa_profile *profile;
+	struct cred *cred = aa_get_task_policy(current, &profile);
+	struct aa_task_context *new_cxt = bprm->cred->security;
+	int error;
+
+	if ((new_cxt->sys.profile == profile) ||
+	    (new_cxt->sys.profile->flags & PFLAG_UNCONFINED)) {
+		put_cred(cred);
+		return 0;
+	}
+	put_cred(cred);
+
+	error = revalidate_files(new_cxt->sys.profile, current->files,
+				 GFP_KERNEL, bprm->cred);
+	if (error)
+		return error;
+
+	current->pdeath_signal = 0;
+
+	/* reset soft limits and set hard limits for the new profile */
+	__aa_transition_rlimits(profile, new_cxt->sys.profile);
+	return 0;
+}
+
+void apparmor_bprm_committed_creds(struct linux_binprm *bprm)
+{
+	/* TODO: cleanup signals - ipc mediation */
+	return;
+}
+
+/**
+ * aa_change_hat - change hat to/from subprofile
+ * @hat_name: hat to change to
+ * @token: magic value to validate the hat change
+ * @permtest: true if this is just a permission test
+ *
+ * Change to new @hat_name, and store the @hat_magic in the current task
+ * context.  If the new @hat_name is %NULL and the @token matches that
+ * stored in the current task context and is not 0, return to the top level
+ * profile.
+ * Returns %0 on success, error otherwise.
+ */
+int aa_change_hat(const char *hat_name, u64 token, int permtest)
+{
+	const struct cred *cred;
+	struct aa_task_context *cxt;
+	struct aa_profile *profile, *previous_profile, *hat = NULL;
+	struct aa_audit_file sa;
+	char *name = NULL;
+
+	memset(&sa, 0, sizeof(sa));
+	sa.base.gfp_mask = GFP_KERNEL;
+	sa.base.operation = "change_hat";
+	sa.request = AA_MAY_CHANGEHAT;
+
+	cred = aa_current_policy(&profile);
+	cxt = cred->security;
+	previous_profile = cxt->sys.previous;
+
+	if (!profile) {
+		sa.base.info = "unconfined";
+		sa.base.error = -EPERM;
+		goto audit;
+	}
+
+	if (hat_name) {
+		sa.name2 = profile->ns->base.name;
+
+		if (PROFILE_IS_HAT(profile))
+			hat = aa_find_child(profile->parent, hat_name);
+		else
+			hat = aa_find_child(profile, hat_name);
+		if (!hat) {
+			if (PROFILE_IS_HAT(profile))
+				name = new_compound_name(profile->parent->fqname,
+							 hat_name);
+			else
+				name = new_compound_name(profile->fqname,
+							 hat_name);
+			sa.name = name;
+			sa.base.info = "hat not found";
+			sa.base.error = -ENOENT;
+			if (permtest || !PROFILE_COMPLAIN(profile))
+				/* probing is an expected unfortunate behavior
+				 * of the change_hat api is traditionally quiet
+				 */
+				goto out;
+			hat = aa_alloc_null_profile(profile, 1);
+			if (!hat) {
+				sa.base.info = "failed null profile create";
+				sa.base.error = -ENOMEM;
+				goto audit;
+			}
+		} else {
+			sa.name = hat->fqname;
+			if (!PROFILE_IS_HAT(hat)) {
+				sa.base.info = "target not hat";
+				sa.base.error = -EPERM;
+				goto audit;
+			}
+		}
+
+		sa.base.error = aa_may_change_ptraced_domain(current, hat);
+		if (sa.base.error) {
+			sa.base.info = "ptraced";
+			sa.base.error = -EPERM;
+			goto audit;
+		}
+
+		if (!permtest) {
+			sa.base.error = aa_set_current_hat(hat, token);
+			if (sa.base.error == -EACCES) {
+				(void)send_sig_info(SIGKILL, NULL, current);
+				sa.base.error = aa_audit(AUDIT_APPARMOR_KILL,
+							 profile, &sa.base,
+							 file_audit_cb);
+				goto out;
+			} else if (name && !sa.base.error)
+				/* reset error for learning of new hats */
+				sa.base.error = -ENOENT;
+		}
+	} else if (previous_profile) {
+		sa.name = previous_profile->fqname;
+		sa.base.error = aa_restore_previous_profile(token);
+		sa.perms.kill = AA_MAY_CHANGEHAT;
+	}
+	/* else
+		 ignore restores when there is no saved profile
+	*/
+
+audit:
+	if (!permtest)
+		sa.base.error = aa_audit_file(profile, &sa);
+
+
+out:
+	aa_put_profile(hat);
+	kfree(name);
+
+	return sa.base.error;
+}
+
+/**
+ * aa_change_profile - perform a one-way profile transition
+ * @ns_name: name of the profile namespace to change to
+ * @fqname: name of profile to change to
+ * @onexec: whether this transition is to take place immediately or at exec
+ * @permtest: true if this is just a permission test
+ *
+ * Change to new profile @name.  Unlike with hats, there is no way
+ * to change back.  If @onexec then the transition is delayed until
+ * the next exec.
+ *
+ * Returns %0 on success, error otherwise.
+ */
+int aa_change_profile(const char *ns_name, const char *fqname, int onexec,
+		      int permtest)
+{
+	const struct cred *cred;
+	struct aa_task_context *cxt;
+	struct aa_profile *profile, *target = NULL;
+	struct aa_namespace *ns = NULL;
+	struct aa_audit_file sa;
+
+	if (!fqname && !ns_name)
+		return -EINVAL;
+
+	memset(&sa, 0, sizeof(sa));
+	sa.request = AA_MAY_CHANGE_PROFILE;
+	sa.base.gfp_mask = GFP_KERNEL;
+	if (onexec)
+		sa.base.operation = "change_onexec";
+	else
+		sa.base.operation = "change_profile";
+
+	cred = aa_current_policy(&profile);
+	cxt = cred->security;
+
+	if (ns_name) {
+		sa.name2 = ns_name;
+		ns = aa_find_namespace(ns_name);
+		if (!ns) {
+			/* we don't create new namespace in complain mode */
+			sa.base.info = "namespace not found";
+			sa.base.error = -ENOENT;
+			goto audit;
+		}
+	} else {
+		ns = aa_get_namespace(cxt->sys.profile->ns);
+		sa.name2 = ns->base.name;
+	}
+
+	/* if the name was not specified, use the name of the current profile */
+	if (!fqname) {
+		if (!profile)
+			fqname = ns->unconfined->fqname;
+		else
+			fqname = profile->fqname;
+	}
+	sa.name = fqname;
+
+	sa.perms = change_profile_perms(profile, ns, fqname, NULL);
+	if (!(sa.perms.allowed & AA_MAY_CHANGE_PROFILE)) {
+		sa.base.error = -EACCES;
+		goto audit;
+	}
+
+	target = aa_find_profile_by_fqname(ns, fqname);
+	if (!target) {
+		sa.base.info = "profile not found";
+		sa.base.error = -ENOENT;
+		if (permtest || !PROFILE_COMPLAIN(profile))
+			goto audit;
+		target = aa_alloc_null_profile(profile, 0);
+	}
+	
+	/* check if tracing task is allowed to trace target domain */
+	sa.base.error = aa_may_change_ptraced_domain(current, target);
+	if (sa.base.error) {
+		sa.base.info = "ptrace prevents transition";
+		goto audit;
+	}
+
+	if (permtest)
+		goto audit;
+
+	if (onexec)
+		sa.base.error = aa_set_current_onexec(target);
+	else
+		sa.base.error = aa_replace_current_profiles(target);
+
+audit:
+	if (!permtest)
+		sa.base.error = aa_audit_file(profile, &sa);
+
+	aa_put_namespace(ns);
+	aa_put_profile(target);
+
+	return sa.base.error;
+}
--- linux-rt-2.6.31.orig/ubuntu/apparmor/net.c
+++ linux-rt-2.6.31/ubuntu/apparmor/net.c
@@ -0,0 +1,146 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor network mediation
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#include "include/apparmor.h"
+#include "include/audit.h"
+#include "include/context.h"
+#include "include/net.h"
+#include "include/policy.h"
+
+#include "af_names.h"
+
+static const char *sock_type_names[] = {
+	"unknown(0)",
+	"stream",
+	"dgram",
+	"raw",
+	"rdm",
+	"seqpacket",
+	"dccp",
+	"unknown(7)",
+	"unknown(8)",
+	"unknown(9)",
+	"packet",
+};
+
+struct aa_audit_net {
+	struct aa_audit base;
+
+	int family, type, protocol;
+
+};
+
+static void audit_cb(struct audit_buffer *ab, void *va)
+{
+	struct aa_audit_net *sa = va;
+
+	if (sa->family || sa->type) {
+		if (address_family_names[sa->family])
+			audit_log_format(ab, " family=\"%s\"",
+					 address_family_names[sa->family]);
+		else
+			audit_log_format(ab, " family=\"unknown(%d)\"",
+					 sa->family);
+
+		if (sock_type_names[sa->type])
+			audit_log_format(ab, " sock_type=\"%s\"",
+					 sock_type_names[sa->type]);
+		else
+			audit_log_format(ab, " sock_type=\"unknown(%d)\"",
+					 sa->type);
+
+		audit_log_format(ab, " protocol=%d", sa->protocol);
+	}
+	
+}
+
+static int aa_audit_net(struct aa_profile *profile, struct aa_audit_net *sa)
+{
+	int type = AUDIT_APPARMOR_AUTO;
+
+	if (likely(!sa->base.error)) {
+		u16 audit_mask = profile->net.audit[sa->family];
+		if (likely((PROFILE_AUDIT_MODE(profile) != AUDIT_ALL) &&
+			   !(1 << sa->type & audit_mask)))
+			return 0;
+		type = AUDIT_APPARMOR_AUDIT;
+	} else {
+		u16 quiet_mask = profile->net.quiet[sa->family];
+		u16 kill_mask = 0;
+		u16 denied = (1 << sa->type) & ~quiet_mask;
+
+		if (denied & kill_mask)
+			type = AUDIT_APPARMOR_KILL;
+
+		if ((denied & quiet_mask) &&
+		    PROFILE_AUDIT_MODE(profile) != AUDIT_NOQUIET &&
+		    PROFILE_AUDIT_MODE(profile) != AUDIT_ALL)
+			return PROFILE_COMPLAIN(profile) ? 0 : sa->base.error;
+	}
+
+	return aa_audit(type, profile, (struct aa_audit *)sa, audit_cb);
+}
+
+int aa_net_perm(struct aa_profile *profile, char *operation,
+		int family, int type, int protocol)
+{
+	struct aa_audit_net sa;
+	u16 family_mask;
+
+	if ((family < 0) || (family >= AF_MAX))
+		return -EINVAL;
+
+	if ((type < 0) || (type >= SOCK_MAX))
+		return -EINVAL;
+
+	/* unix domain and netlink sockets are handled by ipc */
+	if (family == AF_UNIX || family == AF_NETLINK)
+		return 0;
+
+	family_mask = profile->net.allowed[family];
+
+	memset(&sa, 0, sizeof(sa));
+	sa.base.error = (family_mask & (1 << type)) ? 0 : -EACCES;
+	sa.base.operation = operation;
+	sa.base.gfp_mask = GFP_KERNEL;
+	sa.family = family;
+	sa.type = type;
+	sa.protocol = protocol;
+
+	return  aa_audit_net(profile, &sa);
+}
+
+int aa_revalidate_sk(struct sock *sk, char *operation)
+{
+	struct aa_profile *profile;
+	struct cred *cred;
+	int error = 0;
+
+	/* this is some debugging code to flush out the network hooks that
+	   that are called in interrupt context */
+	if (in_interrupt()) {
+		printk(KERN_WARNING "AppArmor Debug: Hook being called from interrupt context\n");
+		dump_stack();
+		return 0;
+	}
+
+	cred = aa_get_task_policy(current, &profile);
+	if (profile)
+		error = aa_net_perm(profile, operation,
+				    sk->sk_family, sk->sk_type,
+				    sk->sk_protocol);
+	put_cred(cred);
+
+	return error;
+}
--- linux-rt-2.6.31.orig/ubuntu/apparmor/sid.c
+++ linux-rt-2.6.31/ubuntu/apparmor/sid.c
@@ -0,0 +1,113 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor security identifier (sid) manipulation fns
+ *
+ * Copyright 2009 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ *
+ *
+ * AppArmor allocates a unique sid for every profile loaded.  If a profile
+ * is replaced it receive the sid of the profile it is replacing.  Each sid
+ * is a u32 with the lower u16 being sids of system profiles and the
+ * upper u16 being user profile sids.
+ *
+ * The sid value of 0 is invalid for system sids and is used to indicate
+ * unconfined for user sids.
+ *
+ * A compound sid is a pair of user and system sids that is used to identify
+ * both profiles confining a task.
+ *
+ * Both system and user sids are globally unique with all users pulling
+ * from the same sid pool.  User sid allocation is limited by the
+ * user controls, that can limit how many profiles are loaded by a user.
+ */
+
+#include <linux/spinlock.h>
+#include <linux/errno.h>
+#include <linux/err.h>
+
+#include "include/sid.h"
+
+/* global counter from which sids are allocated */
+static u16 global_sys_sid;
+static u16 global_usr_sid;
+static DEFINE_SPINLOCK(sid_lock);
+
+
+/* TODO FIXME: add sid to profile mapping, and sid recycling */
+
+
+/**
+ * aa_alloc_sid - allocate a new sid for a profile
+ * @is_usr: true if the new sid is a user based sid
+ */
+u32 aa_alloc_sid(int is_usr)
+{
+	u32 sid;
+
+	/* 
+	 * TODO FIXME: sid recycling - part of profile mapping table
+	 */
+	spin_lock(&sid_lock);
+	if (is_usr) {
+		sid = (++global_usr_sid) << 16;
+	        
+	} else {
+		sid = ++global_sys_sid;
+	}
+	spin_unlock(&sid_lock);
+	return sid;
+}
+
+/**
+ * aa_free_sid - free a sid
+ * @sid: sid to free
+ */
+void aa_free_sid(u32 sid)
+{
+	;	/* NOP ATM */
+}
+
+/**
+ * aa_add_sid_profile - associate a profile to a sid for sid -> profile lookup
+ * @sid: sid of te profile
+ * @profile: profile to associate
+ *
+ * return 0 or error
+ */
+int aa_add_sid_profile(u32 sid, struct aa_profile *profile)
+{
+	/* NOP ATM */
+	return 0;
+}
+
+/**
+ * aa_replace_sid_profile - replace the profile associated with a sid
+ * @sid: sid to associate a new profile with
+ * @profile: profile to associate with side
+ *
+ * return 0 or error
+ */
+int aa_replace_sid_profile(u32 sid, struct aa_profile *profile)
+{
+	/* NOP ATM */
+	return 0;
+}
+
+/**
+ * aa_get_sid_profile - get the profile associated with the sid
+ * @sid: sid to lookup
+ *
+ * returns - the profile, or NULL for unconfined user.
+ *         - if there is an error -ENOENT, -EINVAL
+ */
+struct aa_profile *aa_get_sid_profile(u32 sid)
+{
+	return ERR_PTR(-EINVAL);
+}
+
--- linux-rt-2.6.31.orig/ubuntu/apparmor/resource.c
+++ linux-rt-2.6.31/ubuntu/apparmor/resource.c
@@ -0,0 +1,104 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor resource mediation and attachment
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#include <linux/audit.h>
+
+#include "include/audit.h"
+#include "include/resource.h"
+#include "include/policy.h"
+
+struct aa_audit_resource {
+	struct aa_audit base;
+
+	int rlimit;
+};
+
+static void audit_cb(struct audit_buffer *ab, void *va)
+{
+	struct aa_audit_resource *sa = va;
+
+	if (sa->rlimit)
+		audit_log_format(ab, " rlimit=%d", sa->rlimit - 1);
+}
+
+static int aa_audit_resource(struct aa_profile *profile,
+			     struct aa_audit_resource *sa)
+{
+	return aa_audit(AUDIT_APPARMOR_AUTO, profile, (struct aa_audit *)sa,
+			audit_cb);
+}
+
+/**
+ * aa_task_setrlimit - test permission to set an rlimit
+ * @profile - profile confining the task
+ * @resource - the resource being set
+ * @new_rlim - the new resource limit
+ *
+ * Control raising the processes hard limit.
+ */
+int aa_task_setrlimit(struct aa_profile *profile, unsigned int resource,
+		      struct rlimit *new_rlim)
+{
+	struct aa_audit_resource sa;
+	int error = 0;
+
+	memset(&sa, 0, sizeof(sa));
+	sa.base.operation = "setrlimit";
+	sa.base.gfp_mask = GFP_KERNEL;
+	sa.rlimit = resource + 1;
+
+	if (profile->rlimits.mask & (1 << resource) &&
+	    new_rlim->rlim_max > profile->rlimits.limits[resource].rlim_max) {
+		sa.base.error = -EACCES;
+
+		error = aa_audit_resource(profile, &sa);
+	}
+
+	return error;
+}
+
+void __aa_transition_rlimits(struct aa_profile *old, struct aa_profile *new)
+{
+	unsigned int mask = 0;
+	struct rlimit *rlim, *initrlim;
+	int i;
+
+	/* for any rlimits the profile controlled reset the soft limit
+	 * to the less of the tasks hard limit and the init tasks soft limit
+	 */
+	if (old && old->rlimits.mask) {
+		for (i = 0, mask = 1; i < RLIM_NLIMITS; i++, mask <<=1) {
+			if (old->rlimits.mask & mask) {
+				rlim = current->signal->rlim + i;
+				initrlim = init_task.signal->rlim + i;
+				rlim->rlim_cur = min(rlim->rlim_max,
+						     initrlim->rlim_cur);
+			}
+		}
+	}
+
+	/* set any new hard limits as dictated by the new profile */
+	if (!(new && new->rlimits.mask))
+		return;
+	for (i = 0, mask = 1; i < RLIM_NLIMITS; i++, mask <<=1) {
+		if (!(new->rlimits.mask & mask))
+			continue;
+
+		rlim = current->signal->rlim + i;
+		rlim->rlim_max = min(rlim->rlim_max,
+				     new->rlimits.limits[i].rlim_max);
+		/* soft limit should not exceed hard limit */
+		rlim->rlim_cur = min(rlim->rlim_cur, rlim->rlim_max);
+	}
+}
--- linux-rt-2.6.31.orig/ubuntu/apparmor/ipc.c
+++ linux-rt-2.6.31/ubuntu/apparmor/ipc.c
@@ -0,0 +1,106 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor ipc mediation
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#include <linux/gfp.h>
+#include <linux/ptrace.h>
+
+#include "include/audit.h"
+#include "include/capability.h"
+#include "include/context.h"
+#include "include/policy.h"
+
+
+struct aa_audit_ptrace {
+	struct aa_audit base;
+
+	pid_t tracer, tracee;
+};
+
+/* call back to audit ptrace fields */
+static void audit_cb(struct audit_buffer *ab, void *va)
+{
+	struct aa_audit_ptrace *sa = va;
+	audit_log_format(ab, " tracer=%d tracee=%d", sa->tracer, sa->tracee);
+}
+
+static int aa_audit_ptrace(struct aa_profile *profile,
+			   struct aa_audit_ptrace *sa)
+{
+	return aa_audit(AUDIT_APPARMOR_AUTO, profile, (struct aa_audit *)sa,
+			audit_cb);
+}
+
+int aa_may_ptrace(struct task_struct *tracer_task, struct aa_profile *tracer,
+		  struct aa_profile *tracee, unsigned int mode)
+{
+	/* TODO: currently only based on capability, not extended ptrace
+	 *       rules,
+	 *       Test mode for PTRACE_MODE_READ || PTRACE_MODE_ATTACH
+	 */
+
+	if (!tracer || tracer == tracee)
+		return 0;
+	/* log this capability request */
+	return aa_capable(tracer_task, tracer, CAP_SYS_PTRACE, 1);
+}
+
+int aa_ptrace(struct task_struct *tracer, struct task_struct *tracee,
+	      unsigned int mode)
+{
+	/*
+	 * tracer can ptrace tracee when
+	 * - tracer is unconfined ||
+	 * - tracer & tracee are in the same namespace &&
+	 *   - tracer is in complain mode
+	 *   - tracer has rules allowing it to trace tracee currently this is:
+	 *       - confined by the same profile ||
+	 *       - tracer profile has CAP_SYS_PTRACE
+	 */
+
+	struct aa_profile *tracer_p;
+	const struct cred *cred = aa_get_task_policy(tracer, &tracer_p);
+	int error = 0;
+
+	if (tracer_p) {
+		struct aa_audit_ptrace sa;
+		memset(&sa, 0, sizeof(sa));
+		sa.base.operation = "ptrace";
+		sa.base.gfp_mask = GFP_ATOMIC;
+		sa.tracer = tracer->pid;
+		sa.tracee = tracee->pid;
+		/* FIXME: different namespace restriction can be lifted
+		 * if, namespace are matched to AppArmor namespaces
+		 */
+		if (tracer->nsproxy != tracee->nsproxy) {
+			sa.base.info = "different namespaces";
+			sa.base.error = -EPERM;
+			aa_audit(AUDIT_APPARMOR_DENIED, tracer_p, &sa.base,
+				 audit_cb);
+		} else {
+			struct aa_profile *tracee_p;
+			struct cred *lcred = aa_get_task_policy(tracee,
+								&tracee_p);
+
+			sa.base.error = aa_may_ptrace(tracer, tracer_p,
+						      tracee_p, mode);
+			sa.base.error = aa_audit_ptrace(tracer_p, &sa);
+
+			put_cred(lcred);
+		}
+		error = sa.base.error;
+	}
+	put_cred(cred);
+
+	return error;
+}
--- linux-rt-2.6.31.orig/ubuntu/apparmor/path.c
+++ linux-rt-2.6.31/ubuntu/apparmor/path.c
@@ -0,0 +1,170 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor function for pathnames
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#include <linux/mnt_namespace.h>
+#include <linux/mount.h>
+#include <linux/namei.h>
+#include <linux/path.h>
+#include <linux/sched.h>
+#include <linux/slab.h>
+#include <linux/fs_struct.h>
+
+#include "include/apparmor.h"
+#include "include/path.h"
+
+int aa_get_name_to_buffer(struct path *path, int is_dir, char *buffer, int size,
+			  char **name)
+{
+	int error = d_namespace_path(path, buffer, size - is_dir, name);
+
+	if (!error && is_dir && (*name)[1] != '\0')
+		/*
+		 * Append "/" to the pathname.  The root directory is a special
+		 * case; it already ends in slash.
+		 */
+		strcpy(&buffer[size - 2], "/");
+
+	return error;
+}
+
+/**
+ * aa_get_name - compute the pathname of a file
+ * @path: path the file
+ * @is_dir: set if the file is a directory
+ * @buffer: buffer that aa_get_name() allocated
+ * @name: the error code indicating whether aa_get_name failed
+ *
+ * Returns an error code if the there was a failure in obtaining the
+ * name.
+ *
+ * @name is apointer to the beginning of the pathname (which usually differs
+ * from the beginning of the buffer), or NULL.  If there is an error @name
+ * may contain a partial or invalid name (in the case of a deleted file), that
+ * can be used for audit purposes, but it can not be used for mediation.
+ *
+ * We need @is_dir to indicate whether the file is a directory or not because
+ * the file may not yet exist, and so we cannot check the inode's file type.
+ */
+int aa_get_name(struct path *path, int is_dir, char **buffer, char **name)
+{
+	char *buf, *str = NULL;
+	int size = 256;
+	int error;
+
+	*name = NULL;
+	*buffer = NULL;
+	for (;;) {
+		buf = kmalloc(size, GFP_KERNEL);
+		if (!buf)
+			return -ENOMEM;
+
+		error = aa_get_name_to_buffer(path, is_dir, buf, size, &str);
+		if (!error || (error == -ENOENT) || (error == -ESTALE))
+			break;
+
+		kfree(buf);
+		size <<= 1;
+		if (size > g_apparmor_path_max)
+			return -ENAMETOOLONG;
+	}
+	*buffer = buf;
+	*name = str;
+
+	return error;
+}
+
+int d_namespace_path(struct path *path, char *buf, int buflen, char **name)
+{
+	struct path root, tmp, ns_root = { };
+	char *res;
+	int error = 0;
+
+	read_lock(&current->fs->lock);
+	root = current->fs->root;
+	path_get(&current->fs->root);
+	read_unlock(&current->fs->lock);
+	spin_lock(&vfsmount_lock);
+	if (root.mnt && root.mnt->mnt_ns)
+		ns_root.mnt = mntget(root.mnt->mnt_ns->root);
+	if (ns_root.mnt)
+		ns_root.dentry = dget(ns_root.mnt->mnt_root);
+	spin_unlock(&vfsmount_lock);
+	spin_lock(&dcache_lock);
+	tmp = ns_root;
+	res = __d_path(path, &tmp, buf, buflen);
+
+	*name = res;
+	/* handle error conditions - and still allow a partial path to
+	 * be returned */
+	if (IS_ERR(res)) {
+		error = PTR_ERR(res);
+		*name = buf;
+	} else if (d_unhashed(path->dentry) && !path->dentry->d_inode) {
+		/* On some filesystems, newly allocated dentries appear
+		 * to the security_path hooks as a deleted
+		 * dentry except without an inode allocated.
+		 *
+		 * Remove the appended deleted text and return as a
+		 * string for normal mediation.  The (deleted) string
+		 * is guarenteed to be added in this case, so just
+		 * strip it.
+		 */
+		buf[buflen - 11] = 0;	/* - (len(" (deleted)") +\0) */
+	} else if (d_unhashed(path->dentry) && (buf + buflen) - res > 11 &&
+		   strcmp(buf + buflen - 11, " (deleted)") == 0) {
+		/* For now allow mediation of deleted paths */
+		buf[buflen - 11] = 0;	/* - (len(" (deleted)") +\0) */
+	} else if (!IS_ROOT(path->dentry) && d_unhashed(path->dentry)) {
+		error = -ENOENT;
+#if 0
+	} else if (tmp.dentry != ns_root.dentry && tmp.mnt != ns_root.mnt) {
+		/* disconnected path don return pathname starting with '/' */
+		error = -ESTALE;
+		if (*res == '/')
+			*name = res + 1;
+#endif
+	}
+
+	spin_unlock(&dcache_lock);
+	path_put(&root);
+	path_put(&ns_root);
+
+	return error;
+}
+
+char *sysctl_pathname(struct ctl_table *table, char *buffer, int buflen)
+{
+	if (buflen < 1)
+		return NULL;
+	buffer += --buflen;
+	*buffer = '\0';
+
+	while (table) {
+		int namelen = strlen(table->procname);
+
+		if (buflen < namelen + 1)
+			return NULL;
+		buflen -= namelen + 1;
+		buffer -= namelen;
+		memcpy(buffer, table->procname, namelen);
+		*--buffer = '/';
+		table = table->parent;
+	}
+	if (buflen < 4)
+		return NULL;
+	buffer -= 4;
+	memcpy(buffer, "/sys", 4);
+
+	return buffer;
+}
--- linux-rt-2.6.31.orig/ubuntu/apparmor/context.c
+++ linux-rt-2.6.31/ubuntu/apparmor/context.c
@@ -0,0 +1,209 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor functions used to manipulate object security
+ * contexts.
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#include "include/context.h"
+#include "include/policy.h"
+
+
+
+struct aa_task_context *aa_alloc_task_context(gfp_t flags)
+{
+	return kzalloc(sizeof(struct aa_task_context), flags);
+}
+
+void aa_free_task_context(struct aa_task_context *cxt)
+{
+	if (cxt) {
+		aa_put_profile(cxt->sys.profile);
+		aa_put_profile(cxt->sys.previous);
+		aa_put_profile(cxt->sys.onexec);
+
+		memset(cxt, 0, sizeof(*cxt));
+		kfree(cxt);
+	}
+}
+
+/*
+ * duplicate a task context, incrementing reference counts
+ */
+struct aa_task_context *aa_dup_task_context(struct aa_task_context *old_cxt,
+					    gfp_t gfp)
+{
+	struct aa_task_context *cxt;
+
+	cxt = kmemdup(old_cxt, sizeof(*cxt), gfp);
+	if (!cxt)
+		return NULL;
+
+	aa_get_profile(cxt->sys.profile);
+	aa_get_profile(cxt->sys.previous);
+	aa_get_profile(cxt->sys.onexec);
+
+	return cxt;
+}
+
+/**
+ * aa_cred_policy - obtain cred's profiles
+ * @cred: cred to obtain profiles from
+ * @sys: return system profile
+ * does NOT increment reference count
+ */
+void aa_cred_policy(const struct cred *cred, struct aa_profile **sys)
+{
+	struct aa_task_context *cxt = cred->security;
+	BUG_ON(!cxt);
+	*sys = aa_filtered_profile(aa_profile_newest(cxt->sys.profile));
+}
+
+/**
+ * aa_get_task_policy - get the cred with the task policy, and current profiles
+ * @task: task to get policy of
+ * @sys: return - pointer to system profile
+ *
+ * Only gets the cred ref count which has ref counts on the profiles returned
+ */
+struct cred *aa_get_task_policy(const struct task_struct *task,
+				struct aa_profile **sys)
+{
+	struct cred *cred = get_task_cred(task);
+	aa_cred_policy(cred, sys);
+	return cred;
+}
+
+void aa_put_task_policy(struct cred *cred)
+{
+	put_cred(cred);
+}
+
+static void replace_group(struct aa_task_cxt_group *cgrp,
+			  struct aa_profile *profile)
+{
+	if (cgrp->profile == profile)
+		return;
+
+	if (!profile || (profile->flags & PFLAG_UNCONFINED) ||
+	    (cgrp->profile && cgrp->profile->ns != profile->ns)) {
+		aa_put_profile(cgrp->previous);
+		aa_put_profile(cgrp->onexec);
+		cgrp->previous = NULL;
+		cgrp->onexec = NULL;
+		cgrp->token = 0;
+	}
+	aa_put_profile(cgrp->profile);
+	cgrp->profile = aa_get_profile(profile);
+}
+
+/**
+ * aa_replace_current_profiles - replace the current tasks profiles
+ * @sys: new system profile
+ *
+ * Returns: error on failure
+ */
+int aa_replace_current_profiles(struct aa_profile *sys)
+{
+	struct aa_task_context *cxt;
+	struct cred *new = prepare_creds();
+	if (!new)
+		return -ENOMEM;
+
+	cxt = new->security;
+	replace_group(&cxt->sys, sys);
+
+	commit_creds(new);
+	return 0;
+}
+
+int aa_set_current_onexec(struct aa_profile *sys)
+{
+	struct aa_task_context *cxt;
+	struct cred *new = prepare_creds();
+	if (!new)
+		return -ENOMEM;
+
+	cxt = new->security;
+	aa_put_profile(cxt->sys.onexec);
+	cxt->sys.onexec = aa_get_profile(sys);
+
+	commit_creds(new);
+	return 0;
+}
+
+/*
+ * Do the actual cred switching of a changehat
+ * profile must be valid
+ */
+int aa_set_current_hat(struct aa_profile *profile, u64 token)
+{
+	struct aa_task_context *cxt;
+	struct cred *new = prepare_creds();
+	if (!new)
+		return -ENOMEM;
+
+	cxt = new->security;
+	if (!cxt->sys.previous) {
+		cxt->sys.previous = cxt->sys.profile;
+		cxt->sys.token = token;
+	} else if (cxt->sys.token == token) {
+		aa_put_profile(cxt->sys.profile);
+	} else {
+		/* previous_profile && cxt->token != token */
+		abort_creds(new);
+		return -EACCES;
+	}
+	cxt->sys.profile = aa_get_profile(profile);
+	/* clear exec on switching context */
+	aa_put_profile(cxt->sys.onexec);
+	cxt->sys.onexec = NULL;
+
+	commit_creds(new);
+	return 0;
+}
+
+/*
+ * Attempt to return out of a hat to the previous profile
+ */
+int aa_restore_previous_profile(u64 token)
+{
+	struct aa_task_context *cxt;
+	struct cred *new = prepare_creds();
+	if (!new)
+		return -ENOMEM;
+
+	cxt = new->security;
+	if (cxt->sys.token != token) {
+		abort_creds(new);
+		return -EACCES;
+	}
+	/* ignore restores when there is no saved profile */
+	if (!cxt->sys.previous) {
+		abort_creds(new);
+		return 0;
+	}
+
+	aa_put_profile(cxt->sys.profile);
+	cxt->sys.profile = aa_profile_newest(cxt->sys.previous);
+	if (unlikely(cxt->sys.profile != cxt->sys.previous)) {
+		aa_get_profile(cxt->sys.profile);
+		aa_put_profile(cxt->sys.previous);
+	}
+	/* clear exec && prev information when restoring to previous context */
+	cxt->sys.previous = NULL;
+	cxt->sys.token = 0;
+	aa_put_profile(cxt->sys.onexec);
+	cxt->sys.onexec = NULL;
+
+	commit_creds(new);
+	return 0;
+}
--- linux-rt-2.6.31.orig/ubuntu/apparmor/include/resource.h
+++ linux-rt-2.6.31/ubuntu/apparmor/include/resource.h
@@ -0,0 +1,46 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor resource limits function defintions.
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#ifndef __AA_RESOURCE_H
+#define __AA_RESOURCE_H
+
+#include <linux/resource.h>
+#include <linux/sched.h>
+
+struct aa_profile;
+
+/* struct aa_rlimit - rlimits settings for the profile
+ * @mask: which hard limits to set
+ * @limits: rlimit values that override task limits
+ *
+ * AppArmor rlimits are used to set confined task rlimits.  Only the
+ * limits specified in @mask will be controlled by apparmor.
+ */
+struct aa_rlimit {
+	unsigned int mask;
+	struct rlimit limits[RLIM_NLIMITS];
+};
+
+
+int aa_task_setrlimit(struct aa_profile *profile, unsigned int resource,
+		      struct rlimit *new_rlim);
+
+void __aa_transition_rlimits(struct aa_profile *old, struct aa_profile *new);
+
+static inline void aa_free_rlimit_rules(struct aa_rlimit *rlims)
+{
+	/* NOP */
+}
+
+#endif	/* __AA_RESOURCE_H */
--- linux-rt-2.6.31.orig/ubuntu/apparmor/include/net.h
+++ linux-rt-2.6.31/ubuntu/apparmor/include/net.h
@@ -0,0 +1,40 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor network mediation definitions.
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#ifndef __AA_NET_H
+#define __AA_NET_H
+
+#include <net/sock.h>
+
+/* struct aa_net - network confinement data
+ * @allowed: basic network families permissions
+ * @audit_network: which network permissions to force audit
+ * @quiet_network: which network permissions to quiet rejects
+ */
+struct aa_net {
+	u16 allowed[AF_MAX];
+	u16 audit[AF_MAX];
+	u16 quiet[AF_MAX];
+};
+
+extern int aa_net_perm(struct aa_profile *profile, char *operation,
+			int family, int type, int protocol);
+extern int aa_revalidate_sk(struct sock *sk, char *operation);
+
+static inline void aa_free_net_rules(struct aa_net *new)
+{
+	/* NOP */
+}
+
+#endif	/* __AA_NET_H */
--- linux-rt-2.6.31.orig/ubuntu/apparmor/include/policy_interface.h
+++ linux-rt-2.6.31/ubuntu/apparmor/include/policy_interface.h
@@ -0,0 +1,22 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor policy loading interface function definitions.
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#ifndef __POLICY_INTERFACE_H
+#define __POLICY_INTERFACE_H
+
+ssize_t aa_interface_add_profiles(void *data, size_t size);
+ssize_t aa_interface_replace_profiles(void *udata, size_t size);
+ssize_t aa_interface_remove_profiles(char *name, size_t size);
+
+#endif	/* __POLICY_INTERFACE_H */
--- linux-rt-2.6.31.orig/ubuntu/apparmor/include/apparmor.h
+++ linux-rt-2.6.31/ubuntu/apparmor/include/apparmor.h
@@ -0,0 +1,65 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor basic global and lib definitions
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#ifndef __APPARMOR_H
+#define __APPARMOR_H
+
+#include <linux/fs.h>
+
+/* Control parameters settable thru module/boot flags or
+ * via /sys/kernel/security/apparmor/control */
+extern enum audit_mode g_apparmor_audit;
+extern int g_apparmor_audit_header;
+extern int g_apparmor_debug;
+extern int g_apparmor_lock_policy;
+extern int g_apparmor_logsyscall;
+extern unsigned int g_apparmor_path_max;
+
+
+/*
+ * DEBUG remains global (no per profile flag) since it is mostly used in sysctl
+ * which is not related to profile accesses.
+ */
+
+#define AA_DEBUG(fmt, args...)						\
+	do {								\
+		if (g_apparmor_debug && printk_ratelimit())		\
+			printk(KERN_DEBUG "AppArmor: " fmt, ##args);	\
+	} while (0)
+
+#define AA_ERROR(fmt, args...)						\
+	do {								\
+		if (printk_ratelimit())					\
+			printk(KERN_ERR "AppArmor: " fmt, ##args);	\
+	} while (0)
+
+/* Flag indicating whether initialization completed */
+extern int apparmor_initialized;
+void apparmor_disable(void);
+
+/* fn's in lib */
+void info_message(const char *str);
+char *aa_split_name_from_ns(char *args, char **ns_name);
+char *new_compound_name(const char *n1, const char *n2);
+int aa_strneq(const char *str, const char *sub, int len);
+char *strchrnul(const char *s, int c);
+const char *fqname_subname(const char *name);
+
+static inline int mediated_filesystem(struct inode *inode)
+{
+	return !(inode->i_sb->s_flags & MS_NOUSER);
+}
+
+#endif	/* __APPARMOR_H */
+
--- linux-rt-2.6.31.orig/ubuntu/apparmor/include/capability.h
+++ linux-rt-2.6.31/ubuntu/apparmor/include/capability.h
@@ -0,0 +1,45 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor capability mediation definitions.
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#ifndef __AA_CAPABILITY_H
+#define __AA_CAPABILITY_H
+
+#include <linux/sched.h>
+
+struct aa_profile;
+
+/* aa_caps - confinement data for capabilities
+ * @set_caps: capabilities that are being set
+ * @capabilities: capabilities mask
+ * @audit_caps: caps that are to be audited
+ * @quiet_caps: caps that should not be audited
+ */
+struct aa_caps {
+	kernel_cap_t set;
+	kernel_cap_t allowed;
+	kernel_cap_t audit;
+	kernel_cap_t quiet;
+	kernel_cap_t kill;
+};
+
+int aa_profile_capable(struct aa_profile *profile, int cap);
+int aa_capable(struct task_struct *task, struct aa_profile *profile, int cap,
+	       int audit);
+
+static inline void aa_free_cap_rules(struct aa_caps *caps)
+{
+	/* NOP */
+}
+
+#endif	/* __AA_CAPBILITY_H */
--- linux-rt-2.6.31.orig/ubuntu/apparmor/include/match.h
+++ linux-rt-2.6.31/ubuntu/apparmor/include/match.h
@@ -0,0 +1,105 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor policy dfa matching engine definitions.
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#ifndef __AA_MATCH_H
+#define __AA_MATCH_H
+
+#define DFA_NOMATCH			0
+#define DFA_START			1
+
+#define DFA_VALID_PERM_MASK		0xffffffff
+#define DFA_VALID_PERM2_MASK		0xffffffff
+
+
+/**
+ * The format used for transition tables is based on the GNU flex table
+ * file format (--tables-file option; see Table File Format in the flex
+ * info pages and the flex sources for documentation). The magic number
+ * used in the header is 0x1B5E783D insted of 0xF13C57B1 though, because
+ * the YY_ID_CHK (check) and YY_ID_DEF (default) tables are used
+ * slightly differently (see the apparmor-parser package).
+ */
+
+#define YYTH_MAGIC	0x1B5E783D
+
+struct table_set_header {
+	u32		th_magic;	/* YYTH_MAGIC */
+	u32		th_hsize;
+	u32		th_ssize;
+	u16		th_flags;
+	char		th_version[];
+};
+
+#define	YYTD_ID_ACCEPT	1
+#define YYTD_ID_BASE	2
+#define YYTD_ID_CHK	3
+#define YYTD_ID_DEF	4
+#define YYTD_ID_EC	5
+#define YYTD_ID_META	6
+#define YYTD_ID_ACCEPT2 7
+#define YYTD_ID_NXT	8
+
+
+#define YYTD_DATA8	1
+#define YYTD_DATA16	2
+#define YYTD_DATA32	4
+
+struct table_header {
+	u16		td_id;
+	u16		td_flags;
+	u32		td_hilen;
+	u32		td_lolen;
+	char		td_data[];
+};
+
+#define DEFAULT_TABLE(DFA) ((u16 *)((DFA)->tables[YYTD_ID_DEF - 1]->td_data))
+#define BASE_TABLE(DFA) ((u32 *)((DFA)->tables[YYTD_ID_BASE - 1]->td_data))
+#define NEXT_TABLE(DFA) ((u16 *)((DFA)->tables[YYTD_ID_NXT - 1]->td_data))
+#define CHECK_TABLE(DFA) ((u16 *)((DFA)->tables[YYTD_ID_CHK - 1]->td_data))
+#define EQUIV_TABLE(DFA) ((u8 *)((DFA)->tables[YYTD_ID_EC - 1]->td_data))
+#define ACCEPT_TABLE(DFA) ((u32 *)((DFA)->tables[YYTD_ID_ACCEPT - 1]->td_data))
+#define ACCEPT_TABLE2(DFA) ((u32 *)((DFA)->tables[YYTD_ID_ACCEPT2 - 1]->td_data))
+
+struct aa_dfa {
+	struct table_header *tables[YYTD_ID_NXT];
+};
+
+#define byte_to_byte(X) (X)
+
+#define UNPACK_ARRAY(TABLE, BLOB, LEN, TYPE, NTOHX) \
+	do { \
+		typeof(LEN) __i; \
+		TYPE *__t = (TYPE *) TABLE; \
+		TYPE *__b = (TYPE *) BLOB; \
+		for (__i = 0; __i < LEN; __i++) { \
+			__t[__i] = NTOHX(__b[__i]); \
+		} \
+	} while (0)
+
+static inline size_t table_size(size_t len, size_t el_size)
+{
+	return ALIGN(sizeof(struct table_header) + len * el_size, 8);
+}
+
+struct aa_dfa *aa_match_alloc(void);
+void aa_match_free(struct aa_dfa *dfa);
+int unpack_dfa(struct aa_dfa *dfa, void *blob, size_t size);
+int verify_dfa(struct aa_dfa *dfa);
+unsigned int aa_dfa_match_len(struct aa_dfa *dfa, unsigned int start,
+			      const char *str, int len);
+unsigned int aa_dfa_match(struct aa_dfa *dfa, unsigned int start,
+			  const char *str);
+unsigned int aa_dfa_null_transition(struct aa_dfa *dfa, unsigned int start);
+
+#endif /* __AA_MATCH_H */
--- linux-rt-2.6.31.orig/ubuntu/apparmor/include/sid.h
+++ linux-rt-2.6.31/ubuntu/apparmor/include/sid.h
@@ -0,0 +1,46 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor security identifier (sid) definitions
+ *
+ * Copyright 2009 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#ifndef __AA_SID_H
+#define __AA_SID_H
+
+#include <linux/types.h>
+
+struct aa_profile;
+
+#define AA_ALLOC_USR_SID 1
+#define AA_ALLOC_SYS_SID 0
+
+u32 aa_alloc_sid(int is_usr);
+void aa_free_sid(u32 sid);
+int aa_add_sid_profile(u32 sid, struct aa_profile *profile);
+int aa_replace_sid_profile(u32 sid, struct aa_profile *profile);
+struct aa_profile *aa_get_sid_profile(u32 sid);
+
+
+static inline u32 aa_compound_sid(u32 sys, u32 usr)
+{
+	return sys | usr;
+}
+
+static inline u32 aa_usr_sid(u32 sid)
+{
+	return sid & 0xffff0000;
+}
+
+static inline u32 aa_sys_sid(u32 sid)
+{
+	return sid & 0xffff;
+}
+
+#endif	/* __AA_SID_H */
--- linux-rt-2.6.31.orig/ubuntu/apparmor/include/policy.h
+++ linux-rt-2.6.31/ubuntu/apparmor/include/policy.h
@@ -0,0 +1,301 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor policy definitions.
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#ifndef __AA_POLICY_H
+#define __AA_POLICY_H
+
+#include <linux/capability.h>
+#include <linux/cred.h>
+#include <linux/kref.h>
+#include <linux/sched.h>
+#include <linux/slab.h>
+#include <linux/socket.h>
+
+#include "apparmor.h"
+#include "audit.h"
+#include "capability.h"
+#include "domain.h"
+#include "file.h"
+#include "net.h"
+#include "resource.h"
+
+extern const char *profile_mode_names[];
+#define APPARMOR_NAMES_MAX_INDEX 3
+
+#define PROFILE_COMPLAIN(_profile)				\
+	((g_profile_mode == APPARMOR_COMPLAIN) || ((_profile) &&	\
+					(_profile)->mode == APPARMOR_COMPLAIN))
+
+#define PROFILE_KILL(_profile)					\
+	((g_profile_mode == APPARMOR_KILL) || ((_profile) &&	\
+					(_profile)->mode == APPARMOR_KILL))
+
+#define PROFILE_IS_HAT(_profile) \
+	((_profile) && (_profile)->flags & PFLAG_HAT)
+
+
+/*
+ * FIXME: currently need a clean way to replace and remove profiles as a
+ * set.  It should be done at the namespace level.
+ * Either, with a set of profiles loaded at the namespace level or via
+ * a mark and remove marked interface.
+ */
+enum profile_mode {
+	APPARMOR_ENFORCE,		/* enforce access rules */
+	APPARMOR_COMPLAIN,		/* allow and log access violations */
+	APPARMOR_KILL,			/* kill task on access violation */
+};
+
+enum profile_flags {
+	PFLAG_HAT = 1,			/* profile is a hat */
+	PFLAG_UNCONFINED = 2,		/* profile is the unconfined profile */
+	PFLAG_NULL = 4,			/* profile is null learning profile */
+	PFLAG_IX_ON_NAME_ERROR = 8,	/* fallback to ix on name lookup fail */
+	PFLAG_IMMUTABLE = 0x10,		/* don't allow changes/replacement */
+	PFLAG_USER_DEFINED = 0x20,	/* user based profile */
+	PFLAG_NO_LIST_REF = 0x40,	/* list doesn't keep profile ref */
+};
+
+#define AA_NEW_SID 0
+
+struct aa_profile;
+
+/* struct aa_policy_common - common part of both namespaces and profiles
+ * @name: name of the object
+ * @count: reference count of the obj
+ * lock: lock for modifying the object
+ * @list: list object is on
+ * @profiles: head of the profiles list contained in the object
+ */
+struct aa_policy_common {
+	char *name;
+	struct kref count;
+	rwlock_t lock;
+	struct list_head list;
+	struct list_head profiles;
+};
+
+/* struct aa_ns_acct - accounting of profiles in namespace
+ * @max_size: maximum space allowed for all profiles in namespace
+ * @max_count: maximum number of profiles that can be in this namespace
+ * @size: current size of profiles
+ * @count: current count of profiles (includes null profiles)
+ */
+struct aa_ns_acct {
+	int max_size;
+	int max_count;
+	int size;
+	int count;
+};
+
+/* struct aa_namespace - namespace for a set of profiles
+ * @name: the name of the namespace
+ * @list: list the namespace is on
+ * @profiles: list of profile in the namespace
+ * @acct: accounting for the namespace
+ * @profile_count: count of profiles on @profiles list
+ * @size: accounting of how much memory is consumed by the contained profiles
+ * @unconfined: special unconfined profile for the namespace
+ * @count: reference count on the namespace
+ * @lock: lock for adding/removing profile to the namespace
+ *
+ * An aa_namespace defines the set profiles that are searched to determine
+ * which profile to attach to a task.  Profiles can not be shared between
+ * aa_namespaces and profile names within a namespace are guarenteed to be
+ * unique.  When profiles in seperate namespaces have the same name they
+ * are NOT considered to be equivalent.
+ *
+ * Namespace names must be unique and can not contain the characters :/\0
+ *
+ * FIXME TODO: add vserver support so a vserer gets a default namespace
+ */
+struct aa_namespace {
+	struct aa_policy_common base;
+	struct aa_ns_acct acct;
+	int is_stale;
+	struct aa_profile *unconfined;
+};
+
+
+/* struct aa_profile - basic confinement data
+ * @base - base componets of the profile (name, refcount, lists, lock ...)
+ * @fqname - The fully qualified profile name, less the namespace name
+ * @ns: namespace the profile is in
+ * @parent: parent profile of this profile, if one exists
+ * @replacedby: is set profile that replaced this profile
+ * @xmatch: optional extended matching for unconfined executables names
+ * @xmatch_plen: xmatch prefix len, used to determine xmatch priority
+ * @sid: the unique security id number of this profile
+ * @audit: the auditing mode of the profile
+ * @mode: the enforcement mode of the profile
+ * @flags: flags controlling profile behavior
+ * @size: the memory consumed by this profiles rules
+ * @file: The set of rules governing basic file access and domain transitions
+ * @caps: capabilities for the profile
+ * @net: network controls for the profile
+ * @rlimits: rlimits for the profile
+ *
+ * The AppArmor profile contains the basic confinement data.  Each profile
+ * has a name, and exist in a namespace.  The @name and @exec_match are
+ * used to determine profile attachment against unconfined tasks.  All other
+ * attachments are determined by in profile X transition rules.
+ *
+ * The @replacedby field is write protected by the profile lock.  Reads
+ * are assumed to be atomic, and are done without locking.
+ *
+ * Profiles have a hierachy where hats and children profiles keep
+ * a reference to their parent.
+ *
+ * Profile names can not begin with a : and can not contain the \0
+ * character.  If a profile name begins with / it will be considered when
+ * determining profile attachment on "unconfined" tasks.
+ */
+struct aa_profile {
+	struct aa_policy_common base;
+	char *fqname;
+
+	struct aa_namespace *ns;
+	struct aa_profile *parent;
+	struct aa_profile *replacedby;
+
+	struct aa_dfa *xmatch;
+	int xmatch_len;
+	u32 sid;
+	enum audit_mode audit;
+	enum profile_mode mode;
+	u32 flags;
+	int size;
+
+	struct aa_file_rules file;
+	struct aa_caps caps;
+	struct aa_net net;
+	struct aa_rlimit rlimits;
+};
+
+
+extern struct list_head ns_list;
+extern rwlock_t ns_list_lock;
+
+extern struct aa_namespace *default_namespace;
+extern enum profile_mode g_profile_mode;
+ 
+
+void aa_add_profile(struct aa_policy_common *common,
+		    struct aa_profile *profile);
+
+int alloc_default_namespace(void);
+void free_default_namespace(void);
+struct aa_namespace *alloc_aa_namespace(const char *name);
+void free_aa_namespace_kref(struct kref *kref);
+void free_aa_namespace(struct aa_namespace *ns);
+struct aa_namespace *__aa_find_namespace(struct list_head *head,
+					 const char *name);
+					 
+struct aa_namespace *aa_find_namespace(const char *name);
+struct aa_namespace *aa_prepare_namespace(const char *name);
+void aa_remove_namespace(struct aa_namespace *ns);
+struct aa_namespace *aa_prepare_namespace(const char *name);
+void aa_profile_list_release(struct list_head *head);
+void aa_profile_ns_list_release(void);
+void __aa_remove_namespace(struct aa_namespace *ns);
+
+
+static inline struct aa_policy_common *aa_get_common(struct aa_policy_common *c)
+{
+	if (c)
+		kref_get(&c->count);
+
+	return c;
+}
+
+static inline struct aa_namespace *aa_get_namespace(struct aa_namespace *ns)
+{
+	if (ns)
+		kref_get(&(ns->base.count));
+
+	return ns;
+}
+
+static inline void aa_put_namespace(struct aa_namespace *ns)
+{
+	if (ns)
+		kref_put(&ns->base.count, free_aa_namespace_kref);
+}
+
+
+
+struct aa_profile *alloc_aa_profile(const char *name);
+struct aa_profile *aa_alloc_null_profile(struct aa_profile *parent, int hat);
+void free_aa_profile_kref(struct kref *kref);
+void free_aa_profile(struct aa_profile *profile);
+struct aa_profile *__aa_find_profile(struct list_head *head, const char *name);
+struct aa_profile *aa_find_child(struct aa_profile *parent, const char *name);
+struct aa_policy_common *__aa_find_parent_by_fqname(struct aa_namespace *ns,
+						    const char *fqname);
+struct aa_profile *__aa_find_profile_by_fqname(struct aa_namespace *ns,
+					       const char *fqname);
+struct aa_profile *aa_find_profile_by_fqname(struct aa_namespace *ns,
+					     const char *name);
+struct aa_profile *aa_match_profile(struct aa_namespace *ns, const char *name);
+struct aa_profile *aa_profile_newest(struct aa_profile *profile);
+struct aa_profile *aa_sys_find_attach(struct aa_policy_common *base,
+				      const char *name);
+void __aa_add_profile(struct aa_policy_common *common,
+		      struct aa_profile *profile);
+void __aa_remove_profile(struct aa_profile *profile,
+			 struct aa_profile *replacement);
+void __aa_replace_profile(struct aa_profile *profile,
+			  struct aa_profile *replacement);
+void __aa_profile_list_release(struct list_head *head);
+
+static inline struct aa_profile *aa_filtered_profile(struct aa_profile *profile)
+{
+	if (profile->flags & PFLAG_UNCONFINED)
+		return NULL;
+	return profile;
+}
+
+/**
+ * aa_get_profile - increment refcount on profile @p
+ * @p: profile
+ */
+static inline struct aa_profile *aa_get_profile(struct aa_profile *p)
+{
+	if (p)
+		kref_get(&(p->base.count));
+
+	return p;
+}
+
+/**
+ * aa_put_profile - decrement refcount on profile @p
+ * @p: profile
+ */
+static inline void aa_put_profile(struct aa_profile *p)
+{
+	if (p)
+		kref_put(&p->base.count, free_aa_profile_kref);
+}
+
+static inline int PROFILE_AUDIT_MODE(struct aa_profile *profile)
+{
+	if (g_apparmor_audit != AUDIT_NORMAL)
+		return g_apparmor_audit;
+	if (profile)
+		return profile->audit;
+	return AUDIT_NORMAL;
+}
+
+#endif	/* __AA_POLICY_H */
+
--- linux-rt-2.6.31.orig/ubuntu/apparmor/include/ipc.h
+++ linux-rt-2.6.31/ubuntu/apparmor/include/ipc.h
@@ -0,0 +1,28 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor ipc mediation function definitions.
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#ifndef __AA_IPC_H
+#define __AA_IPC_H
+
+#include <linux/sched.h>
+
+struct aa_profile;
+
+int aa_may_ptrace(struct task_struct *tracer_task, struct aa_profile *tracer,
+		  struct aa_profile *tracee, unsigned int mode);
+
+int aa_ptrace(struct task_struct *tracer, struct task_struct *tracee,
+	      unsigned int mode);
+
+#endif	/* __AA_IPC_H */
--- linux-rt-2.6.31.orig/ubuntu/apparmor/include/apparmorfs.h
+++ linux-rt-2.6.31/ubuntu/apparmor/include/apparmorfs.h
@@ -0,0 +1,24 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor filesystem definitions.
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#ifndef __AA_APPARMORFS_H
+#define __AA_APPARMORFS_H
+
+extern struct dentry *apparmorfs_null;
+extern struct vfsmount *apparmorfs_mnt;
+
+extern int create_apparmorfs(void);
+extern void destroy_apparmorfs(void);
+
+#endif	/* __AA_APPARMORFS_H */
--- linux-rt-2.6.31.orig/ubuntu/apparmor/include/context.h
+++ linux-rt-2.6.31/ubuntu/apparmor/include/context.h
@@ -0,0 +1,153 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor contexts used to associate "labels" to objects.
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#ifndef __AA_CONTEXT_H
+#define __AA_CONTEXT_H
+
+#include <linux/cred.h>
+#include <linux/slab.h>
+#include <linux/sched.h>
+
+#include "policy.h"
+
+
+/* struct aa_file_cxt - the AppArmor context the file was opened in
+ * @profile: the profile the file was opened under
+ * @perms: the permission the file was opened with
+ */
+struct aa_file_cxt {
+	struct aa_profile *profile;
+	u16 allowed;
+};
+
+static inline struct aa_file_cxt *aa_alloc_file_context(gfp_t gfp)
+{
+	return kzalloc(sizeof(struct aa_file_cxt), gfp);
+}
+
+static inline void aa_free_file_context(struct aa_file_cxt *cxt)
+{
+	aa_put_profile(cxt->profile);
+	memset(cxt, 0, sizeof(struct aa_file_cxt));
+	kfree(cxt);
+}
+
+
+
+
+
+/* struct aa_task_cxt_group - a grouping label data for confined tasks
+ * @profile: the current profile
+ * @exec: profile to transition to on next exec
+ * @previous: profile the task may return to
+ * @token: magic value the task must know for returning to @previous_profile
+ *
+ * Contains the task's current profile (which could change due to
+ * change_hat).  Plus the hat_magic needed during change_hat.
+ */
+struct aa_task_cxt_group {
+	struct aa_profile *profile;
+	struct aa_profile *onexec;
+	struct aa_profile *previous;
+	u64 token;
+};
+
+/**
+ * struct aa_task_context - primary label for confined tasks
+ * @sys: the system labeling for the task
+ *
+ * A task is confined by the intersection of its system and user profiles
+ */
+struct aa_task_context {
+	struct aa_task_cxt_group sys;
+};
+
+struct aa_task_context *aa_alloc_task_context(gfp_t flags);
+void aa_free_task_context(struct aa_task_context *cxt);
+struct aa_task_context *aa_dup_task_context(struct aa_task_context *old_cxt,
+					    gfp_t gfp);
+void aa_cred_policy(const struct cred *cred, struct aa_profile **sys);
+struct cred *aa_get_task_policy(const struct task_struct *task,
+				struct aa_profile **sys);
+int aa_replace_current_profiles(struct aa_profile *sys);
+void aa_put_task_policy(struct cred *cred);
+int aa_set_current_onexec(struct aa_profile *sys);
+int aa_set_current_hat(struct aa_profile *profile, u64 token);
+int aa_restore_previous_profile(u64 cookie);
+
+
+static inline struct aa_task_context *__aa_task_cxt(struct task_struct *task)
+{
+	return __task_cred(task)->security;
+}
+
+/**
+ * __aa_task_is_confined - determine if @task has any confinement
+ * @task: task to check confinement of
+ *
+ * If @task != current needs to be in RCU safe critical section
+ */
+static inline int __aa_task_is_confined(struct task_struct *task)
+{
+	struct aa_task_context *cxt;
+	int rc = 1;
+
+	cxt = __aa_task_cxt(task);
+	if (!cxt || (cxt->sys.profile->flags & PFLAG_UNCONFINED))
+		rc = 0;
+
+	return rc;
+}
+
+static inline const struct cred *aa_current_policy(struct aa_profile **sys)
+{
+	const struct cred *cred = current_cred();
+	struct aa_task_context *cxt = cred->security;
+	BUG_ON(!cxt);
+	*sys = aa_filtered_profile(aa_profile_newest(cxt->sys.profile));
+
+	return cred;
+}
+
+static inline const struct cred *aa_current_policy_wupd(struct aa_profile **sys)
+{
+	const struct cred *cred = current_cred();
+	struct aa_task_context *cxt = cred->security;
+	BUG_ON(!cxt);
+
+	*sys = aa_profile_newest(cxt->sys.profile);
+	if (unlikely((cxt->sys.profile != *sys)))
+		aa_replace_current_profiles(*sys);
+	*sys = aa_filtered_profile(*sys);
+
+	return cred;
+}
+
+static inline struct aa_profile *aa_current_profile(void)
+{
+	const struct cred *cred = current_cred();
+	struct aa_task_context *cxt = cred->security;
+	BUG_ON(!cxt);
+	return aa_filtered_profile(aa_profile_newest(cxt->sys.profile));
+}
+
+static inline struct aa_profile *aa_current_profile_wupd(void)
+{
+	struct aa_profile *p;
+	aa_current_policy_wupd(&p);
+	return p;
+}
+
+
+#endif	/* __AA_CONTEXT_H */
--- linux-rt-2.6.31.orig/ubuntu/apparmor/include/file.h
+++ linux-rt-2.6.31/ubuntu/apparmor/include/file.h
@@ -0,0 +1,229 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor file mediation function definitions.
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#ifndef __AA_FILE_H
+#define __AA_FILE_H
+
+#include <linux/path.h>
+
+#include "audit.h"
+#include "domain.h"
+#include "match.h"
+
+struct aa_profile;
+
+/*
+ * We use MAY_EXEC, MAY_WRITE, MAY_READ, MAY_APPEND and the following flags
+ * for profile permissions
+ */
+#define AA_MAY_LINK			0x0010
+#define AA_MAY_LOCK			0x0020
+#define AA_EXEC_MMAP			0x0040
+
+#define AA_MAY_CREATE			0x0080
+#define AA_LINK_SUBSET			0x0100
+#define AA_MAY_DELEGATE			0x0200
+#define AA_EXEC_DELEGATE		0x0400		/*exec allows delegate*/
+
+#define AA_MAY_CHANGEHAT		0x2000		/* ctrl auditing only */
+#define AA_MAY_ONEXEC			0x4000		/* exec allows onexec */
+#define AA_MAY_CHANGE_PROFILE		0x8000
+
+
+#define AA_AUDIT_FILE_MASK	(MAY_READ | MAY_WRITE | MAY_EXEC | MAY_APPEND |\
+				 AA_MAY_LINK | AA_MAY_LOCK | AA_EXEC_MMAP | \
+				 AA_MAY_CREATE)
+
+/*
+ * The xindex is broken into 3 parts
+ * - index - an index into either the exec name table or the variable table
+ * - exec type - which determines how the executable name and index are used
+ * - flags - which modify how the destination name is applied
+ */
+#define AA_X_INDEX_MASK		0x03ff
+
+#define AA_X_TYPE_MASK		0x0c00
+#define AA_X_TYPE_SHIFT		10		
+#define AA_X_NONE		0x0000
+#define AA_X_NAME		0x0400	/* use executable name px */
+#define AA_X_TABLE		0x0800	/* use a specified name ->n# */
+
+#define AA_X_UNSAFE		0x1000
+#define AA_X_CHILD		0x2000	/* make >AA_X_NONE apply to children */
+#define AA_X_INHERIT		0x4000
+#define AA_X_UNCONFINED		0x8000
+
+
+/* AA_SECURE_X_NEEDED - is passed in the bprm->unsafe field */
+#define AA_SECURE_X_NEEDED	0x8000
+
+/* need to conditionalize which ones are being set */
+struct path_cond {
+	uid_t uid;
+	umode_t mode;
+};
+
+/* struct file_perms - file permission fo
+ * @allowed: mask of permissions that are allowed
+ * @audit: mask of permissions to force an audit message for
+ * @quiet: mask of permissions to quiet audit messages for
+ * @kill: mask of permissions that when matched will kill the task
+ * @xindex: exec transition index if @allowed contains MAY_EXEC
+ * @dindex: delegate table index if @allowed contain AA_MAY_DELEGATE
+ *
+ * The @audit and @queit mask should be mutually exclusive.
+ */
+struct file_perms {
+	u16 allowed;
+	u16 audit;
+	u16 quiet;
+	u16 kill;
+	u16 xindex;
+	u16 dindex;
+};
+
+extern struct file_perms nullperms;
+
+#define COMBINED_PERM_MASK(X) ((X).allowed | (X).audit | (X).quiet | (X).kill)
+
+/* FIXME: split perms from dfa and match this to description
+ *        also add delegation info.
+ */
+static inline u16 dfa_map_xindex(u16 mask)
+{
+	u16 old_index = (mask >> 10) & 0xf;
+	u16 index = 0;
+
+//printk("mask x%x\n", mask);
+	if (mask & 0x100)
+		index |= AA_X_UNSAFE;
+	if (mask & 0x200)
+		index |= AA_X_INHERIT;
+	if (mask & 0x80)
+		index |= AA_X_UNCONFINED;
+
+	if (old_index == 1) {
+		index |= AA_X_UNCONFINED;
+	} else if (old_index == 2) {
+		index |= AA_X_NAME;
+	} else if (old_index == 3) {
+		index |= AA_X_NAME | AA_X_CHILD;
+	} else {
+		index |= AA_X_TABLE;
+		index |= old_index - 4;
+	}
+
+	return index;
+}
+
+/*
+ * map old dfa inline permissions to new format
+ */
+#define dfa_user_allow(dfa, state)	((ACCEPT_TABLE(dfa)[state]) & 0x7f)
+#define dfa_user_audit(dfa, state)	((ACCEPT_TABLE2(dfa)[state]) & 0x7f)
+#define dfa_user_quiet(dfa, state)	(((ACCEPT_TABLE2(dfa)[state]) >> 7) & 0x7f)
+#define dfa_user_xindex(dfa, state) \
+	(dfa_map_xindex(ACCEPT_TABLE(dfa)[state] & 0x3fff))
+
+#define dfa_other_allow(dfa, state)	(((ACCEPT_TABLE(dfa)[state]) >> 14) & 0x7f)
+#define dfa_other_audit(dfa, state)	(((ACCEPT_TABLE2(dfa)[state]) >> 14) & 0x7f)
+#define dfa_other_quiet(dfa, state)	((((ACCEPT_TABLE2(dfa)[state]) >> 7) >> 14) & 0x7f)
+#define dfa_other_xindex(dfa, state) \
+	dfa_map_xindex((ACCEPT_TABLE(dfa)[state] >> 14) & 0x3fff)
+
+
+struct aa_audit_file {
+	struct aa_audit base;
+
+	const char *name;
+	const char *name2;
+	const char *name3;
+	struct file_perms perms;
+	u16 request;
+	struct path_cond *cond;
+};
+
+int aa_audit_file(struct aa_profile *profile, struct aa_audit_file *sa);
+void file_audit_cb(struct audit_buffer *ab, void *va);
+
+/**
+ * struct aa_file_rules - components used for file rule permissions
+ * @dfa: dfa to match path names and conditionals against
+ * @perms: permission table indexed by the matched state accept entry of @dfa
+ * @trans: transition table for indexed by named x transitions
+ *
+ * File permission are determined by matching a path against @dfa and then
+ * then using the value of the accept entry for the matching state as
+ * an index into @perms.  If a named exec transition is required it is
+ * looked up in the transition table.
+ */
+struct aa_file_rules {
+	struct aa_dfa *dfa;
+	/* struct perms perms; */
+	struct aa_domain trans;
+	/* TODO: add delegate table */
+};
+
+struct file_perms aa_str_perms(struct aa_dfa *dfa, unsigned int start,
+			       const char *name, struct path_cond *cond,
+			       unsigned int *rstate);
+
+int aa_pathstr_perm(struct aa_profile *profile, const char *op,
+		    const char *name, u16 request, struct path_cond *cond);
+
+int aa_path_perm(struct aa_profile *profile, const char *operation,
+		 struct path *path, u16 request, struct path_cond *cond);
+
+int aa_path_link(struct aa_profile *profile, struct dentry *old_dentry,
+		 struct path *new_dir, struct dentry *new_dentry);
+
+int aa_file_common_perm(struct aa_profile *profile, const char *operation,
+			struct file *file, u16 request, const char *name,
+			int error);
+
+int aa_file_perm(struct aa_profile *profile, const char *operation,
+		 struct file *file, u16 request);
+
+
+static inline void aa_free_file_rules(struct aa_file_rules *rules)
+{
+	aa_match_free(rules->dfa);
+	aa_free_domain_entries(&rules->trans);
+}
+
+#define ACC_FMODE(x) (("\000\004\002\006"[(x)&O_ACCMODE]) | (((x) << 1) & 0x40))
+
+/* from namei.c */
+#define ACC_MODE(x) ("\000\004\002\006"[(x)&O_ACCMODE])
+#define MAP_OPEN_FLAGS(x) ((((x) + 1) & O_ACCMODE) ? (x) + 1 : (x))
+/*
+ * map file flags to AppArmor permissions
+ */
+static inline u16 aa_map_file_to_perms(struct file *file)
+{
+	int flags = MAP_OPEN_FLAGS(file->f_flags);
+	u16 perms = ACC_FMODE(file->f_mode);
+
+	if ((flags & O_APPEND) && (perms & MAY_WRITE))
+		perms = (perms & ~MAY_WRITE) | MAY_APPEND;
+	/* trunc implies write permission */
+	if (flags & O_TRUNC)
+		perms |= MAY_WRITE;
+	if (flags & O_CREAT)
+		perms |= AA_MAY_CREATE;
+
+	return perms;
+}
+
+#endif	/* __AA_FILE_H */
--- linux-rt-2.6.31.orig/ubuntu/apparmor/include/domain.h
+++ linux-rt-2.6.31/ubuntu/apparmor/include/domain.h
@@ -0,0 +1,37 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor security domain transition function definitions.
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#include <linux/binfmts.h>
+#include <linux/types.h>
+
+#ifndef __AA_DOMAIN_H
+#define __AA_DOMAIN_H
+
+struct aa_domain {
+	int size;
+	char **table;
+};
+
+int apparmor_bprm_set_creds(struct linux_binprm *bprm);
+int apparmor_bprm_secureexec(struct linux_binprm *bprm);
+int apparmor_bprm_committing_creds(struct linux_binprm *bprm);
+void apparmor_bprm_committed_creds(struct linux_binprm *bprm);
+
+void aa_free_domain_entries(struct aa_domain *domain);
+int aa_change_hat(const char *hat_name, u64 token, int permtest);
+int aa_change_profile(const char *ns_name, const char *name, int onexec,
+		      int permtest);
+
+
+#endif	/* __AA_DOMAIN_H */
--- linux-rt-2.6.31.orig/ubuntu/apparmor/include/path.h
+++ linux-rt-2.6.31/ubuntu/apparmor/include/path.h
@@ -0,0 +1,24 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor basic path manipulation function definitions.
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#ifndef __AA_PATH_H
+#define __AA_PATH_H
+
+int aa_get_name_to_buffer(struct path *path, int is_dir, char *buffer, int size,
+			  char **name);
+int aa_get_name(struct path *path, int is_dir, char **buffer, char **name);
+int d_namespace_path(struct path *path, char *buf, int buflen, char **name);
+char *sysctl_pathname(struct ctl_table *table, char *buffer, int buflen);
+
+#endif	/* __AA_PATH_H */
--- linux-rt-2.6.31.orig/ubuntu/apparmor/include/audit.h
+++ linux-rt-2.6.31/ubuntu/apparmor/include/audit.h
@@ -0,0 +1,59 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor auditing function definitions.
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#ifndef __AA_AUDIT_H
+#define __AA_AUDIT_H
+
+#include <linux/audit.h>
+#include <linux/fs.h>
+#include <linux/sched.h>
+#include <linux/slab.h>
+
+struct aa_profile;
+
+
+extern const char *audit_mode_names[];
+#define AUDIT_MAX_INDEX 5
+
+#define AUDIT_APPARMOR_AUTO 0	/* auto choose audit message type */
+
+enum audit_mode {
+	AUDIT_NORMAL,		/* follow normal auditing of accesses */
+	AUDIT_QUIET_DENIED,	/* quiet all denied access messages */
+	AUDIT_QUIET,		/* quiet all messages */
+	AUDIT_NOQUIET,		/* do not quiet audit messages */
+	AUDIT_ALL		/* audit all accesses */
+};
+
+/*
+ * aa_audit - AppArmor auditing structure
+ * Structure is populated by access control code and passed to aa_audit which
+ * provides for a single point of logging.
+ */
+struct aa_audit {
+	struct task_struct *task;
+	gfp_t gfp_mask;
+	int error;
+	const char *operation;
+	const char *info;
+};
+
+int aa_audit(int type, struct aa_profile *profile, struct aa_audit *sa,
+	     void(*cb)(struct audit_buffer *, void *));
+
+int aa_audit_syscallreject(struct aa_profile *profile, gfp_t gfp, const char *,
+			   void(*cb)(struct audit_buffer *, void *));
+
+
+#endif	/* __AA_AUDIT_H */
--- linux-rt-2.6.31.orig/ubuntu/apparmor/include/procattr.h
+++ linux-rt-2.6.31/ubuntu/apparmor/include/procattr.h
@@ -0,0 +1,26 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor /proc/<pid>/attr/ interface function defintions.
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#ifndef __AA_PROCATTR_H
+#define __AA_PROCATTR_H
+
+#define AA_DO_TEST 1
+
+int aa_getprocattr(struct aa_namespace *ns, struct aa_profile *profile,
+		   char **string);
+int aa_setprocattr_changehat(char *args, int test);
+int aa_setprocattr_changeprofile(char *args, int onexec, int test);
+int aa_setprocattr_permipc(char *args);
+
+#endif	/* __AA_PROCATTR_H */
--- linux-rt-2.6.31.orig/ubuntu/drbd/drbd_nl.c
+++ linux-rt-2.6.31/ubuntu/drbd/drbd_nl.c
@@ -0,0 +1,2426 @@
+/*
+   drbd_nl.c
+
+   This file is part of DRBD by Philipp Reisner and Lars Ellenberg.
+
+   Copyright (C) 2001-2008, LINBIT Information Technologies GmbH.
+   Copyright (C) 1999-2008, Philipp Reisner <philipp.reisner@linbit.com>.
+   Copyright (C) 2002-2008, Lars Ellenberg <lars.ellenberg@linbit.com>.
+
+   drbd is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 2, or (at your option)
+   any later version.
+
+   drbd is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with drbd; see the file COPYING.  If not, write to
+   the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
+
+ */
+
+#include <linux/autoconf.h>
+#include <linux/module.h>
+#include <linux/in.h>
+#include <linux/fs.h>
+#include <linux/buffer_head.h> /* for fsync_bdev */
+#include <linux/file.h>
+#include <linux/slab.h>
+#include <linux/connector.h>
+#include <linux/drbd.h>
+#include <linux/blkpg.h>
+#include <linux/cpumask.h>
+
+#include "drbd_int.h"
+#include "drbd_wrappers.h"
+#include <linux/drbd_tag_magic.h>
+#include <linux/drbd_limits.h>
+
+/* see get_sb_bdev and bd_claim */
+static char *drbd_m_holder = "Hands off! this is DRBD's meta data device.";
+
+/* Generate the tag_list to struct functions */
+#define NL_PACKET(name, number, fields) \
+STATIC int name ## _from_tags(struct drbd_conf *mdev, \
+	unsigned short *tags, struct name *arg) \
+{ \
+	int tag; \
+	int dlen; \
+	\
+	while ((tag = *tags++) != TT_END) { \
+		dlen = *tags++; \
+		switch (tag_number(tag)) { \
+		fields \
+		default: \
+			if (tag & T_MANDATORY) { \
+				ERR("Unknown tag: %d\n", tag_number(tag)); \
+				return 0; \
+			} \
+		} \
+		tags = (unsigned short *)((char *)tags + dlen); \
+	} \
+	return 1; \
+}
+#define NL_INTEGER(pn, pr, member) \
+	case pn: /* D_ASSERT( tag_type(tag) == TT_INTEGER ); */ \
+		 arg->member = *(int *)(tags); \
+		 break;
+#define NL_INT64(pn, pr, member) \
+	case pn: /* D_ASSERT( tag_type(tag) == TT_INT64 ); */ \
+		 arg->member = *(u64 *)(tags); \
+		 break;
+#define NL_BIT(pn, pr, member) \
+	case pn: /* D_ASSERT( tag_type(tag) == TT_BIT ); */ \
+		 arg->member = *(char *)(tags) ? 1 : 0; \
+		 break;
+#define NL_STRING(pn, pr, member, len) \
+	case pn: /* D_ASSERT( tag_type(tag) == TT_STRING ); */ \
+		if (dlen > len) { \
+			ERR("arg too long: %s (%u wanted, max len: %u bytes)\n", \
+				#member, dlen, (unsigned int)len); \
+			return 0; \
+		} \
+		 arg->member ## _len = dlen; \
+		 memcpy(arg->member, tags, min_t(size_t, dlen, len)); \
+		 break;
+#include "linux/drbd_nl.h"
+
+/* Generate the struct to tag_list functions */
+#define NL_PACKET(name, number, fields) \
+STATIC unsigned short* \
+name ## _to_tags(struct drbd_conf *mdev, \
+	struct name *arg, unsigned short *tags) \
+{ \
+	fields \
+	return tags; \
+}
+
+#define NL_INTEGER(pn, pr, member) \
+	*tags++ = pn | pr | TT_INTEGER; \
+	*tags++ = sizeof(int); \
+	*(int *)tags = arg->member; \
+	tags = (unsigned short *)((char *)tags+sizeof(int));
+#define NL_INT64(pn, pr, member) \
+	*tags++ = pn | pr | TT_INT64; \
+	*tags++ = sizeof(u64); \
+	*(u64 *)tags = arg->member; \
+	tags = (unsigned short *)((char *)tags+sizeof(u64));
+#define NL_BIT(pn, pr, member) \
+	*tags++ = pn | pr | TT_BIT; \
+	*tags++ = sizeof(char); \
+	*(char *)tags = arg->member; \
+	tags = (unsigned short *)((char *)tags+sizeof(char));
+#define NL_STRING(pn, pr, member, len) \
+	*tags++ = pn | pr | TT_STRING; \
+	*tags++ = arg->member ## _len; \
+	memcpy(tags, arg->member, arg->member ## _len); \
+	tags = (unsigned short *)((char *)tags + arg->member ## _len);
+#include "linux/drbd_nl.h"
+
+void drbd_bcast_ev_helper(struct drbd_conf *mdev, char *helper_name);
+void drbd_nl_send_reply(struct cn_msg *, int);
+
+STATIC char *nl_packet_name(int packet_type)
+{
+/* Generate packet type strings */
+#define NL_PACKET(name, number, fields) \
+	[P_ ## name] = # name,
+#define NL_INTEGER Argh!
+#define NL_BIT Argh!
+#define NL_INT64 Argh!
+#define NL_STRING Argh!
+
+	static char *nl_tag_name[P_nl_after_last_packet] = {
+#include "linux/drbd_nl.h"
+	};
+
+	return (packet_type < sizeof(nl_tag_name)/sizeof(nl_tag_name[0])) ?
+	    nl_tag_name[packet_type] : "*Unknown*";
+}
+
+STATIC void nl_trace_packet(void *data)
+{
+	struct cn_msg *req = data;
+	struct drbd_nl_cfg_req *nlp = (struct drbd_nl_cfg_req *)req->data;
+
+	printk(KERN_INFO "drbd%d: "
+	       "Netlink: << %s (%d) - seq: %x, ack: %x, len: %x\n",
+	       nlp->drbd_minor,
+	       nl_packet_name(nlp->packet_type),
+	       nlp->packet_type,
+	       req->seq, req->ack, req->len);
+}
+
+STATIC void nl_trace_reply(void *data)
+{
+	struct cn_msg *req = data;
+	struct drbd_nl_cfg_reply *nlp = (struct drbd_nl_cfg_reply *)req->data;
+
+	printk(KERN_INFO "drbd%d: "
+	       "Netlink: >> %s (%d) - seq: %x, ack: %x, len: %x\n",
+	       nlp->minor,
+	       nlp->packet_type == P_nl_after_last_packet ?
+		   "Empty-Reply" : nl_packet_name(nlp->packet_type),
+	       nlp->packet_type,
+	       req->seq, req->ack, req->len);
+}
+
+int drbd_khelper(struct drbd_conf *mdev, char *cmd)
+{
+	char mb[12];
+	char *argv[] = {usermode_helper, cmd, mb, NULL };
+	int ret;
+	static char *envp[] = { "HOME=/",
+				"TERM=linux",
+				"PATH=/sbin:/usr/sbin:/bin:/usr/bin",
+				NULL };
+
+	snprintf(mb, 12, "minor-%d", mdev_to_minor(mdev));
+
+	INFO("helper command: %s %s %s\n", usermode_helper, cmd, mb);
+
+	drbd_bcast_ev_helper(mdev, cmd);
+	ret = call_usermodehelper(usermode_helper, argv, envp, 1);
+	if (ret)
+		drbd_WARN("helper command: %s %s %s exit code %u (0x%x)\n",
+				usermode_helper, cmd, mb,
+				(ret >> 8) & 0xff, ret);
+	else
+		INFO("helper command: %s %s %s exit code %u (0x%x)\n",
+				usermode_helper, cmd, mb,
+				(ret >> 8) & 0xff, ret);
+
+	if (ret < 0) /* Ignore any ERRNOs we got. */
+		ret = 0;
+
+	return ret;
+}
+
+enum drbd_disk_state drbd_try_outdate_peer(struct drbd_conf *mdev)
+{
+	char *ex_to_string;
+	int r;
+	enum drbd_disk_state nps;
+	enum fencing_policy fp;
+
+	D_ASSERT(mdev->state.pdsk == DUnknown);
+
+	if (inc_local_if_state(mdev, Consistent)) {
+		fp = mdev->bc->dc.fencing;
+		dec_local(mdev);
+	} else {
+		drbd_WARN("Not fencing peer, I'm not even Consistent myself.\n");
+		return mdev->state.pdsk;
+	}
+
+	if (fp == Stonith)
+		_drbd_request_state(mdev, NS(susp, 1), ChgWaitComplete);
+
+	r = drbd_khelper(mdev, "fence-peer");
+
+	switch ((r>>8) & 0xff) {
+	case 3: /* peer is inconsistent */
+		ex_to_string = "peer is inconsistent or worse";
+		nps = Inconsistent;
+		break;
+	case 4:
+		ex_to_string = "peer is outdated";
+		nps = Outdated;
+		break;
+	case 5: /* peer was down, we will(have) create(d) a new UUID anyways... */
+		/* If we would be more strict, we would return DUnknown here. */
+		ex_to_string = "peer is unreachable, assumed to be dead";
+		nps = Outdated;
+		break;
+	case 6: /* Peer is primary, voluntarily outdate myself.
+		 * This is useful when an unconnected Secondary is asked to
+		 * become Primary, but findes the other peer being active. */
+		ex_to_string = "peer is active";
+		drbd_WARN("Peer is primary, outdating myself.\n");
+		nps = DUnknown;
+		_drbd_request_state(mdev, NS(disk, Outdated), ChgWaitComplete);
+		break;
+	case 7:
+		if (fp != Stonith)
+			ERR("fence-peer() = 7 && fencing != Stonith !!!\n");
+		ex_to_string = "peer was stonithed";
+		nps = Outdated;
+		break;
+	default:
+		/* The script is broken ... */
+		nps = DUnknown;
+		ERR("fence-peer helper broken, returned %d\n", (r>>8)&0xff);
+		return nps;
+	}
+
+	INFO("fence-peer helper returned %d (%s)\n",
+			(r>>8) & 0xff, ex_to_string);
+	return nps;
+}
+
+
+int drbd_set_role(struct drbd_conf *mdev, enum drbd_role new_role, int force)
+{
+	const int max_tries = 4;
+	int r = 0;
+	int try = 0;
+	int forced = 0;
+	union drbd_state_t mask, val;
+	enum drbd_disk_state nps;
+
+	if (new_role == Primary)
+		request_ping(mdev); /* Detect a dead peer ASAP */
+
+	mutex_lock(&mdev->state_mutex);
+
+	mask.i = 0; mask.role = role_mask;
+	val.i  = 0; val.role  = new_role;
+
+	while (try++ < max_tries) {
+		r = _drbd_request_state(mdev, mask, val, ChgWaitComplete);
+
+		/* in case we first succeeded to outdate,
+		 * but now suddenly could establish a connection */
+		if (r == SS_CW_FailedByPeer && mask.pdsk != 0) {
+			val.pdsk = 0;
+			mask.pdsk = 0;
+			continue;
+		}
+
+		if (r == SS_NoUpToDateDisk && force &&
+		    (mdev->state.disk == Inconsistent ||
+		     mdev->state.disk == Outdated)) {
+			mask.disk = disk_mask;
+			val.disk  = UpToDate;
+			forced = 1;
+			continue;
+		}
+
+		if (r == SS_NoUpToDateDisk &&
+		    mdev->state.disk == Consistent) {
+			D_ASSERT(mdev->state.pdsk == DUnknown);
+			nps = drbd_try_outdate_peer(mdev);
+
+			if (nps == Outdated) {
+				val.disk = UpToDate;
+				mask.disk = disk_mask;
+			}
+
+			val.pdsk = nps;
+			mask.pdsk = disk_mask;
+
+			continue;
+		}
+
+		if (r == SS_NothingToDo)
+			goto fail;
+		if (r == SS_PrimaryNOP) {
+			nps = drbd_try_outdate_peer(mdev);
+
+			if (force && nps > Outdated) {
+				drbd_WARN("Forced into split brain situation!\n");
+				nps = Outdated;
+			}
+
+			mask.pdsk = disk_mask;
+			val.pdsk  = nps;
+
+			continue;
+		}
+		if (r == SS_TwoPrimaries) {
+			/* Maybe the peer is detected as dead very soon...
+			   retry at most once more in this case. */
+			__set_current_state(TASK_INTERRUPTIBLE);
+			schedule_timeout((mdev->net_conf->ping_timeo+1)*HZ/10);
+			if (try < max_tries)
+				try = max_tries - 1;
+			continue;
+		}
+		if (r < SS_Success) {
+			r = _drbd_request_state(mdev, mask, val,
+						ChgStateVerbose + ChgWaitComplete);
+			if (r < SS_Success)
+				goto fail;
+		}
+		break;
+	}
+
+	if (forced)
+		drbd_WARN("Forced to consider local data as UpToDate!\n");
+
+	fsync_bdev(mdev->this_bdev);
+
+	/* Wait until nothing is on the fly :) */
+	wait_event(mdev->misc_wait, atomic_read(&mdev->ap_pending_cnt) == 0);
+
+	if (new_role == Secondary) {
+		set_disk_ro(mdev->vdisk, TRUE);
+		if (inc_local(mdev)) {
+			mdev->bc->md.uuid[Current] &= ~(u64)1;
+			dec_local(mdev);
+		}
+	} else {
+		if (inc_net(mdev)) {
+			mdev->net_conf->want_lose = 0;
+			dec_net(mdev);
+		}
+		set_disk_ro(mdev->vdisk, FALSE);
+		if (inc_local(mdev)) {
+			if (((mdev->state.conn < Connected ||
+			       mdev->state.pdsk <= Failed)
+			      && mdev->bc->md.uuid[Bitmap] == 0) || forced)
+				drbd_uuid_new_current(mdev);
+
+			mdev->bc->md.uuid[Current] |=  (u64)1;
+			dec_local(mdev);
+		}
+	}
+
+	if ((new_role == Secondary) && inc_local(mdev)) {
+		drbd_al_to_on_disk_bm(mdev);
+		dec_local(mdev);
+	}
+
+	if (mdev->state.conn >= WFReportParams) {
+		/* if this was forced, we should consider sync */
+		if (forced)
+			drbd_send_uuids(mdev);
+		drbd_send_state(mdev);
+	}
+
+	drbd_md_sync(mdev);
+
+	drbd_kobject_uevent(mdev);
+ fail:
+	mutex_unlock(&mdev->state_mutex);
+	return r;
+}
+
+
+STATIC int drbd_nl_primary(struct drbd_conf *mdev, struct drbd_nl_cfg_req *nlp,
+			   struct drbd_nl_cfg_reply *reply)
+{
+	struct primary primary_args;
+
+	memset(&primary_args, 0, sizeof(struct primary));
+	if (!primary_from_tags(mdev, nlp->tag_list, &primary_args)) {
+		reply->ret_code = UnknownMandatoryTag;
+		return 0;
+	}
+
+	reply->ret_code =
+		drbd_set_role(mdev, Primary, primary_args.overwrite_peer);
+
+	return 0;
+}
+
+STATIC int drbd_nl_secondary(struct drbd_conf *mdev, struct drbd_nl_cfg_req *nlp,
+			     struct drbd_nl_cfg_reply *reply)
+{
+	reply->ret_code = drbd_set_role(mdev, Secondary, 0);
+
+	return 0;
+}
+
+/* initializes the md.*_offset members, so we are able to find
+ * the on disk meta data */
+STATIC void drbd_md_set_sector_offsets(struct drbd_conf *mdev,
+				       struct drbd_backing_dev *bdev)
+{
+	sector_t md_size_sect = 0;
+	switch (bdev->dc.meta_dev_idx) {
+	default:
+		/* v07 style fixed size indexed meta data */
+		bdev->md.md_size_sect = MD_RESERVED_SECT;
+		bdev->md.md_offset = drbd_md_ss__(mdev, bdev);
+		bdev->md.al_offset = MD_AL_OFFSET;
+		bdev->md.bm_offset = MD_BM_OFFSET;
+		break;
+	case DRBD_MD_INDEX_FLEX_EXT:
+		/* just occupy the full device; unit: sectors */
+		bdev->md.md_size_sect = drbd_get_capacity(bdev->md_bdev);
+		bdev->md.md_offset = 0;
+		bdev->md.al_offset = MD_AL_OFFSET;
+		bdev->md.bm_offset = MD_BM_OFFSET;
+		break;
+	case DRBD_MD_INDEX_INTERNAL:
+	case DRBD_MD_INDEX_FLEX_INT:
+		bdev->md.md_offset = drbd_md_ss__(mdev, bdev);
+		/* al size is still fixed */
+		bdev->md.al_offset = -MD_AL_MAX_SIZE;
+		/* we need (slightly less than) ~ this much bitmap sectors: */
+		md_size_sect = drbd_get_capacity(bdev->backing_bdev);
+		md_size_sect = ALIGN(md_size_sect, BM_SECT_PER_EXT);
+		md_size_sect = BM_SECT_TO_EXT(md_size_sect);
+		md_size_sect = ALIGN(md_size_sect, 8);
+
+		/* plus the "drbd meta data super block",
+		 * and the activity log; */
+		md_size_sect += MD_BM_OFFSET;
+
+		bdev->md.md_size_sect = md_size_sect;
+		/* bitmap offset is adjusted by 'super' block size */
+		bdev->md.bm_offset   = -md_size_sect + MD_AL_OFFSET;
+		break;
+	}
+}
+
+char *ppsize(char *buf, unsigned long long size)
+{
+	/* Needs 9 bytes at max. */
+	static char units[] = { 'K', 'M', 'G', 'T', 'P', 'E' };
+	int base = 0;
+	while (size >= 10000) {
+		/* shift + round */
+		size = (size >> 10) + !!(size & (1<<9));
+		base++;
+	}
+	sprintf(buf, "%lu %cB", (long)size, units[base]);
+
+	return buf;
+}
+
+/* there is still a theoretical deadlock when called from receiver
+ * on an Inconsistent Primary:
+ *  remote READ does inc_ap_bio, receiver would need to receive answer
+ *  packet from remote to dec_ap_bio again.
+ *  receiver receive_sizes(), comes here,
+ *  waits for ap_bio_cnt == 0. -> deadlock.
+ * but this cannot happen, actually, because:
+ *  Primary Inconsistent, and peer's disk is unreachable
+ *  (not connected, *  or bad/no disk on peer):
+ *  see drbd_fail_request_early, ap_bio_cnt is zero.
+ *  Primary Inconsistent, and SyncTarget:
+ *  peer may not initiate a resize.
+ */
+void drbd_suspend_io(struct drbd_conf *mdev)
+{
+	int in_flight;
+	set_bit(SUSPEND_IO, &mdev->flags);
+	in_flight = atomic_read(&mdev->ap_bio_cnt);
+	if (in_flight)
+		wait_event(mdev->misc_wait, !atomic_read(&mdev->ap_bio_cnt));
+}
+
+void drbd_resume_io(struct drbd_conf *mdev)
+{
+	clear_bit(SUSPEND_IO, &mdev->flags);
+	wake_up(&mdev->misc_wait);
+}
+
+/**
+ * drbd_determin_dev_size:
+ * Evaluates all constraints and sets our correct device size.
+ * Negative return values indicate errors. 0 and positive values
+ * indicate success.
+ * You should call drbd_md_sync() after calling this function.
+ */
+enum determin_dev_size_enum drbd_determin_dev_size(struct drbd_conf *mdev) __must_hold(local)
+{
+	sector_t prev_first_sect, prev_size; /* previous meta location */
+	sector_t la_size;
+	sector_t size;
+	char ppb[10];
+
+	int md_moved, la_size_changed;
+	enum determin_dev_size_enum rv = unchanged;
+
+	/* race:
+	 * application request passes inc_ap_bio,
+	 * but then cannot get an AL-reference.
+	 * this function later may wait on ap_bio_cnt == 0. -> deadlock.
+	 *
+	 * to avoid that:
+	 * Suspend IO right here.
+	 * still lock the act_log to not trigger ASSERTs there.
+	 */
+	drbd_suspend_io(mdev);
+
+	/* no wait necessary anymore, actually we could assert that */
+	wait_event(mdev->al_wait, lc_try_lock(mdev->act_log));
+
+	prev_first_sect = drbd_md_first_sector(mdev->bc);
+	prev_size = mdev->bc->md.md_size_sect;
+	la_size = mdev->bc->md.la_size_sect;
+
+	/* TODO: should only be some assert here, not (re)init... */
+	drbd_md_set_sector_offsets(mdev, mdev->bc);
+
+	size = drbd_new_dev_size(mdev, mdev->bc);
+
+	if (drbd_get_capacity(mdev->this_bdev) != size ||
+	    drbd_bm_capacity(mdev) != size) {
+		int err;
+		err = drbd_bm_resize(mdev, size);
+		if (unlikely(err)) {
+			/* currently there is only one error: ENOMEM! */
+			size = drbd_bm_capacity(mdev)>>1;
+			if (size == 0) {
+				ERR("OUT OF MEMORY! "
+				    "Could not allocate bitmap!\n");
+			} else {
+				ERR("BM resizing failed. "
+				    "Leaving size unchanged at size = %lu KB\n",
+				    (unsigned long)size);
+			}
+			rv = dev_size_error;
+		}
+		/* racy, see comments above. */
+		drbd_set_my_capacity(mdev, size);
+		mdev->bc->md.la_size_sect = size;
+		INFO("size = %s (%llu KB)\n", ppsize(ppb, size>>1),
+		     (unsigned long long)size>>1);
+	}
+	if (rv == dev_size_error)
+		goto out;
+
+	la_size_changed = (la_size != mdev->bc->md.la_size_sect);
+
+	md_moved = prev_first_sect != drbd_md_first_sector(mdev->bc)
+		|| prev_size	   != mdev->bc->md.md_size_sect;
+
+	if (md_moved) {
+		drbd_WARN("Moving meta-data.\n");
+		/* assert: (flexible) internal meta data */
+	}
+
+	if (la_size_changed || md_moved) {
+		drbd_al_shrink(mdev); /* All extents inactive. */
+		INFO("Writing the whole bitmap, size changed\n");
+		rv = drbd_bitmap_io(mdev, &drbd_bm_write, "size changed");
+		drbd_md_mark_dirty(mdev);
+	}
+
+	if (size > la_size)
+		rv = grew;
+	if (size < la_size)
+		rv = shrunk;
+out:
+	lc_unlock(mdev->act_log);
+	wake_up(&mdev->al_wait);
+	drbd_resume_io(mdev);
+
+	return rv;
+}
+
+sector_t
+drbd_new_dev_size(struct drbd_conf *mdev, struct drbd_backing_dev *bdev)
+{
+	sector_t p_size = mdev->p_size;   /* partner's disk size. */
+	sector_t la_size = bdev->md.la_size_sect; /* last agreed size. */
+	sector_t m_size; /* my size */
+	sector_t u_size = bdev->dc.disk_size; /* size requested by user. */
+	sector_t size = 0;
+
+	m_size = drbd_get_max_capacity(bdev);
+
+	if (p_size && m_size) {
+		size = min_t(sector_t, p_size, m_size);
+	} else {
+		if (la_size) {
+			size = la_size;
+			if (m_size && m_size < size)
+				size = m_size;
+			if (p_size && p_size < size)
+				size = p_size;
+		} else {
+			if (m_size)
+				size = m_size;
+			if (p_size)
+				size = p_size;
+		}
+	}
+
+	if (size == 0)
+		ERR("Both nodes diskless!\n");
+
+	if (u_size) {
+		if (u_size > size)
+			ERR("Requested disk size is too big (%lu > %lu)\n",
+			    (unsigned long)u_size>>1, (unsigned long)size>>1);
+		else
+			size = u_size;
+	}
+
+	return size;
+}
+
+/**
+ * drbd_check_al_size:
+ * checks that the al lru is of requested size, and if neccessary tries to
+ * allocate a new one. returns -EBUSY if current al lru is still used,
+ * -ENOMEM when allocation failed, and 0 on success. You should call
+ * drbd_md_sync() after you called this function.
+ */
+STATIC int drbd_check_al_size(struct drbd_conf *mdev)
+{
+	struct lru_cache *n, *t;
+	struct lc_element *e;
+	unsigned int in_use;
+	int i;
+
+	ERR_IF(mdev->sync_conf.al_extents < 7)
+		mdev->sync_conf.al_extents = 127;
+
+	if (mdev->act_log &&
+	    mdev->act_log->nr_elements == mdev->sync_conf.al_extents)
+		return 0;
+
+	in_use = 0;
+	t = mdev->act_log;
+	n = lc_alloc("act_log", mdev->sync_conf.al_extents,
+		     sizeof(struct lc_element), mdev);
+
+	if (n == NULL) {
+		ERR("Cannot allocate act_log lru!\n");
+		return -ENOMEM;
+	}
+	spin_lock_irq(&mdev->al_lock);
+	if (t) {
+		for (i = 0; i < t->nr_elements; i++) {
+			e = lc_entry(t, i);
+			if (e->refcnt)
+				ERR("refcnt(%d)==%d\n",
+				    e->lc_number, e->refcnt);
+			in_use += e->refcnt;
+		}
+	}
+	if (!in_use)
+		mdev->act_log = n;
+	spin_unlock_irq(&mdev->al_lock);
+	if (in_use) {
+		ERR("Activity log still in use!\n");
+		lc_free(n);
+		return -EBUSY;
+	} else {
+		if (t)
+			lc_free(t);
+	}
+	drbd_md_mark_dirty(mdev); /* we changed mdev->act_log->nr_elemens */
+	return 0;
+}
+
+void drbd_setup_queue_param(struct drbd_conf *mdev, unsigned int max_seg_s) __must_hold(local)
+{
+	struct request_queue * const q = mdev->rq_queue;
+	struct request_queue * const b = mdev->bc->backing_bdev->bd_disk->queue;
+	/* unsigned int old_max_seg_s = q->max_segment_size; */
+	int max_segments = mdev->bc->dc.max_bio_bvecs;
+
+	if (b->merge_bvec_fn && !mdev->bc->dc.use_bmbv)
+		max_seg_s = PAGE_SIZE;
+
+	max_seg_s = min(queue_max_sectors(b) * queue_logical_block_size(b), max_seg_s);
+
+	MTRACE(TraceTypeRq, TraceLvlSummary,
+	       DUMPI(queue_max_sectors(b));
+	       DUMPI(queue_max_phys_segments(b));
+	       DUMPI(queue_max_hw_segments(b));
+	       DUMPI(queue_max_segment_size(b));
+	       DUMPI(queue_logical_block_size(b));
+	       DUMPI(queue_segment_boundary(b));
+	       );
+
+	blk_queue_max_sectors(q, max_seg_s >> 9);
+	if (max_segments) {
+		blk_queue_max_phys_segments(q, max_segments);
+		blk_queue_max_hw_segments(q, max_segments);
+	} else {
+		blk_queue_max_phys_segments(q, MAX_PHYS_SEGMENTS);
+		blk_queue_max_hw_segments(q, MAX_HW_SEGMENTS);
+	}
+	blk_queue_max_segment_size(q, max_seg_s);
+	blk_queue_logical_block_size(q, 512);
+	blk_queue_segment_boundary(q, PAGE_SIZE-1);
+	blk_queue_stack_limits(q, b);
+
+	/* KERNEL BUG. in ll_rw_blk.c ??
+	 * t->max_segment_size = min(t->max_segment_size,b->max_segment_size);
+	 * should be
+	 * t->max_segment_size = min_not_zero(...,...)
+	 * workaround here: */
+	if (queue_max_segment_size(q) == 0)
+		blk_queue_max_segment_size(q, max_seg_s);
+
+	MTRACE(TraceTypeRq, TraceLvlSummary,
+	       DUMPI(queue_max_sectors(q));
+	       DUMPI(queue_max_phys_segments(q));
+	       DUMPI(queue_max_hw_segments(q));
+	       DUMPI(queue_max_segment_size(q));
+	       DUMPI(queue_logical_block_size(q));
+	       DUMPI(queue_segment_boundary(q));
+	       );
+
+	if (b->merge_bvec_fn)
+		drbd_WARN("Backing device's merge_bvec_fn() = %p\n",
+		     b->merge_bvec_fn);
+	INFO("max_segment_size ( = BIO size ) = %u\n", queue_max_segment_size(q));
+
+	if (q->backing_dev_info.ra_pages != b->backing_dev_info.ra_pages) {
+		INFO("Adjusting my ra_pages to backing device's (%lu -> %lu)\n",
+		     q->backing_dev_info.ra_pages,
+		     b->backing_dev_info.ra_pages);
+		q->backing_dev_info.ra_pages = b->backing_dev_info.ra_pages;
+	}
+}
+
+/* does always return 0;
+ * interesting return code is in reply->ret_code */
+STATIC int drbd_nl_disk_conf(struct drbd_conf *mdev, struct drbd_nl_cfg_req *nlp,
+			     struct drbd_nl_cfg_reply *reply)
+{
+	enum ret_codes retcode;
+	enum determin_dev_size_enum dd;
+	sector_t max_possible_sectors;
+	sector_t min_md_device_sectors;
+	struct drbd_backing_dev *nbc = NULL; /* new_backing_conf */
+	struct inode *inode, *inode2;
+	struct lru_cache *resync_lru = NULL;
+	union drbd_state_t ns, os;
+	int rv, ntries = 0;
+	int cp_discovered = 0;
+	int hardsect;
+
+	/* if you want to reconfigure, please tear down first */
+	if (mdev->state.disk > Diskless) {
+		retcode = HaveDiskConfig;
+		goto fail;
+	}
+
+	/*
+	* We may have gotten here very quickly from a detach. Wait for a bit
+	* then fail.
+	*/
+	while (1) {
+		__no_warn(local, nbc = mdev->bc;);
+		if (nbc == NULL)
+			break;
+		if (ntries++ >= 5) {
+			drbd_WARN("drbd_nl_disk_conf: mdev->bc not NULL.\n");
+			retcode = HaveDiskConfig;
+			goto fail;
+		}
+		__set_current_state(TASK_INTERRUPTIBLE);
+		schedule_timeout(HZ/10);
+	}
+
+	nbc = kmalloc(sizeof(struct drbd_backing_dev), GFP_KERNEL);
+	if (!nbc) {
+		retcode = KMallocFailed;
+		goto fail;
+	}
+
+	memset(&nbc->md, 0, sizeof(struct drbd_md));
+
+	if (!(nlp->flags & DRBD_NL_SET_DEFAULTS) && inc_local(mdev)) {
+		memcpy(&nbc->dc, &mdev->bc->dc, sizeof(struct disk_conf));
+		dec_local(mdev);
+	} else {
+		memset(&nbc->dc, 0, sizeof(struct disk_conf));
+		nbc->dc.disk_size   = DRBD_DISK_SIZE_SECT_DEF;
+		nbc->dc.on_io_error = DRBD_ON_IO_ERROR_DEF;
+		nbc->dc.fencing     = DRBD_FENCING_DEF;
+		nbc->dc.max_bio_bvecs = DRBD_MAX_BIO_BVECS_DEF;
+	}
+
+	if (!disk_conf_from_tags(mdev, nlp->tag_list, &nbc->dc)) {
+		retcode = UnknownMandatoryTag;
+		goto fail;
+	}
+
+	nbc->lo_file = NULL;
+	nbc->md_file = NULL;
+
+	if (nbc->dc.meta_dev_idx < DRBD_MD_INDEX_FLEX_INT) {
+		retcode = LDMDInvalid;
+		goto fail;
+	}
+
+	nbc->lo_file = filp_open(nbc->dc.backing_dev, O_RDWR, 0);
+	if (IS_ERR(nbc->lo_file)) {
+		ERR("open(\"%s\") failed with %ld\n", nbc->dc.backing_dev,
+		    PTR_ERR(nbc->lo_file));
+		nbc->lo_file = NULL;
+		retcode = LDNameInvalid;
+		goto fail;
+	}
+
+	inode = nbc->lo_file->f_dentry->d_inode;
+
+	if (!S_ISBLK(inode->i_mode)) {
+		retcode = LDNoBlockDev;
+		goto fail;
+	}
+
+	nbc->md_file = filp_open(nbc->dc.meta_dev, O_RDWR, 0);
+	if (IS_ERR(nbc->md_file)) {
+		ERR("open(\"%s\") failed with %ld\n", nbc->dc.meta_dev,
+		    PTR_ERR(nbc->md_file));
+		nbc->md_file = NULL;
+		retcode = MDNameInvalid;
+		goto fail;
+	}
+
+	inode2 = nbc->md_file->f_dentry->d_inode;
+
+	if (!S_ISBLK(inode2->i_mode)) {
+		retcode = MDNoBlockDev;
+		goto fail;
+	}
+
+	nbc->backing_bdev = inode->i_bdev;
+	if (bd_claim(nbc->backing_bdev, mdev)) {
+		printk(KERN_ERR "drbd: bd_claim(%p,%p); failed [%p;%p;%u]\n",
+		       nbc->backing_bdev, mdev,
+		       nbc->backing_bdev->bd_holder,
+		       nbc->backing_bdev->bd_contains->bd_holder,
+		       nbc->backing_bdev->bd_holders);
+		retcode = LDMounted;
+		goto fail;
+	}
+
+	resync_lru = lc_alloc("resync", 61, sizeof(struct bm_extent), mdev);
+	if (!resync_lru) {
+		retcode = KMallocFailed;
+		goto release_bdev_fail;
+	}
+
+	if (!mdev->bitmap) {
+		if (drbd_bm_init(mdev)) {
+			retcode = KMallocFailed;
+			goto release_bdev_fail;
+		}
+	}
+
+	nbc->md_bdev = inode2->i_bdev;
+	if (bd_claim(nbc->md_bdev,
+		     (nbc->dc.meta_dev_idx == DRBD_MD_INDEX_INTERNAL ||
+		      nbc->dc.meta_dev_idx == DRBD_MD_INDEX_FLEX_INT) ?
+		     (void *)mdev : (void *) drbd_m_holder)) {
+		retcode = MDMounted;
+		goto release_bdev_fail;
+	}
+
+	if ((nbc->backing_bdev == nbc->md_bdev) !=
+	    (nbc->dc.meta_dev_idx == DRBD_MD_INDEX_INTERNAL ||
+	     nbc->dc.meta_dev_idx == DRBD_MD_INDEX_FLEX_INT)) {
+		retcode = LDMDInvalid;
+		goto release_bdev2_fail;
+	}
+
+	/* RT - for drbd_get_max_capacity() DRBD_MD_INDEX_FLEX_INT */
+	drbd_md_set_sector_offsets(mdev, nbc);
+
+	if (drbd_get_max_capacity(nbc) < nbc->dc.disk_size) {
+		ERR("max capacity %llu smaller than disk size %llu\n",
+			(unsigned long long) drbd_get_max_capacity(nbc),
+			(unsigned long long) nbc->dc.disk_size);
+		retcode = LDDeviceTooSmall;
+		goto release_bdev2_fail;
+	}
+
+	if (nbc->dc.meta_dev_idx < 0) {
+		max_possible_sectors = DRBD_MAX_SECTORS_FLEX;
+		/* at least one MB, otherwise it does not make sense */
+		min_md_device_sectors = (2<<10);
+	} else {
+		max_possible_sectors = DRBD_MAX_SECTORS;
+		min_md_device_sectors = MD_RESERVED_SECT * (nbc->dc.meta_dev_idx + 1);
+	}
+
+	if (drbd_get_capacity(nbc->md_bdev) > max_possible_sectors)
+		drbd_WARN("truncating very big lower level device "
+		     "to currently maximum possible %llu sectors\n",
+		     (unsigned long long) max_possible_sectors);
+
+	if (drbd_get_capacity(nbc->md_bdev) < min_md_device_sectors) {
+		retcode = MDDeviceTooSmall;
+		drbd_WARN("refusing attach: md-device too small, "
+		     "at least %llu sectors needed for this meta-disk type\n",
+		     (unsigned long long) min_md_device_sectors);
+		goto release_bdev2_fail;
+	}
+
+	/* Make sure the new disk is big enough
+	 * (we may currently be Primary with no local disk...) */
+	if (drbd_get_max_capacity(nbc) <
+	    drbd_get_capacity(mdev->this_bdev)) {
+		retcode = LDDeviceTooSmall;
+		goto release_bdev2_fail;
+	}
+
+	nbc->known_size = drbd_get_capacity(nbc->backing_bdev);
+
+	drbd_suspend_io(mdev);
+	wait_event(mdev->misc_wait, !atomic_read(&mdev->ap_pending_cnt));
+	retcode = _drbd_request_state(mdev, NS(disk, Attaching), ChgStateVerbose);
+	drbd_resume_io(mdev);
+	if (retcode < SS_Success)
+		goto release_bdev2_fail;
+
+	if (!inc_local_if_state(mdev, Attaching))
+		goto force_diskless;
+
+	drbd_thread_start(&mdev->worker);
+	drbd_md_set_sector_offsets(mdev, nbc);
+
+	retcode = drbd_md_read(mdev, nbc);
+	if (retcode != NoError)
+		goto force_diskless_dec;
+
+	if (mdev->state.conn < Connected &&
+	    mdev->state.role == Primary &&
+	    (mdev->ed_uuid & ~((u64)1)) != (nbc->md.uuid[Current] & ~((u64)1))) {
+		ERR("Can only attach to data with current UUID=%016llX\n",
+		    (unsigned long long)mdev->ed_uuid);
+		retcode = DataOfWrongCurrent;
+		goto force_diskless_dec;
+	}
+
+	/* Since we are diskless, fix the AL first... */
+	if (drbd_check_al_size(mdev)) {
+		retcode = KMallocFailed;
+		goto force_diskless_dec;
+	}
+
+	/* Prevent shrinking of consistent devices ! */
+	if (drbd_md_test_flag(nbc, MDF_Consistent) &&
+	   drbd_new_dev_size(mdev, nbc) < nbc->md.la_size_sect) {
+		drbd_WARN("refusing to truncate a consistent device\n");
+		retcode = LDDeviceTooSmall;
+		goto force_diskless_dec;
+	}
+
+	if (!drbd_al_read_log(mdev, nbc)) {
+		retcode = MDIOError;
+		goto force_diskless_dec;
+	}
+
+	/* allocate a second IO page if hardsect != 512 */
+	hardsect = drbd_get_hardsect(nbc->md_bdev);
+	if (hardsect == 0)
+		hardsect = MD_HARDSECT;
+
+	if (hardsect != MD_HARDSECT) {
+		if (!mdev->md_io_tmpp) {
+			struct page *page = alloc_page(GFP_NOIO);
+			if (!page)
+				goto force_diskless_dec;
+
+			drbd_WARN("Meta data's bdev hardsect = %d != %d\n",
+			     hardsect, MD_HARDSECT);
+			drbd_WARN("Workaround engaged (has performace impact).\n");
+
+			mdev->md_io_tmpp = page;
+		}
+	}
+
+	/* Reset the "barriers don't work" bits here, then force meta data to
+	 * be written, to ensure we determine if barriers are supported. */
+	if (nbc->dc.no_md_flush)
+		set_bit(MD_NO_BARRIER, &mdev->flags);
+	else
+		clear_bit(MD_NO_BARRIER, &mdev->flags);
+
+	/* Point of no return reached.
+	 * Devices and memory are no longer released by error cleanup below.
+	 * now mdev takes over responsibility, and the state engine should
+	 * clean it up somewhere.  */
+	D_ASSERT(mdev->bc == NULL);
+	mdev->bc = nbc;
+	mdev->resync = resync_lru;
+	nbc = NULL;
+	resync_lru = NULL;
+
+	mdev->write_ordering = WO_bio_barrier;
+	drbd_bump_write_ordering(mdev, WO_bio_barrier);
+
+	if (drbd_md_test_flag(mdev->bc, MDF_CrashedPrimary))
+		set_bit(CRASHED_PRIMARY, &mdev->flags);
+	else
+		clear_bit(CRASHED_PRIMARY, &mdev->flags);
+
+	if (drbd_md_test_flag(mdev->bc, MDF_PrimaryInd)) {
+		set_bit(CRASHED_PRIMARY, &mdev->flags);
+		cp_discovered = 1;
+	}
+
+	mdev->send_cnt = 0;
+	mdev->recv_cnt = 0;
+	mdev->read_cnt = 0;
+	mdev->writ_cnt = 0;
+
+	drbd_setup_queue_param(mdev, DRBD_MAX_SEGMENT_SIZE);
+
+	/* If I am currently not Primary,
+	 * but meta data primary indicator is set,
+	 * I just now recover from a hard crash,
+	 * and have been Primary before that crash.
+	 *
+	 * Now, if I had no connection before that crash
+	 * (have been degraded Primary), chances are that
+	 * I won't find my peer now either.
+	 *
+	 * In that case, and _only_ in that case,
+	 * we use the degr-wfc-timeout instead of the default,
+	 * so we can automatically recover from a crash of a
+	 * degraded but active "cluster" after a certain timeout.
+	 */
+	clear_bit(USE_DEGR_WFC_T, &mdev->flags);
+	if (mdev->state.role != Primary &&
+	     drbd_md_test_flag(mdev->bc, MDF_PrimaryInd) &&
+	    !drbd_md_test_flag(mdev->bc, MDF_ConnectedInd))
+		set_bit(USE_DEGR_WFC_T, &mdev->flags);
+
+	dd = drbd_determin_dev_size(mdev);
+	if (dd == dev_size_error) {
+		retcode = VMallocFailed;
+		goto force_diskless_dec;
+	} else if (dd == grew)
+		set_bit(RESYNC_AFTER_NEG, &mdev->flags);
+
+	if (drbd_md_test_flag(mdev->bc, MDF_FullSync)) {
+		INFO("Assuming that all blocks are out of sync "
+		     "(aka FullSync)\n");
+		if (drbd_bitmap_io(mdev, &drbd_bmio_set_n_write, "set_n_write from attaching")) {
+			retcode = MDIOError;
+			goto force_diskless_dec;
+		}
+	} else {
+		if (drbd_bitmap_io(mdev, &drbd_bm_read, "read from attaching") < 0) {
+			retcode = MDIOError;
+			goto force_diskless_dec;
+		}
+	}
+
+	if (cp_discovered) {
+		drbd_al_apply_to_bm(mdev);
+		drbd_al_to_on_disk_bm(mdev);
+	}
+
+	spin_lock_irq(&mdev->req_lock);
+	os = mdev->state;
+	ns.i = os.i;
+	/* If MDF_Consistent is not set go into inconsistent state,
+	   otherwise investige MDF_WasUpToDate...
+	   If MDF_WasUpToDate is not set go into Outdated disk state,
+	   otherwise into Consistent state.
+	*/
+	if (drbd_md_test_flag(mdev->bc, MDF_Consistent)) {
+		if (drbd_md_test_flag(mdev->bc, MDF_WasUpToDate))
+			ns.disk = Consistent;
+		else
+			ns.disk = Outdated;
+	} else {
+		ns.disk = Inconsistent;
+	}
+
+	if (drbd_md_test_flag(mdev->bc, MDF_PeerOutDated))
+		ns.pdsk = Outdated;
+
+	if ( ns.disk == Consistent &&
+	    (ns.pdsk == Outdated || mdev->bc->dc.fencing == DontCare))
+		ns.disk = UpToDate;
+
+	/* All tests on MDF_PrimaryInd, MDF_ConnectedInd,
+	   MDF_Consistent and MDF_WasUpToDate must happen before
+	   this point, because drbd_request_state() modifies these
+	   flags. */
+
+	/* In case we are Connected postpone any desicion on the new disk
+	   state after the negotiation phase. */
+	if (mdev->state.conn == Connected) {
+		mdev->new_state_tmp.i = ns.i;
+		ns.i = os.i;
+		ns.disk = Negotiating;
+	}
+
+	rv = _drbd_set_state(mdev, ns, ChgStateVerbose, NULL);
+	ns = mdev->state;
+	spin_unlock_irq(&mdev->req_lock);
+
+	if (rv < SS_Success)
+		goto force_diskless_dec;
+
+	if (mdev->state.role == Primary)
+		mdev->bc->md.uuid[Current] |=  (u64)1;
+	else
+		mdev->bc->md.uuid[Current] &= ~(u64)1;
+
+	drbd_md_mark_dirty(mdev);
+	drbd_md_sync(mdev);
+
+	drbd_kobject_uevent(mdev);
+	dec_local(mdev);
+	reply->ret_code = retcode;
+	return 0;
+
+ force_diskless_dec:
+	dec_local(mdev);
+ force_diskless:
+	drbd_force_state(mdev, NS(disk, Diskless));
+	drbd_md_sync(mdev);
+ release_bdev2_fail:
+	if (nbc)
+		bd_release(nbc->md_bdev);
+ release_bdev_fail:
+	if (nbc)
+		bd_release(nbc->backing_bdev);
+ fail:
+	if (nbc) {
+		if (nbc->lo_file)
+			fput(nbc->lo_file);
+		if (nbc->md_file)
+			fput(nbc->md_file);
+		kfree(nbc);
+	}
+	if (resync_lru)
+		lc_free(resync_lru);
+
+	reply->ret_code = retcode;
+	return 0;
+}
+
+STATIC int drbd_nl_detach(struct drbd_conf *mdev, struct drbd_nl_cfg_req *nlp,
+			  struct drbd_nl_cfg_reply *reply)
+{
+	fsync_bdev(mdev->this_bdev);
+	reply->ret_code = drbd_request_state(mdev, NS(disk, Diskless));
+
+	__set_current_state(TASK_INTERRUPTIBLE);
+	schedule_timeout(HZ/20); /* 50ms; Time for worker to finally terminate */
+
+	return 0;
+}
+
+#define HMAC_NAME_L 20
+
+STATIC int drbd_nl_net_conf(struct drbd_conf *mdev, struct drbd_nl_cfg_req *nlp,
+			    struct drbd_nl_cfg_reply *reply)
+{
+	int i, ns;
+	enum ret_codes retcode;
+	struct net_conf *new_conf = NULL;
+	struct crypto_hash *tfm = NULL;
+	struct crypto_hash *integrity_w_tfm = NULL;
+	struct crypto_hash *integrity_r_tfm = NULL;
+	struct hlist_head *new_tl_hash = NULL;
+	struct hlist_head *new_ee_hash = NULL;
+	struct drbd_conf *odev;
+	char hmac_name[HMAC_NAME_L];
+	void *int_dig_out = NULL;
+	void *int_dig_in = NULL;
+	void *int_dig_vv = NULL;
+
+	if (mdev->state.conn > StandAlone) {
+		retcode = HaveNetConfig;
+		goto fail;
+	}
+
+	new_conf = kmalloc(sizeof(struct net_conf), GFP_KERNEL);
+	if (!new_conf) {
+		retcode = KMallocFailed;
+		goto fail;
+	}
+
+	if (!(nlp->flags & DRBD_NL_SET_DEFAULTS) && inc_net(mdev)) {
+		memcpy(new_conf, mdev->net_conf, sizeof(struct net_conf));
+		dec_net(mdev);
+	} else {
+		memset(new_conf, 0, sizeof(struct net_conf));
+		new_conf->timeout	   = DRBD_TIMEOUT_DEF;
+		new_conf->try_connect_int  = DRBD_CONNECT_INT_DEF;
+		new_conf->ping_int	   = DRBD_PING_INT_DEF;
+		new_conf->max_epoch_size   = DRBD_MAX_EPOCH_SIZE_DEF;
+		new_conf->max_buffers	   = DRBD_MAX_BUFFERS_DEF;
+		new_conf->unplug_watermark = DRBD_UNPLUG_WATERMARK_DEF;
+		new_conf->sndbuf_size	   = DRBD_SNDBUF_SIZE_DEF;
+		new_conf->ko_count	   = DRBD_KO_COUNT_DEF;
+		new_conf->after_sb_0p	   = DRBD_AFTER_SB_0P_DEF;
+		new_conf->after_sb_1p	   = DRBD_AFTER_SB_1P_DEF;
+		new_conf->after_sb_2p	   = DRBD_AFTER_SB_2P_DEF;
+		new_conf->want_lose	   = 0;
+		new_conf->two_primaries    = 0;
+		new_conf->wire_protocol    = DRBD_PROT_C;
+		new_conf->ping_timeo	   = DRBD_PING_TIMEO_DEF;
+		new_conf->rr_conflict	   = DRBD_RR_CONFLICT_DEF;
+	}
+
+	if (!net_conf_from_tags(mdev, nlp->tag_list, new_conf)) {
+		retcode = UnknownMandatoryTag;
+		goto fail;
+	}
+
+	if (new_conf->two_primaries
+	&& (new_conf->wire_protocol != DRBD_PROT_C)) {
+		retcode = ProtocolCRequired;
+		goto fail;
+	};
+
+	if (mdev->state.role == Primary && new_conf->want_lose) {
+		retcode = DiscardNotAllowed;
+		goto fail;
+	}
+
+#define M_ADDR(A) (((struct sockaddr_in *)&A->my_addr)->sin_addr.s_addr)
+#define M_PORT(A) (((struct sockaddr_in *)&A->my_addr)->sin_port)
+#define O_ADDR(A) (((struct sockaddr_in *)&A->peer_addr)->sin_addr.s_addr)
+#define O_PORT(A) (((struct sockaddr_in *)&A->peer_addr)->sin_port)
+	retcode = NoError;
+	for (i = 0; i < minor_count; i++) {
+		odev = minor_to_mdev(i);
+		if (!odev || odev == mdev)
+			continue;
+		if (inc_net(odev)) {
+			if (M_ADDR(new_conf) == M_ADDR(odev->net_conf) &&
+			    M_PORT(new_conf) == M_PORT(odev->net_conf))
+				retcode = LAAlreadyInUse;
+
+			if (O_ADDR(new_conf) == O_ADDR(odev->net_conf) &&
+			    O_PORT(new_conf) == O_PORT(odev->net_conf))
+				retcode = OAAlreadyInUse;
+
+			dec_net(odev);
+			if (retcode != NoError)
+				goto fail;
+		}
+	}
+#undef M_ADDR
+#undef M_PORT
+#undef O_ADDR
+#undef O_PORT
+
+	if (new_conf->cram_hmac_alg[0] != 0) {
+		snprintf(hmac_name, HMAC_NAME_L, "hmac(%s)",
+			new_conf->cram_hmac_alg);
+		tfm = crypto_alloc_hash(hmac_name, 0, CRYPTO_ALG_ASYNC);
+		if (IS_ERR(tfm)) {
+			tfm = NULL;
+			retcode = CRAMAlgNotAvail;
+			goto fail;
+		}
+
+		if (crypto_tfm_alg_type(crypto_hash_tfm(tfm))
+						!= CRYPTO_ALG_TYPE_HASH) {
+			retcode = CRAMAlgNotDigest;
+			goto fail;
+		}
+	}
+
+	if (new_conf->integrity_alg[0]) {
+		integrity_w_tfm = crypto_alloc_hash(new_conf->integrity_alg, 0, CRYPTO_ALG_ASYNC);
+		if (IS_ERR(integrity_w_tfm)) {
+			integrity_w_tfm = NULL;
+			retcode=IntegrityAlgNotAvail;
+			goto fail;
+		}
+
+		if (crypto_tfm_alg_type(crypto_hash_tfm(integrity_w_tfm)) != CRYPTO_ALG_TYPE_DIGEST) {
+			retcode=IntegrityAlgNotDigest;
+			goto fail;
+		}
+
+		integrity_r_tfm = crypto_alloc_hash(new_conf->integrity_alg, 0, CRYPTO_ALG_ASYNC);
+		if (IS_ERR(integrity_r_tfm)) {
+			integrity_r_tfm = NULL;
+			retcode=IntegrityAlgNotAvail;
+			goto fail;
+		}
+	}
+
+	ns = new_conf->max_epoch_size/8;
+	if (mdev->tl_hash_s != ns) {
+		new_tl_hash = kzalloc(ns*sizeof(void *), GFP_KERNEL);
+		if (!new_tl_hash) {
+			retcode = KMallocFailed;
+			goto fail;
+		}
+	}
+
+	ns = new_conf->max_buffers/8;
+	if (new_conf->two_primaries && (mdev->ee_hash_s != ns)) {
+		new_ee_hash = kzalloc(ns*sizeof(void *), GFP_KERNEL);
+		if (!new_ee_hash) {
+			retcode = KMallocFailed;
+			goto fail;
+		}
+	}
+
+	((char *)new_conf->shared_secret)[SHARED_SECRET_MAX-1] = 0;
+
+#if 0
+	/* for the connection loss logic in drbd_recv
+	 * I _need_ the resulting timeo in jiffies to be
+	 * non-zero and different
+	 *
+	 * XXX maybe rather store the value scaled to jiffies?
+	 * Note: MAX_SCHEDULE_TIMEOUT/HZ*HZ != MAX_SCHEDULE_TIMEOUT
+	 *	 and HZ > 10; which is unlikely to change...
+	 *	 Thus, if interrupted by a signal,
+	 *	 sock_{send,recv}msg returns -EINTR,
+	 *	 if the timeout expires, -EAGAIN.
+	 */
+	/* unlikely: someone disabled the timeouts ...
+	 * just put some huge values in there. */
+	if (!new_conf->ping_int)
+		new_conf->ping_int = MAX_SCHEDULE_TIMEOUT/HZ;
+	if (!new_conf->timeout)
+		new_conf->timeout = MAX_SCHEDULE_TIMEOUT/HZ*10;
+	if (new_conf->ping_int*10 < new_conf->timeout)
+		new_conf->timeout = new_conf->ping_int*10/6;
+	if (new_conf->ping_int*10 == new_conf->timeout)
+		new_conf->ping_int = new_conf->ping_int+1;
+#endif
+
+	if (integrity_w_tfm) {
+		i = crypto_hash_digestsize(integrity_w_tfm);
+		int_dig_out = kmalloc(i, GFP_KERNEL);
+		if (!int_dig_out) {
+			retcode = KMallocFailed;
+			goto fail;
+		}
+		int_dig_in = kmalloc(i, GFP_KERNEL);
+		if (!int_dig_in) {
+			retcode = KMallocFailed;
+			goto fail;
+		}
+		int_dig_vv = kmalloc(i, GFP_KERNEL);
+		if (!int_dig_vv) {
+			retcode = KMallocFailed;
+			goto fail;
+		}
+	}
+
+	if (!mdev->bitmap) {
+		if(drbd_bm_init(mdev)) {
+			retcode = KMallocFailed;
+			goto fail;
+		}
+	}
+
+	D_ASSERT(mdev->net_conf == NULL);
+	mdev->net_conf = new_conf;
+
+	mdev->send_cnt = 0;
+	mdev->recv_cnt = 0;
+
+	if (new_tl_hash) {
+		kfree(mdev->tl_hash);
+		mdev->tl_hash_s = mdev->net_conf->max_epoch_size/8;
+		mdev->tl_hash = new_tl_hash;
+	}
+
+	if (new_ee_hash) {
+		kfree(mdev->ee_hash);
+		mdev->ee_hash_s = mdev->net_conf->max_buffers/8;
+		mdev->ee_hash = new_ee_hash;
+	}
+
+	crypto_free_hash(mdev->cram_hmac_tfm);
+	mdev->cram_hmac_tfm = tfm;
+
+	crypto_free_hash(mdev->integrity_w_tfm);
+	mdev->integrity_w_tfm = integrity_w_tfm;
+
+	crypto_free_hash(mdev->integrity_r_tfm);
+	mdev->integrity_r_tfm = integrity_r_tfm;
+
+	kfree(mdev->int_dig_out);
+	kfree(mdev->int_dig_in);
+	kfree(mdev->int_dig_vv);
+	mdev->int_dig_out=int_dig_out;
+	mdev->int_dig_in=int_dig_in;
+	mdev->int_dig_vv=int_dig_vv;
+
+	retcode = _drbd_request_state(mdev, NS(conn, Unconnected), ChgStateVerbose);
+	if (retcode >= SS_Success)
+		drbd_thread_start(&mdev->worker);
+
+	drbd_kobject_uevent(mdev);
+	reply->ret_code = retcode;
+	return 0;
+
+fail:
+	kfree(int_dig_out);
+	kfree(int_dig_in);
+	kfree(int_dig_vv);
+	crypto_free_hash(tfm);
+	crypto_free_hash(integrity_w_tfm);
+	crypto_free_hash(integrity_r_tfm);
+	kfree(new_tl_hash);
+	kfree(new_ee_hash);
+	kfree(new_conf);
+
+	reply->ret_code = retcode;
+	return 0;
+}
+
+STATIC int drbd_nl_disconnect(struct drbd_conf *mdev, struct drbd_nl_cfg_req *nlp,
+			      struct drbd_nl_cfg_reply *reply)
+{
+	int retcode;
+
+	retcode = _drbd_request_state(mdev, NS(conn, Disconnecting), ChgOrdered);
+
+	if (retcode == SS_NothingToDo)
+		goto done;
+	else if (retcode == SS_AlreadyStandAlone)
+		goto done;
+	else if (retcode == SS_PrimaryNOP) {
+		/* Our statche checking code wants to see the peer outdated. */
+		retcode = drbd_request_state(mdev, NS2(conn, Disconnecting,
+						      pdsk, Outdated));
+	} else if (retcode == SS_CW_FailedByPeer) {
+		/* The peer probabely wants to see us outdated. */
+		retcode = _drbd_request_state(mdev, NS2(conn, Disconnecting,
+							disk, Outdated),
+					      ChgOrdered);
+		if (retcode == SS_IsDiskLess || retcode == SS_LowerThanOutdated) {
+			drbd_force_state(mdev, NS(conn, Disconnecting));
+			retcode = SS_Success;
+		}
+	}
+
+	if (retcode < SS_Success)
+		goto fail;
+
+	if (wait_event_interruptible(mdev->state_wait,
+				     mdev->state.conn != Disconnecting)) {
+		/* Do not test for mdev->state.conn == StandAlone, since
+		   someone else might connect us in the mean time! */
+		retcode = GotSignal;
+		goto fail;
+	}
+
+ done:
+	retcode = NoError;
+ fail:
+	drbd_md_sync(mdev);
+	reply->ret_code = retcode;
+	return 0;
+}
+
+void resync_after_online_grow(struct drbd_conf *mdev)
+{
+	int iass; /* I am sync source */
+
+	INFO("Resync of new storage after online grow\n");
+	if (mdev->state.role != mdev->state.peer)
+		iass = (mdev->state.role == Primary);
+	else
+		iass = test_bit(DISCARD_CONCURRENT, &mdev->flags);
+
+	if (iass)
+		drbd_start_resync(mdev, SyncSource);
+	else
+		_drbd_request_state(mdev, NS(conn, WFSyncUUID), ChgStateVerbose + ChgSerialize);
+}
+
+STATIC int drbd_nl_resize(struct drbd_conf *mdev, struct drbd_nl_cfg_req *nlp,
+			  struct drbd_nl_cfg_reply *reply)
+{
+	struct resize rs;
+	int retcode = NoError;
+	int ldsc = 0; /* local disk size changed */
+	enum determin_dev_size_enum dd;
+
+	memset(&rs, 0, sizeof(struct resize));
+	if (!resize_from_tags(mdev, nlp->tag_list, &rs)) {
+		retcode = UnknownMandatoryTag;
+		goto fail;
+	}
+
+	if (mdev->state.conn > Connected) {
+		retcode = NoResizeDuringResync;
+		goto fail;
+	}
+
+	if (mdev->state.role == Secondary &&
+	    mdev->state.peer == Secondary) {
+		retcode = APrimaryNodeNeeded;
+		goto fail;
+	}
+
+	if (!inc_local(mdev)) {
+		retcode = HaveNoDiskConfig;
+		goto fail;
+	}
+
+	if (mdev->bc->known_size != drbd_get_capacity(mdev->bc->backing_bdev)) {
+		mdev->bc->known_size = drbd_get_capacity(mdev->bc->backing_bdev);
+		ldsc = 1;
+	}
+
+	mdev->bc->dc.disk_size = (sector_t)rs.resize_size;
+	dd = drbd_determin_dev_size(mdev);
+	drbd_md_sync(mdev);
+	dec_local(mdev);
+	if (dd == dev_size_error) {
+		retcode = VMallocFailed;
+		goto fail;
+	}
+
+	if (mdev->state.conn == Connected && (dd != unchanged || ldsc)) {
+		drbd_send_uuids(mdev);
+		drbd_send_sizes(mdev);
+		if (dd == grew)
+			resync_after_online_grow(mdev);
+	}
+
+ fail:
+	reply->ret_code = retcode;
+	return 0;
+}
+
+STATIC int drbd_nl_syncer_conf(struct drbd_conf *mdev, struct drbd_nl_cfg_req *nlp,
+			       struct drbd_nl_cfg_reply *reply)
+{
+	int retcode = NoError;
+	int err;
+	int ovr; /* online verify running */
+	int rsr; /* re-sync running */
+	struct drbd_conf *odev;
+	struct crypto_hash *verify_tfm = NULL;
+	struct crypto_hash *csums_tfm = NULL;
+	struct syncer_conf sc;
+	cpumask_t n_cpu_mask = CPU_MASK_NONE;
+
+	memcpy(&sc, &mdev->sync_conf, sizeof(struct syncer_conf));
+
+	if (nlp->flags & DRBD_NL_SET_DEFAULTS) {
+		memset(&sc, 0, sizeof(struct syncer_conf));
+		sc.rate       = DRBD_RATE_DEF;
+		sc.after      = DRBD_AFTER_DEF;
+		sc.al_extents = DRBD_AL_EXTENTS_DEF;
+	}
+
+	if (!syncer_conf_from_tags(mdev, nlp->tag_list, &sc)) {
+		retcode = UnknownMandatoryTag;
+		goto fail;
+	}
+
+	if (sc.after != -1) {
+		if (sc.after < -1 || minor_to_mdev(sc.after) == NULL) {
+			retcode = SyncAfterInvalid;
+			goto fail;
+		}
+		odev = minor_to_mdev(sc.after); /* check against loops in */
+		while (1) {
+			if (odev == mdev) {
+				retcode = SyncAfterCycle;
+				goto fail;
+			}
+			if (odev->sync_conf.after == -1)
+				break; /* no cycles. */
+			odev = minor_to_mdev(odev->sync_conf.after);
+		}
+	}
+
+	/* re-sync running */
+	rsr = (	mdev->state.conn == SyncSource ||
+		mdev->state.conn == SyncTarget ||
+		mdev->state.conn == PausedSyncS ||
+		mdev->state.conn == PausedSyncT );
+
+	if (rsr && strcmp(sc.csums_alg, mdev->sync_conf.csums_alg)) {
+		retcode = CSUMSResyncRunning;
+		goto fail;
+	}
+
+	if (!rsr && sc.csums_alg[0]) {
+		csums_tfm = crypto_alloc_hash(sc.csums_alg, 0, CRYPTO_ALG_ASYNC);
+		if (IS_ERR(csums_tfm)) {
+			csums_tfm = NULL;
+			retcode = CSUMSAlgNotAvail;
+			goto fail;
+		}
+
+		if (crypto_tfm_alg_type(crypto_hash_tfm(csums_tfm)) != CRYPTO_ALG_TYPE_DIGEST) {
+			retcode = CSUMSAlgNotDigest;
+			goto fail;
+		}
+	}
+
+	/* online verify running */
+	ovr = (mdev->state.conn == VerifyS || mdev->state.conn == VerifyT);
+
+	if (ovr) {
+		if (strcmp(sc.verify_alg, mdev->sync_conf.verify_alg)) {
+			retcode = VERIFYIsRunning;
+			goto fail;
+		}
+	}
+
+	if (!ovr && sc.verify_alg[0]) {
+		verify_tfm = crypto_alloc_hash(sc.verify_alg, 0, CRYPTO_ALG_ASYNC);
+		if (IS_ERR(verify_tfm)) {
+			verify_tfm = NULL;
+			retcode = VERIFYAlgNotAvail;
+			goto fail;
+		}
+
+		if (crypto_tfm_alg_type(crypto_hash_tfm(verify_tfm)) != CRYPTO_ALG_TYPE_DIGEST) {
+			retcode = VERIFYAlgNotDigest;
+			goto fail;
+		}
+	}
+
+	if (sc.cpu_mask[0] != 0) {
+		err = __bitmap_parse(sc.cpu_mask, 32, 0, (unsigned long *)&n_cpu_mask, NR_CPUS);
+		if (err) {
+			drbd_WARN("__bitmap_parse() failed with %d\n", err);
+			retcode = CPUMaskParseFailed;
+			goto fail;
+		}
+	}
+
+	ERR_IF (sc.rate < 1) sc.rate = 1;
+	ERR_IF (sc.al_extents < 7) sc.al_extents = 127; /* arbitrary minimum */
+#define AL_MAX ((MD_AL_MAX_SIZE-1) * AL_EXTENTS_PT)
+	if (sc.al_extents > AL_MAX) {
+		ERR("sc.al_extents > %d\n", AL_MAX);
+		sc.al_extents = AL_MAX;
+	}
+#undef AL_MAX
+
+	spin_lock(&mdev->peer_seq_lock);
+	/* lock against receive_SyncParam() */
+	mdev->sync_conf = sc;
+
+	if (!rsr) {
+		crypto_free_hash(mdev->csums_tfm);
+		mdev->csums_tfm = csums_tfm;
+		csums_tfm = NULL;
+	}
+
+	if (!ovr) {
+		crypto_free_hash(mdev->verify_tfm);
+		mdev->verify_tfm = verify_tfm;
+		verify_tfm = NULL;
+	}
+	spin_unlock(&mdev->peer_seq_lock);
+
+	if (inc_local(mdev)) {
+		wait_event(mdev->al_wait, lc_try_lock(mdev->act_log));
+		drbd_al_shrink(mdev);
+		err = drbd_check_al_size(mdev);
+		lc_unlock(mdev->act_log);
+		wake_up(&mdev->al_wait);
+
+		dec_local(mdev);
+		drbd_md_sync(mdev);
+
+		if (err) {
+			retcode = KMallocFailed;
+			goto fail;
+		}
+	}
+
+	if (mdev->state.conn >= Connected)
+		drbd_send_sync_param(mdev, &sc);
+
+	drbd_alter_sa(mdev, sc.after);
+
+	if (!cpus_equal(mdev->cpu_mask, n_cpu_mask)) {
+		mdev->cpu_mask = n_cpu_mask;
+		mdev->cpu_mask = drbd_calc_cpu_mask(mdev);
+		mdev->receiver.reset_cpu_mask = 1;
+		mdev->asender.reset_cpu_mask = 1;
+		mdev->worker.reset_cpu_mask = 1;
+	}
+
+	drbd_kobject_uevent(mdev);
+fail:
+	crypto_free_hash(csums_tfm);
+	crypto_free_hash(verify_tfm);
+	reply->ret_code = retcode;
+	return 0;
+}
+
+STATIC int drbd_nl_invalidate(struct drbd_conf *mdev, struct drbd_nl_cfg_req *nlp,
+			      struct drbd_nl_cfg_reply *reply)
+{
+	int retcode;
+
+	retcode = _drbd_request_state(mdev, NS(conn, StartingSyncT), ChgOrdered);
+
+	if (retcode < SS_Success && retcode != SS_NeedConnection)
+		retcode = drbd_request_state(mdev, NS(conn, StartingSyncT));
+
+	while (retcode == SS_NeedConnection) {
+		spin_lock_irq(&mdev->req_lock);
+		if (mdev->state.conn < Connected)
+			retcode = _drbd_set_state(_NS(mdev, disk, Inconsistent), ChgStateVerbose, NULL);
+		spin_unlock_irq(&mdev->req_lock);
+
+		if (retcode != SS_NeedConnection)
+			break;
+
+		retcode = drbd_request_state(mdev, NS(conn, StartingSyncT));
+	}
+
+	reply->ret_code = retcode;
+	return 0;
+}
+
+STATIC int drbd_nl_invalidate_peer(struct drbd_conf *mdev, struct drbd_nl_cfg_req *nlp,
+				   struct drbd_nl_cfg_reply *reply)
+{
+
+	reply->ret_code = drbd_request_state(mdev, NS(conn, StartingSyncS));
+
+	return 0;
+}
+
+STATIC int drbd_nl_pause_sync(struct drbd_conf *mdev, struct drbd_nl_cfg_req *nlp,
+			      struct drbd_nl_cfg_reply *reply)
+{
+	int retcode = NoError;
+
+	if (drbd_request_state(mdev, NS(user_isp, 1)) == SS_NothingToDo)
+		retcode = PauseFlagAlreadySet;
+
+	reply->ret_code = retcode;
+	return 0;
+}
+
+STATIC int drbd_nl_resume_sync(struct drbd_conf *mdev, struct drbd_nl_cfg_req *nlp,
+			       struct drbd_nl_cfg_reply *reply)
+{
+	int retcode = NoError;
+
+	if (drbd_request_state(mdev, NS(user_isp, 0)) == SS_NothingToDo)
+		retcode = PauseFlagAlreadyClear;
+
+	reply->ret_code = retcode;
+	return 0;
+}
+
+STATIC int drbd_nl_suspend_io(struct drbd_conf *mdev, struct drbd_nl_cfg_req *nlp,
+			      struct drbd_nl_cfg_reply *reply)
+{
+	reply->ret_code = drbd_request_state(mdev, NS(susp, 1));
+
+	return 0;
+}
+
+STATIC int drbd_nl_resume_io(struct drbd_conf *mdev, struct drbd_nl_cfg_req *nlp,
+			     struct drbd_nl_cfg_reply *reply)
+{
+	reply->ret_code = drbd_request_state(mdev, NS(susp, 0));
+	return 0;
+}
+
+STATIC int drbd_nl_outdate(struct drbd_conf *mdev, struct drbd_nl_cfg_req *nlp,
+			   struct drbd_nl_cfg_reply *reply)
+{
+	reply->ret_code = drbd_request_state(mdev, NS(disk, Outdated));
+	return 0;
+}
+
+STATIC int drbd_nl_get_config(struct drbd_conf *mdev, struct drbd_nl_cfg_req *nlp,
+			   struct drbd_nl_cfg_reply *reply)
+{
+	unsigned short *tl;
+
+	tl = reply->tag_list;
+
+	if (inc_local(mdev)) {
+		tl = disk_conf_to_tags(mdev, &mdev->bc->dc, tl);
+		dec_local(mdev);
+	}
+
+	if (inc_net(mdev)) {
+		tl = net_conf_to_tags(mdev, mdev->net_conf, tl);
+		dec_net(mdev);
+	}
+	tl = syncer_conf_to_tags(mdev, &mdev->sync_conf, tl);
+
+	*tl++ = TT_END; /* Close the tag list */
+
+	return (int)((char *)tl - (char *)reply->tag_list);
+}
+
+STATIC int drbd_nl_get_state(struct drbd_conf *mdev, struct drbd_nl_cfg_req *nlp,
+			     struct drbd_nl_cfg_reply *reply)
+{
+	unsigned short *tl = reply->tag_list;
+	union drbd_state_t s = mdev->state;
+	unsigned long rs_left;
+	unsigned int res;
+
+	tl = get_state_to_tags(mdev, (struct get_state *)&s, tl);
+
+	/* no local ref, no bitmap, no syncer progress. */
+	if (s.conn >= SyncSource && s.conn <= PausedSyncT) {
+		if (inc_local(mdev)) {
+			drbd_get_syncer_progress(mdev, &rs_left, &res);
+			*tl++ = T_sync_progress;
+			*tl++ = sizeof(int);
+			memcpy(tl, &res, sizeof(int));
+			tl = (unsigned short *)((char *)tl + sizeof(int));
+			dec_local(mdev);
+		}
+	}
+	*tl++ = TT_END; /* Close the tag list */
+
+	return (int)((char *)tl - (char *)reply->tag_list);
+}
+
+STATIC int drbd_nl_get_uuids(struct drbd_conf *mdev, struct drbd_nl_cfg_req *nlp,
+			     struct drbd_nl_cfg_reply *reply)
+{
+	unsigned short *tl;
+
+	tl = reply->tag_list;
+
+	if (inc_local(mdev)) {
+		/* This is a hand crafted add tag ;) */
+		*tl++ = T_uuids;
+		*tl++ = UUID_SIZE*sizeof(u64);
+		memcpy(tl, mdev->bc->md.uuid, UUID_SIZE*sizeof(u64));
+		tl = (unsigned short *)((char *)tl + UUID_SIZE*sizeof(u64));
+		*tl++ = T_uuids_flags;
+		*tl++ = sizeof(int);
+		memcpy(tl, &mdev->bc->md.flags, sizeof(int));
+		tl = (unsigned short *)((char *)tl + sizeof(int));
+		dec_local(mdev);
+	}
+	*tl++ = TT_END; /* Close the tag list */
+
+	return (int)((char *)tl - (char *)reply->tag_list);
+}
+
+/**
+ * drbd_nl_get_timeout_flag:
+ * Is used by drbdsetup to find out which timeout value to use.
+ */
+STATIC int drbd_nl_get_timeout_flag(struct drbd_conf *mdev, struct drbd_nl_cfg_req *nlp,
+				    struct drbd_nl_cfg_reply *reply)
+{
+	unsigned short *tl;
+	char rv;
+
+	tl = reply->tag_list;
+
+	rv = mdev->state.pdsk == Outdated        ? UT_PeerOutdated :
+	  test_bit(USE_DEGR_WFC_T, &mdev->flags) ? UT_Degraded : UT_Default;
+
+	/* This is a hand crafted add tag ;) */
+	*tl++ = T_use_degraded;
+	*tl++ = sizeof(char);
+	*((char *)tl) = rv;
+	tl = (unsigned short *)((char *)tl + sizeof(char));
+	*tl++ = TT_END;
+
+	return (int)((char *)tl - (char *)reply->tag_list);
+}
+
+STATIC int drbd_nl_start_ov(struct drbd_conf *mdev, struct drbd_nl_cfg_req *nlp,
+				    struct drbd_nl_cfg_reply *reply)
+{
+	reply->ret_code = drbd_request_state(mdev,NS(conn,VerifyS));
+
+	return 0;
+}
+
+
+STATIC int drbd_nl_new_c_uuid(struct drbd_conf *mdev, struct drbd_nl_cfg_req *nlp,
+			      struct drbd_nl_cfg_reply *reply)
+{
+	int retcode = NoError;
+	int err;
+
+	struct new_c_uuid args;
+
+	memset(&args, 0, sizeof(struct new_c_uuid));
+	if (!new_c_uuid_from_tags(mdev, nlp->tag_list, &args)) {
+		reply->ret_code = UnknownMandatoryTag;
+		return 0;
+	}
+
+	mutex_lock(&mdev->state_mutex); /* Protects us against serialized state changes. */
+
+	if (mdev->state.conn >= Connected) {
+		retcode = MayNotBeConnected;
+		goto out;
+	}
+
+	if (!inc_local(mdev)) {
+		retcode = HaveNoDiskConfig;
+		goto out;
+	}
+
+	drbd_uuid_set(mdev, Bitmap, 0); /* Rotate Bitmap to History 1, etc... */
+	drbd_uuid_new_current(mdev); /* New current, previous to Bitmap */
+
+	if (args.clear_bm) {
+		err = drbd_bitmap_io(mdev, &drbd_bmio_clear_n_write, "clear_n_write from new_c_uuid");
+		if (err) {
+			ERR("Writing bitmap failed with %d\n",err);
+			retcode = MDIOError;
+		}
+	}
+
+	drbd_md_sync(mdev);
+	dec_local(mdev);
+out:
+	mutex_unlock(&mdev->state_mutex);
+
+	reply->ret_code = retcode;
+	return 0;
+}
+
+STATIC struct drbd_conf *ensure_mdev(struct drbd_nl_cfg_req *nlp)
+{
+	struct drbd_conf *mdev;
+
+	if (nlp->drbd_minor >= minor_count)
+		return NULL;
+
+	mdev = minor_to_mdev(nlp->drbd_minor);
+
+	if (!mdev && (nlp->flags & DRBD_NL_CREATE_DEVICE)) {
+		struct gendisk *disk = NULL;
+		mdev = drbd_new_device(nlp->drbd_minor);
+
+		spin_lock_irq(&drbd_pp_lock);
+		if (minor_table[nlp->drbd_minor] == NULL) {
+			minor_table[nlp->drbd_minor] = mdev;
+			disk = mdev->vdisk;
+			mdev = NULL;
+		} /* else: we lost the race */
+		spin_unlock_irq(&drbd_pp_lock);
+
+		if (disk) /* we won the race above */
+			/* in case we ever add a drbd_delete_device(),
+			 * don't forget the del_gendisk! */
+			add_disk(disk);
+		else /* we lost the race above */
+			drbd_free_mdev(mdev);
+
+		mdev = minor_to_mdev(nlp->drbd_minor);
+	}
+
+	return mdev;
+}
+
+struct cn_handler_struct {
+	int (*function)(struct drbd_conf *,
+			 struct drbd_nl_cfg_req *,
+			 struct drbd_nl_cfg_reply *);
+	int reply_body_size;
+};
+
+static struct cn_handler_struct cnd_table[] = {
+	[ P_primary ]		= { &drbd_nl_primary,		0 },
+	[ P_secondary ]		= { &drbd_nl_secondary,		0 },
+	[ P_disk_conf ]		= { &drbd_nl_disk_conf,		0 },
+	[ P_detach ]		= { &drbd_nl_detach,		0 },
+	[ P_net_conf ]		= { &drbd_nl_net_conf,		0 },
+	[ P_disconnect ]	= { &drbd_nl_disconnect,	0 },
+	[ P_resize ]		= { &drbd_nl_resize,		0 },
+	[ P_syncer_conf ]	= { &drbd_nl_syncer_conf,	0 },
+	[ P_invalidate ]	= { &drbd_nl_invalidate,	0 },
+	[ P_invalidate_peer ]	= { &drbd_nl_invalidate_peer,	0 },
+	[ P_pause_sync ]	= { &drbd_nl_pause_sync,	0 },
+	[ P_resume_sync ]	= { &drbd_nl_resume_sync,	0 },
+	[ P_suspend_io ]	= { &drbd_nl_suspend_io,	0 },
+	[ P_resume_io ]		= { &drbd_nl_resume_io,		0 },
+	[ P_outdate ]		= { &drbd_nl_outdate,		0 },
+	[ P_get_config ]	= { &drbd_nl_get_config,
+				    sizeof(struct syncer_conf_tag_len_struct) +
+				    sizeof(struct disk_conf_tag_len_struct) +
+				    sizeof(struct net_conf_tag_len_struct) },
+	[ P_get_state ]		= { &drbd_nl_get_state,
+				    sizeof(struct get_state_tag_len_struct) +
+				    sizeof(struct sync_progress_tag_len_struct)	},
+	[ P_get_uuids ]		= { &drbd_nl_get_uuids,
+				    sizeof(struct get_uuids_tag_len_struct) },
+	[ P_get_timeout_flag ]	= { &drbd_nl_get_timeout_flag,
+				    sizeof(struct get_timeout_flag_tag_len_struct)},
+	[ P_start_ov ]		= { &drbd_nl_start_ov,		0 },
+	[ P_new_c_uuid ]	= { &drbd_nl_new_c_uuid,	0 },
+};
+
+STATIC void drbd_connector_callback(void *data)
+{
+	struct cn_msg *req = data;
+	struct drbd_nl_cfg_req *nlp = (struct drbd_nl_cfg_req *)req->data;
+	struct cn_handler_struct *cm;
+	struct cn_msg *cn_reply;
+	struct drbd_nl_cfg_reply *reply;
+	struct drbd_conf *mdev;
+	int retcode, rr;
+	int reply_size = sizeof(struct cn_msg)
+		+ sizeof(struct drbd_nl_cfg_reply)
+		+ sizeof(short int);
+
+	if (!try_module_get(THIS_MODULE)) {
+		printk(KERN_ERR "drbd: try_module_get() failed!\n");
+		return;
+	}
+
+	mdev = ensure_mdev(nlp);
+	if (!mdev) {
+		retcode = MinorNotKnown;
+		goto fail;
+	}
+
+	TRACE(TraceTypeNl, TraceLvlSummary, nl_trace_packet(data););
+
+	if (nlp->packet_type >= P_nl_after_last_packet) {
+		retcode = UnknownNetLinkPacket;
+		goto fail;
+	}
+
+	cm = cnd_table + nlp->packet_type;
+
+	/* This may happen if packet number is 0: */
+	if (cm->function == NULL) {
+		retcode = UnknownNetLinkPacket;
+		goto fail;
+	}
+
+	reply_size += cm->reply_body_size;
+
+	cn_reply = kmalloc(reply_size, GFP_KERNEL);
+	if (!cn_reply) {
+		retcode = KMallocFailed;
+		goto fail;
+	}
+	reply = (struct drbd_nl_cfg_reply *) cn_reply->data;
+
+	reply->packet_type =
+		cm->reply_body_size ? nlp->packet_type : P_nl_after_last_packet;
+	reply->minor = nlp->drbd_minor;
+	reply->ret_code = NoError; /* Might by modified by cm->function. */
+	/* reply->tag_list; might be modified by cm->fucntion. */
+
+	rr = cm->function(mdev, nlp, reply);
+
+	cn_reply->id = req->id;
+	cn_reply->seq = req->seq;
+	cn_reply->ack = req->ack  + 1;
+	cn_reply->len = sizeof(struct drbd_nl_cfg_reply) + rr;
+	cn_reply->flags = 0;
+
+	TRACE(TraceTypeNl, TraceLvlSummary, nl_trace_reply(cn_reply););
+
+	rr = cn_netlink_send(cn_reply, CN_IDX_DRBD, GFP_KERNEL);
+	if (rr && rr != -ESRCH)
+		printk(KERN_INFO "drbd: cn_netlink_send()=%d\n", rr);
+
+	kfree(cn_reply);
+	module_put(THIS_MODULE);
+	return;
+ fail:
+	drbd_nl_send_reply(req, retcode);
+	module_put(THIS_MODULE);
+}
+
+static atomic_t drbd_nl_seq = ATOMIC_INIT(2); /* two. */
+
+static inline unsigned short *
+__tl_add_blob(unsigned short *tl, enum drbd_tags tag, const void *data,
+	int len, int nul_terminated)
+{
+	int l = tag_descriptions[tag_number(tag)].max_len;
+	l = (len < l) ? len :  l;
+	*tl++ = tag;
+	*tl++ = len;
+	memcpy(tl, data, len);
+	/* TODO
+	 * maybe we need to add some padding to the data stream.
+	 * otherwise we may get strange effects on architectures
+	 * that require certain data types to be strictly aligned,
+	 * because now the next "unsigned short" may be misaligned. */
+	tl = (unsigned short*)((char*)tl + len);
+	if (nul_terminated)
+		*((char*)tl - 1) = 0;
+	return tl;
+}
+
+static inline unsigned short *
+tl_add_blob(unsigned short *tl, enum drbd_tags tag, const void *data, int len)
+{
+	return __tl_add_blob(tl, tag, data, len, 0);
+}
+
+static inline unsigned short *
+tl_add_str(unsigned short *tl, enum drbd_tags tag, const char *str)
+{
+	return __tl_add_blob(tl, tag, str, strlen(str)+1, 0);
+}
+
+static inline unsigned short *
+tl_add_int(unsigned short *tl, enum drbd_tags tag, const void *val)
+{
+	switch(tag_type(tag)) {
+	case TT_INTEGER:
+		*tl++ = tag;
+		*tl++ = sizeof(int);
+		*(int*)tl = *(int*)val;
+		tl = (unsigned short*)((char*)tl+sizeof(int));
+		break;
+	case TT_INT64:
+		*tl++ = tag;
+		*tl++ = sizeof(u64);
+		*(u64*)tl = *(u64*)val;
+		tl = (unsigned short*)((char*)tl+sizeof(u64));
+		break;
+	default:
+		/* someone did something stupid. */
+		;
+	}
+	return tl;
+}
+
+void drbd_bcast_state(struct drbd_conf *mdev, union drbd_state_t state)
+{
+	char buffer[sizeof(struct cn_msg)+
+		    sizeof(struct drbd_nl_cfg_reply)+
+		    sizeof(struct get_state_tag_len_struct)+
+		    sizeof(short int)];
+	struct cn_msg *cn_reply = (struct cn_msg *) buffer;
+	struct drbd_nl_cfg_reply *reply =
+		(struct drbd_nl_cfg_reply *)cn_reply->data;
+	unsigned short *tl = reply->tag_list;
+
+	/* drbd_WARN("drbd_bcast_state() got called\n"); */
+
+	tl = get_state_to_tags(mdev, (struct get_state *)&state, tl);
+	*tl++ = TT_END; /* Close the tag list */
+
+	cn_reply->id.idx = CN_IDX_DRBD;
+	cn_reply->id.val = CN_VAL_DRBD;
+
+	cn_reply->seq = atomic_add_return(1, &drbd_nl_seq);
+	cn_reply->ack = 0; /* not used here. */
+	cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
+		(int)((char *)tl - (char *)reply->tag_list);
+	cn_reply->flags = 0;
+
+	reply->packet_type = P_get_state;
+	reply->minor = mdev_to_minor(mdev);
+	reply->ret_code = NoError;
+
+	TRACE(TraceTypeNl, TraceLvlSummary, nl_trace_reply(cn_reply););
+
+	cn_netlink_send(cn_reply, CN_IDX_DRBD, GFP_KERNEL);
+}
+
+void drbd_bcast_ev_helper(struct drbd_conf *mdev, char *helper_name)
+{
+	char buffer[sizeof(struct cn_msg)+
+		    sizeof(struct drbd_nl_cfg_reply)+
+		    sizeof(struct call_helper_tag_len_struct)+
+		    sizeof(short int)];
+	struct cn_msg *cn_reply = (struct cn_msg *) buffer;
+	struct drbd_nl_cfg_reply *reply =
+		(struct drbd_nl_cfg_reply *)cn_reply->data;
+	unsigned short *tl = reply->tag_list;
+	int str_len;
+
+	/* drbd_WARN("drbd_bcast_state() got called\n"); */
+
+	str_len = strlen(helper_name)+1;
+	*tl++ = T_helper;
+	*tl++ = str_len;
+	memcpy(tl, helper_name, str_len);
+	tl = (unsigned short *)((char *)tl + str_len);
+	*tl++ = TT_END; /* Close the tag list */
+
+	cn_reply->id.idx = CN_IDX_DRBD;
+	cn_reply->id.val = CN_VAL_DRBD;
+
+	cn_reply->seq = atomic_add_return(1, &drbd_nl_seq);
+	cn_reply->ack = 0; /* not used here. */
+	cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
+		(int)((char *)tl - (char *)reply->tag_list);
+	cn_reply->flags = 0;
+
+	reply->packet_type = P_call_helper;
+	reply->minor = mdev_to_minor(mdev);
+	reply->ret_code = NoError;
+
+	TRACE(TraceTypeNl, TraceLvlSummary, nl_trace_reply(cn_reply););
+
+	cn_netlink_send(cn_reply, CN_IDX_DRBD, GFP_KERNEL);
+}
+
+void drbd_bcast_ee(struct drbd_conf *mdev,
+		const char *reason, const int dgs,
+		const char* seen_hash, const char* calc_hash,
+		const struct Tl_epoch_entry* e)
+{
+	struct cn_msg *cn_reply;
+	struct drbd_nl_cfg_reply *reply;
+	struct bio_vec *bvec;
+	unsigned short *tl;
+	int i;
+
+	if (!e)
+		return;
+	if (!reason || !reason[0])
+		return;
+
+	/* aparently we have to memcpy twice, first to prepare the data for the
+	 * struct cn_msg, then within cn_netlink_send from the cn_msg to the
+	 * netlink skb. */
+	cn_reply = kmalloc(
+		sizeof(struct cn_msg)+
+		sizeof(struct drbd_nl_cfg_reply)+
+		sizeof(struct dump_ee_tag_len_struct)+
+		sizeof(short int)
+		, GFP_KERNEL);
+
+	if (!cn_reply) {
+		ERR("could not kmalloc buffer for drbd_bcast_ee, sector %llu, size %u\n",
+				(unsigned long long)e->sector, e->size);
+		return;
+	}
+
+	reply = (struct drbd_nl_cfg_reply*)cn_reply->data;
+	tl = reply->tag_list;
+
+	tl = tl_add_str(tl, T_dump_ee_reason, reason);
+	tl = tl_add_blob(tl, T_seen_digest, seen_hash, dgs);
+	tl = tl_add_blob(tl, T_calc_digest, calc_hash, dgs);
+	tl = tl_add_int(tl, T_ee_sector, &e->sector);
+	tl = tl_add_int(tl, T_ee_block_id, &e->block_id);
+
+	*tl++ = T_ee_data;
+	*tl++ = e->size;
+
+	__bio_for_each_segment(bvec, e->private_bio, i, 0) {
+		void *d = kmap(bvec->bv_page);
+		memcpy(tl, d + bvec->bv_offset, bvec->bv_len);
+		kunmap(bvec->bv_page);
+		tl=(unsigned short*)((char*)tl + bvec->bv_len);
+	}
+	*tl++ = TT_END; /* Close the tag list */
+
+	cn_reply->id.idx = CN_IDX_DRBD;
+	cn_reply->id.val = CN_VAL_DRBD;
+
+	cn_reply->seq = atomic_add_return(1,&drbd_nl_seq);
+	cn_reply->ack = 0; // not used here.
+	cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
+		(int)((char*)tl - (char*)reply->tag_list);
+	cn_reply->flags = 0;
+
+	reply->packet_type = P_dump_ee;
+	reply->minor = mdev_to_minor(mdev);
+	reply->ret_code = NoError;
+
+	TRACE(TraceTypeNl, TraceLvlSummary, nl_trace_reply(cn_reply););
+
+	cn_netlink_send(cn_reply, CN_IDX_DRBD, GFP_KERNEL);
+	kfree(cn_reply);
+}
+
+void drbd_bcast_sync_progress(struct drbd_conf *mdev)
+{
+	char buffer[sizeof(struct cn_msg)+
+		    sizeof(struct drbd_nl_cfg_reply)+
+		    sizeof(struct sync_progress_tag_len_struct)+
+		    sizeof(short int)];
+	struct cn_msg *cn_reply = (struct cn_msg *) buffer;
+	struct drbd_nl_cfg_reply *reply =
+		(struct drbd_nl_cfg_reply *)cn_reply->data;
+	unsigned short *tl = reply->tag_list;
+	unsigned long rs_left;
+	unsigned int res;
+
+	/* no local ref, no bitmap, no syncer progress, no broadcast. */
+	if (!inc_local(mdev))
+		return;
+	drbd_get_syncer_progress(mdev, &rs_left, &res);
+	dec_local(mdev);
+
+	*tl++ = T_sync_progress;
+	*tl++ = sizeof(int);
+	memcpy(tl, &res, sizeof(int));
+	tl = (unsigned short *)((char *)tl + sizeof(int));
+	*tl++ = TT_END; /* Close the tag list */
+
+	cn_reply->id.idx = CN_IDX_DRBD;
+	cn_reply->id.val = CN_VAL_DRBD;
+
+	cn_reply->seq = atomic_add_return(1, &drbd_nl_seq);
+	cn_reply->ack = 0; /* not used here. */
+	cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
+		(int)((char *)tl - (char *)reply->tag_list);
+	cn_reply->flags = 0;
+
+	reply->packet_type = P_sync_progress;
+	reply->minor = mdev_to_minor(mdev);
+	reply->ret_code = NoError;
+
+	TRACE(TraceTypeNl, TraceLvlSummary, nl_trace_reply(cn_reply););
+
+	cn_netlink_send(cn_reply, CN_IDX_DRBD, GFP_KERNEL);
+}
+
+int __init drbd_nl_init(void)
+{
+	static struct cb_id cn_id_drbd;
+	int err, try=10;
+
+	cn_id_drbd.val = CN_VAL_DRBD;
+	do {
+		cn_id_drbd.idx = cn_idx;
+		err = cn_add_callback(&cn_id_drbd, "cn_drbd", &drbd_connector_callback);
+		if (!err)
+			break;
+		cn_idx = (cn_idx + CN_IDX_STEP);
+	} while (try--);
+
+	if (err) {
+		printk(KERN_ERR "drbd: cn_drbd failed to register\n");
+		return err;
+	}
+
+	return 0;
+}
+
+void drbd_nl_cleanup(void)
+{
+	static struct cb_id cn_id_drbd;
+
+	cn_id_drbd.idx = cn_idx;
+	cn_id_drbd.val = CN_VAL_DRBD;
+
+	cn_del_callback(&cn_id_drbd);
+}
+
+void drbd_nl_send_reply(struct cn_msg *req, int ret_code)
+{
+	char buffer[sizeof(struct cn_msg)+sizeof(struct drbd_nl_cfg_reply)];
+	struct cn_msg *cn_reply = (struct cn_msg *) buffer;
+	struct drbd_nl_cfg_reply *reply =
+		(struct drbd_nl_cfg_reply *)cn_reply->data;
+	int rr;
+
+	cn_reply->id = req->id;
+
+	cn_reply->seq = req->seq;
+	cn_reply->ack = req->ack  + 1;
+	cn_reply->len = sizeof(struct drbd_nl_cfg_reply);
+	cn_reply->flags = 0;
+
+	reply->minor = ((struct drbd_nl_cfg_req *)req->data)->drbd_minor;
+	reply->ret_code = ret_code;
+
+	TRACE(TraceTypeNl, TraceLvlSummary, nl_trace_reply(cn_reply););
+
+	rr = cn_netlink_send(cn_reply, CN_IDX_DRBD, GFP_KERNEL);
+	if (rr && rr != -ESRCH)
+		printk(KERN_INFO "drbd: cn_netlink_send()=%d\n", rr);
+}
+
--- linux-rt-2.6.31.orig/ubuntu/drbd/drbd_bitmap.c
+++ linux-rt-2.6.31/ubuntu/drbd/drbd_bitmap.c
@@ -0,0 +1,1268 @@
+/*
+   drbd_bitmap.c
+
+   This file is part of DRBD by Philipp Reisner and Lars Ellenberg.
+
+   Copyright (C) 2004-2008, LINBIT Information Technologies GmbH.
+   Copyright (C) 2004-2008, Philipp Reisner <philipp.reisner@linbit.com>.
+   Copyright (C) 2004-2008, Lars Ellenberg <lars.ellenberg@linbit.com>.
+
+   drbd is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 2, or (at your option)
+   any later version.
+
+   drbd is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with drbd; see the file COPYING.  If not, write to
+   the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#include <linux/bitops.h>
+#include <linux/vmalloc.h>
+#include <linux/string.h>
+#include <linux/drbd.h>
+#include "drbd_int.h"
+
+/* OPAQUE outside this file!
+ * interface defined in drbd_int.h
+
+ * convetion:
+ * function name drbd_bm_... => used elsewhere, "public".
+ * function name      bm_... => internal to implementation, "private".
+
+ * Note that since find_first_bit returns int, at the current granularity of
+ * the bitmap (4KB per byte), this implementation "only" supports up to
+ * 1<<(32+12) == 16 TB...
+ */
+
+/*
+ * NOTE
+ *  Access to the *bm_pages is protected by bm_lock.
+ *  It is safe to read the other members within the lock.
+ *
+ *  drbd_bm_set_bits is called from bio_endio callbacks,
+ *  We may be called with irq already disabled,
+ *  so we need spin_lock_irqsave().
+ *  And we need the kmap_atomic.
+ */
+struct drbd_bitmap {
+	struct page **bm_pages;
+	spinlock_t bm_lock;
+	/* WARNING unsigned long bm_*:
+	 * 32bit number of bit offset is just enough for 512 MB bitmap.
+	 * it will blow up if we make the bitmap bigger...
+	 * not that it makes much sense to have a bitmap that large,
+	 * rather change the granularity to 16k or 64k or something.
+	 * (that implies other problems, however...)
+	 */
+	unsigned long bm_set;       /* nr of set bits; THINK maybe atomic_t? */
+	unsigned long bm_bits;
+	size_t   bm_words;
+	size_t   bm_number_of_pages;
+	sector_t bm_dev_capacity;
+	struct semaphore bm_change; /* serializes resize operations */
+
+	atomic_t bm_async_io;
+	wait_queue_head_t bm_io_wait;
+
+	unsigned long  bm_flags;
+
+	/* debugging aid, in case we are still racy somewhere */
+	char          *bm_why;
+	struct task_struct *bm_task;
+};
+
+/* definition of bits in bm_flags */
+#define BM_LOCKED       0
+#define BM_MD_IO_ERROR  1
+
+static inline int bm_is_locked(struct drbd_bitmap *b)
+{
+	return test_bit(BM_LOCKED, &b->bm_flags);
+}
+
+#define bm_print_lock_info(m) __bm_print_lock_info(m, __func__)
+static void __bm_print_lock_info(struct drbd_conf *mdev, const char *func)
+{
+	struct drbd_bitmap *b = mdev->bitmap;
+	if (!__ratelimit(&drbd_ratelimit_state))
+		return;
+	ERR("FIXME %s in %s, bitmap locked for '%s' by %s\n",
+	    current == mdev->receiver.task ? "receiver" :
+	    current == mdev->asender.task  ? "asender"  :
+	    current == mdev->worker.task   ? "worker"   : current->comm,
+	    func, b->bm_why ?: "?",
+	    b->bm_task == mdev->receiver.task ? "receiver" :
+	    b->bm_task == mdev->asender.task  ? "asender"  :
+	    b->bm_task == mdev->worker.task   ? "worker"   : "?");
+}
+
+void drbd_bm_lock(struct drbd_conf *mdev, char *why)
+{
+	struct drbd_bitmap *b = mdev->bitmap;
+	int trylock_failed;
+
+	if (!b) {
+		ERR("FIXME no bitmap in drbd_bm_lock!?\n");
+		return;
+	}
+
+	trylock_failed = down_trylock(&b->bm_change);
+
+	if (trylock_failed) {
+		DBG("%s going to '%s' but bitmap already locked for '%s' by %s\n",
+		    current == mdev->receiver.task ? "receiver" :
+		    current == mdev->asender.task  ? "asender"  :
+		    current == mdev->worker.task   ? "worker"   : "?",
+		    why, b->bm_why ?: "?",
+		    b->bm_task == mdev->receiver.task ? "receiver" :
+		    b->bm_task == mdev->asender.task  ? "asender"  :
+		    b->bm_task == mdev->worker.task   ? "worker"   : "?");
+		down(&b->bm_change);
+	}
+	if (__test_and_set_bit(BM_LOCKED, &b->bm_flags))
+		ERR("FIXME bitmap already locked in bm_lock\n");
+
+	b->bm_why  = why;
+	b->bm_task = current;
+}
+
+void drbd_bm_unlock(struct drbd_conf *mdev)
+{
+	struct drbd_bitmap *b = mdev->bitmap;
+	if (!b) {
+		ERR("FIXME no bitmap in drbd_bm_unlock!?\n");
+		return;
+	}
+
+	if (!__test_and_clear_bit(BM_LOCKED, &mdev->bitmap->bm_flags))
+		ERR("FIXME bitmap not locked in bm_unlock\n");
+
+	b->bm_why  = NULL;
+	b->bm_task = NULL;
+	up(&b->bm_change);
+}
+
+/* word offset to long pointer */
+STATIC unsigned long *__bm_map_paddr(struct drbd_bitmap *b, unsigned long offset, const enum km_type km)
+{
+	struct page *page;
+	unsigned long page_nr;
+
+	/* page_nr = (word*sizeof(long)) >> PAGE_SHIFT; */
+	page_nr = offset >> (PAGE_SHIFT - LN2_BPL + 3);
+	BUG_ON(page_nr >= b->bm_number_of_pages);
+	page = b->bm_pages[page_nr];
+
+	return (unsigned long *) kmap_atomic(page, km);
+}
+
+unsigned long * bm_map_paddr(struct drbd_bitmap *b, unsigned long offset)
+{
+	return __bm_map_paddr(b, offset, KM_IRQ1);
+}
+
+void __bm_unmap(unsigned long *p_addr, const enum km_type km)
+{
+	kunmap_atomic(p_addr, km);
+};
+
+void bm_unmap(unsigned long *p_addr)
+{
+	return __bm_unmap(p_addr, KM_IRQ1);
+}
+
+/* long word offset of _bitmap_ sector */
+#define S2W(s)	((s)<<(BM_EXT_SIZE_B-BM_BLOCK_SIZE_B-LN2_BPL))
+/* word offset from start of bitmap to word number _in_page_
+ * modulo longs per page
+#define MLPP(X) ((X) % (PAGE_SIZE/sizeof(long))
+ hm, well, Philipp thinks gcc might not optimze the % into & (... - 1)
+ so do it explicitly:
+ */
+#define MLPP(X) ((X) & ((PAGE_SIZE/sizeof(long))-1))
+
+/* Long words per page */
+#define LWPP (PAGE_SIZE/sizeof(long))
+
+/*
+ * actually most functions herein should take a struct drbd_bitmap*, not a
+ * struct drbd_conf*, but for the debug macros I like to have the mdev around
+ * to be able to report device specific.
+ */
+
+STATIC void bm_free_pages(struct page **pages, unsigned long number)
+{
+	unsigned long i;
+	if (!pages)
+		return;
+
+	for (i = 0; i < number; i++) {
+		if (!pages[i]) {
+			printk(KERN_ALERT "drbd: bm_free_pages tried to free "
+					  "a NULL pointer; i=%lu n=%lu\n",
+					  i, number);
+			continue;
+		}
+		__free_page(pages[i]);
+		pages[i] = NULL;
+	}
+}
+
+/*
+ * "have" and "want" are NUMBER OF PAGES.
+ */
+STATIC struct page **bm_realloc_pages(struct page **old_pages,
+				       unsigned long have,
+				       unsigned long want)
+{
+	struct page **new_pages, *page;
+	unsigned int i, bytes;
+
+	BUG_ON(have == 0 && old_pages != NULL);
+	BUG_ON(have != 0 && old_pages == NULL);
+
+	if (have == want)
+		return old_pages;
+
+	/* To use kmalloc here is ok, as long as we support 4TB at max...
+	 * otherwise this might become bigger than 128KB, which is
+	 * the maximum for kmalloc.
+	 *
+	 * no, it is not: on 64bit boxes, sizeof(void*) == 8,
+	 * 128MB bitmap @ 4K pages -> 256K of page pointers.
+	 * ==> use vmalloc for now again.
+	 * then again, we could do something like
+	 *   if (nr_pages > watermark) vmalloc else kmalloc :*> ...
+	 * or do cascading page arrays:
+	 *   one page for the page array of the page array,
+	 *   those pages for the real bitmap pages.
+	 *   there we could even add some optimization members,
+	 *   so we won't need to kmap_atomic in bm_find_next_bit just to see
+	 *   that the page has no bits set ...
+	 * or we can try a "huge" page ;-)
+	 */
+	bytes = sizeof(struct page *)*want;
+	new_pages = vmalloc(bytes);
+	if (!new_pages)
+		return NULL;
+
+	memset(new_pages, 0, bytes);
+	if (want >= have) {
+		for (i = 0; i < have; i++)
+			new_pages[i] = old_pages[i];
+		for (; i < want; i++) {
+			page = alloc_page(GFP_HIGHUSER);
+			if (!page) {
+				bm_free_pages(new_pages + have, i - have);
+				vfree(new_pages);
+				return NULL;
+			}
+			new_pages[i] = page;
+		}
+	} else {
+		for (i = 0; i < want; i++)
+			new_pages[i] = old_pages[i];
+		/* NOT HERE, we are outside the spinlock!
+		bm_free_pages(old_pages + want, have - want);
+		*/
+	}
+
+	return new_pages;
+}
+
+/*
+ * called on driver init only. TODO call when a device is created.
+ * allocates the drbd_bitmap, and stores it in mdev->bitmap.
+ */
+int drbd_bm_init(struct drbd_conf *mdev)
+{
+	struct drbd_bitmap *b = mdev->bitmap;
+	WARN_ON(b != NULL);
+	b = kzalloc(sizeof(struct drbd_bitmap), GFP_KERNEL);
+	if (!b)
+		return -ENOMEM;
+	spin_lock_init(&b->bm_lock);
+	init_MUTEX(&b->bm_change);
+	init_waitqueue_head(&b->bm_io_wait);
+
+	mdev->bitmap = b;
+
+	return 0;
+}
+
+sector_t drbd_bm_capacity(struct drbd_conf *mdev)
+{
+	ERR_IF(!mdev->bitmap) return 0;
+	return mdev->bitmap->bm_dev_capacity;
+}
+
+/* called on driver unload. TODO: call when a device is destroyed.
+ */
+void drbd_bm_cleanup(struct drbd_conf *mdev)
+{
+	ERR_IF (!mdev->bitmap) return;
+	bm_free_pages(mdev->bitmap->bm_pages, mdev->bitmap->bm_number_of_pages);
+	vfree(mdev->bitmap->bm_pages);
+	kfree(mdev->bitmap);
+	mdev->bitmap = NULL;
+}
+
+/*
+ * since (b->bm_bits % BITS_PER_LONG) != 0,
+ * this masks out the remaining bits.
+ * Rerturns the number of bits cleared.
+ */
+STATIC int bm_clear_surplus(struct drbd_bitmap *b)
+{
+	const unsigned long mask = (1UL << (b->bm_bits & (BITS_PER_LONG-1))) - 1;
+	size_t w = b->bm_bits >> LN2_BPL;
+	int cleared = 0;
+	unsigned long *p_addr, *bm;
+
+	p_addr = bm_map_paddr(b, w);
+	bm = p_addr + MLPP(w);
+	if (w < b->bm_words) {
+		cleared = hweight_long(*bm & ~mask);
+		*bm &= mask;
+		w++; bm++;
+	}
+
+	if (w < b->bm_words) {
+		cleared += hweight_long(*bm);
+		*bm = 0;
+	}
+	bm_unmap(p_addr);
+	return cleared;
+}
+
+STATIC void bm_set_surplus(struct drbd_bitmap *b)
+{
+	const unsigned long mask = (1UL << (b->bm_bits & (BITS_PER_LONG-1))) - 1;
+	size_t w = b->bm_bits >> LN2_BPL;
+	unsigned long *p_addr, *bm;
+
+	p_addr = bm_map_paddr(b, w);
+	bm = p_addr + MLPP(w);
+	if (w < b->bm_words) {
+		*bm |= ~mask;
+		bm++; w++;
+	}
+
+	if (w < b->bm_words) {
+		*bm = ~(0UL);
+	}
+	bm_unmap(p_addr);
+}
+
+STATIC unsigned long __bm_count_bits(struct drbd_bitmap *b, const int swap_endian)
+{
+	unsigned long *p_addr, *bm, offset = 0;
+	unsigned long bits = 0;
+	unsigned long i, do_now;
+
+	while (offset < b->bm_words) {
+		i = do_now = min_t(size_t, b->bm_words-offset, LWPP);
+		p_addr = bm_map_paddr(b, offset);
+		bm = p_addr + MLPP(offset);
+		while (i--) {
+#ifndef __LITTLE_ENDIAN
+			if (swap_endian)
+				*bm = lel_to_cpu(*bm);
+#endif
+			bits += hweight_long(*bm++);
+		}
+		bm_unmap(p_addr);
+		offset += do_now;
+	}
+
+	return bits;
+}
+
+static inline unsigned long bm_count_bits(struct drbd_bitmap *b)
+{
+	return __bm_count_bits(b, 0);
+}
+
+static inline unsigned long bm_count_bits_swap_endian(struct drbd_bitmap *b)
+{
+	return __bm_count_bits(b, 1);
+}
+
+void _drbd_bm_recount_bits(struct drbd_conf *mdev, char *file, int line)
+{
+	struct drbd_bitmap *b = mdev->bitmap;
+	unsigned long flags, bits;
+
+	ERR_IF(!b) return;
+
+	/* IMO this should be inside drbd_bm_lock/unlock.
+	 * Unfortunately it is used outside of the locks.
+	 * And I'm not yet sure where we need to place the
+	 * lock/unlock correctly.
+	 */
+
+	spin_lock_irqsave(&b->bm_lock, flags);
+	bits = bm_count_bits(b);
+	if (bits != b->bm_set) {
+		ERR("bm_set was %lu, corrected to %lu. %s:%d\n",
+		    b->bm_set, bits, file, line);
+		b->bm_set = bits;
+	}
+	spin_unlock_irqrestore(&b->bm_lock, flags);
+}
+
+/* offset and len in long words.*/
+STATIC void bm_memset(struct drbd_bitmap *b, size_t offset, int c, size_t len)
+{
+	unsigned long *p_addr, *bm;
+	size_t do_now, end;
+
+#define BM_SECTORS_PER_BIT (BM_BLOCK_SIZE/512)
+
+	end = offset + len;
+
+	if (end > b->bm_words) {
+		printk(KERN_ALERT "drbd: bm_memset end > bm_words\n");
+		return;
+	}
+
+	while (offset < end) {
+		do_now = min_t(size_t, ALIGN(offset + 1, LWPP), end) - offset;
+		p_addr = bm_map_paddr(b, offset);
+		bm = p_addr + MLPP(offset);
+		if (bm+do_now > p_addr + LWPP) {
+			printk(KERN_ALERT "drbd: BUG BUG BUG! p_addr:%p bm:%p do_now:%d\n",
+			       p_addr, bm, (int)do_now);
+			break; /* breaks to after catch_oob_access_end() only! */
+		}
+		memset(bm, c, do_now * sizeof(long));
+		bm_unmap(p_addr);
+		offset += do_now;
+	}
+}
+
+/*
+ * make sure the bitmap has enough room for the attached storage,
+ * if neccessary, resize.
+ * called whenever we may have changed the device size.
+ * returns -ENOMEM if we could not allocate enough memory, 0 on success.
+ * In case this is actually a resize, we copy the old bitmap into the new one.
+ * Otherwise, the bitmap is initiallized to all bits set.
+ */
+int drbd_bm_resize(struct drbd_conf *mdev, sector_t capacity)
+{
+	struct drbd_bitmap *b = mdev->bitmap;
+	unsigned long bits, words, owords, obits, *p_addr, *bm;
+	unsigned long want, have, onpages; /* number of pages */
+	struct page **npages, **opages = NULL;
+	int err = 0, growing;
+
+	ERR_IF(!b) return -ENOMEM;
+
+	drbd_bm_lock(mdev, "resize");
+
+	INFO("drbd_bm_resize called with capacity == %llu\n",
+			(unsigned long long)capacity);
+
+	if (capacity == b->bm_dev_capacity)
+		goto out;
+
+	if (capacity == 0) {
+		spin_lock_irq(&b->bm_lock);
+		opages = b->bm_pages;
+		onpages = b->bm_number_of_pages;
+		owords = b->bm_words;
+		b->bm_pages = NULL;
+		b->bm_number_of_pages =
+		b->bm_set   =
+		b->bm_bits  =
+		b->bm_words =
+		b->bm_dev_capacity = 0;
+		spin_unlock_irq(&b->bm_lock);
+		bm_free_pages(opages, onpages);
+		vfree(opages);
+		goto out;
+	}
+	bits  = BM_SECT_TO_BIT(ALIGN(capacity, BM_SECT_PER_BIT));
+
+	/* if we would use
+	   words = ALIGN(bits,BITS_PER_LONG) >> LN2_BPL;
+	   a 32bit host could present the wrong number of words
+	   to a 64bit host.
+	*/
+	words = ALIGN(bits, 64) >> LN2_BPL;
+
+	if (inc_local(mdev)) {
+		D_ASSERT((u64)bits <= (((u64)mdev->bc->md.md_size_sect-MD_BM_OFFSET) << 12));
+		dec_local(mdev);
+	}
+
+	/* one extra long to catch off by one errors */
+	want = ALIGN((words+1)*sizeof(long), PAGE_SIZE) >> PAGE_SHIFT;
+	have = b->bm_number_of_pages;
+	if (want == have) {
+		D_ASSERT(b->bm_pages != NULL);
+		npages = b->bm_pages;
+	} else {
+		if (FAULT_ACTIVE(mdev, DRBD_FAULT_BM_ALLOC))
+			npages = NULL;
+		else
+			npages = bm_realloc_pages(b->bm_pages, have, want);
+	}
+
+	if (!npages) {
+		err = -ENOMEM;
+		goto out;
+	}
+
+	spin_lock_irq(&b->bm_lock);
+	opages = b->bm_pages;
+	owords = b->bm_words;
+	obits  = b->bm_bits;
+
+	growing = bits > obits;
+	if (opages)
+		bm_set_surplus(b);
+
+	b->bm_pages = npages;
+	b->bm_number_of_pages = want;
+	b->bm_bits  = bits;
+	b->bm_words = words;
+	b->bm_dev_capacity = capacity;
+
+	if (growing) {
+		bm_memset(b, owords, 0xff, words-owords);
+		b->bm_set += bits - obits;
+	}
+
+	if (want < have) {
+		/* implicit: (opages != NULL) && (opages != npages) */
+		bm_free_pages(opages + want, have - want);
+	}
+
+	p_addr = bm_map_paddr(b, words);
+	bm = p_addr + MLPP(words);
+	*bm = DRBD_MAGIC;
+	bm_unmap(p_addr);
+
+	(void)bm_clear_surplus(b);
+	if (!growing)
+		b->bm_set = bm_count_bits(b);
+
+	spin_unlock_irq(&b->bm_lock);
+	if (opages != npages)
+		vfree(opages);
+	INFO("resync bitmap: bits=%lu words=%lu\n", bits, words);
+
+ out:
+	drbd_bm_unlock(mdev);
+	return err;
+}
+
+/* inherently racy:
+ * if not protected by other means, return value may be out of date when
+ * leaving this function...
+ * we still need to lock it, since it is important that this returns
+ * bm_set == 0 precisely.
+ *
+ * maybe bm_set should be atomic_t ?
+ */
+unsigned long drbd_bm_total_weight(struct drbd_conf *mdev)
+{
+	struct drbd_bitmap *b = mdev->bitmap;
+	unsigned long s;
+	unsigned long flags;
+
+	/* if I don't have a disk, I don't know about out-of-sync status */
+	if (!inc_local_if_state(mdev, Negotiating))
+		return 0;
+
+	ERR_IF(!b) return 0;
+	ERR_IF(!b->bm_pages) return 0;
+
+	spin_lock_irqsave(&b->bm_lock, flags);
+	s = b->bm_set;
+	spin_unlock_irqrestore(&b->bm_lock, flags);
+
+	dec_local(mdev);
+
+	return s;
+}
+
+size_t drbd_bm_words(struct drbd_conf *mdev)
+{
+	struct drbd_bitmap *b = mdev->bitmap;
+	ERR_IF(!b) return 0;
+	ERR_IF(!b->bm_pages) return 0;
+
+	return b->bm_words;
+}
+
+unsigned long drbd_bm_bits(struct drbd_conf *mdev)
+{
+	struct drbd_bitmap *b = mdev->bitmap;
+	ERR_IF(!b) return 0;
+
+	return b->bm_bits;
+}
+
+/* merge number words from buffer into the bitmap starting at offset.
+ * buffer[i] is expected to be little endian unsigned long.
+ * bitmap must be locked by drbd_bm_lock.
+ * currently only used from receive_bitmap.
+ */
+void drbd_bm_merge_lel(struct drbd_conf *mdev, size_t offset, size_t number,
+			unsigned long *buffer)
+{
+	struct drbd_bitmap *b = mdev->bitmap;
+	unsigned long *p_addr, *bm;
+	unsigned long word, bits;
+	size_t end, do_now;
+
+	end = offset + number;
+
+	ERR_IF(!b) return;
+	ERR_IF(!b->bm_pages) return;
+	if (number == 0)
+		return;
+	WARN_ON(offset >= b->bm_words);
+	WARN_ON(end    >  b->bm_words);
+
+	spin_lock_irq(&b->bm_lock);
+	while (offset < end) {
+		do_now = min_t(size_t, ALIGN(offset+1, LWPP), end) - offset;
+		p_addr = bm_map_paddr(b, offset);
+		bm = p_addr + MLPP(offset);
+		offset += do_now;
+		while (do_now--) {
+			bits = hweight_long(*bm);
+			word = *bm | lel_to_cpu(*buffer++);
+			*bm++ = word;
+			b->bm_set += hweight_long(word) - bits;
+		}
+		bm_unmap(p_addr);
+	}
+	/* with 32bit <-> 64bit cross-platform connect
+	 * this is only correct for current usage,
+	 * where we _know_ that we are 64 bit aligned,
+	 * and know that this function is used in this way, too...
+	 */
+	if (end == b->bm_words)
+		b->bm_set -= bm_clear_surplus(b);
+
+	spin_unlock_irq(&b->bm_lock);
+}
+
+/* copy number words from the bitmap starting at offset into the buffer.
+ * buffer[i] will be little endian unsigned long.
+ */
+void drbd_bm_get_lel(struct drbd_conf *mdev, size_t offset, size_t number,
+		     unsigned long *buffer)
+{
+	struct drbd_bitmap *b = mdev->bitmap;
+	unsigned long *p_addr, *bm;
+	size_t end, do_now;
+
+	end = offset + number;
+
+	ERR_IF(!b) return;
+	ERR_IF(!b->bm_pages) return;
+
+	spin_lock_irq(&b->bm_lock);
+	if ((offset >= b->bm_words) ||
+	    (end    >  b->bm_words) ||
+	    (number <= 0))
+		ERR("offset=%lu number=%lu bm_words=%lu\n",
+			(unsigned long)	offset,
+			(unsigned long)	number,
+			(unsigned long) b->bm_words);
+	else {
+		while (offset < end) {
+			do_now = min_t(size_t, ALIGN(offset+1, LWPP), end) - offset;
+			p_addr = bm_map_paddr(b, offset);
+			bm = p_addr + MLPP(offset);
+			offset += do_now;
+			while (do_now--)
+				*buffer++ = cpu_to_lel(*bm++);
+			bm_unmap(p_addr);
+		}
+	}
+	spin_unlock_irq(&b->bm_lock);
+}
+
+/* set all bits in the bitmap */
+void drbd_bm_set_all(struct drbd_conf *mdev)
+{
+	struct drbd_bitmap *b = mdev->bitmap;
+	ERR_IF(!b) return;
+	ERR_IF(!b->bm_pages) return;
+
+	spin_lock_irq(&b->bm_lock);
+	bm_memset(b, 0, 0xff, b->bm_words);
+	(void)bm_clear_surplus(b);
+	b->bm_set = b->bm_bits;
+	spin_unlock_irq(&b->bm_lock);
+}
+
+/* clear all bits in the bitmap */
+void drbd_bm_clear_all(struct drbd_conf *mdev)
+{
+	struct drbd_bitmap *b = mdev->bitmap;
+	ERR_IF(!b) return;
+	ERR_IF(!b->bm_pages) return;
+
+	spin_lock_irq(&b->bm_lock);
+	bm_memset(b, 0, 0, b->bm_words);
+	b->bm_set = 0;
+	spin_unlock_irq(&b->bm_lock);
+}
+
+static void bm_async_io_complete(struct bio *bio, int error)
+{
+	struct drbd_bitmap *b = bio->bi_private;
+	int uptodate = bio_flagged(bio, BIO_UPTODATE);
+
+
+	/* strange behaviour of some lower level drivers...
+	 * fail the request by clearing the uptodate flag,
+	 * but do not return any error?!
+	 * do we want to WARN() on this? */
+	if (!error && !uptodate)
+		error = -EIO;
+
+	if (error) {
+		/* doh. what now?
+		 * for now, set all bits, and flag MD_IO_ERROR */
+		__set_bit(BM_MD_IO_ERROR, &b->bm_flags);
+	}
+	if (atomic_dec_and_test(&b->bm_async_io))
+		wake_up(&b->bm_io_wait);
+
+	bio_put(bio);
+}
+
+STATIC void bm_page_io_async(struct drbd_conf *mdev, struct drbd_bitmap *b, int page_nr, int rw) __must_hold(local)
+{
+	/* we are process context. we always get a bio */
+	struct bio *bio = bio_alloc(GFP_KERNEL, 1);
+	unsigned int len;
+	sector_t on_disk_sector =
+		mdev->bc->md.md_offset + mdev->bc->md.bm_offset;
+	on_disk_sector += ((sector_t)page_nr) << (PAGE_SHIFT-9);
+
+	/* this might happen with very small
+	 * flexible external meta data device */
+	len = min_t(unsigned int, PAGE_SIZE,
+		(drbd_md_last_sector(mdev->bc) - on_disk_sector + 1)<<9);
+
+	bio->bi_bdev = mdev->bc->md_bdev;
+	bio->bi_sector = on_disk_sector;
+	bio_add_page(bio, b->bm_pages[page_nr], len, 0);
+	bio->bi_private = b;
+	bio->bi_end_io = bm_async_io_complete;
+
+	if (FAULT_ACTIVE(mdev, (rw & WRITE) ? DRBD_FAULT_MD_WR : DRBD_FAULT_MD_RD)) {
+		bio->bi_rw |= rw;
+		bio_endio(bio, -EIO);
+	} else {
+		submit_bio(rw, bio);
+	}
+}
+
+# if defined(__LITTLE_ENDIAN)
+	/* nothing to do, on disk == in memory */
+# define bm_cpu_to_lel(x) ((void)0)
+# else
+void bm_cpu_to_lel(struct drbd_bitmap *b)
+{
+	/* need to cpu_to_lel all the pages ...
+	 * this may be optimized by using
+	 * cpu_to_lel(-1) == -1 and cpu_to_lel(0) == 0;
+	 * the following is still not optimal, but better than nothing */
+	if (b->bm_set == 0) {
+		/* no page at all; avoid swap if all is 0 */
+		i = b->bm_number_of_pages;
+	} else if (b->bm_set == b->bm_bits) {
+		/* only the last page */
+		i = b->bm_number_of_pages - 1;
+	} else {
+		/* all pages */
+		i = 0;
+	}
+	for (; i < b->bm_number_of_pages; i++) {
+		unsigned long *bm;
+		/* if you'd want to use kmap_atomic, you'd have to disable irq! */
+		p_addr = kmap(b->bm_pages[i]);
+		for (bm = p_addr; bm < p_addr + PAGE_SIZE/sizeof(long); bm++)
+			*bm = cpu_to_lel(*bm);
+		kunmap(p_addr);
+	}
+}
+# endif
+/* lel_to_cpu == cpu_to_lel */
+# define bm_lel_to_cpu(x) bm_cpu_to_lel(x)
+
+/*
+ * bm_rw: read/write the whole bitmap from/to its on disk location.
+ */
+STATIC int bm_rw(struct drbd_conf *mdev, int rw) __must_hold(local)
+{
+	struct drbd_bitmap *b = mdev->bitmap;
+	/* sector_t sector; */
+	int bm_words, num_pages, i;
+	unsigned long now;
+	char ppb[10];
+	int err = 0;
+
+	WARN_ON(!bm_is_locked(b));
+
+	/* no spinlock here, the drbd_bm_lock should be enough! */
+
+	bm_words  = drbd_bm_words(mdev);
+	num_pages = (bm_words*sizeof(long) + PAGE_SIZE-1) >> PAGE_SHIFT;
+
+	/* on disk bitmap is little endian */
+	if (rw == WRITE)
+		bm_cpu_to_lel(b);
+
+	now = jiffies;
+	atomic_set(&b->bm_async_io, num_pages);
+	__clear_bit(BM_MD_IO_ERROR, &b->bm_flags);
+
+	/* let the layers below us try to merge these bios... */
+	for (i = 0; i < num_pages; i++)
+		bm_page_io_async(mdev, b, i, rw);
+
+	drbd_blk_run_queue(bdev_get_queue(mdev->bc->md_bdev));
+	wait_event(b->bm_io_wait, atomic_read(&b->bm_async_io) == 0);
+
+	MTRACE(TraceTypeMDIO, TraceLvlSummary,
+	       INFO("%s of bitmap took %lu jiffies\n",
+		    rw == READ ? "reading" : "writing", jiffies - now);
+	       );
+
+	if (test_bit(BM_MD_IO_ERROR, &b->bm_flags)) {
+		ALERT("we had at least one MD IO ERROR during bitmap IO\n");
+		drbd_chk_io_error(mdev, 1, TRUE);
+		drbd_io_error(mdev, TRUE);
+		err = -EIO;
+	}
+
+	now = jiffies;
+	if (rw == WRITE) {
+		/* swap back endianness */
+		bm_lel_to_cpu(b);
+		/* flush bitmap to stable storage */
+		drbd_md_flush(mdev);
+	} else /* rw == READ */ {
+		/* just read, if neccessary adjust endianness */
+		b->bm_set = bm_count_bits_swap_endian(b);
+		INFO("recounting of set bits took additional %lu jiffies\n",
+		     jiffies - now);
+	}
+	now = b->bm_set;
+
+	INFO("%s (%lu bits) marked out-of-sync by on disk bit-map.\n",
+	     ppsize(ppb, now << (BM_BLOCK_SIZE_B-10)), now);
+
+	return err;
+}
+
+/**
+ * drbd_bm_read: Read the whole bitmap from its on disk location.
+ *
+ * currently only called from "drbd_nl_disk_conf"
+ */
+int drbd_bm_read(struct drbd_conf *mdev) __must_hold(local)
+{
+	return bm_rw(mdev, READ);
+}
+
+/**
+ * drbd_bm_write: Write the whole bitmap to its on disk location.
+ *
+ * called at various occasions.
+ */
+int drbd_bm_write(struct drbd_conf *mdev) __must_hold(local)
+{
+	return bm_rw(mdev, WRITE);
+}
+
+/**
+ * drbd_bm_write_sect: Writes a 512 byte piece of the bitmap to its
+ * on disk location. On disk bitmap is little endian.
+ *
+ * @enr: The _sector_ offset from the start of the bitmap.
+ *
+ */
+int drbd_bm_write_sect(struct drbd_conf *mdev, unsigned long enr) __must_hold(local)
+{
+	sector_t on_disk_sector = enr + mdev->bc->md.md_offset
+				      + mdev->bc->md.bm_offset;
+	int bm_words, num_words, offset;
+	int err = 0;
+
+	mutex_lock(&mdev->md_io_mutex);
+	bm_words  = drbd_bm_words(mdev);
+	offset    = S2W(enr);	/* word offset into bitmap */
+	num_words = min(S2W(1), bm_words - offset);
+	if (num_words < S2W(1))
+		memset(page_address(mdev->md_io_page), 0, MD_HARDSECT);
+	drbd_bm_get_lel(mdev, offset, num_words,
+			page_address(mdev->md_io_page));
+	if (!drbd_md_sync_page_io(mdev, mdev->bc, on_disk_sector, WRITE)) {
+		int i;
+		err = -EIO;
+		ERR("IO ERROR writing bitmap sector %lu "
+		    "(meta-disk sector %llus)\n",
+		    enr, (unsigned long long)on_disk_sector);
+		drbd_chk_io_error(mdev, 1, TRUE);
+		drbd_io_error(mdev, TRUE);
+		for (i = 0; i < AL_EXT_PER_BM_SECT; i++)
+			drbd_bm_ALe_set_all(mdev, enr*AL_EXT_PER_BM_SECT+i);
+	}
+	mdev->bm_writ_cnt++;
+	mutex_unlock(&mdev->md_io_mutex);
+	return err;
+}
+
+/* NOTE
+ * find_first_bit returns int, we return unsigned long.
+ * should not make much difference anyways, but ...
+ *
+ * this returns a bit number, NOT a sector!
+ */
+#define BPP_MASK ((1UL << (PAGE_SHIFT+3)) - 1)
+static unsigned long __bm_find_next(struct drbd_conf *mdev, unsigned long bm_fo,
+	const int find_zero_bit, const enum km_type km)
+{
+	struct drbd_bitmap *b = mdev->bitmap;
+	unsigned long i = -1UL;
+	unsigned long *p_addr;
+	unsigned long bit_offset; /* bit offset of the mapped page. */
+
+	if (bm_fo > b->bm_bits) {
+		ERR("bm_fo=%lu bm_bits=%lu\n", bm_fo, b->bm_bits);
+	} else {
+		while (bm_fo < b->bm_bits) {
+			unsigned long offset;
+			bit_offset = bm_fo & ~BPP_MASK; /* bit offset of the page */
+			offset = bit_offset >> LN2_BPL;    /* word offset of the page */
+			p_addr = __bm_map_paddr(b, offset, km);
+
+			if (find_zero_bit)
+				i = find_next_zero_bit(p_addr, PAGE_SIZE*8, bm_fo & BPP_MASK);
+			else
+				i = find_next_bit(p_addr, PAGE_SIZE*8, bm_fo & BPP_MASK);
+
+			__bm_unmap(p_addr, km);
+			if (i < PAGE_SIZE*8) {
+				i = bit_offset + i;
+				if (i >= b->bm_bits)
+					break;
+				goto found;
+			}
+			bm_fo = bit_offset + PAGE_SIZE*8;
+		}
+		i = -1UL;
+	}
+ found:
+	return i;
+}
+
+static unsigned long bm_find_next(struct drbd_conf *mdev,
+	unsigned long bm_fo, const int find_zero_bit)
+{
+	struct drbd_bitmap *b = mdev->bitmap;
+	unsigned long i = -1UL;
+
+	ERR_IF(!b) return i;
+	ERR_IF(!b->bm_pages) return i;
+
+	spin_lock_irq(&b->bm_lock);
+	if (bm_is_locked(b))
+		bm_print_lock_info(mdev);
+
+	i = __bm_find_next(mdev, bm_fo, find_zero_bit, KM_IRQ1);
+
+	spin_unlock_irq(&b->bm_lock);
+	return i;
+}
+
+unsigned long drbd_bm_find_next(struct drbd_conf *mdev, unsigned long bm_fo)
+{
+	return bm_find_next(mdev, bm_fo, 0);
+}
+
+#if 0
+/* not yet needed for anything. */
+unsigned long drbd_bm_find_next_zero(struct drbd_conf *mdev, unsigned long bm_fo)
+{
+	return bm_find_next(mdev, bm_fo, 1);
+}
+#endif
+
+/* does not spin_lock_irqsave.
+ * you must take drbd_bm_lock() first */
+unsigned long _drbd_bm_find_next(struct drbd_conf *mdev, unsigned long bm_fo)
+{
+	/* WARN_ON(!bm_is_locked(mdev)); */
+	return __bm_find_next(mdev, bm_fo, 0, KM_USER1);
+}
+
+unsigned long _drbd_bm_find_next_zero(struct drbd_conf *mdev, unsigned long bm_fo)
+{
+	/* WARN_ON(!bm_is_locked(mdev)); */
+	return __bm_find_next(mdev, bm_fo, 1, KM_USER1);
+}
+
+/* returns number of bits actually changed.
+ * for val != 0, we change 0 -> 1, return code positiv
+ * for val == 0, we change 1 -> 0, return code negative
+ * wants bitnr, not sector.
+ * Must hold bitmap lock already. */
+
+int __bm_change_bits_to(struct drbd_conf *mdev, const unsigned long s,
+	const unsigned long e, int val, const enum km_type km)
+{
+	struct drbd_bitmap *b = mdev->bitmap;
+	unsigned long *p_addr = NULL;
+	unsigned long bitnr;
+	unsigned long last_page_nr = -1UL;
+	int c = 0;
+
+	for (bitnr = s; bitnr <= e; bitnr++) {
+		ERR_IF (bitnr >= b->bm_bits) {
+			ERR("bitnr=%lu bm_bits=%lu\n", bitnr, b->bm_bits);
+		} else {
+			unsigned long offset = bitnr>>LN2_BPL;
+			unsigned long page_nr = offset >> (PAGE_SHIFT - LN2_BPL + 3);
+			if (page_nr != last_page_nr) {
+				if (p_addr)
+					__bm_unmap(p_addr, km);
+				p_addr = __bm_map_paddr(b, offset, km);
+				last_page_nr = page_nr;
+			}
+			if (val)
+				c += (0 == __test_and_set_bit(bitnr & BPP_MASK, p_addr));
+			else
+				c -= (0 != __test_and_clear_bit(bitnr & BPP_MASK, p_addr));
+		}
+	}
+	if (p_addr)
+		__bm_unmap(p_addr, km);
+	b->bm_set += c;
+	return c;
+}
+
+/* returns number of bits actually changed.
+ * for val != 0, we change 0 -> 1, return code positiv
+ * for val == 0, we change 1 -> 0, return code negative
+ * wants bitnr, not sector */
+int bm_change_bits_to(struct drbd_conf *mdev, const unsigned long s,
+	const unsigned long e, int val)
+{
+	unsigned long flags;
+	struct drbd_bitmap *b = mdev->bitmap;
+	int c = 0;
+
+	ERR_IF(!b) return 1;
+	ERR_IF(!b->bm_pages) return 0;
+
+	spin_lock_irqsave(&b->bm_lock, flags);
+	if (bm_is_locked(b))
+		bm_print_lock_info(mdev);
+
+	c = __bm_change_bits_to(mdev, s, e, val, KM_IRQ1);
+
+	spin_unlock_irqrestore(&b->bm_lock, flags);
+	return c;
+}
+
+/* returns number of bits changed 0 -> 1 */
+int drbd_bm_set_bits(struct drbd_conf *mdev, const unsigned long s, const unsigned long e)
+{
+	return bm_change_bits_to(mdev, s, e, 1);
+}
+
+/* returns number of bits changed 1 -> 0 */
+int drbd_bm_clear_bits(struct drbd_conf *mdev, const unsigned long s, const unsigned long e)
+{
+	return -bm_change_bits_to(mdev, s, e, 0);
+}
+
+/* the same thing, but without taking the spin_lock_irqsave.
+ * you must first drbd_bm_lock(). */
+int _drbd_bm_set_bits(struct drbd_conf *mdev, const unsigned long s, const unsigned long e)
+{
+       /* WARN_ON(!bm_is_locked(b)); */
+       return __bm_change_bits_to(mdev, s, e, 1, KM_USER0);
+}
+
+/* returns bit state
+ * wants bitnr, NOT sector.
+ * inherently racy... area needs to be locked by means of {al,rs}_lru
+ *  1 ... bit set
+ *  0 ... bit not set
+ * -1 ... first out of bounds access, stop testing for bits!
+ */
+int drbd_bm_test_bit(struct drbd_conf *mdev, const unsigned long bitnr)
+{
+	unsigned long flags;
+	struct drbd_bitmap *b = mdev->bitmap;
+	unsigned long *p_addr;
+	int i;
+
+	ERR_IF(!b) return 0;
+	ERR_IF(!b->bm_pages) return 0;
+
+	spin_lock_irqsave(&b->bm_lock, flags);
+	if (bm_is_locked(b))
+		bm_print_lock_info(mdev);
+	if (bitnr < b->bm_bits) {
+		unsigned long offset = bitnr>>LN2_BPL;
+		p_addr = bm_map_paddr(b, offset);
+		i = test_bit(bitnr & BPP_MASK, p_addr) ? 1 : 0;
+		bm_unmap(p_addr);
+	} else if (bitnr == b->bm_bits) {
+		i = -1;
+	} else { /* (bitnr > b->bm_bits) */
+		ERR("bitnr=%lu > bm_bits=%lu\n", bitnr, b->bm_bits);
+		i = 0;
+	}
+
+	spin_unlock_irqrestore(&b->bm_lock, flags);
+	return i;
+}
+
+/* returns number of bits set */
+int drbd_bm_count_bits(struct drbd_conf *mdev, const unsigned long s, const unsigned long e)
+{
+	unsigned long flags;
+	struct drbd_bitmap *b = mdev->bitmap;
+	unsigned long *p_addr = NULL, page_nr = -1;
+	unsigned long bitnr;
+	int c = 0;
+	size_t w;
+
+	/* If this is called without a bitmap, that is a bug.  But just to be
+	 * robust in case we screwed up elsewhere, in that case pretend there
+	 * was one dirty bit in the requested area, so we won't try to do a
+	 * local read there (no bitmap probably implies no disk) */
+	ERR_IF(!b) return 1;
+	ERR_IF(!b->bm_pages) return 1;
+
+	spin_lock_irqsave(&b->bm_lock, flags);
+	for (bitnr = s; bitnr <= e; bitnr++) {
+		w = bitnr >> LN2_BPL;
+		if (page_nr != w >> (PAGE_SHIFT - LN2_BPL + 3)) {
+			page_nr = w >> (PAGE_SHIFT - LN2_BPL + 3);
+			if (p_addr)
+				bm_unmap(p_addr);
+			p_addr = bm_map_paddr(b, w);
+		}
+		ERR_IF (bitnr >= b->bm_bits) {
+			ERR("bitnr=%lu bm_bits=%lu\n", bitnr, b->bm_bits);
+		} else {
+			c += (0 != test_bit(bitnr - (page_nr << (PAGE_SHIFT+3)), p_addr));
+		}
+	}
+	if (p_addr)
+		bm_unmap(p_addr);
+	spin_unlock_irqrestore(&b->bm_lock, flags);
+	return c;
+}
+
+
+/* inherently racy...
+ * return value may be already out-of-date when this function returns.
+ * but the general usage is that this is only use during a cstate when bits are
+ * only cleared, not set, and typically only care for the case when the return
+ * value is zero, or we already "locked" this "bitmap extent" by other means.
+ *
+ * enr is bm-extent number, since we chose to name one sector (512 bytes)
+ * worth of the bitmap a "bitmap extent".
+ *
+ * TODO
+ * I think since we use it like a reference count, we should use the real
+ * reference count of some bitmap extent element from some lru instead...
+ *
+ */
+int drbd_bm_e_weight(struct drbd_conf *mdev, unsigned long enr)
+{
+	struct drbd_bitmap *b = mdev->bitmap;
+	int count, s, e;
+	unsigned long flags;
+	unsigned long *p_addr, *bm;
+
+	ERR_IF(!b) return 0;
+	ERR_IF(!b->bm_pages) return 0;
+
+	spin_lock_irqsave(&b->bm_lock, flags);
+	if (bm_is_locked(b))
+		bm_print_lock_info(mdev);
+
+	s = S2W(enr);
+	e = min((size_t)S2W(enr+1), b->bm_words);
+	count = 0;
+	if (s < b->bm_words) {
+		int n = e-s;
+		p_addr = bm_map_paddr(b, s);
+		bm = p_addr + MLPP(s);
+		while (n--)
+			count += hweight_long(*bm++);
+		bm_unmap(p_addr);
+	} else {
+		ERR("start offset (%d) too large in drbd_bm_e_weight\n", s);
+	}
+	spin_unlock_irqrestore(&b->bm_lock, flags);
+	return count;
+}
+
+/* set all bits covered by the AL-extent al_enr */
+unsigned long drbd_bm_ALe_set_all(struct drbd_conf *mdev, unsigned long al_enr)
+{
+	struct drbd_bitmap *b = mdev->bitmap;
+	unsigned long *p_addr, *bm;
+	unsigned long weight;
+	int count, s, e, i, do_now;
+	ERR_IF(!b) return 0;
+	ERR_IF(!b->bm_pages) return 0;
+
+	spin_lock_irq(&b->bm_lock);
+	if (bm_is_locked(b))
+		bm_print_lock_info(mdev);
+	weight = b->bm_set;
+
+	s = al_enr * BM_WORDS_PER_AL_EXT;
+	e = min_t(size_t, s + BM_WORDS_PER_AL_EXT, b->bm_words);
+	/* assert that s and e are on the same page */
+	D_ASSERT((e-1) >> (PAGE_SHIFT - LN2_BPL + 3)
+	      ==  s    >> (PAGE_SHIFT - LN2_BPL + 3));
+	count = 0;
+	if (s < b->bm_words) {
+		i = do_now = e-s;
+		p_addr = bm_map_paddr(b, s);
+		bm = p_addr + MLPP(s);
+		while (i--) {
+			count += hweight_long(*bm);
+			*bm = -1UL;
+			bm++;
+		}
+		bm_unmap(p_addr);
+		b->bm_set += do_now*BITS_PER_LONG - count;
+		if (e == b->bm_words)
+			b->bm_set -= bm_clear_surplus(b);
+	} else {
+		ERR("start offset (%d) too large in drbd_bm_ALe_set_all\n", s);
+	}
+	weight = b->bm_set - weight;
+	spin_unlock_irq(&b->bm_lock);
+	return weight;
+}
--- linux-rt-2.6.31.orig/ubuntu/drbd/drbd_proc.c
+++ linux-rt-2.6.31/ubuntu/drbd/drbd_proc.c
@@ -0,0 +1,271 @@
+/*
+   drbd_proc.c
+
+   This file is part of DRBD by Philipp Reisner and Lars Ellenberg.
+
+   Copyright (C) 2001-2008, LINBIT Information Technologies GmbH.
+   Copyright (C) 1999-2008, Philipp Reisner <philipp.reisner@linbit.com>.
+   Copyright (C) 2002-2008, Lars Ellenberg <lars.ellenberg@linbit.com>.
+
+   drbd is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 2, or (at your option)
+   any later version.
+
+   drbd is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with drbd; see the file COPYING.  If not, write to
+   the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
+
+ */
+
+#include <linux/autoconf.h>
+#include <linux/module.h>
+
+#include <asm/uaccess.h>
+#include <linux/fs.h>
+#include <linux/file.h>
+#include <linux/slab.h>
+#include <linux/proc_fs.h>
+#include <linux/seq_file.h>
+#include <linux/drbd.h>
+#include "drbd_int.h"
+#include "lru_cache.h" /* for lc_sprintf_stats */
+
+STATIC int drbd_proc_open(struct inode *inode, struct file *file);
+
+
+struct proc_dir_entry *drbd_proc;
+struct file_operations drbd_proc_fops = {
+	.owner		= THIS_MODULE,
+	.open		= drbd_proc_open,
+	.read		= seq_read,
+	.llseek		= seq_lseek,
+	.release	= single_release,
+};
+
+
+/*lge
+ * progress bars shamelessly adapted from driver/md/md.c
+ * output looks like
+ *	[=====>..............] 33.5% (23456/123456)
+ *	finish: 2:20:20 speed: 6,345 (6,456) K/sec
+ */
+STATIC void drbd_syncer_progress(struct drbd_conf *mdev, struct seq_file *seq)
+{
+	unsigned long db, dt, dbdt, rt, rs_left;
+	unsigned int res;
+	int i, x, y;
+
+	drbd_get_syncer_progress(mdev, &rs_left, &res);
+
+	x = res/50;
+	y = 20-x;
+	seq_printf(seq, "\t[");
+	for (i = 1; i < x; i++)
+		seq_printf(seq, "=");
+	seq_printf(seq, ">");
+	for (i = 0; i < y; i++)
+		seq_printf(seq, ".");
+	seq_printf(seq, "] ");
+
+	seq_printf(seq, "sync'ed:%3u.%u%% ", res / 10, res % 10);
+	/* if more than 1 GB display in MB */
+	if (mdev->rs_total > 0x100000L)
+		seq_printf(seq, "(%lu/%lu)M\n\t",
+			    (unsigned long) Bit2KB(rs_left >> 10),
+			    (unsigned long) Bit2KB(mdev->rs_total >> 10));
+	else
+		seq_printf(seq, "(%lu/%lu)K\n\t",
+			    (unsigned long) Bit2KB(rs_left),
+			    (unsigned long) Bit2KB(mdev->rs_total));
+
+	/* see drivers/md/md.c
+	 * We do not want to overflow, so the order of operands and
+	 * the * 100 / 100 trick are important. We do a +1 to be
+	 * safe against division by zero. We only estimate anyway.
+	 *
+	 * dt: time from mark until now
+	 * db: blocks written from mark until now
+	 * rt: remaining time
+	 */
+	dt = (jiffies - mdev->rs_mark_time) / HZ;
+
+	if (dt > 20) {
+		/* if we made no update to rs_mark_time for too long,
+		 * we are stalled. show that. */
+		seq_printf(seq, "stalled\n");
+		return;
+	}
+
+	if (!dt)
+		dt++;
+	db = mdev->rs_mark_left - rs_left;
+	rt = (dt * (rs_left / (db/100+1)))/100; /* seconds */
+
+	seq_printf(seq, "finish: %lu:%02lu:%02lu",
+		rt / 3600, (rt % 3600) / 60, rt % 60);
+
+	/* current speed average over (SYNC_MARKS * SYNC_MARK_STEP) jiffies */
+	dbdt = Bit2KB(db/dt);
+	if (dbdt > 1000)
+		seq_printf(seq, " speed: %ld,%03ld",
+			dbdt/1000, dbdt % 1000);
+	else
+		seq_printf(seq, " speed: %ld", dbdt);
+
+	/* mean speed since syncer started
+	 * we do account for PausedSync periods */
+	dt = (jiffies - mdev->rs_start - mdev->rs_paused) / HZ;
+	if (dt <= 0)
+		dt = 1;
+	db = mdev->rs_total - rs_left;
+	dbdt = Bit2KB(db/dt);
+	if (dbdt > 1000)
+		seq_printf(seq, " (%ld,%03ld)",
+			dbdt/1000, dbdt % 1000);
+	else
+		seq_printf(seq, " (%ld)", dbdt);
+
+	seq_printf(seq, " K/sec\n");
+}
+
+#ifdef ENABLE_DYNAMIC_TRACE
+STATIC void resync_dump_detail(struct seq_file *seq, struct lc_element *e)
+{
+	struct bm_extent *bme = (struct bm_extent *)e;
+
+	seq_printf(seq, "%5d %s %s\n", bme->rs_left,
+		   bme->flags & BME_NO_WRITES ? "NO_WRITES" : "---------",
+		   bme->flags & BME_LOCKED ? "LOCKED" : "------"
+		   );
+}
+#endif
+
+STATIC int drbd_seq_show(struct seq_file *seq, void *v)
+{
+	int i, hole = 0;
+	const char *sn;
+	struct drbd_conf *mdev;
+
+	static char write_ordering_chars[] = {
+		[WO_none] = 'n',
+		[WO_drain_io] = 'd',
+		[WO_bdev_flush] = 'f',
+		[WO_bio_barrier] = 'b',
+	};
+
+	seq_printf(seq, "version: " REL_VERSION " (api:%d/proto:%d-%d)\n%s\n",
+		   API_VERSION, PRO_VERSION_MIN, PRO_VERSION_MAX, drbd_buildtag());
+
+	/*
+	  cs .. connection state
+	  ro .. node role (local/remote)
+	  ds .. disk state (local/remote)
+	     protocol
+	     various flags
+	  ns .. network send
+	  nr .. network receive
+	  dw .. disk write
+	  dr .. disk read
+	  al .. activity log write count
+	  bm .. bitmap update write count
+	  pe .. pending (waiting for ack or data reply)
+	  ua .. unack'd (still need to send ack or data reply)
+	  ap .. application requests accepted, but not yet completed
+	  ep .. number of epochs currently "on the fly", BarrierAck pending
+	  wo .. write ordering mode currently in use
+	 oos .. known out-of-sync kB
+	*/
+
+	for (i = 0; i < minor_count; i++) {
+		mdev = minor_to_mdev(i);
+		if (!mdev) {
+			hole = 1;
+			continue;
+		}
+		if (hole) {
+			hole = 0;
+			seq_printf(seq, "\n");
+		}
+
+		sn = conns_to_name(mdev->state.conn);
+
+		if (mdev->state.conn == StandAlone &&
+		    mdev->state.disk == Diskless &&
+		    mdev->state.role == Secondary) {
+			seq_printf(seq, "%2d: cs:Unconfigured\n", i);
+		} else {
+			seq_printf(seq,
+			   "%2d: cs:%s ro:%s/%s ds:%s/%s %c %c%c%c%c%c\n"
+			   "    ns:%u nr:%u dw:%u dr:%u al:%u bm:%u "
+			   "lo:%d pe:%d ua:%d ap:%d ep:%d wo:%c",
+			   i, sn,
+			   roles_to_name(mdev->state.role),
+			   roles_to_name(mdev->state.peer),
+			   disks_to_name(mdev->state.disk),
+			   disks_to_name(mdev->state.pdsk),
+			   (mdev->net_conf == NULL ? ' ' :
+			    (mdev->net_conf->wire_protocol - DRBD_PROT_A+'A')),
+			   mdev->state.susp ? 's' : 'r',
+			   mdev->state.aftr_isp ? 'a' : '-',
+			   mdev->state.peer_isp ? 'p' : '-',
+			   mdev->state.user_isp ? 'u' : '-',
+			   mdev->congestion_reason ?: '-',
+			   mdev->send_cnt/2,
+			   mdev->recv_cnt/2,
+			   mdev->writ_cnt/2,
+			   mdev->read_cnt/2,
+			   mdev->al_writ_cnt,
+			   mdev->bm_writ_cnt,
+			   atomic_read(&mdev->local_cnt),
+			   atomic_read(&mdev->ap_pending_cnt) +
+			   atomic_read(&mdev->rs_pending_cnt),
+			   atomic_read(&mdev->unacked_cnt),
+			   atomic_read(&mdev->ap_bio_cnt),
+			   mdev->epochs,
+			   write_ordering_chars[mdev->write_ordering]
+			);
+			seq_printf(seq, " oos:%lu\n",
+				   Bit2KB(drbd_bm_total_weight(mdev)));
+		}
+		if (mdev->state.conn == SyncSource ||
+		    mdev->state.conn == SyncTarget)
+			drbd_syncer_progress(mdev, seq);
+
+		if (mdev->state.conn == VerifyS || mdev->state.conn == VerifyT)
+			seq_printf(seq, "\t%3d%%      %lu/%lu\n",
+				   (int)((mdev->rs_total-mdev->ov_left) /
+					 (mdev->rs_total/100+1)),
+				   mdev->rs_total - mdev->ov_left,
+				   mdev->rs_total);
+
+#ifdef ENABLE_DYNAMIC_TRACE
+		if (proc_details >= 1 && inc_local_if_state(mdev, Failed)) {
+			lc_printf_stats(seq, mdev->resync);
+			lc_printf_stats(seq, mdev->act_log);
+			dec_local(mdev);
+		}
+
+		if (proc_details >= 2) {
+			if (mdev->resync) {
+				lc_dump(mdev->resync, seq, "rs_left",
+					resync_dump_detail);
+			}
+		}
+#endif
+	}
+
+	return 0;
+}
+
+STATIC int drbd_proc_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, drbd_seq_show, PDE(inode)->data);
+}
+
+/* PROC FS stuff end */
--- linux-rt-2.6.31.orig/ubuntu/drbd/drbd_actlog.c
+++ linux-rt-2.6.31/ubuntu/drbd/drbd_actlog.c
@@ -0,0 +1,1473 @@
+/*
+   drbd_actlog.c
+
+   This file is part of DRBD by Philipp Reisner and Lars Ellenberg.
+
+   Copyright (C) 2003-2008, LINBIT Information Technologies GmbH.
+   Copyright (C) 2003-2008, Philipp Reisner <philipp.reisner@linbit.com>.
+   Copyright (C) 2003-2008, Lars Ellenberg <lars.ellenberg@linbit.com>.
+
+   drbd is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 2, or (at your option)
+   any later version.
+
+   drbd is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with drbd; see the file COPYING.  If not, write to
+   the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
+
+ */
+
+#include <linux/slab.h>
+#include <linux/drbd.h>
+#include "drbd_int.h"
+#include "drbd_wrappers.h"
+
+/* I do not believe that all storage medias can guarantee atomic
+ * 512 byte write operations. When the journal is read, only
+ * transactions with correct xor_sums are considered.
+ * sizeof() = 512 byte */
+struct __attribute__((packed)) al_transaction {
+	u32       magic;
+	u32       tr_number;
+	struct __attribute__((packed)) {
+		u32 pos;
+		u32 extent; } updates[1 + AL_EXTENTS_PT];
+	u32       xor_sum;
+};
+
+struct update_odbm_work {
+	struct drbd_work w;
+	unsigned int enr;
+};
+
+struct update_al_work {
+	struct drbd_work w;
+	struct lc_element *al_ext;
+	struct completion event;
+	unsigned int enr;
+	/* if old_enr != LC_FREE, write corresponding bitmap sector, too */
+	unsigned int old_enr;
+};
+
+struct drbd_atodb_wait {
+	atomic_t           count;
+	struct completion  io_done;
+	struct drbd_conf   *mdev;
+	int                error;
+};
+
+
+int w_al_write_transaction(struct drbd_conf *, struct drbd_work *, int);
+
+STATIC int _drbd_md_sync_page_io(struct drbd_conf *mdev,
+				 struct drbd_backing_dev *bdev,
+				 struct page *page, sector_t sector,
+				 int rw, int size)
+{
+	struct bio *bio;
+	struct drbd_md_io md_io;
+	int ok;
+
+	md_io.mdev = mdev;
+	init_completion(&md_io.event);
+	md_io.error = 0;
+
+	if (rw == WRITE && !test_bit(MD_NO_BARRIER, &mdev->flags))
+		rw |= (1<<BIO_RW_BARRIER);
+	rw |= ((1<<BIO_RW_UNPLUG) | (1<<BIO_RW_SYNCIO));
+
+ retry:
+	bio = bio_alloc(GFP_NOIO, 1);
+	bio->bi_bdev = bdev->md_bdev;
+	bio->bi_sector = sector;
+	ok = (bio_add_page(bio, page, size, 0) == size);
+	if (!ok)
+		goto out;
+	bio->bi_private = &md_io;
+	bio->bi_end_io = drbd_md_io_complete;
+	bio->bi_rw = rw;
+
+	dump_internal_bio("Md", mdev, bio, 0);
+
+	if (FAULT_ACTIVE(mdev, (rw & WRITE) ? DRBD_FAULT_MD_WR : DRBD_FAULT_MD_RD))
+		bio_endio(bio, -EIO);
+	else
+		submit_bio(rw, bio);
+	wait_for_completion(&md_io.event);
+	ok = bio_flagged(bio, BIO_UPTODATE) && md_io.error == 0;
+
+	/* check for unsupported barrier op.
+	 * would rather check on EOPNOTSUPP, but that is not reliable.
+	 * don't try again for ANY return value != 0 */
+	if (unlikely(bio_barrier(bio) && !ok)) {
+		/* Try again with no barrier */
+		drbd_WARN("Barriers not supported on meta data device - disabling\n");
+		set_bit(MD_NO_BARRIER, &mdev->flags);
+		rw &= ~(1 << BIO_RW_BARRIER);
+		bio_put(bio);
+		goto retry;
+	}
+ out:
+	bio_put(bio);
+	return ok;
+}
+
+int drbd_md_sync_page_io(struct drbd_conf *mdev, struct drbd_backing_dev *bdev,
+			 sector_t sector, int rw)
+{
+	int hardsect, mask, ok;
+	int offset = 0;
+	struct page *iop = mdev->md_io_page;
+
+	D_ASSERT(mutex_is_locked(&mdev->md_io_mutex));
+
+	BUG_ON(!bdev->md_bdev);
+
+	hardsect = drbd_get_hardsect(bdev->md_bdev);
+	if (hardsect == 0)
+		hardsect = MD_HARDSECT;
+
+	/* in case hardsect != 512 [ s390 only? ] */
+	if (hardsect != MD_HARDSECT) {
+		mask = (hardsect / MD_HARDSECT) - 1;
+		D_ASSERT(mask == 1 || mask == 3 || mask == 7);
+		D_ASSERT(hardsect == (mask+1) * MD_HARDSECT);
+		offset = sector & mask;
+		sector = sector & ~mask;
+		iop = mdev->md_io_tmpp;
+
+		if (rw == WRITE) {
+			void *p = page_address(mdev->md_io_page);
+			void *hp = page_address(mdev->md_io_tmpp);
+
+			ok = _drbd_md_sync_page_io(mdev, bdev, iop,
+						   sector, READ, hardsect);
+
+			if (unlikely(!ok)) {
+				ERR("drbd_md_sync_page_io(,%llus,"
+				    "READ [hardsect!=512]) failed!\n",
+				    (unsigned long long)sector);
+				return 0;
+			}
+
+			memcpy(hp + offset*MD_HARDSECT , p, MD_HARDSECT);
+		}
+	}
+
+	if (sector < drbd_md_first_sector(bdev) ||
+	    sector > drbd_md_last_sector(bdev))
+		ALERT("%s [%d]:%s(,%llus,%s) out of range md access!\n",
+		     current->comm, current->pid, __func__,
+		     (unsigned long long)sector, rw ? "WRITE" : "READ");
+
+	ok = _drbd_md_sync_page_io(mdev, bdev, iop, sector, rw, hardsect);
+	if (unlikely(!ok)) {
+		ERR("drbd_md_sync_page_io(,%llus,%s) failed!\n",
+		    (unsigned long long)sector, rw ? "WRITE" : "READ");
+		return 0;
+	}
+
+	if (hardsect != MD_HARDSECT && rw == READ) {
+		void *p = page_address(mdev->md_io_page);
+		void *hp = page_address(mdev->md_io_tmpp);
+
+		memcpy(p, hp + offset*MD_HARDSECT, MD_HARDSECT);
+	}
+
+	return ok;
+}
+
+static inline
+struct lc_element *_al_get(struct drbd_conf *mdev, unsigned int enr)
+{
+	struct lc_element *al_ext;
+	struct bm_extent  *bm_ext;
+	unsigned long     al_flags = 0;
+
+	spin_lock_irq(&mdev->al_lock);
+	bm_ext = (struct bm_extent *)
+		lc_find(mdev->resync, enr/AL_EXT_PER_BM_SECT);
+	if (unlikely(bm_ext != NULL)) {
+		if (test_bit(BME_NO_WRITES, &bm_ext->flags)) {
+			spin_unlock_irq(&mdev->al_lock);
+			return NULL;
+		}
+	}
+	al_ext   = lc_get(mdev->act_log, enr);
+	al_flags = mdev->act_log->flags;
+	spin_unlock_irq(&mdev->al_lock);
+
+	/*
+	if (!al_ext) {
+		if (al_flags & LC_STARVING)
+			drbd_WARN("Have to wait for LRU element (AL too small?)\n");
+		if (al_flags & LC_DIRTY)
+			drbd_WARN("Ongoing AL update (AL device too slow?)\n");
+	}
+	*/
+
+	return al_ext;
+}
+
+void drbd_al_begin_io(struct drbd_conf *mdev, sector_t sector)
+{
+	unsigned int enr = (sector >> (AL_EXTENT_SIZE_B-9));
+	struct lc_element *al_ext;
+	struct update_al_work al_work;
+
+	D_ASSERT(atomic_read(&mdev->local_cnt) > 0);
+
+	MTRACE(TraceTypeALExts, TraceLvlMetrics,
+	       INFO("al_begin_io( sec=%llus (al_enr=%u) (rs_enr=%d) )\n",
+		    (unsigned long long) sector, enr,
+		    (int)BM_SECT_TO_EXT(sector));
+	       );
+
+	wait_event(mdev->al_wait, (al_ext = _al_get(mdev, enr)));
+
+	if (al_ext->lc_number != enr) {
+		/* drbd_al_write_transaction(mdev,al_ext,enr);
+		   generic_make_request() are serialized on the
+		   current->bio_tail list now. Therefore we have
+		   to deligate writing something to AL to the
+		   worker thread. */
+		init_completion(&al_work.event);
+		al_work.al_ext = al_ext;
+		al_work.enr = enr;
+		al_work.old_enr = al_ext->lc_number;
+		al_work.w.cb = w_al_write_transaction;
+		drbd_queue_work_front(&mdev->data.work, &al_work.w);
+		wait_for_completion(&al_work.event);
+
+		mdev->al_writ_cnt++;
+
+		spin_lock_irq(&mdev->al_lock);
+		lc_changed(mdev->act_log, al_ext);
+		spin_unlock_irq(&mdev->al_lock);
+		wake_up(&mdev->al_wait);
+	}
+}
+
+void drbd_al_complete_io(struct drbd_conf *mdev, sector_t sector)
+{
+	unsigned int enr = (sector >> (AL_EXTENT_SIZE_B-9));
+	struct lc_element *extent;
+	unsigned long flags;
+
+	MTRACE(TraceTypeALExts, TraceLvlMetrics,
+	       INFO("al_complete_io( sec=%llus (al_enr=%u) (rs_enr=%d) )\n",
+		    (unsigned long long) sector, enr,
+		    (int)BM_SECT_TO_EXT(sector));
+	       );
+
+	spin_lock_irqsave(&mdev->al_lock, flags);
+
+	extent = lc_find(mdev->act_log, enr);
+
+	if (!extent) {
+		spin_unlock_irqrestore(&mdev->al_lock, flags);
+		ERR("al_complete_io() called on inactive extent %u\n", enr);
+		return;
+	}
+
+	if (lc_put(mdev->act_log, extent) == 0)
+		wake_up(&mdev->al_wait);
+
+	spin_unlock_irqrestore(&mdev->al_lock, flags);
+}
+
+int
+w_al_write_transaction(struct drbd_conf *mdev, struct drbd_work *w, int unused)
+{
+	struct update_al_work *aw = (struct update_al_work *)w;
+	struct lc_element *updated = aw->al_ext;
+	const unsigned int new_enr = aw->enr;
+	const unsigned int evicted = aw->old_enr;
+
+	struct al_transaction *buffer;
+	sector_t sector;
+	int i, n, mx;
+	unsigned int extent_nr;
+	u32 xor_sum = 0;
+
+	if (!inc_local(mdev)) {
+		ERR("inc_local() failed in w_al_write_transaction\n");
+		complete(&((struct update_al_work *)w)->event);
+		return 1;
+	}
+	/* do we have to do a bitmap write, first?
+	 * TODO reduce maximum latency:
+	 * submit both bios, then wait for both,
+	 * instead of doing two synchronous sector writes. */
+	if (mdev->state.conn < Connected && evicted != LC_FREE)
+		drbd_bm_write_sect(mdev, evicted/AL_EXT_PER_BM_SECT);
+
+	mutex_lock(&mdev->md_io_mutex); /* protects md_io_page, al_tr_cycle, ... */
+	buffer = (struct al_transaction *)page_address(mdev->md_io_page);
+
+	buffer->magic = __constant_cpu_to_be32(DRBD_MAGIC);
+	buffer->tr_number = cpu_to_be32(mdev->al_tr_number);
+
+	n = lc_index_of(mdev->act_log, updated);
+
+	buffer->updates[0].pos = cpu_to_be32(n);
+	buffer->updates[0].extent = cpu_to_be32(new_enr);
+
+	xor_sum ^= new_enr;
+
+	mx = min_t(int, AL_EXTENTS_PT,
+		   mdev->act_log->nr_elements - mdev->al_tr_cycle);
+	for (i = 0; i < mx; i++) {
+		extent_nr = lc_entry(mdev->act_log,
+				     mdev->al_tr_cycle+i)->lc_number;
+		buffer->updates[i+1].pos = cpu_to_be32(mdev->al_tr_cycle+i);
+		buffer->updates[i+1].extent = cpu_to_be32(extent_nr);
+		xor_sum ^= extent_nr;
+	}
+	for (; i < AL_EXTENTS_PT; i++) {
+		buffer->updates[i+1].pos = __constant_cpu_to_be32(-1);
+		buffer->updates[i+1].extent = __constant_cpu_to_be32(LC_FREE);
+		xor_sum ^= LC_FREE;
+	}
+	mdev->al_tr_cycle += AL_EXTENTS_PT;
+	if (mdev->al_tr_cycle >= mdev->act_log->nr_elements)
+		mdev->al_tr_cycle = 0;
+
+	buffer->xor_sum = cpu_to_be32(xor_sum);
+
+	sector =  mdev->bc->md.md_offset
+		+ mdev->bc->md.al_offset + mdev->al_tr_pos;
+
+	if (!drbd_md_sync_page_io(mdev, mdev->bc, sector, WRITE)) {
+		drbd_chk_io_error(mdev, 1, TRUE);
+		drbd_io_error(mdev, TRUE);
+	}
+
+	if (++mdev->al_tr_pos >
+	    div_ceil(mdev->act_log->nr_elements, AL_EXTENTS_PT))
+		mdev->al_tr_pos = 0;
+
+	D_ASSERT(mdev->al_tr_pos < MD_AL_MAX_SIZE);
+	mdev->al_tr_number++;
+
+	mutex_unlock(&mdev->md_io_mutex);
+
+	complete(&((struct update_al_work *)w)->event);
+	dec_local(mdev);
+
+	return 1;
+}
+
+/**
+ * drbd_al_read_tr: Reads a single transaction record form the
+ * on disk activity log.
+ * Returns -1 on IO error, 0 on checksum error and 1 if it is a valid
+ * record.
+ */
+STATIC int drbd_al_read_tr(struct drbd_conf *mdev,
+			   struct drbd_backing_dev *bdev,
+			   struct al_transaction *b,
+			   int index)
+{
+	sector_t sector;
+	int rv, i;
+	u32 xor_sum = 0;
+
+	sector = bdev->md.md_offset + bdev->md.al_offset + index;
+
+	/* Dont process error normally,
+	 * as this is done before disk is atached! */
+	if (!drbd_md_sync_page_io(mdev, bdev, sector, READ))
+		return -1;
+
+	rv = (be32_to_cpu(b->magic) == DRBD_MAGIC);
+
+	for (i = 0; i < AL_EXTENTS_PT + 1; i++)
+		xor_sum ^= be32_to_cpu(b->updates[i].extent);
+	rv &= (xor_sum == be32_to_cpu(b->xor_sum));
+
+	return rv;
+}
+
+/**
+ * drbd_al_read_log: Restores the activity log from its on disk
+ * representation. Returns 1 on success, returns 0 when
+ * reading the log failed due to IO errors.
+ */
+int drbd_al_read_log(struct drbd_conf *mdev, struct drbd_backing_dev *bdev)
+{
+	struct al_transaction *buffer;
+	int i;
+	int rv;
+	int mx;
+	int cnr;
+	int active_extents = 0;
+	int transactions = 0;
+	int overflow = 0;
+	int from = -1;
+	int to = -1;
+	u32 from_tnr = -1;
+	u32 to_tnr = 0;
+
+	mx = div_ceil(mdev->act_log->nr_elements, AL_EXTENTS_PT);
+
+	/* lock out all other meta data io for now,
+	 * and make sure the page is mapped.
+	 */
+	mutex_lock(&mdev->md_io_mutex);
+	buffer = page_address(mdev->md_io_page);
+
+	/* Find the valid transaction in the log */
+	for (i = 0; i <= mx; i++) {
+		rv = drbd_al_read_tr(mdev, bdev, buffer, i);
+		if (rv == 0)
+			continue;
+		if (rv == -1) {
+			mutex_unlock(&mdev->md_io_mutex);
+			return 0;
+		}
+		cnr = be32_to_cpu(buffer->tr_number);
+
+		if (cnr == -1)
+			overflow = 1;
+
+		if (cnr < from_tnr && !overflow) {
+			from = i;
+			from_tnr = cnr;
+		}
+		if (cnr > to_tnr) {
+			to = i;
+			to_tnr = cnr;
+		}
+	}
+
+	if (from == -1 || to == -1) {
+		drbd_WARN("No usable activity log found.\n");
+
+		mutex_unlock(&mdev->md_io_mutex);
+		return 1;
+	}
+
+	/* Read the valid transactions.
+	 * INFO("Reading from %d to %d.\n",from,to); */
+	i = from;
+	while (1) {
+		int j, pos;
+		unsigned int extent_nr;
+		unsigned int trn;
+
+		rv = drbd_al_read_tr(mdev, bdev, buffer, i);
+		ERR_IF(rv == 0) goto cancel;
+		if (rv == -1) {
+			mutex_unlock(&mdev->md_io_mutex);
+			return 0;
+		}
+
+		trn = be32_to_cpu(buffer->tr_number);
+
+		spin_lock_irq(&mdev->al_lock);
+
+		/* This loop runs backwards because in the cyclic
+		   elements there might be an old version of the
+		   updated element (in slot 0). So the element in slot 0
+		   can overwrite old versions. */
+		for (j = AL_EXTENTS_PT; j >= 0; j--) {
+			pos = be32_to_cpu(buffer->updates[j].pos);
+			extent_nr = be32_to_cpu(buffer->updates[j].extent);
+
+			if (extent_nr == LC_FREE)
+				continue;
+
+			lc_set(mdev->act_log, extent_nr, pos);
+			active_extents++;
+		}
+		spin_unlock_irq(&mdev->al_lock);
+
+		transactions++;
+
+cancel:
+		if (i == to)
+			break;
+		i++;
+		if (i > mx)
+			i = 0;
+	}
+
+	mdev->al_tr_number = to_tnr+1;
+	mdev->al_tr_pos = to;
+	if (++mdev->al_tr_pos >
+	    div_ceil(mdev->act_log->nr_elements, AL_EXTENTS_PT))
+		mdev->al_tr_pos = 0;
+
+	/* ok, we are done with it */
+	mutex_unlock(&mdev->md_io_mutex);
+
+	INFO("Found %d transactions (%d active extents) in activity log.\n",
+	     transactions, active_extents);
+
+	return 1;
+}
+
+STATIC void atodb_endio(struct bio *bio, int error)
+{
+	struct drbd_atodb_wait *wc = bio->bi_private;
+	struct drbd_conf *mdev = wc->mdev;
+	struct page *page;
+	int uptodate = bio_flagged(bio, BIO_UPTODATE);
+
+	/* strange behaviour of some lower level drivers...
+	 * fail the request by clearing the uptodate flag,
+	 * but do not return any error?! */
+	if (!error && !uptodate)
+		error = -EIO;
+
+	/* corresponding drbd_io_error is in drbd_al_to_on_disk_bm */
+	drbd_chk_io_error(mdev, error, TRUE);
+	if (error && wc->error == 0)
+		wc->error = error;
+
+	if (atomic_dec_and_test(&wc->count))
+		complete(&wc->io_done);
+
+	page = bio->bi_io_vec[0].bv_page;
+	put_page(page);
+	bio_put(bio);
+	mdev->bm_writ_cnt++;
+	dec_local(mdev);
+}
+
+#define S2W(s)	((s)<<(BM_EXT_SIZE_B-BM_BLOCK_SIZE_B-LN2_BPL))
+/* activity log to on disk bitmap -- prepare bio unless that sector
+ * is already covered by previously prepared bios */
+STATIC int atodb_prepare_unless_covered(struct drbd_conf *mdev,
+					struct bio **bios,
+					unsigned int enr,
+					struct drbd_atodb_wait *wc) __must_hold(local)
+{
+	struct bio *bio;
+	struct page *page;
+	sector_t on_disk_sector = enr + mdev->bc->md.md_offset
+				      + mdev->bc->md.bm_offset;
+	unsigned int page_offset = PAGE_SIZE;
+	int offset;
+	int i = 0;
+	int err = -ENOMEM;
+
+	/* Check if that enr is already covered by an already created bio.
+	 * Caution, bios[] is not NULL terminated,
+	 * but only initialized to all NULL.
+	 * For completely scattered activity log,
+	 * the last invocation iterates over all bios,
+	 * and finds the last NULL entry.
+	 */
+	while ((bio = bios[i])) {
+		if (bio->bi_sector == on_disk_sector)
+			return 0;
+		i++;
+	}
+	/* bios[i] == NULL, the next not yet used slot */
+
+	bio = bio_alloc(GFP_KERNEL, 1);
+	if (bio == NULL)
+		return -ENOMEM;
+
+	if (i > 0) {
+		const struct bio_vec *prev_bv = bios[i-1]->bi_io_vec;
+		page_offset = prev_bv->bv_offset + prev_bv->bv_len;
+		page = prev_bv->bv_page;
+	}
+	if (page_offset == PAGE_SIZE) {
+		page = alloc_page(__GFP_HIGHMEM);
+		if (page == NULL)
+			goto out_bio_put;
+		page_offset = 0;
+	} else {
+		get_page(page);
+	}
+
+	offset = S2W(enr);
+	drbd_bm_get_lel(mdev, offset,
+			min_t(size_t, S2W(1), drbd_bm_words(mdev) - offset),
+			kmap(page) + page_offset);
+	kunmap(page);
+
+	bio->bi_private = wc;
+	bio->bi_end_io = atodb_endio;
+	bio->bi_bdev = mdev->bc->md_bdev;
+	bio->bi_sector = on_disk_sector;
+
+	if (bio_add_page(bio, page, MD_HARDSECT, page_offset) != MD_HARDSECT)
+		goto out_put_page;
+
+	atomic_inc(&wc->count);
+	/* we already know that we may do this...
+	 * inc_local_if_state(mdev,Attaching);
+	 * just get the extra reference, so that the local_cnt reflects
+	 * the number of pending IO requests DRBD at its backing device.
+	 */
+	atomic_inc(&mdev->local_cnt);
+
+	bios[i] = bio;
+
+	return 0;
+
+out_put_page:
+	err = -EINVAL;
+	put_page(page);
+out_bio_put:
+	bio_put(bio);
+	return err;
+}
+
+/**
+ * drbd_al_to_on_disk_bm:
+ * Writes the areas of the bitmap which are covered by the AL.
+ * called when we detach (unconfigure) local storage,
+ * or when we go from Primary to Secondary state.
+ */
+void drbd_al_to_on_disk_bm(struct drbd_conf *mdev)
+{
+	int i, nr_elements;
+	unsigned int enr;
+	struct bio **bios;
+	struct drbd_atodb_wait wc;
+
+	ERR_IF (!inc_local_if_state(mdev, Attaching))
+		return; /* sorry, I don't have any act_log etc... */
+
+	wait_event(mdev->al_wait, lc_try_lock(mdev->act_log));
+
+	nr_elements = mdev->act_log->nr_elements;
+
+	bios = kzalloc(sizeof(struct bio *) * nr_elements, GFP_KERNEL);
+	if (!bios)
+		goto submit_one_by_one;
+
+	atomic_set(&wc.count, 0);
+	init_completion(&wc.io_done);
+	wc.mdev = mdev;
+	wc.error = 0;
+
+	for (i = 0; i < nr_elements; i++) {
+		enr = lc_entry(mdev->act_log, i)->lc_number;
+		if (enr == LC_FREE)
+			continue;
+		/* next statement also does atomic_inc wc.count and local_cnt */
+		if (atodb_prepare_unless_covered(mdev, bios,
+						enr/AL_EXT_PER_BM_SECT,
+						&wc))
+			goto free_bios_submit_one_by_one;
+	}
+
+	/* unneccessary optimization? */
+	lc_unlock(mdev->act_log);
+	wake_up(&mdev->al_wait);
+
+	/* all prepared, submit them */
+	for (i = 0; i < nr_elements; i++) {
+		if (bios[i] == NULL)
+			break;
+		if (FAULT_ACTIVE(mdev, DRBD_FAULT_MD_WR)) {
+			bios[i]->bi_rw = WRITE;
+			bio_endio(bios[i], -EIO);
+		} else {
+			submit_bio(WRITE, bios[i]);
+		}
+	}
+
+	drbd_blk_run_queue(bdev_get_queue(mdev->bc->md_bdev));
+
+	/* always (try to) flush bitmap to stable storage */
+	drbd_md_flush(mdev);
+
+	/* In case we did not submit a single IO do not wait for
+	 * them to complete. ( Because we would wait forever here. )
+	 *
+	 * In case we had IOs and they are already complete, there
+	 * is not point in waiting anyways.
+	 * Therefore this if () ... */
+	if (atomic_read(&wc.count))
+		wait_for_completion(&wc.io_done);
+
+	dec_local(mdev);
+
+	if (wc.error)
+		drbd_io_error(mdev, TRUE);
+	kfree(bios);
+	return;
+
+ free_bios_submit_one_by_one:
+	/* free everything by calling the endio callback directly. */
+	for (i = 0; i < nr_elements && bios[i]; i++)
+		bio_endio(bios[i], 0);
+
+	kfree(bios);
+
+ submit_one_by_one:
+	drbd_WARN("Using the slow drbd_al_to_on_disk_bm()\n");
+
+	for (i = 0; i < mdev->act_log->nr_elements; i++) {
+		enr = lc_entry(mdev->act_log, i)->lc_number;
+		if (enr == LC_FREE)
+			continue;
+		/* Really slow: if we have al-extents 16..19 active,
+		 * sector 4 will be written four times! Synchronous! */
+		drbd_bm_write_sect(mdev, enr/AL_EXT_PER_BM_SECT);
+	}
+
+	lc_unlock(mdev->act_log);
+	wake_up(&mdev->al_wait);
+	dec_local(mdev);
+}
+
+/**
+ * drbd_al_apply_to_bm: Sets the bits in the bitmap that are described
+ * by the active extents of the AL.
+ */
+void drbd_al_apply_to_bm(struct drbd_conf *mdev)
+{
+	unsigned int enr;
+	unsigned long add = 0;
+	char ppb[10];
+	int i;
+
+	wait_event(mdev->al_wait, lc_try_lock(mdev->act_log));
+
+	for (i = 0; i < mdev->act_log->nr_elements; i++) {
+		enr = lc_entry(mdev->act_log, i)->lc_number;
+		if (enr == LC_FREE)
+			continue;
+		add += drbd_bm_ALe_set_all(mdev, enr);
+	}
+
+	lc_unlock(mdev->act_log);
+	wake_up(&mdev->al_wait);
+
+	INFO("Marked additional %s as out-of-sync based on AL.\n",
+	     ppsize(ppb, Bit2KB(add)));
+}
+
+static inline int _try_lc_del(struct drbd_conf *mdev, struct lc_element *al_ext)
+{
+	int rv;
+
+	spin_lock_irq(&mdev->al_lock);
+	rv = (al_ext->refcnt == 0);
+	if (likely(rv))
+		lc_del(mdev->act_log, al_ext);
+	spin_unlock_irq(&mdev->al_lock);
+
+	MTRACE(TraceTypeALExts, TraceLvlMetrics,
+		if (unlikely(!rv))
+			INFO("Waiting for extent in drbd_al_shrink()\n");
+	       );
+
+	return rv;
+}
+
+/**
+ * drbd_al_shrink: Removes all active extents form the AL. (but does not
+ * write any transactions)
+ * You need to lock mdev->act_log with lc_try_lock() / lc_unlock()
+ */
+void drbd_al_shrink(struct drbd_conf *mdev)
+{
+	struct lc_element *al_ext;
+	int i;
+
+	D_ASSERT(test_bit(__LC_DIRTY, &mdev->act_log->flags));
+
+	for (i = 0; i < mdev->act_log->nr_elements; i++) {
+		al_ext = lc_entry(mdev->act_log, i);
+		if (al_ext->lc_number == LC_FREE)
+			continue;
+		wait_event(mdev->al_wait, _try_lc_del(mdev, al_ext));
+	}
+
+	wake_up(&mdev->al_wait);
+}
+
+STATIC int w_update_odbm(struct drbd_conf *mdev, struct drbd_work *w, int unused)
+{
+	struct update_odbm_work *udw = (struct update_odbm_work *)w;
+
+	if (!inc_local(mdev)) {
+		if (__ratelimit(&drbd_ratelimit_state))
+			drbd_WARN("Can not update on disk bitmap, local IO disabled.\n");
+		return 1;
+	}
+
+	drbd_bm_write_sect(mdev, udw->enr);
+	dec_local(mdev);
+
+	kfree(udw);
+
+	if (drbd_bm_total_weight(mdev) <= mdev->rs_failed) {
+		switch (mdev->state.conn) {
+		case SyncSource:  case SyncTarget:
+		case PausedSyncS: case PausedSyncT:
+			drbd_resync_finished(mdev);
+		default:
+			/* nothing to do */
+			break;
+		}
+	}
+	drbd_bcast_sync_progress(mdev);
+
+	return 1;
+}
+
+
+/* ATTENTION. The AL's extents are 4MB each, while the extents in the
+ * resync LRU-cache are 16MB each.
+ * The caller of this function has to hold an inc_local() reference.
+ *
+ * TODO will be obsoleted once we have a caching lru of the on disk bitmap
+ */
+STATIC void drbd_try_clear_on_disk_bm(struct drbd_conf *mdev, sector_t sector,
+				      int count, int success)
+{
+	struct bm_extent *ext;
+	struct update_odbm_work *udw;
+
+	unsigned int enr;
+
+	D_ASSERT(atomic_read(&mdev->local_cnt));
+
+	/* I simply assume that a sector/size pair never crosses
+	 * a 16 MB extent border. (Currently this is true...) */
+	enr = BM_SECT_TO_EXT(sector);
+
+	ext = (struct bm_extent *) lc_get(mdev->resync, enr);
+	if (ext) {
+		if (ext->lce.lc_number == enr) {
+			if (success)
+				ext->rs_left -= count;
+			else
+				ext->rs_failed += count;
+			if (ext->rs_left < ext->rs_failed) {
+				ERR("BAD! sector=%llus enr=%u rs_left=%d "
+				    "rs_failed=%d count=%d\n",
+				     (unsigned long long)sector,
+				     ext->lce.lc_number, ext->rs_left,
+				     ext->rs_failed, count);
+				dump_stack();
+
+				lc_put(mdev->resync, &ext->lce);
+				drbd_force_state(mdev, NS(conn, Disconnecting));
+				return;
+			}
+		} else {
+			/* Normally this element should be in the cache,
+			 * since drbd_rs_begin_io() pulled it already in.
+			 *
+			 * But maybe an application write finished, and we set
+			 * something outside the resync lru_cache in sync.
+			 */
+			int rs_left = drbd_bm_e_weight(mdev, enr);
+			if (ext->flags != 0) {
+				drbd_WARN("changing resync lce: %d[%u;%02lx]"
+				     " -> %d[%u;00]\n",
+				     ext->lce.lc_number, ext->rs_left,
+				     ext->flags, enr, rs_left);
+				ext->flags = 0;
+			}
+			if (ext->rs_failed) {
+				drbd_WARN("Kicking resync_lru element enr=%u "
+				     "out with rs_failed=%d\n",
+				     ext->lce.lc_number, ext->rs_failed);
+				set_bit(WRITE_BM_AFTER_RESYNC, &mdev->flags);
+			}
+			ext->rs_left = rs_left;
+			ext->rs_failed = success ? 0 : count;
+			lc_changed(mdev->resync, &ext->lce);
+		}
+		lc_put(mdev->resync, &ext->lce);
+		/* no race, we are within the al_lock! */
+
+		if (ext->rs_left == ext->rs_failed) {
+			ext->rs_failed = 0;
+
+			udw = kmalloc(sizeof(*udw), GFP_ATOMIC);
+			if (udw) {
+				udw->enr = ext->lce.lc_number;
+				udw->w.cb = w_update_odbm;
+				drbd_queue_work_front(&mdev->data.work, &udw->w);
+			} else {
+				drbd_WARN("Could not kmalloc an udw\n");
+				set_bit(WRITE_BM_AFTER_RESYNC, &mdev->flags);
+			}
+		}
+	} else {
+		ERR("lc_get() failed! locked=%d/%d flags=%lu\n",
+		    mdev->resync_locked,
+		    mdev->resync->nr_elements,
+		    mdev->resync->flags);
+	}
+}
+
+/* clear the bit corresponding to the piece of storage in question:
+ * size byte of data starting from sector.  Only clear a bits of the affected
+ * one ore more _aligned_ BM_BLOCK_SIZE blocks.
+ *
+ * called by worker on SyncTarget and receiver on SyncSource.
+ *
+ */
+void __drbd_set_in_sync(struct drbd_conf *mdev, sector_t sector, int size,
+		       const char *file, const unsigned int line)
+{
+	/* Is called from worker and receiver context _only_ */
+	unsigned long sbnr, ebnr, lbnr;
+	unsigned long count = 0;
+	sector_t esector, nr_sectors;
+	int wake_up = 0;
+	unsigned long flags;
+
+	if (size <= 0 || (size & 0x1ff) != 0 || size > DRBD_MAX_SEGMENT_SIZE) {
+		ERR("drbd_set_in_sync: sector=%llus size=%d nonsense!\n",
+				(unsigned long long)sector, size);
+		return;
+	}
+	nr_sectors = drbd_get_capacity(mdev->this_bdev);
+	esector = sector + (size >> 9) - 1;
+
+	ERR_IF(sector >= nr_sectors) return;
+	ERR_IF(esector >= nr_sectors) esector = (nr_sectors-1);
+
+	lbnr = BM_SECT_TO_BIT(nr_sectors-1);
+
+	/* we clear it (in sync).
+	 * round up start sector, round down end sector.  we make sure we only
+	 * clear full, alligned, BM_BLOCK_SIZE (4K) blocks */
+	if (unlikely(esector < BM_SECT_PER_BIT-1))
+		return;
+	if (unlikely(esector == (nr_sectors-1)))
+		ebnr = lbnr;
+	else
+		ebnr = BM_SECT_TO_BIT(esector - (BM_SECT_PER_BIT-1));
+	sbnr = BM_SECT_TO_BIT(sector + BM_SECT_PER_BIT-1);
+
+	MTRACE(TraceTypeResync, TraceLvlMetrics,
+	       INFO("drbd_set_in_sync: sector=%llus size=%u sbnr=%lu ebnr=%lu\n",
+		    (unsigned long long)sector, size, sbnr, ebnr);
+	    );
+
+	if (sbnr > ebnr)
+		return;
+
+	/*
+	 * ok, (capacity & 7) != 0 sometimes, but who cares...
+	 * we count rs_{total,left} in bits, not sectors.
+	 */
+	spin_lock_irqsave(&mdev->al_lock, flags);
+	count = drbd_bm_clear_bits(mdev, sbnr, ebnr);
+	if (count) {
+		/* we need the lock for drbd_try_clear_on_disk_bm */
+		if (jiffies - mdev->rs_mark_time > HZ*10) {
+			/* should be roling marks,
+			 * but we estimate only anyways. */
+			if (mdev->rs_mark_left != drbd_bm_total_weight(mdev) &&
+			    mdev->state.conn != PausedSyncT &&
+			    mdev->state.conn != PausedSyncS) {
+				mdev->rs_mark_time = jiffies;
+				mdev->rs_mark_left = drbd_bm_total_weight(mdev);
+			}
+		}
+		if (inc_local(mdev)) {
+			drbd_try_clear_on_disk_bm(mdev, sector, count, TRUE);
+			dec_local(mdev);
+		}
+		/* just wake_up unconditional now, various lc_chaged(),
+		 * lc_put() in drbd_try_clear_on_disk_bm(). */
+		wake_up = 1;
+	}
+	spin_unlock_irqrestore(&mdev->al_lock, flags);
+	if (wake_up)
+		wake_up(&mdev->al_wait);
+}
+
+/*
+ * this is intended to set one request worth of data out of sync.
+ * affects at least 1 bit,
+ * and at most 1+DRBD_MAX_SEGMENT_SIZE/BM_BLOCK_SIZE bits.
+ *
+ * called by tl_clear and drbd_send_dblock (==drbd_make_request).
+ * so this can be _any_ process.
+ */
+void __drbd_set_out_of_sync(struct drbd_conf *mdev, sector_t sector, int size,
+			    const char *file, const unsigned int line)
+{
+	unsigned long sbnr, ebnr, lbnr, flags;
+	sector_t esector, nr_sectors;
+	unsigned int enr, count;
+	struct bm_extent *ext;
+
+	if (size <= 0 || (size & 0x1ff) != 0 || size > DRBD_MAX_SEGMENT_SIZE) {
+		ERR("sector: %llus, size: %d\n",
+			(unsigned long long)sector, size);
+		return;
+	}
+
+	if (!inc_local(mdev))
+		return; /* no disk, no metadata, no bitmap to set bits in */
+
+	nr_sectors = drbd_get_capacity(mdev->this_bdev);
+	esector = sector + (size >> 9) - 1;
+
+	ERR_IF(sector >= nr_sectors)
+		goto out;
+	ERR_IF(esector >= nr_sectors)
+		esector = (nr_sectors-1);
+
+	lbnr = BM_SECT_TO_BIT(nr_sectors-1);
+
+	/* we set it out of sync,
+	 * we do not need to round anything here */
+	sbnr = BM_SECT_TO_BIT(sector);
+	ebnr = BM_SECT_TO_BIT(esector);
+
+	MTRACE(TraceTypeResync, TraceLvlMetrics,
+	       INFO("drbd_set_out_of_sync: sector=%llus size=%u "
+		    "sbnr=%lu ebnr=%lu\n",
+		    (unsigned long long)sector, size, sbnr, ebnr);
+	    );
+
+	/* ok, (capacity & 7) != 0 sometimes, but who cares...
+	 * we count rs_{total,left} in bits, not sectors.  */
+	spin_lock_irqsave(&mdev->al_lock, flags);
+	count = drbd_bm_set_bits(mdev, sbnr, ebnr);
+
+	enr = BM_SECT_TO_EXT(sector);
+	ext = (struct bm_extent *) lc_find(mdev->resync, enr);
+	if (ext)
+		ext->rs_left += count;
+	spin_unlock_irqrestore(&mdev->al_lock, flags);
+
+out:
+	dec_local(mdev);
+}
+
+static inline
+struct bm_extent *_bme_get(struct drbd_conf *mdev, unsigned int enr)
+{
+	struct bm_extent  *bm_ext;
+	int wakeup = 0;
+	unsigned long     rs_flags;
+
+	spin_lock_irq(&mdev->al_lock);
+	if (mdev->resync_locked > mdev->resync->nr_elements/2) {
+		spin_unlock_irq(&mdev->al_lock);
+		return NULL;
+	}
+	bm_ext = (struct bm_extent *) lc_get(mdev->resync, enr);
+	if (bm_ext) {
+		if (bm_ext->lce.lc_number != enr) {
+			bm_ext->rs_left = drbd_bm_e_weight(mdev, enr);
+			bm_ext->rs_failed = 0;
+			lc_changed(mdev->resync, (struct lc_element *)bm_ext);
+			wakeup = 1;
+		}
+		if (bm_ext->lce.refcnt == 1)
+			mdev->resync_locked++;
+		set_bit(BME_NO_WRITES, &bm_ext->flags);
+	}
+	rs_flags = mdev->resync->flags;
+	spin_unlock_irq(&mdev->al_lock);
+	if (wakeup)
+		wake_up(&mdev->al_wait);
+
+	if (!bm_ext) {
+		if (rs_flags & LC_STARVING)
+			drbd_WARN("Have to wait for element"
+			     " (resync LRU too small?)\n");
+		BUG_ON(rs_flags & LC_DIRTY);
+	}
+
+	return bm_ext;
+}
+
+static inline int _is_in_al(struct drbd_conf *mdev, unsigned int enr)
+{
+	struct lc_element *al_ext;
+	int rv = 0;
+
+	spin_lock_irq(&mdev->al_lock);
+	if (unlikely(enr == mdev->act_log->new_number))
+		rv = 1;
+	else {
+		al_ext = lc_find(mdev->act_log, enr);
+		if (al_ext) {
+			if (al_ext->refcnt)
+				rv = 1;
+		}
+	}
+	spin_unlock_irq(&mdev->al_lock);
+
+	/*
+	if (unlikely(rv)) {
+		INFO("Delaying sync read until app's write is done\n");
+	}
+	*/
+	return rv;
+}
+
+/**
+ * drbd_rs_begin_io: Gets an extent in the resync LRU cache and sets it
+ * to BME_LOCKED.
+ *
+ * @sector: The sector number
+ *
+ * sleeps on al_wait.
+ * returns 1 if successful.
+ * returns 0 if interrupted.
+ */
+int drbd_rs_begin_io(struct drbd_conf *mdev, sector_t sector)
+{
+	unsigned int enr = BM_SECT_TO_EXT(sector);
+	struct bm_extent *bm_ext;
+	int i, sig;
+
+	MTRACE(TraceTypeResync, TraceLvlAll,
+	       INFO("drbd_rs_begin_io: sector=%llus (rs_end=%d)\n",
+		    (unsigned long long)sector, enr);
+	    );
+
+	sig = wait_event_interruptible(mdev->al_wait,
+			(bm_ext = _bme_get(mdev, enr)));
+	if (sig)
+		return 0;
+
+	if (test_bit(BME_LOCKED, &bm_ext->flags))
+		return 1;
+
+	for (i = 0; i < AL_EXT_PER_BM_SECT; i++) {
+		sig = wait_event_interruptible(mdev->al_wait,
+				!_is_in_al(mdev, enr * AL_EXT_PER_BM_SECT + i));
+		if (sig) {
+			spin_lock_irq(&mdev->al_lock);
+			if (lc_put(mdev->resync, &bm_ext->lce) == 0) {
+				clear_bit(BME_NO_WRITES, &bm_ext->flags);
+				mdev->resync_locked--;
+				wake_up(&mdev->al_wait);
+			}
+			spin_unlock_irq(&mdev->al_lock);
+			return 0;
+		}
+	}
+
+	set_bit(BME_LOCKED, &bm_ext->flags);
+
+	return 1;
+}
+
+/**
+ * drbd_try_rs_begin_io: Gets an extent in the resync LRU cache, sets it
+ * to BME_NO_WRITES, then tries to set it to BME_LOCKED.
+ *
+ * @sector: The sector number
+ *
+ * does not sleep.
+ * returns zero if we could set BME_LOCKED and can proceed,
+ * -EAGAIN if we need to try again.
+ */
+int drbd_try_rs_begin_io(struct drbd_conf *mdev, sector_t sector)
+{
+	unsigned int enr = BM_SECT_TO_EXT(sector);
+	const unsigned int al_enr = enr*AL_EXT_PER_BM_SECT;
+	struct bm_extent *bm_ext;
+	int i;
+
+	MTRACE(TraceTypeResync, TraceLvlAll,
+	       INFO("drbd_try_rs_begin_io: sector=%llus\n",
+		    (unsigned long long)sector);
+	    );
+
+	spin_lock_irq(&mdev->al_lock);
+	if (mdev->resync_wenr != LC_FREE && mdev->resync_wenr != enr) {
+		/* in case you have very heavy scattered io, it may
+		 * stall the syncer undefined if we giveup the ref count
+		 * when we try again and requeue.
+		 *
+		 * if we don't give up the refcount, but the next time
+		 * we are scheduled this extent has been "synced" by new
+		 * application writes, we'd miss the lc_put on the
+		 * extent we keept the refcount on.
+		 * so we remembered which extent we had to try agin, and
+		 * if the next requested one is something else, we do
+		 * the lc_put here...
+		 * we also have to wake_up
+		 */
+		MTRACE(TraceTypeResync, TraceLvlAll,
+			INFO("dropping %u, aparently got 'synced' "
+			     "by application io\n", mdev->resync_wenr);
+		);
+		bm_ext = (struct bm_extent *)
+			lc_find(mdev->resync, mdev->resync_wenr);
+		if (bm_ext) {
+			D_ASSERT(!test_bit(BME_LOCKED, &bm_ext->flags));
+			D_ASSERT(test_bit(BME_NO_WRITES, &bm_ext->flags));
+			clear_bit(BME_NO_WRITES, &bm_ext->flags);
+			mdev->resync_wenr = LC_FREE;
+			if (lc_put(mdev->resync, &bm_ext->lce) == 0)
+				mdev->resync_locked--;
+			wake_up(&mdev->al_wait);
+		} else {
+			ALERT("LOGIC BUG\n");
+		}
+	}
+	bm_ext = (struct bm_extent *)lc_try_get(mdev->resync, enr);
+	if (bm_ext) {
+		if (test_bit(BME_LOCKED, &bm_ext->flags))
+			goto proceed;
+		if (!test_and_set_bit(BME_NO_WRITES, &bm_ext->flags)) {
+			mdev->resync_locked++;
+		} else {
+			/* we did set the BME_NO_WRITES,
+			 * but then could not set BME_LOCKED,
+			 * so we tried again.
+			 * drop the extra reference. */
+			MTRACE(TraceTypeResync, TraceLvlAll,
+				INFO("dropping extra reference on %u\n", enr);
+			);
+			bm_ext->lce.refcnt--;
+			D_ASSERT(bm_ext->lce.refcnt > 0);
+		}
+		goto check_al;
+	} else {
+		if (mdev->resync_locked > mdev->resync->nr_elements-3) {
+			MTRACE(TraceTypeResync, TraceLvlAll,
+				INFO("resync_locked = %u!\n", mdev->resync_locked);
+			);
+			goto try_again;
+		}
+		bm_ext = (struct bm_extent *)lc_get(mdev->resync, enr);
+		if (!bm_ext) {
+			const unsigned long rs_flags = mdev->resync->flags;
+			if (rs_flags & LC_STARVING)
+				drbd_WARN("Have to wait for element"
+				     " (resync LRU too small?)\n");
+			BUG_ON(rs_flags & LC_DIRTY);
+			goto try_again;
+		}
+		if (bm_ext->lce.lc_number != enr) {
+			bm_ext->rs_left = drbd_bm_e_weight(mdev, enr);
+			bm_ext->rs_failed = 0;
+			lc_changed(mdev->resync, (struct lc_element *)bm_ext);
+			wake_up(&mdev->al_wait);
+			D_ASSERT(test_bit(BME_LOCKED, &bm_ext->flags) == 0);
+		}
+		set_bit(BME_NO_WRITES, &bm_ext->flags);
+		D_ASSERT(bm_ext->lce.refcnt == 1);
+		mdev->resync_locked++;
+		goto check_al;
+	}
+check_al:
+	MTRACE(TraceTypeResync, TraceLvlAll,
+		INFO("checking al for %u\n", enr);
+	);
+	for (i = 0; i < AL_EXT_PER_BM_SECT; i++) {
+		if (unlikely(al_enr+i == mdev->act_log->new_number))
+			goto try_again;
+		if (lc_is_used(mdev->act_log, al_enr+i))
+			goto try_again;
+	}
+	set_bit(BME_LOCKED, &bm_ext->flags);
+proceed:
+	mdev->resync_wenr = LC_FREE;
+	spin_unlock_irq(&mdev->al_lock);
+	return 0;
+
+try_again:
+	MTRACE(TraceTypeResync, TraceLvlAll,
+		INFO("need to try again for %u\n", enr);
+	);
+	if (bm_ext)
+		mdev->resync_wenr = enr;
+	spin_unlock_irq(&mdev->al_lock);
+	return -EAGAIN;
+}
+
+void drbd_rs_complete_io(struct drbd_conf *mdev, sector_t sector)
+{
+	unsigned int enr = BM_SECT_TO_EXT(sector);
+	struct bm_extent *bm_ext;
+	unsigned long flags;
+
+	MTRACE(TraceTypeResync, TraceLvlAll,
+	       INFO("drbd_rs_complete_io: sector=%llus (rs_enr=%d)\n",
+		    (long long)sector, enr);
+	    );
+
+	spin_lock_irqsave(&mdev->al_lock, flags);
+	bm_ext = (struct bm_extent *) lc_find(mdev->resync, enr);
+	if (!bm_ext) {
+		spin_unlock_irqrestore(&mdev->al_lock, flags);
+		ERR("drbd_rs_complete_io() called, but extent not found\n");
+		return;
+	}
+
+	if (bm_ext->lce.refcnt == 0) {
+		spin_unlock_irqrestore(&mdev->al_lock, flags);
+		ERR("drbd_rs_complete_io(,%llu [=%u]) called, "
+		    "but refcnt is 0!?\n",
+		    (unsigned long long)sector, enr);
+		return;
+	}
+
+	if (lc_put(mdev->resync, (struct lc_element *)bm_ext) == 0) {
+		clear_bit(BME_LOCKED, &bm_ext->flags);
+		clear_bit(BME_NO_WRITES, &bm_ext->flags);
+		mdev->resync_locked--;
+		wake_up(&mdev->al_wait);
+	}
+
+	spin_unlock_irqrestore(&mdev->al_lock, flags);
+}
+
+/**
+ * drbd_rs_cancel_all: Removes extents from the resync LRU. Even
+ * if they are BME_LOCKED.
+ */
+void drbd_rs_cancel_all(struct drbd_conf *mdev)
+{
+	MTRACE(TraceTypeResync, TraceLvlMetrics,
+	       INFO("drbd_rs_cancel_all\n");
+	    );
+
+	spin_lock_irq(&mdev->al_lock);
+
+	if (inc_local_if_state(mdev, Failed)) { /* Makes sure ->resync is there. */
+		lc_reset(mdev->resync);
+		dec_local(mdev);
+	}
+	mdev->resync_locked = 0;
+	mdev->resync_wenr = LC_FREE;
+	spin_unlock_irq(&mdev->al_lock);
+	wake_up(&mdev->al_wait);
+}
+
+/**
+ * drbd_rs_del_all: Gracefully remove all extents from the resync LRU.
+ * there may be still a reference hold by someone. In that case this function
+ * returns -EAGAIN.
+ * In case all elements got removed it returns zero.
+ */
+int drbd_rs_del_all(struct drbd_conf *mdev)
+{
+	struct bm_extent *bm_ext;
+	int i;
+
+	MTRACE(TraceTypeResync, TraceLvlMetrics,
+	       INFO("drbd_rs_del_all\n");
+	    );
+
+	spin_lock_irq(&mdev->al_lock);
+
+	if (inc_local_if_state(mdev, Failed)) {
+		/* ok, ->resync is there. */
+		for (i = 0; i < mdev->resync->nr_elements; i++) {
+			bm_ext = (struct bm_extent *) lc_entry(mdev->resync, i);
+			if (bm_ext->lce.lc_number == LC_FREE)
+				continue;
+			if (bm_ext->lce.lc_number == mdev->resync_wenr) {
+				INFO("dropping %u in drbd_rs_del_all, apparently"
+				     " got 'synced' by application io\n",
+				     mdev->resync_wenr);
+				D_ASSERT(!test_bit(BME_LOCKED, &bm_ext->flags));
+				D_ASSERT(test_bit(BME_NO_WRITES, &bm_ext->flags));
+				clear_bit(BME_NO_WRITES, &bm_ext->flags);
+				mdev->resync_wenr = LC_FREE;
+				lc_put(mdev->resync, &bm_ext->lce);
+			}
+			if (bm_ext->lce.refcnt != 0) {
+				INFO("Retrying drbd_rs_del_all() later. "
+				     "refcnt=%d\n", bm_ext->lce.refcnt);
+				dec_local(mdev);
+				spin_unlock_irq(&mdev->al_lock);
+				return -EAGAIN;
+			}
+			D_ASSERT(!test_bit(BME_LOCKED, &bm_ext->flags));
+			D_ASSERT(!test_bit(BME_NO_WRITES, &bm_ext->flags));
+			lc_del(mdev->resync, &bm_ext->lce);
+		}
+		D_ASSERT(mdev->resync->used == 0);
+		dec_local(mdev);
+	}
+	spin_unlock_irq(&mdev->al_lock);
+
+	return 0;
+}
+
+/* Record information on a failure to resync the specified blocks
+ *
+ * called on SyncTarget when resync write fails or NegRSDReply received
+ *
+ */
+void drbd_rs_failed_io(struct drbd_conf *mdev, sector_t sector, int size)
+{
+	/* Is called from worker and receiver context _only_ */
+	unsigned long sbnr, ebnr, lbnr;
+	unsigned long count;
+	sector_t esector, nr_sectors;
+	int wake_up = 0;
+
+	MTRACE(TraceTypeResync, TraceLvlSummary,
+	       INFO("drbd_rs_failed_io: sector=%llus, size=%u\n",
+		    (unsigned long long)sector, size);
+	    );
+
+	if (size <= 0 || (size & 0x1ff) != 0 || size > DRBD_MAX_SEGMENT_SIZE) {
+		ERR("drbd_rs_failed_io: sector=%llus size=%d nonsense!\n",
+				(unsigned long long)sector, size);
+		return;
+	}
+	nr_sectors = drbd_get_capacity(mdev->this_bdev);
+	esector = sector + (size >> 9) - 1;
+
+	ERR_IF(sector >= nr_sectors) return;
+	ERR_IF(esector >= nr_sectors) esector = (nr_sectors-1);
+
+	lbnr = BM_SECT_TO_BIT(nr_sectors-1);
+
+	/*
+	 * round up start sector, round down end sector.  we make sure we only
+	 * handle full, alligned, BM_BLOCK_SIZE (4K) blocks */
+	if (unlikely(esector < BM_SECT_PER_BIT-1))
+		return;
+	if (unlikely(esector == (nr_sectors-1)))
+		ebnr = lbnr;
+	else
+		ebnr = BM_SECT_TO_BIT(esector - (BM_SECT_PER_BIT-1));
+	sbnr = BM_SECT_TO_BIT(sector + BM_SECT_PER_BIT-1);
+
+	if (sbnr > ebnr)
+		return;
+
+	/*
+	 * ok, (capacity & 7) != 0 sometimes, but who cares...
+	 * we count rs_{total,left} in bits, not sectors.
+	 */
+	spin_lock_irq(&mdev->al_lock);
+	count = drbd_bm_count_bits(mdev, sbnr, ebnr);
+	if (count) {
+		mdev->rs_failed += count;
+
+		if (inc_local(mdev)) {
+			drbd_try_clear_on_disk_bm(mdev, sector, count, FALSE);
+			dec_local(mdev);
+		}
+
+		/* just wake_up unconditional now, various lc_chaged(),
+		 * lc_put() in drbd_try_clear_on_disk_bm(). */
+		wake_up = 1;
+	}
+	spin_unlock_irq(&mdev->al_lock);
+	if (wake_up)
+		wake_up(&mdev->al_wait);
+}
--- linux-rt-2.6.31.orig/ubuntu/drbd/drbd_int.h
+++ linux-rt-2.6.31/ubuntu/drbd/drbd_int.h
@@ -0,0 +1,2321 @@
+/*
+  drbd_int.h
+
+  This file is part of DRBD by Philipp Reisner and Lars Ellenberg.
+
+  Copyright (C) 2001-2008, LINBIT Information Technologies GmbH.
+  Copyright (C) 1999-2008, Philipp Reisner <philipp.reisner@linbit.com>.
+  Copyright (C) 2002-2008, Lars Ellenberg <lars.ellenberg@linbit.com>.
+
+  drbd is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation; either version 2, or (at your option)
+  any later version.
+
+  drbd is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.	See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with drbd; see the file COPYING.  If not, write to
+  the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
+
+*/
+
+#ifndef _DRBD_INT_H
+#define _DRBD_INT_H
+
+#include <linux/compiler.h>
+#include <linux/types.h>
+#include <linux/version.h>
+#include <linux/list.h>
+#include <linux/sched.h>
+#include <linux/bitops.h>
+#include <linux/slab.h>
+#include <linux/crypto.h>
+#include <linux/tcp.h>
+#include <linux/mutex.h>
+#include <linux/major.h>
+#include <linux/blkdev.h>
+#include <linux/bio.h>
+#include <net/tcp.h>
+#include "lru_cache.h"
+
+#ifdef __CHECKER__
+# define __protected_by(x)       __attribute__((require_context(x,1,999,"rdwr")))
+# define __protected_read_by(x)  __attribute__((require_context(x,1,999,"read")))
+# define __protected_write_by(x) __attribute__((require_context(x,1,999,"write")))
+# define __must_hold(x)       __attribute__((context(x,1,1), require_context(x,1,999,"call")))
+#else
+# define __protected_by(x)
+# define __protected_read_by(x)
+# define __protected_write_by(x)
+# define __must_hold(x)
+#endif
+
+#define __no_warn(lock, stmt) do { __acquire(lock); stmt; __release(lock); } while (0)
+
+/* module parameter, defined in drbd_main.c */
+extern unsigned int minor_count;
+extern int allow_oos;
+extern unsigned int cn_idx;
+
+#ifdef DRBD_ENABLE_FAULTS
+extern int enable_faults;
+extern int fault_rate;
+extern int fault_devs;
+#endif
+
+extern char usermode_helper[];
+
+
+#ifndef TRUE
+#define TRUE 1
+#endif
+#ifndef FALSE
+#define FALSE 0
+#endif
+
+/* I don't remember why XCPU ...
+ * This is used to wake the asender,
+ * and to interrupt sending the sending task
+ * on disconnect.
+ */
+#define DRBD_SIG SIGXCPU
+
+/* This is used to stop/restart our threads.
+ * Cannot use SIGTERM nor SIGKILL, since these
+ * are sent out by init on runlevel changes
+ * I choose SIGHUP for now.
+ */
+#define DRBD_SIGKILL SIGHUP
+
+/* All EEs on the free list should have ID_VACANT (== 0)
+ * freshly allocated EEs get !ID_VACANT (== 1)
+ * so if it says "cannot dereference null pointer at adress 0x00000001",
+ * it is most likely one of these :( */
+
+#define ID_IN_SYNC      (4711ULL)
+#define ID_OUT_OF_SYNC  (4712ULL)
+
+#define ID_SYNCER (-1ULL)
+#define ID_VACANT 0
+#define is_syncer_block_id(id) ((id) == ID_SYNCER)
+
+struct drbd_conf;
+
+#ifdef DBG_ALL_SYMBOLS
+# define STATIC
+#else
+# define STATIC static
+#endif
+
+/*
+ * Some Message Macros
+ *************************/
+
+#define DUMPP(A)   ERR(#A " = %p in %s:%d\n", (A), __FILE__, __LINE__);
+#define DUMPLU(A)  ERR(#A " = %lu in %s:%d\n", (unsigned long)(A), __FILE__, __LINE__);
+#define DUMPLLU(A) ERR(#A " = %llu in %s:%d\n", (unsigned long long)(A), __FILE__, __LINE__);
+#define DUMPLX(A)  ERR(#A " = %lx in %s:%d\n", (A), __FILE__, __LINE__);
+#define DUMPI(A)   ERR(#A " = %d in %s:%d\n", (int)(A), __FILE__, __LINE__);
+
+
+#define PRINTK(level, fmt, args...) \
+	printk(level "drbd%d: " fmt, \
+		mdev->minor , ##args)
+
+#define ALERT(fmt, args...) PRINTK(KERN_ALERT, fmt , ##args)
+#define ERR(fmt, args...)   PRINTK(KERN_ERR, fmt , ##args)
+/* nowadays, WARN() is defined as BUG() without crash in bug.h */
+#define drbd_WARN(fmt, args...)  PRINTK(KERN_WARNING, fmt , ##args)
+#define INFO(fmt, args...)  PRINTK(KERN_INFO, fmt , ##args)
+#define DBG(fmt, args...)   PRINTK(KERN_DEBUG, fmt , ##args)
+
+#define D_ASSERT(exp)	if (!(exp)) \
+	 ERR("ASSERT( " #exp " ) in %s:%d\n", __FILE__, __LINE__)
+
+#define ERR_IF(exp) if (({				\
+	int _b = (exp) != 0;				\
+	if (_b) ERR("%s: (%s) in %s:%d\n",		\
+		__func__, #exp, __FILE__, __LINE__);	\
+	 _b;						\
+	}))
+
+/* Defines to control fault insertion */
+enum {
+    DRBD_FAULT_MD_WR = 0,	/* meta data write */
+    DRBD_FAULT_MD_RD,		/*           read  */
+    DRBD_FAULT_RS_WR,		/* resync          */
+    DRBD_FAULT_RS_RD,
+    DRBD_FAULT_DT_WR,		/* data            */
+    DRBD_FAULT_DT_RD,
+    DRBD_FAULT_DT_RA,		/* data read ahead */
+    DRBD_FAULT_BM_ALLOC,        /* bitmap allocation */
+    DRBD_FAULT_AL_EE,		/* alloc ee */
+
+    DRBD_FAULT_MAX,
+};
+
+#ifdef DRBD_ENABLE_FAULTS
+extern unsigned int
+_drbd_insert_fault(struct drbd_conf *mdev, unsigned int type);
+static inline int
+drbd_insert_fault(struct drbd_conf *mdev, unsigned int type) {
+    return fault_rate &&
+	    (enable_faults & (1<<type)) &&
+	    _drbd_insert_fault(mdev, type);
+}
+#define FAULT_ACTIVE(_m, _t) (drbd_insert_fault((_m), (_t)))
+
+#else
+#define FAULT_ACTIVE(_m, _t) (0)
+#endif
+
+/* integer division, round _UP_ to the next integer */
+#define div_ceil(A, B) ((A)/(B) + ((A)%(B) ? 1 : 0))
+/* usual integer division */
+#define div_floor(A, B) ((A)/(B))
+
+/* drbd_meta-data.c (still in drbd_main.c) */
+/* 4th incarnation of the disk layout. */
+#define DRBD_MD_MAGIC (DRBD_MAGIC+4)
+
+extern struct drbd_conf **minor_table;
+extern struct ratelimit_state drbd_ratelimit_state;
+
+/***
+ * on the wire
+ *********************************************************************/
+
+enum Drbd_Packet_Cmd {
+	/* receiver (data socket) */
+	Data              = 0x00,
+	DataReply         = 0x01, /* Response to DataRequest */
+	RSDataReply       = 0x02, /* Response to RSDataRequest */
+	Barrier           = 0x03,
+	ReportBitMap      = 0x04,
+	BecomeSyncTarget  = 0x05,
+	BecomeSyncSource  = 0x06,
+	UnplugRemote      = 0x07, /* Used at various times to hint the peer */
+	DataRequest       = 0x08, /* Used to ask for a data block */
+	RSDataRequest     = 0x09, /* Used to ask for a data block for resync */
+	SyncParam         = 0x0a,
+	ReportProtocol    = 0x0b,
+	ReportUUIDs       = 0x0c,
+	ReportSizes       = 0x0d,
+	ReportState       = 0x0e,
+	ReportSyncUUID    = 0x0f,
+	AuthChallenge     = 0x10,
+	AuthResponse      = 0x11,
+	StateChgRequest   = 0x12,
+
+	/* asender (meta socket */
+	Ping              = 0x13,
+	PingAck           = 0x14,
+	RecvAck           = 0x15, /* Used in protocol B */
+	WriteAck          = 0x16, /* Used in protocol C */
+	RSWriteAck        = 0x17, /* Is a WriteAck, additionally call set_in_sync(). */
+	DiscardAck        = 0x18, /* Used in proto C, two-primaries conflict detection */
+	NegAck            = 0x19, /* Sent if local disk is unusable */
+	NegDReply         = 0x1a, /* Local disk is broken... */
+	NegRSDReply       = 0x1b, /* Local disk is broken... */
+	BarrierAck        = 0x1c,
+	StateChgReply     = 0x1d,
+
+	/* "new" commands, no longer fitting into the ordering scheme above */
+
+	OVRequest         = 0x1e, /* data socket */
+	OVReply           = 0x1f,
+	OVResult          = 0x20, /* meta socket */
+	CsumRSRequest     = 0x21, /* data socket */
+	RSIsInSync        = 0x22, /* meta socket */
+	SyncParam89       = 0x23, /* data socket, protocol version 89 replacement for SyncParam */
+	ReportCBitMap     = 0x24, /* compressed or otherwise encoded bitmap transfer */
+
+	MAX_CMD           = 0x25,
+	MayIgnore         = 0x100, /* Flag to test if (cmd > MayIgnore) ... */
+	MAX_OPT_CMD       = 0x101,
+
+	/* special command ids for handshake */
+
+	HandShakeM        = 0xfff1, /* First Packet on the MetaSock */
+	HandShakeS        = 0xfff2, /* First Packet on the Socket */
+
+	HandShake         = 0xfffe  /* FIXED for the next century! */
+};
+
+static inline const char *cmdname(enum Drbd_Packet_Cmd cmd)
+{
+	/* THINK may need to become several global tables
+	 * when we want to support more than
+	 * one PRO_VERSION */
+	static const char *cmdnames[] = {
+		[Data]		   = "Data",
+		[DataReply]	   = "DataReply",
+		[RSDataReply]	   = "RSDataReply",
+		[Barrier]	   = "Barrier",
+		[ReportBitMap]	   = "ReportBitMap",
+		[BecomeSyncTarget] = "BecomeSyncTarget",
+		[BecomeSyncSource] = "BecomeSyncSource",
+		[UnplugRemote]	   = "UnplugRemote",
+		[DataRequest]	   = "DataRequest",
+		[RSDataRequest]    = "RSDataRequest",
+		[SyncParam]	   = "SyncParam",
+		[SyncParam89]	   = "SyncParam89",
+		[ReportProtocol]   = "ReportProtocol",
+		[ReportUUIDs]	   = "ReportUUIDs",
+		[ReportSizes]	   = "ReportSizes",
+		[ReportState]	   = "ReportState",
+		[ReportSyncUUID]   = "ReportSyncUUID",
+		[AuthChallenge]    = "AuthChallenge",
+		[AuthResponse]	   = "AuthResponse",
+		[Ping]		   = "Ping",
+		[PingAck]	   = "PingAck",
+		[RecvAck]	   = "RecvAck",
+		[WriteAck]	   = "WriteAck",
+		[RSWriteAck]	   = "RSWriteAck",
+		[DiscardAck]	   = "DiscardAck",
+		[NegAck]	   = "NegAck",
+		[NegDReply]	   = "NegDReply",
+		[NegRSDReply]	   = "NegRSDReply",
+		[BarrierAck]	   = "BarrierAck",
+		[StateChgRequest]  = "StateChgRequest",
+		[StateChgReply]    = "StateChgReply",
+		[OVRequest]        = "OVRequest",
+		[OVReply]          = "OVReply",
+		[OVResult]         = "OVResult",
+		[CsumRSRequest]    = "CsumRSRequest",
+		[RSIsInSync]       = "RSIsInSync",
+		[ReportCBitMap]    = "ReportCBitMap",
+		[MAX_CMD]	   = NULL,
+	};
+
+	if (cmd == HandShakeM)
+		return "HandShakeM";
+	if (cmd == HandShakeS)
+		return "HandShakeS";
+	if (cmd == HandShake)
+		return "HandShake";
+	if (cmd >= MAX_CMD)
+		return "Unknown";
+	return cmdnames[cmd];
+}
+
+/* for sending/receiving the bitmap,
+ * possibly in some encoding scheme */
+struct bm_xfer_ctx {
+	/* "const"
+	 * stores total bits and long words
+	 * of the bitmap, so we don't need to
+	 * call the accessor functions over and again. */
+	unsigned long bm_bits;
+	unsigned long bm_words;
+	/* during xfer, current position within the bitmap */
+	unsigned long bit_offset;
+	unsigned long word_offset;
+
+	/* statistics; index: (h->command == ReportBitMap) */
+	unsigned packets[2];
+	unsigned bytes[2];
+};
+
+extern void INFO_bm_xfer_stats(struct drbd_conf *mdev,
+		const char *direction, struct bm_xfer_ctx *c);
+
+static inline void bm_xfer_ctx_bit_to_word_offset(struct bm_xfer_ctx *c)
+{
+	/* word_offset counts "native long words" (32 or 64 bit),
+	 * aligned at 64 bit.
+	 * Encoded packet may end at an unaligned bit offset.
+	 * In case a fallback clear text packet is transmitted in
+	 * between, we adjust this offset back to the last 64bit
+	 * aligned "native long word", which makes coding and decoding
+	 * the plain text bitmap much more convenient.  */
+#if BITS_PER_LONG == 64
+	c->word_offset = c->bit_offset >> 6;
+#elif BITS_PER_LONG == 32
+	c->word_offset = c->bit_offset >> 5;
+	c->word_offset &= ~(1UL);
+#else
+# error "unsupported BITS_PER_LONG"
+#endif
+}
+
+/* This is the layout for a packet on the wire.
+ * The byteorder is the network byte order.
+ *     (except block_id and barrier fields.
+ *	these are pointers to local structs
+ *	and have no relevance for the partner,
+ *	which just echoes them as received.)
+ *
+ * NOTE that the payload starts at a long aligned offset,
+ * regardless of 32 or 64 bit arch!
+ */
+struct Drbd_Header {
+	u32	  magic;
+	u16	  command;
+	u16	  length;	/* bytes of data after this header */
+	u8	  payload[0];
+} __attribute((packed));
+/* 8 bytes. packet FIXED for the next century! */
+
+/*
+ * short commands, packets without payload, plain Drbd_Header:
+ *   Ping
+ *   PingAck
+ *   BecomeSyncTarget
+ *   BecomeSyncSource
+ *   UnplugRemote
+ */
+
+/*
+ * commands with out-of-struct payload:
+ *   ReportBitMap    (no additional fields)
+ *   Data, DataReply (see Drbd_Data_Packet)
+ *   ReportCBitMap (see receive_compressed_bitmap)
+ */
+
+/* these defines must not be changed without changing the protocol version */
+#define DP_HARDBARRIER	      1
+#define DP_RW_SYNC	      2
+#define DP_MAY_SET_IN_SYNC    4
+
+struct Drbd_Data_Packet {
+	struct Drbd_Header head;
+	u64	    sector;    /* 64 bits sector number */
+	u64	    block_id;  /* to identify the request in protocol B&C */
+	u32	    seq_num;
+	u32	    dp_flags;
+} __attribute((packed));
+
+/*
+ * commands which share a struct:
+ *  Drbd_BlockAck_Packet:
+ *   RecvAck (proto B), WriteAck (proto C),
+ *   DiscardAck (proto C, two-primaries conflict detection)
+ *  Drbd_BlockRequest_Packet:
+ *   DataRequest, RSDataRequest
+ */
+struct Drbd_BlockAck_Packet {
+	struct Drbd_Header head;
+	u64	    sector;
+	u64	    block_id;
+	u32	    blksize;
+	u32	    seq_num;
+} __attribute((packed));
+
+
+struct Drbd_BlockRequest_Packet {
+	struct Drbd_Header head;
+	u64 sector;
+	u64 block_id;
+	u32 blksize;
+	u32 pad;	/* to multiple of 8 Byte */
+} __attribute((packed));
+
+/*
+ * commands with their own struct for additional fields:
+ *   HandShake
+ *   Barrier
+ *   BarrierAck
+ *   SyncParam
+ *   ReportParams
+ */
+
+struct Drbd_HandShake_Packet {
+	struct Drbd_Header head;	/* 8 bytes */
+	u32 protocol_min;
+	u32 feature_flags;
+	u32 protocol_max;
+
+	/* should be more than enough for future enhancements
+	 * for now, feature_flags and the reserverd array shall be zero.
+	 */
+
+	u32 _pad;
+	u64 reserverd[7];
+} __attribute((packed));
+/* 80 bytes, FIXED for the next century */
+
+struct Drbd_Barrier_Packet {
+	struct Drbd_Header head;
+	u32 barrier;	/* barrier number _handle_ only */
+	u32 pad;	/* to multiple of 8 Byte */
+} __attribute((packed));
+
+struct Drbd_BarrierAck_Packet {
+	struct Drbd_Header head;
+	u32 barrier;
+	u32 set_size;
+} __attribute((packed));
+
+struct Drbd_SyncParam_Packet {
+	struct Drbd_Header head;
+	u32 rate;
+
+	      /* Since protocol version 88 and higher. */
+	char verify_alg[0];
+} __attribute((packed));
+
+struct Drbd_SyncParam89_Packet {
+	struct Drbd_Header head;
+	u32 rate;
+        /* protocol version 89: */
+	char verify_alg[SHARED_SECRET_MAX];
+	char csums_alg[SHARED_SECRET_MAX];
+} __attribute((packed));
+
+struct Drbd_Protocol_Packet {
+	struct Drbd_Header head;
+	u32 protocol;
+	u32 after_sb_0p;
+	u32 after_sb_1p;
+	u32 after_sb_2p;
+	u32 want_lose;
+	u32 two_primaries;
+
+              /* Since protocol version 87 and higher. */
+	char integrity_alg[0];
+
+} __attribute((packed));
+
+struct Drbd_GenCnt_Packet {
+	struct Drbd_Header head;
+	u64 uuid[EXT_UUID_SIZE];
+} __attribute((packed));
+
+struct Drbd_SyncUUID_Packet {
+	struct Drbd_Header head;
+	u64	    uuid;
+} __attribute((packed));
+
+struct Drbd_Sizes_Packet {
+	struct Drbd_Header head;
+	u64	    d_size;  /* size of disk */
+	u64	    u_size;  /* user requested size */
+	u64	    c_size;  /* current exported size */
+	u32	    max_segment_size;  /* Maximal size of a BIO */
+	u32	    queue_order_type;
+} __attribute((packed));
+
+struct Drbd_State_Packet {
+	struct Drbd_Header head;
+	u32	    state;
+} __attribute((packed));
+
+struct Drbd_Req_State_Packet {
+	struct Drbd_Header head;
+	u32	    mask;
+	u32	    val;
+} __attribute((packed));
+
+struct Drbd_RqS_Reply_Packet {
+	struct Drbd_Header head;
+	u32	    retcode;
+} __attribute((packed));
+
+struct Drbd06_Parameter_P {
+	u64	  size;
+	u32	  state;
+	u32	  blksize;
+	u32	  protocol;
+	u32	  version;
+	u32	  gen_cnt[5];
+	u32	  bit_map_gen[5];
+} __attribute((packed));
+
+struct Drbd_Discard_Packet {
+	struct Drbd_Header head;
+	u64	    block_id;
+	u32	    seq_num;
+	u32	    pad;
+} __attribute((packed));
+
+/* Valid values for the encoding field.
+ * Bump proto version when changing this. */
+enum Drbd_bitmap_code {
+	RLE_VLI_Bytes = 0,
+	RLE_VLI_BitsFibD_0_1 = 1,
+	RLE_VLI_BitsFibD_1_1 = 2,
+	RLE_VLI_BitsFibD_1_2 = 3,
+	RLE_VLI_BitsFibD_2_3 = 4,
+	RLE_VLI_BitsFibD_3_5 = 5,
+};
+
+struct Drbd_Compressed_Bitmap_Packet {
+	struct Drbd_Header head;
+	/* (encoding & 0x0f): actual encoding, see enum Drbd_bitmap_code
+	 * (encoding & 0x80): polarity (set/unset) of first runlength
+	 * ((encoding >> 4) & 0x07): pad_bits, number of trailing zero bits
+	 * used to pad up to head.length bytes
+	 */
+	u8 encoding;
+
+	u8 code[0];
+} __attribute((packed));
+
+static inline enum Drbd_bitmap_code
+DCBP_get_code(struct Drbd_Compressed_Bitmap_Packet *p)
+{
+	return (enum Drbd_bitmap_code)(p->encoding & 0x0f);
+}
+
+static inline void
+DCBP_set_code(struct Drbd_Compressed_Bitmap_Packet *p, enum Drbd_bitmap_code code)
+{
+	BUG_ON(code & ~0xf);
+	p->encoding = (p->encoding & ~0xf) | code;
+}
+
+static inline int
+DCBP_get_start(struct Drbd_Compressed_Bitmap_Packet *p)
+{
+	return (p->encoding & 0x80) != 0;
+}
+
+static inline void
+DCBP_set_start(struct Drbd_Compressed_Bitmap_Packet *p, int set)
+{
+	p->encoding = (p->encoding & ~0x80) | (set ? 0x80 : 0);
+}
+
+static inline int
+DCBP_get_pad_bits(struct Drbd_Compressed_Bitmap_Packet *p)
+{
+	return (p->encoding >> 4) & 0x7;
+}
+
+static inline void
+DCBP_set_pad_bits(struct Drbd_Compressed_Bitmap_Packet *p, int n)
+{
+	BUG_ON(n & ~0x7);
+	p->encoding = (p->encoding & (~0x7 << 4)) | (n << 4);
+}
+
+/* one bitmap packet, including the Drbd_Header,
+ * should fit within one _architecture independend_ page.
+ * so we need to use the fixed size 4KiB page size
+ * most architechtures have used for a long time.
+ */
+#define BM_PACKET_PAYLOAD_BYTES (4096 - sizeof(struct Drbd_Header))
+#define BM_PACKET_WORDS (BM_PACKET_PAYLOAD_BYTES/sizeof(long))
+#define BM_PACKET_VLI_BYTES_MAX (4096 - sizeof(struct Drbd_Compressed_Bitmap_Packet))
+#if (PAGE_SIZE < 4096)
+/* drbd_send_bitmap / receive_bitmap would break horribly */
+#error "PAGE_SIZE too small"
+#endif
+
+union Drbd_Polymorph_Packet {
+	struct Drbd_Header		head;
+	struct Drbd_HandShake_Packet	HandShake;
+	struct Drbd_Data_Packet		Data;
+	struct Drbd_BlockAck_Packet	BlockAck;
+	struct Drbd_Barrier_Packet	Barrier;
+	struct Drbd_BarrierAck_Packet	BarrierAck;
+	struct Drbd_SyncParam89_Packet	SyncParam89;
+	struct Drbd_Protocol_Packet	Protocol;
+	struct Drbd_Sizes_Packet	Sizes;
+	struct Drbd_GenCnt_Packet	GenCnt;
+	struct Drbd_State_Packet	State;
+	struct Drbd_Req_State_Packet	ReqState;
+	struct Drbd_RqS_Reply_Packet	RqSReply;
+	struct Drbd_BlockRequest_Packet	BlockRequest;
+} __attribute((packed));
+
+/**********************************************************************/
+enum Drbd_thread_state {
+	None,
+	Running,
+	Exiting,
+	Restarting
+};
+
+struct Drbd_thread {
+	spinlock_t t_lock;
+	struct task_struct *task;
+	struct completion stop;
+	enum Drbd_thread_state t_state;
+	int (*function) (struct Drbd_thread *);
+	struct drbd_conf *mdev;
+	int reset_cpu_mask;
+};
+
+static inline enum Drbd_thread_state get_t_state(struct Drbd_thread *thi)
+{
+	/* THINK testing the t_state seems to be uncritical in all cases
+	 * (but thread_{start,stop}), so we can read it *without* the lock.
+	 *	--lge */
+
+	smp_rmb();
+	return thi->t_state;
+}
+
+
+/*
+ * Having this as the first member of a struct provides sort of "inheritance".
+ * "derived" structs can be "drbd_queue_work()"ed.
+ * The callback should know and cast back to the descendant struct.
+ * drbd_request and Tl_epoch_entry are descendants of drbd_work.
+ */
+struct drbd_work;
+typedef int (*drbd_work_cb)(struct drbd_conf *, struct drbd_work *, int cancel);
+struct drbd_work {
+	struct list_head list;
+	drbd_work_cb cb;
+};
+
+struct drbd_barrier;
+struct drbd_request {
+	struct drbd_work w;
+	struct drbd_conf *mdev;
+	struct bio *private_bio;
+	struct hlist_node colision;
+	sector_t sector;
+	unsigned int size;
+	unsigned int epoch; /* barrier_nr */
+
+	/* barrier_nr: used to check on "completion" whether this req was in
+	 * the current epoch, and we therefore have to close it,
+	 * starting a new epoch...
+	 */
+
+	/* up to here, the struct layout is identical to Tl_epoch_entry;
+	 * we might be able to use that to our advantage...  */
+
+	struct list_head tl_requests; /* ring list in the transfer log */
+	struct bio *master_bio;       /* master bio pointer */
+	unsigned long rq_state; /* see comments above _req_mod() */
+	int seq_num;
+	unsigned long start_time;
+};
+
+struct drbd_barrier {
+	struct drbd_work w;
+	struct list_head requests; /* requests before */
+	struct drbd_barrier *next; /* pointer to the next barrier */
+	unsigned int br_number;  /* the barriers identifier. */
+	int n_req;	/* number of requests attached before this barrier */
+};
+
+struct drbd_request;
+
+/* These Tl_epoch_entries may be in one of 6 lists:
+   active_ee .. data packet being written
+   sync_ee   .. syncer block being written
+   done_ee   .. block written, need to send WriteAck
+   read_ee   .. [RS]DataRequest being read
+*/
+
+struct drbd_epoch {
+	struct list_head list;
+	unsigned int barrier_nr;
+	atomic_t epoch_size; /* increased on every request added. */
+	atomic_t active;     /* increased on every req. added, and dec on every finished. */
+	unsigned long flags;
+};
+
+/* drbd_epoch flag bits */
+enum {
+	DE_BARRIER_IN_NEXT_EPOCH_ISSUED,
+	DE_BARRIER_IN_NEXT_EPOCH_DONE,
+	DE_CONTAINS_A_BARRIER,
+	DE_HAVE_BARRIER_NUMBER,
+	DE_IS_FINISHING,
+};
+
+struct Tl_epoch_entry {
+	struct drbd_work    w;
+	struct drbd_conf *mdev;
+	struct bio *private_bio;
+	struct hlist_node colision;
+	sector_t sector;
+	unsigned int size;
+	struct drbd_epoch *epoch;
+
+	/* up to here, the struct layout is identical to drbd_request;
+	 * we might be able to use that to our advantage...  */
+
+	unsigned int flags;
+	u64    block_id;
+};
+
+struct digest_info {
+	int digest_size;
+	void *digest;
+};
+
+/* ee flag bits */
+enum {
+	__EE_CALL_AL_COMPLETE_IO,
+	__EE_CONFLICT_PENDING,
+	__EE_MAY_SET_IN_SYNC,
+	__EE_IS_BARRIER,
+};
+#define EE_CALL_AL_COMPLETE_IO (1<<__EE_CALL_AL_COMPLETE_IO)
+#define EE_CONFLICT_PENDING    (1<<__EE_CONFLICT_PENDING)
+#define EE_MAY_SET_IN_SYNC     (1<<__EE_MAY_SET_IN_SYNC)
+#define EE_IS_BARRIER          (1<<__EE_IS_BARRIER)
+
+/* global flag bits */
+enum {
+	CREATE_BARRIER,		/* next Data is preceeded by a Barrier */
+	SIGNAL_ASENDER,		/* whether asender wants to be interrupted */
+	SEND_PING,		/* whether asender should send a ping asap */
+	WORK_PENDING,		/* completion flag for drbd_disconnect */
+	STOP_SYNC_TIMER,	/* tell timer to cancel itself */
+	UNPLUG_QUEUED,		/* only relevant with kernel 2.4 */
+	UNPLUG_REMOTE,		/* sending a "UnplugRemote" could help */
+	MD_DIRTY,		/* current uuids and flags not yet on disk */
+	DISCARD_CONCURRENT,	/* Set on one node, cleared on the peer! */
+	USE_DEGR_WFC_T,		/* degr-wfc-timeout instead of wfc-timeout. */
+	CLUSTER_ST_CHANGE,	/* Cluster wide state change going on... */
+	CL_ST_CHG_SUCCESS,
+	CL_ST_CHG_FAIL,
+	CRASHED_PRIMARY,	/* This node was a crashed primary.
+				 * Gets cleared when the state.conn
+				 * goes into Connected state. */
+	WRITE_BM_AFTER_RESYNC,	/* A kmalloc() during resync failed */
+	NO_BARRIER_SUPP,	/* underlying block device doesn't implement barriers */
+	CONSIDER_RESYNC,
+
+	MD_NO_BARRIER,		/* meta data device does not support barriers,
+				   so don't even try */
+	SUSPEND_IO,		/* suspend application io */
+	BITMAP_IO,		/* suspend application io;
+				   once no more io in flight, start bitmap io */
+	BITMAP_IO_QUEUED,       /* Started bitmap IO */
+	RESYNC_AFTER_NEG,       /* Resync after online grow after the attach&negotiate finished. */
+	NET_CONGESTED,		/* The data socket is congested */
+};
+
+struct drbd_bitmap; /* opaque for drbd_conf */
+
+/* TODO sort members for performance
+ * MAYBE group them further */
+
+/* THINK maybe we actually want to use the default "event/%s" worker threads
+ * or similar in linux 2.6, which uses per cpu data and threads.
+ *
+ * To be general, this might need a spin_lock member.
+ * For now, please use the mdev->req_lock to protect list_head,
+ * see drbd_queue_work below.
+ */
+struct drbd_work_queue {
+	struct list_head q;
+	struct semaphore s; /* producers up it, worker down()s it */
+	spinlock_t q_lock;  /* to protect the list. */
+};
+
+struct drbd_socket {
+	struct drbd_work_queue work;
+	struct mutex mutex;
+	struct socket    *socket;
+	/* this way we get our
+	 * send/receive buffers off the stack */
+	union Drbd_Polymorph_Packet sbuf;
+	union Drbd_Polymorph_Packet rbuf;
+};
+
+struct drbd_md {
+	u64 md_offset;		/* sector offset to 'super' block */
+
+	u64 la_size_sect;	/* last agreed size, unit sectors */
+	u64 uuid[UUID_SIZE];
+	u64 device_uuid;
+	u32 flags;
+	u32 md_size_sect;
+
+	s32 al_offset;	/* signed relative sector offset to al area */
+	s32 bm_offset;	/* signed relative sector offset to bitmap */
+
+	/* u32 al_nr_extents;	   important for restoring the AL
+	 * is stored into  sync_conf.al_extents, which in turn
+	 * gets applied to act_log->nr_elements
+	 */
+};
+
+/* for sync_conf and other types... */
+#define NL_PACKET(name, number, fields) struct name { fields };
+#define NL_INTEGER(pn,pr,member) int member;
+#define NL_INT64(pn,pr,member) __u64 member;
+#define NL_BIT(pn,pr,member)   unsigned member:1;
+#define NL_STRING(pn,pr,member,len) unsigned char member[len]; int member ## _len;
+#include "linux/drbd_nl.h"
+
+struct drbd_backing_dev {
+	struct block_device *backing_bdev;
+	struct block_device *md_bdev;
+	struct file *lo_file;
+	struct file *md_file;
+	struct drbd_md md;
+	struct disk_conf dc; /* The user provided config... */
+	sector_t known_size; /* last known size of that backing device */
+};
+
+struct drbd_md_io {
+	struct drbd_conf *mdev;
+	struct completion event;
+	int error;
+};
+
+struct bm_io_work {
+	struct drbd_work w;
+	char *why;
+	int (*io_fn)(struct drbd_conf *mdev);
+	void (*done)(struct drbd_conf *mdev, int rv);
+};
+
+enum write_ordering_e {
+	WO_none,
+	WO_drain_io,
+	WO_bdev_flush,
+	WO_bio_barrier
+};
+
+struct drbd_conf {
+	/* things that are stored as / read from meta data on disk */
+	unsigned long flags;
+
+	/* configured by drbdsetup */
+	struct net_conf *net_conf; /* protected by inc_net() and dec_net() */
+	struct syncer_conf sync_conf;
+	struct drbd_backing_dev *bc __protected_by(local);
+
+	sector_t p_size;     /* partner's disk size */
+	struct request_queue *rq_queue;
+	struct block_device *this_bdev;
+	struct gendisk	    *vdisk;
+
+	struct drbd_socket data; /* data/barrier/cstate/parameter packets */
+	struct drbd_socket meta; /* ping/ack (metadata) packets */
+	int agreed_pro_version;  /* actually used protocol version */
+	unsigned long last_received; /* in jiffies, either socket */
+	unsigned int ko_count;
+	struct drbd_work  resync_work,
+			  unplug_work,
+			  md_sync_work;
+	struct timer_list resync_timer;
+	struct timer_list md_sync_timer;
+
+	/* Used after attach while negotiating new disk state. */
+	union drbd_state_t new_state_tmp;
+
+	union drbd_state_t state;
+	wait_queue_head_t misc_wait;
+	wait_queue_head_t state_wait;  /* upon each state change. */
+	unsigned int send_cnt;
+	unsigned int recv_cnt;
+	unsigned int read_cnt;
+	unsigned int writ_cnt;
+	unsigned int al_writ_cnt;
+	unsigned int bm_writ_cnt;
+	atomic_t ap_bio_cnt;	 /* Requests we need to complete */
+	atomic_t ap_pending_cnt; /* AP data packets on the wire, ack expected */
+	atomic_t rs_pending_cnt; /* RS request/data packets on the wire */
+	atomic_t unacked_cnt;	 /* Need to send replys for */
+	atomic_t local_cnt;	 /* Waiting for local completion */
+	atomic_t net_cnt;	 /* Users of net_conf */
+	spinlock_t req_lock;
+	struct drbd_barrier *unused_spare_barrier; /* for pre-allocation */
+	struct drbd_barrier *newest_barrier;
+	struct drbd_barrier *oldest_barrier;
+	struct list_head out_of_sequence_requests;
+	struct hlist_head *tl_hash;
+	unsigned int tl_hash_s;
+
+	/* blocks to sync in this run [unit BM_BLOCK_SIZE] */
+	unsigned long rs_total;
+	/* number of sync IOs that failed in this run */
+	unsigned long rs_failed;
+	/* Syncer's start time [unit jiffies] */
+	unsigned long rs_start;
+	/* cumulated time in PausedSyncX state [unit jiffies] */
+	unsigned long rs_paused;
+	/* block not up-to-date at mark [unit BM_BLOCK_SIZE] */
+	unsigned long rs_mark_left;
+	/* marks's time [unit jiffies] */
+	unsigned long rs_mark_time;
+	/* skipped because csum was equeal [unit BM_BLOCK_SIZE] */
+	unsigned long rs_same_csum;
+	sector_t ov_position;
+	/* Start sector of out of sync range. */
+	sector_t ov_last_oos_start;
+	/* size of out-of-sync range in sectors. */
+	sector_t ov_last_oos_size;
+	unsigned long ov_left;
+	struct crypto_hash *csums_tfm;
+	struct crypto_hash *verify_tfm;
+
+	struct Drbd_thread receiver;
+	struct Drbd_thread worker;
+	struct Drbd_thread asender;
+	struct drbd_bitmap *bitmap;
+	unsigned long bm_resync_fo; /* bit offset for drbd_bm_find_next */
+
+	/* Used to track operations of resync... */
+	struct lru_cache *resync;
+	/* Number of locked elements in resync LRU */
+	unsigned int resync_locked;
+	/* resync extent number waiting for application requests */
+	unsigned int resync_wenr;
+
+	int open_cnt;
+	u64 *p_uuid;
+	struct drbd_epoch *current_epoch;
+	spinlock_t epoch_lock;
+	unsigned int epochs;
+	enum write_ordering_e write_ordering;
+	struct list_head active_ee; /* IO in progress */
+	struct list_head sync_ee;   /* IO in progress */
+	struct list_head done_ee;   /* send ack */
+	struct list_head read_ee;   /* IO in progress */
+	struct list_head net_ee;    /* zero-copy network send in progress */
+	struct hlist_head *ee_hash; /* is proteced by req_lock! */
+	unsigned int ee_hash_s;
+
+	/* this one is protected by ee_lock, single thread */
+	struct Tl_epoch_entry *last_write_w_barrier;
+
+	int next_barrier_nr;
+	struct hlist_head *app_reads_hash; /* is proteced by req_lock */
+	struct list_head resync_reads;
+	atomic_t pp_in_use;
+	wait_queue_head_t ee_wait;
+	struct page *md_io_page;	/* one page buffer for md_io */
+	struct page *md_io_tmpp;	/* for hardsect != 512 [s390 only?] */
+	struct mutex md_io_mutex;	/* protects the md_io_buffer */
+	spinlock_t al_lock;
+	wait_queue_head_t al_wait;
+	struct lru_cache *act_log;	/* activity log */
+	unsigned int al_tr_number;
+	int al_tr_cycle;
+	int al_tr_pos;   /* position of the next transaction in the journal */
+	struct crypto_hash *cram_hmac_tfm;
+	struct crypto_hash *integrity_w_tfm; /* to be used by the worker thread */
+	struct crypto_hash *integrity_r_tfm; /* to be used by the receiver thread */
+	void *int_dig_out;
+	void *int_dig_in;
+	void *int_dig_vv;
+	wait_queue_head_t seq_wait;
+	atomic_t packet_seq;
+	unsigned int peer_seq;
+	spinlock_t peer_seq_lock;
+	unsigned int minor;
+	unsigned long comm_bm_set; /* communicated number of set bits. */
+	cpumask_t cpu_mask;
+	struct bm_io_work bm_io_work;
+	u64 ed_uuid; /* UUID of the exposed data */
+	struct mutex state_mutex;
+	char congestion_reason;  /* Why we where congested... */
+};
+
+static inline struct drbd_conf *minor_to_mdev(unsigned int minor)
+{
+	struct drbd_conf *mdev;
+
+	mdev = minor < minor_count ? minor_table[minor] : NULL;
+
+	return mdev;
+}
+
+static inline unsigned int mdev_to_minor(struct drbd_conf *mdev)
+{
+	return mdev->minor;
+}
+
+/* returns 1 if it was successfull,
+ * returns 0 if there was no data socket.
+ * so wherever you are going to use the data.socket, e.g. do
+ * if (!drbd_get_data_sock(mdev))
+ *	return 0;
+ *	CODE();
+ * drbd_put_data_sock(mdev);
+ */
+static inline int drbd_get_data_sock(struct drbd_conf *mdev)
+{
+	mutex_lock(&mdev->data.mutex);
+	/* drbd_disconnect() could have called drbd_free_sock()
+	 * while we were waiting in down()... */
+	if (unlikely(mdev->data.socket == NULL)) {
+		mutex_unlock(&mdev->data.mutex);
+		return 0;
+	}
+	return 1;
+}
+
+static inline void drbd_put_data_sock(struct drbd_conf *mdev)
+{
+	mutex_unlock(&mdev->data.mutex);
+}
+
+/*
+ * function declarations
+ *************************/
+
+/* drbd_main.c */
+
+enum chg_state_flags {
+	ChgStateHard	= 1,
+	ChgStateVerbose = 2,
+	ChgWaitComplete = 4,
+	ChgSerialize    = 8,
+	ChgOrdered      = ChgWaitComplete + ChgSerialize,
+};
+
+extern void drbd_init_set_defaults(struct drbd_conf *mdev);
+extern int drbd_change_state(struct drbd_conf *mdev, enum chg_state_flags f,
+			union drbd_state_t mask, union drbd_state_t val);
+extern void drbd_force_state(struct drbd_conf *, union drbd_state_t,
+			union drbd_state_t);
+extern int _drbd_request_state(struct drbd_conf *, union drbd_state_t,
+			union drbd_state_t, enum chg_state_flags);
+extern int __drbd_set_state(struct drbd_conf *, union drbd_state_t,
+			    enum chg_state_flags, struct completion *done);
+extern void print_st_err(struct drbd_conf *, union drbd_state_t,
+			union drbd_state_t, int);
+extern int  drbd_thread_start(struct Drbd_thread *thi);
+extern void _drbd_thread_stop(struct Drbd_thread *thi, int restart, int wait);
+#ifdef CONFIG_SMP
+extern void drbd_thread_current_set_cpu(struct drbd_conf *mdev);
+extern cpumask_t drbd_calc_cpu_mask(struct drbd_conf *mdev);
+#else
+#define drbd_thread_current_set_cpu(A) ({})
+#define drbd_calc_cpu_mask(A) CPU_MASK_ALL
+#endif
+extern void drbd_free_resources(struct drbd_conf *mdev);
+extern void tl_release(struct drbd_conf *mdev, unsigned int barrier_nr,
+		       unsigned int set_size);
+extern void tl_clear(struct drbd_conf *mdev);
+extern void _tl_add_barrier(struct drbd_conf *, struct drbd_barrier *);
+extern void drbd_free_sock(struct drbd_conf *mdev);
+extern int drbd_send(struct drbd_conf *mdev, struct socket *sock,
+			void *buf, size_t size, unsigned msg_flags);
+extern int drbd_send_protocol(struct drbd_conf *mdev);
+extern int _drbd_send_uuids(struct drbd_conf *mdev);
+extern int drbd_send_uuids(struct drbd_conf *mdev);
+extern int drbd_send_sync_uuid(struct drbd_conf *mdev, u64 val);
+extern int drbd_send_sizes(struct drbd_conf *mdev);
+extern int _drbd_send_state(struct drbd_conf *mdev);
+extern int drbd_send_state(struct drbd_conf *mdev);
+extern int _drbd_send_cmd(struct drbd_conf *mdev, struct socket *sock,
+			enum Drbd_Packet_Cmd cmd, struct Drbd_Header *h,
+			size_t size, unsigned msg_flags);
+#define USE_DATA_SOCKET 1
+#define USE_META_SOCKET 0
+extern int drbd_send_cmd(struct drbd_conf *mdev, int use_data_socket,
+			enum Drbd_Packet_Cmd cmd, struct Drbd_Header *h,
+			size_t size);
+extern int drbd_send_cmd2(struct drbd_conf *mdev, enum Drbd_Packet_Cmd cmd,
+			char *data, size_t size);
+extern int drbd_send_sync_param(struct drbd_conf *mdev, struct syncer_conf *sc);
+extern int drbd_send_b_ack(struct drbd_conf *mdev, u32 barrier_nr,
+			u32 set_size);
+extern int drbd_send_ack(struct drbd_conf *mdev, enum Drbd_Packet_Cmd cmd,
+			struct Tl_epoch_entry *e);
+extern int drbd_send_ack_rp(struct drbd_conf *mdev, enum Drbd_Packet_Cmd cmd,
+			struct Drbd_BlockRequest_Packet *rp);
+extern int drbd_send_ack_dp(struct drbd_conf *mdev, enum Drbd_Packet_Cmd cmd,
+			struct Drbd_Data_Packet *dp);
+extern int drbd_send_ack_ex(struct drbd_conf *mdev, enum Drbd_Packet_Cmd cmd,
+			    sector_t sector, int blksize, u64 block_id);
+extern int _drbd_send_page(struct drbd_conf *mdev, struct page *page,
+			int offset, size_t size);
+extern int drbd_send_block(struct drbd_conf *mdev, enum Drbd_Packet_Cmd cmd,
+			   struct Tl_epoch_entry *e);
+extern int drbd_send_dblock(struct drbd_conf *mdev, struct drbd_request *req);
+extern int _drbd_send_barrier(struct drbd_conf *mdev,
+			struct drbd_barrier *barrier);
+extern int drbd_send_drequest(struct drbd_conf *mdev, int cmd,
+			      sector_t sector, int size, u64 block_id);
+extern int drbd_send_drequest_csum(struct drbd_conf *mdev,
+				   sector_t sector,int size,
+				   void *digest, int digest_size,
+				   enum Drbd_Packet_Cmd cmd);
+extern int drbd_send_ov_request(struct drbd_conf *mdev,sector_t sector,int size);
+
+extern int drbd_send_bitmap(struct drbd_conf *mdev);
+extern int _drbd_send_bitmap(struct drbd_conf *mdev);
+extern int drbd_send_sr_reply(struct drbd_conf *mdev, int retcode);
+extern void drbd_free_bc(struct drbd_backing_dev *bc);
+extern int drbd_io_error(struct drbd_conf *mdev, int forcedetach);
+extern void drbd_mdev_cleanup(struct drbd_conf *mdev);
+
+/* drbd_meta-data.c (still in drbd_main.c) */
+extern void drbd_md_sync(struct drbd_conf *mdev);
+extern int  drbd_md_read(struct drbd_conf *mdev, struct drbd_backing_dev *bdev);
+/* maybe define them below as inline? */
+extern void drbd_uuid_set(struct drbd_conf *mdev, int idx, u64 val) __must_hold(local);
+extern void _drbd_uuid_set(struct drbd_conf *mdev, int idx, u64 val) __must_hold(local);
+extern void drbd_uuid_new_current(struct drbd_conf *mdev) __must_hold(local);
+extern void _drbd_uuid_new_current(struct drbd_conf *mdev) __must_hold(local);
+extern void drbd_uuid_set_bm(struct drbd_conf *mdev, u64 val) __must_hold(local);
+extern void drbd_md_set_flag(struct drbd_conf *mdev, int flags) __must_hold(local);
+extern void drbd_md_clear_flag(struct drbd_conf *mdev, int flags)__must_hold(local);
+extern int drbd_md_test_flag(struct drbd_backing_dev *, int);
+extern void drbd_md_mark_dirty(struct drbd_conf *mdev);
+extern void drbd_queue_bitmap_io(struct drbd_conf *mdev,
+				 int (*io_fn)(struct drbd_conf *),
+				 void (*done)(struct drbd_conf *, int),
+				 char *why);
+extern int drbd_bmio_set_n_write(struct drbd_conf *mdev);
+extern int drbd_bmio_clear_n_write(struct drbd_conf *mdev);
+extern int drbd_bitmap_io(struct drbd_conf *mdev, int (*io_fn)(struct drbd_conf *), char *why);
+
+
+/* Meta data layout
+   We reserve a 128MB Block (4k aligned)
+   * either at the end of the backing device
+   * or on a seperate meta data device. */
+
+#define MD_RESERVED_SECT (128LU << 11)  /* 128 MB, unit sectors */
+/* The following numbers are sectors */
+#define MD_AL_OFFSET 8	    /* 8 Sectors after start of meta area */
+#define MD_AL_MAX_SIZE 64   /* = 32 kb LOG  ~ 3776 extents ~ 14 GB Storage */
+/* Allows up to about 3.8TB */
+#define MD_BM_OFFSET (MD_AL_OFFSET + MD_AL_MAX_SIZE)
+
+/* Since the smalles IO unit is usually 512 byte */
+#define MD_HARDSECT_B	 9
+#define MD_HARDSECT	 (1<<MD_HARDSECT_B)
+
+/* activity log */
+#define AL_EXTENTS_PT ((MD_HARDSECT-12)/8-1) /* 61 ; Extents per 512B sector */
+#define AL_EXTENT_SIZE_B 22		 /* One extent represents 4M Storage */
+#define AL_EXTENT_SIZE (1<<AL_EXTENT_SIZE_B)
+
+#if BITS_PER_LONG == 32
+#define LN2_BPL 5
+#define cpu_to_lel(A) cpu_to_le32(A)
+#define lel_to_cpu(A) le32_to_cpu(A)
+#elif BITS_PER_LONG == 64
+#define LN2_BPL 6
+#define cpu_to_lel(A) cpu_to_le64(A)
+#define lel_to_cpu(A) le64_to_cpu(A)
+#else
+#error "LN2 of BITS_PER_LONG unknown!"
+#endif
+
+/* resync bitmap */
+/* 16MB sized 'bitmap extent' to track syncer usage */
+struct bm_extent {
+	struct lc_element lce;
+	int rs_left; /* number of bits set (out of sync) in this extent. */
+	int rs_failed; /* number of failed resync requests in this extent. */
+	unsigned long flags;
+};
+
+#define BME_NO_WRITES  0  /* bm_extent.flags: no more requests on this one! */
+#define BME_LOCKED     1  /* bm_extent.flags: syncer active on this one. */
+
+/* drbd_bitmap.c */
+/*
+ * We need to store one bit for a block.
+ * Example: 1GB disk @ 4096 byte blocks ==> we need 32 KB bitmap.
+ * Bit 0 ==> local node thinks this block is binary identical on both nodes
+ * Bit 1 ==> local node thinks this block needs to be synced.
+ */
+
+#define BM_BLOCK_SIZE_B  12			 /* 4k per bit */
+#define BM_BLOCK_SIZE	 (1<<BM_BLOCK_SIZE_B)
+/* (9+3) : 512 bytes @ 8 bits; representing 16M storage
+ * per sector of on disk bitmap */
+#define BM_EXT_SIZE_B	 (BM_BLOCK_SIZE_B + MD_HARDSECT_B + 3)  /* = 24 */
+#define BM_EXT_SIZE	 (1<<BM_EXT_SIZE_B)
+
+#if (BM_EXT_SIZE_B != 24) || (BM_BLOCK_SIZE_B != 12)
+#error "HAVE YOU FIXED drbdmeta AS WELL??"
+#endif
+
+/* thus many _storage_ sectors are described by one bit */
+#define BM_SECT_TO_BIT(x)   ((x)>>(BM_BLOCK_SIZE_B-9))
+#define BM_BIT_TO_SECT(x)   ((sector_t)(x)<<(BM_BLOCK_SIZE_B-9))
+#define BM_SECT_PER_BIT     BM_BIT_TO_SECT(1)
+
+/* bit to represented kilo byte conversion */
+#define Bit2KB(bits) ((bits)<<(BM_BLOCK_SIZE_B-10))
+
+/* in which _bitmap_ extent (resp. sector) the bit for a certain
+ * _storage_ sector is located in */
+#define BM_SECT_TO_EXT(x)   ((x)>>(BM_EXT_SIZE_B-9))
+
+/* how much _storage_ sectors we have per bitmap sector */
+#define BM_EXT_TO_SECT(x)   ((sector_t)(x) << (BM_EXT_SIZE_B-9))
+#define BM_SECT_PER_EXT     BM_EXT_TO_SECT(1)
+
+/* in one sector of the bitmap, we have this many activity_log extents. */
+#define AL_EXT_PER_BM_SECT  (1 << (BM_EXT_SIZE_B - AL_EXTENT_SIZE_B))
+#define BM_WORDS_PER_AL_EXT (1 << (AL_EXTENT_SIZE_B-BM_BLOCK_SIZE_B-LN2_BPL))
+
+#define BM_BLOCKS_PER_BM_EXT_B (BM_EXT_SIZE_B - BM_BLOCK_SIZE_B)
+#define BM_BLOCKS_PER_BM_EXT_MASK  ((1<<BM_BLOCKS_PER_BM_EXT_B) - 1)
+
+/* the extent in "PER_EXTENT" below is an activity log extent
+ * we need that many (long words/bytes) to store the bitmap
+ *		     of one AL_EXTENT_SIZE chunk of storage.
+ * we can store the bitmap for that many AL_EXTENTS within
+ * one sector of the _on_disk_ bitmap:
+ * bit	 0	  bit 37   bit 38	     bit (512*8)-1
+ *	     ...|........|........|.. // ..|........|
+ * sect. 0	 `296	  `304			   ^(512*8*8)-1
+ *
+#define BM_WORDS_PER_EXT    ( (AL_EXT_SIZE/BM_BLOCK_SIZE) / BITS_PER_LONG )
+#define BM_BYTES_PER_EXT    ( (AL_EXT_SIZE/BM_BLOCK_SIZE) / 8 )  // 128
+#define BM_EXT_PER_SECT	    ( 512 / BM_BYTES_PER_EXTENT )	 //   4
+ */
+
+#define DRBD_MAX_SECTORS_32 (0xffffffffLU)
+#define DRBD_MAX_SECTORS_BM \
+	  ((MD_RESERVED_SECT - MD_BM_OFFSET) * (1LL<<(BM_EXT_SIZE_B-9)))
+#if DRBD_MAX_SECTORS_BM < DRBD_MAX_SECTORS_32
+#define DRBD_MAX_SECTORS      DRBD_MAX_SECTORS_BM
+#define DRBD_MAX_SECTORS_FLEX DRBD_MAX_SECTORS_BM
+#elif !defined(CONFIG_LBD) && BITS_PER_LONG == 32
+#define DRBD_MAX_SECTORS      DRBD_MAX_SECTORS_32
+#define DRBD_MAX_SECTORS_FLEX DRBD_MAX_SECTORS_32
+#else
+#define DRBD_MAX_SECTORS      DRBD_MAX_SECTORS_BM
+/* 16 TB in units of sectors */
+#if BITS_PER_LONG == 32
+/* adjust by one page worth of bitmap,
+ * so we won't wrap around in drbd_bm_find_next_bit.
+ * you should use 64bit OS for that much storage, anyways. */
+#define DRBD_MAX_SECTORS_FLEX BM_BIT_TO_SECT(0xffff7fff)
+#else
+#define DRBD_MAX_SECTORS_FLEX BM_BIT_TO_SECT(0x1LU << 32)
+#endif
+#endif
+
+/* Sector shift value for the "hash" functions of tl_hash and ee_hash tables.
+ * With a value of 6 all IO in one 32K block make it to the same slot of the
+ * hash table. */
+#define HT_SHIFT 6
+#define DRBD_MAX_SEGMENT_SIZE (1U<<(9+HT_SHIFT))
+
+/* Number of elements in the app_reads_hash */
+#define APP_R_HSIZE 15
+
+extern int  drbd_bm_init(struct drbd_conf *mdev);
+extern int  drbd_bm_resize(struct drbd_conf *mdev, sector_t sectors);
+extern void drbd_bm_cleanup(struct drbd_conf *mdev);
+extern void drbd_bm_set_all(struct drbd_conf *mdev);
+extern void drbd_bm_clear_all(struct drbd_conf *mdev);
+extern int  drbd_bm_set_bits(
+		struct drbd_conf *mdev, unsigned long s, unsigned long e);
+extern int  drbd_bm_clear_bits(
+		struct drbd_conf *mdev, unsigned long s, unsigned long e);
+/* bm_set_bits variant for use while holding drbd_bm_lock */
+extern int _drbd_bm_set_bits(struct drbd_conf *mdev,
+		const unsigned long s, const unsigned long e);
+extern int  drbd_bm_test_bit(struct drbd_conf *mdev, unsigned long bitnr);
+extern int  drbd_bm_e_weight(struct drbd_conf *mdev, unsigned long enr);
+extern int  drbd_bm_write_sect(struct drbd_conf *mdev, unsigned long enr) __must_hold(local);
+extern int  drbd_bm_read(struct drbd_conf *mdev) __must_hold(local);
+extern int  drbd_bm_write(struct drbd_conf *mdev) __must_hold(local);
+extern unsigned long drbd_bm_ALe_set_all(struct drbd_conf *mdev,
+		unsigned long al_enr);
+extern size_t	     drbd_bm_words(struct drbd_conf *mdev);
+extern unsigned long drbd_bm_bits(struct drbd_conf *mdev);
+extern sector_t      drbd_bm_capacity(struct drbd_conf *mdev);
+extern unsigned long drbd_bm_find_next(struct drbd_conf *mdev, unsigned long bm_fo);
+/* bm_find_next variants for use while you hold drbd_bm_lock() */
+extern unsigned long _drbd_bm_find_next(struct drbd_conf *mdev, unsigned long bm_fo);
+extern unsigned long _drbd_bm_find_next_zero(struct drbd_conf *mdev, unsigned long bm_fo);
+extern unsigned long drbd_bm_total_weight(struct drbd_conf *mdev);
+extern int drbd_bm_rs_done(struct drbd_conf *mdev);
+/* for receive_bitmap */
+extern void drbd_bm_merge_lel(struct drbd_conf *mdev, size_t offset,
+		size_t number, unsigned long *buffer);
+/* for _drbd_send_bitmap and drbd_bm_write_sect */
+extern void drbd_bm_get_lel(struct drbd_conf *mdev, size_t offset,
+		size_t number, unsigned long *buffer);
+
+extern void drbd_bm_lock(struct drbd_conf *mdev, char *why);
+extern void drbd_bm_unlock(struct drbd_conf *mdev);
+
+extern void _drbd_bm_recount_bits(struct drbd_conf *mdev, char *file, int line);
+#define drbd_bm_recount_bits(mdev) \
+	_drbd_bm_recount_bits(mdev, __FILE__, __LINE__)
+extern int drbd_bm_count_bits(struct drbd_conf *mdev, const unsigned long s, const unsigned long e);
+/* drbd_main.c */
+
+extern struct kmem_cache *drbd_request_cache;
+extern struct kmem_cache *drbd_ee_cache;
+extern mempool_t *drbd_request_mempool;
+extern mempool_t *drbd_ee_mempool;
+
+extern struct page *drbd_pp_pool; /* drbd's page pool */
+extern spinlock_t   drbd_pp_lock;
+extern int	    drbd_pp_vacant;
+extern wait_queue_head_t drbd_pp_wait;
+
+extern rwlock_t global_state_lock;
+
+extern struct drbd_conf *drbd_new_device(unsigned int minor);
+extern void drbd_free_mdev(struct drbd_conf *mdev);
+
+/* Dynamic tracing framework */
+#ifdef ENABLE_DYNAMIC_TRACE
+
+extern int proc_details;
+extern int trace_type;
+extern int trace_devs;
+extern int trace_level;
+
+enum {
+	TraceLvlAlways = 0,
+	TraceLvlSummary,
+	TraceLvlMetrics,
+	TraceLvlAll,
+	TraceLvlMax
+};
+
+enum {
+	TraceTypePacket = 0x00000001,
+	TraceTypeRq	= 0x00000002,
+	TraceTypeUuid	= 0x00000004,
+	TraceTypeResync = 0x00000008,
+	TraceTypeEE	= 0x00000010,
+	TraceTypeUnplug = 0x00000020,
+	TraceTypeNl	= 0x00000040,
+	TraceTypeALExts = 0x00000080,
+	TraceTypeIntRq  = 0x00000100,
+	TraceTypeMDIO   = 0x00000200,
+	TraceTypeEpochs = 0x00000400,
+};
+
+static inline int
+is_trace(unsigned int type, unsigned int level) {
+	return (trace_level >= level) && (type & trace_type);
+}
+static inline int
+is_mdev_trace(struct drbd_conf *mdev, unsigned int type, unsigned int level) {
+	return is_trace(type, level) &&
+		((1 << mdev_to_minor(mdev)) & trace_devs);
+}
+
+#define MTRACE(type, lvl, code...) \
+do { \
+	if (unlikely(is_mdev_trace(mdev, type, lvl))) { \
+		code \
+	} \
+} while (0)
+
+#define TRACE(type, lvl, code...) \
+do { \
+	if (unlikely(is_trace(type, lvl))) { \
+		code \
+	} \
+} while (0)
+
+/* Buffer printing support
+ * dbg_print_flags: used for Flags arg to drbd_print_buffer
+ * - DBGPRINT_BUFFADDR; if set, each line starts with the
+ *	 virtual address of the line being output. If clear,
+ *	 each line starts with the offset from the beginning
+ *	 of the buffer. */
+enum dbg_print_flags {
+    DBGPRINT_BUFFADDR = 0x0001,
+};
+
+extern void drbd_print_uuid(struct drbd_conf *mdev, unsigned int idx);
+
+extern void drbd_print_buffer(const char *prefix, unsigned int flags, int size,
+			      const void *buffer, const void *buffer_va,
+			      unsigned int length);
+
+/* Bio printing support */
+extern void _dump_bio(const char *pfx, struct drbd_conf *mdev, struct bio *bio, int complete, struct drbd_request *r);
+
+static inline void dump_bio(struct drbd_conf *mdev,
+		struct bio *bio, int complete, struct drbd_request *r)
+{
+	MTRACE(TraceTypeRq, TraceLvlSummary,
+	       _dump_bio("Rq", mdev, bio, complete, r);
+		);
+}
+
+static inline void dump_internal_bio(const char *pfx, struct drbd_conf *mdev, struct bio *bio, int complete)
+{
+	MTRACE(TraceTypeIntRq, TraceLvlSummary,
+	       _dump_bio(pfx, mdev, bio, complete, NULL);
+		);
+}
+
+/* Packet dumping support */
+extern void _dump_packet(struct drbd_conf *mdev, struct socket *sock,
+			 int recv, union Drbd_Polymorph_Packet *p,
+			 char *file, int line);
+
+static inline void
+dump_packet(struct drbd_conf *mdev, struct socket *sock,
+	    int recv, union Drbd_Polymorph_Packet *p, char *file, int line)
+{
+	MTRACE(TraceTypePacket, TraceLvlSummary,
+	       _dump_packet(mdev, sock, recv, p, file, line);
+		);
+}
+
+#else
+
+#define MTRACE(ignored...) ((void)0)
+#define TRACE(ignored...) ((void)0)
+
+#define dump_bio(ignored...) ((void)0)
+#define dump_internal_bio(ignored...) ((void)0)
+#define dump_packet(ignored...) ((void)0)
+#endif
+
+/* drbd_req */
+extern int drbd_make_request_26(struct request_queue *q, struct bio *bio);
+extern int drbd_read_remote(struct drbd_conf *mdev, struct drbd_request *req);
+extern int drbd_merge_bvec(struct request_queue *q, struct bvec_merge_data *bvm, struct bio_vec *bvec);
+extern int is_valid_ar_handle(struct drbd_request *, sector_t);
+
+
+/* drbd_nl.c */
+extern void drbd_suspend_io(struct drbd_conf *mdev);
+extern void drbd_resume_io(struct drbd_conf *mdev);
+extern char *ppsize(char *buf, unsigned long long size);
+extern sector_t drbd_new_dev_size(struct drbd_conf *,
+		struct drbd_backing_dev *);
+enum determin_dev_size_enum { dev_size_error = -1, unchanged = 0, shrunk = 1, grew = 2 };
+extern enum determin_dev_size_enum drbd_determin_dev_size(struct drbd_conf *) __must_hold(local);
+extern void resync_after_online_grow(struct drbd_conf *);
+extern void drbd_setup_queue_param(struct drbd_conf *mdev, unsigned int) __must_hold(local);
+extern int drbd_set_role(struct drbd_conf *mdev, enum drbd_role new_role,
+		int force);
+enum drbd_disk_state drbd_try_outdate_peer(struct drbd_conf *mdev);
+extern int drbd_khelper(struct drbd_conf *mdev, char *cmd);
+
+/* drbd_worker.c */
+extern int drbd_worker(struct Drbd_thread *thi);
+extern void drbd_alter_sa(struct drbd_conf *mdev, int na);
+extern void drbd_start_resync(struct drbd_conf *mdev, enum drbd_conns side);
+extern void resume_next_sg(struct drbd_conf *mdev);
+extern void suspend_other_sg(struct drbd_conf *mdev);
+extern int drbd_resync_finished(struct drbd_conf *mdev);
+/* maybe rather drbd_main.c ? */
+extern int drbd_md_sync_page_io(struct drbd_conf *mdev,
+		struct drbd_backing_dev *bdev, sector_t sector, int rw);
+extern void drbd_ov_oos_found(struct drbd_conf*, sector_t, int);
+
+static inline void ov_oos_print(struct drbd_conf *mdev)
+{
+	if (mdev->ov_last_oos_size) {
+		ERR("Out of sync: start=%llu, size=%lu (sectors)\n",
+		     (unsigned long long)mdev->ov_last_oos_start,
+		     (unsigned long)mdev->ov_last_oos_size);
+	}
+	mdev->ov_last_oos_size=0;
+}
+
+
+void drbd_csum(struct drbd_conf *, struct crypto_hash *, struct bio *, void *);
+/* worker callbacks */
+extern int w_req_cancel_conflict(struct drbd_conf *, struct drbd_work *, int);
+extern int w_read_retry_remote(struct drbd_conf *, struct drbd_work *, int);
+extern int w_e_end_data_req(struct drbd_conf *, struct drbd_work *, int);
+extern int w_e_end_rsdata_req(struct drbd_conf *, struct drbd_work *, int);
+extern int w_e_end_csum_rs_req(struct drbd_conf *, struct drbd_work *, int);
+extern int w_e_end_ov_reply(struct drbd_conf *, struct drbd_work *, int);
+extern int w_e_end_ov_req(struct drbd_conf *, struct drbd_work *, int);
+extern int w_ov_finished(struct drbd_conf *, struct drbd_work *, int);
+extern int w_resync_inactive(struct drbd_conf *, struct drbd_work *, int);
+extern int w_resume_next_sg(struct drbd_conf *, struct drbd_work *, int);
+extern int w_io_error(struct drbd_conf *, struct drbd_work *, int);
+extern int w_send_write_hint(struct drbd_conf *, struct drbd_work *, int);
+extern int w_make_resync_request(struct drbd_conf *, struct drbd_work *, int);
+extern int w_send_dblock(struct drbd_conf *, struct drbd_work *, int);
+extern int w_send_barrier(struct drbd_conf *, struct drbd_work *, int);
+extern int w_send_read_req(struct drbd_conf *, struct drbd_work *, int);
+extern int w_prev_work_done(struct drbd_conf *, struct drbd_work *, int);
+extern int w_e_reissue(struct drbd_conf *, struct drbd_work *, int);
+
+extern void resync_timer_fn(unsigned long data);
+
+/* drbd_receiver.c */
+extern int drbd_release_ee(struct drbd_conf *mdev, struct list_head *list);
+extern struct Tl_epoch_entry *drbd_alloc_ee(struct drbd_conf *mdev,
+					    u64 id,
+					    sector_t sector,
+					    unsigned int data_size,
+					    gfp_t gfp_mask) __must_hold(local);
+extern void drbd_free_ee(struct drbd_conf *mdev, struct Tl_epoch_entry *e);
+extern void drbd_wait_ee_list_empty(struct drbd_conf *mdev,
+		struct list_head *head);
+extern void _drbd_wait_ee_list_empty(struct drbd_conf *mdev,
+		struct list_head *head);
+extern void drbd_set_recv_tcq(struct drbd_conf *mdev, int tcq_enabled);
+extern void _drbd_clear_done_ee(struct drbd_conf *mdev);
+
+/* yes, there is kernel_setsockopt, but only since 2.6.18. we don't need to
+ * mess with get_fs/set_fs, we know we are KERNEL_DS always. */
+static inline int drbd_setsockopt(struct socket *sock, int level, int optname,
+			char __user *optval, int optlen)
+{
+	int err;
+	if (level == SOL_SOCKET)
+		err = sock_setsockopt(sock, level, optname, optval, optlen);
+	else
+		err = sock->ops->setsockopt(sock, level, optname, optval,
+					    optlen);
+	return err;
+}
+
+static inline void drbd_tcp_cork(struct socket *sock)
+{
+	int __user val = 1;
+	(void) drbd_setsockopt(sock, SOL_TCP, TCP_CORK,
+			(char __user *)&val, sizeof(val));
+}
+
+static inline void drbd_tcp_uncork(struct socket *sock)
+{
+	int __user val = 0;
+	(void) drbd_setsockopt(sock, SOL_TCP, TCP_CORK,
+			(char __user *)&val, sizeof(val));
+}
+
+static inline void drbd_tcp_nodelay(struct socket *sock)
+{
+	int __user val = 1;
+	(void) drbd_setsockopt(sock, SOL_TCP, TCP_NODELAY,
+			(char __user *)&val, sizeof(val));
+}
+
+static inline void drbd_tcp_quickack(struct socket *sock)
+{
+	int __user val = 1;
+	(void) drbd_setsockopt(sock, SOL_TCP, TCP_QUICKACK,
+			(char __user *)&val, sizeof(val));
+}
+
+void drbd_bump_write_ordering(struct drbd_conf *mdev, enum write_ordering_e wo);
+
+/* drbd_proc.c */
+extern struct proc_dir_entry *drbd_proc;
+extern struct file_operations drbd_proc_fops;
+extern const char *conns_to_name(enum drbd_conns s);
+extern const char *roles_to_name(enum drbd_role s);
+
+/* drbd_actlog.c */
+extern void drbd_al_begin_io(struct drbd_conf *mdev, sector_t sector);
+extern void drbd_al_complete_io(struct drbd_conf *mdev, sector_t sector);
+extern void drbd_rs_complete_io(struct drbd_conf *mdev, sector_t sector);
+extern int drbd_rs_begin_io(struct drbd_conf *mdev, sector_t sector);
+extern int drbd_try_rs_begin_io(struct drbd_conf *mdev, sector_t sector);
+extern void drbd_rs_cancel_all(struct drbd_conf *mdev);
+extern int drbd_rs_del_all(struct drbd_conf *mdev);
+extern void drbd_rs_failed_io(struct drbd_conf *mdev,
+		sector_t sector, int size);
+extern int drbd_al_read_log(struct drbd_conf *mdev, struct drbd_backing_dev *);
+extern void __drbd_set_in_sync(struct drbd_conf *mdev, sector_t sector,
+		int size, const char *file, const unsigned int line);
+#define drbd_set_in_sync(mdev, sector, size) \
+	__drbd_set_in_sync(mdev, sector, size, __FILE__, __LINE__)
+extern void __drbd_set_out_of_sync(struct drbd_conf *mdev, sector_t sector,
+		int size, const char *file, const unsigned int line);
+#define drbd_set_out_of_sync(mdev, sector, size) \
+	__drbd_set_out_of_sync(mdev, sector, size, __FILE__, __LINE__)
+extern void drbd_al_apply_to_bm(struct drbd_conf *mdev);
+extern void drbd_al_to_on_disk_bm(struct drbd_conf *mdev);
+extern void drbd_al_shrink(struct drbd_conf *mdev);
+
+
+/* drbd_nl.c */
+
+void drbd_nl_cleanup(void);
+int __init drbd_nl_init(void);
+void drbd_bcast_state(struct drbd_conf *mdev, union drbd_state_t);
+void drbd_bcast_sync_progress(struct drbd_conf *mdev);
+void drbd_bcast_ee(struct drbd_conf *mdev,
+		const char *reason, const int dgs,
+		const char* seen_hash, const char* calc_hash,
+		const struct Tl_epoch_entry* e);
+
+
+/** DRBD State macros:
+ * These macros are used to express state changes in easily readable form.
+ *
+ * The NS macros expand to a mask and a value, that can be bit ored onto the
+ * current state as soon as the spinlock (req_lock) was taken.
+ *
+ * The _NS macros are used for state functions that get called with the
+ * spinlock. These macros expand directly to the new state value.
+ *
+ * Besides the basic forms NS() and _NS() additional _?NS[23] are defined
+ * to express state changes that affect more than one aspect of the state.
+ *
+ * E.g. NS2(conn, Connected, peer, Secondary)
+ * Means that the network connection was established and that the peer
+ * is in secondary role.
+ */
+#define peer_mask role_mask
+#define pdsk_mask disk_mask
+#define susp_mask 1
+#define user_isp_mask 1
+#define aftr_isp_mask 1
+
+#define NS(T, S) \
+	({ union drbd_state_t mask; mask.i = 0; mask.T = T##_mask; mask; }), \
+	({ union drbd_state_t val; val.i = 0; val.T = (S); val; })
+#define NS2(T1, S1, T2, S2) \
+	({ union drbd_state_t mask; mask.i = 0; mask.T1 = T1##_mask; \
+	  mask.T2 = T2##_mask; mask; }), \
+	({ union drbd_state_t val; val.i = 0; val.T1 = (S1); \
+	  val.T2 = (S2); val; })
+#define NS3(T1, S1, T2, S2, T3, S3) \
+	({ union drbd_state_t mask; mask.i = 0; mask.T1 = T1##_mask; \
+	  mask.T2 = T2##_mask; mask.T3 = T3##_mask; mask; }), \
+	({ union drbd_state_t val;  val.i = 0; val.T1 = (S1); \
+	  val.T2 = (S2); val.T3 = (S3); val; })
+
+#define _NS(D, T, S) \
+	D, ({ union drbd_state_t __ns; __ns.i = D->state.i; __ns.T = (S); __ns; })
+#define _NS2(D, T1, S1, T2, S2) \
+	D, ({ union drbd_state_t __ns; __ns.i = D->state.i; __ns.T1 = (S1); \
+	__ns.T2 = (S2); __ns; })
+#define _NS3(D, T1, S1, T2, S2, T3, S3) \
+	D, ({ union drbd_state_t __ns; __ns.i = D->state.i; __ns.T1 = (S1); \
+	__ns.T2 = (S2); __ns.T3 = (S3); __ns; })
+
+/*
+ * inline helper functions
+ *************************/
+
+static inline void drbd_state_lock(struct drbd_conf *mdev)
+{
+	wait_event(mdev->misc_wait,
+		   !test_and_set_bit(CLUSTER_ST_CHANGE, &mdev->flags));
+}
+
+static inline void drbd_state_unlock(struct drbd_conf *mdev)
+{
+	clear_bit(CLUSTER_ST_CHANGE, &mdev->flags);
+	wake_up(&mdev->misc_wait);
+}
+
+static inline int _drbd_set_state(struct drbd_conf *mdev,
+				   union drbd_state_t ns, enum chg_state_flags flags,
+				   struct completion *done)
+{
+	int rv;
+
+	read_lock(&global_state_lock);
+	rv = __drbd_set_state(mdev, ns, flags, done);
+	read_unlock(&global_state_lock);
+
+	return rv;
+}
+
+static inline int drbd_request_state(struct drbd_conf *mdev,
+				     union drbd_state_t mask,
+				     union drbd_state_t val)
+{
+	return _drbd_request_state(mdev, mask, val, ChgStateVerbose + ChgOrdered);
+}
+
+/**
+ * drbd_chk_io_error: Handles the on_io_error setting, should be called from
+ * all io completion handlers. See also drbd_io_error().
+ */
+static inline void __drbd_chk_io_error(struct drbd_conf *mdev, int forcedetach)
+{
+	switch (mdev->bc->dc.on_io_error) {
+	case PassOn:
+		if (!forcedetach) {
+			if (printk_ratelimit())
+				ERR("Local IO failed. Passing error on...\n");
+			break;
+		}
+		/* NOTE fall through to detach case if forcedetach set */
+	case Detach:
+	case CallIOEHelper:
+		if (mdev->state.disk > Failed) {
+			_drbd_set_state(_NS(mdev, disk, Failed), ChgStateHard, NULL);
+			ERR("Local IO failed. Detaching...\n");
+		}
+		break;
+	}
+}
+
+static inline void drbd_chk_io_error(struct drbd_conf *mdev,
+	int error, int forcedetach)
+{
+	if (error) {
+		unsigned long flags;
+		spin_lock_irqsave(&mdev->req_lock, flags);
+		__drbd_chk_io_error(mdev, forcedetach);
+		spin_unlock_irqrestore(&mdev->req_lock, flags);
+	}
+}
+
+/* Returns the first sector number of our meta data,
+ * which, for internal meta data, happens to be the maximum capacity
+ * we could agree upon with our peer
+ */
+static inline sector_t drbd_md_first_sector(struct drbd_backing_dev *bdev)
+{
+	switch (bdev->dc.meta_dev_idx) {
+	case DRBD_MD_INDEX_INTERNAL:
+	case DRBD_MD_INDEX_FLEX_INT:
+		return bdev->md.md_offset + bdev->md.bm_offset;
+	case DRBD_MD_INDEX_FLEX_EXT:
+	default:
+		return bdev->md.md_offset;
+	}
+}
+
+/* returns the last sector number of our meta data,
+ * to be able to catch out of band md access */
+static inline sector_t drbd_md_last_sector(struct drbd_backing_dev *bdev)
+{
+	switch (bdev->dc.meta_dev_idx) {
+	case DRBD_MD_INDEX_INTERNAL:
+	case DRBD_MD_INDEX_FLEX_INT:
+		return bdev->md.md_offset + MD_AL_OFFSET - 1;
+	case DRBD_MD_INDEX_FLEX_EXT:
+	default:
+		return bdev->md.md_offset + bdev->md.md_size_sect;
+	}
+}
+
+/* Returns the number of 512 byte sectors of the device */
+static inline sector_t drbd_get_capacity(struct block_device *bdev)
+{
+	/* return bdev ? get_capacity(bdev->bd_disk) : 0; */
+	return bdev ? bdev->bd_inode->i_size >> 9 : 0;
+}
+
+/* returns the capacity we announce to out peer.
+ * we clip ourselves at the various MAX_SECTORS, because if we don't,
+ * current implementation will oops sooner or later */
+static inline sector_t drbd_get_max_capacity(struct drbd_backing_dev *bdev)
+{
+	sector_t s;
+	switch (bdev->dc.meta_dev_idx) {
+	case DRBD_MD_INDEX_INTERNAL:
+	case DRBD_MD_INDEX_FLEX_INT:
+		s = drbd_get_capacity(bdev->backing_bdev)
+			? min_t(sector_t, DRBD_MAX_SECTORS_FLEX,
+					drbd_md_first_sector(bdev))
+			: 0;
+		break;
+	case DRBD_MD_INDEX_FLEX_EXT:
+		s = min_t(sector_t, DRBD_MAX_SECTORS_FLEX,
+				drbd_get_capacity(bdev->backing_bdev));
+		/* clip at maximum size the meta device can support */
+		s = min_t(sector_t, s,
+			BM_EXT_TO_SECT(bdev->md.md_size_sect
+				     - bdev->md.bm_offset));
+		break;
+	default:
+		s = min_t(sector_t, DRBD_MAX_SECTORS,
+				drbd_get_capacity(bdev->backing_bdev));
+	}
+	return s;
+}
+
+/* returns the sector number of our meta data 'super' block */
+static inline sector_t drbd_md_ss__(struct drbd_conf *mdev,
+				    struct drbd_backing_dev *bdev)
+{
+	switch (bdev->dc.meta_dev_idx) {
+	default: /* external, some index */
+		return MD_RESERVED_SECT * bdev->dc.meta_dev_idx;
+	case DRBD_MD_INDEX_INTERNAL:
+		/* with drbd08, internal meta data is always "flexible" */
+	case DRBD_MD_INDEX_FLEX_INT:
+		/* sizeof(struct md_on_disk_07) == 4k
+		 * position: last 4k aligned block of 4k size */
+		if (!bdev->backing_bdev) {
+			if (__ratelimit(&drbd_ratelimit_state)) {
+				ERR("bdev->backing_bdev==NULL\n");
+				dump_stack();
+			}
+			return 0;
+		}
+		return (drbd_get_capacity(bdev->backing_bdev) & ~7ULL)
+			- MD_AL_OFFSET;
+	case DRBD_MD_INDEX_FLEX_EXT:
+		return 0;
+	}
+}
+
+static inline void
+_drbd_queue_work(struct drbd_work_queue *q, struct drbd_work *w)
+{
+	list_add_tail(&w->list, &q->q);
+	up(&q->s);
+}
+
+static inline void
+drbd_queue_work_front(struct drbd_work_queue *q, struct drbd_work *w)
+{
+	unsigned long flags;
+	spin_lock_irqsave(&q->q_lock, flags);
+	list_add(&w->list, &q->q);
+	up(&q->s); /* within the spinlock,
+		      see comment near end of drbd_worker() */
+	spin_unlock_irqrestore(&q->q_lock, flags);
+}
+
+static inline void
+drbd_queue_work(struct drbd_work_queue *q, struct drbd_work *w)
+{
+	unsigned long flags;
+	spin_lock_irqsave(&q->q_lock, flags);
+	list_add_tail(&w->list, &q->q);
+	up(&q->s); /* within the spinlock,
+		      see comment near end of drbd_worker() */
+	spin_unlock_irqrestore(&q->q_lock, flags);
+}
+
+static inline void wake_asender(struct drbd_conf *mdev)
+{
+	if (test_bit(SIGNAL_ASENDER, &mdev->flags))
+		force_sig(DRBD_SIG, mdev->asender.task);
+}
+
+static inline void request_ping(struct drbd_conf *mdev)
+{
+	set_bit(SEND_PING, &mdev->flags);
+	wake_asender(mdev);
+}
+
+static inline int drbd_send_short_cmd(struct drbd_conf *mdev,
+	enum Drbd_Packet_Cmd cmd)
+{
+	struct Drbd_Header h;
+	return drbd_send_cmd(mdev, USE_DATA_SOCKET, cmd, &h, sizeof(h));
+}
+
+static inline int drbd_send_ping(struct drbd_conf *mdev)
+{
+	struct Drbd_Header h;
+	return drbd_send_cmd(mdev, USE_META_SOCKET, Ping, &h, sizeof(h));
+}
+
+static inline int drbd_send_ping_ack(struct drbd_conf *mdev)
+{
+	struct Drbd_Header h;
+	return drbd_send_cmd(mdev, USE_META_SOCKET, PingAck, &h, sizeof(h));
+}
+
+static inline void drbd_thread_stop(struct Drbd_thread *thi)
+{
+	_drbd_thread_stop(thi, FALSE, TRUE);
+}
+
+static inline void drbd_thread_stop_nowait(struct Drbd_thread *thi)
+{
+	_drbd_thread_stop(thi, FALSE, FALSE);
+}
+
+static inline void drbd_thread_restart_nowait(struct Drbd_thread *thi)
+{
+	_drbd_thread_stop(thi, TRUE, FALSE);
+}
+
+/* counts how many answer packets packets we expect from our peer,
+ * for either explicit application requests,
+ * or implicit barrier packets as necessary.
+ * increased:
+ *  w_send_barrier
+ *  _req_mod(req, queue_for_net_write or queue_for_net_read);
+ *    it is much easier and equally valid to count what we queue for the
+ *    worker, even before it actually was queued or send.
+ *    (drbd_make_request_common; recovery path on read io-error)
+ * decreased:
+ *  got_BarrierAck (respective tl_clear, tl_clear_barrier)
+ *  _req_mod(req, data_received)
+ *     [from receive_DataReply]
+ *  _req_mod(req, write_acked_by_peer or recv_acked_by_peer or neg_acked)
+ *     [from got_BlockAck (WriteAck, RecvAck)]
+ *     for some reason it is NOT decreased in got_NegAck,
+ *     but in the resulting cleanup code from report_params.
+ *     we should try to remember the reason for that...
+ *  _req_mod(req, send_failed or send_canceled)
+ *  _req_mod(req, connection_lost_while_pending)
+ *     [from tl_clear_barrier]
+ */
+static inline void inc_ap_pending(struct drbd_conf *mdev)
+{
+	atomic_inc(&mdev->ap_pending_cnt);
+}
+
+#define ERR_IF_CNT_IS_NEGATIVE(which)				\
+	if (atomic_read(&mdev->which) < 0)			\
+		ERR("in %s:%d: " #which " = %d < 0 !\n",	\
+		    __func__ , __LINE__ ,			\
+		    atomic_read(&mdev->which))
+
+#define dec_ap_pending(mdev)	do {				\
+	typecheck(struct drbd_conf *, mdev);			\
+	if (atomic_dec_and_test(&mdev->ap_pending_cnt))		\
+		wake_up(&mdev->misc_wait);			\
+	ERR_IF_CNT_IS_NEGATIVE(ap_pending_cnt); } while (0)
+
+/* counts how many resync-related answers we still expect from the peer
+ *		     increase			decrease
+ * SyncTarget sends RSDataRequest (and expects RSDataReply)
+ * SyncSource sends RSDataReply   (and expects WriteAck whith ID_SYNCER)
+ *					   (or NegAck with ID_SYNCER)
+ */
+static inline void inc_rs_pending(struct drbd_conf *mdev)
+{
+	atomic_inc(&mdev->rs_pending_cnt);
+}
+
+#define dec_rs_pending(mdev)	do {				\
+	typecheck(struct drbd_conf *, mdev);			\
+	atomic_dec(&mdev->rs_pending_cnt);			\
+	ERR_IF_CNT_IS_NEGATIVE(rs_pending_cnt); } while (0)
+
+/* counts how many answers we still need to send to the peer.
+ * increased on
+ *  receive_Data	unless protocol A;
+ *			we need to send a RecvAck (proto B)
+ *			or WriteAck (proto C)
+ *  receive_RSDataReply (recv_resync_read) we need to send a WriteAck
+ *  receive_DataRequest (receive_RSDataRequest) we need to send back Data
+ *  receive_Barrier_*	we need to send a BarrierAck
+ */
+static inline void inc_unacked(struct drbd_conf *mdev)
+{
+	atomic_inc(&mdev->unacked_cnt);
+}
+
+#define dec_unacked(mdev)	do {				\
+	typecheck(struct drbd_conf *, mdev);			\
+	atomic_dec(&mdev->unacked_cnt);				\
+	ERR_IF_CNT_IS_NEGATIVE(unacked_cnt); } while (0)
+
+#define sub_unacked(mdev, n)	do {				\
+	typecheck(struct drbd_conf *, mdev);			\
+	atomic_sub(n, &mdev->unacked_cnt);			\
+	ERR_IF_CNT_IS_NEGATIVE(unacked_cnt); } while (0)
+
+
+static inline void dec_net(struct drbd_conf *mdev)
+{
+	if (atomic_dec_and_test(&mdev->net_cnt))
+		wake_up(&mdev->misc_wait);
+}
+
+/**
+ * inc_net: Returns TRUE when it is ok to access mdev->net_conf. You
+ * should call dec_net() when finished looking at mdev->net_conf.
+ */
+static inline int inc_net(struct drbd_conf *mdev)
+{
+	int have_net_conf;
+
+	atomic_inc(&mdev->net_cnt);
+	have_net_conf = mdev->state.conn >= Unconnected;
+	if (!have_net_conf)
+		dec_net(mdev);
+	return have_net_conf;
+}
+
+/**
+ * inc_local: Returns TRUE when local IO is possible. If it returns
+ * TRUE you should call dec_local() after IO is completed.
+ */
+#define inc_local_if_state(M,MINS) __cond_lock(local, _inc_local_if_state(M,MINS))
+#define inc_local(M) __cond_lock(local, _inc_local_if_state(M,Inconsistent))
+
+static inline void dec_local(struct drbd_conf *mdev)
+{
+	__release(local);
+	if (atomic_dec_and_test(&mdev->local_cnt))
+		wake_up(&mdev->misc_wait);
+	D_ASSERT(atomic_read(&mdev->local_cnt) >= 0);
+}
+
+#ifndef __CHECKER__
+static inline int _inc_local_if_state(struct drbd_conf *mdev, enum drbd_disk_state mins)
+{
+	int io_allowed;
+
+	atomic_inc(&mdev->local_cnt);
+	io_allowed = (mdev->state.disk >= mins);
+	if (!io_allowed)
+		dec_local(mdev);
+	return io_allowed;
+}
+#else
+extern int _inc_local_if_state(struct drbd_conf *mdev, enum drbd_disk_state mins);
+#endif
+
+/* you must have an "inc_local" reference */
+static inline void drbd_get_syncer_progress(struct drbd_conf *mdev,
+		unsigned long *bits_left, unsigned int *per_mil_done)
+{
+	/*
+	 * this is to break it at compile time when we change that
+	 * (we may feel 4TB maximum storage per drbd is not enough)
+	 */
+	typecheck(unsigned long, mdev->rs_total);
+
+	/* note: both rs_total and rs_left are in bits, i.e. in
+	 * units of BM_BLOCK_SIZE.
+	 * for the percentage, we don't care. */
+
+	*bits_left = drbd_bm_total_weight(mdev) - mdev->rs_failed;
+	/* >> 10 to prevent overflow,
+	 * +1 to prevent division by zero */
+	if (*bits_left > mdev->rs_total) {
+		/* doh. maybe a logic bug somewhere.
+		 * may also be just a race condition
+		 * between this and a disconnect during sync.
+		 * for now, just prevent in-kernel buffer overflow.
+		 */
+		smp_rmb();
+		drbd_WARN("cs:%s rs_left=%lu > rs_total=%lu (rs_failed %lu)\n",
+				conns_to_name(mdev->state.conn),
+				*bits_left, mdev->rs_total, mdev->rs_failed);
+		*per_mil_done = 0;
+	} else {
+		/* make sure the calculation happens in long context */
+		unsigned long tmp = 1000UL -
+				(*bits_left >> 10)*1000UL
+				/ ((mdev->rs_total >> 10) + 1UL);
+		*per_mil_done = tmp;
+	}
+}
+
+
+/* this throttles on-the-fly application requests
+ * according to max_buffers settings;
+ * maybe re-implement using semaphores? */
+static inline int drbd_get_max_buffers(struct drbd_conf *mdev)
+{
+	int mxb = 1000000; /* arbitrary limit on open requests */
+	if (inc_net(mdev)) {
+		mxb = mdev->net_conf->max_buffers;
+		dec_net(mdev);
+	}
+	return mxb;
+}
+
+static inline int drbd_state_is_stable(union drbd_state_t s)
+{
+
+	/* DO NOT add a default clause, we want the compiler to warn us
+	 * for any newly introduced state we may have forgotten to add here */
+
+	switch ((enum drbd_conns)s.conn) {
+	/* new io only accepted when there is no connection, ... */
+	case StandAlone:
+	case WFConnection:
+	/* ... or there is a well established connection. */
+	case Connected:
+	case SyncSource:
+	case SyncTarget:
+	case VerifyS:
+	case VerifyT:
+	case PausedSyncS:
+	case PausedSyncT:
+		/* maybe stable, look at the disk state */
+		break;
+
+	/* no new io accepted during tansitional states
+	 * like handshake or teardown */
+	case Disconnecting:
+	case Unconnected:
+	case Timeout:
+	case BrokenPipe:
+	case NetworkFailure:
+	case ProtocolError:
+	case TearDown:
+	case WFReportParams:
+	case StartingSyncS:
+	case StartingSyncT:
+	case WFBitMapS:
+	case WFBitMapT:
+	case WFSyncUUID:
+	case conn_mask:
+		/* not "stable" */
+		return 0;
+	}
+
+	switch ((enum drbd_disk_state)s.disk) {
+	case Diskless:
+	case Inconsistent:
+	case Outdated:
+	case Consistent:
+	case UpToDate:
+		/* disk state is stable as well. */
+		break;
+
+	/* no new io accepted during tansitional states */
+	case Attaching:
+	case Failed:
+	case Negotiating:
+	case DUnknown:
+	case disk_mask:
+		/* not "stable" */
+		return 0;
+	}
+
+	return 1;
+}
+
+static inline int __inc_ap_bio_cond(struct drbd_conf *mdev)
+{
+	int mxb = drbd_get_max_buffers(mdev);
+
+	if (mdev->state.susp)
+		return 0;
+	if (test_bit(SUSPEND_IO, &mdev->flags))
+		return 0;
+
+	/* to avoid potential deadlock or bitmap corruption,
+	 * in various places, we only allow new application io
+	 * to start during "stable" states. */
+
+	/* no new io accepted when attaching or detaching the disk */
+	if (!drbd_state_is_stable(mdev->state))
+		return 0;
+
+	/* since some older kernels don't have atomic_add_unless,
+	 * and we are within the spinlock anyways, we have this workaround.  */
+	if (atomic_read(&mdev->ap_bio_cnt) > mxb)
+		return 0;
+	if (test_bit(BITMAP_IO, &mdev->flags))
+		return 0;
+	return 1;
+}
+
+/* I'd like to use wait_event_lock_irq,
+ * but I'm not sure when it got introduced,
+ * and not sure when it has 3 or 4 arguments */
+static inline void inc_ap_bio(struct drbd_conf *mdev, int one_or_two)
+{
+	/* compare with after_state_ch,
+	 * os.conn != WFBitMapS && ns.conn == WFBitMapS */
+	DEFINE_WAIT(wait);
+
+	/* we wait here
+	 *    as long as the device is suspended
+	 *    until the bitmap is no longer on the fly during connection
+	 *    handshake as long as we would exeed the max_buffer limit.
+	 *
+	 * to avoid races with the reconnect code,
+	 * we need to atomic_inc within the spinlock. */
+
+	spin_lock_irq(&mdev->req_lock);
+	while (!__inc_ap_bio_cond(mdev)) {
+		prepare_to_wait(&mdev->misc_wait, &wait, TASK_UNINTERRUPTIBLE);
+		spin_unlock_irq(&mdev->req_lock);
+		schedule();
+		finish_wait(&mdev->misc_wait, &wait);
+		spin_lock_irq(&mdev->req_lock);
+	}
+	atomic_add(one_or_two, &mdev->ap_bio_cnt);
+	spin_unlock_irq(&mdev->req_lock);
+}
+
+static inline void dec_ap_bio(struct drbd_conf *mdev)
+{
+	int mxb = drbd_get_max_buffers(mdev);
+	int ap_bio = atomic_dec_return(&mdev->ap_bio_cnt);
+
+	D_ASSERT(ap_bio >= 0);
+	/* this currently does wake_up for every dec_ap_bio!
+	 * maybe rather introduce some type of hysteresis?
+	 * e.g. (ap_bio == mxb/2 || ap_bio == 0) ? */
+	if (ap_bio < mxb)
+		wake_up(&mdev->misc_wait);
+	if (ap_bio == 0 && test_bit(BITMAP_IO, &mdev->flags)) {
+		if (!test_and_set_bit(BITMAP_IO_QUEUED, &mdev->flags))
+			drbd_queue_work(&mdev->data.work, &mdev->bm_io_work.w);
+	}
+}
+
+static inline void drbd_set_ed_uuid(struct drbd_conf *mdev, u64 val)
+{
+	mdev->ed_uuid = val;
+
+	MTRACE(TraceTypeUuid, TraceLvlMetrics,
+	       INFO(" exposed data uuid now %016llX\n",
+		    (unsigned long long)val);
+		);
+}
+
+static inline int seq_cmp(u32 a, u32 b)
+{
+	/* we assume wrap around at 32bit.
+	 * for wrap around at 24bit (old atomic_t),
+	 * we'd have to
+	 *  a <<= 8; b <<= 8;
+	 */
+	return (s32)(a) - (s32)(b);
+}
+#define seq_lt(a, b) (seq_cmp((a), (b)) < 0)
+#define seq_gt(a, b) (seq_cmp((a), (b)) > 0)
+#define seq_ge(a, b) (seq_cmp((a), (b)) >= 0)
+#define seq_le(a, b) (seq_cmp((a), (b)) <= 0)
+/* CAUTION: please no side effects in arguments! */
+#define seq_max(a, b) ((u32)(seq_gt((a), (b)) ? (a) : (b)))
+
+static inline void update_peer_seq(struct drbd_conf *mdev, unsigned int new_seq)
+{
+	unsigned int m;
+	spin_lock(&mdev->peer_seq_lock);
+	m = seq_max(mdev->peer_seq, new_seq);
+	mdev->peer_seq = m;
+	spin_unlock(&mdev->peer_seq_lock);
+	if (m == new_seq)
+		wake_up(&mdev->seq_wait);
+}
+
+static inline void drbd_update_congested(struct drbd_conf *mdev)
+{
+	struct sock *sk = mdev->data.socket->sk;
+	if (sk->sk_wmem_queued > sk->sk_sndbuf * 4 / 5)
+		set_bit(NET_CONGESTED, &mdev->flags);
+}
+
+static inline int drbd_queue_order_type(struct drbd_conf *mdev)
+{
+	/* sorry, we currently have no working implementation
+	 * of distributed TCQ stuff */
+#ifndef QUEUE_ORDERED_NONE
+#define QUEUE_ORDERED_NONE 0
+#endif
+	return QUEUE_ORDERED_NONE;
+}
+
+static inline void drbd_blk_run_queue(struct request_queue *q)
+{
+	if (q && q->unplug_fn)
+		q->unplug_fn(q);
+}
+
+static inline void drbd_kick_lo(struct drbd_conf *mdev)
+{
+	if (inc_local(mdev)) {
+		drbd_blk_run_queue(bdev_get_queue(mdev->bc->backing_bdev));
+		dec_local(mdev);
+	}
+}
+
+static inline void drbd_md_flush(struct drbd_conf *mdev)
+{
+	int r;
+
+	if (test_bit(MD_NO_BARRIER, &mdev->flags))
+		return;
+
+	r = blkdev_issue_flush(mdev->bc->md_bdev, NULL);
+	if (r) {
+		set_bit(MD_NO_BARRIER, &mdev->flags);
+		ERR("meta data flush failed with status %d, disabling md-flushes\n", r);
+	}
+}
+
+#endif
--- linux-rt-2.6.31.orig/ubuntu/drbd/BOM
+++ linux-rt-2.6.31/ubuntu/drbd/BOM
@@ -0,0 +1,2 @@
+Downloaded from:	http://git.drbd.org/linux-2.6-drbd.git
+Current Version:	8.3.0
--- linux-rt-2.6.31.orig/ubuntu/drbd/Makefile
+++ linux-rt-2.6.31/ubuntu/drbd/Makefile
@@ -0,0 +1,6 @@
+EXTRA_CFLAGS += -I$(src)
+drbd-y := drbd_buildtag.o drbd_bitmap.o drbd_proc.o
+drbd-y += drbd_worker.o drbd_receiver.o drbd_req.o drbd_actlog.o
+drbd-y += lru_cache.o drbd_main.o drbd_strings.o drbd_nl.o
+
+obj-$(CONFIG_BLK_DEV_DRBD)     += drbd.o
--- linux-rt-2.6.31.orig/ubuntu/drbd/lru_cache.h
+++ linux-rt-2.6.31/ubuntu/drbd/lru_cache.h
@@ -0,0 +1,116 @@
+/*
+   lru_cache.c
+
+   This file is part of DRBD by Philipp Reisner and Lars Ellenberg.
+
+   Copyright (C) 2003-2008, LINBIT Information Technologies GmbH.
+   Copyright (C) 2003-2008, Philipp Reisner <philipp.reisner@linbit.com>.
+   Copyright (C) 2003-2008, Lars Ellenberg <lars.ellenberg@linbit.com>.
+
+   drbd is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 2, or (at your option)
+   any later version.
+
+   drbd is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with drbd; see the file COPYING.  If not, write to
+   the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
+
+ */
+
+#ifndef LRU_CACHE_H
+#define LRU_CACHE_H
+
+#include <linux/list.h>
+
+struct lc_element {
+	struct hlist_node colision;
+	struct list_head list;		 /* LRU list or free list */
+	unsigned int refcnt;
+	unsigned int lc_number;
+};
+
+struct lru_cache {
+	struct list_head lru;
+	struct list_head free;
+	struct list_head in_use;
+	size_t element_size;
+	unsigned int  nr_elements;
+	unsigned int  new_number;
+
+	unsigned int used;
+	unsigned long flags;
+	unsigned long hits, misses, starving, dirty, changed;
+	struct lc_element *changing_element; /* just for paranoia */
+
+	void  *lc_private;
+	const char *name;
+
+	struct hlist_head slot[0];
+	/* hash colision chains here, then element storage. */
+};
+
+
+/* flag-bits for lru_cache */
+enum {
+	__LC_PARANOIA,
+	__LC_DIRTY,
+	__LC_STARVING,
+};
+#define LC_PARANOIA (1<<__LC_PARANOIA)
+#define LC_DIRTY    (1<<__LC_DIRTY)
+#define LC_STARVING (1<<__LC_STARVING)
+
+extern struct lru_cache *lc_alloc(const char *name, unsigned int e_count,
+				  size_t e_size, void *private_p);
+extern void lc_reset(struct lru_cache *lc);
+extern void lc_free(struct lru_cache *lc);
+extern void lc_set(struct lru_cache *lc, unsigned int enr, int index);
+extern void lc_del(struct lru_cache *lc, struct lc_element *element);
+
+extern struct lc_element *lc_try_get(struct lru_cache *lc, unsigned int enr);
+extern struct lc_element *lc_find(struct lru_cache *lc, unsigned int enr);
+extern struct lc_element *lc_get(struct lru_cache *lc, unsigned int enr);
+extern unsigned int lc_put(struct lru_cache *lc, struct lc_element *e);
+extern void lc_changed(struct lru_cache *lc, struct lc_element *e);
+
+struct seq_file;
+extern size_t lc_printf_stats(struct seq_file *seq, struct lru_cache *lc);
+
+void lc_dump(struct lru_cache *lc, struct seq_file *seq, char *utext,
+	     void (*detail) (struct seq_file *, struct lc_element *));
+
+/* This can be used to stop lc_get from changing the set of active elements.
+ * Note that the reference counts and order on the lru list may still change.
+ * returns true if we aquired the lock.
+ */
+static inline int lc_try_lock(struct lru_cache *lc)
+{
+	return !test_and_set_bit(__LC_DIRTY, &lc->flags);
+}
+
+static inline void lc_unlock(struct lru_cache *lc)
+{
+	clear_bit(__LC_DIRTY, &lc->flags);
+	smp_mb__after_clear_bit();
+}
+
+static inline int lc_is_used(struct lru_cache *lc, unsigned int enr)
+{
+	struct lc_element *e = lc_find(lc, enr);
+	return e && e->refcnt;
+}
+
+#define LC_FREE (-1U)
+
+#define lc_e_base(lc)  ((char *)((lc)->slot + (lc)->nr_elements))
+#define lc_entry(lc, i) ((struct lc_element *) \
+		       (lc_e_base(lc) + (i)*(lc)->element_size))
+#define lc_index_of(lc, e) (((char *)(e) - lc_e_base(lc))/(lc)->element_size)
+
+#endif
--- linux-rt-2.6.31.orig/ubuntu/drbd/Kconfig
+++ linux-rt-2.6.31/ubuntu/drbd/Kconfig
@@ -0,0 +1,37 @@
+#
+# DRBD device driver configuration
+#
+
+comment "DRBD disabled because PROC_FS, INET or CONNECTOR not selected"
+	depends on !PROC_FS || !INET || !CONNECTOR
+
+config BLK_DEV_DRBD
+	tristate "DRBD Distributed Replicated Block Device support"
+	depends on PROC_FS && INET && CONNECTOR
+	help
+
+	  NOTE: In order to authenticate connections you have to select
+	  CRYPTO_HMAC and a hash function as well.
+
+	  DRBD is a shared-nothing, synchronously replicated block device. It
+	  is designed to serve as a building block for high availability
+	  clusters and in this context, is a "drop-in" replacement for shared
+	  storage. Simplistically, you could see it as a network RAID 1.
+
+	  Each minor device has a role, which can be 'primary' or 'secondary'.
+	  On the node with the primary device the application is supposed to
+	  run and to access the device (/dev/drbdX). Every write is sent to
+	  the local 'lower level block device' and, across the network, to the
+	  node with the device in 'secondary' state.  The secondary device
+	  simply writes the data to its lower level block device.
+
+	  DRBD can also be used in dual-Primary mode (device writable on both
+	  nodes), which means it can exhibit shared disk semantics in a
+	  shared-nothing cluster.  Needless to say, on top of dual-Primary
+	  DRBD utilizing a cluster file system is necessary to maintain for
+	  cache coherency.
+
+	  For automatic failover you need a cluster manager (e.g. heartbeat).
+	  See also: http://www.drbd.org/, http://www.linux-ha.org
+
+	  If unsure, say N.
--- linux-rt-2.6.31.orig/ubuntu/drbd/drbd_req.h
+++ linux-rt-2.6.31/ubuntu/drbd/drbd_req.h
@@ -0,0 +1,327 @@
+/*
+   drbd_req.h
+
+   This file is part of DRBD by Philipp Reisner and Lars Ellenberg.
+
+   Copyright (C) 2006-2008, LINBIT Information Technologies GmbH.
+   Copyright (C) 2006-2008, Lars Ellenberg <lars.ellenberg@linbit.com>.
+   Copyright (C) 2006-2008, Philipp Reisner <philipp.reisner@linbit.com>.
+
+   DRBD is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 2, or (at your option)
+   any later version.
+
+   DRBD is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with drbd; see the file COPYING.  If not, write to
+   the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#ifndef _DRBD_REQ_H
+#define _DRBD_REQ_H
+
+#include <linux/autoconf.h>
+#include <linux/module.h>
+
+#include <linux/slab.h>
+#include <linux/drbd.h>
+#include "drbd_int.h"
+#include "drbd_wrappers.h"
+
+/* The request callbacks will be called in irq context by the IDE drivers,
+   and in Softirqs/Tasklets/BH context by the SCSI drivers,
+   and by the receiver and worker in kernel-thread context.
+   Try to get the locking right :) */
+
+/*
+ * Objects of type struct drbd_request do only exist on a Primary node, and are
+ * associated with IO requests originating from the block layer above us.
+ *
+ * There are quite a few things that may happen to a drbd request
+ * during its lifetime.
+ *
+ *  It will be created.
+ *  It will be marked with the intention to be
+ *    submitted to local disk and/or
+ *    send via the network.
+ *
+ *  It has to be placed on the transfer log and other housekeeping lists,
+ *  In case we have a network connection.
+ *
+ *  It may be identified as a concurrent (write) request
+ *    and be handled accordingly.
+ *
+ *  It may me handed over to the local disk subsystem.
+ *  It may be completed by the local disk subsystem,
+ *    either sucessfully or with io-error.
+ *  In case it is a READ request, and it failed locally,
+ *    it may be retried remotely.
+ *
+ *  It may be queued for sending.
+ *  It may be handed over to the network stack,
+ *    which may fail.
+ *  It may be acknowledged by the "peer" according to the wire_protocol in use.
+ *    this may be a negative ack.
+ *  It may receive a faked ack when the network connection is lost and the
+ *  transfer log is cleaned up.
+ *  Sending may be canceled due to network connection loss.
+ *  When it finally has outlived its time,
+ *    corresponding dirty bits in the resync-bitmap may be cleared or set,
+ *    it will be destroyed,
+ *    and completion will be signalled to the originator,
+ *      with or without "success".
+ *
+ * See also documentation/drbd-request-state-overview.dot
+ *  (dot -Tps2 documentation/drbd-request-state-overview.dot | display -)
+ */
+
+enum drbd_req_event {
+	created,
+	to_be_send,
+	to_be_submitted,
+
+	/* XXX yes, now I am inconsistent...
+	 * these two are not "events" but "actions"
+	 * oh, well... */
+	queue_for_net_write,
+	queue_for_net_read,
+
+	send_canceled,
+	send_failed,
+	handed_over_to_network,
+	connection_lost_while_pending,
+	recv_acked_by_peer,
+	write_acked_by_peer,
+	write_acked_by_peer_and_sis, /* and set_in_sync */
+	conflict_discarded_by_peer,
+	neg_acked,
+	barrier_acked, /* in protocol A and B */
+	data_received, /* (remote read) */
+
+	read_completed_with_error,
+	write_completed_with_error,
+	completed_ok,
+};
+
+/* encoding of request states for now.  we don't actually need that many bits.
+ * we don't need to do atomic bit operations either, since most of the time we
+ * need to look at the connection state and/or manipulate some lists at the
+ * same time, so we should hold the request lock anyways.
+ */
+enum drbd_req_state_bits {
+	/* 210
+	 * 000: no local possible
+	 * 001: to be submitted
+	 *    UNUSED, we could map: 011: submitted, completion still pending
+	 * 110: completed ok
+	 * 010: completed with error
+	 */
+	__RQ_LOCAL_PENDING,
+	__RQ_LOCAL_COMPLETED,
+	__RQ_LOCAL_OK,
+
+	/* 76543
+	 * 00000: no network possible
+	 * 00001: to be send
+	 * 00011: to be send, on worker queue
+	 * 00101: sent, expecting recv_ack (B) or write_ack (C)
+	 * 11101: sent,
+	 *        recv_ack (B) or implicit "ack" (A),
+	 *        still waiting for the barrier ack.
+	 *        master_bio may already be completed and invalidated.
+	 * 11100: write_acked (C),
+	 *        data_received (for remote read, any protocol)
+	 *        or finally the barrier ack has arrived (B,A)...
+	 *        request can be freed
+	 * 01100: neg-acked (write, protocol C)
+	 *        or neg-d-acked (read, any protocol)
+	 *        or killed from the transfer log
+	 *        during cleanup after connection loss
+	 *        request can be freed
+	 * 01000: canceled or send failed...
+	 *        request can be freed
+	 */
+
+	/* if "SENT" is not set, yet, this can still fail or be canceled.
+	 * if "SENT" is set already, we still wait for an Ack packet.
+	 * when cleared, the master_bio may be completed.
+	 * in (B,A) the request object may still linger on the transaction log
+	 * until the corresponding barrier ack comes in */
+	__RQ_NET_PENDING,
+
+	/* If it is QUEUED, and it is a WRITE, it is also registered in the
+	 * transfer log. Currently we need this flag to avoid conflicts between
+	 * worker canceling the request and tl_clear_barrier killing it from
+	 * transfer log.  We should restructure the code so this conflict does
+	 * no longer occur. */
+	__RQ_NET_QUEUED,
+
+	/* well, actually only "handed over to the network stack".
+	 *
+	 * TODO can potentially be dropped because of the similar meaning
+	 * of RQ_NET_SENT and ~RQ_NET_QUEUED.
+	 * however it is not exactly the same. before we drop it
+	 * we must ensure that we can tell a request with network part
+	 * from a request without, regardless of what happens to it. */
+	__RQ_NET_SENT,
+
+	/* when set, the request may be freed (if RQ_NET_QUEUED is clear).
+	 * basically this means the corresponding BarrierAck was received */
+	__RQ_NET_DONE,
+
+	/* whether or not we know (C) or pretend (B,A) that the write
+	 * was successfully written on the peer.
+	 */
+	__RQ_NET_OK,
+
+	/* peer called drbd_set_in_sync() for this write */
+	__RQ_NET_SIS,
+
+	/* keep this last, its for the RQ_NET_MASK */
+	__RQ_NET_MAX,
+};
+
+#define RQ_LOCAL_PENDING   (1UL << __RQ_LOCAL_PENDING)
+#define RQ_LOCAL_COMPLETED (1UL << __RQ_LOCAL_COMPLETED)
+#define RQ_LOCAL_OK        (1UL << __RQ_LOCAL_OK)
+
+#define RQ_LOCAL_MASK      ((RQ_LOCAL_OK << 1)-1) /* 0x07 */
+
+#define RQ_NET_PENDING     (1UL << __RQ_NET_PENDING)
+#define RQ_NET_QUEUED      (1UL << __RQ_NET_QUEUED)
+#define RQ_NET_SENT        (1UL << __RQ_NET_SENT)
+#define RQ_NET_DONE        (1UL << __RQ_NET_DONE)
+#define RQ_NET_OK          (1UL << __RQ_NET_OK)
+#define RQ_NET_SIS         (1UL << __RQ_NET_SIS)
+
+/* 0x1f8 */
+#define RQ_NET_MASK        (((1UL << __RQ_NET_MAX)-1) & ~RQ_LOCAL_MASK)
+
+/* epoch entries */
+static inline
+struct hlist_head *ee_hash_slot(struct drbd_conf *mdev, sector_t sector)
+{
+	BUG_ON(mdev->ee_hash_s == 0);
+	return mdev->ee_hash +
+		((unsigned int)(sector>>HT_SHIFT) % mdev->ee_hash_s);
+}
+
+/* transfer log (drbd_request objects) */
+static inline
+struct hlist_head *tl_hash_slot(struct drbd_conf *mdev, sector_t sector)
+{
+	BUG_ON(mdev->tl_hash_s == 0);
+	return mdev->tl_hash +
+		((unsigned int)(sector>>HT_SHIFT) % mdev->tl_hash_s);
+}
+
+/* when we receive the ACK for a write request,
+ * verify that we actually know about it */
+static inline struct drbd_request *_ack_id_to_req(struct drbd_conf *mdev,
+	u64 id, sector_t sector)
+{
+	struct hlist_head *slot = tl_hash_slot(mdev, sector);
+	struct hlist_node *n;
+	struct drbd_request *req;
+
+	hlist_for_each_entry(req, n, slot, colision) {
+		if ((unsigned long)req == (unsigned long)id) {
+			if (req->sector != sector) {
+				ERR("_ack_id_to_req: found req %p but it has "
+				    "wrong sector (%llus versus %llus)\n", req,
+				    (unsigned long long)req->sector,
+				    (unsigned long long)sector);
+				break;
+			}
+			return req;
+		}
+	}
+	ERR("_ack_id_to_req: failed to find req %p, sector %llus in list\n",
+		(void *)(unsigned long)id, (unsigned long long)sector);
+	return NULL;
+}
+
+/* application reads (drbd_request objects) */
+static struct hlist_head *ar_hash_slot(struct drbd_conf *mdev, sector_t sector)
+{
+	return mdev->app_reads_hash
+		+ ((unsigned int)(sector) % APP_R_HSIZE);
+}
+
+/* when we receive the answer for a read request,
+ * verify that we actually know about it */
+static inline struct drbd_request *_ar_id_to_req(struct drbd_conf *mdev,
+	u64 id, sector_t sector)
+{
+	struct hlist_head *slot = ar_hash_slot(mdev, sector);
+	struct hlist_node *n;
+	struct drbd_request *req;
+
+	hlist_for_each_entry(req, n, slot, colision) {
+		if ((unsigned long)req == (unsigned long)id) {
+			D_ASSERT(req->sector == sector);
+			return req;
+		}
+	}
+	return NULL;
+}
+
+static inline struct drbd_request *drbd_req_new(struct drbd_conf *mdev,
+	struct bio *bio_src)
+{
+	struct bio *bio;
+	struct drbd_request *req =
+		mempool_alloc(drbd_request_mempool, GFP_NOIO);
+	if (likely(req)) {
+		bio = bio_clone(bio_src, GFP_NOIO); /* XXX cannot fail?? */
+
+		req->rq_state    = 0;
+		req->mdev        = mdev;
+		req->master_bio  = bio_src;
+		req->private_bio = bio;
+		req->epoch       = 0;
+		req->sector      = bio->bi_sector;
+		req->size        = bio->bi_size;
+		req->start_time  = jiffies;
+		INIT_HLIST_NODE(&req->colision);
+		INIT_LIST_HEAD(&req->tl_requests);
+		INIT_LIST_HEAD(&req->w.list);
+
+		bio->bi_private  = req;
+		bio->bi_end_io   = drbd_endio_pri;
+		bio->bi_next     = NULL;
+	}
+	return req;
+}
+
+static inline void drbd_req_free(struct drbd_request *req)
+{
+	mempool_free(req, drbd_request_mempool);
+}
+
+static inline int overlaps(sector_t s1, int l1, sector_t s2, int l2)
+{
+	return !((s1 + (l1>>9) <= s2) || (s1 >= s2 + (l2>>9)));
+}
+
+/* aparently too large to be inlined...
+ * moved to drbd_req.c */
+extern void _req_may_be_done(struct drbd_request *req, int error);
+extern void _req_mod(struct drbd_request *req,
+		enum drbd_req_event what, int error);
+
+/* If you need it irqsave, do it your self! */
+static inline void req_mod(struct drbd_request *req,
+		enum drbd_req_event what, int error)
+{
+	struct drbd_conf *mdev = req->mdev;
+	spin_lock_irq(&mdev->req_lock);
+	_req_mod(req, what, error);
+	spin_unlock_irq(&mdev->req_lock);
+}
+#endif
--- linux-rt-2.6.31.orig/ubuntu/drbd/drbd_wrappers.h
+++ linux-rt-2.6.31/ubuntu/drbd/drbd_wrappers.h
@@ -0,0 +1,116 @@
+#include <linux/ctype.h>
+#include <linux/mm.h>
+
+
+/* see get_sb_bdev and bd_claim */
+extern char *drbd_sec_holder;
+
+static inline sector_t drbd_get_hardsect(struct block_device *bdev)
+{
+	return bdev_logical_block_size(bdev);
+}
+
+/* sets the number of 512 byte sectors of our virtual device */
+static inline void drbd_set_my_capacity(struct drbd_conf *mdev,
+					sector_t size)
+{
+	/* set_capacity(mdev->this_bdev->bd_disk, size); */
+	set_capacity(mdev->vdisk, size);
+	mdev->this_bdev->bd_inode->i_size = (loff_t)size << 9;
+}
+
+#define drbd_bio_uptodate(bio) bio_flagged(bio, BIO_UPTODATE)
+
+static inline int drbd_bio_has_active_page(struct bio *bio)
+{
+	struct bio_vec *bvec;
+	int i;
+
+	__bio_for_each_segment(bvec, bio, i, 0) {
+		if (page_count(bvec->bv_page) > 1)
+			return 1;
+	}
+
+	return 0;
+}
+
+/* bi_end_io handlers */
+extern void drbd_md_io_complete(struct bio *bio, int error);
+extern void drbd_endio_read_sec(struct bio *bio, int error);
+extern void drbd_endio_write_sec(struct bio *bio, int error);
+extern void drbd_endio_pri(struct bio *bio, int error);
+
+/* how to get to the kobj of a gendisk.
+ * see also upstream commits
+ * edfaa7c36574f1bf09c65ad602412db9da5f96bf
+ * ed9e1982347b36573cd622ee5f4e2a7ccd79b3fd
+ * 548b10eb2959c96cef6fc29fc96e0931eeb53bc5
+ */
+#ifndef dev_to_disk
+# define disk_to_kobj(disk) (&(disk)->kobj)
+#else
+# ifndef disk_to_dev
+#  define disk_to_dev(disk) (&(disk)->dev)
+# endif
+# define disk_to_kobj(disk) (&disk_to_dev(disk)->kobj)
+#endif
+static inline void drbd_kobject_uevent(struct drbd_conf *mdev)
+{
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,10)
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,15)
+	kobject_uevent(disk_to_kobj(mdev->vdisk), KOBJ_CHANGE, NULL);
+#else
+	kobject_uevent(disk_to_kobj(mdev->vdisk), KOBJ_CHANGE);
+	/* rhel4 / sles9 and older don't have this at all,
+	 * which means user space (udev) won't get events about possible changes of
+	 * corresponding resource + disk names after the initial drbd minor creation.
+	 */
+#endif
+#endif
+}
+
+
+/*
+ * used to submit our private bio
+ */
+static inline void drbd_generic_make_request(struct drbd_conf *mdev,
+					     int fault_type, struct bio *bio)
+{
+	__release(local);
+	if (!bio->bi_bdev) {
+		printk(KERN_ERR "drbd%d: drbd_generic_make_request: "
+				"bio->bi_bdev == NULL\n",
+		       mdev_to_minor(mdev));
+		dump_stack();
+		bio_endio(bio, -ENODEV);
+		return;
+	}
+
+	if (FAULT_ACTIVE(mdev, fault_type))
+		bio_endio(bio, -EIO);
+	else
+		generic_make_request(bio);
+}
+
+static inline void drbd_plug_device(struct drbd_conf *mdev)
+{
+	struct request_queue *q;
+	q = bdev_get_queue(mdev->this_bdev);
+
+	spin_lock_irq(q->queue_lock);
+
+/* XXX the check on !blk_queue_plugged is redundant,
+ * implicitly checked in blk_plug_device */
+
+	if (!blk_queue_plugged(q)) {
+		blk_plug_device(q);
+		del_timer(&q->unplug_timer);
+		/* unplugging should not happen automatically... */
+	}
+	spin_unlock_irq(q->queue_lock);
+}
+
+#ifndef __CHECKER__
+# undef __cond_lock
+# define __cond_lock(x,c) (c)
+#endif
--- linux-rt-2.6.31.orig/ubuntu/drbd/drbd_strings.c
+++ linux-rt-2.6.31/ubuntu/drbd/drbd_strings.c
@@ -0,0 +1,115 @@
+/*
+  drbd.h
+
+  This file is part of DRBD by Philipp Reisner and Lars Ellenberg.
+
+  Copyright (C) 2003-2008, LINBIT Information Technologies GmbH.
+  Copyright (C) 2003-2008, Philipp Reisner <philipp.reisner@linbit.com>.
+  Copyright (C) 2003-2008, Lars Ellenberg <lars.ellenberg@linbit.com>.
+
+  drbd is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation; either version 2, or (at your option)
+  any later version.
+
+  drbd is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with drbd; see the file COPYING.  If not, write to
+  the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
+
+*/
+
+#include <linux/drbd.h>
+
+static const char *drbd_conn_s_names[] = {
+	[StandAlone]     = "StandAlone",
+	[Disconnecting]  = "Disconnecting",
+	[Unconnected]    = "Unconnected",
+	[Timeout]        = "Timeout",
+	[BrokenPipe]     = "BrokenPipe",
+	[NetworkFailure] = "NetworkFailure",
+	[ProtocolError]  = "ProtocolError",
+	[WFConnection]   = "WFConnection",
+	[WFReportParams] = "WFReportParams",
+	[TearDown]       = "TearDown",
+	[Connected]      = "Connected",
+	[StartingSyncS]  = "StartingSyncS",
+	[StartingSyncT]  = "StartingSyncT",
+	[WFBitMapS]      = "WFBitMapS",
+	[WFBitMapT]      = "WFBitMapT",
+	[WFSyncUUID]     = "WFSyncUUID",
+	[SyncSource]     = "SyncSource",
+	[SyncTarget]     = "SyncTarget",
+	[VerifyS]        = "VerifyS",
+	[VerifyT]        = "VerifyT",
+	[PausedSyncS]    = "PausedSyncS",
+	[PausedSyncT]    = "PausedSyncT"
+};
+
+static const char *drbd_role_s_names[] = {
+	[Primary]   = "Primary",
+	[Secondary] = "Secondary",
+	[Unknown]   = "Unknown"
+};
+
+static const char *drbd_disk_s_names[] = {
+	[Diskless]     = "Diskless",
+	[Attaching]    = "Attaching",
+	[Failed]       = "Failed",
+	[Negotiating]  = "Negotiating",
+	[Inconsistent] = "Inconsistent",
+	[Outdated]     = "Outdated",
+	[DUnknown]     = "DUnknown",
+	[Consistent]   = "Consistent",
+	[UpToDate]     = "UpToDate",
+};
+
+static const char *drbd_state_sw_errors[] = {
+	[-SS_TwoPrimaries] = "Multiple primaries not allowed by config",
+	[-SS_NoUpToDateDisk] =
+		"Refusing to be Primary without at least one UpToDate disk",
+	[-SS_BothInconsistent] = "Refusing to be inconsistent on both nodes",
+	[-SS_SyncingDiskless] = "Refusing to be syncing and diskless",
+	[-SS_ConnectedOutdates] = "Refusing to be Outdated while Connected",
+	[-SS_PrimaryNOP] = "Refusing to be Primary while peer is not outdated",
+	[-SS_ResyncRunning] = "Can not start OV/resync since it is already active",
+	[-SS_AlreadyStandAlone] = "Can not disconnect a StandAlone device",
+	[-SS_CW_FailedByPeer] = "State changed was refused by peer node",
+	[-SS_IsDiskLess] =
+		"Device is diskless, the requesed operation requires a disk",
+	[-SS_DeviceInUse] = "Device is held open by someone",
+	[-SS_NoNetConfig] = "Have no net/connection configuration",
+	[-SS_NoVerifyAlg] = "Need a verify algorithm to start online verify",
+	[-SS_NeedConnection] = "Need a connection to start verify or resync",
+	[-SS_NotSupported] = "Peer does not support protocol",
+	[-SS_LowerThanOutdated] = "Disk state is lower than outdated",
+	[-SS_InTransientState] = "In transient state, retry after next state change",
+	[-SS_ConcurrentStChg] = "Concurrent state changes detected and aborted",
+};
+
+const char *conns_to_name(enum drbd_conns s)
+{
+	/* enums are unsigned... */
+	return s > PausedSyncT ? "TOO_LARGE" : drbd_conn_s_names[s];
+}
+
+const char *roles_to_name(enum drbd_role s)
+{
+	return s > Secondary   ? "TOO_LARGE" : drbd_role_s_names[s];
+}
+
+const char *disks_to_name(enum drbd_disk_state s)
+{
+	return s > UpToDate    ? "TOO_LARGE" : drbd_disk_s_names[s];
+}
+
+const char *set_st_err_name(enum set_st_err err)
+{
+	return err <= SS_AfterLastError ? "TOO_SMALL" :
+	       err > SS_TwoPrimaries ? "TOO_LARGE"
+			: drbd_state_sw_errors[-err];
+}
--- linux-rt-2.6.31.orig/ubuntu/drbd/drbd_req.c
+++ linux-rt-2.6.31/ubuntu/drbd/drbd_req.c
@@ -0,0 +1,1206 @@
+/*
+   drbd_req.c
+
+   This file is part of DRBD by Philipp Reisner and Lars Ellenberg.
+
+   Copyright (C) 2001-2008, LINBIT Information Technologies GmbH.
+   Copyright (C) 1999-2008, Philipp Reisner <philipp.reisner@linbit.com>.
+   Copyright (C) 2002-2008, Lars Ellenberg <lars.ellenberg@linbit.com>.
+
+   drbd is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 2, or (at your option)
+   any later version.
+
+   drbd is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with drbd; see the file COPYING.  If not, write to
+   the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
+
+ */
+
+#include <linux/autoconf.h>
+#include <linux/module.h>
+
+#include <linux/slab.h>
+#include <linux/drbd.h>
+#include "drbd_int.h"
+#include "drbd_req.h"
+
+/* outside of the ifdef
+ * because of the _print_rq_state(,FIXME) in barrier_acked */
+STATIC void _print_rq_state(struct drbd_request *req, const char *txt)
+{
+	const unsigned long s = req->rq_state;
+	struct drbd_conf *mdev = req->mdev;
+	const int rw = (req->master_bio == NULL ||
+			bio_data_dir(req->master_bio) == WRITE) ?
+		'W' : 'R';
+
+	INFO("%s %p %c L%c%c%cN%c%c%c%c%c %u (%llus +%u) %s\n",
+	     txt, req, rw,
+	     s & RQ_LOCAL_PENDING ? 'p' : '-',
+	     s & RQ_LOCAL_COMPLETED ? 'c' : '-',
+	     s & RQ_LOCAL_OK ? 'o' : '-',
+	     s & RQ_NET_PENDING ? 'p' : '-',
+	     s & RQ_NET_QUEUED ? 'q' : '-',
+	     s & RQ_NET_SENT ? 's' : '-',
+	     s & RQ_NET_DONE ? 'd' : '-',
+	     s & RQ_NET_OK ? 'o' : '-',
+	     req->epoch,
+	     (unsigned long long)req->sector,
+	     req->size,
+	     conns_to_name(mdev->state.conn));
+}
+
+/* #define VERBOSE_REQUEST_CODE */
+#if defined(VERBOSE_REQUEST_CODE) || defined(ENABLE_DYNAMIC_TRACE)
+STATIC void _print_req_mod(struct drbd_request *req, enum drbd_req_event what)
+{
+	struct drbd_conf *mdev = req->mdev;
+	const int rw = (req->master_bio == NULL ||
+			bio_data_dir(req->master_bio) == WRITE) ?
+		'W' : 'R';
+
+	static const char *rq_event_names[] = {
+		[created] = "created",
+		[to_be_send] = "to_be_send",
+		[to_be_submitted] = "to_be_submitted",
+		[queue_for_net_write] = "queue_for_net_write",
+		[queue_for_net_read] = "queue_for_net_read",
+		[send_canceled] = "send_canceled",
+		[send_failed] = "send_failed",
+		[handed_over_to_network] = "handed_over_to_network",
+		[connection_lost_while_pending] =
+					"connection_lost_while_pending",
+		[recv_acked_by_peer] = "recv_acked_by_peer",
+		[write_acked_by_peer] = "write_acked_by_peer",
+		[neg_acked] = "neg_acked",
+		[conflict_discarded_by_peer] = "conflict_discarded_by_peer",
+		[barrier_acked] = "barrier_acked",
+		[data_received] = "data_received",
+		[read_completed_with_error] = "read_completed_with_error",
+		[write_completed_with_error] = "write_completed_with_error",
+		[completed_ok] = "completed_ok",
+	};
+
+	INFO("_req_mod(%p %c ,%s)\n", req, rw, rq_event_names[what]);
+}
+
+# ifdef ENABLE_DYNAMIC_TRACE
+#  define print_rq_state(R, T) \
+	MTRACE(TraceTypeRq, TraceLvlMetrics, _print_rq_state(R, T);)
+#  define print_req_mod(T, W)  \
+	MTRACE(TraceTypeRq, TraceLvlMetrics, _print_req_mod(T, W);)
+# else
+#  define print_rq_state(R, T) _print_rq_state(R, T)
+#  define print_req_mod(T, W)  _print_req_mod(T, W)
+# endif
+
+#else
+#define print_rq_state(R, T)
+#define print_req_mod(T, W)
+#endif
+
+/* Update disk stats at start of I/O request */
+static inline void _drbd_start_io_acct(struct drbd_conf *mdev, struct drbd_request *req, struct bio *bio)
+{
+	const int rw = bio_data_dir(bio);
+	int cpu;
+	cpu = part_stat_lock();
+	part_stat_inc(cpu, &mdev->vdisk->part0, ios[rw]);
+	part_stat_add(cpu, &mdev->vdisk->part0, sectors[rw], bio_sectors(bio));
+	part_stat_unlock();
+	mdev->vdisk->part0.in_flight++;
+}
+
+/* Update disk stats when completing request upwards */
+static inline void _drbd_end_io_acct(struct drbd_conf *mdev, struct drbd_request *req)
+{
+	int rw = bio_data_dir(req->master_bio);
+	unsigned long duration = jiffies - req->start_time;
+	int cpu;
+	cpu = part_stat_lock();
+	part_stat_add(cpu, &mdev->vdisk->part0, ticks[rw], duration);
+	part_round_stats(cpu, &mdev->vdisk->part0);
+	part_stat_unlock();
+	mdev->vdisk->part0.in_flight--;
+}
+
+static void _req_is_done(struct drbd_conf *mdev, struct drbd_request *req, const int rw)
+{
+	const unsigned long s = req->rq_state;
+	/* if it was a write, we may have to set the corresponding
+	 * bit(s) out-of-sync first. If it had a local part, we need to
+	 * release the reference to the activity log. */
+	if (rw == WRITE) {
+		/* remove it from the transfer log.
+		 * well, only if it had been there in the first
+		 * place... if it had not (local only or conflicting
+		 * and never sent), it should still be "empty" as
+		 * initialised in drbd_req_new(), so we can list_del() it
+		 * here unconditionally */
+		list_del(&req->tl_requests);
+		/* Set out-of-sync unless both OK flags are set
+		 * (local only or remote failed).
+		 * Other places where we set out-of-sync:
+		 * READ with local io-error */
+		if (!(s & RQ_NET_OK) || !(s & RQ_LOCAL_OK))
+			drbd_set_out_of_sync(mdev, req->sector, req->size);
+
+		if ((s & RQ_NET_OK) && (s & RQ_LOCAL_OK) && (s & RQ_NET_SIS))
+			drbd_set_in_sync(mdev, req->sector, req->size);
+
+		/* one might be tempted to move the drbd_al_complete_io
+		 * to the local io completion callback drbd_endio_pri.
+		 * but, if this was a mirror write, we may only
+		 * drbd_al_complete_io after this is RQ_NET_DONE,
+		 * otherwise the extent could be dropped from the al
+		 * before it has actually been written on the peer.
+		 * if we crash before our peer knows about the request,
+		 * but after the extent has been dropped from the al,
+		 * we would forget to resync the corresponding extent.
+		 */
+		if (s & RQ_LOCAL_MASK) {
+			if (inc_local_if_state(mdev, Failed)) {
+				drbd_al_complete_io(mdev, req->sector);
+				dec_local(mdev);
+			} else if (__ratelimit(&drbd_ratelimit_state)) {
+				drbd_WARN("Should have called drbd_al_complete_io(, %llu), "
+				     "but my Disk seems to have failed :(\n",
+				     (unsigned long long) req->sector);
+			}
+		}
+	}
+
+	/* if it was a local io error, we want to notify our
+	 * peer about that, and see if we need to
+	 * detach the disk and stuff.
+	 * to avoid allocating some special work
+	 * struct, reuse the request. */
+
+	/* THINK
+	 * why do we do this not when we detect the error,
+	 * but delay it until it is "done", i.e. possibly
+	 * until the next barrier ack? */
+
+	if (rw == WRITE &&
+	    ((s & RQ_LOCAL_MASK) && !(s & RQ_LOCAL_OK))) {
+		if (!(req->w.list.next == LIST_POISON1 ||
+		      list_empty(&req->w.list))) {
+			/* DEBUG ASSERT only; if this triggers, we
+			 * probably corrupt the worker list here */
+			DUMPP(req->w.list.next);
+			DUMPP(req->w.list.prev);
+		}
+		req->w.cb = w_io_error;
+		drbd_queue_work(&mdev->data.work, &req->w);
+		/* drbd_req_free() is done in w_io_error */
+	} else {
+		drbd_req_free(req);
+	}
+}
+
+static void queue_barrier(struct drbd_conf *mdev)
+{
+	struct drbd_barrier *b;
+
+	/* We are within the req_lock. Once we queued the barrier for sending,
+	 * we set the CREATE_BARRIER bit. It is cleared as soon as a new
+	 * barrier/epoch object is added. This is the only place this bit is
+	 * set. It indicates that the barrier for this epoch is already queued,
+	 * and no new epoch has been created yet. */
+	if (test_bit(CREATE_BARRIER, &mdev->flags))
+		return;
+
+	b = mdev->newest_barrier;
+	b->w.cb = w_send_barrier;
+	/* inc_ap_pending done here, so we won't
+	 * get imbalanced on connection loss.
+	 * dec_ap_pending will be done in got_BarrierAck
+	 * or (on connection loss) in tl_clear.  */
+	inc_ap_pending(mdev);
+	drbd_queue_work(&mdev->data.work, &b->w);
+	set_bit(CREATE_BARRIER, &mdev->flags);
+}
+
+static void _about_to_complete_local_write(struct drbd_conf *mdev,
+	struct drbd_request *req)
+{
+	const unsigned long s = req->rq_state;
+	struct drbd_request *i;
+	struct Tl_epoch_entry *e;
+	struct hlist_node *n;
+	struct hlist_head *slot;
+
+	/* before we can signal completion to the upper layers,
+	 * we may need to close the current epoch */
+	if (mdev->state.conn >= Connected &&
+	    req->epoch == mdev->newest_barrier->br_number)
+		queue_barrier(mdev);
+
+	/* we need to do the conflict detection stuff,
+	 * if we have the ee_hash (two_primaries) and
+	 * this has been on the network */
+	if ((s & RQ_NET_DONE) && mdev->ee_hash != NULL) {
+		const sector_t sector = req->sector;
+		const int size = req->size;
+
+		/* ASSERT:
+		 * there must be no conflicting requests, since
+		 * they must have been failed on the spot */
+#define OVERLAPS overlaps(sector, size, i->sector, i->size)
+		slot = tl_hash_slot(mdev, sector);
+		hlist_for_each_entry(i, n, slot, colision) {
+			if (OVERLAPS) {
+				ALERT("LOGIC BUG: completed: %p %llus +%u; "
+				      "other: %p %llus +%u\n",
+				      req, (unsigned long long)sector, size,
+				      i, (unsigned long long)i->sector, i->size);
+			}
+		}
+
+		/* maybe "wake" those conflicting epoch entries
+		 * that wait for this request to finish.
+		 *
+		 * currently, there can be only _one_ such ee
+		 * (well, or some more, which would be pending
+		 * DiscardAck not yet sent by the asender...),
+		 * since we block the receiver thread upon the
+		 * first conflict detection, which will wait on
+		 * misc_wait.  maybe we want to assert that?
+		 *
+		 * anyways, if we found one,
+		 * we just have to do a wake_up.  */
+#undef OVERLAPS
+#define OVERLAPS overlaps(sector, size, e->sector, e->size)
+		slot = ee_hash_slot(mdev, req->sector);
+		hlist_for_each_entry(e, n, slot, colision) {
+			if (OVERLAPS) {
+				wake_up(&mdev->misc_wait);
+				break;
+			}
+		}
+	}
+#undef OVERLAPS
+}
+
+static void _complete_master_bio(struct drbd_conf *mdev,
+	struct drbd_request *req, int error)
+{
+	dump_bio(mdev, req->master_bio, 1, req);
+	bio_endio(req->master_bio, error);
+	req->master_bio = NULL;
+	dec_ap_bio(mdev);
+}
+
+void _req_may_be_done(struct drbd_request *req, int error)
+{
+	const unsigned long s = req->rq_state;
+	struct drbd_conf *mdev = req->mdev;
+	int rw;
+
+	print_rq_state(req, "_req_may_be_done");
+
+	/* we must not complete the master bio, while it is
+	 *	still being processed by _drbd_send_zc_bio (drbd_send_dblock)
+	 *	not yet acknowledged by the peer
+	 *	not yet completed by the local io subsystem
+	 * these flags may get cleared in any order by
+	 *	the worker,
+	 *	the receiver,
+	 *	the bio_endio completion callbacks.
+	 */
+	if (s & RQ_NET_QUEUED)
+		return;
+	if (s & RQ_NET_PENDING)
+		return;
+	if (s & RQ_LOCAL_PENDING)
+		return;
+
+	if (req->master_bio) {
+		/* this is data_received (remote read)
+		 * or protocol C WriteAck
+		 * or protocol B RecvAck
+		 * or protocol A "handed_over_to_network" (SendAck)
+		 * or canceled or failed,
+		 * or killed from the transfer log due to connection loss.
+		 */
+
+		/*
+		 * figure out whether to report success or failure.
+		 *
+		 * report success when at least one of the operations suceeded.
+		 * or, to put the other way,
+		 * only report failure, when both operations failed.
+		 *
+		 * what to do about the failures is handled elsewhere.
+		 * what we need to do here is just: complete the master_bio.
+		 */
+		int ok = (s & RQ_LOCAL_OK) || (s & RQ_NET_OK);
+		rw = bio_data_dir(req->master_bio);
+
+		/* remove the request from the conflict detection
+		 * respective block_id verification hash */
+		if (!hlist_unhashed(&req->colision))
+			hlist_del(&req->colision);
+		else
+			D_ASSERT((s & RQ_NET_MASK) == 0);
+
+		/* for writes we need to do some extra housekeeping */
+		if (rw == WRITE)
+			_about_to_complete_local_write(mdev, req);
+
+		/* Update disk stats */
+		_drbd_end_io_acct(mdev, req);
+
+		_complete_master_bio(mdev, req,
+				     ok ? 0 : (error ? error : -EIO));
+	} else {
+		/* only WRITE requests can end up here without a master_bio */
+		rw = WRITE;
+	}
+
+	if ((s & RQ_NET_MASK) == 0 || (s & RQ_NET_DONE)) {
+		/* this is disconnected (local only) operation,
+		 * or protocol C WriteAck,
+		 * or protocol A or B BarrierAck,
+		 * or killed from the transfer log due to connection loss. */
+		_req_is_done(mdev, req, rw);
+	}
+	/* else: network part and not DONE yet. that is
+	 * protocol A or B, barrier ack still pending... */
+}
+
+/*
+ * checks whether there was an overlapping request
+ * or ee already registered.
+ *
+ * if so, return 1, in which case this request is completed on the spot,
+ * without ever being submitted or send.
+ *
+ * return 0 if it is ok to submit this request.
+ *
+ * NOTE:
+ * paranoia: assume something above us is broken, and issues different write
+ * requests for the same block simultaneously...
+ *
+ * To ensure these won't be reordered differently on both nodes, resulting in
+ * diverging data sets, we discard the later one(s). Not that this is supposed
+ * to happen, but this is the rationale why we also have to check for
+ * conflicting requests with local origin, and why we have to do so regardless
+ * of whether we allowed multiple primaries.
+ *
+ * BTW, in case we only have one primary, the ee_hash is empty anyways, and the
+ * second hlist_for_each_entry becomes a noop. This is even simpler than to
+ * grab a reference on the net_conf, and check for the two_primaries flag...
+ */
+STATIC int _req_conflicts(struct drbd_request *req)
+{
+	struct drbd_conf *mdev = req->mdev;
+	const sector_t sector = req->sector;
+	const int size = req->size;
+	struct drbd_request *i;
+	struct Tl_epoch_entry *e;
+	struct hlist_node *n;
+	struct hlist_head *slot;
+
+	D_ASSERT(hlist_unhashed(&req->colision));
+
+	if (!inc_net(mdev))
+		return 0;
+
+	/* BUG_ON */
+	ERR_IF (mdev->tl_hash_s == 0)
+		goto out_no_conflict;
+	BUG_ON(mdev->tl_hash == NULL);
+
+#define OVERLAPS overlaps(i->sector, i->size, sector, size)
+	slot = tl_hash_slot(mdev, sector);
+	hlist_for_each_entry(i, n, slot, colision) {
+		if (OVERLAPS) {
+			ALERT("%s[%u] Concurrent local write detected! "
+			      "[DISCARD L] new: %llus +%u; "
+			      "pending: %llus +%u\n",
+			      current->comm, current->pid,
+			      (unsigned long long)sector, size,
+			      (unsigned long long)i->sector, i->size);
+			goto out_conflict;
+		}
+	}
+
+	if (mdev->ee_hash_s) {
+		/* now, check for overlapping requests with remote origin */
+		BUG_ON(mdev->ee_hash == NULL);
+#undef OVERLAPS
+#define OVERLAPS overlaps(e->sector, e->size, sector, size)
+		slot = ee_hash_slot(mdev, sector);
+		hlist_for_each_entry(e, n, slot, colision) {
+			if (OVERLAPS) {
+				ALERT("%s[%u] Concurrent remote write detected!"
+				      " [DISCARD L] new: %llus +%u; "
+				      "pending: %llus +%u\n",
+				      current->comm, current->pid,
+				      (unsigned long long)sector, size,
+				      (unsigned long long)e->sector, e->size);
+				goto out_conflict;
+			}
+		}
+	}
+#undef OVERLAPS
+
+out_no_conflict:
+	/* this is like it should be, and what we expected.
+	 * our users do behave after all... */
+	dec_net(mdev);
+	return 0;
+
+out_conflict:
+	dec_net(mdev);
+	return 1;
+}
+
+/* obviously this could be coded as many single functions
+ * instead of one huge switch,
+ * or by putting the code directly in the respective locations
+ * (as it has been before).
+ *
+ * but having it this way
+ *  enforces that it is all in this one place, where it is easier to audit,
+ *  it makes it obvious that whatever "event" "happens" to a request should
+ *  happen "atomically" within the req_lock,
+ *  and it enforces that we have to think in a very structured manner
+ *  about the "events" that may happen to a request during its life time ...
+ *
+ * Though I think it is likely that we break this again into many
+ * static inline void _req_mod_ ## what (req) ...
+ */
+void _req_mod(struct drbd_request *req, enum drbd_req_event what, int error)
+{
+	struct drbd_conf *mdev = req->mdev;
+
+	if (error && (bio_rw(req->master_bio) != READA))
+		ERR("got an _req_mod() errno of %d\n", error);
+
+	print_req_mod(req, what);
+
+	switch (what) {
+	default:
+		ERR("LOGIC BUG in %s:%u\n", __FILE__ , __LINE__);
+		return;
+
+	/* does not happen...
+	 * initialization done in drbd_req_new
+	case created:
+		break;
+		*/
+
+	case to_be_send: /* via network */
+		/* reached via drbd_make_request_common
+		 * and from w_read_retry_remote */
+		D_ASSERT(!(req->rq_state & RQ_NET_MASK));
+		req->rq_state |= RQ_NET_PENDING;
+		inc_ap_pending(mdev);
+		break;
+
+	case to_be_submitted: /* locally */
+		/* reached via drbd_make_request_common */
+		D_ASSERT(!(req->rq_state & RQ_LOCAL_MASK));
+		req->rq_state |= RQ_LOCAL_PENDING;
+		break;
+
+	case completed_ok:
+		if (bio_data_dir(req->private_bio) == WRITE)
+			mdev->writ_cnt += req->size>>9;
+		else
+			mdev->read_cnt += req->size>>9;
+
+		bio_put(req->private_bio);
+		req->private_bio = NULL;
+
+		req->rq_state |= (RQ_LOCAL_COMPLETED|RQ_LOCAL_OK);
+		req->rq_state &= ~RQ_LOCAL_PENDING;
+
+		_req_may_be_done(req, error);
+		dec_local(mdev);
+		break;
+
+	case write_completed_with_error:
+		req->rq_state |= RQ_LOCAL_COMPLETED;
+		req->rq_state &= ~RQ_LOCAL_PENDING;
+
+		bio_put(req->private_bio);
+		req->private_bio = NULL;
+		ALERT("Local WRITE failed sec=%llus size=%u\n",
+		      (unsigned long long)req->sector, req->size);
+		/* and now: check how to handle local io error. */
+		__drbd_chk_io_error(mdev, FALSE);
+		_req_may_be_done(req, error);
+		dec_local(mdev);
+		break;
+
+	case read_completed_with_error:
+		if (bio_rw(req->master_bio) != READA)
+			drbd_set_out_of_sync(mdev, req->sector, req->size);
+
+		req->rq_state |= RQ_LOCAL_COMPLETED;
+		req->rq_state &= ~RQ_LOCAL_PENDING;
+
+		bio_put(req->private_bio);
+		req->private_bio = NULL;
+		if (bio_rw(req->master_bio) == READA) {
+			/* it is legal to fail READA */
+			_req_may_be_done(req, error);
+			dec_local(mdev);
+			break;
+		}
+		/* else */
+		ALERT("Local READ failed sec=%llus size=%u\n",
+		      (unsigned long long)req->sector, req->size);
+		/* _req_mod(req,to_be_send); oops, recursion in static inline */
+		D_ASSERT(!(req->rq_state & RQ_NET_MASK));
+		req->rq_state |= RQ_NET_PENDING;
+		inc_ap_pending(mdev);
+
+		__drbd_chk_io_error(mdev, FALSE);
+		dec_local(mdev);
+		/* NOTE: if we have no connection,
+		 * or know the peer has no good data either,
+		 * then we don't actually need to "queue_for_net_read",
+		 * but we do so anyways, since the drbd_io_error()
+		 * and the potential state change to "Diskless"
+		 * needs to be done from process context */
+
+		/* fall through: _req_mod(req,queue_for_net_read); */
+
+	case queue_for_net_read:
+		/* READ or READA, and
+		 * no local disk,
+		 * or target area marked as invalid,
+		 * or just got an io-error. */
+		/* from drbd_make_request_common
+		 * or from bio_endio during read io-error recovery */
+
+		/* so we can verify the handle in the answer packet
+		 * corresponding hlist_del is in _req_may_be_done() */
+		hlist_add_head(&req->colision, ar_hash_slot(mdev, req->sector));
+
+		set_bit(UNPLUG_REMOTE, &mdev->flags); /* why? */
+
+		D_ASSERT(req->rq_state & RQ_NET_PENDING);
+		req->rq_state |= RQ_NET_QUEUED;
+		req->w.cb = (req->rq_state & RQ_LOCAL_MASK)
+			? w_read_retry_remote
+			: w_send_read_req;
+		drbd_queue_work(&mdev->data.work, &req->w);
+		break;
+
+	case queue_for_net_write:
+		/* assert something? */
+		/* from drbd_make_request_common only */
+
+		hlist_add_head(&req->colision, tl_hash_slot(mdev, req->sector));
+		/* corresponding hlist_del is in _req_may_be_done() */
+
+		/* NOTE
+		 * In case the req ended up on the transfer log before being
+		 * queued on the worker, it could lead to this request being
+		 * missed during cleanup after connection loss.
+		 * So we have to do both operations here,
+		 * within the same lock that protects the transfer log.
+		 *
+		 * _req_add_to_epoch(req); this has to be after the
+		 * _maybe_start_new_epoch(req); which happened in
+		 * drbd_make_request_common, because we now may set the bit
+		 * again ourselves to close the current epoch.
+		 *
+		 * Add req to the (now) current epoch (barrier). */
+
+		/* see drbd_make_request_common,
+		 * just after it grabs the req_lock */
+		D_ASSERT(test_bit(CREATE_BARRIER, &mdev->flags) == 0);
+
+		req->epoch = mdev->newest_barrier->br_number;
+		list_add_tail(&req->tl_requests,
+				&mdev->newest_barrier->requests);
+
+		/* increment size of current epoch */
+		mdev->newest_barrier->n_req++;
+
+		/* queue work item to send data */
+		D_ASSERT(req->rq_state & RQ_NET_PENDING);
+		req->rq_state |= RQ_NET_QUEUED;
+		req->w.cb =  w_send_dblock;
+		drbd_queue_work(&mdev->data.work, &req->w);
+
+		/* close the epoch, in case it outgrew the limit */
+		if (mdev->newest_barrier->n_req >= mdev->net_conf->max_epoch_size)
+			queue_barrier(mdev);
+
+		break;
+
+	case send_canceled:
+		/* treat it the same */
+	case send_failed:
+		/* real cleanup will be done from tl_clear.  just update flags
+		 * so it is no longer marked as on the worker queue */
+		req->rq_state &= ~RQ_NET_QUEUED;
+		/* if we did it right, tl_clear should be scheduled only after
+		 * this, so this should not be necessary! */
+		_req_may_be_done(req, error);
+		break;
+
+	case handed_over_to_network:
+		/* assert something? */
+		if (bio_data_dir(req->master_bio) == WRITE &&
+		    mdev->net_conf->wire_protocol == DRBD_PROT_A) {
+			/* this is what is dangerous about protocol A:
+			 * pretend it was sucessfully written on the peer. */
+			if (req->rq_state & RQ_NET_PENDING) {
+				dec_ap_pending(mdev);
+				req->rq_state &= ~RQ_NET_PENDING;
+				req->rq_state |= RQ_NET_OK;
+			} /* else: neg-ack was faster... */
+			/* it is still not yet RQ_NET_DONE until the
+			 * corresponding epoch barrier got acked as well,
+			 * so we know what to dirty on connection loss */
+		}
+		req->rq_state &= ~RQ_NET_QUEUED;
+		req->rq_state |= RQ_NET_SENT;
+		/* because _drbd_send_zc_bio could sleep, and may want to
+		 * dereference the bio even after the "write_acked_by_peer" and
+		 * "completed_ok" events came in, once we return from
+		 * _drbd_send_zc_bio (drbd_send_dblock), we have to check
+		 * whether it is done already, and end it.  */
+		_req_may_be_done(req, error);
+		break;
+
+	case connection_lost_while_pending:
+		/* transfer log cleanup after connection loss */
+		/* assert something? */
+		if (req->rq_state & RQ_NET_PENDING)
+			dec_ap_pending(mdev);
+		req->rq_state &= ~(RQ_NET_OK|RQ_NET_PENDING);
+		req->rq_state |= RQ_NET_DONE;
+		/* if it is still queued, we may not complete it here.
+		 * it will be canceled soon. */
+		if (!(req->rq_state & RQ_NET_QUEUED))
+			_req_may_be_done(req, error);
+		break;
+
+	case write_acked_by_peer_and_sis:
+		req->rq_state |= RQ_NET_SIS;
+	case conflict_discarded_by_peer:
+		/* for discarded conflicting writes of multiple primarys,
+		 * there is no need to keep anything in the tl, potential
+		 * node crashes are covered by the activity log. */
+		req->rq_state |= RQ_NET_DONE;
+		/* fall through */
+	case write_acked_by_peer:
+		/* protocol C; successfully written on peer.
+		 * Nothing to do here.
+		 * We want to keep the tl in place for all protocols, to cater
+		 * for volatile write-back caches on lower level devices.
+		 *
+		 * A barrier request is expected to have forced all prior
+		 * requests onto stable storage, so completion of a barrier
+		 * request could set NET_DONE right here, and not wait for the
+		 * BarrierAck, but that is an unecessary optimisation. */
+
+		/* this makes it effectively the same as for: */
+	case recv_acked_by_peer:
+		/* protocol B; pretends to be sucessfully written on peer.
+		 * see also notes above in handed_over_to_network about
+		 * protocol != C */
+		req->rq_state |= RQ_NET_OK;
+		D_ASSERT(req->rq_state & RQ_NET_PENDING);
+		dec_ap_pending(mdev);
+		req->rq_state &= ~RQ_NET_PENDING;
+		_req_may_be_done(req, error);
+		break;
+
+	case neg_acked:
+		/* assert something? */
+		if (req->rq_state & RQ_NET_PENDING)
+			dec_ap_pending(mdev);
+		req->rq_state &= ~(RQ_NET_OK|RQ_NET_PENDING);
+
+		req->rq_state |= RQ_NET_DONE;
+		_req_may_be_done(req, error);
+		/* else: done by handed_over_to_network */
+		break;
+
+	case barrier_acked:
+		if (req->rq_state & RQ_NET_PENDING) {
+			/* barrier came in before all requests have been acked.
+			 * this is bad, because if the connection is lost now,
+			 * we won't be able to clean them up... */
+			_print_rq_state(req,
+				"FIXME (barrier_acked but pending)");
+			list_move(&req->tl_requests, &mdev->out_of_sequence_requests);
+		}
+		D_ASSERT(req->rq_state & RQ_NET_SENT);
+		req->rq_state |= RQ_NET_DONE;
+		_req_may_be_done(req, error);
+		break;
+
+	case data_received:
+		D_ASSERT(req->rq_state & RQ_NET_PENDING);
+		dec_ap_pending(mdev);
+		req->rq_state &= ~RQ_NET_PENDING;
+		req->rq_state |= (RQ_NET_OK|RQ_NET_DONE);
+		_req_may_be_done(req, error);
+		break;
+	};
+}
+
+/* we may do a local read if:
+ * - we are consistent (of course),
+ * - or we are generally inconsistent,
+ *   BUT we are still/already IN SYNC for this area.
+ *   since size may be bigger than BM_BLOCK_SIZE,
+ *   we may need to check several bits.
+ */
+STATIC int drbd_may_do_local_read(struct drbd_conf *mdev, sector_t sector, int size)
+{
+	unsigned long sbnr, ebnr;
+	sector_t esector, nr_sectors;
+
+	if (mdev->state.disk == UpToDate)
+		return 1;
+	if (mdev->state.disk >= Outdated)
+		return 0;
+	if (mdev->state.disk <  Inconsistent)
+		return 0;
+	/* state.disk == Inconsistent   We will have a look at the BitMap */
+	nr_sectors = drbd_get_capacity(mdev->this_bdev);
+	esector = sector + (size >> 9) - 1;
+
+	D_ASSERT(sector  < nr_sectors);
+	D_ASSERT(esector < nr_sectors);
+
+	sbnr = BM_SECT_TO_BIT(sector);
+	ebnr = BM_SECT_TO_BIT(esector);
+
+	return 0 == drbd_bm_count_bits(mdev, sbnr, ebnr);
+}
+
+STATIC int drbd_make_request_common(struct drbd_conf *mdev, struct bio *bio)
+{
+	const int rw = bio_rw(bio);
+	const int size = bio->bi_size;
+	const sector_t sector = bio->bi_sector;
+	struct drbd_barrier *b = NULL;
+	struct drbd_request *req;
+	int local, remote;
+	int err = -EIO;
+
+	/* allocate outside of all locks; */
+	req = drbd_req_new(mdev, bio);
+	if (!req) {
+		dec_ap_bio(mdev);
+		/* only pass the error to the upper layers.
+		 * if user cannot handle io errors, thats not our business. */
+		ERR("could not kmalloc() req\n");
+		bio_endio(bio, -ENOMEM);
+		return 0;
+	}
+
+	dump_bio(mdev, bio, 0, req);
+
+	local = inc_local(mdev);
+	if (!local) {
+		bio_put(req->private_bio); /* or we get a bio leak */
+		req->private_bio = NULL;
+	}
+	if (rw == WRITE) {
+		remote = 1;
+	} else {
+		/* READ || READA */
+		if (local) {
+			if (!drbd_may_do_local_read(mdev, sector, size)) {
+				/* we could kick the syncer to
+				 * sync this extent asap, wait for
+				 * it, then continue locally.
+				 * Or just issue the request remotely.
+				 */
+				local = 0;
+				bio_put(req->private_bio);
+				req->private_bio = NULL;
+				dec_local(mdev);
+			}
+		}
+		remote = !local && mdev->state.pdsk >= UpToDate;
+	}
+
+	/* If we have a disk, but a READA request is mapped to remote,
+	 * we are Primary, Inconsistent, SyncTarget.
+	 * Just fail that READA request right here.
+	 *
+	 * THINK: maybe fail all READA when not local?
+	 *        or make this configurable...
+	 *        if network is slow, READA won't do any good.
+	 */
+	if (rw == READA && mdev->state.disk >= Inconsistent && !local) {
+		err = -EWOULDBLOCK;
+		goto fail_and_free_req;
+	}
+
+	/* For WRITES going to the local disk, grab a reference on the target
+	 * extent.  This waits for any resync activity in the corresponding
+	 * resync extent to finish, and, if necessary, pulls in the target
+	 * extent into the activity log, which involves further disk io because
+	 * of transactional on-disk meta data updates. */
+	if (rw == WRITE && local)
+		drbd_al_begin_io(mdev, sector);
+
+	remote = remote && (mdev->state.pdsk == UpToDate ||
+			    (mdev->state.pdsk == Inconsistent &&
+			     mdev->state.conn >= Connected));
+
+	if (!(local || remote)) {
+		ERR("IO ERROR: neither local nor remote disk\n");
+		goto fail_free_complete;
+	}
+
+	/* For WRITE request, we have to make sure that we have an
+	 * unused_spare_barrier, in case we need to start a new epoch.
+	 * I try to be smart and avoid to pre-allocate always "just in case",
+	 * but there is a race between testing the bit and pointer outside the
+	 * spinlock, and grabbing the spinlock.
+	 * if we lost that race, we retry.  */
+	if (rw == WRITE && remote &&
+	    mdev->unused_spare_barrier == NULL &&
+	    test_bit(CREATE_BARRIER, &mdev->flags)) {
+allocate_barrier:
+		b = kmalloc(sizeof(struct drbd_barrier), GFP_NOIO);
+		if (!b) {
+			ERR("Failed to alloc barrier.\n");
+			err = -ENOMEM;
+			goto fail_free_complete;
+		}
+	}
+
+	/* GOOD, everything prepared, grab the spin_lock */
+	spin_lock_irq(&mdev->req_lock);
+
+	if (remote) {
+		remote = (mdev->state.pdsk == UpToDate ||
+			    (mdev->state.pdsk == Inconsistent &&
+			     mdev->state.conn >= Connected));
+		if (!remote)
+			drbd_WARN("lost connection while grabbing the req_lock!\n");
+		if (!(local || remote)) {
+			ERR("IO ERROR: neither local nor remote disk\n");
+			spin_unlock_irq(&mdev->req_lock);
+			goto fail_free_complete;
+		}
+	}
+
+	if (b && mdev->unused_spare_barrier == NULL) {
+		mdev->unused_spare_barrier = b;
+		b = NULL;
+	}
+	if (rw == WRITE && remote &&
+	    mdev->unused_spare_barrier == NULL &&
+	    test_bit(CREATE_BARRIER, &mdev->flags)) {
+		/* someone closed the current epoch
+		 * while we were grabbing the spinlock */
+		spin_unlock_irq(&mdev->req_lock);
+		goto allocate_barrier;
+	}
+
+
+	/* Update disk stats */
+	_drbd_start_io_acct(mdev, req, bio);
+
+	/* _maybe_start_new_epoch(mdev);
+	 * If we need to generate a write barrier packet, we have to add the
+	 * new epoch (barrier) object, and queue the barrier packet for sending,
+	 * and queue the req's data after it _within the same lock_, otherwise
+	 * we have race conditions were the reorder domains could be mixed up.
+	 *
+	 * Even read requests may start a new epoch and queue the corresponding
+	 * barrier packet.  To get the write ordering right, we only have to
+	 * make sure that, if this is a write request and it triggered a
+	 * barrier packet, this request is queued within the same spinlock. */
+	if (remote && mdev->unused_spare_barrier &&
+	    test_and_clear_bit(CREATE_BARRIER, &mdev->flags)) {
+		_tl_add_barrier(mdev, mdev->unused_spare_barrier);
+		mdev->unused_spare_barrier = NULL;
+	} else {
+		D_ASSERT(!(remote && rw == WRITE &&
+			   test_bit(CREATE_BARRIER, &mdev->flags)));
+	}
+
+	/* NOTE
+	 * Actually, 'local' may be wrong here already, since we may have failed
+	 * to write to the meta data, and may become wrong anytime because of
+	 * local io-error for some other request, which would lead to us
+	 * "detaching" the local disk.
+	 *
+	 * 'remote' may become wrong any time because the network could fail.
+	 *
+	 * This is a harmless race condition, though, since it is handled
+	 * correctly at the appropriate places; so it just deferres the failure
+	 * of the respective operation.
+	 */
+
+	/* mark them early for readability.
+	 * this just sets some state flags. */
+	if (remote)
+		_req_mod(req, to_be_send, 0);
+	if (local)
+		_req_mod(req, to_be_submitted, 0);
+
+	/* check this request on the colison detection hash tables.
+	 * if we have a conflict, just complete it here.
+	 * THINK do we want to check reads, too? (I don't think so...) */
+	if (rw == WRITE && _req_conflicts(req)) {
+		/* this is a conflicting request.
+		 * even though it may have been only _partially_
+		 * overlapping with one of the currently pending requests,
+		 * without even submitting or sending it, we will
+		 * pretend that it was successfully served right now.
+		 */
+		if (local) {
+			bio_put(req->private_bio);
+			req->private_bio = NULL;
+			drbd_al_complete_io(mdev, req->sector);
+			dec_local(mdev);
+			local = 0;
+		}
+		if (remote)
+			dec_ap_pending(mdev);
+		_drbd_end_io_acct(mdev, req);
+		/* THINK: do we want to fail it (-EIO), or pretend success? */
+		bio_endio(req->master_bio, 0);
+		req->master_bio = NULL;
+		dec_ap_bio(mdev);
+		drbd_req_free(req);
+		remote = 0;
+	}
+
+	/* NOTE remote first: to get the concurrent write detection right,
+	 * we must register the request before start of local IO.  */
+	if (remote) {
+		/* either WRITE and Connected,
+		 * or READ, and no local disk,
+		 * or READ, but not in sync.
+		 */
+		if (rw == WRITE)
+			_req_mod(req, queue_for_net_write, 0);
+		else
+			_req_mod(req, queue_for_net_read, 0);
+	}
+	spin_unlock_irq(&mdev->req_lock);
+	kfree(b); /* if someone else has beaten us to it... */
+
+	if (local) {
+		req->private_bio->bi_bdev = mdev->bc->backing_bdev;
+
+		dump_internal_bio("Pri", mdev, req->private_bio, 0);
+
+		if (FAULT_ACTIVE(mdev, rw == WRITE ? DRBD_FAULT_DT_WR
+				     : rw == READ  ? DRBD_FAULT_DT_RD
+				     :               DRBD_FAULT_DT_RA))
+			bio_endio(req->private_bio, -EIO);
+		else
+			generic_make_request(req->private_bio);
+	}
+
+	/* we need to plug ALWAYS since we possibly need to kick lo_dev.
+	 * we plug after submit, so we won't miss an unplug event */
+	drbd_plug_device(mdev);
+
+	return 0;
+
+fail_free_complete:
+	if (rw == WRITE && local)
+		drbd_al_complete_io(mdev, sector);
+fail_and_free_req:
+	if (local) {
+		bio_put(req->private_bio);
+		req->private_bio = NULL;
+		dec_local(mdev);
+	}
+	bio_endio(bio, err);
+	drbd_req_free(req);
+	dec_ap_bio(mdev);
+	kfree(b);
+
+	return 0;
+}
+
+/* helper function for drbd_make_request
+ * if we can determine just by the mdev (state) that this request will fail,
+ * return 1
+ * otherwise return 0
+ */
+static int drbd_fail_request_early(struct drbd_conf *mdev, int is_write)
+{
+	/* Unconfigured */
+	if (mdev->state.conn == Disconnecting &&
+	    mdev->state.disk == Diskless)
+		return 1;
+
+	if (mdev->state.role != Primary &&
+		(!allow_oos || is_write)) {
+		if (__ratelimit(&drbd_ratelimit_state)) {
+			ERR("Process %s[%u] tried to %s; "
+			    "since we are not in Primary state, "
+			    "we cannot allow this\n",
+			    current->comm, current->pid,
+			    is_write ? "WRITE" : "READ");
+		}
+		return 1;
+	}
+
+	/*
+	 * Paranoia: we might have been primary, but sync target, or
+	 * even diskless, then lost the connection.
+	 * This should have been handled (panic? suspend?) somehwere
+	 * else. But maybe it was not, so check again here.
+	 * Caution: as long as we do not have a read/write lock on mdev,
+	 * to serialize state changes, this is racy, since we may lose
+	 * the connection *after* we test for the cstate.
+	 */
+	if (mdev->state.disk < UpToDate && mdev->state.pdsk < UpToDate) {
+		if (__ratelimit(&drbd_ratelimit_state))
+			ERR("Sorry, I have no access to good data anymore.\n");
+		return 1;
+	}
+
+	return 0;
+}
+
+int drbd_make_request_26(struct request_queue *q, struct bio *bio)
+{
+	unsigned int s_enr, e_enr;
+	struct drbd_conf *mdev = (struct drbd_conf *) q->queuedata;
+
+	if (drbd_fail_request_early(mdev, bio_data_dir(bio) & WRITE)) {
+		bio_endio(bio, -EPERM);
+		return 0;
+	}
+
+	/* Reject barrier requests if we know the underlying device does
+	 * not support them.
+	 * XXX: Need to get this info from peer as well some how so we
+	 * XXX: reject if EITHER side/data/metadata area does not support them.
+	 *
+	 * because of those XXX, this is not yet enabled,
+	 * i.e. in drbd_init_set_defaults we set the NO_BARRIER_SUPP bit.
+	 */
+	if (unlikely(bio_barrier(bio) && test_bit(NO_BARRIER_SUPP, &mdev->flags))) {
+		/* drbd_WARN("Rejecting barrier request as underlying device does not support\n"); */
+		bio_endio(bio, -EOPNOTSUPP);
+		return 0;
+	}
+
+	/*
+	 * what we "blindly" assume:
+	 */
+	D_ASSERT(bio->bi_size > 0);
+	D_ASSERT((bio->bi_size & 0x1ff) == 0);
+	D_ASSERT(bio->bi_idx == 0);
+
+	/* to make some things easier, force allignment of requests within the
+	 * granularity of our hash tables */
+	s_enr = bio->bi_sector >> HT_SHIFT;
+	e_enr = (bio->bi_sector+(bio->bi_size>>9)-1) >> HT_SHIFT;
+
+	if (likely(s_enr == e_enr)) {
+		inc_ap_bio(mdev, 1);
+		return drbd_make_request_common(mdev, bio);
+	}
+
+	/* can this bio be split generically?
+	 * Maybe add our own split-arbitrary-bios function. */
+	if (bio->bi_vcnt != 1 || bio->bi_idx != 0 || bio->bi_size > DRBD_MAX_SEGMENT_SIZE) {
+		/* rather error out here than BUG in bio_split */
+		ERR("bio would need to, but cannot, be split: "
+		    "(vcnt=%u,idx=%u,size=%u,sector=%llu)\n",
+		    bio->bi_vcnt, bio->bi_idx, bio->bi_size,
+		    (unsigned long long)bio->bi_sector);
+		bio_endio(bio, -EINVAL);
+	} else {
+		/* This bio crosses some boundary, so we have to split it. */
+		struct bio_pair *bp;
+		/* works for the "do not cross hash slot boundaries" case
+		 * e.g. sector 262269, size 4096
+		 * s_enr = 262269 >> 6 = 4097
+		 * e_enr = (262269+8-1) >> 6 = 4098
+		 * HT_SHIFT = 6
+		 * sps = 64, mask = 63
+		 * first_sectors = 64 - (262269 & 63) = 3
+		 */
+		const sector_t sect = bio->bi_sector;
+		const int sps = 1 << HT_SHIFT; /* sectors per slot */
+		const int mask = sps - 1;
+		const sector_t first_sectors = sps - (sect & mask);
+		bp = bio_split(bio,
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,28)
+				bio_split_pool,
+#endif
+				first_sectors);
+
+		/* we need to get a "reference count" (ap_bio_cnt)
+		 * to avoid races with the disconnect/reconnect/suspend code.
+		 * In case we need to split the bio here, we need to get two references
+		 * atomically, otherwise we might deadlock when trying to submit the
+		 * second one! */
+		inc_ap_bio(mdev, 2);
+
+		D_ASSERT(e_enr == s_enr + 1);
+
+		drbd_make_request_common(mdev, &bp->bio1);
+		drbd_make_request_common(mdev, &bp->bio2);
+		bio_pair_release(bp);
+	}
+	return 0;
+}
+
+/* This is called by bio_add_page().  With this function we reduce
+ * the number of BIOs that span over multiple DRBD_MAX_SEGMENT_SIZEs
+ * units (was AL_EXTENTs).
+ *
+ * we do the calculation within the lower 32bit of the byte offsets,
+ * since we don't care for actual offset, but only check whether it
+ * would cross "activity log extent" boundaries.
+ *
+ * As long as the BIO is emtpy we have to allow at least one bvec,
+ * regardless of size and offset.  so the resulting bio may still
+ * cross extent boundaries.  those are dealt with (bio_split) in
+ * drbd_make_request_26.
+ */
+int drbd_merge_bvec(struct request_queue *q, struct bvec_merge_data *bvm, struct bio_vec *bvec)
+{
+	struct drbd_conf *mdev = (struct drbd_conf *) q->queuedata;
+	unsigned int bio_offset =
+		(unsigned int)bvm->bi_sector << 9; /* 32 bit */
+	unsigned int bio_size = bvm->bi_size;
+	int limit, backing_limit;
+
+	limit = DRBD_MAX_SEGMENT_SIZE
+	      - ((bio_offset & (DRBD_MAX_SEGMENT_SIZE-1)) + bio_size);
+	if (limit < 0)
+		limit = 0;
+	if (bio_size == 0) {
+		if (limit <= bvec->bv_len)
+			limit = bvec->bv_len;
+	} else if (limit && inc_local(mdev)) {
+		struct request_queue * const b =
+			mdev->bc->backing_bdev->bd_disk->queue;
+		if (b->merge_bvec_fn && mdev->bc->dc.use_bmbv) {
+			backing_limit = b->merge_bvec_fn(b, bvm, bvec);
+			limit = min(limit, backing_limit);
+		}
+		dec_local(mdev);
+	}
+	return limit;
+}
--- linux-rt-2.6.31.orig/ubuntu/drbd/drbd_receiver.c
+++ linux-rt-2.6.31/ubuntu/drbd/drbd_receiver.c
@@ -0,0 +1,4375 @@
+/*
+   drbd_receiver.c
+
+   This file is part of DRBD by Philipp Reisner and Lars Ellenberg.
+
+   Copyright (C) 2001-2008, LINBIT Information Technologies GmbH.
+   Copyright (C) 1999-2008, Philipp Reisner <philipp.reisner@linbit.com>.
+   Copyright (C) 2002-2008, Lars Ellenberg <lars.ellenberg@linbit.com>.
+
+   drbd is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 2, or (at your option)
+   any later version.
+
+   drbd is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with drbd; see the file COPYING.  If not, write to
+   the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+
+#include <linux/autoconf.h>
+#include <linux/module.h>
+
+#include <asm/uaccess.h>
+#include <net/sock.h>
+
+#include <linux/version.h>
+#include <linux/fs.h>
+#include <linux/file.h>
+#include <linux/in.h>
+#include <linux/mm.h>
+#include <linux/drbd_config.h>
+#include <linux/memcontrol.h>
+#include <linux/mm_inline.h>
+#include <linux/slab.h>
+#include <linux/smp_lock.h>
+#include <linux/pkt_sched.h>
+#define __KERNEL_SYSCALLS__
+#include <linux/unistd.h>
+#include <linux/vmalloc.h>
+#include <linux/random.h>
+#include <linux/mm.h>
+#include <linux/string.h>
+#include <linux/scatterlist.h>
+#include <linux/drbd.h>
+#include "drbd_int.h"
+#include "drbd_req.h"
+
+#include "drbd_vli.h"
+
+struct flush_work {
+	struct drbd_work w;
+	struct drbd_epoch *epoch;
+};
+
+enum epoch_event {
+	EV_put,
+	EV_got_barrier_nr,
+	EV_barrier_done,
+	EV_became_last,
+	EV_cleanup = 32, /* used as flag */
+};
+
+enum finish_epoch {
+	FE_still_live,
+	FE_destroyed,
+	FE_recycled,
+};
+
+STATIC int drbd_do_handshake(struct drbd_conf *mdev);
+STATIC int drbd_do_auth(struct drbd_conf *mdev);
+
+STATIC enum finish_epoch drbd_may_finish_epoch(struct drbd_conf *, struct drbd_epoch *, enum epoch_event);
+STATIC int e_end_block(struct drbd_conf *, struct drbd_work *, int);
+static inline struct drbd_epoch *previous_epoch(struct drbd_conf *mdev, struct drbd_epoch *epoch)
+{
+	struct drbd_epoch *prev;
+	spin_lock(&mdev->epoch_lock);
+	prev = list_entry(epoch->list.prev, struct drbd_epoch, list);
+	if (prev == epoch || prev == mdev->current_epoch)
+		prev = NULL;
+	spin_unlock(&mdev->epoch_lock);
+	return prev;
+}
+
+#define GFP_TRY	(__GFP_HIGHMEM | __GFP_NOWARN)
+
+/**
+ * drbd_bp_alloc: Returns a page. Fails only if a signal comes in.
+ */
+STATIC struct page *drbd_pp_alloc(struct drbd_conf *mdev, gfp_t gfp_mask)
+{
+	unsigned long flags = 0;
+	struct page *page;
+	DEFINE_WAIT(wait);
+
+	spin_lock_irqsave(&drbd_pp_lock, flags);
+	page = drbd_pp_pool;
+	if (page) {
+		drbd_pp_pool = (struct page *)page_private(page);
+		set_page_private(page, 0); /* just to be polite */
+		drbd_pp_vacant--;
+	}
+	spin_unlock_irqrestore(&drbd_pp_lock, flags);
+	if (page)
+		goto got_page;
+
+	drbd_kick_lo(mdev);
+
+	for (;;) {
+		prepare_to_wait(&drbd_pp_wait, &wait, TASK_INTERRUPTIBLE);
+
+		/* try the pool again, maybe the drbd_kick_lo set some free */
+		spin_lock_irqsave(&drbd_pp_lock, flags);
+		page = drbd_pp_pool;
+		if (page) {
+			drbd_pp_pool = (struct page *)page_private(page);
+			drbd_pp_vacant--;
+		}
+		spin_unlock_irqrestore(&drbd_pp_lock, flags);
+
+		if (page)
+			break;
+
+		/* hm. pool was empty. try to allocate from kernel.
+		 * don't wait, if none is available, though.
+		 */
+		if (atomic_read(&mdev->pp_in_use)
+					< mdev->net_conf->max_buffers) {
+			page = alloc_page(GFP_TRY);
+			if (page)
+				break;
+		}
+
+		/* doh. still no page.
+		 * either used up the configured maximum number,
+		 * or we are low on memory.
+		 * wait for someone to return a page into the pool.
+		 * unless, of course, someone signalled us.
+		 */
+		if (signal_pending(current)) {
+			drbd_WARN("drbd_pp_alloc interrupted!\n");
+			finish_wait(&drbd_pp_wait, &wait);
+			return NULL;
+		}
+		drbd_kick_lo(mdev);
+		if (!(gfp_mask & __GFP_WAIT)) {
+			finish_wait(&drbd_pp_wait, &wait);
+			return NULL;
+		}
+		schedule();
+	}
+	finish_wait(&drbd_pp_wait, &wait);
+
+ got_page:
+	atomic_inc(&mdev->pp_in_use);
+	return page;
+}
+
+STATIC void drbd_pp_free(struct drbd_conf *mdev, struct page *page)
+{
+	unsigned long flags = 0;
+	int free_it;
+
+	spin_lock_irqsave(&drbd_pp_lock, flags);
+	if (drbd_pp_vacant > (DRBD_MAX_SEGMENT_SIZE/PAGE_SIZE)*minor_count) {
+		free_it = 1;
+	} else {
+		set_page_private(page, (unsigned long)drbd_pp_pool);
+		drbd_pp_pool = page;
+		drbd_pp_vacant++;
+		free_it = 0;
+	}
+	spin_unlock_irqrestore(&drbd_pp_lock, flags);
+
+	atomic_dec(&mdev->pp_in_use);
+
+	if (free_it)
+		__free_page(page);
+
+	wake_up(&drbd_pp_wait);
+}
+
+/*
+You need to hold the req_lock:
+ drbd_free_ee()
+ _drbd_wait_ee_list_empty()
+
+You must not have the req_lock:
+ drbd_alloc_ee()
+ drbd_init_ee()
+ drbd_release_ee()
+ drbd_ee_fix_bhs()
+ drbd_process_done_ee()
+ drbd_clear_done_ee()
+ drbd_wait_ee_list_empty()
+*/
+
+struct Tl_epoch_entry *drbd_alloc_ee(struct drbd_conf *mdev,
+				     u64 id,
+				     sector_t sector,
+				     unsigned int data_size,
+				     gfp_t gfp_mask) __must_hold(local)
+{
+	struct request_queue *q;
+	struct Tl_epoch_entry *e;
+	struct bio_vec *bvec;
+	struct page *page;
+	struct bio *bio;
+	unsigned int ds;
+	int i;
+
+	e = mempool_alloc(drbd_ee_mempool, gfp_mask & ~__GFP_HIGHMEM);
+	if (!e) {
+		if (!(gfp_mask & __GFP_NOWARN))
+			ERR("alloc_ee: Allocation of an EE failed\n");
+		return NULL;
+	}
+
+	bio = bio_alloc(gfp_mask & ~__GFP_HIGHMEM, div_ceil(data_size, PAGE_SIZE));
+	if (!bio) {
+		if (!(gfp_mask & __GFP_NOWARN))
+			ERR("alloc_ee: Allocation of a bio failed\n");
+		goto fail1;
+	}
+
+	bio->bi_bdev = mdev->bc->backing_bdev;
+	bio->bi_sector = sector;
+
+	ds = data_size;
+	while (ds) {
+		page = drbd_pp_alloc(mdev, gfp_mask);
+		if (!page) {
+			if (!(gfp_mask & __GFP_NOWARN))
+				ERR("alloc_ee: Allocation of a page failed\n");
+			goto fail2;
+		}
+		if (!bio_add_page(bio, page, min_t(int, ds, PAGE_SIZE), 0)) {
+			drbd_pp_free(mdev, page);
+			ERR("alloc_ee: bio_add_page(s=%llu,"
+			    "data_size=%u,ds=%u) failed\n",
+			    (unsigned long long)sector, data_size, ds);
+
+			q = bdev_get_queue(bio->bi_bdev);
+			if (q->merge_bvec_fn) {
+				struct bvec_merge_data bvm = {
+					.bi_bdev = bio->bi_bdev,
+					.bi_sector = bio->bi_sector,
+					.bi_size = bio->bi_size,
+					.bi_rw = bio->bi_rw,
+				};
+				int l = q->merge_bvec_fn(q, &bvm,
+						&bio->bi_io_vec[bio->bi_vcnt]);
+				ERR("merge_bvec_fn() = %d\n", l);
+			}
+
+			/* dump more of the bio. */
+			DUMPI(bio->bi_max_vecs);
+			DUMPI(bio->bi_vcnt);
+			DUMPI(bio->bi_size);
+			DUMPI(bio->bi_phys_segments);
+
+			goto fail2;
+			break;
+		}
+		ds -= min_t(int, ds, PAGE_SIZE);
+	}
+
+	D_ASSERT(data_size == bio->bi_size);
+
+	bio->bi_private = e;
+	e->mdev = mdev;
+	e->sector = sector;
+	e->size = bio->bi_size;
+
+	e->private_bio = bio;
+	e->block_id = id;
+	INIT_HLIST_NODE(&e->colision);
+	e->epoch = NULL;
+	e->flags = 0;
+
+	MTRACE(TraceTypeEE, TraceLvlAll,
+	       INFO("allocated EE sec=%llus size=%u ee=%p\n",
+		    (unsigned long long)sector, data_size, e);
+	       );
+
+	return e;
+
+ fail2:
+	__bio_for_each_segment(bvec, bio, i, 0) {
+		drbd_pp_free(mdev, bvec->bv_page);
+	}
+	bio_put(bio);
+ fail1:
+	mempool_free(e, drbd_ee_mempool);
+
+	return NULL;
+}
+
+void drbd_free_ee(struct drbd_conf *mdev, struct Tl_epoch_entry *e)
+{
+	struct bio *bio = e->private_bio;
+	struct bio_vec *bvec;
+	int i;
+
+	MTRACE(TraceTypeEE, TraceLvlAll,
+	       INFO("Free EE sec=%llus size=%u ee=%p\n",
+		    (unsigned long long)e->sector, e->size, e);
+	       );
+
+	__bio_for_each_segment(bvec, bio, i, 0) {
+		drbd_pp_free(mdev, bvec->bv_page);
+	}
+
+	bio_put(bio);
+
+	D_ASSERT(hlist_unhashed(&e->colision));
+
+	mempool_free(e, drbd_ee_mempool);
+}
+
+/* currently on module unload only */
+int drbd_release_ee(struct drbd_conf *mdev, struct list_head *list)
+{
+	int count = 0;
+	struct Tl_epoch_entry *e;
+	struct list_head *le;
+
+	spin_lock_irq(&mdev->req_lock);
+	while (!list_empty(list)) {
+		le = list->next;
+		list_del(le);
+		e = list_entry(le, struct Tl_epoch_entry, w.list);
+		drbd_free_ee(mdev, e);
+		count++;
+	}
+	spin_unlock_irq(&mdev->req_lock);
+
+	return count;
+}
+
+
+STATIC void reclaim_net_ee(struct drbd_conf *mdev)
+{
+	struct Tl_epoch_entry *e;
+	struct list_head *le, *tle;
+
+	/* The EEs are always appended to the end of the list. Since
+	   they are sent in order over the wire, they have to finish
+	   in order. As soon as we see the first not finished we can
+	   stop to examine the list... */
+
+	list_for_each_safe(le, tle, &mdev->net_ee) {
+		e = list_entry(le, struct Tl_epoch_entry, w.list);
+		if (drbd_bio_has_active_page(e->private_bio))
+			break;
+		list_del(le);
+		drbd_free_ee(mdev, e);
+	}
+}
+
+
+/*
+ * This function is called from _asender only_
+ * but see also comments in _req_mod(,barrier_acked)
+ * and receive_Barrier.
+ *
+ * Move entries from net_ee to done_ee, if ready.
+ * Grab done_ee, call all callbacks, free the entries.
+ * The callbacks typically send out ACKs.
+ */
+STATIC int drbd_process_done_ee(struct drbd_conf *mdev)
+{
+	LIST_HEAD(work_list);
+	struct Tl_epoch_entry *e, *t;
+	int ok = 1;
+
+	spin_lock_irq(&mdev->req_lock);
+	reclaim_net_ee(mdev);
+	list_splice_init(&mdev->done_ee, &work_list);
+	spin_unlock_irq(&mdev->req_lock);
+
+	/* possible callbacks here:
+	 * e_end_block, and e_end_resync_block, e_send_discard_ack.
+	 * all ignore the last argument.
+	 */
+	list_for_each_entry_safe(e, t, &work_list, w.list) {
+		MTRACE(TraceTypeEE, TraceLvlAll,
+		       INFO("Process EE on done_ee sec=%llus size=%u ee=%p\n",
+			    (unsigned long long)e->sector, e->size, e);
+			);
+		/* list_del not necessary, next/prev members not touched */
+		if (e->w.cb(mdev, &e->w, 0) == 0)
+			ok = 0;
+		drbd_free_ee(mdev, e);
+	}
+	wake_up(&mdev->ee_wait);
+
+	return ok;
+}
+
+
+
+/* clean-up helper for drbd_disconnect */
+void _drbd_clear_done_ee(struct drbd_conf *mdev)
+{
+	struct list_head *le;
+	struct Tl_epoch_entry *e;
+	struct drbd_epoch *epoch;
+	int n = 0;
+
+
+	reclaim_net_ee(mdev);
+
+	while (!list_empty(&mdev->done_ee)) {
+		le = mdev->done_ee.next;
+		list_del(le);
+		e = list_entry(le, struct Tl_epoch_entry, w.list);
+		if (mdev->net_conf->wire_protocol == DRBD_PROT_C
+		|| is_syncer_block_id(e->block_id))
+			++n;
+
+		if (!hlist_unhashed(&e->colision))
+			hlist_del_init(&e->colision);
+
+		if (e->epoch) {
+			if (e->flags & EE_IS_BARRIER) {
+				epoch = previous_epoch(mdev, e->epoch);
+				if (epoch)
+					drbd_may_finish_epoch(mdev, epoch, EV_barrier_done + EV_cleanup);
+			}
+			drbd_may_finish_epoch(mdev, e->epoch, EV_put + EV_cleanup);
+		}
+		drbd_free_ee(mdev, e);
+	}
+
+	sub_unacked(mdev, n);
+}
+
+void _drbd_wait_ee_list_empty(struct drbd_conf *mdev, struct list_head *head)
+{
+	DEFINE_WAIT(wait);
+
+	/* avoids spin_lock/unlock
+	 * and calling prepare_to_wait in the fast path */
+	while (!list_empty(head)) {
+		prepare_to_wait(&mdev->ee_wait, &wait, TASK_UNINTERRUPTIBLE);
+		spin_unlock_irq(&mdev->req_lock);
+		drbd_kick_lo(mdev);
+		schedule();
+		finish_wait(&mdev->ee_wait, &wait);
+		spin_lock_irq(&mdev->req_lock);
+	}
+}
+
+void drbd_wait_ee_list_empty(struct drbd_conf *mdev, struct list_head *head)
+{
+	spin_lock_irq(&mdev->req_lock);
+	_drbd_wait_ee_list_empty(mdev, head);
+	spin_unlock_irq(&mdev->req_lock);
+}
+
+/* see also kernel_accept; which is only present since 2.6.18.
+ * also we want to log which part of it failed, exactly */
+STATIC int drbd_accept(struct drbd_conf *mdev, const char **what,
+		struct socket *sock, struct socket **newsock)
+{
+	struct sock *sk = sock->sk;
+	int err = 0;
+
+	*what = "listen";
+	err = sock->ops->listen(sock, 5);
+	if (err < 0)
+		goto out;
+
+	*what = "sock_create_lite";
+	err = sock_create_lite(sk->sk_family, sk->sk_type, sk->sk_protocol,
+			       newsock);
+	if (err < 0)
+		goto out;
+
+	*what = "accept";
+	err = sock->ops->accept(sock, *newsock, 0);
+	if (err < 0) {
+		sock_release(*newsock);
+		*newsock = NULL;
+		goto out;
+	}
+	(*newsock)->ops  = sock->ops;
+
+out:
+	return err;
+}
+
+STATIC int drbd_recv_short(struct drbd_conf *mdev, struct socket *sock,
+		    void *buf, size_t size, int flags)
+{
+	mm_segment_t oldfs;
+	struct kvec iov = {
+		.iov_base = buf,
+		.iov_len = size,
+	};
+	struct msghdr msg = {
+		.msg_iovlen = 1,
+		.msg_iov = (struct iovec *)&iov,
+		.msg_flags = (flags ? flags : MSG_WAITALL | MSG_NOSIGNAL)
+	};
+	int rv;
+
+	oldfs = get_fs();
+	set_fs(KERNEL_DS);
+	rv = sock_recvmsg(sock, &msg, size, msg.msg_flags);
+	set_fs(oldfs);
+
+	return rv;
+}
+
+STATIC int drbd_recv(struct drbd_conf *mdev, void *buf, size_t size)
+{
+	mm_segment_t oldfs;
+	struct kvec iov = {
+		.iov_base = buf,
+		.iov_len = size,
+	};
+	struct msghdr msg = {
+		.msg_iovlen = 1,
+		.msg_iov = (struct iovec *)&iov,
+		.msg_flags = MSG_WAITALL | MSG_NOSIGNAL
+	};
+	int rv;
+
+	oldfs = get_fs();
+	set_fs(KERNEL_DS);
+
+	for (;;) {
+		rv = sock_recvmsg(mdev->data.socket, &msg, size, msg.msg_flags);
+		if (rv == size)
+			break;
+
+		/* Note:
+		 * ECONNRESET	other side closed the connection
+		 * ERESTARTSYS	(on  sock) we got a signal
+		 */
+
+		if (rv < 0) {
+			if (rv == -ECONNRESET)
+				INFO("sock was reset by peer\n");
+			else if (rv != -ERESTARTSYS)
+				ERR("sock_recvmsg returned %d\n", rv);
+			break;
+		} else if (rv == 0) {
+			INFO("sock was shut down by peer\n");
+			break;
+		} else	{
+			/* signal came in, or peer/link went down,
+			 * after we read a partial message
+			 */
+			/* D_ASSERT(signal_pending(current)); */
+			break;
+		}
+	};
+
+	set_fs(oldfs);
+
+	if (rv != size)
+		drbd_force_state(mdev, NS(conn, BrokenPipe));
+
+	return rv;
+}
+
+STATIC struct socket *drbd_try_connect(struct drbd_conf *mdev)
+{
+	const char *what;
+	struct socket *sock;
+	struct sockaddr_in6 src_in6;
+	int err;
+	int disconnect_on_error = 1;
+
+	if (!inc_net(mdev))
+		return NULL;
+
+	what = "sock_create_kern";
+	err = sock_create_kern(((struct sockaddr *)mdev->net_conf->my_addr)->sa_family,
+		SOCK_STREAM, IPPROTO_TCP, &sock);
+	if (err < 0) {
+		sock = NULL;
+		goto out;
+	}
+
+	sock->sk->sk_rcvtimeo =
+	sock->sk->sk_sndtimeo =  mdev->net_conf->try_connect_int*HZ;
+
+       /* explicitly bind to the configured IP as source IP
+	*  for the outgoing connections.
+	*  This is needed for multihomed hosts and to be
+	*  able to use lo: interfaces for drbd.
+	* Make sure to use 0 as portnumber, so linux selects
+	*  a free one dynamically.
+	*/
+	memcpy(&src_in6, mdev->net_conf->my_addr,
+	       min_t(int, mdev->net_conf->my_addr_len, sizeof(src_in6)));
+	if (((struct sockaddr *)mdev->net_conf->my_addr)->sa_family == AF_INET6)
+		src_in6.sin6_port = 0;
+	else
+		((struct sockaddr_in *)&src_in6)->sin_port = 0; /* AF_INET & AF_SCI */
+
+	what = "bind before connect";
+	err = sock->ops->bind(sock,
+			      (struct sockaddr *) &src_in6,
+			      mdev->net_conf->my_addr_len);
+	if (err < 0)
+		goto out;
+
+	/* connect may fail, peer not yet available.
+	 * stay WFConnection, don't go Disconnecting! */
+	disconnect_on_error = 0;
+	what = "connect";
+	err = sock->ops->connect(sock,
+				 (struct sockaddr *)mdev->net_conf->peer_addr,
+				 mdev->net_conf->peer_addr_len, 0);
+
+out:
+	if (err < 0) {
+		if (sock) {
+			sock_release(sock);
+			sock = NULL;
+		}
+		switch (-err) {
+			/* timeout, busy, signal pending */
+		case ETIMEDOUT: case EAGAIN: case EINPROGRESS:
+		case EINTR: case ERESTARTSYS:
+			/* peer not (yet) available, network problem */
+		case ECONNREFUSED: case ENETUNREACH:
+		case EHOSTDOWN:    case EHOSTUNREACH:
+			disconnect_on_error = 0;
+			break;
+		default:
+			ERR("%s failed, err = %d\n", what, err);
+		}
+		if (disconnect_on_error)
+			drbd_force_state(mdev, NS(conn, Disconnecting));
+	}
+	dec_net(mdev);
+	return sock;
+}
+
+STATIC struct socket *drbd_wait_for_connect(struct drbd_conf *mdev)
+{
+	int timeo, err;
+	struct socket *s_estab = NULL, *s_listen;
+	const char *what;
+
+	if (!inc_net(mdev))
+		return NULL;
+
+	what = "sock_create_kern";
+	err = sock_create_kern(((struct sockaddr *)mdev->net_conf->my_addr)->sa_family,
+		SOCK_STREAM, IPPROTO_TCP, &s_listen);
+	if (err) {
+		s_listen = NULL;
+		goto out;
+	}
+
+	timeo = mdev->net_conf->try_connect_int * HZ;
+	timeo += (random32() & 1) ? timeo / 7 : -timeo / 7; /* 28.5% random jitter */
+
+	s_listen->sk->sk_reuse    = 1; /* SO_REUSEADDR */
+	s_listen->sk->sk_rcvtimeo = timeo;
+	s_listen->sk->sk_sndtimeo = timeo;
+
+	what = "bind before listen";
+	err = s_listen->ops->bind(s_listen,
+			      (struct sockaddr *) mdev->net_conf->my_addr,
+			      mdev->net_conf->my_addr_len);
+	if (err < 0)
+		goto out;
+
+	err = drbd_accept(mdev, &what, s_listen, &s_estab);
+
+out:
+	if (s_listen)
+		sock_release(s_listen);
+	if (err < 0) {
+		if (err != -EAGAIN && err != -EINTR && err != -ERESTARTSYS) {
+			ERR("%s failed, err = %d\n", what, err);
+			drbd_force_state(mdev, NS(conn, Disconnecting));
+		}
+	}
+	dec_net(mdev);
+
+	return s_estab;
+}
+
+STATIC int drbd_send_fp(struct drbd_conf *mdev,
+	struct socket *sock, enum Drbd_Packet_Cmd cmd)
+{
+	struct Drbd_Header *h = (struct Drbd_Header *) &mdev->data.sbuf.head;
+
+	return _drbd_send_cmd(mdev, sock, cmd, h, sizeof(*h), 0);
+}
+
+STATIC enum Drbd_Packet_Cmd drbd_recv_fp(struct drbd_conf *mdev, struct socket *sock)
+{
+	struct Drbd_Header *h = (struct Drbd_Header *) &mdev->data.sbuf.head;
+	int rr;
+
+	rr = drbd_recv_short(mdev, sock, h, sizeof(*h), 0);
+
+	if (rr == sizeof(*h) && h->magic == BE_DRBD_MAGIC)
+		return be16_to_cpu(h->command);
+
+	return 0xffff;
+}
+
+/**
+ * drbd_socket_okay:
+ * Tests if the connection behind the socket still exists. If not it frees
+ * the socket.
+ */
+static int drbd_socket_okay(struct drbd_conf *mdev, struct socket **sock)
+{
+	int rr;
+	char tb[4];
+
+	if (!*sock)
+		return FALSE;
+
+	rr = drbd_recv_short(mdev, *sock, tb, 4, MSG_DONTWAIT | MSG_PEEK);
+
+	if (rr > 0 || rr == -EAGAIN) {
+		return TRUE;
+	} else {
+		sock_release(*sock);
+		*sock = NULL;
+		return FALSE;
+	}
+}
+
+/*
+ * return values:
+ *   1 yess, we have a valid connection
+ *   0 oops, did not work out, please try again
+ *  -1 peer talks different language,
+ *     no point in trying again, please go standalone.
+ *  -2 We do not have a network config...
+ */
+STATIC int drbd_connect(struct drbd_conf *mdev)
+{
+	struct socket *s, *sock, *msock;
+	int try, h, ok;
+
+	D_ASSERT(!mdev->data.socket);
+
+	if (test_and_clear_bit(CREATE_BARRIER, &mdev->flags))
+		ERR("CREATE_BARRIER flag was set in drbd_connect - now cleared!\n");
+
+	if (drbd_request_state(mdev, NS(conn, WFConnection)) < SS_Success)
+		return -2;
+
+	clear_bit(DISCARD_CONCURRENT, &mdev->flags);
+
+	sock  = NULL;
+	msock = NULL;
+
+	do {
+		for (try = 0;;) {
+			/* 3 tries, this should take less than a second! */
+			s = drbd_try_connect(mdev);
+			if (s || ++try >= 3)
+				break;
+			/* give the other side time to call bind() & listen() */
+			__set_current_state(TASK_INTERRUPTIBLE);
+			schedule_timeout(HZ / 10);
+		}
+
+		if (s) {
+			if (!sock) {
+				drbd_send_fp(mdev, s, HandShakeS);
+				sock = s;
+				s = NULL;
+			} else if (!msock) {
+				drbd_send_fp(mdev, s, HandShakeM);
+				msock = s;
+				s = NULL;
+			} else {
+				ERR("Logic error in drbd_connect()\n");
+				return -1;
+			}
+		}
+
+		if (sock && msock) {
+			__set_current_state(TASK_INTERRUPTIBLE);
+			schedule_timeout(HZ / 10);
+			ok = drbd_socket_okay(mdev, &sock);
+			ok = drbd_socket_okay(mdev, &msock) && ok;
+			if (ok)
+				break;
+		}
+
+retry:
+		s = drbd_wait_for_connect(mdev);
+		if (s) {
+			try = drbd_recv_fp(mdev, s);
+			drbd_socket_okay(mdev, &sock);
+			drbd_socket_okay(mdev, &msock);
+			switch (try) {
+			case HandShakeS:
+				if (sock) {
+					drbd_WARN("initial packet S crossed\n");
+					sock_release(sock);
+				}
+				sock = s;
+				break;
+			case HandShakeM:
+				if (msock) {
+					drbd_WARN("initial packet M crossed\n");
+					sock_release(msock);
+					}
+				msock = s;
+				set_bit(DISCARD_CONCURRENT, &mdev->flags);
+				break;
+			default:
+				drbd_WARN("Error receiving initial packet\n");
+				sock_release(s);
+				if (random32() & 1)
+					goto retry;
+			}
+		}
+
+		if (mdev->state.conn <= Disconnecting)
+			return -1;
+		if (signal_pending(current)) {
+			flush_signals(current);
+			smp_rmb();
+			if (get_t_state(&mdev->receiver) == Exiting) {
+				if (sock)
+					sock_release(sock);
+				if (msock)
+					sock_release(msock);
+				return -1;
+			}
+		}
+
+		if (sock && msock) {
+			ok = drbd_socket_okay(mdev, &sock);
+			ok = drbd_socket_okay(mdev, &msock) && ok;
+			if (ok)
+				break;
+		}
+	} while (1);
+
+	msock->sk->sk_reuse = 1; /* SO_REUSEADDR */
+	sock->sk->sk_reuse = 1; /* SO_REUSEADDR */
+
+	sock->sk->sk_allocation = GFP_NOIO;
+	msock->sk->sk_allocation = GFP_NOIO;
+
+	sock->sk->sk_priority = TC_PRIO_INTERACTIVE_BULK;
+	msock->sk->sk_priority = TC_PRIO_INTERACTIVE;
+
+	if (mdev->net_conf->sndbuf_size) {
+		sock->sk->sk_sndbuf = mdev->net_conf->sndbuf_size;
+		sock->sk->sk_rcvbuf = mdev->net_conf->sndbuf_size;
+		sock->sk->sk_userlocks |= SOCK_SNDBUF_LOCK | SOCK_RCVBUF_LOCK;
+	}
+
+	/* NOT YET ...
+	 * sock->sk->sk_sndtimeo = mdev->net_conf->timeout*HZ/10;
+	 * sock->sk->sk_rcvtimeo = MAX_SCHEDULE_TIMEOUT;
+	 * first set it to the HandShake timeout, wich is hardcoded for now: */
+	sock->sk->sk_sndtimeo =
+	sock->sk->sk_rcvtimeo = 2*HZ;
+
+	msock->sk->sk_sndtimeo = mdev->net_conf->timeout*HZ/10;
+	msock->sk->sk_rcvtimeo = mdev->net_conf->ping_int*HZ;
+
+	/* we don't want delays.
+	 * we use TCP_CORK where apropriate, though */
+	drbd_tcp_nodelay(sock);
+	drbd_tcp_nodelay(msock);
+
+	mdev->data.socket = sock;
+	mdev->meta.socket = msock;
+	mdev->last_received = jiffies;
+
+	D_ASSERT(mdev->asender.task == NULL);
+
+	h = drbd_do_handshake(mdev);
+	if (h <= 0)
+		return h;
+
+	if (mdev->cram_hmac_tfm) {
+		/* drbd_request_state(mdev, NS(conn, WFAuth)); */
+		if (!drbd_do_auth(mdev)) {
+			ERR("Authentication of peer failed\n");
+			return -1;
+		}
+	}
+
+	if (drbd_request_state(mdev, NS(conn, WFReportParams)) < SS_Success)
+		return 0;
+
+	sock->sk->sk_sndtimeo = mdev->net_conf->timeout*HZ/10;
+	sock->sk->sk_rcvtimeo = MAX_SCHEDULE_TIMEOUT;
+
+	atomic_set(&mdev->packet_seq, 0);
+	mdev->peer_seq = 0;
+
+	drbd_thread_start(&mdev->asender);
+
+	drbd_send_protocol(mdev);
+	drbd_send_sync_param(mdev, &mdev->sync_conf);
+	drbd_send_sizes(mdev);
+	drbd_send_uuids(mdev);
+	drbd_send_state(mdev);
+	clear_bit(USE_DEGR_WFC_T, &mdev->flags);
+
+	return 1;
+}
+
+STATIC int drbd_recv_header(struct drbd_conf *mdev, struct Drbd_Header *h)
+{
+	int r;
+
+	r = drbd_recv(mdev, h, sizeof(*h));
+
+	if (unlikely(r != sizeof(*h))) {
+		ERR("short read expecting header on sock: r=%d\n", r);
+		return FALSE;
+	};
+	h->command = be16_to_cpu(h->command);
+	h->length  = be16_to_cpu(h->length);
+	if (unlikely(h->magic != BE_DRBD_MAGIC)) {
+		ERR("magic?? on data m: 0x%lx c: %d l: %d\n",
+		    (long)be32_to_cpu(h->magic),
+		    h->command, h->length);
+		return FALSE;
+	}
+	mdev->last_received = jiffies;
+
+	return TRUE;
+}
+
+STATIC enum finish_epoch drbd_flush_after_epoch(struct drbd_conf *mdev, struct drbd_epoch *epoch)
+{
+	int rv;
+
+	if (mdev->write_ordering >= WO_bdev_flush && inc_local(mdev)) {
+		rv = blkdev_issue_flush(mdev->bc->backing_bdev, NULL);
+		if (rv) {
+			ERR("local disk flush failed with status %d\n", rv);
+			/* would rather check on EOPNOTSUPP, but that is not reliable.
+			 * don't try again for ANY return value != 0
+			 * if (rv == -EOPNOTSUPP) */
+			drbd_bump_write_ordering(mdev, WO_drain_io);
+		}
+		dec_local(mdev);
+	}
+
+	return drbd_may_finish_epoch(mdev, epoch, EV_barrier_done);
+}
+
+/**
+ * w_flush: Checks if an epoch can be closed and therefore might
+ * close and/or free the epoch object.
+ */
+STATIC int w_flush(struct drbd_conf *mdev, struct drbd_work *w, int cancel)
+{
+	struct flush_work *fw = (struct flush_work *)w;
+	struct drbd_epoch *epoch = fw->epoch;
+
+	kfree(w);
+
+	if (!test_and_set_bit(DE_BARRIER_IN_NEXT_EPOCH_ISSUED, &epoch->flags))
+		drbd_flush_after_epoch(mdev, epoch);
+
+	drbd_may_finish_epoch(mdev, epoch, EV_put |
+			      (mdev->state.conn < Connected ? EV_cleanup : 0));
+
+	return 1;
+}
+
+/**
+ * drbd_may_finish_epoch: Checks if an epoch can be closed and therefore might
+ * close and/or free the epoch object.
+ */
+STATIC enum finish_epoch drbd_may_finish_epoch(struct drbd_conf *mdev,
+					       struct drbd_epoch *epoch,
+					       enum epoch_event ev)
+{
+	int finish, epoch_size;
+	struct drbd_epoch *next_epoch;
+	int schedule_flush = 0;
+	enum finish_epoch rv = FE_still_live;
+
+	static char *epoch_event_str[] = {
+		[EV_put] = "put",
+		[EV_got_barrier_nr] = "got_barrier_nr",
+		[EV_barrier_done] = "barrier_done",
+		[EV_became_last] = "became_last",
+	};
+
+	spin_lock(&mdev->epoch_lock);
+	do {
+		next_epoch = NULL;
+		finish = 0;
+
+		epoch_size = atomic_read(&epoch->epoch_size);
+
+		switch (ev & ~EV_cleanup) {
+		case EV_put:
+			atomic_dec(&epoch->active);
+			break;
+		case EV_got_barrier_nr:
+			set_bit(DE_HAVE_BARRIER_NUMBER, &epoch->flags);
+
+			/* Special case: If we just switched from WO_bio_barrier to
+			   WO_bdev_flush we should not finish the current epoch */
+			if (test_bit(DE_CONTAINS_A_BARRIER, &epoch->flags) && epoch_size == 1 &&
+			    mdev->write_ordering != WO_bio_barrier &&
+			    epoch == mdev->current_epoch)
+				clear_bit(DE_CONTAINS_A_BARRIER, &epoch->flags);
+			break;
+		case EV_barrier_done:
+			set_bit(DE_BARRIER_IN_NEXT_EPOCH_DONE, &epoch->flags);
+			break;
+		case EV_became_last:
+			/* nothing to do*/
+			break;
+		}
+
+		MTRACE(TraceTypeEpochs, TraceLvlAll,
+		       INFO("Update epoch  %p/%d { size=%d active=%d %c%c n%c%c } ev=%s\n",
+			    epoch, epoch->barrier_nr, epoch_size, atomic_read(&epoch->active),
+			    test_bit(DE_HAVE_BARRIER_NUMBER, &epoch->flags) ? 'n' : '-',
+			    test_bit(DE_CONTAINS_A_BARRIER, &epoch->flags) ? 'b' : '-',
+			    test_bit(DE_BARRIER_IN_NEXT_EPOCH_ISSUED, &epoch->flags) ? 'i' : '-',
+			    test_bit(DE_BARRIER_IN_NEXT_EPOCH_DONE, &epoch->flags) ? 'd' : '-',
+			    epoch_event_str[ev]);
+			);
+
+		if (epoch_size != 0 &&
+		    atomic_read(&epoch->active) == 0 &&
+		    test_bit(DE_HAVE_BARRIER_NUMBER, &epoch->flags) &&
+		    epoch->list.prev == &mdev->current_epoch->list &&
+		    !test_bit(DE_IS_FINISHING, &epoch->flags)) {
+			/* Nearly all conditions are met to finish that epoch... */
+			if (test_bit(DE_BARRIER_IN_NEXT_EPOCH_DONE, &epoch->flags) ||
+			    mdev->write_ordering == WO_none ||
+			    (epoch_size == 1 && test_bit(DE_CONTAINS_A_BARRIER, &epoch->flags)) ||
+			    ev & EV_cleanup) {
+				finish = 1;
+				set_bit(DE_IS_FINISHING, &epoch->flags);
+			} else if (!test_bit(DE_BARRIER_IN_NEXT_EPOCH_ISSUED, &epoch->flags) &&
+				 mdev->write_ordering == WO_bio_barrier) {
+				atomic_inc(&epoch->active);
+				schedule_flush = 1;
+			}
+		}
+		if (finish) {
+			if (!(ev & EV_cleanup)) {
+				spin_unlock(&mdev->epoch_lock);
+				drbd_send_b_ack(mdev, epoch->barrier_nr, epoch_size);
+				spin_lock(&mdev->epoch_lock);
+			}
+			dec_unacked(mdev);
+
+			if (mdev->current_epoch != epoch) {
+				next_epoch = list_entry(epoch->list.next, struct drbd_epoch, list);
+				list_del(&epoch->list);
+				ev = EV_became_last | (ev & EV_cleanup);
+				mdev->epochs--;
+				MTRACE(TraceTypeEpochs, TraceLvlSummary,
+				       INFO("Freeing epoch %p/%d { size=%d } nr_epochs=%d\n",
+					    epoch, epoch->barrier_nr, epoch_size, mdev->epochs);
+					);
+				kfree(epoch);
+
+				if (rv == FE_still_live)
+					rv = FE_destroyed;
+			} else {
+				epoch->flags = 0;
+				atomic_set(&epoch->epoch_size, 0);
+				/* atomic_set(&epoch->active, 0); is alrady zero */
+				if (rv == FE_still_live)
+					rv = FE_recycled;
+			}
+		}
+
+		if (!next_epoch)
+			break;
+
+		epoch = next_epoch;
+	} while (1);
+
+	spin_unlock(&mdev->epoch_lock);
+
+	if (schedule_flush) {
+		struct flush_work *fw;
+		fw = kmalloc(sizeof(*fw), GFP_ATOMIC);
+		if (fw) {
+			MTRACE(TraceTypeEpochs, TraceLvlMetrics,
+			       INFO("Schedul flush %p/%d { size=%d } nr_epochs=%d\n",
+				    epoch, epoch->barrier_nr, epoch_size, mdev->epochs);
+				);
+			fw->w.cb = w_flush;
+			fw->epoch = epoch;
+			drbd_queue_work(&mdev->data.work, &fw->w);
+		} else {
+			drbd_WARN("Could not kmalloc a flush_work obj\n");
+			set_bit(DE_BARRIER_IN_NEXT_EPOCH_ISSUED, &epoch->flags);
+			/* That is not a recursion, only one level */
+			drbd_may_finish_epoch(mdev, epoch, EV_barrier_done);
+			drbd_may_finish_epoch(mdev, epoch, EV_put);
+		}
+	}
+
+	return rv;
+}
+
+/**
+ * drbd_bump_write_ordering: It turned out that the current mdev->write_ordering
+ * method does not work on the backing block device. Try the next allowed method.
+ */
+void drbd_bump_write_ordering(struct drbd_conf *mdev, enum write_ordering_e wo) __must_hold(local)
+{
+	enum write_ordering_e pwo;
+	static char *write_ordering_str[] = {
+		[WO_none] = "none",
+		[WO_drain_io] = "drain",
+		[WO_bdev_flush] = "flush",
+		[WO_bio_barrier] = "barrier",
+	};
+
+	pwo = mdev->write_ordering;
+	wo = min(pwo, wo);
+	if (wo == WO_bio_barrier && mdev->bc->dc.no_disk_barrier)
+		wo = WO_bdev_flush;
+	if (wo == WO_bdev_flush && mdev->bc->dc.no_disk_flush)
+		wo = WO_drain_io;
+	if (wo == WO_drain_io && mdev->bc->dc.no_disk_drain)
+		wo = WO_none;
+	mdev->write_ordering = wo;
+	if (pwo != mdev->write_ordering || wo == WO_bio_barrier)
+		INFO("Method to ensure write ordering: %s\n", write_ordering_str[mdev->write_ordering]);
+}
+
+/**
+ * w_e_reissue: In case the IO subsystem delivered an error for an BIO with the
+ * BIO_RW_BARRIER flag set, retry that bio without the barrier flag set.
+ */
+int w_e_reissue(struct drbd_conf *mdev, struct drbd_work *w, int cancel) __releases(local)
+{
+	struct Tl_epoch_entry *e = (struct Tl_epoch_entry *)w;
+	struct bio *bio = e->private_bio;
+
+	/* We leave DE_CONTAINS_A_BARRIER and EE_IS_BARRIER in place,
+	   (and DE_BARRIER_IN_NEXT_EPOCH_ISSUED in the previous Epoch)
+	   so that we can finish that epoch in drbd_may_finish_epoch().
+	   That is necessary if we already have a long chain of Epochs, before
+	   we realize that BIO_RW_BARRIER is actually not supported */
+
+	/* As long as the -ENOTSUPP on the barrier is reported immediately
+	   that will never trigger. It it is reported late, we will just
+	   print that warning an continue corretly for all future requests
+	   with WO_bdev_flush */
+	if (previous_epoch(mdev, e->epoch))
+		drbd_WARN("Write ordering was not enforced (one time event)\n");
+
+	/* prepare bio for re-submit,
+	 * re-init volatile members */
+	/* we still have a local reference,
+	 * inc_local was done in receive_Data. */
+	bio->bi_bdev = mdev->bc->backing_bdev;
+	bio->bi_sector = e->sector;
+	bio->bi_size = e->size;
+	bio->bi_idx = 0;
+
+	bio->bi_flags &= ~(BIO_POOL_MASK - 1);
+	bio->bi_flags |= 1 << BIO_UPTODATE;
+
+	/* don't know whether this is necessary: */
+	bio->bi_phys_segments = 0;
+	bio->bi_next = NULL;
+
+	/* these should be unchanged: */
+	/* bio->bi_end_io = drbd_endio_write_sec; */
+	/* bio->bi_vcnt = whatever; */
+
+	e->w.cb = e_end_block;
+
+	/* This is no longer a barrier request. */
+	bio->bi_rw &= ~(1UL << BIO_RW_BARRIER);
+
+	drbd_generic_make_request(mdev, DRBD_FAULT_DT_WR, bio);
+
+	return 1;
+}
+
+STATIC int receive_Barrier(struct drbd_conf *mdev, struct Drbd_Header *h)
+{
+	int rv, issue_flush;
+	struct Drbd_Barrier_Packet *p = (struct Drbd_Barrier_Packet *)h;
+	struct drbd_epoch *epoch;
+
+	ERR_IF(h->length != (sizeof(*p)-sizeof(*h))) return FALSE;
+
+	rv = drbd_recv(mdev, h->payload, h->length);
+	ERR_IF(rv != h->length) return FALSE;
+
+	inc_unacked(mdev);
+
+	if (mdev->net_conf->wire_protocol != DRBD_PROT_C)
+		drbd_kick_lo(mdev);
+
+	mdev->current_epoch->barrier_nr = p->barrier;
+	rv = drbd_may_finish_epoch(mdev, mdev->current_epoch, EV_got_barrier_nr);
+
+	/* BarrierAck may imply that the corresponding extent is dropped from
+	 * the activity log, which means it would not be resynced in case the
+	 * Primary crashes now.
+	 * Therefore we must send the barrier_ack after the barrier request was
+	 * completed. */
+	switch (mdev->write_ordering) {
+	case WO_bio_barrier:
+	case WO_none:
+		if (rv == FE_recycled)
+			return TRUE;
+		break;
+
+	case WO_bdev_flush:
+	case WO_drain_io:
+		D_ASSERT(rv == FE_still_live);
+		set_bit(DE_BARRIER_IN_NEXT_EPOCH_ISSUED, &mdev->current_epoch->flags);
+		drbd_wait_ee_list_empty(mdev, &mdev->active_ee);
+		rv = drbd_flush_after_epoch(mdev, mdev->current_epoch);
+		if (rv == FE_recycled)
+			return TRUE;
+
+		/* The asender will send all the ACKs and barrier ACKs out, since
+		   all EEs moved from the active_ee to the done_ee. We need to
+		   provide a new epoch object for the EEs that come in soon */
+		break;
+	}
+
+	epoch = kmalloc(sizeof(struct drbd_epoch), GFP_KERNEL);
+	if (!epoch) {
+		drbd_WARN("Allocation of an epoch failed, slowing down\n");
+		issue_flush = !test_and_set_bit(DE_BARRIER_IN_NEXT_EPOCH_ISSUED, &epoch->flags);
+		drbd_wait_ee_list_empty(mdev, &mdev->active_ee);
+		if (issue_flush) {
+			rv = drbd_flush_after_epoch(mdev, mdev->current_epoch);
+			if (rv == FE_recycled)
+				return TRUE;
+		}
+
+		drbd_wait_ee_list_empty(mdev, &mdev->done_ee);
+
+		return TRUE;
+	}
+
+	epoch->flags = 0;
+	atomic_set(&epoch->epoch_size, 0);
+	atomic_set(&epoch->active, 0);
+
+	spin_lock(&mdev->epoch_lock);
+	if (atomic_read(&mdev->current_epoch->epoch_size)) {
+		list_add(&epoch->list, &mdev->current_epoch->list);
+		mdev->current_epoch = epoch;
+		mdev->epochs++;
+		MTRACE(TraceTypeEpochs, TraceLvlMetrics,
+		       INFO("Allocat epoch %p/xxxx { } nr_epochs=%d\n", epoch, mdev->epochs);
+			);
+	} else {
+		/* The current_epoch got recycled while we allocated this one... */
+		kfree(epoch);
+	}
+	spin_unlock(&mdev->epoch_lock);
+
+	return TRUE;
+}
+
+/* used from receive_RSDataReply (recv_resync_read)
+ * and from receive_Data */
+STATIC struct Tl_epoch_entry *
+read_in_block(struct drbd_conf *mdev, u64 id, sector_t sector, int data_size) __must_hold(local)
+{
+	struct Tl_epoch_entry *e;
+	struct bio_vec *bvec;
+	struct page *page;
+	struct bio *bio;
+	int dgs, ds, i, rr;
+	void *dig_in = mdev->int_dig_in;
+	void *dig_vv = mdev->int_dig_vv;
+
+	dgs = (mdev->agreed_pro_version >= 87 && mdev->integrity_r_tfm) ?
+		crypto_hash_digestsize(mdev->integrity_r_tfm) : 0;
+
+	if (dgs) {
+		rr = drbd_recv(mdev, dig_in, dgs);
+		if (rr != dgs) {
+			drbd_WARN("short read receiving data digest: read %d expected %d\n",
+			     rr, dgs);
+			return NULL;
+		}
+	}
+
+	data_size -= dgs;
+
+	ERR_IF(data_size &  0x1ff) return NULL;
+	ERR_IF(data_size >  DRBD_MAX_SEGMENT_SIZE) return NULL;
+
+	e = drbd_alloc_ee(mdev, id, sector, data_size, GFP_KERNEL);
+	if (!e)
+		return NULL;
+	bio = e->private_bio;
+	ds = data_size;
+	bio_for_each_segment(bvec, bio, i) {
+		page = bvec->bv_page;
+		rr = drbd_recv(mdev, kmap(page), min_t(int, ds, PAGE_SIZE));
+		kunmap(page);
+		if (rr != min_t(int, ds, PAGE_SIZE)) {
+			drbd_free_ee(mdev, e);
+			drbd_WARN("short read receiving data: read %d expected %d\n",
+			     rr, min_t(int, ds, PAGE_SIZE));
+			return NULL;
+		}
+		ds -= rr;
+	}
+
+	if (dgs) {
+		drbd_csum(mdev, mdev->integrity_r_tfm, bio, dig_vv);
+		if (memcmp(dig_in, dig_vv, dgs)) {
+			ERR("Digest integrity check FAILED.\n");
+			drbd_bcast_ee(mdev, "digest failed",
+					dgs, dig_in, dig_vv, e);
+			drbd_free_ee(mdev, e);
+			return NULL;
+		}
+	}
+	mdev->recv_cnt += data_size>>9;
+	return e;
+}
+
+/* drbd_drain_block() just takes a data block
+ * out of the socket input buffer, and discards it.
+ */
+STATIC int drbd_drain_block(struct drbd_conf *mdev, int data_size)
+{
+	struct page *page;
+	int rr, rv = 1;
+	void *data;
+
+	page = drbd_pp_alloc(mdev, GFP_KERNEL);
+
+	data = kmap(page);
+	while (data_size) {
+		rr = drbd_recv(mdev, data, min_t(int, data_size, PAGE_SIZE));
+		if (rr != min_t(int, data_size, PAGE_SIZE)) {
+			rv = 0;
+			drbd_WARN("short read receiving data: read %d expected %d\n",
+			     rr, min_t(int, data_size, PAGE_SIZE));
+			break;
+		}
+		data_size -= rr;
+	}
+	kunmap(page);
+	drbd_pp_free(mdev, page);
+	return rv;
+}
+
+/* kick lower level device, if we have more than (arbitrary number)
+ * reference counts on it, which typically are locally submitted io
+ * requests.  don't use unacked_cnt, so we speed up proto A and B, too. */
+static void maybe_kick_lo(struct drbd_conf *mdev)
+{
+	if (atomic_read(&mdev->local_cnt) >= mdev->net_conf->unplug_watermark)
+		drbd_kick_lo(mdev);
+}
+
+STATIC int recv_dless_read(struct drbd_conf *mdev, struct drbd_request *req,
+			   sector_t sector, int data_size)
+{
+	struct bio_vec *bvec;
+	struct bio *bio;
+	int dgs, rr, i, expect;
+	void *dig_in = mdev->int_dig_in;
+	void *dig_vv = mdev->int_dig_vv;
+
+	dgs = (mdev->agreed_pro_version >= 87 && mdev->integrity_r_tfm) ?
+		crypto_hash_digestsize(mdev->integrity_r_tfm) : 0;
+
+	if (dgs) {
+		rr = drbd_recv(mdev, dig_in, dgs);
+		if (rr != dgs) {
+			drbd_WARN("short read receiving data reply digest: read %d expected %d\n",
+			     rr, dgs);
+			return 0;
+		}
+	}
+
+	data_size -= dgs;
+
+	bio = req->master_bio;
+	D_ASSERT(sector == bio->bi_sector);
+
+	bio_for_each_segment(bvec, bio, i) {
+		expect = min_t(int, data_size, bvec->bv_len);
+		rr = drbd_recv(mdev,
+			     kmap(bvec->bv_page)+bvec->bv_offset,
+			     expect);
+		kunmap(bvec->bv_page);
+		if (rr != expect) {
+			drbd_WARN("short read receiving data reply: "
+			     "read %d expected %d\n",
+			     rr, expect);
+			return 0;
+		}
+		data_size -= rr;
+	}
+
+	if (dgs) {
+		drbd_csum(mdev, mdev->integrity_r_tfm, bio, dig_vv);
+		if (memcmp(dig_in, dig_vv, dgs)) {
+			ERR("Digest integrity check FAILED. Broken NICs?\n");
+			return 0;
+		}
+	}
+
+	D_ASSERT(data_size == 0);
+	return 1;
+}
+
+/* e_end_resync_block() is called via
+ * drbd_process_done_ee() by asender only */
+STATIC int e_end_resync_block(struct drbd_conf *mdev, struct drbd_work *w, int unused)
+{
+	struct Tl_epoch_entry *e = (struct Tl_epoch_entry *)w;
+	sector_t sector = e->sector;
+	int ok;
+
+	D_ASSERT(hlist_unhashed(&e->colision));
+
+	if (likely(drbd_bio_uptodate(e->private_bio))) {
+		drbd_set_in_sync(mdev, sector, e->size);
+		ok = drbd_send_ack(mdev, RSWriteAck, e);
+	} else {
+		/* Record failure to sync */
+		drbd_rs_failed_io(mdev, sector, e->size);
+
+		ok  = drbd_send_ack(mdev, NegAck, e);
+		ok &= drbd_io_error(mdev, FALSE);
+	}
+	dec_unacked(mdev);
+
+	return ok;
+}
+
+STATIC int recv_resync_read(struct drbd_conf *mdev, sector_t sector, int data_size) __releases(local)
+{
+	struct Tl_epoch_entry *e;
+
+	e = read_in_block(mdev, ID_SYNCER, sector, data_size);
+	if (!e) {
+		dec_local(mdev);
+		return FALSE;
+	}
+
+	dec_rs_pending(mdev);
+
+	e->private_bio->bi_end_io = drbd_endio_write_sec;
+	e->private_bio->bi_rw = WRITE;
+	e->w.cb = e_end_resync_block;
+
+	inc_unacked(mdev);
+	/* corresponding dec_unacked() in e_end_resync_block()
+	 * respective _drbd_clear_done_ee */
+
+	spin_lock_irq(&mdev->req_lock);
+	list_add(&e->w.list, &mdev->sync_ee);
+	spin_unlock_irq(&mdev->req_lock);
+
+	MTRACE(TraceTypeEE, TraceLvlAll,
+	       INFO("submit EE (RS)WRITE sec=%llus size=%u ee=%p\n",
+		    (unsigned long long)e->sector, e->size, e);
+	       );
+	dump_internal_bio("Sec", mdev, e->private_bio, 0);
+	drbd_generic_make_request(mdev, DRBD_FAULT_RS_WR, e->private_bio);
+	/* accounting done in endio */
+
+	maybe_kick_lo(mdev);
+	return TRUE;
+}
+
+STATIC int receive_DataReply(struct drbd_conf *mdev, struct Drbd_Header *h)
+{
+	struct drbd_request *req;
+	sector_t sector;
+	unsigned int header_size, data_size;
+	int ok;
+	struct Drbd_Data_Packet *p = (struct Drbd_Data_Packet *)h;
+
+	header_size = sizeof(*p) - sizeof(*h);
+	data_size   = h->length  - header_size;
+
+	ERR_IF(data_size == 0) return FALSE;
+
+	if (drbd_recv(mdev, h->payload, header_size) != header_size)
+		return FALSE;
+
+	sector = be64_to_cpu(p->sector);
+
+	spin_lock_irq(&mdev->req_lock);
+	req = _ar_id_to_req(mdev, p->block_id, sector);
+	spin_unlock_irq(&mdev->req_lock);
+	if (unlikely(!req)) {
+		ERR("Got a corrupt block_id/sector pair(1).\n");
+		return FALSE;
+	}
+
+	/* hlist_del(&req->colision) is done in _req_may_be_done, to avoid
+	 * special casing it there for the various failure cases.
+	 * still no race with drbd_fail_pending_reads */
+	ok = recv_dless_read(mdev, req, sector, data_size);
+
+	if (ok)
+		req_mod(req, data_received, 0);
+	/* else: nothing. handled from drbd_disconnect...
+	 * I don't think we may complete this just yet
+	 * in case we are "on-disconnect: freeze" */
+
+	return ok;
+}
+
+STATIC int receive_RSDataReply(struct drbd_conf *mdev, struct Drbd_Header *h)
+{
+	sector_t sector;
+	unsigned int header_size, data_size;
+	int ok;
+	struct Drbd_Data_Packet *p = (struct Drbd_Data_Packet *)h;
+
+	header_size = sizeof(*p) - sizeof(*h);
+	data_size   = h->length  - header_size;
+
+	ERR_IF(data_size == 0) return FALSE;
+
+	if (drbd_recv(mdev, h->payload, header_size) != header_size)
+		return FALSE;
+
+	sector = be64_to_cpu(p->sector);
+	D_ASSERT(p->block_id == ID_SYNCER);
+
+	if (inc_local(mdev)) {
+		/* data is submitted to disk within recv_resync_read.
+		 * corresponding dec_local done below on error,
+		 * or in drbd_endio_write_sec. */
+		ok = recv_resync_read(mdev, sector, data_size);
+	} else {
+		if (__ratelimit(&drbd_ratelimit_state))
+			ERR("Can not write resync data to local disk.\n");
+
+		ok = drbd_drain_block(mdev, data_size);
+
+		drbd_send_ack_dp(mdev, NegAck, p);
+	}
+
+	return ok;
+}
+
+/* e_end_block() is called via drbd_process_done_ee().
+ * this means this function only runs in the asender thread
+ */
+STATIC int e_end_block(struct drbd_conf *mdev, struct drbd_work *w, int unused)
+{
+	struct Tl_epoch_entry *e = (struct Tl_epoch_entry *)w;
+	sector_t sector = e->sector;
+	struct drbd_epoch *epoch;
+	int ok = 1, pcmd;
+
+	if (e->flags & EE_IS_BARRIER) {
+		epoch = previous_epoch(mdev, e->epoch);
+		if (epoch)
+			drbd_may_finish_epoch(mdev, epoch, EV_barrier_done);
+	}
+
+	if (mdev->net_conf->wire_protocol == DRBD_PROT_C) {
+		if (likely(drbd_bio_uptodate(e->private_bio))) {
+			pcmd = (mdev->state.conn >= SyncSource &&
+				mdev->state.conn <= PausedSyncT &&
+				e->flags & EE_MAY_SET_IN_SYNC) ?
+				RSWriteAck : WriteAck;
+			ok &= drbd_send_ack(mdev, pcmd, e);
+			if (pcmd == RSWriteAck)
+				drbd_set_in_sync(mdev, sector, e->size);
+		} else {
+			ok  = drbd_send_ack(mdev, NegAck, e);
+			ok &= drbd_io_error(mdev, FALSE);
+			/* we expect it to be marked out of sync anyways...
+			 * maybe assert this?  */
+		}
+		dec_unacked(mdev);
+	} else if (unlikely(!drbd_bio_uptodate(e->private_bio))) {
+		ok = drbd_io_error(mdev, FALSE);
+	}
+
+	/* we delete from the conflict detection hash _after_ we sent out the
+	 * WriteAck / NegAck, to get the sequence number right.  */
+	if (mdev->net_conf->two_primaries) {
+		spin_lock_irq(&mdev->req_lock);
+		D_ASSERT(!hlist_unhashed(&e->colision));
+		hlist_del_init(&e->colision);
+		spin_unlock_irq(&mdev->req_lock);
+	} else {
+		D_ASSERT(hlist_unhashed(&e->colision));
+	}
+
+	drbd_may_finish_epoch(mdev, e->epoch, EV_put);
+
+	return ok;
+}
+
+STATIC int e_send_discard_ack(struct drbd_conf *mdev, struct drbd_work *w, int unused)
+{
+	struct Tl_epoch_entry *e = (struct Tl_epoch_entry *)w;
+	int ok = 1;
+
+	D_ASSERT(mdev->net_conf->wire_protocol == DRBD_PROT_C);
+	ok = drbd_send_ack(mdev, DiscardAck, e);
+
+	spin_lock_irq(&mdev->req_lock);
+	D_ASSERT(!hlist_unhashed(&e->colision));
+	hlist_del_init(&e->colision);
+	spin_unlock_irq(&mdev->req_lock);
+
+	dec_unacked(mdev);
+
+	return ok;
+}
+
+/* Called from receive_Data.
+ * Synchronize packets on sock with packets on msock.
+ *
+ * This is here so even when a Data packet traveling via sock overtook an Ack
+ * packet traveling on msock, they are still processed in the order they have
+ * been sent.
+ *
+ * Note: we don't care for Ack packets overtaking Data packets.
+ *
+ * In case packet_seq is larger than mdev->peer_seq number, there are
+ * outstanding packets on the msock. We wait for them to arrive.
+ * In case we are the logically next packet, we update mdev->peer_seq
+ * ourselves. Correctly handles 32bit wrap around.
+ *
+ * Assume we have a 10 GBit connection, that is about 1<<30 byte per second,
+ * about 1<<21 sectors per second. So "worst" case, we have 1<<3 == 8 seconds
+ * for the 24bit wrap (historical atomic_t guarantee on some archs), and we have
+ * 1<<9 == 512 seconds aka ages for the 32bit wrap around...
+ *
+ * returns 0 if we may process the packet,
+ * -ERESTARTSYS if we were interrupted (by disconnect signal). */
+static int drbd_wait_peer_seq(struct drbd_conf *mdev, const u32 packet_seq)
+{
+	DEFINE_WAIT(wait);
+	unsigned int p_seq;
+	long timeout;
+	int ret = 0;
+	spin_lock(&mdev->peer_seq_lock);
+	for (;;) {
+		prepare_to_wait(&mdev->seq_wait, &wait, TASK_INTERRUPTIBLE);
+		if (seq_le(packet_seq, mdev->peer_seq+1))
+			break;
+		if (signal_pending(current)) {
+			ret = -ERESTARTSYS;
+			break;
+		}
+		p_seq = mdev->peer_seq;
+		spin_unlock(&mdev->peer_seq_lock);
+		timeout = schedule_timeout(30*HZ);
+		spin_lock(&mdev->peer_seq_lock);
+		if (timeout == 0 && p_seq == mdev->peer_seq) {
+			ret = -ETIMEDOUT;
+			ERR("ASSERT FAILED waited 30 seconds for sequence update, forcing reconnect\n");
+			break;
+		}
+	}
+	finish_wait(&mdev->seq_wait, &wait);
+	if (mdev->peer_seq+1 == packet_seq)
+		mdev->peer_seq++;
+	spin_unlock(&mdev->peer_seq_lock);
+	return ret;
+}
+
+/* mirrored write */
+STATIC int receive_Data(struct drbd_conf *mdev, struct Drbd_Header *h)
+{
+	sector_t sector;
+	struct Tl_epoch_entry *e;
+	struct Drbd_Data_Packet *p = (struct Drbd_Data_Packet *)h;
+	int header_size, data_size;
+	int rw = WRITE;
+	u32 dp_flags;
+
+	header_size = sizeof(*p) - sizeof(*h);
+	data_size   = h->length  - header_size;
+
+	ERR_IF(data_size == 0) return FALSE;
+
+	if (drbd_recv(mdev, h->payload, header_size) != header_size)
+		return FALSE;
+
+	if (!inc_local(mdev)) {
+		/* data is submitted to disk at the end of this function.
+		 * corresponding dec_local done either below (on error),
+		 * or in drbd_endio_write_sec. */
+		if (__ratelimit(&drbd_ratelimit_state))
+			ERR("Can not write mirrored data block "
+			    "to local disk.\n");
+		spin_lock(&mdev->peer_seq_lock);
+		if (mdev->peer_seq+1 == be32_to_cpu(p->seq_num))
+			mdev->peer_seq++;
+		spin_unlock(&mdev->peer_seq_lock);
+
+		drbd_send_ack_dp(mdev, NegAck, p);
+		atomic_inc(&mdev->current_epoch->epoch_size);
+		return drbd_drain_block(mdev, data_size);
+	}
+
+	sector = be64_to_cpu(p->sector);
+	e = read_in_block(mdev, p->block_id, sector, data_size);
+	if (!e) {
+		dec_local(mdev);
+		return FALSE;
+	}
+
+	e->private_bio->bi_end_io = drbd_endio_write_sec;
+	e->w.cb = e_end_block;
+
+	spin_lock(&mdev->epoch_lock);
+	e->epoch = mdev->current_epoch;
+	atomic_inc(&e->epoch->epoch_size);
+	atomic_inc(&e->epoch->active);
+
+	if (mdev->write_ordering == WO_bio_barrier && atomic_read(&e->epoch->epoch_size) == 1) {
+		struct drbd_epoch *epoch;
+		/* Issue a barrier if we start a new epoch, and the previous epoch
+		   was not a epoch containing a single request which already was
+		   a Barrier. */
+		epoch = list_entry(e->epoch->list.prev, struct drbd_epoch, list);
+		if (epoch == e->epoch) {
+			MTRACE(TraceTypeEpochs, TraceLvlMetrics,
+			       INFO("Add barrier   %p/%d\n",
+				    epoch, epoch->barrier_nr);
+				);
+			set_bit(DE_CONTAINS_A_BARRIER, &e->epoch->flags);
+			rw |= (1<<BIO_RW_BARRIER);
+			e->flags |= EE_IS_BARRIER;
+		} else {
+			if (atomic_read(&epoch->epoch_size) > 1 ||
+			    !test_bit(DE_CONTAINS_A_BARRIER, &epoch->flags)) {
+				MTRACE(TraceTypeEpochs, TraceLvlMetrics,
+				       INFO("Add barrier   %p/%d, setting bi in %p/%d\n",
+					    e->epoch, e->epoch->barrier_nr,
+					    epoch, epoch->barrier_nr);
+					);
+				set_bit(DE_BARRIER_IN_NEXT_EPOCH_ISSUED, &epoch->flags);
+				set_bit(DE_CONTAINS_A_BARRIER, &e->epoch->flags);
+				rw |= (1<<BIO_RW_BARRIER);
+				e->flags |= EE_IS_BARRIER;
+			}
+		}
+	}
+	spin_unlock(&mdev->epoch_lock);
+
+	dp_flags = be32_to_cpu(p->dp_flags);
+	if (dp_flags & DP_HARDBARRIER)
+		rw |= (1<<BIO_RW_BARRIER);
+	if (dp_flags & DP_RW_SYNC)
+		rw |= (1<<BIO_RW_SYNCIO) | (1<<BIO_RW_UNPLUG);
+	if (dp_flags & DP_MAY_SET_IN_SYNC)
+		e->flags |= EE_MAY_SET_IN_SYNC;
+
+	/* I'm the receiver, I do hold a net_cnt reference. */
+	if (!mdev->net_conf->two_primaries) {
+		spin_lock_irq(&mdev->req_lock);
+	} else {
+		/* don't get the req_lock yet,
+		 * we may sleep in drbd_wait_peer_seq */
+		const int size = e->size;
+		const int discard = test_bit(DISCARD_CONCURRENT, &mdev->flags);
+		DEFINE_WAIT(wait);
+		struct drbd_request *i;
+		struct hlist_node *n;
+		struct hlist_head *slot;
+		int first;
+
+		D_ASSERT(mdev->net_conf->wire_protocol == DRBD_PROT_C);
+		BUG_ON(mdev->ee_hash == NULL);
+		BUG_ON(mdev->tl_hash == NULL);
+
+		/* conflict detection and handling:
+		 * 1. wait on the sequence number,
+		 *    in case this data packet overtook ACK packets.
+		 * 2. check our hash tables for conflicting requests.
+		 *    we only need to walk the tl_hash, since an ee can not
+		 *    have a conflict with an other ee: on the submitting
+		 *    node, the corresponding req had already been conflicting,
+		 *    and a conflicting req is never sent.
+		 *
+		 * Note: for two_primaries, we are protocol C,
+		 * so there cannot be any request that is DONE
+		 * but still on the transfer log.
+		 *
+		 * unconditionally add to the ee_hash.
+		 *
+		 * if no conflicting request is found:
+		 *    submit.
+		 *
+		 * if any conflicting request is found
+		 * that has not yet been acked,
+		 * AND I have the "discard concurrent writes" flag:
+		 *	 queue (via done_ee) the DiscardAck; OUT.
+		 *
+		 * if any conflicting request is found:
+		 *	 block the receiver, waiting on misc_wait
+		 *	 until no more conflicting requests are there,
+		 *	 or we get interrupted (disconnect).
+		 *
+		 *	 we do not just write after local io completion of those
+		 *	 requests, but only after req is done completely, i.e.
+		 *	 we wait for the DiscardAck to arrive!
+		 *
+		 *	 then proceed normally, i.e. submit.
+		 */
+		if (drbd_wait_peer_seq(mdev, be32_to_cpu(p->seq_num)))
+			goto out_interrupted;
+
+		spin_lock_irq(&mdev->req_lock);
+
+		hlist_add_head(&e->colision, ee_hash_slot(mdev, sector));
+
+#define OVERLAPS overlaps(i->sector, i->size, sector, size)
+		slot = tl_hash_slot(mdev, sector);
+		first = 1;
+		for (;;) {
+			int have_unacked = 0;
+			int have_conflict = 0;
+			prepare_to_wait(&mdev->misc_wait, &wait,
+				TASK_INTERRUPTIBLE);
+			hlist_for_each_entry(i, n, slot, colision) {
+				if (OVERLAPS) {
+					/* only ALERT on first iteration,
+					 * we may be woken up early... */
+					if (first)
+						ALERT("%s[%u] Concurrent local write detected!"
+						      "	new: %llus +%u; pending: %llus +%u\n",
+						      current->comm, current->pid,
+						      (unsigned long long)sector, size,
+						      (unsigned long long)i->sector, i->size);
+					if (i->rq_state & RQ_NET_PENDING)
+						++have_unacked;
+					++have_conflict;
+				}
+			}
+#undef OVERLAPS
+			if (!have_conflict)
+				break;
+
+			/* Discard Ack only for the _first_ iteration */
+			if (first && discard && have_unacked) {
+				ALERT("Concurrent write! [DISCARD BY FLAG] sec=%llus\n",
+				     (unsigned long long)sector);
+				inc_unacked(mdev);
+				e->w.cb = e_send_discard_ack;
+				list_add_tail(&e->w.list, &mdev->done_ee);
+
+				spin_unlock_irq(&mdev->req_lock);
+
+				/* we could probably send that DiscardAck ourselves,
+				 * but I don't like the receiver using the msock */
+
+				dec_local(mdev);
+				wake_asender(mdev);
+				finish_wait(&mdev->misc_wait, &wait);
+				return TRUE;
+			}
+
+			if (signal_pending(current)) {
+				hlist_del_init(&e->colision);
+
+				spin_unlock_irq(&mdev->req_lock);
+
+				finish_wait(&mdev->misc_wait, &wait);
+				goto out_interrupted;
+			}
+
+			spin_unlock_irq(&mdev->req_lock);
+			if (first) {
+				first = 0;
+				ALERT("Concurrent write! [W AFTERWARDS] "
+				     "sec=%llus\n", (unsigned long long)sector);
+			} else if (discard) {
+				/* we had none on the first iteration.
+				 * there must be none now. */
+				D_ASSERT(have_unacked == 0);
+			}
+			schedule();
+			spin_lock_irq(&mdev->req_lock);
+		}
+		finish_wait(&mdev->misc_wait, &wait);
+	}
+
+	list_add(&e->w.list, &mdev->active_ee);
+	spin_unlock_irq(&mdev->req_lock);
+
+	switch (mdev->net_conf->wire_protocol) {
+	case DRBD_PROT_C:
+		inc_unacked(mdev);
+		/* corresponding dec_unacked() in e_end_block()
+		 * respective _drbd_clear_done_ee */
+		break;
+	case DRBD_PROT_B:
+		/* I really don't like it that the receiver thread
+		 * sends on the msock, but anyways */
+		drbd_send_ack(mdev, RecvAck, e);
+		break;
+	case DRBD_PROT_A:
+		/* nothing to do */
+		break;
+	}
+
+	if (mdev->state.pdsk == Diskless) {
+		/* In case we have the only disk of the cluster, */
+		drbd_set_out_of_sync(mdev, e->sector, e->size);
+		e->flags |= EE_CALL_AL_COMPLETE_IO;
+		drbd_al_begin_io(mdev, e->sector);
+	}
+
+	MTRACE(TraceTypeEE, TraceLvlAll,
+	       INFO("submit EE (DATA)WRITE sec=%llus size=%u ee=%p\n",
+		    (unsigned long long)e->sector, e->size, e);
+	       );
+
+	e->private_bio->bi_rw = rw;
+	dump_internal_bio("Sec", mdev, e->private_bio, 0);
+	drbd_generic_make_request(mdev, DRBD_FAULT_DT_WR, e->private_bio);
+	/* accounting done in endio */
+
+	maybe_kick_lo(mdev);
+	return TRUE;
+
+out_interrupted:
+	/* yes, the epoch_size now is imbalanced.
+	 * but we drop the connection anyways, so we don't have a chance to
+	 * receive a barrier... atomic_inc(&mdev->epoch_size); */
+	dec_local(mdev);
+	drbd_free_ee(mdev, e);
+	return FALSE;
+}
+
+STATIC int receive_DataRequest(struct drbd_conf *mdev, struct Drbd_Header *h)
+{
+	sector_t sector;
+	const sector_t capacity = drbd_get_capacity(mdev->this_bdev);
+	struct Tl_epoch_entry *e;
+	struct digest_info *di;
+	int size, digest_size;
+	unsigned int fault_type;
+	struct Drbd_BlockRequest_Packet *p =
+		(struct Drbd_BlockRequest_Packet *)h;
+	const int brps = sizeof(*p)-sizeof(*h);
+
+	if (drbd_recv(mdev, h->payload, brps) != brps)
+		return FALSE;
+
+	sector = be64_to_cpu(p->sector);
+	size   = be32_to_cpu(p->blksize);
+
+	if (size <= 0 || (size & 0x1ff) != 0 || size > DRBD_MAX_SEGMENT_SIZE) {
+		ERR("%s:%d: sector: %llus, size: %u\n", __FILE__, __LINE__,
+				(unsigned long long)sector, size);
+		return FALSE;
+	}
+	if (sector + (size>>9) > capacity) {
+		ERR("%s:%d: sector: %llus, size: %u\n", __FILE__, __LINE__,
+				(unsigned long long)sector, size);
+		return FALSE;
+	}
+
+	if (!inc_local_if_state(mdev, UpToDate)) {
+		if (__ratelimit(&drbd_ratelimit_state))
+			ERR("Can not satisfy peer's read request, "
+			    "no local data.\n");
+		drbd_send_ack_rp(mdev, h->command == DataRequest ? NegDReply :
+				 NegRSDReply , p);
+		return TRUE;
+	}
+
+	e = drbd_alloc_ee(mdev, p->block_id, sector, size, GFP_KERNEL);
+	if (!e) {
+		dec_local(mdev);
+		return FALSE;
+	}
+
+	e->private_bio->bi_rw = READ;
+	e->private_bio->bi_end_io = drbd_endio_read_sec;
+
+	switch (h->command) {
+	case DataRequest:
+		e->w.cb = w_e_end_data_req;
+		fault_type = DRBD_FAULT_DT_RD;
+		break;
+	case RSDataRequest:
+		e->w.cb = w_e_end_rsdata_req;
+		fault_type = DRBD_FAULT_RS_RD;
+		/* Eventually this should become asynchrously. Currently it
+		 * blocks the whole receiver just to delay the reading of a
+		 * resync data block.
+		 * the drbd_work_queue mechanism is made for this...
+		 */
+		if (!drbd_rs_begin_io(mdev, sector)) {
+			/* we have been interrupted,
+			 * probably connection lost! */
+			D_ASSERT(signal_pending(current));
+			dec_local(mdev);
+			drbd_free_ee(mdev, e);
+			return 0;
+		}
+		break;
+
+	case OVReply:
+	case CsumRSRequest:
+		fault_type = DRBD_FAULT_RS_RD;
+		digest_size = h->length - brps ;
+		di = kmalloc(sizeof(*di) + digest_size, GFP_KERNEL);
+		if (!di) {
+			dec_local(mdev);
+			drbd_free_ee(mdev, e);
+			return 0;
+		}
+
+		di->digest_size = digest_size;
+		di->digest = (((char *)di)+sizeof(struct digest_info));
+
+		if (drbd_recv(mdev, di->digest, digest_size) != digest_size) {
+			dec_local(mdev);
+			drbd_free_ee(mdev, e);
+			kfree(di);
+			return FALSE;
+		}
+
+		e->block_id = (u64)(unsigned long)di;
+		if (h->command == CsumRSRequest) {
+			D_ASSERT(mdev->agreed_pro_version >= 89);
+			e->w.cb = w_e_end_csum_rs_req;
+		} else if (h->command == OVReply) {
+			e->w.cb = w_e_end_ov_reply;
+			dec_rs_pending(mdev);
+			break;
+		}
+
+		if (!drbd_rs_begin_io(mdev, sector)) {
+			/* we have been interrupted, probably connection lost! */
+			D_ASSERT(signal_pending(current));
+			drbd_free_ee(mdev, e);
+			kfree(di);
+			dec_local(mdev);
+			return FALSE;
+		}
+		break;
+
+	case OVRequest:
+		e->w.cb = w_e_end_ov_req;
+		fault_type = DRBD_FAULT_RS_RD;
+		/* Eventually this should become asynchrously. Currently it
+		 * blocks the whole receiver just to delay the reading of a
+		 * resync data block.
+		 * the drbd_work_queue mechanism is made for this...
+		 */
+		if (!drbd_rs_begin_io(mdev, sector)) {
+			/* we have been interrupted,
+			 * probably connection lost! */
+			D_ASSERT(signal_pending(current));
+			dec_local(mdev);
+			drbd_free_ee(mdev, e);
+			return 0;
+		}
+		break;
+
+
+	default:
+		ERR("unexpected command (%s) in receive_DataRequest\n",
+		    cmdname(h->command));
+		fault_type = DRBD_FAULT_MAX;
+	}
+
+	spin_lock_irq(&mdev->req_lock);
+	list_add(&e->w.list, &mdev->read_ee);
+	spin_unlock_irq(&mdev->req_lock);
+
+	inc_unacked(mdev);
+
+	MTRACE(TraceTypeEE, TraceLvlAll,
+	       INFO("submit EE READ sec=%llus size=%u ee=%p\n",
+		    (unsigned long long)e->sector, e->size, e);
+	       );
+
+	dump_internal_bio("Sec", mdev, e->private_bio, 0);
+	drbd_generic_make_request(mdev, fault_type, e->private_bio);
+	maybe_kick_lo(mdev);
+
+	return TRUE;
+}
+
+STATIC int drbd_asb_recover_0p(struct drbd_conf *mdev) __must_hold(local)
+{
+	int self, peer, rv = -100;
+	unsigned long ch_self, ch_peer;
+
+	self = mdev->bc->md.uuid[Bitmap] & 1;
+	peer = mdev->p_uuid[Bitmap] & 1;
+
+	ch_peer = mdev->p_uuid[UUID_SIZE];
+	ch_self = mdev->comm_bm_set;
+
+	switch (mdev->net_conf->after_sb_0p) {
+	case Consensus:
+	case DiscardSecondary:
+	case CallHelper:
+		ERR("Configuration error.\n");
+		break;
+	case Disconnect:
+		break;
+	case DiscardYoungerPri:
+		if (self == 0 && peer == 1) {
+			rv = -1;
+			break;
+		}
+		if (self == 1 && peer == 0) {
+			rv =  1;
+			break;
+		}
+		/* Else fall through to one of the other strategies... */
+	case DiscardOlderPri:
+		if (self == 0 && peer == 1) {
+			rv = 1;
+			break;
+		}
+		if (self == 1 && peer == 0) {
+			rv = -1;
+			break;
+		}
+		/* Else fall through to one of the other strategies... */
+		drbd_WARN("Discard younger/older primary did not found a decision\n"
+		     "Using discard-least-changes instead\n");
+	case DiscardZeroChg:
+		if (ch_peer == 0 && ch_self == 0) {
+			rv = test_bit(DISCARD_CONCURRENT, &mdev->flags)
+				? -1 : 1;
+			break;
+		} else {
+			if (ch_peer == 0) { rv =  1; break; }
+			if (ch_self == 0) { rv = -1; break; }
+		}
+		if (mdev->net_conf->after_sb_0p == DiscardZeroChg)
+			break;
+	case DiscardLeastChg:
+		if	(ch_self < ch_peer)
+			rv = -1;
+		else if (ch_self > ch_peer)
+			rv =  1;
+		else /* ( ch_self == ch_peer ) */
+		     /* Well, then use something else. */
+			rv = test_bit(DISCARD_CONCURRENT, &mdev->flags)
+				? -1 : 1;
+		break;
+	case DiscardLocal:
+		rv = -1;
+		break;
+	case DiscardRemote:
+		rv =  1;
+	}
+
+	return rv;
+}
+
+STATIC int drbd_asb_recover_1p(struct drbd_conf *mdev) __must_hold(local)
+{
+	int self, peer, hg, rv = -100;
+
+	self = mdev->bc->md.uuid[Bitmap] & 1;
+	peer = mdev->p_uuid[Bitmap] & 1;
+
+	switch (mdev->net_conf->after_sb_1p) {
+	case DiscardYoungerPri:
+	case DiscardOlderPri:
+	case DiscardLeastChg:
+	case DiscardLocal:
+	case DiscardRemote:
+		ERR("Configuration error.\n");
+		break;
+	case Disconnect:
+		break;
+	case Consensus:
+		hg = drbd_asb_recover_0p(mdev);
+		if (hg == -1 && mdev->state.role == Secondary)
+			rv = hg;
+		if (hg == 1  && mdev->state.role == Primary)
+			rv = hg;
+		break;
+	case Violently:
+		rv = drbd_asb_recover_0p(mdev);
+		break;
+	case DiscardSecondary:
+		return mdev->state.role == Primary ? 1 : -1;
+	case CallHelper:
+		hg = drbd_asb_recover_0p(mdev);
+		if (hg == -1 && mdev->state.role == Primary) {
+			self = drbd_set_role(mdev, Secondary, 0);
+			if (self != SS_Success) {
+				drbd_khelper(mdev, "pri-lost-after-sb");
+			} else {
+				drbd_WARN("Sucessfully gave up primary role.\n");
+				rv = hg;
+			}
+		} else
+			rv = hg;
+	}
+
+	return rv;
+}
+
+STATIC int drbd_asb_recover_2p(struct drbd_conf *mdev) __must_hold(local)
+{
+	int self, peer, hg, rv = -100;
+
+	self = mdev->bc->md.uuid[Bitmap] & 1;
+	peer = mdev->p_uuid[Bitmap] & 1;
+
+	switch (mdev->net_conf->after_sb_2p) {
+	case DiscardYoungerPri:
+	case DiscardOlderPri:
+	case DiscardLeastChg:
+	case DiscardLocal:
+	case DiscardRemote:
+	case Consensus:
+	case DiscardSecondary:
+		ERR("Configuration error.\n");
+		break;
+	case Violently:
+		rv = drbd_asb_recover_0p(mdev);
+		break;
+	case Disconnect:
+		break;
+	case CallHelper:
+		hg = drbd_asb_recover_0p(mdev);
+		if (hg == -1) {
+			self = drbd_set_role(mdev, Secondary, 0);
+			if (self != SS_Success) {
+				drbd_khelper(mdev, "pri-lost-after-sb");
+			} else {
+				drbd_WARN("Sucessfully gave up primary role.\n");
+				rv = hg;
+			}
+		} else
+			rv = hg;
+	}
+
+	return rv;
+}
+
+STATIC void drbd_uuid_dump(struct drbd_conf *mdev, char *text, u64 *uuid,
+			   u64 bits, u64 flags)
+{
+	if (!uuid) {
+		INFO("%s uuid info vanished while I was looking!\n", text);
+		return;
+	}
+	INFO("%s %016llX:%016llX:%016llX:%016llX bits:%llu flags:%llX\n",
+	     text,
+	     (unsigned long long)uuid[Current],
+	     (unsigned long long)uuid[Bitmap],
+	     (unsigned long long)uuid[History_start],
+	     (unsigned long long)uuid[History_end],
+	     (unsigned long long)bits,
+	     (unsigned long long)flags);
+}
+
+/*
+  100	after split brain try auto recover
+    2	SyncSource set BitMap
+    1	SyncSource use BitMap
+    0	no Sync
+   -1	SyncTarget use BitMap
+   -2	SyncTarget set BitMap
+ -100	after split brain, disconnect
+-1000	unrelated data
+ */
+STATIC int drbd_uuid_compare(struct drbd_conf *mdev, int *rule_nr) __must_hold(local)
+{
+	u64 self, peer;
+	int i, j;
+
+	self = mdev->bc->md.uuid[Current] & ~((u64)1);
+	peer = mdev->p_uuid[Current] & ~((u64)1);
+
+	*rule_nr = 1;
+	if (self == UUID_JUST_CREATED && peer == UUID_JUST_CREATED)
+		return 0;
+
+	*rule_nr = 2;
+	if ((self == UUID_JUST_CREATED || self == (u64)0) &&
+	     peer != UUID_JUST_CREATED)
+		return -2;
+
+	*rule_nr = 3;
+	if (self != UUID_JUST_CREATED &&
+	    (peer == UUID_JUST_CREATED || peer == (u64)0))
+		return 2;
+
+	*rule_nr = 4;
+	if (self == peer) { /* Common power [off|failure] */
+		int rct, dc; /* roles at crash time */
+
+		rct = (test_bit(CRASHED_PRIMARY, &mdev->flags) ? 1 : 0) +
+			(mdev->p_uuid[UUID_FLAGS] & 2);
+		/* lowest bit is set when we were primary,
+		 * next bit (weight 2) is set when peer was primary */
+
+		MTRACE(TraceTypeUuid, TraceLvlMetrics, DUMPI(rct););
+
+		switch (rct) {
+		case 0: /* !self_pri && !peer_pri */ return 0;
+		case 1: /*  self_pri && !peer_pri */ return 1;
+		case 2: /* !self_pri &&  peer_pri */ return -1;
+		case 3: /*  self_pri &&  peer_pri */
+			dc = test_bit(DISCARD_CONCURRENT, &mdev->flags);
+			MTRACE(TraceTypeUuid, TraceLvlMetrics, DUMPI(dc););
+			return dc ? -1 : 1;
+		}
+	}
+
+	*rule_nr = 5;
+	peer = mdev->p_uuid[Bitmap] & ~((u64)1);
+	if (self == peer)
+		return -1;
+
+	*rule_nr = 6;
+	for (i = History_start; i <= History_end; i++) {
+		peer = mdev->p_uuid[i] & ~((u64)1);
+		if (self == peer)
+			return -2;
+	}
+
+	*rule_nr = 7;
+	self = mdev->bc->md.uuid[Bitmap] & ~((u64)1);
+	peer = mdev->p_uuid[Current] & ~((u64)1);
+	if (self == peer)
+		return 1;
+
+	*rule_nr = 8;
+	for (i = History_start; i <= History_end; i++) {
+		self = mdev->bc->md.uuid[i] & ~((u64)1);
+		if (self == peer)
+			return 2;
+	}
+
+	*rule_nr = 9;
+	self = mdev->bc->md.uuid[Bitmap] & ~((u64)1);
+	peer = mdev->p_uuid[Bitmap] & ~((u64)1);
+	if (self == peer && self != ((u64)0))
+		return 100;
+
+	*rule_nr = 10;
+	for (i = History_start; i <= History_end; i++) {
+		self = mdev->p_uuid[i] & ~((u64)1);
+		for (j = History_start; j <= History_end; j++) {
+			peer = mdev->p_uuid[j] & ~((u64)1);
+			if (self == peer)
+				return -100;
+		}
+	}
+
+	return -1000;
+}
+
+/* drbd_sync_handshake() returns the new conn state on success, or
+   conn_mask (-1) on failure.
+ */
+STATIC enum drbd_conns drbd_sync_handshake(struct drbd_conf *mdev, enum drbd_role peer_role,
+					   enum drbd_disk_state peer_disk) __must_hold(local)
+{
+	int hg, rule_nr;
+	enum drbd_conns rv = conn_mask;
+	enum drbd_disk_state mydisk;
+
+	mydisk = mdev->state.disk;
+	if (mydisk == Negotiating)
+		mydisk = mdev->new_state_tmp.disk;
+
+	hg = drbd_uuid_compare(mdev, &rule_nr);
+
+	INFO("drbd_sync_handshake:\n");
+	drbd_uuid_dump(mdev, "self", mdev->bc->md.uuid,
+		       mdev->state.disk >= Negotiating ? drbd_bm_total_weight(mdev) : 0, 0);
+	drbd_uuid_dump(mdev, "peer", mdev->p_uuid,
+		       mdev->p_uuid[UUID_SIZE], mdev->p_uuid[UUID_FLAGS]);
+	INFO("uuid_compare()=%d by rule %d\n", hg, rule_nr);
+
+	if (hg == -1000) {
+		ALERT("Unrelated data, aborting!\n");
+		return conn_mask;
+	}
+
+	if    ((mydisk == Inconsistent && peer_disk > Inconsistent) ||
+	    (peer_disk == Inconsistent && mydisk    > Inconsistent)) {
+		int f = (hg == -100) || abs(hg) == 2;
+		hg = mydisk > Inconsistent ? 1 : -1;
+		if (f)
+			hg = hg*2;
+		INFO("Becoming sync %s due to disk states.\n",
+		     hg > 0 ? "source" : "target");
+	}
+
+	if (hg == 100 || (hg == -100 && mdev->net_conf->always_asbp)) {
+		int pcount = (mdev->state.role == Primary)
+			   + (peer_role == Primary);
+		int forced = (hg == -100);
+
+		switch (pcount) {
+		case 0:
+			hg = drbd_asb_recover_0p(mdev);
+			break;
+		case 1:
+			hg = drbd_asb_recover_1p(mdev);
+			break;
+		case 2:
+			hg = drbd_asb_recover_2p(mdev);
+			break;
+		}
+		if (abs(hg) < 100) {
+			drbd_WARN("Split-Brain detected, %d primaries, "
+			     "automatically solved. Sync from %s node\n",
+			     pcount, (hg < 0) ? "peer" : "this");
+			if (forced) {
+				drbd_WARN("Doing a full sync, since"
+				     " UUIDs where ambiguous.\n");
+				hg = hg*2;
+			}
+		}
+	}
+
+	if (hg == -100) {
+		if (mdev->net_conf->want_lose && !(mdev->p_uuid[UUID_FLAGS]&1))
+			hg = -1;
+		if (!mdev->net_conf->want_lose && (mdev->p_uuid[UUID_FLAGS]&1))
+			hg = 1;
+
+		if (abs(hg) < 100)
+			drbd_WARN("Split-Brain detected, manually solved. "
+			     "Sync from %s node\n",
+			     (hg < 0) ? "peer" : "this");
+	}
+
+	if (hg == -100) {
+		ALERT("Split-Brain detected, dropping connection!\n");
+		drbd_khelper(mdev, "split-brain");
+		return conn_mask;
+	}
+
+	if (hg > 0 && mydisk <= Inconsistent) {
+		ERR("I shall become SyncSource, but I am inconsistent!\n");
+		return conn_mask;
+	}
+
+	if (hg < 0 && /* by intention we do not use mydisk here. */
+	    mdev->state.role == Primary && mdev->state.disk >= Consistent) {
+		switch (mdev->net_conf->rr_conflict) {
+		case CallHelper:
+			drbd_khelper(mdev, "pri-lost");
+			/* fall through */
+		case Disconnect:
+			ERR("I shall become SyncTarget, but I am primary!\n");
+			return conn_mask;
+		case Violently:
+			drbd_WARN("Becoming SyncTarget, violating the stable-data"
+			     "assumption\n");
+		}
+	}
+
+	if (abs(hg) >= 2) {
+		INFO("Writing the whole bitmap, full sync required after drbd_sync_handshake.\n");
+		if (drbd_bitmap_io(mdev, &drbd_bmio_set_n_write, "set_n_write from sync_handshake"))
+			return conn_mask;
+	}
+
+	if (hg > 0) { /* become sync source. */
+		rv = WFBitMapS;
+	} else if (hg < 0) { /* become sync target */
+		rv = WFBitMapT;
+	} else {
+		rv = Connected;
+		if (drbd_bm_total_weight(mdev)) {
+			INFO("No resync, but %lu bits in bitmap!\n",
+			     drbd_bm_total_weight(mdev));
+		}
+	}
+
+	drbd_bm_recount_bits(mdev);
+
+	return rv;
+}
+
+/* returns 1 if invalid */
+STATIC int cmp_after_sb(enum after_sb_handler peer, enum after_sb_handler self)
+{
+	/* DiscardRemote - DiscardLocal is valid */
+	if ((peer == DiscardRemote && self == DiscardLocal) ||
+	    (self == DiscardRemote && peer == DiscardLocal))
+		return 0;
+
+	/* any other things with DiscardRemote or DiscardLocal are invalid */
+	if (peer == DiscardRemote || peer == DiscardLocal ||
+	    self == DiscardRemote || self == DiscardLocal)
+		return 1;
+
+	/* everything else is valid if they are equal on both sides. */
+	if (peer == self)
+		return 0;
+
+	/* everything es is invalid. */
+	return 1;
+}
+
+STATIC int receive_protocol(struct drbd_conf *mdev, struct Drbd_Header *h)
+{
+	struct Drbd_Protocol_Packet *p = (struct Drbd_Protocol_Packet *)h;
+	int header_size, data_size;
+	int p_proto, p_after_sb_0p, p_after_sb_1p, p_after_sb_2p;
+	int p_want_lose, p_two_primaries;
+	char p_integrity_alg[SHARED_SECRET_MAX] = "";
+
+	header_size = sizeof(*p) - sizeof(*h);
+	data_size   = h->length  - header_size;
+
+	if (drbd_recv(mdev, h->payload, header_size) != header_size)
+		return FALSE;
+
+	p_proto		= be32_to_cpu(p->protocol);
+	p_after_sb_0p	= be32_to_cpu(p->after_sb_0p);
+	p_after_sb_1p	= be32_to_cpu(p->after_sb_1p);
+	p_after_sb_2p	= be32_to_cpu(p->after_sb_2p);
+	p_want_lose	= be32_to_cpu(p->want_lose);
+	p_two_primaries = be32_to_cpu(p->two_primaries);
+
+	if (p_proto != mdev->net_conf->wire_protocol) {
+		ERR("incompatible communication protocols\n");
+		goto disconnect;
+	}
+
+	if (cmp_after_sb(p_after_sb_0p, mdev->net_conf->after_sb_0p)) {
+		ERR("incompatible after-sb-0pri settings\n");
+		goto disconnect;
+	}
+
+	if (cmp_after_sb(p_after_sb_1p, mdev->net_conf->after_sb_1p)) {
+		ERR("incompatible after-sb-1pri settings\n");
+		goto disconnect;
+	}
+
+	if (cmp_after_sb(p_after_sb_2p, mdev->net_conf->after_sb_2p)) {
+		ERR("incompatible after-sb-2pri settings\n");
+		goto disconnect;
+	}
+
+	if (p_want_lose && mdev->net_conf->want_lose) {
+		ERR("both sides have the 'want_lose' flag set\n");
+		goto disconnect;
+	}
+
+	if (p_two_primaries != mdev->net_conf->two_primaries) {
+		ERR("incompatible setting of the two-primaries options\n");
+		goto disconnect;
+	}
+
+	if (mdev->agreed_pro_version >= 87) {
+		unsigned char *my_alg = mdev->net_conf->integrity_alg;
+
+		if (drbd_recv(mdev, p_integrity_alg, data_size) != data_size)
+			return FALSE;
+
+		p_integrity_alg[SHARED_SECRET_MAX-1] = 0;
+		if (strcmp(p_integrity_alg, my_alg)) {
+			ERR("incompatible setting of the data-integrity-alg\n");
+			goto disconnect;
+		}
+		INFO("data-integrity-alg: %s\n",
+		     my_alg[0] ? my_alg : (unsigned char *)"<not-used>");
+	}
+
+	return TRUE;
+
+disconnect:
+	drbd_force_state(mdev, NS(conn, Disconnecting));
+	return FALSE;
+}
+
+/* helper function
+ * input: alg name, feature name
+ * return: NULL (alg name was "")
+ *         ERR_PTR(error) if something goes wrong
+ *         or the crypto hash ptr, if it worked out ok. */
+struct crypto_hash *drbd_crypto_alloc_digest_safe(const struct drbd_conf *mdev,
+		const char *alg, const char *name)
+{
+	struct crypto_hash *tfm;
+
+	if (!alg[0])
+		return NULL;
+
+	tfm = crypto_alloc_hash(alg, 0, CRYPTO_ALG_ASYNC);
+	if (IS_ERR(tfm)) {
+		ERR("Can not allocate \"%s\" as %s (reason: %ld)\n",
+				alg, name, PTR_ERR(tfm));
+		return tfm;
+	}
+	if (crypto_tfm_alg_type(crypto_hash_tfm(tfm)) != CRYPTO_ALG_TYPE_DIGEST) {
+		crypto_free_hash(tfm);
+		ERR("\"%s\" is not a digest (%s)\n", alg, name);
+		return ERR_PTR(-EINVAL);
+	}
+	return tfm;
+}
+
+STATIC int receive_SyncParam(struct drbd_conf *mdev, struct Drbd_Header *h)
+{
+	int ok = TRUE;
+	struct Drbd_SyncParam89_Packet *p = (struct Drbd_SyncParam89_Packet *)h;
+	unsigned int header_size, data_size, exp_max_sz;
+	struct crypto_hash *verify_tfm = NULL;
+	struct crypto_hash *csums_tfm = NULL;
+	const int apv = mdev->agreed_pro_version;
+
+	exp_max_sz  = apv <= 87 ? sizeof(struct Drbd_SyncParam_Packet)
+		    : apv == 88 ? sizeof(struct Drbd_SyncParam_Packet)
+					+ SHARED_SECRET_MAX
+		    : /* 89 */    sizeof(struct Drbd_SyncParam89_Packet);
+
+	if (h->length > exp_max_sz) {
+		ERR("SyncParam packet too long: received %u, expected <= %u bytes\n",
+		    h->length, exp_max_sz);
+		return FALSE;
+	}
+
+	if (apv <= 88) {
+		header_size = sizeof(struct Drbd_SyncParam_Packet) - sizeof(*h);
+		data_size   = h->length  - header_size;
+	} else /* apv >= 89 */ {
+		header_size = sizeof(struct Drbd_SyncParam89_Packet) - sizeof(*h);
+		data_size   = h->length  - header_size;
+		D_ASSERT(data_size == 0);
+	}
+
+	/* initialize verify_alg and csums_alg */
+	memset(p->verify_alg, 0, 2 * SHARED_SECRET_MAX);
+
+	if (drbd_recv(mdev, h->payload, header_size) != header_size)
+		return FALSE;
+
+	mdev->sync_conf.rate	  = be32_to_cpu(p->rate);
+
+	if (apv >= 88) {
+		if (apv == 88) {
+			if (data_size > SHARED_SECRET_MAX) {
+				ERR("verify-alg too long, "
+				    "peer wants %u, accepting only %u byte\n",
+						data_size, SHARED_SECRET_MAX);
+				return FALSE;
+			}
+
+			if (drbd_recv(mdev, p->verify_alg, data_size) != data_size)
+				return FALSE;
+
+			/* we expect NUL terminated string */
+			/* but just in case someone tries to be evil */
+			D_ASSERT(p->verify_alg[data_size-1] == 0);
+			p->verify_alg[data_size-1] = 0;
+
+		} else /* apv >= 89 */ {
+			/* we still expect NUL terminated strings */
+			/* but just in case someone tries to be evil */
+			D_ASSERT(p->verify_alg[SHARED_SECRET_MAX-1] == 0);
+			D_ASSERT(p->csums_alg[SHARED_SECRET_MAX-1] == 0);
+			p->verify_alg[SHARED_SECRET_MAX-1] = 0;
+			p->csums_alg[SHARED_SECRET_MAX-1] = 0;
+		}
+
+		if (strcmp(mdev->sync_conf.verify_alg, p->verify_alg)) {
+			if (mdev->state.conn == WFReportParams) {
+				ERR("Different verify-alg settings. me=\"%s\" peer=\"%s\"\n",
+				    mdev->sync_conf.verify_alg, p->verify_alg);
+				goto disconnect;
+			}
+			verify_tfm = drbd_crypto_alloc_digest_safe(mdev,
+					p->verify_alg, "verify-alg");
+			if (IS_ERR(verify_tfm))
+				goto disconnect;
+		}
+
+		if (apv >= 89 && strcmp(mdev->sync_conf.csums_alg, p->csums_alg)) {
+			if (mdev->state.conn == WFReportParams) {
+				ERR("Different csums-alg settings. me=\"%s\" peer=\"%s\"\n",
+				    mdev->sync_conf.csums_alg, p->csums_alg);
+				goto disconnect;
+			}
+			csums_tfm = drbd_crypto_alloc_digest_safe(mdev,
+					p->csums_alg, "csums-alg");
+			if (IS_ERR(csums_tfm))
+				goto disconnect;
+		}
+
+
+		spin_lock(&mdev->peer_seq_lock);
+		/* lock against drbd_nl_syncer_conf() */
+		if (verify_tfm) {
+			strcpy(mdev->sync_conf.verify_alg, p->verify_alg);
+			mdev->sync_conf.verify_alg_len = strlen(p->verify_alg) + 1;
+			crypto_free_hash(mdev->verify_tfm);
+			mdev->verify_tfm = verify_tfm;
+			INFO("using verify-alg: \"%s\"\n", p->verify_alg);
+		}
+		if (csums_tfm) {
+			strcpy(mdev->sync_conf.csums_alg, p->csums_alg);
+			mdev->sync_conf.csums_alg_len = strlen(p->csums_alg) + 1;
+			crypto_free_hash(mdev->csums_tfm);
+			mdev->csums_tfm = csums_tfm;
+			INFO("using csums-alg: \"%s\"\n", p->csums_alg);
+		}
+		spin_unlock(&mdev->peer_seq_lock);
+	}
+
+	return ok;
+disconnect:
+	crypto_free_hash(verify_tfm);
+	drbd_force_state(mdev, NS(conn, Disconnecting));
+	return FALSE;
+}
+
+STATIC void drbd_setup_order_type(struct drbd_conf *mdev, int peer)
+{
+	/* sorry, we currently have no working implementation
+	 * of distributed TCQ */
+}
+
+/* warn if the arguments differ by more than 12.5% */
+static void warn_if_differ_considerably(struct drbd_conf *mdev,
+	const char *s, sector_t a, sector_t b)
+{
+	sector_t d;
+	if (a == 0 || b == 0)
+		return;
+	d = (a > b) ? (a - b) : (b - a);
+	if (d > (a>>3) || d > (b>>3))
+		drbd_WARN("Considerable difference in %s: %llus vs. %llus\n", s,
+		     (unsigned long long)a, (unsigned long long)b);
+}
+
+STATIC int receive_sizes(struct drbd_conf *mdev, struct Drbd_Header *h)
+{
+	struct Drbd_Sizes_Packet *p = (struct Drbd_Sizes_Packet *)h;
+	enum determin_dev_size_enum dd = unchanged;
+	unsigned int max_seg_s;
+	sector_t p_size, p_usize, my_usize;
+	int ldsc = 0; /* local disk size changed */
+	enum drbd_conns nconn;
+
+	ERR_IF(h->length != (sizeof(*p)-sizeof(*h))) return FALSE;
+	if (drbd_recv(mdev, h->payload, h->length) != h->length)
+		return FALSE;
+
+	p_size = be64_to_cpu(p->d_size);
+	p_usize = be64_to_cpu(p->u_size);
+
+	if (p_size == 0 && mdev->state.disk == Diskless) {
+		ERR("some backing storage is needed\n");
+		drbd_force_state(mdev, NS(conn, Disconnecting));
+		return FALSE;
+	}
+
+	/* just store the peer's disk size for now.
+	 * we still need to figure out wether we accept that. */
+	mdev->p_size = p_size;
+
+#define min_not_zero(l, r) (l == 0) ? r : ((r == 0) ? l : min(l, r))
+	if (inc_local(mdev)) {
+		warn_if_differ_considerably(mdev, "lower level device sizes",
+			   p_size, drbd_get_max_capacity(mdev->bc));
+		warn_if_differ_considerably(mdev, "user requested size",
+					    p_usize, mdev->bc->dc.disk_size);
+
+		/* if this is the first connect, or an otherwise expected
+		 * param exchange, choose the minimum */
+		if (mdev->state.conn == WFReportParams)
+			p_usize = min_not_zero((sector_t)mdev->bc->dc.disk_size,
+					     p_usize);
+
+		my_usize = mdev->bc->dc.disk_size;
+
+		if (mdev->bc->dc.disk_size != p_usize) {
+			mdev->bc->dc.disk_size = p_usize;
+			INFO("Peer sets u_size to %lu sectors\n",
+			     (unsigned long)mdev->bc->dc.disk_size);
+		}
+
+		/* Never shrink a device with usable data during connect.
+		   But allow online shrinking if we are connected. */
+		if (drbd_new_dev_size(mdev, mdev->bc) <
+		   drbd_get_capacity(mdev->this_bdev) &&
+		   mdev->state.disk >= Outdated &&
+		   mdev->state.conn < Connected) {
+			ERR("The peer's disk size is too small!\n");
+			drbd_force_state(mdev, NS(conn, Disconnecting));
+			mdev->bc->dc.disk_size = my_usize;
+			dec_local(mdev);
+			return FALSE;
+		}
+		dec_local(mdev);
+	}
+#undef min_not_zero
+
+	if (inc_local(mdev)) {
+		dd = drbd_determin_dev_size(mdev);
+		dec_local(mdev);
+		if (dd == dev_size_error)
+			return FALSE;
+		drbd_md_sync(mdev);
+	} else {
+		/* I am diskless, need to accept the peer's size. */
+		drbd_set_my_capacity(mdev, p_size);
+	}
+
+	if (mdev->p_uuid && mdev->state.conn <= Connected && inc_local(mdev)) {
+		nconn = drbd_sync_handshake(mdev,
+				mdev->state.peer, mdev->state.pdsk);
+		dec_local(mdev);
+
+		if (nconn == conn_mask) {
+			drbd_force_state(mdev, NS(conn, Disconnecting));
+			return FALSE;
+		}
+
+		if (drbd_request_state(mdev, NS(conn, nconn)) < SS_Success) {
+			drbd_force_state(mdev, NS(conn, Disconnecting));
+			return FALSE;
+		}
+	}
+
+	if (inc_local(mdev)) {
+		if (mdev->bc->known_size != drbd_get_capacity(mdev->bc->backing_bdev)) {
+			mdev->bc->known_size = drbd_get_capacity(mdev->bc->backing_bdev);
+			ldsc = 1;
+		}
+
+		max_seg_s = be32_to_cpu(p->max_segment_size);
+		if (max_seg_s != queue_max_segment_size(mdev->rq_queue))
+			drbd_setup_queue_param(mdev, max_seg_s);
+
+		drbd_setup_order_type(mdev, be32_to_cpu(p->queue_order_type));
+		dec_local(mdev);
+	}
+
+	if (mdev->state.conn > WFReportParams) {
+		if (be64_to_cpu(p->c_size) !=
+		    drbd_get_capacity(mdev->this_bdev) || ldsc) {
+			/* we have different sizes, probabely peer
+			 * needs to know my new size... */
+			drbd_send_sizes(mdev);
+		}
+		if (dd == grew && mdev->state.conn == Connected) {
+			if (mdev->state.pdsk >= Inconsistent &&
+			    mdev->state.disk >= Inconsistent)
+				resync_after_online_grow(mdev);
+			else
+				set_bit(RESYNC_AFTER_NEG, &mdev->flags);
+		}
+	}
+
+	return TRUE;
+}
+
+STATIC int receive_uuids(struct drbd_conf *mdev, struct Drbd_Header *h)
+{
+	struct Drbd_GenCnt_Packet *p = (struct Drbd_GenCnt_Packet *)h;
+	u64 *p_uuid;
+	int i;
+
+	ERR_IF(h->length != (sizeof(*p)-sizeof(*h))) return FALSE;
+	if (drbd_recv(mdev, h->payload, h->length) != h->length)
+		return FALSE;
+
+	p_uuid = kmalloc(sizeof(u64)*EXT_UUID_SIZE, GFP_KERNEL);
+
+	for (i = Current; i < EXT_UUID_SIZE; i++)
+		p_uuid[i] = be64_to_cpu(p->uuid[i]);
+
+	kfree(mdev->p_uuid);
+	mdev->p_uuid = p_uuid;
+
+	if (mdev->state.conn < Connected &&
+	    mdev->state.disk < Inconsistent &&
+	    mdev->state.role == Primary &&
+	    (mdev->ed_uuid & ~((u64)1)) != (p_uuid[Current] & ~((u64)1))) {
+		ERR("Can only connect to data with current UUID=%016llX\n",
+		    (unsigned long long)mdev->ed_uuid);
+		drbd_force_state(mdev, NS(conn, Disconnecting));
+		return FALSE;
+	}
+
+	/* Before we test for the disk state, we should wait until an eventually
+	   ongoing cluster wide state change is finished. That is important if
+	   we are primary and are detaching from our disk. We need to see the
+	   new disk state... */
+	wait_event(mdev->misc_wait, !test_bit(CLUSTER_ST_CHANGE, &mdev->flags));
+	if (mdev->state.conn >= Connected && mdev->state.disk < Inconsistent)
+		drbd_set_ed_uuid(mdev, p_uuid[Current]);
+
+	return TRUE;
+}
+
+/**
+ * convert_state:
+ * Switches the view of the state.
+ */
+STATIC union drbd_state_t convert_state(union drbd_state_t ps)
+{
+	union drbd_state_t ms;
+
+	static enum drbd_conns c_tab[] = {
+		[Connected] = Connected,
+
+		[StartingSyncS] = StartingSyncT,
+		[StartingSyncT] = StartingSyncS,
+		[Disconnecting] = TearDown, /* NetworkFailure, */
+		[VerifyS]       = VerifyT,
+		[conn_mask]   = conn_mask,
+	};
+
+	ms.i = ps.i;
+
+	ms.conn = c_tab[ps.conn];
+	ms.peer = ps.role;
+	ms.role = ps.peer;
+	ms.pdsk = ps.disk;
+	ms.disk = ps.pdsk;
+	ms.peer_isp = (ps.aftr_isp | ps.user_isp);
+
+	return ms;
+}
+
+STATIC int receive_req_state(struct drbd_conf *mdev, struct Drbd_Header *h)
+{
+	struct Drbd_Req_State_Packet *p = (struct Drbd_Req_State_Packet *)h;
+	union drbd_state_t mask, val;
+	int rv;
+
+	ERR_IF(h->length != (sizeof(*p)-sizeof(*h))) return FALSE;
+	if (drbd_recv(mdev, h->payload, h->length) != h->length)
+		return FALSE;
+
+	mask.i = be32_to_cpu(p->mask);
+	val.i = be32_to_cpu(p->val);
+
+	if (test_bit(DISCARD_CONCURRENT, &mdev->flags) &&
+	    test_bit(CLUSTER_ST_CHANGE, &mdev->flags)) {
+		drbd_send_sr_reply(mdev, SS_ConcurrentStChg);
+		return TRUE;
+	}
+
+	mask = convert_state(mask);
+	val = convert_state(val);
+
+	rv = drbd_change_state(mdev, ChgStateVerbose, mask, val);
+
+	drbd_send_sr_reply(mdev, rv);
+	drbd_md_sync(mdev);
+
+	return TRUE;
+}
+
+STATIC int receive_state(struct drbd_conf *mdev, struct Drbd_Header *h)
+{
+	struct Drbd_State_Packet *p = (struct Drbd_State_Packet *)h;
+	enum drbd_conns nconn, oconn;
+	union drbd_state_t ns, peer_state;
+	enum drbd_disk_state real_peer_disk;
+	int rv;
+
+	ERR_IF(h->length != (sizeof(*p)-sizeof(*h)))
+		return FALSE;
+
+	if (drbd_recv(mdev, h->payload, h->length) != h->length)
+		return FALSE;
+
+	peer_state.i = be32_to_cpu(p->state);
+
+	real_peer_disk = peer_state.disk;
+	if (peer_state.disk == Negotiating) {
+		real_peer_disk = mdev->p_uuid[UUID_FLAGS] & 4 ? Inconsistent : Consistent;
+		INFO("real peer disk state = %s\n", disks_to_name(real_peer_disk));
+	}
+
+	spin_lock_irq(&mdev->req_lock);
+ retry:
+	oconn = nconn = mdev->state.conn;
+	spin_unlock_irq(&mdev->req_lock);
+
+	if (nconn == WFReportParams)
+		nconn = Connected;
+
+	if (mdev->p_uuid && peer_state.disk >= Negotiating &&
+	    inc_local_if_state(mdev, Negotiating)) {
+		int cr; /* consider resync */
+
+		cr  = (oconn < Connected);
+		cr |= (oconn == Connected &&
+		       (peer_state.disk == Negotiating ||
+			mdev->state.disk == Negotiating));
+		cr |= test_bit(CONSIDER_RESYNC, &mdev->flags); /* peer forced */
+		cr |= (oconn == Connected && peer_state.conn > Connected);
+
+		if (cr)
+			nconn = drbd_sync_handshake(mdev, peer_state.role, real_peer_disk);
+
+		dec_local(mdev);
+		if (nconn == conn_mask) {
+			if (mdev->state.disk == Negotiating) {
+				drbd_force_state(mdev, NS(disk, Diskless));
+				nconn = Connected;
+			} else if (peer_state.disk == Negotiating) {
+				ERR("Disk attach process on the peer node was aborted.\n");
+				peer_state.disk = Diskless;
+			} else {
+				D_ASSERT(oconn == WFReportParams);
+				drbd_force_state(mdev, NS(conn, Disconnecting));
+				return FALSE;
+			}
+		}
+	}
+
+	spin_lock_irq(&mdev->req_lock);
+	if (mdev->state.conn != oconn)
+		goto retry;
+	clear_bit(CONSIDER_RESYNC, &mdev->flags);
+	ns.i = mdev->state.i;
+	ns.conn = nconn;
+	ns.peer = peer_state.role;
+	ns.pdsk = real_peer_disk;
+	ns.peer_isp = (peer_state.aftr_isp | peer_state.user_isp);
+	if ((nconn == Connected || nconn == WFBitMapS) && ns.disk == Negotiating)
+		ns.disk = mdev->new_state_tmp.disk;
+
+	rv = _drbd_set_state(mdev, ns, ChgStateVerbose | ChgStateHard, NULL);
+	ns = mdev->state;
+	spin_unlock_irq(&mdev->req_lock);
+
+	if (rv < SS_Success) {
+		drbd_force_state(mdev, NS(conn, Disconnecting));
+		return FALSE;
+	}
+
+	if (oconn > WFReportParams) {
+		if (nconn > Connected && peer_state.conn <= Connected &&
+		    peer_state.disk != Negotiating ) {
+			/* we want resync, peer has not yet decided to sync... */
+			/* Nowadays only used when forcing a node into primary role and
+			   setting its disk to UpTpDate with that */
+			drbd_send_uuids(mdev);
+			drbd_send_state(mdev);
+		}
+	}
+
+	mdev->net_conf->want_lose = 0;
+
+	drbd_md_sync(mdev); /* update connected indicator, la_size, ... */
+
+	return TRUE;
+}
+
+STATIC int receive_sync_uuid(struct drbd_conf *mdev, struct Drbd_Header *h)
+{
+	struct Drbd_SyncUUID_Packet *p = (struct Drbd_SyncUUID_Packet *)h;
+
+	wait_event(mdev->misc_wait,
+		   mdev->state.conn < Connected ||
+		   mdev->state.conn == WFSyncUUID);
+
+	/* D_ASSERT( mdev->state.conn == WFSyncUUID ); */
+
+	ERR_IF(h->length != (sizeof(*p)-sizeof(*h))) return FALSE;
+	if (drbd_recv(mdev, h->payload, h->length) != h->length)
+		return FALSE;
+
+	/* Here the _drbd_uuid_ functions are right, current should
+	   _not_ be rotated into the history */
+	if (inc_local_if_state(mdev, Negotiating)) {
+		_drbd_uuid_set(mdev, Current, be64_to_cpu(p->uuid));
+		_drbd_uuid_set(mdev, Bitmap, 0UL);
+
+		drbd_start_resync(mdev, SyncTarget);
+
+		dec_local(mdev);
+	} else
+		ERR("Ignoring SyncUUID packet!\n");
+
+	return TRUE;
+}
+
+enum receive_bitmap_ret { OK, DONE, FAILED };
+
+static enum receive_bitmap_ret
+receive_bitmap_plain(struct drbd_conf *mdev, struct Drbd_Header *h,
+	unsigned long *buffer, struct bm_xfer_ctx *c)
+{
+	unsigned num_words = min_t(size_t, BM_PACKET_WORDS, c->bm_words - c->word_offset);
+	unsigned want = num_words * sizeof(long);
+
+	if (want != h->length) {
+		ERR("%s:want (%u) != h->length (%u)\n", __func__, want, h->length);
+		return FAILED;
+	}
+	if (want == 0)
+		return DONE;
+	if (drbd_recv(mdev, buffer, want) != want)
+		return FAILED;
+
+	drbd_bm_merge_lel(mdev, c->word_offset, num_words, buffer);
+
+	c->word_offset += num_words;
+	c->bit_offset = c->word_offset * BITS_PER_LONG;
+	if (c->bit_offset > c->bm_bits)
+		c->bit_offset = c->bm_bits;
+
+	return OK;
+}
+
+static enum receive_bitmap_ret
+recv_bm_rle_bits(struct drbd_conf *mdev,
+		struct Drbd_Compressed_Bitmap_Packet *p,
+		struct bm_xfer_ctx *c)
+{
+	struct bitstream bs;
+	u64 look_ahead;
+	u64 rl;
+	u64 tmp;
+	unsigned long s = c->bit_offset;
+	unsigned long e;
+	int len = p->head.length - (sizeof(*p) - sizeof(p->head));
+	int toggle = DCBP_get_start(p);
+	int have;
+	int bits;
+
+	bitstream_init(&bs, p->code, len, DCBP_get_pad_bits(p));
+
+	bits = bitstream_get_bits(&bs, &look_ahead, 64);
+	if (bits < 0)
+		return FAILED;
+
+	for (have = bits; have > 0; s += rl, toggle = !toggle) {
+		bits = vli_decode_bits(&rl, look_ahead);
+		if (bits <= 0)
+			return FAILED;
+
+		if (toggle) {
+			e = s + rl -1;
+			if (e >= c->bm_bits) {
+				ERR("bitmap overflow (e:%lu) while decoding bm RLE packet\n", e);
+				return FAILED;
+			}
+			_drbd_bm_set_bits(mdev, s, e);
+		}
+
+		if (have < bits) {
+			ERR("bitmap decoding error: h:%d b:%d la:0x%08llx l:%u/%u\n", have, bits, look_ahead,
+				bs.cur.b - p->code, bs.buf_len);
+			return FAILED;
+		}
+		look_ahead >>= bits;
+		have -= bits;
+
+		bits = bitstream_get_bits(&bs, &tmp, 64 - have);
+		if (bits < 0)
+			return FAILED;
+		look_ahead |= tmp << have;
+		have += bits;
+	}
+
+	c->bit_offset = s;
+	bm_xfer_ctx_bit_to_word_offset(c);
+
+	return (s == c->bm_bits) ? DONE : OK;
+}
+
+
+static enum receive_bitmap_ret
+recv_bm_rle_bytes(struct drbd_conf *mdev,
+		struct Drbd_Compressed_Bitmap_Packet *p,
+		struct bm_xfer_ctx *c)
+{
+	u64 rl;
+	unsigned char *buf = p->code;
+	unsigned long s;
+	unsigned long e;
+	int len = p->head.length - (p->code - p->head.payload);
+	int toggle;
+	int n;
+
+	s = c->bit_offset;
+
+	/* decoding.  the payload of bitmap rle packets is VLI encoded
+	 * runlength of set and unset bits, starting with set/unset as defined
+	 * in p->encoding & 0x80. */
+	for (toggle = DCBP_get_start(p); len; s += rl, toggle = !toggle) {
+		if (s >= c->bm_bits) {
+			ERR("bitmap overflow (s:%lu) while decoding bitmap RLE packet\n", s);
+			return FAILED;
+		}
+
+		n = vli_decode_bytes(&rl, buf, len);
+		if (n == 0) /* incomplete buffer! */
+			return FAILED;
+		buf += n;
+		len -= n;
+
+		if (rl == 0) {
+			ERR("unexpected zero runlength while decoding bitmap RLE packet\n");
+			return FAILED;
+		}
+
+		/* unset bits: ignore, because of x | 0 == x. */
+		if (!toggle)
+			continue;
+
+		/* set bits: merge into bitmap. */
+		e = s + rl -1;
+		if (e >= c->bm_bits) {
+			ERR("bitmap overflow (e:%lu) while decoding bitmap RLE packet\n", e);
+			return FAILED;
+		}
+		_drbd_bm_set_bits(mdev, s, e);
+	}
+
+	c->bit_offset = s;
+	bm_xfer_ctx_bit_to_word_offset(c);
+
+	return (s == c->bm_bits) ? DONE : OK;
+}
+
+static enum receive_bitmap_ret
+decode_bitmap_c(struct drbd_conf *mdev,
+		struct Drbd_Compressed_Bitmap_Packet *p,
+		struct bm_xfer_ctx *c)
+{
+	switch (DCBP_get_code(p)) {
+	/* no default! I want the compiler to warn me! */
+	case RLE_VLI_BitsFibD_0_1:
+	case RLE_VLI_BitsFibD_1_1:
+	case RLE_VLI_BitsFibD_1_2:
+	case RLE_VLI_BitsFibD_2_3:
+		break; /* TODO */
+	case RLE_VLI_BitsFibD_3_5:
+		return recv_bm_rle_bits(mdev, p, c);
+	case RLE_VLI_Bytes:
+		return recv_bm_rle_bytes(mdev, p, c);
+	}
+	ERR("receive_bitmap_c: unknown encoding %u\n", p->encoding);
+	return FAILED;
+}
+
+void INFO_bm_xfer_stats(struct drbd_conf *mdev,
+		const char *direction, struct bm_xfer_ctx *c)
+{
+	unsigned plain_would_take = sizeof(struct Drbd_Header) *
+		((c->bm_words+BM_PACKET_WORDS-1)/BM_PACKET_WORDS+1)
+		+ c->bm_words * sizeof(long);
+	unsigned total = c->bytes[0] + c->bytes[1];
+	unsigned q, r;
+
+	/* total can not be zero. but just in case: */
+	if (total == 0)
+		return;
+
+	q = plain_would_take / total;
+	r = plain_would_take % total;
+	r = (r > UINT_MAX/100) ? (r / (total+99/100)) : (100 * r / total);
+
+	INFO("%s bitmap stats [Bytes(packets)]: plain %u(%u), RLE %u(%u), "
+	     "total %u; compression factor: %u.%02u\n",
+			direction,
+			c->bytes[1], c->packets[1],
+			c->bytes[0], c->packets[0],
+			total, q, r);
+}
+
+/* Since we are processing the bitfield from lower addresses to higher,
+   it does not matter if the process it in 32 bit chunks or 64 bit
+   chunks as long as it is little endian. (Understand it as byte stream,
+   beginning with the lowest byte...) If we would use big endian
+   we would need to process it from the highest address to the lowest,
+   in order to be agnostic to the 32 vs 64 bits issue.
+
+   returns 0 on failure, 1 if we suceessfully received it. */
+STATIC int receive_bitmap(struct drbd_conf *mdev, struct Drbd_Header *h)
+{
+	struct bm_xfer_ctx c;
+	void *buffer;
+	enum receive_bitmap_ret ret;
+	int ok = FALSE;
+
+	wait_event(mdev->misc_wait, !atomic_read(&mdev->ap_bio_cnt));
+
+	drbd_bm_lock(mdev, "receive bitmap");
+
+	/* maybe we should use some per thread scratch page,
+	 * and allocate that during initial device creation? */
+	buffer	 = (unsigned long *) __get_free_page(GFP_NOIO);
+	if (!buffer) {
+		ERR("failed to allocate one page buffer in %s\n", __func__);
+		goto out;
+	}
+
+	c = (struct bm_xfer_ctx) {
+		.bm_bits = drbd_bm_bits(mdev),
+		.bm_words = drbd_bm_words(mdev),
+	};
+
+	do {
+		if (h->command == ReportBitMap) {
+			ret = receive_bitmap_plain(mdev, h, buffer, &c);
+		} else if (h->command == ReportCBitMap) {
+			/* MAYBE: sanity check that we speak proto >= 90,
+			 * and the feature is enabled! */
+			struct Drbd_Compressed_Bitmap_Packet *p;
+
+			if (h->length > BM_PACKET_PAYLOAD_BYTES) {
+				ERR("ReportCBitmap packet too large\n");
+				goto out;
+			}
+			/* use the page buff */
+			p = buffer;
+			memcpy(p, h, sizeof(*h));
+			if (drbd_recv(mdev, p->head.payload, h->length) != h->length)
+				goto out;
+			if (p->head.length <= (sizeof(*p) - sizeof(p->head))) {
+				ERR("ReportCBitmap packet too small (l:%u)\n", p->head.length);
+				return FAILED;
+			}
+			ret = decode_bitmap_c(mdev, p, &c);
+		} else {
+			drbd_WARN("receive_bitmap: h->command neither ReportBitMap nor ReportCBitMap (is 0x%x)", h->command);
+			goto out;
+		}
+
+		c.packets[h->command == ReportBitMap]++;
+		c.bytes[h->command == ReportBitMap] += sizeof(struct Drbd_Header) + h->length;
+
+		if (ret != OK)
+			break;
+
+		if (!drbd_recv_header(mdev, h))
+			goto out;
+	} while (ret == OK);
+	if (ret == FAILED)
+		goto out;
+
+	INFO_bm_xfer_stats(mdev, "receive", &c);
+
+	if (mdev->state.conn == WFBitMapT) {
+		ok = !drbd_send_bitmap(mdev);
+		if (!ok)
+			goto out;
+		/* Omit ChgOrdered with this state transition to avoid deadlocks. */
+		ok = _drbd_request_state(mdev, NS(conn, WFSyncUUID), ChgStateVerbose);
+		D_ASSERT(ok == SS_Success);
+	} else if (mdev->state.conn != WFBitMapS) {
+		/* admin may have requested Disconnecting,
+		 * other threads may have noticed network errors */
+		INFO("unexpected cstate (%s) in receive_bitmap\n",
+		    conns_to_name(mdev->state.conn));
+	}
+
+	ok = TRUE;
+ out:
+	drbd_bm_unlock(mdev);
+	if (ok && mdev->state.conn == WFBitMapS)
+		drbd_start_resync(mdev, SyncSource);
+	free_page((unsigned long) buffer);
+	return ok;
+}
+
+STATIC int receive_skip(struct drbd_conf *mdev, struct Drbd_Header *h)
+{
+	/* TODO zero copy sink :) */
+	static char sink[128];
+	int size, want, r;
+
+	drbd_WARN("skipping unknown optional packet type %d, l: %d!\n",
+	     h->command, h->length);
+
+	size = h->length;
+	while (size > 0) {
+		want = min_t(int, size, sizeof(sink));
+		r = drbd_recv(mdev, sink, want);
+		ERR_IF(r <= 0) break;
+		size -= r;
+	}
+	return size == 0;
+}
+
+STATIC int receive_UnplugRemote(struct drbd_conf *mdev, struct Drbd_Header *h)
+{
+	if (mdev->state.disk >= Inconsistent)
+		drbd_kick_lo(mdev);
+
+	/* Make sure we've acked all the TCP data associated
+	 * with the data requests being unplugged */
+	drbd_tcp_quickack(mdev->data.socket);
+
+	return TRUE;
+}
+
+typedef int (*drbd_cmd_handler_f)(struct drbd_conf *, struct Drbd_Header *);
+
+static drbd_cmd_handler_f drbd_default_handler[] = {
+	[Data]		   = receive_Data,
+	[DataReply]	   = receive_DataReply,
+	[RSDataReply]	   = receive_RSDataReply,
+	[Barrier]	   = receive_Barrier,
+	[ReportBitMap]	   = receive_bitmap,
+	[ReportCBitMap]    = receive_bitmap,
+	[UnplugRemote]	   = receive_UnplugRemote,
+	[DataRequest]	   = receive_DataRequest,
+	[RSDataRequest]    = receive_DataRequest,
+	[SyncParam]	   = receive_SyncParam,
+	[SyncParam89]	   = receive_SyncParam,
+	[ReportProtocol]   = receive_protocol,
+	[ReportUUIDs]	   = receive_uuids,
+	[ReportSizes]	   = receive_sizes,
+	[ReportState]	   = receive_state,
+	[StateChgRequest]  = receive_req_state,
+	[ReportSyncUUID]   = receive_sync_uuid,
+	[OVRequest]        = receive_DataRequest,
+	[OVReply]          = receive_DataRequest,
+	[CsumRSRequest]    = receive_DataRequest,
+	/* anything missing from this table is in
+	 * the asender_tbl, see get_asender_cmd */
+	[MAX_CMD]	   = NULL,
+};
+
+static drbd_cmd_handler_f *drbd_cmd_handler = drbd_default_handler;
+static drbd_cmd_handler_f *drbd_opt_cmd_handler;
+
+STATIC void drbdd(struct drbd_conf *mdev)
+{
+	drbd_cmd_handler_f handler;
+	struct Drbd_Header *header = &mdev->data.rbuf.head;
+
+	while (get_t_state(&mdev->receiver) == Running) {
+		drbd_thread_current_set_cpu(mdev);
+		if (!drbd_recv_header(mdev, header))
+			break;
+
+		if (header->command < MAX_CMD)
+			handler = drbd_cmd_handler[header->command];
+		else if (MayIgnore < header->command
+		     && header->command < MAX_OPT_CMD)
+			handler = drbd_opt_cmd_handler[header->command-MayIgnore];
+		else if (header->command > MAX_OPT_CMD)
+			handler = receive_skip;
+		else
+			handler = NULL;
+
+		if (unlikely(!handler)) {
+			ERR("unknown packet type %d, l: %d!\n",
+			    header->command, header->length);
+			drbd_force_state(mdev, NS(conn, ProtocolError));
+			break;
+		}
+		if (unlikely(!handler(mdev, header))) {
+			ERR("error receiving %s, l: %d!\n",
+			    cmdname(header->command), header->length);
+			drbd_force_state(mdev, NS(conn, ProtocolError));
+			break;
+		}
+
+		dump_packet(mdev, mdev->data.socket, 2, &mdev->data.rbuf,
+				__FILE__, __LINE__);
+	}
+}
+
+STATIC void drbd_fail_pending_reads(struct drbd_conf *mdev)
+{
+	struct hlist_head *slot;
+	struct hlist_node *pos;
+	struct hlist_node *tmp;
+	struct drbd_request *req;
+	int i;
+
+	/*
+	 * Application READ requests
+	 */
+	spin_lock_irq(&mdev->req_lock);
+	for (i = 0; i < APP_R_HSIZE; i++) {
+		slot = mdev->app_reads_hash+i;
+		hlist_for_each_entry_safe(req, pos, tmp, slot, colision) {
+			/* it may (but should not any longer!)
+			 * be on the work queue; if that assert triggers,
+			 * we need to also grab the
+			 * spin_lock_irq(&mdev->data.work.q_lock);
+			 * and list_del_init here. */
+			D_ASSERT(list_empty(&req->w.list));
+			_req_mod(req, connection_lost_while_pending, 0);
+		}
+	}
+	for (i = 0; i < APP_R_HSIZE; i++)
+		if (!hlist_empty(mdev->app_reads_hash+i))
+			drbd_WARN("ASSERT FAILED: app_reads_hash[%d].first: "
+				"%p, should be NULL\n", i, mdev->app_reads_hash[i].first);
+
+	memset(mdev->app_reads_hash, 0, APP_R_HSIZE*sizeof(void *));
+	spin_unlock_irq(&mdev->req_lock);
+}
+
+STATIC void drbd_disconnect(struct drbd_conf *mdev)
+{
+	struct drbd_work prev_work_done;
+	enum fencing_policy fp;
+	union drbd_state_t os, ns;
+	int rv = SS_UnknownError;
+	unsigned int i;
+
+	if (mdev->state.conn == StandAlone)
+		return;
+	if (mdev->state.conn >= WFConnection)
+		ERR("ASSERT FAILED cstate = %s, expected < WFConnection\n",
+				conns_to_name(mdev->state.conn));
+
+	/* asender does not clean up anything. it must not interfere, either */
+	drbd_thread_stop(&mdev->asender);
+
+	mutex_lock(&mdev->data.mutex);
+	drbd_free_sock(mdev);
+	mutex_unlock(&mdev->data.mutex);
+
+	spin_lock_irq(&mdev->req_lock);
+	_drbd_wait_ee_list_empty(mdev, &mdev->active_ee);
+	_drbd_wait_ee_list_empty(mdev, &mdev->sync_ee);
+	_drbd_clear_done_ee(mdev);
+	_drbd_wait_ee_list_empty(mdev, &mdev->read_ee);
+	reclaim_net_ee(mdev);
+	spin_unlock_irq(&mdev->req_lock);
+
+	/* We do not have data structures that would allow us to
+	 * get the rs_pending_cnt down to 0 again.
+	 *  * On SyncTarget we do not have any data structures describing
+	 *    the pending RSDataRequest's we have sent.
+	 *  * On SyncSource there is no data structure that tracks
+	 *    the RSDataReply blocks that we sent to the SyncTarget.
+	 *  And no, it is not the sum of the reference counts in the
+	 *  resync_LRU. The resync_LRU tracks the whole operation including
+	 *  the disk-IO, while the rs_pending_cnt only tracks the blocks
+	 *  on the fly. */
+	drbd_rs_cancel_all(mdev);
+	mdev->rs_total = 0;
+	mdev->rs_failed = 0;
+	atomic_set(&mdev->rs_pending_cnt, 0);
+	wake_up(&mdev->misc_wait);
+
+	/* make sure syncer is stopped and w_resume_next_sg queued */
+	del_timer_sync(&mdev->resync_timer);
+	set_bit(STOP_SYNC_TIMER, &mdev->flags);
+	resync_timer_fn((unsigned long)mdev);
+
+	/* wait for all w_e_end_data_req, w_e_end_rsdata_req, w_send_barrier,
+	 * w_make_resync_request etc. which may still be on the worker queue
+	 * to be "canceled" */
+	set_bit(WORK_PENDING, &mdev->flags);
+	prev_work_done.cb = w_prev_work_done;
+	drbd_queue_work(&mdev->data.work, &prev_work_done);
+	wait_event(mdev->misc_wait, !test_bit(WORK_PENDING, &mdev->flags));
+
+	kfree(mdev->p_uuid);
+	mdev->p_uuid = NULL;
+
+	if (!mdev->state.susp)
+		tl_clear(mdev);
+
+	drbd_fail_pending_reads(mdev);
+
+	INFO("Connection closed\n");
+
+	drbd_md_sync(mdev);
+
+	fp = DontCare;
+	if (inc_local(mdev)) {
+		fp = mdev->bc->dc.fencing;
+		dec_local(mdev);
+	}
+
+	if (mdev->state.role == Primary) {
+		if (fp >= Resource && mdev->state.pdsk >= DUnknown) {
+			enum drbd_disk_state nps = drbd_try_outdate_peer(mdev);
+			drbd_request_state(mdev, NS(pdsk, nps));
+		}
+	}
+
+	spin_lock_irq(&mdev->req_lock);
+	os = mdev->state;
+	if (os.conn >= Unconnected) {
+		/* Do not restart in case we are Disconnecting */
+		ns = os;
+		ns.conn = Unconnected;
+		rv = _drbd_set_state(mdev, ns, ChgStateVerbose, NULL);
+	}
+	spin_unlock_irq(&mdev->req_lock);
+
+	if (os.conn == Disconnecting) {
+		struct hlist_head *h;
+		wait_event(mdev->misc_wait, atomic_read(&mdev->net_cnt) == 0);
+
+		/* we must not free the tl_hash
+		 * while application io is still on the fly */
+		wait_event(mdev->misc_wait, atomic_read(&mdev->ap_bio_cnt) == 0);
+
+		spin_lock_irq(&mdev->req_lock);
+		/* paranoia code */
+		for (h = mdev->ee_hash; h < mdev->ee_hash + mdev->ee_hash_s; h++)
+			if (h->first)
+				ERR("ASSERT FAILED ee_hash[%u].first == %p, expected NULL\n",
+						(int)(h - mdev->ee_hash), h->first);
+		kfree(mdev->ee_hash);
+		mdev->ee_hash = NULL;
+		mdev->ee_hash_s = 0;
+
+		/* paranoia code */
+		for (h = mdev->tl_hash; h < mdev->tl_hash + mdev->tl_hash_s; h++)
+			if (h->first)
+				ERR("ASSERT FAILED tl_hash[%u] == %p, expected NULL\n",
+						(int)(h - mdev->tl_hash), h->first);
+		kfree(mdev->tl_hash);
+		mdev->tl_hash = NULL;
+		mdev->tl_hash_s = 0;
+		spin_unlock_irq(&mdev->req_lock);
+
+		crypto_free_hash(mdev->cram_hmac_tfm);
+		mdev->cram_hmac_tfm = NULL;
+
+		kfree(mdev->net_conf);
+		mdev->net_conf = NULL;
+		drbd_request_state(mdev, NS(conn, StandAlone));
+	}
+
+	/* they do trigger all the time.
+	 * hm. why won't tcp release the page references,
+	 * we already released the socket!? */
+	i = atomic_read(&mdev->pp_in_use);
+	if (i)
+		DBG("pp_in_use = %u, expected 0\n", i);
+	if (!list_empty(&mdev->net_ee))
+		DBG("net_ee not empty!\n");
+
+	D_ASSERT(list_empty(&mdev->read_ee));
+	D_ASSERT(list_empty(&mdev->active_ee));
+	D_ASSERT(list_empty(&mdev->sync_ee));
+	D_ASSERT(list_empty(&mdev->done_ee));
+
+	/* ok, no more ee's on the fly, it is safe to reset the epoch_size */
+	atomic_set(&mdev->current_epoch->epoch_size, 0);
+	D_ASSERT(list_empty(&mdev->current_epoch->list));
+}
+
+/*
+ * We support PRO_VERSION_MIN to PRO_VERSION_MAX. The protocol version
+ * we can agree on is stored in agreed_pro_version.
+ *
+ * feature flags and the reserved array should be enough room for future
+ * enhancements of the handshake protocol, and possible plugins...
+ *
+ * for now, they are expected to be zero, but ignored.
+ */
+STATIC int drbd_send_handshake(struct drbd_conf *mdev)
+{
+	/* ASSERT current == mdev->receiver ... */
+	struct Drbd_HandShake_Packet *p = &mdev->data.sbuf.HandShake;
+	int ok;
+
+	if (mutex_lock_interruptible(&mdev->data.mutex)) {
+		ERR("interrupted during initial handshake\n");
+		return 0; /* interrupted. not ok. */
+	}
+
+	if (mdev->data.socket == NULL) {
+		mutex_unlock(&mdev->data.mutex);
+		return 0;
+	}
+
+	memset(p, 0, sizeof(*p));
+	p->protocol_min = cpu_to_be32(PRO_VERSION_MIN);
+	p->protocol_max = cpu_to_be32(PRO_VERSION_MAX);
+	ok = _drbd_send_cmd( mdev, mdev->data.socket, HandShake,
+			     (struct Drbd_Header *)p, sizeof(*p), 0 );
+	mutex_unlock(&mdev->data.mutex);
+	return ok;
+}
+
+/*
+ * return values:
+ *   1 yess, we have a valid connection
+ *   0 oops, did not work out, please try again
+ *  -1 peer talks different language,
+ *     no point in trying again, please go standalone.
+ */
+int drbd_do_handshake(struct drbd_conf *mdev)
+{
+	/* ASSERT current == mdev->receiver ... */
+	struct Drbd_HandShake_Packet *p = &mdev->data.rbuf.HandShake;
+	const int expect = sizeof(struct Drbd_HandShake_Packet)
+			  -sizeof(struct Drbd_Header);
+	int rv;
+
+	rv = drbd_send_handshake(mdev);
+	if (!rv)
+		return 0;
+
+	rv = drbd_recv_header(mdev, &p->head);
+	if (!rv)
+		return 0;
+
+	if (p->head.command != HandShake) {
+		ERR("expected HandShake packet, received: %s (0x%04x)\n",
+		     cmdname(p->head.command), p->head.command);
+		return -1;
+	}
+
+	if (p->head.length != expect) {
+		ERR("expected HandShake length: %u, received: %u\n",
+		     expect, p->head.length);
+		return -1;
+	}
+
+	rv = drbd_recv(mdev, &p->head.payload, expect);
+
+	if (rv != expect) {
+		ERR("short read receiving handshake packet: l=%u\n", rv);
+		return 0;
+	}
+
+	dump_packet(mdev, mdev->data.socket, 2, &mdev->data.rbuf,
+			__FILE__, __LINE__);
+
+	p->protocol_min = be32_to_cpu(p->protocol_min);
+	p->protocol_max = be32_to_cpu(p->protocol_max);
+	if (p->protocol_max == 0)
+		p->protocol_max = p->protocol_min;
+
+	if (PRO_VERSION_MAX < p->protocol_min ||
+	    PRO_VERSION_MIN > p->protocol_max)
+		goto incompat;
+
+	mdev->agreed_pro_version = min_t(int, PRO_VERSION_MAX, p->protocol_max);
+
+	INFO("Handshake successful: "
+	     "Agreed network protocol version %d\n", mdev->agreed_pro_version);
+
+	return 1;
+
+ incompat:
+	ERR("incompatible DRBD dialects: "
+	    "I support %d-%d, peer supports %d-%d\n",
+	    PRO_VERSION_MIN, PRO_VERSION_MAX,
+	    p->protocol_min, p->protocol_max);
+	return -1;
+}
+
+#if !defined(CONFIG_CRYPTO_HMAC) && !defined(CONFIG_CRYPTO_HMAC_MODULE)
+int drbd_do_auth(struct drbd_conf *mdev)
+{
+	ERR("This kernel was build without CONFIG_CRYPTO_HMAC.\n");
+	ERR("You need to disable 'cram-hmac-alg' in drbd.conf.\n");
+	return 0;
+}
+#else
+#define CHALLENGE_LEN 64
+int drbd_do_auth(struct drbd_conf *mdev)
+{
+	char my_challenge[CHALLENGE_LEN];  /* 64 Bytes... */
+	struct scatterlist sg;
+	char *response = NULL;
+	char *right_response = NULL;
+	char *peers_ch = NULL;
+	struct Drbd_Header p;
+	unsigned int key_len = strlen(mdev->net_conf->shared_secret);
+	unsigned int resp_size;
+	struct hash_desc desc;
+	int rv;
+
+	desc.tfm = mdev->cram_hmac_tfm;
+	desc.flags = 0;
+
+	rv = crypto_hash_setkey(mdev->cram_hmac_tfm,
+				(u8 *)mdev->net_conf->shared_secret, key_len);
+	if (rv) {
+		ERR("crypto_hash_setkey() failed with %d\n", rv);
+		rv = 0;
+		goto fail;
+	}
+
+	get_random_bytes(my_challenge, CHALLENGE_LEN);
+
+	rv = drbd_send_cmd2(mdev, AuthChallenge, my_challenge, CHALLENGE_LEN);
+	if (!rv)
+		goto fail;
+
+	rv = drbd_recv_header(mdev, &p);
+	if (!rv)
+		goto fail;
+
+	if (p.command != AuthChallenge) {
+		ERR("expected AuthChallenge packet, received: %s (0x%04x)\n",
+		    cmdname(p.command), p.command);
+		rv = 0;
+		goto fail;
+	}
+
+	if (p.length > CHALLENGE_LEN*2) {
+		ERR("expected AuthChallenge payload too big.\n");
+		rv = 0;
+		goto fail;
+	}
+
+	peers_ch = kmalloc(p.length, GFP_KERNEL);
+	if (peers_ch == NULL) {
+		ERR("kmalloc of peers_ch failed\n");
+		rv = 0;
+		goto fail;
+	}
+
+	rv = drbd_recv(mdev, peers_ch, p.length);
+
+	if (rv != p.length) {
+		ERR("short read AuthChallenge: l=%u\n", rv);
+		rv = 0;
+		goto fail;
+	}
+
+	resp_size = crypto_hash_digestsize(mdev->cram_hmac_tfm);
+	response = kmalloc(resp_size, GFP_KERNEL);
+	if (response == NULL) {
+		ERR("kmalloc of response failed\n");
+		rv = 0;
+		goto fail;
+	}
+
+	sg_init_table(&sg, 1);
+	sg_set_buf(&sg, peers_ch, p.length);
+
+	rv = crypto_hash_digest(&desc, &sg, sg.length, response);
+	if (rv) {
+		ERR("crypto_hash_digest() failed with %d\n", rv);
+		rv = 0;
+		goto fail;
+	}
+
+	rv = drbd_send_cmd2(mdev, AuthResponse, response, resp_size);
+	if (!rv)
+		goto fail;
+
+	rv = drbd_recv_header(mdev, &p);
+	if (!rv)
+		goto fail;
+
+	if (p.command != AuthResponse) {
+		ERR("expected AuthResponse packet, received: %s (0x%04x)\n",
+		    cmdname(p.command), p.command);
+		rv = 0;
+		goto fail;
+	}
+
+	if (p.length != resp_size) {
+		ERR("expected AuthResponse payload of wrong size\n");
+		rv = 0;
+		goto fail;
+	}
+
+	rv = drbd_recv(mdev, response , resp_size);
+
+	if (rv != resp_size) {
+		ERR("short read receiving AuthResponse: l=%u\n", rv);
+		rv = 0;
+		goto fail;
+	}
+
+	right_response = kmalloc(resp_size, GFP_KERNEL);
+	if (response == NULL) {
+		ERR("kmalloc of right_response failed\n");
+		rv = 0;
+		goto fail;
+	}
+
+	sg_set_buf(&sg, my_challenge, CHALLENGE_LEN);
+
+	rv = crypto_hash_digest(&desc, &sg, sg.length, right_response);
+	if (rv) {
+		ERR("crypto_hash_digest() failed with %d\n", rv);
+		rv = 0;
+		goto fail;
+	}
+
+	rv = !memcmp(response, right_response, resp_size);
+
+	if (rv)
+		INFO("Peer authenticated using %d bytes of '%s' HMAC\n",
+		     resp_size, mdev->net_conf->cram_hmac_alg);
+
+ fail:
+	kfree(peers_ch);
+	kfree(response);
+	kfree(right_response);
+
+	return rv;
+}
+#endif
+
+STATIC int drbdd_init(struct Drbd_thread *thi)
+{
+	struct drbd_conf *mdev = thi->mdev;
+	unsigned int minor = mdev_to_minor(mdev);
+	int h;
+
+	sprintf(current->comm, "drbd%d_receiver", minor);
+
+	INFO("receiver (re)started\n");
+
+	do {
+		h = drbd_connect(mdev);
+		if (h == 0) {
+			drbd_disconnect(mdev);
+			__set_current_state(TASK_INTERRUPTIBLE);
+			schedule_timeout(HZ);
+		}
+		if (h == -1) {
+			drbd_WARN("Discarding network configuration.\n");
+			drbd_force_state(mdev, NS(conn, Disconnecting));
+		}
+	} while (h == 0);
+
+	if (h > 0) {
+		if (inc_net(mdev)) {
+			drbdd(mdev);
+			dec_net(mdev);
+		}
+	}
+
+	drbd_disconnect(mdev);
+
+	INFO("receiver terminated\n");
+	return 0;
+}
+
+/* ********* acknowledge sender ******** */
+
+STATIC int got_RqSReply(struct drbd_conf *mdev, struct Drbd_Header *h)
+{
+	struct Drbd_RqS_Reply_Packet *p = (struct Drbd_RqS_Reply_Packet *)h;
+
+	int retcode = be32_to_cpu(p->retcode);
+
+	if (retcode >= SS_Success) {
+		set_bit(CL_ST_CHG_SUCCESS, &mdev->flags);
+	} else {
+		set_bit(CL_ST_CHG_FAIL, &mdev->flags);
+		ERR("Requested state change failed by peer: %s (%d)\n",
+		    set_st_err_name(retcode), retcode);
+	}
+	wake_up(&mdev->state_wait);
+
+	return TRUE;
+}
+
+STATIC int got_Ping(struct drbd_conf *mdev, struct Drbd_Header *h)
+{
+	return drbd_send_ping_ack(mdev);
+
+}
+
+STATIC int got_PingAck(struct drbd_conf *mdev, struct Drbd_Header *h)
+{
+	/* restore idle timeout */
+	mdev->meta.socket->sk->sk_rcvtimeo = mdev->net_conf->ping_int*HZ;
+
+	return TRUE;
+}
+
+STATIC int got_IsInSync(struct drbd_conf *mdev, struct Drbd_Header *h)
+{
+	struct Drbd_BlockAck_Packet *p = (struct Drbd_BlockAck_Packet *)h;
+	sector_t sector = be64_to_cpu(p->sector);
+	int blksize = be32_to_cpu(p->blksize);
+
+	D_ASSERT(mdev->agreed_pro_version >= 89);
+
+	update_peer_seq(mdev, be32_to_cpu(p->seq_num));
+
+	drbd_rs_complete_io(mdev, sector);
+	drbd_set_in_sync(mdev, sector, blksize);
+	/* rs_same_csums is supposed to count in units of BM_BLOCK_SIZE */
+	mdev->rs_same_csum += (blksize >> BM_BLOCK_SIZE_B);
+	dec_rs_pending(mdev);
+
+	return TRUE;
+}
+
+STATIC int got_BlockAck(struct drbd_conf *mdev, struct Drbd_Header *h)
+{
+	struct drbd_request *req;
+	struct Drbd_BlockAck_Packet *p = (struct Drbd_BlockAck_Packet *)h;
+	sector_t sector = be64_to_cpu(p->sector);
+	int blksize = be32_to_cpu(p->blksize);
+
+	update_peer_seq(mdev, be32_to_cpu(p->seq_num));
+
+	if (is_syncer_block_id(p->block_id)) {
+		drbd_set_in_sync(mdev, sector, blksize);
+		dec_rs_pending(mdev);
+	} else {
+		spin_lock_irq(&mdev->req_lock);
+		req = _ack_id_to_req(mdev, p->block_id, sector);
+
+		if (unlikely(!req)) {
+			spin_unlock_irq(&mdev->req_lock);
+			ERR("Got a corrupt block_id/sector pair(2).\n");
+			return FALSE;
+		}
+
+		switch (be16_to_cpu(h->command)) {
+		case RSWriteAck:
+			D_ASSERT(mdev->net_conf->wire_protocol == DRBD_PROT_C);
+			_req_mod(req, write_acked_by_peer_and_sis, 0);
+			break;
+		case WriteAck:
+			D_ASSERT(mdev->net_conf->wire_protocol == DRBD_PROT_C);
+			_req_mod(req, write_acked_by_peer, 0);
+			break;
+		case RecvAck:
+			D_ASSERT(mdev->net_conf->wire_protocol == DRBD_PROT_B);
+			_req_mod(req, recv_acked_by_peer, 0);
+			break;
+		case DiscardAck:
+			D_ASSERT(mdev->net_conf->wire_protocol == DRBD_PROT_C);
+			ALERT("Got DiscardAck packet %llus +%u!"
+			      " DRBD is not a random data generator!\n",
+			      (unsigned long long)req->sector, req->size);
+			_req_mod(req, conflict_discarded_by_peer, 0);
+			break;
+		default:
+			D_ASSERT(0);
+		}
+		spin_unlock_irq(&mdev->req_lock);
+	}
+	/* dec_ap_pending is handled within _req_mod */
+
+	return TRUE;
+}
+
+STATIC int got_NegAck(struct drbd_conf *mdev, struct Drbd_Header *h)
+{
+	struct Drbd_BlockAck_Packet *p = (struct Drbd_BlockAck_Packet *)h;
+	sector_t sector = be64_to_cpu(p->sector);
+	struct drbd_request *req;
+
+	if (__ratelimit(&drbd_ratelimit_state))
+		drbd_WARN("Got NegAck packet. Peer is in troubles?\n");
+
+	update_peer_seq(mdev, be32_to_cpu(p->seq_num));
+
+	if (is_syncer_block_id(p->block_id)) {
+		int size = be32_to_cpu(p->blksize);
+
+		dec_rs_pending(mdev);
+
+		drbd_rs_failed_io(mdev, sector, size);
+	} else {
+		spin_lock_irq(&mdev->req_lock);
+		req = _ack_id_to_req(mdev, p->block_id, sector);
+
+		if (unlikely(!req)) {
+			spin_unlock_irq(&mdev->req_lock);
+			ERR("Got a corrupt block_id/sector pair(2).\n");
+			return FALSE;
+		}
+
+		_req_mod(req, neg_acked, 0);
+		spin_unlock_irq(&mdev->req_lock);
+	}
+
+	return TRUE;
+}
+
+STATIC int got_NegDReply(struct drbd_conf *mdev, struct Drbd_Header *h)
+{
+	struct drbd_request *req;
+	struct Drbd_BlockAck_Packet *p = (struct Drbd_BlockAck_Packet *)h;
+	sector_t sector = be64_to_cpu(p->sector);
+
+	spin_lock_irq(&mdev->req_lock);
+	req = _ar_id_to_req(mdev, p->block_id, sector);
+	if (unlikely(!req)) {
+		spin_unlock_irq(&mdev->req_lock);
+		ERR("Got a corrupt block_id/sector pair(3).\n");
+		return FALSE;
+	}
+
+	_req_mod(req, neg_acked, 0);
+	spin_unlock_irq(&mdev->req_lock);
+
+	update_peer_seq(mdev, be32_to_cpu(p->seq_num));
+
+	ERR("Got NegDReply; Sector %llus, len %u; Fail original request.\n",
+	    (unsigned long long)sector, be32_to_cpu(p->blksize));
+
+	return TRUE;
+}
+
+STATIC int got_NegRSDReply(struct drbd_conf *mdev, struct Drbd_Header *h)
+{
+	sector_t sector;
+	int size;
+	struct Drbd_BlockAck_Packet *p = (struct Drbd_BlockAck_Packet *)h;
+
+	sector = be64_to_cpu(p->sector);
+	size = be32_to_cpu(p->blksize);
+	D_ASSERT(p->block_id == ID_SYNCER);
+
+	update_peer_seq(mdev, be32_to_cpu(p->seq_num));
+
+	dec_rs_pending(mdev);
+
+	if (inc_local_if_state(mdev, Failed)) {
+		drbd_rs_complete_io(mdev, sector);
+		drbd_rs_failed_io(mdev, sector, size);
+		dec_local(mdev);
+	}
+
+	return TRUE;
+}
+
+STATIC int got_BarrierAck(struct drbd_conf *mdev, struct Drbd_Header *h)
+{
+	struct Drbd_BarrierAck_Packet *p = (struct Drbd_BarrierAck_Packet *)h;
+
+	tl_release(mdev, p->barrier, be32_to_cpu(p->set_size));
+
+	return TRUE;
+}
+
+STATIC int got_OVResult(struct drbd_conf *mdev, struct Drbd_Header *h)
+{
+	struct Drbd_BlockAck_Packet *p = (struct Drbd_BlockAck_Packet *)h;
+	struct drbd_work *w;
+	sector_t sector;
+	int size;
+
+	sector = be64_to_cpu(p->sector);
+	size = be32_to_cpu(p->blksize);
+
+	update_peer_seq(mdev, be32_to_cpu(p->seq_num));
+
+	if (be64_to_cpu(p->block_id) == ID_OUT_OF_SYNC)
+		drbd_ov_oos_found(mdev, sector, size);
+	else
+		ov_oos_print(mdev);
+
+	drbd_rs_complete_io(mdev, sector);
+	dec_rs_pending(mdev);
+
+	if (--mdev->ov_left == 0) {
+		w = kmalloc(sizeof(*w), GFP_KERNEL);
+		if (w) {
+			w->cb = w_ov_finished;
+			drbd_queue_work_front(&mdev->data.work, w);
+		} else {
+			ERR("kmalloc(w) failed.");
+			drbd_resync_finished(mdev);
+		}
+	}
+	return TRUE;
+}
+
+struct asender_cmd {
+	size_t pkt_size;
+	int (*process)(struct drbd_conf *mdev, struct Drbd_Header *h);
+};
+
+static struct asender_cmd *get_asender_cmd(int cmd)
+{
+	static struct asender_cmd asender_tbl[] = {
+		/* anything missing from this table is in
+		 * the drbd_cmd_handler (drbd_default_handler) table,
+		 * see the beginning of drbdd() */
+	[Ping]		= { sizeof(struct Drbd_Header), got_Ping },
+	[PingAck]	= { sizeof(struct Drbd_Header),	got_PingAck },
+	[RecvAck]	= { sizeof(struct Drbd_BlockAck_Packet), got_BlockAck },
+	[WriteAck]	= { sizeof(struct Drbd_BlockAck_Packet), got_BlockAck },
+	[RSWriteAck]	= { sizeof(struct Drbd_BlockAck_Packet), got_BlockAck },
+	[DiscardAck]	= { sizeof(struct Drbd_BlockAck_Packet), got_BlockAck },
+	[NegAck]	= { sizeof(struct Drbd_BlockAck_Packet), got_NegAck },
+	[NegDReply]	= { sizeof(struct Drbd_BlockAck_Packet), got_NegDReply },
+	[NegRSDReply]	= { sizeof(struct Drbd_BlockAck_Packet), got_NegRSDReply},
+	[OVResult]      = { sizeof(struct Drbd_BlockAck_Packet),  got_OVResult },
+	[BarrierAck]	= { sizeof(struct Drbd_BarrierAck_Packet), got_BarrierAck },
+	[StateChgReply] = { sizeof(struct Drbd_RqS_Reply_Packet), got_RqSReply },
+	[RSIsInSync]	= { sizeof(struct Drbd_BlockAck_Packet), got_IsInSync },
+	[MAX_CMD]	= { 0, NULL },
+	};
+	if (cmd > MAX_CMD)
+		return NULL;
+	return &asender_tbl[cmd];
+}
+
+STATIC int drbd_asender(struct Drbd_thread *thi)
+{
+	struct drbd_conf *mdev = thi->mdev;
+	struct Drbd_Header *h = &mdev->meta.rbuf.head;
+	struct asender_cmd *cmd = NULL;
+
+	int rv, len;
+	void *buf    = h;
+	int received = 0;
+	int expect   = sizeof(struct Drbd_Header);
+	int empty;
+
+	sprintf(current->comm, "drbd%d_asender", mdev_to_minor(mdev));
+
+	current->policy = SCHED_RR;  /* Make this a realtime task! */
+	current->rt_priority = 2;    /* more important than all other tasks */
+
+	while (get_t_state(thi) == Running) {
+		drbd_thread_current_set_cpu(mdev);
+		if (test_and_clear_bit(SEND_PING, &mdev->flags)) {
+			ERR_IF(!drbd_send_ping(mdev)) goto reconnect;
+			mdev->meta.socket->sk->sk_rcvtimeo =
+				mdev->net_conf->ping_timeo*HZ/10;
+		}
+
+		/* conditionally cork;
+		 * it may hurt latency if we cork without much to send */
+		if (!mdev->net_conf->no_cork &&
+			3 < atomic_read(&mdev->unacked_cnt))
+			drbd_tcp_cork(mdev->meta.socket);
+		while (1) {
+			clear_bit(SIGNAL_ASENDER, &mdev->flags);
+			flush_signals(current);
+			if (!drbd_process_done_ee(mdev)) {
+				ERR("process_done_ee() = NOT_OK\n");
+				goto reconnect;
+			}
+			/* to avoid race with newly queued ACKs */
+			set_bit(SIGNAL_ASENDER, &mdev->flags);
+			spin_lock_irq(&mdev->req_lock);
+			empty = list_empty(&mdev->done_ee);
+			spin_unlock_irq(&mdev->req_lock);
+			/* new ack may have been queued right here,
+			 * but then there is also a signal pending,
+			 * and we start over... */
+			if (empty)
+				break;
+		}
+		/* but unconditionally uncork unless disabled */
+		if (!mdev->net_conf->no_cork)
+			drbd_tcp_uncork(mdev->meta.socket);
+
+		/* short circuit, recv_msg would return EINTR anyways. */
+		if (signal_pending(current))
+			continue;
+
+		rv = drbd_recv_short(mdev, mdev->meta.socket,
+				     buf, expect-received, 0);
+		clear_bit(SIGNAL_ASENDER, &mdev->flags);
+
+		flush_signals(current);
+
+		/* Note:
+		 * -EINTR	 (on meta) we got a signal
+		 * -EAGAIN	 (on meta) rcvtimeo expired
+		 * -ECONNRESET	 other side closed the connection
+		 * -ERESTARTSYS  (on data) we got a signal
+		 * rv <  0	 other than above: unexpected error!
+		 * rv == expected: full header or command
+		 * rv <  expected: "woken" by signal during receive
+		 * rv == 0	 : "connection shut down by peer"
+		 */
+		if (likely(rv > 0)) {
+			received += rv;
+			buf	 += rv;
+		} else if (rv == 0) {
+			ERR("meta connection shut down by peer.\n");
+			goto reconnect;
+		} else if (rv == -EAGAIN) {
+			if (mdev->meta.socket->sk->sk_rcvtimeo ==
+			    mdev->net_conf->ping_timeo*HZ/10) {
+				ERR("PingAck did not arrive in time.\n");
+				goto reconnect;
+			}
+			set_bit(SEND_PING, &mdev->flags);
+			continue;
+		} else if (rv == -EINTR) {
+			continue;
+		} else {
+			ERR("sock_recvmsg returned %d\n", rv);
+			goto reconnect;
+		}
+
+		if (received == expect && cmd == NULL) {
+			if (unlikely(h->magic != BE_DRBD_MAGIC)) {
+				ERR("magic?? on meta m: 0x%lx c: %d l: %d\n",
+				    (long)be32_to_cpu(h->magic),
+				    h->command, h->length);
+				goto reconnect;
+			}
+			cmd = get_asender_cmd(be16_to_cpu(h->command));
+			len = be16_to_cpu(h->length);
+			if (unlikely(cmd == NULL)) {
+				ERR("unknown command?? on meta m: 0x%lx c: %d l: %d\n",
+				    (long)be32_to_cpu(h->magic),
+				    h->command, h->length);
+				goto disconnect;
+			}
+			expect = cmd->pkt_size;
+			ERR_IF(len != expect-sizeof(struct Drbd_Header)) {
+				dump_packet(mdev, mdev->meta.socket, 1, (void *)h, __FILE__, __LINE__);
+				DUMPI(expect);
+				goto reconnect;
+			}
+		}
+		if (received == expect) {
+			D_ASSERT(cmd != NULL);
+			dump_packet(mdev, mdev->meta.socket, 1, (void *)h, __FILE__, __LINE__);
+			if (!cmd->process(mdev, h))
+				goto reconnect;
+
+			buf	 = h;
+			received = 0;
+			expect	 = sizeof(struct Drbd_Header);
+			cmd	 = NULL;
+		}
+	}
+
+	if (0) {
+reconnect:
+		drbd_force_state(mdev, NS(conn, NetworkFailure));
+	}
+	if (0) {
+disconnect:
+		drbd_force_state(mdev, NS(conn, Disconnecting));
+	}
+	clear_bit(SIGNAL_ASENDER, &mdev->flags);
+
+	D_ASSERT(mdev->state.conn < Connected);
+	INFO("asender terminated\n");
+
+	return 0;
+}
--- linux-rt-2.6.31.orig/ubuntu/drbd/drbd_main.c
+++ linux-rt-2.6.31/ubuntu/drbd/drbd_main.c
@@ -0,0 +1,4045 @@
+/*
+   drbd.c
+
+   This file is part of DRBD by Philipp Reisner and Lars Ellenberg.
+
+   Copyright (C) 2001-2008, LINBIT Information Technologies GmbH.
+   Copyright (C) 1999-2008, Philipp Reisner <philipp.reisner@linbit.com>.
+   Copyright (C) 2002-2008, Lars Ellenberg <lars.ellenberg@linbit.com>.
+
+   drbd is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 2, or (at your option)
+   any later version.
+
+   drbd is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with drbd; see the file COPYING.  If not, write to
+   the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
+
+ */
+
+#include <linux/autoconf.h>
+#include <linux/module.h>
+#include <linux/version.h>
+
+#include <asm/uaccess.h>
+#include <asm/types.h>
+#include <net/sock.h>
+#include <linux/ctype.h>
+#include <linux/smp_lock.h>
+#include <linux/fs.h>
+#include <linux/file.h>
+#include <linux/proc_fs.h>
+#include <linux/init.h>
+#include <linux/mm.h>
+#include <linux/drbd_config.h>
+#include <linux/memcontrol.h>
+#include <linux/mm_inline.h>
+#include <linux/slab.h>
+#include <linux/random.h>
+#include <linux/reboot.h>
+#include <linux/notifier.h>
+#include <linux/kthread.h>
+
+#define __KERNEL_SYSCALLS__
+#include <linux/unistd.h>
+#include <linux/vmalloc.h>
+
+#include <linux/drbd.h>
+#include <linux/drbd_limits.h>
+#include "drbd_int.h"
+#include "drbd_req.h" /* only for _req_mod in tl_release and tl_clear */
+
+#include "drbd_vli.h"
+
+#ifndef DRBD_MAJOR
+#define DRBD_MAJOR                147
+#endif
+
+struct after_state_chg_work {
+	struct drbd_work w;
+	union drbd_state_t os;
+	union drbd_state_t ns;
+	enum chg_state_flags flags;
+	struct completion *done;
+};
+
+int drbdd_init(struct Drbd_thread *);
+int drbd_worker(struct Drbd_thread *);
+int drbd_asender(struct Drbd_thread *);
+
+int drbd_init(void);
+static int drbd_open(struct block_device *bdev, fmode_t mode);
+static int drbd_release(struct gendisk *gd, fmode_t mode);
+STATIC int w_after_state_ch(struct drbd_conf *mdev, struct drbd_work *w, int unused);
+STATIC void after_state_ch(struct drbd_conf *mdev, union drbd_state_t os,
+			   union drbd_state_t ns, enum chg_state_flags flags);
+STATIC int w_md_sync(struct drbd_conf *mdev, struct drbd_work *w, int unused);
+STATIC void md_sync_timer_fn(unsigned long data);
+STATIC int w_bitmap_io(struct drbd_conf *mdev, struct drbd_work *w, int unused);
+
+MODULE_AUTHOR("Philipp Reisner <phil@linbit.com>, "
+	      "Lars Ellenberg <lars@linbit.com>");
+MODULE_DESCRIPTION("drbd - Distributed Replicated Block Device v" REL_VERSION);
+MODULE_LICENSE("GPL");
+MODULE_PARM_DESC(minor_count, "Maximum number of drbd devices (1-255)");
+MODULE_ALIAS_BLOCKDEV_MAJOR(DRBD_MAJOR);
+
+#include <linux/moduleparam.h>
+/* allow_open_on_secondary */
+MODULE_PARM_DESC(allow_oos, "DONT USE!");
+/* thanks to these macros, if compiled into the kernel (not-module),
+ * this becomes the boot parameter drbd.minor_count */
+module_param(minor_count, uint, 0444);
+module_param(allow_oos, bool, 0);
+module_param(cn_idx, uint, 0444);
+
+#ifdef DRBD_ENABLE_FAULTS
+int enable_faults;
+int fault_rate;
+static int fault_count;
+int fault_devs;
+/* bitmap of enabled faults */
+module_param(enable_faults, int, 0664);
+/* fault rate % value - applies to all enabled faults */
+module_param(fault_rate, int, 0664);
+/* count of faults inserted */
+module_param(fault_count, int, 0664);
+/* bitmap of devices to insert faults on */
+module_param(fault_devs, int, 0644);
+#endif
+
+/* module parameter, defined */
+unsigned int minor_count = 32;
+int allow_oos;
+unsigned int cn_idx = CN_IDX_DRBD;
+
+#ifdef ENABLE_DYNAMIC_TRACE
+int trace_type;		/* Bitmap of trace types to enable */
+int trace_level;	/* Current trace level */
+int trace_devs;		/* Bitmap of devices to trace */
+int proc_details;       /* Detail level in proc drbd*/
+
+module_param(trace_level, int, 0644);
+module_param(trace_type, int, 0644);
+module_param(trace_devs, int, 0644);
+module_param(proc_details, int, 0644);
+#endif
+
+/* Module parameter for setting the user mode helper program
+ * to run. Default is /sbin/drbdadm */
+char usermode_helper[80] = "/sbin/drbdadm";
+
+module_param_string(usermode_helper, usermode_helper, sizeof(usermode_helper), 0644);
+
+/* in 2.6.x, our device mapping and config info contains our virtual gendisks
+ * as member "struct gendisk *vdisk;"
+ */
+struct drbd_conf **minor_table;
+
+struct kmem_cache *drbd_request_cache;
+struct kmem_cache *drbd_ee_cache;
+mempool_t *drbd_request_mempool;
+mempool_t *drbd_ee_mempool;
+
+/* I do not use a standard mempool, because:
+   1) I want to hand out the preallocated objects first.
+   2) I want to be able to interrupt sleeping allocation with a signal.
+   Note: This is a single linked list, the next pointer is the private
+	 member of struct page.
+ */
+struct page *drbd_pp_pool;
+spinlock_t   drbd_pp_lock;
+int          drbd_pp_vacant;
+wait_queue_head_t drbd_pp_wait;
+
+DEFINE_RATELIMIT_STATE(drbd_ratelimit_state, 5 * HZ, 5);
+
+STATIC struct block_device_operations drbd_ops = {
+	.owner =   THIS_MODULE,
+	.open =    drbd_open,
+	.release = drbd_release,
+};
+
+#define ARRY_SIZE(A) (sizeof(A)/sizeof(A[0]))
+
+#ifdef __CHECKER__
+/* When checking with sparse, and this is an inline function, sparse will
+   give tons of false positives. When this is a real functions sparse works.
+ */
+int _inc_local_if_state(struct drbd_conf *mdev, enum drbd_disk_state mins)
+{
+	int io_allowed;
+
+	atomic_inc(&mdev->local_cnt);
+	io_allowed = (mdev->state.disk >= mins);
+	if (!io_allowed) {
+		if (atomic_dec_and_test(&mdev->local_cnt))
+			wake_up(&mdev->misc_wait);
+	}
+	return io_allowed;
+}
+
+#endif
+
+/************************* The transfer log start */
+STATIC int tl_init(struct drbd_conf *mdev)
+{
+	struct drbd_barrier *b;
+
+	b = kmalloc(sizeof(struct drbd_barrier), GFP_KERNEL);
+	if (!b)
+		return 0;
+	INIT_LIST_HEAD(&b->requests);
+	INIT_LIST_HEAD(&b->w.list);
+	b->next = NULL;
+	b->br_number = 4711;
+	b->n_req = 0;
+	b->w.cb = NULL; /* if this is != NULL, we need to dec_ap_pending in tl_clear */
+
+	mdev->oldest_barrier = b;
+	mdev->newest_barrier = b;
+	INIT_LIST_HEAD(&mdev->out_of_sequence_requests);
+
+	mdev->tl_hash = NULL;
+	mdev->tl_hash_s = 0;
+
+	return 1;
+}
+
+STATIC void tl_cleanup(struct drbd_conf *mdev)
+{
+	D_ASSERT(mdev->oldest_barrier == mdev->newest_barrier);
+	D_ASSERT(list_empty(&mdev->out_of_sequence_requests));
+	kfree(mdev->oldest_barrier);
+	mdev->oldest_barrier = NULL;
+	kfree(mdev->unused_spare_barrier);
+	mdev->unused_spare_barrier = NULL;
+	kfree(mdev->tl_hash);
+	mdev->tl_hash = NULL;
+	mdev->tl_hash_s = 0;
+}
+
+/**
+ * _tl_add_barrier: Adds a barrier to the TL.
+ */
+void _tl_add_barrier(struct drbd_conf *mdev, struct drbd_barrier *new)
+{
+	struct drbd_barrier *newest_before;
+
+	INIT_LIST_HEAD(&new->requests);
+	INIT_LIST_HEAD(&new->w.list);
+	new->w.cb = NULL; /* if this is != NULL, we need to dec_ap_pending in tl_clear */
+	new->next = NULL;
+	new->n_req = 0;
+
+	newest_before = mdev->newest_barrier;
+	/* never send a barrier number == 0, because that is special-cased
+	 * when using TCQ for our write ordering code */
+	new->br_number = (newest_before->br_number+1) ?: 1;
+	if (mdev->newest_barrier != new) {
+		mdev->newest_barrier->next = new;
+		mdev->newest_barrier = new;
+	}
+}
+
+/* when we receive a barrier ack */
+void tl_release(struct drbd_conf *mdev, unsigned int barrier_nr,
+		       unsigned int set_size)
+{
+	struct drbd_barrier *b, *nob; /* next old barrier */
+	struct list_head *le, *tle;
+	struct drbd_request *r;
+
+	spin_lock_irq(&mdev->req_lock);
+
+	b = mdev->oldest_barrier;
+
+	/* first some paranoia code */
+	if (b == NULL) {
+		ERR("BAD! BarrierAck #%u received, but no epoch in tl!?\n",
+			barrier_nr);
+		goto bail;
+	}
+	if (b->br_number != barrier_nr) {
+		ERR("BAD! BarrierAck #%u received, expected #%u!\n",
+			barrier_nr, b->br_number);
+		goto bail;
+	}
+	if (b->n_req != set_size) {
+		ERR("BAD! BarrierAck #%u received with n_req=%u, expected n_req=%u!\n",
+			barrier_nr, set_size, b->n_req);
+		goto bail;
+	}
+
+	/* Clean up list of requests processed during current epoch */
+	list_for_each_safe(le, tle, &b->requests) {
+		r = list_entry(le, struct drbd_request, tl_requests);
+		_req_mod(r, barrier_acked, 0);
+	}
+	/* There could be requests on the list waiting for completion
+	   of the write to the local disk. To avoid corruptions of
+	   slab's data structures we have to remove the lists head.
+
+	   Also there could have been a barrier ack out of sequence, overtaking
+	   the write acks - which would be a but and violating write ordering.
+	   To not deadlock in case we lose connection while such requests are
+	   still pending, we need some way to find them for the
+	   _req_mode(connection_lost_while_pending).
+
+	   These have been list_move'd to the out_of_sequence_requests list in
+	   _req_mod(, barrier_acked,) above.
+	   */
+	list_del_init(&b->requests);
+
+	nob = b->next;
+	if (test_and_clear_bit(CREATE_BARRIER, &mdev->flags)) {
+		_tl_add_barrier(mdev, b);
+		if (nob)
+			mdev->oldest_barrier = nob;
+		/* if nob == NULL b was the only barrier, and becomes the new
+		   barrer. Threfore mdev->oldest_barrier points already to b */
+	} else {
+		D_ASSERT(nob != NULL);
+		mdev->oldest_barrier = nob;
+		kfree(b);
+	}
+
+	spin_unlock_irq(&mdev->req_lock);
+	dec_ap_pending(mdev);
+
+	return;
+
+bail:
+	spin_unlock_irq(&mdev->req_lock);
+	drbd_force_state(mdev, NS(conn, ProtocolError));
+}
+
+
+/* called by drbd_disconnect (exiting receiver thread)
+ * or from some after_state_ch */
+void tl_clear(struct drbd_conf *mdev)
+{
+	struct drbd_barrier *b, *tmp;
+	struct list_head *le, *tle;
+	struct drbd_request *r;
+	int new_initial_bnr = net_random();
+
+	spin_lock_irq(&mdev->req_lock);
+
+	b = mdev->oldest_barrier;
+	while (b) {
+		list_for_each_safe(le, tle, &b->requests) {
+			r = list_entry(le, struct drbd_request, tl_requests);
+			_req_mod(r, connection_lost_while_pending, 0);
+		}
+		tmp = b->next;
+
+		/* there could still be requests on that ring list,
+		 * in case local io is still pending */
+		list_del(&b->requests);
+
+		/* dec_ap_pending corresponding to queue_barrier.
+		 * the newest barrier may not have been queued yet,
+		 * in which case w.cb is still NULL. */
+		if (b->w.cb != NULL)
+			dec_ap_pending(mdev);
+
+		if (b == mdev->newest_barrier) {
+			/* recycle, but reinit! */
+			D_ASSERT(tmp == NULL);
+			INIT_LIST_HEAD(&b->requests);
+			INIT_LIST_HEAD(&b->w.list);
+			b->w.cb = NULL;
+			b->br_number = new_initial_bnr;
+			b->n_req = 0;
+
+			mdev->oldest_barrier = b;
+			break;
+		}
+		kfree(b);
+		b = tmp;
+	}
+
+	/* we expect this list to be empty. */
+	D_ASSERT(list_empty(&mdev->out_of_sequence_requests));
+
+	/* but just in case, clean it up anyways! */
+	list_for_each_safe(le, tle, &mdev->out_of_sequence_requests) {
+		r = list_entry(le, struct drbd_request, tl_requests);
+		_req_mod(r, connection_lost_while_pending, 0);
+	}
+
+	/* ensure bit indicating barrier is required is clear */
+	clear_bit(CREATE_BARRIER, &mdev->flags);
+
+	spin_unlock_irq(&mdev->req_lock);
+}
+
+/**
+ * drbd_io_error: Handles the on_io_error setting, should be called in the
+ * unlikely(!drbd_bio_uptodate(e->bio)) case from kernel thread context.
+ * See also drbd_chk_io_error
+ *
+ * NOTE: we set ourselves FAILED here if on_io_error is Detach or Panic OR
+ *	 if the forcedetach flag is set. This flag is set when failures
+ *	 occur writing the meta data portion of the disk as they are
+ *	 not recoverable.
+ */
+int drbd_io_error(struct drbd_conf *mdev, int forcedetach)
+{
+	enum io_error_handler eh;
+	unsigned long flags;
+	int send;
+	int ok = 1;
+
+	eh = PassOn;
+	if (inc_local_if_state(mdev, Failed)) {
+		eh = mdev->bc->dc.on_io_error;
+		dec_local(mdev);
+	}
+
+	if (!forcedetach && eh == PassOn)
+		return 1;
+
+	spin_lock_irqsave(&mdev->req_lock, flags);
+	send = (mdev->state.disk == Failed);
+	if (send)
+		_drbd_set_state(_NS(mdev, disk, Diskless), ChgStateHard, NULL);
+	spin_unlock_irqrestore(&mdev->req_lock, flags);
+
+	if (!send)
+		return ok;
+
+	if (mdev->state.conn >= Connected) {
+		ok = drbd_send_state(mdev);
+		if (ok)
+			drbd_WARN("Notified peer that my disk is broken.\n");
+		else
+			ERR("Sending state in drbd_io_error() failed\n");
+	}
+
+	/* Make sure we try to flush meta-data to disk - we come
+	 * in here because of a local disk error so it might fail
+	 * but we still need to try -- both because the error might
+	 * be in the data portion of the disk and because we need
+	 * to ensure the md-sync-timer is stopped if running. */
+	drbd_md_sync(mdev);
+
+	/* Releasing the backing device is done in after_state_ch() */
+
+	if (eh == CallIOEHelper)
+		drbd_khelper(mdev, "local-io-error");
+
+	return ok;
+}
+
+/**
+ * cl_wide_st_chg:
+ * Returns TRUE if this state change should be preformed as a cluster wide
+ * transaction. Of course it returns 0 as soon as the connection is lost.
+ */
+STATIC int cl_wide_st_chg(struct drbd_conf *mdev,
+			  union drbd_state_t os, union drbd_state_t ns)
+{
+	return (os.conn >= Connected && ns.conn >= Connected &&
+		 ((os.role != Primary && ns.role == Primary) ||
+		  (os.conn != StartingSyncT && ns.conn == StartingSyncT) ||
+		  (os.conn != StartingSyncS && ns.conn == StartingSyncS) ||
+		  (os.disk != Diskless && ns.disk == Diskless))) ||
+		(os.conn >= Connected && ns.conn == Disconnecting) ||
+		(os.conn == Connected && ns.conn == VerifyS);
+}
+
+int drbd_change_state(struct drbd_conf *mdev, enum chg_state_flags f,
+		      union drbd_state_t mask, union drbd_state_t val)
+{
+	unsigned long flags;
+	union drbd_state_t os, ns;
+	int rv;
+
+	spin_lock_irqsave(&mdev->req_lock, flags);
+	os = mdev->state;
+	ns.i = (os.i & ~mask.i) | val.i;
+	rv = _drbd_set_state(mdev, ns, f, NULL);
+	ns = mdev->state;
+	spin_unlock_irqrestore(&mdev->req_lock, flags);
+
+	return rv;
+}
+
+void drbd_force_state(struct drbd_conf *mdev,
+	union drbd_state_t mask, union drbd_state_t val)
+{
+	drbd_change_state(mdev, ChgStateHard, mask, val);
+}
+
+int is_valid_state(struct drbd_conf *mdev, union drbd_state_t ns);
+int is_valid_state_transition(struct drbd_conf *,
+	union drbd_state_t, union drbd_state_t);
+int drbd_send_state_req(struct drbd_conf *,
+	union drbd_state_t, union drbd_state_t);
+
+STATIC enum set_st_err _req_st_cond(struct drbd_conf *mdev,
+				    union drbd_state_t mask, union drbd_state_t val)
+{
+	union drbd_state_t os, ns;
+	unsigned long flags;
+	int rv;
+
+	if (test_and_clear_bit(CL_ST_CHG_SUCCESS, &mdev->flags))
+		return SS_CW_Success;
+
+	if (test_and_clear_bit(CL_ST_CHG_FAIL, &mdev->flags))
+		return SS_CW_FailedByPeer;
+
+	rv = 0;
+	spin_lock_irqsave(&mdev->req_lock, flags);
+	os = mdev->state;
+	ns.i = (os.i & ~mask.i) | val.i;
+	if (!cl_wide_st_chg(mdev, os, ns))
+		rv = SS_CW_NoNeed;
+	if (!rv) {
+		rv = is_valid_state(mdev, ns);
+		if (rv == SS_Success) {
+			rv = is_valid_state_transition(mdev, ns, os);
+			if (rv == SS_Success)
+				rv = 0; /* cont waiting, otherwise fail. */
+		}
+	}
+	spin_unlock_irqrestore(&mdev->req_lock, flags);
+
+	return rv;
+}
+
+/**
+ * _drbd_request_state:
+ * This function is the most gracefull way to change state. For some state
+ * transition this function even does a cluster wide transaction.
+ * It has a cousin named drbd_request_state(), which is always verbose.
+ */
+STATIC int drbd_req_state(struct drbd_conf *mdev,
+			  union drbd_state_t mask, union drbd_state_t val,
+			  enum chg_state_flags f)
+{
+	struct completion done;
+	unsigned long flags;
+	union drbd_state_t os, ns;
+	int rv;
+
+	init_completion(&done);
+
+	if (f & ChgSerialize)
+		mutex_lock(&mdev->state_mutex);
+
+	spin_lock_irqsave(&mdev->req_lock, flags);
+	os = mdev->state;
+	ns.i = (os.i & ~mask.i) | val.i;
+
+	if (cl_wide_st_chg(mdev, os, ns)) {
+		rv = is_valid_state(mdev, ns);
+		if (rv == SS_Success)
+			rv = is_valid_state_transition(mdev, ns, os);
+		spin_unlock_irqrestore(&mdev->req_lock, flags);
+
+		if (rv < SS_Success) {
+			if (f & ChgStateVerbose)
+				print_st_err(mdev, os, ns, rv);
+			goto abort;
+		}
+
+		drbd_state_lock(mdev);
+		if (!drbd_send_state_req(mdev, mask, val)) {
+			drbd_state_unlock(mdev);
+			rv = SS_CW_FailedByPeer;
+			if (f & ChgStateVerbose)
+				print_st_err(mdev, os, ns, rv);
+			goto abort;
+		}
+
+		wait_event(mdev->state_wait,
+			(rv = _req_st_cond(mdev, mask, val)));
+
+		if (rv < SS_Success) {
+			/* nearly dead code. */
+			drbd_state_unlock(mdev);
+			if (f & ChgStateVerbose)
+				print_st_err(mdev, os, ns, rv);
+			goto abort;
+		}
+		spin_lock_irqsave(&mdev->req_lock, flags);
+		os = mdev->state;
+		ns.i = (os.i & ~mask.i) | val.i;
+		rv = _drbd_set_state(mdev, ns, f, &done);
+		drbd_state_unlock(mdev);
+	} else {
+		rv = _drbd_set_state(mdev, ns, f, &done);
+	}
+
+	spin_unlock_irqrestore(&mdev->req_lock, flags);
+
+	if (f & ChgWaitComplete && rv == SS_Success) {
+		D_ASSERT(current != mdev->worker.task);
+		wait_for_completion(&done);
+	}
+
+abort:
+	if (f & ChgSerialize)
+		mutex_unlock(&mdev->state_mutex);
+
+	return rv;
+}
+
+/**
+ * _drbd_request_state:
+ * This function is the most gracefull way to change state. For some state
+ * transition this function even does a cluster wide transaction.
+ * It has a cousin named drbd_request_state(), which is always verbose.
+ */
+int _drbd_request_state(struct drbd_conf *mdev,	union drbd_state_t mask,
+			union drbd_state_t val,	enum chg_state_flags f)
+{
+	int rv;
+
+	wait_event(mdev->state_wait,
+		   (rv = drbd_req_state(mdev, mask, val, f)) != SS_InTransientState);
+
+	return rv;
+}
+
+STATIC void print_st(struct drbd_conf *mdev, char *name, union drbd_state_t ns)
+{
+	ERR(" %s = { cs:%s ro:%s/%s ds:%s/%s %c%c%c%c }\n",
+	    name,
+	    conns_to_name(ns.conn),
+	    roles_to_name(ns.role),
+	    roles_to_name(ns.peer),
+	    disks_to_name(ns.disk),
+	    disks_to_name(ns.pdsk),
+	    ns.susp ? 's' : 'r',
+	    ns.aftr_isp ? 'a' : '-',
+	    ns.peer_isp ? 'p' : '-',
+	    ns.user_isp ? 'u' : '-'
+	    );
+}
+
+void print_st_err(struct drbd_conf *mdev,
+	union drbd_state_t os, union drbd_state_t ns, int err)
+{
+	if (err == SS_InTransientState)
+		return;
+	ERR("State change failed: %s\n", set_st_err_name(err));
+	print_st(mdev, " state", os);
+	print_st(mdev, "wanted", ns);
+}
+
+
+#define peers_to_name roles_to_name
+#define pdsks_to_name disks_to_name
+
+#define susps_to_name(A)     ((A) ? "1" : "0")
+#define aftr_isps_to_name(A) ((A) ? "1" : "0")
+#define peer_isps_to_name(A) ((A) ? "1" : "0")
+#define user_isps_to_name(A) ((A) ? "1" : "0")
+
+#define PSC(A) \
+	({ if (ns.A != os.A) { \
+		pbp += sprintf(pbp, #A "( %s -> %s ) ", \
+			      A##s_to_name(os.A), \
+			      A##s_to_name(ns.A)); \
+	} })
+
+int is_valid_state(struct drbd_conf *mdev, union drbd_state_t ns)
+{
+	/* See drbd_state_sw_errors in drbd_strings.c */
+
+	enum fencing_policy fp;
+	int rv = SS_Success;
+
+	fp = DontCare;
+	if (inc_local(mdev)) {
+		fp = mdev->bc->dc.fencing;
+		dec_local(mdev);
+	}
+
+	if (inc_net(mdev)) {
+		if (!mdev->net_conf->two_primaries &&
+		    ns.role == Primary && ns.peer == Primary)
+			rv = SS_TwoPrimaries;
+		dec_net(mdev);
+	}
+
+	if (rv <= 0)
+		/* already found a reason to abort */;
+	else if (ns.role == Secondary && mdev->open_cnt)
+		rv = SS_DeviceInUse;
+
+	else if (ns.role == Primary && ns.conn < Connected && ns.disk < UpToDate)
+		rv = SS_NoUpToDateDisk;
+
+	else if (fp >= Resource &&
+		 ns.role == Primary && ns.conn < Connected && ns.pdsk >= DUnknown)
+		rv = SS_PrimaryNOP;
+
+	else if (ns.role == Primary && ns.disk <= Inconsistent && ns.pdsk <= Inconsistent)
+		rv = SS_NoUpToDateDisk;
+
+	else if (ns.conn > Connected && ns.disk < UpToDate && ns.pdsk < UpToDate)
+		rv = SS_BothInconsistent;
+
+	else if (ns.conn > Connected && (ns.disk == Diskless || ns.pdsk == Diskless))
+		rv = SS_SyncingDiskless;
+
+	else if ((ns.conn == Connected ||
+		  ns.conn == WFBitMapS ||
+		  ns.conn == SyncSource ||
+		  ns.conn == PausedSyncS) &&
+		  ns.disk == Outdated)
+		rv = SS_ConnectedOutdates;
+
+	else if ((ns.conn == VerifyS || ns.conn == VerifyT) &&
+		 (mdev->sync_conf.verify_alg[0] == 0))
+		rv = SS_NoVerifyAlg;
+
+	else if ((ns.conn == VerifyS || ns.conn == VerifyT) &&
+		  mdev->agreed_pro_version < 88)
+		rv = SS_NotSupported;
+
+	return rv;
+}
+
+int is_valid_state_transition(struct drbd_conf *mdev,
+	union drbd_state_t ns, union drbd_state_t os)
+{
+	int rv = SS_Success;
+
+	if ((ns.conn == StartingSyncT || ns.conn == StartingSyncS) &&
+	    os.conn > Connected)
+		rv = SS_ResyncRunning;
+
+	if (ns.conn == Disconnecting && os.conn == StandAlone)
+		rv = SS_AlreadyStandAlone;
+
+	if (ns.disk > Attaching && os.disk == Diskless)
+		rv = SS_IsDiskLess;
+
+	if (ns.conn == WFConnection && os.conn < Unconnected)
+		rv = SS_NoNetConfig;
+
+	if (ns.disk == Outdated && os.disk < Outdated && os.disk != Attaching)
+		rv = SS_LowerThanOutdated;
+
+	if (ns.conn == Disconnecting && os.conn == Unconnected)
+		rv = SS_InTransientState;
+
+	if (ns.conn == os.conn && ns.conn == WFReportParams)
+		rv = SS_InTransientState;
+
+	if ((ns.conn == VerifyS || ns.conn == VerifyT) && os.conn < Connected)
+		rv = SS_NeedConnection;
+
+	if ((ns.conn == VerifyS || ns.conn == VerifyT) &&
+	    ns.conn != os.conn && os.conn > Connected)
+		rv = SS_ResyncRunning;
+
+	if ((ns.conn == StartingSyncS || ns.conn == StartingSyncT) &&
+	    os.conn < Connected)
+		rv = SS_NeedConnection;
+
+	return rv;
+}
+
+int __drbd_set_state(struct drbd_conf *mdev,
+		    union drbd_state_t ns, enum chg_state_flags flags,
+		    struct completion *done)
+{
+	union drbd_state_t os;
+	int rv = SS_Success;
+	int warn_sync_abort = 0;
+	enum fencing_policy fp;
+	struct after_state_chg_work *ascw;
+
+
+	os = mdev->state;
+
+	fp = DontCare;
+	if (inc_local(mdev)) {
+		fp = mdev->bc->dc.fencing;
+		dec_local(mdev);
+	}
+
+	/* Early state sanitising. */
+
+	/* Dissalow Network errors to configure a device's network part */
+	if ((ns.conn >= Timeout && ns.conn <= TearDown) &&
+	    os.conn <= Disconnecting)
+		ns.conn = os.conn;
+
+	/* After a network error (+TearDown) only Unconnected or Disconnecting can follow */
+	if (os.conn >= Timeout && os.conn <= TearDown &&
+	    ns.conn != Unconnected && ns.conn != Disconnecting)
+		ns.conn = os.conn;
+
+	/* After Disconnecting only StandAlone may follow */
+	if (os.conn == Disconnecting && ns.conn != StandAlone)
+		ns.conn = os.conn;
+
+	if (ns.conn < Connected) {
+		ns.peer_isp = 0;
+		ns.peer = Unknown;
+		if (ns.pdsk > DUnknown || ns.pdsk < Inconsistent)
+			ns.pdsk = DUnknown;
+	}
+
+	/* Clear the aftr_isp when becomming Unconfigured */
+	if (ns.conn == StandAlone && ns.disk == Diskless && ns.role == Secondary)
+		ns.aftr_isp = 0;
+
+	if (ns.conn <= Disconnecting && ns.disk == Diskless)
+		ns.pdsk = DUnknown;
+
+	if (os.conn > Connected && ns.conn > Connected &&
+	    (ns.disk <= Failed || ns.pdsk <= Failed)) {
+		warn_sync_abort = 1;
+		ns.conn = Connected;
+	}
+
+	if (ns.conn >= Connected &&
+	    ((ns.disk == Consistent || ns.disk == Outdated) ||
+	     (ns.disk == Negotiating && ns.conn == WFBitMapT))) {
+		switch (ns.conn) {
+		case WFBitMapT:
+		case PausedSyncT:
+			ns.disk = Outdated;
+			break;
+		case Connected:
+		case WFBitMapS:
+		case SyncSource:
+		case PausedSyncS:
+			ns.disk = UpToDate;
+			break;
+		case SyncTarget:
+			ns.disk = Inconsistent;
+			drbd_WARN("Implicit set disk state Inconsistent!\n");
+			break;
+		}
+		if (os.disk == Outdated && ns.disk == UpToDate)
+			drbd_WARN("Implicit set disk from Outdate to UpToDate\n");
+	}
+
+	if (ns.conn >= Connected &&
+	    (ns.pdsk == Consistent || ns.pdsk == Outdated)) {
+		switch (ns.conn) {
+		case Connected:
+		case WFBitMapT:
+		case PausedSyncT:
+		case SyncTarget:
+			ns.pdsk = UpToDate;
+			break;
+		case WFBitMapS:
+		case PausedSyncS:
+			ns.pdsk = Outdated;
+			break;
+		case SyncSource:
+			ns.pdsk = Inconsistent;
+			drbd_WARN("Implicit set pdsk Inconsistent!\n");
+			break;
+		}
+		if (os.pdsk == Outdated && ns.pdsk == UpToDate)
+			drbd_WARN("Implicit set pdsk from Outdate to UpToDate\n");
+	}
+
+	/* Connection breaks down before we finished "Negotiating" */
+	if (ns.conn < Connected && ns.disk == Negotiating &&
+	    inc_local_if_state(mdev, Negotiating)) {
+		if (mdev->ed_uuid == mdev->bc->md.uuid[Current]) {
+			ns.disk = mdev->new_state_tmp.disk;
+			ns.pdsk = mdev->new_state_tmp.pdsk;
+		} else {
+			ALERT("Connection lost while negotiating, no data!\n");
+			ns.disk = Diskless;
+			ns.pdsk = DUnknown;
+		}
+		dec_local(mdev);
+	}
+
+	if (fp == Stonith &&
+	    (ns.role == Primary &&
+	     ns.conn < Connected &&
+	     ns.pdsk > Outdated))
+			ns.susp = 1;
+
+	if (ns.aftr_isp || ns.peer_isp || ns.user_isp) {
+		if (ns.conn == SyncSource)
+			ns.conn = PausedSyncS;
+		if (ns.conn == SyncTarget)
+			ns.conn = PausedSyncT;
+	} else {
+		if (ns.conn == PausedSyncS)
+			ns.conn = SyncSource;
+		if (ns.conn == PausedSyncT)
+			ns.conn = SyncTarget;
+	}
+
+	if (ns.i == os.i)
+		return SS_NothingToDo;
+
+	if (!(flags & ChgStateHard)) {
+		/*  pre-state-change checks ; only look at ns  */
+		/* See drbd_state_sw_errors in drbd_strings.c */
+
+		rv = is_valid_state(mdev, ns);
+		if (rv < SS_Success) {
+			/* If the old state was illegal as well, then let
+			   this happen...*/
+
+			if (is_valid_state(mdev, os) == rv) {
+				ERR("Considering state change from bad state. "
+				    "Error would be: '%s'\n",
+				    set_st_err_name(rv));
+				print_st(mdev, "old", os);
+				print_st(mdev, "new", ns);
+				rv = is_valid_state_transition(mdev, ns, os);
+			}
+		} else
+			rv = is_valid_state_transition(mdev, ns, os);
+	}
+
+	if (rv < SS_Success) {
+		if (flags & ChgStateVerbose)
+			print_st_err(mdev, os, ns, rv);
+		return rv;
+	}
+
+	if (warn_sync_abort)
+		drbd_WARN("Resync aborted.\n");
+
+	{
+		char *pbp, pb[300];
+		pbp = pb;
+		*pbp = 0;
+		PSC(role);
+		PSC(peer);
+		PSC(conn);
+		PSC(disk);
+		PSC(pdsk);
+		PSC(susp);
+		PSC(aftr_isp);
+		PSC(peer_isp);
+		PSC(user_isp);
+		INFO("%s\n", pb);
+	}
+
+	mdev->state.i = ns.i;
+	wake_up(&mdev->misc_wait);
+	wake_up(&mdev->state_wait);
+
+	/**   post-state-change actions   **/
+	if (os.conn >= SyncSource   && ns.conn <= Connected) {
+		set_bit(STOP_SYNC_TIMER, &mdev->flags);
+		mod_timer(&mdev->resync_timer, jiffies);
+	}
+
+	if ((os.conn == PausedSyncT || os.conn == PausedSyncS) &&
+	    (ns.conn == SyncTarget  || ns.conn == SyncSource)) {
+		INFO("Syncer continues.\n");
+		mdev->rs_paused += (long)jiffies-(long)mdev->rs_mark_time;
+		if (ns.conn == SyncTarget) {
+			if (!test_and_clear_bit(STOP_SYNC_TIMER, &mdev->flags))
+				mod_timer(&mdev->resync_timer, jiffies);
+			/* This if (!test_bit) is only needed for the case
+			   that a device that has ceased to used its timer,
+			   i.e. it is already in drbd_resync_finished() gets
+			   paused and resumed. */
+		}
+	}
+
+	if ((os.conn == SyncTarget  || os.conn == SyncSource) &&
+	    (ns.conn == PausedSyncT || ns.conn == PausedSyncS)) {
+		INFO("Resync suspended\n");
+		mdev->rs_mark_time = jiffies;
+		if (ns.conn == PausedSyncT)
+			set_bit(STOP_SYNC_TIMER, &mdev->flags);
+	}
+
+	if (os.conn == Connected &&
+	    (ns.conn == VerifyS || ns.conn == VerifyT)) {
+		mdev->ov_position = 0;
+		mdev->ov_left  =
+		mdev->rs_total =
+		mdev->rs_mark_left = drbd_bm_bits(mdev);
+		mdev->rs_start     =
+		mdev->rs_mark_time = jiffies;
+		mdev->ov_last_oos_size = 0;
+		mdev->ov_last_oos_start = 0;
+
+		if (ns.conn == VerifyS)
+			mod_timer(&mdev->resync_timer, jiffies);
+	}
+
+	if (inc_local(mdev)) {
+		u32 mdf = mdev->bc->md.flags & ~(MDF_Consistent|MDF_PrimaryInd|
+						 MDF_ConnectedInd|MDF_WasUpToDate|
+						 MDF_PeerOutDated|MDF_CrashedPrimary);
+
+		if (test_bit(CRASHED_PRIMARY, &mdev->flags))
+			mdf |= MDF_CrashedPrimary;
+		if (mdev->state.role == Primary ||
+		    (mdev->state.pdsk < Inconsistent && mdev->state.peer == Primary))
+			mdf |= MDF_PrimaryInd;
+		if (mdev->state.conn > WFReportParams)
+			mdf |= MDF_ConnectedInd;
+		if (mdev->state.disk > Inconsistent)
+			mdf |= MDF_Consistent;
+		if (mdev->state.disk > Outdated)
+			mdf |= MDF_WasUpToDate;
+		if (mdev->state.pdsk <= Outdated && mdev->state.pdsk >= Inconsistent)
+			mdf |= MDF_PeerOutDated;
+		if (mdf != mdev->bc->md.flags) {
+			mdev->bc->md.flags = mdf;
+			drbd_md_mark_dirty(mdev);
+		}
+		if (os.disk < Consistent && ns.disk >= Consistent)
+			drbd_set_ed_uuid(mdev, mdev->bc->md.uuid[Current]);
+		dec_local(mdev);
+	}
+
+	/* Peer was forced UpToDate & Primary, consider to resync */
+	if (os.disk == Inconsistent && os.pdsk == Inconsistent &&
+	    os.peer == Secondary && ns.peer == Primary)
+		set_bit(CONSIDER_RESYNC, &mdev->flags);
+
+	/* Receiver should clean up itself */
+	if (os.conn != Disconnecting && ns.conn == Disconnecting)
+		drbd_thread_stop_nowait(&mdev->receiver);
+
+	/* Now the receiver finished cleaning up itself, it should die */
+	if (os.conn != StandAlone && ns.conn == StandAlone)
+		drbd_thread_stop_nowait(&mdev->receiver);
+
+	/* Upon network failure, we need to restart the receiver. */
+	if (os.conn > TearDown &&
+	    ns.conn <= TearDown && ns.conn >= Timeout)
+		drbd_thread_restart_nowait(&mdev->receiver);
+
+	ascw = kmalloc(sizeof(*ascw), GFP_ATOMIC);
+	if (ascw) {
+		ascw->os = os;
+		ascw->ns = ns;
+		ascw->flags = flags;
+		ascw->w.cb = w_after_state_ch;
+		ascw->done = done;
+		drbd_queue_work(&mdev->data.work, &ascw->w);
+	} else {
+		drbd_WARN("Could not kmalloc an ascw\n");
+	}
+
+	return rv;
+}
+
+STATIC int w_after_state_ch(struct drbd_conf *mdev, struct drbd_work *w, int unused)
+{
+	struct after_state_chg_work *ascw;
+
+	ascw = (struct after_state_chg_work *) w;
+	after_state_ch(mdev, ascw->os, ascw->ns, ascw->flags);
+	if (ascw->flags & ChgWaitComplete) {
+		D_ASSERT(ascw->done != NULL);
+		complete(ascw->done);
+	}
+	kfree(ascw);
+
+	return 1;
+}
+
+static void abw_start_sync(struct drbd_conf *mdev, int rv)
+{
+	if (rv) {
+		ERR("Writing the bitmap failed not starting resync.\n");
+		_drbd_request_state(mdev, NS(conn, Connected), ChgStateVerbose);
+		return;
+	}
+
+	switch (mdev->state.conn) {
+	case StartingSyncT:
+		_drbd_request_state(mdev, NS(conn, WFSyncUUID), ChgStateVerbose);
+		break;
+	case StartingSyncS:
+		drbd_start_resync(mdev, SyncSource);
+		break;
+	}
+}
+
+STATIC void after_state_ch(struct drbd_conf *mdev, union drbd_state_t os,
+			   union drbd_state_t ns, enum chg_state_flags flags)
+{
+	enum fencing_policy fp;
+
+	if (os.conn != Connected && ns.conn == Connected) {
+		clear_bit(CRASHED_PRIMARY, &mdev->flags);
+		if (mdev->p_uuid)
+			mdev->p_uuid[UUID_FLAGS] &= ~((u64)2);
+	}
+
+	fp = DontCare;
+	if (inc_local(mdev)) {
+		fp = mdev->bc->dc.fencing;
+		dec_local(mdev);
+	}
+
+	/* Inform userspace about the change... */
+	drbd_bcast_state(mdev, ns);
+
+	if (!(os.role == Primary && os.disk < UpToDate && os.pdsk < UpToDate) &&
+	    (ns.role == Primary && ns.disk < UpToDate && ns.pdsk < UpToDate))
+		drbd_khelper(mdev, "pri-on-incon-degr");
+
+	/* Here we have the actions that are performed after a
+	   state change. This function might sleep */
+
+	if (fp == Stonith && ns.susp) {
+		/* case1: The outdate peer handler is successfull:
+		 * case2: The connection was established again: */
+		if ((os.pdsk > Outdated  && ns.pdsk <= Outdated) ||
+		    (os.conn < Connected && ns.conn >= Connected)) {
+			tl_clear(mdev);
+			spin_lock_irq(&mdev->req_lock);
+			_drbd_set_state(_NS(mdev, susp, 0), ChgStateVerbose, NULL);
+			spin_unlock_irq(&mdev->req_lock);
+		}
+	}
+	/* Do not change the order of the if above and the two below... */
+	if (os.pdsk == Diskless && ns.pdsk > Diskless) {      /* attach on the peer */
+		drbd_send_uuids(mdev);
+		drbd_send_state(mdev);
+	}
+	if (os.conn != WFBitMapS && ns.conn == WFBitMapS)
+		drbd_queue_bitmap_io(mdev, &drbd_send_bitmap, NULL, "send_bitmap (WFBitMapS)");
+
+	/* Lost contact to peer's copy of the data */
+	if ((os.pdsk >= Inconsistent &&
+	     os.pdsk != DUnknown &&
+	     os.pdsk != Outdated)
+	&&  (ns.pdsk < Inconsistent ||
+	     ns.pdsk == DUnknown ||
+	     ns.pdsk == Outdated)) {
+		kfree(mdev->p_uuid);
+		mdev->p_uuid = NULL;
+		if (inc_local(mdev)) {
+			if ((ns.role == Primary || ns.peer == Primary) &&
+			    mdev->bc->md.uuid[Bitmap] == 0 && ns.disk >= UpToDate) {
+				drbd_uuid_new_current(mdev);
+				drbd_send_uuids(mdev);
+			}
+			dec_local(mdev);
+		}
+	}
+
+	if (ns.pdsk < Inconsistent && inc_local(mdev)) {
+		if (ns.peer == Primary && mdev->bc->md.uuid[Bitmap] == 0)
+			drbd_uuid_new_current(mdev);
+
+		/* Diskless Peer becomes secondary */
+		if (os.peer == Primary && ns.peer == Secondary)
+			drbd_al_to_on_disk_bm(mdev);
+		dec_local(mdev);
+	}
+
+	/* Last part of the attaching process ... */
+	if (ns.conn >= Connected &&
+	    os.disk == Attaching && ns.disk == Negotiating) {
+		kfree(mdev->p_uuid); /* We expect to receive up-to-date UUIDs soon. */
+		mdev->p_uuid = NULL; /* ...to not use the old ones in the mean time */
+		drbd_send_sizes(mdev);  /* to start sync... */
+		drbd_send_uuids(mdev);
+		drbd_send_state(mdev);
+	}
+
+	/* We want to pause/continue resync, tell peer. */
+	if (ns.conn >= Connected &&
+	     ((os.aftr_isp != ns.aftr_isp) ||
+	      (os.user_isp != ns.user_isp)))
+		drbd_send_state(mdev);
+
+	/* In case one of the isp bits got set, suspend other devices. */
+	if ((!os.aftr_isp && !os.peer_isp && !os.user_isp) &&
+	    (ns.aftr_isp || ns.peer_isp || ns.user_isp))
+		suspend_other_sg(mdev);
+
+	/* Make sure the peer gets informed about eventual state
+	   changes (ISP bits) while we were in WFReportParams. */
+	if (os.conn == WFReportParams && ns.conn >= Connected)
+		drbd_send_state(mdev);
+
+	/* We are in the progress to start a full sync... */
+	if ((os.conn != StartingSyncT && ns.conn == StartingSyncT) ||
+	    (os.conn != StartingSyncS && ns.conn == StartingSyncS))
+		drbd_queue_bitmap_io(mdev, &drbd_bmio_set_n_write, &abw_start_sync, "set_n_write from StartingSync");
+
+	/* We are invalidating our self... */
+	if (os.conn < Connected && ns.conn < Connected &&
+	    os.disk > Inconsistent && ns.disk == Inconsistent)
+		drbd_queue_bitmap_io(mdev, &drbd_bmio_set_n_write, NULL, "set_n_write from invalidate");
+
+	if (os.disk > Diskless && ns.disk == Diskless) {
+		/* since inc_local() only works as long as disk>=Inconsistent,
+		   and it is Diskless here, local_cnt can only go down, it can
+		   not increase... It will reach zero */
+		wait_event(mdev->misc_wait, !atomic_read(&mdev->local_cnt));
+
+		lc_free(mdev->resync);
+		mdev->resync = NULL;
+		lc_free(mdev->act_log);
+		mdev->act_log = NULL;
+		__no_warn(local, drbd_free_bc(mdev->bc););
+		wmb(); /* see begin of drbd_nl_disk_conf() */
+		__no_warn(local, mdev->bc = NULL;);
+
+		if (mdev->md_io_tmpp)
+			__free_page(mdev->md_io_tmpp);
+	}
+
+	/* Disks got bigger while they were detached */
+	if (ns.disk > Negotiating && ns.pdsk > Negotiating &&
+	    test_and_clear_bit(RESYNC_AFTER_NEG, &mdev->flags)) {
+		if (ns.conn == Connected)
+			resync_after_online_grow(mdev);
+	}
+
+	/* A resync finished or aborted, wake paused devices... */
+	if ((os.conn > Connected && ns.conn <= Connected) ||
+	    (os.peer_isp && !ns.peer_isp) ||
+	    (os.user_isp && !ns.user_isp))
+		resume_next_sg(mdev);
+
+	/* Upon network connection, we need to start the received */
+	if (os.conn == StandAlone && ns.conn == Unconnected)
+		drbd_thread_start(&mdev->receiver);
+
+	/* Terminate worker thread if we are unconfigured - it will be
+	   restarted as needed... */
+	if (ns.disk == Diskless && ns.conn == StandAlone && ns.role == Secondary) {
+		if (os.aftr_isp != ns.aftr_isp)
+			resume_next_sg(mdev);
+		drbd_thread_stop_nowait(&mdev->worker);
+	}
+
+	drbd_md_sync(mdev);
+}
+
+
+STATIC int drbd_thread_setup(void *arg)
+{
+	struct Drbd_thread *thi = (struct Drbd_thread *) arg;
+	struct drbd_conf *mdev = thi->mdev;
+	int retval;
+
+restart:
+	retval = thi->function(thi);
+
+	spin_lock(&thi->t_lock);
+
+	/* if the receiver has been "Exiting", the last thing it did
+	 * was set the conn state to "StandAlone",
+	 * if now a re-connect request comes in, conn state goes Unconnected,
+	 * and receiver thread will be "started".
+	 * drbd_thread_start needs to set "Restarting" in that case.
+	 * t_state check and assignement needs to be within the same spinlock,
+	 * so either thread_start sees Exiting, and can remap to Restarting,
+	 * or thread_start see None, and can proceed as normal.
+	 */
+
+	if (thi->t_state == Restarting) {
+		INFO("Restarting %s\n", current->comm);
+		thi->t_state = Running;
+		spin_unlock(&thi->t_lock);
+		goto restart;
+	}
+
+	thi->task = NULL;
+	thi->t_state = None;
+	smp_mb();
+	complete(&thi->stop);
+	spin_unlock(&thi->t_lock);
+
+	INFO("Terminating %s\n", current->comm);
+
+	/* Release mod reference taken when thread was started */
+	module_put(THIS_MODULE);
+	return retval;
+}
+
+STATIC void drbd_thread_init(struct drbd_conf *mdev, struct Drbd_thread *thi,
+		      int (*func) (struct Drbd_thread *))
+{
+	spin_lock_init(&thi->t_lock);
+	thi->task    = NULL;
+	thi->t_state = None;
+	thi->function = func;
+	thi->mdev = mdev;
+}
+
+int drbd_thread_start(struct Drbd_thread *thi)
+{
+	struct drbd_conf *mdev = thi->mdev;
+	struct task_struct *nt;
+	const char *me =
+		thi == &mdev->receiver ? "receiver" :
+		thi == &mdev->asender  ? "asender"  :
+		thi == &mdev->worker   ? "worker"   : "NONSENSE";
+
+	spin_lock(&thi->t_lock);
+	switch (thi->t_state) {
+	case None:
+		INFO("Starting %s thread (from %s [%d])\n",
+				me, current->comm, current->pid);
+
+		/* Get ref on module for thread - this is released when thread exits */
+		if (!try_module_get(THIS_MODULE)) {
+			ERR("Failed to get module reference in drbd_thread_start\n");
+			spin_unlock(&thi->t_lock);
+			return FALSE;
+		}
+
+		D_ASSERT(thi->task == NULL);
+		thi->reset_cpu_mask = 1;
+		thi->t_state = Running;
+		spin_unlock(&thi->t_lock);
+		flush_signals(current); /* otherw. may get -ERESTARTNOINTR */
+
+		nt = kthread_create(drbd_thread_setup, (void *) thi,
+				    "drbd%d_%s", mdev_to_minor(mdev), me);
+
+		if (IS_ERR(nt)) {
+			ERR("Couldn't start thread\n");
+
+			module_put(THIS_MODULE);
+			return FALSE;
+		}
+		spin_lock(&thi->t_lock);
+		thi->task = nt;
+		thi->t_state = Running;
+		spin_unlock(&thi->t_lock);
+		wake_up_process(nt);
+		break;
+	case Exiting:
+		thi->t_state = Restarting;
+		INFO("Restarting %s thread (from %s [%d])\n",
+				me, current->comm, current->pid);
+	case Running:
+	case Restarting:
+	default:
+		spin_unlock(&thi->t_lock);
+		break;
+	}
+
+	return TRUE;
+}
+
+
+void _drbd_thread_stop(struct Drbd_thread *thi, int restart, int wait)
+{
+	enum Drbd_thread_state ns = restart ? Restarting : Exiting;
+
+	spin_lock(&thi->t_lock);
+
+	if (thi->t_state == None) {
+		spin_unlock(&thi->t_lock);
+		if (restart)
+			drbd_thread_start(thi);
+		return;
+	}
+
+	if (thi->t_state != ns) {
+		if (thi->task == NULL) {
+			spin_unlock(&thi->t_lock);
+			return;
+		}
+
+		thi->t_state = ns;
+		smp_mb();
+		init_completion(&thi->stop);
+		if (thi->task != current)
+			force_sig(DRBD_SIGKILL, thi->task);
+
+	}
+
+	spin_unlock(&thi->t_lock);
+
+	if (wait) {
+		wait_for_completion(&thi->stop);
+	}
+}
+
+#ifdef CONFIG_SMP
+/**
+ * drbd_calc_cpu_mask: Generates CPU masks, sprad over all CPUs.
+ * Forces all threads of a device onto the same CPU. This is benificial for
+ * DRBD's performance. May be overwritten by user's configuration.
+ */
+cpumask_t drbd_calc_cpu_mask(struct drbd_conf *mdev)
+{
+	int sv, cpu;
+	cpumask_t av_cpu_m;
+
+	if (cpus_weight(mdev->cpu_mask))
+		return mdev->cpu_mask;
+
+	av_cpu_m = cpu_online_map;
+	sv = mdev_to_minor(mdev) % cpus_weight(av_cpu_m);
+
+	for_each_cpu_mask(cpu, av_cpu_m) {
+		if (sv-- == 0)
+			return cpumask_of_cpu(cpu);
+	}
+
+	/* some kernel versions "forget" to add the (cpumask_t) typecast
+	 * to that macro, which results in "parse error before '{'" ;-> */
+	return (cpumask_t) CPU_MASK_ALL; /* Never reached. */
+}
+
+/* modifies the cpu mask of the _current_ thread,
+ * call in the "main loop" of _all_ threads.
+ * no need for any mutex, current won't die prematurely.
+ */
+void drbd_thread_current_set_cpu(struct drbd_conf *mdev)
+{
+	struct task_struct *p = current;
+	struct Drbd_thread *thi =
+		p == mdev->asender.task  ? &mdev->asender  :
+		p == mdev->receiver.task ? &mdev->receiver :
+		p == mdev->worker.task   ? &mdev->worker   :
+		NULL;
+	ERR_IF(thi == NULL)
+		return;
+	if (!thi->reset_cpu_mask)
+		return;
+	thi->reset_cpu_mask = 0;
+	/* preempt_disable();
+	   Thas was a kernel that warned about a call to smp_processor_id() while preemt
+	   was not disabled. It seems that this was fixed in manline. */
+	set_cpus_allowed(p, mdev->cpu_mask);
+	/* preempt_enable(); */
+}
+#endif
+
+/* the appropriate socket mutex must be held already */
+int _drbd_send_cmd(struct drbd_conf *mdev, struct socket *sock,
+			  enum Drbd_Packet_Cmd cmd, struct Drbd_Header *h,
+			  size_t size, unsigned msg_flags)
+{
+	int sent, ok;
+
+	ERR_IF(!h) return FALSE;
+	ERR_IF(!size) return FALSE;
+
+	h->magic   = BE_DRBD_MAGIC;
+	h->command = cpu_to_be16(cmd);
+	h->length  = cpu_to_be16(size-sizeof(struct Drbd_Header));
+
+	dump_packet(mdev, sock, 0, (void *)h, __FILE__, __LINE__);
+	sent = drbd_send(mdev, sock, h, size, msg_flags);
+
+	ok = (sent == size);
+	if (!ok)
+		ERR("short sent %s size=%d sent=%d\n",
+		    cmdname(cmd), (int)size, sent);
+	return ok;
+}
+
+/* don't pass the socket. we may only look at it
+ * when we hold the appropriate socket mutex.
+ */
+int drbd_send_cmd(struct drbd_conf *mdev, int use_data_socket,
+		  enum Drbd_Packet_Cmd cmd, struct Drbd_Header *h, size_t size)
+{
+	int ok = 0;
+	struct socket *sock;
+
+	if (use_data_socket) {
+		mutex_lock(&mdev->data.mutex);
+		sock = mdev->data.socket;
+	} else {
+		mutex_lock(&mdev->meta.mutex);
+		sock = mdev->meta.socket;
+	}
+
+	/* drbd_disconnect() could have called drbd_free_sock()
+	 * while we were waiting in down()... */
+	if (likely(sock != NULL))
+		ok = _drbd_send_cmd(mdev, sock, cmd, h, size, 0);
+
+	if (use_data_socket)
+		mutex_unlock(&mdev->data.mutex);
+	else
+		mutex_unlock(&mdev->meta.mutex);
+	return ok;
+}
+
+int drbd_send_cmd2(struct drbd_conf *mdev, enum Drbd_Packet_Cmd cmd, char *data,
+		   size_t size)
+{
+	struct Drbd_Header h;
+	int ok;
+
+	h.magic   = BE_DRBD_MAGIC;
+	h.command = cpu_to_be16(cmd);
+	h.length  = cpu_to_be16(size);
+
+	if (!drbd_get_data_sock(mdev))
+		return 0;
+
+	dump_packet(mdev, mdev->data.socket, 0, (void *)&h, __FILE__, __LINE__);
+
+	ok = (sizeof(h) ==
+		drbd_send(mdev, mdev->data.socket, &h, sizeof(h), 0));
+	ok = ok && (size ==
+		drbd_send(mdev, mdev->data.socket, data, size, 0));
+
+	drbd_put_data_sock(mdev);
+
+	return ok;
+}
+
+int drbd_send_sync_param(struct drbd_conf *mdev, struct syncer_conf *sc)
+{
+	struct Drbd_SyncParam89_Packet *p;
+	struct socket *sock;
+	int size, rv;
+	const int apv = mdev->agreed_pro_version;
+
+	size = apv <= 87 ? sizeof(struct Drbd_SyncParam_Packet)
+		: apv == 88 ? sizeof(struct Drbd_SyncParam_Packet)
+			+ strlen(mdev->sync_conf.verify_alg) + 1
+		: /* 89 */    sizeof(struct Drbd_SyncParam89_Packet);
+
+	/* used from admin command context and receiver/worker context.
+	 * to avoid kmalloc, grab the socket right here,
+	 * then use the pre-allocated sbuf there */
+	mutex_lock(&mdev->data.mutex);
+	sock = mdev->data.socket;
+
+	if (likely(sock != NULL)) {
+		enum Drbd_Packet_Cmd cmd = apv >= 89 ? SyncParam89 : SyncParam;
+
+		p = &mdev->data.sbuf.SyncParam89;
+
+		/* initialize verify_alg and csums_alg */
+		memset(p->verify_alg, 0, 2 * SHARED_SECRET_MAX);
+
+		p->rate = cpu_to_be32(sc->rate);
+
+		if (apv >= 88)
+			strcpy(p->verify_alg, mdev->sync_conf.verify_alg);
+		if (apv >= 89)
+			strcpy(p->csums_alg, mdev->sync_conf.csums_alg);
+
+		rv = _drbd_send_cmd(mdev, sock, cmd, &p->head, size, 0);
+	} else
+		rv = 0; /* not ok */
+
+	mutex_unlock(&mdev->data.mutex);
+
+	return rv;
+}
+
+int drbd_send_protocol(struct drbd_conf *mdev)
+{
+	struct Drbd_Protocol_Packet *p;
+	int size, rv;
+
+	size = sizeof(struct Drbd_Protocol_Packet);
+
+	if (mdev->agreed_pro_version >= 87)
+		size += strlen(mdev->net_conf->integrity_alg) + 1;
+
+	p = kmalloc(size, GFP_KERNEL);
+	if (p == NULL)
+		return 0;
+
+	p->protocol      = cpu_to_be32(mdev->net_conf->wire_protocol);
+	p->after_sb_0p   = cpu_to_be32(mdev->net_conf->after_sb_0p);
+	p->after_sb_1p   = cpu_to_be32(mdev->net_conf->after_sb_1p);
+	p->after_sb_2p   = cpu_to_be32(mdev->net_conf->after_sb_2p);
+	p->want_lose     = cpu_to_be32(mdev->net_conf->want_lose);
+	p->two_primaries = cpu_to_be32(mdev->net_conf->two_primaries);
+
+	if (mdev->agreed_pro_version >= 87)
+		strcpy(p->integrity_alg, mdev->net_conf->integrity_alg);
+
+	rv = drbd_send_cmd(mdev, USE_DATA_SOCKET, ReportProtocol,
+			   (struct Drbd_Header *)p, size);
+	kfree(p);
+	return rv;
+}
+
+int drbd_send_uuids(struct drbd_conf *mdev)
+{
+	struct Drbd_GenCnt_Packet p;
+	int i;
+
+	u64 uuid_flags = 0;
+
+	if (!inc_local_if_state(mdev, Negotiating))
+		return 1;
+
+	for (i = Current; i < UUID_SIZE; i++)
+		p.uuid[i] = mdev->bc ? cpu_to_be64(mdev->bc->md.uuid[i]) : 0;
+
+	mdev->comm_bm_set = drbd_bm_total_weight(mdev);
+	p.uuid[UUID_SIZE] = cpu_to_be64(mdev->comm_bm_set);
+	uuid_flags |= mdev->net_conf->want_lose ? 1 : 0;
+	uuid_flags |= test_bit(CRASHED_PRIMARY, &mdev->flags) ? 2 : 0;
+	uuid_flags |= mdev->new_state_tmp.disk == Inconsistent ? 4 : 0;
+	p.uuid[UUID_FLAGS] = cpu_to_be64(uuid_flags);
+
+	dec_local(mdev);
+
+	return drbd_send_cmd(mdev, USE_DATA_SOCKET, ReportUUIDs,
+			     (struct Drbd_Header *)&p, sizeof(p));
+}
+
+int drbd_send_sync_uuid(struct drbd_conf *mdev, u64 val)
+{
+	struct Drbd_SyncUUID_Packet p;
+
+	p.uuid = cpu_to_be64(val);
+
+	return drbd_send_cmd(mdev, USE_DATA_SOCKET, ReportSyncUUID,
+			     (struct Drbd_Header *)&p, sizeof(p));
+}
+
+int drbd_send_sizes(struct drbd_conf *mdev)
+{
+	struct Drbd_Sizes_Packet p;
+	sector_t d_size, u_size;
+	int q_order_type;
+	int ok;
+
+	if (inc_local_if_state(mdev, Negotiating)) {
+		D_ASSERT(mdev->bc->backing_bdev);
+		d_size = drbd_get_max_capacity(mdev->bc);
+		u_size = mdev->bc->dc.disk_size;
+		q_order_type = drbd_queue_order_type(mdev);
+		p.queue_order_type = cpu_to_be32(drbd_queue_order_type(mdev));
+		dec_local(mdev);
+	} else {
+		d_size = 0;
+		u_size = 0;
+		q_order_type = QUEUE_ORDERED_NONE;
+	}
+
+	p.d_size = cpu_to_be64(d_size);
+	p.u_size = cpu_to_be64(u_size);
+	p.c_size = cpu_to_be64(drbd_get_capacity(mdev->this_bdev));
+	p.max_segment_size = cpu_to_be32(queue_max_segment_size(mdev->rq_queue));
+	p.queue_order_type = cpu_to_be32(q_order_type);
+
+	ok = drbd_send_cmd(mdev, USE_DATA_SOCKET, ReportSizes,
+			   (struct Drbd_Header *)&p, sizeof(p));
+	return ok;
+}
+
+/**
+ * drbd_send_state:
+ * Informs the peer about our state. Only call it when
+ * mdev->state.conn >= Connected (I.e. you may not call it while in
+ * WFReportParams. Though there is one valid and necessary exception,
+ * drbd_connect() calls drbd_send_state() while in it WFReportParams.
+ */
+int drbd_send_state(struct drbd_conf *mdev)
+{
+	struct socket *sock;
+	struct Drbd_State_Packet p;
+	int ok = 0;
+
+	/* Grab state lock so we wont send state if we're in the middle
+	 * of a cluster wide state change on another thread */
+	drbd_state_lock(mdev);
+
+	mutex_lock(&mdev->data.mutex);
+
+	p.state = cpu_to_be32(mdev->state.i); /* Within the send mutex */
+	sock = mdev->data.socket;
+
+	if (likely(sock != NULL)) {
+		ok = _drbd_send_cmd(mdev, sock, ReportState,
+				    (struct Drbd_Header *)&p, sizeof(p), 0);
+	}
+
+	mutex_unlock(&mdev->data.mutex);
+
+	drbd_state_unlock(mdev);
+	return ok;
+}
+
+int drbd_send_state_req(struct drbd_conf *mdev,
+	union drbd_state_t mask, union drbd_state_t val)
+{
+	struct Drbd_Req_State_Packet p;
+
+	p.mask    = cpu_to_be32(mask.i);
+	p.val     = cpu_to_be32(val.i);
+
+	return drbd_send_cmd(mdev, USE_DATA_SOCKET, StateChgRequest,
+			     (struct Drbd_Header *)&p, sizeof(p));
+}
+
+int drbd_send_sr_reply(struct drbd_conf *mdev, int retcode)
+{
+	struct Drbd_RqS_Reply_Packet p;
+
+	p.retcode    = cpu_to_be32(retcode);
+
+	return drbd_send_cmd(mdev, USE_META_SOCKET, StateChgReply,
+			     (struct Drbd_Header *)&p, sizeof(p));
+}
+
+/* returns
+ * positive: number of payload bytes needed in this packet.
+ * zero: incompressible.  */
+int fill_bitmap_rle_bytes(struct drbd_conf *mdev,
+	struct Drbd_Compressed_Bitmap_Packet *p,
+	struct bm_xfer_ctx *c)
+{
+	unsigned long plain_bits;
+	unsigned long tmp;
+	unsigned long rl;
+	void *buffer;
+	unsigned n;
+	unsigned len;
+	unsigned toggle;
+
+	/* may we use this feature? */
+	if ((mdev->sync_conf.use_rle_encoding == 0) ||
+		(mdev->agreed_pro_version < 90))
+			return 0;
+
+	if (c->bit_offset >= c->bm_bits)
+		return 0; /* nothing to do. */
+
+	/* use at most thus many bytes */
+	len = BM_PACKET_VLI_BYTES_MAX;
+	buffer = p->code;
+	/* plain bits covered in this code string */
+	plain_bits = 0;
+
+	/* p->encoding & 0x80 stores whether the first
+	 * run length is set.
+	 * bit offset is implicit.
+	 * start with toggle == 2 to be able to tell the first iteration */
+	toggle = 2;
+
+	/* see how much plain bits we can stuff into one packet
+	 * using RLE and VLI. */
+	do {
+		tmp = (toggle == 0) ? _drbd_bm_find_next_zero(mdev, c->bit_offset)
+				    : _drbd_bm_find_next(mdev, c->bit_offset);
+		if (tmp == -1UL)
+			tmp = c->bm_bits;
+		rl = tmp - c->bit_offset;
+
+		if (toggle == 2) { /* first iteration */
+			if (rl == 0) {
+				/* the first checked bit was set,
+				 * store start value, */
+				DCBP_set_start(p, 1);
+				/* but skip encoding of zero run length */
+				toggle = !toggle;
+				continue;
+			}
+			DCBP_set_start(p, 0);
+		}
+
+		/* paranoia: catch zero runlength.
+		 * can only happen if bitmap is modified while we scan it. */
+		if (rl == 0) {
+			ERR("unexpected zero runlength while encoding bitmap "
+			    "t:%u bo:%lu\n", toggle, c->bit_offset);
+			return -1;
+		}
+
+		n = vli_encode_bytes(buffer, rl, len);
+		if (n == 0) /* buffer full */
+			break;
+
+		toggle = !toggle;
+		buffer += n;
+		len -= n;
+		plain_bits += rl;
+		c->bit_offset = tmp;
+	} while (len && c->bit_offset < c->bm_bits);
+
+	len = BM_PACKET_VLI_BYTES_MAX - len;
+
+	if (plain_bits < (len << 3)) {
+		/* incompressible with this method.
+		 * we need to rewind both word and bit position. */
+		c->bit_offset -= plain_bits;
+		bm_xfer_ctx_bit_to_word_offset(c);
+		c->bit_offset = c->word_offset * BITS_PER_LONG;
+		return 0;
+	}
+
+	/* RLE + VLI was able to compress it just fine.
+	 * update c->word_offset. */
+	bm_xfer_ctx_bit_to_word_offset(c);
+
+	/* store pad_bits */
+	DCBP_set_pad_bits(p, 0);
+
+	return len;
+}
+
+int fill_bitmap_rle_bits(struct drbd_conf *mdev,
+	struct Drbd_Compressed_Bitmap_Packet *p,
+	struct bm_xfer_ctx *c)
+{
+	struct bitstream bs;
+	unsigned long plain_bits;
+	unsigned long tmp;
+	unsigned long rl;
+	unsigned len;
+	unsigned toggle;
+	int bits;
+
+	/* may we use this feature? */
+	if ((mdev->sync_conf.use_rle_encoding == 0) ||
+		(mdev->agreed_pro_version < 90))
+			return 0;
+
+	if (c->bit_offset >= c->bm_bits)
+		return 0; /* nothing to do. */
+
+	/* use at most thus many bytes */
+	bitstream_init(&bs, p->code, BM_PACKET_VLI_BYTES_MAX, 0);
+	memset(p->code, 0, BM_PACKET_VLI_BYTES_MAX);
+	/* plain bits covered in this code string */
+	plain_bits = 0;
+
+	/* p->encoding & 0x80 stores whether the first
+	 * run length is set.
+	 * bit offset is implicit.
+	 * start with toggle == 2 to be able to tell the first iteration */
+	toggle = 2;
+
+	/* see how much plain bits we can stuff into one packet
+	 * using RLE and VLI. */
+	do {
+		tmp = (toggle == 0) ? _drbd_bm_find_next_zero(mdev, c->bit_offset)
+				    : _drbd_bm_find_next(mdev, c->bit_offset);
+		if (tmp == -1UL)
+			tmp = c->bm_bits;
+		rl = tmp - c->bit_offset;
+
+		if (toggle == 2) { /* first iteration */
+			if (rl == 0) {
+				/* the first checked bit was set,
+				 * store start value, */
+				DCBP_set_start(p, 1);
+				/* but skip encoding of zero run length */
+				toggle = !toggle;
+				continue;
+			}
+			DCBP_set_start(p, 0);
+		}
+
+		/* paranoia: catch zero runlength.
+		 * can only happen if bitmap is modified while we scan it. */
+		if (rl == 0) {
+			ERR("unexpected zero runlength while encoding bitmap "
+			    "t:%u bo:%lu\n", toggle, c->bit_offset);
+			return -1;
+		}
+
+		bits = vli_encode_bits(&bs, rl);
+		if (bits == -ENOBUFS) /* buffer full */
+			break;
+		if (bits <= 0) {
+			ERR("error while encoding bitmap: %d\n", bits);
+			return 0;
+		}
+
+		toggle = !toggle;
+		plain_bits += rl;
+		c->bit_offset = tmp;
+	} while (c->bit_offset < c->bm_bits);
+
+	len = bs.cur.b - p->code + !!bs.cur.bit;
+
+	if (plain_bits < (len << 3)) {
+		/* incompressible with this method.
+		 * we need to rewind both word and bit position. */
+		c->bit_offset -= plain_bits;
+		bm_xfer_ctx_bit_to_word_offset(c);
+		c->bit_offset = c->word_offset * BITS_PER_LONG;
+		return 0;
+	}
+
+	/* RLE + VLI was able to compress it just fine.
+	 * update c->word_offset. */
+	bm_xfer_ctx_bit_to_word_offset(c);
+
+	/* store pad_bits */
+	DCBP_set_pad_bits(p, (8 - bs.cur.bit) & 0x7);
+
+	return len;
+}
+
+enum { OK, FAILED, DONE }
+send_bitmap_rle_or_plain(struct drbd_conf *mdev,
+	struct Drbd_Header *h, struct bm_xfer_ctx *c)
+{
+	struct Drbd_Compressed_Bitmap_Packet *p = (void*)h;
+	unsigned long num_words;
+	int len;
+	int ok;
+
+	if (0)
+		len = fill_bitmap_rle_bytes(mdev, p, c);
+	else
+		len = fill_bitmap_rle_bits(mdev, p, c);
+
+	if (len < 0)
+		return FAILED;
+	if (len) {
+		DCBP_set_code(p, 0 ? RLE_VLI_Bytes : RLE_VLI_BitsFibD_3_5);
+		ok = _drbd_send_cmd(mdev, mdev->data.socket, ReportCBitMap, h,
+			sizeof(*p) + len, 0);
+
+		c->packets[0]++;
+		c->bytes[0] += sizeof(*p) + len;
+
+		if (c->bit_offset >= c->bm_bits)
+			len = 0; /* DONE */
+	} else {
+		/* was not compressible.
+		 * send a buffer full of plain text bits instead. */
+		num_words = min_t(size_t, BM_PACKET_WORDS, c->bm_words - c->word_offset);
+		len = num_words * sizeof(long);
+		if (len)
+			drbd_bm_get_lel(mdev, c->word_offset, num_words, (unsigned long*)h->payload);
+		ok = _drbd_send_cmd(mdev, mdev->data.socket, ReportBitMap,
+				   h, sizeof(struct Drbd_Header) + len, 0);
+		c->word_offset += num_words;
+		c->bit_offset = c->word_offset * BITS_PER_LONG;
+
+		c->packets[1]++;
+		c->bytes[1] += sizeof(struct Drbd_Header) + len;
+
+		if (c->bit_offset > c->bm_bits)
+			c->bit_offset = c->bm_bits;
+	}
+	ok = ok ? ((len == 0) ? DONE : OK) : FAILED;
+
+	if (ok == DONE)
+		INFO_bm_xfer_stats(mdev, "send", c);
+	return ok;
+}
+
+/* See the comment at receive_bitmap() */
+int _drbd_send_bitmap(struct drbd_conf *mdev)
+{
+	struct bm_xfer_ctx c;
+	struct Drbd_Header *p;
+	int ret;
+
+	ERR_IF(!mdev->bitmap) return FALSE;
+
+	/* maybe we should use some per thread scratch page,
+	 * and allocate that during initial device creation? */
+	p = (struct Drbd_Header *) __get_free_page(GFP_NOIO);
+	if (!p) {
+		ERR("failed to allocate one page buffer in %s\n", __func__);
+		return FALSE;
+	}
+
+	if (inc_local(mdev)) {
+		if (drbd_md_test_flag(mdev->bc, MDF_FullSync)) {
+			INFO("Writing the whole bitmap, MDF_FullSync was set.\n");
+			drbd_bm_set_all(mdev);
+			if (drbd_bm_write(mdev)) {
+				/* write_bm did fail! Leave full sync flag set in Meta Data
+				 * but otherwise process as per normal - need to tell other
+				 * side that a full resync is required! */
+				ERR("Failed to write bitmap to disk!\n");
+			} else {
+				drbd_md_clear_flag(mdev, MDF_FullSync);
+				drbd_md_sync(mdev);
+			}
+		}
+		dec_local(mdev);
+	}
+
+	c = (struct bm_xfer_ctx) {
+		.bm_bits = drbd_bm_bits(mdev),
+		.bm_words = drbd_bm_words(mdev),
+	};
+
+	do {
+		ret = send_bitmap_rle_or_plain(mdev, p, &c);
+	} while (ret == OK);
+
+	free_page((unsigned long) p);
+	return (ret == DONE);
+}
+
+int drbd_send_bitmap(struct drbd_conf *mdev)
+{
+	int err;
+
+	if (!drbd_get_data_sock(mdev))
+		return -1;
+	err = !_drbd_send_bitmap(mdev);
+	drbd_put_data_sock(mdev);
+	return err;
+}
+
+int drbd_send_b_ack(struct drbd_conf *mdev, u32 barrier_nr, u32 set_size)
+{
+	int ok;
+	struct Drbd_BarrierAck_Packet p;
+
+	p.barrier  = barrier_nr;
+	p.set_size = cpu_to_be32(set_size);
+
+	if (mdev->state.conn < Connected)
+		return FALSE;
+	ok = drbd_send_cmd(mdev, USE_META_SOCKET, BarrierAck,
+			(struct Drbd_Header *)&p, sizeof(p));
+	return ok;
+}
+
+/**
+ * _drbd_send_ack:
+ * This helper function expects the sector and block_id parameter already
+ * in big endian!
+ */
+STATIC int _drbd_send_ack(struct drbd_conf *mdev, enum Drbd_Packet_Cmd cmd,
+			  u64 sector,
+			  u32 blksize,
+			  u64 block_id)
+{
+	int ok;
+	struct Drbd_BlockAck_Packet p;
+
+	p.sector   = sector;
+	p.block_id = block_id;
+	p.blksize  = blksize;
+	p.seq_num  = cpu_to_be32(atomic_add_return(1, &mdev->packet_seq));
+
+	if (!mdev->meta.socket || mdev->state.conn < Connected)
+		return FALSE;
+	ok = drbd_send_cmd(mdev, USE_META_SOCKET, cmd,
+				(struct Drbd_Header *)&p, sizeof(p));
+	return ok;
+}
+
+int drbd_send_ack_dp(struct drbd_conf *mdev, enum Drbd_Packet_Cmd cmd,
+		     struct Drbd_Data_Packet *dp)
+{
+	const int header_size = sizeof(struct Drbd_Data_Packet)
+			      - sizeof(struct Drbd_Header);
+	int data_size  = ((struct Drbd_Header *)dp)->length - header_size;
+
+	return _drbd_send_ack(mdev, cmd, dp->sector, cpu_to_be32(data_size),
+			      dp->block_id);
+}
+
+int drbd_send_ack_rp(struct drbd_conf *mdev, enum Drbd_Packet_Cmd cmd,
+		     struct Drbd_BlockRequest_Packet *rp)
+{
+	return _drbd_send_ack(mdev, cmd, rp->sector, rp->blksize, rp->block_id);
+}
+
+int drbd_send_ack(struct drbd_conf *mdev,
+	enum Drbd_Packet_Cmd cmd, struct Tl_epoch_entry *e)
+{
+	return _drbd_send_ack(mdev, cmd,
+			      cpu_to_be64(e->sector),
+			      cpu_to_be32(e->size),
+			      e->block_id);
+}
+
+/* This function misuses the block_id field to signal if the blocks
+ * are is sync or not. */
+int drbd_send_ack_ex(struct drbd_conf *mdev, enum Drbd_Packet_Cmd cmd,
+		     sector_t sector, int blksize, u64 block_id)
+{
+	return _drbd_send_ack(mdev, cmd,
+			      cpu_to_be64(sector),
+			      cpu_to_be32(blksize),
+			      cpu_to_be64(block_id));
+}
+
+int drbd_send_drequest(struct drbd_conf *mdev, int cmd,
+		       sector_t sector, int size, u64 block_id)
+{
+	int ok;
+	struct Drbd_BlockRequest_Packet p;
+
+	p.sector   = cpu_to_be64(sector);
+	p.block_id = block_id;
+	p.blksize  = cpu_to_be32(size);
+
+	ok = drbd_send_cmd(mdev, USE_DATA_SOCKET, cmd,
+				(struct Drbd_Header *)&p, sizeof(p));
+	return ok;
+}
+
+int drbd_send_drequest_csum(struct drbd_conf *mdev,
+			    sector_t sector, int size,
+			    void *digest, int digest_size,
+			    enum Drbd_Packet_Cmd cmd)
+{
+	int ok;
+	struct Drbd_BlockRequest_Packet p;
+
+	p.sector   = cpu_to_be64(sector);
+	p.block_id = BE_DRBD_MAGIC + 0xbeef;
+	p.blksize  = cpu_to_be32(size);
+
+	p.head.magic   = BE_DRBD_MAGIC;
+	p.head.command = cpu_to_be16(cmd);
+	p.head.length  = cpu_to_be16(sizeof(p) - sizeof(struct Drbd_Header) + digest_size);
+
+	mutex_lock(&mdev->data.mutex);
+
+	ok = (sizeof(p) == drbd_send(mdev, mdev->data.socket, &p, sizeof(p), 0));
+	ok = ok && (digest_size == drbd_send(mdev, mdev->data.socket, digest, digest_size, 0));
+
+	mutex_unlock(&mdev->data.mutex);
+
+	return ok;
+}
+
+int drbd_send_ov_request(struct drbd_conf *mdev, sector_t sector, int size)
+{
+	int ok;
+	struct Drbd_BlockRequest_Packet p;
+
+	p.sector   = cpu_to_be64(sector);
+	p.block_id = BE_DRBD_MAGIC + 0xbabe;
+	p.blksize  = cpu_to_be32(size);
+
+	ok = drbd_send_cmd(mdev, USE_DATA_SOCKET, OVRequest,
+			   (struct Drbd_Header *)&p, sizeof(p));
+	return ok;
+}
+
+/* called on sndtimeo
+ * returns FALSE if we should retry,
+ * TRUE if we think connection is dead
+ */
+STATIC int we_should_drop_the_connection(struct drbd_conf *mdev, struct socket *sock)
+{
+	int drop_it;
+	/* long elapsed = (long)(jiffies - mdev->last_received); */
+
+	drop_it =   mdev->meta.socket == sock
+		|| !mdev->asender.task
+		|| get_t_state(&mdev->asender) != Running
+		|| mdev->state.conn < Connected;
+
+	if (drop_it)
+		return TRUE;
+
+	drop_it = !--mdev->ko_count;
+	if (!drop_it) {
+		ERR("[%s/%d] sock_sendmsg time expired, ko = %u\n",
+		       current->comm, current->pid, mdev->ko_count);
+		request_ping(mdev);
+	}
+
+	return drop_it; /* && (mdev->state == Primary) */;
+}
+
+/* The idea of sendpage seems to be to put some kind of reference
+ * to the page into the skb, and to hand it over to the NIC. In
+ * this process get_page() gets called.
+ *
+ * As soon as the page was really sent over the network put_page()
+ * gets called by some part of the network layer. [ NIC driver? ]
+ *
+ * [ get_page() / put_page() increment/decrement the count. If count
+ *   reaches 0 the page will be freed. ]
+ *
+ * This works nicely with pages from FSs.
+ * But this means that in protocol A we might signal IO completion too early!
+ *
+ * In order not to corrupt data during a resync we must make sure
+ * that we do not reuse our own buffer pages (EEs) to early, therefore
+ * we have the net_ee list.
+ *
+ * XFS seems to have problems, still, it submits pages with page_count == 0!
+ * As a workaround, we disable sendpage on pages
+ * with page_count == 0 or PageSlab.
+ */
+STATIC int _drbd_no_send_page(struct drbd_conf *mdev, struct page *page,
+		   int offset, size_t size)
+{
+       int ret;
+       ret = drbd_send(mdev, mdev->data.socket, kmap(page) + offset, size, 0);
+       kunmap(page);
+       return ret;
+}
+
+int _drbd_send_page(struct drbd_conf *mdev, struct page *page,
+		    int offset, size_t size)
+{
+	mm_segment_t oldfs = get_fs();
+	int sent, ok;
+	int len = size;
+
+	/* PARANOIA. if this ever triggers,
+	 * something in the layers above us is really kaputt.
+	 *one roundtrip later:
+	 * doh. it triggered. so XFS _IS_ really kaputt ...
+	 * oh well...
+	 */
+	if ((page_count(page) < 1) || PageSlab(page)) {
+		/* e.g. XFS meta- & log-data is in slab pages, which have a
+		 * page_count of 0 and/or have PageSlab() set...
+		 */
+		sent = _drbd_no_send_page(mdev, page, offset, size);
+		if (likely(sent > 0))
+			len -= sent;
+		goto out;
+	}
+
+	drbd_update_congested(mdev);
+	set_fs(KERNEL_DS);
+	do {
+		sent = mdev->data.socket->ops->sendpage(mdev->data.socket, page,
+							offset, len,
+							MSG_NOSIGNAL);
+		if (sent == -EAGAIN) {
+			if (we_should_drop_the_connection(mdev,
+							  mdev->data.socket))
+				break;
+			else
+				continue;
+		}
+		if (sent <= 0) {
+			drbd_WARN("%s: size=%d len=%d sent=%d\n",
+			     __func__, (int)size, len, sent);
+			break;
+		}
+		len    -= sent;
+		offset += sent;
+	} while (len > 0 /* THINK && mdev->cstate >= Connected*/);
+	set_fs(oldfs);
+	clear_bit(NET_CONGESTED, &mdev->flags);
+
+out:
+	ok = (len == 0);
+	if (likely(ok))
+		mdev->send_cnt += size>>9;
+	return ok;
+}
+
+static inline int _drbd_send_bio(struct drbd_conf *mdev, struct bio *bio)
+{
+	struct bio_vec *bvec;
+	int i;
+	__bio_for_each_segment(bvec, bio, i, 0) {
+		if (!_drbd_no_send_page(mdev, bvec->bv_page,
+				     bvec->bv_offset, bvec->bv_len))
+			return 0;
+	}
+	return 1;
+}
+
+static inline int _drbd_send_zc_bio(struct drbd_conf *mdev, struct bio *bio)
+{
+	struct bio_vec *bvec;
+	int i;
+	__bio_for_each_segment(bvec, bio, i, 0) {
+		if (!_drbd_send_page(mdev, bvec->bv_page,
+				     bvec->bv_offset, bvec->bv_len))
+			return 0;
+	}
+
+	return 1;
+}
+
+/* Used to send write requests
+ * Primary -> Peer	(Data)
+ */
+int drbd_send_dblock(struct drbd_conf *mdev, struct drbd_request *req)
+{
+	int ok = 1;
+	struct Drbd_Data_Packet p;
+	unsigned int dp_flags = 0;
+	void *dgb;
+	int dgs;
+
+	if (!drbd_get_data_sock(mdev))
+		return 0;
+
+	dgs = (mdev->agreed_pro_version >= 87 && mdev->integrity_w_tfm) ?
+		crypto_hash_digestsize(mdev->integrity_w_tfm) : 0;
+
+	p.head.magic   = BE_DRBD_MAGIC;
+	p.head.command = cpu_to_be16(Data);
+	p.head.length  =
+		cpu_to_be16(sizeof(p) - sizeof(struct Drbd_Header) + dgs + req->size);
+
+	p.sector   = cpu_to_be64(req->sector);
+	p.block_id = (unsigned long)req;
+	p.seq_num  = cpu_to_be32(req->seq_num =
+				 atomic_add_return(1, &mdev->packet_seq));
+	dp_flags = 0;
+
+	/* NOTE: no need to check if barriers supported here as we would
+	 *       not pass the test in make_request_common in that case
+	 */
+	if (bio_barrier(req->master_bio))
+		dp_flags |= DP_HARDBARRIER;
+	if (bio_sync(req->master_bio))
+		dp_flags |= DP_RW_SYNC;
+	if (mdev->state.conn >= SyncSource &&
+	    mdev->state.conn <= PausedSyncT)
+		dp_flags |= DP_MAY_SET_IN_SYNC;
+
+	p.dp_flags = cpu_to_be32(dp_flags);
+	dump_packet(mdev, mdev->data.socket, 0, (void *)&p, __FILE__, __LINE__);
+	set_bit(UNPLUG_REMOTE, &mdev->flags);
+	ok = (sizeof(p) ==
+		drbd_send(mdev, mdev->data.socket, &p, sizeof(p), MSG_MORE));
+	if (ok && dgs) {
+		dgb = mdev->int_dig_out;
+		drbd_csum(mdev, mdev->integrity_w_tfm, req->master_bio, dgb);
+		ok = drbd_send(mdev, mdev->data.socket, dgb, dgs, MSG_MORE);
+	}
+	if (ok) {
+		if (mdev->net_conf->wire_protocol == DRBD_PROT_A)
+			ok = _drbd_send_bio(mdev, req->master_bio);
+		else
+			ok = _drbd_send_zc_bio(mdev, req->master_bio);
+	}
+
+	drbd_put_data_sock(mdev);
+	return ok;
+}
+
+/* answer packet, used to send data back for read requests:
+ *  Peer       -> (diskless) Primary   (DataReply)
+ *  SyncSource -> SyncTarget         (RSDataReply)
+ */
+int drbd_send_block(struct drbd_conf *mdev, enum Drbd_Packet_Cmd cmd,
+		    struct Tl_epoch_entry *e)
+{
+	int ok;
+	struct Drbd_Data_Packet p;
+	void *dgb;
+	int dgs;
+
+	dgs = (mdev->agreed_pro_version >= 87 && mdev->integrity_w_tfm) ?
+		crypto_hash_digestsize(mdev->integrity_w_tfm) : 0;
+
+	p.head.magic   = BE_DRBD_MAGIC;
+	p.head.command = cpu_to_be16(cmd);
+	p.head.length  =
+		cpu_to_be16(sizeof(p) - sizeof(struct Drbd_Header) + dgs + e->size);
+
+	p.sector   = cpu_to_be64(e->sector);
+	p.block_id = e->block_id;
+	/* p.seq_num  = 0;    No sequence numbers here.. */
+
+	/* Only called by our kernel thread.
+	 * This one may be interupted by DRBD_SIG and/or DRBD_SIGKILL
+	 * in response to admin command or module unload.
+	 */
+	if (!drbd_get_data_sock(mdev))
+		return 0;
+
+	dump_packet(mdev, mdev->data.socket, 0, (void *)&p, __FILE__, __LINE__);
+	ok = sizeof(p) == drbd_send(mdev, mdev->data.socket, &p,
+					sizeof(p), MSG_MORE);
+	if (ok && dgs) {
+		dgb = mdev->int_dig_out;
+		drbd_csum(mdev, mdev->integrity_w_tfm, e->private_bio, dgb);
+		ok = drbd_send(mdev, mdev->data.socket, dgb, dgs, MSG_MORE);
+	}
+	if (ok)
+		ok = _drbd_send_zc_bio(mdev, e->private_bio);
+
+	drbd_put_data_sock(mdev);
+	return ok;
+}
+
+/*
+  drbd_send distinguishes two cases:
+
+  Packets sent via the data socket "sock"
+  and packets sent via the meta data socket "msock"
+
+		    sock                      msock
+  -----------------+-------------------------+------------------------------
+  timeout           conf.timeout / 2          conf.timeout / 2
+  timeout action    send a ping via msock     Abort communication
+					      and close all sockets
+*/
+
+/*
+ * you must have down()ed the appropriate [m]sock_mutex elsewhere!
+ */
+int drbd_send(struct drbd_conf *mdev, struct socket *sock,
+	      void *buf, size_t size, unsigned msg_flags)
+{
+	struct kvec iov;
+	struct msghdr msg;
+	int rv, sent = 0;
+
+	if (!sock)
+		return -1000;
+
+	/* THINK  if (signal_pending) return ... ? */
+
+	iov.iov_base = buf;
+	iov.iov_len  = size;
+
+	msg.msg_name       = NULL;
+	msg.msg_namelen    = 0;
+	msg.msg_control    = NULL;
+	msg.msg_controllen = 0;
+	msg.msg_flags      = msg_flags | MSG_NOSIGNAL;
+
+	if (sock == mdev->data.socket) {
+		mdev->ko_count = mdev->net_conf->ko_count;
+		drbd_update_congested(mdev);
+	}
+	do {
+		/* STRANGE
+		 * tcp_sendmsg does _not_ use its size parameter at all ?
+		 *
+		 * -EAGAIN on timeout, -EINTR on signal.
+		 */
+/* THINK
+ * do we need to block DRBD_SIG if sock == &meta.socket ??
+ * otherwise wake_asender() might interrupt some send_*Ack !
+ */
+		rv = kernel_sendmsg(sock, &msg, &iov, 1, size);
+		if (rv == -EAGAIN) {
+			if (we_should_drop_the_connection(mdev, sock))
+				break;
+			else
+				continue;
+		}
+		D_ASSERT(rv != 0);
+		if (rv == -EINTR) {
+			flush_signals(current);
+			rv = 0;
+		}
+		if (rv < 0)
+			break;
+		sent += rv;
+		iov.iov_base += rv;
+		iov.iov_len  -= rv;
+	} while (sent < size);
+
+	if (sock == mdev->data.socket)
+		clear_bit(NET_CONGESTED, &mdev->flags);
+
+	if (rv <= 0) {
+		if (rv != -EAGAIN) {
+			ERR("%s_sendmsg returned %d\n",
+			    sock == mdev->meta.socket ? "msock" : "sock",
+			    rv);
+			drbd_force_state(mdev, NS(conn, BrokenPipe));
+		} else
+			drbd_force_state(mdev, NS(conn, Timeout));
+	}
+
+	return sent;
+}
+
+static int drbd_open(struct block_device *bdev, fmode_t mode)
+{
+	struct drbd_conf *mdev = bdev->bd_disk->private_data;
+	unsigned long flags;
+	int rv = 0;
+
+	spin_lock_irqsave(&mdev->req_lock, flags);
+	/* to have a stable mdev->state.role
+	 * and no race with updating open_cnt */
+
+	if (mdev->state.role != Primary) {
+		if (mode & FMODE_WRITE)
+			rv = -EROFS;
+		else if (!allow_oos)
+			rv = -EMEDIUMTYPE;
+	}
+
+	if (!rv)
+		mdev->open_cnt++;
+	spin_unlock_irqrestore(&mdev->req_lock, flags);
+
+	return rv;
+}
+
+static int drbd_release(struct gendisk *gd, fmode_t mode)
+{
+	struct drbd_conf *mdev = gd->private_data;
+	mdev->open_cnt--;
+	return 0;
+}
+
+STATIC void drbd_unplug_fn(struct request_queue *q)
+{
+	struct drbd_conf *mdev = q->queuedata;
+
+	MTRACE(TraceTypeUnplug, TraceLvlSummary,
+	       INFO("got unplugged ap_bio_count=%d\n",
+		    atomic_read(&mdev->ap_bio_cnt));
+	       );
+
+	/* unplug FIRST */
+	spin_lock_irq(q->queue_lock);
+	blk_remove_plug(q);
+	spin_unlock_irq(q->queue_lock);
+
+	/* only if connected */
+	spin_lock_irq(&mdev->req_lock);
+	if (mdev->state.pdsk >= Inconsistent && mdev->state.conn >= Connected) {
+		D_ASSERT(mdev->state.role == Primary);
+		if (test_and_clear_bit(UNPLUG_REMOTE, &mdev->flags)) {
+			/* add to the data.work queue,
+			 * unless already queued.
+			 * XXX this might be a good addition to drbd_queue_work
+			 * anyways, to detect "double queuing" ... */
+			if (list_empty(&mdev->unplug_work.list))
+				drbd_queue_work(&mdev->data.work,
+						&mdev->unplug_work);
+		}
+	}
+	spin_unlock_irq(&mdev->req_lock);
+
+	if (mdev->state.disk >= Inconsistent)
+		drbd_kick_lo(mdev);
+}
+
+STATIC void drbd_set_defaults(struct drbd_conf *mdev)
+{
+	mdev->sync_conf.after      = DRBD_AFTER_DEF;
+	mdev->sync_conf.rate       = DRBD_RATE_DEF;
+	mdev->sync_conf.al_extents = DRBD_AL_EXTENTS_DEF;
+	mdev->state = (union drbd_state_t) {
+		{ .role = Secondary,
+		  .peer = Unknown,
+		  .conn = StandAlone,
+		  .disk = Diskless,
+		  .pdsk = DUnknown,
+		  .susp = 0
+		} };
+}
+
+void drbd_init_set_defaults(struct drbd_conf *mdev)
+{
+	/* the memset(,0,) did most of this.
+	 * note: only assignments, no allocation in here */
+
+	drbd_set_defaults(mdev);
+
+	/* for now, we do NOT yet support it,
+	 * even though we start some framework
+	 * to eventually support barriers */
+	set_bit(NO_BARRIER_SUPP, &mdev->flags);
+
+	atomic_set(&mdev->ap_bio_cnt, 0);
+	atomic_set(&mdev->ap_pending_cnt, 0);
+	atomic_set(&mdev->rs_pending_cnt, 0);
+	atomic_set(&mdev->unacked_cnt, 0);
+	atomic_set(&mdev->local_cnt, 0);
+	atomic_set(&mdev->net_cnt, 0);
+	atomic_set(&mdev->packet_seq, 0);
+	atomic_set(&mdev->pp_in_use, 0);
+
+	mutex_init(&mdev->md_io_mutex);
+	mutex_init(&mdev->data.mutex);
+	mutex_init(&mdev->meta.mutex);
+	sema_init(&mdev->data.work.s, 0);
+	sema_init(&mdev->meta.work.s, 0);
+	mutex_init(&mdev->state_mutex);
+
+	spin_lock_init(&mdev->data.work.q_lock);
+	spin_lock_init(&mdev->meta.work.q_lock);
+
+	spin_lock_init(&mdev->al_lock);
+	spin_lock_init(&mdev->req_lock);
+	spin_lock_init(&mdev->peer_seq_lock);
+	spin_lock_init(&mdev->epoch_lock);
+
+	INIT_LIST_HEAD(&mdev->active_ee);
+	INIT_LIST_HEAD(&mdev->sync_ee);
+	INIT_LIST_HEAD(&mdev->done_ee);
+	INIT_LIST_HEAD(&mdev->read_ee);
+	INIT_LIST_HEAD(&mdev->net_ee);
+	INIT_LIST_HEAD(&mdev->resync_reads);
+	INIT_LIST_HEAD(&mdev->data.work.q);
+	INIT_LIST_HEAD(&mdev->meta.work.q);
+	INIT_LIST_HEAD(&mdev->resync_work.list);
+	INIT_LIST_HEAD(&mdev->unplug_work.list);
+	INIT_LIST_HEAD(&mdev->md_sync_work.list);
+	INIT_LIST_HEAD(&mdev->bm_io_work.w.list);
+	mdev->resync_work.cb  = w_resync_inactive;
+	mdev->unplug_work.cb  = w_send_write_hint;
+	mdev->md_sync_work.cb = w_md_sync;
+	mdev->bm_io_work.w.cb = w_bitmap_io;
+	init_timer(&mdev->resync_timer);
+	init_timer(&mdev->md_sync_timer);
+	mdev->resync_timer.function = resync_timer_fn;
+	mdev->resync_timer.data = (unsigned long) mdev;
+	mdev->md_sync_timer.function = md_sync_timer_fn;
+	mdev->md_sync_timer.data = (unsigned long) mdev;
+
+	init_waitqueue_head(&mdev->misc_wait);
+	init_waitqueue_head(&mdev->state_wait);
+	init_waitqueue_head(&mdev->ee_wait);
+	init_waitqueue_head(&mdev->al_wait);
+	init_waitqueue_head(&mdev->seq_wait);
+
+	drbd_thread_init(mdev, &mdev->receiver, drbdd_init);
+	drbd_thread_init(mdev, &mdev->worker, drbd_worker);
+	drbd_thread_init(mdev, &mdev->asender, drbd_asender);
+
+	mdev->agreed_pro_version = PRO_VERSION_MAX;
+	mdev->write_ordering = WO_bio_barrier;
+	mdev->resync_wenr = LC_FREE;
+}
+
+void drbd_mdev_cleanup(struct drbd_conf *mdev)
+{
+	if (mdev->receiver.t_state != None)
+		ERR("ASSERT FAILED: receiver t_state == %d expected 0.\n",
+				mdev->receiver.t_state);
+
+	/* no need to lock it, I'm the only thread alive */
+	if (atomic_read(&mdev->current_epoch->epoch_size) !=  0)
+		ERR("epoch_size:%d\n", atomic_read(&mdev->current_epoch->epoch_size));
+	mdev->al_writ_cnt  =
+	mdev->bm_writ_cnt  =
+	mdev->read_cnt     =
+	mdev->recv_cnt     =
+	mdev->send_cnt     =
+	mdev->writ_cnt     =
+	mdev->p_size       =
+	mdev->rs_start     =
+	mdev->rs_total     =
+	mdev->rs_failed    =
+	mdev->rs_mark_left =
+	mdev->rs_mark_time = 0;
+	D_ASSERT(mdev->net_conf == NULL);
+
+	drbd_set_my_capacity(mdev, 0);
+	drbd_bm_resize(mdev, 0);
+	drbd_bm_cleanup(mdev);
+
+	drbd_free_resources(mdev);
+
+	/*
+	 * currently we drbd_init_ee only on module load, so
+	 * we may do drbd_release_ee only on module unload!
+	 */
+	D_ASSERT(list_empty(&mdev->active_ee));
+	D_ASSERT(list_empty(&mdev->sync_ee));
+	D_ASSERT(list_empty(&mdev->done_ee));
+	D_ASSERT(list_empty(&mdev->read_ee));
+	D_ASSERT(list_empty(&mdev->net_ee));
+	D_ASSERT(list_empty(&mdev->resync_reads));
+	D_ASSERT(list_empty(&mdev->data.work.q));
+	D_ASSERT(list_empty(&mdev->meta.work.q));
+	D_ASSERT(list_empty(&mdev->resync_work.list));
+	D_ASSERT(list_empty(&mdev->unplug_work.list));
+
+}
+
+
+STATIC void drbd_destroy_mempools(void)
+{
+	struct page *page;
+
+	while (drbd_pp_pool) {
+		page = drbd_pp_pool;
+		drbd_pp_pool = (struct page *)page_private(page);
+		__free_page(page);
+		drbd_pp_vacant--;
+	}
+
+	/* D_ASSERT(atomic_read(&drbd_pp_vacant)==0); */
+
+	if (drbd_ee_mempool)
+		mempool_destroy(drbd_ee_mempool);
+	if (drbd_request_mempool)
+		mempool_destroy(drbd_request_mempool);
+	if (drbd_ee_cache)
+		kmem_cache_destroy(drbd_ee_cache);
+	if (drbd_request_cache)
+		kmem_cache_destroy(drbd_request_cache);
+
+	drbd_ee_mempool      = NULL;
+	drbd_request_mempool = NULL;
+	drbd_ee_cache        = NULL;
+	drbd_request_cache   = NULL;
+
+	return;
+}
+
+STATIC int drbd_create_mempools(void)
+{
+	struct page *page;
+	const int number = (DRBD_MAX_SEGMENT_SIZE/PAGE_SIZE) * minor_count;
+	int i;
+
+	/* prepare our caches and mempools */
+	drbd_request_mempool = NULL;
+	drbd_ee_cache        = NULL;
+	drbd_request_cache   = NULL;
+	drbd_pp_pool         = NULL;
+
+	/* caches */
+	drbd_request_cache = kmem_cache_create(
+		"drbd_req_cache", sizeof(struct drbd_request), 0, 0, NULL);
+	if (drbd_request_cache == NULL)
+		goto Enomem;
+
+	drbd_ee_cache = kmem_cache_create(
+		"drbd_ee_cache", sizeof(struct Tl_epoch_entry), 0, 0, NULL);
+	if (drbd_ee_cache == NULL)
+		goto Enomem;
+
+	/* mempools */
+	drbd_request_mempool = mempool_create(number,
+		mempool_alloc_slab, mempool_free_slab, drbd_request_cache);
+	if (drbd_request_mempool == NULL)
+		goto Enomem;
+
+	drbd_ee_mempool = mempool_create(number,
+		mempool_alloc_slab, mempool_free_slab, drbd_ee_cache);
+	if (drbd_request_mempool == NULL)
+		goto Enomem;
+
+	/* drbd's page pool */
+	spin_lock_init(&drbd_pp_lock);
+
+	for (i = 0; i < number; i++) {
+		page = alloc_page(GFP_HIGHUSER);
+		if (!page)
+			goto Enomem;
+		set_page_private(page, (unsigned long)drbd_pp_pool);
+		drbd_pp_pool = page;
+	}
+	drbd_pp_vacant = number;
+
+	return 0;
+
+Enomem:
+	drbd_destroy_mempools(); /* in case we allocated some */
+	return -ENOMEM;
+}
+
+STATIC int drbd_notify_sys(struct notifier_block *this, unsigned long code,
+	void *unused)
+{
+	/* just so we have it.  you never know what interessting things we
+	 * might want to do here some day...
+	 */
+
+	return NOTIFY_DONE;
+}
+
+STATIC struct notifier_block drbd_notifier = {
+	.notifier_call = drbd_notify_sys,
+};
+
+static void drbd_release_ee_lists(struct drbd_conf *mdev)
+{
+	int rr;
+
+	rr = drbd_release_ee(mdev, &mdev->active_ee);
+	if (rr)
+		ERR("%d EEs in active list found!\n", rr);
+
+	rr = drbd_release_ee(mdev, &mdev->sync_ee);
+	if (rr)
+		ERR("%d EEs in sync list found!\n", rr);
+
+	rr = drbd_release_ee(mdev, &mdev->read_ee);
+	if (rr)
+		ERR("%d EEs in read list found!\n", rr);
+
+	rr = drbd_release_ee(mdev, &mdev->done_ee);
+	if (rr)
+		ERR("%d EEs in done list found!\n", rr);
+
+	rr = drbd_release_ee(mdev, &mdev->net_ee);
+	if (rr)
+		ERR("%d EEs in net list found!\n", rr);
+}
+
+/* caution. no locking.
+ * currently only used from module cleanup code. */
+static void drbd_delete_device(unsigned int minor)
+{
+	struct drbd_conf *mdev = minor_to_mdev(minor);
+
+	if (!mdev)
+		return;
+
+	/* paranoia asserts */
+	if (mdev->open_cnt != 0)
+		ERR("open_cnt = %d in %s:%u", mdev->open_cnt,
+				__FILE__ , __LINE__);
+
+	ERR_IF (!list_empty(&mdev->data.work.q)) {
+		struct list_head *lp;
+		list_for_each(lp, &mdev->data.work.q) {
+			DUMPP(lp);
+		}
+	};
+	/* end paranoia asserts */
+
+	del_gendisk(mdev->vdisk);
+
+	/* cleanup stuff that may have been allocated during
+	 * device (re-)configuration or state changes */
+
+	if (mdev->this_bdev)
+		bdput(mdev->this_bdev);
+
+	drbd_free_resources(mdev);
+
+	drbd_release_ee_lists(mdev);
+
+	/* should be free'd on disconnect? */
+	kfree(mdev->ee_hash);
+	/*
+	mdev->ee_hash_s = 0;
+	mdev->ee_hash = NULL;
+	*/
+
+	if (mdev->act_log)
+		lc_free(mdev->act_log);
+	if (mdev->resync)
+		lc_free(mdev->resync);
+
+	kfree(mdev->p_uuid);
+	/* mdev->p_uuid = NULL; */
+
+	kfree(mdev->int_dig_out);
+	kfree(mdev->int_dig_in);
+	kfree(mdev->int_dig_vv);
+
+	/* cleanup the rest that has been
+	 * allocated from drbd_new_device
+	 * and actually free the mdev itself */
+	drbd_free_mdev(mdev);
+}
+
+STATIC void drbd_cleanup(void)
+{
+	unsigned int i;
+
+	unregister_reboot_notifier(&drbd_notifier);
+
+	drbd_nl_cleanup();
+
+	if (minor_table) {
+		if (drbd_proc)
+			remove_proc_entry("drbd", NULL);
+		i = minor_count;
+		while (i--)
+			drbd_delete_device(i);
+		drbd_destroy_mempools();
+	}
+
+	kfree(minor_table);
+
+	unregister_blkdev(DRBD_MAJOR, "drbd");
+
+	printk(KERN_INFO "drbd: module cleanup done.\n");
+}
+
+/**
+ * drbd_congested: Returns 1<<BDI_async_congested and/or
+ * 1<<BDI_sync_congested if we are congested. This interface is known
+ * to be used by pdflush.
+ */
+static int drbd_congested(void *congested_data, int bdi_bits)
+{
+	struct drbd_conf *mdev = congested_data;
+	struct request_queue *q;
+	char reason = '-';
+	int r = 0;
+
+	if (!__inc_ap_bio_cond(mdev)) {
+		/* DRBD has frozen IO */
+		r = bdi_bits;
+		reason = 'd';
+		goto out;
+	}
+
+	if (inc_local(mdev)) {
+		q = bdev_get_queue(mdev->bc->backing_bdev);
+		r = bdi_congested(&q->backing_dev_info, bdi_bits);
+		dec_local(mdev);
+		if (r)
+			reason = 'b';
+	}
+
+	if (bdi_bits & (1 << BDI_async_congested) && test_bit(NET_CONGESTED, &mdev->flags)) {
+		r |= (1 << BDI_async_congested);
+		reason = reason == 'b' ? 'a' : 'n';
+	}
+
+out:
+	mdev->congestion_reason = reason;
+	return r;
+}
+
+struct drbd_conf *drbd_new_device(unsigned int minor)
+{
+	struct drbd_conf *mdev;
+	struct gendisk *disk;
+	struct request_queue *q;
+
+	mdev = kzalloc(sizeof(struct drbd_conf), GFP_KERNEL);
+	if (!mdev)
+		return NULL;
+
+	mdev->minor = minor;
+
+	drbd_init_set_defaults(mdev);
+
+	q = blk_alloc_queue(GFP_KERNEL);
+	if (!q)
+		goto out_no_q;
+	mdev->rq_queue = q;
+	q->queuedata   = mdev;
+	blk_queue_max_segment_size(q, DRBD_MAX_SEGMENT_SIZE);
+
+	disk = alloc_disk(1);
+	if (!disk)
+		goto out_no_disk;
+	mdev->vdisk = disk;
+
+	set_disk_ro(disk, TRUE);
+
+	disk->queue = q;
+	disk->major = DRBD_MAJOR;
+	disk->first_minor = minor;
+	disk->fops = &drbd_ops;
+	sprintf(disk->disk_name, "drbd%d", minor);
+	disk->private_data = mdev;
+
+	mdev->this_bdev = bdget(MKDEV(DRBD_MAJOR, minor));
+	/* we have no partitions. we contain only ourselves. */
+	mdev->this_bdev->bd_contains = mdev->this_bdev;
+
+	q->backing_dev_info.congested_fn = drbd_congested;
+	q->backing_dev_info.congested_data = mdev;
+
+	blk_queue_make_request(q, drbd_make_request_26);
+	blk_queue_bounce_limit(q, BLK_BOUNCE_ANY);
+	blk_queue_merge_bvec(q, drbd_merge_bvec);
+	q->queue_lock = &mdev->req_lock; /* needed since we use */
+		/* plugging on a queue, that actually has no requests! */
+	q->unplug_fn = drbd_unplug_fn;
+
+	mdev->md_io_page = alloc_page(GFP_KERNEL);
+	if (!mdev->md_io_page)
+		goto out_no_io_page;
+
+	if (drbd_bm_init(mdev))
+		goto out_no_bitmap;
+	/* no need to lock access, we are still initializing the module. */
+	if (!tl_init(mdev))
+		goto out_no_tl;
+
+	mdev->app_reads_hash = kzalloc(APP_R_HSIZE*sizeof(void *), GFP_KERNEL);
+	if (!mdev->app_reads_hash)
+		goto out_no_app_reads;
+
+	mdev->current_epoch = kzalloc(sizeof(struct drbd_epoch), GFP_KERNEL);
+	if (!mdev->current_epoch)
+		goto out_no_epoch;
+
+	INIT_LIST_HEAD(&mdev->current_epoch->list);
+	mdev->epochs = 1;
+
+	return mdev;
+
+/* out_whatever_else:
+	kfree(mdev->current_epoch); */
+out_no_epoch:
+	kfree(mdev->app_reads_hash);
+out_no_app_reads:
+	tl_cleanup(mdev);
+out_no_tl:
+	drbd_bm_cleanup(mdev);
+out_no_bitmap:
+	__free_page(mdev->md_io_page);
+out_no_io_page:
+	put_disk(disk);
+out_no_disk:
+	blk_cleanup_queue(q);
+out_no_q:
+	kfree(mdev);
+	return NULL;
+}
+
+/* counterpart of drbd_new_device.
+ * last part of drbd_delete_device. */
+void drbd_free_mdev(struct drbd_conf *mdev)
+{
+	kfree(mdev->current_epoch);
+	kfree(mdev->app_reads_hash);
+	tl_cleanup(mdev);
+	if (mdev->bitmap) /* should no longer be there. */
+		drbd_bm_cleanup(mdev);
+	__free_page(mdev->md_io_page);
+	put_disk(mdev->vdisk);
+	blk_cleanup_queue(mdev->rq_queue);
+	kfree(mdev);
+}
+
+
+int __init drbd_init(void)
+{
+	int err;
+
+	if (sizeof(struct Drbd_HandShake_Packet) != 80) {
+		printk(KERN_ERR
+		       "drbd: never change the size or layout "
+		       "of the HandShake packet.\n");
+		return -EINVAL;
+	}
+
+	if (1 > minor_count || minor_count > 255) {
+		printk(KERN_ERR
+			"drbd: invalid minor_count (%d)\n", minor_count);
+#ifdef MODULE
+		return -EINVAL;
+#else
+		minor_count = 8;
+#endif
+	}
+
+	err = drbd_nl_init();
+	if (err)
+		return err;
+
+	err = register_blkdev(DRBD_MAJOR, "drbd");
+	if (err) {
+		printk(KERN_ERR
+		       "drbd: unable to register block device major %d\n",
+		       DRBD_MAJOR);
+		return err;
+	}
+
+	register_reboot_notifier(&drbd_notifier);
+
+	/*
+	 * allocate all necessary structs
+	 */
+	err = -ENOMEM;
+
+	init_waitqueue_head(&drbd_pp_wait);
+
+	drbd_proc = NULL; /* play safe for drbd_cleanup */
+	minor_table = kzalloc(sizeof(struct drbd_conf *)*minor_count,
+				GFP_KERNEL);
+	if (!minor_table)
+		goto Enomem;
+
+	err = drbd_create_mempools();
+	if (err)
+		goto Enomem;
+
+	drbd_proc = proc_create("drbd", S_IFREG | S_IRUGO , NULL, &drbd_proc_fops);
+	if (!drbd_proc)	{
+		printk(KERN_ERR "drbd: unable to register proc file\n");
+		goto Enomem;
+	}
+
+	rwlock_init(&global_state_lock);
+
+	printk(KERN_INFO "drbd: initialised. "
+	       "Version: " REL_VERSION " (api:%d/proto:%d-%d)\n",
+	       API_VERSION, PRO_VERSION_MIN, PRO_VERSION_MAX);
+	printk(KERN_INFO "drbd: %s\n", drbd_buildtag());
+	printk(KERN_INFO "drbd: registered as block device major %d\n",
+		DRBD_MAJOR);
+	printk(KERN_INFO "drbd: minor_table @ 0x%p\n", minor_table);
+
+	return 0; /* Success! */
+
+Enomem:
+	drbd_cleanup();
+	if (err == -ENOMEM)
+		/* currently always the case */
+		printk(KERN_ERR "drbd: ran out of memory\n");
+	else
+		printk(KERN_ERR "drbd: initialization failure\n");
+	return err;
+}
+
+void drbd_free_bc(struct drbd_backing_dev *bc)
+{
+	if (bc == NULL)
+		return;
+
+	bd_release(bc->backing_bdev);
+	bd_release(bc->md_bdev);
+
+	fput(bc->lo_file);
+	fput(bc->md_file);
+
+	kfree(bc);
+}
+
+void drbd_free_sock(struct drbd_conf *mdev)
+{
+	if (mdev->data.socket) {
+		sock_release(mdev->data.socket);
+		mdev->data.socket = NULL;
+	}
+	if (mdev->meta.socket) {
+		sock_release(mdev->meta.socket);
+		mdev->meta.socket = NULL;
+	}
+}
+
+
+void drbd_free_resources(struct drbd_conf *mdev)
+{
+	crypto_free_hash(mdev->csums_tfm);
+	mdev->csums_tfm = NULL;
+	crypto_free_hash(mdev->verify_tfm);
+	mdev->verify_tfm = NULL;
+	crypto_free_hash(mdev->cram_hmac_tfm);
+	mdev->cram_hmac_tfm = NULL;
+	crypto_free_hash(mdev->integrity_w_tfm);
+	mdev->integrity_w_tfm = NULL;
+	crypto_free_hash(mdev->integrity_r_tfm);
+	mdev->integrity_r_tfm = NULL;
+
+	drbd_free_sock(mdev);
+
+	__no_warn(local,
+		  drbd_free_bc(mdev->bc);
+		  mdev->bc = NULL;);
+}
+
+/*********************************/
+/* meta data management */
+
+struct meta_data_on_disk {
+	u64 la_size;           /* last agreed size. */
+	u64 uuid[UUID_SIZE];   /* UUIDs. */
+	u64 device_uuid;
+	u64 reserved_u64_1;
+	u32 flags;             /* MDF */
+	u32 magic;
+	u32 md_size_sect;
+	u32 al_offset;         /* offset to this block */
+	u32 al_nr_extents;     /* important for restoring the AL */
+	      /* `-- act_log->nr_elements <-- sync_conf.al_extents */
+	u32 bm_offset;         /* offset to the bitmap, from here */
+	u32 bm_bytes_per_bit;  /* BM_BLOCK_SIZE */
+	u32 reserved_u32[4];
+
+} __attribute((packed));
+
+/**
+ * drbd_md_sync:
+ * Writes the meta data super block if the MD_DIRTY flag bit is set.
+ */
+void drbd_md_sync(struct drbd_conf *mdev)
+{
+	struct meta_data_on_disk *buffer;
+	sector_t sector;
+	int i;
+
+	if (!test_and_clear_bit(MD_DIRTY, &mdev->flags))
+		return;
+	del_timer(&mdev->md_sync_timer);
+
+	/* We use here Failed and not Attaching because we try to write
+	 * metadata even if we detach due to a disk failure! */
+	if (!inc_local_if_state(mdev, Failed))
+		return;
+
+	MTRACE(TraceTypeMDIO, TraceLvlSummary,
+	       INFO("Writing meta data super block now.\n");
+	       );
+
+	mutex_lock(&mdev->md_io_mutex);
+	buffer = (struct meta_data_on_disk *)page_address(mdev->md_io_page);
+	memset(buffer, 0, 512);
+
+	buffer->la_size = cpu_to_be64(drbd_get_capacity(mdev->this_bdev));
+	for (i = Current; i < UUID_SIZE; i++)
+		buffer->uuid[i] = cpu_to_be64(mdev->bc->md.uuid[i]);
+	buffer->flags = cpu_to_be32(mdev->bc->md.flags);
+	buffer->magic = cpu_to_be32(DRBD_MD_MAGIC);
+
+	buffer->md_size_sect  = cpu_to_be32(mdev->bc->md.md_size_sect);
+	buffer->al_offset     = cpu_to_be32(mdev->bc->md.al_offset);
+	buffer->al_nr_extents = cpu_to_be32(mdev->act_log->nr_elements);
+	buffer->bm_bytes_per_bit = cpu_to_be32(BM_BLOCK_SIZE);
+	buffer->device_uuid = cpu_to_be64(mdev->bc->md.device_uuid);
+
+	buffer->bm_offset = cpu_to_be32(mdev->bc->md.bm_offset);
+
+	D_ASSERT(drbd_md_ss__(mdev, mdev->bc) == mdev->bc->md.md_offset);
+	sector = mdev->bc->md.md_offset;
+
+	if (drbd_md_sync_page_io(mdev, mdev->bc, sector, WRITE)) {
+		clear_bit(MD_DIRTY, &mdev->flags);
+	} else {
+		/* this was a try anyways ... */
+		ERR("meta data update failed!\n");
+
+		drbd_chk_io_error(mdev, 1, TRUE);
+		drbd_io_error(mdev, TRUE);
+	}
+
+	/* Update mdev->bc->md.la_size_sect,
+	 * since we updated it on metadata. */
+	mdev->bc->md.la_size_sect = drbd_get_capacity(mdev->this_bdev);
+
+	mutex_unlock(&mdev->md_io_mutex);
+	dec_local(mdev);
+}
+
+/**
+ * drbd_md_read:
+ * @bdev: describes the backing storage and the meta-data storage
+ * Reads the meta data from bdev. Return 0 (NoError) on success, and an
+ * enum ret_codes in case something goes wrong.
+ * Currently only: MDIOError, MDInvalid.
+ */
+int drbd_md_read(struct drbd_conf *mdev, struct drbd_backing_dev *bdev)
+{
+	struct meta_data_on_disk *buffer;
+	int i, rv = NoError;
+
+	if (!inc_local_if_state(mdev, Attaching))
+		return MDIOError;
+
+	mutex_lock(&mdev->md_io_mutex);
+	buffer = (struct meta_data_on_disk *)page_address(mdev->md_io_page);
+
+	if (!drbd_md_sync_page_io(mdev, bdev, bdev->md.md_offset, READ)) {
+		/* NOTE: cant do normal error processing here as this is
+		   called BEFORE disk is attached */
+		ERR("Error while reading metadata.\n");
+		rv = MDIOError;
+		goto err;
+	}
+
+	if (be32_to_cpu(buffer->magic) != DRBD_MD_MAGIC) {
+		ERR("Error while reading metadata, magic not found.\n");
+		rv = MDInvalid;
+		goto err;
+	}
+	if (be32_to_cpu(buffer->al_offset) != bdev->md.al_offset) {
+		ERR("unexpected al_offset: %d (expected %d)\n",
+		    be32_to_cpu(buffer->al_offset), bdev->md.al_offset);
+		rv = MDInvalid;
+		goto err;
+	}
+	if (be32_to_cpu(buffer->bm_offset) != bdev->md.bm_offset) {
+		ERR("unexpected bm_offset: %d (expected %d)\n",
+		    be32_to_cpu(buffer->bm_offset), bdev->md.bm_offset);
+		rv = MDInvalid;
+		goto err;
+	}
+	if (be32_to_cpu(buffer->md_size_sect) != bdev->md.md_size_sect) {
+		ERR("unexpected md_size: %u (expected %u)\n",
+		    be32_to_cpu(buffer->md_size_sect), bdev->md.md_size_sect);
+		rv = MDInvalid;
+		goto err;
+	}
+
+	if (be32_to_cpu(buffer->bm_bytes_per_bit) != BM_BLOCK_SIZE) {
+		ERR("unexpected bm_bytes_per_bit: %u (expected %u)\n",
+		    be32_to_cpu(buffer->bm_bytes_per_bit), BM_BLOCK_SIZE);
+		rv = MDInvalid;
+		goto err;
+	}
+
+	bdev->md.la_size_sect = be64_to_cpu(buffer->la_size);
+	for (i = Current; i < UUID_SIZE; i++)
+		bdev->md.uuid[i] = be64_to_cpu(buffer->uuid[i]);
+	bdev->md.flags = be32_to_cpu(buffer->flags);
+	mdev->sync_conf.al_extents = be32_to_cpu(buffer->al_nr_extents);
+	bdev->md.device_uuid = be64_to_cpu(buffer->device_uuid);
+
+	if (mdev->sync_conf.al_extents < 7)
+		mdev->sync_conf.al_extents = 127;
+
+ err:
+	mutex_unlock(&mdev->md_io_mutex);
+	dec_local(mdev);
+
+	return rv;
+}
+
+/**
+ * drbd_md_mark_dirty:
+ * Call this function if you change enything that should be written to
+ * the meta-data super block. This function sets MD_DIRTY, and starts a
+ * timer that ensures that within five seconds you have to call drbd_md_sync().
+ */
+void drbd_md_mark_dirty(struct drbd_conf *mdev)
+{
+	set_bit(MD_DIRTY, &mdev->flags);
+	mod_timer(&mdev->md_sync_timer, jiffies + 5*HZ);
+}
+
+
+STATIC void drbd_uuid_move_history(struct drbd_conf *mdev) __must_hold(local)
+{
+	int i;
+
+	for (i = History_start; i < History_end; i++) {
+		mdev->bc->md.uuid[i+1] = mdev->bc->md.uuid[i];
+
+		MTRACE(TraceTypeUuid, TraceLvlAll,
+		       drbd_print_uuid(mdev, i+1);
+			);
+	}
+}
+
+void _drbd_uuid_set(struct drbd_conf *mdev, int idx, u64 val) __must_hold(local)
+{
+	if (idx == Current) {
+		if (mdev->state.role == Primary)
+			val |= 1;
+		else
+			val &= ~((u64)1);
+
+		drbd_set_ed_uuid(mdev, val);
+	}
+
+	mdev->bc->md.uuid[idx] = val;
+
+	MTRACE(TraceTypeUuid, TraceLvlSummary,
+	       drbd_print_uuid(mdev, idx);
+		);
+
+	drbd_md_mark_dirty(mdev);
+}
+
+
+void drbd_uuid_set(struct drbd_conf *mdev, int idx, u64 val) __must_hold(local)
+{
+	if (mdev->bc->md.uuid[idx]) {
+		drbd_uuid_move_history(mdev);
+		mdev->bc->md.uuid[History_start] = mdev->bc->md.uuid[idx];
+		MTRACE(TraceTypeUuid, TraceLvlMetrics,
+		       drbd_print_uuid(mdev, History_start);
+			);
+	}
+	_drbd_uuid_set(mdev, idx, val);
+}
+
+/**
+ * drbd_uuid_new_current:
+ * Creates a new current UUID, and rotates the old current UUID into
+ * the bitmap slot. Causes an incremental resync upon next connect.
+ */
+void drbd_uuid_new_current(struct drbd_conf *mdev) __must_hold(local)
+{
+	u64 val;
+
+	INFO("Creating new current UUID\n");
+	D_ASSERT(mdev->bc->md.uuid[Bitmap] == 0);
+	mdev->bc->md.uuid[Bitmap] = mdev->bc->md.uuid[Current];
+	MTRACE(TraceTypeUuid, TraceLvlMetrics,
+	       drbd_print_uuid(mdev, Bitmap);
+		);
+
+	get_random_bytes(&val, sizeof(u64));
+	_drbd_uuid_set(mdev, Current, val);
+}
+
+void drbd_uuid_set_bm(struct drbd_conf *mdev, u64 val) __must_hold(local)
+{
+	if (mdev->bc->md.uuid[Bitmap] == 0 && val == 0)
+		return;
+
+	if (val == 0) {
+		drbd_uuid_move_history(mdev);
+		mdev->bc->md.uuid[History_start] = mdev->bc->md.uuid[Bitmap];
+		mdev->bc->md.uuid[Bitmap] = 0;
+
+		MTRACE(TraceTypeUuid, TraceLvlMetrics,
+		       drbd_print_uuid(mdev, History_start);
+		       drbd_print_uuid(mdev, Bitmap);
+			);
+	} else {
+		if (mdev->bc->md.uuid[Bitmap])
+			drbd_WARN("bm UUID already set");
+
+		mdev->bc->md.uuid[Bitmap] = val;
+		mdev->bc->md.uuid[Bitmap] &= ~((u64)1);
+
+		MTRACE(TraceTypeUuid, TraceLvlMetrics,
+		       drbd_print_uuid(mdev, Bitmap);
+			);
+	}
+	drbd_md_mark_dirty(mdev);
+}
+
+/**
+ * drbd_bmio_set_n_write:
+ * Is an io_fn for drbd_queue_bitmap_io() or drbd_bitmap_io() that sets
+ * all bits in the bitmap and writes the whole bitmap to stable storage.
+ */
+int drbd_bmio_set_n_write(struct drbd_conf *mdev)
+{
+	int rv = -EIO;
+
+	if (inc_local_if_state(mdev, Attaching)) {
+		drbd_md_set_flag(mdev, MDF_FullSync);
+		drbd_md_sync(mdev);
+		drbd_bm_set_all(mdev);
+
+		rv = drbd_bm_write(mdev);
+
+		if (!rv) {
+			drbd_md_clear_flag(mdev, MDF_FullSync);
+			drbd_md_sync(mdev);
+		}
+
+		dec_local(mdev);
+	}
+
+	return rv;
+}
+
+/**
+ * drbd_bmio_clear_n_write:
+ * Is an io_fn for drbd_queue_bitmap_io() or drbd_bitmap_io() that clears
+ * all bits in the bitmap and writes the whole bitmap to stable storage.
+ */
+int drbd_bmio_clear_n_write(struct drbd_conf *mdev)
+{
+	int rv = -EIO;
+
+	if (inc_local_if_state(mdev, Attaching)) {
+		drbd_bm_clear_all(mdev);
+		rv = drbd_bm_write(mdev);
+		dec_local(mdev);
+	}
+
+	return rv;
+}
+
+STATIC int w_bitmap_io(struct drbd_conf *mdev, struct drbd_work *w, int unused)
+{
+	struct bm_io_work *work = (struct bm_io_work *)w;
+	int rv;
+
+	D_ASSERT(atomic_read(&mdev->ap_bio_cnt) == 0);
+
+	drbd_bm_lock(mdev, work->why);
+	rv = work->io_fn(mdev);
+	drbd_bm_unlock(mdev);
+
+	clear_bit(BITMAP_IO, &mdev->flags);
+	wake_up(&mdev->misc_wait);
+
+	if (work->done)
+		work->done(mdev, rv);
+
+	clear_bit(BITMAP_IO_QUEUED, &mdev->flags);
+	work->why = NULL;
+
+	return 1;
+}
+
+/**
+ * drbd_queue_bitmap_io:
+ * Queues an IO operation on the whole bitmap.
+ * While IO on the bitmap happens we freeze appliation IO thus we ensure
+ * that drbd_set_out_of_sync() can not be called.
+ * This function MUST ONLY be called from worker context.
+ * BAD API ALERT!
+ * It MUST NOT be used while a previous such work is still pending!
+ */
+void drbd_queue_bitmap_io(struct drbd_conf *mdev,
+			  int (*io_fn)(struct drbd_conf *),
+			  void (*done)(struct drbd_conf *, int),
+			  char *why)
+{
+	D_ASSERT(current == mdev->worker.task);
+
+	D_ASSERT(!test_bit(BITMAP_IO_QUEUED, &mdev->flags));
+	D_ASSERT(!test_bit(BITMAP_IO, &mdev->flags));
+	D_ASSERT(list_empty(&mdev->bm_io_work.w.list));
+	if (mdev->bm_io_work.why)
+		ERR("FIXME going to queue '%s' but '%s' still pending?\n",
+			why, mdev->bm_io_work.why);
+
+	mdev->bm_io_work.io_fn = io_fn;
+	mdev->bm_io_work.done = done;
+	mdev->bm_io_work.why = why;
+
+	set_bit(BITMAP_IO, &mdev->flags);
+	if (atomic_read(&mdev->ap_bio_cnt) == 0) {
+		if (list_empty(&mdev->bm_io_work.w.list)) {
+			set_bit(BITMAP_IO_QUEUED, &mdev->flags);
+			drbd_queue_work(&mdev->data.work, &mdev->bm_io_work.w);
+		} else
+			ERR("FIXME avoided double queuing bm_io_work\n");
+	}
+}
+
+/**
+ * drbd_bitmap_io:
+ * Does an IO operation on the bitmap, freezing application IO while that
+ * IO operations runs. This functions MUST NOT be called from worker context.
+ */
+int drbd_bitmap_io(struct drbd_conf *mdev, int (*io_fn)(struct drbd_conf *), char *why)
+{
+	int rv;
+
+	D_ASSERT(current != mdev->worker.task);
+
+	drbd_suspend_io(mdev);
+
+	drbd_bm_lock(mdev, why);
+	rv = io_fn(mdev);
+	drbd_bm_unlock(mdev);
+
+	drbd_resume_io(mdev);
+
+	return rv;
+}
+
+void drbd_md_set_flag(struct drbd_conf *mdev, int flag) __must_hold(local)
+{
+	if ((mdev->bc->md.flags & flag) != flag) {
+		drbd_md_mark_dirty(mdev);
+		mdev->bc->md.flags |= flag;
+	}
+}
+
+void drbd_md_clear_flag(struct drbd_conf *mdev, int flag) __must_hold(local)
+{
+	if ((mdev->bc->md.flags & flag) != 0) {
+		drbd_md_mark_dirty(mdev);
+		mdev->bc->md.flags &= ~flag;
+	}
+}
+int drbd_md_test_flag(struct drbd_backing_dev *bdev, int flag)
+{
+	return (bdev->md.flags & flag) != 0;
+}
+
+STATIC void md_sync_timer_fn(unsigned long data)
+{
+	struct drbd_conf *mdev = (struct drbd_conf *) data;
+
+	drbd_queue_work_front(&mdev->data.work, &mdev->md_sync_work);
+}
+
+STATIC int w_md_sync(struct drbd_conf *mdev, struct drbd_work *w, int unused)
+{
+	drbd_WARN("md_sync_timer expired! Worker calls drbd_md_sync().\n");
+	drbd_md_sync(mdev);
+
+	return 1;
+}
+
+#ifdef DRBD_ENABLE_FAULTS
+/* Fault insertion support including random number generator shamelessly
+ * stolen from kernel/rcutorture.c */
+struct fault_random_state {
+	unsigned long state;
+	unsigned long count;
+};
+
+#define FAULT_RANDOM_MULT 39916801  /* prime */
+#define FAULT_RANDOM_ADD	479001701 /* prime */
+#define FAULT_RANDOM_REFRESH 10000
+
+/*
+ * Crude but fast random-number generator.  Uses a linear congruential
+ * generator, with occasional help from get_random_bytes().
+ */
+STATIC unsigned long
+_drbd_fault_random(struct fault_random_state *rsp)
+{
+	long refresh;
+
+	if (--rsp->count < 0) {
+		get_random_bytes(&refresh, sizeof(refresh));
+		rsp->state += refresh;
+		rsp->count = FAULT_RANDOM_REFRESH;
+	}
+	rsp->state = rsp->state * FAULT_RANDOM_MULT + FAULT_RANDOM_ADD;
+	return swahw32(rsp->state);
+}
+
+STATIC char *
+_drbd_fault_str(unsigned int type) {
+	static char *_faults[] = {
+		"Meta-data write",
+		"Meta-data read",
+		"Resync write",
+		"Resync read",
+		"Data write",
+		"Data read",
+		"Data read ahead",
+		"BM allocation",
+		"EE allocation"
+	};
+
+	return (type < DRBD_FAULT_MAX) ? _faults[type] : "**Unknown**";
+}
+
+unsigned int
+_drbd_insert_fault(struct drbd_conf *mdev, unsigned int type)
+{
+	static struct fault_random_state rrs = {0, 0};
+
+	unsigned int ret = (
+		(fault_devs == 0 ||
+			((1 << mdev_to_minor(mdev)) & fault_devs) != 0) &&
+		(((_drbd_fault_random(&rrs) % 100) + 1) <= fault_rate));
+
+	if (ret) {
+		fault_count++;
+
+		if (printk_ratelimit())
+			drbd_WARN("***Simulating %s failure\n",
+				_drbd_fault_str(type));
+	}
+
+	return ret;
+}
+#endif
+
+#ifdef ENABLE_DYNAMIC_TRACE
+
+STATIC char *_drbd_uuid_str(unsigned int idx)
+{
+	static char *uuid_str[] = {
+		"Current",
+		"Bitmap",
+		"History_start",
+		"History_end",
+		"UUID_SIZE",
+		"UUID_FLAGS",
+	};
+
+	return (idx < EXT_UUID_SIZE) ? uuid_str[idx] : "*Unknown UUID index*";
+}
+
+/* Pretty print a UUID value */
+void drbd_print_uuid(struct drbd_conf *mdev, unsigned int idx) __must_hold(local)
+{
+	INFO(" uuid[%s] now %016llX\n",
+	     _drbd_uuid_str(idx), (unsigned long long)mdev->bc->md.uuid[idx]);
+}
+
+
+/*
+ *
+ * drbd_print_buffer
+ *
+ * This routine dumps binary data to the debugging output. Can be
+ * called at interrupt level.
+ *
+ * Arguments:
+ *
+ *     prefix      - String is output at the beginning of each line output
+ *     flags       - Control operation of the routine. Currently defined
+ *                   Flags are:
+ *                   DBGPRINT_BUFFADDR; if set, each line starts with the
+ *                       virtual address of the line being outupt. If clear,
+ *                       each line starts with the offset from the beginning
+ *                       of the buffer.
+ *     size        - Indicates the size of each entry in the buffer. Supported
+ *                   values are sizeof(char), sizeof(short) and sizeof(int)
+ *     buffer      - Start address of buffer
+ *     buffer_va   - Virtual address of start of buffer (normally the same
+ *                   as Buffer, but having it separate allows it to hold
+ *                   file address for example)
+ *     length      - length of buffer
+ *
+ */
+void
+drbd_print_buffer(const char *prefix, unsigned int flags, int size,
+		  const void *buffer, const void *buffer_va,
+		  unsigned int length)
+
+#define LINE_SIZE       16
+#define LINE_ENTRIES    (int)(LINE_SIZE/size)
+{
+	const unsigned char *pstart;
+	const unsigned char *pstart_va;
+	const unsigned char *pend;
+	char bytes_str[LINE_SIZE*3+8], ascii_str[LINE_SIZE+8];
+	char *pbytes = bytes_str, *pascii = ascii_str;
+	int  offset = 0;
+	long sizemask;
+	int  field_width;
+	int  index;
+	const unsigned char *pend_str;
+	const unsigned char *p;
+	int count;
+
+	/* verify size parameter */
+	if (size != sizeof(char) &&
+	    size != sizeof(short) &&
+	    size != sizeof(int)) {
+		printk(KERN_DEBUG "drbd_print_buffer: "
+			"ERROR invalid size %d\n", size);
+		return;
+	}
+
+	sizemask = size-1;
+	field_width = size*2;
+
+	/* Adjust start/end to be on appropriate boundary for size */
+	buffer = (const char *)((long)buffer & ~sizemask);
+	pend   = (const unsigned char *)
+		(((long)buffer + length + sizemask) & ~sizemask);
+
+	if (flags & DBGPRINT_BUFFADDR) {
+		/* Move start back to nearest multiple of line size,
+		 * if printing address. This results in nicely formatted output
+		 * with addresses being on line size (16) byte boundaries */
+		pstart = (const unsigned char *)((long)buffer & ~(LINE_SIZE-1));
+	} else {
+		pstart = (const unsigned char *)buffer;
+	}
+
+	/* Set value of start VA to print if addresses asked for */
+	pstart_va = (const unsigned char *)buffer_va
+		 - ((const unsigned char *)buffer-pstart);
+
+	/* Calculate end position to nicely align right hand side */
+	pend_str = pstart + (((pend-pstart) + LINE_SIZE-1) & ~(LINE_SIZE-1));
+
+	/* Init strings */
+	*pbytes = *pascii = '\0';
+
+	/* Start at beginning of first line */
+	p = pstart;
+	count = 0;
+
+	while (p < pend_str) {
+		if (p < (const unsigned char *)buffer || p >= pend) {
+			/* Before start of buffer or after end- print spaces */
+			pbytes += sprintf(pbytes, "%*c ", field_width, ' ');
+			pascii += sprintf(pascii, "%*c", size, ' ');
+			p += size;
+		} else {
+			/* Add hex and ascii to strings */
+			int val;
+			switch (size) {
+			default:
+			case 1:
+				val = *(unsigned char *)p;
+				break;
+			case 2:
+				val = *(unsigned short *)p;
+				break;
+			case 4:
+				val = *(unsigned int *)p;
+				break;
+			}
+
+			pbytes += sprintf(pbytes, "%0*x ", field_width, val);
+
+			for (index = size; index; index--) {
+				*pascii++ = isprint(*p) ? *p : '.';
+				p++;
+			}
+		}
+
+		count++;
+
+		if (count == LINE_ENTRIES || p >= pend_str) {
+			/* Null terminate and print record */
+			*pascii = '\0';
+			printk(KERN_DEBUG "%s%8.8lx: %*s|%*s|\n",
+			       prefix,
+			       (flags & DBGPRINT_BUFFADDR)
+			       ? (long)pstart_va:(long)offset,
+			       LINE_ENTRIES*(field_width+1), bytes_str,
+			       LINE_SIZE, ascii_str);
+
+			/* Move onto next line */
+			pstart_va += (p-pstart);
+			pstart = p;
+			count  = 0;
+			offset += LINE_SIZE;
+
+			/* Re-init strings */
+			pbytes = bytes_str;
+			pascii = ascii_str;
+			*pbytes = *pascii = '\0';
+		}
+	}
+}
+
+#define PSM(A)							\
+do {								\
+	if (mask.A) {						\
+		int i = snprintf(p, len, " " #A "( %s )",	\
+				A##s_to_name(val.A));		\
+		if (i >= len)					\
+			return op;				\
+		p += i;						\
+		len -= i;					\
+	}							\
+} while (0)
+
+STATIC char *dump_st(char *p, int len, union drbd_state_t mask, union drbd_state_t val)
+{
+	char *op = p;
+	*p = '\0';
+	PSM(role);
+	PSM(peer);
+	PSM(conn);
+	PSM(disk);
+	PSM(pdsk);
+
+	return op;
+}
+
+#define INFOP(fmt, args...) \
+do { \
+	if (trace_level >= TraceLvlAll) { \
+		INFO("%s:%d: %s [%d] %s %s " fmt , \
+		     file, line, current->comm, current->pid, \
+		     sockname, recv ? "<<<" : ">>>" , \
+		     ## args); \
+	} else { \
+		INFO("%s %s " fmt, sockname, \
+		     recv ? "<<<" : ">>>" , \
+		     ## args); \
+	} \
+} while (0)
+
+STATIC char *_dump_block_id(u64 block_id, char *buff)
+{
+	if (is_syncer_block_id(block_id))
+		strcpy(buff, "SyncerId");
+	else
+		sprintf(buff, "%llx", (unsigned long long)block_id);
+
+	return buff;
+}
+
+void
+_dump_packet(struct drbd_conf *mdev, struct socket *sock,
+	    int recv, union Drbd_Polymorph_Packet *p, char *file, int line)
+{
+	char *sockname = sock == mdev->meta.socket ? "meta" : "data";
+	int cmd = (recv == 2) ? p->head.command : be16_to_cpu(p->head.command);
+	char tmp[300];
+	union drbd_state_t m, v;
+
+	switch (cmd) {
+	case HandShake:
+		INFOP("%s (protocol %u-%u)\n", cmdname(cmd),
+			be32_to_cpu(p->HandShake.protocol_min),
+			be32_to_cpu(p->HandShake.protocol_max));
+		break;
+
+	case ReportBitMap: /* don't report this */
+	case ReportCBitMap: /* don't report this */
+		break;
+
+	case Data:
+		INFOP("%s (sector %llus, id %s, seq %u, f %x)\n", cmdname(cmd),
+		      (unsigned long long)be64_to_cpu(p->Data.sector),
+		      _dump_block_id(p->Data.block_id, tmp),
+		      be32_to_cpu(p->Data.seq_num),
+		      be32_to_cpu(p->Data.dp_flags)
+			);
+		break;
+
+	case DataReply:
+	case RSDataReply:
+		INFOP("%s (sector %llus, id %s)\n", cmdname(cmd),
+		      (unsigned long long)be64_to_cpu(p->Data.sector),
+		      _dump_block_id(p->Data.block_id, tmp)
+			);
+		break;
+
+	case RecvAck:
+	case WriteAck:
+	case RSWriteAck:
+	case DiscardAck:
+	case NegAck:
+	case NegRSDReply:
+		INFOP("%s (sector %llus, size %u, id %s, seq %u)\n",
+			cmdname(cmd),
+		      (long long)be64_to_cpu(p->BlockAck.sector),
+		      be32_to_cpu(p->BlockAck.blksize),
+		      _dump_block_id(p->BlockAck.block_id, tmp),
+		      be32_to_cpu(p->BlockAck.seq_num)
+			);
+		break;
+
+	case DataRequest:
+	case RSDataRequest:
+		INFOP("%s (sector %llus, size %u, id %s)\n", cmdname(cmd),
+		      (long long)be64_to_cpu(p->BlockRequest.sector),
+		      be32_to_cpu(p->BlockRequest.blksize),
+		      _dump_block_id(p->BlockRequest.block_id, tmp)
+			);
+		break;
+
+	case Barrier:
+	case BarrierAck:
+		INFOP("%s (barrier %u)\n", cmdname(cmd), p->Barrier.barrier);
+		break;
+
+	case SyncParam:
+	case SyncParam89:
+		INFOP("%s (rate %u, verify-alg \"%.64s\", csums-alg \"%.64s\")\n",
+			cmdname(cmd), be32_to_cpu(p->SyncParam89.rate),
+			p->SyncParam89.verify_alg, p->SyncParam89.csums_alg);
+		break;
+
+	case ReportUUIDs:
+		INFOP("%s Curr:%016llX, Bitmap:%016llX, "
+		      "HisSt:%016llX, HisEnd:%016llX\n",
+		      cmdname(cmd),
+		      (unsigned long long)be64_to_cpu(p->GenCnt.uuid[Current]),
+		      (unsigned long long)be64_to_cpu(p->GenCnt.uuid[Bitmap]),
+		      (unsigned long long)be64_to_cpu(p->GenCnt.uuid[History_start]),
+		      (unsigned long long)be64_to_cpu(p->GenCnt.uuid[History_end]));
+		break;
+
+	case ReportSizes:
+		INFOP("%s (d %lluMiB, u %lluMiB, c %lldMiB, "
+		      "max bio %x, q order %x)\n",
+		      cmdname(cmd),
+		      (long long)(be64_to_cpu(p->Sizes.d_size)>>(20-9)),
+		      (long long)(be64_to_cpu(p->Sizes.u_size)>>(20-9)),
+		      (long long)(be64_to_cpu(p->Sizes.c_size)>>(20-9)),
+		      be32_to_cpu(p->Sizes.max_segment_size),
+		      be32_to_cpu(p->Sizes.queue_order_type));
+		break;
+
+	case ReportState:
+		v.i = be32_to_cpu(p->State.state);
+		m.i = 0xffffffff;
+		dump_st(tmp, sizeof(tmp), m, v);
+		INFOP("%s (s %x {%s})\n", cmdname(cmd), v.i, tmp);
+		break;
+
+	case StateChgRequest:
+		m.i = be32_to_cpu(p->ReqState.mask);
+		v.i = be32_to_cpu(p->ReqState.val);
+		dump_st(tmp, sizeof(tmp), m, v);
+		INFOP("%s (m %x v %x {%s})\n", cmdname(cmd), m.i, v.i, tmp);
+		break;
+
+	case StateChgReply:
+		INFOP("%s (ret %x)\n", cmdname(cmd),
+		      be32_to_cpu(p->RqSReply.retcode));
+		break;
+
+	case Ping:
+	case PingAck:
+		/*
+		 * Dont trace pings at summary level
+		 */
+		if (trace_level < TraceLvlAll)
+			break;
+		/* fall through... */
+	default:
+		INFOP("%s (%u)\n", cmdname(cmd), cmd);
+		break;
+	}
+}
+
+/* Debug routine to dump info about bio */
+
+void _dump_bio(const char *pfx, struct drbd_conf *mdev, struct bio *bio, int complete, struct drbd_request *r)
+{
+#ifdef CONFIG_LBD
+#define SECTOR_FORMAT "%Lx"
+#else
+#define SECTOR_FORMAT "%lx"
+#endif
+#define SECTOR_SHIFT 9
+
+	unsigned long lowaddr = (unsigned long)(bio->bi_sector << SECTOR_SHIFT);
+	char *faddr = (char *)(lowaddr);
+	char rb[sizeof(void *)*2+6] = { 0, };
+	struct bio_vec *bvec;
+	int segno;
+
+	const int rw = bio->bi_rw;
+	const int biorw      = (rw & (RW_MASK|RWA_MASK));
+	const int biobarrier = (rw & (1<<BIO_RW_BARRIER));
+	const int biosync    = (rw & ((1<<BIO_RW_UNPLUG) | (1<<BIO_RW_SYNCIO)));
+
+	if (r)
+		sprintf(rb, "Req:%p ", r);
+
+	INFO("%s %s:%s%s%s Bio:%p %s- %soffset " SECTOR_FORMAT ", size %x\n",
+	     complete ? "<<<" : ">>>",
+	     pfx,
+	     biorw == WRITE ? "Write" : "Read",
+	     biobarrier ? " : B" : "",
+	     biosync ? " : S" : "",
+	     bio,
+	     rb,
+	     complete ? (drbd_bio_uptodate(bio) ? "Success, " : "Failed, ") : "",
+	     bio->bi_sector << SECTOR_SHIFT,
+	     bio->bi_size);
+
+	if (trace_level >= TraceLvlMetrics &&
+	    ((biorw == WRITE) ^ complete)) {
+		printk(KERN_DEBUG "  ind     page   offset   length\n");
+		__bio_for_each_segment(bvec, bio, segno, 0) {
+			printk(KERN_DEBUG "  [%d] %p %8.8x %8.8x\n", segno,
+			       bvec->bv_page, bvec->bv_offset, bvec->bv_len);
+
+			if (trace_level >= TraceLvlAll) {
+				char *bvec_buf;
+				unsigned long flags;
+
+				bvec_buf = bvec_kmap_irq(bvec, &flags);
+
+				drbd_print_buffer("    ", DBGPRINT_BUFFADDR, 1,
+						  bvec_buf,
+						  faddr,
+						  (bvec->bv_len <= 0x80)
+						  ? bvec->bv_len : 0x80);
+
+				bvec_kunmap_irq(bvec_buf, &flags);
+
+				if (bvec->bv_len > 0x40)
+					printk(KERN_DEBUG "    ....\n");
+
+				faddr += bvec->bv_len;
+			}
+		}
+	}
+}
+#endif
+
+module_init(drbd_init)
+module_exit(drbd_cleanup)
--- linux-rt-2.6.31.orig/ubuntu/drbd/drbd_worker.c
+++ linux-rt-2.6.31/ubuntu/drbd/drbd_worker.c
@@ -0,0 +1,1465 @@
+/*
+   drbd_worker.c
+
+   This file is part of DRBD by Philipp Reisner and Lars Ellenberg.
+
+   Copyright (C) 2001-2008, LINBIT Information Technologies GmbH.
+   Copyright (C) 1999-2008, Philipp Reisner <philipp.reisner@linbit.com>.
+   Copyright (C) 2002-2008, Lars Ellenberg <lars.ellenberg@linbit.com>.
+
+   drbd is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 2, or (at your option)
+   any later version.
+
+   drbd is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with drbd; see the file COPYING.  If not, write to
+   the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
+
+ */
+
+#include <linux/autoconf.h>
+#include <linux/module.h>
+#include <linux/version.h>
+
+#include <linux/sched.h>
+#include <linux/smp_lock.h>
+#include <linux/wait.h>
+#include <linux/mm.h>
+#include <linux/drbd_config.h>
+#include <linux/memcontrol.h>
+#include <linux/mm_inline.h>
+#include <linux/slab.h>
+#include <linux/random.h>
+#include <linux/mm.h>
+#include <linux/string.h>
+#include <linux/scatterlist.h>
+
+#include <linux/drbd.h>
+#include "drbd_int.h"
+#include "drbd_req.h"
+
+#define SLEEP_TIME (HZ/10)
+
+STATIC int w_make_ov_request(struct drbd_conf *mdev, struct drbd_work *w, int cancel);
+
+
+
+/* defined here:
+   drbd_md_io_complete
+   drbd_endio_write_sec
+   drbd_endio_read_sec
+   drbd_endio_pri
+
+ * more endio handlers:
+   atodb_endio in drbd_actlog.c
+   drbd_bm_async_io_complete in drbd_bitmap.c
+
+ * For all these callbacks, note the follwing:
+ * The callbacks will be called in irq context by the IDE drivers,
+ * and in Softirqs/Tasklets/BH context by the SCSI drivers.
+ * Try to get the locking right :)
+ *
+ */
+
+
+/* About the global_state_lock
+   Each state transition on an device holds a read lock. In case we have
+   to evaluate the sync after dependencies, we grab a write lock, because
+   we need stable states on all devices for that.  */
+rwlock_t global_state_lock;
+
+/* used for synchronous meta data and bitmap IO
+ * submitted by drbd_md_sync_page_io()
+ */
+void drbd_md_io_complete(struct bio *bio, int error)
+{
+	struct drbd_md_io *md_io;
+
+	/* error parameter ignored:
+	 * drbd_md_sync_page_io explicitly tests bio_uptodate(bio); */
+
+	md_io = (struct drbd_md_io *)bio->bi_private;
+
+	md_io->error = error;
+
+	dump_internal_bio("Md", md_io->mdev, bio, 1);
+
+	complete(&md_io->event);
+}
+
+/* reads on behalf of the partner,
+ * "submitted" by the receiver
+ */
+void drbd_endio_read_sec(struct bio *bio, int error) __releases(local)
+{
+	unsigned long flags = 0;
+	struct Tl_epoch_entry *e = NULL;
+	struct drbd_conf *mdev;
+	int uptodate = bio_flagged(bio, BIO_UPTODATE);
+
+	e = bio->bi_private;
+	mdev = e->mdev;
+
+	if (!error && !uptodate) {
+		/* strange behaviour of some lower level drivers...
+		 * fail the request by clearing the uptodate flag,
+		 * but do not return any error?!
+		 * do we want to drbd_WARN() on this? */
+		error = -EIO;
+	}
+
+	D_ASSERT(e->block_id != ID_VACANT);
+
+	dump_internal_bio("Sec", mdev, bio, 1);
+
+	spin_lock_irqsave(&mdev->req_lock, flags);
+	mdev->read_cnt += e->size >> 9;
+	list_del(&e->w.list);
+	if (list_empty(&mdev->read_ee))
+		wake_up(&mdev->ee_wait);
+	spin_unlock_irqrestore(&mdev->req_lock, flags);
+
+	drbd_chk_io_error(mdev, error, FALSE);
+	drbd_queue_work(&mdev->data.work, &e->w);
+	dec_local(mdev);
+
+	MTRACE(TraceTypeEE, TraceLvlAll,
+	       INFO("Moved EE (READ) to worker sec=%llus size=%u ee=%p\n",
+		    (unsigned long long)e->sector, e->size, e);
+	       );
+}
+
+/* writes on behalf of the partner, or resync writes,
+ * "submitted" by the receiver.
+ */
+void drbd_endio_write_sec(struct bio *bio, int error) __releases(local)
+{
+	unsigned long flags = 0;
+	struct Tl_epoch_entry *e = NULL;
+	struct drbd_conf *mdev;
+	sector_t e_sector;
+	int do_wake;
+	int is_syncer_req;
+	int do_al_complete_io;
+	int uptodate = bio_flagged(bio, BIO_UPTODATE);
+
+	e = bio->bi_private;
+	mdev = e->mdev;
+
+	if (!error && !uptodate) {
+		/* strange behaviour of some lower level drivers...
+		 * fail the request by clearing the uptodate flag,
+		 * but do not return any error?!
+		 * do we want to drbd_WARN() on this? */
+		error = -EIO;
+	}
+
+	/* error == -ENOTSUPP would be a better test,
+	 * alas it is not reliable */
+	if (error && e->flags & EE_IS_BARRIER) {
+		drbd_bump_write_ordering(mdev, WO_bdev_flush);
+		spin_lock_irqsave(&mdev->req_lock, flags);
+		list_del(&e->w.list);
+		e->w.cb = w_e_reissue;
+		__release(local); /* Actually happens in w_e_reissue. */
+		spin_unlock_irqrestore(&mdev->req_lock, flags);
+		drbd_queue_work(&mdev->data.work, &e->w);
+		return;
+	}
+
+	D_ASSERT(e->block_id != ID_VACANT);
+
+	dump_internal_bio("Sec", mdev, bio, 1);
+
+	spin_lock_irqsave(&mdev->req_lock, flags);
+	mdev->writ_cnt += e->size >> 9;
+	is_syncer_req = is_syncer_block_id(e->block_id);
+
+	/* after we moved e to done_ee,
+	 * we may no longer access it,
+	 * it may be freed/reused already!
+	 * (as soon as we release the req_lock) */
+	e_sector = e->sector;
+	do_al_complete_io = e->flags & EE_CALL_AL_COMPLETE_IO;
+
+	list_del(&e->w.list); /* has been on active_ee or sync_ee */
+	list_add_tail(&e->w.list, &mdev->done_ee);
+
+	MTRACE(TraceTypeEE, TraceLvlAll,
+	       INFO("Moved EE (WRITE) to done_ee sec=%llus size=%u ee=%p\n",
+		    (unsigned long long)e->sector, e->size, e);
+	       );
+
+	/* No hlist_del_init(&e->colision) here, we did not send the Ack yet,
+	 * neither did we wake possibly waiting conflicting requests.
+	 * done from "drbd_process_done_ee" within the appropriate w.cb
+	 * (e_end_block/e_end_resync_block) or from _drbd_clear_done_ee */
+
+	do_wake = is_syncer_req
+		? list_empty(&mdev->sync_ee)
+		: list_empty(&mdev->active_ee);
+
+	if (error)
+		__drbd_chk_io_error(mdev, FALSE);
+	spin_unlock_irqrestore(&mdev->req_lock, flags);
+
+	if (is_syncer_req)
+		drbd_rs_complete_io(mdev, e_sector);
+
+	if (do_wake)
+		wake_up(&mdev->ee_wait);
+
+	if (do_al_complete_io)
+		drbd_al_complete_io(mdev, e_sector);
+
+	wake_asender(mdev);
+	dec_local(mdev);
+
+}
+
+/* read, readA or write requests on Primary comming from drbd_make_request
+ */
+void drbd_endio_pri(struct bio *bio, int error)
+{
+	unsigned long flags;
+	struct drbd_request *req = bio->bi_private;
+	struct drbd_conf *mdev = req->mdev;
+	enum drbd_req_event what;
+	int uptodate = bio_flagged(bio, BIO_UPTODATE);
+
+	if (!error && !uptodate) {
+		/* strange behaviour of some lower level drivers...
+		 * fail the request by clearing the uptodate flag,
+		 * but do not return any error?!
+		 * do we want to drbd_WARN() on this? */
+		error = -EIO;
+	}
+
+	dump_internal_bio("Pri", mdev, bio, 1);
+
+	/* to avoid recursion in _req_mod */
+	what = error
+	       ? (bio_data_dir(bio) == WRITE)
+		 ? write_completed_with_error
+		 : read_completed_with_error
+	       : completed_ok;
+	spin_lock_irqsave(&mdev->req_lock, flags);
+	_req_mod(req, what, error);
+	spin_unlock_irqrestore(&mdev->req_lock, flags);
+}
+
+int w_io_error(struct drbd_conf *mdev, struct drbd_work *w, int cancel)
+{
+	struct drbd_request *req = (struct drbd_request *)w;
+	int ok;
+
+	/* NOTE: mdev->bc can be NULL by the time we get here! */
+	/* D_ASSERT(mdev->bc->dc.on_io_error != PassOn); */
+
+	/* the only way this callback is scheduled is from _req_may_be_done,
+	 * when it is done and had a local write error, see comments there */
+	drbd_req_free(req);
+
+	ok = drbd_io_error(mdev, FALSE);
+	if (unlikely(!ok))
+		ERR("Sending in w_io_error() failed\n");
+	return ok;
+}
+
+int w_read_retry_remote(struct drbd_conf *mdev, struct drbd_work *w, int cancel)
+{
+	struct drbd_request *req = (struct drbd_request *)w;
+
+	/* We should not detach for read io-error,
+	 * but try to WRITE the DataReply to the failed location,
+	 * to give the disk the chance to relocate that block */
+	drbd_io_error(mdev, FALSE); /* tries to schedule a detach and notifies peer */
+
+	spin_lock_irq(&mdev->req_lock);
+	if (cancel ||
+	    mdev->state.conn < Connected ||
+	    mdev->state.pdsk <= Inconsistent) {
+		_req_mod(req, send_canceled, 0);
+		spin_unlock_irq(&mdev->req_lock);
+		ALERT("WE ARE LOST. Local IO failure, no peer.\n");
+		return 1;
+	}
+	spin_unlock_irq(&mdev->req_lock);
+
+	return w_send_read_req(mdev, w, 0);
+}
+
+int w_resync_inactive(struct drbd_conf *mdev, struct drbd_work *w, int cancel)
+{
+	ERR_IF(cancel) return 1;
+	ERR("resync inactive, but callback triggered??\n");
+	return 1; /* Simply ignore this! */
+}
+
+STATIC void drbd_csum(struct drbd_conf *mdev, struct crypto_hash *tfm, struct bio *bio, void *digest)
+{
+	struct hash_desc desc;
+	struct scatterlist sg;
+	struct bio_vec *bvec;
+	int i;
+
+	desc.tfm = tfm;
+	desc.flags = 0;
+
+	sg_init_table(&sg, 1);
+	crypto_hash_init(&desc);
+
+	__bio_for_each_segment(bvec, bio, i, 0) {
+		sg_set_page(&sg, bvec->bv_page, bvec->bv_len, bvec->bv_offset);
+		crypto_hash_update(&desc, &sg, sg.length);
+	}
+	crypto_hash_final(&desc, digest);
+}
+
+STATIC int w_e_send_csum(struct drbd_conf *mdev, struct drbd_work *w, int cancel)
+{
+	struct Tl_epoch_entry *e = (struct Tl_epoch_entry *)w;
+	int digest_size;
+	void *digest;
+	int ok;
+
+	D_ASSERT(e->block_id == DRBD_MAGIC + 0xbeef);
+
+	if (unlikely(cancel)) {
+		drbd_free_ee(mdev, e);
+		return 1;
+	}
+
+	if (likely(drbd_bio_uptodate(e->private_bio))) {
+		digest_size = crypto_hash_digestsize(mdev->csums_tfm);
+		digest = kmalloc(digest_size, GFP_KERNEL);
+		if (digest) {
+			drbd_csum(mdev, mdev->csums_tfm, e->private_bio, digest);
+
+			inc_rs_pending(mdev);
+			ok = drbd_send_drequest_csum(mdev,
+						     e->sector,
+						     e->size,
+						     digest,
+						     digest_size,
+						     CsumRSRequest);
+			kfree(digest);
+		} else {
+			ERR("kmalloc() of digest failed.\n");
+			ok = 0;
+		}
+	} else {
+		drbd_io_error(mdev, FALSE);
+		ok = 1;
+	}
+
+	drbd_free_ee(mdev, e);
+
+	if (unlikely(!ok))
+		ERR("drbd_send_drequest(..., csum) failed\n");
+	return ok;
+}
+
+#define GFP_TRY	(__GFP_HIGHMEM | __GFP_NOWARN)
+
+STATIC int read_for_csum(struct drbd_conf *mdev, sector_t sector, int size)
+{
+	struct Tl_epoch_entry *e;
+
+	if (!inc_local(mdev))
+		return 0;
+
+	if (FAULT_ACTIVE(mdev, DRBD_FAULT_AL_EE))
+		return 2;
+
+	e = drbd_alloc_ee(mdev, DRBD_MAGIC+0xbeef, sector, size, GFP_TRY);
+	if (!e) {
+		dec_local(mdev);
+		return 2;
+	}
+
+	spin_lock_irq(&mdev->req_lock);
+	list_add(&e->w.list, &mdev->read_ee);
+	spin_unlock_irq(&mdev->req_lock);
+
+	e->private_bio->bi_end_io = drbd_endio_read_sec;
+	e->private_bio->bi_rw = READ;
+	e->w.cb = w_e_send_csum;
+
+	mdev->read_cnt += size >> 9;
+	drbd_generic_make_request(mdev, DRBD_FAULT_RS_RD, e->private_bio);
+
+	return 1;
+}
+
+void resync_timer_fn(unsigned long data)
+{
+	unsigned long flags;
+	struct drbd_conf *mdev = (struct drbd_conf *) data;
+	int queue;
+
+	spin_lock_irqsave(&mdev->req_lock, flags);
+
+	if (likely(!test_and_clear_bit(STOP_SYNC_TIMER, &mdev->flags))) {
+		queue = 1;
+		if (mdev->state.conn == VerifyS)
+			mdev->resync_work.cb = w_make_ov_request;
+		else
+			mdev->resync_work.cb = w_make_resync_request;
+	} else {
+		queue = 0;
+		mdev->resync_work.cb = w_resync_inactive;
+	}
+
+	spin_unlock_irqrestore(&mdev->req_lock, flags);
+
+	/* harmless race: list_empty outside data.work.q_lock */
+	if (list_empty(&mdev->resync_work.list) && queue)
+		drbd_queue_work(&mdev->data.work, &mdev->resync_work);
+}
+
+int w_make_resync_request(struct drbd_conf *mdev,
+		struct drbd_work *w, int cancel)
+{
+	unsigned long bit;
+	sector_t sector;
+	const sector_t capacity = drbd_get_capacity(mdev->this_bdev);
+	int max_segment_size = queue_max_segment_size(mdev->rq_queue);
+	int number, i, size;
+	int align;
+
+	if (unlikely(cancel))
+		return 1;
+
+	if (unlikely(mdev->state.conn < Connected)) {
+		ERR("Confused in w_make_resync_request()! cstate < Connected");
+		return 0;
+	}
+
+	if (mdev->state.conn != SyncTarget)
+		ERR("%s in w_make_resync_request\n",
+			conns_to_name(mdev->state.conn));
+
+	if (!inc_local(mdev)) {
+		/* Since we only need to access mdev->rsync a
+		   inc_local_if_state(mdev,Failed) would be sufficient, but
+		   to continue resync with a broken disk makes no sense at
+		   all */
+		ERR("Disk broke down during resync!\n");
+		mdev->resync_work.cb = w_resync_inactive;
+		return 1;
+	}
+	/* All goto requeses have to happend after this block: inc_local() */
+
+	number = SLEEP_TIME*mdev->sync_conf.rate / ((BM_BLOCK_SIZE/1024)*HZ);
+
+	if (atomic_read(&mdev->rs_pending_cnt) > number)
+		goto requeue;
+	number -= atomic_read(&mdev->rs_pending_cnt);
+
+	for (i = 0; i < number; i++) {
+next_sector:
+		size = BM_BLOCK_SIZE;
+		bit  = drbd_bm_find_next(mdev, mdev->bm_resync_fo);
+
+		if (bit == -1UL) {
+			mdev->bm_resync_fo = drbd_bm_bits(mdev);
+			mdev->resync_work.cb = w_resync_inactive;
+			dec_local(mdev);
+			return 1;
+		}
+
+		sector = BM_BIT_TO_SECT(bit);
+
+		if (drbd_try_rs_begin_io(mdev, sector)) {
+			mdev->bm_resync_fo = bit;
+			goto requeue;
+		}
+		mdev->bm_resync_fo = bit + 1;
+
+		if (unlikely(drbd_bm_test_bit(mdev, bit) == 0)) {
+			drbd_rs_complete_io(mdev, sector);
+			goto next_sector;
+		}
+
+#if DRBD_MAX_SEGMENT_SIZE > BM_BLOCK_SIZE
+		/* try to find some adjacent bits.
+		 * we stop if we have already the maximum req size.
+		 *
+		 * Aditionally always align bigger requests, in order to
+		 * be prepared for all stripe sizes of software RAIDs.
+		 *
+		 * we _do_ care about the agreed-uppon q->max_segment_size
+		 * here, as splitting up the requests on the other side is more
+		 * difficult.  the consequence is, that on lvm and md and other
+		 * "indirect" devices, this is dead code, since
+		 * q->max_segment_size will be PAGE_SIZE.
+		 */
+		align = 1;
+		for (;;) {
+			if (size + BM_BLOCK_SIZE > max_segment_size)
+				break;
+
+			/* Be always aligned */
+			if (sector & ((1<<(align+3))-1))
+				break;
+
+			/* do not cross extent boundaries */
+			if (((bit+1) & BM_BLOCKS_PER_BM_EXT_MASK) == 0)
+				break;
+			/* now, is it actually dirty, after all?
+			 * caution, drbd_bm_test_bit is tri-state for some
+			 * obscure reason; ( b == 0 ) would get the out-of-band
+			 * only accidentally right because of the "oddly sized"
+			 * adjustment below */
+			if (drbd_bm_test_bit(mdev, bit+1) != 1)
+				break;
+			bit++;
+			size += BM_BLOCK_SIZE;
+			if ((BM_BLOCK_SIZE << align) <= size)
+				align++;
+			i++;
+		}
+		/* if we merged some,
+		 * reset the offset to start the next drbd_bm_find_next from */
+		if (size > BM_BLOCK_SIZE)
+			mdev->bm_resync_fo = bit + 1;
+#endif
+
+		/* adjust very last sectors, in case we are oddly sized */
+		if (sector + (size>>9) > capacity)
+			size = (capacity-sector)<<9;
+		if (mdev->agreed_pro_version >= 89 && mdev->csums_tfm) {
+			switch (read_for_csum(mdev, sector, size)) {
+			case 0: /* Disk failure*/
+				dec_local(mdev);
+				return 0;
+			case 2: /* Allocation failed */
+				drbd_rs_complete_io(mdev, sector);
+				mdev->bm_resync_fo = BM_SECT_TO_BIT(sector);
+				goto requeue;
+			/* case 1: everything ok */
+			}
+		} else {
+			inc_rs_pending(mdev);
+			if (!drbd_send_drequest(mdev, RSDataRequest,
+					       sector, size, ID_SYNCER)) {
+				ERR("drbd_send_drequest() failed, aborting...\n");
+				dec_rs_pending(mdev);
+				dec_local(mdev);
+				return 0;
+			}
+		}
+	}
+
+	if (mdev->bm_resync_fo >= drbd_bm_bits(mdev)) {
+		/* last syncer _request_ was sent,
+		 * but the RSDataReply not yet received.  sync will end (and
+		 * next sync group will resume), as soon as we receive the last
+		 * resync data block, and the last bit is cleared.
+		 * until then resync "work" is "inactive" ...
+		 */
+		mdev->resync_work.cb = w_resync_inactive;
+		dec_local(mdev);
+		return 1;
+	}
+
+ requeue:
+	mod_timer(&mdev->resync_timer, jiffies + SLEEP_TIME);
+	dec_local(mdev);
+	return 1;
+}
+
+int w_make_ov_request(struct drbd_conf *mdev, struct drbd_work *w, int cancel)
+{
+	int number, i, size;
+	sector_t sector;
+	const sector_t capacity = drbd_get_capacity(mdev->this_bdev);
+
+	if (unlikely(cancel))
+		return 1;
+
+	if (unlikely(mdev->state.conn < Connected)) {
+		ERR("Confused in w_make_ov_request()! cstate < Connected");
+		return 0;
+	}
+
+	number = SLEEP_TIME*mdev->sync_conf.rate / ((BM_BLOCK_SIZE/1024)*HZ);
+	if (atomic_read(&mdev->rs_pending_cnt) > number)
+		goto requeue;
+
+	number -= atomic_read(&mdev->rs_pending_cnt);
+
+	sector = mdev->ov_position;
+	for (i = 0; i < number; i++) {
+		size = BM_BLOCK_SIZE;
+
+		if (drbd_try_rs_begin_io(mdev, sector)) {
+			mdev->ov_position = sector;
+			goto requeue;
+		}
+
+		if (sector + (size>>9) > capacity)
+			size = (capacity-sector)<<9;
+
+		inc_rs_pending(mdev);
+		if (!drbd_send_ov_request(mdev, sector, size)) {
+			dec_rs_pending(mdev);
+			return 0;
+		}
+		sector += BM_SECT_PER_BIT;
+		if (sector >= capacity) {
+			mdev->resync_work.cb = w_resync_inactive;
+
+			return 1;
+		}
+	}
+	mdev->ov_position = sector;
+
+ requeue:
+	mod_timer(&mdev->resync_timer, jiffies + SLEEP_TIME);
+	return 1;
+}
+
+
+int w_ov_finished(struct drbd_conf *mdev, struct drbd_work *w, int cancel)
+{
+	kfree(w);
+	ov_oos_print(mdev);
+	drbd_resync_finished(mdev);
+
+	return 1;
+}
+
+STATIC int w_resync_finished(struct drbd_conf *mdev, struct drbd_work *w, int cancel)
+{
+	kfree(w);
+
+	drbd_resync_finished(mdev);
+
+	return 1;
+}
+
+int drbd_resync_finished(struct drbd_conf *mdev)
+{
+	unsigned long db, dt, dbdt;
+	unsigned long n_oos;
+	union drbd_state_t os, ns;
+	struct drbd_work *w;
+	char *khelper_cmd = NULL;
+
+	/* Remove all elements from the resync LRU. Since future actions
+	 * might set bits in the (main) bitmap, then the entries in the
+	 * resync LRU would be wrong. */
+	if (drbd_rs_del_all(mdev)) {
+		/* In case this is not possible now, most probabely because
+		 * there are RSDataReply Packets lingering on the worker's
+		 * queue (or even the read operations for those packets
+		 * is not finished by now).   Retry in 100ms. */
+
+		drbd_kick_lo(mdev);
+		__set_current_state(TASK_INTERRUPTIBLE);
+		schedule_timeout(HZ / 10);
+		w = kmalloc(sizeof(struct drbd_work), GFP_ATOMIC);
+		if (w) {
+			w->cb = w_resync_finished;
+			drbd_queue_work(&mdev->data.work, w);
+			return 1;
+		}
+		ERR("Warn failed to drbd_rs_del_all() and to kmalloc(w).\n");
+	}
+
+	dt = (jiffies - mdev->rs_start - mdev->rs_paused) / HZ;
+	if (dt <= 0)
+		dt = 1;
+	db = mdev->rs_total;
+	dbdt = Bit2KB(db/dt);
+	mdev->rs_paused /= HZ;
+
+	if (!inc_local(mdev))
+		goto out;
+
+	spin_lock_irq(&mdev->req_lock);
+	os = mdev->state;
+
+	/* This protects us against multiple calls (that can happen in the presence
+	   of application IO), and against connectivity loss just before we arrive here. */
+	if (os.conn <= Connected)
+		goto out_unlock;
+
+	ns = os;
+	ns.conn = Connected;
+
+	INFO("%s done (total %lu sec; paused %lu sec; %lu K/sec)\n",
+	     (os.conn == VerifyS || os.conn == VerifyT) ?
+	     "Online verify " : "Resync",
+	     dt + mdev->rs_paused, mdev->rs_paused, dbdt);
+
+	n_oos = drbd_bm_total_weight(mdev);
+
+	if (os.conn == VerifyS || os.conn == VerifyT) {
+		if (n_oos) {
+			ALERT("Online verify found %lu %dk block out of sync!\n",
+			      n_oos, Bit2KB(1));
+			khelper_cmd = "out-of-sync";
+		}
+	} else {
+		D_ASSERT((n_oos - mdev->rs_failed) == 0);
+
+		if (os.conn == SyncTarget || os.conn == PausedSyncT)
+			khelper_cmd = "after-resync-target";
+
+		if (mdev->csums_tfm && mdev->rs_total) {
+			const unsigned long s = mdev->rs_same_csum;
+			const unsigned long t = mdev->rs_total;
+			const int ratio =
+				(t == 0)     ? 0 :
+			(t < 100000) ? ((s*100)/t) : (s/(t/100));
+			INFO("%u %% had equal check sums, eliminated: %luK; "
+			     "transferred %luK total %luK\n",
+			     ratio,
+			     Bit2KB(mdev->rs_same_csum),
+			     Bit2KB(mdev->rs_total - mdev->rs_same_csum),
+			     Bit2KB(mdev->rs_total));
+		}
+	}
+
+	if (mdev->rs_failed) {
+		INFO("            %lu failed blocks\n", mdev->rs_failed);
+
+		if (os.conn == SyncTarget || os.conn == PausedSyncT) {
+			ns.disk = Inconsistent;
+			ns.pdsk = UpToDate;
+		} else {
+			ns.disk = UpToDate;
+			ns.pdsk = Inconsistent;
+		}
+	} else {
+		ns.disk = UpToDate;
+		ns.pdsk = UpToDate;
+
+		if (os.conn == SyncTarget || os.conn == PausedSyncT) {
+			if (mdev->p_uuid) {
+				int i;
+				for (i = Bitmap ; i <= History_end ; i++)
+					_drbd_uuid_set(mdev, i, mdev->p_uuid[i]);
+				drbd_uuid_set(mdev, Bitmap, mdev->bc->md.uuid[Current]);
+				_drbd_uuid_set(mdev, Current, mdev->p_uuid[Current]);
+			} else {
+				ERR("mdev->p_uuid is NULL! BUG\n");
+			}
+		}
+
+		drbd_uuid_set_bm(mdev, 0UL);
+
+		if (mdev->p_uuid) {
+			/* Now the two UUID sets are equal, update what we
+			 * know of the peer. */
+			int i;
+			for (i = Current ; i <= History_end ; i++)
+				mdev->p_uuid[i] = mdev->bc->md.uuid[i];
+		}
+	}
+
+	_drbd_set_state(mdev, ns, ChgStateVerbose, NULL);
+out_unlock:
+	spin_unlock_irq(&mdev->req_lock);
+	dec_local(mdev);
+out:
+	mdev->rs_total  = 0;
+	mdev->rs_failed = 0;
+	mdev->rs_paused = 0;
+
+	if (test_and_clear_bit(WRITE_BM_AFTER_RESYNC, &mdev->flags)) {
+		drbd_WARN("Writing the whole bitmap, due to failed kmalloc\n");
+		drbd_queue_bitmap_io(mdev, &drbd_bm_write, NULL, "write from resync_finished");
+	}
+
+	drbd_bm_recount_bits(mdev);
+
+	if (khelper_cmd)
+		drbd_khelper(mdev, khelper_cmd);
+
+	return 1;
+}
+
+/**
+ * w_e_end_data_req: Send the answer (DataReply) in response to a DataRequest.
+ */
+int w_e_end_data_req(struct drbd_conf *mdev, struct drbd_work *w, int cancel)
+{
+	struct Tl_epoch_entry *e = (struct Tl_epoch_entry *)w;
+	int ok;
+
+	if (unlikely(cancel)) {
+		drbd_free_ee(mdev, e);
+		dec_unacked(mdev);
+		return 1;
+	}
+
+	if (likely(drbd_bio_uptodate(e->private_bio))) {
+		ok = drbd_send_block(mdev, DataReply, e);
+	} else {
+		if (__ratelimit(&drbd_ratelimit_state))
+			ERR("Sending NegDReply. sector=%llus.\n",
+			    (unsigned long long)e->sector);
+
+		ok = drbd_send_ack(mdev, NegDReply, e);
+
+		drbd_io_error(mdev, FALSE);
+	}
+
+	dec_unacked(mdev);
+
+	spin_lock_irq(&mdev->req_lock);
+	if (drbd_bio_has_active_page(e->private_bio)) {
+		/* This might happen if sendpage() has not finished */
+		list_add_tail(&e->w.list, &mdev->net_ee);
+	} else {
+		drbd_free_ee(mdev, e);
+	}
+	spin_unlock_irq(&mdev->req_lock);
+
+	if (unlikely(!ok))
+		ERR("drbd_send_block() failed\n");
+	return ok;
+}
+
+/**
+ * w_e_end_rsdata_req: Send the answer (RSDataReply) to a RSDataRequest.
+ */
+int w_e_end_rsdata_req(struct drbd_conf *mdev, struct drbd_work *w, int cancel)
+{
+	struct Tl_epoch_entry *e = (struct Tl_epoch_entry *)w;
+	int ok;
+
+	if (unlikely(cancel)) {
+		drbd_free_ee(mdev, e);
+		dec_unacked(mdev);
+		return 1;
+	}
+
+	if (inc_local_if_state(mdev, Failed)) {
+		drbd_rs_complete_io(mdev, e->sector);
+		dec_local(mdev);
+	}
+
+	if (likely(drbd_bio_uptodate(e->private_bio))) {
+		if (likely(mdev->state.pdsk >= Inconsistent)) {
+			inc_rs_pending(mdev);
+			ok = drbd_send_block(mdev, RSDataReply, e);
+		} else {
+			if (__ratelimit(&drbd_ratelimit_state))
+				ERR("Not sending RSDataReply, "
+				    "partner DISKLESS!\n");
+			ok = 1;
+		}
+	} else {
+		if (__ratelimit(&drbd_ratelimit_state))
+			ERR("Sending NegRSDReply. sector %llus.\n",
+			    (unsigned long long)e->sector);
+
+		ok = drbd_send_ack(mdev, NegRSDReply, e);
+
+		drbd_io_error(mdev, FALSE);
+
+		/* update resync data with failure */
+		drbd_rs_failed_io(mdev, e->sector, e->size);
+	}
+
+	dec_unacked(mdev);
+
+	spin_lock_irq(&mdev->req_lock);
+	if (drbd_bio_has_active_page(e->private_bio)) {
+		/* This might happen if sendpage() has not finished */
+		list_add_tail(&e->w.list, &mdev->net_ee);
+	} else {
+		drbd_free_ee(mdev, e);
+	}
+	spin_unlock_irq(&mdev->req_lock);
+
+	if (unlikely(!ok))
+		ERR("drbd_send_block() failed\n");
+	return ok;
+}
+
+int w_e_end_csum_rs_req(struct drbd_conf *mdev, struct drbd_work *w, int cancel)
+{
+	struct Tl_epoch_entry *e = (struct Tl_epoch_entry *)w;
+	struct digest_info *di;
+	int digest_size;
+	void *digest = NULL;
+	int ok, eq = 0;
+
+	if (unlikely(cancel)) {
+		drbd_free_ee(mdev, e);
+		dec_unacked(mdev);
+		return 1;
+	}
+
+	drbd_rs_complete_io(mdev, e->sector);
+
+	di = (struct digest_info *)(unsigned long)e->block_id;
+
+	if (likely(drbd_bio_uptodate(e->private_bio))) {
+		/* quick hack to try to avoid a race against reconfiguration.
+		 * a real fix would be much more involved,
+		 * introducing more locking mechanisms */
+		if (mdev->csums_tfm) {
+			digest_size = crypto_hash_digestsize(mdev->csums_tfm);
+			D_ASSERT(digest_size == di->digest_size);
+			digest = kmalloc(digest_size, GFP_KERNEL);
+		}
+		if (digest) {
+			drbd_csum(mdev, mdev->csums_tfm, e->private_bio, digest);
+			eq = !memcmp(digest, di->digest, digest_size);
+			kfree(digest);
+		}
+
+		if (eq) {
+			drbd_set_in_sync(mdev, e->sector, e->size);
+			mdev->rs_same_csum++;
+			ok = drbd_send_ack(mdev, RSIsInSync, e);
+		} else {
+			inc_rs_pending(mdev);
+			e->block_id = ID_SYNCER;
+			ok = drbd_send_block(mdev, RSDataReply, e);
+		}
+	} else {
+		ok = drbd_send_ack(mdev, NegRSDReply, e);
+		if (__ratelimit(&drbd_ratelimit_state))
+			ERR("Sending NegDReply. I guess it gets messy.\n");
+		drbd_io_error(mdev, FALSE);
+	}
+
+	dec_unacked(mdev);
+
+	kfree(di);
+
+	spin_lock_irq(&mdev->req_lock);
+	if (drbd_bio_has_active_page(e->private_bio)) {
+		/* This might happen if sendpage() has not finished */
+		list_add_tail(&e->w.list, &mdev->net_ee);
+	} else {
+		drbd_free_ee(mdev, e);
+	}
+	spin_unlock_irq(&mdev->req_lock);
+
+	if (unlikely(!ok))
+		ERR("drbd_send_block/ack() failed\n");
+	return ok;
+}
+
+int w_e_end_ov_req(struct drbd_conf *mdev, struct drbd_work *w, int cancel)
+{
+	struct Tl_epoch_entry *e = (struct Tl_epoch_entry *)w;
+	int digest_size;
+	void *digest;
+	int ok = 1;
+
+	if (unlikely(cancel)) {
+		drbd_free_ee(mdev, e);
+		dec_unacked(mdev);
+		return 1;
+	}
+
+	if (likely(drbd_bio_uptodate(e->private_bio))) {
+		digest_size = crypto_hash_digestsize(mdev->verify_tfm);
+		digest = kmalloc(digest_size, GFP_KERNEL);
+		if (digest) {
+			drbd_csum(mdev, mdev->verify_tfm, e->private_bio, digest);
+			ok = drbd_send_drequest_csum(mdev, e->sector, e->size,
+						     digest, digest_size, OVReply);
+			if (ok)
+				inc_rs_pending(mdev);
+			kfree(digest);
+		}
+	}
+
+	dec_unacked(mdev);
+
+	spin_lock_irq(&mdev->req_lock);
+	drbd_free_ee(mdev, e);
+	spin_unlock_irq(&mdev->req_lock);
+
+	return ok;
+}
+
+void drbd_ov_oos_found(struct drbd_conf *mdev, sector_t sector, int size)
+{
+	if (mdev->ov_last_oos_start + mdev->ov_last_oos_size == sector) {
+		mdev->ov_last_oos_size += size>>9;
+	} else {
+		mdev->ov_last_oos_start = sector;
+		mdev->ov_last_oos_size = size>>9;
+	}
+	drbd_set_out_of_sync(mdev, sector, size);
+	set_bit(WRITE_BM_AFTER_RESYNC, &mdev->flags);
+}
+
+int w_e_end_ov_reply(struct drbd_conf *mdev, struct drbd_work *w, int cancel)
+{
+	struct Tl_epoch_entry *e = (struct Tl_epoch_entry *)w;
+	struct digest_info *di;
+	int digest_size;
+	void *digest;
+	int ok, eq = 0;
+
+	if (unlikely(cancel)) {
+		drbd_free_ee(mdev, e);
+		dec_unacked(mdev);
+		return 1;
+	}
+
+	/* after "cancel", because after drbd_disconnect/drbd_rs_cancel_all
+	 * the resync lru has been cleaned up already */
+	drbd_rs_complete_io(mdev, e->sector);
+
+	di = (struct digest_info *)(unsigned long)e->block_id;
+
+	if (likely(drbd_bio_uptodate(e->private_bio))) {
+		digest_size = crypto_hash_digestsize(mdev->verify_tfm);
+		digest = kmalloc(digest_size, GFP_KERNEL);
+		if (digest) {
+			drbd_csum(mdev, mdev->verify_tfm, e->private_bio, digest);
+
+			D_ASSERT(digest_size == di->digest_size);
+			eq = !memcmp(digest, di->digest, digest_size);
+			kfree(digest);
+		}
+	} else {
+		ok = drbd_send_ack(mdev, NegRSDReply, e);
+		if (__ratelimit(&drbd_ratelimit_state))
+			ERR("Sending NegDReply. I guess it gets messy.\n");
+		drbd_io_error(mdev, FALSE);
+	}
+
+	dec_unacked(mdev);
+
+	kfree(di);
+
+	if (!eq)
+		drbd_ov_oos_found(mdev, e->sector, e->size);
+	else
+		ov_oos_print(mdev);
+
+	ok = drbd_send_ack_ex(mdev, OVResult, e->sector, e->size,
+			      eq ? ID_IN_SYNC : ID_OUT_OF_SYNC);
+
+	spin_lock_irq(&mdev->req_lock);
+	drbd_free_ee(mdev, e);
+	spin_unlock_irq(&mdev->req_lock);
+
+	if (--mdev->ov_left == 0) {
+		ov_oos_print(mdev);
+		drbd_resync_finished(mdev);
+	}
+
+	return ok;
+}
+
+int w_prev_work_done(struct drbd_conf *mdev, struct drbd_work *w, int cancel)
+{
+	clear_bit(WORK_PENDING, &mdev->flags);
+	wake_up(&mdev->misc_wait);
+	return 1;
+}
+
+int w_send_barrier(struct drbd_conf *mdev, struct drbd_work *w, int cancel)
+{
+	struct drbd_barrier *b = (struct drbd_barrier *)w;
+	struct Drbd_Barrier_Packet *p = &mdev->data.sbuf.Barrier;
+	int ok = 1;
+
+	/* really avoid racing with tl_clear.  w.cb may have been referenced
+	 * just before it was reassigned and requeued, so double check that.
+	 * actually, this race was harmless, since we only try to send the
+	 * barrier packet here, and otherwise do nothing with the object.
+	 * but compare with the head of w_clear_epoch */
+	spin_lock_irq(&mdev->req_lock);
+	if (w->cb != w_send_barrier || mdev->state.conn < Connected)
+		cancel = 1;
+	spin_unlock_irq(&mdev->req_lock);
+	if (cancel)
+		return 1;
+
+	if (!drbd_get_data_sock(mdev))
+		return 0;
+	p->barrier = b->br_number;
+	/* inc_ap_pending was done where this was queued.
+	 * dec_ap_pending will be done in got_BarrierAck
+	 * or (on connection loss) in w_clear_epoch.  */
+	ok = _drbd_send_cmd(mdev, mdev->data.socket, Barrier,
+				(struct Drbd_Header *)p, sizeof(*p), 0);
+	drbd_put_data_sock(mdev);
+
+	return ok;
+}
+
+int w_send_write_hint(struct drbd_conf *mdev, struct drbd_work *w, int cancel)
+{
+	if (cancel)
+		return 1;
+	return drbd_send_short_cmd(mdev, UnplugRemote);
+}
+
+/**
+ * w_send_dblock: Send a mirrored write request.
+ */
+int w_send_dblock(struct drbd_conf *mdev, struct drbd_work *w, int cancel)
+{
+	struct drbd_request *req = (struct drbd_request *)w;
+	int ok;
+
+	if (unlikely(cancel)) {
+		req_mod(req, send_canceled, 0);
+		return 1;
+	}
+
+	ok = drbd_send_dblock(mdev, req);
+	req_mod(req, ok ? handed_over_to_network : send_failed, 0);
+
+	return ok;
+}
+
+/**
+ * w_send_read_req: Send a read requests.
+ */
+int w_send_read_req(struct drbd_conf *mdev, struct drbd_work *w, int cancel)
+{
+	struct drbd_request *req = (struct drbd_request *)w;
+	int ok;
+
+	if (unlikely(cancel)) {
+		req_mod(req, send_canceled, 0);
+		return 1;
+	}
+
+	ok = drbd_send_drequest(mdev, DataRequest, req->sector, req->size,
+				(unsigned long)req);
+
+	if (!ok) {
+		/* ?? we set Timeout or BrokenPipe in drbd_send();
+		 * so this is probably redundant */
+		if (mdev->state.conn >= Connected)
+			drbd_force_state(mdev, NS(conn, NetworkFailure));
+	}
+	req_mod(req, ok ? handed_over_to_network : send_failed, 0);
+
+	return ok;
+}
+
+STATIC int _drbd_may_sync_now(struct drbd_conf *mdev)
+{
+	struct drbd_conf *odev = mdev;
+
+	while (1) {
+		if (odev->sync_conf.after == -1)
+			return 1;
+		odev = minor_to_mdev(odev->sync_conf.after);
+		ERR_IF(!odev) return 1;
+		if ((odev->state.conn >= SyncSource &&
+		     odev->state.conn <= PausedSyncT) ||
+		    odev->state.aftr_isp || odev->state.peer_isp ||
+		    odev->state.user_isp)
+			return 0;
+	}
+}
+
+/**
+ * _drbd_pause_after:
+ * Finds all devices that may not resync now, and causes them to
+ * pause their resynchronisation.
+ * Called from process context only (admin command and after_state_ch).
+ */
+STATIC int _drbd_pause_after(struct drbd_conf *mdev)
+{
+	struct drbd_conf *odev;
+	int i, rv = 0;
+
+	for (i = 0; i < minor_count; i++) {
+		odev = minor_to_mdev(i);
+		if (!odev)
+			continue;
+		if (odev->state.conn == StandAlone && odev->state.disk == Diskless)
+			continue;
+		if (!_drbd_may_sync_now(odev))
+			rv |= (__drbd_set_state(_NS(odev, aftr_isp, 1), ChgStateHard, NULL)
+			       != SS_NothingToDo);
+	}
+
+	return rv;
+}
+
+/**
+ * _drbd_resume_next:
+ * Finds all devices that can resume resynchronisation
+ * process, and causes them to resume.
+ * Called from process context only (admin command and worker).
+ */
+STATIC int _drbd_resume_next(struct drbd_conf *mdev)
+{
+	struct drbd_conf *odev;
+	int i, rv = 0;
+
+	for (i = 0; i < minor_count; i++) {
+		odev = minor_to_mdev(i);
+		if (!odev)
+			continue;
+		if (odev->state.conn == StandAlone && odev->state.disk == Diskless)
+			continue;
+		if (odev->state.aftr_isp) {
+			if (_drbd_may_sync_now(odev))
+				rv |= (__drbd_set_state(_NS(odev, aftr_isp, 0),
+							ChgStateHard, NULL)
+				       != SS_NothingToDo) ;
+		}
+	}
+	return rv;
+}
+
+void resume_next_sg(struct drbd_conf *mdev)
+{
+	write_lock_irq(&global_state_lock);
+	_drbd_resume_next(mdev);
+	write_unlock_irq(&global_state_lock);
+}
+
+void suspend_other_sg(struct drbd_conf *mdev)
+{
+	write_lock_irq(&global_state_lock);
+	_drbd_pause_after(mdev);
+	write_unlock_irq(&global_state_lock);
+}
+
+void drbd_alter_sa(struct drbd_conf *mdev, int na)
+{
+	int changes;
+
+	write_lock_irq(&global_state_lock);
+	mdev->sync_conf.after = na;
+
+	do {
+		changes  = _drbd_pause_after(mdev);
+		changes |= _drbd_resume_next(mdev);
+	} while (changes);
+
+	write_unlock_irq(&global_state_lock);
+}
+
+/**
+ * drbd_start_resync:
+ * @side: Either SyncSource or SyncTarget
+ * Start the resync process. Called from process context only,
+ * either admin command or drbd_receiver.
+ * Note, this function might bring you directly into one of the
+ * PausedSync* states.
+ */
+void drbd_start_resync(struct drbd_conf *mdev, enum drbd_conns side)
+{
+	union drbd_state_t ns;
+	int r;
+
+	MTRACE(TraceTypeResync, TraceLvlSummary,
+	       INFO("Resync starting: side=%s\n",
+		    side == SyncTarget ? "SyncTarget" : "SyncSource");
+	    );
+
+	drbd_bm_recount_bits(mdev);
+
+	/* In case a previous resync run was aborted by an IO error... */
+	drbd_rs_cancel_all(mdev);
+
+	if (side == SyncTarget) {
+		/* Since application IO was locked out during WFBitMapT and
+		   WFSyncUUID we are still unmodified. Before going to SyncTarget
+		   we check that we might make the data inconsistent. */
+		r = drbd_khelper(mdev, "before-resync-target");
+		r = (r >> 8) & 0xff;
+		if (r > 0) {
+			INFO("before-resync-target handler returned %d, "
+			     "dropping connection.\n", r);
+			drbd_force_state(mdev, NS(conn, Disconnecting));
+			return;
+		}
+	}
+
+	drbd_state_lock(mdev);
+
+	if (!inc_local_if_state(mdev, Negotiating)) {
+		drbd_state_unlock(mdev);
+		return;
+	}
+
+	if (side == SyncTarget) {
+		mdev->bm_resync_fo = 0;
+	} else /* side == SyncSource */ {
+		u64 uuid;
+
+		get_random_bytes(&uuid, sizeof(u64));
+		drbd_uuid_set(mdev, Bitmap, uuid);
+		drbd_send_sync_uuid(mdev, uuid);
+
+		D_ASSERT(mdev->state.disk == UpToDate);
+	}
+
+	write_lock_irq(&global_state_lock);
+	ns = mdev->state;
+
+	ns.aftr_isp = !_drbd_may_sync_now(mdev);
+
+	ns.conn = side;
+
+	if (side == SyncTarget)
+		ns.disk = Inconsistent;
+	else /* side == SyncSource */
+		ns.pdsk = Inconsistent;
+
+	r = __drbd_set_state(mdev, ns, ChgStateVerbose, NULL);
+	ns = mdev->state;
+
+	if (ns.conn < Connected)
+		r = SS_UnknownError;
+
+	if (r == SS_Success) {
+		mdev->rs_total     =
+		mdev->rs_mark_left = drbd_bm_total_weight(mdev);
+		mdev->rs_failed    = 0;
+		mdev->rs_paused    = 0;
+		mdev->rs_start     =
+		mdev->rs_mark_time = jiffies;
+		mdev->rs_same_csum = 0;
+		_drbd_pause_after(mdev);
+	}
+	write_unlock_irq(&global_state_lock);
+	drbd_state_unlock(mdev);
+	dec_local(mdev);
+
+	if (r == SS_Success) {
+		INFO("Began resync as %s (will sync %lu KB [%lu bits set]).\n",
+		     conns_to_name(ns.conn),
+		     (unsigned long) mdev->rs_total << (BM_BLOCK_SIZE_B-10),
+		     (unsigned long) mdev->rs_total);
+
+		if (mdev->rs_total == 0) {
+			drbd_resync_finished(mdev);
+			return;
+		}
+
+		if (ns.conn == SyncTarget) {
+			D_ASSERT(!test_bit(STOP_SYNC_TIMER, &mdev->flags));
+			mod_timer(&mdev->resync_timer, jiffies);
+		}
+
+		drbd_md_sync(mdev);
+	}
+}
+
+int drbd_worker(struct Drbd_thread *thi)
+{
+	struct drbd_conf *mdev = thi->mdev;
+	struct drbd_work *w = NULL;
+	LIST_HEAD(work_list);
+	int intr = 0, i;
+
+	sprintf(current->comm, "drbd%d_worker", mdev_to_minor(mdev));
+
+	while (get_t_state(thi) == Running) {
+		drbd_thread_current_set_cpu(mdev);
+
+		if (down_trylock(&mdev->data.work.s)) {
+			mutex_lock(&mdev->data.mutex);
+			if (mdev->data.socket && !mdev->net_conf->no_cork)
+				drbd_tcp_uncork(mdev->data.socket);
+			mutex_unlock(&mdev->data.mutex);
+
+			intr = down_interruptible(&mdev->data.work.s);
+
+			mutex_lock(&mdev->data.mutex);
+			if (mdev->data.socket  && !mdev->net_conf->no_cork)
+				drbd_tcp_cork(mdev->data.socket);
+			mutex_unlock(&mdev->data.mutex);
+		}
+
+		if (intr) {
+			D_ASSERT(intr == -EINTR);
+			flush_signals(current);
+			ERR_IF (get_t_state(thi) == Running)
+				continue;
+			break;
+		}
+
+		if (get_t_state(thi) != Running)
+			break;
+		/* With this break, we have done a down() but not consumed
+		   the entry from the list. The cleanup code takes care of
+		   this...   */
+
+		w = NULL;
+		spin_lock_irq(&mdev->data.work.q_lock);
+		ERR_IF(list_empty(&mdev->data.work.q)) {
+			/* something terribly wrong in our logic.
+			 * we were able to down() the semaphore,
+			 * but the list is empty... doh.
+			 *
+			 * what is the best thing to do now?
+			 * try again from scratch, restarting the receiver,
+			 * asender, whatnot? could break even more ugly,
+			 * e.g. when we are primary, but no good local data.
+			 *
+			 * I'll try to get away just starting over this loop.
+			 */
+			spin_unlock_irq(&mdev->data.work.q_lock);
+			continue;
+		}
+		w = list_entry(mdev->data.work.q.next, struct drbd_work, list);
+		list_del_init(&w->list);
+		spin_unlock_irq(&mdev->data.work.q_lock);
+
+		if (!w->cb(mdev, w, mdev->state.conn < Connected)) {
+			/* drbd_WARN("worker: a callback failed! \n"); */
+			if (mdev->state.conn >= Connected)
+				drbd_force_state(mdev,
+						NS(conn, NetworkFailure));
+		}
+	}
+
+	spin_lock_irq(&mdev->data.work.q_lock);
+	i = 0;
+	while (!list_empty(&mdev->data.work.q)) {
+		list_splice_init(&mdev->data.work.q, &work_list);
+		spin_unlock_irq(&mdev->data.work.q_lock);
+
+		while (!list_empty(&work_list)) {
+			w = list_entry(work_list.next, struct drbd_work, list);
+			list_del_init(&w->list);
+			w->cb(mdev, w, 1);
+			i++; /* dead debugging code */
+		}
+
+		spin_lock_irq(&mdev->data.work.q_lock);
+	}
+	sema_init(&mdev->data.work.s, 0);
+	/* DANGEROUS race: if someone did queue his work within the spinlock,
+	 * but up() ed outside the spinlock, we could get an up() on the
+	 * semaphore without corresponding list entry.
+	 * So don't do that.
+	 */
+	spin_unlock_irq(&mdev->data.work.q_lock);
+
+	D_ASSERT(mdev->state.disk == Diskless && mdev->state.conn == StandAlone);
+	/* _drbd_set_state only uses stop_nowait.
+	 * wait here for the Exiting receiver. */
+	drbd_thread_stop(&mdev->receiver);
+	drbd_mdev_cleanup(mdev);
+
+	INFO("worker terminated\n");
+
+	return 0;
+}
--- linux-rt-2.6.31.orig/ubuntu/drbd/lru_cache.c
+++ linux-rt-2.6.31/ubuntu/drbd/lru_cache.c
@@ -0,0 +1,397 @@
+/*
+   lru_cache.c
+
+   This file is part of DRBD by Philipp Reisner and Lars Ellenberg.
+
+   Copyright (C) 2003-2008, LINBIT Information Technologies GmbH.
+   Copyright (C) 2003-2008, Philipp Reisner <philipp.reisner@linbit.com>.
+   Copyright (C) 2003-2008, Lars Ellenberg <lars.ellenberg@linbit.com>.
+
+   drbd is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 2, or (at your option)
+   any later version.
+
+   drbd is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with drbd; see the file COPYING.  If not, write to
+   the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
+
+ */
+
+#include <linux/bitops.h>
+#include <linux/vmalloc.h>
+#include <linux/string.h> /* for memset */
+#include <linux/seq_file.h> /* for seq_printf */
+#include "lru_cache.h"
+
+/* this is developers aid only! */
+#define PARANOIA_ENTRY() BUG_ON(test_and_set_bit(__LC_PARANOIA, &lc->flags))
+#define PARANOIA_LEAVE() do { clear_bit(__LC_PARANOIA, &lc->flags); smp_mb__after_clear_bit(); } while (0)
+#define RETURN(x...)     do { PARANOIA_LEAVE(); return x ; } while (0)
+
+static inline size_t size_of_lc(unsigned int e_count, size_t e_size)
+{
+	return sizeof(struct lru_cache)
+	     + e_count * (e_size + sizeof(struct hlist_head));
+}
+
+static inline void lc_init(struct lru_cache *lc,
+		const size_t bytes, const char *name,
+		const unsigned int e_count, const size_t e_size,
+		void *private_p)
+{
+	struct lc_element *e;
+	unsigned int i;
+
+	memset(lc, 0, bytes);
+	INIT_LIST_HEAD(&lc->in_use);
+	INIT_LIST_HEAD(&lc->lru);
+	INIT_LIST_HEAD(&lc->free);
+	lc->element_size = e_size;
+	lc->nr_elements  = e_count;
+	lc->new_number	 = -1;
+	lc->lc_private   = private_p;
+	lc->name         = name;
+	for (i = 0; i < e_count; i++) {
+		e = lc_entry(lc, i);
+		e->lc_number = LC_FREE;
+		list_add(&e->list, &lc->free);
+		/* memset(,0,) did the rest of init for us */
+	}
+}
+
+/**
+ * lc_alloc: allocates memory for @e_count objects of @e_size bytes plus the
+ * struct lru_cache, and the hash table slots.
+ * returns pointer to a newly initialized lru_cache object with said parameters.
+ */
+struct lru_cache *lc_alloc(const char *name, unsigned int e_count,
+			   size_t e_size, void *private_p)
+{
+	struct lru_cache   *lc;
+	size_t bytes;
+
+	BUG_ON(!e_count);
+	e_size = max(sizeof(struct lc_element), e_size);
+	bytes = size_of_lc(e_count, e_size);
+	lc = vmalloc(bytes);
+	if (lc)
+		lc_init(lc, bytes, name, e_count, e_size, private_p);
+	return lc;
+}
+
+/**
+ * lc_free: Frees memory allocated by lc_alloc.
+ * @lc: The lru_cache object
+ */
+void lc_free(struct lru_cache *lc)
+{
+	vfree(lc);
+}
+
+/**
+ * lc_reset: does a full reset for @lc and the hash table slots.
+ * It is roughly the equivalent of re-allocating a fresh lru_cache object,
+ * basically a short cut to lc_free(lc); lc = lc_alloc(...);
+ */
+void lc_reset(struct lru_cache *lc)
+{
+	lc_init(lc, size_of_lc(lc->nr_elements, lc->element_size), lc->name,
+			lc->nr_elements, lc->element_size, lc->lc_private);
+}
+
+size_t	lc_printf_stats(struct seq_file *seq, struct lru_cache *lc)
+{
+	/* NOTE:
+	 * total calls to lc_get are
+	 * (starving + hits + misses)
+	 * misses include "dirty" count (update from an other thread in
+	 * progress) and "changed", when this in fact lead to an successful
+	 * update of the cache.
+	 */
+	return seq_printf(seq, "\t%s: used:%u/%u "
+		"hits:%lu misses:%lu starving:%lu dirty:%lu changed:%lu\n",
+		lc->name, lc->used, lc->nr_elements,
+		lc->hits, lc->misses, lc->starving, lc->dirty, lc->changed);
+}
+
+static unsigned int lc_hash_fn(struct lru_cache *lc, unsigned int enr)
+{
+	return enr % lc->nr_elements;
+}
+
+
+/**
+ * lc_find: Returns the pointer to an element, if the element is present
+ * in the hash table. In case it is not this function returns NULL.
+ * @lc: The lru_cache object
+ * @enr: element number
+ */
+struct lc_element *lc_find(struct lru_cache *lc, unsigned int enr)
+{
+	struct hlist_node *n;
+	struct lc_element *e;
+
+	BUG_ON(!lc);
+	BUG_ON(!lc->nr_elements);
+	hlist_for_each_entry(e, n, lc->slot + lc_hash_fn(lc, enr), colision) {
+		if (e->lc_number == enr)
+			return e;
+	}
+	return NULL;
+}
+
+static struct lc_element *lc_evict(struct lru_cache *lc)
+{
+	struct list_head  *n;
+	struct lc_element *e;
+
+	if (list_empty(&lc->lru))
+		return NULL;
+
+	n = lc->lru.prev;
+	e = list_entry(n, struct lc_element, list);
+
+	list_del(&e->list);
+	hlist_del(&e->colision);
+	return e;
+}
+
+/**
+ * lc_del: Removes an element from the cache (and therefore adds the
+ * element's storage to the free list)
+ *
+ * @lc: The lru_cache object
+ * @e: The element to remove
+ */
+void lc_del(struct lru_cache *lc, struct lc_element *e)
+{
+	PARANOIA_ENTRY();
+	BUG_ON(e->refcnt);
+	list_del(&e->list);
+	hlist_del_init(&e->colision);
+	e->lc_number = LC_FREE;
+	e->refcnt = 0;
+	list_add(&e->list, &lc->free);
+	RETURN();
+}
+
+static struct lc_element *lc_get_unused_element(struct lru_cache *lc)
+{
+	struct list_head *n;
+
+	if (list_empty(&lc->free))
+		return lc_evict(lc);
+
+	n = lc->free.next;
+	list_del(n);
+	return list_entry(n, struct lc_element, list);
+}
+
+static int lc_unused_element_available(struct lru_cache *lc)
+{
+	if (!list_empty(&lc->free))
+		return 1; /* something on the free list */
+	if (!list_empty(&lc->lru))
+		return 1;  /* something to evict */
+
+	return 0;
+}
+
+
+/**
+ * lc_get: Finds an element in the cache, increases its usage count,
+ * "touches" and returns it.
+ * In case the requested number is not present, it needs to be added to the
+ * cache. Therefore it is possible that an other element becomes eviced from
+ * the cache. In either case, the user is notified so he is able to e.g. keep
+ * a persistent log of the cache changes, and therefore the objects in use.
+ *
+ * Return values:
+ *  NULL    if the requested element number was not in the cache, and no unused
+ *          element could be recycled
+ *  pointer to the element with the REQUESTED element number
+ *          In this case, it can be used right away
+ *
+ *  pointer to an UNUSED element with some different element number.
+ *          In this case, the cache is marked dirty, and the returned element
+ *          pointer is removed from the lru list and hash collision chains.
+ *          The user now should do whatever houskeeping is necessary. Then he
+ *          needs to call lc_element_changed(lc,element_pointer), to finish the
+ *          change.
+ *
+ * NOTE: The user needs to check the lc_number on EACH use, so he recognizes
+ *       any cache set change.
+ *
+ * @lc: The lru_cache object
+ * @enr: element number
+ */
+struct lc_element *lc_get(struct lru_cache *lc, unsigned int enr)
+{
+	struct lc_element *e;
+
+	BUG_ON(!lc);
+	BUG_ON(!lc->nr_elements);
+
+	PARANOIA_ENTRY();
+	if (lc->flags & LC_STARVING) {
+		++lc->starving;
+		RETURN(NULL);
+	}
+
+	e = lc_find(lc, enr);
+	if (e) {
+		++lc->hits;
+		if (e->refcnt++ == 0)
+			lc->used++;
+		list_move(&e->list, &lc->in_use); /* Not evictable... */
+		RETURN(e);
+	}
+
+	++lc->misses;
+
+	/* In case there is nothing available and we can not kick out
+	 * the LRU element, we have to wait ...
+	 */
+	if (!lc_unused_element_available(lc)) {
+		__set_bit(__LC_STARVING, &lc->flags);
+		RETURN(NULL);
+	}
+
+	/* it was not present in the cache, find an unused element,
+	 * which then is replaced.
+	 * we need to update the cache; serialize on lc->flags & LC_DIRTY
+	 */
+	if (test_and_set_bit(__LC_DIRTY, &lc->flags)) {
+		++lc->dirty;
+		RETURN(NULL);
+	}
+
+	e = lc_get_unused_element(lc);
+	BUG_ON(!e);
+
+	clear_bit(__LC_STARVING, &lc->flags);
+	BUG_ON(++e->refcnt != 1);
+	lc->used++;
+
+	lc->changing_element = e;
+	lc->new_number = enr;
+
+	RETURN(e);
+}
+
+/* similar to lc_get,
+ * but only gets a new reference on an existing element.
+ * you either get the requested element, or NULL.
+ */
+struct lc_element *lc_try_get(struct lru_cache *lc, unsigned int enr)
+{
+	struct lc_element *e;
+
+	BUG_ON(!lc);
+	BUG_ON(!lc->nr_elements);
+
+	PARANOIA_ENTRY();
+	if (lc->flags & LC_STARVING) {
+		++lc->starving;
+		RETURN(NULL);
+	}
+
+	e = lc_find(lc, enr);
+	if (e) {
+		++lc->hits;
+		if (e->refcnt++ == 0)
+			lc->used++;
+		list_move(&e->list, &lc->in_use); /* Not evictable... */
+	}
+	RETURN(e);
+}
+
+void lc_changed(struct lru_cache *lc, struct lc_element *e)
+{
+	PARANOIA_ENTRY();
+	BUG_ON(e != lc->changing_element);
+	++lc->changed;
+	e->lc_number = lc->new_number;
+	list_add(&e->list, &lc->in_use);
+	hlist_add_head(&e->colision,
+		lc->slot + lc_hash_fn(lc, lc->new_number));
+	lc->changing_element = NULL;
+	lc->new_number = -1;
+	clear_bit(__LC_DIRTY, &lc->flags);
+	smp_mb__after_clear_bit();
+	RETURN();
+}
+
+
+unsigned int lc_put(struct lru_cache *lc, struct lc_element *e)
+{
+	BUG_ON(!lc);
+	BUG_ON(!lc->nr_elements);
+	BUG_ON(!e);
+
+	PARANOIA_ENTRY();
+	BUG_ON(e->refcnt == 0);
+	BUG_ON(e == lc->changing_element);
+	if (--e->refcnt == 0) {
+		/* move it to the front of LRU. */
+		list_move(&e->list, &lc->lru);
+		lc->used--;
+		clear_bit(__LC_STARVING, &lc->flags);
+		smp_mb__after_clear_bit();
+	}
+	RETURN(e->refcnt);
+}
+
+
+/**
+ * lc_set: Sets an element in the cache. You might use this function to
+ * setup the cache. It is expected that the elements are properly initialized.
+ * @lc: The lru_cache object
+ * @enr: element number
+ * @index: The elements' position in the cache
+ */
+void lc_set(struct lru_cache *lc, unsigned int enr, int index)
+{
+	struct lc_element *e;
+
+	if (index < 0 || index >= lc->nr_elements)
+		return;
+
+	e = lc_entry(lc, index);
+	e->lc_number = enr;
+
+	hlist_del_init(&e->colision);
+	hlist_add_head(&e->colision, lc->slot + lc_hash_fn(lc, enr));
+	list_move(&e->list, e->refcnt ? &lc->in_use : &lc->lru);
+}
+
+/**
+ * lc_dump: Dump a complete LRU cache to seq in textual form.
+ */
+void lc_dump(struct lru_cache *lc, struct seq_file *seq, char *utext,
+	     void (*detail) (struct seq_file *, struct lc_element *))
+{
+	unsigned int nr_elements = lc->nr_elements;
+	struct lc_element *e;
+	int i;
+
+	seq_printf(seq, "\tnn: lc_number refcnt %s\n ", utext);
+	for (i = 0; i < nr_elements; i++) {
+		e = lc_entry(lc, i);
+		if (e->lc_number == LC_FREE) {
+			seq_printf(seq, "\t%2d: FREE\n", i);
+		} else {
+			seq_printf(seq, "\t%2d: %4u %4u    ", i,
+				   e->lc_number,
+				   e->refcnt);
+			detail(seq, e);
+		}
+	}
+}
+
--- linux-rt-2.6.31.orig/ubuntu/drbd/drbd_buildtag.c
+++ linux-rt-2.6.31/ubuntu/drbd/drbd_buildtag.c
@@ -0,0 +1,7 @@
+/* automatically generated. DO NOT EDIT. */
+#include <linux/drbd_config.h>
+const char *drbd_buildtag(void)
+{
+	return "GIT-hash: bbadddd7bad33396ebb8c0c12da9aab594d00c4e drbd/Makefile-2.6"
+		" build by phil@fat-tyre, 2009-04-01 10:29:21";
+}
--- linux-rt-2.6.31.orig/ubuntu/drbd/drbd_vli.h
+++ linux-rt-2.6.31/ubuntu/drbd/drbd_vli.h
@@ -0,0 +1,474 @@
+/*
+-*- linux-c -*-
+   drbd_receiver.c
+   This file is part of DRBD by Philipp Reisner and Lars Ellenberg.
+
+   Copyright (C) 2001-2008, LINBIT Information Technologies GmbH.
+   Copyright (C) 1999-2008, Philipp Reisner <philipp.reisner@linbit.com>.
+   Copyright (C) 2002-2008, Lars Ellenberg <lars.ellenberg@linbit.com>.
+
+   drbd is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 2, or (at your option)
+   any later version.
+
+   drbd is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with drbd; see the file COPYING.  If not, write to
+   the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#ifndef _DRBD_VLI_H
+#define _DRBD_VLI_H
+
+/*
+ * At a granularity of 4KiB storage represented per bit,
+ * and stroage sizes of several TiB,
+ * and possibly small-bandwidth replication,
+ * the bitmap transfer time can take much too long,
+ * if transmitted in plain text.
+ *
+ * We try to reduce the transfered bitmap information
+ * by encoding runlengths of bit polarity.
+ *
+ * We never actually need to encode a "zero" (runlengths are positive).
+ * But then we have to store the value of the first bit.
+ * So we can as well have the "zero" be a valid runlength,
+ * and start encoding/decoding by "number of _set_ bits" by convention.
+ *
+ * We assume that large areas are either completely set or unset,
+ * which gives good compression with any runlength method,
+ * even when encoding the runlength as fixed size 32bit/64bit integers.
+ *
+ * Still, there may be areas where the polarity flips every few bits,
+ * and encoding the runlength sequence of those ares with fix size
+ * integers would be much worse than plaintext.
+ *
+ * We want to encode small runlength values with minimum code length,
+ * while still being able to encode a Huge run of all zeros.
+ *
+ * Thus we need a Variable Length Integer encoding, VLI.
+ *
+ * For runlength < 8, we produce more code bits than plaintext input.
+ * we need to send incompressible chunks as plaintext, skip over them
+ * and then see if the next chunk compresses better.
+ *
+ * We don't care too much about "excellent" compression ratio
+ * for large runlengths, 249 bit/24 bit still gives a factor of > 10.
+ *
+ * We care for cpu time needed to actually encode/decode
+ * into the transmitted byte stream.
+ *
+ * There are endless variants of VLI.
+ * For this special purpose, we just need something that is "good enough",
+ * and easy to understand and code, fast to encode and decode,
+ * and does not consume memory.
+ */
+
+/*
+ * buf points to the current position in the tranfered byte stream.
+ * stream is by definition little endian.
+ * *buf_len gives the remaining number of bytes at that position.
+ * *out will receive the decoded value.
+ * returns number of bytes consumed,
+ * or 0 if not enough bytes left in buffer (which would be invalid input).
+ */
+static inline int vli_decode_bytes(u64 *out, unsigned char *buf, unsigned buf_len)
+{
+	u64 tmp = 0;
+	unsigned bytes; /* extra bytes after code byte */
+
+	if (buf_len == 0)
+		return 0;
+
+	switch(*buf) {
+	case 0xff: bytes = 8; break;
+	case 0xfe: bytes = 7; break;
+	case 0xfd: bytes = 6; break;
+	case 0xfc: bytes = 5; break;
+	case 0xfb: bytes = 4; break;
+	case 0xfa: bytes = 3; break;
+	case 0xf9: bytes = 2; break;
+	default:
+		*out = *buf;
+		return 1;
+	}
+
+	if (buf_len <= bytes)
+		return 0;
+
+	/* no pointer cast assignment, there may be funny alignment
+	 * requirements on certain architectures */
+	memcpy(&tmp, buf+1, bytes);
+	*out = le64_to_cpu(tmp);
+	return bytes+1;
+}
+
+/*
+ * similarly, encode n into buf.
+ * returns consumed bytes,
+ * or zero if not enough room left in buffer
+ * (in which case the buf is left unchanged).
+ *
+ * encoding is little endian, first byte codes how much bytes follow.
+ * first byte <= 0xf8 means just this byte, value = code byte.
+ * first byte == 0xf9 .. 0xff: (code byte - 0xf7) data bytes follow.
+ */
+static inline int vli_encode_bytes(unsigned char *buf, u64 n, unsigned buf_len)
+{
+	unsigned bytes; /* _extra_ bytes after code byte */
+
+	if (buf_len == 0)
+		return 0;
+
+	if (n <= 0xf8) {
+		*buf = (unsigned char)n;
+		return 1;
+	}
+
+	bytes = (n < (1ULL << 32))
+	      ? (n < (1ULL << 16)) ? 2
+	      : (n < (1ULL << 24)) ? 3 : 4
+	      : (n < (1ULL << 48)) ?
+		(n < (1ULL << 40)) ? 5 : 6
+	      : (n < (1ULL << 56)) ? 7 : 8;
+
+	if (buf_len <= bytes)
+		return 0;
+
+	/* no pointer cast assignment, there may be funny alignment
+	 * requirements on certain architectures */
+	*buf++ = 0xf7 + bytes; /* code, 0xf9 .. 0xff */
+	n = cpu_to_le64(n);
+	memcpy(buf, &n, bytes); /* plain */
+	return bytes+1;
+}
+
+/* ================================================================== */
+
+/* And here the more involved variants of VLI.
+ *
+ * Code length is determined by some unique (e.g. unary) prefix.
+ * This encodes arbitrary bit length, not whole bytes: we have a bit-stream,
+ * not a byte stream.
+ */
+
+/* for the bitstream, we need a cursor */
+struct bitstream_cursor {
+	/* the current byte */
+	u8 *b;
+	/* the current bit within *b, nomalized: 0..7 */
+	unsigned int bit;
+};
+
+/* initialize cursor to point to first bit of stream */
+static inline void bitstream_cursor_reset(struct bitstream_cursor *cur, void *s)
+{
+	cur->b = s;
+	cur->bit = 0;
+}
+
+/* advance cursor by that many bits; maximum expected input value: 64,
+ * but depending on VLI implementation, it may be more. */
+static inline void bitstream_cursor_advance(struct bitstream_cursor *cur, unsigned int bits)
+{
+	bits += cur->bit;
+	cur->b = cur->b + (bits >> 3);
+	cur->bit = bits & 7;
+}
+
+/* the bitstream itself knows its length */
+struct bitstream {
+	struct bitstream_cursor cur;
+	unsigned char *buf;
+	size_t buf_len;		/* in bytes */
+
+	/* for input stream:
+	 * number of trailing 0 bits for padding
+	 * total number of valid bits in stream: buf_len * 8 - pad_bits */
+	unsigned int pad_bits;
+};
+
+static inline void bitstream_init(struct bitstream *bs, void *s, size_t len, unsigned int pad_bits)
+{
+	bs->buf = s;
+	bs->buf_len = len;
+	bs->pad_bits = pad_bits;
+	bitstream_cursor_reset(&bs->cur, bs->buf);
+}
+
+static inline void bitstream_rewind(struct bitstream *bs)
+{
+	bitstream_cursor_reset(&bs->cur, bs->buf);
+	memset(bs->buf, 0, bs->buf_len);
+}
+
+/* Put (at most 64) least significant bits of val into bitstream, and advance cursor.
+ * Ignores "pad_bits".
+ * Returns zero if bits == 0 (nothing to do).
+ * Returns number of bits used if successful.
+ *
+ * If there is not enough room left in bitstream,
+ * leaves bitstream unchanged and returns -ENOBUFS.
+ */
+static inline int bitstream_put_bits(struct bitstream *bs, u64 val, const unsigned int bits)
+{
+	unsigned char *b = bs->cur.b;
+	unsigned int tmp;
+
+	if (bits == 0)
+		return 0;
+
+	if ((bs->cur.b + ((bs->cur.bit + bits -1) >> 3)) - bs->buf >= bs->buf_len)
+		return -ENOBUFS;
+
+	/* paranoia: strip off hi bits; they should not be set anyways. */
+	if (bits < 64)
+		val &= ~0ULL >> (64 - bits);
+
+	*b++ |= (val & 0xff) << bs->cur.bit;
+
+	for (tmp = 8 - bs->cur.bit; tmp < bits; tmp += 8)
+		*b++ |= (val >> tmp) & 0xff;
+
+	bitstream_cursor_advance(&bs->cur, bits);
+	return bits;
+}
+
+/* Fetch (at most 64) bits from bitstream into *out, and advance cursor.
+ *
+ * If more than 64 bits are requested, returns -EINVAL and leave *out unchanged.
+ *
+ * If there are less than the requested number of valid bits left in the
+ * bitstream, still fetches all available bits.
+ *
+ * Returns number of actually fetched bits.
+ */
+static inline int bitstream_get_bits(struct bitstream *bs, u64 *out, int bits)
+{
+	u64 val;
+	unsigned int n;
+
+	if (bits > 64)
+		return -EINVAL;
+
+	if (bs->cur.b + ((bs->cur.bit + bs->pad_bits + bits -1) >> 3) - bs->buf >= bs->buf_len)
+		bits = ((bs->buf_len - (bs->cur.b - bs->buf)) << 3)
+			- bs->cur.bit - bs->pad_bits;
+
+	if (bits == 0) {
+		*out = 0;
+		return 0;
+	}
+
+	/* get the high bits */
+	val = 0;
+	n = (bs->cur.bit + bits + 7) >> 3;
+	/* n may be at most 9, if cur.bit + bits > 64 */
+	/* which means this copies at most 8 byte */
+	if (n) {
+		memcpy(&val, bs->cur.b+1, n - 1);
+		val = le64_to_cpu(val) << (8 - bs->cur.bit);
+	}
+
+	/* we still need the low bits */
+	val |= bs->cur.b[0] >> bs->cur.bit;
+
+	/* and mask out bits we don't want */
+	val &= ~0ULL >> (64 - bits);
+
+	bitstream_cursor_advance(&bs->cur, bits);
+	*out = val;
+
+	return bits;
+}
+
+/* we still need to actually define the code. */
+
+/*
+ * encoding is "visualised" as
+ * __little endian__ bitstream, least significant bit first (left most)
+ *
+ * this particular encoding is chosen so that the prefix code
+ * starts as unary encoding the level, then modified so that
+ * 11 levels can be described in 8bit, with minimal overhead
+ * for the smaller levels.
+ *
+ * Number of data bits follow fibonacci sequence, with the exception of the
+ * last level (+1 data bit, so it makes 64bit total).  The only worse code when
+ * encoding bit polarity runlength is 2 plain bits => 3 code bits.
+prefix    data bits                                  max val    Nº data bits
+0                                                                     0x1  0
+10 x                                                                  0x3  1
+110 x                                                                 0x5  1
+1110 xx                                                               0x9  2
+11110 xxx                                                            0x11  3
+1111100 x xxxx                                                       0x31  5
+1111101 x xxxxxxx                                                   0x131  8
+11111100  xxxxxxxx xxxxx                                           0x2131 13
+11111110  xxxxxxxx xxxxxxxx xxxxx                                0x202131 21
+11111101  xxxxxxxx xxxxxxxx xxxxxxxx  xxxxxxxx xx             0x400202131 34
+11111111  xxxxxxxx xxxxxxxx xxxxxxxx  xxxxxxxx xxxxxxxx xxxxxxxx xxxxxxxx 56
+ * maximum encodable value: 0x100000400202131 == 2**56 + some */
+
+/* LEVEL: (total bits, prefix bits, prefix value),
+ * sorted ascending by number of total bits.
+ * The rest of the code table is calculated at compiletime from this. */
+
+/* fibonacci data 0, 1, ... */
+#define VLI_L_0_1() do { \
+	LEVEL( 1, 1, 0x00); \
+	LEVEL( 3, 2, 0x01); \
+	LEVEL( 4, 3, 0x03); \
+	LEVEL( 6, 4, 0x07); \
+	LEVEL( 8, 5, 0x0f); \
+	LEVEL(12, 7, 0x1f); \
+	LEVEL(15, 7, 0x5f); \
+	LEVEL(21, 8, 0x3f); \
+	LEVEL(29, 8, 0x7f); \
+	LEVEL(42, 8, 0xbf); \
+	LEVEL(64, 8, 0xff); \
+	} while (0)
+
+/* Some variants, differeing in number of levels, prefix value, and number of
+ * databits in each level.  I tried a lot of variants. Those where the number
+ * of data bits follows the fibonacci sequence (with a certain offset) simply
+ * "look best" ;-)
+ * All of these can encode at least "2 ** 56". */
+
+/* fibonacci data 1, 1, ... */
+#define VLI_L_1_1() do { \
+	LEVEL( 2, 1, 0x00); \
+	LEVEL( 3, 2, 0x01); \
+	LEVEL( 5, 3, 0x03); \
+	LEVEL( 7, 4, 0x07); \
+	LEVEL(10, 5, 0x0f); \
+	LEVEL(14, 6, 0x1f); \
+	LEVEL(21, 8, 0x3f); \
+	LEVEL(29, 8, 0x7f); \
+	LEVEL(42, 8, 0xbf); \
+	LEVEL(64, 8, 0xff); \
+	} while (0)
+
+/* fibonacci data 1, 2, ... */
+#define VLI_L_1_2() do { \
+	LEVEL( 2, 1, 0x00); \
+	LEVEL( 4, 2, 0x01); \
+	LEVEL( 6, 3, 0x03); \
+	LEVEL( 9, 4, 0x07); \
+	LEVEL(13, 5, 0x0f); \
+	LEVEL(19, 6, 0x1f); \
+	LEVEL(28, 7, 0x3f); \
+	LEVEL(42, 8, 0x7f); \
+	LEVEL(64, 8, 0xff); \
+	} while (0)
+
+/* fibonacci data 2, 3, ... */
+#define VLI_L_2_3() do { \
+	LEVEL( 3, 1, 0x00); \
+	LEVEL( 5, 2, 0x01); \
+	LEVEL( 8, 3, 0x03); \
+	LEVEL(12, 4, 0x07); \
+	LEVEL(18, 5, 0x0f); \
+	LEVEL(27, 6, 0x1f); \
+	LEVEL(41, 7, 0x3f); \
+	LEVEL(64, 7, 0x5f); \
+	} while (0)
+
+/* fibonacci data 3, 5, ... */
+#define VLI_L_3_5() do { \
+	LEVEL( 4, 1, 0x00); \
+	LEVEL( 7, 2, 0x01); \
+	LEVEL(11, 3, 0x03); \
+	LEVEL(17, 4, 0x07); \
+	LEVEL(26, 5, 0x0f); \
+	LEVEL(40, 6, 0x1f); \
+	LEVEL(64, 6, 0x3f); \
+	} while (0)
+
+/* CONFIG */
+#ifndef VLI_LEVELS
+#define VLI_LEVELS() VLI_L_3_5()
+#endif
+
+/* finds a suitable level to decode the least significant part of in.
+ * returns number of bits consumed.
+ *
+ * BUG() for bad input, as that would mean a buggy code table. */
+static inline int vli_decode_bits(u64 *out, const u64 in)
+{
+	u64 adj = 1;
+
+#define LEVEL(t,b,v)					\
+	do {						\
+		if ((in & ((1 << b) -1)) == v) {	\
+			*out = ((in & ((~0ULL) >> (64-t))) >> b) + adj;	\
+			return t;			\
+		}					\
+		adj += 1ULL << (t - b);			\
+	} while (0)
+
+	VLI_LEVELS();
+
+	/* NOT REACHED, if VLI_LEVELS code table is defined properly */
+	BUG();
+#undef LEVEL
+}
+
+/* return number of code bits needed,
+ * or negative error number */
+static inline int __vli_encode_bits(u64 *out, const u64 in)
+{
+	u64 max = 0;
+	u64 adj = 1;
+
+	if (in == 0)
+		return -EINVAL;
+
+#define LEVEL(t,b,v) do {		\
+		max += 1ULL << (t - b);	\
+		if (in <= max) {	\
+			if (out)	\
+				*out = ((in - adj) << b) | v;	\
+			return t;	\
+		}			\
+		adj = max + 1;		\
+	} while (0)
+
+	VLI_LEVELS();
+
+	return -EOVERFLOW;
+#undef LEVEL
+}
+
+/* encodes @in as vli into @bs;
+
+ * return values
+ *  > 0: number of bits successfully stored in bitstream
+ * -ENOBUFS @bs is full
+ * -EINVAL input zero (invalid)
+ * -EOVERFLOW input too large for this vli code (invalid)
+ */
+static inline int vli_encode_bits(struct bitstream *bs, u64 in)
+{
+	u64 code = code;
+	int bits = __vli_encode_bits(&code, in);
+
+	if (bits <= 0)
+		return bits;
+
+	return bitstream_put_bits(bs, code, bits);
+}
+
+#undef VLI_L_0_1
+#undef VLI_L_1_1
+#undef VLI_L_1_2
+#undef VLI_L_2_3
+#undef VLI_L_3_5
+
+#undef VLI_LEVELS
+#endif
--- linux-rt-2.6.31.orig/ubuntu/drbd/linux/drbd_config.h
+++ linux-rt-2.6.31/ubuntu/drbd/linux/drbd_config.h
@@ -0,0 +1,43 @@
+/*
+  drbd_config.h
+  DRBD's compile time configuration.
+
+  drbd is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation; either version 2, or (at your option)
+  any later version.
+
+  drbd is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with drbd; see the file COPYING.  If not, write to
+  the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#ifndef DRBD_CONFIG_H
+#define DRBD_CONFIG_H
+
+extern const char *drbd_buildtag(void);
+
+#define REL_VERSION "8.3.1"
+#define API_VERSION 88
+#define PRO_VERSION_MIN 86
+#define PRO_VERSION_MAX 90
+
+#ifndef __CHECKER__   /* for a sparse run, we need all STATICs */
+#define DBG_ALL_SYMBOLS /* no static functs, improves quality of OOPS traces */
+#endif
+
+
+/* Define this to enable dynamic tracing controlled by module parameters
+ * at run time. This enables ALL use of dynamic tracing including packet
+ * and bio dumping, etc */
+#define ENABLE_DYNAMIC_TRACE
+
+/* Enable fault insertion code */
+#define DRBD_ENABLE_FAULTS
+
+#endif
--- linux-rt-2.6.31.orig/ubuntu/drbd/linux/drbd_limits.h
+++ linux-rt-2.6.31/ubuntu/drbd/linux/drbd_limits.h
@@ -0,0 +1,133 @@
+/*
+  drbd_limits.h
+  This file is part of DRBD by Philipp Reisner and Lars Ellenberg.
+*/
+
+/*
+ * Our current limitations.
+ * Some of them are hard limits,
+ * some of them are arbitrary range limits, that make it easier to provide
+ * feedback about nonsense settings for certain configurable values.
+ */
+
+#ifndef DRBD_LIMITS_H
+#define DRBD_LIMITS_H 1
+
+#define DEBUG_RANGE_CHECK 0
+
+#define DRBD_MINOR_COUNT_MIN 1
+#define DRBD_MINOR_COUNT_MAX 255
+
+#define DRBD_DIALOG_REFRESH_MIN 0
+#define DRBD_DIALOG_REFRESH_MAX 600
+
+/* valid port number */
+#define DRBD_PORT_MIN 1
+#define DRBD_PORT_MAX 0xffff
+
+/* startup { */
+  /* if you want more than 3.4 days, disable */
+#define DRBD_WFC_TIMEOUT_MIN 0
+#define DRBD_WFC_TIMEOUT_MAX 300000
+#define DRBD_WFC_TIMEOUT_DEF 0
+
+#define DRBD_DEGR_WFC_TIMEOUT_MIN 0
+#define DRBD_DEGR_WFC_TIMEOUT_MAX 300000
+#define DRBD_DEGR_WFC_TIMEOUT_DEF 0
+
+#define DRBD_OUTDATED_WFC_TIMEOUT_MIN 0
+#define DRBD_OUTDATED_WFC_TIMEOUT_MAX 300000
+#define DRBD_OUTDATED_WFC_TIMEOUT_DEF 0
+/* }*/
+
+/* net { */
+  /* timeout, unit centi seconds
+   * more than one minute timeout is not usefull */
+#define DRBD_TIMEOUT_MIN 1
+#define DRBD_TIMEOUT_MAX 600
+#define DRBD_TIMEOUT_DEF 60       /* 6 seconds */
+
+  /* active connection retries when WFConnection */
+#define DRBD_CONNECT_INT_MIN 1
+#define DRBD_CONNECT_INT_MAX 120
+#define DRBD_CONNECT_INT_DEF 10   /* seconds */
+
+  /* keep-alive probes when idle */
+#define DRBD_PING_INT_MIN 1
+#define DRBD_PING_INT_MAX 120
+#define DRBD_PING_INT_DEF 10
+
+ /* timeout for the ping packets.*/
+#define DRBD_PING_TIMEO_MIN  1
+#define DRBD_PING_TIMEO_MAX  100
+#define DRBD_PING_TIMEO_DEF  5
+
+  /* max number of write requests between write barriers */
+#define DRBD_MAX_EPOCH_SIZE_MIN 1
+#define DRBD_MAX_EPOCH_SIZE_MAX 20000
+#define DRBD_MAX_EPOCH_SIZE_DEF 2048
+
+  /* I don't think that a tcp send buffer of more than 10M is usefull */
+#define DRBD_SNDBUF_SIZE_MIN  0
+#define DRBD_SNDBUF_SIZE_MAX  (10<<20)
+#define DRBD_SNDBUF_SIZE_DEF  (2*65535)
+
+  /* @4k PageSize -> 128kB - 512MB */
+#define DRBD_MAX_BUFFERS_MIN  32
+#define DRBD_MAX_BUFFERS_MAX  131072
+#define DRBD_MAX_BUFFERS_DEF  2048
+
+  /* @4k PageSize -> 4kB - 512MB */
+#define DRBD_UNPLUG_WATERMARK_MIN  1
+#define DRBD_UNPLUG_WATERMARK_MAX  131072
+#define DRBD_UNPLUG_WATERMARK_DEF (DRBD_MAX_BUFFERS_DEF/16)
+
+  /* 0 is disabled.
+   * 200 should be more than enough even for very short timeouts */
+#define DRBD_KO_COUNT_MIN  0
+#define DRBD_KO_COUNT_MAX  200
+#define DRBD_KO_COUNT_DEF  0
+/* } */
+
+/* syncer { */
+  /* FIXME allow rate to be zero? */
+#define DRBD_RATE_MIN 1
+/* channel bonding 10 GbE, or other hardware */
+#define DRBD_RATE_MAX (4 << 20)
+#define DRBD_RATE_DEF 250  /* kb/second */
+
+  /* less than 7 would hit performance unneccessarily.
+   * 3833 is the largest prime that still does fit
+   * into 64 sectors of activity log */
+#define DRBD_AL_EXTENTS_MIN  7
+#define DRBD_AL_EXTENTS_MAX  3833
+#define DRBD_AL_EXTENTS_DEF  127
+
+#define DRBD_AFTER_MIN  -1
+#define DRBD_AFTER_MAX  255
+#define DRBD_AFTER_DEF  -1
+
+/* } */
+
+/* drbdsetup XY resize -d Z
+ * you are free to reduce the device size to nothing, if you want to.
+ * the upper limit with 64bit kernel, enough ram and flexible meta data
+ * is 16 TB, currently. */
+/* DRBD_MAX_SECTORS */
+#define DRBD_DISK_SIZE_SECT_MIN  0
+#define DRBD_DISK_SIZE_SECT_MAX  (16 * (2LLU << 30))
+#define DRBD_DISK_SIZE_SECT_DEF  0 /* = disabled = no user size... */
+
+#define DRBD_ON_IO_ERROR_DEF PassOn
+#define DRBD_FENCING_DEF DontCare
+#define DRBD_AFTER_SB_0P_DEF Disconnect
+#define DRBD_AFTER_SB_1P_DEF Disconnect
+#define DRBD_AFTER_SB_2P_DEF Disconnect
+#define DRBD_RR_CONFLICT_DEF Disconnect
+
+#define DRBD_MAX_BIO_BVECS_MIN 0
+#define DRBD_MAX_BIO_BVECS_MAX 128
+#define DRBD_MAX_BIO_BVECS_DEF 0
+
+#undef RANGE
+#endif
--- linux-rt-2.6.31.orig/ubuntu/drbd/linux/drbd_tag_magic.h
+++ linux-rt-2.6.31/ubuntu/drbd/linux/drbd_tag_magic.h
@@ -0,0 +1,83 @@
+#ifndef DRBD_TAG_MAGIC_H
+#define DRBD_TAG_MAGIC_H
+
+#define TT_END     0
+#define TT_REMOVED 0xE000
+
+/* declare packet_type enums */
+enum packet_types {
+#define NL_PACKET(name, number, fields) P_ ## name = number,
+#define NL_INTEGER(pn, pr, member)
+#define NL_INT64(pn, pr, member)
+#define NL_BIT(pn, pr, member)
+#define NL_STRING(pn, pr, member, len)
+#include "drbd_nl.h"
+	P_nl_after_last_packet,
+};
+
+/* These struct are used to deduce the size of the tag lists: */
+#define NL_PACKET(name, number, fields)	\
+	struct name ## _tag_len_struct { fields };
+#define NL_INTEGER(pn, pr, member)		\
+	int member; int tag_and_len ## member;
+#define NL_INT64(pn, pr, member)		\
+	__u64 member; int tag_and_len ## member;
+#define NL_BIT(pn, pr, member)		\
+	unsigned char member:1; int tag_and_len ## member;
+#define NL_STRING(pn, pr, member, len)	\
+	unsigned char member[len]; int member ## _len; \
+	int tag_and_len ## member;
+#include "linux/drbd_nl.h"
+
+/* declate tag-list-sizes */
+static const int tag_list_sizes[] = {
+#define NL_PACKET(name, number, fields) 2 fields ,
+#define NL_INTEGER(pn, pr, member)      + 4 + 4
+#define NL_INT64(pn, pr, member)        + 4 + 8
+#define NL_BIT(pn, pr, member)          + 4 + 1
+#define NL_STRING(pn, pr, member, len)  + 4 + (len)
+#include "drbd_nl.h"
+};
+
+/* The two highest bits are used for the tag type */
+#define TT_MASK      0xC000
+#define TT_INTEGER   0x0000
+#define TT_INT64     0x4000
+#define TT_BIT       0x8000
+#define TT_STRING    0xC000
+/* The next bit indicates if processing of the tag is mandatory */
+#define T_MANDATORY  0x2000
+#define T_MAY_IGNORE 0x0000
+#define TN_MASK      0x1fff
+/* The remaining 13 bits are used to enumerate the tags */
+
+#define tag_type(T)   ((T) & TT_MASK)
+#define tag_number(T) ((T) & TN_MASK)
+
+/* declare tag enums */
+#define NL_PACKET(name, number, fields) fields
+enum drbd_tags {
+#define NL_INTEGER(pn, pr, member)     T_ ## member = pn | TT_INTEGER | pr ,
+#define NL_INT64(pn, pr, member)       T_ ## member = pn | TT_INT64   | pr ,
+#define NL_BIT(pn, pr, member)         T_ ## member = pn | TT_BIT     | pr ,
+#define NL_STRING(pn, pr, member, len) T_ ## member = pn | TT_STRING  | pr ,
+#include "drbd_nl.h"
+};
+
+struct tag {
+	const char *name;
+	int type_n_flags;
+	int max_len;
+};
+
+/* declare tag names */
+#define NL_PACKET(name, number, fields) fields
+static const struct tag tag_descriptions[] = {
+#define NL_INTEGER(pn, pr, member)     [ pn ] = { #member, TT_INTEGER | pr, sizeof(int)   },
+#define NL_INT64(pn, pr, member)       [ pn ] = { #member, TT_INT64   | pr, sizeof(__u64) },
+#define NL_BIT(pn, pr, member)         [ pn ] = { #member, TT_BIT     | pr, sizeof(int)   },
+#define NL_STRING(pn, pr, member, len) [ pn ] = { #member, TT_STRING  | pr, (len)         },
+#include "drbd_nl.h"
+};
+
+#endif
--- linux-rt-2.6.31.orig/ubuntu/drbd/linux/drbd_nl.h
+++ linux-rt-2.6.31/ubuntu/drbd/linux/drbd_nl.h
@@ -0,0 +1,135 @@
+/*
+   PAKET( name,
+	  TYPE ( pn, pr, member )
+	  ...
+   )
+
+   You may never reissue one of the pn arguments
+*/
+
+#if !defined(NL_PACKET) || !defined(NL_STRING) || !defined(NL_INTEGER) || !defined(NL_BIT) || !defined(NL_INT64)
+#error "The macros NL_PACKET, NL_STRING, NL_INTEGER, NL_INT64 and NL_BIT needs to be defined"
+#endif
+
+NL_PACKET(primary, 1,
+       NL_BIT(		1,	T_MAY_IGNORE,	overwrite_peer)
+)
+
+NL_PACKET(secondary, 2, )
+
+NL_PACKET(disk_conf, 3,
+	NL_INT64(	2,	T_MAY_IGNORE,	disk_size)
+	NL_STRING(	3,	T_MANDATORY,	backing_dev,	128)
+	NL_STRING(	4,	T_MANDATORY,	meta_dev,	128)
+	NL_INTEGER(	5,	T_MANDATORY,	meta_dev_idx)
+	NL_INTEGER(	6,	T_MAY_IGNORE,	on_io_error)
+	NL_INTEGER(	7,	T_MAY_IGNORE,	fencing)
+	NL_BIT(		37,	T_MAY_IGNORE,	use_bmbv)
+	NL_BIT(		53,	T_MAY_IGNORE,	no_disk_flush)
+	NL_BIT(		54,	T_MAY_IGNORE,	no_md_flush)
+	  /*  55 max_bio_size was available in 8.2.6rc2 */
+	NL_INTEGER(	56,	T_MAY_IGNORE,	max_bio_bvecs)
+	NL_BIT(		57,	T_MAY_IGNORE,	no_disk_barrier)
+	NL_BIT(		58,	T_MAY_IGNORE,	no_disk_drain)
+)
+
+NL_PACKET(detach, 4, )
+
+NL_PACKET(net_conf, 5,
+	NL_STRING(	8,	T_MANDATORY,	my_addr,	128)
+	NL_STRING(	9,	T_MANDATORY,	peer_addr,	128)
+	NL_STRING(	10,	T_MAY_IGNORE,	shared_secret,	SHARED_SECRET_MAX)
+	NL_STRING(	11,	T_MAY_IGNORE,	cram_hmac_alg,	SHARED_SECRET_MAX)
+	NL_STRING(	44,	T_MAY_IGNORE,	integrity_alg,	SHARED_SECRET_MAX)
+	NL_INTEGER(	14,	T_MAY_IGNORE,	timeout)
+	NL_INTEGER(	15,	T_MANDATORY,	wire_protocol)
+	NL_INTEGER(	16,	T_MAY_IGNORE,	try_connect_int)
+	NL_INTEGER(	17,	T_MAY_IGNORE,	ping_int)
+	NL_INTEGER(	18,	T_MAY_IGNORE,	max_epoch_size)
+	NL_INTEGER(	19,	T_MAY_IGNORE,	max_buffers)
+	NL_INTEGER(	20,	T_MAY_IGNORE,	unplug_watermark)
+	NL_INTEGER(	21,	T_MAY_IGNORE,	sndbuf_size)
+	NL_INTEGER(	22,	T_MAY_IGNORE,	ko_count)
+	NL_INTEGER(	24,	T_MAY_IGNORE,	after_sb_0p)
+	NL_INTEGER(	25,	T_MAY_IGNORE,	after_sb_1p)
+	NL_INTEGER(	26,	T_MAY_IGNORE,	after_sb_2p)
+	NL_INTEGER(	39,	T_MAY_IGNORE,	rr_conflict)
+	NL_INTEGER(	40,	T_MAY_IGNORE,	ping_timeo)
+	  /* 59 addr_family was available in GIT, never released */
+	NL_BIT(		60,	T_MANDATORY,	mind_af)
+	NL_BIT(		27,	T_MAY_IGNORE,	want_lose)
+	NL_BIT(		28,	T_MAY_IGNORE,	two_primaries)
+	NL_BIT(		41,	T_MAY_IGNORE,	always_asbp)
+	NL_BIT(		61,	T_MAY_IGNORE,	no_cork)
+	NL_BIT(		62,	T_MANDATORY,	auto_sndbuf_size)
+)
+
+NL_PACKET(disconnect, 6, )
+
+NL_PACKET(resize, 7,
+	NL_INT64(		29,	T_MAY_IGNORE,	resize_size)
+)
+
+NL_PACKET(syncer_conf, 8,
+	NL_INTEGER(	30,	T_MAY_IGNORE,	rate)
+	NL_INTEGER(	31,	T_MAY_IGNORE,	after)
+	NL_INTEGER(	32,	T_MAY_IGNORE,	al_extents)
+	NL_STRING(      52,     T_MAY_IGNORE,   verify_alg,     SHARED_SECRET_MAX)
+	NL_STRING(      51,     T_MAY_IGNORE,   cpu_mask,       32)
+	NL_STRING(	64,	T_MAY_IGNORE,	csums_alg,	SHARED_SECRET_MAX)
+	NL_BIT(         65,     T_MAY_IGNORE,   use_rle_encoding)
+)
+
+NL_PACKET(invalidate, 9, )
+NL_PACKET(invalidate_peer, 10, )
+NL_PACKET(pause_sync, 11, )
+NL_PACKET(resume_sync, 12, )
+NL_PACKET(suspend_io, 13, )
+NL_PACKET(resume_io, 14, )
+NL_PACKET(outdate, 15, )
+NL_PACKET(get_config, 16, )
+NL_PACKET(get_state, 17,
+	NL_INTEGER(	33,	T_MAY_IGNORE,	state_i)
+)
+
+NL_PACKET(get_uuids, 18,
+	NL_STRING(	34,	T_MAY_IGNORE,	uuids,	(UUID_SIZE*sizeof(__u64)))
+	NL_INTEGER(	35,	T_MAY_IGNORE,	uuids_flags)
+)
+
+NL_PACKET(get_timeout_flag, 19,
+	NL_BIT(		36,	T_MAY_IGNORE,	use_degraded)
+)
+
+NL_PACKET(call_helper, 20,
+	NL_STRING(	38,	T_MAY_IGNORE,	helper,		32)
+)
+
+/* Tag nr 42 already allocated in drbd-8.1 development. */
+
+NL_PACKET(sync_progress, 23,
+	NL_INTEGER(	43,	T_MAY_IGNORE,	sync_progress)
+)
+
+NL_PACKET(dump_ee, 24,
+	NL_STRING(	45,	T_MAY_IGNORE,	dump_ee_reason, 32)
+	NL_STRING(	46,	T_MAY_IGNORE,	seen_digest, SHARED_SECRET_MAX)
+	NL_STRING(	47,	T_MAY_IGNORE,	calc_digest, SHARED_SECRET_MAX)
+	NL_INT64(	48,	T_MAY_IGNORE,	ee_sector)
+	NL_INT64(	49,	T_MAY_IGNORE,	ee_block_id)
+	NL_STRING(	50,	T_MAY_IGNORE,	ee_data,	32 << 10)
+)
+
+NL_PACKET(start_ov, 25,
+)
+
+NL_PACKET(new_c_uuid, 26,
+       NL_BIT(		63,	T_MANDATORY,	clear_bm)
+)
+
+#undef NL_PACKET
+#undef NL_INTEGER
+#undef NL_INT64
+#undef NL_BIT
+#undef NL_STRING
+
--- linux-rt-2.6.31.orig/ubuntu/drbd/linux/drbd.h
+++ linux-rt-2.6.31/ubuntu/drbd/linux/drbd.h
@@ -0,0 +1,372 @@
+/*
+  drbd.h
+  Kernel module for 2.6.x Kernels
+
+  This file is part of DRBD by Philipp Reisner and Lars Ellenberg.
+
+  Copyright (C) 2001-2008, LINBIT Information Technologies GmbH.
+  Copyright (C) 2001-2008, Philipp Reisner <philipp.reisner@linbit.com>.
+  Copyright (C) 2001-2008, Lars Ellenberg <lars.ellenberg@linbit.com>.
+
+  drbd is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation; either version 2, or (at your option)
+  any later version.
+
+  drbd is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with drbd; see the file COPYING.  If not, write to
+  the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
+
+*/
+#ifndef DRBD_H
+#define DRBD_H
+#include <linux/drbd_config.h>
+#include <linux/connector.h>
+
+#include <asm/types.h>
+
+#ifdef __KERNEL__
+#include <linux/types.h>
+#include <asm/byteorder.h>
+#else
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <limits.h>
+
+/* Altough the Linux source code makes a difference between
+   generic endiness and the bitfields' endianess, there is no
+   architecture as of Linux-2.6.24-rc4 where the bitfileds' endianess
+   does not match the generic endianess. */
+
+#if __BYTE_ORDER == __LITTLE_ENDIAN
+#define __LITTLE_ENDIAN_BITFIELD
+#elif __BYTE_ORDER == __BIG_ENDIAN
+#define __BIG_ENDIAN_BITFIELD
+#else
+# error "sorry, weird endianness on this box"
+#endif
+
+#endif
+
+
+enum io_error_handler {
+	PassOn, /* FIXME should the better be named "Ignore"? */
+	CallIOEHelper,
+	Detach
+};
+
+enum fencing_policy {
+	DontCare,
+	Resource,
+	Stonith
+};
+
+enum disconnect_handler {
+	Reconnect,
+	DropNetConf,
+	FreezeIO
+};
+
+enum after_sb_handler {
+	Disconnect,
+	DiscardYoungerPri,
+	DiscardOlderPri,
+	DiscardZeroChg,
+	DiscardLeastChg,
+	DiscardLocal,
+	DiscardRemote,
+	Consensus,
+	DiscardSecondary,
+	CallHelper,
+	Violently
+};
+
+/* KEEP the order, do not delete or insert!
+ * Or change the API_VERSION, too. */
+enum ret_codes {
+	RetCodeBase = 100,
+	NoError,         /* 101 ... */
+	LAAlreadyInUse,
+	OAAlreadyInUse,
+	LDNameInvalid,
+	MDNameInvalid,
+	LDAlreadyInUse,
+	LDNoBlockDev,
+	MDNoBlockDev,
+	LDOpenFailed,
+	MDOpenFailed,
+	LDDeviceTooSmall,
+	MDDeviceTooSmall,
+	LDNoConfig,
+	LDMounted,
+	MDMounted,
+	LDMDInvalid,
+	LDDeviceTooLarge,
+	MDIOError,
+	MDInvalid,
+	CRAMAlgNotAvail,
+	CRAMAlgNotDigest,
+	KMallocFailed,
+	DiscardNotAllowed,
+	HaveDiskConfig,
+	HaveNetConfig,
+	UnknownMandatoryTag,
+	MinorNotKnown,
+	StateNotAllowed,
+	GotSignal, /* EINTR */
+	NoResizeDuringResync,
+	APrimaryNodeNeeded,
+	SyncAfterInvalid,
+	SyncAfterCycle,
+	PauseFlagAlreadySet,
+	PauseFlagAlreadyClear,
+	DiskLowerThanOutdated, /* obsolete, now SS_LowerThanOutdated */
+	UnknownNetLinkPacket,
+	HaveNoDiskConfig,
+	ProtocolCRequired,
+	VMallocFailed,
+	IntegrityAlgNotAvail,
+	IntegrityAlgNotDigest,
+	CPUMaskParseFailed,
+	CSUMSAlgNotAvail,
+	CSUMSAlgNotDigest,
+	VERIFYAlgNotAvail,
+	VERIFYAlgNotDigest,
+	CSUMSResyncRunning,
+	VERIFYIsRunning,
+	DataOfWrongCurrent,
+	MayNotBeConnected,
+
+	/* insert new ones above this line */
+	AfterLastRetCode,
+};
+
+#define DRBD_PROT_A   1
+#define DRBD_PROT_B   2
+#define DRBD_PROT_C   3
+
+enum drbd_role {
+	Unknown = 0,
+	Primary = 1,     /* role */
+	Secondary = 2,   /* role */
+	role_mask = 3,
+};
+
+/* The order of these constants is important.
+ * The lower ones (<WFReportParams) indicate
+ * that there is no socket!
+ * >=WFReportParams ==> There is a socket
+ */
+enum drbd_conns {
+	StandAlone,
+	Disconnecting,  /* Temporal state on the way to StandAlone. */
+	Unconnected,    /* >= Unconnected -> inc_net() succeeds */
+
+	/* These temporal states are all used on the way
+	 * from >= Connected to Unconnected.
+	 * The 'disconnect reason' states
+	 * I do not allow to change beween them. */
+	Timeout,
+	BrokenPipe,
+	NetworkFailure,
+	ProtocolError,
+	TearDown,
+
+	WFConnection,
+	WFReportParams, /* we have a socket */
+	Connected,      /* we have introduced each other */
+	StartingSyncS,  /* starting full sync by IOCTL. */
+	StartingSyncT,  /* stariing full sync by IOCTL. */
+	WFBitMapS,
+	WFBitMapT,
+	WFSyncUUID,
+
+	/* All SyncStates are tested with this comparison
+	 * xx >= SyncSource && xx <= PausedSyncT */
+	SyncSource,
+	SyncTarget,
+	VerifyS,
+	VerifyT,
+	PausedSyncS,
+	PausedSyncT,
+	conn_mask = 31
+};
+
+enum drbd_disk_state {
+	Diskless,
+	Attaching,      /* In the process of reading the meta-data */
+	Failed,         /* Becomes Diskless as soon as we told it the peer */
+			/* when >= Failed it is legal to access mdev->bc */
+	Negotiating,    /* Late attaching state, we need to talk to the peer */
+	Inconsistent,
+	Outdated,
+	DUnknown,       /* Only used for the peer, never for myself */
+	Consistent,     /* Might be Outdated, might be UpToDate ... */
+	UpToDate,       /* Only this disk state allows applications' IO ! */
+	disk_mask = 15
+};
+
+union drbd_state_t {
+/* According to gcc's docs is the ...
+ * The order of allocation of bit-fields within a unit (C90 6.5.2.1, C99 6.7.2.1).
+ * Determined by ABI.
+ * pointed out by Maxim Uvarov q<muvarov@ru.mvista.com>
+ * even though we transmit as "cpu_to_be32(state)",
+ * the offsets of the bitfields still need to be swapped
+ * on different endianess.
+ */
+	struct {
+#if defined(__LITTLE_ENDIAN_BITFIELD)
+		unsigned role:2 ;   /* 3/4	 primary/secondary/unknown */
+		unsigned peer:2 ;   /* 3/4	 primary/secondary/unknown */
+		unsigned conn:5 ;   /* 17/32	 cstates */
+		unsigned disk:4 ;   /* 8/16	 from Diskless to UpToDate */
+		unsigned pdsk:4 ;   /* 8/16	 from Diskless to UpToDate */
+		unsigned susp:1 ;   /* 2/2	 IO suspended  no/yes */
+		unsigned aftr_isp:1 ; /* isp .. imposed sync pause */
+		unsigned peer_isp:1 ;
+		unsigned user_isp:1 ;
+		unsigned _pad:11;   /* 0	 unused */
+#elif defined(__BIG_ENDIAN_BITFIELD)
+		unsigned _pad:11;   /* 0	 unused */
+		unsigned user_isp:1 ;
+		unsigned peer_isp:1 ;
+		unsigned aftr_isp:1 ; /* isp .. imposed sync pause */
+		unsigned susp:1 ;   /* 2/2	 IO suspended  no/yes */
+		unsigned pdsk:4 ;   /* 8/16	 from Diskless to UpToDate */
+		unsigned disk:4 ;   /* 8/16	 from Diskless to UpToDate */
+		unsigned conn:5 ;   /* 17/32	 cstates */
+		unsigned peer:2 ;   /* 3/4	 primary/secondary/unknown */
+		unsigned role:2 ;   /* 3/4	 primary/secondary/unknown */
+#else
+# error "this endianess is not supported"
+#endif
+#ifndef DRBD_DEBUG_STATE_CHANGES
+#define DRBD_DEBUG_STATE_CHANGES 0
+#endif
+#if DRBD_DEBUG_STATE_CHANGES
+		unsigned int line;
+		const char *func;
+#endif
+	};
+	unsigned int i;
+};
+
+enum set_st_err {
+	SS_CW_NoNeed = 4,
+	SS_CW_Success = 3,
+	SS_NothingToDo = 2,
+	SS_Success = 1,
+	SS_UnknownError = 0, /* Used to sleep longer in _drbd_request_state */
+	SS_TwoPrimaries = -1,
+	SS_NoUpToDateDisk = -2,
+	SS_BothInconsistent = -4,
+	SS_SyncingDiskless = -5,
+	SS_ConnectedOutdates = -6,
+	SS_PrimaryNOP = -7,
+	SS_ResyncRunning = -8,
+	SS_AlreadyStandAlone = -9,
+	SS_CW_FailedByPeer = -10,
+	SS_IsDiskLess = -11,
+	SS_DeviceInUse = -12,
+	SS_NoNetConfig = -13,
+	SS_NoVerifyAlg = -14,       /* drbd-8.2 only */
+	SS_NeedConnection = -15,    /* drbd-8.2 only */
+	SS_LowerThanOutdated = -16,
+	SS_NotSupported = -17,      /* drbd-8.2 only */
+	SS_InTransientState = -18,  /* Retry after the next state change */
+	SS_ConcurrentStChg = -19,   /* Concurrent cluster side state change! */
+	SS_AfterLastError = -20,    /* Keep this at bottom */
+};
+
+/* from drbd_strings.c */
+extern const char *conns_to_name(enum drbd_conns);
+extern const char *roles_to_name(enum drbd_role);
+extern const char *disks_to_name(enum drbd_disk_state);
+extern const char *set_st_err_name(enum set_st_err);
+
+#ifndef BDEVNAME_SIZE
+# define BDEVNAME_SIZE 32
+#endif
+
+#define SHARED_SECRET_MAX 64
+
+enum MetaDataFlags {
+	__MDF_Consistent,
+	__MDF_PrimaryInd,
+	__MDF_ConnectedInd,
+	__MDF_FullSync,
+	__MDF_WasUpToDate,
+	__MDF_PeerOutDated, /* or worse (e.g. invalid). */
+	__MDF_CrashedPrimary,
+};
+#define MDF_Consistent      (1<<__MDF_Consistent)
+#define MDF_PrimaryInd      (1<<__MDF_PrimaryInd)
+#define MDF_ConnectedInd    (1<<__MDF_ConnectedInd)
+#define MDF_FullSync        (1<<__MDF_FullSync)
+#define MDF_WasUpToDate     (1<<__MDF_WasUpToDate)
+#define MDF_PeerOutDated    (1<<__MDF_PeerOutDated)
+#define MDF_CrashedPrimary  (1<<__MDF_CrashedPrimary)
+
+enum UuidIndex {
+	Current,
+	Bitmap,
+	History_start,
+	History_end,
+	UUID_SIZE,      /* nl-packet: number of dirty bits */
+	UUID_FLAGS,     /* nl-packet: flags */
+	EXT_UUID_SIZE   /* Everything. */
+};
+
+enum UseTimeout {
+	UT_Default      = 0,
+	UT_Degraded     = 1,
+	UT_PeerOutdated = 2,
+};
+
+#define UUID_JUST_CREATED ((__u64)4)
+
+#define DRBD_MAGIC 0x83740267
+#define BE_DRBD_MAGIC __constant_cpu_to_be32(DRBD_MAGIC)
+
+/* these are of type "int" */
+#define DRBD_MD_INDEX_INTERNAL -1
+#define DRBD_MD_INDEX_FLEX_EXT -2
+#define DRBD_MD_INDEX_FLEX_INT -3
+
+/* Start of the new netlink/connector stuff */
+
+#define DRBD_NL_CREATE_DEVICE 0x01
+#define DRBD_NL_SET_DEFAULTS  0x02
+
+/* The following line should be moved over to linux/connector.h
+ * when the time comes */
+#ifndef CN_IDX_DRBD
+# define CN_IDX_DRBD			0x4
+/* Ubuntu "intrepid ibex" release defined CN_IDX_DRBD as 0x6 */
+#endif
+#define CN_VAL_DRBD			0x1
+
+/* For searching a vacant cn_idx value */
+#define CN_IDX_STEP			6977
+
+struct drbd_nl_cfg_req {
+	int packet_type;
+	unsigned int drbd_minor;
+	int flags;
+	unsigned short tag_list[];
+};
+
+struct drbd_nl_cfg_reply {
+	int packet_type;
+	unsigned int minor;
+	int ret_code; /* enum ret_code or set_st_err_t */
+	unsigned short tag_list[]; /* only used with get_* calls */
+};
+
+#endif
--- linux-rt-2.6.31.orig/ubuntu/compcache/xvmalloc.c
+++ linux-rt-2.6.31/ubuntu/compcache/xvmalloc.c
@@ -0,0 +1,557 @@
+/*
+ * xvmalloc.c
+ *
+ * Copyright (C) 2008, 2009  Nitin Gupta
+ *
+ * This code is released using a dual license strategy: GPL/LGPL
+ * You can choose the licence that better fits your requirements.
+ *
+ * Released under the terms of GNU General Public License Version 2.0
+ * Released under the terms of GNU Lesser General Public License Version 2.1
+ */
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/bitops.h>
+#include <linux/errno.h>
+#include <linux/highmem.h>
+#include <linux/init.h>
+#include <linux/string.h>
+#include <linux/slab.h>
+
+#include "xvmalloc.h"
+#include "xvmalloc_int.h"
+
+static void stat_inc(u64 *value)
+{
+	*value = *value + 1;
+}
+
+static void stat_dec(u64 *value)
+{
+	*value = *value - 1;
+}
+
+static int test_flag(struct block_header *block, enum blockflags flag)
+{
+	return block->prev & BIT(flag);
+}
+
+static void set_flag(struct block_header *block, enum blockflags flag)
+{
+	block->prev |= BIT(flag);
+}
+
+static void clear_flag(struct block_header *block, enum blockflags flag)
+{
+	block->prev &= ~BIT(flag);
+}
+
+/*
+ * Given <pagenum, offset> pair, provide a derefrencable pointer.
+ * This is called from xv_malloc/xv_free path, so it needs to be fast.
+ */
+static void *get_ptr_atomic(u32 pagenum, u16 offset, enum km_type type)
+{
+	unsigned char *base;
+
+	base = kmap_atomic(pfn_to_page(pagenum), type);
+	return base + offset;
+}
+
+static void put_ptr_atomic(void *ptr, enum km_type type)
+{
+	kunmap_atomic(ptr, type);
+}
+
+static u32 get_blockprev(struct block_header *block)
+{
+	return block->prev & PREV_MASK;
+}
+
+static void set_blockprev(struct block_header *block, u16 new_offset)
+{
+	block->prev = new_offset | (block->prev & FLAGS_MASK);
+}
+
+static struct block_header *BLOCK_NEXT(struct block_header *block)
+{
+	return (struct block_header *)((char *)block + block->size + XV_ALIGN);
+}
+
+/*
+ * Get index of free list containing blocks of maximum size
+ * which is less than or equal to given size.
+ */
+static u32 get_index_for_insert(u32 size)
+{
+	if (unlikely(size > XV_MAX_ALLOC_SIZE))
+		size = XV_MAX_ALLOC_SIZE;
+	size &= ~FL_DELTA_MASK;
+	return (size - XV_MIN_ALLOC_SIZE) >> FL_DELTA_SHIFT;
+}
+
+/*
+ * Get index of free list having blocks of size greater than
+ * or equal to requested size.
+ */
+static u32 get_index(u32 size)
+{
+	if (unlikely(size < XV_MIN_ALLOC_SIZE))
+		size = XV_MIN_ALLOC_SIZE;
+	size = ALIGN(size, FL_DELTA);
+	return (size - XV_MIN_ALLOC_SIZE) >> FL_DELTA_SHIFT;
+}
+
+/*
+ * Allocate a memory page. Called when a pool needs to grow.
+ */
+static u32 xv_alloc_page(gfp_t flags)
+{
+	struct page *page;
+
+	//page = alloc_page(GFP_NOIO | __GFP_HIGHMEM);
+	page = alloc_page(flags);
+	if (unlikely(!page))
+		return 0;
+
+	return page_to_pfn(page);
+}
+
+/*
+ * Called when all objects in a page are freed.
+ */
+static void xv_free_page(u32 pagenum)
+{
+	__free_page(pfn_to_page(pagenum));
+}
+
+/**
+ * find_block - find block of at least given size
+ * @pool: memory pool to search from
+ * @size: size of block required
+ * @pagenum: page no. containing required block
+ * @offset: offset within the page where block is located.
+ *
+ * Searches two level bitmap to locate block of at least
+ * the given size. If such a block is found, it provides
+ * <pagenum, offset> to identify this block and returns index
+ * in freelist where we found this block.
+ * Otherwise, returns 0 and <pagenum, offset> params are not touched.
+ */
+static u32 find_block(struct xv_pool *pool, u32 size,
+			u32 *pagenum, u32 *offset)
+{
+	ulong flbitmap, slbitmap;
+	u32 flindex, slindex, slbitstart;
+
+	/* There are no free blocks in this pool */
+	if (!pool->flbitmap)
+		return 0;
+
+	/* Get freelist index correspoding to this size */
+	slindex = get_index(size);
+	slbitmap = pool->slbitmap[slindex / BITS_PER_LONG];
+	slbitstart = slindex % BITS_PER_LONG;
+
+	/*
+	 * If freelist is not empty at this index, we found the
+	 * block - head of this list. This is approximate best-fit match.
+	 */
+	if (test_bit(slbitstart, &slbitmap)) {
+		*pagenum = pool->freelist[slindex].pagenum;
+		*offset = pool->freelist[slindex].offset;
+		return slindex;
+	}
+
+	/*
+	 * No best-fit found. Search a bit further in bitmap for a free block.
+	 * Second level bitmap consists of series of 32-bit chunks. Search
+	 * further in the chunk where we expected a best-fit, starting from
+	 * index location found above.
+	 */
+	slbitstart++;
+	slbitmap >>= slbitstart;
+
+	/* Skip this search if we were already at end of this bitmap chunk */
+	if ((slbitstart != BITS_PER_LONG) && slbitmap) {
+		slindex += __ffs(slbitmap) + 1;
+		*pagenum = pool->freelist[slindex].pagenum;
+		*offset = pool->freelist[slindex].offset;
+		return slindex;
+	}
+
+	/* Now do a full two-level bitmap search to find next nearest fit */
+	flindex = slindex / BITS_PER_LONG;
+
+	flbitmap = (pool->flbitmap) >> (flindex + 1);
+	if (!flbitmap)
+		return 0;
+
+	flindex += __ffs(flbitmap) + 1;
+	slbitmap = pool->slbitmap[flindex];
+	slindex = (flindex * BITS_PER_LONG) + __ffs(slbitmap);
+	*pagenum = pool->freelist[slindex].pagenum;
+	*offset = pool->freelist[slindex].offset;
+
+	return slindex;
+}
+
+/*
+ * Insert block at <pagenum, offset> in freelist of given pool.
+ * freelist used depends on block size.
+ */
+static void insert_block(struct xv_pool *pool, u32 pagenum, u32 offset,
+			struct block_header *block)
+{
+	u32 flindex, slindex;
+	struct block_header *nextblock;
+
+	slindex = get_index_for_insert(block->size);
+	flindex = slindex / BITS_PER_LONG;
+
+	block->link.prev_pagenum = 0;
+	block->link.prev_offset = 0;
+	block->link.next_pagenum = pool->freelist[slindex].pagenum;
+	block->link.next_offset = pool->freelist[slindex].offset;
+	pool->freelist[slindex].pagenum = pagenum;
+	pool->freelist[slindex].offset = offset;
+
+	if (block->link.next_pagenum) {
+		nextblock = get_ptr_atomic(block->link.next_pagenum,
+					block->link.next_offset, KM_USER1);
+		nextblock->link.prev_pagenum = pagenum;
+		nextblock->link.prev_offset = offset;
+		put_ptr_atomic(nextblock, KM_USER1);
+	}
+
+	__set_bit(slindex % BITS_PER_LONG, &pool->slbitmap[flindex]);
+	__set_bit(flindex, &pool->flbitmap);
+}
+
+/*
+ * Remove block from head of freelist. Index 'slindex' identifies the freelist.
+ */
+static void remove_block_head(struct xv_pool *pool,
+			struct block_header *block, u32 slindex)
+{
+	struct block_header *tmpblock;
+	u32 flindex = slindex / BITS_PER_LONG;
+
+	pool->freelist[slindex].pagenum = block->link.next_pagenum;
+	pool->freelist[slindex].offset = block->link.next_offset;
+	block->link.prev_pagenum = 0;
+	block->link.prev_offset = 0;
+
+	if (!pool->freelist[slindex].pagenum) {
+		__clear_bit(slindex % BITS_PER_LONG, &pool->slbitmap[flindex]);
+		if (!pool->slbitmap[flindex])
+			__clear_bit(flindex, &pool->flbitmap);
+	} else {
+		/*
+		 * DEBUG ONLY: We need not reinitialize freelist head previous
+		 * pointer to 0 - we never depend on its value. But just for
+		 * sanity, lets do it.
+		 */
+		tmpblock = get_ptr_atomic(pool->freelist[slindex].pagenum,
+				pool->freelist[slindex].offset, KM_USER1);
+		tmpblock->link.prev_pagenum = 0;
+		tmpblock->link.prev_offset = 0;
+		put_ptr_atomic(tmpblock, KM_USER1);
+	}
+}
+
+/*
+ * Remove block from freelist. Index 'slindex' identifies the freelist.
+ */
+static void remove_block(struct xv_pool *pool, u32 pagenum, u32 offset,
+			struct block_header *block, u32 slindex)
+{
+	u32 flindex;
+	struct block_header *tmpblock;
+
+	if (pool->freelist[slindex].pagenum == pagenum
+	   && pool->freelist[slindex].offset == offset) {
+		remove_block_head(pool, block, slindex);
+		return;
+	}
+
+	flindex = slindex / BITS_PER_LONG;
+
+	if (block->link.prev_pagenum) {
+		tmpblock = get_ptr_atomic(block->link.prev_pagenum,
+				block->link.prev_offset, KM_USER1);
+		tmpblock->link.next_pagenum = block->link.next_pagenum;
+		tmpblock->link.next_offset = block->link.next_offset;
+		put_ptr_atomic(tmpblock, KM_USER1);
+	}
+
+	if (block->link.next_pagenum) {
+		tmpblock = get_ptr_atomic(block->link.next_pagenum,
+				block->link.next_offset, KM_USER1);
+		tmpblock->link.prev_pagenum = block->link.prev_pagenum;
+		tmpblock->link.prev_offset = block->link.prev_offset;
+		put_ptr_atomic(tmpblock, KM_USER1);
+	}
+
+	return;
+}
+
+/*
+ * Allocate a page and add it freelist of given pool.
+ */
+static int grow_pool(struct xv_pool *pool, gfp_t flags)
+{
+	u32 pagenum;
+	struct block_header *block;
+
+	pagenum = xv_alloc_page(flags);
+	if (unlikely(!pagenum))
+		return -ENOMEM;
+
+	stat_inc(&pool->total_pages);
+
+	spin_lock(&pool->lock);
+	block = get_ptr_atomic(pagenum, 0, KM_USER0);
+
+	block->size = PAGE_SIZE - XV_ALIGN;
+	set_flag(block, BLOCK_FREE);
+	clear_flag(block, PREV_FREE);
+	set_blockprev(block, 0);
+
+	insert_block(pool, pagenum, 0, block);
+
+	put_ptr_atomic(block, KM_USER0);
+	spin_unlock(&pool->lock);
+
+	return 0;
+}
+
+/*
+ * Create a memory pool. Allocates freelist, bitmaps and other
+ * per-pool metadata.
+ */
+struct xv_pool *xv_create_pool(void)
+{
+	u32 ovhd_size;
+	struct xv_pool *pool;
+
+	ovhd_size = roundup(sizeof(*pool), PAGE_SIZE);
+	pool = kzalloc(ovhd_size, GFP_KERNEL);
+	if (!pool)
+		return NULL;
+
+	spin_lock_init(&pool->lock);
+
+	return pool;
+}
+EXPORT_SYMBOL_GPL(xv_create_pool);
+
+void xv_destroy_pool(struct xv_pool *pool)
+{
+	kfree(pool);
+}
+EXPORT_SYMBOL_GPL(xv_destroy_pool);
+
+/**
+ * xv_malloc - Allocate block of given size from pool.
+ * @pool: pool to allocate from
+ * @size: size of block to allocate
+ * @pagenum: page no. that holds the object
+ * @offset: location of object within pagenum
+ *
+ * On success, <pagenum, offset> identifies block allocated
+ * and 0 is returned. On failure, <pagenum, offset> is set to
+ * 0 and -ENOMEM is returned.
+ *
+ * Allocation requests with size > XV_MAX_ALLOC_SIZE will fail.
+ */
+int xv_malloc(struct xv_pool *pool, u32 size, u32 *pagenum, u32 *offset,
+							gfp_t flags)
+{
+	int error;
+	u32 index, tmpsize, origsize, tmpoffset;
+	struct block_header *block, *tmpblock;
+
+	*pagenum = 0;
+	*offset = 0;
+	origsize = size;
+
+	if (unlikely(!size || size > XV_MAX_ALLOC_SIZE))
+		return -ENOMEM;
+
+	size = ALIGN(size, XV_ALIGN);
+
+	spin_lock(&pool->lock);
+
+	index = find_block(pool, size, pagenum, offset);
+
+	if (!*pagenum) {
+		spin_unlock(&pool->lock);
+		if (flags & GFP_NOWAIT)
+			return -ENOMEM;
+		error = grow_pool(pool, flags);
+		if (unlikely(error))
+			return -ENOMEM;
+
+		spin_lock(&pool->lock);
+		index = find_block(pool, size, pagenum, offset);
+	}
+
+	if (!*pagenum) {
+		spin_unlock(&pool->lock);
+		return -ENOMEM;
+	}
+
+	block = get_ptr_atomic(*pagenum, *offset, KM_USER0);
+
+	remove_block_head(pool, block, index);
+
+	/* Split the block if required */
+	tmpoffset = *offset + size + XV_ALIGN;
+	tmpsize = block->size - size;
+	tmpblock = (struct block_header *)((char *)block + size + XV_ALIGN);
+	if (tmpsize) {
+		tmpblock->size = tmpsize - XV_ALIGN;
+		set_flag(tmpblock, BLOCK_FREE);
+		clear_flag(tmpblock, PREV_FREE);
+
+		set_blockprev(tmpblock, *offset);
+		if (tmpblock->size >= XV_MIN_ALLOC_SIZE)
+			insert_block(pool, *pagenum, tmpoffset, tmpblock);
+
+		if (tmpoffset + XV_ALIGN + tmpblock->size != PAGE_SIZE) {
+			tmpblock = BLOCK_NEXT(tmpblock);
+			set_blockprev(tmpblock, tmpoffset);
+		}
+	} else {
+		/* This block is exact fit */
+		if (tmpoffset != PAGE_SIZE)
+			clear_flag(tmpblock, PREV_FREE);
+	}
+
+	block->size = origsize;
+	clear_flag(block, BLOCK_FREE);
+
+	put_ptr_atomic(block, KM_USER0);
+	spin_unlock(&pool->lock);
+
+	*offset += XV_ALIGN;
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(xv_malloc);
+
+/*
+ * Free block identified with <pagenum, offset>
+ */
+void xv_free(struct xv_pool *pool, u32 pagenum, u32 offset)
+{
+	void *page;
+	struct block_header *block, *tmpblock;
+
+	offset -= XV_ALIGN;
+
+	spin_lock(&pool->lock);
+
+	page = get_ptr_atomic(pagenum, 0, KM_USER0);
+	block = (struct block_header *)((char *)page + offset);
+
+	/* Catch double free bugs */
+	BUG_ON(test_flag(block, BLOCK_FREE));
+
+	block->size = ALIGN(block->size, XV_ALIGN);
+
+	tmpblock = BLOCK_NEXT(block);
+	if (offset + block->size + XV_ALIGN == PAGE_SIZE)
+		tmpblock = NULL;
+
+	/* Merge next block if its free */
+	if (tmpblock && test_flag(tmpblock, BLOCK_FREE)) {
+		/*
+		 * Blocks smaller than XV_MIN_ALLOC_SIZE
+		 * are not inserted in any free list.
+		 */
+		if (tmpblock->size >= XV_MIN_ALLOC_SIZE) {
+			remove_block(pool, pagenum,
+				    offset + block->size + XV_ALIGN, tmpblock,
+				    get_index_for_insert(tmpblock->size));
+		}
+		block->size += tmpblock->size + XV_ALIGN;
+	}
+
+	/* Merge previous block if its free */
+	if (test_flag(block, PREV_FREE)) {
+		tmpblock = (struct block_header *)((char *)(page) +
+						get_blockprev(block));
+		offset = offset - tmpblock->size - XV_ALIGN;
+
+		if (tmpblock->size >= XV_MIN_ALLOC_SIZE)
+			remove_block(pool, pagenum, offset, tmpblock,
+				    get_index_for_insert(tmpblock->size));
+
+		tmpblock->size += block->size + XV_ALIGN;
+		block = tmpblock;
+	}
+
+	/* No used objects in this page. Free it. */
+	if (block->size == PAGE_SIZE - XV_ALIGN) {
+		put_ptr_atomic(page, KM_USER0);
+		spin_unlock(&pool->lock);
+
+		xv_free_page(pagenum);
+		stat_dec(&pool->total_pages);
+		return;
+	}
+
+	set_flag(block, BLOCK_FREE);
+	if (block->size >= XV_MIN_ALLOC_SIZE)
+		insert_block(pool, pagenum, offset, block);
+
+	if (offset + block->size + XV_ALIGN != PAGE_SIZE) {
+		tmpblock = BLOCK_NEXT(block);
+		set_flag(tmpblock, PREV_FREE);
+		set_blockprev(tmpblock, offset);
+	}
+
+	put_ptr_atomic(page, KM_USER0);
+	spin_unlock(&pool->lock);
+
+	return;
+}
+EXPORT_SYMBOL_GPL(xv_free);
+
+u32 xv_get_object_size(void *obj)
+{
+	struct block_header *blk;
+
+	blk = (struct block_header *)((char *)(obj) - XV_ALIGN);
+	return blk->size;
+}
+EXPORT_SYMBOL_GPL(xv_get_object_size);
+
+/*
+ * Returns total memory used by allocator (userdata + metadata)
+ */
+u64 xv_get_total_size_bytes(struct xv_pool *pool)
+{
+	return pool->total_pages << PAGE_SHIFT;
+}
+EXPORT_SYMBOL_GPL(xv_get_total_size_bytes);
+
+static int __init xv_malloc_init(void)
+{
+	return 0;
+}
+
+static void __exit xv_malloc_exit(void)
+{
+	return;
+}
+
+module_init(xv_malloc_init);
+module_exit(xv_malloc_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Nitin Gupta <ngupta@vflare.org>");
+MODULE_DESCRIPTION("xvmalloc memory allocator");
--- linux-rt-2.6.31.orig/ubuntu/compcache/GPL.txt
+++ linux-rt-2.6.31/ubuntu/compcache/GPL.txt
@@ -0,0 +1,280 @@
+		    GNU GENERAL PUBLIC LICENSE
+		       Version 2, June 1991
+
+ Copyright (C) 1989, 1991 Free Software Foundation, Inc.
+                       59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+			    Preamble
+
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+License is intended to guarantee your freedom to share and change free
+software--to make sure the software is free for all its users.  This
+General Public License applies to most of the Free Software
+Foundation's software and to any other program whose authors commit to
+using it.  (Some other Free Software Foundation software is covered by
+the GNU Library General Public License instead.)  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+this service if you wish), that you receive source code or can get it
+if you want it, that you can change the software or use pieces of it
+in new free programs; and that you know you can do these things.
+
+  To protect your rights, we need to make restrictions that forbid
+anyone to deny you these rights or to ask you to surrender the rights.
+These restrictions translate to certain responsibilities for you if you
+distribute copies of the software, or if you modify it.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must give the recipients all the rights that
+you have.  You must make sure that they, too, receive or can get the
+source code.  And you must show them these terms so they know their
+rights.
+
+  We protect your rights with two steps: (1) copyright the software, and
+(2) offer you this license which gives you legal permission to copy,
+distribute and/or modify the software.
+
+  Also, for each author's protection and ours, we want to make certain
+that everyone understands that there is no warranty for this free
+software.  If the software is modified by someone else and passed on, we
+want its recipients to know that what they have is not the original, so
+that any problems introduced by others will not reflect on the original
+authors' reputations.
+
+  Finally, any free program is threatened constantly by software
+patents.  We wish to avoid the danger that redistributors of a free
+program will individually obtain patent licenses, in effect making the
+program proprietary.  To prevent this, we have made it clear that any
+patent must be licensed for everyone's free use or not licensed at all.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+		    GNU GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License applies to any program or other work which contains
+a notice placed by the copyright holder saying it may be distributed
+under the terms of this General Public License.  The "Program", below,
+refers to any such program or work, and a "work based on the Program"
+means either the Program or any derivative work under copyright law:
+that is to say, a work containing the Program or a portion of it,
+either verbatim or with modifications and/or translated into another
+language.  (Hereinafter, translation is included without limitation in
+the term "modification".)  Each licensee is addressed as "you".
+
+Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running the Program is not restricted, and the output from the Program
+is covered only if its contents constitute a work based on the
+Program (independent of having been made by running the Program).
+Whether that is true depends on what the Program does.
+
+  1. You may copy and distribute verbatim copies of the Program's
+source code as you receive it, in any medium, provided that you
+conspicuously and appropriately publish on each copy an appropriate
+copyright notice and disclaimer of warranty; keep intact all the
+notices that refer to this License and to the absence of any warranty;
+and give any other recipients of the Program a copy of this License
+along with the Program.
+
+You may charge a fee for the physical act of transferring a copy, and
+you may at your option offer warranty protection in exchange for a fee.
+
+  2. You may modify your copy or copies of the Program or any portion
+of it, thus forming a work based on the Program, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) You must cause the modified files to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    b) You must cause any work that you distribute or publish, that in
+    whole or in part contains or is derived from the Program or any
+    part thereof, to be licensed as a whole at no charge to all third
+    parties under the terms of this License.
+
+    c) If the modified program normally reads commands interactively
+    when run, you must cause it, when started running for such
+    interactive use in the most ordinary way, to print or display an
+    announcement including an appropriate copyright notice and a
+    notice that there is no warranty (or else, saying that you provide
+    a warranty) and that users may redistribute the program under
+    these conditions, and telling the user how to view a copy of this
+    License.  (Exception: if the Program itself is interactive but
+    does not normally print such an announcement, your work based on
+    the Program is not required to print an announcement.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Program,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Program, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Program.
+
+In addition, mere aggregation of another work not based on the Program
+with the Program (or with a work based on the Program) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+  3. You may copy and distribute the Program (or a work based on it,
+under Section 2) in object code or executable form under the terms of
+Sections 1 and 2 above provided that you also do one of the following:
+
+    a) Accompany it with the complete corresponding machine-readable
+    source code, which must be distributed under the terms of Sections
+    1 and 2 above on a medium customarily used for software interchange; or,
+
+    b) Accompany it with a written offer, valid for at least three
+    years, to give any third party, for a charge no more than your
+    cost of physically performing source distribution, a complete
+    machine-readable copy of the corresponding source code, to be
+    distributed under the terms of Sections 1 and 2 above on a medium
+    customarily used for software interchange; or,
+
+    c) Accompany it with the information you received as to the offer
+    to distribute corresponding source code.  (This alternative is
+    allowed only for noncommercial distribution and only if you
+    received the program in object code or executable form with such
+    an offer, in accord with Subsection b above.)
+
+The source code for a work means the preferred form of the work for
+making modifications to it.  For an executable work, complete source
+code means all the source code for all modules it contains, plus any
+associated interface definition files, plus the scripts used to
+control compilation and installation of the executable.  However, as a
+special exception, the source code distributed need not include
+anything that is normally distributed (in either source or binary
+form) with the major components (compiler, kernel, and so on) of the
+operating system on which the executable runs, unless that component
+itself accompanies the executable.
+
+If distribution of executable or object code is made by offering
+access to copy from a designated place, then offering equivalent
+access to copy the source code from the same place counts as
+distribution of the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  4. You may not copy, modify, sublicense, or distribute the Program
+except as expressly provided under this License.  Any attempt
+otherwise to copy, modify, sublicense or distribute the Program is
+void, and will automatically terminate your rights under this License.
+However, parties who have received copies, or rights, from you under
+this License will not have their licenses terminated so long as such
+parties remain in full compliance.
+
+  5. You are not required to accept this License, since you have not
+signed it.  However, nothing else grants you permission to modify or
+distribute the Program or its derivative works.  These actions are
+prohibited by law if you do not accept this License.  Therefore, by
+modifying or distributing the Program (or any work based on the
+Program), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Program or works based on it.
+
+  6. Each time you redistribute the Program (or any work based on the
+Program), the recipient automatically receives a license from the
+original licensor to copy, distribute or modify the Program subject to
+these terms and conditions.  You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties to
+this License.
+
+  7. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Program at all.  For example, if a patent
+license would not permit royalty-free redistribution of the Program by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Program.
+
+If any portion of this section is held invalid or unenforceable under
+any particular circumstance, the balance of the section is intended to
+apply and the section as a whole is intended to apply in other
+circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system, which is
+implemented by public license practices.  Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+  8. If the distribution and/or use of the Program is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Program under this License
+may add an explicit geographical distribution limitation excluding
+those countries, so that distribution is permitted only in or among
+countries not thus excluded.  In such case, this License incorporates
+the limitation as if written in the body of this License.
+
+  9. The Free Software Foundation may publish revised and/or new versions
+of the General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+Each version is given a distinguishing version number.  If the Program
+specifies a version number of this License which applies to it and "any
+later version", you have the option of following the terms and conditions
+either of that version or of any later version published by the Free
+Software Foundation.  If the Program does not specify a version number of
+this License, you may choose any version ever published by the Free Software
+Foundation.
+
+  10. If you wish to incorporate parts of the Program into other free
+programs whose distribution conditions are different, write to the author
+to ask for permission.  For software which is copyrighted by the Free
+Software Foundation, write to the Free Software Foundation; we sometimes
+make exceptions for this.  Our decision will be guided by the two goals
+of preserving the free status of all derivatives of our free software and
+of promoting the sharing and reuse of software generally.
+
+			    NO WARRANTY
+
+  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
+FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
+OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
+PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
+OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
+TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
+PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
+REPAIR OR CORRECTION.
+
+  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
+REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
+INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
+OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
+TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
+YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
+PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGES.
+
+		     END OF TERMS AND CONDITIONS
--- linux-rt-2.6.31.orig/ubuntu/compcache/xvmalloc_int.h
+++ linux-rt-2.6.31/ubuntu/compcache/xvmalloc_int.h
@@ -0,0 +1,86 @@
+/*
+ * xvmalloc_int.c
+ *
+ * Copyright (C) 2008, 2009  Nitin Gupta
+ *
+ * This code is released using a dual license strategy: GPL/LGPL
+ * You can choose the licence that better fits your requirements.
+ *
+ * Released under the terms of GNU General Public License Version 2.0
+ * Released under the terms of GNU Lesser General Public License Version 2.1
+ */
+
+#ifndef _XVMALLOC_INT_H_
+#define _XVMALLOC_INT_H_
+
+#include <linux/kernel.h>
+#include <linux/types.h>
+
+/* User configurable params */
+
+/* This must be greater than sizeof(LinkFree) */
+#define XV_MIN_ALLOC_SIZE       32
+#define XV_MAX_ALLOC_SIZE       (PAGE_SIZE - XV_ALIGN)
+
+/* Must be power of two */
+#define XV_ALIGN_SHIFT	2
+#define XV_ALIGN	(1 << XV_ALIGN_SHIFT)
+#define XV_ALIGN_MASK	(XV_ALIGN - 1)
+
+/* Free lists are separated by FL_DELTA bytes */
+#define FL_DELTA_SHIFT	3
+#define FL_DELTA	(1 << FL_DELTA_SHIFT)
+#define FL_DELTA_MASK	(FL_DELTA - 1)
+#define NUM_FREE_LISTS	((XV_MAX_ALLOC_SIZE - XV_MIN_ALLOC_SIZE) \
+				/ FL_DELTA + 1)
+
+#define MAX_FLI		DIV_ROUND_UP(NUM_FREE_LISTS, BITS_PER_LONG)
+
+/* End of user params */
+
+enum blockflags {
+	BLOCK_FREE,
+	PREV_FREE,
+	__NR_BLOCKFLAGS,
+};
+
+#define FLAGS_MASK	XV_ALIGN_MASK
+#define PREV_MASK	(~FLAGS_MASK)
+
+struct freelist_entry {
+	u32 pagenum;
+	u16 offset;
+	u16 pad;
+};
+
+struct link_free {
+	u32 prev_pagenum;
+	u32 next_pagenum;
+	u16 prev_offset;
+	u16 next_offset;
+};
+
+struct block_header {
+	union {
+		/* This common header must be ALIGN bytes */
+		u8 common[XV_ALIGN];
+		struct {
+			u16 size;
+			u16 prev;
+		};
+	};
+	struct link_free link;
+};
+
+struct xv_pool {
+	ulong flbitmap;
+	ulong slbitmap[MAX_FLI];
+	spinlock_t lock;
+
+	struct freelist_entry freelist[NUM_FREE_LISTS];
+
+	/* stats */
+	u64 total_pages;
+};
+
+#endif
--- linux-rt-2.6.31.orig/ubuntu/compcache/Changelog
+++ linux-rt-2.6.31/ubuntu/compcache/Changelog
@@ -0,0 +1,82 @@
+version 0.5.3	(8/4/2009)
+ - Major cleanups.
+ - Rename module: compcache.ko -> ramzswap.ko
+ - Rename params: backing_dev -> backing_swap
+ - Updated use_compcache.sh script with detailed
+   documentation on parameters.
+ - LZO de/compress modules are no longer packaged
+   with compcache. Most distros now include these.
+
+version 0.5.2	(11/3/2009)
+ - Can forward incompressible pages to physical swap disk.
+ - New module params:
+ 	- memlimit_kb
+	- disksize_kb
+	- backing_dev
+   See use_compcache.sh for documentation on these params.
+ - Modified use_compcache.sh script to handle new params.
+ - Detect zero-filled pages and don't allocate any memory
+   for them.
+
+version 0.5.1	(22/1/2009)
+ - Fix crash on x86 systems with higmem (mem > ~1G).
+   This required minor changes to atomic (un)map functions (see Issue #20).
+
+version 0.5	(16/1/2009)
+ - Fix crash in case compcache init fails.
+
+version 0.5pre4	(10/1/2009)
+ - Support discarding pages for freed swap blocks (requires 2.6.28-git14).
+   This feature will be disabled if compiled for older kernel.
+ - Mark ramzswap as "solid-state" block device (requires 2.6.26-git14).
+ - Fixed incorrect stats reporting in /proc/compcache (some
+   new stats added too).
+
+version 0.5pre3	(5/1/2009)
+ - Use kmap_atomic() in xvMalloc. This fixes issue #19
+ - Remove xvMapPage() and xvUnmapMap() from xvMalloc.
+
+version 0.5pre2 (28/10/2008)
+ - Alloc full page for uncompressible pages instead
+   of returning I/O error.
+ - Warn users when using ramzswap > (2 x RAM size)
+
+version 0.5pre1 (15/10/2008)
+ - Replaced TLSF with xvMalloc memory allocator
+   http://code.google.com/p/compcache/wiki/xvMalloc
+
+version 0.4	(13/8/2008)
+ - Enable debug and stats option for compcache and tlsf by default
+   proc nodes: /proc/{tlsfinfo,compcache}
+ - Fix crash when reading /proc/tlsfinfo
+ - Lots of cleanups: clean compile on x64
+ 
+version 0.3	(17/3/2008)
+ - Fix spurious swap read failures
+ - Better swap request filtering
+ - Swap device again renamed to /dev/ramzswap0
+   This is to prevent Ubuntu installer from presenting
+   this device as possible installation target (see Issue #5)
+ - use_compcache.sh script now waits for disk node to be created
+   instead of arbitrary sleep (see Issue #6).
+ - Modified scripts: use_compcache.sh and unuse_compcache.sh
+   to now use new device name (compcache0 -> ramzswap0).
+
+version 0.2	(3/3/2008)
+ - Fixed bug on systems with highmem
+ - Better filtering-out of non-swap requests
+ - Export statistics through proc nodes:
+   - /proc/compcache
+   - /proc/tlsfinfo
+ - Debug and Statistics support for allocator
+   and compcache can now be individually turned
+   on/off by setting DEBUG, STATS to 0/1 in
+   respective header files
+ - Swap device now renamed to /dev/compcache0
+ - Added scripts: use_compcache.sh and unuse_compcache.sh
+   See README for usage
+ - Default compcache size set to 25% of RAM
+ - Lots of code cleanups
+ - Updated README
+ - Created Changelog :)
+
--- linux-rt-2.6.31.orig/ubuntu/compcache/BOM
+++ linux-rt-2.6.31/ubuntu/compcache/BOM
@@ -0,0 +1,2 @@
+Downloaded from:	http://code.google.com/p/compcache/
+Current Version:	0.5.3
--- linux-rt-2.6.31.orig/ubuntu/compcache/Makefile
+++ linux-rt-2.6.31/ubuntu/compcache/Makefile
@@ -0,0 +1 @@
+obj-$(CONFIG_BLK_DEV_COMPCACHE) := ramzswap.o xvmalloc.o
--- linux-rt-2.6.31.orig/ubuntu/compcache/Kconfig
+++ linux-rt-2.6.31/ubuntu/compcache/Kconfig
@@ -0,0 +1,31 @@
+menu "Compcache options"
+
+config BLK_DEV_COMPCACHE
+	tristate "Compressed RAM based swap device"
+	default m
+	select LZO_COMPRESS
+	select LZO_DECOMPRESS
+	depends on BLOCK
+	help
+	  This creates RAM based block device which acts as swap disk. Pages
+	  swapped to this disk are compressed and stored in memory itself.
+	  Project Home: http://code.google.com/p/compcache/
+
+config BLK_DEV_COMPCACHE_DEBUG
+	default n
+	depends on BLK_DEV_COMPCACHE
+	bool "Enable debugging"
+	help
+	  This causes negligible performance loss and size increase.
+	  If unsure, say Y.
+
+config BLK_DEV_COMPCACHE_STATS
+	default n
+	depends on BLK_DEV_COMPCACHE
+	bool "Enable statistics"
+	help
+	  Creates /proc/compcache to export various statistics.
+	  This adds about 4K to size with negligible performance loss.
+	  If unsure, say Y.
+ 
+endmenu
--- linux-rt-2.6.31.orig/ubuntu/compcache/ramzswap.c
+++ linux-rt-2.6.31/ubuntu/compcache/ramzswap.c
@@ -0,0 +1,1049 @@
+/*
+ * Compressed RAM based swap device
+ *
+ * Copyright (C) 2008, 2009  Nitin Gupta
+ *
+ * This RAM based block device acts as swap disk.
+ * Pages swapped to this device are compressed and
+ * stored in memory.
+ *
+ * Released under the terms of GNU General Public License Version 2.0
+ *
+ * Project home: http://compcache.googlecode.com
+ */
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/bitops.h>
+#include <linux/blkdev.h>
+#include <linux/buffer_head.h>
+#include <linux/device.h>
+#include <linux/genhd.h>
+#include <linux/highmem.h>
+#include <linux/lzo.h>
+#include <linux/mutex.h>
+#include <linux/proc_fs.h>
+#include <linux/string.h>
+#include <linux/swap.h>
+#include <linux/swapops.h>
+#include <linux/vmalloc.h>
+
+#include "compat.h"
+#include "ramzswap.h"
+
+/* Globals */
+static struct ramzswap rzs;
+static struct ramzswap_stats stats;
+/*
+ * Pages that compress to larger than this size are
+ * forwarded to backing swap, if present or stored
+ * uncompressed in memory otherwise.
+ */
+static unsigned int MAX_CPAGE_SIZE;
+
+/* Module params (documentation at end) */
+static unsigned long disksize_kb;
+static unsigned long memlimit_kb;
+static char *backing_swap;
+
+static int __init ramzswap_init(void);
+static struct block_device_operations ramzswap_devops = {
+	.owner = THIS_MODULE,
+};
+
+static int test_flag(u32 index, enum rzs_pageflags flag)
+{
+	return rzs.table[index].flags & BIT(flag);
+}
+
+static void set_flag(u32 index, enum rzs_pageflags flag)
+{
+	rzs.table[index].flags |= BIT(flag);
+}
+
+static void clear_flag(u32 index, enum rzs_pageflags flag)
+{
+	rzs.table[index].flags &= ~BIT(flag);
+}
+
+static int page_zero_filled(void *ptr)
+{
+	u32 pos;
+	u64 *page;
+
+	page = (u64 *)ptr;
+
+	for (pos = 0; pos != PAGE_SIZE / sizeof(*page); pos++) {
+		if (page[pos])
+			return 0;
+	}
+
+	return 1;
+}
+
+/*
+ * Given <pagenum, offset> pair, provide a dereferencable pointer.
+ */
+static void *get_ptr_atomic(u32 pagenum, u16 offset, enum km_type type)
+{
+	unsigned char *page;
+
+	page = kmap_atomic(pfn_to_page(pagenum), type);
+	return page + offset;
+}
+
+static void put_ptr_atomic(void *ptr, enum km_type type)
+{
+	kunmap_atomic(ptr, type);
+}
+
+#if defined(STATS)
+static struct proc_dir_entry *proc;
+
+static int proc_ramzswap_read(char *page, char **start, off_t off,
+				int count, int *eof, void *data)
+{
+	int len;
+	size_t succ_writes, mem_used;
+	unsigned int good_compress_perc = 0, no_compress_perc = 0;
+
+	mem_used = xv_get_total_size_bytes(rzs.mem_pool)
+			+ (stats.pages_expand << PAGE_SHIFT);
+
+	if (off > 0) {
+		*eof = 1;
+		return 0;
+	}
+
+#define K(x)	((x) >> 10)
+	/* Basic stats */
+	len = sprintf(page,
+		"DiskSize:	%8zu kB\n",
+		(size_t)(K(rzs.disksize)));
+
+	if (rzs.backing_swap) {
+		/* This must always be less than ComprDataSize */
+		len += sprintf(page + len,
+			"MemLimit:	%8zu kB\n",
+			K(rzs.memlimit));
+	}
+
+	succ_writes = stats.num_writes - stats.failed_writes;
+
+	if (succ_writes && stats.pages_stored) {
+		good_compress_perc = stats.good_compress * 100
+					/ stats.pages_stored;
+		no_compress_perc = stats.pages_expand * 100
+					/ stats.pages_stored;
+	}
+
+	/* Extended stats */
+	len += sprintf(page + len,
+		"NumReads:	%8llu\n"
+		"NumWrites:	%8llu\n"
+		"FailedReads:	%8llu\n"
+		"FailedWrites:	%8llu\n"
+		"InvalidIO:	%8llu\n"
+		"PagesDiscard:	%8llu\n"
+		"ZeroPages:	%8u\n"
+		"GoodCompress:	%8u %%\n"
+		"NoCompress:	%8u %%\n"
+		"PagesStored:	%8u\n"
+		"PagesUsed:	%8zu\n"
+		"OrigDataSize:	%8zu kB\n"
+		"ComprDataSize:	%8zu kB\n"
+		"MemUsedTotal:	%8zu kB\n",
+		stats.num_reads,
+		stats.num_writes,
+		stats.failed_reads,
+		stats.failed_writes,
+		stats.invalid_io,
+		stats.pages_discard,
+		stats.pages_zero,
+		good_compress_perc,
+		no_compress_perc,
+		stats.pages_stored,
+		mem_used >> PAGE_SHIFT,
+		(size_t)(K(stats.pages_stored << PAGE_SHIFT)),
+		(size_t)(K(stats.compr_size)),
+		(size_t)(K(mem_used)));
+
+	if (rzs.backing_swap) {
+		/* This must always be less than ComprDataSize */
+		len += sprintf(page + len,
+			"BDevNumReads:	%8llu\n"
+			"BDevNumWrites:	%8llu\n",
+			stats.bdev_num_reads,
+			stats.bdev_num_writes);
+	}
+
+	return len;
+}
+#endif	/* STATS */
+
+/*
+ * Check if value of backing_swap module param is sane.
+ * Claim this device and set ramzswap size equal to
+ * size of this block device.
+ */
+static int setup_backing_swap(void)
+{
+	int error = 0;
+	struct inode *inode;
+	struct file *swap_file;
+	struct address_space *mapping;
+	struct block_device *bdev = NULL;
+
+	if (backing_swap == NULL) {
+		pr_debug(C "backing_swap param not given\n");
+		goto out;
+	}
+
+	pr_info(C "Using backing swap device: %s\n", backing_swap);
+
+	swap_file = filp_open(backing_swap, O_RDWR | O_LARGEFILE, 0);
+	if (IS_ERR(swap_file)) {
+		pr_err(C "Error opening backing device: %s\n", backing_swap);
+		error = -EINVAL;
+		goto out;
+	}
+
+	mapping = swap_file->f_mapping;
+	inode = mapping->host;
+
+	if (S_ISBLK(inode->i_mode)) {
+		bdev = I_BDEV(inode);
+		error = bd_claim(bdev, ramzswap_init);
+		if (error < 0) {
+			bdev = NULL;
+			goto bad_param;
+		}
+		rzs.old_block_size = block_size(bdev);
+		error = set_blocksize(bdev, PAGE_SIZE);
+		if (error < 0)
+			goto bad_param;
+	} else {
+		/* TODO: support for regular file as backing swap */
+		pr_info(C "%s is not a block device.\n", backing_swap);
+		error = -EINVAL;
+		goto out;
+	}
+
+	rzs.swap_file = swap_file;
+	rzs.backing_swap = bdev;
+	rzs.disksize = i_size_read(inode);
+	BUG_ON(!rzs.disksize);
+
+	return 0;
+
+bad_param:
+	if (bdev) {
+		set_blocksize(bdev, rzs.old_block_size);
+		bd_release(bdev);
+	}
+	filp_close(swap_file, NULL);
+
+out:
+	rzs.backing_swap = NULL;
+	return error;
+}
+
+/*
+ * Check if request is within bounds and page aligned.
+ */
+static inline int valid_swap_request(struct bio *bio)
+{
+	if (unlikely(
+		(bio->bi_sector >= (rzs.disksize >> SECTOR_SHIFT)) ||
+		(bio->bi_sector & (SECTORS_PER_PAGE - 1)) ||
+		(bio->bi_vcnt != 1) ||
+		(bio->bi_size != PAGE_SIZE) ||
+		(bio->bi_io_vec[0].bv_offset != 0))) {
+
+		return 0;
+	}
+
+	/* swap request is valid */
+	return 1;
+}
+
+static void ramzswap_free_page(size_t index)
+{
+	u32 clen;
+	void *obj;
+
+	u32 pagenum = rzs.table[index].pagenum;
+	u32 offset = rzs.table[index].offset;
+
+	if (unlikely(test_flag(index, RZS_UNCOMPRESSED))) {
+		clen = PAGE_SIZE;
+		__free_page(pfn_to_page(pagenum));
+		clear_flag(index, RZS_UNCOMPRESSED);
+		stat_dec(stats.pages_expand);
+		goto out;
+	}
+
+	obj = get_ptr_atomic(pagenum, offset, KM_USER0);
+	clen = xv_get_object_size(obj) - sizeof(struct zobj_header);
+	put_ptr_atomic(obj, KM_USER0);
+
+	xv_free(rzs.mem_pool, pagenum, offset);
+	stat_dec_if_less(stats.good_compress, clen, PAGE_SIZE / 2 + 1);
+
+out:
+	stats.compr_size -= clen;
+	stat_dec(stats.pages_stored);
+
+	rzs.table[index].pagenum = 0;
+	rzs.table[index].offset = 0;
+}
+
+#ifdef SWAP_DISCARD_SUPPORTED
+static int ramzswap_prepare_discard(struct request_queue *q,
+					struct request *req)
+{
+	return 0;
+}
+
+/*
+ * Called by main I/O handler function. This helper
+ * function handles 'discard' I/O requests which means
+ * that  some swap pages are no longer required, so
+ * swap device can take needed action -- we free memory
+ * allocated for these pages.
+ */
+static int ramzswap_discard(struct bio *bio)
+{
+	size_t index, start_page, num_pages;
+
+	start_page = bio->bi_sector >> SECTORS_PER_PAGE_SHIFT;
+	num_pages = bio->bi_size >> (SECTOR_SHIFT + SECTORS_PER_PAGE_SHIFT);
+
+	for (index = start_page; index < start_page + num_pages; index++) {
+		if (rzs.table[index].pagenum) {
+			ramzswap_free_page(index);
+			stat_inc(stats.pages_discard);
+		}
+	}
+
+	set_bit(BIO_UPTODATE, &bio->bi_flags);
+	BIO_ENDIO(bio, 0);
+	return 0;
+}
+#endif
+
+int handle_zero_page(struct bio *bio)
+{
+	void *user_mem;
+	struct page *page = bio->bi_io_vec[0].bv_page;
+
+	user_mem = get_ptr_atomic(page_to_pfn(page), 0, KM_USER0);
+	memset(user_mem, 0, PAGE_SIZE);
+	put_ptr_atomic(user_mem, KM_USER0);
+
+	set_bit(BIO_UPTODATE, &bio->bi_flags);
+	BIO_ENDIO(bio, 0);
+	return 0;
+}
+
+int handle_uncompressed_page(struct bio *bio)
+{
+	u32 index;
+	struct page *page;
+	unsigned char *user_mem, *cmem;
+
+	page = bio->bi_io_vec[0].bv_page;
+	index = bio->bi_sector >>SECTORS_PER_PAGE_SHIFT;
+
+	user_mem = get_ptr_atomic(page_to_pfn(page), 0, KM_USER0);
+	cmem = get_ptr_atomic(rzs.table[index].pagenum,
+			rzs.table[index].offset, KM_USER1);
+
+	memcpy(user_mem, cmem, PAGE_SIZE);
+	put_ptr_atomic(user_mem, KM_USER0);
+	put_ptr_atomic(cmem, KM_USER1);
+
+	set_bit(BIO_UPTODATE, &bio->bi_flags);
+	BIO_ENDIO(bio, 0);
+	return 0;
+}
+
+
+/*
+ * Called when request page is not present in ramzswap.
+ * Its either in backing swap device (if present) or
+ * this is an attempt to read before any previous write
+ * to this location - this happens due to readahead when
+ * swap device is read from user-space (e.g. during swapon)
+ */
+int handle_ramzswap_fault(struct bio *bio)
+{
+	void *user_mem;
+	struct page *page = bio->bi_io_vec[0].bv_page;
+
+	/*
+	 * Always forward such requests to backing swap
+	 * device (if present)
+	 */
+	if (rzs.backing_swap) {
+		stat_dec(stats.num_reads);
+		stat_inc(stats.bdev_num_reads);
+		bio->bi_bdev = rzs.backing_swap;
+		return 1;
+	}
+
+	/*
+	 * Its unlikely event in case backing dev is
+	 * not present
+	 */
+	pr_debug(C "Read before write on swap device: "
+		"sector=%lu, size=%u, offset=%u\n",
+		(ulong)(bio->bi_sector), bio->bi_size,
+		bio->bi_io_vec[0].bv_offset);
+	user_mem = kmap(page);
+	memset(user_mem, 0, PAGE_SIZE);
+	kunmap(page);
+
+	set_bit(BIO_UPTODATE, &bio->bi_flags);
+	BIO_ENDIO(bio, 0);
+	return 0;
+}
+
+int ramzswap_read(struct bio *bio)
+{
+	int ret;
+	u32 index;
+	size_t clen;
+	struct page *page;
+	struct zobj_header *zheader;
+	unsigned char *user_mem, *cmem;
+
+	stat_inc(stats.num_reads);
+
+	page = bio->bi_io_vec[0].bv_page;
+	index = bio->bi_sector >> SECTORS_PER_PAGE_SHIFT;
+
+	if (test_flag(index, RZS_ZERO))
+		return handle_zero_page(bio);
+
+	/* Requested page is not present in compressed area */
+	if (!rzs.table[index].pagenum)
+		return handle_ramzswap_fault(bio);
+
+	/* Page is stored uncompressed since its incompressible */
+	if (unlikely(test_flag(index, RZS_UNCOMPRESSED)))
+		return handle_uncompressed_page(bio);
+
+	user_mem = get_ptr_atomic(page_to_pfn(page), 0, KM_USER0);
+	clen = PAGE_SIZE;
+
+	cmem = get_ptr_atomic(rzs.table[index].pagenum,
+			rzs.table[index].offset, KM_USER1);
+
+	ret = lzo1x_decompress_safe(
+		cmem + sizeof(*zheader),
+		xv_get_object_size(cmem) - sizeof(*zheader),
+		user_mem, &clen);
+
+	put_ptr_atomic(user_mem, KM_USER0);
+	put_ptr_atomic(cmem, KM_USER1);
+
+	/* should NEVER happen */
+	if (unlikely(ret != LZO_E_OK)) {
+		pr_err(C "Decompression failed! err=%d, page=%u\n",
+			ret, index);
+		stat_inc(stats.failed_reads);
+		goto out;
+	}
+
+	set_bit(BIO_UPTODATE, &bio->bi_flags);
+	BIO_ENDIO(bio, 0);
+	return 0;
+
+out:
+	BIO_IO_ERROR(bio);
+	return 0;
+}
+
+int ramzswap_write(struct bio *bio)
+{
+	int ret, fwd_write_request = 0;
+	u32 offset;
+	size_t clen, index;
+	struct zobj_header *zheader;
+	struct page *page, *page_store;
+	unsigned char *user_mem, *cmem, *src;
+
+	stat_inc(stats.num_writes);
+
+	page = bio->bi_io_vec[0].bv_page;
+	index = bio->bi_sector >> SECTORS_PER_PAGE_SHIFT;
+
+	src = rzs.compress_buffer;
+
+	/*
+	 * System swaps to same sector again when the stored page
+	 * is no longer referenced by any process. So, its now safe
+	 * to free the memory that was allocated for this page.
+	 */
+	if (rzs.table[index].pagenum)
+		ramzswap_free_page(index);
+
+	/*
+	 * No memory ia allocated for zero filled pages.
+	 * Simply clear zero page flag.
+	 */
+	if (test_flag(index, RZS_ZERO)) {
+		stat_dec(stats.pages_zero);
+		clear_flag(index, RZS_ZERO);
+	}
+
+	mutex_lock(&rzs.lock);
+
+	user_mem = get_ptr_atomic(page_to_pfn(page), 0, KM_USER0);
+	if (page_zero_filled(user_mem)) {
+		put_ptr_atomic(user_mem, KM_USER0);
+		mutex_unlock(&rzs.lock);
+		stat_inc(stats.pages_zero);
+		set_flag(index, RZS_ZERO);
+
+		set_bit(BIO_UPTODATE, &bio->bi_flags);
+		BIO_ENDIO(bio, 0);
+		return 0;
+	}
+
+	if (rzs.backing_swap &&
+		(stats.compr_size > rzs.memlimit - PAGE_SIZE)) {
+		put_ptr_atomic(user_mem, KM_USER0);
+		mutex_unlock(&rzs.lock);
+		fwd_write_request = 1;
+		goto out;
+	}
+
+	ret = lzo1x_1_compress(user_mem, PAGE_SIZE, src, &clen,
+				rzs.compress_workmem);
+
+	put_ptr_atomic(user_mem, KM_USER0);
+
+	if (unlikely(ret != LZO_E_OK)) {
+		mutex_unlock(&rzs.lock);
+		pr_err(C "Compression failed! err=%d\n", ret);
+		stat_inc(stats.failed_writes);
+		goto out;
+	}
+
+	/*
+	 * Page is incompressible. Forward it to backing swap
+	 * if present. Otherwise, store it as-is (uncompressed)
+	 * since we do not want to return too many swap write
+	 * errors which has side effect of hanging the system.
+	 */
+	if (unlikely(clen > MAX_CPAGE_SIZE)) {
+		if (rzs.backing_swap) {
+			mutex_unlock(&rzs.lock);
+			fwd_write_request = 1;
+			goto out;
+		}
+
+		clen = PAGE_SIZE;
+		page_store = alloc_page(GFP_NOIO | __GFP_HIGHMEM);
+		if (unlikely(!page_store)) {
+			mutex_unlock(&rzs.lock);
+			stat_inc(stats.failed_writes);
+			goto out;
+		}
+
+		offset = 0;
+		set_flag(index, RZS_UNCOMPRESSED);
+		stat_inc(stats.pages_expand);
+		rzs.table[index].pagenum = page_to_pfn(page_store);
+		src = get_ptr_atomic(page_to_pfn(page), 0, KM_USER0);
+		goto memstore;
+	}
+
+	if (xv_malloc(rzs.mem_pool, clen + sizeof(*zheader),
+			&rzs.table[index].pagenum, &offset,
+			GFP_NOIO | __GFP_HIGHMEM)) {
+		mutex_unlock(&rzs.lock);
+		pr_info(C "Error allocating memory for compressed "
+			"page: %zu, size=%zu\n", index, clen);
+		stat_inc(stats.failed_writes);
+		if (rzs.backing_swap)
+			fwd_write_request = 1;
+		goto out;
+	}
+
+memstore:
+	rzs.table[index].offset = offset;
+
+	cmem = get_ptr_atomic(rzs.table[index].pagenum,
+			rzs.table[index].offset, KM_USER1);
+
+#if 0
+	/* Back-reference needed for memory defragmentation */
+	if (!test_flag(index, RZS_UNCOMPRESSED)) {
+		zheader = (struct zobj_header *)cmem;
+		zheader->table_idx = index;
+		cmem += sizeof(*zheader);
+	}
+#endif
+
+	memcpy(cmem, src, clen);
+
+	put_ptr_atomic(cmem, KM_USER1);
+	if (unlikely(test_flag(index, RZS_UNCOMPRESSED)))
+		put_ptr_atomic(src, KM_USER0);
+
+	/* Update stats */
+	stats.compr_size += clen;
+	stat_inc(stats.pages_stored);
+	stat_inc_if_less(stats.good_compress, clen, PAGE_SIZE / 2 + 1);
+
+	mutex_unlock(&rzs.lock);
+
+	set_bit(BIO_UPTODATE, &bio->bi_flags);
+	BIO_ENDIO(bio, 0);
+	return 0;
+
+out:
+	if (fwd_write_request) {
+		stat_inc(stats.bdev_num_writes);
+		bio->bi_bdev = rzs.backing_swap;
+		return 1;
+	}
+
+	BIO_IO_ERROR(bio);
+	return 0;
+}
+
+/*
+ * Handler function for all ramzswap I/O requests.
+ */
+static int ramzswap_make_request(struct request_queue *queue, struct bio *bio)
+{
+	int ret = 0;
+
+#ifdef SWAP_DISCARD_SUPPORTED
+	if (bio_discard(bio))
+		return ramzswap_discard(bio);
+#endif
+
+	if (!valid_swap_request(bio)) {
+		stat_inc(stats.invalid_io);
+		BIO_IO_ERROR(bio);
+		return 0;
+	}
+
+	switch (bio_data_dir(bio)) {
+	case READ:
+		ret = ramzswap_read(bio);
+		break;
+
+	case WRITE:
+		ret = ramzswap_write(bio);
+		break;
+	}
+
+	return ret;
+}
+
+/*
+ * Swap header (1st page of swap device) contains information
+ * to indentify it as a swap partition. Prepare such a header
+ * for ramzswap device (ramzswap0) so that swapon can identify
+ * it as swap partition. In case backing swap device is provided,
+ * copy its swap header.
+ */
+static int setup_swap_header(union swap_header *s)
+{
+	int ret = 0;
+	struct page *page;
+	struct address_space *mapping;
+	union swap_header *backing_swap_header;
+
+	/*
+	 * There is no backing swap device. Create a swap header
+	 * that is acceptable by swapon.
+	 */
+	if (rzs.backing_swap == NULL) {
+		s->info.version = 1;
+		s->info.last_page = rzs.disksize >> PAGE_SHIFT;
+		s->info.nr_badpages = 0;
+		memcpy(s->magic.magic, "SWAPSPACE2", 10);
+		return 0;
+	}
+
+	/*
+	 * We have a backing swap device. Copy its swap header
+	 * to ramzswap device header. If this header contains
+	 * invalid information (backing device not a swap
+	 * partition, etc.), swapon will fail for ramzswap
+	 * which is correct behavior - we don't want to swap
+	 * over filesystem partition!
+	 */
+
+	/* Read the backing swap header (code from sys_swapon) */
+	mapping = rzs.swap_file->f_mapping;
+	if (!mapping->a_ops->readpage) {
+		ret = -EINVAL;
+		goto out;
+	}
+
+	page = read_mapping_page(mapping, 0, rzs.swap_file);
+	if (IS_ERR(page)) {
+		ret = PTR_ERR(page);
+		goto out;
+	}
+
+	backing_swap_header = kmap(page);
+	*s = *backing_swap_header;
+	kunmap(page);
+
+out:
+	return ret;
+}
+
+static void ramzswap_set_disksize(size_t totalram_bytes)
+{
+	rzs.disksize = disksize_kb << 10;
+
+	if (!disksize_kb) {
+		pr_info(C
+		"disk size not provided. You can use disksize_kb module "
+		"param to specify size.\nUsing default: (%u%% of RAM).\n",
+		DEFAULT_DISKSIZE_PERC_RAM
+		);
+		rzs.disksize = DEFAULT_DISKSIZE_PERC_RAM *
+					(totalram_bytes / 100);
+	}
+
+	if (disksize_kb > 2 * (totalram_bytes >> 10)) {
+		pr_info(C
+		"There is little point creating a ramzswap of greater than "
+		"twice the size of memory since we expect a 2:1 compression "
+		"ratio. Note that ramzswap uses about 0.1%% of the size of "
+		"the swap device when not in use so a huge ramzswap is "
+		"wasteful.\n"
+		"\tMemory Size: %zu kB\n"
+		"\tSize you selected: %lu kB\n"
+		"Continuing anyway ...\n",
+		totalram_bytes >> 10, disksize_kb
+		);
+	}
+
+	rzs.disksize &= PAGE_MASK;
+	pr_info(C "disk size set to %zu kB\n", rzs.disksize >> 10);
+}
+
+/*
+ * memlimit cannot be greater than backing disk size.
+ */
+static void ramzswap_set_memlimit(size_t totalram_bytes)
+{
+	int memlimit_valid = 1;
+	rzs.memlimit = memlimit_kb << 10;
+
+	if (!rzs.memlimit) {
+		pr_info(C "memory limit not set. You can use "
+			"memlimit_kb module param to specify limit.");
+		memlimit_valid = 0;
+	}
+
+	if (rzs.memlimit > rzs.disksize) {
+		pr_info(C "memory limit cannot be greater than "
+			"disksize: limit=%zu, disksize=%zu",
+			rzs.memlimit, rzs.disksize);
+		memlimit_valid = 0;
+	}
+
+	if (!memlimit_valid) {
+		size_t mempart, disksize;
+		pr_info(C "\nUsing default: MIN[(%u%% of RAM), "
+			"(backing disk size)].\n",
+			DEFAULT_MEMLIMIT_PERC_RAM);
+		mempart = DEFAULT_MEMLIMIT_PERC_RAM * (totalram_bytes / 100);
+		disksize = rzs.disksize;
+		rzs.memlimit = mempart > disksize ? disksize : mempart;
+	}
+
+	if (rzs.memlimit > totalram_bytes / 2) {
+		pr_info(C
+		"Its not advisable setting limit more than half of "
+		"size of memory since we expect a 2:1 compression ratio. "
+		"Limit represents amount of *compressed* data we can keep "
+		"in memory!\n"
+		"\tMemory Size: %zu kB\n"
+		"\tLimit you selected: %lu kB\n"
+		"Continuing anyway ...\n",
+		totalram_bytes >> 10, memlimit_kb
+		);
+	}
+
+	rzs.memlimit &= PAGE_MASK;
+	BUG_ON(!rzs.memlimit);
+
+	pr_info(C "memory limit set to %zu kB\n", rzs.memlimit >> 10);
+}
+
+static int __init ramzswap_init(void)
+{
+	int ret;
+	size_t num_pages, totalram_bytes;
+	struct sysinfo i;
+	struct page *page;
+	void *swap_header;
+
+	mutex_init(&rzs.lock);
+
+	ret = setup_backing_swap();
+	if (ret)
+		goto fail;
+
+	si_meminfo(&i);
+	/* Here is a trivia: guess unit used for i.totalram !! */
+	totalram_bytes = i.totalram << PAGE_SHIFT;
+
+	if (rzs.backing_swap)
+		ramzswap_set_memlimit(totalram_bytes);
+	else
+		ramzswap_set_disksize(totalram_bytes);
+
+	rzs.compress_workmem = kmalloc(LZO1X_MEM_COMPRESS, GFP_KERNEL);
+	if (rzs.compress_workmem == NULL) {
+		pr_err(C "Error allocating compressor working memory\n");
+		ret = -ENOMEM;
+		goto fail;
+	}
+
+	rzs.compress_buffer = kmalloc(2 * PAGE_SIZE, GFP_KERNEL);
+	if (rzs.compress_buffer == NULL) {
+		pr_err(C "Error allocating compressor buffer space\n");
+		ret = -ENOMEM;
+		goto fail;
+	}
+
+	num_pages = rzs.disksize >> PAGE_SHIFT;
+	rzs.table = vmalloc(num_pages * sizeof(*rzs.table));
+	if (rzs.table == NULL) {
+		pr_err(C "Error allocating ramzswap address table\n");
+		ret = -ENOMEM;
+		goto fail;
+	}
+	memset(rzs.table, 0, num_pages * sizeof(*rzs.table));
+
+	page = alloc_page(__GFP_ZERO);
+	if (page == NULL) {
+		pr_err(C "Error allocating swap header page\n");
+		ret = -ENOMEM;
+		goto fail;
+	}
+	rzs.table[0].pagenum = page_to_pfn(page);
+	set_flag(0, RZS_UNCOMPRESSED);
+
+	swap_header = kmap(page);
+	ret = setup_swap_header((union swap_header *)(swap_header));
+	kunmap(page);
+	if (ret) {
+		pr_err(C "Error setting swap header\n");
+		goto fail;
+	}
+
+	rzs.disk = alloc_disk(1);
+	if (rzs.disk == NULL) {
+		pr_err(C "Error allocating disk structure\n");
+		ret = -ENOMEM;
+		goto fail;
+	}
+
+	rzs.disk->first_minor = 0;
+	rzs.disk->fops = &ramzswap_devops;
+	/*
+	 * It is named like this to prevent distro installers
+	 * from offering ramzswap as installation target. They
+	 * seem to ignore all devices beginning with 'ram'
+	 */
+	strcpy(rzs.disk->disk_name, "ramzswap0");
+
+	rzs.disk->major = register_blkdev(0, rzs.disk->disk_name);
+	if (rzs.disk->major < 0) {
+		pr_err(C "Cannot register block device\n");
+		ret = -EFAULT;
+		goto fail;
+	}
+
+	rzs.disk->queue = blk_alloc_queue(GFP_KERNEL);
+	if (rzs.disk->queue == NULL) {
+		pr_err(C "Cannot register disk queue\n");
+		ret = -EFAULT;
+		goto fail;
+	}
+
+	set_capacity(rzs.disk, rzs.disksize >> SECTOR_SHIFT);
+	blk_queue_make_request(rzs.disk->queue, ramzswap_make_request);
+
+#ifdef QUEUE_FLAG_NONROT
+	/*
+	 * Assuming backing device is "rotational" type.
+	 * TODO: check if its actually "non-rotational" (SSD).
+	 *
+	 * We have ident mapping of sectors for ramzswap and
+	 * and the backing swap device. So, this queue flag
+	 * should be according to backing dev.
+	 */
+	if (!rzs.backing_swap)
+		queue_flag_set_unlocked(QUEUE_FLAG_NONROT, rzs.disk->queue);
+#endif
+#ifdef SWAP_DISCARD_SUPPORTED
+	blk_queue_set_discard(rzs.disk->queue, ramzswap_prepare_discard);
+#endif
+	blk_queue_logical_block_size(rzs.disk->queue, PAGE_SIZE);
+	add_disk(rzs.disk);
+
+	rzs.mem_pool = xv_create_pool();
+	if (!rzs.mem_pool) {
+		pr_err(C "Error creating memory pool\n");
+		ret = -ENOMEM;
+		goto fail;
+	}
+
+#if defined(STATS)
+	proc = create_proc_entry("ramzswap", S_IRUGO, NULL);
+	if (proc)
+		proc->read_proc = &proc_ramzswap_read;
+	else {
+		ret = -ENOMEM;
+		pr_warning(C "Error creating proc entry\n");
+		goto fail;
+	}
+#endif
+
+	/*
+	 * Pages that compress to size greater than this are forwarded
+	 * to physical swap disk (if backing dev is provided)
+	 */
+	if (rzs.backing_swap)
+		MAX_CPAGE_SIZE = MAX_CPAGE_SIZE_BDEV;
+	else
+		MAX_CPAGE_SIZE = MAX_CPAGE_SIZE_NOBDEV;
+
+	pr_debug(C "Max compressed page size: %u bytes\n", MAX_CPAGE_SIZE);
+
+	pr_debug(C "Initialization done!\n");
+	return 0;
+
+fail:
+	if (rzs.disk != NULL) {
+		if (rzs.disk->major > 0)
+			unregister_blkdev(rzs.disk->major, rzs.disk->disk_name);
+		del_gendisk(rzs.disk);
+	}
+
+	if (rzs.table && rzs.table[0].pagenum)
+		__free_page(pfn_to_page(rzs.table[0].pagenum));
+	kfree(rzs.compress_workmem);
+	kfree(rzs.compress_buffer);
+	vfree(rzs.table);
+	xv_destroy_pool(rzs.mem_pool);
+#if defined(STATS)
+	if (proc)
+		remove_proc_entry("ramzswap", proc->parent);
+#endif
+	pr_err(C "Initialization failed: err=%d\n", ret);
+	return ret;
+}
+
+static void __exit ramzswap_exit(void)
+{
+	size_t index, num_pages;
+	num_pages = rzs.disksize >> PAGE_SHIFT;
+
+	unregister_blkdev(rzs.disk->major, rzs.disk->disk_name);
+	del_gendisk(rzs.disk);
+
+	/* Close backing swap device (if present) */
+	if (rzs.backing_swap) {
+		set_blocksize(rzs.backing_swap, rzs.old_block_size);
+		bd_release(rzs.backing_swap);
+		filp_close(rzs.swap_file, NULL);
+	}
+
+	__free_page(pfn_to_page(rzs.table[0].pagenum));
+	kfree(rzs.compress_workmem);
+	kfree(rzs.compress_buffer);
+
+	/* Free all pages that are still in ramzswap */
+	for (index = 1; index < num_pages; index++) {
+		u32 pagenum, offset;
+
+		pagenum = rzs.table[index].pagenum;
+		offset = rzs.table[index].offset;
+
+		if (!pagenum)
+			continue;
+
+		if (unlikely(test_flag(index, RZS_UNCOMPRESSED)))
+			__free_page(pfn_to_page(pagenum));
+		else
+			xv_free(rzs.mem_pool, pagenum, offset);
+	}
+
+	vfree(rzs.table);
+	xv_destroy_pool(rzs.mem_pool);
+
+#if defined(STATS)
+	remove_proc_entry("ramzswap", proc->parent);
+#endif
+	pr_debug(C "cleanup done!\n");
+}
+
+/*
+ * This param is applicable only when there is no backing swap device.
+ * We ignore this param in case backing dev is provided since then its
+ * always equal to size of the backing swap device.
+ *
+ * This size refers to amount of (uncompressed) data it can hold.
+ * For e.g. disksize_kb=1024 means it can hold 1024kb worth of
+ * uncompressed data even if this data compresses to just, say, 100kb.
+ *
+ * Default value is used if this param is missing or 0 (if its applicable).
+ * Default: [DEFAULT_DISKSIZE_PERC_RAM]% of RAM
+ */
+module_param(disksize_kb, ulong, 0);
+MODULE_PARM_DESC(disksize_kb, "ramzswap device size (kB)");
+
+/*
+ * This param is applicable only when backing swap device is provided.
+ * This refers to limit on amount of (compressed) data it can hold in
+ * memory. Note that total amount of memory used (MemUsedTotal) can
+ * exceed this memlimit since that includes memory wastage due to
+ * fragmentation and metadata overhead.
+ *
+ * Any additional data beyond this limit is forwarded to backing
+ * swap device. TODO: allow changing memlimit at runtime.
+ *
+ * Default value is used if this param is missing or 0 (if its applicable).
+ * Default: MIN([DEFAULT_MEMLIMIT_PERC_RAM]% of RAM, Backing Device Size)
+ */
+module_param(memlimit_kb, ulong, 0);
+MODULE_PARM_DESC(memlimit_kb, "ramzswap memory limit (kB)");
+
+/*
+ * This is block device to be used as backing store for ramzswap.
+ * When pages more than memlimit_kb as swapped to ramzswap, we store
+ * any additional pages in this device. We may also move some pages
+ * from ramzswap to this device in case system is really low on
+ * memory (TODO).
+ *
+ * This device is not directly visible to kernel as a swap device
+ * (/proc/swaps will only show /dev/ramzswap0 and not this device).
+ * Managing this backing device is the job of ramzswap module.
+ */
+module_param(backing_swap, charp, 0);
+MODULE_PARM_DESC(backing_swap, "Backing swap partition");
+
+module_init(ramzswap_init);
+module_exit(ramzswap_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Nitin Gupta <ngupta@vflare.org>");
+MODULE_DESCRIPTION("Compressed RAM Based Swap Device");
--- linux-rt-2.6.31.orig/ubuntu/compcache/ramzswap.h
+++ linux-rt-2.6.31/ubuntu/compcache/ramzswap.h
@@ -0,0 +1,159 @@
+/*
+ * Compressed RAM based swap device
+ *
+ * Copyright (C) 2008, 2009  Nitin Gupta
+ *
+ * This RAM based block device acts as swap disk.
+ * Pages swapped to this device are compressed and
+ * stored in memory.
+ *
+ * Released under the terms of GNU General Public License Version 2.0
+ *
+ * Project home: http://compcache.googlecode.com
+ */
+
+#ifndef _RAMZSWAP_H_
+#define _RAMZSWAP_H_
+
+#include "xvmalloc.h"
+
+/*
+ * Stored at beginning of each compressed object.
+ *
+ * It stores back-reference to table entry which points to this
+ * object. This is required to support memory defragmentation or
+ * migrating compressed pages to backing swap disk.
+ */
+struct zobj_header {
+#if 0
+	u32 table_idx;
+#endif
+};
+
+/*-- Configurable parameters */
+
+/* Default ramzswap disk size: 25% of total RAM */
+#define DEFAULT_DISKSIZE_PERC_RAM	25
+#define DEFAULT_MEMLIMIT_PERC_RAM	15
+
+/*
+ * Max compressed page size when backing device is provided.
+ * Pages that compress to size greater than this are sent to
+ * physical swap disk.
+ */
+#define MAX_CPAGE_SIZE_BDEV	(PAGE_SIZE / 2)
+
+/*
+ * Max compressed page size when there is no backing dev.
+ * Pages that compress to size greater than this are stored
+ * uncompressed in memory.
+ */
+#define MAX_CPAGE_SIZE_NOBDEV	(PAGE_SIZE / 4 * 3)
+
+/*
+ * NOTE: MAX_CPAGE_SIZE_{BDEV,NOBDEV} sizes must be
+ * less than or equal to:
+ *   XV_MAX_ALLOC_SIZE - sizeof(struct zobj_header)
+ * since otherwise xvMalloc would always return failure.
+ */
+
+/*-- End of configurable params */
+
+#define SECTOR_SHIFT		9
+#define SECTOR_SIZE		(1 << SECTOR_SHIFT)
+#define SECTORS_PER_PAGE_SHIFT	(PAGE_SHIFT - SECTOR_SHIFT)
+#define SECTORS_PER_PAGE	(1 << SECTORS_PER_PAGE_SHIFT)
+
+/* Message prefix */
+#define C "ramzswap: "
+
+/* Debugging and Stats */
+#define NOP	do { } while (0)
+
+#if defined(CONFIG_BLK_DEV_RAMZSWAP_STATS)
+#define STATS
+#endif
+
+#if defined(STATS)
+#define stat_inc(stat)			((stat)++)
+#define stat_dec(stat)			((stat)--)
+#define stat_inc_if_less(stat, val1, val2) \
+				((stat) += ((val1) < (val2) ? 1 : 0))
+#define stat_dec_if_less(stat, val1, val2) \
+				((stat) -= ((val1) < (val2) ? 1 : 0))
+#else	/* STATS */
+#define stat_inc(x)			NOP
+#define stat_dec(x)			NOP
+#define stat_inc_if_less(x, v1, v2)	NOP
+#define stat_dec_if_less(x, v1, v2)	NOP
+#endif	/* STATS */
+
+/* Flags for ramzswap pages (table[page_no].flags) */
+enum rzs_pageflags {
+	/* Page is stored uncompressed */
+	RZS_UNCOMPRESSED,
+
+	/* Page consists entirely of zeros */
+	RZS_ZERO,
+
+	__NR_RZS_PAGEFLAGS,
+};
+
+/*-- Data structures */
+
+/* Indexed by page no. */
+struct table {
+	u32 pagenum;
+	u16 offset;
+	u8 count;	/* object ref count (not yet used) */
+	u8 flags;
+};
+
+struct ramzswap {
+	struct xv_pool *mem_pool;
+	void *compress_workmem;
+	void *compress_buffer;
+	struct table *table;
+	struct mutex lock;
+	struct gendisk *disk;
+	/*
+	 * This is limit on compressed data size (stats.compr_size)
+	 * Its applicable only when backing swap device is present.
+	 */
+	size_t memlimit;	/* bytes */
+	/*
+	 * This is limit on amount of *uncompressed* worth of data
+	 * we can hold. When backing swap device is provided, it is
+	 * set equal to device size.
+	 */
+	size_t disksize;	/* bytes */
+
+	/* backing swap device info */
+	struct block_device *backing_swap;
+	struct file *swap_file;
+	int old_block_size;
+};
+
+struct ramzswap_stats {
+	/* basic stats */
+	size_t compr_size;	/* compressed size of pages stored -
+				 * needed to enforce memlimit */
+	/* more stats */
+#if defined(STATS)
+	u64 num_reads;		/* failed + successful */
+	u64 num_writes;		/* --do-- */
+	u64 failed_reads;	/* can happen when memory is too low */
+	u64 failed_writes;	/* should NEVER! happen */
+	u64 invalid_io;		/* non-swap I/O requests */
+	u64 pages_discard;	/* no. of pages freed by discard callback */
+	u32 pages_zero;		/* no. of zero filled pages */
+	u32 pages_stored;	/* no. of pages currently stored */
+	u32 good_compress;	/* no. of pages with compression ratio<=50% */
+	u32 pages_expand;	/* no. of incompressible pages */
+	u64 bdev_num_reads;	/* no. of reads on backing dev */
+	u64 bdev_num_writes;	/* no. of writes on backing dev */
+#endif
+};
+/*-- */
+
+#endif
--- linux-rt-2.6.31.orig/ubuntu/compcache/compat.h
+++ linux-rt-2.6.31/ubuntu/compcache/compat.h
@@ -0,0 +1,34 @@
+#ifndef _CCACHE_COMPAT_H_
+#define _CCACHE_COMPAT_H_
+
+#include <linux/version.h>
+
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,23)
+#define BIO_IO_ERROR(bio)	bio_io_error(bio, PAGE_SIZE)
+#define BIO_ENDIO(bio, error)	bio_endio(bio, PAGE_SIZE, error)
+#else
+#define BIO_IO_ERROR(bio)	bio_io_error(bio)
+#define BIO_ENDIO(bio, error)	bio_endio(bio, error)
+#endif
+
+#ifndef pr_err
+#define pr_err(fmt, arg...) \
+	printk(KERN_ERR fmt, ##arg)
+#endif
+
+#ifndef pr_warning
+#define pr_warning(fmt, arg...) \
+	printk(KERN_WARNING fmt, ##arg)
+#endif
+
+#ifndef pr_info
+#define pr_info(fmt, arg...) \
+	printk(KERN_ERR fmt, ##arg)
+#endif
+
+#ifdef bio_discard
+#define SWAP_DISCARD_SUPPORTED
+#endif
+
+#endif
+
--- linux-rt-2.6.31.orig/ubuntu/compcache/README
+++ linux-rt-2.6.31/ubuntu/compcache/README
@@ -0,0 +1,45 @@
+ramzswap: Compressed RAM based swap device
+-------------------------------------------
+
+Project home: http://compcache.googlecode.com
+
+* Introduction
+This is a RAM based block device which acts as swap disk.
+Pages swapped to this device are compressed and stored in
+memory itself. See project home for use cases, performance
+numbers and lot more.
+
+* Compiling
+ - Run 'make': this will compile all modules against your kernel.
+
+ - Following kernel modules are created:
+   - xvmalloc.ko
+   - ramzswap.ko
+
+* Using
+ - Following scipts are included
+   - use_ramzswap.sh [<disksize(KB)|<memlimit(KB)>] [<backing_swap>]
+     This loads all required modules and sets up swap device.
+     NOTE: script contains detailed documentation on parameters.
+
+   - unuse_ramzswap.sh
+     Unloads all modules and turns off ramzswap swap device.
+
+* Common Problems
+ - If you get lots of compile errors, make sure you have package for
+   kernel source installed. For e.g., on Fedora its 'kernel-devel' package.
+
+ - If (un)use_ramzswap scripts fail to work, refer to wiki:
+   http://code.google.com/p/compcache/wiki/CompilingAndUsing
+
+* Notes
+ - Statistics are exported via /proc/ramzswap
+
+Please consider using Issue Tracker:
+http://code.google.com/p/compcache/issues/list
+for reporting any bugs/feature requests.
+
+Cheers!
+Nitin Gupta
+EMail: ngupta at vflare dot org
+
--- linux-rt-2.6.31.orig/ubuntu/compcache/LGPL-2.1.txt
+++ linux-rt-2.6.31/ubuntu/compcache/LGPL-2.1.txt
@@ -0,0 +1,510 @@
+
+                  GNU LESSER GENERAL PUBLIC LICENSE
+                       Version 2.1, February 1999
+
+ Copyright (C) 1991, 1999 Free Software Foundation, Inc.
+	51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+[This is the first released version of the Lesser GPL.  It also counts
+ as the successor of the GNU Library Public License, version 2, hence
+ the version number 2.1.]
+
+                            Preamble
+
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+Licenses are intended to guarantee your freedom to share and change
+free software--to make sure the software is free for all its users.
+
+  This license, the Lesser General Public License, applies to some
+specially designated software packages--typically libraries--of the
+Free Software Foundation and other authors who decide to use it.  You
+can use it too, but we suggest you first think carefully about whether
+this license or the ordinary General Public License is the better
+strategy to use in any particular case, based on the explanations
+below.
+
+  When we speak of free software, we are referring to freedom of use,
+not price.  Our General Public Licenses are designed to make sure that
+you have the freedom to distribute copies of free software (and charge
+for this service if you wish); that you receive source code or can get
+it if you want it; that you can change the software and use pieces of
+it in new free programs; and that you are informed that you can do
+these things.
+
+  To protect your rights, we need to make restrictions that forbid
+distributors to deny you these rights or to ask you to surrender these
+rights.  These restrictions translate to certain responsibilities for
+you if you distribute copies of the library or if you modify it.
+
+  For example, if you distribute copies of the library, whether gratis
+or for a fee, you must give the recipients all the rights that we gave
+you.  You must make sure that they, too, receive or can get the source
+code.  If you link other code with the library, you must provide
+complete object files to the recipients, so that they can relink them
+with the library after making changes to the library and recompiling
+it.  And you must show them these terms so they know their rights.
+
+  We protect your rights with a two-step method: (1) we copyright the
+library, and (2) we offer you this license, which gives you legal
+permission to copy, distribute and/or modify the library.
+
+  To protect each distributor, we want to make it very clear that
+there is no warranty for the free library.  Also, if the library is
+modified by someone else and passed on, the recipients should know
+that what they have is not the original version, so that the original
+author's reputation will not be affected by problems that might be
+introduced by others.
+
+  Finally, software patents pose a constant threat to the existence of
+any free program.  We wish to make sure that a company cannot
+effectively restrict the users of a free program by obtaining a
+restrictive license from a patent holder.  Therefore, we insist that
+any patent license obtained for a version of the library must be
+consistent with the full freedom of use specified in this license.
+
+  Most GNU software, including some libraries, is covered by the
+ordinary GNU General Public License.  This license, the GNU Lesser
+General Public License, applies to certain designated libraries, and
+is quite different from the ordinary General Public License.  We use
+this license for certain libraries in order to permit linking those
+libraries into non-free programs.
+
+  When a program is linked with a library, whether statically or using
+a shared library, the combination of the two is legally speaking a
+combined work, a derivative of the original library.  The ordinary
+General Public License therefore permits such linking only if the
+entire combination fits its criteria of freedom.  The Lesser General
+Public License permits more lax criteria for linking other code with
+the library.
+
+  We call this license the "Lesser" General Public License because it
+does Less to protect the user's freedom than the ordinary General
+Public License.  It also provides other free software developers Less
+of an advantage over competing non-free programs.  These disadvantages
+are the reason we use the ordinary General Public License for many
+libraries.  However, the Lesser license provides advantages in certain
+special circumstances.
+
+  For example, on rare occasions, there may be a special need to
+encourage the widest possible use of a certain library, so that it
+becomes a de-facto standard.  To achieve this, non-free programs must
+be allowed to use the library.  A more frequent case is that a free
+library does the same job as widely used non-free libraries.  In this
+case, there is little to gain by limiting the free library to free
+software only, so we use the Lesser General Public License.
+
+  In other cases, permission to use a particular library in non-free
+programs enables a greater number of people to use a large body of
+free software.  For example, permission to use the GNU C Library in
+non-free programs enables many more people to use the whole GNU
+operating system, as well as its variant, the GNU/Linux operating
+system.
+
+  Although the Lesser General Public License is Less protective of the
+users' freedom, it does ensure that the user of a program that is
+linked with the Library has the freedom and the wherewithal to run
+that program using a modified version of the Library.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.  Pay close attention to the difference between a
+"work based on the library" and a "work that uses the library".  The
+former contains code derived from the library, whereas the latter must
+be combined with the library in order to run.
+
+                  GNU LESSER GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License Agreement applies to any software library or other
+program which contains a notice placed by the copyright holder or
+other authorized party saying it may be distributed under the terms of
+this Lesser General Public License (also called "this License").
+Each licensee is addressed as "you".
+
+  A "library" means a collection of software functions and/or data
+prepared so as to be conveniently linked with application programs
+(which use some of those functions and data) to form executables.
+
+  The "Library", below, refers to any such software library or work
+which has been distributed under these terms.  A "work based on the
+Library" means either the Library or any derivative work under
+copyright law: that is to say, a work containing the Library or a
+portion of it, either verbatim or with modifications and/or translated
+straightforwardly into another language.  (Hereinafter, translation is
+included without limitation in the term "modification".)
+
+  "Source code" for a work means the preferred form of the work for
+making modifications to it.  For a library, complete source code means
+all the source code for all modules it contains, plus any associated
+interface definition files, plus the scripts used to control
+compilation and installation of the library.
+
+  Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running a program using the Library is not restricted, and output from
+such a program is covered only if its contents constitute a work based
+on the Library (independent of the use of the Library in a tool for
+writing it).  Whether that is true depends on what the Library does
+and what the program that uses the Library does.
+
+  1. You may copy and distribute verbatim copies of the Library's
+complete source code as you receive it, in any medium, provided that
+you conspicuously and appropriately publish on each copy an
+appropriate copyright notice and disclaimer of warranty; keep intact
+all the notices that refer to this License and to the absence of any
+warranty; and distribute a copy of this License along with the
+Library.
+
+  You may charge a fee for the physical act of transferring a copy,
+and you may at your option offer warranty protection in exchange for a
+fee.
+
+  2. You may modify your copy or copies of the Library or any portion
+of it, thus forming a work based on the Library, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) The modified work must itself be a software library.
+
+    b) You must cause the files modified to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    c) You must cause the whole of the work to be licensed at no
+    charge to all third parties under the terms of this License.
+
+    d) If a facility in the modified Library refers to a function or a
+    table of data to be supplied by an application program that uses
+    the facility, other than as an argument passed when the facility
+    is invoked, then you must make a good faith effort to ensure that,
+    in the event an application does not supply such function or
+    table, the facility still operates, and performs whatever part of
+    its purpose remains meaningful.
+
+    (For example, a function in a library to compute square roots has
+    a purpose that is entirely well-defined independent of the
+    application.  Therefore, Subsection 2d requires that any
+    application-supplied function or table used by this function must
+    be optional: if the application does not supply it, the square
+    root function must still compute square roots.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Library,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Library, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote
+it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Library.
+
+In addition, mere aggregation of another work not based on the Library
+with the Library (or with a work based on the Library) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+  3. You may opt to apply the terms of the ordinary GNU General Public
+License instead of this License to a given copy of the Library.  To do
+this, you must alter all the notices that refer to this License, so
+that they refer to the ordinary GNU General Public License, version 2,
+instead of to this License.  (If a newer version than version 2 of the
+ordinary GNU General Public License has appeared, then you can specify
+that version instead if you wish.)  Do not make any other change in
+these notices.
+
+  Once this change is made in a given copy, it is irreversible for
+that copy, so the ordinary GNU General Public License applies to all
+subsequent copies and derivative works made from that copy.
+
+  This option is useful when you wish to copy part of the code of
+the Library into a program that is not a library.
+
+  4. You may copy and distribute the Library (or a portion or
+derivative of it, under Section 2) in object code or executable form
+under the terms of Sections 1 and 2 above provided that you accompany
+it with the complete corresponding machine-readable source code, which
+must be distributed under the terms of Sections 1 and 2 above on a
+medium customarily used for software interchange.
+
+  If distribution of object code is made by offering access to copy
+from a designated place, then offering equivalent access to copy the
+source code from the same place satisfies the requirement to
+distribute the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  5. A program that contains no derivative of any portion of the
+Library, but is designed to work with the Library by being compiled or
+linked with it, is called a "work that uses the Library".  Such a
+work, in isolation, is not a derivative work of the Library, and
+therefore falls outside the scope of this License.
+
+  However, linking a "work that uses the Library" with the Library
+creates an executable that is a derivative of the Library (because it
+contains portions of the Library), rather than a "work that uses the
+library".  The executable is therefore covered by this License.
+Section 6 states terms for distribution of such executables.
+
+  When a "work that uses the Library" uses material from a header file
+that is part of the Library, the object code for the work may be a
+derivative work of the Library even though the source code is not.
+Whether this is true is especially significant if the work can be
+linked without the Library, or if the work is itself a library.  The
+threshold for this to be true is not precisely defined by law.
+
+  If such an object file uses only numerical parameters, data
+structure layouts and accessors, and small macros and small inline
+functions (ten lines or less in length), then the use of the object
+file is unrestricted, regardless of whether it is legally a derivative
+work.  (Executables containing this object code plus portions of the
+Library will still fall under Section 6.)
+
+  Otherwise, if the work is a derivative of the Library, you may
+distribute the object code for the work under the terms of Section 6.
+Any executables containing that work also fall under Section 6,
+whether or not they are linked directly with the Library itself.
+
+  6. As an exception to the Sections above, you may also combine or
+link a "work that uses the Library" with the Library to produce a
+work containing portions of the Library, and distribute that work
+under terms of your choice, provided that the terms permit
+modification of the work for the customer's own use and reverse
+engineering for debugging such modifications.
+
+  You must give prominent notice with each copy of the work that the
+Library is used in it and that the Library and its use are covered by
+this License.  You must supply a copy of this License.  If the work
+during execution displays copyright notices, you must include the
+copyright notice for the Library among them, as well as a reference
+directing the user to the copy of this License.  Also, you must do one
+of these things:
+
+    a) Accompany the work with the complete corresponding
+    machine-readable source code for the Library including whatever
+    changes were used in the work (which must be distributed under
+    Sections 1 and 2 above); and, if the work is an executable linked
+    with the Library, with the complete machine-readable "work that
+    uses the Library", as object code and/or source code, so that the
+    user can modify the Library and then relink to produce a modified
+    executable containing the modified Library.  (It is understood
+    that the user who changes the contents of definitions files in the
+    Library will not necessarily be able to recompile the application
+    to use the modified definitions.)
+
+    b) Use a suitable shared library mechanism for linking with the
+    Library.  A suitable mechanism is one that (1) uses at run time a
+    copy of the library already present on the user's computer system,
+    rather than copying library functions into the executable, and (2)
+    will operate properly with a modified version of the library, if
+    the user installs one, as long as the modified version is
+    interface-compatible with the version that the work was made with.
+
+    c) Accompany the work with a written offer, valid for at least
+    three years, to give the same user the materials specified in
+    Subsection 6a, above, for a charge no more than the cost of
+    performing this distribution.
+
+    d) If distribution of the work is made by offering access to copy
+    from a designated place, offer equivalent access to copy the above
+    specified materials from the same place.
+
+    e) Verify that the user has already received a copy of these
+    materials or that you have already sent this user a copy.
+
+  For an executable, the required form of the "work that uses the
+Library" must include any data and utility programs needed for
+reproducing the executable from it.  However, as a special exception,
+the materials to be distributed need not include anything that is
+normally distributed (in either source or binary form) with the major
+components (compiler, kernel, and so on) of the operating system on
+which the executable runs, unless that component itself accompanies
+the executable.
+
+  It may happen that this requirement contradicts the license
+restrictions of other proprietary libraries that do not normally
+accompany the operating system.  Such a contradiction means you cannot
+use both them and the Library together in an executable that you
+distribute.
+
+  7. You may place library facilities that are a work based on the
+Library side-by-side in a single library together with other library
+facilities not covered by this License, and distribute such a combined
+library, provided that the separate distribution of the work based on
+the Library and of the other library facilities is otherwise
+permitted, and provided that you do these two things:
+
+    a) Accompany the combined library with a copy of the same work
+    based on the Library, uncombined with any other library
+    facilities.  This must be distributed under the terms of the
+    Sections above.
+
+    b) Give prominent notice with the combined library of the fact
+    that part of it is a work based on the Library, and explaining
+    where to find the accompanying uncombined form of the same work.
+
+  8. You may not copy, modify, sublicense, link with, or distribute
+the Library except as expressly provided under this License.  Any
+attempt otherwise to copy, modify, sublicense, link with, or
+distribute the Library is void, and will automatically terminate your
+rights under this License.  However, parties who have received copies,
+or rights, from you under this License will not have their licenses
+terminated so long as such parties remain in full compliance.
+
+  9. You are not required to accept this License, since you have not
+signed it.  However, nothing else grants you permission to modify or
+distribute the Library or its derivative works.  These actions are
+prohibited by law if you do not accept this License.  Therefore, by
+modifying or distributing the Library (or any work based on the
+Library), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Library or works based on it.
+
+  10. Each time you redistribute the Library (or any work based on the
+Library), the recipient automatically receives a license from the
+original licensor to copy, distribute, link with or modify the Library
+subject to these terms and conditions.  You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties with
+this License.
+
+  11. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Library at all.  For example, if a patent
+license would not permit royalty-free redistribution of the Library by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Library.
+
+If any portion of this section is held invalid or unenforceable under
+any particular circumstance, the balance of the section is intended to
+apply, and the section as a whole is intended to apply in other
+circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system which is
+implemented by public license practices.  Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+  12. If the distribution and/or use of the Library is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Library under this License
+may add an explicit geographical distribution limitation excluding those
+countries, so that distribution is permitted only in or among
+countries not thus excluded.  In such case, this License incorporates
+the limitation as if written in the body of this License.
+
+  13. The Free Software Foundation may publish revised and/or new
+versions of the Lesser General Public License from time to time.
+Such new versions will be similar in spirit to the present version,
+but may differ in detail to address new problems or concerns.
+
+Each version is given a distinguishing version number.  If the Library
+specifies a version number of this License which applies to it and
+"any later version", you have the option of following the terms and
+conditions either of that version or of any later version published by
+the Free Software Foundation.  If the Library does not specify a
+license version number, you may choose any version ever published by
+the Free Software Foundation.
+
+  14. If you wish to incorporate parts of the Library into other free
+programs whose distribution conditions are incompatible with these,
+write to the author to ask for permission.  For software which is
+copyrighted by the Free Software Foundation, write to the Free
+Software Foundation; we sometimes make exceptions for this.  Our
+decision will be guided by the two goals of preserving the free status
+of all derivatives of our free software and of promoting the sharing
+and reuse of software generally.
+
+                            NO WARRANTY
+
+  15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO
+WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW.
+EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR
+OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY
+KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE
+LIBRARY IS WITH YOU.  SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME
+THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN
+WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY
+AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU
+FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR
+CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE
+LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING
+RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A
+FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF
+SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
+DAMAGES.
+
+                     END OF TERMS AND CONDITIONS
+
+           How to Apply These Terms to Your New Libraries
+
+  If you develop a new library, and you want it to be of the greatest
+possible use to the public, we recommend making it free software that
+everyone can redistribute and change.  You can do so by permitting
+redistribution under these terms (or, alternatively, under the terms
+of the ordinary General Public License).
+
+  To apply these terms, attach the following notices to the library.
+It is safest to attach them to the start of each source file to most
+effectively convey the exclusion of warranty; and each file should
+have at least the "copyright" line and a pointer to where the full
+notice is found.
+
+
+    <one line to give the library's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Lesser General Public
+    License as published by the Free Software Foundation; either
+    version 2.1 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Lesser General Public License for more details.
+
+    You should have received a copy of the GNU Lesser General Public
+    License along with this library; if not, write to the Free Software
+    Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+
+Also add information on how to contact you by electronic and paper mail.
+
+You should also get your employer (if you work as a programmer) or
+your school, if any, to sign a "copyright disclaimer" for the library,
+if necessary.  Here is a sample; alter the names:
+
+  Yoyodyne, Inc., hereby disclaims all copyright interest in the
+  library `Frob' (a library for tweaking knobs) written by James
+  Random Hacker.
+
+  <signature of Ty Coon>, 1 April 1990
+  Ty Coon, President of Vice
+
+That's all there is to it!
+
+
--- linux-rt-2.6.31.orig/ubuntu/compcache/xvmalloc.h
+++ linux-rt-2.6.31/ubuntu/compcache/xvmalloc.h
@@ -0,0 +1,30 @@
+/*
+ * xvmalloc.h
+ *
+ * Copyright (C) 2008, 2009  Nitin Gupta
+ *
+ * This code is released using a dual license strategy: GPL/LGPL
+ * You can choose the licence that better fits your requirements.
+ *
+ * Released under the terms of GNU General Public License Version 2.0
+ * Released under the terms of GNU Lesser General Public License Version 2.1
+ */
+
+#ifndef _XVMALLOC_H_
+#define _XVMALLOC_H_
+
+#include <linux/types.h>
+
+struct xv_pool;
+
+struct xv_pool *xv_create_pool(void);
+void xv_destroy_pool(struct xv_pool *pool);
+
+int xv_malloc(struct xv_pool *pool, u32 size, u32 *pagenum, u32 *offset,
+							gfp_t flags);
+void xv_free(struct xv_pool *pool, u32 pagenum, u32 offset);
+
+u32 xv_get_object_size(void *obj);
+u64 xv_get_total_size_bytes(struct xv_pool *pool);
+
+#endif
--- linux-rt-2.6.31.orig/ipc/shm.c
+++ linux-rt-2.6.31/ipc/shm.c
@@ -290,28 +290,28 @@
 	unsigned long flags)
 {
 	struct shm_file_data *sfd = shm_file_data(file);
-	return get_unmapped_area(sfd->file, addr, len, pgoff, flags);
-}
-
-int is_file_shm_hugepages(struct file *file)
-{
-	int ret = 0;
-
-	if (file->f_op == &shm_file_operations) {
-		struct shm_file_data *sfd;
-		sfd = shm_file_data(file);
-		ret = is_file_hugepages(sfd->file);
-	}
-	return ret;
+	return sfd->file->f_op->get_unmapped_area(sfd->file, addr, len,
+						pgoff, flags);
 }
 
 static const struct file_operations shm_file_operations = {
 	.mmap		= shm_mmap,
 	.fsync		= shm_fsync,
 	.release	= shm_release,
+};
+
+static const struct file_operations shm_file_operations_huge = {
+	.mmap           = shm_mmap,
+	.fsync          = shm_fsync,
+	.release        = shm_release,
 	.get_unmapped_area	= shm_get_unmapped_area,
 };
 
+int is_file_shm_hugepages(struct file *file)
+{
+	return file->f_op == &shm_file_operations_huge;
+}
+
 static struct vm_operations_struct shm_vm_ops = {
 	.open	= shm_open,	/* callback for a new vm-area open */
 	.close	= shm_close,	/* callback for when the vm-area is released */
@@ -410,7 +410,7 @@
 	return error;
 
 no_id:
-	if (shp->mlock_user)	/* shmflg & SHM_HUGETLB case */
+	if (is_file_hugepages(file) && shp->mlock_user)
 		user_shm_unlock(size, shp->mlock_user);
 	fput(file);
 no_file:
@@ -889,7 +889,10 @@
 	if (!sfd)
 		goto out_put_dentry;
 
-	file = alloc_file(path.mnt, path.dentry, f_mode, &shm_file_operations);
+	file = alloc_file(path.mnt, path.dentry, f_mode,
+			is_file_hugepages(shp->shm_file) ?
+				&shm_file_operations_huge :
+				&shm_file_operations);
 	if (!file)
 		goto out_free;
 	ima_counts_get(file);